1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright 2009 Sun Microsystems, Inc. All rights reserved. 23 * Use is subject to license terms. 24 */ 25 26 #ifndef _INET_IPCLASSIFIER_H 27 #define _INET_IPCLASSIFIER_H 28 29 #ifdef __cplusplus 30 extern "C" { 31 #endif 32 33 #include <inet/common.h> 34 #include <inet/ip.h> 35 #include <inet/mi.h> 36 #include <inet/tcp.h> 37 #include <inet/ip6.h> 38 #include <netinet/in.h> /* for IPPROTO_* constants */ 39 #include <sys/sdt.h> 40 #include <sys/socket_proto.h> 41 #include <sys/sunddi.h> 42 #include <sys/sunldi.h> 43 44 typedef void (*edesc_spf)(void *, mblk_t *, void *, int); 45 typedef void (*edesc_rpf)(void *, mblk_t *, void *); 46 47 /* 48 * ============================== 49 * = The CONNECTION = 50 * ============================== 51 */ 52 53 /* 54 * The connection structure contains the common information/flags/ref needed. 55 * Implementation will keep the connection struct, the layers (with their 56 * respective data for event i.e. tcp_t if event was tcp_input) all in one 57 * contiguous memory location. 58 */ 59 60 /* Conn Flags */ 61 /* Unused 0x00020000 */ 62 /* Unused 0x00040000 */ 63 #define IPCL_FULLY_BOUND 0x00080000 /* Bound to correct squeue */ 64 #define IPCL_CHECK_POLICY 0x00100000 /* Needs policy checking */ 65 #define IPCL_SOCKET 0x00200000 /* Sockfs connection */ 66 #define IPCL_ACCEPTOR 0x00400000 /* Sockfs priv acceptor */ 67 #define IPCL_CL_LISTENER 0x00800000 /* Cluster listener */ 68 #define IPCL_EAGER 0x01000000 /* Incoming connection */ 69 /* Unused 0x02000000 */ 70 #define IPCL_TCP6 0x04000000 /* AF_INET6 TCP */ 71 #define IPCL_TCP4 0x08000000 /* IPv4 packet format TCP */ 72 /* Unused 0x10000000 */ 73 /* Unused 0x20000000 */ 74 #define IPCL_CONNECTED 0x40000000 /* Conn in connected table */ 75 #define IPCL_BOUND 0x80000000 /* Conn in bind table */ 76 77 /* Flags identifying the type of conn */ 78 #define IPCL_TCPCONN 0x00000001 /* From tcp_conn_cache */ 79 #define IPCL_SCTPCONN 0x00000002 /* From sctp_conn_cache */ 80 #define IPCL_IPCCONN 0x00000004 /* From ip_conn_cache */ 81 #define IPCL_UDPCONN 0x00000008 /* From udp_conn_cache */ 82 #define IPCL_RAWIPCONN 0x00000010 /* From rawip_conn_cache */ 83 #define IPCL_RTSCONN 0x00000020 /* From rts_conn_cache */ 84 /* Unused 0x00000040 */ 85 #define IPCL_IPTUN 0x00000080 /* iptun module above us */ 86 #define IPCL_NONSTR 0x00001000 /* A non-STREAMS socket */ 87 #define IPCL_IN_SQUEUE 0x10000000 /* Waiting squeue to finish */ 88 89 /* Conn Masks */ 90 #define IPCL_TCP (IPCL_TCP4|IPCL_TCP6) 91 #define IPCL_REMOVED 0x00000100 92 #define IPCL_REUSED 0x00000200 93 94 /* The packet format is IPv4; could be an AF_INET or AF_INET6 socket */ 95 #define IPCL_IS_TCP4(connp) \ 96 (((connp)->conn_flags & IPCL_TCP4)) 97 98 /* Connected AF_INET with no IPsec policy */ 99 #define IPCL_IS_TCP4_CONNECTED_NO_POLICY(connp) \ 100 (((connp)->conn_flags & \ 101 (IPCL_TCP4|IPCL_CONNECTED|IPCL_CHECK_POLICY|IPCL_TCP6)) \ 102 == (IPCL_TCP4|IPCL_CONNECTED)) 103 104 #define IPCL_IS_CONNECTED(connp) \ 105 ((connp)->conn_flags & IPCL_CONNECTED) 106 107 #define IPCL_IS_BOUND(connp) \ 108 ((connp)->conn_flags & IPCL_BOUND) 109 110 /* AF_INET TCP that is bound */ 111 #define IPCL_IS_TCP4_BOUND(connp) \ 112 (((connp)->conn_flags & \ 113 (IPCL_TCP4|IPCL_BOUND|IPCL_TCP6)) == \ 114 (IPCL_TCP4|IPCL_BOUND)) 115 116 #define IPCL_IS_FULLY_BOUND(connp) \ 117 ((connp)->conn_flags & IPCL_FULLY_BOUND) 118 119 /* 120 * Can't use conn_protocol since we need to tell difference 121 * between a real TCP socket and a SOCK_RAW, IPPROTO_TCP. 122 */ 123 #define IPCL_IS_TCP(connp) \ 124 ((connp)->conn_flags & IPCL_TCPCONN) 125 126 #define IPCL_IS_SCTP(connp) \ 127 ((connp)->conn_flags & IPCL_SCTPCONN) 128 129 #define IPCL_IS_UDP(connp) \ 130 ((connp)->conn_flags & IPCL_UDPCONN) 131 132 #define IPCL_IS_RAWIP(connp) \ 133 ((connp)->conn_flags & IPCL_RAWIPCONN) 134 135 #define IPCL_IS_RTS(connp) \ 136 ((connp)->conn_flags & IPCL_RTSCONN) 137 138 #define IPCL_IS_IPTUN(connp) \ 139 ((connp)->conn_flags & IPCL_IPTUN) 140 141 #define IPCL_IS_NONSTR(connp) ((connp)->conn_flags & IPCL_NONSTR) 142 143 typedef struct connf_s connf_t; 144 145 typedef struct 146 { 147 int ctb_depth; 148 #define CONN_STACK_DEPTH 15 149 pc_t ctb_stack[CONN_STACK_DEPTH]; 150 } conn_trace_t; 151 152 typedef struct ip_helper_minor_info_s { 153 dev_t ip_minfo_dev; /* Device */ 154 vmem_t *ip_minfo_arena; /* Arena */ 155 } ip_helper_minfo_t; 156 157 /* 158 * ip helper stream info 159 */ 160 typedef struct ip_helper_stream_info_s { 161 ldi_handle_t iphs_handle; 162 queue_t *iphs_rq; 163 queue_t *iphs_wq; 164 ip_helper_minfo_t *iphs_minfo; 165 } ip_helper_stream_info_t; 166 167 /* 168 * Mandatory Access Control mode, in conn_t's conn_mac_mode field. 169 * CONN_MAC_DEFAULT: strict enforcement of MAC. 170 * CONN_MAC_AWARE: allows communications between unlabeled systems 171 * and privileged daemons 172 * CONN_MAC_IMPLICIT: allows communications without explicit labels 173 * on the wire with privileged daemons. 174 * 175 * CONN_MAC_IMPLICIT is intended specifically for labeled IPsec key management 176 * in networks which don't pass CIPSO-labeled packets. 177 */ 178 #define CONN_MAC_DEFAULT 0 179 #define CONN_MAC_AWARE 1 180 #define CONN_MAC_IMPLICIT 2 181 182 /* 183 * The initial fields in the conn_t are setup by the kmem_cache constructor, 184 * and are preserved when it is freed. Fields after that are bzero'ed when 185 * the conn_t is freed. 186 */ 187 struct conn_s { 188 kmutex_t conn_lock; 189 uint32_t conn_ref; /* Reference counter */ 190 uint32_t conn_flags; /* Conn Flags */ 191 192 193 union { 194 tcp_t *cp_tcp; /* Pointer to the tcp struct */ 195 struct udp_s *cp_udp; /* Pointer to the udp struct */ 196 struct icmp_s *cp_icmp; /* Pointer to rawip struct */ 197 struct rts_s *cp_rts; /* Pointer to rts struct */ 198 struct iptun_s *cp_iptun; /* Pointer to iptun_t */ 199 void *cp_priv; 200 } conn_proto_priv; 201 #define conn_tcp conn_proto_priv.cp_tcp 202 #define conn_udp conn_proto_priv.cp_udp 203 #define conn_icmp conn_proto_priv.cp_icmp 204 #define conn_rts conn_proto_priv.cp_rts 205 #define conn_iptun conn_proto_priv.cp_iptun 206 #define conn_priv conn_proto_priv.cp_priv 207 208 kcondvar_t conn_cv; 209 uint8_t conn_ulp; /* protocol type */ 210 211 edesc_rpf conn_recv; /* Pointer to recv routine */ 212 213 /* Fields after this are bzero'ed when the conn_t is freed. */ 214 215 squeue_t *conn_sqp; /* Squeue for processing */ 216 uint_t conn_state_flags; /* IP state flags */ 217 #define conn_start_clr conn_state_flags 218 219 ire_t *conn_ire_cache; /* outbound ire cache */ 220 unsigned int 221 conn_on_sqp : 1, /* Conn is being processed */ 222 conn_dontroute : 1, /* SO_DONTROUTE state */ 223 conn_loopback : 1, /* SO_LOOPBACK state */ 224 conn_broadcast : 1, /* SO_BROADCAST state */ 225 226 conn_reuseaddr : 1, /* SO_REUSEADDR state */ 227 conn_multicast_loop : 1, /* IP_MULTICAST_LOOP */ 228 conn_multi_router : 1, /* Wants all multicast pkts */ 229 conn_draining : 1, /* ip_wsrv running */ 230 231 conn_did_putbq : 1, /* ip_wput did a putbq */ 232 conn_unspec_src : 1, /* IP_UNSPEC_SRC */ 233 conn_policy_cached : 1, /* Is policy cached/latched ? */ 234 conn_in_enforce_policy : 1, /* Enforce Policy on inbound */ 235 236 conn_out_enforce_policy : 1, /* Enforce Policy on outbound */ 237 conn_af_isv6 : 1, /* ip address family ver 6 */ 238 conn_pkt_isv6 : 1, /* ip packet format ver 6 */ 239 conn_ip_recvpktinfo : 1, /* IPV*_RECVPKTINFO option */ 240 241 conn_ipv6_recvhoplimit : 1, /* IPV6_RECVHOPLIMIT option */ 242 conn_ipv6_recvhopopts : 1, /* IPV6_RECVHOPOPTS option */ 243 conn_ipv6_recvdstopts : 1, /* IPV6_RECVDSTOPTS option */ 244 conn_ipv6_recvrthdr : 1, /* IPV6_RECVRTHDR option */ 245 246 conn_ipv6_recvrtdstopts : 1, /* IPV6_RECVRTHDRDSTOPTS */ 247 conn_ipv6_v6only : 1, /* IPV6_V6ONLY */ 248 conn_ipv6_recvtclass : 1, /* IPV6_RECVTCLASS */ 249 conn_ipv6_recvpathmtu : 1, /* IPV6_RECVPATHMTU */ 250 251 conn_pathmtu_valid : 1, /* The cached mtu is valid. */ 252 conn_ipv6_dontfrag : 1, /* IPV6_DONTFRAG */ 253 conn_fully_bound : 1, /* Fully bound connection */ 254 conn_recvif : 1, /* IP_RECVIF option */ 255 256 conn_recvslla : 1, /* IP_RECVSLLA option */ 257 conn_mdt_ok : 1, /* MDT is permitted */ 258 conn_nexthop_set : 1, 259 conn_allzones : 1; /* SO_ALLZONES */ 260 261 unsigned int 262 conn_lso_ok : 1; /* LSO is usable */ 263 boolean_t conn_direct_blocked; /* conn is flow-controlled */ 264 265 squeue_t *conn_initial_sqp; /* Squeue at open time */ 266 squeue_t *conn_final_sqp; /* Squeue after connect */ 267 ill_t *conn_dhcpinit_ill; /* IP_DHCPINIT_IF */ 268 ipsec_latch_t *conn_latch; /* latched state */ 269 ill_t *conn_outgoing_ill; /* IP{,V6}_BOUND_IF */ 270 edesc_spf conn_send; /* Pointer to send routine */ 271 queue_t *conn_rq; /* Read queue */ 272 queue_t *conn_wq; /* Write queue */ 273 dev_t conn_dev; /* Minor number */ 274 vmem_t *conn_minor_arena; /* Minor arena */ 275 ip_helper_stream_info_t *conn_helper_info; 276 277 cred_t *conn_cred; /* Credentials */ 278 connf_t *conn_g_fanout; /* Global Hash bucket head */ 279 struct conn_s *conn_g_next; /* Global Hash chain next */ 280 struct conn_s *conn_g_prev; /* Global Hash chain prev */ 281 struct ipsec_policy_head_s *conn_policy; /* Configured policy */ 282 in6_addr_t conn_bound_source_v6; 283 #define conn_bound_source V4_PART_OF_V6(conn_bound_source_v6) 284 285 connf_t *conn_fanout; /* Hash bucket we're part of */ 286 struct conn_s *conn_next; /* Hash chain next */ 287 struct conn_s *conn_prev; /* Hash chain prev */ 288 struct { 289 in6_addr_t connua_laddr; /* Local address */ 290 in6_addr_t connua_faddr; /* Remote address */ 291 } connua_v6addr; 292 #define conn_src V4_PART_OF_V6(connua_v6addr.connua_laddr) 293 #define conn_rem V4_PART_OF_V6(connua_v6addr.connua_faddr) 294 #define conn_srcv6 connua_v6addr.connua_laddr 295 #define conn_remv6 connua_v6addr.connua_faddr 296 union { 297 /* Used for classifier match performance */ 298 uint32_t conn_ports2; 299 struct { 300 in_port_t tcpu_fport; /* Remote port */ 301 in_port_t tcpu_lport; /* Local port */ 302 } tcpu_ports; 303 } u_port; 304 #define conn_fport u_port.tcpu_ports.tcpu_fport 305 #define conn_lport u_port.tcpu_ports.tcpu_lport 306 #define conn_ports u_port.conn_ports2 307 #define conn_upq conn_rq 308 uint8_t conn_unused_byte; 309 310 uint_t conn_proto; /* SO_PROTOTYPE state */ 311 ill_t *conn_incoming_ill; /* IP{,V6}_BOUND_IF */ 312 ill_t *conn_oper_pending_ill; /* pending shared ioctl */ 313 314 ilg_t *conn_ilg; /* Group memberships */ 315 int conn_ilg_allocated; /* Number allocated */ 316 int conn_ilg_inuse; /* Number currently used */ 317 int conn_ilg_walker_cnt; /* No of ilg walkers */ 318 /* XXXX get rid of this, once ilg_delete_all is fixed */ 319 kcondvar_t conn_refcv; 320 321 struct ipif_s *conn_multicast_ipif; /* IP_MULTICAST_IF */ 322 ill_t *conn_multicast_ill; /* IPV6_MULTICAST_IF */ 323 struct conn_s *conn_drain_next; /* Next conn in drain list */ 324 struct conn_s *conn_drain_prev; /* Prev conn in drain list */ 325 idl_t *conn_idl; /* Ptr to the drain list head */ 326 mblk_t *conn_ipsec_opt_mp; /* ipsec option mblk */ 327 uint32_t conn_src_preferences; /* prefs for src addr select */ 328 /* mtuinfo from IPV6_PACKET_TOO_BIG conditional on conn_pathmtu_valid */ 329 struct ip6_mtuinfo mtuinfo; 330 zoneid_t conn_zoneid; /* zone connection is in */ 331 in6_addr_t conn_nexthop_v6; /* nexthop IP address */ 332 uchar_t conn_broadcast_ttl; /* IP_BROADCAST_TTL */ 333 #define conn_nexthop_v4 V4_PART_OF_V6(conn_nexthop_v6) 334 cred_t *conn_effective_cred; /* Effective TX credentials */ 335 int conn_rtaware; /* RT_AWARE sockopt value */ 336 kcondvar_t conn_sq_cv; /* For non-STREAMS socket IO */ 337 kthread_t *conn_sq_caller; /* Caller of squeue sync ops */ 338 sock_upcalls_t *conn_upcalls; /* Upcalls to sockfs */ 339 sock_upper_handle_t conn_upper_handle; /* Upper handle: sonode * */ 340 341 unsigned int 342 conn_ulp_labeled : 1, /* ULP label is synced */ 343 conn_mlp_type : 2, /* mlp_type_t; tsol/tndb.h */ 344 conn_anon_mlp : 1, /* user wants anon MLP */ 345 346 conn_anon_port : 1, /* user bound anonymously */ 347 conn_mac_mode : 2, /* normal/loose/implicit MAC */ 348 conn_spare : 26; 349 350 boolean_t conn_flow_cntrld; 351 netstack_t *conn_netstack; /* Corresponds to a netstack_hold */ 352 #ifdef CONN_DEBUG 353 #define CONN_TRACE_MAX 10 354 int conn_trace_last; /* ndx of last used tracebuf */ 355 conn_trace_t conn_trace_buf[CONN_TRACE_MAX]; 356 #endif 357 }; 358 359 /* 360 * These two macros are used by TX. First priority is SCM_UCRED having 361 * set the label in the mblk. Second priority is the open credentials with 362 * peer's label (aka conn_effective_cred). Last priority is the open 363 * credentials. BEST_CRED takes all three into account in the above order. 364 * CONN_CRED is for connection-oriented cases when we don't need to look 365 * at the mblk. 366 */ 367 #define CONN_CRED(connp) ((connp)->conn_effective_cred == NULL ? \ 368 (connp)->conn_cred : (connp)->conn_effective_cred) 369 #define BEST_CRED(mp, connp, pidp) ip_best_cred(mp, connp, pidp) 370 371 /* 372 * connf_t - connection fanout data. 373 * 374 * The hash tables and their linkage (conn_t.{hashnextp, hashprevp} are 375 * protected by the per-bucket lock. Each conn_t inserted in the list 376 * points back at the connf_t that heads the bucket. 377 */ 378 struct connf_s { 379 struct conn_s *connf_head; 380 kmutex_t connf_lock; 381 }; 382 383 #define CONN_INC_REF(connp) { \ 384 mutex_enter(&(connp)->conn_lock); \ 385 DTRACE_PROBE1(conn__inc__ref, conn_t *, connp); \ 386 ASSERT(conn_trace_ref(connp)); \ 387 (connp)->conn_ref++; \ 388 ASSERT((connp)->conn_ref != 0); \ 389 mutex_exit(&(connp)->conn_lock); \ 390 } 391 392 #define CONN_INC_REF_LOCKED(connp) { \ 393 DTRACE_PROBE1(conn__inc__ref, conn_t *, connp); \ 394 ASSERT(MUTEX_HELD(&(connp)->conn_lock)); \ 395 ASSERT(conn_trace_ref(connp)); \ 396 (connp)->conn_ref++; \ 397 ASSERT((connp)->conn_ref != 0); \ 398 } 399 400 #define CONN_DEC_REF(connp) { \ 401 mutex_enter(&(connp)->conn_lock); \ 402 DTRACE_PROBE1(conn__dec__ref, conn_t *, connp); \ 403 /* \ 404 * The squeue framework always does a CONN_DEC_REF after return \ 405 * from TCP. Hence the refcnt must be at least 2 if conn_on_sqp \ 406 * is B_TRUE and conn_ref is being decremented. This is to \ 407 * account for the mblk being currently processed. \ 408 */ \ 409 if ((connp)->conn_ref == 0 || \ 410 ((connp)->conn_ref == 1 && (connp)->conn_on_sqp)) \ 411 cmn_err(CE_PANIC, "CONN_DEC_REF: connp(%p) has ref " \ 412 "= %d\n", (void *)(connp), (connp)->conn_ref); \ 413 ASSERT(conn_untrace_ref(connp)); \ 414 (connp)->conn_ref--; \ 415 if ((connp)->conn_ref == 0) { \ 416 /* Refcnt can't increase again, safe to drop lock */ \ 417 mutex_exit(&(connp)->conn_lock); \ 418 ipcl_conn_destroy(connp); \ 419 } else { \ 420 cv_broadcast(&(connp)->conn_cv); \ 421 mutex_exit(&(connp)->conn_lock); \ 422 } \ 423 } 424 425 /* 426 * For use with subsystems within ip which use ALL_ZONES as a wildcard 427 */ 428 #define IPCL_ZONEID(connp) \ 429 ((connp)->conn_allzones ? ALL_ZONES : (connp)->conn_zoneid) 430 431 /* 432 * For matching between a conn_t and a zoneid. 433 */ 434 #define IPCL_ZONE_MATCH(connp, zoneid) \ 435 (((connp)->conn_allzones) || \ 436 ((zoneid) == ALL_ZONES) || \ 437 (connp)->conn_zoneid == (zoneid)) 438 439 /* 440 * On a labeled system, we must treat bindings to ports 441 * on shared IP addresses by sockets with MAC exemption 442 * privilege as being in all zones, as there's 443 * otherwise no way to identify the right receiver. 444 */ 445 446 #define IPCL_CONNS_MAC(conn1, conn2) \ 447 (((conn1)->conn_mac_mode != CONN_MAC_DEFAULT) || \ 448 ((conn2)->conn_mac_mode != CONN_MAC_DEFAULT)) 449 450 #define IPCL_BIND_ZONE_MATCH(conn1, conn2) \ 451 (IPCL_CONNS_MAC(conn1, conn2) || \ 452 IPCL_ZONE_MATCH(conn1, conn2->conn_zoneid) || \ 453 IPCL_ZONE_MATCH(conn2, conn1->conn_zoneid)) 454 455 456 #define _IPCL_V4_MATCH(v6addr, v4addr) \ 457 (V4_PART_OF_V6((v6addr)) == (v4addr) && IN6_IS_ADDR_V4MAPPED(&(v6addr))) 458 459 #define _IPCL_V4_MATCH_ANY(addr) \ 460 (IN6_IS_ADDR_V4MAPPED_ANY(&(addr)) || IN6_IS_ADDR_UNSPECIFIED(&(addr))) 461 462 463 /* 464 * IPCL_PROTO_MATCH() only matches conns with the specified zoneid, while 465 * IPCL_PROTO_MATCH_V6() can match other conns in the multicast case, see 466 * ip_fanout_proto(). 467 */ 468 #define IPCL_PROTO_MATCH(connp, protocol, ipha, ill, \ 469 fanout_flags, zoneid) \ 470 ((((connp)->conn_src == INADDR_ANY) || \ 471 (((connp)->conn_src == ((ipha)->ipha_dst)) && \ 472 (((connp)->conn_rem == INADDR_ANY) || \ 473 ((connp)->conn_rem == ((ipha)->ipha_src))))) && \ 474 IPCL_ZONE_MATCH(connp, zoneid) && \ 475 (conn_wantpacket((connp), (ill), (ipha), (fanout_flags), \ 476 (zoneid)) || ((protocol) == IPPROTO_PIM) || \ 477 ((protocol) == IPPROTO_RSVP))) 478 479 #define IPCL_PROTO_MATCH_V6(connp, protocol, ip6h, ill, \ 480 fanout_flags, zoneid) \ 481 ((IN6_IS_ADDR_UNSPECIFIED(&(connp)->conn_srcv6) || \ 482 (IN6_ARE_ADDR_EQUAL(&(connp)->conn_srcv6, &((ip6h)->ip6_dst)) && \ 483 (IN6_IS_ADDR_UNSPECIFIED(&(connp)->conn_remv6) || \ 484 IN6_ARE_ADDR_EQUAL(&(connp)->conn_remv6, &((ip6h)->ip6_src))))) && \ 485 (conn_wantpacket_v6((connp), (ill), (ip6h), \ 486 (fanout_flags), (zoneid)) || ((protocol) == IPPROTO_RSVP))) 487 488 #define IPCL_CONN_HASH(src, ports, ipst) \ 489 ((unsigned)(ntohl((src)) ^ ((ports) >> 24) ^ ((ports) >> 16) ^ \ 490 ((ports) >> 8) ^ (ports)) % (ipst)->ips_ipcl_conn_fanout_size) 491 492 #define IPCL_CONN_HASH_V6(src, ports, ipst) \ 493 IPCL_CONN_HASH(V4_PART_OF_V6((src)), (ports), (ipst)) 494 495 #define IPCL_CONN_MATCH(connp, proto, src, dst, ports) \ 496 ((connp)->conn_ulp == (proto) && \ 497 (connp)->conn_ports == (ports) && \ 498 _IPCL_V4_MATCH((connp)->conn_remv6, (src)) && \ 499 _IPCL_V4_MATCH((connp)->conn_srcv6, (dst)) && \ 500 !(connp)->conn_ipv6_v6only) 501 502 #define IPCL_CONN_MATCH_V6(connp, proto, src, dst, ports) \ 503 ((connp)->conn_ulp == (proto) && \ 504 (connp)->conn_ports == (ports) && \ 505 IN6_ARE_ADDR_EQUAL(&(connp)->conn_remv6, &(src)) && \ 506 IN6_ARE_ADDR_EQUAL(&(connp)->conn_srcv6, &(dst))) 507 508 #define IPCL_CONN_INIT(connp, protocol, src, rem, ports) { \ 509 (connp)->conn_ulp = protocol; \ 510 IN6_IPADDR_TO_V4MAPPED(src, &(connp)->conn_srcv6); \ 511 IN6_IPADDR_TO_V4MAPPED(rem, &(connp)->conn_remv6); \ 512 (connp)->conn_ports = ports; \ 513 } 514 515 #define IPCL_CONN_INIT_V6(connp, protocol, src, rem, ports) { \ 516 (connp)->conn_ulp = protocol; \ 517 (connp)->conn_srcv6 = src; \ 518 (connp)->conn_remv6 = rem; \ 519 (connp)->conn_ports = ports; \ 520 } 521 522 #define IPCL_PORT_HASH(port, size) \ 523 ((((port) >> 8) ^ (port)) & ((size) - 1)) 524 525 #define IPCL_BIND_HASH(lport, ipst) \ 526 ((unsigned)(((lport) >> 8) ^ (lport)) % \ 527 (ipst)->ips_ipcl_bind_fanout_size) 528 529 #define IPCL_BIND_MATCH(connp, proto, laddr, lport) \ 530 ((connp)->conn_ulp == (proto) && \ 531 (connp)->conn_lport == (lport) && \ 532 (_IPCL_V4_MATCH_ANY((connp)->conn_srcv6) || \ 533 _IPCL_V4_MATCH((connp)->conn_srcv6, (laddr))) && \ 534 !(connp)->conn_ipv6_v6only) 535 536 #define IPCL_BIND_MATCH_V6(connp, proto, laddr, lport) \ 537 ((connp)->conn_ulp == (proto) && \ 538 (connp)->conn_lport == (lport) && \ 539 (IN6_ARE_ADDR_EQUAL(&(connp)->conn_srcv6, &(laddr)) || \ 540 IN6_IS_ADDR_UNSPECIFIED(&(connp)->conn_srcv6))) 541 542 #define IPCL_UDP_MATCH(connp, lport, laddr, fport, faddr) \ 543 (((connp)->conn_lport == (lport)) && \ 544 ((_IPCL_V4_MATCH_ANY((connp)->conn_srcv6) || \ 545 (_IPCL_V4_MATCH((connp)->conn_srcv6, (laddr)) && \ 546 (_IPCL_V4_MATCH_ANY((connp)->conn_remv6) || \ 547 (_IPCL_V4_MATCH((connp)->conn_remv6, (faddr)) && \ 548 (connp)->conn_fport == (fport)))))) && \ 549 !(connp)->conn_ipv6_v6only) 550 551 #define IPCL_UDP_MATCH_V6(connp, lport, laddr, fport, faddr) \ 552 (((connp)->conn_lport == (lport)) && \ 553 (IN6_IS_ADDR_UNSPECIFIED(&(connp)->conn_srcv6) || \ 554 (IN6_ARE_ADDR_EQUAL(&(connp)->conn_srcv6, &(laddr)) && \ 555 (IN6_IS_ADDR_UNSPECIFIED(&(connp)->conn_remv6) || \ 556 (IN6_ARE_ADDR_EQUAL(&(connp)->conn_remv6, &(faddr)) && \ 557 (connp)->conn_fport == (fport)))))) 558 559 #define IPCL_IPTUN_HASH(laddr, faddr) \ 560 ((ntohl(laddr) ^ ((ntohl(faddr) << 24) | (ntohl(faddr) >> 8))) % \ 561 ipcl_iptun_fanout_size) 562 563 #define IPCL_IPTUN_HASH_V6(laddr, faddr) \ 564 IPCL_IPTUN_HASH((laddr)->s6_addr32[0] ^ (laddr)->s6_addr32[1] ^ \ 565 (faddr)->s6_addr32[2] ^ (faddr)->s6_addr32[3], \ 566 (faddr)->s6_addr32[0] ^ (faddr)->s6_addr32[1] ^ \ 567 (laddr)->s6_addr32[2] ^ (laddr)->s6_addr32[3]) 568 569 #define IPCL_IPTUN_MATCH(connp, laddr, faddr) \ 570 (_IPCL_V4_MATCH((connp)->conn_srcv6, (laddr)) && \ 571 _IPCL_V4_MATCH((connp)->conn_remv6, (faddr))) 572 573 #define IPCL_IPTUN_MATCH_V6(connp, laddr, faddr) \ 574 (IN6_ARE_ADDR_EQUAL(&(connp)->conn_srcv6, (laddr)) && \ 575 IN6_ARE_ADDR_EQUAL(&(connp)->conn_remv6, (faddr))) 576 577 #define IPCL_TCP_EAGER_INIT(connp, protocol, src, rem, ports) { \ 578 (connp)->conn_flags |= (IPCL_TCP4|IPCL_EAGER); \ 579 IN6_IPADDR_TO_V4MAPPED(src, &(connp)->conn_srcv6); \ 580 IN6_IPADDR_TO_V4MAPPED(rem, &(connp)->conn_remv6); \ 581 (connp)->conn_ports = ports; \ 582 (connp)->conn_send = ip_output; \ 583 (connp)->conn_sqp = IP_SQUEUE_GET(lbolt); \ 584 (connp)->conn_initial_sqp = (connp)->conn_sqp; \ 585 } 586 587 #define IPCL_TCP_EAGER_INIT_V6(connp, protocol, src, rem, ports) { \ 588 (connp)->conn_flags |= (IPCL_TCP6|IPCL_EAGER); \ 589 (connp)->conn_srcv6 = src; \ 590 (connp)->conn_remv6 = rem; \ 591 (connp)->conn_ports = ports; \ 592 (connp)->conn_send = ip_output_v6; \ 593 (connp)->conn_sqp = IP_SQUEUE_GET(lbolt); \ 594 (connp)->conn_initial_sqp = (connp)->conn_sqp; \ 595 } 596 597 #define IPCL_UDP_HASH(lport, ipst) \ 598 IPCL_PORT_HASH(lport, (ipst)->ips_ipcl_udp_fanout_size) 599 600 #define CONN_G_HASH_SIZE 1024 601 602 /* Raw socket hash function. */ 603 #define IPCL_RAW_HASH(lport, ipst) \ 604 IPCL_PORT_HASH(lport, (ipst)->ips_ipcl_raw_fanout_size) 605 606 /* 607 * This is similar to IPCL_BIND_MATCH except that the local port check 608 * is changed to a wildcard port check. 609 */ 610 #define IPCL_RAW_MATCH(connp, proto, laddr) \ 611 ((connp)->conn_ulp == (proto) && \ 612 (connp)->conn_lport == 0 && \ 613 (_IPCL_V4_MATCH_ANY((connp)->conn_srcv6) || \ 614 _IPCL_V4_MATCH((connp)->conn_srcv6, (laddr)))) 615 616 #define IPCL_RAW_MATCH_V6(connp, proto, laddr) \ 617 ((connp)->conn_ulp == (proto) && \ 618 (connp)->conn_lport == 0 && \ 619 (IN6_IS_ADDR_UNSPECIFIED(&(connp)->conn_srcv6) || \ 620 IN6_ARE_ADDR_EQUAL(&(connp)->conn_srcv6, &(laddr)))) 621 622 /* Function prototypes */ 623 extern void ipcl_g_init(void); 624 extern void ipcl_init(ip_stack_t *); 625 extern void ipcl_g_destroy(void); 626 extern void ipcl_destroy(ip_stack_t *); 627 extern conn_t *ipcl_conn_create(uint32_t, int, netstack_t *); 628 extern void ipcl_conn_destroy(conn_t *); 629 630 void ipcl_hash_insert_wildcard(connf_t *, conn_t *); 631 void ipcl_hash_remove(conn_t *); 632 void ipcl_hash_remove_locked(conn_t *connp, connf_t *connfp); 633 634 extern int ipcl_bind_insert(conn_t *, uint8_t, ipaddr_t, uint16_t); 635 extern int ipcl_bind_insert_v6(conn_t *, uint8_t, const in6_addr_t *, 636 uint16_t); 637 extern int ipcl_conn_insert(conn_t *, uint8_t, ipaddr_t, ipaddr_t, 638 uint32_t); 639 extern int ipcl_conn_insert_v6(conn_t *, uint8_t, const in6_addr_t *, 640 const in6_addr_t *, uint32_t, uint_t); 641 extern conn_t *ipcl_get_next_conn(connf_t *, conn_t *, uint32_t); 642 643 void ipcl_proto_insert(conn_t *, uint8_t); 644 void ipcl_proto_insert_v6(conn_t *, uint8_t); 645 conn_t *ipcl_classify_v4(mblk_t *, uint8_t, uint_t, zoneid_t, ip_stack_t *); 646 conn_t *ipcl_classify_v6(mblk_t *, uint8_t, uint_t, zoneid_t, ip_stack_t *); 647 conn_t *ipcl_classify(mblk_t *, zoneid_t, ip_stack_t *); 648 conn_t *ipcl_classify_raw(mblk_t *, uint8_t, zoneid_t, uint32_t, ipha_t *, 649 ip_stack_t *); 650 conn_t *ipcl_iptun_classify_v4(ipaddr_t *, ipaddr_t *, ip_stack_t *); 651 conn_t *ipcl_iptun_classify_v6(in6_addr_t *, in6_addr_t *, ip_stack_t *); 652 void ipcl_globalhash_insert(conn_t *); 653 void ipcl_globalhash_remove(conn_t *); 654 void ipcl_walk(pfv_t, void *, ip_stack_t *); 655 conn_t *ipcl_tcp_lookup_reversed_ipv4(ipha_t *, tcph_t *, int, ip_stack_t *); 656 conn_t *ipcl_tcp_lookup_reversed_ipv6(ip6_t *, tcpha_t *, int, uint_t, 657 ip_stack_t *); 658 conn_t *ipcl_lookup_listener_v4(uint16_t, ipaddr_t, zoneid_t, ip_stack_t *); 659 conn_t *ipcl_lookup_listener_v6(uint16_t, in6_addr_t *, uint_t, zoneid_t, 660 ip_stack_t *); 661 int conn_trace_ref(conn_t *); 662 int conn_untrace_ref(conn_t *); 663 void ipcl_conn_cleanup(conn_t *); 664 conn_t *ipcl_conn_tcp_lookup_reversed_ipv4(conn_t *, ipha_t *, tcph_t *, 665 ip_stack_t *); 666 conn_t *ipcl_conn_tcp_lookup_reversed_ipv6(conn_t *, ip6_t *, tcph_t *, 667 ip_stack_t *); 668 669 extern int ip_create_helper_stream(conn_t *connp, ldi_ident_t li); 670 extern void ip_free_helper_stream(conn_t *connp); 671 672 extern int ip_get_options(conn_t *, int, int, void *, t_uscalar_t *, cred_t *); 673 extern int ip_set_options(conn_t *, int, int, const void *, t_uscalar_t, 674 cred_t *); 675 676 #ifdef __cplusplus 677 } 678 #endif 679 680 #endif /* _INET_IPCLASSIFIER_H */ 681