ipclassifier.c revision a9737be2ffd06809b910b99f83661c1a911bd543
/*
* CDDL HEADER START
*
* The contents of this file are subject to the terms of the
* Common Development and Distribution License (the "License").
* You may not use this file except in compliance with the License.
*
* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
* See the License for the specific language governing permissions
* and limitations under the License.
*
* When distributing Covered Code, include this CDDL HEADER in each
* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
* If applicable, add the following below this CDDL HEADER, with the
* fields enclosed by brackets "[]" replaced with your own identifying
* information: Portions Copyright [yyyy] [name of copyright owner]
*
* CDDL HEADER END
*/
/*
* Copyright 2007 Sun Microsystems, Inc. All rights reserved.
* Use is subject to license terms.
*/
#pragma ident "%Z%%M% %I% %E% SMI"
const char ipclassifier_version[] = "@(#)ipclassifier.c %I% %E% SMI";
/*
* IP PACKET CLASSIFIER
*
* The IP packet classifier provides mapping between IP packets and persistent
* connection state for connection-oriented protocols. It also provides
* interface for managing connection states.
*
* The connection state is kept in conn_t data structure and contains, among
* other things:
*
* o Transport protocol
* o squeue for the connection (for TCP only)
* o reference counter
* o Connection state
* o hash table linkage
* o credentials
* o ipsec policy
* o send and receive functions.
* o mutex lock.
*
* Connections use a reference counting scheme. They are freed when the
* reference counter drops to zero. A reference is incremented when connection
* is placed in a list or table, when incoming packet for the connection arrives
* and when connection is processed via squeue (squeue processing may be
* asynchronous and the reference protects the connection from being destroyed
* before its processing is finished).
*
* send and receive functions are currently used for TCP only. The send function
* determines the IP entry point for the packet once it leaves TCP to be sent to
* the destination address. The receive function is used by IP when the packet
* should be passed for TCP processing. When a new connection is created these
* are set to ip_output() and tcp_input() respectively. During the lifetime of
* the connection the send and receive functions may change depending on the
* changes in the connection state. For example, Once the connection is bound to
* an addresse, the receive function for this connection is set to
* tcp_conn_request(). This allows incoming SYNs to go directly into the
* listener SYN processing function without going to tcp_input() first.
*
* Classifier uses several hash tables:
*
* ipcl_conn_fanout: contains all TCP connections in CONNECTED state
* ipcl_bind_fanout: contains all connections in BOUND state
* ipcl_proto_fanout: IPv4 protocol fanout
* ipcl_proto_fanout_v6: IPv6 protocol fanout
* ipcl_udp_fanout: contains all UDP connections
* ipcl_globalhash_fanout: contains all connections
*
* The ipcl_globalhash_fanout is used for any walkers (like snmp and Clustering)
* which need to view all existing connections.
*
* All tables are protected by per-bucket locks. When both per-bucket lock and
* connection lock need to be held, the per-bucket lock should be acquired
* first, followed by the connection lock.
*
* All functions doing search in one of these tables increment a reference
* counter on the connection found (if any). This reference should be dropped
* when the caller has finished processing the connection.
*
*
* INTERFACES:
* ===========
*
* Connection Lookup:
* ------------------
*
* conn_t *ipcl_classify_v4(mp, protocol, hdr_len, zoneid, ip_stack)
* conn_t *ipcl_classify_v6(mp, protocol, hdr_len, zoneid, ip_stack)
*
* Finds connection for an incoming IPv4 or IPv6 packet. Returns NULL if
* it can't find any associated connection. If the connection is found, its
* reference counter is incremented.
*
* mp: mblock, containing packet header. The full header should fit
* into a single mblock. It should also contain at least full IP
* and TCP or UDP header.
*
* protocol: Either IPPROTO_TCP or IPPROTO_UDP.
*
* hdr_len: The size of IP header. It is used to find TCP or UDP header in
* the packet.
*
* zoneid: The zone in which the returned connection must be; the zoneid
* corresponding to the ire_zoneid on the IRE located for the
* packet's destination address.
*
* For TCP connections, the lookup order is as follows:
* 5-tuple {src, dst, protocol, local port, remote port}
* lookup in ipcl_conn_fanout table.
* 3-tuple {dst, remote port, protocol} lookup in
* ipcl_bind_fanout table.
*
* For UDP connections, a 5-tuple {src, dst, protocol, local port,
* remote port} lookup is done on ipcl_udp_fanout. Note that,
* these interfaces do not handle cases where a packets belongs
* to multiple UDP clients, which is handled in IP itself.
*
* If the destination IRE is ALL_ZONES (indicated by zoneid), then we must
* determine which actual zone gets the segment. This is used only in a
* labeled environment. The matching rules are:
*
* - If it's not a multilevel port, then the label on the packet selects
* the zone. Unlabeled packets are delivered to the global zone.
*
* - If it's a multilevel port, then only the zone registered to receive
* packets on that port matches.
*
* Also, in a labeled environment, packet labels need to be checked. For fully
* bound TCP connections, we can assume that the packet label was checked
* during connection establishment, and doesn't need to be checked on each
* packet. For others, though, we need to check for strict equality or, for
* multilevel ports, membership in the range or set. This part currently does
* a tnrh lookup on each packet, but could be optimized to use cached results
* if that were necessary. (SCTP doesn't come through here, but if it did,
* we would apply the same rules as TCP.)
*
* An implication of the above is that fully-bound TCP sockets must always use
* distinct 4-tuples; they can't be discriminated by label alone.
*
* Note that we cannot trust labels on packets sent to fully-bound UDP sockets,
* as there's no connection set-up handshake and no shared state.
*
* Labels on looped-back packets within a single zone do not need to be
* checked, as all processes in the same zone have the same label.
*
* Finally, for unlabeled packets received by a labeled system, special rules
* apply. We consider only the MLP if there is one. Otherwise, we prefer a
* socket in the zone whose label matches the default label of the sender, if
* any. In any event, the receiving socket must have SO_MAC_EXEMPT set and the
* receiver's label must dominate the sender's default label.
*
* conn_t *ipcl_tcp_lookup_reversed_ipv4(ipha_t *, tcph_t *, int, ip_stack);
* conn_t *ipcl_tcp_lookup_reversed_ipv6(ip6_t *, tcpha_t *, int, uint_t,
* ip_stack);
*
* Lookup routine to find a exact match for {src, dst, local port,
* remote port) for TCP connections in ipcl_conn_fanout. The address and
* ports are read from the IP and TCP header respectively.
*
* conn_t *ipcl_lookup_listener_v4(lport, laddr, protocol,
* zoneid, ip_stack);
* conn_t *ipcl_lookup_listener_v6(lport, laddr, protocol, ifindex,
* zoneid, ip_stack);
*
* Lookup routine to find a listener with the tuple {lport, laddr,
* protocol} in the ipcl_bind_fanout table. For IPv6, an additional
* parameter interface index is also compared.
*
* void ipcl_walk(func, arg, ip_stack)
*
* Apply 'func' to every connection available. The 'func' is called as
* (*func)(connp, arg). The walk is non-atomic so connections may be
* created and destroyed during the walk. The CONN_CONDEMNED and
* CONN_INCIPIENT flags ensure that connections which are newly created
* or being destroyed are not selected by the walker.
*
* Table Updates
* -------------
*
* int ipcl_conn_insert(connp, protocol, src, dst, ports)
* int ipcl_conn_insert_v6(connp, protocol, src, dst, ports, ifindex)
*
* Insert 'connp' in the ipcl_conn_fanout.
* Arguements :
* connp conn_t to be inserted
* protocol connection protocol
* src source address
* dst destination address
* ports local and remote port
* ifindex interface index for IPv6 connections
*
* Return value :
* 0 if connp was inserted
* EADDRINUSE if the connection with the same tuple
* already exists.
*
* int ipcl_bind_insert(connp, protocol, src, lport);
* int ipcl_bind_insert_v6(connp, protocol, src, lport);
*
* Insert 'connp' in ipcl_bind_fanout.
* Arguements :
* connp conn_t to be inserted
* protocol connection protocol
* src source address connection wants
* to bind to
* lport local port connection wants to
* bind to
*
*
* void ipcl_hash_remove(connp);
*
* Removes the 'connp' from the connection fanout table.
*
* Connection Creation/Destruction
* -------------------------------
*
* conn_t *ipcl_conn_create(type, sleep, netstack_t *)
*
* Creates a new conn based on the type flag, inserts it into
* globalhash table.
*
* type: This flag determines the type of conn_t which needs to be
* created i.e., which kmem_cache it comes from.
* IPCL_TCPCONN indicates a TCP connection
* IPCL_SCTPCONN indicates a SCTP connection
* IPCL_UDPCONN indicates a UDP conn_t.
* IPCL_RTSCONN indicates a RTS conn_t.
* IPCL_IPCCONN indicates all other connections.
*
* void ipcl_conn_destroy(connp)
*
* Destroys the connection state, removes it from the global
* connection hash table and frees its memory.
*/
#include <sys/sysmacros.h>
#define _SUN_TPI_VERSION 2
#include <sys/isa_defs.h>
#include <inet/udp_impl.h>
#include <inet/rawip_impl.h>
#include <inet/rts_impl.h>
#include <inet/ipclassifier.h>
#include <inet/ipsec_impl.h>
#ifdef DEBUG
#define IPCL_DEBUG
#else
#endif
#ifdef IPCL_DEBUG
int ipcl_debug_level = 0;
#else
#endif
uint_t tcp_conn_hash_size = 0;
/* Raw socket fanout size. Must be a power of 2. */
/*
* Power of 2^N Primes useful for hashing for N of 0-28,
* these primes are the nearest prime <= 2^N - 2^(N-2).
*/
6143, 12281, 24571, 49139, 98299, 196597, 393209, \
786431, 1572853, 3145721, 6291449, 12582893, 25165813, \
50331599, 100663291, 201326557, 0}
/*
* wrapper structure to ensure that conn and what follows it (tcp_t, etc)
* are aligned on cache lines.
*/
typedef union itc_s {
} itc_t;
struct kmem_cache *tcp_conn_cache;
struct kmem_cache *ip_conn_cache;
extern struct kmem_cache *sctp_conn_cache;
extern struct kmem_cache *tcp_sack_info_cache;
extern struct kmem_cache *tcp_iphc_cache;
struct kmem_cache *udp_conn_cache;
struct kmem_cache *rawip_conn_cache;
struct kmem_cache *rts_conn_cache;
extern void tcp_timermp_free(tcp_t *);
extern mblk_t *tcp_timermp_alloc(int);
static int ip_conn_constructor(void *, void *, int);
static void ip_conn_destructor(void *, void *);
static int tcp_conn_constructor(void *, void *, int);
static void tcp_conn_destructor(void *, void *);
static int udp_conn_constructor(void *, void *, int);
static void udp_conn_destructor(void *, void *);
static int rawip_conn_constructor(void *, void *, int);
static void rawip_conn_destructor(void *, void *);
static int rts_conn_constructor(void *, void *, int);
static void rts_conn_destructor(void *, void *);
#ifdef IPCL_DEBUG
#define INET_NTOA_BUFSIZE 18
static char *
{
unsigned char *p;
p = (unsigned char *)∈
return (b);
}
#endif
/*
* Global (for all stack instances) init routine
*/
void
ipcl_g_init(void)
{
sizeof (conn_t), CACHE_ALIGN_SIZE,
}
/*
* ipclassifier intialization routine, sets up hash tables.
*/
void
{
int i;
/*
*/
if (ipcl_conn_hash_size != 0) {
} else if (tcp_conn_hash_size != 0) {
} else {
}
}
break;
}
}
/* Out of range, use the 2^16 value */
}
for (i = 0; i < ipst->ips_ipcl_conn_fanout_size; i++) {
}
for (i = 0; i < ipst->ips_ipcl_bind_fanout_size; i++) {
}
for (i = 0; i < IPPROTO_MAX; i++) {
}
for (i = 0; i < IPPROTO_MAX; i++) {
}
for (i = 0; i < ipst->ips_ipcl_udp_fanout_size; i++) {
}
for (i = 0; i < ipst->ips_ipcl_raw_fanout_size; i++) {
}
for (i = 0; i < CONN_G_HASH_SIZE; i++) {
}
}
void
ipcl_g_destroy(void)
{
}
/*
* All user-level and kernel use of the stack must be gone
* by now.
*/
void
{
int i;
for (i = 0; i < ipst->ips_ipcl_conn_fanout_size; i++) {
}
sizeof (connf_t));
for (i = 0; i < ipst->ips_ipcl_bind_fanout_size; i++) {
}
sizeof (connf_t));
for (i = 0; i < IPPROTO_MAX; i++) {
}
for (i = 0; i < IPPROTO_MAX; i++) {
}
IPPROTO_MAX * sizeof (connf_t));
for (i = 0; i < ipst->ips_ipcl_udp_fanout_size; i++) {
}
sizeof (connf_t));
for (i = 0; i < ipst->ips_ipcl_raw_fanout_size; i++) {
}
sizeof (connf_t));
for (i = 0; i < CONN_G_HASH_SIZE; i++) {
}
sizeof (connf_t) * CONN_G_HASH_SIZE);
}
/*
* conn creation routine. initialize the conn, sets the reference
* and inserts it in the global hash table.
*/
conn_t *
{
struct kmem_cache *conn_cache;
switch (type) {
case IPCL_SCTPCONN:
return (NULL);
return (connp);
case IPCL_TCPCONN:
break;
case IPCL_UDPCONN:
break;
case IPCL_RAWIPCONN:
break;
case IPCL_RTSCONN:
break;
case IPCL_IPCCONN:
break;
default:
ASSERT(0);
}
return (NULL);
return (connp);
}
void
{
}
/* FIXME: add separate tcp_conn_free()? */
}
}
}
tcp->tcp_sack_info);
}
if (tcp->tcp_hdr_grown) {
} else {
}
tcp->tcp_iphc_len = 0;
}
}
return;
}
}
}
}
return;
}
}
/* leave conn_priv aka conn_udp, conn_icmp, etc in place. */
} else {
}
}
/*
* Running in cluster mode - deregister listener information
*/
static void
{
if (cl_inet_unlisten != NULL) {
if (connp->conn_pkt_isv6) {
} else {
}
connp->conn_lport);
}
}
/*
* We set the IPCL_REMOVED flag (instead of clearing the flag indicating
* which table the conn belonged to). So for debugging we can see which hash
* table this connection was in.
*/
#define IPCL_HASH_REMOVE(connp) { \
(void *)(connp))); \
else \
ipcl_conn_unlisten((connp)); \
CONN_DEC_REF((connp)); \
} \
}
void
{
}
/*
* The whole purpose of this function is allow removal of
* a conn_t from the connected hash for timewait reclaim.
* This is essentially a TW reclaim fastpath where timewait
* collector checks under fanout lock (so no one else can
* get access to the conn_t) that refcnt is 2 i.e. one for
* TCP and one for the classifier hash list. If ref count
* is indeed 2, we can just remove the conn under lock and
* avoid cleaning up the conn under squeue. This gives us
* improved performance.
*/
void
{
}
} else {
}
}
} \
CONN_INC_REF(connp); \
}
IPCL_HASH_REMOVE((connp)); \
}
IPCL_HASH_REMOVE((connp)); \
} \
} else { \
} \
} \
IPCL_BOUND; \
CONN_INC_REF(connp); \
}
boolean_t isv4mapped = \
IPCL_HASH_REMOVE((connp)); \
if (isv4mapped && \
break; \
} \
} \
IPCL_BOUND; \
CONN_INC_REF((connp)); \
}
void
{
}
void
{
protocol == IPPROTO_ESP);
/* Insert it in the protocol hash */
}
void
{
protocol == IPPROTO_ESP);
/* Insert it in the Bind Hash */
}
/*
* This function is used only for inserting SCTP raw socket now.
* This may change later.
*
* Note that only one raw socket can be bound to a port. The param
* lport is in network byte order.
*/
static int
{
/* Check for existing raw socket already bound to the port. */
&connp->conn_srcv6))) {
break;
}
}
return (EADDRNOTAVAIL);
} else {
}
} else {
}
return (0);
}
/*
* Check for a MAC exemption conflict on a labeled system. Note that for
* protocols that use port numbers (UDP, TCP, SCTP), we do this check up in the
* transport layer. This check is for binding all other protocols.
*
* Returns true if there's a conflict.
*/
static boolean_t
{
/* We don't allow v4 fallback for v6 raw socket */
continue;
/* If neither is exempt, then there's no conflict */
continue;
/* If both are bound to different specific addrs, ok */
continue;
/* These two conflict; fail */
break;
}
}
static boolean_t
{
/* We don't allow v4 fallback for v6 raw socket */
continue;
/* If neither is exempt, then there's no conflict */
continue;
/* If both are bound to different addrs, ok */
continue;
/* These two conflict; fail */
break;
}
}
/*
* (v4, v6) bind hash insertion routines
*/
int
{
#ifdef IPCL_DEBUG
char buf[INET_NTOA_BUFSIZE];
#endif
int ret = 0;
switch (protocol) {
default:
if (is_system_labeled() &&
return (EADDRINUSE);
/* FALLTHROUGH */
case IPPROTO_UDP:
if (protocol == IPPROTO_UDP) {
IPCL_DEBUG_LVL(64,
("ipcl_bind_insert: connp %p - udp\n",
(void *)connp));
} else {
IPCL_DEBUG_LVL(64,
("ipcl_bind_insert: connp %p - protocol\n",
(void *)connp));
}
} else {
}
break;
case IPPROTO_TCP:
/* Insert it in the Bind Hash */
} else {
}
if (cl_inet_listen != NULL) {
}
break;
case IPPROTO_SCTP:
break;
}
return (ret);
}
int
{
int ret = 0;
switch (protocol) {
default:
if (is_system_labeled() &&
return (EADDRINUSE);
/* FALLTHROUGH */
case IPPROTO_UDP:
if (protocol == IPPROTO_UDP) {
IPCL_DEBUG_LVL(128,
("ipcl_bind_insert_v6: connp %p - udp\n",
(void *)connp));
} else {
IPCL_DEBUG_LVL(128,
("ipcl_bind_insert_v6: connp %p - protocol\n",
(void *)connp));
}
} else {
}
break;
case IPPROTO_TCP:
/* XXX - Need a separate table for IN6_IS_ADDR_UNSPECIFIED? */
/* Insert it in the Bind Hash */
} else {
}
if (cl_inet_listen != NULL) {
if (connp->conn_pkt_isv6) {
laddrp =
} else {
}
lport);
}
break;
case IPPROTO_SCTP:
break;
}
return (ret);
}
/*
* ipcl_conn_hash insertion routines.
*/
int
{
#ifdef IPCL_DEBUG
#endif
int ret = 0;
"dst = %s, ports = %x, protocol = %x", (void *)connp,
switch (protocol) {
case IPPROTO_TCP:
/*
* for a eager connection, i.e connections which
* have just been created, the initialization is
* already done in ip at conn_creation time, so
* we can skip the checks here.
*/
}
connp->conn_ports)) {
/* Already have a conn. bail out */
return (EADDRINUSE);
}
}
/*
* rebind. Let it happen.
*/
}
break;
case IPPROTO_SCTP:
/*
* The raw socket may have already been bound, remove it
* from the hash first.
*/
break;
default:
/*
* Check for conflicts among MAC exempt bindings. For
* transports with port numbers, this is done by the upper
* level per-transport binding logic. For all others, it's
* done here.
*/
if (is_system_labeled() &&
return (EADDRINUSE);
/* FALLTHROUGH */
case IPPROTO_UDP:
if (protocol == IPPROTO_UDP) {
} else {
}
} else {
}
break;
}
return (ret);
}
int
{
int ret = 0;
switch (protocol) {
case IPPROTO_TCP:
/* Just need to insert a conn struct */
}
ipst)];
connp->conn_ports) &&
/* Already have a conn. bail out */
return (EADDRINUSE);
}
}
/*
* rebind. Let it happen.
*/
}
break;
case IPPROTO_SCTP:
break;
default:
if (is_system_labeled() &&
return (EADDRINUSE);
/* FALLTHROUGH */
case IPPROTO_UDP:
if (protocol == IPPROTO_UDP) {
} else {
}
} else {
}
break;
}
return (ret);
}
/*
* v4 packet classifying function. looks up the fanout table to
* find the conn, the packet belongs to. returns the conn with
* the reference held, null otherwise.
*
* If zoneid is ALL_ZONES, then the search rules described in the "Connection
* Lookup" comment block are applied. Labels are also checked as described
* above. If the packet is from the inside (looped back), and is from the same
* zone, then label checks are omitted.
*/
conn_t *
{
switch (protocol) {
case IPPROTO_TCP:
connfp =
break;
}
/*
* We have a fully-bound TCP connection.
*
* For labeled systems, there's no need to check the
* label here. It's known to be good as we checked
* before allowing the connection to become bound.
*/
return (connp);
}
/* Cred cannot be null on IPv4 */
if (is_system_labeled())
TSLF_UNLABELED) != 0;
if (shared_addr) {
/*
* No need to handle exclusive-stack zones since
* ALL_ZONES only applies to the shared stack.
*/
/*
* If no shared MLP is found, tsol_mlp_findzone returns
* ALL_ZONES. In that case, we assume it's SLP, and
* search for the zone based on the packet label.
*
* If there is such a zone, we prefer to find a
* connection in it. Otherwise, we look for a
* MAC-exempt connection in any zone whose label
* dominates the default label on the packet.
*/
else
}
break;
}
/*
* If the matching connection is SLP on a private address, then
* the label on the packet must match the local zone's label.
* Otherwise, it must be in the label range defined by tnrh.
* This is ensured by tsol_receive_label.
*/
shared_addr, connp)) {
char *,
"connp(1) could not receive mp(2)",
}
/* Have a listener at least */
return (connp);
}
IPCL_DEBUG_LVL(512,
("ipcl_classify: couldn't classify mp = %p\n",
(void *)mp));
break;
case IPPROTO_UDP:
/* Cred cannot be null on IPv4 */
if (is_system_labeled())
TSLF_UNLABELED) != 0;
if (shared_addr) {
/*
* No need to handle exclusive-stack zones since
* ALL_ZONES only applies to the shared stack.
*/
/*
* If no shared MLP is found, tsol_mlp_findzone returns
* ALL_ZONES. In that case, we assume it's SLP, and
* search for the zone based on the packet label.
*
* If there is such a zone, we prefer to find a
* connection in it. Otherwise, we look for a
* MAC-exempt connection in any zone whose label
* dominates the default label on the packet.
*/
else
}
break;
}
shared_addr, connp)) {
char *, "connp(1) could not receive mp(2)",
}
return (connp);
}
/*
*/
IPCL_DEBUG_LVL(512,
("ipcl_classify: cant find udp conn_t for ports : %x %x",
break;
}
return (NULL);
}
conn_t *
{
switch (protocol) {
case IPPROTO_TCP:
connfp =
break;
}
/*
* We have a fully-bound TCP connection.
*
* For labeled systems, there's no need to check the
* label here. It's known to be good as we checked
* before allowing the connection to become bound.
*/
return (connp);
}
/* Cred can be null on IPv6 */
if (is_system_labeled()) {
}
if (shared_addr) {
/*
* No need to handle exclusive-stack zones since
* ALL_ZONES only applies to the shared stack.
*/
/*
* If no shared MLP is found, tsol_mlp_findzone returns
* ALL_ZONES. In that case, we assume it's SLP, and
* search for the zone based on the packet label.
*
* If there is such a zone, we prefer to find a
* connection in it. Otherwise, we look for a
* MAC-exempt connection in any zone whose label
* dominates the default label on the packet.
*/
else
}
break;
}
shared_addr, connp)) {
char *, "connp(1) could not receive mp(2)",
}
/* Have a listner at least */
IPCL_DEBUG_LVL(512,
("ipcl_classify_v6: found listner "
"connp = %p\n", (void *)connp));
return (connp);
}
IPCL_DEBUG_LVL(512,
("ipcl_classify_v6: couldn't classify mp = %p\n",
(void *)mp));
break;
case IPPROTO_UDP:
/* Cred can be null on IPv6 */
if (is_system_labeled()) {
}
if (shared_addr) {
/*
* No need to handle exclusive-stack zones since
* ALL_ZONES only applies to the shared stack.
*/
/*
* If no shared MLP is found, tsol_mlp_findzone returns
* ALL_ZONES. In that case, we assume it's SLP, and
* search for the zone based on the packet label.
*
* If there is such a zone, we prefer to find a
* connection in it. Otherwise, we look for a
* MAC-exempt connection in any zone whose label
* dominates the default label on the packet.
*/
else
}
fport));
break;
}
shared_addr, connp)) {
char *, "connp(1) could not receive mp(2)",
}
return (connp);
}
/*
*/
IPCL_DEBUG_LVL(512,
("ipcl_classify_v6: cant find udp conn_t for ports : %x %x",
break;
}
return (NULL);
}
/*
* wrapper around ipcl_classify_(v4,v6) routines.
*/
conn_t *
{
return (NULL);
case IPV4_VERSION:
case IPV6_VERSION:
return (NULL);
}
return (NULL);
}
conn_t *
{
int af;
const void *dst;
/* Cred can be null on IPv6 */
if (is_system_labeled()) {
}
if (shared_addr) {
/*
* No need to handle exclusive-stack zones since ALL_ZONES
* only applies to the shared stack.
*/
/*
* If no shared MLP is found, tsol_mlp_findzone returns
* ALL_ZONES. In that case, we assume it's SLP, and search for
* the zone based on the packet label.
*
* If there is such a zone, we prefer to find a connection in
* it. Otherwise, we look for a MAC-exempt connection in any
* zone whose label dominates the default label on the packet.
*/
else
}
/* We don't allow v4 fallback for v6 raw socket. */
continue;
if (connp->conn_fully_bound) {
if (af == IPV4_VERSION) {
continue;
} else {
continue;
}
} else {
if (af == IPV4_VERSION) {
continue;
} else {
continue;
}
}
break;
}
/*
* If the connection is fully-bound and connection-oriented (TCP or
* SCTP), then we've already validated the remote system's label.
* There's no need to do it again for every packet.
*/
char *, "connp(1) could not receive mp(2)",
}
goto found;
/* Try to look for a wildcard match. */
/* We don't allow v4 fallback for v6 raw socket. */
continue;
}
if (af == IPV4_VERSION) {
break;
} else {
break;
}
}
}
goto found;
return (NULL);
return (connp);
}
/* ARGSUSED */
static int
{
return (0);
}
/* ARGSUSED */
static void
{
}
/* ARGSUSED */
static int
{
return (0);
}
/* ARGSUSED */
static void
{
}
/* ARGSUSED */
static int
{
return (0);
}
/* ARGSUSED */
static void
{
}
/* ARGSUSED */
static int
{
return (0);
}
/* ARGSUSED */
static void
{
}
/* ARGSUSED */
static int
{
return (0);
}
/* ARGSUSED */
static void
{
}
/*
* Called as part of ipcl_conn_destroy to assert and clear any pointers
* in the conn_t.
*
* Below we list all the pointers in the conn_t as a documentation aid.
* The ones that we can not ASSERT to be NULL are #ifdef'ed out.
* If you add any pointers to the conn_t please add an ASSERT here
* and #ifdef it out if it can't be actually asserted to be NULL.
* In any case, we bzero most of the conn_t at the end of the function.
*/
void
{
#ifdef notdef
/* These are not cleared */
#endif
#ifdef notdef
/*
* The ill and ipif pointers are not cleared before the conn_t
* make the code less complex.
*/
#endif
#ifdef notdef
/* conn_idl is not cleared when removed from idl list */
#endif
/* Clear out the conn_t fields that are not preserved */
sizeof (conn_t) -
}
/*
* All conns are inserted in a global multi-list for the benefit of
* walkers. The walk is guaranteed to walk all open conns at the time
* of the start of the walk exactly once. This property is needed to
* achieve some cleanups during unplumb of interfaces. This is achieved
* as follows.
*
* ipcl_conn_create and ipcl_conn_destroy are the only functions that
* call the insert and delete functions below at creation and deletion
* time respectively. The conn never moves or changes its position in this
* multi-list during its lifetime. CONN_CONDEMNED ensures that the refcnt
* won't increase due to walkers, once the conn deletion has started. Note
* that we can't remove the conn from the global list and then wait for
* the refcnt to drop to zero, since walkers would then see a truncated
* list. CONN_INCIPIENT ensures that walkers don't start looking at
* conns until ip_open is ready to make them globally visible.
* The global round robin multi-list locks are held only to get the
* if the multi-list is much greater than the number of cpus.
*/
void
{
int index;
/*
* No need for atomic here. Approximate even distribution
* in the global lists is sufficient.
*/
ipst->ips_conn_g_index++;
/*
* Mark as INCIPIENT, so that walkers will ignore this
* for now, till ip_open is ready to make it visible globally.
*/
/* Insert at the head of the list */
/* The fanout bucket this conn points to */
}
void
{
/*
* We were never inserted in the global multi list.
* IPCL_NONE variety is never inserted in the global multilist
* since it is presumed to not need any cleanup and is transient.
*/
return;
else
/* Better to stumble on a null pointer than to corrupt memory */
}
/*
* Walk the list of all conn_t's in the system, calling the function provided
* with the specified argument for each.
* Applies to both IPv4 and IPv6.
*
* ipcl_walk() is called to cleanup the conn_t's, typically when an interface is
* unplumbed or removed. New conn_t's that are created while we are walking
* may be missed by this walk, because they are not necessarily inserted
* at the tail of the list. They are new conn_t's and thus don't have any
* stale pointers. The CONN_CLOSING flag ensures that no new reference
* is created to the struct that is going away.
*/
void
{
int i;
for (i = 0; i < CONN_G_HASH_SIZE; i++) {
prev_connp = NULL;
if (connp->conn_state_flags &
(CONN_CONDEMNED | CONN_INCIPIENT)) {
continue;
}
if (prev_connp != NULL)
prev_connp = connp;
}
if (prev_connp != NULL)
}
}
/*
* the {src, dst, lport, fport} quadruplet. Returns with conn reference
* held; caller must call CONN_DEC_REF. Only checks for connected entries
* (peer tcp in ESTABLISHED state).
*/
conn_t *
{
/*
* If either the source of destination address is loopback, then
* both endpoints must be in the same Zone. Otherwise, both of
* the addresses are system-wide unique (tcp is in ESTABLISHED
* state) and the endpoints may reside in different Zones.
*/
return (tconnp);
}
}
return (NULL);
}
/*
* the {src, dst, lport, fport} quadruplet. Returns with conn reference
* held; caller must call CONN_DEC_REF. Only checks for connected entries
* (peer tcp in ESTABLISHED state).
*/
conn_t *
{
/*
* If either the source of destination address is loopback, then
* both endpoints must be in the same Zone. Otherwise, both of
* the addresses are system-wide unique (tcp is in ESTABLISHED
* state) and the endpoints may reside in different Zones. We
* don't do Zone check for link local address(es) because the
* current Zone implementation treats each link local address as
* being unique per system node, i.e. they belong to global Zone.
*/
/* We skip tcp_bound_if check here as this is loopback tcp */
return (tconnp);
}
}
return (NULL);
}
/*
* Find an exact {src, dst, lport, fport} match for a bounced datagram.
* Returns with conn reference held. Caller must call CONN_DEC_REF.
* Only checks for connected entries i.e. no INADDR_ANY checks.
*/
conn_t *
{
return (tconnp);
}
}
return (NULL);
}
/*
* Find an exact {src, dst, lport, fport} match for a bounced datagram.
* Returns with conn reference held. Caller must call CONN_DEC_REF.
* Only checks for connected entries i.e. no INADDR_ANY checks.
* Match on ifindex in addition to addresses.
*/
conn_t *
{
(tcp->tcp_bound_if == 0 ||
return (tconnp);
}
}
return (NULL);
}
/*
* a listener when changing state.
*/
conn_t *
{
/*
* Avoid false matches for packets sent to an IP destination of
* all zeros.
*/
if (laddr == 0)
return (NULL);
return (connp);
}
}
return (NULL);
}
/*
* a listener when changing state.
*/
conn_t *
{
/*
* Avoid false matches for packets sent to an IP destination of
* all zeros.
*/
if (IN6_IS_ADDR_UNSPECIFIED(laddr))
return (NULL);
(tcp->tcp_bound_if == 0 ||
return (connp);
}
}
return (NULL);
}
/*
* ipcl_get_next_conn
* get the next entry in the conn global list
* and put a reference on the next_conn.
* decrement the reference on the current conn.
*
* This is an iterator based walker function that also provides for
* some selection by the caller. It walks through the conn_hash bucket
* searching for the next valid connp in the list, and selects connections
* that are neither closed nor condemned. It also REFHOLDS the conn
* thus ensuring that the conn exists when the caller uses the conn.
*/
conn_t *
{
return (NULL);
while (next_connp != NULL) {
(CONN_CONDEMNED | CONN_INCIPIENT))) {
/*
* This conn has been condemned or
* is closing, or the flags don't match
*/
continue;
}
break;
}
return (next_connp);
}
#ifdef CONN_DEBUG
/*
*/
int
{
int last;
last++;
if (last == CONN_TRACE_MAX)
last = 0;
return (1);
}
int
{
int last;
last++;
if (last == CONN_TRACE_MAX)
last = 0;
return (1);
}
#endif