17c478bd9Sstevel@tonic-gate /*
27c478bd9Sstevel@tonic-gate * CDDL HEADER START
37c478bd9Sstevel@tonic-gate *
47c478bd9Sstevel@tonic-gate * The contents of this file are subject to the terms of the
5bffb04cfSmarkfen * Common Development and Distribution License (the "License").
6bffb04cfSmarkfen * You may not use this file except in compliance with the License.
77c478bd9Sstevel@tonic-gate *
87c478bd9Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
97c478bd9Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing.
107c478bd9Sstevel@tonic-gate * See the License for the specific language governing permissions
117c478bd9Sstevel@tonic-gate * and limitations under the License.
127c478bd9Sstevel@tonic-gate *
137c478bd9Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each
147c478bd9Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
157c478bd9Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the
167c478bd9Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying
177c478bd9Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner]
187c478bd9Sstevel@tonic-gate *
197c478bd9Sstevel@tonic-gate * CDDL HEADER END
207c478bd9Sstevel@tonic-gate */
217c478bd9Sstevel@tonic-gate /*
224ba231ceSKacheong Poon * Copyright 2010 Sun Microsystems, Inc. All rights reserved.
237c478bd9Sstevel@tonic-gate * Use is subject to license terms.
2469e71331SBayard Bell * Copyright (c) 2012 Nexenta Systems, Inc. All rights reserved.
2548bbca81SDaniel Hoffman * Copyright (c) 2016 by Delphix. All rights reserved.
2662063242SDan McDonald * Copyright (c) 2018, Joyent, Inc.
277c478bd9Sstevel@tonic-gate */
287c478bd9Sstevel@tonic-gate
297c478bd9Sstevel@tonic-gate /*
307c478bd9Sstevel@tonic-gate * IPsec Security Policy Database.
317c478bd9Sstevel@tonic-gate *
327c478bd9Sstevel@tonic-gate * This module maintains the SPD and provides routines used by ip and ip6
337c478bd9Sstevel@tonic-gate * to apply IPsec policy to inbound and outbound datagrams.
347c478bd9Sstevel@tonic-gate */
357c478bd9Sstevel@tonic-gate
367c478bd9Sstevel@tonic-gate #include <sys/types.h>
377c478bd9Sstevel@tonic-gate #include <sys/stream.h>
387c478bd9Sstevel@tonic-gate #include <sys/stropts.h>
397c478bd9Sstevel@tonic-gate #include <sys/sysmacros.h>
407c478bd9Sstevel@tonic-gate #include <sys/strsubr.h>
415d3b8cb7SBill Sommerfeld #include <sys/strsun.h>
427c478bd9Sstevel@tonic-gate #include <sys/strlog.h>
43bd670b35SErik Nordmark #include <sys/strsun.h>
447c478bd9Sstevel@tonic-gate #include <sys/cmn_err.h>
457c478bd9Sstevel@tonic-gate #include <sys/zone.h>
467c478bd9Sstevel@tonic-gate
477c478bd9Sstevel@tonic-gate #include <sys/systm.h>
487c478bd9Sstevel@tonic-gate #include <sys/param.h>
497c478bd9Sstevel@tonic-gate #include <sys/kmem.h>
508810c16bSdanmcd #include <sys/ddi.h>
517c478bd9Sstevel@tonic-gate
527c478bd9Sstevel@tonic-gate #include <sys/crypto/api.h>
537c478bd9Sstevel@tonic-gate
547c478bd9Sstevel@tonic-gate #include <inet/common.h>
557c478bd9Sstevel@tonic-gate #include <inet/mi.h>
567c478bd9Sstevel@tonic-gate
577c478bd9Sstevel@tonic-gate #include <netinet/ip6.h>
587c478bd9Sstevel@tonic-gate #include <netinet/icmp6.h>
597c478bd9Sstevel@tonic-gate #include <netinet/udp.h>
607c478bd9Sstevel@tonic-gate
617c478bd9Sstevel@tonic-gate #include <inet/ip.h>
627c478bd9Sstevel@tonic-gate #include <inet/ip6.h>
637c478bd9Sstevel@tonic-gate
647c478bd9Sstevel@tonic-gate #include <net/pfkeyv2.h>
657c478bd9Sstevel@tonic-gate #include <net/pfpolicy.h>
667c478bd9Sstevel@tonic-gate #include <inet/sadb.h>
677c478bd9Sstevel@tonic-gate #include <inet/ipsec_impl.h>
6832350c00Sdanmcd
6932350c00Sdanmcd #include <inet/ip_impl.h> /* For IP_MOD_ID */
7032350c00Sdanmcd
717c478bd9Sstevel@tonic-gate #include <inet/ipsecah.h>
727c478bd9Sstevel@tonic-gate #include <inet/ipsecesp.h>
737c478bd9Sstevel@tonic-gate #include <inet/ipdrop.h>
747c478bd9Sstevel@tonic-gate #include <inet/ipclassifier.h>
752b24ab6bSSebastien Roy #include <inet/iptun.h>
762b24ab6bSSebastien Roy #include <inet/iptun/iptun_impl.h>
777c478bd9Sstevel@tonic-gate
78f4b3ec61Sdh155122 static void ipsec_update_present_flags(ipsec_stack_t *);
79f4b3ec61Sdh155122 static ipsec_act_t *ipsec_act_wildcard_expand(ipsec_act_t *, uint_t *,
80f4b3ec61Sdh155122 netstack_t *);
8132350c00Sdanmcd static mblk_t *ipsec_check_ipsecin_policy(mblk_t *, ipsec_policy_t *,
82bd670b35SErik Nordmark ipha_t *, ip6_t *, uint64_t, ip_recv_attr_t *, netstack_t *);
83f4b3ec61Sdh155122 static void ipsec_action_free_table(ipsec_action_t *);
847c478bd9Sstevel@tonic-gate static void ipsec_action_reclaim(void *);
854ba231ceSKacheong Poon static void ipsec_action_reclaim_stack(ipsec_stack_t *);
86f4b3ec61Sdh155122 static void ipsid_init(netstack_t *);
87f4b3ec61Sdh155122 static void ipsid_fini(netstack_t *);
888810c16bSdanmcd
898810c16bSdanmcd /* sel_flags values for ipsec_init_inbound_sel(). */
908810c16bSdanmcd #define SEL_NONE 0x0000
918810c16bSdanmcd #define SEL_PORT_POLICY 0x0001
928810c16bSdanmcd #define SEL_IS_ICMP 0x0002
938810c16bSdanmcd #define SEL_TUNNEL_MODE 0x0004
942b24ab6bSSebastien Roy #define SEL_POST_FRAG 0x0008
958810c16bSdanmcd
968810c16bSdanmcd /* Return values for ipsec_init_inbound_sel(). */
978810c16bSdanmcd typedef enum { SELRET_NOMEM, SELRET_BADPKT, SELRET_SUCCESS, SELRET_TUNFRAG}
988810c16bSdanmcd selret_t;
998810c16bSdanmcd
1008810c16bSdanmcd static selret_t ipsec_init_inbound_sel(ipsec_selector_t *, mblk_t *,
1018810c16bSdanmcd ipha_t *, ip6_t *, uint8_t);
1028810c16bSdanmcd
103bd670b35SErik Nordmark static boolean_t ipsec_check_ipsecin_action(ip_recv_attr_t *, mblk_t *,
1047c478bd9Sstevel@tonic-gate struct ipsec_action_s *, ipha_t *ipha, ip6_t *ip6h, const char **,
105bd670b35SErik Nordmark kstat_named_t **, netstack_t *);
1067c478bd9Sstevel@tonic-gate static void ipsec_unregister_prov_update(void);
107f4b3ec61Sdh155122 static void ipsec_prov_update_callback_stack(uint32_t, void *, netstack_t *);
1086a182920Ssommerfe static boolean_t ipsec_compare_action(ipsec_policy_t *, ipsec_policy_t *);
1098810c16bSdanmcd static uint32_t selector_hash(ipsec_selector_t *, ipsec_policy_root_t *);
110f4b3ec61Sdh155122 static boolean_t ipsec_kstat_init(ipsec_stack_t *);
111f4b3ec61Sdh155122 static void ipsec_kstat_destroy(ipsec_stack_t *);
112f4b3ec61Sdh155122 static int ipsec_free_tables(ipsec_stack_t *);
1138810c16bSdanmcd static int tunnel_compare(const void *, const void *);
1148810c16bSdanmcd static void ipsec_freemsg_chain(mblk_t *);
115bd670b35SErik Nordmark static void ip_drop_packet_chain(mblk_t *, boolean_t, ill_t *,
1168810c16bSdanmcd struct kstat_named *, ipdropper_t *);
117f4b3ec61Sdh155122 static boolean_t ipsec_kstat_init(ipsec_stack_t *);
118f4b3ec61Sdh155122 static void ipsec_kstat_destroy(ipsec_stack_t *);
119f4b3ec61Sdh155122 static int ipsec_free_tables(ipsec_stack_t *);
120f4b3ec61Sdh155122 static int tunnel_compare(const void *, const void *);
121f4b3ec61Sdh155122 static void ipsec_freemsg_chain(mblk_t *);
1226a182920Ssommerfe
1236a182920Ssommerfe /*
1246a182920Ssommerfe * Selector hash table is statically sized at module load time.
1256a182920Ssommerfe * we default to 251 buckets, which is the largest prime number under 255
1266a182920Ssommerfe */
1276a182920Ssommerfe
1286a182920Ssommerfe #define IPSEC_SPDHASH_DEFAULT 251
1296a182920Ssommerfe
1308810c16bSdanmcd /* SPD hash-size tunable per tunnel. */
1318810c16bSdanmcd #define TUN_SPDHASH_DEFAULT 5
1328810c16bSdanmcd
133daa41a61Sdanmcd uint32_t ipsec_spd_hashsize;
134daa41a61Sdanmcd uint32_t tun_spd_hashsize;
1358810c16bSdanmcd
1366a182920Ssommerfe #define IPSEC_SEL_NOHASH ((uint32_t)(~0))
1377c478bd9Sstevel@tonic-gate
138f4b3ec61Sdh155122 /*
139f4b3ec61Sdh155122 * Handle global across all stack instances
140f4b3ec61Sdh155122 */
141f4b3ec61Sdh155122 static crypto_notify_handle_t prov_update_handle = NULL;
1426a182920Ssommerfe
1437c478bd9Sstevel@tonic-gate static kmem_cache_t *ipsec_action_cache;
1447c478bd9Sstevel@tonic-gate static kmem_cache_t *ipsec_sel_cache;
1457c478bd9Sstevel@tonic-gate static kmem_cache_t *ipsec_pol_cache;
1467c478bd9Sstevel@tonic-gate
1478810c16bSdanmcd /* Frag cache prototypes */
148bd670b35SErik Nordmark static void ipsec_fragcache_clean(ipsec_fragcache_t *, ipsec_stack_t *);
1498810c16bSdanmcd static ipsec_fragcache_entry_t *fragcache_delentry(int,
150bd670b35SErik Nordmark ipsec_fragcache_entry_t *, ipsec_fragcache_t *, ipsec_stack_t *);
1518810c16bSdanmcd boolean_t ipsec_fragcache_init(ipsec_fragcache_t *);
152bd670b35SErik Nordmark void ipsec_fragcache_uninit(ipsec_fragcache_t *, ipsec_stack_t *ipss);
153bd670b35SErik Nordmark mblk_t *ipsec_fragcache_add(ipsec_fragcache_t *, mblk_t *, mblk_t *,
154bd670b35SErik Nordmark int, ipsec_stack_t *);
1557c478bd9Sstevel@tonic-gate
15607b56925Ssommerfe int ipsec_hdr_pullup_needed = 0;
15707b56925Ssommerfe int ipsec_weird_null_inbound_policy = 0;
15807b56925Ssommerfe
1597c478bd9Sstevel@tonic-gate #define ALGBITS_ROUND_DOWN(x, align) (((x)/(align))*(align))
1607c478bd9Sstevel@tonic-gate #define ALGBITS_ROUND_UP(x, align) ALGBITS_ROUND_DOWN((x)+(align)-1, align)
1617c478bd9Sstevel@tonic-gate
1627c478bd9Sstevel@tonic-gate /*
1637c478bd9Sstevel@tonic-gate * Inbound traffic should have matching identities for both SA's.
1647c478bd9Sstevel@tonic-gate */
1657c478bd9Sstevel@tonic-gate
1667c478bd9Sstevel@tonic-gate #define SA_IDS_MATCH(sa1, sa2) \
1677c478bd9Sstevel@tonic-gate (((sa1) == NULL) || ((sa2) == NULL) || \
1687c478bd9Sstevel@tonic-gate (((sa1)->ipsa_src_cid == (sa2)->ipsa_src_cid) && \
1697c478bd9Sstevel@tonic-gate (((sa1)->ipsa_dst_cid == (sa2)->ipsa_dst_cid))))
1706a182920Ssommerfe
1718810c16bSdanmcd /*
1728810c16bSdanmcd * IPv6 Fragments
1738810c16bSdanmcd */
1748810c16bSdanmcd #define IS_V6_FRAGMENT(ipp) (ipp.ipp_fields & IPPF_FRAGHDR)
1756a182920Ssommerfe
1767c478bd9Sstevel@tonic-gate /*
1777c478bd9Sstevel@tonic-gate * Policy failure messages.
1787c478bd9Sstevel@tonic-gate */
1797c478bd9Sstevel@tonic-gate static char *ipsec_policy_failure_msgs[] = {
1807c478bd9Sstevel@tonic-gate
1817c478bd9Sstevel@tonic-gate /* IPSEC_POLICY_NOT_NEEDED */
1827c478bd9Sstevel@tonic-gate "%s: Dropping the datagram because the incoming packet "
1837c478bd9Sstevel@tonic-gate "is %s, but the recipient expects clear; Source %s, "
1847c478bd9Sstevel@tonic-gate "Destination %s.\n",
1857c478bd9Sstevel@tonic-gate
1867c478bd9Sstevel@tonic-gate /* IPSEC_POLICY_MISMATCH */
1877c478bd9Sstevel@tonic-gate "%s: Policy Failure for the incoming packet (%s); Source %s, "
1887c478bd9Sstevel@tonic-gate "Destination %s.\n",
1897c478bd9Sstevel@tonic-gate
1907c478bd9Sstevel@tonic-gate /* IPSEC_POLICY_AUTH_NOT_NEEDED */
1917c478bd9Sstevel@tonic-gate "%s: Authentication present while not expected in the "
1927c478bd9Sstevel@tonic-gate "incoming %s packet; Source %s, Destination %s.\n",
1937c478bd9Sstevel@tonic-gate
1947c478bd9Sstevel@tonic-gate /* IPSEC_POLICY_ENCR_NOT_NEEDED */
1957c478bd9Sstevel@tonic-gate "%s: Encryption present while not expected in the "
1967c478bd9Sstevel@tonic-gate "incoming %s packet; Source %s, Destination %s.\n",
1977c478bd9Sstevel@tonic-gate
1987c478bd9Sstevel@tonic-gate /* IPSEC_POLICY_SE_NOT_NEEDED */
1997c478bd9Sstevel@tonic-gate "%s: Self-Encapsulation present while not expected in the "
2007c478bd9Sstevel@tonic-gate "incoming %s packet; Source %s, Destination %s.\n",
2017c478bd9Sstevel@tonic-gate };
2027c478bd9Sstevel@tonic-gate
2037c478bd9Sstevel@tonic-gate /*
2047c478bd9Sstevel@tonic-gate * General overviews:
2057c478bd9Sstevel@tonic-gate *
2067c478bd9Sstevel@tonic-gate * Locking:
2077c478bd9Sstevel@tonic-gate *
2087c478bd9Sstevel@tonic-gate * All of the system policy structures are protected by a single
209f4b3ec61Sdh155122 * rwlock. These structures are threaded in a
2107c478bd9Sstevel@tonic-gate * fairly complex fashion and are not expected to change on a
2117c478bd9Sstevel@tonic-gate * regular basis, so this should not cause scaling/contention
2127c478bd9Sstevel@tonic-gate * problems. As a result, policy checks should (hopefully) be MT-hot.
2137c478bd9Sstevel@tonic-gate *
2147c478bd9Sstevel@tonic-gate * Allocation policy:
2157c478bd9Sstevel@tonic-gate *
2167c478bd9Sstevel@tonic-gate * We use custom kmem cache types for the various
2177c478bd9Sstevel@tonic-gate * bits & pieces of the policy data structures. All allocations
2187c478bd9Sstevel@tonic-gate * use KM_NOSLEEP instead of KM_SLEEP for policy allocation. The
2197c478bd9Sstevel@tonic-gate * policy table is of potentially unbounded size, so we don't
2207c478bd9Sstevel@tonic-gate * want to provide a way to hog all system memory with policy
2217c478bd9Sstevel@tonic-gate * entries..
2227c478bd9Sstevel@tonic-gate */
2237c478bd9Sstevel@tonic-gate
2248810c16bSdanmcd /* Convenient functions for freeing or dropping a b_next linked mblk chain */
2258810c16bSdanmcd
2268810c16bSdanmcd /* Free all messages in an mblk chain */
2278810c16bSdanmcd static void
ipsec_freemsg_chain(mblk_t * mp)2288810c16bSdanmcd ipsec_freemsg_chain(mblk_t *mp)
2298810c16bSdanmcd {
2308810c16bSdanmcd mblk_t *mpnext;
2318810c16bSdanmcd while (mp != NULL) {
2328810c16bSdanmcd ASSERT(mp->b_prev == NULL);
2338810c16bSdanmcd mpnext = mp->b_next;
2348810c16bSdanmcd mp->b_next = NULL;
235bd670b35SErik Nordmark freemsg(mp);
2368810c16bSdanmcd mp = mpnext;
2378810c16bSdanmcd }
2388810c16bSdanmcd }
2398810c16bSdanmcd
240bd670b35SErik Nordmark /*
241bd670b35SErik Nordmark * ip_drop all messages in an mblk chain
242bd670b35SErik Nordmark * Can handle a b_next chain of ip_recv_attr_t mblks, or just a b_next chain
243bd670b35SErik Nordmark * of data.
244bd670b35SErik Nordmark */
2458810c16bSdanmcd static void
ip_drop_packet_chain(mblk_t * mp,boolean_t inbound,ill_t * ill,struct kstat_named * counter,ipdropper_t * who_called)246bd670b35SErik Nordmark ip_drop_packet_chain(mblk_t *mp, boolean_t inbound, ill_t *ill,
247bd670b35SErik Nordmark struct kstat_named *counter, ipdropper_t *who_called)
2488810c16bSdanmcd {
2498810c16bSdanmcd mblk_t *mpnext;
2508810c16bSdanmcd while (mp != NULL) {
2518810c16bSdanmcd ASSERT(mp->b_prev == NULL);
2528810c16bSdanmcd mpnext = mp->b_next;
2538810c16bSdanmcd mp->b_next = NULL;
254bd670b35SErik Nordmark if (ip_recv_attr_is_mblk(mp))
255bd670b35SErik Nordmark mp = ip_recv_attr_free_mblk(mp);
256bd670b35SErik Nordmark ip_drop_packet(mp, inbound, ill, counter, who_called);
2578810c16bSdanmcd mp = mpnext;
2588810c16bSdanmcd }
2598810c16bSdanmcd }
2606a182920Ssommerfe
2616a182920Ssommerfe /*
2626a182920Ssommerfe * AVL tree comparison function.
2636a182920Ssommerfe * the in-kernel avl assumes unique keys for all objects.
2646a182920Ssommerfe * Since sometimes policy will duplicate rules, we may insert
2656a182920Ssommerfe * multiple rules with the same rule id, so we need a tie-breaker.
2666a182920Ssommerfe */
2676a182920Ssommerfe static int
ipsec_policy_cmpbyid(const void * a,const void * b)2686a182920Ssommerfe ipsec_policy_cmpbyid(const void *a, const void *b)
2696a182920Ssommerfe {
2706a182920Ssommerfe const ipsec_policy_t *ipa, *ipb;
2716a182920Ssommerfe uint64_t idxa, idxb;
2726a182920Ssommerfe
2736a182920Ssommerfe ipa = (const ipsec_policy_t *)a;
2746a182920Ssommerfe ipb = (const ipsec_policy_t *)b;
2756a182920Ssommerfe idxa = ipa->ipsp_index;
2766a182920Ssommerfe idxb = ipb->ipsp_index;
2776a182920Ssommerfe
2786a182920Ssommerfe if (idxa < idxb)
2796a182920Ssommerfe return (-1);
2806a182920Ssommerfe if (idxa > idxb)
2816a182920Ssommerfe return (1);
2826a182920Ssommerfe /*
2836a182920Ssommerfe * Tie-breaker #1: All installed policy rules have a non-NULL
2846a182920Ssommerfe * ipsl_sel (selector set), so an entry with a NULL ipsp_sel is not
2856a182920Ssommerfe * actually in-tree but rather a template node being used in
2866a182920Ssommerfe * an avl_find query; see ipsec_policy_delete(). This gives us
287bd670b35SErik Nordmark * a placeholder in the ordering just before the first entry with
2886a182920Ssommerfe * a key >= the one we're looking for, so we can walk forward from
2896a182920Ssommerfe * that point to get the remaining entries with the same id.
2906a182920Ssommerfe */
2916a182920Ssommerfe if ((ipa->ipsp_sel == NULL) && (ipb->ipsp_sel != NULL))
2926a182920Ssommerfe return (-1);
2936a182920Ssommerfe if ((ipb->ipsp_sel == NULL) && (ipa->ipsp_sel != NULL))
2946a182920Ssommerfe return (1);
2956a182920Ssommerfe /*
2966a182920Ssommerfe * At most one of the arguments to the comparison should have a
2976a182920Ssommerfe * NULL selector pointer; if not, the tree is broken.
2986a182920Ssommerfe */
2996a182920Ssommerfe ASSERT(ipa->ipsp_sel != NULL);
3006a182920Ssommerfe ASSERT(ipb->ipsp_sel != NULL);
3016a182920Ssommerfe /*
3026a182920Ssommerfe * Tie-breaker #2: use the virtual address of the policy node
3036a182920Ssommerfe * to arbitrarily break ties. Since we use the new tree node in
3046a182920Ssommerfe * the avl_find() in ipsec_insert_always, the new node will be
3056a182920Ssommerfe * inserted into the tree in the right place in the sequence.
3066a182920Ssommerfe */
3076a182920Ssommerfe if (ipa < ipb)
3086a182920Ssommerfe return (-1);
3096a182920Ssommerfe if (ipa > ipb)
3106a182920Ssommerfe return (1);
3116a182920Ssommerfe return (0);
3126a182920Ssommerfe }
3136a182920Ssommerfe
314f4b3ec61Sdh155122 /*
315f4b3ec61Sdh155122 * Free what ipsec_alloc_table allocated.
316f4b3ec61Sdh155122 */
3178810c16bSdanmcd void
ipsec_polhead_free_table(ipsec_policy_head_t * iph)3186a182920Ssommerfe ipsec_polhead_free_table(ipsec_policy_head_t *iph)
3196a182920Ssommerfe {
3208810c16bSdanmcd int dir;
321f4b3ec61Sdh155122 int i;
3226a182920Ssommerfe
3236a182920Ssommerfe for (dir = 0; dir < IPSEC_NTYPES; dir++) {
3246a182920Ssommerfe ipsec_policy_root_t *ipr = &iph->iph_root[dir];
3256a182920Ssommerfe
3266a182920Ssommerfe if (ipr->ipr_hash == NULL)
3276a182920Ssommerfe continue;
3286a182920Ssommerfe
329f4b3ec61Sdh155122 for (i = 0; i < ipr->ipr_nchains; i++) {
330f4b3ec61Sdh155122 ASSERT(ipr->ipr_hash[i].hash_head == NULL);
331f4b3ec61Sdh155122 }
3328810c16bSdanmcd kmem_free(ipr->ipr_hash, ipr->ipr_nchains *
3336a182920Ssommerfe sizeof (ipsec_policy_hash_t));
334f4b3ec61Sdh155122 ipr->ipr_hash = NULL;
3356a182920Ssommerfe }
3366a182920Ssommerfe }
3376a182920Ssommerfe
3388810c16bSdanmcd void
ipsec_polhead_destroy(ipsec_policy_head_t * iph)3396a182920Ssommerfe ipsec_polhead_destroy(ipsec_policy_head_t *iph)
3406a182920Ssommerfe {
3416a182920Ssommerfe int dir;
3426a182920Ssommerfe
3436a182920Ssommerfe avl_destroy(&iph->iph_rulebyid);
3446a182920Ssommerfe rw_destroy(&iph->iph_lock);
3456a182920Ssommerfe
3466a182920Ssommerfe for (dir = 0; dir < IPSEC_NTYPES; dir++) {
3476a182920Ssommerfe ipsec_policy_root_t *ipr = &iph->iph_root[dir];
3486a182920Ssommerfe int chain;
3496a182920Ssommerfe
3508810c16bSdanmcd for (chain = 0; chain < ipr->ipr_nchains; chain++)
3516a182920Ssommerfe mutex_destroy(&(ipr->ipr_hash[chain].hash_lock));
3526a182920Ssommerfe
3536a182920Ssommerfe }
3546a182920Ssommerfe ipsec_polhead_free_table(iph);
3556a182920Ssommerfe }
3566a182920Ssommerfe
3577c478bd9Sstevel@tonic-gate /*
358f4b3ec61Sdh155122 * Free the IPsec stack instance.
3597c478bd9Sstevel@tonic-gate */
360f4b3ec61Sdh155122 /* ARGSUSED */
361f4b3ec61Sdh155122 static void
ipsec_stack_fini(netstackid_t stackid,void * arg)362f4b3ec61Sdh155122 ipsec_stack_fini(netstackid_t stackid, void *arg)
3637c478bd9Sstevel@tonic-gate {
364f4b3ec61Sdh155122 ipsec_stack_t *ipss = (ipsec_stack_t *)arg;
3658810c16bSdanmcd void *cookie;
3668810c16bSdanmcd ipsec_tun_pol_t *node;
367f4b3ec61Sdh155122 netstack_t *ns = ipss->ipsec_netstack;
368f4b3ec61Sdh155122 int i;
369f4b3ec61Sdh155122 ipsec_algtype_t algtype;
3707c478bd9Sstevel@tonic-gate
371f4b3ec61Sdh155122 ipsec_loader_destroy(ipss);
3727c478bd9Sstevel@tonic-gate
373f4b3ec61Sdh155122 rw_enter(&ipss->ipsec_tunnel_policy_lock, RW_WRITER);
3748810c16bSdanmcd /*
3758810c16bSdanmcd * It's possible we can just ASSERT() the tree is empty. After all,
3768810c16bSdanmcd * we aren't called until IP is ready to unload (and presumably all
3778810c16bSdanmcd * tunnels have been unplumbed). But we'll play it safe for now, the
3788810c16bSdanmcd * loop will just exit immediately if it's empty.
3798810c16bSdanmcd */
3808810c16bSdanmcd cookie = NULL;
3818810c16bSdanmcd while ((node = (ipsec_tun_pol_t *)
382f4b3ec61Sdh155122 avl_destroy_nodes(&ipss->ipsec_tunnel_policies,
383f4b3ec61Sdh155122 &cookie)) != NULL) {
384f4b3ec61Sdh155122 ITP_REFRELE(node, ns);
3858810c16bSdanmcd }
386f4b3ec61Sdh155122 avl_destroy(&ipss->ipsec_tunnel_policies);
387f4b3ec61Sdh155122 rw_exit(&ipss->ipsec_tunnel_policy_lock);
388f4b3ec61Sdh155122 rw_destroy(&ipss->ipsec_tunnel_policy_lock);
3897c478bd9Sstevel@tonic-gate
390f4b3ec61Sdh155122 ipsec_config_flush(ns);
3917c478bd9Sstevel@tonic-gate
392f4b3ec61Sdh155122 ipsec_kstat_destroy(ipss);
3937c478bd9Sstevel@tonic-gate
394f4b3ec61Sdh155122 ip_drop_unregister(&ipss->ipsec_dropper);
3957c478bd9Sstevel@tonic-gate
396f4b3ec61Sdh155122 ip_drop_unregister(&ipss->ipsec_spd_dropper);
397f4b3ec61Sdh155122 ip_drop_destroy(ipss);
398f4b3ec61Sdh155122 /*
399f4b3ec61Sdh155122 * Globals start with ref == 1 to prevent IPPH_REFRELE() from
400f4b3ec61Sdh155122 * attempting to free them, hence they should have 1 now.
401f4b3ec61Sdh155122 */
402f4b3ec61Sdh155122 ipsec_polhead_destroy(&ipss->ipsec_system_policy);
403f4b3ec61Sdh155122 ASSERT(ipss->ipsec_system_policy.iph_refs == 1);
404f4b3ec61Sdh155122 ipsec_polhead_destroy(&ipss->ipsec_inactive_policy);
405f4b3ec61Sdh155122 ASSERT(ipss->ipsec_inactive_policy.iph_refs == 1);
4067c478bd9Sstevel@tonic-gate
407f4b3ec61Sdh155122 for (i = 0; i < IPSEC_ACTION_HASH_SIZE; i++) {
408f4b3ec61Sdh155122 ipsec_action_free_table(ipss->ipsec_action_hash[i].hash_head);
409f4b3ec61Sdh155122 ipss->ipsec_action_hash[i].hash_head = NULL;
410f4b3ec61Sdh155122 mutex_destroy(&(ipss->ipsec_action_hash[i].hash_lock));
411f4b3ec61Sdh155122 }
412f4b3ec61Sdh155122
413f4b3ec61Sdh155122 for (i = 0; i < ipss->ipsec_spd_hashsize; i++) {
414f4b3ec61Sdh155122 ASSERT(ipss->ipsec_sel_hash[i].hash_head == NULL);
415f4b3ec61Sdh155122 mutex_destroy(&(ipss->ipsec_sel_hash[i].hash_lock));
416f4b3ec61Sdh155122 }
417f4b3ec61Sdh155122
41869e71331SBayard Bell rw_enter(&ipss->ipsec_alg_lock, RW_WRITER);
419f4b3ec61Sdh155122 for (algtype = 0; algtype < IPSEC_NALGTYPES; algtype ++) {
4209b4fe9cbSDan McDonald for (i = 0; i < IPSEC_MAX_ALGS; i++) {
421f4b3ec61Sdh155122 if (ipss->ipsec_alglists[algtype][i] != NULL)
422f4b3ec61Sdh155122 ipsec_alg_unreg(algtype, i, ns);
423f4b3ec61Sdh155122 }
424f4b3ec61Sdh155122 }
42569e71331SBayard Bell rw_exit(&ipss->ipsec_alg_lock);
42669e71331SBayard Bell rw_destroy(&ipss->ipsec_alg_lock);
427f4b3ec61Sdh155122
428f4b3ec61Sdh155122 ipsid_gc(ns);
429f4b3ec61Sdh155122 ipsid_fini(ns);
430f4b3ec61Sdh155122
431f4b3ec61Sdh155122 (void) ipsec_free_tables(ipss);
432f4b3ec61Sdh155122 kmem_free(ipss, sizeof (*ipss));
433f4b3ec61Sdh155122 }
434f4b3ec61Sdh155122
435f4b3ec61Sdh155122 void
ipsec_policy_g_destroy(void)436f4b3ec61Sdh155122 ipsec_policy_g_destroy(void)
437f4b3ec61Sdh155122 {
4387c478bd9Sstevel@tonic-gate kmem_cache_destroy(ipsec_action_cache);
4397c478bd9Sstevel@tonic-gate kmem_cache_destroy(ipsec_sel_cache);
4407c478bd9Sstevel@tonic-gate kmem_cache_destroy(ipsec_pol_cache);
441f4b3ec61Sdh155122
442f4b3ec61Sdh155122 ipsec_unregister_prov_update();
443f4b3ec61Sdh155122
444f4b3ec61Sdh155122 netstack_unregister(NS_IPSEC);
4457c478bd9Sstevel@tonic-gate }
4467c478bd9Sstevel@tonic-gate
4476a182920Ssommerfe
4486a182920Ssommerfe /*
449f4b3ec61Sdh155122 * Free what ipsec_alloc_tables allocated.
4506a182920Ssommerfe * Called when table allocation fails to free the table.
4516a182920Ssommerfe */
4526a182920Ssommerfe static int
ipsec_free_tables(ipsec_stack_t * ipss)453f4b3ec61Sdh155122 ipsec_free_tables(ipsec_stack_t *ipss)
4546a182920Ssommerfe {
455f4b3ec61Sdh155122 int i;
456f4b3ec61Sdh155122
457f4b3ec61Sdh155122 if (ipss->ipsec_sel_hash != NULL) {
458f4b3ec61Sdh155122 for (i = 0; i < ipss->ipsec_spd_hashsize; i++) {
459f4b3ec61Sdh155122 ASSERT(ipss->ipsec_sel_hash[i].hash_head == NULL);
4606a182920Ssommerfe }
461f4b3ec61Sdh155122 kmem_free(ipss->ipsec_sel_hash, ipss->ipsec_spd_hashsize *
462f4b3ec61Sdh155122 sizeof (*ipss->ipsec_sel_hash));
463f4b3ec61Sdh155122 ipss->ipsec_sel_hash = NULL;
464f4b3ec61Sdh155122 ipss->ipsec_spd_hashsize = 0;
465f4b3ec61Sdh155122 }
466f4b3ec61Sdh155122 ipsec_polhead_free_table(&ipss->ipsec_system_policy);
467f4b3ec61Sdh155122 ipsec_polhead_free_table(&ipss->ipsec_inactive_policy);
4686a182920Ssommerfe
4696a182920Ssommerfe return (ENOMEM);
4706a182920Ssommerfe }
4716a182920Ssommerfe
4726a182920Ssommerfe /*
4736a182920Ssommerfe * Attempt to allocate the tables in a single policy head.
4746a182920Ssommerfe * Return nonzero on failure after cleaning up any work in progress.
4756a182920Ssommerfe */
4768810c16bSdanmcd int
ipsec_alloc_table(ipsec_policy_head_t * iph,int nchains,int kmflag,boolean_t global_cleanup,netstack_t * ns)4778810c16bSdanmcd ipsec_alloc_table(ipsec_policy_head_t *iph, int nchains, int kmflag,
478f4b3ec61Sdh155122 boolean_t global_cleanup, netstack_t *ns)
4796a182920Ssommerfe {
4808810c16bSdanmcd int dir;
4816a182920Ssommerfe
4826a182920Ssommerfe for (dir = 0; dir < IPSEC_NTYPES; dir++) {
4836a182920Ssommerfe ipsec_policy_root_t *ipr = &iph->iph_root[dir];
4846a182920Ssommerfe
4858810c16bSdanmcd ipr->ipr_nchains = nchains;
4866a182920Ssommerfe ipr->ipr_hash = kmem_zalloc(nchains *
4876a182920Ssommerfe sizeof (ipsec_policy_hash_t), kmflag);
4886a182920Ssommerfe if (ipr->ipr_hash == NULL)
489f4b3ec61Sdh155122 return (global_cleanup ?
490f4b3ec61Sdh155122 ipsec_free_tables(ns->netstack_ipsec) :
4918810c16bSdanmcd ENOMEM);
4926a182920Ssommerfe }
4936a182920Ssommerfe return (0);
4946a182920Ssommerfe }
4956a182920Ssommerfe
4966a182920Ssommerfe /*
4976a182920Ssommerfe * Attempt to allocate the various tables. Return nonzero on failure
4986a182920Ssommerfe * after cleaning up any work in progress.
4996a182920Ssommerfe */
5006a182920Ssommerfe static int
ipsec_alloc_tables(int kmflag,netstack_t * ns)501f4b3ec61Sdh155122 ipsec_alloc_tables(int kmflag, netstack_t *ns)
5026a182920Ssommerfe {
5036a182920Ssommerfe int error;
504f4b3ec61Sdh155122 ipsec_stack_t *ipss = ns->netstack_ipsec;
5056a182920Ssommerfe
506f4b3ec61Sdh155122 error = ipsec_alloc_table(&ipss->ipsec_system_policy,
507f4b3ec61Sdh155122 ipss->ipsec_spd_hashsize, kmflag, B_TRUE, ns);
5086a182920Ssommerfe if (error != 0)
5096a182920Ssommerfe return (error);
5106a182920Ssommerfe
511f4b3ec61Sdh155122 error = ipsec_alloc_table(&ipss->ipsec_inactive_policy,
512f4b3ec61Sdh155122 ipss->ipsec_spd_hashsize, kmflag, B_TRUE, ns);
5136a182920Ssommerfe if (error != 0)
5146a182920Ssommerfe return (error);
5156a182920Ssommerfe
516f4b3ec61Sdh155122 ipss->ipsec_sel_hash = kmem_zalloc(ipss->ipsec_spd_hashsize *
517f4b3ec61Sdh155122 sizeof (*ipss->ipsec_sel_hash), kmflag);
5186a182920Ssommerfe
519f4b3ec61Sdh155122 if (ipss->ipsec_sel_hash == NULL)
520f4b3ec61Sdh155122 return (ipsec_free_tables(ipss));
5216a182920Ssommerfe
5226a182920Ssommerfe return (0);
5236a182920Ssommerfe }
5246a182920Ssommerfe
5256a182920Ssommerfe /*
5266a182920Ssommerfe * After table allocation, initialize a policy head.
5276a182920Ssommerfe */
5288810c16bSdanmcd void
ipsec_polhead_init(ipsec_policy_head_t * iph,int nchains)5298810c16bSdanmcd ipsec_polhead_init(ipsec_policy_head_t *iph, int nchains)
5306a182920Ssommerfe {
5318810c16bSdanmcd int dir, chain;
5326a182920Ssommerfe
5336a182920Ssommerfe rw_init(&iph->iph_lock, NULL, RW_DEFAULT, NULL);
5346a182920Ssommerfe avl_create(&iph->iph_rulebyid, ipsec_policy_cmpbyid,
5356a182920Ssommerfe sizeof (ipsec_policy_t), offsetof(ipsec_policy_t, ipsp_byid));
5366a182920Ssommerfe
5376a182920Ssommerfe for (dir = 0; dir < IPSEC_NTYPES; dir++) {
5386a182920Ssommerfe ipsec_policy_root_t *ipr = &iph->iph_root[dir];
5396a182920Ssommerfe ipr->ipr_nchains = nchains;
5406a182920Ssommerfe
5416a182920Ssommerfe for (chain = 0; chain < nchains; chain++) {
5426a182920Ssommerfe mutex_init(&(ipr->ipr_hash[chain].hash_lock),
5436a182920Ssommerfe NULL, MUTEX_DEFAULT, NULL);
5446a182920Ssommerfe }
5456a182920Ssommerfe }
5466a182920Ssommerfe }
5476a182920Ssommerfe
548f4b3ec61Sdh155122 static boolean_t
ipsec_kstat_init(ipsec_stack_t * ipss)549f4b3ec61Sdh155122 ipsec_kstat_init(ipsec_stack_t *ipss)
5507c478bd9Sstevel@tonic-gate {
551f4b3ec61Sdh155122 ipss->ipsec_ksp = kstat_create_netstack("ip", 0, "ipsec_stat", "net",
552f4b3ec61Sdh155122 KSTAT_TYPE_NAMED, sizeof (ipsec_kstats_t) / sizeof (kstat_named_t),
553f4b3ec61Sdh155122 KSTAT_FLAG_PERSISTENT, ipss->ipsec_netstack->netstack_stackid);
554f4b3ec61Sdh155122
555f4b3ec61Sdh155122 if (ipss->ipsec_ksp == NULL || ipss->ipsec_ksp->ks_data == NULL)
556f4b3ec61Sdh155122 return (B_FALSE);
557f4b3ec61Sdh155122
558f4b3ec61Sdh155122 ipss->ipsec_kstats = ipss->ipsec_ksp->ks_data;
559f4b3ec61Sdh155122
560f4b3ec61Sdh155122 #define KI(x) kstat_named_init(&ipss->ipsec_kstats->x, #x, KSTAT_DATA_UINT64)
561f4b3ec61Sdh155122 KI(esp_stat_in_requests);
562f4b3ec61Sdh155122 KI(esp_stat_in_discards);
563f4b3ec61Sdh155122 KI(esp_stat_lookup_failure);
564f4b3ec61Sdh155122 KI(ah_stat_in_requests);
565f4b3ec61Sdh155122 KI(ah_stat_in_discards);
566f4b3ec61Sdh155122 KI(ah_stat_lookup_failure);
567f4b3ec61Sdh155122 KI(sadb_acquire_maxpackets);
568f4b3ec61Sdh155122 KI(sadb_acquire_qhiwater);
569f4b3ec61Sdh155122 #undef KI
570f4b3ec61Sdh155122
571f4b3ec61Sdh155122 kstat_install(ipss->ipsec_ksp);
572f4b3ec61Sdh155122 return (B_TRUE);
573f4b3ec61Sdh155122 }
574f4b3ec61Sdh155122
575f4b3ec61Sdh155122 static void
ipsec_kstat_destroy(ipsec_stack_t * ipss)576f4b3ec61Sdh155122 ipsec_kstat_destroy(ipsec_stack_t *ipss)
577f4b3ec61Sdh155122 {
578f4b3ec61Sdh155122 kstat_delete_netstack(ipss->ipsec_ksp,
579f4b3ec61Sdh155122 ipss->ipsec_netstack->netstack_stackid);
580f4b3ec61Sdh155122 ipss->ipsec_kstats = NULL;
581f4b3ec61Sdh155122
582f4b3ec61Sdh155122 }
583f4b3ec61Sdh155122
584f4b3ec61Sdh155122 /*
585f4b3ec61Sdh155122 * Initialize the IPsec stack instance.
586f4b3ec61Sdh155122 */
587f4b3ec61Sdh155122 /* ARGSUSED */
588f4b3ec61Sdh155122 static void *
ipsec_stack_init(netstackid_t stackid,netstack_t * ns)589f4b3ec61Sdh155122 ipsec_stack_init(netstackid_t stackid, netstack_t *ns)
590f4b3ec61Sdh155122 {
591f4b3ec61Sdh155122 ipsec_stack_t *ipss;
5927c478bd9Sstevel@tonic-gate int i;
5937c478bd9Sstevel@tonic-gate
594f4b3ec61Sdh155122 ipss = (ipsec_stack_t *)kmem_zalloc(sizeof (*ipss), KM_SLEEP);
595f4b3ec61Sdh155122 ipss->ipsec_netstack = ns;
596f4b3ec61Sdh155122
597f4b3ec61Sdh155122 /*
598f4b3ec61Sdh155122 * FIXME: netstack_ipsec is used by some of the routines we call
599f4b3ec61Sdh155122 * below, but it isn't set until this routine returns.
600f4b3ec61Sdh155122 * Either we introduce optional xxx_stack_alloc() functions
601f4b3ec61Sdh155122 * that will be called by the netstack framework before xxx_stack_init,
602f4b3ec61Sdh155122 * or we switch spd.c and sadb.c to operate on ipsec_stack_t
603f4b3ec61Sdh155122 * (latter has some include file order issues for sadb.h, but makes
604f4b3ec61Sdh155122 * sense if we merge some of the ipsec related stack_t's together.
605f4b3ec61Sdh155122 */
606f4b3ec61Sdh155122 ns->netstack_ipsec = ipss;
607f4b3ec61Sdh155122
6086a182920Ssommerfe /*
6096a182920Ssommerfe * Make two attempts to allocate policy hash tables; try it at
6106a182920Ssommerfe * the "preferred" size (may be set in /etc/system) first,
6116a182920Ssommerfe * then fall back to the default size.
6126a182920Ssommerfe */
613daa41a61Sdanmcd ipss->ipsec_spd_hashsize = (ipsec_spd_hashsize == 0) ?
614daa41a61Sdanmcd IPSEC_SPDHASH_DEFAULT : ipsec_spd_hashsize;
6156a182920Ssommerfe
616f4b3ec61Sdh155122 if (ipsec_alloc_tables(KM_NOSLEEP, ns) != 0) {
6176a182920Ssommerfe cmn_err(CE_WARN,
6186a182920Ssommerfe "Unable to allocate %d entry IPsec policy hash table",
619f4b3ec61Sdh155122 ipss->ipsec_spd_hashsize);
620f4b3ec61Sdh155122 ipss->ipsec_spd_hashsize = IPSEC_SPDHASH_DEFAULT;
6216a182920Ssommerfe cmn_err(CE_WARN, "Falling back to %d entries",
622f4b3ec61Sdh155122 ipss->ipsec_spd_hashsize);
623f4b3ec61Sdh155122 (void) ipsec_alloc_tables(KM_SLEEP, ns);
6246a182920Ssommerfe }
6256a182920Ssommerfe
6268810c16bSdanmcd /* Just set a default for tunnels. */
627daa41a61Sdanmcd ipss->ipsec_tun_spd_hashsize = (tun_spd_hashsize == 0) ?
628daa41a61Sdanmcd TUN_SPDHASH_DEFAULT : tun_spd_hashsize;
6298810c16bSdanmcd
630f4b3ec61Sdh155122 ipsid_init(ns);
6318810c16bSdanmcd /*
6328810c16bSdanmcd * Globals need ref == 1 to prevent IPPH_REFRELE() from attempting
6338810c16bSdanmcd * to free them.
6348810c16bSdanmcd */
635f4b3ec61Sdh155122 ipss->ipsec_system_policy.iph_refs = 1;
636f4b3ec61Sdh155122 ipss->ipsec_inactive_policy.iph_refs = 1;
637f4b3ec61Sdh155122 ipsec_polhead_init(&ipss->ipsec_system_policy,
638f4b3ec61Sdh155122 ipss->ipsec_spd_hashsize);
639f4b3ec61Sdh155122 ipsec_polhead_init(&ipss->ipsec_inactive_policy,
640f4b3ec61Sdh155122 ipss->ipsec_spd_hashsize);
641f4b3ec61Sdh155122 rw_init(&ipss->ipsec_tunnel_policy_lock, NULL, RW_DEFAULT, NULL);
642f4b3ec61Sdh155122 avl_create(&ipss->ipsec_tunnel_policies, tunnel_compare,
643f4b3ec61Sdh155122 sizeof (ipsec_tun_pol_t), 0);
644f4b3ec61Sdh155122
645f4b3ec61Sdh155122 ipss->ipsec_next_policy_index = 1;
646f4b3ec61Sdh155122
647f4b3ec61Sdh155122 rw_init(&ipss->ipsec_system_policy.iph_lock, NULL, RW_DEFAULT, NULL);
648f4b3ec61Sdh155122 rw_init(&ipss->ipsec_inactive_policy.iph_lock, NULL, RW_DEFAULT, NULL);
6497c478bd9Sstevel@tonic-gate
6507c478bd9Sstevel@tonic-gate for (i = 0; i < IPSEC_ACTION_HASH_SIZE; i++)
651f4b3ec61Sdh155122 mutex_init(&(ipss->ipsec_action_hash[i].hash_lock),
6527c478bd9Sstevel@tonic-gate NULL, MUTEX_DEFAULT, NULL);
6537c478bd9Sstevel@tonic-gate
654f4b3ec61Sdh155122 for (i = 0; i < ipss->ipsec_spd_hashsize; i++)
655f4b3ec61Sdh155122 mutex_init(&(ipss->ipsec_sel_hash[i].hash_lock),
6567c478bd9Sstevel@tonic-gate NULL, MUTEX_DEFAULT, NULL);
6577c478bd9Sstevel@tonic-gate
65869e71331SBayard Bell rw_init(&ipss->ipsec_alg_lock, NULL, RW_DEFAULT, NULL);
659f4b3ec61Sdh155122 for (i = 0; i < IPSEC_NALGTYPES; i++) {
660f4b3ec61Sdh155122 ipss->ipsec_nalgs[i] = 0;
661f4b3ec61Sdh155122 }
6627c478bd9Sstevel@tonic-gate
663f4b3ec61Sdh155122 ip_drop_init(ipss);
664f4b3ec61Sdh155122 ip_drop_register(&ipss->ipsec_spd_dropper, "IPsec SPD");
6657c478bd9Sstevel@tonic-gate
666f4b3ec61Sdh155122 /* IP's IPsec code calls the packet dropper */
667f4b3ec61Sdh155122 ip_drop_register(&ipss->ipsec_dropper, "IP IPsec processing");
668f4b3ec61Sdh155122
669f4b3ec61Sdh155122 (void) ipsec_kstat_init(ipss);
670f4b3ec61Sdh155122
671f4b3ec61Sdh155122 ipsec_loader_init(ipss);
672f4b3ec61Sdh155122 ipsec_loader_start(ipss);
673f4b3ec61Sdh155122
674f4b3ec61Sdh155122 return (ipss);
675f4b3ec61Sdh155122 }
676f4b3ec61Sdh155122
677f4b3ec61Sdh155122 /* Global across all stack instances */
678f4b3ec61Sdh155122 void
ipsec_policy_g_init(void)679f4b3ec61Sdh155122 ipsec_policy_g_init(void)
680f4b3ec61Sdh155122 {
6817c478bd9Sstevel@tonic-gate ipsec_action_cache = kmem_cache_create("ipsec_actions",
6827c478bd9Sstevel@tonic-gate sizeof (ipsec_action_t), _POINTER_ALIGNMENT, NULL, NULL,
6837c478bd9Sstevel@tonic-gate ipsec_action_reclaim, NULL, NULL, 0);
6847c478bd9Sstevel@tonic-gate ipsec_sel_cache = kmem_cache_create("ipsec_selectors",
6857c478bd9Sstevel@tonic-gate sizeof (ipsec_sel_t), _POINTER_ALIGNMENT, NULL, NULL,
6867c478bd9Sstevel@tonic-gate NULL, NULL, NULL, 0);
6877c478bd9Sstevel@tonic-gate ipsec_pol_cache = kmem_cache_create("ipsec_policy",
6887c478bd9Sstevel@tonic-gate sizeof (ipsec_policy_t), _POINTER_ALIGNMENT, NULL, NULL,
6897c478bd9Sstevel@tonic-gate NULL, NULL, NULL, 0);
6907c478bd9Sstevel@tonic-gate
691f4b3ec61Sdh155122 /*
692f4b3ec61Sdh155122 * We want to be informed each time a stack is created or
693f4b3ec61Sdh155122 * destroyed in the kernel, so we can maintain the
694f4b3ec61Sdh155122 * set of ipsec_stack_t's.
695f4b3ec61Sdh155122 */
696f4b3ec61Sdh155122 netstack_register(NS_IPSEC, ipsec_stack_init, NULL, ipsec_stack_fini);
6977c478bd9Sstevel@tonic-gate }
6987c478bd9Sstevel@tonic-gate
6997c478bd9Sstevel@tonic-gate /*
7007c478bd9Sstevel@tonic-gate * Sort algorithm lists.
701a86080f9Sdanmcd *
7027c478bd9Sstevel@tonic-gate * I may need to split this based on
7037c478bd9Sstevel@tonic-gate * authentication/encryption, and I may wish to have an administrator
7047c478bd9Sstevel@tonic-gate * configure this list. Hold on to some NDD variables...
7057c478bd9Sstevel@tonic-gate *
7067c478bd9Sstevel@tonic-gate * XXX For now, sort on minimum key size (GAG!). While minimum key size is
707a86080f9Sdanmcd * not the ideal metric, it's the only quantifiable measure available.
708a86080f9Sdanmcd * We need a better metric for sorting algorithms by preference.
7097c478bd9Sstevel@tonic-gate */
7107c478bd9Sstevel@tonic-gate static void
alg_insert_sortlist(enum ipsec_algtype at,uint8_t algid,netstack_t * ns)711f4b3ec61Sdh155122 alg_insert_sortlist(enum ipsec_algtype at, uint8_t algid, netstack_t *ns)
7127c478bd9Sstevel@tonic-gate {
713f4b3ec61Sdh155122 ipsec_stack_t *ipss = ns->netstack_ipsec;
714f4b3ec61Sdh155122 ipsec_alginfo_t *ai = ipss->ipsec_alglists[at][algid];
7157c478bd9Sstevel@tonic-gate uint8_t holder, swap;
7167c478bd9Sstevel@tonic-gate uint_t i;
717f4b3ec61Sdh155122 uint_t count = ipss->ipsec_nalgs[at];
7187c478bd9Sstevel@tonic-gate ASSERT(ai != NULL);
7197c478bd9Sstevel@tonic-gate ASSERT(algid == ai->alg_id);
7207c478bd9Sstevel@tonic-gate
72169e71331SBayard Bell ASSERT(RW_WRITE_HELD(&ipss->ipsec_alg_lock));
7227c478bd9Sstevel@tonic-gate
7237c478bd9Sstevel@tonic-gate holder = algid;
7247c478bd9Sstevel@tonic-gate
7257c478bd9Sstevel@tonic-gate for (i = 0; i < count - 1; i++) {
7267c478bd9Sstevel@tonic-gate ipsec_alginfo_t *alt;
7277c478bd9Sstevel@tonic-gate
728f4b3ec61Sdh155122 alt = ipss->ipsec_alglists[at][ipss->ipsec_sortlist[at][i]];
7297c478bd9Sstevel@tonic-gate /*
7307c478bd9Sstevel@tonic-gate * If you want to give precedence to newly added algs,
7317c478bd9Sstevel@tonic-gate * add the = in the > comparison.
7327c478bd9Sstevel@tonic-gate */
7337c478bd9Sstevel@tonic-gate if ((holder != algid) || (ai->alg_minbits > alt->alg_minbits)) {
7347c478bd9Sstevel@tonic-gate /* Swap sortlist[i] and holder. */
735f4b3ec61Sdh155122 swap = ipss->ipsec_sortlist[at][i];
736f4b3ec61Sdh155122 ipss->ipsec_sortlist[at][i] = holder;
7377c478bd9Sstevel@tonic-gate holder = swap;
7387c478bd9Sstevel@tonic-gate ai = alt;
7397c478bd9Sstevel@tonic-gate } /* Else just continue. */
7407c478bd9Sstevel@tonic-gate }
7417c478bd9Sstevel@tonic-gate
7427c478bd9Sstevel@tonic-gate /* Store holder in last slot. */
743f4b3ec61Sdh155122 ipss->ipsec_sortlist[at][i] = holder;
7447c478bd9Sstevel@tonic-gate }
7457c478bd9Sstevel@tonic-gate
7467c478bd9Sstevel@tonic-gate /*
7477c478bd9Sstevel@tonic-gate * Remove an algorithm from a sorted algorithm list.
7487c478bd9Sstevel@tonic-gate * This should be considerably easier, even with complex sorting.
7497c478bd9Sstevel@tonic-gate */
7507c478bd9Sstevel@tonic-gate static void
alg_remove_sortlist(enum ipsec_algtype at,uint8_t algid,netstack_t * ns)751f4b3ec61Sdh155122 alg_remove_sortlist(enum ipsec_algtype at, uint8_t algid, netstack_t *ns)
7527c478bd9Sstevel@tonic-gate {
7537c478bd9Sstevel@tonic-gate boolean_t copyback = B_FALSE;
7547c478bd9Sstevel@tonic-gate int i;
755f4b3ec61Sdh155122 ipsec_stack_t *ipss = ns->netstack_ipsec;
756f4b3ec61Sdh155122 int newcount = ipss->ipsec_nalgs[at];
7577c478bd9Sstevel@tonic-gate
75869e71331SBayard Bell ASSERT(RW_WRITE_HELD(&ipss->ipsec_alg_lock));
7597c478bd9Sstevel@tonic-gate
7607c478bd9Sstevel@tonic-gate for (i = 0; i <= newcount; i++) {
761f4b3ec61Sdh155122 if (copyback) {
762f4b3ec61Sdh155122 ipss->ipsec_sortlist[at][i-1] =
763f4b3ec61Sdh155122 ipss->ipsec_sortlist[at][i];
764f4b3ec61Sdh155122 } else if (ipss->ipsec_sortlist[at][i] == algid) {
7657c478bd9Sstevel@tonic-gate copyback = B_TRUE;
7667c478bd9Sstevel@tonic-gate }
7677c478bd9Sstevel@tonic-gate }
768f4b3ec61Sdh155122 }
7697c478bd9Sstevel@tonic-gate
7707c478bd9Sstevel@tonic-gate /*
7717c478bd9Sstevel@tonic-gate * Add the specified algorithm to the algorithm tables.
7727c478bd9Sstevel@tonic-gate * Must be called while holding the algorithm table writer lock.
7737c478bd9Sstevel@tonic-gate */
7747c478bd9Sstevel@tonic-gate void
ipsec_alg_reg(ipsec_algtype_t algtype,ipsec_alginfo_t * alg,netstack_t * ns)775f4b3ec61Sdh155122 ipsec_alg_reg(ipsec_algtype_t algtype, ipsec_alginfo_t *alg, netstack_t *ns)
7767c478bd9Sstevel@tonic-gate {
777f4b3ec61Sdh155122 ipsec_stack_t *ipss = ns->netstack_ipsec;
7787c478bd9Sstevel@tonic-gate
77969e71331SBayard Bell ASSERT(RW_WRITE_HELD(&ipss->ipsec_alg_lock));
7807c478bd9Sstevel@tonic-gate
781f4b3ec61Sdh155122 ASSERT(ipss->ipsec_alglists[algtype][alg->alg_id] == NULL);
782f4b3ec61Sdh155122 ipsec_alg_fix_min_max(alg, algtype, ns);
783f4b3ec61Sdh155122 ipss->ipsec_alglists[algtype][alg->alg_id] = alg;
784f4b3ec61Sdh155122
785f4b3ec61Sdh155122 ipss->ipsec_nalgs[algtype]++;
786f4b3ec61Sdh155122 alg_insert_sortlist(algtype, alg->alg_id, ns);
7877c478bd9Sstevel@tonic-gate }
7887c478bd9Sstevel@tonic-gate
7897c478bd9Sstevel@tonic-gate /*
7907c478bd9Sstevel@tonic-gate * Remove the specified algorithm from the algorithm tables.
7917c478bd9Sstevel@tonic-gate * Must be called while holding the algorithm table writer lock.
7927c478bd9Sstevel@tonic-gate */
7937c478bd9Sstevel@tonic-gate void
ipsec_alg_unreg(ipsec_algtype_t algtype,uint8_t algid,netstack_t * ns)794f4b3ec61Sdh155122 ipsec_alg_unreg(ipsec_algtype_t algtype, uint8_t algid, netstack_t *ns)
7957c478bd9Sstevel@tonic-gate {
796f4b3ec61Sdh155122 ipsec_stack_t *ipss = ns->netstack_ipsec;
7977c478bd9Sstevel@tonic-gate
79869e71331SBayard Bell ASSERT(RW_WRITE_HELD(&ipss->ipsec_alg_lock));
7997c478bd9Sstevel@tonic-gate
800f4b3ec61Sdh155122 ASSERT(ipss->ipsec_alglists[algtype][algid] != NULL);
801f4b3ec61Sdh155122 ipsec_alg_free(ipss->ipsec_alglists[algtype][algid]);
802f4b3ec61Sdh155122 ipss->ipsec_alglists[algtype][algid] = NULL;
803f4b3ec61Sdh155122
804f4b3ec61Sdh155122 ipss->ipsec_nalgs[algtype]--;
805f4b3ec61Sdh155122 alg_remove_sortlist(algtype, algid, ns);
8067c478bd9Sstevel@tonic-gate }
8077c478bd9Sstevel@tonic-gate
8087c478bd9Sstevel@tonic-gate /*
8097c478bd9Sstevel@tonic-gate * Hooks for spdsock to get a grip on system policy.
8107c478bd9Sstevel@tonic-gate */
8117c478bd9Sstevel@tonic-gate
8127c478bd9Sstevel@tonic-gate ipsec_policy_head_t *
ipsec_system_policy(netstack_t * ns)813f4b3ec61Sdh155122 ipsec_system_policy(netstack_t *ns)
8147c478bd9Sstevel@tonic-gate {
815f4b3ec61Sdh155122 ipsec_stack_t *ipss = ns->netstack_ipsec;
816f4b3ec61Sdh155122 ipsec_policy_head_t *h = &ipss->ipsec_system_policy;
817f4b3ec61Sdh155122
8187c478bd9Sstevel@tonic-gate IPPH_REFHOLD(h);
8197c478bd9Sstevel@tonic-gate return (h);
8207c478bd9Sstevel@tonic-gate }
8217c478bd9Sstevel@tonic-gate
8227c478bd9Sstevel@tonic-gate ipsec_policy_head_t *
ipsec_inactive_policy(netstack_t * ns)823f4b3ec61Sdh155122 ipsec_inactive_policy(netstack_t *ns)
8247c478bd9Sstevel@tonic-gate {
825f4b3ec61Sdh155122 ipsec_stack_t *ipss = ns->netstack_ipsec;
826f4b3ec61Sdh155122 ipsec_policy_head_t *h = &ipss->ipsec_inactive_policy;
827f4b3ec61Sdh155122
8287c478bd9Sstevel@tonic-gate IPPH_REFHOLD(h);
8297c478bd9Sstevel@tonic-gate return (h);
8307c478bd9Sstevel@tonic-gate }
8317c478bd9Sstevel@tonic-gate
8327c478bd9Sstevel@tonic-gate /*
8337c478bd9Sstevel@tonic-gate * Lock inactive policy, then active policy, then exchange policy root
8347c478bd9Sstevel@tonic-gate * pointers.
8357c478bd9Sstevel@tonic-gate */
8367c478bd9Sstevel@tonic-gate void
ipsec_swap_policy(ipsec_policy_head_t * active,ipsec_policy_head_t * inactive,netstack_t * ns)837f4b3ec61Sdh155122 ipsec_swap_policy(ipsec_policy_head_t *active, ipsec_policy_head_t *inactive,
838f4b3ec61Sdh155122 netstack_t *ns)
8397c478bd9Sstevel@tonic-gate {
8407c478bd9Sstevel@tonic-gate int af, dir;
8416a182920Ssommerfe avl_tree_t r1, r2;
8427c478bd9Sstevel@tonic-gate
8438810c16bSdanmcd rw_enter(&inactive->iph_lock, RW_WRITER);
8448810c16bSdanmcd rw_enter(&active->iph_lock, RW_WRITER);
8456a182920Ssommerfe
8468810c16bSdanmcd r1 = active->iph_rulebyid;
8478810c16bSdanmcd r2 = inactive->iph_rulebyid;
8488810c16bSdanmcd active->iph_rulebyid = r2;
8498810c16bSdanmcd inactive->iph_rulebyid = r1;
8506a182920Ssommerfe
8517c478bd9Sstevel@tonic-gate for (dir = 0; dir < IPSEC_NTYPES; dir++) {
8526a182920Ssommerfe ipsec_policy_hash_t *h1, *h2;
8536a182920Ssommerfe
8548810c16bSdanmcd h1 = active->iph_root[dir].ipr_hash;
8558810c16bSdanmcd h2 = inactive->iph_root[dir].ipr_hash;
8568810c16bSdanmcd active->iph_root[dir].ipr_hash = h2;
8578810c16bSdanmcd inactive->iph_root[dir].ipr_hash = h1;
8586a182920Ssommerfe
8597c478bd9Sstevel@tonic-gate for (af = 0; af < IPSEC_NAF; af++) {
8606a182920Ssommerfe ipsec_policy_t *t1, *t2;
8616a182920Ssommerfe
8628810c16bSdanmcd t1 = active->iph_root[dir].ipr_nonhash[af];
8638810c16bSdanmcd t2 = inactive->iph_root[dir].ipr_nonhash[af];
8648810c16bSdanmcd active->iph_root[dir].ipr_nonhash[af] = t2;
8658810c16bSdanmcd inactive->iph_root[dir].ipr_nonhash[af] = t1;
8666a182920Ssommerfe if (t1 != NULL) {
8676a182920Ssommerfe t1->ipsp_hash.hash_pp =
8688810c16bSdanmcd &(inactive->iph_root[dir].ipr_nonhash[af]);
8696a182920Ssommerfe }
8706a182920Ssommerfe if (t2 != NULL) {
8716a182920Ssommerfe t2->ipsp_hash.hash_pp =
8728810c16bSdanmcd &(active->iph_root[dir].ipr_nonhash[af]);
8736a182920Ssommerfe }
8746a182920Ssommerfe
8757c478bd9Sstevel@tonic-gate }
8767c478bd9Sstevel@tonic-gate }
8778810c16bSdanmcd active->iph_gen++;
8788810c16bSdanmcd inactive->iph_gen++;
879f4b3ec61Sdh155122 ipsec_update_present_flags(ns->netstack_ipsec);
8808810c16bSdanmcd rw_exit(&active->iph_lock);
8818810c16bSdanmcd rw_exit(&inactive->iph_lock);
8828810c16bSdanmcd }
8838810c16bSdanmcd
8848810c16bSdanmcd /*
8858810c16bSdanmcd * Swap global policy primary/secondary.
8868810c16bSdanmcd */
8878810c16bSdanmcd void
ipsec_swap_global_policy(netstack_t * ns)888f4b3ec61Sdh155122 ipsec_swap_global_policy(netstack_t *ns)
8898810c16bSdanmcd {
890f4b3ec61Sdh155122 ipsec_stack_t *ipss = ns->netstack_ipsec;
891f4b3ec61Sdh155122
892f4b3ec61Sdh155122 ipsec_swap_policy(&ipss->ipsec_system_policy,
893f4b3ec61Sdh155122 &ipss->ipsec_inactive_policy, ns);
8947c478bd9Sstevel@tonic-gate }
8957c478bd9Sstevel@tonic-gate
8967c478bd9Sstevel@tonic-gate /*
8977c478bd9Sstevel@tonic-gate * Clone one policy rule..
8987c478bd9Sstevel@tonic-gate */
8997c478bd9Sstevel@tonic-gate static ipsec_policy_t *
ipsec_copy_policy(const ipsec_policy_t * src)9007c478bd9Sstevel@tonic-gate ipsec_copy_policy(const ipsec_policy_t *src)
9017c478bd9Sstevel@tonic-gate {
9027c478bd9Sstevel@tonic-gate ipsec_policy_t *dst = kmem_cache_alloc(ipsec_pol_cache, KM_NOSLEEP);
9037c478bd9Sstevel@tonic-gate
9047c478bd9Sstevel@tonic-gate if (dst == NULL)
9057c478bd9Sstevel@tonic-gate return (NULL);
9067c478bd9Sstevel@tonic-gate
9077c478bd9Sstevel@tonic-gate /*
9087c478bd9Sstevel@tonic-gate * Adjust refcounts of cloned state.
9097c478bd9Sstevel@tonic-gate */
9107c478bd9Sstevel@tonic-gate IPACT_REFHOLD(src->ipsp_act);
9117c478bd9Sstevel@tonic-gate src->ipsp_sel->ipsl_refs++;
9127c478bd9Sstevel@tonic-gate
9136a182920Ssommerfe HASH_NULL(dst, ipsp_hash);
914bd670b35SErik Nordmark dst->ipsp_netstack = src->ipsp_netstack;
9157c478bd9Sstevel@tonic-gate dst->ipsp_refs = 1;
9167c478bd9Sstevel@tonic-gate dst->ipsp_sel = src->ipsp_sel;
9177c478bd9Sstevel@tonic-gate dst->ipsp_act = src->ipsp_act;
9187c478bd9Sstevel@tonic-gate dst->ipsp_prio = src->ipsp_prio;
9197c478bd9Sstevel@tonic-gate dst->ipsp_index = src->ipsp_index;
9207c478bd9Sstevel@tonic-gate
9217c478bd9Sstevel@tonic-gate return (dst);
9227c478bd9Sstevel@tonic-gate }
9237c478bd9Sstevel@tonic-gate
9246a182920Ssommerfe void
ipsec_insert_always(avl_tree_t * tree,void * new_node)9256a182920Ssommerfe ipsec_insert_always(avl_tree_t *tree, void *new_node)
9266a182920Ssommerfe {
9276a182920Ssommerfe void *node;
9286a182920Ssommerfe avl_index_t where;
9296a182920Ssommerfe
9306a182920Ssommerfe node = avl_find(tree, new_node, &where);
9316a182920Ssommerfe ASSERT(node == NULL);
9326a182920Ssommerfe avl_insert(tree, new_node, where);
9336a182920Ssommerfe }
9346a182920Ssommerfe
9356a182920Ssommerfe
9366a182920Ssommerfe static int
ipsec_copy_chain(ipsec_policy_head_t * dph,ipsec_policy_t * src,ipsec_policy_t ** dstp)9376a182920Ssommerfe ipsec_copy_chain(ipsec_policy_head_t *dph, ipsec_policy_t *src,
9386a182920Ssommerfe ipsec_policy_t **dstp)
9396a182920Ssommerfe {
9406a182920Ssommerfe for (; src != NULL; src = src->ipsp_hash.hash_next) {
9416a182920Ssommerfe ipsec_policy_t *dst = ipsec_copy_policy(src);
9426a182920Ssommerfe if (dst == NULL)
9436a182920Ssommerfe return (ENOMEM);
9446a182920Ssommerfe
9456a182920Ssommerfe HASHLIST_INSERT(dst, ipsp_hash, *dstp);
9466a182920Ssommerfe ipsec_insert_always(&dph->iph_rulebyid, dst);
9476a182920Ssommerfe }
9486a182920Ssommerfe return (0);
9496a182920Ssommerfe }
9506a182920Ssommerfe
9516a182920Ssommerfe
9526a182920Ssommerfe
9537c478bd9Sstevel@tonic-gate /*
9547c478bd9Sstevel@tonic-gate * Make one policy head look exactly like another.
9557c478bd9Sstevel@tonic-gate *
9567c478bd9Sstevel@tonic-gate * As with ipsec_swap_policy, we lock the destination policy head first, then
9577c478bd9Sstevel@tonic-gate * the source policy head. Note that we only need to read-lock the source
9587c478bd9Sstevel@tonic-gate * policy head as we are not changing it.
9597c478bd9Sstevel@tonic-gate */
9608810c16bSdanmcd int
ipsec_copy_polhead(ipsec_policy_head_t * sph,ipsec_policy_head_t * dph,netstack_t * ns)961f4b3ec61Sdh155122 ipsec_copy_polhead(ipsec_policy_head_t *sph, ipsec_policy_head_t *dph,
962f4b3ec61Sdh155122 netstack_t *ns)
9637c478bd9Sstevel@tonic-gate {
9646a182920Ssommerfe int af, dir, chain, nchains;
9657c478bd9Sstevel@tonic-gate
9667c478bd9Sstevel@tonic-gate rw_enter(&dph->iph_lock, RW_WRITER);
9677c478bd9Sstevel@tonic-gate
968f4b3ec61Sdh155122 ipsec_polhead_flush(dph, ns);
9697c478bd9Sstevel@tonic-gate
9707c478bd9Sstevel@tonic-gate rw_enter(&sph->iph_lock, RW_READER);
9717c478bd9Sstevel@tonic-gate
9727c478bd9Sstevel@tonic-gate for (dir = 0; dir < IPSEC_NTYPES; dir++) {
9736a182920Ssommerfe ipsec_policy_root_t *dpr = &dph->iph_root[dir];
9746a182920Ssommerfe ipsec_policy_root_t *spr = &sph->iph_root[dir];
9756a182920Ssommerfe nchains = dpr->ipr_nchains;
9766a182920Ssommerfe
9776a182920Ssommerfe ASSERT(dpr->ipr_nchains == spr->ipr_nchains);
9786a182920Ssommerfe
9797c478bd9Sstevel@tonic-gate for (af = 0; af < IPSEC_NAF; af++) {
9806a182920Ssommerfe if (ipsec_copy_chain(dph, spr->ipr_nonhash[af],
9816a182920Ssommerfe &dpr->ipr_nonhash[af]))
9826a182920Ssommerfe goto abort_copy;
9837c478bd9Sstevel@tonic-gate }
9846a182920Ssommerfe
9856a182920Ssommerfe for (chain = 0; chain < nchains; chain++) {
9866a182920Ssommerfe if (ipsec_copy_chain(dph,
9876a182920Ssommerfe spr->ipr_hash[chain].hash_head,
9886a182920Ssommerfe &dpr->ipr_hash[chain].hash_head))
9896a182920Ssommerfe goto abort_copy;
9907c478bd9Sstevel@tonic-gate }
9917c478bd9Sstevel@tonic-gate }
9927c478bd9Sstevel@tonic-gate
9937c478bd9Sstevel@tonic-gate dph->iph_gen++;
9947c478bd9Sstevel@tonic-gate
9957c478bd9Sstevel@tonic-gate rw_exit(&sph->iph_lock);
9967c478bd9Sstevel@tonic-gate rw_exit(&dph->iph_lock);
9977c478bd9Sstevel@tonic-gate return (0);
9986a182920Ssommerfe
9996a182920Ssommerfe abort_copy:
1000f4b3ec61Sdh155122 ipsec_polhead_flush(dph, ns);
10016a182920Ssommerfe rw_exit(&sph->iph_lock);
10026a182920Ssommerfe rw_exit(&dph->iph_lock);
10036a182920Ssommerfe return (ENOMEM);
10047c478bd9Sstevel@tonic-gate }
10057c478bd9Sstevel@tonic-gate
10067c478bd9Sstevel@tonic-gate /*
10077c478bd9Sstevel@tonic-gate * Clone currently active policy to the inactive policy list.
10087c478bd9Sstevel@tonic-gate */
10097c478bd9Sstevel@tonic-gate int
ipsec_clone_system_policy(netstack_t * ns)1010f4b3ec61Sdh155122 ipsec_clone_system_policy(netstack_t *ns)
10117c478bd9Sstevel@tonic-gate {
1012f4b3ec61Sdh155122 ipsec_stack_t *ipss = ns->netstack_ipsec;
1013f4b3ec61Sdh155122
1014f4b3ec61Sdh155122 return (ipsec_copy_polhead(&ipss->ipsec_system_policy,
1015f4b3ec61Sdh155122 &ipss->ipsec_inactive_policy, ns));
10167c478bd9Sstevel@tonic-gate }
10177c478bd9Sstevel@tonic-gate
10188810c16bSdanmcd /*
10197c478bd9Sstevel@tonic-gate * Extract the string from ipsec_policy_failure_msgs[type] and
10207c478bd9Sstevel@tonic-gate * log it.
10217c478bd9Sstevel@tonic-gate *
10227c478bd9Sstevel@tonic-gate */
10237c478bd9Sstevel@tonic-gate void
ipsec_log_policy_failure(int type,char * func_name,ipha_t * ipha,ip6_t * ip6h,boolean_t secure,netstack_t * ns)102432350c00Sdanmcd ipsec_log_policy_failure(int type, char *func_name, ipha_t *ipha, ip6_t *ip6h,
1025f4b3ec61Sdh155122 boolean_t secure, netstack_t *ns)
10267c478bd9Sstevel@tonic-gate {
10277c478bd9Sstevel@tonic-gate char sbuf[INET6_ADDRSTRLEN];
10287c478bd9Sstevel@tonic-gate char dbuf[INET6_ADDRSTRLEN];
10297c478bd9Sstevel@tonic-gate char *s;
10307c478bd9Sstevel@tonic-gate char *d;
1031f4b3ec61Sdh155122 ipsec_stack_t *ipss = ns->netstack_ipsec;
10327c478bd9Sstevel@tonic-gate
10337c478bd9Sstevel@tonic-gate ASSERT((ipha == NULL && ip6h != NULL) ||
10347c478bd9Sstevel@tonic-gate (ip6h == NULL && ipha != NULL));
10357c478bd9Sstevel@tonic-gate
10367c478bd9Sstevel@tonic-gate if (ipha != NULL) {
10377c478bd9Sstevel@tonic-gate s = inet_ntop(AF_INET, &ipha->ipha_src, sbuf, sizeof (sbuf));
10387c478bd9Sstevel@tonic-gate d = inet_ntop(AF_INET, &ipha->ipha_dst, dbuf, sizeof (dbuf));
10397c478bd9Sstevel@tonic-gate } else {
10407c478bd9Sstevel@tonic-gate s = inet_ntop(AF_INET6, &ip6h->ip6_src, sbuf, sizeof (sbuf));
10417c478bd9Sstevel@tonic-gate d = inet_ntop(AF_INET6, &ip6h->ip6_dst, dbuf, sizeof (dbuf));
10427c478bd9Sstevel@tonic-gate
10437c478bd9Sstevel@tonic-gate }
10447c478bd9Sstevel@tonic-gate
10457c478bd9Sstevel@tonic-gate /* Always bump the policy failure counter. */
1046f4b3ec61Sdh155122 ipss->ipsec_policy_failure_count[type]++;
10477c478bd9Sstevel@tonic-gate
1048f4b3ec61Sdh155122 ipsec_rl_strlog(ns, IP_MOD_ID, 0, 0, SL_ERROR|SL_WARN|SL_CONSOLE,
104932350c00Sdanmcd ipsec_policy_failure_msgs[type], func_name,
10507c478bd9Sstevel@tonic-gate (secure ? "secure" : "not secure"), s, d);
1051bffb04cfSmarkfen }
1052bffb04cfSmarkfen
1053bffb04cfSmarkfen /*
1054bffb04cfSmarkfen * Rate-limiting front-end to strlog() for AH and ESP. Uses the ndd variables
1055bffb04cfSmarkfen * in /dev/ip and the same rate-limiting clock so that there's a single
1056bffb04cfSmarkfen * knob to turn to throttle the rate of messages.
1057bffb04cfSmarkfen */
1058bffb04cfSmarkfen void
ipsec_rl_strlog(netstack_t * ns,short mid,short sid,char level,ushort_t sl,char * fmt,...)1059f4b3ec61Sdh155122 ipsec_rl_strlog(netstack_t *ns, short mid, short sid, char level, ushort_t sl,
1060f4b3ec61Sdh155122 char *fmt, ...)
1061bffb04cfSmarkfen {
1062bffb04cfSmarkfen va_list adx;
1063bffb04cfSmarkfen hrtime_t current = gethrtime();
1064f4b3ec61Sdh155122 ip_stack_t *ipst = ns->netstack_ip;
1065f4b3ec61Sdh155122 ipsec_stack_t *ipss = ns->netstack_ipsec;
1066bffb04cfSmarkfen
1067bffb04cfSmarkfen sl |= SL_CONSOLE;
1068bffb04cfSmarkfen /*
1069bffb04cfSmarkfen * Throttle logging to stop syslog from being swamped. If variable
1070bffb04cfSmarkfen * 'ipsec_policy_log_interval' is zero, don't log any messages at
1071bffb04cfSmarkfen * all, otherwise log only one message every 'ipsec_policy_log_interval'
1072bffb04cfSmarkfen * msec. Convert interval (in msec) to hrtime (in nsec).
1073bffb04cfSmarkfen */
1074bffb04cfSmarkfen
1075f4b3ec61Sdh155122 if (ipst->ips_ipsec_policy_log_interval) {
1076f4b3ec61Sdh155122 if (ipss->ipsec_policy_failure_last +
1077cf0ee00aSDan McDonald MSEC2NSEC(ipst->ips_ipsec_policy_log_interval) <= current) {
1078bffb04cfSmarkfen va_start(adx, fmt);
1079bffb04cfSmarkfen (void) vstrlog(mid, sid, level, sl, fmt, adx);
1080bffb04cfSmarkfen va_end(adx);
1081f4b3ec61Sdh155122 ipss->ipsec_policy_failure_last = current;
10827c478bd9Sstevel@tonic-gate }
10837c478bd9Sstevel@tonic-gate }
1084bffb04cfSmarkfen }
10857c478bd9Sstevel@tonic-gate
10867c478bd9Sstevel@tonic-gate void
ipsec_config_flush(netstack_t * ns)1087f4b3ec61Sdh155122 ipsec_config_flush(netstack_t *ns)
10887c478bd9Sstevel@tonic-gate {
1089f4b3ec61Sdh155122 ipsec_stack_t *ipss = ns->netstack_ipsec;
1090f4b3ec61Sdh155122
1091f4b3ec61Sdh155122 rw_enter(&ipss->ipsec_system_policy.iph_lock, RW_WRITER);
1092f4b3ec61Sdh155122 ipsec_polhead_flush(&ipss->ipsec_system_policy, ns);
1093f4b3ec61Sdh155122 ipss->ipsec_next_policy_index = 1;
1094f4b3ec61Sdh155122 rw_exit(&ipss->ipsec_system_policy.iph_lock);
10954ba231ceSKacheong Poon ipsec_action_reclaim_stack(ipss);
10967c478bd9Sstevel@tonic-gate }
10977c478bd9Sstevel@tonic-gate
10987c478bd9Sstevel@tonic-gate /*
10997c478bd9Sstevel@tonic-gate * Clip a policy's min/max keybits vs. the capabilities of the
11007c478bd9Sstevel@tonic-gate * algorithm.
11017c478bd9Sstevel@tonic-gate */
11027c478bd9Sstevel@tonic-gate static void
act_alg_adjust(uint_t algtype,uint_t algid,uint16_t * minbits,uint16_t * maxbits,netstack_t * ns)11037c478bd9Sstevel@tonic-gate act_alg_adjust(uint_t algtype, uint_t algid,
1104f4b3ec61Sdh155122 uint16_t *minbits, uint16_t *maxbits, netstack_t *ns)
11057c478bd9Sstevel@tonic-gate {
1106f4b3ec61Sdh155122 ipsec_stack_t *ipss = ns->netstack_ipsec;
1107f4b3ec61Sdh155122 ipsec_alginfo_t *algp = ipss->ipsec_alglists[algtype][algid];
1108f4b3ec61Sdh155122
11097c478bd9Sstevel@tonic-gate if (algp != NULL) {
11107c478bd9Sstevel@tonic-gate /*
11117c478bd9Sstevel@tonic-gate * If passed-in minbits is zero, we assume the caller trusts
11127c478bd9Sstevel@tonic-gate * us with setting the minimum key size. We pick the
11137c478bd9Sstevel@tonic-gate * algorithms DEFAULT key size for the minimum in this case.
11147c478bd9Sstevel@tonic-gate */
11157c478bd9Sstevel@tonic-gate if (*minbits == 0) {
11167c478bd9Sstevel@tonic-gate *minbits = algp->alg_default_bits;
11177c478bd9Sstevel@tonic-gate ASSERT(*minbits >= algp->alg_minbits);
11187c478bd9Sstevel@tonic-gate } else {
11198810c16bSdanmcd *minbits = MAX(MIN(*minbits, algp->alg_maxbits),
11208810c16bSdanmcd algp->alg_minbits);
11217c478bd9Sstevel@tonic-gate }
11227c478bd9Sstevel@tonic-gate if (*maxbits == 0)
11237c478bd9Sstevel@tonic-gate *maxbits = algp->alg_maxbits;
11247c478bd9Sstevel@tonic-gate else
11258810c16bSdanmcd *maxbits = MIN(MAX(*maxbits, algp->alg_minbits),
11268810c16bSdanmcd algp->alg_maxbits);
11277c478bd9Sstevel@tonic-gate ASSERT(*minbits <= *maxbits);
11287c478bd9Sstevel@tonic-gate } else {
11297c478bd9Sstevel@tonic-gate *minbits = 0;
11307c478bd9Sstevel@tonic-gate *maxbits = 0;
11317c478bd9Sstevel@tonic-gate }
11327c478bd9Sstevel@tonic-gate }
11337c478bd9Sstevel@tonic-gate
11347c478bd9Sstevel@tonic-gate /*
11357c478bd9Sstevel@tonic-gate * Check an action's requested algorithms against the algorithms currently
11367c478bd9Sstevel@tonic-gate * loaded in the system.
11377c478bd9Sstevel@tonic-gate */
11387c478bd9Sstevel@tonic-gate boolean_t
ipsec_check_action(ipsec_act_t * act,int * diag,netstack_t * ns)1139f4b3ec61Sdh155122 ipsec_check_action(ipsec_act_t *act, int *diag, netstack_t *ns)
11407c478bd9Sstevel@tonic-gate {
11417c478bd9Sstevel@tonic-gate ipsec_prot_t *ipp;
1142f4b3ec61Sdh155122 ipsec_stack_t *ipss = ns->netstack_ipsec;
11437c478bd9Sstevel@tonic-gate
11447c478bd9Sstevel@tonic-gate ipp = &act->ipa_apply;
11457c478bd9Sstevel@tonic-gate
11467c478bd9Sstevel@tonic-gate if (ipp->ipp_use_ah &&
1147f4b3ec61Sdh155122 ipss->ipsec_alglists[IPSEC_ALG_AUTH][ipp->ipp_auth_alg] == NULL) {
11487c478bd9Sstevel@tonic-gate *diag = SPD_DIAGNOSTIC_UNSUPP_AH_ALG;
11497c478bd9Sstevel@tonic-gate return (B_FALSE);
11507c478bd9Sstevel@tonic-gate }
11517c478bd9Sstevel@tonic-gate if (ipp->ipp_use_espa &&
1152f4b3ec61Sdh155122 ipss->ipsec_alglists[IPSEC_ALG_AUTH][ipp->ipp_esp_auth_alg] ==
1153f4b3ec61Sdh155122 NULL) {
11547c478bd9Sstevel@tonic-gate *diag = SPD_DIAGNOSTIC_UNSUPP_ESP_AUTH_ALG;
11557c478bd9Sstevel@tonic-gate return (B_FALSE);
11567c478bd9Sstevel@tonic-gate }
11577c478bd9Sstevel@tonic-gate if (ipp->ipp_use_esp &&
1158f4b3ec61Sdh155122 ipss->ipsec_alglists[IPSEC_ALG_ENCR][ipp->ipp_encr_alg] == NULL) {
11597c478bd9Sstevel@tonic-gate *diag = SPD_DIAGNOSTIC_UNSUPP_ESP_ENCR_ALG;
11607c478bd9Sstevel@tonic-gate return (B_FALSE);
11617c478bd9Sstevel@tonic-gate }
11627c478bd9Sstevel@tonic-gate
11637c478bd9Sstevel@tonic-gate act_alg_adjust(IPSEC_ALG_AUTH, ipp->ipp_auth_alg,
1164f4b3ec61Sdh155122 &ipp->ipp_ah_minbits, &ipp->ipp_ah_maxbits, ns);
11657c478bd9Sstevel@tonic-gate act_alg_adjust(IPSEC_ALG_AUTH, ipp->ipp_esp_auth_alg,
1166f4b3ec61Sdh155122 &ipp->ipp_espa_minbits, &ipp->ipp_espa_maxbits, ns);
11677c478bd9Sstevel@tonic-gate act_alg_adjust(IPSEC_ALG_ENCR, ipp->ipp_encr_alg,
1168f4b3ec61Sdh155122 &ipp->ipp_espe_minbits, &ipp->ipp_espe_maxbits, ns);
11697c478bd9Sstevel@tonic-gate
11707c478bd9Sstevel@tonic-gate if (ipp->ipp_ah_minbits > ipp->ipp_ah_maxbits) {
11717c478bd9Sstevel@tonic-gate *diag = SPD_DIAGNOSTIC_UNSUPP_AH_KEYSIZE;
11727c478bd9Sstevel@tonic-gate return (B_FALSE);
11737c478bd9Sstevel@tonic-gate }
11747c478bd9Sstevel@tonic-gate if (ipp->ipp_espa_minbits > ipp->ipp_espa_maxbits) {
11757c478bd9Sstevel@tonic-gate *diag = SPD_DIAGNOSTIC_UNSUPP_ESP_AUTH_KEYSIZE;
11767c478bd9Sstevel@tonic-gate return (B_FALSE);
11777c478bd9Sstevel@tonic-gate }
11787c478bd9Sstevel@tonic-gate if (ipp->ipp_espe_minbits > ipp->ipp_espe_maxbits) {
11797c478bd9Sstevel@tonic-gate *diag = SPD_DIAGNOSTIC_UNSUPP_ESP_ENCR_KEYSIZE;
11807c478bd9Sstevel@tonic-gate return (B_FALSE);
11817c478bd9Sstevel@tonic-gate }
11827c478bd9Sstevel@tonic-gate /* TODO: sanity check lifetimes */
11837c478bd9Sstevel@tonic-gate return (B_TRUE);
11847c478bd9Sstevel@tonic-gate }
11857c478bd9Sstevel@tonic-gate
11867c478bd9Sstevel@tonic-gate /*
11877c478bd9Sstevel@tonic-gate * Set up a single action during wildcard expansion..
11887c478bd9Sstevel@tonic-gate */
11897c478bd9Sstevel@tonic-gate static void
ipsec_setup_act(ipsec_act_t * outact,ipsec_act_t * act,uint_t auth_alg,uint_t encr_alg,uint_t eauth_alg,netstack_t * ns)11907c478bd9Sstevel@tonic-gate ipsec_setup_act(ipsec_act_t *outact, ipsec_act_t *act,
1191f4b3ec61Sdh155122 uint_t auth_alg, uint_t encr_alg, uint_t eauth_alg, netstack_t *ns)
11927c478bd9Sstevel@tonic-gate {
11937c478bd9Sstevel@tonic-gate ipsec_prot_t *ipp;
11947c478bd9Sstevel@tonic-gate
11957c478bd9Sstevel@tonic-gate *outact = *act;
11967c478bd9Sstevel@tonic-gate ipp = &outact->ipa_apply;
11977c478bd9Sstevel@tonic-gate ipp->ipp_auth_alg = (uint8_t)auth_alg;
11987c478bd9Sstevel@tonic-gate ipp->ipp_encr_alg = (uint8_t)encr_alg;
11997c478bd9Sstevel@tonic-gate ipp->ipp_esp_auth_alg = (uint8_t)eauth_alg;
12007c478bd9Sstevel@tonic-gate
12017c478bd9Sstevel@tonic-gate act_alg_adjust(IPSEC_ALG_AUTH, auth_alg,
1202f4b3ec61Sdh155122 &ipp->ipp_ah_minbits, &ipp->ipp_ah_maxbits, ns);
12037c478bd9Sstevel@tonic-gate act_alg_adjust(IPSEC_ALG_AUTH, eauth_alg,
1204f4b3ec61Sdh155122 &ipp->ipp_espa_minbits, &ipp->ipp_espa_maxbits, ns);
12057c478bd9Sstevel@tonic-gate act_alg_adjust(IPSEC_ALG_ENCR, encr_alg,
1206f4b3ec61Sdh155122 &ipp->ipp_espe_minbits, &ipp->ipp_espe_maxbits, ns);
12077c478bd9Sstevel@tonic-gate }
12087c478bd9Sstevel@tonic-gate
12097c478bd9Sstevel@tonic-gate /*
12107c478bd9Sstevel@tonic-gate * combinatoric expansion time: expand a wildcarded action into an
12117c478bd9Sstevel@tonic-gate * array of wildcarded actions; we return the exploded action list,
12127c478bd9Sstevel@tonic-gate * and return a count in *nact (output only).
12137c478bd9Sstevel@tonic-gate */
12147c478bd9Sstevel@tonic-gate static ipsec_act_t *
ipsec_act_wildcard_expand(ipsec_act_t * act,uint_t * nact,netstack_t * ns)1215f4b3ec61Sdh155122 ipsec_act_wildcard_expand(ipsec_act_t *act, uint_t *nact, netstack_t *ns)
12167c478bd9Sstevel@tonic-gate {
12177c478bd9Sstevel@tonic-gate boolean_t use_ah, use_esp, use_espa;
12187c478bd9Sstevel@tonic-gate boolean_t wild_auth, wild_encr, wild_eauth;
12197c478bd9Sstevel@tonic-gate uint_t auth_alg, auth_idx, auth_min, auth_max;
12207c478bd9Sstevel@tonic-gate uint_t eauth_alg, eauth_idx, eauth_min, eauth_max;
12217c478bd9Sstevel@tonic-gate uint_t encr_alg, encr_idx, encr_min, encr_max;
12227c478bd9Sstevel@tonic-gate uint_t action_count, ai;
12237c478bd9Sstevel@tonic-gate ipsec_act_t *outact;
1224f4b3ec61Sdh155122 ipsec_stack_t *ipss = ns->netstack_ipsec;
12257c478bd9Sstevel@tonic-gate
12267c478bd9Sstevel@tonic-gate if (act->ipa_type != IPSEC_ACT_APPLY) {
12277c478bd9Sstevel@tonic-gate outact = kmem_alloc(sizeof (*act), KM_NOSLEEP);
12287c478bd9Sstevel@tonic-gate *nact = 1;
12297c478bd9Sstevel@tonic-gate if (outact != NULL)
12307c478bd9Sstevel@tonic-gate bcopy(act, outact, sizeof (*act));
12317c478bd9Sstevel@tonic-gate return (outact);
12327c478bd9Sstevel@tonic-gate }
12337c478bd9Sstevel@tonic-gate /*
12347c478bd9Sstevel@tonic-gate * compute the combinatoric explosion..
12357c478bd9Sstevel@tonic-gate *
12367c478bd9Sstevel@tonic-gate * we assume a request for encr if esp_req is PREF_REQUIRED
12377c478bd9Sstevel@tonic-gate * we assume a request for ah auth if ah_req is PREF_REQUIRED.
12387c478bd9Sstevel@tonic-gate * we assume a request for esp auth if !ah and esp_req is PREF_REQUIRED
12397c478bd9Sstevel@tonic-gate */
12407c478bd9Sstevel@tonic-gate
12417c478bd9Sstevel@tonic-gate use_ah = act->ipa_apply.ipp_use_ah;
12427c478bd9Sstevel@tonic-gate use_esp = act->ipa_apply.ipp_use_esp;
12437c478bd9Sstevel@tonic-gate use_espa = act->ipa_apply.ipp_use_espa;
12447c478bd9Sstevel@tonic-gate auth_alg = act->ipa_apply.ipp_auth_alg;
12457c478bd9Sstevel@tonic-gate eauth_alg = act->ipa_apply.ipp_esp_auth_alg;
12467c478bd9Sstevel@tonic-gate encr_alg = act->ipa_apply.ipp_encr_alg;
12477c478bd9Sstevel@tonic-gate
12487c478bd9Sstevel@tonic-gate wild_auth = use_ah && (auth_alg == 0);
12497c478bd9Sstevel@tonic-gate wild_eauth = use_espa && (eauth_alg == 0);
12507c478bd9Sstevel@tonic-gate wild_encr = use_esp && (encr_alg == 0);
12517c478bd9Sstevel@tonic-gate
12527c478bd9Sstevel@tonic-gate action_count = 1;
12537c478bd9Sstevel@tonic-gate auth_min = auth_max = auth_alg;
12547c478bd9Sstevel@tonic-gate eauth_min = eauth_max = eauth_alg;
12557c478bd9Sstevel@tonic-gate encr_min = encr_max = encr_alg;
12567c478bd9Sstevel@tonic-gate
12577c478bd9Sstevel@tonic-gate /*
12587c478bd9Sstevel@tonic-gate * set up for explosion.. for each dimension, expand output
12597c478bd9Sstevel@tonic-gate * size by the explosion factor.
12607c478bd9Sstevel@tonic-gate *
12617c478bd9Sstevel@tonic-gate * Don't include the "any" algorithms, if defined, as no
12627c478bd9Sstevel@tonic-gate * kernel policies should be set for these algorithms.
12637c478bd9Sstevel@tonic-gate */
12647c478bd9Sstevel@tonic-gate
1265f4b3ec61Sdh155122 #define SET_EXP_MINMAX(type, wild, alg, min, max, ipss) \
1266f4b3ec61Sdh155122 if (wild) { \
1267f4b3ec61Sdh155122 int nalgs = ipss->ipsec_nalgs[type]; \
1268f4b3ec61Sdh155122 if (ipss->ipsec_alglists[type][alg] != NULL) \
12697c478bd9Sstevel@tonic-gate nalgs--; \
12707c478bd9Sstevel@tonic-gate action_count *= nalgs; \
12717c478bd9Sstevel@tonic-gate min = 0; \
1272f4b3ec61Sdh155122 max = ipss->ipsec_nalgs[type] - 1; \
12737c478bd9Sstevel@tonic-gate }
12747c478bd9Sstevel@tonic-gate
12757c478bd9Sstevel@tonic-gate SET_EXP_MINMAX(IPSEC_ALG_AUTH, wild_auth, SADB_AALG_NONE,
1276f4b3ec61Sdh155122 auth_min, auth_max, ipss);
12777c478bd9Sstevel@tonic-gate SET_EXP_MINMAX(IPSEC_ALG_AUTH, wild_eauth, SADB_AALG_NONE,
1278f4b3ec61Sdh155122 eauth_min, eauth_max, ipss);
12797c478bd9Sstevel@tonic-gate SET_EXP_MINMAX(IPSEC_ALG_ENCR, wild_encr, SADB_EALG_NONE,
1280f4b3ec61Sdh155122 encr_min, encr_max, ipss);
12817c478bd9Sstevel@tonic-gate
12827c478bd9Sstevel@tonic-gate #undef SET_EXP_MINMAX
12837c478bd9Sstevel@tonic-gate
12847c478bd9Sstevel@tonic-gate /*
12857c478bd9Sstevel@tonic-gate * ok, allocate the whole mess..
12867c478bd9Sstevel@tonic-gate */
12877c478bd9Sstevel@tonic-gate
12887c478bd9Sstevel@tonic-gate outact = kmem_alloc(sizeof (*outact) * action_count, KM_NOSLEEP);
12897c478bd9Sstevel@tonic-gate if (outact == NULL)
12907c478bd9Sstevel@tonic-gate return (NULL);
12917c478bd9Sstevel@tonic-gate
12927c478bd9Sstevel@tonic-gate /*
12937c478bd9Sstevel@tonic-gate * Now compute all combinations. Note that non-wildcarded
12947c478bd9Sstevel@tonic-gate * dimensions just get a single value from auth_min, while
12957c478bd9Sstevel@tonic-gate * wildcarded dimensions indirect through the sortlist.
12967c478bd9Sstevel@tonic-gate *
12977c478bd9Sstevel@tonic-gate * We do encryption outermost since, at this time, there's
12987c478bd9Sstevel@tonic-gate * greater difference in security and performance between
12997c478bd9Sstevel@tonic-gate * encryption algorithms vs. authentication algorithms.
13007c478bd9Sstevel@tonic-gate */
13017c478bd9Sstevel@tonic-gate
13027c478bd9Sstevel@tonic-gate ai = 0;
13037c478bd9Sstevel@tonic-gate
1304f4b3ec61Sdh155122 #define WHICH_ALG(type, wild, idx, ipss) \
1305f4b3ec61Sdh155122 ((wild)?(ipss->ipsec_sortlist[type][idx]):(idx))
13067c478bd9Sstevel@tonic-gate
13077c478bd9Sstevel@tonic-gate for (encr_idx = encr_min; encr_idx <= encr_max; encr_idx++) {
1308f4b3ec61Sdh155122 encr_alg = WHICH_ALG(IPSEC_ALG_ENCR, wild_encr, encr_idx, ipss);
13097c478bd9Sstevel@tonic-gate if (wild_encr && encr_alg == SADB_EALG_NONE)
13107c478bd9Sstevel@tonic-gate continue;
13117c478bd9Sstevel@tonic-gate for (auth_idx = auth_min; auth_idx <= auth_max; auth_idx++) {
13127c478bd9Sstevel@tonic-gate auth_alg = WHICH_ALG(IPSEC_ALG_AUTH, wild_auth,
1313f4b3ec61Sdh155122 auth_idx, ipss);
13147c478bd9Sstevel@tonic-gate if (wild_auth && auth_alg == SADB_AALG_NONE)
13157c478bd9Sstevel@tonic-gate continue;
13167c478bd9Sstevel@tonic-gate for (eauth_idx = eauth_min; eauth_idx <= eauth_max;
13177c478bd9Sstevel@tonic-gate eauth_idx++) {
13187c478bd9Sstevel@tonic-gate eauth_alg = WHICH_ALG(IPSEC_ALG_AUTH,
1319f4b3ec61Sdh155122 wild_eauth, eauth_idx, ipss);
13207c478bd9Sstevel@tonic-gate if (wild_eauth && eauth_alg == SADB_AALG_NONE)
13217c478bd9Sstevel@tonic-gate continue;
13227c478bd9Sstevel@tonic-gate
13237c478bd9Sstevel@tonic-gate ipsec_setup_act(&outact[ai], act,
1324f4b3ec61Sdh155122 auth_alg, encr_alg, eauth_alg, ns);
13257c478bd9Sstevel@tonic-gate ai++;
13267c478bd9Sstevel@tonic-gate }
13277c478bd9Sstevel@tonic-gate }
13287c478bd9Sstevel@tonic-gate }
13297c478bd9Sstevel@tonic-gate
13307c478bd9Sstevel@tonic-gate #undef WHICH_ALG
13317c478bd9Sstevel@tonic-gate
13327c478bd9Sstevel@tonic-gate ASSERT(ai == action_count);
13337c478bd9Sstevel@tonic-gate *nact = action_count;
13347c478bd9Sstevel@tonic-gate return (outact);
13357c478bd9Sstevel@tonic-gate }
13367c478bd9Sstevel@tonic-gate
13377c478bd9Sstevel@tonic-gate /*
13387c478bd9Sstevel@tonic-gate * Extract the parts of an ipsec_prot_t from an old-style ipsec_req_t.
13397c478bd9Sstevel@tonic-gate */
13407c478bd9Sstevel@tonic-gate static void
ipsec_prot_from_req(const ipsec_req_t * req,ipsec_prot_t * ipp)13412b24ab6bSSebastien Roy ipsec_prot_from_req(const ipsec_req_t *req, ipsec_prot_t *ipp)
13427c478bd9Sstevel@tonic-gate {
13437c478bd9Sstevel@tonic-gate bzero(ipp, sizeof (*ipp));
13447c478bd9Sstevel@tonic-gate /*
13457c478bd9Sstevel@tonic-gate * ipp_use_* are bitfields. Look at "!!" in the following as a
13467c478bd9Sstevel@tonic-gate * "boolean canonicalization" operator.
13477c478bd9Sstevel@tonic-gate */
13487c478bd9Sstevel@tonic-gate ipp->ipp_use_ah = !!(req->ipsr_ah_req & IPSEC_PREF_REQUIRED);
13497c478bd9Sstevel@tonic-gate ipp->ipp_use_esp = !!(req->ipsr_esp_req & IPSEC_PREF_REQUIRED);
1350d2f8a3dfSpwernau ipp->ipp_use_espa = !!(req->ipsr_esp_auth_alg);
13517c478bd9Sstevel@tonic-gate ipp->ipp_use_se = !!(req->ipsr_self_encap_req & IPSEC_PREF_REQUIRED);
13527c478bd9Sstevel@tonic-gate ipp->ipp_use_unique = !!((req->ipsr_ah_req|req->ipsr_esp_req) &
13537c478bd9Sstevel@tonic-gate IPSEC_PREF_UNIQUE);
13547c478bd9Sstevel@tonic-gate ipp->ipp_encr_alg = req->ipsr_esp_alg;
1355d2f8a3dfSpwernau /*
1356d2f8a3dfSpwernau * SADB_AALG_ANY is a placeholder to distinguish "any" from
1357d2f8a3dfSpwernau * "none" above. If auth is required, as determined above,
1358d2f8a3dfSpwernau * SADB_AALG_ANY becomes 0, which is the representation
1359d2f8a3dfSpwernau * of "any" and "none" in PF_KEY v2.
1360d2f8a3dfSpwernau */
1361d2f8a3dfSpwernau ipp->ipp_auth_alg = (req->ipsr_auth_alg != SADB_AALG_ANY) ?
1362d2f8a3dfSpwernau req->ipsr_auth_alg : 0;
1363d2f8a3dfSpwernau ipp->ipp_esp_auth_alg = (req->ipsr_esp_auth_alg != SADB_AALG_ANY) ?
1364d2f8a3dfSpwernau req->ipsr_esp_auth_alg : 0;
13657c478bd9Sstevel@tonic-gate }
13667c478bd9Sstevel@tonic-gate
13677c478bd9Sstevel@tonic-gate /*
13687c478bd9Sstevel@tonic-gate * Extract a new-style action from a request.
13697c478bd9Sstevel@tonic-gate */
13707c478bd9Sstevel@tonic-gate void
ipsec_actvec_from_req(const ipsec_req_t * req,ipsec_act_t ** actp,uint_t * nactp,netstack_t * ns)13712b24ab6bSSebastien Roy ipsec_actvec_from_req(const ipsec_req_t *req, ipsec_act_t **actp, uint_t *nactp,
1372f4b3ec61Sdh155122 netstack_t *ns)
13737c478bd9Sstevel@tonic-gate {
13747c478bd9Sstevel@tonic-gate struct ipsec_act act;
1375f4b3ec61Sdh155122
13767c478bd9Sstevel@tonic-gate bzero(&act, sizeof (act));
13777c478bd9Sstevel@tonic-gate if ((req->ipsr_ah_req & IPSEC_PREF_NEVER) &&
13787c478bd9Sstevel@tonic-gate (req->ipsr_esp_req & IPSEC_PREF_NEVER)) {
13797c478bd9Sstevel@tonic-gate act.ipa_type = IPSEC_ACT_BYPASS;
13807c478bd9Sstevel@tonic-gate } else {
13817c478bd9Sstevel@tonic-gate act.ipa_type = IPSEC_ACT_APPLY;
13827c478bd9Sstevel@tonic-gate ipsec_prot_from_req(req, &act.ipa_apply);
13837c478bd9Sstevel@tonic-gate }
1384f4b3ec61Sdh155122 *actp = ipsec_act_wildcard_expand(&act, nactp, ns);
13857c478bd9Sstevel@tonic-gate }
13867c478bd9Sstevel@tonic-gate
13877c478bd9Sstevel@tonic-gate /*
13887c478bd9Sstevel@tonic-gate * Convert a new-style "prot" back to an ipsec_req_t (more backwards compat).
13897c478bd9Sstevel@tonic-gate * We assume caller has already zero'ed *req for us.
13907c478bd9Sstevel@tonic-gate */
13917c478bd9Sstevel@tonic-gate static int
ipsec_req_from_prot(ipsec_prot_t * ipp,ipsec_req_t * req)13927c478bd9Sstevel@tonic-gate ipsec_req_from_prot(ipsec_prot_t *ipp, ipsec_req_t *req)
13937c478bd9Sstevel@tonic-gate {
13947c478bd9Sstevel@tonic-gate req->ipsr_esp_alg = ipp->ipp_encr_alg;
13957c478bd9Sstevel@tonic-gate req->ipsr_auth_alg = ipp->ipp_auth_alg;
13967c478bd9Sstevel@tonic-gate req->ipsr_esp_auth_alg = ipp->ipp_esp_auth_alg;
13977c478bd9Sstevel@tonic-gate
13987c478bd9Sstevel@tonic-gate if (ipp->ipp_use_unique) {
13997c478bd9Sstevel@tonic-gate req->ipsr_ah_req |= IPSEC_PREF_UNIQUE;
14007c478bd9Sstevel@tonic-gate req->ipsr_esp_req |= IPSEC_PREF_UNIQUE;
14017c478bd9Sstevel@tonic-gate }
14027c478bd9Sstevel@tonic-gate if (ipp->ipp_use_se)
14037c478bd9Sstevel@tonic-gate req->ipsr_self_encap_req |= IPSEC_PREF_REQUIRED;
14047c478bd9Sstevel@tonic-gate if (ipp->ipp_use_ah)
14057c478bd9Sstevel@tonic-gate req->ipsr_ah_req |= IPSEC_PREF_REQUIRED;
14067c478bd9Sstevel@tonic-gate if (ipp->ipp_use_esp)
14077c478bd9Sstevel@tonic-gate req->ipsr_esp_req |= IPSEC_PREF_REQUIRED;
14087c478bd9Sstevel@tonic-gate return (sizeof (*req));
14097c478bd9Sstevel@tonic-gate }
14107c478bd9Sstevel@tonic-gate
14117c478bd9Sstevel@tonic-gate /*
14127c478bd9Sstevel@tonic-gate * Convert a new-style action back to an ipsec_req_t (more backwards compat).
14137c478bd9Sstevel@tonic-gate * We assume caller has already zero'ed *req for us.
14147c478bd9Sstevel@tonic-gate */
14157c478bd9Sstevel@tonic-gate static int
ipsec_req_from_act(ipsec_action_t * ap,ipsec_req_t * req)14167c478bd9Sstevel@tonic-gate ipsec_req_from_act(ipsec_action_t *ap, ipsec_req_t *req)
14177c478bd9Sstevel@tonic-gate {
14187c478bd9Sstevel@tonic-gate switch (ap->ipa_act.ipa_type) {
14197c478bd9Sstevel@tonic-gate case IPSEC_ACT_BYPASS:
14207c478bd9Sstevel@tonic-gate req->ipsr_ah_req = IPSEC_PREF_NEVER;
14217c478bd9Sstevel@tonic-gate req->ipsr_esp_req = IPSEC_PREF_NEVER;
14227c478bd9Sstevel@tonic-gate return (sizeof (*req));
14237c478bd9Sstevel@tonic-gate case IPSEC_ACT_APPLY:
14247c478bd9Sstevel@tonic-gate return (ipsec_req_from_prot(&ap->ipa_act.ipa_apply, req));
14257c478bd9Sstevel@tonic-gate }
14267c478bd9Sstevel@tonic-gate return (sizeof (*req));
14277c478bd9Sstevel@tonic-gate }
14287c478bd9Sstevel@tonic-gate
14297c478bd9Sstevel@tonic-gate /*
14307c478bd9Sstevel@tonic-gate * Convert a new-style action back to an ipsec_req_t (more backwards compat).
14317c478bd9Sstevel@tonic-gate * We assume caller has already zero'ed *req for us.
14327c478bd9Sstevel@tonic-gate */
14338810c16bSdanmcd int
ipsec_req_from_head(ipsec_policy_head_t * ph,ipsec_req_t * req,int af)14347c478bd9Sstevel@tonic-gate ipsec_req_from_head(ipsec_policy_head_t *ph, ipsec_req_t *req, int af)
14357c478bd9Sstevel@tonic-gate {
14367c478bd9Sstevel@tonic-gate ipsec_policy_t *p;
14377c478bd9Sstevel@tonic-gate
14386a182920Ssommerfe /*
14396a182920Ssommerfe * FULL-PERSOCK: consult hash table, too?
14406a182920Ssommerfe */
14416a182920Ssommerfe for (p = ph->iph_root[IPSEC_INBOUND].ipr_nonhash[af];
14427c478bd9Sstevel@tonic-gate p != NULL;
14436a182920Ssommerfe p = p->ipsp_hash.hash_next) {
14447c478bd9Sstevel@tonic-gate if ((p->ipsp_sel->ipsl_key.ipsl_valid & IPSL_WILDCARD) == 0)
14457c478bd9Sstevel@tonic-gate return (ipsec_req_from_act(p->ipsp_act, req));
14467c478bd9Sstevel@tonic-gate }
14477c478bd9Sstevel@tonic-gate return (sizeof (*req));
14487c478bd9Sstevel@tonic-gate }
14497c478bd9Sstevel@tonic-gate
14507c478bd9Sstevel@tonic-gate /*
14517c478bd9Sstevel@tonic-gate * Based on per-socket or latched policy, convert to an appropriate
14527c478bd9Sstevel@tonic-gate * IP_SEC_OPT ipsec_req_t for the socket option; return size so we can
14537c478bd9Sstevel@tonic-gate * be tail-called from ip.
14547c478bd9Sstevel@tonic-gate */
14557c478bd9Sstevel@tonic-gate int
ipsec_req_from_conn(conn_t * connp,ipsec_req_t * req,int af)14567c478bd9Sstevel@tonic-gate ipsec_req_from_conn(conn_t *connp, ipsec_req_t *req, int af)
14577c478bd9Sstevel@tonic-gate {
14587c478bd9Sstevel@tonic-gate ipsec_latch_t *ipl;
14597c478bd9Sstevel@tonic-gate int rv = sizeof (ipsec_req_t);
14607c478bd9Sstevel@tonic-gate
14617c478bd9Sstevel@tonic-gate bzero(req, sizeof (*req));
14627c478bd9Sstevel@tonic-gate
1463bd670b35SErik Nordmark ASSERT(MUTEX_HELD(&connp->conn_lock));
14647c478bd9Sstevel@tonic-gate ipl = connp->conn_latch;
14657c478bd9Sstevel@tonic-gate
14667c478bd9Sstevel@tonic-gate /*
14677c478bd9Sstevel@tonic-gate * Find appropriate policy. First choice is latched action;
14687c478bd9Sstevel@tonic-gate * failing that, see latched policy; failing that,
14697c478bd9Sstevel@tonic-gate * look at configured policy.
14707c478bd9Sstevel@tonic-gate */
14717c478bd9Sstevel@tonic-gate if (ipl != NULL) {
1472bd670b35SErik Nordmark if (connp->conn_latch_in_action != NULL) {
1473bd670b35SErik Nordmark rv = ipsec_req_from_act(connp->conn_latch_in_action,
1474bd670b35SErik Nordmark req);
14757c478bd9Sstevel@tonic-gate goto done;
14767c478bd9Sstevel@tonic-gate }
1477bd670b35SErik Nordmark if (connp->conn_latch_in_policy != NULL) {
1478bd670b35SErik Nordmark rv = ipsec_req_from_act(
1479bd670b35SErik Nordmark connp->conn_latch_in_policy->ipsp_act, req);
14807c478bd9Sstevel@tonic-gate goto done;
14817c478bd9Sstevel@tonic-gate }
14827c478bd9Sstevel@tonic-gate }
14837c478bd9Sstevel@tonic-gate if (connp->conn_policy != NULL)
14847c478bd9Sstevel@tonic-gate rv = ipsec_req_from_head(connp->conn_policy, req, af);
14857c478bd9Sstevel@tonic-gate done:
14867c478bd9Sstevel@tonic-gate return (rv);
14877c478bd9Sstevel@tonic-gate }
14887c478bd9Sstevel@tonic-gate
14897c478bd9Sstevel@tonic-gate void
ipsec_actvec_free(ipsec_act_t * act,uint_t nact)14907c478bd9Sstevel@tonic-gate ipsec_actvec_free(ipsec_act_t *act, uint_t nact)
14917c478bd9Sstevel@tonic-gate {
14927c478bd9Sstevel@tonic-gate kmem_free(act, nact * sizeof (*act));
14937c478bd9Sstevel@tonic-gate }
14947c478bd9Sstevel@tonic-gate
14957c478bd9Sstevel@tonic-gate /*
14967c478bd9Sstevel@tonic-gate * Consumes a reference to ipsp.
14977c478bd9Sstevel@tonic-gate */
14987c478bd9Sstevel@tonic-gate static mblk_t *
ipsec_check_loopback_policy(mblk_t * data_mp,ip_recv_attr_t * ira,ipsec_policy_t * ipsp)1499bd670b35SErik Nordmark ipsec_check_loopback_policy(mblk_t *data_mp, ip_recv_attr_t *ira,
150032350c00Sdanmcd ipsec_policy_t *ipsp)
15017c478bd9Sstevel@tonic-gate {
1502bd670b35SErik Nordmark if (!(ira->ira_flags & IRAF_IPSEC_SECURE))
1503bd670b35SErik Nordmark return (data_mp);
15047c478bd9Sstevel@tonic-gate
1505bd670b35SErik Nordmark ASSERT(ira->ira_flags & IRAF_LOOPBACK);
15067c478bd9Sstevel@tonic-gate
1507bd670b35SErik Nordmark IPPOL_REFRELE(ipsp);
15087c478bd9Sstevel@tonic-gate
15097c478bd9Sstevel@tonic-gate /*
15107c478bd9Sstevel@tonic-gate * We should do an actual policy check here. Revisit this
151132350c00Sdanmcd * when we revisit the IPsec API. (And pass a conn_t in when we
151232350c00Sdanmcd * get there.)
15137c478bd9Sstevel@tonic-gate */
15147c478bd9Sstevel@tonic-gate
1515bd670b35SErik Nordmark return (data_mp);
15167c478bd9Sstevel@tonic-gate }
15177c478bd9Sstevel@tonic-gate
151807b56925Ssommerfe /*
151907b56925Ssommerfe * Check that packet's inbound ports & proto match the selectors
152007b56925Ssommerfe * expected by the SAs it traversed on the way in.
152107b56925Ssommerfe */
152207b56925Ssommerfe static boolean_t
ipsec_check_ipsecin_unique(ip_recv_attr_t * ira,const char ** reason,kstat_named_t ** counter,uint64_t pkt_unique,netstack_t * ns)1523bd670b35SErik Nordmark ipsec_check_ipsecin_unique(ip_recv_attr_t *ira, const char **reason,
1524bd670b35SErik Nordmark kstat_named_t **counter, uint64_t pkt_unique, netstack_t *ns)
152507b56925Ssommerfe {
15268810c16bSdanmcd uint64_t ah_mask, esp_mask;
15279c7c47efSsommerfe ipsa_t *ah_assoc;
15289c7c47efSsommerfe ipsa_t *esp_assoc;
1529f4b3ec61Sdh155122 ipsec_stack_t *ipss = ns->netstack_ipsec;
153007b56925Ssommerfe
1531bd670b35SErik Nordmark ASSERT(ira->ira_flags & IRAF_IPSEC_SECURE);
1532bd670b35SErik Nordmark ASSERT(!(ira->ira_flags & IRAF_LOOPBACK));
15339c7c47efSsommerfe
1534bd670b35SErik Nordmark ah_assoc = ira->ira_ipsec_ah_sa;
1535bd670b35SErik Nordmark esp_assoc = ira->ira_ipsec_esp_sa;
153607b56925Ssommerfe ASSERT((ah_assoc != NULL) || (esp_assoc != NULL));
153707b56925Ssommerfe
153807b56925Ssommerfe ah_mask = (ah_assoc != NULL) ? ah_assoc->ipsa_unique_mask : 0;
153907b56925Ssommerfe esp_mask = (esp_assoc != NULL) ? esp_assoc->ipsa_unique_mask : 0;
154007b56925Ssommerfe
154107b56925Ssommerfe if ((ah_mask == 0) && (esp_mask == 0))
154207b56925Ssommerfe return (B_TRUE);
154307b56925Ssommerfe
154407b56925Ssommerfe /*
15458810c16bSdanmcd * The pkt_unique check will also check for tunnel mode on the SA
15468810c16bSdanmcd * vs. the tunneled_packet boolean. "Be liberal in what you receive"
15478810c16bSdanmcd * should not apply in this case. ;)
154807b56925Ssommerfe */
154907b56925Ssommerfe
15508810c16bSdanmcd if (ah_mask != 0 &&
15518810c16bSdanmcd ah_assoc->ipsa_unique_id != (pkt_unique & ah_mask)) {
155207b56925Ssommerfe *reason = "AH inner header mismatch";
1553f4b3ec61Sdh155122 *counter = DROPPER(ipss, ipds_spd_ah_innermismatch);
155407b56925Ssommerfe return (B_FALSE);
155507b56925Ssommerfe }
15568810c16bSdanmcd if (esp_mask != 0 &&
15578810c16bSdanmcd esp_assoc->ipsa_unique_id != (pkt_unique & esp_mask)) {
155807b56925Ssommerfe *reason = "ESP inner header mismatch";
1559f4b3ec61Sdh155122 *counter = DROPPER(ipss, ipds_spd_esp_innermismatch);
156007b56925Ssommerfe return (B_FALSE);
156107b56925Ssommerfe }
156207b56925Ssommerfe return (B_TRUE);
156307b56925Ssommerfe }
156407b56925Ssommerfe
15657c478bd9Sstevel@tonic-gate static boolean_t
ipsec_check_ipsecin_action(ip_recv_attr_t * ira,mblk_t * mp,ipsec_action_t * ap,ipha_t * ipha,ip6_t * ip6h,const char ** reason,kstat_named_t ** counter,netstack_t * ns)1566bd670b35SErik Nordmark ipsec_check_ipsecin_action(ip_recv_attr_t *ira, mblk_t *mp, ipsec_action_t *ap,
1567bd670b35SErik Nordmark ipha_t *ipha, ip6_t *ip6h, const char **reason, kstat_named_t **counter,
1568bd670b35SErik Nordmark netstack_t *ns)
15697c478bd9Sstevel@tonic-gate {
15707c478bd9Sstevel@tonic-gate boolean_t ret = B_TRUE;
15717c478bd9Sstevel@tonic-gate ipsec_prot_t *ipp;
15727c478bd9Sstevel@tonic-gate ipsa_t *ah_assoc;
15737c478bd9Sstevel@tonic-gate ipsa_t *esp_assoc;
15747c478bd9Sstevel@tonic-gate boolean_t decaps;
1575f4b3ec61Sdh155122 ipsec_stack_t *ipss = ns->netstack_ipsec;
15767c478bd9Sstevel@tonic-gate
15777c478bd9Sstevel@tonic-gate ASSERT((ipha == NULL && ip6h != NULL) ||
15787c478bd9Sstevel@tonic-gate (ip6h == NULL && ipha != NULL));
15797c478bd9Sstevel@tonic-gate
1580bd670b35SErik Nordmark if (ira->ira_flags & IRAF_LOOPBACK) {
15817c478bd9Sstevel@tonic-gate /*
15827c478bd9Sstevel@tonic-gate * Besides accepting pointer-equivalent actions, we also
15837c478bd9Sstevel@tonic-gate * accept any ICMP errors we generated for ourselves,
15847c478bd9Sstevel@tonic-gate * regardless of policy. If we do not wish to make this
15857c478bd9Sstevel@tonic-gate * assumption in the future, check here, and where
1586bd670b35SErik Nordmark * IXAF_TRUSTED_ICMP is initialized in ip.c and ip6.c.
15877c478bd9Sstevel@tonic-gate */
1588bd670b35SErik Nordmark if (ap == ira->ira_ipsec_action ||
1589bd670b35SErik Nordmark (ira->ira_flags & IRAF_TRUSTED_ICMP))
15907c478bd9Sstevel@tonic-gate return (B_TRUE);
15917c478bd9Sstevel@tonic-gate
15927c478bd9Sstevel@tonic-gate /* Deep compare necessary here?? */
1593f4b3ec61Sdh155122 *counter = DROPPER(ipss, ipds_spd_loopback_mismatch);
15947c478bd9Sstevel@tonic-gate *reason = "loopback policy mismatch";
15957c478bd9Sstevel@tonic-gate return (B_FALSE);
15967c478bd9Sstevel@tonic-gate }
1597bd670b35SErik Nordmark ASSERT(!(ira->ira_flags & IRAF_TRUSTED_ICMP));
1598bd670b35SErik Nordmark ASSERT(ira->ira_flags & IRAF_IPSEC_SECURE);
15997c478bd9Sstevel@tonic-gate
1600bd670b35SErik Nordmark ah_assoc = ira->ira_ipsec_ah_sa;
1601bd670b35SErik Nordmark esp_assoc = ira->ira_ipsec_esp_sa;
16027c478bd9Sstevel@tonic-gate
1603bd670b35SErik Nordmark decaps = (ira->ira_flags & IRAF_IPSEC_DECAPS);
16047c478bd9Sstevel@tonic-gate
16057c478bd9Sstevel@tonic-gate switch (ap->ipa_act.ipa_type) {
16067c478bd9Sstevel@tonic-gate case IPSEC_ACT_DISCARD:
16077c478bd9Sstevel@tonic-gate case IPSEC_ACT_REJECT:
16087c478bd9Sstevel@tonic-gate /* Should "fail hard" */
1609f4b3ec61Sdh155122 *counter = DROPPER(ipss, ipds_spd_explicit);
16107c478bd9Sstevel@tonic-gate *reason = "blocked by policy";
16117c478bd9Sstevel@tonic-gate return (B_FALSE);
16127c478bd9Sstevel@tonic-gate
16137c478bd9Sstevel@tonic-gate case IPSEC_ACT_BYPASS:
16147c478bd9Sstevel@tonic-gate case IPSEC_ACT_CLEAR:
1615f4b3ec61Sdh155122 *counter = DROPPER(ipss, ipds_spd_got_secure);
16167c478bd9Sstevel@tonic-gate *reason = "expected clear, got protected";
16177c478bd9Sstevel@tonic-gate return (B_FALSE);
16187c478bd9Sstevel@tonic-gate
16197c478bd9Sstevel@tonic-gate case IPSEC_ACT_APPLY:
16207c478bd9Sstevel@tonic-gate ipp = &ap->ipa_act.ipa_apply;
16217c478bd9Sstevel@tonic-gate /*
16227c478bd9Sstevel@tonic-gate * As of now we do the simple checks of whether
16237c478bd9Sstevel@tonic-gate * the datagram has gone through the required IPSEC
16247c478bd9Sstevel@tonic-gate * protocol constraints or not. We might have more
16257c478bd9Sstevel@tonic-gate * in the future like sensitive levels, key bits, etc.
16267c478bd9Sstevel@tonic-gate * If it fails the constraints, check whether we would
16277c478bd9Sstevel@tonic-gate * have accepted this if it had come in clear.
16287c478bd9Sstevel@tonic-gate */
16297c478bd9Sstevel@tonic-gate if (ipp->ipp_use_ah) {
16307c478bd9Sstevel@tonic-gate if (ah_assoc == NULL) {
16317c478bd9Sstevel@tonic-gate ret = ipsec_inbound_accept_clear(mp, ipha,
16327c478bd9Sstevel@tonic-gate ip6h);
1633f4b3ec61Sdh155122 *counter = DROPPER(ipss, ipds_spd_got_clear);
16347c478bd9Sstevel@tonic-gate *reason = "unprotected not accepted";
16357c478bd9Sstevel@tonic-gate break;
16367c478bd9Sstevel@tonic-gate }
16377c478bd9Sstevel@tonic-gate ASSERT(ah_assoc != NULL);
16387c478bd9Sstevel@tonic-gate ASSERT(ipp->ipp_auth_alg != 0);
16397c478bd9Sstevel@tonic-gate
16407c478bd9Sstevel@tonic-gate if (ah_assoc->ipsa_auth_alg !=
16417c478bd9Sstevel@tonic-gate ipp->ipp_auth_alg) {
1642f4b3ec61Sdh155122 *counter = DROPPER(ipss, ipds_spd_bad_ahalg);
16437c478bd9Sstevel@tonic-gate *reason = "unacceptable ah alg";
16447c478bd9Sstevel@tonic-gate ret = B_FALSE;
16457c478bd9Sstevel@tonic-gate break;
16467c478bd9Sstevel@tonic-gate }
16477c478bd9Sstevel@tonic-gate } else if (ah_assoc != NULL) {
16487c478bd9Sstevel@tonic-gate /*
16497c478bd9Sstevel@tonic-gate * Don't allow this. Check IPSEC NOTE above
16507c478bd9Sstevel@tonic-gate * ip_fanout_proto().
16517c478bd9Sstevel@tonic-gate */
1652f4b3ec61Sdh155122 *counter = DROPPER(ipss, ipds_spd_got_ah);
16537c478bd9Sstevel@tonic-gate *reason = "unexpected AH";
16547c478bd9Sstevel@tonic-gate ret = B_FALSE;
16557c478bd9Sstevel@tonic-gate break;
16567c478bd9Sstevel@tonic-gate }
16577c478bd9Sstevel@tonic-gate if (ipp->ipp_use_esp) {
16587c478bd9Sstevel@tonic-gate if (esp_assoc == NULL) {
16597c478bd9Sstevel@tonic-gate ret = ipsec_inbound_accept_clear(mp, ipha,
16607c478bd9Sstevel@tonic-gate ip6h);
1661f4b3ec61Sdh155122 *counter = DROPPER(ipss, ipds_spd_got_clear);
16627c478bd9Sstevel@tonic-gate *reason = "unprotected not accepted";
16637c478bd9Sstevel@tonic-gate break;
16647c478bd9Sstevel@tonic-gate }
16657c478bd9Sstevel@tonic-gate ASSERT(esp_assoc != NULL);
16667c478bd9Sstevel@tonic-gate ASSERT(ipp->ipp_encr_alg != 0);
16677c478bd9Sstevel@tonic-gate
16687c478bd9Sstevel@tonic-gate if (esp_assoc->ipsa_encr_alg !=
16697c478bd9Sstevel@tonic-gate ipp->ipp_encr_alg) {
1670f4b3ec61Sdh155122 *counter = DROPPER(ipss, ipds_spd_bad_espealg);
16717c478bd9Sstevel@tonic-gate *reason = "unacceptable esp alg";
16727c478bd9Sstevel@tonic-gate ret = B_FALSE;
16737c478bd9Sstevel@tonic-gate break;
16747c478bd9Sstevel@tonic-gate }
16757c478bd9Sstevel@tonic-gate /*
16767c478bd9Sstevel@tonic-gate * If the client does not need authentication,
16777c478bd9Sstevel@tonic-gate * we don't verify the alogrithm.
16787c478bd9Sstevel@tonic-gate */
16797c478bd9Sstevel@tonic-gate if (ipp->ipp_use_espa) {
16807c478bd9Sstevel@tonic-gate if (esp_assoc->ipsa_auth_alg !=
16817c478bd9Sstevel@tonic-gate ipp->ipp_esp_auth_alg) {
1682f4b3ec61Sdh155122 *counter = DROPPER(ipss,
1683f4b3ec61Sdh155122 ipds_spd_bad_espaalg);
16847c478bd9Sstevel@tonic-gate *reason = "unacceptable esp auth alg";
16857c478bd9Sstevel@tonic-gate ret = B_FALSE;
16867c478bd9Sstevel@tonic-gate break;
16877c478bd9Sstevel@tonic-gate }
16887c478bd9Sstevel@tonic-gate }
16897c478bd9Sstevel@tonic-gate } else if (esp_assoc != NULL) {
16907c478bd9Sstevel@tonic-gate /*
16917c478bd9Sstevel@tonic-gate * Don't allow this. Check IPSEC NOTE above
16927c478bd9Sstevel@tonic-gate * ip_fanout_proto().
16937c478bd9Sstevel@tonic-gate */
1694f4b3ec61Sdh155122 *counter = DROPPER(ipss, ipds_spd_got_esp);
16957c478bd9Sstevel@tonic-gate *reason = "unexpected ESP";
16967c478bd9Sstevel@tonic-gate ret = B_FALSE;
16977c478bd9Sstevel@tonic-gate break;
16987c478bd9Sstevel@tonic-gate }
16997c478bd9Sstevel@tonic-gate if (ipp->ipp_use_se) {
17007c478bd9Sstevel@tonic-gate if (!decaps) {
17017c478bd9Sstevel@tonic-gate ret = ipsec_inbound_accept_clear(mp, ipha,
17027c478bd9Sstevel@tonic-gate ip6h);
17037c478bd9Sstevel@tonic-gate if (!ret) {
17047c478bd9Sstevel@tonic-gate /* XXX mutant? */
1705f4b3ec61Sdh155122 *counter = DROPPER(ipss,
1706f4b3ec61Sdh155122 ipds_spd_bad_selfencap);
17077c478bd9Sstevel@tonic-gate *reason = "self encap not found";
17087c478bd9Sstevel@tonic-gate break;
17097c478bd9Sstevel@tonic-gate }
17107c478bd9Sstevel@tonic-gate }
17117c478bd9Sstevel@tonic-gate } else if (decaps) {
17127c478bd9Sstevel@tonic-gate /*
17137c478bd9Sstevel@tonic-gate * XXX If the packet comes in tunneled and the
17147c478bd9Sstevel@tonic-gate * recipient does not expect it to be tunneled, it
17157c478bd9Sstevel@tonic-gate * is okay. But we drop to be consistent with the
17167c478bd9Sstevel@tonic-gate * other cases.
17177c478bd9Sstevel@tonic-gate */
1718f4b3ec61Sdh155122 *counter = DROPPER(ipss, ipds_spd_got_selfencap);
17197c478bd9Sstevel@tonic-gate *reason = "unexpected self encap";
17207c478bd9Sstevel@tonic-gate ret = B_FALSE;
17217c478bd9Sstevel@tonic-gate break;
17227c478bd9Sstevel@tonic-gate }
1723bd670b35SErik Nordmark if (ira->ira_ipsec_action != NULL) {
17247c478bd9Sstevel@tonic-gate /*
17257c478bd9Sstevel@tonic-gate * This can happen if we do a double policy-check on
17267c478bd9Sstevel@tonic-gate * a packet
17277c478bd9Sstevel@tonic-gate * XXX XXX should fix this case!
17287c478bd9Sstevel@tonic-gate */
1729bd670b35SErik Nordmark IPACT_REFRELE(ira->ira_ipsec_action);
17307c478bd9Sstevel@tonic-gate }
1731bd670b35SErik Nordmark ASSERT(ira->ira_flags & IRAF_IPSEC_SECURE);
1732bd670b35SErik Nordmark ASSERT(ira->ira_ipsec_action == NULL);
17337c478bd9Sstevel@tonic-gate IPACT_REFHOLD(ap);
1734bd670b35SErik Nordmark ira->ira_ipsec_action = ap;
17357c478bd9Sstevel@tonic-gate break; /* from switch */
17367c478bd9Sstevel@tonic-gate }
17377c478bd9Sstevel@tonic-gate return (ret);
17387c478bd9Sstevel@tonic-gate }
17397c478bd9Sstevel@tonic-gate
17407c478bd9Sstevel@tonic-gate static boolean_t
spd_match_inbound_ids(ipsec_latch_t * ipl,ipsa_t * sa)17417c478bd9Sstevel@tonic-gate spd_match_inbound_ids(ipsec_latch_t *ipl, ipsa_t *sa)
17427c478bd9Sstevel@tonic-gate {
17437c478bd9Sstevel@tonic-gate ASSERT(ipl->ipl_ids_latched == B_TRUE);
17447c478bd9Sstevel@tonic-gate return ipsid_equal(ipl->ipl_remote_cid, sa->ipsa_src_cid) &&
17457c478bd9Sstevel@tonic-gate ipsid_equal(ipl->ipl_local_cid, sa->ipsa_dst_cid);
17467c478bd9Sstevel@tonic-gate }
17477c478bd9Sstevel@tonic-gate
17487c478bd9Sstevel@tonic-gate /*
17498810c16bSdanmcd * Takes a latched conn and an inbound packet and returns a unique_id suitable
17508810c16bSdanmcd * for SA comparisons. Most of the time we will copy from the conn_t, but
17518810c16bSdanmcd * there are cases when the conn_t is latched but it has wildcard selectors,
17528810c16bSdanmcd * and then we need to fallback to scooping them out of the packet.
17538810c16bSdanmcd *
17548810c16bSdanmcd * Assume we'll never have 0 with a conn_t present, so use 0 as a failure. We
17558810c16bSdanmcd * can get away with this because we only have non-zero ports/proto for
17568810c16bSdanmcd * latched conn_ts.
17578810c16bSdanmcd *
17588810c16bSdanmcd * Ideal candidate for an "inline" keyword, as we're JUST convoluted enough
17598810c16bSdanmcd * to not be a nice macro.
17608810c16bSdanmcd */
17618810c16bSdanmcd static uint64_t
conn_to_unique(conn_t * connp,mblk_t * data_mp,ipha_t * ipha,ip6_t * ip6h)17628810c16bSdanmcd conn_to_unique(conn_t *connp, mblk_t *data_mp, ipha_t *ipha, ip6_t *ip6h)
17638810c16bSdanmcd {
17648810c16bSdanmcd ipsec_selector_t sel;
1765bd670b35SErik Nordmark uint8_t ulp = connp->conn_proto;
17668810c16bSdanmcd
1767bd670b35SErik Nordmark ASSERT(connp->conn_latch_in_policy != NULL);
17688810c16bSdanmcd
17698810c16bSdanmcd if ((ulp == IPPROTO_TCP || ulp == IPPROTO_UDP || ulp == IPPROTO_SCTP) &&
17708810c16bSdanmcd (connp->conn_fport == 0 || connp->conn_lport == 0)) {
17718810c16bSdanmcd /* Slow path - we gotta grab from the packet. */
17728810c16bSdanmcd if (ipsec_init_inbound_sel(&sel, data_mp, ipha, ip6h,
17738810c16bSdanmcd SEL_NONE) != SELRET_SUCCESS) {
17748810c16bSdanmcd /* Failure -> have caller free packet with ENOMEM. */
17758810c16bSdanmcd return (0);
17768810c16bSdanmcd }
17778810c16bSdanmcd return (SA_UNIQUE_ID(sel.ips_remote_port, sel.ips_local_port,
17788810c16bSdanmcd sel.ips_protocol, 0));
17798810c16bSdanmcd }
17808810c16bSdanmcd
17818810c16bSdanmcd #ifdef DEBUG_NOT_UNTIL_6478464
17828810c16bSdanmcd if (ipsec_init_inbound_sel(&sel, data_mp, ipha, ip6h, SEL_NONE) ==
17838810c16bSdanmcd SELRET_SUCCESS) {
17848810c16bSdanmcd ASSERT(sel.ips_local_port == connp->conn_lport);
17858810c16bSdanmcd ASSERT(sel.ips_remote_port == connp->conn_fport);
1786bd670b35SErik Nordmark ASSERT(sel.ips_protocol == connp->conn_proto);
17878810c16bSdanmcd }
1788bd670b35SErik Nordmark ASSERT(connp->conn_proto != 0);
17898810c16bSdanmcd #endif
17908810c16bSdanmcd
17918810c16bSdanmcd return (SA_UNIQUE_ID(connp->conn_fport, connp->conn_lport, ulp, 0));
17928810c16bSdanmcd }
17938810c16bSdanmcd
17948810c16bSdanmcd /*
1795bd670b35SErik Nordmark * Called to check policy on a latched connection.
1796bd670b35SErik Nordmark * Note that we don't dereference conn_latch or conn_ihere since the conn might
1797bd670b35SErik Nordmark * be closing. The caller passes a held ipsec_latch_t instead.
17987c478bd9Sstevel@tonic-gate */
1799bd670b35SErik Nordmark static boolean_t
ipsec_check_ipsecin_latch(ip_recv_attr_t * ira,mblk_t * mp,ipsec_latch_t * ipl,ipsec_action_t * ap,ipha_t * ipha,ip6_t * ip6h,const char ** reason,kstat_named_t ** counter,conn_t * connp,netstack_t * ns)1800bd670b35SErik Nordmark ipsec_check_ipsecin_latch(ip_recv_attr_t *ira, mblk_t *mp, ipsec_latch_t *ipl,
1801bd670b35SErik Nordmark ipsec_action_t *ap, ipha_t *ipha, ip6_t *ip6h, const char **reason,
1802bd670b35SErik Nordmark kstat_named_t **counter, conn_t *connp, netstack_t *ns)
18037c478bd9Sstevel@tonic-gate {
1804f4b3ec61Sdh155122 ipsec_stack_t *ipss = ns->netstack_ipsec;
1805f4b3ec61Sdh155122
18067c478bd9Sstevel@tonic-gate ASSERT(ipl->ipl_ids_latched == B_TRUE);
1807bd670b35SErik Nordmark ASSERT(ira->ira_flags & IRAF_IPSEC_SECURE);
18087c478bd9Sstevel@tonic-gate
1809bd670b35SErik Nordmark if (!(ira->ira_flags & IRAF_LOOPBACK)) {
18109c7c47efSsommerfe /*
18119c7c47efSsommerfe * Over loopback, there aren't real security associations,
18129c7c47efSsommerfe * so there are neither identities nor "unique" values
18139c7c47efSsommerfe * for us to check the packet against.
18149c7c47efSsommerfe */
1815bd670b35SErik Nordmark if (ira->ira_ipsec_ah_sa != NULL) {
1816bd670b35SErik Nordmark if (!spd_match_inbound_ids(ipl,
1817bd670b35SErik Nordmark ira->ira_ipsec_ah_sa)) {
1818f4b3ec61Sdh155122 *counter = DROPPER(ipss, ipds_spd_ah_badid);
18197c478bd9Sstevel@tonic-gate *reason = "AH identity mismatch";
18207c478bd9Sstevel@tonic-gate return (B_FALSE);
18217c478bd9Sstevel@tonic-gate }
1822bd670b35SErik Nordmark }
18237c478bd9Sstevel@tonic-gate
1824bd670b35SErik Nordmark if (ira->ira_ipsec_esp_sa != NULL) {
1825bd670b35SErik Nordmark if (!spd_match_inbound_ids(ipl,
1826bd670b35SErik Nordmark ira->ira_ipsec_esp_sa)) {
1827f4b3ec61Sdh155122 *counter = DROPPER(ipss, ipds_spd_esp_badid);
18287c478bd9Sstevel@tonic-gate *reason = "ESP identity mismatch";
18297c478bd9Sstevel@tonic-gate return (B_FALSE);
18307c478bd9Sstevel@tonic-gate }
1831bd670b35SErik Nordmark }
18327c478bd9Sstevel@tonic-gate
18338810c16bSdanmcd /*
18348810c16bSdanmcd * Can fudge pkt_unique from connp because we're latched.
18358810c16bSdanmcd * In DEBUG kernels (see conn_to_unique()'s implementation),
18368810c16bSdanmcd * verify this even if it REALLY slows things down.
18378810c16bSdanmcd */
1838bd670b35SErik Nordmark if (!ipsec_check_ipsecin_unique(ira, reason, counter,
1839bd670b35SErik Nordmark conn_to_unique(connp, mp, ipha, ip6h), ns)) {
184007b56925Ssommerfe return (B_FALSE);
18419c7c47efSsommerfe }
18429c7c47efSsommerfe }
1843bd670b35SErik Nordmark return (ipsec_check_ipsecin_action(ira, mp, ap, ipha, ip6h, reason,
1844bd670b35SErik Nordmark counter, ns));
18457c478bd9Sstevel@tonic-gate }
18467c478bd9Sstevel@tonic-gate
18477c478bd9Sstevel@tonic-gate /*
18487c478bd9Sstevel@tonic-gate * Check to see whether this secured datagram meets the policy
18497c478bd9Sstevel@tonic-gate * constraints specified in ipsp.
18507c478bd9Sstevel@tonic-gate *
18517c478bd9Sstevel@tonic-gate * Called from ipsec_check_global_policy, and ipsec_check_inbound_policy.
18527c478bd9Sstevel@tonic-gate *
18537c478bd9Sstevel@tonic-gate * Consumes a reference to ipsp.
1854bd670b35SErik Nordmark * Returns the mblk if ok.
18557c478bd9Sstevel@tonic-gate */
18567c478bd9Sstevel@tonic-gate static mblk_t *
ipsec_check_ipsecin_policy(mblk_t * data_mp,ipsec_policy_t * ipsp,ipha_t * ipha,ip6_t * ip6h,uint64_t pkt_unique,ip_recv_attr_t * ira,netstack_t * ns)1857bd670b35SErik Nordmark ipsec_check_ipsecin_policy(mblk_t *data_mp, ipsec_policy_t *ipsp,
1858bd670b35SErik Nordmark ipha_t *ipha, ip6_t *ip6h, uint64_t pkt_unique, ip_recv_attr_t *ira,
1859bd670b35SErik Nordmark netstack_t *ns)
18607c478bd9Sstevel@tonic-gate {
18617c478bd9Sstevel@tonic-gate ipsec_action_t *ap;
18627c478bd9Sstevel@tonic-gate const char *reason = "no policy actions found";
1863f4b3ec61Sdh155122 ip_stack_t *ipst = ns->netstack_ip;
1864bd670b35SErik Nordmark ipsec_stack_t *ipss = ns->netstack_ipsec;
1865f4b3ec61Sdh155122 kstat_named_t *counter;
1866f4b3ec61Sdh155122
1867f4b3ec61Sdh155122 counter = DROPPER(ipss, ipds_spd_got_secure);
18687c478bd9Sstevel@tonic-gate
18697c478bd9Sstevel@tonic-gate ASSERT(ipsp != NULL);
18707c478bd9Sstevel@tonic-gate
18717c478bd9Sstevel@tonic-gate ASSERT((ipha == NULL && ip6h != NULL) ||
18727c478bd9Sstevel@tonic-gate (ip6h == NULL && ipha != NULL));
18737c478bd9Sstevel@tonic-gate
1874bd670b35SErik Nordmark if (ira->ira_flags & IRAF_LOOPBACK)
1875bd670b35SErik Nordmark return (ipsec_check_loopback_policy(data_mp, ira, ipsp));
18767c478bd9Sstevel@tonic-gate
1877bd670b35SErik Nordmark ASSERT(ira->ira_flags & IRAF_IPSEC_SECURE);
18789c7c47efSsommerfe
1879bd670b35SErik Nordmark if (ira->ira_ipsec_action != NULL) {
18807c478bd9Sstevel@tonic-gate /*
18817c478bd9Sstevel@tonic-gate * this can happen if we do a double policy-check on a packet
18827c478bd9Sstevel@tonic-gate * Would be nice to be able to delete this test..
18837c478bd9Sstevel@tonic-gate */
1884bd670b35SErik Nordmark IPACT_REFRELE(ira->ira_ipsec_action);
18857c478bd9Sstevel@tonic-gate }
1886bd670b35SErik Nordmark ASSERT(ira->ira_ipsec_action == NULL);
18877c478bd9Sstevel@tonic-gate
1888bd670b35SErik Nordmark if (!SA_IDS_MATCH(ira->ira_ipsec_ah_sa, ira->ira_ipsec_esp_sa)) {
18897c478bd9Sstevel@tonic-gate reason = "inbound AH and ESP identities differ";
1890f4b3ec61Sdh155122 counter = DROPPER(ipss, ipds_spd_ahesp_diffid);
18917c478bd9Sstevel@tonic-gate goto drop;
18927c478bd9Sstevel@tonic-gate }
18937c478bd9Sstevel@tonic-gate
1894bd670b35SErik Nordmark if (!ipsec_check_ipsecin_unique(ira, &reason, &counter, pkt_unique,
1895bd670b35SErik Nordmark ns))
189607b56925Ssommerfe goto drop;
189707b56925Ssommerfe
18987c478bd9Sstevel@tonic-gate /*
18997c478bd9Sstevel@tonic-gate * Ok, now loop through the possible actions and see if any
19007c478bd9Sstevel@tonic-gate * of them work for us.
19017c478bd9Sstevel@tonic-gate */
19027c478bd9Sstevel@tonic-gate
19037c478bd9Sstevel@tonic-gate for (ap = ipsp->ipsp_act; ap != NULL; ap = ap->ipa_next) {
1904bd670b35SErik Nordmark if (ipsec_check_ipsecin_action(ira, data_mp, ap,
1905bd670b35SErik Nordmark ipha, ip6h, &reason, &counter, ns)) {
1906f4b3ec61Sdh155122 BUMP_MIB(&ipst->ips_ip_mib, ipsecInSucceeded);
1907bd670b35SErik Nordmark IPPOL_REFRELE(ipsp);
1908bd670b35SErik Nordmark return (data_mp);
19097c478bd9Sstevel@tonic-gate }
19107c478bd9Sstevel@tonic-gate }
19117c478bd9Sstevel@tonic-gate drop:
1912f4b3ec61Sdh155122 ipsec_rl_strlog(ns, IP_MOD_ID, 0, 0, SL_ERROR|SL_WARN|SL_CONSOLE,
19137c478bd9Sstevel@tonic-gate "ipsec inbound policy mismatch: %s, packet dropped\n",
19147c478bd9Sstevel@tonic-gate reason);
1915bd670b35SErik Nordmark IPPOL_REFRELE(ipsp);
1916bd670b35SErik Nordmark ASSERT(ira->ira_ipsec_action == NULL);
1917f4b3ec61Sdh155122 BUMP_MIB(&ipst->ips_ip_mib, ipsecInFailed);
1918bd670b35SErik Nordmark ip_drop_packet(data_mp, B_TRUE, NULL, counter,
1919f4b3ec61Sdh155122 &ipss->ipsec_spd_dropper);
19207c478bd9Sstevel@tonic-gate return (NULL);
19217c478bd9Sstevel@tonic-gate }
19227c478bd9Sstevel@tonic-gate
19237c478bd9Sstevel@tonic-gate /*
19247c478bd9Sstevel@tonic-gate * sleazy prefix-length-based compare.
19257c478bd9Sstevel@tonic-gate * another inlining candidate..
19267c478bd9Sstevel@tonic-gate */
19278810c16bSdanmcd boolean_t
ip_addr_match(uint8_t * addr1,int pfxlen,in6_addr_t * addr2p)19287c478bd9Sstevel@tonic-gate ip_addr_match(uint8_t *addr1, int pfxlen, in6_addr_t *addr2p)
19297c478bd9Sstevel@tonic-gate {
19307c478bd9Sstevel@tonic-gate int offset = pfxlen>>3;
19317c478bd9Sstevel@tonic-gate int bitsleft = pfxlen & 7;
19327c478bd9Sstevel@tonic-gate uint8_t *addr2 = (uint8_t *)addr2p;
19337c478bd9Sstevel@tonic-gate
19347c478bd9Sstevel@tonic-gate /*
19357c478bd9Sstevel@tonic-gate * and there was much evil..
19367c478bd9Sstevel@tonic-gate * XXX should inline-expand the bcmp here and do this 32 bits
19377c478bd9Sstevel@tonic-gate * or 64 bits at a time..
19387c478bd9Sstevel@tonic-gate */
19397c478bd9Sstevel@tonic-gate return ((bcmp(addr1, addr2, offset) == 0) &&
19407c478bd9Sstevel@tonic-gate ((bitsleft == 0) ||
1941daa41a61Sdanmcd (((addr1[offset] ^ addr2[offset]) & (0xff<<(8-bitsleft))) == 0)));
19427c478bd9Sstevel@tonic-gate }
19437c478bd9Sstevel@tonic-gate
19447c478bd9Sstevel@tonic-gate static ipsec_policy_t *
ipsec_find_policy_chain(ipsec_policy_t * best,ipsec_policy_t * chain,ipsec_selector_t * sel,boolean_t is_icmp_inv_acq)19456a182920Ssommerfe ipsec_find_policy_chain(ipsec_policy_t *best, ipsec_policy_t *chain,
19466a182920Ssommerfe ipsec_selector_t *sel, boolean_t is_icmp_inv_acq)
19477c478bd9Sstevel@tonic-gate {
19487c478bd9Sstevel@tonic-gate ipsec_selkey_t *isel;
19496a182920Ssommerfe ipsec_policy_t *p;
19507c478bd9Sstevel@tonic-gate int bpri = best ? best->ipsp_prio : 0;
19517c478bd9Sstevel@tonic-gate
19526a182920Ssommerfe for (p = chain; p != NULL; p = p->ipsp_hash.hash_next) {
19536a182920Ssommerfe uint32_t valid;
19547c478bd9Sstevel@tonic-gate
19557c478bd9Sstevel@tonic-gate if (p->ipsp_prio <= bpri)
19567c478bd9Sstevel@tonic-gate continue;
19577c478bd9Sstevel@tonic-gate isel = &p->ipsp_sel->ipsl_key;
19587c478bd9Sstevel@tonic-gate valid = isel->ipsl_valid;
19597c478bd9Sstevel@tonic-gate
19607c478bd9Sstevel@tonic-gate if ((valid & IPSL_PROTOCOL) &&
19617c478bd9Sstevel@tonic-gate (isel->ipsl_proto != sel->ips_protocol))
19627c478bd9Sstevel@tonic-gate continue;
19637c478bd9Sstevel@tonic-gate
19647c478bd9Sstevel@tonic-gate if ((valid & IPSL_REMOTE_ADDR) &&
19657c478bd9Sstevel@tonic-gate !ip_addr_match((uint8_t *)&isel->ipsl_remote,
1966daa41a61Sdanmcd isel->ipsl_remote_pfxlen, &sel->ips_remote_addr_v6))
19677c478bd9Sstevel@tonic-gate continue;
19687c478bd9Sstevel@tonic-gate
19697c478bd9Sstevel@tonic-gate if ((valid & IPSL_LOCAL_ADDR) &&
19707c478bd9Sstevel@tonic-gate !ip_addr_match((uint8_t *)&isel->ipsl_local,
1971daa41a61Sdanmcd isel->ipsl_local_pfxlen, &sel->ips_local_addr_v6))
19727c478bd9Sstevel@tonic-gate continue;
19737c478bd9Sstevel@tonic-gate
19747c478bd9Sstevel@tonic-gate if ((valid & IPSL_REMOTE_PORT) &&
19757c478bd9Sstevel@tonic-gate isel->ipsl_rport != sel->ips_remote_port)
19767c478bd9Sstevel@tonic-gate continue;
19777c478bd9Sstevel@tonic-gate
19787c478bd9Sstevel@tonic-gate if ((valid & IPSL_LOCAL_PORT) &&
19797c478bd9Sstevel@tonic-gate isel->ipsl_lport != sel->ips_local_port)
19807c478bd9Sstevel@tonic-gate continue;
19817c478bd9Sstevel@tonic-gate
19827c478bd9Sstevel@tonic-gate if (!is_icmp_inv_acq) {
19837c478bd9Sstevel@tonic-gate if ((valid & IPSL_ICMP_TYPE) &&
19847c478bd9Sstevel@tonic-gate (isel->ipsl_icmp_type > sel->ips_icmp_type ||
19857c478bd9Sstevel@tonic-gate isel->ipsl_icmp_type_end < sel->ips_icmp_type)) {
19867c478bd9Sstevel@tonic-gate continue;
19877c478bd9Sstevel@tonic-gate }
19887c478bd9Sstevel@tonic-gate
19897c478bd9Sstevel@tonic-gate if ((valid & IPSL_ICMP_CODE) &&
19907c478bd9Sstevel@tonic-gate (isel->ipsl_icmp_code > sel->ips_icmp_code ||
19917c478bd9Sstevel@tonic-gate isel->ipsl_icmp_code_end <
19927c478bd9Sstevel@tonic-gate sel->ips_icmp_code)) {
19937c478bd9Sstevel@tonic-gate continue;
19947c478bd9Sstevel@tonic-gate }
19957c478bd9Sstevel@tonic-gate } else {
19967c478bd9Sstevel@tonic-gate /*
19977c478bd9Sstevel@tonic-gate * special case for icmp inverse acquire
19987c478bd9Sstevel@tonic-gate * we only want policies that aren't drop/pass
19997c478bd9Sstevel@tonic-gate */
20007c478bd9Sstevel@tonic-gate if (p->ipsp_act->ipa_act.ipa_type != IPSEC_ACT_APPLY)
20017c478bd9Sstevel@tonic-gate continue;
20027c478bd9Sstevel@tonic-gate }
20037c478bd9Sstevel@tonic-gate
20047c478bd9Sstevel@tonic-gate /* we matched all the packet-port-field selectors! */
20056a182920Ssommerfe best = p;
20067c478bd9Sstevel@tonic-gate bpri = p->ipsp_prio;
20077c478bd9Sstevel@tonic-gate }
20087c478bd9Sstevel@tonic-gate
20096a182920Ssommerfe return (best);
20106a182920Ssommerfe }
20116a182920Ssommerfe
20127c478bd9Sstevel@tonic-gate /*
20136a182920Ssommerfe * Try to find and return the best policy entry under a given policy
20146a182920Ssommerfe * root for a given set of selectors; the first parameter "best" is
20156a182920Ssommerfe * the current best policy so far. If "best" is non-null, we have a
20166a182920Ssommerfe * reference to it. We return a reference to a policy; if that policy
20176a182920Ssommerfe * is not the original "best", we need to release that reference
20186a182920Ssommerfe * before returning.
20196a182920Ssommerfe */
20208810c16bSdanmcd ipsec_policy_t *
ipsec_find_policy_head(ipsec_policy_t * best,ipsec_policy_head_t * head,int direction,ipsec_selector_t * sel)20218810c16bSdanmcd ipsec_find_policy_head(ipsec_policy_t *best, ipsec_policy_head_t *head,
2022bd670b35SErik Nordmark int direction, ipsec_selector_t *sel)
20236a182920Ssommerfe {
20246a182920Ssommerfe ipsec_policy_t *curbest;
20256a182920Ssommerfe ipsec_policy_root_t *root;
20266a182920Ssommerfe uint8_t is_icmp_inv_acq = sel->ips_is_icmp_inv_acq;
20276a182920Ssommerfe int af = sel->ips_isv4 ? IPSEC_AF_V4 : IPSEC_AF_V6;
20286a182920Ssommerfe
20296a182920Ssommerfe curbest = best;
20306a182920Ssommerfe root = &head->iph_root[direction];
20316a182920Ssommerfe
20326a182920Ssommerfe #ifdef DEBUG
20336a182920Ssommerfe if (is_icmp_inv_acq) {
20346a182920Ssommerfe if (sel->ips_isv4) {
20356a182920Ssommerfe if (sel->ips_protocol != IPPROTO_ICMP) {
20366a182920Ssommerfe cmn_err(CE_WARN, "ipsec_find_policy_head:"
2037daa41a61Sdanmcd " expecting icmp, got %d",
2038daa41a61Sdanmcd sel->ips_protocol);
20396a182920Ssommerfe }
20406a182920Ssommerfe } else {
20416a182920Ssommerfe if (sel->ips_protocol != IPPROTO_ICMPV6) {
20426a182920Ssommerfe cmn_err(CE_WARN, "ipsec_find_policy_head:"
2043daa41a61Sdanmcd " expecting icmpv6, got %d",
2044daa41a61Sdanmcd sel->ips_protocol);
20456a182920Ssommerfe }
20466a182920Ssommerfe }
20476a182920Ssommerfe }
20486a182920Ssommerfe #endif
20496a182920Ssommerfe
20506a182920Ssommerfe rw_enter(&head->iph_lock, RW_READER);
20516a182920Ssommerfe
20526a182920Ssommerfe if (root->ipr_nchains > 0) {
20536a182920Ssommerfe curbest = ipsec_find_policy_chain(curbest,
20548810c16bSdanmcd root->ipr_hash[selector_hash(sel, root)].hash_head, sel,
20558810c16bSdanmcd is_icmp_inv_acq);
20566a182920Ssommerfe }
20576a182920Ssommerfe curbest = ipsec_find_policy_chain(curbest, root->ipr_nonhash[af], sel,
20586a182920Ssommerfe is_icmp_inv_acq);
20596a182920Ssommerfe
20606a182920Ssommerfe /*
20616a182920Ssommerfe * Adjust reference counts if we found anything new.
20627c478bd9Sstevel@tonic-gate */
20637c478bd9Sstevel@tonic-gate if (curbest != best) {
20646a182920Ssommerfe ASSERT(curbest != NULL);
20657c478bd9Sstevel@tonic-gate IPPOL_REFHOLD(curbest);
20666a182920Ssommerfe
20677c478bd9Sstevel@tonic-gate if (best != NULL) {
2068bd670b35SErik Nordmark IPPOL_REFRELE(best);
20697c478bd9Sstevel@tonic-gate }
20707c478bd9Sstevel@tonic-gate }
20717c478bd9Sstevel@tonic-gate
20727c478bd9Sstevel@tonic-gate rw_exit(&head->iph_lock);
20737c478bd9Sstevel@tonic-gate
20747c478bd9Sstevel@tonic-gate return (curbest);
20757c478bd9Sstevel@tonic-gate }
20767c478bd9Sstevel@tonic-gate
20777c478bd9Sstevel@tonic-gate /*
20787c478bd9Sstevel@tonic-gate * Find the best system policy (either global or per-interface) which
20797c478bd9Sstevel@tonic-gate * applies to the given selector; look in all the relevant policy roots
20807c478bd9Sstevel@tonic-gate * to figure out which policy wins.
20817c478bd9Sstevel@tonic-gate *
20827c478bd9Sstevel@tonic-gate * Returns a reference to a policy; caller must release this
20837c478bd9Sstevel@tonic-gate * reference when done.
20847c478bd9Sstevel@tonic-gate */
20857c478bd9Sstevel@tonic-gate ipsec_policy_t *
ipsec_find_policy(int direction,const conn_t * connp,ipsec_selector_t * sel,netstack_t * ns)2086bd670b35SErik Nordmark ipsec_find_policy(int direction, const conn_t *connp, ipsec_selector_t *sel,
2087bd670b35SErik Nordmark netstack_t *ns)
20887c478bd9Sstevel@tonic-gate {
20897c478bd9Sstevel@tonic-gate ipsec_policy_t *p;
2090f4b3ec61Sdh155122 ipsec_stack_t *ipss = ns->netstack_ipsec;
20917c478bd9Sstevel@tonic-gate
2092f4b3ec61Sdh155122 p = ipsec_find_policy_head(NULL, &ipss->ipsec_system_policy,
2093bd670b35SErik Nordmark direction, sel);
20947c478bd9Sstevel@tonic-gate if ((connp != NULL) && (connp->conn_policy != NULL)) {
20957c478bd9Sstevel@tonic-gate p = ipsec_find_policy_head(p, connp->conn_policy,
2096bd670b35SErik Nordmark direction, sel);
20977c478bd9Sstevel@tonic-gate }
20987c478bd9Sstevel@tonic-gate
20997c478bd9Sstevel@tonic-gate return (p);
21007c478bd9Sstevel@tonic-gate }
21017c478bd9Sstevel@tonic-gate
21027c478bd9Sstevel@tonic-gate /*
21037c478bd9Sstevel@tonic-gate * Check with global policy and see whether this inbound
21047c478bd9Sstevel@tonic-gate * packet meets the policy constraints.
21057c478bd9Sstevel@tonic-gate *
21067c478bd9Sstevel@tonic-gate * Locate appropriate policy from global policy, supplemented by the
21077c478bd9Sstevel@tonic-gate * conn's configured and/or cached policy if the conn is supplied.
21087c478bd9Sstevel@tonic-gate *
21097c478bd9Sstevel@tonic-gate * Dispatch to ipsec_check_ipsecin_policy if we have policy and an
21107c478bd9Sstevel@tonic-gate * encrypted packet to see if they match.
21117c478bd9Sstevel@tonic-gate *
21127c478bd9Sstevel@tonic-gate * Otherwise, see if the policy allows cleartext; if not, drop it on the
21137c478bd9Sstevel@tonic-gate * floor.
21147c478bd9Sstevel@tonic-gate */
21157c478bd9Sstevel@tonic-gate mblk_t *
ipsec_check_global_policy(mblk_t * data_mp,conn_t * connp,ipha_t * ipha,ip6_t * ip6h,ip_recv_attr_t * ira,netstack_t * ns)2116bd670b35SErik Nordmark ipsec_check_global_policy(mblk_t *data_mp, conn_t *connp,
2117bd670b35SErik Nordmark ipha_t *ipha, ip6_t *ip6h, ip_recv_attr_t *ira, netstack_t *ns)
21187c478bd9Sstevel@tonic-gate {
21197c478bd9Sstevel@tonic-gate ipsec_policy_t *p;
21207c478bd9Sstevel@tonic-gate ipsec_selector_t sel;
21217c478bd9Sstevel@tonic-gate boolean_t policy_present;
21227c478bd9Sstevel@tonic-gate kstat_named_t *counter;
21238810c16bSdanmcd uint64_t pkt_unique;
2124f4b3ec61Sdh155122 ip_stack_t *ipst = ns->netstack_ip;
2125bd670b35SErik Nordmark ipsec_stack_t *ipss = ns->netstack_ipsec;
21267c478bd9Sstevel@tonic-gate
21277c478bd9Sstevel@tonic-gate sel.ips_is_icmp_inv_acq = 0;
21287c478bd9Sstevel@tonic-gate
21297c478bd9Sstevel@tonic-gate ASSERT((ipha == NULL && ip6h != NULL) ||
21307c478bd9Sstevel@tonic-gate (ip6h == NULL && ipha != NULL));
21317c478bd9Sstevel@tonic-gate
21327c478bd9Sstevel@tonic-gate if (ipha != NULL)
2133f4b3ec61Sdh155122 policy_present = ipss->ipsec_inbound_v4_policy_present;
21347c478bd9Sstevel@tonic-gate else
2135f4b3ec61Sdh155122 policy_present = ipss->ipsec_inbound_v6_policy_present;
21367c478bd9Sstevel@tonic-gate
21377c478bd9Sstevel@tonic-gate if (!policy_present && connp == NULL) {
21387c478bd9Sstevel@tonic-gate /*
21397c478bd9Sstevel@tonic-gate * No global policy and no per-socket policy;
21407c478bd9Sstevel@tonic-gate * just pass it back (but we shouldn't get here in that case)
21417c478bd9Sstevel@tonic-gate */
2142bd670b35SErik Nordmark return (data_mp);
21437c478bd9Sstevel@tonic-gate }
21447c478bd9Sstevel@tonic-gate
21457c478bd9Sstevel@tonic-gate /*
21467c478bd9Sstevel@tonic-gate * If we have cached policy, use it.
21477c478bd9Sstevel@tonic-gate * Otherwise consult system policy.
21487c478bd9Sstevel@tonic-gate */
21497c478bd9Sstevel@tonic-gate if ((connp != NULL) && (connp->conn_latch != NULL)) {
2150bd670b35SErik Nordmark p = connp->conn_latch_in_policy;
21517c478bd9Sstevel@tonic-gate if (p != NULL) {
21527c478bd9Sstevel@tonic-gate IPPOL_REFHOLD(p);
21537c478bd9Sstevel@tonic-gate }
21548810c16bSdanmcd /*
21558810c16bSdanmcd * Fudge sel for UNIQUE_ID setting below.
21568810c16bSdanmcd */
21578810c16bSdanmcd pkt_unique = conn_to_unique(connp, data_mp, ipha, ip6h);
21587c478bd9Sstevel@tonic-gate } else {
21597c478bd9Sstevel@tonic-gate /* Initialize the ports in the selector */
21608810c16bSdanmcd if (ipsec_init_inbound_sel(&sel, data_mp, ipha, ip6h,
21618810c16bSdanmcd SEL_NONE) == SELRET_NOMEM) {
21627c478bd9Sstevel@tonic-gate /*
21637c478bd9Sstevel@tonic-gate * Technically not a policy mismatch, but it is
21647c478bd9Sstevel@tonic-gate * an internal failure.
21657c478bd9Sstevel@tonic-gate */
216632350c00Sdanmcd ipsec_log_policy_failure(IPSEC_POLICY_MISMATCH,
21675d3b8cb7SBill Sommerfeld "ipsec_init_inbound_sel", ipha, ip6h, B_TRUE, ns);
2168f4b3ec61Sdh155122 counter = DROPPER(ipss, ipds_spd_nomem);
21697c478bd9Sstevel@tonic-gate goto fail;
21707c478bd9Sstevel@tonic-gate }
21717c478bd9Sstevel@tonic-gate
21727c478bd9Sstevel@tonic-gate /*
21737c478bd9Sstevel@tonic-gate * Find the policy which best applies.
21747c478bd9Sstevel@tonic-gate *
21757c478bd9Sstevel@tonic-gate * If we find global policy, we should look at both
21767c478bd9Sstevel@tonic-gate * local policy and global policy and see which is
21777c478bd9Sstevel@tonic-gate * stronger and match accordingly.
21787c478bd9Sstevel@tonic-gate *
21797c478bd9Sstevel@tonic-gate * If we don't find a global policy, check with
21807c478bd9Sstevel@tonic-gate * local policy alone.
21817c478bd9Sstevel@tonic-gate */
21827c478bd9Sstevel@tonic-gate
2183bd670b35SErik Nordmark p = ipsec_find_policy(IPSEC_TYPE_INBOUND, connp, &sel, ns);
21848810c16bSdanmcd pkt_unique = SA_UNIQUE_ID(sel.ips_remote_port,
21858810c16bSdanmcd sel.ips_local_port, sel.ips_protocol, 0);
21867c478bd9Sstevel@tonic-gate }
21877c478bd9Sstevel@tonic-gate
21887c478bd9Sstevel@tonic-gate if (p == NULL) {
2189bd670b35SErik Nordmark if (!(ira->ira_flags & IRAF_IPSEC_SECURE)) {
21907c478bd9Sstevel@tonic-gate /*
21917c478bd9Sstevel@tonic-gate * We have no policy; default to succeeding.
21927c478bd9Sstevel@tonic-gate * XXX paranoid system design doesn't do this.
21937c478bd9Sstevel@tonic-gate */
2194f4b3ec61Sdh155122 BUMP_MIB(&ipst->ips_ip_mib, ipsecInSucceeded);
2195bd670b35SErik Nordmark return (data_mp);
21967c478bd9Sstevel@tonic-gate } else {
2197f4b3ec61Sdh155122 counter = DROPPER(ipss, ipds_spd_got_secure);
219832350c00Sdanmcd ipsec_log_policy_failure(IPSEC_POLICY_NOT_NEEDED,
2199f4b3ec61Sdh155122 "ipsec_check_global_policy", ipha, ip6h, B_TRUE,
2200f4b3ec61Sdh155122 ns);
22017c478bd9Sstevel@tonic-gate goto fail;
22027c478bd9Sstevel@tonic-gate }
22037c478bd9Sstevel@tonic-gate }
2204bd670b35SErik Nordmark if (ira->ira_flags & IRAF_IPSEC_SECURE) {
2205bd670b35SErik Nordmark return (ipsec_check_ipsecin_policy(data_mp, p, ipha, ip6h,
2206bd670b35SErik Nordmark pkt_unique, ira, ns));
220732350c00Sdanmcd }
22087c478bd9Sstevel@tonic-gate if (p->ipsp_act->ipa_allow_clear) {
2209f4b3ec61Sdh155122 BUMP_MIB(&ipst->ips_ip_mib, ipsecInSucceeded);
2210bd670b35SErik Nordmark IPPOL_REFRELE(p);
2211bd670b35SErik Nordmark return (data_mp);
22127c478bd9Sstevel@tonic-gate }
2213bd670b35SErik Nordmark IPPOL_REFRELE(p);
22147c478bd9Sstevel@tonic-gate /*
22157c478bd9Sstevel@tonic-gate * If we reach here, we will drop the packet because it failed the
22167c478bd9Sstevel@tonic-gate * global policy check because the packet was cleartext, and it
22177c478bd9Sstevel@tonic-gate * should not have been.
22187c478bd9Sstevel@tonic-gate */
221932350c00Sdanmcd ipsec_log_policy_failure(IPSEC_POLICY_MISMATCH,
2220f4b3ec61Sdh155122 "ipsec_check_global_policy", ipha, ip6h, B_FALSE, ns);
2221f4b3ec61Sdh155122 counter = DROPPER(ipss, ipds_spd_got_clear);
22227c478bd9Sstevel@tonic-gate
22237c478bd9Sstevel@tonic-gate fail:
2224bd670b35SErik Nordmark ip_drop_packet(data_mp, B_TRUE, NULL, counter,
2225f4b3ec61Sdh155122 &ipss->ipsec_spd_dropper);
2226f4b3ec61Sdh155122 BUMP_MIB(&ipst->ips_ip_mib, ipsecInFailed);
22277c478bd9Sstevel@tonic-gate return (NULL);
22287c478bd9Sstevel@tonic-gate }
22297c478bd9Sstevel@tonic-gate
22307c478bd9Sstevel@tonic-gate /*
22317c478bd9Sstevel@tonic-gate * We check whether an inbound datagram is a valid one
22327c478bd9Sstevel@tonic-gate * to accept in clear. If it is secure, it is the job
22337c478bd9Sstevel@tonic-gate * of IPSEC to log information appropriately if it
22347c478bd9Sstevel@tonic-gate * suspects that it may not be the real one.
22357c478bd9Sstevel@tonic-gate *
22367c478bd9Sstevel@tonic-gate * It is called only while fanning out to the ULP
22377c478bd9Sstevel@tonic-gate * where ULP accepts only secure data and the incoming
22387c478bd9Sstevel@tonic-gate * is clear. Usually we never accept clear datagrams in
22397c478bd9Sstevel@tonic-gate * such cases. ICMP is the only exception.
22407c478bd9Sstevel@tonic-gate *
22417c478bd9Sstevel@tonic-gate * NOTE : We don't call this function if the client (ULP)
22427c478bd9Sstevel@tonic-gate * is willing to accept things in clear.
22437c478bd9Sstevel@tonic-gate */
22447c478bd9Sstevel@tonic-gate boolean_t
ipsec_inbound_accept_clear(mblk_t * mp,ipha_t * ipha,ip6_t * ip6h)22457c478bd9Sstevel@tonic-gate ipsec_inbound_accept_clear(mblk_t *mp, ipha_t *ipha, ip6_t *ip6h)
22467c478bd9Sstevel@tonic-gate {
22477c478bd9Sstevel@tonic-gate ushort_t iph_hdr_length;
22487c478bd9Sstevel@tonic-gate icmph_t *icmph;
22497c478bd9Sstevel@tonic-gate icmp6_t *icmp6;
22507c478bd9Sstevel@tonic-gate uint8_t *nexthdrp;
22517c478bd9Sstevel@tonic-gate
22527c478bd9Sstevel@tonic-gate ASSERT((ipha != NULL && ip6h == NULL) ||
22537c478bd9Sstevel@tonic-gate (ipha == NULL && ip6h != NULL));
22547c478bd9Sstevel@tonic-gate
22557c478bd9Sstevel@tonic-gate if (ip6h != NULL) {
22567c478bd9Sstevel@tonic-gate iph_hdr_length = ip_hdr_length_v6(mp, ip6h);
22577c478bd9Sstevel@tonic-gate if (!ip_hdr_length_nexthdr_v6(mp, ip6h, &iph_hdr_length,
22587c478bd9Sstevel@tonic-gate &nexthdrp)) {
22597c478bd9Sstevel@tonic-gate return (B_FALSE);
22607c478bd9Sstevel@tonic-gate }
22617c478bd9Sstevel@tonic-gate if (*nexthdrp != IPPROTO_ICMPV6)
22627c478bd9Sstevel@tonic-gate return (B_FALSE);
22637c478bd9Sstevel@tonic-gate icmp6 = (icmp6_t *)(&mp->b_rptr[iph_hdr_length]);
22647c478bd9Sstevel@tonic-gate /* Match IPv6 ICMP policy as closely as IPv4 as possible. */
22657c478bd9Sstevel@tonic-gate switch (icmp6->icmp6_type) {
22667c478bd9Sstevel@tonic-gate case ICMP6_PARAM_PROB:
22677c478bd9Sstevel@tonic-gate /* Corresponds to port/proto unreach in IPv4. */
22687c478bd9Sstevel@tonic-gate case ICMP6_ECHO_REQUEST:
22697c478bd9Sstevel@tonic-gate /* Just like IPv4. */
22707c478bd9Sstevel@tonic-gate return (B_FALSE);
22717c478bd9Sstevel@tonic-gate
22727c478bd9Sstevel@tonic-gate case MLD_LISTENER_QUERY:
22737c478bd9Sstevel@tonic-gate case MLD_LISTENER_REPORT:
22747c478bd9Sstevel@tonic-gate case MLD_LISTENER_REDUCTION:
22757c478bd9Sstevel@tonic-gate /*
22767c478bd9Sstevel@tonic-gate * XXX Seperate NDD in IPv4 what about here?
22777c478bd9Sstevel@tonic-gate * Plus, mcast is important to ND.
22787c478bd9Sstevel@tonic-gate */
22797c478bd9Sstevel@tonic-gate case ICMP6_DST_UNREACH:
22807c478bd9Sstevel@tonic-gate /* Corresponds to HOST/NET unreachable in IPv4. */
22817c478bd9Sstevel@tonic-gate case ICMP6_PACKET_TOO_BIG:
22827c478bd9Sstevel@tonic-gate case ICMP6_ECHO_REPLY:
22837c478bd9Sstevel@tonic-gate /* These are trusted in IPv4. */
22847c478bd9Sstevel@tonic-gate case ND_ROUTER_SOLICIT:
22857c478bd9Sstevel@tonic-gate case ND_ROUTER_ADVERT:
22867c478bd9Sstevel@tonic-gate case ND_NEIGHBOR_SOLICIT:
22877c478bd9Sstevel@tonic-gate case ND_NEIGHBOR_ADVERT:
22887c478bd9Sstevel@tonic-gate case ND_REDIRECT:
22897c478bd9Sstevel@tonic-gate /* Trust ND messages for now. */
22907c478bd9Sstevel@tonic-gate case ICMP6_TIME_EXCEEDED:
22917c478bd9Sstevel@tonic-gate default:
22927c478bd9Sstevel@tonic-gate return (B_TRUE);
22937c478bd9Sstevel@tonic-gate }
22947c478bd9Sstevel@tonic-gate } else {
22957c478bd9Sstevel@tonic-gate /*
22967c478bd9Sstevel@tonic-gate * If it is not ICMP, fail this request.
22977c478bd9Sstevel@tonic-gate */
22988810c16bSdanmcd if (ipha->ipha_protocol != IPPROTO_ICMP) {
22998810c16bSdanmcd #ifdef FRAGCACHE_DEBUG
23008810c16bSdanmcd cmn_err(CE_WARN, "Dropping - ipha_proto = %d\n",
23018810c16bSdanmcd ipha->ipha_protocol);
23028810c16bSdanmcd #endif
23037c478bd9Sstevel@tonic-gate return (B_FALSE);
23048810c16bSdanmcd }
23057c478bd9Sstevel@tonic-gate iph_hdr_length = IPH_HDR_LENGTH(ipha);
23067c478bd9Sstevel@tonic-gate icmph = (icmph_t *)&mp->b_rptr[iph_hdr_length];
23077c478bd9Sstevel@tonic-gate /*
23087c478bd9Sstevel@tonic-gate * It is an insecure icmp message. Check to see whether we are
23097c478bd9Sstevel@tonic-gate * willing to accept this one.
23107c478bd9Sstevel@tonic-gate */
23117c478bd9Sstevel@tonic-gate
23127c478bd9Sstevel@tonic-gate switch (icmph->icmph_type) {
23137c478bd9Sstevel@tonic-gate case ICMP_ECHO_REPLY:
23147c478bd9Sstevel@tonic-gate case ICMP_TIME_STAMP_REPLY:
23157c478bd9Sstevel@tonic-gate case ICMP_INFO_REPLY:
23167c478bd9Sstevel@tonic-gate case ICMP_ROUTER_ADVERTISEMENT:
23177c478bd9Sstevel@tonic-gate /*
23187c478bd9Sstevel@tonic-gate * We should not encourage clear replies if this
23197c478bd9Sstevel@tonic-gate * client expects secure. If somebody is replying
23207c478bd9Sstevel@tonic-gate * in clear some mailicious user watching both the
23217c478bd9Sstevel@tonic-gate * request and reply, can do chosen-plain-text attacks.
23227c478bd9Sstevel@tonic-gate * With global policy we might be just expecting secure
23237c478bd9Sstevel@tonic-gate * but sending out clear. We don't know what the right
23247c478bd9Sstevel@tonic-gate * thing is. We can't do much here as we can't control
23257c478bd9Sstevel@tonic-gate * the sender here. Till we are sure of what to do,
23267c478bd9Sstevel@tonic-gate * accept them.
23277c478bd9Sstevel@tonic-gate */
23287c478bd9Sstevel@tonic-gate return (B_TRUE);
23297c478bd9Sstevel@tonic-gate case ICMP_ECHO_REQUEST:
23307c478bd9Sstevel@tonic-gate case ICMP_TIME_STAMP_REQUEST:
23317c478bd9Sstevel@tonic-gate case ICMP_INFO_REQUEST:
23327c478bd9Sstevel@tonic-gate case ICMP_ADDRESS_MASK_REQUEST:
23337c478bd9Sstevel@tonic-gate case ICMP_ROUTER_SOLICITATION:
23347c478bd9Sstevel@tonic-gate case ICMP_ADDRESS_MASK_REPLY:
23357c478bd9Sstevel@tonic-gate /*
23367c478bd9Sstevel@tonic-gate * Don't accept this as somebody could be sending
23377c478bd9Sstevel@tonic-gate * us plain text to get encrypted data. If we reply,
23387c478bd9Sstevel@tonic-gate * it will lead to chosen plain text attack.
23397c478bd9Sstevel@tonic-gate */
23407c478bd9Sstevel@tonic-gate return (B_FALSE);
23417c478bd9Sstevel@tonic-gate case ICMP_DEST_UNREACHABLE:
23427c478bd9Sstevel@tonic-gate switch (icmph->icmph_code) {
23437c478bd9Sstevel@tonic-gate case ICMP_FRAGMENTATION_NEEDED:
23447c478bd9Sstevel@tonic-gate /*
23457c478bd9Sstevel@tonic-gate * Be in sync with icmp_inbound, where we have
2346bd670b35SErik Nordmark * already set dce_pmtu
23477c478bd9Sstevel@tonic-gate */
23488810c16bSdanmcd #ifdef FRAGCACHE_DEBUG
23498810c16bSdanmcd cmn_err(CE_WARN, "ICMP frag needed\n");
23508810c16bSdanmcd #endif
23517c478bd9Sstevel@tonic-gate return (B_TRUE);
23527c478bd9Sstevel@tonic-gate case ICMP_HOST_UNREACHABLE:
23537c478bd9Sstevel@tonic-gate case ICMP_NET_UNREACHABLE:
23547c478bd9Sstevel@tonic-gate /*
23557c478bd9Sstevel@tonic-gate * By accepting, we could reset a connection.
23567c478bd9Sstevel@tonic-gate * How do we solve the problem of some
23577c478bd9Sstevel@tonic-gate * intermediate router sending in-secure ICMP
23587c478bd9Sstevel@tonic-gate * messages ?
23597c478bd9Sstevel@tonic-gate */
23607c478bd9Sstevel@tonic-gate return (B_TRUE);
23617c478bd9Sstevel@tonic-gate case ICMP_PORT_UNREACHABLE:
23627c478bd9Sstevel@tonic-gate case ICMP_PROTOCOL_UNREACHABLE:
23637c478bd9Sstevel@tonic-gate default :
23647c478bd9Sstevel@tonic-gate return (B_FALSE);
23657c478bd9Sstevel@tonic-gate }
23667c478bd9Sstevel@tonic-gate case ICMP_SOURCE_QUENCH:
23677c478bd9Sstevel@tonic-gate /*
23687c478bd9Sstevel@tonic-gate * If this is an attack, TCP will slow start
23697c478bd9Sstevel@tonic-gate * because of this. Is it very harmful ?
23707c478bd9Sstevel@tonic-gate */
23717c478bd9Sstevel@tonic-gate return (B_TRUE);
23727c478bd9Sstevel@tonic-gate case ICMP_PARAM_PROBLEM:
23737c478bd9Sstevel@tonic-gate return (B_FALSE);
23747c478bd9Sstevel@tonic-gate case ICMP_TIME_EXCEEDED:
23757c478bd9Sstevel@tonic-gate return (B_TRUE);
23767c478bd9Sstevel@tonic-gate case ICMP_REDIRECT:
23777c478bd9Sstevel@tonic-gate return (B_FALSE);
23787c478bd9Sstevel@tonic-gate default :
23797c478bd9Sstevel@tonic-gate return (B_FALSE);
23807c478bd9Sstevel@tonic-gate }
23817c478bd9Sstevel@tonic-gate }
23827c478bd9Sstevel@tonic-gate }
23837c478bd9Sstevel@tonic-gate
23847c478bd9Sstevel@tonic-gate void
ipsec_latch_ids(ipsec_latch_t * ipl,ipsid_t * local,ipsid_t * remote)23857c478bd9Sstevel@tonic-gate ipsec_latch_ids(ipsec_latch_t *ipl, ipsid_t *local, ipsid_t *remote)
23867c478bd9Sstevel@tonic-gate {
23877c478bd9Sstevel@tonic-gate mutex_enter(&ipl->ipl_lock);
23887c478bd9Sstevel@tonic-gate
23897c478bd9Sstevel@tonic-gate if (ipl->ipl_ids_latched) {
23907c478bd9Sstevel@tonic-gate /* I lost, someone else got here before me */
23917c478bd9Sstevel@tonic-gate mutex_exit(&ipl->ipl_lock);
23927c478bd9Sstevel@tonic-gate return;
23937c478bd9Sstevel@tonic-gate }
23947c478bd9Sstevel@tonic-gate
23957c478bd9Sstevel@tonic-gate if (local != NULL)
23967c478bd9Sstevel@tonic-gate IPSID_REFHOLD(local);
23977c478bd9Sstevel@tonic-gate if (remote != NULL)
23987c478bd9Sstevel@tonic-gate IPSID_REFHOLD(remote);
23997c478bd9Sstevel@tonic-gate
24007c478bd9Sstevel@tonic-gate ipl->ipl_local_cid = local;
24017c478bd9Sstevel@tonic-gate ipl->ipl_remote_cid = remote;
24027c478bd9Sstevel@tonic-gate ipl->ipl_ids_latched = B_TRUE;
24037c478bd9Sstevel@tonic-gate mutex_exit(&ipl->ipl_lock);
24047c478bd9Sstevel@tonic-gate }
24057c478bd9Sstevel@tonic-gate
24067c478bd9Sstevel@tonic-gate void
ipsec_latch_inbound(conn_t * connp,ip_recv_attr_t * ira)2407bd670b35SErik Nordmark ipsec_latch_inbound(conn_t *connp, ip_recv_attr_t *ira)
24087c478bd9Sstevel@tonic-gate {
24097c478bd9Sstevel@tonic-gate ipsa_t *sa;
2410bd670b35SErik Nordmark ipsec_latch_t *ipl = connp->conn_latch;
24117c478bd9Sstevel@tonic-gate
24127c478bd9Sstevel@tonic-gate if (!ipl->ipl_ids_latched) {
24137c478bd9Sstevel@tonic-gate ipsid_t *local = NULL;
24147c478bd9Sstevel@tonic-gate ipsid_t *remote = NULL;
24157c478bd9Sstevel@tonic-gate
2416bd670b35SErik Nordmark if (!(ira->ira_flags & IRAF_LOOPBACK)) {
2417bd670b35SErik Nordmark ASSERT(ira->ira_flags & IRAF_IPSEC_SECURE);
2418bd670b35SErik Nordmark if (ira->ira_ipsec_esp_sa != NULL)
2419bd670b35SErik Nordmark sa = ira->ira_ipsec_esp_sa;
24207c478bd9Sstevel@tonic-gate else
2421bd670b35SErik Nordmark sa = ira->ira_ipsec_ah_sa;
24227c478bd9Sstevel@tonic-gate ASSERT(sa != NULL);
24237c478bd9Sstevel@tonic-gate local = sa->ipsa_dst_cid;
24247c478bd9Sstevel@tonic-gate remote = sa->ipsa_src_cid;
24257c478bd9Sstevel@tonic-gate }
24267c478bd9Sstevel@tonic-gate ipsec_latch_ids(ipl, local, remote);
24277c478bd9Sstevel@tonic-gate }
2428bd670b35SErik Nordmark if (ira->ira_flags & IRAF_IPSEC_SECURE) {
2429bd670b35SErik Nordmark if (connp->conn_latch_in_action != NULL) {
2430bd670b35SErik Nordmark /*
2431bd670b35SErik Nordmark * Previously cached action. This is probably
2432bd670b35SErik Nordmark * harmless, but in DEBUG kernels, check for
2433bd670b35SErik Nordmark * action equality.
2434bd670b35SErik Nordmark *
2435bd670b35SErik Nordmark * Preserve the existing action to preserve latch
2436bd670b35SErik Nordmark * invariance.
2437bd670b35SErik Nordmark */
2438bd670b35SErik Nordmark ASSERT(connp->conn_latch_in_action ==
2439bd670b35SErik Nordmark ira->ira_ipsec_action);
2440bd670b35SErik Nordmark return;
2441bd670b35SErik Nordmark }
2442bd670b35SErik Nordmark connp->conn_latch_in_action = ira->ira_ipsec_action;
2443bd670b35SErik Nordmark IPACT_REFHOLD(connp->conn_latch_in_action);
2444bd670b35SErik Nordmark }
24457c478bd9Sstevel@tonic-gate }
24467c478bd9Sstevel@tonic-gate
24477c478bd9Sstevel@tonic-gate /*
24487c478bd9Sstevel@tonic-gate * Check whether the policy constraints are met either for an
24497c478bd9Sstevel@tonic-gate * inbound datagram; called from IP in numerous places.
24507c478bd9Sstevel@tonic-gate *
24517c478bd9Sstevel@tonic-gate * Note that this is not a chokepoint for inbound policy checks;
245207b56925Ssommerfe * see also ipsec_check_ipsecin_latch() and ipsec_check_global_policy()
24537c478bd9Sstevel@tonic-gate */
24547c478bd9Sstevel@tonic-gate mblk_t *
ipsec_check_inbound_policy(mblk_t * mp,conn_t * connp,ipha_t * ipha,ip6_t * ip6h,ip_recv_attr_t * ira)2455bd670b35SErik Nordmark ipsec_check_inbound_policy(mblk_t *mp, conn_t *connp,
2456bd670b35SErik Nordmark ipha_t *ipha, ip6_t *ip6h, ip_recv_attr_t *ira)
24577c478bd9Sstevel@tonic-gate {
24587c478bd9Sstevel@tonic-gate boolean_t ret;
24597c478bd9Sstevel@tonic-gate ipsec_latch_t *ipl;
2460bd670b35SErik Nordmark ipsec_action_t *ap;
24618810c16bSdanmcd uint64_t unique_id;
2462f4b3ec61Sdh155122 ipsec_stack_t *ipss;
2463f4b3ec61Sdh155122 ip_stack_t *ipst;
2464f4b3ec61Sdh155122 netstack_t *ns;
246550b2f153SVladimir Kotal ipsec_policy_head_t *policy_head;
2466bd670b35SErik Nordmark ipsec_policy_t *p = NULL;
24677c478bd9Sstevel@tonic-gate
24687c478bd9Sstevel@tonic-gate ASSERT(connp != NULL);
2469f4b3ec61Sdh155122 ns = connp->conn_netstack;
2470f4b3ec61Sdh155122 ipss = ns->netstack_ipsec;
2471f4b3ec61Sdh155122 ipst = ns->netstack_ip;
24727c478bd9Sstevel@tonic-gate
2473bd670b35SErik Nordmark if (!(ira->ira_flags & IRAF_IPSEC_SECURE)) {
24747c478bd9Sstevel@tonic-gate /*
24757c478bd9Sstevel@tonic-gate * This is the case where the incoming datagram is
24767c478bd9Sstevel@tonic-gate * cleartext and we need to see whether this client
24777c478bd9Sstevel@tonic-gate * would like to receive such untrustworthy things from
24787c478bd9Sstevel@tonic-gate * the wire.
24797c478bd9Sstevel@tonic-gate */
24807c478bd9Sstevel@tonic-gate ASSERT(mp != NULL);
24817c478bd9Sstevel@tonic-gate
2482a065e3c6SGeorge Shepherd mutex_enter(&connp->conn_lock);
2483a065e3c6SGeorge Shepherd if (connp->conn_state_flags & CONN_CONDEMNED) {
2484a065e3c6SGeorge Shepherd mutex_exit(&connp->conn_lock);
2485bd670b35SErik Nordmark ip_drop_packet(mp, B_TRUE, NULL,
2486bd670b35SErik Nordmark DROPPER(ipss, ipds_spd_got_clear),
2487a065e3c6SGeorge Shepherd &ipss->ipsec_spd_dropper);
2488a065e3c6SGeorge Shepherd BUMP_MIB(&ipst->ips_ip_mib, ipsecInFailed);
2489a065e3c6SGeorge Shepherd return (NULL);
2490a065e3c6SGeorge Shepherd }
2491bd670b35SErik Nordmark if (connp->conn_latch != NULL) {
2492a065e3c6SGeorge Shepherd /* Hold a reference in case the conn is closing */
2493bd670b35SErik Nordmark p = connp->conn_latch_in_policy;
2494bd670b35SErik Nordmark if (p != NULL)
2495bd670b35SErik Nordmark IPPOL_REFHOLD(p);
2496a065e3c6SGeorge Shepherd mutex_exit(&connp->conn_lock);
24977c478bd9Sstevel@tonic-gate /*
24987c478bd9Sstevel@tonic-gate * Policy is cached in the conn.
24997c478bd9Sstevel@tonic-gate */
2500bd670b35SErik Nordmark if (p != NULL && !p->ipsp_act->ipa_allow_clear) {
25017c478bd9Sstevel@tonic-gate ret = ipsec_inbound_accept_clear(mp,
25027c478bd9Sstevel@tonic-gate ipha, ip6h);
25037c478bd9Sstevel@tonic-gate if (ret) {
2504f4b3ec61Sdh155122 BUMP_MIB(&ipst->ips_ip_mib,
2505f4b3ec61Sdh155122 ipsecInSucceeded);
2506bd670b35SErik Nordmark IPPOL_REFRELE(p);
2507bd670b35SErik Nordmark return (mp);
25087c478bd9Sstevel@tonic-gate } else {
25097c478bd9Sstevel@tonic-gate ipsec_log_policy_failure(
25107c478bd9Sstevel@tonic-gate IPSEC_POLICY_MISMATCH,
25117c478bd9Sstevel@tonic-gate "ipsec_check_inbound_policy", ipha,
2512f4b3ec61Sdh155122 ip6h, B_FALSE, ns);
2513bd670b35SErik Nordmark ip_drop_packet(mp, B_TRUE, NULL,
2514f4b3ec61Sdh155122 DROPPER(ipss, ipds_spd_got_clear),
2515f4b3ec61Sdh155122 &ipss->ipsec_spd_dropper);
2516f4b3ec61Sdh155122 BUMP_MIB(&ipst->ips_ip_mib,
2517f4b3ec61Sdh155122 ipsecInFailed);
2518bd670b35SErik Nordmark IPPOL_REFRELE(p);
25197c478bd9Sstevel@tonic-gate return (NULL);
25207c478bd9Sstevel@tonic-gate }
25217c478bd9Sstevel@tonic-gate } else {
2522f4b3ec61Sdh155122 BUMP_MIB(&ipst->ips_ip_mib, ipsecInSucceeded);
2523bd670b35SErik Nordmark if (p != NULL)
2524bd670b35SErik Nordmark IPPOL_REFRELE(p);
2525bd670b35SErik Nordmark return (mp);
25267c478bd9Sstevel@tonic-gate }
25277c478bd9Sstevel@tonic-gate } else {
252850b2f153SVladimir Kotal policy_head = connp->conn_policy;
2529a065e3c6SGeorge Shepherd
253050b2f153SVladimir Kotal /* Hold a reference in case the conn is closing */
253150b2f153SVladimir Kotal if (policy_head != NULL)
253250b2f153SVladimir Kotal IPPH_REFHOLD(policy_head);
2533a065e3c6SGeorge Shepherd mutex_exit(&connp->conn_lock);
25347c478bd9Sstevel@tonic-gate /*
25357c478bd9Sstevel@tonic-gate * As this is a non-hardbound connection we need
25367c478bd9Sstevel@tonic-gate * to look at both per-socket policy and global
2537bd670b35SErik Nordmark * policy.
25387c478bd9Sstevel@tonic-gate */
2539bd670b35SErik Nordmark mp = ipsec_check_global_policy(mp, connp,
2540bd670b35SErik Nordmark ipha, ip6h, ira, ns);
254150b2f153SVladimir Kotal if (policy_head != NULL)
254250b2f153SVladimir Kotal IPPH_REFRELE(policy_head, ns);
2543bd670b35SErik Nordmark return (mp);
25447c478bd9Sstevel@tonic-gate }
25457c478bd9Sstevel@tonic-gate }
25467c478bd9Sstevel@tonic-gate
2547a065e3c6SGeorge Shepherd mutex_enter(&connp->conn_lock);
2548a065e3c6SGeorge Shepherd /* Connection is closing */
2549a065e3c6SGeorge Shepherd if (connp->conn_state_flags & CONN_CONDEMNED) {
2550a065e3c6SGeorge Shepherd mutex_exit(&connp->conn_lock);
2551bd670b35SErik Nordmark ip_drop_packet(mp, B_TRUE, NULL,
2552bd670b35SErik Nordmark DROPPER(ipss, ipds_spd_got_clear),
2553a065e3c6SGeorge Shepherd &ipss->ipsec_spd_dropper);
2554a065e3c6SGeorge Shepherd BUMP_MIB(&ipst->ips_ip_mib, ipsecInFailed);
2555a065e3c6SGeorge Shepherd return (NULL);
2556a065e3c6SGeorge Shepherd }
2557a065e3c6SGeorge Shepherd
2558a065e3c6SGeorge Shepherd /*
2559a065e3c6SGeorge Shepherd * Once a connection is latched it remains so for life, the conn_latch
2560a065e3c6SGeorge Shepherd * pointer on the conn has not changed, simply initializing ipl here
2561a065e3c6SGeorge Shepherd * as the earlier initialization was done only in the cleartext case.
2562a065e3c6SGeorge Shepherd */
256336cdea1aSDan McDonald if ((ipl = connp->conn_latch) == NULL) {
256450b2f153SVladimir Kotal mblk_t *retmp;
256550b2f153SVladimir Kotal policy_head = connp->conn_policy;
256650b2f153SVladimir Kotal
256750b2f153SVladimir Kotal /* Hold a reference in case the conn is closing */
256850b2f153SVladimir Kotal if (policy_head != NULL)
256950b2f153SVladimir Kotal IPPH_REFHOLD(policy_head);
2570a065e3c6SGeorge Shepherd mutex_exit(&connp->conn_lock);
25717c478bd9Sstevel@tonic-gate /*
257207b56925Ssommerfe * We don't have policies cached in the conn
25737c478bd9Sstevel@tonic-gate * for this stream. So, look at the global
25747c478bd9Sstevel@tonic-gate * policy. It will check against conn or global
25757c478bd9Sstevel@tonic-gate * depending on whichever is stronger.
25767c478bd9Sstevel@tonic-gate */
2577bd670b35SErik Nordmark retmp = ipsec_check_global_policy(mp, connp,
2578bd670b35SErik Nordmark ipha, ip6h, ira, ns);
257950b2f153SVladimir Kotal if (policy_head != NULL)
258050b2f153SVladimir Kotal IPPH_REFRELE(policy_head, ns);
258150b2f153SVladimir Kotal return (retmp);
258207b56925Ssommerfe }
258307b56925Ssommerfe
2584a065e3c6SGeorge Shepherd IPLATCH_REFHOLD(ipl);
2585bd670b35SErik Nordmark /* Hold reference on conn_latch_in_action in case conn is closing */
2586bd670b35SErik Nordmark ap = connp->conn_latch_in_action;
2587bd670b35SErik Nordmark if (ap != NULL)
2588bd670b35SErik Nordmark IPACT_REFHOLD(ap);
2589a065e3c6SGeorge Shepherd mutex_exit(&connp->conn_lock);
2590a065e3c6SGeorge Shepherd
2591bd670b35SErik Nordmark if (ap != NULL) {
25927c478bd9Sstevel@tonic-gate /* Policy is cached & latched; fast(er) path */
25937c478bd9Sstevel@tonic-gate const char *reason;
25947c478bd9Sstevel@tonic-gate kstat_named_t *counter;
2595f4b3ec61Sdh155122
2596bd670b35SErik Nordmark if (ipsec_check_ipsecin_latch(ira, mp, ipl, ap,
2597bd670b35SErik Nordmark ipha, ip6h, &reason, &counter, connp, ns)) {
2598f4b3ec61Sdh155122 BUMP_MIB(&ipst->ips_ip_mib, ipsecInSucceeded);
2599bd670b35SErik Nordmark IPLATCH_REFRELE(ipl);
2600bd670b35SErik Nordmark IPACT_REFRELE(ap);
2601bd670b35SErik Nordmark return (mp);
26027c478bd9Sstevel@tonic-gate }
2603f4b3ec61Sdh155122 ipsec_rl_strlog(ns, IP_MOD_ID, 0, 0,
2604f4b3ec61Sdh155122 SL_ERROR|SL_WARN|SL_CONSOLE,
26057c478bd9Sstevel@tonic-gate "ipsec inbound policy mismatch: %s, packet dropped\n",
26067c478bd9Sstevel@tonic-gate reason);
2607bd670b35SErik Nordmark ip_drop_packet(mp, B_TRUE, NULL, counter,
2608f4b3ec61Sdh155122 &ipss->ipsec_spd_dropper);
2609f4b3ec61Sdh155122 BUMP_MIB(&ipst->ips_ip_mib, ipsecInFailed);
2610bd670b35SErik Nordmark IPLATCH_REFRELE(ipl);
2611bd670b35SErik Nordmark IPACT_REFRELE(ap);
26127c478bd9Sstevel@tonic-gate return (NULL);
2613bd670b35SErik Nordmark }
2614bd670b35SErik Nordmark if ((p = connp->conn_latch_in_policy) == NULL) {
261507b56925Ssommerfe ipsec_weird_null_inbound_policy++;
2616bd670b35SErik Nordmark IPLATCH_REFRELE(ipl);
2617bd670b35SErik Nordmark return (mp);
261807b56925Ssommerfe }
26197c478bd9Sstevel@tonic-gate
26208810c16bSdanmcd unique_id = conn_to_unique(connp, mp, ipha, ip6h);
2621bd670b35SErik Nordmark IPPOL_REFHOLD(p);
2622bd670b35SErik Nordmark mp = ipsec_check_ipsecin_policy(mp, p, ipha, ip6h, unique_id, ira, ns);
26237c478bd9Sstevel@tonic-gate /*
26247c478bd9Sstevel@tonic-gate * NOTE: ipsecIn{Failed,Succeeeded} bumped by
26257c478bd9Sstevel@tonic-gate * ipsec_check_ipsecin_policy().
26267c478bd9Sstevel@tonic-gate */
2627bd670b35SErik Nordmark if (mp != NULL)
2628bd670b35SErik Nordmark ipsec_latch_inbound(connp, ira);
2629bd670b35SErik Nordmark IPLATCH_REFRELE(ipl);
2630bd670b35SErik Nordmark return (mp);
26317c478bd9Sstevel@tonic-gate }
26327c478bd9Sstevel@tonic-gate
26338810c16bSdanmcd /*
2634bd670b35SErik Nordmark * Handle all sorts of cases like tunnel-mode and ICMP.
26355d3b8cb7SBill Sommerfeld */
26365d3b8cb7SBill Sommerfeld static int
prepended_length(mblk_t * mp,uintptr_t hptr)26375d3b8cb7SBill Sommerfeld prepended_length(mblk_t *mp, uintptr_t hptr)
26385d3b8cb7SBill Sommerfeld {
26395d3b8cb7SBill Sommerfeld int rc = 0;
26405d3b8cb7SBill Sommerfeld
26415d3b8cb7SBill Sommerfeld while (mp != NULL) {
26425d3b8cb7SBill Sommerfeld if (hptr >= (uintptr_t)mp->b_rptr && hptr <
26435d3b8cb7SBill Sommerfeld (uintptr_t)mp->b_wptr) {
26445d3b8cb7SBill Sommerfeld rc += (int)(hptr - (uintptr_t)mp->b_rptr);
26455d3b8cb7SBill Sommerfeld break; /* out of while loop */
26465d3b8cb7SBill Sommerfeld }
26475d3b8cb7SBill Sommerfeld rc += (int)MBLKL(mp);
26485d3b8cb7SBill Sommerfeld mp = mp->b_cont;
26495d3b8cb7SBill Sommerfeld }
26505d3b8cb7SBill Sommerfeld
26515d3b8cb7SBill Sommerfeld if (mp == NULL) {
26525d3b8cb7SBill Sommerfeld /*
26535d3b8cb7SBill Sommerfeld * IF (big IF) we make it here by naturally exiting the loop,
26545d3b8cb7SBill Sommerfeld * then ip6h isn't in the mblk chain "mp" at all.
26555d3b8cb7SBill Sommerfeld *
26565d3b8cb7SBill Sommerfeld * The only case where this happens is with a reversed IP
26575d3b8cb7SBill Sommerfeld * header that gets passed up by inbound ICMP processing.
26585d3b8cb7SBill Sommerfeld * This unfortunately triggers longstanding bug 6478464. For
26595d3b8cb7SBill Sommerfeld * now, just pass up 0 for the answer.
26605d3b8cb7SBill Sommerfeld */
26615d3b8cb7SBill Sommerfeld #ifdef DEBUG_NOT_UNTIL_6478464
26625d3b8cb7SBill Sommerfeld ASSERT(mp != NULL);
26635d3b8cb7SBill Sommerfeld #endif
26645d3b8cb7SBill Sommerfeld rc = 0;
26655d3b8cb7SBill Sommerfeld }
26665d3b8cb7SBill Sommerfeld
26675d3b8cb7SBill Sommerfeld return (rc);
26685d3b8cb7SBill Sommerfeld }
26695d3b8cb7SBill Sommerfeld
26705d3b8cb7SBill Sommerfeld /*
26718810c16bSdanmcd * Returns:
26728810c16bSdanmcd *
26738810c16bSdanmcd * SELRET_NOMEM --> msgpullup() needed to gather things failed.
26748810c16bSdanmcd * SELRET_BADPKT --> If we're being called after tunnel-mode fragment
26758810c16bSdanmcd * gathering, the initial fragment is too short for
26768810c16bSdanmcd * useful data. Only returned if SEL_TUNNEL_FIRSTFRAG is
26778810c16bSdanmcd * set.
26788810c16bSdanmcd * SELRET_SUCCESS --> "sel" now has initialized IPsec selector data.
26798810c16bSdanmcd * SELRET_TUNFRAG --> This is a fragment in a tunnel-mode packet. Caller
26808810c16bSdanmcd * should put this packet in a fragment-gathering queue.
26818810c16bSdanmcd * Only returned if SEL_TUNNEL_MODE and SEL_PORT_POLICY
26828810c16bSdanmcd * is set.
2683bd670b35SErik Nordmark *
2684bd670b35SErik Nordmark * Note that ipha/ip6h can be in a different mblk (mp->b_cont) in the case
2685bd670b35SErik Nordmark * of tunneled packets.
2686bd670b35SErik Nordmark * Also, mp->b_rptr can be an ICMP error where ipha/ip6h is the packet in
2687bd670b35SErik Nordmark * error past the ICMP error.
26888810c16bSdanmcd */
26898810c16bSdanmcd static selret_t
ipsec_init_inbound_sel(ipsec_selector_t * sel,mblk_t * mp,ipha_t * ipha,ip6_t * ip6h,uint8_t sel_flags)26908810c16bSdanmcd ipsec_init_inbound_sel(ipsec_selector_t *sel, mblk_t *mp, ipha_t *ipha,
26918810c16bSdanmcd ip6_t *ip6h, uint8_t sel_flags)
26927c478bd9Sstevel@tonic-gate {
26937c478bd9Sstevel@tonic-gate uint16_t *ports;
2694bd670b35SErik Nordmark int outer_hdr_len = 0; /* For ICMP or tunnel-mode cases... */
26957c478bd9Sstevel@tonic-gate ushort_t hdr_len;
26967c478bd9Sstevel@tonic-gate mblk_t *spare_mp = NULL;
26975d3b8cb7SBill Sommerfeld uint8_t *nexthdrp, *transportp;
26987c478bd9Sstevel@tonic-gate uint8_t nexthdr;
26995d3b8cb7SBill Sommerfeld uint8_t icmp_proto;
2700bd670b35SErik Nordmark ip_pkt_t ipp;
27018810c16bSdanmcd boolean_t port_policy_present = (sel_flags & SEL_PORT_POLICY);
27028810c16bSdanmcd boolean_t is_icmp = (sel_flags & SEL_IS_ICMP);
27038810c16bSdanmcd boolean_t tunnel_mode = (sel_flags & SEL_TUNNEL_MODE);
27042b24ab6bSSebastien Roy boolean_t post_frag = (sel_flags & SEL_POST_FRAG);
27057c478bd9Sstevel@tonic-gate
27067c478bd9Sstevel@tonic-gate ASSERT((ipha == NULL && ip6h != NULL) ||
27077c478bd9Sstevel@tonic-gate (ipha != NULL && ip6h == NULL));
27087c478bd9Sstevel@tonic-gate
27097c478bd9Sstevel@tonic-gate if (ip6h != NULL) {
27105d3b8cb7SBill Sommerfeld outer_hdr_len = prepended_length(mp, (uintptr_t)ip6h);
27115d3b8cb7SBill Sommerfeld nexthdr = ip6h->ip6_nxt;
27125d3b8cb7SBill Sommerfeld icmp_proto = IPPROTO_ICMPV6;
27137c478bd9Sstevel@tonic-gate sel->ips_isv4 = B_FALSE;
27147c478bd9Sstevel@tonic-gate sel->ips_local_addr_v6 = ip6h->ip6_dst;
27157c478bd9Sstevel@tonic-gate sel->ips_remote_addr_v6 = ip6h->ip6_src;
27167c478bd9Sstevel@tonic-gate
27178810c16bSdanmcd bzero(&ipp, sizeof (ipp));
27188810c16bSdanmcd
27197c478bd9Sstevel@tonic-gate switch (nexthdr) {
27207c478bd9Sstevel@tonic-gate case IPPROTO_HOPOPTS:
27217c478bd9Sstevel@tonic-gate case IPPROTO_ROUTING:
27227c478bd9Sstevel@tonic-gate case IPPROTO_DSTOPTS:
27238810c16bSdanmcd case IPPROTO_FRAGMENT:
27247c478bd9Sstevel@tonic-gate /*
27257c478bd9Sstevel@tonic-gate * Use ip_hdr_length_nexthdr_v6(). And have a spare
27267c478bd9Sstevel@tonic-gate * mblk that's contiguous to feed it
27277c478bd9Sstevel@tonic-gate */
27287c478bd9Sstevel@tonic-gate if ((spare_mp = msgpullup(mp, -1)) == NULL)
27298810c16bSdanmcd return (SELRET_NOMEM);
27307c478bd9Sstevel@tonic-gate if (!ip_hdr_length_nexthdr_v6(spare_mp,
27318810c16bSdanmcd (ip6_t *)(spare_mp->b_rptr + outer_hdr_len),
27328810c16bSdanmcd &hdr_len, &nexthdrp)) {
27338810c16bSdanmcd /* Malformed packet - caller frees. */
27348810c16bSdanmcd ipsec_freemsg_chain(spare_mp);
27358810c16bSdanmcd return (SELRET_BADPKT);
27367c478bd9Sstevel@tonic-gate }
2737d1a98e54SPaul Wernau /* Repopulate now that we have the whole packet */
2738d1a98e54SPaul Wernau ip6h = (ip6_t *)(spare_mp->b_rptr + outer_hdr_len);
2739d1a98e54SPaul Wernau (void) ip_find_hdr_v6(spare_mp, ip6h, B_FALSE, &ipp,
2740d1a98e54SPaul Wernau NULL);
27417c478bd9Sstevel@tonic-gate nexthdr = *nexthdrp;
27427c478bd9Sstevel@tonic-gate /* We can just extract based on hdr_len now. */
27437c478bd9Sstevel@tonic-gate break;
27447c478bd9Sstevel@tonic-gate default:
2745d1a98e54SPaul Wernau (void) ip_find_hdr_v6(mp, ip6h, B_FALSE, &ipp, NULL);
27467c478bd9Sstevel@tonic-gate hdr_len = IPV6_HDR_LEN;
27477c478bd9Sstevel@tonic-gate break;
27487c478bd9Sstevel@tonic-gate }
27498810c16bSdanmcd if (port_policy_present && IS_V6_FRAGMENT(ipp) && !is_icmp) {
27508810c16bSdanmcd /* IPv6 Fragment */
27518810c16bSdanmcd ipsec_freemsg_chain(spare_mp);
27528810c16bSdanmcd return (SELRET_TUNFRAG);
27538810c16bSdanmcd }
27545d3b8cb7SBill Sommerfeld transportp = (uint8_t *)ip6h + hdr_len;
27557c478bd9Sstevel@tonic-gate } else {
27565d3b8cb7SBill Sommerfeld outer_hdr_len = prepended_length(mp, (uintptr_t)ipha);
27575d3b8cb7SBill Sommerfeld icmp_proto = IPPROTO_ICMP;
27587c478bd9Sstevel@tonic-gate sel->ips_isv4 = B_TRUE;
27597c478bd9Sstevel@tonic-gate sel->ips_local_addr_v4 = ipha->ipha_dst;
27607c478bd9Sstevel@tonic-gate sel->ips_remote_addr_v4 = ipha->ipha_src;
27617c478bd9Sstevel@tonic-gate nexthdr = ipha->ipha_protocol;
27627c478bd9Sstevel@tonic-gate hdr_len = IPH_HDR_LENGTH(ipha);
27638810c16bSdanmcd
27648810c16bSdanmcd if (port_policy_present &&
27658810c16bSdanmcd IS_V4_FRAGMENT(ipha->ipha_fragment_offset_and_flags) &&
27668810c16bSdanmcd !is_icmp) {
27678810c16bSdanmcd /* IPv4 Fragment */
27688810c16bSdanmcd ipsec_freemsg_chain(spare_mp);
27698810c16bSdanmcd return (SELRET_TUNFRAG);
27708810c16bSdanmcd }
27715d3b8cb7SBill Sommerfeld transportp = (uint8_t *)ipha + hdr_len;
27727c478bd9Sstevel@tonic-gate }
27737c478bd9Sstevel@tonic-gate sel->ips_protocol = nexthdr;
27747c478bd9Sstevel@tonic-gate
27758810c16bSdanmcd if ((nexthdr != IPPROTO_TCP && nexthdr != IPPROTO_UDP &&
27765d3b8cb7SBill Sommerfeld nexthdr != IPPROTO_SCTP && nexthdr != icmp_proto) ||
27772b24ab6bSSebastien Roy (!port_policy_present && !post_frag && tunnel_mode)) {
27787c478bd9Sstevel@tonic-gate sel->ips_remote_port = sel->ips_local_port = 0;
27798810c16bSdanmcd ipsec_freemsg_chain(spare_mp);
27808810c16bSdanmcd return (SELRET_SUCCESS);
27817c478bd9Sstevel@tonic-gate }
27827c478bd9Sstevel@tonic-gate
27835d3b8cb7SBill Sommerfeld if (transportp + 4 > mp->b_wptr) {
27847c478bd9Sstevel@tonic-gate /* If we didn't pullup a copy already, do so now. */
27857c478bd9Sstevel@tonic-gate /*
27867c478bd9Sstevel@tonic-gate * XXX performance, will upper-layers frequently split TCP/UDP
27877c478bd9Sstevel@tonic-gate * apart from IP or options? If so, perhaps we should revisit
27887c478bd9Sstevel@tonic-gate * the spare_mp strategy.
27897c478bd9Sstevel@tonic-gate */
279007b56925Ssommerfe ipsec_hdr_pullup_needed++;
27917c478bd9Sstevel@tonic-gate if (spare_mp == NULL &&
27927c478bd9Sstevel@tonic-gate (spare_mp = msgpullup(mp, -1)) == NULL) {
27938810c16bSdanmcd return (SELRET_NOMEM);
27947c478bd9Sstevel@tonic-gate }
27955d3b8cb7SBill Sommerfeld transportp = &spare_mp->b_rptr[hdr_len + outer_hdr_len];
27967c478bd9Sstevel@tonic-gate }
27977c478bd9Sstevel@tonic-gate
27985d3b8cb7SBill Sommerfeld if (nexthdr == icmp_proto) {
27995d3b8cb7SBill Sommerfeld sel->ips_icmp_type = *transportp++;
28005d3b8cb7SBill Sommerfeld sel->ips_icmp_code = *transportp;
28017c478bd9Sstevel@tonic-gate sel->ips_remote_port = sel->ips_local_port = 0;
28028810c16bSdanmcd } else {
28035d3b8cb7SBill Sommerfeld ports = (uint16_t *)transportp;
28047c478bd9Sstevel@tonic-gate sel->ips_remote_port = *ports++;
28057c478bd9Sstevel@tonic-gate sel->ips_local_port = *ports;
28068810c16bSdanmcd }
28078810c16bSdanmcd ipsec_freemsg_chain(spare_mp);
28088810c16bSdanmcd return (SELRET_SUCCESS);
28097c478bd9Sstevel@tonic-gate }
28107c478bd9Sstevel@tonic-gate
2811bd670b35SErik Nordmark /*
2812bd670b35SErik Nordmark * This is called with a b_next chain of messages from the fragcache code,
2813bd670b35SErik Nordmark * hence it needs to discard a chain on error.
2814bd670b35SErik Nordmark */
28157c478bd9Sstevel@tonic-gate static boolean_t
ipsec_init_outbound_ports(ipsec_selector_t * sel,mblk_t * mp,ipha_t * ipha,ip6_t * ip6h,int outer_hdr_len,ipsec_stack_t * ipss)28167c478bd9Sstevel@tonic-gate ipsec_init_outbound_ports(ipsec_selector_t *sel, mblk_t *mp, ipha_t *ipha,
2817f4b3ec61Sdh155122 ip6_t *ip6h, int outer_hdr_len, ipsec_stack_t *ipss)
28187c478bd9Sstevel@tonic-gate {
28197c478bd9Sstevel@tonic-gate /*
28207c478bd9Sstevel@tonic-gate * XXX cut&paste shared with ipsec_init_inbound_sel
28217c478bd9Sstevel@tonic-gate */
28227c478bd9Sstevel@tonic-gate uint16_t *ports;
28237c478bd9Sstevel@tonic-gate ushort_t hdr_len;
28247c478bd9Sstevel@tonic-gate mblk_t *spare_mp = NULL;
28257c478bd9Sstevel@tonic-gate uint8_t *nexthdrp;
28267c478bd9Sstevel@tonic-gate uint8_t nexthdr;
28277c478bd9Sstevel@tonic-gate uint8_t *typecode;
28287c478bd9Sstevel@tonic-gate uint8_t check_proto;
28297c478bd9Sstevel@tonic-gate
28307c478bd9Sstevel@tonic-gate ASSERT((ipha == NULL && ip6h != NULL) ||
28317c478bd9Sstevel@tonic-gate (ipha != NULL && ip6h == NULL));
28327c478bd9Sstevel@tonic-gate
28337c478bd9Sstevel@tonic-gate if (ip6h != NULL) {
28347c478bd9Sstevel@tonic-gate check_proto = IPPROTO_ICMPV6;
28357c478bd9Sstevel@tonic-gate nexthdr = ip6h->ip6_nxt;
28367c478bd9Sstevel@tonic-gate switch (nexthdr) {
28377c478bd9Sstevel@tonic-gate case IPPROTO_HOPOPTS:
28387c478bd9Sstevel@tonic-gate case IPPROTO_ROUTING:
28397c478bd9Sstevel@tonic-gate case IPPROTO_DSTOPTS:
28408810c16bSdanmcd case IPPROTO_FRAGMENT:
28417c478bd9Sstevel@tonic-gate /*
28427c478bd9Sstevel@tonic-gate * Use ip_hdr_length_nexthdr_v6(). And have a spare
28437c478bd9Sstevel@tonic-gate * mblk that's contiguous to feed it
28447c478bd9Sstevel@tonic-gate */
28457c478bd9Sstevel@tonic-gate spare_mp = msgpullup(mp, -1);
28467c478bd9Sstevel@tonic-gate if (spare_mp == NULL ||
28477c478bd9Sstevel@tonic-gate !ip_hdr_length_nexthdr_v6(spare_mp,
28488810c16bSdanmcd (ip6_t *)(spare_mp->b_rptr + outer_hdr_len),
28498810c16bSdanmcd &hdr_len, &nexthdrp)) {
28507c478bd9Sstevel@tonic-gate /* Always works, even if NULL. */
28518810c16bSdanmcd ipsec_freemsg_chain(spare_mp);
2852bd670b35SErik Nordmark ip_drop_packet_chain(mp, B_FALSE, NULL,
2853f4b3ec61Sdh155122 DROPPER(ipss, ipds_spd_nomem),
2854f4b3ec61Sdh155122 &ipss->ipsec_spd_dropper);
28557c478bd9Sstevel@tonic-gate return (B_FALSE);
28567c478bd9Sstevel@tonic-gate } else {
28577c478bd9Sstevel@tonic-gate nexthdr = *nexthdrp;
28587c478bd9Sstevel@tonic-gate /* We can just extract based on hdr_len now. */
28597c478bd9Sstevel@tonic-gate }
28607c478bd9Sstevel@tonic-gate break;
28617c478bd9Sstevel@tonic-gate default:
28627c478bd9Sstevel@tonic-gate hdr_len = IPV6_HDR_LEN;
28637c478bd9Sstevel@tonic-gate break;
28647c478bd9Sstevel@tonic-gate }
28657c478bd9Sstevel@tonic-gate } else {
28667c478bd9Sstevel@tonic-gate check_proto = IPPROTO_ICMP;
28677c478bd9Sstevel@tonic-gate hdr_len = IPH_HDR_LENGTH(ipha);
28687c478bd9Sstevel@tonic-gate nexthdr = ipha->ipha_protocol;
28697c478bd9Sstevel@tonic-gate }
28707c478bd9Sstevel@tonic-gate
28717c478bd9Sstevel@tonic-gate sel->ips_protocol = nexthdr;
28727c478bd9Sstevel@tonic-gate if (nexthdr != IPPROTO_TCP && nexthdr != IPPROTO_UDP &&
28737c478bd9Sstevel@tonic-gate nexthdr != IPPROTO_SCTP && nexthdr != check_proto) {
28747c478bd9Sstevel@tonic-gate sel->ips_local_port = sel->ips_remote_port = 0;
28758810c16bSdanmcd ipsec_freemsg_chain(spare_mp); /* Always works, even if NULL */
28767c478bd9Sstevel@tonic-gate return (B_TRUE);
28777c478bd9Sstevel@tonic-gate }
28787c478bd9Sstevel@tonic-gate
28798810c16bSdanmcd if (&mp->b_rptr[hdr_len] + 4 + outer_hdr_len > mp->b_wptr) {
28807c478bd9Sstevel@tonic-gate /* If we didn't pullup a copy already, do so now. */
28817c478bd9Sstevel@tonic-gate /*
28827c478bd9Sstevel@tonic-gate * XXX performance, will upper-layers frequently split TCP/UDP
28837c478bd9Sstevel@tonic-gate * apart from IP or options? If so, perhaps we should revisit
28847c478bd9Sstevel@tonic-gate * the spare_mp strategy.
28857c478bd9Sstevel@tonic-gate *
28867c478bd9Sstevel@tonic-gate * XXX should this be msgpullup(mp, hdr_len+4) ???
28877c478bd9Sstevel@tonic-gate */
28887c478bd9Sstevel@tonic-gate if (spare_mp == NULL &&
28897c478bd9Sstevel@tonic-gate (spare_mp = msgpullup(mp, -1)) == NULL) {
2890bd670b35SErik Nordmark ip_drop_packet_chain(mp, B_FALSE, NULL,
2891f4b3ec61Sdh155122 DROPPER(ipss, ipds_spd_nomem),
2892f4b3ec61Sdh155122 &ipss->ipsec_spd_dropper);
28937c478bd9Sstevel@tonic-gate return (B_FALSE);
28947c478bd9Sstevel@tonic-gate }
28958810c16bSdanmcd ports = (uint16_t *)&spare_mp->b_rptr[hdr_len + outer_hdr_len];
28967c478bd9Sstevel@tonic-gate } else {
28978810c16bSdanmcd ports = (uint16_t *)&mp->b_rptr[hdr_len + outer_hdr_len];
28987c478bd9Sstevel@tonic-gate }
28997c478bd9Sstevel@tonic-gate
29007c478bd9Sstevel@tonic-gate if (nexthdr == check_proto) {
29017c478bd9Sstevel@tonic-gate typecode = (uint8_t *)ports;
29027c478bd9Sstevel@tonic-gate sel->ips_icmp_type = *typecode++;
29037c478bd9Sstevel@tonic-gate sel->ips_icmp_code = *typecode;
29047c478bd9Sstevel@tonic-gate sel->ips_remote_port = sel->ips_local_port = 0;
29058810c16bSdanmcd } else {
29067c478bd9Sstevel@tonic-gate sel->ips_local_port = *ports++;
29077c478bd9Sstevel@tonic-gate sel->ips_remote_port = *ports;
29088810c16bSdanmcd }
29098810c16bSdanmcd ipsec_freemsg_chain(spare_mp); /* Always works, even if NULL */
29107c478bd9Sstevel@tonic-gate return (B_TRUE);
29117c478bd9Sstevel@tonic-gate }
29127c478bd9Sstevel@tonic-gate
29137c478bd9Sstevel@tonic-gate /*
2914bd670b35SErik Nordmark * Prepend an mblk with a ipsec_crypto_t to the message chain.
2915bd670b35SErik Nordmark * Frees the argument and returns NULL should the allocation fail.
2916bd670b35SErik Nordmark * Returns the pointer to the crypto data part.
2917bd670b35SErik Nordmark */
2918bd670b35SErik Nordmark mblk_t *
ipsec_add_crypto_data(mblk_t * data_mp,ipsec_crypto_t ** icp)2919bd670b35SErik Nordmark ipsec_add_crypto_data(mblk_t *data_mp, ipsec_crypto_t **icp)
2920bd670b35SErik Nordmark {
2921bd670b35SErik Nordmark mblk_t *mp;
2922bd670b35SErik Nordmark
2923bd670b35SErik Nordmark mp = allocb(sizeof (ipsec_crypto_t), BPRI_MED);
2924bd670b35SErik Nordmark if (mp == NULL) {
2925bd670b35SErik Nordmark freemsg(data_mp);
2926bd670b35SErik Nordmark return (NULL);
2927bd670b35SErik Nordmark }
2928bd670b35SErik Nordmark bzero(mp->b_rptr, sizeof (ipsec_crypto_t));
2929bd670b35SErik Nordmark mp->b_wptr += sizeof (ipsec_crypto_t);
2930bd670b35SErik Nordmark mp->b_cont = data_mp;
2931bd670b35SErik Nordmark mp->b_datap->db_type = M_EVENT; /* For ASSERT */
2932bd670b35SErik Nordmark *icp = (ipsec_crypto_t *)mp->b_rptr;
2933bd670b35SErik Nordmark return (mp);
2934bd670b35SErik Nordmark }
2935bd670b35SErik Nordmark
2936bd670b35SErik Nordmark /*
2937bd670b35SErik Nordmark * Remove what was prepended above. Return b_cont and a pointer to the
2938bd670b35SErik Nordmark * crypto data.
2939bd670b35SErik Nordmark * The caller must call ipsec_free_crypto_data for mblk once it is done
2940bd670b35SErik Nordmark * with the crypto data.
2941bd670b35SErik Nordmark */
2942bd670b35SErik Nordmark mblk_t *
ipsec_remove_crypto_data(mblk_t * crypto_mp,ipsec_crypto_t ** icp)2943bd670b35SErik Nordmark ipsec_remove_crypto_data(mblk_t *crypto_mp, ipsec_crypto_t **icp)
2944bd670b35SErik Nordmark {
2945bd670b35SErik Nordmark ASSERT(crypto_mp->b_datap->db_type == M_EVENT);
2946bd670b35SErik Nordmark ASSERT(MBLKL(crypto_mp) == sizeof (ipsec_crypto_t));
2947bd670b35SErik Nordmark
2948bd670b35SErik Nordmark *icp = (ipsec_crypto_t *)crypto_mp->b_rptr;
2949bd670b35SErik Nordmark return (crypto_mp->b_cont);
2950bd670b35SErik Nordmark }
2951bd670b35SErik Nordmark
2952bd670b35SErik Nordmark /*
2953bd670b35SErik Nordmark * Free what was prepended above. Return b_cont.
2954bd670b35SErik Nordmark */
2955bd670b35SErik Nordmark mblk_t *
ipsec_free_crypto_data(mblk_t * crypto_mp)2956bd670b35SErik Nordmark ipsec_free_crypto_data(mblk_t *crypto_mp)
2957bd670b35SErik Nordmark {
2958bd670b35SErik Nordmark mblk_t *mp;
2959bd670b35SErik Nordmark
2960bd670b35SErik Nordmark ASSERT(crypto_mp->b_datap->db_type == M_EVENT);
2961bd670b35SErik Nordmark ASSERT(MBLKL(crypto_mp) == sizeof (ipsec_crypto_t));
2962bd670b35SErik Nordmark
2963bd670b35SErik Nordmark mp = crypto_mp->b_cont;
2964bd670b35SErik Nordmark freeb(crypto_mp);
2965bd670b35SErik Nordmark return (mp);
2966bd670b35SErik Nordmark }
2967bd670b35SErik Nordmark
2968bd670b35SErik Nordmark /*
29697c478bd9Sstevel@tonic-gate * Create an ipsec_action_t based on the way an inbound packet was protected.
29707c478bd9Sstevel@tonic-gate * Used to reflect traffic back to a sender.
29717c478bd9Sstevel@tonic-gate *
29727c478bd9Sstevel@tonic-gate * We don't bother interning the action into the hash table.
29737c478bd9Sstevel@tonic-gate */
29747c478bd9Sstevel@tonic-gate ipsec_action_t *
ipsec_in_to_out_action(ip_recv_attr_t * ira)2975bd670b35SErik Nordmark ipsec_in_to_out_action(ip_recv_attr_t *ira)
29767c478bd9Sstevel@tonic-gate {
29777c478bd9Sstevel@tonic-gate ipsa_t *ah_assoc, *esp_assoc;
29787c478bd9Sstevel@tonic-gate uint_t auth_alg = 0, encr_alg = 0, espa_alg = 0;
29797c478bd9Sstevel@tonic-gate ipsec_action_t *ap;
29807c478bd9Sstevel@tonic-gate boolean_t unique;
29817c478bd9Sstevel@tonic-gate
29827c478bd9Sstevel@tonic-gate ap = kmem_cache_alloc(ipsec_action_cache, KM_NOSLEEP);
29837c478bd9Sstevel@tonic-gate
29847c478bd9Sstevel@tonic-gate if (ap == NULL)
29857c478bd9Sstevel@tonic-gate return (NULL);
29867c478bd9Sstevel@tonic-gate
29877c478bd9Sstevel@tonic-gate bzero(ap, sizeof (*ap));
29886a182920Ssommerfe HASH_NULL(ap, ipa_hash);
29897c478bd9Sstevel@tonic-gate ap->ipa_next = NULL;
29907c478bd9Sstevel@tonic-gate ap->ipa_refs = 1;
29917c478bd9Sstevel@tonic-gate
29927c478bd9Sstevel@tonic-gate /*
29937c478bd9Sstevel@tonic-gate * Get the algorithms that were used for this packet.
29947c478bd9Sstevel@tonic-gate */
29957c478bd9Sstevel@tonic-gate ap->ipa_act.ipa_type = IPSEC_ACT_APPLY;
29967c478bd9Sstevel@tonic-gate ap->ipa_act.ipa_log = 0;
2997bd670b35SErik Nordmark ASSERT(ira->ira_flags & IRAF_IPSEC_SECURE);
2998bd670b35SErik Nordmark
2999bd670b35SErik Nordmark ah_assoc = ira->ira_ipsec_ah_sa;
30007c478bd9Sstevel@tonic-gate ap->ipa_act.ipa_apply.ipp_use_ah = (ah_assoc != NULL);
30017c478bd9Sstevel@tonic-gate
3002bd670b35SErik Nordmark esp_assoc = ira->ira_ipsec_esp_sa;
30037c478bd9Sstevel@tonic-gate ap->ipa_act.ipa_apply.ipp_use_esp = (esp_assoc != NULL);
30047c478bd9Sstevel@tonic-gate
30057c478bd9Sstevel@tonic-gate if (esp_assoc != NULL) {
30067c478bd9Sstevel@tonic-gate encr_alg = esp_assoc->ipsa_encr_alg;
30077c478bd9Sstevel@tonic-gate espa_alg = esp_assoc->ipsa_auth_alg;
30087c478bd9Sstevel@tonic-gate ap->ipa_act.ipa_apply.ipp_use_espa = (espa_alg != 0);
30097c478bd9Sstevel@tonic-gate }
30107c478bd9Sstevel@tonic-gate if (ah_assoc != NULL)
30117c478bd9Sstevel@tonic-gate auth_alg = ah_assoc->ipsa_auth_alg;
30127c478bd9Sstevel@tonic-gate
30137c478bd9Sstevel@tonic-gate ap->ipa_act.ipa_apply.ipp_encr_alg = (uint8_t)encr_alg;
30147c478bd9Sstevel@tonic-gate ap->ipa_act.ipa_apply.ipp_auth_alg = (uint8_t)auth_alg;
30157c478bd9Sstevel@tonic-gate ap->ipa_act.ipa_apply.ipp_esp_auth_alg = (uint8_t)espa_alg;
3016bd670b35SErik Nordmark ap->ipa_act.ipa_apply.ipp_use_se =
3017bd670b35SErik Nordmark !!(ira->ira_flags & IRAF_IPSEC_DECAPS);
30187c478bd9Sstevel@tonic-gate unique = B_FALSE;
30197c478bd9Sstevel@tonic-gate
30207c478bd9Sstevel@tonic-gate if (esp_assoc != NULL) {
30217c478bd9Sstevel@tonic-gate ap->ipa_act.ipa_apply.ipp_espa_minbits =
30227c478bd9Sstevel@tonic-gate esp_assoc->ipsa_authkeybits;
30237c478bd9Sstevel@tonic-gate ap->ipa_act.ipa_apply.ipp_espa_maxbits =
30247c478bd9Sstevel@tonic-gate esp_assoc->ipsa_authkeybits;
30257c478bd9Sstevel@tonic-gate ap->ipa_act.ipa_apply.ipp_espe_minbits =
30267c478bd9Sstevel@tonic-gate esp_assoc->ipsa_encrkeybits;
30277c478bd9Sstevel@tonic-gate ap->ipa_act.ipa_apply.ipp_espe_maxbits =
30287c478bd9Sstevel@tonic-gate esp_assoc->ipsa_encrkeybits;
30297c478bd9Sstevel@tonic-gate ap->ipa_act.ipa_apply.ipp_km_proto = esp_assoc->ipsa_kmp;
30307c478bd9Sstevel@tonic-gate ap->ipa_act.ipa_apply.ipp_km_cookie = esp_assoc->ipsa_kmc;
30317c478bd9Sstevel@tonic-gate if (esp_assoc->ipsa_flags & IPSA_F_UNIQUE)
30327c478bd9Sstevel@tonic-gate unique = B_TRUE;
30337c478bd9Sstevel@tonic-gate }
30347c478bd9Sstevel@tonic-gate if (ah_assoc != NULL) {
30357c478bd9Sstevel@tonic-gate ap->ipa_act.ipa_apply.ipp_ah_minbits =
30367c478bd9Sstevel@tonic-gate ah_assoc->ipsa_authkeybits;
30377c478bd9Sstevel@tonic-gate ap->ipa_act.ipa_apply.ipp_ah_maxbits =
30387c478bd9Sstevel@tonic-gate ah_assoc->ipsa_authkeybits;
30397c478bd9Sstevel@tonic-gate ap->ipa_act.ipa_apply.ipp_km_proto = ah_assoc->ipsa_kmp;
30407c478bd9Sstevel@tonic-gate ap->ipa_act.ipa_apply.ipp_km_cookie = ah_assoc->ipsa_kmc;
30417c478bd9Sstevel@tonic-gate if (ah_assoc->ipsa_flags & IPSA_F_UNIQUE)
30427c478bd9Sstevel@tonic-gate unique = B_TRUE;
30437c478bd9Sstevel@tonic-gate }
30447c478bd9Sstevel@tonic-gate ap->ipa_act.ipa_apply.ipp_use_unique = unique;
30457c478bd9Sstevel@tonic-gate ap->ipa_want_unique = unique;
30467c478bd9Sstevel@tonic-gate ap->ipa_allow_clear = B_FALSE;
3047bd670b35SErik Nordmark ap->ipa_want_se = !!(ira->ira_flags & IRAF_IPSEC_DECAPS);
30487c478bd9Sstevel@tonic-gate ap->ipa_want_ah = (ah_assoc != NULL);
30497c478bd9Sstevel@tonic-gate ap->ipa_want_esp = (esp_assoc != NULL);
30507c478bd9Sstevel@tonic-gate
30517c478bd9Sstevel@tonic-gate ap->ipa_ovhd = ipsec_act_ovhd(&ap->ipa_act);
30527c478bd9Sstevel@tonic-gate
30537c478bd9Sstevel@tonic-gate ap->ipa_act.ipa_apply.ipp_replay_depth = 0; /* don't care */
30547c478bd9Sstevel@tonic-gate
30557c478bd9Sstevel@tonic-gate return (ap);
30567c478bd9Sstevel@tonic-gate }
30577c478bd9Sstevel@tonic-gate
30587c478bd9Sstevel@tonic-gate
30597c478bd9Sstevel@tonic-gate /*
30607c478bd9Sstevel@tonic-gate * Compute the worst-case amount of extra space required by an action.
30617c478bd9Sstevel@tonic-gate * Note that, because of the ESP considerations listed below, this is
30627c478bd9Sstevel@tonic-gate * actually not the same as the best-case reduction in the MTU; in the
30637c478bd9Sstevel@tonic-gate * future, we should pass additional information to this function to
30647c478bd9Sstevel@tonic-gate * allow the actual MTU impact to be computed.
30657c478bd9Sstevel@tonic-gate *
30667c478bd9Sstevel@tonic-gate * AH: Revisit this if we implement algorithms with
30677c478bd9Sstevel@tonic-gate * a verifier size of more than 12 bytes.
30687c478bd9Sstevel@tonic-gate *
30697c478bd9Sstevel@tonic-gate * ESP: A more exact but more messy computation would take into
30707c478bd9Sstevel@tonic-gate * account the interaction between the cipher block size and the
30717c478bd9Sstevel@tonic-gate * effective MTU, yielding the inner payload size which reflects a
30727c478bd9Sstevel@tonic-gate * packet with *minimum* ESP padding..
30737c478bd9Sstevel@tonic-gate */
30748810c16bSdanmcd int32_t
ipsec_act_ovhd(const ipsec_act_t * act)30757c478bd9Sstevel@tonic-gate ipsec_act_ovhd(const ipsec_act_t *act)
30767c478bd9Sstevel@tonic-gate {
30777c478bd9Sstevel@tonic-gate int32_t overhead = 0;
30787c478bd9Sstevel@tonic-gate
30797c478bd9Sstevel@tonic-gate if (act->ipa_type == IPSEC_ACT_APPLY) {
30807c478bd9Sstevel@tonic-gate const ipsec_prot_t *ipp = &act->ipa_apply;
30817c478bd9Sstevel@tonic-gate
30827c478bd9Sstevel@tonic-gate if (ipp->ipp_use_ah)
30837c478bd9Sstevel@tonic-gate overhead += IPSEC_MAX_AH_HDR_SIZE;
30847c478bd9Sstevel@tonic-gate if (ipp->ipp_use_esp) {
30857c478bd9Sstevel@tonic-gate overhead += IPSEC_MAX_ESP_HDR_SIZE;
30867c478bd9Sstevel@tonic-gate overhead += sizeof (struct udphdr);
30877c478bd9Sstevel@tonic-gate }
30887c478bd9Sstevel@tonic-gate if (ipp->ipp_use_se)
30897c478bd9Sstevel@tonic-gate overhead += IP_SIMPLE_HDR_LENGTH;
30907c478bd9Sstevel@tonic-gate }
30917c478bd9Sstevel@tonic-gate return (overhead);
30927c478bd9Sstevel@tonic-gate }
30937c478bd9Sstevel@tonic-gate
30947c478bd9Sstevel@tonic-gate /*
30957c478bd9Sstevel@tonic-gate * This hash function is used only when creating policies and thus is not
30967c478bd9Sstevel@tonic-gate * performance-critical for packet flows.
30977c478bd9Sstevel@tonic-gate *
30987c478bd9Sstevel@tonic-gate * Future work: canonicalize the structures hashed with this (i.e.,
30997c478bd9Sstevel@tonic-gate * zeroize padding) so the hash works correctly.
31007c478bd9Sstevel@tonic-gate */
31017c478bd9Sstevel@tonic-gate /* ARGSUSED */
31027c478bd9Sstevel@tonic-gate static uint32_t
policy_hash(int size,const void * start,const void * end)31037c478bd9Sstevel@tonic-gate policy_hash(int size, const void *start, const void *end)
31047c478bd9Sstevel@tonic-gate {
31057c478bd9Sstevel@tonic-gate return (0);
31067c478bd9Sstevel@tonic-gate }
31077c478bd9Sstevel@tonic-gate
31086a182920Ssommerfe
31096a182920Ssommerfe /*
31106a182920Ssommerfe * Hash function macros for each address type.
31116a182920Ssommerfe *
31126a182920Ssommerfe * The IPV6 hash function assumes that the low order 32-bits of the
31136a182920Ssommerfe * address (typically containing the low order 24 bits of the mac
31146a182920Ssommerfe * address) are reasonably well-distributed. Revisit this if we run
31156a182920Ssommerfe * into trouble from lots of collisions on ::1 addresses and the like
31166a182920Ssommerfe * (seems unlikely).
31176a182920Ssommerfe */
31188810c16bSdanmcd #define IPSEC_IPV4_HASH(a, n) ((a) % (n))
31198810c16bSdanmcd #define IPSEC_IPV6_HASH(a, n) (((a).s6_addr32[3]) % (n))
31206a182920Ssommerfe
31216a182920Ssommerfe /*
31226a182920Ssommerfe * These two hash functions should produce coordinated values
31236a182920Ssommerfe * but have slightly different roles.
31246a182920Ssommerfe */
31256a182920Ssommerfe static uint32_t
selkey_hash(const ipsec_selkey_t * selkey,netstack_t * ns)3126f4b3ec61Sdh155122 selkey_hash(const ipsec_selkey_t *selkey, netstack_t *ns)
31276a182920Ssommerfe {
31286a182920Ssommerfe uint32_t valid = selkey->ipsl_valid;
3129f4b3ec61Sdh155122 ipsec_stack_t *ipss = ns->netstack_ipsec;
31306a182920Ssommerfe
31316a182920Ssommerfe if (!(valid & IPSL_REMOTE_ADDR))
31326a182920Ssommerfe return (IPSEC_SEL_NOHASH);
31336a182920Ssommerfe
31346a182920Ssommerfe if (valid & IPSL_IPV4) {
3135f4b3ec61Sdh155122 if (selkey->ipsl_remote_pfxlen == 32) {
31368810c16bSdanmcd return (IPSEC_IPV4_HASH(selkey->ipsl_remote.ipsad_v4,
3137f4b3ec61Sdh155122 ipss->ipsec_spd_hashsize));
3138f4b3ec61Sdh155122 }
31396a182920Ssommerfe }
31406a182920Ssommerfe if (valid & IPSL_IPV6) {
3141f4b3ec61Sdh155122 if (selkey->ipsl_remote_pfxlen == 128) {
31428810c16bSdanmcd return (IPSEC_IPV6_HASH(selkey->ipsl_remote.ipsad_v6,
3143f4b3ec61Sdh155122 ipss->ipsec_spd_hashsize));
3144f4b3ec61Sdh155122 }
31456a182920Ssommerfe }
31466a182920Ssommerfe return (IPSEC_SEL_NOHASH);
31476a182920Ssommerfe }
31486a182920Ssommerfe
31496a182920Ssommerfe static uint32_t
selector_hash(ipsec_selector_t * sel,ipsec_policy_root_t * root)31508810c16bSdanmcd selector_hash(ipsec_selector_t *sel, ipsec_policy_root_t *root)
31516a182920Ssommerfe {
31526a182920Ssommerfe if (sel->ips_isv4) {
31538810c16bSdanmcd return (IPSEC_IPV4_HASH(sel->ips_remote_addr_v4,
31548810c16bSdanmcd root->ipr_nchains));
31556a182920Ssommerfe }
31568810c16bSdanmcd return (IPSEC_IPV6_HASH(sel->ips_remote_addr_v6, root->ipr_nchains));
31576a182920Ssommerfe }
31586a182920Ssommerfe
31597c478bd9Sstevel@tonic-gate /*
31607c478bd9Sstevel@tonic-gate * Intern actions into the action hash table.
31617c478bd9Sstevel@tonic-gate */
31627c478bd9Sstevel@tonic-gate ipsec_action_t *
ipsec_act_find(const ipsec_act_t * a,int n,netstack_t * ns)3163f4b3ec61Sdh155122 ipsec_act_find(const ipsec_act_t *a, int n, netstack_t *ns)
31647c478bd9Sstevel@tonic-gate {
31657c478bd9Sstevel@tonic-gate int i;
31667c478bd9Sstevel@tonic-gate uint32_t hval;
31677c478bd9Sstevel@tonic-gate ipsec_action_t *ap;
31687c478bd9Sstevel@tonic-gate ipsec_action_t *prev = NULL;
31697c478bd9Sstevel@tonic-gate int32_t overhead, maxovhd = 0;
31707c478bd9Sstevel@tonic-gate boolean_t allow_clear = B_FALSE;
31717c478bd9Sstevel@tonic-gate boolean_t want_ah = B_FALSE;
31727c478bd9Sstevel@tonic-gate boolean_t want_esp = B_FALSE;
31737c478bd9Sstevel@tonic-gate boolean_t want_se = B_FALSE;
31747c478bd9Sstevel@tonic-gate boolean_t want_unique = B_FALSE;
3175f4b3ec61Sdh155122 ipsec_stack_t *ipss = ns->netstack_ipsec;
31767c478bd9Sstevel@tonic-gate
31777c478bd9Sstevel@tonic-gate /*
31787c478bd9Sstevel@tonic-gate * TODO: should canonicalize a[] (i.e., zeroize any padding)
31797c478bd9Sstevel@tonic-gate * so we can use a non-trivial policy_hash function.
31807c478bd9Sstevel@tonic-gate */
3181ab82c29bSToomas Soome ap = NULL;
31827c478bd9Sstevel@tonic-gate for (i = n-1; i >= 0; i--) {
31837c478bd9Sstevel@tonic-gate hval = policy_hash(IPSEC_ACTION_HASH_SIZE, &a[i], &a[n]);
31847c478bd9Sstevel@tonic-gate
3185f4b3ec61Sdh155122 HASH_LOCK(ipss->ipsec_action_hash, hval);
31867c478bd9Sstevel@tonic-gate
3187f4b3ec61Sdh155122 for (HASH_ITERATE(ap, ipa_hash,
3188f4b3ec61Sdh155122 ipss->ipsec_action_hash, hval)) {
31897c478bd9Sstevel@tonic-gate if (bcmp(&ap->ipa_act, &a[i], sizeof (*a)) != 0)
31907c478bd9Sstevel@tonic-gate continue;
31917c478bd9Sstevel@tonic-gate if (ap->ipa_next != prev)
31927c478bd9Sstevel@tonic-gate continue;
31937c478bd9Sstevel@tonic-gate break;
31947c478bd9Sstevel@tonic-gate }
31957c478bd9Sstevel@tonic-gate if (ap != NULL) {
3196f4b3ec61Sdh155122 HASH_UNLOCK(ipss->ipsec_action_hash, hval);
31977c478bd9Sstevel@tonic-gate prev = ap;
31987c478bd9Sstevel@tonic-gate continue;
31997c478bd9Sstevel@tonic-gate }
32007c478bd9Sstevel@tonic-gate /*
32017c478bd9Sstevel@tonic-gate * need to allocate a new one..
32027c478bd9Sstevel@tonic-gate */
32037c478bd9Sstevel@tonic-gate ap = kmem_cache_alloc(ipsec_action_cache, KM_NOSLEEP);
32047c478bd9Sstevel@tonic-gate if (ap == NULL) {
3205f4b3ec61Sdh155122 HASH_UNLOCK(ipss->ipsec_action_hash, hval);
32067c478bd9Sstevel@tonic-gate if (prev != NULL)
32077c478bd9Sstevel@tonic-gate ipsec_action_free(prev);
32087c478bd9Sstevel@tonic-gate return (NULL);
32097c478bd9Sstevel@tonic-gate }
3210f4b3ec61Sdh155122 HASH_INSERT(ap, ipa_hash, ipss->ipsec_action_hash, hval);
32117c478bd9Sstevel@tonic-gate
32127c478bd9Sstevel@tonic-gate ap->ipa_next = prev;
32137c478bd9Sstevel@tonic-gate ap->ipa_act = a[i];
32147c478bd9Sstevel@tonic-gate
32157c478bd9Sstevel@tonic-gate overhead = ipsec_act_ovhd(&a[i]);
32167c478bd9Sstevel@tonic-gate if (maxovhd < overhead)
32177c478bd9Sstevel@tonic-gate maxovhd = overhead;
32187c478bd9Sstevel@tonic-gate
32197c478bd9Sstevel@tonic-gate if ((a[i].ipa_type == IPSEC_ACT_BYPASS) ||
32207c478bd9Sstevel@tonic-gate (a[i].ipa_type == IPSEC_ACT_CLEAR))
32217c478bd9Sstevel@tonic-gate allow_clear = B_TRUE;
32227c478bd9Sstevel@tonic-gate if (a[i].ipa_type == IPSEC_ACT_APPLY) {
32237c478bd9Sstevel@tonic-gate const ipsec_prot_t *ipp = &a[i].ipa_apply;
32247c478bd9Sstevel@tonic-gate
32257c478bd9Sstevel@tonic-gate ASSERT(ipp->ipp_use_ah || ipp->ipp_use_esp);
32267c478bd9Sstevel@tonic-gate want_ah |= ipp->ipp_use_ah;
32277c478bd9Sstevel@tonic-gate want_esp |= ipp->ipp_use_esp;
32287c478bd9Sstevel@tonic-gate want_se |= ipp->ipp_use_se;
32297c478bd9Sstevel@tonic-gate want_unique |= ipp->ipp_use_unique;
32307c478bd9Sstevel@tonic-gate }
32317c478bd9Sstevel@tonic-gate ap->ipa_allow_clear = allow_clear;
32327c478bd9Sstevel@tonic-gate ap->ipa_want_ah = want_ah;
32337c478bd9Sstevel@tonic-gate ap->ipa_want_esp = want_esp;
32347c478bd9Sstevel@tonic-gate ap->ipa_want_se = want_se;
32357c478bd9Sstevel@tonic-gate ap->ipa_want_unique = want_unique;
32367c478bd9Sstevel@tonic-gate ap->ipa_refs = 1; /* from the hash table */
32377c478bd9Sstevel@tonic-gate ap->ipa_ovhd = maxovhd;
32387c478bd9Sstevel@tonic-gate if (prev)
32397c478bd9Sstevel@tonic-gate prev->ipa_refs++;
32407c478bd9Sstevel@tonic-gate prev = ap;
3241f4b3ec61Sdh155122 HASH_UNLOCK(ipss->ipsec_action_hash, hval);
32427c478bd9Sstevel@tonic-gate }
32437c478bd9Sstevel@tonic-gate
32447c478bd9Sstevel@tonic-gate ap->ipa_refs++; /* caller's reference */
32457c478bd9Sstevel@tonic-gate
32467c478bd9Sstevel@tonic-gate return (ap);
32477c478bd9Sstevel@tonic-gate }
32487c478bd9Sstevel@tonic-gate
32497c478bd9Sstevel@tonic-gate /*
32507c478bd9Sstevel@tonic-gate * Called when refcount goes to 0, indicating that all references to this
32517c478bd9Sstevel@tonic-gate * node are gone.
32527c478bd9Sstevel@tonic-gate *
32537c478bd9Sstevel@tonic-gate * This does not unchain the action from the hash table.
32547c478bd9Sstevel@tonic-gate */
32557c478bd9Sstevel@tonic-gate void
ipsec_action_free(ipsec_action_t * ap)32567c478bd9Sstevel@tonic-gate ipsec_action_free(ipsec_action_t *ap)
32577c478bd9Sstevel@tonic-gate {
32587c478bd9Sstevel@tonic-gate for (;;) {
32597c478bd9Sstevel@tonic-gate ipsec_action_t *np = ap->ipa_next;
32607c478bd9Sstevel@tonic-gate ASSERT(ap->ipa_refs == 0);
32617c478bd9Sstevel@tonic-gate ASSERT(ap->ipa_hash.hash_pp == NULL);
32627c478bd9Sstevel@tonic-gate kmem_cache_free(ipsec_action_cache, ap);
32637c478bd9Sstevel@tonic-gate ap = np;
32647c478bd9Sstevel@tonic-gate /* Inlined IPACT_REFRELE -- avoid recursion */
32657c478bd9Sstevel@tonic-gate if (ap == NULL)
32667c478bd9Sstevel@tonic-gate break;
32677c478bd9Sstevel@tonic-gate membar_exit();
32681a5e258fSJosef 'Jeff' Sipek if (atomic_dec_32_nv(&(ap)->ipa_refs) != 0)
32697c478bd9Sstevel@tonic-gate break;
32707c478bd9Sstevel@tonic-gate /* End inlined IPACT_REFRELE */
32717c478bd9Sstevel@tonic-gate }
32727c478bd9Sstevel@tonic-gate }
32737c478bd9Sstevel@tonic-gate
32747c478bd9Sstevel@tonic-gate /*
3275f4b3ec61Sdh155122 * Called when the action hash table goes away.
3276f4b3ec61Sdh155122 *
3277f4b3ec61Sdh155122 * The actions can be queued on an mblk with ipsec_in or
3278f4b3ec61Sdh155122 * ipsec_out, hence the actions might still be around.
3279f4b3ec61Sdh155122 * But we decrement ipa_refs here since we no longer have
3280f4b3ec61Sdh155122 * a reference to the action from the hash table.
3281f4b3ec61Sdh155122 */
3282f4b3ec61Sdh155122 static void
ipsec_action_free_table(ipsec_action_t * ap)3283f4b3ec61Sdh155122 ipsec_action_free_table(ipsec_action_t *ap)
3284f4b3ec61Sdh155122 {
3285f4b3ec61Sdh155122 while (ap != NULL) {
3286f4b3ec61Sdh155122 ipsec_action_t *np = ap->ipa_next;
3287f4b3ec61Sdh155122
3288f4b3ec61Sdh155122 /* FIXME: remove? */
3289f4b3ec61Sdh155122 (void) printf("ipsec_action_free_table(%p) ref %d\n",
3290f4b3ec61Sdh155122 (void *)ap, ap->ipa_refs);
3291f4b3ec61Sdh155122 ASSERT(ap->ipa_refs > 0);
3292f4b3ec61Sdh155122 IPACT_REFRELE(ap);
3293f4b3ec61Sdh155122 ap = np;
3294f4b3ec61Sdh155122 }
3295f4b3ec61Sdh155122 }
3296f4b3ec61Sdh155122
3297f4b3ec61Sdh155122 /*
3298f4b3ec61Sdh155122 * Need to walk all stack instances since the reclaim function
3299f4b3ec61Sdh155122 * is global for all instances
3300f4b3ec61Sdh155122 */
3301f4b3ec61Sdh155122 /* ARGSUSED */
3302f4b3ec61Sdh155122 static void
ipsec_action_reclaim(void * arg)3303f4b3ec61Sdh155122 ipsec_action_reclaim(void *arg)
3304f4b3ec61Sdh155122 {
3305f4b3ec61Sdh155122 netstack_handle_t nh;
3306f4b3ec61Sdh155122 netstack_t *ns;
33074ba231ceSKacheong Poon ipsec_stack_t *ipss;
3308f4b3ec61Sdh155122
3309f4b3ec61Sdh155122 netstack_next_init(&nh);
3310f4b3ec61Sdh155122 while ((ns = netstack_next(&nh)) != NULL) {
33114ba231ceSKacheong Poon /*
33124ba231ceSKacheong Poon * netstack_next() can return a netstack_t with a NULL
33134ba231ceSKacheong Poon * netstack_ipsec at boot time.
33144ba231ceSKacheong Poon */
33154ba231ceSKacheong Poon if ((ipss = ns->netstack_ipsec) == NULL) {
33164ba231ceSKacheong Poon netstack_rele(ns);
33174ba231ceSKacheong Poon continue;
33184ba231ceSKacheong Poon }
33194ba231ceSKacheong Poon ipsec_action_reclaim_stack(ipss);
3320f4b3ec61Sdh155122 netstack_rele(ns);
3321f4b3ec61Sdh155122 }
3322f4b3ec61Sdh155122 netstack_next_fini(&nh);
3323f4b3ec61Sdh155122 }
3324f4b3ec61Sdh155122
3325f4b3ec61Sdh155122 /*
33267c478bd9Sstevel@tonic-gate * Periodically sweep action hash table for actions with refcount==1, and
33277c478bd9Sstevel@tonic-gate * nuke them. We cannot do this "on demand" (i.e., from IPACT_REFRELE)
33287c478bd9Sstevel@tonic-gate * because we can't close the race between another thread finding the action
33297c478bd9Sstevel@tonic-gate * in the hash table without holding the bucket lock during IPACT_REFRELE.
33307c478bd9Sstevel@tonic-gate * Instead, we run this function sporadically to clean up after ourselves;
33317c478bd9Sstevel@tonic-gate * we also set it as the "reclaim" function for the action kmem_cache.
33327c478bd9Sstevel@tonic-gate *
33337c478bd9Sstevel@tonic-gate * Note that it may take several passes of ipsec_action_gc() to free all
33347c478bd9Sstevel@tonic-gate * "stale" actions.
33357c478bd9Sstevel@tonic-gate */
33367c478bd9Sstevel@tonic-gate static void
ipsec_action_reclaim_stack(ipsec_stack_t * ipss)33374ba231ceSKacheong Poon ipsec_action_reclaim_stack(ipsec_stack_t *ipss)
33387c478bd9Sstevel@tonic-gate {
33397c478bd9Sstevel@tonic-gate int i;
33407c478bd9Sstevel@tonic-gate
33417c478bd9Sstevel@tonic-gate for (i = 0; i < IPSEC_ACTION_HASH_SIZE; i++) {
33427c478bd9Sstevel@tonic-gate ipsec_action_t *ap, *np;
33437c478bd9Sstevel@tonic-gate
33447c478bd9Sstevel@tonic-gate /* skip the lock if nobody home */
3345f4b3ec61Sdh155122 if (ipss->ipsec_action_hash[i].hash_head == NULL)
33467c478bd9Sstevel@tonic-gate continue;
33477c478bd9Sstevel@tonic-gate
3348f4b3ec61Sdh155122 HASH_LOCK(ipss->ipsec_action_hash, i);
3349f4b3ec61Sdh155122 for (ap = ipss->ipsec_action_hash[i].hash_head;
33507c478bd9Sstevel@tonic-gate ap != NULL; ap = np) {
33517c478bd9Sstevel@tonic-gate ASSERT(ap->ipa_refs > 0);
33527c478bd9Sstevel@tonic-gate np = ap->ipa_hash.hash_next;
33537c478bd9Sstevel@tonic-gate if (ap->ipa_refs > 1)
33547c478bd9Sstevel@tonic-gate continue;
3355f4b3ec61Sdh155122 HASH_UNCHAIN(ap, ipa_hash,
3356f4b3ec61Sdh155122 ipss->ipsec_action_hash, i);
33577c478bd9Sstevel@tonic-gate IPACT_REFRELE(ap);
33587c478bd9Sstevel@tonic-gate }
3359f4b3ec61Sdh155122 HASH_UNLOCK(ipss->ipsec_action_hash, i);
33607c478bd9Sstevel@tonic-gate }
33617c478bd9Sstevel@tonic-gate }
33627c478bd9Sstevel@tonic-gate
33637c478bd9Sstevel@tonic-gate /*
33647c478bd9Sstevel@tonic-gate * Intern a selector set into the selector set hash table.
33657c478bd9Sstevel@tonic-gate * This is simpler than the actions case..
33667c478bd9Sstevel@tonic-gate */
33676a182920Ssommerfe static ipsec_sel_t *
ipsec_find_sel(ipsec_selkey_t * selkey,netstack_t * ns)3368f4b3ec61Sdh155122 ipsec_find_sel(ipsec_selkey_t *selkey, netstack_t *ns)
33697c478bd9Sstevel@tonic-gate {
33707c478bd9Sstevel@tonic-gate ipsec_sel_t *sp;
33716a182920Ssommerfe uint32_t hval, bucket;
3372f4b3ec61Sdh155122 ipsec_stack_t *ipss = ns->netstack_ipsec;
33737c478bd9Sstevel@tonic-gate
33747c478bd9Sstevel@tonic-gate /*
33757c478bd9Sstevel@tonic-gate * Exactly one AF bit should be set in selkey.
33767c478bd9Sstevel@tonic-gate */
33777c478bd9Sstevel@tonic-gate ASSERT(!(selkey->ipsl_valid & IPSL_IPV4) ^
33787c478bd9Sstevel@tonic-gate !(selkey->ipsl_valid & IPSL_IPV6));
33797c478bd9Sstevel@tonic-gate
3380f4b3ec61Sdh155122 hval = selkey_hash(selkey, ns);
33818810c16bSdanmcd /* Set pol_hval to uninitialized until we put it in a polhead. */
33828810c16bSdanmcd selkey->ipsl_sel_hval = hval;
33837c478bd9Sstevel@tonic-gate
33846a182920Ssommerfe bucket = (hval == IPSEC_SEL_NOHASH) ? 0 : hval;
33857c478bd9Sstevel@tonic-gate
3386f4b3ec61Sdh155122 ASSERT(!HASH_LOCKED(ipss->ipsec_sel_hash, bucket));
3387f4b3ec61Sdh155122 HASH_LOCK(ipss->ipsec_sel_hash, bucket);
33886a182920Ssommerfe
3389f4b3ec61Sdh155122 for (HASH_ITERATE(sp, ipsl_hash, ipss->ipsec_sel_hash, bucket)) {
33908810c16bSdanmcd if (bcmp(&sp->ipsl_key, selkey,
33918810c16bSdanmcd offsetof(ipsec_selkey_t, ipsl_pol_hval)) == 0)
33927c478bd9Sstevel@tonic-gate break;
33937c478bd9Sstevel@tonic-gate }
33947c478bd9Sstevel@tonic-gate if (sp != NULL) {
33957c478bd9Sstevel@tonic-gate sp->ipsl_refs++;
33967c478bd9Sstevel@tonic-gate
3397f4b3ec61Sdh155122 HASH_UNLOCK(ipss->ipsec_sel_hash, bucket);
33987c478bd9Sstevel@tonic-gate return (sp);
33997c478bd9Sstevel@tonic-gate }
34006a182920Ssommerfe
34017c478bd9Sstevel@tonic-gate sp = kmem_cache_alloc(ipsec_sel_cache, KM_NOSLEEP);
34027c478bd9Sstevel@tonic-gate if (sp == NULL) {
3403f4b3ec61Sdh155122 HASH_UNLOCK(ipss->ipsec_sel_hash, bucket);
34047c478bd9Sstevel@tonic-gate return (NULL);
34057c478bd9Sstevel@tonic-gate }
34067c478bd9Sstevel@tonic-gate
3407f4b3ec61Sdh155122 HASH_INSERT(sp, ipsl_hash, ipss->ipsec_sel_hash, bucket);
34087c478bd9Sstevel@tonic-gate sp->ipsl_refs = 2; /* one for hash table, one for caller */
34097c478bd9Sstevel@tonic-gate sp->ipsl_key = *selkey;
34108810c16bSdanmcd /* Set to uninitalized and have insertion into polhead fix things. */
34118810c16bSdanmcd if (selkey->ipsl_sel_hval != IPSEC_SEL_NOHASH)
34128810c16bSdanmcd sp->ipsl_key.ipsl_pol_hval = 0;
34138810c16bSdanmcd else
34148810c16bSdanmcd sp->ipsl_key.ipsl_pol_hval = IPSEC_SEL_NOHASH;
34157c478bd9Sstevel@tonic-gate
3416f4b3ec61Sdh155122 HASH_UNLOCK(ipss->ipsec_sel_hash, bucket);
34177c478bd9Sstevel@tonic-gate
34187c478bd9Sstevel@tonic-gate return (sp);
34197c478bd9Sstevel@tonic-gate }
34207c478bd9Sstevel@tonic-gate
34217c478bd9Sstevel@tonic-gate static void
ipsec_sel_rel(ipsec_sel_t ** spp,netstack_t * ns)3422f4b3ec61Sdh155122 ipsec_sel_rel(ipsec_sel_t **spp, netstack_t *ns)
34237c478bd9Sstevel@tonic-gate {
34247c478bd9Sstevel@tonic-gate ipsec_sel_t *sp = *spp;
34258810c16bSdanmcd int hval = sp->ipsl_key.ipsl_sel_hval;
3426f4b3ec61Sdh155122 ipsec_stack_t *ipss = ns->netstack_ipsec;
3427f4b3ec61Sdh155122
34287c478bd9Sstevel@tonic-gate *spp = NULL;
34297c478bd9Sstevel@tonic-gate
34306a182920Ssommerfe if (hval == IPSEC_SEL_NOHASH)
34316a182920Ssommerfe hval = 0;
34326a182920Ssommerfe
3433f4b3ec61Sdh155122 ASSERT(!HASH_LOCKED(ipss->ipsec_sel_hash, hval));
3434f4b3ec61Sdh155122 HASH_LOCK(ipss->ipsec_sel_hash, hval);
34357c478bd9Sstevel@tonic-gate if (--sp->ipsl_refs == 1) {
3436f4b3ec61Sdh155122 HASH_UNCHAIN(sp, ipsl_hash, ipss->ipsec_sel_hash, hval);
34377c478bd9Sstevel@tonic-gate sp->ipsl_refs--;
3438f4b3ec61Sdh155122 HASH_UNLOCK(ipss->ipsec_sel_hash, hval);
34397c478bd9Sstevel@tonic-gate ASSERT(sp->ipsl_refs == 0);
34407c478bd9Sstevel@tonic-gate kmem_cache_free(ipsec_sel_cache, sp);
34417c478bd9Sstevel@tonic-gate /* Caller unlocks */
34427c478bd9Sstevel@tonic-gate return;
34437c478bd9Sstevel@tonic-gate }
34447c478bd9Sstevel@tonic-gate
3445f4b3ec61Sdh155122 HASH_UNLOCK(ipss->ipsec_sel_hash, hval);
34467c478bd9Sstevel@tonic-gate }
34477c478bd9Sstevel@tonic-gate
34487c478bd9Sstevel@tonic-gate /*
34497c478bd9Sstevel@tonic-gate * Free a policy rule which we know is no longer being referenced.
34507c478bd9Sstevel@tonic-gate */
34517c478bd9Sstevel@tonic-gate void
ipsec_policy_free(ipsec_policy_t * ipp)3452bd670b35SErik Nordmark ipsec_policy_free(ipsec_policy_t *ipp)
34537c478bd9Sstevel@tonic-gate {
34547c478bd9Sstevel@tonic-gate ASSERT(ipp->ipsp_refs == 0);
34557c478bd9Sstevel@tonic-gate ASSERT(ipp->ipsp_sel != NULL);
34567c478bd9Sstevel@tonic-gate ASSERT(ipp->ipsp_act != NULL);
3457bd670b35SErik Nordmark ASSERT(ipp->ipsp_netstack != NULL);
3458f4b3ec61Sdh155122
3459bd670b35SErik Nordmark ipsec_sel_rel(&ipp->ipsp_sel, ipp->ipsp_netstack);
34607c478bd9Sstevel@tonic-gate IPACT_REFRELE(ipp->ipsp_act);
34617c478bd9Sstevel@tonic-gate kmem_cache_free(ipsec_pol_cache, ipp);
34627c478bd9Sstevel@tonic-gate }
34637c478bd9Sstevel@tonic-gate
34647c478bd9Sstevel@tonic-gate /*
34657c478bd9Sstevel@tonic-gate * Construction of new policy rules; construct a policy, and add it to
34667c478bd9Sstevel@tonic-gate * the appropriate tables.
34677c478bd9Sstevel@tonic-gate */
34687c478bd9Sstevel@tonic-gate ipsec_policy_t *
ipsec_policy_create(ipsec_selkey_t * keys,const ipsec_act_t * a,int nacts,int prio,uint64_t * index_ptr,netstack_t * ns)34696a182920Ssommerfe ipsec_policy_create(ipsec_selkey_t *keys, const ipsec_act_t *a,
3470f4b3ec61Sdh155122 int nacts, int prio, uint64_t *index_ptr, netstack_t *ns)
34717c478bd9Sstevel@tonic-gate {
34727c478bd9Sstevel@tonic-gate ipsec_action_t *ap;
34737c478bd9Sstevel@tonic-gate ipsec_sel_t *sp;
34747c478bd9Sstevel@tonic-gate ipsec_policy_t *ipp;
3475f4b3ec61Sdh155122 ipsec_stack_t *ipss = ns->netstack_ipsec;
34767c478bd9Sstevel@tonic-gate
34778810c16bSdanmcd if (index_ptr == NULL)
3478f4b3ec61Sdh155122 index_ptr = &ipss->ipsec_next_policy_index;
34798810c16bSdanmcd
34807c478bd9Sstevel@tonic-gate ipp = kmem_cache_alloc(ipsec_pol_cache, KM_NOSLEEP);
3481f4b3ec61Sdh155122 ap = ipsec_act_find(a, nacts, ns);
3482f4b3ec61Sdh155122 sp = ipsec_find_sel(keys, ns);
34837c478bd9Sstevel@tonic-gate
34847c478bd9Sstevel@tonic-gate if ((ap == NULL) || (sp == NULL) || (ipp == NULL)) {
34857c478bd9Sstevel@tonic-gate if (ap != NULL) {
34867c478bd9Sstevel@tonic-gate IPACT_REFRELE(ap);
34877c478bd9Sstevel@tonic-gate }
34887c478bd9Sstevel@tonic-gate if (sp != NULL)
3489f4b3ec61Sdh155122 ipsec_sel_rel(&sp, ns);
34907c478bd9Sstevel@tonic-gate if (ipp != NULL)
34917c478bd9Sstevel@tonic-gate kmem_cache_free(ipsec_pol_cache, ipp);
34927c478bd9Sstevel@tonic-gate return (NULL);
34937c478bd9Sstevel@tonic-gate }
34947c478bd9Sstevel@tonic-gate
34956a182920Ssommerfe HASH_NULL(ipp, ipsp_hash);
34967c478bd9Sstevel@tonic-gate
3497bd670b35SErik Nordmark ipp->ipsp_netstack = ns; /* Needed for ipsec_policy_free */
34987c478bd9Sstevel@tonic-gate ipp->ipsp_refs = 1; /* caller's reference */
34997c478bd9Sstevel@tonic-gate ipp->ipsp_sel = sp;
35007c478bd9Sstevel@tonic-gate ipp->ipsp_act = ap;
35017c478bd9Sstevel@tonic-gate ipp->ipsp_prio = prio; /* rule priority */
35028810c16bSdanmcd ipp->ipsp_index = *index_ptr;
35038810c16bSdanmcd (*index_ptr)++;
35047c478bd9Sstevel@tonic-gate
35057c478bd9Sstevel@tonic-gate return (ipp);
35067c478bd9Sstevel@tonic-gate }
35077c478bd9Sstevel@tonic-gate
35087c478bd9Sstevel@tonic-gate static void
ipsec_update_present_flags(ipsec_stack_t * ipss)3509f4b3ec61Sdh155122 ipsec_update_present_flags(ipsec_stack_t *ipss)
35107c478bd9Sstevel@tonic-gate {
3511f4b3ec61Sdh155122 boolean_t hashpol;
3512f4b3ec61Sdh155122
3513f4b3ec61Sdh155122 hashpol = (avl_numnodes(&ipss->ipsec_system_policy.iph_rulebyid) > 0);
35146a182920Ssommerfe
35156a182920Ssommerfe if (hashpol) {
3516f4b3ec61Sdh155122 ipss->ipsec_outbound_v4_policy_present = B_TRUE;
3517f4b3ec61Sdh155122 ipss->ipsec_outbound_v6_policy_present = B_TRUE;
3518f4b3ec61Sdh155122 ipss->ipsec_inbound_v4_policy_present = B_TRUE;
3519f4b3ec61Sdh155122 ipss->ipsec_inbound_v6_policy_present = B_TRUE;
35206a182920Ssommerfe return;
35216a182920Ssommerfe }
35226a182920Ssommerfe
3523f4b3ec61Sdh155122 ipss->ipsec_outbound_v4_policy_present = (NULL !=
3524f4b3ec61Sdh155122 ipss->ipsec_system_policy.iph_root[IPSEC_TYPE_OUTBOUND].
35256a182920Ssommerfe ipr_nonhash[IPSEC_AF_V4]);
3526f4b3ec61Sdh155122 ipss->ipsec_outbound_v6_policy_present = (NULL !=
3527f4b3ec61Sdh155122 ipss->ipsec_system_policy.iph_root[IPSEC_TYPE_OUTBOUND].
35286a182920Ssommerfe ipr_nonhash[IPSEC_AF_V6]);
3529f4b3ec61Sdh155122 ipss->ipsec_inbound_v4_policy_present = (NULL !=
3530f4b3ec61Sdh155122 ipss->ipsec_system_policy.iph_root[IPSEC_TYPE_INBOUND].
35316a182920Ssommerfe ipr_nonhash[IPSEC_AF_V4]);
3532f4b3ec61Sdh155122 ipss->ipsec_inbound_v6_policy_present = (NULL !=
3533f4b3ec61Sdh155122 ipss->ipsec_system_policy.iph_root[IPSEC_TYPE_INBOUND].
35346a182920Ssommerfe ipr_nonhash[IPSEC_AF_V6]);
35357c478bd9Sstevel@tonic-gate }
35367c478bd9Sstevel@tonic-gate
35377c478bd9Sstevel@tonic-gate boolean_t
ipsec_policy_delete(ipsec_policy_head_t * php,ipsec_selkey_t * keys,int dir,netstack_t * ns)3538f4b3ec61Sdh155122 ipsec_policy_delete(ipsec_policy_head_t *php, ipsec_selkey_t *keys, int dir,
3539f4b3ec61Sdh155122 netstack_t *ns)
35407c478bd9Sstevel@tonic-gate {
35417c478bd9Sstevel@tonic-gate ipsec_sel_t *sp;
35426a182920Ssommerfe ipsec_policy_t *ip, *nip, *head;
35437c478bd9Sstevel@tonic-gate int af;
35446a182920Ssommerfe ipsec_policy_root_t *pr = &php->iph_root[dir];
35457c478bd9Sstevel@tonic-gate
3546f4b3ec61Sdh155122 sp = ipsec_find_sel(keys, ns);
35477c478bd9Sstevel@tonic-gate
35487c478bd9Sstevel@tonic-gate if (sp == NULL)
35497c478bd9Sstevel@tonic-gate return (B_FALSE);
35507c478bd9Sstevel@tonic-gate
35517c478bd9Sstevel@tonic-gate af = (sp->ipsl_key.ipsl_valid & IPSL_IPV4) ? IPSEC_AF_V4 : IPSEC_AF_V6;
35527c478bd9Sstevel@tonic-gate
35537c478bd9Sstevel@tonic-gate rw_enter(&php->iph_lock, RW_WRITER);
35547c478bd9Sstevel@tonic-gate
35558810c16bSdanmcd if (sp->ipsl_key.ipsl_pol_hval == IPSEC_SEL_NOHASH) {
35566a182920Ssommerfe head = pr->ipr_nonhash[af];
35576a182920Ssommerfe } else {
35588810c16bSdanmcd head = pr->ipr_hash[sp->ipsl_key.ipsl_pol_hval].hash_head;
35596a182920Ssommerfe }
35606a182920Ssommerfe
35616a182920Ssommerfe for (ip = head; ip != NULL; ip = nip) {
35626a182920Ssommerfe nip = ip->ipsp_hash.hash_next;
35637c478bd9Sstevel@tonic-gate if (ip->ipsp_sel != sp) {
35647c478bd9Sstevel@tonic-gate continue;
35657c478bd9Sstevel@tonic-gate }
35666a182920Ssommerfe
3567bd670b35SErik Nordmark IPPOL_UNCHAIN(php, ip);
35686a182920Ssommerfe
35697c478bd9Sstevel@tonic-gate php->iph_gen++;
3570f4b3ec61Sdh155122 ipsec_update_present_flags(ns->netstack_ipsec);
35716a182920Ssommerfe
35726a182920Ssommerfe rw_exit(&php->iph_lock);
35736a182920Ssommerfe
3574f4b3ec61Sdh155122 ipsec_sel_rel(&sp, ns);
35756a182920Ssommerfe
35767c478bd9Sstevel@tonic-gate return (B_TRUE);
35777c478bd9Sstevel@tonic-gate }
35786a182920Ssommerfe
35797c478bd9Sstevel@tonic-gate rw_exit(&php->iph_lock);
3580f4b3ec61Sdh155122 ipsec_sel_rel(&sp, ns);
35817c478bd9Sstevel@tonic-gate return (B_FALSE);
35827c478bd9Sstevel@tonic-gate }
35837c478bd9Sstevel@tonic-gate
35847c478bd9Sstevel@tonic-gate int
ipsec_policy_delete_index(ipsec_policy_head_t * php,uint64_t policy_index,netstack_t * ns)3585f4b3ec61Sdh155122 ipsec_policy_delete_index(ipsec_policy_head_t *php, uint64_t policy_index,
3586f4b3ec61Sdh155122 netstack_t *ns)
35877c478bd9Sstevel@tonic-gate {
35886a182920Ssommerfe boolean_t found = B_FALSE;
35896a182920Ssommerfe ipsec_policy_t ipkey;
35906a182920Ssommerfe ipsec_policy_t *ip;
35916a182920Ssommerfe avl_index_t where;
35927c478bd9Sstevel@tonic-gate
3593188e1664SErik Nordmark bzero(&ipkey, sizeof (ipkey));
35946a182920Ssommerfe ipkey.ipsp_index = policy_index;
35957c478bd9Sstevel@tonic-gate
35967c478bd9Sstevel@tonic-gate rw_enter(&php->iph_lock, RW_WRITER);
35977c478bd9Sstevel@tonic-gate
35986a182920Ssommerfe /*
35996a182920Ssommerfe * We could be cleverer here about the walk.
36006a182920Ssommerfe * but well, (k+1)*log(N) will do for now (k==number of matches,
36016a182920Ssommerfe * N==number of table entries
36026a182920Ssommerfe */
36036a182920Ssommerfe for (;;) {
36046a182920Ssommerfe ip = (ipsec_policy_t *)avl_find(&php->iph_rulebyid,
36056a182920Ssommerfe (void *)&ipkey, &where);
36066a182920Ssommerfe ASSERT(ip == NULL);
36076a182920Ssommerfe
36086a182920Ssommerfe ip = avl_nearest(&php->iph_rulebyid, where, AVL_AFTER);
36096a182920Ssommerfe
36106a182920Ssommerfe if (ip == NULL)
36116a182920Ssommerfe break;
36126a182920Ssommerfe
36137c478bd9Sstevel@tonic-gate if (ip->ipsp_index != policy_index) {
36146a182920Ssommerfe ASSERT(ip->ipsp_index > policy_index);
36156a182920Ssommerfe break;
36167c478bd9Sstevel@tonic-gate }
36176a182920Ssommerfe
3618bd670b35SErik Nordmark IPPOL_UNCHAIN(php, ip);
36197c478bd9Sstevel@tonic-gate found = B_TRUE;
36207c478bd9Sstevel@tonic-gate }
36216a182920Ssommerfe
36226a182920Ssommerfe if (found) {
36236a182920Ssommerfe php->iph_gen++;
3624f4b3ec61Sdh155122 ipsec_update_present_flags(ns->netstack_ipsec);
36256a182920Ssommerfe }
36266a182920Ssommerfe
36277c478bd9Sstevel@tonic-gate rw_exit(&php->iph_lock);
36286a182920Ssommerfe
36297c478bd9Sstevel@tonic-gate return (found ? 0 : ENOENT);
36307c478bd9Sstevel@tonic-gate }
36317c478bd9Sstevel@tonic-gate
36327c478bd9Sstevel@tonic-gate /*
36337c478bd9Sstevel@tonic-gate * Given a constructed ipsec_policy_t policy rule, see if it can be entered
36348810c16bSdanmcd * into the correct policy ruleset. As a side-effect, it sets the hash
36358810c16bSdanmcd * entries on "ipp"'s ipsp_pol_hval.
36367c478bd9Sstevel@tonic-gate *
36377c478bd9Sstevel@tonic-gate * Returns B_TRUE if it can be entered, B_FALSE if it can't be (because a
36387c478bd9Sstevel@tonic-gate * duplicate policy exists with exactly the same selectors), or an icmp
36397c478bd9Sstevel@tonic-gate * rule exists with a different encryption/authentication action.
36407c478bd9Sstevel@tonic-gate */
36417c478bd9Sstevel@tonic-gate boolean_t
ipsec_check_policy(ipsec_policy_head_t * php,ipsec_policy_t * ipp,int direction)36427c478bd9Sstevel@tonic-gate ipsec_check_policy(ipsec_policy_head_t *php, ipsec_policy_t *ipp, int direction)
36437c478bd9Sstevel@tonic-gate {
36447c478bd9Sstevel@tonic-gate ipsec_policy_root_t *pr = &php->iph_root[direction];
36457c478bd9Sstevel@tonic-gate int af = -1;
36466a182920Ssommerfe ipsec_policy_t *p2, *head;
36477c478bd9Sstevel@tonic-gate uint8_t check_proto;
36486a182920Ssommerfe ipsec_selkey_t *selkey = &ipp->ipsp_sel->ipsl_key;
36496a182920Ssommerfe uint32_t valid = selkey->ipsl_valid;
36507c478bd9Sstevel@tonic-gate
36516a182920Ssommerfe if (valid & IPSL_IPV6) {
36526a182920Ssommerfe ASSERT(!(valid & IPSL_IPV4));
36537c478bd9Sstevel@tonic-gate af = IPSEC_AF_V6;
36547c478bd9Sstevel@tonic-gate check_proto = IPPROTO_ICMPV6;
36557c478bd9Sstevel@tonic-gate } else {
36566a182920Ssommerfe ASSERT(valid & IPSL_IPV4);
36577c478bd9Sstevel@tonic-gate af = IPSEC_AF_V4;
36587c478bd9Sstevel@tonic-gate check_proto = IPPROTO_ICMP;
36597c478bd9Sstevel@tonic-gate }
36607c478bd9Sstevel@tonic-gate
36616a182920Ssommerfe ASSERT(RW_WRITE_HELD(&php->iph_lock));
36626a182920Ssommerfe
36637c478bd9Sstevel@tonic-gate /*
36647c478bd9Sstevel@tonic-gate * Double-check that we don't have any duplicate selectors here.
36657c478bd9Sstevel@tonic-gate * Because selectors are interned below, we need only compare pointers
36667c478bd9Sstevel@tonic-gate * for equality.
36677c478bd9Sstevel@tonic-gate */
36688810c16bSdanmcd if (selkey->ipsl_sel_hval == IPSEC_SEL_NOHASH) {
36696a182920Ssommerfe head = pr->ipr_nonhash[af];
36706a182920Ssommerfe } else {
36718810c16bSdanmcd selkey->ipsl_pol_hval =
36728810c16bSdanmcd (selkey->ipsl_valid & IPSL_IPV4) ?
36738810c16bSdanmcd IPSEC_IPV4_HASH(selkey->ipsl_remote.ipsad_v4,
36748810c16bSdanmcd pr->ipr_nchains) :
36758810c16bSdanmcd IPSEC_IPV6_HASH(selkey->ipsl_remote.ipsad_v6,
36768810c16bSdanmcd pr->ipr_nchains);
36778810c16bSdanmcd
36788810c16bSdanmcd head = pr->ipr_hash[selkey->ipsl_pol_hval].hash_head;
36796a182920Ssommerfe }
36807c478bd9Sstevel@tonic-gate
36816a182920Ssommerfe for (p2 = head; p2 != NULL; p2 = p2->ipsp_hash.hash_next) {
36827c478bd9Sstevel@tonic-gate if (p2->ipsp_sel == ipp->ipsp_sel)
36837c478bd9Sstevel@tonic-gate return (B_FALSE);
36847c478bd9Sstevel@tonic-gate }
36857c478bd9Sstevel@tonic-gate
36867c478bd9Sstevel@tonic-gate /*
36877c478bd9Sstevel@tonic-gate * If it's ICMP and not a drop or pass rule, run through the ICMP
36887c478bd9Sstevel@tonic-gate * rules and make sure the action is either new or the same as any
36897c478bd9Sstevel@tonic-gate * other actions. We don't have to check the full chain because
36907c478bd9Sstevel@tonic-gate * discard and bypass will override all other actions
36917c478bd9Sstevel@tonic-gate */
36927c478bd9Sstevel@tonic-gate
36936a182920Ssommerfe if (valid & IPSL_PROTOCOL &&
36946a182920Ssommerfe selkey->ipsl_proto == check_proto &&
36957c478bd9Sstevel@tonic-gate (ipp->ipsp_act->ipa_act.ipa_type == IPSEC_ACT_APPLY)) {
36966a182920Ssommerfe
36976a182920Ssommerfe for (p2 = head; p2 != NULL; p2 = p2->ipsp_hash.hash_next) {
36986a182920Ssommerfe
36997c478bd9Sstevel@tonic-gate if (p2->ipsp_sel->ipsl_key.ipsl_valid & IPSL_PROTOCOL &&
37007c478bd9Sstevel@tonic-gate p2->ipsp_sel->ipsl_key.ipsl_proto == check_proto &&
37017c478bd9Sstevel@tonic-gate (p2->ipsp_act->ipa_act.ipa_type ==
37027c478bd9Sstevel@tonic-gate IPSEC_ACT_APPLY)) {
37037c478bd9Sstevel@tonic-gate return (ipsec_compare_action(p2, ipp));
37047c478bd9Sstevel@tonic-gate }
37057c478bd9Sstevel@tonic-gate }
37067c478bd9Sstevel@tonic-gate }
37077c478bd9Sstevel@tonic-gate
37087c478bd9Sstevel@tonic-gate return (B_TRUE);
37097c478bd9Sstevel@tonic-gate }
37107c478bd9Sstevel@tonic-gate
37117c478bd9Sstevel@tonic-gate /*
37127c478bd9Sstevel@tonic-gate * compare the action chains of two policies for equality
37137c478bd9Sstevel@tonic-gate * B_TRUE -> effective equality
37147c478bd9Sstevel@tonic-gate */
37157c478bd9Sstevel@tonic-gate
37167c478bd9Sstevel@tonic-gate static boolean_t
ipsec_compare_action(ipsec_policy_t * p1,ipsec_policy_t * p2)37177c478bd9Sstevel@tonic-gate ipsec_compare_action(ipsec_policy_t *p1, ipsec_policy_t *p2)
37187c478bd9Sstevel@tonic-gate {
37197c478bd9Sstevel@tonic-gate
37207c478bd9Sstevel@tonic-gate ipsec_action_t *act1, *act2;
37217c478bd9Sstevel@tonic-gate
37227c478bd9Sstevel@tonic-gate /* We have a valid rule. Let's compare the actions */
37237c478bd9Sstevel@tonic-gate if (p1->ipsp_act == p2->ipsp_act) {
37247c478bd9Sstevel@tonic-gate /* same action. We are good */
37257c478bd9Sstevel@tonic-gate return (B_TRUE);
37267c478bd9Sstevel@tonic-gate }
37277c478bd9Sstevel@tonic-gate
37287c478bd9Sstevel@tonic-gate /* we have to walk the chain */
37297c478bd9Sstevel@tonic-gate
37307c478bd9Sstevel@tonic-gate act1 = p1->ipsp_act;
37317c478bd9Sstevel@tonic-gate act2 = p2->ipsp_act;
37327c478bd9Sstevel@tonic-gate
37337c478bd9Sstevel@tonic-gate while (act1 != NULL && act2 != NULL) {
37347c478bd9Sstevel@tonic-gate
37357c478bd9Sstevel@tonic-gate /* otherwise, Are we close enough? */
37367c478bd9Sstevel@tonic-gate if (act1->ipa_allow_clear != act2->ipa_allow_clear ||
37377c478bd9Sstevel@tonic-gate act1->ipa_want_ah != act2->ipa_want_ah ||
37387c478bd9Sstevel@tonic-gate act1->ipa_want_esp != act2->ipa_want_esp ||
37397c478bd9Sstevel@tonic-gate act1->ipa_want_se != act2->ipa_want_se) {
37407c478bd9Sstevel@tonic-gate /* Nope, we aren't */
37417c478bd9Sstevel@tonic-gate return (B_FALSE);
37427c478bd9Sstevel@tonic-gate }
37437c478bd9Sstevel@tonic-gate
37447c478bd9Sstevel@tonic-gate if (act1->ipa_want_ah) {
37457c478bd9Sstevel@tonic-gate if (act1->ipa_act.ipa_apply.ipp_auth_alg !=
37467c478bd9Sstevel@tonic-gate act2->ipa_act.ipa_apply.ipp_auth_alg) {
37477c478bd9Sstevel@tonic-gate return (B_FALSE);
37487c478bd9Sstevel@tonic-gate }
37497c478bd9Sstevel@tonic-gate
37507c478bd9Sstevel@tonic-gate if (act1->ipa_act.ipa_apply.ipp_ah_minbits !=
37517c478bd9Sstevel@tonic-gate act2->ipa_act.ipa_apply.ipp_ah_minbits ||
37527c478bd9Sstevel@tonic-gate act1->ipa_act.ipa_apply.ipp_ah_maxbits !=
37537c478bd9Sstevel@tonic-gate act2->ipa_act.ipa_apply.ipp_ah_maxbits) {
37547c478bd9Sstevel@tonic-gate return (B_FALSE);
37557c478bd9Sstevel@tonic-gate }
37567c478bd9Sstevel@tonic-gate }
37577c478bd9Sstevel@tonic-gate
37587c478bd9Sstevel@tonic-gate if (act1->ipa_want_esp) {
37597c478bd9Sstevel@tonic-gate if (act1->ipa_act.ipa_apply.ipp_use_esp !=
37607c478bd9Sstevel@tonic-gate act2->ipa_act.ipa_apply.ipp_use_esp ||
37617c478bd9Sstevel@tonic-gate act1->ipa_act.ipa_apply.ipp_use_espa !=
37627c478bd9Sstevel@tonic-gate act2->ipa_act.ipa_apply.ipp_use_espa) {
37637c478bd9Sstevel@tonic-gate return (B_FALSE);
37647c478bd9Sstevel@tonic-gate }
37657c478bd9Sstevel@tonic-gate
37667c478bd9Sstevel@tonic-gate if (act1->ipa_act.ipa_apply.ipp_use_esp) {
37677c478bd9Sstevel@tonic-gate if (act1->ipa_act.ipa_apply.ipp_encr_alg !=
37687c478bd9Sstevel@tonic-gate act2->ipa_act.ipa_apply.ipp_encr_alg) {
37697c478bd9Sstevel@tonic-gate return (B_FALSE);
37707c478bd9Sstevel@tonic-gate }
37717c478bd9Sstevel@tonic-gate
37727c478bd9Sstevel@tonic-gate if (act1->ipa_act.ipa_apply.ipp_espe_minbits !=
37737c478bd9Sstevel@tonic-gate act2->ipa_act.ipa_apply.ipp_espe_minbits ||
37747c478bd9Sstevel@tonic-gate act1->ipa_act.ipa_apply.ipp_espe_maxbits !=
37757c478bd9Sstevel@tonic-gate act2->ipa_act.ipa_apply.ipp_espe_maxbits) {
37767c478bd9Sstevel@tonic-gate return (B_FALSE);
37777c478bd9Sstevel@tonic-gate }
37787c478bd9Sstevel@tonic-gate }
37797c478bd9Sstevel@tonic-gate
37807c478bd9Sstevel@tonic-gate if (act1->ipa_act.ipa_apply.ipp_use_espa) {
37817c478bd9Sstevel@tonic-gate if (act1->ipa_act.ipa_apply.ipp_esp_auth_alg !=
37827c478bd9Sstevel@tonic-gate act2->ipa_act.ipa_apply.ipp_esp_auth_alg) {
37837c478bd9Sstevel@tonic-gate return (B_FALSE);
37847c478bd9Sstevel@tonic-gate }
37857c478bd9Sstevel@tonic-gate
37867c478bd9Sstevel@tonic-gate if (act1->ipa_act.ipa_apply.ipp_espa_minbits !=
37877c478bd9Sstevel@tonic-gate act2->ipa_act.ipa_apply.ipp_espa_minbits ||
37887c478bd9Sstevel@tonic-gate act1->ipa_act.ipa_apply.ipp_espa_maxbits !=
37897c478bd9Sstevel@tonic-gate act2->ipa_act.ipa_apply.ipp_espa_maxbits) {
37907c478bd9Sstevel@tonic-gate return (B_FALSE);
37917c478bd9Sstevel@tonic-gate }
37927c478bd9Sstevel@tonic-gate }
37937c478bd9Sstevel@tonic-gate
37947c478bd9Sstevel@tonic-gate }
37957c478bd9Sstevel@tonic-gate
37967c478bd9Sstevel@tonic-gate act1 = act1->ipa_next;
37977c478bd9Sstevel@tonic-gate act2 = act2->ipa_next;
37987c478bd9Sstevel@tonic-gate }
37997c478bd9Sstevel@tonic-gate
38007c478bd9Sstevel@tonic-gate if (act1 != NULL || act2 != NULL) {
38017c478bd9Sstevel@tonic-gate return (B_FALSE);
38027c478bd9Sstevel@tonic-gate }
38037c478bd9Sstevel@tonic-gate
38047c478bd9Sstevel@tonic-gate return (B_TRUE);
38057c478bd9Sstevel@tonic-gate }
38067c478bd9Sstevel@tonic-gate
38077c478bd9Sstevel@tonic-gate
38087c478bd9Sstevel@tonic-gate /*
38097c478bd9Sstevel@tonic-gate * Given a constructed ipsec_policy_t policy rule, enter it into
38107c478bd9Sstevel@tonic-gate * the correct policy ruleset.
38117c478bd9Sstevel@tonic-gate *
38127c478bd9Sstevel@tonic-gate * ipsec_check_policy() is assumed to have succeeded first (to check for
38137c478bd9Sstevel@tonic-gate * duplicates).
38147c478bd9Sstevel@tonic-gate */
38157c478bd9Sstevel@tonic-gate void
ipsec_enter_policy(ipsec_policy_head_t * php,ipsec_policy_t * ipp,int direction,netstack_t * ns)3816f4b3ec61Sdh155122 ipsec_enter_policy(ipsec_policy_head_t *php, ipsec_policy_t *ipp, int direction,
3817f4b3ec61Sdh155122 netstack_t *ns)
38187c478bd9Sstevel@tonic-gate {
38197c478bd9Sstevel@tonic-gate ipsec_policy_root_t *pr = &php->iph_root[direction];
38206a182920Ssommerfe ipsec_selkey_t *selkey = &ipp->ipsp_sel->ipsl_key;
38216a182920Ssommerfe uint32_t valid = selkey->ipsl_valid;
38228810c16bSdanmcd uint32_t hval = selkey->ipsl_pol_hval;
38237c478bd9Sstevel@tonic-gate int af = -1;
38247c478bd9Sstevel@tonic-gate
38257c478bd9Sstevel@tonic-gate ASSERT(RW_WRITE_HELD(&php->iph_lock));
38267c478bd9Sstevel@tonic-gate
38276a182920Ssommerfe if (valid & IPSL_IPV6) {
38286a182920Ssommerfe ASSERT(!(valid & IPSL_IPV4));
38297c478bd9Sstevel@tonic-gate af = IPSEC_AF_V6;
38307c478bd9Sstevel@tonic-gate } else {
38316a182920Ssommerfe ASSERT(valid & IPSL_IPV4);
38327c478bd9Sstevel@tonic-gate af = IPSEC_AF_V4;
38337c478bd9Sstevel@tonic-gate }
38347c478bd9Sstevel@tonic-gate
38357c478bd9Sstevel@tonic-gate php->iph_gen++;
38367c478bd9Sstevel@tonic-gate
38376a182920Ssommerfe if (hval == IPSEC_SEL_NOHASH) {
38386a182920Ssommerfe HASHLIST_INSERT(ipp, ipsp_hash, pr->ipr_nonhash[af]);
38396a182920Ssommerfe } else {
38406a182920Ssommerfe HASH_LOCK(pr->ipr_hash, hval);
38416a182920Ssommerfe HASH_INSERT(ipp, ipsp_hash, pr->ipr_hash, hval);
38426a182920Ssommerfe HASH_UNLOCK(pr->ipr_hash, hval);
38436a182920Ssommerfe }
38446a182920Ssommerfe
38456a182920Ssommerfe ipsec_insert_always(&php->iph_rulebyid, ipp);
38466a182920Ssommerfe
3847f4b3ec61Sdh155122 ipsec_update_present_flags(ns->netstack_ipsec);
38487c478bd9Sstevel@tonic-gate }
38497c478bd9Sstevel@tonic-gate
38506a182920Ssommerfe static void
ipsec_ipr_flush(ipsec_policy_head_t * php,ipsec_policy_root_t * ipr)3851bd670b35SErik Nordmark ipsec_ipr_flush(ipsec_policy_head_t *php, ipsec_policy_root_t *ipr)
38526a182920Ssommerfe {
38536a182920Ssommerfe ipsec_policy_t *ip, *nip;
38546a182920Ssommerfe int af, chain, nchain;
38556a182920Ssommerfe
38566a182920Ssommerfe for (af = 0; af < IPSEC_NAF; af++) {
38576a182920Ssommerfe for (ip = ipr->ipr_nonhash[af]; ip != NULL; ip = nip) {
38586a182920Ssommerfe nip = ip->ipsp_hash.hash_next;
3859bd670b35SErik Nordmark IPPOL_UNCHAIN(php, ip);
38606a182920Ssommerfe }
38616a182920Ssommerfe ipr->ipr_nonhash[af] = NULL;
38626a182920Ssommerfe }
38636a182920Ssommerfe nchain = ipr->ipr_nchains;
38646a182920Ssommerfe
38656a182920Ssommerfe for (chain = 0; chain < nchain; chain++) {
38666a182920Ssommerfe for (ip = ipr->ipr_hash[chain].hash_head; ip != NULL;
38676a182920Ssommerfe ip = nip) {
38686a182920Ssommerfe nip = ip->ipsp_hash.hash_next;
3869bd670b35SErik Nordmark IPPOL_UNCHAIN(php, ip);
38706a182920Ssommerfe }
38716a182920Ssommerfe ipr->ipr_hash[chain].hash_head = NULL;
38726a182920Ssommerfe }
38736a182920Ssommerfe }
38746a182920Ssommerfe
38752b24ab6bSSebastien Roy /*
38762b24ab6bSSebastien Roy * Create and insert inbound or outbound policy associated with actp for the
38772b24ab6bSSebastien Roy * address family fam into the policy head ph. Returns B_TRUE if policy was
38782b24ab6bSSebastien Roy * inserted, and B_FALSE otherwise.
38792b24ab6bSSebastien Roy */
38802b24ab6bSSebastien Roy boolean_t
ipsec_polhead_insert(ipsec_policy_head_t * ph,ipsec_act_t * actp,uint_t nact,int fam,int ptype,netstack_t * ns)38812b24ab6bSSebastien Roy ipsec_polhead_insert(ipsec_policy_head_t *ph, ipsec_act_t *actp, uint_t nact,
38822b24ab6bSSebastien Roy int fam, int ptype, netstack_t *ns)
38832b24ab6bSSebastien Roy {
38842b24ab6bSSebastien Roy ipsec_selkey_t sel;
38852b24ab6bSSebastien Roy ipsec_policy_t *pol;
38862b24ab6bSSebastien Roy ipsec_policy_root_t *pr;
38872b24ab6bSSebastien Roy
38882b24ab6bSSebastien Roy bzero(&sel, sizeof (sel));
38892b24ab6bSSebastien Roy sel.ipsl_valid = (fam == IPSEC_AF_V4 ? IPSL_IPV4 : IPSL_IPV6);
38902b24ab6bSSebastien Roy if ((pol = ipsec_policy_create(&sel, actp, nact, IPSEC_PRIO_SOCKET,
38912b24ab6bSSebastien Roy NULL, ns)) != NULL) {
38922b24ab6bSSebastien Roy pr = &ph->iph_root[ptype];
38932b24ab6bSSebastien Roy HASHLIST_INSERT(pol, ipsp_hash, pr->ipr_nonhash[fam]);
38942b24ab6bSSebastien Roy ipsec_insert_always(&ph->iph_rulebyid, pol);
38952b24ab6bSSebastien Roy }
38962b24ab6bSSebastien Roy return (pol != NULL);
38972b24ab6bSSebastien Roy }
38982b24ab6bSSebastien Roy
38997c478bd9Sstevel@tonic-gate void
ipsec_polhead_flush(ipsec_policy_head_t * php,netstack_t * ns)3900f4b3ec61Sdh155122 ipsec_polhead_flush(ipsec_policy_head_t *php, netstack_t *ns)
39017c478bd9Sstevel@tonic-gate {
39026a182920Ssommerfe int dir;
39037c478bd9Sstevel@tonic-gate
39047c478bd9Sstevel@tonic-gate ASSERT(RW_WRITE_HELD(&php->iph_lock));
39057c478bd9Sstevel@tonic-gate
39066a182920Ssommerfe for (dir = 0; dir < IPSEC_NTYPES; dir++)
3907bd670b35SErik Nordmark ipsec_ipr_flush(php, &php->iph_root[dir]);
39086a182920Ssommerfe
3909bd670b35SErik Nordmark php->iph_gen++;
3910f4b3ec61Sdh155122 ipsec_update_present_flags(ns->netstack_ipsec);
39117c478bd9Sstevel@tonic-gate }
39127c478bd9Sstevel@tonic-gate
39137c478bd9Sstevel@tonic-gate void
ipsec_polhead_free(ipsec_policy_head_t * php,netstack_t * ns)3914f4b3ec61Sdh155122 ipsec_polhead_free(ipsec_policy_head_t *php, netstack_t *ns)
39157c478bd9Sstevel@tonic-gate {
39168810c16bSdanmcd int dir;
39178810c16bSdanmcd
39187c478bd9Sstevel@tonic-gate ASSERT(php->iph_refs == 0);
3919f4b3ec61Sdh155122
39207c478bd9Sstevel@tonic-gate rw_enter(&php->iph_lock, RW_WRITER);
3921f4b3ec61Sdh155122 ipsec_polhead_flush(php, ns);
39227c478bd9Sstevel@tonic-gate rw_exit(&php->iph_lock);
39237c478bd9Sstevel@tonic-gate rw_destroy(&php->iph_lock);
39248810c16bSdanmcd for (dir = 0; dir < IPSEC_NTYPES; dir++) {
39258810c16bSdanmcd ipsec_policy_root_t *ipr = &php->iph_root[dir];
39268810c16bSdanmcd int chain;
39278810c16bSdanmcd
39288810c16bSdanmcd for (chain = 0; chain < ipr->ipr_nchains; chain++)
39298810c16bSdanmcd mutex_destroy(&(ipr->ipr_hash[chain].hash_lock));
39308810c16bSdanmcd
39318810c16bSdanmcd }
39328810c16bSdanmcd ipsec_polhead_free_table(php);
39337c478bd9Sstevel@tonic-gate kmem_free(php, sizeof (*php));
39347c478bd9Sstevel@tonic-gate }
39357c478bd9Sstevel@tonic-gate
39366a182920Ssommerfe static void
ipsec_ipr_init(ipsec_policy_root_t * ipr)39376a182920Ssommerfe ipsec_ipr_init(ipsec_policy_root_t *ipr)
39386a182920Ssommerfe {
39396a182920Ssommerfe int af;
39406a182920Ssommerfe
39416a182920Ssommerfe ipr->ipr_nchains = 0;
39426a182920Ssommerfe ipr->ipr_hash = NULL;
39436a182920Ssommerfe
39446a182920Ssommerfe for (af = 0; af < IPSEC_NAF; af++) {
39456a182920Ssommerfe ipr->ipr_nonhash[af] = NULL;
39466a182920Ssommerfe }
39476a182920Ssommerfe }
39486a182920Ssommerfe
39498810c16bSdanmcd ipsec_policy_head_t *
ipsec_polhead_create(void)39507c478bd9Sstevel@tonic-gate ipsec_polhead_create(void)
39517c478bd9Sstevel@tonic-gate {
39527c478bd9Sstevel@tonic-gate ipsec_policy_head_t *php;
39537c478bd9Sstevel@tonic-gate
39547c478bd9Sstevel@tonic-gate php = kmem_alloc(sizeof (*php), KM_NOSLEEP);
39556a182920Ssommerfe if (php == NULL)
39566a182920Ssommerfe return (php);
39576a182920Ssommerfe
39587c478bd9Sstevel@tonic-gate rw_init(&php->iph_lock, NULL, RW_DEFAULT, NULL);
39597c478bd9Sstevel@tonic-gate php->iph_refs = 1;
39606a182920Ssommerfe php->iph_gen = 0;
39616a182920Ssommerfe
39626a182920Ssommerfe ipsec_ipr_init(&php->iph_root[IPSEC_TYPE_INBOUND]);
39636a182920Ssommerfe ipsec_ipr_init(&php->iph_root[IPSEC_TYPE_OUTBOUND]);
39646a182920Ssommerfe
39656a182920Ssommerfe avl_create(&php->iph_rulebyid, ipsec_policy_cmpbyid,
39666a182920Ssommerfe sizeof (ipsec_policy_t), offsetof(ipsec_policy_t, ipsp_byid));
39676a182920Ssommerfe
39687c478bd9Sstevel@tonic-gate return (php);
39697c478bd9Sstevel@tonic-gate }
39707c478bd9Sstevel@tonic-gate
39717c478bd9Sstevel@tonic-gate /*
39727c478bd9Sstevel@tonic-gate * Clone the policy head into a new polhead; release one reference to the
39737c478bd9Sstevel@tonic-gate * old one and return the only reference to the new one.
39747c478bd9Sstevel@tonic-gate * If the old one had a refcount of 1, just return it.
39757c478bd9Sstevel@tonic-gate */
39768810c16bSdanmcd ipsec_policy_head_t *
ipsec_polhead_split(ipsec_policy_head_t * php,netstack_t * ns)3977f4b3ec61Sdh155122 ipsec_polhead_split(ipsec_policy_head_t *php, netstack_t *ns)
39787c478bd9Sstevel@tonic-gate {
39797c478bd9Sstevel@tonic-gate ipsec_policy_head_t *nphp;
39807c478bd9Sstevel@tonic-gate
39817c478bd9Sstevel@tonic-gate if (php == NULL)
39827c478bd9Sstevel@tonic-gate return (ipsec_polhead_create());
39837c478bd9Sstevel@tonic-gate else if (php->iph_refs == 1)
39847c478bd9Sstevel@tonic-gate return (php);
39857c478bd9Sstevel@tonic-gate
39867c478bd9Sstevel@tonic-gate nphp = ipsec_polhead_create();
39877c478bd9Sstevel@tonic-gate if (nphp == NULL)
39887c478bd9Sstevel@tonic-gate return (NULL);
39897c478bd9Sstevel@tonic-gate
3990f4b3ec61Sdh155122 if (ipsec_copy_polhead(php, nphp, ns) != 0) {
3991f4b3ec61Sdh155122 ipsec_polhead_free(nphp, ns);
39927c478bd9Sstevel@tonic-gate return (NULL);
39937c478bd9Sstevel@tonic-gate }
3994f4b3ec61Sdh155122 IPPH_REFRELE(php, ns);
39957c478bd9Sstevel@tonic-gate return (nphp);
39967c478bd9Sstevel@tonic-gate }
39977c478bd9Sstevel@tonic-gate
39987c478bd9Sstevel@tonic-gate /*
39997c478bd9Sstevel@tonic-gate * When sending a response to a ICMP request or generating a RST
40007c478bd9Sstevel@tonic-gate * in the TCP case, the outbound packets need to go at the same level
40017c478bd9Sstevel@tonic-gate * of protection as the incoming ones i.e we associate our outbound
40027c478bd9Sstevel@tonic-gate * policy with how the packet came in. We call this after we have
40037c478bd9Sstevel@tonic-gate * accepted the incoming packet which may or may not have been in
40047c478bd9Sstevel@tonic-gate * clear and hence we are sending the reply back with the policy
40057c478bd9Sstevel@tonic-gate * matching the incoming datagram's policy.
40067c478bd9Sstevel@tonic-gate *
40077c478bd9Sstevel@tonic-gate * NOTE : This technology serves two purposes :
40087c478bd9Sstevel@tonic-gate *
40097c478bd9Sstevel@tonic-gate * 1) If we have multiple outbound policies, we send out a reply
40107c478bd9Sstevel@tonic-gate * matching with how it came in rather than matching the outbound
40117c478bd9Sstevel@tonic-gate * policy.
40127c478bd9Sstevel@tonic-gate *
40137c478bd9Sstevel@tonic-gate * 2) For assymetric policies, we want to make sure that incoming
40147c478bd9Sstevel@tonic-gate * and outgoing has the same level of protection. Assymetric
40157c478bd9Sstevel@tonic-gate * policies exist only with global policy where we may not have
40167c478bd9Sstevel@tonic-gate * both outbound and inbound at the same time.
40177c478bd9Sstevel@tonic-gate *
40187c478bd9Sstevel@tonic-gate * NOTE2: This function is called by cleartext cases, so it needs to be
40197c478bd9Sstevel@tonic-gate * in IP proper.
4020bd670b35SErik Nordmark *
4021bd670b35SErik Nordmark * Note: the caller has moved other parts of ira into ixa already.
40227c478bd9Sstevel@tonic-gate */
40237c478bd9Sstevel@tonic-gate boolean_t
ipsec_in_to_out(ip_recv_attr_t * ira,ip_xmit_attr_t * ixa,mblk_t * data_mp,ipha_t * ipha,ip6_t * ip6h)4024bd670b35SErik Nordmark ipsec_in_to_out(ip_recv_attr_t *ira, ip_xmit_attr_t *ixa, mblk_t *data_mp,
4025bd670b35SErik Nordmark ipha_t *ipha, ip6_t *ip6h)
40267c478bd9Sstevel@tonic-gate {
40277c478bd9Sstevel@tonic-gate ipsec_selector_t sel;
40287c478bd9Sstevel@tonic-gate ipsec_action_t *reflect_action = NULL;
4029bd670b35SErik Nordmark netstack_t *ns = ixa->ixa_ipst->ips_netstack;
40307c478bd9Sstevel@tonic-gate
40317c478bd9Sstevel@tonic-gate bzero((void*)&sel, sizeof (sel));
40327c478bd9Sstevel@tonic-gate
4033bd670b35SErik Nordmark if (ira->ira_ipsec_action != NULL) {
40347c478bd9Sstevel@tonic-gate /* transfer reference.. */
4035bd670b35SErik Nordmark reflect_action = ira->ira_ipsec_action;
4036bd670b35SErik Nordmark ira->ira_ipsec_action = NULL;
4037bd670b35SErik Nordmark } else if (!(ira->ira_flags & IRAF_LOOPBACK))
4038bd670b35SErik Nordmark reflect_action = ipsec_in_to_out_action(ira);
40395d3b8cb7SBill Sommerfeld
40405d3b8cb7SBill Sommerfeld /*
40417c478bd9Sstevel@tonic-gate * The caller is going to send the datagram out which might
4042bd670b35SErik Nordmark * go on the wire or delivered locally through ire_send_local.
40437c478bd9Sstevel@tonic-gate *
40447c478bd9Sstevel@tonic-gate * 1) If it goes out on the wire, new associations will be
40457c478bd9Sstevel@tonic-gate * obtained.
4046bd670b35SErik Nordmark * 2) If it is delivered locally, ire_send_local will convert
4047bd670b35SErik Nordmark * this ip_xmit_attr_t back to a ip_recv_attr_t looking at the
4048bd670b35SErik Nordmark * requests.
40497c478bd9Sstevel@tonic-gate */
4050bd670b35SErik Nordmark ixa->ixa_ipsec_action = reflect_action;
40517c478bd9Sstevel@tonic-gate
4052bd670b35SErik Nordmark if (!ipsec_init_outbound_ports(&sel, data_mp, ipha, ip6h, 0,
4053bd670b35SErik Nordmark ns->netstack_ipsec)) {
4054bd670b35SErik Nordmark /* Note: data_mp already consumed and ip_drop_packet done */
40557c478bd9Sstevel@tonic-gate return (B_FALSE);
4056bd670b35SErik Nordmark }
4057bd670b35SErik Nordmark ixa->ixa_ipsec_src_port = sel.ips_local_port;
4058bd670b35SErik Nordmark ixa->ixa_ipsec_dst_port = sel.ips_remote_port;
4059bd670b35SErik Nordmark ixa->ixa_ipsec_proto = sel.ips_protocol;
4060bd670b35SErik Nordmark ixa->ixa_ipsec_icmp_type = sel.ips_icmp_type;
4061bd670b35SErik Nordmark ixa->ixa_ipsec_icmp_code = sel.ips_icmp_code;
40627c478bd9Sstevel@tonic-gate
40637c478bd9Sstevel@tonic-gate /*
40647c478bd9Sstevel@tonic-gate * Don't use global policy for this, as we want
40657c478bd9Sstevel@tonic-gate * to use the same protection that was applied to the inbound packet.
4066bd670b35SErik Nordmark * Thus we set IXAF_NO_IPSEC is it arrived in the clear to make
4067bd670b35SErik Nordmark * it be sent in the clear.
40687c478bd9Sstevel@tonic-gate */
4069bd670b35SErik Nordmark if (ira->ira_flags & IRAF_IPSEC_SECURE)
4070bd670b35SErik Nordmark ixa->ixa_flags |= IXAF_IPSEC_SECURE;
4071bd670b35SErik Nordmark else
4072bd670b35SErik Nordmark ixa->ixa_flags |= IXAF_NO_IPSEC;
4073f4b3ec61Sdh155122
40747c478bd9Sstevel@tonic-gate return (B_TRUE);
40757c478bd9Sstevel@tonic-gate }
40767c478bd9Sstevel@tonic-gate
4077bd670b35SErik Nordmark void
ipsec_out_release_refs(ip_xmit_attr_t * ixa)4078bd670b35SErik Nordmark ipsec_out_release_refs(ip_xmit_attr_t *ixa)
40797c478bd9Sstevel@tonic-gate {
4080bd670b35SErik Nordmark if (!(ixa->ixa_flags & IXAF_IPSEC_SECURE))
4081bd670b35SErik Nordmark return;
40827c478bd9Sstevel@tonic-gate
4083bd670b35SErik Nordmark if (ixa->ixa_ipsec_ah_sa != NULL) {
4084bd670b35SErik Nordmark IPSA_REFRELE(ixa->ixa_ipsec_ah_sa);
4085bd670b35SErik Nordmark ixa->ixa_ipsec_ah_sa = NULL;
4086bd670b35SErik Nordmark }
4087bd670b35SErik Nordmark if (ixa->ixa_ipsec_esp_sa != NULL) {
4088bd670b35SErik Nordmark IPSA_REFRELE(ixa->ixa_ipsec_esp_sa);
4089bd670b35SErik Nordmark ixa->ixa_ipsec_esp_sa = NULL;
4090bd670b35SErik Nordmark }
4091bd670b35SErik Nordmark if (ixa->ixa_ipsec_policy != NULL) {
4092bd670b35SErik Nordmark IPPOL_REFRELE(ixa->ixa_ipsec_policy);
4093bd670b35SErik Nordmark ixa->ixa_ipsec_policy = NULL;
4094bd670b35SErik Nordmark }
4095bd670b35SErik Nordmark if (ixa->ixa_ipsec_action != NULL) {
4096bd670b35SErik Nordmark IPACT_REFRELE(ixa->ixa_ipsec_action);
4097bd670b35SErik Nordmark ixa->ixa_ipsec_action = NULL;
4098bd670b35SErik Nordmark }
4099bd670b35SErik Nordmark if (ixa->ixa_ipsec_latch) {
4100bd670b35SErik Nordmark IPLATCH_REFRELE(ixa->ixa_ipsec_latch);
4101bd670b35SErik Nordmark ixa->ixa_ipsec_latch = NULL;
4102bd670b35SErik Nordmark }
4103bd670b35SErik Nordmark /* Clear the soft references to the SAs */
4104bd670b35SErik Nordmark ixa->ixa_ipsec_ref[0].ipsr_sa = NULL;
4105bd670b35SErik Nordmark ixa->ixa_ipsec_ref[0].ipsr_bucket = NULL;
4106bd670b35SErik Nordmark ixa->ixa_ipsec_ref[0].ipsr_gen = 0;
4107bd670b35SErik Nordmark ixa->ixa_ipsec_ref[1].ipsr_sa = NULL;
4108bd670b35SErik Nordmark ixa->ixa_ipsec_ref[1].ipsr_bucket = NULL;
4109bd670b35SErik Nordmark ixa->ixa_ipsec_ref[1].ipsr_gen = 0;
4110bd670b35SErik Nordmark ixa->ixa_flags &= ~IXAF_IPSEC_SECURE;
4111f4b3ec61Sdh155122 }
41127c478bd9Sstevel@tonic-gate
4113bd670b35SErik Nordmark void
ipsec_in_release_refs(ip_recv_attr_t * ira)4114bd670b35SErik Nordmark ipsec_in_release_refs(ip_recv_attr_t *ira)
41157c478bd9Sstevel@tonic-gate {
4116bd670b35SErik Nordmark if (!(ira->ira_flags & IRAF_IPSEC_SECURE))
4117bd670b35SErik Nordmark return;
41187c478bd9Sstevel@tonic-gate
4119bd670b35SErik Nordmark if (ira->ira_ipsec_ah_sa != NULL) {
4120bd670b35SErik Nordmark IPSA_REFRELE(ira->ira_ipsec_ah_sa);
4121bd670b35SErik Nordmark ira->ira_ipsec_ah_sa = NULL;
41227c478bd9Sstevel@tonic-gate }
4123bd670b35SErik Nordmark if (ira->ira_ipsec_esp_sa != NULL) {
4124bd670b35SErik Nordmark IPSA_REFRELE(ira->ira_ipsec_esp_sa);
4125bd670b35SErik Nordmark ira->ira_ipsec_esp_sa = NULL;
41267c478bd9Sstevel@tonic-gate }
412762063242SDan McDonald if (ira->ira_ipsec_action != NULL) {
412862063242SDan McDonald IPACT_REFRELE(ira->ira_ipsec_action);
412962063242SDan McDonald ira->ira_ipsec_action = NULL;
413062063242SDan McDonald }
413162063242SDan McDonald
4132bd670b35SErik Nordmark ira->ira_flags &= ~IRAF_IPSEC_SECURE;
41337c478bd9Sstevel@tonic-gate }
41347c478bd9Sstevel@tonic-gate
41357c478bd9Sstevel@tonic-gate /*
4136bd670b35SErik Nordmark * This is called from ire_send_local when a packet
4137bd670b35SErik Nordmark * is looped back. We setup the ip_recv_attr_t "borrowing" the references
4138bd670b35SErik Nordmark * held by the callers.
4139bd670b35SErik Nordmark * Note that we don't do any IPsec but we carry the actions and IPSEC flags
4140bd670b35SErik Nordmark * across so that the fanout policy checks see that IPsec was applied.
41417c478bd9Sstevel@tonic-gate *
4142bd670b35SErik Nordmark * The caller should do ipsec_in_release_refs() on the ira by calling
4143bd670b35SErik Nordmark * ira_cleanup().
41447c478bd9Sstevel@tonic-gate */
41457c478bd9Sstevel@tonic-gate void
ipsec_out_to_in(ip_xmit_attr_t * ixa,ill_t * ill,ip_recv_attr_t * ira)4146bd670b35SErik Nordmark ipsec_out_to_in(ip_xmit_attr_t *ixa, ill_t *ill, ip_recv_attr_t *ira)
41477c478bd9Sstevel@tonic-gate {
41487c478bd9Sstevel@tonic-gate ipsec_policy_t *pol;
41497c478bd9Sstevel@tonic-gate ipsec_action_t *act;
41507c478bd9Sstevel@tonic-gate
4151bd670b35SErik Nordmark /* Non-IPsec operations */
4152bd670b35SErik Nordmark ira->ira_free_flags = 0;
4153bd670b35SErik Nordmark ira->ira_zoneid = ixa->ixa_zoneid;
4154bd670b35SErik Nordmark ira->ira_cred = ixa->ixa_cred;
4155bd670b35SErik Nordmark ira->ira_cpid = ixa->ixa_cpid;
4156bd670b35SErik Nordmark ira->ira_tsl = ixa->ixa_tsl;
4157bd670b35SErik Nordmark ira->ira_ill = ira->ira_rill = ill;
4158bd670b35SErik Nordmark ira->ira_flags = ixa->ixa_flags & IAF_MASK;
4159bd670b35SErik Nordmark ira->ira_no_loop_zoneid = ixa->ixa_no_loop_zoneid;
4160bd670b35SErik Nordmark ira->ira_pktlen = ixa->ixa_pktlen;
4161bd670b35SErik Nordmark ira->ira_ip_hdr_length = ixa->ixa_ip_hdr_length;
4162bd670b35SErik Nordmark ira->ira_protocol = ixa->ixa_protocol;
4163bd670b35SErik Nordmark ira->ira_mhip = NULL;
41647c478bd9Sstevel@tonic-gate
4165bd670b35SErik Nordmark ira->ira_flags |= IRAF_LOOPBACK | IRAF_L2SRC_LOOPBACK;
41667c478bd9Sstevel@tonic-gate
4167bd670b35SErik Nordmark ira->ira_sqp = ixa->ixa_sqp;
4168bd670b35SErik Nordmark ira->ira_ring = NULL;
41697c478bd9Sstevel@tonic-gate
4170bd670b35SErik Nordmark ira->ira_ruifindex = ill->ill_phyint->phyint_ifindex;
4171bd670b35SErik Nordmark ira->ira_rifindex = ira->ira_ruifindex;
4172bd670b35SErik Nordmark
4173bd670b35SErik Nordmark if (!(ixa->ixa_flags & IXAF_IPSEC_SECURE))
4174bd670b35SErik Nordmark return;
4175bd670b35SErik Nordmark
4176bd670b35SErik Nordmark ira->ira_flags |= IRAF_IPSEC_SECURE;
4177bd670b35SErik Nordmark
4178bd670b35SErik Nordmark ira->ira_ipsec_ah_sa = NULL;
4179bd670b35SErik Nordmark ira->ira_ipsec_esp_sa = NULL;
4180bd670b35SErik Nordmark
4181bd670b35SErik Nordmark act = ixa->ixa_ipsec_action;
41827c478bd9Sstevel@tonic-gate if (act == NULL) {
4183bd670b35SErik Nordmark pol = ixa->ixa_ipsec_policy;
41847c478bd9Sstevel@tonic-gate if (pol != NULL) {
41857c478bd9Sstevel@tonic-gate act = pol->ipsp_act;
41867c478bd9Sstevel@tonic-gate IPACT_REFHOLD(act);
41877c478bd9Sstevel@tonic-gate }
41887c478bd9Sstevel@tonic-gate }
4189bd670b35SErik Nordmark ixa->ixa_ipsec_action = NULL;
4190bd670b35SErik Nordmark ira->ira_ipsec_action = act;
41917c478bd9Sstevel@tonic-gate }
41927c478bd9Sstevel@tonic-gate
41937c478bd9Sstevel@tonic-gate /*
4194bd670b35SErik Nordmark * Consults global policy and per-socket policy to see whether this datagram
4195bd670b35SErik Nordmark * should go out secure. If so it updates the ip_xmit_attr_t
4196bd670b35SErik Nordmark * Should not be used when connecting, since then we want to latch the policy.
4197bd670b35SErik Nordmark *
4198bd670b35SErik Nordmark * If connp is NULL we just look at the global policy.
4199bd670b35SErik Nordmark *
4200bd670b35SErik Nordmark * Returns NULL if the packet was dropped, in which case the MIB has
4201bd670b35SErik Nordmark * been incremented and ip_drop_packet done.
42027c478bd9Sstevel@tonic-gate */
42037c478bd9Sstevel@tonic-gate mblk_t *
ip_output_attach_policy(mblk_t * mp,ipha_t * ipha,ip6_t * ip6h,const conn_t * connp,ip_xmit_attr_t * ixa)4204bd670b35SErik Nordmark ip_output_attach_policy(mblk_t *mp, ipha_t *ipha, ip6_t *ip6h,
4205bd670b35SErik Nordmark const conn_t *connp, ip_xmit_attr_t *ixa)
42067c478bd9Sstevel@tonic-gate {
42077c478bd9Sstevel@tonic-gate ipsec_selector_t sel;
42087c478bd9Sstevel@tonic-gate boolean_t policy_present;
4209bd670b35SErik Nordmark ip_stack_t *ipst = ixa->ixa_ipst;
4210f4b3ec61Sdh155122 netstack_t *ns = ipst->ips_netstack;
4211f4b3ec61Sdh155122 ipsec_stack_t *ipss = ns->netstack_ipsec;
4212bd670b35SErik Nordmark ipsec_policy_t *p;
42137c478bd9Sstevel@tonic-gate
4214bd670b35SErik Nordmark ixa->ixa_ipsec_policy_gen = ipss->ipsec_system_policy.iph_gen;
42157c478bd9Sstevel@tonic-gate ASSERT((ipha != NULL && ip6h == NULL) ||
42167c478bd9Sstevel@tonic-gate (ip6h != NULL && ipha == NULL));
42177c478bd9Sstevel@tonic-gate
42187c478bd9Sstevel@tonic-gate if (ipha != NULL)
4219f4b3ec61Sdh155122 policy_present = ipss->ipsec_outbound_v4_policy_present;
42207c478bd9Sstevel@tonic-gate else
4221f4b3ec61Sdh155122 policy_present = ipss->ipsec_outbound_v6_policy_present;
42227c478bd9Sstevel@tonic-gate
4223bd670b35SErik Nordmark if (!policy_present && (connp == NULL || connp->conn_policy == NULL))
4224bd670b35SErik Nordmark return (mp);
4225bd670b35SErik Nordmark
4226bd670b35SErik Nordmark bzero((void*)&sel, sizeof (sel));
42277c478bd9Sstevel@tonic-gate
42287c478bd9Sstevel@tonic-gate if (ipha != NULL) {
4229bd670b35SErik Nordmark sel.ips_local_addr_v4 = ipha->ipha_src;
42307c478bd9Sstevel@tonic-gate sel.ips_remote_addr_v4 = ip_get_dst(ipha);
42317c478bd9Sstevel@tonic-gate sel.ips_isv4 = B_TRUE;
42327c478bd9Sstevel@tonic-gate } else {
42337c478bd9Sstevel@tonic-gate sel.ips_isv4 = B_FALSE;
42347c478bd9Sstevel@tonic-gate sel.ips_local_addr_v6 = ip6h->ip6_src;
4235bd670b35SErik Nordmark sel.ips_remote_addr_v6 = ip_get_dst_v6(ip6h, mp, NULL);
42367c478bd9Sstevel@tonic-gate }
4237bd670b35SErik Nordmark sel.ips_protocol = ixa->ixa_protocol;
42387c478bd9Sstevel@tonic-gate
4239f4b3ec61Sdh155122 if (!ipsec_init_outbound_ports(&sel, mp, ipha, ip6h, 0, ipss)) {
42407c478bd9Sstevel@tonic-gate if (ipha != NULL) {
4241f4b3ec61Sdh155122 BUMP_MIB(&ipst->ips_ip_mib, ipIfStatsOutDiscards);
42427c478bd9Sstevel@tonic-gate } else {
4243f4b3ec61Sdh155122 BUMP_MIB(&ipst->ips_ip6_mib, ipIfStatsOutDiscards);
42447c478bd9Sstevel@tonic-gate }
4245bd670b35SErik Nordmark /* Note: mp already consumed and ip_drop_packet done */
42467c478bd9Sstevel@tonic-gate return (NULL);
42477c478bd9Sstevel@tonic-gate }
42487c478bd9Sstevel@tonic-gate
4249bd670b35SErik Nordmark ASSERT(ixa->ixa_ipsec_policy == NULL);
4250bd670b35SErik Nordmark p = ipsec_find_policy(IPSEC_TYPE_OUTBOUND, connp, &sel, ns);
4251bd670b35SErik Nordmark ixa->ixa_ipsec_policy = p;
4252bd670b35SErik Nordmark if (p != NULL) {
4253bd670b35SErik Nordmark ixa->ixa_flags |= IXAF_IPSEC_SECURE;
4254bd670b35SErik Nordmark if (connp == NULL || connp->conn_policy == NULL)
4255bd670b35SErik Nordmark ixa->ixa_flags |= IXAF_IPSEC_GLOBAL_POLICY;
4256bd670b35SErik Nordmark } else {
4257bd670b35SErik Nordmark ixa->ixa_flags &= ~IXAF_IPSEC_SECURE;
42587c478bd9Sstevel@tonic-gate }
42597c478bd9Sstevel@tonic-gate
42607c478bd9Sstevel@tonic-gate /*
42617c478bd9Sstevel@tonic-gate * Copy the right port information.
42627c478bd9Sstevel@tonic-gate */
4263bd670b35SErik Nordmark ixa->ixa_ipsec_src_port = sel.ips_local_port;
4264bd670b35SErik Nordmark ixa->ixa_ipsec_dst_port = sel.ips_remote_port;
4265bd670b35SErik Nordmark ixa->ixa_ipsec_icmp_type = sel.ips_icmp_type;
4266bd670b35SErik Nordmark ixa->ixa_ipsec_icmp_code = sel.ips_icmp_code;
4267bd670b35SErik Nordmark ixa->ixa_ipsec_proto = sel.ips_protocol;
4268bd670b35SErik Nordmark return (mp);
42697c478bd9Sstevel@tonic-gate }
42707c478bd9Sstevel@tonic-gate
42717c478bd9Sstevel@tonic-gate /*
42727c478bd9Sstevel@tonic-gate * When appropriate, this function caches inbound and outbound policy
4273bd670b35SErik Nordmark * for this connection. The outbound policy is stored in conn_ixa.
4274bd670b35SErik Nordmark * Note that it can not be used for SCTP since conn_faddr isn't set for SCTP.
42757c478bd9Sstevel@tonic-gate *
42767c478bd9Sstevel@tonic-gate * XXX need to work out more details about per-interface policy and
42777c478bd9Sstevel@tonic-gate * caching here!
42787c478bd9Sstevel@tonic-gate *
42797c478bd9Sstevel@tonic-gate * XXX may want to split inbound and outbound caching for ill..
42807c478bd9Sstevel@tonic-gate */
42817c478bd9Sstevel@tonic-gate int
ipsec_conn_cache_policy(conn_t * connp,boolean_t isv4)42827c478bd9Sstevel@tonic-gate ipsec_conn_cache_policy(conn_t *connp, boolean_t isv4)
42837c478bd9Sstevel@tonic-gate {
42847c478bd9Sstevel@tonic-gate boolean_t global_policy_present;
4285f4b3ec61Sdh155122 netstack_t *ns = connp->conn_netstack;
4286f4b3ec61Sdh155122 ipsec_stack_t *ipss = ns->netstack_ipsec;
42877c478bd9Sstevel@tonic-gate
4288bd670b35SErik Nordmark connp->conn_ixa->ixa_ipsec_policy_gen =
4289bd670b35SErik Nordmark ipss->ipsec_system_policy.iph_gen;
42907c478bd9Sstevel@tonic-gate /*
42917c478bd9Sstevel@tonic-gate * There is no policy latching for ICMP sockets because we can't
42927c478bd9Sstevel@tonic-gate * decide on which policy to use until we see the packet and get
42937c478bd9Sstevel@tonic-gate * type/code selectors.
42947c478bd9Sstevel@tonic-gate */
4295bd670b35SErik Nordmark if (connp->conn_proto == IPPROTO_ICMP ||
4296bd670b35SErik Nordmark connp->conn_proto == IPPROTO_ICMPV6) {
42977c478bd9Sstevel@tonic-gate connp->conn_in_enforce_policy =
42987c478bd9Sstevel@tonic-gate connp->conn_out_enforce_policy = B_TRUE;
42997c478bd9Sstevel@tonic-gate if (connp->conn_latch != NULL) {
4300bd670b35SErik Nordmark IPLATCH_REFRELE(connp->conn_latch);
43017c478bd9Sstevel@tonic-gate connp->conn_latch = NULL;
43027c478bd9Sstevel@tonic-gate }
4303bd670b35SErik Nordmark if (connp->conn_latch_in_policy != NULL) {
4304bd670b35SErik Nordmark IPPOL_REFRELE(connp->conn_latch_in_policy);
4305bd670b35SErik Nordmark connp->conn_latch_in_policy = NULL;
4306bd670b35SErik Nordmark }
4307bd670b35SErik Nordmark if (connp->conn_latch_in_action != NULL) {
4308bd670b35SErik Nordmark IPACT_REFRELE(connp->conn_latch_in_action);
4309bd670b35SErik Nordmark connp->conn_latch_in_action = NULL;
4310bd670b35SErik Nordmark }
4311bd670b35SErik Nordmark if (connp->conn_ixa->ixa_ipsec_policy != NULL) {
4312bd670b35SErik Nordmark IPPOL_REFRELE(connp->conn_ixa->ixa_ipsec_policy);
4313bd670b35SErik Nordmark connp->conn_ixa->ixa_ipsec_policy = NULL;
4314bd670b35SErik Nordmark }
4315bd670b35SErik Nordmark if (connp->conn_ixa->ixa_ipsec_action != NULL) {
4316bd670b35SErik Nordmark IPACT_REFRELE(connp->conn_ixa->ixa_ipsec_action);
4317bd670b35SErik Nordmark connp->conn_ixa->ixa_ipsec_action = NULL;
4318bd670b35SErik Nordmark }
4319bd670b35SErik Nordmark connp->conn_ixa->ixa_flags &= ~IXAF_IPSEC_SECURE;
43207c478bd9Sstevel@tonic-gate return (0);
43217c478bd9Sstevel@tonic-gate }
43227c478bd9Sstevel@tonic-gate
43237c478bd9Sstevel@tonic-gate global_policy_present = isv4 ?
4324f4b3ec61Sdh155122 (ipss->ipsec_outbound_v4_policy_present ||
4325f4b3ec61Sdh155122 ipss->ipsec_inbound_v4_policy_present) :
4326f4b3ec61Sdh155122 (ipss->ipsec_outbound_v6_policy_present ||
4327f4b3ec61Sdh155122 ipss->ipsec_inbound_v6_policy_present);
43287c478bd9Sstevel@tonic-gate
43297c478bd9Sstevel@tonic-gate if ((connp->conn_policy != NULL) || global_policy_present) {
43307c478bd9Sstevel@tonic-gate ipsec_selector_t sel;
43317c478bd9Sstevel@tonic-gate ipsec_policy_t *p;
43327c478bd9Sstevel@tonic-gate
43337c478bd9Sstevel@tonic-gate if (connp->conn_latch == NULL &&
43347c478bd9Sstevel@tonic-gate (connp->conn_latch = iplatch_create()) == NULL) {
43357c478bd9Sstevel@tonic-gate return (ENOMEM);
43367c478bd9Sstevel@tonic-gate }
43377c478bd9Sstevel@tonic-gate
4338bd670b35SErik Nordmark bzero((void*)&sel, sizeof (sel));
4339bd670b35SErik Nordmark
4340bd670b35SErik Nordmark sel.ips_protocol = connp->conn_proto;
43417c478bd9Sstevel@tonic-gate sel.ips_local_port = connp->conn_lport;
43427c478bd9Sstevel@tonic-gate sel.ips_remote_port = connp->conn_fport;
43437c478bd9Sstevel@tonic-gate sel.ips_is_icmp_inv_acq = 0;
43447c478bd9Sstevel@tonic-gate sel.ips_isv4 = isv4;
43457c478bd9Sstevel@tonic-gate if (isv4) {
4346bd670b35SErik Nordmark sel.ips_local_addr_v4 = connp->conn_laddr_v4;
4347bd670b35SErik Nordmark sel.ips_remote_addr_v4 = connp->conn_faddr_v4;
43487c478bd9Sstevel@tonic-gate } else {
4349bd670b35SErik Nordmark sel.ips_local_addr_v6 = connp->conn_laddr_v6;
4350bd670b35SErik Nordmark sel.ips_remote_addr_v6 = connp->conn_faddr_v6;
43517c478bd9Sstevel@tonic-gate }
43527c478bd9Sstevel@tonic-gate
4353bd670b35SErik Nordmark p = ipsec_find_policy(IPSEC_TYPE_INBOUND, connp, &sel, ns);
4354bd670b35SErik Nordmark if (connp->conn_latch_in_policy != NULL)
4355bd670b35SErik Nordmark IPPOL_REFRELE(connp->conn_latch_in_policy);
4356bd670b35SErik Nordmark connp->conn_latch_in_policy = p;
43577c478bd9Sstevel@tonic-gate connp->conn_in_enforce_policy = (p != NULL);
43587c478bd9Sstevel@tonic-gate
4359bd670b35SErik Nordmark p = ipsec_find_policy(IPSEC_TYPE_OUTBOUND, connp, &sel, ns);
4360bd670b35SErik Nordmark if (connp->conn_ixa->ixa_ipsec_policy != NULL)
4361bd670b35SErik Nordmark IPPOL_REFRELE(connp->conn_ixa->ixa_ipsec_policy);
4362bd670b35SErik Nordmark connp->conn_ixa->ixa_ipsec_policy = p;
43637c478bd9Sstevel@tonic-gate connp->conn_out_enforce_policy = (p != NULL);
4364bd670b35SErik Nordmark if (p != NULL) {
4365bd670b35SErik Nordmark connp->conn_ixa->ixa_flags |= IXAF_IPSEC_SECURE;
4366bd670b35SErik Nordmark if (connp->conn_policy == NULL) {
4367bd670b35SErik Nordmark connp->conn_ixa->ixa_flags |=
4368bd670b35SErik Nordmark IXAF_IPSEC_GLOBAL_POLICY;
4369bd670b35SErik Nordmark }
4370bd670b35SErik Nordmark } else {
4371bd670b35SErik Nordmark connp->conn_ixa->ixa_flags &= ~IXAF_IPSEC_SECURE;
4372bd670b35SErik Nordmark }
43737c478bd9Sstevel@tonic-gate /* Clear the latched actions too, in case we're recaching. */
4374bd670b35SErik Nordmark if (connp->conn_ixa->ixa_ipsec_action != NULL) {
4375bd670b35SErik Nordmark IPACT_REFRELE(connp->conn_ixa->ixa_ipsec_action);
4376bd670b35SErik Nordmark connp->conn_ixa->ixa_ipsec_action = NULL;
4377bd670b35SErik Nordmark }
4378bd670b35SErik Nordmark if (connp->conn_latch_in_action != NULL) {
4379bd670b35SErik Nordmark IPACT_REFRELE(connp->conn_latch_in_action);
4380bd670b35SErik Nordmark connp->conn_latch_in_action = NULL;
4381bd670b35SErik Nordmark }
4382bd670b35SErik Nordmark connp->conn_ixa->ixa_ipsec_src_port = sel.ips_local_port;
4383bd670b35SErik Nordmark connp->conn_ixa->ixa_ipsec_dst_port = sel.ips_remote_port;
4384bd670b35SErik Nordmark connp->conn_ixa->ixa_ipsec_icmp_type = sel.ips_icmp_type;
4385bd670b35SErik Nordmark connp->conn_ixa->ixa_ipsec_icmp_code = sel.ips_icmp_code;
4386bd670b35SErik Nordmark connp->conn_ixa->ixa_ipsec_proto = sel.ips_protocol;
4387bd670b35SErik Nordmark } else {
4388bd670b35SErik Nordmark connp->conn_ixa->ixa_flags &= ~IXAF_IPSEC_SECURE;
43897c478bd9Sstevel@tonic-gate }
43907c478bd9Sstevel@tonic-gate
43917c478bd9Sstevel@tonic-gate /*
43927c478bd9Sstevel@tonic-gate * We may or may not have policy for this endpoint. We still set
43937c478bd9Sstevel@tonic-gate * conn_policy_cached so that inbound datagrams don't have to look
43947c478bd9Sstevel@tonic-gate * at global policy as policy is considered latched for these
43957c478bd9Sstevel@tonic-gate * endpoints. We should not set conn_policy_cached until the conn
43967c478bd9Sstevel@tonic-gate * reflects the actual policy. If we *set* this before inheriting
43977c478bd9Sstevel@tonic-gate * the policy there is a window where the check
43987c478bd9Sstevel@tonic-gate * CONN_INBOUND_POLICY_PRESENT, will neither check with the policy
43997c478bd9Sstevel@tonic-gate * on the conn (because we have not yet copied the policy on to
44007c478bd9Sstevel@tonic-gate * conn and hence not set conn_in_enforce_policy) nor with the
44017c478bd9Sstevel@tonic-gate * global policy (because conn_policy_cached is already set).
44027c478bd9Sstevel@tonic-gate */
44037c478bd9Sstevel@tonic-gate connp->conn_policy_cached = B_TRUE;
44047c478bd9Sstevel@tonic-gate return (0);
44057c478bd9Sstevel@tonic-gate }
44067c478bd9Sstevel@tonic-gate
4407bd670b35SErik Nordmark /*
4408bd670b35SErik Nordmark * When appropriate, this function caches outbound policy for faddr/fport.
4409bd670b35SErik Nordmark * It is used when we are not connected i.e., when we can not latch the
4410bd670b35SErik Nordmark * policy.
4411bd670b35SErik Nordmark */
44127c478bd9Sstevel@tonic-gate void
ipsec_cache_outbound_policy(const conn_t * connp,const in6_addr_t * v6src,const in6_addr_t * v6dst,in_port_t dstport,ip_xmit_attr_t * ixa)4413bd670b35SErik Nordmark ipsec_cache_outbound_policy(const conn_t *connp, const in6_addr_t *v6src,
4414bd670b35SErik Nordmark const in6_addr_t *v6dst, in_port_t dstport, ip_xmit_attr_t *ixa)
44157c478bd9Sstevel@tonic-gate {
4416bd670b35SErik Nordmark boolean_t isv4 = (ixa->ixa_flags & IXAF_IS_IPV4) != 0;
4417bd670b35SErik Nordmark boolean_t global_policy_present;
4418bd670b35SErik Nordmark netstack_t *ns = connp->conn_netstack;
4419bd670b35SErik Nordmark ipsec_stack_t *ipss = ns->netstack_ipsec;
4420bd670b35SErik Nordmark
4421bd670b35SErik Nordmark ixa->ixa_ipsec_policy_gen = ipss->ipsec_system_policy.iph_gen;
4422bd670b35SErik Nordmark
4423bd670b35SErik Nordmark /*
4424bd670b35SErik Nordmark * There is no policy caching for ICMP sockets because we can't
4425bd670b35SErik Nordmark * decide on which policy to use until we see the packet and get
4426bd670b35SErik Nordmark * type/code selectors.
4427bd670b35SErik Nordmark */
4428bd670b35SErik Nordmark if (connp->conn_proto == IPPROTO_ICMP ||
4429bd670b35SErik Nordmark connp->conn_proto == IPPROTO_ICMPV6) {
4430bd670b35SErik Nordmark ixa->ixa_flags &= ~IXAF_IPSEC_SECURE;
4431bd670b35SErik Nordmark if (ixa->ixa_ipsec_policy != NULL) {
4432bd670b35SErik Nordmark IPPOL_REFRELE(ixa->ixa_ipsec_policy);
4433bd670b35SErik Nordmark ixa->ixa_ipsec_policy = NULL;
4434bd670b35SErik Nordmark }
4435bd670b35SErik Nordmark if (ixa->ixa_ipsec_action != NULL) {
4436bd670b35SErik Nordmark IPACT_REFRELE(ixa->ixa_ipsec_action);
4437bd670b35SErik Nordmark ixa->ixa_ipsec_action = NULL;
4438bd670b35SErik Nordmark }
4439bd670b35SErik Nordmark return;
4440bd670b35SErik Nordmark }
4441bd670b35SErik Nordmark
4442bd670b35SErik Nordmark global_policy_present = isv4 ?
4443bd670b35SErik Nordmark (ipss->ipsec_outbound_v4_policy_present ||
4444bd670b35SErik Nordmark ipss->ipsec_inbound_v4_policy_present) :
4445bd670b35SErik Nordmark (ipss->ipsec_outbound_v6_policy_present ||
4446bd670b35SErik Nordmark ipss->ipsec_inbound_v6_policy_present);
4447bd670b35SErik Nordmark
4448bd670b35SErik Nordmark if ((connp->conn_policy != NULL) || global_policy_present) {
4449bd670b35SErik Nordmark ipsec_selector_t sel;
4450bd670b35SErik Nordmark ipsec_policy_t *p;
4451bd670b35SErik Nordmark
4452bd670b35SErik Nordmark bzero((void*)&sel, sizeof (sel));
4453bd670b35SErik Nordmark
4454bd670b35SErik Nordmark sel.ips_protocol = connp->conn_proto;
4455bd670b35SErik Nordmark sel.ips_local_port = connp->conn_lport;
4456bd670b35SErik Nordmark sel.ips_remote_port = dstport;
4457bd670b35SErik Nordmark sel.ips_is_icmp_inv_acq = 0;
4458bd670b35SErik Nordmark sel.ips_isv4 = isv4;
4459bd670b35SErik Nordmark if (isv4) {
4460bd670b35SErik Nordmark IN6_V4MAPPED_TO_IPADDR(v6src, sel.ips_local_addr_v4);
4461bd670b35SErik Nordmark IN6_V4MAPPED_TO_IPADDR(v6dst, sel.ips_remote_addr_v4);
4462bd670b35SErik Nordmark } else {
4463bd670b35SErik Nordmark sel.ips_local_addr_v6 = *v6src;
4464bd670b35SErik Nordmark sel.ips_remote_addr_v6 = *v6dst;
4465bd670b35SErik Nordmark }
4466bd670b35SErik Nordmark
4467bd670b35SErik Nordmark p = ipsec_find_policy(IPSEC_TYPE_OUTBOUND, connp, &sel, ns);
4468bd670b35SErik Nordmark if (ixa->ixa_ipsec_policy != NULL)
4469bd670b35SErik Nordmark IPPOL_REFRELE(ixa->ixa_ipsec_policy);
4470bd670b35SErik Nordmark ixa->ixa_ipsec_policy = p;
4471bd670b35SErik Nordmark if (p != NULL) {
4472bd670b35SErik Nordmark ixa->ixa_flags |= IXAF_IPSEC_SECURE;
4473bd670b35SErik Nordmark if (connp->conn_policy == NULL)
4474bd670b35SErik Nordmark ixa->ixa_flags |= IXAF_IPSEC_GLOBAL_POLICY;
4475bd670b35SErik Nordmark } else {
4476bd670b35SErik Nordmark ixa->ixa_flags &= ~IXAF_IPSEC_SECURE;
4477bd670b35SErik Nordmark }
4478bd670b35SErik Nordmark /* Clear the latched actions too, in case we're recaching. */
4479bd670b35SErik Nordmark if (ixa->ixa_ipsec_action != NULL) {
4480bd670b35SErik Nordmark IPACT_REFRELE(ixa->ixa_ipsec_action);
4481bd670b35SErik Nordmark ixa->ixa_ipsec_action = NULL;
4482bd670b35SErik Nordmark }
4483bd670b35SErik Nordmark
4484bd670b35SErik Nordmark ixa->ixa_ipsec_src_port = sel.ips_local_port;
4485bd670b35SErik Nordmark ixa->ixa_ipsec_dst_port = sel.ips_remote_port;
4486bd670b35SErik Nordmark ixa->ixa_ipsec_icmp_type = sel.ips_icmp_type;
4487bd670b35SErik Nordmark ixa->ixa_ipsec_icmp_code = sel.ips_icmp_code;
4488bd670b35SErik Nordmark ixa->ixa_ipsec_proto = sel.ips_protocol;
4489bd670b35SErik Nordmark } else {
4490bd670b35SErik Nordmark ixa->ixa_flags &= ~IXAF_IPSEC_SECURE;
4491bd670b35SErik Nordmark if (ixa->ixa_ipsec_policy != NULL) {
4492bd670b35SErik Nordmark IPPOL_REFRELE(ixa->ixa_ipsec_policy);
4493bd670b35SErik Nordmark ixa->ixa_ipsec_policy = NULL;
4494bd670b35SErik Nordmark }
4495bd670b35SErik Nordmark if (ixa->ixa_ipsec_action != NULL) {
4496bd670b35SErik Nordmark IPACT_REFRELE(ixa->ixa_ipsec_action);
4497bd670b35SErik Nordmark ixa->ixa_ipsec_action = NULL;
4498bd670b35SErik Nordmark }
4499bd670b35SErik Nordmark }
4500bd670b35SErik Nordmark }
4501bd670b35SErik Nordmark
4502bd670b35SErik Nordmark /*
4503bd670b35SErik Nordmark * Returns B_FALSE if the policy has gone stale.
4504bd670b35SErik Nordmark */
4505bd670b35SErik Nordmark boolean_t
ipsec_outbound_policy_current(ip_xmit_attr_t * ixa)4506bd670b35SErik Nordmark ipsec_outbound_policy_current(ip_xmit_attr_t *ixa)
4507bd670b35SErik Nordmark {
4508bd670b35SErik Nordmark ipsec_stack_t *ipss = ixa->ixa_ipst->ips_netstack->netstack_ipsec;
4509bd670b35SErik Nordmark
4510bd670b35SErik Nordmark if (!(ixa->ixa_flags & IXAF_IPSEC_GLOBAL_POLICY))
4511bd670b35SErik Nordmark return (B_TRUE);
4512bd670b35SErik Nordmark
4513bd670b35SErik Nordmark return (ixa->ixa_ipsec_policy_gen == ipss->ipsec_system_policy.iph_gen);
4514bd670b35SErik Nordmark }
4515bd670b35SErik Nordmark
4516bd670b35SErik Nordmark void
iplatch_free(ipsec_latch_t * ipl)4517bd670b35SErik Nordmark iplatch_free(ipsec_latch_t *ipl)
4518bd670b35SErik Nordmark {
45197c478bd9Sstevel@tonic-gate if (ipl->ipl_local_cid != NULL)
45207c478bd9Sstevel@tonic-gate IPSID_REFRELE(ipl->ipl_local_cid);
45217c478bd9Sstevel@tonic-gate if (ipl->ipl_remote_cid != NULL)
45227c478bd9Sstevel@tonic-gate IPSID_REFRELE(ipl->ipl_remote_cid);
45237c478bd9Sstevel@tonic-gate mutex_destroy(&ipl->ipl_lock);
45247c478bd9Sstevel@tonic-gate kmem_free(ipl, sizeof (*ipl));
45257c478bd9Sstevel@tonic-gate }
45267c478bd9Sstevel@tonic-gate
45277c478bd9Sstevel@tonic-gate ipsec_latch_t *
iplatch_create()45287c478bd9Sstevel@tonic-gate iplatch_create()
45297c478bd9Sstevel@tonic-gate {
4530a0f9c00cSJosef 'Jeff' Sipek ipsec_latch_t *ipl = kmem_zalloc(sizeof (*ipl), KM_NOSLEEP);
45317c478bd9Sstevel@tonic-gate if (ipl == NULL)
45327c478bd9Sstevel@tonic-gate return (ipl);
45337c478bd9Sstevel@tonic-gate mutex_init(&ipl->ipl_lock, NULL, MUTEX_DEFAULT, NULL);
45347c478bd9Sstevel@tonic-gate ipl->ipl_refcnt = 1;
45357c478bd9Sstevel@tonic-gate return (ipl);
45367c478bd9Sstevel@tonic-gate }
45377c478bd9Sstevel@tonic-gate
45387c478bd9Sstevel@tonic-gate /*
45397c478bd9Sstevel@tonic-gate * Hash function for ID hash table.
45407c478bd9Sstevel@tonic-gate */
45417c478bd9Sstevel@tonic-gate static uint32_t
ipsid_hash(int idtype,char * idstring)45427c478bd9Sstevel@tonic-gate ipsid_hash(int idtype, char *idstring)
45437c478bd9Sstevel@tonic-gate {
45447c478bd9Sstevel@tonic-gate uint32_t hval = idtype;
45457c478bd9Sstevel@tonic-gate unsigned char c;
45467c478bd9Sstevel@tonic-gate
45477c478bd9Sstevel@tonic-gate while ((c = *idstring++) != 0) {
45487c478bd9Sstevel@tonic-gate hval = (hval << 4) | (hval >> 28);
45497c478bd9Sstevel@tonic-gate hval ^= c;
45507c478bd9Sstevel@tonic-gate }
45517c478bd9Sstevel@tonic-gate hval = hval ^ (hval >> 16);
45527c478bd9Sstevel@tonic-gate return (hval & (IPSID_HASHSIZE-1));
45537c478bd9Sstevel@tonic-gate }
45547c478bd9Sstevel@tonic-gate
45557c478bd9Sstevel@tonic-gate /*
45567c478bd9Sstevel@tonic-gate * Look up identity string in hash table. Return identity object
45577c478bd9Sstevel@tonic-gate * corresponding to the name -- either preexisting, or newly allocated.
45587c478bd9Sstevel@tonic-gate *
45597c478bd9Sstevel@tonic-gate * Return NULL if we need to allocate a new one and can't get memory.
45607c478bd9Sstevel@tonic-gate */
45617c478bd9Sstevel@tonic-gate ipsid_t *
ipsid_lookup(int idtype,char * idstring,netstack_t * ns)4562f4b3ec61Sdh155122 ipsid_lookup(int idtype, char *idstring, netstack_t *ns)
45637c478bd9Sstevel@tonic-gate {
45647c478bd9Sstevel@tonic-gate ipsid_t *retval;
45657c478bd9Sstevel@tonic-gate char *nstr;
45667c478bd9Sstevel@tonic-gate int idlen = strlen(idstring) + 1;
4567f4b3ec61Sdh155122 ipsec_stack_t *ipss = ns->netstack_ipsec;
4568f4b3ec61Sdh155122 ipsif_t *bucket;
45697c478bd9Sstevel@tonic-gate
4570f4b3ec61Sdh155122 bucket = &ipss->ipsec_ipsid_buckets[ipsid_hash(idtype, idstring)];
45717c478bd9Sstevel@tonic-gate
45727c478bd9Sstevel@tonic-gate mutex_enter(&bucket->ipsif_lock);
45737c478bd9Sstevel@tonic-gate
45747c478bd9Sstevel@tonic-gate for (retval = bucket->ipsif_head; retval != NULL;
45757c478bd9Sstevel@tonic-gate retval = retval->ipsid_next) {
45767c478bd9Sstevel@tonic-gate if (idtype != retval->ipsid_type)
45777c478bd9Sstevel@tonic-gate continue;
45787c478bd9Sstevel@tonic-gate if (bcmp(idstring, retval->ipsid_cid, idlen) != 0)
45797c478bd9Sstevel@tonic-gate continue;
45807c478bd9Sstevel@tonic-gate
45817c478bd9Sstevel@tonic-gate IPSID_REFHOLD(retval);
45827c478bd9Sstevel@tonic-gate mutex_exit(&bucket->ipsif_lock);
45837c478bd9Sstevel@tonic-gate return (retval);
45847c478bd9Sstevel@tonic-gate }
45857c478bd9Sstevel@tonic-gate
45867c478bd9Sstevel@tonic-gate retval = kmem_alloc(sizeof (*retval), KM_NOSLEEP);
45877c478bd9Sstevel@tonic-gate if (!retval) {
45887c478bd9Sstevel@tonic-gate mutex_exit(&bucket->ipsif_lock);
45897c478bd9Sstevel@tonic-gate return (NULL);
45907c478bd9Sstevel@tonic-gate }
45917c478bd9Sstevel@tonic-gate
45927c478bd9Sstevel@tonic-gate nstr = kmem_alloc(idlen, KM_NOSLEEP);
45937c478bd9Sstevel@tonic-gate if (!nstr) {
45947c478bd9Sstevel@tonic-gate mutex_exit(&bucket->ipsif_lock);
45957c478bd9Sstevel@tonic-gate kmem_free(retval, sizeof (*retval));
45967c478bd9Sstevel@tonic-gate return (NULL);
45977c478bd9Sstevel@tonic-gate }
45987c478bd9Sstevel@tonic-gate
45997c478bd9Sstevel@tonic-gate retval->ipsid_refcnt = 1;
46007c478bd9Sstevel@tonic-gate retval->ipsid_next = bucket->ipsif_head;
46017c478bd9Sstevel@tonic-gate if (retval->ipsid_next != NULL)
46027c478bd9Sstevel@tonic-gate retval->ipsid_next->ipsid_ptpn = &retval->ipsid_next;
46037c478bd9Sstevel@tonic-gate retval->ipsid_ptpn = &bucket->ipsif_head;
46047c478bd9Sstevel@tonic-gate retval->ipsid_type = idtype;
46057c478bd9Sstevel@tonic-gate retval->ipsid_cid = nstr;
46067c478bd9Sstevel@tonic-gate bucket->ipsif_head = retval;
46077c478bd9Sstevel@tonic-gate bcopy(idstring, nstr, idlen);
46087c478bd9Sstevel@tonic-gate mutex_exit(&bucket->ipsif_lock);
46097c478bd9Sstevel@tonic-gate
46107c478bd9Sstevel@tonic-gate return (retval);
46117c478bd9Sstevel@tonic-gate }
46127c478bd9Sstevel@tonic-gate
46137c478bd9Sstevel@tonic-gate /*
46147c478bd9Sstevel@tonic-gate * Garbage collect the identity hash table.
46157c478bd9Sstevel@tonic-gate */
46167c478bd9Sstevel@tonic-gate void
ipsid_gc(netstack_t * ns)4617f4b3ec61Sdh155122 ipsid_gc(netstack_t *ns)
46187c478bd9Sstevel@tonic-gate {
46197c478bd9Sstevel@tonic-gate int i, len;
46207c478bd9Sstevel@tonic-gate ipsid_t *id, *nid;
46217c478bd9Sstevel@tonic-gate ipsif_t *bucket;
4622f4b3ec61Sdh155122 ipsec_stack_t *ipss = ns->netstack_ipsec;
46237c478bd9Sstevel@tonic-gate
46247c478bd9Sstevel@tonic-gate for (i = 0; i < IPSID_HASHSIZE; i++) {
4625f4b3ec61Sdh155122 bucket = &ipss->ipsec_ipsid_buckets[i];
46267c478bd9Sstevel@tonic-gate mutex_enter(&bucket->ipsif_lock);
46277c478bd9Sstevel@tonic-gate for (id = bucket->ipsif_head; id != NULL; id = nid) {
46287c478bd9Sstevel@tonic-gate nid = id->ipsid_next;
46297c478bd9Sstevel@tonic-gate if (id->ipsid_refcnt == 0) {
46307c478bd9Sstevel@tonic-gate *id->ipsid_ptpn = nid;
46317c478bd9Sstevel@tonic-gate if (nid != NULL)
46327c478bd9Sstevel@tonic-gate nid->ipsid_ptpn = id->ipsid_ptpn;
46337c478bd9Sstevel@tonic-gate len = strlen(id->ipsid_cid) + 1;
46347c478bd9Sstevel@tonic-gate kmem_free(id->ipsid_cid, len);
46357c478bd9Sstevel@tonic-gate kmem_free(id, sizeof (*id));
46367c478bd9Sstevel@tonic-gate }
46377c478bd9Sstevel@tonic-gate }
46387c478bd9Sstevel@tonic-gate mutex_exit(&bucket->ipsif_lock);
46397c478bd9Sstevel@tonic-gate }
46407c478bd9Sstevel@tonic-gate }
46417c478bd9Sstevel@tonic-gate
46427c478bd9Sstevel@tonic-gate /*
46437c478bd9Sstevel@tonic-gate * Return true if two identities are the same.
46447c478bd9Sstevel@tonic-gate */
46457c478bd9Sstevel@tonic-gate boolean_t
ipsid_equal(ipsid_t * id1,ipsid_t * id2)46467c478bd9Sstevel@tonic-gate ipsid_equal(ipsid_t *id1, ipsid_t *id2)
46477c478bd9Sstevel@tonic-gate {
46487c478bd9Sstevel@tonic-gate if (id1 == id2)
46497c478bd9Sstevel@tonic-gate return (B_TRUE);
46507c478bd9Sstevel@tonic-gate #ifdef DEBUG
46517c478bd9Sstevel@tonic-gate if ((id1 == NULL) || (id2 == NULL))
46527c478bd9Sstevel@tonic-gate return (B_FALSE);
46537c478bd9Sstevel@tonic-gate /*
46547c478bd9Sstevel@tonic-gate * test that we're interning id's correctly..
46557c478bd9Sstevel@tonic-gate */
46567c478bd9Sstevel@tonic-gate ASSERT((strcmp(id1->ipsid_cid, id2->ipsid_cid) != 0) ||
46577c478bd9Sstevel@tonic-gate (id1->ipsid_type != id2->ipsid_type));
46587c478bd9Sstevel@tonic-gate #endif
46597c478bd9Sstevel@tonic-gate return (B_FALSE);
46607c478bd9Sstevel@tonic-gate }
46617c478bd9Sstevel@tonic-gate
46627c478bd9Sstevel@tonic-gate /*
46637c478bd9Sstevel@tonic-gate * Initialize identity table; called during module initialization.
46647c478bd9Sstevel@tonic-gate */
46657c478bd9Sstevel@tonic-gate static void
ipsid_init(netstack_t * ns)4666f4b3ec61Sdh155122 ipsid_init(netstack_t *ns)
46677c478bd9Sstevel@tonic-gate {
46687c478bd9Sstevel@tonic-gate ipsif_t *bucket;
46697c478bd9Sstevel@tonic-gate int i;
4670f4b3ec61Sdh155122 ipsec_stack_t *ipss = ns->netstack_ipsec;
46717c478bd9Sstevel@tonic-gate
46727c478bd9Sstevel@tonic-gate for (i = 0; i < IPSID_HASHSIZE; i++) {
4673f4b3ec61Sdh155122 bucket = &ipss->ipsec_ipsid_buckets[i];
46747c478bd9Sstevel@tonic-gate mutex_init(&bucket->ipsif_lock, NULL, MUTEX_DEFAULT, NULL);
46757c478bd9Sstevel@tonic-gate }
46767c478bd9Sstevel@tonic-gate }
46777c478bd9Sstevel@tonic-gate
46787c478bd9Sstevel@tonic-gate /*
46797c478bd9Sstevel@tonic-gate * Free identity table (preparatory to module unload)
46807c478bd9Sstevel@tonic-gate */
46817c478bd9Sstevel@tonic-gate static void
ipsid_fini(netstack_t * ns)4682f4b3ec61Sdh155122 ipsid_fini(netstack_t *ns)
46837c478bd9Sstevel@tonic-gate {
46847c478bd9Sstevel@tonic-gate ipsif_t *bucket;
46857c478bd9Sstevel@tonic-gate int i;
4686f4b3ec61Sdh155122 ipsec_stack_t *ipss = ns->netstack_ipsec;
46877c478bd9Sstevel@tonic-gate
46887c478bd9Sstevel@tonic-gate for (i = 0; i < IPSID_HASHSIZE; i++) {
4689f4b3ec61Sdh155122 bucket = &ipss->ipsec_ipsid_buckets[i];
4690f4b3ec61Sdh155122 ASSERT(bucket->ipsif_head == NULL);
46917c478bd9Sstevel@tonic-gate mutex_destroy(&bucket->ipsif_lock);
46927c478bd9Sstevel@tonic-gate }
46937c478bd9Sstevel@tonic-gate }
46947c478bd9Sstevel@tonic-gate
46957c478bd9Sstevel@tonic-gate /*
4696b7daf799SDan McDonald * Update the minimum and maximum supported key sizes for the specified
4697b7daf799SDan McDonald * algorithm, which is either a member of a netstack alg array or about to be,
4698b7daf799SDan McDonald * and therefore must be called holding ipsec_alg_lock for write.
46997c478bd9Sstevel@tonic-gate */
47007c478bd9Sstevel@tonic-gate void
ipsec_alg_fix_min_max(ipsec_alginfo_t * alg,ipsec_algtype_t alg_type,netstack_t * ns)4701f4b3ec61Sdh155122 ipsec_alg_fix_min_max(ipsec_alginfo_t *alg, ipsec_algtype_t alg_type,
4702f4b3ec61Sdh155122 netstack_t *ns)
47037c478bd9Sstevel@tonic-gate {
47047c478bd9Sstevel@tonic-gate size_t crypto_min = (size_t)-1, crypto_max = 0;
47057c478bd9Sstevel@tonic-gate size_t cur_crypto_min, cur_crypto_max;
47067c478bd9Sstevel@tonic-gate boolean_t is_valid;
47077c478bd9Sstevel@tonic-gate crypto_mechanism_info_t *mech_infos;
47087c478bd9Sstevel@tonic-gate uint_t nmech_infos;
47097c478bd9Sstevel@tonic-gate int crypto_rc, i;
47107c478bd9Sstevel@tonic-gate crypto_mech_usage_t mask;
4711f4b3ec61Sdh155122 ipsec_stack_t *ipss = ns->netstack_ipsec;
47127c478bd9Sstevel@tonic-gate
471369e71331SBayard Bell ASSERT(RW_WRITE_HELD(&ipss->ipsec_alg_lock));
47147c478bd9Sstevel@tonic-gate
47157c478bd9Sstevel@tonic-gate /*
47167c478bd9Sstevel@tonic-gate * Compute the min, max, and default key sizes (in number of
47177c478bd9Sstevel@tonic-gate * increments to the default key size in bits) as defined
47187c478bd9Sstevel@tonic-gate * by the algorithm mappings. This range of key sizes is used
47197c478bd9Sstevel@tonic-gate * for policy related operations. The effective key sizes
47207c478bd9Sstevel@tonic-gate * supported by the framework could be more limited than
47217c478bd9Sstevel@tonic-gate * those defined for an algorithm.
47227c478bd9Sstevel@tonic-gate */
47237c478bd9Sstevel@tonic-gate alg->alg_default_bits = alg->alg_key_sizes[0];
4724628b0c67SMark Fenwick alg->alg_default = 0;
47257c478bd9Sstevel@tonic-gate if (alg->alg_increment != 0) {
47267c478bd9Sstevel@tonic-gate /* key sizes are defined by range & increment */
47277c478bd9Sstevel@tonic-gate alg->alg_minbits = alg->alg_key_sizes[1];
47287c478bd9Sstevel@tonic-gate alg->alg_maxbits = alg->alg_key_sizes[2];
47297c478bd9Sstevel@tonic-gate } else if (alg->alg_nkey_sizes == 0) {
47307c478bd9Sstevel@tonic-gate /* no specified key size for algorithm */
47317c478bd9Sstevel@tonic-gate alg->alg_minbits = alg->alg_maxbits = 0;
47327c478bd9Sstevel@tonic-gate } else {
47337c478bd9Sstevel@tonic-gate /* key sizes are defined by enumeration */
47347c478bd9Sstevel@tonic-gate alg->alg_minbits = (uint16_t)-1;
47357c478bd9Sstevel@tonic-gate alg->alg_maxbits = 0;
47367c478bd9Sstevel@tonic-gate
47377c478bd9Sstevel@tonic-gate for (i = 0; i < alg->alg_nkey_sizes; i++) {
47387c478bd9Sstevel@tonic-gate if (alg->alg_key_sizes[i] < alg->alg_minbits)
47397c478bd9Sstevel@tonic-gate alg->alg_minbits = alg->alg_key_sizes[i];
47407c478bd9Sstevel@tonic-gate if (alg->alg_key_sizes[i] > alg->alg_maxbits)
47417c478bd9Sstevel@tonic-gate alg->alg_maxbits = alg->alg_key_sizes[i];
47427c478bd9Sstevel@tonic-gate }
47437c478bd9Sstevel@tonic-gate }
47447c478bd9Sstevel@tonic-gate
47457c478bd9Sstevel@tonic-gate if (!(alg->alg_flags & ALG_FLAG_VALID))
47467c478bd9Sstevel@tonic-gate return;
47477c478bd9Sstevel@tonic-gate
47487c478bd9Sstevel@tonic-gate /*
47497c478bd9Sstevel@tonic-gate * Mechanisms do not apply to the NULL encryption
47507c478bd9Sstevel@tonic-gate * algorithm, so simply return for this case.
47517c478bd9Sstevel@tonic-gate */
47527c478bd9Sstevel@tonic-gate if (alg->alg_id == SADB_EALG_NULL)
47537c478bd9Sstevel@tonic-gate return;
47547c478bd9Sstevel@tonic-gate
47557c478bd9Sstevel@tonic-gate /*
47567c478bd9Sstevel@tonic-gate * Find the min and max key sizes supported by the cryptographic
47577c478bd9Sstevel@tonic-gate * framework providers.
47587c478bd9Sstevel@tonic-gate */
47597c478bd9Sstevel@tonic-gate
47607c478bd9Sstevel@tonic-gate /* get the key sizes supported by the framework */
47617c478bd9Sstevel@tonic-gate crypto_rc = crypto_get_all_mech_info(alg->alg_mech_type,
47627c478bd9Sstevel@tonic-gate &mech_infos, &nmech_infos, KM_SLEEP);
47637c478bd9Sstevel@tonic-gate if (crypto_rc != CRYPTO_SUCCESS || nmech_infos == 0) {
47647c478bd9Sstevel@tonic-gate alg->alg_flags &= ~ALG_FLAG_VALID;
47657c478bd9Sstevel@tonic-gate return;
47667c478bd9Sstevel@tonic-gate }
47677c478bd9Sstevel@tonic-gate
47687c478bd9Sstevel@tonic-gate /* min and max key sizes supported by framework */
47697c478bd9Sstevel@tonic-gate for (i = 0, is_valid = B_FALSE; i < nmech_infos; i++) {
47707c478bd9Sstevel@tonic-gate int unit_bits;
47717c478bd9Sstevel@tonic-gate
47727c478bd9Sstevel@tonic-gate /*
47737c478bd9Sstevel@tonic-gate * Ignore entries that do not support the operations
47747c478bd9Sstevel@tonic-gate * needed for the algorithm type.
47757c478bd9Sstevel@tonic-gate */
4776daa41a61Sdanmcd if (alg_type == IPSEC_ALG_AUTH) {
47777c478bd9Sstevel@tonic-gate mask = CRYPTO_MECH_USAGE_MAC;
4778daa41a61Sdanmcd } else {
47797c478bd9Sstevel@tonic-gate mask = CRYPTO_MECH_USAGE_ENCRYPT |
47807c478bd9Sstevel@tonic-gate CRYPTO_MECH_USAGE_DECRYPT;
4781daa41a61Sdanmcd }
47827c478bd9Sstevel@tonic-gate if ((mech_infos[i].mi_usage & mask) != mask)
47837c478bd9Sstevel@tonic-gate continue;
47847c478bd9Sstevel@tonic-gate
47857c478bd9Sstevel@tonic-gate unit_bits = (mech_infos[i].mi_keysize_unit ==
47867c478bd9Sstevel@tonic-gate CRYPTO_KEYSIZE_UNIT_IN_BYTES) ? 8 : 1;
47877c478bd9Sstevel@tonic-gate /* adjust min/max supported by framework */
47887c478bd9Sstevel@tonic-gate cur_crypto_min = mech_infos[i].mi_min_key_size * unit_bits;
47897c478bd9Sstevel@tonic-gate cur_crypto_max = mech_infos[i].mi_max_key_size * unit_bits;
47907c478bd9Sstevel@tonic-gate
47917c478bd9Sstevel@tonic-gate if (cur_crypto_min < crypto_min)
47927c478bd9Sstevel@tonic-gate crypto_min = cur_crypto_min;
47937c478bd9Sstevel@tonic-gate
47947c478bd9Sstevel@tonic-gate /*
47957c478bd9Sstevel@tonic-gate * CRYPTO_EFFECTIVELY_INFINITE is a special value of
47967c478bd9Sstevel@tonic-gate * the crypto framework which means "no upper limit".
47977c478bd9Sstevel@tonic-gate */
47987c478bd9Sstevel@tonic-gate if (mech_infos[i].mi_max_key_size ==
4799daa41a61Sdanmcd CRYPTO_EFFECTIVELY_INFINITE) {
48007c478bd9Sstevel@tonic-gate crypto_max = (size_t)-1;
4801daa41a61Sdanmcd } else if (cur_crypto_max > crypto_max) {
48027c478bd9Sstevel@tonic-gate crypto_max = cur_crypto_max;
4803daa41a61Sdanmcd }
48047c478bd9Sstevel@tonic-gate
48057c478bd9Sstevel@tonic-gate is_valid = B_TRUE;
48067c478bd9Sstevel@tonic-gate }
48077c478bd9Sstevel@tonic-gate
48087c478bd9Sstevel@tonic-gate kmem_free(mech_infos, sizeof (crypto_mechanism_info_t) *
48097c478bd9Sstevel@tonic-gate nmech_infos);
48107c478bd9Sstevel@tonic-gate
48117c478bd9Sstevel@tonic-gate if (!is_valid) {
48127c478bd9Sstevel@tonic-gate /* no key sizes supported by framework */
48137c478bd9Sstevel@tonic-gate alg->alg_flags &= ~ALG_FLAG_VALID;
48147c478bd9Sstevel@tonic-gate return;
48157c478bd9Sstevel@tonic-gate }
48167c478bd9Sstevel@tonic-gate
48177c478bd9Sstevel@tonic-gate /*
48187c478bd9Sstevel@tonic-gate * Determine min and max key sizes from alg_key_sizes[].
48197c478bd9Sstevel@tonic-gate * defined for the algorithm entry. Adjust key sizes based on
48207c478bd9Sstevel@tonic-gate * those supported by the framework.
48217c478bd9Sstevel@tonic-gate */
48227c478bd9Sstevel@tonic-gate alg->alg_ef_default_bits = alg->alg_key_sizes[0];
4823628b0c67SMark Fenwick
4824628b0c67SMark Fenwick /*
4825628b0c67SMark Fenwick * For backwards compatability, assume that the IV length
4826628b0c67SMark Fenwick * is the same as the data length.
4827628b0c67SMark Fenwick */
4828628b0c67SMark Fenwick alg->alg_ivlen = alg->alg_datalen;
4829628b0c67SMark Fenwick
4830628b0c67SMark Fenwick /*
4831628b0c67SMark Fenwick * Copy any algorithm parameters (if provided) into dedicated
4832628b0c67SMark Fenwick * elements in the ipsec_alginfo_t structure.
4833628b0c67SMark Fenwick * There may be a better place to put this code.
4834628b0c67SMark Fenwick */
4835628b0c67SMark Fenwick for (i = 0; i < alg->alg_nparams; i++) {
4836628b0c67SMark Fenwick switch (i) {
4837628b0c67SMark Fenwick case 0:
4838628b0c67SMark Fenwick /* Initialisation Vector length (bytes) */
4839628b0c67SMark Fenwick alg->alg_ivlen = alg->alg_params[0];
4840628b0c67SMark Fenwick break;
4841628b0c67SMark Fenwick case 1:
4842628b0c67SMark Fenwick /* Integrity Check Vector length (bytes) */
4843628b0c67SMark Fenwick alg->alg_icvlen = alg->alg_params[1];
4844628b0c67SMark Fenwick break;
4845628b0c67SMark Fenwick case 2:
4846628b0c67SMark Fenwick /* Salt length (bytes) */
4847628b0c67SMark Fenwick alg->alg_saltlen = (uint8_t)alg->alg_params[2];
4848628b0c67SMark Fenwick break;
4849628b0c67SMark Fenwick default:
4850628b0c67SMark Fenwick break;
4851628b0c67SMark Fenwick }
4852628b0c67SMark Fenwick }
4853628b0c67SMark Fenwick
4854628b0c67SMark Fenwick /* Default if the IV length is not specified. */
4855628b0c67SMark Fenwick if (alg_type == IPSEC_ALG_ENCR && alg->alg_ivlen == 0)
4856628b0c67SMark Fenwick alg->alg_ivlen = alg->alg_datalen;
4857628b0c67SMark Fenwick
4858628b0c67SMark Fenwick alg_flag_check(alg);
4859628b0c67SMark Fenwick
48607c478bd9Sstevel@tonic-gate if (alg->alg_increment != 0) {
48617c478bd9Sstevel@tonic-gate /* supported key sizes are defined by range & increment */
48627c478bd9Sstevel@tonic-gate crypto_min = ALGBITS_ROUND_UP(crypto_min, alg->alg_increment);
48637c478bd9Sstevel@tonic-gate crypto_max = ALGBITS_ROUND_DOWN(crypto_max, alg->alg_increment);
48647c478bd9Sstevel@tonic-gate
48657c478bd9Sstevel@tonic-gate alg->alg_ef_minbits = MAX(alg->alg_minbits,
48667c478bd9Sstevel@tonic-gate (uint16_t)crypto_min);
48677c478bd9Sstevel@tonic-gate alg->alg_ef_maxbits = MIN(alg->alg_maxbits,
48687c478bd9Sstevel@tonic-gate (uint16_t)crypto_max);
48697c478bd9Sstevel@tonic-gate
48707c478bd9Sstevel@tonic-gate /*
48717c478bd9Sstevel@tonic-gate * If the sizes supported by the framework are outside
48727c478bd9Sstevel@tonic-gate * the range of sizes defined by the algorithm mappings,
48737c478bd9Sstevel@tonic-gate * the algorithm cannot be used. Check for this
48747c478bd9Sstevel@tonic-gate * condition here.
48757c478bd9Sstevel@tonic-gate */
48767c478bd9Sstevel@tonic-gate if (alg->alg_ef_minbits > alg->alg_ef_maxbits) {
48777c478bd9Sstevel@tonic-gate alg->alg_flags &= ~ALG_FLAG_VALID;
48787c478bd9Sstevel@tonic-gate return;
48797c478bd9Sstevel@tonic-gate }
48807c478bd9Sstevel@tonic-gate if (alg->alg_ef_default_bits < alg->alg_ef_minbits)
48817c478bd9Sstevel@tonic-gate alg->alg_ef_default_bits = alg->alg_ef_minbits;
48827c478bd9Sstevel@tonic-gate if (alg->alg_ef_default_bits > alg->alg_ef_maxbits)
48837c478bd9Sstevel@tonic-gate alg->alg_ef_default_bits = alg->alg_ef_maxbits;
48847c478bd9Sstevel@tonic-gate } else if (alg->alg_nkey_sizes == 0) {
48857c478bd9Sstevel@tonic-gate /* no specified key size for algorithm */
48867c478bd9Sstevel@tonic-gate alg->alg_ef_minbits = alg->alg_ef_maxbits = 0;
48877c478bd9Sstevel@tonic-gate } else {
48887c478bd9Sstevel@tonic-gate /* supported key sizes are defined by enumeration */
48897c478bd9Sstevel@tonic-gate alg->alg_ef_minbits = (uint16_t)-1;
48907c478bd9Sstevel@tonic-gate alg->alg_ef_maxbits = 0;
48917c478bd9Sstevel@tonic-gate
48927c478bd9Sstevel@tonic-gate for (i = 0, is_valid = B_FALSE; i < alg->alg_nkey_sizes; i++) {
48937c478bd9Sstevel@tonic-gate /*
48947c478bd9Sstevel@tonic-gate * Ignore the current key size if it is not in the
48957c478bd9Sstevel@tonic-gate * range of sizes supported by the framework.
48967c478bd9Sstevel@tonic-gate */
48977c478bd9Sstevel@tonic-gate if (alg->alg_key_sizes[i] < crypto_min ||
48987c478bd9Sstevel@tonic-gate alg->alg_key_sizes[i] > crypto_max)
48997c478bd9Sstevel@tonic-gate continue;
49007c478bd9Sstevel@tonic-gate if (alg->alg_key_sizes[i] < alg->alg_ef_minbits)
49017c478bd9Sstevel@tonic-gate alg->alg_ef_minbits = alg->alg_key_sizes[i];
49027c478bd9Sstevel@tonic-gate if (alg->alg_key_sizes[i] > alg->alg_ef_maxbits)
49037c478bd9Sstevel@tonic-gate alg->alg_ef_maxbits = alg->alg_key_sizes[i];
49047c478bd9Sstevel@tonic-gate is_valid = B_TRUE;
49057c478bd9Sstevel@tonic-gate }
49067c478bd9Sstevel@tonic-gate
49077c478bd9Sstevel@tonic-gate if (!is_valid) {
49087c478bd9Sstevel@tonic-gate alg->alg_flags &= ~ALG_FLAG_VALID;
49097c478bd9Sstevel@tonic-gate return;
49107c478bd9Sstevel@tonic-gate }
49117c478bd9Sstevel@tonic-gate alg->alg_ef_default = 0;
49127c478bd9Sstevel@tonic-gate }
49137c478bd9Sstevel@tonic-gate }
49147c478bd9Sstevel@tonic-gate
49157c478bd9Sstevel@tonic-gate /*
4916*bbf21555SRichard Lowe * Sanity check parameters provided by ipsecalgs(8). Assume that
4917628b0c67SMark Fenwick * the algoritm is marked as valid, there is a check at the top
4918628b0c67SMark Fenwick * of this function. If any of the checks below fail, the algorithm
4919628b0c67SMark Fenwick * entry is invalid.
4920628b0c67SMark Fenwick */
4921628b0c67SMark Fenwick void
alg_flag_check(ipsec_alginfo_t * alg)4922628b0c67SMark Fenwick alg_flag_check(ipsec_alginfo_t *alg)
4923628b0c67SMark Fenwick {
4924628b0c67SMark Fenwick alg->alg_flags &= ~ALG_FLAG_VALID;
4925628b0c67SMark Fenwick
4926628b0c67SMark Fenwick /*
4927628b0c67SMark Fenwick * Can't have the algorithm marked as CCM and GCM.
4928628b0c67SMark Fenwick * Check the ALG_FLAG_COMBINED and ALG_FLAG_COUNTERMODE
4929628b0c67SMark Fenwick * flags are set for CCM & GCM.
4930628b0c67SMark Fenwick */
4931628b0c67SMark Fenwick if ((alg->alg_flags & (ALG_FLAG_CCM|ALG_FLAG_GCM)) ==
4932628b0c67SMark Fenwick (ALG_FLAG_CCM|ALG_FLAG_GCM))
4933628b0c67SMark Fenwick return;
4934628b0c67SMark Fenwick if (alg->alg_flags & (ALG_FLAG_CCM|ALG_FLAG_GCM)) {
4935628b0c67SMark Fenwick if (!(alg->alg_flags & ALG_FLAG_COUNTERMODE))
4936628b0c67SMark Fenwick return;
4937628b0c67SMark Fenwick if (!(alg->alg_flags & ALG_FLAG_COMBINED))
4938628b0c67SMark Fenwick return;
4939628b0c67SMark Fenwick }
4940628b0c67SMark Fenwick
4941628b0c67SMark Fenwick /*
4942628b0c67SMark Fenwick * For ALG_FLAG_COUNTERMODE, check the parameters
4943628b0c67SMark Fenwick * fit in the ipsec_nonce_t structure.
4944628b0c67SMark Fenwick */
4945628b0c67SMark Fenwick if (alg->alg_flags & ALG_FLAG_COUNTERMODE) {
4946628b0c67SMark Fenwick if (alg->alg_ivlen != sizeof (((ipsec_nonce_t *)NULL)->iv))
4947628b0c67SMark Fenwick return;
4948628b0c67SMark Fenwick if (alg->alg_saltlen > sizeof (((ipsec_nonce_t *)NULL)->salt))
4949628b0c67SMark Fenwick return;
4950628b0c67SMark Fenwick }
4951628b0c67SMark Fenwick if ((alg->alg_flags & ALG_FLAG_COMBINED) &&
4952628b0c67SMark Fenwick (alg->alg_icvlen == 0))
4953628b0c67SMark Fenwick return;
4954628b0c67SMark Fenwick
4955628b0c67SMark Fenwick /* all is well. */
4956628b0c67SMark Fenwick alg->alg_flags |= ALG_FLAG_VALID;
4957628b0c67SMark Fenwick }
4958628b0c67SMark Fenwick
4959628b0c67SMark Fenwick /*
49607c478bd9Sstevel@tonic-gate * Free the memory used by the specified algorithm.
49617c478bd9Sstevel@tonic-gate */
49627c478bd9Sstevel@tonic-gate void
ipsec_alg_free(ipsec_alginfo_t * alg)49637c478bd9Sstevel@tonic-gate ipsec_alg_free(ipsec_alginfo_t *alg)
49647c478bd9Sstevel@tonic-gate {
49657c478bd9Sstevel@tonic-gate if (alg == NULL)
49667c478bd9Sstevel@tonic-gate return;
49677c478bd9Sstevel@tonic-gate
4968f4b3ec61Sdh155122 if (alg->alg_key_sizes != NULL) {
49697c478bd9Sstevel@tonic-gate kmem_free(alg->alg_key_sizes,
49707c478bd9Sstevel@tonic-gate (alg->alg_nkey_sizes + 1) * sizeof (uint16_t));
4971f4b3ec61Sdh155122 alg->alg_key_sizes = NULL;
4972f4b3ec61Sdh155122 }
4973f4b3ec61Sdh155122 if (alg->alg_block_sizes != NULL) {
49747c478bd9Sstevel@tonic-gate kmem_free(alg->alg_block_sizes,
49757c478bd9Sstevel@tonic-gate (alg->alg_nblock_sizes + 1) * sizeof (uint16_t));
4976f4b3ec61Sdh155122 alg->alg_block_sizes = NULL;
4977f4b3ec61Sdh155122 }
4978d0115d88SMark Fenwick if (alg->alg_params != NULL) {
4979d0115d88SMark Fenwick kmem_free(alg->alg_params,
4980d0115d88SMark Fenwick (alg->alg_nparams + 1) * sizeof (uint16_t));
4981d0115d88SMark Fenwick alg->alg_params = NULL;
4982d0115d88SMark Fenwick }
49837c478bd9Sstevel@tonic-gate kmem_free(alg, sizeof (*alg));
49847c478bd9Sstevel@tonic-gate }
49857c478bd9Sstevel@tonic-gate
49867c478bd9Sstevel@tonic-gate /*
49877c478bd9Sstevel@tonic-gate * Check the validity of the specified key size for an algorithm.
49887c478bd9Sstevel@tonic-gate * Returns B_TRUE if key size is valid, B_FALSE otherwise.
49897c478bd9Sstevel@tonic-gate */
49907c478bd9Sstevel@tonic-gate boolean_t
ipsec_valid_key_size(uint16_t key_size,ipsec_alginfo_t * alg)49917c478bd9Sstevel@tonic-gate ipsec_valid_key_size(uint16_t key_size, ipsec_alginfo_t *alg)
49927c478bd9Sstevel@tonic-gate {
49937c478bd9Sstevel@tonic-gate if (key_size < alg->alg_ef_minbits || key_size > alg->alg_ef_maxbits)
49947c478bd9Sstevel@tonic-gate return (B_FALSE);
49957c478bd9Sstevel@tonic-gate
49967c478bd9Sstevel@tonic-gate if (alg->alg_increment == 0 && alg->alg_nkey_sizes != 0) {
49977c478bd9Sstevel@tonic-gate /*
49987c478bd9Sstevel@tonic-gate * If the key sizes are defined by enumeration, the new
49997c478bd9Sstevel@tonic-gate * key size must be equal to one of the supported values.
50007c478bd9Sstevel@tonic-gate */
50017c478bd9Sstevel@tonic-gate int i;
50027c478bd9Sstevel@tonic-gate
50037c478bd9Sstevel@tonic-gate for (i = 0; i < alg->alg_nkey_sizes; i++)
50047c478bd9Sstevel@tonic-gate if (key_size == alg->alg_key_sizes[i])
50057c478bd9Sstevel@tonic-gate break;
50067c478bd9Sstevel@tonic-gate if (i == alg->alg_nkey_sizes)
50077c478bd9Sstevel@tonic-gate return (B_FALSE);
50087c478bd9Sstevel@tonic-gate }
50097c478bd9Sstevel@tonic-gate
50107c478bd9Sstevel@tonic-gate return (B_TRUE);
50117c478bd9Sstevel@tonic-gate }
50127c478bd9Sstevel@tonic-gate
50137c478bd9Sstevel@tonic-gate /*
50147c478bd9Sstevel@tonic-gate * Callback function invoked by the crypto framework when a provider
50157c478bd9Sstevel@tonic-gate * registers or unregisters. This callback updates the algorithms
50167c478bd9Sstevel@tonic-gate * tables when a crypto algorithm is no longer available or becomes
50177c478bd9Sstevel@tonic-gate * available, and triggers the freeing/creation of context templates
50187c478bd9Sstevel@tonic-gate * associated with existing SAs, if needed.
5019f4b3ec61Sdh155122 *
5020f4b3ec61Sdh155122 * Need to walk all stack instances since the callback is global
5021f4b3ec61Sdh155122 * for all instances
50227c478bd9Sstevel@tonic-gate */
50237c478bd9Sstevel@tonic-gate void
ipsec_prov_update_callback(uint32_t event,void * event_arg)50247c478bd9Sstevel@tonic-gate ipsec_prov_update_callback(uint32_t event, void *event_arg)
50257c478bd9Sstevel@tonic-gate {
5026f4b3ec61Sdh155122 netstack_handle_t nh;
5027f4b3ec61Sdh155122 netstack_t *ns;
5028f4b3ec61Sdh155122
5029f4b3ec61Sdh155122 netstack_next_init(&nh);
5030f4b3ec61Sdh155122 while ((ns = netstack_next(&nh)) != NULL) {
5031f4b3ec61Sdh155122 ipsec_prov_update_callback_stack(event, event_arg, ns);
5032f4b3ec61Sdh155122 netstack_rele(ns);
5033f4b3ec61Sdh155122 }
5034f4b3ec61Sdh155122 netstack_next_fini(&nh);
5035f4b3ec61Sdh155122 }
5036f4b3ec61Sdh155122
5037f4b3ec61Sdh155122 static void
ipsec_prov_update_callback_stack(uint32_t event,void * event_arg,netstack_t * ns)5038f4b3ec61Sdh155122 ipsec_prov_update_callback_stack(uint32_t event, void *event_arg,
5039f4b3ec61Sdh155122 netstack_t *ns)
5040f4b3ec61Sdh155122 {
50417c478bd9Sstevel@tonic-gate crypto_notify_event_change_t *prov_change =
50427c478bd9Sstevel@tonic-gate (crypto_notify_event_change_t *)event_arg;
50437c478bd9Sstevel@tonic-gate uint_t algidx, algid, algtype, mech_count, mech_idx;
50447c478bd9Sstevel@tonic-gate ipsec_alginfo_t *alg;
50457c478bd9Sstevel@tonic-gate ipsec_alginfo_t oalg;
50467c478bd9Sstevel@tonic-gate crypto_mech_name_t *mechs;
50477c478bd9Sstevel@tonic-gate boolean_t alg_changed = B_FALSE;
5048f4b3ec61Sdh155122 ipsec_stack_t *ipss = ns->netstack_ipsec;
50497c478bd9Sstevel@tonic-gate
50507c478bd9Sstevel@tonic-gate /* ignore events for which we didn't register */
5051c892ebf1Skrishna if (event != CRYPTO_EVENT_MECHS_CHANGED) {
50527c478bd9Sstevel@tonic-gate ip1dbg(("ipsec_prov_update_callback: unexpected event 0x%x "
50537c478bd9Sstevel@tonic-gate " received from crypto framework\n", event));
50547c478bd9Sstevel@tonic-gate return;
50557c478bd9Sstevel@tonic-gate }
50567c478bd9Sstevel@tonic-gate
50577c478bd9Sstevel@tonic-gate mechs = crypto_get_mech_list(&mech_count, KM_SLEEP);
50587c478bd9Sstevel@tonic-gate if (mechs == NULL)
50597c478bd9Sstevel@tonic-gate return;
50607c478bd9Sstevel@tonic-gate
50617c478bd9Sstevel@tonic-gate /*
50627c478bd9Sstevel@tonic-gate * Walk the list of currently defined IPsec algorithm. Update
50637c478bd9Sstevel@tonic-gate * the algorithm valid flag and trigger an update of the
50647c478bd9Sstevel@tonic-gate * SAs that depend on that algorithm.
50657c478bd9Sstevel@tonic-gate */
506669e71331SBayard Bell rw_enter(&ipss->ipsec_alg_lock, RW_WRITER);
50677c478bd9Sstevel@tonic-gate for (algtype = 0; algtype < IPSEC_NALGTYPES; algtype++) {
5068f4b3ec61Sdh155122 for (algidx = 0; algidx < ipss->ipsec_nalgs[algtype];
5069f4b3ec61Sdh155122 algidx++) {
50707c478bd9Sstevel@tonic-gate
5071f4b3ec61Sdh155122 algid = ipss->ipsec_sortlist[algtype][algidx];
5072f4b3ec61Sdh155122 alg = ipss->ipsec_alglists[algtype][algid];
50737c478bd9Sstevel@tonic-gate ASSERT(alg != NULL);
50747c478bd9Sstevel@tonic-gate
50757c478bd9Sstevel@tonic-gate /*
50767c478bd9Sstevel@tonic-gate * Skip the algorithms which do not map to the
50777c478bd9Sstevel@tonic-gate * crypto framework provider being added or removed.
50787c478bd9Sstevel@tonic-gate */
50797c478bd9Sstevel@tonic-gate if (strncmp(alg->alg_mech_name,
50807c478bd9Sstevel@tonic-gate prov_change->ec_mech_name,
50817c478bd9Sstevel@tonic-gate CRYPTO_MAX_MECH_NAME) != 0)
50827c478bd9Sstevel@tonic-gate continue;
50837c478bd9Sstevel@tonic-gate
50847c478bd9Sstevel@tonic-gate /*
50857c478bd9Sstevel@tonic-gate * Determine if the mechanism is valid. If it
50867c478bd9Sstevel@tonic-gate * is not, mark the algorithm as being invalid. If
50877c478bd9Sstevel@tonic-gate * it is, mark the algorithm as being valid.
50887c478bd9Sstevel@tonic-gate */
50897c478bd9Sstevel@tonic-gate for (mech_idx = 0; mech_idx < mech_count; mech_idx++)
50907c478bd9Sstevel@tonic-gate if (strncmp(alg->alg_mech_name,
50917c478bd9Sstevel@tonic-gate mechs[mech_idx], CRYPTO_MAX_MECH_NAME) == 0)
50927c478bd9Sstevel@tonic-gate break;
50937c478bd9Sstevel@tonic-gate if (mech_idx == mech_count &&
50947c478bd9Sstevel@tonic-gate alg->alg_flags & ALG_FLAG_VALID) {
50957c478bd9Sstevel@tonic-gate alg->alg_flags &= ~ALG_FLAG_VALID;
50967c478bd9Sstevel@tonic-gate alg_changed = B_TRUE;
50977c478bd9Sstevel@tonic-gate } else if (mech_idx < mech_count &&
50987c478bd9Sstevel@tonic-gate !(alg->alg_flags & ALG_FLAG_VALID)) {
50997c478bd9Sstevel@tonic-gate alg->alg_flags |= ALG_FLAG_VALID;
51007c478bd9Sstevel@tonic-gate alg_changed = B_TRUE;
51017c478bd9Sstevel@tonic-gate }
51027c478bd9Sstevel@tonic-gate
51037c478bd9Sstevel@tonic-gate /*
51047c478bd9Sstevel@tonic-gate * Update the supported key sizes, regardless
51057c478bd9Sstevel@tonic-gate * of whether a crypto provider was added or
51067c478bd9Sstevel@tonic-gate * removed.
51077c478bd9Sstevel@tonic-gate */
51087c478bd9Sstevel@tonic-gate oalg = *alg;
5109f4b3ec61Sdh155122 ipsec_alg_fix_min_max(alg, algtype, ns);
51107c478bd9Sstevel@tonic-gate if (!alg_changed &&
51117c478bd9Sstevel@tonic-gate alg->alg_ef_minbits != oalg.alg_ef_minbits ||
51127c478bd9Sstevel@tonic-gate alg->alg_ef_maxbits != oalg.alg_ef_maxbits ||
51137c478bd9Sstevel@tonic-gate alg->alg_ef_default != oalg.alg_ef_default ||
51147c478bd9Sstevel@tonic-gate alg->alg_ef_default_bits !=
51157c478bd9Sstevel@tonic-gate oalg.alg_ef_default_bits)
51167c478bd9Sstevel@tonic-gate alg_changed = B_TRUE;
51177c478bd9Sstevel@tonic-gate
51187c478bd9Sstevel@tonic-gate /*
51197c478bd9Sstevel@tonic-gate * Update the affected SAs if a software provider is
51207c478bd9Sstevel@tonic-gate * being added or removed.
51217c478bd9Sstevel@tonic-gate */
51227c478bd9Sstevel@tonic-gate if (prov_change->ec_provider_type ==
51237c478bd9Sstevel@tonic-gate CRYPTO_SW_PROVIDER)
51247c478bd9Sstevel@tonic-gate sadb_alg_update(algtype, alg->alg_id,
51257c478bd9Sstevel@tonic-gate prov_change->ec_change ==
5126f4b3ec61Sdh155122 CRYPTO_MECH_ADDED, ns);
51277c478bd9Sstevel@tonic-gate }
51287c478bd9Sstevel@tonic-gate }
512969e71331SBayard Bell rw_exit(&ipss->ipsec_alg_lock);
51307c478bd9Sstevel@tonic-gate crypto_free_mech_list(mechs, mech_count);
51317c478bd9Sstevel@tonic-gate
51327c478bd9Sstevel@tonic-gate if (alg_changed) {
51337c478bd9Sstevel@tonic-gate /*
51347c478bd9Sstevel@tonic-gate * An algorithm has changed, i.e. it became valid or
51357c478bd9Sstevel@tonic-gate * invalid, or its support key sizes have changed.
51367c478bd9Sstevel@tonic-gate * Notify ipsecah and ipsecesp of this change so
51377c478bd9Sstevel@tonic-gate * that they can send a SADB_REGISTER to their consumers.
51387c478bd9Sstevel@tonic-gate */
5139f4b3ec61Sdh155122 ipsecah_algs_changed(ns);
5140f4b3ec61Sdh155122 ipsecesp_algs_changed(ns);
51417c478bd9Sstevel@tonic-gate }
51427c478bd9Sstevel@tonic-gate }
51437c478bd9Sstevel@tonic-gate
51447c478bd9Sstevel@tonic-gate /*
51457c478bd9Sstevel@tonic-gate * Registers with the crypto framework to be notified of crypto
51467c478bd9Sstevel@tonic-gate * providers changes. Used to update the algorithm tables and
51477c478bd9Sstevel@tonic-gate * to free or create context templates if needed. Invoked after IPsec
51487c478bd9Sstevel@tonic-gate * is loaded successfully.
5149f4b3ec61Sdh155122 *
5150f4b3ec61Sdh155122 * This is called separately for each IP instance, so we ensure we only
5151f4b3ec61Sdh155122 * register once.
51527c478bd9Sstevel@tonic-gate */
51537c478bd9Sstevel@tonic-gate void
ipsec_register_prov_update(void)51547c478bd9Sstevel@tonic-gate ipsec_register_prov_update(void)
51557c478bd9Sstevel@tonic-gate {
5156f4b3ec61Sdh155122 if (prov_update_handle != NULL)
5157f4b3ec61Sdh155122 return;
5158f4b3ec61Sdh155122
51597c478bd9Sstevel@tonic-gate prov_update_handle = crypto_notify_events(
5160c892ebf1Skrishna ipsec_prov_update_callback, CRYPTO_EVENT_MECHS_CHANGED);
51617c478bd9Sstevel@tonic-gate }
51627c478bd9Sstevel@tonic-gate
51637c478bd9Sstevel@tonic-gate /*
51647c478bd9Sstevel@tonic-gate * Unregisters from the framework to be notified of crypto providers
5165f4b3ec61Sdh155122 * changes. Called from ipsec_policy_g_destroy().
51667c478bd9Sstevel@tonic-gate */
51677c478bd9Sstevel@tonic-gate static void
ipsec_unregister_prov_update(void)51687c478bd9Sstevel@tonic-gate ipsec_unregister_prov_update(void)
51697c478bd9Sstevel@tonic-gate {
51707c478bd9Sstevel@tonic-gate if (prov_update_handle != NULL)
51717c478bd9Sstevel@tonic-gate crypto_unnotify_events(prov_update_handle);
51727c478bd9Sstevel@tonic-gate }
51738810c16bSdanmcd
51748810c16bSdanmcd /*
51758810c16bSdanmcd * Tunnel-mode support routines.
51768810c16bSdanmcd */
51778810c16bSdanmcd
51788810c16bSdanmcd /*
51798810c16bSdanmcd * Returns an mblk chain suitable for putnext() if policies match and IPsec
51808810c16bSdanmcd * SAs are available. If there's no per-tunnel policy, or a match comes back
51818810c16bSdanmcd * with no match, then still return the packet and have global policy take
51828810c16bSdanmcd * a crack at it in IP.
5183bd670b35SErik Nordmark * This updates the ip_xmit_attr with the IPsec policy.
51848810c16bSdanmcd *
51858810c16bSdanmcd * Remember -> we can be forwarding packets. Keep that in mind w.r.t.
51868810c16bSdanmcd * inner-packet contents.
51878810c16bSdanmcd */
51888810c16bSdanmcd mblk_t *
ipsec_tun_outbound(mblk_t * mp,iptun_t * iptun,ipha_t * inner_ipv4,ip6_t * inner_ipv6,ipha_t * outer_ipv4,ip6_t * outer_ipv6,int outer_hdr_len,ip_xmit_attr_t * ixa)51892b24ab6bSSebastien Roy ipsec_tun_outbound(mblk_t *mp, iptun_t *iptun, ipha_t *inner_ipv4,
5190bd670b35SErik Nordmark ip6_t *inner_ipv6, ipha_t *outer_ipv4, ip6_t *outer_ipv6, int outer_hdr_len,
5191bd670b35SErik Nordmark ip_xmit_attr_t *ixa)
51928810c16bSdanmcd {
51938810c16bSdanmcd ipsec_policy_head_t *polhead;
51948810c16bSdanmcd ipsec_selector_t sel;
5195bd670b35SErik Nordmark mblk_t *nmp;
51968810c16bSdanmcd boolean_t is_fragment;
51978810c16bSdanmcd ipsec_policy_t *pol;
51982b24ab6bSSebastien Roy ipsec_tun_pol_t *itp = iptun->iptun_itp;
51992b24ab6bSSebastien Roy netstack_t *ns = iptun->iptun_ns;
5200f4b3ec61Sdh155122 ipsec_stack_t *ipss = ns->netstack_ipsec;
52018810c16bSdanmcd
52028810c16bSdanmcd ASSERT(outer_ipv6 != NULL && outer_ipv4 == NULL ||
52038810c16bSdanmcd outer_ipv4 != NULL && outer_ipv6 == NULL);
52048810c16bSdanmcd /* We take care of inners in a bit. */
52058810c16bSdanmcd
5206bd670b35SErik Nordmark /* Are the IPsec fields initialized at all? */
5207bd670b35SErik Nordmark if (!(ixa->ixa_flags & IXAF_IPSEC_SECURE)) {
5208bd670b35SErik Nordmark ASSERT(ixa->ixa_ipsec_policy == NULL);
5209bd670b35SErik Nordmark ASSERT(ixa->ixa_ipsec_latch == NULL);
5210bd670b35SErik Nordmark ASSERT(ixa->ixa_ipsec_action == NULL);
5211bd670b35SErik Nordmark ASSERT(ixa->ixa_ipsec_ah_sa == NULL);
5212bd670b35SErik Nordmark ASSERT(ixa->ixa_ipsec_esp_sa == NULL);
5213bd670b35SErik Nordmark }
5214bd670b35SErik Nordmark
52152b24ab6bSSebastien Roy ASSERT(itp != NULL && (itp->itp_flags & ITPF_P_ACTIVE));
52168810c16bSdanmcd polhead = itp->itp_policy;
52178810c16bSdanmcd
52188810c16bSdanmcd bzero(&sel, sizeof (sel));
52198810c16bSdanmcd if (inner_ipv4 != NULL) {
52208810c16bSdanmcd ASSERT(inner_ipv6 == NULL);
52218810c16bSdanmcd sel.ips_isv4 = B_TRUE;
52228810c16bSdanmcd sel.ips_local_addr_v4 = inner_ipv4->ipha_src;
52238810c16bSdanmcd sel.ips_remote_addr_v4 = inner_ipv4->ipha_dst;
52248810c16bSdanmcd sel.ips_protocol = (uint8_t)inner_ipv4->ipha_protocol;
52258810c16bSdanmcd } else {
52268810c16bSdanmcd ASSERT(inner_ipv6 != NULL);
52278810c16bSdanmcd sel.ips_isv4 = B_FALSE;
52288810c16bSdanmcd sel.ips_local_addr_v6 = inner_ipv6->ip6_src;
52298810c16bSdanmcd /*
523005d90a32SDan McDonald * We don't care about routing-header dests in the
523105d90a32SDan McDonald * forwarding/tunnel path, so just grab ip6_dst.
52328810c16bSdanmcd */
52338810c16bSdanmcd sel.ips_remote_addr_v6 = inner_ipv6->ip6_dst;
52348810c16bSdanmcd }
52358810c16bSdanmcd
52368810c16bSdanmcd if (itp->itp_flags & ITPF_P_PER_PORT_SECURITY) {
523705d90a32SDan McDonald /*
523805d90a32SDan McDonald * Caller can prepend the outer header, which means
523905d90a32SDan McDonald * inner_ipv[46] may be stuck in the middle. Pullup the whole
524005d90a32SDan McDonald * mess now if need-be, for easier processing later. Don't
524105d90a32SDan McDonald * forget to rewire the outer header too.
524205d90a32SDan McDonald */
524305d90a32SDan McDonald if (mp->b_cont != NULL) {
524405d90a32SDan McDonald nmp = msgpullup(mp, -1);
524505d90a32SDan McDonald if (nmp == NULL) {
5246bd670b35SErik Nordmark ip_drop_packet(mp, B_FALSE, NULL,
524705d90a32SDan McDonald DROPPER(ipss, ipds_spd_nomem),
524805d90a32SDan McDonald &ipss->ipsec_spd_dropper);
524905d90a32SDan McDonald return (NULL);
525005d90a32SDan McDonald }
525105d90a32SDan McDonald freemsg(mp);
525205d90a32SDan McDonald mp = nmp;
525305d90a32SDan McDonald if (outer_ipv4 != NULL)
525405d90a32SDan McDonald outer_ipv4 = (ipha_t *)mp->b_rptr;
525505d90a32SDan McDonald else
525605d90a32SDan McDonald outer_ipv6 = (ip6_t *)mp->b_rptr;
525705d90a32SDan McDonald if (inner_ipv4 != NULL) {
525805d90a32SDan McDonald inner_ipv4 =
525905d90a32SDan McDonald (ipha_t *)(mp->b_rptr + outer_hdr_len);
526005d90a32SDan McDonald } else {
526105d90a32SDan McDonald inner_ipv6 =
526205d90a32SDan McDonald (ip6_t *)(mp->b_rptr + outer_hdr_len);
526305d90a32SDan McDonald }
526405d90a32SDan McDonald }
526505d90a32SDan McDonald if (inner_ipv4 != NULL) {
526605d90a32SDan McDonald is_fragment = IS_V4_FRAGMENT(
526705d90a32SDan McDonald inner_ipv4->ipha_fragment_offset_and_flags);
526805d90a32SDan McDonald } else {
526905d90a32SDan McDonald sel.ips_remote_addr_v6 = ip_get_dst_v6(inner_ipv6, mp,
527005d90a32SDan McDonald &is_fragment);
527105d90a32SDan McDonald }
527205d90a32SDan McDonald
52738810c16bSdanmcd if (is_fragment) {
52748810c16bSdanmcd ipha_t *oiph;
52758810c16bSdanmcd ipha_t *iph = NULL;
52768810c16bSdanmcd ip6_t *ip6h = NULL;
52778810c16bSdanmcd int hdr_len;
52788810c16bSdanmcd uint16_t ip6_hdr_length;
52798810c16bSdanmcd uint8_t v6_proto;
52808810c16bSdanmcd uint8_t *v6_proto_p;
52818810c16bSdanmcd
52828810c16bSdanmcd /*
52838810c16bSdanmcd * We have a fragment we need to track!
52848810c16bSdanmcd */
52858810c16bSdanmcd mp = ipsec_fragcache_add(&itp->itp_fragcache, NULL, mp,
5286f4b3ec61Sdh155122 outer_hdr_len, ipss);
52878810c16bSdanmcd if (mp == NULL)
52888810c16bSdanmcd return (NULL);
528905d90a32SDan McDonald ASSERT(mp->b_cont == NULL);
52908810c16bSdanmcd
52918810c16bSdanmcd /*
52922b24ab6bSSebastien Roy * If we get here, we have a full fragment chain
52938810c16bSdanmcd */
52948810c16bSdanmcd
52958810c16bSdanmcd oiph = (ipha_t *)mp->b_rptr;
52968810c16bSdanmcd if (IPH_HDR_VERSION(oiph) == IPV4_VERSION) {
52978810c16bSdanmcd hdr_len = ((outer_hdr_len != 0) ?
52988810c16bSdanmcd IPH_HDR_LENGTH(oiph) : 0);
52998810c16bSdanmcd iph = (ipha_t *)(mp->b_rptr + hdr_len);
53008810c16bSdanmcd } else {
53018810c16bSdanmcd ASSERT(IPH_HDR_VERSION(oiph) == IPV6_VERSION);
530205d90a32SDan McDonald ip6h = (ip6_t *)mp->b_rptr;
530305d90a32SDan McDonald if (!ip_hdr_length_nexthdr_v6(mp, ip6h,
530405d90a32SDan McDonald &ip6_hdr_length, &v6_proto_p)) {
5305bd670b35SErik Nordmark ip_drop_packet_chain(mp, B_FALSE, NULL,
5306bd670b35SErik Nordmark DROPPER(ipss,
530705d90a32SDan McDonald ipds_spd_malformed_packet),
5308f4b3ec61Sdh155122 &ipss->ipsec_spd_dropper);
530905d90a32SDan McDonald return (NULL);
53108810c16bSdanmcd }
53118810c16bSdanmcd hdr_len = ip6_hdr_length;
53128810c16bSdanmcd }
53138810c16bSdanmcd outer_hdr_len = hdr_len;
53148810c16bSdanmcd
53158810c16bSdanmcd if (sel.ips_isv4) {
53168810c16bSdanmcd if (iph == NULL) {
53178810c16bSdanmcd /* Was v6 outer */
53188810c16bSdanmcd iph = (ipha_t *)(mp->b_rptr + hdr_len);
53198810c16bSdanmcd }
53208810c16bSdanmcd inner_ipv4 = iph;
53218810c16bSdanmcd sel.ips_local_addr_v4 = inner_ipv4->ipha_src;
53228810c16bSdanmcd sel.ips_remote_addr_v4 = inner_ipv4->ipha_dst;
53238810c16bSdanmcd sel.ips_protocol =
53248810c16bSdanmcd (uint8_t)inner_ipv4->ipha_protocol;
53258810c16bSdanmcd } else {
532605d90a32SDan McDonald inner_ipv6 = (ip6_t *)(mp->b_rptr +
53278810c16bSdanmcd hdr_len);
53288810c16bSdanmcd sel.ips_local_addr_v6 = inner_ipv6->ip6_src;
53298810c16bSdanmcd sel.ips_remote_addr_v6 = inner_ipv6->ip6_dst;
533005d90a32SDan McDonald if (!ip_hdr_length_nexthdr_v6(mp,
533105d90a32SDan McDonald inner_ipv6, &ip6_hdr_length, &v6_proto_p)) {
5332bd670b35SErik Nordmark ip_drop_packet_chain(mp, B_FALSE, NULL,
5333bd670b35SErik Nordmark DROPPER(ipss,
533405d90a32SDan McDonald ipds_spd_malformed_frag),
533505d90a32SDan McDonald &ipss->ipsec_spd_dropper);
533605d90a32SDan McDonald return (NULL);
533705d90a32SDan McDonald }
53388810c16bSdanmcd v6_proto = *v6_proto_p;
53398810c16bSdanmcd sel.ips_protocol = v6_proto;
53408810c16bSdanmcd #ifdef FRAGCACHE_DEBUG
53418810c16bSdanmcd cmn_err(CE_WARN, "v6_sel.ips_protocol = %d\n",
53428810c16bSdanmcd sel.ips_protocol);
53438810c16bSdanmcd #endif
53448810c16bSdanmcd }
53458810c16bSdanmcd /* Ports are extracted below */
53468810c16bSdanmcd }
53478810c16bSdanmcd
53488810c16bSdanmcd /* Get ports... */
53498810c16bSdanmcd if (!ipsec_init_outbound_ports(&sel, mp,
5350f4b3ec61Sdh155122 inner_ipv4, inner_ipv6, outer_hdr_len, ipss)) {
53518810c16bSdanmcd /* callee did ip_drop_packet_chain() on mp. */
53528810c16bSdanmcd return (NULL);
53538810c16bSdanmcd }
53548810c16bSdanmcd #ifdef FRAGCACHE_DEBUG
53558810c16bSdanmcd if (inner_ipv4 != NULL)
53568810c16bSdanmcd cmn_err(CE_WARN,
53578810c16bSdanmcd "(v4) sel.ips_protocol = %d, "
53588810c16bSdanmcd "sel.ips_local_port = %d, "
53598810c16bSdanmcd "sel.ips_remote_port = %d\n",
53608810c16bSdanmcd sel.ips_protocol, ntohs(sel.ips_local_port),
53618810c16bSdanmcd ntohs(sel.ips_remote_port));
53628810c16bSdanmcd if (inner_ipv6 != NULL)
53638810c16bSdanmcd cmn_err(CE_WARN,
53648810c16bSdanmcd "(v6) sel.ips_protocol = %d, "
53658810c16bSdanmcd "sel.ips_local_port = %d, "
53668810c16bSdanmcd "sel.ips_remote_port = %d\n",
53678810c16bSdanmcd sel.ips_protocol, ntohs(sel.ips_local_port),
53688810c16bSdanmcd ntohs(sel.ips_remote_port));
53698810c16bSdanmcd #endif
537005d90a32SDan McDonald /* Success so far! */
53718810c16bSdanmcd }
53728810c16bSdanmcd rw_enter(&polhead->iph_lock, RW_READER);
5373bd670b35SErik Nordmark pol = ipsec_find_policy_head(NULL, polhead, IPSEC_TYPE_OUTBOUND, &sel);
53748810c16bSdanmcd rw_exit(&polhead->iph_lock);
53758810c16bSdanmcd if (pol == NULL) {
53768810c16bSdanmcd /*
53778810c16bSdanmcd * No matching policy on this tunnel, drop the packet.
53788810c16bSdanmcd *
53798810c16bSdanmcd * NOTE: Tunnel-mode tunnels are different from the
53808810c16bSdanmcd * IP global transport mode policy head. For a tunnel-mode
53818810c16bSdanmcd * tunnel, we drop the packet in lieu of passing it
53828810c16bSdanmcd * along accepted the way a global-policy miss would.
53838810c16bSdanmcd *
53848810c16bSdanmcd * NOTE2: "negotiate transport" tunnels should match ALL
53858810c16bSdanmcd * inbound packets, but we do not uncomment the ASSERT()
53868810c16bSdanmcd * below because if/when we open PF_POLICY, a user can
538748bbca81SDaniel Hoffman * shoot themself in the foot with a 0 priority.
53888810c16bSdanmcd */
53898810c16bSdanmcd
53908810c16bSdanmcd /* ASSERT(itp->itp_flags & ITPF_P_TUNNEL); */
53918810c16bSdanmcd #ifdef FRAGCACHE_DEBUG
53928810c16bSdanmcd cmn_err(CE_WARN, "ipsec_tun_outbound(): No matching tunnel "
53938810c16bSdanmcd "per-port policy\n");
53948810c16bSdanmcd #endif
5395bd670b35SErik Nordmark ip_drop_packet_chain(mp, B_FALSE, NULL,
5396f4b3ec61Sdh155122 DROPPER(ipss, ipds_spd_explicit),
5397f4b3ec61Sdh155122 &ipss->ipsec_spd_dropper);
53988810c16bSdanmcd return (NULL);
53998810c16bSdanmcd }
54008810c16bSdanmcd
54018810c16bSdanmcd #ifdef FRAGCACHE_DEBUG
54028810c16bSdanmcd cmn_err(CE_WARN, "Having matching tunnel per-port policy\n");
54038810c16bSdanmcd #endif
54048810c16bSdanmcd
54058810c16bSdanmcd /*
5406bd670b35SErik Nordmark * NOTE: ixa_cleanup() function will release pol references.
54078810c16bSdanmcd */
5408bd670b35SErik Nordmark ixa->ixa_ipsec_policy = pol;
54092b24ab6bSSebastien Roy /*
54102b24ab6bSSebastien Roy * NOTE: There is a subtle difference between iptun_zoneid and
54112b24ab6bSSebastien Roy * iptun_connp->conn_zoneid explained in iptun_conn_create(). When
54122b24ab6bSSebastien Roy * interacting with the ip module, we must use conn_zoneid.
54132b24ab6bSSebastien Roy */
5414bd670b35SErik Nordmark ixa->ixa_zoneid = iptun->iptun_connp->conn_zoneid;
5415bd670b35SErik Nordmark
5416bd670b35SErik Nordmark ASSERT((outer_ipv4 != NULL) ? (ixa->ixa_flags & IXAF_IS_IPV4) :
5417bd670b35SErik Nordmark !(ixa->ixa_flags & IXAF_IS_IPV4));
5418bd670b35SErik Nordmark ASSERT(ixa->ixa_ipsec_policy != NULL);
5419bd670b35SErik Nordmark ixa->ixa_flags |= IXAF_IPSEC_SECURE;
54208810c16bSdanmcd
54218810c16bSdanmcd if (!(itp->itp_flags & ITPF_P_TUNNEL)) {
54228810c16bSdanmcd /* Set up transport mode for tunnelled packets. */
5423bd670b35SErik Nordmark ixa->ixa_ipsec_proto = (inner_ipv4 != NULL) ? IPPROTO_ENCAP :
54248810c16bSdanmcd IPPROTO_IPV6;
5425bd670b35SErik Nordmark return (mp);
54268810c16bSdanmcd }
54278810c16bSdanmcd
54288810c16bSdanmcd /* Fill in tunnel-mode goodies here. */
5429bd670b35SErik Nordmark ixa->ixa_flags |= IXAF_IPSEC_TUNNEL;
54308810c16bSdanmcd /* XXX Do I need to fill in all of the goodies here? */
54318810c16bSdanmcd if (inner_ipv4) {
5432bd670b35SErik Nordmark ixa->ixa_ipsec_inaf = AF_INET;
5433bd670b35SErik Nordmark ixa->ixa_ipsec_insrc[0] =
54348810c16bSdanmcd pol->ipsp_sel->ipsl_key.ipsl_local.ipsad_v4;
5435bd670b35SErik Nordmark ixa->ixa_ipsec_indst[0] =
54368810c16bSdanmcd pol->ipsp_sel->ipsl_key.ipsl_remote.ipsad_v4;
54378810c16bSdanmcd } else {
5438bd670b35SErik Nordmark ixa->ixa_ipsec_inaf = AF_INET6;
5439bd670b35SErik Nordmark ixa->ixa_ipsec_insrc[0] =
54408810c16bSdanmcd pol->ipsp_sel->ipsl_key.ipsl_local.ipsad_v6.s6_addr32[0];
5441bd670b35SErik Nordmark ixa->ixa_ipsec_insrc[1] =
54428810c16bSdanmcd pol->ipsp_sel->ipsl_key.ipsl_local.ipsad_v6.s6_addr32[1];
5443bd670b35SErik Nordmark ixa->ixa_ipsec_insrc[2] =
54448810c16bSdanmcd pol->ipsp_sel->ipsl_key.ipsl_local.ipsad_v6.s6_addr32[2];
5445bd670b35SErik Nordmark ixa->ixa_ipsec_insrc[3] =
54468810c16bSdanmcd pol->ipsp_sel->ipsl_key.ipsl_local.ipsad_v6.s6_addr32[3];
5447bd670b35SErik Nordmark ixa->ixa_ipsec_indst[0] =
54488810c16bSdanmcd pol->ipsp_sel->ipsl_key.ipsl_remote.ipsad_v6.s6_addr32[0];
5449bd670b35SErik Nordmark ixa->ixa_ipsec_indst[1] =
54508810c16bSdanmcd pol->ipsp_sel->ipsl_key.ipsl_remote.ipsad_v6.s6_addr32[1];
5451bd670b35SErik Nordmark ixa->ixa_ipsec_indst[2] =
54528810c16bSdanmcd pol->ipsp_sel->ipsl_key.ipsl_remote.ipsad_v6.s6_addr32[2];
5453bd670b35SErik Nordmark ixa->ixa_ipsec_indst[3] =
54548810c16bSdanmcd pol->ipsp_sel->ipsl_key.ipsl_remote.ipsad_v6.s6_addr32[3];
54558810c16bSdanmcd }
5456bd670b35SErik Nordmark ixa->ixa_ipsec_insrcpfx = pol->ipsp_sel->ipsl_key.ipsl_local_pfxlen;
5457bd670b35SErik Nordmark ixa->ixa_ipsec_indstpfx = pol->ipsp_sel->ipsl_key.ipsl_remote_pfxlen;
54588810c16bSdanmcd /* NOTE: These are used for transport mode too. */
5459bd670b35SErik Nordmark ixa->ixa_ipsec_src_port = pol->ipsp_sel->ipsl_key.ipsl_lport;
5460bd670b35SErik Nordmark ixa->ixa_ipsec_dst_port = pol->ipsp_sel->ipsl_key.ipsl_rport;
5461bd670b35SErik Nordmark ixa->ixa_ipsec_proto = pol->ipsp_sel->ipsl_key.ipsl_proto;
54628810c16bSdanmcd
5463bd670b35SErik Nordmark return (mp);
54648810c16bSdanmcd }
54658810c16bSdanmcd
54668810c16bSdanmcd /*
54678810c16bSdanmcd * NOTE: The following releases pol's reference and
54688810c16bSdanmcd * calls ip_drop_packet() for me on NULL returns.
54698810c16bSdanmcd */
54708810c16bSdanmcd mblk_t *
ipsec_check_ipsecin_policy_reasm(mblk_t * attr_mp,ipsec_policy_t * pol,ipha_t * inner_ipv4,ip6_t * inner_ipv6,uint64_t pkt_unique,netstack_t * ns)5471bd670b35SErik Nordmark ipsec_check_ipsecin_policy_reasm(mblk_t *attr_mp, ipsec_policy_t *pol,
5472f4b3ec61Sdh155122 ipha_t *inner_ipv4, ip6_t *inner_ipv6, uint64_t pkt_unique, netstack_t *ns)
54738810c16bSdanmcd {
5474bd670b35SErik Nordmark /* Assume attr_mp is a chain of b_next-linked ip_recv_attr mblk. */
54758810c16bSdanmcd mblk_t *data_chain = NULL, *data_tail = NULL;
5476bd670b35SErik Nordmark mblk_t *next;
5477bd670b35SErik Nordmark mblk_t *data_mp;
5478bd670b35SErik Nordmark ip_recv_attr_t iras;
54798810c16bSdanmcd
5480bd670b35SErik Nordmark while (attr_mp != NULL) {
5481bd670b35SErik Nordmark ASSERT(ip_recv_attr_is_mblk(attr_mp));
5482bd670b35SErik Nordmark next = attr_mp->b_next;
5483bd670b35SErik Nordmark attr_mp->b_next = NULL; /* No tripping asserts. */
5484bd670b35SErik Nordmark
5485bd670b35SErik Nordmark data_mp = attr_mp->b_cont;
5486bd670b35SErik Nordmark attr_mp->b_cont = NULL;
5487bd670b35SErik Nordmark if (!ip_recv_attr_from_mblk(attr_mp, &iras)) {
5488bd670b35SErik Nordmark /* The ill or ip_stack_t disappeared on us */
5489bd670b35SErik Nordmark freemsg(data_mp); /* ip_drop_packet?? */
5490bd670b35SErik Nordmark ira_cleanup(&iras, B_TRUE);
5491bd670b35SErik Nordmark goto fail;
5492bd670b35SErik Nordmark }
54938810c16bSdanmcd
54948810c16bSdanmcd /*
54958810c16bSdanmcd * Need IPPOL_REFHOLD(pol) for extras because
54968810c16bSdanmcd * ipsecin_policy does the refrele.
54978810c16bSdanmcd */
54988810c16bSdanmcd IPPOL_REFHOLD(pol);
54998810c16bSdanmcd
5500bd670b35SErik Nordmark data_mp = ipsec_check_ipsecin_policy(data_mp, pol, inner_ipv4,
5501bd670b35SErik Nordmark inner_ipv6, pkt_unique, &iras, ns);
5502bd670b35SErik Nordmark ira_cleanup(&iras, B_TRUE);
5503bd670b35SErik Nordmark
5504bd670b35SErik Nordmark if (data_mp == NULL)
5505bd670b35SErik Nordmark goto fail;
5506bd670b35SErik Nordmark
55078810c16bSdanmcd if (data_tail == NULL) {
55088810c16bSdanmcd /* First one */
5509bd670b35SErik Nordmark data_chain = data_tail = data_mp;
55108810c16bSdanmcd } else {
5511bd670b35SErik Nordmark data_tail->b_next = data_mp;
5512bd670b35SErik Nordmark data_tail = data_mp;
55138810c16bSdanmcd }
5514bd670b35SErik Nordmark attr_mp = next;
55158810c16bSdanmcd }
55168810c16bSdanmcd /*
55178810c16bSdanmcd * One last release because either the loop bumped it up, or we never
55188810c16bSdanmcd * called ipsec_check_ipsecin_policy().
55198810c16bSdanmcd */
5520bd670b35SErik Nordmark IPPOL_REFRELE(pol);
55218810c16bSdanmcd
55228810c16bSdanmcd /* data_chain is ready for return to tun module. */
55238810c16bSdanmcd return (data_chain);
5524bd670b35SErik Nordmark
5525bd670b35SErik Nordmark fail:
5526bd670b35SErik Nordmark /*
5527bd670b35SErik Nordmark * Need to get rid of any extra pol
5528bd670b35SErik Nordmark * references, and any remaining bits as well.
5529bd670b35SErik Nordmark */
5530bd670b35SErik Nordmark IPPOL_REFRELE(pol);
5531bd670b35SErik Nordmark ipsec_freemsg_chain(data_chain);
5532bd670b35SErik Nordmark ipsec_freemsg_chain(next); /* ipdrop stats? */
5533bd670b35SErik Nordmark return (NULL);
55348810c16bSdanmcd }
55358810c16bSdanmcd
55368810c16bSdanmcd /*
5537bd670b35SErik Nordmark * Return a message if the inbound packet passed an IPsec policy check. Returns
5538bd670b35SErik Nordmark * NULL if it failed or if it is a fragment needing its friends before a
55398810c16bSdanmcd * policy check can be performed.
55408810c16bSdanmcd *
5541bd670b35SErik Nordmark * Expects a non-NULL data_mp, and a non-NULL polhead.
5542bd670b35SErik Nordmark * The returned mblk may be a b_next chain of packets if fragments
55438810c16bSdanmcd * neeeded to be collected for a proper policy check.
55448810c16bSdanmcd *
5545bd670b35SErik Nordmark * This function calls ip_drop_packet() on data_mp if need be.
55468810c16bSdanmcd *
55478810c16bSdanmcd * NOTE: outer_hdr_len is signed. If it's a negative value, the caller
55488810c16bSdanmcd * is inspecting an ICMP packet.
55498810c16bSdanmcd */
5550bd670b35SErik Nordmark mblk_t *
ipsec_tun_inbound(ip_recv_attr_t * ira,mblk_t * data_mp,ipsec_tun_pol_t * itp,ipha_t * inner_ipv4,ip6_t * inner_ipv6,ipha_t * outer_ipv4,ip6_t * outer_ipv6,int outer_hdr_len,netstack_t * ns)5551bd670b35SErik Nordmark ipsec_tun_inbound(ip_recv_attr_t *ira, mblk_t *data_mp, ipsec_tun_pol_t *itp,
55528810c16bSdanmcd ipha_t *inner_ipv4, ip6_t *inner_ipv6, ipha_t *outer_ipv4,
5553f4b3ec61Sdh155122 ip6_t *outer_ipv6, int outer_hdr_len, netstack_t *ns)
55548810c16bSdanmcd {
55558810c16bSdanmcd ipsec_policy_head_t *polhead;
55568810c16bSdanmcd ipsec_selector_t sel;
55578810c16bSdanmcd ipsec_policy_t *pol;
55588810c16bSdanmcd uint16_t tmpport;
55598810c16bSdanmcd selret_t rc;
5560bd670b35SErik Nordmark boolean_t port_policy_present, is_icmp, global_present;
55618810c16bSdanmcd in6_addr_t tmpaddr;
5562a8e50c3eSdanmcd ipaddr_t tmp4;
55632b24ab6bSSebastien Roy uint8_t flags, *inner_hdr;
5564f4b3ec61Sdh155122 ipsec_stack_t *ipss = ns->netstack_ipsec;
55658810c16bSdanmcd
55668810c16bSdanmcd sel.ips_is_icmp_inv_acq = 0;
55678810c16bSdanmcd
556832350c00Sdanmcd if (outer_ipv4 != NULL) {
556932350c00Sdanmcd ASSERT(outer_ipv6 == NULL);
5570f4b3ec61Sdh155122 global_present = ipss->ipsec_inbound_v4_policy_present;
557132350c00Sdanmcd } else {
55722b24ab6bSSebastien Roy ASSERT(outer_ipv6 != NULL);
5573f4b3ec61Sdh155122 global_present = ipss->ipsec_inbound_v6_policy_present;
557432350c00Sdanmcd }
557532350c00Sdanmcd
55768810c16bSdanmcd ASSERT(inner_ipv4 != NULL && inner_ipv6 == NULL ||
55778810c16bSdanmcd inner_ipv4 == NULL && inner_ipv6 != NULL);
55788810c16bSdanmcd
55798810c16bSdanmcd if (outer_hdr_len < 0) {
55808810c16bSdanmcd outer_hdr_len = (-outer_hdr_len);
55818810c16bSdanmcd is_icmp = B_TRUE;
55828810c16bSdanmcd } else {
55838810c16bSdanmcd is_icmp = B_FALSE;
55848810c16bSdanmcd }
55858810c16bSdanmcd
55868810c16bSdanmcd if (itp != NULL && (itp->itp_flags & ITPF_P_ACTIVE)) {
5587bd670b35SErik Nordmark mblk_t *mp = data_mp;
5588bd670b35SErik Nordmark
55898810c16bSdanmcd polhead = itp->itp_policy;
55908810c16bSdanmcd /*
55918810c16bSdanmcd * We need to perform full Tunnel-Mode enforcement,
55928810c16bSdanmcd * and we need to have inner-header data for such enforcement.
55938810c16bSdanmcd *
55948810c16bSdanmcd * See ipsec_init_inbound_sel() for the 0x80000000 on inbound
55958810c16bSdanmcd * and on return.
55968810c16bSdanmcd */
55978810c16bSdanmcd
55988810c16bSdanmcd port_policy_present = ((itp->itp_flags &
55998810c16bSdanmcd ITPF_P_PER_PORT_SECURITY) ? B_TRUE : B_FALSE);
56002b24ab6bSSebastien Roy /*
56012b24ab6bSSebastien Roy * NOTE: Even if our policy is transport mode, set the
56022b24ab6bSSebastien Roy * SEL_TUNNEL_MODE flag so ipsec_init_inbound_sel() can
56032b24ab6bSSebastien Roy * do the right thing w.r.t. outer headers.
56042b24ab6bSSebastien Roy */
56058810c16bSdanmcd flags = ((port_policy_present ? SEL_PORT_POLICY : SEL_NONE) |
56068810c16bSdanmcd (is_icmp ? SEL_IS_ICMP : SEL_NONE) | SEL_TUNNEL_MODE);
56078810c16bSdanmcd
5608bd670b35SErik Nordmark rc = ipsec_init_inbound_sel(&sel, data_mp, inner_ipv4,
56098810c16bSdanmcd inner_ipv6, flags);
56108810c16bSdanmcd
56118810c16bSdanmcd switch (rc) {
56128810c16bSdanmcd case SELRET_NOMEM:
5613bd670b35SErik Nordmark ip_drop_packet(data_mp, B_TRUE, NULL,
5614f4b3ec61Sdh155122 DROPPER(ipss, ipds_spd_nomem),
5615f4b3ec61Sdh155122 &ipss->ipsec_spd_dropper);
5616bd670b35SErik Nordmark return (NULL);
56178810c16bSdanmcd case SELRET_TUNFRAG:
56188810c16bSdanmcd /*
56198810c16bSdanmcd * At this point, if we're cleartext, we don't want
56208810c16bSdanmcd * to go there.
56218810c16bSdanmcd */
5622bd670b35SErik Nordmark if (!(ira->ira_flags & IRAF_IPSEC_SECURE)) {
5623bd670b35SErik Nordmark ip_drop_packet(data_mp, B_TRUE, NULL,
5624f4b3ec61Sdh155122 DROPPER(ipss, ipds_spd_got_clear),
5625f4b3ec61Sdh155122 &ipss->ipsec_spd_dropper);
5626bd670b35SErik Nordmark return (NULL);
56278810c16bSdanmcd }
5628d1a98e54SPaul Wernau
5629d1a98e54SPaul Wernau /*
5630d1a98e54SPaul Wernau * Inner and outer headers may not be contiguous.
5631d1a98e54SPaul Wernau * Pullup the data_mp now to satisfy assumptions of
5632d1a98e54SPaul Wernau * ipsec_fragcache_add()
5633d1a98e54SPaul Wernau */
5634d1a98e54SPaul Wernau if (data_mp->b_cont != NULL) {
5635d1a98e54SPaul Wernau mblk_t *nmp;
5636d1a98e54SPaul Wernau
5637d1a98e54SPaul Wernau nmp = msgpullup(data_mp, -1);
5638d1a98e54SPaul Wernau if (nmp == NULL) {
5639d1a98e54SPaul Wernau ip_drop_packet(data_mp, B_TRUE, NULL,
5640d1a98e54SPaul Wernau DROPPER(ipss, ipds_spd_nomem),
5641d1a98e54SPaul Wernau &ipss->ipsec_spd_dropper);
5642d1a98e54SPaul Wernau return (NULL);
5643d1a98e54SPaul Wernau }
5644d1a98e54SPaul Wernau freemsg(data_mp);
5645d1a98e54SPaul Wernau data_mp = nmp;
5646d1a98e54SPaul Wernau if (outer_ipv4 != NULL)
5647d1a98e54SPaul Wernau outer_ipv4 =
5648d1a98e54SPaul Wernau (ipha_t *)data_mp->b_rptr;
5649d1a98e54SPaul Wernau else
5650d1a98e54SPaul Wernau outer_ipv6 =
5651d1a98e54SPaul Wernau (ip6_t *)data_mp->b_rptr;
5652d1a98e54SPaul Wernau if (inner_ipv4 != NULL) {
5653d1a98e54SPaul Wernau inner_ipv4 =
5654d1a98e54SPaul Wernau (ipha_t *)(data_mp->b_rptr +
5655d1a98e54SPaul Wernau outer_hdr_len);
5656d1a98e54SPaul Wernau } else {
5657d1a98e54SPaul Wernau inner_ipv6 =
5658d1a98e54SPaul Wernau (ip6_t *)(data_mp->b_rptr +
5659d1a98e54SPaul Wernau outer_hdr_len);
5660d1a98e54SPaul Wernau }
5661d1a98e54SPaul Wernau }
5662d1a98e54SPaul Wernau
5663bd670b35SErik Nordmark /*
5664bd670b35SErik Nordmark * If we need to queue the packet. First we
5665bd670b35SErik Nordmark * get an mblk with the attributes. ipsec_fragcache_add
5666bd670b35SErik Nordmark * will prepend that to the queued data and return
5667bd670b35SErik Nordmark * a list of b_next messages each of which starts with
5668bd670b35SErik Nordmark * the attribute mblk.
5669bd670b35SErik Nordmark */
5670bd670b35SErik Nordmark mp = ip_recv_attr_to_mblk(ira);
5671bd670b35SErik Nordmark if (mp == NULL) {
5672bd670b35SErik Nordmark ip_drop_packet(data_mp, B_TRUE, NULL,
5673bd670b35SErik Nordmark DROPPER(ipss, ipds_spd_nomem),
5674bd670b35SErik Nordmark &ipss->ipsec_spd_dropper);
5675bd670b35SErik Nordmark return (NULL);
5676bd670b35SErik Nordmark }
5677d1a98e54SPaul Wernau
5678bd670b35SErik Nordmark mp = ipsec_fragcache_add(&itp->itp_fragcache,
5679bd670b35SErik Nordmark mp, data_mp, outer_hdr_len, ipss);
56808810c16bSdanmcd
5681bd670b35SErik Nordmark if (mp == NULL) {
56828810c16bSdanmcd /*
56838810c16bSdanmcd * Data is cached, fragment chain is not
5684bd670b35SErik Nordmark * complete.
56858810c16bSdanmcd */
5686bd670b35SErik Nordmark return (NULL);
56878810c16bSdanmcd }
56888810c16bSdanmcd
56898810c16bSdanmcd /*
56908810c16bSdanmcd * If we get here, we have a full fragment chain.
56918810c16bSdanmcd * Reacquire headers and selectors from first fragment.
56928810c16bSdanmcd */
5693bd670b35SErik Nordmark ASSERT(ip_recv_attr_is_mblk(mp));
5694bd670b35SErik Nordmark data_mp = mp->b_cont;
5695bd670b35SErik Nordmark inner_hdr = data_mp->b_rptr;
56962b24ab6bSSebastien Roy if (outer_ipv4 != NULL) {
56972b24ab6bSSebastien Roy inner_hdr += IPH_HDR_LENGTH(
5698bd670b35SErik Nordmark (ipha_t *)data_mp->b_rptr);
56998810c16bSdanmcd } else {
5700bd670b35SErik Nordmark inner_hdr += ip_hdr_length_v6(data_mp,
5701bd670b35SErik Nordmark (ip6_t *)data_mp->b_rptr);
57028810c16bSdanmcd }
5703bd670b35SErik Nordmark ASSERT(inner_hdr <= data_mp->b_wptr);
57042b24ab6bSSebastien Roy
57052b24ab6bSSebastien Roy if (inner_ipv4 != NULL) {
57062b24ab6bSSebastien Roy inner_ipv4 = (ipha_t *)inner_hdr;
57072b24ab6bSSebastien Roy inner_ipv6 = NULL;
57082b24ab6bSSebastien Roy } else {
57092b24ab6bSSebastien Roy inner_ipv6 = (ip6_t *)inner_hdr;
57102b24ab6bSSebastien Roy inner_ipv4 = NULL;
57112b24ab6bSSebastien Roy }
57122b24ab6bSSebastien Roy
57132b24ab6bSSebastien Roy /*
57142b24ab6bSSebastien Roy * Use SEL_TUNNEL_MODE to take into account the outer
57152b24ab6bSSebastien Roy * header. Use SEL_POST_FRAG so we always get ports.
57162b24ab6bSSebastien Roy */
5717bd670b35SErik Nordmark rc = ipsec_init_inbound_sel(&sel, data_mp,
57182b24ab6bSSebastien Roy inner_ipv4, inner_ipv6,
57192b24ab6bSSebastien Roy SEL_TUNNEL_MODE | SEL_POST_FRAG);
57208810c16bSdanmcd switch (rc) {
57218810c16bSdanmcd case SELRET_SUCCESS:
57228810c16bSdanmcd /*
57238810c16bSdanmcd * Get to same place as first caller's
57248810c16bSdanmcd * SELRET_SUCCESS case.
57258810c16bSdanmcd */
57268810c16bSdanmcd break;
57278810c16bSdanmcd case SELRET_NOMEM:
5728bd670b35SErik Nordmark ip_drop_packet_chain(mp, B_TRUE, NULL,
5729f4b3ec61Sdh155122 DROPPER(ipss, ipds_spd_nomem),
5730f4b3ec61Sdh155122 &ipss->ipsec_spd_dropper);
5731bd670b35SErik Nordmark return (NULL);
57328810c16bSdanmcd case SELRET_BADPKT:
5733bd670b35SErik Nordmark ip_drop_packet_chain(mp, B_TRUE, NULL,
5734f4b3ec61Sdh155122 DROPPER(ipss, ipds_spd_malformed_frag),
5735f4b3ec61Sdh155122 &ipss->ipsec_spd_dropper);
5736bd670b35SErik Nordmark return (NULL);
57378810c16bSdanmcd case SELRET_TUNFRAG:
57388810c16bSdanmcd cmn_err(CE_WARN, "(TUNFRAG on 2nd call...)");
57398810c16bSdanmcd /* FALLTHRU */
57408810c16bSdanmcd default:
57418810c16bSdanmcd cmn_err(CE_WARN, "ipsec_init_inbound_sel(mark2)"
57428810c16bSdanmcd " returns bizarro 0x%x", rc);
57438810c16bSdanmcd /* Guaranteed panic! */
57448810c16bSdanmcd ASSERT(rc == SELRET_NOMEM);
5745bd670b35SErik Nordmark return (NULL);
57468810c16bSdanmcd }
57478810c16bSdanmcd /* FALLTHRU */
57488810c16bSdanmcd case SELRET_SUCCESS:
57498810c16bSdanmcd /*
57508810c16bSdanmcd * Common case:
57518810c16bSdanmcd * No per-port policy or a non-fragment. Keep going.
57528810c16bSdanmcd */
57538810c16bSdanmcd break;
57548810c16bSdanmcd case SELRET_BADPKT:
57558810c16bSdanmcd /*
57568810c16bSdanmcd * We may receive ICMP (with IPv6 inner) packets that
57578810c16bSdanmcd * trigger this return value. Send 'em in for
57588810c16bSdanmcd * enforcement checking.
57598810c16bSdanmcd */
57608810c16bSdanmcd cmn_err(CE_NOTE, "ipsec_tun_inbound(): "
57618810c16bSdanmcd "sending 'bad packet' in for enforcement");
57628810c16bSdanmcd break;
57638810c16bSdanmcd default:
57648810c16bSdanmcd cmn_err(CE_WARN,
57658810c16bSdanmcd "ipsec_init_inbound_sel() returns bizarro 0x%x",
57668810c16bSdanmcd rc);
57678810c16bSdanmcd ASSERT(rc == SELRET_NOMEM); /* Guaranteed panic! */
5768bd670b35SErik Nordmark return (NULL);
57698810c16bSdanmcd }
57708810c16bSdanmcd
57718810c16bSdanmcd if (is_icmp) {
57728810c16bSdanmcd /*
57738810c16bSdanmcd * Swap local/remote because this is an ICMP packet.
57748810c16bSdanmcd */
57758810c16bSdanmcd tmpaddr = sel.ips_local_addr_v6;
57768810c16bSdanmcd sel.ips_local_addr_v6 = sel.ips_remote_addr_v6;
57778810c16bSdanmcd sel.ips_remote_addr_v6 = tmpaddr;
57788810c16bSdanmcd tmpport = sel.ips_local_port;
57798810c16bSdanmcd sel.ips_local_port = sel.ips_remote_port;
57808810c16bSdanmcd sel.ips_remote_port = tmpport;
57818810c16bSdanmcd }
57828810c16bSdanmcd
57838810c16bSdanmcd /* find_policy_head() */
57848810c16bSdanmcd rw_enter(&polhead->iph_lock, RW_READER);
57858810c16bSdanmcd pol = ipsec_find_policy_head(NULL, polhead, IPSEC_TYPE_INBOUND,
5786bd670b35SErik Nordmark &sel);
57878810c16bSdanmcd rw_exit(&polhead->iph_lock);
57888810c16bSdanmcd if (pol != NULL) {
5789bd670b35SErik Nordmark uint64_t pkt_unique;
5790bd670b35SErik Nordmark
5791bd670b35SErik Nordmark if (!(ira->ira_flags & IRAF_IPSEC_SECURE)) {
5792bd670b35SErik Nordmark if (!pol->ipsp_act->ipa_allow_clear) {
57938810c16bSdanmcd /*
57948810c16bSdanmcd * XXX should never get here with
57958810c16bSdanmcd * tunnel reassembled fragments?
57968810c16bSdanmcd */
5797bd670b35SErik Nordmark ASSERT(mp == data_mp);
5798bd670b35SErik Nordmark ip_drop_packet(data_mp, B_TRUE, NULL,
5799f4b3ec61Sdh155122 DROPPER(ipss, ipds_spd_got_clear),
5800f4b3ec61Sdh155122 &ipss->ipsec_spd_dropper);
5801bd670b35SErik Nordmark IPPOL_REFRELE(pol);
5802bd670b35SErik Nordmark return (NULL);
5803bd670b35SErik Nordmark } else {
5804bd670b35SErik Nordmark IPPOL_REFRELE(pol);
5805bd670b35SErik Nordmark return (mp);
58068810c16bSdanmcd }
5807bd670b35SErik Nordmark }
5808bd670b35SErik Nordmark pkt_unique = SA_UNIQUE_ID(sel.ips_remote_port,
5809bd670b35SErik Nordmark sel.ips_local_port,
5810bd670b35SErik Nordmark (inner_ipv4 == NULL) ? IPPROTO_IPV6 :
5811bd670b35SErik Nordmark IPPROTO_ENCAP, sel.ips_protocol);
58128810c16bSdanmcd
58138810c16bSdanmcd /*
58148810c16bSdanmcd * NOTE: The following releases pol's reference and
58158810c16bSdanmcd * calls ip_drop_packet() for me on NULL returns.
58168810c16bSdanmcd *
58178810c16bSdanmcd * "sel" is still good here, so let's use it!
58188810c16bSdanmcd */
5819bd670b35SErik Nordmark if (data_mp == mp) {
5820bd670b35SErik Nordmark /* A single packet without attributes */
5821bd670b35SErik Nordmark data_mp = ipsec_check_ipsecin_policy(data_mp,
5822bd670b35SErik Nordmark pol, inner_ipv4, inner_ipv6, pkt_unique,
5823bd670b35SErik Nordmark ira, ns);
5824bd670b35SErik Nordmark } else {
5825bd670b35SErik Nordmark /*
5826bd670b35SErik Nordmark * We pass in the b_next chain of attr_mp's
5827bd670b35SErik Nordmark * and get back a b_next chain of data_mp's.
5828bd670b35SErik Nordmark */
5829bd670b35SErik Nordmark data_mp = ipsec_check_ipsecin_policy_reasm(mp,
5830bd670b35SErik Nordmark pol, inner_ipv4, inner_ipv6, pkt_unique,
5831bd670b35SErik Nordmark ns);
5832bd670b35SErik Nordmark }
5833bd670b35SErik Nordmark return (data_mp);
58348810c16bSdanmcd }
58358810c16bSdanmcd
58368810c16bSdanmcd /*
58378810c16bSdanmcd * Else fallthru and check the global policy on the outer
58388810c16bSdanmcd * header(s) if this tunnel is an old-style transport-mode
58398810c16bSdanmcd * one. Drop the packet explicitly (no policy entry) for
58408810c16bSdanmcd * a new-style tunnel-mode tunnel.
58418810c16bSdanmcd */
58428810c16bSdanmcd if ((itp->itp_flags & ITPF_P_TUNNEL) && !is_icmp) {
5843bd670b35SErik Nordmark ip_drop_packet_chain(data_mp, B_TRUE, NULL,
5844f4b3ec61Sdh155122 DROPPER(ipss, ipds_spd_explicit),
5845f4b3ec61Sdh155122 &ipss->ipsec_spd_dropper);
5846bd670b35SErik Nordmark return (NULL);
58478810c16bSdanmcd }
58488810c16bSdanmcd }
58498810c16bSdanmcd
58508810c16bSdanmcd /*
58518810c16bSdanmcd * NOTE: If we reach here, we will not have packet chains from
58528810c16bSdanmcd * fragcache_add(), because the only way I get chains is on a
58538810c16bSdanmcd * tunnel-mode tunnel, which either returns with a pass, or gets
58548810c16bSdanmcd * hit by the ip_drop_packet_chain() call right above here.
58558810c16bSdanmcd */
5856bd670b35SErik Nordmark ASSERT(data_mp->b_next == NULL);
58578810c16bSdanmcd
58588810c16bSdanmcd /* If no per-tunnel security, check global policy now. */
5859bd670b35SErik Nordmark if ((ira->ira_flags & IRAF_IPSEC_SECURE) && !global_present) {
5860bd670b35SErik Nordmark if (ira->ira_flags & IRAF_TRUSTED_ICMP) {
58618810c16bSdanmcd /*
5862bd670b35SErik Nordmark * This is an ICMP message that was geenrated locally.
5863bd670b35SErik Nordmark * We should accept it.
58648810c16bSdanmcd */
5865bd670b35SErik Nordmark return (data_mp);
58668810c16bSdanmcd }
58678810c16bSdanmcd
5868bd670b35SErik Nordmark ip_drop_packet(data_mp, B_TRUE, NULL,
5869f4b3ec61Sdh155122 DROPPER(ipss, ipds_spd_got_secure),
5870f4b3ec61Sdh155122 &ipss->ipsec_spd_dropper);
5871bd670b35SErik Nordmark return (NULL);
58728810c16bSdanmcd }
58738810c16bSdanmcd
5874a8e50c3eSdanmcd if (is_icmp) {
5875a8e50c3eSdanmcd /*
5876a8e50c3eSdanmcd * For ICMP packets, "outer_ipvN" is set to the outer header
5877a8e50c3eSdanmcd * that is *INSIDE* the ICMP payload. For global policy
5878a8e50c3eSdanmcd * checking, we need to reverse src/dst on the payload in
5879a8e50c3eSdanmcd * order to construct selectors appropriately. See "ripha"
5880a8e50c3eSdanmcd * constructions in ip.c. To avoid a bug like 6478464 (see
5881a8e50c3eSdanmcd * earlier in this file), we will actually exchange src/dst
5882a8e50c3eSdanmcd * in the packet, and reverse if after the call to
5883a8e50c3eSdanmcd * ipsec_check_global_policy().
5884a8e50c3eSdanmcd */
5885a8e50c3eSdanmcd if (outer_ipv4 != NULL) {
5886a8e50c3eSdanmcd tmp4 = outer_ipv4->ipha_src;
5887a8e50c3eSdanmcd outer_ipv4->ipha_src = outer_ipv4->ipha_dst;
5888a8e50c3eSdanmcd outer_ipv4->ipha_dst = tmp4;
5889a8e50c3eSdanmcd } else {
5890a8e50c3eSdanmcd ASSERT(outer_ipv6 != NULL);
5891a8e50c3eSdanmcd tmpaddr = outer_ipv6->ip6_src;
5892a8e50c3eSdanmcd outer_ipv6->ip6_src = outer_ipv6->ip6_dst;
5893a8e50c3eSdanmcd outer_ipv6->ip6_dst = tmpaddr;
5894a8e50c3eSdanmcd }
5895a8e50c3eSdanmcd }
5896a8e50c3eSdanmcd
5897bd670b35SErik Nordmark data_mp = ipsec_check_global_policy(data_mp, NULL, outer_ipv4,
5898bd670b35SErik Nordmark outer_ipv6, ira, ns);
5899bd670b35SErik Nordmark if (data_mp == NULL)
5900bd670b35SErik Nordmark return (NULL);
59018810c16bSdanmcd
5902a8e50c3eSdanmcd if (is_icmp) {
5903a8e50c3eSdanmcd /* Set things back to normal. */
5904a8e50c3eSdanmcd if (outer_ipv4 != NULL) {
5905a8e50c3eSdanmcd tmp4 = outer_ipv4->ipha_src;
5906a8e50c3eSdanmcd outer_ipv4->ipha_src = outer_ipv4->ipha_dst;
5907a8e50c3eSdanmcd outer_ipv4->ipha_dst = tmp4;
5908a8e50c3eSdanmcd } else {
5909a8e50c3eSdanmcd /* No need for ASSERT()s now. */
5910a8e50c3eSdanmcd tmpaddr = outer_ipv6->ip6_src;
5911a8e50c3eSdanmcd outer_ipv6->ip6_src = outer_ipv6->ip6_dst;
5912a8e50c3eSdanmcd outer_ipv6->ip6_dst = tmpaddr;
5913a8e50c3eSdanmcd }
5914a8e50c3eSdanmcd }
5915a8e50c3eSdanmcd
59168810c16bSdanmcd /*
59178810c16bSdanmcd * At this point, we pretend it's a cleartext accepted
59188810c16bSdanmcd * packet.
59198810c16bSdanmcd */
5920bd670b35SErik Nordmark return (data_mp);
59218810c16bSdanmcd }
59228810c16bSdanmcd
59238810c16bSdanmcd /*
59248810c16bSdanmcd * AVL comparison routine for our list of tunnel polheads.
59258810c16bSdanmcd */
59268810c16bSdanmcd static int
tunnel_compare(const void * arg1,const void * arg2)59278810c16bSdanmcd tunnel_compare(const void *arg1, const void *arg2)
59288810c16bSdanmcd {
59298810c16bSdanmcd ipsec_tun_pol_t *left, *right;
59308810c16bSdanmcd int rc;
59318810c16bSdanmcd
59328810c16bSdanmcd left = (ipsec_tun_pol_t *)arg1;
59338810c16bSdanmcd right = (ipsec_tun_pol_t *)arg2;
59348810c16bSdanmcd
59358810c16bSdanmcd rc = strncmp(left->itp_name, right->itp_name, LIFNAMSIZ);
59368810c16bSdanmcd return (rc == 0 ? rc : (rc > 0 ? 1 : -1));
59378810c16bSdanmcd }
59388810c16bSdanmcd
59398810c16bSdanmcd /*
59408810c16bSdanmcd * Free a tunnel policy node.
59418810c16bSdanmcd */
59428810c16bSdanmcd void
itp_free(ipsec_tun_pol_t * node,netstack_t * ns)5943f4b3ec61Sdh155122 itp_free(ipsec_tun_pol_t *node, netstack_t *ns)
59448810c16bSdanmcd {
59452b24ab6bSSebastien Roy if (node->itp_policy != NULL) {
5946f4b3ec61Sdh155122 IPPH_REFRELE(node->itp_policy, ns);
59472b24ab6bSSebastien Roy node->itp_policy = NULL;
59482b24ab6bSSebastien Roy }
59492b24ab6bSSebastien Roy if (node->itp_inactive != NULL) {
5950f4b3ec61Sdh155122 IPPH_REFRELE(node->itp_inactive, ns);
59512b24ab6bSSebastien Roy node->itp_inactive = NULL;
59522b24ab6bSSebastien Roy }
59538810c16bSdanmcd mutex_destroy(&node->itp_lock);
59548810c16bSdanmcd kmem_free(node, sizeof (*node));
59558810c16bSdanmcd }
59568810c16bSdanmcd
59578810c16bSdanmcd void
itp_unlink(ipsec_tun_pol_t * node,netstack_t * ns)5958f4b3ec61Sdh155122 itp_unlink(ipsec_tun_pol_t *node, netstack_t *ns)
59598810c16bSdanmcd {
5960f4b3ec61Sdh155122 ipsec_stack_t *ipss = ns->netstack_ipsec;
5961f4b3ec61Sdh155122
5962f4b3ec61Sdh155122 rw_enter(&ipss->ipsec_tunnel_policy_lock, RW_WRITER);
5963f4b3ec61Sdh155122 ipss->ipsec_tunnel_policy_gen++;
5964bd670b35SErik Nordmark ipsec_fragcache_uninit(&node->itp_fragcache, ipss);
5965f4b3ec61Sdh155122 avl_remove(&ipss->ipsec_tunnel_policies, node);
5966f4b3ec61Sdh155122 rw_exit(&ipss->ipsec_tunnel_policy_lock);
5967f4b3ec61Sdh155122 ITP_REFRELE(node, ns);
59688810c16bSdanmcd }
59698810c16bSdanmcd
59708810c16bSdanmcd /*
59718810c16bSdanmcd * Public interface to look up a tunnel security policy by name. Used by
59728810c16bSdanmcd * spdsock mostly. Returns "node" with a bumped refcnt.
59738810c16bSdanmcd */
59748810c16bSdanmcd ipsec_tun_pol_t *
get_tunnel_policy(char * name,netstack_t * ns)5975f4b3ec61Sdh155122 get_tunnel_policy(char *name, netstack_t *ns)
59768810c16bSdanmcd {
59778810c16bSdanmcd ipsec_tun_pol_t *node, lookup;
5978f4b3ec61Sdh155122 ipsec_stack_t *ipss = ns->netstack_ipsec;
59798810c16bSdanmcd
59808810c16bSdanmcd (void) strncpy(lookup.itp_name, name, LIFNAMSIZ);
59818810c16bSdanmcd
5982f4b3ec61Sdh155122 rw_enter(&ipss->ipsec_tunnel_policy_lock, RW_READER);
5983f4b3ec61Sdh155122 node = (ipsec_tun_pol_t *)avl_find(&ipss->ipsec_tunnel_policies,
5984f4b3ec61Sdh155122 &lookup, NULL);
59858810c16bSdanmcd if (node != NULL) {
59868810c16bSdanmcd ITP_REFHOLD(node);
59878810c16bSdanmcd }
5988f4b3ec61Sdh155122 rw_exit(&ipss->ipsec_tunnel_policy_lock);
59898810c16bSdanmcd
59908810c16bSdanmcd return (node);
59918810c16bSdanmcd }
59928810c16bSdanmcd
59938810c16bSdanmcd /*
59948810c16bSdanmcd * Public interface to walk all tunnel security polcies. Useful for spdsock
59958810c16bSdanmcd * DUMP operations. iterator() will not consume a reference.
59968810c16bSdanmcd */
59978810c16bSdanmcd void
itp_walk(void (* iterator)(ipsec_tun_pol_t *,void *,netstack_t *),void * arg,netstack_t * ns)5998f4b3ec61Sdh155122 itp_walk(void (*iterator)(ipsec_tun_pol_t *, void *, netstack_t *),
5999f4b3ec61Sdh155122 void *arg, netstack_t *ns)
60008810c16bSdanmcd {
60018810c16bSdanmcd ipsec_tun_pol_t *node;
6002f4b3ec61Sdh155122 ipsec_stack_t *ipss = ns->netstack_ipsec;
60038810c16bSdanmcd
6004f4b3ec61Sdh155122 rw_enter(&ipss->ipsec_tunnel_policy_lock, RW_READER);
6005f4b3ec61Sdh155122 for (node = avl_first(&ipss->ipsec_tunnel_policies); node != NULL;
6006f4b3ec61Sdh155122 node = AVL_NEXT(&ipss->ipsec_tunnel_policies, node)) {
6007f4b3ec61Sdh155122 iterator(node, arg, ns);
60088810c16bSdanmcd }
6009f4b3ec61Sdh155122 rw_exit(&ipss->ipsec_tunnel_policy_lock);
60108810c16bSdanmcd }
60118810c16bSdanmcd
60128810c16bSdanmcd /*
60138810c16bSdanmcd * Initialize policy head. This can only fail if there's a memory problem.
60148810c16bSdanmcd */
60158810c16bSdanmcd static boolean_t
tunnel_polhead_init(ipsec_policy_head_t * iph,netstack_t * ns)6016f4b3ec61Sdh155122 tunnel_polhead_init(ipsec_policy_head_t *iph, netstack_t *ns)
60178810c16bSdanmcd {
6018f4b3ec61Sdh155122 ipsec_stack_t *ipss = ns->netstack_ipsec;
6019f4b3ec61Sdh155122
60208810c16bSdanmcd rw_init(&iph->iph_lock, NULL, RW_DEFAULT, NULL);
60218810c16bSdanmcd iph->iph_refs = 1;
60228810c16bSdanmcd iph->iph_gen = 0;
6023f4b3ec61Sdh155122 if (ipsec_alloc_table(iph, ipss->ipsec_tun_spd_hashsize,
6024f4b3ec61Sdh155122 KM_SLEEP, B_FALSE, ns) != 0) {
60258810c16bSdanmcd ipsec_polhead_free_table(iph);
60268810c16bSdanmcd return (B_FALSE);
60278810c16bSdanmcd }
6028f4b3ec61Sdh155122 ipsec_polhead_init(iph, ipss->ipsec_tun_spd_hashsize);
60298810c16bSdanmcd return (B_TRUE);
60308810c16bSdanmcd }
60318810c16bSdanmcd
60328810c16bSdanmcd /*
60338810c16bSdanmcd * Create a tunnel policy node with "name". Set errno with
60348810c16bSdanmcd * ENOMEM if there's a memory problem, and EEXIST if there's an existing
60358810c16bSdanmcd * node.
60368810c16bSdanmcd */
60378810c16bSdanmcd ipsec_tun_pol_t *
create_tunnel_policy(char * name,int * errno,uint64_t * gen,netstack_t * ns)6038f4b3ec61Sdh155122 create_tunnel_policy(char *name, int *errno, uint64_t *gen, netstack_t *ns)
60398810c16bSdanmcd {
60408810c16bSdanmcd ipsec_tun_pol_t *newbie, *existing;
60418810c16bSdanmcd avl_index_t where;
6042f4b3ec61Sdh155122 ipsec_stack_t *ipss = ns->netstack_ipsec;
60438810c16bSdanmcd
60448810c16bSdanmcd newbie = kmem_zalloc(sizeof (*newbie), KM_NOSLEEP);
60458810c16bSdanmcd if (newbie == NULL) {
60468810c16bSdanmcd *errno = ENOMEM;
60478810c16bSdanmcd return (NULL);
60488810c16bSdanmcd }
60498810c16bSdanmcd if (!ipsec_fragcache_init(&newbie->itp_fragcache)) {
60508810c16bSdanmcd kmem_free(newbie, sizeof (*newbie));
60518810c16bSdanmcd *errno = ENOMEM;
60528810c16bSdanmcd return (NULL);
60538810c16bSdanmcd }
60548810c16bSdanmcd
60558810c16bSdanmcd (void) strncpy(newbie->itp_name, name, LIFNAMSIZ);
60568810c16bSdanmcd
6057f4b3ec61Sdh155122 rw_enter(&ipss->ipsec_tunnel_policy_lock, RW_WRITER);
6058f4b3ec61Sdh155122 existing = (ipsec_tun_pol_t *)avl_find(&ipss->ipsec_tunnel_policies,
6059f4b3ec61Sdh155122 newbie, &where);
60608810c16bSdanmcd if (existing != NULL) {
6061f4b3ec61Sdh155122 itp_free(newbie, ns);
60628810c16bSdanmcd *errno = EEXIST;
6063f4b3ec61Sdh155122 rw_exit(&ipss->ipsec_tunnel_policy_lock);
60648810c16bSdanmcd return (NULL);
60658810c16bSdanmcd }
6066f4b3ec61Sdh155122 ipss->ipsec_tunnel_policy_gen++;
6067f4b3ec61Sdh155122 *gen = ipss->ipsec_tunnel_policy_gen;
60688810c16bSdanmcd newbie->itp_refcnt = 2; /* One for the caller, one for the tree. */
60698810c16bSdanmcd newbie->itp_next_policy_index = 1;
6070f4b3ec61Sdh155122 avl_insert(&ipss->ipsec_tunnel_policies, newbie, where);
60718810c16bSdanmcd mutex_init(&newbie->itp_lock, NULL, MUTEX_DEFAULT, NULL);
60728810c16bSdanmcd newbie->itp_policy = kmem_zalloc(sizeof (ipsec_policy_head_t),
60738810c16bSdanmcd KM_NOSLEEP);
60748810c16bSdanmcd if (newbie->itp_policy == NULL)
60758810c16bSdanmcd goto nomem;
60768810c16bSdanmcd newbie->itp_inactive = kmem_zalloc(sizeof (ipsec_policy_head_t),
60778810c16bSdanmcd KM_NOSLEEP);
60788810c16bSdanmcd if (newbie->itp_inactive == NULL) {
6079489e6c7eSdanmcd kmem_free(newbie->itp_policy, sizeof (ipsec_policy_head_t));
60808810c16bSdanmcd goto nomem;
60818810c16bSdanmcd }
60828810c16bSdanmcd
6083f4b3ec61Sdh155122 if (!tunnel_polhead_init(newbie->itp_policy, ns)) {
60848810c16bSdanmcd kmem_free(newbie->itp_policy, sizeof (ipsec_policy_head_t));
60858810c16bSdanmcd kmem_free(newbie->itp_inactive, sizeof (ipsec_policy_head_t));
60868810c16bSdanmcd goto nomem;
6087f4b3ec61Sdh155122 } else if (!tunnel_polhead_init(newbie->itp_inactive, ns)) {
6088f4b3ec61Sdh155122 IPPH_REFRELE(newbie->itp_policy, ns);
60898810c16bSdanmcd kmem_free(newbie->itp_inactive, sizeof (ipsec_policy_head_t));
60908810c16bSdanmcd goto nomem;
60918810c16bSdanmcd }
6092f4b3ec61Sdh155122 rw_exit(&ipss->ipsec_tunnel_policy_lock);
60938810c16bSdanmcd
60948810c16bSdanmcd return (newbie);
60958810c16bSdanmcd nomem:
60968810c16bSdanmcd *errno = ENOMEM;
60978810c16bSdanmcd kmem_free(newbie, sizeof (*newbie));
60988810c16bSdanmcd return (NULL);
60998810c16bSdanmcd }
61008810c16bSdanmcd
61018810c16bSdanmcd /*
61022b24ab6bSSebastien Roy * Given two addresses, find a tunnel instance's IPsec policy heads.
61032b24ab6bSSebastien Roy * Returns NULL on failure.
61048810c16bSdanmcd */
61058810c16bSdanmcd ipsec_tun_pol_t *
itp_get_byaddr(uint32_t * laddr,uint32_t * faddr,int af,ip_stack_t * ipst)61062b24ab6bSSebastien Roy itp_get_byaddr(uint32_t *laddr, uint32_t *faddr, int af, ip_stack_t *ipst)
61078810c16bSdanmcd {
61082b24ab6bSSebastien Roy conn_t *connp;
61092b24ab6bSSebastien Roy iptun_t *iptun;
61102b24ab6bSSebastien Roy ipsec_tun_pol_t *itp = NULL;
61112b24ab6bSSebastien Roy
61122b24ab6bSSebastien Roy /* Classifiers are used to "src" being foreign. */
61132b24ab6bSSebastien Roy if (af == AF_INET) {
61142b24ab6bSSebastien Roy connp = ipcl_iptun_classify_v4((ipaddr_t *)faddr,
61152b24ab6bSSebastien Roy (ipaddr_t *)laddr, ipst);
61162b24ab6bSSebastien Roy } else {
61172b24ab6bSSebastien Roy ASSERT(af == AF_INET6);
61182b24ab6bSSebastien Roy ASSERT(!IN6_IS_ADDR_V4MAPPED((in6_addr_t *)laddr));
61192b24ab6bSSebastien Roy ASSERT(!IN6_IS_ADDR_V4MAPPED((in6_addr_t *)faddr));
61202b24ab6bSSebastien Roy connp = ipcl_iptun_classify_v6((in6_addr_t *)faddr,
61212b24ab6bSSebastien Roy (in6_addr_t *)laddr, ipst);
61222b24ab6bSSebastien Roy }
61232b24ab6bSSebastien Roy
61242b24ab6bSSebastien Roy if (connp == NULL)
61252b24ab6bSSebastien Roy return (NULL);
61262b24ab6bSSebastien Roy
61272b24ab6bSSebastien Roy if (IPCL_IS_IPTUN(connp)) {
61282b24ab6bSSebastien Roy iptun = connp->conn_iptun;
61292b24ab6bSSebastien Roy if (iptun != NULL) {
61302b24ab6bSSebastien Roy itp = iptun->iptun_itp;
61312b24ab6bSSebastien Roy if (itp != NULL) {
61322b24ab6bSSebastien Roy /* Braces due to the macro's nature... */
61332b24ab6bSSebastien Roy ITP_REFHOLD(itp);
61342b24ab6bSSebastien Roy }
61352b24ab6bSSebastien Roy } /* Else itp is already NULL. */
61362b24ab6bSSebastien Roy }
61372b24ab6bSSebastien Roy
61382b24ab6bSSebastien Roy CONN_DEC_REF(connp);
61392b24ab6bSSebastien Roy return (itp);
61408810c16bSdanmcd }
61418810c16bSdanmcd
61428810c16bSdanmcd /*
61438810c16bSdanmcd * Frag cache code, based on SunScreen 3.2 source
61448810c16bSdanmcd * screen/kernel/common/screen_fragcache.c
61458810c16bSdanmcd */
61468810c16bSdanmcd
61478810c16bSdanmcd #define IPSEC_FRAG_TTL_MAX 5
61488810c16bSdanmcd /*
61498810c16bSdanmcd * Note that the following parameters create 256 hash buckets
61508810c16bSdanmcd * with 1024 free entries to be distributed. Things are cleaned
61518810c16bSdanmcd * periodically and are attempted to be cleaned when there is no
61528810c16bSdanmcd * free space, but this system errs on the side of dropping packets
61538810c16bSdanmcd * over creating memory exhaustion. We may decide to make hash
61548810c16bSdanmcd * factor a tunable if this proves to be a bad decision.
61558810c16bSdanmcd */
61568810c16bSdanmcd #define IPSEC_FRAG_HASH_SLOTS (1<<8)
61578810c16bSdanmcd #define IPSEC_FRAG_HASH_FACTOR 4
61588810c16bSdanmcd #define IPSEC_FRAG_HASH_SIZE (IPSEC_FRAG_HASH_SLOTS * IPSEC_FRAG_HASH_FACTOR)
61598810c16bSdanmcd
61608810c16bSdanmcd #define IPSEC_FRAG_HASH_MASK (IPSEC_FRAG_HASH_SLOTS - 1)
61618810c16bSdanmcd #define IPSEC_FRAG_HASH_FUNC(id) (((id) & IPSEC_FRAG_HASH_MASK) ^ \
61628810c16bSdanmcd (((id) / \
61638810c16bSdanmcd (ushort_t)IPSEC_FRAG_HASH_SLOTS) & \
61648810c16bSdanmcd IPSEC_FRAG_HASH_MASK))
61658810c16bSdanmcd
61668810c16bSdanmcd /* Maximum fragments per packet. 48 bytes payload x 1366 packets > 64KB */
61678810c16bSdanmcd #define IPSEC_MAX_FRAGS 1366
61688810c16bSdanmcd
61698810c16bSdanmcd #define V4_FRAG_OFFSET(ipha) ((ntohs(ipha->ipha_fragment_offset_and_flags) & \
61708810c16bSdanmcd IPH_OFFSET) << 3)
61718810c16bSdanmcd #define V4_MORE_FRAGS(ipha) (ntohs(ipha->ipha_fragment_offset_and_flags) & \
61728810c16bSdanmcd IPH_MF)
61738810c16bSdanmcd
61748810c16bSdanmcd /*
61758810c16bSdanmcd * Initialize an ipsec fragcache instance.
61768810c16bSdanmcd * Returns B_FALSE if memory allocation fails.
61778810c16bSdanmcd */
61788810c16bSdanmcd boolean_t
ipsec_fragcache_init(ipsec_fragcache_t * frag)61798810c16bSdanmcd ipsec_fragcache_init(ipsec_fragcache_t *frag)
61808810c16bSdanmcd {
61818810c16bSdanmcd ipsec_fragcache_entry_t *ftemp;
61828810c16bSdanmcd int i;
61838810c16bSdanmcd
61848810c16bSdanmcd mutex_init(&frag->itpf_lock, NULL, MUTEX_DEFAULT, NULL);
61858810c16bSdanmcd frag->itpf_ptr = (ipsec_fragcache_entry_t **)
6186daa41a61Sdanmcd kmem_zalloc(sizeof (ipsec_fragcache_entry_t *) *
61878810c16bSdanmcd IPSEC_FRAG_HASH_SLOTS, KM_NOSLEEP);
61888810c16bSdanmcd if (frag->itpf_ptr == NULL)
61898810c16bSdanmcd return (B_FALSE);
61908810c16bSdanmcd
61918810c16bSdanmcd ftemp = (ipsec_fragcache_entry_t *)
61928810c16bSdanmcd kmem_zalloc(sizeof (ipsec_fragcache_entry_t) *
61938810c16bSdanmcd IPSEC_FRAG_HASH_SIZE, KM_NOSLEEP);
61948810c16bSdanmcd if (ftemp == NULL) {
6195daa41a61Sdanmcd kmem_free(frag->itpf_ptr, sizeof (ipsec_fragcache_entry_t *) *
61968810c16bSdanmcd IPSEC_FRAG_HASH_SLOTS);
61978810c16bSdanmcd return (B_FALSE);
61988810c16bSdanmcd }
61998810c16bSdanmcd
62008810c16bSdanmcd frag->itpf_freelist = NULL;
62018810c16bSdanmcd
62028810c16bSdanmcd for (i = 0; i < IPSEC_FRAG_HASH_SIZE; i++) {
62038810c16bSdanmcd ftemp->itpfe_next = frag->itpf_freelist;
62048810c16bSdanmcd frag->itpf_freelist = ftemp;
62058810c16bSdanmcd ftemp++;
62068810c16bSdanmcd }
62078810c16bSdanmcd
62088810c16bSdanmcd frag->itpf_expire_hint = 0;
62098810c16bSdanmcd
62108810c16bSdanmcd return (B_TRUE);
62118810c16bSdanmcd }
62128810c16bSdanmcd
62138810c16bSdanmcd void
ipsec_fragcache_uninit(ipsec_fragcache_t * frag,ipsec_stack_t * ipss)6214bd670b35SErik Nordmark ipsec_fragcache_uninit(ipsec_fragcache_t *frag, ipsec_stack_t *ipss)
62158810c16bSdanmcd {
62168810c16bSdanmcd ipsec_fragcache_entry_t *fep;
62178810c16bSdanmcd int i;
62188810c16bSdanmcd
62198810c16bSdanmcd mutex_enter(&frag->itpf_lock);
62208810c16bSdanmcd if (frag->itpf_ptr) {
62218810c16bSdanmcd /* Delete any existing fragcache entry chains */
62228810c16bSdanmcd for (i = 0; i < IPSEC_FRAG_HASH_SLOTS; i++) {
62238810c16bSdanmcd fep = (frag->itpf_ptr)[i];
62248810c16bSdanmcd while (fep != NULL) {
62258810c16bSdanmcd /* Returned fep is next in chain or NULL */
6226bd670b35SErik Nordmark fep = fragcache_delentry(i, fep, frag, ipss);
62278810c16bSdanmcd }
62288810c16bSdanmcd }
62298810c16bSdanmcd /*
62308810c16bSdanmcd * Chase the pointers back to the beginning
62318810c16bSdanmcd * of the memory allocation and then
62328810c16bSdanmcd * get rid of the allocated freelist
62338810c16bSdanmcd */
62348810c16bSdanmcd while (frag->itpf_freelist->itpfe_next != NULL)
62358810c16bSdanmcd frag->itpf_freelist = frag->itpf_freelist->itpfe_next;
62368810c16bSdanmcd /*
62378810c16bSdanmcd * XXX - If we ever dynamically grow the freelist
62388810c16bSdanmcd * then we'll have to free entries individually
62398810c16bSdanmcd * or determine how many entries or chunks we have
62408810c16bSdanmcd * grown since the initial allocation.
62418810c16bSdanmcd */
62428810c16bSdanmcd kmem_free(frag->itpf_freelist,
62438810c16bSdanmcd sizeof (ipsec_fragcache_entry_t) *
62448810c16bSdanmcd IPSEC_FRAG_HASH_SIZE);
62458810c16bSdanmcd /* Free the fragcache structure */
62468810c16bSdanmcd kmem_free(frag->itpf_ptr,
62478810c16bSdanmcd sizeof (ipsec_fragcache_entry_t *) *
62488810c16bSdanmcd IPSEC_FRAG_HASH_SLOTS);
62498810c16bSdanmcd }
62508810c16bSdanmcd mutex_exit(&frag->itpf_lock);
62518810c16bSdanmcd mutex_destroy(&frag->itpf_lock);
62528810c16bSdanmcd }
62538810c16bSdanmcd
62548810c16bSdanmcd /*
62558810c16bSdanmcd * Add a fragment to the fragment cache. Consumes mp if NULL is returned.
62568810c16bSdanmcd * Returns mp if a whole fragment has been assembled, NULL otherwise
6257bd670b35SErik Nordmark * The returned mp could be a b_next chain of fragments.
6258bd670b35SErik Nordmark *
6259bd670b35SErik Nordmark * The iramp argument is set on inbound; NULL if outbound.
62608810c16bSdanmcd */
62618810c16bSdanmcd mblk_t *
ipsec_fragcache_add(ipsec_fragcache_t * frag,mblk_t * iramp,mblk_t * mp,int outer_hdr_len,ipsec_stack_t * ipss)6262bd670b35SErik Nordmark ipsec_fragcache_add(ipsec_fragcache_t *frag, mblk_t *iramp, mblk_t *mp,
6263f4b3ec61Sdh155122 int outer_hdr_len, ipsec_stack_t *ipss)
62648810c16bSdanmcd {
62658810c16bSdanmcd boolean_t is_v4;
62668810c16bSdanmcd time_t itpf_time;
62678810c16bSdanmcd ipha_t *iph;
62688810c16bSdanmcd ipha_t *oiph;
62698810c16bSdanmcd ip6_t *ip6h = NULL;
62708810c16bSdanmcd uint8_t v6_proto;
62718810c16bSdanmcd uint8_t *v6_proto_p;
62728810c16bSdanmcd uint16_t ip6_hdr_length;
6273bd670b35SErik Nordmark ip_pkt_t ipp;
62748810c16bSdanmcd ip6_frag_t *fraghdr;
62758810c16bSdanmcd ipsec_fragcache_entry_t *fep;
62768810c16bSdanmcd int i;
627705d90a32SDan McDonald mblk_t *nmp, *prevmp;
62788810c16bSdanmcd int firstbyte, lastbyte;
62798810c16bSdanmcd int offset;
62808810c16bSdanmcd int last;
6281bd670b35SErik Nordmark boolean_t inbound = (iramp != NULL);
62828810c16bSdanmcd
6283d1a98e54SPaul Wernau #ifdef FRAGCACHE_DEBUG
6284d1a98e54SPaul Wernau cmn_err(CE_WARN, "Fragcache: %s\n", inbound ? "INBOUND" : "OUTBOUND");
6285d1a98e54SPaul Wernau #endif
6286ab82c29bSToomas Soome v6_proto = 0;
6287ab82c29bSToomas Soome fraghdr = NULL;
6288ab82c29bSToomas Soome
628905d90a32SDan McDonald /*
629005d90a32SDan McDonald * You're on the slow path, so insure that every packet in the
629105d90a32SDan McDonald * cache is a single-mblk one.
629205d90a32SDan McDonald */
629305d90a32SDan McDonald if (mp->b_cont != NULL) {
629405d90a32SDan McDonald nmp = msgpullup(mp, -1);
629505d90a32SDan McDonald if (nmp == NULL) {
6296bd670b35SErik Nordmark ip_drop_packet(mp, inbound, NULL,
6297f4b3ec61Sdh155122 DROPPER(ipss, ipds_spd_nomem),
6298f4b3ec61Sdh155122 &ipss->ipsec_spd_dropper);
6299bd670b35SErik Nordmark if (inbound)
6300bd670b35SErik Nordmark (void) ip_recv_attr_free_mblk(iramp);
63018810c16bSdanmcd return (NULL);
63028810c16bSdanmcd }
630305d90a32SDan McDonald freemsg(mp);
630405d90a32SDan McDonald mp = nmp;
630505d90a32SDan McDonald }
63068810c16bSdanmcd
630705d90a32SDan McDonald mutex_enter(&frag->itpf_lock);
630805d90a32SDan McDonald
630905d90a32SDan McDonald oiph = (ipha_t *)mp->b_rptr;
631005d90a32SDan McDonald iph = (ipha_t *)(mp->b_rptr + outer_hdr_len);
631105d90a32SDan McDonald
631205d90a32SDan McDonald if (IPH_HDR_VERSION(iph) == IPV4_VERSION) {
631305d90a32SDan McDonald is_v4 = B_TRUE;
631405d90a32SDan McDonald } else {
631505d90a32SDan McDonald ASSERT(IPH_HDR_VERSION(iph) == IPV6_VERSION);
631605d90a32SDan McDonald ip6h = (ip6_t *)(mp->b_rptr + outer_hdr_len);
631705d90a32SDan McDonald
631805d90a32SDan McDonald if (!ip_hdr_length_nexthdr_v6(mp, ip6h, &ip6_hdr_length,
63198810c16bSdanmcd &v6_proto_p)) {
63208810c16bSdanmcd /*
63218810c16bSdanmcd * Find upper layer protocol.
63228810c16bSdanmcd * If it fails we have a malformed packet
63238810c16bSdanmcd */
63248810c16bSdanmcd mutex_exit(&frag->itpf_lock);
6325bd670b35SErik Nordmark ip_drop_packet(mp, inbound, NULL,
6326f4b3ec61Sdh155122 DROPPER(ipss, ipds_spd_malformed_packet),
6327f4b3ec61Sdh155122 &ipss->ipsec_spd_dropper);
6328bd670b35SErik Nordmark if (inbound)
6329bd670b35SErik Nordmark (void) ip_recv_attr_free_mblk(iramp);
63308810c16bSdanmcd return (NULL);
63318810c16bSdanmcd } else {
63328810c16bSdanmcd v6_proto = *v6_proto_p;
63338810c16bSdanmcd }
63348810c16bSdanmcd
63358810c16bSdanmcd
63368810c16bSdanmcd bzero(&ipp, sizeof (ipp));
6337bd670b35SErik Nordmark (void) ip_find_hdr_v6(mp, ip6h, B_FALSE, &ipp, NULL);
63388810c16bSdanmcd if (!(ipp.ipp_fields & IPPF_FRAGHDR)) {
63398810c16bSdanmcd /*
63408810c16bSdanmcd * We think this is a fragment, but didn't find
63418810c16bSdanmcd * a fragment header. Something is wrong.
63428810c16bSdanmcd */
63438810c16bSdanmcd mutex_exit(&frag->itpf_lock);
6344bd670b35SErik Nordmark ip_drop_packet(mp, inbound, NULL,
6345f4b3ec61Sdh155122 DROPPER(ipss, ipds_spd_malformed_frag),
6346f4b3ec61Sdh155122 &ipss->ipsec_spd_dropper);
6347bd670b35SErik Nordmark if (inbound)
6348bd670b35SErik Nordmark (void) ip_recv_attr_free_mblk(iramp);
63498810c16bSdanmcd return (NULL);
63508810c16bSdanmcd }
63518810c16bSdanmcd fraghdr = ipp.ipp_fraghdr;
63528810c16bSdanmcd is_v4 = B_FALSE;
63538810c16bSdanmcd }
63548810c16bSdanmcd
63558810c16bSdanmcd /* Anything to cleanup? */
63568810c16bSdanmcd
63578810c16bSdanmcd /*
63588810c16bSdanmcd * This cleanup call could be put in a timer loop
63598810c16bSdanmcd * but it may actually be just as reasonable a decision to
63608810c16bSdanmcd * leave it here. The disadvantage is this only gets called when
63618810c16bSdanmcd * frags are added. The advantage is that it is not
63628810c16bSdanmcd * susceptible to race conditions like a time-based cleanup
63638810c16bSdanmcd * may be.
63648810c16bSdanmcd */
63658810c16bSdanmcd itpf_time = gethrestime_sec();
63668810c16bSdanmcd if (itpf_time >= frag->itpf_expire_hint)
6367bd670b35SErik Nordmark ipsec_fragcache_clean(frag, ipss);
63688810c16bSdanmcd
63698810c16bSdanmcd /* Lookup to see if there is an existing entry */
63708810c16bSdanmcd
63718810c16bSdanmcd if (is_v4)
63728810c16bSdanmcd i = IPSEC_FRAG_HASH_FUNC(iph->ipha_ident);
63738810c16bSdanmcd else
63748810c16bSdanmcd i = IPSEC_FRAG_HASH_FUNC(fraghdr->ip6f_ident);
63758810c16bSdanmcd
63768810c16bSdanmcd for (fep = (frag->itpf_ptr)[i]; fep; fep = fep->itpfe_next) {
63778810c16bSdanmcd if (is_v4) {
63788810c16bSdanmcd ASSERT(iph != NULL);
63798810c16bSdanmcd if ((fep->itpfe_id == iph->ipha_ident) &&
63808810c16bSdanmcd (fep->itpfe_src == iph->ipha_src) &&
63818810c16bSdanmcd (fep->itpfe_dst == iph->ipha_dst) &&
63828810c16bSdanmcd (fep->itpfe_proto == iph->ipha_protocol))
63838810c16bSdanmcd break;
63848810c16bSdanmcd } else {
63858810c16bSdanmcd ASSERT(fraghdr != NULL);
63868810c16bSdanmcd ASSERT(fep != NULL);
63878810c16bSdanmcd if ((fep->itpfe_id == fraghdr->ip6f_ident) &&
63888810c16bSdanmcd IN6_ARE_ADDR_EQUAL(&fep->itpfe_src6,
63898810c16bSdanmcd &ip6h->ip6_src) &&
63908810c16bSdanmcd IN6_ARE_ADDR_EQUAL(&fep->itpfe_dst6,
63918810c16bSdanmcd &ip6h->ip6_dst) && (fep->itpfe_proto == v6_proto))
63928810c16bSdanmcd break;
63938810c16bSdanmcd }
63948810c16bSdanmcd }
63958810c16bSdanmcd
63968810c16bSdanmcd if (is_v4) {
63978810c16bSdanmcd firstbyte = V4_FRAG_OFFSET(iph);
63988810c16bSdanmcd lastbyte = firstbyte + ntohs(iph->ipha_length) -
63998810c16bSdanmcd IPH_HDR_LENGTH(iph);
64008810c16bSdanmcd last = (V4_MORE_FRAGS(iph) == 0);
64018810c16bSdanmcd #ifdef FRAGCACHE_DEBUG
64028810c16bSdanmcd cmn_err(CE_WARN, "V4 fragcache: firstbyte = %d, lastbyte = %d, "
6403d1a98e54SPaul Wernau "is_last_frag = %d, id = %d, mp = %p\n", firstbyte,
6404d1a98e54SPaul Wernau lastbyte, last, iph->ipha_ident, mp);
64058810c16bSdanmcd #endif
64068810c16bSdanmcd } else {
64078810c16bSdanmcd firstbyte = ntohs(fraghdr->ip6f_offlg & IP6F_OFF_MASK);
64088810c16bSdanmcd lastbyte = firstbyte + ntohs(ip6h->ip6_plen) +
64098810c16bSdanmcd sizeof (ip6_t) - ip6_hdr_length;
64108810c16bSdanmcd last = (fraghdr->ip6f_offlg & IP6F_MORE_FRAG) == 0;
64118810c16bSdanmcd #ifdef FRAGCACHE_DEBUG
64128810c16bSdanmcd cmn_err(CE_WARN, "V6 fragcache: firstbyte = %d, lastbyte = %d, "
6413d1a98e54SPaul Wernau "is_last_frag = %d, id = %d, fraghdr = %p, mp = %p\n",
6414d1a98e54SPaul Wernau firstbyte, lastbyte, last, fraghdr->ip6f_ident, fraghdr,
6415d1a98e54SPaul Wernau mp);
64168810c16bSdanmcd #endif
64178810c16bSdanmcd }
64188810c16bSdanmcd
64198810c16bSdanmcd /* check for bogus fragments and delete the entry */
64208810c16bSdanmcd if (firstbyte > 0 && firstbyte <= 8) {
64218810c16bSdanmcd if (fep != NULL)
6422bd670b35SErik Nordmark (void) fragcache_delentry(i, fep, frag, ipss);
64238810c16bSdanmcd mutex_exit(&frag->itpf_lock);
6424bd670b35SErik Nordmark ip_drop_packet(mp, inbound, NULL,
6425f4b3ec61Sdh155122 DROPPER(ipss, ipds_spd_malformed_frag),
6426f4b3ec61Sdh155122 &ipss->ipsec_spd_dropper);
6427bd670b35SErik Nordmark if (inbound)
6428bd670b35SErik Nordmark (void) ip_recv_attr_free_mblk(iramp);
64298810c16bSdanmcd return (NULL);
64308810c16bSdanmcd }
64318810c16bSdanmcd
64328810c16bSdanmcd /* Not found, allocate a new entry */
64338810c16bSdanmcd if (fep == NULL) {
64348810c16bSdanmcd if (frag->itpf_freelist == NULL) {
64358810c16bSdanmcd /* see if there is some space */
6436bd670b35SErik Nordmark ipsec_fragcache_clean(frag, ipss);
64378810c16bSdanmcd if (frag->itpf_freelist == NULL) {
64388810c16bSdanmcd mutex_exit(&frag->itpf_lock);
6439bd670b35SErik Nordmark ip_drop_packet(mp, inbound, NULL,
6440f4b3ec61Sdh155122 DROPPER(ipss, ipds_spd_nomem),
6441f4b3ec61Sdh155122 &ipss->ipsec_spd_dropper);
6442bd670b35SErik Nordmark if (inbound)
6443bd670b35SErik Nordmark (void) ip_recv_attr_free_mblk(iramp);
64448810c16bSdanmcd return (NULL);
64458810c16bSdanmcd }
64468810c16bSdanmcd }
64478810c16bSdanmcd
64488810c16bSdanmcd fep = frag->itpf_freelist;
64498810c16bSdanmcd frag->itpf_freelist = fep->itpfe_next;
64508810c16bSdanmcd
64518810c16bSdanmcd if (is_v4) {
64528810c16bSdanmcd bcopy((caddr_t)&iph->ipha_src, (caddr_t)&fep->itpfe_src,
64538810c16bSdanmcd sizeof (struct in_addr));
64548810c16bSdanmcd bcopy((caddr_t)&iph->ipha_dst, (caddr_t)&fep->itpfe_dst,
64558810c16bSdanmcd sizeof (struct in_addr));
64568810c16bSdanmcd fep->itpfe_id = iph->ipha_ident;
64578810c16bSdanmcd fep->itpfe_proto = iph->ipha_protocol;
64588810c16bSdanmcd i = IPSEC_FRAG_HASH_FUNC(fep->itpfe_id);
64598810c16bSdanmcd } else {
64608810c16bSdanmcd bcopy((in6_addr_t *)&ip6h->ip6_src,
64618810c16bSdanmcd (in6_addr_t *)&fep->itpfe_src6,
64628810c16bSdanmcd sizeof (struct in6_addr));
64638810c16bSdanmcd bcopy((in6_addr_t *)&ip6h->ip6_dst,
64648810c16bSdanmcd (in6_addr_t *)&fep->itpfe_dst6,
64658810c16bSdanmcd sizeof (struct in6_addr));
64668810c16bSdanmcd fep->itpfe_id = fraghdr->ip6f_ident;
64678810c16bSdanmcd fep->itpfe_proto = v6_proto;
64688810c16bSdanmcd i = IPSEC_FRAG_HASH_FUNC(fep->itpfe_id);
64698810c16bSdanmcd }
64708810c16bSdanmcd itpf_time = gethrestime_sec();
64718810c16bSdanmcd fep->itpfe_exp = itpf_time + IPSEC_FRAG_TTL_MAX + 1;
64728810c16bSdanmcd fep->itpfe_last = 0;
64738810c16bSdanmcd fep->itpfe_fraglist = NULL;
64748810c16bSdanmcd fep->itpfe_depth = 0;
64758810c16bSdanmcd fep->itpfe_next = (frag->itpf_ptr)[i];
64768810c16bSdanmcd (frag->itpf_ptr)[i] = fep;
64778810c16bSdanmcd
64788810c16bSdanmcd if (frag->itpf_expire_hint > fep->itpfe_exp)
64798810c16bSdanmcd frag->itpf_expire_hint = fep->itpfe_exp;
64808810c16bSdanmcd
64818810c16bSdanmcd }
64828810c16bSdanmcd
64838810c16bSdanmcd /* Insert it in the frag list */
64848810c16bSdanmcd /* List is in order by starting offset of fragments */
64858810c16bSdanmcd
64868810c16bSdanmcd prevmp = NULL;
64878810c16bSdanmcd for (nmp = fep->itpfe_fraglist; nmp; nmp = nmp->b_next) {
64888810c16bSdanmcd ipha_t *niph;
64898810c16bSdanmcd ipha_t *oniph;
64908810c16bSdanmcd ip6_t *nip6h;
6491bd670b35SErik Nordmark ip_pkt_t nipp;
64928810c16bSdanmcd ip6_frag_t *nfraghdr;
64938810c16bSdanmcd uint16_t nip6_hdr_length;
64948810c16bSdanmcd uint8_t *nv6_proto_p;
64958810c16bSdanmcd int nfirstbyte, nlastbyte;
64968810c16bSdanmcd char *data, *ndata;
64978810c16bSdanmcd mblk_t *ndata_mp = (inbound ? nmp->b_cont : nmp);
64988810c16bSdanmcd int hdr_len;
64998810c16bSdanmcd
65008810c16bSdanmcd oniph = (ipha_t *)mp->b_rptr;
65018810c16bSdanmcd nip6h = NULL;
65028810c16bSdanmcd niph = NULL;
65038810c16bSdanmcd
65048810c16bSdanmcd /*
65058810c16bSdanmcd * Determine outer header type and length and set
65068810c16bSdanmcd * pointers appropriately
65078810c16bSdanmcd */
65088810c16bSdanmcd
65098810c16bSdanmcd if (IPH_HDR_VERSION(oniph) == IPV4_VERSION) {
65108810c16bSdanmcd hdr_len = ((outer_hdr_len != 0) ?
65118810c16bSdanmcd IPH_HDR_LENGTH(oiph) : 0);
65128810c16bSdanmcd niph = (ipha_t *)(ndata_mp->b_rptr + hdr_len);
65138810c16bSdanmcd } else {
65148810c16bSdanmcd ASSERT(IPH_HDR_VERSION(oniph) == IPV6_VERSION);
651505d90a32SDan McDonald ASSERT(ndata_mp->b_cont == NULL);
651605d90a32SDan McDonald nip6h = (ip6_t *)ndata_mp->b_rptr;
651705d90a32SDan McDonald (void) ip_hdr_length_nexthdr_v6(ndata_mp, nip6h,
65188810c16bSdanmcd &nip6_hdr_length, &v6_proto_p);
65198810c16bSdanmcd hdr_len = ((outer_hdr_len != 0) ? nip6_hdr_length : 0);
65208810c16bSdanmcd }
65218810c16bSdanmcd
65228810c16bSdanmcd /*
65238810c16bSdanmcd * Determine inner header type and length and set
65248810c16bSdanmcd * pointers appropriately
65258810c16bSdanmcd */
65268810c16bSdanmcd
65278810c16bSdanmcd if (is_v4) {
65288810c16bSdanmcd if (niph == NULL) {
65298810c16bSdanmcd /* Was v6 outer */
65308810c16bSdanmcd niph = (ipha_t *)(ndata_mp->b_rptr + hdr_len);
65318810c16bSdanmcd }
65328810c16bSdanmcd nfirstbyte = V4_FRAG_OFFSET(niph);
65338810c16bSdanmcd nlastbyte = nfirstbyte + ntohs(niph->ipha_length) -
65348810c16bSdanmcd IPH_HDR_LENGTH(niph);
65358810c16bSdanmcd } else {
653605d90a32SDan McDonald ASSERT(ndata_mp->b_cont == NULL);
653705d90a32SDan McDonald nip6h = (ip6_t *)(ndata_mp->b_rptr + hdr_len);
653805d90a32SDan McDonald if (!ip_hdr_length_nexthdr_v6(ndata_mp, nip6h,
65398810c16bSdanmcd &nip6_hdr_length, &nv6_proto_p)) {
65408810c16bSdanmcd mutex_exit(&frag->itpf_lock);
6541bd670b35SErik Nordmark ip_drop_packet_chain(nmp, inbound, NULL,
6542f4b3ec61Sdh155122 DROPPER(ipss, ipds_spd_malformed_frag),
6543f4b3ec61Sdh155122 &ipss->ipsec_spd_dropper);
654405d90a32SDan McDonald ipsec_freemsg_chain(ndata_mp);
6545bd670b35SErik Nordmark if (inbound)
6546bd670b35SErik Nordmark (void) ip_recv_attr_free_mblk(iramp);
65478810c16bSdanmcd return (NULL);
65488810c16bSdanmcd }
65498810c16bSdanmcd bzero(&nipp, sizeof (nipp));
6550bd670b35SErik Nordmark (void) ip_find_hdr_v6(ndata_mp, nip6h, B_FALSE, &nipp,
6551bd670b35SErik Nordmark NULL);
65528810c16bSdanmcd nfraghdr = nipp.ipp_fraghdr;
65538810c16bSdanmcd nfirstbyte = ntohs(nfraghdr->ip6f_offlg &
65548810c16bSdanmcd IP6F_OFF_MASK);
65558810c16bSdanmcd nlastbyte = nfirstbyte + ntohs(nip6h->ip6_plen) +
65568810c16bSdanmcd sizeof (ip6_t) - nip6_hdr_length;
65578810c16bSdanmcd }
65588810c16bSdanmcd
65598810c16bSdanmcd /* Check for overlapping fragments */
65608810c16bSdanmcd if (firstbyte >= nfirstbyte && firstbyte < nlastbyte) {
65618810c16bSdanmcd /*
65628810c16bSdanmcd * Overlap Check:
65638810c16bSdanmcd * ~~~~--------- # Check if the newly
65648810c16bSdanmcd * ~ ndata_mp| # received fragment
65658810c16bSdanmcd * ~~~~--------- # overlaps with the
65668810c16bSdanmcd * ---------~~~~~~ # current fragment.
65678810c16bSdanmcd * | mp ~
65688810c16bSdanmcd * ---------~~~~~~
65698810c16bSdanmcd */
65708810c16bSdanmcd if (is_v4) {
65718810c16bSdanmcd data = (char *)iph + IPH_HDR_LENGTH(iph) +
65728810c16bSdanmcd firstbyte - nfirstbyte;
65738810c16bSdanmcd ndata = (char *)niph + IPH_HDR_LENGTH(niph);
65748810c16bSdanmcd } else {
65758810c16bSdanmcd data = (char *)ip6h +
65768810c16bSdanmcd nip6_hdr_length + firstbyte -
65778810c16bSdanmcd nfirstbyte;
65788810c16bSdanmcd ndata = (char *)nip6h + nip6_hdr_length;
65798810c16bSdanmcd }
6580daa41a61Sdanmcd if (bcmp(data, ndata, MIN(lastbyte, nlastbyte) -
6581daa41a61Sdanmcd firstbyte)) {
65828810c16bSdanmcd /* Overlapping data does not match */
6583bd670b35SErik Nordmark (void) fragcache_delentry(i, fep, frag, ipss);
65848810c16bSdanmcd mutex_exit(&frag->itpf_lock);
6585bd670b35SErik Nordmark ip_drop_packet(mp, inbound, NULL,
6586f4b3ec61Sdh155122 DROPPER(ipss, ipds_spd_overlap_frag),
6587f4b3ec61Sdh155122 &ipss->ipsec_spd_dropper);
6588bd670b35SErik Nordmark if (inbound)
6589bd670b35SErik Nordmark (void) ip_recv_attr_free_mblk(iramp);
65908810c16bSdanmcd return (NULL);
65918810c16bSdanmcd }
65928810c16bSdanmcd /* Part of defense for jolt2.c fragmentation attack */
65938810c16bSdanmcd if (firstbyte >= nfirstbyte && lastbyte <= nlastbyte) {
65948810c16bSdanmcd /*
65958810c16bSdanmcd * Check for identical or subset fragments:
65968810c16bSdanmcd * ---------- ~~~~--------~~~~~
65978810c16bSdanmcd * | nmp | or ~ nmp ~
65988810c16bSdanmcd * ---------- ~~~~--------~~~~~
65998810c16bSdanmcd * ---------- ------
66008810c16bSdanmcd * | mp | | mp |
66018810c16bSdanmcd * ---------- ------
66028810c16bSdanmcd */
66038810c16bSdanmcd mutex_exit(&frag->itpf_lock);
6604bd670b35SErik Nordmark ip_drop_packet(mp, inbound, NULL,
6605f4b3ec61Sdh155122 DROPPER(ipss, ipds_spd_evil_frag),
6606f4b3ec61Sdh155122 &ipss->ipsec_spd_dropper);
6607bd670b35SErik Nordmark if (inbound)
6608bd670b35SErik Nordmark (void) ip_recv_attr_free_mblk(iramp);
66098810c16bSdanmcd return (NULL);
66108810c16bSdanmcd }
66118810c16bSdanmcd
66128810c16bSdanmcd }
66138810c16bSdanmcd
66148810c16bSdanmcd /* Correct location for this fragment? */
66158810c16bSdanmcd if (firstbyte <= nfirstbyte) {
66168810c16bSdanmcd /*
66178810c16bSdanmcd * Check if the tail end of the new fragment overlaps
66188810c16bSdanmcd * with the head of the current fragment.
66198810c16bSdanmcd * --------~~~~~~~
66208810c16bSdanmcd * | nmp ~
66218810c16bSdanmcd * --------~~~~~~~
66228810c16bSdanmcd * ~~~~~--------
66238810c16bSdanmcd * ~ mp |
66248810c16bSdanmcd * ~~~~~--------
66258810c16bSdanmcd */
66268810c16bSdanmcd if (lastbyte > nfirstbyte) {
66278810c16bSdanmcd /* Fragments overlap */
66288810c16bSdanmcd data = (char *)iph + IPH_HDR_LENGTH(iph) +
66298810c16bSdanmcd firstbyte - nfirstbyte;
66308810c16bSdanmcd ndata = (char *)niph + IPH_HDR_LENGTH(niph);
66318810c16bSdanmcd if (is_v4) {
66328810c16bSdanmcd data = (char *)iph +
66338810c16bSdanmcd IPH_HDR_LENGTH(iph) + firstbyte -
66348810c16bSdanmcd nfirstbyte;
66358810c16bSdanmcd ndata = (char *)niph +
66368810c16bSdanmcd IPH_HDR_LENGTH(niph);
66378810c16bSdanmcd } else {
66388810c16bSdanmcd data = (char *)ip6h +
66398810c16bSdanmcd nip6_hdr_length + firstbyte -
66408810c16bSdanmcd nfirstbyte;
66418810c16bSdanmcd ndata = (char *)nip6h + nip6_hdr_length;
66428810c16bSdanmcd }
66438810c16bSdanmcd if (bcmp(data, ndata, MIN(lastbyte, nlastbyte)
66448810c16bSdanmcd - nfirstbyte)) {
66458810c16bSdanmcd /* Overlap mismatch */
6646bd670b35SErik Nordmark (void) fragcache_delentry(i, fep, frag,
6647bd670b35SErik Nordmark ipss);
66488810c16bSdanmcd mutex_exit(&frag->itpf_lock);
6649bd670b35SErik Nordmark ip_drop_packet(mp, inbound, NULL,
6650bd670b35SErik Nordmark DROPPER(ipss,
6651daa41a61Sdanmcd ipds_spd_overlap_frag),
6652f4b3ec61Sdh155122 &ipss->ipsec_spd_dropper);
6653bd670b35SErik Nordmark if (inbound) {
6654bd670b35SErik Nordmark (void) ip_recv_attr_free_mblk(
6655bd670b35SErik Nordmark iramp);
6656bd670b35SErik Nordmark }
66578810c16bSdanmcd return (NULL);
66588810c16bSdanmcd }
66598810c16bSdanmcd }
66608810c16bSdanmcd
66618810c16bSdanmcd /*
66628810c16bSdanmcd * Fragment does not illegally overlap and can now
66638810c16bSdanmcd * be inserted into the chain
66648810c16bSdanmcd */
66658810c16bSdanmcd break;
66668810c16bSdanmcd }
66678810c16bSdanmcd
66688810c16bSdanmcd prevmp = nmp;
66698810c16bSdanmcd }
6670bd670b35SErik Nordmark /* Prepend the attributes before we link it in */
6671bd670b35SErik Nordmark if (iramp != NULL) {
6672bd670b35SErik Nordmark ASSERT(iramp->b_cont == NULL);
6673bd670b35SErik Nordmark iramp->b_cont = mp;
6674bd670b35SErik Nordmark mp = iramp;
6675bd670b35SErik Nordmark iramp = NULL;
6676bd670b35SErik Nordmark }
6677bd670b35SErik Nordmark mp->b_next = nmp;
66788810c16bSdanmcd
66798810c16bSdanmcd if (prevmp == NULL) {
6680bd670b35SErik Nordmark fep->itpfe_fraglist = mp;
66818810c16bSdanmcd } else {
6682bd670b35SErik Nordmark prevmp->b_next = mp;
66838810c16bSdanmcd }
66848810c16bSdanmcd if (last)
66858810c16bSdanmcd fep->itpfe_last = 1;
66868810c16bSdanmcd
66878810c16bSdanmcd /* Part of defense for jolt2.c fragmentation attack */
66888810c16bSdanmcd if (++(fep->itpfe_depth) > IPSEC_MAX_FRAGS) {
6689bd670b35SErik Nordmark (void) fragcache_delentry(i, fep, frag, ipss);
66908810c16bSdanmcd mutex_exit(&frag->itpf_lock);
6691bd670b35SErik Nordmark if (inbound)
6692bd670b35SErik Nordmark mp = ip_recv_attr_free_mblk(mp);
6693bd670b35SErik Nordmark
6694bd670b35SErik Nordmark ip_drop_packet(mp, inbound, NULL,
6695f4b3ec61Sdh155122 DROPPER(ipss, ipds_spd_max_frags),
6696f4b3ec61Sdh155122 &ipss->ipsec_spd_dropper);
66978810c16bSdanmcd return (NULL);
66988810c16bSdanmcd }
66998810c16bSdanmcd
67008810c16bSdanmcd /* Check for complete packet */
67018810c16bSdanmcd
67028810c16bSdanmcd if (!fep->itpfe_last) {
67038810c16bSdanmcd mutex_exit(&frag->itpf_lock);
67048810c16bSdanmcd #ifdef FRAGCACHE_DEBUG
6705d1a98e54SPaul Wernau cmn_err(CE_WARN, "Fragment cached, last not yet seen.\n");
67068810c16bSdanmcd #endif
67078810c16bSdanmcd return (NULL);
67088810c16bSdanmcd }
67098810c16bSdanmcd
67108810c16bSdanmcd offset = 0;
67118810c16bSdanmcd for (mp = fep->itpfe_fraglist; mp; mp = mp->b_next) {
67128810c16bSdanmcd mblk_t *data_mp = (inbound ? mp->b_cont : mp);
67138810c16bSdanmcd int hdr_len;
67148810c16bSdanmcd
67158810c16bSdanmcd oiph = (ipha_t *)data_mp->b_rptr;
67168810c16bSdanmcd ip6h = NULL;
67178810c16bSdanmcd iph = NULL;
67188810c16bSdanmcd
67198810c16bSdanmcd if (IPH_HDR_VERSION(oiph) == IPV4_VERSION) {
67208810c16bSdanmcd hdr_len = ((outer_hdr_len != 0) ?
67218810c16bSdanmcd IPH_HDR_LENGTH(oiph) : 0);
67228810c16bSdanmcd iph = (ipha_t *)(data_mp->b_rptr + hdr_len);
67238810c16bSdanmcd } else {
67248810c16bSdanmcd ASSERT(IPH_HDR_VERSION(oiph) == IPV6_VERSION);
672505d90a32SDan McDonald ASSERT(data_mp->b_cont == NULL);
672605d90a32SDan McDonald ip6h = (ip6_t *)data_mp->b_rptr;
672705d90a32SDan McDonald (void) ip_hdr_length_nexthdr_v6(data_mp, ip6h,
67288810c16bSdanmcd &ip6_hdr_length, &v6_proto_p);
67298810c16bSdanmcd hdr_len = ((outer_hdr_len != 0) ? ip6_hdr_length : 0);
67308810c16bSdanmcd }
67318810c16bSdanmcd
67328810c16bSdanmcd /* Calculate current fragment start/end */
67338810c16bSdanmcd if (is_v4) {
67348810c16bSdanmcd if (iph == NULL) {
67358810c16bSdanmcd /* Was v6 outer */
67368810c16bSdanmcd iph = (ipha_t *)(data_mp->b_rptr + hdr_len);
67378810c16bSdanmcd }
67388810c16bSdanmcd firstbyte = V4_FRAG_OFFSET(iph);
67398810c16bSdanmcd lastbyte = firstbyte + ntohs(iph->ipha_length) -
67408810c16bSdanmcd IPH_HDR_LENGTH(iph);
67418810c16bSdanmcd } else {
674205d90a32SDan McDonald ASSERT(data_mp->b_cont == NULL);
674305d90a32SDan McDonald ip6h = (ip6_t *)(data_mp->b_rptr + hdr_len);
674405d90a32SDan McDonald if (!ip_hdr_length_nexthdr_v6(data_mp, ip6h,
67458810c16bSdanmcd &ip6_hdr_length, &v6_proto_p)) {
67468810c16bSdanmcd mutex_exit(&frag->itpf_lock);
6747bd670b35SErik Nordmark ip_drop_packet_chain(mp, inbound, NULL,
6748f4b3ec61Sdh155122 DROPPER(ipss, ipds_spd_malformed_frag),
6749f4b3ec61Sdh155122 &ipss->ipsec_spd_dropper);
67508810c16bSdanmcd return (NULL);
67518810c16bSdanmcd }
67528810c16bSdanmcd v6_proto = *v6_proto_p;
67538810c16bSdanmcd bzero(&ipp, sizeof (ipp));
6754bd670b35SErik Nordmark (void) ip_find_hdr_v6(data_mp, ip6h, B_FALSE, &ipp,
6755bd670b35SErik Nordmark NULL);
67568810c16bSdanmcd fraghdr = ipp.ipp_fraghdr;
67578810c16bSdanmcd firstbyte = ntohs(fraghdr->ip6f_offlg &
67588810c16bSdanmcd IP6F_OFF_MASK);
67598810c16bSdanmcd lastbyte = firstbyte + ntohs(ip6h->ip6_plen) +
67608810c16bSdanmcd sizeof (ip6_t) - ip6_hdr_length;
67618810c16bSdanmcd }
67628810c16bSdanmcd
67638810c16bSdanmcd /*
67648810c16bSdanmcd * If this fragment is greater than current offset,
67658810c16bSdanmcd * we have a missing fragment so return NULL
67668810c16bSdanmcd */
67678810c16bSdanmcd if (firstbyte > offset) {
67688810c16bSdanmcd mutex_exit(&frag->itpf_lock);
67698810c16bSdanmcd #ifdef FRAGCACHE_DEBUG
67708810c16bSdanmcd /*
67718810c16bSdanmcd * Note, this can happen when the last frag
67728810c16bSdanmcd * gets sent through because it is smaller
67738810c16bSdanmcd * than the MTU. It is not necessarily an
67748810c16bSdanmcd * error condition.
67758810c16bSdanmcd */
67768810c16bSdanmcd cmn_err(CE_WARN, "Frag greater than offset! : "
67778810c16bSdanmcd "missing fragment: firstbyte = %d, offset = %d, "
67788810c16bSdanmcd "mp = %p\n", firstbyte, offset, mp);
67798810c16bSdanmcd #endif
67808810c16bSdanmcd return (NULL);
67818810c16bSdanmcd }
6782d1a98e54SPaul Wernau #ifdef FRAGCACHE_DEBUG
6783d1a98e54SPaul Wernau cmn_err(CE_WARN, "Frag offsets : "
6784d1a98e54SPaul Wernau "firstbyte = %d, offset = %d, mp = %p\n",
6785d1a98e54SPaul Wernau firstbyte, offset, mp);
6786d1a98e54SPaul Wernau #endif
67878810c16bSdanmcd
67888810c16bSdanmcd /*
67898810c16bSdanmcd * If we are at the last fragment, we have the complete
67908810c16bSdanmcd * packet, so rechain things and return it to caller
67918810c16bSdanmcd * for processing
67928810c16bSdanmcd */
67938810c16bSdanmcd
67948810c16bSdanmcd if ((is_v4 && !V4_MORE_FRAGS(iph)) ||
67958810c16bSdanmcd (!is_v4 && !(fraghdr->ip6f_offlg & IP6F_MORE_FRAG))) {
67968810c16bSdanmcd mp = fep->itpfe_fraglist;
67978810c16bSdanmcd fep->itpfe_fraglist = NULL;
6798bd670b35SErik Nordmark (void) fragcache_delentry(i, fep, frag, ipss);
67998810c16bSdanmcd mutex_exit(&frag->itpf_lock);
68008810c16bSdanmcd
68018810c16bSdanmcd if ((is_v4 && (firstbyte + ntohs(iph->ipha_length) >
68028810c16bSdanmcd 65535)) || (!is_v4 && (firstbyte +
68038810c16bSdanmcd ntohs(ip6h->ip6_plen) > 65535))) {
68048810c16bSdanmcd /* It is an invalid "ping-o-death" packet */
68058810c16bSdanmcd /* Discard it */
6806bd670b35SErik Nordmark ip_drop_packet_chain(mp, inbound, NULL,
6807f4b3ec61Sdh155122 DROPPER(ipss, ipds_spd_evil_frag),
6808f4b3ec61Sdh155122 &ipss->ipsec_spd_dropper);
68098810c16bSdanmcd return (NULL);
68108810c16bSdanmcd }
68118810c16bSdanmcd #ifdef FRAGCACHE_DEBUG
68128810c16bSdanmcd cmn_err(CE_WARN, "Fragcache returning mp = %p, "
68138810c16bSdanmcd "mp->b_next = %p", mp, mp->b_next);
68148810c16bSdanmcd #endif
68158810c16bSdanmcd /*
6816bd670b35SErik Nordmark * For inbound case, mp has attrmp b_next'd chain
68178810c16bSdanmcd * For outbound case, it is just data mp chain
68188810c16bSdanmcd */
68198810c16bSdanmcd return (mp);
68208810c16bSdanmcd }
68218810c16bSdanmcd
68228810c16bSdanmcd /*
68238810c16bSdanmcd * Update new ending offset if this
68248810c16bSdanmcd * fragment extends the packet
68258810c16bSdanmcd */
68268810c16bSdanmcd if (offset < lastbyte)
68278810c16bSdanmcd offset = lastbyte;
68288810c16bSdanmcd }
68298810c16bSdanmcd
68308810c16bSdanmcd mutex_exit(&frag->itpf_lock);
68318810c16bSdanmcd
68328810c16bSdanmcd /* Didn't find last fragment, so return NULL */
68338810c16bSdanmcd return (NULL);
68348810c16bSdanmcd }
68358810c16bSdanmcd
68368810c16bSdanmcd static void
ipsec_fragcache_clean(ipsec_fragcache_t * frag,ipsec_stack_t * ipss)6837bd670b35SErik Nordmark ipsec_fragcache_clean(ipsec_fragcache_t *frag, ipsec_stack_t *ipss)
68388810c16bSdanmcd {
68398810c16bSdanmcd ipsec_fragcache_entry_t *fep;
68408810c16bSdanmcd int i;
68418810c16bSdanmcd ipsec_fragcache_entry_t *earlyfep = NULL;
68428810c16bSdanmcd time_t itpf_time;
68438810c16bSdanmcd int earlyexp;
68448810c16bSdanmcd int earlyi = 0;
68458810c16bSdanmcd
68468810c16bSdanmcd ASSERT(MUTEX_HELD(&frag->itpf_lock));
68478810c16bSdanmcd
68488810c16bSdanmcd itpf_time = gethrestime_sec();
68498810c16bSdanmcd earlyexp = itpf_time + 10000;
68508810c16bSdanmcd
68518810c16bSdanmcd for (i = 0; i < IPSEC_FRAG_HASH_SLOTS; i++) {
68528810c16bSdanmcd fep = (frag->itpf_ptr)[i];
68538810c16bSdanmcd while (fep) {
68548810c16bSdanmcd if (fep->itpfe_exp < itpf_time) {
68558810c16bSdanmcd /* found */
6856bd670b35SErik Nordmark fep = fragcache_delentry(i, fep, frag, ipss);
68578810c16bSdanmcd } else {
68588810c16bSdanmcd if (fep->itpfe_exp < earlyexp) {
68598810c16bSdanmcd earlyfep = fep;
68608810c16bSdanmcd earlyexp = fep->itpfe_exp;
68618810c16bSdanmcd earlyi = i;
68628810c16bSdanmcd }
68638810c16bSdanmcd fep = fep->itpfe_next;
68648810c16bSdanmcd }
68658810c16bSdanmcd }
68668810c16bSdanmcd }
68678810c16bSdanmcd
68688810c16bSdanmcd frag->itpf_expire_hint = earlyexp;
68698810c16bSdanmcd
68708810c16bSdanmcd /* if (!found) */
68718810c16bSdanmcd if (frag->itpf_freelist == NULL)
6872bd670b35SErik Nordmark (void) fragcache_delentry(earlyi, earlyfep, frag, ipss);
68738810c16bSdanmcd }
68748810c16bSdanmcd
68758810c16bSdanmcd static ipsec_fragcache_entry_t *
fragcache_delentry(int slot,ipsec_fragcache_entry_t * fep,ipsec_fragcache_t * frag,ipsec_stack_t * ipss)68768810c16bSdanmcd fragcache_delentry(int slot, ipsec_fragcache_entry_t *fep,
6877bd670b35SErik Nordmark ipsec_fragcache_t *frag, ipsec_stack_t *ipss)
68788810c16bSdanmcd {
68798810c16bSdanmcd ipsec_fragcache_entry_t *targp;
68808810c16bSdanmcd ipsec_fragcache_entry_t *nextp = fep->itpfe_next;
68818810c16bSdanmcd
68828810c16bSdanmcd ASSERT(MUTEX_HELD(&frag->itpf_lock));
68838810c16bSdanmcd
68848810c16bSdanmcd /* Free up any fragment list still in cache entry */
6885bd670b35SErik Nordmark if (fep->itpfe_fraglist != NULL) {
6886bd670b35SErik Nordmark ip_drop_packet_chain(fep->itpfe_fraglist,
6887bd670b35SErik Nordmark ip_recv_attr_is_mblk(fep->itpfe_fraglist), NULL,
6888d1a98e54SPaul Wernau DROPPER(ipss, ipds_spd_expired_frags),
6889d1a98e54SPaul Wernau &ipss->ipsec_spd_dropper);
6890bd670b35SErik Nordmark }
6891bd670b35SErik Nordmark fep->itpfe_fraglist = NULL;
68928810c16bSdanmcd
68938810c16bSdanmcd targp = (frag->itpf_ptr)[slot];
68948810c16bSdanmcd ASSERT(targp != 0);
68958810c16bSdanmcd
68968810c16bSdanmcd if (targp == fep) {
68978810c16bSdanmcd /* unlink from head of hash chain */
68988810c16bSdanmcd (frag->itpf_ptr)[slot] = nextp;
68998810c16bSdanmcd /* link into free list */
69008810c16bSdanmcd fep->itpfe_next = frag->itpf_freelist;
69018810c16bSdanmcd frag->itpf_freelist = fep;
69028810c16bSdanmcd return (nextp);
69038810c16bSdanmcd }
69048810c16bSdanmcd
69058810c16bSdanmcd /* maybe should use double linked list to make update faster */
69068810c16bSdanmcd /* must be past front of chain */
69078810c16bSdanmcd while (targp) {
69088810c16bSdanmcd if (targp->itpfe_next == fep) {
69098810c16bSdanmcd /* unlink from hash chain */
69108810c16bSdanmcd targp->itpfe_next = nextp;
69118810c16bSdanmcd /* link into free list */
69128810c16bSdanmcd fep->itpfe_next = frag->itpf_freelist;
69138810c16bSdanmcd frag->itpf_freelist = fep;
69148810c16bSdanmcd return (nextp);
69158810c16bSdanmcd }
69168810c16bSdanmcd targp = targp->itpfe_next;
69178810c16bSdanmcd ASSERT(targp != 0);
69188810c16bSdanmcd }
69198810c16bSdanmcd /* NOTREACHED */
69208810c16bSdanmcd return (NULL);
69218810c16bSdanmcd }
6922