xref: /illumos-gate/usr/src/uts/common/inet/ipclassifier.h (revision e82490700e19f1b8a2cef6102f4726144d281988)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  */
25 
26 /*
27  * Copyright 2020 OmniOS Community Edition (OmniOSce) Association.
28  */
29 
30 #ifndef	_INET_IPCLASSIFIER_H
31 #define	_INET_IPCLASSIFIER_H
32 
33 #ifdef	__cplusplus
34 extern "C" {
35 #endif
36 
37 #include <inet/common.h>
38 #include <inet/ip.h>
39 #include <inet/mi.h>
40 #include <inet/tcp.h>
41 #include <inet/ip6.h>
42 #include <netinet/in.h>		/* for IPPROTO_* constants */
43 #include <sys/sdt.h>
44 #include <sys/socket_proto.h>
45 #include <sys/sunddi.h>
46 #include <sys/sunldi.h>
47 
48 typedef void (*edesc_rpf)(void *, mblk_t *, void *, ip_recv_attr_t *);
49 struct icmph_s;
50 struct icmp6_hdr;
51 typedef boolean_t (*edesc_vpf)(conn_t *, void *, struct icmph_s *,
52     struct icmp6_hdr *, ip_recv_attr_t *);
53 
54 /*
55  * ==============================
56  * =	The CONNECTION		=
57  * ==============================
58  */
59 
60 /*
61  * The connection structure contains the common information/flags/ref needed.
62  * Implementation will keep the connection struct, the layers (with their
63  * respective data for event i.e. tcp_t if event was tcp_input_data) all in one
64  * contiguous memory location.
65  */
66 
67 /* Conn Flags */
68 /* Unused			0x00020000 */
69 /* Unused			0x00040000 */
70 #define	IPCL_FULLY_BOUND	0x00080000	/* Bound to correct squeue */
71 /* Unused			0x00100000 */
72 /* Unused			0x00200000 */
73 /* Unused			0x00400000 */
74 #define	IPCL_CL_LISTENER	0x00800000	/* Cluster listener */
75 /* Unused			0x01000000 */
76 /* Unused			0x02000000 */
77 /* Unused			0x04000000 */
78 /* Unused			0x08000000 */
79 /* Unused			0x10000000 */
80 /* Unused			0x20000000 */
81 #define	IPCL_CONNECTED		0x40000000	/* Conn in connected table */
82 #define	IPCL_BOUND		0x80000000	/* Conn in bind table */
83 
84 /* Flags identifying the type of conn */
85 #define	IPCL_TCPCONN		0x00000001	/* From tcp_conn_cache */
86 #define	IPCL_SCTPCONN		0x00000002	/* From sctp_conn_cache */
87 #define	IPCL_IPCCONN		0x00000004	/* From ip_conn_cache */
88 #define	IPCL_UDPCONN		0x00000008	/* From udp_conn_cache */
89 #define	IPCL_RAWIPCONN		0x00000010	/* From rawip_conn_cache */
90 #define	IPCL_RTSCONN		0x00000020	/* From rts_conn_cache */
91 /* Unused			0x00000040 */
92 #define	IPCL_IPTUN		0x00000080	/* iptun module above us */
93 
94 #define	IPCL_NONSTR		0x00001000	/* A non-STREAMS socket */
95 /* Unused			0x10000000 */
96 
97 #define	IPCL_REMOVED		0x00000100
98 #define	IPCL_REUSED		0x00000200
99 
100 #define	IPCL_IS_CONNECTED(connp)					\
101 	((connp)->conn_flags & IPCL_CONNECTED)
102 
103 #define	IPCL_IS_BOUND(connp)						\
104 	((connp)->conn_flags & IPCL_BOUND)
105 
106 /*
107  * Can't use conn_proto since we need to tell difference
108  * between a real TCP socket and a SOCK_RAW, IPPROTO_TCP.
109  */
110 #define	IPCL_IS_TCP(connp)						\
111 	((connp)->conn_flags & IPCL_TCPCONN)
112 
113 #define	IPCL_IS_SCTP(connp)						\
114 	((connp)->conn_flags & IPCL_SCTPCONN)
115 
116 #define	IPCL_IS_UDP(connp)						\
117 	((connp)->conn_flags & IPCL_UDPCONN)
118 
119 #define	IPCL_IS_RAWIP(connp)						\
120 	((connp)->conn_flags & IPCL_RAWIPCONN)
121 
122 #define	IPCL_IS_RTS(connp)						\
123 	((connp)->conn_flags & IPCL_RTSCONN)
124 
125 #define	IPCL_IS_IPTUN(connp)						\
126 	((connp)->conn_flags & IPCL_IPTUN)
127 
128 #define	IPCL_IS_NONSTR(connp)	((connp)->conn_flags & IPCL_NONSTR)
129 
130 typedef struct connf_s connf_t;
131 
132 typedef struct
133 {
134 	int	ctb_depth;
135 #define	CONN_STACK_DEPTH	15
136 	pc_t	ctb_stack[CONN_STACK_DEPTH];
137 } conn_trace_t;
138 
139 typedef struct ip_helper_minor_info_s {
140 	dev_t	ip_minfo_dev;		/* Device */
141 	vmem_t	*ip_minfo_arena;	/* Arena */
142 } ip_helper_minfo_t;
143 
144 /*
145  * ip helper stream info
146  */
147 typedef struct ip_helper_stream_info_s {
148 	ldi_handle_t		iphs_handle;
149 	queue_t			*iphs_rq;
150 	queue_t			*iphs_wq;
151 	ip_helper_minfo_t	*iphs_minfo;
152 } ip_helper_stream_info_t;
153 
154 /*
155  * Mandatory Access Control mode, in conn_t's conn_mac_mode field.
156  *	CONN_MAC_DEFAULT: strict enforcement of MAC.
157  *	CONN_MAC_AWARE:   allows communications between unlabeled systems
158  *			  and privileged daemons
159  *	CONN_MAC_IMPLICIT: allows communications without explicit labels
160  *		           on the wire with privileged daemons.
161  *
162  * CONN_MAC_IMPLICIT is intended specifically for labeled IPsec key management
163  * in networks which don't pass CIPSO-labeled packets.
164  */
165 #define	CONN_MAC_DEFAULT 0
166 #define	CONN_MAC_AWARE 1
167 #define	CONN_MAC_IMPLICIT 2
168 
169 /*
170  * conn receive ancillary definition.
171  *
172  * These are the set of socket options that make the receive side
173  * potentially pass up ancillary data items.
174  * We have a union with an integer so that we can quickly check whether
175  * any ancillary data items need to be added.
176  */
177 typedef struct crb_s {
178 	union {
179 		uint32_t	crbu_all;
180 		struct {
181 			uint32_t
182 	crbb_recvdstaddr : 1,		/* IP_RECVDSTADDR option */
183 	crbb_recvopts : 1,		/* IP_RECVOPTS option */
184 	crbb_recvif : 1,		/* IP_RECVIF option */
185 	crbb_recvslla : 1,		/* IP_RECVSLLA option */
186 
187 	crbb_recvttl : 1,		/* IP_RECVTTL option */
188 	crbb_recvtos : 1,		/* IP_RECVTOS option */
189 	crbb_ip_recvpktinfo : 1,	/* IP*_RECVPKTINFO option  */
190 	crbb_ipv6_recvhoplimit : 1,	/* IPV6_RECVHOPLIMIT option */
191 	crbb_ipv6_recvhopopts : 1,	/* IPV6_RECVHOPOPTS option */
192 
193 	crbb_ipv6_recvdstopts : 1,	/* IPV6_RECVDSTOPTS option */
194 	crbb_ipv6_recvrthdr : 1,	/* IPV6_RECVRTHDR option */
195 	crbb_old_ipv6_recvdstopts : 1,	/* old form of IPV6_DSTOPTS */
196 	crbb_ipv6_recvrthdrdstopts : 1,	/* IPV6_RECVRTHDRDSTOPTS */
197 
198 	crbb_ipv6_recvtclass : 1,	/* IPV6_RECVTCLASS */
199 	crbb_recvucred : 1,		/* IP_RECVUCRED option */
200 	crbb_timestamp : 1;		/* SO_TIMESTAMP "socket" option */
201 
202 		} crbb;
203 	} crbu;
204 } crb_t;
205 
206 #define	crb_all				crbu.crbu_all
207 #define	crb_recvdstaddr			crbu.crbb.crbb_recvdstaddr
208 #define	crb_recvopts			crbu.crbb.crbb_recvopts
209 #define	crb_recvif			crbu.crbb.crbb_recvif
210 #define	crb_recvslla			crbu.crbb.crbb_recvslla
211 #define	crb_recvttl			crbu.crbb.crbb_recvttl
212 #define	crb_recvtos			crbu.crbb.crbb_recvtos
213 #define	crb_ip_recvpktinfo		crbu.crbb.crbb_ip_recvpktinfo
214 #define	crb_ipv6_recvhoplimit		crbu.crbb.crbb_ipv6_recvhoplimit
215 #define	crb_ipv6_recvhopopts		crbu.crbb.crbb_ipv6_recvhopopts
216 #define	crb_ipv6_recvdstopts		crbu.crbb.crbb_ipv6_recvdstopts
217 #define	crb_ipv6_recvrthdr		crbu.crbb.crbb_ipv6_recvrthdr
218 #define	crb_old_ipv6_recvdstopts	crbu.crbb.crbb_old_ipv6_recvdstopts
219 #define	crb_ipv6_recvrthdrdstopts	crbu.crbb.crbb_ipv6_recvrthdrdstopts
220 #define	crb_ipv6_recvtclass		crbu.crbb.crbb_ipv6_recvtclass
221 #define	crb_recvucred			crbu.crbb.crbb_recvucred
222 #define	crb_timestamp			crbu.crbb.crbb_timestamp
223 
224 /*
225  * The initial fields in the conn_t are setup by the kmem_cache constructor,
226  * and are preserved when it is freed. Fields after that are bzero'ed when
227  * the conn_t is freed.
228  *
229  * Much of the conn_t is protected by conn_lock.
230  *
231  * conn_lock is also used by some ULPs (like UDP and RAWIP) to protect
232  * their state.
233  */
234 struct conn_s {
235 	kmutex_t	conn_lock;
236 	uint32_t	conn_ref;		/* Reference counter */
237 	uint32_t	conn_flags;		/* Conn Flags */
238 
239 	union {
240 		tcp_t		*cp_tcp;	/* Pointer to the tcp struct */
241 		struct udp_s	*cp_udp;	/* Pointer to the udp struct */
242 		struct icmp_s	*cp_icmp;	/* Pointer to rawip struct */
243 		struct rts_s	*cp_rts;	/* Pointer to rts struct */
244 		struct iptun_s	*cp_iptun;	/* Pointer to iptun_t */
245 		struct sctp_s	*cp_sctp;	/* For IPCL_SCTPCONN */
246 		void		*cp_priv;
247 	} conn_proto_priv;
248 #define	conn_tcp	conn_proto_priv.cp_tcp
249 #define	conn_udp	conn_proto_priv.cp_udp
250 #define	conn_icmp	conn_proto_priv.cp_icmp
251 #define	conn_rts	conn_proto_priv.cp_rts
252 #define	conn_iptun	conn_proto_priv.cp_iptun
253 #define	conn_sctp	conn_proto_priv.cp_sctp
254 #define	conn_priv	conn_proto_priv.cp_priv
255 
256 	kcondvar_t	conn_cv;
257 	uint8_t		conn_proto;		/* protocol type */
258 
259 	edesc_rpf	conn_recv;		/* Pointer to recv routine */
260 	edesc_rpf	conn_recvicmp;		/* For ICMP error */
261 	edesc_vpf	conn_verifyicmp;	/* Verify ICMP error */
262 
263 	ip_xmit_attr_t	*conn_ixa;		/* Options if no ancil data */
264 
265 	/* Fields after this are bzero'ed when the conn_t is freed. */
266 #define	conn_start_clr	conn_recv_ancillary
267 
268 	/* Options for receive-side ancillary data */
269 	crb_t		conn_recv_ancillary;
270 
271 	squeue_t	*conn_sqp;		/* Squeue for processing */
272 	uint_t		conn_state_flags;	/* IP state flags */
273 
274 	int		conn_lingertime;	/* linger time (in seconds) */
275 
276 	unsigned int
277 		conn_on_sqp : 1,		/* Conn is being processed */
278 		conn_linger : 1,		/* SO_LINGER state */
279 		conn_useloopback : 1,		/* SO_USELOOPBACK state */
280 		conn_broadcast : 1,		/* SO_BROADCAST state */
281 
282 		conn_reuseaddr : 1,		/* SO_REUSEADDR state */
283 		conn_keepalive : 1,		/* SO_KEEPALIVE state */
284 		conn_multi_router : 1,		/* Wants all multicast pkts */
285 		conn_unspec_src : 1,		/* IP_UNSPEC_SRC */
286 
287 		conn_policy_cached : 1,		/* Is policy cached/latched ? */
288 		conn_in_enforce_policy : 1,	/* Enforce Policy on inbound */
289 		conn_out_enforce_policy : 1,	/* Enforce Policy on outbound */
290 		conn_debug : 1,			/* SO_DEBUG */
291 
292 		conn_ipv6_v6only : 1,		/* IPV6_V6ONLY */
293 		conn_oobinline : 1,		/* SO_OOBINLINE state */
294 		conn_dgram_errind : 1,		/* SO_DGRAM_ERRIND state */
295 		conn_exclbind : 1,		/* SO_EXCLBIND state */
296 
297 		conn_mdt_ok : 1,		/* MDT is permitted */
298 		conn_allzones : 1,		/* SO_ALLZONES */
299 		conn_ipv6_recvpathmtu : 1,	/* IPV6_RECVPATHMTU */
300 		conn_mcbc_bind : 1,		/* Bound to multi/broadcast */
301 
302 		conn_pad_to_bit_31 : 12;
303 
304 	boolean_t	conn_blocked;		/* conn is flow-controlled */
305 
306 	squeue_t	*conn_initial_sqp;	/* Squeue at open time */
307 	squeue_t	*conn_final_sqp;	/* Squeue after connect */
308 	ill_t		*conn_dhcpinit_ill;	/* IP_DHCPINIT_IF */
309 	ipsec_latch_t	*conn_latch;		/* latched IDS */
310 	struct ipsec_policy_s	*conn_latch_in_policy; /* latched policy (in) */
311 	struct ipsec_action_s	*conn_latch_in_action; /* latched action (in) */
312 	uint_t		conn_bound_if;		/* IP*_BOUND_IF */
313 	queue_t		*conn_rq;		/* Read queue */
314 	queue_t		*conn_wq;		/* Write queue */
315 	dev_t		conn_dev;		/* Minor number */
316 	vmem_t		*conn_minor_arena;	/* Minor arena */
317 	ip_helper_stream_info_t *conn_helper_info;
318 
319 	cred_t		*conn_cred;		/* Credentials */
320 	pid_t		conn_cpid;		/* pid from open/connect */
321 	uint64_t	conn_open_time;		/* time when this was opened */
322 
323 	connf_t		*conn_g_fanout;		/* Global Hash bucket head */
324 	struct conn_s	*conn_g_next;		/* Global Hash chain next */
325 	struct conn_s	*conn_g_prev;		/* Global Hash chain prev */
326 	struct ipsec_policy_head_s *conn_policy; /* Configured policy */
327 	in6_addr_t	conn_bound_addr_v6;	/* Address in bind() */
328 #define	conn_bound_addr_v4	V4_PART_OF_V6(conn_bound_addr_v6)
329 	connf_t		*conn_fanout;		/* Hash bucket we're part of */
330 	struct conn_s	*conn_next;		/* Hash chain next */
331 	struct conn_s	*conn_prev;		/* Hash chain prev */
332 
333 	struct {
334 		in6_addr_t connua_laddr;	/* Local address - match */
335 		in6_addr_t connua_faddr;	/* Remote address */
336 	} connua_v6addr;
337 #define	conn_laddr_v4	V4_PART_OF_V6(connua_v6addr.connua_laddr)
338 #define	conn_faddr_v4	V4_PART_OF_V6(connua_v6addr.connua_faddr)
339 #define	conn_laddr_v6	connua_v6addr.connua_laddr
340 #define	conn_faddr_v6	connua_v6addr.connua_faddr
341 	in6_addr_t	conn_saddr_v6;		/* Local address - source */
342 #define	conn_saddr_v4	V4_PART_OF_V6(conn_saddr_v6)
343 
344 	union {
345 		/* Used for classifier match performance */
346 		uint32_t		connu_ports2;
347 		struct {
348 			in_port_t	connu_fport;	/* Remote port */
349 			in_port_t	connu_lport;	/* Local port */
350 		} connu_ports;
351 	} u_port;
352 #define	conn_fport	u_port.connu_ports.connu_fport
353 #define	conn_lport	u_port.connu_ports.connu_lport
354 #define	conn_ports	u_port.connu_ports2
355 
356 	uint_t		conn_incoming_ifindex;	/* IP{,V6}_BOUND_IF, scopeid */
357 	ill_t		*conn_oper_pending_ill; /* pending shared ioctl */
358 
359 	krwlock_t	conn_ilg_lock;		/* Protects conn_ilg_* */
360 	ilg_t		*conn_ilg;		/* Group memberships */
361 
362 	kcondvar_t	conn_refcv;		/* For conn_oper_pending_ill */
363 
364 	struct conn_s	*conn_drain_next;	/* Next conn in drain list */
365 	struct conn_s	*conn_drain_prev;	/* Prev conn in drain list */
366 	idl_t		*conn_idl;		/* Ptr to the drain list head */
367 	mblk_t		*conn_ipsec_opt_mp;	/* ipsec option mblk */
368 	zoneid_t	conn_zoneid;		/* zone connection is in */
369 	int		conn_rtaware;		/* RT_AWARE sockopt value */
370 	kcondvar_t	conn_sq_cv;		/* For non-STREAMS socket IO */
371 	sock_upcalls_t	*conn_upcalls;		/* Upcalls to sockfs */
372 	sock_upper_handle_t conn_upper_handle;	/* Upper handle: sonode * */
373 
374 	unsigned int
375 		conn_mlp_type : 2,		/* mlp_type_t; tsol/tndb.h */
376 		conn_anon_mlp : 1,		/* user wants anon MLP */
377 		conn_anon_port : 1,		/* user bound anonymously */
378 
379 		conn_mac_mode : 2,		/* normal/loose/implicit MAC */
380 		conn_anon_priv_bind : 1,	/* *_ANON_PRIV_BIND state */
381 		conn_zone_is_global : 1,	/* GLOBAL_ZONEID */
382 		conn_isvrrp : 1,		/* VRRP control socket */
383 		conn_spare : 23;
384 
385 	boolean_t	conn_flow_cntrld;
386 	netstack_t	*conn_netstack;	/* Corresponds to a netstack_hold */
387 
388 	/*
389 	 * IP format that packets received for this struct should use.
390 	 * Value can be IP4_VERSION or IPV6_VERSION.
391 	 * The sending version is encoded using IXAF_IS_IPV4.
392 	 */
393 	ushort_t	conn_ipversion;
394 
395 	/* Written to only once at the time of opening the endpoint */
396 	sa_family_t	conn_family;		/* Family from socket() call */
397 	uint_t		conn_so_type;		/* Type from socket() call */
398 
399 	uint_t		conn_sndbuf;		/* SO_SNDBUF state */
400 	uint_t		conn_rcvbuf;		/* SO_RCVBUF state */
401 	uint_t		conn_wroff;		/* Current write offset */
402 
403 	uint_t		conn_sndlowat;		/* Send buffer low water mark */
404 	uint_t		conn_rcvlowat;		/* Recv buffer low water mark */
405 
406 	uint8_t		conn_default_ttl;	/* Default TTL/hoplimit */
407 	uint8_t		conn_min_ttl;		/* IP_MINTTL+IPV6_MINHOPLIMIT */
408 
409 	uint32_t	conn_flowinfo;	/* Connected flow id and tclass */
410 
411 	/*
412 	 * The most recent address for sendto. Initially set to zero
413 	 * which is always different than then the destination address
414 	 * since the send interprets zero as the loopback address.
415 	 */
416 	in6_addr_t	conn_v6lastdst;
417 #define	conn_v4lastdst	V4_PART_OF_V6(conn_v6lastdst)
418 	ushort_t	conn_lastipversion;
419 	in_port_t	conn_lastdstport;
420 	uint32_t	conn_lastflowinfo;	/* IPv6-only */
421 	uint_t		conn_lastscopeid;	/* IPv6-only */
422 	uint_t		conn_lastsrcid;		/* Only for AF_INET6 */
423 	/*
424 	 * When we are not connected conn_saddr might be unspecified.
425 	 * We track the source that was used with conn_v6lastdst here.
426 	 */
427 	in6_addr_t	conn_v6lastsrc;
428 #define	conn_v4lastsrc	V4_PART_OF_V6(conn_v6lastsrc)
429 
430 	/* Templates for transmitting packets */
431 	ip_pkt_t	conn_xmit_ipp;		/* Options if no ancil data */
432 
433 	/*
434 	 * Header template - conn_ht_ulp is a pointer into conn_ht_iphc.
435 	 * Note that ixa_ip_hdr_length indicates the offset of ht_ulp in
436 	 * ht_iphc
437 	 *
438 	 * The header template is maintained for connected endpoints (and
439 	 * updated when sticky options are changed) and also for the lastdst.
440 	 * There is no conflict between those usages since SOCK_DGRAM and
441 	 * SOCK_RAW can not be used to specify a destination address (with
442 	 * sendto/sendmsg) if the socket has been connected.
443 	 */
444 	uint8_t		*conn_ht_iphc;		/* Start of IP header */
445 	uint_t		conn_ht_iphc_allocated;	/* Allocated buffer size */
446 	uint_t		conn_ht_iphc_len;	/* IP+ULP size */
447 	uint8_t		*conn_ht_ulp;		/* Upper-layer header */
448 	uint_t		conn_ht_ulp_len;	/* ULP header len */
449 
450 	/* Checksum to compensate for source routed packets. Host byte order */
451 	uint32_t	conn_sum;
452 
453 	uint32_t	conn_ioctlref;		/* ioctl ref count */
454 #ifdef CONN_DEBUG
455 #define	CONN_TRACE_MAX	10
456 	int		conn_trace_last;	/* ndx of last used tracebuf */
457 	conn_trace_t	conn_trace_buf[CONN_TRACE_MAX];
458 #endif
459 };
460 
461 /*
462  * connf_t - connection fanout data.
463  *
464  * The hash tables and their linkage (conn_t.{hashnextp, hashprevp} are
465  * protected by the per-bucket lock. Each conn_t inserted in the list
466  * points back at the connf_t that heads the bucket.
467  */
468 struct connf_s {
469 	struct conn_s	*connf_head;
470 	kmutex_t	connf_lock;
471 };
472 
473 #define	CONN_INC_REF(connp)	{				\
474 	mutex_enter(&(connp)->conn_lock);			\
475 	DTRACE_PROBE1(conn__inc__ref, conn_t *, connp);		\
476 	ASSERT(conn_trace_ref(connp));				\
477 	(connp)->conn_ref++;					\
478 	ASSERT((connp)->conn_ref != 0);				\
479 	mutex_exit(&(connp)->conn_lock);			\
480 }
481 
482 #define	CONN_INC_REF_LOCKED(connp)	{			\
483 	DTRACE_PROBE1(conn__inc__ref, conn_t *, connp);		\
484 	ASSERT(MUTEX_HELD(&(connp)->conn_lock));		\
485 	ASSERT(conn_trace_ref(connp));				\
486 	(connp)->conn_ref++;					\
487 	ASSERT((connp)->conn_ref != 0);				\
488 }
489 
490 #define	CONN_DEC_REF(connp)	{					\
491 	mutex_enter(&(connp)->conn_lock);				\
492 	DTRACE_PROBE1(conn__dec__ref, conn_t *, connp);			\
493 	/*								\
494 	 * The squeue framework always does a CONN_DEC_REF after return	\
495 	 * from TCP. Hence the refcnt must be at least 2 if conn_on_sqp	\
496 	 * is B_TRUE and conn_ref is being decremented. This is to	\
497 	 * account for the mblk being currently processed.		\
498 	 */								\
499 	if ((connp)->conn_ref == 0 ||					\
500 	    ((connp)->conn_ref == 1 && (connp)->conn_on_sqp))		\
501 		cmn_err(CE_PANIC, "CONN_DEC_REF: connp(%p) has ref "	\
502 			"= %d\n", (void *)(connp), (connp)->conn_ref);	\
503 	ASSERT(conn_untrace_ref(connp));				\
504 	(connp)->conn_ref--;						\
505 	if ((connp)->conn_ref == 0) {					\
506 		/* Refcnt can't increase again, safe to drop lock */	\
507 		mutex_exit(&(connp)->conn_lock);			\
508 		ipcl_conn_destroy(connp);				\
509 	} else {							\
510 		cv_broadcast(&(connp)->conn_cv);			\
511 		mutex_exit(&(connp)->conn_lock);			\
512 	}								\
513 }
514 
515 /*
516  * For use with subsystems within ip which use ALL_ZONES as a wildcard
517  */
518 #define	IPCL_ZONEID(connp)						\
519 	((connp)->conn_allzones ? ALL_ZONES : (connp)->conn_zoneid)
520 
521 /*
522  * For matching between a conn_t and a zoneid.
523  */
524 #define	IPCL_ZONE_MATCH(connp, zoneid)					\
525 	(((connp)->conn_allzones) ||					\
526 	    ((zoneid) == ALL_ZONES) ||					\
527 	    (connp)->conn_zoneid == (zoneid))
528 
529 /*
530  * On a labeled system, we must treat bindings to ports
531  * on shared IP addresses by sockets with MAC exemption
532  * privilege as being in all zones, as there's
533  * otherwise no way to identify the right receiver.
534  */
535 
536 #define	IPCL_CONNS_MAC(conn1, conn2)					\
537 	(((conn1)->conn_mac_mode != CONN_MAC_DEFAULT) ||		\
538 	((conn2)->conn_mac_mode != CONN_MAC_DEFAULT))
539 
540 #define	IPCL_BIND_ZONE_MATCH(conn1, conn2)				\
541 	(IPCL_CONNS_MAC(conn1, conn2) ||				\
542 	IPCL_ZONE_MATCH(conn1, conn2->conn_zoneid) ||			\
543 	IPCL_ZONE_MATCH(conn2, conn1->conn_zoneid))
544 
545 
546 #define	_IPCL_V4_MATCH(v6addr, v4addr)	\
547 	(V4_PART_OF_V6((v6addr)) == (v4addr) && IN6_IS_ADDR_V4MAPPED(&(v6addr)))
548 
549 #define	_IPCL_V4_MATCH_ANY(addr)	\
550 	(IN6_IS_ADDR_V4MAPPED_ANY(&(addr)) || IN6_IS_ADDR_UNSPECIFIED(&(addr)))
551 
552 
553 /*
554  * IPCL_PROTO_MATCH() and IPCL_PROTO_MATCH_V6() only matches conns with
555  * the specified ira_zoneid or conn_allzones by calling conn_wantpacket.
556  */
557 #define	IPCL_PROTO_MATCH(connp, ira, ipha)				\
558 	((((connp)->conn_laddr_v4 == INADDR_ANY) ||			\
559 	(((connp)->conn_laddr_v4 == ((ipha)->ipha_dst)) &&		\
560 	    (((connp)->conn_faddr_v4 == INADDR_ANY) ||			\
561 	((connp)->conn_faddr_v4 == ((ipha)->ipha_src))))) &&		\
562 	conn_wantpacket((connp), (ira), (ipha)))
563 
564 #define	IPCL_PROTO_MATCH_V6(connp, ira, ip6h)				\
565 	((IN6_IS_ADDR_UNSPECIFIED(&(connp)->conn_laddr_v6) ||		\
566 	(IN6_ARE_ADDR_EQUAL(&(connp)->conn_laddr_v6, &((ip6h)->ip6_dst)) &&   \
567 	(IN6_IS_ADDR_UNSPECIFIED(&(connp)->conn_faddr_v6) ||		      \
568 	IN6_ARE_ADDR_EQUAL(&(connp)->conn_faddr_v6, &((ip6h)->ip6_src))))) && \
569 	(conn_wantpacket_v6((connp), (ira), (ip6h))))
570 
571 #define	IPCL_CONN_HASH(src, ports, ipst)				\
572 	((unsigned)(ntohl((src)) ^ ((ports) >> 24) ^ ((ports) >> 16) ^	\
573 	((ports) >> 8) ^ (ports)) % (ipst)->ips_ipcl_conn_fanout_size)
574 
575 #define	IPCL_CONN_HASH_V6(src, ports, ipst)				\
576 	IPCL_CONN_HASH(V4_PART_OF_V6((src)), (ports), (ipst))
577 
578 #define	IPCL_CONN_MATCH(connp, proto, src, dst, ports)			\
579 	((connp)->conn_proto == (proto) &&				\
580 		(connp)->conn_ports == (ports) &&			\
581 		_IPCL_V4_MATCH((connp)->conn_faddr_v6, (src)) &&	\
582 		_IPCL_V4_MATCH((connp)->conn_laddr_v6, (dst)) &&	\
583 		!(connp)->conn_ipv6_v6only)
584 
585 #define	IPCL_CONN_MATCH_V6(connp, proto, src, dst, ports)		\
586 	((connp)->conn_proto == (proto) &&				\
587 		(connp)->conn_ports == (ports) &&			\
588 		IN6_ARE_ADDR_EQUAL(&(connp)->conn_faddr_v6, &(src)) &&	\
589 		IN6_ARE_ADDR_EQUAL(&(connp)->conn_laddr_v6, &(dst)))
590 
591 #define	IPCL_PORT_HASH(port, size) \
592 	((((port) >> 8) ^ (port)) & ((size) - 1))
593 
594 #define	IPCL_BIND_HASH(lport, ipst)					\
595 	((unsigned)(((lport) >> 8) ^ (lport)) % \
596 	    (ipst)->ips_ipcl_bind_fanout_size)
597 
598 #define	IPCL_BIND_MATCH(connp, proto, laddr, lport)			\
599 	((connp)->conn_proto == (proto) &&				\
600 		(connp)->conn_lport == (lport) &&			\
601 		(_IPCL_V4_MATCH_ANY((connp)->conn_laddr_v6) ||		\
602 		_IPCL_V4_MATCH((connp)->conn_laddr_v6, (laddr))) &&	\
603 		!(connp)->conn_ipv6_v6only)
604 
605 #define	IPCL_BIND_MATCH_V6(connp, proto, laddr, lport)			\
606 	((connp)->conn_proto == (proto) &&				\
607 		(connp)->conn_lport == (lport) &&			\
608 		(IN6_ARE_ADDR_EQUAL(&(connp)->conn_laddr_v6, &(laddr)) || \
609 		IN6_IS_ADDR_UNSPECIFIED(&(connp)->conn_laddr_v6)))
610 
611 /*
612  * We compare conn_laddr since it captures both connected and a bind to
613  * a multicast or broadcast address.
614  * The caller needs to match the zoneid and also call conn_wantpacket
615  * for multicast, broadcast, or when conn_incoming_ifindex is set.
616  */
617 #define	IPCL_UDP_MATCH(connp, lport, laddr, fport, faddr)		\
618 	(((connp)->conn_lport == (lport)) &&				\
619 	((_IPCL_V4_MATCH_ANY((connp)->conn_laddr_v6) ||			\
620 	(_IPCL_V4_MATCH((connp)->conn_laddr_v6, (laddr)) &&		\
621 	(_IPCL_V4_MATCH_ANY((connp)->conn_faddr_v6) ||			\
622 	(_IPCL_V4_MATCH((connp)->conn_faddr_v6, (faddr)) &&		\
623 	(connp)->conn_fport == (fport)))))) &&				\
624 	!(connp)->conn_ipv6_v6only)
625 
626 /*
627  * We compare conn_laddr since it captures both connected and a bind to
628  * a multicast or broadcast address.
629  * The caller needs to match the zoneid and also call conn_wantpacket_v6
630  * for multicast or when conn_incoming_ifindex is set.
631  */
632 #define	IPCL_UDP_MATCH_V6(connp, lport, laddr, fport, faddr)	\
633 	(((connp)->conn_lport == (lport)) &&			\
634 	(IN6_IS_ADDR_UNSPECIFIED(&(connp)->conn_laddr_v6) ||	\
635 	(IN6_ARE_ADDR_EQUAL(&(connp)->conn_laddr_v6, &(laddr)) &&	\
636 	(IN6_IS_ADDR_UNSPECIFIED(&(connp)->conn_faddr_v6) ||	\
637 	(IN6_ARE_ADDR_EQUAL(&(connp)->conn_faddr_v6, &(faddr)) &&	\
638 	(connp)->conn_fport == (fport))))))
639 
640 #define	IPCL_IPTUN_HASH(laddr, faddr)					\
641 	((ntohl(laddr) ^ ((ntohl(faddr) << 24) | (ntohl(faddr) >> 8))) % \
642 	ipcl_iptun_fanout_size)
643 
644 #define	IPCL_IPTUN_HASH_V6(laddr, faddr)				\
645 	IPCL_IPTUN_HASH((laddr)->s6_addr32[0] ^ (laddr)->s6_addr32[1] ^	\
646 	    (faddr)->s6_addr32[2] ^ (faddr)->s6_addr32[3],		\
647 	    (faddr)->s6_addr32[0] ^ (faddr)->s6_addr32[1] ^		\
648 	    (laddr)->s6_addr32[2] ^ (laddr)->s6_addr32[3])
649 
650 #define	IPCL_IPTUN_MATCH(connp, laddr, faddr)			\
651 	(_IPCL_V4_MATCH((connp)->conn_laddr_v6, (laddr)) &&	\
652 	_IPCL_V4_MATCH((connp)->conn_faddr_v6, (faddr)))
653 
654 #define	IPCL_IPTUN_MATCH_V6(connp, laddr, faddr)		\
655 	(IN6_ARE_ADDR_EQUAL(&(connp)->conn_laddr_v6, (laddr)) &&	\
656 	IN6_ARE_ADDR_EQUAL(&(connp)->conn_faddr_v6, (faddr)))
657 
658 #define	IPCL_UDP_HASH(lport, ipst)	\
659 	IPCL_PORT_HASH(lport, (ipst)->ips_ipcl_udp_fanout_size)
660 
661 #define	CONN_G_HASH_SIZE	1024
662 
663 /* Raw socket hash function. */
664 #define	IPCL_RAW_HASH(lport, ipst)	\
665 	IPCL_PORT_HASH(lport, (ipst)->ips_ipcl_raw_fanout_size)
666 
667 /*
668  * This is similar to IPCL_BIND_MATCH except that the local port check
669  * is changed to a wildcard port check.
670  * We compare conn_laddr since it captures both connected and a bind to
671  * a multicast or broadcast address.
672  */
673 #define	IPCL_RAW_MATCH(connp, proto, laddr)			\
674 	((connp)->conn_proto == (proto) &&			\
675 	(connp)->conn_lport == 0 &&				\
676 	(_IPCL_V4_MATCH_ANY((connp)->conn_laddr_v6) ||		\
677 	_IPCL_V4_MATCH((connp)->conn_laddr_v6, (laddr))))
678 
679 #define	IPCL_RAW_MATCH_V6(connp, proto, laddr)			\
680 	((connp)->conn_proto == (proto) &&			\
681 	(connp)->conn_lport == 0 &&				\
682 	(IN6_IS_ADDR_UNSPECIFIED(&(connp)->conn_laddr_v6) ||	\
683 	IN6_ARE_ADDR_EQUAL(&(connp)->conn_laddr_v6, &(laddr))))
684 
685 /* Function prototypes */
686 extern void ipcl_g_init(void);
687 extern void ipcl_init(ip_stack_t *);
688 extern void ipcl_g_destroy(void);
689 extern void ipcl_destroy(ip_stack_t *);
690 extern conn_t *ipcl_conn_create(uint32_t, int, netstack_t *);
691 extern void ipcl_conn_destroy(conn_t *);
692 
693 void ipcl_hash_insert_wildcard(connf_t *, conn_t *);
694 void ipcl_hash_remove(conn_t *);
695 void ipcl_hash_remove_locked(conn_t *connp, connf_t *connfp);
696 
697 extern int	ipcl_bind_insert(conn_t *);
698 extern int	ipcl_bind_insert_v4(conn_t *);
699 extern int	ipcl_bind_insert_v6(conn_t *);
700 extern int	ipcl_conn_insert(conn_t *);
701 extern int	ipcl_conn_insert_v4(conn_t *);
702 extern int	ipcl_conn_insert_v6(conn_t *);
703 extern conn_t	*ipcl_get_next_conn(connf_t *, conn_t *, uint32_t);
704 
705 conn_t *ipcl_classify_v4(mblk_t *, uint8_t, uint_t, ip_recv_attr_t *,
706 	    ip_stack_t *);
707 conn_t *ipcl_classify_v6(mblk_t *, uint8_t, uint_t, ip_recv_attr_t *,
708 	    ip_stack_t *);
709 conn_t *ipcl_classify(mblk_t *, ip_recv_attr_t *, ip_stack_t *);
710 conn_t *ipcl_classify_raw(mblk_t *, uint8_t, uint32_t, ipha_t *,
711     ip6_t *, ip_recv_attr_t *, ip_stack_t *);
712 conn_t *ipcl_iptun_classify_v4(ipaddr_t *, ipaddr_t *, ip_stack_t *);
713 conn_t *ipcl_iptun_classify_v6(in6_addr_t *, in6_addr_t *, ip_stack_t *);
714 void	ipcl_globalhash_insert(conn_t *);
715 void	ipcl_globalhash_remove(conn_t *);
716 void	ipcl_walk(pfv_t, void *, ip_stack_t *);
717 conn_t	*ipcl_tcp_lookup_reversed_ipv4(ipha_t *, tcpha_t *, int, ip_stack_t *);
718 conn_t	*ipcl_tcp_lookup_reversed_ipv6(ip6_t *, tcpha_t *, int, uint_t,
719 	    ip_stack_t *);
720 conn_t	*ipcl_lookup_listener_v4(uint16_t, ipaddr_t, zoneid_t, ip_stack_t *);
721 conn_t	*ipcl_lookup_listener_v6(uint16_t, in6_addr_t *, uint_t, zoneid_t,
722 	    ip_stack_t *);
723 int	conn_trace_ref(conn_t *);
724 int	conn_untrace_ref(conn_t *);
725 void	ipcl_conn_cleanup(conn_t *);
726 extern uint_t	conn_recvancillary_size(conn_t *, crb_t, ip_recv_attr_t *,
727     mblk_t *, ip_pkt_t *);
728 extern void	conn_recvancillary_add(conn_t *, crb_t, ip_recv_attr_t *,
729     ip_pkt_t *, uchar_t *, uint_t);
730 conn_t *ipcl_conn_tcp_lookup_reversed_ipv4(conn_t *, ipha_t *, tcpha_t *,
731 	    ip_stack_t *);
732 conn_t *ipcl_conn_tcp_lookup_reversed_ipv6(conn_t *, ip6_t *, tcpha_t *,
733 	    ip_stack_t *);
734 
735 extern int ip_create_helper_stream(conn_t *, ldi_ident_t);
736 extern void ip_free_helper_stream(conn_t *);
737 extern int	ip_helper_stream_setup(queue_t *, dev_t *, int, int,
738     cred_t *, boolean_t);
739 extern mib2_socketInfoEntry_t *conn_get_socket_info(conn_t *,
740     mib2_socketInfoEntry_t *);
741 
742 #ifdef	__cplusplus
743 }
744 #endif
745 
746 #endif	/* _INET_IPCLASSIFIER_H */
747