/*

 * CDDL HEADER START

 *

 * The contents of this file are subject to the terms of the

 * Common Development and Distribution License, Version 1.0 only

 * (the "License").  You may not use this file except in compliance

 * with the License.

 *

 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE

 * or http://www.opensolaris.org/os/licensing.

 * See the License for the specific language governing permissions

 * and limitations under the License.

 *

 * When distributing Covered Code, include this CDDL HEADER in each

 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.

 * If applicable, add the following below this CDDL HEADER, with the

 * fields enclosed by brackets "[]" replaced with your own identifying

 * information: Portions Copyright [yyyy] [name of copyright owner]

 *

 * CDDL HEADER END

 */

/*

 * Copyright 2005 Sun Microsystems, Inc.  All rights reserved.

 * Use is subject to license terms.

 */

#pragma ident	"%Z%%M%	%I%	%E% SMI"

const char ipclassifier_version[] = "@(#)ipclassifier.c	1.6	04/03/31 SMI";

/*

 * IP PACKET CLASSIFIER

 *

 * The IP packet classifier provides mapping between IP packets and persistent

 * connection state for connection-oriented protocols. It also provides

 * interface for managing connection states.

 *

 * The connection state is kept in conn_t data structure and contains, among

 * other things:

 *

 *	o local/remote address and ports

 *	o Transport protocol

 *	o squeue for the connection (for TCP only)

 *	o reference counter

 *	o Connection state

 *	o hash table linkage

 *	o interface/ire information

 *	o credentials

 *	o ipsec policy

 *	o send and receive functions.

 *	o mutex lock.

 *

 * Connections use a reference counting scheme. They are freed when the

 * reference counter drops to zero. A reference is incremented when connection

 * is placed in a list or table, when incoming packet for the connection arrives

 * and when connection is processed via squeue (squeue processing may be

 * asynchronous and the reference protects the connection from being destroyed

 * before its processing is finished).

 *

 * send and receive functions are currently used for TCP only. The send function

 * determines the IP entry point for the packet once it leaves TCP to be sent to

 * the destination address. The receive function is used by IP when the packet

 * should be passed for TCP processing. When a new connection is created these

 * are set to ip_output() and tcp_input() respectively. During the lifetime of

 * the connection the send and receive functions may change depending on the

 * changes in the connection state. For example, Once the connection is bound to

 * an addresse, the receive function for this connection is set to

 * tcp_conn_request().  This allows incoming SYNs to go directly into the

 * listener SYN processing function without going to tcp_input() first.

 *

 * Classifier uses several hash tables:

 *

 * 	ipcl_conn_fanout:	contains all TCP connections in CONNECTED state

 *	ipcl_bind_fanout:	contains all connections in BOUND state

 *	ipcl_proto_fanout:	IPv4 protocol fanout

 *	ipcl_proto_fanout_v6:	IPv6 protocol fanout

 *	ipcl_udp_fanout:	contains all UDP connections

 *	ipcl_globalhash_fanout:	contains all connections

 *

 * The ipcl_globalhash_fanout is used for any walkers (like snmp and Clustering)

 * which need to view all existing connections.

 *

 * All tables are protected by per-bucket locks. When both per-bucket lock and

 * connection lock need to be held, the per-bucket lock should be acquired

 * first, followed by the connection lock.

 *

 * All functions doing search in one of these tables increment a reference

 * counter on the connection found (if any). This reference should be dropped

 * when the caller has finished processing the connection.

 *

 *

 * INTERFACES:

 * ===========

 *

 * Connection Lookup:

 * ------------------

 *

 * conn_t *ipcl_classify_v4(mp, protocol, hdr_len, zoneid)

 * conn_t *ipcl_classify_v6(mp, protocol, hdr_len, zoneid)

 *

 * Finds connection for an incoming IPv4 or IPv6 packet. Returns NULL if

 * it can't find any associated connection. If the connection is found, its

 * reference counter is incremented.

 *

 *	mp:	mblock, containing packet header. The full header should fit

 *		into a single mblock. It should also contain at least full IP

 *		and TCP or UDP header.

 *

 *	protocol: Either IPPROTO_TCP or IPPROTO_UDP.

 *

 *	hdr_len: The size of IP header. It is used to find TCP or UDP header in

 *		 the packet.

 *

 * 	zoneid: The zone in which the returned connection must be.

 *

 *	For TCP connections, the lookup order is as follows:

 *		5-tuple {src, dst, protocol, local port, remote port}

 *			lookup in ipcl_conn_fanout table.

 *		3-tuple {dst, remote port, protocol} lookup in

 *			ipcl_bind_fanout table.

 *

 *	For UDP connections, a 5-tuple {src, dst, protocol, local port,

 *	remote port} lookup is done on ipcl_udp_fanout. Note that,

 *	these interfaces do not handle cases where a packets belongs

 *	to multiple UDP clients, which is handled in IP itself.

 *

 * conn_t	*ipcl_tcp_lookup_reversed_ipv4(ipha_t *, tcph_t *, int);

 * conn_t	*ipcl_tcp_lookup_reversed_ipv6(ip6_t *, tcpha_t *, int, uint_t);

 *

 *	Lookup routine to find a exact match for {src, dst, local port,

 *	remote port) for TCP connections in ipcl_conn_fanout. The address and

 *	ports are read from the IP and TCP header respectively.

 *

 * conn_t	*ipcl_lookup_listener_v4(lport, laddr, protocol);

 * conn_t	*ipcl_lookup_listener_v6(lport, laddr, protocol, ifindex);

 *

 * 	Lookup routine to find a listener with the tuple {lport, laddr,

 * 	protocol} in the ipcl_bind_fanout table. For IPv6, an additional

 * 	parameter interface index is also compared.

 *

 * void ipcl_walk(func, arg)

 *

 * 	Apply 'func' to every connection available. The 'func' is called as

 *	(*func)(connp, arg). The walk is non-atomic so connections may be

 *	created and destroyed during the walk. The CONN_CONDEMNED and

 *	CONN_INCIPIENT flags ensure that connections which are newly created

 *	or being destroyed are not selected by the walker.

 *

 * Table Updates

 * -------------

 *

 * int ipcl_conn_insert(connp, protocol, src, dst, ports)

 * int ipcl_conn_insert_v6(connp, protocol, src, dst, ports, ifindex)

 *

 *	Insert 'connp' in the ipcl_conn_fanout.

 *	Arguements :

 *		connp		conn_t to be inserted

 *		protocol	connection protocol

 *		src		source address

 *		dst		destination address

 *		ports		local and remote port

 *		ifindex		interface index for IPv6 connections

 *

 *	Return value :

 *		0		if connp was inserted

 *		EADDRINUSE	if the connection with the same tuple

 *				already exists.

 *

 * int ipcl_bind_insert(connp, protocol, src, lport);

 * int ipcl_bind_insert_v6(connp, protocol, src, lport);

 *

 * 	Insert 'connp' in ipcl_bind_fanout.

 * 	Arguements :

 * 		connp		conn_t to be inserted

 * 		protocol	connection protocol

 * 		src		source address connection wants

 * 				to bind to

 * 		lport		local port connection wants to

 * 				bind to

 *

 *

 * void ipcl_hash_remove(connp);

 *

 * 	Removes the 'connp' from the connection fanout table.

 *

 * Connection Creation/Destruction

 * -------------------------------

 *

 * conn_t *ipcl_conn_create(type, sleep)

 *

 * 	Creates a new conn based on the type flag, inserts it into

 * 	globalhash table.

 *

 *	type:	This flag determines the type of conn_t which needs to be

 *		created.

 *		IPCL_TCPCONN	indicates a TCP connection

 *		IPCL_IPCONN	indicates all non-TCP connections.

 *

 * void ipcl_conn_destroy(connp)

 *

 * 	Destroys the connection state, removes it from the global

 * 	connection hash table and frees its memory.

 */

#include <sys/types.h>

#include <sys/stream.h>

#include <sys/dlpi.h>

#include <sys/stropts.h>

#include <sys/sysmacros.h>

#include <sys/strsubr.h>

#include <sys/strlog.h>

#include <sys/strsun.h>

#define	_SUN_TPI_VERSION 2

#include <sys/ddi.h>

#include <sys/cmn_err.h>

#include <sys/debug.h>

#include <sys/systm.h>

#include <sys/param.h>

#include <sys/kmem.h>

#include <sys/isa_defs.h>

#include <inet/common.h>

#include <netinet/ip6.h>

#include <netinet/icmp6.h>

#include <inet/ip.h>

#include <inet/ip6.h>

#include <inet/tcp.h>

#include <inet/tcp_trace.h>

#include <inet/ip_multi.h>

#include <inet/ip_if.h>

#include <inet/ip_ire.h>

#include <inet/ip_rts.h>

#include <inet/optcom.h>

#include <inet/ip_ndp.h>

#include <inet/sctp_ip.h>

#include <sys/ethernet.h>

#include <net/if_types.h>

#include <sys/cpuvar.h>

#include <inet/mi.h>

#include <inet/ipclassifier.h>

#include <inet/ipsec_impl.h>

#ifdef DEBUG

#define	IPCL_DEBUG

#else

#undef	IPCL_DEBUG

#endif

#ifdef	IPCL_DEBUG

int	ipcl_debug_level = 0;

#define	IPCL_DEBUG_LVL(level, args)	\

	if (ipcl_debug_level  & level) { printf args; }

#else

#define	IPCL_DEBUG_LVL(level, args) {; }

#endif

connf_t	*ipcl_conn_fanout;

connf_t	*ipcl_bind_fanout;

connf_t	ipcl_proto_fanout[IPPROTO_MAX + 1];

connf_t	ipcl_proto_fanout_v6[IPPROTO_MAX + 1];

connf_t	*ipcl_udp_fanout;

/* A separate hash list for raw socket. */

connf_t *ipcl_raw_fanout;

connf_t rts_clients;

/* Old value for compatibility */

uint_t tcp_conn_hash_size = 0;

/* New value. Zero means choose automatically. */

uint_t ipcl_conn_hash_size = 0;

uint_t ipcl_conn_hash_memfactor = 8192;

uint_t ipcl_conn_hash_maxsize = 82500;

uint_t ipcl_conn_fanout_size = 0;

/* bind/udp fanout table size */

uint_t ipcl_bind_fanout_size = 512;

uint_t ipcl_udp_fanout_size = 256;

/* Raw socket fanout size.  Must be a power of 2. */

uint_t ipcl_raw_fanout_size = 256;

/*

 * Power of 2^N Primes useful for hashing for N of 0-28,

 * these primes are the nearest prime <= 2^N - 2^(N-2).

 */

#define	P2Ps() {0, 0, 0, 5, 11, 23, 47, 89, 191, 383, 761, 1531, 3067,	\

		6143, 12281, 24571, 49139, 98299, 196597, 393209,	\

		786431, 1572853, 3145721, 6291449, 12582893, 25165813,	\

		50331599, 100663291, 201326557, 0}

/*

 * wrapper structure to ensure that conn+tcpb are aligned

 * on cache lines.

 */

typedef struct itc_s {

	union {

		conn_t	itcu_conn;

		char	itcu_filler[CACHE_ALIGN(conn_s)];

	}	itc_u;

	tcp_t	itc_tcp;

} itc_t;

#define	itc_conn	itc_u.itcu_conn

struct kmem_cache  *ipcl_tcpconn_cache;

struct kmem_cache  *ipcl_tcp_cache;

struct kmem_cache  *ipcl_conn_cache;

extern struct kmem_cache  *sctp_conn_cache;

extern struct kmem_cache  *tcp_sack_info_cache;

extern struct kmem_cache  *tcp_iphc_cache;

extern void	tcp_timermp_free(tcp_t *);

extern mblk_t	*tcp_timermp_alloc(int);

static int	ipcl_tcpconn_constructor(void *, void *, int);

static void	ipcl_tcpconn_destructor(void *, void *);

static int conn_g_index;

connf_t	*ipcl_globalhash_fanout;

#ifdef	IPCL_DEBUG

#define	INET_NTOA_BUFSIZE	18

static char *

inet_ntoa_r(uint32_t in, char *b)

{

	unsigned char	*p;

	p = (unsigned char *)∈

	(void) sprintf(b, "%d.%d.%d.%d", p[0], p[1], p[2], p[3]);

	return (b);

}

#endif

/*

 * ipclassifier intialization routine, sets up hash tables and

 * conn caches.

 */

void

ipcl_init(void)

{

	int i;

	int sizes[] = P2Ps();

	ipcl_conn_cache = kmem_cache_create("ipcl_conn_cache",

	    sizeof (conn_t), CACHE_ALIGN_SIZE,

	ipcl_tcpconn_cache = kmem_cache_create("ipcl_tcpconn_cache",

	    sizeof (itc_t), CACHE_ALIGN_SIZE,

	    ipcl_tcpconn_constructor, ipcl_tcpconn_destructor,

	    NULL, NULL, NULL, 0);

	/*

	 * Calculate size of conn fanout table.

	 */

	if (ipcl_conn_hash_size != 0) {

		ipcl_conn_fanout_size = ipcl_conn_hash_size;

	} else if (tcp_conn_hash_size != 0) {

		ipcl_conn_fanout_size = tcp_conn_hash_size;

	} else {

		extern pgcnt_t freemem;

		ipcl_conn_fanout_size =

		    (freemem * PAGESIZE) / ipcl_conn_hash_memfactor;

		if (ipcl_conn_fanout_size > ipcl_conn_hash_maxsize)

			ipcl_conn_fanout_size = ipcl_conn_hash_maxsize;

	}

	for (i = 9; i < sizeof (sizes) / sizeof (*sizes) - 1; i++) {

		if (sizes[i] >= ipcl_conn_fanout_size) {

			break;

		}

	}

	if ((ipcl_conn_fanout_size = sizes[i]) == 0) {

		/* Out of range, use the 2^16 value */

		ipcl_conn_fanout_size = sizes[16];

	}

	ipcl_conn_fanout = (connf_t *)kmem_zalloc(ipcl_conn_fanout_size *

	    sizeof (*ipcl_conn_fanout), KM_SLEEP);

	for (i = 0; i < ipcl_conn_fanout_size; i++) {

		mutex_init(&ipcl_conn_fanout[i].connf_lock, NULL,

		    MUTEX_DEFAULT, NULL);

	}

	ipcl_bind_fanout = (connf_t *)kmem_zalloc(ipcl_bind_fanout_size *

	    sizeof (*ipcl_bind_fanout), KM_SLEEP);

	for (i = 0; i < ipcl_bind_fanout_size; i++) {

		mutex_init(&ipcl_bind_fanout[i].connf_lock, NULL,

		    MUTEX_DEFAULT, NULL);

	}

	for (i = 0; i < A_CNT(ipcl_proto_fanout); i++) {

		mutex_init(&ipcl_proto_fanout[i].connf_lock, NULL,

		    MUTEX_DEFAULT, NULL);

	}

	for (i = 0; i < A_CNT(ipcl_proto_fanout_v6); i++) {

		mutex_init(&ipcl_proto_fanout_v6[i].connf_lock, NULL,

		    MUTEX_DEFAULT, NULL);

	}

	mutex_init(&rts_clients.connf_lock, NULL, MUTEX_DEFAULT, NULL);

	ipcl_udp_fanout = (connf_t *)kmem_zalloc(ipcl_udp_fanout_size *

	    sizeof (*ipcl_udp_fanout), KM_SLEEP);

	for (i = 0; i < ipcl_udp_fanout_size; i++) {

		mutex_init(&ipcl_udp_fanout[i].connf_lock, NULL,

		    MUTEX_DEFAULT, NULL);

	}

	ipcl_raw_fanout = (connf_t *)kmem_zalloc(ipcl_raw_fanout_size *

	    sizeof (*ipcl_raw_fanout), KM_SLEEP);

	for (i = 0; i < ipcl_raw_fanout_size; i++) {

		mutex_init(&ipcl_raw_fanout[i].connf_lock, NULL,

		    MUTEX_DEFAULT, NULL);

	}

	ipcl_globalhash_fanout = (connf_t *)kmem_zalloc(sizeof (connf_t) *

	    CONN_G_HASH_SIZE, KM_SLEEP);

	for (i = 0; i < CONN_G_HASH_SIZE; i++) {

		mutex_init(&ipcl_globalhash_fanout[i].connf_lock, NULL,

		    MUTEX_DEFAULT, NULL);

	}

}

void

ipcl_destroy(void)

{

	int i;

	kmem_cache_destroy(ipcl_conn_cache);

	kmem_cache_destroy(ipcl_tcpconn_cache);

	for (i = 0; i < ipcl_conn_fanout_size; i++)

		mutex_destroy(&ipcl_conn_fanout[i].connf_lock);

	kmem_free(ipcl_conn_fanout, ipcl_conn_fanout_size *

	    sizeof (*ipcl_conn_fanout));

	for (i = 0; i < ipcl_bind_fanout_size; i++)

		mutex_destroy(&ipcl_bind_fanout[i].connf_lock);

	kmem_free(ipcl_bind_fanout, ipcl_bind_fanout_size *

	    sizeof (*ipcl_bind_fanout));

	for (i = 0; i < A_CNT(ipcl_proto_fanout); i++)

		mutex_destroy(&ipcl_proto_fanout[i].connf_lock);

	for (i = 0; i < A_CNT(ipcl_proto_fanout_v6); i++)

		mutex_destroy(&ipcl_proto_fanout_v6[i].connf_lock);

	for (i = 0; i < ipcl_udp_fanout_size; i++)

		mutex_destroy(&ipcl_udp_fanout[i].connf_lock);

	kmem_free(ipcl_udp_fanout, ipcl_udp_fanout_size *

	    sizeof (*ipcl_udp_fanout));

	for (i = 0; i < ipcl_raw_fanout_size; i++)

		mutex_destroy(&ipcl_raw_fanout[i].connf_lock);

	kmem_free(ipcl_raw_fanout, ipcl_raw_fanout_size *

	    sizeof (*ipcl_raw_fanout));

	kmem_free(ipcl_globalhash_fanout, sizeof (connf_t) * CONN_G_HASH_SIZE);

	mutex_destroy(&rts_clients.connf_lock);

}

/*

 * conn creation routine. initialize the conn, sets the reference

 * and inserts it in the global hash table.

 */

conn_t *

ipcl_conn_create(uint32_t type, int sleep)

{

	itc_t	*itc;

	conn_t	*connp;

	switch (type) {

	case IPCL_TCPCONN:

		if ((itc = kmem_cache_alloc(ipcl_tcpconn_cache,

		    sleep)) == NULL)

			return (NULL);

		connp = &itc->itc_conn;

		connp->conn_ref = 1;

		IPCL_DEBUG_LVL(1,

		    ("ipcl_conn_create: connp = %p tcp (%p)",

		    (void *)connp, (void *)connp->conn_tcp));

		ipcl_globalhash_insert(connp);

		break;

	case IPCL_SCTPCONN:

		if ((connp = kmem_cache_alloc(sctp_conn_cache, sleep)) == NULL)

			return (NULL);

		connp->conn_flags = IPCL_SCTPCONN;

		break;

	case IPCL_IPCCONN:

		connp = kmem_cache_alloc(ipcl_conn_cache, sleep);

		if (connp == NULL)

		bzero(connp, sizeof (conn_t));

		cv_init(&connp->conn_cv, NULL, CV_DEFAULT, NULL);

		connp->conn_ref = 1;

		IPCL_DEBUG_LVL(1,

		    ("ipcl_conn_create: connp = %p\n", (void *)connp));

		ipcl_globalhash_insert(connp);

		break;

	}

	return (connp);

}

void

ipcl_conn_destroy(conn_t *connp)

{

	mblk_t	*mp;

	ASSERT(!MUTEX_HELD(&connp->conn_lock));