xref: /titanic_41/usr/src/uts/common/inet/ipclassifier.h (revision fc724630b14603e4c1147df68b7bf45f7de7431f)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  */
25 
26 #ifndef	_INET_IPCLASSIFIER_H
27 #define	_INET_IPCLASSIFIER_H
28 
29 #ifdef	__cplusplus
30 extern "C" {
31 #endif
32 
33 #include <inet/common.h>
34 #include <inet/ip.h>
35 #include <inet/mi.h>
36 #include <inet/tcp.h>
37 #include <inet/ip6.h>
38 #include <netinet/in.h>		/* for IPPROTO_* constants */
39 #include <sys/sdt.h>
40 #include <sys/socket_proto.h>
41 #include <sys/sunddi.h>
42 #include <sys/sunldi.h>
43 
44 typedef void (*edesc_spf)(void *, mblk_t *, void *, int);
45 typedef void (*edesc_rpf)(void *, mblk_t *, void *);
46 
47 /*
48  * ==============================
49  * =	The CONNECTION		=
50  * ==============================
51  */
52 
53 /*
54  * The connection structure contains the common information/flags/ref needed.
55  * Implementation will keep the connection struct, the layers (with their
56  * respective data for event i.e. tcp_t if event was tcp_input) all in one
57  * contiguous memory location.
58  */
59 
60 /* Conn Flags */
61 /* Unused			0x00020000 */
62 /* Unused			0x00040000 */
63 #define	IPCL_FULLY_BOUND	0x00080000	/* Bound to correct squeue */
64 #define	IPCL_CHECK_POLICY	0x00100000	/* Needs policy checking */
65 #define	IPCL_SOCKET		0x00200000	/* Sockfs connection */
66 #define	IPCL_ACCEPTOR		0x00400000	/* Sockfs priv acceptor */
67 #define	IPCL_CL_LISTENER	0x00800000	/* Cluster listener */
68 #define	IPCL_EAGER		0x01000000	/* Incoming connection */
69 /* Unused			0x02000000 */
70 #define	IPCL_TCP6		0x04000000	/* AF_INET6 TCP */
71 #define	IPCL_TCP4		0x08000000	/* IPv4 packet format TCP */
72 /* Unused			0x10000000 */
73 /* Unused			0x20000000 */
74 #define	IPCL_CONNECTED		0x40000000	/* Conn in connected table */
75 #define	IPCL_BOUND		0x80000000	/* Conn in bind table */
76 
77 /* Flags identifying the type of conn */
78 #define	IPCL_TCPCONN		0x00000001	/* From tcp_conn_cache */
79 #define	IPCL_SCTPCONN		0x00000002	/* From sctp_conn_cache */
80 #define	IPCL_IPCCONN		0x00000004	/* From ip_conn_cache */
81 #define	IPCL_UDPCONN		0x00000008	/* From udp_conn_cache */
82 #define	IPCL_RAWIPCONN		0x00000010	/* From rawip_conn_cache */
83 #define	IPCL_RTSCONN		0x00000020	/* From rts_conn_cache */
84 #define	IPCL_ISV6		0x00000040	/* AF_INET6 */
85 #define	IPCL_IPTUN		0x00000080	/* Has "tun" plumbed above it */
86 #define	IPCL_NONSTR		0x00001000	/* A non-STREAMS socket */
87 #define	IPCL_IN_SQUEUE		0x10000000	/* Waiting squeue to finish */
88 
89 /* Conn Masks */
90 #define	IPCL_TCP		(IPCL_TCP4|IPCL_TCP6)
91 #define	IPCL_REMOVED		0x00000100
92 #define	IPCL_REUSED		0x00000200
93 
94 /* The packet format is IPv4; could be an AF_INET or AF_INET6 socket */
95 #define	IPCL_IS_TCP4(connp)						\
96 	(((connp)->conn_flags & IPCL_TCP4))
97 
98 /* Connected AF_INET with no IPsec policy */
99 #define	IPCL_IS_TCP4_CONNECTED_NO_POLICY(connp)				\
100 	(((connp)->conn_flags &						\
101 		(IPCL_TCP4|IPCL_CONNECTED|IPCL_CHECK_POLICY|IPCL_TCP6))	\
102 		== (IPCL_TCP4|IPCL_CONNECTED))
103 
104 #define	IPCL_IS_CONNECTED(connp)					\
105 	((connp)->conn_flags & IPCL_CONNECTED)
106 
107 #define	IPCL_IS_BOUND(connp)						\
108 	((connp)->conn_flags & IPCL_BOUND)
109 
110 /* AF_INET TCP that is bound */
111 #define	IPCL_IS_TCP4_BOUND(connp)					\
112 	(((connp)->conn_flags &						\
113 		(IPCL_TCP4|IPCL_BOUND|IPCL_TCP6)) ==			\
114 		(IPCL_TCP4|IPCL_BOUND))
115 
116 #define	IPCL_IS_FULLY_BOUND(connp)					\
117 	((connp)->conn_flags & IPCL_FULLY_BOUND)
118 
119 /*
120  * Can't use conn_protocol since we need to tell difference
121  * between a real TCP socket and a SOCK_RAW, IPPROTO_TCP.
122  */
123 #define	IPCL_IS_TCP(connp)						\
124 	((connp)->conn_flags & IPCL_TCPCONN)
125 
126 #define	IPCL_IS_SCTP(connp)						\
127 	((connp)->conn_flags & IPCL_SCTPCONN)
128 
129 #define	IPCL_IS_UDP(connp)						\
130 	((connp)->conn_flags & IPCL_UDPCONN)
131 
132 #define	IPCL_IS_RAWIP(connp)						\
133 	((connp)->conn_flags & IPCL_RAWIPCONN)
134 
135 #define	IPCL_IS_RTS(connp)						\
136 	((connp)->conn_flags & IPCL_RTSCONN)
137 
138 #define	IPCL_IS_IPTUN(connp)						\
139 	(((connp)->conn_ulp == IPPROTO_ENCAP ||				\
140 	(connp)->conn_ulp == IPPROTO_IPV6) &&				\
141 	((connp)->conn_flags & IPCL_IPTUN))
142 
143 #define	IPCL_IS_NONSTR(connp)	((connp)->conn_flags & IPCL_NONSTR)
144 
145 typedef struct connf_s connf_t;
146 
147 typedef struct
148 {
149 	int	ctb_depth;
150 #define	CONN_STACK_DEPTH	15
151 	pc_t	ctb_stack[CONN_STACK_DEPTH];
152 } conn_trace_t;
153 
154 typedef struct ip_helper_minor_info_s {
155 	dev_t	ip_minfo_dev;		/* Device */
156 	vmem_t	*ip_minfo_arena;	/* Arena */
157 } ip_helper_minfo_t;
158 
159 /*
160  * ip helper stream info
161  */
162 typedef struct ip_helper_stream_info_s {
163 	ldi_handle_t		iphs_handle;
164 	queue_t 		*iphs_rq;
165 	queue_t 		*iphs_wq;
166 	ip_helper_minfo_t	*iphs_minfo;
167 } ip_helper_stream_info_t;
168 
169 /*
170  * The initial fields in the conn_t are setup by the kmem_cache constructor,
171  * and are preserved when it is freed. Fields after that are bzero'ed when
172  * the conn_t is freed.
173  */
174 struct conn_s {
175 	kmutex_t	conn_lock;
176 	uint32_t	conn_ref;		/* Reference counter */
177 	uint32_t	conn_flags;		/* Conn Flags */
178 
179 
180 	union {
181 		tcp_t		*cp_tcp;	/* Pointer to the tcp struct */
182 		struct udp_s	*cp_udp;	/* Pointer to the udp struct */
183 		struct icmp_s	*cp_icmp;	/* Pointer to rawip struct */
184 		struct rts_s	*cp_rts;	/* Pointer to rts struct */
185 		void		*cp_priv;
186 	} conn_proto_priv;
187 #define	conn_tcp	conn_proto_priv.cp_tcp
188 #define	conn_udp	conn_proto_priv.cp_udp
189 #define	conn_icmp	conn_proto_priv.cp_icmp
190 #define	conn_rts	conn_proto_priv.cp_rts
191 #define	conn_priv	conn_proto_priv.cp_priv
192 
193 	kcondvar_t	conn_cv;
194 	uint8_t		conn_ulp;		/* protocol type */
195 
196 	edesc_rpf	conn_recv;		/* Pointer to recv routine */
197 
198 	/* Fields after this are bzero'ed when the conn_t is freed. */
199 
200 	squeue_t	*conn_sqp;		/* Squeue for processing */
201 	uint_t		conn_state_flags;	/* IP state flags */
202 #define	conn_start_clr	conn_state_flags
203 
204 	ire_t		*conn_ire_cache; 	/* outbound ire cache */
205 	unsigned int
206 		conn_on_sqp : 1,		/* Conn is being processed */
207 		conn_dontroute : 1,		/* SO_DONTROUTE state */
208 		conn_loopback : 1,		/* SO_LOOPBACK state */
209 		conn_broadcast : 1,		/* SO_BROADCAST state */
210 
211 		conn_reuseaddr : 1,		/* SO_REUSEADDR state */
212 		conn_multicast_loop : 1,	/* IP_MULTICAST_LOOP */
213 		conn_multi_router : 1,		/* Wants all multicast pkts */
214 		conn_draining : 1,		/* ip_wsrv running */
215 
216 		conn_did_putbq : 1,		/* ip_wput did a putbq */
217 		conn_unspec_src : 1,		/* IP_UNSPEC_SRC */
218 		conn_policy_cached : 1,		/* Is policy cached/latched ? */
219 		conn_in_enforce_policy : 1,	/* Enforce Policy on inbound */
220 
221 		conn_out_enforce_policy : 1,	/* Enforce Policy on outbound */
222 		conn_af_isv6 : 1,		/* ip address family ver 6 */
223 		conn_pkt_isv6 : 1,		/* ip packet format ver 6 */
224 		conn_ip_recvpktinfo : 1,	/* IPV*_RECVPKTINFO option */
225 
226 		conn_ipv6_recvhoplimit : 1,	/* IPV6_RECVHOPLIMIT option */
227 		conn_ipv6_recvhopopts : 1,	/* IPV6_RECVHOPOPTS option */
228 		conn_ipv6_recvdstopts : 1,	/* IPV6_RECVDSTOPTS option */
229 		conn_ipv6_recvrthdr : 1,	/* IPV6_RECVRTHDR option */
230 
231 		conn_ipv6_recvrtdstopts : 1,	/* IPV6_RECVRTHDRDSTOPTS */
232 		conn_ipv6_v6only : 1,		/* IPV6_V6ONLY */
233 		conn_ipv6_recvtclass : 1,	/* IPV6_RECVTCLASS */
234 		conn_ipv6_recvpathmtu : 1,	/* IPV6_RECVPATHMTU */
235 
236 		conn_pathmtu_valid : 1,		/* The cached mtu is valid. */
237 		conn_ipv6_dontfrag : 1,		/* IPV6_DONTFRAG */
238 		conn_fully_bound : 1,		/* Fully bound connection */
239 		conn_recvif : 1,		/* IP_RECVIF option */
240 
241 		conn_recvslla : 1,		/* IP_RECVSLLA option */
242 		conn_mdt_ok : 1,		/* MDT is permitted */
243 		conn_nexthop_set : 1,
244 		conn_allzones : 1;		/* SO_ALLZONES */
245 
246 	unsigned int
247 		conn_lso_ok : 1;		/* LSO is usable */
248 	boolean_t conn_direct_blocked;		/* conn is flow-controlled */
249 
250 	squeue_t	*conn_initial_sqp;	/* Squeue at open time */
251 	squeue_t	*conn_final_sqp;	/* Squeue after connect */
252 	ill_t		*conn_dhcpinit_ill;	/* IP_DHCPINIT_IF */
253 	ipsec_latch_t	*conn_latch;		/* latched state */
254 	ill_t		*conn_outgoing_ill;	/* IP{,V6}_BOUND_IF */
255 	edesc_spf	conn_send;		/* Pointer to send routine */
256 	queue_t		*conn_rq;		/* Read queue */
257 	queue_t		*conn_wq;		/* Write queue */
258 	dev_t		conn_dev;		/* Minor number */
259 	vmem_t		*conn_minor_arena;	/* Minor arena */
260 	ip_helper_stream_info_t *conn_helper_info;
261 
262 	cred_t		*conn_cred;		/* Credentials */
263 	connf_t		*conn_g_fanout;		/* Global Hash bucket head */
264 	struct conn_s	*conn_g_next;		/* Global Hash chain next */
265 	struct conn_s	*conn_g_prev;		/* Global Hash chain prev */
266 	struct ipsec_policy_head_s *conn_policy; /* Configured policy */
267 	in6_addr_t	conn_bound_source_v6;
268 #define	conn_bound_source	V4_PART_OF_V6(conn_bound_source_v6)
269 
270 	connf_t		*conn_fanout;		/* Hash bucket we're part of */
271 	struct conn_s	*conn_next;		/* Hash chain next */
272 	struct conn_s	*conn_prev;		/* Hash chain prev */
273 	struct {
274 		in6_addr_t connua_laddr;	/* Local address */
275 		in6_addr_t connua_faddr;	/* Remote address */
276 	} connua_v6addr;
277 #define	conn_src	V4_PART_OF_V6(connua_v6addr.connua_laddr)
278 #define	conn_rem	V4_PART_OF_V6(connua_v6addr.connua_faddr)
279 #define	conn_srcv6	connua_v6addr.connua_laddr
280 #define	conn_remv6	connua_v6addr.connua_faddr
281 	union {
282 		/* Used for classifier match performance */
283 		uint32_t		conn_ports2;
284 		struct {
285 			in_port_t	tcpu_fport;	/* Remote port */
286 			in_port_t	tcpu_lport;	/* Local port */
287 		} tcpu_ports;
288 	} u_port;
289 #define	conn_fport	u_port.tcpu_ports.tcpu_fport
290 #define	conn_lport	u_port.tcpu_ports.tcpu_lport
291 #define	conn_ports	u_port.conn_ports2
292 #define	conn_upq	conn_rq
293 	uint8_t		conn_unused_byte;
294 
295 	uint_t		conn_proto;		/* SO_PROTOTYPE state */
296 	ill_t		*conn_incoming_ill;	/* IP{,V6}_BOUND_IF */
297 	ill_t		*conn_oper_pending_ill; /* pending shared ioctl */
298 
299 	ilg_t	*conn_ilg;		/* Group memberships */
300 	int	conn_ilg_allocated;	/* Number allocated */
301 	int	conn_ilg_inuse;		/* Number currently used */
302 	int	conn_ilg_walker_cnt;	/* No of ilg walkers */
303 	/* XXXX get rid of this, once ilg_delete_all is fixed */
304 	kcondvar_t	conn_refcv;
305 
306 	struct ipif_s	*conn_multicast_ipif;	/* IP_MULTICAST_IF */
307 	ill_t		*conn_multicast_ill;	/* IPV6_MULTICAST_IF */
308 	struct	conn_s	*conn_drain_next;	/* Next conn in drain list */
309 	struct	conn_s	*conn_drain_prev;	/* Prev conn in drain list */
310 	idl_t		*conn_idl;		/* Ptr to the drain list head */
311 	mblk_t		*conn_ipsec_opt_mp;	/* ipsec option mblk */
312 	uint32_t	conn_src_preferences;	/* prefs for src addr select */
313 	/* mtuinfo from IPV6_PACKET_TOO_BIG conditional on conn_pathmtu_valid */
314 	struct ip6_mtuinfo mtuinfo;
315 	zoneid_t	conn_zoneid;		/* zone connection is in */
316 	in6_addr_t	conn_nexthop_v6;	/* nexthop IP address */
317 	uchar_t		conn_broadcast_ttl; 	/* IP_BROADCAST_TTL */
318 #define	conn_nexthop_v4	V4_PART_OF_V6(conn_nexthop_v6)
319 	cred_t		*conn_peercred;		/* Peer TX label, if any */
320 	int		conn_rtaware; 		/* RT_AWARE sockopt value */
321 	kcondvar_t	conn_sq_cv;		/* For non-STREAMS socket IO */
322 	kthread_t	*conn_sq_caller;	/* Caller of squeue sync ops */
323 	sock_upcalls_t	*conn_upcalls;		/* Upcalls to sockfs */
324 	sock_upper_handle_t conn_upper_handle;	/* Upper handle: sonode * */
325 
326 	unsigned int
327 		conn_ulp_labeled : 1,		/* ULP label is synced */
328 		conn_mlp_type : 2,		/* mlp_type_t; tsol/tndb.h */
329 		conn_anon_mlp : 1,		/* user wants anon MLP */
330 
331 		conn_anon_port : 1,		/* user bound anonymously */
332 		conn_mac_exempt : 1,		/* unlabeled with loose MAC */
333 		conn_spare : 26;
334 
335 	boolean_t	conn_flow_cntrld;
336 	netstack_t	*conn_netstack;	/* Corresponds to a netstack_hold */
337 #ifdef CONN_DEBUG
338 #define	CONN_TRACE_MAX	10
339 	int		conn_trace_last;	/* ndx of last used tracebuf */
340 	conn_trace_t	conn_trace_buf[CONN_TRACE_MAX];
341 #endif
342 };
343 
344 /*
345  * These two macros are used by TX. First priority is SCM_UCRED having
346  * set the label in the mblk. Second priority is the peers label (aka
347  * conn_peercred). Last priority is the open credentials.
348  * BEST_CRED takes all three into account in the above order.
349  * CONN_CRED is for connection-oriented cases when we don't need to look
350  * at the mblk.
351  */
352 #define	CONN_CRED(connp) ((connp)->conn_peercred == NULL ? \
353 	(connp)->conn_cred : (connp)->conn_peercred)
354 #define	BEST_CRED(mp, connp) ip_best_cred(mp, connp)
355 
356 /*
357  * connf_t - connection fanout data.
358  *
359  * The hash tables and their linkage (conn_t.{hashnextp, hashprevp} are
360  * protected by the per-bucket lock. Each conn_t inserted in the list
361  * points back at the connf_t that heads the bucket.
362  */
363 struct connf_s {
364 	struct conn_s	*connf_head;
365 	kmutex_t	connf_lock;
366 };
367 
368 #define	CONN_INC_REF(connp)	{				\
369 	mutex_enter(&(connp)->conn_lock);			\
370 	DTRACE_PROBE1(conn__inc__ref, conn_t *, connp);		\
371 	ASSERT(conn_trace_ref(connp));				\
372 	(connp)->conn_ref++;					\
373 	ASSERT((connp)->conn_ref != 0);				\
374 	mutex_exit(&(connp)->conn_lock);			\
375 }
376 
377 #define	CONN_INC_REF_LOCKED(connp)	{			\
378 	DTRACE_PROBE1(conn__inc__ref, conn_t *, connp);		\
379 	ASSERT(MUTEX_HELD(&(connp)->conn_lock));	 	\
380 	ASSERT(conn_trace_ref(connp));				\
381 	(connp)->conn_ref++;					\
382 	ASSERT((connp)->conn_ref != 0);				\
383 }
384 
385 #define	CONN_DEC_REF(connp)	{					\
386 	mutex_enter(&(connp)->conn_lock);				\
387 	DTRACE_PROBE1(conn__dec__ref, conn_t *, connp);			\
388 	/*								\
389 	 * The squeue framework always does a CONN_DEC_REF after return	\
390 	 * from TCP. Hence the refcnt must be at least 2 if conn_on_sqp	\
391 	 * is B_TRUE and conn_ref is being decremented. This is to	\
392 	 * account for the mblk being currently processed.		\
393 	 */								\
394 	if ((connp)->conn_ref <= 0 ||					\
395 	    ((connp)->conn_ref == 1 && (connp)->conn_on_sqp))		\
396 		cmn_err(CE_PANIC, "CONN_DEC_REF: connp(%p) has ref "	\
397 			"= %d\n", (void *)(connp), (connp)->conn_ref);	\
398 	ASSERT(conn_untrace_ref(connp));				\
399 	(connp)->conn_ref--;						\
400 	if ((connp)->conn_ref == 0) {					\
401 		/* Refcnt can't increase again, safe to drop lock */	\
402 		mutex_exit(&(connp)->conn_lock);			\
403 		ipcl_conn_destroy(connp);				\
404 	} else {							\
405 		cv_broadcast(&(connp)->conn_cv);			\
406 		mutex_exit(&(connp)->conn_lock);			\
407 	}								\
408 }
409 
410 /*
411  * For use with subsystems within ip which use ALL_ZONES as a wildcard
412  */
413 #define	IPCL_ZONEID(connp)						\
414 	((connp)->conn_allzones ? ALL_ZONES : (connp)->conn_zoneid)
415 
416 /*
417  * For matching between a conn_t and a zoneid.
418  */
419 #define	IPCL_ZONE_MATCH(connp, zoneid) 					\
420 	(((connp)->conn_allzones) ||					\
421 	    ((zoneid) == ALL_ZONES) ||					\
422 	    (connp)->conn_zoneid == (zoneid))
423 
424 
425 #define	_IPCL_V4_MATCH(v6addr, v4addr)	\
426 	(V4_PART_OF_V6((v6addr)) == (v4addr) && IN6_IS_ADDR_V4MAPPED(&(v6addr)))
427 
428 #define	_IPCL_V4_MATCH_ANY(addr)	\
429 	(IN6_IS_ADDR_V4MAPPED_ANY(&(addr)) || IN6_IS_ADDR_UNSPECIFIED(&(addr)))
430 
431 
432 /*
433  * IPCL_PROTO_MATCH() only matches conns with the specified zoneid, while
434  * IPCL_PROTO_MATCH_V6() can match other conns in the multicast case, see
435  * ip_fanout_proto().
436  */
437 #define	IPCL_PROTO_MATCH(connp, protocol, ipha, ill,			\
438     fanout_flags, zoneid)						\
439 	((((connp)->conn_src == INADDR_ANY) ||				\
440 	(((connp)->conn_src == ((ipha)->ipha_dst)) &&			\
441 	    (((connp)->conn_rem == INADDR_ANY) ||			\
442 	((connp)->conn_rem == ((ipha)->ipha_src))))) &&			\
443 	IPCL_ZONE_MATCH(connp, zoneid) &&				\
444 	(conn_wantpacket((connp), (ill), (ipha), (fanout_flags), 	\
445 	    (zoneid)) || ((protocol) == IPPROTO_PIM) ||			\
446 	    ((protocol) == IPPROTO_RSVP)))
447 
448 #define	IPCL_PROTO_MATCH_V6(connp, protocol, ip6h, ill,			   \
449     fanout_flags, zoneid)						   \
450 	((IN6_IS_ADDR_UNSPECIFIED(&(connp)->conn_srcv6) ||		   \
451 	(IN6_ARE_ADDR_EQUAL(&(connp)->conn_srcv6, &((ip6h)->ip6_dst)) &&   \
452 	(IN6_IS_ADDR_UNSPECIFIED(&(connp)->conn_remv6) ||		   \
453 	IN6_ARE_ADDR_EQUAL(&(connp)->conn_remv6, &((ip6h)->ip6_src))))) && \
454 	(conn_wantpacket_v6((connp), (ill), (ip6h),			   \
455 	(fanout_flags), (zoneid)) || ((protocol) == IPPROTO_RSVP)))
456 
457 #define	IPCL_CONN_HASH(src, ports, ipst)				\
458 	((unsigned)(ntohl((src)) ^ ((ports) >> 24) ^ ((ports) >> 16) ^	\
459 	((ports) >> 8) ^ (ports)) % (ipst)->ips_ipcl_conn_fanout_size)
460 
461 #define	IPCL_CONN_HASH_V6(src, ports, ipst)				\
462 	IPCL_CONN_HASH(V4_PART_OF_V6((src)), (ports), (ipst))
463 
464 #define	IPCL_CONN_MATCH(connp, proto, src, dst, ports)			\
465 	((connp)->conn_ulp == (proto) &&				\
466 		(connp)->conn_ports == (ports) &&      			\
467 		_IPCL_V4_MATCH((connp)->conn_remv6, (src)) &&		\
468 		_IPCL_V4_MATCH((connp)->conn_srcv6, (dst)) &&		\
469 		!(connp)->conn_ipv6_v6only)
470 
471 #define	IPCL_CONN_MATCH_V6(connp, proto, src, dst, ports)		\
472 	((connp)->conn_ulp == (proto) &&				\
473 		(connp)->conn_ports == (ports) &&      			\
474 		IN6_ARE_ADDR_EQUAL(&(connp)->conn_remv6, &(src)) &&	\
475 		IN6_ARE_ADDR_EQUAL(&(connp)->conn_srcv6, &(dst)))
476 
477 #define	IPCL_CONN_INIT(connp, protocol, src, rem, ports) {		\
478 	(connp)->conn_ulp = protocol;					\
479 	IN6_IPADDR_TO_V4MAPPED(src, &(connp)->conn_srcv6);		\
480 	IN6_IPADDR_TO_V4MAPPED(rem, &(connp)->conn_remv6);		\
481 	(connp)->conn_ports = ports;					\
482 }
483 
484 #define	IPCL_CONN_INIT_V6(connp, protocol, src, rem, ports) {		\
485 	(connp)->conn_ulp = protocol;					\
486 	(connp)->conn_srcv6 = src;					\
487 	(connp)->conn_remv6 = rem;					\
488 	(connp)->conn_ports = ports;					\
489 }
490 
491 #define	IPCL_PORT_HASH(port, size) \
492 	((((port) >> 8) ^ (port)) & ((size) - 1))
493 
494 #define	IPCL_BIND_HASH(lport, ipst)					\
495 	((unsigned)(((lport) >> 8) ^ (lport)) % \
496 	    (ipst)->ips_ipcl_bind_fanout_size)
497 
498 #define	IPCL_BIND_MATCH(connp, proto, laddr, lport)			\
499 	((connp)->conn_ulp == (proto) &&				\
500 		(connp)->conn_lport == (lport) &&			\
501 		(_IPCL_V4_MATCH_ANY((connp)->conn_srcv6) ||		\
502 		_IPCL_V4_MATCH((connp)->conn_srcv6, (laddr))) &&	\
503 		!(connp)->conn_ipv6_v6only)
504 
505 #define	IPCL_BIND_MATCH_V6(connp, proto, laddr, lport)			\
506 	((connp)->conn_ulp == (proto) &&				\
507 		(connp)->conn_lport == (lport) &&			\
508 		(IN6_ARE_ADDR_EQUAL(&(connp)->conn_srcv6, &(laddr)) ||	\
509 		IN6_IS_ADDR_UNSPECIFIED(&(connp)->conn_srcv6)))
510 
511 #define	IPCL_UDP_MATCH(connp, lport, laddr, fport, faddr)		\
512 	(((connp)->conn_lport == (lport)) &&				\
513 	((_IPCL_V4_MATCH_ANY((connp)->conn_srcv6) ||			\
514 	(_IPCL_V4_MATCH((connp)->conn_srcv6, (laddr)) &&		\
515 	(_IPCL_V4_MATCH_ANY((connp)->conn_remv6) ||			\
516 	(_IPCL_V4_MATCH((connp)->conn_remv6, (faddr)) &&		\
517 	(connp)->conn_fport == (fport)))))) &&				\
518 	!(connp)->conn_ipv6_v6only)
519 
520 #define	IPCL_UDP_MATCH_V6(connp, lport, laddr, fport, faddr)	\
521 	(((connp)->conn_lport == (lport)) &&			\
522 	(IN6_IS_ADDR_UNSPECIFIED(&(connp)->conn_srcv6) ||	\
523 	(IN6_ARE_ADDR_EQUAL(&(connp)->conn_srcv6, &(laddr)) &&	\
524 	(IN6_IS_ADDR_UNSPECIFIED(&(connp)->conn_remv6) ||	\
525 	(IN6_ARE_ADDR_EQUAL(&(connp)->conn_remv6, &(faddr)) &&	\
526 	(connp)->conn_fport == (fport))))))
527 
528 #define	IPCL_TCP_EAGER_INIT(connp, protocol, src, rem, ports) {		\
529 	(connp)->conn_flags |= (IPCL_TCP4|IPCL_EAGER);			\
530 	IN6_IPADDR_TO_V4MAPPED(src, &(connp)->conn_srcv6);		\
531 	IN6_IPADDR_TO_V4MAPPED(rem, &(connp)->conn_remv6);		\
532 	(connp)->conn_ports = ports;					\
533 	(connp)->conn_send = ip_output;					\
534 	(connp)->conn_sqp = IP_SQUEUE_GET(lbolt);			\
535 	(connp)->conn_initial_sqp = (connp)->conn_sqp;			\
536 }
537 
538 #define	IPCL_TCP_EAGER_INIT_V6(connp, protocol, src, rem, ports) {	\
539 	(connp)->conn_flags |= (IPCL_TCP6|IPCL_EAGER|IPCL_ISV6);	\
540 	(connp)->conn_srcv6 = src;					\
541 	(connp)->conn_remv6 = rem;					\
542 	(connp)->conn_ports = ports;					\
543 	(connp)->conn_send = ip_output_v6;				\
544 	(connp)->conn_sqp = IP_SQUEUE_GET(lbolt);			\
545 	(connp)->conn_initial_sqp = (connp)->conn_sqp;			\
546 }
547 
548 #define	IPCL_UDP_HASH(lport, ipst)	\
549 	IPCL_PORT_HASH(lport, (ipst)->ips_ipcl_udp_fanout_size)
550 
551 #define	CONN_G_HASH_SIZE	1024
552 
553 /* Raw socket hash function. */
554 #define	IPCL_RAW_HASH(lport, ipst)	\
555 	IPCL_PORT_HASH(lport, (ipst)->ips_ipcl_raw_fanout_size)
556 
557 /*
558  * This is similar to IPCL_BIND_MATCH except that the local port check
559  * is changed to a wildcard port check.
560  */
561 #define	IPCL_RAW_MATCH(connp, proto, laddr)			\
562 	((connp)->conn_ulp == (proto) &&			\
563 	(connp)->conn_lport == 0 &&				\
564 	(_IPCL_V4_MATCH_ANY((connp)->conn_srcv6) ||		\
565 	_IPCL_V4_MATCH((connp)->conn_srcv6, (laddr))))
566 
567 #define	IPCL_RAW_MATCH_V6(connp, proto, laddr)			\
568 	((connp)->conn_ulp == (proto) &&			\
569 	(connp)->conn_lport == 0 &&				\
570 	(IN6_IS_ADDR_UNSPECIFIED(&(connp)->conn_srcv6) ||	\
571 	IN6_ARE_ADDR_EQUAL(&(connp)->conn_srcv6, &(laddr))))
572 
573 /* Function prototypes */
574 extern void ipcl_g_init(void);
575 extern void ipcl_init(ip_stack_t *);
576 extern void ipcl_g_destroy(void);
577 extern void ipcl_destroy(ip_stack_t *);
578 extern conn_t *ipcl_conn_create(uint32_t, int, netstack_t *);
579 extern void ipcl_conn_destroy(conn_t *);
580 
581 void ipcl_hash_insert_wildcard(connf_t *, conn_t *);
582 void ipcl_hash_remove(conn_t *);
583 void ipcl_hash_remove_locked(conn_t *connp, connf_t *connfp);
584 
585 extern int	ipcl_bind_insert(conn_t *, uint8_t, ipaddr_t, uint16_t);
586 extern int	ipcl_bind_insert_v6(conn_t *, uint8_t, const in6_addr_t *,
587 		    uint16_t);
588 extern int	ipcl_conn_insert(conn_t *, uint8_t, ipaddr_t, ipaddr_t,
589 		    uint32_t);
590 extern int	ipcl_conn_insert_v6(conn_t *, uint8_t, const in6_addr_t *,
591 		    const in6_addr_t *, uint32_t, uint_t);
592 extern conn_t	*ipcl_get_next_conn(connf_t *, conn_t *, uint32_t);
593 
594 void ipcl_proto_insert(conn_t *, uint8_t);
595 void ipcl_proto_insert_v6(conn_t *, uint8_t);
596 conn_t *ipcl_classify_v4(mblk_t *, uint8_t, uint_t, zoneid_t, ip_stack_t *);
597 conn_t *ipcl_classify_v6(mblk_t *, uint8_t, uint_t, zoneid_t, ip_stack_t *);
598 conn_t *ipcl_classify(mblk_t *, zoneid_t, ip_stack_t *);
599 conn_t *ipcl_classify_raw(mblk_t *, uint8_t, zoneid_t, uint32_t, ipha_t *,
600 	    ip_stack_t *);
601 void	ipcl_globalhash_insert(conn_t *);
602 void	ipcl_globalhash_remove(conn_t *);
603 void	ipcl_walk(pfv_t, void *, ip_stack_t *);
604 conn_t	*ipcl_tcp_lookup_reversed_ipv4(ipha_t *, tcph_t *, int, ip_stack_t *);
605 conn_t	*ipcl_tcp_lookup_reversed_ipv6(ip6_t *, tcpha_t *, int, uint_t,
606 	    ip_stack_t *);
607 conn_t	*ipcl_lookup_listener_v4(uint16_t, ipaddr_t, zoneid_t, ip_stack_t *);
608 conn_t	*ipcl_lookup_listener_v6(uint16_t, in6_addr_t *, uint_t, zoneid_t,
609 	    ip_stack_t *);
610 int	conn_trace_ref(conn_t *);
611 int	conn_untrace_ref(conn_t *);
612 void	ipcl_conn_cleanup(conn_t *);
613 conn_t *ipcl_conn_tcp_lookup_reversed_ipv4(conn_t *, ipha_t *, tcph_t *,
614 	    ip_stack_t *);
615 conn_t *ipcl_conn_tcp_lookup_reversed_ipv6(conn_t *, ip6_t *, tcph_t *,
616 	    ip_stack_t *);
617 
618 extern int ip_create_helper_stream(conn_t *connp, ldi_ident_t li);
619 extern void ip_free_helper_stream(conn_t *connp);
620 
621 extern int ip_get_options(conn_t *, int, int, void *, t_uscalar_t *, cred_t *);
622 extern int ip_set_options(conn_t *, int, int, const void *, t_uscalar_t,
623     cred_t *);
624 
625 #ifdef	__cplusplus
626 }
627 #endif
628 
629 #endif	/* _INET_IPCLASSIFIER_H */
630