xref: /titanic_41/usr/src/uts/common/inet/ip/sadb.c (revision dcda19f50b2b80bfc622fff718ac04fb0e1cb670)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  */
25 
26 #include <sys/types.h>
27 #include <sys/stream.h>
28 #include <sys/stropts.h>
29 #include <sys/strsubr.h>
30 #include <sys/errno.h>
31 #include <sys/ddi.h>
32 #include <sys/debug.h>
33 #include <sys/cmn_err.h>
34 #include <sys/stream.h>
35 #include <sys/strlog.h>
36 #include <sys/kmem.h>
37 #include <sys/sunddi.h>
38 #include <sys/tihdr.h>
39 #include <sys/atomic.h>
40 #include <sys/socket.h>
41 #include <sys/sysmacros.h>
42 #include <sys/crypto/common.h>
43 #include <sys/crypto/api.h>
44 #include <sys/zone.h>
45 #include <netinet/in.h>
46 #include <net/if.h>
47 #include <net/pfkeyv2.h>
48 #include <inet/common.h>
49 #include <netinet/ip6.h>
50 #include <inet/ip.h>
51 #include <inet/ip_ire.h>
52 #include <inet/ip6.h>
53 #include <inet/ipsec_info.h>
54 #include <inet/tcp.h>
55 #include <inet/sadb.h>
56 #include <inet/ipsec_impl.h>
57 #include <inet/ipsecah.h>
58 #include <inet/ipsecesp.h>
59 #include <sys/random.h>
60 #include <sys/dlpi.h>
61 #include <sys/iphada.h>
62 #include <inet/ip_if.h>
63 #include <inet/ipdrop.h>
64 #include <inet/ipclassifier.h>
65 #include <inet/sctp_ip.h>
66 #include <inet/tun.h>
67 
68 /*
69  * This source file contains Security Association Database (SADB) common
70  * routines.  They are linked in with the AH module.  Since AH has no chance
71  * of falling under export control, it was safe to link it in there.
72  */
73 
74 static mblk_t *sadb_extended_acquire(ipsec_selector_t *, ipsec_policy_t *,
75     ipsec_action_t *, boolean_t, uint32_t, uint32_t, netstack_t *);
76 static void sadb_ill_df(ill_t *, mblk_t *, isaf_t *, int, boolean_t);
77 static ipsa_t *sadb_torch_assoc(isaf_t *, ipsa_t *, boolean_t, mblk_t **);
78 static void sadb_drain_torchq(queue_t *, mblk_t *);
79 static void sadb_destroy_acqlist(iacqf_t **, uint_t, boolean_t,
80 			    netstack_t *);
81 static void sadb_destroy(sadb_t *, netstack_t *);
82 static mblk_t *sadb_sa2msg(ipsa_t *, sadb_msg_t *);
83 
84 static time_t sadb_add_time(time_t, uint64_t);
85 static void lifetime_fuzz(ipsa_t *);
86 static void age_pair_peer_list(templist_t *, sadb_t *, boolean_t);
87 static void ipsa_set_replay(ipsa_t *ipsa, uint32_t offset);
88 
89 extern void (*cl_inet_getspi)(netstackid_t stack_id, uint8_t protocol,
90     uint8_t *ptr, size_t len, void *args);
91 extern int (*cl_inet_checkspi)(netstackid_t stack_id, uint8_t protocol,
92     uint32_t spi, void *args);
93 extern void (*cl_inet_deletespi)(netstackid_t stack_id, uint8_t protocol,
94     uint32_t spi, void *args);
95 
96 /*
97  * ipsacq_maxpackets is defined here to make it tunable
98  * from /etc/system.
99  */
100 extern uint64_t ipsacq_maxpackets;
101 
102 #define	SET_EXPIRE(sa, delta, exp) {				\
103 	if (((sa)->ipsa_ ## delta) != 0) {				\
104 		(sa)->ipsa_ ## exp = sadb_add_time((sa)->ipsa_addtime,	\
105 			(sa)->ipsa_ ## delta);				\
106 	}								\
107 }
108 
109 #define	UPDATE_EXPIRE(sa, delta, exp) {					\
110 	if (((sa)->ipsa_ ## delta) != 0) {				\
111 		time_t tmp = sadb_add_time((sa)->ipsa_usetime,		\
112 			(sa)->ipsa_ ## delta);				\
113 		if (((sa)->ipsa_ ## exp) == 0)				\
114 			(sa)->ipsa_ ## exp = tmp;			\
115 		else							\
116 			(sa)->ipsa_ ## exp = 				\
117 			    MIN((sa)->ipsa_ ## exp, tmp); 		\
118 	}								\
119 }
120 
121 
122 /* wrap the macro so we can pass it as a function pointer */
123 void
124 sadb_sa_refrele(void *target)
125 {
126 	IPSA_REFRELE(((ipsa_t *)target));
127 }
128 
129 /*
130  * We presume that sizeof (long) == sizeof (time_t) and that time_t is
131  * a signed type.
132  */
133 #define	TIME_MAX LONG_MAX
134 
135 /*
136  * PF_KEY gives us lifetimes in uint64_t seconds.  We presume that
137  * time_t is defined to be a signed type with the same range as
138  * "long".  On ILP32 systems, we thus run the risk of wrapping around
139  * at end of time, as well as "overwrapping" the clock back around
140  * into a seemingly valid but incorrect future date earlier than the
141  * desired expiration.
142  *
143  * In order to avoid odd behavior (either negative lifetimes or loss
144  * of high order bits) when someone asks for bizarrely long SA
145  * lifetimes, we do a saturating add for expire times.
146  *
147  * We presume that ILP32 systems will be past end of support life when
148  * the 32-bit time_t overflows (a dangerous assumption, mind you..).
149  *
150  * On LP64, 2^64 seconds are about 5.8e11 years, at which point we
151  * will hopefully have figured out clever ways to avoid the use of
152  * fixed-sized integers in computation.
153  */
154 static time_t
155 sadb_add_time(time_t base, uint64_t delta)
156 {
157 	time_t sum;
158 
159 	/*
160 	 * Clip delta to the maximum possible time_t value to
161 	 * prevent "overwrapping" back into a shorter-than-desired
162 	 * future time.
163 	 */
164 	if (delta > TIME_MAX)
165 		delta = TIME_MAX;
166 	/*
167 	 * This sum may still overflow.
168 	 */
169 	sum = base + delta;
170 
171 	/*
172 	 * .. so if the result is less than the base, we overflowed.
173 	 */
174 	if (sum < base)
175 		sum = TIME_MAX;
176 
177 	return (sum);
178 }
179 
180 /*
181  * Callers of this function have already created a working security
182  * association, and have found the appropriate table & hash chain.  All this
183  * function does is check duplicates, and insert the SA.  The caller needs to
184  * hold the hash bucket lock and increment the refcnt before insertion.
185  *
186  * Return 0 if success, EEXIST if collision.
187  */
188 #define	SA_UNIQUE_MATCH(sa1, sa2) \
189 	(((sa1)->ipsa_unique_id & (sa1)->ipsa_unique_mask) == \
190 	((sa2)->ipsa_unique_id & (sa2)->ipsa_unique_mask))
191 
192 int
193 sadb_insertassoc(ipsa_t *ipsa, isaf_t *bucket)
194 {
195 	ipsa_t **ptpn = NULL;
196 	ipsa_t *walker;
197 	boolean_t unspecsrc;
198 
199 	ASSERT(MUTEX_HELD(&bucket->isaf_lock));
200 
201 	unspecsrc = IPSA_IS_ADDR_UNSPEC(ipsa->ipsa_srcaddr, ipsa->ipsa_addrfam);
202 
203 	walker = bucket->isaf_ipsa;
204 	ASSERT(walker == NULL || ipsa->ipsa_addrfam == walker->ipsa_addrfam);
205 
206 	/*
207 	 * Find insertion point (pointed to with **ptpn).  Insert at the head
208 	 * of the list unless there's an unspecified source address, then
209 	 * insert it after the last SA with a specified source address.
210 	 *
211 	 * BTW, you'll have to walk the whole chain, matching on {DST, SPI}
212 	 * checking for collisions.
213 	 */
214 
215 	while (walker != NULL) {
216 		if (IPSA_ARE_ADDR_EQUAL(walker->ipsa_dstaddr,
217 		    ipsa->ipsa_dstaddr, ipsa->ipsa_addrfam)) {
218 			if (walker->ipsa_spi == ipsa->ipsa_spi)
219 				return (EEXIST);
220 
221 			mutex_enter(&walker->ipsa_lock);
222 			if (ipsa->ipsa_state == IPSA_STATE_MATURE &&
223 			    (walker->ipsa_flags & IPSA_F_USED) &&
224 			    SA_UNIQUE_MATCH(walker, ipsa)) {
225 				walker->ipsa_flags |= IPSA_F_CINVALID;
226 			}
227 			mutex_exit(&walker->ipsa_lock);
228 		}
229 
230 		if (ptpn == NULL && unspecsrc) {
231 			if (IPSA_IS_ADDR_UNSPEC(walker->ipsa_srcaddr,
232 			    walker->ipsa_addrfam))
233 				ptpn = walker->ipsa_ptpn;
234 			else if (walker->ipsa_next == NULL)
235 				ptpn = &walker->ipsa_next;
236 		}
237 
238 		walker = walker->ipsa_next;
239 	}
240 
241 	if (ptpn == NULL)
242 		ptpn = &bucket->isaf_ipsa;
243 	ipsa->ipsa_next = *ptpn;
244 	ipsa->ipsa_ptpn = ptpn;
245 	if (ipsa->ipsa_next != NULL)
246 		ipsa->ipsa_next->ipsa_ptpn = &ipsa->ipsa_next;
247 	*ptpn = ipsa;
248 	ipsa->ipsa_linklock = &bucket->isaf_lock;
249 
250 	return (0);
251 }
252 #undef SA_UNIQUE_MATCH
253 
254 /*
255  * Free a security association.  Its reference count is 0, which means
256  * I must free it.  The SA must be unlocked and must not be linked into
257  * any fanout list.
258  */
259 static void
260 sadb_freeassoc(ipsa_t *ipsa)
261 {
262 	ipsec_stack_t	*ipss = ipsa->ipsa_netstack->netstack_ipsec;
263 
264 	ASSERT(ipss != NULL);
265 	ASSERT(MUTEX_NOT_HELD(&ipsa->ipsa_lock));
266 	ASSERT(ipsa->ipsa_refcnt == 0);
267 	ASSERT(ipsa->ipsa_next == NULL);
268 	ASSERT(ipsa->ipsa_ptpn == NULL);
269 
270 	mutex_enter(&ipsa->ipsa_lock);
271 	/* Don't call sadb_clear_lpkt() since we hold the ipsa_lock anyway. */
272 	ip_drop_packet(ipsa->ipsa_lpkt, B_TRUE, NULL, NULL,
273 	    DROPPER(ipss, ipds_sadb_inlarval_timeout),
274 	    &ipss->ipsec_sadb_dropper);
275 	ipsec_destroy_ctx_tmpl(ipsa, IPSEC_ALG_AUTH);
276 	ipsec_destroy_ctx_tmpl(ipsa, IPSEC_ALG_ENCR);
277 	mutex_exit(&ipsa->ipsa_lock);
278 
279 	/* bzero() these fields for paranoia's sake. */
280 	if (ipsa->ipsa_authkey != NULL) {
281 		bzero(ipsa->ipsa_authkey, ipsa->ipsa_authkeylen);
282 		kmem_free(ipsa->ipsa_authkey, ipsa->ipsa_authkeylen);
283 	}
284 	if (ipsa->ipsa_encrkey != NULL) {
285 		bzero(ipsa->ipsa_encrkey, ipsa->ipsa_encrkeylen);
286 		kmem_free(ipsa->ipsa_encrkey, ipsa->ipsa_encrkeylen);
287 	}
288 	if (ipsa->ipsa_src_cid != NULL) {
289 		IPSID_REFRELE(ipsa->ipsa_src_cid);
290 	}
291 	if (ipsa->ipsa_dst_cid != NULL) {
292 		IPSID_REFRELE(ipsa->ipsa_dst_cid);
293 	}
294 	if (ipsa->ipsa_integ != NULL)
295 		kmem_free(ipsa->ipsa_integ, ipsa->ipsa_integlen);
296 	if (ipsa->ipsa_sens != NULL)
297 		kmem_free(ipsa->ipsa_sens, ipsa->ipsa_senslen);
298 
299 	mutex_destroy(&ipsa->ipsa_lock);
300 	kmem_free(ipsa, sizeof (*ipsa));
301 }
302 
303 /*
304  * Unlink a security association from a hash bucket.  Assume the hash bucket
305  * lock is held, but the association's lock is not.
306  *
307  * Note that we do not bump the bucket's generation number here because
308  * we might not be making a visible change to the set of visible SA's.
309  * All callers MUST bump the bucket's generation number before they unlock
310  * the bucket if they use sadb_unlinkassoc to permanetly remove an SA which
311  * was present in the bucket at the time it was locked.
312  */
313 void
314 sadb_unlinkassoc(ipsa_t *ipsa)
315 {
316 	ASSERT(ipsa->ipsa_linklock != NULL);
317 	ASSERT(MUTEX_HELD(ipsa->ipsa_linklock));
318 
319 	/* These fields are protected by the link lock. */
320 	*(ipsa->ipsa_ptpn) = ipsa->ipsa_next;
321 	if (ipsa->ipsa_next != NULL) {
322 		ipsa->ipsa_next->ipsa_ptpn = ipsa->ipsa_ptpn;
323 		ipsa->ipsa_next = NULL;
324 	}
325 
326 	ipsa->ipsa_ptpn = NULL;
327 
328 	/* This may destroy the SA. */
329 	IPSA_REFRELE(ipsa);
330 }
331 
332 void
333 sadb_delete_cluster(ipsa_t *assoc)
334 {
335 	uint8_t protocol;
336 
337 	if (cl_inet_deletespi &&
338 	    ((assoc->ipsa_state == IPSA_STATE_LARVAL) ||
339 	    (assoc->ipsa_state == IPSA_STATE_MATURE))) {
340 		protocol = (assoc->ipsa_type == SADB_SATYPE_AH) ?
341 		    IPPROTO_AH : IPPROTO_ESP;
342 		cl_inet_deletespi(assoc->ipsa_netstack->netstack_stackid,
343 		    protocol, assoc->ipsa_spi, NULL);
344 	}
345 }
346 
347 /*
348  * Create a larval security association with the specified SPI.	 All other
349  * fields are zeroed.
350  */
351 static ipsa_t *
352 sadb_makelarvalassoc(uint32_t spi, uint32_t *src, uint32_t *dst, int addrfam,
353     netstack_t *ns)
354 {
355 	ipsa_t *newbie;
356 
357 	/*
358 	 * Allocate...
359 	 */
360 
361 	newbie = (ipsa_t *)kmem_zalloc(sizeof (ipsa_t), KM_NOSLEEP);
362 	if (newbie == NULL) {
363 		/* Can't make new larval SA. */
364 		return (NULL);
365 	}
366 
367 	/* Assigned requested SPI, assume caller does SPI allocation magic. */
368 	newbie->ipsa_spi = spi;
369 	newbie->ipsa_netstack = ns;	/* No netstack_hold */
370 
371 	/*
372 	 * Copy addresses...
373 	 */
374 
375 	IPSA_COPY_ADDR(newbie->ipsa_srcaddr, src, addrfam);
376 	IPSA_COPY_ADDR(newbie->ipsa_dstaddr, dst, addrfam);
377 
378 	newbie->ipsa_addrfam = addrfam;
379 
380 	/*
381 	 * Set common initialization values, including refcnt.
382 	 */
383 	mutex_init(&newbie->ipsa_lock, NULL, MUTEX_DEFAULT, NULL);
384 	newbie->ipsa_state = IPSA_STATE_LARVAL;
385 	newbie->ipsa_refcnt = 1;
386 	newbie->ipsa_freefunc = sadb_freeassoc;
387 
388 	/*
389 	 * There aren't a lot of other common initialization values, as
390 	 * they are copied in from the PF_KEY message.
391 	 */
392 
393 	return (newbie);
394 }
395 
396 /*
397  * Call me to initialize a security association fanout.
398  */
399 static int
400 sadb_init_fanout(isaf_t **tablep, uint_t size, int kmflag)
401 {
402 	isaf_t *table;
403 	int i;
404 
405 	table = (isaf_t *)kmem_alloc(size * sizeof (*table), kmflag);
406 	*tablep = table;
407 
408 	if (table == NULL)
409 		return (ENOMEM);
410 
411 	for (i = 0; i < size; i++) {
412 		mutex_init(&(table[i].isaf_lock), NULL, MUTEX_DEFAULT, NULL);
413 		table[i].isaf_ipsa = NULL;
414 		table[i].isaf_gen = 0;
415 	}
416 
417 	return (0);
418 }
419 
420 /*
421  * Call me to initialize an acquire fanout
422  */
423 static int
424 sadb_init_acfanout(iacqf_t **tablep, uint_t size, int kmflag)
425 {
426 	iacqf_t *table;
427 	int i;
428 
429 	table = (iacqf_t *)kmem_alloc(size * sizeof (*table), kmflag);
430 	*tablep = table;
431 
432 	if (table == NULL)
433 		return (ENOMEM);
434 
435 	for (i = 0; i < size; i++) {
436 		mutex_init(&(table[i].iacqf_lock), NULL, MUTEX_DEFAULT, NULL);
437 		table[i].iacqf_ipsacq = NULL;
438 	}
439 
440 	return (0);
441 }
442 
443 /*
444  * Attempt to initialize an SADB instance.  On failure, return ENOMEM;
445  * caller must clean up partial allocations.
446  */
447 static int
448 sadb_init_trial(sadb_t *sp, uint_t size, int kmflag)
449 {
450 	ASSERT(sp->sdb_of == NULL);
451 	ASSERT(sp->sdb_if == NULL);
452 	ASSERT(sp->sdb_acq == NULL);
453 
454 	sp->sdb_hashsize = size;
455 	if (sadb_init_fanout(&sp->sdb_of, size, kmflag) != 0)
456 		return (ENOMEM);
457 	if (sadb_init_fanout(&sp->sdb_if, size, kmflag) != 0)
458 		return (ENOMEM);
459 	if (sadb_init_acfanout(&sp->sdb_acq, size, kmflag) != 0)
460 		return (ENOMEM);
461 
462 	return (0);
463 }
464 
465 /*
466  * Call me to initialize an SADB instance; fall back to default size on failure.
467  */
468 static void
469 sadb_init(const char *name, sadb_t *sp, uint_t size, uint_t ver,
470     netstack_t *ns)
471 {
472 	ASSERT(sp->sdb_of == NULL);
473 	ASSERT(sp->sdb_if == NULL);
474 	ASSERT(sp->sdb_acq == NULL);
475 
476 	if (size < IPSEC_DEFAULT_HASH_SIZE)
477 		size = IPSEC_DEFAULT_HASH_SIZE;
478 
479 	if (sadb_init_trial(sp, size, KM_NOSLEEP) != 0) {
480 
481 		cmn_err(CE_WARN,
482 		    "Unable to allocate %u entry IPv%u %s SADB hash table",
483 		    size, ver, name);
484 
485 		sadb_destroy(sp, ns);
486 		size = IPSEC_DEFAULT_HASH_SIZE;
487 		cmn_err(CE_WARN, "Falling back to %d entries", size);
488 		(void) sadb_init_trial(sp, size, KM_SLEEP);
489 	}
490 }
491 
492 
493 /*
494  * Initialize an SADB-pair.
495  */
496 void
497 sadbp_init(const char *name, sadbp_t *sp, int type, int size, netstack_t *ns)
498 {
499 	sadb_init(name, &sp->s_v4, size, 4, ns);
500 	sadb_init(name, &sp->s_v6, size, 6, ns);
501 
502 	sp->s_satype = type;
503 
504 	ASSERT((type == SADB_SATYPE_AH) || (type == SADB_SATYPE_ESP));
505 	if (type == SADB_SATYPE_AH) {
506 		ipsec_stack_t	*ipss = ns->netstack_ipsec;
507 
508 		ip_drop_register(&ipss->ipsec_sadb_dropper, "IPsec SADB");
509 		sp->s_addflags = AH_ADD_SETTABLE_FLAGS;
510 		sp->s_updateflags = AH_UPDATE_SETTABLE_FLAGS;
511 	} else {
512 		sp->s_addflags = ESP_ADD_SETTABLE_FLAGS;
513 		sp->s_updateflags = ESP_UPDATE_SETTABLE_FLAGS;
514 	}
515 }
516 
517 /*
518  * Deliver a single SADB_DUMP message representing a single SA.  This is
519  * called many times by sadb_dump().
520  *
521  * If the return value of this is ENOBUFS (not the same as ENOMEM), then
522  * the caller should take that as a hint that dupb() on the "original answer"
523  * failed, and that perhaps the caller should try again with a copyb()ed
524  * "original answer".
525  */
526 static int
527 sadb_dump_deliver(queue_t *pfkey_q, mblk_t *original_answer, ipsa_t *ipsa,
528     sadb_msg_t *samsg)
529 {
530 	mblk_t *answer;
531 
532 	answer = dupb(original_answer);
533 	if (answer == NULL)
534 		return (ENOBUFS);
535 	answer->b_cont = sadb_sa2msg(ipsa, samsg);
536 	if (answer->b_cont == NULL) {
537 		freeb(answer);
538 		return (ENOMEM);
539 	}
540 
541 	/* Just do a putnext, and let keysock deal with flow control. */
542 	putnext(pfkey_q, answer);
543 	return (0);
544 }
545 
546 /*
547  * Common function to allocate and prepare a keysock_out_t M_CTL message.
548  */
549 mblk_t *
550 sadb_keysock_out(minor_t serial)
551 {
552 	mblk_t *mp;
553 	keysock_out_t *kso;
554 
555 	mp = allocb(sizeof (ipsec_info_t), BPRI_HI);
556 	if (mp != NULL) {
557 		mp->b_datap->db_type = M_CTL;
558 		mp->b_wptr += sizeof (ipsec_info_t);
559 		kso = (keysock_out_t *)mp->b_rptr;
560 		kso->ks_out_type = KEYSOCK_OUT;
561 		kso->ks_out_len = sizeof (*kso);
562 		kso->ks_out_serial = serial;
563 	}
564 
565 	return (mp);
566 }
567 
568 /*
569  * Perform an SADB_DUMP, spewing out every SA in an array of SA fanouts
570  * to keysock.
571  */
572 static int
573 sadb_dump_fanout(queue_t *pfkey_q, mblk_t *mp, minor_t serial, isaf_t *fanout,
574     int num_entries, boolean_t do_peers, time_t active_time)
575 {
576 	int i, error = 0;
577 	mblk_t *original_answer;
578 	ipsa_t *walker;
579 	sadb_msg_t *samsg;
580 	time_t	current;
581 
582 	/*
583 	 * For each IPSA hash bucket do:
584 	 *	- Hold the mutex
585 	 *	- Walk each entry, doing an sadb_dump_deliver() on it.
586 	 */
587 	ASSERT(mp->b_cont != NULL);
588 	samsg = (sadb_msg_t *)mp->b_cont->b_rptr;
589 
590 	original_answer = sadb_keysock_out(serial);
591 	if (original_answer == NULL)
592 		return (ENOMEM);
593 
594 	current = gethrestime_sec();
595 	for (i = 0; i < num_entries; i++) {
596 		mutex_enter(&fanout[i].isaf_lock);
597 		for (walker = fanout[i].isaf_ipsa; walker != NULL;
598 		    walker = walker->ipsa_next) {
599 			if (!do_peers && walker->ipsa_haspeer)
600 				continue;
601 			if ((active_time != 0) &&
602 			    ((current - walker->ipsa_lastuse) > active_time))
603 				continue;
604 			error = sadb_dump_deliver(pfkey_q, original_answer,
605 			    walker, samsg);
606 			if (error == ENOBUFS) {
607 				mblk_t *new_original_answer;
608 
609 				/* Ran out of dupb's.  Try a copyb. */
610 				new_original_answer = copyb(original_answer);
611 				if (new_original_answer == NULL) {
612 					error = ENOMEM;
613 				} else {
614 					freeb(original_answer);
615 					original_answer = new_original_answer;
616 					error = sadb_dump_deliver(pfkey_q,
617 					    original_answer, walker, samsg);
618 				}
619 			}
620 			if (error != 0)
621 				break;	/* out of for loop. */
622 		}
623 		mutex_exit(&fanout[i].isaf_lock);
624 		if (error != 0)
625 			break;	/* out of for loop. */
626 	}
627 
628 	freeb(original_answer);
629 	return (error);
630 }
631 
632 /*
633  * Dump an entire SADB; outbound first, then inbound.
634  */
635 
636 int
637 sadb_dump(queue_t *pfkey_q, mblk_t *mp, keysock_in_t *ksi, sadb_t *sp)
638 {
639 	int error;
640 	time_t	active_time = 0;
641 	sadb_x_edump_t	*edump =
642 	    (sadb_x_edump_t *)ksi->ks_in_extv[SADB_X_EXT_EDUMP];
643 
644 	if (edump != NULL) {
645 		active_time = edump->sadb_x_edump_timeout;
646 	}
647 
648 	/* Dump outbound */
649 	error = sadb_dump_fanout(pfkey_q, mp, ksi->ks_in_serial, sp->sdb_of,
650 	    sp->sdb_hashsize, B_TRUE, active_time);
651 	if (error)
652 		return (error);
653 
654 	/* Dump inbound */
655 	return sadb_dump_fanout(pfkey_q, mp, ksi->ks_in_serial, sp->sdb_if,
656 	    sp->sdb_hashsize, B_FALSE, active_time);
657 }
658 
659 /*
660  * Generic sadb table walker.
661  *
662  * Call "walkfn" for each SA in each bucket in "table"; pass the
663  * bucket, the entry and "cookie" to the callback function.
664  * Take care to ensure that walkfn can delete the SA without screwing
665  * up our traverse.
666  *
667  * The bucket is locked for the duration of the callback, both so that the
668  * callback can just call sadb_unlinkassoc() when it wants to delete something,
669  * and so that no new entries are added while we're walking the list.
670  */
671 static void
672 sadb_walker(isaf_t *table, uint_t numentries,
673     void (*walkfn)(isaf_t *head, ipsa_t *entry, void *cookie),
674     void *cookie)
675 {
676 	int i;
677 	for (i = 0; i < numentries; i++) {
678 		ipsa_t *entry, *next;
679 
680 		mutex_enter(&table[i].isaf_lock);
681 
682 		for (entry = table[i].isaf_ipsa; entry != NULL;
683 		    entry = next) {
684 			next = entry->ipsa_next;
685 			(*walkfn)(&table[i], entry, cookie);
686 		}
687 		mutex_exit(&table[i].isaf_lock);
688 	}
689 }
690 
691 /*
692  * From the given SA, construct a dl_ct_ipsec_key and
693  * a dl_ct_ipsec structures to be sent to the adapter as part
694  * of a DL_CONTROL_REQ.
695  *
696  * ct_sa must point to the storage allocated for the key
697  * structure and must be followed by storage allocated
698  * for the SA information that must be sent to the driver
699  * as part of the DL_CONTROL_REQ request.
700  *
701  * The is_inbound boolean indicates whether the specified
702  * SA is part of an inbound SA table.
703  *
704  * Returns B_TRUE if the corresponding SA must be passed to
705  * a provider, B_FALSE otherwise; frees *mp if it returns B_FALSE.
706  */
707 static boolean_t
708 sadb_req_from_sa(ipsa_t *sa, mblk_t *mp, boolean_t is_inbound)
709 {
710 	dl_ct_ipsec_key_t *keyp;
711 	dl_ct_ipsec_t *sap;
712 	void *ct_sa = mp->b_wptr;
713 
714 	ASSERT(MUTEX_HELD(&sa->ipsa_lock));
715 
716 	keyp = (dl_ct_ipsec_key_t *)(ct_sa);
717 	sap = (dl_ct_ipsec_t *)(keyp + 1);
718 
719 	IPSECHW_DEBUG(IPSECHW_CAPAB, ("sadb_req_from_sa: "
720 	    "is_inbound = %d\n", is_inbound));
721 
722 	/* initialize flag */
723 	sap->sadb_sa_flags = 0;
724 	if (is_inbound) {
725 		sap->sadb_sa_flags |= DL_CT_IPSEC_INBOUND;
726 		/*
727 		 * If an inbound SA has a peer, then mark it has being
728 		 * an outbound SA as well.
729 		 */
730 		if (sa->ipsa_haspeer)
731 			sap->sadb_sa_flags |= DL_CT_IPSEC_OUTBOUND;
732 	} else {
733 		/*
734 		 * If an outbound SA has a peer, then don't send it,
735 		 * since we will send the copy from the inbound table.
736 		 */
737 		if (sa->ipsa_haspeer) {
738 			freemsg(mp);
739 			return (B_FALSE);
740 		}
741 		sap->sadb_sa_flags |= DL_CT_IPSEC_OUTBOUND;
742 	}
743 
744 	keyp->dl_key_spi = sa->ipsa_spi;
745 	bcopy(sa->ipsa_dstaddr, keyp->dl_key_dest_addr,
746 	    DL_CTL_IPSEC_ADDR_LEN);
747 	keyp->dl_key_addr_family = sa->ipsa_addrfam;
748 
749 	sap->sadb_sa_auth = sa->ipsa_auth_alg;
750 	sap->sadb_sa_encrypt = sa->ipsa_encr_alg;
751 
752 	sap->sadb_key_len_a = sa->ipsa_authkeylen;
753 	sap->sadb_key_bits_a = sa->ipsa_authkeybits;
754 	bcopy(sa->ipsa_authkey,
755 	    sap->sadb_key_data_a, sap->sadb_key_len_a);
756 
757 	sap->sadb_key_len_e = sa->ipsa_encrkeylen;
758 	sap->sadb_key_bits_e = sa->ipsa_encrkeybits;
759 	bcopy(sa->ipsa_encrkey,
760 	    sap->sadb_key_data_e, sap->sadb_key_len_e);
761 
762 	mp->b_wptr += sizeof (dl_ct_ipsec_t) + sizeof (dl_ct_ipsec_key_t);
763 	return (B_TRUE);
764 }
765 
766 /*
767  * Called from AH or ESP to format a message which will be used to inform
768  * IPsec-acceleration-capable ills of a SADB change.
769  * (It is not possible to send the message to IP directly from this function
770  * since the SA, if any, is locked during the call).
771  *
772  * dl_operation: DL_CONTROL_REQ operation (add, delete, update, etc)
773  * sa_type: identifies whether the operation applies to AH or ESP
774  *	(must be one of SADB_SATYPE_AH or SADB_SATYPE_ESP)
775  * sa: Pointer to an SA.  Must be non-NULL and locked
776  *	for ADD, DELETE, GET, and UPDATE operations.
777  * This function returns an mblk chain that must be passed to IP
778  * for forwarding to the IPsec capable providers.
779  */
780 mblk_t *
781 sadb_fmt_sa_req(uint_t dl_operation, uint_t sa_type, ipsa_t *sa,
782     boolean_t is_inbound)
783 {
784 	mblk_t *mp;
785 	dl_control_req_t *ctrl;
786 	boolean_t need_key = B_FALSE;
787 	mblk_t *ctl_mp = NULL;
788 	ipsec_ctl_t *ctl;
789 
790 	/*
791 	 * 1 allocate and initialize DL_CONTROL_REQ M_PROTO
792 	 * 2 if a key is needed for the operation
793 	 *    2.1 initialize key
794 	 *    2.2 if a full SA is needed for the operation
795 	 *	2.2.1 initialize full SA info
796 	 * 3 return message; caller will call ill_ipsec_capab_send_all()
797 	 * to send the resulting message to IPsec capable ills.
798 	 */
799 
800 	ASSERT(sa_type == SADB_SATYPE_AH || sa_type == SADB_SATYPE_ESP);
801 
802 	/*
803 	 * Allocate DL_CONTROL_REQ M_PROTO
804 	 * We allocate room for the SA even if it's not needed
805 	 * by some of the operations (for example flush)
806 	 */
807 	mp = allocb(sizeof (dl_control_req_t) +
808 	    sizeof (dl_ct_ipsec_key_t) + sizeof (dl_ct_ipsec_t), BPRI_HI);
809 	if (mp == NULL)
810 		return (NULL);
811 	mp->b_datap->db_type = M_PROTO;
812 
813 	/* initialize dl_control_req_t */
814 	ctrl = (dl_control_req_t *)mp->b_wptr;
815 	ctrl->dl_primitive = DL_CONTROL_REQ;
816 	ctrl->dl_operation = dl_operation;
817 	ctrl->dl_type = sa_type == SADB_SATYPE_AH ? DL_CT_IPSEC_AH :
818 	    DL_CT_IPSEC_ESP;
819 	ctrl->dl_key_offset = sizeof (dl_control_req_t);
820 	ctrl->dl_key_length = sizeof (dl_ct_ipsec_key_t);
821 	ctrl->dl_data_offset = sizeof (dl_control_req_t) +
822 	    sizeof (dl_ct_ipsec_key_t);
823 	ctrl->dl_data_length = sizeof (dl_ct_ipsec_t);
824 	mp->b_wptr += sizeof (dl_control_req_t);
825 
826 	if ((dl_operation == DL_CO_SET) || (dl_operation == DL_CO_DELETE)) {
827 		ASSERT(sa != NULL);
828 		ASSERT(MUTEX_HELD(&sa->ipsa_lock));
829 
830 		need_key = B_TRUE;
831 
832 		/*
833 		 * Initialize key and SA data. Note that for some
834 		 * operations the SA data is ignored by the provider
835 		 * (delete, etc.)
836 		 */
837 		if (!sadb_req_from_sa(sa, mp, is_inbound))
838 			return (NULL);
839 	}
840 
841 	/* construct control message */
842 	ctl_mp = allocb(sizeof (ipsec_ctl_t), BPRI_HI);
843 	if (ctl_mp == NULL) {
844 		cmn_err(CE_WARN, "sadb_fmt_sa_req: allocb failed\n");
845 		freemsg(mp);
846 		return (NULL);
847 	}
848 
849 	ctl_mp->b_datap->db_type = M_CTL;
850 	ctl_mp->b_wptr += sizeof (ipsec_ctl_t);
851 	ctl_mp->b_cont = mp;
852 
853 	ctl = (ipsec_ctl_t *)ctl_mp->b_rptr;
854 	ctl->ipsec_ctl_type = IPSEC_CTL;
855 	ctl->ipsec_ctl_len  = sizeof (ipsec_ctl_t);
856 	ctl->ipsec_ctl_sa_type = sa_type;
857 
858 	if (need_key) {
859 		/*
860 		 * Keep an additional reference on SA, since it will be
861 		 * needed by IP to send control messages corresponding
862 		 * to that SA from its perimeter. IP will do a
863 		 * IPSA_REFRELE when done with the request.
864 		 */
865 		ASSERT(MUTEX_HELD(&sa->ipsa_lock));
866 		IPSA_REFHOLD(sa);
867 		ctl->ipsec_ctl_sa = sa;
868 	} else
869 		ctl->ipsec_ctl_sa = NULL;
870 
871 	return (ctl_mp);
872 }
873 
874 
875 /*
876  * Called by sadb_ill_download() to dump the entries for a specific
877  * fanout table.  For each SA entry in the table passed as argument,
878  * use mp as a template and constructs a full DL_CONTROL message, and
879  * call ill_dlpi_send(), provided by IP, to send the resulting
880  * messages to the ill.
881  */
882 static void
883 sadb_ill_df(ill_t *ill, mblk_t *mp, isaf_t *fanout, int num_entries,
884     boolean_t is_inbound)
885 {
886 	ipsa_t *walker;
887 	mblk_t *nmp, *salist;
888 	int i, error = 0;
889 	ip_stack_t	*ipst = ill->ill_ipst;
890 	netstack_t	*ns = ipst->ips_netstack;
891 
892 	IPSECHW_DEBUG(IPSECHW_SADB, ("sadb_ill_df: fanout at 0x%p ne=%d\n",
893 	    (void *)fanout, num_entries));
894 	/*
895 	 * For each IPSA hash bucket do:
896 	 *	- Hold the mutex
897 	 *	- Walk each entry, sending a corresponding request to IP
898 	 *	  for it.
899 	 */
900 	ASSERT(mp->b_datap->db_type == M_PROTO);
901 
902 	for (i = 0; i < num_entries; i++) {
903 		mutex_enter(&fanout[i].isaf_lock);
904 		salist = NULL;
905 
906 		for (walker = fanout[i].isaf_ipsa; walker != NULL;
907 		    walker = walker->ipsa_next) {
908 			IPSECHW_DEBUG(IPSECHW_SADB,
909 			    ("sadb_ill_df: sending SA to ill via IP \n"));
910 			/*
911 			 * Duplicate the template mp passed and
912 			 * complete DL_CONTROL_REQ data.
913 			 * To be more memory efficient, we could use
914 			 * dupb() for the M_CTL and copyb() for the M_PROTO
915 			 * as the M_CTL, since the M_CTL is the same for
916 			 * every SA entry passed down to IP for the same ill.
917 			 *
918 			 * Note that copymsg/copyb ensure that the new mblk
919 			 * is at least as large as the source mblk even if it's
920 			 * not using all its storage -- therefore, nmp
921 			 * has trailing space for sadb_req_from_sa to add
922 			 * the SA-specific bits.
923 			 */
924 			mutex_enter(&walker->ipsa_lock);
925 			if (ipsec_capab_match(ill,
926 			    ill->ill_phyint->phyint_ifindex, ill->ill_isv6,
927 			    walker, ns)) {
928 				nmp = copymsg(mp);
929 				if (nmp == NULL) {
930 					IPSECHW_DEBUG(IPSECHW_SADB,
931 					    ("sadb_ill_df: alloc error\n"));
932 					error = ENOMEM;
933 					mutex_exit(&walker->ipsa_lock);
934 					break;
935 				}
936 				if (sadb_req_from_sa(walker, nmp, is_inbound)) {
937 					nmp->b_next = salist;
938 					salist = nmp;
939 				}
940 			}
941 			mutex_exit(&walker->ipsa_lock);
942 		}
943 		mutex_exit(&fanout[i].isaf_lock);
944 		while (salist != NULL) {
945 			nmp = salist;
946 			salist = nmp->b_next;
947 			nmp->b_next = NULL;
948 			ill_dlpi_send(ill, nmp);
949 		}
950 		if (error != 0)
951 			break;	/* out of for loop. */
952 	}
953 }
954 
955 /*
956  * Called by ill_ipsec_capab_add(). Sends a copy of the SADB of
957  * the type specified by sa_type to the specified ill.
958  *
959  * We call for each fanout table defined by the SADB (one per
960  * protocol). sadb_ill_df() finally calls ill_dlpi_send() for
961  * each SADB entry in order to send a corresponding DL_CONTROL_REQ
962  * message to the ill.
963  */
964 void
965 sadb_ill_download(ill_t *ill, uint_t sa_type)
966 {
967 	mblk_t *protomp;	/* prototype message */
968 	dl_control_req_t *ctrl;
969 	sadbp_t *spp;
970 	sadb_t *sp;
971 	int dlt;
972 	ip_stack_t	*ipst = ill->ill_ipst;
973 	netstack_t	*ns = ipst->ips_netstack;
974 
975 	ASSERT(sa_type == SADB_SATYPE_AH || sa_type == SADB_SATYPE_ESP);
976 
977 	/*
978 	 * Allocate and initialize prototype answer. A duplicate for
979 	 * each SA is sent down to the interface.
980 	 */
981 
982 	/* DL_CONTROL_REQ M_PROTO mblk_t */
983 	protomp = allocb(sizeof (dl_control_req_t) +
984 	    sizeof (dl_ct_ipsec_key_t) + sizeof (dl_ct_ipsec_t), BPRI_HI);
985 	if (protomp == NULL)
986 		return;
987 	protomp->b_datap->db_type = M_PROTO;
988 
989 	dlt = (sa_type == SADB_SATYPE_AH) ? DL_CT_IPSEC_AH : DL_CT_IPSEC_ESP;
990 	if (sa_type == SADB_SATYPE_ESP) {
991 		ipsecesp_stack_t *espstack = ns->netstack_ipsecesp;
992 
993 		spp = &espstack->esp_sadb;
994 	} else {
995 		ipsecah_stack_t	*ahstack = ns->netstack_ipsecah;
996 
997 		spp = &ahstack->ah_sadb;
998 	}
999 
1000 	ctrl = (dl_control_req_t *)protomp->b_wptr;
1001 	ctrl->dl_primitive = DL_CONTROL_REQ;
1002 	ctrl->dl_operation = DL_CO_SET;
1003 	ctrl->dl_type = dlt;
1004 	ctrl->dl_key_offset = sizeof (dl_control_req_t);
1005 	ctrl->dl_key_length = sizeof (dl_ct_ipsec_key_t);
1006 	ctrl->dl_data_offset = sizeof (dl_control_req_t) +
1007 	    sizeof (dl_ct_ipsec_key_t);
1008 	ctrl->dl_data_length = sizeof (dl_ct_ipsec_t);
1009 	protomp->b_wptr += sizeof (dl_control_req_t);
1010 
1011 	/*
1012 	 * then for each SADB entry, we fill out the dl_ct_ipsec_key_t
1013 	 * and dl_ct_ipsec_t
1014 	 */
1015 	sp = ill->ill_isv6 ? &(spp->s_v6) : &(spp->s_v4);
1016 	sadb_ill_df(ill, protomp, sp->sdb_of, sp->sdb_hashsize, B_FALSE);
1017 	sadb_ill_df(ill, protomp, sp->sdb_if, sp->sdb_hashsize, B_TRUE);
1018 	freemsg(protomp);
1019 }
1020 
1021 /*
1022  * Call me to free up a security association fanout.  Use the forever
1023  * variable to indicate freeing up the SAs (forever == B_FALSE, e.g.
1024  * an SADB_FLUSH message), or destroying everything (forever == B_TRUE,
1025  * when a module is unloaded).
1026  */
1027 static void
1028 sadb_destroyer(isaf_t **tablep, uint_t numentries, boolean_t forever,
1029     boolean_t inbound)
1030 {
1031 	int i;
1032 	isaf_t *table = *tablep;
1033 	uint8_t protocol;
1034 	ipsa_t *sa;
1035 	netstackid_t sid;
1036 
1037 	if (table == NULL)
1038 		return;
1039 
1040 	for (i = 0; i < numentries; i++) {
1041 		mutex_enter(&table[i].isaf_lock);
1042 		while ((sa = table[i].isaf_ipsa) != NULL) {
1043 			if (inbound && cl_inet_deletespi &&
1044 			    (sa->ipsa_state != IPSA_STATE_ACTIVE_ELSEWHERE) &&
1045 			    (sa->ipsa_state != IPSA_STATE_IDLE)) {
1046 				protocol = (sa->ipsa_type == SADB_SATYPE_AH) ?
1047 				    IPPROTO_AH : IPPROTO_ESP;
1048 				sid = sa->ipsa_netstack->netstack_stackid;
1049 				cl_inet_deletespi(sid, protocol, sa->ipsa_spi,
1050 				    NULL);
1051 			}
1052 			sadb_unlinkassoc(sa);
1053 		}
1054 		table[i].isaf_gen++;
1055 		mutex_exit(&table[i].isaf_lock);
1056 		if (forever)
1057 			mutex_destroy(&(table[i].isaf_lock));
1058 	}
1059 
1060 	if (forever) {
1061 		*tablep = NULL;
1062 		kmem_free(table, numentries * sizeof (*table));
1063 	}
1064 }
1065 
1066 /*
1067  * Entry points to sadb_destroyer().
1068  */
1069 static void
1070 sadb_flush(sadb_t *sp, netstack_t *ns)
1071 {
1072 	/*
1073 	 * Flush out each bucket, one at a time.  Were it not for keysock's
1074 	 * enforcement, there would be a subtlety where I could add on the
1075 	 * heels of a flush.  With keysock's enforcement, however, this
1076 	 * makes ESP's job easy.
1077 	 */
1078 	sadb_destroyer(&sp->sdb_of, sp->sdb_hashsize, B_FALSE, B_FALSE);
1079 	sadb_destroyer(&sp->sdb_if, sp->sdb_hashsize, B_FALSE, B_TRUE);
1080 
1081 	/* For each acquire, destroy it; leave the bucket mutex alone. */
1082 	sadb_destroy_acqlist(&sp->sdb_acq, sp->sdb_hashsize, B_FALSE, ns);
1083 }
1084 
1085 static void
1086 sadb_destroy(sadb_t *sp, netstack_t *ns)
1087 {
1088 	sadb_destroyer(&sp->sdb_of, sp->sdb_hashsize, B_TRUE, B_FALSE);
1089 	sadb_destroyer(&sp->sdb_if, sp->sdb_hashsize, B_TRUE, B_TRUE);
1090 
1091 	/* For each acquire, destroy it, including the bucket mutex. */
1092 	sadb_destroy_acqlist(&sp->sdb_acq, sp->sdb_hashsize, B_TRUE, ns);
1093 
1094 	ASSERT(sp->sdb_of == NULL);
1095 	ASSERT(sp->sdb_if == NULL);
1096 	ASSERT(sp->sdb_acq == NULL);
1097 }
1098 
1099 static void
1100 sadb_send_flush_req(sadbp_t *spp)
1101 {
1102 	mblk_t *ctl_mp;
1103 
1104 	/*
1105 	 * we've been unplumbed, or never were plumbed; don't go there.
1106 	 */
1107 	if (spp->s_ip_q == NULL)
1108 		return;
1109 
1110 	/* have IP send a flush msg to the IPsec accelerators */
1111 	ctl_mp = sadb_fmt_sa_req(DL_CO_FLUSH, spp->s_satype, NULL, B_TRUE);
1112 	if (ctl_mp != NULL)
1113 		putnext(spp->s_ip_q, ctl_mp);
1114 }
1115 
1116 void
1117 sadbp_flush(sadbp_t *spp, netstack_t *ns)
1118 {
1119 	sadb_flush(&spp->s_v4, ns);
1120 	sadb_flush(&spp->s_v6, ns);
1121 
1122 	sadb_send_flush_req(spp);
1123 }
1124 
1125 void
1126 sadbp_destroy(sadbp_t *spp, netstack_t *ns)
1127 {
1128 	sadb_destroy(&spp->s_v4, ns);
1129 	sadb_destroy(&spp->s_v6, ns);
1130 
1131 	sadb_send_flush_req(spp);
1132 	if (spp->s_satype == SADB_SATYPE_AH) {
1133 		ipsec_stack_t	*ipss = ns->netstack_ipsec;
1134 
1135 		ip_drop_unregister(&ipss->ipsec_sadb_dropper);
1136 	}
1137 }
1138 
1139 
1140 /*
1141  * Check hard vs. soft lifetimes.  If there's a reality mismatch (e.g.
1142  * soft lifetimes > hard lifetimes) return an appropriate diagnostic for
1143  * EINVAL.
1144  */
1145 int
1146 sadb_hardsoftchk(sadb_lifetime_t *hard, sadb_lifetime_t *soft,
1147     sadb_lifetime_t *idle)
1148 {
1149 	if (hard == NULL || soft == NULL)
1150 		return (0);
1151 
1152 	if (hard->sadb_lifetime_allocations != 0 &&
1153 	    soft->sadb_lifetime_allocations != 0 &&
1154 	    hard->sadb_lifetime_allocations < soft->sadb_lifetime_allocations)
1155 		return (SADB_X_DIAGNOSTIC_ALLOC_HSERR);
1156 
1157 	if (hard->sadb_lifetime_bytes != 0 &&
1158 	    soft->sadb_lifetime_bytes != 0 &&
1159 	    hard->sadb_lifetime_bytes < soft->sadb_lifetime_bytes)
1160 		return (SADB_X_DIAGNOSTIC_BYTES_HSERR);
1161 
1162 	if (hard->sadb_lifetime_addtime != 0 &&
1163 	    soft->sadb_lifetime_addtime != 0 &&
1164 	    hard->sadb_lifetime_addtime < soft->sadb_lifetime_addtime)
1165 		return (SADB_X_DIAGNOSTIC_ADDTIME_HSERR);
1166 
1167 	if (hard->sadb_lifetime_usetime != 0 &&
1168 	    soft->sadb_lifetime_usetime != 0 &&
1169 	    hard->sadb_lifetime_usetime < soft->sadb_lifetime_usetime)
1170 		return (SADB_X_DIAGNOSTIC_USETIME_HSERR);
1171 
1172 	if (idle != NULL) {
1173 		if (hard->sadb_lifetime_addtime != 0 &&
1174 		    idle->sadb_lifetime_addtime != 0 &&
1175 		    hard->sadb_lifetime_addtime < idle->sadb_lifetime_addtime)
1176 			return (SADB_X_DIAGNOSTIC_ADDTIME_HSERR);
1177 
1178 		if (soft->sadb_lifetime_addtime != 0 &&
1179 		    idle->sadb_lifetime_addtime != 0 &&
1180 		    soft->sadb_lifetime_addtime < idle->sadb_lifetime_addtime)
1181 			return (SADB_X_DIAGNOSTIC_ADDTIME_HSERR);
1182 
1183 		if (hard->sadb_lifetime_usetime != 0 &&
1184 		    idle->sadb_lifetime_usetime != 0 &&
1185 		    hard->sadb_lifetime_usetime < idle->sadb_lifetime_usetime)
1186 			return (SADB_X_DIAGNOSTIC_USETIME_HSERR);
1187 
1188 		if (soft->sadb_lifetime_usetime != 0 &&
1189 		    idle->sadb_lifetime_usetime != 0 &&
1190 		    soft->sadb_lifetime_usetime < idle->sadb_lifetime_usetime)
1191 			return (SADB_X_DIAGNOSTIC_USETIME_HSERR);
1192 	}
1193 
1194 	return (0);
1195 }
1196 
1197 /*
1198  * Clone a security association for the purposes of inserting a single SA
1199  * into inbound and outbound tables respectively. This function should only
1200  * be called from sadb_common_add().
1201  */
1202 static ipsa_t *
1203 sadb_cloneassoc(ipsa_t *ipsa)
1204 {
1205 	ipsa_t *newbie;
1206 	boolean_t error = B_FALSE;
1207 
1208 	ASSERT(MUTEX_NOT_HELD(&(ipsa->ipsa_lock)));
1209 
1210 	newbie = kmem_alloc(sizeof (ipsa_t), KM_NOSLEEP);
1211 	if (newbie == NULL)
1212 		return (NULL);
1213 
1214 	/* Copy over what we can. */
1215 	*newbie = *ipsa;
1216 
1217 	/* bzero and initialize locks, in case *_init() allocates... */
1218 	mutex_init(&newbie->ipsa_lock, NULL, MUTEX_DEFAULT, NULL);
1219 
1220 	/*
1221 	 * While somewhat dain-bramaged, the most graceful way to
1222 	 * recover from errors is to keep plowing through the
1223 	 * allocations, and getting what I can.  It's easier to call
1224 	 * sadb_freeassoc() on the stillborn clone when all the
1225 	 * pointers aren't pointing to the parent's data.
1226 	 */
1227 
1228 	if (ipsa->ipsa_authkey != NULL) {
1229 		newbie->ipsa_authkey = kmem_alloc(newbie->ipsa_authkeylen,
1230 		    KM_NOSLEEP);
1231 		if (newbie->ipsa_authkey == NULL) {
1232 			error = B_TRUE;
1233 		} else {
1234 			bcopy(ipsa->ipsa_authkey, newbie->ipsa_authkey,
1235 			    newbie->ipsa_authkeylen);
1236 
1237 			newbie->ipsa_kcfauthkey.ck_data =
1238 			    newbie->ipsa_authkey;
1239 		}
1240 
1241 		if (newbie->ipsa_amech.cm_param != NULL) {
1242 			newbie->ipsa_amech.cm_param =
1243 			    (char *)&newbie->ipsa_mac_len;
1244 		}
1245 	}
1246 
1247 	if (ipsa->ipsa_encrkey != NULL) {
1248 		newbie->ipsa_encrkey = kmem_alloc(newbie->ipsa_encrkeylen,
1249 		    KM_NOSLEEP);
1250 		if (newbie->ipsa_encrkey == NULL) {
1251 			error = B_TRUE;
1252 		} else {
1253 			bcopy(ipsa->ipsa_encrkey, newbie->ipsa_encrkey,
1254 			    newbie->ipsa_encrkeylen);
1255 
1256 			newbie->ipsa_kcfencrkey.ck_data =
1257 			    newbie->ipsa_encrkey;
1258 		}
1259 	}
1260 
1261 	newbie->ipsa_authtmpl = NULL;
1262 	newbie->ipsa_encrtmpl = NULL;
1263 	newbie->ipsa_haspeer = B_TRUE;
1264 
1265 	if (ipsa->ipsa_integ != NULL) {
1266 		newbie->ipsa_integ = kmem_alloc(newbie->ipsa_integlen,
1267 		    KM_NOSLEEP);
1268 		if (newbie->ipsa_integ == NULL) {
1269 			error = B_TRUE;
1270 		} else {
1271 			bcopy(ipsa->ipsa_integ, newbie->ipsa_integ,
1272 			    newbie->ipsa_integlen);
1273 		}
1274 	}
1275 
1276 	if (ipsa->ipsa_sens != NULL) {
1277 		newbie->ipsa_sens = kmem_alloc(newbie->ipsa_senslen,
1278 		    KM_NOSLEEP);
1279 		if (newbie->ipsa_sens == NULL) {
1280 			error = B_TRUE;
1281 		} else {
1282 			bcopy(ipsa->ipsa_sens, newbie->ipsa_sens,
1283 			    newbie->ipsa_senslen);
1284 		}
1285 	}
1286 
1287 	if (ipsa->ipsa_src_cid != NULL) {
1288 		newbie->ipsa_src_cid = ipsa->ipsa_src_cid;
1289 		IPSID_REFHOLD(ipsa->ipsa_src_cid);
1290 	}
1291 
1292 	if (ipsa->ipsa_dst_cid != NULL) {
1293 		newbie->ipsa_dst_cid = ipsa->ipsa_dst_cid;
1294 		IPSID_REFHOLD(ipsa->ipsa_dst_cid);
1295 	}
1296 
1297 	if (error) {
1298 		sadb_freeassoc(newbie);
1299 		return (NULL);
1300 	}
1301 
1302 	return (newbie);
1303 }
1304 
1305 /*
1306  * Initialize a SADB address extension at the address specified by addrext.
1307  * Return a pointer to the end of the new address extension.
1308  */
1309 static uint8_t *
1310 sadb_make_addr_ext(uint8_t *start, uint8_t *end, uint16_t exttype,
1311     sa_family_t af, uint32_t *addr, uint16_t port, uint8_t proto, int prefix)
1312 {
1313 	struct sockaddr_in *sin;
1314 	struct sockaddr_in6 *sin6;
1315 	uint8_t *cur = start;
1316 	int addrext_len;
1317 	int sin_len;
1318 	sadb_address_t *addrext	= (sadb_address_t *)cur;
1319 
1320 	if (cur == NULL)
1321 		return (NULL);
1322 
1323 	cur += sizeof (*addrext);
1324 	if (cur > end)
1325 		return (NULL);
1326 
1327 	addrext->sadb_address_proto = proto;
1328 	addrext->sadb_address_prefixlen = prefix;
1329 	addrext->sadb_address_reserved = 0;
1330 	addrext->sadb_address_exttype = exttype;
1331 
1332 	switch (af) {
1333 	case AF_INET:
1334 		sin = (struct sockaddr_in *)cur;
1335 		sin_len = sizeof (*sin);
1336 		cur += sin_len;
1337 		if (cur > end)
1338 			return (NULL);
1339 
1340 		sin->sin_family = af;
1341 		bzero(sin->sin_zero, sizeof (sin->sin_zero));
1342 		sin->sin_port = port;
1343 		IPSA_COPY_ADDR(&sin->sin_addr, addr, af);
1344 		break;
1345 	case AF_INET6:
1346 		sin6 = (struct sockaddr_in6 *)cur;
1347 		sin_len = sizeof (*sin6);
1348 		cur += sin_len;
1349 		if (cur > end)
1350 			return (NULL);
1351 
1352 		bzero(sin6, sizeof (*sin6));
1353 		sin6->sin6_family = af;
1354 		sin6->sin6_port = port;
1355 		IPSA_COPY_ADDR(&sin6->sin6_addr, addr, af);
1356 		break;
1357 	}
1358 
1359 	addrext_len = roundup(cur - start, sizeof (uint64_t));
1360 	addrext->sadb_address_len = SADB_8TO64(addrext_len);
1361 
1362 	cur = start + addrext_len;
1363 	if (cur > end)
1364 		cur = NULL;
1365 
1366 	return (cur);
1367 }
1368 
1369 /*
1370  * Construct a key management cookie extension.
1371  */
1372 
1373 static uint8_t *
1374 sadb_make_kmc_ext(uint8_t *cur, uint8_t *end, uint32_t kmp, uint32_t kmc)
1375 {
1376 	sadb_x_kmc_t *kmcext = (sadb_x_kmc_t *)cur;
1377 
1378 	if (cur == NULL)
1379 		return (NULL);
1380 
1381 	cur += sizeof (*kmcext);
1382 
1383 	if (cur > end)
1384 		return (NULL);
1385 
1386 	kmcext->sadb_x_kmc_len = SADB_8TO64(sizeof (*kmcext));
1387 	kmcext->sadb_x_kmc_exttype = SADB_X_EXT_KM_COOKIE;
1388 	kmcext->sadb_x_kmc_proto = kmp;
1389 	kmcext->sadb_x_kmc_cookie = kmc;
1390 	kmcext->sadb_x_kmc_reserved = 0;
1391 
1392 	return (cur);
1393 }
1394 
1395 /*
1396  * Given an original message header with sufficient space following it, and an
1397  * SA, construct a full PF_KEY message with all of the relevant extensions.
1398  * This is mostly used for SADB_GET, and SADB_DUMP.
1399  */
1400 static mblk_t *
1401 sadb_sa2msg(ipsa_t *ipsa, sadb_msg_t *samsg)
1402 {
1403 	int alloclen, addrsize, paddrsize, authsize, encrsize;
1404 	int srcidsize, dstidsize;
1405 	sa_family_t fam, pfam;	/* Address family for SADB_EXT_ADDRESS */
1406 				/* src/dst and proxy sockaddrs. */
1407 	/*
1408 	 * The following are pointers into the PF_KEY message this PF_KEY
1409 	 * message creates.
1410 	 */
1411 	sadb_msg_t *newsamsg;
1412 	sadb_sa_t *assoc;
1413 	sadb_lifetime_t *lt;
1414 	sadb_key_t *key;
1415 	sadb_ident_t *ident;
1416 	sadb_sens_t *sens;
1417 	sadb_ext_t *walker;	/* For when we need a generic ext. pointer. */
1418 	sadb_x_replay_ctr_t *repl_ctr;
1419 	sadb_x_pair_t *pair_ext;
1420 
1421 	mblk_t *mp;
1422 	uint64_t *bitmap;
1423 	uint8_t *cur, *end;
1424 	/* These indicate the presence of the above extension fields. */
1425 	boolean_t soft, hard, isrc, idst, auth, encr, sensinteg, srcid, dstid;
1426 	boolean_t idle;
1427 	boolean_t paired;
1428 	uint32_t otherspi;
1429 
1430 	/* First off, figure out the allocation length for this message. */
1431 
1432 	/*
1433 	 * Constant stuff.  This includes base, SA, address (src, dst),
1434 	 * and lifetime (current).
1435 	 */
1436 	alloclen = sizeof (sadb_msg_t) + sizeof (sadb_sa_t) +
1437 	    sizeof (sadb_lifetime_t);
1438 
1439 	fam = ipsa->ipsa_addrfam;
1440 	switch (fam) {
1441 	case AF_INET:
1442 		addrsize = roundup(sizeof (struct sockaddr_in) +
1443 		    sizeof (sadb_address_t), sizeof (uint64_t));
1444 		break;
1445 	case AF_INET6:
1446 		addrsize = roundup(sizeof (struct sockaddr_in6) +
1447 		    sizeof (sadb_address_t), sizeof (uint64_t));
1448 		break;
1449 	default:
1450 		return (NULL);
1451 	}
1452 	/*
1453 	 * Allocate TWO address extensions, for source and destination.
1454 	 * (Thus, the * 2.)
1455 	 */
1456 	alloclen += addrsize * 2;
1457 	if (ipsa->ipsa_flags & IPSA_F_NATT_REM)
1458 		alloclen += addrsize;
1459 	if (ipsa->ipsa_flags & IPSA_F_NATT_LOC)
1460 		alloclen += addrsize;
1461 
1462 	if (ipsa->ipsa_flags & IPSA_F_PAIRED) {
1463 		paired = B_TRUE;
1464 		alloclen += sizeof (sadb_x_pair_t);
1465 		otherspi = ipsa->ipsa_otherspi;
1466 	} else {
1467 		paired = B_FALSE;
1468 	}
1469 
1470 	/* How 'bout other lifetimes? */
1471 	if (ipsa->ipsa_softaddlt != 0 || ipsa->ipsa_softuselt != 0 ||
1472 	    ipsa->ipsa_softbyteslt != 0 || ipsa->ipsa_softalloc != 0) {
1473 		alloclen += sizeof (sadb_lifetime_t);
1474 		soft = B_TRUE;
1475 	} else {
1476 		soft = B_FALSE;
1477 	}
1478 
1479 	if (ipsa->ipsa_hardaddlt != 0 || ipsa->ipsa_harduselt != 0 ||
1480 	    ipsa->ipsa_hardbyteslt != 0 || ipsa->ipsa_hardalloc != 0) {
1481 		alloclen += sizeof (sadb_lifetime_t);
1482 		hard = B_TRUE;
1483 	} else {
1484 		hard = B_FALSE;
1485 	}
1486 
1487 	if (ipsa->ipsa_idleaddlt != 0 || ipsa->ipsa_idleuselt != 0) {
1488 		alloclen += sizeof (sadb_lifetime_t);
1489 		idle = B_TRUE;
1490 	} else {
1491 		idle = B_FALSE;
1492 	}
1493 
1494 	/* Inner addresses. */
1495 	if (ipsa->ipsa_innerfam == 0) {
1496 		isrc = B_FALSE;
1497 		idst = B_FALSE;
1498 	} else {
1499 		pfam = ipsa->ipsa_innerfam;
1500 		switch (pfam) {
1501 		case AF_INET6:
1502 			paddrsize = roundup(sizeof (struct sockaddr_in6) +
1503 			    sizeof (sadb_address_t), sizeof (uint64_t));
1504 			break;
1505 		case AF_INET:
1506 			paddrsize = roundup(sizeof (struct sockaddr_in) +
1507 			    sizeof (sadb_address_t), sizeof (uint64_t));
1508 			break;
1509 		default:
1510 			cmn_err(CE_PANIC,
1511 			    "IPsec SADB: Proxy length failure.\n");
1512 			break;
1513 		}
1514 		isrc = B_TRUE;
1515 		idst = B_TRUE;
1516 		alloclen += 2 * paddrsize;
1517 	}
1518 
1519 	/* For the following fields, assume that length != 0 ==> stuff */
1520 	if (ipsa->ipsa_authkeylen != 0) {
1521 		authsize = roundup(sizeof (sadb_key_t) + ipsa->ipsa_authkeylen,
1522 		    sizeof (uint64_t));
1523 		alloclen += authsize;
1524 		auth = B_TRUE;
1525 	} else {
1526 		auth = B_FALSE;
1527 	}
1528 
1529 	if (ipsa->ipsa_encrkeylen != 0) {
1530 		encrsize = roundup(sizeof (sadb_key_t) + ipsa->ipsa_encrkeylen,
1531 		    sizeof (uint64_t));
1532 		alloclen += encrsize;
1533 		encr = B_TRUE;
1534 	} else {
1535 		encr = B_FALSE;
1536 	}
1537 
1538 	/* No need for roundup on sens and integ. */
1539 	if (ipsa->ipsa_integlen != 0 || ipsa->ipsa_senslen != 0) {
1540 		alloclen += sizeof (sadb_key_t) + ipsa->ipsa_integlen +
1541 		    ipsa->ipsa_senslen;
1542 		sensinteg = B_TRUE;
1543 	} else {
1544 		sensinteg = B_FALSE;
1545 	}
1546 
1547 	/*
1548 	 * Must use strlen() here for lengths.	Identities use NULL
1549 	 * pointers to indicate their nonexistence.
1550 	 */
1551 	if (ipsa->ipsa_src_cid != NULL) {
1552 		srcidsize = roundup(sizeof (sadb_ident_t) +
1553 		    strlen(ipsa->ipsa_src_cid->ipsid_cid) + 1,
1554 		    sizeof (uint64_t));
1555 		alloclen += srcidsize;
1556 		srcid = B_TRUE;
1557 	} else {
1558 		srcid = B_FALSE;
1559 	}
1560 
1561 	if (ipsa->ipsa_dst_cid != NULL) {
1562 		dstidsize = roundup(sizeof (sadb_ident_t) +
1563 		    strlen(ipsa->ipsa_dst_cid->ipsid_cid) + 1,
1564 		    sizeof (uint64_t));
1565 		alloclen += dstidsize;
1566 		dstid = B_TRUE;
1567 	} else {
1568 		dstid = B_FALSE;
1569 	}
1570 
1571 	if ((ipsa->ipsa_kmp != 0) || (ipsa->ipsa_kmc != 0))
1572 		alloclen += sizeof (sadb_x_kmc_t);
1573 
1574 	if (ipsa->ipsa_replay != 0) {
1575 		alloclen += sizeof (sadb_x_replay_ctr_t);
1576 	}
1577 
1578 	/* Make sure the allocation length is a multiple of 8 bytes. */
1579 	ASSERT((alloclen & 0x7) == 0);
1580 
1581 	/* XXX Possibly make it esballoc, with a bzero-ing free_ftn. */
1582 	mp = allocb(alloclen, BPRI_HI);
1583 	if (mp == NULL)
1584 		return (NULL);
1585 
1586 	mp->b_wptr += alloclen;
1587 	end = mp->b_wptr;
1588 	newsamsg = (sadb_msg_t *)mp->b_rptr;
1589 	*newsamsg = *samsg;
1590 	newsamsg->sadb_msg_len = (uint16_t)SADB_8TO64(alloclen);
1591 
1592 	mutex_enter(&ipsa->ipsa_lock);	/* Since I'm grabbing SA fields... */
1593 
1594 	newsamsg->sadb_msg_satype = ipsa->ipsa_type;
1595 
1596 	assoc = (sadb_sa_t *)(newsamsg + 1);
1597 	assoc->sadb_sa_len = SADB_8TO64(sizeof (*assoc));
1598 	assoc->sadb_sa_exttype = SADB_EXT_SA;
1599 	assoc->sadb_sa_spi = ipsa->ipsa_spi;
1600 	assoc->sadb_sa_replay = ipsa->ipsa_replay_wsize;
1601 	assoc->sadb_sa_state = ipsa->ipsa_state;
1602 	assoc->sadb_sa_auth = ipsa->ipsa_auth_alg;
1603 	assoc->sadb_sa_encrypt = ipsa->ipsa_encr_alg;
1604 	assoc->sadb_sa_flags = ipsa->ipsa_flags;
1605 
1606 	lt = (sadb_lifetime_t *)(assoc + 1);
1607 	lt->sadb_lifetime_len = SADB_8TO64(sizeof (*lt));
1608 	lt->sadb_lifetime_exttype = SADB_EXT_LIFETIME_CURRENT;
1609 	/* We do not support the concept. */
1610 	lt->sadb_lifetime_allocations = 0;
1611 	lt->sadb_lifetime_bytes = ipsa->ipsa_bytes;
1612 	lt->sadb_lifetime_addtime = ipsa->ipsa_addtime;
1613 	lt->sadb_lifetime_usetime = ipsa->ipsa_usetime;
1614 
1615 	if (hard) {
1616 		lt++;
1617 		lt->sadb_lifetime_len = SADB_8TO64(sizeof (*lt));
1618 		lt->sadb_lifetime_exttype = SADB_EXT_LIFETIME_HARD;
1619 		lt->sadb_lifetime_allocations = ipsa->ipsa_hardalloc;
1620 		lt->sadb_lifetime_bytes = ipsa->ipsa_hardbyteslt;
1621 		lt->sadb_lifetime_addtime = ipsa->ipsa_hardaddlt;
1622 		lt->sadb_lifetime_usetime = ipsa->ipsa_harduselt;
1623 	}
1624 
1625 	if (soft) {
1626 		lt++;
1627 		lt->sadb_lifetime_len = SADB_8TO64(sizeof (*lt));
1628 		lt->sadb_lifetime_exttype = SADB_EXT_LIFETIME_SOFT;
1629 		lt->sadb_lifetime_allocations = ipsa->ipsa_softalloc;
1630 		lt->sadb_lifetime_bytes = ipsa->ipsa_softbyteslt;
1631 		lt->sadb_lifetime_addtime = ipsa->ipsa_softaddlt;
1632 		lt->sadb_lifetime_usetime = ipsa->ipsa_softuselt;
1633 	}
1634 
1635 	if (idle) {
1636 		lt++;
1637 		lt->sadb_lifetime_len = SADB_8TO64(sizeof (*lt));
1638 		lt->sadb_lifetime_exttype = SADB_X_EXT_LIFETIME_IDLE;
1639 		lt->sadb_lifetime_addtime = ipsa->ipsa_idleaddlt;
1640 		lt->sadb_lifetime_usetime = ipsa->ipsa_idleuselt;
1641 	}
1642 
1643 	cur = (uint8_t *)(lt + 1);
1644 
1645 	/* NOTE:  Don't fill in ports here if we are a tunnel-mode SA. */
1646 	cur = sadb_make_addr_ext(cur, end, SADB_EXT_ADDRESS_SRC, fam,
1647 	    ipsa->ipsa_srcaddr, (!isrc && !idst) ? SA_SRCPORT(ipsa) : 0,
1648 	    SA_PROTO(ipsa), 0);
1649 	if (cur == NULL) {
1650 		freemsg(mp);
1651 		mp = NULL;
1652 		goto bail;
1653 	}
1654 
1655 	cur = sadb_make_addr_ext(cur, end, SADB_EXT_ADDRESS_DST, fam,
1656 	    ipsa->ipsa_dstaddr, (!isrc && !idst) ? SA_DSTPORT(ipsa) : 0,
1657 	    SA_PROTO(ipsa), 0);
1658 	if (cur == NULL) {
1659 		freemsg(mp);
1660 		mp = NULL;
1661 		goto bail;
1662 	}
1663 
1664 	if (ipsa->ipsa_flags & IPSA_F_NATT_LOC) {
1665 		cur = sadb_make_addr_ext(cur, end, SADB_X_EXT_ADDRESS_NATT_LOC,
1666 		    fam, &ipsa->ipsa_natt_addr_loc, ipsa->ipsa_local_nat_port,
1667 		    IPPROTO_UDP, 0);
1668 		if (cur == NULL) {
1669 			freemsg(mp);
1670 			mp = NULL;
1671 			goto bail;
1672 		}
1673 	}
1674 
1675 	if (ipsa->ipsa_flags & IPSA_F_NATT_REM) {
1676 		cur = sadb_make_addr_ext(cur, end, SADB_X_EXT_ADDRESS_NATT_REM,
1677 		    fam, &ipsa->ipsa_natt_addr_rem, ipsa->ipsa_remote_nat_port,
1678 		    IPPROTO_UDP, 0);
1679 		if (cur == NULL) {
1680 			freemsg(mp);
1681 			mp = NULL;
1682 			goto bail;
1683 		}
1684 	}
1685 
1686 	/* If we are a tunnel-mode SA, fill in the inner-selectors. */
1687 	if (isrc) {
1688 		cur = sadb_make_addr_ext(cur, end, SADB_X_EXT_ADDRESS_INNER_SRC,
1689 		    pfam, ipsa->ipsa_innersrc, SA_SRCPORT(ipsa),
1690 		    SA_IPROTO(ipsa), ipsa->ipsa_innersrcpfx);
1691 		if (cur == NULL) {
1692 			freemsg(mp);
1693 			mp = NULL;
1694 			goto bail;
1695 		}
1696 	}
1697 
1698 	if (idst) {
1699 		cur = sadb_make_addr_ext(cur, end, SADB_X_EXT_ADDRESS_INNER_DST,
1700 		    pfam, ipsa->ipsa_innerdst, SA_DSTPORT(ipsa),
1701 		    SA_IPROTO(ipsa), ipsa->ipsa_innerdstpfx);
1702 		if (cur == NULL) {
1703 			freemsg(mp);
1704 			mp = NULL;
1705 			goto bail;
1706 		}
1707 	}
1708 
1709 	if ((ipsa->ipsa_kmp != 0) || (ipsa->ipsa_kmc != 0)) {
1710 		cur = sadb_make_kmc_ext(cur, end,
1711 		    ipsa->ipsa_kmp, ipsa->ipsa_kmc);
1712 		if (cur == NULL) {
1713 			freemsg(mp);
1714 			mp = NULL;
1715 			goto bail;
1716 		}
1717 	}
1718 
1719 	walker = (sadb_ext_t *)cur;
1720 	if (auth) {
1721 		key = (sadb_key_t *)walker;
1722 		key->sadb_key_len = SADB_8TO64(authsize);
1723 		key->sadb_key_exttype = SADB_EXT_KEY_AUTH;
1724 		key->sadb_key_bits = ipsa->ipsa_authkeybits;
1725 		key->sadb_key_reserved = 0;
1726 		bcopy(ipsa->ipsa_authkey, key + 1, ipsa->ipsa_authkeylen);
1727 		walker = (sadb_ext_t *)((uint64_t *)walker +
1728 		    walker->sadb_ext_len);
1729 	}
1730 
1731 	if (encr) {
1732 		key = (sadb_key_t *)walker;
1733 		key->sadb_key_len = SADB_8TO64(encrsize);
1734 		key->sadb_key_exttype = SADB_EXT_KEY_ENCRYPT;
1735 		key->sadb_key_bits = ipsa->ipsa_encrkeybits;
1736 		key->sadb_key_reserved = 0;
1737 		bcopy(ipsa->ipsa_encrkey, key + 1, ipsa->ipsa_encrkeylen);
1738 		walker = (sadb_ext_t *)((uint64_t *)walker +
1739 		    walker->sadb_ext_len);
1740 	}
1741 
1742 	if (srcid) {
1743 		ident = (sadb_ident_t *)walker;
1744 		ident->sadb_ident_len = SADB_8TO64(srcidsize);
1745 		ident->sadb_ident_exttype = SADB_EXT_IDENTITY_SRC;
1746 		ident->sadb_ident_type = ipsa->ipsa_src_cid->ipsid_type;
1747 		ident->sadb_ident_id = 0;
1748 		ident->sadb_ident_reserved = 0;
1749 		(void) strcpy((char *)(ident + 1),
1750 		    ipsa->ipsa_src_cid->ipsid_cid);
1751 		walker = (sadb_ext_t *)((uint64_t *)walker +
1752 		    walker->sadb_ext_len);
1753 	}
1754 
1755 	if (dstid) {
1756 		ident = (sadb_ident_t *)walker;
1757 		ident->sadb_ident_len = SADB_8TO64(dstidsize);
1758 		ident->sadb_ident_exttype = SADB_EXT_IDENTITY_DST;
1759 		ident->sadb_ident_type = ipsa->ipsa_dst_cid->ipsid_type;
1760 		ident->sadb_ident_id = 0;
1761 		ident->sadb_ident_reserved = 0;
1762 		(void) strcpy((char *)(ident + 1),
1763 		    ipsa->ipsa_dst_cid->ipsid_cid);
1764 		walker = (sadb_ext_t *)((uint64_t *)walker +
1765 		    walker->sadb_ext_len);
1766 	}
1767 
1768 	if (sensinteg) {
1769 		sens = (sadb_sens_t *)walker;
1770 		sens->sadb_sens_len = SADB_8TO64(sizeof (sadb_sens_t *) +
1771 		    ipsa->ipsa_senslen + ipsa->ipsa_integlen);
1772 		sens->sadb_sens_dpd = ipsa->ipsa_dpd;
1773 		sens->sadb_sens_sens_level = ipsa->ipsa_senslevel;
1774 		sens->sadb_sens_integ_level = ipsa->ipsa_integlevel;
1775 		sens->sadb_sens_sens_len = SADB_8TO64(ipsa->ipsa_senslen);
1776 		sens->sadb_sens_integ_len = SADB_8TO64(ipsa->ipsa_integlen);
1777 		sens->sadb_sens_reserved = 0;
1778 		bitmap = (uint64_t *)(sens + 1);
1779 		if (ipsa->ipsa_sens != NULL) {
1780 			bcopy(ipsa->ipsa_sens, bitmap, ipsa->ipsa_senslen);
1781 			bitmap += sens->sadb_sens_sens_len;
1782 		}
1783 		if (ipsa->ipsa_integ != NULL)
1784 			bcopy(ipsa->ipsa_integ, bitmap, ipsa->ipsa_integlen);
1785 		walker = (sadb_ext_t *)((uint64_t *)walker +
1786 		    walker->sadb_ext_len);
1787 	}
1788 
1789 	if (paired) {
1790 		pair_ext = (sadb_x_pair_t *)walker;
1791 
1792 		pair_ext->sadb_x_pair_len = SADB_8TO64(sizeof (sadb_x_pair_t));
1793 		pair_ext->sadb_x_pair_exttype = SADB_X_EXT_PAIR;
1794 		pair_ext->sadb_x_pair_spi = otherspi;
1795 
1796 		walker = (sadb_ext_t *)((uint64_t *)walker +
1797 		    walker->sadb_ext_len);
1798 	}
1799 
1800 	if (ipsa->ipsa_replay != 0) {
1801 		repl_ctr = (sadb_x_replay_ctr_t *)walker;
1802 		repl_ctr->sadb_x_rc_len = SADB_8TO64(sizeof (*repl_ctr));
1803 		repl_ctr->sadb_x_rc_exttype = SADB_X_EXT_REPLAY_VALUE;
1804 		repl_ctr->sadb_x_rc_replay32 = ipsa->ipsa_replay;
1805 		repl_ctr->sadb_x_rc_replay64 = 0;
1806 		walker = (sadb_ext_t *)(repl_ctr + 1);
1807 	}
1808 
1809 bail:
1810 	/* Pardon any delays... */
1811 	mutex_exit(&ipsa->ipsa_lock);
1812 
1813 	return (mp);
1814 }
1815 
1816 /*
1817  * Strip out key headers or unmarked headers (SADB_EXT_KEY_*, SADB_EXT_UNKNOWN)
1818  * and adjust base message accordingly.
1819  *
1820  * Assume message is pulled up in one piece of contiguous memory.
1821  *
1822  * Say if we start off with:
1823  *
1824  * +------+----+-------------+-----------+---------------+---------------+
1825  * | base | SA | source addr | dest addr | rsrvd. or key | soft lifetime |
1826  * +------+----+-------------+-----------+---------------+---------------+
1827  *
1828  * we will end up with
1829  *
1830  * +------+----+-------------+-----------+---------------+
1831  * | base | SA | source addr | dest addr | soft lifetime |
1832  * +------+----+-------------+-----------+---------------+
1833  */
1834 static void
1835 sadb_strip(sadb_msg_t *samsg)
1836 {
1837 	sadb_ext_t *ext;
1838 	uint8_t *target = NULL;
1839 	uint8_t *msgend;
1840 	int sofar = SADB_8TO64(sizeof (*samsg));
1841 	int copylen;
1842 
1843 	ext = (sadb_ext_t *)(samsg + 1);
1844 	msgend = (uint8_t *)samsg;
1845 	msgend += SADB_64TO8(samsg->sadb_msg_len);
1846 	while ((uint8_t *)ext < msgend) {
1847 		if (ext->sadb_ext_type == SADB_EXT_RESERVED ||
1848 		    ext->sadb_ext_type == SADB_EXT_KEY_AUTH ||
1849 		    ext->sadb_ext_type == SADB_X_EXT_EDUMP ||
1850 		    ext->sadb_ext_type == SADB_EXT_KEY_ENCRYPT) {
1851 			/*
1852 			 * Aha!	 I found a header to be erased.
1853 			 */
1854 
1855 			if (target != NULL) {
1856 				/*
1857 				 * If I had a previous header to be erased,
1858 				 * copy over it.  I can get away with just
1859 				 * copying backwards because the target will
1860 				 * always be 8 bytes behind the source.
1861 				 */
1862 				copylen = ((uint8_t *)ext) - (target +
1863 				    SADB_64TO8(
1864 				    ((sadb_ext_t *)target)->sadb_ext_len));
1865 				ovbcopy(((uint8_t *)ext - copylen), target,
1866 				    copylen);
1867 				target += copylen;
1868 				((sadb_ext_t *)target)->sadb_ext_len =
1869 				    SADB_8TO64(((uint8_t *)ext) - target +
1870 				    SADB_64TO8(ext->sadb_ext_len));
1871 			} else {
1872 				target = (uint8_t *)ext;
1873 			}
1874 		} else {
1875 			sofar += ext->sadb_ext_len;
1876 		}
1877 
1878 		ext = (sadb_ext_t *)(((uint64_t *)ext) + ext->sadb_ext_len);
1879 	}
1880 
1881 	ASSERT((uint8_t *)ext == msgend);
1882 
1883 	if (target != NULL) {
1884 		copylen = ((uint8_t *)ext) - (target +
1885 		    SADB_64TO8(((sadb_ext_t *)target)->sadb_ext_len));
1886 		if (copylen != 0)
1887 			ovbcopy(((uint8_t *)ext - copylen), target, copylen);
1888 	}
1889 
1890 	/* Adjust samsg. */
1891 	samsg->sadb_msg_len = (uint16_t)sofar;
1892 
1893 	/* Assume all of the rest is cleared by caller in sadb_pfkey_echo(). */
1894 }
1895 
1896 /*
1897  * AH needs to send an error to PF_KEY.	 Assume mp points to an M_CTL
1898  * followed by an M_DATA with a PF_KEY message in it.  The serial of
1899  * the sending keysock instance is included.
1900  */
1901 void
1902 sadb_pfkey_error(queue_t *pfkey_q, mblk_t *mp, int error, int diagnostic,
1903     uint_t serial)
1904 {
1905 	mblk_t *msg = mp->b_cont;
1906 	sadb_msg_t *samsg;
1907 	keysock_out_t *kso;
1908 
1909 	/*
1910 	 * Enough functions call this to merit a NULL queue check.
1911 	 */
1912 	if (pfkey_q == NULL) {
1913 		freemsg(mp);
1914 		return;
1915 	}
1916 
1917 	ASSERT(msg != NULL);
1918 	ASSERT((mp->b_wptr - mp->b_rptr) == sizeof (ipsec_info_t));
1919 	ASSERT((msg->b_wptr - msg->b_rptr) >= sizeof (sadb_msg_t));
1920 	samsg = (sadb_msg_t *)msg->b_rptr;
1921 	kso = (keysock_out_t *)mp->b_rptr;
1922 
1923 	kso->ks_out_type = KEYSOCK_OUT;
1924 	kso->ks_out_len = sizeof (*kso);
1925 	kso->ks_out_serial = serial;
1926 
1927 	/*
1928 	 * Only send the base message up in the event of an error.
1929 	 * Don't worry about bzero()-ing, because it was probably bogus
1930 	 * anyway.
1931 	 */
1932 	msg->b_wptr = msg->b_rptr + sizeof (*samsg);
1933 	samsg = (sadb_msg_t *)msg->b_rptr;
1934 	samsg->sadb_msg_len = SADB_8TO64(sizeof (*samsg));
1935 	samsg->sadb_msg_errno = (uint8_t)error;
1936 	if (diagnostic != SADB_X_DIAGNOSTIC_PRESET)
1937 		samsg->sadb_x_msg_diagnostic = (uint16_t)diagnostic;
1938 
1939 	putnext(pfkey_q, mp);
1940 }
1941 
1942 /*
1943  * Send a successful return packet back to keysock via the queue in pfkey_q.
1944  *
1945  * Often, an SA is associated with the reply message, it's passed in if needed,
1946  * and NULL if not.  BTW, that ipsa will have its refcnt appropriately held,
1947  * and the caller will release said refcnt.
1948  */
1949 void
1950 sadb_pfkey_echo(queue_t *pfkey_q, mblk_t *mp, sadb_msg_t *samsg,
1951     keysock_in_t *ksi, ipsa_t *ipsa)
1952 {
1953 	keysock_out_t *kso;
1954 	mblk_t *mp1;
1955 	sadb_msg_t *newsamsg;
1956 	uint8_t *oldend;
1957 
1958 	ASSERT((mp->b_cont != NULL) &&
1959 	    ((void *)samsg == (void *)mp->b_cont->b_rptr) &&
1960 	    ((void *)mp->b_rptr == (void *)ksi));
1961 
1962 	switch (samsg->sadb_msg_type) {
1963 	case SADB_ADD:
1964 	case SADB_UPDATE:
1965 	case SADB_X_UPDATEPAIR:
1966 	case SADB_X_DELPAIR_STATE:
1967 	case SADB_FLUSH:
1968 	case SADB_DUMP:
1969 		/*
1970 		 * I have all of the message already.  I just need to strip
1971 		 * out the keying material and echo the message back.
1972 		 *
1973 		 * NOTE: for SADB_DUMP, the function sadb_dump() did the
1974 		 * work.  When DUMP reaches here, it should only be a base
1975 		 * message.
1976 		 */
1977 	justecho:
1978 		if (ksi->ks_in_extv[SADB_EXT_KEY_AUTH] != NULL ||
1979 		    ksi->ks_in_extv[SADB_EXT_KEY_ENCRYPT] != NULL ||
1980 		    ksi->ks_in_extv[SADB_X_EXT_EDUMP] != NULL) {
1981 			sadb_strip(samsg);
1982 			/* Assume PF_KEY message is contiguous. */
1983 			ASSERT(mp->b_cont->b_cont == NULL);
1984 			oldend = mp->b_cont->b_wptr;
1985 			mp->b_cont->b_wptr = mp->b_cont->b_rptr +
1986 			    SADB_64TO8(samsg->sadb_msg_len);
1987 			bzero(mp->b_cont->b_wptr, oldend - mp->b_cont->b_wptr);
1988 		}
1989 		break;
1990 	case SADB_GET:
1991 		/*
1992 		 * Do a lot of work here, because of the ipsa I just found.
1993 		 * First construct the new PF_KEY message, then abandon
1994 		 * the old one.
1995 		 */
1996 		mp1 = sadb_sa2msg(ipsa, samsg);
1997 		if (mp1 == NULL) {
1998 			sadb_pfkey_error(pfkey_q, mp, ENOMEM,
1999 			    SADB_X_DIAGNOSTIC_NONE, ksi->ks_in_serial);
2000 			return;
2001 		}
2002 		freemsg(mp->b_cont);
2003 		mp->b_cont = mp1;
2004 		break;
2005 	case SADB_DELETE:
2006 	case SADB_X_DELPAIR:
2007 		if (ipsa == NULL)
2008 			goto justecho;
2009 		/*
2010 		 * Because listening KMds may require more info, treat
2011 		 * DELETE like a special case of GET.
2012 		 */
2013 		mp1 = sadb_sa2msg(ipsa, samsg);
2014 		if (mp1 == NULL) {
2015 			sadb_pfkey_error(pfkey_q, mp, ENOMEM,
2016 			    SADB_X_DIAGNOSTIC_NONE, ksi->ks_in_serial);
2017 			return;
2018 		}
2019 		newsamsg = (sadb_msg_t *)mp1->b_rptr;
2020 		sadb_strip(newsamsg);
2021 		oldend = mp1->b_wptr;
2022 		mp1->b_wptr = mp1->b_rptr + SADB_64TO8(newsamsg->sadb_msg_len);
2023 		bzero(mp1->b_wptr, oldend - mp1->b_wptr);
2024 		freemsg(mp->b_cont);
2025 		mp->b_cont = mp1;
2026 		break;
2027 	default:
2028 		if (mp != NULL)
2029 			freemsg(mp);
2030 		return;
2031 	}
2032 
2033 	/* ksi is now null and void. */
2034 	kso = (keysock_out_t *)ksi;
2035 	kso->ks_out_type = KEYSOCK_OUT;
2036 	kso->ks_out_len = sizeof (*kso);
2037 	kso->ks_out_serial = ksi->ks_in_serial;
2038 	/* We're ready to send... */
2039 	putnext(pfkey_q, mp);
2040 }
2041 
2042 /*
2043  * Set up a global pfkey_q instance for AH, ESP, or some other consumer.
2044  */
2045 void
2046 sadb_keysock_hello(queue_t **pfkey_qp, queue_t *q, mblk_t *mp,
2047     void (*ager)(void *), void *agerarg, timeout_id_t *top, int satype)
2048 {
2049 	keysock_hello_ack_t *kha;
2050 	queue_t *oldq;
2051 
2052 	ASSERT(OTHERQ(q) != NULL);
2053 
2054 	/*
2055 	 * First, check atomically that I'm the first and only keysock
2056 	 * instance.
2057 	 *
2058 	 * Use OTHERQ(q), because qreply(q, mp) == putnext(OTHERQ(q), mp),
2059 	 * and I want this module to say putnext(*_pfkey_q, mp) for PF_KEY
2060 	 * messages.
2061 	 */
2062 
2063 	oldq = casptr((void **)pfkey_qp, NULL, OTHERQ(q));
2064 	if (oldq != NULL) {
2065 		ASSERT(oldq != q);
2066 		cmn_err(CE_WARN, "Danger!  Multiple keysocks on top of %s.\n",
2067 		    (satype == SADB_SATYPE_ESP)? "ESP" : "AH or other");
2068 		freemsg(mp);
2069 		return;
2070 	}
2071 
2072 	kha = (keysock_hello_ack_t *)mp->b_rptr;
2073 	kha->ks_hello_len = sizeof (keysock_hello_ack_t);
2074 	kha->ks_hello_type = KEYSOCK_HELLO_ACK;
2075 	kha->ks_hello_satype = (uint8_t)satype;
2076 
2077 	/*
2078 	 * If we made it past the casptr, then we have "exclusive" access
2079 	 * to the timeout handle.  Fire it off in 4 seconds, because it
2080 	 * just seems like a good interval.
2081 	 */
2082 	*top = qtimeout(*pfkey_qp, ager, agerarg, drv_usectohz(4000000));
2083 
2084 	putnext(*pfkey_qp, mp);
2085 }
2086 
2087 /*
2088  * Normalize IPv4-mapped IPv6 addresses (and prefixes) as appropriate.
2089  *
2090  * Check addresses themselves for wildcard or multicast.
2091  * Check ire table for local/non-local/broadcast.
2092  */
2093 int
2094 sadb_addrcheck(queue_t *pfkey_q, mblk_t *mp, sadb_ext_t *ext, uint_t serial,
2095     netstack_t *ns)
2096 {
2097 	sadb_address_t *addr = (sadb_address_t *)ext;
2098 	struct sockaddr_in *sin;
2099 	struct sockaddr_in6 *sin6;
2100 	ire_t *ire;
2101 	int diagnostic, type;
2102 	boolean_t normalized = B_FALSE;
2103 
2104 	ASSERT(ext != NULL);
2105 	ASSERT((ext->sadb_ext_type == SADB_EXT_ADDRESS_SRC) ||
2106 	    (ext->sadb_ext_type == SADB_EXT_ADDRESS_DST) ||
2107 	    (ext->sadb_ext_type == SADB_X_EXT_ADDRESS_INNER_SRC) ||
2108 	    (ext->sadb_ext_type == SADB_X_EXT_ADDRESS_INNER_DST) ||
2109 	    (ext->sadb_ext_type == SADB_X_EXT_ADDRESS_NATT_LOC) ||
2110 	    (ext->sadb_ext_type == SADB_X_EXT_ADDRESS_NATT_REM));
2111 
2112 	/* Assign both sockaddrs, the compiler will do the right thing. */
2113 	sin = (struct sockaddr_in *)(addr + 1);
2114 	sin6 = (struct sockaddr_in6 *)(addr + 1);
2115 
2116 	if (sin6->sin6_family == AF_INET6) {
2117 		if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
2118 			/*
2119 			 * Convert to an AF_INET sockaddr.  This means the
2120 			 * return messages will have the extra space, but have
2121 			 * AF_INET sockaddrs instead of AF_INET6.
2122 			 *
2123 			 * Yes, RFC 2367 isn't clear on what to do here w.r.t.
2124 			 * mapped addresses, but since AF_INET6 ::ffff:<v4> is
2125 			 * equal to AF_INET <v4>, it shouldnt be a huge
2126 			 * problem.
2127 			 */
2128 			sin->sin_family = AF_INET;
2129 			IN6_V4MAPPED_TO_INADDR(&sin6->sin6_addr,
2130 			    &sin->sin_addr);
2131 			bzero(&sin->sin_zero, sizeof (sin->sin_zero));
2132 			normalized = B_TRUE;
2133 		}
2134 	} else if (sin->sin_family != AF_INET) {
2135 		switch (ext->sadb_ext_type) {
2136 		case SADB_EXT_ADDRESS_SRC:
2137 			diagnostic = SADB_X_DIAGNOSTIC_BAD_SRC_AF;
2138 			break;
2139 		case SADB_EXT_ADDRESS_DST:
2140 			diagnostic = SADB_X_DIAGNOSTIC_BAD_DST_AF;
2141 			break;
2142 		case SADB_X_EXT_ADDRESS_INNER_SRC:
2143 			diagnostic = SADB_X_DIAGNOSTIC_BAD_PROXY_AF;
2144 			break;
2145 		case SADB_X_EXT_ADDRESS_INNER_DST:
2146 			diagnostic = SADB_X_DIAGNOSTIC_BAD_INNER_DST_AF;
2147 			break;
2148 		case SADB_X_EXT_ADDRESS_NATT_LOC:
2149 			diagnostic = SADB_X_DIAGNOSTIC_BAD_NATT_LOC_AF;
2150 			break;
2151 		case SADB_X_EXT_ADDRESS_NATT_REM:
2152 			diagnostic = SADB_X_DIAGNOSTIC_BAD_NATT_REM_AF;
2153 			break;
2154 			/* There is no default, see above ASSERT. */
2155 		}
2156 bail:
2157 		if (pfkey_q != NULL) {
2158 			sadb_pfkey_error(pfkey_q, mp, EINVAL, diagnostic,
2159 			    serial);
2160 		} else {
2161 			/*
2162 			 * Scribble in sadb_msg that we got passed in.
2163 			 * Overload "mp" to be an sadb_msg pointer.
2164 			 */
2165 			sadb_msg_t *samsg = (sadb_msg_t *)mp;
2166 
2167 			samsg->sadb_msg_errno = EINVAL;
2168 			samsg->sadb_x_msg_diagnostic = diagnostic;
2169 		}
2170 		return (KS_IN_ADDR_UNKNOWN);
2171 	}
2172 
2173 	if (ext->sadb_ext_type == SADB_X_EXT_ADDRESS_INNER_SRC ||
2174 	    ext->sadb_ext_type == SADB_X_EXT_ADDRESS_INNER_DST) {
2175 		/*
2176 		 * We need only check for prefix issues.
2177 		 */
2178 
2179 		/* Set diagnostic now, in case we need it later. */
2180 		diagnostic =
2181 		    (ext->sadb_ext_type == SADB_X_EXT_ADDRESS_INNER_SRC) ?
2182 		    SADB_X_DIAGNOSTIC_PREFIX_INNER_SRC :
2183 		    SADB_X_DIAGNOSTIC_PREFIX_INNER_DST;
2184 
2185 		if (normalized)
2186 			addr->sadb_address_prefixlen -= 96;
2187 
2188 		/*
2189 		 * Verify and mask out inner-addresses based on prefix length.
2190 		 */
2191 		if (sin->sin_family == AF_INET) {
2192 			if (addr->sadb_address_prefixlen > 32)
2193 				goto bail;
2194 			sin->sin_addr.s_addr &=
2195 			    ip_plen_to_mask(addr->sadb_address_prefixlen);
2196 		} else {
2197 			in6_addr_t mask;
2198 
2199 			ASSERT(sin->sin_family == AF_INET6);
2200 			/*
2201 			 * ip_plen_to_mask_v6() returns NULL if the value in
2202 			 * question is out of range.
2203 			 */
2204 			if (ip_plen_to_mask_v6(addr->sadb_address_prefixlen,
2205 			    &mask) == NULL)
2206 				goto bail;
2207 			sin6->sin6_addr.s6_addr32[0] &= mask.s6_addr32[0];
2208 			sin6->sin6_addr.s6_addr32[1] &= mask.s6_addr32[1];
2209 			sin6->sin6_addr.s6_addr32[2] &= mask.s6_addr32[2];
2210 			sin6->sin6_addr.s6_addr32[3] &= mask.s6_addr32[3];
2211 		}
2212 
2213 		/* We don't care in these cases. */
2214 		return (KS_IN_ADDR_DONTCARE);
2215 	}
2216 
2217 	if (sin->sin_family == AF_INET6) {
2218 		/* Check the easy ones now. */
2219 		if (IN6_IS_ADDR_MULTICAST(&sin6->sin6_addr))
2220 			return (KS_IN_ADDR_MBCAST);
2221 		if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
2222 			return (KS_IN_ADDR_UNSPEC);
2223 		/*
2224 		 * At this point, we're a unicast IPv6 address.
2225 		 *
2226 		 * A ctable lookup for local is sufficient here.  If we're
2227 		 * local, return KS_IN_ADDR_ME, otherwise KS_IN_ADDR_NOTME.
2228 		 *
2229 		 * XXX Zones alert -> me/notme decision needs to be tempered
2230 		 * by what zone we're in when we go to zone-aware IPsec.
2231 		 */
2232 		ire = ire_ctable_lookup_v6(&sin6->sin6_addr, NULL,
2233 		    IRE_LOCAL, NULL, ALL_ZONES, NULL, MATCH_IRE_TYPE,
2234 		    ns->netstack_ip);
2235 		if (ire != NULL) {
2236 			/* Hey hey, it's local. */
2237 			IRE_REFRELE(ire);
2238 			return (KS_IN_ADDR_ME);
2239 		}
2240 	} else {
2241 		ASSERT(sin->sin_family == AF_INET);
2242 		if (sin->sin_addr.s_addr == INADDR_ANY)
2243 			return (KS_IN_ADDR_UNSPEC);
2244 		if (CLASSD(sin->sin_addr.s_addr))
2245 			return (KS_IN_ADDR_MBCAST);
2246 		/*
2247 		 * At this point we're a unicast or broadcast IPv4 address.
2248 		 *
2249 		 * Lookup on the ctable for IRE_BROADCAST or IRE_LOCAL.
2250 		 * A NULL return value is NOTME, otherwise, look at the
2251 		 * returned ire for broadcast or not and return accordingly.
2252 		 *
2253 		 * XXX Zones alert -> me/notme decision needs to be tempered
2254 		 * by what zone we're in when we go to zone-aware IPsec.
2255 		 */
2256 		ire = ire_ctable_lookup(sin->sin_addr.s_addr, 0,
2257 		    IRE_LOCAL | IRE_BROADCAST, NULL, ALL_ZONES, NULL,
2258 		    MATCH_IRE_TYPE, ns->netstack_ip);
2259 		if (ire != NULL) {
2260 			/* Check for local or broadcast */
2261 			type = ire->ire_type;
2262 			IRE_REFRELE(ire);
2263 			ASSERT(type == IRE_LOCAL || type == IRE_BROADCAST);
2264 			return ((type == IRE_LOCAL) ? KS_IN_ADDR_ME :
2265 			    KS_IN_ADDR_MBCAST);
2266 		}
2267 	}
2268 
2269 	return (KS_IN_ADDR_NOTME);
2270 }
2271 
2272 /*
2273  * Address normalizations and reality checks for inbound PF_KEY messages.
2274  *
2275  * For the case of src == unspecified AF_INET6, and dst == AF_INET, convert
2276  * the source to AF_INET.  Do the same for the inner sources.
2277  */
2278 boolean_t
2279 sadb_addrfix(keysock_in_t *ksi, queue_t *pfkey_q, mblk_t *mp, netstack_t *ns)
2280 {
2281 	struct sockaddr_in *src, *isrc;
2282 	struct sockaddr_in6 *dst, *idst;
2283 	sadb_address_t *srcext, *dstext;
2284 	uint16_t sport;
2285 	sadb_ext_t **extv = ksi->ks_in_extv;
2286 	int rc;
2287 
2288 	if (extv[SADB_EXT_ADDRESS_SRC] != NULL) {
2289 		rc = sadb_addrcheck(pfkey_q, mp, extv[SADB_EXT_ADDRESS_SRC],
2290 		    ksi->ks_in_serial, ns);
2291 		if (rc == KS_IN_ADDR_UNKNOWN)
2292 			return (B_FALSE);
2293 		if (rc == KS_IN_ADDR_MBCAST) {
2294 			sadb_pfkey_error(pfkey_q, mp, EINVAL,
2295 			    SADB_X_DIAGNOSTIC_BAD_SRC, ksi->ks_in_serial);
2296 			return (B_FALSE);
2297 		}
2298 		ksi->ks_in_srctype = rc;
2299 	}
2300 
2301 	if (extv[SADB_EXT_ADDRESS_DST] != NULL) {
2302 		rc = sadb_addrcheck(pfkey_q, mp, extv[SADB_EXT_ADDRESS_DST],
2303 		    ksi->ks_in_serial, ns);
2304 		if (rc == KS_IN_ADDR_UNKNOWN)
2305 			return (B_FALSE);
2306 		if (rc == KS_IN_ADDR_UNSPEC) {
2307 			sadb_pfkey_error(pfkey_q, mp, EINVAL,
2308 			    SADB_X_DIAGNOSTIC_BAD_DST, ksi->ks_in_serial);
2309 			return (B_FALSE);
2310 		}
2311 		ksi->ks_in_dsttype = rc;
2312 	}
2313 
2314 	/*
2315 	 * NAT-Traversal addrs are simple enough to not require all of
2316 	 * the checks in sadb_addrcheck().  Just normalize or reject if not
2317 	 * AF_INET.
2318 	 */
2319 	if (extv[SADB_X_EXT_ADDRESS_NATT_LOC] != NULL) {
2320 		rc = sadb_addrcheck(pfkey_q, mp,
2321 		    extv[SADB_X_EXT_ADDRESS_NATT_LOC], ksi->ks_in_serial, ns);
2322 
2323 		/*
2324 		 * Local NAT-T addresses never use an IRE_LOCAL, so it should
2325 		 * always be NOTME, or UNSPEC (to handle both tunnel mode
2326 		 * AND local-port flexibility).
2327 		 */
2328 		if (rc != KS_IN_ADDR_NOTME && rc != KS_IN_ADDR_UNSPEC) {
2329 			sadb_pfkey_error(pfkey_q, mp, EINVAL,
2330 			    SADB_X_DIAGNOSTIC_MALFORMED_NATT_LOC,
2331 			    ksi->ks_in_serial);
2332 			return (B_FALSE);
2333 		}
2334 		src = (struct sockaddr_in *)
2335 		    (((sadb_address_t *)extv[SADB_X_EXT_ADDRESS_NATT_LOC]) + 1);
2336 		if (src->sin_family != AF_INET) {
2337 			sadb_pfkey_error(pfkey_q, mp, EINVAL,
2338 			    SADB_X_DIAGNOSTIC_BAD_NATT_LOC_AF,
2339 			    ksi->ks_in_serial);
2340 			return (B_FALSE);
2341 		}
2342 	}
2343 
2344 	if (extv[SADB_X_EXT_ADDRESS_NATT_REM] != NULL) {
2345 		rc = sadb_addrcheck(pfkey_q, mp,
2346 		    extv[SADB_X_EXT_ADDRESS_NATT_REM], ksi->ks_in_serial, ns);
2347 
2348 		/*
2349 		 * Remote NAT-T addresses never use an IRE_LOCAL, so it should
2350 		 * always be NOTME, or UNSPEC if it's a tunnel-mode SA.
2351 		 */
2352 		if (rc != KS_IN_ADDR_NOTME &&
2353 		    !(extv[SADB_X_EXT_ADDRESS_INNER_SRC] != NULL &&
2354 		    rc == KS_IN_ADDR_UNSPEC)) {
2355 			sadb_pfkey_error(pfkey_q, mp, EINVAL,
2356 			    SADB_X_DIAGNOSTIC_MALFORMED_NATT_REM,
2357 			    ksi->ks_in_serial);
2358 			return (B_FALSE);
2359 		}
2360 		src = (struct sockaddr_in *)
2361 		    (((sadb_address_t *)extv[SADB_X_EXT_ADDRESS_NATT_REM]) + 1);
2362 		if (src->sin_family != AF_INET) {
2363 			sadb_pfkey_error(pfkey_q, mp, EINVAL,
2364 			    SADB_X_DIAGNOSTIC_BAD_NATT_REM_AF,
2365 			    ksi->ks_in_serial);
2366 			return (B_FALSE);
2367 		}
2368 	}
2369 
2370 	if (extv[SADB_X_EXT_ADDRESS_INNER_SRC] != NULL) {
2371 		if (extv[SADB_X_EXT_ADDRESS_INNER_DST] == NULL) {
2372 			sadb_pfkey_error(pfkey_q, mp, EINVAL,
2373 			    SADB_X_DIAGNOSTIC_MISSING_INNER_DST,
2374 			    ksi->ks_in_serial);
2375 			return (B_FALSE);
2376 		}
2377 
2378 		if (sadb_addrcheck(pfkey_q, mp,
2379 		    extv[SADB_X_EXT_ADDRESS_INNER_DST], ksi->ks_in_serial, ns)
2380 		    == KS_IN_ADDR_UNKNOWN ||
2381 		    sadb_addrcheck(pfkey_q, mp,
2382 		    extv[SADB_X_EXT_ADDRESS_INNER_SRC], ksi->ks_in_serial, ns)
2383 		    == KS_IN_ADDR_UNKNOWN)
2384 			return (B_FALSE);
2385 
2386 		isrc = (struct sockaddr_in *)
2387 		    (((sadb_address_t *)extv[SADB_X_EXT_ADDRESS_INNER_SRC]) +
2388 		    1);
2389 		idst = (struct sockaddr_in6 *)
2390 		    (((sadb_address_t *)extv[SADB_X_EXT_ADDRESS_INNER_DST]) +
2391 		    1);
2392 		if (isrc->sin_family != idst->sin6_family) {
2393 			sadb_pfkey_error(pfkey_q, mp, EINVAL,
2394 			    SADB_X_DIAGNOSTIC_INNER_AF_MISMATCH,
2395 			    ksi->ks_in_serial);
2396 			return (B_FALSE);
2397 		}
2398 	} else if (extv[SADB_X_EXT_ADDRESS_INNER_DST] != NULL) {
2399 			sadb_pfkey_error(pfkey_q, mp, EINVAL,
2400 			    SADB_X_DIAGNOSTIC_MISSING_INNER_SRC,
2401 			    ksi->ks_in_serial);
2402 			return (B_FALSE);
2403 	} else {
2404 		isrc = NULL;	/* For inner/outer port check below. */
2405 	}
2406 
2407 	dstext = (sadb_address_t *)extv[SADB_EXT_ADDRESS_DST];
2408 	srcext = (sadb_address_t *)extv[SADB_EXT_ADDRESS_SRC];
2409 
2410 	if (dstext == NULL || srcext == NULL)
2411 		return (B_TRUE);
2412 
2413 	dst = (struct sockaddr_in6 *)(dstext + 1);
2414 	src = (struct sockaddr_in *)(srcext + 1);
2415 
2416 	if (isrc != NULL &&
2417 	    (isrc->sin_port != 0 || idst->sin6_port != 0) &&
2418 	    (src->sin_port != 0 || dst->sin6_port != 0)) {
2419 		/* Can't set inner and outer ports in one SA. */
2420 		sadb_pfkey_error(pfkey_q, mp, EINVAL,
2421 		    SADB_X_DIAGNOSTIC_DUAL_PORT_SETS,
2422 		    ksi->ks_in_serial);
2423 		return (B_FALSE);
2424 	}
2425 
2426 	if (dst->sin6_family == src->sin_family)
2427 		return (B_TRUE);
2428 
2429 	if (srcext->sadb_address_proto != dstext->sadb_address_proto) {
2430 		if (srcext->sadb_address_proto == 0) {
2431 			srcext->sadb_address_proto = dstext->sadb_address_proto;
2432 		} else if (dstext->sadb_address_proto == 0) {
2433 			dstext->sadb_address_proto = srcext->sadb_address_proto;
2434 		} else {
2435 			/* Inequal protocols, neither were 0.  Report error. */
2436 			sadb_pfkey_error(pfkey_q, mp, EINVAL,
2437 			    SADB_X_DIAGNOSTIC_PROTO_MISMATCH,
2438 			    ksi->ks_in_serial);
2439 			return (B_FALSE);
2440 		}
2441 	}
2442 
2443 	/*
2444 	 * With the exception of an unspec IPv6 source and an IPv4
2445 	 * destination, address families MUST me matched.
2446 	 */
2447 	if (src->sin_family == AF_INET ||
2448 	    ksi->ks_in_srctype != KS_IN_ADDR_UNSPEC) {
2449 		sadb_pfkey_error(pfkey_q, mp, EINVAL,
2450 		    SADB_X_DIAGNOSTIC_AF_MISMATCH, ksi->ks_in_serial);
2451 		return (B_FALSE);
2452 	}
2453 
2454 	/*
2455 	 * Convert "src" to AF_INET INADDR_ANY.  We rely on sin_port being
2456 	 * in the same place for sockaddr_in and sockaddr_in6.
2457 	 */
2458 	sport = src->sin_port;
2459 	bzero(src, sizeof (*src));
2460 	src->sin_family = AF_INET;
2461 	src->sin_port = sport;
2462 
2463 	return (B_TRUE);
2464 }
2465 
2466 /*
2467  * Set the results in "addrtype", given an IRE as requested by
2468  * sadb_addrcheck().
2469  */
2470 int
2471 sadb_addrset(ire_t *ire)
2472 {
2473 	if ((ire->ire_type & IRE_BROADCAST) ||
2474 	    (ire->ire_ipversion == IPV4_VERSION && CLASSD(ire->ire_addr)) ||
2475 	    (ire->ire_ipversion == IPV6_VERSION &&
2476 	    IN6_IS_ADDR_MULTICAST(&(ire->ire_addr_v6))))
2477 		return (KS_IN_ADDR_MBCAST);
2478 	if (ire->ire_type & (IRE_LOCAL | IRE_LOOPBACK))
2479 		return (KS_IN_ADDR_ME);
2480 	return (KS_IN_ADDR_NOTME);
2481 }
2482 
2483 
2484 /*
2485  * Walker callback function to delete sa's based on src/dst address.
2486  * Assumes that we're called with *head locked, no other locks held;
2487  * Conveniently, and not coincidentally, this is both what sadb_walker
2488  * gives us and also what sadb_unlinkassoc expects.
2489  */
2490 
2491 struct sadb_purge_state
2492 {
2493 	uint32_t *src;
2494 	uint32_t *dst;
2495 	sa_family_t af;
2496 	boolean_t inbnd;
2497 	char *sidstr;
2498 	char *didstr;
2499 	uint16_t sidtype;
2500 	uint16_t didtype;
2501 	uint32_t kmproto;
2502 	uint8_t sadb_sa_state;
2503 	mblk_t *mq;
2504 	sadb_t *sp;
2505 };
2506 
2507 static void
2508 sadb_purge_cb(isaf_t *head, ipsa_t *entry, void *cookie)
2509 {
2510 	struct sadb_purge_state *ps = (struct sadb_purge_state *)cookie;
2511 
2512 	ASSERT(MUTEX_HELD(&head->isaf_lock));
2513 
2514 	mutex_enter(&entry->ipsa_lock);
2515 
2516 	if ((entry->ipsa_state == IPSA_STATE_LARVAL) ||
2517 	    (ps->src != NULL &&
2518 	    !IPSA_ARE_ADDR_EQUAL(entry->ipsa_srcaddr, ps->src, ps->af)) ||
2519 	    (ps->dst != NULL &&
2520 	    !IPSA_ARE_ADDR_EQUAL(entry->ipsa_dstaddr, ps->dst, ps->af)) ||
2521 	    (ps->didstr != NULL && (entry->ipsa_dst_cid != NULL) &&
2522 	    !(ps->didtype == entry->ipsa_dst_cid->ipsid_type &&
2523 	    strcmp(ps->didstr, entry->ipsa_dst_cid->ipsid_cid) == 0)) ||
2524 	    (ps->sidstr != NULL && (entry->ipsa_src_cid != NULL) &&
2525 	    !(ps->sidtype == entry->ipsa_src_cid->ipsid_type &&
2526 	    strcmp(ps->sidstr, entry->ipsa_src_cid->ipsid_cid) == 0)) ||
2527 	    (ps->kmproto <= SADB_X_KMP_MAX && ps->kmproto != entry->ipsa_kmp)) {
2528 		mutex_exit(&entry->ipsa_lock);
2529 		return;
2530 	}
2531 
2532 	if (ps->inbnd) {
2533 		sadb_delete_cluster(entry);
2534 	}
2535 	entry->ipsa_state = IPSA_STATE_DEAD;
2536 	(void) sadb_torch_assoc(head, entry, ps->inbnd, &ps->mq);
2537 }
2538 
2539 /*
2540  * Common code to purge an SA with a matching src or dst address.
2541  * Don't kill larval SA's in such a purge.
2542  */
2543 int
2544 sadb_purge_sa(mblk_t *mp, keysock_in_t *ksi, sadb_t *sp, queue_t *pfkey_q,
2545     queue_t *ip_q)
2546 {
2547 	sadb_address_t *dstext =
2548 	    (sadb_address_t *)ksi->ks_in_extv[SADB_EXT_ADDRESS_DST];
2549 	sadb_address_t *srcext =
2550 	    (sadb_address_t *)ksi->ks_in_extv[SADB_EXT_ADDRESS_SRC];
2551 	sadb_ident_t *dstid =
2552 	    (sadb_ident_t *)ksi->ks_in_extv[SADB_EXT_IDENTITY_DST];
2553 	sadb_ident_t *srcid =
2554 	    (sadb_ident_t *)ksi->ks_in_extv[SADB_EXT_IDENTITY_SRC];
2555 	sadb_x_kmc_t *kmc =
2556 	    (sadb_x_kmc_t *)ksi->ks_in_extv[SADB_X_EXT_KM_COOKIE];
2557 	struct sockaddr_in *src, *dst;
2558 	struct sockaddr_in6 *src6, *dst6;
2559 	struct sadb_purge_state ps;
2560 
2561 	/*
2562 	 * Don't worry about IPv6 v4-mapped addresses, sadb_addrcheck()
2563 	 * takes care of them.
2564 	 */
2565 
2566 	/* enforced by caller */
2567 	ASSERT((dstext != NULL) || (srcext != NULL));
2568 
2569 	ps.src = NULL;
2570 	ps.dst = NULL;
2571 #ifdef DEBUG
2572 	ps.af = (sa_family_t)-1;
2573 #endif
2574 	ps.mq = NULL;
2575 	ps.sidstr = NULL;
2576 	ps.didstr = NULL;
2577 	ps.kmproto = SADB_X_KMP_MAX + 1;
2578 
2579 	if (dstext != NULL) {
2580 		dst = (struct sockaddr_in *)(dstext + 1);
2581 		ps.af = dst->sin_family;
2582 		if (dst->sin_family == AF_INET6) {
2583 			dst6 = (struct sockaddr_in6 *)dst;
2584 			ps.dst = (uint32_t *)&dst6->sin6_addr;
2585 		} else {
2586 			ps.dst = (uint32_t *)&dst->sin_addr;
2587 		}
2588 	}
2589 
2590 	if (srcext != NULL) {
2591 		src = (struct sockaddr_in *)(srcext + 1);
2592 		ps.af = src->sin_family;
2593 		if (src->sin_family == AF_INET6) {
2594 			src6 = (struct sockaddr_in6 *)(srcext + 1);
2595 			ps.src = (uint32_t *)&src6->sin6_addr;
2596 		} else {
2597 			ps.src = (uint32_t *)&src->sin_addr;
2598 		}
2599 		ASSERT(dstext == NULL || src->sin_family == dst->sin_family);
2600 	}
2601 
2602 	ASSERT(ps.af != (sa_family_t)-1);
2603 
2604 	if (dstid != NULL) {
2605 		/*
2606 		 * NOTE:  May need to copy string in the future
2607 		 * if the inbound keysock message disappears for some strange
2608 		 * reason.
2609 		 */
2610 		ps.didstr = (char *)(dstid + 1);
2611 		ps.didtype = dstid->sadb_ident_type;
2612 	}
2613 
2614 	if (srcid != NULL) {
2615 		/*
2616 		 * NOTE:  May need to copy string in the future
2617 		 * if the inbound keysock message disappears for some strange
2618 		 * reason.
2619 		 */
2620 		ps.sidstr = (char *)(srcid + 1);
2621 		ps.sidtype = srcid->sadb_ident_type;
2622 	}
2623 
2624 	if (kmc != NULL)
2625 		ps.kmproto = kmc->sadb_x_kmc_proto;
2626 
2627 	/*
2628 	 * This is simple, crude, and effective.
2629 	 * Unimplemented optimizations (TBD):
2630 	 * - we can limit how many places we search based on where we
2631 	 * think the SA is filed.
2632 	 * - if we get a dst address, we can hash based on dst addr to find
2633 	 * the correct bucket in the outbound table.
2634 	 */
2635 	ps.inbnd = B_TRUE;
2636 	sadb_walker(sp->sdb_if, sp->sdb_hashsize, sadb_purge_cb, &ps);
2637 	ps.inbnd = B_FALSE;
2638 	sadb_walker(sp->sdb_of, sp->sdb_hashsize, sadb_purge_cb, &ps);
2639 
2640 	if (ps.mq != NULL)
2641 		sadb_drain_torchq(ip_q, ps.mq);
2642 
2643 	ASSERT(mp->b_cont != NULL);
2644 	sadb_pfkey_echo(pfkey_q, mp, (sadb_msg_t *)mp->b_cont->b_rptr, ksi,
2645 	    NULL);
2646 	return (0);
2647 }
2648 
2649 static void
2650 sadb_delpair_state(isaf_t *head, ipsa_t *entry, void *cookie)
2651 {
2652 	struct sadb_purge_state *ps = (struct sadb_purge_state *)cookie;
2653 	isaf_t  *inbound_bucket;
2654 	ipsa_t *peer_assoc;
2655 
2656 	ASSERT(MUTEX_HELD(&head->isaf_lock));
2657 
2658 	mutex_enter(&entry->ipsa_lock);
2659 
2660 	if ((entry->ipsa_state != ps->sadb_sa_state) ||
2661 	    ((ps->src != NULL) &&
2662 	    !IPSA_ARE_ADDR_EQUAL(entry->ipsa_srcaddr, ps->src, ps->af))) {
2663 		mutex_exit(&entry->ipsa_lock);
2664 		return;
2665 	}
2666 
2667 	/*
2668 	 * The isaf_t *, which is passed in , is always an outbound bucket,
2669 	 * and we are preserving the outbound-then-inbound hash-bucket lock
2670 	 * ordering. The sadb_walker() which triggers this function is called
2671 	 * only on the outbound fanout, and the corresponding inbound bucket
2672 	 * lock is safe to acquire here.
2673 	 */
2674 
2675 	if (entry->ipsa_haspeer) {
2676 		inbound_bucket = INBOUND_BUCKET(ps->sp, entry->ipsa_spi);
2677 		mutex_enter(&inbound_bucket->isaf_lock);
2678 		peer_assoc = ipsec_getassocbyspi(inbound_bucket,
2679 		    entry->ipsa_spi, entry->ipsa_srcaddr,
2680 		    entry->ipsa_dstaddr, entry->ipsa_addrfam);
2681 	} else {
2682 		inbound_bucket = INBOUND_BUCKET(ps->sp, entry->ipsa_otherspi);
2683 		mutex_enter(&inbound_bucket->isaf_lock);
2684 		peer_assoc = ipsec_getassocbyspi(inbound_bucket,
2685 		    entry->ipsa_otherspi, entry->ipsa_dstaddr,
2686 		    entry->ipsa_srcaddr, entry->ipsa_addrfam);
2687 	}
2688 
2689 	entry->ipsa_state = IPSA_STATE_DEAD;
2690 	(void) sadb_torch_assoc(head, entry, B_FALSE, &ps->mq);
2691 	if (peer_assoc != NULL) {
2692 		mutex_enter(&peer_assoc->ipsa_lock);
2693 		peer_assoc->ipsa_state = IPSA_STATE_DEAD;
2694 		(void) sadb_torch_assoc(inbound_bucket, peer_assoc,
2695 		    B_FALSE, &ps->mq);
2696 	}
2697 	mutex_exit(&inbound_bucket->isaf_lock);
2698 }
2699 
2700 /*
2701  * Common code to delete/get an SA.
2702  */
2703 int
2704 sadb_delget_sa(mblk_t *mp, keysock_in_t *ksi, sadbp_t *spp,
2705     int *diagnostic, queue_t *pfkey_q, uint8_t sadb_msg_type)
2706 {
2707 	sadb_sa_t *assoc = (sadb_sa_t *)ksi->ks_in_extv[SADB_EXT_SA];
2708 	sadb_address_t *srcext =
2709 	    (sadb_address_t *)ksi->ks_in_extv[SADB_EXT_ADDRESS_SRC];
2710 	sadb_address_t *dstext =
2711 	    (sadb_address_t *)ksi->ks_in_extv[SADB_EXT_ADDRESS_DST];
2712 	ipsa_t *echo_target = NULL;
2713 	ipsap_t *ipsapp;
2714 	mblk_t *torchq = NULL;
2715 	uint_t	error = 0;
2716 
2717 	if (assoc == NULL) {
2718 		*diagnostic = SADB_X_DIAGNOSTIC_MISSING_SA;
2719 		return (EINVAL);
2720 	}
2721 
2722 	if (sadb_msg_type == SADB_X_DELPAIR_STATE) {
2723 		struct sockaddr_in *src;
2724 		struct sockaddr_in6 *src6;
2725 		struct sadb_purge_state ps;
2726 
2727 		if (srcext == NULL) {
2728 			*diagnostic = SADB_X_DIAGNOSTIC_MISSING_SRC;
2729 			return (EINVAL);
2730 		}
2731 		ps.src = NULL;
2732 		ps.mq = NULL;
2733 		src = (struct sockaddr_in *)(srcext + 1);
2734 		ps.af = src->sin_family;
2735 		if (src->sin_family == AF_INET6) {
2736 			src6 = (struct sockaddr_in6 *)(srcext + 1);
2737 			ps.src = (uint32_t *)&src6->sin6_addr;
2738 			ps.sp = &spp->s_v6;
2739 		} else {
2740 			ps.src = (uint32_t *)&src->sin_addr;
2741 			ps.sp = &spp->s_v4;
2742 		}
2743 		ps.inbnd = B_FALSE;
2744 		ps.sadb_sa_state = assoc->sadb_sa_state;
2745 		sadb_walker(ps.sp->sdb_of, ps.sp->sdb_hashsize,
2746 		    sadb_delpair_state, &ps);
2747 
2748 		if (ps.mq != NULL)
2749 			sadb_drain_torchq(pfkey_q, ps.mq);
2750 
2751 		ASSERT(mp->b_cont != NULL);
2752 		sadb_pfkey_echo(pfkey_q, mp, (sadb_msg_t *)mp->b_cont->b_rptr,
2753 		    ksi, NULL);
2754 		return (0);
2755 	}
2756 
2757 	if (dstext == NULL) {
2758 		*diagnostic = SADB_X_DIAGNOSTIC_MISSING_DST;
2759 		return (EINVAL);
2760 	}
2761 
2762 	ipsapp = get_ipsa_pair(assoc, srcext, dstext, spp);
2763 	if (ipsapp == NULL) {
2764 		*diagnostic = SADB_X_DIAGNOSTIC_SA_NOTFOUND;
2765 		return (ESRCH);
2766 	}
2767 
2768 	echo_target = ipsapp->ipsap_sa_ptr;
2769 	if (echo_target == NULL)
2770 		echo_target = ipsapp->ipsap_psa_ptr;
2771 
2772 	if (sadb_msg_type == SADB_DELETE || sadb_msg_type == SADB_X_DELPAIR) {
2773 		/*
2774 		 * Bucket locks will be required if SA is actually unlinked.
2775 		 * get_ipsa_pair() returns valid hash bucket pointers even
2776 		 * if it can't find a pair SA pointer.
2777 		 */
2778 		mutex_enter(&ipsapp->ipsap_bucket->isaf_lock);
2779 		mutex_enter(&ipsapp->ipsap_pbucket->isaf_lock);
2780 
2781 		if (ipsapp->ipsap_sa_ptr != NULL) {
2782 			mutex_enter(&ipsapp->ipsap_sa_ptr->ipsa_lock);
2783 			if (ipsapp->ipsap_sa_ptr->ipsa_flags & IPSA_F_INBOUND) {
2784 				sadb_delete_cluster(ipsapp->ipsap_sa_ptr);
2785 			}
2786 			ipsapp->ipsap_sa_ptr->ipsa_state = IPSA_STATE_DEAD;
2787 			(void) sadb_torch_assoc(ipsapp->ipsap_bucket,
2788 			    ipsapp->ipsap_sa_ptr, B_FALSE, &torchq);
2789 			/*
2790 			 * sadb_torch_assoc() releases the ipsa_lock
2791 			 * and calls sadb_unlinkassoc() which does a
2792 			 * IPSA_REFRELE.
2793 			 */
2794 		}
2795 		if (ipsapp->ipsap_psa_ptr != NULL) {
2796 			mutex_enter(&ipsapp->ipsap_psa_ptr->ipsa_lock);
2797 			if (sadb_msg_type == SADB_X_DELPAIR ||
2798 			    ipsapp->ipsap_psa_ptr->ipsa_haspeer) {
2799 				if (ipsapp->ipsap_psa_ptr->ipsa_flags &
2800 				    IPSA_F_INBOUND) {
2801 					sadb_delete_cluster(
2802 					    ipsapp->ipsap_psa_ptr);
2803 				}
2804 				ipsapp->ipsap_psa_ptr->ipsa_state =
2805 				    IPSA_STATE_DEAD;
2806 				(void) sadb_torch_assoc(ipsapp->ipsap_pbucket,
2807 				    ipsapp->ipsap_psa_ptr, B_FALSE, &torchq);
2808 			} else {
2809 				/*
2810 				 * Only half of the "pair" has been deleted.
2811 				 * Update the remaining SA and remove references
2812 				 * to its pair SA, which is now gone.
2813 				 */
2814 				ipsapp->ipsap_psa_ptr->ipsa_otherspi = 0;
2815 				ipsapp->ipsap_psa_ptr->ipsa_flags &=
2816 				    ~IPSA_F_PAIRED;
2817 				mutex_exit(&ipsapp->ipsap_psa_ptr->ipsa_lock);
2818 			}
2819 		} else if (sadb_msg_type == SADB_X_DELPAIR) {
2820 			*diagnostic = SADB_X_DIAGNOSTIC_PAIR_SA_NOTFOUND;
2821 			error = ESRCH;
2822 		}
2823 		mutex_exit(&ipsapp->ipsap_bucket->isaf_lock);
2824 		mutex_exit(&ipsapp->ipsap_pbucket->isaf_lock);
2825 	}
2826 
2827 	if (torchq != NULL)
2828 		sadb_drain_torchq(spp->s_ip_q, torchq);
2829 
2830 	ASSERT(mp->b_cont != NULL);
2831 
2832 	if (error == 0)
2833 		sadb_pfkey_echo(pfkey_q, mp, (sadb_msg_t *)
2834 		    mp->b_cont->b_rptr, ksi, echo_target);
2835 
2836 	destroy_ipsa_pair(ipsapp);
2837 
2838 	return (error);
2839 }
2840 
2841 /*
2842  * This function takes a sadb_sa_t and finds the ipsa_t structure
2843  * and the isaf_t (hash bucket) that its stored under. If the security
2844  * association has a peer, the ipsa_t structure and bucket for that security
2845  * association are also searched for. The "pair" of ipsa_t's and isaf_t's
2846  * are returned as a ipsap_t.
2847  *
2848  * Note that a "pair" is defined as one (but not both) of the following:
2849  *
2850  * A security association which has a soft reference to another security
2851  * association via its SPI.
2852  *
2853  * A security association that is not obviously "inbound" or "outbound" so
2854  * it appears in both hash tables, the "peer" being the same security
2855  * association in the other hash table.
2856  *
2857  * This function will return NULL if the ipsa_t can't be found in the
2858  * inbound or outbound  hash tables (not found). If only one ipsa_t is
2859  * found, the pair ipsa_t will be NULL. Both isaf_t values are valid
2860  * provided at least one ipsa_t is found.
2861  */
2862 ipsap_t *
2863 get_ipsa_pair(sadb_sa_t *assoc, sadb_address_t *srcext, sadb_address_t *dstext,
2864     sadbp_t *spp)
2865 {
2866 	struct sockaddr_in *src, *dst;
2867 	struct sockaddr_in6 *src6, *dst6;
2868 	sadb_t *sp;
2869 	uint32_t *srcaddr, *dstaddr;
2870 	isaf_t *outbound_bucket, *inbound_bucket;
2871 	boolean_t in_inbound_table = B_FALSE;
2872 	ipsap_t *ipsapp;
2873 	sa_family_t af;
2874 
2875 	uint32_t pair_srcaddr[IPSA_MAX_ADDRLEN];
2876 	uint32_t pair_dstaddr[IPSA_MAX_ADDRLEN];
2877 	uint32_t pair_spi;
2878 
2879 	ipsapp = kmem_zalloc(sizeof (*ipsapp), KM_NOSLEEP);
2880 	if (ipsapp == NULL)
2881 		return (NULL);
2882 
2883 	/*
2884 	 * Don't worry about IPv6 v4-mapped addresses, sadb_addrcheck()
2885 	 * takes care of them.
2886 	 */
2887 
2888 	dst = (struct sockaddr_in *)(dstext + 1);
2889 	af = dst->sin_family;
2890 	if (af == AF_INET6) {
2891 		sp = &spp->s_v6;
2892 		dst6 = (struct sockaddr_in6 *)dst;
2893 		dstaddr = (uint32_t *)&dst6->sin6_addr;
2894 		if (srcext != NULL) {
2895 			src6 = (struct sockaddr_in6 *)(srcext + 1);
2896 			srcaddr = (uint32_t *)&src6->sin6_addr;
2897 			ASSERT(src6->sin6_family == af);
2898 			ASSERT(src6->sin6_family == AF_INET6);
2899 		} else {
2900 			srcaddr = ALL_ZEROES_PTR;
2901 		}
2902 		outbound_bucket = OUTBOUND_BUCKET_V6(sp,
2903 		    *(uint32_t *)dstaddr);
2904 	} else {
2905 		sp = &spp->s_v4;
2906 		dstaddr = (uint32_t *)&dst->sin_addr;
2907 		if (srcext != NULL) {
2908 			src = (struct sockaddr_in *)(srcext + 1);
2909 			srcaddr = (uint32_t *)&src->sin_addr;
2910 			ASSERT(src->sin_family == af);
2911 			ASSERT(src->sin_family == AF_INET);
2912 		} else {
2913 			srcaddr = ALL_ZEROES_PTR;
2914 		}
2915 		outbound_bucket = OUTBOUND_BUCKET_V4(sp,
2916 		    *(uint32_t *)dstaddr);
2917 	}
2918 
2919 	inbound_bucket = INBOUND_BUCKET(sp, assoc->sadb_sa_spi);
2920 
2921 	/* Lock down both buckets. */
2922 	mutex_enter(&outbound_bucket->isaf_lock);
2923 	mutex_enter(&inbound_bucket->isaf_lock);
2924 
2925 	if (assoc->sadb_sa_flags & IPSA_F_INBOUND) {
2926 		ipsapp->ipsap_sa_ptr = ipsec_getassocbyspi(inbound_bucket,
2927 		    assoc->sadb_sa_spi, srcaddr, dstaddr, af);
2928 		if (ipsapp->ipsap_sa_ptr != NULL) {
2929 			ipsapp->ipsap_bucket = inbound_bucket;
2930 			ipsapp->ipsap_pbucket = outbound_bucket;
2931 			in_inbound_table = B_TRUE;
2932 		} else {
2933 			ipsapp->ipsap_sa_ptr =
2934 			    ipsec_getassocbyspi(outbound_bucket,
2935 			    assoc->sadb_sa_spi, srcaddr, dstaddr, af);
2936 			ipsapp->ipsap_bucket = outbound_bucket;
2937 			ipsapp->ipsap_pbucket = inbound_bucket;
2938 		}
2939 	} else {
2940 		/* IPSA_F_OUTBOUND is set *or* no directions flags set. */
2941 		ipsapp->ipsap_sa_ptr =
2942 		    ipsec_getassocbyspi(outbound_bucket,
2943 		    assoc->sadb_sa_spi, srcaddr, dstaddr, af);
2944 		if (ipsapp->ipsap_sa_ptr != NULL) {
2945 			ipsapp->ipsap_bucket = outbound_bucket;
2946 			ipsapp->ipsap_pbucket = inbound_bucket;
2947 		} else {
2948 			ipsapp->ipsap_sa_ptr =
2949 			    ipsec_getassocbyspi(inbound_bucket,
2950 			    assoc->sadb_sa_spi, srcaddr, dstaddr, af);
2951 			ipsapp->ipsap_bucket = inbound_bucket;
2952 			ipsapp->ipsap_pbucket = outbound_bucket;
2953 			if (ipsapp->ipsap_sa_ptr != NULL)
2954 				in_inbound_table = B_TRUE;
2955 		}
2956 	}
2957 
2958 	if (ipsapp->ipsap_sa_ptr == NULL) {
2959 		mutex_exit(&outbound_bucket->isaf_lock);
2960 		mutex_exit(&inbound_bucket->isaf_lock);
2961 		kmem_free(ipsapp, sizeof (*ipsapp));
2962 		return (NULL);
2963 	}
2964 
2965 	if ((ipsapp->ipsap_sa_ptr->ipsa_state == IPSA_STATE_LARVAL) &&
2966 	    in_inbound_table) {
2967 		mutex_exit(&outbound_bucket->isaf_lock);
2968 		mutex_exit(&inbound_bucket->isaf_lock);
2969 		return (ipsapp);
2970 	}
2971 
2972 	mutex_enter(&ipsapp->ipsap_sa_ptr->ipsa_lock);
2973 	if (ipsapp->ipsap_sa_ptr->ipsa_haspeer) {
2974 		/*
2975 		 * haspeer implies no sa_pairing, look for same spi
2976 		 * in other hashtable.
2977 		 */
2978 		ipsapp->ipsap_psa_ptr =
2979 		    ipsec_getassocbyspi(ipsapp->ipsap_pbucket,
2980 		    assoc->sadb_sa_spi, srcaddr, dstaddr, af);
2981 		mutex_exit(&ipsapp->ipsap_sa_ptr->ipsa_lock);
2982 		mutex_exit(&outbound_bucket->isaf_lock);
2983 		mutex_exit(&inbound_bucket->isaf_lock);
2984 		return (ipsapp);
2985 	}
2986 	pair_spi = ipsapp->ipsap_sa_ptr->ipsa_otherspi;
2987 	IPSA_COPY_ADDR(&pair_srcaddr,
2988 	    ipsapp->ipsap_sa_ptr->ipsa_srcaddr, af);
2989 	IPSA_COPY_ADDR(&pair_dstaddr,
2990 	    ipsapp->ipsap_sa_ptr->ipsa_dstaddr, af);
2991 	mutex_exit(&ipsapp->ipsap_sa_ptr->ipsa_lock);
2992 	mutex_exit(&outbound_bucket->isaf_lock);
2993 	mutex_exit(&inbound_bucket->isaf_lock);
2994 
2995 	if (pair_spi == 0) {
2996 		ASSERT(ipsapp->ipsap_bucket != NULL);
2997 		ASSERT(ipsapp->ipsap_pbucket != NULL);
2998 		return (ipsapp);
2999 	}
3000 
3001 	/* found sa in outbound sadb, peer should be inbound */
3002 
3003 	if (in_inbound_table) {
3004 		/* Found SA in inbound table, pair will be in outbound. */
3005 		if (af == AF_INET6) {
3006 			ipsapp->ipsap_pbucket = OUTBOUND_BUCKET_V6(sp,
3007 			    *(uint32_t *)pair_srcaddr);
3008 		} else {
3009 			ipsapp->ipsap_pbucket = OUTBOUND_BUCKET_V4(sp,
3010 			    *(uint32_t *)pair_srcaddr);
3011 		}
3012 	} else {
3013 		ipsapp->ipsap_pbucket = INBOUND_BUCKET(sp, pair_spi);
3014 	}
3015 	mutex_enter(&ipsapp->ipsap_pbucket->isaf_lock);
3016 	ipsapp->ipsap_psa_ptr = ipsec_getassocbyspi(ipsapp->ipsap_pbucket,
3017 	    pair_spi, pair_dstaddr, pair_srcaddr, af);
3018 	mutex_exit(&ipsapp->ipsap_pbucket->isaf_lock);
3019 	ASSERT(ipsapp->ipsap_bucket != NULL);
3020 	ASSERT(ipsapp->ipsap_pbucket != NULL);
3021 	return (ipsapp);
3022 }
3023 
3024 /*
3025  * Initialize the mechanism parameters associated with an SA.
3026  * These parameters can be shared by multiple packets, which saves
3027  * us from the overhead of consulting the algorithm table for
3028  * each packet.
3029  */
3030 static void
3031 sadb_init_alginfo(ipsa_t *sa)
3032 {
3033 	ipsec_alginfo_t *alg;
3034 	ipsec_stack_t	*ipss = sa->ipsa_netstack->netstack_ipsec;
3035 
3036 	mutex_enter(&ipss->ipsec_alg_lock);
3037 
3038 	if (sa->ipsa_encrkey != NULL) {
3039 		alg = ipss->ipsec_alglists[IPSEC_ALG_ENCR][sa->ipsa_encr_alg];
3040 		if (alg != NULL && ALG_VALID(alg)) {
3041 			sa->ipsa_emech.cm_type = alg->alg_mech_type;
3042 			sa->ipsa_emech.cm_param = NULL;
3043 			sa->ipsa_emech.cm_param_len = 0;
3044 			sa->ipsa_iv_len = alg->alg_datalen;
3045 		} else
3046 			sa->ipsa_emech.cm_type = CRYPTO_MECHANISM_INVALID;
3047 	}
3048 
3049 	if (sa->ipsa_authkey != NULL) {
3050 		alg = ipss->ipsec_alglists[IPSEC_ALG_AUTH][sa->ipsa_auth_alg];
3051 		if (alg != NULL && ALG_VALID(alg)) {
3052 			sa->ipsa_amech.cm_type = alg->alg_mech_type;
3053 			sa->ipsa_amech.cm_param = (char *)&sa->ipsa_mac_len;
3054 			sa->ipsa_amech.cm_param_len = sizeof (size_t);
3055 			sa->ipsa_mac_len = (size_t)alg->alg_datalen;
3056 		} else
3057 			sa->ipsa_amech.cm_type = CRYPTO_MECHANISM_INVALID;
3058 	}
3059 
3060 	mutex_exit(&ipss->ipsec_alg_lock);
3061 }
3062 
3063 /*
3064  * Perform NAT-traversal cached checksum offset calculations here.
3065  */
3066 static void
3067 sadb_nat_calculations(ipsa_t *newbie, sadb_address_t *natt_loc_ext,
3068     sadb_address_t *natt_rem_ext, uint32_t *src_addr_ptr,
3069     uint32_t *dst_addr_ptr)
3070 {
3071 	struct sockaddr_in *natt_loc, *natt_rem;
3072 	uint32_t *natt_loc_ptr = NULL, *natt_rem_ptr = NULL;
3073 	uint32_t running_sum = 0;
3074 
3075 #define	DOWN_SUM(x) (x) = ((x) & 0xFFFF) +	 ((x) >> 16)
3076 
3077 	if (natt_rem_ext != NULL) {
3078 		uint32_t l_src;
3079 		uint32_t l_rem;
3080 
3081 		natt_rem = (struct sockaddr_in *)(natt_rem_ext + 1);
3082 
3083 		/* Ensured by sadb_addrfix(). */
3084 		ASSERT(natt_rem->sin_family == AF_INET);
3085 
3086 		natt_rem_ptr = (uint32_t *)(&natt_rem->sin_addr);
3087 		newbie->ipsa_remote_nat_port = natt_rem->sin_port;
3088 		l_src = *src_addr_ptr;
3089 		l_rem = *natt_rem_ptr;
3090 
3091 		/* Instead of IPSA_COPY_ADDR(), just copy first 32 bits. */
3092 		newbie->ipsa_natt_addr_rem = *natt_rem_ptr;
3093 
3094 		l_src = ntohl(l_src);
3095 		DOWN_SUM(l_src);
3096 		DOWN_SUM(l_src);
3097 		l_rem = ntohl(l_rem);
3098 		DOWN_SUM(l_rem);
3099 		DOWN_SUM(l_rem);
3100 
3101 		/*
3102 		 * We're 1's complement for checksums, so check for wraparound
3103 		 * here.
3104 		 */
3105 		if (l_rem > l_src)
3106 			l_src--;
3107 
3108 		running_sum += l_src - l_rem;
3109 
3110 		DOWN_SUM(running_sum);
3111 		DOWN_SUM(running_sum);
3112 	}
3113 
3114 	if (natt_loc_ext != NULL) {
3115 		natt_loc = (struct sockaddr_in *)(natt_loc_ext + 1);
3116 
3117 		/* Ensured by sadb_addrfix(). */
3118 		ASSERT(natt_loc->sin_family == AF_INET);
3119 
3120 		natt_loc_ptr = (uint32_t *)(&natt_loc->sin_addr);
3121 		newbie->ipsa_local_nat_port = natt_loc->sin_port;
3122 
3123 		/* Instead of IPSA_COPY_ADDR(), just copy first 32 bits. */
3124 		newbie->ipsa_natt_addr_loc = *natt_loc_ptr;
3125 
3126 		/*
3127 		 * NAT-T port agility means we may have natt_loc_ext, but
3128 		 * only for a local-port change.
3129 		 */
3130 		if (natt_loc->sin_addr.s_addr != INADDR_ANY) {
3131 			uint32_t l_dst = ntohl(*dst_addr_ptr);
3132 			uint32_t l_loc = ntohl(*natt_loc_ptr);
3133 
3134 			DOWN_SUM(l_loc);
3135 			DOWN_SUM(l_loc);
3136 			DOWN_SUM(l_dst);
3137 			DOWN_SUM(l_dst);
3138 
3139 			/*
3140 			 * We're 1's complement for checksums, so check for
3141 			 * wraparound here.
3142 			 */
3143 			if (l_loc > l_dst)
3144 				l_dst--;
3145 
3146 			running_sum += l_dst - l_loc;
3147 			DOWN_SUM(running_sum);
3148 			DOWN_SUM(running_sum);
3149 		}
3150 	}
3151 
3152 	newbie->ipsa_inbound_cksum = running_sum;
3153 #undef DOWN_SUM
3154 }
3155 
3156 /*
3157  * This function is called from consumers that need to insert a fully-grown
3158  * security association into its tables.  This function takes into account that
3159  * SAs can be "inbound", "outbound", or "both".	 The "primary" and "secondary"
3160  * hash bucket parameters are set in order of what the SA will be most of the
3161  * time.  (For example, an SA with an unspecified source, and a multicast
3162  * destination will primarily be an outbound SA.  OTOH, if that destination
3163  * is unicast for this node, then the SA will primarily be inbound.)
3164  *
3165  * It takes a lot of parameters because even if clone is B_FALSE, this needs
3166  * to check both buckets for purposes of collision.
3167  *
3168  * Return 0 upon success.  Return various errnos (ENOMEM, EEXIST) for
3169  * various error conditions.  We may need to set samsg->sadb_x_msg_diagnostic
3170  * with additional diagnostic information because there is at least one EINVAL
3171  * case here.
3172  */
3173 int
3174 sadb_common_add(queue_t *ip_q, queue_t *pfkey_q, mblk_t *mp, sadb_msg_t *samsg,
3175     keysock_in_t *ksi, isaf_t *primary, isaf_t *secondary,
3176     ipsa_t *newbie, boolean_t clone, boolean_t is_inbound, int *diagnostic,
3177     netstack_t *ns, sadbp_t *spp)
3178 {
3179 	ipsa_t *newbie_clone = NULL, *scratch;
3180 	ipsap_t *ipsapp = NULL;
3181 	sadb_sa_t *assoc = (sadb_sa_t *)ksi->ks_in_extv[SADB_EXT_SA];
3182 	sadb_address_t *srcext =
3183 	    (sadb_address_t *)ksi->ks_in_extv[SADB_EXT_ADDRESS_SRC];
3184 	sadb_address_t *dstext =
3185 	    (sadb_address_t *)ksi->ks_in_extv[SADB_EXT_ADDRESS_DST];
3186 	sadb_address_t *isrcext =
3187 	    (sadb_address_t *)ksi->ks_in_extv[SADB_X_EXT_ADDRESS_INNER_SRC];
3188 	sadb_address_t *idstext =
3189 	    (sadb_address_t *)ksi->ks_in_extv[SADB_X_EXT_ADDRESS_INNER_DST];
3190 	sadb_x_kmc_t *kmcext =
3191 	    (sadb_x_kmc_t *)ksi->ks_in_extv[SADB_X_EXT_KM_COOKIE];
3192 	sadb_key_t *akey = (sadb_key_t *)ksi->ks_in_extv[SADB_EXT_KEY_AUTH];
3193 	sadb_key_t *ekey = (sadb_key_t *)ksi->ks_in_extv[SADB_EXT_KEY_ENCRYPT];
3194 	sadb_x_pair_t *pair_ext =
3195 	    (sadb_x_pair_t *)ksi->ks_in_extv[SADB_X_EXT_PAIR];
3196 	sadb_x_replay_ctr_t *replayext =
3197 	    (sadb_x_replay_ctr_t *)ksi->ks_in_extv[SADB_X_EXT_REPLAY_VALUE];
3198 	uint8_t protocol =
3199 	    (samsg->sadb_msg_satype == SADB_SATYPE_AH) ? IPPROTO_AH:IPPROTO_ESP;
3200 #if 0
3201 	/*
3202 	 * XXXMLS - When Trusted Solaris or Multi-Level Secure functionality
3203 	 * comes to ON, examine these if 0'ed fragments.  Look for XXXMLS.
3204 	 */
3205 	sadb_sens_t *sens = (sadb_sens_t *);
3206 #endif
3207 	struct sockaddr_in *src, *dst, *isrc, *idst;
3208 	struct sockaddr_in6 *src6, *dst6, *isrc6, *idst6;
3209 	sadb_lifetime_t *soft =
3210 	    (sadb_lifetime_t *)ksi->ks_in_extv[SADB_EXT_LIFETIME_SOFT];
3211 	sadb_lifetime_t *hard =
3212 	    (sadb_lifetime_t *)ksi->ks_in_extv[SADB_EXT_LIFETIME_HARD];
3213 	sadb_lifetime_t	*idle =
3214 	    (sadb_lifetime_t *)ksi->ks_in_extv[SADB_X_EXT_LIFETIME_IDLE];
3215 	sa_family_t af;
3216 	int error = 0;
3217 	boolean_t isupdate = (newbie != NULL);
3218 	uint32_t *src_addr_ptr, *dst_addr_ptr, *isrc_addr_ptr, *idst_addr_ptr;
3219 	mblk_t *ctl_mp = NULL;
3220 	ipsec_stack_t	*ipss = ns->netstack_ipsec;
3221 	int		rcode;
3222 
3223 	if (srcext == NULL) {
3224 		*diagnostic = SADB_X_DIAGNOSTIC_MISSING_SRC;
3225 		return (EINVAL);
3226 	}
3227 	if (dstext == NULL) {
3228 		*diagnostic = SADB_X_DIAGNOSTIC_MISSING_DST;
3229 		return (EINVAL);
3230 	}
3231 	if (assoc == NULL) {
3232 		*diagnostic = SADB_X_DIAGNOSTIC_MISSING_SA;
3233 		return (EINVAL);
3234 	}
3235 
3236 	src = (struct sockaddr_in *)(srcext + 1);
3237 	src6 = (struct sockaddr_in6 *)(srcext + 1);
3238 	dst = (struct sockaddr_in *)(dstext + 1);
3239 	dst6 = (struct sockaddr_in6 *)(dstext + 1);
3240 	if (isrcext != NULL) {
3241 		isrc = (struct sockaddr_in *)(isrcext + 1);
3242 		isrc6 = (struct sockaddr_in6 *)(isrcext + 1);
3243 		ASSERT(idstext != NULL);
3244 		idst = (struct sockaddr_in *)(idstext + 1);
3245 		idst6 = (struct sockaddr_in6 *)(idstext + 1);
3246 	} else {
3247 		isrc = NULL;
3248 		isrc6 = NULL;
3249 	}
3250 
3251 	af = src->sin_family;
3252 
3253 	if (af == AF_INET) {
3254 		src_addr_ptr = (uint32_t *)&src->sin_addr;
3255 		dst_addr_ptr = (uint32_t *)&dst->sin_addr;
3256 	} else {
3257 		ASSERT(af == AF_INET6);
3258 		src_addr_ptr = (uint32_t *)&src6->sin6_addr;
3259 		dst_addr_ptr = (uint32_t *)&dst6->sin6_addr;
3260 	}
3261 
3262 	if (!isupdate && (clone == B_TRUE || is_inbound == B_TRUE) &&
3263 	    cl_inet_checkspi &&
3264 	    (assoc->sadb_sa_state != SADB_X_SASTATE_ACTIVE_ELSEWHERE)) {
3265 		rcode = cl_inet_checkspi(ns->netstack_stackid, protocol,
3266 		    assoc->sadb_sa_spi, NULL);
3267 		if (rcode == -1) {
3268 			return (EEXIST);
3269 		}
3270 	}
3271 
3272 	/*
3273 	 * Check to see if the new SA will be cloned AND paired. The
3274 	 * reason a SA will be cloned is the source or destination addresses
3275 	 * are not specific enough to determine if the SA goes in the outbound
3276 	 * or the inbound hash table, so its cloned and put in both. If
3277 	 * the SA is paired, it's soft linked to another SA for the other
3278 	 * direction. Keeping track and looking up SA's that are direction
3279 	 * unspecific and linked is too hard.
3280 	 */
3281 	if (clone && (pair_ext != NULL)) {
3282 		*diagnostic = SADB_X_DIAGNOSTIC_PAIR_INAPPROPRIATE;
3283 		return (EINVAL);
3284 	}
3285 
3286 	if (!isupdate) {
3287 		newbie = sadb_makelarvalassoc(assoc->sadb_sa_spi,
3288 		    src_addr_ptr, dst_addr_ptr, af, ns);
3289 		if (newbie == NULL)
3290 			return (ENOMEM);
3291 	}
3292 
3293 	mutex_enter(&newbie->ipsa_lock);
3294 
3295 	if (isrc != NULL) {
3296 		if (isrc->sin_family == AF_INET) {
3297 			if (srcext->sadb_address_proto != IPPROTO_ENCAP) {
3298 				if (srcext->sadb_address_proto != 0) {
3299 					/*
3300 					 * Mismatched outer-packet protocol
3301 					 * and inner-packet address family.
3302 					 */
3303 					mutex_exit(&newbie->ipsa_lock);
3304 					error = EPROTOTYPE;
3305 					goto error;
3306 				} else {
3307 					/* Fill in with explicit protocol. */
3308 					srcext->sadb_address_proto =
3309 					    IPPROTO_ENCAP;
3310 					dstext->sadb_address_proto =
3311 					    IPPROTO_ENCAP;
3312 				}
3313 			}
3314 			isrc_addr_ptr = (uint32_t *)&isrc->sin_addr;
3315 			idst_addr_ptr = (uint32_t *)&idst->sin_addr;
3316 		} else {
3317 			ASSERT(isrc->sin_family == AF_INET6);
3318 			if (srcext->sadb_address_proto != IPPROTO_IPV6) {
3319 				if (srcext->sadb_address_proto != 0) {
3320 					/*
3321 					 * Mismatched outer-packet protocol
3322 					 * and inner-packet address family.
3323 					 */
3324 					mutex_exit(&newbie->ipsa_lock);
3325 					error = EPROTOTYPE;
3326 					goto error;
3327 				} else {
3328 					/* Fill in with explicit protocol. */
3329 					srcext->sadb_address_proto =
3330 					    IPPROTO_IPV6;
3331 					dstext->sadb_address_proto =
3332 					    IPPROTO_IPV6;
3333 				}
3334 			}
3335 			isrc_addr_ptr = (uint32_t *)&isrc6->sin6_addr;
3336 			idst_addr_ptr = (uint32_t *)&idst6->sin6_addr;
3337 		}
3338 		newbie->ipsa_innerfam = isrc->sin_family;
3339 
3340 		IPSA_COPY_ADDR(newbie->ipsa_innersrc, isrc_addr_ptr,
3341 		    newbie->ipsa_innerfam);
3342 		IPSA_COPY_ADDR(newbie->ipsa_innerdst, idst_addr_ptr,
3343 		    newbie->ipsa_innerfam);
3344 		newbie->ipsa_innersrcpfx = isrcext->sadb_address_prefixlen;
3345 		newbie->ipsa_innerdstpfx = idstext->sadb_address_prefixlen;
3346 
3347 		/* Unique value uses inner-ports for Tunnel Mode... */
3348 		newbie->ipsa_unique_id = SA_UNIQUE_ID(isrc->sin_port,
3349 		    idst->sin_port, dstext->sadb_address_proto,
3350 		    idstext->sadb_address_proto);
3351 		newbie->ipsa_unique_mask = SA_UNIQUE_MASK(isrc->sin_port,
3352 		    idst->sin_port, dstext->sadb_address_proto,
3353 		    idstext->sadb_address_proto);
3354 	} else {
3355 		/* ... and outer-ports for Transport Mode. */
3356 		newbie->ipsa_unique_id = SA_UNIQUE_ID(src->sin_port,
3357 		    dst->sin_port, dstext->sadb_address_proto, 0);
3358 		newbie->ipsa_unique_mask = SA_UNIQUE_MASK(src->sin_port,
3359 		    dst->sin_port, dstext->sadb_address_proto, 0);
3360 	}
3361 	if (newbie->ipsa_unique_mask != (uint64_t)0)
3362 		newbie->ipsa_flags |= IPSA_F_UNIQUE;
3363 
3364 	sadb_nat_calculations(newbie,
3365 	    (sadb_address_t *)ksi->ks_in_extv[SADB_X_EXT_ADDRESS_NATT_LOC],
3366 	    (sadb_address_t *)ksi->ks_in_extv[SADB_X_EXT_ADDRESS_NATT_REM],
3367 	    src_addr_ptr, dst_addr_ptr);
3368 
3369 	newbie->ipsa_type = samsg->sadb_msg_satype;
3370 	ASSERT((assoc->sadb_sa_state == SADB_SASTATE_MATURE) ||
3371 	    (assoc->sadb_sa_state == SADB_X_SASTATE_ACTIVE_ELSEWHERE));
3372 	newbie->ipsa_auth_alg = assoc->sadb_sa_auth;
3373 	newbie->ipsa_encr_alg = assoc->sadb_sa_encrypt;
3374 
3375 	newbie->ipsa_flags |= assoc->sadb_sa_flags;
3376 	if ((newbie->ipsa_flags & SADB_X_SAFLAGS_NATT_LOC &&
3377 	    ksi->ks_in_extv[SADB_X_EXT_ADDRESS_NATT_LOC] == NULL) ||
3378 	    (newbie->ipsa_flags & SADB_X_SAFLAGS_NATT_REM &&
3379 	    ksi->ks_in_extv[SADB_X_EXT_ADDRESS_NATT_REM] == NULL) ||
3380 	    (newbie->ipsa_flags & SADB_X_SAFLAGS_TUNNEL &&
3381 	    ksi->ks_in_extv[SADB_X_EXT_ADDRESS_INNER_SRC] == NULL)) {
3382 		mutex_exit(&newbie->ipsa_lock);
3383 		*diagnostic = SADB_X_DIAGNOSTIC_BAD_SAFLAGS;
3384 		error = EINVAL;
3385 		goto error;
3386 	}
3387 	/*
3388 	 * If unspecified source address, force replay_wsize to 0.
3389 	 * This is because an SA that has multiple sources of secure
3390 	 * traffic cannot enforce a replay counter w/o synchronizing the
3391 	 * senders.
3392 	 */
3393 	if (ksi->ks_in_srctype != KS_IN_ADDR_UNSPEC)
3394 		newbie->ipsa_replay_wsize = assoc->sadb_sa_replay;
3395 	else
3396 		newbie->ipsa_replay_wsize = 0;
3397 
3398 	newbie->ipsa_addtime = gethrestime_sec();
3399 
3400 	if (kmcext != NULL) {
3401 		newbie->ipsa_kmp = kmcext->sadb_x_kmc_proto;
3402 		newbie->ipsa_kmc = kmcext->sadb_x_kmc_cookie;
3403 	}
3404 
3405 	/*
3406 	 * XXX CURRENT lifetime checks MAY BE needed for an UPDATE.
3407 	 * The spec says that one can update current lifetimes, but
3408 	 * that seems impractical, especially in the larval-to-mature
3409 	 * update that this function performs.
3410 	 */
3411 	if (soft != NULL) {
3412 		newbie->ipsa_softaddlt = soft->sadb_lifetime_addtime;
3413 		newbie->ipsa_softuselt = soft->sadb_lifetime_usetime;
3414 		newbie->ipsa_softbyteslt = soft->sadb_lifetime_bytes;
3415 		newbie->ipsa_softalloc = soft->sadb_lifetime_allocations;
3416 		SET_EXPIRE(newbie, softaddlt, softexpiretime);
3417 	}
3418 	if (hard != NULL) {
3419 		newbie->ipsa_hardaddlt = hard->sadb_lifetime_addtime;
3420 		newbie->ipsa_harduselt = hard->sadb_lifetime_usetime;
3421 		newbie->ipsa_hardbyteslt = hard->sadb_lifetime_bytes;
3422 		newbie->ipsa_hardalloc = hard->sadb_lifetime_allocations;
3423 		SET_EXPIRE(newbie, hardaddlt, hardexpiretime);
3424 	}
3425 	if (idle != NULL) {
3426 		newbie->ipsa_idleaddlt = idle->sadb_lifetime_addtime;
3427 		newbie->ipsa_idleuselt = idle->sadb_lifetime_usetime;
3428 		newbie->ipsa_idleexpiretime = newbie->ipsa_addtime +
3429 		    newbie->ipsa_idleaddlt;
3430 		newbie->ipsa_idletime = newbie->ipsa_idleaddlt;
3431 	}
3432 
3433 	newbie->ipsa_authtmpl = NULL;
3434 	newbie->ipsa_encrtmpl = NULL;
3435 
3436 	if (akey != NULL) {
3437 		newbie->ipsa_authkeybits = akey->sadb_key_bits;
3438 		newbie->ipsa_authkeylen = SADB_1TO8(akey->sadb_key_bits);
3439 		/* In case we have to round up to the next byte... */
3440 		if ((akey->sadb_key_bits & 0x7) != 0)
3441 			newbie->ipsa_authkeylen++;
3442 		newbie->ipsa_authkey = kmem_alloc(newbie->ipsa_authkeylen,
3443 		    KM_NOSLEEP);
3444 		if (newbie->ipsa_authkey == NULL) {
3445 			error = ENOMEM;
3446 			mutex_exit(&newbie->ipsa_lock);
3447 			goto error;
3448 		}
3449 		bcopy(akey + 1, newbie->ipsa_authkey, newbie->ipsa_authkeylen);
3450 		bzero(akey + 1, newbie->ipsa_authkeylen);
3451 
3452 		/*
3453 		 * Pre-initialize the kernel crypto framework key
3454 		 * structure.
3455 		 */
3456 		newbie->ipsa_kcfauthkey.ck_format = CRYPTO_KEY_RAW;
3457 		newbie->ipsa_kcfauthkey.ck_length = newbie->ipsa_authkeybits;
3458 		newbie->ipsa_kcfauthkey.ck_data = newbie->ipsa_authkey;
3459 
3460 		mutex_enter(&ipss->ipsec_alg_lock);
3461 		error = ipsec_create_ctx_tmpl(newbie, IPSEC_ALG_AUTH);
3462 		mutex_exit(&ipss->ipsec_alg_lock);
3463 		if (error != 0) {
3464 			mutex_exit(&newbie->ipsa_lock);
3465 			goto error;
3466 		}
3467 	}
3468 
3469 	if (ekey != NULL) {
3470 		newbie->ipsa_encrkeybits = ekey->sadb_key_bits;
3471 		newbie->ipsa_encrkeylen = SADB_1TO8(ekey->sadb_key_bits);
3472 		/* In case we have to round up to the next byte... */
3473 		if ((ekey->sadb_key_bits & 0x7) != 0)
3474 			newbie->ipsa_encrkeylen++;
3475 		newbie->ipsa_encrkey = kmem_alloc(newbie->ipsa_encrkeylen,
3476 		    KM_NOSLEEP);
3477 		if (newbie->ipsa_encrkey == NULL) {
3478 			error = ENOMEM;
3479 			mutex_exit(&newbie->ipsa_lock);
3480 			goto error;
3481 		}
3482 		bcopy(ekey + 1, newbie->ipsa_encrkey, newbie->ipsa_encrkeylen);
3483 		/* XXX is this safe w.r.t db_ref, etc? */
3484 		bzero(ekey + 1, newbie->ipsa_encrkeylen);
3485 
3486 		/*
3487 		 * Pre-initialize the kernel crypto framework key
3488 		 * structure.
3489 		 */
3490 		newbie->ipsa_kcfencrkey.ck_format = CRYPTO_KEY_RAW;
3491 		newbie->ipsa_kcfencrkey.ck_length = newbie->ipsa_encrkeybits;
3492 		newbie->ipsa_kcfencrkey.ck_data = newbie->ipsa_encrkey;
3493 
3494 		mutex_enter(&ipss->ipsec_alg_lock);
3495 		error = ipsec_create_ctx_tmpl(newbie, IPSEC_ALG_ENCR);
3496 		mutex_exit(&ipss->ipsec_alg_lock);
3497 		if (error != 0) {
3498 			mutex_exit(&newbie->ipsa_lock);
3499 			goto error;
3500 		}
3501 	}
3502 
3503 	sadb_init_alginfo(newbie);
3504 
3505 	/*
3506 	 * Ptrs to processing functions.
3507 	 */
3508 	if (newbie->ipsa_type == SADB_SATYPE_ESP)
3509 		ipsecesp_init_funcs(newbie);
3510 	else
3511 		ipsecah_init_funcs(newbie);
3512 	ASSERT(newbie->ipsa_output_func != NULL &&
3513 	    newbie->ipsa_input_func != NULL);
3514 
3515 	/*
3516 	 * Certificate ID stuff.
3517 	 */
3518 	if (ksi->ks_in_extv[SADB_EXT_IDENTITY_SRC] != NULL) {
3519 		sadb_ident_t *id =
3520 		    (sadb_ident_t *)ksi->ks_in_extv[SADB_EXT_IDENTITY_SRC];
3521 
3522 		/*
3523 		 * Can assume strlen() will return okay because ext_check() in
3524 		 * keysock.c prepares the string for us.
3525 		 */
3526 		newbie->ipsa_src_cid = ipsid_lookup(id->sadb_ident_type,
3527 		    (char *)(id+1), ns);
3528 		if (newbie->ipsa_src_cid == NULL) {
3529 			error = ENOMEM;
3530 			mutex_exit(&newbie->ipsa_lock);
3531 			goto error;
3532 		}
3533 	}
3534 
3535 	if (ksi->ks_in_extv[SADB_EXT_IDENTITY_DST] != NULL) {
3536 		sadb_ident_t *id =
3537 		    (sadb_ident_t *)ksi->ks_in_extv[SADB_EXT_IDENTITY_DST];
3538 
3539 		/*
3540 		 * Can assume strlen() will return okay because ext_check() in
3541 		 * keysock.c prepares the string for us.
3542 		 */
3543 		newbie->ipsa_dst_cid = ipsid_lookup(id->sadb_ident_type,
3544 		    (char *)(id+1), ns);
3545 		if (newbie->ipsa_dst_cid == NULL) {
3546 			error = ENOMEM;
3547 			mutex_exit(&newbie->ipsa_lock);
3548 			goto error;
3549 		}
3550 	}
3551 
3552 #if 0
3553 	/* XXXMLS  SENSITIVITY handling code. */
3554 	if (sens != NULL) {
3555 		int i;
3556 		uint64_t *bitmap = (uint64_t *)(sens + 1);
3557 
3558 		newbie->ipsa_dpd = sens->sadb_sens_dpd;
3559 		newbie->ipsa_senslevel = sens->sadb_sens_sens_level;
3560 		newbie->ipsa_integlevel = sens->sadb_sens_integ_level;
3561 		newbie->ipsa_senslen = SADB_64TO8(sens->sadb_sens_sens_len);
3562 		newbie->ipsa_integlen = SADB_64TO8(sens->sadb_sens_integ_len);
3563 		newbie->ipsa_integ = kmem_alloc(newbie->ipsa_integlen,
3564 		    KM_NOSLEEP);
3565 		if (newbie->ipsa_integ == NULL) {
3566 			error = ENOMEM;
3567 			mutex_exit(&newbie->ipsa_lock);
3568 			goto error;
3569 		}
3570 		newbie->ipsa_sens = kmem_alloc(newbie->ipsa_senslen,
3571 		    KM_NOSLEEP);
3572 		if (newbie->ipsa_sens == NULL) {
3573 			error = ENOMEM;
3574 			mutex_exit(&newbie->ipsa_lock);
3575 			goto error;
3576 		}
3577 		for (i = 0; i < sens->sadb_sens_sens_len; i++) {
3578 			newbie->ipsa_sens[i] = *bitmap;
3579 			bitmap++;
3580 		}
3581 		for (i = 0; i < sens->sadb_sens_integ_len; i++) {
3582 			newbie->ipsa_integ[i] = *bitmap;
3583 			bitmap++;
3584 		}
3585 	}
3586 
3587 #endif
3588 
3589 	if (replayext != NULL) {
3590 		if ((replayext->sadb_x_rc_replay32 == 0) &&
3591 		    (replayext->sadb_x_rc_replay64 != 0)) {
3592 			error = EOPNOTSUPP;
3593 			mutex_exit(&newbie->ipsa_lock);
3594 			goto error;
3595 		}
3596 		newbie->ipsa_replay = replayext->sadb_x_rc_replay32;
3597 	}
3598 
3599 	/* now that the SA has been updated, set its new state */
3600 	newbie->ipsa_state = assoc->sadb_sa_state;
3601 
3602 	if (clone) {
3603 		newbie->ipsa_haspeer = B_TRUE;
3604 	} else {
3605 		if (!is_inbound) {
3606 			lifetime_fuzz(newbie);
3607 		}
3608 	}
3609 	/*
3610 	 * The less locks I hold when doing an insertion and possible cloning,
3611 	 * the better!
3612 	 */
3613 	mutex_exit(&newbie->ipsa_lock);
3614 
3615 	if (clone) {
3616 		newbie_clone = sadb_cloneassoc(newbie);
3617 
3618 		if (newbie_clone == NULL) {
3619 			error = ENOMEM;
3620 			goto error;
3621 		}
3622 	}
3623 
3624 	/*
3625 	 * Enter the bucket locks.  The order of entry is outbound,
3626 	 * inbound.  We map "primary" and "secondary" into outbound and inbound
3627 	 * based on the destination address type.  If the destination address
3628 	 * type is for a node that isn't mine (or potentially mine), the
3629 	 * "primary" bucket is the outbound one.
3630 	 */
3631 	if (!is_inbound) {
3632 		/* primary == outbound */
3633 		mutex_enter(&primary->isaf_lock);
3634 		mutex_enter(&secondary->isaf_lock);
3635 	} else {
3636 		/* primary == inbound */
3637 		mutex_enter(&secondary->isaf_lock);
3638 		mutex_enter(&primary->isaf_lock);
3639 	}
3640 
3641 	IPSECHW_DEBUG(IPSECHW_SADB, ("sadb_common_add: spi = 0x%x\n",
3642 	    newbie->ipsa_spi));
3643 
3644 	/*
3645 	 * sadb_insertassoc() doesn't increment the reference
3646 	 * count.  We therefore have to increment the
3647 	 * reference count one more time to reflect the
3648 	 * pointers of the table that reference this SA.
3649 	 */
3650 	IPSA_REFHOLD(newbie);
3651 
3652 	if (isupdate) {
3653 		/*
3654 		 * Unlink from larval holding cell in the "inbound" fanout.
3655 		 */
3656 		ASSERT(newbie->ipsa_linklock == &primary->isaf_lock ||
3657 		    newbie->ipsa_linklock == &secondary->isaf_lock);
3658 		sadb_unlinkassoc(newbie);
3659 	}
3660 
3661 	mutex_enter(&newbie->ipsa_lock);
3662 	error = sadb_insertassoc(newbie, primary);
3663 	if (error == 0) {
3664 		ctl_mp = sadb_fmt_sa_req(DL_CO_SET, newbie->ipsa_type, newbie,
3665 		    is_inbound);
3666 	}
3667 	mutex_exit(&newbie->ipsa_lock);
3668 
3669 	if (error != 0) {
3670 		/*
3671 		 * Since sadb_insertassoc() failed, we must decrement the
3672 		 * refcount again so the cleanup code will actually free
3673 		 * the offending SA.
3674 		 */
3675 		IPSA_REFRELE(newbie);
3676 		goto error_unlock;
3677 	}
3678 
3679 	if (newbie_clone != NULL) {
3680 		mutex_enter(&newbie_clone->ipsa_lock);
3681 		error = sadb_insertassoc(newbie_clone, secondary);
3682 		mutex_exit(&newbie_clone->ipsa_lock);
3683 		if (error != 0) {
3684 			/* Collision in secondary table. */
3685 			sadb_unlinkassoc(newbie);  /* This does REFRELE. */
3686 			goto error_unlock;
3687 		}
3688 		IPSA_REFHOLD(newbie_clone);
3689 	} else {
3690 		ASSERT(primary != secondary);
3691 		scratch = ipsec_getassocbyspi(secondary, newbie->ipsa_spi,
3692 		    ALL_ZEROES_PTR, newbie->ipsa_dstaddr, af);
3693 		if (scratch != NULL) {
3694 			/* Collision in secondary table. */
3695 			sadb_unlinkassoc(newbie);  /* This does REFRELE. */
3696 			/* Set the error, since ipsec_getassocbyspi() can't. */
3697 			error = EEXIST;
3698 			goto error_unlock;
3699 		}
3700 	}
3701 
3702 	/* OKAY!  So let's do some reality check assertions. */
3703 
3704 	ASSERT(MUTEX_NOT_HELD(&newbie->ipsa_lock));
3705 	ASSERT(newbie_clone == NULL ||
3706 	    (MUTEX_NOT_HELD(&newbie_clone->ipsa_lock)));
3707 	/*
3708 	 * If hardware acceleration could happen, send it.
3709 	 */
3710 	if (ctl_mp != NULL) {
3711 		putnext(ip_q, ctl_mp);
3712 		ctl_mp = NULL;
3713 	}
3714 
3715 error_unlock:
3716 
3717 	/*
3718 	 * We can exit the locks in any order.	Only entrance needs to
3719 	 * follow any protocol.
3720 	 */
3721 	mutex_exit(&secondary->isaf_lock);
3722 	mutex_exit(&primary->isaf_lock);
3723 
3724 	if (pair_ext != NULL && error == 0) {
3725 		/* update pair_spi if it exists. */
3726 		ipsapp = get_ipsa_pair(assoc, srcext, dstext, spp);
3727 		if (ipsapp == NULL) {
3728 			error = ESRCH;
3729 			*diagnostic = SADB_X_DIAGNOSTIC_PAIR_SA_NOTFOUND;
3730 		} else if (ipsapp->ipsap_psa_ptr != NULL) {
3731 			*diagnostic = SADB_X_DIAGNOSTIC_PAIR_ALREADY;
3732 			error = EINVAL;
3733 		} else {
3734 			/* update_pairing() sets diagnostic */
3735 			error = update_pairing(ipsapp, ksi, diagnostic, spp);
3736 		}
3737 	}
3738 	/* Common error point for this routine. */
3739 error:
3740 	if (newbie != NULL) {
3741 		if (error != 0) {
3742 			/* This SA is broken, let the reaper clean up. */
3743 			mutex_enter(&newbie->ipsa_lock);
3744 			newbie->ipsa_state = IPSA_STATE_DEAD;
3745 			newbie->ipsa_hardexpiretime = 1;
3746 			mutex_exit(&newbie->ipsa_lock);
3747 		}
3748 		IPSA_REFRELE(newbie);
3749 	}
3750 	if (newbie_clone != NULL) {
3751 		IPSA_REFRELE(newbie_clone);
3752 	}
3753 	if (ctl_mp != NULL)
3754 		freemsg(ctl_mp);
3755 
3756 	if (error == 0) {
3757 		/*
3758 		 * Construct favorable PF_KEY return message and send to
3759 		 * keysock. Update the flags in the original keysock message
3760 		 * to reflect the actual flags in the new SA.
3761 		 *  (Q:  Do I need to pass "newbie"?  If I do,
3762 		 * make sure to REFHOLD, call, then REFRELE.)
3763 		 */
3764 		assoc->sadb_sa_flags = newbie->ipsa_flags;
3765 		sadb_pfkey_echo(pfkey_q, mp, samsg, ksi, NULL);
3766 	}
3767 
3768 	destroy_ipsa_pair(ipsapp);
3769 	return (error);
3770 }
3771 
3772 /*
3773  * Set the time of first use for a security association.  Update any
3774  * expiration times as a result.
3775  */
3776 void
3777 sadb_set_usetime(ipsa_t *assoc)
3778 {
3779 	time_t snapshot = gethrestime_sec();
3780 
3781 	mutex_enter(&assoc->ipsa_lock);
3782 	assoc->ipsa_lastuse = snapshot;
3783 	assoc->ipsa_idleexpiretime = snapshot + assoc->ipsa_idletime;
3784 
3785 	/*
3786 	 * Caller does check usetime before calling me usually, and
3787 	 * double-checking is better than a mutex_enter/exit hit.
3788 	 */
3789 	if (assoc->ipsa_usetime == 0) {
3790 		/*
3791 		 * This is redundant for outbound SA's, as
3792 		 * ipsec_getassocbyconn() sets the IPSA_F_USED flag already.
3793 		 * Inbound SAs, however, have no such protection.
3794 		 */
3795 		assoc->ipsa_flags |= IPSA_F_USED;
3796 		assoc->ipsa_usetime = snapshot;
3797 
3798 		/*
3799 		 * After setting the use time, see if we have a use lifetime
3800 		 * that would cause the actual SA expiration time to shorten.
3801 		 */
3802 		UPDATE_EXPIRE(assoc, softuselt, softexpiretime);
3803 		UPDATE_EXPIRE(assoc, harduselt, hardexpiretime);
3804 	}
3805 	mutex_exit(&assoc->ipsa_lock);
3806 }
3807 
3808 /*
3809  * Send up a PF_KEY expire message for this association.
3810  */
3811 static void
3812 sadb_expire_assoc(queue_t *pfkey_q, ipsa_t *assoc)
3813 {
3814 	mblk_t *mp, *mp1;
3815 	int alloclen, af;
3816 	sadb_msg_t *samsg;
3817 	sadb_lifetime_t *current, *expire;
3818 	sadb_sa_t *saext;
3819 	uint8_t *end;
3820 	boolean_t tunnel_mode;
3821 
3822 	ASSERT(MUTEX_HELD(&assoc->ipsa_lock));
3823 
3824 	/* Don't bother sending if there's no queue. */
3825 	if (pfkey_q == NULL)
3826 		return;
3827 
3828 	/* If the SA is one of a pair, only SOFT expire the OUTBOUND SA */
3829 	if (assoc->ipsa_state == IPSA_STATE_DYING &&
3830 	    (assoc->ipsa_flags & IPSA_F_PAIRED) &&
3831 	    !(assoc->ipsa_flags & IPSA_F_OUTBOUND)) {
3832 		return;
3833 	}
3834 
3835 	mp = sadb_keysock_out(0);
3836 	if (mp == NULL) {
3837 		/* cmn_err(CE_WARN, */
3838 		/*	"sadb_expire_assoc: Can't allocate KEYSOCK_OUT.\n"); */
3839 		return;
3840 	}
3841 
3842 	alloclen = sizeof (*samsg) + sizeof (*current) + sizeof (*expire) +
3843 	    2 * sizeof (sadb_address_t) + sizeof (*saext);
3844 
3845 	af = assoc->ipsa_addrfam;
3846 	switch (af) {
3847 	case AF_INET:
3848 		alloclen += 2 * sizeof (struct sockaddr_in);
3849 		break;
3850 	case AF_INET6:
3851 		alloclen += 2 * sizeof (struct sockaddr_in6);
3852 		break;
3853 	default:
3854 		/* Won't happen unless there's a kernel bug. */
3855 		freeb(mp);
3856 		cmn_err(CE_WARN,
3857 		    "sadb_expire_assoc: Unknown address length.\n");
3858 		return;
3859 	}
3860 
3861 	tunnel_mode = (assoc->ipsa_flags & IPSA_F_TUNNEL);
3862 	if (tunnel_mode) {
3863 		alloclen += 2 * sizeof (sadb_address_t);
3864 		switch (assoc->ipsa_innerfam) {
3865 		case AF_INET:
3866 			alloclen += 2 * sizeof (struct sockaddr_in);
3867 			break;
3868 		case AF_INET6:
3869 			alloclen += 2 * sizeof (struct sockaddr_in6);
3870 			break;
3871 		default:
3872 			/* Won't happen unless there's a kernel bug. */
3873 			freeb(mp);
3874 			cmn_err(CE_WARN, "sadb_expire_assoc: "
3875 			    "Unknown inner address length.\n");
3876 			return;
3877 		}
3878 	}
3879 
3880 	mp->b_cont = allocb(alloclen, BPRI_HI);
3881 	if (mp->b_cont == NULL) {
3882 		freeb(mp);
3883 		/* cmn_err(CE_WARN, */
3884 		/*	"sadb_expire_assoc: Can't allocate message.\n"); */
3885 		return;
3886 	}
3887 
3888 	mp1 = mp;
3889 	mp = mp->b_cont;
3890 	end = mp->b_wptr + alloclen;
3891 
3892 	samsg = (sadb_msg_t *)mp->b_wptr;
3893 	mp->b_wptr += sizeof (*samsg);
3894 	samsg->sadb_msg_version = PF_KEY_V2;
3895 	samsg->sadb_msg_type = SADB_EXPIRE;
3896 	samsg->sadb_msg_errno = 0;
3897 	samsg->sadb_msg_satype = assoc->ipsa_type;
3898 	samsg->sadb_msg_len = SADB_8TO64(alloclen);
3899 	samsg->sadb_msg_reserved = 0;
3900 	samsg->sadb_msg_seq = 0;
3901 	samsg->sadb_msg_pid = 0;
3902 
3903 	saext = (sadb_sa_t *)mp->b_wptr;
3904 	mp->b_wptr += sizeof (*saext);
3905 	saext->sadb_sa_len = SADB_8TO64(sizeof (*saext));
3906 	saext->sadb_sa_exttype = SADB_EXT_SA;
3907 	saext->sadb_sa_spi = assoc->ipsa_spi;
3908 	saext->sadb_sa_replay = assoc->ipsa_replay_wsize;
3909 	saext->sadb_sa_state = assoc->ipsa_state;
3910 	saext->sadb_sa_auth = assoc->ipsa_auth_alg;
3911 	saext->sadb_sa_encrypt = assoc->ipsa_encr_alg;
3912 	saext->sadb_sa_flags = assoc->ipsa_flags;
3913 
3914 	current = (sadb_lifetime_t *)mp->b_wptr;
3915 	mp->b_wptr += sizeof (sadb_lifetime_t);
3916 	current->sadb_lifetime_len = SADB_8TO64(sizeof (*current));
3917 	current->sadb_lifetime_exttype = SADB_EXT_LIFETIME_CURRENT;
3918 	/* We do not support the concept. */
3919 	current->sadb_lifetime_allocations = 0;
3920 	current->sadb_lifetime_bytes = assoc->ipsa_bytes;
3921 	current->sadb_lifetime_addtime = assoc->ipsa_addtime;
3922 	current->sadb_lifetime_usetime = assoc->ipsa_usetime;
3923 
3924 	expire = (sadb_lifetime_t *)mp->b_wptr;
3925 	mp->b_wptr += sizeof (*expire);
3926 	expire->sadb_lifetime_len = SADB_8TO64(sizeof (*expire));
3927 
3928 	if (assoc->ipsa_state == IPSA_STATE_DEAD) {
3929 		expire->sadb_lifetime_exttype = SADB_EXT_LIFETIME_HARD;
3930 		expire->sadb_lifetime_allocations = assoc->ipsa_hardalloc;
3931 		expire->sadb_lifetime_bytes = assoc->ipsa_hardbyteslt;
3932 		expire->sadb_lifetime_addtime = assoc->ipsa_hardaddlt;
3933 		expire->sadb_lifetime_usetime = assoc->ipsa_harduselt;
3934 	} else if (assoc->ipsa_state == IPSA_STATE_DYING) {
3935 		expire->sadb_lifetime_exttype = SADB_EXT_LIFETIME_SOFT;
3936 		expire->sadb_lifetime_allocations = assoc->ipsa_softalloc;
3937 		expire->sadb_lifetime_bytes = assoc->ipsa_softbyteslt;
3938 		expire->sadb_lifetime_addtime = assoc->ipsa_softaddlt;
3939 		expire->sadb_lifetime_usetime = assoc->ipsa_softuselt;
3940 	} else {
3941 		ASSERT(assoc->ipsa_state == IPSA_STATE_MATURE);
3942 		expire->sadb_lifetime_exttype = SADB_X_EXT_LIFETIME_IDLE;
3943 		expire->sadb_lifetime_allocations = 0;
3944 		expire->sadb_lifetime_bytes = 0;
3945 		expire->sadb_lifetime_addtime = assoc->ipsa_idleaddlt;
3946 		expire->sadb_lifetime_usetime = assoc->ipsa_idleuselt;
3947 	}
3948 
3949 	mp->b_wptr = sadb_make_addr_ext(mp->b_wptr, end, SADB_EXT_ADDRESS_SRC,
3950 	    af, assoc->ipsa_srcaddr, tunnel_mode ? 0 : SA_SRCPORT(assoc),
3951 	    SA_PROTO(assoc), 0);
3952 	ASSERT(mp->b_wptr != NULL);
3953 
3954 	mp->b_wptr = sadb_make_addr_ext(mp->b_wptr, end, SADB_EXT_ADDRESS_DST,
3955 	    af, assoc->ipsa_dstaddr, tunnel_mode ? 0 : SA_DSTPORT(assoc),
3956 	    SA_PROTO(assoc), 0);
3957 	ASSERT(mp->b_wptr != NULL);
3958 
3959 	if (tunnel_mode) {
3960 		mp->b_wptr = sadb_make_addr_ext(mp->b_wptr, end,
3961 		    SADB_X_EXT_ADDRESS_INNER_SRC, assoc->ipsa_innerfam,
3962 		    assoc->ipsa_innersrc, SA_SRCPORT(assoc), SA_IPROTO(assoc),
3963 		    assoc->ipsa_innersrcpfx);
3964 		ASSERT(mp->b_wptr != NULL);
3965 		mp->b_wptr = sadb_make_addr_ext(mp->b_wptr, end,
3966 		    SADB_X_EXT_ADDRESS_INNER_DST, assoc->ipsa_innerfam,
3967 		    assoc->ipsa_innerdst, SA_DSTPORT(assoc), SA_IPROTO(assoc),
3968 		    assoc->ipsa_innerdstpfx);
3969 		ASSERT(mp->b_wptr != NULL);
3970 	}
3971 
3972 	/* Can just putnext, we're ready to go! */
3973 	putnext(pfkey_q, mp1);
3974 }
3975 
3976 /*
3977  * "Age" the SA with the number of bytes that was used to protect traffic.
3978  * Send an SADB_EXPIRE message if appropriate.	Return B_TRUE if there was
3979  * enough "charge" left in the SA to protect the data.	Return B_FALSE
3980  * otherwise.  (If B_FALSE is returned, the association either was, or became
3981  * DEAD.)
3982  */
3983 boolean_t
3984 sadb_age_bytes(queue_t *pfkey_q, ipsa_t *assoc, uint64_t bytes,
3985     boolean_t sendmsg)
3986 {
3987 	boolean_t rc = B_TRUE;
3988 	uint64_t newtotal;
3989 
3990 	mutex_enter(&assoc->ipsa_lock);
3991 	newtotal = assoc->ipsa_bytes + bytes;
3992 	if (assoc->ipsa_hardbyteslt != 0 &&
3993 	    newtotal >= assoc->ipsa_hardbyteslt) {
3994 		if (assoc->ipsa_state != IPSA_STATE_DEAD) {
3995 			sadb_delete_cluster(assoc);
3996 			/*
3997 			 * Send EXPIRE message to PF_KEY.  May wish to pawn
3998 			 * this off on another non-interrupt thread.  Also
3999 			 * unlink this SA immediately.
4000 			 */
4001 			assoc->ipsa_state = IPSA_STATE_DEAD;
4002 			if (sendmsg)
4003 				sadb_expire_assoc(pfkey_q, assoc);
4004 			/*
4005 			 * Set non-zero expiration time so sadb_age_assoc()
4006 			 * will work when reaping.
4007 			 */
4008 			assoc->ipsa_hardexpiretime = (time_t)1;
4009 		} /* Else someone beat me to it! */
4010 		rc = B_FALSE;
4011 	} else if (assoc->ipsa_softbyteslt != 0 &&
4012 	    (newtotal >= assoc->ipsa_softbyteslt)) {
4013 		if (assoc->ipsa_state < IPSA_STATE_DYING) {
4014 			/*
4015 			 * Send EXPIRE message to PF_KEY.  May wish to pawn
4016 			 * this off on another non-interrupt thread.
4017 			 */
4018 			assoc->ipsa_state = IPSA_STATE_DYING;
4019 			assoc->ipsa_bytes = newtotal;
4020 			if (sendmsg)
4021 				sadb_expire_assoc(pfkey_q, assoc);
4022 		} /* Else someone beat me to it! */
4023 	}
4024 	if (rc == B_TRUE)
4025 		assoc->ipsa_bytes = newtotal;
4026 	mutex_exit(&assoc->ipsa_lock);
4027 	return (rc);
4028 }
4029 
4030 /*
4031  * Push one or more DL_CO_DELETE messages queued up by
4032  * sadb_torch_assoc down to the underlying driver now that it's a
4033  * convenient time for it (i.e., ipsa bucket locks not held).
4034  */
4035 static void
4036 sadb_drain_torchq(queue_t *q, mblk_t *mp)
4037 {
4038 	while (mp != NULL) {
4039 		mblk_t *next = mp->b_next;
4040 		mp->b_next = NULL;
4041 		if (q != NULL)
4042 			putnext(q, mp);
4043 		else
4044 			freemsg(mp);
4045 		mp = next;
4046 	}
4047 }
4048 
4049 /*
4050  * "Torch" an individual SA.  Returns NULL, so it can be tail-called from
4051  *     sadb_age_assoc().
4052  *
4053  * If SA is hardware-accelerated, and we can't allocate the mblk
4054  * containing the DL_CO_DELETE, just return; it will remain in the
4055  * table and be swept up by sadb_ager() in a subsequent pass.
4056  */
4057 static ipsa_t *
4058 sadb_torch_assoc(isaf_t *head, ipsa_t *sa, boolean_t inbnd, mblk_t **mq)
4059 {
4060 	mblk_t *mp;
4061 
4062 	ASSERT(MUTEX_HELD(&head->isaf_lock));
4063 	ASSERT(MUTEX_HELD(&sa->ipsa_lock));
4064 	ASSERT(sa->ipsa_state == IPSA_STATE_DEAD);
4065 
4066 	/*
4067 	 * Force cached SAs to be revalidated..
4068 	 */
4069 	head->isaf_gen++;
4070 
4071 	if (sa->ipsa_flags & IPSA_F_HW) {
4072 		mp = sadb_fmt_sa_req(DL_CO_DELETE, sa->ipsa_type, sa, inbnd);
4073 		if (mp == NULL) {
4074 			mutex_exit(&sa->ipsa_lock);
4075 			return (NULL);
4076 		}
4077 		mp->b_next = *mq;
4078 		*mq = mp;
4079 	}
4080 	mutex_exit(&sa->ipsa_lock);
4081 	sadb_unlinkassoc(sa);
4082 
4083 	return (NULL);
4084 }
4085 
4086 /*
4087  * Do various SA-is-idle activities depending on delta (the number of idle
4088  * seconds on the SA) and/or other properties of the SA.
4089  *
4090  * Return B_TRUE if I've sent a packet, because I have to drop the
4091  * association's mutex before sending a packet out the wire.
4092  */
4093 /* ARGSUSED */
4094 static boolean_t
4095 sadb_idle_activities(ipsa_t *assoc, time_t delta, boolean_t inbound)
4096 {
4097 	ipsecesp_stack_t *espstack = assoc->ipsa_netstack->netstack_ipsecesp;
4098 	int nat_t_interval = espstack->ipsecesp_nat_keepalive_interval;
4099 
4100 	ASSERT(MUTEX_HELD(&assoc->ipsa_lock));
4101 
4102 	if (!inbound && (assoc->ipsa_flags & IPSA_F_NATT_LOC) &&
4103 	    delta >= nat_t_interval &&
4104 	    gethrestime_sec() - assoc->ipsa_last_nat_t_ka >= nat_t_interval) {
4105 		ASSERT(assoc->ipsa_type == SADB_SATYPE_ESP);
4106 		assoc->ipsa_last_nat_t_ka = gethrestime_sec();
4107 		mutex_exit(&assoc->ipsa_lock);
4108 		ipsecesp_send_keepalive(assoc);
4109 		return (B_TRUE);
4110 	}
4111 	return (B_FALSE);
4112 }
4113 
4114 /*
4115  * Return "assoc" if haspeer is true and I send an expire.  This allows
4116  * the consumers' aging functions to tidy up an expired SA's peer.
4117  */
4118 static ipsa_t *
4119 sadb_age_assoc(isaf_t *head, queue_t *pfkey_q, ipsa_t *assoc,
4120     time_t current, int reap_delay, boolean_t inbound, mblk_t **mq)
4121 {
4122 	ipsa_t *retval = NULL;
4123 	boolean_t dropped_mutex = B_FALSE;
4124 
4125 	ASSERT(MUTEX_HELD(&head->isaf_lock));
4126 
4127 	mutex_enter(&assoc->ipsa_lock);
4128 
4129 	if (((assoc->ipsa_state == IPSA_STATE_LARVAL) ||
4130 	    ((assoc->ipsa_state == IPSA_STATE_IDLE) ||
4131 	    (assoc->ipsa_state == IPSA_STATE_ACTIVE_ELSEWHERE) &&
4132 	    (assoc->ipsa_hardexpiretime != 0))) &&
4133 	    (assoc->ipsa_hardexpiretime <= current)) {
4134 		assoc->ipsa_state = IPSA_STATE_DEAD;
4135 		return (sadb_torch_assoc(head, assoc, inbound, mq));
4136 	}
4137 
4138 	/*
4139 	 * Check lifetimes.  Fortunately, SA setup is done
4140 	 * such that there are only two times to look at,
4141 	 * softexpiretime, and hardexpiretime.
4142 	 *
4143 	 * Check hard first.
4144 	 */
4145 
4146 	if (assoc->ipsa_hardexpiretime != 0 &&
4147 	    assoc->ipsa_hardexpiretime <= current) {
4148 		if (assoc->ipsa_state == IPSA_STATE_DEAD)
4149 			return (sadb_torch_assoc(head, assoc, inbound, mq));
4150 
4151 		if (inbound) {
4152 			sadb_delete_cluster(assoc);
4153 		}
4154 
4155 		/*
4156 		 * Send SADB_EXPIRE with hard lifetime, delay for unlinking.
4157 		 */
4158 		assoc->ipsa_state = IPSA_STATE_DEAD;
4159 		if (assoc->ipsa_haspeer || assoc->ipsa_otherspi != 0) {
4160 			/*
4161 			 * If the SA is paired or peered with another, put
4162 			 * a copy on a list which can be processed later, the
4163 			 * pair/peer SA needs to be updated so the both die
4164 			 * at the same time.
4165 			 *
4166 			 * If I return assoc, I have to bump up its reference
4167 			 * count to keep with the ipsa_t reference count
4168 			 * semantics.
4169 			 */
4170 			IPSA_REFHOLD(assoc);
4171 			retval = assoc;
4172 		}
4173 		sadb_expire_assoc(pfkey_q, assoc);
4174 		assoc->ipsa_hardexpiretime = current + reap_delay;
4175 	} else if (assoc->ipsa_softexpiretime != 0 &&
4176 	    assoc->ipsa_softexpiretime <= current &&
4177 	    assoc->ipsa_state < IPSA_STATE_DYING) {
4178 		/*
4179 		 * Send EXPIRE message to PF_KEY.  May wish to pawn
4180 		 * this off on another non-interrupt thread.
4181 		 */
4182 		assoc->ipsa_state = IPSA_STATE_DYING;
4183 		if (assoc->ipsa_haspeer) {
4184 			/*
4185 			 * If the SA has a peer, update the peer's state
4186 			 * on SOFT_EXPIRE, this is mostly to prevent two
4187 			 * expire messages from effectively the same SA.
4188 			 *
4189 			 * Don't care about paired SA's, then can (and should)
4190 			 * be able to soft expire at different times.
4191 			 *
4192 			 * If I return assoc, I have to bump up its
4193 			 * reference count to keep with the ipsa_t reference
4194 			 * count semantics.
4195 			 */
4196 			IPSA_REFHOLD(assoc);
4197 			retval = assoc;
4198 		}
4199 		sadb_expire_assoc(pfkey_q, assoc);
4200 	} else if (assoc->ipsa_idletime != 0 &&
4201 	    assoc->ipsa_idleexpiretime <= current) {
4202 		if (assoc->ipsa_state == IPSA_STATE_ACTIVE_ELSEWHERE) {
4203 			assoc->ipsa_state = IPSA_STATE_IDLE;
4204 		}
4205 
4206 		/*
4207 		 * Need to handle Mature case
4208 		 */
4209 		if (assoc->ipsa_state == IPSA_STATE_MATURE) {
4210 			sadb_expire_assoc(pfkey_q, assoc);
4211 		}
4212 	} else {
4213 		/* Check idle time activities. */
4214 		dropped_mutex = sadb_idle_activities(assoc,
4215 		    current - assoc->ipsa_lastuse, inbound);
4216 	}
4217 
4218 	if (!dropped_mutex)
4219 		mutex_exit(&assoc->ipsa_lock);
4220 	return (retval);
4221 }
4222 
4223 /*
4224  * Called by a consumer protocol to do ther dirty work of reaping dead
4225  * Security Associations.
4226  *
4227  * NOTE: sadb_age_assoc() marks expired SA's as DEAD but only removed
4228  * SA's that are already marked DEAD, so expired SA's are only reaped
4229  * the second time sadb_ager() runs.
4230  */
4231 void
4232 sadb_ager(sadb_t *sp, queue_t *pfkey_q, queue_t *ip_q, int reap_delay,
4233     netstack_t *ns)
4234 {
4235 	int i;
4236 	isaf_t *bucket;
4237 	ipsa_t *assoc, *spare;
4238 	iacqf_t *acqlist;
4239 	ipsacq_t *acqrec, *spareacq;
4240 	templist_t *haspeerlist, *newbie;
4241 	/* Snapshot current time now. */
4242 	time_t current = gethrestime_sec();
4243 	mblk_t *mq = NULL;
4244 	haspeerlist = NULL;
4245 
4246 	/*
4247 	 * Do my dirty work.  This includes aging real entries, aging
4248 	 * larvals, and aging outstanding ACQUIREs.
4249 	 *
4250 	 * I hope I don't tie up resources for too long.
4251 	 */
4252 
4253 	/* Age acquires. */
4254 
4255 	for (i = 0; i < sp->sdb_hashsize; i++) {
4256 		acqlist = &sp->sdb_acq[i];
4257 		mutex_enter(&acqlist->iacqf_lock);
4258 		for (acqrec = acqlist->iacqf_ipsacq; acqrec != NULL;
4259 		    acqrec = spareacq) {
4260 			spareacq = acqrec->ipsacq_next;
4261 			if (current > acqrec->ipsacq_expire)
4262 				sadb_destroy_acquire(acqrec, ns);
4263 		}
4264 		mutex_exit(&acqlist->iacqf_lock);
4265 	}
4266 
4267 	/* Age inbound associations. */
4268 	for (i = 0; i < sp->sdb_hashsize; i++) {
4269 		bucket = &(sp->sdb_if[i]);
4270 		mutex_enter(&bucket->isaf_lock);
4271 		for (assoc = bucket->isaf_ipsa; assoc != NULL;
4272 		    assoc = spare) {
4273 			spare = assoc->ipsa_next;
4274 			if (sadb_age_assoc(bucket, pfkey_q, assoc, current,
4275 			    reap_delay, B_TRUE, &mq) != NULL) {
4276 				/*
4277 				 * Put SA's which have a peer or SA's which
4278 				 * are paired on a list for processing after
4279 				 * all the hash tables have been walked.
4280 				 *
4281 				 * sadb_age_assoc() increments the refcnt,
4282 				 * effectively doing an IPSA_REFHOLD().
4283 				 */
4284 				newbie = kmem_alloc(sizeof (*newbie),
4285 				    KM_NOSLEEP);
4286 				if (newbie == NULL) {
4287 					/*
4288 					 * Don't forget to REFRELE().
4289 					 */
4290 					IPSA_REFRELE(assoc);
4291 					continue;	/* for loop... */
4292 				}
4293 				newbie->next = haspeerlist;
4294 				newbie->ipsa = assoc;
4295 				haspeerlist = newbie;
4296 			}
4297 		}
4298 		mutex_exit(&bucket->isaf_lock);
4299 	}
4300 
4301 	if (mq != NULL) {
4302 		sadb_drain_torchq(ip_q, mq);
4303 		mq = NULL;
4304 	}
4305 	age_pair_peer_list(haspeerlist, sp, B_FALSE);
4306 	haspeerlist = NULL;
4307 
4308 	/* Age outbound associations. */
4309 	for (i = 0; i < sp->sdb_hashsize; i++) {
4310 		bucket = &(sp->sdb_of[i]);
4311 		mutex_enter(&bucket->isaf_lock);
4312 		for (assoc = bucket->isaf_ipsa; assoc != NULL;
4313 		    assoc = spare) {
4314 			spare = assoc->ipsa_next;
4315 			if (sadb_age_assoc(bucket, pfkey_q, assoc, current,
4316 			    reap_delay, B_FALSE, &mq) != NULL) {
4317 				/*
4318 				 * sadb_age_assoc() increments the refcnt,
4319 				 * effectively doing an IPSA_REFHOLD().
4320 				 */
4321 				newbie = kmem_alloc(sizeof (*newbie),
4322 				    KM_NOSLEEP);
4323 				if (newbie == NULL) {
4324 					/*
4325 					 * Don't forget to REFRELE().
4326 					 */
4327 					IPSA_REFRELE(assoc);
4328 					continue;	/* for loop... */
4329 				}
4330 				newbie->next = haspeerlist;
4331 				newbie->ipsa = assoc;
4332 				haspeerlist = newbie;
4333 			}
4334 		}
4335 		mutex_exit(&bucket->isaf_lock);
4336 	}
4337 	if (mq != NULL) {
4338 		sadb_drain_torchq(ip_q, mq);
4339 		mq = NULL;
4340 	}
4341 
4342 	age_pair_peer_list(haspeerlist, sp, B_TRUE);
4343 
4344 	/*
4345 	 * Run a GC pass to clean out dead identities.
4346 	 */
4347 	ipsid_gc(ns);
4348 }
4349 
4350 /*
4351  * Figure out when to reschedule the ager.
4352  */
4353 timeout_id_t
4354 sadb_retimeout(hrtime_t begin, queue_t *pfkey_q, void (*ager)(void *),
4355     void *agerarg, uint_t *intp, uint_t intmax, short mid)
4356 {
4357 	hrtime_t end = gethrtime();
4358 	uint_t interval = *intp;
4359 
4360 	/*
4361 	 * See how long this took.  If it took too long, increase the
4362 	 * aging interval.
4363 	 */
4364 	if ((end - begin) > interval * 1000000) {
4365 		if (interval >= intmax) {
4366 			/* XXX Rate limit this?  Or recommend flush? */
4367 			(void) strlog(mid, 0, 0, SL_ERROR | SL_WARN,
4368 			    "Too many SA's to age out in %d msec.\n",
4369 			    intmax);
4370 		} else {
4371 			/* Double by shifting by one bit. */
4372 			interval <<= 1;
4373 			interval = min(interval, intmax);
4374 		}
4375 	} else if ((end - begin) <= interval * 500000 &&
4376 	    interval > SADB_AGE_INTERVAL_DEFAULT) {
4377 		/*
4378 		 * If I took less than half of the interval, then I should
4379 		 * ratchet the interval back down.  Never automatically
4380 		 * shift below the default aging interval.
4381 		 *
4382 		 * NOTE:This even overrides manual setting of the age
4383 		 *	interval using NDD.
4384 		 */
4385 		/* Halve by shifting one bit. */
4386 		interval >>= 1;
4387 		interval = max(interval, SADB_AGE_INTERVAL_DEFAULT);
4388 	}
4389 	*intp = interval;
4390 	return (qtimeout(pfkey_q, ager, agerarg,
4391 	    interval * drv_usectohz(1000)));
4392 }
4393 
4394 
4395 /*
4396  * Update the lifetime values of an SA.	 This is the path an SADB_UPDATE
4397  * message takes when updating a MATURE or DYING SA.
4398  */
4399 static void
4400 sadb_update_lifetimes(ipsa_t *assoc, sadb_lifetime_t *hard,
4401     sadb_lifetime_t *soft, sadb_lifetime_t *idle, boolean_t outbound)
4402 {
4403 	mutex_enter(&assoc->ipsa_lock);
4404 
4405 	/*
4406 	 * XXX RFC 2367 mentions how an SADB_EXT_LIFETIME_CURRENT can be
4407 	 * passed in during an update message.	We currently don't handle
4408 	 * these.
4409 	 */
4410 
4411 	if (hard != NULL) {
4412 		if (hard->sadb_lifetime_bytes != 0)
4413 			assoc->ipsa_hardbyteslt = hard->sadb_lifetime_bytes;
4414 		if (hard->sadb_lifetime_usetime != 0)
4415 			assoc->ipsa_harduselt = hard->sadb_lifetime_usetime;
4416 		if (hard->sadb_lifetime_addtime != 0)
4417 			assoc->ipsa_hardaddlt = hard->sadb_lifetime_addtime;
4418 		if (assoc->ipsa_hardaddlt != 0) {
4419 			assoc->ipsa_hardexpiretime =
4420 			    assoc->ipsa_addtime + assoc->ipsa_hardaddlt;
4421 		}
4422 		if (assoc->ipsa_harduselt != 0 &&
4423 		    assoc->ipsa_flags & IPSA_F_USED) {
4424 			UPDATE_EXPIRE(assoc, harduselt, hardexpiretime);
4425 		}
4426 		if (hard->sadb_lifetime_allocations != 0)
4427 			assoc->ipsa_hardalloc = hard->sadb_lifetime_allocations;
4428 	}
4429 
4430 	if (soft != NULL) {
4431 		if (soft->sadb_lifetime_bytes != 0) {
4432 			if (soft->sadb_lifetime_bytes >
4433 			    assoc->ipsa_hardbyteslt) {
4434 				assoc->ipsa_softbyteslt =
4435 				    assoc->ipsa_hardbyteslt;
4436 			} else {
4437 				assoc->ipsa_softbyteslt =
4438 				    soft->sadb_lifetime_bytes;
4439 			}
4440 		}
4441 		if (soft->sadb_lifetime_usetime != 0) {
4442 			if (soft->sadb_lifetime_usetime >
4443 			    assoc->ipsa_harduselt) {
4444 				assoc->ipsa_softuselt =
4445 				    assoc->ipsa_harduselt;
4446 			} else {
4447 				assoc->ipsa_softuselt =
4448 				    soft->sadb_lifetime_usetime;
4449 			}
4450 		}
4451 		if (soft->sadb_lifetime_addtime != 0) {
4452 			if (soft->sadb_lifetime_addtime >
4453 			    assoc->ipsa_hardexpiretime) {
4454 				assoc->ipsa_softexpiretime =
4455 				    assoc->ipsa_hardexpiretime;
4456 			} else {
4457 				assoc->ipsa_softaddlt =
4458 				    soft->sadb_lifetime_addtime;
4459 			}
4460 		}
4461 		if (assoc->ipsa_softaddlt != 0) {
4462 			assoc->ipsa_softexpiretime =
4463 			    assoc->ipsa_addtime + assoc->ipsa_softaddlt;
4464 		}
4465 		if (assoc->ipsa_softuselt != 0 &&
4466 		    assoc->ipsa_flags & IPSA_F_USED) {
4467 			UPDATE_EXPIRE(assoc, softuselt, softexpiretime);
4468 		}
4469 		if (outbound && assoc->ipsa_softexpiretime != 0) {
4470 			if (assoc->ipsa_state == IPSA_STATE_MATURE)
4471 				lifetime_fuzz(assoc);
4472 		}
4473 
4474 		if (soft->sadb_lifetime_allocations != 0)
4475 			assoc->ipsa_softalloc = soft->sadb_lifetime_allocations;
4476 	}
4477 
4478 	if (idle != NULL) {
4479 		time_t current = gethrestime_sec();
4480 		if ((assoc->ipsa_idleexpiretime <= current) &&
4481 		    (assoc->ipsa_idleaddlt == idle->sadb_lifetime_addtime)) {
4482 			assoc->ipsa_idleexpiretime =
4483 			    current + assoc->ipsa_idleaddlt;
4484 		}
4485 		if (idle->sadb_lifetime_addtime != 0)
4486 			assoc->ipsa_idleaddlt = idle->sadb_lifetime_addtime;
4487 		if (idle->sadb_lifetime_usetime != 0)
4488 			assoc->ipsa_idleuselt = idle->sadb_lifetime_usetime;
4489 		if (assoc->ipsa_idleaddlt != 0) {
4490 			assoc->ipsa_idleexpiretime =
4491 			    current + idle->sadb_lifetime_addtime;
4492 			assoc->ipsa_idletime = idle->sadb_lifetime_addtime;
4493 		}
4494 		if (assoc->ipsa_idleuselt != 0) {
4495 			if (assoc->ipsa_idletime != 0) {
4496 				assoc->ipsa_idletime = min(assoc->ipsa_idletime,
4497 				    assoc->ipsa_idleuselt);
4498 			assoc->ipsa_idleexpiretime =
4499 			    current + assoc->ipsa_idletime;
4500 			} else {
4501 				assoc->ipsa_idleexpiretime =
4502 				    current + assoc->ipsa_idleuselt;
4503 				assoc->ipsa_idletime = assoc->ipsa_idleuselt;
4504 			}
4505 		}
4506 	}
4507 	mutex_exit(&assoc->ipsa_lock);
4508 }
4509 
4510 static int
4511 sadb_update_state(ipsa_t *assoc, uint_t new_state, mblk_t **ipkt_lst)
4512 {
4513 	int rcode = 0;
4514 	time_t current = gethrestime_sec();
4515 
4516 	mutex_enter(&assoc->ipsa_lock);
4517 
4518 	switch (new_state) {
4519 	case SADB_X_SASTATE_ACTIVE_ELSEWHERE:
4520 		if (assoc->ipsa_state == SADB_X_SASTATE_IDLE) {
4521 			assoc->ipsa_state = IPSA_STATE_ACTIVE_ELSEWHERE;
4522 			assoc->ipsa_idleexpiretime =
4523 			    current + assoc->ipsa_idletime;
4524 		}
4525 		break;
4526 	case SADB_X_SASTATE_IDLE:
4527 		if (assoc->ipsa_state == SADB_X_SASTATE_ACTIVE_ELSEWHERE) {
4528 			assoc->ipsa_state = IPSA_STATE_IDLE;
4529 			assoc->ipsa_idleexpiretime =
4530 			    current + assoc->ipsa_idletime;
4531 		} else {
4532 			rcode = EINVAL;
4533 		}
4534 		break;
4535 
4536 	case SADB_X_SASTATE_ACTIVE:
4537 		if (assoc->ipsa_state != SADB_X_SASTATE_IDLE) {
4538 			rcode = EINVAL;
4539 			break;
4540 		}
4541 		assoc->ipsa_state = IPSA_STATE_MATURE;
4542 		assoc->ipsa_idleexpiretime = current + assoc->ipsa_idletime;
4543 
4544 		if (ipkt_lst == NULL) {
4545 			break;
4546 		}
4547 
4548 		if (assoc->ipsa_bpkt_head != NULL) {
4549 			*ipkt_lst = assoc->ipsa_bpkt_head;
4550 			assoc->ipsa_bpkt_head = assoc->ipsa_bpkt_tail = NULL;
4551 			assoc->ipsa_mblkcnt = 0;
4552 		} else {
4553 			*ipkt_lst = NULL;
4554 		}
4555 		break;
4556 	default:
4557 		rcode = EINVAL;
4558 		break;
4559 	}
4560 
4561 	mutex_exit(&assoc->ipsa_lock);
4562 	return (rcode);
4563 }
4564 
4565 /*
4566  * Common code to update an SA.
4567  */
4568 
4569 int
4570 sadb_update_sa(mblk_t *mp, keysock_in_t *ksi, mblk_t **ipkt_lst,
4571     sadbp_t *spp, int *diagnostic, queue_t *pfkey_q,
4572     int (*add_sa_func)(mblk_t *, keysock_in_t *, int *, netstack_t *),
4573     netstack_t *ns, uint8_t sadb_msg_type)
4574 {
4575 	sadb_sa_t *assoc = (sadb_sa_t *)ksi->ks_in_extv[SADB_EXT_SA];
4576 	sadb_address_t *srcext =
4577 	    (sadb_address_t *)ksi->ks_in_extv[SADB_EXT_ADDRESS_SRC];
4578 	sadb_address_t *dstext =
4579 	    (sadb_address_t *)ksi->ks_in_extv[SADB_EXT_ADDRESS_DST];
4580 	sadb_x_kmc_t *kmcext =
4581 	    (sadb_x_kmc_t *)ksi->ks_in_extv[SADB_X_EXT_KM_COOKIE];
4582 	sadb_key_t *akey = (sadb_key_t *)ksi->ks_in_extv[SADB_EXT_KEY_AUTH];
4583 	sadb_key_t *ekey = (sadb_key_t *)ksi->ks_in_extv[SADB_EXT_KEY_ENCRYPT];
4584 	sadb_x_replay_ctr_t *replext =
4585 	    (sadb_x_replay_ctr_t *)ksi->ks_in_extv[SADB_X_EXT_REPLAY_VALUE];
4586 	sadb_lifetime_t *soft =
4587 	    (sadb_lifetime_t *)ksi->ks_in_extv[SADB_EXT_LIFETIME_SOFT];
4588 	sadb_lifetime_t *hard =
4589 	    (sadb_lifetime_t *)ksi->ks_in_extv[SADB_EXT_LIFETIME_HARD];
4590 	sadb_lifetime_t *idle =
4591 	    (sadb_lifetime_t *)ksi->ks_in_extv[SADB_X_EXT_LIFETIME_IDLE];
4592 	sadb_x_pair_t *pair_ext =
4593 	    (sadb_x_pair_t *)ksi->ks_in_extv[SADB_X_EXT_PAIR];
4594 	ipsa_t *echo_target = NULL;
4595 	int error = 0;
4596 	ipsap_t *ipsapp = NULL;
4597 	uint32_t kmp = 0, kmc = 0;
4598 	time_t current = gethrestime_sec();
4599 
4600 
4601 	/* I need certain extensions present for either UPDATE message. */
4602 	if (srcext == NULL) {
4603 		*diagnostic = SADB_X_DIAGNOSTIC_MISSING_SRC;
4604 		return (EINVAL);
4605 	}
4606 	if (dstext == NULL) {
4607 		*diagnostic = SADB_X_DIAGNOSTIC_MISSING_DST;
4608 		return (EINVAL);
4609 	}
4610 	if (assoc == NULL) {
4611 		*diagnostic = SADB_X_DIAGNOSTIC_MISSING_SA;
4612 		return (EINVAL);
4613 	}
4614 
4615 	if (kmcext != NULL) {
4616 		kmp = kmcext->sadb_x_kmc_proto;
4617 		kmc = kmcext->sadb_x_kmc_cookie;
4618 	}
4619 
4620 	ipsapp = get_ipsa_pair(assoc, srcext, dstext, spp);
4621 	if (ipsapp == NULL) {
4622 		*diagnostic = SADB_X_DIAGNOSTIC_SA_NOTFOUND;
4623 		return (ESRCH);
4624 	}
4625 
4626 	if (ipsapp->ipsap_psa_ptr == NULL && ipsapp->ipsap_sa_ptr != NULL) {
4627 		if (ipsapp->ipsap_sa_ptr->ipsa_state == IPSA_STATE_LARVAL) {
4628 			/*
4629 			 * REFRELE the target and let the add_sa_func()
4630 			 * deal with updating a larval SA.
4631 			 */
4632 			destroy_ipsa_pair(ipsapp);
4633 			return (add_sa_func(mp, ksi, diagnostic, ns));
4634 		}
4635 	}
4636 
4637 	if (assoc->sadb_sa_state == SADB_X_SASTATE_ACTIVE_ELSEWHERE) {
4638 		if (ipsapp->ipsap_sa_ptr != NULL &&
4639 		    ipsapp->ipsap_sa_ptr->ipsa_state == IPSA_STATE_IDLE) {
4640 			if ((error = sadb_update_state(ipsapp->ipsap_sa_ptr,
4641 			    assoc->sadb_sa_state, NULL)) != 0) {
4642 				*diagnostic = SADB_X_DIAGNOSTIC_BAD_SASTATE;
4643 				goto bail;
4644 			}
4645 		}
4646 		if (ipsapp->ipsap_psa_ptr != NULL &&
4647 		    ipsapp->ipsap_psa_ptr->ipsa_state == IPSA_STATE_IDLE) {
4648 			if ((error = sadb_update_state(ipsapp->ipsap_psa_ptr,
4649 			    assoc->sadb_sa_state, NULL)) != 0) {
4650 				*diagnostic = SADB_X_DIAGNOSTIC_BAD_SASTATE;
4651 				goto bail;
4652 			}
4653 		}
4654 	}
4655 	if (assoc->sadb_sa_state == SADB_X_SASTATE_ACTIVE) {
4656 		if (ipsapp->ipsap_sa_ptr != NULL) {
4657 			error = sadb_update_state(ipsapp->ipsap_sa_ptr,
4658 			    assoc->sadb_sa_state,
4659 			    (ipsapp->ipsap_sa_ptr->ipsa_flags &
4660 			    IPSA_F_INBOUND) ? ipkt_lst : NULL);
4661 			if (error) {
4662 				*diagnostic = SADB_X_DIAGNOSTIC_BAD_SASTATE;
4663 				goto bail;
4664 			}
4665 		}
4666 		if (ipsapp->ipsap_psa_ptr != NULL) {
4667 			error = sadb_update_state(ipsapp->ipsap_psa_ptr,
4668 			    assoc->sadb_sa_state,
4669 			    (ipsapp->ipsap_psa_ptr->ipsa_flags &
4670 			    IPSA_F_INBOUND) ? ipkt_lst : NULL);
4671 			if (error) {
4672 				*diagnostic = SADB_X_DIAGNOSTIC_BAD_SASTATE;
4673 				goto bail;
4674 			}
4675 		}
4676 		sadb_pfkey_echo(pfkey_q, mp, (sadb_msg_t *)mp->b_cont->b_rptr,
4677 		    ksi, echo_target);
4678 		goto bail;
4679 	}
4680 
4681 	/*
4682 	 * Reality checks for updates of active associations.
4683 	 * Sundry first-pass UPDATE-specific reality checks.
4684 	 * Have to do the checks here, because it's after the add_sa code.
4685 	 * XXX STATS : logging/stats here?
4686 	 */
4687 
4688 	if (!((assoc->sadb_sa_state == SADB_SASTATE_MATURE) ||
4689 	    (assoc->sadb_sa_state == SADB_X_SASTATE_ACTIVE_ELSEWHERE))) {
4690 		*diagnostic = SADB_X_DIAGNOSTIC_BAD_SASTATE;
4691 		error = EINVAL;
4692 		goto bail;
4693 	}
4694 
4695 	if (assoc->sadb_sa_flags & ~spp->s_updateflags) {
4696 		*diagnostic = SADB_X_DIAGNOSTIC_BAD_SAFLAGS;
4697 		error = EINVAL;
4698 		goto bail;
4699 	}
4700 
4701 	if (ksi->ks_in_extv[SADB_EXT_LIFETIME_CURRENT] != NULL) {
4702 		error = EOPNOTSUPP;
4703 		goto bail;
4704 	}
4705 
4706 	if ((*diagnostic = sadb_hardsoftchk(hard, soft, idle)) != 0) {
4707 		error = EINVAL;
4708 		goto bail;
4709 	}
4710 	if (akey != NULL) {
4711 		*diagnostic = SADB_X_DIAGNOSTIC_AKEY_PRESENT;
4712 		error = EINVAL;
4713 		goto bail;
4714 	}
4715 	if (ekey != NULL) {
4716 		*diagnostic = SADB_X_DIAGNOSTIC_EKEY_PRESENT;
4717 		error = EINVAL;
4718 		goto bail;
4719 	}
4720 
4721 	if (ipsapp->ipsap_sa_ptr != NULL) {
4722 		if (ipsapp->ipsap_sa_ptr->ipsa_state == IPSA_STATE_DEAD) {
4723 			error = ESRCH;	/* DEAD == Not there, in this case. */
4724 			*diagnostic = SADB_X_DIAGNOSTIC_SA_EXPIRED;
4725 			goto bail;
4726 		}
4727 		if ((kmp != 0) &&
4728 		    ((ipsapp->ipsap_sa_ptr->ipsa_kmp != 0) ||
4729 		    (ipsapp->ipsap_sa_ptr->ipsa_kmp != kmp))) {
4730 			*diagnostic = SADB_X_DIAGNOSTIC_DUPLICATE_KMP;
4731 			error = EINVAL;
4732 			goto bail;
4733 		}
4734 		if ((kmc != 0) &&
4735 		    ((ipsapp->ipsap_sa_ptr->ipsa_kmc != 0) ||
4736 		    (ipsapp->ipsap_sa_ptr->ipsa_kmc != kmc))) {
4737 			*diagnostic = SADB_X_DIAGNOSTIC_DUPLICATE_KMC;
4738 			error = EINVAL;
4739 			goto bail;
4740 		}
4741 		/*
4742 		 * Do not allow replay value change for MATURE or LARVAL SA.
4743 		 */
4744 
4745 		if ((replext != NULL) &&
4746 		    ((ipsapp->ipsap_sa_ptr->ipsa_state == IPSA_STATE_LARVAL) ||
4747 		    (ipsapp->ipsap_sa_ptr->ipsa_state == IPSA_STATE_MATURE))) {
4748 			*diagnostic = SADB_X_DIAGNOSTIC_BAD_SASTATE;
4749 			error = EINVAL;
4750 			goto bail;
4751 		}
4752 	}
4753 
4754 	if (ipsapp->ipsap_psa_ptr != NULL) {
4755 		if (ipsapp->ipsap_psa_ptr->ipsa_state == IPSA_STATE_DEAD) {
4756 			*diagnostic = SADB_X_DIAGNOSTIC_SA_EXPIRED;
4757 			error = ESRCH;	/* DEAD == Not there, in this case. */
4758 			goto bail;
4759 		}
4760 		if ((kmp != 0) &&
4761 		    ((ipsapp->ipsap_psa_ptr->ipsa_kmp != 0) ||
4762 		    (ipsapp->ipsap_psa_ptr->ipsa_kmp != kmp))) {
4763 			*diagnostic = SADB_X_DIAGNOSTIC_DUPLICATE_KMP;
4764 			error = EINVAL;
4765 			goto bail;
4766 		}
4767 		if ((kmc != 0) &&
4768 		    ((ipsapp->ipsap_psa_ptr->ipsa_kmc != 0) ||
4769 		    (ipsapp->ipsap_psa_ptr->ipsa_kmc != kmc))) {
4770 			*diagnostic = SADB_X_DIAGNOSTIC_DUPLICATE_KMC;
4771 			error = EINVAL;
4772 			goto bail;
4773 		}
4774 	}
4775 
4776 	if (ipsapp->ipsap_sa_ptr != NULL) {
4777 		sadb_update_lifetimes(ipsapp->ipsap_sa_ptr, hard, soft,
4778 		    idle, B_TRUE);
4779 		if (kmp != 0)
4780 			ipsapp->ipsap_sa_ptr->ipsa_kmp = kmp;
4781 		if (kmc != 0)
4782 			ipsapp->ipsap_sa_ptr->ipsa_kmc = kmc;
4783 		if ((replext != NULL) &&
4784 		    (ipsapp->ipsap_sa_ptr->ipsa_replay_wsize != 0)) {
4785 			/*
4786 			 * If an inbound SA, update the replay counter
4787 			 * and check off all the other sequence number
4788 			 */
4789 			if (ksi->ks_in_dsttype == KS_IN_ADDR_ME) {
4790 				if (!sadb_replay_check(ipsapp->ipsap_sa_ptr,
4791 				    replext->sadb_x_rc_replay32)) {
4792 					error = EINVAL;
4793 					goto bail;
4794 				}
4795 				mutex_enter(&ipsapp->ipsap_sa_ptr->ipsa_lock);
4796 				ipsapp->ipsap_sa_ptr->ipsa_idleexpiretime =
4797 				    current +
4798 				    ipsapp->ipsap_sa_ptr->ipsa_idletime;
4799 				mutex_exit(&ipsapp->ipsap_sa_ptr->ipsa_lock);
4800 			} else {
4801 				mutex_enter(&ipsapp->ipsap_sa_ptr->ipsa_lock);
4802 				ipsapp->ipsap_sa_ptr->ipsa_replay =
4803 				    replext->sadb_x_rc_replay32;
4804 				ipsapp->ipsap_sa_ptr->ipsa_idleexpiretime =
4805 				    current +
4806 				    ipsapp->ipsap_sa_ptr->ipsa_idletime;
4807 				mutex_exit(&ipsapp->ipsap_sa_ptr->ipsa_lock);
4808 			}
4809 		}
4810 	}
4811 
4812 	if (sadb_msg_type == SADB_X_UPDATEPAIR) {
4813 		if (ipsapp->ipsap_psa_ptr != NULL) {
4814 			sadb_update_lifetimes(ipsapp->ipsap_psa_ptr, hard, soft,
4815 			    idle, B_FALSE);
4816 			if (kmp != 0)
4817 				ipsapp->ipsap_psa_ptr->ipsa_kmp = kmp;
4818 			if (kmc != 0)
4819 				ipsapp->ipsap_psa_ptr->ipsa_kmc = kmc;
4820 		} else {
4821 			*diagnostic = SADB_X_DIAGNOSTIC_PAIR_SA_NOTFOUND;
4822 			error = ESRCH;
4823 			goto bail;
4824 		}
4825 	}
4826 
4827 	if (pair_ext != NULL)
4828 		error = update_pairing(ipsapp, ksi, diagnostic, spp);
4829 
4830 	if (error == 0)
4831 		sadb_pfkey_echo(pfkey_q, mp, (sadb_msg_t *)mp->b_cont->b_rptr,
4832 		    ksi, echo_target);
4833 bail:
4834 
4835 	destroy_ipsa_pair(ipsapp);
4836 
4837 	return (error);
4838 }
4839 
4840 
4841 int
4842 update_pairing(ipsap_t *ipsapp, keysock_in_t *ksi, int *diagnostic,
4843     sadbp_t *spp)
4844 {
4845 	sadb_sa_t *assoc = (sadb_sa_t *)ksi->ks_in_extv[SADB_EXT_SA];
4846 	sadb_address_t *srcext =
4847 	    (sadb_address_t *)ksi->ks_in_extv[SADB_EXT_ADDRESS_SRC];
4848 	sadb_address_t *dstext =
4849 	    (sadb_address_t *)ksi->ks_in_extv[SADB_EXT_ADDRESS_DST];
4850 	sadb_x_pair_t *pair_ext =
4851 	    (sadb_x_pair_t *)ksi->ks_in_extv[SADB_X_EXT_PAIR];
4852 	int error = 0;
4853 	ipsap_t *oipsapp = NULL;
4854 	boolean_t undo_pair = B_FALSE;
4855 	uint32_t ipsa_flags;
4856 
4857 	if (pair_ext->sadb_x_pair_spi == 0 || pair_ext->sadb_x_pair_spi ==
4858 	    assoc->sadb_sa_spi) {
4859 		*diagnostic = SADB_X_DIAGNOSTIC_PAIR_INAPPROPRIATE;
4860 		return (EINVAL);
4861 	}
4862 
4863 	/*
4864 	 * Assume for now that the spi value provided in the SADB_UPDATE
4865 	 * message was valid, update the SA with its pair spi value.
4866 	 * If the spi turns out to be bogus or the SA no longer exists
4867 	 * then this will be detected when the reverse update is made
4868 	 * below.
4869 	 */
4870 	mutex_enter(&ipsapp->ipsap_sa_ptr->ipsa_lock);
4871 	ipsapp->ipsap_sa_ptr->ipsa_flags |= IPSA_F_PAIRED;
4872 	ipsapp->ipsap_sa_ptr->ipsa_otherspi = pair_ext->sadb_x_pair_spi;
4873 	mutex_exit(&ipsapp->ipsap_sa_ptr->ipsa_lock);
4874 
4875 	/*
4876 	 * After updating the ipsa_otherspi element of the SA, get_ipsa_pair()
4877 	 * should now return pointers to the SA *AND* its pair, if this is not
4878 	 * the case, the "otherspi" either did not exist or was deleted. Also
4879 	 * check that "otherspi" is not already paired. If everything looks
4880 	 * good, complete the update. IPSA_REFRELE the first pair_pointer
4881 	 * after this update to ensure its not deleted until we are done.
4882 	 */
4883 	oipsapp = get_ipsa_pair(assoc, srcext, dstext, spp);
4884 	if (oipsapp == NULL) {
4885 		/*
4886 		 * This should never happen, calling function still has
4887 		 * IPSA_REFHELD on the SA we just updated.
4888 		 */
4889 		*diagnostic = SADB_X_DIAGNOSTIC_PAIR_SA_NOTFOUND;
4890 		return (EINVAL);
4891 	}
4892 
4893 	if (oipsapp->ipsap_psa_ptr == NULL) {
4894 		*diagnostic = SADB_X_DIAGNOSTIC_PAIR_INAPPROPRIATE;
4895 		undo_pair = B_TRUE;
4896 	} else {
4897 		ipsa_flags = oipsapp->ipsap_psa_ptr->ipsa_flags;
4898 		if ((oipsapp->ipsap_psa_ptr->ipsa_state == IPSA_STATE_DEAD) ||
4899 		    (oipsapp->ipsap_psa_ptr->ipsa_state == IPSA_STATE_DYING)) {
4900 			/* Its dead Jim! */
4901 			*diagnostic = SADB_X_DIAGNOSTIC_PAIR_INAPPROPRIATE;
4902 			undo_pair = B_TRUE;
4903 		} else if ((ipsa_flags & (IPSA_F_OUTBOUND | IPSA_F_INBOUND)) ==
4904 		    (IPSA_F_OUTBOUND | IPSA_F_INBOUND)) {
4905 			/* This SA is in both hashtables. */
4906 			*diagnostic = SADB_X_DIAGNOSTIC_PAIR_INAPPROPRIATE;
4907 			undo_pair = B_TRUE;
4908 		} else if (ipsa_flags & IPSA_F_PAIRED) {
4909 			/* This SA is already paired with another. */
4910 			*diagnostic = SADB_X_DIAGNOSTIC_PAIR_ALREADY;
4911 			undo_pair = B_TRUE;
4912 		}
4913 	}
4914 
4915 	if (undo_pair) {
4916 		/* The pair SA does not exist. */
4917 		mutex_enter(&ipsapp->ipsap_sa_ptr->ipsa_lock);
4918 		ipsapp->ipsap_sa_ptr->ipsa_flags &= ~IPSA_F_PAIRED;
4919 		ipsapp->ipsap_sa_ptr->ipsa_otherspi = 0;
4920 		mutex_exit(&ipsapp->ipsap_sa_ptr->ipsa_lock);
4921 		error = EINVAL;
4922 	} else {
4923 		mutex_enter(&oipsapp->ipsap_psa_ptr->ipsa_lock);
4924 		oipsapp->ipsap_psa_ptr->ipsa_otherspi = assoc->sadb_sa_spi;
4925 		oipsapp->ipsap_psa_ptr->ipsa_flags |= IPSA_F_PAIRED;
4926 		mutex_exit(&oipsapp->ipsap_psa_ptr->ipsa_lock);
4927 	}
4928 
4929 	destroy_ipsa_pair(oipsapp);
4930 	return (error);
4931 }
4932 
4933 /*
4934  * The following functions deal with ACQUIRE LISTS.  An ACQUIRE list is
4935  * a list of outstanding SADB_ACQUIRE messages.	 If ipsec_getassocbyconn() fails
4936  * for an outbound datagram, that datagram is queued up on an ACQUIRE record,
4937  * and an SADB_ACQUIRE message is sent up.  Presumably, a user-space key
4938  * management daemon will process the ACQUIRE, use a SADB_GETSPI to reserve
4939  * an SPI value and a larval SA, then SADB_UPDATE the larval SA, and ADD the
4940  * other direction's SA.
4941  */
4942 
4943 /*
4944  * Check the ACQUIRE lists.  If there's an existing ACQUIRE record,
4945  * grab it, lock it, and return it.  Otherwise return NULL.
4946  */
4947 static ipsacq_t *
4948 sadb_checkacquire(iacqf_t *bucket, ipsec_action_t *ap, ipsec_policy_t *pp,
4949     uint32_t *src, uint32_t *dst, uint32_t *isrc, uint32_t *idst,
4950     uint64_t unique_id)
4951 {
4952 	ipsacq_t *walker;
4953 	sa_family_t fam;
4954 	uint32_t blank_address[4] = {0, 0, 0, 0};
4955 
4956 	if (isrc == NULL) {
4957 		ASSERT(idst == NULL);
4958 		isrc = idst = blank_address;
4959 	}
4960 
4961 	/*
4962 	 * Scan list for duplicates.  Check for UNIQUE, src/dest, policy.
4963 	 *
4964 	 * XXX May need search for duplicates based on other things too!
4965 	 */
4966 	for (walker = bucket->iacqf_ipsacq; walker != NULL;
4967 	    walker = walker->ipsacq_next) {
4968 		mutex_enter(&walker->ipsacq_lock);
4969 		fam = walker->ipsacq_addrfam;
4970 		if (IPSA_ARE_ADDR_EQUAL(dst, walker->ipsacq_dstaddr, fam) &&
4971 		    IPSA_ARE_ADDR_EQUAL(src, walker->ipsacq_srcaddr, fam) &&
4972 		    ip_addr_match((uint8_t *)isrc, walker->ipsacq_innersrcpfx,
4973 		    (in6_addr_t *)walker->ipsacq_innersrc) &&
4974 		    ip_addr_match((uint8_t *)idst, walker->ipsacq_innerdstpfx,
4975 		    (in6_addr_t *)walker->ipsacq_innerdst) &&
4976 		    (ap == walker->ipsacq_act) &&
4977 		    (pp == walker->ipsacq_policy) &&
4978 		    /* XXX do deep compares of ap/pp? */
4979 		    (unique_id == walker->ipsacq_unique_id))
4980 			break;			/* everything matched */
4981 		mutex_exit(&walker->ipsacq_lock);
4982 	}
4983 
4984 	return (walker);
4985 }
4986 
4987 /*
4988  * For this mblk, insert a new acquire record.  Assume bucket contains addrs
4989  * of all of the same length.  Give up (and drop) if memory
4990  * cannot be allocated for a new one; otherwise, invoke callback to
4991  * send the acquire up..
4992  *
4993  * In cases where we need both AH and ESP, add the SA to the ESP ACQUIRE
4994  * list.  The ah_add_sa_finish() routines can look at the packet's ipsec_out_t
4995  * and handle this case specially.
4996  */
4997 void
4998 sadb_acquire(mblk_t *mp, ipsec_out_t *io, boolean_t need_ah, boolean_t need_esp)
4999 {
5000 	sadbp_t *spp;
5001 	sadb_t *sp;
5002 	ipsacq_t *newbie;
5003 	iacqf_t *bucket;
5004 	mblk_t *datamp = mp->b_cont;
5005 	mblk_t *extended;
5006 	ipha_t *ipha = (ipha_t *)datamp->b_rptr;
5007 	ip6_t *ip6h = (ip6_t *)datamp->b_rptr;
5008 	uint32_t *src, *dst, *isrc, *idst;
5009 	ipsec_policy_t *pp = io->ipsec_out_policy;
5010 	ipsec_action_t *ap = io->ipsec_out_act;
5011 	sa_family_t af;
5012 	int hashoffset;
5013 	uint32_t seq;
5014 	uint64_t unique_id = 0;
5015 	ipsec_selector_t sel;
5016 	boolean_t tunnel_mode = io->ipsec_out_tunnel;
5017 	netstack_t	*ns = io->ipsec_out_ns;
5018 	ipsec_stack_t	*ipss = ns->netstack_ipsec;
5019 
5020 	ASSERT((pp != NULL) || (ap != NULL));
5021 
5022 	ASSERT(need_ah != NULL || need_esp != NULL);
5023 	/* Assign sadb pointers */
5024 	if (need_esp) { /* ESP for AH+ESP */
5025 		ipsecesp_stack_t *espstack = ns->netstack_ipsecesp;
5026 
5027 		spp = &espstack->esp_sadb;
5028 	} else {
5029 		ipsecah_stack_t	*ahstack = ns->netstack_ipsecah;
5030 
5031 		spp = &ahstack->ah_sadb;
5032 	}
5033 	sp = io->ipsec_out_v4 ? &spp->s_v4 : &spp->s_v6;
5034 
5035 	if (ap == NULL)
5036 		ap = pp->ipsp_act;
5037 
5038 	ASSERT(ap != NULL);
5039 
5040 	if (ap->ipa_act.ipa_apply.ipp_use_unique || tunnel_mode)
5041 		unique_id = SA_FORM_UNIQUE_ID(io);
5042 
5043 	/*
5044 	 * Set up an ACQUIRE record.
5045 	 *
5046 	 * Immediately, make sure the ACQUIRE sequence number doesn't slip
5047 	 * below the lowest point allowed in the kernel.  (In other words,
5048 	 * make sure the high bit on the sequence number is set.)
5049 	 */
5050 
5051 	seq = keysock_next_seq(ns) | IACQF_LOWEST_SEQ;
5052 
5053 	if (IPH_HDR_VERSION(ipha) == IP_VERSION) {
5054 		src = (uint32_t *)&ipha->ipha_src;
5055 		dst = (uint32_t *)&ipha->ipha_dst;
5056 		af = AF_INET;
5057 		hashoffset = OUTBOUND_HASH_V4(sp, ipha->ipha_dst);
5058 		ASSERT(io->ipsec_out_v4 == B_TRUE);
5059 	} else {
5060 		ASSERT(IPH_HDR_VERSION(ipha) == IPV6_VERSION);
5061 		src = (uint32_t *)&ip6h->ip6_src;
5062 		dst = (uint32_t *)&ip6h->ip6_dst;
5063 		af = AF_INET6;
5064 		hashoffset = OUTBOUND_HASH_V6(sp, ip6h->ip6_dst);
5065 		ASSERT(io->ipsec_out_v4 == B_FALSE);
5066 	}
5067 
5068 	if (tunnel_mode) {
5069 		if (pp == NULL) {
5070 			/*
5071 			 * Tunnel mode with no policy pointer means this is a
5072 			 * reflected ICMP (like a ECHO REQUEST) that came in
5073 			 * with self-encapsulated protection.  Until we better
5074 			 * support this, drop the packet.
5075 			 */
5076 			ip_drop_packet(mp, B_FALSE, NULL, NULL,
5077 			    DROPPER(ipss, ipds_spd_got_selfencap),
5078 			    &ipss->ipsec_spd_dropper);
5079 			return;
5080 		}
5081 		/* Snag inner addresses. */
5082 		isrc = io->ipsec_out_insrc;
5083 		idst = io->ipsec_out_indst;
5084 	} else {
5085 		isrc = idst = NULL;
5086 	}
5087 
5088 	/*
5089 	 * Check buckets to see if there is an existing entry.  If so,
5090 	 * grab it.  sadb_checkacquire locks newbie if found.
5091 	 */
5092 	bucket = &(sp->sdb_acq[hashoffset]);
5093 	mutex_enter(&bucket->iacqf_lock);
5094 	newbie = sadb_checkacquire(bucket, ap, pp, src, dst, isrc, idst,
5095 	    unique_id);
5096 
5097 	if (newbie == NULL) {
5098 		/*
5099 		 * Otherwise, allocate a new one.
5100 		 */
5101 		newbie = kmem_zalloc(sizeof (*newbie), KM_NOSLEEP);
5102 		if (newbie == NULL) {
5103 			mutex_exit(&bucket->iacqf_lock);
5104 			ip_drop_packet(mp, B_FALSE, NULL, NULL,
5105 			    DROPPER(ipss, ipds_sadb_acquire_nomem),
5106 			    &ipss->ipsec_sadb_dropper);
5107 			return;
5108 		}
5109 		newbie->ipsacq_policy = pp;
5110 		if (pp != NULL) {
5111 			IPPOL_REFHOLD(pp);
5112 		}
5113 		IPACT_REFHOLD(ap);
5114 		newbie->ipsacq_act = ap;
5115 		newbie->ipsacq_linklock = &bucket->iacqf_lock;
5116 		newbie->ipsacq_next = bucket->iacqf_ipsacq;
5117 		newbie->ipsacq_ptpn = &bucket->iacqf_ipsacq;
5118 		if (newbie->ipsacq_next != NULL)
5119 			newbie->ipsacq_next->ipsacq_ptpn = &newbie->ipsacq_next;
5120 		bucket->iacqf_ipsacq = newbie;
5121 		mutex_init(&newbie->ipsacq_lock, NULL, MUTEX_DEFAULT, NULL);
5122 		mutex_enter(&newbie->ipsacq_lock);
5123 	}
5124 
5125 	mutex_exit(&bucket->iacqf_lock);
5126 
5127 	/*
5128 	 * This assert looks silly for now, but we may need to enter newbie's
5129 	 * mutex during a search.
5130 	 */
5131 	ASSERT(MUTEX_HELD(&newbie->ipsacq_lock));
5132 
5133 	mp->b_next = NULL;
5134 	/* Queue up packet.  Use b_next. */
5135 	if (newbie->ipsacq_numpackets == 0) {
5136 		/* First one. */
5137 		newbie->ipsacq_mp = mp;
5138 		newbie->ipsacq_numpackets = 1;
5139 		newbie->ipsacq_expire = gethrestime_sec();
5140 		/*
5141 		 * Extended ACQUIRE with both AH+ESP will use ESP's timeout
5142 		 * value.
5143 		 */
5144 		newbie->ipsacq_expire += *spp->s_acquire_timeout;
5145 		newbie->ipsacq_seq = seq;
5146 		newbie->ipsacq_addrfam = af;
5147 
5148 		newbie->ipsacq_srcport = io->ipsec_out_src_port;
5149 		newbie->ipsacq_dstport = io->ipsec_out_dst_port;
5150 		newbie->ipsacq_icmp_type = io->ipsec_out_icmp_type;
5151 		newbie->ipsacq_icmp_code = io->ipsec_out_icmp_code;
5152 		if (tunnel_mode) {
5153 			newbie->ipsacq_inneraddrfam = io->ipsec_out_inaf;
5154 			newbie->ipsacq_proto = io->ipsec_out_inaf == AF_INET6 ?
5155 			    IPPROTO_IPV6 : IPPROTO_ENCAP;
5156 			newbie->ipsacq_innersrcpfx = io->ipsec_out_insrcpfx;
5157 			newbie->ipsacq_innerdstpfx = io->ipsec_out_indstpfx;
5158 			IPSA_COPY_ADDR(newbie->ipsacq_innersrc,
5159 			    io->ipsec_out_insrc, io->ipsec_out_inaf);
5160 			IPSA_COPY_ADDR(newbie->ipsacq_innerdst,
5161 			    io->ipsec_out_indst, io->ipsec_out_inaf);
5162 		} else {
5163 			newbie->ipsacq_proto = io->ipsec_out_proto;
5164 		}
5165 		newbie->ipsacq_unique_id = unique_id;
5166 	} else {
5167 		/* Scan to the end of the list & insert. */
5168 		mblk_t *lastone = newbie->ipsacq_mp;
5169 
5170 		while (lastone->b_next != NULL)
5171 			lastone = lastone->b_next;
5172 		lastone->b_next = mp;
5173 		if (newbie->ipsacq_numpackets++ == ipsacq_maxpackets) {
5174 			newbie->ipsacq_numpackets = ipsacq_maxpackets;
5175 			lastone = newbie->ipsacq_mp;
5176 			newbie->ipsacq_mp = lastone->b_next;
5177 			lastone->b_next = NULL;
5178 			ip_drop_packet(lastone, B_FALSE, NULL, NULL,
5179 			    DROPPER(ipss, ipds_sadb_acquire_toofull),
5180 			    &ipss->ipsec_sadb_dropper);
5181 		} else {
5182 			IP_ACQUIRE_STAT(ipss, qhiwater,
5183 			    newbie->ipsacq_numpackets);
5184 		}
5185 	}
5186 
5187 	/*
5188 	 * Reset addresses.  Set them to the most recently added mblk chain,
5189 	 * so that the address pointers in the acquire record will point
5190 	 * at an mblk still attached to the acquire list.
5191 	 */
5192 
5193 	newbie->ipsacq_srcaddr = src;
5194 	newbie->ipsacq_dstaddr = dst;
5195 
5196 	/*
5197 	 * If the acquire record has more than one queued packet, we've
5198 	 * already sent an ACQUIRE, and don't need to repeat ourself.
5199 	 */
5200 	if (newbie->ipsacq_seq != seq || newbie->ipsacq_numpackets > 1) {
5201 		/* I have an acquire outstanding already! */
5202 		mutex_exit(&newbie->ipsacq_lock);
5203 		return;
5204 	}
5205 
5206 	if (keysock_extended_reg(ns)) {
5207 		/*
5208 		 * Construct an extended ACQUIRE.  There are logging
5209 		 * opportunities here in failure cases.
5210 		 */
5211 
5212 		(void) memset(&sel, 0, sizeof (sel));
5213 		sel.ips_isv4 = io->ipsec_out_v4;
5214 		if (tunnel_mode) {
5215 			sel.ips_protocol = (io->ipsec_out_inaf == AF_INET) ?
5216 			    IPPROTO_ENCAP : IPPROTO_IPV6;
5217 		} else {
5218 			sel.ips_protocol = io->ipsec_out_proto;
5219 			sel.ips_local_port = io->ipsec_out_src_port;
5220 			sel.ips_remote_port = io->ipsec_out_dst_port;
5221 		}
5222 		sel.ips_icmp_type = io->ipsec_out_icmp_type;
5223 		sel.ips_icmp_code = io->ipsec_out_icmp_code;
5224 		sel.ips_is_icmp_inv_acq = 0;
5225 		if (af == AF_INET) {
5226 			sel.ips_local_addr_v4 = ipha->ipha_src;
5227 			sel.ips_remote_addr_v4 = ipha->ipha_dst;
5228 		} else {
5229 			sel.ips_local_addr_v6 = ip6h->ip6_src;
5230 			sel.ips_remote_addr_v6 = ip6h->ip6_dst;
5231 		}
5232 
5233 		extended = sadb_keysock_out(0);
5234 		if (extended != NULL) {
5235 			extended->b_cont = sadb_extended_acquire(&sel, pp, ap,
5236 			    tunnel_mode, seq, 0, ns);
5237 			if (extended->b_cont == NULL) {
5238 				freeb(extended);
5239 				extended = NULL;
5240 			}
5241 		}
5242 	} else
5243 		extended = NULL;
5244 
5245 	/*
5246 	 * Send an ACQUIRE message (and possible an extended ACQUIRE) based on
5247 	 * this new record.  The send-acquire callback assumes that acqrec is
5248 	 * already locked.
5249 	 */
5250 	(*spp->s_acqfn)(newbie, extended, ns);
5251 }
5252 
5253 /*
5254  * Unlink and free an acquire record.
5255  */
5256 void
5257 sadb_destroy_acquire(ipsacq_t *acqrec, netstack_t *ns)
5258 {
5259 	mblk_t *mp;
5260 	ipsec_stack_t	*ipss = ns->netstack_ipsec;
5261 
5262 	ASSERT(MUTEX_HELD(acqrec->ipsacq_linklock));
5263 
5264 	if (acqrec->ipsacq_policy != NULL) {
5265 		IPPOL_REFRELE(acqrec->ipsacq_policy, ns);
5266 	}
5267 	if (acqrec->ipsacq_act != NULL) {
5268 		IPACT_REFRELE(acqrec->ipsacq_act);
5269 	}
5270 
5271 	/* Unlink */
5272 	*(acqrec->ipsacq_ptpn) = acqrec->ipsacq_next;
5273 	if (acqrec->ipsacq_next != NULL)
5274 		acqrec->ipsacq_next->ipsacq_ptpn = acqrec->ipsacq_ptpn;
5275 
5276 	/*
5277 	 * Free hanging mp's.
5278 	 *
5279 	 * XXX Instead of freemsg(), perhaps use IPSEC_REQ_FAILED.
5280 	 */
5281 
5282 	mutex_enter(&acqrec->ipsacq_lock);
5283 	while (acqrec->ipsacq_mp != NULL) {
5284 		mp = acqrec->ipsacq_mp;
5285 		acqrec->ipsacq_mp = mp->b_next;
5286 		mp->b_next = NULL;
5287 		ip_drop_packet(mp, B_FALSE, NULL, NULL,
5288 		    DROPPER(ipss, ipds_sadb_acquire_timeout),
5289 		    &ipss->ipsec_sadb_dropper);
5290 	}
5291 	mutex_exit(&acqrec->ipsacq_lock);
5292 
5293 	/* Free */
5294 	mutex_destroy(&acqrec->ipsacq_lock);
5295 	kmem_free(acqrec, sizeof (*acqrec));
5296 }
5297 
5298 /*
5299  * Destroy an acquire list fanout.
5300  */
5301 static void
5302 sadb_destroy_acqlist(iacqf_t **listp, uint_t numentries, boolean_t forever,
5303     netstack_t *ns)
5304 {
5305 	int i;
5306 	iacqf_t *list = *listp;
5307 
5308 	if (list == NULL)
5309 		return;
5310 
5311 	for (i = 0; i < numentries; i++) {
5312 		mutex_enter(&(list[i].iacqf_lock));
5313 		while (list[i].iacqf_ipsacq != NULL)
5314 			sadb_destroy_acquire(list[i].iacqf_ipsacq, ns);
5315 		mutex_exit(&(list[i].iacqf_lock));
5316 		if (forever)
5317 			mutex_destroy(&(list[i].iacqf_lock));
5318 	}
5319 
5320 	if (forever) {
5321 		*listp = NULL;
5322 		kmem_free(list, numentries * sizeof (*list));
5323 	}
5324 }
5325 
5326 /*
5327  * Create an algorithm descriptor for an extended ACQUIRE.  Filter crypto
5328  * framework's view of reality vs. IPsec's.  EF's wins, BTW.
5329  */
5330 static uint8_t *
5331 sadb_new_algdesc(uint8_t *start, uint8_t *limit,
5332     sadb_x_ecomb_t *ecomb, uint8_t satype, uint8_t algtype,
5333     uint8_t alg, uint16_t minbits, uint16_t maxbits, ipsec_stack_t *ipss)
5334 {
5335 	uint8_t *cur = start;
5336 	ipsec_alginfo_t *algp;
5337 	sadb_x_algdesc_t *algdesc = (sadb_x_algdesc_t *)cur;
5338 
5339 	cur += sizeof (*algdesc);
5340 	if (cur >= limit)
5341 		return (NULL);
5342 
5343 	ecomb->sadb_x_ecomb_numalgs++;
5344 
5345 	/*
5346 	 * Normalize vs. crypto framework's limits.  This way, you can specify
5347 	 * a stronger policy, and when the framework loads a stronger version,
5348 	 * you can just keep plowing w/o rewhacking your SPD.
5349 	 */
5350 	mutex_enter(&ipss->ipsec_alg_lock);
5351 	algp = ipss->ipsec_alglists[(algtype == SADB_X_ALGTYPE_AUTH) ?
5352 	    IPSEC_ALG_AUTH : IPSEC_ALG_ENCR][alg];
5353 	if (algp == NULL) {
5354 		mutex_exit(&ipss->ipsec_alg_lock);
5355 		return (NULL);	/* Algorithm doesn't exist.  Fail gracefully. */
5356 	}
5357 	if (minbits < algp->alg_ef_minbits)
5358 		minbits = algp->alg_ef_minbits;
5359 	if (maxbits > algp->alg_ef_maxbits)
5360 		maxbits = algp->alg_ef_maxbits;
5361 	mutex_exit(&ipss->ipsec_alg_lock);
5362 
5363 	algdesc->sadb_x_algdesc_satype = satype;
5364 	algdesc->sadb_x_algdesc_algtype = algtype;
5365 	algdesc->sadb_x_algdesc_alg = alg;
5366 	algdesc->sadb_x_algdesc_minbits = minbits;
5367 	algdesc->sadb_x_algdesc_maxbits = maxbits;
5368 	algdesc->sadb_x_algdesc_reserved = 0;
5369 	return (cur);
5370 }
5371 
5372 /*
5373  * Convert the given ipsec_action_t into an ecomb starting at *ecomb
5374  * which must fit before *limit
5375  *
5376  * return NULL if we ran out of room or a pointer to the end of the ecomb.
5377  */
5378 static uint8_t *
5379 sadb_action_to_ecomb(uint8_t *start, uint8_t *limit, ipsec_action_t *act,
5380     netstack_t *ns)
5381 {
5382 	uint8_t *cur = start;
5383 	sadb_x_ecomb_t *ecomb = (sadb_x_ecomb_t *)cur;
5384 	ipsec_prot_t *ipp;
5385 	ipsec_stack_t *ipss = ns->netstack_ipsec;
5386 
5387 	cur += sizeof (*ecomb);
5388 	if (cur >= limit)
5389 		return (NULL);
5390 
5391 	ASSERT(act->ipa_act.ipa_type == IPSEC_ACT_APPLY);
5392 
5393 	ipp = &act->ipa_act.ipa_apply;
5394 
5395 	ecomb->sadb_x_ecomb_numalgs = 0;
5396 	ecomb->sadb_x_ecomb_reserved = 0;
5397 	ecomb->sadb_x_ecomb_reserved2 = 0;
5398 	/*
5399 	 * No limits on allocations, since we really don't support that
5400 	 * concept currently.
5401 	 */
5402 	ecomb->sadb_x_ecomb_soft_allocations = 0;
5403 	ecomb->sadb_x_ecomb_hard_allocations = 0;
5404 
5405 	/*
5406 	 * XXX TBD: Policy or global parameters will eventually be
5407 	 * able to fill in some of these.
5408 	 */
5409 	ecomb->sadb_x_ecomb_flags = 0;
5410 	ecomb->sadb_x_ecomb_soft_bytes = 0;
5411 	ecomb->sadb_x_ecomb_hard_bytes = 0;
5412 	ecomb->sadb_x_ecomb_soft_addtime = 0;
5413 	ecomb->sadb_x_ecomb_hard_addtime = 0;
5414 	ecomb->sadb_x_ecomb_soft_usetime = 0;
5415 	ecomb->sadb_x_ecomb_hard_usetime = 0;
5416 
5417 	if (ipp->ipp_use_ah) {
5418 		cur = sadb_new_algdesc(cur, limit, ecomb,
5419 		    SADB_SATYPE_AH, SADB_X_ALGTYPE_AUTH, ipp->ipp_auth_alg,
5420 		    ipp->ipp_ah_minbits, ipp->ipp_ah_maxbits, ipss);
5421 		if (cur == NULL)
5422 			return (NULL);
5423 		ipsecah_fill_defs(ecomb, ns);
5424 	}
5425 
5426 	if (ipp->ipp_use_esp) {
5427 		if (ipp->ipp_use_espa) {
5428 			cur = sadb_new_algdesc(cur, limit, ecomb,
5429 			    SADB_SATYPE_ESP, SADB_X_ALGTYPE_AUTH,
5430 			    ipp->ipp_esp_auth_alg,
5431 			    ipp->ipp_espa_minbits,
5432 			    ipp->ipp_espa_maxbits, ipss);
5433 			if (cur == NULL)
5434 				return (NULL);
5435 		}
5436 
5437 		cur = sadb_new_algdesc(cur, limit, ecomb,
5438 		    SADB_SATYPE_ESP, SADB_X_ALGTYPE_CRYPT,
5439 		    ipp->ipp_encr_alg,
5440 		    ipp->ipp_espe_minbits,
5441 		    ipp->ipp_espe_maxbits, ipss);
5442 		if (cur == NULL)
5443 			return (NULL);
5444 		/* Fill in lifetimes if and only if AH didn't already... */
5445 		if (!ipp->ipp_use_ah)
5446 			ipsecesp_fill_defs(ecomb, ns);
5447 	}
5448 
5449 	return (cur);
5450 }
5451 
5452 /*
5453  * Construct an extended ACQUIRE message based on a selector and the resulting
5454  * IPsec action.
5455  *
5456  * NOTE: This is used by both inverse ACQUIRE and actual ACQUIRE
5457  * generation. As a consequence, expect this function to evolve
5458  * rapidly.
5459  */
5460 static mblk_t *
5461 sadb_extended_acquire(ipsec_selector_t *sel, ipsec_policy_t *pol,
5462     ipsec_action_t *act, boolean_t tunnel_mode, uint32_t seq, uint32_t pid,
5463     netstack_t *ns)
5464 {
5465 	mblk_t *mp;
5466 	sadb_msg_t *samsg;
5467 	uint8_t *start, *cur, *end;
5468 	uint32_t *saddrptr, *daddrptr;
5469 	sa_family_t af;
5470 	sadb_prop_t *eprop;
5471 	ipsec_action_t *ap, *an;
5472 	ipsec_selkey_t *ipsl;
5473 	uint8_t proto, pfxlen;
5474 	uint16_t lport, rport;
5475 	uint32_t kmp, kmc;
5476 
5477 	/*
5478 	 * Find the action we want sooner rather than later..
5479 	 */
5480 	an = NULL;
5481 	if (pol == NULL) {
5482 		ap = act;
5483 	} else {
5484 		ap = pol->ipsp_act;
5485 
5486 		if (ap != NULL)
5487 			an = ap->ipa_next;
5488 	}
5489 
5490 	/*
5491 	 * Just take a swag for the allocation for now.	 We can always
5492 	 * alter it later.
5493 	 */
5494 #define	SADB_EXTENDED_ACQUIRE_SIZE	4096
5495 	mp = allocb(SADB_EXTENDED_ACQUIRE_SIZE, BPRI_HI);
5496 	if (mp == NULL)
5497 		return (NULL);
5498 
5499 	start = mp->b_rptr;
5500 	end = start + SADB_EXTENDED_ACQUIRE_SIZE;
5501 
5502 	cur = start;
5503 
5504 	samsg = (sadb_msg_t *)cur;
5505 	cur += sizeof (*samsg);
5506 
5507 	samsg->sadb_msg_version = PF_KEY_V2;
5508 	samsg->sadb_msg_type = SADB_ACQUIRE;
5509 	samsg->sadb_msg_errno = 0;
5510 	samsg->sadb_msg_reserved = 0;
5511 	samsg->sadb_msg_satype = 0;
5512 	samsg->sadb_msg_seq = seq;
5513 	samsg->sadb_msg_pid = pid;
5514 
5515 	if (tunnel_mode) {
5516 		/*
5517 		 * Form inner address extensions based NOT on the inner
5518 		 * selectors (i.e. the packet data), but on the policy's
5519 		 * selector key (i.e. the policy's selector information).
5520 		 *
5521 		 * NOTE:  The position of IPv4 and IPv6 addresses is the
5522 		 * same in ipsec_selkey_t (unless the compiler does very
5523 		 * strange things with unions, consult your local C language
5524 		 * lawyer for details).
5525 		 */
5526 		ASSERT(pol != NULL);
5527 
5528 		ipsl = &(pol->ipsp_sel->ipsl_key);
5529 		if (ipsl->ipsl_valid & IPSL_IPV4) {
5530 			af = AF_INET;
5531 			ASSERT(sel->ips_protocol == IPPROTO_ENCAP);
5532 			ASSERT(!(ipsl->ipsl_valid & IPSL_IPV6));
5533 		} else {
5534 			af = AF_INET6;
5535 			ASSERT(sel->ips_protocol == IPPROTO_IPV6);
5536 			ASSERT(ipsl->ipsl_valid & IPSL_IPV6);
5537 		}
5538 
5539 		if (ipsl->ipsl_valid & IPSL_LOCAL_ADDR) {
5540 			saddrptr = (uint32_t *)(&ipsl->ipsl_local);
5541 			pfxlen = ipsl->ipsl_local_pfxlen;
5542 		} else {
5543 			saddrptr = (uint32_t *)(&ipv6_all_zeros);
5544 			pfxlen = 0;
5545 		}
5546 		/* XXX What about ICMP type/code? */
5547 		lport = (ipsl->ipsl_valid & IPSL_LOCAL_PORT) ?
5548 		    ipsl->ipsl_lport : 0;
5549 		proto = (ipsl->ipsl_valid & IPSL_PROTOCOL) ?
5550 		    ipsl->ipsl_proto : 0;
5551 
5552 		cur = sadb_make_addr_ext(cur, end, SADB_X_EXT_ADDRESS_INNER_SRC,
5553 		    af, saddrptr, lport, proto, pfxlen);
5554 		if (cur == NULL) {
5555 			freeb(mp);
5556 			return (NULL);
5557 		}
5558 
5559 		if (ipsl->ipsl_valid & IPSL_REMOTE_ADDR) {
5560 			daddrptr = (uint32_t *)(&ipsl->ipsl_remote);
5561 			pfxlen = ipsl->ipsl_remote_pfxlen;
5562 		} else {
5563 			daddrptr = (uint32_t *)(&ipv6_all_zeros);
5564 			pfxlen = 0;
5565 		}
5566 		/* XXX What about ICMP type/code? */
5567 		rport = (ipsl->ipsl_valid & IPSL_REMOTE_PORT) ?
5568 		    ipsl->ipsl_rport : 0;
5569 
5570 		cur = sadb_make_addr_ext(cur, end, SADB_X_EXT_ADDRESS_INNER_DST,
5571 		    af, daddrptr, rport, proto, pfxlen);
5572 		if (cur == NULL) {
5573 			freeb(mp);
5574 			return (NULL);
5575 		}
5576 		/*
5577 		 * TODO  - if we go to 3408's dream of transport mode IP-in-IP
5578 		 * _with_ inner-packet address selectors, we'll need to further
5579 		 * distinguish tunnel mode here.  For now, having inner
5580 		 * addresses and/or ports is sufficient.
5581 		 *
5582 		 * Meanwhile, whack proto/ports to reflect IP-in-IP for the
5583 		 * outer addresses.
5584 		 */
5585 		proto = sel->ips_protocol;	/* Either _ENCAP or _IPV6 */
5586 		lport = rport = 0;
5587 	} else if ((ap != NULL) && (!ap->ipa_want_unique)) {
5588 		proto = 0;
5589 		lport = 0;
5590 		rport = 0;
5591 		if (pol != NULL) {
5592 			ipsl = &(pol->ipsp_sel->ipsl_key);
5593 			if (ipsl->ipsl_valid & IPSL_PROTOCOL)
5594 				proto = ipsl->ipsl_proto;
5595 			if (ipsl->ipsl_valid & IPSL_REMOTE_PORT)
5596 				rport = ipsl->ipsl_rport;
5597 			if (ipsl->ipsl_valid & IPSL_LOCAL_PORT)
5598 				lport = ipsl->ipsl_lport;
5599 		}
5600 	} else {
5601 		proto = sel->ips_protocol;
5602 		lport = sel->ips_local_port;
5603 		rport = sel->ips_remote_port;
5604 	}
5605 
5606 	af = sel->ips_isv4 ? AF_INET : AF_INET6;
5607 
5608 	/*
5609 	 * NOTE:  The position of IPv4 and IPv6 addresses is the same in
5610 	 * ipsec_selector_t.
5611 	 */
5612 	cur = sadb_make_addr_ext(cur, end, SADB_EXT_ADDRESS_SRC, af,
5613 	    (uint32_t *)(&sel->ips_local_addr_v6), lport, proto, 0);
5614 
5615 	if (cur == NULL) {
5616 		freeb(mp);
5617 		return (NULL);
5618 	}
5619 
5620 	cur = sadb_make_addr_ext(cur, end, SADB_EXT_ADDRESS_DST, af,
5621 	    (uint32_t *)(&sel->ips_remote_addr_v6), rport, proto, 0);
5622 
5623 	if (cur == NULL) {
5624 		freeb(mp);
5625 		return (NULL);
5626 	}
5627 
5628 	/*
5629 	 * This section will change a lot as policy evolves.
5630 	 * For now, it'll be relatively simple.
5631 	 */
5632 	eprop = (sadb_prop_t *)cur;
5633 	cur += sizeof (*eprop);
5634 	if (cur > end) {
5635 		/* no space left */
5636 		freeb(mp);
5637 		return (NULL);
5638 	}
5639 
5640 	eprop->sadb_prop_exttype = SADB_X_EXT_EPROP;
5641 	eprop->sadb_x_prop_ereserved = 0;
5642 	eprop->sadb_x_prop_numecombs = 0;
5643 	eprop->sadb_prop_replay = 32;	/* default */
5644 
5645 	kmc = kmp = 0;
5646 
5647 	for (; ap != NULL; ap = an) {
5648 		an = (pol != NULL) ? ap->ipa_next : NULL;
5649 
5650 		/*
5651 		 * Skip non-IPsec policies
5652 		 */
5653 		if (ap->ipa_act.ipa_type != IPSEC_ACT_APPLY)
5654 			continue;
5655 
5656 		if (ap->ipa_act.ipa_apply.ipp_km_proto)
5657 			kmp = ap->ipa_act.ipa_apply.ipp_km_proto;
5658 		if (ap->ipa_act.ipa_apply.ipp_km_cookie)
5659 			kmc = ap->ipa_act.ipa_apply.ipp_km_cookie;
5660 		if (ap->ipa_act.ipa_apply.ipp_replay_depth) {
5661 			eprop->sadb_prop_replay =
5662 			    ap->ipa_act.ipa_apply.ipp_replay_depth;
5663 		}
5664 
5665 		cur = sadb_action_to_ecomb(cur, end, ap, ns);
5666 		if (cur == NULL) { /* no space */
5667 			freeb(mp);
5668 			return (NULL);
5669 		}
5670 		eprop->sadb_x_prop_numecombs++;
5671 	}
5672 
5673 	if (eprop->sadb_x_prop_numecombs == 0) {
5674 		/*
5675 		 * This will happen if we fail to find a policy
5676 		 * allowing for IPsec processing.
5677 		 * Construct an error message.
5678 		 */
5679 		samsg->sadb_msg_len = SADB_8TO64(sizeof (*samsg));
5680 		samsg->sadb_msg_errno = ENOENT;
5681 		samsg->sadb_x_msg_diagnostic = 0;
5682 		return (mp);
5683 	}
5684 
5685 	if ((kmp != 0) || (kmc != 0)) {
5686 		cur = sadb_make_kmc_ext(cur, end, kmp, kmc);
5687 		if (cur == NULL) {
5688 			freeb(mp);
5689 			return (NULL);
5690 		}
5691 	}
5692 
5693 	eprop->sadb_prop_len = SADB_8TO64(cur - (uint8_t *)eprop);
5694 	samsg->sadb_msg_len = SADB_8TO64(cur - start);
5695 	mp->b_wptr = cur;
5696 
5697 	return (mp);
5698 }
5699 
5700 /*
5701  * Generic setup of an RFC 2367 ACQUIRE message.  Caller sets satype.
5702  *
5703  * NOTE: This function acquires alg_lock as a side-effect if-and-only-if we
5704  * succeed (i.e. return non-NULL).  Caller MUST release it.  This is to
5705  * maximize code consolidation while preventing algorithm changes from messing
5706  * with the callers finishing touches on the ACQUIRE itself.
5707  */
5708 mblk_t *
5709 sadb_setup_acquire(ipsacq_t *acqrec, uint8_t satype, ipsec_stack_t *ipss)
5710 {
5711 	uint_t allocsize;
5712 	mblk_t *pfkeymp, *msgmp;
5713 	sa_family_t af;
5714 	uint8_t *cur, *end;
5715 	sadb_msg_t *samsg;
5716 	uint16_t sport_typecode;
5717 	uint16_t dport_typecode;
5718 	uint8_t check_proto;
5719 	boolean_t tunnel_mode = (acqrec->ipsacq_inneraddrfam != 0);
5720 
5721 	ASSERT(MUTEX_HELD(&acqrec->ipsacq_lock));
5722 
5723 	pfkeymp = sadb_keysock_out(0);
5724 	if (pfkeymp == NULL)
5725 		return (NULL);
5726 
5727 	/*
5728 	 * First, allocate a basic ACQUIRE message
5729 	 */
5730 	allocsize = sizeof (sadb_msg_t) + sizeof (sadb_address_t) +
5731 	    sizeof (sadb_address_t) + sizeof (sadb_prop_t);
5732 
5733 	/* Make sure there's enough to cover both AF_INET and AF_INET6. */
5734 	allocsize += 2 * sizeof (struct sockaddr_in6);
5735 
5736 	mutex_enter(&ipss->ipsec_alg_lock);
5737 	/* NOTE:  The lock is now held through to this function's return. */
5738 	allocsize += ipss->ipsec_nalgs[IPSEC_ALG_AUTH] *
5739 	    ipss->ipsec_nalgs[IPSEC_ALG_ENCR] * sizeof (sadb_comb_t);
5740 
5741 	if (tunnel_mode) {
5742 		/* Tunnel mode! */
5743 		allocsize += 2 * sizeof (sadb_address_t);
5744 		/* Enough to cover both AF_INET and AF_INET6. */
5745 		allocsize += 2 * sizeof (struct sockaddr_in6);
5746 	}
5747 
5748 	msgmp = allocb(allocsize, BPRI_HI);
5749 	if (msgmp == NULL) {
5750 		freeb(pfkeymp);
5751 		mutex_exit(&ipss->ipsec_alg_lock);
5752 		return (NULL);
5753 	}
5754 
5755 	pfkeymp->b_cont = msgmp;
5756 	cur = msgmp->b_rptr;
5757 	end = cur + allocsize;
5758 	samsg = (sadb_msg_t *)cur;
5759 	cur += sizeof (sadb_msg_t);
5760 
5761 	af = acqrec->ipsacq_addrfam;
5762 	switch (af) {
5763 	case AF_INET:
5764 		check_proto = IPPROTO_ICMP;
5765 		break;
5766 	case AF_INET6:
5767 		check_proto = IPPROTO_ICMPV6;
5768 		break;
5769 	default:
5770 		/* This should never happen unless we have kernel bugs. */
5771 		cmn_err(CE_WARN,
5772 		    "sadb_setup_acquire:  corrupt ACQUIRE record.\n");
5773 		ASSERT(0);
5774 		mutex_exit(&ipss->ipsec_alg_lock);
5775 		return (NULL);
5776 	}
5777 
5778 	samsg->sadb_msg_version = PF_KEY_V2;
5779 	samsg->sadb_msg_type = SADB_ACQUIRE;
5780 	samsg->sadb_msg_satype = satype;
5781 	samsg->sadb_msg_errno = 0;
5782 	samsg->sadb_msg_pid = 0;
5783 	samsg->sadb_msg_reserved = 0;
5784 	samsg->sadb_msg_seq = acqrec->ipsacq_seq;
5785 
5786 	ASSERT(MUTEX_HELD(&acqrec->ipsacq_lock));
5787 
5788 	if ((acqrec->ipsacq_proto == check_proto) || tunnel_mode) {
5789 		sport_typecode = dport_typecode = 0;
5790 	} else {
5791 		sport_typecode = acqrec->ipsacq_srcport;
5792 		dport_typecode = acqrec->ipsacq_dstport;
5793 	}
5794 
5795 	cur = sadb_make_addr_ext(cur, end, SADB_EXT_ADDRESS_SRC, af,
5796 	    acqrec->ipsacq_srcaddr, sport_typecode, acqrec->ipsacq_proto, 0);
5797 
5798 	cur = sadb_make_addr_ext(cur, end, SADB_EXT_ADDRESS_DST, af,
5799 	    acqrec->ipsacq_dstaddr, dport_typecode, acqrec->ipsacq_proto, 0);
5800 
5801 	if (tunnel_mode) {
5802 		sport_typecode = acqrec->ipsacq_srcport;
5803 		dport_typecode = acqrec->ipsacq_dstport;
5804 		cur = sadb_make_addr_ext(cur, end, SADB_X_EXT_ADDRESS_INNER_SRC,
5805 		    acqrec->ipsacq_inneraddrfam, acqrec->ipsacq_innersrc,
5806 		    sport_typecode, acqrec->ipsacq_inner_proto,
5807 		    acqrec->ipsacq_innersrcpfx);
5808 		cur = sadb_make_addr_ext(cur, end, SADB_X_EXT_ADDRESS_INNER_DST,
5809 		    acqrec->ipsacq_inneraddrfam, acqrec->ipsacq_innerdst,
5810 		    dport_typecode, acqrec->ipsacq_inner_proto,
5811 		    acqrec->ipsacq_innerdstpfx);
5812 	}
5813 
5814 	/* XXX Insert identity information here. */
5815 
5816 	/* XXXMLS Insert sensitivity information here. */
5817 
5818 	if (cur != NULL)
5819 		samsg->sadb_msg_len = SADB_8TO64(cur - msgmp->b_rptr);
5820 	else
5821 		mutex_exit(&ipss->ipsec_alg_lock);
5822 
5823 	return (pfkeymp);
5824 }
5825 
5826 /*
5827  * Given an SADB_GETSPI message, find an appropriately ranged SA and
5828  * allocate an SA.  If there are message improprieties, return (ipsa_t *)-1.
5829  * If there was a memory allocation error, return NULL.	 (Assume NULL !=
5830  * (ipsa_t *)-1).
5831  *
5832  * master_spi is passed in host order.
5833  */
5834 ipsa_t *
5835 sadb_getspi(keysock_in_t *ksi, uint32_t master_spi, int *diagnostic,
5836     netstack_t *ns, uint_t sa_type)
5837 {
5838 	sadb_address_t *src =
5839 	    (sadb_address_t *)ksi->ks_in_extv[SADB_EXT_ADDRESS_SRC],
5840 	    *dst = (sadb_address_t *)ksi->ks_in_extv[SADB_EXT_ADDRESS_DST];
5841 	sadb_spirange_t *range =
5842 	    (sadb_spirange_t *)ksi->ks_in_extv[SADB_EXT_SPIRANGE];
5843 	struct sockaddr_in *ssa, *dsa;
5844 	struct sockaddr_in6 *ssa6, *dsa6;
5845 	uint32_t *srcaddr, *dstaddr;
5846 	sa_family_t af;
5847 	uint32_t add, min, max;
5848 	uint8_t protocol =
5849 	    (sa_type == SADB_SATYPE_AH) ? IPPROTO_AH : IPPROTO_ESP;
5850 
5851 	if (src == NULL) {
5852 		*diagnostic = SADB_X_DIAGNOSTIC_MISSING_SRC;
5853 		return ((ipsa_t *)-1);
5854 	}
5855 	if (dst == NULL) {
5856 		*diagnostic = SADB_X_DIAGNOSTIC_MISSING_DST;
5857 		return ((ipsa_t *)-1);
5858 	}
5859 	if (range == NULL) {
5860 		*diagnostic = SADB_X_DIAGNOSTIC_MISSING_RANGE;
5861 		return ((ipsa_t *)-1);
5862 	}
5863 
5864 	min = ntohl(range->sadb_spirange_min);
5865 	max = ntohl(range->sadb_spirange_max);
5866 	dsa = (struct sockaddr_in *)(dst + 1);
5867 	dsa6 = (struct sockaddr_in6 *)dsa;
5868 
5869 	ssa = (struct sockaddr_in *)(src + 1);
5870 	ssa6 = (struct sockaddr_in6 *)ssa;
5871 	ASSERT(dsa->sin_family == ssa->sin_family);
5872 
5873 	srcaddr = ALL_ZEROES_PTR;
5874 	af = dsa->sin_family;
5875 	switch (af) {
5876 	case AF_INET:
5877 		if (src != NULL)
5878 			srcaddr = (uint32_t *)(&ssa->sin_addr);
5879 		dstaddr = (uint32_t *)(&dsa->sin_addr);
5880 		break;
5881 	case AF_INET6:
5882 		if (src != NULL)
5883 			srcaddr = (uint32_t *)(&ssa6->sin6_addr);
5884 		dstaddr = (uint32_t *)(&dsa6->sin6_addr);
5885 		break;
5886 	default:
5887 		*diagnostic = SADB_X_DIAGNOSTIC_BAD_DST_AF;
5888 		return ((ipsa_t *)-1);
5889 	}
5890 
5891 	if (master_spi < min || master_spi > max) {
5892 		/* Return a random value in the range. */
5893 		if (cl_inet_getspi) {
5894 			cl_inet_getspi(ns->netstack_stackid, protocol,
5895 			    (uint8_t *)&add, sizeof (add), NULL);
5896 		} else {
5897 			(void) random_get_pseudo_bytes((uint8_t *)&add,
5898 			    sizeof (add));
5899 		}
5900 		master_spi = min + (add % (max - min + 1));
5901 	}
5902 
5903 	/*
5904 	 * Since master_spi is passed in host order, we need to htonl() it
5905 	 * for the purposes of creating a new SA.
5906 	 */
5907 	return (sadb_makelarvalassoc(htonl(master_spi), srcaddr, dstaddr, af,
5908 	    ns));
5909 }
5910 
5911 /*
5912  *
5913  * Locate an ACQUIRE and nuke it.  If I have an samsg that's larger than the
5914  * base header, just ignore it.	 Otherwise, lock down the whole ACQUIRE list
5915  * and scan for the sequence number in question.  I may wish to accept an
5916  * address pair with it, for easier searching.
5917  *
5918  * Caller frees the message, so we don't have to here.
5919  *
5920  * NOTE:	The ip_q parameter may be used in the future for ACQUIRE
5921  *		failures.
5922  */
5923 /* ARGSUSED */
5924 void
5925 sadb_in_acquire(sadb_msg_t *samsg, sadbp_t *sp, queue_t *ip_q, netstack_t *ns)
5926 {
5927 	int i;
5928 	ipsacq_t *acqrec;
5929 	iacqf_t *bucket;
5930 
5931 	/*
5932 	 * I only accept the base header for this!
5933 	 * Though to be honest, requiring the dst address would help
5934 	 * immensely.
5935 	 *
5936 	 * XXX	There are already cases where I can get the dst address.
5937 	 */
5938 	if (samsg->sadb_msg_len > SADB_8TO64(sizeof (*samsg)))
5939 		return;
5940 
5941 	/*
5942 	 * Using the samsg->sadb_msg_seq, find the ACQUIRE record, delete it,
5943 	 * (and in the future send a message to IP with the appropriate error
5944 	 * number).
5945 	 *
5946 	 * Q: Do I want to reject if pid != 0?
5947 	 */
5948 
5949 	for (i = 0; i < sp->s_v4.sdb_hashsize; i++) {
5950 		bucket = &sp->s_v4.sdb_acq[i];
5951 		mutex_enter(&bucket->iacqf_lock);
5952 		for (acqrec = bucket->iacqf_ipsacq; acqrec != NULL;
5953 		    acqrec = acqrec->ipsacq_next) {
5954 			if (samsg->sadb_msg_seq == acqrec->ipsacq_seq)
5955 				break;	/* for acqrec... loop. */
5956 		}
5957 		if (acqrec != NULL)
5958 			break;	/* for i = 0... loop. */
5959 
5960 		mutex_exit(&bucket->iacqf_lock);
5961 	}
5962 
5963 	if (acqrec == NULL) {
5964 		for (i = 0; i < sp->s_v6.sdb_hashsize; i++) {
5965 			bucket = &sp->s_v6.sdb_acq[i];
5966 			mutex_enter(&bucket->iacqf_lock);
5967 			for (acqrec = bucket->iacqf_ipsacq; acqrec != NULL;
5968 			    acqrec = acqrec->ipsacq_next) {
5969 				if (samsg->sadb_msg_seq == acqrec->ipsacq_seq)
5970 					break;	/* for acqrec... loop. */
5971 			}
5972 			if (acqrec != NULL)
5973 				break;	/* for i = 0... loop. */
5974 
5975 			mutex_exit(&bucket->iacqf_lock);
5976 		}
5977 	}
5978 
5979 
5980 	if (acqrec == NULL)
5981 		return;
5982 
5983 	/*
5984 	 * What do I do with the errno and IP?	I may need mp's services a
5985 	 * little more.	 See sadb_destroy_acquire() for future directions
5986 	 * beyond free the mblk chain on the acquire record.
5987 	 */
5988 
5989 	ASSERT(&bucket->iacqf_lock == acqrec->ipsacq_linklock);
5990 	sadb_destroy_acquire(acqrec, ns);
5991 	/* Have to exit mutex here, because of breaking out of for loop. */
5992 	mutex_exit(&bucket->iacqf_lock);
5993 }
5994 
5995 /*
5996  * The following functions work with the replay windows of an SA.  They assume
5997  * the ipsa->ipsa_replay_arr is an array of uint64_t, and that the bit vector
5998  * represents the highest sequence number packet received, and back
5999  * (ipsa->ipsa_replay_wsize) packets.
6000  */
6001 
6002 /*
6003  * Is the replay bit set?
6004  */
6005 static boolean_t
6006 ipsa_is_replay_set(ipsa_t *ipsa, uint32_t offset)
6007 {
6008 	uint64_t bit = (uint64_t)1 << (uint64_t)(offset & 63);
6009 
6010 	return ((bit & ipsa->ipsa_replay_arr[offset >> 6]) ? B_TRUE : B_FALSE);
6011 }
6012 
6013 /*
6014  * Shift the bits of the replay window over.
6015  */
6016 static void
6017 ipsa_shift_replay(ipsa_t *ipsa, uint32_t shift)
6018 {
6019 	int i;
6020 	int jump = ((shift - 1) >> 6) + 1;
6021 
6022 	if (shift == 0)
6023 		return;
6024 
6025 	for (i = (ipsa->ipsa_replay_wsize - 1) >> 6; i >= 0; i--) {
6026 		if (i + jump <= (ipsa->ipsa_replay_wsize - 1) >> 6) {
6027 			ipsa->ipsa_replay_arr[i + jump] |=
6028 			    ipsa->ipsa_replay_arr[i] >> (64 - (shift & 63));
6029 		}
6030 		ipsa->ipsa_replay_arr[i] <<= shift;
6031 	}
6032 }
6033 
6034 /*
6035  * Set a bit in the bit vector.
6036  */
6037 static void
6038 ipsa_set_replay(ipsa_t *ipsa, uint32_t offset)
6039 {
6040 	uint64_t bit = (uint64_t)1 << (uint64_t)(offset & 63);
6041 
6042 	ipsa->ipsa_replay_arr[offset >> 6] |= bit;
6043 }
6044 
6045 #define	SADB_MAX_REPLAY_VALUE 0xffffffff
6046 
6047 /*
6048  * Assume caller has NOT done ntohl() already on seq.  Check to see
6049  * if replay sequence number "seq" has been seen already.
6050  */
6051 boolean_t
6052 sadb_replay_check(ipsa_t *ipsa, uint32_t seq)
6053 {
6054 	boolean_t rc;
6055 	uint32_t diff;
6056 
6057 	if (ipsa->ipsa_replay_wsize == 0)
6058 		return (B_TRUE);
6059 
6060 	/*
6061 	 * NOTE:  I've already checked for 0 on the wire in sadb_replay_peek().
6062 	 */
6063 
6064 	/* Convert sequence number into host order before holding the mutex. */
6065 	seq = ntohl(seq);
6066 
6067 	mutex_enter(&ipsa->ipsa_lock);
6068 
6069 	/* Initialize inbound SA's ipsa_replay field to last one received. */
6070 	if (ipsa->ipsa_replay == 0)
6071 		ipsa->ipsa_replay = 1;
6072 
6073 	if (seq > ipsa->ipsa_replay) {
6074 		/*
6075 		 * I have received a new "highest value received".  Shift
6076 		 * the replay window over.
6077 		 */
6078 		diff = seq - ipsa->ipsa_replay;
6079 		if (diff < ipsa->ipsa_replay_wsize) {
6080 			/* In replay window, shift bits over. */
6081 			ipsa_shift_replay(ipsa, diff);
6082 		} else {
6083 			/* WAY FAR AHEAD, clear bits and start again. */
6084 			bzero(ipsa->ipsa_replay_arr,
6085 			    sizeof (ipsa->ipsa_replay_arr));
6086 		}
6087 		ipsa_set_replay(ipsa, 0);
6088 		ipsa->ipsa_replay = seq;
6089 		rc = B_TRUE;
6090 		goto done;
6091 	}
6092 	diff = ipsa->ipsa_replay - seq;
6093 	if (diff >= ipsa->ipsa_replay_wsize || ipsa_is_replay_set(ipsa, diff)) {
6094 		rc = B_FALSE;
6095 		goto done;
6096 	}
6097 	/* Set this packet as seen. */
6098 	ipsa_set_replay(ipsa, diff);
6099 
6100 	rc = B_TRUE;
6101 done:
6102 	mutex_exit(&ipsa->ipsa_lock);
6103 	return (rc);
6104 }
6105 
6106 /*
6107  * "Peek" and see if we should even bother going through the effort of
6108  * running an authentication check on the sequence number passed in.
6109  * this takes into account packets that are below the replay window,
6110  * and collisions with already replayed packets.  Return B_TRUE if it
6111  * is okay to proceed, B_FALSE if this packet should be dropped immediately.
6112  * Assume same byte-ordering as sadb_replay_check.
6113  */
6114 boolean_t
6115 sadb_replay_peek(ipsa_t *ipsa, uint32_t seq)
6116 {
6117 	boolean_t rc = B_FALSE;
6118 	uint32_t diff;
6119 
6120 	if (ipsa->ipsa_replay_wsize == 0)
6121 		return (B_TRUE);
6122 
6123 	/*
6124 	 * 0 is 0, regardless of byte order... :)
6125 	 *
6126 	 * If I get 0 on the wire (and there is a replay window) then the
6127 	 * sender most likely wrapped.	This ipsa may need to be marked or
6128 	 * something.
6129 	 */
6130 	if (seq == 0)
6131 		return (B_FALSE);
6132 
6133 	seq = ntohl(seq);
6134 	mutex_enter(&ipsa->ipsa_lock);
6135 	if (seq < ipsa->ipsa_replay - ipsa->ipsa_replay_wsize &&
6136 	    ipsa->ipsa_replay >= ipsa->ipsa_replay_wsize)
6137 		goto done;
6138 
6139 	/*
6140 	 * If I've hit 0xffffffff, then quite honestly, I don't need to
6141 	 * bother with formalities.  I'm not accepting any more packets
6142 	 * on this SA.
6143 	 */
6144 	if (ipsa->ipsa_replay == SADB_MAX_REPLAY_VALUE) {
6145 		/*
6146 		 * Since we're already holding the lock, update the
6147 		 * expire time ala. sadb_replay_delete() and return.
6148 		 */
6149 		ipsa->ipsa_hardexpiretime = (time_t)1;
6150 		goto done;
6151 	}
6152 
6153 	if (seq <= ipsa->ipsa_replay) {
6154 		/*
6155 		 * This seq is in the replay window.  I'm not below it,
6156 		 * because I already checked for that above!
6157 		 */
6158 		diff = ipsa->ipsa_replay - seq;
6159 		if (ipsa_is_replay_set(ipsa, diff))
6160 			goto done;
6161 	}
6162 	/* Else return B_TRUE, I'm going to advance the window. */
6163 
6164 	rc = B_TRUE;
6165 done:
6166 	mutex_exit(&ipsa->ipsa_lock);
6167 	return (rc);
6168 }
6169 
6170 /*
6171  * Delete a single SA.
6172  *
6173  * For now, use the quick-and-dirty trick of making the association's
6174  * hard-expire lifetime (time_t)1, ensuring deletion by the *_ager().
6175  */
6176 void
6177 sadb_replay_delete(ipsa_t *assoc)
6178 {
6179 	mutex_enter(&assoc->ipsa_lock);
6180 	assoc->ipsa_hardexpiretime = (time_t)1;
6181 	mutex_exit(&assoc->ipsa_lock);
6182 }
6183 
6184 /*
6185  * Given a queue that presumably points to IP, send a T_BIND_REQ for _proto_
6186  * down.  The caller will handle the T_BIND_ACK locally.
6187  */
6188 boolean_t
6189 sadb_t_bind_req(queue_t *q, int proto)
6190 {
6191 	struct T_bind_req *tbr;
6192 	mblk_t *mp;
6193 
6194 	mp = allocb_cred(sizeof (struct T_bind_req) + 1, kcred, NOPID);
6195 	if (mp == NULL) {
6196 		/* cmn_err(CE_WARN, */
6197 		/* "sadb_t_bind_req(%d): couldn't allocate mblk\n", proto); */
6198 		return (B_FALSE);
6199 	}
6200 	mp->b_datap->db_type = M_PCPROTO;
6201 	tbr = (struct T_bind_req *)mp->b_rptr;
6202 	mp->b_wptr += sizeof (struct T_bind_req);
6203 	tbr->PRIM_type = T_BIND_REQ;
6204 	tbr->ADDR_length = 0;
6205 	tbr->ADDR_offset = 0;
6206 	tbr->CONIND_number = 0;
6207 	*mp->b_wptr = (uint8_t)proto;
6208 	mp->b_wptr++;
6209 
6210 	putnext(q, mp);
6211 	return (B_TRUE);
6212 }
6213 
6214 /*
6215  * Special front-end to ipsec_rl_strlog() dealing with SA failure.
6216  * this is designed to take only a format string with "* %x * %s *", so
6217  * that "spi" is printed first, then "addr" is converted using inet_pton().
6218  *
6219  * This is abstracted out to save the stack space for only when inet_pton()
6220  * is called.  Make sure "spi" is in network order; it usually is when this
6221  * would get called.
6222  */
6223 void
6224 ipsec_assocfailure(short mid, short sid, char level, ushort_t sl, char *fmt,
6225     uint32_t spi, void *addr, int af, netstack_t *ns)
6226 {
6227 	char buf[INET6_ADDRSTRLEN];
6228 
6229 	ASSERT(af == AF_INET6 || af == AF_INET);
6230 
6231 	ipsec_rl_strlog(ns, mid, sid, level, sl, fmt, ntohl(spi),
6232 	    inet_ntop(af, addr, buf, sizeof (buf)));
6233 }
6234 
6235 /*
6236  * Fills in a reference to the policy, if any, from the conn, in *ppp
6237  * Releases a reference to the passed conn_t.
6238  */
6239 static void
6240 ipsec_conn_pol(ipsec_selector_t *sel, conn_t *connp, ipsec_policy_t **ppp)
6241 {
6242 	ipsec_policy_t	*pp;
6243 	ipsec_latch_t	*ipl = connp->conn_latch;
6244 
6245 	if ((ipl != NULL) && (ipl->ipl_out_policy != NULL)) {
6246 		pp = ipl->ipl_out_policy;
6247 		IPPOL_REFHOLD(pp);
6248 	} else {
6249 		pp = ipsec_find_policy(IPSEC_TYPE_OUTBOUND, connp, NULL, sel,
6250 		    connp->conn_netstack);
6251 	}
6252 	*ppp = pp;
6253 	CONN_DEC_REF(connp);
6254 }
6255 
6256 /*
6257  * The following functions scan through active conn_t structures
6258  * and return a reference to the best-matching policy it can find.
6259  * Caller must release the reference.
6260  */
6261 static void
6262 ipsec_udp_pol(ipsec_selector_t *sel, ipsec_policy_t **ppp, ip_stack_t *ipst)
6263 {
6264 	connf_t *connfp;
6265 	conn_t *connp = NULL;
6266 	ipsec_selector_t portonly;
6267 
6268 	bzero((void *)&portonly, sizeof (portonly));
6269 
6270 	if (sel->ips_local_port == 0)
6271 		return;
6272 
6273 	connfp = &ipst->ips_ipcl_udp_fanout[IPCL_UDP_HASH(sel->ips_local_port,
6274 	    ipst)];
6275 	mutex_enter(&connfp->connf_lock);
6276 
6277 	if (sel->ips_isv4) {
6278 		connp = connfp->connf_head;
6279 		while (connp != NULL) {
6280 			if (IPCL_UDP_MATCH(connp, sel->ips_local_port,
6281 			    sel->ips_local_addr_v4, sel->ips_remote_port,
6282 			    sel->ips_remote_addr_v4))
6283 				break;
6284 			connp = connp->conn_next;
6285 		}
6286 
6287 		if (connp == NULL) {
6288 			/* Try port-only match in IPv6. */
6289 			portonly.ips_local_port = sel->ips_local_port;
6290 			sel = &portonly;
6291 		}
6292 	}
6293 
6294 	if (connp == NULL) {
6295 		connp = connfp->connf_head;
6296 		while (connp != NULL) {
6297 			if (IPCL_UDP_MATCH_V6(connp, sel->ips_local_port,
6298 			    sel->ips_local_addr_v6, sel->ips_remote_port,
6299 			    sel->ips_remote_addr_v6))
6300 				break;
6301 			connp = connp->conn_next;
6302 		}
6303 
6304 		if (connp == NULL) {
6305 			mutex_exit(&connfp->connf_lock);
6306 			return;
6307 		}
6308 	}
6309 
6310 	CONN_INC_REF(connp);
6311 	mutex_exit(&connfp->connf_lock);
6312 
6313 	ipsec_conn_pol(sel, connp, ppp);
6314 }
6315 
6316 static conn_t *
6317 ipsec_find_listen_conn(uint16_t *pptr, ipsec_selector_t *sel, ip_stack_t *ipst)
6318 {
6319 	connf_t *connfp;
6320 	conn_t *connp = NULL;
6321 	const in6_addr_t *v6addrmatch = &sel->ips_local_addr_v6;
6322 
6323 	if (sel->ips_local_port == 0)
6324 		return (NULL);
6325 
6326 	connfp = &ipst->ips_ipcl_bind_fanout[
6327 	    IPCL_BIND_HASH(sel->ips_local_port, ipst)];
6328 	mutex_enter(&connfp->connf_lock);
6329 
6330 	if (sel->ips_isv4) {
6331 		connp = connfp->connf_head;
6332 		while (connp != NULL) {
6333 			if (IPCL_BIND_MATCH(connp, IPPROTO_TCP,
6334 			    sel->ips_local_addr_v4, pptr[1]))
6335 				break;
6336 			connp = connp->conn_next;
6337 		}
6338 
6339 		if (connp == NULL) {
6340 			/* Match to all-zeroes. */
6341 			v6addrmatch = &ipv6_all_zeros;
6342 		}
6343 	}
6344 
6345 	if (connp == NULL) {
6346 		connp = connfp->connf_head;
6347 		while (connp != NULL) {
6348 			if (IPCL_BIND_MATCH_V6(connp, IPPROTO_TCP,
6349 			    *v6addrmatch, pptr[1]))
6350 				break;
6351 			connp = connp->conn_next;
6352 		}
6353 
6354 		if (connp == NULL) {
6355 			mutex_exit(&connfp->connf_lock);
6356 			return (NULL);
6357 		}
6358 	}
6359 
6360 	CONN_INC_REF(connp);
6361 	mutex_exit(&connfp->connf_lock);
6362 	return (connp);
6363 }
6364 
6365 static void
6366 ipsec_tcp_pol(ipsec_selector_t *sel, ipsec_policy_t **ppp, ip_stack_t *ipst)
6367 {
6368 	connf_t 	*connfp;
6369 	conn_t		*connp;
6370 	uint32_t	ports;
6371 	uint16_t	*pptr = (uint16_t *)&ports;
6372 
6373 	/*
6374 	 * Find TCP state in the following order:
6375 	 * 1.) Connected conns.
6376 	 * 2.) Listeners.
6377 	 *
6378 	 * Even though #2 will be the common case for inbound traffic, only
6379 	 * following this order insures correctness.
6380 	 */
6381 
6382 	if (sel->ips_local_port == 0)
6383 		return;
6384 
6385 	/*
6386 	 * 0 should be fport, 1 should be lport.  SRC is the local one here.
6387 	 * See ipsec_construct_inverse_acquire() for details.
6388 	 */
6389 	pptr[0] = sel->ips_remote_port;
6390 	pptr[1] = sel->ips_local_port;
6391 
6392 	connfp = &ipst->ips_ipcl_conn_fanout[
6393 	    IPCL_CONN_HASH(sel->ips_remote_addr_v4, ports, ipst)];
6394 	mutex_enter(&connfp->connf_lock);
6395 	connp = connfp->connf_head;
6396 
6397 	if (sel->ips_isv4) {
6398 		while (connp != NULL) {
6399 			if (IPCL_CONN_MATCH(connp, IPPROTO_TCP,
6400 			    sel->ips_remote_addr_v4, sel->ips_local_addr_v4,
6401 			    ports))
6402 				break;
6403 			connp = connp->conn_next;
6404 		}
6405 	} else {
6406 		while (connp != NULL) {
6407 			if (IPCL_CONN_MATCH_V6(connp, IPPROTO_TCP,
6408 			    sel->ips_remote_addr_v6, sel->ips_local_addr_v6,
6409 			    ports))
6410 				break;
6411 			connp = connp->conn_next;
6412 		}
6413 	}
6414 
6415 	if (connp != NULL) {
6416 		CONN_INC_REF(connp);
6417 		mutex_exit(&connfp->connf_lock);
6418 	} else {
6419 		mutex_exit(&connfp->connf_lock);
6420 
6421 		/* Try the listen hash. */
6422 		if ((connp = ipsec_find_listen_conn(pptr, sel, ipst)) == NULL)
6423 			return;
6424 	}
6425 
6426 	ipsec_conn_pol(sel, connp, ppp);
6427 }
6428 
6429 static void
6430 ipsec_sctp_pol(ipsec_selector_t *sel, ipsec_policy_t **ppp,
6431     ip_stack_t *ipst)
6432 {
6433 	conn_t		*connp;
6434 	uint32_t	ports;
6435 	uint16_t	*pptr = (uint16_t *)&ports;
6436 
6437 	/*
6438 	 * Find SCP state in the following order:
6439 	 * 1.) Connected conns.
6440 	 * 2.) Listeners.
6441 	 *
6442 	 * Even though #2 will be the common case for inbound traffic, only
6443 	 * following this order insures correctness.
6444 	 */
6445 
6446 	if (sel->ips_local_port == 0)
6447 		return;
6448 
6449 	/*
6450 	 * 0 should be fport, 1 should be lport.  SRC is the local one here.
6451 	 * See ipsec_construct_inverse_acquire() for details.
6452 	 */
6453 	pptr[0] = sel->ips_remote_port;
6454 	pptr[1] = sel->ips_local_port;
6455 
6456 	if (sel->ips_isv4) {
6457 		in6_addr_t	src, dst;
6458 
6459 		IN6_IPADDR_TO_V4MAPPED(sel->ips_remote_addr_v4, &dst);
6460 		IN6_IPADDR_TO_V4MAPPED(sel->ips_local_addr_v4, &src);
6461 		connp = sctp_find_conn(&dst, &src, ports, ALL_ZONES,
6462 		    ipst->ips_netstack->netstack_sctp);
6463 	} else {
6464 		connp = sctp_find_conn(&sel->ips_remote_addr_v6,
6465 		    &sel->ips_local_addr_v6, ports, ALL_ZONES,
6466 		    ipst->ips_netstack->netstack_sctp);
6467 	}
6468 	if (connp == NULL)
6469 		return;
6470 	ipsec_conn_pol(sel, connp, ppp);
6471 }
6472 
6473 /*
6474  * Fill in a query for the SPD (in "sel") using two PF_KEY address extensions.
6475  * Returns 0 or errno, and always sets *diagnostic to something appropriate
6476  * to PF_KEY.
6477  *
6478  * NOTE:  For right now, this function (and ipsec_selector_t for that matter),
6479  * ignore prefix lengths in the address extension.  Since we match on first-
6480  * entered policies, this shouldn't matter.  Also, since we normalize prefix-
6481  * set addresses to mask out the lower bits, we should get a suitable search
6482  * key for the SPD anyway.  This is the function to change if the assumption
6483  * about suitable search keys is wrong.
6484  */
6485 static int
6486 ipsec_get_inverse_acquire_sel(ipsec_selector_t *sel, sadb_address_t *srcext,
6487     sadb_address_t *dstext, int *diagnostic)
6488 {
6489 	struct sockaddr_in *src, *dst;
6490 	struct sockaddr_in6 *src6, *dst6;
6491 
6492 	*diagnostic = 0;
6493 
6494 	bzero(sel, sizeof (*sel));
6495 	sel->ips_protocol = srcext->sadb_address_proto;
6496 	dst = (struct sockaddr_in *)(dstext + 1);
6497 	if (dst->sin_family == AF_INET6) {
6498 		dst6 = (struct sockaddr_in6 *)dst;
6499 		src6 = (struct sockaddr_in6 *)(srcext + 1);
6500 		if (src6->sin6_family != AF_INET6) {
6501 			*diagnostic = SADB_X_DIAGNOSTIC_AF_MISMATCH;
6502 			return (EINVAL);
6503 		}
6504 		sel->ips_remote_addr_v6 = dst6->sin6_addr;
6505 		sel->ips_local_addr_v6 = src6->sin6_addr;
6506 		if (sel->ips_protocol == IPPROTO_ICMPV6) {
6507 			sel->ips_is_icmp_inv_acq = 1;
6508 		} else {
6509 			sel->ips_remote_port = dst6->sin6_port;
6510 			sel->ips_local_port = src6->sin6_port;
6511 		}
6512 		sel->ips_isv4 = B_FALSE;
6513 	} else {
6514 		src = (struct sockaddr_in *)(srcext + 1);
6515 		if (src->sin_family != AF_INET) {
6516 			*diagnostic = SADB_X_DIAGNOSTIC_AF_MISMATCH;
6517 			return (EINVAL);
6518 		}
6519 		sel->ips_remote_addr_v4 = dst->sin_addr.s_addr;
6520 		sel->ips_local_addr_v4 = src->sin_addr.s_addr;
6521 		if (sel->ips_protocol == IPPROTO_ICMP) {
6522 			sel->ips_is_icmp_inv_acq = 1;
6523 		} else {
6524 			sel->ips_remote_port = dst->sin_port;
6525 			sel->ips_local_port = src->sin_port;
6526 		}
6527 		sel->ips_isv4 = B_TRUE;
6528 	}
6529 	return (0);
6530 }
6531 
6532 /*
6533  * We have encapsulation.
6534  * - Lookup tun_t by address and look for an associated
6535  *   tunnel policy
6536  * - If there are inner selectors
6537  *   - check ITPF_P_TUNNEL and ITPF_P_ACTIVE
6538  *   - Look up tunnel policy based on selectors
6539  * - Else
6540  *   - Sanity check the negotation
6541  *   - If appropriate, fall through to global policy
6542  */
6543 static int
6544 ipsec_tun_pol(ipsec_selector_t *sel, ipsec_policy_t **ppp,
6545     sadb_address_t *innsrcext, sadb_address_t *inndstext, ipsec_tun_pol_t *itp,
6546     int *diagnostic, netstack_t *ns)
6547 {
6548 	int err;
6549 	ipsec_policy_head_t *polhead;
6550 
6551 	/* Check for inner selectors and act appropriately */
6552 
6553 	if (innsrcext != NULL) {
6554 		/* Inner selectors present */
6555 		ASSERT(inndstext != NULL);
6556 		if ((itp == NULL) ||
6557 		    (itp->itp_flags & (ITPF_P_ACTIVE | ITPF_P_TUNNEL)) !=
6558 		    (ITPF_P_ACTIVE | ITPF_P_TUNNEL)) {
6559 			/*
6560 			 * If inner packet selectors, we must have negotiate
6561 			 * tunnel and active policy.  If the tunnel has
6562 			 * transport-mode policy set on it, or has no policy,
6563 			 * fail.
6564 			 */
6565 			return (ENOENT);
6566 		} else {
6567 			/*
6568 			 * Reset "sel" to indicate inner selectors.  Pass
6569 			 * inner PF_KEY address extensions for this to happen.
6570 			 */
6571 			err = ipsec_get_inverse_acquire_sel(sel,
6572 			    innsrcext, inndstext, diagnostic);
6573 			if (err != 0) {
6574 				ITP_REFRELE(itp, ns);
6575 				return (err);
6576 			}
6577 			/*
6578 			 * Now look for a tunnel policy based on those inner
6579 			 * selectors.  (Common code is below.)
6580 			 */
6581 		}
6582 	} else {
6583 		/* No inner selectors present */
6584 		if ((itp == NULL) || !(itp->itp_flags & ITPF_P_ACTIVE)) {
6585 			/*
6586 			 * Transport mode negotiation with no tunnel policy
6587 			 * configured - return to indicate a global policy
6588 			 * check is needed.
6589 			 */
6590 			if (itp != NULL) {
6591 				ITP_REFRELE(itp, ns);
6592 			}
6593 			return (0);
6594 		} else if (itp->itp_flags & ITPF_P_TUNNEL) {
6595 			/* Tunnel mode set with no inner selectors. */
6596 			ITP_REFRELE(itp, ns);
6597 			return (ENOENT);
6598 		}
6599 		/*
6600 		 * Else, this is a tunnel policy configured with ifconfig(1m)
6601 		 * or "negotiate transport" with ipsecconf(1m).  We have an
6602 		 * itp with policy set based on any match, so don't bother
6603 		 * changing fields in "sel".
6604 		 */
6605 	}
6606 
6607 	ASSERT(itp != NULL);
6608 	polhead = itp->itp_policy;
6609 	ASSERT(polhead != NULL);
6610 	rw_enter(&polhead->iph_lock, RW_READER);
6611 	*ppp = ipsec_find_policy_head(NULL, polhead,
6612 	    IPSEC_TYPE_INBOUND, sel, ns);
6613 	rw_exit(&polhead->iph_lock);
6614 	ITP_REFRELE(itp, ns);
6615 
6616 	/*
6617 	 * Don't default to global if we didn't find a matching policy entry.
6618 	 * Instead, send ENOENT, just like if we hit a transport-mode tunnel.
6619 	 */
6620 	if (*ppp == NULL)
6621 		return (ENOENT);
6622 
6623 	return (0);
6624 }
6625 
6626 static void
6627 ipsec_oth_pol(ipsec_selector_t *sel, ipsec_policy_t **ppp,
6628     ip_stack_t *ipst)
6629 {
6630 	boolean_t	isv4 = sel->ips_isv4;
6631 	connf_t		*connfp;
6632 	conn_t		*connp;
6633 
6634 	if (isv4) {
6635 		connfp = &ipst->ips_ipcl_proto_fanout[sel->ips_protocol];
6636 	} else {
6637 		connfp = &ipst->ips_ipcl_proto_fanout_v6[sel->ips_protocol];
6638 	}
6639 
6640 	mutex_enter(&connfp->connf_lock);
6641 	for (connp = connfp->connf_head; connp != NULL;
6642 	    connp = connp->conn_next) {
6643 		if (!((isv4 && !((connp->conn_src == 0 ||
6644 		    connp->conn_src == sel->ips_local_addr_v4) &&
6645 		    (connp->conn_rem == 0 ||
6646 		    connp->conn_rem == sel->ips_remote_addr_v4))) ||
6647 		    (!isv4 && !((IN6_IS_ADDR_UNSPECIFIED(&connp->conn_srcv6) ||
6648 		    IN6_ARE_ADDR_EQUAL(&connp->conn_srcv6,
6649 		    &sel->ips_local_addr_v6)) &&
6650 		    (IN6_IS_ADDR_UNSPECIFIED(&connp->conn_remv6) ||
6651 		    IN6_ARE_ADDR_EQUAL(&connp->conn_remv6,
6652 		    &sel->ips_remote_addr_v6)))))) {
6653 			break;
6654 		}
6655 	}
6656 	if (connp == NULL) {
6657 		mutex_exit(&connfp->connf_lock);
6658 		return;
6659 	}
6660 
6661 	CONN_INC_REF(connp);
6662 	mutex_exit(&connfp->connf_lock);
6663 
6664 	ipsec_conn_pol(sel, connp, ppp);
6665 }
6666 
6667 /*
6668  * Construct an inverse ACQUIRE reply based on:
6669  *
6670  * 1.) Current global policy.
6671  * 2.) An conn_t match depending on what all was passed in the extv[].
6672  * 3.) A tunnel's policy head.
6673  * ...
6674  * N.) Other stuff TBD (e.g. identities)
6675  *
6676  * If there is an error, set sadb_msg_errno and sadb_x_msg_diagnostic
6677  * in this function so the caller can extract them where appropriately.
6678  *
6679  * The SRC address is the local one - just like an outbound ACQUIRE message.
6680  */
6681 mblk_t *
6682 ipsec_construct_inverse_acquire(sadb_msg_t *samsg, sadb_ext_t *extv[],
6683     netstack_t *ns)
6684 {
6685 	int err;
6686 	int diagnostic;
6687 	sadb_address_t *srcext = (sadb_address_t *)extv[SADB_EXT_ADDRESS_SRC],
6688 	    *dstext = (sadb_address_t *)extv[SADB_EXT_ADDRESS_DST],
6689 	    *innsrcext = (sadb_address_t *)extv[SADB_X_EXT_ADDRESS_INNER_SRC],
6690 	    *inndstext = (sadb_address_t *)extv[SADB_X_EXT_ADDRESS_INNER_DST];
6691 	struct sockaddr_in6 *src, *dst;
6692 	struct sockaddr_in6 *isrc, *idst;
6693 	ipsec_tun_pol_t *itp = NULL;
6694 	ipsec_policy_t *pp = NULL;
6695 	ipsec_selector_t sel, isel;
6696 	mblk_t *retmp;
6697 	ip_stack_t	*ipst = ns->netstack_ip;
6698 	ipsec_stack_t	*ipss = ns->netstack_ipsec;
6699 
6700 	/* Normalize addresses */
6701 	if (sadb_addrcheck(NULL, (mblk_t *)samsg, (sadb_ext_t *)srcext, 0, ns)
6702 	    == KS_IN_ADDR_UNKNOWN) {
6703 		err = EINVAL;
6704 		diagnostic = SADB_X_DIAGNOSTIC_BAD_SRC;
6705 		goto bail;
6706 	}
6707 	src = (struct sockaddr_in6 *)(srcext + 1);
6708 	if (sadb_addrcheck(NULL, (mblk_t *)samsg, (sadb_ext_t *)dstext, 0, ns)
6709 	    == KS_IN_ADDR_UNKNOWN) {
6710 		err = EINVAL;
6711 		diagnostic = SADB_X_DIAGNOSTIC_BAD_DST;
6712 		goto bail;
6713 	}
6714 	dst = (struct sockaddr_in6 *)(dstext + 1);
6715 	if (src->sin6_family != dst->sin6_family) {
6716 		err = EINVAL;
6717 		diagnostic = SADB_X_DIAGNOSTIC_AF_MISMATCH;
6718 		goto bail;
6719 	}
6720 
6721 	/* Check for tunnel mode and act appropriately */
6722 	if (innsrcext != NULL) {
6723 		if (inndstext == NULL) {
6724 			err = EINVAL;
6725 			diagnostic = SADB_X_DIAGNOSTIC_MISSING_INNER_DST;
6726 			goto bail;
6727 		}
6728 		if (sadb_addrcheck(NULL, (mblk_t *)samsg,
6729 		    (sadb_ext_t *)innsrcext, 0, ns) == KS_IN_ADDR_UNKNOWN) {
6730 			err = EINVAL;
6731 			diagnostic = SADB_X_DIAGNOSTIC_MALFORMED_INNER_SRC;
6732 			goto bail;
6733 		}
6734 		isrc = (struct sockaddr_in6 *)(innsrcext + 1);
6735 		if (sadb_addrcheck(NULL, (mblk_t *)samsg,
6736 		    (sadb_ext_t *)inndstext, 0, ns) == KS_IN_ADDR_UNKNOWN) {
6737 			err = EINVAL;
6738 			diagnostic = SADB_X_DIAGNOSTIC_MALFORMED_INNER_DST;
6739 			goto bail;
6740 		}
6741 		idst = (struct sockaddr_in6 *)(inndstext + 1);
6742 		if (isrc->sin6_family != idst->sin6_family) {
6743 			err = EINVAL;
6744 			diagnostic = SADB_X_DIAGNOSTIC_INNER_AF_MISMATCH;
6745 			goto bail;
6746 		}
6747 		if (isrc->sin6_family != AF_INET &&
6748 		    isrc->sin6_family != AF_INET6) {
6749 			err = EINVAL;
6750 			diagnostic = SADB_X_DIAGNOSTIC_BAD_INNER_SRC_AF;
6751 			goto bail;
6752 		}
6753 	} else if (inndstext != NULL) {
6754 		err = EINVAL;
6755 		diagnostic = SADB_X_DIAGNOSTIC_MISSING_INNER_SRC;
6756 		goto bail;
6757 	}
6758 
6759 	/* Get selectors first, based on outer addresses */
6760 	err = ipsec_get_inverse_acquire_sel(&sel, srcext, dstext, &diagnostic);
6761 	if (err != 0)
6762 		goto bail;
6763 
6764 	/* Check for tunnel mode mismatches. */
6765 	if (innsrcext != NULL &&
6766 	    ((isrc->sin6_family == AF_INET &&
6767 	    sel.ips_protocol != IPPROTO_ENCAP && sel.ips_protocol != 0) ||
6768 	    (isrc->sin6_family == AF_INET6 &&
6769 	    sel.ips_protocol != IPPROTO_IPV6 && sel.ips_protocol != 0))) {
6770 		err = EPROTOTYPE;
6771 		goto bail;
6772 	}
6773 
6774 	/*
6775 	 * Okay, we have the addresses and other selector information.
6776 	 * Let's first find a conn...
6777 	 */
6778 	pp = NULL;
6779 	switch (sel.ips_protocol) {
6780 	case IPPROTO_TCP:
6781 		ipsec_tcp_pol(&sel, &pp, ipst);
6782 		break;
6783 	case IPPROTO_UDP:
6784 		ipsec_udp_pol(&sel, &pp, ipst);
6785 		break;
6786 	case IPPROTO_SCTP:
6787 		ipsec_sctp_pol(&sel, &pp, ipst);
6788 		break;
6789 	case IPPROTO_ENCAP:
6790 	case IPPROTO_IPV6:
6791 		rw_enter(&ipss->ipsec_itp_get_byaddr_rw_lock, RW_READER);
6792 		/*
6793 		 * Assume sel.ips_remote_addr_* has the right address at
6794 		 * that exact position.
6795 		 */
6796 		itp = ipss->ipsec_itp_get_byaddr(
6797 		    (uint32_t *)(&sel.ips_local_addr_v6),
6798 		    (uint32_t *)(&sel.ips_remote_addr_v6),
6799 		    src->sin6_family, ns);
6800 		rw_exit(&ipss->ipsec_itp_get_byaddr_rw_lock);
6801 		if (innsrcext == NULL) {
6802 			/*
6803 			 * Transport-mode tunnel, make sure we fake out isel
6804 			 * to contain something based on the outer protocol.
6805 			 */
6806 			bzero(&isel, sizeof (isel));
6807 			isel.ips_isv4 = (sel.ips_protocol == IPPROTO_ENCAP);
6808 		} /* Else isel is initialized by ipsec_tun_pol(). */
6809 		err = ipsec_tun_pol(&isel, &pp, innsrcext, inndstext, itp,
6810 		    &diagnostic, ns);
6811 		/*
6812 		 * NOTE:  isel isn't used for now, but in RFC 430x IPsec, it
6813 		 * may be.
6814 		 */
6815 		if (err != 0)
6816 			goto bail;
6817 		break;
6818 	default:
6819 		ipsec_oth_pol(&sel, &pp, ipst);
6820 		break;
6821 	}
6822 
6823 	/*
6824 	 * If we didn't find a matching conn_t or other policy head, take a
6825 	 * look in the global policy.
6826 	 */
6827 	if (pp == NULL) {
6828 		pp = ipsec_find_policy(IPSEC_TYPE_OUTBOUND, NULL, NULL, &sel,
6829 		    ns);
6830 		if (pp == NULL) {
6831 			/* There's no global policy. */
6832 			err = ENOENT;
6833 			diagnostic = 0;
6834 			goto bail;
6835 		}
6836 	}
6837 
6838 	/*
6839 	 * Now that we have a policy entry/widget, construct an ACQUIRE
6840 	 * message based on that, fix fields where appropriate,
6841 	 * and return the message.
6842 	 */
6843 	retmp = sadb_extended_acquire(&sel, pp, NULL,
6844 	    (itp != NULL && (itp->itp_flags & ITPF_P_TUNNEL)),
6845 	    samsg->sadb_msg_seq, samsg->sadb_msg_pid, ns);
6846 	if (pp != NULL) {
6847 		IPPOL_REFRELE(pp, ns);
6848 	}
6849 	if (retmp != NULL) {
6850 		return (retmp);
6851 	} else {
6852 		err = ENOMEM;
6853 		diagnostic = 0;
6854 	}
6855 bail:
6856 	samsg->sadb_msg_errno = (uint8_t)err;
6857 	samsg->sadb_x_msg_diagnostic = (uint16_t)diagnostic;
6858 	return (NULL);
6859 }
6860 
6861 /*
6862  * ipsa_lpkt is a one-element queue, only manipulated by the next two
6863  * functions.  They have to hold the ipsa_lock because of potential races
6864  * between key management using SADB_UPDATE, and inbound packets that may
6865  * queue up on the larval SA (hence the 'l' in "lpkt").
6866  */
6867 
6868 /*
6869  * sadb_set_lpkt: Return TRUE if we can swap in a value to ipsa->ipsa_lpkt and
6870  * freemsg the previous value.  Return FALSE if we lost the race and the SA is
6871  * in a non-LARVAL state.  free clue: ip_drop_packet(NULL) is safe.
6872  */
6873 boolean_t
6874 sadb_set_lpkt(ipsa_t *ipsa, mblk_t *npkt, netstack_t *ns)
6875 {
6876 	mblk_t *opkt;
6877 	ipsec_stack_t	*ipss = ns->netstack_ipsec;
6878 	boolean_t is_larval;
6879 
6880 	/*
6881 	 * Check the packet's netstack id in case we go asynch with a
6882 	 * taskq_dispatch.
6883 	 */
6884 	ASSERT(((ipsec_in_t *)npkt->b_rptr)->ipsec_in_type == IPSEC_IN);
6885 	ASSERT(((ipsec_in_t *)npkt->b_rptr)->ipsec_in_stackid ==
6886 	    ns->netstack_stackid);
6887 
6888 	mutex_enter(&ipsa->ipsa_lock);
6889 	is_larval = (ipsa->ipsa_state == IPSA_STATE_LARVAL);
6890 	if (is_larval) {
6891 		opkt = ipsa->ipsa_lpkt;
6892 		ipsa->ipsa_lpkt = npkt;
6893 	} else {
6894 		/* We lost the race. */
6895 		opkt = NULL;
6896 		ASSERT(ipsa->ipsa_lpkt == NULL);
6897 	}
6898 	mutex_exit(&ipsa->ipsa_lock);
6899 
6900 	ip_drop_packet(opkt, B_TRUE, NULL, NULL,
6901 	    DROPPER(ipss, ipds_sadb_inlarval_replace),
6902 	    &ipss->ipsec_sadb_dropper);
6903 	return (is_larval);
6904 }
6905 
6906 /*
6907  * sadb_clear_lpkt: Atomically clear ipsa->ipsa_lpkt and return the
6908  * previous value.
6909  */
6910 mblk_t *
6911 sadb_clear_lpkt(ipsa_t *ipsa)
6912 {
6913 	mblk_t *opkt;
6914 
6915 	mutex_enter(&ipsa->ipsa_lock);
6916 	opkt = ipsa->ipsa_lpkt;
6917 	ipsa->ipsa_lpkt = NULL;
6918 	mutex_exit(&ipsa->ipsa_lock);
6919 
6920 	return (opkt);
6921 }
6922 
6923 /*
6924  * Buffer a packet that's in IDLE state as set by Solaris Clustering.
6925  */
6926 void
6927 sadb_buf_pkt(ipsa_t *ipsa, mblk_t *bpkt, netstack_t *ns)
6928 {
6929 	ipsec_stack_t   *ipss = ns->netstack_ipsec;
6930 	extern void (*cl_inet_idlesa)(netstackid_t, uint8_t, uint32_t,
6931 	    sa_family_t, in6_addr_t, in6_addr_t, void *);
6932 	in6_addr_t *srcaddr = (in6_addr_t *)(&ipsa->ipsa_srcaddr);
6933 	in6_addr_t *dstaddr = (in6_addr_t *)(&ipsa->ipsa_dstaddr);
6934 
6935 	ASSERT(ipsa->ipsa_state == IPSA_STATE_IDLE);
6936 
6937 	if (cl_inet_idlesa == NULL) {
6938 		ip_drop_packet(bpkt, B_TRUE, NULL, NULL,
6939 		    DROPPER(ipss, ipds_sadb_inidle_overflow),
6940 		    &ipss->ipsec_sadb_dropper);
6941 		return;
6942 	}
6943 
6944 	cl_inet_idlesa(ns->netstack_stackid,
6945 	    (ipsa->ipsa_type == SADB_SATYPE_AH) ? IPPROTO_AH : IPPROTO_ESP,
6946 	    ipsa->ipsa_spi, ipsa->ipsa_addrfam, *srcaddr, *dstaddr, NULL);
6947 
6948 	/*
6949 	 * Check the packet's netstack id in case we go asynch with a
6950 	 * taskq_dispatch.
6951 	 */
6952 	ASSERT(((ipsec_in_t *)bpkt->b_rptr)->ipsec_in_type == IPSEC_IN);
6953 	ASSERT(((ipsec_in_t *)bpkt->b_rptr)->ipsec_in_stackid ==
6954 	    ns->netstack_stackid);
6955 
6956 	mutex_enter(&ipsa->ipsa_lock);
6957 	ipsa->ipsa_mblkcnt++;
6958 	if (ipsa->ipsa_bpkt_head == NULL) {
6959 		ipsa->ipsa_bpkt_head = ipsa->ipsa_bpkt_tail = bpkt;
6960 	} else {
6961 		ipsa->ipsa_bpkt_tail->b_next = bpkt;
6962 		ipsa->ipsa_bpkt_tail = bpkt;
6963 		if (ipsa->ipsa_mblkcnt > SADB_MAX_IDLEPKTS) {
6964 			mblk_t *tmp;
6965 			tmp = ipsa->ipsa_bpkt_head;
6966 			ipsa->ipsa_bpkt_head = ipsa->ipsa_bpkt_head->b_next;
6967 			ip_drop_packet(tmp, B_TRUE, NULL, NULL,
6968 			    DROPPER(ipss, ipds_sadb_inidle_overflow),
6969 			    &ipss->ipsec_sadb_dropper);
6970 			ipsa->ipsa_mblkcnt --;
6971 		}
6972 	}
6973 	mutex_exit(&ipsa->ipsa_lock);
6974 
6975 }
6976 
6977 /*
6978  * Stub function that taskq_dispatch() invokes to take the mblk (in arg)
6979  * and put into STREAMS again.
6980  */
6981 void
6982 sadb_clear_buf_pkt(void *ipkt)
6983 {
6984 	mblk_t	*tmp, *buf_pkt;
6985 	netstack_t *ns;
6986 	ipsec_in_t *ii;
6987 
6988 	buf_pkt = (mblk_t *)ipkt;
6989 
6990 	ii = (ipsec_in_t *)buf_pkt->b_rptr;
6991 	ASSERT(ii->ipsec_in_type == IPSEC_IN);
6992 	ns = netstack_find_by_stackid(ii->ipsec_in_stackid);
6993 	if (ns != NULL && ns != ii->ipsec_in_ns) {
6994 		netstack_rele(ns);
6995 		ns = NULL;  /* For while-loop below. */
6996 	}
6997 
6998 	while (buf_pkt != NULL) {
6999 		tmp = buf_pkt->b_next;
7000 		buf_pkt->b_next = NULL;
7001 		if (ns != NULL)
7002 			ip_fanout_proto_again(buf_pkt, NULL, NULL, NULL);
7003 		else
7004 			freemsg(buf_pkt);
7005 		buf_pkt = tmp;
7006 	}
7007 	if (ns != NULL)
7008 		netstack_rele(ns);
7009 }
7010 /*
7011  * Walker callback used by sadb_alg_update() to free/create crypto
7012  * context template when a crypto software provider is removed or
7013  * added.
7014  */
7015 
7016 struct sadb_update_alg_state {
7017 	ipsec_algtype_t alg_type;
7018 	uint8_t alg_id;
7019 	boolean_t is_added;
7020 };
7021 
7022 static void
7023 sadb_alg_update_cb(isaf_t *head, ipsa_t *entry, void *cookie)
7024 {
7025 	struct sadb_update_alg_state *update_state =
7026 	    (struct sadb_update_alg_state *)cookie;
7027 	crypto_ctx_template_t *ctx_tmpl = NULL;
7028 
7029 	ASSERT(MUTEX_HELD(&head->isaf_lock));
7030 
7031 	if (entry->ipsa_state == IPSA_STATE_LARVAL)
7032 		return;
7033 
7034 	mutex_enter(&entry->ipsa_lock);
7035 
7036 	switch (update_state->alg_type) {
7037 	case IPSEC_ALG_AUTH:
7038 		if (entry->ipsa_auth_alg == update_state->alg_id)
7039 			ctx_tmpl = &entry->ipsa_authtmpl;
7040 		break;
7041 	case IPSEC_ALG_ENCR:
7042 		if (entry->ipsa_encr_alg == update_state->alg_id)
7043 			ctx_tmpl = &entry->ipsa_encrtmpl;
7044 		break;
7045 	default:
7046 		ctx_tmpl = NULL;
7047 	}
7048 
7049 	if (ctx_tmpl == NULL) {
7050 		mutex_exit(&entry->ipsa_lock);
7051 		return;
7052 	}
7053 
7054 	/*
7055 	 * The context template of the SA may be affected by the change
7056 	 * of crypto provider.
7057 	 */
7058 	if (update_state->is_added) {
7059 		/* create the context template if not already done */
7060 		if (*ctx_tmpl == NULL) {
7061 			(void) ipsec_create_ctx_tmpl(entry,
7062 			    update_state->alg_type);
7063 		}
7064 	} else {
7065 		/*
7066 		 * The crypto provider was removed. If the context template
7067 		 * exists but it is no longer valid, free it.
7068 		 */
7069 		if (*ctx_tmpl != NULL)
7070 			ipsec_destroy_ctx_tmpl(entry, update_state->alg_type);
7071 	}
7072 
7073 	mutex_exit(&entry->ipsa_lock);
7074 }
7075 
7076 /*
7077  * Invoked by IP when an software crypto provider has been updated.
7078  * The type and id of the corresponding algorithm is passed as argument.
7079  * is_added is B_TRUE if the provider was added, B_FALSE if it was
7080  * removed. The function updates the SADB and free/creates the
7081  * context templates associated with SAs if needed.
7082  */
7083 
7084 #define	SADB_ALG_UPDATE_WALK(sadb, table) \
7085     sadb_walker((sadb).table, (sadb).sdb_hashsize, sadb_alg_update_cb, \
7086 	&update_state)
7087 
7088 void
7089 sadb_alg_update(ipsec_algtype_t alg_type, uint8_t alg_id, boolean_t is_added,
7090     netstack_t *ns)
7091 {
7092 	struct sadb_update_alg_state update_state;
7093 	ipsecah_stack_t	*ahstack = ns->netstack_ipsecah;
7094 	ipsecesp_stack_t	*espstack = ns->netstack_ipsecesp;
7095 
7096 	update_state.alg_type = alg_type;
7097 	update_state.alg_id = alg_id;
7098 	update_state.is_added = is_added;
7099 
7100 	if (alg_type == IPSEC_ALG_AUTH) {
7101 		/* walk the AH tables only for auth. algorithm changes */
7102 		SADB_ALG_UPDATE_WALK(ahstack->ah_sadb.s_v4, sdb_of);
7103 		SADB_ALG_UPDATE_WALK(ahstack->ah_sadb.s_v4, sdb_if);
7104 		SADB_ALG_UPDATE_WALK(ahstack->ah_sadb.s_v6, sdb_of);
7105 		SADB_ALG_UPDATE_WALK(ahstack->ah_sadb.s_v6, sdb_if);
7106 	}
7107 
7108 	/* walk the ESP tables */
7109 	SADB_ALG_UPDATE_WALK(espstack->esp_sadb.s_v4, sdb_of);
7110 	SADB_ALG_UPDATE_WALK(espstack->esp_sadb.s_v4, sdb_if);
7111 	SADB_ALG_UPDATE_WALK(espstack->esp_sadb.s_v6, sdb_of);
7112 	SADB_ALG_UPDATE_WALK(espstack->esp_sadb.s_v6, sdb_if);
7113 }
7114 
7115 /*
7116  * Creates a context template for the specified SA. This function
7117  * is called when an SA is created and when a context template needs
7118  * to be created due to a change of software provider.
7119  */
7120 int
7121 ipsec_create_ctx_tmpl(ipsa_t *sa, ipsec_algtype_t alg_type)
7122 {
7123 	ipsec_alginfo_t *alg;
7124 	crypto_mechanism_t mech;
7125 	crypto_key_t *key;
7126 	crypto_ctx_template_t *sa_tmpl;
7127 	int rv;
7128 	ipsec_stack_t	*ipss = sa->ipsa_netstack->netstack_ipsec;
7129 
7130 	ASSERT(MUTEX_HELD(&ipss->ipsec_alg_lock));
7131 	ASSERT(MUTEX_HELD(&sa->ipsa_lock));
7132 
7133 	/* get pointers to the algorithm info, context template, and key */
7134 	switch (alg_type) {
7135 	case IPSEC_ALG_AUTH:
7136 		key = &sa->ipsa_kcfauthkey;
7137 		sa_tmpl = &sa->ipsa_authtmpl;
7138 		alg = ipss->ipsec_alglists[alg_type][sa->ipsa_auth_alg];
7139 		break;
7140 	case IPSEC_ALG_ENCR:
7141 		key = &sa->ipsa_kcfencrkey;
7142 		sa_tmpl = &sa->ipsa_encrtmpl;
7143 		alg = ipss->ipsec_alglists[alg_type][sa->ipsa_encr_alg];
7144 		break;
7145 	default:
7146 		alg = NULL;
7147 	}
7148 
7149 	if (alg == NULL || !ALG_VALID(alg))
7150 		return (EINVAL);
7151 
7152 	/* initialize the mech info structure for the framework */
7153 	ASSERT(alg->alg_mech_type != CRYPTO_MECHANISM_INVALID);
7154 	mech.cm_type = alg->alg_mech_type;
7155 	mech.cm_param = NULL;
7156 	mech.cm_param_len = 0;
7157 
7158 	/* create a new context template */
7159 	rv = crypto_create_ctx_template(&mech, key, sa_tmpl, KM_NOSLEEP);
7160 
7161 	/*
7162 	 * CRYPTO_MECH_NOT_SUPPORTED can be returned if only hardware
7163 	 * providers are available for that mechanism. In that case
7164 	 * we don't fail, and will generate the context template from
7165 	 * the framework callback when a software provider for that
7166 	 * mechanism registers.
7167 	 *
7168 	 * The context template is assigned the special value
7169 	 * IPSEC_CTX_TMPL_ALLOC if the allocation failed due to a
7170 	 * lack of memory. No attempt will be made to use
7171 	 * the context template if it is set to this value.
7172 	 */
7173 	if (rv == CRYPTO_HOST_MEMORY) {
7174 		*sa_tmpl = IPSEC_CTX_TMPL_ALLOC;
7175 	} else if (rv != CRYPTO_SUCCESS) {
7176 		*sa_tmpl = NULL;
7177 		if (rv != CRYPTO_MECH_NOT_SUPPORTED)
7178 			return (EINVAL);
7179 	}
7180 
7181 	return (0);
7182 }
7183 
7184 /*
7185  * Destroy the context template of the specified algorithm type
7186  * of the specified SA. Must be called while holding the SA lock.
7187  */
7188 void
7189 ipsec_destroy_ctx_tmpl(ipsa_t *sa, ipsec_algtype_t alg_type)
7190 {
7191 	ASSERT(MUTEX_HELD(&sa->ipsa_lock));
7192 
7193 	if (alg_type == IPSEC_ALG_AUTH) {
7194 		if (sa->ipsa_authtmpl == IPSEC_CTX_TMPL_ALLOC)
7195 			sa->ipsa_authtmpl = NULL;
7196 		else if (sa->ipsa_authtmpl != NULL) {
7197 			crypto_destroy_ctx_template(sa->ipsa_authtmpl);
7198 			sa->ipsa_authtmpl = NULL;
7199 		}
7200 	} else {
7201 		ASSERT(alg_type == IPSEC_ALG_ENCR);
7202 		if (sa->ipsa_encrtmpl == IPSEC_CTX_TMPL_ALLOC)
7203 			sa->ipsa_encrtmpl = NULL;
7204 		else if (sa->ipsa_encrtmpl != NULL) {
7205 			crypto_destroy_ctx_template(sa->ipsa_encrtmpl);
7206 			sa->ipsa_encrtmpl = NULL;
7207 		}
7208 	}
7209 }
7210 
7211 /*
7212  * Use the kernel crypto framework to check the validity of a key received
7213  * via keysock. Returns 0 if the key is OK, -1 otherwise.
7214  */
7215 int
7216 ipsec_check_key(crypto_mech_type_t mech_type, sadb_key_t *sadb_key,
7217     boolean_t is_auth, int *diag)
7218 {
7219 	crypto_mechanism_t mech;
7220 	crypto_key_t crypto_key;
7221 	int crypto_rc;
7222 
7223 	mech.cm_type = mech_type;
7224 	mech.cm_param = NULL;
7225 	mech.cm_param_len = 0;
7226 
7227 	crypto_key.ck_format = CRYPTO_KEY_RAW;
7228 	crypto_key.ck_data = sadb_key + 1;
7229 	crypto_key.ck_length = sadb_key->sadb_key_bits;
7230 
7231 	crypto_rc = crypto_key_check(&mech, &crypto_key);
7232 
7233 	switch (crypto_rc) {
7234 	case CRYPTO_SUCCESS:
7235 		return (0);
7236 	case CRYPTO_MECHANISM_INVALID:
7237 	case CRYPTO_MECH_NOT_SUPPORTED:
7238 		*diag = is_auth ? SADB_X_DIAGNOSTIC_BAD_AALG :
7239 		    SADB_X_DIAGNOSTIC_BAD_EALG;
7240 		break;
7241 	case CRYPTO_KEY_SIZE_RANGE:
7242 		*diag = is_auth ? SADB_X_DIAGNOSTIC_BAD_AKEYBITS :
7243 		    SADB_X_DIAGNOSTIC_BAD_EKEYBITS;
7244 		break;
7245 	case CRYPTO_WEAK_KEY:
7246 		*diag = is_auth ? SADB_X_DIAGNOSTIC_WEAK_AKEY :
7247 		    SADB_X_DIAGNOSTIC_WEAK_EKEY;
7248 		break;
7249 	}
7250 
7251 	return (-1);
7252 }
7253 /*
7254  * If this is an outgoing SA then add some fuzz to the
7255  * SOFT EXPIRE time. The reason for this is to stop
7256  * peers trying to renegotiate SOFT expiring SA's at
7257  * the same time. The amount of fuzz needs to be at
7258  * least 10 seconds which is the typical interval
7259  * sadb_ager(), although this is only a guide as it
7260  * selftunes.
7261  */
7262 void
7263 lifetime_fuzz(ipsa_t *assoc)
7264 {
7265 	uint8_t rnd;
7266 
7267 	if (assoc->ipsa_softaddlt == 0)
7268 		return;
7269 
7270 	(void) random_get_pseudo_bytes(&rnd, sizeof (rnd));
7271 	rnd = (rnd & 0xF) + 10;
7272 	assoc->ipsa_softexpiretime -= rnd;
7273 	assoc->ipsa_softaddlt -= rnd;
7274 }
7275 void
7276 destroy_ipsa_pair(ipsap_t *ipsapp)
7277 {
7278 	if (ipsapp == NULL)
7279 		return;
7280 
7281 	/*
7282 	 * Because of the multi-line macro nature of IPSA_REFRELE, keep
7283 	 * them in { }.
7284 	 */
7285 	if (ipsapp->ipsap_sa_ptr != NULL) {
7286 		IPSA_REFRELE(ipsapp->ipsap_sa_ptr);
7287 	}
7288 	if (ipsapp->ipsap_psa_ptr != NULL) {
7289 		IPSA_REFRELE(ipsapp->ipsap_psa_ptr);
7290 	}
7291 
7292 	kmem_free(ipsapp, sizeof (*ipsapp));
7293 }
7294 
7295 /*
7296  * The sadb_ager() function walks through the hash tables of SA's and ages
7297  * them, if the SA expires as a result, its marked as DEAD and will be reaped
7298  * the next time sadb_ager() runs. SA's which are paired or have a peer (same
7299  * SA appears in both the inbound and outbound tables because its not possible
7300  * to determine its direction) are placed on a list when they expire. This is
7301  * to ensure that pair/peer SA's are reaped at the same time, even if they
7302  * expire at different times.
7303  *
7304  * This function is called twice by sadb_ager(), one after processing the
7305  * inbound table, then again after processing the outbound table.
7306  */
7307 void
7308 age_pair_peer_list(templist_t *haspeerlist, sadb_t *sp, boolean_t outbound)
7309 {
7310 	templist_t *listptr;
7311 	int outhash;
7312 	isaf_t *bucket;
7313 	boolean_t haspeer;
7314 	ipsa_t *peer_assoc, *dying;
7315 	/*
7316 	 * Haspeer cases will contain both IPv4 and IPv6.  This code
7317 	 * is address independent.
7318 	 */
7319 	while (haspeerlist != NULL) {
7320 		/* "dying" contains the SA that has a peer. */
7321 		dying = haspeerlist->ipsa;
7322 		haspeer = (dying->ipsa_haspeer);
7323 		listptr = haspeerlist;
7324 		haspeerlist = listptr->next;
7325 		kmem_free(listptr, sizeof (*listptr));
7326 		/*
7327 		 * Pick peer bucket based on addrfam.
7328 		 */
7329 		if (outbound) {
7330 			if (haspeer)
7331 				bucket = INBOUND_BUCKET(sp, dying->ipsa_spi);
7332 			else
7333 				bucket = INBOUND_BUCKET(sp,
7334 				    dying->ipsa_otherspi);
7335 		} else { /* inbound */
7336 			if (haspeer) {
7337 				if (dying->ipsa_addrfam == AF_INET6) {
7338 					outhash = OUTBOUND_HASH_V6(sp,
7339 					    *((in6_addr_t *)&dying->
7340 					    ipsa_dstaddr));
7341 				} else {
7342 					outhash = OUTBOUND_HASH_V4(sp,
7343 					    *((ipaddr_t *)&dying->
7344 					    ipsa_dstaddr));
7345 				}
7346 			} else if (dying->ipsa_addrfam == AF_INET6) {
7347 				outhash = OUTBOUND_HASH_V6(sp,
7348 				    *((in6_addr_t *)&dying->
7349 				    ipsa_srcaddr));
7350 			} else {
7351 				outhash = OUTBOUND_HASH_V4(sp,
7352 				    *((ipaddr_t *)&dying->
7353 				    ipsa_srcaddr));
7354 			}
7355 		bucket = &(sp->sdb_of[outhash]);
7356 		}
7357 
7358 		mutex_enter(&bucket->isaf_lock);
7359 		/*
7360 		 * "haspeer" SA's have the same src/dst address ordering,
7361 		 * "paired" SA's have the src/dst addresses reversed.
7362 		 */
7363 		if (haspeer) {
7364 			peer_assoc = ipsec_getassocbyspi(bucket,
7365 			    dying->ipsa_spi, dying->ipsa_srcaddr,
7366 			    dying->ipsa_dstaddr, dying->ipsa_addrfam);
7367 		} else {
7368 			peer_assoc = ipsec_getassocbyspi(bucket,
7369 			    dying->ipsa_otherspi, dying->ipsa_dstaddr,
7370 			    dying->ipsa_srcaddr, dying->ipsa_addrfam);
7371 		}
7372 
7373 		mutex_exit(&bucket->isaf_lock);
7374 		if (peer_assoc != NULL) {
7375 			mutex_enter(&peer_assoc->ipsa_lock);
7376 			mutex_enter(&dying->ipsa_lock);
7377 			if (!haspeer) {
7378 				/*
7379 				 * Only SA's which have a "peer" or are
7380 				 * "paired" end up on this list, so this
7381 				 * must be a "paired" SA, update the flags
7382 				 * to break the pair.
7383 				 */
7384 				peer_assoc->ipsa_otherspi = 0;
7385 				peer_assoc->ipsa_flags &= ~IPSA_F_PAIRED;
7386 				dying->ipsa_otherspi = 0;
7387 				dying->ipsa_flags &= ~IPSA_F_PAIRED;
7388 			}
7389 			if (haspeer || outbound) {
7390 				/*
7391 				 * Update the state of the "inbound" SA when
7392 				 * the "outbound" SA has expired. Don't update
7393 				 * the "outbound" SA when the "inbound" SA
7394 				 * SA expires because setting the hard_addtime
7395 				 * below will cause this to happen.
7396 				 */
7397 				peer_assoc->ipsa_state = dying->ipsa_state;
7398 			}
7399 			if (dying->ipsa_state == IPSA_STATE_DEAD)
7400 				peer_assoc->ipsa_hardexpiretime = 1;
7401 
7402 			mutex_exit(&dying->ipsa_lock);
7403 			mutex_exit(&peer_assoc->ipsa_lock);
7404 			IPSA_REFRELE(peer_assoc);
7405 		}
7406 		IPSA_REFRELE(dying);
7407 	}
7408 }
7409