xref: /illumos-gate/usr/src/uts/common/inet/ip/spdsock.c (revision bea83d026ee1bd1b2a2419e1d0232f107a5d7d9b)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  */
25 
26 #pragma ident	"%Z%%M%	%I%	%E% SMI"
27 
28 #include <sys/param.h>
29 #include <sys/types.h>
30 #include <sys/stream.h>
31 #include <sys/strsubr.h>
32 #include <sys/strsun.h>
33 #include <sys/stropts.h>
34 #include <sys/zone.h>
35 #include <sys/vnode.h>
36 #include <sys/sysmacros.h>
37 #define	_SUN_TPI_VERSION 2
38 #include <sys/tihdr.h>
39 #include <sys/ddi.h>
40 #include <sys/sunddi.h>
41 #include <sys/mkdev.h>
42 #include <sys/debug.h>
43 #include <sys/kmem.h>
44 #include <sys/cmn_err.h>
45 #include <sys/suntpi.h>
46 #include <sys/policy.h>
47 
48 #include <sys/socket.h>
49 #include <netinet/in.h>
50 #include <net/pfkeyv2.h>
51 #include <net/pfpolicy.h>
52 
53 #include <inet/common.h>
54 #include <netinet/ip6.h>
55 #include <inet/ip.h>
56 #include <inet/ip6.h>
57 #include <inet/mi.h>
58 #include <inet/nd.h>
59 #include <inet/ip_if.h>
60 #include <inet/tun.h>
61 #include <inet/optcom.h>
62 #include <inet/ipsec_info.h>
63 #include <inet/ipsec_impl.h>
64 #include <inet/spdsock.h>
65 #include <inet/sadb.h>
66 
67 #include <sys/isa_defs.h>
68 
69 #include <c2/audit.h>
70 
71 /*
72  * This is a transport provider for the PF_POLICY IPsec policy
73  * management socket, which provides a management interface into the
74  * SPD, allowing policy rules to be added, deleted, and queried.
75  *
76  * This effectively replaces the old private SIOC*IPSECONFIG ioctls
77  * with an extensible interface which will hopefully be public some
78  * day.
79  *
80  * See <net/pfpolicy.h> for more details on the protocol.
81  *
82  * We link against drv/ip and call directly into it to manipulate the
83  * SPD; see ipsec_impl.h for the policy data structures and spd.c for
84  * the code which maintains them.
85  *
86  * The MT model of this is QPAIR with the addition of some explicit
87  * locking to protect system-wide policy data structures.
88  */
89 
90 static vmem_t *spdsock_vmem;		/* for minor numbers. */
91 
92 #define	ALIGNED64(x) IS_P2ALIGNED((x), sizeof (uint64_t))
93 
94 /* Default structure copied into T_INFO_ACK messages (from rts.c...) */
95 static struct T_info_ack spdsock_g_t_info_ack = {
96 	T_INFO_ACK,
97 	T_INFINITE,	/* TSDU_size. Maximum size messages. */
98 	T_INVALID,	/* ETSDU_size. No expedited data. */
99 	T_INVALID,	/* CDATA_size. No connect data. */
100 	T_INVALID,	/* DDATA_size. No disconnect data. */
101 	0,		/* ADDR_size. */
102 	0,		/* OPT_size. No user-settable options */
103 	64 * 1024,	/* TIDU_size. spdsock allows maximum size messages. */
104 	T_COTS,		/* SERV_type. spdsock supports connection oriented. */
105 	TS_UNBND,	/* CURRENT_state. This is set from spdsock_state. */
106 	(XPG4_1)	/* Provider flags */
107 };
108 
109 /* Named Dispatch Parameter Management Structure */
110 typedef struct spdsockparam_s {
111 	uint_t	spdsock_param_min;
112 	uint_t	spdsock_param_max;
113 	uint_t	spdsock_param_value;
114 	char *spdsock_param_name;
115 } spdsockparam_t;
116 
117 /*
118  * Table of NDD variables supported by spdsock. These are loaded into
119  * spdsock_g_nd in spdsock_init_nd.
120  * All of these are alterable, within the min/max values given, at run time.
121  */
122 static	spdsockparam_t	lcl_param_arr[] = {
123 	/* min	max	value	name */
124 	{ 4096, 65536,	8192,	"spdsock_xmit_hiwat"},
125 	{ 0,	65536,	1024,	"spdsock_xmit_lowat"},
126 	{ 4096, 65536,	8192,	"spdsock_recv_hiwat"},
127 	{ 65536, 1024*1024*1024, 256*1024,	"spdsock_max_buf"},
128 	{ 0,	3,	0,	"spdsock_debug"},
129 };
130 #define	spds_xmit_hiwat	spds_params[0].spdsock_param_value
131 #define	spds_xmit_lowat	spds_params[1].spdsock_param_value
132 #define	spds_recv_hiwat	spds_params[2].spdsock_param_value
133 #define	spds_max_buf	spds_params[3].spdsock_param_value
134 #define	spds_debug		spds_params[4].spdsock_param_value
135 
136 #define	ss0dbg(a)	printf a
137 /* NOTE:  != 0 instead of > 0 so lint doesn't complain. */
138 #define	ss1dbg(spds, a)	if (spds->spds_debug != 0) printf a
139 #define	ss2dbg(spds, a)	if (spds->spds_debug > 1) printf a
140 #define	ss3dbg(spds, a)	if (spds->spds_debug > 2) printf a
141 
142 static int spdsock_close(queue_t *);
143 static int spdsock_open(queue_t *, dev_t *, int, int, cred_t *);
144 static void spdsock_wput(queue_t *, mblk_t *);
145 static void spdsock_wsrv(queue_t *);
146 static void spdsock_rsrv(queue_t *);
147 static void *spdsock_stack_init(netstackid_t stackid, netstack_t *ns);
148 static void spdsock_stack_fini(netstackid_t stackid, void *arg);
149 static void spdsock_loadcheck(void *);
150 static void spdsock_merge_algs(spd_stack_t *);
151 static void spdsock_flush_one(ipsec_policy_head_t *, netstack_t *);
152 static mblk_t *spdsock_dump_next_record(spdsock_t *);
153 
154 static struct module_info info = {
155 	5138, "spdsock", 1, INFPSZ, 512, 128
156 };
157 
158 static struct qinit rinit = {
159 	NULL, (pfi_t)spdsock_rsrv, spdsock_open, spdsock_close,
160 	NULL, &info
161 };
162 
163 static struct qinit winit = {
164 	(pfi_t)spdsock_wput, (pfi_t)spdsock_wsrv, NULL, NULL, NULL, &info
165 };
166 
167 struct streamtab spdsockinfo = {
168 	&rinit, &winit
169 };
170 
171 /* mapping from alg type to protocol number, as per RFC 2407 */
172 static const uint_t algproto[] = {
173 	PROTO_IPSEC_AH,
174 	PROTO_IPSEC_ESP,
175 };
176 
177 #define	NALGPROTOS	(sizeof (algproto) / sizeof (algproto[0]))
178 
179 /* mapping from kernel exec mode to spdsock exec mode */
180 static const uint_t execmodes[] = {
181 	SPD_ALG_EXEC_MODE_SYNC,
182 	SPD_ALG_EXEC_MODE_ASYNC
183 };
184 
185 #define	NEXECMODES	(sizeof (execmodes) / sizeof (execmodes[0]))
186 
187 #define	ALL_ACTIVE_POLHEADS ((ipsec_policy_head_t *)-1)
188 #define	ALL_INACTIVE_POLHEADS ((ipsec_policy_head_t *)-2)
189 
190 #define	ITP_NAME(itp) (itp != NULL ? itp->itp_name : NULL)
191 
192 /* ARGSUSED */
193 static int
194 spdsock_param_get(q, mp, cp, cr)
195 	queue_t	*q;
196 	mblk_t	*mp;
197 	caddr_t	cp;
198 	cred_t *cr;
199 {
200 	spdsockparam_t	*spdsockpa = (spdsockparam_t *)cp;
201 	uint_t value;
202 	spdsock_t *ss = (spdsock_t *)q->q_ptr;
203 	spd_stack_t	*spds = ss->spdsock_spds;
204 
205 	mutex_enter(&spds->spds_param_lock);
206 	value = spdsockpa->spdsock_param_value;
207 	mutex_exit(&spds->spds_param_lock);
208 
209 	(void) mi_mpprintf(mp, "%u", value);
210 	return (0);
211 }
212 
213 /* This routine sets an NDD variable in a spdsockparam_t structure. */
214 /* ARGSUSED */
215 static int
216 spdsock_param_set(q, mp, value, cp, cr)
217 	queue_t	*q;
218 	mblk_t	*mp;
219 	char *value;
220 	caddr_t	cp;
221 	cred_t *cr;
222 {
223 	ulong_t	new_value;
224 	spdsockparam_t	*spdsockpa = (spdsockparam_t *)cp;
225 	spdsock_t *ss = (spdsock_t *)q->q_ptr;
226 	spd_stack_t	*spds = ss->spdsock_spds;
227 
228 	/* Convert the value from a string into a long integer. */
229 	if (ddi_strtoul(value, NULL, 10, &new_value) != 0)
230 		return (EINVAL);
231 
232 	mutex_enter(&spds->spds_param_lock);
233 	/*
234 	 * Fail the request if the new value does not lie within the
235 	 * required bounds.
236 	 */
237 	if (new_value < spdsockpa->spdsock_param_min ||
238 	    new_value > spdsockpa->spdsock_param_max) {
239 		mutex_exit(&spds->spds_param_lock);
240 		return (EINVAL);
241 	}
242 
243 	/* Set the new value */
244 	spdsockpa->spdsock_param_value = new_value;
245 	mutex_exit(&spds->spds_param_lock);
246 
247 	return (0);
248 }
249 
250 /*
251  * Initialize at module load time
252  */
253 boolean_t
254 spdsock_ddi_init(void)
255 {
256 	spdsock_max_optsize = optcom_max_optsize(
257 	    spdsock_opt_obj.odb_opt_des_arr, spdsock_opt_obj.odb_opt_arr_cnt);
258 
259 	spdsock_vmem = vmem_create("spdsock", (void *)1, MAXMIN, 1,
260 	    NULL, NULL, NULL, 1, VM_SLEEP | VMC_IDENTIFIER);
261 
262 	/*
263 	 * We want to be informed each time a stack is created or
264 	 * destroyed in the kernel, so we can maintain the
265 	 * set of spd_stack_t's.
266 	 */
267 	netstack_register(NS_SPDSOCK, spdsock_stack_init, NULL,
268 	    spdsock_stack_fini);
269 
270 	return (B_TRUE);
271 }
272 
273 /*
274  * Walk through the param array specified registering each element with the
275  * named dispatch handler.
276  */
277 static boolean_t
278 spdsock_param_register(IDP *ndp, spdsockparam_t *ssp, int cnt)
279 {
280 	for (; cnt-- > 0; ssp++) {
281 		if (ssp->spdsock_param_name != NULL &&
282 		    ssp->spdsock_param_name[0]) {
283 			if (!nd_load(ndp,
284 			    ssp->spdsock_param_name,
285 			    spdsock_param_get, spdsock_param_set,
286 			    (caddr_t)ssp)) {
287 				nd_free(ndp);
288 				return (B_FALSE);
289 			}
290 		}
291 	}
292 	return (B_TRUE);
293 }
294 
295 /*
296  * Initialize for each stack instance
297  */
298 /* ARGSUSED */
299 static void *
300 spdsock_stack_init(netstackid_t stackid, netstack_t *ns)
301 {
302 	spd_stack_t	*spds;
303 	spdsockparam_t	*ssp;
304 
305 	spds = (spd_stack_t *)kmem_zalloc(sizeof (*spds), KM_SLEEP);
306 	spds->spds_netstack = ns;
307 
308 	ASSERT(spds->spds_g_nd == NULL);
309 
310 	ssp = (spdsockparam_t *)kmem_alloc(sizeof (lcl_param_arr), KM_SLEEP);
311 	spds->spds_params = ssp;
312 	bcopy(lcl_param_arr, ssp, sizeof (lcl_param_arr));
313 
314 	(void) spdsock_param_register(&spds->spds_g_nd, ssp,
315 	    A_CNT(lcl_param_arr));
316 
317 	mutex_init(&spds->spds_param_lock, NULL, MUTEX_DEFAULT, NULL);
318 	mutex_init(&spds->spds_alg_lock, NULL, MUTEX_DEFAULT, NULL);
319 
320 	return (spds);
321 }
322 
323 void
324 spdsock_ddi_destroy(void)
325 {
326 	vmem_destroy(spdsock_vmem);
327 
328 	netstack_unregister(NS_SPDSOCK);
329 }
330 
331 /* ARGSUSED */
332 static void
333 spdsock_stack_fini(netstackid_t stackid, void *arg)
334 {
335 	spd_stack_t *spds = (spd_stack_t *)arg;
336 
337 	mutex_destroy(&spds->spds_param_lock);
338 	mutex_destroy(&spds->spds_alg_lock);
339 	nd_free(&spds->spds_g_nd);
340 	kmem_free(spds->spds_params, sizeof (lcl_param_arr));
341 	spds->spds_params = NULL;
342 
343 	kmem_free(spds, sizeof (*spds));
344 }
345 
346 /*
347  * NOTE: large quantities of this should be shared with keysock.
348  * Would be nice to combine some of this into a common module, but
349  * not possible given time pressures.
350  */
351 
352 /*
353  * High-level reality checking of extensions.
354  */
355 /* ARGSUSED */ /* XXX */
356 static boolean_t
357 ext_check(spd_ext_t *ext)
358 {
359 	spd_if_t *tunname = (spd_if_t *)ext;
360 	int i;
361 	char *idstr;
362 
363 	if (ext->spd_ext_type == SPD_EXT_TUN_NAME) {
364 		/* (NOTE:  Modified from SADB_EXT_IDENTITY..) */
365 
366 		/*
367 		 * Make sure the strings in these identities are
368 		 * null-terminated.  Let's "proactively" null-terminate the
369 		 * string at the last byte if it's not terminated sooner.
370 		 */
371 		i = SPD_64TO8(tunname->spd_if_len) - sizeof (spd_if_t);
372 		idstr = (char *)(tunname + 1);
373 		while (*idstr != '\0' && i > 0) {
374 			i--;
375 			idstr++;
376 		}
377 		if (i == 0) {
378 			/*
379 			 * I.e., if the bozo user didn't NULL-terminate the
380 			 * string...
381 			 */
382 			idstr--;
383 			*idstr = '\0';
384 		}
385 	}
386 	return (B_TRUE);	/* For now... */
387 }
388 
389 
390 
391 /* Return values for spdsock_get_ext(). */
392 #define	KGE_OK	0
393 #define	KGE_DUP	1
394 #define	KGE_UNK	2
395 #define	KGE_LEN	3
396 #define	KGE_CHK	4
397 
398 /*
399  * Parse basic extension headers and return in the passed-in pointer vector.
400  * Return values include:
401  *
402  *	KGE_OK	Everything's nice and parsed out.
403  *		If there are no extensions, place NULL in extv[0].
404  *	KGE_DUP	There is a duplicate extension.
405  *		First instance in appropriate bin.  First duplicate in
406  *		extv[0].
407  *	KGE_UNK	Unknown extension type encountered.  extv[0] contains
408  *		unknown header.
409  *	KGE_LEN	Extension length error.
410  *	KGE_CHK	High-level reality check failed on specific extension.
411  *
412  * My apologies for some of the pointer arithmetic in here.  I'm thinking
413  * like an assembly programmer, yet trying to make the compiler happy.
414  */
415 static int
416 spdsock_get_ext(spd_ext_t *extv[], spd_msg_t *basehdr, uint_t msgsize)
417 {
418 	bzero(extv, sizeof (spd_ext_t *) * (SPD_EXT_MAX + 1));
419 
420 	/* Use extv[0] as the "current working pointer". */
421 
422 	extv[0] = (spd_ext_t *)(basehdr + 1);
423 
424 	while (extv[0] < (spd_ext_t *)(((uint8_t *)basehdr) + msgsize)) {
425 		/* Check for unknown headers. */
426 		if (extv[0]->spd_ext_type == 0 ||
427 		    extv[0]->spd_ext_type > SPD_EXT_MAX)
428 			return (KGE_UNK);
429 
430 		/*
431 		 * Check length.  Use uint64_t because extlen is in units
432 		 * of 64-bit words.  If length goes beyond the msgsize,
433 		 * return an error.  (Zero length also qualifies here.)
434 		 */
435 		if (extv[0]->spd_ext_len == 0 ||
436 		    (void *)((uint64_t *)extv[0] + extv[0]->spd_ext_len) >
437 		    (void *)((uint8_t *)basehdr + msgsize))
438 			return (KGE_LEN);
439 
440 		/* Check for redundant headers. */
441 		if (extv[extv[0]->spd_ext_type] != NULL)
442 			return (KGE_DUP);
443 
444 		/*
445 		 * Reality check the extension if possible at the spdsock
446 		 * level.
447 		 */
448 		if (!ext_check(extv[0]))
449 			return (KGE_CHK);
450 
451 		/* If I make it here, assign the appropriate bin. */
452 		extv[extv[0]->spd_ext_type] = extv[0];
453 
454 		/* Advance pointer (See above for uint64_t ptr reasoning.) */
455 		extv[0] = (spd_ext_t *)
456 		    ((uint64_t *)extv[0] + extv[0]->spd_ext_len);
457 	}
458 
459 	/* Everything's cool. */
460 
461 	/*
462 	 * If extv[0] == NULL, then there are no extension headers in this
463 	 * message.  Ensure that this is the case.
464 	 */
465 	if (extv[0] == (spd_ext_t *)(basehdr + 1))
466 		extv[0] = NULL;
467 
468 	return (KGE_OK);
469 }
470 
471 static const int bad_ext_diag[] = {
472 	SPD_DIAGNOSTIC_MALFORMED_LCLPORT,
473 	SPD_DIAGNOSTIC_MALFORMED_REMPORT,
474 	SPD_DIAGNOSTIC_MALFORMED_PROTO,
475 	SPD_DIAGNOSTIC_MALFORMED_LCLADDR,
476 	SPD_DIAGNOSTIC_MALFORMED_REMADDR,
477 	SPD_DIAGNOSTIC_MALFORMED_ACTION,
478 	SPD_DIAGNOSTIC_MALFORMED_RULE,
479 	SPD_DIAGNOSTIC_MALFORMED_RULESET,
480 	SPD_DIAGNOSTIC_MALFORMED_ICMP_TYPECODE
481 };
482 
483 static const int dup_ext_diag[] = {
484 	SPD_DIAGNOSTIC_DUPLICATE_LCLPORT,
485 	SPD_DIAGNOSTIC_DUPLICATE_REMPORT,
486 	SPD_DIAGNOSTIC_DUPLICATE_PROTO,
487 	SPD_DIAGNOSTIC_DUPLICATE_LCLADDR,
488 	SPD_DIAGNOSTIC_DUPLICATE_REMADDR,
489 	SPD_DIAGNOSTIC_DUPLICATE_ACTION,
490 	SPD_DIAGNOSTIC_DUPLICATE_RULE,
491 	SPD_DIAGNOSTIC_DUPLICATE_RULESET,
492 	SPD_DIAGNOSTIC_DUPLICATE_ICMP_TYPECODE
493 };
494 
495 /*
496  * Transmit a PF_POLICY error message to the instance either pointed to
497  * by ks, the instance with serial number serial, or more, depending.
498  *
499  * The faulty message (or a reasonable facsimile thereof) is in mp.
500  * This function will free mp or recycle it for delivery, thereby causing
501  * the stream head to free it.
502  */
503 static void
504 spdsock_error(queue_t *q, mblk_t *mp, int error, int diagnostic)
505 {
506 	spd_msg_t *spmsg = (spd_msg_t *)mp->b_rptr;
507 
508 	ASSERT(mp->b_datap->db_type == M_DATA);
509 
510 	if (spmsg->spd_msg_type < SPD_MIN ||
511 	    spmsg->spd_msg_type > SPD_MAX)
512 		spmsg->spd_msg_type = SPD_RESERVED;
513 
514 	/*
515 	 * Strip out extension headers.
516 	 */
517 	ASSERT(mp->b_rptr + sizeof (*spmsg) <= mp->b_datap->db_lim);
518 	mp->b_wptr = mp->b_rptr + sizeof (*spmsg);
519 	spmsg->spd_msg_len = SPD_8TO64(sizeof (spd_msg_t));
520 	spmsg->spd_msg_errno = (uint8_t)error;
521 	spmsg->spd_msg_diagnostic = (uint16_t)diagnostic;
522 
523 	qreply(q, mp);
524 }
525 
526 static void
527 spdsock_diag(queue_t *q, mblk_t *mp, int diagnostic)
528 {
529 	spdsock_error(q, mp, EINVAL, diagnostic);
530 }
531 
532 static void
533 spd_echo(queue_t *q, mblk_t *mp)
534 {
535 	qreply(q, mp);
536 }
537 
538 /*
539  * Do NOT consume a reference to itp.
540  */
541 /*ARGSUSED*/
542 static void
543 spdsock_flush_node(ipsec_tun_pol_t *itp, void *cookie, netstack_t *ns)
544 {
545 	boolean_t active = (boolean_t)cookie;
546 	ipsec_policy_head_t *iph;
547 
548 	iph = active ? itp->itp_policy : itp->itp_inactive;
549 	IPPH_REFHOLD(iph);
550 	mutex_enter(&itp->itp_lock);
551 	spdsock_flush_one(iph, ns);
552 	if (active)
553 		itp->itp_flags &= ~ITPF_PFLAGS;
554 	else
555 		itp->itp_flags &= ~ITPF_IFLAGS;
556 	mutex_exit(&itp->itp_lock);
557 }
558 
559 /*
560  * Clear out one polhead.
561  */
562 static void
563 spdsock_flush_one(ipsec_policy_head_t *iph, netstack_t *ns)
564 {
565 	rw_enter(&iph->iph_lock, RW_WRITER);
566 	ipsec_polhead_flush(iph, ns);
567 	rw_exit(&iph->iph_lock);
568 	IPPH_REFRELE(iph, ns);
569 }
570 
571 static void
572 spdsock_flush(queue_t *q, ipsec_policy_head_t *iph, ipsec_tun_pol_t *itp,
573     mblk_t *mp)
574 {
575 	boolean_t active;
576 	spdsock_t *ss = (spdsock_t *)q->q_ptr;
577 	spd_stack_t *spds = ss->spdsock_spds;
578 	netstack_t *ns = spds->spds_netstack;
579 
580 	if (iph != ALL_ACTIVE_POLHEADS && iph != ALL_INACTIVE_POLHEADS) {
581 		spdsock_flush_one(iph, spds->spds_netstack);
582 		if (audit_active) {
583 			spd_msg_t *spmsg = (spd_msg_t *)mp->b_rptr;
584 
585 			active = (spmsg->spd_msg_spdid == SPD_ACTIVE);
586 			audit_pf_policy(SPD_FLUSH, DB_CRED(mp), ns,
587 			    ITP_NAME(itp), active, 0, DB_CPID(mp));
588 		}
589 	} else {
590 		active = (iph == ALL_ACTIVE_POLHEADS);
591 
592 		/* First flush the global policy. */
593 		spdsock_flush_one(active ? ipsec_system_policy(ns) :
594 		    ipsec_inactive_policy(ns), ns);
595 		if (audit_active) {
596 			audit_pf_policy(SPD_FLUSH, DB_CRED(mp), ns, NULL,
597 			    active, 0, DB_CPID(mp));
598 		}
599 		/* Then flush every tunnel's appropriate one. */
600 		itp_walk(spdsock_flush_node, (void *)active,
601 		    spds->spds_netstack);
602 		if (audit_active)
603 			audit_pf_policy(SPD_FLUSH, DB_CRED(mp), ns,
604 			    "all tunnels", active, 0, DB_CPID(mp));
605 	}
606 
607 	spd_echo(q, mp);
608 }
609 
610 static boolean_t
611 spdsock_ext_to_sel(spd_ext_t **extv, ipsec_selkey_t *sel, int *diag)
612 {
613 	bzero(sel, sizeof (*sel));
614 
615 	if (extv[SPD_EXT_PROTO] != NULL) {
616 		struct spd_proto *pr =
617 		    (struct spd_proto *)extv[SPD_EXT_PROTO];
618 		sel->ipsl_proto = pr->spd_proto_number;
619 		sel->ipsl_valid |= IPSL_PROTOCOL;
620 	}
621 	if (extv[SPD_EXT_LCLPORT] != NULL) {
622 		struct spd_portrange *pr =
623 		    (struct spd_portrange *)extv[SPD_EXT_LCLPORT];
624 		sel->ipsl_lport = pr->spd_ports_minport;
625 		sel->ipsl_valid |= IPSL_LOCAL_PORT;
626 	}
627 	if (extv[SPD_EXT_REMPORT] != NULL) {
628 		struct spd_portrange *pr =
629 		    (struct spd_portrange *)extv[SPD_EXT_REMPORT];
630 		sel->ipsl_rport = pr->spd_ports_minport;
631 		sel->ipsl_valid |= IPSL_REMOTE_PORT;
632 	}
633 
634 	if (extv[SPD_EXT_ICMP_TYPECODE] != NULL) {
635 		struct spd_typecode *tc=
636 		    (struct spd_typecode *)extv[SPD_EXT_ICMP_TYPECODE];
637 
638 		sel->ipsl_valid |= IPSL_ICMP_TYPE;
639 		sel->ipsl_icmp_type = tc->spd_typecode_type;
640 		if (tc->spd_typecode_type_end < tc->spd_typecode_type)
641 			sel->ipsl_icmp_type_end = tc->spd_typecode_type;
642 		else
643 			sel->ipsl_icmp_type_end = tc->spd_typecode_type_end;
644 
645 		if (tc->spd_typecode_code != 255) {
646 			sel->ipsl_valid |= IPSL_ICMP_CODE;
647 			sel->ipsl_icmp_code = tc->spd_typecode_code;
648 			if (tc->spd_typecode_code_end < tc->spd_typecode_code)
649 				sel->ipsl_icmp_code_end = tc->spd_typecode_code;
650 			else
651 				sel->ipsl_icmp_code_end =
652 				    tc->spd_typecode_code_end;
653 		}
654 	}
655 #define	ADDR2SEL(sel, extv, field, pfield, extn, bit)			      \
656 	if ((extv)[(extn)] != NULL) {					      \
657 		uint_t addrlen;						      \
658 		struct spd_address *ap = 				      \
659 			(struct spd_address *)((extv)[(extn)]); 	      \
660 		addrlen = (ap->spd_address_af == AF_INET6) ? 		      \
661 			IPV6_ADDR_LEN : IP_ADDR_LEN;			      \
662 		if (SPD_64TO8(ap->spd_address_len) < 			      \
663 			(addrlen + sizeof (*ap))) {			      \
664 			*diag = SPD_DIAGNOSTIC_BAD_ADDR_LEN;		      \
665 			return (B_FALSE);				      \
666 		}							      \
667 		bcopy((ap+1), &((sel)->field), addrlen);		      \
668 		(sel)->pfield = ap->spd_address_prefixlen;		      \
669 		(sel)->ipsl_valid |= (bit);				      \
670 		(sel)->ipsl_valid |= (ap->spd_address_af == AF_INET6) ?	      \
671 			IPSL_IPV6 : IPSL_IPV4;				      \
672 	}
673 
674 	ADDR2SEL(sel, extv, ipsl_local, ipsl_local_pfxlen,
675 	    SPD_EXT_LCLADDR, IPSL_LOCAL_ADDR);
676 	ADDR2SEL(sel, extv, ipsl_remote, ipsl_remote_pfxlen,
677 	    SPD_EXT_REMADDR, IPSL_REMOTE_ADDR);
678 
679 	if ((sel->ipsl_valid & (IPSL_IPV6|IPSL_IPV4)) ==
680 	    (IPSL_IPV6|IPSL_IPV4)) {
681 		*diag = SPD_DIAGNOSTIC_MIXED_AF;
682 		return (B_FALSE);
683 	}
684 
685 #undef ADDR2SEL
686 
687 	return (B_TRUE);
688 }
689 
690 static boolean_t
691 spd_convert_type(uint32_t type, ipsec_act_t *act)
692 {
693 	switch (type) {
694 	case SPD_ACTTYPE_DROP:
695 		act->ipa_type = IPSEC_ACT_DISCARD;
696 		return (B_TRUE);
697 
698 	case SPD_ACTTYPE_PASS:
699 		act->ipa_type = IPSEC_ACT_CLEAR;
700 		return (B_TRUE);
701 
702 	case SPD_ACTTYPE_IPSEC:
703 		act->ipa_type = IPSEC_ACT_APPLY;
704 		return (B_TRUE);
705 	}
706 	return (B_FALSE);
707 }
708 
709 static boolean_t
710 spd_convert_flags(uint32_t flags, ipsec_act_t *act)
711 {
712 	/*
713 	 * Note use of !! for boolean canonicalization.
714 	 */
715 	act->ipa_apply.ipp_use_ah = !!(flags & SPD_APPLY_AH);
716 	act->ipa_apply.ipp_use_esp = !!(flags & SPD_APPLY_ESP);
717 	act->ipa_apply.ipp_use_espa = !!(flags & SPD_APPLY_ESPA);
718 	act->ipa_apply.ipp_use_se = !!(flags & SPD_APPLY_SE);
719 	act->ipa_apply.ipp_use_unique = !!(flags & SPD_APPLY_UNIQUE);
720 	return (B_TRUE);
721 }
722 
723 static void
724 spdsock_reset_act(ipsec_act_t *act)
725 {
726 	bzero(act, sizeof (*act));
727 	act->ipa_apply.ipp_espe_maxbits = IPSEC_MAX_KEYBITS;
728 	act->ipa_apply.ipp_espa_maxbits = IPSEC_MAX_KEYBITS;
729 	act->ipa_apply.ipp_ah_maxbits = IPSEC_MAX_KEYBITS;
730 }
731 
732 /*
733  * Sanity check action against reality, and shrink-wrap key sizes..
734  */
735 static boolean_t
736 spdsock_check_action(ipsec_act_t *act, boolean_t tunnel_polhead, int *diag,
737     spd_stack_t *spds)
738 {
739 	if (tunnel_polhead && act->ipa_apply.ipp_use_unique) {
740 		*diag = SPD_DIAGNOSTIC_ADD_INCON_FLAGS;
741 		return (B_FALSE);
742 	}
743 	if ((act->ipa_type != IPSEC_ACT_APPLY) &&
744 	    (act->ipa_apply.ipp_use_ah ||
745 	    act->ipa_apply.ipp_use_esp ||
746 	    act->ipa_apply.ipp_use_espa ||
747 	    act->ipa_apply.ipp_use_se ||
748 	    act->ipa_apply.ipp_use_unique)) {
749 		*diag = SPD_DIAGNOSTIC_ADD_INCON_FLAGS;
750 		return (B_FALSE);
751 	}
752 	if ((act->ipa_type == IPSEC_ACT_APPLY) &&
753 	    !act->ipa_apply.ipp_use_ah &&
754 	    !act->ipa_apply.ipp_use_esp) {
755 		*diag = SPD_DIAGNOSTIC_ADD_INCON_FLAGS;
756 		return (B_FALSE);
757 	}
758 	return (ipsec_check_action(act, diag, spds->spds_netstack));
759 }
760 
761 /*
762  * We may be short a few error checks here..
763  */
764 static boolean_t
765 spdsock_ext_to_actvec(spd_ext_t **extv, ipsec_act_t **actpp, uint_t *nactp,
766     int *diag, spd_stack_t *spds)
767 {
768 	struct spd_ext_actions *sactp =
769 	    (struct spd_ext_actions *)extv[SPD_EXT_ACTION];
770 	ipsec_act_t act, *actp, *endactp;
771 	struct spd_attribute *attrp, *endattrp;
772 	uint64_t *endp;
773 	int nact;
774 	boolean_t tunnel_polhead;
775 
776 	tunnel_polhead = (extv[SPD_EXT_TUN_NAME] != NULL &&
777 	    (((struct spd_rule *)extv[SPD_EXT_RULE])->spd_rule_flags &
778 	    SPD_RULE_FLAG_TUNNEL));
779 
780 	*actpp = NULL;
781 	*nactp = 0;
782 
783 	if (sactp == NULL) {
784 		*diag = SPD_DIAGNOSTIC_NO_ACTION_EXT;
785 		return (B_FALSE);
786 	}
787 
788 	/*
789 	 * Parse the "action" extension and convert into an action chain.
790 	 */
791 
792 	nact = sactp->spd_actions_count;
793 
794 	endp = (uint64_t *)sactp;
795 	endp += sactp->spd_actions_len;
796 	endattrp = (struct spd_attribute *)endp;
797 
798 	actp = kmem_alloc(sizeof (*actp) * nact, KM_NOSLEEP);
799 	if (actp == NULL) {
800 		*diag = SPD_DIAGNOSTIC_ADD_NO_MEM;
801 		return (B_FALSE);
802 	}
803 	*actpp = actp;
804 	*nactp = nact;
805 	endactp = actp + nact;
806 
807 	spdsock_reset_act(&act);
808 	attrp = (struct spd_attribute *)(&sactp[1]);
809 
810 	for (; attrp < endattrp; attrp++) {
811 		switch (attrp->spd_attr_tag) {
812 		case SPD_ATTR_NOP:
813 			break;
814 
815 		case SPD_ATTR_EMPTY:
816 			spdsock_reset_act(&act);
817 			break;
818 
819 		case SPD_ATTR_END:
820 			attrp = endattrp;
821 			/* FALLTHRU */
822 		case SPD_ATTR_NEXT:
823 			if (actp >= endactp) {
824 				*diag = SPD_DIAGNOSTIC_ADD_WRONG_ACT_COUNT;
825 				goto fail;
826 			}
827 			if (!spdsock_check_action(&act, tunnel_polhead,
828 			    diag, spds))
829 				goto fail;
830 			*actp++ = act;
831 			spdsock_reset_act(&act);
832 			break;
833 
834 		case SPD_ATTR_TYPE:
835 			if (!spd_convert_type(attrp->spd_attr_value, &act)) {
836 				*diag = SPD_DIAGNOSTIC_ADD_BAD_TYPE;
837 				goto fail;
838 			}
839 			break;
840 
841 		case SPD_ATTR_FLAGS:
842 			if (!tunnel_polhead && extv[SPD_EXT_TUN_NAME] != NULL) {
843 				/*
844 				 * Set "sa unique" for transport-mode
845 				 * tunnels whether we want to or not.
846 				 */
847 				attrp->spd_attr_value |= SPD_APPLY_UNIQUE;
848 			}
849 			if (!spd_convert_flags(attrp->spd_attr_value, &act)) {
850 				*diag = SPD_DIAGNOSTIC_ADD_BAD_FLAGS;
851 				goto fail;
852 			}
853 			break;
854 
855 		case SPD_ATTR_AH_AUTH:
856 			if (attrp->spd_attr_value == 0) {
857 				*diag = SPD_DIAGNOSTIC_UNSUPP_AH_ALG;
858 				goto fail;
859 			}
860 			act.ipa_apply.ipp_auth_alg = attrp->spd_attr_value;
861 			break;
862 
863 		case SPD_ATTR_ESP_ENCR:
864 			if (attrp->spd_attr_value == 0) {
865 				*diag = SPD_DIAGNOSTIC_UNSUPP_ESP_ENCR_ALG;
866 				goto fail;
867 			}
868 			act.ipa_apply.ipp_encr_alg = attrp->spd_attr_value;
869 			break;
870 
871 		case SPD_ATTR_ESP_AUTH:
872 			if (attrp->spd_attr_value == 0) {
873 				*diag = SPD_DIAGNOSTIC_UNSUPP_ESP_AUTH_ALG;
874 				goto fail;
875 			}
876 			act.ipa_apply.ipp_esp_auth_alg = attrp->spd_attr_value;
877 			break;
878 
879 		case SPD_ATTR_ENCR_MINBITS:
880 			act.ipa_apply.ipp_espe_minbits = attrp->spd_attr_value;
881 			break;
882 
883 		case SPD_ATTR_ENCR_MAXBITS:
884 			act.ipa_apply.ipp_espe_maxbits = attrp->spd_attr_value;
885 			break;
886 
887 		case SPD_ATTR_AH_MINBITS:
888 			act.ipa_apply.ipp_ah_minbits = attrp->spd_attr_value;
889 			break;
890 
891 		case SPD_ATTR_AH_MAXBITS:
892 			act.ipa_apply.ipp_ah_maxbits = attrp->spd_attr_value;
893 			break;
894 
895 		case SPD_ATTR_ESPA_MINBITS:
896 			act.ipa_apply.ipp_espa_minbits = attrp->spd_attr_value;
897 			break;
898 
899 		case SPD_ATTR_ESPA_MAXBITS:
900 			act.ipa_apply.ipp_espa_maxbits = attrp->spd_attr_value;
901 			break;
902 
903 		case SPD_ATTR_LIFE_SOFT_TIME:
904 		case SPD_ATTR_LIFE_HARD_TIME:
905 		case SPD_ATTR_LIFE_SOFT_BYTES:
906 		case SPD_ATTR_LIFE_HARD_BYTES:
907 			break;
908 
909 		case SPD_ATTR_KM_PROTO:
910 			act.ipa_apply.ipp_km_proto = attrp->spd_attr_value;
911 			break;
912 
913 		case SPD_ATTR_KM_COOKIE:
914 			act.ipa_apply.ipp_km_cookie = attrp->spd_attr_value;
915 			break;
916 
917 		case SPD_ATTR_REPLAY_DEPTH:
918 			act.ipa_apply.ipp_replay_depth = attrp->spd_attr_value;
919 			break;
920 		}
921 	}
922 	if (actp != endactp) {
923 		*diag = SPD_DIAGNOSTIC_ADD_WRONG_ACT_COUNT;
924 		goto fail;
925 	}
926 
927 	return (B_TRUE);
928 fail:
929 	ipsec_actvec_free(*actpp, nact);
930 	*actpp = NULL;
931 	return (B_FALSE);
932 }
933 
934 typedef struct
935 {
936 	ipsec_policy_t *pol;
937 	int dir;
938 } tmprule_t;
939 
940 static int
941 mkrule(ipsec_policy_head_t *iph, struct spd_rule *rule,
942     ipsec_selkey_t *sel, ipsec_act_t *actp, int nact, uint_t dir, uint_t af,
943     tmprule_t **rp, uint64_t *index, spd_stack_t *spds)
944 {
945 	ipsec_policy_t *pol;
946 
947 	sel->ipsl_valid &= ~(IPSL_IPV6|IPSL_IPV4);
948 	sel->ipsl_valid |= af;
949 
950 	pol = ipsec_policy_create(sel, actp, nact, rule->spd_rule_priority,
951 	    index, spds->spds_netstack);
952 	if (pol == NULL)
953 		return (ENOMEM);
954 
955 	(*rp)->pol = pol;
956 	(*rp)->dir = dir;
957 	(*rp)++;
958 
959 	if (!ipsec_check_policy(iph, pol, dir))
960 		return (EEXIST);
961 
962 	rule->spd_rule_index = pol->ipsp_index;
963 	return (0);
964 }
965 
966 static int
967 mkrulepair(ipsec_policy_head_t *iph, struct spd_rule *rule,
968     ipsec_selkey_t *sel, ipsec_act_t *actp, int nact, uint_t dir, uint_t afs,
969     tmprule_t **rp, uint64_t *index, spd_stack_t *spds)
970 {
971 	int error;
972 
973 	if (afs & IPSL_IPV4) {
974 		error = mkrule(iph, rule, sel, actp, nact, dir, IPSL_IPV4, rp,
975 		    index, spds);
976 		if (error != 0)
977 			return (error);
978 	}
979 	if (afs & IPSL_IPV6) {
980 		error = mkrule(iph, rule, sel, actp, nact, dir, IPSL_IPV6, rp,
981 		    index, spds);
982 		if (error != 0)
983 			return (error);
984 	}
985 	return (0);
986 }
987 
988 
989 static void
990 spdsock_addrule(queue_t *q, ipsec_policy_head_t *iph, mblk_t *mp,
991     spd_ext_t **extv, ipsec_tun_pol_t *itp)
992 {
993 	ipsec_selkey_t sel;
994 	ipsec_act_t *actp;
995 	uint_t nact;
996 	int diag = 0, error, afs;
997 	struct spd_rule *rule = (struct spd_rule *)extv[SPD_EXT_RULE];
998 	tmprule_t rules[4], *rulep = &rules[0];
999 	boolean_t tunnel_mode, empty_itp, active;
1000 	uint64_t *index = (itp == NULL) ? NULL : &itp->itp_next_policy_index;
1001 	spdsock_t *ss = (spdsock_t *)q->q_ptr;
1002 	spd_stack_t	*spds = ss->spdsock_spds;
1003 
1004 	if (rule == NULL) {
1005 		spdsock_diag(q, mp, SPD_DIAGNOSTIC_NO_RULE_EXT);
1006 		if (audit_active) {
1007 			spd_msg_t *spmsg = (spd_msg_t *)mp->b_rptr;
1008 
1009 			active = (spmsg->spd_msg_spdid == SPD_ACTIVE);
1010 			audit_pf_policy(SPD_ADDRULE, DB_CRED(mp),
1011 			    spds->spds_netstack, ITP_NAME(itp), active,
1012 			    SPD_DIAGNOSTIC_NO_RULE_EXT, DB_CPID(mp));
1013 		}
1014 		return;
1015 	}
1016 
1017 	tunnel_mode = (rule->spd_rule_flags & SPD_RULE_FLAG_TUNNEL);
1018 
1019 	if (itp != NULL) {
1020 		mutex_enter(&itp->itp_lock);
1021 		ASSERT(itp->itp_policy == iph || itp->itp_inactive == iph);
1022 		active = (itp->itp_policy == iph);
1023 		if (ITP_P_ISACTIVE(itp, iph)) {
1024 			/* Check for mix-and-match of tunnel/transport. */
1025 			if ((tunnel_mode && !ITP_P_ISTUNNEL(itp, iph)) ||
1026 			    (!tunnel_mode && ITP_P_ISTUNNEL(itp, iph))) {
1027 				mutex_exit(&itp->itp_lock);
1028 				spdsock_error(q, mp, EBUSY, 0);
1029 				return;
1030 			}
1031 			empty_itp = B_FALSE;
1032 		} else {
1033 			empty_itp = B_TRUE;
1034 			itp->itp_flags = active ? ITPF_P_ACTIVE : ITPF_I_ACTIVE;
1035 			if (tunnel_mode)
1036 				itp->itp_flags |= active ? ITPF_P_TUNNEL :
1037 				    ITPF_I_TUNNEL;
1038 		}
1039 	} else {
1040 		empty_itp = B_FALSE;
1041 	}
1042 
1043 	if (rule->spd_rule_index != 0) {
1044 		diag = SPD_DIAGNOSTIC_INVALID_RULE_INDEX;
1045 		error = EINVAL;
1046 		goto fail2;
1047 	}
1048 
1049 	if (!spdsock_ext_to_sel(extv, &sel, &diag)) {
1050 		error = EINVAL;
1051 		goto fail2;
1052 	}
1053 
1054 	if (itp != NULL) {
1055 		if (tunnel_mode) {
1056 			if (sel.ipsl_valid &
1057 			    (IPSL_REMOTE_PORT | IPSL_LOCAL_PORT)) {
1058 				itp->itp_flags |= active ?
1059 				    ITPF_P_PER_PORT_SECURITY :
1060 				    ITPF_I_PER_PORT_SECURITY;
1061 			}
1062 		} else {
1063 			/*
1064 			 * For now, we don't allow transport-mode on a tunnel
1065 			 * with ANY specific selectors.  Bail if we have such
1066 			 * a request.
1067 			 */
1068 			if (sel.ipsl_valid & IPSL_WILDCARD) {
1069 				diag = SPD_DIAGNOSTIC_NO_TUNNEL_SELECTORS;
1070 				error = EINVAL;
1071 				goto fail2;
1072 			}
1073 		}
1074 	}
1075 
1076 	if (!spdsock_ext_to_actvec(extv, &actp, &nact, &diag, spds)) {
1077 		error = EINVAL;
1078 		goto fail2;
1079 	}
1080 	/*
1081 	 * If no addresses were specified, add both.
1082 	 */
1083 	afs = sel.ipsl_valid & (IPSL_IPV6|IPSL_IPV4);
1084 	if (afs == 0)
1085 		afs = (IPSL_IPV6|IPSL_IPV4);
1086 
1087 	rw_enter(&iph->iph_lock, RW_WRITER);
1088 
1089 	if (rule->spd_rule_flags & SPD_RULE_FLAG_OUTBOUND) {
1090 		error = mkrulepair(iph, rule, &sel, actp, nact,
1091 		    IPSEC_TYPE_OUTBOUND, afs, &rulep, index, spds);
1092 		if (error != 0)
1093 			goto fail;
1094 	}
1095 
1096 	if (rule->spd_rule_flags & SPD_RULE_FLAG_INBOUND) {
1097 		error = mkrulepair(iph, rule, &sel, actp, nact,
1098 		    IPSEC_TYPE_INBOUND, afs, &rulep, index, spds);
1099 		if (error != 0)
1100 			goto fail;
1101 	}
1102 
1103 	while ((--rulep) >= &rules[0]) {
1104 		ipsec_enter_policy(iph, rulep->pol, rulep->dir,
1105 		    spds->spds_netstack);
1106 	}
1107 	rw_exit(&iph->iph_lock);
1108 	if (itp != NULL)
1109 		mutex_exit(&itp->itp_lock);
1110 
1111 	ipsec_actvec_free(actp, nact);
1112 	spd_echo(q, mp);
1113 	if (audit_active) {
1114 		spd_msg_t *spmsg = (spd_msg_t *)mp->b_rptr;
1115 
1116 		active = (spmsg->spd_msg_spdid == SPD_ACTIVE);
1117 		audit_pf_policy(SPD_ADDRULE, DB_CRED(mp), spds->spds_netstack,
1118 		    ITP_NAME(itp), active, 0, DB_CPID(mp));
1119 	}
1120 	return;
1121 
1122 fail:
1123 	rw_exit(&iph->iph_lock);
1124 	while ((--rulep) >= &rules[0]) {
1125 		IPPOL_REFRELE(rulep->pol, spds->spds_netstack);
1126 	}
1127 	ipsec_actvec_free(actp, nact);
1128 fail2:
1129 	if (itp != NULL) {
1130 		if (empty_itp)
1131 			itp->itp_flags = 0;
1132 		mutex_exit(&itp->itp_lock);
1133 	}
1134 	spdsock_error(q, mp, error, diag);
1135 	if (audit_active) {
1136 		spd_msg_t *spmsg = (spd_msg_t *)mp->b_rptr;
1137 
1138 		active = (spmsg->spd_msg_spdid == SPD_ACTIVE);
1139 		audit_pf_policy(SPD_ADDRULE, DB_CRED(mp), spds->spds_netstack,
1140 		    ITP_NAME(itp), active, error, DB_CPID(mp));
1141 	}
1142 }
1143 
1144 void
1145 spdsock_deleterule(queue_t *q, ipsec_policy_head_t *iph, mblk_t *mp,
1146     spd_ext_t **extv, ipsec_tun_pol_t *itp)
1147 {
1148 	ipsec_selkey_t sel;
1149 	struct spd_rule *rule = (struct spd_rule *)extv[SPD_EXT_RULE];
1150 	int err, diag = 0;
1151 	spdsock_t *ss = (spdsock_t *)q->q_ptr;
1152 	spd_stack_t	*spds = ss->spdsock_spds;
1153 
1154 	if (rule == NULL) {
1155 		spdsock_diag(q, mp, SPD_DIAGNOSTIC_NO_RULE_EXT);
1156 		if (audit_active) {
1157 			boolean_t active;
1158 			spd_msg_t *spmsg = (spd_msg_t *)mp->b_rptr;
1159 
1160 			active = (spmsg->spd_msg_spdid == SPD_ACTIVE);
1161 			audit_pf_policy(SPD_DELETERULE, DB_CRED(mp),
1162 			    spds->spds_netstack, ITP_NAME(itp), active,
1163 			    SPD_DIAGNOSTIC_NO_RULE_EXT, DB_CPID(mp));
1164 		}
1165 		return;
1166 	}
1167 
1168 	/*
1169 	 * Must enter itp_lock first to avoid deadlock.  See tun.c's
1170 	 * set_sec_simple() for the other case of itp_lock and iph_lock.
1171 	 */
1172 	if (itp != NULL)
1173 		mutex_enter(&itp->itp_lock);
1174 
1175 	if (rule->spd_rule_index != 0) {
1176 		if (ipsec_policy_delete_index(iph, rule->spd_rule_index,
1177 		    spds->spds_netstack) != 0) {
1178 			err = ESRCH;
1179 			goto fail;
1180 		}
1181 	} else {
1182 		if (!spdsock_ext_to_sel(extv, &sel, &diag)) {
1183 			err = EINVAL;	/* diag already set... */
1184 			goto fail;
1185 		}
1186 
1187 		if ((rule->spd_rule_flags & SPD_RULE_FLAG_INBOUND) &&
1188 		    !ipsec_policy_delete(iph, &sel, IPSEC_TYPE_INBOUND,
1189 		    spds->spds_netstack)) {
1190 			err = ESRCH;
1191 			goto fail;
1192 		}
1193 
1194 		if ((rule->spd_rule_flags & SPD_RULE_FLAG_OUTBOUND) &&
1195 		    !ipsec_policy_delete(iph, &sel, IPSEC_TYPE_OUTBOUND,
1196 		    spds->spds_netstack)) {
1197 			err = ESRCH;
1198 			goto fail;
1199 		}
1200 	}
1201 
1202 	if (itp != NULL) {
1203 		ASSERT(iph == itp->itp_policy || iph == itp->itp_inactive);
1204 		rw_enter(&iph->iph_lock, RW_READER);
1205 		if (avl_numnodes(&iph->iph_rulebyid) == 0) {
1206 			if (iph == itp->itp_policy)
1207 				itp->itp_flags &= ~ITPF_PFLAGS;
1208 			else
1209 				itp->itp_flags &= ~ITPF_IFLAGS;
1210 		}
1211 		/* Can exit locks in any order. */
1212 		rw_exit(&iph->iph_lock);
1213 		mutex_exit(&itp->itp_lock);
1214 	}
1215 	spd_echo(q, mp);
1216 	if (audit_active) {
1217 		boolean_t active;
1218 		spd_msg_t *spmsg = (spd_msg_t *)mp->b_rptr;
1219 
1220 		active = (spmsg->spd_msg_spdid == SPD_ACTIVE);
1221 		audit_pf_policy(SPD_DELETERULE, DB_CRED(mp),
1222 		    spds->spds_netstack, ITP_NAME(itp), active, 0, DB_CPID(mp));
1223 	}
1224 	return;
1225 fail:
1226 	if (itp != NULL)
1227 		mutex_exit(&itp->itp_lock);
1228 	spdsock_error(q, mp, err, diag);
1229 	if (audit_active) {
1230 		boolean_t active;
1231 		spd_msg_t *spmsg = (spd_msg_t *)mp->b_rptr;
1232 
1233 		active = (spmsg->spd_msg_spdid == SPD_ACTIVE);
1234 		audit_pf_policy(SPD_DELETERULE, DB_CRED(mp),
1235 		    spds->spds_netstack, ITP_NAME(itp), active, err,
1236 		    DB_CPID(mp));
1237 	}
1238 }
1239 
1240 /* Do NOT consume a reference to itp. */
1241 /* ARGSUSED */
1242 static void
1243 spdsock_flip_node(ipsec_tun_pol_t *itp, void *ignoreme, netstack_t *ns)
1244 {
1245 	mutex_enter(&itp->itp_lock);
1246 	ITPF_SWAP(itp->itp_flags);
1247 	ipsec_swap_policy(itp->itp_policy, itp->itp_inactive, ns);
1248 	mutex_exit(&itp->itp_lock);
1249 }
1250 
1251 void
1252 spdsock_flip(queue_t *q, mblk_t *mp, spd_if_t *tunname)
1253 {
1254 	char *tname;
1255 	ipsec_tun_pol_t *itp;
1256 	spdsock_t *ss = (spdsock_t *)q->q_ptr;
1257 	spd_stack_t	*spds = ss->spdsock_spds;
1258 
1259 	if (tunname != NULL) {
1260 		tname = (char *)tunname->spd_if_name;
1261 		if (*tname == '\0') {
1262 			/* can't fail */
1263 			ipsec_swap_global_policy(spds->spds_netstack);
1264 			if (audit_active) {
1265 				boolean_t active;
1266 				spd_msg_t *spmsg = (spd_msg_t *)mp->b_rptr;
1267 
1268 				active = (spmsg->spd_msg_spdid == SPD_ACTIVE);
1269 				audit_pf_policy(SPD_FLIP, DB_CRED(mp),
1270 				    spds->spds_netstack, NULL, active, 0,
1271 				    DB_CPID(mp));
1272 			}
1273 			itp_walk(spdsock_flip_node, NULL, spds->spds_netstack);
1274 			if (audit_active) {
1275 				boolean_t active;
1276 				spd_msg_t *spmsg = (spd_msg_t *)mp->b_rptr;
1277 
1278 				active = (spmsg->spd_msg_spdid == SPD_ACTIVE);
1279 				audit_pf_policy(SPD_FLIP, DB_CRED(mp),
1280 				    spds->spds_netstack, "all tunnels", active,
1281 				    0, DB_CPID(mp));
1282 			}
1283 		} else {
1284 			itp = get_tunnel_policy(tname, spds->spds_netstack);
1285 			if (itp == NULL) {
1286 				/* Better idea for "tunnel not found"? */
1287 				spdsock_error(q, mp, ESRCH, 0);
1288 				if (audit_active) {
1289 					boolean_t active;
1290 					spd_msg_t *spmsg =
1291 					    (spd_msg_t *)mp->b_rptr;
1292 
1293 					active = (spmsg->spd_msg_spdid ==
1294 					    SPD_ACTIVE);
1295 					audit_pf_policy(SPD_FLIP, DB_CRED(mp),
1296 					    spds->spds_netstack, ITP_NAME(itp),
1297 					    active, ESRCH, DB_CPID(mp));
1298 				}
1299 				return;
1300 			}
1301 			spdsock_flip_node(itp, NULL, NULL);
1302 			if (audit_active) {
1303 				boolean_t active;
1304 				spd_msg_t *spmsg = (spd_msg_t *)mp->b_rptr;
1305 
1306 				active = (spmsg->spd_msg_spdid == SPD_ACTIVE);
1307 				audit_pf_policy(SPD_FLIP, DB_CRED(mp),
1308 				    spds->spds_netstack, ITP_NAME(itp), active,
1309 				    0, DB_CPID(mp));
1310 			}
1311 			ITP_REFRELE(itp, spds->spds_netstack);
1312 		}
1313 	} else {
1314 		ipsec_swap_global_policy(spds->spds_netstack);	/* can't fail */
1315 		if (audit_active) {
1316 			boolean_t active;
1317 			spd_msg_t *spmsg = (spd_msg_t *)mp->b_rptr;
1318 
1319 			active = (spmsg->spd_msg_spdid == SPD_ACTIVE);
1320 			audit_pf_policy(SPD_FLIP, DB_CRED(mp),
1321 			    spds->spds_netstack, NULL, active, 0, DB_CPID(mp));
1322 		}
1323 	}
1324 	spd_echo(q, mp);
1325 }
1326 
1327 /*
1328  * Unimplemented feature
1329  */
1330 /* ARGSUSED */
1331 static void
1332 spdsock_lookup(queue_t *q, ipsec_policy_head_t *iph, mblk_t *mp,
1333     spd_ext_t **extv, ipsec_tun_pol_t *itp)
1334 {
1335 	spdsock_error(q, mp, EINVAL, 0);
1336 }
1337 
1338 
1339 static mblk_t *
1340 spdsock_dump_ruleset(mblk_t *req, ipsec_policy_head_t *iph,
1341     uint32_t count, uint16_t error)
1342 {
1343 	size_t len = sizeof (spd_ruleset_ext_t) + sizeof (spd_msg_t);
1344 	spd_msg_t *msg;
1345 	spd_ruleset_ext_t *ruleset;
1346 	mblk_t *m = allocb(len, BPRI_HI);
1347 
1348 	ASSERT(RW_READ_HELD(&iph->iph_lock));
1349 
1350 	if (m == NULL) {
1351 		return (NULL);
1352 	}
1353 	msg = (spd_msg_t *)m->b_rptr;
1354 	ruleset = (spd_ruleset_ext_t *)(&msg[1]);
1355 
1356 	m->b_wptr = (uint8_t *)&ruleset[1];
1357 
1358 	*msg = *(spd_msg_t *)(req->b_rptr);
1359 	msg->spd_msg_len = SPD_8TO64(len);
1360 	msg->spd_msg_errno = error;
1361 
1362 	ruleset->spd_ruleset_len = SPD_8TO64(sizeof (*ruleset));
1363 	ruleset->spd_ruleset_type = SPD_EXT_RULESET;
1364 	ruleset->spd_ruleset_count = count;
1365 	ruleset->spd_ruleset_version = iph->iph_gen;
1366 	return (m);
1367 }
1368 
1369 static mblk_t *
1370 spdsock_dump_finish(spdsock_t *ss, int error)
1371 {
1372 	mblk_t *m;
1373 	ipsec_policy_head_t *iph = ss->spdsock_dump_head;
1374 	mblk_t *req = ss->spdsock_dump_req;
1375 	ipsec_tun_pol_t *itp, dummy;
1376 	spd_stack_t *spds = ss->spdsock_spds;
1377 	netstack_t *ns = spds->spds_netstack;
1378 	ipsec_stack_t *ipss = ns->netstack_ipsec;
1379 
1380 	ss->spdsock_dump_remaining_polheads--;
1381 	if (error == 0 && ss->spdsock_dump_remaining_polheads != 0) {
1382 		/* Attempt a respin with a new policy head. */
1383 		rw_enter(&ipss->ipsec_tunnel_policy_lock, RW_READER);
1384 		/* NOTE:  No need for ITP_REF*() macros here. */
1385 		if (ipss->ipsec_tunnel_policy_gen > ss->spdsock_dump_tun_gen) {
1386 			/* Bail with EAGAIN. */
1387 			error = EAGAIN;
1388 		} else if (ss->spdsock_dump_name[0] == '\0') {
1389 			/* Just finished global, find first node. */
1390 			itp = (ipsec_tun_pol_t *)avl_first(
1391 			    &ipss->ipsec_tunnel_policies);
1392 		} else {
1393 			/*
1394 			 * We just finished current-named polhead, find
1395 			 * the next one.
1396 			 */
1397 			(void) strncpy(dummy.itp_name, ss->spdsock_dump_name,
1398 			    LIFNAMSIZ);
1399 			itp = (ipsec_tun_pol_t *)avl_find(
1400 			    &ipss->ipsec_tunnel_policies, &dummy, NULL);
1401 			ASSERT(itp != NULL);
1402 			itp = (ipsec_tun_pol_t *)AVL_NEXT(
1403 			    &ipss->ipsec_tunnel_policies, itp);
1404 			/* remaining_polheads should maintain this assertion. */
1405 			ASSERT(itp != NULL);
1406 		}
1407 		if (error == 0) {
1408 			(void) strncpy(ss->spdsock_dump_name, itp->itp_name,
1409 			    LIFNAMSIZ);
1410 			/* Reset other spdsock_dump thingies. */
1411 			IPPH_REFRELE(ss->spdsock_dump_head, ns);
1412 			if (ss->spdsock_dump_active) {
1413 				ss->spdsock_dump_tunnel =
1414 				    itp->itp_flags & ITPF_P_TUNNEL;
1415 				iph = itp->itp_policy;
1416 			} else {
1417 				ss->spdsock_dump_tunnel =
1418 				    itp->itp_flags & ITPF_I_TUNNEL;
1419 				iph = itp->itp_inactive;
1420 			}
1421 			IPPH_REFHOLD(iph);
1422 			rw_enter(&iph->iph_lock, RW_READER);
1423 			ss->spdsock_dump_head = iph;
1424 			ss->spdsock_dump_gen = iph->iph_gen;
1425 			ss->spdsock_dump_cur_type = 0;
1426 			ss->spdsock_dump_cur_af = IPSEC_AF_V4;
1427 			ss->spdsock_dump_cur_rule = NULL;
1428 			ss->spdsock_dump_count = 0;
1429 			ss->spdsock_dump_cur_chain = 0;
1430 			rw_exit(&iph->iph_lock);
1431 			rw_exit(&ipss->ipsec_tunnel_policy_lock);
1432 			/* And start again. */
1433 			return (spdsock_dump_next_record(ss));
1434 		}
1435 		rw_exit(&ipss->ipsec_tunnel_policy_lock);
1436 	}
1437 
1438 	rw_enter(&iph->iph_lock, RW_READER);
1439 	m = spdsock_dump_ruleset(req, iph, ss->spdsock_dump_count, error);
1440 	rw_exit(&iph->iph_lock);
1441 	IPPH_REFRELE(iph, ns);
1442 	ss->spdsock_dump_req = NULL;
1443 	freemsg(req);
1444 
1445 	return (m);
1446 }
1447 
1448 /*
1449  * Rule encoding functions.
1450  * We do a two-pass encode.
1451  * If base != NULL, fill in encoded rule part starting at base+offset.
1452  * Always return "offset" plus length of to-be-encoded data.
1453  */
1454 static uint_t
1455 spdsock_encode_typecode(uint8_t *base, uint_t offset, uint8_t type,
1456     uint8_t type_end, uint8_t code, uint8_t code_end)
1457 {
1458 	struct spd_typecode *tcp;
1459 
1460 	ASSERT(ALIGNED64(offset));
1461 
1462 	if (base != NULL) {
1463 		tcp = (struct spd_typecode *)(base + offset);
1464 		tcp->spd_typecode_len = SPD_8TO64(sizeof (*tcp));
1465 		tcp->spd_typecode_exttype = SPD_EXT_ICMP_TYPECODE;
1466 		tcp->spd_typecode_code = code;
1467 		tcp->spd_typecode_type = type;
1468 		tcp->spd_typecode_type_end = type_end;
1469 		tcp->spd_typecode_code_end = code_end;
1470 	}
1471 	offset += sizeof (*tcp);
1472 
1473 	ASSERT(ALIGNED64(offset));
1474 
1475 	return (offset);
1476 }
1477 
1478 static uint_t
1479 spdsock_encode_proto(uint8_t *base, uint_t offset, uint8_t proto)
1480 {
1481 	struct spd_proto *spp;
1482 
1483 	ASSERT(ALIGNED64(offset));
1484 
1485 	if (base != NULL) {
1486 		spp = (struct spd_proto *)(base + offset);
1487 		spp->spd_proto_len = SPD_8TO64(sizeof (*spp));
1488 		spp->spd_proto_exttype = SPD_EXT_PROTO;
1489 		spp->spd_proto_number = proto;
1490 		spp->spd_proto_reserved1 = 0;
1491 		spp->spd_proto_reserved2 = 0;
1492 	}
1493 	offset += sizeof (*spp);
1494 
1495 	ASSERT(ALIGNED64(offset));
1496 
1497 	return (offset);
1498 }
1499 
1500 static uint_t
1501 spdsock_encode_port(uint8_t *base, uint_t offset, uint16_t ext, uint16_t port)
1502 {
1503 	struct spd_portrange *spp;
1504 
1505 	ASSERT(ALIGNED64(offset));
1506 
1507 	if (base != NULL) {
1508 		spp = (struct spd_portrange *)(base + offset);
1509 		spp->spd_ports_len = SPD_8TO64(sizeof (*spp));
1510 		spp->spd_ports_exttype = ext;
1511 		spp->spd_ports_minport = port;
1512 		spp->spd_ports_maxport = port;
1513 	}
1514 	offset += sizeof (*spp);
1515 
1516 	ASSERT(ALIGNED64(offset));
1517 
1518 	return (offset);
1519 }
1520 
1521 static uint_t
1522 spdsock_encode_addr(uint8_t *base, uint_t offset, uint16_t ext,
1523     const ipsec_selkey_t *sel, const ipsec_addr_t *addr, uint_t pfxlen)
1524 {
1525 	struct spd_address *sae;
1526 	ipsec_addr_t *spdaddr;
1527 	uint_t start = offset;
1528 	uint_t addrlen;
1529 	uint_t af;
1530 
1531 	if (sel->ipsl_valid & IPSL_IPV4) {
1532 		af = AF_INET;
1533 		addrlen = IP_ADDR_LEN;
1534 	} else {
1535 		af = AF_INET6;
1536 		addrlen = IPV6_ADDR_LEN;
1537 	}
1538 
1539 	ASSERT(ALIGNED64(offset));
1540 
1541 	if (base != NULL) {
1542 		sae = (struct spd_address *)(base + offset);
1543 		sae->spd_address_exttype = ext;
1544 		sae->spd_address_af = af;
1545 		sae->spd_address_prefixlen = pfxlen;
1546 		sae->spd_address_reserved2 = 0;
1547 
1548 		spdaddr = (ipsec_addr_t *)(&sae[1]);
1549 		bcopy(addr, spdaddr, addrlen);
1550 	}
1551 	offset += sizeof (*sae);
1552 	addrlen = roundup(addrlen, sizeof (uint64_t));
1553 	offset += addrlen;
1554 
1555 	ASSERT(ALIGNED64(offset));
1556 
1557 	if (base != NULL)
1558 		sae->spd_address_len = SPD_8TO64(offset - start);
1559 	return (offset);
1560 }
1561 
1562 static uint_t
1563 spdsock_encode_sel(uint8_t *base, uint_t offset, const ipsec_sel_t *sel)
1564 {
1565 	const ipsec_selkey_t *selkey = &sel->ipsl_key;
1566 
1567 	if (selkey->ipsl_valid & IPSL_PROTOCOL)
1568 		offset = spdsock_encode_proto(base, offset, selkey->ipsl_proto);
1569 	if (selkey->ipsl_valid & IPSL_LOCAL_PORT)
1570 		offset = spdsock_encode_port(base, offset, SPD_EXT_LCLPORT,
1571 		    selkey->ipsl_lport);
1572 	if (selkey->ipsl_valid & IPSL_REMOTE_PORT)
1573 		offset = spdsock_encode_port(base, offset, SPD_EXT_REMPORT,
1574 		    selkey->ipsl_rport);
1575 	if (selkey->ipsl_valid & IPSL_REMOTE_ADDR)
1576 		offset = spdsock_encode_addr(base, offset, SPD_EXT_REMADDR,
1577 		    selkey, &selkey->ipsl_remote, selkey->ipsl_remote_pfxlen);
1578 	if (selkey->ipsl_valid & IPSL_LOCAL_ADDR)
1579 		offset = spdsock_encode_addr(base, offset, SPD_EXT_LCLADDR,
1580 		    selkey, &selkey->ipsl_local, selkey->ipsl_local_pfxlen);
1581 	if (selkey->ipsl_valid & IPSL_ICMP_TYPE) {
1582 		offset = spdsock_encode_typecode(base, offset,
1583 		    selkey->ipsl_icmp_type, selkey->ipsl_icmp_type_end,
1584 		    (selkey->ipsl_valid & IPSL_ICMP_CODE) ?
1585 		    selkey->ipsl_icmp_code : 255,
1586 		    (selkey->ipsl_valid & IPSL_ICMP_CODE) ?
1587 		    selkey->ipsl_icmp_code_end : 255);
1588 	}
1589 	return (offset);
1590 }
1591 
1592 static uint_t
1593 spdsock_encode_actattr(uint8_t *base, uint_t offset, uint32_t tag,
1594     uint32_t value)
1595 {
1596 	struct spd_attribute *attr;
1597 
1598 	ASSERT(ALIGNED64(offset));
1599 
1600 	if (base != NULL) {
1601 		attr = (struct spd_attribute *)(base + offset);
1602 		attr->spd_attr_tag = tag;
1603 		attr->spd_attr_value = value;
1604 	}
1605 	offset += sizeof (struct spd_attribute);
1606 
1607 	ASSERT(ALIGNED64(offset));
1608 
1609 	return (offset);
1610 }
1611 
1612 
1613 #define	EMIT(t, v) offset = spdsock_encode_actattr(base, offset, (t), (v))
1614 
1615 static uint_t
1616 spdsock_encode_action(uint8_t *base, uint_t offset, const ipsec_action_t *ap)
1617 {
1618 	const struct ipsec_act *act = &(ap->ipa_act);
1619 	uint_t flags;
1620 
1621 	EMIT(SPD_ATTR_EMPTY, 0);
1622 	switch (act->ipa_type) {
1623 	case IPSEC_ACT_DISCARD:
1624 	case IPSEC_ACT_REJECT:
1625 		EMIT(SPD_ATTR_TYPE, SPD_ACTTYPE_DROP);
1626 		break;
1627 	case IPSEC_ACT_BYPASS:
1628 	case IPSEC_ACT_CLEAR:
1629 		EMIT(SPD_ATTR_TYPE, SPD_ACTTYPE_PASS);
1630 		break;
1631 
1632 	case IPSEC_ACT_APPLY:
1633 		EMIT(SPD_ATTR_TYPE, SPD_ACTTYPE_IPSEC);
1634 		flags = 0;
1635 		if (act->ipa_apply.ipp_use_ah)
1636 			flags |= SPD_APPLY_AH;
1637 		if (act->ipa_apply.ipp_use_esp)
1638 			flags |= SPD_APPLY_ESP;
1639 		if (act->ipa_apply.ipp_use_espa)
1640 			flags |= SPD_APPLY_ESPA;
1641 		if (act->ipa_apply.ipp_use_se)
1642 			flags |= SPD_APPLY_SE;
1643 		if (act->ipa_apply.ipp_use_unique)
1644 			flags |= SPD_APPLY_UNIQUE;
1645 		EMIT(SPD_ATTR_FLAGS, flags);
1646 		if (flags & SPD_APPLY_AH) {
1647 			EMIT(SPD_ATTR_AH_AUTH, act->ipa_apply.ipp_auth_alg);
1648 			EMIT(SPD_ATTR_AH_MINBITS,
1649 			    act->ipa_apply.ipp_ah_minbits);
1650 			EMIT(SPD_ATTR_AH_MAXBITS,
1651 			    act->ipa_apply.ipp_ah_maxbits);
1652 		}
1653 		if (flags & SPD_APPLY_ESP) {
1654 			EMIT(SPD_ATTR_ESP_ENCR, act->ipa_apply.ipp_encr_alg);
1655 			EMIT(SPD_ATTR_ENCR_MINBITS,
1656 			    act->ipa_apply.ipp_espe_minbits);
1657 			EMIT(SPD_ATTR_ENCR_MAXBITS,
1658 			    act->ipa_apply.ipp_espe_maxbits);
1659 			if (flags & SPD_APPLY_ESPA) {
1660 				EMIT(SPD_ATTR_ESP_AUTH,
1661 				    act->ipa_apply.ipp_esp_auth_alg);
1662 				EMIT(SPD_ATTR_ESPA_MINBITS,
1663 				    act->ipa_apply.ipp_espa_minbits);
1664 				EMIT(SPD_ATTR_ESPA_MAXBITS,
1665 				    act->ipa_apply.ipp_espa_maxbits);
1666 			}
1667 		}
1668 		if (act->ipa_apply.ipp_km_proto != 0)
1669 			EMIT(SPD_ATTR_KM_PROTO, act->ipa_apply.ipp_km_proto);
1670 		if (act->ipa_apply.ipp_km_cookie != 0)
1671 			EMIT(SPD_ATTR_KM_PROTO, act->ipa_apply.ipp_km_cookie);
1672 		if (act->ipa_apply.ipp_replay_depth != 0)
1673 			EMIT(SPD_ATTR_REPLAY_DEPTH,
1674 			    act->ipa_apply.ipp_replay_depth);
1675 		/* Add more here */
1676 		break;
1677 	}
1678 
1679 	return (offset);
1680 }
1681 
1682 static uint_t
1683 spdsock_encode_action_list(uint8_t *base, uint_t offset,
1684     const ipsec_action_t *ap)
1685 {
1686 	struct spd_ext_actions *act;
1687 	uint_t nact = 0;
1688 	uint_t start = offset;
1689 
1690 	ASSERT(ALIGNED64(offset));
1691 
1692 	if (base != NULL) {
1693 		act = (struct spd_ext_actions *)(base + offset);
1694 		act->spd_actions_len = 0;
1695 		act->spd_actions_exttype = SPD_EXT_ACTION;
1696 		act->spd_actions_count = 0;
1697 		act->spd_actions_reserved = 0;
1698 	}
1699 
1700 	offset += sizeof (*act);
1701 
1702 	ASSERT(ALIGNED64(offset));
1703 
1704 	while (ap != NULL) {
1705 		offset = spdsock_encode_action(base, offset, ap);
1706 		ap = ap->ipa_next;
1707 		nact++;
1708 		if (ap != NULL) {
1709 			EMIT(SPD_ATTR_NEXT, 0);
1710 		}
1711 	}
1712 	EMIT(SPD_ATTR_END, 0);
1713 
1714 	ASSERT(ALIGNED64(offset));
1715 
1716 	if (base != NULL) {
1717 		act->spd_actions_count = nact;
1718 		act->spd_actions_len = SPD_8TO64(offset - start);
1719 	}
1720 
1721 	return (offset);
1722 }
1723 
1724 #undef EMIT
1725 
1726 /* ARGSUSED */
1727 static uint_t
1728 spdsock_rule_flags(uint_t dir, uint_t af)
1729 {
1730 	uint_t flags = 0;
1731 
1732 	if (dir == IPSEC_TYPE_INBOUND)
1733 		flags |= SPD_RULE_FLAG_INBOUND;
1734 	if (dir == IPSEC_TYPE_OUTBOUND)
1735 		flags |= SPD_RULE_FLAG_OUTBOUND;
1736 
1737 	return (flags);
1738 }
1739 
1740 
1741 static uint_t
1742 spdsock_encode_rule_head(uint8_t *base, uint_t offset, spd_msg_t *req,
1743     const ipsec_policy_t *rule, uint_t dir, uint_t af, char *name,
1744     boolean_t tunnel)
1745 {
1746 	struct spd_msg *spmsg;
1747 	struct spd_rule *spr;
1748 	spd_if_t *sid;
1749 
1750 	uint_t start = offset;
1751 
1752 	ASSERT(ALIGNED64(offset));
1753 
1754 	if (base != NULL) {
1755 		spmsg = (struct spd_msg *)(base + offset);
1756 		bzero(spmsg, sizeof (*spmsg));
1757 		spmsg->spd_msg_version = PF_POLICY_V1;
1758 		spmsg->spd_msg_type = SPD_DUMP;
1759 		spmsg->spd_msg_seq = req->spd_msg_seq;
1760 		spmsg->spd_msg_pid = req->spd_msg_pid;
1761 	}
1762 	offset += sizeof (struct spd_msg);
1763 
1764 	ASSERT(ALIGNED64(offset));
1765 
1766 	if (base != NULL) {
1767 		spr = (struct spd_rule *)(base + offset);
1768 		spr->spd_rule_type = SPD_EXT_RULE;
1769 		spr->spd_rule_priority = rule->ipsp_prio;
1770 		spr->spd_rule_flags = spdsock_rule_flags(dir, af);
1771 		if (tunnel)
1772 			spr->spd_rule_flags |= SPD_RULE_FLAG_TUNNEL;
1773 		spr->spd_rule_unused = 0;
1774 		spr->spd_rule_len = SPD_8TO64(sizeof (*spr));
1775 		spr->spd_rule_index = rule->ipsp_index;
1776 	}
1777 	offset += sizeof (struct spd_rule);
1778 
1779 	/*
1780 	 * If we have an interface name (i.e. if this policy head came from
1781 	 * a tunnel), add the SPD_EXT_TUN_NAME extension.
1782 	 */
1783 	if (name[0] != '\0') {
1784 
1785 		ASSERT(ALIGNED64(offset));
1786 
1787 		if (base != NULL) {
1788 			sid = (spd_if_t *)(base + offset);
1789 			sid->spd_if_exttype = SPD_EXT_TUN_NAME;
1790 			sid->spd_if_len = SPD_8TO64(sizeof (spd_if_t) +
1791 			    roundup((strlen(name) - 4), 8));
1792 			(void) strlcpy((char *)sid->spd_if_name, name,
1793 			    LIFNAMSIZ);
1794 		}
1795 
1796 		offset += sizeof (spd_if_t) + roundup((strlen(name) - 4), 8);
1797 	}
1798 
1799 	offset = spdsock_encode_sel(base, offset, rule->ipsp_sel);
1800 	offset = spdsock_encode_action_list(base, offset, rule->ipsp_act);
1801 
1802 	ASSERT(ALIGNED64(offset));
1803 
1804 	if (base != NULL) {
1805 		spmsg->spd_msg_len = SPD_8TO64(offset - start);
1806 	}
1807 	return (offset);
1808 }
1809 
1810 /* ARGSUSED */
1811 static mblk_t *
1812 spdsock_encode_rule(mblk_t *req, const ipsec_policy_t *rule,
1813     uint_t dir, uint_t af, char *name, boolean_t tunnel)
1814 {
1815 	mblk_t *m;
1816 	uint_t len;
1817 	spd_msg_t *mreq = (spd_msg_t *)req->b_rptr;
1818 
1819 	/*
1820 	 * Figure out how much space we'll need.
1821 	 */
1822 	len = spdsock_encode_rule_head(NULL, 0, mreq, rule, dir, af, name,
1823 	    tunnel);
1824 
1825 	/*
1826 	 * Allocate mblk.
1827 	 */
1828 	m = allocb(len, BPRI_HI);
1829 	if (m == NULL)
1830 		return (NULL);
1831 
1832 	/*
1833 	 * Fill it in..
1834 	 */
1835 	m->b_wptr = m->b_rptr + len;
1836 	bzero(m->b_rptr, len);
1837 	(void) spdsock_encode_rule_head(m->b_rptr, 0, mreq, rule, dir, af,
1838 	    name, tunnel);
1839 	return (m);
1840 }
1841 
1842 static ipsec_policy_t *
1843 spdsock_dump_next_in_chain(spdsock_t *ss, ipsec_policy_head_t *iph,
1844     ipsec_policy_t *cur)
1845 {
1846 	ASSERT(RW_READ_HELD(&iph->iph_lock));
1847 
1848 	ss->spdsock_dump_count++;
1849 	ss->spdsock_dump_cur_rule = cur->ipsp_hash.hash_next;
1850 	return (cur);
1851 }
1852 
1853 static ipsec_policy_t *
1854 spdsock_dump_next_rule(spdsock_t *ss, ipsec_policy_head_t *iph)
1855 {
1856 	ipsec_policy_t *cur;
1857 	ipsec_policy_root_t *ipr;
1858 	int chain, nchains, type, af;
1859 
1860 	ASSERT(RW_READ_HELD(&iph->iph_lock));
1861 
1862 	cur = ss->spdsock_dump_cur_rule;
1863 
1864 	if (cur != NULL)
1865 		return (spdsock_dump_next_in_chain(ss, iph, cur));
1866 
1867 	type = ss->spdsock_dump_cur_type;
1868 
1869 next:
1870 	chain = ss->spdsock_dump_cur_chain;
1871 	ipr = &iph->iph_root[type];
1872 	nchains = ipr->ipr_nchains;
1873 
1874 	while (chain < nchains) {
1875 		cur = ipr->ipr_hash[chain].hash_head;
1876 		chain++;
1877 		if (cur != NULL) {
1878 			ss->spdsock_dump_cur_chain = chain;
1879 			return (spdsock_dump_next_in_chain(ss, iph, cur));
1880 		}
1881 	}
1882 	ss->spdsock_dump_cur_chain = nchains;
1883 
1884 	af = ss->spdsock_dump_cur_af;
1885 	while (af < IPSEC_NAF) {
1886 		cur = ipr->ipr_nonhash[af];
1887 		af++;
1888 		if (cur != NULL) {
1889 			ss->spdsock_dump_cur_af = af;
1890 			return (spdsock_dump_next_in_chain(ss, iph, cur));
1891 		}
1892 	}
1893 
1894 	type++;
1895 	if (type >= IPSEC_NTYPES)
1896 		return (NULL);
1897 
1898 	ss->spdsock_dump_cur_chain = 0;
1899 	ss->spdsock_dump_cur_type = type;
1900 	ss->spdsock_dump_cur_af = IPSEC_AF_V4;
1901 	goto next;
1902 
1903 }
1904 
1905 static mblk_t *
1906 spdsock_dump_next_record(spdsock_t *ss)
1907 {
1908 	ipsec_policy_head_t *iph;
1909 	ipsec_policy_t *rule;
1910 	mblk_t *m;
1911 	mblk_t *req = ss->spdsock_dump_req;
1912 
1913 	iph = ss->spdsock_dump_head;
1914 
1915 	ASSERT(iph != NULL);
1916 
1917 	rw_enter(&iph->iph_lock, RW_READER);
1918 
1919 	if (iph->iph_gen != ss->spdsock_dump_gen) {
1920 		rw_exit(&iph->iph_lock);
1921 		return (spdsock_dump_finish(ss, EAGAIN));
1922 	}
1923 
1924 	rule = spdsock_dump_next_rule(ss, iph);
1925 
1926 	if (!rule) {
1927 		rw_exit(&iph->iph_lock);
1928 		return (spdsock_dump_finish(ss, 0));
1929 	}
1930 
1931 	m = spdsock_encode_rule(req, rule, ss->spdsock_dump_cur_type,
1932 	    ss->spdsock_dump_cur_af, ss->spdsock_dump_name,
1933 	    ss->spdsock_dump_tunnel);
1934 	rw_exit(&iph->iph_lock);
1935 
1936 	if (m == NULL)
1937 		return (spdsock_dump_finish(ss, ENOMEM));
1938 	return (m);
1939 }
1940 
1941 /*
1942  * Dump records until we run into flow-control back-pressure.
1943  */
1944 static void
1945 spdsock_dump_some(queue_t *q, spdsock_t *ss)
1946 {
1947 	mblk_t *m, *dataind;
1948 
1949 	while ((ss->spdsock_dump_req != NULL) && canputnext(q)) {
1950 		m = spdsock_dump_next_record(ss);
1951 		if (m == NULL)
1952 			return;
1953 		dataind = allocb(sizeof (struct T_data_req), BPRI_HI);
1954 		if (dataind == NULL) {
1955 			freemsg(m);
1956 			return;
1957 		}
1958 		dataind->b_cont = m;
1959 		dataind->b_wptr += sizeof (struct T_data_req);
1960 		((struct T_data_ind *)dataind->b_rptr)->PRIM_type = T_DATA_IND;
1961 		((struct T_data_ind *)dataind->b_rptr)->MORE_flag = 0;
1962 		dataind->b_datap->db_type = M_PROTO;
1963 		putnext(q, dataind);
1964 	}
1965 }
1966 
1967 /*
1968  * Start dumping.
1969  * Format a start-of-dump record, and set up the stream and kick the rsrv
1970  * procedure to continue the job..
1971  */
1972 /* ARGSUSED */
1973 static void
1974 spdsock_dump(queue_t *q, ipsec_policy_head_t *iph, mblk_t *mp)
1975 {
1976 	spdsock_t *ss = (spdsock_t *)q->q_ptr;
1977 	spd_stack_t *spds = ss->spdsock_spds;
1978 	netstack_t *ns = spds->spds_netstack;
1979 	ipsec_stack_t *ipss = ns->netstack_ipsec;
1980 	mblk_t *mr;
1981 
1982 	/* spdsock_parse() already NULL-terminated spdsock_dump_name. */
1983 	if (iph == ALL_ACTIVE_POLHEADS || iph == ALL_INACTIVE_POLHEADS) {
1984 		rw_enter(&ipss->ipsec_tunnel_policy_lock, RW_READER);
1985 		ss->spdsock_dump_remaining_polheads = 1 +
1986 		    avl_numnodes(&ipss->ipsec_tunnel_policies);
1987 		ss->spdsock_dump_tun_gen = ipss->ipsec_tunnel_policy_gen;
1988 		rw_exit(&ipss->ipsec_tunnel_policy_lock);
1989 		if (iph == ALL_ACTIVE_POLHEADS) {
1990 			iph = ipsec_system_policy(ns);
1991 			ss->spdsock_dump_active = B_TRUE;
1992 		} else {
1993 			iph = ipsec_inactive_policy(spds->spds_netstack);
1994 			ss->spdsock_dump_active = B_FALSE;
1995 		}
1996 		ASSERT(ss->spdsock_dump_name[0] == '\0');
1997 	} else {
1998 		ss->spdsock_dump_remaining_polheads = 1;
1999 	}
2000 
2001 	rw_enter(&iph->iph_lock, RW_READER);
2002 
2003 	mr = spdsock_dump_ruleset(mp, iph, 0, 0);
2004 
2005 	if (!mr) {
2006 		rw_exit(&iph->iph_lock);
2007 		spdsock_error(q, mp, ENOMEM, 0);
2008 		return;
2009 	}
2010 
2011 	ss->spdsock_dump_req = mp;
2012 	ss->spdsock_dump_head = iph;
2013 	ss->spdsock_dump_gen = iph->iph_gen;
2014 	ss->spdsock_dump_cur_type = 0;
2015 	ss->spdsock_dump_cur_af = IPSEC_AF_V4;
2016 	ss->spdsock_dump_cur_rule = NULL;
2017 	ss->spdsock_dump_count = 0;
2018 	ss->spdsock_dump_cur_chain = 0;
2019 	rw_exit(&iph->iph_lock);
2020 
2021 	qreply(q, mr);
2022 	qenable(OTHERQ(q));
2023 }
2024 
2025 /* Do NOT consume a reference to ITP. */
2026 void
2027 spdsock_clone_node(ipsec_tun_pol_t *itp, void *ep, netstack_t *ns)
2028 {
2029 	int *errptr = (int *)ep;
2030 
2031 	if (*errptr != 0)
2032 		return;	/* We've failed already for some reason. */
2033 	mutex_enter(&itp->itp_lock);
2034 	ITPF_CLONE(itp->itp_flags);
2035 	*errptr = ipsec_copy_polhead(itp->itp_policy, itp->itp_inactive, ns);
2036 	mutex_exit(&itp->itp_lock);
2037 }
2038 
2039 void
2040 spdsock_clone(queue_t *q, mblk_t *mp, spd_if_t *tunname)
2041 {
2042 	int error;
2043 	char *tname;
2044 	ipsec_tun_pol_t *itp;
2045 	spdsock_t *ss = (spdsock_t *)q->q_ptr;
2046 	spd_stack_t	*spds = ss->spdsock_spds;
2047 
2048 	if (tunname != NULL) {
2049 		tname = (char *)tunname->spd_if_name;
2050 		if (*tname == '\0') {
2051 			error = ipsec_clone_system_policy(spds->spds_netstack);
2052 			if (audit_active) {
2053 				boolean_t active;
2054 				spd_msg_t *spmsg = (spd_msg_t *)mp->b_rptr;
2055 
2056 				active = (spmsg->spd_msg_spdid == SPD_ACTIVE);
2057 				audit_pf_policy(SPD_CLONE, DB_CRED(mp),
2058 				    spds->spds_netstack, NULL, active, error,
2059 				    DB_CPID(mp));
2060 			}
2061 			if (error == 0) {
2062 				itp_walk(spdsock_clone_node, &error,
2063 				    spds->spds_netstack);
2064 				if (audit_active) {
2065 					boolean_t active;
2066 					spd_msg_t *spmsg =
2067 					    (spd_msg_t *)mp->b_rptr;
2068 
2069 					active = (spmsg->spd_msg_spdid ==
2070 					    SPD_ACTIVE);
2071 					audit_pf_policy(SPD_CLONE, DB_CRED(mp),
2072 					    spds->spds_netstack,
2073 					    "all tunnels", active, 0,
2074 					    DB_CPID(mp));
2075 				}
2076 			}
2077 		} else {
2078 			itp = get_tunnel_policy(tname, spds->spds_netstack);
2079 			if (itp == NULL) {
2080 				spdsock_error(q, mp, ENOENT, 0);
2081 				if (audit_active) {
2082 					boolean_t active;
2083 					spd_msg_t *spmsg =
2084 					    (spd_msg_t *)mp->b_rptr;
2085 
2086 					active = (spmsg->spd_msg_spdid ==
2087 					    SPD_ACTIVE);
2088 					audit_pf_policy(SPD_CLONE, DB_CRED(mp),
2089 					    spds->spds_netstack, ITP_NAME(itp),
2090 					    active, ENOENT, DB_CPID(mp));
2091 				}
2092 				return;
2093 			}
2094 			spdsock_clone_node(itp, &error, NULL);
2095 			ITP_REFRELE(itp, spds->spds_netstack);
2096 			if (audit_active) {
2097 				boolean_t active;
2098 				spd_msg_t *spmsg = (spd_msg_t *)mp->b_rptr;
2099 
2100 				active = (spmsg->spd_msg_spdid == SPD_ACTIVE);
2101 				audit_pf_policy(SPD_CLONE, DB_CRED(mp),
2102 				    spds->spds_netstack, ITP_NAME(itp), active,
2103 				    error, DB_CPID(mp));
2104 			}
2105 		}
2106 	} else {
2107 		error = ipsec_clone_system_policy(spds->spds_netstack);
2108 		if (audit_active) {
2109 			boolean_t active;
2110 			spd_msg_t *spmsg = (spd_msg_t *)mp->b_rptr;
2111 
2112 			active = (spmsg->spd_msg_spdid == SPD_ACTIVE);
2113 			audit_pf_policy(SPD_CLONE, DB_CRED(mp),
2114 			    spds->spds_netstack, NULL, active, error,
2115 			    DB_CPID(mp));
2116 		}
2117 	}
2118 
2119 	if (error != 0)
2120 		spdsock_error(q, mp, error, 0);
2121 	else
2122 		spd_echo(q, mp);
2123 }
2124 
2125 /*
2126  * Process a SPD_ALGLIST request. The caller expects separate alg entries
2127  * for AH authentication, ESP authentication, and ESP encryption.
2128  * The same distinction is then used when setting the min and max key
2129  * sizes when defining policies.
2130  */
2131 
2132 #define	SPDSOCK_AH_AUTH		0
2133 #define	SPDSOCK_ESP_AUTH	1
2134 #define	SPDSOCK_ESP_ENCR	2
2135 #define	SPDSOCK_NTYPES		3
2136 
2137 static const uint_t algattr[SPDSOCK_NTYPES] = {
2138 	SPD_ATTR_AH_AUTH,
2139 	SPD_ATTR_ESP_AUTH,
2140 	SPD_ATTR_ESP_ENCR
2141 };
2142 static const uint_t minbitsattr[SPDSOCK_NTYPES] = {
2143 	SPD_ATTR_AH_MINBITS,
2144 	SPD_ATTR_ESPA_MINBITS,
2145 	SPD_ATTR_ENCR_MINBITS
2146 };
2147 static const uint_t maxbitsattr[SPDSOCK_NTYPES] = {
2148 	SPD_ATTR_AH_MAXBITS,
2149 	SPD_ATTR_ESPA_MAXBITS,
2150 	SPD_ATTR_ENCR_MAXBITS
2151 };
2152 static const uint_t defbitsattr[SPDSOCK_NTYPES] = {
2153 	SPD_ATTR_AH_DEFBITS,
2154 	SPD_ATTR_ESPA_DEFBITS,
2155 	SPD_ATTR_ENCR_DEFBITS
2156 };
2157 static const uint_t incrbitsattr[SPDSOCK_NTYPES] = {
2158 	SPD_ATTR_AH_INCRBITS,
2159 	SPD_ATTR_ESPA_INCRBITS,
2160 	SPD_ATTR_ENCR_INCRBITS
2161 };
2162 
2163 #define	ATTRPERALG	6	/* fixed attributes per algs */
2164 
2165 void
2166 spdsock_alglist(queue_t *q, mblk_t *mp)
2167 {
2168 	uint_t algtype;
2169 	uint_t algidx;
2170 	uint_t algcount;
2171 	uint_t size;
2172 	mblk_t *m;
2173 	uint8_t *cur;
2174 	spd_msg_t *msg;
2175 	struct spd_ext_actions *act;
2176 	struct spd_attribute *attr;
2177 	spdsock_t *ss = (spdsock_t *)q->q_ptr;
2178 	spd_stack_t	*spds = ss->spdsock_spds;
2179 	ipsec_stack_t	*ipss = spds->spds_netstack->netstack_ipsec;
2180 
2181 	mutex_enter(&ipss->ipsec_alg_lock);
2182 	/*
2183 	 * The SPD client expects to receive separate entries for
2184 	 * AH authentication and ESP authentication supported algorithms.
2185 	 *
2186 	 * Don't return the "any" algorithms, if defined, as no
2187 	 * kernel policies can be set for these algorithms.
2188 	 */
2189 	algcount = 2 * ipss->ipsec_nalgs[IPSEC_ALG_AUTH] +
2190 	    ipss->ipsec_nalgs[IPSEC_ALG_ENCR];
2191 
2192 	if (ipss->ipsec_alglists[IPSEC_ALG_AUTH][SADB_AALG_NONE] != NULL)
2193 		algcount--;
2194 	if (ipss->ipsec_alglists[IPSEC_ALG_ENCR][SADB_EALG_NONE] != NULL)
2195 		algcount--;
2196 
2197 	/*
2198 	 * For each algorithm, we encode:
2199 	 * ALG / MINBITS / MAXBITS / DEFBITS / INCRBITS / {END, NEXT}
2200 	 */
2201 
2202 	size = sizeof (spd_msg_t) + sizeof (struct spd_ext_actions) +
2203 	    ATTRPERALG * sizeof (struct spd_attribute) * algcount;
2204 
2205 	ASSERT(ALIGNED64(size));
2206 
2207 	m = allocb(size, BPRI_HI);
2208 	if (m == NULL) {
2209 		mutex_exit(&ipss->ipsec_alg_lock);
2210 		spdsock_error(q, mp, ENOMEM, 0);
2211 		return;
2212 	}
2213 
2214 	m->b_wptr = m->b_rptr + size;
2215 	cur = m->b_rptr;
2216 
2217 	msg = (spd_msg_t *)cur;
2218 	bcopy(mp->b_rptr, cur, sizeof (*msg));
2219 
2220 	msg->spd_msg_len = SPD_8TO64(size);
2221 	msg->spd_msg_errno = 0;
2222 	msg->spd_msg_diagnostic = 0;
2223 
2224 	cur += sizeof (*msg);
2225 
2226 	act = (struct spd_ext_actions *)cur;
2227 	cur += sizeof (*act);
2228 
2229 	act->spd_actions_len = SPD_8TO64(size - sizeof (spd_msg_t));
2230 	act->spd_actions_exttype = SPD_EXT_ACTION;
2231 	act->spd_actions_count = algcount;
2232 	act->spd_actions_reserved = 0;
2233 
2234 	attr = (struct spd_attribute *)cur;
2235 
2236 #define	EMIT(tag, value) {					\
2237 		attr->spd_attr_tag = (tag); 			\
2238 		attr->spd_attr_value = (value); 		\
2239 		attr++;			  			\
2240 	}
2241 
2242 	/*
2243 	 * If you change the number of EMIT's here, change
2244 	 * ATTRPERALG above to match
2245 	 */
2246 #define	EMITALGATTRS(_type) {					\
2247 		EMIT(algattr[_type], algid); 		/* 1 */	\
2248 		EMIT(minbitsattr[_type], minbits);	/* 2 */	\
2249 		EMIT(maxbitsattr[_type], maxbits);	/* 3 */	\
2250 		EMIT(defbitsattr[_type], defbits);	/* 4 */	\
2251 		EMIT(incrbitsattr[_type], incr);	/* 5 */	\
2252 		EMIT(SPD_ATTR_NEXT, 0);			/* 6 */	\
2253 	}
2254 
2255 	for (algtype = 0; algtype < IPSEC_NALGTYPES; algtype++) {
2256 		for (algidx = 0; algidx < ipss->ipsec_nalgs[algtype];
2257 		    algidx++) {
2258 			int algid = ipss->ipsec_sortlist[algtype][algidx];
2259 			ipsec_alginfo_t *alg =
2260 			    ipss->ipsec_alglists[algtype][algid];
2261 			uint_t minbits = alg->alg_minbits;
2262 			uint_t maxbits = alg->alg_maxbits;
2263 			uint_t defbits = alg->alg_default_bits;
2264 			uint_t incr = alg->alg_increment;
2265 
2266 			if (algtype == IPSEC_ALG_AUTH) {
2267 				if (algid == SADB_AALG_NONE)
2268 					continue;
2269 				EMITALGATTRS(SPDSOCK_AH_AUTH);
2270 				EMITALGATTRS(SPDSOCK_ESP_AUTH);
2271 			} else {
2272 				if (algid == SADB_EALG_NONE)
2273 					continue;
2274 				ASSERT(algtype == IPSEC_ALG_ENCR);
2275 				EMITALGATTRS(SPDSOCK_ESP_ENCR);
2276 			}
2277 		}
2278 	}
2279 
2280 	mutex_exit(&ipss->ipsec_alg_lock);
2281 
2282 #undef EMITALGATTRS
2283 #undef EMIT
2284 #undef ATTRPERALG
2285 
2286 	attr--;
2287 	attr->spd_attr_tag = SPD_ATTR_END;
2288 
2289 	freemsg(mp);
2290 	qreply(q, m);
2291 }
2292 
2293 /*
2294  * Process a SPD_DUMPALGS request.
2295  */
2296 
2297 #define	ATTRPERALG	7	/* fixed attributes per algs */
2298 
2299 void
2300 spdsock_dumpalgs(queue_t *q, mblk_t *mp)
2301 {
2302 	uint_t algtype;
2303 	uint_t algidx;
2304 	uint_t size;
2305 	mblk_t *m;
2306 	uint8_t *cur;
2307 	spd_msg_t *msg;
2308 	struct spd_ext_actions *act;
2309 	struct spd_attribute *attr;
2310 	ipsec_alginfo_t *alg;
2311 	uint_t algid;
2312 	uint_t i;
2313 	uint_t alg_size;
2314 	spdsock_t *ss = (spdsock_t *)q->q_ptr;
2315 	spd_stack_t	*spds = ss->spdsock_spds;
2316 	ipsec_stack_t	*ipss = spds->spds_netstack->netstack_ipsec;
2317 
2318 	mutex_enter(&ipss->ipsec_alg_lock);
2319 
2320 	/*
2321 	 * For each algorithm, we encode:
2322 	 * ALG / MINBITS / MAXBITS / DEFBITS / INCRBITS / {END, NEXT}
2323 	 *
2324 	 * ALG_ID / ALG_PROTO / ALG_INCRBITS / ALG_NKEYSIZES / ALG_KEYSIZE*
2325 	 * ALG_NBLOCKSIZES / ALG_BLOCKSIZE* / ALG_MECHNAME / {END, NEXT}
2326 	 */
2327 
2328 	/*
2329 	 * Compute the size of the SPD message.
2330 	 */
2331 	size = sizeof (spd_msg_t) + sizeof (struct spd_ext_actions);
2332 
2333 	for (algtype = 0; algtype < IPSEC_NALGTYPES; algtype++) {
2334 		for (algidx = 0; algidx < ipss->ipsec_nalgs[algtype];
2335 		    algidx++) {
2336 			algid = ipss->ipsec_sortlist[algtype][algidx];
2337 			alg = ipss->ipsec_alglists[algtype][algid];
2338 			alg_size = sizeof (struct spd_attribute) *
2339 			    (ATTRPERALG + alg->alg_nkey_sizes +
2340 			    alg->alg_nblock_sizes) + CRYPTO_MAX_MECH_NAME;
2341 			size += alg_size;
2342 		}
2343 	}
2344 
2345 	ASSERT(ALIGNED64(size));
2346 
2347 	m = allocb(size, BPRI_HI);
2348 	if (m == NULL) {
2349 		mutex_exit(&ipss->ipsec_alg_lock);
2350 		spdsock_error(q, mp, ENOMEM, 0);
2351 		return;
2352 	}
2353 
2354 	m->b_wptr = m->b_rptr + size;
2355 	cur = m->b_rptr;
2356 
2357 	msg = (spd_msg_t *)cur;
2358 	bcopy(mp->b_rptr, cur, sizeof (*msg));
2359 
2360 	msg->spd_msg_len = SPD_8TO64(size);
2361 	msg->spd_msg_errno = 0;
2362 	msg->spd_msg_diagnostic = 0;
2363 
2364 	cur += sizeof (*msg);
2365 
2366 	act = (struct spd_ext_actions *)cur;
2367 	cur += sizeof (*act);
2368 
2369 	act->spd_actions_len = SPD_8TO64(size - sizeof (spd_msg_t));
2370 	act->spd_actions_exttype = SPD_EXT_ACTION;
2371 	act->spd_actions_count = ipss->ipsec_nalgs[IPSEC_ALG_AUTH] +
2372 	    ipss->ipsec_nalgs[IPSEC_ALG_ENCR];
2373 	act->spd_actions_reserved = 0;
2374 
2375 	attr = (struct spd_attribute *)cur;
2376 
2377 #define	EMIT(tag, value) {					\
2378 		attr->spd_attr_tag = (tag); 			\
2379 		attr->spd_attr_value = (value); 		\
2380 		attr++;			  			\
2381 	}
2382 
2383 	for (algtype = 0; algtype < IPSEC_NALGTYPES; algtype++) {
2384 		for (algidx = 0; algidx < ipss->ipsec_nalgs[algtype];
2385 		    algidx++) {
2386 
2387 			algid = ipss->ipsec_sortlist[algtype][algidx];
2388 			alg = ipss->ipsec_alglists[algtype][algid];
2389 
2390 			/*
2391 			 * If you change the number of EMIT's here, change
2392 			 * ATTRPERALG above to match
2393 			 */
2394 			EMIT(SPD_ATTR_ALG_ID, algid);
2395 			EMIT(SPD_ATTR_ALG_PROTO, algproto[algtype]);
2396 			EMIT(SPD_ATTR_ALG_INCRBITS, alg->alg_increment);
2397 
2398 			EMIT(SPD_ATTR_ALG_NKEYSIZES, alg->alg_nkey_sizes);
2399 			for (i = 0; i < alg->alg_nkey_sizes; i++)
2400 				EMIT(SPD_ATTR_ALG_KEYSIZE,
2401 				    alg->alg_key_sizes[i]);
2402 
2403 			EMIT(SPD_ATTR_ALG_NBLOCKSIZES, alg->alg_nblock_sizes);
2404 			for (i = 0; i < alg->alg_nblock_sizes; i++)
2405 				EMIT(SPD_ATTR_ALG_BLOCKSIZE,
2406 				    alg->alg_block_sizes[i]);
2407 
2408 			EMIT(SPD_ATTR_ALG_MECHNAME, CRYPTO_MAX_MECH_NAME);
2409 			bcopy(alg->alg_mech_name, attr, CRYPTO_MAX_MECH_NAME);
2410 			attr = (struct spd_attribute *)((char *)attr +
2411 			    CRYPTO_MAX_MECH_NAME);
2412 
2413 			EMIT(SPD_ATTR_NEXT, 0);
2414 		}
2415 	}
2416 
2417 	mutex_exit(&ipss->ipsec_alg_lock);
2418 
2419 #undef EMITALGATTRS
2420 #undef EMIT
2421 #undef ATTRPERALG
2422 
2423 	attr--;
2424 	attr->spd_attr_tag = SPD_ATTR_END;
2425 
2426 	freemsg(mp);
2427 	qreply(q, m);
2428 }
2429 
2430 /*
2431  * Do the actual work of processing an SPD_UPDATEALGS request. Can
2432  * be invoked either once IPsec is loaded on a cached request, or
2433  * when a request is received while IPsec is loaded.
2434  */
2435 static void
2436 spdsock_do_updatealg(spd_ext_t *extv[], int *diag, spd_stack_t *spds)
2437 {
2438 	struct spd_ext_actions *actp;
2439 	struct spd_attribute *attr, *endattr;
2440 	uint64_t *start, *end;
2441 	ipsec_alginfo_t *alg = NULL;
2442 	ipsec_algtype_t alg_type = 0;
2443 	boolean_t skip_alg = B_TRUE, doing_proto = B_FALSE;
2444 	uint_t i, cur_key, cur_block, algid;
2445 
2446 	*diag = -1;
2447 	ASSERT(MUTEX_HELD(&spds->spds_alg_lock));
2448 
2449 	/* parse the message, building the list of algorithms */
2450 
2451 	actp = (struct spd_ext_actions *)extv[SPD_EXT_ACTION];
2452 	if (actp == NULL) {
2453 		*diag = SPD_DIAGNOSTIC_NO_ACTION_EXT;
2454 		return;
2455 	}
2456 
2457 	start = (uint64_t *)actp;
2458 	end = (start + actp->spd_actions_len);
2459 	endattr = (struct spd_attribute *)end;
2460 	attr = (struct spd_attribute *)&actp[1];
2461 
2462 	bzero(spds->spds_algs, IPSEC_NALGTYPES * IPSEC_MAX_ALGS *
2463 	    sizeof (ipsec_alginfo_t *));
2464 
2465 	alg = kmem_zalloc(sizeof (*alg), KM_SLEEP);
2466 
2467 #define	ALG_KEY_SIZES(a)   (((a)->alg_nkey_sizes + 1) * sizeof (uint16_t))
2468 #define	ALG_BLOCK_SIZES(a) (((a)->alg_nblock_sizes + 1) * sizeof (uint16_t))
2469 
2470 	while (attr < endattr) {
2471 		switch (attr->spd_attr_tag) {
2472 		case SPD_ATTR_NOP:
2473 		case SPD_ATTR_EMPTY:
2474 			break;
2475 		case SPD_ATTR_END:
2476 			attr = endattr;
2477 			/* FALLTHRU */
2478 		case SPD_ATTR_NEXT:
2479 			if (doing_proto) {
2480 				doing_proto = B_FALSE;
2481 				break;
2482 			}
2483 			if (skip_alg) {
2484 				ipsec_alg_free(alg);
2485 			} else {
2486 				ipsec_alg_free(
2487 				    spds->spds_algs[alg_type][alg->alg_id]);
2488 				spds->spds_algs[alg_type][alg->alg_id] =
2489 				    alg;
2490 			}
2491 			alg = kmem_zalloc(sizeof (*alg), KM_SLEEP);
2492 			break;
2493 
2494 		case SPD_ATTR_ALG_ID:
2495 			if (attr->spd_attr_value >= IPSEC_MAX_ALGS) {
2496 				ss1dbg(spds, ("spdsock_do_updatealg: "
2497 				    "invalid alg id %d\n",
2498 				    attr->spd_attr_value));
2499 				*diag = SPD_DIAGNOSTIC_ALG_ID_RANGE;
2500 				goto bail;
2501 			}
2502 			alg->alg_id = attr->spd_attr_value;
2503 			break;
2504 
2505 		case SPD_ATTR_ALG_PROTO:
2506 			/* find the alg type */
2507 			for (i = 0; i < NALGPROTOS; i++)
2508 				if (algproto[i] == attr->spd_attr_value)
2509 					break;
2510 			skip_alg = (i == NALGPROTOS);
2511 			if (!skip_alg)
2512 				alg_type = i;
2513 			break;
2514 
2515 		case SPD_ATTR_ALG_INCRBITS:
2516 			alg->alg_increment = attr->spd_attr_value;
2517 			break;
2518 
2519 		case SPD_ATTR_ALG_NKEYSIZES:
2520 			if (alg->alg_key_sizes != NULL) {
2521 				kmem_free(alg->alg_key_sizes,
2522 				    ALG_KEY_SIZES(alg));
2523 			}
2524 			alg->alg_nkey_sizes = attr->spd_attr_value;
2525 			/*
2526 			 * Allocate room for the trailing zero key size
2527 			 * value as well.
2528 			 */
2529 			alg->alg_key_sizes = kmem_zalloc(ALG_KEY_SIZES(alg),
2530 			    KM_SLEEP);
2531 			cur_key = 0;
2532 			break;
2533 
2534 		case SPD_ATTR_ALG_KEYSIZE:
2535 			if (alg->alg_key_sizes == NULL ||
2536 			    cur_key >= alg->alg_nkey_sizes) {
2537 				ss1dbg(spds, ("spdsock_do_updatealg: "
2538 				    "too many key sizes\n"));
2539 				*diag = SPD_DIAGNOSTIC_ALG_NUM_KEY_SIZES;
2540 				goto bail;
2541 			}
2542 			alg->alg_key_sizes[cur_key++] = attr->spd_attr_value;
2543 			break;
2544 
2545 		case SPD_ATTR_ALG_NBLOCKSIZES:
2546 			if (alg->alg_block_sizes != NULL) {
2547 				kmem_free(alg->alg_block_sizes,
2548 				    ALG_BLOCK_SIZES(alg));
2549 			}
2550 			alg->alg_nblock_sizes = attr->spd_attr_value;
2551 			/*
2552 			 * Allocate room for the trailing zero block size
2553 			 * value as well.
2554 			 */
2555 			alg->alg_block_sizes = kmem_zalloc(ALG_BLOCK_SIZES(alg),
2556 			    KM_SLEEP);
2557 			cur_block = 0;
2558 			break;
2559 
2560 		case SPD_ATTR_ALG_BLOCKSIZE:
2561 			if (alg->alg_block_sizes == NULL ||
2562 			    cur_block >= alg->alg_nblock_sizes) {
2563 				ss1dbg(spds, ("spdsock_do_updatealg: "
2564 				    "too many block sizes\n"));
2565 				*diag = SPD_DIAGNOSTIC_ALG_NUM_BLOCK_SIZES;
2566 				goto bail;
2567 			}
2568 			alg->alg_block_sizes[cur_block++] =
2569 			    attr->spd_attr_value;
2570 			break;
2571 
2572 		case SPD_ATTR_ALG_MECHNAME: {
2573 			char *mech_name;
2574 
2575 			if (attr->spd_attr_value > CRYPTO_MAX_MECH_NAME) {
2576 				ss1dbg(spds, ("spdsock_do_updatealg: "
2577 				    "mech name too long\n"));
2578 				*diag = SPD_DIAGNOSTIC_ALG_MECH_NAME_LEN;
2579 				goto bail;
2580 			}
2581 			mech_name = (char *)(attr + 1);
2582 			bcopy(mech_name, alg->alg_mech_name,
2583 			    attr->spd_attr_value);
2584 			alg->alg_mech_name[CRYPTO_MAX_MECH_NAME-1] = '\0';
2585 			attr = (struct spd_attribute *)((char *)attr +
2586 			    attr->spd_attr_value);
2587 			break;
2588 		}
2589 
2590 		case SPD_ATTR_PROTO_ID:
2591 			doing_proto = B_TRUE;
2592 			for (i = 0; i < NALGPROTOS; i++) {
2593 				if (algproto[i] == attr->spd_attr_value) {
2594 					alg_type = i;
2595 					break;
2596 				}
2597 			}
2598 			break;
2599 
2600 		case SPD_ATTR_PROTO_EXEC_MODE:
2601 			if (!doing_proto)
2602 				break;
2603 			for (i = 0; i < NEXECMODES; i++) {
2604 				if (execmodes[i] == attr->spd_attr_value) {
2605 					spds->spds_algs_exec_mode[alg_type] = i;
2606 					break;
2607 				}
2608 			}
2609 			break;
2610 		}
2611 		attr++;
2612 	}
2613 
2614 #undef	ALG_KEY_SIZES
2615 #undef	ALG_BLOCK_SIZES
2616 
2617 	/* update the algorithm tables */
2618 	spdsock_merge_algs(spds);
2619 bail:
2620 	/* cleanup */
2621 	ipsec_alg_free(alg);
2622 	for (alg_type = 0; alg_type < IPSEC_NALGTYPES; alg_type++)
2623 		for (algid = 0; algid < IPSEC_MAX_ALGS; algid++)
2624 		if (spds->spds_algs[alg_type][algid] != NULL)
2625 			ipsec_alg_free(spds->spds_algs[alg_type][algid]);
2626 }
2627 
2628 /*
2629  * Process an SPD_UPDATEALGS request. If IPsec is not loaded, queue
2630  * the request until IPsec loads. If IPsec is loaded, act on it
2631  * immediately.
2632  */
2633 
2634 static void
2635 spdsock_updatealg(queue_t *q, mblk_t *mp, spd_ext_t *extv[])
2636 {
2637 	spdsock_t *ss = (spdsock_t *)q->q_ptr;
2638 	spd_stack_t	*spds = ss->spdsock_spds;
2639 	ipsec_stack_t	*ipss = spds->spds_netstack->netstack_ipsec;
2640 
2641 	if (!ipsec_loaded(ipss)) {
2642 		/*
2643 		 * IPsec is not loaded, save request and return nicely,
2644 		 * the message will be processed once IPsec loads.
2645 		 */
2646 		mblk_t *new_mp;
2647 
2648 		/* last update message wins */
2649 		if ((new_mp = copymsg(mp)) == NULL) {
2650 			spdsock_error(q, mp, ENOMEM, 0);
2651 			return;
2652 		}
2653 		mutex_enter(&spds->spds_alg_lock);
2654 		bcopy(extv, spds->spds_extv_algs,
2655 		    sizeof (spd_ext_t *) * (SPD_EXT_MAX + 1));
2656 		if (spds->spds_mp_algs != NULL)
2657 			freemsg(spds->spds_mp_algs);
2658 		spds->spds_mp_algs = mp;
2659 		spds->spds_algs_pending = B_TRUE;
2660 		mutex_exit(&spds->spds_alg_lock);
2661 		if (audit_active)
2662 			audit_pf_policy(SPD_UPDATEALGS, DB_CRED(mp),
2663 			    spds->spds_netstack, NULL, B_TRUE, EAGAIN,
2664 			    DB_CPID(mp));
2665 		spd_echo(q, new_mp);
2666 	} else {
2667 		/*
2668 		 * IPsec is loaded, act on the message immediately.
2669 		 */
2670 		int diag;
2671 
2672 		mutex_enter(&spds->spds_alg_lock);
2673 		spdsock_do_updatealg(extv, &diag, spds);
2674 		mutex_exit(&spds->spds_alg_lock);
2675 		if (diag == -1) {
2676 			spd_echo(q, mp);
2677 		if (audit_active)
2678 			audit_pf_policy(SPD_UPDATEALGS, DB_CRED(mp),
2679 			    spds->spds_netstack, NULL, B_TRUE, 0,
2680 			    DB_CPID(mp));
2681 		} else {
2682 			spdsock_diag(q, mp, diag);
2683 		if (audit_active)
2684 			audit_pf_policy(SPD_UPDATEALGS, DB_CRED(mp),
2685 			    spds->spds_netstack, NULL, B_TRUE, diag,
2686 			    DB_CPID(mp));
2687 		}
2688 	}
2689 }
2690 
2691 /*
2692  * With a reference-held ill, dig down and find an instance of "tun", and
2693  * assign its tunnel policy pointer, while reference-holding it.  Also,
2694  * release ill's refrence when finished.
2695  *
2696  * We'll be messing with q_next, so be VERY careful.
2697  */
2698 static void
2699 find_tun_and_set_itp(ill_t *ill, ipsec_tun_pol_t *itp)
2700 {
2701 	queue_t *q;
2702 	tun_t *tun;
2703 
2704 	/* Don't bother if this ill is going away. */
2705 	if (ill->ill_flags & ILL_CONDEMNED) {
2706 		ill_refrele(ill);
2707 		return;
2708 	}
2709 
2710 
2711 	q = ill->ill_wq;
2712 	claimstr(q);	/* Lighter-weight than freezestr(). */
2713 
2714 	do {
2715 		/* Use strcmp() because "tun" is bounded. */
2716 		if (strcmp(q->q_qinfo->qi_minfo->mi_idname, "tun") == 0) {
2717 			/* Aha!  Got it. */
2718 			tun = (tun_t *)q->q_ptr;
2719 			if (tun != NULL) {
2720 				mutex_enter(&tun->tun_lock);
2721 				if (tun->tun_itp != itp) {
2722 					ASSERT(tun->tun_itp == NULL);
2723 					ITP_REFHOLD(itp);
2724 					tun->tun_itp = itp;
2725 				}
2726 				mutex_exit(&tun->tun_lock);
2727 				goto release_and_return;
2728 			}
2729 			/*
2730 			 * Else assume this is some other module named "tun"
2731 			 * and move on, hoping we find one that actually has
2732 			 * something in q_ptr.
2733 			 */
2734 		}
2735 		q = q->q_next;
2736 	} while (q != NULL);
2737 
2738 release_and_return:
2739 	releasestr(ill->ill_wq);
2740 	ill_refrele(ill);
2741 }
2742 
2743 /*
2744  * Sort through the mess of polhead options to retrieve an appropriate one.
2745  * Returns NULL if we send an spdsock error.  Returns a valid pointer if we
2746  * found a valid polhead.  Returns ALL_ACTIVE_POLHEADS (aka. -1) or
2747  * ALL_INACTIVE_POLHEADS (aka. -2) if the operation calls for the operation to
2748  * act on ALL policy heads.
2749  */
2750 static ipsec_policy_head_t *
2751 get_appropriate_polhead(queue_t *q, mblk_t *mp, spd_if_t *tunname, int spdid,
2752     int msgtype, ipsec_tun_pol_t **itpp)
2753 {
2754 	ipsec_tun_pol_t *itp;
2755 	ipsec_policy_head_t *iph;
2756 	int errno;
2757 	char *tname;
2758 	boolean_t active;
2759 	spdsock_t *ss = (spdsock_t *)q->q_ptr;
2760 	spd_stack_t	*spds = ss->spdsock_spds;
2761 	netstack_t	*ns = spds->spds_netstack;
2762 	uint64_t gen;	/* Placeholder */
2763 	ill_t *v4, *v6;
2764 
2765 	active = (spdid == SPD_ACTIVE);
2766 	*itpp = NULL;
2767 	if (!active && spdid != SPD_STANDBY) {
2768 		spdsock_diag(q, mp, SPD_DIAGNOSTIC_BAD_SPDID);
2769 		return (NULL);
2770 	}
2771 
2772 	if (tunname != NULL) {
2773 		/* Acting on a tunnel's SPD. */
2774 		tname = (char *)tunname->spd_if_name;
2775 		if (*tname == '\0') {
2776 			/* Handle all-polhead cases here. */
2777 			if (msgtype != SPD_FLUSH && msgtype != SPD_DUMP) {
2778 				spdsock_diag(q, mp,
2779 				    SPD_DIAGNOSTIC_NOT_GLOBAL_OP);
2780 				return (NULL);
2781 			}
2782 			return (active ? ALL_ACTIVE_POLHEADS :
2783 			    ALL_INACTIVE_POLHEADS);
2784 		}
2785 
2786 		itp = get_tunnel_policy(tname, spds->spds_netstack);
2787 		if (itp == NULL) {
2788 			if (msgtype != SPD_ADDRULE) {
2789 				/* "Tunnel not found" */
2790 				spdsock_error(q, mp, ENOENT, 0);
2791 				return (NULL);
2792 			}
2793 
2794 			errno = 0;
2795 			itp = create_tunnel_policy(tname, &errno, &gen,
2796 			    spds->spds_netstack);
2797 			if (itp == NULL) {
2798 				/*
2799 				 * Something very bad happened, most likely
2800 				 * ENOMEM.  Return an indicator.
2801 				 */
2802 				spdsock_error(q, mp, errno, 0);
2803 				return (NULL);
2804 			}
2805 		}
2806 		/*
2807 		 * Troll the plumbed tunnels and see if we have a
2808 		 * match.  We need to do this always in case we add
2809 		 * policy AFTER plumbing a tunnel.
2810 		 */
2811 		v4 = ill_lookup_on_name(tname, B_FALSE, B_FALSE, NULL,
2812 		    NULL, NULL, &errno, NULL, ns->netstack_ip);
2813 		if (v4 != NULL)
2814 			find_tun_and_set_itp(v4, itp);
2815 		v6 = ill_lookup_on_name(tname, B_FALSE, B_TRUE, NULL,
2816 		    NULL, NULL, &errno, NULL, ns->netstack_ip);
2817 		if (v6 != NULL)
2818 			find_tun_and_set_itp(v6, itp);
2819 		ASSERT(itp != NULL);
2820 		*itpp = itp;
2821 		/* For spdsock dump state, set the polhead's name. */
2822 		if (msgtype == SPD_DUMP) {
2823 			(void) strncpy(ss->spdsock_dump_name, tname, LIFNAMSIZ);
2824 			ss->spdsock_dump_tunnel = itp->itp_flags &
2825 			    (active ? ITPF_P_TUNNEL : ITPF_I_TUNNEL);
2826 		}
2827 	} else {
2828 		itp = NULL;
2829 		/* For spdsock dump state, indicate it's global policy. */
2830 		if (msgtype == SPD_DUMP)
2831 			ss->spdsock_dump_name[0] = '\0';
2832 	}
2833 
2834 	if (active)
2835 		iph = (itp == NULL) ? ipsec_system_policy(ns) : itp->itp_policy;
2836 	else
2837 		iph = (itp == NULL) ? ipsec_inactive_policy(ns) :
2838 		    itp->itp_inactive;
2839 
2840 	ASSERT(iph != NULL);
2841 	if (itp != NULL) {
2842 		IPPH_REFHOLD(iph);
2843 	}
2844 
2845 	return (iph);
2846 }
2847 
2848 static void
2849 spdsock_parse(queue_t *q, mblk_t *mp)
2850 {
2851 	spd_msg_t *spmsg;
2852 	spd_ext_t *extv[SPD_EXT_MAX + 1];
2853 	uint_t msgsize;
2854 	ipsec_policy_head_t *iph;
2855 	ipsec_tun_pol_t *itp;
2856 	spd_if_t *tunname;
2857 	spdsock_t *ss = (spdsock_t *)q->q_ptr;
2858 	spd_stack_t *spds = ss->spdsock_spds;
2859 	netstack_t *ns = spds->spds_netstack;
2860 	ipsec_stack_t *ipss = ns->netstack_ipsec;
2861 
2862 	/* Make sure nothing's below me. */
2863 	ASSERT(WR(q)->q_next == NULL);
2864 
2865 	spmsg = (spd_msg_t *)mp->b_rptr;
2866 
2867 	msgsize = SPD_64TO8(spmsg->spd_msg_len);
2868 
2869 	if (msgdsize(mp) != msgsize) {
2870 		/*
2871 		 * Message len incorrect w.r.t. actual size.  Send an error
2872 		 * (EMSGSIZE).	It may be necessary to massage things a
2873 		 * bit.	 For example, if the spd_msg_type is hosed,
2874 		 * I need to set it to SPD_RESERVED to get delivery to
2875 		 * do the right thing.	Then again, maybe just letting
2876 		 * the error delivery do the right thing.
2877 		 */
2878 		ss2dbg(spds,
2879 		    ("mblk (%lu) and base (%d) message sizes don't jibe.\n",
2880 		    msgdsize(mp), msgsize));
2881 		spdsock_error(q, mp, EMSGSIZE, SPD_DIAGNOSTIC_NONE);
2882 		return;
2883 	}
2884 
2885 	if (msgsize > (uint_t)(mp->b_wptr - mp->b_rptr)) {
2886 		/* Get all message into one mblk. */
2887 		if (pullupmsg(mp, -1) == 0) {
2888 			/*
2889 			 * Something screwy happened.
2890 			 */
2891 			ss3dbg(spds, ("spdsock_parse: pullupmsg() failed.\n"));
2892 			return;
2893 		} else {
2894 			spmsg = (spd_msg_t *)mp->b_rptr;
2895 		}
2896 	}
2897 
2898 	switch (spdsock_get_ext(extv, spmsg, msgsize)) {
2899 	case KGE_DUP:
2900 		/* Handle duplicate extension. */
2901 		ss1dbg(spds, ("Got duplicate extension of type %d.\n",
2902 		    extv[0]->spd_ext_type));
2903 		spdsock_diag(q, mp, dup_ext_diag[extv[0]->spd_ext_type]);
2904 		return;
2905 	case KGE_UNK:
2906 		/* Handle unknown extension. */
2907 		ss1dbg(spds, ("Got unknown extension of type %d.\n",
2908 		    extv[0]->spd_ext_type));
2909 		spdsock_diag(q, mp, SPD_DIAGNOSTIC_UNKNOWN_EXT);
2910 		return;
2911 	case KGE_LEN:
2912 		/* Length error. */
2913 		ss1dbg(spds, ("Length %d on extension type %d overrun or 0.\n",
2914 		    extv[0]->spd_ext_len, extv[0]->spd_ext_type));
2915 		spdsock_diag(q, mp, SPD_DIAGNOSTIC_BAD_EXTLEN);
2916 		return;
2917 	case KGE_CHK:
2918 		/* Reality check failed. */
2919 		ss1dbg(spds, ("Reality check failed on extension type %d.\n",
2920 		    extv[0]->spd_ext_type));
2921 		spdsock_diag(q, mp, bad_ext_diag[extv[0]->spd_ext_type]);
2922 		return;
2923 	default:
2924 		/* Default case is no errors. */
2925 		break;
2926 	}
2927 
2928 	/*
2929 	 * Special-case SPD_UPDATEALGS so as not to load IPsec.
2930 	 */
2931 	if (!ipsec_loaded(ipss) && spmsg->spd_msg_type != SPD_UPDATEALGS) {
2932 		spdsock_t *ss = (spdsock_t *)q->q_ptr;
2933 
2934 		ASSERT(ss != NULL);
2935 		ipsec_loader_loadnow(ipss);
2936 		ss->spdsock_timeout_arg = mp;
2937 		ss->spdsock_timeout = qtimeout(q, spdsock_loadcheck,
2938 		    q, LOADCHECK_INTERVAL);
2939 		return;
2940 	}
2941 
2942 	/* First check for messages that need no polheads at all. */
2943 	switch (spmsg->spd_msg_type) {
2944 	case SPD_UPDATEALGS:
2945 		spdsock_updatealg(q, mp, extv);
2946 		return;
2947 	case SPD_ALGLIST:
2948 		spdsock_alglist(q, mp);
2949 		return;
2950 	case SPD_DUMPALGS:
2951 		spdsock_dumpalgs(q, mp);
2952 		return;
2953 	}
2954 
2955 	/*
2956 	 * Then check for ones that need both primary/secondary polheads,
2957 	 * finding the appropriate tunnel policy if need be.
2958 	 */
2959 	tunname = (spd_if_t *)extv[SPD_EXT_TUN_NAME];
2960 	switch (spmsg->spd_msg_type) {
2961 	case SPD_FLIP:
2962 		spdsock_flip(q, mp, tunname);
2963 		return;
2964 	case SPD_CLONE:
2965 		spdsock_clone(q, mp, tunname);
2966 		return;
2967 	}
2968 
2969 	/*
2970 	 * Finally, find ones that operate on exactly one polhead, or
2971 	 * "all polheads" of a given type (active/inactive).
2972 	 */
2973 	iph = get_appropriate_polhead(q, mp, tunname, spmsg->spd_msg_spdid,
2974 	    spmsg->spd_msg_type, &itp);
2975 	if (iph == NULL)
2976 		return;
2977 
2978 	/* All-polheads-ready operations. */
2979 	switch (spmsg->spd_msg_type) {
2980 	case SPD_FLUSH:
2981 		if (itp != NULL) {
2982 			mutex_enter(&itp->itp_lock);
2983 			if (spmsg->spd_msg_spdid == SPD_ACTIVE)
2984 				itp->itp_flags &= ~ITPF_PFLAGS;
2985 			else
2986 				itp->itp_flags &= ~ITPF_IFLAGS;
2987 			mutex_exit(&itp->itp_lock);
2988 			ITP_REFRELE(itp, ns);
2989 		}
2990 		spdsock_flush(q, iph, itp, mp);
2991 		return;
2992 	case SPD_DUMP:
2993 		if (itp != NULL)
2994 			ITP_REFRELE(itp, ns);
2995 		spdsock_dump(q, iph, mp);
2996 		return;
2997 	}
2998 
2999 	if (iph == ALL_ACTIVE_POLHEADS || iph == ALL_INACTIVE_POLHEADS) {
3000 		spdsock_diag(q, mp, SPD_DIAGNOSTIC_NOT_GLOBAL_OP);
3001 		return;
3002 	}
3003 
3004 	/* Single-polhead-only operations. */
3005 	switch (spmsg->spd_msg_type) {
3006 	case SPD_ADDRULE:
3007 		spdsock_addrule(q, iph, mp, extv, itp);
3008 		break;
3009 	case SPD_DELETERULE:
3010 		spdsock_deleterule(q, iph, mp, extv, itp);
3011 		break;
3012 	case SPD_LOOKUP:
3013 		spdsock_lookup(q, iph, mp, extv, itp);
3014 		break;
3015 	default:
3016 		spdsock_diag(q, mp, SPD_DIAGNOSTIC_BAD_MSG_TYPE);
3017 		break;
3018 	}
3019 
3020 	IPPH_REFRELE(iph, spds->spds_netstack);
3021 	if (itp != NULL)
3022 		ITP_REFRELE(itp, ns);
3023 }
3024 
3025 /*
3026  * If an algorithm mapping was received before IPsec was loaded, process it.
3027  * Called from the IPsec loader.
3028  */
3029 void
3030 spdsock_update_pending_algs(netstack_t *ns)
3031 {
3032 	spd_stack_t *spds = ns->netstack_spdsock;
3033 
3034 	mutex_enter(&spds->spds_alg_lock);
3035 	if (spds->spds_algs_pending) {
3036 		int diag;
3037 
3038 		spdsock_do_updatealg(spds->spds_extv_algs, &diag,
3039 		    spds);
3040 		spds->spds_algs_pending = B_FALSE;
3041 	}
3042 	mutex_exit(&spds->spds_alg_lock);
3043 }
3044 
3045 static void
3046 spdsock_loadcheck(void *arg)
3047 {
3048 	queue_t *q = (queue_t *)arg;
3049 	spdsock_t *ss = (spdsock_t *)q->q_ptr;
3050 	mblk_t *mp;
3051 	spd_stack_t	*spds = ss->spdsock_spds;
3052 	ipsec_stack_t	*ipss = spds->spds_netstack->netstack_ipsec;
3053 
3054 	ASSERT(ss != NULL);
3055 
3056 	ss->spdsock_timeout = 0;
3057 	mp = ss->spdsock_timeout_arg;
3058 	ASSERT(mp != NULL);
3059 	ss->spdsock_timeout_arg = NULL;
3060 	if (ipsec_failed(ipss))
3061 		spdsock_error(q, mp, EPROTONOSUPPORT, 0);
3062 	else
3063 		spdsock_parse(q, mp);
3064 }
3065 
3066 /*
3067  * Copy relevant state bits.
3068  */
3069 static void
3070 spdsock_copy_info(struct T_info_ack *tap, spdsock_t *ss)
3071 {
3072 	*tap = spdsock_g_t_info_ack;
3073 	tap->CURRENT_state = ss->spdsock_state;
3074 	tap->OPT_size = spdsock_max_optsize;
3075 }
3076 
3077 /*
3078  * This routine responds to T_CAPABILITY_REQ messages.  It is called by
3079  * spdsock_wput.  Much of the T_CAPABILITY_ACK information is copied from
3080  * spdsock_g_t_info_ack.  The current state of the stream is copied from
3081  * spdsock_state.
3082  */
3083 static void
3084 spdsock_capability_req(queue_t *q, mblk_t *mp)
3085 {
3086 	spdsock_t *ss = (spdsock_t *)q->q_ptr;
3087 	t_uscalar_t cap_bits1;
3088 	struct T_capability_ack	*tcap;
3089 
3090 	cap_bits1 = ((struct T_capability_req *)mp->b_rptr)->CAP_bits1;
3091 
3092 	mp = tpi_ack_alloc(mp, sizeof (struct T_capability_ack),
3093 	    mp->b_datap->db_type, T_CAPABILITY_ACK);
3094 	if (mp == NULL)
3095 		return;
3096 
3097 	tcap = (struct T_capability_ack *)mp->b_rptr;
3098 	tcap->CAP_bits1 = 0;
3099 
3100 	if (cap_bits1 & TC1_INFO) {
3101 		spdsock_copy_info(&tcap->INFO_ack, ss);
3102 		tcap->CAP_bits1 |= TC1_INFO;
3103 	}
3104 
3105 	qreply(q, mp);
3106 }
3107 
3108 /*
3109  * This routine responds to T_INFO_REQ messages. It is called by
3110  * spdsock_wput_other.
3111  * Most of the T_INFO_ACK information is copied from spdsock_g_t_info_ack.
3112  * The current state of the stream is copied from spdsock_state.
3113  */
3114 static void
3115 spdsock_info_req(q, mp)
3116 	queue_t	*q;
3117 	mblk_t	*mp;
3118 {
3119 	mp = tpi_ack_alloc(mp, sizeof (struct T_info_ack), M_PCPROTO,
3120 	    T_INFO_ACK);
3121 	if (mp == NULL)
3122 		return;
3123 	spdsock_copy_info((struct T_info_ack *)mp->b_rptr,
3124 	    (spdsock_t *)q->q_ptr);
3125 	qreply(q, mp);
3126 }
3127 
3128 /*
3129  * spdsock_err_ack. This routine creates a
3130  * T_ERROR_ACK message and passes it
3131  * upstream.
3132  */
3133 static void
3134 spdsock_err_ack(q, mp, t_error, sys_error)
3135 	queue_t	*q;
3136 	mblk_t	*mp;
3137 	int	t_error;
3138 	int	sys_error;
3139 {
3140 	if ((mp = mi_tpi_err_ack_alloc(mp, t_error, sys_error)) != NULL)
3141 		qreply(q, mp);
3142 }
3143 
3144 /*
3145  * This routine retrieves the current status of socket options.
3146  * It returns the size of the option retrieved.
3147  */
3148 /* ARGSUSED */
3149 int
3150 spdsock_opt_get(queue_t *q, int level, int name, uchar_t *ptr)
3151 {
3152 	int *i1 = (int *)ptr;
3153 
3154 	switch (level) {
3155 	case SOL_SOCKET:
3156 		switch (name) {
3157 		case SO_TYPE:
3158 			*i1 = SOCK_RAW;
3159 			break;
3160 		/*
3161 		 * The following two items can be manipulated,
3162 		 * but changing them should do nothing.
3163 		 */
3164 		case SO_SNDBUF:
3165 			*i1 = (int)q->q_hiwat;
3166 			break;
3167 		case SO_RCVBUF:
3168 			*i1 = (int)(RD(q)->q_hiwat);
3169 			break;
3170 		}
3171 		break;
3172 	default:
3173 		return (0);
3174 	}
3175 	return (sizeof (int));
3176 }
3177 
3178 /*
3179  * This routine sets socket options.
3180  */
3181 /* ARGSUSED */
3182 int
3183 spdsock_opt_set(queue_t *q, uint_t mgmt_flags, int level, int name,
3184     uint_t inlen, uchar_t *invalp, uint_t *outlenp, uchar_t *outvalp,
3185     void *thisdg_attrs, cred_t *cr, mblk_t *mblk)
3186 {
3187 	int *i1 = (int *)invalp;
3188 	spdsock_t *ss = (spdsock_t *)q->q_ptr;
3189 	spd_stack_t	*spds = ss->spdsock_spds;
3190 
3191 	switch (level) {
3192 	case SOL_SOCKET:
3193 		switch (name) {
3194 		case SO_SNDBUF:
3195 			if (*i1 > spds->spds_max_buf)
3196 				return (ENOBUFS);
3197 			q->q_hiwat = *i1;
3198 			break;
3199 		case SO_RCVBUF:
3200 			if (*i1 > spds->spds_max_buf)
3201 				return (ENOBUFS);
3202 			RD(q)->q_hiwat = *i1;
3203 			(void) mi_set_sth_hiwat(RD(q), *i1);
3204 			break;
3205 		}
3206 		break;
3207 	}
3208 	return (0);
3209 }
3210 
3211 
3212 /*
3213  * Handle STREAMS messages.
3214  */
3215 static void
3216 spdsock_wput_other(queue_t *q, mblk_t *mp)
3217 {
3218 	struct iocblk *iocp;
3219 	int error;
3220 	spdsock_t *ss = (spdsock_t *)q->q_ptr;
3221 	spd_stack_t	*spds = ss->spdsock_spds;
3222 	cred_t		*cr;
3223 
3224 	switch (mp->b_datap->db_type) {
3225 	case M_PROTO:
3226 	case M_PCPROTO:
3227 		if ((mp->b_wptr - mp->b_rptr) < sizeof (long)) {
3228 			ss3dbg(spds, (
3229 			    "spdsock_wput_other: Not big enough M_PROTO\n"));
3230 			freemsg(mp);
3231 			return;
3232 		}
3233 		cr = zone_get_kcred(netstackid_to_zoneid(
3234 		    spds->spds_netstack->netstack_stackid));
3235 		ASSERT(cr != NULL);
3236 
3237 		switch (((union T_primitives *)mp->b_rptr)->type) {
3238 		case T_CAPABILITY_REQ:
3239 			spdsock_capability_req(q, mp);
3240 			break;
3241 		case T_INFO_REQ:
3242 			spdsock_info_req(q, mp);
3243 			break;
3244 		case T_SVR4_OPTMGMT_REQ:
3245 			(void) svr4_optcom_req(q, mp, DB_CREDDEF(mp, cr),
3246 			    &spdsock_opt_obj, B_FALSE);
3247 			break;
3248 		case T_OPTMGMT_REQ:
3249 			(void) tpi_optcom_req(q, mp, DB_CREDDEF(mp, cr),
3250 			    &spdsock_opt_obj, B_FALSE);
3251 			break;
3252 		case T_DATA_REQ:
3253 		case T_EXDATA_REQ:
3254 		case T_ORDREL_REQ:
3255 			/* Illegal for spdsock. */
3256 			freemsg(mp);
3257 			(void) putnextctl1(RD(q), M_ERROR, EPROTO);
3258 			break;
3259 		default:
3260 			/* Not supported by spdsock. */
3261 			spdsock_err_ack(q, mp, TNOTSUPPORT, 0);
3262 			break;
3263 		}
3264 		crfree(cr);
3265 		return;
3266 	case M_IOCTL:
3267 		iocp = (struct iocblk *)mp->b_rptr;
3268 		error = EINVAL;
3269 
3270 		switch (iocp->ioc_cmd) {
3271 		case ND_SET:
3272 		case ND_GET:
3273 			if (nd_getset(q, spds->spds_g_nd, mp)) {
3274 				qreply(q, mp);
3275 				return;
3276 			} else
3277 				error = ENOENT;
3278 			/* FALLTHRU */
3279 		default:
3280 			miocnak(q, mp, 0, error);
3281 			return;
3282 		}
3283 	case M_FLUSH:
3284 		if (*mp->b_rptr & FLUSHW) {
3285 			flushq(q, FLUSHALL);
3286 			*mp->b_rptr &= ~FLUSHW;
3287 		}
3288 		if (*mp->b_rptr & FLUSHR) {
3289 			qreply(q, mp);
3290 			return;
3291 		}
3292 		/* Else FALLTHRU */
3293 	}
3294 
3295 	/* If fell through, just black-hole the message. */
3296 	freemsg(mp);
3297 }
3298 
3299 static void
3300 spdsock_wput(queue_t *q, mblk_t *mp)
3301 {
3302 	uint8_t *rptr = mp->b_rptr;
3303 	mblk_t *mp1;
3304 	spdsock_t *ss = (spdsock_t *)q->q_ptr;
3305 	spd_stack_t	*spds = ss->spdsock_spds;
3306 
3307 	/*
3308 	 * If we're dumping, defer processing other messages until the
3309 	 * dump completes.
3310 	 */
3311 	if (ss->spdsock_dump_req != NULL) {
3312 		if (!putq(q, mp))
3313 			freemsg(mp);
3314 		return;
3315 	}
3316 
3317 	switch (mp->b_datap->db_type) {
3318 	case M_DATA:
3319 		/*
3320 		 * Silently discard.
3321 		 */
3322 		ss2dbg(spds, ("raw M_DATA in spdsock.\n"));
3323 		freemsg(mp);
3324 		return;
3325 	case M_PROTO:
3326 	case M_PCPROTO:
3327 		if ((mp->b_wptr - rptr) >= sizeof (struct T_data_req)) {
3328 			if (((union T_primitives *)rptr)->type == T_DATA_REQ) {
3329 				if ((mp1 = mp->b_cont) == NULL) {
3330 					/* No data after T_DATA_REQ. */
3331 					ss2dbg(spds,
3332 					    ("No data after DATA_REQ.\n"));
3333 					freemsg(mp);
3334 					return;
3335 				}
3336 				freeb(mp);
3337 				mp = mp1;
3338 				ss2dbg(spds, ("T_DATA_REQ\n"));
3339 				break;	/* Out of switch. */
3340 			}
3341 		}
3342 		/* FALLTHRU */
3343 	default:
3344 		ss3dbg(spds, ("In default wput case (%d %d).\n",
3345 		    mp->b_datap->db_type, ((union T_primitives *)rptr)->type));
3346 		spdsock_wput_other(q, mp);
3347 		return;
3348 	}
3349 
3350 	/* I now have a PF_POLICY message in an M_DATA block. */
3351 	spdsock_parse(q, mp);
3352 }
3353 
3354 /*
3355  * Device open procedure, called when new queue pair created.
3356  * We are passed the read-side queue.
3357  */
3358 /* ARGSUSED */
3359 static int
3360 spdsock_open(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp)
3361 {
3362 	spdsock_t *ss;
3363 	queue_t *oq = OTHERQ(q);
3364 	minor_t ssminor;
3365 	netstack_t *ns;
3366 	spd_stack_t *spds;
3367 
3368 	if (secpolicy_ip_config(credp, B_FALSE) != 0)
3369 		return (EPERM);
3370 
3371 	if (q->q_ptr != NULL)
3372 		return (0);  /* Re-open of an already open instance. */
3373 
3374 	if (sflag & MODOPEN)
3375 		return (EINVAL);
3376 
3377 	ns = netstack_find_by_cred(credp);
3378 	ASSERT(ns != NULL);
3379 	spds = ns->netstack_spdsock;
3380 	ASSERT(spds != NULL);
3381 
3382 	ss2dbg(spds, ("Made it into PF_POLICY socket open.\n"));
3383 
3384 	ssminor = (minor_t)(uintptr_t)vmem_alloc(spdsock_vmem, 1, VM_NOSLEEP);
3385 	if (ssminor == 0) {
3386 		netstack_rele(spds->spds_netstack);
3387 		return (ENOMEM);
3388 	}
3389 	ss = kmem_zalloc(sizeof (spdsock_t), KM_NOSLEEP);
3390 	if (ss == NULL) {
3391 		vmem_free(spdsock_vmem, (void *)(uintptr_t)ssminor, 1);
3392 		netstack_rele(spds->spds_netstack);
3393 		return (ENOMEM);
3394 	}
3395 
3396 	ss->spdsock_minor = ssminor;
3397 	ss->spdsock_state = TS_UNBND;
3398 	ss->spdsock_dump_req = NULL;
3399 
3400 	ss->spdsock_spds = spds;
3401 
3402 	q->q_ptr = ss;
3403 	oq->q_ptr = ss;
3404 
3405 	q->q_hiwat = spds->spds_recv_hiwat;
3406 
3407 	oq->q_hiwat = spds->spds_xmit_hiwat;
3408 	oq->q_lowat = spds->spds_xmit_lowat;
3409 
3410 	qprocson(q);
3411 	(void) mi_set_sth_hiwat(q, spds->spds_recv_hiwat);
3412 
3413 	*devp = makedevice(getmajor(*devp), ss->spdsock_minor);
3414 	return (0);
3415 }
3416 
3417 /*
3418  * Read-side service procedure, invoked when we get back-enabled
3419  * when buffer space becomes available.
3420  *
3421  * Dump another chunk if we were dumping before; when we finish, kick
3422  * the write-side queue in case it's waiting for read queue space.
3423  */
3424 void
3425 spdsock_rsrv(queue_t *q)
3426 {
3427 	spdsock_t *ss = q->q_ptr;
3428 
3429 	if (ss->spdsock_dump_req != NULL)
3430 		spdsock_dump_some(q, ss);
3431 
3432 	if (ss->spdsock_dump_req == NULL)
3433 		qenable(OTHERQ(q));
3434 }
3435 
3436 /*
3437  * Write-side service procedure, invoked when we defer processing
3438  * if another message is received while a dump is in progress.
3439  */
3440 void
3441 spdsock_wsrv(queue_t *q)
3442 {
3443 	spdsock_t *ss = q->q_ptr;
3444 	mblk_t *mp;
3445 	spd_stack_t	*spds = ss->spdsock_spds;
3446 	ipsec_stack_t	*ipss = spds->spds_netstack->netstack_ipsec;
3447 
3448 	if (ss->spdsock_dump_req != NULL) {
3449 		qenable(OTHERQ(q));
3450 		return;
3451 	}
3452 
3453 	while ((mp = getq(q)) != NULL) {
3454 		if (ipsec_loaded(ipss)) {
3455 			spdsock_wput(q, mp);
3456 			if (ss->spdsock_dump_req != NULL)
3457 				return;
3458 		} else if (!ipsec_failed(ipss)) {
3459 			(void) putq(q, mp);
3460 		} else {
3461 			spdsock_error(q, mp, EPFNOSUPPORT, 0);
3462 		}
3463 	}
3464 }
3465 
3466 static int
3467 spdsock_close(queue_t *q)
3468 {
3469 	spdsock_t *ss = q->q_ptr;
3470 	spd_stack_t	*spds = ss->spdsock_spds;
3471 
3472 	qprocsoff(q);
3473 
3474 	/* Safe assumption. */
3475 	ASSERT(ss != NULL);
3476 
3477 	if (ss->spdsock_timeout != 0)
3478 		(void) quntimeout(q, ss->spdsock_timeout);
3479 
3480 	ss3dbg(spds, ("Driver close, PF_POLICY socket is going away.\n"));
3481 
3482 	vmem_free(spdsock_vmem, (void *)(uintptr_t)ss->spdsock_minor, 1);
3483 	netstack_rele(ss->spdsock_spds->spds_netstack);
3484 
3485 	kmem_free(ss, sizeof (spdsock_t));
3486 	return (0);
3487 }
3488 
3489 /*
3490  * Merge the IPsec algorithms tables with the received algorithm information.
3491  */
3492 void
3493 spdsock_merge_algs(spd_stack_t *spds)
3494 {
3495 	ipsec_alginfo_t *alg, *oalg;
3496 	ipsec_algtype_t algtype;
3497 	uint_t algidx, algid, nalgs;
3498 	crypto_mech_name_t *mechs;
3499 	uint_t mech_count, mech_idx;
3500 	netstack_t	*ns = spds->spds_netstack;
3501 	ipsec_stack_t	*ipss = ns->netstack_ipsec;
3502 
3503 	ASSERT(MUTEX_HELD(&spds->spds_alg_lock));
3504 
3505 	/*
3506 	 * Get the list of supported mechanisms from the crypto framework.
3507 	 * If a mechanism is supported by KCF, resolve its mechanism
3508 	 * id and mark it as being valid. This operation must be done
3509 	 * without holding alg_lock, since it can cause a provider
3510 	 * module to be loaded and the provider notification callback to
3511 	 * be invoked.
3512 	 */
3513 	mechs = crypto_get_mech_list(&mech_count, KM_SLEEP);
3514 	for (algtype = 0; algtype < IPSEC_NALGTYPES; algtype++) {
3515 		for (algid = 0; algid < IPSEC_MAX_ALGS; algid++) {
3516 			int algflags = 0;
3517 			crypto_mech_type_t mt = CRYPTO_MECHANISM_INVALID;
3518 
3519 			alg = spds->spds_algs[algtype][algid];
3520 			if (alg == NULL)
3521 				continue;
3522 
3523 			/*
3524 			 * The NULL encryption algorithm is a special
3525 			 * case because there are no mechanisms, yet
3526 			 * the algorithm is still valid.
3527 			 */
3528 			if (alg->alg_id == SADB_EALG_NULL) {
3529 				alg->alg_mech_type = CRYPTO_MECHANISM_INVALID;
3530 				alg->alg_flags = ALG_FLAG_VALID;
3531 				continue;
3532 			}
3533 
3534 			for (mech_idx = 0; mech_idx < mech_count; mech_idx++) {
3535 				if (strncmp(alg->alg_mech_name, mechs[mech_idx],
3536 				    CRYPTO_MAX_MECH_NAME) == 0) {
3537 					mt = crypto_mech2id(alg->alg_mech_name);
3538 					ASSERT(mt != CRYPTO_MECHANISM_INVALID);
3539 					algflags = ALG_FLAG_VALID;
3540 					break;
3541 				}
3542 			}
3543 			alg->alg_mech_type = mt;
3544 			alg->alg_flags = algflags;
3545 		}
3546 	}
3547 
3548 	mutex_enter(&ipss->ipsec_alg_lock);
3549 
3550 	/*
3551 	 * For each algorithm currently defined, check if it is
3552 	 * present in the new tables created from the SPD_UPDATEALGS
3553 	 * message received from user-space.
3554 	 * Delete the algorithm entries that are currently defined
3555 	 * but not part of the new tables.
3556 	 */
3557 	for (algtype = 0; algtype < IPSEC_NALGTYPES; algtype++) {
3558 		nalgs = ipss->ipsec_nalgs[algtype];
3559 		for (algidx = 0; algidx < nalgs; algidx++) {
3560 			algid = ipss->ipsec_sortlist[algtype][algidx];
3561 			if (spds->spds_algs[algtype][algid] == NULL)
3562 				ipsec_alg_unreg(algtype, algid, ns);
3563 		}
3564 	}
3565 
3566 	/*
3567 	 * For each algorithm we just received, check if it is
3568 	 * present in the currently defined tables. If it is, swap
3569 	 * the entry with the one we just allocated.
3570 	 * If the new algorithm is not in the current tables,
3571 	 * add it.
3572 	 */
3573 	for (algtype = 0; algtype < IPSEC_NALGTYPES; algtype++) {
3574 		for (algid = 0; algid < IPSEC_MAX_ALGS; algid++) {
3575 			alg = spds->spds_algs[algtype][algid];
3576 			if (alg == NULL)
3577 				continue;
3578 
3579 			if ((oalg = ipss->ipsec_alglists[algtype][algid]) ==
3580 			    NULL) {
3581 				/*
3582 				 * New algorithm, add it to the algorithm
3583 				 * table.
3584 				 */
3585 				ipsec_alg_reg(algtype, alg, ns);
3586 			} else {
3587 				/*
3588 				 * Algorithm is already in the table. Swap
3589 				 * the existing entry with the new one.
3590 				 */
3591 				ipsec_alg_fix_min_max(alg, algtype, ns);
3592 				ipss->ipsec_alglists[algtype][algid] = alg;
3593 				ipsec_alg_free(oalg);
3594 			}
3595 			spds->spds_algs[algtype][algid] = NULL;
3596 		}
3597 	}
3598 
3599 	for (algtype = 0; algtype < IPSEC_NALGTYPES; algtype++) {
3600 		ipss->ipsec_algs_exec_mode[algtype] =
3601 		    spds->spds_algs_exec_mode[algtype];
3602 	}
3603 
3604 	mutex_exit(&ipss->ipsec_alg_lock);
3605 
3606 	crypto_free_mech_list(mechs, mech_count);
3607 
3608 	ipsecah_algs_changed(ns);
3609 	ipsecesp_algs_changed(ns);
3610 }
3611