1 /*
   2  * CDDL HEADER START
   3  *
   4  * The contents of this file are subject to the terms of the
   5  * Common Development and Distribution License (the "License").
   6  * You may not use this file except in compliance with the License.
   7  *
   8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
   9  * or http://www.opensolaris.org/os/licensing.
  10  * See the License for the specific language governing permissions
  11  * and limitations under the License.
  12  *
  13  * When distributing Covered Code, include this CDDL HEADER in each
  14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  15  * If applicable, add the following below this CDDL HEADER, with the
  16  * fields enclosed by brackets "[]" replaced with your own identifying
  17  * information: Portions Copyright [yyyy] [name of copyright owner]
  18  *
  19  * CDDL HEADER END
  20  */
  21 /*
  22  * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
  23  * Use is subject to license terms.
  24  */
  25 
  26 #ifndef _INET_IPCLASSIFIER_H
  27 #define _INET_IPCLASSIFIER_H
  28 
  29 #ifdef  __cplusplus
  30 extern "C" {
  31 #endif
  32 
  33 #include <inet/common.h>
  34 #include <inet/ip.h>
  35 #include <inet/mi.h>
  36 #include <inet/tcp.h>
  37 #include <inet/ip6.h>
  38 #include <netinet/in.h>           /* for IPPROTO_* constants */
  39 #include <sys/sdt.h>
  40 #include <sys/socket_proto.h>
  41 #include <sys/sunddi.h>
  42 #include <sys/sunldi.h>
  43 
  44 typedef void (*edesc_rpf)(void *, mblk_t *, void *, ip_recv_attr_t *);
  45 struct icmph_s;
  46 struct icmp6_hdr;
  47 typedef boolean_t (*edesc_vpf)(conn_t *, void *, struct icmph_s *,
  48     struct icmp6_hdr *, ip_recv_attr_t *);
  49 
  50 /*
  51  * ==============================
  52  * =    The CONNECTION          =
  53  * ==============================
  54  */
  55 
  56 /*
  57  * The connection structure contains the common information/flags/ref needed.
  58  * Implementation will keep the connection struct, the layers (with their
  59  * respective data for event i.e. tcp_t if event was tcp_input_data) all in one
  60  * contiguous memory location.
  61  */
  62 
  63 /* Conn Flags */
  64 /* Unused                       0x00020000 */
  65 /* Unused                       0x00040000 */
  66 #define IPCL_FULLY_BOUND        0x00080000      /* Bound to correct squeue */
  67 /* Unused                       0x00100000 */
  68 /* Unused                       0x00200000 */
  69 /* Unused                       0x00400000 */
  70 #define IPCL_CL_LISTENER        0x00800000      /* Cluster listener */
  71 /* Unused                       0x01000000 */
  72 /* Unused                       0x02000000 */
  73 /* Unused                       0x04000000 */
  74 /* Unused                       0x08000000 */
  75 /* Unused                       0x10000000 */
  76 /* Unused                       0x20000000 */
  77 #define IPCL_CONNECTED          0x40000000      /* Conn in connected table */
  78 #define IPCL_BOUND              0x80000000      /* Conn in bind table */
  79 
  80 /* Flags identifying the type of conn */
  81 #define IPCL_TCPCONN            0x00000001      /* From tcp_conn_cache */
  82 #define IPCL_SCTPCONN           0x00000002      /* From sctp_conn_cache */
  83 #define IPCL_IPCCONN            0x00000004      /* From ip_conn_cache */
  84 #define IPCL_UDPCONN            0x00000008      /* From udp_conn_cache */
  85 #define IPCL_RAWIPCONN          0x00000010      /* From rawip_conn_cache */
  86 #define IPCL_RTSCONN            0x00000020      /* From rts_conn_cache */
  87 #define IPCL_DCCPCONN           0x00000040      /* From dccp_conn_cache */
  88 #define IPCL_IPTUN              0x00000080      /* iptun module above us */
  89 
  90 #define IPCL_NONSTR             0x00001000      /* A non-STREAMS socket */
  91 /* Unused                       0x10000000 */
  92 
  93 #define IPCL_REMOVED            0x00000100
  94 #define IPCL_REUSED             0x00000200
  95 
  96 #define IPCL_IS_CONNECTED(connp)                                        \
  97         ((connp)->conn_flags & IPCL_CONNECTED)
  98 
  99 #define IPCL_IS_BOUND(connp)                                            \
 100         ((connp)->conn_flags & IPCL_BOUND)
 101 
 102 /*
 103  * Can't use conn_proto since we need to tell difference
 104  * between a real TCP socket and a SOCK_RAW, IPPROTO_TCP.
 105  */
 106 #define IPCL_IS_TCP(connp)                                              \
 107         ((connp)->conn_flags & IPCL_TCPCONN)
 108 
 109 #define IPCL_IS_SCTP(connp)                                             \
 110         ((connp)->conn_flags & IPCL_SCTPCONN)
 111 
 112 #define IPCL_IS_UDP(connp)                                              \
 113         ((connp)->conn_flags & IPCL_UDPCONN)
 114 
 115 #define IPCL_IS_RAWIP(connp)                                            \
 116         ((connp)->conn_flags & IPCL_RAWIPCONN)
 117 
 118 #define IPCL_IS_RTS(connp)                                              \
 119         ((connp)->conn_flags & IPCL_RTSCONN)
 120 
 121 #define IPCL_IS_IPTUN(connp)                                            \
 122         ((connp)->conn_flags & IPCL_IPTUN)
 123 
 124 #define IPCL_IS_DCCP(connp)                                             \
 125         ((connp)->conn_flags & IPCL_DCCPCONN)
 126 
 127 #define IPCL_IS_NONSTR(connp)   ((connp)->conn_flags & IPCL_NONSTR)
 128 
 129 typedef struct connf_s connf_t;
 130 
 131 typedef struct
 132 {
 133         int     ctb_depth;
 134 #define CONN_STACK_DEPTH        15
 135         pc_t    ctb_stack[CONN_STACK_DEPTH];
 136 } conn_trace_t;
 137 
 138 typedef struct ip_helper_minor_info_s {
 139         dev_t   ip_minfo_dev;           /* Device */
 140         vmem_t  *ip_minfo_arena;        /* Arena */
 141 } ip_helper_minfo_t;
 142 
 143 /*
 144  * ip helper stream info
 145  */
 146 typedef struct ip_helper_stream_info_s {
 147         ldi_handle_t            iphs_handle;
 148         queue_t                 *iphs_rq;
 149         queue_t                 *iphs_wq;
 150         ip_helper_minfo_t       *iphs_minfo;
 151 } ip_helper_stream_info_t;
 152 
 153 /*
 154  * Mandatory Access Control mode, in conn_t's conn_mac_mode field.
 155  *      CONN_MAC_DEFAULT: strict enforcement of MAC.
 156  *      CONN_MAC_AWARE:   allows communications between unlabeled systems
 157  *                        and privileged daemons
 158  *      CONN_MAC_IMPLICIT: allows communications without explicit labels
 159  *                         on the wire with privileged daemons.
 160  *
 161  * CONN_MAC_IMPLICIT is intended specifically for labeled IPsec key management
 162  * in networks which don't pass CIPSO-labeled packets.
 163  */
 164 #define CONN_MAC_DEFAULT 0
 165 #define CONN_MAC_AWARE 1
 166 #define CONN_MAC_IMPLICIT 2
 167 
 168 /*
 169  * conn receive ancillary definition.
 170  *
 171  * These are the set of socket options that make the receive side
 172  * potentially pass up ancillary data items.
 173  * We have a union with an integer so that we can quickly check whether
 174  * any ancillary data items need to be added.
 175  */
 176 typedef struct crb_s {
 177         union {
 178                 uint32_t        crbu_all;
 179                 struct {
 180                         uint32_t
 181         crbb_recvdstaddr : 1,           /* IP_RECVDSTADDR option */
 182         crbb_recvopts : 1,              /* IP_RECVOPTS option */
 183         crbb_recvif : 1,                /* IP_RECVIF option */
 184         crbb_recvslla : 1,              /* IP_RECVSLLA option */
 185 
 186         crbb_recvttl : 1,               /* IP_RECVTTL option */
 187         crbb_ip_recvpktinfo : 1,        /* IP*_RECVPKTINFO option  */
 188         crbb_ipv6_recvhoplimit : 1,     /* IPV6_RECVHOPLIMIT option */
 189         crbb_ipv6_recvhopopts : 1,      /* IPV6_RECVHOPOPTS option */
 190 
 191         crbb_ipv6_recvdstopts : 1,      /* IPV6_RECVDSTOPTS option */
 192         crbb_ipv6_recvrthdr : 1,        /* IPV6_RECVRTHDR option */
 193         crbb_old_ipv6_recvdstopts : 1,  /* old form of IPV6_DSTOPTS */
 194         crbb_ipv6_recvrthdrdstopts : 1, /* IPV6_RECVRTHDRDSTOPTS */
 195 
 196         crbb_ipv6_recvtclass : 1,       /* IPV6_RECVTCLASS */
 197         crbb_recvucred : 1,             /* IP_RECVUCRED option */
 198         crbb_timestamp : 1;             /* SO_TIMESTAMP "socket" option */
 199 
 200                 } crbb;
 201         } crbu;
 202 } crb_t;
 203 
 204 #define crb_all                         crbu.crbu_all
 205 #define crb_recvdstaddr                 crbu.crbb.crbb_recvdstaddr
 206 #define crb_recvopts                    crbu.crbb.crbb_recvopts
 207 #define crb_recvif                      crbu.crbb.crbb_recvif
 208 #define crb_recvslla                    crbu.crbb.crbb_recvslla
 209 #define crb_recvttl                     crbu.crbb.crbb_recvttl
 210 #define crb_ip_recvpktinfo              crbu.crbb.crbb_ip_recvpktinfo
 211 #define crb_ipv6_recvhoplimit           crbu.crbb.crbb_ipv6_recvhoplimit
 212 #define crb_ipv6_recvhopopts            crbu.crbb.crbb_ipv6_recvhopopts
 213 #define crb_ipv6_recvdstopts            crbu.crbb.crbb_ipv6_recvdstopts
 214 #define crb_ipv6_recvrthdr              crbu.crbb.crbb_ipv6_recvrthdr
 215 #define crb_old_ipv6_recvdstopts        crbu.crbb.crbb_old_ipv6_recvdstopts
 216 #define crb_ipv6_recvrthdrdstopts       crbu.crbb.crbb_ipv6_recvrthdrdstopts
 217 #define crb_ipv6_recvtclass             crbu.crbb.crbb_ipv6_recvtclass
 218 #define crb_recvucred                   crbu.crbb.crbb_recvucred
 219 #define crb_timestamp                   crbu.crbb.crbb_timestamp
 220 
 221 /*
 222  * The initial fields in the conn_t are setup by the kmem_cache constructor,
 223  * and are preserved when it is freed. Fields after that are bzero'ed when
 224  * the conn_t is freed.
 225  *
 226  * Much of the conn_t is protected by conn_lock.
 227  *
 228  * conn_lock is also used by some ULPs (like UDP and RAWIP) to protect
 229  * their state.
 230  */
 231 struct conn_s {
 232         kmutex_t        conn_lock;
 233         uint32_t        conn_ref;               /* Reference counter */
 234         uint32_t        conn_flags;             /* Conn Flags */
 235 
 236         union {
 237                 tcp_t           *cp_tcp;        /* Pointer to the tcp struct */
 238                 struct udp_s    *cp_udp;        /* Pointer to the udp struct */
 239                 struct icmp_s   *cp_icmp;       /* Pointer to rawip struct */
 240                 struct rts_s    *cp_rts;        /* Pointer to rts struct */
 241                 struct iptun_s  *cp_iptun;      /* Pointer to iptun_t */
 242                 struct sctp_s   *cp_sctp;       /* For IPCL_SCTPCONN */
 243                 struct dccp_s   *cp_dccp;       /* Pointer to dccp struct */
 244                 void            *cp_priv;
 245         } conn_proto_priv;
 246 #define conn_tcp        conn_proto_priv.cp_tcp
 247 #define conn_udp        conn_proto_priv.cp_udp
 248 #define conn_icmp       conn_proto_priv.cp_icmp
 249 #define conn_rts        conn_proto_priv.cp_rts
 250 #define conn_iptun      conn_proto_priv.cp_iptun
 251 #define conn_sctp       conn_proto_priv.cp_sctp
 252 #define conn_dccp       conn_proto_priv.cp_dccp
 253 #define conn_priv       conn_proto_priv.cp_priv
 254 
 255         kcondvar_t      conn_cv;
 256         uint8_t         conn_proto;             /* protocol type */
 257 
 258         edesc_rpf       conn_recv;              /* Pointer to recv routine */
 259         edesc_rpf       conn_recvicmp;          /* For ICMP error */
 260         edesc_vpf       conn_verifyicmp;        /* Verify ICMP error */
 261 
 262         ip_xmit_attr_t  *conn_ixa;              /* Options if no ancil data */
 263 
 264         /* Fields after this are bzero'ed when the conn_t is freed. */
 265 #define conn_start_clr  conn_recv_ancillary
 266 
 267         /* Options for receive-side ancillary data */
 268         crb_t           conn_recv_ancillary;
 269 
 270         squeue_t        *conn_sqp;              /* Squeue for processing */
 271         uint_t          conn_state_flags;       /* IP state flags */
 272 
 273         int             conn_lingertime;        /* linger time (in seconds) */
 274 
 275         unsigned int
 276                 conn_on_sqp : 1,                /* Conn is being processed */
 277                 conn_linger : 1,                /* SO_LINGER state */
 278                 conn_useloopback : 1,           /* SO_USELOOPBACK state */
 279                 conn_broadcast : 1,             /* SO_BROADCAST state */
 280 
 281                 conn_reuseaddr : 1,             /* SO_REUSEADDR state */
 282                 conn_keepalive : 1,             /* SO_KEEPALIVE state */
 283                 conn_multi_router : 1,          /* Wants all multicast pkts */
 284                 conn_unspec_src : 1,            /* IP_UNSPEC_SRC */
 285 
 286                 conn_policy_cached : 1,         /* Is policy cached/latched ? */
 287                 conn_in_enforce_policy : 1,     /* Enforce Policy on inbound */
 288                 conn_out_enforce_policy : 1,    /* Enforce Policy on outbound */
 289                 conn_debug : 1,                 /* SO_DEBUG */
 290 
 291                 conn_ipv6_v6only : 1,           /* IPV6_V6ONLY */
 292                 conn_oobinline : 1,             /* SO_OOBINLINE state */
 293                 conn_dgram_errind : 1,          /* SO_DGRAM_ERRIND state */
 294                 conn_exclbind : 1,              /* SO_EXCLBIND state */
 295 
 296                 conn_mdt_ok : 1,                /* MDT is permitted */
 297                 conn_allzones : 1,              /* SO_ALLZONES */
 298                 conn_ipv6_recvpathmtu : 1,      /* IPV6_RECVPATHMTU */
 299                 conn_mcbc_bind : 1,             /* Bound to multi/broadcast */
 300 
 301                 conn_pad_to_bit_31 : 12;
 302 
 303         boolean_t       conn_blocked;           /* conn is flow-controlled */
 304 
 305         squeue_t        *conn_initial_sqp;      /* Squeue at open time */
 306         squeue_t        *conn_final_sqp;        /* Squeue after connect */
 307         ill_t           *conn_dhcpinit_ill;     /* IP_DHCPINIT_IF */
 308         ipsec_latch_t   *conn_latch;            /* latched IDS */
 309         struct ipsec_policy_s   *conn_latch_in_policy; /* latched policy (in) */
 310         struct ipsec_action_s   *conn_latch_in_action; /* latched action (in) */
 311         uint_t          conn_bound_if;          /* IP*_BOUND_IF */
 312         queue_t         *conn_rq;               /* Read queue */
 313         queue_t         *conn_wq;               /* Write queue */
 314         dev_t           conn_dev;               /* Minor number */
 315         vmem_t          *conn_minor_arena;      /* Minor arena */
 316         ip_helper_stream_info_t *conn_helper_info;
 317 
 318         cred_t          *conn_cred;             /* Credentials */
 319         pid_t           conn_cpid;              /* pid from open/connect */
 320         uint64_t        conn_open_time;         /* time when this was opened */
 321 
 322         connf_t         *conn_g_fanout;         /* Global Hash bucket head */
 323         struct conn_s   *conn_g_next;           /* Global Hash chain next */
 324         struct conn_s   *conn_g_prev;           /* Global Hash chain prev */
 325         struct ipsec_policy_head_s *conn_policy; /* Configured policy */
 326         in6_addr_t      conn_bound_addr_v6;     /* Address in bind() */
 327 #define conn_bound_addr_v4      V4_PART_OF_V6(conn_bound_addr_v6)
 328         connf_t         *conn_fanout;           /* Hash bucket we're part of */
 329         struct conn_s   *conn_next;             /* Hash chain next */
 330         struct conn_s   *conn_prev;             /* Hash chain prev */
 331 
 332         struct {
 333                 in6_addr_t connua_laddr;        /* Local address - match */
 334                 in6_addr_t connua_faddr;        /* Remote address */
 335         } connua_v6addr;
 336 #define conn_laddr_v4   V4_PART_OF_V6(connua_v6addr.connua_laddr)
 337 #define conn_faddr_v4   V4_PART_OF_V6(connua_v6addr.connua_faddr)
 338 #define conn_laddr_v6   connua_v6addr.connua_laddr
 339 #define conn_faddr_v6   connua_v6addr.connua_faddr
 340         in6_addr_t      conn_saddr_v6;          /* Local address - source */
 341 #define conn_saddr_v4   V4_PART_OF_V6(conn_saddr_v6)
 342 
 343         union {
 344                 /* Used for classifier match performance */
 345                 uint32_t                connu_ports2;
 346                 struct {
 347                         in_port_t       connu_fport;    /* Remote port */
 348                         in_port_t       connu_lport;    /* Local port */
 349                 } connu_ports;
 350         } u_port;
 351 #define conn_fport      u_port.connu_ports.connu_fport
 352 #define conn_lport      u_port.connu_ports.connu_lport
 353 #define conn_ports      u_port.connu_ports2
 354 
 355         uint_t          conn_incoming_ifindex;  /* IP{,V6}_BOUND_IF, scopeid */
 356         ill_t           *conn_oper_pending_ill; /* pending shared ioctl */
 357 
 358         krwlock_t       conn_ilg_lock;          /* Protects conn_ilg_* */
 359         ilg_t           *conn_ilg;              /* Group memberships */
 360 
 361         kcondvar_t      conn_refcv;             /* For conn_oper_pending_ill */
 362 
 363         struct conn_s   *conn_drain_next;       /* Next conn in drain list */
 364         struct conn_s   *conn_drain_prev;       /* Prev conn in drain list */
 365         idl_t           *conn_idl;              /* Ptr to the drain list head */
 366         mblk_t          *conn_ipsec_opt_mp;     /* ipsec option mblk */
 367         zoneid_t        conn_zoneid;            /* zone connection is in */
 368         int             conn_rtaware;           /* RT_AWARE sockopt value */
 369         kcondvar_t      conn_sq_cv;             /* For non-STREAMS socket IO */
 370         sock_upcalls_t  *conn_upcalls;          /* Upcalls to sockfs */
 371         sock_upper_handle_t conn_upper_handle;  /* Upper handle: sonode * */
 372 
 373         unsigned int
 374                 conn_mlp_type : 2,              /* mlp_type_t; tsol/tndb.h */
 375                 conn_anon_mlp : 1,              /* user wants anon MLP */
 376                 conn_anon_port : 1,             /* user bound anonymously */
 377 
 378                 conn_mac_mode : 2,              /* normal/loose/implicit MAC */
 379                 conn_anon_priv_bind : 1,        /* *_ANON_PRIV_BIND state */
 380                 conn_zone_is_global : 1,        /* GLOBAL_ZONEID */
 381                 conn_isvrrp : 1,                /* VRRP control socket */
 382                 conn_spare : 23;
 383 
 384         boolean_t       conn_flow_cntrld;
 385         netstack_t      *conn_netstack; /* Corresponds to a netstack_hold */
 386 
 387         /*
 388          * IP format that packets received for this struct should use.
 389          * Value can be IP4_VERSION or IPV6_VERSION.
 390          * The sending version is encoded using IXAF_IS_IPV4.
 391          */
 392         ushort_t        conn_ipversion;
 393 
 394         /* Written to only once at the time of opening the endpoint */
 395         sa_family_t     conn_family;            /* Family from socket() call */
 396         uint_t          conn_so_type;           /* Type from socket() call */
 397 
 398         uint_t          conn_sndbuf;            /* SO_SNDBUF state */
 399         uint_t          conn_rcvbuf;            /* SO_RCVBUF state */
 400         uint_t          conn_wroff;             /* Current write offset */
 401 
 402         uint_t          conn_sndlowat;          /* Send buffer low water mark */
 403         uint_t          conn_rcvlowat;          /* Recv buffer low water mark */
 404 
 405         uint8_t         conn_default_ttl;       /* Default TTL/hoplimit */
 406 
 407         uint32_t        conn_flowinfo;  /* Connected flow id and tclass */
 408 
 409         /*
 410          * The most recent address for sendto. Initially set to zero
 411          * which is always different than then the destination address
 412          * since the send interprets zero as the loopback address.
 413          */
 414         in6_addr_t      conn_v6lastdst;
 415 #define conn_v4lastdst  V4_PART_OF_V6(conn_v6lastdst)
 416         ushort_t        conn_lastipversion;
 417         in_port_t       conn_lastdstport;
 418         uint32_t        conn_lastflowinfo;      /* IPv6-only */
 419         uint_t          conn_lastscopeid;       /* IPv6-only */
 420         uint_t          conn_lastsrcid;         /* Only for AF_INET6 */
 421         /*
 422          * When we are not connected conn_saddr might be unspecified.
 423          * We track the source that was used with conn_v6lastdst here.
 424          */
 425         in6_addr_t      conn_v6lastsrc;
 426 #define conn_v4lastsrc  V4_PART_OF_V6(conn_v6lastsrc)
 427 
 428         /* Templates for transmitting packets */
 429         ip_pkt_t        conn_xmit_ipp;          /* Options if no ancil data */
 430 
 431         /*
 432          * Header template - conn_ht_ulp is a pointer into conn_ht_iphc.
 433          * Note that ixa_ip_hdr_length indicates the offset of ht_ulp in
 434          * ht_iphc
 435          *
 436          * The header template is maintained for connected endpoints (and
 437          * updated when sticky options are changed) and also for the lastdst.
 438          * There is no conflict between those usages since SOCK_DGRAM and
 439          * SOCK_RAW can not be used to specify a destination address (with
 440          * sendto/sendmsg) if the socket has been connected.
 441          */
 442         uint8_t         *conn_ht_iphc;          /* Start of IP header */
 443         uint_t          conn_ht_iphc_allocated; /* Allocated buffer size */
 444         uint_t          conn_ht_iphc_len;       /* IP+ULP size */
 445         uint8_t         *conn_ht_ulp;           /* Upper-layer header */
 446         uint_t          conn_ht_ulp_len;        /* ULP header len */
 447 
 448         /* Checksum to compensate for source routed packets. Host byte order */
 449         uint32_t        conn_sum;
 450 
 451         uint32_t        conn_ioctlref;          /* ioctl ref count */
 452 #ifdef CONN_DEBUG
 453 #define CONN_TRACE_MAX  10
 454         int             conn_trace_last;        /* ndx of last used tracebuf */
 455         conn_trace_t    conn_trace_buf[CONN_TRACE_MAX];
 456 #endif
 457 };
 458 
 459 /*
 460  * connf_t - connection fanout data.
 461  *
 462  * The hash tables and their linkage (conn_t.{hashnextp, hashprevp} are
 463  * protected by the per-bucket lock. Each conn_t inserted in the list
 464  * points back at the connf_t that heads the bucket.
 465  */
 466 struct connf_s {
 467         struct conn_s   *connf_head;
 468         kmutex_t        connf_lock;
 469 };
 470 
 471 #define CONN_INC_REF(connp)     {                               \
 472         mutex_enter(&(connp)->conn_lock);                        \
 473         DTRACE_PROBE1(conn__inc__ref, conn_t *, connp);         \
 474         ASSERT(conn_trace_ref(connp));                          \
 475         (connp)->conn_ref++;                                 \
 476         ASSERT((connp)->conn_ref != 0);                              \
 477         mutex_exit(&(connp)->conn_lock);                 \
 478 }
 479 
 480 #define CONN_INC_REF_LOCKED(connp)      {                       \
 481         DTRACE_PROBE1(conn__inc__ref, conn_t *, connp);         \
 482         ASSERT(MUTEX_HELD(&(connp)->conn_lock));         \
 483         ASSERT(conn_trace_ref(connp));                          \
 484         (connp)->conn_ref++;                                 \
 485         ASSERT((connp)->conn_ref != 0);                              \
 486 }
 487 
 488 #define CONN_DEC_REF(connp)     {                                       \
 489         mutex_enter(&(connp)->conn_lock);                                \
 490         DTRACE_PROBE1(conn__dec__ref, conn_t *, connp);                 \
 491         /*                                                              \
 492          * The squeue framework always does a CONN_DEC_REF after return \
 493          * from TCP. Hence the refcnt must be at least 2 if conn_on_sqp \
 494          * is B_TRUE and conn_ref is being decremented. This is to      \
 495          * account for the mblk being currently processed.              \
 496          */                                                             \
 497         if ((connp)->conn_ref == 0 ||                                        \
 498             ((connp)->conn_ref == 1 && (connp)->conn_on_sqp))             \
 499                 cmn_err(CE_PANIC, "CONN_DEC_REF: connp(%p) has ref "    \
 500                         "= %d\n", (void *)(connp), (connp)->conn_ref);       \
 501         ASSERT(conn_untrace_ref(connp));                                \
 502         (connp)->conn_ref--;                                         \
 503         if ((connp)->conn_ref == 0) {                                        \
 504                 /* Refcnt can't increase again, safe to drop lock */    \
 505                 mutex_exit(&(connp)->conn_lock);                 \
 506                 ipcl_conn_destroy(connp);                               \
 507         } else {                                                        \
 508                 cv_broadcast(&(connp)->conn_cv);                 \
 509                 mutex_exit(&(connp)->conn_lock);                 \
 510         }                                                               \
 511 }
 512 
 513 /*
 514  * For use with subsystems within ip which use ALL_ZONES as a wildcard
 515  */
 516 #define IPCL_ZONEID(connp)                                              \
 517         ((connp)->conn_allzones ? ALL_ZONES : (connp)->conn_zoneid)
 518 
 519 /*
 520  * For matching between a conn_t and a zoneid.
 521  */
 522 #define IPCL_ZONE_MATCH(connp, zoneid)                                  \
 523         (((connp)->conn_allzones) ||                                 \
 524             ((zoneid) == ALL_ZONES) ||                                  \
 525             (connp)->conn_zoneid == (zoneid))
 526 
 527 /*
 528  * On a labeled system, we must treat bindings to ports
 529  * on shared IP addresses by sockets with MAC exemption
 530  * privilege as being in all zones, as there's
 531  * otherwise no way to identify the right receiver.
 532  */
 533 
 534 #define IPCL_CONNS_MAC(conn1, conn2)                                    \
 535         (((conn1)->conn_mac_mode != CONN_MAC_DEFAULT) ||             \
 536         ((conn2)->conn_mac_mode != CONN_MAC_DEFAULT))
 537 
 538 #define IPCL_BIND_ZONE_MATCH(conn1, conn2)                              \
 539         (IPCL_CONNS_MAC(conn1, conn2) ||                                \
 540         IPCL_ZONE_MATCH(conn1, conn2->conn_zoneid) ||                        \
 541         IPCL_ZONE_MATCH(conn2, conn1->conn_zoneid))
 542 
 543 
 544 #define _IPCL_V4_MATCH(v6addr, v4addr)  \
 545         (V4_PART_OF_V6((v6addr)) == (v4addr) && IN6_IS_ADDR_V4MAPPED(&(v6addr)))
 546 
 547 #define _IPCL_V4_MATCH_ANY(addr)        \
 548         (IN6_IS_ADDR_V4MAPPED_ANY(&(addr)) || IN6_IS_ADDR_UNSPECIFIED(&(addr)))
 549 
 550 
 551 /*
 552  * IPCL_PROTO_MATCH() and IPCL_PROTO_MATCH_V6() only matches conns with
 553  * the specified ira_zoneid or conn_allzones by calling conn_wantpacket.
 554  */
 555 #define IPCL_PROTO_MATCH(connp, ira, ipha)                              \
 556         ((((connp)->conn_laddr_v4 == INADDR_ANY) ||                  \
 557         (((connp)->conn_laddr_v4 == ((ipha)->ipha_dst)) &&                \
 558             (((connp)->conn_faddr_v4 == INADDR_ANY) ||                       \
 559         ((connp)->conn_faddr_v4 == ((ipha)->ipha_src))))) &&              \
 560         conn_wantpacket((connp), (ira), (ipha)))
 561 
 562 #define IPCL_PROTO_MATCH_V6(connp, ira, ip6h)                           \
 563         ((IN6_IS_ADDR_UNSPECIFIED(&(connp)->conn_laddr_v6) ||            \
 564         (IN6_ARE_ADDR_EQUAL(&(connp)->conn_laddr_v6, &((ip6h)->ip6_dst)) &&   \
 565         (IN6_IS_ADDR_UNSPECIFIED(&(connp)->conn_faddr_v6) ||                   \
 566         IN6_ARE_ADDR_EQUAL(&(connp)->conn_faddr_v6, &((ip6h)->ip6_src))))) && \
 567         (conn_wantpacket_v6((connp), (ira), (ip6h))))
 568 
 569 #define IPCL_CONN_HASH(src, ports, ipst)                                \
 570         ((unsigned)(ntohl((src)) ^ ((ports) >> 24) ^ ((ports) >> 16) ^      \
 571         ((ports) >> 8) ^ (ports)) % (ipst)->ips_ipcl_conn_fanout_size)
 572 
 573 #define IPCL_CONN_HASH_V6(src, ports, ipst)                             \
 574         IPCL_CONN_HASH(V4_PART_OF_V6((src)), (ports), (ipst))
 575 
 576 #define IPCL_CONN_MATCH(connp, proto, src, dst, ports)                  \
 577         ((connp)->conn_proto == (proto) &&                           \
 578                 (connp)->conn_ports == (ports) &&                            \
 579                 _IPCL_V4_MATCH((connp)->conn_faddr_v6, (src)) &&     \
 580                 _IPCL_V4_MATCH((connp)->conn_laddr_v6, (dst)) &&     \
 581                 !(connp)->conn_ipv6_v6only)
 582 
 583 #define IPCL_CONN_MATCH_V6(connp, proto, src, dst, ports)               \
 584         ((connp)->conn_proto == (proto) &&                           \
 585                 (connp)->conn_ports == (ports) &&                            \
 586                 IN6_ARE_ADDR_EQUAL(&(connp)->conn_faddr_v6, &(src)) &&       \
 587                 IN6_ARE_ADDR_EQUAL(&(connp)->conn_laddr_v6, &(dst)))
 588 
 589 #define IPCL_PORT_HASH(port, size) \
 590         ((((port) >> 8) ^ (port)) & ((size) - 1))
 591 
 592 #define IPCL_BIND_HASH(lport, ipst)                                     \
 593         ((unsigned)(((lport) >> 8) ^ (lport)) % \
 594             (ipst)->ips_ipcl_bind_fanout_size)
 595 
 596 #define IPCL_BIND_MATCH(connp, proto, laddr, lport)                     \
 597         ((connp)->conn_proto == (proto) &&                           \
 598                 (connp)->conn_lport == (lport) &&                    \
 599                 (_IPCL_V4_MATCH_ANY((connp)->conn_laddr_v6) ||               \
 600                 _IPCL_V4_MATCH((connp)->conn_laddr_v6, (laddr))) &&  \
 601                 !(connp)->conn_ipv6_v6only)
 602 
 603 #define IPCL_BIND_MATCH_V6(connp, proto, laddr, lport)                  \
 604         ((connp)->conn_proto == (proto) &&                           \
 605                 (connp)->conn_lport == (lport) &&                    \
 606                 (IN6_ARE_ADDR_EQUAL(&(connp)->conn_laddr_v6, &(laddr)) || \
 607                 IN6_IS_ADDR_UNSPECIFIED(&(connp)->conn_laddr_v6)))
 608 
 609 /*
 610  * We compare conn_laddr since it captures both connected and a bind to
 611  * a multicast or broadcast address.
 612  * The caller needs to match the zoneid and also call conn_wantpacket
 613  * for multicast, broadcast, or when conn_incoming_ifindex is set.
 614  */
 615 #define IPCL_UDP_MATCH(connp, lport, laddr, fport, faddr)               \
 616         (((connp)->conn_lport == (lport)) &&                         \
 617         ((_IPCL_V4_MATCH_ANY((connp)->conn_laddr_v6) ||                      \
 618         (_IPCL_V4_MATCH((connp)->conn_laddr_v6, (laddr)) &&          \
 619         (_IPCL_V4_MATCH_ANY((connp)->conn_faddr_v6) ||                       \
 620         (_IPCL_V4_MATCH((connp)->conn_faddr_v6, (faddr)) &&          \
 621         (connp)->conn_fport == (fport)))))) &&                               \
 622         !(connp)->conn_ipv6_v6only)
 623 
 624 /*
 625  * We compare conn_laddr since it captures both connected and a bind to
 626  * a multicast or broadcast address.
 627  * The caller needs to match the zoneid and also call conn_wantpacket_v6
 628  * for multicast or when conn_incoming_ifindex is set.
 629  */
 630 #define IPCL_UDP_MATCH_V6(connp, lport, laddr, fport, faddr)    \
 631         (((connp)->conn_lport == (lport)) &&                 \
 632         (IN6_IS_ADDR_UNSPECIFIED(&(connp)->conn_laddr_v6) ||     \
 633         (IN6_ARE_ADDR_EQUAL(&(connp)->conn_laddr_v6, &(laddr)) &&    \
 634         (IN6_IS_ADDR_UNSPECIFIED(&(connp)->conn_faddr_v6) ||     \
 635         (IN6_ARE_ADDR_EQUAL(&(connp)->conn_faddr_v6, &(faddr)) &&    \
 636         (connp)->conn_fport == (fport))))))
 637 
 638 #define IPCL_IPTUN_HASH(laddr, faddr)                                   \
 639         ((ntohl(laddr) ^ ((ntohl(faddr) << 24) | (ntohl(faddr) >> 8))) % \
 640         ipcl_iptun_fanout_size)
 641 
 642 #define IPCL_IPTUN_HASH_V6(laddr, faddr)                                \
 643         IPCL_IPTUN_HASH((laddr)->s6_addr32[0] ^ (laddr)->s6_addr32[1] ^   \
 644             (faddr)->s6_addr32[2] ^ (faddr)->s6_addr32[3],                \
 645             (faddr)->s6_addr32[0] ^ (faddr)->s6_addr32[1] ^               \
 646             (laddr)->s6_addr32[2] ^ (laddr)->s6_addr32[3])
 647 
 648 #define IPCL_IPTUN_MATCH(connp, laddr, faddr)                   \
 649         (_IPCL_V4_MATCH((connp)->conn_laddr_v6, (laddr)) &&  \
 650         _IPCL_V4_MATCH((connp)->conn_faddr_v6, (faddr)))
 651 
 652 #define IPCL_IPTUN_MATCH_V6(connp, laddr, faddr)                \
 653         (IN6_ARE_ADDR_EQUAL(&(connp)->conn_laddr_v6, (laddr)) && \
 654         IN6_ARE_ADDR_EQUAL(&(connp)->conn_faddr_v6, (faddr)))
 655 
 656 #define IPCL_UDP_HASH(lport, ipst)      \
 657         IPCL_PORT_HASH(lport, (ipst)->ips_ipcl_udp_fanout_size)
 658 
 659 #define IPCL_DCCP_CONN_HASH(src, ports, ipst)                           \
 660         ((unsigned)(ntohl((src)) ^ ((ports) >> 24) ^ ((ports) >> 16) ^      \
 661         ((ports) >> 8) ^ (ports)) % (ipst)->ips_ipcl_dccp_conn_fanout_size)
 662 
 663 #define IPCL_DCCP_CONN_HASH_V6(src, ports, ipst)                        \
 664         IPCL_DCCP_CONN_HASH(V4_PART_OF_V6((src)), (ports), (ipst))
 665 
 666 #define IPCL_DCCP_BIND_HASH(lport, ipst)                                \
 667         ((unsigned)(((lport) >> 8) ^ (lport)) %                           \
 668             (ipst)->ips_ipcl_dccp_bind_fanout_size)
 669 
 670 
 671 #define CONN_G_HASH_SIZE        1024
 672 
 673 /* Raw socket hash function. */
 674 #define IPCL_RAW_HASH(lport, ipst)      \
 675         IPCL_PORT_HASH(lport, (ipst)->ips_ipcl_raw_fanout_size)
 676 
 677 /*
 678  * This is similar to IPCL_BIND_MATCH except that the local port check
 679  * is changed to a wildcard port check.
 680  * We compare conn_laddr since it captures both connected and a bind to
 681  * a multicast or broadcast address.
 682  */
 683 #define IPCL_RAW_MATCH(connp, proto, laddr)                     \
 684         ((connp)->conn_proto == (proto) &&                   \
 685         (connp)->conn_lport == 0 &&                          \
 686         (_IPCL_V4_MATCH_ANY((connp)->conn_laddr_v6) ||               \
 687         _IPCL_V4_MATCH((connp)->conn_laddr_v6, (laddr))))
 688 
 689 #define IPCL_RAW_MATCH_V6(connp, proto, laddr)                  \
 690         ((connp)->conn_proto == (proto) &&                   \
 691         (connp)->conn_lport == 0 &&                          \
 692         (IN6_IS_ADDR_UNSPECIFIED(&(connp)->conn_laddr_v6) ||     \
 693         IN6_ARE_ADDR_EQUAL(&(connp)->conn_laddr_v6, &(laddr))))
 694 
 695 /* Function prototypes */
 696 extern void ipcl_g_init(void);
 697 extern void ipcl_init(ip_stack_t *);
 698 extern void ipcl_g_destroy(void);
 699 extern void ipcl_destroy(ip_stack_t *);
 700 extern conn_t *ipcl_conn_create(uint32_t, int, netstack_t *);
 701 extern void ipcl_conn_destroy(conn_t *);
 702 
 703 void ipcl_hash_insert_wildcard(connf_t *, conn_t *);
 704 void ipcl_hash_remove(conn_t *);
 705 void ipcl_hash_remove_locked(conn_t *connp, connf_t *connfp);
 706 
 707 extern int      ipcl_bind_insert(conn_t *);
 708 extern int      ipcl_bind_insert_v4(conn_t *);
 709 extern int      ipcl_bind_insert_v6(conn_t *);
 710 extern int      ipcl_conn_insert(conn_t *);
 711 extern int      ipcl_conn_insert_v4(conn_t *);
 712 extern int      ipcl_conn_insert_v6(conn_t *);
 713 extern conn_t   *ipcl_get_next_conn(connf_t *, conn_t *, uint32_t);
 714 
 715 conn_t *ipcl_classify_v4(mblk_t *, uint8_t, uint_t, ip_recv_attr_t *,
 716             ip_stack_t *);
 717 conn_t *ipcl_classify_v6(mblk_t *, uint8_t, uint_t, ip_recv_attr_t *,
 718             ip_stack_t *);
 719 conn_t *ipcl_classify(mblk_t *, ip_recv_attr_t *, ip_stack_t *);
 720 conn_t *ipcl_classify_raw(mblk_t *, uint8_t, uint32_t, ipha_t *,
 721     ip6_t *, ip_recv_attr_t *, ip_stack_t *);
 722 conn_t *ipcl_iptun_classify_v4(ipaddr_t *, ipaddr_t *, ip_stack_t *);
 723 conn_t *ipcl_iptun_classify_v6(in6_addr_t *, in6_addr_t *, ip_stack_t *);
 724 void    ipcl_globalhash_insert(conn_t *);
 725 void    ipcl_globalhash_remove(conn_t *);
 726 void    ipcl_walk(pfv_t, void *, ip_stack_t *);
 727 conn_t  *ipcl_tcp_lookup_reversed_ipv4(ipha_t *, tcpha_t *, int, ip_stack_t *);
 728 conn_t  *ipcl_tcp_lookup_reversed_ipv6(ip6_t *, tcpha_t *, int, uint_t,
 729             ip_stack_t *);
 730 conn_t  *ipcl_lookup_listener_v4(uint16_t, ipaddr_t, zoneid_t, ip_stack_t *);
 731 conn_t  *ipcl_lookup_listener_v6(uint16_t, in6_addr_t *, uint_t, zoneid_t,
 732             ip_stack_t *);
 733 int     conn_trace_ref(conn_t *);
 734 int     conn_untrace_ref(conn_t *);
 735 void    ipcl_conn_cleanup(conn_t *);
 736 extern uint_t   conn_recvancillary_size(conn_t *, crb_t, ip_recv_attr_t *,
 737     mblk_t *, ip_pkt_t *);
 738 extern void     conn_recvancillary_add(conn_t *, crb_t, ip_recv_attr_t *,
 739     ip_pkt_t *, uchar_t *, uint_t);
 740 conn_t *ipcl_conn_tcp_lookup_reversed_ipv4(conn_t *, ipha_t *, tcpha_t *,
 741             ip_stack_t *);
 742 conn_t *ipcl_conn_tcp_lookup_reversed_ipv6(conn_t *, ip6_t *, tcpha_t *,
 743             ip_stack_t *);
 744 
 745 extern int ip_create_helper_stream(conn_t *, ldi_ident_t);
 746 extern void ip_free_helper_stream(conn_t *);
 747 extern int      ip_helper_stream_setup(queue_t *, dev_t *, int, int,
 748     cred_t *, boolean_t);
 749 
 750 #ifdef  __cplusplus
 751 }
 752 #endif
 753 
 754 #endif  /* _INET_IPCLASSIFIER_H */