1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright 2008 Sun Microsystems, Inc. All rights reserved. 23 * Use is subject to license terms. 24 */ 25 26 /* 27 * IP PACKET CLASSIFIER 28 * 29 * The IP packet classifier provides mapping between IP packets and persistent 30 * connection state for connection-oriented protocols. It also provides 31 * interface for managing connection states. 32 * 33 * The connection state is kept in conn_t data structure and contains, among 34 * other things: 35 * 36 * o local/remote address and ports 37 * o Transport protocol 38 * o squeue for the connection (for TCP only) 39 * o reference counter 40 * o Connection state 41 * o hash table linkage 42 * o interface/ire information 43 * o credentials 44 * o ipsec policy 45 * o send and receive functions. 46 * o mutex lock. 47 * 48 * Connections use a reference counting scheme. They are freed when the 49 * reference counter drops to zero. A reference is incremented when connection 50 * is placed in a list or table, when incoming packet for the connection arrives 51 * and when connection is processed via squeue (squeue processing may be 52 * asynchronous and the reference protects the connection from being destroyed 53 * before its processing is finished). 54 * 55 * send and receive functions are currently used for TCP only. The send function 56 * determines the IP entry point for the packet once it leaves TCP to be sent to 57 * the destination address. The receive function is used by IP when the packet 58 * should be passed for TCP processing. When a new connection is created these 59 * are set to ip_output() and tcp_input() respectively. During the lifetime of 60 * the connection the send and receive functions may change depending on the 61 * changes in the connection state. For example, Once the connection is bound to 62 * an addresse, the receive function for this connection is set to 63 * tcp_conn_request(). This allows incoming SYNs to go directly into the 64 * listener SYN processing function without going to tcp_input() first. 65 * 66 * Classifier uses several hash tables: 67 * 68 * ipcl_conn_fanout: contains all TCP connections in CONNECTED state 69 * ipcl_bind_fanout: contains all connections in BOUND state 70 * ipcl_proto_fanout: IPv4 protocol fanout 71 * ipcl_proto_fanout_v6: IPv6 protocol fanout 72 * ipcl_udp_fanout: contains all UDP connections 73 * ipcl_globalhash_fanout: contains all connections 74 * 75 * The ipcl_globalhash_fanout is used for any walkers (like snmp and Clustering) 76 * which need to view all existing connections. 77 * 78 * All tables are protected by per-bucket locks. When both per-bucket lock and 79 * connection lock need to be held, the per-bucket lock should be acquired 80 * first, followed by the connection lock. 81 * 82 * All functions doing search in one of these tables increment a reference 83 * counter on the connection found (if any). This reference should be dropped 84 * when the caller has finished processing the connection. 85 * 86 * 87 * INTERFACES: 88 * =========== 89 * 90 * Connection Lookup: 91 * ------------------ 92 * 93 * conn_t *ipcl_classify_v4(mp, protocol, hdr_len, zoneid, ip_stack) 94 * conn_t *ipcl_classify_v6(mp, protocol, hdr_len, zoneid, ip_stack) 95 * 96 * Finds connection for an incoming IPv4 or IPv6 packet. Returns NULL if 97 * it can't find any associated connection. If the connection is found, its 98 * reference counter is incremented. 99 * 100 * mp: mblock, containing packet header. The full header should fit 101 * into a single mblock. It should also contain at least full IP 102 * and TCP or UDP header. 103 * 104 * protocol: Either IPPROTO_TCP or IPPROTO_UDP. 105 * 106 * hdr_len: The size of IP header. It is used to find TCP or UDP header in 107 * the packet. 108 * 109 * zoneid: The zone in which the returned connection must be; the zoneid 110 * corresponding to the ire_zoneid on the IRE located for the 111 * packet's destination address. 112 * 113 * For TCP connections, the lookup order is as follows: 114 * 5-tuple {src, dst, protocol, local port, remote port} 115 * lookup in ipcl_conn_fanout table. 116 * 3-tuple {dst, remote port, protocol} lookup in 117 * ipcl_bind_fanout table. 118 * 119 * For UDP connections, a 5-tuple {src, dst, protocol, local port, 120 * remote port} lookup is done on ipcl_udp_fanout. Note that, 121 * these interfaces do not handle cases where a packets belongs 122 * to multiple UDP clients, which is handled in IP itself. 123 * 124 * If the destination IRE is ALL_ZONES (indicated by zoneid), then we must 125 * determine which actual zone gets the segment. This is used only in a 126 * labeled environment. The matching rules are: 127 * 128 * - If it's not a multilevel port, then the label on the packet selects 129 * the zone. Unlabeled packets are delivered to the global zone. 130 * 131 * - If it's a multilevel port, then only the zone registered to receive 132 * packets on that port matches. 133 * 134 * Also, in a labeled environment, packet labels need to be checked. For fully 135 * bound TCP connections, we can assume that the packet label was checked 136 * during connection establishment, and doesn't need to be checked on each 137 * packet. For others, though, we need to check for strict equality or, for 138 * multilevel ports, membership in the range or set. This part currently does 139 * a tnrh lookup on each packet, but could be optimized to use cached results 140 * if that were necessary. (SCTP doesn't come through here, but if it did, 141 * we would apply the same rules as TCP.) 142 * 143 * An implication of the above is that fully-bound TCP sockets must always use 144 * distinct 4-tuples; they can't be discriminated by label alone. 145 * 146 * Note that we cannot trust labels on packets sent to fully-bound UDP sockets, 147 * as there's no connection set-up handshake and no shared state. 148 * 149 * Labels on looped-back packets within a single zone do not need to be 150 * checked, as all processes in the same zone have the same label. 151 * 152 * Finally, for unlabeled packets received by a labeled system, special rules 153 * apply. We consider only the MLP if there is one. Otherwise, we prefer a 154 * socket in the zone whose label matches the default label of the sender, if 155 * any. In any event, the receiving socket must have SO_MAC_EXEMPT set and the 156 * receiver's label must dominate the sender's default label. 157 * 158 * conn_t *ipcl_tcp_lookup_reversed_ipv4(ipha_t *, tcph_t *, int, ip_stack); 159 * conn_t *ipcl_tcp_lookup_reversed_ipv6(ip6_t *, tcpha_t *, int, uint_t, 160 * ip_stack); 161 * 162 * Lookup routine to find a exact match for {src, dst, local port, 163 * remote port) for TCP connections in ipcl_conn_fanout. The address and 164 * ports are read from the IP and TCP header respectively. 165 * 166 * conn_t *ipcl_lookup_listener_v4(lport, laddr, protocol, 167 * zoneid, ip_stack); 168 * conn_t *ipcl_lookup_listener_v6(lport, laddr, protocol, ifindex, 169 * zoneid, ip_stack); 170 * 171 * Lookup routine to find a listener with the tuple {lport, laddr, 172 * protocol} in the ipcl_bind_fanout table. For IPv6, an additional 173 * parameter interface index is also compared. 174 * 175 * void ipcl_walk(func, arg, ip_stack) 176 * 177 * Apply 'func' to every connection available. The 'func' is called as 178 * (*func)(connp, arg). The walk is non-atomic so connections may be 179 * created and destroyed during the walk. The CONN_CONDEMNED and 180 * CONN_INCIPIENT flags ensure that connections which are newly created 181 * or being destroyed are not selected by the walker. 182 * 183 * Table Updates 184 * ------------- 185 * 186 * int ipcl_conn_insert(connp, protocol, src, dst, ports) 187 * int ipcl_conn_insert_v6(connp, protocol, src, dst, ports, ifindex) 188 * 189 * Insert 'connp' in the ipcl_conn_fanout. 190 * Arguements : 191 * connp conn_t to be inserted 192 * protocol connection protocol 193 * src source address 194 * dst destination address 195 * ports local and remote port 196 * ifindex interface index for IPv6 connections 197 * 198 * Return value : 199 * 0 if connp was inserted 200 * EADDRINUSE if the connection with the same tuple 201 * already exists. 202 * 203 * int ipcl_bind_insert(connp, protocol, src, lport); 204 * int ipcl_bind_insert_v6(connp, protocol, src, lport); 205 * 206 * Insert 'connp' in ipcl_bind_fanout. 207 * Arguements : 208 * connp conn_t to be inserted 209 * protocol connection protocol 210 * src source address connection wants 211 * to bind to 212 * lport local port connection wants to 213 * bind to 214 * 215 * 216 * void ipcl_hash_remove(connp); 217 * 218 * Removes the 'connp' from the connection fanout table. 219 * 220 * Connection Creation/Destruction 221 * ------------------------------- 222 * 223 * conn_t *ipcl_conn_create(type, sleep, netstack_t *) 224 * 225 * Creates a new conn based on the type flag, inserts it into 226 * globalhash table. 227 * 228 * type: This flag determines the type of conn_t which needs to be 229 * created i.e., which kmem_cache it comes from. 230 * IPCL_TCPCONN indicates a TCP connection 231 * IPCL_SCTPCONN indicates a SCTP connection 232 * IPCL_UDPCONN indicates a UDP conn_t. 233 * IPCL_RAWIPCONN indicates a RAWIP/ICMP conn_t. 234 * IPCL_RTSCONN indicates a RTS conn_t. 235 * IPCL_IPCCONN indicates all other connections. 236 * 237 * void ipcl_conn_destroy(connp) 238 * 239 * Destroys the connection state, removes it from the global 240 * connection hash table and frees its memory. 241 */ 242 243 #include <sys/types.h> 244 #include <sys/stream.h> 245 #include <sys/stropts.h> 246 #include <sys/sysmacros.h> 247 #include <sys/strsubr.h> 248 #include <sys/strsun.h> 249 #define _SUN_TPI_VERSION 2 250 #include <sys/ddi.h> 251 #include <sys/cmn_err.h> 252 #include <sys/debug.h> 253 254 #include <sys/systm.h> 255 #include <sys/param.h> 256 #include <sys/kmem.h> 257 #include <sys/isa_defs.h> 258 #include <inet/common.h> 259 #include <netinet/ip6.h> 260 #include <netinet/icmp6.h> 261 262 #include <inet/ip.h> 263 #include <inet/ip6.h> 264 #include <inet/tcp.h> 265 #include <inet/ip_ndp.h> 266 #include <inet/udp_impl.h> 267 #include <inet/sctp_ip.h> 268 #include <inet/sctp/sctp_impl.h> 269 #include <inet/rawip_impl.h> 270 #include <inet/rts_impl.h> 271 272 #include <sys/cpuvar.h> 273 274 #include <inet/ipclassifier.h> 275 #include <inet/ipsec_impl.h> 276 277 #include <sys/tsol/tnet.h> 278 279 #ifdef DEBUG 280 #define IPCL_DEBUG 281 #else 282 #undef IPCL_DEBUG 283 #endif 284 285 #ifdef IPCL_DEBUG 286 int ipcl_debug_level = 0; 287 #define IPCL_DEBUG_LVL(level, args) \ 288 if (ipcl_debug_level & level) { printf args; } 289 #else 290 #define IPCL_DEBUG_LVL(level, args) {; } 291 #endif 292 /* Old value for compatibility. Setable in /etc/system */ 293 uint_t tcp_conn_hash_size = 0; 294 295 /* New value. Zero means choose automatically. Setable in /etc/system */ 296 uint_t ipcl_conn_hash_size = 0; 297 uint_t ipcl_conn_hash_memfactor = 8192; 298 uint_t ipcl_conn_hash_maxsize = 82500; 299 300 /* bind/udp fanout table size */ 301 uint_t ipcl_bind_fanout_size = 512; 302 uint_t ipcl_udp_fanout_size = 16384; 303 304 /* Raw socket fanout size. Must be a power of 2. */ 305 uint_t ipcl_raw_fanout_size = 256; 306 307 /* 308 * Power of 2^N Primes useful for hashing for N of 0-28, 309 * these primes are the nearest prime <= 2^N - 2^(N-2). 310 */ 311 312 #define P2Ps() {0, 0, 0, 5, 11, 23, 47, 89, 191, 383, 761, 1531, 3067, \ 313 6143, 12281, 24571, 49139, 98299, 196597, 393209, \ 314 786431, 1572853, 3145721, 6291449, 12582893, 25165813, \ 315 50331599, 100663291, 201326557, 0} 316 317 /* 318 * wrapper structure to ensure that conn and what follows it (tcp_t, etc) 319 * are aligned on cache lines. 320 */ 321 typedef union itc_s { 322 conn_t itc_conn; 323 char itcu_filler[CACHE_ALIGN(conn_s)]; 324 } itc_t; 325 326 struct kmem_cache *tcp_conn_cache; 327 struct kmem_cache *ip_conn_cache; 328 extern struct kmem_cache *sctp_conn_cache; 329 extern struct kmem_cache *tcp_sack_info_cache; 330 extern struct kmem_cache *tcp_iphc_cache; 331 struct kmem_cache *udp_conn_cache; 332 struct kmem_cache *rawip_conn_cache; 333 struct kmem_cache *rts_conn_cache; 334 335 extern void tcp_timermp_free(tcp_t *); 336 extern mblk_t *tcp_timermp_alloc(int); 337 338 static int ip_conn_constructor(void *, void *, int); 339 static void ip_conn_destructor(void *, void *); 340 341 static int tcp_conn_constructor(void *, void *, int); 342 static void tcp_conn_destructor(void *, void *); 343 344 static int udp_conn_constructor(void *, void *, int); 345 static void udp_conn_destructor(void *, void *); 346 347 static int rawip_conn_constructor(void *, void *, int); 348 static void rawip_conn_destructor(void *, void *); 349 350 static int rts_conn_constructor(void *, void *, int); 351 static void rts_conn_destructor(void *, void *); 352 353 #ifdef IPCL_DEBUG 354 #define INET_NTOA_BUFSIZE 18 355 356 static char * 357 inet_ntoa_r(uint32_t in, char *b) 358 { 359 unsigned char *p; 360 361 p = (unsigned char *)∈ 362 (void) sprintf(b, "%d.%d.%d.%d", p[0], p[1], p[2], p[3]); 363 return (b); 364 } 365 #endif 366 367 /* 368 * Global (for all stack instances) init routine 369 */ 370 void 371 ipcl_g_init(void) 372 { 373 ip_conn_cache = kmem_cache_create("ip_conn_cache", 374 sizeof (conn_t), CACHE_ALIGN_SIZE, 375 ip_conn_constructor, ip_conn_destructor, 376 NULL, NULL, NULL, 0); 377 378 tcp_conn_cache = kmem_cache_create("tcp_conn_cache", 379 sizeof (itc_t) + sizeof (tcp_t), CACHE_ALIGN_SIZE, 380 tcp_conn_constructor, tcp_conn_destructor, 381 NULL, NULL, NULL, 0); 382 383 udp_conn_cache = kmem_cache_create("udp_conn_cache", 384 sizeof (itc_t) + sizeof (udp_t), CACHE_ALIGN_SIZE, 385 udp_conn_constructor, udp_conn_destructor, 386 NULL, NULL, NULL, 0); 387 388 rawip_conn_cache = kmem_cache_create("rawip_conn_cache", 389 sizeof (itc_t) + sizeof (icmp_t), CACHE_ALIGN_SIZE, 390 rawip_conn_constructor, rawip_conn_destructor, 391 NULL, NULL, NULL, 0); 392 393 rts_conn_cache = kmem_cache_create("rts_conn_cache", 394 sizeof (itc_t) + sizeof (rts_t), CACHE_ALIGN_SIZE, 395 rts_conn_constructor, rts_conn_destructor, 396 NULL, NULL, NULL, 0); 397 } 398 399 /* 400 * ipclassifier intialization routine, sets up hash tables. 401 */ 402 void 403 ipcl_init(ip_stack_t *ipst) 404 { 405 int i; 406 int sizes[] = P2Ps(); 407 408 /* 409 * Calculate size of conn fanout table from /etc/system settings 410 */ 411 if (ipcl_conn_hash_size != 0) { 412 ipst->ips_ipcl_conn_fanout_size = ipcl_conn_hash_size; 413 } else if (tcp_conn_hash_size != 0) { 414 ipst->ips_ipcl_conn_fanout_size = tcp_conn_hash_size; 415 } else { 416 extern pgcnt_t freemem; 417 418 ipst->ips_ipcl_conn_fanout_size = 419 (freemem * PAGESIZE) / ipcl_conn_hash_memfactor; 420 421 if (ipst->ips_ipcl_conn_fanout_size > ipcl_conn_hash_maxsize) { 422 ipst->ips_ipcl_conn_fanout_size = 423 ipcl_conn_hash_maxsize; 424 } 425 } 426 427 for (i = 9; i < sizeof (sizes) / sizeof (*sizes) - 1; i++) { 428 if (sizes[i] >= ipst->ips_ipcl_conn_fanout_size) { 429 break; 430 } 431 } 432 if ((ipst->ips_ipcl_conn_fanout_size = sizes[i]) == 0) { 433 /* Out of range, use the 2^16 value */ 434 ipst->ips_ipcl_conn_fanout_size = sizes[16]; 435 } 436 437 /* Take values from /etc/system */ 438 ipst->ips_ipcl_bind_fanout_size = ipcl_bind_fanout_size; 439 ipst->ips_ipcl_udp_fanout_size = ipcl_udp_fanout_size; 440 ipst->ips_ipcl_raw_fanout_size = ipcl_raw_fanout_size; 441 442 ASSERT(ipst->ips_ipcl_conn_fanout == NULL); 443 444 ipst->ips_ipcl_conn_fanout = kmem_zalloc( 445 ipst->ips_ipcl_conn_fanout_size * sizeof (connf_t), KM_SLEEP); 446 447 for (i = 0; i < ipst->ips_ipcl_conn_fanout_size; i++) { 448 mutex_init(&ipst->ips_ipcl_conn_fanout[i].connf_lock, NULL, 449 MUTEX_DEFAULT, NULL); 450 } 451 452 ipst->ips_ipcl_bind_fanout = kmem_zalloc( 453 ipst->ips_ipcl_bind_fanout_size * sizeof (connf_t), KM_SLEEP); 454 455 for (i = 0; i < ipst->ips_ipcl_bind_fanout_size; i++) { 456 mutex_init(&ipst->ips_ipcl_bind_fanout[i].connf_lock, NULL, 457 MUTEX_DEFAULT, NULL); 458 } 459 460 ipst->ips_ipcl_proto_fanout = kmem_zalloc(IPPROTO_MAX * 461 sizeof (connf_t), KM_SLEEP); 462 for (i = 0; i < IPPROTO_MAX; i++) { 463 mutex_init(&ipst->ips_ipcl_proto_fanout[i].connf_lock, NULL, 464 MUTEX_DEFAULT, NULL); 465 } 466 467 ipst->ips_ipcl_proto_fanout_v6 = kmem_zalloc(IPPROTO_MAX * 468 sizeof (connf_t), KM_SLEEP); 469 for (i = 0; i < IPPROTO_MAX; i++) { 470 mutex_init(&ipst->ips_ipcl_proto_fanout_v6[i].connf_lock, NULL, 471 MUTEX_DEFAULT, NULL); 472 } 473 474 ipst->ips_rts_clients = kmem_zalloc(sizeof (connf_t), KM_SLEEP); 475 mutex_init(&ipst->ips_rts_clients->connf_lock, 476 NULL, MUTEX_DEFAULT, NULL); 477 478 ipst->ips_ipcl_udp_fanout = kmem_zalloc( 479 ipst->ips_ipcl_udp_fanout_size * sizeof (connf_t), KM_SLEEP); 480 for (i = 0; i < ipst->ips_ipcl_udp_fanout_size; i++) { 481 mutex_init(&ipst->ips_ipcl_udp_fanout[i].connf_lock, NULL, 482 MUTEX_DEFAULT, NULL); 483 } 484 485 ipst->ips_ipcl_raw_fanout = kmem_zalloc( 486 ipst->ips_ipcl_raw_fanout_size * sizeof (connf_t), KM_SLEEP); 487 for (i = 0; i < ipst->ips_ipcl_raw_fanout_size; i++) { 488 mutex_init(&ipst->ips_ipcl_raw_fanout[i].connf_lock, NULL, 489 MUTEX_DEFAULT, NULL); 490 } 491 492 ipst->ips_ipcl_globalhash_fanout = kmem_zalloc( 493 sizeof (connf_t) * CONN_G_HASH_SIZE, KM_SLEEP); 494 for (i = 0; i < CONN_G_HASH_SIZE; i++) { 495 mutex_init(&ipst->ips_ipcl_globalhash_fanout[i].connf_lock, 496 NULL, MUTEX_DEFAULT, NULL); 497 } 498 } 499 500 void 501 ipcl_g_destroy(void) 502 { 503 kmem_cache_destroy(ip_conn_cache); 504 kmem_cache_destroy(tcp_conn_cache); 505 kmem_cache_destroy(udp_conn_cache); 506 kmem_cache_destroy(rawip_conn_cache); 507 kmem_cache_destroy(rts_conn_cache); 508 } 509 510 /* 511 * All user-level and kernel use of the stack must be gone 512 * by now. 513 */ 514 void 515 ipcl_destroy(ip_stack_t *ipst) 516 { 517 int i; 518 519 for (i = 0; i < ipst->ips_ipcl_conn_fanout_size; i++) { 520 ASSERT(ipst->ips_ipcl_conn_fanout[i].connf_head == NULL); 521 mutex_destroy(&ipst->ips_ipcl_conn_fanout[i].connf_lock); 522 } 523 kmem_free(ipst->ips_ipcl_conn_fanout, ipst->ips_ipcl_conn_fanout_size * 524 sizeof (connf_t)); 525 ipst->ips_ipcl_conn_fanout = NULL; 526 527 for (i = 0; i < ipst->ips_ipcl_bind_fanout_size; i++) { 528 ASSERT(ipst->ips_ipcl_bind_fanout[i].connf_head == NULL); 529 mutex_destroy(&ipst->ips_ipcl_bind_fanout[i].connf_lock); 530 } 531 kmem_free(ipst->ips_ipcl_bind_fanout, ipst->ips_ipcl_bind_fanout_size * 532 sizeof (connf_t)); 533 ipst->ips_ipcl_bind_fanout = NULL; 534 535 for (i = 0; i < IPPROTO_MAX; i++) { 536 ASSERT(ipst->ips_ipcl_proto_fanout[i].connf_head == NULL); 537 mutex_destroy(&ipst->ips_ipcl_proto_fanout[i].connf_lock); 538 } 539 kmem_free(ipst->ips_ipcl_proto_fanout, IPPROTO_MAX * sizeof (connf_t)); 540 ipst->ips_ipcl_proto_fanout = NULL; 541 542 for (i = 0; i < IPPROTO_MAX; i++) { 543 ASSERT(ipst->ips_ipcl_proto_fanout_v6[i].connf_head == NULL); 544 mutex_destroy(&ipst->ips_ipcl_proto_fanout_v6[i].connf_lock); 545 } 546 kmem_free(ipst->ips_ipcl_proto_fanout_v6, 547 IPPROTO_MAX * sizeof (connf_t)); 548 ipst->ips_ipcl_proto_fanout_v6 = NULL; 549 550 for (i = 0; i < ipst->ips_ipcl_udp_fanout_size; i++) { 551 ASSERT(ipst->ips_ipcl_udp_fanout[i].connf_head == NULL); 552 mutex_destroy(&ipst->ips_ipcl_udp_fanout[i].connf_lock); 553 } 554 kmem_free(ipst->ips_ipcl_udp_fanout, ipst->ips_ipcl_udp_fanout_size * 555 sizeof (connf_t)); 556 ipst->ips_ipcl_udp_fanout = NULL; 557 558 for (i = 0; i < ipst->ips_ipcl_raw_fanout_size; i++) { 559 ASSERT(ipst->ips_ipcl_raw_fanout[i].connf_head == NULL); 560 mutex_destroy(&ipst->ips_ipcl_raw_fanout[i].connf_lock); 561 } 562 kmem_free(ipst->ips_ipcl_raw_fanout, ipst->ips_ipcl_raw_fanout_size * 563 sizeof (connf_t)); 564 ipst->ips_ipcl_raw_fanout = NULL; 565 566 for (i = 0; i < CONN_G_HASH_SIZE; i++) { 567 ASSERT(ipst->ips_ipcl_globalhash_fanout[i].connf_head == NULL); 568 mutex_destroy(&ipst->ips_ipcl_globalhash_fanout[i].connf_lock); 569 } 570 kmem_free(ipst->ips_ipcl_globalhash_fanout, 571 sizeof (connf_t) * CONN_G_HASH_SIZE); 572 ipst->ips_ipcl_globalhash_fanout = NULL; 573 574 ASSERT(ipst->ips_rts_clients->connf_head == NULL); 575 mutex_destroy(&ipst->ips_rts_clients->connf_lock); 576 kmem_free(ipst->ips_rts_clients, sizeof (connf_t)); 577 ipst->ips_rts_clients = NULL; 578 } 579 580 /* 581 * conn creation routine. initialize the conn, sets the reference 582 * and inserts it in the global hash table. 583 */ 584 conn_t * 585 ipcl_conn_create(uint32_t type, int sleep, netstack_t *ns) 586 { 587 conn_t *connp; 588 sctp_stack_t *sctps; 589 struct kmem_cache *conn_cache; 590 591 switch (type) { 592 case IPCL_SCTPCONN: 593 if ((connp = kmem_cache_alloc(sctp_conn_cache, sleep)) == NULL) 594 return (NULL); 595 sctp_conn_init(connp); 596 sctps = ns->netstack_sctp; 597 SCTP_G_Q_REFHOLD(sctps); 598 netstack_hold(ns); 599 connp->conn_netstack = ns; 600 return (connp); 601 602 case IPCL_TCPCONN: 603 conn_cache = tcp_conn_cache; 604 break; 605 606 case IPCL_UDPCONN: 607 conn_cache = udp_conn_cache; 608 break; 609 610 case IPCL_RAWIPCONN: 611 conn_cache = rawip_conn_cache; 612 break; 613 614 case IPCL_RTSCONN: 615 conn_cache = rts_conn_cache; 616 break; 617 618 case IPCL_IPCCONN: 619 conn_cache = ip_conn_cache; 620 break; 621 622 default: 623 connp = NULL; 624 ASSERT(0); 625 } 626 627 if ((connp = kmem_cache_alloc(conn_cache, sleep)) == NULL) 628 return (NULL); 629 630 connp->conn_ref = 1; 631 netstack_hold(ns); 632 connp->conn_netstack = ns; 633 ipcl_globalhash_insert(connp); 634 return (connp); 635 } 636 637 void 638 ipcl_conn_destroy(conn_t *connp) 639 { 640 mblk_t *mp; 641 netstack_t *ns = connp->conn_netstack; 642 643 ASSERT(!MUTEX_HELD(&connp->conn_lock)); 644 ASSERT(connp->conn_ref == 0); 645 ASSERT(connp->conn_ire_cache == NULL); 646 647 DTRACE_PROBE1(conn__destroy, conn_t *, connp); 648 649 if (connp->conn_peercred != NULL && 650 connp->conn_peercred != connp->conn_cred) 651 crfree(connp->conn_peercred); 652 connp->conn_peercred = NULL; 653 654 if (connp->conn_cred != NULL) { 655 crfree(connp->conn_cred); 656 connp->conn_cred = NULL; 657 } 658 659 ipcl_globalhash_remove(connp); 660 661 /* FIXME: add separate tcp_conn_free()? */ 662 if (connp->conn_flags & IPCL_TCPCONN) { 663 tcp_t *tcp = connp->conn_tcp; 664 tcp_stack_t *tcps; 665 666 ASSERT(tcp != NULL); 667 tcps = tcp->tcp_tcps; 668 if (tcps != NULL) { 669 if (connp->conn_latch != NULL) { 670 IPLATCH_REFRELE(connp->conn_latch, ns); 671 connp->conn_latch = NULL; 672 } 673 if (connp->conn_policy != NULL) { 674 IPPH_REFRELE(connp->conn_policy, ns); 675 connp->conn_policy = NULL; 676 } 677 tcp->tcp_tcps = NULL; 678 TCPS_REFRELE(tcps); 679 } 680 681 tcp_free(tcp); 682 mp = tcp->tcp_timercache; 683 tcp->tcp_cred = NULL; 684 685 if (tcp->tcp_sack_info != NULL) { 686 bzero(tcp->tcp_sack_info, sizeof (tcp_sack_info_t)); 687 kmem_cache_free(tcp_sack_info_cache, 688 tcp->tcp_sack_info); 689 } 690 if (tcp->tcp_iphc != NULL) { 691 if (tcp->tcp_hdr_grown) { 692 kmem_free(tcp->tcp_iphc, tcp->tcp_iphc_len); 693 } else { 694 bzero(tcp->tcp_iphc, tcp->tcp_iphc_len); 695 kmem_cache_free(tcp_iphc_cache, tcp->tcp_iphc); 696 } 697 tcp->tcp_iphc_len = 0; 698 } 699 ASSERT(tcp->tcp_iphc_len == 0); 700 701 ASSERT(connp->conn_latch == NULL); 702 ASSERT(connp->conn_policy == NULL); 703 704 if (ns != NULL) { 705 ASSERT(tcp->tcp_tcps == NULL); 706 connp->conn_netstack = NULL; 707 netstack_rele(ns); 708 } 709 710 ipcl_conn_cleanup(connp); 711 connp->conn_flags = IPCL_TCPCONN; 712 bzero(tcp, sizeof (tcp_t)); 713 714 tcp->tcp_timercache = mp; 715 tcp->tcp_connp = connp; 716 kmem_cache_free(tcp_conn_cache, connp); 717 return; 718 } 719 if (connp->conn_latch != NULL) { 720 IPLATCH_REFRELE(connp->conn_latch, connp->conn_netstack); 721 connp->conn_latch = NULL; 722 } 723 if (connp->conn_policy != NULL) { 724 IPPH_REFRELE(connp->conn_policy, connp->conn_netstack); 725 connp->conn_policy = NULL; 726 } 727 if (connp->conn_ipsec_opt_mp != NULL) { 728 freemsg(connp->conn_ipsec_opt_mp); 729 connp->conn_ipsec_opt_mp = NULL; 730 } 731 732 if (connp->conn_flags & IPCL_SCTPCONN) { 733 ASSERT(ns != NULL); 734 sctp_free(connp); 735 return; 736 } 737 738 if (ns != NULL) { 739 connp->conn_netstack = NULL; 740 netstack_rele(ns); 741 } 742 ipcl_conn_cleanup(connp); 743 744 /* leave conn_priv aka conn_udp, conn_icmp, etc in place. */ 745 if (connp->conn_flags & IPCL_UDPCONN) { 746 connp->conn_flags = IPCL_UDPCONN; 747 kmem_cache_free(udp_conn_cache, connp); 748 } else if (connp->conn_flags & IPCL_RAWIPCONN) { 749 connp->conn_flags = IPCL_RAWIPCONN; 750 connp->conn_ulp = IPPROTO_ICMP; 751 kmem_cache_free(rawip_conn_cache, connp); 752 } else if (connp->conn_flags & IPCL_RTSCONN) { 753 connp->conn_flags = IPCL_RTSCONN; 754 kmem_cache_free(rts_conn_cache, connp); 755 } else { 756 connp->conn_flags = IPCL_IPCCONN; 757 ASSERT(connp->conn_flags & IPCL_IPCCONN); 758 ASSERT(connp->conn_priv == NULL); 759 kmem_cache_free(ip_conn_cache, connp); 760 } 761 } 762 763 /* 764 * Running in cluster mode - deregister listener information 765 */ 766 767 static void 768 ipcl_conn_unlisten(conn_t *connp) 769 { 770 ASSERT((connp->conn_flags & IPCL_CL_LISTENER) != 0); 771 ASSERT(connp->conn_lport != 0); 772 773 if (cl_inet_unlisten != NULL) { 774 sa_family_t addr_family; 775 uint8_t *laddrp; 776 777 if (connp->conn_pkt_isv6) { 778 addr_family = AF_INET6; 779 laddrp = (uint8_t *)&connp->conn_bound_source_v6; 780 } else { 781 addr_family = AF_INET; 782 laddrp = (uint8_t *)&connp->conn_bound_source; 783 } 784 (*cl_inet_unlisten)(IPPROTO_TCP, addr_family, laddrp, 785 connp->conn_lport); 786 } 787 connp->conn_flags &= ~IPCL_CL_LISTENER; 788 } 789 790 /* 791 * We set the IPCL_REMOVED flag (instead of clearing the flag indicating 792 * which table the conn belonged to). So for debugging we can see which hash 793 * table this connection was in. 794 */ 795 #define IPCL_HASH_REMOVE(connp) { \ 796 connf_t *connfp = (connp)->conn_fanout; \ 797 ASSERT(!MUTEX_HELD(&((connp)->conn_lock))); \ 798 if (connfp != NULL) { \ 799 IPCL_DEBUG_LVL(4, ("IPCL_HASH_REMOVE: connp %p", \ 800 (void *)(connp))); \ 801 mutex_enter(&connfp->connf_lock); \ 802 if ((connp)->conn_next != NULL) \ 803 (connp)->conn_next->conn_prev = \ 804 (connp)->conn_prev; \ 805 if ((connp)->conn_prev != NULL) \ 806 (connp)->conn_prev->conn_next = \ 807 (connp)->conn_next; \ 808 else \ 809 connfp->connf_head = (connp)->conn_next; \ 810 (connp)->conn_fanout = NULL; \ 811 (connp)->conn_next = NULL; \ 812 (connp)->conn_prev = NULL; \ 813 (connp)->conn_flags |= IPCL_REMOVED; \ 814 if (((connp)->conn_flags & IPCL_CL_LISTENER) != 0) \ 815 ipcl_conn_unlisten((connp)); \ 816 CONN_DEC_REF((connp)); \ 817 mutex_exit(&connfp->connf_lock); \ 818 } \ 819 } 820 821 void 822 ipcl_hash_remove(conn_t *connp) 823 { 824 IPCL_HASH_REMOVE(connp); 825 } 826 827 /* 828 * The whole purpose of this function is allow removal of 829 * a conn_t from the connected hash for timewait reclaim. 830 * This is essentially a TW reclaim fastpath where timewait 831 * collector checks under fanout lock (so no one else can 832 * get access to the conn_t) that refcnt is 2 i.e. one for 833 * TCP and one for the classifier hash list. If ref count 834 * is indeed 2, we can just remove the conn under lock and 835 * avoid cleaning up the conn under squeue. This gives us 836 * improved performance. 837 */ 838 void 839 ipcl_hash_remove_locked(conn_t *connp, connf_t *connfp) 840 { 841 ASSERT(MUTEX_HELD(&connfp->connf_lock)); 842 ASSERT(MUTEX_HELD(&connp->conn_lock)); 843 ASSERT((connp->conn_flags & IPCL_CL_LISTENER) == 0); 844 845 if ((connp)->conn_next != NULL) { 846 (connp)->conn_next->conn_prev = (connp)->conn_prev; 847 } 848 if ((connp)->conn_prev != NULL) { 849 (connp)->conn_prev->conn_next = (connp)->conn_next; 850 } else { 851 connfp->connf_head = (connp)->conn_next; 852 } 853 (connp)->conn_fanout = NULL; 854 (connp)->conn_next = NULL; 855 (connp)->conn_prev = NULL; 856 (connp)->conn_flags |= IPCL_REMOVED; 857 ASSERT((connp)->conn_ref == 2); 858 (connp)->conn_ref--; 859 } 860 861 #define IPCL_HASH_INSERT_CONNECTED_LOCKED(connfp, connp) { \ 862 ASSERT((connp)->conn_fanout == NULL); \ 863 ASSERT((connp)->conn_next == NULL); \ 864 ASSERT((connp)->conn_prev == NULL); \ 865 if ((connfp)->connf_head != NULL) { \ 866 (connfp)->connf_head->conn_prev = (connp); \ 867 (connp)->conn_next = (connfp)->connf_head; \ 868 } \ 869 (connp)->conn_fanout = (connfp); \ 870 (connfp)->connf_head = (connp); \ 871 (connp)->conn_flags = ((connp)->conn_flags & ~IPCL_REMOVED) | \ 872 IPCL_CONNECTED; \ 873 CONN_INC_REF(connp); \ 874 } 875 876 #define IPCL_HASH_INSERT_CONNECTED(connfp, connp) { \ 877 IPCL_DEBUG_LVL(8, ("IPCL_HASH_INSERT_CONNECTED: connfp %p " \ 878 "connp %p", (void *)(connfp), (void *)(connp))); \ 879 IPCL_HASH_REMOVE((connp)); \ 880 mutex_enter(&(connfp)->connf_lock); \ 881 IPCL_HASH_INSERT_CONNECTED_LOCKED(connfp, connp); \ 882 mutex_exit(&(connfp)->connf_lock); \ 883 } 884 885 #define IPCL_HASH_INSERT_BOUND(connfp, connp) { \ 886 conn_t *pconnp = NULL, *nconnp; \ 887 IPCL_DEBUG_LVL(32, ("IPCL_HASH_INSERT_BOUND: connfp %p " \ 888 "connp %p", (void *)connfp, (void *)(connp))); \ 889 IPCL_HASH_REMOVE((connp)); \ 890 mutex_enter(&(connfp)->connf_lock); \ 891 nconnp = (connfp)->connf_head; \ 892 while (nconnp != NULL && \ 893 !_IPCL_V4_MATCH_ANY(nconnp->conn_srcv6)) { \ 894 pconnp = nconnp; \ 895 nconnp = nconnp->conn_next; \ 896 } \ 897 if (pconnp != NULL) { \ 898 pconnp->conn_next = (connp); \ 899 (connp)->conn_prev = pconnp; \ 900 } else { \ 901 (connfp)->connf_head = (connp); \ 902 } \ 903 if (nconnp != NULL) { \ 904 (connp)->conn_next = nconnp; \ 905 nconnp->conn_prev = (connp); \ 906 } \ 907 (connp)->conn_fanout = (connfp); \ 908 (connp)->conn_flags = ((connp)->conn_flags & ~IPCL_REMOVED) | \ 909 IPCL_BOUND; \ 910 CONN_INC_REF(connp); \ 911 mutex_exit(&(connfp)->connf_lock); \ 912 } 913 914 #define IPCL_HASH_INSERT_WILDCARD(connfp, connp) { \ 915 conn_t **list, *prev, *next; \ 916 boolean_t isv4mapped = \ 917 IN6_IS_ADDR_V4MAPPED(&(connp)->conn_srcv6); \ 918 IPCL_DEBUG_LVL(32, ("IPCL_HASH_INSERT_WILDCARD: connfp %p " \ 919 "connp %p", (void *)(connfp), (void *)(connp))); \ 920 IPCL_HASH_REMOVE((connp)); \ 921 mutex_enter(&(connfp)->connf_lock); \ 922 list = &(connfp)->connf_head; \ 923 prev = NULL; \ 924 while ((next = *list) != NULL) { \ 925 if (isv4mapped && \ 926 IN6_IS_ADDR_UNSPECIFIED(&next->conn_srcv6) && \ 927 connp->conn_zoneid == next->conn_zoneid) { \ 928 (connp)->conn_next = next; \ 929 if (prev != NULL) \ 930 prev = next->conn_prev; \ 931 next->conn_prev = (connp); \ 932 break; \ 933 } \ 934 list = &next->conn_next; \ 935 prev = next; \ 936 } \ 937 (connp)->conn_prev = prev; \ 938 *list = (connp); \ 939 (connp)->conn_fanout = (connfp); \ 940 (connp)->conn_flags = ((connp)->conn_flags & ~IPCL_REMOVED) | \ 941 IPCL_BOUND; \ 942 CONN_INC_REF((connp)); \ 943 mutex_exit(&(connfp)->connf_lock); \ 944 } 945 946 void 947 ipcl_hash_insert_wildcard(connf_t *connfp, conn_t *connp) 948 { 949 IPCL_HASH_INSERT_WILDCARD(connfp, connp); 950 } 951 952 void 953 ipcl_proto_insert(conn_t *connp, uint8_t protocol) 954 { 955 connf_t *connfp; 956 ip_stack_t *ipst = connp->conn_netstack->netstack_ip; 957 958 ASSERT(connp != NULL); 959 ASSERT(!connp->conn_mac_exempt || protocol == IPPROTO_AH || 960 protocol == IPPROTO_ESP); 961 962 connp->conn_ulp = protocol; 963 964 /* Insert it in the protocol hash */ 965 connfp = &ipst->ips_ipcl_proto_fanout[protocol]; 966 IPCL_HASH_INSERT_WILDCARD(connfp, connp); 967 } 968 969 void 970 ipcl_proto_insert_v6(conn_t *connp, uint8_t protocol) 971 { 972 connf_t *connfp; 973 ip_stack_t *ipst = connp->conn_netstack->netstack_ip; 974 975 ASSERT(connp != NULL); 976 ASSERT(!connp->conn_mac_exempt || protocol == IPPROTO_AH || 977 protocol == IPPROTO_ESP); 978 979 connp->conn_ulp = protocol; 980 981 /* Insert it in the Bind Hash */ 982 connfp = &ipst->ips_ipcl_proto_fanout_v6[protocol]; 983 IPCL_HASH_INSERT_WILDCARD(connfp, connp); 984 } 985 986 /* 987 * This function is used only for inserting SCTP raw socket now. 988 * This may change later. 989 * 990 * Note that only one raw socket can be bound to a port. The param 991 * lport is in network byte order. 992 */ 993 static int 994 ipcl_sctp_hash_insert(conn_t *connp, in_port_t lport) 995 { 996 connf_t *connfp; 997 conn_t *oconnp; 998 ip_stack_t *ipst = connp->conn_netstack->netstack_ip; 999 1000 connfp = &ipst->ips_ipcl_raw_fanout[IPCL_RAW_HASH(ntohs(lport), ipst)]; 1001 1002 /* Check for existing raw socket already bound to the port. */ 1003 mutex_enter(&connfp->connf_lock); 1004 for (oconnp = connfp->connf_head; oconnp != NULL; 1005 oconnp = oconnp->conn_next) { 1006 if (oconnp->conn_lport == lport && 1007 oconnp->conn_zoneid == connp->conn_zoneid && 1008 oconnp->conn_af_isv6 == connp->conn_af_isv6 && 1009 ((IN6_IS_ADDR_UNSPECIFIED(&connp->conn_srcv6) || 1010 IN6_IS_ADDR_UNSPECIFIED(&oconnp->conn_srcv6) || 1011 IN6_IS_ADDR_V4MAPPED_ANY(&connp->conn_srcv6) || 1012 IN6_IS_ADDR_V4MAPPED_ANY(&oconnp->conn_srcv6)) || 1013 IN6_ARE_ADDR_EQUAL(&oconnp->conn_srcv6, 1014 &connp->conn_srcv6))) { 1015 break; 1016 } 1017 } 1018 mutex_exit(&connfp->connf_lock); 1019 if (oconnp != NULL) 1020 return (EADDRNOTAVAIL); 1021 1022 if (IN6_IS_ADDR_UNSPECIFIED(&connp->conn_remv6) || 1023 IN6_IS_ADDR_V4MAPPED_ANY(&connp->conn_remv6)) { 1024 if (IN6_IS_ADDR_UNSPECIFIED(&connp->conn_srcv6) || 1025 IN6_IS_ADDR_V4MAPPED_ANY(&connp->conn_srcv6)) { 1026 IPCL_HASH_INSERT_WILDCARD(connfp, connp); 1027 } else { 1028 IPCL_HASH_INSERT_BOUND(connfp, connp); 1029 } 1030 } else { 1031 IPCL_HASH_INSERT_CONNECTED(connfp, connp); 1032 } 1033 return (0); 1034 } 1035 1036 /* 1037 * Check for a MAC exemption conflict on a labeled system. Note that for 1038 * protocols that use port numbers (UDP, TCP, SCTP), we do this check up in the 1039 * transport layer. This check is for binding all other protocols. 1040 * 1041 * Returns true if there's a conflict. 1042 */ 1043 static boolean_t 1044 check_exempt_conflict_v4(conn_t *connp, ip_stack_t *ipst) 1045 { 1046 connf_t *connfp; 1047 conn_t *tconn; 1048 1049 connfp = &ipst->ips_ipcl_proto_fanout[connp->conn_ulp]; 1050 mutex_enter(&connfp->connf_lock); 1051 for (tconn = connfp->connf_head; tconn != NULL; 1052 tconn = tconn->conn_next) { 1053 /* We don't allow v4 fallback for v6 raw socket */ 1054 if (connp->conn_af_isv6 != tconn->conn_af_isv6) 1055 continue; 1056 /* If neither is exempt, then there's no conflict */ 1057 if (!connp->conn_mac_exempt && !tconn->conn_mac_exempt) 1058 continue; 1059 /* If both are bound to different specific addrs, ok */ 1060 if (connp->conn_src != INADDR_ANY && 1061 tconn->conn_src != INADDR_ANY && 1062 connp->conn_src != tconn->conn_src) 1063 continue; 1064 /* These two conflict; fail */ 1065 break; 1066 } 1067 mutex_exit(&connfp->connf_lock); 1068 return (tconn != NULL); 1069 } 1070 1071 static boolean_t 1072 check_exempt_conflict_v6(conn_t *connp, ip_stack_t *ipst) 1073 { 1074 connf_t *connfp; 1075 conn_t *tconn; 1076 1077 connfp = &ipst->ips_ipcl_proto_fanout[connp->conn_ulp]; 1078 mutex_enter(&connfp->connf_lock); 1079 for (tconn = connfp->connf_head; tconn != NULL; 1080 tconn = tconn->conn_next) { 1081 /* We don't allow v4 fallback for v6 raw socket */ 1082 if (connp->conn_af_isv6 != tconn->conn_af_isv6) 1083 continue; 1084 /* If neither is exempt, then there's no conflict */ 1085 if (!connp->conn_mac_exempt && !tconn->conn_mac_exempt) 1086 continue; 1087 /* If both are bound to different addrs, ok */ 1088 if (!IN6_IS_ADDR_UNSPECIFIED(&connp->conn_srcv6) && 1089 !IN6_IS_ADDR_UNSPECIFIED(&tconn->conn_srcv6) && 1090 !IN6_ARE_ADDR_EQUAL(&connp->conn_srcv6, &tconn->conn_srcv6)) 1091 continue; 1092 /* These two conflict; fail */ 1093 break; 1094 } 1095 mutex_exit(&connfp->connf_lock); 1096 return (tconn != NULL); 1097 } 1098 1099 /* 1100 * (v4, v6) bind hash insertion routines 1101 */ 1102 int 1103 ipcl_bind_insert(conn_t *connp, uint8_t protocol, ipaddr_t src, uint16_t lport) 1104 { 1105 connf_t *connfp; 1106 #ifdef IPCL_DEBUG 1107 char buf[INET_NTOA_BUFSIZE]; 1108 #endif 1109 int ret = 0; 1110 ip_stack_t *ipst = connp->conn_netstack->netstack_ip; 1111 1112 ASSERT(connp); 1113 1114 IPCL_DEBUG_LVL(64, ("ipcl_bind_insert: connp %p, src = %s, " 1115 "port = %d\n", (void *)connp, inet_ntoa_r(src, buf), lport)); 1116 1117 connp->conn_ulp = protocol; 1118 IN6_IPADDR_TO_V4MAPPED(src, &connp->conn_srcv6); 1119 connp->conn_lport = lport; 1120 1121 switch (protocol) { 1122 default: 1123 if (is_system_labeled() && 1124 check_exempt_conflict_v4(connp, ipst)) 1125 return (EADDRINUSE); 1126 /* FALLTHROUGH */ 1127 case IPPROTO_UDP: 1128 if (protocol == IPPROTO_UDP) { 1129 IPCL_DEBUG_LVL(64, 1130 ("ipcl_bind_insert: connp %p - udp\n", 1131 (void *)connp)); 1132 connfp = &ipst->ips_ipcl_udp_fanout[ 1133 IPCL_UDP_HASH(lport, ipst)]; 1134 } else { 1135 IPCL_DEBUG_LVL(64, 1136 ("ipcl_bind_insert: connp %p - protocol\n", 1137 (void *)connp)); 1138 connfp = &ipst->ips_ipcl_proto_fanout[protocol]; 1139 } 1140 1141 if (connp->conn_rem != INADDR_ANY) { 1142 IPCL_HASH_INSERT_CONNECTED(connfp, connp); 1143 } else if (connp->conn_src != INADDR_ANY) { 1144 IPCL_HASH_INSERT_BOUND(connfp, connp); 1145 } else { 1146 IPCL_HASH_INSERT_WILDCARD(connfp, connp); 1147 } 1148 break; 1149 1150 case IPPROTO_TCP: 1151 1152 /* Insert it in the Bind Hash */ 1153 ASSERT(connp->conn_zoneid != ALL_ZONES); 1154 connfp = &ipst->ips_ipcl_bind_fanout[ 1155 IPCL_BIND_HASH(lport, ipst)]; 1156 if (connp->conn_src != INADDR_ANY) { 1157 IPCL_HASH_INSERT_BOUND(connfp, connp); 1158 } else { 1159 IPCL_HASH_INSERT_WILDCARD(connfp, connp); 1160 } 1161 if (cl_inet_listen != NULL) { 1162 ASSERT(!connp->conn_pkt_isv6); 1163 connp->conn_flags |= IPCL_CL_LISTENER; 1164 (*cl_inet_listen)(IPPROTO_TCP, AF_INET, 1165 (uint8_t *)&connp->conn_bound_source, lport); 1166 } 1167 break; 1168 1169 case IPPROTO_SCTP: 1170 ret = ipcl_sctp_hash_insert(connp, lport); 1171 break; 1172 } 1173 1174 return (ret); 1175 } 1176 1177 int 1178 ipcl_bind_insert_v6(conn_t *connp, uint8_t protocol, const in6_addr_t *src, 1179 uint16_t lport) 1180 { 1181 connf_t *connfp; 1182 int ret = 0; 1183 ip_stack_t *ipst = connp->conn_netstack->netstack_ip; 1184 1185 ASSERT(connp); 1186 1187 connp->conn_ulp = protocol; 1188 connp->conn_srcv6 = *src; 1189 connp->conn_lport = lport; 1190 1191 switch (protocol) { 1192 default: 1193 if (is_system_labeled() && 1194 check_exempt_conflict_v6(connp, ipst)) 1195 return (EADDRINUSE); 1196 /* FALLTHROUGH */ 1197 case IPPROTO_UDP: 1198 if (protocol == IPPROTO_UDP) { 1199 IPCL_DEBUG_LVL(128, 1200 ("ipcl_bind_insert_v6: connp %p - udp\n", 1201 (void *)connp)); 1202 connfp = &ipst->ips_ipcl_udp_fanout[ 1203 IPCL_UDP_HASH(lport, ipst)]; 1204 } else { 1205 IPCL_DEBUG_LVL(128, 1206 ("ipcl_bind_insert_v6: connp %p - protocol\n", 1207 (void *)connp)); 1208 connfp = &ipst->ips_ipcl_proto_fanout_v6[protocol]; 1209 } 1210 1211 if (!IN6_IS_ADDR_UNSPECIFIED(&connp->conn_remv6)) { 1212 IPCL_HASH_INSERT_CONNECTED(connfp, connp); 1213 } else if (!IN6_IS_ADDR_UNSPECIFIED(&connp->conn_srcv6)) { 1214 IPCL_HASH_INSERT_BOUND(connfp, connp); 1215 } else { 1216 IPCL_HASH_INSERT_WILDCARD(connfp, connp); 1217 } 1218 break; 1219 1220 case IPPROTO_TCP: 1221 /* XXX - Need a separate table for IN6_IS_ADDR_UNSPECIFIED? */ 1222 1223 /* Insert it in the Bind Hash */ 1224 ASSERT(connp->conn_zoneid != ALL_ZONES); 1225 connfp = &ipst->ips_ipcl_bind_fanout[ 1226 IPCL_BIND_HASH(lport, ipst)]; 1227 if (!IN6_IS_ADDR_UNSPECIFIED(&connp->conn_srcv6)) { 1228 IPCL_HASH_INSERT_BOUND(connfp, connp); 1229 } else { 1230 IPCL_HASH_INSERT_WILDCARD(connfp, connp); 1231 } 1232 if (cl_inet_listen != NULL) { 1233 sa_family_t addr_family; 1234 uint8_t *laddrp; 1235 1236 if (connp->conn_pkt_isv6) { 1237 addr_family = AF_INET6; 1238 laddrp = 1239 (uint8_t *)&connp->conn_bound_source_v6; 1240 } else { 1241 addr_family = AF_INET; 1242 laddrp = (uint8_t *)&connp->conn_bound_source; 1243 } 1244 connp->conn_flags |= IPCL_CL_LISTENER; 1245 (*cl_inet_listen)(IPPROTO_TCP, addr_family, laddrp, 1246 lport); 1247 } 1248 break; 1249 1250 case IPPROTO_SCTP: 1251 ret = ipcl_sctp_hash_insert(connp, lport); 1252 break; 1253 } 1254 1255 return (ret); 1256 } 1257 1258 /* 1259 * ipcl_conn_hash insertion routines. 1260 */ 1261 int 1262 ipcl_conn_insert(conn_t *connp, uint8_t protocol, ipaddr_t src, 1263 ipaddr_t rem, uint32_t ports) 1264 { 1265 connf_t *connfp; 1266 uint16_t *up; 1267 conn_t *tconnp; 1268 #ifdef IPCL_DEBUG 1269 char sbuf[INET_NTOA_BUFSIZE], rbuf[INET_NTOA_BUFSIZE]; 1270 #endif 1271 in_port_t lport; 1272 int ret = 0; 1273 ip_stack_t *ipst = connp->conn_netstack->netstack_ip; 1274 1275 IPCL_DEBUG_LVL(256, ("ipcl_conn_insert: connp %p, src = %s, " 1276 "dst = %s, ports = %x, protocol = %x", (void *)connp, 1277 inet_ntoa_r(src, sbuf), inet_ntoa_r(rem, rbuf), 1278 ports, protocol)); 1279 1280 switch (protocol) { 1281 case IPPROTO_TCP: 1282 if (!(connp->conn_flags & IPCL_EAGER)) { 1283 /* 1284 * for a eager connection, i.e connections which 1285 * have just been created, the initialization is 1286 * already done in ip at conn_creation time, so 1287 * we can skip the checks here. 1288 */ 1289 IPCL_CONN_INIT(connp, protocol, src, rem, ports); 1290 } 1291 connfp = &ipst->ips_ipcl_conn_fanout[ 1292 IPCL_CONN_HASH(connp->conn_rem, 1293 connp->conn_ports, ipst)]; 1294 mutex_enter(&connfp->connf_lock); 1295 for (tconnp = connfp->connf_head; tconnp != NULL; 1296 tconnp = tconnp->conn_next) { 1297 if (IPCL_CONN_MATCH(tconnp, connp->conn_ulp, 1298 connp->conn_rem, connp->conn_src, 1299 connp->conn_ports)) { 1300 1301 /* Already have a conn. bail out */ 1302 mutex_exit(&connfp->connf_lock); 1303 return (EADDRINUSE); 1304 } 1305 } 1306 if (connp->conn_fanout != NULL) { 1307 /* 1308 * Probably a XTI/TLI application trying to do a 1309 * rebind. Let it happen. 1310 */ 1311 mutex_exit(&connfp->connf_lock); 1312 IPCL_HASH_REMOVE(connp); 1313 mutex_enter(&connfp->connf_lock); 1314 } 1315 1316 ASSERT(connp->conn_recv != NULL); 1317 1318 IPCL_HASH_INSERT_CONNECTED_LOCKED(connfp, connp); 1319 mutex_exit(&connfp->connf_lock); 1320 break; 1321 1322 case IPPROTO_SCTP: 1323 /* 1324 * The raw socket may have already been bound, remove it 1325 * from the hash first. 1326 */ 1327 IPCL_HASH_REMOVE(connp); 1328 lport = htons((uint16_t)(ntohl(ports) & 0xFFFF)); 1329 ret = ipcl_sctp_hash_insert(connp, lport); 1330 break; 1331 1332 default: 1333 /* 1334 * Check for conflicts among MAC exempt bindings. For 1335 * transports with port numbers, this is done by the upper 1336 * level per-transport binding logic. For all others, it's 1337 * done here. 1338 */ 1339 if (is_system_labeled() && 1340 check_exempt_conflict_v4(connp, ipst)) 1341 return (EADDRINUSE); 1342 /* FALLTHROUGH */ 1343 1344 case IPPROTO_UDP: 1345 up = (uint16_t *)&ports; 1346 IPCL_CONN_INIT(connp, protocol, src, rem, ports); 1347 if (protocol == IPPROTO_UDP) { 1348 connfp = &ipst->ips_ipcl_udp_fanout[ 1349 IPCL_UDP_HASH(up[1], ipst)]; 1350 } else { 1351 connfp = &ipst->ips_ipcl_proto_fanout[protocol]; 1352 } 1353 1354 if (connp->conn_rem != INADDR_ANY) { 1355 IPCL_HASH_INSERT_CONNECTED(connfp, connp); 1356 } else if (connp->conn_src != INADDR_ANY) { 1357 IPCL_HASH_INSERT_BOUND(connfp, connp); 1358 } else { 1359 IPCL_HASH_INSERT_WILDCARD(connfp, connp); 1360 } 1361 break; 1362 } 1363 1364 return (ret); 1365 } 1366 1367 int 1368 ipcl_conn_insert_v6(conn_t *connp, uint8_t protocol, const in6_addr_t *src, 1369 const in6_addr_t *rem, uint32_t ports, uint_t ifindex) 1370 { 1371 connf_t *connfp; 1372 uint16_t *up; 1373 conn_t *tconnp; 1374 in_port_t lport; 1375 int ret = 0; 1376 ip_stack_t *ipst = connp->conn_netstack->netstack_ip; 1377 1378 switch (protocol) { 1379 case IPPROTO_TCP: 1380 /* Just need to insert a conn struct */ 1381 if (!(connp->conn_flags & IPCL_EAGER)) { 1382 IPCL_CONN_INIT_V6(connp, protocol, *src, *rem, ports); 1383 } 1384 connfp = &ipst->ips_ipcl_conn_fanout[ 1385 IPCL_CONN_HASH_V6(connp->conn_remv6, connp->conn_ports, 1386 ipst)]; 1387 mutex_enter(&connfp->connf_lock); 1388 for (tconnp = connfp->connf_head; tconnp != NULL; 1389 tconnp = tconnp->conn_next) { 1390 if (IPCL_CONN_MATCH_V6(tconnp, connp->conn_ulp, 1391 connp->conn_remv6, connp->conn_srcv6, 1392 connp->conn_ports) && 1393 (tconnp->conn_tcp->tcp_bound_if == 0 || 1394 tconnp->conn_tcp->tcp_bound_if == ifindex)) { 1395 /* Already have a conn. bail out */ 1396 mutex_exit(&connfp->connf_lock); 1397 return (EADDRINUSE); 1398 } 1399 } 1400 if (connp->conn_fanout != NULL) { 1401 /* 1402 * Probably a XTI/TLI application trying to do a 1403 * rebind. Let it happen. 1404 */ 1405 mutex_exit(&connfp->connf_lock); 1406 IPCL_HASH_REMOVE(connp); 1407 mutex_enter(&connfp->connf_lock); 1408 } 1409 IPCL_HASH_INSERT_CONNECTED_LOCKED(connfp, connp); 1410 mutex_exit(&connfp->connf_lock); 1411 break; 1412 1413 case IPPROTO_SCTP: 1414 IPCL_HASH_REMOVE(connp); 1415 lport = htons((uint16_t)(ntohl(ports) & 0xFFFF)); 1416 ret = ipcl_sctp_hash_insert(connp, lport); 1417 break; 1418 1419 default: 1420 if (is_system_labeled() && 1421 check_exempt_conflict_v6(connp, ipst)) 1422 return (EADDRINUSE); 1423 /* FALLTHROUGH */ 1424 case IPPROTO_UDP: 1425 up = (uint16_t *)&ports; 1426 IPCL_CONN_INIT_V6(connp, protocol, *src, *rem, ports); 1427 if (protocol == IPPROTO_UDP) { 1428 connfp = &ipst->ips_ipcl_udp_fanout[ 1429 IPCL_UDP_HASH(up[1], ipst)]; 1430 } else { 1431 connfp = &ipst->ips_ipcl_proto_fanout_v6[protocol]; 1432 } 1433 1434 if (!IN6_IS_ADDR_UNSPECIFIED(&connp->conn_remv6)) { 1435 IPCL_HASH_INSERT_CONNECTED(connfp, connp); 1436 } else if (!IN6_IS_ADDR_UNSPECIFIED(&connp->conn_srcv6)) { 1437 IPCL_HASH_INSERT_BOUND(connfp, connp); 1438 } else { 1439 IPCL_HASH_INSERT_WILDCARD(connfp, connp); 1440 } 1441 break; 1442 } 1443 1444 return (ret); 1445 } 1446 1447 /* 1448 * v4 packet classifying function. looks up the fanout table to 1449 * find the conn, the packet belongs to. returns the conn with 1450 * the reference held, null otherwise. 1451 * 1452 * If zoneid is ALL_ZONES, then the search rules described in the "Connection 1453 * Lookup" comment block are applied. Labels are also checked as described 1454 * above. If the packet is from the inside (looped back), and is from the same 1455 * zone, then label checks are omitted. 1456 */ 1457 conn_t * 1458 ipcl_classify_v4(mblk_t *mp, uint8_t protocol, uint_t hdr_len, zoneid_t zoneid, 1459 ip_stack_t *ipst) 1460 { 1461 ipha_t *ipha; 1462 connf_t *connfp, *bind_connfp; 1463 uint16_t lport; 1464 uint16_t fport; 1465 uint32_t ports; 1466 conn_t *connp; 1467 uint16_t *up; 1468 boolean_t shared_addr; 1469 boolean_t unlabeled; 1470 1471 ipha = (ipha_t *)mp->b_rptr; 1472 up = (uint16_t *)((uchar_t *)ipha + hdr_len + TCP_PORTS_OFFSET); 1473 1474 switch (protocol) { 1475 case IPPROTO_TCP: 1476 ports = *(uint32_t *)up; 1477 connfp = 1478 &ipst->ips_ipcl_conn_fanout[IPCL_CONN_HASH(ipha->ipha_src, 1479 ports, ipst)]; 1480 mutex_enter(&connfp->connf_lock); 1481 for (connp = connfp->connf_head; connp != NULL; 1482 connp = connp->conn_next) { 1483 if (IPCL_CONN_MATCH(connp, protocol, 1484 ipha->ipha_src, ipha->ipha_dst, ports)) 1485 break; 1486 } 1487 1488 if (connp != NULL) { 1489 /* 1490 * We have a fully-bound TCP connection. 1491 * 1492 * For labeled systems, there's no need to check the 1493 * label here. It's known to be good as we checked 1494 * before allowing the connection to become bound. 1495 */ 1496 CONN_INC_REF(connp); 1497 mutex_exit(&connfp->connf_lock); 1498 return (connp); 1499 } 1500 1501 mutex_exit(&connfp->connf_lock); 1502 1503 lport = up[1]; 1504 unlabeled = B_FALSE; 1505 /* Cred cannot be null on IPv4 */ 1506 if (is_system_labeled()) 1507 unlabeled = (crgetlabel(DB_CRED(mp))->tsl_flags & 1508 TSLF_UNLABELED) != 0; 1509 shared_addr = (zoneid == ALL_ZONES); 1510 if (shared_addr) { 1511 /* 1512 * No need to handle exclusive-stack zones since 1513 * ALL_ZONES only applies to the shared stack. 1514 */ 1515 zoneid = tsol_mlp_findzone(protocol, lport); 1516 /* 1517 * If no shared MLP is found, tsol_mlp_findzone returns 1518 * ALL_ZONES. In that case, we assume it's SLP, and 1519 * search for the zone based on the packet label. 1520 * 1521 * If there is such a zone, we prefer to find a 1522 * connection in it. Otherwise, we look for a 1523 * MAC-exempt connection in any zone whose label 1524 * dominates the default label on the packet. 1525 */ 1526 if (zoneid == ALL_ZONES) 1527 zoneid = tsol_packet_to_zoneid(mp); 1528 else 1529 unlabeled = B_FALSE; 1530 } 1531 1532 bind_connfp = 1533 &ipst->ips_ipcl_bind_fanout[IPCL_BIND_HASH(lport, ipst)]; 1534 mutex_enter(&bind_connfp->connf_lock); 1535 for (connp = bind_connfp->connf_head; connp != NULL; 1536 connp = connp->conn_next) { 1537 if (IPCL_BIND_MATCH(connp, protocol, ipha->ipha_dst, 1538 lport) && (IPCL_ZONE_MATCH(connp, zoneid) || 1539 (unlabeled && connp->conn_mac_exempt))) 1540 break; 1541 } 1542 1543 /* 1544 * If the matching connection is SLP on a private address, then 1545 * the label on the packet must match the local zone's label. 1546 * Otherwise, it must be in the label range defined by tnrh. 1547 * This is ensured by tsol_receive_label. 1548 */ 1549 if (connp != NULL && is_system_labeled() && 1550 !tsol_receive_local(mp, &ipha->ipha_dst, IPV4_VERSION, 1551 shared_addr, connp)) { 1552 DTRACE_PROBE3( 1553 tx__ip__log__info__classify__tcp, 1554 char *, 1555 "connp(1) could not receive mp(2)", 1556 conn_t *, connp, mblk_t *, mp); 1557 connp = NULL; 1558 } 1559 1560 if (connp != NULL) { 1561 /* Have a listener at least */ 1562 CONN_INC_REF(connp); 1563 mutex_exit(&bind_connfp->connf_lock); 1564 return (connp); 1565 } 1566 1567 mutex_exit(&bind_connfp->connf_lock); 1568 1569 IPCL_DEBUG_LVL(512, 1570 ("ipcl_classify: couldn't classify mp = %p\n", 1571 (void *)mp)); 1572 break; 1573 1574 case IPPROTO_UDP: 1575 lport = up[1]; 1576 unlabeled = B_FALSE; 1577 /* Cred cannot be null on IPv4 */ 1578 if (is_system_labeled()) 1579 unlabeled = (crgetlabel(DB_CRED(mp))->tsl_flags & 1580 TSLF_UNLABELED) != 0; 1581 shared_addr = (zoneid == ALL_ZONES); 1582 if (shared_addr) { 1583 /* 1584 * No need to handle exclusive-stack zones since 1585 * ALL_ZONES only applies to the shared stack. 1586 */ 1587 zoneid = tsol_mlp_findzone(protocol, lport); 1588 /* 1589 * If no shared MLP is found, tsol_mlp_findzone returns 1590 * ALL_ZONES. In that case, we assume it's SLP, and 1591 * search for the zone based on the packet label. 1592 * 1593 * If there is such a zone, we prefer to find a 1594 * connection in it. Otherwise, we look for a 1595 * MAC-exempt connection in any zone whose label 1596 * dominates the default label on the packet. 1597 */ 1598 if (zoneid == ALL_ZONES) 1599 zoneid = tsol_packet_to_zoneid(mp); 1600 else 1601 unlabeled = B_FALSE; 1602 } 1603 fport = up[0]; 1604 IPCL_DEBUG_LVL(512, ("ipcl_udp_classify %x %x", lport, fport)); 1605 connfp = &ipst->ips_ipcl_udp_fanout[IPCL_UDP_HASH(lport, ipst)]; 1606 mutex_enter(&connfp->connf_lock); 1607 for (connp = connfp->connf_head; connp != NULL; 1608 connp = connp->conn_next) { 1609 if (IPCL_UDP_MATCH(connp, lport, ipha->ipha_dst, 1610 fport, ipha->ipha_src) && 1611 (IPCL_ZONE_MATCH(connp, zoneid) || 1612 (unlabeled && connp->conn_mac_exempt))) 1613 break; 1614 } 1615 1616 if (connp != NULL && is_system_labeled() && 1617 !tsol_receive_local(mp, &ipha->ipha_dst, IPV4_VERSION, 1618 shared_addr, connp)) { 1619 DTRACE_PROBE3(tx__ip__log__info__classify__udp, 1620 char *, "connp(1) could not receive mp(2)", 1621 conn_t *, connp, mblk_t *, mp); 1622 connp = NULL; 1623 } 1624 1625 if (connp != NULL) { 1626 CONN_INC_REF(connp); 1627 mutex_exit(&connfp->connf_lock); 1628 return (connp); 1629 } 1630 1631 /* 1632 * We shouldn't come here for multicast/broadcast packets 1633 */ 1634 mutex_exit(&connfp->connf_lock); 1635 IPCL_DEBUG_LVL(512, 1636 ("ipcl_classify: cant find udp conn_t for ports : %x %x", 1637 lport, fport)); 1638 break; 1639 } 1640 1641 return (NULL); 1642 } 1643 1644 conn_t * 1645 ipcl_classify_v6(mblk_t *mp, uint8_t protocol, uint_t hdr_len, zoneid_t zoneid, 1646 ip_stack_t *ipst) 1647 { 1648 ip6_t *ip6h; 1649 connf_t *connfp, *bind_connfp; 1650 uint16_t lport; 1651 uint16_t fport; 1652 tcph_t *tcph; 1653 uint32_t ports; 1654 conn_t *connp; 1655 uint16_t *up; 1656 boolean_t shared_addr; 1657 boolean_t unlabeled; 1658 1659 ip6h = (ip6_t *)mp->b_rptr; 1660 1661 switch (protocol) { 1662 case IPPROTO_TCP: 1663 tcph = (tcph_t *)&mp->b_rptr[hdr_len]; 1664 up = (uint16_t *)tcph->th_lport; 1665 ports = *(uint32_t *)up; 1666 1667 connfp = 1668 &ipst->ips_ipcl_conn_fanout[IPCL_CONN_HASH_V6(ip6h->ip6_src, 1669 ports, ipst)]; 1670 mutex_enter(&connfp->connf_lock); 1671 for (connp = connfp->connf_head; connp != NULL; 1672 connp = connp->conn_next) { 1673 if (IPCL_CONN_MATCH_V6(connp, protocol, 1674 ip6h->ip6_src, ip6h->ip6_dst, ports)) 1675 break; 1676 } 1677 1678 if (connp != NULL) { 1679 /* 1680 * We have a fully-bound TCP connection. 1681 * 1682 * For labeled systems, there's no need to check the 1683 * label here. It's known to be good as we checked 1684 * before allowing the connection to become bound. 1685 */ 1686 CONN_INC_REF(connp); 1687 mutex_exit(&connfp->connf_lock); 1688 return (connp); 1689 } 1690 1691 mutex_exit(&connfp->connf_lock); 1692 1693 lport = up[1]; 1694 unlabeled = B_FALSE; 1695 /* Cred can be null on IPv6 */ 1696 if (is_system_labeled()) { 1697 cred_t *cr = DB_CRED(mp); 1698 1699 unlabeled = (cr != NULL && 1700 crgetlabel(cr)->tsl_flags & TSLF_UNLABELED) != 0; 1701 } 1702 shared_addr = (zoneid == ALL_ZONES); 1703 if (shared_addr) { 1704 /* 1705 * No need to handle exclusive-stack zones since 1706 * ALL_ZONES only applies to the shared stack. 1707 */ 1708 zoneid = tsol_mlp_findzone(protocol, lport); 1709 /* 1710 * If no shared MLP is found, tsol_mlp_findzone returns 1711 * ALL_ZONES. In that case, we assume it's SLP, and 1712 * search for the zone based on the packet label. 1713 * 1714 * If there is such a zone, we prefer to find a 1715 * connection in it. Otherwise, we look for a 1716 * MAC-exempt connection in any zone whose label 1717 * dominates the default label on the packet. 1718 */ 1719 if (zoneid == ALL_ZONES) 1720 zoneid = tsol_packet_to_zoneid(mp); 1721 else 1722 unlabeled = B_FALSE; 1723 } 1724 1725 bind_connfp = 1726 &ipst->ips_ipcl_bind_fanout[IPCL_BIND_HASH(lport, ipst)]; 1727 mutex_enter(&bind_connfp->connf_lock); 1728 for (connp = bind_connfp->connf_head; connp != NULL; 1729 connp = connp->conn_next) { 1730 if (IPCL_BIND_MATCH_V6(connp, protocol, 1731 ip6h->ip6_dst, lport) && 1732 (IPCL_ZONE_MATCH(connp, zoneid) || 1733 (unlabeled && connp->conn_mac_exempt))) 1734 break; 1735 } 1736 1737 if (connp != NULL && is_system_labeled() && 1738 !tsol_receive_local(mp, &ip6h->ip6_dst, IPV6_VERSION, 1739 shared_addr, connp)) { 1740 DTRACE_PROBE3(tx__ip__log__info__classify__tcp6, 1741 char *, "connp(1) could not receive mp(2)", 1742 conn_t *, connp, mblk_t *, mp); 1743 connp = NULL; 1744 } 1745 1746 if (connp != NULL) { 1747 /* Have a listner at least */ 1748 CONN_INC_REF(connp); 1749 mutex_exit(&bind_connfp->connf_lock); 1750 IPCL_DEBUG_LVL(512, 1751 ("ipcl_classify_v6: found listner " 1752 "connp = %p\n", (void *)connp)); 1753 1754 return (connp); 1755 } 1756 1757 mutex_exit(&bind_connfp->connf_lock); 1758 1759 IPCL_DEBUG_LVL(512, 1760 ("ipcl_classify_v6: couldn't classify mp = %p\n", 1761 (void *)mp)); 1762 break; 1763 1764 case IPPROTO_UDP: 1765 up = (uint16_t *)&mp->b_rptr[hdr_len]; 1766 lport = up[1]; 1767 unlabeled = B_FALSE; 1768 /* Cred can be null on IPv6 */ 1769 if (is_system_labeled()) { 1770 cred_t *cr = DB_CRED(mp); 1771 1772 unlabeled = (cr != NULL && 1773 crgetlabel(cr)->tsl_flags & TSLF_UNLABELED) != 0; 1774 } 1775 shared_addr = (zoneid == ALL_ZONES); 1776 if (shared_addr) { 1777 /* 1778 * No need to handle exclusive-stack zones since 1779 * ALL_ZONES only applies to the shared stack. 1780 */ 1781 zoneid = tsol_mlp_findzone(protocol, lport); 1782 /* 1783 * If no shared MLP is found, tsol_mlp_findzone returns 1784 * ALL_ZONES. In that case, we assume it's SLP, and 1785 * search for the zone based on the packet label. 1786 * 1787 * If there is such a zone, we prefer to find a 1788 * connection in it. Otherwise, we look for a 1789 * MAC-exempt connection in any zone whose label 1790 * dominates the default label on the packet. 1791 */ 1792 if (zoneid == ALL_ZONES) 1793 zoneid = tsol_packet_to_zoneid(mp); 1794 else 1795 unlabeled = B_FALSE; 1796 } 1797 1798 fport = up[0]; 1799 IPCL_DEBUG_LVL(512, ("ipcl_udp_classify_v6 %x %x", lport, 1800 fport)); 1801 connfp = &ipst->ips_ipcl_udp_fanout[IPCL_UDP_HASH(lport, ipst)]; 1802 mutex_enter(&connfp->connf_lock); 1803 for (connp = connfp->connf_head; connp != NULL; 1804 connp = connp->conn_next) { 1805 if (IPCL_UDP_MATCH_V6(connp, lport, ip6h->ip6_dst, 1806 fport, ip6h->ip6_src) && 1807 (IPCL_ZONE_MATCH(connp, zoneid) || 1808 (unlabeled && connp->conn_mac_exempt))) 1809 break; 1810 } 1811 1812 if (connp != NULL && is_system_labeled() && 1813 !tsol_receive_local(mp, &ip6h->ip6_dst, IPV6_VERSION, 1814 shared_addr, connp)) { 1815 DTRACE_PROBE3(tx__ip__log__info__classify__udp6, 1816 char *, "connp(1) could not receive mp(2)", 1817 conn_t *, connp, mblk_t *, mp); 1818 connp = NULL; 1819 } 1820 1821 if (connp != NULL) { 1822 CONN_INC_REF(connp); 1823 mutex_exit(&connfp->connf_lock); 1824 return (connp); 1825 } 1826 1827 /* 1828 * We shouldn't come here for multicast/broadcast packets 1829 */ 1830 mutex_exit(&connfp->connf_lock); 1831 IPCL_DEBUG_LVL(512, 1832 ("ipcl_classify_v6: cant find udp conn_t for ports : %x %x", 1833 lport, fport)); 1834 break; 1835 } 1836 1837 return (NULL); 1838 } 1839 1840 /* 1841 * wrapper around ipcl_classify_(v4,v6) routines. 1842 */ 1843 conn_t * 1844 ipcl_classify(mblk_t *mp, zoneid_t zoneid, ip_stack_t *ipst) 1845 { 1846 uint16_t hdr_len; 1847 ipha_t *ipha; 1848 uint8_t *nexthdrp; 1849 1850 if (MBLKL(mp) < sizeof (ipha_t)) 1851 return (NULL); 1852 1853 switch (IPH_HDR_VERSION(mp->b_rptr)) { 1854 case IPV4_VERSION: 1855 ipha = (ipha_t *)mp->b_rptr; 1856 hdr_len = IPH_HDR_LENGTH(ipha); 1857 return (ipcl_classify_v4(mp, ipha->ipha_protocol, hdr_len, 1858 zoneid, ipst)); 1859 case IPV6_VERSION: 1860 if (!ip_hdr_length_nexthdr_v6(mp, (ip6_t *)mp->b_rptr, 1861 &hdr_len, &nexthdrp)) 1862 return (NULL); 1863 1864 return (ipcl_classify_v6(mp, *nexthdrp, hdr_len, zoneid, ipst)); 1865 } 1866 1867 return (NULL); 1868 } 1869 1870 conn_t * 1871 ipcl_classify_raw(mblk_t *mp, uint8_t protocol, zoneid_t zoneid, 1872 uint32_t ports, ipha_t *hdr, ip_stack_t *ipst) 1873 { 1874 connf_t *connfp; 1875 conn_t *connp; 1876 in_port_t lport; 1877 int af; 1878 boolean_t shared_addr; 1879 boolean_t unlabeled; 1880 const void *dst; 1881 1882 lport = ((uint16_t *)&ports)[1]; 1883 1884 unlabeled = B_FALSE; 1885 /* Cred can be null on IPv6 */ 1886 if (is_system_labeled()) { 1887 cred_t *cr = DB_CRED(mp); 1888 1889 unlabeled = (cr != NULL && 1890 crgetlabel(cr)->tsl_flags & TSLF_UNLABELED) != 0; 1891 } 1892 shared_addr = (zoneid == ALL_ZONES); 1893 if (shared_addr) { 1894 /* 1895 * No need to handle exclusive-stack zones since ALL_ZONES 1896 * only applies to the shared stack. 1897 */ 1898 zoneid = tsol_mlp_findzone(protocol, lport); 1899 /* 1900 * If no shared MLP is found, tsol_mlp_findzone returns 1901 * ALL_ZONES. In that case, we assume it's SLP, and search for 1902 * the zone based on the packet label. 1903 * 1904 * If there is such a zone, we prefer to find a connection in 1905 * it. Otherwise, we look for a MAC-exempt connection in any 1906 * zone whose label dominates the default label on the packet. 1907 */ 1908 if (zoneid == ALL_ZONES) 1909 zoneid = tsol_packet_to_zoneid(mp); 1910 else 1911 unlabeled = B_FALSE; 1912 } 1913 1914 af = IPH_HDR_VERSION(hdr); 1915 dst = af == IPV4_VERSION ? (const void *)&hdr->ipha_dst : 1916 (const void *)&((ip6_t *)hdr)->ip6_dst; 1917 connfp = &ipst->ips_ipcl_raw_fanout[IPCL_RAW_HASH(ntohs(lport), ipst)]; 1918 1919 mutex_enter(&connfp->connf_lock); 1920 for (connp = connfp->connf_head; connp != NULL; 1921 connp = connp->conn_next) { 1922 /* We don't allow v4 fallback for v6 raw socket. */ 1923 if (af == (connp->conn_af_isv6 ? IPV4_VERSION : 1924 IPV6_VERSION)) 1925 continue; 1926 if (connp->conn_fully_bound) { 1927 if (af == IPV4_VERSION) { 1928 if (!IPCL_CONN_MATCH(connp, protocol, 1929 hdr->ipha_src, hdr->ipha_dst, ports)) 1930 continue; 1931 } else { 1932 if (!IPCL_CONN_MATCH_V6(connp, protocol, 1933 ((ip6_t *)hdr)->ip6_src, 1934 ((ip6_t *)hdr)->ip6_dst, ports)) 1935 continue; 1936 } 1937 } else { 1938 if (af == IPV4_VERSION) { 1939 if (!IPCL_BIND_MATCH(connp, protocol, 1940 hdr->ipha_dst, lport)) 1941 continue; 1942 } else { 1943 if (!IPCL_BIND_MATCH_V6(connp, protocol, 1944 ((ip6_t *)hdr)->ip6_dst, lport)) 1945 continue; 1946 } 1947 } 1948 1949 if (IPCL_ZONE_MATCH(connp, zoneid) || 1950 (unlabeled && connp->conn_mac_exempt)) 1951 break; 1952 } 1953 /* 1954 * If the connection is fully-bound and connection-oriented (TCP or 1955 * SCTP), then we've already validated the remote system's label. 1956 * There's no need to do it again for every packet. 1957 */ 1958 if (connp != NULL && is_system_labeled() && (!connp->conn_fully_bound || 1959 !(connp->conn_flags & (IPCL_TCP|IPCL_SCTPCONN))) && 1960 !tsol_receive_local(mp, dst, af, shared_addr, connp)) { 1961 DTRACE_PROBE3(tx__ip__log__info__classify__rawip, 1962 char *, "connp(1) could not receive mp(2)", 1963 conn_t *, connp, mblk_t *, mp); 1964 connp = NULL; 1965 } 1966 1967 if (connp != NULL) 1968 goto found; 1969 mutex_exit(&connfp->connf_lock); 1970 1971 /* Try to look for a wildcard match. */ 1972 connfp = &ipst->ips_ipcl_raw_fanout[IPCL_RAW_HASH(0, ipst)]; 1973 mutex_enter(&connfp->connf_lock); 1974 for (connp = connfp->connf_head; connp != NULL; 1975 connp = connp->conn_next) { 1976 /* We don't allow v4 fallback for v6 raw socket. */ 1977 if ((af == (connp->conn_af_isv6 ? IPV4_VERSION : 1978 IPV6_VERSION)) || !IPCL_ZONE_MATCH(connp, zoneid)) { 1979 continue; 1980 } 1981 if (af == IPV4_VERSION) { 1982 if (IPCL_RAW_MATCH(connp, protocol, hdr->ipha_dst)) 1983 break; 1984 } else { 1985 if (IPCL_RAW_MATCH_V6(connp, protocol, 1986 ((ip6_t *)hdr)->ip6_dst)) { 1987 break; 1988 } 1989 } 1990 } 1991 1992 if (connp != NULL) 1993 goto found; 1994 1995 mutex_exit(&connfp->connf_lock); 1996 return (NULL); 1997 1998 found: 1999 ASSERT(connp != NULL); 2000 CONN_INC_REF(connp); 2001 mutex_exit(&connfp->connf_lock); 2002 return (connp); 2003 } 2004 2005 /* ARGSUSED */ 2006 static int 2007 tcp_conn_constructor(void *buf, void *cdrarg, int kmflags) 2008 { 2009 itc_t *itc = (itc_t *)buf; 2010 conn_t *connp = &itc->itc_conn; 2011 tcp_t *tcp = (tcp_t *)&itc[1]; 2012 2013 bzero(connp, sizeof (conn_t)); 2014 bzero(tcp, sizeof (tcp_t)); 2015 2016 mutex_init(&connp->conn_lock, NULL, MUTEX_DEFAULT, NULL); 2017 cv_init(&connp->conn_cv, NULL, CV_DEFAULT, NULL); 2018 tcp->tcp_timercache = tcp_timermp_alloc(KM_NOSLEEP); 2019 connp->conn_tcp = tcp; 2020 connp->conn_flags = IPCL_TCPCONN; 2021 connp->conn_ulp = IPPROTO_TCP; 2022 tcp->tcp_connp = connp; 2023 return (0); 2024 } 2025 2026 /* ARGSUSED */ 2027 static void 2028 tcp_conn_destructor(void *buf, void *cdrarg) 2029 { 2030 itc_t *itc = (itc_t *)buf; 2031 conn_t *connp = &itc->itc_conn; 2032 tcp_t *tcp = (tcp_t *)&itc[1]; 2033 2034 ASSERT(connp->conn_flags & IPCL_TCPCONN); 2035 ASSERT(tcp->tcp_connp == connp); 2036 ASSERT(connp->conn_tcp == tcp); 2037 tcp_timermp_free(tcp); 2038 mutex_destroy(&connp->conn_lock); 2039 cv_destroy(&connp->conn_cv); 2040 } 2041 2042 /* ARGSUSED */ 2043 static int 2044 ip_conn_constructor(void *buf, void *cdrarg, int kmflags) 2045 { 2046 itc_t *itc = (itc_t *)buf; 2047 conn_t *connp = &itc->itc_conn; 2048 2049 bzero(connp, sizeof (conn_t)); 2050 mutex_init(&connp->conn_lock, NULL, MUTEX_DEFAULT, NULL); 2051 cv_init(&connp->conn_cv, NULL, CV_DEFAULT, NULL); 2052 connp->conn_flags = IPCL_IPCCONN; 2053 2054 return (0); 2055 } 2056 2057 /* ARGSUSED */ 2058 static void 2059 ip_conn_destructor(void *buf, void *cdrarg) 2060 { 2061 itc_t *itc = (itc_t *)buf; 2062 conn_t *connp = &itc->itc_conn; 2063 2064 ASSERT(connp->conn_flags & IPCL_IPCCONN); 2065 ASSERT(connp->conn_priv == NULL); 2066 mutex_destroy(&connp->conn_lock); 2067 cv_destroy(&connp->conn_cv); 2068 } 2069 2070 /* ARGSUSED */ 2071 static int 2072 udp_conn_constructor(void *buf, void *cdrarg, int kmflags) 2073 { 2074 itc_t *itc = (itc_t *)buf; 2075 conn_t *connp = &itc->itc_conn; 2076 udp_t *udp = (udp_t *)&itc[1]; 2077 2078 bzero(connp, sizeof (conn_t)); 2079 bzero(udp, sizeof (udp_t)); 2080 2081 mutex_init(&connp->conn_lock, NULL, MUTEX_DEFAULT, NULL); 2082 cv_init(&connp->conn_cv, NULL, CV_DEFAULT, NULL); 2083 connp->conn_udp = udp; 2084 connp->conn_flags = IPCL_UDPCONN; 2085 connp->conn_ulp = IPPROTO_UDP; 2086 udp->udp_connp = connp; 2087 return (0); 2088 } 2089 2090 /* ARGSUSED */ 2091 static void 2092 udp_conn_destructor(void *buf, void *cdrarg) 2093 { 2094 itc_t *itc = (itc_t *)buf; 2095 conn_t *connp = &itc->itc_conn; 2096 udp_t *udp = (udp_t *)&itc[1]; 2097 2098 ASSERT(connp->conn_flags & IPCL_UDPCONN); 2099 ASSERT(udp->udp_connp == connp); 2100 ASSERT(connp->conn_udp == udp); 2101 mutex_destroy(&connp->conn_lock); 2102 cv_destroy(&connp->conn_cv); 2103 } 2104 2105 /* ARGSUSED */ 2106 static int 2107 rawip_conn_constructor(void *buf, void *cdrarg, int kmflags) 2108 { 2109 itc_t *itc = (itc_t *)buf; 2110 conn_t *connp = &itc->itc_conn; 2111 icmp_t *icmp = (icmp_t *)&itc[1]; 2112 2113 bzero(connp, sizeof (conn_t)); 2114 bzero(icmp, sizeof (icmp_t)); 2115 2116 mutex_init(&connp->conn_lock, NULL, MUTEX_DEFAULT, NULL); 2117 cv_init(&connp->conn_cv, NULL, CV_DEFAULT, NULL); 2118 connp->conn_icmp = icmp; 2119 connp->conn_flags = IPCL_RAWIPCONN; 2120 connp->conn_ulp = IPPROTO_ICMP; 2121 icmp->icmp_connp = connp; 2122 return (0); 2123 } 2124 2125 /* ARGSUSED */ 2126 static void 2127 rawip_conn_destructor(void *buf, void *cdrarg) 2128 { 2129 itc_t *itc = (itc_t *)buf; 2130 conn_t *connp = &itc->itc_conn; 2131 icmp_t *icmp = (icmp_t *)&itc[1]; 2132 2133 ASSERT(connp->conn_flags & IPCL_RAWIPCONN); 2134 ASSERT(icmp->icmp_connp == connp); 2135 ASSERT(connp->conn_icmp == icmp); 2136 mutex_destroy(&connp->conn_lock); 2137 cv_destroy(&connp->conn_cv); 2138 } 2139 2140 /* ARGSUSED */ 2141 static int 2142 rts_conn_constructor(void *buf, void *cdrarg, int kmflags) 2143 { 2144 itc_t *itc = (itc_t *)buf; 2145 conn_t *connp = &itc->itc_conn; 2146 rts_t *rts = (rts_t *)&itc[1]; 2147 2148 bzero(connp, sizeof (conn_t)); 2149 bzero(rts, sizeof (rts_t)); 2150 2151 mutex_init(&connp->conn_lock, NULL, MUTEX_DEFAULT, NULL); 2152 cv_init(&connp->conn_cv, NULL, CV_DEFAULT, NULL); 2153 connp->conn_rts = rts; 2154 connp->conn_flags = IPCL_RTSCONN; 2155 rts->rts_connp = connp; 2156 return (0); 2157 } 2158 2159 /* ARGSUSED */ 2160 static void 2161 rts_conn_destructor(void *buf, void *cdrarg) 2162 { 2163 itc_t *itc = (itc_t *)buf; 2164 conn_t *connp = &itc->itc_conn; 2165 rts_t *rts = (rts_t *)&itc[1]; 2166 2167 ASSERT(connp->conn_flags & IPCL_RTSCONN); 2168 ASSERT(rts->rts_connp == connp); 2169 ASSERT(connp->conn_rts == rts); 2170 mutex_destroy(&connp->conn_lock); 2171 cv_destroy(&connp->conn_cv); 2172 } 2173 2174 /* 2175 * Called as part of ipcl_conn_destroy to assert and clear any pointers 2176 * in the conn_t. 2177 * 2178 * Below we list all the pointers in the conn_t as a documentation aid. 2179 * The ones that we can not ASSERT to be NULL are #ifdef'ed out. 2180 * If you add any pointers to the conn_t please add an ASSERT here 2181 * and #ifdef it out if it can't be actually asserted to be NULL. 2182 * In any case, we bzero most of the conn_t at the end of the function. 2183 */ 2184 void 2185 ipcl_conn_cleanup(conn_t *connp) 2186 { 2187 ASSERT(connp->conn_ire_cache == NULL); 2188 ASSERT(connp->conn_latch == NULL); 2189 #ifdef notdef 2190 /* These are not cleared */ 2191 ASSERT(connp->conn_rq == NULL); 2192 ASSERT(connp->conn_wq == NULL); 2193 #endif 2194 ASSERT(connp->conn_cred == NULL); 2195 ASSERT(connp->conn_g_fanout == NULL); 2196 ASSERT(connp->conn_g_next == NULL); 2197 ASSERT(connp->conn_g_prev == NULL); 2198 ASSERT(connp->conn_policy == NULL); 2199 ASSERT(connp->conn_fanout == NULL); 2200 ASSERT(connp->conn_next == NULL); 2201 ASSERT(connp->conn_prev == NULL); 2202 #ifdef notdef 2203 /* 2204 * The ill and ipif pointers are not cleared before the conn_t 2205 * goes away since they do not hold a reference on the ill/ipif. 2206 * We should replace these pointers with ifindex/ipaddr_t to 2207 * make the code less complex. 2208 */ 2209 ASSERT(connp->conn_xmit_if_ill == NULL); 2210 ASSERT(connp->conn_nofailover_ill == NULL); 2211 ASSERT(connp->conn_outgoing_ill == NULL); 2212 ASSERT(connp->conn_incoming_ill == NULL); 2213 ASSERT(connp->conn_outgoing_pill == NULL); 2214 ASSERT(connp->conn_multicast_ipif == NULL); 2215 ASSERT(connp->conn_multicast_ill == NULL); 2216 #endif 2217 ASSERT(connp->conn_oper_pending_ill == NULL); 2218 ASSERT(connp->conn_ilg == NULL); 2219 ASSERT(connp->conn_drain_next == NULL); 2220 ASSERT(connp->conn_drain_prev == NULL); 2221 #ifdef notdef 2222 /* conn_idl is not cleared when removed from idl list */ 2223 ASSERT(connp->conn_idl == NULL); 2224 #endif 2225 ASSERT(connp->conn_ipsec_opt_mp == NULL); 2226 ASSERT(connp->conn_peercred == NULL); 2227 ASSERT(connp->conn_netstack == NULL); 2228 2229 /* Clear out the conn_t fields that are not preserved */ 2230 bzero(&connp->conn_start_clr, 2231 sizeof (conn_t) - 2232 ((uchar_t *)&connp->conn_start_clr - (uchar_t *)connp)); 2233 2234 } 2235 2236 /* 2237 * All conns are inserted in a global multi-list for the benefit of 2238 * walkers. The walk is guaranteed to walk all open conns at the time 2239 * of the start of the walk exactly once. This property is needed to 2240 * achieve some cleanups during unplumb of interfaces. This is achieved 2241 * as follows. 2242 * 2243 * ipcl_conn_create and ipcl_conn_destroy are the only functions that 2244 * call the insert and delete functions below at creation and deletion 2245 * time respectively. The conn never moves or changes its position in this 2246 * multi-list during its lifetime. CONN_CONDEMNED ensures that the refcnt 2247 * won't increase due to walkers, once the conn deletion has started. Note 2248 * that we can't remove the conn from the global list and then wait for 2249 * the refcnt to drop to zero, since walkers would then see a truncated 2250 * list. CONN_INCIPIENT ensures that walkers don't start looking at 2251 * conns until ip_open is ready to make them globally visible. 2252 * The global round robin multi-list locks are held only to get the 2253 * next member/insertion/deletion and contention should be negligible 2254 * if the multi-list is much greater than the number of cpus. 2255 */ 2256 void 2257 ipcl_globalhash_insert(conn_t *connp) 2258 { 2259 int index; 2260 struct connf_s *connfp; 2261 ip_stack_t *ipst = connp->conn_netstack->netstack_ip; 2262 2263 /* 2264 * No need for atomic here. Approximate even distribution 2265 * in the global lists is sufficient. 2266 */ 2267 ipst->ips_conn_g_index++; 2268 index = ipst->ips_conn_g_index & (CONN_G_HASH_SIZE - 1); 2269 2270 connp->conn_g_prev = NULL; 2271 /* 2272 * Mark as INCIPIENT, so that walkers will ignore this 2273 * for now, till ip_open is ready to make it visible globally. 2274 */ 2275 connp->conn_state_flags |= CONN_INCIPIENT; 2276 2277 connfp = &ipst->ips_ipcl_globalhash_fanout[index]; 2278 /* Insert at the head of the list */ 2279 mutex_enter(&connfp->connf_lock); 2280 connp->conn_g_next = connfp->connf_head; 2281 if (connp->conn_g_next != NULL) 2282 connp->conn_g_next->conn_g_prev = connp; 2283 connfp->connf_head = connp; 2284 2285 /* The fanout bucket this conn points to */ 2286 connp->conn_g_fanout = connfp; 2287 2288 mutex_exit(&connfp->connf_lock); 2289 } 2290 2291 void 2292 ipcl_globalhash_remove(conn_t *connp) 2293 { 2294 struct connf_s *connfp; 2295 2296 /* 2297 * We were never inserted in the global multi list. 2298 * IPCL_NONE variety is never inserted in the global multilist 2299 * since it is presumed to not need any cleanup and is transient. 2300 */ 2301 if (connp->conn_g_fanout == NULL) 2302 return; 2303 2304 connfp = connp->conn_g_fanout; 2305 mutex_enter(&connfp->connf_lock); 2306 if (connp->conn_g_prev != NULL) 2307 connp->conn_g_prev->conn_g_next = connp->conn_g_next; 2308 else 2309 connfp->connf_head = connp->conn_g_next; 2310 if (connp->conn_g_next != NULL) 2311 connp->conn_g_next->conn_g_prev = connp->conn_g_prev; 2312 mutex_exit(&connfp->connf_lock); 2313 2314 /* Better to stumble on a null pointer than to corrupt memory */ 2315 connp->conn_g_next = NULL; 2316 connp->conn_g_prev = NULL; 2317 connp->conn_g_fanout = NULL; 2318 } 2319 2320 /* 2321 * Walk the list of all conn_t's in the system, calling the function provided 2322 * with the specified argument for each. 2323 * Applies to both IPv4 and IPv6. 2324 * 2325 * IPCs may hold pointers to ipif/ill. To guard against stale pointers 2326 * ipcl_walk() is called to cleanup the conn_t's, typically when an interface is 2327 * unplumbed or removed. New conn_t's that are created while we are walking 2328 * may be missed by this walk, because they are not necessarily inserted 2329 * at the tail of the list. They are new conn_t's and thus don't have any 2330 * stale pointers. The CONN_CLOSING flag ensures that no new reference 2331 * is created to the struct that is going away. 2332 */ 2333 void 2334 ipcl_walk(pfv_t func, void *arg, ip_stack_t *ipst) 2335 { 2336 int i; 2337 conn_t *connp; 2338 conn_t *prev_connp; 2339 2340 for (i = 0; i < CONN_G_HASH_SIZE; i++) { 2341 mutex_enter(&ipst->ips_ipcl_globalhash_fanout[i].connf_lock); 2342 prev_connp = NULL; 2343 connp = ipst->ips_ipcl_globalhash_fanout[i].connf_head; 2344 while (connp != NULL) { 2345 mutex_enter(&connp->conn_lock); 2346 if (connp->conn_state_flags & 2347 (CONN_CONDEMNED | CONN_INCIPIENT)) { 2348 mutex_exit(&connp->conn_lock); 2349 connp = connp->conn_g_next; 2350 continue; 2351 } 2352 CONN_INC_REF_LOCKED(connp); 2353 mutex_exit(&connp->conn_lock); 2354 mutex_exit( 2355 &ipst->ips_ipcl_globalhash_fanout[i].connf_lock); 2356 (*func)(connp, arg); 2357 if (prev_connp != NULL) 2358 CONN_DEC_REF(prev_connp); 2359 mutex_enter( 2360 &ipst->ips_ipcl_globalhash_fanout[i].connf_lock); 2361 prev_connp = connp; 2362 connp = connp->conn_g_next; 2363 } 2364 mutex_exit(&ipst->ips_ipcl_globalhash_fanout[i].connf_lock); 2365 if (prev_connp != NULL) 2366 CONN_DEC_REF(prev_connp); 2367 } 2368 } 2369 2370 /* 2371 * Search for a peer TCP/IPv4 loopback conn by doing a reverse lookup on 2372 * the {src, dst, lport, fport} quadruplet. Returns with conn reference 2373 * held; caller must call CONN_DEC_REF. Only checks for connected entries 2374 * (peer tcp in ESTABLISHED state). 2375 */ 2376 conn_t * 2377 ipcl_conn_tcp_lookup_reversed_ipv4(conn_t *connp, ipha_t *ipha, tcph_t *tcph, 2378 ip_stack_t *ipst) 2379 { 2380 uint32_t ports; 2381 uint16_t *pports = (uint16_t *)&ports; 2382 connf_t *connfp; 2383 conn_t *tconnp; 2384 boolean_t zone_chk; 2385 2386 /* 2387 * If either the source of destination address is loopback, then 2388 * both endpoints must be in the same Zone. Otherwise, both of 2389 * the addresses are system-wide unique (tcp is in ESTABLISHED 2390 * state) and the endpoints may reside in different Zones. 2391 */ 2392 zone_chk = (ipha->ipha_src == htonl(INADDR_LOOPBACK) || 2393 ipha->ipha_dst == htonl(INADDR_LOOPBACK)); 2394 2395 bcopy(tcph->th_fport, &pports[0], sizeof (uint16_t)); 2396 bcopy(tcph->th_lport, &pports[1], sizeof (uint16_t)); 2397 2398 connfp = &ipst->ips_ipcl_conn_fanout[IPCL_CONN_HASH(ipha->ipha_dst, 2399 ports, ipst)]; 2400 2401 mutex_enter(&connfp->connf_lock); 2402 for (tconnp = connfp->connf_head; tconnp != NULL; 2403 tconnp = tconnp->conn_next) { 2404 2405 if (IPCL_CONN_MATCH(tconnp, IPPROTO_TCP, 2406 ipha->ipha_dst, ipha->ipha_src, ports) && 2407 tconnp->conn_tcp->tcp_state == TCPS_ESTABLISHED && 2408 (!zone_chk || tconnp->conn_zoneid == connp->conn_zoneid)) { 2409 2410 ASSERT(tconnp != connp); 2411 CONN_INC_REF(tconnp); 2412 mutex_exit(&connfp->connf_lock); 2413 return (tconnp); 2414 } 2415 } 2416 mutex_exit(&connfp->connf_lock); 2417 return (NULL); 2418 } 2419 2420 /* 2421 * Search for a peer TCP/IPv6 loopback conn by doing a reverse lookup on 2422 * the {src, dst, lport, fport} quadruplet. Returns with conn reference 2423 * held; caller must call CONN_DEC_REF. Only checks for connected entries 2424 * (peer tcp in ESTABLISHED state). 2425 */ 2426 conn_t * 2427 ipcl_conn_tcp_lookup_reversed_ipv6(conn_t *connp, ip6_t *ip6h, tcph_t *tcph, 2428 ip_stack_t *ipst) 2429 { 2430 uint32_t ports; 2431 uint16_t *pports = (uint16_t *)&ports; 2432 connf_t *connfp; 2433 conn_t *tconnp; 2434 boolean_t zone_chk; 2435 2436 /* 2437 * If either the source of destination address is loopback, then 2438 * both endpoints must be in the same Zone. Otherwise, both of 2439 * the addresses are system-wide unique (tcp is in ESTABLISHED 2440 * state) and the endpoints may reside in different Zones. We 2441 * don't do Zone check for link local address(es) because the 2442 * current Zone implementation treats each link local address as 2443 * being unique per system node, i.e. they belong to global Zone. 2444 */ 2445 zone_chk = (IN6_IS_ADDR_LOOPBACK(&ip6h->ip6_src) || 2446 IN6_IS_ADDR_LOOPBACK(&ip6h->ip6_dst)); 2447 2448 bcopy(tcph->th_fport, &pports[0], sizeof (uint16_t)); 2449 bcopy(tcph->th_lport, &pports[1], sizeof (uint16_t)); 2450 2451 connfp = &ipst->ips_ipcl_conn_fanout[IPCL_CONN_HASH_V6(ip6h->ip6_dst, 2452 ports, ipst)]; 2453 2454 mutex_enter(&connfp->connf_lock); 2455 for (tconnp = connfp->connf_head; tconnp != NULL; 2456 tconnp = tconnp->conn_next) { 2457 2458 /* We skip tcp_bound_if check here as this is loopback tcp */ 2459 if (IPCL_CONN_MATCH_V6(tconnp, IPPROTO_TCP, 2460 ip6h->ip6_dst, ip6h->ip6_src, ports) && 2461 tconnp->conn_tcp->tcp_state == TCPS_ESTABLISHED && 2462 (!zone_chk || tconnp->conn_zoneid == connp->conn_zoneid)) { 2463 2464 ASSERT(tconnp != connp); 2465 CONN_INC_REF(tconnp); 2466 mutex_exit(&connfp->connf_lock); 2467 return (tconnp); 2468 } 2469 } 2470 mutex_exit(&connfp->connf_lock); 2471 return (NULL); 2472 } 2473 2474 /* 2475 * Find an exact {src, dst, lport, fport} match for a bounced datagram. 2476 * Returns with conn reference held. Caller must call CONN_DEC_REF. 2477 * Only checks for connected entries i.e. no INADDR_ANY checks. 2478 */ 2479 conn_t * 2480 ipcl_tcp_lookup_reversed_ipv4(ipha_t *ipha, tcph_t *tcph, int min_state, 2481 ip_stack_t *ipst) 2482 { 2483 uint32_t ports; 2484 uint16_t *pports; 2485 connf_t *connfp; 2486 conn_t *tconnp; 2487 2488 pports = (uint16_t *)&ports; 2489 bcopy(tcph->th_fport, &pports[0], sizeof (uint16_t)); 2490 bcopy(tcph->th_lport, &pports[1], sizeof (uint16_t)); 2491 2492 connfp = &ipst->ips_ipcl_conn_fanout[IPCL_CONN_HASH(ipha->ipha_dst, 2493 ports, ipst)]; 2494 2495 mutex_enter(&connfp->connf_lock); 2496 for (tconnp = connfp->connf_head; tconnp != NULL; 2497 tconnp = tconnp->conn_next) { 2498 2499 if (IPCL_CONN_MATCH(tconnp, IPPROTO_TCP, 2500 ipha->ipha_dst, ipha->ipha_src, ports) && 2501 tconnp->conn_tcp->tcp_state >= min_state) { 2502 2503 CONN_INC_REF(tconnp); 2504 mutex_exit(&connfp->connf_lock); 2505 return (tconnp); 2506 } 2507 } 2508 mutex_exit(&connfp->connf_lock); 2509 return (NULL); 2510 } 2511 2512 /* 2513 * Find an exact {src, dst, lport, fport} match for a bounced datagram. 2514 * Returns with conn reference held. Caller must call CONN_DEC_REF. 2515 * Only checks for connected entries i.e. no INADDR_ANY checks. 2516 * Match on ifindex in addition to addresses. 2517 */ 2518 conn_t * 2519 ipcl_tcp_lookup_reversed_ipv6(ip6_t *ip6h, tcpha_t *tcpha, int min_state, 2520 uint_t ifindex, ip_stack_t *ipst) 2521 { 2522 tcp_t *tcp; 2523 uint32_t ports; 2524 uint16_t *pports; 2525 connf_t *connfp; 2526 conn_t *tconnp; 2527 2528 pports = (uint16_t *)&ports; 2529 pports[0] = tcpha->tha_fport; 2530 pports[1] = tcpha->tha_lport; 2531 2532 connfp = &ipst->ips_ipcl_conn_fanout[IPCL_CONN_HASH_V6(ip6h->ip6_dst, 2533 ports, ipst)]; 2534 2535 mutex_enter(&connfp->connf_lock); 2536 for (tconnp = connfp->connf_head; tconnp != NULL; 2537 tconnp = tconnp->conn_next) { 2538 2539 tcp = tconnp->conn_tcp; 2540 if (IPCL_CONN_MATCH_V6(tconnp, IPPROTO_TCP, 2541 ip6h->ip6_dst, ip6h->ip6_src, ports) && 2542 tcp->tcp_state >= min_state && 2543 (tcp->tcp_bound_if == 0 || 2544 tcp->tcp_bound_if == ifindex)) { 2545 2546 CONN_INC_REF(tconnp); 2547 mutex_exit(&connfp->connf_lock); 2548 return (tconnp); 2549 } 2550 } 2551 mutex_exit(&connfp->connf_lock); 2552 return (NULL); 2553 } 2554 2555 /* 2556 * Finds a TCP/IPv4 listening connection; called by tcp_disconnect to locate 2557 * a listener when changing state. 2558 */ 2559 conn_t * 2560 ipcl_lookup_listener_v4(uint16_t lport, ipaddr_t laddr, zoneid_t zoneid, 2561 ip_stack_t *ipst) 2562 { 2563 connf_t *bind_connfp; 2564 conn_t *connp; 2565 tcp_t *tcp; 2566 2567 /* 2568 * Avoid false matches for packets sent to an IP destination of 2569 * all zeros. 2570 */ 2571 if (laddr == 0) 2572 return (NULL); 2573 2574 ASSERT(zoneid != ALL_ZONES); 2575 2576 bind_connfp = &ipst->ips_ipcl_bind_fanout[IPCL_BIND_HASH(lport, ipst)]; 2577 mutex_enter(&bind_connfp->connf_lock); 2578 for (connp = bind_connfp->connf_head; connp != NULL; 2579 connp = connp->conn_next) { 2580 tcp = connp->conn_tcp; 2581 if (IPCL_BIND_MATCH(connp, IPPROTO_TCP, laddr, lport) && 2582 IPCL_ZONE_MATCH(connp, zoneid) && 2583 (tcp->tcp_listener == NULL)) { 2584 CONN_INC_REF(connp); 2585 mutex_exit(&bind_connfp->connf_lock); 2586 return (connp); 2587 } 2588 } 2589 mutex_exit(&bind_connfp->connf_lock); 2590 return (NULL); 2591 } 2592 2593 /* 2594 * Finds a TCP/IPv6 listening connection; called by tcp_disconnect to locate 2595 * a listener when changing state. 2596 */ 2597 conn_t * 2598 ipcl_lookup_listener_v6(uint16_t lport, in6_addr_t *laddr, uint_t ifindex, 2599 zoneid_t zoneid, ip_stack_t *ipst) 2600 { 2601 connf_t *bind_connfp; 2602 conn_t *connp = NULL; 2603 tcp_t *tcp; 2604 2605 /* 2606 * Avoid false matches for packets sent to an IP destination of 2607 * all zeros. 2608 */ 2609 if (IN6_IS_ADDR_UNSPECIFIED(laddr)) 2610 return (NULL); 2611 2612 ASSERT(zoneid != ALL_ZONES); 2613 2614 bind_connfp = &ipst->ips_ipcl_bind_fanout[IPCL_BIND_HASH(lport, ipst)]; 2615 mutex_enter(&bind_connfp->connf_lock); 2616 for (connp = bind_connfp->connf_head; connp != NULL; 2617 connp = connp->conn_next) { 2618 tcp = connp->conn_tcp; 2619 if (IPCL_BIND_MATCH_V6(connp, IPPROTO_TCP, *laddr, lport) && 2620 IPCL_ZONE_MATCH(connp, zoneid) && 2621 (tcp->tcp_bound_if == 0 || 2622 tcp->tcp_bound_if == ifindex) && 2623 tcp->tcp_listener == NULL) { 2624 CONN_INC_REF(connp); 2625 mutex_exit(&bind_connfp->connf_lock); 2626 return (connp); 2627 } 2628 } 2629 mutex_exit(&bind_connfp->connf_lock); 2630 return (NULL); 2631 } 2632 2633 /* 2634 * ipcl_get_next_conn 2635 * get the next entry in the conn global list 2636 * and put a reference on the next_conn. 2637 * decrement the reference on the current conn. 2638 * 2639 * This is an iterator based walker function that also provides for 2640 * some selection by the caller. It walks through the conn_hash bucket 2641 * searching for the next valid connp in the list, and selects connections 2642 * that are neither closed nor condemned. It also REFHOLDS the conn 2643 * thus ensuring that the conn exists when the caller uses the conn. 2644 */ 2645 conn_t * 2646 ipcl_get_next_conn(connf_t *connfp, conn_t *connp, uint32_t conn_flags) 2647 { 2648 conn_t *next_connp; 2649 2650 if (connfp == NULL) 2651 return (NULL); 2652 2653 mutex_enter(&connfp->connf_lock); 2654 2655 next_connp = (connp == NULL) ? 2656 connfp->connf_head : connp->conn_g_next; 2657 2658 while (next_connp != NULL) { 2659 mutex_enter(&next_connp->conn_lock); 2660 if (!(next_connp->conn_flags & conn_flags) || 2661 (next_connp->conn_state_flags & 2662 (CONN_CONDEMNED | CONN_INCIPIENT))) { 2663 /* 2664 * This conn has been condemned or 2665 * is closing, or the flags don't match 2666 */ 2667 mutex_exit(&next_connp->conn_lock); 2668 next_connp = next_connp->conn_g_next; 2669 continue; 2670 } 2671 CONN_INC_REF_LOCKED(next_connp); 2672 mutex_exit(&next_connp->conn_lock); 2673 break; 2674 } 2675 2676 mutex_exit(&connfp->connf_lock); 2677 2678 if (connp != NULL) 2679 CONN_DEC_REF(connp); 2680 2681 return (next_connp); 2682 } 2683 2684 #ifdef CONN_DEBUG 2685 /* 2686 * Trace of the last NBUF refhold/refrele 2687 */ 2688 int 2689 conn_trace_ref(conn_t *connp) 2690 { 2691 int last; 2692 conn_trace_t *ctb; 2693 2694 ASSERT(MUTEX_HELD(&connp->conn_lock)); 2695 last = connp->conn_trace_last; 2696 last++; 2697 if (last == CONN_TRACE_MAX) 2698 last = 0; 2699 2700 ctb = &connp->conn_trace_buf[last]; 2701 ctb->ctb_depth = getpcstack(ctb->ctb_stack, CONN_STACK_DEPTH); 2702 connp->conn_trace_last = last; 2703 return (1); 2704 } 2705 2706 int 2707 conn_untrace_ref(conn_t *connp) 2708 { 2709 int last; 2710 conn_trace_t *ctb; 2711 2712 ASSERT(MUTEX_HELD(&connp->conn_lock)); 2713 last = connp->conn_trace_last; 2714 last++; 2715 if (last == CONN_TRACE_MAX) 2716 last = 0; 2717 2718 ctb = &connp->conn_trace_buf[last]; 2719 ctb->ctb_depth = getpcstack(ctb->ctb_stack, CONN_STACK_DEPTH); 2720 connp->conn_trace_last = last; 2721 return (1); 2722 } 2723 #endif 2724