1 /*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21 /*
22 * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
23 */
24
25 /*
26 * IP PACKET CLASSIFIER
27 *
28 * The IP packet classifier provides mapping between IP packets and persistent
29 * connection state for connection-oriented protocols. It also provides
30 * interface for managing connection states.
31 *
32 * The connection state is kept in conn_t data structure and contains, among
33 * other things:
34 *
35 * o local/remote address and ports
36 * o Transport protocol
37 * o squeue for the connection (for TCP only)
38 * o reference counter
39 * o Connection state
40 * o hash table linkage
41 * o interface/ire information
42 * o credentials
43 * o ipsec policy
44 * o send and receive functions.
45 * o mutex lock.
46 *
47 * Connections use a reference counting scheme. They are freed when the
48 * reference counter drops to zero. A reference is incremented when connection
49 * is placed in a list or table, when incoming packet for the connection arrives
50 * and when connection is processed via squeue (squeue processing may be
51 * asynchronous and the reference protects the connection from being destroyed
52 * before its processing is finished).
53 *
54 * conn_recv is used to pass up packets to the ULP.
55 * For TCP conn_recv changes. It is tcp_input_listener_unbound initially for
56 * a listener, and changes to tcp_input_listener as the listener has picked a
57 * good squeue. For other cases it is set to tcp_input_data.
58 *
59 * conn_recvicmp is used to pass up ICMP errors to the ULP.
60 *
61 * Classifier uses several hash tables:
62 *
63 * ipcl_conn_fanout: contains all TCP connections in CONNECTED state
64 * ipcl_bind_fanout: contains all connections in BOUND state
65 * ipcl_proto_fanout: IPv4 protocol fanout
66 * ipcl_proto_fanout_v6: IPv6 protocol fanout
67 * ipcl_udp_fanout: contains all UDP connections
68 * ipcl_iptun_fanout: contains all IP tunnel connections
69 * ipcl_globalhash_fanout: contains all connections
70 *
71 * The ipcl_globalhash_fanout is used for any walkers (like snmp and Clustering)
72 * which need to view all existing connections.
73 *
74 * All tables are protected by per-bucket locks. When both per-bucket lock and
75 * connection lock need to be held, the per-bucket lock should be acquired
76 * first, followed by the connection lock.
77 *
78 * All functions doing search in one of these tables increment a reference
79 * counter on the connection found (if any). This reference should be dropped
80 * when the caller has finished processing the connection.
81 *
82 *
83 * INTERFACES:
84 * ===========
85 *
86 * Connection Lookup:
87 * ------------------
88 *
89 * conn_t *ipcl_classify_v4(mp, protocol, hdr_len, ira, ip_stack)
90 * conn_t *ipcl_classify_v6(mp, protocol, hdr_len, ira, ip_stack)
91 *
92 * Finds connection for an incoming IPv4 or IPv6 packet. Returns NULL if
93 * it can't find any associated connection. If the connection is found, its
94 * reference counter is incremented.
95 *
96 * mp: mblock, containing packet header. The full header should fit
97 * into a single mblock. It should also contain at least full IP
98 * and TCP or UDP header.
99 *
100 * protocol: Either IPPROTO_TCP or IPPROTO_UDP.
101 *
102 * hdr_len: The size of IP header. It is used to find TCP or UDP header in
103 * the packet.
104 *
105 * ira->ira_zoneid: The zone in which the returned connection must be; the
106 * zoneid corresponding to the ire_zoneid on the IRE located for
107 * the packet's destination address.
108 *
109 * ira->ira_flags: Contains the IRAF_TX_MAC_EXEMPTABLE and
110 * IRAF_TX_SHARED_ADDR flags
111 *
112 * For TCP connections, the lookup order is as follows:
113 * 5-tuple {src, dst, protocol, local port, remote port}
114 * lookup in ipcl_conn_fanout table.
115 * 3-tuple {dst, remote port, protocol} lookup in
116 * ipcl_bind_fanout table.
117 *
118 * For UDP connections, a 5-tuple {src, dst, protocol, local port,
119 * remote port} lookup is done on ipcl_udp_fanout. Note that,
120 * these interfaces do not handle cases where a packets belongs
121 * to multiple UDP clients, which is handled in IP itself.
122 *
123 * If the destination IRE is ALL_ZONES (indicated by zoneid), then we must
124 * determine which actual zone gets the segment. This is used only in a
125 * labeled environment. The matching rules are:
126 *
127 * - If it's not a multilevel port, then the label on the packet selects
128 * the zone. Unlabeled packets are delivered to the global zone.
129 *
130 * - If it's a multilevel port, then only the zone registered to receive
131 * packets on that port matches.
132 *
133 * Also, in a labeled environment, packet labels need to be checked. For fully
134 * bound TCP connections, we can assume that the packet label was checked
135 * during connection establishment, and doesn't need to be checked on each
136 * packet. For others, though, we need to check for strict equality or, for
137 * multilevel ports, membership in the range or set. This part currently does
138 * a tnrh lookup on each packet, but could be optimized to use cached results
139 * if that were necessary. (SCTP doesn't come through here, but if it did,
140 * we would apply the same rules as TCP.)
141 *
142 * An implication of the above is that fully-bound TCP sockets must always use
143 * distinct 4-tuples; they can't be discriminated by label alone.
144 *
145 * Note that we cannot trust labels on packets sent to fully-bound UDP sockets,
146 * as there's no connection set-up handshake and no shared state.
147 *
148 * Labels on looped-back packets within a single zone do not need to be
149 * checked, as all processes in the same zone have the same label.
150 *
151 * Finally, for unlabeled packets received by a labeled system, special rules
152 * apply. We consider only the MLP if there is one. Otherwise, we prefer a
153 * socket in the zone whose label matches the default label of the sender, if
154 * any. In any event, the receiving socket must have SO_MAC_EXEMPT set and the
155 * receiver's label must dominate the sender's default label.
156 *
157 * conn_t *ipcl_tcp_lookup_reversed_ipv4(ipha_t *, tcpha_t *, int, ip_stack);
158 * conn_t *ipcl_tcp_lookup_reversed_ipv6(ip6_t *, tcpha_t *, int, uint_t,
159 * ip_stack);
160 *
161 * Lookup routine to find a exact match for {src, dst, local port,
162 * remote port) for TCP connections in ipcl_conn_fanout. The address and
163 * ports are read from the IP and TCP header respectively.
164 *
165 * conn_t *ipcl_lookup_listener_v4(lport, laddr, protocol,
166 * zoneid, ip_stack);
167 * conn_t *ipcl_lookup_listener_v6(lport, laddr, protocol, ifindex,
168 * zoneid, ip_stack);
169 *
170 * Lookup routine to find a listener with the tuple {lport, laddr,
171 * protocol} in the ipcl_bind_fanout table. For IPv6, an additional
172 * parameter interface index is also compared.
173 *
174 * void ipcl_walk(func, arg, ip_stack)
175 *
176 * Apply 'func' to every connection available. The 'func' is called as
177 * (*func)(connp, arg). The walk is non-atomic so connections may be
178 * created and destroyed during the walk. The CONN_CONDEMNED and
179 * CONN_INCIPIENT flags ensure that connections which are newly created
180 * or being destroyed are not selected by the walker.
181 *
182 * Table Updates
183 * -------------
184 *
185 * int ipcl_conn_insert(connp);
186 * int ipcl_conn_insert_v4(connp);
187 * int ipcl_conn_insert_v6(connp);
188 *
189 * Insert 'connp' in the ipcl_conn_fanout.
190 * Arguements :
191 * connp conn_t to be inserted
192 *
193 * Return value :
194 * 0 if connp was inserted
195 * EADDRINUSE if the connection with the same tuple
196 * already exists.
197 *
198 * int ipcl_bind_insert(connp);
199 * int ipcl_bind_insert_v4(connp);
200 * int ipcl_bind_insert_v6(connp);
201 *
202 * Insert 'connp' in ipcl_bind_fanout.
203 * Arguements :
204 * connp conn_t to be inserted
205 *
206 *
207 * void ipcl_hash_remove(connp);
208 *
209 * Removes the 'connp' from the connection fanout table.
210 *
211 * Connection Creation/Destruction
212 * -------------------------------
213 *
214 * conn_t *ipcl_conn_create(type, sleep, netstack_t *)
215 *
216 * Creates a new conn based on the type flag, inserts it into
217 * globalhash table.
218 *
219 * type: This flag determines the type of conn_t which needs to be
220 * created i.e., which kmem_cache it comes from.
221 * IPCL_TCPCONN indicates a TCP connection
222 * IPCL_SCTPCONN indicates a SCTP connection
223 * IPCL_UDPCONN indicates a UDP conn_t.
224 * IPCL_RAWIPCONN indicates a RAWIP/ICMP conn_t.
225 * IPCL_RTSCONN indicates a RTS conn_t.
226 * IPCL_IPCCONN indicates all other connections.
227 *
228 * void ipcl_conn_destroy(connp)
229 *
230 * Destroys the connection state, removes it from the global
231 * connection hash table and frees its memory.
232 */
233
234 #include <sys/types.h>
235 #include <sys/stream.h>
236 #include <sys/stropts.h>
237 #include <sys/sysmacros.h>
238 #include <sys/strsubr.h>
239 #include <sys/strsun.h>
240 #define _SUN_TPI_VERSION 2
241 #include <sys/ddi.h>
242 #include <sys/cmn_err.h>
243 #include <sys/debug.h>
244
245 #include <sys/systm.h>
246 #include <sys/param.h>
247 #include <sys/kmem.h>
248 #include <sys/isa_defs.h>
249 #include <inet/common.h>
250 #include <netinet/ip6.h>
251 #include <netinet/icmp6.h>
252
253 #include <inet/ip.h>
254 #include <inet/ip_if.h>
255 #include <inet/ip_ire.h>
256 #include <inet/ip6.h>
257 #include <inet/ip_ndp.h>
258 #include <inet/ip_impl.h>
259 #include <inet/udp_impl.h>
260 #include <inet/sctp_ip.h>
261 #include <inet/sctp/sctp_impl.h>
262 #include <inet/rawip_impl.h>
263 #include <inet/rts_impl.h>
264 #include <inet/iptun/iptun_impl.h>
265
266 #include <sys/cpuvar.h>
267
268 #include <inet/ipclassifier.h>
269 #include <inet/tcp.h>
270 #include <inet/ipsec_impl.h>
271
272 #include <sys/tsol/tnet.h>
273 #include <sys/sockio.h>
274
275 /* Old value for compatibility. Setable in /etc/system */
276 uint_t tcp_conn_hash_size = 0;
277
278 /* New value. Zero means choose automatically. Setable in /etc/system */
279 uint_t ipcl_conn_hash_size = 0;
280 uint_t ipcl_conn_hash_memfactor = 8192;
281 uint_t ipcl_conn_hash_maxsize = 82500;
282
283 /* bind/udp fanout table size */
284 uint_t ipcl_bind_fanout_size = 512;
285 uint_t ipcl_udp_fanout_size = 16384;
286
287 /* Raw socket fanout size. Must be a power of 2. */
288 uint_t ipcl_raw_fanout_size = 256;
289
290 /*
291 * The IPCL_IPTUN_HASH() function works best with a prime table size. We
292 * expect that most large deployments would have hundreds of tunnels, and
293 * thousands in the extreme case.
294 */
295 uint_t ipcl_iptun_fanout_size = 6143;
296
297 /*
298 * Power of 2^N Primes useful for hashing for N of 0-28,
299 * these primes are the nearest prime <= 2^N - 2^(N-2).
300 */
301
302 #define P2Ps() {0, 0, 0, 5, 11, 23, 47, 89, 191, 383, 761, 1531, 3067, \
303 6143, 12281, 24571, 49139, 98299, 196597, 393209, \
304 786431, 1572853, 3145721, 6291449, 12582893, 25165813, \
305 50331599, 100663291, 201326557, 0}
306
307 /*
308 * wrapper structure to ensure that conn and what follows it (tcp_t, etc)
309 * are aligned on cache lines.
310 */
311 typedef union itc_s {
312 conn_t itc_conn;
313 char itcu_filler[CACHE_ALIGN(conn_s)];
314 } itc_t;
315
316 struct kmem_cache *tcp_conn_cache;
317 struct kmem_cache *ip_conn_cache;
318 extern struct kmem_cache *sctp_conn_cache;
319 struct kmem_cache *udp_conn_cache;
320 struct kmem_cache *rawip_conn_cache;
321 struct kmem_cache *rts_conn_cache;
322
323 extern void tcp_timermp_free(tcp_t *);
324 extern mblk_t *tcp_timermp_alloc(int);
325
326 static int ip_conn_constructor(void *, void *, int);
327 static void ip_conn_destructor(void *, void *);
328
329 static int tcp_conn_constructor(void *, void *, int);
330 static void tcp_conn_destructor(void *, void *);
331
332 static int udp_conn_constructor(void *, void *, int);
333 static void udp_conn_destructor(void *, void *);
334
335 static int rawip_conn_constructor(void *, void *, int);
336 static void rawip_conn_destructor(void *, void *);
337
338 static int rts_conn_constructor(void *, void *, int);
339 static void rts_conn_destructor(void *, void *);
340
341 /*
342 * Global (for all stack instances) init routine
343 */
344 void
345 ipcl_g_init(void)
346 {
347 ip_conn_cache = kmem_cache_create("ip_conn_cache",
348 sizeof (conn_t), CACHE_ALIGN_SIZE,
349 ip_conn_constructor, ip_conn_destructor,
350 NULL, NULL, NULL, 0);
351
352 tcp_conn_cache = kmem_cache_create("tcp_conn_cache",
353 sizeof (itc_t) + sizeof (tcp_t), CACHE_ALIGN_SIZE,
354 tcp_conn_constructor, tcp_conn_destructor,
355 tcp_conn_reclaim, NULL, NULL, 0);
356
357 udp_conn_cache = kmem_cache_create("udp_conn_cache",
358 sizeof (itc_t) + sizeof (udp_t), CACHE_ALIGN_SIZE,
359 udp_conn_constructor, udp_conn_destructor,
360 NULL, NULL, NULL, 0);
361
362 rawip_conn_cache = kmem_cache_create("rawip_conn_cache",
363 sizeof (itc_t) + sizeof (icmp_t), CACHE_ALIGN_SIZE,
364 rawip_conn_constructor, rawip_conn_destructor,
365 NULL, NULL, NULL, 0);
366
367 rts_conn_cache = kmem_cache_create("rts_conn_cache",
368 sizeof (itc_t) + sizeof (rts_t), CACHE_ALIGN_SIZE,
369 rts_conn_constructor, rts_conn_destructor,
370 NULL, NULL, NULL, 0);
371 }
372
373 /*
374 * ipclassifier intialization routine, sets up hash tables.
375 */
376 void
377 ipcl_init(ip_stack_t *ipst)
378 {
379 int i;
380 int sizes[] = P2Ps();
381
382 /*
383 * Calculate size of conn fanout table from /etc/system settings
384 */
385 if (ipcl_conn_hash_size != 0) {
386 ipst->ips_ipcl_conn_fanout_size = ipcl_conn_hash_size;
387 } else if (tcp_conn_hash_size != 0) {
388 ipst->ips_ipcl_conn_fanout_size = tcp_conn_hash_size;
389 } else {
390 extern pgcnt_t freemem;
391
392 ipst->ips_ipcl_conn_fanout_size =
393 (freemem * PAGESIZE) / ipcl_conn_hash_memfactor;
394
395 if (ipst->ips_ipcl_conn_fanout_size > ipcl_conn_hash_maxsize) {
396 ipst->ips_ipcl_conn_fanout_size =
397 ipcl_conn_hash_maxsize;
398 }
399 }
400
401 for (i = 9; i < sizeof (sizes) / sizeof (*sizes) - 1; i++) {
402 if (sizes[i] >= ipst->ips_ipcl_conn_fanout_size) {
403 break;
404 }
405 }
406 if ((ipst->ips_ipcl_conn_fanout_size = sizes[i]) == 0) {
407 /* Out of range, use the 2^16 value */
408 ipst->ips_ipcl_conn_fanout_size = sizes[16];
409 }
410
411 /* Take values from /etc/system */
412 ipst->ips_ipcl_bind_fanout_size = ipcl_bind_fanout_size;
413 ipst->ips_ipcl_udp_fanout_size = ipcl_udp_fanout_size;
414 ipst->ips_ipcl_raw_fanout_size = ipcl_raw_fanout_size;
415 ipst->ips_ipcl_iptun_fanout_size = ipcl_iptun_fanout_size;
416
417 ASSERT(ipst->ips_ipcl_conn_fanout == NULL);
418
419 ipst->ips_ipcl_conn_fanout = kmem_zalloc(
420 ipst->ips_ipcl_conn_fanout_size * sizeof (connf_t), KM_SLEEP);
421
422 for (i = 0; i < ipst->ips_ipcl_conn_fanout_size; i++) {
423 mutex_init(&ipst->ips_ipcl_conn_fanout[i].connf_lock, NULL,
424 MUTEX_DEFAULT, NULL);
425 }
426
427 ipst->ips_ipcl_bind_fanout = kmem_zalloc(
428 ipst->ips_ipcl_bind_fanout_size * sizeof (connf_t), KM_SLEEP);
429
430 for (i = 0; i < ipst->ips_ipcl_bind_fanout_size; i++) {
431 mutex_init(&ipst->ips_ipcl_bind_fanout[i].connf_lock, NULL,
432 MUTEX_DEFAULT, NULL);
433 }
434
435 ipst->ips_ipcl_proto_fanout_v4 = kmem_zalloc(IPPROTO_MAX *
436 sizeof (connf_t), KM_SLEEP);
437 for (i = 0; i < IPPROTO_MAX; i++) {
438 mutex_init(&ipst->ips_ipcl_proto_fanout_v4[i].connf_lock, NULL,
439 MUTEX_DEFAULT, NULL);
440 }
441
442 ipst->ips_ipcl_proto_fanout_v6 = kmem_zalloc(IPPROTO_MAX *
443 sizeof (connf_t), KM_SLEEP);
444 for (i = 0; i < IPPROTO_MAX; i++) {
445 mutex_init(&ipst->ips_ipcl_proto_fanout_v6[i].connf_lock, NULL,
446 MUTEX_DEFAULT, NULL);
447 }
448
449 ipst->ips_rts_clients = kmem_zalloc(sizeof (connf_t), KM_SLEEP);
450 mutex_init(&ipst->ips_rts_clients->connf_lock,
451 NULL, MUTEX_DEFAULT, NULL);
452
453 ipst->ips_ipcl_udp_fanout = kmem_zalloc(
454 ipst->ips_ipcl_udp_fanout_size * sizeof (connf_t), KM_SLEEP);
455 for (i = 0; i < ipst->ips_ipcl_udp_fanout_size; i++) {
456 mutex_init(&ipst->ips_ipcl_udp_fanout[i].connf_lock, NULL,
457 MUTEX_DEFAULT, NULL);
458 }
459
460 ipst->ips_ipcl_iptun_fanout = kmem_zalloc(
461 ipst->ips_ipcl_iptun_fanout_size * sizeof (connf_t), KM_SLEEP);
462 for (i = 0; i < ipst->ips_ipcl_iptun_fanout_size; i++) {
463 mutex_init(&ipst->ips_ipcl_iptun_fanout[i].connf_lock, NULL,
464 MUTEX_DEFAULT, NULL);
465 }
466
467 ipst->ips_ipcl_raw_fanout = kmem_zalloc(
468 ipst->ips_ipcl_raw_fanout_size * sizeof (connf_t), KM_SLEEP);
469 for (i = 0; i < ipst->ips_ipcl_raw_fanout_size; i++) {
470 mutex_init(&ipst->ips_ipcl_raw_fanout[i].connf_lock, NULL,
471 MUTEX_DEFAULT, NULL);
472 }
473
474 ipst->ips_ipcl_globalhash_fanout = kmem_zalloc(
475 sizeof (connf_t) * CONN_G_HASH_SIZE, KM_SLEEP);
476 for (i = 0; i < CONN_G_HASH_SIZE; i++) {
477 mutex_init(&ipst->ips_ipcl_globalhash_fanout[i].connf_lock,
478 NULL, MUTEX_DEFAULT, NULL);
479 }
480 }
481
482 void
483 ipcl_g_destroy(void)
484 {
485 kmem_cache_destroy(ip_conn_cache);
486 kmem_cache_destroy(tcp_conn_cache);
487 kmem_cache_destroy(udp_conn_cache);
488 kmem_cache_destroy(rawip_conn_cache);
489 kmem_cache_destroy(rts_conn_cache);
490 }
491
492 /*
493 * All user-level and kernel use of the stack must be gone
494 * by now.
495 */
496 void
497 ipcl_destroy(ip_stack_t *ipst)
498 {
499 int i;
500
501 for (i = 0; i < ipst->ips_ipcl_conn_fanout_size; i++) {
502 ASSERT(ipst->ips_ipcl_conn_fanout[i].connf_head == NULL);
503 mutex_destroy(&ipst->ips_ipcl_conn_fanout[i].connf_lock);
504 }
505 kmem_free(ipst->ips_ipcl_conn_fanout, ipst->ips_ipcl_conn_fanout_size *
506 sizeof (connf_t));
507 ipst->ips_ipcl_conn_fanout = NULL;
508
509 for (i = 0; i < ipst->ips_ipcl_bind_fanout_size; i++) {
510 ASSERT(ipst->ips_ipcl_bind_fanout[i].connf_head == NULL);
511 mutex_destroy(&ipst->ips_ipcl_bind_fanout[i].connf_lock);
512 }
513 kmem_free(ipst->ips_ipcl_bind_fanout, ipst->ips_ipcl_bind_fanout_size *
514 sizeof (connf_t));
515 ipst->ips_ipcl_bind_fanout = NULL;
516
517 for (i = 0; i < IPPROTO_MAX; i++) {
518 ASSERT(ipst->ips_ipcl_proto_fanout_v4[i].connf_head == NULL);
519 mutex_destroy(&ipst->ips_ipcl_proto_fanout_v4[i].connf_lock);
520 }
521 kmem_free(ipst->ips_ipcl_proto_fanout_v4,
522 IPPROTO_MAX * sizeof (connf_t));
523 ipst->ips_ipcl_proto_fanout_v4 = NULL;
524
525 for (i = 0; i < IPPROTO_MAX; i++) {
526 ASSERT(ipst->ips_ipcl_proto_fanout_v6[i].connf_head == NULL);
527 mutex_destroy(&ipst->ips_ipcl_proto_fanout_v6[i].connf_lock);
528 }
529 kmem_free(ipst->ips_ipcl_proto_fanout_v6,
530 IPPROTO_MAX * sizeof (connf_t));
531 ipst->ips_ipcl_proto_fanout_v6 = NULL;
532
533 for (i = 0; i < ipst->ips_ipcl_udp_fanout_size; i++) {
534 ASSERT(ipst->ips_ipcl_udp_fanout[i].connf_head == NULL);
535 mutex_destroy(&ipst->ips_ipcl_udp_fanout[i].connf_lock);
536 }
537 kmem_free(ipst->ips_ipcl_udp_fanout, ipst->ips_ipcl_udp_fanout_size *
538 sizeof (connf_t));
539 ipst->ips_ipcl_udp_fanout = NULL;
540
541 for (i = 0; i < ipst->ips_ipcl_iptun_fanout_size; i++) {
542 ASSERT(ipst->ips_ipcl_iptun_fanout[i].connf_head == NULL);
543 mutex_destroy(&ipst->ips_ipcl_iptun_fanout[i].connf_lock);
544 }
545 kmem_free(ipst->ips_ipcl_iptun_fanout,
546 ipst->ips_ipcl_iptun_fanout_size * sizeof (connf_t));
547 ipst->ips_ipcl_iptun_fanout = NULL;
548
549 for (i = 0; i < ipst->ips_ipcl_raw_fanout_size; i++) {
550 ASSERT(ipst->ips_ipcl_raw_fanout[i].connf_head == NULL);
551 mutex_destroy(&ipst->ips_ipcl_raw_fanout[i].connf_lock);
552 }
553 kmem_free(ipst->ips_ipcl_raw_fanout, ipst->ips_ipcl_raw_fanout_size *
554 sizeof (connf_t));
555 ipst->ips_ipcl_raw_fanout = NULL;
556
557 for (i = 0; i < CONN_G_HASH_SIZE; i++) {
558 ASSERT(ipst->ips_ipcl_globalhash_fanout[i].connf_head == NULL);
559 mutex_destroy(&ipst->ips_ipcl_globalhash_fanout[i].connf_lock);
560 }
561 kmem_free(ipst->ips_ipcl_globalhash_fanout,
562 sizeof (connf_t) * CONN_G_HASH_SIZE);
563 ipst->ips_ipcl_globalhash_fanout = NULL;
564
565 ASSERT(ipst->ips_rts_clients->connf_head == NULL);
566 mutex_destroy(&ipst->ips_rts_clients->connf_lock);
567 kmem_free(ipst->ips_rts_clients, sizeof (connf_t));
568 ipst->ips_rts_clients = NULL;
569 }
570
571 /*
572 * conn creation routine. initialize the conn, sets the reference
573 * and inserts it in the global hash table.
574 */
575 conn_t *
576 ipcl_conn_create(uint32_t type, int sleep, netstack_t *ns)
577 {
578 conn_t *connp;
579 struct kmem_cache *conn_cache;
580
581 switch (type) {
582 case IPCL_SCTPCONN:
583 if ((connp = kmem_cache_alloc(sctp_conn_cache, sleep)) == NULL)
584 return (NULL);
585 sctp_conn_init(connp);
586 netstack_hold(ns);
587 connp->conn_netstack = ns;
588 connp->conn_ixa->ixa_ipst = ns->netstack_ip;
589 connp->conn_ixa->ixa_conn_id = (long)connp;
590 ipcl_globalhash_insert(connp);
591 return (connp);
592
593 case IPCL_TCPCONN:
594 conn_cache = tcp_conn_cache;
595 break;
596
597 case IPCL_UDPCONN:
598 conn_cache = udp_conn_cache;
599 break;
600
601 case IPCL_RAWIPCONN:
602 conn_cache = rawip_conn_cache;
603 break;
604
605 case IPCL_RTSCONN:
606 conn_cache = rts_conn_cache;
607 break;
608
609 case IPCL_IPCCONN:
610 conn_cache = ip_conn_cache;
611 break;
612
613 default:
614 connp = NULL;
615 ASSERT(0);
616 }
617
618 if ((connp = kmem_cache_alloc(conn_cache, sleep)) == NULL)
619 return (NULL);
620
621 connp->conn_ref = 1;
622 netstack_hold(ns);
623 connp->conn_netstack = ns;
624 connp->conn_ixa->ixa_ipst = ns->netstack_ip;
625 connp->conn_ixa->ixa_conn_id = (long)connp;
626 ipcl_globalhash_insert(connp);
627 return (connp);
628 }
629
630 void
631 ipcl_conn_destroy(conn_t *connp)
632 {
633 mblk_t *mp;
634 netstack_t *ns = connp->conn_netstack;
635
636 ASSERT(!MUTEX_HELD(&connp->conn_lock));
637 ASSERT(connp->conn_ref == 0);
638 ASSERT(connp->conn_ioctlref == 0);
639
640 DTRACE_PROBE1(conn__destroy, conn_t *, connp);
641
642 if (connp->conn_cred != NULL) {
643 crfree(connp->conn_cred);
644 connp->conn_cred = NULL;
645 /* ixa_cred done in ipcl_conn_cleanup below */
646 }
647
648 if (connp->conn_ht_iphc != NULL) {
649 kmem_free(connp->conn_ht_iphc, connp->conn_ht_iphc_allocated);
650 connp->conn_ht_iphc = NULL;
651 connp->conn_ht_iphc_allocated = 0;
652 connp->conn_ht_iphc_len = 0;
653 connp->conn_ht_ulp = NULL;
654 connp->conn_ht_ulp_len = 0;
655 }
656 ip_pkt_free(&connp->conn_xmit_ipp);
657
658 ipcl_globalhash_remove(connp);
659
660 if (connp->conn_latch != NULL) {
661 IPLATCH_REFRELE(connp->conn_latch);
662 connp->conn_latch = NULL;
663 }
664 if (connp->conn_latch_in_policy != NULL) {
665 IPPOL_REFRELE(connp->conn_latch_in_policy);
666 connp->conn_latch_in_policy = NULL;
667 }
668 if (connp->conn_latch_in_action != NULL) {
669 IPACT_REFRELE(connp->conn_latch_in_action);
670 connp->conn_latch_in_action = NULL;
671 }
672 if (connp->conn_policy != NULL) {
673 IPPH_REFRELE(connp->conn_policy, ns);
674 connp->conn_policy = NULL;
675 }
676
677 if (connp->conn_ipsec_opt_mp != NULL) {
678 freemsg(connp->conn_ipsec_opt_mp);
679 connp->conn_ipsec_opt_mp = NULL;
680 }
681
682 if (connp->conn_flags & IPCL_TCPCONN) {
683 tcp_t *tcp = connp->conn_tcp;
684
685 tcp_free(tcp);
686 mp = tcp->tcp_timercache;
687
688 tcp->tcp_tcps = NULL;
689
690 /*
691 * tcp_rsrv_mp can be NULL if tcp_get_conn() fails to allocate
692 * the mblk.
693 */
694 if (tcp->tcp_rsrv_mp != NULL) {
695 freeb(tcp->tcp_rsrv_mp);
696 tcp->tcp_rsrv_mp = NULL;
697 mutex_destroy(&tcp->tcp_rsrv_mp_lock);
698 }
699
700 ipcl_conn_cleanup(connp);
701 connp->conn_flags = IPCL_TCPCONN;
702 if (ns != NULL) {
703 ASSERT(tcp->tcp_tcps == NULL);
704 connp->conn_netstack = NULL;
705 connp->conn_ixa->ixa_ipst = NULL;
706 netstack_rele(ns);
707 }
708
709 bzero(tcp, sizeof (tcp_t));
710
711 tcp->tcp_timercache = mp;
712 tcp->tcp_connp = connp;
713 kmem_cache_free(tcp_conn_cache, connp);
714 return;
715 }
716
717 if (connp->conn_flags & IPCL_SCTPCONN) {
718 ASSERT(ns != NULL);
719 sctp_free(connp);
720 return;
721 }
722
723 ipcl_conn_cleanup(connp);
724 if (ns != NULL) {
725 connp->conn_netstack = NULL;
726 connp->conn_ixa->ixa_ipst = NULL;
727 netstack_rele(ns);
728 }
729
730 /* leave conn_priv aka conn_udp, conn_icmp, etc in place. */
731 if (connp->conn_flags & IPCL_UDPCONN) {
732 connp->conn_flags = IPCL_UDPCONN;
733 kmem_cache_free(udp_conn_cache, connp);
734 } else if (connp->conn_flags & IPCL_RAWIPCONN) {
735 connp->conn_flags = IPCL_RAWIPCONN;
736 connp->conn_proto = IPPROTO_ICMP;
737 connp->conn_ixa->ixa_protocol = connp->conn_proto;
738 kmem_cache_free(rawip_conn_cache, connp);
739 } else if (connp->conn_flags & IPCL_RTSCONN) {
740 connp->conn_flags = IPCL_RTSCONN;
741 kmem_cache_free(rts_conn_cache, connp);
742 } else {
743 connp->conn_flags = IPCL_IPCCONN;
744 ASSERT(connp->conn_flags & IPCL_IPCCONN);
745 ASSERT(connp->conn_priv == NULL);
746 kmem_cache_free(ip_conn_cache, connp);
747 }
748 }
749
750 /*
751 * Running in cluster mode - deregister listener information
752 */
753 static void
754 ipcl_conn_unlisten(conn_t *connp)
755 {
756 ASSERT((connp->conn_flags & IPCL_CL_LISTENER) != 0);
757 ASSERT(connp->conn_lport != 0);
758
759 if (cl_inet_unlisten != NULL) {
760 sa_family_t addr_family;
761 uint8_t *laddrp;
762
763 if (connp->conn_ipversion == IPV6_VERSION) {
764 addr_family = AF_INET6;
765 laddrp = (uint8_t *)&connp->conn_bound_addr_v6;
766 } else {
767 addr_family = AF_INET;
768 laddrp = (uint8_t *)&connp->conn_bound_addr_v4;
769 }
770 (*cl_inet_unlisten)(connp->conn_netstack->netstack_stackid,
771 IPPROTO_TCP, addr_family, laddrp, connp->conn_lport, NULL);
772 }
773 connp->conn_flags &= ~IPCL_CL_LISTENER;
774 }
775
776 /*
777 * We set the IPCL_REMOVED flag (instead of clearing the flag indicating
778 * which table the conn belonged to). So for debugging we can see which hash
779 * table this connection was in.
780 */
781 #define IPCL_HASH_REMOVE(connp) { \
782 connf_t *connfp = (connp)->conn_fanout; \
783 ASSERT(!MUTEX_HELD(&((connp)->conn_lock))); \
784 if (connfp != NULL) { \
785 mutex_enter(&connfp->connf_lock); \
786 if ((connp)->conn_next != NULL) \
787 (connp)->conn_next->conn_prev = \
788 (connp)->conn_prev; \
789 if ((connp)->conn_prev != NULL) \
790 (connp)->conn_prev->conn_next = \
791 (connp)->conn_next; \
792 else \
793 connfp->connf_head = (connp)->conn_next; \
794 (connp)->conn_fanout = NULL; \
795 (connp)->conn_next = NULL; \
796 (connp)->conn_prev = NULL; \
797 (connp)->conn_flags |= IPCL_REMOVED; \
798 if (((connp)->conn_flags & IPCL_CL_LISTENER) != 0) \
799 ipcl_conn_unlisten((connp)); \
800 CONN_DEC_REF((connp)); \
801 mutex_exit(&connfp->connf_lock); \
802 } \
803 }
804
805 void
806 ipcl_hash_remove(conn_t *connp)
807 {
808 uint8_t protocol = connp->conn_proto;
809
810 IPCL_HASH_REMOVE(connp);
811 if (protocol == IPPROTO_RSVP)
812 ill_set_inputfn_all(connp->conn_netstack->netstack_ip);
813 }
814
815 /*
816 * The whole purpose of this function is allow removal of
817 * a conn_t from the connected hash for timewait reclaim.
818 * This is essentially a TW reclaim fastpath where timewait
819 * collector checks under fanout lock (so no one else can
820 * get access to the conn_t) that refcnt is 2 i.e. one for
821 * TCP and one for the classifier hash list. If ref count
822 * is indeed 2, we can just remove the conn under lock and
823 * avoid cleaning up the conn under squeue. This gives us
824 * improved performance.
825 */
826 void
827 ipcl_hash_remove_locked(conn_t *connp, connf_t *connfp)
828 {
829 ASSERT(MUTEX_HELD(&connfp->connf_lock));
830 ASSERT(MUTEX_HELD(&connp->conn_lock));
831 ASSERT((connp->conn_flags & IPCL_CL_LISTENER) == 0);
832
833 if ((connp)->conn_next != NULL) {
834 (connp)->conn_next->conn_prev = (connp)->conn_prev;
835 }
836 if ((connp)->conn_prev != NULL) {
837 (connp)->conn_prev->conn_next = (connp)->conn_next;
838 } else {
839 connfp->connf_head = (connp)->conn_next;
840 }
841 (connp)->conn_fanout = NULL;
842 (connp)->conn_next = NULL;
843 (connp)->conn_prev = NULL;
844 (connp)->conn_flags |= IPCL_REMOVED;
845 ASSERT((connp)->conn_ref == 2);
846 (connp)->conn_ref--;
847 }
848
849 #define IPCL_HASH_INSERT_CONNECTED_LOCKED(connfp, connp) { \
850 ASSERT((connp)->conn_fanout == NULL); \
851 ASSERT((connp)->conn_next == NULL); \
852 ASSERT((connp)->conn_prev == NULL); \
853 if ((connfp)->connf_head != NULL) { \
854 (connfp)->connf_head->conn_prev = (connp); \
855 (connp)->conn_next = (connfp)->connf_head; \
856 } \
857 (connp)->conn_fanout = (connfp); \
858 (connfp)->connf_head = (connp); \
859 (connp)->conn_flags = ((connp)->conn_flags & ~IPCL_REMOVED) | \
860 IPCL_CONNECTED; \
861 CONN_INC_REF(connp); \
862 }
863
864 #define IPCL_HASH_INSERT_CONNECTED(connfp, connp) { \
865 IPCL_HASH_REMOVE((connp)); \
866 mutex_enter(&(connfp)->connf_lock); \
867 IPCL_HASH_INSERT_CONNECTED_LOCKED(connfp, connp); \
868 mutex_exit(&(connfp)->connf_lock); \
869 }
870
871 #define IPCL_HASH_INSERT_BOUND(connfp, connp) { \
872 conn_t *pconnp = NULL, *nconnp; \
873 IPCL_HASH_REMOVE((connp)); \
874 mutex_enter(&(connfp)->connf_lock); \
875 nconnp = (connfp)->connf_head; \
876 while (nconnp != NULL && \
877 !_IPCL_V4_MATCH_ANY(nconnp->conn_laddr_v6)) { \
878 pconnp = nconnp; \
879 nconnp = nconnp->conn_next; \
880 } \
881 if (pconnp != NULL) { \
882 pconnp->conn_next = (connp); \
883 (connp)->conn_prev = pconnp; \
884 } else { \
885 (connfp)->connf_head = (connp); \
886 } \
887 if (nconnp != NULL) { \
888 (connp)->conn_next = nconnp; \
889 nconnp->conn_prev = (connp); \
890 } \
891 (connp)->conn_fanout = (connfp); \
892 (connp)->conn_flags = ((connp)->conn_flags & ~IPCL_REMOVED) | \
893 IPCL_BOUND; \
894 CONN_INC_REF(connp); \
895 mutex_exit(&(connfp)->connf_lock); \
896 }
897
898 #define IPCL_HASH_INSERT_WILDCARD(connfp, connp) { \
899 conn_t **list, *prev, *next; \
900 boolean_t isv4mapped = \
901 IN6_IS_ADDR_V4MAPPED(&(connp)->conn_laddr_v6); \
902 IPCL_HASH_REMOVE((connp)); \
903 mutex_enter(&(connfp)->connf_lock); \
904 list = &(connfp)->connf_head; \
905 prev = NULL; \
906 while ((next = *list) != NULL) { \
907 if (isv4mapped && \
908 IN6_IS_ADDR_UNSPECIFIED(&next->conn_laddr_v6) && \
909 connp->conn_zoneid == next->conn_zoneid) { \
910 (connp)->conn_next = next; \
911 if (prev != NULL) \
912 prev = next->conn_prev; \
913 next->conn_prev = (connp); \
914 break; \
915 } \
916 list = &next->conn_next; \
917 prev = next; \
918 } \
919 (connp)->conn_prev = prev; \
920 *list = (connp); \
921 (connp)->conn_fanout = (connfp); \
922 (connp)->conn_flags = ((connp)->conn_flags & ~IPCL_REMOVED) | \
923 IPCL_BOUND; \
924 CONN_INC_REF((connp)); \
925 mutex_exit(&(connfp)->connf_lock); \
926 }
927
928 void
929 ipcl_hash_insert_wildcard(connf_t *connfp, conn_t *connp)
930 {
931 IPCL_HASH_INSERT_WILDCARD(connfp, connp);
932 }
933
934 /*
935 * Because the classifier is used to classify inbound packets, the destination
936 * address is meant to be our local tunnel address (tunnel source), and the
937 * source the remote tunnel address (tunnel destination).
938 *
939 * Note that conn_proto can't be used for fanout since the upper protocol
940 * can be both 41 and 4 when IPv6 and IPv4 are over the same tunnel.
941 */
942 conn_t *
943 ipcl_iptun_classify_v4(ipaddr_t *src, ipaddr_t *dst, ip_stack_t *ipst)
944 {
945 connf_t *connfp;
946 conn_t *connp;
947
948 /* first look for IPv4 tunnel links */
949 connfp = &ipst->ips_ipcl_iptun_fanout[IPCL_IPTUN_HASH(*dst, *src)];
950 mutex_enter(&connfp->connf_lock);
951 for (connp = connfp->connf_head; connp != NULL;
952 connp = connp->conn_next) {
953 if (IPCL_IPTUN_MATCH(connp, *dst, *src))
954 break;
955 }
956 if (connp != NULL)
957 goto done;
958
959 mutex_exit(&connfp->connf_lock);
960
961 /* We didn't find an IPv4 tunnel, try a 6to4 tunnel */
962 connfp = &ipst->ips_ipcl_iptun_fanout[IPCL_IPTUN_HASH(*dst,
963 INADDR_ANY)];
964 mutex_enter(&connfp->connf_lock);
965 for (connp = connfp->connf_head; connp != NULL;
966 connp = connp->conn_next) {
967 if (IPCL_IPTUN_MATCH(connp, *dst, INADDR_ANY))
968 break;
969 }
970 done:
971 if (connp != NULL)
972 CONN_INC_REF(connp);
973 mutex_exit(&connfp->connf_lock);
974 return (connp);
975 }
976
977 conn_t *
978 ipcl_iptun_classify_v6(in6_addr_t *src, in6_addr_t *dst, ip_stack_t *ipst)
979 {
980 connf_t *connfp;
981 conn_t *connp;
982
983 /* Look for an IPv6 tunnel link */
984 connfp = &ipst->ips_ipcl_iptun_fanout[IPCL_IPTUN_HASH_V6(dst, src)];
985 mutex_enter(&connfp->connf_lock);
986 for (connp = connfp->connf_head; connp != NULL;
987 connp = connp->conn_next) {
988 if (IPCL_IPTUN_MATCH_V6(connp, dst, src)) {
989 CONN_INC_REF(connp);
990 break;
991 }
992 }
993 mutex_exit(&connfp->connf_lock);
994 return (connp);
995 }
996
997 /*
998 * This function is used only for inserting SCTP raw socket now.
999 * This may change later.
1000 *
1001 * Note that only one raw socket can be bound to a port. The param
1002 * lport is in network byte order.
1003 */
1004 static int
1005 ipcl_sctp_hash_insert(conn_t *connp, in_port_t lport)
1006 {
1007 connf_t *connfp;
1008 conn_t *oconnp;
1009 ip_stack_t *ipst = connp->conn_netstack->netstack_ip;
1010
1011 connfp = &ipst->ips_ipcl_raw_fanout[IPCL_RAW_HASH(ntohs(lport), ipst)];
1012
1013 /* Check for existing raw socket already bound to the port. */
1014 mutex_enter(&connfp->connf_lock);
1015 for (oconnp = connfp->connf_head; oconnp != NULL;
1016 oconnp = oconnp->conn_next) {
1017 if (oconnp->conn_lport == lport &&
1018 oconnp->conn_zoneid == connp->conn_zoneid &&
1019 oconnp->conn_family == connp->conn_family &&
1020 ((IN6_IS_ADDR_UNSPECIFIED(&connp->conn_laddr_v6) ||
1021 IN6_IS_ADDR_UNSPECIFIED(&oconnp->conn_laddr_v6) ||
1022 IN6_IS_ADDR_V4MAPPED_ANY(&connp->conn_laddr_v6) ||
1023 IN6_IS_ADDR_V4MAPPED_ANY(&oconnp->conn_laddr_v6)) ||
1024 IN6_ARE_ADDR_EQUAL(&oconnp->conn_laddr_v6,
1025 &connp->conn_laddr_v6))) {
1026 break;
1027 }
1028 }
1029 mutex_exit(&connfp->connf_lock);
1030 if (oconnp != NULL)
1031 return (EADDRNOTAVAIL);
1032
1033 if (IN6_IS_ADDR_UNSPECIFIED(&connp->conn_faddr_v6) ||
1034 IN6_IS_ADDR_V4MAPPED_ANY(&connp->conn_faddr_v6)) {
1035 if (IN6_IS_ADDR_UNSPECIFIED(&connp->conn_laddr_v6) ||
1036 IN6_IS_ADDR_V4MAPPED_ANY(&connp->conn_laddr_v6)) {
1037 IPCL_HASH_INSERT_WILDCARD(connfp, connp);
1038 } else {
1039 IPCL_HASH_INSERT_BOUND(connfp, connp);
1040 }
1041 } else {
1042 IPCL_HASH_INSERT_CONNECTED(connfp, connp);
1043 }
1044 return (0);
1045 }
1046
1047 static int
1048 ipcl_iptun_hash_insert(conn_t *connp, ip_stack_t *ipst)
1049 {
1050 connf_t *connfp;
1051 conn_t *tconnp;
1052 ipaddr_t laddr = connp->conn_laddr_v4;
1053 ipaddr_t faddr = connp->conn_faddr_v4;
1054
1055 connfp = &ipst->ips_ipcl_iptun_fanout[IPCL_IPTUN_HASH(laddr, faddr)];
1056 mutex_enter(&connfp->connf_lock);
1057 for (tconnp = connfp->connf_head; tconnp != NULL;
1058 tconnp = tconnp->conn_next) {
1059 if (IPCL_IPTUN_MATCH(tconnp, laddr, faddr)) {
1060 /* A tunnel is already bound to these addresses. */
1061 mutex_exit(&connfp->connf_lock);
1062 return (EADDRINUSE);
1063 }
1064 }
1065 IPCL_HASH_INSERT_CONNECTED_LOCKED(connfp, connp);
1066 mutex_exit(&connfp->connf_lock);
1067 return (0);
1068 }
1069
1070 static int
1071 ipcl_iptun_hash_insert_v6(conn_t *connp, ip_stack_t *ipst)
1072 {
1073 connf_t *connfp;
1074 conn_t *tconnp;
1075 in6_addr_t *laddr = &connp->conn_laddr_v6;
1076 in6_addr_t *faddr = &connp->conn_faddr_v6;
1077
1078 connfp = &ipst->ips_ipcl_iptun_fanout[IPCL_IPTUN_HASH_V6(laddr, faddr)];
1079 mutex_enter(&connfp->connf_lock);
1080 for (tconnp = connfp->connf_head; tconnp != NULL;
1081 tconnp = tconnp->conn_next) {
1082 if (IPCL_IPTUN_MATCH_V6(tconnp, laddr, faddr)) {
1083 /* A tunnel is already bound to these addresses. */
1084 mutex_exit(&connfp->connf_lock);
1085 return (EADDRINUSE);
1086 }
1087 }
1088 IPCL_HASH_INSERT_CONNECTED_LOCKED(connfp, connp);
1089 mutex_exit(&connfp->connf_lock);
1090 return (0);
1091 }
1092
1093 /*
1094 * Check for a MAC exemption conflict on a labeled system. Note that for
1095 * protocols that use port numbers (UDP, TCP, SCTP), we do this check up in the
1096 * transport layer. This check is for binding all other protocols.
1097 *
1098 * Returns true if there's a conflict.
1099 */
1100 static boolean_t
1101 check_exempt_conflict_v4(conn_t *connp, ip_stack_t *ipst)
1102 {
1103 connf_t *connfp;
1104 conn_t *tconn;
1105
1106 connfp = &ipst->ips_ipcl_proto_fanout_v4[connp->conn_proto];
1107 mutex_enter(&connfp->connf_lock);
1108 for (tconn = connfp->connf_head; tconn != NULL;
1109 tconn = tconn->conn_next) {
1110 /* We don't allow v4 fallback for v6 raw socket */
1111 if (connp->conn_family != tconn->conn_family)
1112 continue;
1113 /* If neither is exempt, then there's no conflict */
1114 if ((connp->conn_mac_mode == CONN_MAC_DEFAULT) &&
1115 (tconn->conn_mac_mode == CONN_MAC_DEFAULT))
1116 continue;
1117 /* We are only concerned about sockets for a different zone */
1118 if (connp->conn_zoneid == tconn->conn_zoneid)
1119 continue;
1120 /* If both are bound to different specific addrs, ok */
1121 if (connp->conn_laddr_v4 != INADDR_ANY &&
1122 tconn->conn_laddr_v4 != INADDR_ANY &&
1123 connp->conn_laddr_v4 != tconn->conn_laddr_v4)
1124 continue;
1125 /* These two conflict; fail */
1126 break;
1127 }
1128 mutex_exit(&connfp->connf_lock);
1129 return (tconn != NULL);
1130 }
1131
1132 static boolean_t
1133 check_exempt_conflict_v6(conn_t *connp, ip_stack_t *ipst)
1134 {
1135 connf_t *connfp;
1136 conn_t *tconn;
1137
1138 connfp = &ipst->ips_ipcl_proto_fanout_v6[connp->conn_proto];
1139 mutex_enter(&connfp->connf_lock);
1140 for (tconn = connfp->connf_head; tconn != NULL;
1141 tconn = tconn->conn_next) {
1142 /* We don't allow v4 fallback for v6 raw socket */
1143 if (connp->conn_family != tconn->conn_family)
1144 continue;
1145 /* If neither is exempt, then there's no conflict */
1146 if ((connp->conn_mac_mode == CONN_MAC_DEFAULT) &&
1147 (tconn->conn_mac_mode == CONN_MAC_DEFAULT))
1148 continue;
1149 /* We are only concerned about sockets for a different zone */
1150 if (connp->conn_zoneid == tconn->conn_zoneid)
1151 continue;
1152 /* If both are bound to different addrs, ok */
1153 if (!IN6_IS_ADDR_UNSPECIFIED(&connp->conn_laddr_v6) &&
1154 !IN6_IS_ADDR_UNSPECIFIED(&tconn->conn_laddr_v6) &&
1155 !IN6_ARE_ADDR_EQUAL(&connp->conn_laddr_v6,
1156 &tconn->conn_laddr_v6))
1157 continue;
1158 /* These two conflict; fail */
1159 break;
1160 }
1161 mutex_exit(&connfp->connf_lock);
1162 return (tconn != NULL);
1163 }
1164
1165 /*
1166 * (v4, v6) bind hash insertion routines
1167 * The caller has already setup the conn (conn_proto, conn_laddr_v6, conn_lport)
1168 */
1169
1170 int
1171 ipcl_bind_insert(conn_t *connp)
1172 {
1173 if (connp->conn_ipversion == IPV6_VERSION)
1174 return (ipcl_bind_insert_v6(connp));
1175 else
1176 return (ipcl_bind_insert_v4(connp));
1177 }
1178
1179 int
1180 ipcl_bind_insert_v4(conn_t *connp)
1181 {
1182 connf_t *connfp;
1183 int ret = 0;
1184 ip_stack_t *ipst = connp->conn_netstack->netstack_ip;
1185 uint16_t lport = connp->conn_lport;
1186 uint8_t protocol = connp->conn_proto;
1187
1188 if (IPCL_IS_IPTUN(connp))
1189 return (ipcl_iptun_hash_insert(connp, ipst));
1190
1191 switch (protocol) {
1192 default:
1193 if (is_system_labeled() &&
1194 check_exempt_conflict_v4(connp, ipst))
1195 return (EADDRINUSE);
1196 /* FALLTHROUGH */
1197 case IPPROTO_UDP:
1198 if (protocol == IPPROTO_UDP) {
1199 connfp = &ipst->ips_ipcl_udp_fanout[
1200 IPCL_UDP_HASH(lport, ipst)];
1201 } else {
1202 connfp = &ipst->ips_ipcl_proto_fanout_v4[protocol];
1203 }
1204
1205 if (connp->conn_faddr_v4 != INADDR_ANY) {
1206 IPCL_HASH_INSERT_CONNECTED(connfp, connp);
1207 } else if (connp->conn_laddr_v4 != INADDR_ANY) {
1208 IPCL_HASH_INSERT_BOUND(connfp, connp);
1209 } else {
1210 IPCL_HASH_INSERT_WILDCARD(connfp, connp);
1211 }
1212 if (protocol == IPPROTO_RSVP)
1213 ill_set_inputfn_all(ipst);
1214 break;
1215
1216 case IPPROTO_TCP:
1217 /* Insert it in the Bind Hash */
1218 ASSERT(connp->conn_zoneid != ALL_ZONES);
1219 connfp = &ipst->ips_ipcl_bind_fanout[
1220 IPCL_BIND_HASH(lport, ipst)];
1221 if (connp->conn_laddr_v4 != INADDR_ANY) {
1222 IPCL_HASH_INSERT_BOUND(connfp, connp);
1223 } else {
1224 IPCL_HASH_INSERT_WILDCARD(connfp, connp);
1225 }
1226 if (cl_inet_listen != NULL) {
1227 ASSERT(connp->conn_ipversion == IPV4_VERSION);
1228 connp->conn_flags |= IPCL_CL_LISTENER;
1229 (*cl_inet_listen)(
1230 connp->conn_netstack->netstack_stackid,
1231 IPPROTO_TCP, AF_INET,
1232 (uint8_t *)&connp->conn_bound_addr_v4, lport, NULL);
1233 }
1234 break;
1235
1236 case IPPROTO_SCTP:
1237 ret = ipcl_sctp_hash_insert(connp, lport);
1238 break;
1239 }
1240
1241 return (ret);
1242 }
1243
1244 int
1245 ipcl_bind_insert_v6(conn_t *connp)
1246 {
1247 connf_t *connfp;
1248 int ret = 0;
1249 ip_stack_t *ipst = connp->conn_netstack->netstack_ip;
1250 uint16_t lport = connp->conn_lport;
1251 uint8_t protocol = connp->conn_proto;
1252
1253 if (IPCL_IS_IPTUN(connp)) {
1254 return (ipcl_iptun_hash_insert_v6(connp, ipst));
1255 }
1256
1257 switch (protocol) {
1258 default:
1259 if (is_system_labeled() &&
1260 check_exempt_conflict_v6(connp, ipst))
1261 return (EADDRINUSE);
1262 /* FALLTHROUGH */
1263 case IPPROTO_UDP:
1264 if (protocol == IPPROTO_UDP) {
1265 connfp = &ipst->ips_ipcl_udp_fanout[
1266 IPCL_UDP_HASH(lport, ipst)];
1267 } else {
1268 connfp = &ipst->ips_ipcl_proto_fanout_v6[protocol];
1269 }
1270
1271 if (!IN6_IS_ADDR_UNSPECIFIED(&connp->conn_faddr_v6)) {
1272 IPCL_HASH_INSERT_CONNECTED(connfp, connp);
1273 } else if (!IN6_IS_ADDR_UNSPECIFIED(&connp->conn_laddr_v6)) {
1274 IPCL_HASH_INSERT_BOUND(connfp, connp);
1275 } else {
1276 IPCL_HASH_INSERT_WILDCARD(connfp, connp);
1277 }
1278 break;
1279
1280 case IPPROTO_TCP:
1281 /* Insert it in the Bind Hash */
1282 ASSERT(connp->conn_zoneid != ALL_ZONES);
1283 connfp = &ipst->ips_ipcl_bind_fanout[
1284 IPCL_BIND_HASH(lport, ipst)];
1285 if (!IN6_IS_ADDR_UNSPECIFIED(&connp->conn_laddr_v6)) {
1286 IPCL_HASH_INSERT_BOUND(connfp, connp);
1287 } else {
1288 IPCL_HASH_INSERT_WILDCARD(connfp, connp);
1289 }
1290 if (cl_inet_listen != NULL) {
1291 sa_family_t addr_family;
1292 uint8_t *laddrp;
1293
1294 if (connp->conn_ipversion == IPV6_VERSION) {
1295 addr_family = AF_INET6;
1296 laddrp =
1297 (uint8_t *)&connp->conn_bound_addr_v6;
1298 } else {
1299 addr_family = AF_INET;
1300 laddrp = (uint8_t *)&connp->conn_bound_addr_v4;
1301 }
1302 connp->conn_flags |= IPCL_CL_LISTENER;
1303 (*cl_inet_listen)(
1304 connp->conn_netstack->netstack_stackid,
1305 IPPROTO_TCP, addr_family, laddrp, lport, NULL);
1306 }
1307 break;
1308
1309 case IPPROTO_SCTP:
1310 ret = ipcl_sctp_hash_insert(connp, lport);
1311 break;
1312 }
1313
1314 return (ret);
1315 }
1316
1317 /*
1318 * ipcl_conn_hash insertion routines.
1319 * The caller has already set conn_proto and the addresses/ports in the conn_t.
1320 */
1321
1322 int
1323 ipcl_conn_insert(conn_t *connp)
1324 {
1325 if (connp->conn_ipversion == IPV6_VERSION)
1326 return (ipcl_conn_insert_v6(connp));
1327 else
1328 return (ipcl_conn_insert_v4(connp));
1329 }
1330
1331 int
1332 ipcl_conn_insert_v4(conn_t *connp)
1333 {
1334 connf_t *connfp;
1335 conn_t *tconnp;
1336 int ret = 0;
1337 ip_stack_t *ipst = connp->conn_netstack->netstack_ip;
1338 uint16_t lport = connp->conn_lport;
1339 uint8_t protocol = connp->conn_proto;
1340
1341 if (IPCL_IS_IPTUN(connp))
1342 return (ipcl_iptun_hash_insert(connp, ipst));
1343
1344 switch (protocol) {
1345 case IPPROTO_TCP:
1346 /*
1347 * For TCP, we check whether the connection tuple already
1348 * exists before allowing the connection to proceed. We
1349 * also allow indexing on the zoneid. This is to allow
1350 * multiple shared stack zones to have the same tcp
1351 * connection tuple. In practice this only happens for
1352 * INADDR_LOOPBACK as it's the only local address which
1353 * doesn't have to be unique.
1354 */
1355 connfp = &ipst->ips_ipcl_conn_fanout[
1356 IPCL_CONN_HASH(connp->conn_faddr_v4,
1357 connp->conn_ports, ipst)];
1358 mutex_enter(&connfp->connf_lock);
1359 for (tconnp = connfp->connf_head; tconnp != NULL;
1360 tconnp = tconnp->conn_next) {
1361 if (IPCL_CONN_MATCH(tconnp, connp->conn_proto,
1362 connp->conn_faddr_v4, connp->conn_laddr_v4,
1363 connp->conn_ports) &&
1364 IPCL_ZONE_MATCH(tconnp, connp->conn_zoneid)) {
1365 /* Already have a conn. bail out */
1366 mutex_exit(&connfp->connf_lock);
1367 return (EADDRINUSE);
1368 }
1369 }
1370 if (connp->conn_fanout != NULL) {
1371 /*
1372 * Probably a XTI/TLI application trying to do a
1373 * rebind. Let it happen.
1374 */
1375 mutex_exit(&connfp->connf_lock);
1376 IPCL_HASH_REMOVE(connp);
1377 mutex_enter(&connfp->connf_lock);
1378 }
1379
1380 ASSERT(connp->conn_recv != NULL);
1381 ASSERT(connp->conn_recvicmp != NULL);
1382
1383 IPCL_HASH_INSERT_CONNECTED_LOCKED(connfp, connp);
1384 mutex_exit(&connfp->connf_lock);
1385 break;
1386
1387 case IPPROTO_SCTP:
1388 /*
1389 * The raw socket may have already been bound, remove it
1390 * from the hash first.
1391 */
1392 IPCL_HASH_REMOVE(connp);
1393 ret = ipcl_sctp_hash_insert(connp, lport);
1394 break;
1395
1396 default:
1397 /*
1398 * Check for conflicts among MAC exempt bindings. For
1399 * transports with port numbers, this is done by the upper
1400 * level per-transport binding logic. For all others, it's
1401 * done here.
1402 */
1403 if (is_system_labeled() &&
1404 check_exempt_conflict_v4(connp, ipst))
1405 return (EADDRINUSE);
1406 /* FALLTHROUGH */
1407
1408 case IPPROTO_UDP:
1409 if (protocol == IPPROTO_UDP) {
1410 connfp = &ipst->ips_ipcl_udp_fanout[
1411 IPCL_UDP_HASH(lport, ipst)];
1412 } else {
1413 connfp = &ipst->ips_ipcl_proto_fanout_v4[protocol];
1414 }
1415
1416 if (connp->conn_faddr_v4 != INADDR_ANY) {
1417 IPCL_HASH_INSERT_CONNECTED(connfp, connp);
1418 } else if (connp->conn_laddr_v4 != INADDR_ANY) {
1419 IPCL_HASH_INSERT_BOUND(connfp, connp);
1420 } else {
1421 IPCL_HASH_INSERT_WILDCARD(connfp, connp);
1422 }
1423 break;
1424 }
1425
1426 return (ret);
1427 }
1428
1429 int
1430 ipcl_conn_insert_v6(conn_t *connp)
1431 {
1432 connf_t *connfp;
1433 conn_t *tconnp;
1434 int ret = 0;
1435 ip_stack_t *ipst = connp->conn_netstack->netstack_ip;
1436 uint16_t lport = connp->conn_lport;
1437 uint8_t protocol = connp->conn_proto;
1438 uint_t ifindex = connp->conn_bound_if;
1439
1440 if (IPCL_IS_IPTUN(connp))
1441 return (ipcl_iptun_hash_insert_v6(connp, ipst));
1442
1443 switch (protocol) {
1444 case IPPROTO_TCP:
1445
1446 /*
1447 * For tcp, we check whether the connection tuple already
1448 * exists before allowing the connection to proceed. We
1449 * also allow indexing on the zoneid. This is to allow
1450 * multiple shared stack zones to have the same tcp
1451 * connection tuple. In practice this only happens for
1452 * ipv6_loopback as it's the only local address which
1453 * doesn't have to be unique.
1454 */
1455 connfp = &ipst->ips_ipcl_conn_fanout[
1456 IPCL_CONN_HASH_V6(connp->conn_faddr_v6, connp->conn_ports,
1457 ipst)];
1458 mutex_enter(&connfp->connf_lock);
1459 for (tconnp = connfp->connf_head; tconnp != NULL;
1460 tconnp = tconnp->conn_next) {
1461 /* NOTE: need to match zoneid. Bug in onnv-gate */
1462 if (IPCL_CONN_MATCH_V6(tconnp, connp->conn_proto,
1463 connp->conn_faddr_v6, connp->conn_laddr_v6,
1464 connp->conn_ports) &&
1465 (tconnp->conn_bound_if == 0 ||
1466 tconnp->conn_bound_if == ifindex) &&
1467 IPCL_ZONE_MATCH(tconnp, connp->conn_zoneid)) {
1468 /* Already have a conn. bail out */
1469 mutex_exit(&connfp->connf_lock);
1470 return (EADDRINUSE);
1471 }
1472 }
1473 if (connp->conn_fanout != NULL) {
1474 /*
1475 * Probably a XTI/TLI application trying to do a
1476 * rebind. Let it happen.
1477 */
1478 mutex_exit(&connfp->connf_lock);
1479 IPCL_HASH_REMOVE(connp);
1480 mutex_enter(&connfp->connf_lock);
1481 }
1482 IPCL_HASH_INSERT_CONNECTED_LOCKED(connfp, connp);
1483 mutex_exit(&connfp->connf_lock);
1484 break;
1485
1486 case IPPROTO_SCTP:
1487 IPCL_HASH_REMOVE(connp);
1488 ret = ipcl_sctp_hash_insert(connp, lport);
1489 break;
1490
1491 default:
1492 if (is_system_labeled() &&
1493 check_exempt_conflict_v6(connp, ipst))
1494 return (EADDRINUSE);
1495 /* FALLTHROUGH */
1496 case IPPROTO_UDP:
1497 if (protocol == IPPROTO_UDP) {
1498 connfp = &ipst->ips_ipcl_udp_fanout[
1499 IPCL_UDP_HASH(lport, ipst)];
1500 } else {
1501 connfp = &ipst->ips_ipcl_proto_fanout_v6[protocol];
1502 }
1503
1504 if (!IN6_IS_ADDR_UNSPECIFIED(&connp->conn_faddr_v6)) {
1505 IPCL_HASH_INSERT_CONNECTED(connfp, connp);
1506 } else if (!IN6_IS_ADDR_UNSPECIFIED(&connp->conn_laddr_v6)) {
1507 IPCL_HASH_INSERT_BOUND(connfp, connp);
1508 } else {
1509 IPCL_HASH_INSERT_WILDCARD(connfp, connp);
1510 }
1511 break;
1512 }
1513
1514 return (ret);
1515 }
1516
1517 /*
1518 * v4 packet classifying function. looks up the fanout table to
1519 * find the conn, the packet belongs to. returns the conn with
1520 * the reference held, null otherwise.
1521 *
1522 * If zoneid is ALL_ZONES, then the search rules described in the "Connection
1523 * Lookup" comment block are applied. Labels are also checked as described
1524 * above. If the packet is from the inside (looped back), and is from the same
1525 * zone, then label checks are omitted.
1526 */
1527 conn_t *
1528 ipcl_classify_v4(mblk_t *mp, uint8_t protocol, uint_t hdr_len,
1529 ip_recv_attr_t *ira, ip_stack_t *ipst)
1530 {
1531 ipha_t *ipha;
1532 connf_t *connfp, *bind_connfp;
1533 uint16_t lport;
1534 uint16_t fport;
1535 uint32_t ports;
1536 conn_t *connp;
1537 uint16_t *up;
1538 zoneid_t zoneid = ira->ira_zoneid;
1539
1540 ipha = (ipha_t *)mp->b_rptr;
1541 up = (uint16_t *)((uchar_t *)ipha + hdr_len + TCP_PORTS_OFFSET);
1542
1543 switch (protocol) {
1544 case IPPROTO_TCP:
1545 ports = *(uint32_t *)up;
1546 connfp =
1547 &ipst->ips_ipcl_conn_fanout[IPCL_CONN_HASH(ipha->ipha_src,
1548 ports, ipst)];
1549 mutex_enter(&connfp->connf_lock);
1550 for (connp = connfp->connf_head; connp != NULL;
1551 connp = connp->conn_next) {
1552 if (IPCL_CONN_MATCH(connp, protocol,
1553 ipha->ipha_src, ipha->ipha_dst, ports) &&
1554 (connp->conn_zoneid == zoneid ||
1555 connp->conn_allzones ||
1556 ((connp->conn_mac_mode != CONN_MAC_DEFAULT) &&
1557 (ira->ira_flags & IRAF_TX_MAC_EXEMPTABLE) &&
1558 (ira->ira_flags & IRAF_TX_SHARED_ADDR))))
1559 break;
1560 }
1561
1562 if (connp != NULL) {
1563 /*
1564 * We have a fully-bound TCP connection.
1565 *
1566 * For labeled systems, there's no need to check the
1567 * label here. It's known to be good as we checked
1568 * before allowing the connection to become bound.
1569 */
1570 CONN_INC_REF(connp);
1571 mutex_exit(&connfp->connf_lock);
1572 return (connp);
1573 }
1574
1575 mutex_exit(&connfp->connf_lock);
1576 lport = up[1];
1577 bind_connfp =
1578 &ipst->ips_ipcl_bind_fanout[IPCL_BIND_HASH(lport, ipst)];
1579 mutex_enter(&bind_connfp->connf_lock);
1580 for (connp = bind_connfp->connf_head; connp != NULL;
1581 connp = connp->conn_next) {
1582 if (IPCL_BIND_MATCH(connp, protocol, ipha->ipha_dst,
1583 lport) &&
1584 (connp->conn_zoneid == zoneid ||
1585 connp->conn_allzones ||
1586 ((connp->conn_mac_mode != CONN_MAC_DEFAULT) &&
1587 (ira->ira_flags & IRAF_TX_MAC_EXEMPTABLE) &&
1588 (ira->ira_flags & IRAF_TX_SHARED_ADDR))))
1589 break;
1590 }
1591
1592 /*
1593 * If the matching connection is SLP on a private address, then
1594 * the label on the packet must match the local zone's label.
1595 * Otherwise, it must be in the label range defined by tnrh.
1596 * This is ensured by tsol_receive_local.
1597 *
1598 * Note that we don't check tsol_receive_local for
1599 * the connected case.
1600 */
1601 if (connp != NULL && (ira->ira_flags & IRAF_SYSTEM_LABELED) &&
1602 !tsol_receive_local(mp, &ipha->ipha_dst, IPV4_VERSION,
1603 ira, connp)) {
1604 DTRACE_PROBE3(tx__ip__log__info__classify__tcp,
1605 char *, "connp(1) could not receive mp(2)",
1606 conn_t *, connp, mblk_t *, mp);
1607 connp = NULL;
1608 }
1609
1610 if (connp != NULL) {
1611 /* Have a listener at least */
1612 CONN_INC_REF(connp);
1613 mutex_exit(&bind_connfp->connf_lock);
1614 return (connp);
1615 }
1616
1617 mutex_exit(&bind_connfp->connf_lock);
1618 break;
1619
1620 case IPPROTO_UDP:
1621 lport = up[1];
1622 fport = up[0];
1623 connfp = &ipst->ips_ipcl_udp_fanout[IPCL_UDP_HASH(lport, ipst)];
1624 mutex_enter(&connfp->connf_lock);
1625 for (connp = connfp->connf_head; connp != NULL;
1626 connp = connp->conn_next) {
1627 if (IPCL_UDP_MATCH(connp, lport, ipha->ipha_dst,
1628 fport, ipha->ipha_src) &&
1629 (connp->conn_zoneid == zoneid ||
1630 connp->conn_allzones ||
1631 ((connp->conn_mac_mode != CONN_MAC_DEFAULT) &&
1632 (ira->ira_flags & IRAF_TX_MAC_EXEMPTABLE))))
1633 break;
1634 }
1635
1636 if (connp != NULL && (ira->ira_flags & IRAF_SYSTEM_LABELED) &&
1637 !tsol_receive_local(mp, &ipha->ipha_dst, IPV4_VERSION,
1638 ira, connp)) {
1639 DTRACE_PROBE3(tx__ip__log__info__classify__udp,
1640 char *, "connp(1) could not receive mp(2)",
1641 conn_t *, connp, mblk_t *, mp);
1642 connp = NULL;
1643 }
1644
1645 if (connp != NULL) {
1646 CONN_INC_REF(connp);
1647 mutex_exit(&connfp->connf_lock);
1648 return (connp);
1649 }
1650
1651 /*
1652 * We shouldn't come here for multicast/broadcast packets
1653 */
1654 mutex_exit(&connfp->connf_lock);
1655
1656 break;
1657
1658 case IPPROTO_ENCAP:
1659 case IPPROTO_IPV6:
1660 return (ipcl_iptun_classify_v4(&ipha->ipha_src,
1661 &ipha->ipha_dst, ipst));
1662 }
1663
1664 return (NULL);
1665 }
1666
1667 conn_t *
1668 ipcl_classify_v6(mblk_t *mp, uint8_t protocol, uint_t hdr_len,
1669 ip_recv_attr_t *ira, ip_stack_t *ipst)
1670 {
1671 ip6_t *ip6h;
1672 connf_t *connfp, *bind_connfp;
1673 uint16_t lport;
1674 uint16_t fport;
1675 tcpha_t *tcpha;
1676 uint32_t ports;
1677 conn_t *connp;
1678 uint16_t *up;
1679 zoneid_t zoneid = ira->ira_zoneid;
1680
1681 ip6h = (ip6_t *)mp->b_rptr;
1682
1683 switch (protocol) {
1684 case IPPROTO_TCP:
1685 tcpha = (tcpha_t *)&mp->b_rptr[hdr_len];
1686 up = &tcpha->tha_lport;
1687 ports = *(uint32_t *)up;
1688
1689 connfp =
1690 &ipst->ips_ipcl_conn_fanout[IPCL_CONN_HASH_V6(ip6h->ip6_src,
1691 ports, ipst)];
1692 mutex_enter(&connfp->connf_lock);
1693 for (connp = connfp->connf_head; connp != NULL;
1694 connp = connp->conn_next) {
1695 if (IPCL_CONN_MATCH_V6(connp, protocol,
1696 ip6h->ip6_src, ip6h->ip6_dst, ports) &&
1697 (connp->conn_zoneid == zoneid ||
1698 connp->conn_allzones ||
1699 ((connp->conn_mac_mode != CONN_MAC_DEFAULT) &&
1700 (ira->ira_flags & IRAF_TX_MAC_EXEMPTABLE) &&
1701 (ira->ira_flags & IRAF_TX_SHARED_ADDR))))
1702 break;
1703 }
1704
1705 if (connp != NULL) {
1706 /*
1707 * We have a fully-bound TCP connection.
1708 *
1709 * For labeled systems, there's no need to check the
1710 * label here. It's known to be good as we checked
1711 * before allowing the connection to become bound.
1712 */
1713 CONN_INC_REF(connp);
1714 mutex_exit(&connfp->connf_lock);
1715 return (connp);
1716 }
1717
1718 mutex_exit(&connfp->connf_lock);
1719
1720 lport = up[1];
1721 bind_connfp =
1722 &ipst->ips_ipcl_bind_fanout[IPCL_BIND_HASH(lport, ipst)];
1723 mutex_enter(&bind_connfp->connf_lock);
1724 for (connp = bind_connfp->connf_head; connp != NULL;
1725 connp = connp->conn_next) {
1726 if (IPCL_BIND_MATCH_V6(connp, protocol,
1727 ip6h->ip6_dst, lport) &&
1728 (connp->conn_zoneid == zoneid ||
1729 connp->conn_allzones ||
1730 ((connp->conn_mac_mode != CONN_MAC_DEFAULT) &&
1731 (ira->ira_flags & IRAF_TX_MAC_EXEMPTABLE) &&
1732 (ira->ira_flags & IRAF_TX_SHARED_ADDR))))
1733 break;
1734 }
1735
1736 if (connp != NULL && (ira->ira_flags & IRAF_SYSTEM_LABELED) &&
1737 !tsol_receive_local(mp, &ip6h->ip6_dst, IPV6_VERSION,
1738 ira, connp)) {
1739 DTRACE_PROBE3(tx__ip__log__info__classify__tcp6,
1740 char *, "connp(1) could not receive mp(2)",
1741 conn_t *, connp, mblk_t *, mp);
1742 connp = NULL;
1743 }
1744
1745 if (connp != NULL) {
1746 /* Have a listner at least */
1747 CONN_INC_REF(connp);
1748 mutex_exit(&bind_connfp->connf_lock);
1749 return (connp);
1750 }
1751
1752 mutex_exit(&bind_connfp->connf_lock);
1753 break;
1754
1755 case IPPROTO_UDP:
1756 up = (uint16_t *)&mp->b_rptr[hdr_len];
1757 lport = up[1];
1758 fport = up[0];
1759 connfp = &ipst->ips_ipcl_udp_fanout[IPCL_UDP_HASH(lport, ipst)];
1760 mutex_enter(&connfp->connf_lock);
1761 for (connp = connfp->connf_head; connp != NULL;
1762 connp = connp->conn_next) {
1763 if (IPCL_UDP_MATCH_V6(connp, lport, ip6h->ip6_dst,
1764 fport, ip6h->ip6_src) &&
1765 (connp->conn_zoneid == zoneid ||
1766 connp->conn_allzones ||
1767 ((connp->conn_mac_mode != CONN_MAC_DEFAULT) &&
1768 (ira->ira_flags & IRAF_TX_MAC_EXEMPTABLE) &&
1769 (ira->ira_flags & IRAF_TX_SHARED_ADDR))))
1770 break;
1771 }
1772
1773 if (connp != NULL && (ira->ira_flags & IRAF_SYSTEM_LABELED) &&
1774 !tsol_receive_local(mp, &ip6h->ip6_dst, IPV6_VERSION,
1775 ira, connp)) {
1776 DTRACE_PROBE3(tx__ip__log__info__classify__udp6,
1777 char *, "connp(1) could not receive mp(2)",
1778 conn_t *, connp, mblk_t *, mp);
1779 connp = NULL;
1780 }
1781
1782 if (connp != NULL) {
1783 CONN_INC_REF(connp);
1784 mutex_exit(&connfp->connf_lock);
1785 return (connp);
1786 }
1787
1788 /*
1789 * We shouldn't come here for multicast/broadcast packets
1790 */
1791 mutex_exit(&connfp->connf_lock);
1792 break;
1793 case IPPROTO_ENCAP:
1794 case IPPROTO_IPV6:
1795 return (ipcl_iptun_classify_v6(&ip6h->ip6_src,
1796 &ip6h->ip6_dst, ipst));
1797 }
1798
1799 return (NULL);
1800 }
1801
1802 /*
1803 * wrapper around ipcl_classify_(v4,v6) routines.
1804 */
1805 conn_t *
1806 ipcl_classify(mblk_t *mp, ip_recv_attr_t *ira, ip_stack_t *ipst)
1807 {
1808 if (ira->ira_flags & IRAF_IS_IPV4) {
1809 return (ipcl_classify_v4(mp, ira->ira_protocol,
1810 ira->ira_ip_hdr_length, ira, ipst));
1811 } else {
1812 return (ipcl_classify_v6(mp, ira->ira_protocol,
1813 ira->ira_ip_hdr_length, ira, ipst));
1814 }
1815 }
1816
1817 /*
1818 * Only used to classify SCTP RAW sockets
1819 */
1820 conn_t *
1821 ipcl_classify_raw(mblk_t *mp, uint8_t protocol, uint32_t ports,
1822 ipha_t *ipha, ip6_t *ip6h, ip_recv_attr_t *ira, ip_stack_t *ipst)
1823 {
1824 connf_t *connfp;
1825 conn_t *connp;
1826 in_port_t lport;
1827 int ipversion;
1828 const void *dst;
1829 zoneid_t zoneid = ira->ira_zoneid;
1830
1831 lport = ((uint16_t *)&ports)[1];
1832 if (ira->ira_flags & IRAF_IS_IPV4) {
1833 dst = (const void *)&ipha->ipha_dst;
1834 ipversion = IPV4_VERSION;
1835 } else {
1836 dst = (const void *)&ip6h->ip6_dst;
1837 ipversion = IPV6_VERSION;
1838 }
1839
1840 connfp = &ipst->ips_ipcl_raw_fanout[IPCL_RAW_HASH(ntohs(lport), ipst)];
1841 mutex_enter(&connfp->connf_lock);
1842 for (connp = connfp->connf_head; connp != NULL;
1843 connp = connp->conn_next) {
1844 /* We don't allow v4 fallback for v6 raw socket. */
1845 if (ipversion != connp->conn_ipversion)
1846 continue;
1847 if (!IN6_IS_ADDR_UNSPECIFIED(&connp->conn_faddr_v6) &&
1848 !IN6_IS_ADDR_V4MAPPED_ANY(&connp->conn_faddr_v6)) {
1849 if (ipversion == IPV4_VERSION) {
1850 if (!IPCL_CONN_MATCH(connp, protocol,
1851 ipha->ipha_src, ipha->ipha_dst, ports))
1852 continue;
1853 } else {
1854 if (!IPCL_CONN_MATCH_V6(connp, protocol,
1855 ip6h->ip6_src, ip6h->ip6_dst, ports))
1856 continue;
1857 }
1858 } else {
1859 if (ipversion == IPV4_VERSION) {
1860 if (!IPCL_BIND_MATCH(connp, protocol,
1861 ipha->ipha_dst, lport))
1862 continue;
1863 } else {
1864 if (!IPCL_BIND_MATCH_V6(connp, protocol,
1865 ip6h->ip6_dst, lport))
1866 continue;
1867 }
1868 }
1869
1870 if (connp->conn_zoneid == zoneid ||
1871 connp->conn_allzones ||
1872 ((connp->conn_mac_mode != CONN_MAC_DEFAULT) &&
1873 (ira->ira_flags & IRAF_TX_MAC_EXEMPTABLE) &&
1874 (ira->ira_flags & IRAF_TX_SHARED_ADDR)))
1875 break;
1876 }
1877
1878 if (connp != NULL && (ira->ira_flags & IRAF_SYSTEM_LABELED) &&
1879 !tsol_receive_local(mp, dst, ipversion, ira, connp)) {
1880 DTRACE_PROBE3(tx__ip__log__info__classify__rawip,
1881 char *, "connp(1) could not receive mp(2)",
1882 conn_t *, connp, mblk_t *, mp);
1883 connp = NULL;
1884 }
1885
1886 if (connp != NULL)
1887 goto found;
1888 mutex_exit(&connfp->connf_lock);
1889
1890 /* Try to look for a wildcard SCTP RAW socket match. */
1891 connfp = &ipst->ips_ipcl_raw_fanout[IPCL_RAW_HASH(0, ipst)];
1892 mutex_enter(&connfp->connf_lock);
1893 for (connp = connfp->connf_head; connp != NULL;
1894 connp = connp->conn_next) {
1895 /* We don't allow v4 fallback for v6 raw socket. */
1896 if (ipversion != connp->conn_ipversion)
1897 continue;
1898 if (!IPCL_ZONE_MATCH(connp, zoneid))
1899 continue;
1900
1901 if (ipversion == IPV4_VERSION) {
1902 if (IPCL_RAW_MATCH(connp, protocol, ipha->ipha_dst))
1903 break;
1904 } else {
1905 if (IPCL_RAW_MATCH_V6(connp, protocol, ip6h->ip6_dst)) {
1906 break;
1907 }
1908 }
1909 }
1910
1911 if (connp != NULL)
1912 goto found;
1913
1914 mutex_exit(&connfp->connf_lock);
1915 return (NULL);
1916
1917 found:
1918 ASSERT(connp != NULL);
1919 CONN_INC_REF(connp);
1920 mutex_exit(&connfp->connf_lock);
1921 return (connp);
1922 }
1923
1924 /* ARGSUSED */
1925 static int
1926 tcp_conn_constructor(void *buf, void *cdrarg, int kmflags)
1927 {
1928 itc_t *itc = (itc_t *)buf;
1929 conn_t *connp = &itc->itc_conn;
1930 tcp_t *tcp = (tcp_t *)&itc[1];
1931
1932 bzero(connp, sizeof (conn_t));
1933 bzero(tcp, sizeof (tcp_t));
1934
1935 mutex_init(&connp->conn_lock, NULL, MUTEX_DEFAULT, NULL);
1936 cv_init(&connp->conn_cv, NULL, CV_DEFAULT, NULL);
1937 cv_init(&connp->conn_sq_cv, NULL, CV_DEFAULT, NULL);
1938 tcp->tcp_timercache = tcp_timermp_alloc(kmflags);
1939 if (tcp->tcp_timercache == NULL)
1940 return (ENOMEM);
1941 connp->conn_tcp = tcp;
1942 connp->conn_flags = IPCL_TCPCONN;
1943 connp->conn_proto = IPPROTO_TCP;
1944 tcp->tcp_connp = connp;
1945 rw_init(&connp->conn_ilg_lock, NULL, RW_DEFAULT, NULL);
1946
1947 connp->conn_ixa = kmem_zalloc(sizeof (ip_xmit_attr_t), kmflags);
1948 if (connp->conn_ixa == NULL) {
1949 tcp_timermp_free(tcp);
1950 return (ENOMEM);
1951 }
1952 connp->conn_ixa->ixa_refcnt = 1;
1953 connp->conn_ixa->ixa_protocol = connp->conn_proto;
1954 connp->conn_ixa->ixa_xmit_hint = CONN_TO_XMIT_HINT(connp);
1955 return (0);
1956 }
1957
1958 /* ARGSUSED */
1959 static void
1960 tcp_conn_destructor(void *buf, void *cdrarg)
1961 {
1962 itc_t *itc = (itc_t *)buf;
1963 conn_t *connp = &itc->itc_conn;
1964 tcp_t *tcp = (tcp_t *)&itc[1];
1965
1966 ASSERT(connp->conn_flags & IPCL_TCPCONN);
1967 ASSERT(tcp->tcp_connp == connp);
1968 ASSERT(connp->conn_tcp == tcp);
1969 tcp_timermp_free(tcp);
1970 mutex_destroy(&connp->conn_lock);
1971 cv_destroy(&connp->conn_cv);
1972 cv_destroy(&connp->conn_sq_cv);
1973 rw_destroy(&connp->conn_ilg_lock);
1974
1975 /* Can be NULL if constructor failed */
1976 if (connp->conn_ixa != NULL) {
1977 ASSERT(connp->conn_ixa->ixa_refcnt == 1);
1978 ASSERT(connp->conn_ixa->ixa_ire == NULL);
1979 ASSERT(connp->conn_ixa->ixa_nce == NULL);
1980 ixa_refrele(connp->conn_ixa);
1981 }
1982 }
1983
1984 /* ARGSUSED */
1985 static int
1986 ip_conn_constructor(void *buf, void *cdrarg, int kmflags)
1987 {
1988 itc_t *itc = (itc_t *)buf;
1989 conn_t *connp = &itc->itc_conn;
1990
1991 bzero(connp, sizeof (conn_t));
1992 mutex_init(&connp->conn_lock, NULL, MUTEX_DEFAULT, NULL);
1993 cv_init(&connp->conn_cv, NULL, CV_DEFAULT, NULL);
1994 connp->conn_flags = IPCL_IPCCONN;
1995 rw_init(&connp->conn_ilg_lock, NULL, RW_DEFAULT, NULL);
1996
1997 connp->conn_ixa = kmem_zalloc(sizeof (ip_xmit_attr_t), kmflags);
1998 if (connp->conn_ixa == NULL)
1999 return (ENOMEM);
2000 connp->conn_ixa->ixa_refcnt = 1;
2001 connp->conn_ixa->ixa_xmit_hint = CONN_TO_XMIT_HINT(connp);
2002 return (0);
2003 }
2004
2005 /* ARGSUSED */
2006 static void
2007 ip_conn_destructor(void *buf, void *cdrarg)
2008 {
2009 itc_t *itc = (itc_t *)buf;
2010 conn_t *connp = &itc->itc_conn;
2011
2012 ASSERT(connp->conn_flags & IPCL_IPCCONN);
2013 ASSERT(connp->conn_priv == NULL);
2014 mutex_destroy(&connp->conn_lock);
2015 cv_destroy(&connp->conn_cv);
2016 rw_destroy(&connp->conn_ilg_lock);
2017
2018 /* Can be NULL if constructor failed */
2019 if (connp->conn_ixa != NULL) {
2020 ASSERT(connp->conn_ixa->ixa_refcnt == 1);
2021 ASSERT(connp->conn_ixa->ixa_ire == NULL);
2022 ASSERT(connp->conn_ixa->ixa_nce == NULL);
2023 ixa_refrele(connp->conn_ixa);
2024 }
2025 }
2026
2027 /* ARGSUSED */
2028 static int
2029 udp_conn_constructor(void *buf, void *cdrarg, int kmflags)
2030 {
2031 itc_t *itc = (itc_t *)buf;
2032 conn_t *connp = &itc->itc_conn;
2033 udp_t *udp = (udp_t *)&itc[1];
2034
2035 bzero(connp, sizeof (conn_t));
2036 bzero(udp, sizeof (udp_t));
2037
2038 mutex_init(&connp->conn_lock, NULL, MUTEX_DEFAULT, NULL);
2039 cv_init(&connp->conn_cv, NULL, CV_DEFAULT, NULL);
2040 connp->conn_udp = udp;
2041 connp->conn_flags = IPCL_UDPCONN;
2042 connp->conn_proto = IPPROTO_UDP;
2043 udp->udp_connp = connp;
2044 rw_init(&connp->conn_ilg_lock, NULL, RW_DEFAULT, NULL);
2045 connp->conn_ixa = kmem_zalloc(sizeof (ip_xmit_attr_t), kmflags);
2046 if (connp->conn_ixa == NULL)
2047 return (ENOMEM);
2048 connp->conn_ixa->ixa_refcnt = 1;
2049 connp->conn_ixa->ixa_protocol = connp->conn_proto;
2050 connp->conn_ixa->ixa_xmit_hint = CONN_TO_XMIT_HINT(connp);
2051 return (0);
2052 }
2053
2054 /* ARGSUSED */
2055 static void
2056 udp_conn_destructor(void *buf, void *cdrarg)
2057 {
2058 itc_t *itc = (itc_t *)buf;
2059 conn_t *connp = &itc->itc_conn;
2060 udp_t *udp = (udp_t *)&itc[1];
2061
2062 ASSERT(connp->conn_flags & IPCL_UDPCONN);
2063 ASSERT(udp->udp_connp == connp);
2064 ASSERT(connp->conn_udp == udp);
2065 mutex_destroy(&connp->conn_lock);
2066 cv_destroy(&connp->conn_cv);
2067 rw_destroy(&connp->conn_ilg_lock);
2068
2069 /* Can be NULL if constructor failed */
2070 if (connp->conn_ixa != NULL) {
2071 ASSERT(connp->conn_ixa->ixa_refcnt == 1);
2072 ASSERT(connp->conn_ixa->ixa_ire == NULL);
2073 ASSERT(connp->conn_ixa->ixa_nce == NULL);
2074 ixa_refrele(connp->conn_ixa);
2075 }
2076 }
2077
2078 /* ARGSUSED */
2079 static int
2080 rawip_conn_constructor(void *buf, void *cdrarg, int kmflags)
2081 {
2082 itc_t *itc = (itc_t *)buf;
2083 conn_t *connp = &itc->itc_conn;
2084 icmp_t *icmp = (icmp_t *)&itc[1];
2085
2086 bzero(connp, sizeof (conn_t));
2087 bzero(icmp, sizeof (icmp_t));
2088
2089 mutex_init(&connp->conn_lock, NULL, MUTEX_DEFAULT, NULL);
2090 cv_init(&connp->conn_cv, NULL, CV_DEFAULT, NULL);
2091 connp->conn_icmp = icmp;
2092 connp->conn_flags = IPCL_RAWIPCONN;
2093 connp->conn_proto = IPPROTO_ICMP;
2094 icmp->icmp_connp = connp;
2095 rw_init(&connp->conn_ilg_lock, NULL, RW_DEFAULT, NULL);
2096 connp->conn_ixa = kmem_zalloc(sizeof (ip_xmit_attr_t), kmflags);
2097 if (connp->conn_ixa == NULL)
2098 return (ENOMEM);
2099 connp->conn_ixa->ixa_refcnt = 1;
2100 connp->conn_ixa->ixa_protocol = connp->conn_proto;
2101 connp->conn_ixa->ixa_xmit_hint = CONN_TO_XMIT_HINT(connp);
2102 return (0);
2103 }
2104
2105 /* ARGSUSED */
2106 static void
2107 rawip_conn_destructor(void *buf, void *cdrarg)
2108 {
2109 itc_t *itc = (itc_t *)buf;
2110 conn_t *connp = &itc->itc_conn;
2111 icmp_t *icmp = (icmp_t *)&itc[1];
2112
2113 ASSERT(connp->conn_flags & IPCL_RAWIPCONN);
2114 ASSERT(icmp->icmp_connp == connp);
2115 ASSERT(connp->conn_icmp == icmp);
2116 mutex_destroy(&connp->conn_lock);
2117 cv_destroy(&connp->conn_cv);
2118 rw_destroy(&connp->conn_ilg_lock);
2119
2120 /* Can be NULL if constructor failed */
2121 if (connp->conn_ixa != NULL) {
2122 ASSERT(connp->conn_ixa->ixa_refcnt == 1);
2123 ASSERT(connp->conn_ixa->ixa_ire == NULL);
2124 ASSERT(connp->conn_ixa->ixa_nce == NULL);
2125 ixa_refrele(connp->conn_ixa);
2126 }
2127 }
2128
2129 /* ARGSUSED */
2130 static int
2131 rts_conn_constructor(void *buf, void *cdrarg, int kmflags)
2132 {
2133 itc_t *itc = (itc_t *)buf;
2134 conn_t *connp = &itc->itc_conn;
2135 rts_t *rts = (rts_t *)&itc[1];
2136
2137 bzero(connp, sizeof (conn_t));
2138 bzero(rts, sizeof (rts_t));
2139
2140 mutex_init(&connp->conn_lock, NULL, MUTEX_DEFAULT, NULL);
2141 cv_init(&connp->conn_cv, NULL, CV_DEFAULT, NULL);
2142 connp->conn_rts = rts;
2143 connp->conn_flags = IPCL_RTSCONN;
2144 rts->rts_connp = connp;
2145 rw_init(&connp->conn_ilg_lock, NULL, RW_DEFAULT, NULL);
2146 connp->conn_ixa = kmem_zalloc(sizeof (ip_xmit_attr_t), kmflags);
2147 if (connp->conn_ixa == NULL)
2148 return (ENOMEM);
2149 connp->conn_ixa->ixa_refcnt = 1;
2150 connp->conn_ixa->ixa_xmit_hint = CONN_TO_XMIT_HINT(connp);
2151 return (0);
2152 }
2153
2154 /* ARGSUSED */
2155 static void
2156 rts_conn_destructor(void *buf, void *cdrarg)
2157 {
2158 itc_t *itc = (itc_t *)buf;
2159 conn_t *connp = &itc->itc_conn;
2160 rts_t *rts = (rts_t *)&itc[1];
2161
2162 ASSERT(connp->conn_flags & IPCL_RTSCONN);
2163 ASSERT(rts->rts_connp == connp);
2164 ASSERT(connp->conn_rts == rts);
2165 mutex_destroy(&connp->conn_lock);
2166 cv_destroy(&connp->conn_cv);
2167 rw_destroy(&connp->conn_ilg_lock);
2168
2169 /* Can be NULL if constructor failed */
2170 if (connp->conn_ixa != NULL) {
2171 ASSERT(connp->conn_ixa->ixa_refcnt == 1);
2172 ASSERT(connp->conn_ixa->ixa_ire == NULL);
2173 ASSERT(connp->conn_ixa->ixa_nce == NULL);
2174 ixa_refrele(connp->conn_ixa);
2175 }
2176 }
2177
2178 /*
2179 * Called as part of ipcl_conn_destroy to assert and clear any pointers
2180 * in the conn_t.
2181 *
2182 * Below we list all the pointers in the conn_t as a documentation aid.
2183 * The ones that we can not ASSERT to be NULL are #ifdef'ed out.
2184 * If you add any pointers to the conn_t please add an ASSERT here
2185 * and #ifdef it out if it can't be actually asserted to be NULL.
2186 * In any case, we bzero most of the conn_t at the end of the function.
2187 */
2188 void
2189 ipcl_conn_cleanup(conn_t *connp)
2190 {
2191 ip_xmit_attr_t *ixa;
2192
2193 ASSERT(connp->conn_latch == NULL);
2194 ASSERT(connp->conn_latch_in_policy == NULL);
2195 ASSERT(connp->conn_latch_in_action == NULL);
2196 #ifdef notdef
2197 ASSERT(connp->conn_rq == NULL);
2198 ASSERT(connp->conn_wq == NULL);
2199 #endif
2200 ASSERT(connp->conn_cred == NULL);
2201 ASSERT(connp->conn_g_fanout == NULL);
2202 ASSERT(connp->conn_g_next == NULL);
2203 ASSERT(connp->conn_g_prev == NULL);
2204 ASSERT(connp->conn_policy == NULL);
2205 ASSERT(connp->conn_fanout == NULL);
2206 ASSERT(connp->conn_next == NULL);
2207 ASSERT(connp->conn_prev == NULL);
2208 ASSERT(connp->conn_oper_pending_ill == NULL);
2209 ASSERT(connp->conn_ilg == NULL);
2210 ASSERT(connp->conn_drain_next == NULL);
2211 ASSERT(connp->conn_drain_prev == NULL);
2212 #ifdef notdef
2213 /* conn_idl is not cleared when removed from idl list */
2214 ASSERT(connp->conn_idl == NULL);
2215 #endif
2216 ASSERT(connp->conn_ipsec_opt_mp == NULL);
2217 #ifdef notdef
2218 /* conn_netstack is cleared by the caller; needed by ixa_cleanup */
2219 ASSERT(connp->conn_netstack == NULL);
2220 #endif
2221
2222 ASSERT(connp->conn_helper_info == NULL);
2223 ASSERT(connp->conn_ixa != NULL);
2224 ixa = connp->conn_ixa;
2225 ASSERT(ixa->ixa_refcnt == 1);
2226 /* Need to preserve ixa_protocol */
2227 ixa_cleanup(ixa);
2228 ixa->ixa_flags = 0;
2229
2230 /* Clear out the conn_t fields that are not preserved */
2231 bzero(&connp->conn_start_clr,
2232 sizeof (conn_t) -
2233 ((uchar_t *)&connp->conn_start_clr - (uchar_t *)connp));
2234 }
2235
2236 /*
2237 * All conns are inserted in a global multi-list for the benefit of
2238 * walkers. The walk is guaranteed to walk all open conns at the time
2239 * of the start of the walk exactly once. This property is needed to
2240 * achieve some cleanups during unplumb of interfaces. This is achieved
2241 * as follows.
2242 *
2243 * ipcl_conn_create and ipcl_conn_destroy are the only functions that
2244 * call the insert and delete functions below at creation and deletion
2245 * time respectively. The conn never moves or changes its position in this
2246 * multi-list during its lifetime. CONN_CONDEMNED ensures that the refcnt
2247 * won't increase due to walkers, once the conn deletion has started. Note
2248 * that we can't remove the conn from the global list and then wait for
2249 * the refcnt to drop to zero, since walkers would then see a truncated
2250 * list. CONN_INCIPIENT ensures that walkers don't start looking at
2251 * conns until ip_open is ready to make them globally visible.
2252 * The global round robin multi-list locks are held only to get the
2253 * next member/insertion/deletion and contention should be negligible
2254 * if the multi-list is much greater than the number of cpus.
2255 */
2256 void
2257 ipcl_globalhash_insert(conn_t *connp)
2258 {
2259 int index;
2260 struct connf_s *connfp;
2261 ip_stack_t *ipst = connp->conn_netstack->netstack_ip;
2262
2263 /*
2264 * No need for atomic here. Approximate even distribution
2265 * in the global lists is sufficient.
2266 */
2267 ipst->ips_conn_g_index++;
2268 index = ipst->ips_conn_g_index & (CONN_G_HASH_SIZE - 1);
2269
2270 connp->conn_g_prev = NULL;
2271 /*
2272 * Mark as INCIPIENT, so that walkers will ignore this
2273 * for now, till ip_open is ready to make it visible globally.
2274 */
2275 connp->conn_state_flags |= CONN_INCIPIENT;
2276
2277 connfp = &ipst->ips_ipcl_globalhash_fanout[index];
2278 /* Insert at the head of the list */
2279 mutex_enter(&connfp->connf_lock);
2280 connp->conn_g_next = connfp->connf_head;
2281 if (connp->conn_g_next != NULL)
2282 connp->conn_g_next->conn_g_prev = connp;
2283 connfp->connf_head = connp;
2284
2285 /* The fanout bucket this conn points to */
2286 connp->conn_g_fanout = connfp;
2287
2288 mutex_exit(&connfp->connf_lock);
2289 }
2290
2291 void
2292 ipcl_globalhash_remove(conn_t *connp)
2293 {
2294 struct connf_s *connfp;
2295
2296 /*
2297 * We were never inserted in the global multi list.
2298 * IPCL_NONE variety is never inserted in the global multilist
2299 * since it is presumed to not need any cleanup and is transient.
2300 */
2301 if (connp->conn_g_fanout == NULL)
2302 return;
2303
2304 connfp = connp->conn_g_fanout;
2305 mutex_enter(&connfp->connf_lock);
2306 if (connp->conn_g_prev != NULL)
2307 connp->conn_g_prev->conn_g_next = connp->conn_g_next;
2308 else
2309 connfp->connf_head = connp->conn_g_next;
2310 if (connp->conn_g_next != NULL)
2311 connp->conn_g_next->conn_g_prev = connp->conn_g_prev;
2312 mutex_exit(&connfp->connf_lock);
2313
2314 /* Better to stumble on a null pointer than to corrupt memory */
2315 connp->conn_g_next = NULL;
2316 connp->conn_g_prev = NULL;
2317 connp->conn_g_fanout = NULL;
2318 }
2319
2320 /*
2321 * Walk the list of all conn_t's in the system, calling the function provided
2322 * With the specified argument for each.
2323 * Applies to both IPv4 and IPv6.
2324 *
2325 * CONNs may hold pointers to ills (conn_dhcpinit_ill and
2326 * conn_oper_pending_ill). To guard against stale pointers
2327 * ipcl_walk() is called to cleanup the conn_t's, typically when an interface is
2328 * unplumbed or removed. New conn_t's that are created while we are walking
2329 * may be missed by this walk, because they are not necessarily inserted
2330 * at the tail of the list. They are new conn_t's and thus don't have any
2331 * stale pointers. The CONN_CLOSING flag ensures that no new reference
2332 * is created to the struct that is going away.
2333 */
2334 void
2335 ipcl_walk(pfv_t func, void *arg, ip_stack_t *ipst)
2336 {
2337 int i;
2338 conn_t *connp;
2339 conn_t *prev_connp;
2340
2341 for (i = 0; i < CONN_G_HASH_SIZE; i++) {
2342 mutex_enter(&ipst->ips_ipcl_globalhash_fanout[i].connf_lock);
2343 prev_connp = NULL;
2344 connp = ipst->ips_ipcl_globalhash_fanout[i].connf_head;
2345 while (connp != NULL) {
2346 mutex_enter(&connp->conn_lock);
2347 if (connp->conn_state_flags &
2348 (CONN_CONDEMNED | CONN_INCIPIENT)) {
2349 mutex_exit(&connp->conn_lock);
2350 connp = connp->conn_g_next;
2351 continue;
2352 }
2353 CONN_INC_REF_LOCKED(connp);
2354 mutex_exit(&connp->conn_lock);
2355 mutex_exit(
2356 &ipst->ips_ipcl_globalhash_fanout[i].connf_lock);
2357 (*func)(connp, arg);
2358 if (prev_connp != NULL)
2359 CONN_DEC_REF(prev_connp);
2360 mutex_enter(
2361 &ipst->ips_ipcl_globalhash_fanout[i].connf_lock);
2362 prev_connp = connp;
2363 connp = connp->conn_g_next;
2364 }
2365 mutex_exit(&ipst->ips_ipcl_globalhash_fanout[i].connf_lock);
2366 if (prev_connp != NULL)
2367 CONN_DEC_REF(prev_connp);
2368 }
2369 }
2370
2371 /*
2372 * Search for a peer TCP/IPv4 loopback conn by doing a reverse lookup on
2373 * the {src, dst, lport, fport} quadruplet. Returns with conn reference
2374 * held; caller must call CONN_DEC_REF. Only checks for connected entries
2375 * (peer tcp in ESTABLISHED state).
2376 */
2377 conn_t *
2378 ipcl_conn_tcp_lookup_reversed_ipv4(conn_t *connp, ipha_t *ipha, tcpha_t *tcpha,
2379 ip_stack_t *ipst)
2380 {
2381 uint32_t ports;
2382 uint16_t *pports = (uint16_t *)&ports;
2383 connf_t *connfp;
2384 conn_t *tconnp;
2385 boolean_t zone_chk;
2386
2387 /*
2388 * If either the source of destination address is loopback, then
2389 * both endpoints must be in the same Zone. Otherwise, both of
2390 * the addresses are system-wide unique (tcp is in ESTABLISHED
2391 * state) and the endpoints may reside in different Zones.
2392 */
2393 zone_chk = (ipha->ipha_src == htonl(INADDR_LOOPBACK) ||
2394 ipha->ipha_dst == htonl(INADDR_LOOPBACK));
2395
2396 pports[0] = tcpha->tha_fport;
2397 pports[1] = tcpha->tha_lport;
2398
2399 connfp = &ipst->ips_ipcl_conn_fanout[IPCL_CONN_HASH(ipha->ipha_dst,
2400 ports, ipst)];
2401
2402 mutex_enter(&connfp->connf_lock);
2403 for (tconnp = connfp->connf_head; tconnp != NULL;
2404 tconnp = tconnp->conn_next) {
2405
2406 if (IPCL_CONN_MATCH(tconnp, IPPROTO_TCP,
2407 ipha->ipha_dst, ipha->ipha_src, ports) &&
2408 tconnp->conn_tcp->tcp_state == TCPS_ESTABLISHED &&
2409 (!zone_chk || tconnp->conn_zoneid == connp->conn_zoneid)) {
2410
2411 ASSERT(tconnp != connp);
2412 CONN_INC_REF(tconnp);
2413 mutex_exit(&connfp->connf_lock);
2414 return (tconnp);
2415 }
2416 }
2417 mutex_exit(&connfp->connf_lock);
2418 return (NULL);
2419 }
2420
2421 /*
2422 * Search for a peer TCP/IPv6 loopback conn by doing a reverse lookup on
2423 * the {src, dst, lport, fport} quadruplet. Returns with conn reference
2424 * held; caller must call CONN_DEC_REF. Only checks for connected entries
2425 * (peer tcp in ESTABLISHED state).
2426 */
2427 conn_t *
2428 ipcl_conn_tcp_lookup_reversed_ipv6(conn_t *connp, ip6_t *ip6h, tcpha_t *tcpha,
2429 ip_stack_t *ipst)
2430 {
2431 uint32_t ports;
2432 uint16_t *pports = (uint16_t *)&ports;
2433 connf_t *connfp;
2434 conn_t *tconnp;
2435 boolean_t zone_chk;
2436
2437 /*
2438 * If either the source of destination address is loopback, then
2439 * both endpoints must be in the same Zone. Otherwise, both of
2440 * the addresses are system-wide unique (tcp is in ESTABLISHED
2441 * state) and the endpoints may reside in different Zones. We
2442 * don't do Zone check for link local address(es) because the
2443 * current Zone implementation treats each link local address as
2444 * being unique per system node, i.e. they belong to global Zone.
2445 */
2446 zone_chk = (IN6_IS_ADDR_LOOPBACK(&ip6h->ip6_src) ||
2447 IN6_IS_ADDR_LOOPBACK(&ip6h->ip6_dst));
2448
2449 pports[0] = tcpha->tha_fport;
2450 pports[1] = tcpha->tha_lport;
2451
2452 connfp = &ipst->ips_ipcl_conn_fanout[IPCL_CONN_HASH_V6(ip6h->ip6_dst,
2453 ports, ipst)];
2454
2455 mutex_enter(&connfp->connf_lock);
2456 for (tconnp = connfp->connf_head; tconnp != NULL;
2457 tconnp = tconnp->conn_next) {
2458
2459 /* We skip conn_bound_if check here as this is loopback tcp */
2460 if (IPCL_CONN_MATCH_V6(tconnp, IPPROTO_TCP,
2461 ip6h->ip6_dst, ip6h->ip6_src, ports) &&
2462 tconnp->conn_tcp->tcp_state == TCPS_ESTABLISHED &&
2463 (!zone_chk || tconnp->conn_zoneid == connp->conn_zoneid)) {
2464
2465 ASSERT(tconnp != connp);
2466 CONN_INC_REF(tconnp);
2467 mutex_exit(&connfp->connf_lock);
2468 return (tconnp);
2469 }
2470 }
2471 mutex_exit(&connfp->connf_lock);
2472 return (NULL);
2473 }
2474
2475 /*
2476 * Find an exact {src, dst, lport, fport} match for a bounced datagram.
2477 * Returns with conn reference held. Caller must call CONN_DEC_REF.
2478 * Only checks for connected entries i.e. no INADDR_ANY checks.
2479 */
2480 conn_t *
2481 ipcl_tcp_lookup_reversed_ipv4(ipha_t *ipha, tcpha_t *tcpha, int min_state,
2482 ip_stack_t *ipst)
2483 {
2484 uint32_t ports;
2485 uint16_t *pports;
2486 connf_t *connfp;
2487 conn_t *tconnp;
2488
2489 pports = (uint16_t *)&ports;
2490 pports[0] = tcpha->tha_fport;
2491 pports[1] = tcpha->tha_lport;
2492
2493 connfp = &ipst->ips_ipcl_conn_fanout[IPCL_CONN_HASH(ipha->ipha_dst,
2494 ports, ipst)];
2495
2496 mutex_enter(&connfp->connf_lock);
2497 for (tconnp = connfp->connf_head; tconnp != NULL;
2498 tconnp = tconnp->conn_next) {
2499
2500 if (IPCL_CONN_MATCH(tconnp, IPPROTO_TCP,
2501 ipha->ipha_dst, ipha->ipha_src, ports) &&
2502 tconnp->conn_tcp->tcp_state >= min_state) {
2503
2504 CONN_INC_REF(tconnp);
2505 mutex_exit(&connfp->connf_lock);
2506 return (tconnp);
2507 }
2508 }
2509 mutex_exit(&connfp->connf_lock);
2510 return (NULL);
2511 }
2512
2513 /*
2514 * Find an exact {src, dst, lport, fport} match for a bounced datagram.
2515 * Returns with conn reference held. Caller must call CONN_DEC_REF.
2516 * Only checks for connected entries i.e. no INADDR_ANY checks.
2517 * Match on ifindex in addition to addresses.
2518 */
2519 conn_t *
2520 ipcl_tcp_lookup_reversed_ipv6(ip6_t *ip6h, tcpha_t *tcpha, int min_state,
2521 uint_t ifindex, ip_stack_t *ipst)
2522 {
2523 tcp_t *tcp;
2524 uint32_t ports;
2525 uint16_t *pports;
2526 connf_t *connfp;
2527 conn_t *tconnp;
2528
2529 pports = (uint16_t *)&ports;
2530 pports[0] = tcpha->tha_fport;
2531 pports[1] = tcpha->tha_lport;
2532
2533 connfp = &ipst->ips_ipcl_conn_fanout[IPCL_CONN_HASH_V6(ip6h->ip6_dst,
2534 ports, ipst)];
2535
2536 mutex_enter(&connfp->connf_lock);
2537 for (tconnp = connfp->connf_head; tconnp != NULL;
2538 tconnp = tconnp->conn_next) {
2539
2540 tcp = tconnp->conn_tcp;
2541 if (IPCL_CONN_MATCH_V6(tconnp, IPPROTO_TCP,
2542 ip6h->ip6_dst, ip6h->ip6_src, ports) &&
2543 tcp->tcp_state >= min_state &&
2544 (tconnp->conn_bound_if == 0 ||
2545 tconnp->conn_bound_if == ifindex)) {
2546
2547 CONN_INC_REF(tconnp);
2548 mutex_exit(&connfp->connf_lock);
2549 return (tconnp);
2550 }
2551 }
2552 mutex_exit(&connfp->connf_lock);
2553 return (NULL);
2554 }
2555
2556 /*
2557 * Finds a TCP/IPv4 listening connection; called by tcp_disconnect to locate
2558 * a listener when changing state.
2559 */
2560 conn_t *
2561 ipcl_lookup_listener_v4(uint16_t lport, ipaddr_t laddr, zoneid_t zoneid,
2562 ip_stack_t *ipst)
2563 {
2564 connf_t *bind_connfp;
2565 conn_t *connp;
2566 tcp_t *tcp;
2567
2568 /*
2569 * Avoid false matches for packets sent to an IP destination of
2570 * all zeros.
2571 */
2572 if (laddr == 0)
2573 return (NULL);
2574
2575 ASSERT(zoneid != ALL_ZONES);
2576
2577 bind_connfp = &ipst->ips_ipcl_bind_fanout[IPCL_BIND_HASH(lport, ipst)];
2578 mutex_enter(&bind_connfp->connf_lock);
2579 for (connp = bind_connfp->connf_head; connp != NULL;
2580 connp = connp->conn_next) {
2581 tcp = connp->conn_tcp;
2582 if (IPCL_BIND_MATCH(connp, IPPROTO_TCP, laddr, lport) &&
2583 IPCL_ZONE_MATCH(connp, zoneid) &&
2584 (tcp->tcp_listener == NULL)) {
2585 CONN_INC_REF(connp);
2586 mutex_exit(&bind_connfp->connf_lock);
2587 return (connp);
2588 }
2589 }
2590 mutex_exit(&bind_connfp->connf_lock);
2591 return (NULL);
2592 }
2593
2594 /*
2595 * Finds a TCP/IPv6 listening connection; called by tcp_disconnect to locate
2596 * a listener when changing state.
2597 */
2598 conn_t *
2599 ipcl_lookup_listener_v6(uint16_t lport, in6_addr_t *laddr, uint_t ifindex,
2600 zoneid_t zoneid, ip_stack_t *ipst)
2601 {
2602 connf_t *bind_connfp;
2603 conn_t *connp = NULL;
2604 tcp_t *tcp;
2605
2606 /*
2607 * Avoid false matches for packets sent to an IP destination of
2608 * all zeros.
2609 */
2610 if (IN6_IS_ADDR_UNSPECIFIED(laddr))
2611 return (NULL);
2612
2613 ASSERT(zoneid != ALL_ZONES);
2614
2615 bind_connfp = &ipst->ips_ipcl_bind_fanout[IPCL_BIND_HASH(lport, ipst)];
2616 mutex_enter(&bind_connfp->connf_lock);
2617 for (connp = bind_connfp->connf_head; connp != NULL;
2618 connp = connp->conn_next) {
2619 tcp = connp->conn_tcp;
2620 if (IPCL_BIND_MATCH_V6(connp, IPPROTO_TCP, *laddr, lport) &&
2621 IPCL_ZONE_MATCH(connp, zoneid) &&
2622 (connp->conn_bound_if == 0 ||
2623 connp->conn_bound_if == ifindex) &&
2624 tcp->tcp_listener == NULL) {
2625 CONN_INC_REF(connp);
2626 mutex_exit(&bind_connfp->connf_lock);
2627 return (connp);
2628 }
2629 }
2630 mutex_exit(&bind_connfp->connf_lock);
2631 return (NULL);
2632 }
2633
2634 /*
2635 * ipcl_get_next_conn
2636 * get the next entry in the conn global list
2637 * and put a reference on the next_conn.
2638 * decrement the reference on the current conn.
2639 *
2640 * This is an iterator based walker function that also provides for
2641 * some selection by the caller. It walks through the conn_hash bucket
2642 * searching for the next valid connp in the list, and selects connections
2643 * that are neither closed nor condemned. It also REFHOLDS the conn
2644 * thus ensuring that the conn exists when the caller uses the conn.
2645 */
2646 conn_t *
2647 ipcl_get_next_conn(connf_t *connfp, conn_t *connp, uint32_t conn_flags)
2648 {
2649 conn_t *next_connp;
2650
2651 if (connfp == NULL)
2652 return (NULL);
2653
2654 mutex_enter(&connfp->connf_lock);
2655
2656 next_connp = (connp == NULL) ?
2657 connfp->connf_head : connp->conn_g_next;
2658
2659 while (next_connp != NULL) {
2660 mutex_enter(&next_connp->conn_lock);
2661 if (!(next_connp->conn_flags & conn_flags) ||
2662 (next_connp->conn_state_flags &
2663 (CONN_CONDEMNED | CONN_INCIPIENT))) {
2664 /*
2665 * This conn has been condemned or
2666 * is closing, or the flags don't match
2667 */
2668 mutex_exit(&next_connp->conn_lock);
2669 next_connp = next_connp->conn_g_next;
2670 continue;
2671 }
2672 CONN_INC_REF_LOCKED(next_connp);
2673 mutex_exit(&next_connp->conn_lock);
2674 break;
2675 }
2676
2677 mutex_exit(&connfp->connf_lock);
2678
2679 if (connp != NULL)
2680 CONN_DEC_REF(connp);
2681
2682 return (next_connp);
2683 }
2684
2685 #ifdef CONN_DEBUG
2686 /*
2687 * Trace of the last NBUF refhold/refrele
2688 */
2689 int
2690 conn_trace_ref(conn_t *connp)
2691 {
2692 int last;
2693 conn_trace_t *ctb;
2694
2695 ASSERT(MUTEX_HELD(&connp->conn_lock));
2696 last = connp->conn_trace_last;
2697 last++;
2698 if (last == CONN_TRACE_MAX)
2699 last = 0;
2700
2701 ctb = &connp->conn_trace_buf[last];
2702 ctb->ctb_depth = getpcstack(ctb->ctb_stack, CONN_STACK_DEPTH);
2703 connp->conn_trace_last = last;
2704 return (1);
2705 }
2706
2707 int
2708 conn_untrace_ref(conn_t *connp)
2709 {
2710 int last;
2711 conn_trace_t *ctb;
2712
2713 ASSERT(MUTEX_HELD(&connp->conn_lock));
2714 last = connp->conn_trace_last;
2715 last++;
2716 if (last == CONN_TRACE_MAX)
2717 last = 0;
2718
2719 ctb = &connp->conn_trace_buf[last];
2720 ctb->ctb_depth = getpcstack(ctb->ctb_stack, CONN_STACK_DEPTH);
2721 connp->conn_trace_last = last;
2722 return (1);
2723 }
2724 #endif