ipclassifier.c revision 7c478bd95313f5f23a4c958a745db2134aa03244
/*
* CDDL HEADER START
*
* The contents of this file are subject to the terms of the
* Common Development and Distribution License, Version 1.0 only
* (the "License"). You may not use this file except in compliance
* with the License.
*
* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
* See the License for the specific language governing permissions
* and limitations under the License.
*
* When distributing Covered Code, include this CDDL HEADER in each
* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
* If applicable, add the following below this CDDL HEADER, with the
* fields enclosed by brackets "[]" replaced with your own identifying
* information: Portions Copyright [yyyy] [name of copyright owner]
*
* CDDL HEADER END
*/
/*
* Copyright 2004 Sun Microsystems, Inc. All rights reserved.
* Use is subject to license terms.
*/
#pragma ident "%Z%%M% %I% %E% SMI"
const char ipclassifier_version[] = "@(#)ipclassifier.c 1.6 04/03/31 SMI";
/*
* IP PACKET CLASSIFIER
*
* The IP packet classifier provides mapping between IP packets and persistent
* connection state for connection-oriented protocols. It also provides
* interface for managing connection states.
*
* The connection state is kept in conn_t data structure and contains, among
* other things:
*
* o Transport protocol
* o squeue for the connection (for TCP only)
* o reference counter
* o Connection state
* o hash table linkage
* o credentials
* o ipsec policy
* o send and receive functions.
* o mutex lock.
*
* Connections use a reference counting scheme. They are freed when the
* reference counter drops to zero. A reference is incremented when connection
* is placed in a list or table, when incoming packet for the connection arrives
* and when connection is processed via squeue (squeue processing may be
* asynchronous and the reference protects the connection from being destroyed
* before its processing is finished).
*
* send and receive functions are currently used for TCP only. The send function
* determines the IP entry point for the packet once it leaves TCP to be sent to
* the destination address. The receive function is used by IP when the packet
* should be passed for TCP processing. When a new connection is created these
* are set to ip_output() and tcp_input() respectively. During the lifetime of
* the connection the send and receive functions may change depending on the
* changes in the connection state. For example, Once the connection is bound to
* an addresse, the receive function for this connection is set to
* tcp_conn_request(). This allows incoming SYNs to go directly into the
* listener SYN processing function without going to tcp_input() first.
*
* Classifier uses several hash tables:
*
* ipcl_conn_fanout: contains all TCP connections in CONNECTED state
* ipcl_bind_fanout: contains all connections in BOUND state
* ipcl_proto_fanout: IPv4 protocol fanout
* ipcl_proto_fanout_v6: IPv6 protocol fanout
* ipcl_udp_fanout: contains all UDP connections
* ipcl_globalhash_fanout: contains all connections
*
* The ipcl_globalhash_fanout is used for any walkers (like snmp and Clustering)
* which need to view all existing connections.
*
* All tables are protected by per-bucket locks. When both per-bucket lock and
* connection lock need to be held, the per-bucket lock should be acquired
* first, followed by the connection lock.
*
* All functions doing search in one of these tables increment a reference
* counter on the connection found (if any). This reference should be dropped
* when the caller has finished processing the connection.
*
*
* INTERFACES:
* ===========
*
* Connection Lookup:
* ------------------
*
* conn_t *ipcl_classify_v4(mp, protocol, hdr_len, zoneid)
* conn_t *ipcl_classify_v6(mp, protocol, hdr_len, zoneid)
*
* Finds connection for an incoming IPv4 or IPv6 packet. Returns NULL if
* it can't find any associated connection. If the connection is found, its
* reference counter is incremented.
*
* mp: mblock, containing packet header. The full header should fit
* into a single mblock. It should also contain at least full IP
* and TCP or UDP header.
*
* protocol: Either IPPROTO_TCP or IPPROTO_UDP.
*
* hdr_len: The size of IP header. It is used to find TCP or UDP header in
* the packet.
*
* zoneid: The zone in which the returned connection must be.
*
* For TCP connections, the lookup order is as follows:
* 5-tuple {src, dst, protocol, local port, remote port}
* lookup in ipcl_conn_fanout table.
* 3-tuple {dst, remote port, protocol} lookup in
* ipcl_bind_fanout table.
*
* For UDP connections, a 5-tuple {src, dst, protocol, local port,
* remote port} lookup is done on ipcl_udp_fanout. Note that,
* these interfaces do not handle cases where a packets belongs
* to multiple UDP clients, which is handled in IP itself.
*
* conn_t *ipcl_tcp_lookup_reversed_ipv4(ipha_t *, tcph_t *, int);
* conn_t *ipcl_tcp_lookup_reversed_ipv6(ip6_t *, tcpha_t *, int, uint_t);
*
* Lookup routine to find a exact match for {src, dst, local port,
* remote port) for TCP connections in ipcl_conn_fanout. The address and
* ports are read from the IP and TCP header respectively.
*
* conn_t *ipcl_lookup_listener_v4(lport, laddr, protocol);
* conn_t *ipcl_lookup_listener_v6(lport, laddr, protocol, ifindex);
*
* Lookup routine to find a listener with the tuple {lport, laddr,
* protocol} in the ipcl_bind_fanout table. For IPv6, an additional
* parameter interface index is also compared.
*
* void ipcl_walk(func, arg)
*
* Apply 'func' to every connection available. The 'func' is called as
* (*func)(connp, arg). The walk is non-atomic so connections may be
* created and destroyed during the walk. The CONN_CONDEMNED and
* CONN_INCIPIENT flags ensure that connections which are newly created
* or being destroyed are not selected by the walker.
*
* Table Updates
* -------------
*
* int ipcl_conn_insert(connp, protocol, src, dst, ports)
* int ipcl_conn_insert_v6(connp, protocol, src, dst, ports, ifindex)
*
* Insert 'connp' in the ipcl_conn_fanout.
* Arguements :
* connp conn_t to be inserted
* protocol connection protocol
* src source address
* dst destination address
* ports local and remote port
* ifindex interface index for IPv6 connections
*
* Return value :
* 0 if connp was inserted
* EADDRINUSE if the connection with the same tuple
* already exists.
*
* int ipcl_bind_insert(connp, protocol, src, lport);
* int ipcl_bind_insert_v6(connp, protocol, src, lport);
*
* Insert 'connp' in ipcl_bind_fanout.
* Arguements :
* connp conn_t to be inserted
* protocol connection protocol
* src source address connection wants
* to bind to
* lport local port connection wants to
* bind to
*
*
* void ipcl_hash_remove(connp);
*
* Removes the 'connp' from the connection fanout table.
*
* Connection Creation/Destruction
* -------------------------------
*
* conn_t *ipcl_conn_create(type, sleep)
*
* Creates a new conn based on the type flag, inserts it into
* globalhash table.
*
* type: This flag determines the type of conn_t which needs to be
* created.
* IPCL_TCPCONN indicates a TCP connection
* IPCL_IPCONN indicates all non-TCP connections.
*
* void ipcl_conn_destroy(connp)
*
* Destroys the connection state, removes it from the global
* connection hash table and frees its memory.
*/
#include <sys/sysmacros.h>
#define _SUN_TPI_VERSION 2
#include <sys/isa_defs.h>
#include <inet/tcp_trace.h>
#include <inet/ip_multi.h>
#include <sys/ethernet.h>
#include <net/if_types.h>
#include <inet/ipclassifier.h>
#include <inet/ipsec_impl.h>
#ifdef DEBUG
#define IPCL_DEBUG
#else
#endif
#ifdef IPCL_DEBUG
int ipcl_debug_level = 0;
#else
#endif
/* A separate hash list for raw socket. */
/* Old value for compatibility */
uint_t tcp_conn_hash_size = 0;
/* New value. Zero means choose automatically. */
/* Raw socket fanout size. Must be a power of 2. */
/*
* Power of 2^N Primes useful for hashing for N of 0-28,
* these primes are the nearest prime <= 2^N - 2^(N-2).
*/
6143, 12281, 24571, 49139, 98299, 196597, 393209, \
786431, 1572853, 3145721, 6291449, 12582893, 25165813, \
50331599, 100663291, 201326557, 0}
/*
* wrapper structure to ensure that conn+tcpb are aligned
* on cache lines.
*/
typedef struct itc_s {
union {
} itc_u;
} itc_t;
struct kmem_cache *ipcl_tcpconn_cache;
struct kmem_cache *ipcl_tcp_cache;
struct kmem_cache *ipcl_conn_cache;
extern struct kmem_cache *sctp_conn_cache;
extern struct kmem_cache *tcp_sack_info_cache;
extern struct kmem_cache *tcp_iphc_cache;
extern void tcp_timermp_free(tcp_t *);
extern mblk_t *tcp_timermp_alloc(int);
static int ipcl_tcpconn_constructor(void *, void *, int);
static void ipcl_tcpconn_destructor(void *, void *);
static int conn_g_index;
#ifdef IPCL_DEBUG
#define INET_NTOA_BUFSIZE 18
static char *
{
unsigned char *p;
p = (unsigned char *)∈
return (b);
}
#endif
/*
* ipclassifier intialization routine, sets up hash tables and
* conn caches.
*/
void
ipcl_init(void)
{
int i;
sizeof (conn_t), CACHE_ALIGN_SIZE,
sizeof (itc_t), CACHE_ALIGN_SIZE,
/*
* Calculate size of conn fanout table.
*/
if (ipcl_conn_hash_size != 0) {
} else if (tcp_conn_hash_size != 0) {
} else {
}
if (sizes[i] >= ipcl_conn_fanout_size) {
break;
}
}
if ((ipcl_conn_fanout_size = sizes[i]) == 0) {
/* Out of range, use the 2^16 value */
}
sizeof (*ipcl_conn_fanout), KM_SLEEP);
for (i = 0; i < ipcl_conn_fanout_size; i++) {
}
sizeof (*ipcl_bind_fanout), KM_SLEEP);
for (i = 0; i < ipcl_bind_fanout_size; i++) {
}
for (i = 0; i < A_CNT(ipcl_proto_fanout); i++) {
}
for (i = 0; i < A_CNT(ipcl_proto_fanout_v6); i++) {
}
sizeof (*ipcl_udp_fanout), KM_SLEEP);
for (i = 0; i < ipcl_udp_fanout_size; i++) {
}
sizeof (*ipcl_raw_fanout), KM_SLEEP);
for (i = 0; i < ipcl_raw_fanout_size; i++) {
}
for (i = 0; i < CONN_G_HASH_SIZE; i++) {
}
}
void
ipcl_destroy(void)
{
int i;
for (i = 0; i < ipcl_conn_fanout_size; i++)
sizeof (*ipcl_conn_fanout));
for (i = 0; i < ipcl_bind_fanout_size; i++)
sizeof (*ipcl_bind_fanout));
for (i = 0; i < A_CNT(ipcl_proto_fanout); i++)
for (i = 0; i < A_CNT(ipcl_proto_fanout_v6); i++)
for (i = 0; i < ipcl_udp_fanout_size; i++)
sizeof (*ipcl_udp_fanout));
for (i = 0; i < ipcl_raw_fanout_size; i++)
sizeof (*ipcl_raw_fanout));
}
/*
* conn creation routine. initialize the conn, sets the reference
* and inserts it in the global hash table.
*/
conn_t *
{
switch (type) {
case IPCL_TCPCONN:
return (NULL);
("ipcl_conn_create: connp = %p tcp (%p)",
break;
case IPCL_SCTPCONN:
return (NULL);
break;
case IPCL_IPCCONN:
return (connp);
("ipcl_conn_create: connp = %p\n", (void *)connp));
break;
}
return (connp);
}
void
{
tcp->tcp_sack_info);
}
if (tcp->tcp_hdr_grown) {
} else {
}
tcp->tcp_iphc_len = 0;
}
} else {
}
}
/*
* Running in cluster mode - deregister listener information
*/
static void
{
if (cl_inet_unlisten != NULL) {
if (connp->conn_pkt_isv6) {
} else {
}
connp->conn_lport);
}
}
/*
* We set the IPCL_REMOVED flag (instead of clearing the flag indicating
* which table the conn belonged to). So for debugging we can see which hash
* table this connection was in.
*/
#define IPCL_HASH_REMOVE(connp) { \
(void *)(connp))); \
else \
ipcl_conn_unlisten((connp)); \
CONN_DEC_REF((connp)); \
} \
}
void
{
}
/*
* The whole purpose of this function is allow removal of
* a conn_t from the connected hash for timewait reclaim.
* This is essentially a TW reclaim fastpath where timewait
* collector checks under fanout lock (so no one else can
* get access to the conn_t) that refcnt is 2 i.e. one for
* TCP and one for the classifier hash list. If ref count
* is indeed 2, we can just remove the conn under lock and
* avoid cleaning up the conn under squeue. This gives us
* improved performance.
*/
void
{
}
} else {
}
}
} \
CONN_INC_REF(connp); \
}
IPCL_HASH_REMOVE((connp)); \
}
IPCL_HASH_REMOVE((connp)); \
} \
} else { \
} \
} \
} else { \
} \
} \
IPCL_BOUND; \
CONN_INC_REF(connp); \
}
boolean_t isv4mapped = \
IPCL_HASH_REMOVE((connp)); \
if (isv4mapped && \
break; \
} \
} \
IPCL_BOUND; \
CONN_INC_REF((connp)); \
}
void
{
}
void
{
/* Insert it in the protocol hash */
}
void
{
/* Insert it in the Bind Hash */
}
/*
* This function is used only for inserting SCTP raw socket now.
* This may change later.
*
* Note that only one raw socket can be bound to a port. The param
* lport is in network byte order.
*/
static int
{
/* Check for existing raw socket already bound to the port. */
&connp->conn_srcv6))) {
break;
}
}
return (EADDRNOTAVAIL);
} else {
}
} else {
}
return (0);
}
/*
* (v4, v6) bind hash insertion routines
*/
int
{
#ifdef IPCL_DEBUG
char buf[INET_NTOA_BUFSIZE];
#endif
int ret = 0;
switch (protocol) {
case IPPROTO_UDP:
default:
if (protocol == IPPROTO_UDP) {
IPCL_DEBUG_LVL(64,
("ipcl_bind_insert: connp %p - udp\n",
(void *)connp));
} else {
IPCL_DEBUG_LVL(64,
("ipcl_bind_insert: connp %p - protocol\n",
(void *)connp));
}
} else {
}
break;
case IPPROTO_TCP:
/* Insert it in the Bind Hash */
} else {
}
if (cl_inet_listen != NULL) {
}
break;
case IPPROTO_SCTP:
break;
}
return (ret);
}
int
{
int ret = 0;
switch (protocol) {
case IPPROTO_UDP:
default:
if (protocol == IPPROTO_UDP) {
IPCL_DEBUG_LVL(128,
("ipcl_bind_insert_v6: connp %p - udp\n",
(void *)connp));
} else {
IPCL_DEBUG_LVL(128,
("ipcl_bind_insert_v6: connp %p - protocol\n",
(void *)connp));
}
} else {
}
break;
case IPPROTO_TCP:
/* XXX - Need a separate table for IN6_IS_ADDR_UNSPECIFIED? */
/* Insert it in the Bind Hash */
} else {
}
if (cl_inet_listen != NULL) {
if (connp->conn_pkt_isv6) {
laddrp =
} else {
}
lport);
}
break;
case IPPROTO_SCTP:
break;
}
return (ret);
}
/*
* ipcl_conn_hash insertion routines.
*/
int
{
#ifdef IPCL_DEBUG
#endif
int ret = 0;
"dst = %s, ports = %x, protocol = %x", (void *)connp,
switch (protocol) {
case IPPROTO_TCP:
/*
* for a eager connection, i.e connections which
* have just been created, the initialization is
* already done in ip at conn_creation time, so
* we can skip the checks here.
*/
}
connp->conn_ports)];
connp->conn_ports)) {
/* Already have a conn. bail out */
return (EADDRINUSE);
}
}
/*
* rebind. Let it happen.
*/
}
break;
case IPPROTO_SCTP:
break;
case IPPROTO_UDP:
default:
if (protocol == IPPROTO_UDP) {
} else {
}
} else {
}
break;
}
return (ret);
}
int
{
int ret = 0;
switch (protocol) {
case IPPROTO_TCP:
/* Just need to insert a conn struct */
}
connp->conn_ports)];
connp->conn_ports) &&
/* Already have a conn. bail out */
return (EADDRINUSE);
}
}
/*
* rebind. Let it happen.
*/
}
break;
case IPPROTO_SCTP:
break;
case IPPROTO_UDP:
default:
if (protocol == IPPROTO_UDP) {
} else {
}
} else {
}
break;
}
return (ret);
}
/*
* v4 packet classifying function. looks up the fanout table to
* find the conn, the packet belongs to. returns the conn with
* the reference held, null otherwise.
*/
conn_t *
{
switch (protocol) {
case IPPROTO_TCP:
connfp =
break;
}
return (connp);
}
break;
}
/* Have a listner at least */
return (connp);
}
IPCL_DEBUG_LVL(512,
("ipcl_classify: couldn't classify mp = %p\n",
(void *)mp));
break;
case IPPROTO_UDP:
break;
}
return (connp);
}
/*
*/
IPCL_DEBUG_LVL(512,
("ipcl_classify: cant find udp conn_t for ports : %x %x",
break;
}
return (NULL);
}
conn_t *
{
switch (protocol) {
case IPPROTO_TCP:
connfp =
break;
}
return (connp);
}
break;
}
/* Have a listner at least */
IPCL_DEBUG_LVL(512,
("ipcl_classify_v6: found listner "
"connp = %p\n", (void *)connp));
return (connp);
}
IPCL_DEBUG_LVL(512,
("ipcl_classify_v6: couldn't classify mp = %p\n",
(void *)mp));
break;
case IPPROTO_UDP:
fport));
break;
}
return (connp);
}
/*
*/
IPCL_DEBUG_LVL(512,
("ipcl_classify_v6: cant find udp conn_t for ports : %x %x",
break;
}
return (NULL);
}
/*
* wrapper around ipcl_classify_(v4,v6) routines.
*/
conn_t *
{
return (NULL);
case IPV4_VERSION:
zoneid));
case IPV6_VERSION:
return (NULL);
}
return (NULL);
}
conn_t *
{
int af;
/* We don't allow v4 fallback for v6 raw socket. */
continue;
}
if (connp->conn_fully_bound) {
if (af == IPV4_VERSION) {
break;
}
} else {
break;
}
}
} else {
if (af == IPV4_VERSION) {
break;
}
} else {
break;
}
}
}
}
return (connp);
}
return (NULL);
}
/* ARGSUSED */
static int
{
return (0);
}
/* ARGSUSED */
static void
{
}
/*
* All conns are inserted in a global multi-list for the benefit of
* walkers. The walk is guaranteed to walk all open conns at the time
* of the start of the walk exactly once. This property is needed to
* achieve some cleanups during unplumb of interfaces. This is achieved
* as follows.
*
* ipcl_conn_create and ipcl_conn_destroy are the only functions that
* call the insert and delete functions below at creation and deletion
* time respectively. The conn never moves or changes its position in this
* multi-list during its lifetime. CONN_CONDEMNED ensures that the refcnt
* won't increase due to walkers, once the conn deletion has started. Note
* that we can't remove the conn from the global list and then wait for
* the refcnt to drop to zero, since walkers would then see a truncated
* list. CONN_INCIPIENT ensures that walkers don't start looking at
* conns until ip_open is ready to make them globally visible.
* The global round robin multi-list locks are held only to get the
* if the multi-list is much greater than the number of cpus.
*/
void
{
int index;
/*
* No need for atomic here. Approximate even distribution
* in the global lists is sufficient.
*/
conn_g_index++;
/*
* Mark as INCIPIENT, so that walkers will ignore this
* for now, till ip_open is ready to make it visible globally.
*/
/* Insert at the head of the list */
/* The fanout bucket this conn points to */
}
void
{
/*
* We were never inserted in the global multi list.
* IPCL_NONE variety is never inserted in the global multilist
* since it is presumed to not need any cleanup and is transient.
*/
return;
else
/* Better to stumble on a null pointer than to corrupt memory */
}
/*
* Walk the list of all conn_t's in the system, calling the function provided
* with the specified argument for each.
* Applies to both IPv4 and IPv6.
*
* ipcl_walk() is called to cleanup the conn_t's, typically when an interface is
* unplumbed or removed. New conn_t's that are created while we are walking
* may be missed by this walk, because they are not necessarily inserted
* at the tail of the list. They are new conn_t's and thus don't have any
* stale pointers. The CONN_CLOSING flag ensures that no new reference
* is created to the struct that is going away.
*/
void
{
int i;
for (i = 0; i < CONN_G_HASH_SIZE; i++) {
prev_connp = NULL;
if (connp->conn_state_flags &
(CONN_CONDEMNED | CONN_INCIPIENT)) {
continue;
}
if (prev_connp != NULL)
prev_connp = connp;
}
if (prev_connp != NULL)
}
}
/*
* the {src, dst, lport, fport} quadruplet. Returns with conn reference
* held; caller must call CONN_DEC_REF. Only checks for connected entries
* (peer tcp in at least ESTABLISHED state).
*/
conn_t *
{
/*
* If either the source of destination address is loopback, then
* both endpoints must be in the same Zone. Otherwise, both of
* the addresses are system-wide unique (tcp is in ESTABLISHED
* state) and the endpoints may reside in different Zones.
*/
return (tconnp);
}
}
return (NULL);
}
/*
* the {src, dst, lport, fport} quadruplet. Returns with conn reference
* held; caller must call CONN_DEC_REF. Only checks for connected entries
* (peer tcp in at least ESTABLISHED state).
*/
conn_t *
{
/*
* If either the source of destination address is loopback, then
* both endpoints must be in the same Zone. Otherwise, both of
* the addresses are system-wide unique (tcp is in ESTABLISHED
* state) and the endpoints may reside in different Zones. We
* don't do Zone check for link local address(es) because the
* current Zone implementation treats each link local address as
* being unique per system node, i.e. they belong to global Zone.
*/
/* We skip tcp_bound_if check here as this is loopback tcp */
return (tconnp);
}
}
return (NULL);
}
/*
* Find an exact {src, dst, lport, fport} match for a bounced datagram.
* Returns with conn reference held. Caller must call CONN_DEC_REF.
* Only checks for connected entries i.e. no INADDR_ANY checks.
*/
conn_t *
{
return (tconnp);
}
}
return (NULL);
}
/*
* Find an exact {src, dst, lport, fport} match for a bounced datagram.
* Returns with conn reference held. Caller must call CONN_DEC_REF.
* Only checks for connected entries i.e. no INADDR_ANY checks.
* Match on ifindex in addition to addresses.
*/
conn_t *
{
(tcp->tcp_bound_if == 0 ||
return (tconnp);
}
}
return (NULL);
}
/*
* To find a TCP listening connection matching the incoming segment.
*/
conn_t *
{
/*
* Avoid false matches for packets sent to an IP destination of
* all zeros.
*/
if (laddr == 0)
return (NULL);
return (connp);
}
}
return (NULL);
}
conn_t *
{
/*
* Avoid false matches for packets sent to an IP destination of
* all zeros.
*/
if (IN6_IS_ADDR_UNSPECIFIED(laddr))
return (NULL);
(tcp->tcp_bound_if == 0 ||
return (connp);
}
}
return (NULL);
}
#ifdef CONN_DEBUG
/*
*/
int
{
int last;
last++;
if (last == CONN_TRACE_MAX)
last = 0;
return (1);
}
int
{
int last;
last++;
if (last == CONN_TRACE_MAX)
last = 0;
return (1);
}
#endif