common/inet/ipclassifier.h

	ipclassifier.h revision 5d3b8cb7141cfa596d20cdc5043b8a6df635938d
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

#ifndef _INET_IPCLASSIFIER_H
#define _INET_IPCLASSIFIER_H

#ifdef  __cplusplus
extern "C" {
#endif

#include <inet/common.h>
#include <inet/ip.h>
#include <inet/mi.h>
#include <inet/tcp.h>
#include <inet/ip6.h>
#include <netinet/in.h>     /* for IPPROTO_* constants */
#include <sys/sdt.h>
#include <sys/socket_proto.h>
#include <sys/sunddi.h>
#include <sys/sunldi.h>

typedef void (*edesc_spf)(void *, mblk_t *, void *, int);
typedef void (*edesc_rpf)(void *, mblk_t *, void *);

/*
 * ==============================
 * =    The CONNECTION      =
 * ==============================
 */

/*
 * The connection structure contains the common information/flags/ref needed.
 * Implementation will keep the connection struct, the layers (with their
 * respective data for event i.e. tcp_t if event was tcp_input) all in one
 * contiguous memory location.
 */

/* Conn Flags */
/* Unused           0x00020000 */
/* Unused           0x00040000 */
#define IPCL_FULLY_BOUND    0x00080000  /* Bound to correct squeue */
#define IPCL_CHECK_POLICY   0x00100000  /* Needs policy checking */
#define IPCL_SOCKET     0x00200000  /* Sockfs connection */
#define IPCL_ACCEPTOR       0x00400000  /* Sockfs priv acceptor */
#define IPCL_CL_LISTENER    0x00800000  /* Cluster listener */
#define IPCL_EAGER      0x01000000  /* Incoming connection */
/* Unused           0x02000000 */
#define IPCL_TCP6       0x04000000  /* AF_INET6 TCP */
#define IPCL_TCP4       0x08000000  /* IPv4 packet format TCP */
/* Unused           0x10000000 */
/* Unused           0x20000000 */
#define IPCL_CONNECTED      0x40000000  /* Conn in connected table */
#define IPCL_BOUND      0x80000000  /* Conn in bind table */

/* Flags identifying the type of conn */
#define IPCL_TCPCONN        0x00000001  /* From tcp_conn_cache */
#define IPCL_SCTPCONN       0x00000002  /* From sctp_conn_cache */
#define IPCL_IPCCONN        0x00000004  /* From ip_conn_cache */
#define IPCL_UDPCONN        0x00000008  /* From udp_conn_cache */
#define IPCL_RAWIPCONN      0x00000010  /* From rawip_conn_cache */
#define IPCL_RTSCONN        0x00000020  /* From rts_conn_cache */
/* Unused           0x00000040 */
#define IPCL_IPTUN      0x00000080  /* iptun module above us */
#define IPCL_NONSTR     0x00001000  /* A non-STREAMS socket */
#define IPCL_IN_SQUEUE      0x10000000  /* Waiting squeue to finish */

/* Conn Masks */
#define IPCL_TCP        (IPCL_TCP4|IPCL_TCP6)
#define IPCL_REMOVED        0x00000100
#define IPCL_REUSED     0x00000200

/* The packet format is IPv4; could be an AF_INET or AF_INET6 socket */
#define IPCL_IS_TCP4(connp)                     \
    (((connp)->conn_flags & IPCL_TCP4))

/* Connected AF_INET with no IPsec policy */
#define IPCL_IS_TCP4_CONNECTED_NO_POLICY(connp)             \
    (((connp)->conn_flags &                     \
        (IPCL_TCP4|IPCL_CONNECTED|IPCL_CHECK_POLICY|IPCL_TCP6)) \
        == (IPCL_TCP4|IPCL_CONNECTED))

#define IPCL_IS_CONNECTED(connp)                    \
    ((connp)->conn_flags & IPCL_CONNECTED)

#define IPCL_IS_BOUND(connp)                        \
    ((connp)->conn_flags & IPCL_BOUND)

/* AF_INET TCP that is bound */
#define IPCL_IS_TCP4_BOUND(connp)                   \
    (((connp)->conn_flags &                     \
        (IPCL_TCP4|IPCL_BOUND|IPCL_TCP6)) ==            \
        (IPCL_TCP4|IPCL_BOUND))

#define IPCL_IS_FULLY_BOUND(connp)                  \
    ((connp)->conn_flags & IPCL_FULLY_BOUND)

/*
 * Can't use conn_protocol since we need to tell difference
 * between a real TCP socket and a SOCK_RAW, IPPROTO_TCP.
 */
#define IPCL_IS_TCP(connp)                      \
    ((connp)->conn_flags & IPCL_TCPCONN)

#define IPCL_IS_SCTP(connp)                     \
    ((connp)->conn_flags & IPCL_SCTPCONN)

#define IPCL_IS_UDP(connp)                      \
    ((connp)->conn_flags & IPCL_UDPCONN)

#define IPCL_IS_RAWIP(connp)                        \
    ((connp)->conn_flags & IPCL_RAWIPCONN)

#define IPCL_IS_RTS(connp)                      \
    ((connp)->conn_flags & IPCL_RTSCONN)

#define IPCL_IS_IPTUN(connp)                        \
    ((connp)->conn_flags & IPCL_IPTUN)

#define IPCL_IS_NONSTR(connp)   ((connp)->conn_flags & IPCL_NONSTR)

typedef struct connf_s connf_t;

typedef struct
{
    int ctb_depth;
#define CONN_STACK_DEPTH    15
    pc_t    ctb_stack[CONN_STACK_DEPTH];
} conn_trace_t;

typedef struct ip_helper_minor_info_s {
    dev_t   ip_minfo_dev;       /* Device */
    vmem_t  *ip_minfo_arena;    /* Arena */
} ip_helper_minfo_t;

/*
 * ip helper stream info
 */
typedef struct ip_helper_stream_info_s {
    ldi_handle_t        iphs_handle;
    queue_t         *iphs_rq;
    queue_t         *iphs_wq;
    ip_helper_minfo_t   *iphs_minfo;
} ip_helper_stream_info_t;

/*
 * Mandatory Access Control mode, in conn_t's conn_mac_mode field.
 *  CONN_MAC_DEFAULT: strict enforcement of MAC.
 *  CONN_MAC_AWARE:   allows communications between unlabeled systems
 *            and privileged daemons
 *  CONN_MAC_IMPLICIT: allows communications without explicit labels
 *                 on the wire with privileged daemons.
 *
 * CONN_MAC_IMPLICIT is intended specifically for labeled IPsec key management
 * in networks which don't pass CIPSO-labeled packets.
 */
#define CONN_MAC_DEFAULT 0
#define CONN_MAC_AWARE 1
#define CONN_MAC_IMPLICIT 2

/*
 * The initial fields in the conn_t are setup by the kmem_cache constructor,
 * and are preserved when it is freed. Fields after that are bzero'ed when
 * the conn_t is freed.
 */
struct conn_s {
    kmutex_t    conn_lock;
    uint32_t    conn_ref;       /* Reference counter */
    uint32_t    conn_flags;     /* Conn Flags */


    union {
        tcp_t       *cp_tcp;    /* Pointer to the tcp struct */
        struct udp_s    *cp_udp;    /* Pointer to the udp struct */
        struct icmp_s   *cp_icmp;   /* Pointer to rawip struct */
        struct rts_s    *cp_rts;    /* Pointer to rts struct */
        struct iptun_s  *cp_iptun;  /* Pointer to iptun_t */
        void        *cp_priv;
    } conn_proto_priv;
#define conn_tcp    conn_proto_priv.cp_tcp
#define conn_udp    conn_proto_priv.cp_udp
#define conn_icmp   conn_proto_priv.cp_icmp
#define conn_rts    conn_proto_priv.cp_rts
#define conn_iptun  conn_proto_priv.cp_iptun
#define conn_priv   conn_proto_priv.cp_priv

    kcondvar_t  conn_cv;
    uint8_t     conn_ulp;       /* protocol type */

    edesc_rpf   conn_recv;      /* Pointer to recv routine */

    /* Fields after this are bzero'ed when the conn_t is freed. */

    squeue_t    *conn_sqp;      /* Squeue for processing */
    uint_t      conn_state_flags;   /* IP state flags */
#define conn_start_clr  conn_state_flags

    ire_t       *conn_ire_cache;    /* outbound ire cache */
    unsigned int
        conn_on_sqp : 1,        /* Conn is being processed */
        conn_dontroute : 1,     /* SO_DONTROUTE state */
        conn_loopback : 1,      /* SO_LOOPBACK state */
        conn_broadcast : 1,     /* SO_BROADCAST state */

        conn_reuseaddr : 1,     /* SO_REUSEADDR state */
        conn_multicast_loop : 1,    /* IP_MULTICAST_LOOP */
        conn_multi_router : 1,      /* Wants all multicast pkts */
        conn_draining : 1,      /* ip_wsrv running */

        conn_did_putbq : 1,     /* ip_wput did a putbq */
        conn_unspec_src : 1,        /* IP_UNSPEC_SRC */
        conn_policy_cached : 1,     /* Is policy cached/latched ? */
        conn_in_enforce_policy : 1, /* Enforce Policy on inbound */

        conn_out_enforce_policy : 1,    /* Enforce Policy on outbound */
        conn_af_isv6 : 1,       /* ip address family ver 6 */
        conn_pkt_isv6 : 1,      /* ip packet format ver 6 */
        conn_ip_recvpktinfo : 1,    /* IPV*_RECVPKTINFO option */

        conn_ipv6_recvhoplimit : 1, /* IPV6_RECVHOPLIMIT option */
        conn_ipv6_recvhopopts : 1,  /* IPV6_RECVHOPOPTS option */
        conn_ipv6_recvdstopts : 1,  /* IPV6_RECVDSTOPTS option */
        conn_ipv6_recvrthdr : 1,    /* IPV6_RECVRTHDR option */

        conn_ipv6_recvrtdstopts : 1,    /* IPV6_RECVRTHDRDSTOPTS */
        conn_ipv6_v6only : 1,       /* IPV6_V6ONLY */
        conn_ipv6_recvtclass : 1,   /* IPV6_RECVTCLASS */
        conn_ipv6_recvpathmtu : 1,  /* IPV6_RECVPATHMTU */

        conn_pathmtu_valid : 1,     /* The cached mtu is valid. */
        conn_ipv6_dontfrag : 1,     /* IPV6_DONTFRAG */
        conn_fully_bound : 1,       /* Fully bound connection */
        conn_recvif : 1,        /* IP_RECVIF option */

        conn_recvslla : 1,      /* IP_RECVSLLA option */
        conn_mdt_ok : 1,        /* MDT is permitted */
        conn_nexthop_set : 1,
        conn_allzones : 1;      /* SO_ALLZONES */

    unsigned int
        conn_lso_ok : 1;        /* LSO is usable */
    boolean_t conn_direct_blocked;      /* conn is flow-controlled */

    squeue_t    *conn_initial_sqp;  /* Squeue at open time */
    squeue_t    *conn_final_sqp;    /* Squeue after connect */
    ill_t       *conn_dhcpinit_ill; /* IP_DHCPINIT_IF */
    ipsec_latch_t   *conn_latch;        /* latched state */
    ill_t       *conn_outgoing_ill; /* IP{,V6}_BOUND_IF */
    edesc_spf   conn_send;      /* Pointer to send routine */
    queue_t     *conn_rq;       /* Read queue */
    queue_t     *conn_wq;       /* Write queue */
    dev_t       conn_dev;       /* Minor number */
    vmem_t      *conn_minor_arena;  /* Minor arena */
    ip_helper_stream_info_t *conn_helper_info;

    cred_t      *conn_cred;     /* Credentials */
    connf_t     *conn_g_fanout;     /* Global Hash bucket head */
    struct conn_s   *conn_g_next;       /* Global Hash chain next */
    struct conn_s   *conn_g_prev;       /* Global Hash chain prev */
    struct ipsec_policy_head_s *conn_policy; /* Configured policy */
    in6_addr_t  conn_bound_source_v6;
#define conn_bound_source   V4_PART_OF_V6(conn_bound_source_v6)

    connf_t     *conn_fanout;       /* Hash bucket we're part of */
    struct conn_s   *conn_next;     /* Hash chain next */
    struct conn_s   *conn_prev;     /* Hash chain prev */
    struct {
        in6_addr_t connua_laddr;    /* Local address */
        in6_addr_t connua_faddr;    /* Remote address */
    } connua_v6addr;
#define conn_src    V4_PART_OF_V6(connua_v6addr.connua_laddr)
#define conn_rem    V4_PART_OF_V6(connua_v6addr.connua_faddr)
#define conn_srcv6  connua_v6addr.connua_laddr
#define conn_remv6  connua_v6addr.connua_faddr
    union {
        /* Used for classifier match performance */
        uint32_t        conn_ports2;
        struct {
            in_port_t   tcpu_fport; /* Remote port */
            in_port_t   tcpu_lport; /* Local port */
        } tcpu_ports;
    } u_port;
#define conn_fport  u_port.tcpu_ports.tcpu_fport
#define conn_lport  u_port.tcpu_ports.tcpu_lport
#define conn_ports  u_port.conn_ports2
#define conn_upq    conn_rq
    uint8_t     conn_unused_byte;

    uint_t      conn_proto;     /* SO_PROTOTYPE state */
    ill_t       *conn_incoming_ill; /* IP{,V6}_BOUND_IF */
    ill_t       *conn_oper_pending_ill; /* pending shared ioctl */

    ilg_t   *conn_ilg;      /* Group memberships */
    int conn_ilg_allocated; /* Number allocated */
    int conn_ilg_inuse;     /* Number currently used */
    int conn_ilg_walker_cnt;    /* No of ilg walkers */
    /* XXXX get rid of this, once ilg_delete_all is fixed */
    kcondvar_t  conn_refcv;

    struct ipif_s   *conn_multicast_ipif;   /* IP_MULTICAST_IF */
    ill_t       *conn_multicast_ill;    /* IPV6_MULTICAST_IF */
    struct  conn_s  *conn_drain_next;   /* Next conn in drain list */
    struct  conn_s  *conn_drain_prev;   /* Prev conn in drain list */
    idl_t       *conn_idl;      /* Ptr to the drain list head */
    mblk_t      *conn_ipsec_opt_mp; /* ipsec option mblk */
    uint32_t    conn_src_preferences;   /* prefs for src addr select */
    /* mtuinfo from IPV6_PACKET_TOO_BIG conditional on conn_pathmtu_valid */
    struct ip6_mtuinfo mtuinfo;
    zoneid_t    conn_zoneid;        /* zone connection is in */
    in6_addr_t  conn_nexthop_v6;    /* nexthop IP address */
    uchar_t     conn_broadcast_ttl;     /* IP_BROADCAST_TTL */
#define conn_nexthop_v4 V4_PART_OF_V6(conn_nexthop_v6)
    cred_t      *conn_effective_cred;   /* Effective TX credentials */
    int     conn_rtaware;       /* RT_AWARE sockopt value */
    kcondvar_t  conn_sq_cv;     /* For non-STREAMS socket IO */
    kthread_t   *conn_sq_caller;    /* Caller of squeue sync ops */
    sock_upcalls_t  *conn_upcalls;      /* Upcalls to sockfs */
    sock_upper_handle_t conn_upper_handle;  /* Upper handle: sonode * */

    unsigned int
        conn_ulp_labeled : 1,       /* ULP label is synced */
        conn_mlp_type : 2,      /* mlp_type_t; tsol/tndb.h */
        conn_anon_mlp : 1,      /* user wants anon MLP */

        conn_anon_port : 1,     /* user bound anonymously */
        conn_mac_mode : 2,      /* normal/loose/implicit MAC */
        conn_spare : 26;

    boolean_t   conn_flow_cntrld;
    netstack_t  *conn_netstack; /* Corresponds to a netstack_hold */
#ifdef CONN_DEBUG
#define CONN_TRACE_MAX  10
    int     conn_trace_last;    /* ndx of last used tracebuf */
    conn_trace_t    conn_trace_buf[CONN_TRACE_MAX];
#endif
};

/*
 * These two macros are used by TX. First priority is SCM_UCRED having
 * set the label in the mblk. Second priority is the open credentials with
 * peer's label (aka conn_effective_cred). Last priority is the open
 * credentials. BEST_CRED takes all three into account in the above order.
 * CONN_CRED is for connection-oriented cases when we don't need to look
 * at the mblk.
 */
#define CONN_CRED(connp) ((connp)->conn_effective_cred == NULL ? \
    (connp)->conn_cred : (connp)->conn_effective_cred)
#define BEST_CRED(mp, connp, pidp) ip_best_cred(mp, connp, pidp)

/*
 * connf_t - connection fanout data.
 *
 * The hash tables and their linkage (conn_t.{hashnextp, hashprevp} are
 * protected by the per-bucket lock. Each conn_t inserted in the list
 * points back at the connf_t that heads the bucket.
 */
struct connf_s {
    struct conn_s   *connf_head;
    kmutex_t    connf_lock;
};

#define CONN_INC_REF(connp) {               \
    mutex_enter(&(connp)->conn_lock);           \
    DTRACE_PROBE1(conn__inc__ref, conn_t *, connp);     \
    ASSERT(conn_trace_ref(connp));              \
    (connp)->conn_ref++;                    \
    ASSERT((connp)->conn_ref != 0);             \
    mutex_exit(&(connp)->conn_lock);            \
}

#define CONN_INC_REF_LOCKED(connp)  {           \
    DTRACE_PROBE1(conn__inc__ref, conn_t *, connp);     \
    ASSERT(MUTEX_HELD(&(connp)->conn_lock));        \
    ASSERT(conn_trace_ref(connp));              \
    (connp)->conn_ref++;                    \
    ASSERT((connp)->conn_ref != 0);             \
}

#define CONN_DEC_REF(connp) {                   \
    mutex_enter(&(connp)->conn_lock);               \
    DTRACE_PROBE1(conn__dec__ref, conn_t *, connp);         \
    /*                              \
     * The squeue framework always does a CONN_DEC_REF after return \
     * from TCP. Hence the refcnt must be at least 2 if conn_on_sqp \
     * is B_TRUE and conn_ref is being decremented. This is to  \
     * account for the mblk being currently processed.      \
     */                             \
    if ((connp)->conn_ref == 0 ||                   \
        ((connp)->conn_ref == 1 && (connp)->conn_on_sqp))       \
        cmn_err(CE_PANIC, "CONN_DEC_REF: connp(%p) has ref "    \
            "= %d\n", (void *)(connp), (connp)->conn_ref);  \
    ASSERT(conn_untrace_ref(connp));                \
    (connp)->conn_ref--;                        \
    if ((connp)->conn_ref == 0) {                   \
        /* Refcnt can't increase again, safe to drop lock */    \
        mutex_exit(&(connp)->conn_lock);            \
        ipcl_conn_destroy(connp);               \
    } else {                            \
        cv_broadcast(&(connp)->conn_cv);            \
        mutex_exit(&(connp)->conn_lock);            \
    }                               \
}

/*
 * For use with subsystems within ip which use ALL_ZONES as a wildcard
 */
#define IPCL_ZONEID(connp)                      \
    ((connp)->conn_allzones ? ALL_ZONES : (connp)->conn_zoneid)

/*
 * For matching between a conn_t and a zoneid.
 */
#define IPCL_ZONE_MATCH(connp, zoneid)                  \
    (((connp)->conn_allzones) ||                    \
        ((zoneid) == ALL_ZONES) ||                  \
        (connp)->conn_zoneid == (zoneid))

/*
 * On a labeled system, we must treat bindings to ports
 * on shared IP addresses by sockets with MAC exemption
 * privilege as being in all zones, as there's
 * otherwise no way to identify the right receiver.
 */

#define IPCL_CONNS_MAC(conn1, conn2)                    \
    (((conn1)->conn_mac_mode != CONN_MAC_DEFAULT) ||        \
    ((conn2)->conn_mac_mode != CONN_MAC_DEFAULT))

#define IPCL_BIND_ZONE_MATCH(conn1, conn2)              \
    (IPCL_CONNS_MAC(conn1, conn2) ||                \
    IPCL_ZONE_MATCH(conn1, conn2->conn_zoneid) ||           \
    IPCL_ZONE_MATCH(conn2, conn1->conn_zoneid))


#define _IPCL_V4_MATCH(v6addr, v4addr)  \
    (V4_PART_OF_V6((v6addr)) == (v4addr) && IN6_IS_ADDR_V4MAPPED(&(v6addr)))

#define _IPCL_V4_MATCH_ANY(addr)    \
    (IN6_IS_ADDR_V4MAPPED_ANY(&(addr)) || IN6_IS_ADDR_UNSPECIFIED(&(addr)))


/*
 * IPCL_PROTO_MATCH() only matches conns with the specified zoneid, while
 * IPCL_PROTO_MATCH_V6() can match other conns in the multicast case, see
 * ip_fanout_proto().
 */
#define IPCL_PROTO_MATCH(connp, protocol, ipha, ill,            \
    fanout_flags, zoneid)                       \
    ((((connp)->conn_src == INADDR_ANY) ||              \
    (((connp)->conn_src == ((ipha)->ipha_dst)) &&           \
        (((connp)->conn_rem == INADDR_ANY) ||           \
    ((connp)->conn_rem == ((ipha)->ipha_src))))) &&         \
    IPCL_ZONE_MATCH(connp, zoneid) &&               \
    (conn_wantpacket((connp), (ill), (ipha), (fanout_flags),    \
        (zoneid)) || ((protocol) == IPPROTO_PIM) ||         \
        ((protocol) == IPPROTO_RSVP)))

#define IPCL_PROTO_MATCH_V6(connp, protocol, ip6h, ill,            \
    fanout_flags, zoneid)                          \
    ((IN6_IS_ADDR_UNSPECIFIED(&(connp)->conn_srcv6) ||         \
    (IN6_ARE_ADDR_EQUAL(&(connp)->conn_srcv6, &((ip6h)->ip6_dst)) &&   \
    (IN6_IS_ADDR_UNSPECIFIED(&(connp)->conn_remv6) ||          \
    IN6_ARE_ADDR_EQUAL(&(connp)->conn_remv6, &((ip6h)->ip6_src))))) && \
    (conn_wantpacket_v6((connp), (ill), (ip6h),            \
    (fanout_flags), (zoneid)) || ((protocol) == IPPROTO_RSVP)))

#define IPCL_CONN_HASH(src, ports, ipst)                \
    ((unsigned)(ntohl((src)) ^ ((ports) >> 24) ^ ((ports) >> 16) ^  \
    ((ports) >> 8) ^ (ports)) % (ipst)->ips_ipcl_conn_fanout_size)

#define IPCL_CONN_HASH_V6(src, ports, ipst)             \
    IPCL_CONN_HASH(V4_PART_OF_V6((src)), (ports), (ipst))

#define IPCL_CONN_MATCH(connp, proto, src, dst, ports)          \
    ((connp)->conn_ulp == (proto) &&                \
        (connp)->conn_ports == (ports) &&               \
        _IPCL_V4_MATCH((connp)->conn_remv6, (src)) &&       \
        _IPCL_V4_MATCH((connp)->conn_srcv6, (dst)) &&       \
        !(connp)->conn_ipv6_v6only)

#define IPCL_CONN_MATCH_V6(connp, proto, src, dst, ports)       \
    ((connp)->conn_ulp == (proto) &&                \
        (connp)->conn_ports == (ports) &&               \
        IN6_ARE_ADDR_EQUAL(&(connp)->conn_remv6, &(src)) && \
        IN6_ARE_ADDR_EQUAL(&(connp)->conn_srcv6, &(dst)))

#define IPCL_CONN_INIT(connp, protocol, src, rem, ports) {      \
    (connp)->conn_ulp = protocol;                   \
    IN6_IPADDR_TO_V4MAPPED(src, &(connp)->conn_srcv6);      \
    IN6_IPADDR_TO_V4MAPPED(rem, &(connp)->conn_remv6);      \
    (connp)->conn_ports = ports;                    \
}

#define IPCL_CONN_INIT_V6(connp, protocol, src, rem, ports) {       \
    (connp)->conn_ulp = protocol;                   \
    (connp)->conn_srcv6 = src;                  \
    (connp)->conn_remv6 = rem;                  \
    (connp)->conn_ports = ports;                    \
}

#define IPCL_PORT_HASH(port, size) \
    ((((port) >> 8) ^ (port)) & ((size) - 1))

#define IPCL_BIND_HASH(lport, ipst)                 \
    ((unsigned)(((lport) >> 8) ^ (lport)) % \
        (ipst)->ips_ipcl_bind_fanout_size)

#define IPCL_BIND_MATCH(connp, proto, laddr, lport)         \
    ((connp)->conn_ulp == (proto) &&                \
        (connp)->conn_lport == (lport) &&           \
        (_IPCL_V4_MATCH_ANY((connp)->conn_srcv6) ||     \
        _IPCL_V4_MATCH((connp)->conn_srcv6, (laddr))) &&    \
        !(connp)->conn_ipv6_v6only)

#define IPCL_BIND_MATCH_V6(connp, proto, laddr, lport)          \
    ((connp)->conn_ulp == (proto) &&                \
        (connp)->conn_lport == (lport) &&           \
        (IN6_ARE_ADDR_EQUAL(&(connp)->conn_srcv6, &(laddr)) ||  \
        IN6_IS_ADDR_UNSPECIFIED(&(connp)->conn_srcv6)))

#define IPCL_UDP_MATCH(connp, lport, laddr, fport, faddr)       \
    (((connp)->conn_lport == (lport)) &&                \
    ((_IPCL_V4_MATCH_ANY((connp)->conn_srcv6) ||            \
    (_IPCL_V4_MATCH((connp)->conn_srcv6, (laddr)) &&        \
    (_IPCL_V4_MATCH_ANY((connp)->conn_remv6) ||         \
    (_IPCL_V4_MATCH((connp)->conn_remv6, (faddr)) &&        \
    (connp)->conn_fport == (fport)))))) &&              \
    !(connp)->conn_ipv6_v6only)

#define IPCL_UDP_MATCH_V6(connp, lport, laddr, fport, faddr)    \
    (((connp)->conn_lport == (lport)) &&            \
    (IN6_IS_ADDR_UNSPECIFIED(&(connp)->conn_srcv6) ||   \
    (IN6_ARE_ADDR_EQUAL(&(connp)->conn_srcv6, &(laddr)) &&  \
    (IN6_IS_ADDR_UNSPECIFIED(&(connp)->conn_remv6) ||   \
    (IN6_ARE_ADDR_EQUAL(&(connp)->conn_remv6, &(faddr)) &&  \
    (connp)->conn_fport == (fport))))))

#define IPCL_IPTUN_HASH(laddr, faddr)                   \
    ((ntohl(laddr) ^ ((ntohl(faddr) << 24) | (ntohl(faddr) >> 8))) % \
    ipcl_iptun_fanout_size)

#define IPCL_IPTUN_HASH_V6(laddr, faddr)                \
    IPCL_IPTUN_HASH((laddr)->s6_addr32[0] ^ (laddr)->s6_addr32[1] ^ \
        (faddr)->s6_addr32[2] ^ (faddr)->s6_addr32[3],      \
        (faddr)->s6_addr32[0] ^ (faddr)->s6_addr32[1] ^     \
        (laddr)->s6_addr32[2] ^ (laddr)->s6_addr32[3])

#define IPCL_IPTUN_MATCH(connp, laddr, faddr)           \
    (_IPCL_V4_MATCH((connp)->conn_srcv6, (laddr)) &&    \
    _IPCL_V4_MATCH((connp)->conn_remv6, (faddr)))

#define IPCL_IPTUN_MATCH_V6(connp, laddr, faddr)        \
    (IN6_ARE_ADDR_EQUAL(&(connp)->conn_srcv6, (laddr)) &&   \
    IN6_ARE_ADDR_EQUAL(&(connp)->conn_remv6, (faddr)))

#define IPCL_TCP_EAGER_INIT(connp, protocol, src, rem, ports) {     \
    (connp)->conn_flags |= (IPCL_TCP4|IPCL_EAGER);          \
    IN6_IPADDR_TO_V4MAPPED(src, &(connp)->conn_srcv6);      \
    IN6_IPADDR_TO_V4MAPPED(rem, &(connp)->conn_remv6);      \
    (connp)->conn_ports = ports;                    \
    (connp)->conn_send = ip_output;                 \
    (connp)->conn_sqp = IP_SQUEUE_GET(lbolt);           \
    (connp)->conn_initial_sqp = (connp)->conn_sqp;          \
}

#define IPCL_TCP_EAGER_INIT_V6(connp, protocol, src, rem, ports) {  \
    (connp)->conn_flags |= (IPCL_TCP6|IPCL_EAGER);          \
    (connp)->conn_srcv6 = src;                  \
    (connp)->conn_remv6 = rem;                  \
    (connp)->conn_ports = ports;                    \
    (connp)->conn_send = ip_output_v6;              \
    (connp)->conn_sqp = IP_SQUEUE_GET(lbolt);           \
    (connp)->conn_initial_sqp = (connp)->conn_sqp;          \
}

#define IPCL_UDP_HASH(lport, ipst)  \
    IPCL_PORT_HASH(lport, (ipst)->ips_ipcl_udp_fanout_size)

#define CONN_G_HASH_SIZE    1024

/* Raw socket hash function. */
#define IPCL_RAW_HASH(lport, ipst)  \
    IPCL_PORT_HASH(lport, (ipst)->ips_ipcl_raw_fanout_size)

/*
 * This is similar to IPCL_BIND_MATCH except that the local port check
 * is changed to a wildcard port check.
 */
#define IPCL_RAW_MATCH(connp, proto, laddr)         \
    ((connp)->conn_ulp == (proto) &&            \
    (connp)->conn_lport == 0 &&             \
    (_IPCL_V4_MATCH_ANY((connp)->conn_srcv6) ||     \
    _IPCL_V4_MATCH((connp)->conn_srcv6, (laddr))))

#define IPCL_RAW_MATCH_V6(connp, proto, laddr)          \
    ((connp)->conn_ulp == (proto) &&            \
    (connp)->conn_lport == 0 &&             \
    (IN6_IS_ADDR_UNSPECIFIED(&(connp)->conn_srcv6) ||   \
    IN6_ARE_ADDR_EQUAL(&(connp)->conn_srcv6, &(laddr))))

/* Function prototypes */
extern void ipcl_g_init(void);
extern void ipcl_init(ip_stack_t *);
extern void ipcl_g_destroy(void);
extern void ipcl_destroy(ip_stack_t *);
extern conn_t *ipcl_conn_create(uint32_t, int, netstack_t *);
extern void ipcl_conn_destroy(conn_t *);

void ipcl_hash_insert_wildcard(connf_t *, conn_t *);
void ipcl_hash_remove(conn_t *);
void ipcl_hash_remove_locked(conn_t *connp, connf_t *connfp);

extern int  ipcl_bind_insert(conn_t *, uint8_t, ipaddr_t, uint16_t);
extern int  ipcl_bind_insert_v6(conn_t *, uint8_t, const in6_addr_t *,
            uint16_t);
extern int  ipcl_conn_insert(conn_t *, uint8_t, ipaddr_t, ipaddr_t,
            uint32_t);
extern int  ipcl_conn_insert_v6(conn_t *, uint8_t, const in6_addr_t *,
            const in6_addr_t *, uint32_t, uint_t);
extern conn_t   *ipcl_get_next_conn(connf_t *, conn_t *, uint32_t);

void ipcl_proto_insert(conn_t *, uint8_t);
void ipcl_proto_insert_v6(conn_t *, uint8_t);
conn_t *ipcl_classify_v4(mblk_t *, uint8_t, uint_t, zoneid_t, ip_stack_t *);
conn_t *ipcl_classify_v6(mblk_t *, uint8_t, uint_t, zoneid_t, ip_stack_t *);
conn_t *ipcl_classify(mblk_t *, zoneid_t, ip_stack_t *);
conn_t *ipcl_classify_raw(mblk_t *, uint8_t, zoneid_t, uint32_t, ipha_t *,
        ip_stack_t *);
conn_t *ipcl_iptun_classify_v4(ipaddr_t *, ipaddr_t *, ip_stack_t *);
conn_t *ipcl_iptun_classify_v6(in6_addr_t *, in6_addr_t *, ip_stack_t *);
void    ipcl_globalhash_insert(conn_t *);
void    ipcl_globalhash_remove(conn_t *);
void    ipcl_walk(pfv_t, void *, ip_stack_t *);
conn_t  *ipcl_tcp_lookup_reversed_ipv4(ipha_t *, tcph_t *, int, ip_stack_t *);
conn_t  *ipcl_tcp_lookup_reversed_ipv6(ip6_t *, tcpha_t *, int, uint_t,
        ip_stack_t *);
conn_t  *ipcl_lookup_listener_v4(uint16_t, ipaddr_t, zoneid_t, ip_stack_t *);
conn_t  *ipcl_lookup_listener_v6(uint16_t, in6_addr_t *, uint_t, zoneid_t,
        ip_stack_t *);
int conn_trace_ref(conn_t *);
int conn_untrace_ref(conn_t *);
void    ipcl_conn_cleanup(conn_t *);
conn_t *ipcl_conn_tcp_lookup_reversed_ipv4(conn_t *, ipha_t *, tcph_t *,
        ip_stack_t *);
conn_t *ipcl_conn_tcp_lookup_reversed_ipv6(conn_t *, ip6_t *, tcph_t *,
        ip_stack_t *);

extern int ip_create_helper_stream(conn_t *connp, ldi_ident_t li);
extern void ip_free_helper_stream(conn_t *connp);

extern int ip_get_options(conn_t *, int, int, void *, t_uscalar_t *, cred_t *);
extern int ip_set_options(conn_t *, int, int, const void *, t_uscalar_t,
    cred_t *);

#ifdef  __cplusplus
}
#endif

#endif  /* _INET_IPCLASSIFIER_H */