1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright 2008 Sun Microsystems, Inc. All rights reserved. 23 * Use is subject to license terms. 24 */ 25 26 /* 27 * IP PACKET CLASSIFIER 28 * 29 * The IP packet classifier provides mapping between IP packets and persistent 30 * connection state for connection-oriented protocols. It also provides 31 * interface for managing connection states. 32 * 33 * The connection state is kept in conn_t data structure and contains, among 34 * other things: 35 * 36 * o local/remote address and ports 37 * o Transport protocol 38 * o squeue for the connection (for TCP only) 39 * o reference counter 40 * o Connection state 41 * o hash table linkage 42 * o interface/ire information 43 * o credentials 44 * o ipsec policy 45 * o send and receive functions. 46 * o mutex lock. 47 * 48 * Connections use a reference counting scheme. They are freed when the 49 * reference counter drops to zero. A reference is incremented when connection 50 * is placed in a list or table, when incoming packet for the connection arrives 51 * and when connection is processed via squeue (squeue processing may be 52 * asynchronous and the reference protects the connection from being destroyed 53 * before its processing is finished). 54 * 55 * send and receive functions are currently used for TCP only. The send function 56 * determines the IP entry point for the packet once it leaves TCP to be sent to 57 * the destination address. The receive function is used by IP when the packet 58 * should be passed for TCP processing. When a new connection is created these 59 * are set to ip_output() and tcp_input() respectively. During the lifetime of 60 * the connection the send and receive functions may change depending on the 61 * changes in the connection state. For example, Once the connection is bound to 62 * an addresse, the receive function for this connection is set to 63 * tcp_conn_request(). This allows incoming SYNs to go directly into the 64 * listener SYN processing function without going to tcp_input() first. 65 * 66 * Classifier uses several hash tables: 67 * 68 * ipcl_conn_fanout: contains all TCP connections in CONNECTED state 69 * ipcl_bind_fanout: contains all connections in BOUND state 70 * ipcl_proto_fanout: IPv4 protocol fanout 71 * ipcl_proto_fanout_v6: IPv6 protocol fanout 72 * ipcl_udp_fanout: contains all UDP connections 73 * ipcl_globalhash_fanout: contains all connections 74 * 75 * The ipcl_globalhash_fanout is used for any walkers (like snmp and Clustering) 76 * which need to view all existing connections. 77 * 78 * All tables are protected by per-bucket locks. When both per-bucket lock and 79 * connection lock need to be held, the per-bucket lock should be acquired 80 * first, followed by the connection lock. 81 * 82 * All functions doing search in one of these tables increment a reference 83 * counter on the connection found (if any). This reference should be dropped 84 * when the caller has finished processing the connection. 85 * 86 * 87 * INTERFACES: 88 * =========== 89 * 90 * Connection Lookup: 91 * ------------------ 92 * 93 * conn_t *ipcl_classify_v4(mp, protocol, hdr_len, zoneid, ip_stack) 94 * conn_t *ipcl_classify_v6(mp, protocol, hdr_len, zoneid, ip_stack) 95 * 96 * Finds connection for an incoming IPv4 or IPv6 packet. Returns NULL if 97 * it can't find any associated connection. If the connection is found, its 98 * reference counter is incremented. 99 * 100 * mp: mblock, containing packet header. The full header should fit 101 * into a single mblock. It should also contain at least full IP 102 * and TCP or UDP header. 103 * 104 * protocol: Either IPPROTO_TCP or IPPROTO_UDP. 105 * 106 * hdr_len: The size of IP header. It is used to find TCP or UDP header in 107 * the packet. 108 * 109 * zoneid: The zone in which the returned connection must be; the zoneid 110 * corresponding to the ire_zoneid on the IRE located for the 111 * packet's destination address. 112 * 113 * For TCP connections, the lookup order is as follows: 114 * 5-tuple {src, dst, protocol, local port, remote port} 115 * lookup in ipcl_conn_fanout table. 116 * 3-tuple {dst, remote port, protocol} lookup in 117 * ipcl_bind_fanout table. 118 * 119 * For UDP connections, a 5-tuple {src, dst, protocol, local port, 120 * remote port} lookup is done on ipcl_udp_fanout. Note that, 121 * these interfaces do not handle cases where a packets belongs 122 * to multiple UDP clients, which is handled in IP itself. 123 * 124 * If the destination IRE is ALL_ZONES (indicated by zoneid), then we must 125 * determine which actual zone gets the segment. This is used only in a 126 * labeled environment. The matching rules are: 127 * 128 * - If it's not a multilevel port, then the label on the packet selects 129 * the zone. Unlabeled packets are delivered to the global zone. 130 * 131 * - If it's a multilevel port, then only the zone registered to receive 132 * packets on that port matches. 133 * 134 * Also, in a labeled environment, packet labels need to be checked. For fully 135 * bound TCP connections, we can assume that the packet label was checked 136 * during connection establishment, and doesn't need to be checked on each 137 * packet. For others, though, we need to check for strict equality or, for 138 * multilevel ports, membership in the range or set. This part currently does 139 * a tnrh lookup on each packet, but could be optimized to use cached results 140 * if that were necessary. (SCTP doesn't come through here, but if it did, 141 * we would apply the same rules as TCP.) 142 * 143 * An implication of the above is that fully-bound TCP sockets must always use 144 * distinct 4-tuples; they can't be discriminated by label alone. 145 * 146 * Note that we cannot trust labels on packets sent to fully-bound UDP sockets, 147 * as there's no connection set-up handshake and no shared state. 148 * 149 * Labels on looped-back packets within a single zone do not need to be 150 * checked, as all processes in the same zone have the same label. 151 * 152 * Finally, for unlabeled packets received by a labeled system, special rules 153 * apply. We consider only the MLP if there is one. Otherwise, we prefer a 154 * socket in the zone whose label matches the default label of the sender, if 155 * any. In any event, the receiving socket must have SO_MAC_EXEMPT set and the 156 * receiver's label must dominate the sender's default label. 157 * 158 * conn_t *ipcl_tcp_lookup_reversed_ipv4(ipha_t *, tcph_t *, int, ip_stack); 159 * conn_t *ipcl_tcp_lookup_reversed_ipv6(ip6_t *, tcpha_t *, int, uint_t, 160 * ip_stack); 161 * 162 * Lookup routine to find a exact match for {src, dst, local port, 163 * remote port) for TCP connections in ipcl_conn_fanout. The address and 164 * ports are read from the IP and TCP header respectively. 165 * 166 * conn_t *ipcl_lookup_listener_v4(lport, laddr, protocol, 167 * zoneid, ip_stack); 168 * conn_t *ipcl_lookup_listener_v6(lport, laddr, protocol, ifindex, 169 * zoneid, ip_stack); 170 * 171 * Lookup routine to find a listener with the tuple {lport, laddr, 172 * protocol} in the ipcl_bind_fanout table. For IPv6, an additional 173 * parameter interface index is also compared. 174 * 175 * void ipcl_walk(func, arg, ip_stack) 176 * 177 * Apply 'func' to every connection available. The 'func' is called as 178 * (*func)(connp, arg). The walk is non-atomic so connections may be 179 * created and destroyed during the walk. The CONN_CONDEMNED and 180 * CONN_INCIPIENT flags ensure that connections which are newly created 181 * or being destroyed are not selected by the walker. 182 * 183 * Table Updates 184 * ------------- 185 * 186 * int ipcl_conn_insert(connp, protocol, src, dst, ports) 187 * int ipcl_conn_insert_v6(connp, protocol, src, dst, ports, ifindex) 188 * 189 * Insert 'connp' in the ipcl_conn_fanout. 190 * Arguements : 191 * connp conn_t to be inserted 192 * protocol connection protocol 193 * src source address 194 * dst destination address 195 * ports local and remote port 196 * ifindex interface index for IPv6 connections 197 * 198 * Return value : 199 * 0 if connp was inserted 200 * EADDRINUSE if the connection with the same tuple 201 * already exists. 202 * 203 * int ipcl_bind_insert(connp, protocol, src, lport); 204 * int ipcl_bind_insert_v6(connp, protocol, src, lport); 205 * 206 * Insert 'connp' in ipcl_bind_fanout. 207 * Arguements : 208 * connp conn_t to be inserted 209 * protocol connection protocol 210 * src source address connection wants 211 * to bind to 212 * lport local port connection wants to 213 * bind to 214 * 215 * 216 * void ipcl_hash_remove(connp); 217 * 218 * Removes the 'connp' from the connection fanout table. 219 * 220 * Connection Creation/Destruction 221 * ------------------------------- 222 * 223 * conn_t *ipcl_conn_create(type, sleep, netstack_t *) 224 * 225 * Creates a new conn based on the type flag, inserts it into 226 * globalhash table. 227 * 228 * type: This flag determines the type of conn_t which needs to be 229 * created i.e., which kmem_cache it comes from. 230 * IPCL_TCPCONN indicates a TCP connection 231 * IPCL_SCTPCONN indicates a SCTP connection 232 * IPCL_UDPCONN indicates a UDP conn_t. 233 * IPCL_RAWIPCONN indicates a RAWIP/ICMP conn_t. 234 * IPCL_RTSCONN indicates a RTS conn_t. 235 * IPCL_IPCCONN indicates all other connections. 236 * 237 * void ipcl_conn_destroy(connp) 238 * 239 * Destroys the connection state, removes it from the global 240 * connection hash table and frees its memory. 241 */ 242 243 #include <sys/types.h> 244 #include <sys/stream.h> 245 #include <sys/stropts.h> 246 #include <sys/sysmacros.h> 247 #include <sys/strsubr.h> 248 #include <sys/strsun.h> 249 #define _SUN_TPI_VERSION 2 250 #include <sys/ddi.h> 251 #include <sys/cmn_err.h> 252 #include <sys/debug.h> 253 254 #include <sys/systm.h> 255 #include <sys/param.h> 256 #include <sys/kmem.h> 257 #include <sys/isa_defs.h> 258 #include <inet/common.h> 259 #include <netinet/ip6.h> 260 #include <netinet/icmp6.h> 261 262 #include <inet/ip.h> 263 #include <inet/ip6.h> 264 #include <inet/tcp.h> 265 #include <inet/ip_ndp.h> 266 #include <inet/udp_impl.h> 267 #include <inet/sctp_ip.h> 268 #include <inet/sctp/sctp_impl.h> 269 #include <inet/rawip_impl.h> 270 #include <inet/rts_impl.h> 271 272 #include <sys/cpuvar.h> 273 274 #include <inet/ipclassifier.h> 275 #include <inet/ipsec_impl.h> 276 277 #include <sys/tsol/tnet.h> 278 279 #ifdef DEBUG 280 #define IPCL_DEBUG 281 #else 282 #undef IPCL_DEBUG 283 #endif 284 285 #ifdef IPCL_DEBUG 286 int ipcl_debug_level = 0; 287 #define IPCL_DEBUG_LVL(level, args) \ 288 if (ipcl_debug_level & level) { printf args; } 289 #else 290 #define IPCL_DEBUG_LVL(level, args) {; } 291 #endif 292 /* Old value for compatibility. Setable in /etc/system */ 293 uint_t tcp_conn_hash_size = 0; 294 295 /* New value. Zero means choose automatically. Setable in /etc/system */ 296 uint_t ipcl_conn_hash_size = 0; 297 uint_t ipcl_conn_hash_memfactor = 8192; 298 uint_t ipcl_conn_hash_maxsize = 82500; 299 300 /* bind/udp fanout table size */ 301 uint_t ipcl_bind_fanout_size = 512; 302 uint_t ipcl_udp_fanout_size = 16384; 303 304 /* Raw socket fanout size. Must be a power of 2. */ 305 uint_t ipcl_raw_fanout_size = 256; 306 307 /* 308 * Power of 2^N Primes useful for hashing for N of 0-28, 309 * these primes are the nearest prime <= 2^N - 2^(N-2). 310 */ 311 312 #define P2Ps() {0, 0, 0, 5, 11, 23, 47, 89, 191, 383, 761, 1531, 3067, \ 313 6143, 12281, 24571, 49139, 98299, 196597, 393209, \ 314 786431, 1572853, 3145721, 6291449, 12582893, 25165813, \ 315 50331599, 100663291, 201326557, 0} 316 317 /* 318 * wrapper structure to ensure that conn and what follows it (tcp_t, etc) 319 * are aligned on cache lines. 320 */ 321 typedef union itc_s { 322 conn_t itc_conn; 323 char itcu_filler[CACHE_ALIGN(conn_s)]; 324 } itc_t; 325 326 struct kmem_cache *tcp_conn_cache; 327 struct kmem_cache *ip_conn_cache; 328 extern struct kmem_cache *sctp_conn_cache; 329 extern struct kmem_cache *tcp_sack_info_cache; 330 extern struct kmem_cache *tcp_iphc_cache; 331 struct kmem_cache *udp_conn_cache; 332 struct kmem_cache *rawip_conn_cache; 333 struct kmem_cache *rts_conn_cache; 334 335 extern void tcp_timermp_free(tcp_t *); 336 extern mblk_t *tcp_timermp_alloc(int); 337 338 static int ip_conn_constructor(void *, void *, int); 339 static void ip_conn_destructor(void *, void *); 340 341 static int tcp_conn_constructor(void *, void *, int); 342 static void tcp_conn_destructor(void *, void *); 343 344 static int udp_conn_constructor(void *, void *, int); 345 static void udp_conn_destructor(void *, void *); 346 347 static int rawip_conn_constructor(void *, void *, int); 348 static void rawip_conn_destructor(void *, void *); 349 350 static int rts_conn_constructor(void *, void *, int); 351 static void rts_conn_destructor(void *, void *); 352 353 #ifdef IPCL_DEBUG 354 #define INET_NTOA_BUFSIZE 18 355 356 static char * 357 inet_ntoa_r(uint32_t in, char *b) 358 { 359 unsigned char *p; 360 361 p = (unsigned char *)∈ 362 (void) sprintf(b, "%d.%d.%d.%d", p[0], p[1], p[2], p[3]); 363 return (b); 364 } 365 #endif 366 367 /* 368 * Global (for all stack instances) init routine 369 */ 370 void 371 ipcl_g_init(void) 372 { 373 ip_conn_cache = kmem_cache_create("ip_conn_cache", 374 sizeof (conn_t), CACHE_ALIGN_SIZE, 375 ip_conn_constructor, ip_conn_destructor, 376 NULL, NULL, NULL, 0); 377 378 tcp_conn_cache = kmem_cache_create("tcp_conn_cache", 379 sizeof (itc_t) + sizeof (tcp_t), CACHE_ALIGN_SIZE, 380 tcp_conn_constructor, tcp_conn_destructor, 381 NULL, NULL, NULL, 0); 382 383 udp_conn_cache = kmem_cache_create("udp_conn_cache", 384 sizeof (itc_t) + sizeof (udp_t), CACHE_ALIGN_SIZE, 385 udp_conn_constructor, udp_conn_destructor, 386 NULL, NULL, NULL, 0); 387 388 rawip_conn_cache = kmem_cache_create("rawip_conn_cache", 389 sizeof (itc_t) + sizeof (icmp_t), CACHE_ALIGN_SIZE, 390 rawip_conn_constructor, rawip_conn_destructor, 391 NULL, NULL, NULL, 0); 392 393 rts_conn_cache = kmem_cache_create("rts_conn_cache", 394 sizeof (itc_t) + sizeof (rts_t), CACHE_ALIGN_SIZE, 395 rts_conn_constructor, rts_conn_destructor, 396 NULL, NULL, NULL, 0); 397 } 398 399 /* 400 * ipclassifier intialization routine, sets up hash tables. 401 */ 402 void 403 ipcl_init(ip_stack_t *ipst) 404 { 405 int i; 406 int sizes[] = P2Ps(); 407 408 /* 409 * Calculate size of conn fanout table from /etc/system settings 410 */ 411 if (ipcl_conn_hash_size != 0) { 412 ipst->ips_ipcl_conn_fanout_size = ipcl_conn_hash_size; 413 } else if (tcp_conn_hash_size != 0) { 414 ipst->ips_ipcl_conn_fanout_size = tcp_conn_hash_size; 415 } else { 416 extern pgcnt_t freemem; 417 418 ipst->ips_ipcl_conn_fanout_size = 419 (freemem * PAGESIZE) / ipcl_conn_hash_memfactor; 420 421 if (ipst->ips_ipcl_conn_fanout_size > ipcl_conn_hash_maxsize) { 422 ipst->ips_ipcl_conn_fanout_size = 423 ipcl_conn_hash_maxsize; 424 } 425 } 426 427 for (i = 9; i < sizeof (sizes) / sizeof (*sizes) - 1; i++) { 428 if (sizes[i] >= ipst->ips_ipcl_conn_fanout_size) { 429 break; 430 } 431 } 432 if ((ipst->ips_ipcl_conn_fanout_size = sizes[i]) == 0) { 433 /* Out of range, use the 2^16 value */ 434 ipst->ips_ipcl_conn_fanout_size = sizes[16]; 435 } 436 437 /* Take values from /etc/system */ 438 ipst->ips_ipcl_bind_fanout_size = ipcl_bind_fanout_size; 439 ipst->ips_ipcl_udp_fanout_size = ipcl_udp_fanout_size; 440 ipst->ips_ipcl_raw_fanout_size = ipcl_raw_fanout_size; 441 442 ASSERT(ipst->ips_ipcl_conn_fanout == NULL); 443 444 ipst->ips_ipcl_conn_fanout = kmem_zalloc( 445 ipst->ips_ipcl_conn_fanout_size * sizeof (connf_t), KM_SLEEP); 446 447 for (i = 0; i < ipst->ips_ipcl_conn_fanout_size; i++) { 448 mutex_init(&ipst->ips_ipcl_conn_fanout[i].connf_lock, NULL, 449 MUTEX_DEFAULT, NULL); 450 } 451 452 ipst->ips_ipcl_bind_fanout = kmem_zalloc( 453 ipst->ips_ipcl_bind_fanout_size * sizeof (connf_t), KM_SLEEP); 454 455 for (i = 0; i < ipst->ips_ipcl_bind_fanout_size; i++) { 456 mutex_init(&ipst->ips_ipcl_bind_fanout[i].connf_lock, NULL, 457 MUTEX_DEFAULT, NULL); 458 } 459 460 ipst->ips_ipcl_proto_fanout = kmem_zalloc(IPPROTO_MAX * 461 sizeof (connf_t), KM_SLEEP); 462 for (i = 0; i < IPPROTO_MAX; i++) { 463 mutex_init(&ipst->ips_ipcl_proto_fanout[i].connf_lock, NULL, 464 MUTEX_DEFAULT, NULL); 465 } 466 467 ipst->ips_ipcl_proto_fanout_v6 = kmem_zalloc(IPPROTO_MAX * 468 sizeof (connf_t), KM_SLEEP); 469 for (i = 0; i < IPPROTO_MAX; i++) { 470 mutex_init(&ipst->ips_ipcl_proto_fanout_v6[i].connf_lock, NULL, 471 MUTEX_DEFAULT, NULL); 472 } 473 474 ipst->ips_rts_clients = kmem_zalloc(sizeof (connf_t), KM_SLEEP); 475 mutex_init(&ipst->ips_rts_clients->connf_lock, 476 NULL, MUTEX_DEFAULT, NULL); 477 478 ipst->ips_ipcl_udp_fanout = kmem_zalloc( 479 ipst->ips_ipcl_udp_fanout_size * sizeof (connf_t), KM_SLEEP); 480 for (i = 0; i < ipst->ips_ipcl_udp_fanout_size; i++) { 481 mutex_init(&ipst->ips_ipcl_udp_fanout[i].connf_lock, NULL, 482 MUTEX_DEFAULT, NULL); 483 } 484 485 ipst->ips_ipcl_raw_fanout = kmem_zalloc( 486 ipst->ips_ipcl_raw_fanout_size * sizeof (connf_t), KM_SLEEP); 487 for (i = 0; i < ipst->ips_ipcl_raw_fanout_size; i++) { 488 mutex_init(&ipst->ips_ipcl_raw_fanout[i].connf_lock, NULL, 489 MUTEX_DEFAULT, NULL); 490 } 491 492 ipst->ips_ipcl_globalhash_fanout = kmem_zalloc( 493 sizeof (connf_t) * CONN_G_HASH_SIZE, KM_SLEEP); 494 for (i = 0; i < CONN_G_HASH_SIZE; i++) { 495 mutex_init(&ipst->ips_ipcl_globalhash_fanout[i].connf_lock, 496 NULL, MUTEX_DEFAULT, NULL); 497 } 498 } 499 500 void 501 ipcl_g_destroy(void) 502 { 503 kmem_cache_destroy(ip_conn_cache); 504 kmem_cache_destroy(tcp_conn_cache); 505 kmem_cache_destroy(udp_conn_cache); 506 kmem_cache_destroy(rawip_conn_cache); 507 kmem_cache_destroy(rts_conn_cache); 508 } 509 510 /* 511 * All user-level and kernel use of the stack must be gone 512 * by now. 513 */ 514 void 515 ipcl_destroy(ip_stack_t *ipst) 516 { 517 int i; 518 519 for (i = 0; i < ipst->ips_ipcl_conn_fanout_size; i++) { 520 ASSERT(ipst->ips_ipcl_conn_fanout[i].connf_head == NULL); 521 mutex_destroy(&ipst->ips_ipcl_conn_fanout[i].connf_lock); 522 } 523 kmem_free(ipst->ips_ipcl_conn_fanout, ipst->ips_ipcl_conn_fanout_size * 524 sizeof (connf_t)); 525 ipst->ips_ipcl_conn_fanout = NULL; 526 527 for (i = 0; i < ipst->ips_ipcl_bind_fanout_size; i++) { 528 ASSERT(ipst->ips_ipcl_bind_fanout[i].connf_head == NULL); 529 mutex_destroy(&ipst->ips_ipcl_bind_fanout[i].connf_lock); 530 } 531 kmem_free(ipst->ips_ipcl_bind_fanout, ipst->ips_ipcl_bind_fanout_size * 532 sizeof (connf_t)); 533 ipst->ips_ipcl_bind_fanout = NULL; 534 535 for (i = 0; i < IPPROTO_MAX; i++) { 536 ASSERT(ipst->ips_ipcl_proto_fanout[i].connf_head == NULL); 537 mutex_destroy(&ipst->ips_ipcl_proto_fanout[i].connf_lock); 538 } 539 kmem_free(ipst->ips_ipcl_proto_fanout, IPPROTO_MAX * sizeof (connf_t)); 540 ipst->ips_ipcl_proto_fanout = NULL; 541 542 for (i = 0; i < IPPROTO_MAX; i++) { 543 ASSERT(ipst->ips_ipcl_proto_fanout_v6[i].connf_head == NULL); 544 mutex_destroy(&ipst->ips_ipcl_proto_fanout_v6[i].connf_lock); 545 } 546 kmem_free(ipst->ips_ipcl_proto_fanout_v6, 547 IPPROTO_MAX * sizeof (connf_t)); 548 ipst->ips_ipcl_proto_fanout_v6 = NULL; 549 550 for (i = 0; i < ipst->ips_ipcl_udp_fanout_size; i++) { 551 ASSERT(ipst->ips_ipcl_udp_fanout[i].connf_head == NULL); 552 mutex_destroy(&ipst->ips_ipcl_udp_fanout[i].connf_lock); 553 } 554 kmem_free(ipst->ips_ipcl_udp_fanout, ipst->ips_ipcl_udp_fanout_size * 555 sizeof (connf_t)); 556 ipst->ips_ipcl_udp_fanout = NULL; 557 558 for (i = 0; i < ipst->ips_ipcl_raw_fanout_size; i++) { 559 ASSERT(ipst->ips_ipcl_raw_fanout[i].connf_head == NULL); 560 mutex_destroy(&ipst->ips_ipcl_raw_fanout[i].connf_lock); 561 } 562 kmem_free(ipst->ips_ipcl_raw_fanout, ipst->ips_ipcl_raw_fanout_size * 563 sizeof (connf_t)); 564 ipst->ips_ipcl_raw_fanout = NULL; 565 566 for (i = 0; i < CONN_G_HASH_SIZE; i++) { 567 ASSERT(ipst->ips_ipcl_globalhash_fanout[i].connf_head == NULL); 568 mutex_destroy(&ipst->ips_ipcl_globalhash_fanout[i].connf_lock); 569 } 570 kmem_free(ipst->ips_ipcl_globalhash_fanout, 571 sizeof (connf_t) * CONN_G_HASH_SIZE); 572 ipst->ips_ipcl_globalhash_fanout = NULL; 573 574 ASSERT(ipst->ips_rts_clients->connf_head == NULL); 575 mutex_destroy(&ipst->ips_rts_clients->connf_lock); 576 kmem_free(ipst->ips_rts_clients, sizeof (connf_t)); 577 ipst->ips_rts_clients = NULL; 578 } 579 580 /* 581 * conn creation routine. initialize the conn, sets the reference 582 * and inserts it in the global hash table. 583 */ 584 conn_t * 585 ipcl_conn_create(uint32_t type, int sleep, netstack_t *ns) 586 { 587 conn_t *connp; 588 sctp_stack_t *sctps; 589 struct kmem_cache *conn_cache; 590 591 switch (type) { 592 case IPCL_SCTPCONN: 593 if ((connp = kmem_cache_alloc(sctp_conn_cache, sleep)) == NULL) 594 return (NULL); 595 sctp_conn_init(connp); 596 sctps = ns->netstack_sctp; 597 SCTP_G_Q_REFHOLD(sctps); 598 netstack_hold(ns); 599 connp->conn_netstack = ns; 600 return (connp); 601 602 case IPCL_TCPCONN: 603 conn_cache = tcp_conn_cache; 604 break; 605 606 case IPCL_UDPCONN: 607 conn_cache = udp_conn_cache; 608 break; 609 610 case IPCL_RAWIPCONN: 611 conn_cache = rawip_conn_cache; 612 break; 613 614 case IPCL_RTSCONN: 615 conn_cache = rts_conn_cache; 616 break; 617 618 case IPCL_IPCCONN: 619 conn_cache = ip_conn_cache; 620 break; 621 622 default: 623 connp = NULL; 624 ASSERT(0); 625 } 626 627 if ((connp = kmem_cache_alloc(conn_cache, sleep)) == NULL) 628 return (NULL); 629 630 connp->conn_ref = 1; 631 netstack_hold(ns); 632 connp->conn_netstack = ns; 633 ipcl_globalhash_insert(connp); 634 return (connp); 635 } 636 637 void 638 ipcl_conn_destroy(conn_t *connp) 639 { 640 mblk_t *mp; 641 netstack_t *ns = connp->conn_netstack; 642 643 ASSERT(!MUTEX_HELD(&connp->conn_lock)); 644 ASSERT(connp->conn_ref == 0); 645 ASSERT(connp->conn_ire_cache == NULL); 646 647 DTRACE_PROBE1(conn__destroy, conn_t *, connp); 648 649 if (connp->conn_peercred != NULL && 650 connp->conn_peercred != connp->conn_cred) 651 crfree(connp->conn_peercred); 652 connp->conn_peercred = NULL; 653 654 if (connp->conn_cred != NULL) { 655 crfree(connp->conn_cred); 656 connp->conn_cred = NULL; 657 } 658 659 ipcl_globalhash_remove(connp); 660 661 /* FIXME: add separate tcp_conn_free()? */ 662 if (connp->conn_flags & IPCL_TCPCONN) { 663 tcp_t *tcp = connp->conn_tcp; 664 tcp_stack_t *tcps; 665 666 ASSERT(tcp != NULL); 667 tcps = tcp->tcp_tcps; 668 if (tcps != NULL) { 669 if (connp->conn_latch != NULL) { 670 IPLATCH_REFRELE(connp->conn_latch, ns); 671 connp->conn_latch = NULL; 672 } 673 if (connp->conn_policy != NULL) { 674 IPPH_REFRELE(connp->conn_policy, ns); 675 connp->conn_policy = NULL; 676 } 677 tcp->tcp_tcps = NULL; 678 TCPS_REFRELE(tcps); 679 } 680 681 tcp_free(tcp); 682 mp = tcp->tcp_timercache; 683 tcp->tcp_cred = NULL; 684 685 if (tcp->tcp_sack_info != NULL) { 686 bzero(tcp->tcp_sack_info, sizeof (tcp_sack_info_t)); 687 kmem_cache_free(tcp_sack_info_cache, 688 tcp->tcp_sack_info); 689 } 690 if (tcp->tcp_iphc != NULL) { 691 if (tcp->tcp_hdr_grown) { 692 kmem_free(tcp->tcp_iphc, tcp->tcp_iphc_len); 693 } else { 694 bzero(tcp->tcp_iphc, tcp->tcp_iphc_len); 695 kmem_cache_free(tcp_iphc_cache, tcp->tcp_iphc); 696 } 697 tcp->tcp_iphc_len = 0; 698 } 699 ASSERT(tcp->tcp_iphc_len == 0); 700 701 /* 702 * tcp_rsrv_mp can be NULL if tcp_get_conn() fails to allocate 703 * the mblk. 704 */ 705 if (tcp->tcp_rsrv_mp != NULL) { 706 freeb(tcp->tcp_rsrv_mp); 707 tcp->tcp_rsrv_mp = NULL; 708 mutex_destroy(&tcp->tcp_rsrv_mp_lock); 709 } 710 711 ASSERT(connp->conn_latch == NULL); 712 ASSERT(connp->conn_policy == NULL); 713 714 if (ns != NULL) { 715 ASSERT(tcp->tcp_tcps == NULL); 716 connp->conn_netstack = NULL; 717 netstack_rele(ns); 718 } 719 720 ipcl_conn_cleanup(connp); 721 connp->conn_flags = IPCL_TCPCONN; 722 bzero(tcp, sizeof (tcp_t)); 723 724 tcp->tcp_timercache = mp; 725 tcp->tcp_connp = connp; 726 kmem_cache_free(tcp_conn_cache, connp); 727 return; 728 } 729 if (connp->conn_latch != NULL) { 730 IPLATCH_REFRELE(connp->conn_latch, connp->conn_netstack); 731 connp->conn_latch = NULL; 732 } 733 if (connp->conn_policy != NULL) { 734 IPPH_REFRELE(connp->conn_policy, connp->conn_netstack); 735 connp->conn_policy = NULL; 736 } 737 if (connp->conn_ipsec_opt_mp != NULL) { 738 freemsg(connp->conn_ipsec_opt_mp); 739 connp->conn_ipsec_opt_mp = NULL; 740 } 741 742 if (connp->conn_flags & IPCL_SCTPCONN) { 743 ASSERT(ns != NULL); 744 sctp_free(connp); 745 return; 746 } 747 748 if (ns != NULL) { 749 connp->conn_netstack = NULL; 750 netstack_rele(ns); 751 } 752 ipcl_conn_cleanup(connp); 753 754 /* leave conn_priv aka conn_udp, conn_icmp, etc in place. */ 755 if (connp->conn_flags & IPCL_UDPCONN) { 756 connp->conn_flags = IPCL_UDPCONN; 757 kmem_cache_free(udp_conn_cache, connp); 758 } else if (connp->conn_flags & IPCL_RAWIPCONN) { 759 connp->conn_flags = IPCL_RAWIPCONN; 760 connp->conn_ulp = IPPROTO_ICMP; 761 kmem_cache_free(rawip_conn_cache, connp); 762 } else if (connp->conn_flags & IPCL_RTSCONN) { 763 connp->conn_flags = IPCL_RTSCONN; 764 kmem_cache_free(rts_conn_cache, connp); 765 } else { 766 connp->conn_flags = IPCL_IPCCONN; 767 ASSERT(connp->conn_flags & IPCL_IPCCONN); 768 ASSERT(connp->conn_priv == NULL); 769 kmem_cache_free(ip_conn_cache, connp); 770 } 771 } 772 773 /* 774 * Running in cluster mode - deregister listener information 775 */ 776 777 static void 778 ipcl_conn_unlisten(conn_t *connp) 779 { 780 ASSERT((connp->conn_flags & IPCL_CL_LISTENER) != 0); 781 ASSERT(connp->conn_lport != 0); 782 783 if (cl_inet_unlisten != NULL) { 784 sa_family_t addr_family; 785 uint8_t *laddrp; 786 787 if (connp->conn_pkt_isv6) { 788 addr_family = AF_INET6; 789 laddrp = (uint8_t *)&connp->conn_bound_source_v6; 790 } else { 791 addr_family = AF_INET; 792 laddrp = (uint8_t *)&connp->conn_bound_source; 793 } 794 (*cl_inet_unlisten)(IPPROTO_TCP, addr_family, laddrp, 795 connp->conn_lport); 796 } 797 connp->conn_flags &= ~IPCL_CL_LISTENER; 798 } 799 800 /* 801 * We set the IPCL_REMOVED flag (instead of clearing the flag indicating 802 * which table the conn belonged to). So for debugging we can see which hash 803 * table this connection was in. 804 */ 805 #define IPCL_HASH_REMOVE(connp) { \ 806 connf_t *connfp = (connp)->conn_fanout; \ 807 ASSERT(!MUTEX_HELD(&((connp)->conn_lock))); \ 808 if (connfp != NULL) { \ 809 IPCL_DEBUG_LVL(4, ("IPCL_HASH_REMOVE: connp %p", \ 810 (void *)(connp))); \ 811 mutex_enter(&connfp->connf_lock); \ 812 if ((connp)->conn_next != NULL) \ 813 (connp)->conn_next->conn_prev = \ 814 (connp)->conn_prev; \ 815 if ((connp)->conn_prev != NULL) \ 816 (connp)->conn_prev->conn_next = \ 817 (connp)->conn_next; \ 818 else \ 819 connfp->connf_head = (connp)->conn_next; \ 820 (connp)->conn_fanout = NULL; \ 821 (connp)->conn_next = NULL; \ 822 (connp)->conn_prev = NULL; \ 823 (connp)->conn_flags |= IPCL_REMOVED; \ 824 if (((connp)->conn_flags & IPCL_CL_LISTENER) != 0) \ 825 ipcl_conn_unlisten((connp)); \ 826 CONN_DEC_REF((connp)); \ 827 mutex_exit(&connfp->connf_lock); \ 828 } \ 829 } 830 831 void 832 ipcl_hash_remove(conn_t *connp) 833 { 834 IPCL_HASH_REMOVE(connp); 835 } 836 837 /* 838 * The whole purpose of this function is allow removal of 839 * a conn_t from the connected hash for timewait reclaim. 840 * This is essentially a TW reclaim fastpath where timewait 841 * collector checks under fanout lock (so no one else can 842 * get access to the conn_t) that refcnt is 2 i.e. one for 843 * TCP and one for the classifier hash list. If ref count 844 * is indeed 2, we can just remove the conn under lock and 845 * avoid cleaning up the conn under squeue. This gives us 846 * improved performance. 847 */ 848 void 849 ipcl_hash_remove_locked(conn_t *connp, connf_t *connfp) 850 { 851 ASSERT(MUTEX_HELD(&connfp->connf_lock)); 852 ASSERT(MUTEX_HELD(&connp->conn_lock)); 853 ASSERT((connp->conn_flags & IPCL_CL_LISTENER) == 0); 854 855 if ((connp)->conn_next != NULL) { 856 (connp)->conn_next->conn_prev = (connp)->conn_prev; 857 } 858 if ((connp)->conn_prev != NULL) { 859 (connp)->conn_prev->conn_next = (connp)->conn_next; 860 } else { 861 connfp->connf_head = (connp)->conn_next; 862 } 863 (connp)->conn_fanout = NULL; 864 (connp)->conn_next = NULL; 865 (connp)->conn_prev = NULL; 866 (connp)->conn_flags |= IPCL_REMOVED; 867 ASSERT((connp)->conn_ref == 2); 868 (connp)->conn_ref--; 869 } 870 871 #define IPCL_HASH_INSERT_CONNECTED_LOCKED(connfp, connp) { \ 872 ASSERT((connp)->conn_fanout == NULL); \ 873 ASSERT((connp)->conn_next == NULL); \ 874 ASSERT((connp)->conn_prev == NULL); \ 875 if ((connfp)->connf_head != NULL) { \ 876 (connfp)->connf_head->conn_prev = (connp); \ 877 (connp)->conn_next = (connfp)->connf_head; \ 878 } \ 879 (connp)->conn_fanout = (connfp); \ 880 (connfp)->connf_head = (connp); \ 881 (connp)->conn_flags = ((connp)->conn_flags & ~IPCL_REMOVED) | \ 882 IPCL_CONNECTED; \ 883 CONN_INC_REF(connp); \ 884 } 885 886 #define IPCL_HASH_INSERT_CONNECTED(connfp, connp) { \ 887 IPCL_DEBUG_LVL(8, ("IPCL_HASH_INSERT_CONNECTED: connfp %p " \ 888 "connp %p", (void *)(connfp), (void *)(connp))); \ 889 IPCL_HASH_REMOVE((connp)); \ 890 mutex_enter(&(connfp)->connf_lock); \ 891 IPCL_HASH_INSERT_CONNECTED_LOCKED(connfp, connp); \ 892 mutex_exit(&(connfp)->connf_lock); \ 893 } 894 895 #define IPCL_HASH_INSERT_BOUND(connfp, connp) { \ 896 conn_t *pconnp = NULL, *nconnp; \ 897 IPCL_DEBUG_LVL(32, ("IPCL_HASH_INSERT_BOUND: connfp %p " \ 898 "connp %p", (void *)connfp, (void *)(connp))); \ 899 IPCL_HASH_REMOVE((connp)); \ 900 mutex_enter(&(connfp)->connf_lock); \ 901 nconnp = (connfp)->connf_head; \ 902 while (nconnp != NULL && \ 903 !_IPCL_V4_MATCH_ANY(nconnp->conn_srcv6)) { \ 904 pconnp = nconnp; \ 905 nconnp = nconnp->conn_next; \ 906 } \ 907 if (pconnp != NULL) { \ 908 pconnp->conn_next = (connp); \ 909 (connp)->conn_prev = pconnp; \ 910 } else { \ 911 (connfp)->connf_head = (connp); \ 912 } \ 913 if (nconnp != NULL) { \ 914 (connp)->conn_next = nconnp; \ 915 nconnp->conn_prev = (connp); \ 916 } \ 917 (connp)->conn_fanout = (connfp); \ 918 (connp)->conn_flags = ((connp)->conn_flags & ~IPCL_REMOVED) | \ 919 IPCL_BOUND; \ 920 CONN_INC_REF(connp); \ 921 mutex_exit(&(connfp)->connf_lock); \ 922 } 923 924 #define IPCL_HASH_INSERT_WILDCARD(connfp, connp) { \ 925 conn_t **list, *prev, *next; \ 926 boolean_t isv4mapped = \ 927 IN6_IS_ADDR_V4MAPPED(&(connp)->conn_srcv6); \ 928 IPCL_DEBUG_LVL(32, ("IPCL_HASH_INSERT_WILDCARD: connfp %p " \ 929 "connp %p", (void *)(connfp), (void *)(connp))); \ 930 IPCL_HASH_REMOVE((connp)); \ 931 mutex_enter(&(connfp)->connf_lock); \ 932 list = &(connfp)->connf_head; \ 933 prev = NULL; \ 934 while ((next = *list) != NULL) { \ 935 if (isv4mapped && \ 936 IN6_IS_ADDR_UNSPECIFIED(&next->conn_srcv6) && \ 937 connp->conn_zoneid == next->conn_zoneid) { \ 938 (connp)->conn_next = next; \ 939 if (prev != NULL) \ 940 prev = next->conn_prev; \ 941 next->conn_prev = (connp); \ 942 break; \ 943 } \ 944 list = &next->conn_next; \ 945 prev = next; \ 946 } \ 947 (connp)->conn_prev = prev; \ 948 *list = (connp); \ 949 (connp)->conn_fanout = (connfp); \ 950 (connp)->conn_flags = ((connp)->conn_flags & ~IPCL_REMOVED) | \ 951 IPCL_BOUND; \ 952 CONN_INC_REF((connp)); \ 953 mutex_exit(&(connfp)->connf_lock); \ 954 } 955 956 void 957 ipcl_hash_insert_wildcard(connf_t *connfp, conn_t *connp) 958 { 959 IPCL_HASH_INSERT_WILDCARD(connfp, connp); 960 } 961 962 void 963 ipcl_proto_insert(conn_t *connp, uint8_t protocol) 964 { 965 connf_t *connfp; 966 ip_stack_t *ipst = connp->conn_netstack->netstack_ip; 967 968 ASSERT(connp != NULL); 969 ASSERT(!connp->conn_mac_exempt || protocol == IPPROTO_AH || 970 protocol == IPPROTO_ESP); 971 972 connp->conn_ulp = protocol; 973 974 /* Insert it in the protocol hash */ 975 connfp = &ipst->ips_ipcl_proto_fanout[protocol]; 976 IPCL_HASH_INSERT_WILDCARD(connfp, connp); 977 } 978 979 void 980 ipcl_proto_insert_v6(conn_t *connp, uint8_t protocol) 981 { 982 connf_t *connfp; 983 ip_stack_t *ipst = connp->conn_netstack->netstack_ip; 984 985 ASSERT(connp != NULL); 986 ASSERT(!connp->conn_mac_exempt || protocol == IPPROTO_AH || 987 protocol == IPPROTO_ESP); 988 989 connp->conn_ulp = protocol; 990 991 /* Insert it in the Bind Hash */ 992 connfp = &ipst->ips_ipcl_proto_fanout_v6[protocol]; 993 IPCL_HASH_INSERT_WILDCARD(connfp, connp); 994 } 995 996 /* 997 * This function is used only for inserting SCTP raw socket now. 998 * This may change later. 999 * 1000 * Note that only one raw socket can be bound to a port. The param 1001 * lport is in network byte order. 1002 */ 1003 static int 1004 ipcl_sctp_hash_insert(conn_t *connp, in_port_t lport) 1005 { 1006 connf_t *connfp; 1007 conn_t *oconnp; 1008 ip_stack_t *ipst = connp->conn_netstack->netstack_ip; 1009 1010 connfp = &ipst->ips_ipcl_raw_fanout[IPCL_RAW_HASH(ntohs(lport), ipst)]; 1011 1012 /* Check for existing raw socket already bound to the port. */ 1013 mutex_enter(&connfp->connf_lock); 1014 for (oconnp = connfp->connf_head; oconnp != NULL; 1015 oconnp = oconnp->conn_next) { 1016 if (oconnp->conn_lport == lport && 1017 oconnp->conn_zoneid == connp->conn_zoneid && 1018 oconnp->conn_af_isv6 == connp->conn_af_isv6 && 1019 ((IN6_IS_ADDR_UNSPECIFIED(&connp->conn_srcv6) || 1020 IN6_IS_ADDR_UNSPECIFIED(&oconnp->conn_srcv6) || 1021 IN6_IS_ADDR_V4MAPPED_ANY(&connp->conn_srcv6) || 1022 IN6_IS_ADDR_V4MAPPED_ANY(&oconnp->conn_srcv6)) || 1023 IN6_ARE_ADDR_EQUAL(&oconnp->conn_srcv6, 1024 &connp->conn_srcv6))) { 1025 break; 1026 } 1027 } 1028 mutex_exit(&connfp->connf_lock); 1029 if (oconnp != NULL) 1030 return (EADDRNOTAVAIL); 1031 1032 if (IN6_IS_ADDR_UNSPECIFIED(&connp->conn_remv6) || 1033 IN6_IS_ADDR_V4MAPPED_ANY(&connp->conn_remv6)) { 1034 if (IN6_IS_ADDR_UNSPECIFIED(&connp->conn_srcv6) || 1035 IN6_IS_ADDR_V4MAPPED_ANY(&connp->conn_srcv6)) { 1036 IPCL_HASH_INSERT_WILDCARD(connfp, connp); 1037 } else { 1038 IPCL_HASH_INSERT_BOUND(connfp, connp); 1039 } 1040 } else { 1041 IPCL_HASH_INSERT_CONNECTED(connfp, connp); 1042 } 1043 return (0); 1044 } 1045 1046 /* 1047 * Check for a MAC exemption conflict on a labeled system. Note that for 1048 * protocols that use port numbers (UDP, TCP, SCTP), we do this check up in the 1049 * transport layer. This check is for binding all other protocols. 1050 * 1051 * Returns true if there's a conflict. 1052 */ 1053 static boolean_t 1054 check_exempt_conflict_v4(conn_t *connp, ip_stack_t *ipst) 1055 { 1056 connf_t *connfp; 1057 conn_t *tconn; 1058 1059 connfp = &ipst->ips_ipcl_proto_fanout[connp->conn_ulp]; 1060 mutex_enter(&connfp->connf_lock); 1061 for (tconn = connfp->connf_head; tconn != NULL; 1062 tconn = tconn->conn_next) { 1063 /* We don't allow v4 fallback for v6 raw socket */ 1064 if (connp->conn_af_isv6 != tconn->conn_af_isv6) 1065 continue; 1066 /* If neither is exempt, then there's no conflict */ 1067 if (!connp->conn_mac_exempt && !tconn->conn_mac_exempt) 1068 continue; 1069 /* If both are bound to different specific addrs, ok */ 1070 if (connp->conn_src != INADDR_ANY && 1071 tconn->conn_src != INADDR_ANY && 1072 connp->conn_src != tconn->conn_src) 1073 continue; 1074 /* These two conflict; fail */ 1075 break; 1076 } 1077 mutex_exit(&connfp->connf_lock); 1078 return (tconn != NULL); 1079 } 1080 1081 static boolean_t 1082 check_exempt_conflict_v6(conn_t *connp, ip_stack_t *ipst) 1083 { 1084 connf_t *connfp; 1085 conn_t *tconn; 1086 1087 connfp = &ipst->ips_ipcl_proto_fanout[connp->conn_ulp]; 1088 mutex_enter(&connfp->connf_lock); 1089 for (tconn = connfp->connf_head; tconn != NULL; 1090 tconn = tconn->conn_next) { 1091 /* We don't allow v4 fallback for v6 raw socket */ 1092 if (connp->conn_af_isv6 != tconn->conn_af_isv6) 1093 continue; 1094 /* If neither is exempt, then there's no conflict */ 1095 if (!connp->conn_mac_exempt && !tconn->conn_mac_exempt) 1096 continue; 1097 /* If both are bound to different addrs, ok */ 1098 if (!IN6_IS_ADDR_UNSPECIFIED(&connp->conn_srcv6) && 1099 !IN6_IS_ADDR_UNSPECIFIED(&tconn->conn_srcv6) && 1100 !IN6_ARE_ADDR_EQUAL(&connp->conn_srcv6, &tconn->conn_srcv6)) 1101 continue; 1102 /* These two conflict; fail */ 1103 break; 1104 } 1105 mutex_exit(&connfp->connf_lock); 1106 return (tconn != NULL); 1107 } 1108 1109 /* 1110 * (v4, v6) bind hash insertion routines 1111 */ 1112 int 1113 ipcl_bind_insert(conn_t *connp, uint8_t protocol, ipaddr_t src, uint16_t lport) 1114 { 1115 connf_t *connfp; 1116 #ifdef IPCL_DEBUG 1117 char buf[INET_NTOA_BUFSIZE]; 1118 #endif 1119 int ret = 0; 1120 ip_stack_t *ipst = connp->conn_netstack->netstack_ip; 1121 1122 ASSERT(connp); 1123 1124 IPCL_DEBUG_LVL(64, ("ipcl_bind_insert: connp %p, src = %s, " 1125 "port = %d\n", (void *)connp, inet_ntoa_r(src, buf), lport)); 1126 1127 connp->conn_ulp = protocol; 1128 IN6_IPADDR_TO_V4MAPPED(src, &connp->conn_srcv6); 1129 connp->conn_lport = lport; 1130 1131 switch (protocol) { 1132 default: 1133 if (is_system_labeled() && 1134 check_exempt_conflict_v4(connp, ipst)) 1135 return (EADDRINUSE); 1136 /* FALLTHROUGH */ 1137 case IPPROTO_UDP: 1138 if (protocol == IPPROTO_UDP) { 1139 IPCL_DEBUG_LVL(64, 1140 ("ipcl_bind_insert: connp %p - udp\n", 1141 (void *)connp)); 1142 connfp = &ipst->ips_ipcl_udp_fanout[ 1143 IPCL_UDP_HASH(lport, ipst)]; 1144 } else { 1145 IPCL_DEBUG_LVL(64, 1146 ("ipcl_bind_insert: connp %p - protocol\n", 1147 (void *)connp)); 1148 connfp = &ipst->ips_ipcl_proto_fanout[protocol]; 1149 } 1150 1151 if (connp->conn_rem != INADDR_ANY) { 1152 IPCL_HASH_INSERT_CONNECTED(connfp, connp); 1153 } else if (connp->conn_src != INADDR_ANY) { 1154 IPCL_HASH_INSERT_BOUND(connfp, connp); 1155 } else { 1156 IPCL_HASH_INSERT_WILDCARD(connfp, connp); 1157 } 1158 break; 1159 1160 case IPPROTO_TCP: 1161 1162 /* Insert it in the Bind Hash */ 1163 ASSERT(connp->conn_zoneid != ALL_ZONES); 1164 connfp = &ipst->ips_ipcl_bind_fanout[ 1165 IPCL_BIND_HASH(lport, ipst)]; 1166 if (connp->conn_src != INADDR_ANY) { 1167 IPCL_HASH_INSERT_BOUND(connfp, connp); 1168 } else { 1169 IPCL_HASH_INSERT_WILDCARD(connfp, connp); 1170 } 1171 if (cl_inet_listen != NULL) { 1172 ASSERT(!connp->conn_pkt_isv6); 1173 connp->conn_flags |= IPCL_CL_LISTENER; 1174 (*cl_inet_listen)(IPPROTO_TCP, AF_INET, 1175 (uint8_t *)&connp->conn_bound_source, lport); 1176 } 1177 break; 1178 1179 case IPPROTO_SCTP: 1180 ret = ipcl_sctp_hash_insert(connp, lport); 1181 break; 1182 } 1183 1184 return (ret); 1185 } 1186 1187 int 1188 ipcl_bind_insert_v6(conn_t *connp, uint8_t protocol, const in6_addr_t *src, 1189 uint16_t lport) 1190 { 1191 connf_t *connfp; 1192 int ret = 0; 1193 ip_stack_t *ipst = connp->conn_netstack->netstack_ip; 1194 1195 ASSERT(connp); 1196 1197 connp->conn_ulp = protocol; 1198 connp->conn_srcv6 = *src; 1199 connp->conn_lport = lport; 1200 1201 switch (protocol) { 1202 default: 1203 if (is_system_labeled() && 1204 check_exempt_conflict_v6(connp, ipst)) 1205 return (EADDRINUSE); 1206 /* FALLTHROUGH */ 1207 case IPPROTO_UDP: 1208 if (protocol == IPPROTO_UDP) { 1209 IPCL_DEBUG_LVL(128, 1210 ("ipcl_bind_insert_v6: connp %p - udp\n", 1211 (void *)connp)); 1212 connfp = &ipst->ips_ipcl_udp_fanout[ 1213 IPCL_UDP_HASH(lport, ipst)]; 1214 } else { 1215 IPCL_DEBUG_LVL(128, 1216 ("ipcl_bind_insert_v6: connp %p - protocol\n", 1217 (void *)connp)); 1218 connfp = &ipst->ips_ipcl_proto_fanout_v6[protocol]; 1219 } 1220 1221 if (!IN6_IS_ADDR_UNSPECIFIED(&connp->conn_remv6)) { 1222 IPCL_HASH_INSERT_CONNECTED(connfp, connp); 1223 } else if (!IN6_IS_ADDR_UNSPECIFIED(&connp->conn_srcv6)) { 1224 IPCL_HASH_INSERT_BOUND(connfp, connp); 1225 } else { 1226 IPCL_HASH_INSERT_WILDCARD(connfp, connp); 1227 } 1228 break; 1229 1230 case IPPROTO_TCP: 1231 /* XXX - Need a separate table for IN6_IS_ADDR_UNSPECIFIED? */ 1232 1233 /* Insert it in the Bind Hash */ 1234 ASSERT(connp->conn_zoneid != ALL_ZONES); 1235 connfp = &ipst->ips_ipcl_bind_fanout[ 1236 IPCL_BIND_HASH(lport, ipst)]; 1237 if (!IN6_IS_ADDR_UNSPECIFIED(&connp->conn_srcv6)) { 1238 IPCL_HASH_INSERT_BOUND(connfp, connp); 1239 } else { 1240 IPCL_HASH_INSERT_WILDCARD(connfp, connp); 1241 } 1242 if (cl_inet_listen != NULL) { 1243 sa_family_t addr_family; 1244 uint8_t *laddrp; 1245 1246 if (connp->conn_pkt_isv6) { 1247 addr_family = AF_INET6; 1248 laddrp = 1249 (uint8_t *)&connp->conn_bound_source_v6; 1250 } else { 1251 addr_family = AF_INET; 1252 laddrp = (uint8_t *)&connp->conn_bound_source; 1253 } 1254 connp->conn_flags |= IPCL_CL_LISTENER; 1255 (*cl_inet_listen)(IPPROTO_TCP, addr_family, laddrp, 1256 lport); 1257 } 1258 break; 1259 1260 case IPPROTO_SCTP: 1261 ret = ipcl_sctp_hash_insert(connp, lport); 1262 break; 1263 } 1264 1265 return (ret); 1266 } 1267 1268 /* 1269 * ipcl_conn_hash insertion routines. 1270 */ 1271 int 1272 ipcl_conn_insert(conn_t *connp, uint8_t protocol, ipaddr_t src, 1273 ipaddr_t rem, uint32_t ports) 1274 { 1275 connf_t *connfp; 1276 uint16_t *up; 1277 conn_t *tconnp; 1278 #ifdef IPCL_DEBUG 1279 char sbuf[INET_NTOA_BUFSIZE], rbuf[INET_NTOA_BUFSIZE]; 1280 #endif 1281 in_port_t lport; 1282 int ret = 0; 1283 ip_stack_t *ipst = connp->conn_netstack->netstack_ip; 1284 1285 IPCL_DEBUG_LVL(256, ("ipcl_conn_insert: connp %p, src = %s, " 1286 "dst = %s, ports = %x, protocol = %x", (void *)connp, 1287 inet_ntoa_r(src, sbuf), inet_ntoa_r(rem, rbuf), 1288 ports, protocol)); 1289 1290 switch (protocol) { 1291 case IPPROTO_TCP: 1292 if (!(connp->conn_flags & IPCL_EAGER)) { 1293 /* 1294 * for a eager connection, i.e connections which 1295 * have just been created, the initialization is 1296 * already done in ip at conn_creation time, so 1297 * we can skip the checks here. 1298 */ 1299 IPCL_CONN_INIT(connp, protocol, src, rem, ports); 1300 } 1301 connfp = &ipst->ips_ipcl_conn_fanout[ 1302 IPCL_CONN_HASH(connp->conn_rem, 1303 connp->conn_ports, ipst)]; 1304 mutex_enter(&connfp->connf_lock); 1305 for (tconnp = connfp->connf_head; tconnp != NULL; 1306 tconnp = tconnp->conn_next) { 1307 if (IPCL_CONN_MATCH(tconnp, connp->conn_ulp, 1308 connp->conn_rem, connp->conn_src, 1309 connp->conn_ports)) { 1310 1311 /* Already have a conn. bail out */ 1312 mutex_exit(&connfp->connf_lock); 1313 return (EADDRINUSE); 1314 } 1315 } 1316 if (connp->conn_fanout != NULL) { 1317 /* 1318 * Probably a XTI/TLI application trying to do a 1319 * rebind. Let it happen. 1320 */ 1321 mutex_exit(&connfp->connf_lock); 1322 IPCL_HASH_REMOVE(connp); 1323 mutex_enter(&connfp->connf_lock); 1324 } 1325 1326 ASSERT(connp->conn_recv != NULL); 1327 1328 IPCL_HASH_INSERT_CONNECTED_LOCKED(connfp, connp); 1329 mutex_exit(&connfp->connf_lock); 1330 break; 1331 1332 case IPPROTO_SCTP: 1333 /* 1334 * The raw socket may have already been bound, remove it 1335 * from the hash first. 1336 */ 1337 IPCL_HASH_REMOVE(connp); 1338 lport = htons((uint16_t)(ntohl(ports) & 0xFFFF)); 1339 ret = ipcl_sctp_hash_insert(connp, lport); 1340 break; 1341 1342 default: 1343 /* 1344 * Check for conflicts among MAC exempt bindings. For 1345 * transports with port numbers, this is done by the upper 1346 * level per-transport binding logic. For all others, it's 1347 * done here. 1348 */ 1349 if (is_system_labeled() && 1350 check_exempt_conflict_v4(connp, ipst)) 1351 return (EADDRINUSE); 1352 /* FALLTHROUGH */ 1353 1354 case IPPROTO_UDP: 1355 up = (uint16_t *)&ports; 1356 IPCL_CONN_INIT(connp, protocol, src, rem, ports); 1357 if (protocol == IPPROTO_UDP) { 1358 connfp = &ipst->ips_ipcl_udp_fanout[ 1359 IPCL_UDP_HASH(up[1], ipst)]; 1360 } else { 1361 connfp = &ipst->ips_ipcl_proto_fanout[protocol]; 1362 } 1363 1364 if (connp->conn_rem != INADDR_ANY) { 1365 IPCL_HASH_INSERT_CONNECTED(connfp, connp); 1366 } else if (connp->conn_src != INADDR_ANY) { 1367 IPCL_HASH_INSERT_BOUND(connfp, connp); 1368 } else { 1369 IPCL_HASH_INSERT_WILDCARD(connfp, connp); 1370 } 1371 break; 1372 } 1373 1374 return (ret); 1375 } 1376 1377 int 1378 ipcl_conn_insert_v6(conn_t *connp, uint8_t protocol, const in6_addr_t *src, 1379 const in6_addr_t *rem, uint32_t ports, uint_t ifindex) 1380 { 1381 connf_t *connfp; 1382 uint16_t *up; 1383 conn_t *tconnp; 1384 in_port_t lport; 1385 int ret = 0; 1386 ip_stack_t *ipst = connp->conn_netstack->netstack_ip; 1387 1388 switch (protocol) { 1389 case IPPROTO_TCP: 1390 /* Just need to insert a conn struct */ 1391 if (!(connp->conn_flags & IPCL_EAGER)) { 1392 IPCL_CONN_INIT_V6(connp, protocol, *src, *rem, ports); 1393 } 1394 connfp = &ipst->ips_ipcl_conn_fanout[ 1395 IPCL_CONN_HASH_V6(connp->conn_remv6, connp->conn_ports, 1396 ipst)]; 1397 mutex_enter(&connfp->connf_lock); 1398 for (tconnp = connfp->connf_head; tconnp != NULL; 1399 tconnp = tconnp->conn_next) { 1400 if (IPCL_CONN_MATCH_V6(tconnp, connp->conn_ulp, 1401 connp->conn_remv6, connp->conn_srcv6, 1402 connp->conn_ports) && 1403 (tconnp->conn_tcp->tcp_bound_if == 0 || 1404 tconnp->conn_tcp->tcp_bound_if == ifindex)) { 1405 /* Already have a conn. bail out */ 1406 mutex_exit(&connfp->connf_lock); 1407 return (EADDRINUSE); 1408 } 1409 } 1410 if (connp->conn_fanout != NULL) { 1411 /* 1412 * Probably a XTI/TLI application trying to do a 1413 * rebind. Let it happen. 1414 */ 1415 mutex_exit(&connfp->connf_lock); 1416 IPCL_HASH_REMOVE(connp); 1417 mutex_enter(&connfp->connf_lock); 1418 } 1419 IPCL_HASH_INSERT_CONNECTED_LOCKED(connfp, connp); 1420 mutex_exit(&connfp->connf_lock); 1421 break; 1422 1423 case IPPROTO_SCTP: 1424 IPCL_HASH_REMOVE(connp); 1425 lport = htons((uint16_t)(ntohl(ports) & 0xFFFF)); 1426 ret = ipcl_sctp_hash_insert(connp, lport); 1427 break; 1428 1429 default: 1430 if (is_system_labeled() && 1431 check_exempt_conflict_v6(connp, ipst)) 1432 return (EADDRINUSE); 1433 /* FALLTHROUGH */ 1434 case IPPROTO_UDP: 1435 up = (uint16_t *)&ports; 1436 IPCL_CONN_INIT_V6(connp, protocol, *src, *rem, ports); 1437 if (protocol == IPPROTO_UDP) { 1438 connfp = &ipst->ips_ipcl_udp_fanout[ 1439 IPCL_UDP_HASH(up[1], ipst)]; 1440 } else { 1441 connfp = &ipst->ips_ipcl_proto_fanout_v6[protocol]; 1442 } 1443 1444 if (!IN6_IS_ADDR_UNSPECIFIED(&connp->conn_remv6)) { 1445 IPCL_HASH_INSERT_CONNECTED(connfp, connp); 1446 } else if (!IN6_IS_ADDR_UNSPECIFIED(&connp->conn_srcv6)) { 1447 IPCL_HASH_INSERT_BOUND(connfp, connp); 1448 } else { 1449 IPCL_HASH_INSERT_WILDCARD(connfp, connp); 1450 } 1451 break; 1452 } 1453 1454 return (ret); 1455 } 1456 1457 /* 1458 * v4 packet classifying function. looks up the fanout table to 1459 * find the conn, the packet belongs to. returns the conn with 1460 * the reference held, null otherwise. 1461 * 1462 * If zoneid is ALL_ZONES, then the search rules described in the "Connection 1463 * Lookup" comment block are applied. Labels are also checked as described 1464 * above. If the packet is from the inside (looped back), and is from the same 1465 * zone, then label checks are omitted. 1466 */ 1467 conn_t * 1468 ipcl_classify_v4(mblk_t *mp, uint8_t protocol, uint_t hdr_len, zoneid_t zoneid, 1469 ip_stack_t *ipst) 1470 { 1471 ipha_t *ipha; 1472 connf_t *connfp, *bind_connfp; 1473 uint16_t lport; 1474 uint16_t fport; 1475 uint32_t ports; 1476 conn_t *connp; 1477 uint16_t *up; 1478 boolean_t shared_addr; 1479 boolean_t unlabeled; 1480 1481 ipha = (ipha_t *)mp->b_rptr; 1482 up = (uint16_t *)((uchar_t *)ipha + hdr_len + TCP_PORTS_OFFSET); 1483 1484 switch (protocol) { 1485 case IPPROTO_TCP: 1486 ports = *(uint32_t *)up; 1487 connfp = 1488 &ipst->ips_ipcl_conn_fanout[IPCL_CONN_HASH(ipha->ipha_src, 1489 ports, ipst)]; 1490 mutex_enter(&connfp->connf_lock); 1491 for (connp = connfp->connf_head; connp != NULL; 1492 connp = connp->conn_next) { 1493 if (IPCL_CONN_MATCH(connp, protocol, 1494 ipha->ipha_src, ipha->ipha_dst, ports)) 1495 break; 1496 } 1497 1498 if (connp != NULL) { 1499 /* 1500 * We have a fully-bound TCP connection. 1501 * 1502 * For labeled systems, there's no need to check the 1503 * label here. It's known to be good as we checked 1504 * before allowing the connection to become bound. 1505 */ 1506 CONN_INC_REF(connp); 1507 mutex_exit(&connfp->connf_lock); 1508 return (connp); 1509 } 1510 1511 mutex_exit(&connfp->connf_lock); 1512 1513 lport = up[1]; 1514 unlabeled = B_FALSE; 1515 /* Cred cannot be null on IPv4 */ 1516 if (is_system_labeled()) 1517 unlabeled = (crgetlabel(DB_CRED(mp))->tsl_flags & 1518 TSLF_UNLABELED) != 0; 1519 shared_addr = (zoneid == ALL_ZONES); 1520 if (shared_addr) { 1521 /* 1522 * No need to handle exclusive-stack zones since 1523 * ALL_ZONES only applies to the shared stack. 1524 */ 1525 zoneid = tsol_mlp_findzone(protocol, lport); 1526 /* 1527 * If no shared MLP is found, tsol_mlp_findzone returns 1528 * ALL_ZONES. In that case, we assume it's SLP, and 1529 * search for the zone based on the packet label. 1530 * 1531 * If there is such a zone, we prefer to find a 1532 * connection in it. Otherwise, we look for a 1533 * MAC-exempt connection in any zone whose label 1534 * dominates the default label on the packet. 1535 */ 1536 if (zoneid == ALL_ZONES) 1537 zoneid = tsol_packet_to_zoneid(mp); 1538 else 1539 unlabeled = B_FALSE; 1540 } 1541 1542 bind_connfp = 1543 &ipst->ips_ipcl_bind_fanout[IPCL_BIND_HASH(lport, ipst)]; 1544 mutex_enter(&bind_connfp->connf_lock); 1545 for (connp = bind_connfp->connf_head; connp != NULL; 1546 connp = connp->conn_next) { 1547 if (IPCL_BIND_MATCH(connp, protocol, ipha->ipha_dst, 1548 lport) && (IPCL_ZONE_MATCH(connp, zoneid) || 1549 (unlabeled && connp->conn_mac_exempt))) 1550 break; 1551 } 1552 1553 /* 1554 * If the matching connection is SLP on a private address, then 1555 * the label on the packet must match the local zone's label. 1556 * Otherwise, it must be in the label range defined by tnrh. 1557 * This is ensured by tsol_receive_label. 1558 */ 1559 if (connp != NULL && is_system_labeled() && 1560 !tsol_receive_local(mp, &ipha->ipha_dst, IPV4_VERSION, 1561 shared_addr, connp)) { 1562 DTRACE_PROBE3( 1563 tx__ip__log__info__classify__tcp, 1564 char *, 1565 "connp(1) could not receive mp(2)", 1566 conn_t *, connp, mblk_t *, mp); 1567 connp = NULL; 1568 } 1569 1570 if (connp != NULL) { 1571 /* Have a listener at least */ 1572 CONN_INC_REF(connp); 1573 mutex_exit(&bind_connfp->connf_lock); 1574 return (connp); 1575 } 1576 1577 mutex_exit(&bind_connfp->connf_lock); 1578 1579 IPCL_DEBUG_LVL(512, 1580 ("ipcl_classify: couldn't classify mp = %p\n", 1581 (void *)mp)); 1582 break; 1583 1584 case IPPROTO_UDP: 1585 lport = up[1]; 1586 unlabeled = B_FALSE; 1587 /* Cred cannot be null on IPv4 */ 1588 if (is_system_labeled()) 1589 unlabeled = (crgetlabel(DB_CRED(mp))->tsl_flags & 1590 TSLF_UNLABELED) != 0; 1591 shared_addr = (zoneid == ALL_ZONES); 1592 if (shared_addr) { 1593 /* 1594 * No need to handle exclusive-stack zones since 1595 * ALL_ZONES only applies to the shared stack. 1596 */ 1597 zoneid = tsol_mlp_findzone(protocol, lport); 1598 /* 1599 * If no shared MLP is found, tsol_mlp_findzone returns 1600 * ALL_ZONES. In that case, we assume it's SLP, and 1601 * search for the zone based on the packet label. 1602 * 1603 * If there is such a zone, we prefer to find a 1604 * connection in it. Otherwise, we look for a 1605 * MAC-exempt connection in any zone whose label 1606 * dominates the default label on the packet. 1607 */ 1608 if (zoneid == ALL_ZONES) 1609 zoneid = tsol_packet_to_zoneid(mp); 1610 else 1611 unlabeled = B_FALSE; 1612 } 1613 fport = up[0]; 1614 IPCL_DEBUG_LVL(512, ("ipcl_udp_classify %x %x", lport, fport)); 1615 connfp = &ipst->ips_ipcl_udp_fanout[IPCL_UDP_HASH(lport, ipst)]; 1616 mutex_enter(&connfp->connf_lock); 1617 for (connp = connfp->connf_head; connp != NULL; 1618 connp = connp->conn_next) { 1619 if (IPCL_UDP_MATCH(connp, lport, ipha->ipha_dst, 1620 fport, ipha->ipha_src) && 1621 (IPCL_ZONE_MATCH(connp, zoneid) || 1622 (unlabeled && connp->conn_mac_exempt))) 1623 break; 1624 } 1625 1626 if (connp != NULL && is_system_labeled() && 1627 !tsol_receive_local(mp, &ipha->ipha_dst, IPV4_VERSION, 1628 shared_addr, connp)) { 1629 DTRACE_PROBE3(tx__ip__log__info__classify__udp, 1630 char *, "connp(1) could not receive mp(2)", 1631 conn_t *, connp, mblk_t *, mp); 1632 connp = NULL; 1633 } 1634 1635 if (connp != NULL) { 1636 CONN_INC_REF(connp); 1637 mutex_exit(&connfp->connf_lock); 1638 return (connp); 1639 } 1640 1641 /* 1642 * We shouldn't come here for multicast/broadcast packets 1643 */ 1644 mutex_exit(&connfp->connf_lock); 1645 IPCL_DEBUG_LVL(512, 1646 ("ipcl_classify: cant find udp conn_t for ports : %x %x", 1647 lport, fport)); 1648 break; 1649 } 1650 1651 return (NULL); 1652 } 1653 1654 conn_t * 1655 ipcl_classify_v6(mblk_t *mp, uint8_t protocol, uint_t hdr_len, zoneid_t zoneid, 1656 ip_stack_t *ipst) 1657 { 1658 ip6_t *ip6h; 1659 connf_t *connfp, *bind_connfp; 1660 uint16_t lport; 1661 uint16_t fport; 1662 tcph_t *tcph; 1663 uint32_t ports; 1664 conn_t *connp; 1665 uint16_t *up; 1666 boolean_t shared_addr; 1667 boolean_t unlabeled; 1668 1669 ip6h = (ip6_t *)mp->b_rptr; 1670 1671 switch (protocol) { 1672 case IPPROTO_TCP: 1673 tcph = (tcph_t *)&mp->b_rptr[hdr_len]; 1674 up = (uint16_t *)tcph->th_lport; 1675 ports = *(uint32_t *)up; 1676 1677 connfp = 1678 &ipst->ips_ipcl_conn_fanout[IPCL_CONN_HASH_V6(ip6h->ip6_src, 1679 ports, ipst)]; 1680 mutex_enter(&connfp->connf_lock); 1681 for (connp = connfp->connf_head; connp != NULL; 1682 connp = connp->conn_next) { 1683 if (IPCL_CONN_MATCH_V6(connp, protocol, 1684 ip6h->ip6_src, ip6h->ip6_dst, ports)) 1685 break; 1686 } 1687 1688 if (connp != NULL) { 1689 /* 1690 * We have a fully-bound TCP connection. 1691 * 1692 * For labeled systems, there's no need to check the 1693 * label here. It's known to be good as we checked 1694 * before allowing the connection to become bound. 1695 */ 1696 CONN_INC_REF(connp); 1697 mutex_exit(&connfp->connf_lock); 1698 return (connp); 1699 } 1700 1701 mutex_exit(&connfp->connf_lock); 1702 1703 lport = up[1]; 1704 unlabeled = B_FALSE; 1705 /* Cred can be null on IPv6 */ 1706 if (is_system_labeled()) { 1707 cred_t *cr = DB_CRED(mp); 1708 1709 unlabeled = (cr != NULL && 1710 crgetlabel(cr)->tsl_flags & TSLF_UNLABELED) != 0; 1711 } 1712 shared_addr = (zoneid == ALL_ZONES); 1713 if (shared_addr) { 1714 /* 1715 * No need to handle exclusive-stack zones since 1716 * ALL_ZONES only applies to the shared stack. 1717 */ 1718 zoneid = tsol_mlp_findzone(protocol, lport); 1719 /* 1720 * If no shared MLP is found, tsol_mlp_findzone returns 1721 * ALL_ZONES. In that case, we assume it's SLP, and 1722 * search for the zone based on the packet label. 1723 * 1724 * If there is such a zone, we prefer to find a 1725 * connection in it. Otherwise, we look for a 1726 * MAC-exempt connection in any zone whose label 1727 * dominates the default label on the packet. 1728 */ 1729 if (zoneid == ALL_ZONES) 1730 zoneid = tsol_packet_to_zoneid(mp); 1731 else 1732 unlabeled = B_FALSE; 1733 } 1734 1735 bind_connfp = 1736 &ipst->ips_ipcl_bind_fanout[IPCL_BIND_HASH(lport, ipst)]; 1737 mutex_enter(&bind_connfp->connf_lock); 1738 for (connp = bind_connfp->connf_head; connp != NULL; 1739 connp = connp->conn_next) { 1740 if (IPCL_BIND_MATCH_V6(connp, protocol, 1741 ip6h->ip6_dst, lport) && 1742 (IPCL_ZONE_MATCH(connp, zoneid) || 1743 (unlabeled && connp->conn_mac_exempt))) 1744 break; 1745 } 1746 1747 if (connp != NULL && is_system_labeled() && 1748 !tsol_receive_local(mp, &ip6h->ip6_dst, IPV6_VERSION, 1749 shared_addr, connp)) { 1750 DTRACE_PROBE3(tx__ip__log__info__classify__tcp6, 1751 char *, "connp(1) could not receive mp(2)", 1752 conn_t *, connp, mblk_t *, mp); 1753 connp = NULL; 1754 } 1755 1756 if (connp != NULL) { 1757 /* Have a listner at least */ 1758 CONN_INC_REF(connp); 1759 mutex_exit(&bind_connfp->connf_lock); 1760 IPCL_DEBUG_LVL(512, 1761 ("ipcl_classify_v6: found listner " 1762 "connp = %p\n", (void *)connp)); 1763 1764 return (connp); 1765 } 1766 1767 mutex_exit(&bind_connfp->connf_lock); 1768 1769 IPCL_DEBUG_LVL(512, 1770 ("ipcl_classify_v6: couldn't classify mp = %p\n", 1771 (void *)mp)); 1772 break; 1773 1774 case IPPROTO_UDP: 1775 up = (uint16_t *)&mp->b_rptr[hdr_len]; 1776 lport = up[1]; 1777 unlabeled = B_FALSE; 1778 /* Cred can be null on IPv6 */ 1779 if (is_system_labeled()) { 1780 cred_t *cr = DB_CRED(mp); 1781 1782 unlabeled = (cr != NULL && 1783 crgetlabel(cr)->tsl_flags & TSLF_UNLABELED) != 0; 1784 } 1785 shared_addr = (zoneid == ALL_ZONES); 1786 if (shared_addr) { 1787 /* 1788 * No need to handle exclusive-stack zones since 1789 * ALL_ZONES only applies to the shared stack. 1790 */ 1791 zoneid = tsol_mlp_findzone(protocol, lport); 1792 /* 1793 * If no shared MLP is found, tsol_mlp_findzone returns 1794 * ALL_ZONES. In that case, we assume it's SLP, and 1795 * search for the zone based on the packet label. 1796 * 1797 * If there is such a zone, we prefer to find a 1798 * connection in it. Otherwise, we look for a 1799 * MAC-exempt connection in any zone whose label 1800 * dominates the default label on the packet. 1801 */ 1802 if (zoneid == ALL_ZONES) 1803 zoneid = tsol_packet_to_zoneid(mp); 1804 else 1805 unlabeled = B_FALSE; 1806 } 1807 1808 fport = up[0]; 1809 IPCL_DEBUG_LVL(512, ("ipcl_udp_classify_v6 %x %x", lport, 1810 fport)); 1811 connfp = &ipst->ips_ipcl_udp_fanout[IPCL_UDP_HASH(lport, ipst)]; 1812 mutex_enter(&connfp->connf_lock); 1813 for (connp = connfp->connf_head; connp != NULL; 1814 connp = connp->conn_next) { 1815 if (IPCL_UDP_MATCH_V6(connp, lport, ip6h->ip6_dst, 1816 fport, ip6h->ip6_src) && 1817 (IPCL_ZONE_MATCH(connp, zoneid) || 1818 (unlabeled && connp->conn_mac_exempt))) 1819 break; 1820 } 1821 1822 if (connp != NULL && is_system_labeled() && 1823 !tsol_receive_local(mp, &ip6h->ip6_dst, IPV6_VERSION, 1824 shared_addr, connp)) { 1825 DTRACE_PROBE3(tx__ip__log__info__classify__udp6, 1826 char *, "connp(1) could not receive mp(2)", 1827 conn_t *, connp, mblk_t *, mp); 1828 connp = NULL; 1829 } 1830 1831 if (connp != NULL) { 1832 CONN_INC_REF(connp); 1833 mutex_exit(&connfp->connf_lock); 1834 return (connp); 1835 } 1836 1837 /* 1838 * We shouldn't come here for multicast/broadcast packets 1839 */ 1840 mutex_exit(&connfp->connf_lock); 1841 IPCL_DEBUG_LVL(512, 1842 ("ipcl_classify_v6: cant find udp conn_t for ports : %x %x", 1843 lport, fport)); 1844 break; 1845 } 1846 1847 return (NULL); 1848 } 1849 1850 /* 1851 * wrapper around ipcl_classify_(v4,v6) routines. 1852 */ 1853 conn_t * 1854 ipcl_classify(mblk_t *mp, zoneid_t zoneid, ip_stack_t *ipst) 1855 { 1856 uint16_t hdr_len; 1857 ipha_t *ipha; 1858 uint8_t *nexthdrp; 1859 1860 if (MBLKL(mp) < sizeof (ipha_t)) 1861 return (NULL); 1862 1863 switch (IPH_HDR_VERSION(mp->b_rptr)) { 1864 case IPV4_VERSION: 1865 ipha = (ipha_t *)mp->b_rptr; 1866 hdr_len = IPH_HDR_LENGTH(ipha); 1867 return (ipcl_classify_v4(mp, ipha->ipha_protocol, hdr_len, 1868 zoneid, ipst)); 1869 case IPV6_VERSION: 1870 if (!ip_hdr_length_nexthdr_v6(mp, (ip6_t *)mp->b_rptr, 1871 &hdr_len, &nexthdrp)) 1872 return (NULL); 1873 1874 return (ipcl_classify_v6(mp, *nexthdrp, hdr_len, zoneid, ipst)); 1875 } 1876 1877 return (NULL); 1878 } 1879 1880 conn_t * 1881 ipcl_classify_raw(mblk_t *mp, uint8_t protocol, zoneid_t zoneid, 1882 uint32_t ports, ipha_t *hdr, ip_stack_t *ipst) 1883 { 1884 connf_t *connfp; 1885 conn_t *connp; 1886 in_port_t lport; 1887 int af; 1888 boolean_t shared_addr; 1889 boolean_t unlabeled; 1890 const void *dst; 1891 1892 lport = ((uint16_t *)&ports)[1]; 1893 1894 unlabeled = B_FALSE; 1895 /* Cred can be null on IPv6 */ 1896 if (is_system_labeled()) { 1897 cred_t *cr = DB_CRED(mp); 1898 1899 unlabeled = (cr != NULL && 1900 crgetlabel(cr)->tsl_flags & TSLF_UNLABELED) != 0; 1901 } 1902 shared_addr = (zoneid == ALL_ZONES); 1903 if (shared_addr) { 1904 /* 1905 * No need to handle exclusive-stack zones since ALL_ZONES 1906 * only applies to the shared stack. 1907 */ 1908 zoneid = tsol_mlp_findzone(protocol, lport); 1909 /* 1910 * If no shared MLP is found, tsol_mlp_findzone returns 1911 * ALL_ZONES. In that case, we assume it's SLP, and search for 1912 * the zone based on the packet label. 1913 * 1914 * If there is such a zone, we prefer to find a connection in 1915 * it. Otherwise, we look for a MAC-exempt connection in any 1916 * zone whose label dominates the default label on the packet. 1917 */ 1918 if (zoneid == ALL_ZONES) 1919 zoneid = tsol_packet_to_zoneid(mp); 1920 else 1921 unlabeled = B_FALSE; 1922 } 1923 1924 af = IPH_HDR_VERSION(hdr); 1925 dst = af == IPV4_VERSION ? (const void *)&hdr->ipha_dst : 1926 (const void *)&((ip6_t *)hdr)->ip6_dst; 1927 connfp = &ipst->ips_ipcl_raw_fanout[IPCL_RAW_HASH(ntohs(lport), ipst)]; 1928 1929 mutex_enter(&connfp->connf_lock); 1930 for (connp = connfp->connf_head; connp != NULL; 1931 connp = connp->conn_next) { 1932 /* We don't allow v4 fallback for v6 raw socket. */ 1933 if (af == (connp->conn_af_isv6 ? IPV4_VERSION : 1934 IPV6_VERSION)) 1935 continue; 1936 if (connp->conn_fully_bound) { 1937 if (af == IPV4_VERSION) { 1938 if (!IPCL_CONN_MATCH(connp, protocol, 1939 hdr->ipha_src, hdr->ipha_dst, ports)) 1940 continue; 1941 } else { 1942 if (!IPCL_CONN_MATCH_V6(connp, protocol, 1943 ((ip6_t *)hdr)->ip6_src, 1944 ((ip6_t *)hdr)->ip6_dst, ports)) 1945 continue; 1946 } 1947 } else { 1948 if (af == IPV4_VERSION) { 1949 if (!IPCL_BIND_MATCH(connp, protocol, 1950 hdr->ipha_dst, lport)) 1951 continue; 1952 } else { 1953 if (!IPCL_BIND_MATCH_V6(connp, protocol, 1954 ((ip6_t *)hdr)->ip6_dst, lport)) 1955 continue; 1956 } 1957 } 1958 1959 if (IPCL_ZONE_MATCH(connp, zoneid) || 1960 (unlabeled && connp->conn_mac_exempt)) 1961 break; 1962 } 1963 /* 1964 * If the connection is fully-bound and connection-oriented (TCP or 1965 * SCTP), then we've already validated the remote system's label. 1966 * There's no need to do it again for every packet. 1967 */ 1968 if (connp != NULL && is_system_labeled() && (!connp->conn_fully_bound || 1969 !(connp->conn_flags & (IPCL_TCP|IPCL_SCTPCONN))) && 1970 !tsol_receive_local(mp, dst, af, shared_addr, connp)) { 1971 DTRACE_PROBE3(tx__ip__log__info__classify__rawip, 1972 char *, "connp(1) could not receive mp(2)", 1973 conn_t *, connp, mblk_t *, mp); 1974 connp = NULL; 1975 } 1976 1977 if (connp != NULL) 1978 goto found; 1979 mutex_exit(&connfp->connf_lock); 1980 1981 /* Try to look for a wildcard match. */ 1982 connfp = &ipst->ips_ipcl_raw_fanout[IPCL_RAW_HASH(0, ipst)]; 1983 mutex_enter(&connfp->connf_lock); 1984 for (connp = connfp->connf_head; connp != NULL; 1985 connp = connp->conn_next) { 1986 /* We don't allow v4 fallback for v6 raw socket. */ 1987 if ((af == (connp->conn_af_isv6 ? IPV4_VERSION : 1988 IPV6_VERSION)) || !IPCL_ZONE_MATCH(connp, zoneid)) { 1989 continue; 1990 } 1991 if (af == IPV4_VERSION) { 1992 if (IPCL_RAW_MATCH(connp, protocol, hdr->ipha_dst)) 1993 break; 1994 } else { 1995 if (IPCL_RAW_MATCH_V6(connp, protocol, 1996 ((ip6_t *)hdr)->ip6_dst)) { 1997 break; 1998 } 1999 } 2000 } 2001 2002 if (connp != NULL) 2003 goto found; 2004 2005 mutex_exit(&connfp->connf_lock); 2006 return (NULL); 2007 2008 found: 2009 ASSERT(connp != NULL); 2010 CONN_INC_REF(connp); 2011 mutex_exit(&connfp->connf_lock); 2012 return (connp); 2013 } 2014 2015 /* ARGSUSED */ 2016 static int 2017 tcp_conn_constructor(void *buf, void *cdrarg, int kmflags) 2018 { 2019 itc_t *itc = (itc_t *)buf; 2020 conn_t *connp = &itc->itc_conn; 2021 tcp_t *tcp = (tcp_t *)&itc[1]; 2022 2023 bzero(connp, sizeof (conn_t)); 2024 bzero(tcp, sizeof (tcp_t)); 2025 2026 mutex_init(&connp->conn_lock, NULL, MUTEX_DEFAULT, NULL); 2027 cv_init(&connp->conn_cv, NULL, CV_DEFAULT, NULL); 2028 tcp->tcp_timercache = tcp_timermp_alloc(KM_NOSLEEP); 2029 connp->conn_tcp = tcp; 2030 connp->conn_flags = IPCL_TCPCONN; 2031 connp->conn_ulp = IPPROTO_TCP; 2032 tcp->tcp_connp = connp; 2033 return (0); 2034 } 2035 2036 /* ARGSUSED */ 2037 static void 2038 tcp_conn_destructor(void *buf, void *cdrarg) 2039 { 2040 itc_t *itc = (itc_t *)buf; 2041 conn_t *connp = &itc->itc_conn; 2042 tcp_t *tcp = (tcp_t *)&itc[1]; 2043 2044 ASSERT(connp->conn_flags & IPCL_TCPCONN); 2045 ASSERT(tcp->tcp_connp == connp); 2046 ASSERT(connp->conn_tcp == tcp); 2047 tcp_timermp_free(tcp); 2048 mutex_destroy(&connp->conn_lock); 2049 cv_destroy(&connp->conn_cv); 2050 } 2051 2052 /* ARGSUSED */ 2053 static int 2054 ip_conn_constructor(void *buf, void *cdrarg, int kmflags) 2055 { 2056 itc_t *itc = (itc_t *)buf; 2057 conn_t *connp = &itc->itc_conn; 2058 2059 bzero(connp, sizeof (conn_t)); 2060 mutex_init(&connp->conn_lock, NULL, MUTEX_DEFAULT, NULL); 2061 cv_init(&connp->conn_cv, NULL, CV_DEFAULT, NULL); 2062 connp->conn_flags = IPCL_IPCCONN; 2063 2064 return (0); 2065 } 2066 2067 /* ARGSUSED */ 2068 static void 2069 ip_conn_destructor(void *buf, void *cdrarg) 2070 { 2071 itc_t *itc = (itc_t *)buf; 2072 conn_t *connp = &itc->itc_conn; 2073 2074 ASSERT(connp->conn_flags & IPCL_IPCCONN); 2075 ASSERT(connp->conn_priv == NULL); 2076 mutex_destroy(&connp->conn_lock); 2077 cv_destroy(&connp->conn_cv); 2078 } 2079 2080 /* ARGSUSED */ 2081 static int 2082 udp_conn_constructor(void *buf, void *cdrarg, int kmflags) 2083 { 2084 itc_t *itc = (itc_t *)buf; 2085 conn_t *connp = &itc->itc_conn; 2086 udp_t *udp = (udp_t *)&itc[1]; 2087 2088 bzero(connp, sizeof (conn_t)); 2089 bzero(udp, sizeof (udp_t)); 2090 2091 mutex_init(&connp->conn_lock, NULL, MUTEX_DEFAULT, NULL); 2092 cv_init(&connp->conn_cv, NULL, CV_DEFAULT, NULL); 2093 connp->conn_udp = udp; 2094 connp->conn_flags = IPCL_UDPCONN; 2095 connp->conn_ulp = IPPROTO_UDP; 2096 udp->udp_connp = connp; 2097 return (0); 2098 } 2099 2100 /* ARGSUSED */ 2101 static void 2102 udp_conn_destructor(void *buf, void *cdrarg) 2103 { 2104 itc_t *itc = (itc_t *)buf; 2105 conn_t *connp = &itc->itc_conn; 2106 udp_t *udp = (udp_t *)&itc[1]; 2107 2108 ASSERT(connp->conn_flags & IPCL_UDPCONN); 2109 ASSERT(udp->udp_connp == connp); 2110 ASSERT(connp->conn_udp == udp); 2111 mutex_destroy(&connp->conn_lock); 2112 cv_destroy(&connp->conn_cv); 2113 } 2114 2115 /* ARGSUSED */ 2116 static int 2117 rawip_conn_constructor(void *buf, void *cdrarg, int kmflags) 2118 { 2119 itc_t *itc = (itc_t *)buf; 2120 conn_t *connp = &itc->itc_conn; 2121 icmp_t *icmp = (icmp_t *)&itc[1]; 2122 2123 bzero(connp, sizeof (conn_t)); 2124 bzero(icmp, sizeof (icmp_t)); 2125 2126 mutex_init(&connp->conn_lock, NULL, MUTEX_DEFAULT, NULL); 2127 cv_init(&connp->conn_cv, NULL, CV_DEFAULT, NULL); 2128 connp->conn_icmp = icmp; 2129 connp->conn_flags = IPCL_RAWIPCONN; 2130 connp->conn_ulp = IPPROTO_ICMP; 2131 icmp->icmp_connp = connp; 2132 return (0); 2133 } 2134 2135 /* ARGSUSED */ 2136 static void 2137 rawip_conn_destructor(void *buf, void *cdrarg) 2138 { 2139 itc_t *itc = (itc_t *)buf; 2140 conn_t *connp = &itc->itc_conn; 2141 icmp_t *icmp = (icmp_t *)&itc[1]; 2142 2143 ASSERT(connp->conn_flags & IPCL_RAWIPCONN); 2144 ASSERT(icmp->icmp_connp == connp); 2145 ASSERT(connp->conn_icmp == icmp); 2146 mutex_destroy(&connp->conn_lock); 2147 cv_destroy(&connp->conn_cv); 2148 } 2149 2150 /* ARGSUSED */ 2151 static int 2152 rts_conn_constructor(void *buf, void *cdrarg, int kmflags) 2153 { 2154 itc_t *itc = (itc_t *)buf; 2155 conn_t *connp = &itc->itc_conn; 2156 rts_t *rts = (rts_t *)&itc[1]; 2157 2158 bzero(connp, sizeof (conn_t)); 2159 bzero(rts, sizeof (rts_t)); 2160 2161 mutex_init(&connp->conn_lock, NULL, MUTEX_DEFAULT, NULL); 2162 cv_init(&connp->conn_cv, NULL, CV_DEFAULT, NULL); 2163 connp->conn_rts = rts; 2164 connp->conn_flags = IPCL_RTSCONN; 2165 rts->rts_connp = connp; 2166 return (0); 2167 } 2168 2169 /* ARGSUSED */ 2170 static void 2171 rts_conn_destructor(void *buf, void *cdrarg) 2172 { 2173 itc_t *itc = (itc_t *)buf; 2174 conn_t *connp = &itc->itc_conn; 2175 rts_t *rts = (rts_t *)&itc[1]; 2176 2177 ASSERT(connp->conn_flags & IPCL_RTSCONN); 2178 ASSERT(rts->rts_connp == connp); 2179 ASSERT(connp->conn_rts == rts); 2180 mutex_destroy(&connp->conn_lock); 2181 cv_destroy(&connp->conn_cv); 2182 } 2183 2184 /* 2185 * Called as part of ipcl_conn_destroy to assert and clear any pointers 2186 * in the conn_t. 2187 * 2188 * Below we list all the pointers in the conn_t as a documentation aid. 2189 * The ones that we can not ASSERT to be NULL are #ifdef'ed out. 2190 * If you add any pointers to the conn_t please add an ASSERT here 2191 * and #ifdef it out if it can't be actually asserted to be NULL. 2192 * In any case, we bzero most of the conn_t at the end of the function. 2193 */ 2194 void 2195 ipcl_conn_cleanup(conn_t *connp) 2196 { 2197 ASSERT(connp->conn_ire_cache == NULL); 2198 ASSERT(connp->conn_latch == NULL); 2199 #ifdef notdef 2200 /* These are not cleared */ 2201 ASSERT(connp->conn_rq == NULL); 2202 ASSERT(connp->conn_wq == NULL); 2203 #endif 2204 ASSERT(connp->conn_cred == NULL); 2205 ASSERT(connp->conn_g_fanout == NULL); 2206 ASSERT(connp->conn_g_next == NULL); 2207 ASSERT(connp->conn_g_prev == NULL); 2208 ASSERT(connp->conn_policy == NULL); 2209 ASSERT(connp->conn_fanout == NULL); 2210 ASSERT(connp->conn_next == NULL); 2211 ASSERT(connp->conn_prev == NULL); 2212 #ifdef notdef 2213 /* 2214 * The ill and ipif pointers are not cleared before the conn_t 2215 * goes away since they do not hold a reference on the ill/ipif. 2216 * We should replace these pointers with ifindex/ipaddr_t to 2217 * make the code less complex. 2218 */ 2219 ASSERT(connp->conn_xmit_if_ill == NULL); 2220 ASSERT(connp->conn_nofailover_ill == NULL); 2221 ASSERT(connp->conn_outgoing_ill == NULL); 2222 ASSERT(connp->conn_incoming_ill == NULL); 2223 ASSERT(connp->conn_outgoing_pill == NULL); 2224 ASSERT(connp->conn_multicast_ipif == NULL); 2225 ASSERT(connp->conn_multicast_ill == NULL); 2226 #endif 2227 ASSERT(connp->conn_oper_pending_ill == NULL); 2228 ASSERT(connp->conn_ilg == NULL); 2229 ASSERT(connp->conn_drain_next == NULL); 2230 ASSERT(connp->conn_drain_prev == NULL); 2231 #ifdef notdef 2232 /* conn_idl is not cleared when removed from idl list */ 2233 ASSERT(connp->conn_idl == NULL); 2234 #endif 2235 ASSERT(connp->conn_ipsec_opt_mp == NULL); 2236 ASSERT(connp->conn_peercred == NULL); 2237 ASSERT(connp->conn_netstack == NULL); 2238 2239 /* Clear out the conn_t fields that are not preserved */ 2240 bzero(&connp->conn_start_clr, 2241 sizeof (conn_t) - 2242 ((uchar_t *)&connp->conn_start_clr - (uchar_t *)connp)); 2243 2244 } 2245 2246 /* 2247 * All conns are inserted in a global multi-list for the benefit of 2248 * walkers. The walk is guaranteed to walk all open conns at the time 2249 * of the start of the walk exactly once. This property is needed to 2250 * achieve some cleanups during unplumb of interfaces. This is achieved 2251 * as follows. 2252 * 2253 * ipcl_conn_create and ipcl_conn_destroy are the only functions that 2254 * call the insert and delete functions below at creation and deletion 2255 * time respectively. The conn never moves or changes its position in this 2256 * multi-list during its lifetime. CONN_CONDEMNED ensures that the refcnt 2257 * won't increase due to walkers, once the conn deletion has started. Note 2258 * that we can't remove the conn from the global list and then wait for 2259 * the refcnt to drop to zero, since walkers would then see a truncated 2260 * list. CONN_INCIPIENT ensures that walkers don't start looking at 2261 * conns until ip_open is ready to make them globally visible. 2262 * The global round robin multi-list locks are held only to get the 2263 * next member/insertion/deletion and contention should be negligible 2264 * if the multi-list is much greater than the number of cpus. 2265 */ 2266 void 2267 ipcl_globalhash_insert(conn_t *connp) 2268 { 2269 int index; 2270 struct connf_s *connfp; 2271 ip_stack_t *ipst = connp->conn_netstack->netstack_ip; 2272 2273 /* 2274 * No need for atomic here. Approximate even distribution 2275 * in the global lists is sufficient. 2276 */ 2277 ipst->ips_conn_g_index++; 2278 index = ipst->ips_conn_g_index & (CONN_G_HASH_SIZE - 1); 2279 2280 connp->conn_g_prev = NULL; 2281 /* 2282 * Mark as INCIPIENT, so that walkers will ignore this 2283 * for now, till ip_open is ready to make it visible globally. 2284 */ 2285 connp->conn_state_flags |= CONN_INCIPIENT; 2286 2287 connfp = &ipst->ips_ipcl_globalhash_fanout[index]; 2288 /* Insert at the head of the list */ 2289 mutex_enter(&connfp->connf_lock); 2290 connp->conn_g_next = connfp->connf_head; 2291 if (connp->conn_g_next != NULL) 2292 connp->conn_g_next->conn_g_prev = connp; 2293 connfp->connf_head = connp; 2294 2295 /* The fanout bucket this conn points to */ 2296 connp->conn_g_fanout = connfp; 2297 2298 mutex_exit(&connfp->connf_lock); 2299 } 2300 2301 void 2302 ipcl_globalhash_remove(conn_t *connp) 2303 { 2304 struct connf_s *connfp; 2305 2306 /* 2307 * We were never inserted in the global multi list. 2308 * IPCL_NONE variety is never inserted in the global multilist 2309 * since it is presumed to not need any cleanup and is transient. 2310 */ 2311 if (connp->conn_g_fanout == NULL) 2312 return; 2313 2314 connfp = connp->conn_g_fanout; 2315 mutex_enter(&connfp->connf_lock); 2316 if (connp->conn_g_prev != NULL) 2317 connp->conn_g_prev->conn_g_next = connp->conn_g_next; 2318 else 2319 connfp->connf_head = connp->conn_g_next; 2320 if (connp->conn_g_next != NULL) 2321 connp->conn_g_next->conn_g_prev = connp->conn_g_prev; 2322 mutex_exit(&connfp->connf_lock); 2323 2324 /* Better to stumble on a null pointer than to corrupt memory */ 2325 connp->conn_g_next = NULL; 2326 connp->conn_g_prev = NULL; 2327 connp->conn_g_fanout = NULL; 2328 } 2329 2330 /* 2331 * Walk the list of all conn_t's in the system, calling the function provided 2332 * with the specified argument for each. 2333 * Applies to both IPv4 and IPv6. 2334 * 2335 * IPCs may hold pointers to ipif/ill. To guard against stale pointers 2336 * ipcl_walk() is called to cleanup the conn_t's, typically when an interface is 2337 * unplumbed or removed. New conn_t's that are created while we are walking 2338 * may be missed by this walk, because they are not necessarily inserted 2339 * at the tail of the list. They are new conn_t's and thus don't have any 2340 * stale pointers. The CONN_CLOSING flag ensures that no new reference 2341 * is created to the struct that is going away. 2342 */ 2343 void 2344 ipcl_walk(pfv_t func, void *arg, ip_stack_t *ipst) 2345 { 2346 int i; 2347 conn_t *connp; 2348 conn_t *prev_connp; 2349 2350 for (i = 0; i < CONN_G_HASH_SIZE; i++) { 2351 mutex_enter(&ipst->ips_ipcl_globalhash_fanout[i].connf_lock); 2352 prev_connp = NULL; 2353 connp = ipst->ips_ipcl_globalhash_fanout[i].connf_head; 2354 while (connp != NULL) { 2355 mutex_enter(&connp->conn_lock); 2356 if (connp->conn_state_flags & 2357 (CONN_CONDEMNED | CONN_INCIPIENT)) { 2358 mutex_exit(&connp->conn_lock); 2359 connp = connp->conn_g_next; 2360 continue; 2361 } 2362 CONN_INC_REF_LOCKED(connp); 2363 mutex_exit(&connp->conn_lock); 2364 mutex_exit( 2365 &ipst->ips_ipcl_globalhash_fanout[i].connf_lock); 2366 (*func)(connp, arg); 2367 if (prev_connp != NULL) 2368 CONN_DEC_REF(prev_connp); 2369 mutex_enter( 2370 &ipst->ips_ipcl_globalhash_fanout[i].connf_lock); 2371 prev_connp = connp; 2372 connp = connp->conn_g_next; 2373 } 2374 mutex_exit(&ipst->ips_ipcl_globalhash_fanout[i].connf_lock); 2375 if (prev_connp != NULL) 2376 CONN_DEC_REF(prev_connp); 2377 } 2378 } 2379 2380 /* 2381 * Search for a peer TCP/IPv4 loopback conn by doing a reverse lookup on 2382 * the {src, dst, lport, fport} quadruplet. Returns with conn reference 2383 * held; caller must call CONN_DEC_REF. Only checks for connected entries 2384 * (peer tcp in ESTABLISHED state). 2385 */ 2386 conn_t * 2387 ipcl_conn_tcp_lookup_reversed_ipv4(conn_t *connp, ipha_t *ipha, tcph_t *tcph, 2388 ip_stack_t *ipst) 2389 { 2390 uint32_t ports; 2391 uint16_t *pports = (uint16_t *)&ports; 2392 connf_t *connfp; 2393 conn_t *tconnp; 2394 boolean_t zone_chk; 2395 2396 /* 2397 * If either the source of destination address is loopback, then 2398 * both endpoints must be in the same Zone. Otherwise, both of 2399 * the addresses are system-wide unique (tcp is in ESTABLISHED 2400 * state) and the endpoints may reside in different Zones. 2401 */ 2402 zone_chk = (ipha->ipha_src == htonl(INADDR_LOOPBACK) || 2403 ipha->ipha_dst == htonl(INADDR_LOOPBACK)); 2404 2405 bcopy(tcph->th_fport, &pports[0], sizeof (uint16_t)); 2406 bcopy(tcph->th_lport, &pports[1], sizeof (uint16_t)); 2407 2408 connfp = &ipst->ips_ipcl_conn_fanout[IPCL_CONN_HASH(ipha->ipha_dst, 2409 ports, ipst)]; 2410 2411 mutex_enter(&connfp->connf_lock); 2412 for (tconnp = connfp->connf_head; tconnp != NULL; 2413 tconnp = tconnp->conn_next) { 2414 2415 if (IPCL_CONN_MATCH(tconnp, IPPROTO_TCP, 2416 ipha->ipha_dst, ipha->ipha_src, ports) && 2417 tconnp->conn_tcp->tcp_state == TCPS_ESTABLISHED && 2418 (!zone_chk || tconnp->conn_zoneid == connp->conn_zoneid)) { 2419 2420 ASSERT(tconnp != connp); 2421 CONN_INC_REF(tconnp); 2422 mutex_exit(&connfp->connf_lock); 2423 return (tconnp); 2424 } 2425 } 2426 mutex_exit(&connfp->connf_lock); 2427 return (NULL); 2428 } 2429 2430 /* 2431 * Search for a peer TCP/IPv6 loopback conn by doing a reverse lookup on 2432 * the {src, dst, lport, fport} quadruplet. Returns with conn reference 2433 * held; caller must call CONN_DEC_REF. Only checks for connected entries 2434 * (peer tcp in ESTABLISHED state). 2435 */ 2436 conn_t * 2437 ipcl_conn_tcp_lookup_reversed_ipv6(conn_t *connp, ip6_t *ip6h, tcph_t *tcph, 2438 ip_stack_t *ipst) 2439 { 2440 uint32_t ports; 2441 uint16_t *pports = (uint16_t *)&ports; 2442 connf_t *connfp; 2443 conn_t *tconnp; 2444 boolean_t zone_chk; 2445 2446 /* 2447 * If either the source of destination address is loopback, then 2448 * both endpoints must be in the same Zone. Otherwise, both of 2449 * the addresses are system-wide unique (tcp is in ESTABLISHED 2450 * state) and the endpoints may reside in different Zones. We 2451 * don't do Zone check for link local address(es) because the 2452 * current Zone implementation treats each link local address as 2453 * being unique per system node, i.e. they belong to global Zone. 2454 */ 2455 zone_chk = (IN6_IS_ADDR_LOOPBACK(&ip6h->ip6_src) || 2456 IN6_IS_ADDR_LOOPBACK(&ip6h->ip6_dst)); 2457 2458 bcopy(tcph->th_fport, &pports[0], sizeof (uint16_t)); 2459 bcopy(tcph->th_lport, &pports[1], sizeof (uint16_t)); 2460 2461 connfp = &ipst->ips_ipcl_conn_fanout[IPCL_CONN_HASH_V6(ip6h->ip6_dst, 2462 ports, ipst)]; 2463 2464 mutex_enter(&connfp->connf_lock); 2465 for (tconnp = connfp->connf_head; tconnp != NULL; 2466 tconnp = tconnp->conn_next) { 2467 2468 /* We skip tcp_bound_if check here as this is loopback tcp */ 2469 if (IPCL_CONN_MATCH_V6(tconnp, IPPROTO_TCP, 2470 ip6h->ip6_dst, ip6h->ip6_src, ports) && 2471 tconnp->conn_tcp->tcp_state == TCPS_ESTABLISHED && 2472 (!zone_chk || tconnp->conn_zoneid == connp->conn_zoneid)) { 2473 2474 ASSERT(tconnp != connp); 2475 CONN_INC_REF(tconnp); 2476 mutex_exit(&connfp->connf_lock); 2477 return (tconnp); 2478 } 2479 } 2480 mutex_exit(&connfp->connf_lock); 2481 return (NULL); 2482 } 2483 2484 /* 2485 * Find an exact {src, dst, lport, fport} match for a bounced datagram. 2486 * Returns with conn reference held. Caller must call CONN_DEC_REF. 2487 * Only checks for connected entries i.e. no INADDR_ANY checks. 2488 */ 2489 conn_t * 2490 ipcl_tcp_lookup_reversed_ipv4(ipha_t *ipha, tcph_t *tcph, int min_state, 2491 ip_stack_t *ipst) 2492 { 2493 uint32_t ports; 2494 uint16_t *pports; 2495 connf_t *connfp; 2496 conn_t *tconnp; 2497 2498 pports = (uint16_t *)&ports; 2499 bcopy(tcph->th_fport, &pports[0], sizeof (uint16_t)); 2500 bcopy(tcph->th_lport, &pports[1], sizeof (uint16_t)); 2501 2502 connfp = &ipst->ips_ipcl_conn_fanout[IPCL_CONN_HASH(ipha->ipha_dst, 2503 ports, ipst)]; 2504 2505 mutex_enter(&connfp->connf_lock); 2506 for (tconnp = connfp->connf_head; tconnp != NULL; 2507 tconnp = tconnp->conn_next) { 2508 2509 if (IPCL_CONN_MATCH(tconnp, IPPROTO_TCP, 2510 ipha->ipha_dst, ipha->ipha_src, ports) && 2511 tconnp->conn_tcp->tcp_state >= min_state) { 2512 2513 CONN_INC_REF(tconnp); 2514 mutex_exit(&connfp->connf_lock); 2515 return (tconnp); 2516 } 2517 } 2518 mutex_exit(&connfp->connf_lock); 2519 return (NULL); 2520 } 2521 2522 /* 2523 * Find an exact {src, dst, lport, fport} match for a bounced datagram. 2524 * Returns with conn reference held. Caller must call CONN_DEC_REF. 2525 * Only checks for connected entries i.e. no INADDR_ANY checks. 2526 * Match on ifindex in addition to addresses. 2527 */ 2528 conn_t * 2529 ipcl_tcp_lookup_reversed_ipv6(ip6_t *ip6h, tcpha_t *tcpha, int min_state, 2530 uint_t ifindex, ip_stack_t *ipst) 2531 { 2532 tcp_t *tcp; 2533 uint32_t ports; 2534 uint16_t *pports; 2535 connf_t *connfp; 2536 conn_t *tconnp; 2537 2538 pports = (uint16_t *)&ports; 2539 pports[0] = tcpha->tha_fport; 2540 pports[1] = tcpha->tha_lport; 2541 2542 connfp = &ipst->ips_ipcl_conn_fanout[IPCL_CONN_HASH_V6(ip6h->ip6_dst, 2543 ports, ipst)]; 2544 2545 mutex_enter(&connfp->connf_lock); 2546 for (tconnp = connfp->connf_head; tconnp != NULL; 2547 tconnp = tconnp->conn_next) { 2548 2549 tcp = tconnp->conn_tcp; 2550 if (IPCL_CONN_MATCH_V6(tconnp, IPPROTO_TCP, 2551 ip6h->ip6_dst, ip6h->ip6_src, ports) && 2552 tcp->tcp_state >= min_state && 2553 (tcp->tcp_bound_if == 0 || 2554 tcp->tcp_bound_if == ifindex)) { 2555 2556 CONN_INC_REF(tconnp); 2557 mutex_exit(&connfp->connf_lock); 2558 return (tconnp); 2559 } 2560 } 2561 mutex_exit(&connfp->connf_lock); 2562 return (NULL); 2563 } 2564 2565 /* 2566 * Finds a TCP/IPv4 listening connection; called by tcp_disconnect to locate 2567 * a listener when changing state. 2568 */ 2569 conn_t * 2570 ipcl_lookup_listener_v4(uint16_t lport, ipaddr_t laddr, zoneid_t zoneid, 2571 ip_stack_t *ipst) 2572 { 2573 connf_t *bind_connfp; 2574 conn_t *connp; 2575 tcp_t *tcp; 2576 2577 /* 2578 * Avoid false matches for packets sent to an IP destination of 2579 * all zeros. 2580 */ 2581 if (laddr == 0) 2582 return (NULL); 2583 2584 ASSERT(zoneid != ALL_ZONES); 2585 2586 bind_connfp = &ipst->ips_ipcl_bind_fanout[IPCL_BIND_HASH(lport, ipst)]; 2587 mutex_enter(&bind_connfp->connf_lock); 2588 for (connp = bind_connfp->connf_head; connp != NULL; 2589 connp = connp->conn_next) { 2590 tcp = connp->conn_tcp; 2591 if (IPCL_BIND_MATCH(connp, IPPROTO_TCP, laddr, lport) && 2592 IPCL_ZONE_MATCH(connp, zoneid) && 2593 (tcp->tcp_listener == NULL)) { 2594 CONN_INC_REF(connp); 2595 mutex_exit(&bind_connfp->connf_lock); 2596 return (connp); 2597 } 2598 } 2599 mutex_exit(&bind_connfp->connf_lock); 2600 return (NULL); 2601 } 2602 2603 /* 2604 * Finds a TCP/IPv6 listening connection; called by tcp_disconnect to locate 2605 * a listener when changing state. 2606 */ 2607 conn_t * 2608 ipcl_lookup_listener_v6(uint16_t lport, in6_addr_t *laddr, uint_t ifindex, 2609 zoneid_t zoneid, ip_stack_t *ipst) 2610 { 2611 connf_t *bind_connfp; 2612 conn_t *connp = NULL; 2613 tcp_t *tcp; 2614 2615 /* 2616 * Avoid false matches for packets sent to an IP destination of 2617 * all zeros. 2618 */ 2619 if (IN6_IS_ADDR_UNSPECIFIED(laddr)) 2620 return (NULL); 2621 2622 ASSERT(zoneid != ALL_ZONES); 2623 2624 bind_connfp = &ipst->ips_ipcl_bind_fanout[IPCL_BIND_HASH(lport, ipst)]; 2625 mutex_enter(&bind_connfp->connf_lock); 2626 for (connp = bind_connfp->connf_head; connp != NULL; 2627 connp = connp->conn_next) { 2628 tcp = connp->conn_tcp; 2629 if (IPCL_BIND_MATCH_V6(connp, IPPROTO_TCP, *laddr, lport) && 2630 IPCL_ZONE_MATCH(connp, zoneid) && 2631 (tcp->tcp_bound_if == 0 || 2632 tcp->tcp_bound_if == ifindex) && 2633 tcp->tcp_listener == NULL) { 2634 CONN_INC_REF(connp); 2635 mutex_exit(&bind_connfp->connf_lock); 2636 return (connp); 2637 } 2638 } 2639 mutex_exit(&bind_connfp->connf_lock); 2640 return (NULL); 2641 } 2642 2643 /* 2644 * ipcl_get_next_conn 2645 * get the next entry in the conn global list 2646 * and put a reference on the next_conn. 2647 * decrement the reference on the current conn. 2648 * 2649 * This is an iterator based walker function that also provides for 2650 * some selection by the caller. It walks through the conn_hash bucket 2651 * searching for the next valid connp in the list, and selects connections 2652 * that are neither closed nor condemned. It also REFHOLDS the conn 2653 * thus ensuring that the conn exists when the caller uses the conn. 2654 */ 2655 conn_t * 2656 ipcl_get_next_conn(connf_t *connfp, conn_t *connp, uint32_t conn_flags) 2657 { 2658 conn_t *next_connp; 2659 2660 if (connfp == NULL) 2661 return (NULL); 2662 2663 mutex_enter(&connfp->connf_lock); 2664 2665 next_connp = (connp == NULL) ? 2666 connfp->connf_head : connp->conn_g_next; 2667 2668 while (next_connp != NULL) { 2669 mutex_enter(&next_connp->conn_lock); 2670 if (!(next_connp->conn_flags & conn_flags) || 2671 (next_connp->conn_state_flags & 2672 (CONN_CONDEMNED | CONN_INCIPIENT))) { 2673 /* 2674 * This conn has been condemned or 2675 * is closing, or the flags don't match 2676 */ 2677 mutex_exit(&next_connp->conn_lock); 2678 next_connp = next_connp->conn_g_next; 2679 continue; 2680 } 2681 CONN_INC_REF_LOCKED(next_connp); 2682 mutex_exit(&next_connp->conn_lock); 2683 break; 2684 } 2685 2686 mutex_exit(&connfp->connf_lock); 2687 2688 if (connp != NULL) 2689 CONN_DEC_REF(connp); 2690 2691 return (next_connp); 2692 } 2693 2694 #ifdef CONN_DEBUG 2695 /* 2696 * Trace of the last NBUF refhold/refrele 2697 */ 2698 int 2699 conn_trace_ref(conn_t *connp) 2700 { 2701 int last; 2702 conn_trace_t *ctb; 2703 2704 ASSERT(MUTEX_HELD(&connp->conn_lock)); 2705 last = connp->conn_trace_last; 2706 last++; 2707 if (last == CONN_TRACE_MAX) 2708 last = 0; 2709 2710 ctb = &connp->conn_trace_buf[last]; 2711 ctb->ctb_depth = getpcstack(ctb->ctb_stack, CONN_STACK_DEPTH); 2712 connp->conn_trace_last = last; 2713 return (1); 2714 } 2715 2716 int 2717 conn_untrace_ref(conn_t *connp) 2718 { 2719 int last; 2720 conn_trace_t *ctb; 2721 2722 ASSERT(MUTEX_HELD(&connp->conn_lock)); 2723 last = connp->conn_trace_last; 2724 last++; 2725 if (last == CONN_TRACE_MAX) 2726 last = 0; 2727 2728 ctb = &connp->conn_trace_buf[last]; 2729 ctb->ctb_depth = getpcstack(ctb->ctb_stack, CONN_STACK_DEPTH); 2730 connp->conn_trace_last = last; 2731 return (1); 2732 } 2733 #endif 2734