1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright 2010 Sun Microsystems, Inc. All rights reserved. 23 * Use is subject to license terms. 24 */ 25 26 #ifndef _INET_IPCLASSIFIER_H 27 #define _INET_IPCLASSIFIER_H 28 29 #ifdef __cplusplus 30 extern "C" { 31 #endif 32 33 #include <inet/common.h> 34 #include <inet/ip.h> 35 #include <inet/mi.h> 36 #include <inet/tcp.h> 37 #include <inet/ip6.h> 38 #include <netinet/in.h> /* for IPPROTO_* constants */ 39 #include <sys/sdt.h> 40 #include <sys/socket_proto.h> 41 #include <sys/sunddi.h> 42 #include <sys/sunldi.h> 43 44 typedef void (*edesc_rpf)(void *, mblk_t *, void *, ip_recv_attr_t *); 45 struct icmph_s; 46 struct icmp6_hdr; 47 typedef boolean_t (*edesc_vpf)(conn_t *, void *, struct icmph_s *, 48 struct icmp6_hdr *, ip_recv_attr_t *); 49 50 /* 51 * ============================== 52 * = The CONNECTION = 53 * ============================== 54 */ 55 56 /* 57 * The connection structure contains the common information/flags/ref needed. 58 * Implementation will keep the connection struct, the layers (with their 59 * respective data for event i.e. tcp_t if event was tcp_input_data) all in one 60 * contiguous memory location. 61 */ 62 63 /* Conn Flags */ 64 /* Unused 0x00020000 */ 65 /* Unused 0x00040000 */ 66 #define IPCL_FULLY_BOUND 0x00080000 /* Bound to correct squeue */ 67 /* Unused 0x00100000 */ 68 /* Unused 0x00200000 */ 69 /* Unused 0x00400000 */ 70 #define IPCL_CL_LISTENER 0x00800000 /* Cluster listener */ 71 /* Unused 0x01000000 */ 72 /* Unused 0x02000000 */ 73 /* Unused 0x04000000 */ 74 /* Unused 0x08000000 */ 75 /* Unused 0x10000000 */ 76 /* Unused 0x20000000 */ 77 #define IPCL_CONNECTED 0x40000000 /* Conn in connected table */ 78 #define IPCL_BOUND 0x80000000 /* Conn in bind table */ 79 80 /* Flags identifying the type of conn */ 81 #define IPCL_TCPCONN 0x00000001 /* From tcp_conn_cache */ 82 #define IPCL_SCTPCONN 0x00000002 /* From sctp_conn_cache */ 83 #define IPCL_IPCCONN 0x00000004 /* From ip_conn_cache */ 84 #define IPCL_UDPCONN 0x00000008 /* From udp_conn_cache */ 85 #define IPCL_RAWIPCONN 0x00000010 /* From rawip_conn_cache */ 86 #define IPCL_RTSCONN 0x00000020 /* From rts_conn_cache */ 87 #define IPCL_DCCPCONN 0x00000040 /* From dccp_conn_cache */ 88 #define IPCL_IPTUN 0x00000080 /* iptun module above us */ 89 90 #define IPCL_NONSTR 0x00001000 /* A non-STREAMS socket */ 91 /* Unused 0x10000000 */ 92 93 #define IPCL_REMOVED 0x00000100 94 #define IPCL_REUSED 0x00000200 95 96 #define IPCL_IS_CONNECTED(connp) \ 97 ((connp)->conn_flags & IPCL_CONNECTED) 98 99 #define IPCL_IS_BOUND(connp) \ 100 ((connp)->conn_flags & IPCL_BOUND) 101 102 /* 103 * Can't use conn_proto since we need to tell difference 104 * between a real TCP socket and a SOCK_RAW, IPPROTO_TCP. 105 */ 106 #define IPCL_IS_TCP(connp) \ 107 ((connp)->conn_flags & IPCL_TCPCONN) 108 109 #define IPCL_IS_SCTP(connp) \ 110 ((connp)->conn_flags & IPCL_SCTPCONN) 111 112 #define IPCL_IS_UDP(connp) \ 113 ((connp)->conn_flags & IPCL_UDPCONN) 114 115 #define IPCL_IS_RAWIP(connp) \ 116 ((connp)->conn_flags & IPCL_RAWIPCONN) 117 118 #define IPCL_IS_RTS(connp) \ 119 ((connp)->conn_flags & IPCL_RTSCONN) 120 121 #define IPCL_IS_IPTUN(connp) \ 122 ((connp)->conn_flags & IPCL_IPTUN) 123 124 #define IPCL_IS_DCCP(connp) \ 125 ((connp)->conn_flags & IPCL_DCCPCONN) 126 127 #define IPCL_IS_NONSTR(connp) ((connp)->conn_flags & IPCL_NONSTR) 128 129 typedef struct connf_s connf_t; 130 131 typedef struct 132 { 133 int ctb_depth; 134 #define CONN_STACK_DEPTH 15 135 pc_t ctb_stack[CONN_STACK_DEPTH]; 136 } conn_trace_t; 137 138 typedef struct ip_helper_minor_info_s { 139 dev_t ip_minfo_dev; /* Device */ 140 vmem_t *ip_minfo_arena; /* Arena */ 141 } ip_helper_minfo_t; 142 143 /* 144 * ip helper stream info 145 */ 146 typedef struct ip_helper_stream_info_s { 147 ldi_handle_t iphs_handle; 148 queue_t *iphs_rq; 149 queue_t *iphs_wq; 150 ip_helper_minfo_t *iphs_minfo; 151 } ip_helper_stream_info_t; 152 153 /* 154 * Mandatory Access Control mode, in conn_t's conn_mac_mode field. 155 * CONN_MAC_DEFAULT: strict enforcement of MAC. 156 * CONN_MAC_AWARE: allows communications between unlabeled systems 157 * and privileged daemons 158 * CONN_MAC_IMPLICIT: allows communications without explicit labels 159 * on the wire with privileged daemons. 160 * 161 * CONN_MAC_IMPLICIT is intended specifically for labeled IPsec key management 162 * in networks which don't pass CIPSO-labeled packets. 163 */ 164 #define CONN_MAC_DEFAULT 0 165 #define CONN_MAC_AWARE 1 166 #define CONN_MAC_IMPLICIT 2 167 168 /* 169 * conn receive ancillary definition. 170 * 171 * These are the set of socket options that make the receive side 172 * potentially pass up ancillary data items. 173 * We have a union with an integer so that we can quickly check whether 174 * any ancillary data items need to be added. 175 */ 176 typedef struct crb_s { 177 union { 178 uint32_t crbu_all; 179 struct { 180 uint32_t 181 crbb_recvdstaddr : 1, /* IP_RECVDSTADDR option */ 182 crbb_recvopts : 1, /* IP_RECVOPTS option */ 183 crbb_recvif : 1, /* IP_RECVIF option */ 184 crbb_recvslla : 1, /* IP_RECVSLLA option */ 185 186 crbb_recvttl : 1, /* IP_RECVTTL option */ 187 crbb_ip_recvpktinfo : 1, /* IP*_RECVPKTINFO option */ 188 crbb_ipv6_recvhoplimit : 1, /* IPV6_RECVHOPLIMIT option */ 189 crbb_ipv6_recvhopopts : 1, /* IPV6_RECVHOPOPTS option */ 190 191 crbb_ipv6_recvdstopts : 1, /* IPV6_RECVDSTOPTS option */ 192 crbb_ipv6_recvrthdr : 1, /* IPV6_RECVRTHDR option */ 193 crbb_old_ipv6_recvdstopts : 1, /* old form of IPV6_DSTOPTS */ 194 crbb_ipv6_recvrthdrdstopts : 1, /* IPV6_RECVRTHDRDSTOPTS */ 195 196 crbb_ipv6_recvtclass : 1, /* IPV6_RECVTCLASS */ 197 crbb_recvucred : 1, /* IP_RECVUCRED option */ 198 crbb_timestamp : 1; /* SO_TIMESTAMP "socket" option */ 199 200 } crbb; 201 } crbu; 202 } crb_t; 203 204 #define crb_all crbu.crbu_all 205 #define crb_recvdstaddr crbu.crbb.crbb_recvdstaddr 206 #define crb_recvopts crbu.crbb.crbb_recvopts 207 #define crb_recvif crbu.crbb.crbb_recvif 208 #define crb_recvslla crbu.crbb.crbb_recvslla 209 #define crb_recvttl crbu.crbb.crbb_recvttl 210 #define crb_ip_recvpktinfo crbu.crbb.crbb_ip_recvpktinfo 211 #define crb_ipv6_recvhoplimit crbu.crbb.crbb_ipv6_recvhoplimit 212 #define crb_ipv6_recvhopopts crbu.crbb.crbb_ipv6_recvhopopts 213 #define crb_ipv6_recvdstopts crbu.crbb.crbb_ipv6_recvdstopts 214 #define crb_ipv6_recvrthdr crbu.crbb.crbb_ipv6_recvrthdr 215 #define crb_old_ipv6_recvdstopts crbu.crbb.crbb_old_ipv6_recvdstopts 216 #define crb_ipv6_recvrthdrdstopts crbu.crbb.crbb_ipv6_recvrthdrdstopts 217 #define crb_ipv6_recvtclass crbu.crbb.crbb_ipv6_recvtclass 218 #define crb_recvucred crbu.crbb.crbb_recvucred 219 #define crb_timestamp crbu.crbb.crbb_timestamp 220 221 /* 222 * The initial fields in the conn_t are setup by the kmem_cache constructor, 223 * and are preserved when it is freed. Fields after that are bzero'ed when 224 * the conn_t is freed. 225 * 226 * Much of the conn_t is protected by conn_lock. 227 * 228 * conn_lock is also used by some ULPs (like UDP and RAWIP) to protect 229 * their state. 230 */ 231 struct conn_s { 232 kmutex_t conn_lock; 233 uint32_t conn_ref; /* Reference counter */ 234 uint32_t conn_flags; /* Conn Flags */ 235 236 union { 237 tcp_t *cp_tcp; /* Pointer to the tcp struct */ 238 struct udp_s *cp_udp; /* Pointer to the udp struct */ 239 struct icmp_s *cp_icmp; /* Pointer to rawip struct */ 240 struct rts_s *cp_rts; /* Pointer to rts struct */ 241 struct iptun_s *cp_iptun; /* Pointer to iptun_t */ 242 struct sctp_s *cp_sctp; /* For IPCL_SCTPCONN */ 243 struct dccp_s *cp_dccp; /* Pointer to dccp struct */ 244 void *cp_priv; 245 } conn_proto_priv; 246 #define conn_tcp conn_proto_priv.cp_tcp 247 #define conn_udp conn_proto_priv.cp_udp 248 #define conn_icmp conn_proto_priv.cp_icmp 249 #define conn_rts conn_proto_priv.cp_rts 250 #define conn_iptun conn_proto_priv.cp_iptun 251 #define conn_sctp conn_proto_priv.cp_sctp 252 #define conn_dccp conn_proto_priv.cp_dccp 253 #define conn_priv conn_proto_priv.cp_priv 254 255 kcondvar_t conn_cv; 256 uint8_t conn_proto; /* protocol type */ 257 258 edesc_rpf conn_recv; /* Pointer to recv routine */ 259 edesc_rpf conn_recvicmp; /* For ICMP error */ 260 edesc_vpf conn_verifyicmp; /* Verify ICMP error */ 261 262 ip_xmit_attr_t *conn_ixa; /* Options if no ancil data */ 263 264 /* Fields after this are bzero'ed when the conn_t is freed. */ 265 #define conn_start_clr conn_recv_ancillary 266 267 /* Options for receive-side ancillary data */ 268 crb_t conn_recv_ancillary; 269 270 squeue_t *conn_sqp; /* Squeue for processing */ 271 uint_t conn_state_flags; /* IP state flags */ 272 273 int conn_lingertime; /* linger time (in seconds) */ 274 275 unsigned int 276 conn_on_sqp : 1, /* Conn is being processed */ 277 conn_linger : 1, /* SO_LINGER state */ 278 conn_useloopback : 1, /* SO_USELOOPBACK state */ 279 conn_broadcast : 1, /* SO_BROADCAST state */ 280 281 conn_reuseaddr : 1, /* SO_REUSEADDR state */ 282 conn_keepalive : 1, /* SO_KEEPALIVE state */ 283 conn_multi_router : 1, /* Wants all multicast pkts */ 284 conn_unspec_src : 1, /* IP_UNSPEC_SRC */ 285 286 conn_policy_cached : 1, /* Is policy cached/latched ? */ 287 conn_in_enforce_policy : 1, /* Enforce Policy on inbound */ 288 conn_out_enforce_policy : 1, /* Enforce Policy on outbound */ 289 conn_debug : 1, /* SO_DEBUG */ 290 291 conn_ipv6_v6only : 1, /* IPV6_V6ONLY */ 292 conn_oobinline : 1, /* SO_OOBINLINE state */ 293 conn_dgram_errind : 1, /* SO_DGRAM_ERRIND state */ 294 conn_exclbind : 1, /* SO_EXCLBIND state */ 295 296 conn_mdt_ok : 1, /* MDT is permitted */ 297 conn_allzones : 1, /* SO_ALLZONES */ 298 conn_ipv6_recvpathmtu : 1, /* IPV6_RECVPATHMTU */ 299 conn_mcbc_bind : 1, /* Bound to multi/broadcast */ 300 301 conn_pad_to_bit_31 : 12; 302 303 boolean_t conn_blocked; /* conn is flow-controlled */ 304 305 squeue_t *conn_initial_sqp; /* Squeue at open time */ 306 squeue_t *conn_final_sqp; /* Squeue after connect */ 307 ill_t *conn_dhcpinit_ill; /* IP_DHCPINIT_IF */ 308 ipsec_latch_t *conn_latch; /* latched IDS */ 309 struct ipsec_policy_s *conn_latch_in_policy; /* latched policy (in) */ 310 struct ipsec_action_s *conn_latch_in_action; /* latched action (in) */ 311 uint_t conn_bound_if; /* IP*_BOUND_IF */ 312 queue_t *conn_rq; /* Read queue */ 313 queue_t *conn_wq; /* Write queue */ 314 dev_t conn_dev; /* Minor number */ 315 vmem_t *conn_minor_arena; /* Minor arena */ 316 ip_helper_stream_info_t *conn_helper_info; 317 318 cred_t *conn_cred; /* Credentials */ 319 pid_t conn_cpid; /* pid from open/connect */ 320 uint64_t conn_open_time; /* time when this was opened */ 321 322 connf_t *conn_g_fanout; /* Global Hash bucket head */ 323 struct conn_s *conn_g_next; /* Global Hash chain next */ 324 struct conn_s *conn_g_prev; /* Global Hash chain prev */ 325 struct ipsec_policy_head_s *conn_policy; /* Configured policy */ 326 in6_addr_t conn_bound_addr_v6; /* Address in bind() */ 327 #define conn_bound_addr_v4 V4_PART_OF_V6(conn_bound_addr_v6) 328 connf_t *conn_fanout; /* Hash bucket we're part of */ 329 struct conn_s *conn_next; /* Hash chain next */ 330 struct conn_s *conn_prev; /* Hash chain prev */ 331 332 struct { 333 in6_addr_t connua_laddr; /* Local address - match */ 334 in6_addr_t connua_faddr; /* Remote address */ 335 } connua_v6addr; 336 #define conn_laddr_v4 V4_PART_OF_V6(connua_v6addr.connua_laddr) 337 #define conn_faddr_v4 V4_PART_OF_V6(connua_v6addr.connua_faddr) 338 #define conn_laddr_v6 connua_v6addr.connua_laddr 339 #define conn_faddr_v6 connua_v6addr.connua_faddr 340 in6_addr_t conn_saddr_v6; /* Local address - source */ 341 #define conn_saddr_v4 V4_PART_OF_V6(conn_saddr_v6) 342 343 union { 344 /* Used for classifier match performance */ 345 uint32_t connu_ports2; 346 struct { 347 in_port_t connu_fport; /* Remote port */ 348 in_port_t connu_lport; /* Local port */ 349 } connu_ports; 350 } u_port; 351 #define conn_fport u_port.connu_ports.connu_fport 352 #define conn_lport u_port.connu_ports.connu_lport 353 #define conn_ports u_port.connu_ports2 354 355 uint_t conn_incoming_ifindex; /* IP{,V6}_BOUND_IF, scopeid */ 356 ill_t *conn_oper_pending_ill; /* pending shared ioctl */ 357 358 krwlock_t conn_ilg_lock; /* Protects conn_ilg_* */ 359 ilg_t *conn_ilg; /* Group memberships */ 360 361 kcondvar_t conn_refcv; /* For conn_oper_pending_ill */ 362 363 struct conn_s *conn_drain_next; /* Next conn in drain list */ 364 struct conn_s *conn_drain_prev; /* Prev conn in drain list */ 365 idl_t *conn_idl; /* Ptr to the drain list head */ 366 mblk_t *conn_ipsec_opt_mp; /* ipsec option mblk */ 367 zoneid_t conn_zoneid; /* zone connection is in */ 368 int conn_rtaware; /* RT_AWARE sockopt value */ 369 kcondvar_t conn_sq_cv; /* For non-STREAMS socket IO */ 370 sock_upcalls_t *conn_upcalls; /* Upcalls to sockfs */ 371 sock_upper_handle_t conn_upper_handle; /* Upper handle: sonode * */ 372 373 unsigned int 374 conn_mlp_type : 2, /* mlp_type_t; tsol/tndb.h */ 375 conn_anon_mlp : 1, /* user wants anon MLP */ 376 conn_anon_port : 1, /* user bound anonymously */ 377 378 conn_mac_mode : 2, /* normal/loose/implicit MAC */ 379 conn_anon_priv_bind : 1, /* *_ANON_PRIV_BIND state */ 380 conn_zone_is_global : 1, /* GLOBAL_ZONEID */ 381 conn_isvrrp : 1, /* VRRP control socket */ 382 conn_spare : 23; 383 384 boolean_t conn_flow_cntrld; 385 netstack_t *conn_netstack; /* Corresponds to a netstack_hold */ 386 387 /* 388 * IP format that packets received for this struct should use. 389 * Value can be IP4_VERSION or IPV6_VERSION. 390 * The sending version is encoded using IXAF_IS_IPV4. 391 */ 392 ushort_t conn_ipversion; 393 394 /* Written to only once at the time of opening the endpoint */ 395 sa_family_t conn_family; /* Family from socket() call */ 396 uint_t conn_so_type; /* Type from socket() call */ 397 398 uint_t conn_sndbuf; /* SO_SNDBUF state */ 399 uint_t conn_rcvbuf; /* SO_RCVBUF state */ 400 uint_t conn_wroff; /* Current write offset */ 401 402 uint_t conn_sndlowat; /* Send buffer low water mark */ 403 uint_t conn_rcvlowat; /* Recv buffer low water mark */ 404 405 uint8_t conn_default_ttl; /* Default TTL/hoplimit */ 406 407 uint32_t conn_flowinfo; /* Connected flow id and tclass */ 408 409 /* 410 * The most recent address for sendto. Initially set to zero 411 * which is always different than then the destination address 412 * since the send interprets zero as the loopback address. 413 */ 414 in6_addr_t conn_v6lastdst; 415 #define conn_v4lastdst V4_PART_OF_V6(conn_v6lastdst) 416 ushort_t conn_lastipversion; 417 in_port_t conn_lastdstport; 418 uint32_t conn_lastflowinfo; /* IPv6-only */ 419 uint_t conn_lastscopeid; /* IPv6-only */ 420 uint_t conn_lastsrcid; /* Only for AF_INET6 */ 421 /* 422 * When we are not connected conn_saddr might be unspecified. 423 * We track the source that was used with conn_v6lastdst here. 424 */ 425 in6_addr_t conn_v6lastsrc; 426 #define conn_v4lastsrc V4_PART_OF_V6(conn_v6lastsrc) 427 428 /* Templates for transmitting packets */ 429 ip_pkt_t conn_xmit_ipp; /* Options if no ancil data */ 430 431 /* 432 * Header template - conn_ht_ulp is a pointer into conn_ht_iphc. 433 * Note that ixa_ip_hdr_length indicates the offset of ht_ulp in 434 * ht_iphc 435 * 436 * The header template is maintained for connected endpoints (and 437 * updated when sticky options are changed) and also for the lastdst. 438 * There is no conflict between those usages since SOCK_DGRAM and 439 * SOCK_RAW can not be used to specify a destination address (with 440 * sendto/sendmsg) if the socket has been connected. 441 */ 442 uint8_t *conn_ht_iphc; /* Start of IP header */ 443 uint_t conn_ht_iphc_allocated; /* Allocated buffer size */ 444 uint_t conn_ht_iphc_len; /* IP+ULP size */ 445 uint8_t *conn_ht_ulp; /* Upper-layer header */ 446 uint_t conn_ht_ulp_len; /* ULP header len */ 447 448 /* Checksum to compensate for source routed packets. Host byte order */ 449 uint32_t conn_sum; 450 451 uint32_t conn_ioctlref; /* ioctl ref count */ 452 #ifdef CONN_DEBUG 453 #define CONN_TRACE_MAX 10 454 int conn_trace_last; /* ndx of last used tracebuf */ 455 conn_trace_t conn_trace_buf[CONN_TRACE_MAX]; 456 #endif 457 }; 458 459 /* 460 * connf_t - connection fanout data. 461 * 462 * The hash tables and their linkage (conn_t.{hashnextp, hashprevp} are 463 * protected by the per-bucket lock. Each conn_t inserted in the list 464 * points back at the connf_t that heads the bucket. 465 */ 466 struct connf_s { 467 struct conn_s *connf_head; 468 kmutex_t connf_lock; 469 }; 470 471 #define CONN_INC_REF(connp) { \ 472 mutex_enter(&(connp)->conn_lock); \ 473 DTRACE_PROBE1(conn__inc__ref, conn_t *, connp); \ 474 ASSERT(conn_trace_ref(connp)); \ 475 (connp)->conn_ref++; \ 476 ASSERT((connp)->conn_ref != 0); \ 477 mutex_exit(&(connp)->conn_lock); \ 478 } 479 480 #define CONN_INC_REF_LOCKED(connp) { \ 481 DTRACE_PROBE1(conn__inc__ref, conn_t *, connp); \ 482 ASSERT(MUTEX_HELD(&(connp)->conn_lock)); \ 483 ASSERT(conn_trace_ref(connp)); \ 484 (connp)->conn_ref++; \ 485 ASSERT((connp)->conn_ref != 0); \ 486 } 487 488 #define CONN_DEC_REF(connp) { \ 489 mutex_enter(&(connp)->conn_lock); \ 490 DTRACE_PROBE1(conn__dec__ref, conn_t *, connp); \ 491 /* \ 492 * The squeue framework always does a CONN_DEC_REF after return \ 493 * from TCP. Hence the refcnt must be at least 2 if conn_on_sqp \ 494 * is B_TRUE and conn_ref is being decremented. This is to \ 495 * account for the mblk being currently processed. \ 496 */ \ 497 if ((connp)->conn_ref == 0 || \ 498 ((connp)->conn_ref == 1 && (connp)->conn_on_sqp)) \ 499 cmn_err(CE_PANIC, "CONN_DEC_REF: connp(%p) has ref " \ 500 "= %d\n", (void *)(connp), (connp)->conn_ref); \ 501 ASSERT(conn_untrace_ref(connp)); \ 502 (connp)->conn_ref--; \ 503 if ((connp)->conn_ref == 0) { \ 504 /* Refcnt can't increase again, safe to drop lock */ \ 505 mutex_exit(&(connp)->conn_lock); \ 506 ipcl_conn_destroy(connp); \ 507 } else { \ 508 cv_broadcast(&(connp)->conn_cv); \ 509 mutex_exit(&(connp)->conn_lock); \ 510 } \ 511 } 512 513 /* 514 * For use with subsystems within ip which use ALL_ZONES as a wildcard 515 */ 516 #define IPCL_ZONEID(connp) \ 517 ((connp)->conn_allzones ? ALL_ZONES : (connp)->conn_zoneid) 518 519 /* 520 * For matching between a conn_t and a zoneid. 521 */ 522 #define IPCL_ZONE_MATCH(connp, zoneid) \ 523 (((connp)->conn_allzones) || \ 524 ((zoneid) == ALL_ZONES) || \ 525 (connp)->conn_zoneid == (zoneid)) 526 527 /* 528 * On a labeled system, we must treat bindings to ports 529 * on shared IP addresses by sockets with MAC exemption 530 * privilege as being in all zones, as there's 531 * otherwise no way to identify the right receiver. 532 */ 533 534 #define IPCL_CONNS_MAC(conn1, conn2) \ 535 (((conn1)->conn_mac_mode != CONN_MAC_DEFAULT) || \ 536 ((conn2)->conn_mac_mode != CONN_MAC_DEFAULT)) 537 538 #define IPCL_BIND_ZONE_MATCH(conn1, conn2) \ 539 (IPCL_CONNS_MAC(conn1, conn2) || \ 540 IPCL_ZONE_MATCH(conn1, conn2->conn_zoneid) || \ 541 IPCL_ZONE_MATCH(conn2, conn1->conn_zoneid)) 542 543 544 #define _IPCL_V4_MATCH(v6addr, v4addr) \ 545 (V4_PART_OF_V6((v6addr)) == (v4addr) && IN6_IS_ADDR_V4MAPPED(&(v6addr))) 546 547 #define _IPCL_V4_MATCH_ANY(addr) \ 548 (IN6_IS_ADDR_V4MAPPED_ANY(&(addr)) || IN6_IS_ADDR_UNSPECIFIED(&(addr))) 549 550 551 /* 552 * IPCL_PROTO_MATCH() and IPCL_PROTO_MATCH_V6() only matches conns with 553 * the specified ira_zoneid or conn_allzones by calling conn_wantpacket. 554 */ 555 #define IPCL_PROTO_MATCH(connp, ira, ipha) \ 556 ((((connp)->conn_laddr_v4 == INADDR_ANY) || \ 557 (((connp)->conn_laddr_v4 == ((ipha)->ipha_dst)) && \ 558 (((connp)->conn_faddr_v4 == INADDR_ANY) || \ 559 ((connp)->conn_faddr_v4 == ((ipha)->ipha_src))))) && \ 560 conn_wantpacket((connp), (ira), (ipha))) 561 562 #define IPCL_PROTO_MATCH_V6(connp, ira, ip6h) \ 563 ((IN6_IS_ADDR_UNSPECIFIED(&(connp)->conn_laddr_v6) || \ 564 (IN6_ARE_ADDR_EQUAL(&(connp)->conn_laddr_v6, &((ip6h)->ip6_dst)) && \ 565 (IN6_IS_ADDR_UNSPECIFIED(&(connp)->conn_faddr_v6) || \ 566 IN6_ARE_ADDR_EQUAL(&(connp)->conn_faddr_v6, &((ip6h)->ip6_src))))) && \ 567 (conn_wantpacket_v6((connp), (ira), (ip6h)))) 568 569 #define IPCL_CONN_HASH(src, ports, ipst) \ 570 ((unsigned)(ntohl((src)) ^ ((ports) >> 24) ^ ((ports) >> 16) ^ \ 571 ((ports) >> 8) ^ (ports)) % (ipst)->ips_ipcl_conn_fanout_size) 572 573 #define IPCL_CONN_HASH_V6(src, ports, ipst) \ 574 IPCL_CONN_HASH(V4_PART_OF_V6((src)), (ports), (ipst)) 575 576 #define IPCL_CONN_MATCH(connp, proto, src, dst, ports) \ 577 ((connp)->conn_proto == (proto) && \ 578 (connp)->conn_ports == (ports) && \ 579 _IPCL_V4_MATCH((connp)->conn_faddr_v6, (src)) && \ 580 _IPCL_V4_MATCH((connp)->conn_laddr_v6, (dst)) && \ 581 !(connp)->conn_ipv6_v6only) 582 583 #define IPCL_CONN_MATCH_V6(connp, proto, src, dst, ports) \ 584 ((connp)->conn_proto == (proto) && \ 585 (connp)->conn_ports == (ports) && \ 586 IN6_ARE_ADDR_EQUAL(&(connp)->conn_faddr_v6, &(src)) && \ 587 IN6_ARE_ADDR_EQUAL(&(connp)->conn_laddr_v6, &(dst))) 588 589 #define IPCL_PORT_HASH(port, size) \ 590 ((((port) >> 8) ^ (port)) & ((size) - 1)) 591 592 #define IPCL_BIND_HASH(lport, ipst) \ 593 ((unsigned)(((lport) >> 8) ^ (lport)) % \ 594 (ipst)->ips_ipcl_bind_fanout_size) 595 596 #define IPCL_BIND_MATCH(connp, proto, laddr, lport) \ 597 ((connp)->conn_proto == (proto) && \ 598 (connp)->conn_lport == (lport) && \ 599 (_IPCL_V4_MATCH_ANY((connp)->conn_laddr_v6) || \ 600 _IPCL_V4_MATCH((connp)->conn_laddr_v6, (laddr))) && \ 601 !(connp)->conn_ipv6_v6only) 602 603 #define IPCL_BIND_MATCH_V6(connp, proto, laddr, lport) \ 604 ((connp)->conn_proto == (proto) && \ 605 (connp)->conn_lport == (lport) && \ 606 (IN6_ARE_ADDR_EQUAL(&(connp)->conn_laddr_v6, &(laddr)) || \ 607 IN6_IS_ADDR_UNSPECIFIED(&(connp)->conn_laddr_v6))) 608 609 /* 610 * We compare conn_laddr since it captures both connected and a bind to 611 * a multicast or broadcast address. 612 * The caller needs to match the zoneid and also call conn_wantpacket 613 * for multicast, broadcast, or when conn_incoming_ifindex is set. 614 */ 615 #define IPCL_UDP_MATCH(connp, lport, laddr, fport, faddr) \ 616 (((connp)->conn_lport == (lport)) && \ 617 ((_IPCL_V4_MATCH_ANY((connp)->conn_laddr_v6) || \ 618 (_IPCL_V4_MATCH((connp)->conn_laddr_v6, (laddr)) && \ 619 (_IPCL_V4_MATCH_ANY((connp)->conn_faddr_v6) || \ 620 (_IPCL_V4_MATCH((connp)->conn_faddr_v6, (faddr)) && \ 621 (connp)->conn_fport == (fport)))))) && \ 622 !(connp)->conn_ipv6_v6only) 623 624 /* 625 * We compare conn_laddr since it captures both connected and a bind to 626 * a multicast or broadcast address. 627 * The caller needs to match the zoneid and also call conn_wantpacket_v6 628 * for multicast or when conn_incoming_ifindex is set. 629 */ 630 #define IPCL_UDP_MATCH_V6(connp, lport, laddr, fport, faddr) \ 631 (((connp)->conn_lport == (lport)) && \ 632 (IN6_IS_ADDR_UNSPECIFIED(&(connp)->conn_laddr_v6) || \ 633 (IN6_ARE_ADDR_EQUAL(&(connp)->conn_laddr_v6, &(laddr)) && \ 634 (IN6_IS_ADDR_UNSPECIFIED(&(connp)->conn_faddr_v6) || \ 635 (IN6_ARE_ADDR_EQUAL(&(connp)->conn_faddr_v6, &(faddr)) && \ 636 (connp)->conn_fport == (fport)))))) 637 638 #define IPCL_IPTUN_HASH(laddr, faddr) \ 639 ((ntohl(laddr) ^ ((ntohl(faddr) << 24) | (ntohl(faddr) >> 8))) % \ 640 ipcl_iptun_fanout_size) 641 642 #define IPCL_IPTUN_HASH_V6(laddr, faddr) \ 643 IPCL_IPTUN_HASH((laddr)->s6_addr32[0] ^ (laddr)->s6_addr32[1] ^ \ 644 (faddr)->s6_addr32[2] ^ (faddr)->s6_addr32[3], \ 645 (faddr)->s6_addr32[0] ^ (faddr)->s6_addr32[1] ^ \ 646 (laddr)->s6_addr32[2] ^ (laddr)->s6_addr32[3]) 647 648 #define IPCL_IPTUN_MATCH(connp, laddr, faddr) \ 649 (_IPCL_V4_MATCH((connp)->conn_laddr_v6, (laddr)) && \ 650 _IPCL_V4_MATCH((connp)->conn_faddr_v6, (faddr))) 651 652 #define IPCL_IPTUN_MATCH_V6(connp, laddr, faddr) \ 653 (IN6_ARE_ADDR_EQUAL(&(connp)->conn_laddr_v6, (laddr)) && \ 654 IN6_ARE_ADDR_EQUAL(&(connp)->conn_faddr_v6, (faddr))) 655 656 #define IPCL_UDP_HASH(lport, ipst) \ 657 IPCL_PORT_HASH(lport, (ipst)->ips_ipcl_udp_fanout_size) 658 659 #define IPCL_DCCP_HASH(lport, ipst) \ 660 IPCL_PORT_HASH(lport, (ipst)->ips_ipcl_dccp_fanout_size) 661 662 #define CONN_G_HASH_SIZE 1024 663 664 /* Raw socket hash function. */ 665 #define IPCL_RAW_HASH(lport, ipst) \ 666 IPCL_PORT_HASH(lport, (ipst)->ips_ipcl_raw_fanout_size) 667 668 /* 669 * This is similar to IPCL_BIND_MATCH except that the local port check 670 * is changed to a wildcard port check. 671 * We compare conn_laddr since it captures both connected and a bind to 672 * a multicast or broadcast address. 673 */ 674 #define IPCL_RAW_MATCH(connp, proto, laddr) \ 675 ((connp)->conn_proto == (proto) && \ 676 (connp)->conn_lport == 0 && \ 677 (_IPCL_V4_MATCH_ANY((connp)->conn_laddr_v6) || \ 678 _IPCL_V4_MATCH((connp)->conn_laddr_v6, (laddr)))) 679 680 #define IPCL_RAW_MATCH_V6(connp, proto, laddr) \ 681 ((connp)->conn_proto == (proto) && \ 682 (connp)->conn_lport == 0 && \ 683 (IN6_IS_ADDR_UNSPECIFIED(&(connp)->conn_laddr_v6) || \ 684 IN6_ARE_ADDR_EQUAL(&(connp)->conn_laddr_v6, &(laddr)))) 685 686 /* Function prototypes */ 687 extern void ipcl_g_init(void); 688 extern void ipcl_init(ip_stack_t *); 689 extern void ipcl_g_destroy(void); 690 extern void ipcl_destroy(ip_stack_t *); 691 extern conn_t *ipcl_conn_create(uint32_t, int, netstack_t *); 692 extern void ipcl_conn_destroy(conn_t *); 693 694 void ipcl_hash_insert_wildcard(connf_t *, conn_t *); 695 void ipcl_hash_remove(conn_t *); 696 void ipcl_hash_remove_locked(conn_t *connp, connf_t *connfp); 697 698 extern int ipcl_bind_insert(conn_t *); 699 extern int ipcl_bind_insert_v4(conn_t *); 700 extern int ipcl_bind_insert_v6(conn_t *); 701 extern int ipcl_conn_insert(conn_t *); 702 extern int ipcl_conn_insert_v4(conn_t *); 703 extern int ipcl_conn_insert_v6(conn_t *); 704 extern conn_t *ipcl_get_next_conn(connf_t *, conn_t *, uint32_t); 705 706 conn_t *ipcl_classify_v4(mblk_t *, uint8_t, uint_t, ip_recv_attr_t *, 707 ip_stack_t *); 708 conn_t *ipcl_classify_v6(mblk_t *, uint8_t, uint_t, ip_recv_attr_t *, 709 ip_stack_t *); 710 conn_t *ipcl_classify(mblk_t *, ip_recv_attr_t *, ip_stack_t *); 711 conn_t *ipcl_classify_raw(mblk_t *, uint8_t, uint32_t, ipha_t *, 712 ip6_t *, ip_recv_attr_t *, ip_stack_t *); 713 conn_t *ipcl_iptun_classify_v4(ipaddr_t *, ipaddr_t *, ip_stack_t *); 714 conn_t *ipcl_iptun_classify_v6(in6_addr_t *, in6_addr_t *, ip_stack_t *); 715 void ipcl_globalhash_insert(conn_t *); 716 void ipcl_globalhash_remove(conn_t *); 717 void ipcl_walk(pfv_t, void *, ip_stack_t *); 718 conn_t *ipcl_tcp_lookup_reversed_ipv4(ipha_t *, tcpha_t *, int, ip_stack_t *); 719 conn_t *ipcl_tcp_lookup_reversed_ipv6(ip6_t *, tcpha_t *, int, uint_t, 720 ip_stack_t *); 721 conn_t *ipcl_lookup_listener_v4(uint16_t, ipaddr_t, zoneid_t, ip_stack_t *); 722 conn_t *ipcl_lookup_listener_v6(uint16_t, in6_addr_t *, uint_t, zoneid_t, 723 ip_stack_t *); 724 int conn_trace_ref(conn_t *); 725 int conn_untrace_ref(conn_t *); 726 void ipcl_conn_cleanup(conn_t *); 727 extern uint_t conn_recvancillary_size(conn_t *, crb_t, ip_recv_attr_t *, 728 mblk_t *, ip_pkt_t *); 729 extern void conn_recvancillary_add(conn_t *, crb_t, ip_recv_attr_t *, 730 ip_pkt_t *, uchar_t *, uint_t); 731 conn_t *ipcl_conn_tcp_lookup_reversed_ipv4(conn_t *, ipha_t *, tcpha_t *, 732 ip_stack_t *); 733 conn_t *ipcl_conn_tcp_lookup_reversed_ipv6(conn_t *, ip6_t *, tcpha_t *, 734 ip_stack_t *); 735 736 extern int ip_create_helper_stream(conn_t *, ldi_ident_t); 737 extern void ip_free_helper_stream(conn_t *); 738 extern int ip_helper_stream_setup(queue_t *, dev_t *, int, int, 739 cred_t *, boolean_t); 740 741 #ifdef __cplusplus 742 } 743 #endif 744 745 #endif /* _INET_IPCLASSIFIER_H */