xref: /titanic_50/usr/src/uts/common/inet/ipclassifier.h (revision 3db3491215579980a91e230cf21b20608fbb8259)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  */
25 
26 #ifndef	_INET_IPCLASSIFIER_H
27 #define	_INET_IPCLASSIFIER_H
28 
29 #ifdef	__cplusplus
30 extern "C" {
31 #endif
32 
33 #include <inet/common.h>
34 #include <inet/ip.h>
35 #include <inet/mi.h>
36 #include <inet/tcp.h>
37 #include <inet/ip6.h>
38 #include <netinet/in.h>		/* for IPPROTO_* constants */
39 #include <sys/sdt.h>
40 #include <sys/socket_proto.h>
41 #include <sys/sunddi.h>
42 #include <sys/sunldi.h>
43 
44 typedef void (*edesc_spf)(void *, mblk_t *, void *, int);
45 typedef void (*edesc_rpf)(void *, mblk_t *, void *);
46 
47 /*
48  * ==============================
49  * =	The CONNECTION		=
50  * ==============================
51  */
52 
53 /*
54  * The connection structure contains the common information/flags/ref needed.
55  * Implementation will keep the connection struct, the layers (with their
56  * respective data for event i.e. tcp_t if event was tcp_input) all in one
57  * contiguous memory location.
58  */
59 
60 /* Conn Flags */
61 /* Unused			0x00020000 */
62 /* Unused			0x00040000 */
63 #define	IPCL_FULLY_BOUND	0x00080000	/* Bound to correct squeue */
64 #define	IPCL_CHECK_POLICY	0x00100000	/* Needs policy checking */
65 #define	IPCL_SOCKET		0x00200000	/* Sockfs connection */
66 #define	IPCL_ACCEPTOR		0x00400000	/* Sockfs priv acceptor */
67 #define	IPCL_CL_LISTENER	0x00800000	/* Cluster listener */
68 #define	IPCL_EAGER		0x01000000	/* Incoming connection */
69 /* Unused			0x02000000 */
70 #define	IPCL_TCP6		0x04000000	/* AF_INET6 TCP */
71 #define	IPCL_TCP4		0x08000000	/* IPv4 packet format TCP */
72 /* Unused			0x10000000 */
73 /* Unused			0x20000000 */
74 #define	IPCL_CONNECTED		0x40000000	/* Conn in connected table */
75 #define	IPCL_BOUND		0x80000000	/* Conn in bind table */
76 
77 /* Flags identifying the type of conn */
78 #define	IPCL_TCPCONN		0x00000001	/* From tcp_conn_cache */
79 #define	IPCL_SCTPCONN		0x00000002	/* From sctp_conn_cache */
80 #define	IPCL_IPCCONN		0x00000004	/* From ip_conn_cache */
81 #define	IPCL_UDPCONN		0x00000008	/* From udp_conn_cache */
82 #define	IPCL_RAWIPCONN		0x00000010	/* From rawip_conn_cache */
83 #define	IPCL_RTSCONN		0x00000020	/* From rts_conn_cache */
84 #define	IPCL_ISV6		0x00000040	/* AF_INET6 */
85 #define	IPCL_IPTUN		0x00000080	/* Has "tun" plumbed above it */
86 #define	IPCL_NONSTR		0x00001000	/* A non-STREAMS socket */
87 #define	IPCL_IN_SQUEUE		0x10000000	/* Waiting squeue to finish */
88 
89 /* Conn Masks */
90 #define	IPCL_TCP		(IPCL_TCP4|IPCL_TCP6)
91 #define	IPCL_REMOVED		0x00000100
92 #define	IPCL_REUSED		0x00000200
93 
94 /* The packet format is IPv4; could be an AF_INET or AF_INET6 socket */
95 #define	IPCL_IS_TCP4(connp)						\
96 	(((connp)->conn_flags & IPCL_TCP4))
97 
98 /* Connected AF_INET with no IPsec policy */
99 #define	IPCL_IS_TCP4_CONNECTED_NO_POLICY(connp)				\
100 	(((connp)->conn_flags &						\
101 		(IPCL_TCP4|IPCL_CONNECTED|IPCL_CHECK_POLICY|IPCL_TCP6))	\
102 		== (IPCL_TCP4|IPCL_CONNECTED))
103 
104 #define	IPCL_IS_CONNECTED(connp)					\
105 	((connp)->conn_flags & IPCL_CONNECTED)
106 
107 #define	IPCL_IS_BOUND(connp)						\
108 	((connp)->conn_flags & IPCL_BOUND)
109 
110 /* AF_INET TCP that is bound */
111 #define	IPCL_IS_TCP4_BOUND(connp)					\
112 	(((connp)->conn_flags &						\
113 		(IPCL_TCP4|IPCL_BOUND|IPCL_TCP6)) ==			\
114 		(IPCL_TCP4|IPCL_BOUND))
115 
116 #define	IPCL_IS_FULLY_BOUND(connp)					\
117 	((connp)->conn_flags & IPCL_FULLY_BOUND)
118 
119 /*
120  * Can't use conn_protocol since we need to tell difference
121  * between a real TCP socket and a SOCK_RAW, IPPROTO_TCP.
122  */
123 #define	IPCL_IS_TCP(connp)						\
124 	((connp)->conn_flags & IPCL_TCPCONN)
125 
126 #define	IPCL_IS_SCTP(connp)						\
127 	((connp)->conn_flags & IPCL_SCTPCONN)
128 
129 #define	IPCL_IS_UDP(connp)						\
130 	((connp)->conn_flags & IPCL_UDPCONN)
131 
132 #define	IPCL_IS_RAWIP(connp)						\
133 	((connp)->conn_flags & IPCL_RAWIPCONN)
134 
135 #define	IPCL_IS_RTS(connp)						\
136 	((connp)->conn_flags & IPCL_RTSCONN)
137 
138 /* FIXME: Isn't it sufficient to check IPCL_IPTUN? */
139 #define	IPCL_IS_IPTUN(connp)						\
140 	(((connp)->conn_ulp == IPPROTO_ENCAP ||				\
141 	(connp)->conn_ulp == IPPROTO_IPV6) &&				\
142 	((connp)->conn_flags & IPCL_IPTUN))
143 
144 #define	IPCL_IS_NONSTR(connp)	((connp)->conn_flags & IPCL_NONSTR)
145 
146 typedef struct connf_s connf_t;
147 
148 typedef struct
149 {
150 	int	ctb_depth;
151 #define	CONN_STACK_DEPTH	15
152 	pc_t	ctb_stack[CONN_STACK_DEPTH];
153 } conn_trace_t;
154 
155 typedef struct ip_helper_minor_info_s {
156 	dev_t	ip_minfo_dev;		/* Device */
157 	vmem_t	*ip_minfo_arena;	/* Arena */
158 } ip_helper_minfo_t;
159 
160 /*
161  * ip helper stream info
162  */
163 typedef struct ip_helper_stream_info_s {
164 	ldi_handle_t		iphs_handle;
165 	queue_t 		*iphs_rq;
166 	queue_t 		*iphs_wq;
167 	ip_helper_minfo_t	*iphs_minfo;
168 } ip_helper_stream_info_t;
169 
170 /*
171  * The initial fields in the conn_t are setup by the kmem_cache constructor,
172  * and are preserved when it is freed. Fields after that are bzero'ed when
173  * the conn_t is freed.
174  */
175 struct conn_s {
176 	kmutex_t	conn_lock;
177 	uint32_t	conn_ref;		/* Reference counter */
178 	uint32_t	conn_flags;		/* Conn Flags */
179 
180 
181 	union {
182 		tcp_t		*cp_tcp;	/* Pointer to the tcp struct */
183 		struct udp_s	*cp_udp;	/* Pointer to the udp struct */
184 		struct icmp_s	*cp_icmp;	/* Pointer to rawip struct */
185 		struct rts_s	*cp_rts;	/* Pointer to rts struct */
186 		void		*cp_priv;
187 	} conn_proto_priv;
188 #define	conn_tcp	conn_proto_priv.cp_tcp
189 #define	conn_udp	conn_proto_priv.cp_udp
190 #define	conn_icmp	conn_proto_priv.cp_icmp
191 #define	conn_rts	conn_proto_priv.cp_rts
192 #define	conn_priv	conn_proto_priv.cp_priv
193 
194 	kcondvar_t	conn_cv;
195 	uint8_t		conn_ulp;		/* protocol type */
196 
197 	edesc_rpf	conn_recv;		/* Pointer to recv routine */
198 
199 	/* Fields after this are bzero'ed when the conn_t is freed. */
200 
201 	squeue_t	*conn_sqp;		/* Squeue for processing */
202 	uint_t		conn_state_flags;	/* IP state flags */
203 #define	conn_start_clr	conn_state_flags
204 
205 	ire_t		*conn_ire_cache; 	/* outbound ire cache */
206 	unsigned int
207 		conn_on_sqp : 1,		/* Conn is being processed */
208 		conn_dontroute : 1,		/* SO_DONTROUTE state */
209 		conn_loopback : 1,		/* SO_LOOPBACK state */
210 		conn_broadcast : 1,		/* SO_BROADCAST state */
211 
212 		conn_reuseaddr : 1,		/* SO_REUSEADDR state */
213 		conn_multicast_loop : 1,	/* IP_MULTICAST_LOOP */
214 		conn_multi_router : 1,		/* Wants all multicast pkts */
215 		conn_draining : 1,		/* ip_wsrv running */
216 
217 		conn_did_putbq : 1,		/* ip_wput did a putbq */
218 		conn_unspec_src : 1,		/* IP_UNSPEC_SRC */
219 		conn_policy_cached : 1,		/* Is policy cached/latched ? */
220 		conn_in_enforce_policy : 1,	/* Enforce Policy on inbound */
221 
222 		conn_out_enforce_policy : 1,	/* Enforce Policy on outbound */
223 		conn_af_isv6 : 1,		/* ip address family ver 6 */
224 		conn_pkt_isv6 : 1,		/* ip packet format ver 6 */
225 		conn_ip_recvpktinfo : 1,	/* IPV*_RECVPKTINFO option */
226 
227 		conn_ipv6_recvhoplimit : 1,	/* IPV6_RECVHOPLIMIT option */
228 		conn_ipv6_recvhopopts : 1,	/* IPV6_RECVHOPOPTS option */
229 		conn_ipv6_recvdstopts : 1,	/* IPV6_RECVDSTOPTS option */
230 		conn_ipv6_recvrthdr : 1,	/* IPV6_RECVRTHDR option */
231 
232 		conn_ipv6_recvrtdstopts : 1,	/* IPV6_RECVRTHDRDSTOPTS */
233 		conn_ipv6_v6only : 1,		/* IPV6_V6ONLY */
234 		conn_ipv6_recvtclass : 1,	/* IPV6_RECVTCLASS */
235 		conn_ipv6_recvpathmtu : 1,	/* IPV6_RECVPATHMTU */
236 
237 		conn_pathmtu_valid : 1,		/* The cached mtu is valid. */
238 		conn_ipv6_dontfrag : 1,		/* IPV6_DONTFRAG */
239 		conn_fully_bound : 1,		/* Fully bound connection */
240 		conn_recvif : 1,		/* IP_RECVIF option */
241 
242 		conn_recvslla : 1,		/* IP_RECVSLLA option */
243 		conn_mdt_ok : 1,		/* MDT is permitted */
244 		conn_nexthop_set : 1,
245 		conn_allzones : 1;		/* SO_ALLZONES */
246 
247 	unsigned int
248 		conn_lso_ok : 1;		/* LSO is usable */
249 
250 	squeue_t	*conn_initial_sqp;	/* Squeue at open time */
251 	squeue_t	*conn_final_sqp;	/* Squeue after connect */
252 	ill_t		*conn_dhcpinit_ill;	/* IP_DHCPINIT_IF */
253 	ipsec_latch_t	*conn_latch;		/* latched state */
254 	ill_t		*conn_outgoing_ill;	/* IP{,V6}_BOUND_IF */
255 	edesc_spf	conn_send;		/* Pointer to send routine */
256 	queue_t		*conn_rq;		/* Read queue */
257 	queue_t		*conn_wq;		/* Write queue */
258 	dev_t		conn_dev;		/* Minor number */
259 	vmem_t		*conn_minor_arena;	/* Minor arena */
260 	ip_helper_stream_info_t *conn_helper_info;
261 
262 	cred_t		*conn_cred;		/* Credentials */
263 	connf_t		*conn_g_fanout;		/* Global Hash bucket head */
264 	struct conn_s	*conn_g_next;		/* Global Hash chain next */
265 	struct conn_s	*conn_g_prev;		/* Global Hash chain prev */
266 	struct ipsec_policy_head_s *conn_policy; /* Configured policy */
267 	in6_addr_t	conn_bound_source_v6;
268 #define	conn_bound_source	V4_PART_OF_V6(conn_bound_source_v6)
269 
270 	connf_t		*conn_fanout;		/* Hash bucket we're part of */
271 	struct conn_s	*conn_next;		/* Hash chain next */
272 	struct conn_s	*conn_prev;		/* Hash chain prev */
273 	struct {
274 		in6_addr_t connua_laddr;	/* Local address */
275 		in6_addr_t connua_faddr;	/* Remote address */
276 	} connua_v6addr;
277 #define	conn_src	V4_PART_OF_V6(connua_v6addr.connua_laddr)
278 #define	conn_rem	V4_PART_OF_V6(connua_v6addr.connua_faddr)
279 #define	conn_srcv6	connua_v6addr.connua_laddr
280 #define	conn_remv6	connua_v6addr.connua_faddr
281 	union {
282 		/* Used for classifier match performance */
283 		uint32_t		conn_ports2;
284 		struct {
285 			in_port_t	tcpu_fport;	/* Remote port */
286 			in_port_t	tcpu_lport;	/* Local port */
287 		} tcpu_ports;
288 	} u_port;
289 #define	conn_fport	u_port.tcpu_ports.tcpu_fport
290 #define	conn_lport	u_port.tcpu_ports.tcpu_lport
291 #define	conn_ports	u_port.conn_ports2
292 #define	conn_upq	conn_rq
293 	uint8_t		conn_unused_byte;
294 
295 	uint_t		conn_proto;		/* SO_PROTOTYPE state */
296 	ill_t		*conn_incoming_ill;	/* IP{,V6}_BOUND_IF */
297 	ill_t		*conn_oper_pending_ill; /* pending shared ioctl */
298 
299 	ilg_t	*conn_ilg;		/* Group memberships */
300 	int	conn_ilg_allocated;	/* Number allocated */
301 	int	conn_ilg_inuse;		/* Number currently used */
302 	int	conn_ilg_walker_cnt;	/* No of ilg walkers */
303 	/* XXXX get rid of this, once ilg_delete_all is fixed */
304 	kcondvar_t	conn_refcv;
305 
306 	struct ipif_s	*conn_multicast_ipif;	/* IP_MULTICAST_IF */
307 	ill_t		*conn_multicast_ill;	/* IPV6_MULTICAST_IF */
308 	struct	conn_s	*conn_drain_next;	/* Next conn in drain list */
309 	struct	conn_s	*conn_drain_prev;	/* Prev conn in drain list */
310 	idl_t		*conn_idl;		/* Ptr to the drain list head */
311 	mblk_t		*conn_ipsec_opt_mp;	/* ipsec option mblk */
312 	uint32_t	conn_src_preferences;	/* prefs for src addr select */
313 	/* mtuinfo from IPV6_PACKET_TOO_BIG conditional on conn_pathmtu_valid */
314 	struct ip6_mtuinfo mtuinfo;
315 	zoneid_t	conn_zoneid;		/* zone connection is in */
316 	in6_addr_t	conn_nexthop_v6;	/* nexthop IP address */
317 	uchar_t		conn_broadcast_ttl; 	/* IP_BROADCAST_TTL */
318 #define	conn_nexthop_v4	V4_PART_OF_V6(conn_nexthop_v6)
319 	cred_t		*conn_peercred;		/* Peer credentials, if any */
320 	int		conn_rtaware; 		/* RT_AWARE sockopt value */
321 	kcondvar_t	conn_sq_cv;		/* For non-STREAMS socket IO */
322 	kthread_t	*conn_sq_caller;	/* Caller of squeue sync ops */
323 	sock_upcalls_t	*conn_upcalls;		/* Upcalls to sockfs */
324 	sock_upper_handle_t conn_upper_handle;	/* Upper handle: sonode * */
325 
326 	unsigned int
327 		conn_ulp_labeled : 1,		/* ULP label is synced */
328 		conn_mlp_type : 2,		/* mlp_type_t; tsol/tndb.h */
329 		conn_anon_mlp : 1,		/* user wants anon MLP */
330 
331 		conn_anon_port : 1,		/* user bound anonymously */
332 		conn_mac_exempt : 1,		/* unlabeled with loose MAC */
333 		conn_spare : 26;
334 
335 	boolean_t	conn_flow_cntrld;
336 	netstack_t	*conn_netstack;	/* Corresponds to a netstack_hold */
337 #ifdef CONN_DEBUG
338 #define	CONN_TRACE_MAX	10
339 	int		conn_trace_last;	/* ndx of last used tracebuf */
340 	conn_trace_t	conn_trace_buf[CONN_TRACE_MAX];
341 #endif
342 };
343 
344 #define	CONN_CRED(connp) ((connp)->conn_peercred == NULL ? \
345 	(connp)->conn_cred : (connp)->conn_peercred)
346 #define	BEST_CRED(mp, connp) ((DB_CRED(mp) != NULL &&	\
347 	crgetlabel(DB_CRED(mp)) != NULL) ? DB_CRED(mp) : CONN_CRED(connp))
348 
349 /*
350  * connf_t - connection fanout data.
351  *
352  * The hash tables and their linkage (conn_t.{hashnextp, hashprevp} are
353  * protected by the per-bucket lock. Each conn_t inserted in the list
354  * points back at the connf_t that heads the bucket.
355  */
356 struct connf_s {
357 	struct conn_s	*connf_head;
358 	kmutex_t	connf_lock;
359 };
360 
361 #define	CONN_INC_REF(connp)	{				\
362 	mutex_enter(&(connp)->conn_lock);			\
363 	DTRACE_PROBE1(conn__inc__ref, conn_t *, connp);		\
364 	ASSERT(conn_trace_ref(connp));				\
365 	(connp)->conn_ref++;					\
366 	ASSERT((connp)->conn_ref != 0);				\
367 	mutex_exit(&(connp)->conn_lock);			\
368 }
369 
370 #define	CONN_INC_REF_LOCKED(connp)	{			\
371 	DTRACE_PROBE1(conn__inc__ref, conn_t *, connp);		\
372 	ASSERT(MUTEX_HELD(&(connp)->conn_lock));	 	\
373 	ASSERT(conn_trace_ref(connp));				\
374 	(connp)->conn_ref++;					\
375 	ASSERT((connp)->conn_ref != 0);				\
376 }
377 
378 #define	CONN_DEC_REF(connp)	{					\
379 	mutex_enter(&(connp)->conn_lock);				\
380 	DTRACE_PROBE1(conn__dec__ref, conn_t *, connp);			\
381 	/*								\
382 	 * The squeue framework always does a CONN_DEC_REF after return	\
383 	 * from TCP. Hence the refcnt must be at least 2 if conn_on_sqp	\
384 	 * is B_TRUE and conn_ref is being decremented. This is to	\
385 	 * account for the mblk being currently processed.		\
386 	 */								\
387 	if ((connp)->conn_ref <= 0 ||					\
388 	    ((connp)->conn_ref == 1 && (connp)->conn_on_sqp))		\
389 		cmn_err(CE_PANIC, "CONN_DEC_REF: connp(%p) has ref "	\
390 			"= %d\n", (void *)(connp), (connp)->conn_ref);	\
391 	ASSERT(conn_untrace_ref(connp));				\
392 	(connp)->conn_ref--;						\
393 	if ((connp)->conn_ref == 0) {					\
394 		/* Refcnt can't increase again, safe to drop lock */	\
395 		mutex_exit(&(connp)->conn_lock);			\
396 		ipcl_conn_destroy(connp);				\
397 	} else {							\
398 		cv_broadcast(&(connp)->conn_cv);			\
399 		mutex_exit(&(connp)->conn_lock);			\
400 	}								\
401 }
402 
403 /*
404  * For use with subsystems within ip which use ALL_ZONES as a wildcard
405  */
406 #define	IPCL_ZONEID(connp)						\
407 	((connp)->conn_allzones ? ALL_ZONES : (connp)->conn_zoneid)
408 
409 /*
410  * For matching between a conn_t and a zoneid.
411  */
412 #define	IPCL_ZONE_MATCH(connp, zoneid) 					\
413 	(((connp)->conn_allzones) ||					\
414 	    ((zoneid) == ALL_ZONES) ||					\
415 	    (connp)->conn_zoneid == (zoneid))
416 
417 
418 #define	_IPCL_V4_MATCH(v6addr, v4addr)	\
419 	(V4_PART_OF_V6((v6addr)) == (v4addr) && IN6_IS_ADDR_V4MAPPED(&(v6addr)))
420 
421 #define	_IPCL_V4_MATCH_ANY(addr)	\
422 	(IN6_IS_ADDR_V4MAPPED_ANY(&(addr)) || IN6_IS_ADDR_UNSPECIFIED(&(addr)))
423 
424 
425 /*
426  * IPCL_PROTO_MATCH() only matches conns with the specified zoneid, while
427  * IPCL_PROTO_MATCH_V6() can match other conns in the multicast case, see
428  * ip_fanout_proto().
429  */
430 #define	IPCL_PROTO_MATCH(connp, protocol, ipha, ill,			\
431     fanout_flags, zoneid)						\
432 	((((connp)->conn_src == INADDR_ANY) ||				\
433 	(((connp)->conn_src == ((ipha)->ipha_dst)) &&			\
434 	    (((connp)->conn_rem == INADDR_ANY) ||			\
435 	((connp)->conn_rem == ((ipha)->ipha_src))))) &&			\
436 	IPCL_ZONE_MATCH(connp, zoneid) &&				\
437 	(conn_wantpacket((connp), (ill), (ipha), (fanout_flags), 	\
438 	    (zoneid)) || ((protocol) == IPPROTO_PIM) ||			\
439 	    ((protocol) == IPPROTO_RSVP)))
440 
441 #define	IPCL_PROTO_MATCH_V6(connp, protocol, ip6h, ill,			   \
442     fanout_flags, zoneid)						   \
443 	((IN6_IS_ADDR_UNSPECIFIED(&(connp)->conn_srcv6) ||		   \
444 	(IN6_ARE_ADDR_EQUAL(&(connp)->conn_srcv6, &((ip6h)->ip6_dst)) &&   \
445 	(IN6_IS_ADDR_UNSPECIFIED(&(connp)->conn_remv6) ||		   \
446 	IN6_ARE_ADDR_EQUAL(&(connp)->conn_remv6, &((ip6h)->ip6_src))))) && \
447 	(conn_wantpacket_v6((connp), (ill), (ip6h),			   \
448 	(fanout_flags), (zoneid)) || ((protocol) == IPPROTO_RSVP)))
449 
450 #define	IPCL_CONN_HASH(src, ports, ipst)				\
451 	((unsigned)(ntohl((src)) ^ ((ports) >> 24) ^ ((ports) >> 16) ^	\
452 	((ports) >> 8) ^ (ports)) % (ipst)->ips_ipcl_conn_fanout_size)
453 
454 #define	IPCL_CONN_HASH_V6(src, ports, ipst)				\
455 	IPCL_CONN_HASH(V4_PART_OF_V6((src)), (ports), (ipst))
456 
457 #define	IPCL_CONN_MATCH(connp, proto, src, dst, ports)			\
458 	((connp)->conn_ulp == (proto) &&				\
459 		(connp)->conn_ports == (ports) &&      			\
460 		_IPCL_V4_MATCH((connp)->conn_remv6, (src)) &&		\
461 		_IPCL_V4_MATCH((connp)->conn_srcv6, (dst)) &&		\
462 		!(connp)->conn_ipv6_v6only)
463 
464 #define	IPCL_CONN_MATCH_V6(connp, proto, src, dst, ports)		\
465 	((connp)->conn_ulp == (proto) &&				\
466 		(connp)->conn_ports == (ports) &&      			\
467 		IN6_ARE_ADDR_EQUAL(&(connp)->conn_remv6, &(src)) &&	\
468 		IN6_ARE_ADDR_EQUAL(&(connp)->conn_srcv6, &(dst)))
469 
470 #define	IPCL_CONN_INIT(connp, protocol, src, rem, ports) {		\
471 	(connp)->conn_ulp = protocol;					\
472 	IN6_IPADDR_TO_V4MAPPED(src, &(connp)->conn_srcv6);		\
473 	IN6_IPADDR_TO_V4MAPPED(rem, &(connp)->conn_remv6);		\
474 	(connp)->conn_ports = ports;					\
475 }
476 
477 #define	IPCL_CONN_INIT_V6(connp, protocol, src, rem, ports) {		\
478 	(connp)->conn_ulp = protocol;					\
479 	(connp)->conn_srcv6 = src;					\
480 	(connp)->conn_remv6 = rem;					\
481 	(connp)->conn_ports = ports;					\
482 }
483 
484 #define	IPCL_PORT_HASH(port, size) \
485 	((((port) >> 8) ^ (port)) & ((size) - 1))
486 
487 #define	IPCL_BIND_HASH(lport, ipst)					\
488 	((unsigned)(((lport) >> 8) ^ (lport)) % \
489 	    (ipst)->ips_ipcl_bind_fanout_size)
490 
491 #define	IPCL_BIND_MATCH(connp, proto, laddr, lport)			\
492 	((connp)->conn_ulp == (proto) &&				\
493 		(connp)->conn_lport == (lport) &&			\
494 		(_IPCL_V4_MATCH_ANY((connp)->conn_srcv6) ||		\
495 		_IPCL_V4_MATCH((connp)->conn_srcv6, (laddr))) &&	\
496 		!(connp)->conn_ipv6_v6only)
497 
498 #define	IPCL_BIND_MATCH_V6(connp, proto, laddr, lport)			\
499 	((connp)->conn_ulp == (proto) &&				\
500 		(connp)->conn_lport == (lport) &&			\
501 		(IN6_ARE_ADDR_EQUAL(&(connp)->conn_srcv6, &(laddr)) ||	\
502 		IN6_IS_ADDR_UNSPECIFIED(&(connp)->conn_srcv6)))
503 
504 #define	IPCL_UDP_MATCH(connp, lport, laddr, fport, faddr)		\
505 	(((connp)->conn_lport == (lport)) &&				\
506 	((_IPCL_V4_MATCH_ANY((connp)->conn_srcv6) ||			\
507 	(_IPCL_V4_MATCH((connp)->conn_srcv6, (laddr)) &&		\
508 	(_IPCL_V4_MATCH_ANY((connp)->conn_remv6) ||			\
509 	(_IPCL_V4_MATCH((connp)->conn_remv6, (faddr)) &&		\
510 	(connp)->conn_fport == (fport)))))) &&				\
511 	!(connp)->conn_ipv6_v6only)
512 
513 #define	IPCL_UDP_MATCH_V6(connp, lport, laddr, fport, faddr)	\
514 	(((connp)->conn_lport == (lport)) &&			\
515 	(IN6_IS_ADDR_UNSPECIFIED(&(connp)->conn_srcv6) ||	\
516 	(IN6_ARE_ADDR_EQUAL(&(connp)->conn_srcv6, &(laddr)) &&	\
517 	(IN6_IS_ADDR_UNSPECIFIED(&(connp)->conn_remv6) ||	\
518 	(IN6_ARE_ADDR_EQUAL(&(connp)->conn_remv6, &(faddr)) &&	\
519 	(connp)->conn_fport == (fport))))))
520 
521 #define	IPCL_TCP_EAGER_INIT(connp, protocol, src, rem, ports) {		\
522 	(connp)->conn_flags |= (IPCL_TCP4|IPCL_EAGER);			\
523 	IN6_IPADDR_TO_V4MAPPED(src, &(connp)->conn_srcv6);		\
524 	IN6_IPADDR_TO_V4MAPPED(rem, &(connp)->conn_remv6);		\
525 	(connp)->conn_ports = ports;					\
526 	(connp)->conn_send = ip_output;					\
527 	(connp)->conn_sqp = IP_SQUEUE_GET(lbolt);			\
528 	(connp)->conn_initial_sqp = (connp)->conn_sqp;			\
529 }
530 
531 #define	IPCL_TCP_EAGER_INIT_V6(connp, protocol, src, rem, ports) {	\
532 	(connp)->conn_flags |= (IPCL_TCP6|IPCL_EAGER|IPCL_ISV6);	\
533 	(connp)->conn_srcv6 = src;					\
534 	(connp)->conn_remv6 = rem;					\
535 	(connp)->conn_ports = ports;					\
536 	(connp)->conn_send = ip_output_v6;				\
537 	(connp)->conn_sqp = IP_SQUEUE_GET(lbolt);			\
538 	(connp)->conn_initial_sqp = (connp)->conn_sqp;			\
539 }
540 
541 #define	IPCL_UDP_HASH(lport, ipst)	\
542 	IPCL_PORT_HASH(lport, (ipst)->ips_ipcl_udp_fanout_size)
543 
544 #define	CONN_G_HASH_SIZE	1024
545 
546 /* Raw socket hash function. */
547 #define	IPCL_RAW_HASH(lport, ipst)	\
548 	IPCL_PORT_HASH(lport, (ipst)->ips_ipcl_raw_fanout_size)
549 
550 /*
551  * This is similar to IPCL_BIND_MATCH except that the local port check
552  * is changed to a wildcard port check.
553  */
554 #define	IPCL_RAW_MATCH(connp, proto, laddr)			\
555 	((connp)->conn_ulp == (proto) &&			\
556 	(connp)->conn_lport == 0 &&				\
557 	(_IPCL_V4_MATCH_ANY((connp)->conn_srcv6) ||		\
558 	_IPCL_V4_MATCH((connp)->conn_srcv6, (laddr))))
559 
560 #define	IPCL_RAW_MATCH_V6(connp, proto, laddr)			\
561 	((connp)->conn_ulp == (proto) &&			\
562 	(connp)->conn_lport == 0 &&				\
563 	(IN6_IS_ADDR_UNSPECIFIED(&(connp)->conn_srcv6) ||	\
564 	IN6_ARE_ADDR_EQUAL(&(connp)->conn_srcv6, &(laddr))))
565 
566 /* Function prototypes */
567 extern void ipcl_g_init(void);
568 extern void ipcl_init(ip_stack_t *);
569 extern void ipcl_g_destroy(void);
570 extern void ipcl_destroy(ip_stack_t *);
571 extern conn_t *ipcl_conn_create(uint32_t, int, netstack_t *);
572 extern void ipcl_conn_destroy(conn_t *);
573 
574 void ipcl_hash_insert_wildcard(connf_t *, conn_t *);
575 void ipcl_hash_remove(conn_t *);
576 void ipcl_hash_remove_locked(conn_t *connp, connf_t *connfp);
577 
578 extern int	ipcl_bind_insert(conn_t *, uint8_t, ipaddr_t, uint16_t);
579 extern int	ipcl_bind_insert_v6(conn_t *, uint8_t, const in6_addr_t *,
580 		    uint16_t);
581 extern int	ipcl_conn_insert(conn_t *, uint8_t, ipaddr_t, ipaddr_t,
582 		    uint32_t);
583 extern int	ipcl_conn_insert_v6(conn_t *, uint8_t, const in6_addr_t *,
584 		    const in6_addr_t *, uint32_t, uint_t);
585 extern conn_t	*ipcl_get_next_conn(connf_t *, conn_t *, uint32_t);
586 
587 void ipcl_proto_insert(conn_t *, uint8_t);
588 void ipcl_proto_insert_v6(conn_t *, uint8_t);
589 conn_t *ipcl_classify_v4(mblk_t *, uint8_t, uint_t, zoneid_t, ip_stack_t *);
590 conn_t *ipcl_classify_v6(mblk_t *, uint8_t, uint_t, zoneid_t, ip_stack_t *);
591 conn_t *ipcl_classify(mblk_t *, zoneid_t, ip_stack_t *);
592 conn_t *ipcl_classify_raw(mblk_t *, uint8_t, zoneid_t, uint32_t, ipha_t *,
593 	    ip_stack_t *);
594 void	ipcl_globalhash_insert(conn_t *);
595 void	ipcl_globalhash_remove(conn_t *);
596 void	ipcl_walk(pfv_t, void *, ip_stack_t *);
597 conn_t	*ipcl_tcp_lookup_reversed_ipv4(ipha_t *, tcph_t *, int, ip_stack_t *);
598 conn_t	*ipcl_tcp_lookup_reversed_ipv6(ip6_t *, tcpha_t *, int, uint_t,
599 	    ip_stack_t *);
600 conn_t	*ipcl_lookup_listener_v4(uint16_t, ipaddr_t, zoneid_t, ip_stack_t *);
601 conn_t	*ipcl_lookup_listener_v6(uint16_t, in6_addr_t *, uint_t, zoneid_t,
602 	    ip_stack_t *);
603 int	conn_trace_ref(conn_t *);
604 int	conn_untrace_ref(conn_t *);
605 void	ipcl_conn_cleanup(conn_t *);
606 conn_t *ipcl_conn_tcp_lookup_reversed_ipv4(conn_t *, ipha_t *, tcph_t *,
607 	    ip_stack_t *);
608 conn_t *ipcl_conn_tcp_lookup_reversed_ipv6(conn_t *, ip6_t *, tcph_t *,
609 	    ip_stack_t *);
610 
611 extern int ip_create_helper_stream(conn_t *connp, ldi_ident_t li);
612 extern void ip_free_helper_stream(conn_t *connp);
613 
614 extern int ip_get_options(conn_t *, int, int, void *, t_uscalar_t *, cred_t *);
615 extern int ip_set_options(conn_t *, int, int, const void *, t_uscalar_t,
616     cred_t *);
617 
618 #ifdef	__cplusplus
619 }
620 #endif
621 
622 #endif	/* _INET_IPCLASSIFIER_H */
623