1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright 2009 Sun Microsystems, Inc. All rights reserved. 23 * Use is subject to license terms. 24 */ 25 26 #include <sys/types.h> 27 #include <sys/stream.h> 28 #include <sys/stropts.h> 29 #include <sys/strsubr.h> 30 #include <sys/errno.h> 31 #include <sys/ddi.h> 32 #include <sys/debug.h> 33 #include <sys/cmn_err.h> 34 #include <sys/stream.h> 35 #include <sys/strlog.h> 36 #include <sys/kmem.h> 37 #include <sys/sunddi.h> 38 #include <sys/tihdr.h> 39 #include <sys/atomic.h> 40 #include <sys/socket.h> 41 #include <sys/sysmacros.h> 42 #include <sys/crypto/common.h> 43 #include <sys/crypto/api.h> 44 #include <sys/zone.h> 45 #include <netinet/in.h> 46 #include <net/if.h> 47 #include <net/pfkeyv2.h> 48 #include <inet/common.h> 49 #include <netinet/ip6.h> 50 #include <inet/ip.h> 51 #include <inet/ip_ire.h> 52 #include <inet/ip6.h> 53 #include <inet/ipsec_info.h> 54 #include <inet/tcp.h> 55 #include <inet/sadb.h> 56 #include <inet/ipsec_impl.h> 57 #include <inet/ipsecah.h> 58 #include <inet/ipsecesp.h> 59 #include <sys/random.h> 60 #include <sys/dlpi.h> 61 #include <sys/iphada.h> 62 #include <inet/ip_if.h> 63 #include <inet/ipdrop.h> 64 #include <inet/ipclassifier.h> 65 #include <inet/sctp_ip.h> 66 #include <inet/tun.h> 67 68 /* 69 * This source file contains Security Association Database (SADB) common 70 * routines. They are linked in with the AH module. Since AH has no chance 71 * of falling under export control, it was safe to link it in there. 72 */ 73 74 static mblk_t *sadb_extended_acquire(ipsec_selector_t *, ipsec_policy_t *, 75 ipsec_action_t *, boolean_t, uint32_t, uint32_t, netstack_t *); 76 static void sadb_ill_df(ill_t *, mblk_t *, isaf_t *, int, boolean_t); 77 static ipsa_t *sadb_torch_assoc(isaf_t *, ipsa_t *, boolean_t, mblk_t **); 78 static void sadb_drain_torchq(queue_t *, mblk_t *); 79 static void sadb_destroy_acqlist(iacqf_t **, uint_t, boolean_t, 80 netstack_t *); 81 static void sadb_destroy(sadb_t *, netstack_t *); 82 static mblk_t *sadb_sa2msg(ipsa_t *, sadb_msg_t *); 83 84 static time_t sadb_add_time(time_t, uint64_t); 85 static void lifetime_fuzz(ipsa_t *); 86 static void age_pair_peer_list(templist_t *, sadb_t *, boolean_t); 87 static void ipsa_set_replay(ipsa_t *ipsa, uint32_t offset); 88 89 extern void (*cl_inet_getspi)(netstackid_t stack_id, uint8_t protocol, 90 uint8_t *ptr, size_t len, void *args); 91 extern int (*cl_inet_checkspi)(netstackid_t stack_id, uint8_t protocol, 92 uint32_t spi, void *args); 93 extern void (*cl_inet_deletespi)(netstackid_t stack_id, uint8_t protocol, 94 uint32_t spi, void *args); 95 96 /* 97 * ipsacq_maxpackets is defined here to make it tunable 98 * from /etc/system. 99 */ 100 extern uint64_t ipsacq_maxpackets; 101 102 #define SET_EXPIRE(sa, delta, exp) { \ 103 if (((sa)->ipsa_ ## delta) != 0) { \ 104 (sa)->ipsa_ ## exp = sadb_add_time((sa)->ipsa_addtime, \ 105 (sa)->ipsa_ ## delta); \ 106 } \ 107 } 108 109 #define UPDATE_EXPIRE(sa, delta, exp) { \ 110 if (((sa)->ipsa_ ## delta) != 0) { \ 111 time_t tmp = sadb_add_time((sa)->ipsa_usetime, \ 112 (sa)->ipsa_ ## delta); \ 113 if (((sa)->ipsa_ ## exp) == 0) \ 114 (sa)->ipsa_ ## exp = tmp; \ 115 else \ 116 (sa)->ipsa_ ## exp = \ 117 MIN((sa)->ipsa_ ## exp, tmp); \ 118 } \ 119 } 120 121 122 /* wrap the macro so we can pass it as a function pointer */ 123 void 124 sadb_sa_refrele(void *target) 125 { 126 IPSA_REFRELE(((ipsa_t *)target)); 127 } 128 129 /* 130 * We presume that sizeof (long) == sizeof (time_t) and that time_t is 131 * a signed type. 132 */ 133 #define TIME_MAX LONG_MAX 134 135 /* 136 * PF_KEY gives us lifetimes in uint64_t seconds. We presume that 137 * time_t is defined to be a signed type with the same range as 138 * "long". On ILP32 systems, we thus run the risk of wrapping around 139 * at end of time, as well as "overwrapping" the clock back around 140 * into a seemingly valid but incorrect future date earlier than the 141 * desired expiration. 142 * 143 * In order to avoid odd behavior (either negative lifetimes or loss 144 * of high order bits) when someone asks for bizarrely long SA 145 * lifetimes, we do a saturating add for expire times. 146 * 147 * We presume that ILP32 systems will be past end of support life when 148 * the 32-bit time_t overflows (a dangerous assumption, mind you..). 149 * 150 * On LP64, 2^64 seconds are about 5.8e11 years, at which point we 151 * will hopefully have figured out clever ways to avoid the use of 152 * fixed-sized integers in computation. 153 */ 154 static time_t 155 sadb_add_time(time_t base, uint64_t delta) 156 { 157 time_t sum; 158 159 /* 160 * Clip delta to the maximum possible time_t value to 161 * prevent "overwrapping" back into a shorter-than-desired 162 * future time. 163 */ 164 if (delta > TIME_MAX) 165 delta = TIME_MAX; 166 /* 167 * This sum may still overflow. 168 */ 169 sum = base + delta; 170 171 /* 172 * .. so if the result is less than the base, we overflowed. 173 */ 174 if (sum < base) 175 sum = TIME_MAX; 176 177 return (sum); 178 } 179 180 /* 181 * Callers of this function have already created a working security 182 * association, and have found the appropriate table & hash chain. All this 183 * function does is check duplicates, and insert the SA. The caller needs to 184 * hold the hash bucket lock and increment the refcnt before insertion. 185 * 186 * Return 0 if success, EEXIST if collision. 187 */ 188 #define SA_UNIQUE_MATCH(sa1, sa2) \ 189 (((sa1)->ipsa_unique_id & (sa1)->ipsa_unique_mask) == \ 190 ((sa2)->ipsa_unique_id & (sa2)->ipsa_unique_mask)) 191 192 int 193 sadb_insertassoc(ipsa_t *ipsa, isaf_t *bucket) 194 { 195 ipsa_t **ptpn = NULL; 196 ipsa_t *walker; 197 boolean_t unspecsrc; 198 199 ASSERT(MUTEX_HELD(&bucket->isaf_lock)); 200 201 unspecsrc = IPSA_IS_ADDR_UNSPEC(ipsa->ipsa_srcaddr, ipsa->ipsa_addrfam); 202 203 walker = bucket->isaf_ipsa; 204 ASSERT(walker == NULL || ipsa->ipsa_addrfam == walker->ipsa_addrfam); 205 206 /* 207 * Find insertion point (pointed to with **ptpn). Insert at the head 208 * of the list unless there's an unspecified source address, then 209 * insert it after the last SA with a specified source address. 210 * 211 * BTW, you'll have to walk the whole chain, matching on {DST, SPI} 212 * checking for collisions. 213 */ 214 215 while (walker != NULL) { 216 if (IPSA_ARE_ADDR_EQUAL(walker->ipsa_dstaddr, 217 ipsa->ipsa_dstaddr, ipsa->ipsa_addrfam)) { 218 if (walker->ipsa_spi == ipsa->ipsa_spi) 219 return (EEXIST); 220 221 mutex_enter(&walker->ipsa_lock); 222 if (ipsa->ipsa_state == IPSA_STATE_MATURE && 223 (walker->ipsa_flags & IPSA_F_USED) && 224 SA_UNIQUE_MATCH(walker, ipsa)) { 225 walker->ipsa_flags |= IPSA_F_CINVALID; 226 } 227 mutex_exit(&walker->ipsa_lock); 228 } 229 230 if (ptpn == NULL && unspecsrc) { 231 if (IPSA_IS_ADDR_UNSPEC(walker->ipsa_srcaddr, 232 walker->ipsa_addrfam)) 233 ptpn = walker->ipsa_ptpn; 234 else if (walker->ipsa_next == NULL) 235 ptpn = &walker->ipsa_next; 236 } 237 238 walker = walker->ipsa_next; 239 } 240 241 if (ptpn == NULL) 242 ptpn = &bucket->isaf_ipsa; 243 ipsa->ipsa_next = *ptpn; 244 ipsa->ipsa_ptpn = ptpn; 245 if (ipsa->ipsa_next != NULL) 246 ipsa->ipsa_next->ipsa_ptpn = &ipsa->ipsa_next; 247 *ptpn = ipsa; 248 ipsa->ipsa_linklock = &bucket->isaf_lock; 249 250 return (0); 251 } 252 #undef SA_UNIQUE_MATCH 253 254 /* 255 * Free a security association. Its reference count is 0, which means 256 * I must free it. The SA must be unlocked and must not be linked into 257 * any fanout list. 258 */ 259 static void 260 sadb_freeassoc(ipsa_t *ipsa) 261 { 262 ipsec_stack_t *ipss = ipsa->ipsa_netstack->netstack_ipsec; 263 264 ASSERT(ipss != NULL); 265 ASSERT(MUTEX_NOT_HELD(&ipsa->ipsa_lock)); 266 ASSERT(ipsa->ipsa_refcnt == 0); 267 ASSERT(ipsa->ipsa_next == NULL); 268 ASSERT(ipsa->ipsa_ptpn == NULL); 269 270 mutex_enter(&ipsa->ipsa_lock); 271 /* Don't call sadb_clear_lpkt() since we hold the ipsa_lock anyway. */ 272 ip_drop_packet(ipsa->ipsa_lpkt, B_TRUE, NULL, NULL, 273 DROPPER(ipss, ipds_sadb_inlarval_timeout), 274 &ipss->ipsec_sadb_dropper); 275 ipsec_destroy_ctx_tmpl(ipsa, IPSEC_ALG_AUTH); 276 ipsec_destroy_ctx_tmpl(ipsa, IPSEC_ALG_ENCR); 277 mutex_exit(&ipsa->ipsa_lock); 278 279 /* bzero() these fields for paranoia's sake. */ 280 if (ipsa->ipsa_authkey != NULL) { 281 bzero(ipsa->ipsa_authkey, ipsa->ipsa_authkeylen); 282 kmem_free(ipsa->ipsa_authkey, ipsa->ipsa_authkeylen); 283 } 284 if (ipsa->ipsa_encrkey != NULL) { 285 bzero(ipsa->ipsa_encrkey, ipsa->ipsa_encrkeylen); 286 kmem_free(ipsa->ipsa_encrkey, ipsa->ipsa_encrkeylen); 287 } 288 if (ipsa->ipsa_src_cid != NULL) { 289 IPSID_REFRELE(ipsa->ipsa_src_cid); 290 } 291 if (ipsa->ipsa_dst_cid != NULL) { 292 IPSID_REFRELE(ipsa->ipsa_dst_cid); 293 } 294 if (ipsa->ipsa_integ != NULL) 295 kmem_free(ipsa->ipsa_integ, ipsa->ipsa_integlen); 296 if (ipsa->ipsa_sens != NULL) 297 kmem_free(ipsa->ipsa_sens, ipsa->ipsa_senslen); 298 299 mutex_destroy(&ipsa->ipsa_lock); 300 kmem_free(ipsa, sizeof (*ipsa)); 301 } 302 303 /* 304 * Unlink a security association from a hash bucket. Assume the hash bucket 305 * lock is held, but the association's lock is not. 306 * 307 * Note that we do not bump the bucket's generation number here because 308 * we might not be making a visible change to the set of visible SA's. 309 * All callers MUST bump the bucket's generation number before they unlock 310 * the bucket if they use sadb_unlinkassoc to permanetly remove an SA which 311 * was present in the bucket at the time it was locked. 312 */ 313 void 314 sadb_unlinkassoc(ipsa_t *ipsa) 315 { 316 ASSERT(ipsa->ipsa_linklock != NULL); 317 ASSERT(MUTEX_HELD(ipsa->ipsa_linklock)); 318 319 /* These fields are protected by the link lock. */ 320 *(ipsa->ipsa_ptpn) = ipsa->ipsa_next; 321 if (ipsa->ipsa_next != NULL) { 322 ipsa->ipsa_next->ipsa_ptpn = ipsa->ipsa_ptpn; 323 ipsa->ipsa_next = NULL; 324 } 325 326 ipsa->ipsa_ptpn = NULL; 327 328 /* This may destroy the SA. */ 329 IPSA_REFRELE(ipsa); 330 } 331 332 void 333 sadb_delete_cluster(ipsa_t *assoc) 334 { 335 uint8_t protocol; 336 337 if (cl_inet_deletespi && 338 ((assoc->ipsa_state == IPSA_STATE_LARVAL) || 339 (assoc->ipsa_state == IPSA_STATE_MATURE))) { 340 protocol = (assoc->ipsa_type == SADB_SATYPE_AH) ? 341 IPPROTO_AH : IPPROTO_ESP; 342 cl_inet_deletespi(assoc->ipsa_netstack->netstack_stackid, 343 protocol, assoc->ipsa_spi, NULL); 344 } 345 } 346 347 /* 348 * Create a larval security association with the specified SPI. All other 349 * fields are zeroed. 350 */ 351 static ipsa_t * 352 sadb_makelarvalassoc(uint32_t spi, uint32_t *src, uint32_t *dst, int addrfam, 353 netstack_t *ns) 354 { 355 ipsa_t *newbie; 356 357 /* 358 * Allocate... 359 */ 360 361 newbie = (ipsa_t *)kmem_zalloc(sizeof (ipsa_t), KM_NOSLEEP); 362 if (newbie == NULL) { 363 /* Can't make new larval SA. */ 364 return (NULL); 365 } 366 367 /* Assigned requested SPI, assume caller does SPI allocation magic. */ 368 newbie->ipsa_spi = spi; 369 newbie->ipsa_netstack = ns; /* No netstack_hold */ 370 371 /* 372 * Copy addresses... 373 */ 374 375 IPSA_COPY_ADDR(newbie->ipsa_srcaddr, src, addrfam); 376 IPSA_COPY_ADDR(newbie->ipsa_dstaddr, dst, addrfam); 377 378 newbie->ipsa_addrfam = addrfam; 379 380 /* 381 * Set common initialization values, including refcnt. 382 */ 383 mutex_init(&newbie->ipsa_lock, NULL, MUTEX_DEFAULT, NULL); 384 newbie->ipsa_state = IPSA_STATE_LARVAL; 385 newbie->ipsa_refcnt = 1; 386 newbie->ipsa_freefunc = sadb_freeassoc; 387 388 /* 389 * There aren't a lot of other common initialization values, as 390 * they are copied in from the PF_KEY message. 391 */ 392 393 return (newbie); 394 } 395 396 /* 397 * Call me to initialize a security association fanout. 398 */ 399 static int 400 sadb_init_fanout(isaf_t **tablep, uint_t size, int kmflag) 401 { 402 isaf_t *table; 403 int i; 404 405 table = (isaf_t *)kmem_alloc(size * sizeof (*table), kmflag); 406 *tablep = table; 407 408 if (table == NULL) 409 return (ENOMEM); 410 411 for (i = 0; i < size; i++) { 412 mutex_init(&(table[i].isaf_lock), NULL, MUTEX_DEFAULT, NULL); 413 table[i].isaf_ipsa = NULL; 414 table[i].isaf_gen = 0; 415 } 416 417 return (0); 418 } 419 420 /* 421 * Call me to initialize an acquire fanout 422 */ 423 static int 424 sadb_init_acfanout(iacqf_t **tablep, uint_t size, int kmflag) 425 { 426 iacqf_t *table; 427 int i; 428 429 table = (iacqf_t *)kmem_alloc(size * sizeof (*table), kmflag); 430 *tablep = table; 431 432 if (table == NULL) 433 return (ENOMEM); 434 435 for (i = 0; i < size; i++) { 436 mutex_init(&(table[i].iacqf_lock), NULL, MUTEX_DEFAULT, NULL); 437 table[i].iacqf_ipsacq = NULL; 438 } 439 440 return (0); 441 } 442 443 /* 444 * Attempt to initialize an SADB instance. On failure, return ENOMEM; 445 * caller must clean up partial allocations. 446 */ 447 static int 448 sadb_init_trial(sadb_t *sp, uint_t size, int kmflag) 449 { 450 ASSERT(sp->sdb_of == NULL); 451 ASSERT(sp->sdb_if == NULL); 452 ASSERT(sp->sdb_acq == NULL); 453 454 sp->sdb_hashsize = size; 455 if (sadb_init_fanout(&sp->sdb_of, size, kmflag) != 0) 456 return (ENOMEM); 457 if (sadb_init_fanout(&sp->sdb_if, size, kmflag) != 0) 458 return (ENOMEM); 459 if (sadb_init_acfanout(&sp->sdb_acq, size, kmflag) != 0) 460 return (ENOMEM); 461 462 return (0); 463 } 464 465 /* 466 * Call me to initialize an SADB instance; fall back to default size on failure. 467 */ 468 static void 469 sadb_init(const char *name, sadb_t *sp, uint_t size, uint_t ver, 470 netstack_t *ns) 471 { 472 ASSERT(sp->sdb_of == NULL); 473 ASSERT(sp->sdb_if == NULL); 474 ASSERT(sp->sdb_acq == NULL); 475 476 if (size < IPSEC_DEFAULT_HASH_SIZE) 477 size = IPSEC_DEFAULT_HASH_SIZE; 478 479 if (sadb_init_trial(sp, size, KM_NOSLEEP) != 0) { 480 481 cmn_err(CE_WARN, 482 "Unable to allocate %u entry IPv%u %s SADB hash table", 483 size, ver, name); 484 485 sadb_destroy(sp, ns); 486 size = IPSEC_DEFAULT_HASH_SIZE; 487 cmn_err(CE_WARN, "Falling back to %d entries", size); 488 (void) sadb_init_trial(sp, size, KM_SLEEP); 489 } 490 } 491 492 493 /* 494 * Initialize an SADB-pair. 495 */ 496 void 497 sadbp_init(const char *name, sadbp_t *sp, int type, int size, netstack_t *ns) 498 { 499 sadb_init(name, &sp->s_v4, size, 4, ns); 500 sadb_init(name, &sp->s_v6, size, 6, ns); 501 502 sp->s_satype = type; 503 504 ASSERT((type == SADB_SATYPE_AH) || (type == SADB_SATYPE_ESP)); 505 if (type == SADB_SATYPE_AH) { 506 ipsec_stack_t *ipss = ns->netstack_ipsec; 507 508 ip_drop_register(&ipss->ipsec_sadb_dropper, "IPsec SADB"); 509 sp->s_addflags = AH_ADD_SETTABLE_FLAGS; 510 sp->s_updateflags = AH_UPDATE_SETTABLE_FLAGS; 511 } else { 512 sp->s_addflags = ESP_ADD_SETTABLE_FLAGS; 513 sp->s_updateflags = ESP_UPDATE_SETTABLE_FLAGS; 514 } 515 } 516 517 /* 518 * Deliver a single SADB_DUMP message representing a single SA. This is 519 * called many times by sadb_dump(). 520 * 521 * If the return value of this is ENOBUFS (not the same as ENOMEM), then 522 * the caller should take that as a hint that dupb() on the "original answer" 523 * failed, and that perhaps the caller should try again with a copyb()ed 524 * "original answer". 525 */ 526 static int 527 sadb_dump_deliver(queue_t *pfkey_q, mblk_t *original_answer, ipsa_t *ipsa, 528 sadb_msg_t *samsg) 529 { 530 mblk_t *answer; 531 532 answer = dupb(original_answer); 533 if (answer == NULL) 534 return (ENOBUFS); 535 answer->b_cont = sadb_sa2msg(ipsa, samsg); 536 if (answer->b_cont == NULL) { 537 freeb(answer); 538 return (ENOMEM); 539 } 540 541 /* Just do a putnext, and let keysock deal with flow control. */ 542 putnext(pfkey_q, answer); 543 return (0); 544 } 545 546 /* 547 * Common function to allocate and prepare a keysock_out_t M_CTL message. 548 */ 549 mblk_t * 550 sadb_keysock_out(minor_t serial) 551 { 552 mblk_t *mp; 553 keysock_out_t *kso; 554 555 mp = allocb(sizeof (ipsec_info_t), BPRI_HI); 556 if (mp != NULL) { 557 mp->b_datap->db_type = M_CTL; 558 mp->b_wptr += sizeof (ipsec_info_t); 559 kso = (keysock_out_t *)mp->b_rptr; 560 kso->ks_out_type = KEYSOCK_OUT; 561 kso->ks_out_len = sizeof (*kso); 562 kso->ks_out_serial = serial; 563 } 564 565 return (mp); 566 } 567 568 /* 569 * Perform an SADB_DUMP, spewing out every SA in an array of SA fanouts 570 * to keysock. 571 */ 572 static int 573 sadb_dump_fanout(queue_t *pfkey_q, mblk_t *mp, minor_t serial, isaf_t *fanout, 574 int num_entries, boolean_t do_peers, time_t active_time) 575 { 576 int i, error = 0; 577 mblk_t *original_answer; 578 ipsa_t *walker; 579 sadb_msg_t *samsg; 580 time_t current; 581 582 /* 583 * For each IPSA hash bucket do: 584 * - Hold the mutex 585 * - Walk each entry, doing an sadb_dump_deliver() on it. 586 */ 587 ASSERT(mp->b_cont != NULL); 588 samsg = (sadb_msg_t *)mp->b_cont->b_rptr; 589 590 original_answer = sadb_keysock_out(serial); 591 if (original_answer == NULL) 592 return (ENOMEM); 593 594 current = gethrestime_sec(); 595 for (i = 0; i < num_entries; i++) { 596 mutex_enter(&fanout[i].isaf_lock); 597 for (walker = fanout[i].isaf_ipsa; walker != NULL; 598 walker = walker->ipsa_next) { 599 if (!do_peers && walker->ipsa_haspeer) 600 continue; 601 if ((active_time != 0) && 602 ((current - walker->ipsa_lastuse) > active_time)) 603 continue; 604 error = sadb_dump_deliver(pfkey_q, original_answer, 605 walker, samsg); 606 if (error == ENOBUFS) { 607 mblk_t *new_original_answer; 608 609 /* Ran out of dupb's. Try a copyb. */ 610 new_original_answer = copyb(original_answer); 611 if (new_original_answer == NULL) { 612 error = ENOMEM; 613 } else { 614 freeb(original_answer); 615 original_answer = new_original_answer; 616 error = sadb_dump_deliver(pfkey_q, 617 original_answer, walker, samsg); 618 } 619 } 620 if (error != 0) 621 break; /* out of for loop. */ 622 } 623 mutex_exit(&fanout[i].isaf_lock); 624 if (error != 0) 625 break; /* out of for loop. */ 626 } 627 628 freeb(original_answer); 629 return (error); 630 } 631 632 /* 633 * Dump an entire SADB; outbound first, then inbound. 634 */ 635 636 int 637 sadb_dump(queue_t *pfkey_q, mblk_t *mp, keysock_in_t *ksi, sadb_t *sp) 638 { 639 int error; 640 time_t active_time = 0; 641 sadb_x_edump_t *edump = 642 (sadb_x_edump_t *)ksi->ks_in_extv[SADB_X_EXT_EDUMP]; 643 644 if (edump != NULL) { 645 active_time = edump->sadb_x_edump_timeout; 646 } 647 648 /* Dump outbound */ 649 error = sadb_dump_fanout(pfkey_q, mp, ksi->ks_in_serial, sp->sdb_of, 650 sp->sdb_hashsize, B_TRUE, active_time); 651 if (error) 652 return (error); 653 654 /* Dump inbound */ 655 return sadb_dump_fanout(pfkey_q, mp, ksi->ks_in_serial, sp->sdb_if, 656 sp->sdb_hashsize, B_FALSE, active_time); 657 } 658 659 /* 660 * Generic sadb table walker. 661 * 662 * Call "walkfn" for each SA in each bucket in "table"; pass the 663 * bucket, the entry and "cookie" to the callback function. 664 * Take care to ensure that walkfn can delete the SA without screwing 665 * up our traverse. 666 * 667 * The bucket is locked for the duration of the callback, both so that the 668 * callback can just call sadb_unlinkassoc() when it wants to delete something, 669 * and so that no new entries are added while we're walking the list. 670 */ 671 static void 672 sadb_walker(isaf_t *table, uint_t numentries, 673 void (*walkfn)(isaf_t *head, ipsa_t *entry, void *cookie), 674 void *cookie) 675 { 676 int i; 677 for (i = 0; i < numentries; i++) { 678 ipsa_t *entry, *next; 679 680 mutex_enter(&table[i].isaf_lock); 681 682 for (entry = table[i].isaf_ipsa; entry != NULL; 683 entry = next) { 684 next = entry->ipsa_next; 685 (*walkfn)(&table[i], entry, cookie); 686 } 687 mutex_exit(&table[i].isaf_lock); 688 } 689 } 690 691 /* 692 * From the given SA, construct a dl_ct_ipsec_key and 693 * a dl_ct_ipsec structures to be sent to the adapter as part 694 * of a DL_CONTROL_REQ. 695 * 696 * ct_sa must point to the storage allocated for the key 697 * structure and must be followed by storage allocated 698 * for the SA information that must be sent to the driver 699 * as part of the DL_CONTROL_REQ request. 700 * 701 * The is_inbound boolean indicates whether the specified 702 * SA is part of an inbound SA table. 703 * 704 * Returns B_TRUE if the corresponding SA must be passed to 705 * a provider, B_FALSE otherwise; frees *mp if it returns B_FALSE. 706 */ 707 static boolean_t 708 sadb_req_from_sa(ipsa_t *sa, mblk_t *mp, boolean_t is_inbound) 709 { 710 dl_ct_ipsec_key_t *keyp; 711 dl_ct_ipsec_t *sap; 712 void *ct_sa = mp->b_wptr; 713 714 ASSERT(MUTEX_HELD(&sa->ipsa_lock)); 715 716 keyp = (dl_ct_ipsec_key_t *)(ct_sa); 717 sap = (dl_ct_ipsec_t *)(keyp + 1); 718 719 IPSECHW_DEBUG(IPSECHW_CAPAB, ("sadb_req_from_sa: " 720 "is_inbound = %d\n", is_inbound)); 721 722 /* initialize flag */ 723 sap->sadb_sa_flags = 0; 724 if (is_inbound) { 725 sap->sadb_sa_flags |= DL_CT_IPSEC_INBOUND; 726 /* 727 * If an inbound SA has a peer, then mark it has being 728 * an outbound SA as well. 729 */ 730 if (sa->ipsa_haspeer) 731 sap->sadb_sa_flags |= DL_CT_IPSEC_OUTBOUND; 732 } else { 733 /* 734 * If an outbound SA has a peer, then don't send it, 735 * since we will send the copy from the inbound table. 736 */ 737 if (sa->ipsa_haspeer) { 738 freemsg(mp); 739 return (B_FALSE); 740 } 741 sap->sadb_sa_flags |= DL_CT_IPSEC_OUTBOUND; 742 } 743 744 keyp->dl_key_spi = sa->ipsa_spi; 745 bcopy(sa->ipsa_dstaddr, keyp->dl_key_dest_addr, 746 DL_CTL_IPSEC_ADDR_LEN); 747 keyp->dl_key_addr_family = sa->ipsa_addrfam; 748 749 sap->sadb_sa_auth = sa->ipsa_auth_alg; 750 sap->sadb_sa_encrypt = sa->ipsa_encr_alg; 751 752 sap->sadb_key_len_a = sa->ipsa_authkeylen; 753 sap->sadb_key_bits_a = sa->ipsa_authkeybits; 754 bcopy(sa->ipsa_authkey, 755 sap->sadb_key_data_a, sap->sadb_key_len_a); 756 757 sap->sadb_key_len_e = sa->ipsa_encrkeylen; 758 sap->sadb_key_bits_e = sa->ipsa_encrkeybits; 759 bcopy(sa->ipsa_encrkey, 760 sap->sadb_key_data_e, sap->sadb_key_len_e); 761 762 mp->b_wptr += sizeof (dl_ct_ipsec_t) + sizeof (dl_ct_ipsec_key_t); 763 return (B_TRUE); 764 } 765 766 /* 767 * Called from AH or ESP to format a message which will be used to inform 768 * IPsec-acceleration-capable ills of a SADB change. 769 * (It is not possible to send the message to IP directly from this function 770 * since the SA, if any, is locked during the call). 771 * 772 * dl_operation: DL_CONTROL_REQ operation (add, delete, update, etc) 773 * sa_type: identifies whether the operation applies to AH or ESP 774 * (must be one of SADB_SATYPE_AH or SADB_SATYPE_ESP) 775 * sa: Pointer to an SA. Must be non-NULL and locked 776 * for ADD, DELETE, GET, and UPDATE operations. 777 * This function returns an mblk chain that must be passed to IP 778 * for forwarding to the IPsec capable providers. 779 */ 780 mblk_t * 781 sadb_fmt_sa_req(uint_t dl_operation, uint_t sa_type, ipsa_t *sa, 782 boolean_t is_inbound) 783 { 784 mblk_t *mp; 785 dl_control_req_t *ctrl; 786 boolean_t need_key = B_FALSE; 787 mblk_t *ctl_mp = NULL; 788 ipsec_ctl_t *ctl; 789 790 /* 791 * 1 allocate and initialize DL_CONTROL_REQ M_PROTO 792 * 2 if a key is needed for the operation 793 * 2.1 initialize key 794 * 2.2 if a full SA is needed for the operation 795 * 2.2.1 initialize full SA info 796 * 3 return message; caller will call ill_ipsec_capab_send_all() 797 * to send the resulting message to IPsec capable ills. 798 */ 799 800 ASSERT(sa_type == SADB_SATYPE_AH || sa_type == SADB_SATYPE_ESP); 801 802 /* 803 * Allocate DL_CONTROL_REQ M_PROTO 804 * We allocate room for the SA even if it's not needed 805 * by some of the operations (for example flush) 806 */ 807 mp = allocb(sizeof (dl_control_req_t) + 808 sizeof (dl_ct_ipsec_key_t) + sizeof (dl_ct_ipsec_t), BPRI_HI); 809 if (mp == NULL) 810 return (NULL); 811 mp->b_datap->db_type = M_PROTO; 812 813 /* initialize dl_control_req_t */ 814 ctrl = (dl_control_req_t *)mp->b_wptr; 815 ctrl->dl_primitive = DL_CONTROL_REQ; 816 ctrl->dl_operation = dl_operation; 817 ctrl->dl_type = sa_type == SADB_SATYPE_AH ? DL_CT_IPSEC_AH : 818 DL_CT_IPSEC_ESP; 819 ctrl->dl_key_offset = sizeof (dl_control_req_t); 820 ctrl->dl_key_length = sizeof (dl_ct_ipsec_key_t); 821 ctrl->dl_data_offset = sizeof (dl_control_req_t) + 822 sizeof (dl_ct_ipsec_key_t); 823 ctrl->dl_data_length = sizeof (dl_ct_ipsec_t); 824 mp->b_wptr += sizeof (dl_control_req_t); 825 826 if ((dl_operation == DL_CO_SET) || (dl_operation == DL_CO_DELETE)) { 827 ASSERT(sa != NULL); 828 ASSERT(MUTEX_HELD(&sa->ipsa_lock)); 829 830 need_key = B_TRUE; 831 832 /* 833 * Initialize key and SA data. Note that for some 834 * operations the SA data is ignored by the provider 835 * (delete, etc.) 836 */ 837 if (!sadb_req_from_sa(sa, mp, is_inbound)) 838 return (NULL); 839 } 840 841 /* construct control message */ 842 ctl_mp = allocb(sizeof (ipsec_ctl_t), BPRI_HI); 843 if (ctl_mp == NULL) { 844 cmn_err(CE_WARN, "sadb_fmt_sa_req: allocb failed\n"); 845 freemsg(mp); 846 return (NULL); 847 } 848 849 ctl_mp->b_datap->db_type = M_CTL; 850 ctl_mp->b_wptr += sizeof (ipsec_ctl_t); 851 ctl_mp->b_cont = mp; 852 853 ctl = (ipsec_ctl_t *)ctl_mp->b_rptr; 854 ctl->ipsec_ctl_type = IPSEC_CTL; 855 ctl->ipsec_ctl_len = sizeof (ipsec_ctl_t); 856 ctl->ipsec_ctl_sa_type = sa_type; 857 858 if (need_key) { 859 /* 860 * Keep an additional reference on SA, since it will be 861 * needed by IP to send control messages corresponding 862 * to that SA from its perimeter. IP will do a 863 * IPSA_REFRELE when done with the request. 864 */ 865 ASSERT(MUTEX_HELD(&sa->ipsa_lock)); 866 IPSA_REFHOLD(sa); 867 ctl->ipsec_ctl_sa = sa; 868 } else 869 ctl->ipsec_ctl_sa = NULL; 870 871 return (ctl_mp); 872 } 873 874 875 /* 876 * Called by sadb_ill_download() to dump the entries for a specific 877 * fanout table. For each SA entry in the table passed as argument, 878 * use mp as a template and constructs a full DL_CONTROL message, and 879 * call ill_dlpi_send(), provided by IP, to send the resulting 880 * messages to the ill. 881 */ 882 static void 883 sadb_ill_df(ill_t *ill, mblk_t *mp, isaf_t *fanout, int num_entries, 884 boolean_t is_inbound) 885 { 886 ipsa_t *walker; 887 mblk_t *nmp, *salist; 888 int i, error = 0; 889 ip_stack_t *ipst = ill->ill_ipst; 890 netstack_t *ns = ipst->ips_netstack; 891 892 IPSECHW_DEBUG(IPSECHW_SADB, ("sadb_ill_df: fanout at 0x%p ne=%d\n", 893 (void *)fanout, num_entries)); 894 /* 895 * For each IPSA hash bucket do: 896 * - Hold the mutex 897 * - Walk each entry, sending a corresponding request to IP 898 * for it. 899 */ 900 ASSERT(mp->b_datap->db_type == M_PROTO); 901 902 for (i = 0; i < num_entries; i++) { 903 mutex_enter(&fanout[i].isaf_lock); 904 salist = NULL; 905 906 for (walker = fanout[i].isaf_ipsa; walker != NULL; 907 walker = walker->ipsa_next) { 908 IPSECHW_DEBUG(IPSECHW_SADB, 909 ("sadb_ill_df: sending SA to ill via IP \n")); 910 /* 911 * Duplicate the template mp passed and 912 * complete DL_CONTROL_REQ data. 913 * To be more memory efficient, we could use 914 * dupb() for the M_CTL and copyb() for the M_PROTO 915 * as the M_CTL, since the M_CTL is the same for 916 * every SA entry passed down to IP for the same ill. 917 * 918 * Note that copymsg/copyb ensure that the new mblk 919 * is at least as large as the source mblk even if it's 920 * not using all its storage -- therefore, nmp 921 * has trailing space for sadb_req_from_sa to add 922 * the SA-specific bits. 923 */ 924 mutex_enter(&walker->ipsa_lock); 925 if (ipsec_capab_match(ill, 926 ill->ill_phyint->phyint_ifindex, ill->ill_isv6, 927 walker, ns)) { 928 nmp = copymsg(mp); 929 if (nmp == NULL) { 930 IPSECHW_DEBUG(IPSECHW_SADB, 931 ("sadb_ill_df: alloc error\n")); 932 error = ENOMEM; 933 mutex_exit(&walker->ipsa_lock); 934 break; 935 } 936 if (sadb_req_from_sa(walker, nmp, is_inbound)) { 937 nmp->b_next = salist; 938 salist = nmp; 939 } 940 } 941 mutex_exit(&walker->ipsa_lock); 942 } 943 mutex_exit(&fanout[i].isaf_lock); 944 while (salist != NULL) { 945 nmp = salist; 946 salist = nmp->b_next; 947 nmp->b_next = NULL; 948 ill_dlpi_send(ill, nmp); 949 } 950 if (error != 0) 951 break; /* out of for loop. */ 952 } 953 } 954 955 /* 956 * Called by ill_ipsec_capab_add(). Sends a copy of the SADB of 957 * the type specified by sa_type to the specified ill. 958 * 959 * We call for each fanout table defined by the SADB (one per 960 * protocol). sadb_ill_df() finally calls ill_dlpi_send() for 961 * each SADB entry in order to send a corresponding DL_CONTROL_REQ 962 * message to the ill. 963 */ 964 void 965 sadb_ill_download(ill_t *ill, uint_t sa_type) 966 { 967 mblk_t *protomp; /* prototype message */ 968 dl_control_req_t *ctrl; 969 sadbp_t *spp; 970 sadb_t *sp; 971 int dlt; 972 ip_stack_t *ipst = ill->ill_ipst; 973 netstack_t *ns = ipst->ips_netstack; 974 975 ASSERT(sa_type == SADB_SATYPE_AH || sa_type == SADB_SATYPE_ESP); 976 977 /* 978 * Allocate and initialize prototype answer. A duplicate for 979 * each SA is sent down to the interface. 980 */ 981 982 /* DL_CONTROL_REQ M_PROTO mblk_t */ 983 protomp = allocb(sizeof (dl_control_req_t) + 984 sizeof (dl_ct_ipsec_key_t) + sizeof (dl_ct_ipsec_t), BPRI_HI); 985 if (protomp == NULL) 986 return; 987 protomp->b_datap->db_type = M_PROTO; 988 989 dlt = (sa_type == SADB_SATYPE_AH) ? DL_CT_IPSEC_AH : DL_CT_IPSEC_ESP; 990 if (sa_type == SADB_SATYPE_ESP) { 991 ipsecesp_stack_t *espstack = ns->netstack_ipsecesp; 992 993 spp = &espstack->esp_sadb; 994 } else { 995 ipsecah_stack_t *ahstack = ns->netstack_ipsecah; 996 997 spp = &ahstack->ah_sadb; 998 } 999 1000 ctrl = (dl_control_req_t *)protomp->b_wptr; 1001 ctrl->dl_primitive = DL_CONTROL_REQ; 1002 ctrl->dl_operation = DL_CO_SET; 1003 ctrl->dl_type = dlt; 1004 ctrl->dl_key_offset = sizeof (dl_control_req_t); 1005 ctrl->dl_key_length = sizeof (dl_ct_ipsec_key_t); 1006 ctrl->dl_data_offset = sizeof (dl_control_req_t) + 1007 sizeof (dl_ct_ipsec_key_t); 1008 ctrl->dl_data_length = sizeof (dl_ct_ipsec_t); 1009 protomp->b_wptr += sizeof (dl_control_req_t); 1010 1011 /* 1012 * then for each SADB entry, we fill out the dl_ct_ipsec_key_t 1013 * and dl_ct_ipsec_t 1014 */ 1015 sp = ill->ill_isv6 ? &(spp->s_v6) : &(spp->s_v4); 1016 sadb_ill_df(ill, protomp, sp->sdb_of, sp->sdb_hashsize, B_FALSE); 1017 sadb_ill_df(ill, protomp, sp->sdb_if, sp->sdb_hashsize, B_TRUE); 1018 freemsg(protomp); 1019 } 1020 1021 /* 1022 * Call me to free up a security association fanout. Use the forever 1023 * variable to indicate freeing up the SAs (forever == B_FALSE, e.g. 1024 * an SADB_FLUSH message), or destroying everything (forever == B_TRUE, 1025 * when a module is unloaded). 1026 */ 1027 static void 1028 sadb_destroyer(isaf_t **tablep, uint_t numentries, boolean_t forever, 1029 boolean_t inbound) 1030 { 1031 int i; 1032 isaf_t *table = *tablep; 1033 uint8_t protocol; 1034 ipsa_t *sa; 1035 netstackid_t sid; 1036 1037 if (table == NULL) 1038 return; 1039 1040 for (i = 0; i < numentries; i++) { 1041 mutex_enter(&table[i].isaf_lock); 1042 while ((sa = table[i].isaf_ipsa) != NULL) { 1043 if (inbound && cl_inet_deletespi && 1044 (sa->ipsa_state != IPSA_STATE_ACTIVE_ELSEWHERE) && 1045 (sa->ipsa_state != IPSA_STATE_IDLE)) { 1046 protocol = (sa->ipsa_type == SADB_SATYPE_AH) ? 1047 IPPROTO_AH : IPPROTO_ESP; 1048 sid = sa->ipsa_netstack->netstack_stackid; 1049 cl_inet_deletespi(sid, protocol, sa->ipsa_spi, 1050 NULL); 1051 } 1052 sadb_unlinkassoc(sa); 1053 } 1054 table[i].isaf_gen++; 1055 mutex_exit(&table[i].isaf_lock); 1056 if (forever) 1057 mutex_destroy(&(table[i].isaf_lock)); 1058 } 1059 1060 if (forever) { 1061 *tablep = NULL; 1062 kmem_free(table, numentries * sizeof (*table)); 1063 } 1064 } 1065 1066 /* 1067 * Entry points to sadb_destroyer(). 1068 */ 1069 static void 1070 sadb_flush(sadb_t *sp, netstack_t *ns) 1071 { 1072 /* 1073 * Flush out each bucket, one at a time. Were it not for keysock's 1074 * enforcement, there would be a subtlety where I could add on the 1075 * heels of a flush. With keysock's enforcement, however, this 1076 * makes ESP's job easy. 1077 */ 1078 sadb_destroyer(&sp->sdb_of, sp->sdb_hashsize, B_FALSE, B_FALSE); 1079 sadb_destroyer(&sp->sdb_if, sp->sdb_hashsize, B_FALSE, B_TRUE); 1080 1081 /* For each acquire, destroy it; leave the bucket mutex alone. */ 1082 sadb_destroy_acqlist(&sp->sdb_acq, sp->sdb_hashsize, B_FALSE, ns); 1083 } 1084 1085 static void 1086 sadb_destroy(sadb_t *sp, netstack_t *ns) 1087 { 1088 sadb_destroyer(&sp->sdb_of, sp->sdb_hashsize, B_TRUE, B_FALSE); 1089 sadb_destroyer(&sp->sdb_if, sp->sdb_hashsize, B_TRUE, B_TRUE); 1090 1091 /* For each acquire, destroy it, including the bucket mutex. */ 1092 sadb_destroy_acqlist(&sp->sdb_acq, sp->sdb_hashsize, B_TRUE, ns); 1093 1094 ASSERT(sp->sdb_of == NULL); 1095 ASSERT(sp->sdb_if == NULL); 1096 ASSERT(sp->sdb_acq == NULL); 1097 } 1098 1099 static void 1100 sadb_send_flush_req(sadbp_t *spp) 1101 { 1102 mblk_t *ctl_mp; 1103 1104 /* 1105 * we've been unplumbed, or never were plumbed; don't go there. 1106 */ 1107 if (spp->s_ip_q == NULL) 1108 return; 1109 1110 /* have IP send a flush msg to the IPsec accelerators */ 1111 ctl_mp = sadb_fmt_sa_req(DL_CO_FLUSH, spp->s_satype, NULL, B_TRUE); 1112 if (ctl_mp != NULL) 1113 putnext(spp->s_ip_q, ctl_mp); 1114 } 1115 1116 void 1117 sadbp_flush(sadbp_t *spp, netstack_t *ns) 1118 { 1119 sadb_flush(&spp->s_v4, ns); 1120 sadb_flush(&spp->s_v6, ns); 1121 1122 sadb_send_flush_req(spp); 1123 } 1124 1125 void 1126 sadbp_destroy(sadbp_t *spp, netstack_t *ns) 1127 { 1128 sadb_destroy(&spp->s_v4, ns); 1129 sadb_destroy(&spp->s_v6, ns); 1130 1131 sadb_send_flush_req(spp); 1132 if (spp->s_satype == SADB_SATYPE_AH) { 1133 ipsec_stack_t *ipss = ns->netstack_ipsec; 1134 1135 ip_drop_unregister(&ipss->ipsec_sadb_dropper); 1136 } 1137 } 1138 1139 1140 /* 1141 * Check hard vs. soft lifetimes. If there's a reality mismatch (e.g. 1142 * soft lifetimes > hard lifetimes) return an appropriate diagnostic for 1143 * EINVAL. 1144 */ 1145 int 1146 sadb_hardsoftchk(sadb_lifetime_t *hard, sadb_lifetime_t *soft, 1147 sadb_lifetime_t *idle) 1148 { 1149 if (hard == NULL || soft == NULL) 1150 return (0); 1151 1152 if (hard->sadb_lifetime_allocations != 0 && 1153 soft->sadb_lifetime_allocations != 0 && 1154 hard->sadb_lifetime_allocations < soft->sadb_lifetime_allocations) 1155 return (SADB_X_DIAGNOSTIC_ALLOC_HSERR); 1156 1157 if (hard->sadb_lifetime_bytes != 0 && 1158 soft->sadb_lifetime_bytes != 0 && 1159 hard->sadb_lifetime_bytes < soft->sadb_lifetime_bytes) 1160 return (SADB_X_DIAGNOSTIC_BYTES_HSERR); 1161 1162 if (hard->sadb_lifetime_addtime != 0 && 1163 soft->sadb_lifetime_addtime != 0 && 1164 hard->sadb_lifetime_addtime < soft->sadb_lifetime_addtime) 1165 return (SADB_X_DIAGNOSTIC_ADDTIME_HSERR); 1166 1167 if (hard->sadb_lifetime_usetime != 0 && 1168 soft->sadb_lifetime_usetime != 0 && 1169 hard->sadb_lifetime_usetime < soft->sadb_lifetime_usetime) 1170 return (SADB_X_DIAGNOSTIC_USETIME_HSERR); 1171 1172 if (idle != NULL) { 1173 if (hard->sadb_lifetime_addtime != 0 && 1174 idle->sadb_lifetime_addtime != 0 && 1175 hard->sadb_lifetime_addtime < idle->sadb_lifetime_addtime) 1176 return (SADB_X_DIAGNOSTIC_ADDTIME_HSERR); 1177 1178 if (soft->sadb_lifetime_addtime != 0 && 1179 idle->sadb_lifetime_addtime != 0 && 1180 soft->sadb_lifetime_addtime < idle->sadb_lifetime_addtime) 1181 return (SADB_X_DIAGNOSTIC_ADDTIME_HSERR); 1182 1183 if (hard->sadb_lifetime_usetime != 0 && 1184 idle->sadb_lifetime_usetime != 0 && 1185 hard->sadb_lifetime_usetime < idle->sadb_lifetime_usetime) 1186 return (SADB_X_DIAGNOSTIC_USETIME_HSERR); 1187 1188 if (soft->sadb_lifetime_usetime != 0 && 1189 idle->sadb_lifetime_usetime != 0 && 1190 soft->sadb_lifetime_usetime < idle->sadb_lifetime_usetime) 1191 return (SADB_X_DIAGNOSTIC_USETIME_HSERR); 1192 } 1193 1194 return (0); 1195 } 1196 1197 /* 1198 * Clone a security association for the purposes of inserting a single SA 1199 * into inbound and outbound tables respectively. This function should only 1200 * be called from sadb_common_add(). 1201 */ 1202 static ipsa_t * 1203 sadb_cloneassoc(ipsa_t *ipsa) 1204 { 1205 ipsa_t *newbie; 1206 boolean_t error = B_FALSE; 1207 1208 ASSERT(MUTEX_NOT_HELD(&(ipsa->ipsa_lock))); 1209 1210 newbie = kmem_alloc(sizeof (ipsa_t), KM_NOSLEEP); 1211 if (newbie == NULL) 1212 return (NULL); 1213 1214 /* Copy over what we can. */ 1215 *newbie = *ipsa; 1216 1217 /* bzero and initialize locks, in case *_init() allocates... */ 1218 mutex_init(&newbie->ipsa_lock, NULL, MUTEX_DEFAULT, NULL); 1219 1220 /* 1221 * While somewhat dain-bramaged, the most graceful way to 1222 * recover from errors is to keep plowing through the 1223 * allocations, and getting what I can. It's easier to call 1224 * sadb_freeassoc() on the stillborn clone when all the 1225 * pointers aren't pointing to the parent's data. 1226 */ 1227 1228 if (ipsa->ipsa_authkey != NULL) { 1229 newbie->ipsa_authkey = kmem_alloc(newbie->ipsa_authkeylen, 1230 KM_NOSLEEP); 1231 if (newbie->ipsa_authkey == NULL) { 1232 error = B_TRUE; 1233 } else { 1234 bcopy(ipsa->ipsa_authkey, newbie->ipsa_authkey, 1235 newbie->ipsa_authkeylen); 1236 1237 newbie->ipsa_kcfauthkey.ck_data = 1238 newbie->ipsa_authkey; 1239 } 1240 1241 if (newbie->ipsa_amech.cm_param != NULL) { 1242 newbie->ipsa_amech.cm_param = 1243 (char *)&newbie->ipsa_mac_len; 1244 } 1245 } 1246 1247 if (ipsa->ipsa_encrkey != NULL) { 1248 newbie->ipsa_encrkey = kmem_alloc(newbie->ipsa_encrkeylen, 1249 KM_NOSLEEP); 1250 if (newbie->ipsa_encrkey == NULL) { 1251 error = B_TRUE; 1252 } else { 1253 bcopy(ipsa->ipsa_encrkey, newbie->ipsa_encrkey, 1254 newbie->ipsa_encrkeylen); 1255 1256 newbie->ipsa_kcfencrkey.ck_data = 1257 newbie->ipsa_encrkey; 1258 } 1259 } 1260 1261 newbie->ipsa_authtmpl = NULL; 1262 newbie->ipsa_encrtmpl = NULL; 1263 newbie->ipsa_haspeer = B_TRUE; 1264 1265 if (ipsa->ipsa_integ != NULL) { 1266 newbie->ipsa_integ = kmem_alloc(newbie->ipsa_integlen, 1267 KM_NOSLEEP); 1268 if (newbie->ipsa_integ == NULL) { 1269 error = B_TRUE; 1270 } else { 1271 bcopy(ipsa->ipsa_integ, newbie->ipsa_integ, 1272 newbie->ipsa_integlen); 1273 } 1274 } 1275 1276 if (ipsa->ipsa_sens != NULL) { 1277 newbie->ipsa_sens = kmem_alloc(newbie->ipsa_senslen, 1278 KM_NOSLEEP); 1279 if (newbie->ipsa_sens == NULL) { 1280 error = B_TRUE; 1281 } else { 1282 bcopy(ipsa->ipsa_sens, newbie->ipsa_sens, 1283 newbie->ipsa_senslen); 1284 } 1285 } 1286 1287 if (ipsa->ipsa_src_cid != NULL) { 1288 newbie->ipsa_src_cid = ipsa->ipsa_src_cid; 1289 IPSID_REFHOLD(ipsa->ipsa_src_cid); 1290 } 1291 1292 if (ipsa->ipsa_dst_cid != NULL) { 1293 newbie->ipsa_dst_cid = ipsa->ipsa_dst_cid; 1294 IPSID_REFHOLD(ipsa->ipsa_dst_cid); 1295 } 1296 1297 if (error) { 1298 sadb_freeassoc(newbie); 1299 return (NULL); 1300 } 1301 1302 return (newbie); 1303 } 1304 1305 /* 1306 * Initialize a SADB address extension at the address specified by addrext. 1307 * Return a pointer to the end of the new address extension. 1308 */ 1309 static uint8_t * 1310 sadb_make_addr_ext(uint8_t *start, uint8_t *end, uint16_t exttype, 1311 sa_family_t af, uint32_t *addr, uint16_t port, uint8_t proto, int prefix) 1312 { 1313 struct sockaddr_in *sin; 1314 struct sockaddr_in6 *sin6; 1315 uint8_t *cur = start; 1316 int addrext_len; 1317 int sin_len; 1318 sadb_address_t *addrext = (sadb_address_t *)cur; 1319 1320 if (cur == NULL) 1321 return (NULL); 1322 1323 cur += sizeof (*addrext); 1324 if (cur > end) 1325 return (NULL); 1326 1327 addrext->sadb_address_proto = proto; 1328 addrext->sadb_address_prefixlen = prefix; 1329 addrext->sadb_address_reserved = 0; 1330 addrext->sadb_address_exttype = exttype; 1331 1332 switch (af) { 1333 case AF_INET: 1334 sin = (struct sockaddr_in *)cur; 1335 sin_len = sizeof (*sin); 1336 cur += sin_len; 1337 if (cur > end) 1338 return (NULL); 1339 1340 sin->sin_family = af; 1341 bzero(sin->sin_zero, sizeof (sin->sin_zero)); 1342 sin->sin_port = port; 1343 IPSA_COPY_ADDR(&sin->sin_addr, addr, af); 1344 break; 1345 case AF_INET6: 1346 sin6 = (struct sockaddr_in6 *)cur; 1347 sin_len = sizeof (*sin6); 1348 cur += sin_len; 1349 if (cur > end) 1350 return (NULL); 1351 1352 bzero(sin6, sizeof (*sin6)); 1353 sin6->sin6_family = af; 1354 sin6->sin6_port = port; 1355 IPSA_COPY_ADDR(&sin6->sin6_addr, addr, af); 1356 break; 1357 } 1358 1359 addrext_len = roundup(cur - start, sizeof (uint64_t)); 1360 addrext->sadb_address_len = SADB_8TO64(addrext_len); 1361 1362 cur = start + addrext_len; 1363 if (cur > end) 1364 cur = NULL; 1365 1366 return (cur); 1367 } 1368 1369 /* 1370 * Construct a key management cookie extension. 1371 */ 1372 1373 static uint8_t * 1374 sadb_make_kmc_ext(uint8_t *cur, uint8_t *end, uint32_t kmp, uint32_t kmc) 1375 { 1376 sadb_x_kmc_t *kmcext = (sadb_x_kmc_t *)cur; 1377 1378 if (cur == NULL) 1379 return (NULL); 1380 1381 cur += sizeof (*kmcext); 1382 1383 if (cur > end) 1384 return (NULL); 1385 1386 kmcext->sadb_x_kmc_len = SADB_8TO64(sizeof (*kmcext)); 1387 kmcext->sadb_x_kmc_exttype = SADB_X_EXT_KM_COOKIE; 1388 kmcext->sadb_x_kmc_proto = kmp; 1389 kmcext->sadb_x_kmc_cookie = kmc; 1390 kmcext->sadb_x_kmc_reserved = 0; 1391 1392 return (cur); 1393 } 1394 1395 /* 1396 * Given an original message header with sufficient space following it, and an 1397 * SA, construct a full PF_KEY message with all of the relevant extensions. 1398 * This is mostly used for SADB_GET, and SADB_DUMP. 1399 */ 1400 static mblk_t * 1401 sadb_sa2msg(ipsa_t *ipsa, sadb_msg_t *samsg) 1402 { 1403 int alloclen, addrsize, paddrsize, authsize, encrsize; 1404 int srcidsize, dstidsize; 1405 sa_family_t fam, pfam; /* Address family for SADB_EXT_ADDRESS */ 1406 /* src/dst and proxy sockaddrs. */ 1407 /* 1408 * The following are pointers into the PF_KEY message this PF_KEY 1409 * message creates. 1410 */ 1411 sadb_msg_t *newsamsg; 1412 sadb_sa_t *assoc; 1413 sadb_lifetime_t *lt; 1414 sadb_key_t *key; 1415 sadb_ident_t *ident; 1416 sadb_sens_t *sens; 1417 sadb_ext_t *walker; /* For when we need a generic ext. pointer. */ 1418 sadb_x_replay_ctr_t *repl_ctr; 1419 sadb_x_pair_t *pair_ext; 1420 1421 mblk_t *mp; 1422 uint64_t *bitmap; 1423 uint8_t *cur, *end; 1424 /* These indicate the presence of the above extension fields. */ 1425 boolean_t soft, hard, isrc, idst, auth, encr, sensinteg, srcid, dstid; 1426 boolean_t idle; 1427 boolean_t paired; 1428 uint32_t otherspi; 1429 1430 /* First off, figure out the allocation length for this message. */ 1431 1432 /* 1433 * Constant stuff. This includes base, SA, address (src, dst), 1434 * and lifetime (current). 1435 */ 1436 alloclen = sizeof (sadb_msg_t) + sizeof (sadb_sa_t) + 1437 sizeof (sadb_lifetime_t); 1438 1439 fam = ipsa->ipsa_addrfam; 1440 switch (fam) { 1441 case AF_INET: 1442 addrsize = roundup(sizeof (struct sockaddr_in) + 1443 sizeof (sadb_address_t), sizeof (uint64_t)); 1444 break; 1445 case AF_INET6: 1446 addrsize = roundup(sizeof (struct sockaddr_in6) + 1447 sizeof (sadb_address_t), sizeof (uint64_t)); 1448 break; 1449 default: 1450 return (NULL); 1451 } 1452 /* 1453 * Allocate TWO address extensions, for source and destination. 1454 * (Thus, the * 2.) 1455 */ 1456 alloclen += addrsize * 2; 1457 if (ipsa->ipsa_flags & IPSA_F_NATT_REM) 1458 alloclen += addrsize; 1459 if (ipsa->ipsa_flags & IPSA_F_NATT_LOC) 1460 alloclen += addrsize; 1461 1462 if (ipsa->ipsa_flags & IPSA_F_PAIRED) { 1463 paired = B_TRUE; 1464 alloclen += sizeof (sadb_x_pair_t); 1465 otherspi = ipsa->ipsa_otherspi; 1466 } else { 1467 paired = B_FALSE; 1468 } 1469 1470 /* How 'bout other lifetimes? */ 1471 if (ipsa->ipsa_softaddlt != 0 || ipsa->ipsa_softuselt != 0 || 1472 ipsa->ipsa_softbyteslt != 0 || ipsa->ipsa_softalloc != 0) { 1473 alloclen += sizeof (sadb_lifetime_t); 1474 soft = B_TRUE; 1475 } else { 1476 soft = B_FALSE; 1477 } 1478 1479 if (ipsa->ipsa_hardaddlt != 0 || ipsa->ipsa_harduselt != 0 || 1480 ipsa->ipsa_hardbyteslt != 0 || ipsa->ipsa_hardalloc != 0) { 1481 alloclen += sizeof (sadb_lifetime_t); 1482 hard = B_TRUE; 1483 } else { 1484 hard = B_FALSE; 1485 } 1486 1487 if (ipsa->ipsa_idleaddlt != 0 || ipsa->ipsa_idleuselt != 0) { 1488 alloclen += sizeof (sadb_lifetime_t); 1489 idle = B_TRUE; 1490 } else { 1491 idle = B_FALSE; 1492 } 1493 1494 /* Inner addresses. */ 1495 if (ipsa->ipsa_innerfam == 0) { 1496 isrc = B_FALSE; 1497 idst = B_FALSE; 1498 } else { 1499 pfam = ipsa->ipsa_innerfam; 1500 switch (pfam) { 1501 case AF_INET6: 1502 paddrsize = roundup(sizeof (struct sockaddr_in6) + 1503 sizeof (sadb_address_t), sizeof (uint64_t)); 1504 break; 1505 case AF_INET: 1506 paddrsize = roundup(sizeof (struct sockaddr_in) + 1507 sizeof (sadb_address_t), sizeof (uint64_t)); 1508 break; 1509 default: 1510 cmn_err(CE_PANIC, 1511 "IPsec SADB: Proxy length failure.\n"); 1512 break; 1513 } 1514 isrc = B_TRUE; 1515 idst = B_TRUE; 1516 alloclen += 2 * paddrsize; 1517 } 1518 1519 /* For the following fields, assume that length != 0 ==> stuff */ 1520 if (ipsa->ipsa_authkeylen != 0) { 1521 authsize = roundup(sizeof (sadb_key_t) + ipsa->ipsa_authkeylen, 1522 sizeof (uint64_t)); 1523 alloclen += authsize; 1524 auth = B_TRUE; 1525 } else { 1526 auth = B_FALSE; 1527 } 1528 1529 if (ipsa->ipsa_encrkeylen != 0) { 1530 encrsize = roundup(sizeof (sadb_key_t) + ipsa->ipsa_encrkeylen, 1531 sizeof (uint64_t)); 1532 alloclen += encrsize; 1533 encr = B_TRUE; 1534 } else { 1535 encr = B_FALSE; 1536 } 1537 1538 /* No need for roundup on sens and integ. */ 1539 if (ipsa->ipsa_integlen != 0 || ipsa->ipsa_senslen != 0) { 1540 alloclen += sizeof (sadb_key_t) + ipsa->ipsa_integlen + 1541 ipsa->ipsa_senslen; 1542 sensinteg = B_TRUE; 1543 } else { 1544 sensinteg = B_FALSE; 1545 } 1546 1547 /* 1548 * Must use strlen() here for lengths. Identities use NULL 1549 * pointers to indicate their nonexistence. 1550 */ 1551 if (ipsa->ipsa_src_cid != NULL) { 1552 srcidsize = roundup(sizeof (sadb_ident_t) + 1553 strlen(ipsa->ipsa_src_cid->ipsid_cid) + 1, 1554 sizeof (uint64_t)); 1555 alloclen += srcidsize; 1556 srcid = B_TRUE; 1557 } else { 1558 srcid = B_FALSE; 1559 } 1560 1561 if (ipsa->ipsa_dst_cid != NULL) { 1562 dstidsize = roundup(sizeof (sadb_ident_t) + 1563 strlen(ipsa->ipsa_dst_cid->ipsid_cid) + 1, 1564 sizeof (uint64_t)); 1565 alloclen += dstidsize; 1566 dstid = B_TRUE; 1567 } else { 1568 dstid = B_FALSE; 1569 } 1570 1571 if ((ipsa->ipsa_kmp != 0) || (ipsa->ipsa_kmc != 0)) 1572 alloclen += sizeof (sadb_x_kmc_t); 1573 1574 if (ipsa->ipsa_replay != 0) { 1575 alloclen += sizeof (sadb_x_replay_ctr_t); 1576 } 1577 1578 /* Make sure the allocation length is a multiple of 8 bytes. */ 1579 ASSERT((alloclen & 0x7) == 0); 1580 1581 /* XXX Possibly make it esballoc, with a bzero-ing free_ftn. */ 1582 mp = allocb(alloclen, BPRI_HI); 1583 if (mp == NULL) 1584 return (NULL); 1585 1586 mp->b_wptr += alloclen; 1587 end = mp->b_wptr; 1588 newsamsg = (sadb_msg_t *)mp->b_rptr; 1589 *newsamsg = *samsg; 1590 newsamsg->sadb_msg_len = (uint16_t)SADB_8TO64(alloclen); 1591 1592 mutex_enter(&ipsa->ipsa_lock); /* Since I'm grabbing SA fields... */ 1593 1594 newsamsg->sadb_msg_satype = ipsa->ipsa_type; 1595 1596 assoc = (sadb_sa_t *)(newsamsg + 1); 1597 assoc->sadb_sa_len = SADB_8TO64(sizeof (*assoc)); 1598 assoc->sadb_sa_exttype = SADB_EXT_SA; 1599 assoc->sadb_sa_spi = ipsa->ipsa_spi; 1600 assoc->sadb_sa_replay = ipsa->ipsa_replay_wsize; 1601 assoc->sadb_sa_state = ipsa->ipsa_state; 1602 assoc->sadb_sa_auth = ipsa->ipsa_auth_alg; 1603 assoc->sadb_sa_encrypt = ipsa->ipsa_encr_alg; 1604 assoc->sadb_sa_flags = ipsa->ipsa_flags; 1605 1606 lt = (sadb_lifetime_t *)(assoc + 1); 1607 lt->sadb_lifetime_len = SADB_8TO64(sizeof (*lt)); 1608 lt->sadb_lifetime_exttype = SADB_EXT_LIFETIME_CURRENT; 1609 /* We do not support the concept. */ 1610 lt->sadb_lifetime_allocations = 0; 1611 lt->sadb_lifetime_bytes = ipsa->ipsa_bytes; 1612 lt->sadb_lifetime_addtime = ipsa->ipsa_addtime; 1613 lt->sadb_lifetime_usetime = ipsa->ipsa_usetime; 1614 1615 if (hard) { 1616 lt++; 1617 lt->sadb_lifetime_len = SADB_8TO64(sizeof (*lt)); 1618 lt->sadb_lifetime_exttype = SADB_EXT_LIFETIME_HARD; 1619 lt->sadb_lifetime_allocations = ipsa->ipsa_hardalloc; 1620 lt->sadb_lifetime_bytes = ipsa->ipsa_hardbyteslt; 1621 lt->sadb_lifetime_addtime = ipsa->ipsa_hardaddlt; 1622 lt->sadb_lifetime_usetime = ipsa->ipsa_harduselt; 1623 } 1624 1625 if (soft) { 1626 lt++; 1627 lt->sadb_lifetime_len = SADB_8TO64(sizeof (*lt)); 1628 lt->sadb_lifetime_exttype = SADB_EXT_LIFETIME_SOFT; 1629 lt->sadb_lifetime_allocations = ipsa->ipsa_softalloc; 1630 lt->sadb_lifetime_bytes = ipsa->ipsa_softbyteslt; 1631 lt->sadb_lifetime_addtime = ipsa->ipsa_softaddlt; 1632 lt->sadb_lifetime_usetime = ipsa->ipsa_softuselt; 1633 } 1634 1635 if (idle) { 1636 lt++; 1637 lt->sadb_lifetime_len = SADB_8TO64(sizeof (*lt)); 1638 lt->sadb_lifetime_exttype = SADB_X_EXT_LIFETIME_IDLE; 1639 lt->sadb_lifetime_addtime = ipsa->ipsa_idleaddlt; 1640 lt->sadb_lifetime_usetime = ipsa->ipsa_idleuselt; 1641 } 1642 1643 cur = (uint8_t *)(lt + 1); 1644 1645 /* NOTE: Don't fill in ports here if we are a tunnel-mode SA. */ 1646 cur = sadb_make_addr_ext(cur, end, SADB_EXT_ADDRESS_SRC, fam, 1647 ipsa->ipsa_srcaddr, (!isrc && !idst) ? SA_SRCPORT(ipsa) : 0, 1648 SA_PROTO(ipsa), 0); 1649 if (cur == NULL) { 1650 freemsg(mp); 1651 mp = NULL; 1652 goto bail; 1653 } 1654 1655 cur = sadb_make_addr_ext(cur, end, SADB_EXT_ADDRESS_DST, fam, 1656 ipsa->ipsa_dstaddr, (!isrc && !idst) ? SA_DSTPORT(ipsa) : 0, 1657 SA_PROTO(ipsa), 0); 1658 if (cur == NULL) { 1659 freemsg(mp); 1660 mp = NULL; 1661 goto bail; 1662 } 1663 1664 if (ipsa->ipsa_flags & IPSA_F_NATT_LOC) { 1665 cur = sadb_make_addr_ext(cur, end, SADB_X_EXT_ADDRESS_NATT_LOC, 1666 fam, &ipsa->ipsa_natt_addr_loc, ipsa->ipsa_local_nat_port, 1667 IPPROTO_UDP, 0); 1668 if (cur == NULL) { 1669 freemsg(mp); 1670 mp = NULL; 1671 goto bail; 1672 } 1673 } 1674 1675 if (ipsa->ipsa_flags & IPSA_F_NATT_REM) { 1676 cur = sadb_make_addr_ext(cur, end, SADB_X_EXT_ADDRESS_NATT_REM, 1677 fam, &ipsa->ipsa_natt_addr_rem, ipsa->ipsa_remote_nat_port, 1678 IPPROTO_UDP, 0); 1679 if (cur == NULL) { 1680 freemsg(mp); 1681 mp = NULL; 1682 goto bail; 1683 } 1684 } 1685 1686 /* If we are a tunnel-mode SA, fill in the inner-selectors. */ 1687 if (isrc) { 1688 cur = sadb_make_addr_ext(cur, end, SADB_X_EXT_ADDRESS_INNER_SRC, 1689 pfam, ipsa->ipsa_innersrc, SA_SRCPORT(ipsa), 1690 SA_IPROTO(ipsa), ipsa->ipsa_innersrcpfx); 1691 if (cur == NULL) { 1692 freemsg(mp); 1693 mp = NULL; 1694 goto bail; 1695 } 1696 } 1697 1698 if (idst) { 1699 cur = sadb_make_addr_ext(cur, end, SADB_X_EXT_ADDRESS_INNER_DST, 1700 pfam, ipsa->ipsa_innerdst, SA_DSTPORT(ipsa), 1701 SA_IPROTO(ipsa), ipsa->ipsa_innerdstpfx); 1702 if (cur == NULL) { 1703 freemsg(mp); 1704 mp = NULL; 1705 goto bail; 1706 } 1707 } 1708 1709 if ((ipsa->ipsa_kmp != 0) || (ipsa->ipsa_kmc != 0)) { 1710 cur = sadb_make_kmc_ext(cur, end, 1711 ipsa->ipsa_kmp, ipsa->ipsa_kmc); 1712 if (cur == NULL) { 1713 freemsg(mp); 1714 mp = NULL; 1715 goto bail; 1716 } 1717 } 1718 1719 walker = (sadb_ext_t *)cur; 1720 if (auth) { 1721 key = (sadb_key_t *)walker; 1722 key->sadb_key_len = SADB_8TO64(authsize); 1723 key->sadb_key_exttype = SADB_EXT_KEY_AUTH; 1724 key->sadb_key_bits = ipsa->ipsa_authkeybits; 1725 key->sadb_key_reserved = 0; 1726 bcopy(ipsa->ipsa_authkey, key + 1, ipsa->ipsa_authkeylen); 1727 walker = (sadb_ext_t *)((uint64_t *)walker + 1728 walker->sadb_ext_len); 1729 } 1730 1731 if (encr) { 1732 key = (sadb_key_t *)walker; 1733 key->sadb_key_len = SADB_8TO64(encrsize); 1734 key->sadb_key_exttype = SADB_EXT_KEY_ENCRYPT; 1735 key->sadb_key_bits = ipsa->ipsa_encrkeybits; 1736 key->sadb_key_reserved = 0; 1737 bcopy(ipsa->ipsa_encrkey, key + 1, ipsa->ipsa_encrkeylen); 1738 walker = (sadb_ext_t *)((uint64_t *)walker + 1739 walker->sadb_ext_len); 1740 } 1741 1742 if (srcid) { 1743 ident = (sadb_ident_t *)walker; 1744 ident->sadb_ident_len = SADB_8TO64(srcidsize); 1745 ident->sadb_ident_exttype = SADB_EXT_IDENTITY_SRC; 1746 ident->sadb_ident_type = ipsa->ipsa_src_cid->ipsid_type; 1747 ident->sadb_ident_id = 0; 1748 ident->sadb_ident_reserved = 0; 1749 (void) strcpy((char *)(ident + 1), 1750 ipsa->ipsa_src_cid->ipsid_cid); 1751 walker = (sadb_ext_t *)((uint64_t *)walker + 1752 walker->sadb_ext_len); 1753 } 1754 1755 if (dstid) { 1756 ident = (sadb_ident_t *)walker; 1757 ident->sadb_ident_len = SADB_8TO64(dstidsize); 1758 ident->sadb_ident_exttype = SADB_EXT_IDENTITY_DST; 1759 ident->sadb_ident_type = ipsa->ipsa_dst_cid->ipsid_type; 1760 ident->sadb_ident_id = 0; 1761 ident->sadb_ident_reserved = 0; 1762 (void) strcpy((char *)(ident + 1), 1763 ipsa->ipsa_dst_cid->ipsid_cid); 1764 walker = (sadb_ext_t *)((uint64_t *)walker + 1765 walker->sadb_ext_len); 1766 } 1767 1768 if (sensinteg) { 1769 sens = (sadb_sens_t *)walker; 1770 sens->sadb_sens_len = SADB_8TO64(sizeof (sadb_sens_t *) + 1771 ipsa->ipsa_senslen + ipsa->ipsa_integlen); 1772 sens->sadb_sens_dpd = ipsa->ipsa_dpd; 1773 sens->sadb_sens_sens_level = ipsa->ipsa_senslevel; 1774 sens->sadb_sens_integ_level = ipsa->ipsa_integlevel; 1775 sens->sadb_sens_sens_len = SADB_8TO64(ipsa->ipsa_senslen); 1776 sens->sadb_sens_integ_len = SADB_8TO64(ipsa->ipsa_integlen); 1777 sens->sadb_sens_reserved = 0; 1778 bitmap = (uint64_t *)(sens + 1); 1779 if (ipsa->ipsa_sens != NULL) { 1780 bcopy(ipsa->ipsa_sens, bitmap, ipsa->ipsa_senslen); 1781 bitmap += sens->sadb_sens_sens_len; 1782 } 1783 if (ipsa->ipsa_integ != NULL) 1784 bcopy(ipsa->ipsa_integ, bitmap, ipsa->ipsa_integlen); 1785 walker = (sadb_ext_t *)((uint64_t *)walker + 1786 walker->sadb_ext_len); 1787 } 1788 1789 if (paired) { 1790 pair_ext = (sadb_x_pair_t *)walker; 1791 1792 pair_ext->sadb_x_pair_len = SADB_8TO64(sizeof (sadb_x_pair_t)); 1793 pair_ext->sadb_x_pair_exttype = SADB_X_EXT_PAIR; 1794 pair_ext->sadb_x_pair_spi = otherspi; 1795 1796 walker = (sadb_ext_t *)((uint64_t *)walker + 1797 walker->sadb_ext_len); 1798 } 1799 1800 if (ipsa->ipsa_replay != 0) { 1801 repl_ctr = (sadb_x_replay_ctr_t *)walker; 1802 repl_ctr->sadb_x_rc_len = SADB_8TO64(sizeof (*repl_ctr)); 1803 repl_ctr->sadb_x_rc_exttype = SADB_X_EXT_REPLAY_VALUE; 1804 repl_ctr->sadb_x_rc_replay32 = ipsa->ipsa_replay; 1805 repl_ctr->sadb_x_rc_replay64 = 0; 1806 walker = (sadb_ext_t *)(repl_ctr + 1); 1807 } 1808 1809 bail: 1810 /* Pardon any delays... */ 1811 mutex_exit(&ipsa->ipsa_lock); 1812 1813 return (mp); 1814 } 1815 1816 /* 1817 * Strip out key headers or unmarked headers (SADB_EXT_KEY_*, SADB_EXT_UNKNOWN) 1818 * and adjust base message accordingly. 1819 * 1820 * Assume message is pulled up in one piece of contiguous memory. 1821 * 1822 * Say if we start off with: 1823 * 1824 * +------+----+-------------+-----------+---------------+---------------+ 1825 * | base | SA | source addr | dest addr | rsrvd. or key | soft lifetime | 1826 * +------+----+-------------+-----------+---------------+---------------+ 1827 * 1828 * we will end up with 1829 * 1830 * +------+----+-------------+-----------+---------------+ 1831 * | base | SA | source addr | dest addr | soft lifetime | 1832 * +------+----+-------------+-----------+---------------+ 1833 */ 1834 static void 1835 sadb_strip(sadb_msg_t *samsg) 1836 { 1837 sadb_ext_t *ext; 1838 uint8_t *target = NULL; 1839 uint8_t *msgend; 1840 int sofar = SADB_8TO64(sizeof (*samsg)); 1841 int copylen; 1842 1843 ext = (sadb_ext_t *)(samsg + 1); 1844 msgend = (uint8_t *)samsg; 1845 msgend += SADB_64TO8(samsg->sadb_msg_len); 1846 while ((uint8_t *)ext < msgend) { 1847 if (ext->sadb_ext_type == SADB_EXT_RESERVED || 1848 ext->sadb_ext_type == SADB_EXT_KEY_AUTH || 1849 ext->sadb_ext_type == SADB_X_EXT_EDUMP || 1850 ext->sadb_ext_type == SADB_EXT_KEY_ENCRYPT) { 1851 /* 1852 * Aha! I found a header to be erased. 1853 */ 1854 1855 if (target != NULL) { 1856 /* 1857 * If I had a previous header to be erased, 1858 * copy over it. I can get away with just 1859 * copying backwards because the target will 1860 * always be 8 bytes behind the source. 1861 */ 1862 copylen = ((uint8_t *)ext) - (target + 1863 SADB_64TO8( 1864 ((sadb_ext_t *)target)->sadb_ext_len)); 1865 ovbcopy(((uint8_t *)ext - copylen), target, 1866 copylen); 1867 target += copylen; 1868 ((sadb_ext_t *)target)->sadb_ext_len = 1869 SADB_8TO64(((uint8_t *)ext) - target + 1870 SADB_64TO8(ext->sadb_ext_len)); 1871 } else { 1872 target = (uint8_t *)ext; 1873 } 1874 } else { 1875 sofar += ext->sadb_ext_len; 1876 } 1877 1878 ext = (sadb_ext_t *)(((uint64_t *)ext) + ext->sadb_ext_len); 1879 } 1880 1881 ASSERT((uint8_t *)ext == msgend); 1882 1883 if (target != NULL) { 1884 copylen = ((uint8_t *)ext) - (target + 1885 SADB_64TO8(((sadb_ext_t *)target)->sadb_ext_len)); 1886 if (copylen != 0) 1887 ovbcopy(((uint8_t *)ext - copylen), target, copylen); 1888 } 1889 1890 /* Adjust samsg. */ 1891 samsg->sadb_msg_len = (uint16_t)sofar; 1892 1893 /* Assume all of the rest is cleared by caller in sadb_pfkey_echo(). */ 1894 } 1895 1896 /* 1897 * AH needs to send an error to PF_KEY. Assume mp points to an M_CTL 1898 * followed by an M_DATA with a PF_KEY message in it. The serial of 1899 * the sending keysock instance is included. 1900 */ 1901 void 1902 sadb_pfkey_error(queue_t *pfkey_q, mblk_t *mp, int error, int diagnostic, 1903 uint_t serial) 1904 { 1905 mblk_t *msg = mp->b_cont; 1906 sadb_msg_t *samsg; 1907 keysock_out_t *kso; 1908 1909 /* 1910 * Enough functions call this to merit a NULL queue check. 1911 */ 1912 if (pfkey_q == NULL) { 1913 freemsg(mp); 1914 return; 1915 } 1916 1917 ASSERT(msg != NULL); 1918 ASSERT((mp->b_wptr - mp->b_rptr) == sizeof (ipsec_info_t)); 1919 ASSERT((msg->b_wptr - msg->b_rptr) >= sizeof (sadb_msg_t)); 1920 samsg = (sadb_msg_t *)msg->b_rptr; 1921 kso = (keysock_out_t *)mp->b_rptr; 1922 1923 kso->ks_out_type = KEYSOCK_OUT; 1924 kso->ks_out_len = sizeof (*kso); 1925 kso->ks_out_serial = serial; 1926 1927 /* 1928 * Only send the base message up in the event of an error. 1929 * Don't worry about bzero()-ing, because it was probably bogus 1930 * anyway. 1931 */ 1932 msg->b_wptr = msg->b_rptr + sizeof (*samsg); 1933 samsg = (sadb_msg_t *)msg->b_rptr; 1934 samsg->sadb_msg_len = SADB_8TO64(sizeof (*samsg)); 1935 samsg->sadb_msg_errno = (uint8_t)error; 1936 if (diagnostic != SADB_X_DIAGNOSTIC_PRESET) 1937 samsg->sadb_x_msg_diagnostic = (uint16_t)diagnostic; 1938 1939 putnext(pfkey_q, mp); 1940 } 1941 1942 /* 1943 * Send a successful return packet back to keysock via the queue in pfkey_q. 1944 * 1945 * Often, an SA is associated with the reply message, it's passed in if needed, 1946 * and NULL if not. BTW, that ipsa will have its refcnt appropriately held, 1947 * and the caller will release said refcnt. 1948 */ 1949 void 1950 sadb_pfkey_echo(queue_t *pfkey_q, mblk_t *mp, sadb_msg_t *samsg, 1951 keysock_in_t *ksi, ipsa_t *ipsa) 1952 { 1953 keysock_out_t *kso; 1954 mblk_t *mp1; 1955 sadb_msg_t *newsamsg; 1956 uint8_t *oldend; 1957 1958 ASSERT((mp->b_cont != NULL) && 1959 ((void *)samsg == (void *)mp->b_cont->b_rptr) && 1960 ((void *)mp->b_rptr == (void *)ksi)); 1961 1962 switch (samsg->sadb_msg_type) { 1963 case SADB_ADD: 1964 case SADB_UPDATE: 1965 case SADB_X_UPDATEPAIR: 1966 case SADB_X_DELPAIR_STATE: 1967 case SADB_FLUSH: 1968 case SADB_DUMP: 1969 /* 1970 * I have all of the message already. I just need to strip 1971 * out the keying material and echo the message back. 1972 * 1973 * NOTE: for SADB_DUMP, the function sadb_dump() did the 1974 * work. When DUMP reaches here, it should only be a base 1975 * message. 1976 */ 1977 justecho: 1978 if (ksi->ks_in_extv[SADB_EXT_KEY_AUTH] != NULL || 1979 ksi->ks_in_extv[SADB_EXT_KEY_ENCRYPT] != NULL || 1980 ksi->ks_in_extv[SADB_X_EXT_EDUMP] != NULL) { 1981 sadb_strip(samsg); 1982 /* Assume PF_KEY message is contiguous. */ 1983 ASSERT(mp->b_cont->b_cont == NULL); 1984 oldend = mp->b_cont->b_wptr; 1985 mp->b_cont->b_wptr = mp->b_cont->b_rptr + 1986 SADB_64TO8(samsg->sadb_msg_len); 1987 bzero(mp->b_cont->b_wptr, oldend - mp->b_cont->b_wptr); 1988 } 1989 break; 1990 case SADB_GET: 1991 /* 1992 * Do a lot of work here, because of the ipsa I just found. 1993 * First construct the new PF_KEY message, then abandon 1994 * the old one. 1995 */ 1996 mp1 = sadb_sa2msg(ipsa, samsg); 1997 if (mp1 == NULL) { 1998 sadb_pfkey_error(pfkey_q, mp, ENOMEM, 1999 SADB_X_DIAGNOSTIC_NONE, ksi->ks_in_serial); 2000 return; 2001 } 2002 freemsg(mp->b_cont); 2003 mp->b_cont = mp1; 2004 break; 2005 case SADB_DELETE: 2006 case SADB_X_DELPAIR: 2007 if (ipsa == NULL) 2008 goto justecho; 2009 /* 2010 * Because listening KMds may require more info, treat 2011 * DELETE like a special case of GET. 2012 */ 2013 mp1 = sadb_sa2msg(ipsa, samsg); 2014 if (mp1 == NULL) { 2015 sadb_pfkey_error(pfkey_q, mp, ENOMEM, 2016 SADB_X_DIAGNOSTIC_NONE, ksi->ks_in_serial); 2017 return; 2018 } 2019 newsamsg = (sadb_msg_t *)mp1->b_rptr; 2020 sadb_strip(newsamsg); 2021 oldend = mp1->b_wptr; 2022 mp1->b_wptr = mp1->b_rptr + SADB_64TO8(newsamsg->sadb_msg_len); 2023 bzero(mp1->b_wptr, oldend - mp1->b_wptr); 2024 freemsg(mp->b_cont); 2025 mp->b_cont = mp1; 2026 break; 2027 default: 2028 if (mp != NULL) 2029 freemsg(mp); 2030 return; 2031 } 2032 2033 /* ksi is now null and void. */ 2034 kso = (keysock_out_t *)ksi; 2035 kso->ks_out_type = KEYSOCK_OUT; 2036 kso->ks_out_len = sizeof (*kso); 2037 kso->ks_out_serial = ksi->ks_in_serial; 2038 /* We're ready to send... */ 2039 putnext(pfkey_q, mp); 2040 } 2041 2042 /* 2043 * Set up a global pfkey_q instance for AH, ESP, or some other consumer. 2044 */ 2045 void 2046 sadb_keysock_hello(queue_t **pfkey_qp, queue_t *q, mblk_t *mp, 2047 void (*ager)(void *), void *agerarg, timeout_id_t *top, int satype) 2048 { 2049 keysock_hello_ack_t *kha; 2050 queue_t *oldq; 2051 2052 ASSERT(OTHERQ(q) != NULL); 2053 2054 /* 2055 * First, check atomically that I'm the first and only keysock 2056 * instance. 2057 * 2058 * Use OTHERQ(q), because qreply(q, mp) == putnext(OTHERQ(q), mp), 2059 * and I want this module to say putnext(*_pfkey_q, mp) for PF_KEY 2060 * messages. 2061 */ 2062 2063 oldq = casptr((void **)pfkey_qp, NULL, OTHERQ(q)); 2064 if (oldq != NULL) { 2065 ASSERT(oldq != q); 2066 cmn_err(CE_WARN, "Danger! Multiple keysocks on top of %s.\n", 2067 (satype == SADB_SATYPE_ESP)? "ESP" : "AH or other"); 2068 freemsg(mp); 2069 return; 2070 } 2071 2072 kha = (keysock_hello_ack_t *)mp->b_rptr; 2073 kha->ks_hello_len = sizeof (keysock_hello_ack_t); 2074 kha->ks_hello_type = KEYSOCK_HELLO_ACK; 2075 kha->ks_hello_satype = (uint8_t)satype; 2076 2077 /* 2078 * If we made it past the casptr, then we have "exclusive" access 2079 * to the timeout handle. Fire it off in 4 seconds, because it 2080 * just seems like a good interval. 2081 */ 2082 *top = qtimeout(*pfkey_qp, ager, agerarg, drv_usectohz(4000000)); 2083 2084 putnext(*pfkey_qp, mp); 2085 } 2086 2087 /* 2088 * Normalize IPv4-mapped IPv6 addresses (and prefixes) as appropriate. 2089 * 2090 * Check addresses themselves for wildcard or multicast. 2091 * Check ire table for local/non-local/broadcast. 2092 */ 2093 int 2094 sadb_addrcheck(queue_t *pfkey_q, mblk_t *mp, sadb_ext_t *ext, uint_t serial, 2095 netstack_t *ns) 2096 { 2097 sadb_address_t *addr = (sadb_address_t *)ext; 2098 struct sockaddr_in *sin; 2099 struct sockaddr_in6 *sin6; 2100 ire_t *ire; 2101 int diagnostic, type; 2102 boolean_t normalized = B_FALSE; 2103 2104 ASSERT(ext != NULL); 2105 ASSERT((ext->sadb_ext_type == SADB_EXT_ADDRESS_SRC) || 2106 (ext->sadb_ext_type == SADB_EXT_ADDRESS_DST) || 2107 (ext->sadb_ext_type == SADB_X_EXT_ADDRESS_INNER_SRC) || 2108 (ext->sadb_ext_type == SADB_X_EXT_ADDRESS_INNER_DST) || 2109 (ext->sadb_ext_type == SADB_X_EXT_ADDRESS_NATT_LOC) || 2110 (ext->sadb_ext_type == SADB_X_EXT_ADDRESS_NATT_REM)); 2111 2112 /* Assign both sockaddrs, the compiler will do the right thing. */ 2113 sin = (struct sockaddr_in *)(addr + 1); 2114 sin6 = (struct sockaddr_in6 *)(addr + 1); 2115 2116 if (sin6->sin6_family == AF_INET6) { 2117 if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) { 2118 /* 2119 * Convert to an AF_INET sockaddr. This means the 2120 * return messages will have the extra space, but have 2121 * AF_INET sockaddrs instead of AF_INET6. 2122 * 2123 * Yes, RFC 2367 isn't clear on what to do here w.r.t. 2124 * mapped addresses, but since AF_INET6 ::ffff:<v4> is 2125 * equal to AF_INET <v4>, it shouldnt be a huge 2126 * problem. 2127 */ 2128 sin->sin_family = AF_INET; 2129 IN6_V4MAPPED_TO_INADDR(&sin6->sin6_addr, 2130 &sin->sin_addr); 2131 bzero(&sin->sin_zero, sizeof (sin->sin_zero)); 2132 normalized = B_TRUE; 2133 } 2134 } else if (sin->sin_family != AF_INET) { 2135 switch (ext->sadb_ext_type) { 2136 case SADB_EXT_ADDRESS_SRC: 2137 diagnostic = SADB_X_DIAGNOSTIC_BAD_SRC_AF; 2138 break; 2139 case SADB_EXT_ADDRESS_DST: 2140 diagnostic = SADB_X_DIAGNOSTIC_BAD_DST_AF; 2141 break; 2142 case SADB_X_EXT_ADDRESS_INNER_SRC: 2143 diagnostic = SADB_X_DIAGNOSTIC_BAD_PROXY_AF; 2144 break; 2145 case SADB_X_EXT_ADDRESS_INNER_DST: 2146 diagnostic = SADB_X_DIAGNOSTIC_BAD_INNER_DST_AF; 2147 break; 2148 case SADB_X_EXT_ADDRESS_NATT_LOC: 2149 diagnostic = SADB_X_DIAGNOSTIC_BAD_NATT_LOC_AF; 2150 break; 2151 case SADB_X_EXT_ADDRESS_NATT_REM: 2152 diagnostic = SADB_X_DIAGNOSTIC_BAD_NATT_REM_AF; 2153 break; 2154 /* There is no default, see above ASSERT. */ 2155 } 2156 bail: 2157 if (pfkey_q != NULL) { 2158 sadb_pfkey_error(pfkey_q, mp, EINVAL, diagnostic, 2159 serial); 2160 } else { 2161 /* 2162 * Scribble in sadb_msg that we got passed in. 2163 * Overload "mp" to be an sadb_msg pointer. 2164 */ 2165 sadb_msg_t *samsg = (sadb_msg_t *)mp; 2166 2167 samsg->sadb_msg_errno = EINVAL; 2168 samsg->sadb_x_msg_diagnostic = diagnostic; 2169 } 2170 return (KS_IN_ADDR_UNKNOWN); 2171 } 2172 2173 if (ext->sadb_ext_type == SADB_X_EXT_ADDRESS_INNER_SRC || 2174 ext->sadb_ext_type == SADB_X_EXT_ADDRESS_INNER_DST) { 2175 /* 2176 * We need only check for prefix issues. 2177 */ 2178 2179 /* Set diagnostic now, in case we need it later. */ 2180 diagnostic = 2181 (ext->sadb_ext_type == SADB_X_EXT_ADDRESS_INNER_SRC) ? 2182 SADB_X_DIAGNOSTIC_PREFIX_INNER_SRC : 2183 SADB_X_DIAGNOSTIC_PREFIX_INNER_DST; 2184 2185 if (normalized) 2186 addr->sadb_address_prefixlen -= 96; 2187 2188 /* 2189 * Verify and mask out inner-addresses based on prefix length. 2190 */ 2191 if (sin->sin_family == AF_INET) { 2192 if (addr->sadb_address_prefixlen > 32) 2193 goto bail; 2194 sin->sin_addr.s_addr &= 2195 ip_plen_to_mask(addr->sadb_address_prefixlen); 2196 } else { 2197 in6_addr_t mask; 2198 2199 ASSERT(sin->sin_family == AF_INET6); 2200 /* 2201 * ip_plen_to_mask_v6() returns NULL if the value in 2202 * question is out of range. 2203 */ 2204 if (ip_plen_to_mask_v6(addr->sadb_address_prefixlen, 2205 &mask) == NULL) 2206 goto bail; 2207 sin6->sin6_addr.s6_addr32[0] &= mask.s6_addr32[0]; 2208 sin6->sin6_addr.s6_addr32[1] &= mask.s6_addr32[1]; 2209 sin6->sin6_addr.s6_addr32[2] &= mask.s6_addr32[2]; 2210 sin6->sin6_addr.s6_addr32[3] &= mask.s6_addr32[3]; 2211 } 2212 2213 /* We don't care in these cases. */ 2214 return (KS_IN_ADDR_DONTCARE); 2215 } 2216 2217 if (sin->sin_family == AF_INET6) { 2218 /* Check the easy ones now. */ 2219 if (IN6_IS_ADDR_MULTICAST(&sin6->sin6_addr)) 2220 return (KS_IN_ADDR_MBCAST); 2221 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) 2222 return (KS_IN_ADDR_UNSPEC); 2223 /* 2224 * At this point, we're a unicast IPv6 address. 2225 * 2226 * A ctable lookup for local is sufficient here. If we're 2227 * local, return KS_IN_ADDR_ME, otherwise KS_IN_ADDR_NOTME. 2228 * 2229 * XXX Zones alert -> me/notme decision needs to be tempered 2230 * by what zone we're in when we go to zone-aware IPsec. 2231 */ 2232 ire = ire_ctable_lookup_v6(&sin6->sin6_addr, NULL, 2233 IRE_LOCAL, NULL, ALL_ZONES, NULL, MATCH_IRE_TYPE, 2234 ns->netstack_ip); 2235 if (ire != NULL) { 2236 /* Hey hey, it's local. */ 2237 IRE_REFRELE(ire); 2238 return (KS_IN_ADDR_ME); 2239 } 2240 } else { 2241 ASSERT(sin->sin_family == AF_INET); 2242 if (sin->sin_addr.s_addr == INADDR_ANY) 2243 return (KS_IN_ADDR_UNSPEC); 2244 if (CLASSD(sin->sin_addr.s_addr)) 2245 return (KS_IN_ADDR_MBCAST); 2246 /* 2247 * At this point we're a unicast or broadcast IPv4 address. 2248 * 2249 * Lookup on the ctable for IRE_BROADCAST or IRE_LOCAL. 2250 * A NULL return value is NOTME, otherwise, look at the 2251 * returned ire for broadcast or not and return accordingly. 2252 * 2253 * XXX Zones alert -> me/notme decision needs to be tempered 2254 * by what zone we're in when we go to zone-aware IPsec. 2255 */ 2256 ire = ire_ctable_lookup(sin->sin_addr.s_addr, 0, 2257 IRE_LOCAL | IRE_BROADCAST, NULL, ALL_ZONES, NULL, 2258 MATCH_IRE_TYPE, ns->netstack_ip); 2259 if (ire != NULL) { 2260 /* Check for local or broadcast */ 2261 type = ire->ire_type; 2262 IRE_REFRELE(ire); 2263 ASSERT(type == IRE_LOCAL || type == IRE_BROADCAST); 2264 return ((type == IRE_LOCAL) ? KS_IN_ADDR_ME : 2265 KS_IN_ADDR_MBCAST); 2266 } 2267 } 2268 2269 return (KS_IN_ADDR_NOTME); 2270 } 2271 2272 /* 2273 * Address normalizations and reality checks for inbound PF_KEY messages. 2274 * 2275 * For the case of src == unspecified AF_INET6, and dst == AF_INET, convert 2276 * the source to AF_INET. Do the same for the inner sources. 2277 */ 2278 boolean_t 2279 sadb_addrfix(keysock_in_t *ksi, queue_t *pfkey_q, mblk_t *mp, netstack_t *ns) 2280 { 2281 struct sockaddr_in *src, *isrc; 2282 struct sockaddr_in6 *dst, *idst; 2283 sadb_address_t *srcext, *dstext; 2284 uint16_t sport; 2285 sadb_ext_t **extv = ksi->ks_in_extv; 2286 int rc; 2287 2288 if (extv[SADB_EXT_ADDRESS_SRC] != NULL) { 2289 rc = sadb_addrcheck(pfkey_q, mp, extv[SADB_EXT_ADDRESS_SRC], 2290 ksi->ks_in_serial, ns); 2291 if (rc == KS_IN_ADDR_UNKNOWN) 2292 return (B_FALSE); 2293 if (rc == KS_IN_ADDR_MBCAST) { 2294 sadb_pfkey_error(pfkey_q, mp, EINVAL, 2295 SADB_X_DIAGNOSTIC_BAD_SRC, ksi->ks_in_serial); 2296 return (B_FALSE); 2297 } 2298 ksi->ks_in_srctype = rc; 2299 } 2300 2301 if (extv[SADB_EXT_ADDRESS_DST] != NULL) { 2302 rc = sadb_addrcheck(pfkey_q, mp, extv[SADB_EXT_ADDRESS_DST], 2303 ksi->ks_in_serial, ns); 2304 if (rc == KS_IN_ADDR_UNKNOWN) 2305 return (B_FALSE); 2306 if (rc == KS_IN_ADDR_UNSPEC) { 2307 sadb_pfkey_error(pfkey_q, mp, EINVAL, 2308 SADB_X_DIAGNOSTIC_BAD_DST, ksi->ks_in_serial); 2309 return (B_FALSE); 2310 } 2311 ksi->ks_in_dsttype = rc; 2312 } 2313 2314 /* 2315 * NAT-Traversal addrs are simple enough to not require all of 2316 * the checks in sadb_addrcheck(). Just normalize or reject if not 2317 * AF_INET. 2318 */ 2319 if (extv[SADB_X_EXT_ADDRESS_NATT_LOC] != NULL) { 2320 rc = sadb_addrcheck(pfkey_q, mp, 2321 extv[SADB_X_EXT_ADDRESS_NATT_LOC], ksi->ks_in_serial, ns); 2322 2323 /* 2324 * Local NAT-T addresses never use an IRE_LOCAL, so it should 2325 * always be NOTME, or UNSPEC (to handle both tunnel mode 2326 * AND local-port flexibility). 2327 */ 2328 if (rc != KS_IN_ADDR_NOTME && rc != KS_IN_ADDR_UNSPEC) { 2329 sadb_pfkey_error(pfkey_q, mp, EINVAL, 2330 SADB_X_DIAGNOSTIC_MALFORMED_NATT_LOC, 2331 ksi->ks_in_serial); 2332 return (B_FALSE); 2333 } 2334 src = (struct sockaddr_in *) 2335 (((sadb_address_t *)extv[SADB_X_EXT_ADDRESS_NATT_LOC]) + 1); 2336 if (src->sin_family != AF_INET) { 2337 sadb_pfkey_error(pfkey_q, mp, EINVAL, 2338 SADB_X_DIAGNOSTIC_BAD_NATT_LOC_AF, 2339 ksi->ks_in_serial); 2340 return (B_FALSE); 2341 } 2342 } 2343 2344 if (extv[SADB_X_EXT_ADDRESS_NATT_REM] != NULL) { 2345 rc = sadb_addrcheck(pfkey_q, mp, 2346 extv[SADB_X_EXT_ADDRESS_NATT_REM], ksi->ks_in_serial, ns); 2347 2348 /* 2349 * Remote NAT-T addresses never use an IRE_LOCAL, so it should 2350 * always be NOTME, or UNSPEC if it's a tunnel-mode SA. 2351 */ 2352 if (rc != KS_IN_ADDR_NOTME && 2353 !(extv[SADB_X_EXT_ADDRESS_INNER_SRC] != NULL && 2354 rc == KS_IN_ADDR_UNSPEC)) { 2355 sadb_pfkey_error(pfkey_q, mp, EINVAL, 2356 SADB_X_DIAGNOSTIC_MALFORMED_NATT_REM, 2357 ksi->ks_in_serial); 2358 return (B_FALSE); 2359 } 2360 src = (struct sockaddr_in *) 2361 (((sadb_address_t *)extv[SADB_X_EXT_ADDRESS_NATT_REM]) + 1); 2362 if (src->sin_family != AF_INET) { 2363 sadb_pfkey_error(pfkey_q, mp, EINVAL, 2364 SADB_X_DIAGNOSTIC_BAD_NATT_REM_AF, 2365 ksi->ks_in_serial); 2366 return (B_FALSE); 2367 } 2368 } 2369 2370 if (extv[SADB_X_EXT_ADDRESS_INNER_SRC] != NULL) { 2371 if (extv[SADB_X_EXT_ADDRESS_INNER_DST] == NULL) { 2372 sadb_pfkey_error(pfkey_q, mp, EINVAL, 2373 SADB_X_DIAGNOSTIC_MISSING_INNER_DST, 2374 ksi->ks_in_serial); 2375 return (B_FALSE); 2376 } 2377 2378 if (sadb_addrcheck(pfkey_q, mp, 2379 extv[SADB_X_EXT_ADDRESS_INNER_DST], ksi->ks_in_serial, ns) 2380 == KS_IN_ADDR_UNKNOWN || 2381 sadb_addrcheck(pfkey_q, mp, 2382 extv[SADB_X_EXT_ADDRESS_INNER_SRC], ksi->ks_in_serial, ns) 2383 == KS_IN_ADDR_UNKNOWN) 2384 return (B_FALSE); 2385 2386 isrc = (struct sockaddr_in *) 2387 (((sadb_address_t *)extv[SADB_X_EXT_ADDRESS_INNER_SRC]) + 2388 1); 2389 idst = (struct sockaddr_in6 *) 2390 (((sadb_address_t *)extv[SADB_X_EXT_ADDRESS_INNER_DST]) + 2391 1); 2392 if (isrc->sin_family != idst->sin6_family) { 2393 sadb_pfkey_error(pfkey_q, mp, EINVAL, 2394 SADB_X_DIAGNOSTIC_INNER_AF_MISMATCH, 2395 ksi->ks_in_serial); 2396 return (B_FALSE); 2397 } 2398 } else if (extv[SADB_X_EXT_ADDRESS_INNER_DST] != NULL) { 2399 sadb_pfkey_error(pfkey_q, mp, EINVAL, 2400 SADB_X_DIAGNOSTIC_MISSING_INNER_SRC, 2401 ksi->ks_in_serial); 2402 return (B_FALSE); 2403 } else { 2404 isrc = NULL; /* For inner/outer port check below. */ 2405 } 2406 2407 dstext = (sadb_address_t *)extv[SADB_EXT_ADDRESS_DST]; 2408 srcext = (sadb_address_t *)extv[SADB_EXT_ADDRESS_SRC]; 2409 2410 if (dstext == NULL || srcext == NULL) 2411 return (B_TRUE); 2412 2413 dst = (struct sockaddr_in6 *)(dstext + 1); 2414 src = (struct sockaddr_in *)(srcext + 1); 2415 2416 if (isrc != NULL && 2417 (isrc->sin_port != 0 || idst->sin6_port != 0) && 2418 (src->sin_port != 0 || dst->sin6_port != 0)) { 2419 /* Can't set inner and outer ports in one SA. */ 2420 sadb_pfkey_error(pfkey_q, mp, EINVAL, 2421 SADB_X_DIAGNOSTIC_DUAL_PORT_SETS, 2422 ksi->ks_in_serial); 2423 return (B_FALSE); 2424 } 2425 2426 if (dst->sin6_family == src->sin_family) 2427 return (B_TRUE); 2428 2429 if (srcext->sadb_address_proto != dstext->sadb_address_proto) { 2430 if (srcext->sadb_address_proto == 0) { 2431 srcext->sadb_address_proto = dstext->sadb_address_proto; 2432 } else if (dstext->sadb_address_proto == 0) { 2433 dstext->sadb_address_proto = srcext->sadb_address_proto; 2434 } else { 2435 /* Inequal protocols, neither were 0. Report error. */ 2436 sadb_pfkey_error(pfkey_q, mp, EINVAL, 2437 SADB_X_DIAGNOSTIC_PROTO_MISMATCH, 2438 ksi->ks_in_serial); 2439 return (B_FALSE); 2440 } 2441 } 2442 2443 /* 2444 * With the exception of an unspec IPv6 source and an IPv4 2445 * destination, address families MUST me matched. 2446 */ 2447 if (src->sin_family == AF_INET || 2448 ksi->ks_in_srctype != KS_IN_ADDR_UNSPEC) { 2449 sadb_pfkey_error(pfkey_q, mp, EINVAL, 2450 SADB_X_DIAGNOSTIC_AF_MISMATCH, ksi->ks_in_serial); 2451 return (B_FALSE); 2452 } 2453 2454 /* 2455 * Convert "src" to AF_INET INADDR_ANY. We rely on sin_port being 2456 * in the same place for sockaddr_in and sockaddr_in6. 2457 */ 2458 sport = src->sin_port; 2459 bzero(src, sizeof (*src)); 2460 src->sin_family = AF_INET; 2461 src->sin_port = sport; 2462 2463 return (B_TRUE); 2464 } 2465 2466 /* 2467 * Set the results in "addrtype", given an IRE as requested by 2468 * sadb_addrcheck(). 2469 */ 2470 int 2471 sadb_addrset(ire_t *ire) 2472 { 2473 if ((ire->ire_type & IRE_BROADCAST) || 2474 (ire->ire_ipversion == IPV4_VERSION && CLASSD(ire->ire_addr)) || 2475 (ire->ire_ipversion == IPV6_VERSION && 2476 IN6_IS_ADDR_MULTICAST(&(ire->ire_addr_v6)))) 2477 return (KS_IN_ADDR_MBCAST); 2478 if (ire->ire_type & (IRE_LOCAL | IRE_LOOPBACK)) 2479 return (KS_IN_ADDR_ME); 2480 return (KS_IN_ADDR_NOTME); 2481 } 2482 2483 2484 /* 2485 * Walker callback function to delete sa's based on src/dst address. 2486 * Assumes that we're called with *head locked, no other locks held; 2487 * Conveniently, and not coincidentally, this is both what sadb_walker 2488 * gives us and also what sadb_unlinkassoc expects. 2489 */ 2490 2491 struct sadb_purge_state 2492 { 2493 uint32_t *src; 2494 uint32_t *dst; 2495 sa_family_t af; 2496 boolean_t inbnd; 2497 char *sidstr; 2498 char *didstr; 2499 uint16_t sidtype; 2500 uint16_t didtype; 2501 uint32_t kmproto; 2502 uint8_t sadb_sa_state; 2503 mblk_t *mq; 2504 sadb_t *sp; 2505 }; 2506 2507 static void 2508 sadb_purge_cb(isaf_t *head, ipsa_t *entry, void *cookie) 2509 { 2510 struct sadb_purge_state *ps = (struct sadb_purge_state *)cookie; 2511 2512 ASSERT(MUTEX_HELD(&head->isaf_lock)); 2513 2514 mutex_enter(&entry->ipsa_lock); 2515 2516 if ((entry->ipsa_state == IPSA_STATE_LARVAL) || 2517 (ps->src != NULL && 2518 !IPSA_ARE_ADDR_EQUAL(entry->ipsa_srcaddr, ps->src, ps->af)) || 2519 (ps->dst != NULL && 2520 !IPSA_ARE_ADDR_EQUAL(entry->ipsa_dstaddr, ps->dst, ps->af)) || 2521 (ps->didstr != NULL && (entry->ipsa_dst_cid != NULL) && 2522 !(ps->didtype == entry->ipsa_dst_cid->ipsid_type && 2523 strcmp(ps->didstr, entry->ipsa_dst_cid->ipsid_cid) == 0)) || 2524 (ps->sidstr != NULL && (entry->ipsa_src_cid != NULL) && 2525 !(ps->sidtype == entry->ipsa_src_cid->ipsid_type && 2526 strcmp(ps->sidstr, entry->ipsa_src_cid->ipsid_cid) == 0)) || 2527 (ps->kmproto <= SADB_X_KMP_MAX && ps->kmproto != entry->ipsa_kmp)) { 2528 mutex_exit(&entry->ipsa_lock); 2529 return; 2530 } 2531 2532 if (ps->inbnd) { 2533 sadb_delete_cluster(entry); 2534 } 2535 entry->ipsa_state = IPSA_STATE_DEAD; 2536 (void) sadb_torch_assoc(head, entry, ps->inbnd, &ps->mq); 2537 } 2538 2539 /* 2540 * Common code to purge an SA with a matching src or dst address. 2541 * Don't kill larval SA's in such a purge. 2542 */ 2543 int 2544 sadb_purge_sa(mblk_t *mp, keysock_in_t *ksi, sadb_t *sp, queue_t *pfkey_q, 2545 queue_t *ip_q) 2546 { 2547 sadb_address_t *dstext = 2548 (sadb_address_t *)ksi->ks_in_extv[SADB_EXT_ADDRESS_DST]; 2549 sadb_address_t *srcext = 2550 (sadb_address_t *)ksi->ks_in_extv[SADB_EXT_ADDRESS_SRC]; 2551 sadb_ident_t *dstid = 2552 (sadb_ident_t *)ksi->ks_in_extv[SADB_EXT_IDENTITY_DST]; 2553 sadb_ident_t *srcid = 2554 (sadb_ident_t *)ksi->ks_in_extv[SADB_EXT_IDENTITY_SRC]; 2555 sadb_x_kmc_t *kmc = 2556 (sadb_x_kmc_t *)ksi->ks_in_extv[SADB_X_EXT_KM_COOKIE]; 2557 struct sockaddr_in *src, *dst; 2558 struct sockaddr_in6 *src6, *dst6; 2559 struct sadb_purge_state ps; 2560 2561 /* 2562 * Don't worry about IPv6 v4-mapped addresses, sadb_addrcheck() 2563 * takes care of them. 2564 */ 2565 2566 /* enforced by caller */ 2567 ASSERT((dstext != NULL) || (srcext != NULL)); 2568 2569 ps.src = NULL; 2570 ps.dst = NULL; 2571 #ifdef DEBUG 2572 ps.af = (sa_family_t)-1; 2573 #endif 2574 ps.mq = NULL; 2575 ps.sidstr = NULL; 2576 ps.didstr = NULL; 2577 ps.kmproto = SADB_X_KMP_MAX + 1; 2578 2579 if (dstext != NULL) { 2580 dst = (struct sockaddr_in *)(dstext + 1); 2581 ps.af = dst->sin_family; 2582 if (dst->sin_family == AF_INET6) { 2583 dst6 = (struct sockaddr_in6 *)dst; 2584 ps.dst = (uint32_t *)&dst6->sin6_addr; 2585 } else { 2586 ps.dst = (uint32_t *)&dst->sin_addr; 2587 } 2588 } 2589 2590 if (srcext != NULL) { 2591 src = (struct sockaddr_in *)(srcext + 1); 2592 ps.af = src->sin_family; 2593 if (src->sin_family == AF_INET6) { 2594 src6 = (struct sockaddr_in6 *)(srcext + 1); 2595 ps.src = (uint32_t *)&src6->sin6_addr; 2596 } else { 2597 ps.src = (uint32_t *)&src->sin_addr; 2598 } 2599 ASSERT(dstext == NULL || src->sin_family == dst->sin_family); 2600 } 2601 2602 ASSERT(ps.af != (sa_family_t)-1); 2603 2604 if (dstid != NULL) { 2605 /* 2606 * NOTE: May need to copy string in the future 2607 * if the inbound keysock message disappears for some strange 2608 * reason. 2609 */ 2610 ps.didstr = (char *)(dstid + 1); 2611 ps.didtype = dstid->sadb_ident_type; 2612 } 2613 2614 if (srcid != NULL) { 2615 /* 2616 * NOTE: May need to copy string in the future 2617 * if the inbound keysock message disappears for some strange 2618 * reason. 2619 */ 2620 ps.sidstr = (char *)(srcid + 1); 2621 ps.sidtype = srcid->sadb_ident_type; 2622 } 2623 2624 if (kmc != NULL) 2625 ps.kmproto = kmc->sadb_x_kmc_proto; 2626 2627 /* 2628 * This is simple, crude, and effective. 2629 * Unimplemented optimizations (TBD): 2630 * - we can limit how many places we search based on where we 2631 * think the SA is filed. 2632 * - if we get a dst address, we can hash based on dst addr to find 2633 * the correct bucket in the outbound table. 2634 */ 2635 ps.inbnd = B_TRUE; 2636 sadb_walker(sp->sdb_if, sp->sdb_hashsize, sadb_purge_cb, &ps); 2637 ps.inbnd = B_FALSE; 2638 sadb_walker(sp->sdb_of, sp->sdb_hashsize, sadb_purge_cb, &ps); 2639 2640 if (ps.mq != NULL) 2641 sadb_drain_torchq(ip_q, ps.mq); 2642 2643 ASSERT(mp->b_cont != NULL); 2644 sadb_pfkey_echo(pfkey_q, mp, (sadb_msg_t *)mp->b_cont->b_rptr, ksi, 2645 NULL); 2646 return (0); 2647 } 2648 2649 static void 2650 sadb_delpair_state(isaf_t *head, ipsa_t *entry, void *cookie) 2651 { 2652 struct sadb_purge_state *ps = (struct sadb_purge_state *)cookie; 2653 isaf_t *inbound_bucket; 2654 ipsa_t *peer_assoc; 2655 2656 ASSERT(MUTEX_HELD(&head->isaf_lock)); 2657 2658 mutex_enter(&entry->ipsa_lock); 2659 2660 if ((entry->ipsa_state != ps->sadb_sa_state) || 2661 ((ps->src != NULL) && 2662 !IPSA_ARE_ADDR_EQUAL(entry->ipsa_srcaddr, ps->src, ps->af))) { 2663 mutex_exit(&entry->ipsa_lock); 2664 return; 2665 } 2666 2667 /* 2668 * The isaf_t *, which is passed in , is always an outbound bucket, 2669 * and we are preserving the outbound-then-inbound hash-bucket lock 2670 * ordering. The sadb_walker() which triggers this function is called 2671 * only on the outbound fanout, and the corresponding inbound bucket 2672 * lock is safe to acquire here. 2673 */ 2674 2675 if (entry->ipsa_haspeer) { 2676 inbound_bucket = INBOUND_BUCKET(ps->sp, entry->ipsa_spi); 2677 mutex_enter(&inbound_bucket->isaf_lock); 2678 peer_assoc = ipsec_getassocbyspi(inbound_bucket, 2679 entry->ipsa_spi, entry->ipsa_srcaddr, 2680 entry->ipsa_dstaddr, entry->ipsa_addrfam); 2681 } else { 2682 inbound_bucket = INBOUND_BUCKET(ps->sp, entry->ipsa_otherspi); 2683 mutex_enter(&inbound_bucket->isaf_lock); 2684 peer_assoc = ipsec_getassocbyspi(inbound_bucket, 2685 entry->ipsa_otherspi, entry->ipsa_dstaddr, 2686 entry->ipsa_srcaddr, entry->ipsa_addrfam); 2687 } 2688 2689 entry->ipsa_state = IPSA_STATE_DEAD; 2690 (void) sadb_torch_assoc(head, entry, B_FALSE, &ps->mq); 2691 if (peer_assoc != NULL) { 2692 mutex_enter(&peer_assoc->ipsa_lock); 2693 peer_assoc->ipsa_state = IPSA_STATE_DEAD; 2694 (void) sadb_torch_assoc(inbound_bucket, peer_assoc, 2695 B_FALSE, &ps->mq); 2696 } 2697 mutex_exit(&inbound_bucket->isaf_lock); 2698 } 2699 2700 /* 2701 * Common code to delete/get an SA. 2702 */ 2703 int 2704 sadb_delget_sa(mblk_t *mp, keysock_in_t *ksi, sadbp_t *spp, 2705 int *diagnostic, queue_t *pfkey_q, uint8_t sadb_msg_type) 2706 { 2707 sadb_sa_t *assoc = (sadb_sa_t *)ksi->ks_in_extv[SADB_EXT_SA]; 2708 sadb_address_t *srcext = 2709 (sadb_address_t *)ksi->ks_in_extv[SADB_EXT_ADDRESS_SRC]; 2710 sadb_address_t *dstext = 2711 (sadb_address_t *)ksi->ks_in_extv[SADB_EXT_ADDRESS_DST]; 2712 ipsa_t *echo_target = NULL; 2713 ipsap_t *ipsapp; 2714 mblk_t *torchq = NULL; 2715 uint_t error = 0; 2716 2717 if (assoc == NULL) { 2718 *diagnostic = SADB_X_DIAGNOSTIC_MISSING_SA; 2719 return (EINVAL); 2720 } 2721 2722 if (sadb_msg_type == SADB_X_DELPAIR_STATE) { 2723 struct sockaddr_in *src; 2724 struct sockaddr_in6 *src6; 2725 struct sadb_purge_state ps; 2726 2727 if (srcext == NULL) { 2728 *diagnostic = SADB_X_DIAGNOSTIC_MISSING_SRC; 2729 return (EINVAL); 2730 } 2731 ps.src = NULL; 2732 ps.mq = NULL; 2733 src = (struct sockaddr_in *)(srcext + 1); 2734 ps.af = src->sin_family; 2735 if (src->sin_family == AF_INET6) { 2736 src6 = (struct sockaddr_in6 *)(srcext + 1); 2737 ps.src = (uint32_t *)&src6->sin6_addr; 2738 ps.sp = &spp->s_v6; 2739 } else { 2740 ps.src = (uint32_t *)&src->sin_addr; 2741 ps.sp = &spp->s_v4; 2742 } 2743 ps.inbnd = B_FALSE; 2744 ps.sadb_sa_state = assoc->sadb_sa_state; 2745 sadb_walker(ps.sp->sdb_of, ps.sp->sdb_hashsize, 2746 sadb_delpair_state, &ps); 2747 2748 if (ps.mq != NULL) 2749 sadb_drain_torchq(pfkey_q, ps.mq); 2750 2751 ASSERT(mp->b_cont != NULL); 2752 sadb_pfkey_echo(pfkey_q, mp, (sadb_msg_t *)mp->b_cont->b_rptr, 2753 ksi, NULL); 2754 return (0); 2755 } 2756 2757 if (dstext == NULL) { 2758 *diagnostic = SADB_X_DIAGNOSTIC_MISSING_DST; 2759 return (EINVAL); 2760 } 2761 2762 ipsapp = get_ipsa_pair(assoc, srcext, dstext, spp); 2763 if (ipsapp == NULL) { 2764 *diagnostic = SADB_X_DIAGNOSTIC_SA_NOTFOUND; 2765 return (ESRCH); 2766 } 2767 2768 echo_target = ipsapp->ipsap_sa_ptr; 2769 if (echo_target == NULL) 2770 echo_target = ipsapp->ipsap_psa_ptr; 2771 2772 if (sadb_msg_type == SADB_DELETE || sadb_msg_type == SADB_X_DELPAIR) { 2773 /* 2774 * Bucket locks will be required if SA is actually unlinked. 2775 * get_ipsa_pair() returns valid hash bucket pointers even 2776 * if it can't find a pair SA pointer. 2777 */ 2778 mutex_enter(&ipsapp->ipsap_bucket->isaf_lock); 2779 mutex_enter(&ipsapp->ipsap_pbucket->isaf_lock); 2780 2781 if (ipsapp->ipsap_sa_ptr != NULL) { 2782 mutex_enter(&ipsapp->ipsap_sa_ptr->ipsa_lock); 2783 if (ipsapp->ipsap_sa_ptr->ipsa_flags & IPSA_F_INBOUND) { 2784 sadb_delete_cluster(ipsapp->ipsap_sa_ptr); 2785 } 2786 ipsapp->ipsap_sa_ptr->ipsa_state = IPSA_STATE_DEAD; 2787 (void) sadb_torch_assoc(ipsapp->ipsap_bucket, 2788 ipsapp->ipsap_sa_ptr, B_FALSE, &torchq); 2789 /* 2790 * sadb_torch_assoc() releases the ipsa_lock 2791 * and calls sadb_unlinkassoc() which does a 2792 * IPSA_REFRELE. 2793 */ 2794 } 2795 if (ipsapp->ipsap_psa_ptr != NULL) { 2796 mutex_enter(&ipsapp->ipsap_psa_ptr->ipsa_lock); 2797 if (sadb_msg_type == SADB_X_DELPAIR) { 2798 if (ipsapp->ipsap_psa_ptr->ipsa_flags & 2799 IPSA_F_INBOUND) { 2800 sadb_delete_cluster( 2801 ipsapp->ipsap_psa_ptr); 2802 } 2803 ipsapp->ipsap_psa_ptr->ipsa_state = 2804 IPSA_STATE_DEAD; 2805 (void) sadb_torch_assoc(ipsapp->ipsap_pbucket, 2806 ipsapp->ipsap_psa_ptr, B_FALSE, &torchq); 2807 } else { 2808 /* 2809 * Only half of the "pair" has been deleted. 2810 * Update the remaining SA and remove references 2811 * to its pair SA, which is now gone. 2812 */ 2813 ipsapp->ipsap_psa_ptr->ipsa_otherspi = 0; 2814 ipsapp->ipsap_psa_ptr->ipsa_flags &= 2815 ~IPSA_F_PAIRED; 2816 mutex_exit(&ipsapp->ipsap_psa_ptr->ipsa_lock); 2817 } 2818 } else if (sadb_msg_type == SADB_X_DELPAIR) { 2819 *diagnostic = SADB_X_DIAGNOSTIC_PAIR_SA_NOTFOUND; 2820 error = ESRCH; 2821 } 2822 mutex_exit(&ipsapp->ipsap_bucket->isaf_lock); 2823 mutex_exit(&ipsapp->ipsap_pbucket->isaf_lock); 2824 } 2825 2826 if (torchq != NULL) 2827 sadb_drain_torchq(spp->s_ip_q, torchq); 2828 2829 ASSERT(mp->b_cont != NULL); 2830 2831 if (error == 0) 2832 sadb_pfkey_echo(pfkey_q, mp, (sadb_msg_t *) 2833 mp->b_cont->b_rptr, ksi, echo_target); 2834 2835 destroy_ipsa_pair(ipsapp); 2836 2837 return (error); 2838 } 2839 2840 /* 2841 * This function takes a sadb_sa_t and finds the ipsa_t structure 2842 * and the isaf_t (hash bucket) that its stored under. If the security 2843 * association has a peer, the ipsa_t structure and bucket for that security 2844 * association are also searched for. The "pair" of ipsa_t's and isaf_t's 2845 * are returned as a ipsap_t. 2846 * 2847 * Note that a "pair" is defined as one (but not both) of the following: 2848 * 2849 * A security association which has a soft reference to another security 2850 * association via its SPI. 2851 * 2852 * A security association that is not obviously "inbound" or "outbound" so 2853 * it appears in both hash tables, the "peer" being the same security 2854 * association in the other hash table. 2855 * 2856 * This function will return NULL if the ipsa_t can't be found in the 2857 * inbound or outbound hash tables (not found). If only one ipsa_t is 2858 * found, the pair ipsa_t will be NULL. Both isaf_t values are valid 2859 * provided at least one ipsa_t is found. 2860 */ 2861 ipsap_t * 2862 get_ipsa_pair(sadb_sa_t *assoc, sadb_address_t *srcext, sadb_address_t *dstext, 2863 sadbp_t *spp) 2864 { 2865 struct sockaddr_in *src, *dst; 2866 struct sockaddr_in6 *src6, *dst6; 2867 sadb_t *sp; 2868 uint32_t *srcaddr, *dstaddr; 2869 isaf_t *outbound_bucket, *inbound_bucket; 2870 boolean_t in_inbound_table = B_FALSE; 2871 ipsap_t *ipsapp; 2872 sa_family_t af; 2873 2874 uint32_t pair_srcaddr[IPSA_MAX_ADDRLEN]; 2875 uint32_t pair_dstaddr[IPSA_MAX_ADDRLEN]; 2876 uint32_t pair_spi; 2877 2878 ipsapp = kmem_zalloc(sizeof (*ipsapp), KM_NOSLEEP); 2879 if (ipsapp == NULL) 2880 return (NULL); 2881 2882 /* 2883 * Don't worry about IPv6 v4-mapped addresses, sadb_addrcheck() 2884 * takes care of them. 2885 */ 2886 2887 dst = (struct sockaddr_in *)(dstext + 1); 2888 af = dst->sin_family; 2889 if (af == AF_INET6) { 2890 sp = &spp->s_v6; 2891 dst6 = (struct sockaddr_in6 *)dst; 2892 dstaddr = (uint32_t *)&dst6->sin6_addr; 2893 if (srcext != NULL) { 2894 src6 = (struct sockaddr_in6 *)(srcext + 1); 2895 srcaddr = (uint32_t *)&src6->sin6_addr; 2896 ASSERT(src6->sin6_family == af); 2897 ASSERT(src6->sin6_family == AF_INET6); 2898 } else { 2899 srcaddr = ALL_ZEROES_PTR; 2900 } 2901 outbound_bucket = OUTBOUND_BUCKET_V6(sp, 2902 *(uint32_t *)dstaddr); 2903 } else { 2904 sp = &spp->s_v4; 2905 dstaddr = (uint32_t *)&dst->sin_addr; 2906 if (srcext != NULL) { 2907 src = (struct sockaddr_in *)(srcext + 1); 2908 srcaddr = (uint32_t *)&src->sin_addr; 2909 ASSERT(src->sin_family == af); 2910 ASSERT(src->sin_family == AF_INET); 2911 } else { 2912 srcaddr = ALL_ZEROES_PTR; 2913 } 2914 outbound_bucket = OUTBOUND_BUCKET_V4(sp, 2915 *(uint32_t *)dstaddr); 2916 } 2917 2918 inbound_bucket = INBOUND_BUCKET(sp, assoc->sadb_sa_spi); 2919 2920 /* Lock down both buckets. */ 2921 mutex_enter(&outbound_bucket->isaf_lock); 2922 mutex_enter(&inbound_bucket->isaf_lock); 2923 2924 if (assoc->sadb_sa_flags & IPSA_F_INBOUND) { 2925 ipsapp->ipsap_sa_ptr = ipsec_getassocbyspi(inbound_bucket, 2926 assoc->sadb_sa_spi, srcaddr, dstaddr, af); 2927 if (ipsapp->ipsap_sa_ptr != NULL) { 2928 ipsapp->ipsap_bucket = inbound_bucket; 2929 ipsapp->ipsap_pbucket = outbound_bucket; 2930 in_inbound_table = B_TRUE; 2931 } else { 2932 ipsapp->ipsap_sa_ptr = 2933 ipsec_getassocbyspi(outbound_bucket, 2934 assoc->sadb_sa_spi, srcaddr, dstaddr, af); 2935 ipsapp->ipsap_bucket = outbound_bucket; 2936 ipsapp->ipsap_pbucket = inbound_bucket; 2937 } 2938 } else { 2939 /* IPSA_F_OUTBOUND is set *or* no directions flags set. */ 2940 ipsapp->ipsap_sa_ptr = 2941 ipsec_getassocbyspi(outbound_bucket, 2942 assoc->sadb_sa_spi, srcaddr, dstaddr, af); 2943 if (ipsapp->ipsap_sa_ptr != NULL) { 2944 ipsapp->ipsap_bucket = outbound_bucket; 2945 ipsapp->ipsap_pbucket = inbound_bucket; 2946 } else { 2947 ipsapp->ipsap_sa_ptr = 2948 ipsec_getassocbyspi(inbound_bucket, 2949 assoc->sadb_sa_spi, srcaddr, dstaddr, af); 2950 ipsapp->ipsap_bucket = inbound_bucket; 2951 ipsapp->ipsap_pbucket = outbound_bucket; 2952 if (ipsapp->ipsap_sa_ptr != NULL) 2953 in_inbound_table = B_TRUE; 2954 } 2955 } 2956 2957 if (ipsapp->ipsap_sa_ptr == NULL) { 2958 mutex_exit(&outbound_bucket->isaf_lock); 2959 mutex_exit(&inbound_bucket->isaf_lock); 2960 kmem_free(ipsapp, sizeof (*ipsapp)); 2961 return (NULL); 2962 } 2963 2964 if ((ipsapp->ipsap_sa_ptr->ipsa_state == IPSA_STATE_LARVAL) && 2965 in_inbound_table) { 2966 mutex_exit(&outbound_bucket->isaf_lock); 2967 mutex_exit(&inbound_bucket->isaf_lock); 2968 return (ipsapp); 2969 } 2970 2971 mutex_enter(&ipsapp->ipsap_sa_ptr->ipsa_lock); 2972 if (ipsapp->ipsap_sa_ptr->ipsa_haspeer) { 2973 /* 2974 * haspeer implies no sa_pairing, look for same spi 2975 * in other hashtable. 2976 */ 2977 ipsapp->ipsap_psa_ptr = 2978 ipsec_getassocbyspi(ipsapp->ipsap_pbucket, 2979 assoc->sadb_sa_spi, srcaddr, dstaddr, af); 2980 mutex_exit(&ipsapp->ipsap_sa_ptr->ipsa_lock); 2981 mutex_exit(&outbound_bucket->isaf_lock); 2982 mutex_exit(&inbound_bucket->isaf_lock); 2983 return (ipsapp); 2984 } 2985 pair_spi = ipsapp->ipsap_sa_ptr->ipsa_otherspi; 2986 IPSA_COPY_ADDR(&pair_srcaddr, 2987 ipsapp->ipsap_sa_ptr->ipsa_srcaddr, af); 2988 IPSA_COPY_ADDR(&pair_dstaddr, 2989 ipsapp->ipsap_sa_ptr->ipsa_dstaddr, af); 2990 mutex_exit(&ipsapp->ipsap_sa_ptr->ipsa_lock); 2991 mutex_exit(&outbound_bucket->isaf_lock); 2992 mutex_exit(&inbound_bucket->isaf_lock); 2993 2994 if (pair_spi == 0) { 2995 ASSERT(ipsapp->ipsap_bucket != NULL); 2996 ASSERT(ipsapp->ipsap_pbucket != NULL); 2997 return (ipsapp); 2998 } 2999 3000 /* found sa in outbound sadb, peer should be inbound */ 3001 3002 if (in_inbound_table) { 3003 /* Found SA in inbound table, pair will be in outbound. */ 3004 if (af == AF_INET6) { 3005 ipsapp->ipsap_pbucket = OUTBOUND_BUCKET_V6(sp, 3006 *(uint32_t *)pair_srcaddr); 3007 } else { 3008 ipsapp->ipsap_pbucket = OUTBOUND_BUCKET_V4(sp, 3009 *(uint32_t *)pair_srcaddr); 3010 } 3011 } else { 3012 ipsapp->ipsap_pbucket = INBOUND_BUCKET(sp, pair_spi); 3013 } 3014 mutex_enter(&ipsapp->ipsap_pbucket->isaf_lock); 3015 ipsapp->ipsap_psa_ptr = ipsec_getassocbyspi(ipsapp->ipsap_pbucket, 3016 pair_spi, pair_dstaddr, pair_srcaddr, af); 3017 mutex_exit(&ipsapp->ipsap_pbucket->isaf_lock); 3018 ASSERT(ipsapp->ipsap_bucket != NULL); 3019 ASSERT(ipsapp->ipsap_pbucket != NULL); 3020 return (ipsapp); 3021 } 3022 3023 /* 3024 * Initialize the mechanism parameters associated with an SA. 3025 * These parameters can be shared by multiple packets, which saves 3026 * us from the overhead of consulting the algorithm table for 3027 * each packet. 3028 */ 3029 static void 3030 sadb_init_alginfo(ipsa_t *sa) 3031 { 3032 ipsec_alginfo_t *alg; 3033 ipsec_stack_t *ipss = sa->ipsa_netstack->netstack_ipsec; 3034 3035 mutex_enter(&ipss->ipsec_alg_lock); 3036 3037 if (sa->ipsa_encrkey != NULL) { 3038 alg = ipss->ipsec_alglists[IPSEC_ALG_ENCR][sa->ipsa_encr_alg]; 3039 if (alg != NULL && ALG_VALID(alg)) { 3040 sa->ipsa_emech.cm_type = alg->alg_mech_type; 3041 sa->ipsa_emech.cm_param = NULL; 3042 sa->ipsa_emech.cm_param_len = 0; 3043 sa->ipsa_iv_len = alg->alg_datalen; 3044 } else 3045 sa->ipsa_emech.cm_type = CRYPTO_MECHANISM_INVALID; 3046 } 3047 3048 if (sa->ipsa_authkey != NULL) { 3049 alg = ipss->ipsec_alglists[IPSEC_ALG_AUTH][sa->ipsa_auth_alg]; 3050 if (alg != NULL && ALG_VALID(alg)) { 3051 sa->ipsa_amech.cm_type = alg->alg_mech_type; 3052 sa->ipsa_amech.cm_param = (char *)&sa->ipsa_mac_len; 3053 sa->ipsa_amech.cm_param_len = sizeof (size_t); 3054 sa->ipsa_mac_len = (size_t)alg->alg_datalen; 3055 } else 3056 sa->ipsa_amech.cm_type = CRYPTO_MECHANISM_INVALID; 3057 } 3058 3059 mutex_exit(&ipss->ipsec_alg_lock); 3060 } 3061 3062 /* 3063 * Perform NAT-traversal cached checksum offset calculations here. 3064 */ 3065 static void 3066 sadb_nat_calculations(ipsa_t *newbie, sadb_address_t *natt_loc_ext, 3067 sadb_address_t *natt_rem_ext, uint32_t *src_addr_ptr, 3068 uint32_t *dst_addr_ptr) 3069 { 3070 struct sockaddr_in *natt_loc, *natt_rem; 3071 uint32_t *natt_loc_ptr = NULL, *natt_rem_ptr = NULL; 3072 uint32_t running_sum = 0; 3073 3074 #define DOWN_SUM(x) (x) = ((x) & 0xFFFF) + ((x) >> 16) 3075 3076 if (natt_rem_ext != NULL) { 3077 uint32_t l_src; 3078 uint32_t l_rem; 3079 3080 natt_rem = (struct sockaddr_in *)(natt_rem_ext + 1); 3081 3082 /* Ensured by sadb_addrfix(). */ 3083 ASSERT(natt_rem->sin_family == AF_INET); 3084 3085 natt_rem_ptr = (uint32_t *)(&natt_rem->sin_addr); 3086 newbie->ipsa_remote_nat_port = natt_rem->sin_port; 3087 l_src = *src_addr_ptr; 3088 l_rem = *natt_rem_ptr; 3089 3090 /* Instead of IPSA_COPY_ADDR(), just copy first 32 bits. */ 3091 newbie->ipsa_natt_addr_rem = *natt_rem_ptr; 3092 3093 l_src = ntohl(l_src); 3094 DOWN_SUM(l_src); 3095 DOWN_SUM(l_src); 3096 l_rem = ntohl(l_rem); 3097 DOWN_SUM(l_rem); 3098 DOWN_SUM(l_rem); 3099 3100 /* 3101 * We're 1's complement for checksums, so check for wraparound 3102 * here. 3103 */ 3104 if (l_rem > l_src) 3105 l_src--; 3106 3107 running_sum += l_src - l_rem; 3108 3109 DOWN_SUM(running_sum); 3110 DOWN_SUM(running_sum); 3111 } 3112 3113 if (natt_loc_ext != NULL) { 3114 natt_loc = (struct sockaddr_in *)(natt_loc_ext + 1); 3115 3116 /* Ensured by sadb_addrfix(). */ 3117 ASSERT(natt_loc->sin_family == AF_INET); 3118 3119 natt_loc_ptr = (uint32_t *)(&natt_loc->sin_addr); 3120 newbie->ipsa_local_nat_port = natt_loc->sin_port; 3121 3122 /* Instead of IPSA_COPY_ADDR(), just copy first 32 bits. */ 3123 newbie->ipsa_natt_addr_loc = *natt_loc_ptr; 3124 3125 /* 3126 * NAT-T port agility means we may have natt_loc_ext, but 3127 * only for a local-port change. 3128 */ 3129 if (natt_loc->sin_addr.s_addr != INADDR_ANY) { 3130 uint32_t l_dst = ntohl(*dst_addr_ptr); 3131 uint32_t l_loc = ntohl(*natt_loc_ptr); 3132 3133 DOWN_SUM(l_loc); 3134 DOWN_SUM(l_loc); 3135 DOWN_SUM(l_dst); 3136 DOWN_SUM(l_dst); 3137 3138 /* 3139 * We're 1's complement for checksums, so check for 3140 * wraparound here. 3141 */ 3142 if (l_loc > l_dst) 3143 l_dst--; 3144 3145 running_sum += l_dst - l_loc; 3146 DOWN_SUM(running_sum); 3147 DOWN_SUM(running_sum); 3148 } 3149 } 3150 3151 newbie->ipsa_inbound_cksum = running_sum; 3152 #undef DOWN_SUM 3153 } 3154 3155 /* 3156 * This function is called from consumers that need to insert a fully-grown 3157 * security association into its tables. This function takes into account that 3158 * SAs can be "inbound", "outbound", or "both". The "primary" and "secondary" 3159 * hash bucket parameters are set in order of what the SA will be most of the 3160 * time. (For example, an SA with an unspecified source, and a multicast 3161 * destination will primarily be an outbound SA. OTOH, if that destination 3162 * is unicast for this node, then the SA will primarily be inbound.) 3163 * 3164 * It takes a lot of parameters because even if clone is B_FALSE, this needs 3165 * to check both buckets for purposes of collision. 3166 * 3167 * Return 0 upon success. Return various errnos (ENOMEM, EEXIST) for 3168 * various error conditions. We may need to set samsg->sadb_x_msg_diagnostic 3169 * with additional diagnostic information because there is at least one EINVAL 3170 * case here. 3171 */ 3172 int 3173 sadb_common_add(queue_t *ip_q, queue_t *pfkey_q, mblk_t *mp, sadb_msg_t *samsg, 3174 keysock_in_t *ksi, isaf_t *primary, isaf_t *secondary, 3175 ipsa_t *newbie, boolean_t clone, boolean_t is_inbound, int *diagnostic, 3176 netstack_t *ns, sadbp_t *spp) 3177 { 3178 ipsa_t *newbie_clone = NULL, *scratch; 3179 ipsap_t *ipsapp = NULL; 3180 sadb_sa_t *assoc = (sadb_sa_t *)ksi->ks_in_extv[SADB_EXT_SA]; 3181 sadb_address_t *srcext = 3182 (sadb_address_t *)ksi->ks_in_extv[SADB_EXT_ADDRESS_SRC]; 3183 sadb_address_t *dstext = 3184 (sadb_address_t *)ksi->ks_in_extv[SADB_EXT_ADDRESS_DST]; 3185 sadb_address_t *isrcext = 3186 (sadb_address_t *)ksi->ks_in_extv[SADB_X_EXT_ADDRESS_INNER_SRC]; 3187 sadb_address_t *idstext = 3188 (sadb_address_t *)ksi->ks_in_extv[SADB_X_EXT_ADDRESS_INNER_DST]; 3189 sadb_x_kmc_t *kmcext = 3190 (sadb_x_kmc_t *)ksi->ks_in_extv[SADB_X_EXT_KM_COOKIE]; 3191 sadb_key_t *akey = (sadb_key_t *)ksi->ks_in_extv[SADB_EXT_KEY_AUTH]; 3192 sadb_key_t *ekey = (sadb_key_t *)ksi->ks_in_extv[SADB_EXT_KEY_ENCRYPT]; 3193 sadb_x_pair_t *pair_ext = 3194 (sadb_x_pair_t *)ksi->ks_in_extv[SADB_X_EXT_PAIR]; 3195 sadb_x_replay_ctr_t *replayext = 3196 (sadb_x_replay_ctr_t *)ksi->ks_in_extv[SADB_X_EXT_REPLAY_VALUE]; 3197 uint8_t protocol = 3198 (samsg->sadb_msg_satype == SADB_SATYPE_AH) ? IPPROTO_AH:IPPROTO_ESP; 3199 #if 0 3200 /* 3201 * XXXMLS - When Trusted Solaris or Multi-Level Secure functionality 3202 * comes to ON, examine these if 0'ed fragments. Look for XXXMLS. 3203 */ 3204 sadb_sens_t *sens = (sadb_sens_t *); 3205 #endif 3206 struct sockaddr_in *src, *dst, *isrc, *idst; 3207 struct sockaddr_in6 *src6, *dst6, *isrc6, *idst6; 3208 sadb_lifetime_t *soft = 3209 (sadb_lifetime_t *)ksi->ks_in_extv[SADB_EXT_LIFETIME_SOFT]; 3210 sadb_lifetime_t *hard = 3211 (sadb_lifetime_t *)ksi->ks_in_extv[SADB_EXT_LIFETIME_HARD]; 3212 sadb_lifetime_t *idle = 3213 (sadb_lifetime_t *)ksi->ks_in_extv[SADB_X_EXT_LIFETIME_IDLE]; 3214 sa_family_t af; 3215 int error = 0; 3216 boolean_t isupdate = (newbie != NULL); 3217 uint32_t *src_addr_ptr, *dst_addr_ptr, *isrc_addr_ptr, *idst_addr_ptr; 3218 mblk_t *ctl_mp = NULL; 3219 ipsec_stack_t *ipss = ns->netstack_ipsec; 3220 int rcode; 3221 3222 if (srcext == NULL) { 3223 *diagnostic = SADB_X_DIAGNOSTIC_MISSING_SRC; 3224 return (EINVAL); 3225 } 3226 if (dstext == NULL) { 3227 *diagnostic = SADB_X_DIAGNOSTIC_MISSING_DST; 3228 return (EINVAL); 3229 } 3230 if (assoc == NULL) { 3231 *diagnostic = SADB_X_DIAGNOSTIC_MISSING_SA; 3232 return (EINVAL); 3233 } 3234 3235 src = (struct sockaddr_in *)(srcext + 1); 3236 src6 = (struct sockaddr_in6 *)(srcext + 1); 3237 dst = (struct sockaddr_in *)(dstext + 1); 3238 dst6 = (struct sockaddr_in6 *)(dstext + 1); 3239 if (isrcext != NULL) { 3240 isrc = (struct sockaddr_in *)(isrcext + 1); 3241 isrc6 = (struct sockaddr_in6 *)(isrcext + 1); 3242 ASSERT(idstext != NULL); 3243 idst = (struct sockaddr_in *)(idstext + 1); 3244 idst6 = (struct sockaddr_in6 *)(idstext + 1); 3245 } else { 3246 isrc = NULL; 3247 isrc6 = NULL; 3248 } 3249 3250 af = src->sin_family; 3251 3252 if (af == AF_INET) { 3253 src_addr_ptr = (uint32_t *)&src->sin_addr; 3254 dst_addr_ptr = (uint32_t *)&dst->sin_addr; 3255 } else { 3256 ASSERT(af == AF_INET6); 3257 src_addr_ptr = (uint32_t *)&src6->sin6_addr; 3258 dst_addr_ptr = (uint32_t *)&dst6->sin6_addr; 3259 } 3260 3261 if (!isupdate && (clone == B_TRUE || is_inbound == B_TRUE) && 3262 cl_inet_checkspi && 3263 (assoc->sadb_sa_state != SADB_X_SASTATE_ACTIVE_ELSEWHERE)) { 3264 rcode = cl_inet_checkspi(ns->netstack_stackid, protocol, 3265 assoc->sadb_sa_spi, NULL); 3266 if (rcode == -1) { 3267 return (EEXIST); 3268 } 3269 } 3270 3271 /* 3272 * Check to see if the new SA will be cloned AND paired. The 3273 * reason a SA will be cloned is the source or destination addresses 3274 * are not specific enough to determine if the SA goes in the outbound 3275 * or the inbound hash table, so its cloned and put in both. If 3276 * the SA is paired, it's soft linked to another SA for the other 3277 * direction. Keeping track and looking up SA's that are direction 3278 * unspecific and linked is too hard. 3279 */ 3280 if (clone && (pair_ext != NULL)) { 3281 *diagnostic = SADB_X_DIAGNOSTIC_PAIR_INAPPROPRIATE; 3282 return (EINVAL); 3283 } 3284 3285 if (!isupdate) { 3286 newbie = sadb_makelarvalassoc(assoc->sadb_sa_spi, 3287 src_addr_ptr, dst_addr_ptr, af, ns); 3288 if (newbie == NULL) 3289 return (ENOMEM); 3290 } 3291 3292 mutex_enter(&newbie->ipsa_lock); 3293 3294 if (isrc != NULL) { 3295 if (isrc->sin_family == AF_INET) { 3296 if (srcext->sadb_address_proto != IPPROTO_ENCAP) { 3297 if (srcext->sadb_address_proto != 0) { 3298 /* 3299 * Mismatched outer-packet protocol 3300 * and inner-packet address family. 3301 */ 3302 mutex_exit(&newbie->ipsa_lock); 3303 error = EPROTOTYPE; 3304 goto error; 3305 } else { 3306 /* Fill in with explicit protocol. */ 3307 srcext->sadb_address_proto = 3308 IPPROTO_ENCAP; 3309 dstext->sadb_address_proto = 3310 IPPROTO_ENCAP; 3311 } 3312 } 3313 isrc_addr_ptr = (uint32_t *)&isrc->sin_addr; 3314 idst_addr_ptr = (uint32_t *)&idst->sin_addr; 3315 } else { 3316 ASSERT(isrc->sin_family == AF_INET6); 3317 if (srcext->sadb_address_proto != IPPROTO_IPV6) { 3318 if (srcext->sadb_address_proto != 0) { 3319 /* 3320 * Mismatched outer-packet protocol 3321 * and inner-packet address family. 3322 */ 3323 mutex_exit(&newbie->ipsa_lock); 3324 error = EPROTOTYPE; 3325 goto error; 3326 } else { 3327 /* Fill in with explicit protocol. */ 3328 srcext->sadb_address_proto = 3329 IPPROTO_IPV6; 3330 dstext->sadb_address_proto = 3331 IPPROTO_IPV6; 3332 } 3333 } 3334 isrc_addr_ptr = (uint32_t *)&isrc6->sin6_addr; 3335 idst_addr_ptr = (uint32_t *)&idst6->sin6_addr; 3336 } 3337 newbie->ipsa_innerfam = isrc->sin_family; 3338 3339 IPSA_COPY_ADDR(newbie->ipsa_innersrc, isrc_addr_ptr, 3340 newbie->ipsa_innerfam); 3341 IPSA_COPY_ADDR(newbie->ipsa_innerdst, idst_addr_ptr, 3342 newbie->ipsa_innerfam); 3343 newbie->ipsa_innersrcpfx = isrcext->sadb_address_prefixlen; 3344 newbie->ipsa_innerdstpfx = idstext->sadb_address_prefixlen; 3345 3346 /* Unique value uses inner-ports for Tunnel Mode... */ 3347 newbie->ipsa_unique_id = SA_UNIQUE_ID(isrc->sin_port, 3348 idst->sin_port, dstext->sadb_address_proto, 3349 idstext->sadb_address_proto); 3350 newbie->ipsa_unique_mask = SA_UNIQUE_MASK(isrc->sin_port, 3351 idst->sin_port, dstext->sadb_address_proto, 3352 idstext->sadb_address_proto); 3353 } else { 3354 /* ... and outer-ports for Transport Mode. */ 3355 newbie->ipsa_unique_id = SA_UNIQUE_ID(src->sin_port, 3356 dst->sin_port, dstext->sadb_address_proto, 0); 3357 newbie->ipsa_unique_mask = SA_UNIQUE_MASK(src->sin_port, 3358 dst->sin_port, dstext->sadb_address_proto, 0); 3359 } 3360 if (newbie->ipsa_unique_mask != (uint64_t)0) 3361 newbie->ipsa_flags |= IPSA_F_UNIQUE; 3362 3363 sadb_nat_calculations(newbie, 3364 (sadb_address_t *)ksi->ks_in_extv[SADB_X_EXT_ADDRESS_NATT_LOC], 3365 (sadb_address_t *)ksi->ks_in_extv[SADB_X_EXT_ADDRESS_NATT_REM], 3366 src_addr_ptr, dst_addr_ptr); 3367 3368 newbie->ipsa_type = samsg->sadb_msg_satype; 3369 ASSERT((assoc->sadb_sa_state == SADB_SASTATE_MATURE) || 3370 (assoc->sadb_sa_state == SADB_X_SASTATE_ACTIVE_ELSEWHERE)); 3371 newbie->ipsa_auth_alg = assoc->sadb_sa_auth; 3372 newbie->ipsa_encr_alg = assoc->sadb_sa_encrypt; 3373 3374 newbie->ipsa_flags |= assoc->sadb_sa_flags; 3375 if ((newbie->ipsa_flags & SADB_X_SAFLAGS_NATT_LOC && 3376 ksi->ks_in_extv[SADB_X_EXT_ADDRESS_NATT_LOC] == NULL) || 3377 (newbie->ipsa_flags & SADB_X_SAFLAGS_NATT_REM && 3378 ksi->ks_in_extv[SADB_X_EXT_ADDRESS_NATT_REM] == NULL) || 3379 (newbie->ipsa_flags & SADB_X_SAFLAGS_TUNNEL && 3380 ksi->ks_in_extv[SADB_X_EXT_ADDRESS_INNER_SRC] == NULL)) { 3381 mutex_exit(&newbie->ipsa_lock); 3382 *diagnostic = SADB_X_DIAGNOSTIC_BAD_SAFLAGS; 3383 error = EINVAL; 3384 goto error; 3385 } 3386 /* 3387 * If unspecified source address, force replay_wsize to 0. 3388 * This is because an SA that has multiple sources of secure 3389 * traffic cannot enforce a replay counter w/o synchronizing the 3390 * senders. 3391 */ 3392 if (ksi->ks_in_srctype != KS_IN_ADDR_UNSPEC) 3393 newbie->ipsa_replay_wsize = assoc->sadb_sa_replay; 3394 else 3395 newbie->ipsa_replay_wsize = 0; 3396 3397 newbie->ipsa_addtime = gethrestime_sec(); 3398 3399 if (kmcext != NULL) { 3400 newbie->ipsa_kmp = kmcext->sadb_x_kmc_proto; 3401 newbie->ipsa_kmc = kmcext->sadb_x_kmc_cookie; 3402 } 3403 3404 /* 3405 * XXX CURRENT lifetime checks MAY BE needed for an UPDATE. 3406 * The spec says that one can update current lifetimes, but 3407 * that seems impractical, especially in the larval-to-mature 3408 * update that this function performs. 3409 */ 3410 if (soft != NULL) { 3411 newbie->ipsa_softaddlt = soft->sadb_lifetime_addtime; 3412 newbie->ipsa_softuselt = soft->sadb_lifetime_usetime; 3413 newbie->ipsa_softbyteslt = soft->sadb_lifetime_bytes; 3414 newbie->ipsa_softalloc = soft->sadb_lifetime_allocations; 3415 SET_EXPIRE(newbie, softaddlt, softexpiretime); 3416 } 3417 if (hard != NULL) { 3418 newbie->ipsa_hardaddlt = hard->sadb_lifetime_addtime; 3419 newbie->ipsa_harduselt = hard->sadb_lifetime_usetime; 3420 newbie->ipsa_hardbyteslt = hard->sadb_lifetime_bytes; 3421 newbie->ipsa_hardalloc = hard->sadb_lifetime_allocations; 3422 SET_EXPIRE(newbie, hardaddlt, hardexpiretime); 3423 } 3424 if (idle != NULL) { 3425 newbie->ipsa_idleaddlt = idle->sadb_lifetime_addtime; 3426 newbie->ipsa_idleuselt = idle->sadb_lifetime_usetime; 3427 newbie->ipsa_idleexpiretime = newbie->ipsa_addtime + 3428 newbie->ipsa_idleaddlt; 3429 newbie->ipsa_idletime = newbie->ipsa_idleaddlt; 3430 } 3431 3432 newbie->ipsa_authtmpl = NULL; 3433 newbie->ipsa_encrtmpl = NULL; 3434 3435 if (akey != NULL) { 3436 newbie->ipsa_authkeybits = akey->sadb_key_bits; 3437 newbie->ipsa_authkeylen = SADB_1TO8(akey->sadb_key_bits); 3438 /* In case we have to round up to the next byte... */ 3439 if ((akey->sadb_key_bits & 0x7) != 0) 3440 newbie->ipsa_authkeylen++; 3441 newbie->ipsa_authkey = kmem_alloc(newbie->ipsa_authkeylen, 3442 KM_NOSLEEP); 3443 if (newbie->ipsa_authkey == NULL) { 3444 error = ENOMEM; 3445 mutex_exit(&newbie->ipsa_lock); 3446 goto error; 3447 } 3448 bcopy(akey + 1, newbie->ipsa_authkey, newbie->ipsa_authkeylen); 3449 bzero(akey + 1, newbie->ipsa_authkeylen); 3450 3451 /* 3452 * Pre-initialize the kernel crypto framework key 3453 * structure. 3454 */ 3455 newbie->ipsa_kcfauthkey.ck_format = CRYPTO_KEY_RAW; 3456 newbie->ipsa_kcfauthkey.ck_length = newbie->ipsa_authkeybits; 3457 newbie->ipsa_kcfauthkey.ck_data = newbie->ipsa_authkey; 3458 3459 mutex_enter(&ipss->ipsec_alg_lock); 3460 error = ipsec_create_ctx_tmpl(newbie, IPSEC_ALG_AUTH); 3461 mutex_exit(&ipss->ipsec_alg_lock); 3462 if (error != 0) { 3463 mutex_exit(&newbie->ipsa_lock); 3464 goto error; 3465 } 3466 } 3467 3468 if (ekey != NULL) { 3469 newbie->ipsa_encrkeybits = ekey->sadb_key_bits; 3470 newbie->ipsa_encrkeylen = SADB_1TO8(ekey->sadb_key_bits); 3471 /* In case we have to round up to the next byte... */ 3472 if ((ekey->sadb_key_bits & 0x7) != 0) 3473 newbie->ipsa_encrkeylen++; 3474 newbie->ipsa_encrkey = kmem_alloc(newbie->ipsa_encrkeylen, 3475 KM_NOSLEEP); 3476 if (newbie->ipsa_encrkey == NULL) { 3477 error = ENOMEM; 3478 mutex_exit(&newbie->ipsa_lock); 3479 goto error; 3480 } 3481 bcopy(ekey + 1, newbie->ipsa_encrkey, newbie->ipsa_encrkeylen); 3482 /* XXX is this safe w.r.t db_ref, etc? */ 3483 bzero(ekey + 1, newbie->ipsa_encrkeylen); 3484 3485 /* 3486 * Pre-initialize the kernel crypto framework key 3487 * structure. 3488 */ 3489 newbie->ipsa_kcfencrkey.ck_format = CRYPTO_KEY_RAW; 3490 newbie->ipsa_kcfencrkey.ck_length = newbie->ipsa_encrkeybits; 3491 newbie->ipsa_kcfencrkey.ck_data = newbie->ipsa_encrkey; 3492 3493 mutex_enter(&ipss->ipsec_alg_lock); 3494 error = ipsec_create_ctx_tmpl(newbie, IPSEC_ALG_ENCR); 3495 mutex_exit(&ipss->ipsec_alg_lock); 3496 if (error != 0) { 3497 mutex_exit(&newbie->ipsa_lock); 3498 goto error; 3499 } 3500 } 3501 3502 sadb_init_alginfo(newbie); 3503 3504 /* 3505 * Ptrs to processing functions. 3506 */ 3507 if (newbie->ipsa_type == SADB_SATYPE_ESP) 3508 ipsecesp_init_funcs(newbie); 3509 else 3510 ipsecah_init_funcs(newbie); 3511 ASSERT(newbie->ipsa_output_func != NULL && 3512 newbie->ipsa_input_func != NULL); 3513 3514 /* 3515 * Certificate ID stuff. 3516 */ 3517 if (ksi->ks_in_extv[SADB_EXT_IDENTITY_SRC] != NULL) { 3518 sadb_ident_t *id = 3519 (sadb_ident_t *)ksi->ks_in_extv[SADB_EXT_IDENTITY_SRC]; 3520 3521 /* 3522 * Can assume strlen() will return okay because ext_check() in 3523 * keysock.c prepares the string for us. 3524 */ 3525 newbie->ipsa_src_cid = ipsid_lookup(id->sadb_ident_type, 3526 (char *)(id+1), ns); 3527 if (newbie->ipsa_src_cid == NULL) { 3528 error = ENOMEM; 3529 mutex_exit(&newbie->ipsa_lock); 3530 goto error; 3531 } 3532 } 3533 3534 if (ksi->ks_in_extv[SADB_EXT_IDENTITY_DST] != NULL) { 3535 sadb_ident_t *id = 3536 (sadb_ident_t *)ksi->ks_in_extv[SADB_EXT_IDENTITY_DST]; 3537 3538 /* 3539 * Can assume strlen() will return okay because ext_check() in 3540 * keysock.c prepares the string for us. 3541 */ 3542 newbie->ipsa_dst_cid = ipsid_lookup(id->sadb_ident_type, 3543 (char *)(id+1), ns); 3544 if (newbie->ipsa_dst_cid == NULL) { 3545 error = ENOMEM; 3546 mutex_exit(&newbie->ipsa_lock); 3547 goto error; 3548 } 3549 } 3550 3551 #if 0 3552 /* XXXMLS SENSITIVITY handling code. */ 3553 if (sens != NULL) { 3554 int i; 3555 uint64_t *bitmap = (uint64_t *)(sens + 1); 3556 3557 newbie->ipsa_dpd = sens->sadb_sens_dpd; 3558 newbie->ipsa_senslevel = sens->sadb_sens_sens_level; 3559 newbie->ipsa_integlevel = sens->sadb_sens_integ_level; 3560 newbie->ipsa_senslen = SADB_64TO8(sens->sadb_sens_sens_len); 3561 newbie->ipsa_integlen = SADB_64TO8(sens->sadb_sens_integ_len); 3562 newbie->ipsa_integ = kmem_alloc(newbie->ipsa_integlen, 3563 KM_NOSLEEP); 3564 if (newbie->ipsa_integ == NULL) { 3565 error = ENOMEM; 3566 mutex_exit(&newbie->ipsa_lock); 3567 goto error; 3568 } 3569 newbie->ipsa_sens = kmem_alloc(newbie->ipsa_senslen, 3570 KM_NOSLEEP); 3571 if (newbie->ipsa_sens == NULL) { 3572 error = ENOMEM; 3573 mutex_exit(&newbie->ipsa_lock); 3574 goto error; 3575 } 3576 for (i = 0; i < sens->sadb_sens_sens_len; i++) { 3577 newbie->ipsa_sens[i] = *bitmap; 3578 bitmap++; 3579 } 3580 for (i = 0; i < sens->sadb_sens_integ_len; i++) { 3581 newbie->ipsa_integ[i] = *bitmap; 3582 bitmap++; 3583 } 3584 } 3585 3586 #endif 3587 3588 if (replayext != NULL) { 3589 if ((replayext->sadb_x_rc_replay32 == 0) && 3590 (replayext->sadb_x_rc_replay64 != 0)) { 3591 error = EOPNOTSUPP; 3592 mutex_exit(&newbie->ipsa_lock); 3593 goto error; 3594 } 3595 newbie->ipsa_replay = replayext->sadb_x_rc_replay32; 3596 } 3597 3598 /* now that the SA has been updated, set its new state */ 3599 newbie->ipsa_state = assoc->sadb_sa_state; 3600 3601 if (clone) { 3602 newbie->ipsa_haspeer = B_TRUE; 3603 } else { 3604 if (!is_inbound) { 3605 lifetime_fuzz(newbie); 3606 } 3607 } 3608 /* 3609 * The less locks I hold when doing an insertion and possible cloning, 3610 * the better! 3611 */ 3612 mutex_exit(&newbie->ipsa_lock); 3613 3614 if (clone) { 3615 newbie_clone = sadb_cloneassoc(newbie); 3616 3617 if (newbie_clone == NULL) { 3618 error = ENOMEM; 3619 goto error; 3620 } 3621 } 3622 3623 /* 3624 * Enter the bucket locks. The order of entry is outbound, 3625 * inbound. We map "primary" and "secondary" into outbound and inbound 3626 * based on the destination address type. If the destination address 3627 * type is for a node that isn't mine (or potentially mine), the 3628 * "primary" bucket is the outbound one. 3629 */ 3630 if (!is_inbound) { 3631 /* primary == outbound */ 3632 mutex_enter(&primary->isaf_lock); 3633 mutex_enter(&secondary->isaf_lock); 3634 } else { 3635 /* primary == inbound */ 3636 mutex_enter(&secondary->isaf_lock); 3637 mutex_enter(&primary->isaf_lock); 3638 } 3639 3640 IPSECHW_DEBUG(IPSECHW_SADB, ("sadb_common_add: spi = 0x%x\n", 3641 newbie->ipsa_spi)); 3642 3643 /* 3644 * sadb_insertassoc() doesn't increment the reference 3645 * count. We therefore have to increment the 3646 * reference count one more time to reflect the 3647 * pointers of the table that reference this SA. 3648 */ 3649 IPSA_REFHOLD(newbie); 3650 3651 if (isupdate) { 3652 /* 3653 * Unlink from larval holding cell in the "inbound" fanout. 3654 */ 3655 ASSERT(newbie->ipsa_linklock == &primary->isaf_lock || 3656 newbie->ipsa_linklock == &secondary->isaf_lock); 3657 sadb_unlinkassoc(newbie); 3658 } 3659 3660 mutex_enter(&newbie->ipsa_lock); 3661 error = sadb_insertassoc(newbie, primary); 3662 if (error == 0) { 3663 ctl_mp = sadb_fmt_sa_req(DL_CO_SET, newbie->ipsa_type, newbie, 3664 is_inbound); 3665 } 3666 mutex_exit(&newbie->ipsa_lock); 3667 3668 if (error != 0) { 3669 /* 3670 * Since sadb_insertassoc() failed, we must decrement the 3671 * refcount again so the cleanup code will actually free 3672 * the offending SA. 3673 */ 3674 IPSA_REFRELE(newbie); 3675 goto error_unlock; 3676 } 3677 3678 if (newbie_clone != NULL) { 3679 mutex_enter(&newbie_clone->ipsa_lock); 3680 error = sadb_insertassoc(newbie_clone, secondary); 3681 mutex_exit(&newbie_clone->ipsa_lock); 3682 if (error != 0) { 3683 /* Collision in secondary table. */ 3684 sadb_unlinkassoc(newbie); /* This does REFRELE. */ 3685 goto error_unlock; 3686 } 3687 IPSA_REFHOLD(newbie_clone); 3688 } else { 3689 ASSERT(primary != secondary); 3690 scratch = ipsec_getassocbyspi(secondary, newbie->ipsa_spi, 3691 ALL_ZEROES_PTR, newbie->ipsa_dstaddr, af); 3692 if (scratch != NULL) { 3693 /* Collision in secondary table. */ 3694 sadb_unlinkassoc(newbie); /* This does REFRELE. */ 3695 /* Set the error, since ipsec_getassocbyspi() can't. */ 3696 error = EEXIST; 3697 goto error_unlock; 3698 } 3699 } 3700 3701 /* OKAY! So let's do some reality check assertions. */ 3702 3703 ASSERT(MUTEX_NOT_HELD(&newbie->ipsa_lock)); 3704 ASSERT(newbie_clone == NULL || 3705 (MUTEX_NOT_HELD(&newbie_clone->ipsa_lock))); 3706 /* 3707 * If hardware acceleration could happen, send it. 3708 */ 3709 if (ctl_mp != NULL) { 3710 putnext(ip_q, ctl_mp); 3711 ctl_mp = NULL; 3712 } 3713 3714 error_unlock: 3715 3716 /* 3717 * We can exit the locks in any order. Only entrance needs to 3718 * follow any protocol. 3719 */ 3720 mutex_exit(&secondary->isaf_lock); 3721 mutex_exit(&primary->isaf_lock); 3722 3723 if (pair_ext != NULL && error == 0) { 3724 /* update pair_spi if it exists. */ 3725 ipsapp = get_ipsa_pair(assoc, srcext, dstext, spp); 3726 if (ipsapp == NULL) { 3727 error = ESRCH; 3728 *diagnostic = SADB_X_DIAGNOSTIC_PAIR_SA_NOTFOUND; 3729 } else if (ipsapp->ipsap_psa_ptr != NULL) { 3730 *diagnostic = SADB_X_DIAGNOSTIC_PAIR_ALREADY; 3731 error = EINVAL; 3732 } else { 3733 /* update_pairing() sets diagnostic */ 3734 error = update_pairing(ipsapp, ksi, diagnostic, spp); 3735 } 3736 } 3737 /* Common error point for this routine. */ 3738 error: 3739 if (newbie != NULL) { 3740 if (error != 0) { 3741 /* This SA is broken, let the reaper clean up. */ 3742 mutex_enter(&newbie->ipsa_lock); 3743 newbie->ipsa_state = IPSA_STATE_DEAD; 3744 newbie->ipsa_hardexpiretime = 1; 3745 mutex_exit(&newbie->ipsa_lock); 3746 } 3747 IPSA_REFRELE(newbie); 3748 } 3749 if (newbie_clone != NULL) { 3750 IPSA_REFRELE(newbie_clone); 3751 } 3752 if (ctl_mp != NULL) 3753 freemsg(ctl_mp); 3754 3755 if (error == 0) { 3756 /* 3757 * Construct favorable PF_KEY return message and send to 3758 * keysock. Update the flags in the original keysock message 3759 * to reflect the actual flags in the new SA. 3760 * (Q: Do I need to pass "newbie"? If I do, 3761 * make sure to REFHOLD, call, then REFRELE.) 3762 */ 3763 assoc->sadb_sa_flags = newbie->ipsa_flags; 3764 sadb_pfkey_echo(pfkey_q, mp, samsg, ksi, NULL); 3765 } 3766 3767 destroy_ipsa_pair(ipsapp); 3768 return (error); 3769 } 3770 3771 /* 3772 * Set the time of first use for a security association. Update any 3773 * expiration times as a result. 3774 */ 3775 void 3776 sadb_set_usetime(ipsa_t *assoc) 3777 { 3778 time_t snapshot = gethrestime_sec(); 3779 3780 mutex_enter(&assoc->ipsa_lock); 3781 assoc->ipsa_lastuse = snapshot; 3782 assoc->ipsa_idleexpiretime = snapshot + assoc->ipsa_idletime; 3783 3784 /* 3785 * Caller does check usetime before calling me usually, and 3786 * double-checking is better than a mutex_enter/exit hit. 3787 */ 3788 if (assoc->ipsa_usetime == 0) { 3789 /* 3790 * This is redundant for outbound SA's, as 3791 * ipsec_getassocbyconn() sets the IPSA_F_USED flag already. 3792 * Inbound SAs, however, have no such protection. 3793 */ 3794 assoc->ipsa_flags |= IPSA_F_USED; 3795 assoc->ipsa_usetime = snapshot; 3796 3797 /* 3798 * After setting the use time, see if we have a use lifetime 3799 * that would cause the actual SA expiration time to shorten. 3800 */ 3801 UPDATE_EXPIRE(assoc, softuselt, softexpiretime); 3802 UPDATE_EXPIRE(assoc, harduselt, hardexpiretime); 3803 } 3804 mutex_exit(&assoc->ipsa_lock); 3805 } 3806 3807 /* 3808 * Send up a PF_KEY expire message for this association. 3809 */ 3810 static void 3811 sadb_expire_assoc(queue_t *pfkey_q, ipsa_t *assoc) 3812 { 3813 mblk_t *mp, *mp1; 3814 int alloclen, af; 3815 sadb_msg_t *samsg; 3816 sadb_lifetime_t *current, *expire; 3817 sadb_sa_t *saext; 3818 uint8_t *end; 3819 boolean_t tunnel_mode; 3820 3821 ASSERT(MUTEX_HELD(&assoc->ipsa_lock)); 3822 3823 /* Don't bother sending if there's no queue. */ 3824 if (pfkey_q == NULL) 3825 return; 3826 3827 /* If the SA is one of a pair, only SOFT expire the OUTBOUND SA */ 3828 if (assoc->ipsa_state == IPSA_STATE_DYING && 3829 (assoc->ipsa_flags & IPSA_F_PAIRED) && 3830 !(assoc->ipsa_flags & IPSA_F_OUTBOUND)) { 3831 return; 3832 } 3833 3834 mp = sadb_keysock_out(0); 3835 if (mp == NULL) { 3836 /* cmn_err(CE_WARN, */ 3837 /* "sadb_expire_assoc: Can't allocate KEYSOCK_OUT.\n"); */ 3838 return; 3839 } 3840 3841 alloclen = sizeof (*samsg) + sizeof (*current) + sizeof (*expire) + 3842 2 * sizeof (sadb_address_t) + sizeof (*saext); 3843 3844 af = assoc->ipsa_addrfam; 3845 switch (af) { 3846 case AF_INET: 3847 alloclen += 2 * sizeof (struct sockaddr_in); 3848 break; 3849 case AF_INET6: 3850 alloclen += 2 * sizeof (struct sockaddr_in6); 3851 break; 3852 default: 3853 /* Won't happen unless there's a kernel bug. */ 3854 freeb(mp); 3855 cmn_err(CE_WARN, 3856 "sadb_expire_assoc: Unknown address length.\n"); 3857 return; 3858 } 3859 3860 tunnel_mode = (assoc->ipsa_flags & IPSA_F_TUNNEL); 3861 if (tunnel_mode) { 3862 alloclen += 2 * sizeof (sadb_address_t); 3863 switch (assoc->ipsa_innerfam) { 3864 case AF_INET: 3865 alloclen += 2 * sizeof (struct sockaddr_in); 3866 break; 3867 case AF_INET6: 3868 alloclen += 2 * sizeof (struct sockaddr_in6); 3869 break; 3870 default: 3871 /* Won't happen unless there's a kernel bug. */ 3872 freeb(mp); 3873 cmn_err(CE_WARN, "sadb_expire_assoc: " 3874 "Unknown inner address length.\n"); 3875 return; 3876 } 3877 } 3878 3879 mp->b_cont = allocb(alloclen, BPRI_HI); 3880 if (mp->b_cont == NULL) { 3881 freeb(mp); 3882 /* cmn_err(CE_WARN, */ 3883 /* "sadb_expire_assoc: Can't allocate message.\n"); */ 3884 return; 3885 } 3886 3887 mp1 = mp; 3888 mp = mp->b_cont; 3889 end = mp->b_wptr + alloclen; 3890 3891 samsg = (sadb_msg_t *)mp->b_wptr; 3892 mp->b_wptr += sizeof (*samsg); 3893 samsg->sadb_msg_version = PF_KEY_V2; 3894 samsg->sadb_msg_type = SADB_EXPIRE; 3895 samsg->sadb_msg_errno = 0; 3896 samsg->sadb_msg_satype = assoc->ipsa_type; 3897 samsg->sadb_msg_len = SADB_8TO64(alloclen); 3898 samsg->sadb_msg_reserved = 0; 3899 samsg->sadb_msg_seq = 0; 3900 samsg->sadb_msg_pid = 0; 3901 3902 saext = (sadb_sa_t *)mp->b_wptr; 3903 mp->b_wptr += sizeof (*saext); 3904 saext->sadb_sa_len = SADB_8TO64(sizeof (*saext)); 3905 saext->sadb_sa_exttype = SADB_EXT_SA; 3906 saext->sadb_sa_spi = assoc->ipsa_spi; 3907 saext->sadb_sa_replay = assoc->ipsa_replay_wsize; 3908 saext->sadb_sa_state = assoc->ipsa_state; 3909 saext->sadb_sa_auth = assoc->ipsa_auth_alg; 3910 saext->sadb_sa_encrypt = assoc->ipsa_encr_alg; 3911 saext->sadb_sa_flags = assoc->ipsa_flags; 3912 3913 current = (sadb_lifetime_t *)mp->b_wptr; 3914 mp->b_wptr += sizeof (sadb_lifetime_t); 3915 current->sadb_lifetime_len = SADB_8TO64(sizeof (*current)); 3916 current->sadb_lifetime_exttype = SADB_EXT_LIFETIME_CURRENT; 3917 /* We do not support the concept. */ 3918 current->sadb_lifetime_allocations = 0; 3919 current->sadb_lifetime_bytes = assoc->ipsa_bytes; 3920 current->sadb_lifetime_addtime = assoc->ipsa_addtime; 3921 current->sadb_lifetime_usetime = assoc->ipsa_usetime; 3922 3923 expire = (sadb_lifetime_t *)mp->b_wptr; 3924 mp->b_wptr += sizeof (*expire); 3925 expire->sadb_lifetime_len = SADB_8TO64(sizeof (*expire)); 3926 3927 if (assoc->ipsa_state == IPSA_STATE_DEAD) { 3928 expire->sadb_lifetime_exttype = SADB_EXT_LIFETIME_HARD; 3929 expire->sadb_lifetime_allocations = assoc->ipsa_hardalloc; 3930 expire->sadb_lifetime_bytes = assoc->ipsa_hardbyteslt; 3931 expire->sadb_lifetime_addtime = assoc->ipsa_hardaddlt; 3932 expire->sadb_lifetime_usetime = assoc->ipsa_harduselt; 3933 } else if (assoc->ipsa_state == IPSA_STATE_DYING) { 3934 expire->sadb_lifetime_exttype = SADB_EXT_LIFETIME_SOFT; 3935 expire->sadb_lifetime_allocations = assoc->ipsa_softalloc; 3936 expire->sadb_lifetime_bytes = assoc->ipsa_softbyteslt; 3937 expire->sadb_lifetime_addtime = assoc->ipsa_softaddlt; 3938 expire->sadb_lifetime_usetime = assoc->ipsa_softuselt; 3939 } else { 3940 ASSERT(assoc->ipsa_state == IPSA_STATE_MATURE); 3941 expire->sadb_lifetime_exttype = SADB_X_EXT_LIFETIME_IDLE; 3942 expire->sadb_lifetime_allocations = 0; 3943 expire->sadb_lifetime_bytes = 0; 3944 expire->sadb_lifetime_addtime = assoc->ipsa_idleaddlt; 3945 expire->sadb_lifetime_usetime = assoc->ipsa_idleuselt; 3946 } 3947 3948 mp->b_wptr = sadb_make_addr_ext(mp->b_wptr, end, SADB_EXT_ADDRESS_SRC, 3949 af, assoc->ipsa_srcaddr, tunnel_mode ? 0 : SA_SRCPORT(assoc), 3950 SA_PROTO(assoc), 0); 3951 ASSERT(mp->b_wptr != NULL); 3952 3953 mp->b_wptr = sadb_make_addr_ext(mp->b_wptr, end, SADB_EXT_ADDRESS_DST, 3954 af, assoc->ipsa_dstaddr, tunnel_mode ? 0 : SA_DSTPORT(assoc), 3955 SA_PROTO(assoc), 0); 3956 ASSERT(mp->b_wptr != NULL); 3957 3958 if (tunnel_mode) { 3959 mp->b_wptr = sadb_make_addr_ext(mp->b_wptr, end, 3960 SADB_X_EXT_ADDRESS_INNER_SRC, assoc->ipsa_innerfam, 3961 assoc->ipsa_innersrc, SA_SRCPORT(assoc), SA_IPROTO(assoc), 3962 assoc->ipsa_innersrcpfx); 3963 ASSERT(mp->b_wptr != NULL); 3964 mp->b_wptr = sadb_make_addr_ext(mp->b_wptr, end, 3965 SADB_X_EXT_ADDRESS_INNER_DST, assoc->ipsa_innerfam, 3966 assoc->ipsa_innerdst, SA_DSTPORT(assoc), SA_IPROTO(assoc), 3967 assoc->ipsa_innerdstpfx); 3968 ASSERT(mp->b_wptr != NULL); 3969 } 3970 3971 /* Can just putnext, we're ready to go! */ 3972 putnext(pfkey_q, mp1); 3973 } 3974 3975 /* 3976 * "Age" the SA with the number of bytes that was used to protect traffic. 3977 * Send an SADB_EXPIRE message if appropriate. Return B_TRUE if there was 3978 * enough "charge" left in the SA to protect the data. Return B_FALSE 3979 * otherwise. (If B_FALSE is returned, the association either was, or became 3980 * DEAD.) 3981 */ 3982 boolean_t 3983 sadb_age_bytes(queue_t *pfkey_q, ipsa_t *assoc, uint64_t bytes, 3984 boolean_t sendmsg) 3985 { 3986 boolean_t rc = B_TRUE; 3987 uint64_t newtotal; 3988 3989 mutex_enter(&assoc->ipsa_lock); 3990 newtotal = assoc->ipsa_bytes + bytes; 3991 if (assoc->ipsa_hardbyteslt != 0 && 3992 newtotal >= assoc->ipsa_hardbyteslt) { 3993 if (assoc->ipsa_state != IPSA_STATE_DEAD) { 3994 sadb_delete_cluster(assoc); 3995 /* 3996 * Send EXPIRE message to PF_KEY. May wish to pawn 3997 * this off on another non-interrupt thread. Also 3998 * unlink this SA immediately. 3999 */ 4000 assoc->ipsa_state = IPSA_STATE_DEAD; 4001 if (sendmsg) 4002 sadb_expire_assoc(pfkey_q, assoc); 4003 /* 4004 * Set non-zero expiration time so sadb_age_assoc() 4005 * will work when reaping. 4006 */ 4007 assoc->ipsa_hardexpiretime = (time_t)1; 4008 } /* Else someone beat me to it! */ 4009 rc = B_FALSE; 4010 } else if (assoc->ipsa_softbyteslt != 0 && 4011 (newtotal >= assoc->ipsa_softbyteslt)) { 4012 if (assoc->ipsa_state < IPSA_STATE_DYING) { 4013 /* 4014 * Send EXPIRE message to PF_KEY. May wish to pawn 4015 * this off on another non-interrupt thread. 4016 */ 4017 assoc->ipsa_state = IPSA_STATE_DYING; 4018 assoc->ipsa_bytes = newtotal; 4019 if (sendmsg) 4020 sadb_expire_assoc(pfkey_q, assoc); 4021 } /* Else someone beat me to it! */ 4022 } 4023 if (rc == B_TRUE) 4024 assoc->ipsa_bytes = newtotal; 4025 mutex_exit(&assoc->ipsa_lock); 4026 return (rc); 4027 } 4028 4029 /* 4030 * Push one or more DL_CO_DELETE messages queued up by 4031 * sadb_torch_assoc down to the underlying driver now that it's a 4032 * convenient time for it (i.e., ipsa bucket locks not held). 4033 */ 4034 static void 4035 sadb_drain_torchq(queue_t *q, mblk_t *mp) 4036 { 4037 while (mp != NULL) { 4038 mblk_t *next = mp->b_next; 4039 mp->b_next = NULL; 4040 if (q != NULL) 4041 putnext(q, mp); 4042 else 4043 freemsg(mp); 4044 mp = next; 4045 } 4046 } 4047 4048 /* 4049 * "Torch" an individual SA. Returns NULL, so it can be tail-called from 4050 * sadb_age_assoc(). 4051 * 4052 * If SA is hardware-accelerated, and we can't allocate the mblk 4053 * containing the DL_CO_DELETE, just return; it will remain in the 4054 * table and be swept up by sadb_ager() in a subsequent pass. 4055 */ 4056 static ipsa_t * 4057 sadb_torch_assoc(isaf_t *head, ipsa_t *sa, boolean_t inbnd, mblk_t **mq) 4058 { 4059 mblk_t *mp; 4060 4061 ASSERT(MUTEX_HELD(&head->isaf_lock)); 4062 ASSERT(MUTEX_HELD(&sa->ipsa_lock)); 4063 ASSERT(sa->ipsa_state == IPSA_STATE_DEAD); 4064 4065 /* 4066 * Force cached SAs to be revalidated.. 4067 */ 4068 head->isaf_gen++; 4069 4070 if (sa->ipsa_flags & IPSA_F_HW) { 4071 mp = sadb_fmt_sa_req(DL_CO_DELETE, sa->ipsa_type, sa, inbnd); 4072 if (mp == NULL) { 4073 mutex_exit(&sa->ipsa_lock); 4074 return (NULL); 4075 } 4076 mp->b_next = *mq; 4077 *mq = mp; 4078 } 4079 mutex_exit(&sa->ipsa_lock); 4080 sadb_unlinkassoc(sa); 4081 4082 return (NULL); 4083 } 4084 4085 /* 4086 * Do various SA-is-idle activities depending on delta (the number of idle 4087 * seconds on the SA) and/or other properties of the SA. 4088 * 4089 * Return B_TRUE if I've sent a packet, because I have to drop the 4090 * association's mutex before sending a packet out the wire. 4091 */ 4092 /* ARGSUSED */ 4093 static boolean_t 4094 sadb_idle_activities(ipsa_t *assoc, time_t delta, boolean_t inbound) 4095 { 4096 ipsecesp_stack_t *espstack = assoc->ipsa_netstack->netstack_ipsecesp; 4097 int nat_t_interval = espstack->ipsecesp_nat_keepalive_interval; 4098 4099 ASSERT(MUTEX_HELD(&assoc->ipsa_lock)); 4100 4101 if (!inbound && (assoc->ipsa_flags & IPSA_F_NATT_LOC) && 4102 delta >= nat_t_interval && 4103 gethrestime_sec() - assoc->ipsa_last_nat_t_ka >= nat_t_interval) { 4104 ASSERT(assoc->ipsa_type == SADB_SATYPE_ESP); 4105 assoc->ipsa_last_nat_t_ka = gethrestime_sec(); 4106 mutex_exit(&assoc->ipsa_lock); 4107 ipsecesp_send_keepalive(assoc); 4108 return (B_TRUE); 4109 } 4110 return (B_FALSE); 4111 } 4112 4113 /* 4114 * Return "assoc" if haspeer is true and I send an expire. This allows 4115 * the consumers' aging functions to tidy up an expired SA's peer. 4116 */ 4117 static ipsa_t * 4118 sadb_age_assoc(isaf_t *head, queue_t *pfkey_q, ipsa_t *assoc, 4119 time_t current, int reap_delay, boolean_t inbound, mblk_t **mq) 4120 { 4121 ipsa_t *retval = NULL; 4122 boolean_t dropped_mutex = B_FALSE; 4123 4124 ASSERT(MUTEX_HELD(&head->isaf_lock)); 4125 4126 mutex_enter(&assoc->ipsa_lock); 4127 4128 if (((assoc->ipsa_state == IPSA_STATE_LARVAL) || 4129 ((assoc->ipsa_state == IPSA_STATE_IDLE) || 4130 (assoc->ipsa_state == IPSA_STATE_ACTIVE_ELSEWHERE) && 4131 (assoc->ipsa_hardexpiretime != 0))) && 4132 (assoc->ipsa_hardexpiretime <= current)) { 4133 assoc->ipsa_state = IPSA_STATE_DEAD; 4134 return (sadb_torch_assoc(head, assoc, inbound, mq)); 4135 } 4136 4137 /* 4138 * Check lifetimes. Fortunately, SA setup is done 4139 * such that there are only two times to look at, 4140 * softexpiretime, and hardexpiretime. 4141 * 4142 * Check hard first. 4143 */ 4144 4145 if (assoc->ipsa_hardexpiretime != 0 && 4146 assoc->ipsa_hardexpiretime <= current) { 4147 if (assoc->ipsa_state == IPSA_STATE_DEAD) 4148 return (sadb_torch_assoc(head, assoc, inbound, mq)); 4149 4150 if (inbound) { 4151 sadb_delete_cluster(assoc); 4152 } 4153 4154 /* 4155 * Send SADB_EXPIRE with hard lifetime, delay for unlinking. 4156 */ 4157 assoc->ipsa_state = IPSA_STATE_DEAD; 4158 if (assoc->ipsa_haspeer || assoc->ipsa_otherspi != 0) { 4159 /* 4160 * If the SA is paired or peered with another, put 4161 * a copy on a list which can be processed later, the 4162 * pair/peer SA needs to be updated so the both die 4163 * at the same time. 4164 * 4165 * If I return assoc, I have to bump up its reference 4166 * count to keep with the ipsa_t reference count 4167 * semantics. 4168 */ 4169 IPSA_REFHOLD(assoc); 4170 retval = assoc; 4171 } 4172 sadb_expire_assoc(pfkey_q, assoc); 4173 assoc->ipsa_hardexpiretime = current + reap_delay; 4174 } else if (assoc->ipsa_softexpiretime != 0 && 4175 assoc->ipsa_softexpiretime <= current && 4176 assoc->ipsa_state < IPSA_STATE_DYING) { 4177 /* 4178 * Send EXPIRE message to PF_KEY. May wish to pawn 4179 * this off on another non-interrupt thread. 4180 */ 4181 assoc->ipsa_state = IPSA_STATE_DYING; 4182 if (assoc->ipsa_haspeer) { 4183 /* 4184 * If the SA has a peer, update the peer's state 4185 * on SOFT_EXPIRE, this is mostly to prevent two 4186 * expire messages from effectively the same SA. 4187 * 4188 * Don't care about paired SA's, then can (and should) 4189 * be able to soft expire at different times. 4190 * 4191 * If I return assoc, I have to bump up its 4192 * reference count to keep with the ipsa_t reference 4193 * count semantics. 4194 */ 4195 IPSA_REFHOLD(assoc); 4196 retval = assoc; 4197 } 4198 sadb_expire_assoc(pfkey_q, assoc); 4199 } else if (assoc->ipsa_idletime != 0 && 4200 assoc->ipsa_idleexpiretime <= current) { 4201 if (assoc->ipsa_state == IPSA_STATE_ACTIVE_ELSEWHERE) { 4202 assoc->ipsa_state = IPSA_STATE_IDLE; 4203 } 4204 4205 /* 4206 * Need to handle Mature case 4207 */ 4208 if (assoc->ipsa_state == IPSA_STATE_MATURE) { 4209 sadb_expire_assoc(pfkey_q, assoc); 4210 } 4211 } else { 4212 /* Check idle time activities. */ 4213 dropped_mutex = sadb_idle_activities(assoc, 4214 current - assoc->ipsa_lastuse, inbound); 4215 } 4216 4217 if (!dropped_mutex) 4218 mutex_exit(&assoc->ipsa_lock); 4219 return (retval); 4220 } 4221 4222 /* 4223 * Called by a consumer protocol to do ther dirty work of reaping dead 4224 * Security Associations. 4225 * 4226 * NOTE: sadb_age_assoc() marks expired SA's as DEAD but only removed 4227 * SA's that are already marked DEAD, so expired SA's are only reaped 4228 * the second time sadb_ager() runs. 4229 */ 4230 void 4231 sadb_ager(sadb_t *sp, queue_t *pfkey_q, queue_t *ip_q, int reap_delay, 4232 netstack_t *ns) 4233 { 4234 int i; 4235 isaf_t *bucket; 4236 ipsa_t *assoc, *spare; 4237 iacqf_t *acqlist; 4238 ipsacq_t *acqrec, *spareacq; 4239 templist_t *haspeerlist, *newbie; 4240 /* Snapshot current time now. */ 4241 time_t current = gethrestime_sec(); 4242 mblk_t *mq = NULL; 4243 haspeerlist = NULL; 4244 4245 /* 4246 * Do my dirty work. This includes aging real entries, aging 4247 * larvals, and aging outstanding ACQUIREs. 4248 * 4249 * I hope I don't tie up resources for too long. 4250 */ 4251 4252 /* Age acquires. */ 4253 4254 for (i = 0; i < sp->sdb_hashsize; i++) { 4255 acqlist = &sp->sdb_acq[i]; 4256 mutex_enter(&acqlist->iacqf_lock); 4257 for (acqrec = acqlist->iacqf_ipsacq; acqrec != NULL; 4258 acqrec = spareacq) { 4259 spareacq = acqrec->ipsacq_next; 4260 if (current > acqrec->ipsacq_expire) 4261 sadb_destroy_acquire(acqrec, ns); 4262 } 4263 mutex_exit(&acqlist->iacqf_lock); 4264 } 4265 4266 /* Age inbound associations. */ 4267 for (i = 0; i < sp->sdb_hashsize; i++) { 4268 bucket = &(sp->sdb_if[i]); 4269 mutex_enter(&bucket->isaf_lock); 4270 for (assoc = bucket->isaf_ipsa; assoc != NULL; 4271 assoc = spare) { 4272 spare = assoc->ipsa_next; 4273 if (sadb_age_assoc(bucket, pfkey_q, assoc, current, 4274 reap_delay, B_TRUE, &mq) != NULL) { 4275 /* 4276 * Put SA's which have a peer or SA's which 4277 * are paired on a list for processing after 4278 * all the hash tables have been walked. 4279 * 4280 * sadb_age_assoc() increments the refcnt, 4281 * effectively doing an IPSA_REFHOLD(). 4282 */ 4283 newbie = kmem_alloc(sizeof (*newbie), 4284 KM_NOSLEEP); 4285 if (newbie == NULL) { 4286 /* 4287 * Don't forget to REFRELE(). 4288 */ 4289 IPSA_REFRELE(assoc); 4290 continue; /* for loop... */ 4291 } 4292 newbie->next = haspeerlist; 4293 newbie->ipsa = assoc; 4294 haspeerlist = newbie; 4295 } 4296 } 4297 mutex_exit(&bucket->isaf_lock); 4298 } 4299 4300 if (mq != NULL) { 4301 sadb_drain_torchq(ip_q, mq); 4302 mq = NULL; 4303 } 4304 age_pair_peer_list(haspeerlist, sp, B_FALSE); 4305 haspeerlist = NULL; 4306 4307 /* Age outbound associations. */ 4308 for (i = 0; i < sp->sdb_hashsize; i++) { 4309 bucket = &(sp->sdb_of[i]); 4310 mutex_enter(&bucket->isaf_lock); 4311 for (assoc = bucket->isaf_ipsa; assoc != NULL; 4312 assoc = spare) { 4313 spare = assoc->ipsa_next; 4314 if (sadb_age_assoc(bucket, pfkey_q, assoc, current, 4315 reap_delay, B_FALSE, &mq) != NULL) { 4316 /* 4317 * sadb_age_assoc() increments the refcnt, 4318 * effectively doing an IPSA_REFHOLD(). 4319 */ 4320 newbie = kmem_alloc(sizeof (*newbie), 4321 KM_NOSLEEP); 4322 if (newbie == NULL) { 4323 /* 4324 * Don't forget to REFRELE(). 4325 */ 4326 IPSA_REFRELE(assoc); 4327 continue; /* for loop... */ 4328 } 4329 newbie->next = haspeerlist; 4330 newbie->ipsa = assoc; 4331 haspeerlist = newbie; 4332 } 4333 } 4334 mutex_exit(&bucket->isaf_lock); 4335 } 4336 if (mq != NULL) { 4337 sadb_drain_torchq(ip_q, mq); 4338 mq = NULL; 4339 } 4340 4341 age_pair_peer_list(haspeerlist, sp, B_TRUE); 4342 4343 /* 4344 * Run a GC pass to clean out dead identities. 4345 */ 4346 ipsid_gc(ns); 4347 } 4348 4349 /* 4350 * Figure out when to reschedule the ager. 4351 */ 4352 timeout_id_t 4353 sadb_retimeout(hrtime_t begin, queue_t *pfkey_q, void (*ager)(void *), 4354 void *agerarg, uint_t *intp, uint_t intmax, short mid) 4355 { 4356 hrtime_t end = gethrtime(); 4357 uint_t interval = *intp; 4358 4359 /* 4360 * See how long this took. If it took too long, increase the 4361 * aging interval. 4362 */ 4363 if ((end - begin) > interval * 1000000) { 4364 if (interval >= intmax) { 4365 /* XXX Rate limit this? Or recommend flush? */ 4366 (void) strlog(mid, 0, 0, SL_ERROR | SL_WARN, 4367 "Too many SA's to age out in %d msec.\n", 4368 intmax); 4369 } else { 4370 /* Double by shifting by one bit. */ 4371 interval <<= 1; 4372 interval = min(interval, intmax); 4373 } 4374 } else if ((end - begin) <= interval * 500000 && 4375 interval > SADB_AGE_INTERVAL_DEFAULT) { 4376 /* 4377 * If I took less than half of the interval, then I should 4378 * ratchet the interval back down. Never automatically 4379 * shift below the default aging interval. 4380 * 4381 * NOTE:This even overrides manual setting of the age 4382 * interval using NDD. 4383 */ 4384 /* Halve by shifting one bit. */ 4385 interval >>= 1; 4386 interval = max(interval, SADB_AGE_INTERVAL_DEFAULT); 4387 } 4388 *intp = interval; 4389 return (qtimeout(pfkey_q, ager, agerarg, 4390 interval * drv_usectohz(1000))); 4391 } 4392 4393 4394 /* 4395 * Update the lifetime values of an SA. This is the path an SADB_UPDATE 4396 * message takes when updating a MATURE or DYING SA. 4397 */ 4398 static void 4399 sadb_update_lifetimes(ipsa_t *assoc, sadb_lifetime_t *hard, 4400 sadb_lifetime_t *soft, sadb_lifetime_t *idle, boolean_t outbound) 4401 { 4402 mutex_enter(&assoc->ipsa_lock); 4403 4404 /* 4405 * XXX RFC 2367 mentions how an SADB_EXT_LIFETIME_CURRENT can be 4406 * passed in during an update message. We currently don't handle 4407 * these. 4408 */ 4409 4410 if (hard != NULL) { 4411 if (hard->sadb_lifetime_bytes != 0) 4412 assoc->ipsa_hardbyteslt = hard->sadb_lifetime_bytes; 4413 if (hard->sadb_lifetime_usetime != 0) 4414 assoc->ipsa_harduselt = hard->sadb_lifetime_usetime; 4415 if (hard->sadb_lifetime_addtime != 0) 4416 assoc->ipsa_hardaddlt = hard->sadb_lifetime_addtime; 4417 if (assoc->ipsa_hardaddlt != 0) { 4418 assoc->ipsa_hardexpiretime = 4419 assoc->ipsa_addtime + assoc->ipsa_hardaddlt; 4420 } 4421 if (assoc->ipsa_harduselt != 0 && 4422 assoc->ipsa_flags & IPSA_F_USED) { 4423 UPDATE_EXPIRE(assoc, harduselt, hardexpiretime); 4424 } 4425 if (hard->sadb_lifetime_allocations != 0) 4426 assoc->ipsa_hardalloc = hard->sadb_lifetime_allocations; 4427 } 4428 4429 if (soft != NULL) { 4430 if (soft->sadb_lifetime_bytes != 0) { 4431 if (soft->sadb_lifetime_bytes > 4432 assoc->ipsa_hardbyteslt) { 4433 assoc->ipsa_softbyteslt = 4434 assoc->ipsa_hardbyteslt; 4435 } else { 4436 assoc->ipsa_softbyteslt = 4437 soft->sadb_lifetime_bytes; 4438 } 4439 } 4440 if (soft->sadb_lifetime_usetime != 0) { 4441 if (soft->sadb_lifetime_usetime > 4442 assoc->ipsa_harduselt) { 4443 assoc->ipsa_softuselt = 4444 assoc->ipsa_harduselt; 4445 } else { 4446 assoc->ipsa_softuselt = 4447 soft->sadb_lifetime_usetime; 4448 } 4449 } 4450 if (soft->sadb_lifetime_addtime != 0) { 4451 if (soft->sadb_lifetime_addtime > 4452 assoc->ipsa_hardexpiretime) { 4453 assoc->ipsa_softexpiretime = 4454 assoc->ipsa_hardexpiretime; 4455 } else { 4456 assoc->ipsa_softaddlt = 4457 soft->sadb_lifetime_addtime; 4458 } 4459 } 4460 if (assoc->ipsa_softaddlt != 0) { 4461 assoc->ipsa_softexpiretime = 4462 assoc->ipsa_addtime + assoc->ipsa_softaddlt; 4463 } 4464 if (assoc->ipsa_softuselt != 0 && 4465 assoc->ipsa_flags & IPSA_F_USED) { 4466 UPDATE_EXPIRE(assoc, softuselt, softexpiretime); 4467 } 4468 if (outbound && assoc->ipsa_softexpiretime != 0) { 4469 if (assoc->ipsa_state == IPSA_STATE_MATURE) 4470 lifetime_fuzz(assoc); 4471 } 4472 4473 if (soft->sadb_lifetime_allocations != 0) 4474 assoc->ipsa_softalloc = soft->sadb_lifetime_allocations; 4475 } 4476 4477 if (idle != NULL) { 4478 time_t current = gethrestime_sec(); 4479 if ((assoc->ipsa_idleexpiretime <= current) && 4480 (assoc->ipsa_idleaddlt == idle->sadb_lifetime_addtime)) { 4481 assoc->ipsa_idleexpiretime = 4482 current + assoc->ipsa_idleaddlt; 4483 } 4484 if (idle->sadb_lifetime_addtime != 0) 4485 assoc->ipsa_idleaddlt = idle->sadb_lifetime_addtime; 4486 if (idle->sadb_lifetime_usetime != 0) 4487 assoc->ipsa_idleuselt = idle->sadb_lifetime_usetime; 4488 if (assoc->ipsa_idleaddlt != 0) { 4489 assoc->ipsa_idleexpiretime = 4490 current + idle->sadb_lifetime_addtime; 4491 assoc->ipsa_idletime = idle->sadb_lifetime_addtime; 4492 } 4493 if (assoc->ipsa_idleuselt != 0) { 4494 if (assoc->ipsa_idletime != 0) { 4495 assoc->ipsa_idletime = min(assoc->ipsa_idletime, 4496 assoc->ipsa_idleuselt); 4497 assoc->ipsa_idleexpiretime = 4498 current + assoc->ipsa_idletime; 4499 } else { 4500 assoc->ipsa_idleexpiretime = 4501 current + assoc->ipsa_idleuselt; 4502 assoc->ipsa_idletime = assoc->ipsa_idleuselt; 4503 } 4504 } 4505 } 4506 mutex_exit(&assoc->ipsa_lock); 4507 } 4508 4509 static int 4510 sadb_update_state(ipsa_t *assoc, uint_t new_state, mblk_t **ipkt_lst) 4511 { 4512 int rcode = 0; 4513 time_t current = gethrestime_sec(); 4514 4515 mutex_enter(&assoc->ipsa_lock); 4516 4517 switch (new_state) { 4518 case SADB_X_SASTATE_ACTIVE_ELSEWHERE: 4519 if (assoc->ipsa_state == SADB_X_SASTATE_IDLE) { 4520 assoc->ipsa_state = IPSA_STATE_ACTIVE_ELSEWHERE; 4521 assoc->ipsa_idleexpiretime = 4522 current + assoc->ipsa_idletime; 4523 } 4524 break; 4525 case SADB_X_SASTATE_IDLE: 4526 if (assoc->ipsa_state == SADB_X_SASTATE_ACTIVE_ELSEWHERE) { 4527 assoc->ipsa_state = IPSA_STATE_IDLE; 4528 assoc->ipsa_idleexpiretime = 4529 current + assoc->ipsa_idletime; 4530 } else { 4531 rcode = EINVAL; 4532 } 4533 break; 4534 4535 case SADB_X_SASTATE_ACTIVE: 4536 if (assoc->ipsa_state != SADB_X_SASTATE_IDLE) { 4537 rcode = EINVAL; 4538 break; 4539 } 4540 assoc->ipsa_state = IPSA_STATE_MATURE; 4541 assoc->ipsa_idleexpiretime = current + assoc->ipsa_idletime; 4542 4543 if (ipkt_lst == NULL) { 4544 break; 4545 } 4546 4547 if (assoc->ipsa_bpkt_head != NULL) { 4548 *ipkt_lst = assoc->ipsa_bpkt_head; 4549 assoc->ipsa_bpkt_head = assoc->ipsa_bpkt_tail = NULL; 4550 assoc->ipsa_mblkcnt = 0; 4551 } else { 4552 *ipkt_lst = NULL; 4553 } 4554 break; 4555 default: 4556 rcode = EINVAL; 4557 break; 4558 } 4559 4560 mutex_exit(&assoc->ipsa_lock); 4561 return (rcode); 4562 } 4563 4564 /* 4565 * Common code to update an SA. 4566 */ 4567 4568 int 4569 sadb_update_sa(mblk_t *mp, keysock_in_t *ksi, mblk_t **ipkt_lst, 4570 sadbp_t *spp, int *diagnostic, queue_t *pfkey_q, 4571 int (*add_sa_func)(mblk_t *, keysock_in_t *, int *, netstack_t *), 4572 netstack_t *ns, uint8_t sadb_msg_type) 4573 { 4574 sadb_sa_t *assoc = (sadb_sa_t *)ksi->ks_in_extv[SADB_EXT_SA]; 4575 sadb_address_t *srcext = 4576 (sadb_address_t *)ksi->ks_in_extv[SADB_EXT_ADDRESS_SRC]; 4577 sadb_address_t *dstext = 4578 (sadb_address_t *)ksi->ks_in_extv[SADB_EXT_ADDRESS_DST]; 4579 sadb_x_kmc_t *kmcext = 4580 (sadb_x_kmc_t *)ksi->ks_in_extv[SADB_X_EXT_KM_COOKIE]; 4581 sadb_key_t *akey = (sadb_key_t *)ksi->ks_in_extv[SADB_EXT_KEY_AUTH]; 4582 sadb_key_t *ekey = (sadb_key_t *)ksi->ks_in_extv[SADB_EXT_KEY_ENCRYPT]; 4583 sadb_x_replay_ctr_t *replext = 4584 (sadb_x_replay_ctr_t *)ksi->ks_in_extv[SADB_X_EXT_REPLAY_VALUE]; 4585 sadb_lifetime_t *soft = 4586 (sadb_lifetime_t *)ksi->ks_in_extv[SADB_EXT_LIFETIME_SOFT]; 4587 sadb_lifetime_t *hard = 4588 (sadb_lifetime_t *)ksi->ks_in_extv[SADB_EXT_LIFETIME_HARD]; 4589 sadb_lifetime_t *idle = 4590 (sadb_lifetime_t *)ksi->ks_in_extv[SADB_X_EXT_LIFETIME_IDLE]; 4591 sadb_x_pair_t *pair_ext = 4592 (sadb_x_pair_t *)ksi->ks_in_extv[SADB_X_EXT_PAIR]; 4593 ipsa_t *echo_target = NULL; 4594 int error = 0; 4595 ipsap_t *ipsapp = NULL; 4596 uint32_t kmp = 0, kmc = 0; 4597 time_t current = gethrestime_sec(); 4598 4599 4600 /* I need certain extensions present for either UPDATE message. */ 4601 if (srcext == NULL) { 4602 *diagnostic = SADB_X_DIAGNOSTIC_MISSING_SRC; 4603 return (EINVAL); 4604 } 4605 if (dstext == NULL) { 4606 *diagnostic = SADB_X_DIAGNOSTIC_MISSING_DST; 4607 return (EINVAL); 4608 } 4609 if (assoc == NULL) { 4610 *diagnostic = SADB_X_DIAGNOSTIC_MISSING_SA; 4611 return (EINVAL); 4612 } 4613 4614 if (kmcext != NULL) { 4615 kmp = kmcext->sadb_x_kmc_proto; 4616 kmc = kmcext->sadb_x_kmc_cookie; 4617 } 4618 4619 ipsapp = get_ipsa_pair(assoc, srcext, dstext, spp); 4620 if (ipsapp == NULL) { 4621 *diagnostic = SADB_X_DIAGNOSTIC_SA_NOTFOUND; 4622 return (ESRCH); 4623 } 4624 4625 if (ipsapp->ipsap_psa_ptr == NULL && ipsapp->ipsap_sa_ptr != NULL) { 4626 if (ipsapp->ipsap_sa_ptr->ipsa_state == IPSA_STATE_LARVAL) { 4627 /* 4628 * REFRELE the target and let the add_sa_func() 4629 * deal with updating a larval SA. 4630 */ 4631 destroy_ipsa_pair(ipsapp); 4632 return (add_sa_func(mp, ksi, diagnostic, ns)); 4633 } 4634 } 4635 4636 if (assoc->sadb_sa_state == SADB_X_SASTATE_ACTIVE_ELSEWHERE) { 4637 if (ipsapp->ipsap_sa_ptr != NULL && 4638 ipsapp->ipsap_sa_ptr->ipsa_state == IPSA_STATE_IDLE) { 4639 if ((error = sadb_update_state(ipsapp->ipsap_sa_ptr, 4640 assoc->sadb_sa_state, NULL)) != 0) { 4641 *diagnostic = SADB_X_DIAGNOSTIC_BAD_SASTATE; 4642 goto bail; 4643 } 4644 } 4645 if (ipsapp->ipsap_psa_ptr != NULL && 4646 ipsapp->ipsap_psa_ptr->ipsa_state == IPSA_STATE_IDLE) { 4647 if ((error = sadb_update_state(ipsapp->ipsap_psa_ptr, 4648 assoc->sadb_sa_state, NULL)) != 0) { 4649 *diagnostic = SADB_X_DIAGNOSTIC_BAD_SASTATE; 4650 goto bail; 4651 } 4652 } 4653 } 4654 if (assoc->sadb_sa_state == SADB_X_SASTATE_ACTIVE) { 4655 if (ipsapp->ipsap_sa_ptr != NULL) { 4656 error = sadb_update_state(ipsapp->ipsap_sa_ptr, 4657 assoc->sadb_sa_state, 4658 (ipsapp->ipsap_sa_ptr->ipsa_flags & 4659 IPSA_F_INBOUND) ? ipkt_lst : NULL); 4660 if (error) { 4661 *diagnostic = SADB_X_DIAGNOSTIC_BAD_SASTATE; 4662 goto bail; 4663 } 4664 } 4665 if (ipsapp->ipsap_psa_ptr != NULL) { 4666 error = sadb_update_state(ipsapp->ipsap_psa_ptr, 4667 assoc->sadb_sa_state, 4668 (ipsapp->ipsap_psa_ptr->ipsa_flags & 4669 IPSA_F_INBOUND) ? ipkt_lst : NULL); 4670 if (error) { 4671 *diagnostic = SADB_X_DIAGNOSTIC_BAD_SASTATE; 4672 goto bail; 4673 } 4674 } 4675 sadb_pfkey_echo(pfkey_q, mp, (sadb_msg_t *)mp->b_cont->b_rptr, 4676 ksi, echo_target); 4677 goto bail; 4678 } 4679 4680 /* 4681 * Reality checks for updates of active associations. 4682 * Sundry first-pass UPDATE-specific reality checks. 4683 * Have to do the checks here, because it's after the add_sa code. 4684 * XXX STATS : logging/stats here? 4685 */ 4686 4687 if (!((assoc->sadb_sa_state == SADB_SASTATE_MATURE) || 4688 (assoc->sadb_sa_state == SADB_X_SASTATE_ACTIVE_ELSEWHERE))) { 4689 *diagnostic = SADB_X_DIAGNOSTIC_BAD_SASTATE; 4690 error = EINVAL; 4691 goto bail; 4692 } 4693 4694 if (assoc->sadb_sa_flags & ~spp->s_updateflags) { 4695 *diagnostic = SADB_X_DIAGNOSTIC_BAD_SAFLAGS; 4696 error = EINVAL; 4697 goto bail; 4698 } 4699 4700 if (ksi->ks_in_extv[SADB_EXT_LIFETIME_CURRENT] != NULL) { 4701 error = EOPNOTSUPP; 4702 goto bail; 4703 } 4704 4705 if ((*diagnostic = sadb_hardsoftchk(hard, soft, idle)) != 0) { 4706 error = EINVAL; 4707 goto bail; 4708 } 4709 if (akey != NULL) { 4710 *diagnostic = SADB_X_DIAGNOSTIC_AKEY_PRESENT; 4711 error = EINVAL; 4712 goto bail; 4713 } 4714 if (ekey != NULL) { 4715 *diagnostic = SADB_X_DIAGNOSTIC_EKEY_PRESENT; 4716 error = EINVAL; 4717 goto bail; 4718 } 4719 4720 if (ipsapp->ipsap_sa_ptr != NULL) { 4721 if (ipsapp->ipsap_sa_ptr->ipsa_state == IPSA_STATE_DEAD) { 4722 error = ESRCH; /* DEAD == Not there, in this case. */ 4723 *diagnostic = SADB_X_DIAGNOSTIC_SA_EXPIRED; 4724 goto bail; 4725 } 4726 if ((kmp != 0) && 4727 ((ipsapp->ipsap_sa_ptr->ipsa_kmp != 0) || 4728 (ipsapp->ipsap_sa_ptr->ipsa_kmp != kmp))) { 4729 *diagnostic = SADB_X_DIAGNOSTIC_DUPLICATE_KMP; 4730 error = EINVAL; 4731 goto bail; 4732 } 4733 if ((kmc != 0) && 4734 ((ipsapp->ipsap_sa_ptr->ipsa_kmc != 0) || 4735 (ipsapp->ipsap_sa_ptr->ipsa_kmc != kmc))) { 4736 *diagnostic = SADB_X_DIAGNOSTIC_DUPLICATE_KMC; 4737 error = EINVAL; 4738 goto bail; 4739 } 4740 /* 4741 * Do not allow replay value change for MATURE or LARVAL SA. 4742 */ 4743 4744 if ((replext != NULL) && 4745 ((ipsapp->ipsap_sa_ptr->ipsa_state == IPSA_STATE_LARVAL) || 4746 (ipsapp->ipsap_sa_ptr->ipsa_state == IPSA_STATE_MATURE))) { 4747 *diagnostic = SADB_X_DIAGNOSTIC_BAD_SASTATE; 4748 error = EINVAL; 4749 goto bail; 4750 } 4751 } 4752 4753 if (ipsapp->ipsap_psa_ptr != NULL) { 4754 if (ipsapp->ipsap_psa_ptr->ipsa_state == IPSA_STATE_DEAD) { 4755 *diagnostic = SADB_X_DIAGNOSTIC_SA_EXPIRED; 4756 error = ESRCH; /* DEAD == Not there, in this case. */ 4757 goto bail; 4758 } 4759 if ((kmp != 0) && 4760 ((ipsapp->ipsap_psa_ptr->ipsa_kmp != 0) || 4761 (ipsapp->ipsap_psa_ptr->ipsa_kmp != kmp))) { 4762 *diagnostic = SADB_X_DIAGNOSTIC_DUPLICATE_KMP; 4763 error = EINVAL; 4764 goto bail; 4765 } 4766 if ((kmc != 0) && 4767 ((ipsapp->ipsap_psa_ptr->ipsa_kmc != 0) || 4768 (ipsapp->ipsap_psa_ptr->ipsa_kmc != kmc))) { 4769 *diagnostic = SADB_X_DIAGNOSTIC_DUPLICATE_KMC; 4770 error = EINVAL; 4771 goto bail; 4772 } 4773 } 4774 4775 if (ipsapp->ipsap_sa_ptr != NULL) { 4776 sadb_update_lifetimes(ipsapp->ipsap_sa_ptr, hard, soft, 4777 idle, B_TRUE); 4778 if (kmp != 0) 4779 ipsapp->ipsap_sa_ptr->ipsa_kmp = kmp; 4780 if (kmc != 0) 4781 ipsapp->ipsap_sa_ptr->ipsa_kmc = kmc; 4782 if ((replext != NULL) && 4783 (ipsapp->ipsap_sa_ptr->ipsa_replay_wsize != 0)) { 4784 /* 4785 * If an inbound SA, update the replay counter 4786 * and check off all the other sequence number 4787 */ 4788 if (ksi->ks_in_dsttype == KS_IN_ADDR_ME) { 4789 if (!sadb_replay_check(ipsapp->ipsap_sa_ptr, 4790 replext->sadb_x_rc_replay32)) { 4791 error = EINVAL; 4792 goto bail; 4793 } 4794 mutex_enter(&ipsapp->ipsap_sa_ptr->ipsa_lock); 4795 ipsapp->ipsap_sa_ptr->ipsa_idleexpiretime = 4796 current + 4797 ipsapp->ipsap_sa_ptr->ipsa_idletime; 4798 mutex_exit(&ipsapp->ipsap_sa_ptr->ipsa_lock); 4799 } else { 4800 mutex_enter(&ipsapp->ipsap_sa_ptr->ipsa_lock); 4801 ipsapp->ipsap_sa_ptr->ipsa_replay = 4802 replext->sadb_x_rc_replay32; 4803 ipsapp->ipsap_sa_ptr->ipsa_idleexpiretime = 4804 current + 4805 ipsapp->ipsap_sa_ptr->ipsa_idletime; 4806 mutex_exit(&ipsapp->ipsap_sa_ptr->ipsa_lock); 4807 } 4808 } 4809 } 4810 4811 if (sadb_msg_type == SADB_X_UPDATEPAIR) { 4812 if (ipsapp->ipsap_psa_ptr != NULL) { 4813 sadb_update_lifetimes(ipsapp->ipsap_psa_ptr, hard, soft, 4814 idle, B_FALSE); 4815 if (kmp != 0) 4816 ipsapp->ipsap_psa_ptr->ipsa_kmp = kmp; 4817 if (kmc != 0) 4818 ipsapp->ipsap_psa_ptr->ipsa_kmc = kmc; 4819 } else { 4820 *diagnostic = SADB_X_DIAGNOSTIC_PAIR_SA_NOTFOUND; 4821 error = ESRCH; 4822 goto bail; 4823 } 4824 } 4825 4826 if (pair_ext != NULL) 4827 error = update_pairing(ipsapp, ksi, diagnostic, spp); 4828 4829 if (error == 0) 4830 sadb_pfkey_echo(pfkey_q, mp, (sadb_msg_t *)mp->b_cont->b_rptr, 4831 ksi, echo_target); 4832 bail: 4833 4834 destroy_ipsa_pair(ipsapp); 4835 4836 return (error); 4837 } 4838 4839 4840 int 4841 update_pairing(ipsap_t *ipsapp, keysock_in_t *ksi, int *diagnostic, 4842 sadbp_t *spp) 4843 { 4844 sadb_sa_t *assoc = (sadb_sa_t *)ksi->ks_in_extv[SADB_EXT_SA]; 4845 sadb_address_t *srcext = 4846 (sadb_address_t *)ksi->ks_in_extv[SADB_EXT_ADDRESS_SRC]; 4847 sadb_address_t *dstext = 4848 (sadb_address_t *)ksi->ks_in_extv[SADB_EXT_ADDRESS_DST]; 4849 sadb_x_pair_t *pair_ext = 4850 (sadb_x_pair_t *)ksi->ks_in_extv[SADB_X_EXT_PAIR]; 4851 int error = 0; 4852 ipsap_t *oipsapp = NULL; 4853 boolean_t undo_pair = B_FALSE; 4854 uint32_t ipsa_flags; 4855 4856 if (pair_ext->sadb_x_pair_spi == 0 || pair_ext->sadb_x_pair_spi == 4857 assoc->sadb_sa_spi) { 4858 *diagnostic = SADB_X_DIAGNOSTIC_PAIR_INAPPROPRIATE; 4859 return (EINVAL); 4860 } 4861 4862 /* 4863 * Assume for now that the spi value provided in the SADB_UPDATE 4864 * message was valid, update the SA with its pair spi value. 4865 * If the spi turns out to be bogus or the SA no longer exists 4866 * then this will be detected when the reverse update is made 4867 * below. 4868 */ 4869 mutex_enter(&ipsapp->ipsap_sa_ptr->ipsa_lock); 4870 ipsapp->ipsap_sa_ptr->ipsa_flags |= IPSA_F_PAIRED; 4871 ipsapp->ipsap_sa_ptr->ipsa_otherspi = pair_ext->sadb_x_pair_spi; 4872 mutex_exit(&ipsapp->ipsap_sa_ptr->ipsa_lock); 4873 4874 /* 4875 * After updating the ipsa_otherspi element of the SA, get_ipsa_pair() 4876 * should now return pointers to the SA *AND* its pair, if this is not 4877 * the case, the "otherspi" either did not exist or was deleted. Also 4878 * check that "otherspi" is not already paired. If everything looks 4879 * good, complete the update. IPSA_REFRELE the first pair_pointer 4880 * after this update to ensure its not deleted until we are done. 4881 */ 4882 oipsapp = get_ipsa_pair(assoc, srcext, dstext, spp); 4883 if (oipsapp == NULL) { 4884 /* 4885 * This should never happen, calling function still has 4886 * IPSA_REFHELD on the SA we just updated. 4887 */ 4888 *diagnostic = SADB_X_DIAGNOSTIC_PAIR_SA_NOTFOUND; 4889 return (EINVAL); 4890 } 4891 4892 if (oipsapp->ipsap_psa_ptr == NULL) { 4893 *diagnostic = SADB_X_DIAGNOSTIC_PAIR_INAPPROPRIATE; 4894 undo_pair = B_TRUE; 4895 } else { 4896 ipsa_flags = oipsapp->ipsap_psa_ptr->ipsa_flags; 4897 if ((oipsapp->ipsap_psa_ptr->ipsa_state == IPSA_STATE_DEAD) || 4898 (oipsapp->ipsap_psa_ptr->ipsa_state == IPSA_STATE_DYING)) { 4899 /* Its dead Jim! */ 4900 *diagnostic = SADB_X_DIAGNOSTIC_PAIR_INAPPROPRIATE; 4901 undo_pair = B_TRUE; 4902 } else if ((ipsa_flags & (IPSA_F_OUTBOUND | IPSA_F_INBOUND)) == 4903 (IPSA_F_OUTBOUND | IPSA_F_INBOUND)) { 4904 /* This SA is in both hashtables. */ 4905 *diagnostic = SADB_X_DIAGNOSTIC_PAIR_INAPPROPRIATE; 4906 undo_pair = B_TRUE; 4907 } else if (ipsa_flags & IPSA_F_PAIRED) { 4908 /* This SA is already paired with another. */ 4909 *diagnostic = SADB_X_DIAGNOSTIC_PAIR_ALREADY; 4910 undo_pair = B_TRUE; 4911 } 4912 } 4913 4914 if (undo_pair) { 4915 /* The pair SA does not exist. */ 4916 mutex_enter(&ipsapp->ipsap_sa_ptr->ipsa_lock); 4917 ipsapp->ipsap_sa_ptr->ipsa_flags &= ~IPSA_F_PAIRED; 4918 ipsapp->ipsap_sa_ptr->ipsa_otherspi = 0; 4919 mutex_exit(&ipsapp->ipsap_sa_ptr->ipsa_lock); 4920 error = EINVAL; 4921 } else { 4922 mutex_enter(&oipsapp->ipsap_psa_ptr->ipsa_lock); 4923 oipsapp->ipsap_psa_ptr->ipsa_otherspi = assoc->sadb_sa_spi; 4924 oipsapp->ipsap_psa_ptr->ipsa_flags |= IPSA_F_PAIRED; 4925 mutex_exit(&oipsapp->ipsap_psa_ptr->ipsa_lock); 4926 } 4927 4928 destroy_ipsa_pair(oipsapp); 4929 return (error); 4930 } 4931 4932 /* 4933 * The following functions deal with ACQUIRE LISTS. An ACQUIRE list is 4934 * a list of outstanding SADB_ACQUIRE messages. If ipsec_getassocbyconn() fails 4935 * for an outbound datagram, that datagram is queued up on an ACQUIRE record, 4936 * and an SADB_ACQUIRE message is sent up. Presumably, a user-space key 4937 * management daemon will process the ACQUIRE, use a SADB_GETSPI to reserve 4938 * an SPI value and a larval SA, then SADB_UPDATE the larval SA, and ADD the 4939 * other direction's SA. 4940 */ 4941 4942 /* 4943 * Check the ACQUIRE lists. If there's an existing ACQUIRE record, 4944 * grab it, lock it, and return it. Otherwise return NULL. 4945 */ 4946 static ipsacq_t * 4947 sadb_checkacquire(iacqf_t *bucket, ipsec_action_t *ap, ipsec_policy_t *pp, 4948 uint32_t *src, uint32_t *dst, uint32_t *isrc, uint32_t *idst, 4949 uint64_t unique_id) 4950 { 4951 ipsacq_t *walker; 4952 sa_family_t fam; 4953 uint32_t blank_address[4] = {0, 0, 0, 0}; 4954 4955 if (isrc == NULL) { 4956 ASSERT(idst == NULL); 4957 isrc = idst = blank_address; 4958 } 4959 4960 /* 4961 * Scan list for duplicates. Check for UNIQUE, src/dest, policy. 4962 * 4963 * XXX May need search for duplicates based on other things too! 4964 */ 4965 for (walker = bucket->iacqf_ipsacq; walker != NULL; 4966 walker = walker->ipsacq_next) { 4967 mutex_enter(&walker->ipsacq_lock); 4968 fam = walker->ipsacq_addrfam; 4969 if (IPSA_ARE_ADDR_EQUAL(dst, walker->ipsacq_dstaddr, fam) && 4970 IPSA_ARE_ADDR_EQUAL(src, walker->ipsacq_srcaddr, fam) && 4971 ip_addr_match((uint8_t *)isrc, walker->ipsacq_innersrcpfx, 4972 (in6_addr_t *)walker->ipsacq_innersrc) && 4973 ip_addr_match((uint8_t *)idst, walker->ipsacq_innerdstpfx, 4974 (in6_addr_t *)walker->ipsacq_innerdst) && 4975 (ap == walker->ipsacq_act) && 4976 (pp == walker->ipsacq_policy) && 4977 /* XXX do deep compares of ap/pp? */ 4978 (unique_id == walker->ipsacq_unique_id)) 4979 break; /* everything matched */ 4980 mutex_exit(&walker->ipsacq_lock); 4981 } 4982 4983 return (walker); 4984 } 4985 4986 /* 4987 * For this mblk, insert a new acquire record. Assume bucket contains addrs 4988 * of all of the same length. Give up (and drop) if memory 4989 * cannot be allocated for a new one; otherwise, invoke callback to 4990 * send the acquire up.. 4991 * 4992 * In cases where we need both AH and ESP, add the SA to the ESP ACQUIRE 4993 * list. The ah_add_sa_finish() routines can look at the packet's ipsec_out_t 4994 * and handle this case specially. 4995 */ 4996 void 4997 sadb_acquire(mblk_t *mp, ipsec_out_t *io, boolean_t need_ah, boolean_t need_esp) 4998 { 4999 sadbp_t *spp; 5000 sadb_t *sp; 5001 ipsacq_t *newbie; 5002 iacqf_t *bucket; 5003 mblk_t *datamp = mp->b_cont; 5004 mblk_t *extended; 5005 ipha_t *ipha = (ipha_t *)datamp->b_rptr; 5006 ip6_t *ip6h = (ip6_t *)datamp->b_rptr; 5007 uint32_t *src, *dst, *isrc, *idst; 5008 ipsec_policy_t *pp = io->ipsec_out_policy; 5009 ipsec_action_t *ap = io->ipsec_out_act; 5010 sa_family_t af; 5011 int hashoffset; 5012 uint32_t seq; 5013 uint64_t unique_id = 0; 5014 ipsec_selector_t sel; 5015 boolean_t tunnel_mode = io->ipsec_out_tunnel; 5016 netstack_t *ns = io->ipsec_out_ns; 5017 ipsec_stack_t *ipss = ns->netstack_ipsec; 5018 5019 ASSERT((pp != NULL) || (ap != NULL)); 5020 5021 ASSERT(need_ah != NULL || need_esp != NULL); 5022 /* Assign sadb pointers */ 5023 if (need_esp) { /* ESP for AH+ESP */ 5024 ipsecesp_stack_t *espstack = ns->netstack_ipsecesp; 5025 5026 spp = &espstack->esp_sadb; 5027 } else { 5028 ipsecah_stack_t *ahstack = ns->netstack_ipsecah; 5029 5030 spp = &ahstack->ah_sadb; 5031 } 5032 sp = io->ipsec_out_v4 ? &spp->s_v4 : &spp->s_v6; 5033 5034 if (ap == NULL) 5035 ap = pp->ipsp_act; 5036 5037 ASSERT(ap != NULL); 5038 5039 if (ap->ipa_act.ipa_apply.ipp_use_unique || tunnel_mode) 5040 unique_id = SA_FORM_UNIQUE_ID(io); 5041 5042 /* 5043 * Set up an ACQUIRE record. 5044 * 5045 * Immediately, make sure the ACQUIRE sequence number doesn't slip 5046 * below the lowest point allowed in the kernel. (In other words, 5047 * make sure the high bit on the sequence number is set.) 5048 */ 5049 5050 seq = keysock_next_seq(ns) | IACQF_LOWEST_SEQ; 5051 5052 if (IPH_HDR_VERSION(ipha) == IP_VERSION) { 5053 src = (uint32_t *)&ipha->ipha_src; 5054 dst = (uint32_t *)&ipha->ipha_dst; 5055 af = AF_INET; 5056 hashoffset = OUTBOUND_HASH_V4(sp, ipha->ipha_dst); 5057 ASSERT(io->ipsec_out_v4 == B_TRUE); 5058 } else { 5059 ASSERT(IPH_HDR_VERSION(ipha) == IPV6_VERSION); 5060 src = (uint32_t *)&ip6h->ip6_src; 5061 dst = (uint32_t *)&ip6h->ip6_dst; 5062 af = AF_INET6; 5063 hashoffset = OUTBOUND_HASH_V6(sp, ip6h->ip6_dst); 5064 ASSERT(io->ipsec_out_v4 == B_FALSE); 5065 } 5066 5067 if (tunnel_mode) { 5068 /* Snag inner addresses. */ 5069 isrc = io->ipsec_out_insrc; 5070 idst = io->ipsec_out_indst; 5071 } else { 5072 isrc = idst = NULL; 5073 } 5074 5075 /* 5076 * Check buckets to see if there is an existing entry. If so, 5077 * grab it. sadb_checkacquire locks newbie if found. 5078 */ 5079 bucket = &(sp->sdb_acq[hashoffset]); 5080 mutex_enter(&bucket->iacqf_lock); 5081 newbie = sadb_checkacquire(bucket, ap, pp, src, dst, isrc, idst, 5082 unique_id); 5083 5084 if (newbie == NULL) { 5085 /* 5086 * Otherwise, allocate a new one. 5087 */ 5088 newbie = kmem_zalloc(sizeof (*newbie), KM_NOSLEEP); 5089 if (newbie == NULL) { 5090 mutex_exit(&bucket->iacqf_lock); 5091 ip_drop_packet(mp, B_FALSE, NULL, NULL, 5092 DROPPER(ipss, ipds_sadb_acquire_nomem), 5093 &ipss->ipsec_sadb_dropper); 5094 return; 5095 } 5096 newbie->ipsacq_policy = pp; 5097 if (pp != NULL) { 5098 IPPOL_REFHOLD(pp); 5099 } 5100 IPACT_REFHOLD(ap); 5101 newbie->ipsacq_act = ap; 5102 newbie->ipsacq_linklock = &bucket->iacqf_lock; 5103 newbie->ipsacq_next = bucket->iacqf_ipsacq; 5104 newbie->ipsacq_ptpn = &bucket->iacqf_ipsacq; 5105 if (newbie->ipsacq_next != NULL) 5106 newbie->ipsacq_next->ipsacq_ptpn = &newbie->ipsacq_next; 5107 bucket->iacqf_ipsacq = newbie; 5108 mutex_init(&newbie->ipsacq_lock, NULL, MUTEX_DEFAULT, NULL); 5109 mutex_enter(&newbie->ipsacq_lock); 5110 } 5111 5112 mutex_exit(&bucket->iacqf_lock); 5113 5114 /* 5115 * This assert looks silly for now, but we may need to enter newbie's 5116 * mutex during a search. 5117 */ 5118 ASSERT(MUTEX_HELD(&newbie->ipsacq_lock)); 5119 5120 mp->b_next = NULL; 5121 /* Queue up packet. Use b_next. */ 5122 if (newbie->ipsacq_numpackets == 0) { 5123 /* First one. */ 5124 newbie->ipsacq_mp = mp; 5125 newbie->ipsacq_numpackets = 1; 5126 newbie->ipsacq_expire = gethrestime_sec(); 5127 /* 5128 * Extended ACQUIRE with both AH+ESP will use ESP's timeout 5129 * value. 5130 */ 5131 newbie->ipsacq_expire += *spp->s_acquire_timeout; 5132 newbie->ipsacq_seq = seq; 5133 newbie->ipsacq_addrfam = af; 5134 5135 newbie->ipsacq_srcport = io->ipsec_out_src_port; 5136 newbie->ipsacq_dstport = io->ipsec_out_dst_port; 5137 newbie->ipsacq_icmp_type = io->ipsec_out_icmp_type; 5138 newbie->ipsacq_icmp_code = io->ipsec_out_icmp_code; 5139 if (tunnel_mode) { 5140 newbie->ipsacq_inneraddrfam = io->ipsec_out_inaf; 5141 newbie->ipsacq_proto = io->ipsec_out_inaf == AF_INET6 ? 5142 IPPROTO_IPV6 : IPPROTO_ENCAP; 5143 newbie->ipsacq_innersrcpfx = io->ipsec_out_insrcpfx; 5144 newbie->ipsacq_innerdstpfx = io->ipsec_out_indstpfx; 5145 IPSA_COPY_ADDR(newbie->ipsacq_innersrc, 5146 io->ipsec_out_insrc, io->ipsec_out_inaf); 5147 IPSA_COPY_ADDR(newbie->ipsacq_innerdst, 5148 io->ipsec_out_indst, io->ipsec_out_inaf); 5149 } else { 5150 newbie->ipsacq_proto = io->ipsec_out_proto; 5151 } 5152 newbie->ipsacq_unique_id = unique_id; 5153 } else { 5154 /* Scan to the end of the list & insert. */ 5155 mblk_t *lastone = newbie->ipsacq_mp; 5156 5157 while (lastone->b_next != NULL) 5158 lastone = lastone->b_next; 5159 lastone->b_next = mp; 5160 if (newbie->ipsacq_numpackets++ == ipsacq_maxpackets) { 5161 newbie->ipsacq_numpackets = ipsacq_maxpackets; 5162 lastone = newbie->ipsacq_mp; 5163 newbie->ipsacq_mp = lastone->b_next; 5164 lastone->b_next = NULL; 5165 ip_drop_packet(lastone, B_FALSE, NULL, NULL, 5166 DROPPER(ipss, ipds_sadb_acquire_toofull), 5167 &ipss->ipsec_sadb_dropper); 5168 } else { 5169 IP_ACQUIRE_STAT(ipss, qhiwater, 5170 newbie->ipsacq_numpackets); 5171 } 5172 } 5173 5174 /* 5175 * Reset addresses. Set them to the most recently added mblk chain, 5176 * so that the address pointers in the acquire record will point 5177 * at an mblk still attached to the acquire list. 5178 */ 5179 5180 newbie->ipsacq_srcaddr = src; 5181 newbie->ipsacq_dstaddr = dst; 5182 5183 /* 5184 * If the acquire record has more than one queued packet, we've 5185 * already sent an ACQUIRE, and don't need to repeat ourself. 5186 */ 5187 if (newbie->ipsacq_seq != seq || newbie->ipsacq_numpackets > 1) { 5188 /* I have an acquire outstanding already! */ 5189 mutex_exit(&newbie->ipsacq_lock); 5190 return; 5191 } 5192 5193 if (keysock_extended_reg(ns)) { 5194 /* 5195 * Construct an extended ACQUIRE. There are logging 5196 * opportunities here in failure cases. 5197 */ 5198 5199 (void) memset(&sel, 0, sizeof (sel)); 5200 sel.ips_isv4 = io->ipsec_out_v4; 5201 if (tunnel_mode) { 5202 sel.ips_protocol = (io->ipsec_out_inaf == AF_INET) ? 5203 IPPROTO_ENCAP : IPPROTO_IPV6; 5204 } else { 5205 sel.ips_protocol = io->ipsec_out_proto; 5206 sel.ips_local_port = io->ipsec_out_src_port; 5207 sel.ips_remote_port = io->ipsec_out_dst_port; 5208 } 5209 sel.ips_icmp_type = io->ipsec_out_icmp_type; 5210 sel.ips_icmp_code = io->ipsec_out_icmp_code; 5211 sel.ips_is_icmp_inv_acq = 0; 5212 if (af == AF_INET) { 5213 sel.ips_local_addr_v4 = ipha->ipha_src; 5214 sel.ips_remote_addr_v4 = ipha->ipha_dst; 5215 } else { 5216 sel.ips_local_addr_v6 = ip6h->ip6_src; 5217 sel.ips_remote_addr_v6 = ip6h->ip6_dst; 5218 } 5219 5220 extended = sadb_keysock_out(0); 5221 if (extended != NULL) { 5222 extended->b_cont = sadb_extended_acquire(&sel, pp, ap, 5223 tunnel_mode, seq, 0, ns); 5224 if (extended->b_cont == NULL) { 5225 freeb(extended); 5226 extended = NULL; 5227 } 5228 } 5229 } else 5230 extended = NULL; 5231 5232 /* 5233 * Send an ACQUIRE message (and possible an extended ACQUIRE) based on 5234 * this new record. The send-acquire callback assumes that acqrec is 5235 * already locked. 5236 */ 5237 (*spp->s_acqfn)(newbie, extended, ns); 5238 } 5239 5240 /* 5241 * Unlink and free an acquire record. 5242 */ 5243 void 5244 sadb_destroy_acquire(ipsacq_t *acqrec, netstack_t *ns) 5245 { 5246 mblk_t *mp; 5247 ipsec_stack_t *ipss = ns->netstack_ipsec; 5248 5249 ASSERT(MUTEX_HELD(acqrec->ipsacq_linklock)); 5250 5251 if (acqrec->ipsacq_policy != NULL) { 5252 IPPOL_REFRELE(acqrec->ipsacq_policy, ns); 5253 } 5254 if (acqrec->ipsacq_act != NULL) { 5255 IPACT_REFRELE(acqrec->ipsacq_act); 5256 } 5257 5258 /* Unlink */ 5259 *(acqrec->ipsacq_ptpn) = acqrec->ipsacq_next; 5260 if (acqrec->ipsacq_next != NULL) 5261 acqrec->ipsacq_next->ipsacq_ptpn = acqrec->ipsacq_ptpn; 5262 5263 /* 5264 * Free hanging mp's. 5265 * 5266 * XXX Instead of freemsg(), perhaps use IPSEC_REQ_FAILED. 5267 */ 5268 5269 mutex_enter(&acqrec->ipsacq_lock); 5270 while (acqrec->ipsacq_mp != NULL) { 5271 mp = acqrec->ipsacq_mp; 5272 acqrec->ipsacq_mp = mp->b_next; 5273 mp->b_next = NULL; 5274 ip_drop_packet(mp, B_FALSE, NULL, NULL, 5275 DROPPER(ipss, ipds_sadb_acquire_timeout), 5276 &ipss->ipsec_sadb_dropper); 5277 } 5278 mutex_exit(&acqrec->ipsacq_lock); 5279 5280 /* Free */ 5281 mutex_destroy(&acqrec->ipsacq_lock); 5282 kmem_free(acqrec, sizeof (*acqrec)); 5283 } 5284 5285 /* 5286 * Destroy an acquire list fanout. 5287 */ 5288 static void 5289 sadb_destroy_acqlist(iacqf_t **listp, uint_t numentries, boolean_t forever, 5290 netstack_t *ns) 5291 { 5292 int i; 5293 iacqf_t *list = *listp; 5294 5295 if (list == NULL) 5296 return; 5297 5298 for (i = 0; i < numentries; i++) { 5299 mutex_enter(&(list[i].iacqf_lock)); 5300 while (list[i].iacqf_ipsacq != NULL) 5301 sadb_destroy_acquire(list[i].iacqf_ipsacq, ns); 5302 mutex_exit(&(list[i].iacqf_lock)); 5303 if (forever) 5304 mutex_destroy(&(list[i].iacqf_lock)); 5305 } 5306 5307 if (forever) { 5308 *listp = NULL; 5309 kmem_free(list, numentries * sizeof (*list)); 5310 } 5311 } 5312 5313 /* 5314 * Create an algorithm descriptor for an extended ACQUIRE. Filter crypto 5315 * framework's view of reality vs. IPsec's. EF's wins, BTW. 5316 */ 5317 static uint8_t * 5318 sadb_new_algdesc(uint8_t *start, uint8_t *limit, 5319 sadb_x_ecomb_t *ecomb, uint8_t satype, uint8_t algtype, 5320 uint8_t alg, uint16_t minbits, uint16_t maxbits, ipsec_stack_t *ipss) 5321 { 5322 uint8_t *cur = start; 5323 ipsec_alginfo_t *algp; 5324 sadb_x_algdesc_t *algdesc = (sadb_x_algdesc_t *)cur; 5325 5326 cur += sizeof (*algdesc); 5327 if (cur >= limit) 5328 return (NULL); 5329 5330 ecomb->sadb_x_ecomb_numalgs++; 5331 5332 /* 5333 * Normalize vs. crypto framework's limits. This way, you can specify 5334 * a stronger policy, and when the framework loads a stronger version, 5335 * you can just keep plowing w/o rewhacking your SPD. 5336 */ 5337 mutex_enter(&ipss->ipsec_alg_lock); 5338 algp = ipss->ipsec_alglists[(algtype == SADB_X_ALGTYPE_AUTH) ? 5339 IPSEC_ALG_AUTH : IPSEC_ALG_ENCR][alg]; 5340 if (algp == NULL) { 5341 mutex_exit(&ipss->ipsec_alg_lock); 5342 return (NULL); /* Algorithm doesn't exist. Fail gracefully. */ 5343 } 5344 if (minbits < algp->alg_ef_minbits) 5345 minbits = algp->alg_ef_minbits; 5346 if (maxbits > algp->alg_ef_maxbits) 5347 maxbits = algp->alg_ef_maxbits; 5348 mutex_exit(&ipss->ipsec_alg_lock); 5349 5350 algdesc->sadb_x_algdesc_satype = satype; 5351 algdesc->sadb_x_algdesc_algtype = algtype; 5352 algdesc->sadb_x_algdesc_alg = alg; 5353 algdesc->sadb_x_algdesc_minbits = minbits; 5354 algdesc->sadb_x_algdesc_maxbits = maxbits; 5355 algdesc->sadb_x_algdesc_reserved = 0; 5356 return (cur); 5357 } 5358 5359 /* 5360 * Convert the given ipsec_action_t into an ecomb starting at *ecomb 5361 * which must fit before *limit 5362 * 5363 * return NULL if we ran out of room or a pointer to the end of the ecomb. 5364 */ 5365 static uint8_t * 5366 sadb_action_to_ecomb(uint8_t *start, uint8_t *limit, ipsec_action_t *act, 5367 netstack_t *ns) 5368 { 5369 uint8_t *cur = start; 5370 sadb_x_ecomb_t *ecomb = (sadb_x_ecomb_t *)cur; 5371 ipsec_prot_t *ipp; 5372 ipsec_stack_t *ipss = ns->netstack_ipsec; 5373 5374 cur += sizeof (*ecomb); 5375 if (cur >= limit) 5376 return (NULL); 5377 5378 ASSERT(act->ipa_act.ipa_type == IPSEC_ACT_APPLY); 5379 5380 ipp = &act->ipa_act.ipa_apply; 5381 5382 ecomb->sadb_x_ecomb_numalgs = 0; 5383 ecomb->sadb_x_ecomb_reserved = 0; 5384 ecomb->sadb_x_ecomb_reserved2 = 0; 5385 /* 5386 * No limits on allocations, since we really don't support that 5387 * concept currently. 5388 */ 5389 ecomb->sadb_x_ecomb_soft_allocations = 0; 5390 ecomb->sadb_x_ecomb_hard_allocations = 0; 5391 5392 /* 5393 * XXX TBD: Policy or global parameters will eventually be 5394 * able to fill in some of these. 5395 */ 5396 ecomb->sadb_x_ecomb_flags = 0; 5397 ecomb->sadb_x_ecomb_soft_bytes = 0; 5398 ecomb->sadb_x_ecomb_hard_bytes = 0; 5399 ecomb->sadb_x_ecomb_soft_addtime = 0; 5400 ecomb->sadb_x_ecomb_hard_addtime = 0; 5401 ecomb->sadb_x_ecomb_soft_usetime = 0; 5402 ecomb->sadb_x_ecomb_hard_usetime = 0; 5403 5404 if (ipp->ipp_use_ah) { 5405 cur = sadb_new_algdesc(cur, limit, ecomb, 5406 SADB_SATYPE_AH, SADB_X_ALGTYPE_AUTH, ipp->ipp_auth_alg, 5407 ipp->ipp_ah_minbits, ipp->ipp_ah_maxbits, ipss); 5408 if (cur == NULL) 5409 return (NULL); 5410 ipsecah_fill_defs(ecomb, ns); 5411 } 5412 5413 if (ipp->ipp_use_esp) { 5414 if (ipp->ipp_use_espa) { 5415 cur = sadb_new_algdesc(cur, limit, ecomb, 5416 SADB_SATYPE_ESP, SADB_X_ALGTYPE_AUTH, 5417 ipp->ipp_esp_auth_alg, 5418 ipp->ipp_espa_minbits, 5419 ipp->ipp_espa_maxbits, ipss); 5420 if (cur == NULL) 5421 return (NULL); 5422 } 5423 5424 cur = sadb_new_algdesc(cur, limit, ecomb, 5425 SADB_SATYPE_ESP, SADB_X_ALGTYPE_CRYPT, 5426 ipp->ipp_encr_alg, 5427 ipp->ipp_espe_minbits, 5428 ipp->ipp_espe_maxbits, ipss); 5429 if (cur == NULL) 5430 return (NULL); 5431 /* Fill in lifetimes if and only if AH didn't already... */ 5432 if (!ipp->ipp_use_ah) 5433 ipsecesp_fill_defs(ecomb, ns); 5434 } 5435 5436 return (cur); 5437 } 5438 5439 /* 5440 * Construct an extended ACQUIRE message based on a selector and the resulting 5441 * IPsec action. 5442 * 5443 * NOTE: This is used by both inverse ACQUIRE and actual ACQUIRE 5444 * generation. As a consequence, expect this function to evolve 5445 * rapidly. 5446 */ 5447 static mblk_t * 5448 sadb_extended_acquire(ipsec_selector_t *sel, ipsec_policy_t *pol, 5449 ipsec_action_t *act, boolean_t tunnel_mode, uint32_t seq, uint32_t pid, 5450 netstack_t *ns) 5451 { 5452 mblk_t *mp; 5453 sadb_msg_t *samsg; 5454 uint8_t *start, *cur, *end; 5455 uint32_t *saddrptr, *daddrptr; 5456 sa_family_t af; 5457 sadb_prop_t *eprop; 5458 ipsec_action_t *ap, *an; 5459 ipsec_selkey_t *ipsl; 5460 uint8_t proto, pfxlen; 5461 uint16_t lport, rport; 5462 uint32_t kmp, kmc; 5463 5464 /* 5465 * Find the action we want sooner rather than later.. 5466 */ 5467 an = NULL; 5468 if (pol == NULL) { 5469 ap = act; 5470 } else { 5471 ap = pol->ipsp_act; 5472 5473 if (ap != NULL) 5474 an = ap->ipa_next; 5475 } 5476 5477 /* 5478 * Just take a swag for the allocation for now. We can always 5479 * alter it later. 5480 */ 5481 #define SADB_EXTENDED_ACQUIRE_SIZE 4096 5482 mp = allocb(SADB_EXTENDED_ACQUIRE_SIZE, BPRI_HI); 5483 if (mp == NULL) 5484 return (NULL); 5485 5486 start = mp->b_rptr; 5487 end = start + SADB_EXTENDED_ACQUIRE_SIZE; 5488 5489 cur = start; 5490 5491 samsg = (sadb_msg_t *)cur; 5492 cur += sizeof (*samsg); 5493 5494 samsg->sadb_msg_version = PF_KEY_V2; 5495 samsg->sadb_msg_type = SADB_ACQUIRE; 5496 samsg->sadb_msg_errno = 0; 5497 samsg->sadb_msg_reserved = 0; 5498 samsg->sadb_msg_satype = 0; 5499 samsg->sadb_msg_seq = seq; 5500 samsg->sadb_msg_pid = pid; 5501 5502 if (tunnel_mode) { 5503 /* 5504 * Form inner address extensions based NOT on the inner 5505 * selectors (i.e. the packet data), but on the policy's 5506 * selector key (i.e. the policy's selector information). 5507 * 5508 * NOTE: The position of IPv4 and IPv6 addresses is the 5509 * same in ipsec_selkey_t (unless the compiler does very 5510 * strange things with unions, consult your local C language 5511 * lawyer for details). 5512 */ 5513 ipsl = &(pol->ipsp_sel->ipsl_key); 5514 if (ipsl->ipsl_valid & IPSL_IPV4) { 5515 af = AF_INET; 5516 ASSERT(sel->ips_protocol == IPPROTO_ENCAP); 5517 ASSERT(!(ipsl->ipsl_valid & IPSL_IPV6)); 5518 } else { 5519 af = AF_INET6; 5520 ASSERT(sel->ips_protocol == IPPROTO_IPV6); 5521 ASSERT(ipsl->ipsl_valid & IPSL_IPV6); 5522 } 5523 5524 if (ipsl->ipsl_valid & IPSL_LOCAL_ADDR) { 5525 saddrptr = (uint32_t *)(&ipsl->ipsl_local); 5526 pfxlen = ipsl->ipsl_local_pfxlen; 5527 } else { 5528 saddrptr = (uint32_t *)(&ipv6_all_zeros); 5529 pfxlen = 0; 5530 } 5531 /* XXX What about ICMP type/code? */ 5532 lport = (ipsl->ipsl_valid & IPSL_LOCAL_PORT) ? 5533 ipsl->ipsl_lport : 0; 5534 proto = (ipsl->ipsl_valid & IPSL_PROTOCOL) ? 5535 ipsl->ipsl_proto : 0; 5536 5537 cur = sadb_make_addr_ext(cur, end, SADB_X_EXT_ADDRESS_INNER_SRC, 5538 af, saddrptr, lport, proto, pfxlen); 5539 if (cur == NULL) { 5540 freeb(mp); 5541 return (NULL); 5542 } 5543 5544 if (ipsl->ipsl_valid & IPSL_REMOTE_ADDR) { 5545 daddrptr = (uint32_t *)(&ipsl->ipsl_remote); 5546 pfxlen = ipsl->ipsl_remote_pfxlen; 5547 } else { 5548 daddrptr = (uint32_t *)(&ipv6_all_zeros); 5549 pfxlen = 0; 5550 } 5551 /* XXX What about ICMP type/code? */ 5552 rport = (ipsl->ipsl_valid & IPSL_REMOTE_PORT) ? 5553 ipsl->ipsl_rport : 0; 5554 5555 cur = sadb_make_addr_ext(cur, end, SADB_X_EXT_ADDRESS_INNER_DST, 5556 af, daddrptr, rport, proto, pfxlen); 5557 if (cur == NULL) { 5558 freeb(mp); 5559 return (NULL); 5560 } 5561 /* 5562 * TODO - if we go to 3408's dream of transport mode IP-in-IP 5563 * _with_ inner-packet address selectors, we'll need to further 5564 * distinguish tunnel mode here. For now, having inner 5565 * addresses and/or ports is sufficient. 5566 * 5567 * Meanwhile, whack proto/ports to reflect IP-in-IP for the 5568 * outer addresses. 5569 */ 5570 proto = sel->ips_protocol; /* Either _ENCAP or _IPV6 */ 5571 lport = rport = 0; 5572 } else if ((ap != NULL) && (!ap->ipa_want_unique)) { 5573 proto = 0; 5574 lport = 0; 5575 rport = 0; 5576 if (pol != NULL) { 5577 ipsl = &(pol->ipsp_sel->ipsl_key); 5578 if (ipsl->ipsl_valid & IPSL_PROTOCOL) 5579 proto = ipsl->ipsl_proto; 5580 if (ipsl->ipsl_valid & IPSL_REMOTE_PORT) 5581 rport = ipsl->ipsl_rport; 5582 if (ipsl->ipsl_valid & IPSL_LOCAL_PORT) 5583 lport = ipsl->ipsl_lport; 5584 } 5585 } else { 5586 proto = sel->ips_protocol; 5587 lport = sel->ips_local_port; 5588 rport = sel->ips_remote_port; 5589 } 5590 5591 af = sel->ips_isv4 ? AF_INET : AF_INET6; 5592 5593 /* 5594 * NOTE: The position of IPv4 and IPv6 addresses is the same in 5595 * ipsec_selector_t. 5596 */ 5597 cur = sadb_make_addr_ext(cur, end, SADB_EXT_ADDRESS_SRC, af, 5598 (uint32_t *)(&sel->ips_local_addr_v6), lport, proto, 0); 5599 5600 if (cur == NULL) { 5601 freeb(mp); 5602 return (NULL); 5603 } 5604 5605 cur = sadb_make_addr_ext(cur, end, SADB_EXT_ADDRESS_DST, af, 5606 (uint32_t *)(&sel->ips_remote_addr_v6), rport, proto, 0); 5607 5608 if (cur == NULL) { 5609 freeb(mp); 5610 return (NULL); 5611 } 5612 5613 /* 5614 * This section will change a lot as policy evolves. 5615 * For now, it'll be relatively simple. 5616 */ 5617 eprop = (sadb_prop_t *)cur; 5618 cur += sizeof (*eprop); 5619 if (cur > end) { 5620 /* no space left */ 5621 freeb(mp); 5622 return (NULL); 5623 } 5624 5625 eprop->sadb_prop_exttype = SADB_X_EXT_EPROP; 5626 eprop->sadb_x_prop_ereserved = 0; 5627 eprop->sadb_x_prop_numecombs = 0; 5628 eprop->sadb_prop_replay = 32; /* default */ 5629 5630 kmc = kmp = 0; 5631 5632 for (; ap != NULL; ap = an) { 5633 an = (pol != NULL) ? ap->ipa_next : NULL; 5634 5635 /* 5636 * Skip non-IPsec policies 5637 */ 5638 if (ap->ipa_act.ipa_type != IPSEC_ACT_APPLY) 5639 continue; 5640 5641 if (ap->ipa_act.ipa_apply.ipp_km_proto) 5642 kmp = ap->ipa_act.ipa_apply.ipp_km_proto; 5643 if (ap->ipa_act.ipa_apply.ipp_km_cookie) 5644 kmc = ap->ipa_act.ipa_apply.ipp_km_cookie; 5645 if (ap->ipa_act.ipa_apply.ipp_replay_depth) { 5646 eprop->sadb_prop_replay = 5647 ap->ipa_act.ipa_apply.ipp_replay_depth; 5648 } 5649 5650 cur = sadb_action_to_ecomb(cur, end, ap, ns); 5651 if (cur == NULL) { /* no space */ 5652 freeb(mp); 5653 return (NULL); 5654 } 5655 eprop->sadb_x_prop_numecombs++; 5656 } 5657 5658 if (eprop->sadb_x_prop_numecombs == 0) { 5659 /* 5660 * This will happen if we fail to find a policy 5661 * allowing for IPsec processing. 5662 * Construct an error message. 5663 */ 5664 samsg->sadb_msg_len = SADB_8TO64(sizeof (*samsg)); 5665 samsg->sadb_msg_errno = ENOENT; 5666 samsg->sadb_x_msg_diagnostic = 0; 5667 return (mp); 5668 } 5669 5670 if ((kmp != 0) || (kmc != 0)) { 5671 cur = sadb_make_kmc_ext(cur, end, kmp, kmc); 5672 if (cur == NULL) { 5673 freeb(mp); 5674 return (NULL); 5675 } 5676 } 5677 5678 eprop->sadb_prop_len = SADB_8TO64(cur - (uint8_t *)eprop); 5679 samsg->sadb_msg_len = SADB_8TO64(cur - start); 5680 mp->b_wptr = cur; 5681 5682 return (mp); 5683 } 5684 5685 /* 5686 * Generic setup of an RFC 2367 ACQUIRE message. Caller sets satype. 5687 * 5688 * NOTE: This function acquires alg_lock as a side-effect if-and-only-if we 5689 * succeed (i.e. return non-NULL). Caller MUST release it. This is to 5690 * maximize code consolidation while preventing algorithm changes from messing 5691 * with the callers finishing touches on the ACQUIRE itself. 5692 */ 5693 mblk_t * 5694 sadb_setup_acquire(ipsacq_t *acqrec, uint8_t satype, ipsec_stack_t *ipss) 5695 { 5696 uint_t allocsize; 5697 mblk_t *pfkeymp, *msgmp; 5698 sa_family_t af; 5699 uint8_t *cur, *end; 5700 sadb_msg_t *samsg; 5701 uint16_t sport_typecode; 5702 uint16_t dport_typecode; 5703 uint8_t check_proto; 5704 boolean_t tunnel_mode = (acqrec->ipsacq_inneraddrfam != 0); 5705 5706 ASSERT(MUTEX_HELD(&acqrec->ipsacq_lock)); 5707 5708 pfkeymp = sadb_keysock_out(0); 5709 if (pfkeymp == NULL) 5710 return (NULL); 5711 5712 /* 5713 * First, allocate a basic ACQUIRE message 5714 */ 5715 allocsize = sizeof (sadb_msg_t) + sizeof (sadb_address_t) + 5716 sizeof (sadb_address_t) + sizeof (sadb_prop_t); 5717 5718 /* Make sure there's enough to cover both AF_INET and AF_INET6. */ 5719 allocsize += 2 * sizeof (struct sockaddr_in6); 5720 5721 mutex_enter(&ipss->ipsec_alg_lock); 5722 /* NOTE: The lock is now held through to this function's return. */ 5723 allocsize += ipss->ipsec_nalgs[IPSEC_ALG_AUTH] * 5724 ipss->ipsec_nalgs[IPSEC_ALG_ENCR] * sizeof (sadb_comb_t); 5725 5726 if (tunnel_mode) { 5727 /* Tunnel mode! */ 5728 allocsize += 2 * sizeof (sadb_address_t); 5729 /* Enough to cover both AF_INET and AF_INET6. */ 5730 allocsize += 2 * sizeof (struct sockaddr_in6); 5731 } 5732 5733 msgmp = allocb(allocsize, BPRI_HI); 5734 if (msgmp == NULL) { 5735 freeb(pfkeymp); 5736 mutex_exit(&ipss->ipsec_alg_lock); 5737 return (NULL); 5738 } 5739 5740 pfkeymp->b_cont = msgmp; 5741 cur = msgmp->b_rptr; 5742 end = cur + allocsize; 5743 samsg = (sadb_msg_t *)cur; 5744 cur += sizeof (sadb_msg_t); 5745 5746 af = acqrec->ipsacq_addrfam; 5747 switch (af) { 5748 case AF_INET: 5749 check_proto = IPPROTO_ICMP; 5750 break; 5751 case AF_INET6: 5752 check_proto = IPPROTO_ICMPV6; 5753 break; 5754 default: 5755 /* This should never happen unless we have kernel bugs. */ 5756 cmn_err(CE_WARN, 5757 "sadb_setup_acquire: corrupt ACQUIRE record.\n"); 5758 ASSERT(0); 5759 mutex_exit(&ipss->ipsec_alg_lock); 5760 return (NULL); 5761 } 5762 5763 samsg->sadb_msg_version = PF_KEY_V2; 5764 samsg->sadb_msg_type = SADB_ACQUIRE; 5765 samsg->sadb_msg_satype = satype; 5766 samsg->sadb_msg_errno = 0; 5767 samsg->sadb_msg_pid = 0; 5768 samsg->sadb_msg_reserved = 0; 5769 samsg->sadb_msg_seq = acqrec->ipsacq_seq; 5770 5771 ASSERT(MUTEX_HELD(&acqrec->ipsacq_lock)); 5772 5773 if ((acqrec->ipsacq_proto == check_proto) || tunnel_mode) { 5774 sport_typecode = dport_typecode = 0; 5775 } else { 5776 sport_typecode = acqrec->ipsacq_srcport; 5777 dport_typecode = acqrec->ipsacq_dstport; 5778 } 5779 5780 cur = sadb_make_addr_ext(cur, end, SADB_EXT_ADDRESS_SRC, af, 5781 acqrec->ipsacq_srcaddr, sport_typecode, acqrec->ipsacq_proto, 0); 5782 5783 cur = sadb_make_addr_ext(cur, end, SADB_EXT_ADDRESS_DST, af, 5784 acqrec->ipsacq_dstaddr, dport_typecode, acqrec->ipsacq_proto, 0); 5785 5786 if (tunnel_mode) { 5787 sport_typecode = acqrec->ipsacq_srcport; 5788 dport_typecode = acqrec->ipsacq_dstport; 5789 cur = sadb_make_addr_ext(cur, end, SADB_X_EXT_ADDRESS_INNER_SRC, 5790 acqrec->ipsacq_inneraddrfam, acqrec->ipsacq_innersrc, 5791 sport_typecode, acqrec->ipsacq_inner_proto, 5792 acqrec->ipsacq_innersrcpfx); 5793 cur = sadb_make_addr_ext(cur, end, SADB_X_EXT_ADDRESS_INNER_DST, 5794 acqrec->ipsacq_inneraddrfam, acqrec->ipsacq_innerdst, 5795 dport_typecode, acqrec->ipsacq_inner_proto, 5796 acqrec->ipsacq_innerdstpfx); 5797 } 5798 5799 /* XXX Insert identity information here. */ 5800 5801 /* XXXMLS Insert sensitivity information here. */ 5802 5803 if (cur != NULL) 5804 samsg->sadb_msg_len = SADB_8TO64(cur - msgmp->b_rptr); 5805 else 5806 mutex_exit(&ipss->ipsec_alg_lock); 5807 5808 return (pfkeymp); 5809 } 5810 5811 /* 5812 * Given an SADB_GETSPI message, find an appropriately ranged SA and 5813 * allocate an SA. If there are message improprieties, return (ipsa_t *)-1. 5814 * If there was a memory allocation error, return NULL. (Assume NULL != 5815 * (ipsa_t *)-1). 5816 * 5817 * master_spi is passed in host order. 5818 */ 5819 ipsa_t * 5820 sadb_getspi(keysock_in_t *ksi, uint32_t master_spi, int *diagnostic, 5821 netstack_t *ns, uint_t sa_type) 5822 { 5823 sadb_address_t *src = 5824 (sadb_address_t *)ksi->ks_in_extv[SADB_EXT_ADDRESS_SRC], 5825 *dst = (sadb_address_t *)ksi->ks_in_extv[SADB_EXT_ADDRESS_DST]; 5826 sadb_spirange_t *range = 5827 (sadb_spirange_t *)ksi->ks_in_extv[SADB_EXT_SPIRANGE]; 5828 struct sockaddr_in *ssa, *dsa; 5829 struct sockaddr_in6 *ssa6, *dsa6; 5830 uint32_t *srcaddr, *dstaddr; 5831 sa_family_t af; 5832 uint32_t add, min, max; 5833 uint8_t protocol = 5834 (sa_type == SADB_SATYPE_AH) ? IPPROTO_AH : IPPROTO_ESP; 5835 5836 if (src == NULL) { 5837 *diagnostic = SADB_X_DIAGNOSTIC_MISSING_SRC; 5838 return ((ipsa_t *)-1); 5839 } 5840 if (dst == NULL) { 5841 *diagnostic = SADB_X_DIAGNOSTIC_MISSING_DST; 5842 return ((ipsa_t *)-1); 5843 } 5844 if (range == NULL) { 5845 *diagnostic = SADB_X_DIAGNOSTIC_MISSING_RANGE; 5846 return ((ipsa_t *)-1); 5847 } 5848 5849 min = ntohl(range->sadb_spirange_min); 5850 max = ntohl(range->sadb_spirange_max); 5851 dsa = (struct sockaddr_in *)(dst + 1); 5852 dsa6 = (struct sockaddr_in6 *)dsa; 5853 5854 ssa = (struct sockaddr_in *)(src + 1); 5855 ssa6 = (struct sockaddr_in6 *)ssa; 5856 ASSERT(dsa->sin_family == ssa->sin_family); 5857 5858 srcaddr = ALL_ZEROES_PTR; 5859 af = dsa->sin_family; 5860 switch (af) { 5861 case AF_INET: 5862 if (src != NULL) 5863 srcaddr = (uint32_t *)(&ssa->sin_addr); 5864 dstaddr = (uint32_t *)(&dsa->sin_addr); 5865 break; 5866 case AF_INET6: 5867 if (src != NULL) 5868 srcaddr = (uint32_t *)(&ssa6->sin6_addr); 5869 dstaddr = (uint32_t *)(&dsa6->sin6_addr); 5870 break; 5871 default: 5872 *diagnostic = SADB_X_DIAGNOSTIC_BAD_DST_AF; 5873 return ((ipsa_t *)-1); 5874 } 5875 5876 if (master_spi < min || master_spi > max) { 5877 /* Return a random value in the range. */ 5878 if (cl_inet_getspi) { 5879 cl_inet_getspi(ns->netstack_stackid, protocol, 5880 (uint8_t *)&add, sizeof (add), NULL); 5881 } else { 5882 (void) random_get_pseudo_bytes((uint8_t *)&add, 5883 sizeof (add)); 5884 } 5885 master_spi = min + (add % (max - min + 1)); 5886 } 5887 5888 /* 5889 * Since master_spi is passed in host order, we need to htonl() it 5890 * for the purposes of creating a new SA. 5891 */ 5892 return (sadb_makelarvalassoc(htonl(master_spi), srcaddr, dstaddr, af, 5893 ns)); 5894 } 5895 5896 /* 5897 * 5898 * Locate an ACQUIRE and nuke it. If I have an samsg that's larger than the 5899 * base header, just ignore it. Otherwise, lock down the whole ACQUIRE list 5900 * and scan for the sequence number in question. I may wish to accept an 5901 * address pair with it, for easier searching. 5902 * 5903 * Caller frees the message, so we don't have to here. 5904 * 5905 * NOTE: The ip_q parameter may be used in the future for ACQUIRE 5906 * failures. 5907 */ 5908 /* ARGSUSED */ 5909 void 5910 sadb_in_acquire(sadb_msg_t *samsg, sadbp_t *sp, queue_t *ip_q, netstack_t *ns) 5911 { 5912 int i; 5913 ipsacq_t *acqrec; 5914 iacqf_t *bucket; 5915 5916 /* 5917 * I only accept the base header for this! 5918 * Though to be honest, requiring the dst address would help 5919 * immensely. 5920 * 5921 * XXX There are already cases where I can get the dst address. 5922 */ 5923 if (samsg->sadb_msg_len > SADB_8TO64(sizeof (*samsg))) 5924 return; 5925 5926 /* 5927 * Using the samsg->sadb_msg_seq, find the ACQUIRE record, delete it, 5928 * (and in the future send a message to IP with the appropriate error 5929 * number). 5930 * 5931 * Q: Do I want to reject if pid != 0? 5932 */ 5933 5934 for (i = 0; i < sp->s_v4.sdb_hashsize; i++) { 5935 bucket = &sp->s_v4.sdb_acq[i]; 5936 mutex_enter(&bucket->iacqf_lock); 5937 for (acqrec = bucket->iacqf_ipsacq; acqrec != NULL; 5938 acqrec = acqrec->ipsacq_next) { 5939 if (samsg->sadb_msg_seq == acqrec->ipsacq_seq) 5940 break; /* for acqrec... loop. */ 5941 } 5942 if (acqrec != NULL) 5943 break; /* for i = 0... loop. */ 5944 5945 mutex_exit(&bucket->iacqf_lock); 5946 } 5947 5948 if (acqrec == NULL) { 5949 for (i = 0; i < sp->s_v6.sdb_hashsize; i++) { 5950 bucket = &sp->s_v6.sdb_acq[i]; 5951 mutex_enter(&bucket->iacqf_lock); 5952 for (acqrec = bucket->iacqf_ipsacq; acqrec != NULL; 5953 acqrec = acqrec->ipsacq_next) { 5954 if (samsg->sadb_msg_seq == acqrec->ipsacq_seq) 5955 break; /* for acqrec... loop. */ 5956 } 5957 if (acqrec != NULL) 5958 break; /* for i = 0... loop. */ 5959 5960 mutex_exit(&bucket->iacqf_lock); 5961 } 5962 } 5963 5964 5965 if (acqrec == NULL) 5966 return; 5967 5968 /* 5969 * What do I do with the errno and IP? I may need mp's services a 5970 * little more. See sadb_destroy_acquire() for future directions 5971 * beyond free the mblk chain on the acquire record. 5972 */ 5973 5974 ASSERT(&bucket->iacqf_lock == acqrec->ipsacq_linklock); 5975 sadb_destroy_acquire(acqrec, ns); 5976 /* Have to exit mutex here, because of breaking out of for loop. */ 5977 mutex_exit(&bucket->iacqf_lock); 5978 } 5979 5980 /* 5981 * The following functions work with the replay windows of an SA. They assume 5982 * the ipsa->ipsa_replay_arr is an array of uint64_t, and that the bit vector 5983 * represents the highest sequence number packet received, and back 5984 * (ipsa->ipsa_replay_wsize) packets. 5985 */ 5986 5987 /* 5988 * Is the replay bit set? 5989 */ 5990 static boolean_t 5991 ipsa_is_replay_set(ipsa_t *ipsa, uint32_t offset) 5992 { 5993 uint64_t bit = (uint64_t)1 << (uint64_t)(offset & 63); 5994 5995 return ((bit & ipsa->ipsa_replay_arr[offset >> 6]) ? B_TRUE : B_FALSE); 5996 } 5997 5998 /* 5999 * Shift the bits of the replay window over. 6000 */ 6001 static void 6002 ipsa_shift_replay(ipsa_t *ipsa, uint32_t shift) 6003 { 6004 int i; 6005 int jump = ((shift - 1) >> 6) + 1; 6006 6007 if (shift == 0) 6008 return; 6009 6010 for (i = (ipsa->ipsa_replay_wsize - 1) >> 6; i >= 0; i--) { 6011 if (i + jump <= (ipsa->ipsa_replay_wsize - 1) >> 6) { 6012 ipsa->ipsa_replay_arr[i + jump] |= 6013 ipsa->ipsa_replay_arr[i] >> (64 - (shift & 63)); 6014 } 6015 ipsa->ipsa_replay_arr[i] <<= shift; 6016 } 6017 } 6018 6019 /* 6020 * Set a bit in the bit vector. 6021 */ 6022 static void 6023 ipsa_set_replay(ipsa_t *ipsa, uint32_t offset) 6024 { 6025 uint64_t bit = (uint64_t)1 << (uint64_t)(offset & 63); 6026 6027 ipsa->ipsa_replay_arr[offset >> 6] |= bit; 6028 } 6029 6030 #define SADB_MAX_REPLAY_VALUE 0xffffffff 6031 6032 /* 6033 * Assume caller has NOT done ntohl() already on seq. Check to see 6034 * if replay sequence number "seq" has been seen already. 6035 */ 6036 boolean_t 6037 sadb_replay_check(ipsa_t *ipsa, uint32_t seq) 6038 { 6039 boolean_t rc; 6040 uint32_t diff; 6041 6042 if (ipsa->ipsa_replay_wsize == 0) 6043 return (B_TRUE); 6044 6045 /* 6046 * NOTE: I've already checked for 0 on the wire in sadb_replay_peek(). 6047 */ 6048 6049 /* Convert sequence number into host order before holding the mutex. */ 6050 seq = ntohl(seq); 6051 6052 mutex_enter(&ipsa->ipsa_lock); 6053 6054 /* Initialize inbound SA's ipsa_replay field to last one received. */ 6055 if (ipsa->ipsa_replay == 0) 6056 ipsa->ipsa_replay = 1; 6057 6058 if (seq > ipsa->ipsa_replay) { 6059 /* 6060 * I have received a new "highest value received". Shift 6061 * the replay window over. 6062 */ 6063 diff = seq - ipsa->ipsa_replay; 6064 if (diff < ipsa->ipsa_replay_wsize) { 6065 /* In replay window, shift bits over. */ 6066 ipsa_shift_replay(ipsa, diff); 6067 } else { 6068 /* WAY FAR AHEAD, clear bits and start again. */ 6069 bzero(ipsa->ipsa_replay_arr, 6070 sizeof (ipsa->ipsa_replay_arr)); 6071 } 6072 ipsa_set_replay(ipsa, 0); 6073 ipsa->ipsa_replay = seq; 6074 rc = B_TRUE; 6075 goto done; 6076 } 6077 diff = ipsa->ipsa_replay - seq; 6078 if (diff >= ipsa->ipsa_replay_wsize || ipsa_is_replay_set(ipsa, diff)) { 6079 rc = B_FALSE; 6080 goto done; 6081 } 6082 /* Set this packet as seen. */ 6083 ipsa_set_replay(ipsa, diff); 6084 6085 rc = B_TRUE; 6086 done: 6087 mutex_exit(&ipsa->ipsa_lock); 6088 return (rc); 6089 } 6090 6091 /* 6092 * "Peek" and see if we should even bother going through the effort of 6093 * running an authentication check on the sequence number passed in. 6094 * this takes into account packets that are below the replay window, 6095 * and collisions with already replayed packets. Return B_TRUE if it 6096 * is okay to proceed, B_FALSE if this packet should be dropped immediately. 6097 * Assume same byte-ordering as sadb_replay_check. 6098 */ 6099 boolean_t 6100 sadb_replay_peek(ipsa_t *ipsa, uint32_t seq) 6101 { 6102 boolean_t rc = B_FALSE; 6103 uint32_t diff; 6104 6105 if (ipsa->ipsa_replay_wsize == 0) 6106 return (B_TRUE); 6107 6108 /* 6109 * 0 is 0, regardless of byte order... :) 6110 * 6111 * If I get 0 on the wire (and there is a replay window) then the 6112 * sender most likely wrapped. This ipsa may need to be marked or 6113 * something. 6114 */ 6115 if (seq == 0) 6116 return (B_FALSE); 6117 6118 seq = ntohl(seq); 6119 mutex_enter(&ipsa->ipsa_lock); 6120 if (seq < ipsa->ipsa_replay - ipsa->ipsa_replay_wsize && 6121 ipsa->ipsa_replay >= ipsa->ipsa_replay_wsize) 6122 goto done; 6123 6124 /* 6125 * If I've hit 0xffffffff, then quite honestly, I don't need to 6126 * bother with formalities. I'm not accepting any more packets 6127 * on this SA. 6128 */ 6129 if (ipsa->ipsa_replay == SADB_MAX_REPLAY_VALUE) { 6130 /* 6131 * Since we're already holding the lock, update the 6132 * expire time ala. sadb_replay_delete() and return. 6133 */ 6134 ipsa->ipsa_hardexpiretime = (time_t)1; 6135 goto done; 6136 } 6137 6138 if (seq <= ipsa->ipsa_replay) { 6139 /* 6140 * This seq is in the replay window. I'm not below it, 6141 * because I already checked for that above! 6142 */ 6143 diff = ipsa->ipsa_replay - seq; 6144 if (ipsa_is_replay_set(ipsa, diff)) 6145 goto done; 6146 } 6147 /* Else return B_TRUE, I'm going to advance the window. */ 6148 6149 rc = B_TRUE; 6150 done: 6151 mutex_exit(&ipsa->ipsa_lock); 6152 return (rc); 6153 } 6154 6155 /* 6156 * Delete a single SA. 6157 * 6158 * For now, use the quick-and-dirty trick of making the association's 6159 * hard-expire lifetime (time_t)1, ensuring deletion by the *_ager(). 6160 */ 6161 void 6162 sadb_replay_delete(ipsa_t *assoc) 6163 { 6164 mutex_enter(&assoc->ipsa_lock); 6165 assoc->ipsa_hardexpiretime = (time_t)1; 6166 mutex_exit(&assoc->ipsa_lock); 6167 } 6168 6169 /* 6170 * Given a queue that presumably points to IP, send a T_BIND_REQ for _proto_ 6171 * down. The caller will handle the T_BIND_ACK locally. 6172 */ 6173 boolean_t 6174 sadb_t_bind_req(queue_t *q, int proto) 6175 { 6176 struct T_bind_req *tbr; 6177 mblk_t *mp; 6178 6179 mp = allocb_cred(sizeof (struct T_bind_req) + 1, kcred, NOPID); 6180 if (mp == NULL) { 6181 /* cmn_err(CE_WARN, */ 6182 /* "sadb_t_bind_req(%d): couldn't allocate mblk\n", proto); */ 6183 return (B_FALSE); 6184 } 6185 mp->b_datap->db_type = M_PCPROTO; 6186 tbr = (struct T_bind_req *)mp->b_rptr; 6187 mp->b_wptr += sizeof (struct T_bind_req); 6188 tbr->PRIM_type = T_BIND_REQ; 6189 tbr->ADDR_length = 0; 6190 tbr->ADDR_offset = 0; 6191 tbr->CONIND_number = 0; 6192 *mp->b_wptr = (uint8_t)proto; 6193 mp->b_wptr++; 6194 6195 putnext(q, mp); 6196 return (B_TRUE); 6197 } 6198 6199 /* 6200 * Special front-end to ipsec_rl_strlog() dealing with SA failure. 6201 * this is designed to take only a format string with "* %x * %s *", so 6202 * that "spi" is printed first, then "addr" is converted using inet_pton(). 6203 * 6204 * This is abstracted out to save the stack space for only when inet_pton() 6205 * is called. Make sure "spi" is in network order; it usually is when this 6206 * would get called. 6207 */ 6208 void 6209 ipsec_assocfailure(short mid, short sid, char level, ushort_t sl, char *fmt, 6210 uint32_t spi, void *addr, int af, netstack_t *ns) 6211 { 6212 char buf[INET6_ADDRSTRLEN]; 6213 6214 ASSERT(af == AF_INET6 || af == AF_INET); 6215 6216 ipsec_rl_strlog(ns, mid, sid, level, sl, fmt, ntohl(spi), 6217 inet_ntop(af, addr, buf, sizeof (buf))); 6218 } 6219 6220 /* 6221 * Fills in a reference to the policy, if any, from the conn, in *ppp 6222 * Releases a reference to the passed conn_t. 6223 */ 6224 static void 6225 ipsec_conn_pol(ipsec_selector_t *sel, conn_t *connp, ipsec_policy_t **ppp) 6226 { 6227 ipsec_policy_t *pp; 6228 ipsec_latch_t *ipl = connp->conn_latch; 6229 6230 if ((ipl != NULL) && (ipl->ipl_out_policy != NULL)) { 6231 pp = ipl->ipl_out_policy; 6232 IPPOL_REFHOLD(pp); 6233 } else { 6234 pp = ipsec_find_policy(IPSEC_TYPE_OUTBOUND, connp, NULL, sel, 6235 connp->conn_netstack); 6236 } 6237 *ppp = pp; 6238 CONN_DEC_REF(connp); 6239 } 6240 6241 /* 6242 * The following functions scan through active conn_t structures 6243 * and return a reference to the best-matching policy it can find. 6244 * Caller must release the reference. 6245 */ 6246 static void 6247 ipsec_udp_pol(ipsec_selector_t *sel, ipsec_policy_t **ppp, ip_stack_t *ipst) 6248 { 6249 connf_t *connfp; 6250 conn_t *connp = NULL; 6251 ipsec_selector_t portonly; 6252 6253 bzero((void *)&portonly, sizeof (portonly)); 6254 6255 if (sel->ips_local_port == 0) 6256 return; 6257 6258 connfp = &ipst->ips_ipcl_udp_fanout[IPCL_UDP_HASH(sel->ips_local_port, 6259 ipst)]; 6260 mutex_enter(&connfp->connf_lock); 6261 6262 if (sel->ips_isv4) { 6263 connp = connfp->connf_head; 6264 while (connp != NULL) { 6265 if (IPCL_UDP_MATCH(connp, sel->ips_local_port, 6266 sel->ips_local_addr_v4, sel->ips_remote_port, 6267 sel->ips_remote_addr_v4)) 6268 break; 6269 connp = connp->conn_next; 6270 } 6271 6272 if (connp == NULL) { 6273 /* Try port-only match in IPv6. */ 6274 portonly.ips_local_port = sel->ips_local_port; 6275 sel = &portonly; 6276 } 6277 } 6278 6279 if (connp == NULL) { 6280 connp = connfp->connf_head; 6281 while (connp != NULL) { 6282 if (IPCL_UDP_MATCH_V6(connp, sel->ips_local_port, 6283 sel->ips_local_addr_v6, sel->ips_remote_port, 6284 sel->ips_remote_addr_v6)) 6285 break; 6286 connp = connp->conn_next; 6287 } 6288 6289 if (connp == NULL) { 6290 mutex_exit(&connfp->connf_lock); 6291 return; 6292 } 6293 } 6294 6295 CONN_INC_REF(connp); 6296 mutex_exit(&connfp->connf_lock); 6297 6298 ipsec_conn_pol(sel, connp, ppp); 6299 } 6300 6301 static conn_t * 6302 ipsec_find_listen_conn(uint16_t *pptr, ipsec_selector_t *sel, ip_stack_t *ipst) 6303 { 6304 connf_t *connfp; 6305 conn_t *connp = NULL; 6306 const in6_addr_t *v6addrmatch = &sel->ips_local_addr_v6; 6307 6308 if (sel->ips_local_port == 0) 6309 return (NULL); 6310 6311 connfp = &ipst->ips_ipcl_bind_fanout[ 6312 IPCL_BIND_HASH(sel->ips_local_port, ipst)]; 6313 mutex_enter(&connfp->connf_lock); 6314 6315 if (sel->ips_isv4) { 6316 connp = connfp->connf_head; 6317 while (connp != NULL) { 6318 if (IPCL_BIND_MATCH(connp, IPPROTO_TCP, 6319 sel->ips_local_addr_v4, pptr[1])) 6320 break; 6321 connp = connp->conn_next; 6322 } 6323 6324 if (connp == NULL) { 6325 /* Match to all-zeroes. */ 6326 v6addrmatch = &ipv6_all_zeros; 6327 } 6328 } 6329 6330 if (connp == NULL) { 6331 connp = connfp->connf_head; 6332 while (connp != NULL) { 6333 if (IPCL_BIND_MATCH_V6(connp, IPPROTO_TCP, 6334 *v6addrmatch, pptr[1])) 6335 break; 6336 connp = connp->conn_next; 6337 } 6338 6339 if (connp == NULL) { 6340 mutex_exit(&connfp->connf_lock); 6341 return (NULL); 6342 } 6343 } 6344 6345 CONN_INC_REF(connp); 6346 mutex_exit(&connfp->connf_lock); 6347 return (connp); 6348 } 6349 6350 static void 6351 ipsec_tcp_pol(ipsec_selector_t *sel, ipsec_policy_t **ppp, ip_stack_t *ipst) 6352 { 6353 connf_t *connfp; 6354 conn_t *connp; 6355 uint32_t ports; 6356 uint16_t *pptr = (uint16_t *)&ports; 6357 6358 /* 6359 * Find TCP state in the following order: 6360 * 1.) Connected conns. 6361 * 2.) Listeners. 6362 * 6363 * Even though #2 will be the common case for inbound traffic, only 6364 * following this order insures correctness. 6365 */ 6366 6367 if (sel->ips_local_port == 0) 6368 return; 6369 6370 /* 6371 * 0 should be fport, 1 should be lport. SRC is the local one here. 6372 * See ipsec_construct_inverse_acquire() for details. 6373 */ 6374 pptr[0] = sel->ips_remote_port; 6375 pptr[1] = sel->ips_local_port; 6376 6377 connfp = &ipst->ips_ipcl_conn_fanout[ 6378 IPCL_CONN_HASH(sel->ips_remote_addr_v4, ports, ipst)]; 6379 mutex_enter(&connfp->connf_lock); 6380 connp = connfp->connf_head; 6381 6382 if (sel->ips_isv4) { 6383 while (connp != NULL) { 6384 if (IPCL_CONN_MATCH(connp, IPPROTO_TCP, 6385 sel->ips_remote_addr_v4, sel->ips_local_addr_v4, 6386 ports)) 6387 break; 6388 connp = connp->conn_next; 6389 } 6390 } else { 6391 while (connp != NULL) { 6392 if (IPCL_CONN_MATCH_V6(connp, IPPROTO_TCP, 6393 sel->ips_remote_addr_v6, sel->ips_local_addr_v6, 6394 ports)) 6395 break; 6396 connp = connp->conn_next; 6397 } 6398 } 6399 6400 if (connp != NULL) { 6401 CONN_INC_REF(connp); 6402 mutex_exit(&connfp->connf_lock); 6403 } else { 6404 mutex_exit(&connfp->connf_lock); 6405 6406 /* Try the listen hash. */ 6407 if ((connp = ipsec_find_listen_conn(pptr, sel, ipst)) == NULL) 6408 return; 6409 } 6410 6411 ipsec_conn_pol(sel, connp, ppp); 6412 } 6413 6414 static void 6415 ipsec_sctp_pol(ipsec_selector_t *sel, ipsec_policy_t **ppp, 6416 ip_stack_t *ipst) 6417 { 6418 conn_t *connp; 6419 uint32_t ports; 6420 uint16_t *pptr = (uint16_t *)&ports; 6421 6422 /* 6423 * Find SCP state in the following order: 6424 * 1.) Connected conns. 6425 * 2.) Listeners. 6426 * 6427 * Even though #2 will be the common case for inbound traffic, only 6428 * following this order insures correctness. 6429 */ 6430 6431 if (sel->ips_local_port == 0) 6432 return; 6433 6434 /* 6435 * 0 should be fport, 1 should be lport. SRC is the local one here. 6436 * See ipsec_construct_inverse_acquire() for details. 6437 */ 6438 pptr[0] = sel->ips_remote_port; 6439 pptr[1] = sel->ips_local_port; 6440 6441 if (sel->ips_isv4) { 6442 in6_addr_t src, dst; 6443 6444 IN6_IPADDR_TO_V4MAPPED(sel->ips_remote_addr_v4, &dst); 6445 IN6_IPADDR_TO_V4MAPPED(sel->ips_local_addr_v4, &src); 6446 connp = sctp_find_conn(&dst, &src, ports, ALL_ZONES, 6447 ipst->ips_netstack->netstack_sctp); 6448 } else { 6449 connp = sctp_find_conn(&sel->ips_remote_addr_v6, 6450 &sel->ips_local_addr_v6, ports, ALL_ZONES, 6451 ipst->ips_netstack->netstack_sctp); 6452 } 6453 if (connp == NULL) 6454 return; 6455 ipsec_conn_pol(sel, connp, ppp); 6456 } 6457 6458 /* 6459 * Fill in a query for the SPD (in "sel") using two PF_KEY address extensions. 6460 * Returns 0 or errno, and always sets *diagnostic to something appropriate 6461 * to PF_KEY. 6462 * 6463 * NOTE: For right now, this function (and ipsec_selector_t for that matter), 6464 * ignore prefix lengths in the address extension. Since we match on first- 6465 * entered policies, this shouldn't matter. Also, since we normalize prefix- 6466 * set addresses to mask out the lower bits, we should get a suitable search 6467 * key for the SPD anyway. This is the function to change if the assumption 6468 * about suitable search keys is wrong. 6469 */ 6470 static int 6471 ipsec_get_inverse_acquire_sel(ipsec_selector_t *sel, sadb_address_t *srcext, 6472 sadb_address_t *dstext, int *diagnostic) 6473 { 6474 struct sockaddr_in *src, *dst; 6475 struct sockaddr_in6 *src6, *dst6; 6476 6477 *diagnostic = 0; 6478 6479 bzero(sel, sizeof (*sel)); 6480 sel->ips_protocol = srcext->sadb_address_proto; 6481 dst = (struct sockaddr_in *)(dstext + 1); 6482 if (dst->sin_family == AF_INET6) { 6483 dst6 = (struct sockaddr_in6 *)dst; 6484 src6 = (struct sockaddr_in6 *)(srcext + 1); 6485 if (src6->sin6_family != AF_INET6) { 6486 *diagnostic = SADB_X_DIAGNOSTIC_AF_MISMATCH; 6487 return (EINVAL); 6488 } 6489 sel->ips_remote_addr_v6 = dst6->sin6_addr; 6490 sel->ips_local_addr_v6 = src6->sin6_addr; 6491 if (sel->ips_protocol == IPPROTO_ICMPV6) { 6492 sel->ips_is_icmp_inv_acq = 1; 6493 } else { 6494 sel->ips_remote_port = dst6->sin6_port; 6495 sel->ips_local_port = src6->sin6_port; 6496 } 6497 sel->ips_isv4 = B_FALSE; 6498 } else { 6499 src = (struct sockaddr_in *)(srcext + 1); 6500 if (src->sin_family != AF_INET) { 6501 *diagnostic = SADB_X_DIAGNOSTIC_AF_MISMATCH; 6502 return (EINVAL); 6503 } 6504 sel->ips_remote_addr_v4 = dst->sin_addr.s_addr; 6505 sel->ips_local_addr_v4 = src->sin_addr.s_addr; 6506 if (sel->ips_protocol == IPPROTO_ICMP) { 6507 sel->ips_is_icmp_inv_acq = 1; 6508 } else { 6509 sel->ips_remote_port = dst->sin_port; 6510 sel->ips_local_port = src->sin_port; 6511 } 6512 sel->ips_isv4 = B_TRUE; 6513 } 6514 return (0); 6515 } 6516 6517 /* 6518 * We have encapsulation. 6519 * - Lookup tun_t by address and look for an associated 6520 * tunnel policy 6521 * - If there are inner selectors 6522 * - check ITPF_P_TUNNEL and ITPF_P_ACTIVE 6523 * - Look up tunnel policy based on selectors 6524 * - Else 6525 * - Sanity check the negotation 6526 * - If appropriate, fall through to global policy 6527 */ 6528 static int 6529 ipsec_tun_pol(ipsec_selector_t *sel, ipsec_policy_t **ppp, 6530 sadb_address_t *innsrcext, sadb_address_t *inndstext, ipsec_tun_pol_t *itp, 6531 int *diagnostic, netstack_t *ns) 6532 { 6533 int err; 6534 ipsec_policy_head_t *polhead; 6535 6536 /* Check for inner selectors and act appropriately */ 6537 6538 if (innsrcext != NULL) { 6539 /* Inner selectors present */ 6540 ASSERT(inndstext != NULL); 6541 if ((itp == NULL) || 6542 (itp->itp_flags & (ITPF_P_ACTIVE | ITPF_P_TUNNEL)) != 6543 (ITPF_P_ACTIVE | ITPF_P_TUNNEL)) { 6544 /* 6545 * If inner packet selectors, we must have negotiate 6546 * tunnel and active policy. If the tunnel has 6547 * transport-mode policy set on it, or has no policy, 6548 * fail. 6549 */ 6550 return (ENOENT); 6551 } else { 6552 /* 6553 * Reset "sel" to indicate inner selectors. Pass 6554 * inner PF_KEY address extensions for this to happen. 6555 */ 6556 err = ipsec_get_inverse_acquire_sel(sel, 6557 innsrcext, inndstext, diagnostic); 6558 if (err != 0) { 6559 ITP_REFRELE(itp, ns); 6560 return (err); 6561 } 6562 /* 6563 * Now look for a tunnel policy based on those inner 6564 * selectors. (Common code is below.) 6565 */ 6566 } 6567 } else { 6568 /* No inner selectors present */ 6569 if ((itp == NULL) || !(itp->itp_flags & ITPF_P_ACTIVE)) { 6570 /* 6571 * Transport mode negotiation with no tunnel policy 6572 * configured - return to indicate a global policy 6573 * check is needed. 6574 */ 6575 if (itp != NULL) { 6576 ITP_REFRELE(itp, ns); 6577 } 6578 return (0); 6579 } else if (itp->itp_flags & ITPF_P_TUNNEL) { 6580 /* Tunnel mode set with no inner selectors. */ 6581 ITP_REFRELE(itp, ns); 6582 return (ENOENT); 6583 } 6584 /* 6585 * Else, this is a tunnel policy configured with ifconfig(1m) 6586 * or "negotiate transport" with ipsecconf(1m). We have an 6587 * itp with policy set based on any match, so don't bother 6588 * changing fields in "sel". 6589 */ 6590 } 6591 6592 ASSERT(itp != NULL); 6593 polhead = itp->itp_policy; 6594 ASSERT(polhead != NULL); 6595 rw_enter(&polhead->iph_lock, RW_READER); 6596 *ppp = ipsec_find_policy_head(NULL, polhead, 6597 IPSEC_TYPE_INBOUND, sel, ns); 6598 rw_exit(&polhead->iph_lock); 6599 ITP_REFRELE(itp, ns); 6600 6601 /* 6602 * Don't default to global if we didn't find a matching policy entry. 6603 * Instead, send ENOENT, just like if we hit a transport-mode tunnel. 6604 */ 6605 if (*ppp == NULL) 6606 return (ENOENT); 6607 6608 return (0); 6609 } 6610 6611 static void 6612 ipsec_oth_pol(ipsec_selector_t *sel, ipsec_policy_t **ppp, 6613 ip_stack_t *ipst) 6614 { 6615 boolean_t isv4 = sel->ips_isv4; 6616 connf_t *connfp; 6617 conn_t *connp; 6618 6619 if (isv4) { 6620 connfp = &ipst->ips_ipcl_proto_fanout[sel->ips_protocol]; 6621 } else { 6622 connfp = &ipst->ips_ipcl_proto_fanout_v6[sel->ips_protocol]; 6623 } 6624 6625 mutex_enter(&connfp->connf_lock); 6626 for (connp = connfp->connf_head; connp != NULL; 6627 connp = connp->conn_next) { 6628 if (!((isv4 && !((connp->conn_src == 0 || 6629 connp->conn_src == sel->ips_local_addr_v4) && 6630 (connp->conn_rem == 0 || 6631 connp->conn_rem == sel->ips_remote_addr_v4))) || 6632 (!isv4 && !((IN6_IS_ADDR_UNSPECIFIED(&connp->conn_srcv6) || 6633 IN6_ARE_ADDR_EQUAL(&connp->conn_srcv6, 6634 &sel->ips_local_addr_v6)) && 6635 (IN6_IS_ADDR_UNSPECIFIED(&connp->conn_remv6) || 6636 IN6_ARE_ADDR_EQUAL(&connp->conn_remv6, 6637 &sel->ips_remote_addr_v6)))))) { 6638 break; 6639 } 6640 } 6641 if (connp == NULL) { 6642 mutex_exit(&connfp->connf_lock); 6643 return; 6644 } 6645 6646 CONN_INC_REF(connp); 6647 mutex_exit(&connfp->connf_lock); 6648 6649 ipsec_conn_pol(sel, connp, ppp); 6650 } 6651 6652 /* 6653 * Construct an inverse ACQUIRE reply based on: 6654 * 6655 * 1.) Current global policy. 6656 * 2.) An conn_t match depending on what all was passed in the extv[]. 6657 * 3.) A tunnel's policy head. 6658 * ... 6659 * N.) Other stuff TBD (e.g. identities) 6660 * 6661 * If there is an error, set sadb_msg_errno and sadb_x_msg_diagnostic 6662 * in this function so the caller can extract them where appropriately. 6663 * 6664 * The SRC address is the local one - just like an outbound ACQUIRE message. 6665 */ 6666 mblk_t * 6667 ipsec_construct_inverse_acquire(sadb_msg_t *samsg, sadb_ext_t *extv[], 6668 netstack_t *ns) 6669 { 6670 int err; 6671 int diagnostic; 6672 sadb_address_t *srcext = (sadb_address_t *)extv[SADB_EXT_ADDRESS_SRC], 6673 *dstext = (sadb_address_t *)extv[SADB_EXT_ADDRESS_DST], 6674 *innsrcext = (sadb_address_t *)extv[SADB_X_EXT_ADDRESS_INNER_SRC], 6675 *inndstext = (sadb_address_t *)extv[SADB_X_EXT_ADDRESS_INNER_DST]; 6676 struct sockaddr_in6 *src, *dst; 6677 struct sockaddr_in6 *isrc, *idst; 6678 ipsec_tun_pol_t *itp = NULL; 6679 ipsec_policy_t *pp = NULL; 6680 ipsec_selector_t sel, isel; 6681 mblk_t *retmp; 6682 ip_stack_t *ipst = ns->netstack_ip; 6683 ipsec_stack_t *ipss = ns->netstack_ipsec; 6684 6685 /* Normalize addresses */ 6686 if (sadb_addrcheck(NULL, (mblk_t *)samsg, (sadb_ext_t *)srcext, 0, ns) 6687 == KS_IN_ADDR_UNKNOWN) { 6688 err = EINVAL; 6689 diagnostic = SADB_X_DIAGNOSTIC_BAD_SRC; 6690 goto bail; 6691 } 6692 src = (struct sockaddr_in6 *)(srcext + 1); 6693 if (sadb_addrcheck(NULL, (mblk_t *)samsg, (sadb_ext_t *)dstext, 0, ns) 6694 == KS_IN_ADDR_UNKNOWN) { 6695 err = EINVAL; 6696 diagnostic = SADB_X_DIAGNOSTIC_BAD_DST; 6697 goto bail; 6698 } 6699 dst = (struct sockaddr_in6 *)(dstext + 1); 6700 if (src->sin6_family != dst->sin6_family) { 6701 err = EINVAL; 6702 diagnostic = SADB_X_DIAGNOSTIC_AF_MISMATCH; 6703 goto bail; 6704 } 6705 6706 /* Check for tunnel mode and act appropriately */ 6707 if (innsrcext != NULL) { 6708 if (inndstext == NULL) { 6709 err = EINVAL; 6710 diagnostic = SADB_X_DIAGNOSTIC_MISSING_INNER_DST; 6711 goto bail; 6712 } 6713 if (sadb_addrcheck(NULL, (mblk_t *)samsg, 6714 (sadb_ext_t *)innsrcext, 0, ns) == KS_IN_ADDR_UNKNOWN) { 6715 err = EINVAL; 6716 diagnostic = SADB_X_DIAGNOSTIC_MALFORMED_INNER_SRC; 6717 goto bail; 6718 } 6719 isrc = (struct sockaddr_in6 *)(innsrcext + 1); 6720 if (sadb_addrcheck(NULL, (mblk_t *)samsg, 6721 (sadb_ext_t *)inndstext, 0, ns) == KS_IN_ADDR_UNKNOWN) { 6722 err = EINVAL; 6723 diagnostic = SADB_X_DIAGNOSTIC_MALFORMED_INNER_DST; 6724 goto bail; 6725 } 6726 idst = (struct sockaddr_in6 *)(inndstext + 1); 6727 if (isrc->sin6_family != idst->sin6_family) { 6728 err = EINVAL; 6729 diagnostic = SADB_X_DIAGNOSTIC_INNER_AF_MISMATCH; 6730 goto bail; 6731 } 6732 if (isrc->sin6_family != AF_INET && 6733 isrc->sin6_family != AF_INET6) { 6734 err = EINVAL; 6735 diagnostic = SADB_X_DIAGNOSTIC_BAD_INNER_SRC_AF; 6736 goto bail; 6737 } 6738 } else if (inndstext != NULL) { 6739 err = EINVAL; 6740 diagnostic = SADB_X_DIAGNOSTIC_MISSING_INNER_SRC; 6741 goto bail; 6742 } 6743 6744 /* Get selectors first, based on outer addresses */ 6745 err = ipsec_get_inverse_acquire_sel(&sel, srcext, dstext, &diagnostic); 6746 if (err != 0) 6747 goto bail; 6748 6749 /* Check for tunnel mode mismatches. */ 6750 if (innsrcext != NULL && 6751 ((isrc->sin6_family == AF_INET && 6752 sel.ips_protocol != IPPROTO_ENCAP && sel.ips_protocol != 0) || 6753 (isrc->sin6_family == AF_INET6 && 6754 sel.ips_protocol != IPPROTO_IPV6 && sel.ips_protocol != 0))) { 6755 err = EPROTOTYPE; 6756 goto bail; 6757 } 6758 6759 /* 6760 * Okay, we have the addresses and other selector information. 6761 * Let's first find a conn... 6762 */ 6763 pp = NULL; 6764 switch (sel.ips_protocol) { 6765 case IPPROTO_TCP: 6766 ipsec_tcp_pol(&sel, &pp, ipst); 6767 break; 6768 case IPPROTO_UDP: 6769 ipsec_udp_pol(&sel, &pp, ipst); 6770 break; 6771 case IPPROTO_SCTP: 6772 ipsec_sctp_pol(&sel, &pp, ipst); 6773 break; 6774 case IPPROTO_ENCAP: 6775 case IPPROTO_IPV6: 6776 rw_enter(&ipss->ipsec_itp_get_byaddr_rw_lock, RW_READER); 6777 /* 6778 * Assume sel.ips_remote_addr_* has the right address at 6779 * that exact position. 6780 */ 6781 itp = ipss->ipsec_itp_get_byaddr( 6782 (uint32_t *)(&sel.ips_local_addr_v6), 6783 (uint32_t *)(&sel.ips_remote_addr_v6), 6784 src->sin6_family, ns); 6785 rw_exit(&ipss->ipsec_itp_get_byaddr_rw_lock); 6786 if (innsrcext == NULL) { 6787 /* 6788 * Transport-mode tunnel, make sure we fake out isel 6789 * to contain something based on the outer protocol. 6790 */ 6791 bzero(&isel, sizeof (isel)); 6792 isel.ips_isv4 = (sel.ips_protocol == IPPROTO_ENCAP); 6793 } /* Else isel is initialized by ipsec_tun_pol(). */ 6794 err = ipsec_tun_pol(&isel, &pp, innsrcext, inndstext, itp, 6795 &diagnostic, ns); 6796 /* 6797 * NOTE: isel isn't used for now, but in RFC 430x IPsec, it 6798 * may be. 6799 */ 6800 if (err != 0) 6801 goto bail; 6802 break; 6803 default: 6804 ipsec_oth_pol(&sel, &pp, ipst); 6805 break; 6806 } 6807 6808 /* 6809 * If we didn't find a matching conn_t or other policy head, take a 6810 * look in the global policy. 6811 */ 6812 if (pp == NULL) { 6813 pp = ipsec_find_policy(IPSEC_TYPE_OUTBOUND, NULL, NULL, &sel, 6814 ns); 6815 if (pp == NULL) { 6816 /* There's no global policy. */ 6817 err = ENOENT; 6818 diagnostic = 0; 6819 goto bail; 6820 } 6821 } 6822 6823 /* 6824 * Now that we have a policy entry/widget, construct an ACQUIRE 6825 * message based on that, fix fields where appropriate, 6826 * and return the message. 6827 */ 6828 retmp = sadb_extended_acquire(&sel, pp, NULL, 6829 (itp != NULL && (itp->itp_flags & ITPF_P_TUNNEL)), 6830 samsg->sadb_msg_seq, samsg->sadb_msg_pid, ns); 6831 if (pp != NULL) { 6832 IPPOL_REFRELE(pp, ns); 6833 } 6834 if (retmp != NULL) { 6835 return (retmp); 6836 } else { 6837 err = ENOMEM; 6838 diagnostic = 0; 6839 } 6840 bail: 6841 samsg->sadb_msg_errno = (uint8_t)err; 6842 samsg->sadb_x_msg_diagnostic = (uint16_t)diagnostic; 6843 return (NULL); 6844 } 6845 6846 /* 6847 * ipsa_lpkt is a one-element queue, only manipulated by the next two 6848 * functions. They have to hold the ipsa_lock because of potential races 6849 * between key management using SADB_UPDATE, and inbound packets that may 6850 * queue up on the larval SA (hence the 'l' in "lpkt"). 6851 */ 6852 6853 /* 6854 * sadb_set_lpkt: Return TRUE if we can swap in a value to ipsa->ipsa_lpkt and 6855 * freemsg the previous value. Return FALSE if we lost the race and the SA is 6856 * in a non-LARVAL state. free clue: ip_drop_packet(NULL) is safe. 6857 */ 6858 boolean_t 6859 sadb_set_lpkt(ipsa_t *ipsa, mblk_t *npkt, netstack_t *ns) 6860 { 6861 mblk_t *opkt; 6862 ipsec_stack_t *ipss = ns->netstack_ipsec; 6863 boolean_t is_larval; 6864 6865 /* 6866 * Check the packet's netstack id in case we go asynch with a 6867 * taskq_dispatch. 6868 */ 6869 ASSERT(((ipsec_in_t *)npkt->b_rptr)->ipsec_in_type == IPSEC_IN); 6870 ASSERT(((ipsec_in_t *)npkt->b_rptr)->ipsec_in_stackid == 6871 ns->netstack_stackid); 6872 6873 mutex_enter(&ipsa->ipsa_lock); 6874 is_larval = (ipsa->ipsa_state == IPSA_STATE_LARVAL); 6875 if (is_larval) { 6876 opkt = ipsa->ipsa_lpkt; 6877 ipsa->ipsa_lpkt = npkt; 6878 } else { 6879 /* We lost the race. */ 6880 opkt = NULL; 6881 ASSERT(ipsa->ipsa_lpkt == NULL); 6882 } 6883 mutex_exit(&ipsa->ipsa_lock); 6884 6885 ip_drop_packet(opkt, B_TRUE, NULL, NULL, 6886 DROPPER(ipss, ipds_sadb_inlarval_replace), 6887 &ipss->ipsec_sadb_dropper); 6888 return (is_larval); 6889 } 6890 6891 /* 6892 * sadb_clear_lpkt: Atomically clear ipsa->ipsa_lpkt and return the 6893 * previous value. 6894 */ 6895 mblk_t * 6896 sadb_clear_lpkt(ipsa_t *ipsa) 6897 { 6898 mblk_t *opkt; 6899 6900 mutex_enter(&ipsa->ipsa_lock); 6901 opkt = ipsa->ipsa_lpkt; 6902 ipsa->ipsa_lpkt = NULL; 6903 mutex_exit(&ipsa->ipsa_lock); 6904 6905 return (opkt); 6906 } 6907 6908 /* 6909 * Buffer a packet that's in IDLE state as set by Solaris Clustering. 6910 */ 6911 void 6912 sadb_buf_pkt(ipsa_t *ipsa, mblk_t *bpkt, netstack_t *ns) 6913 { 6914 ipsec_stack_t *ipss = ns->netstack_ipsec; 6915 extern void (*cl_inet_idlesa)(netstackid_t, uint8_t, uint32_t, 6916 sa_family_t, in6_addr_t, in6_addr_t, void *); 6917 in6_addr_t *srcaddr = (in6_addr_t *)(&ipsa->ipsa_srcaddr); 6918 in6_addr_t *dstaddr = (in6_addr_t *)(&ipsa->ipsa_dstaddr); 6919 6920 ASSERT(ipsa->ipsa_state == IPSA_STATE_IDLE); 6921 6922 if (cl_inet_idlesa == NULL) { 6923 ip_drop_packet(bpkt, B_TRUE, NULL, NULL, 6924 DROPPER(ipss, ipds_sadb_inidle_overflow), 6925 &ipss->ipsec_sadb_dropper); 6926 return; 6927 } 6928 6929 cl_inet_idlesa(ns->netstack_stackid, 6930 (ipsa->ipsa_type == SADB_SATYPE_AH) ? IPPROTO_AH : IPPROTO_ESP, 6931 ipsa->ipsa_spi, ipsa->ipsa_addrfam, *srcaddr, *dstaddr, NULL); 6932 6933 /* 6934 * Check the packet's netstack id in case we go asynch with a 6935 * taskq_dispatch. 6936 */ 6937 ASSERT(((ipsec_in_t *)bpkt->b_rptr)->ipsec_in_type == IPSEC_IN); 6938 ASSERT(((ipsec_in_t *)bpkt->b_rptr)->ipsec_in_stackid == 6939 ns->netstack_stackid); 6940 6941 mutex_enter(&ipsa->ipsa_lock); 6942 ipsa->ipsa_mblkcnt++; 6943 if (ipsa->ipsa_bpkt_head == NULL) { 6944 ipsa->ipsa_bpkt_head = ipsa->ipsa_bpkt_tail = bpkt; 6945 } else { 6946 ipsa->ipsa_bpkt_tail->b_next = bpkt; 6947 ipsa->ipsa_bpkt_tail = bpkt; 6948 if (ipsa->ipsa_mblkcnt > SADB_MAX_IDLEPKTS) { 6949 mblk_t *tmp; 6950 tmp = ipsa->ipsa_bpkt_head; 6951 ipsa->ipsa_bpkt_head = ipsa->ipsa_bpkt_head->b_next; 6952 ip_drop_packet(tmp, B_TRUE, NULL, NULL, 6953 DROPPER(ipss, ipds_sadb_inidle_overflow), 6954 &ipss->ipsec_sadb_dropper); 6955 ipsa->ipsa_mblkcnt --; 6956 } 6957 } 6958 mutex_exit(&ipsa->ipsa_lock); 6959 6960 } 6961 6962 /* 6963 * Stub function that taskq_dispatch() invokes to take the mblk (in arg) 6964 * and put into STREAMS again. 6965 */ 6966 void 6967 sadb_clear_buf_pkt(void *ipkt) 6968 { 6969 mblk_t *tmp, *buf_pkt; 6970 netstack_t *ns; 6971 ipsec_in_t *ii; 6972 6973 buf_pkt = (mblk_t *)ipkt; 6974 6975 ii = (ipsec_in_t *)buf_pkt->b_rptr; 6976 ASSERT(ii->ipsec_in_type == IPSEC_IN); 6977 ns = netstack_find_by_stackid(ii->ipsec_in_stackid); 6978 if (ns != NULL && ns != ii->ipsec_in_ns) { 6979 netstack_rele(ns); 6980 ns = NULL; /* For while-loop below. */ 6981 } 6982 6983 while (buf_pkt != NULL) { 6984 tmp = buf_pkt->b_next; 6985 buf_pkt->b_next = NULL; 6986 if (ns != NULL) 6987 ip_fanout_proto_again(buf_pkt, NULL, NULL, NULL); 6988 else 6989 freemsg(buf_pkt); 6990 buf_pkt = tmp; 6991 } 6992 if (ns != NULL) 6993 netstack_rele(ns); 6994 } 6995 /* 6996 * Walker callback used by sadb_alg_update() to free/create crypto 6997 * context template when a crypto software provider is removed or 6998 * added. 6999 */ 7000 7001 struct sadb_update_alg_state { 7002 ipsec_algtype_t alg_type; 7003 uint8_t alg_id; 7004 boolean_t is_added; 7005 }; 7006 7007 static void 7008 sadb_alg_update_cb(isaf_t *head, ipsa_t *entry, void *cookie) 7009 { 7010 struct sadb_update_alg_state *update_state = 7011 (struct sadb_update_alg_state *)cookie; 7012 crypto_ctx_template_t *ctx_tmpl = NULL; 7013 7014 ASSERT(MUTEX_HELD(&head->isaf_lock)); 7015 7016 if (entry->ipsa_state == IPSA_STATE_LARVAL) 7017 return; 7018 7019 mutex_enter(&entry->ipsa_lock); 7020 7021 switch (update_state->alg_type) { 7022 case IPSEC_ALG_AUTH: 7023 if (entry->ipsa_auth_alg == update_state->alg_id) 7024 ctx_tmpl = &entry->ipsa_authtmpl; 7025 break; 7026 case IPSEC_ALG_ENCR: 7027 if (entry->ipsa_encr_alg == update_state->alg_id) 7028 ctx_tmpl = &entry->ipsa_encrtmpl; 7029 break; 7030 default: 7031 ctx_tmpl = NULL; 7032 } 7033 7034 if (ctx_tmpl == NULL) { 7035 mutex_exit(&entry->ipsa_lock); 7036 return; 7037 } 7038 7039 /* 7040 * The context template of the SA may be affected by the change 7041 * of crypto provider. 7042 */ 7043 if (update_state->is_added) { 7044 /* create the context template if not already done */ 7045 if (*ctx_tmpl == NULL) { 7046 (void) ipsec_create_ctx_tmpl(entry, 7047 update_state->alg_type); 7048 } 7049 } else { 7050 /* 7051 * The crypto provider was removed. If the context template 7052 * exists but it is no longer valid, free it. 7053 */ 7054 if (*ctx_tmpl != NULL) 7055 ipsec_destroy_ctx_tmpl(entry, update_state->alg_type); 7056 } 7057 7058 mutex_exit(&entry->ipsa_lock); 7059 } 7060 7061 /* 7062 * Invoked by IP when an software crypto provider has been updated. 7063 * The type and id of the corresponding algorithm is passed as argument. 7064 * is_added is B_TRUE if the provider was added, B_FALSE if it was 7065 * removed. The function updates the SADB and free/creates the 7066 * context templates associated with SAs if needed. 7067 */ 7068 7069 #define SADB_ALG_UPDATE_WALK(sadb, table) \ 7070 sadb_walker((sadb).table, (sadb).sdb_hashsize, sadb_alg_update_cb, \ 7071 &update_state) 7072 7073 void 7074 sadb_alg_update(ipsec_algtype_t alg_type, uint8_t alg_id, boolean_t is_added, 7075 netstack_t *ns) 7076 { 7077 struct sadb_update_alg_state update_state; 7078 ipsecah_stack_t *ahstack = ns->netstack_ipsecah; 7079 ipsecesp_stack_t *espstack = ns->netstack_ipsecesp; 7080 7081 update_state.alg_type = alg_type; 7082 update_state.alg_id = alg_id; 7083 update_state.is_added = is_added; 7084 7085 if (alg_type == IPSEC_ALG_AUTH) { 7086 /* walk the AH tables only for auth. algorithm changes */ 7087 SADB_ALG_UPDATE_WALK(ahstack->ah_sadb.s_v4, sdb_of); 7088 SADB_ALG_UPDATE_WALK(ahstack->ah_sadb.s_v4, sdb_if); 7089 SADB_ALG_UPDATE_WALK(ahstack->ah_sadb.s_v6, sdb_of); 7090 SADB_ALG_UPDATE_WALK(ahstack->ah_sadb.s_v6, sdb_if); 7091 } 7092 7093 /* walk the ESP tables */ 7094 SADB_ALG_UPDATE_WALK(espstack->esp_sadb.s_v4, sdb_of); 7095 SADB_ALG_UPDATE_WALK(espstack->esp_sadb.s_v4, sdb_if); 7096 SADB_ALG_UPDATE_WALK(espstack->esp_sadb.s_v6, sdb_of); 7097 SADB_ALG_UPDATE_WALK(espstack->esp_sadb.s_v6, sdb_if); 7098 } 7099 7100 /* 7101 * Creates a context template for the specified SA. This function 7102 * is called when an SA is created and when a context template needs 7103 * to be created due to a change of software provider. 7104 */ 7105 int 7106 ipsec_create_ctx_tmpl(ipsa_t *sa, ipsec_algtype_t alg_type) 7107 { 7108 ipsec_alginfo_t *alg; 7109 crypto_mechanism_t mech; 7110 crypto_key_t *key; 7111 crypto_ctx_template_t *sa_tmpl; 7112 int rv; 7113 ipsec_stack_t *ipss = sa->ipsa_netstack->netstack_ipsec; 7114 7115 ASSERT(MUTEX_HELD(&ipss->ipsec_alg_lock)); 7116 ASSERT(MUTEX_HELD(&sa->ipsa_lock)); 7117 7118 /* get pointers to the algorithm info, context template, and key */ 7119 switch (alg_type) { 7120 case IPSEC_ALG_AUTH: 7121 key = &sa->ipsa_kcfauthkey; 7122 sa_tmpl = &sa->ipsa_authtmpl; 7123 alg = ipss->ipsec_alglists[alg_type][sa->ipsa_auth_alg]; 7124 break; 7125 case IPSEC_ALG_ENCR: 7126 key = &sa->ipsa_kcfencrkey; 7127 sa_tmpl = &sa->ipsa_encrtmpl; 7128 alg = ipss->ipsec_alglists[alg_type][sa->ipsa_encr_alg]; 7129 break; 7130 default: 7131 alg = NULL; 7132 } 7133 7134 if (alg == NULL || !ALG_VALID(alg)) 7135 return (EINVAL); 7136 7137 /* initialize the mech info structure for the framework */ 7138 ASSERT(alg->alg_mech_type != CRYPTO_MECHANISM_INVALID); 7139 mech.cm_type = alg->alg_mech_type; 7140 mech.cm_param = NULL; 7141 mech.cm_param_len = 0; 7142 7143 /* create a new context template */ 7144 rv = crypto_create_ctx_template(&mech, key, sa_tmpl, KM_NOSLEEP); 7145 7146 /* 7147 * CRYPTO_MECH_NOT_SUPPORTED can be returned if only hardware 7148 * providers are available for that mechanism. In that case 7149 * we don't fail, and will generate the context template from 7150 * the framework callback when a software provider for that 7151 * mechanism registers. 7152 * 7153 * The context template is assigned the special value 7154 * IPSEC_CTX_TMPL_ALLOC if the allocation failed due to a 7155 * lack of memory. No attempt will be made to use 7156 * the context template if it is set to this value. 7157 */ 7158 if (rv == CRYPTO_HOST_MEMORY) { 7159 *sa_tmpl = IPSEC_CTX_TMPL_ALLOC; 7160 } else if (rv != CRYPTO_SUCCESS) { 7161 *sa_tmpl = NULL; 7162 if (rv != CRYPTO_MECH_NOT_SUPPORTED) 7163 return (EINVAL); 7164 } 7165 7166 return (0); 7167 } 7168 7169 /* 7170 * Destroy the context template of the specified algorithm type 7171 * of the specified SA. Must be called while holding the SA lock. 7172 */ 7173 void 7174 ipsec_destroy_ctx_tmpl(ipsa_t *sa, ipsec_algtype_t alg_type) 7175 { 7176 ASSERT(MUTEX_HELD(&sa->ipsa_lock)); 7177 7178 if (alg_type == IPSEC_ALG_AUTH) { 7179 if (sa->ipsa_authtmpl == IPSEC_CTX_TMPL_ALLOC) 7180 sa->ipsa_authtmpl = NULL; 7181 else if (sa->ipsa_authtmpl != NULL) { 7182 crypto_destroy_ctx_template(sa->ipsa_authtmpl); 7183 sa->ipsa_authtmpl = NULL; 7184 } 7185 } else { 7186 ASSERT(alg_type == IPSEC_ALG_ENCR); 7187 if (sa->ipsa_encrtmpl == IPSEC_CTX_TMPL_ALLOC) 7188 sa->ipsa_encrtmpl = NULL; 7189 else if (sa->ipsa_encrtmpl != NULL) { 7190 crypto_destroy_ctx_template(sa->ipsa_encrtmpl); 7191 sa->ipsa_encrtmpl = NULL; 7192 } 7193 } 7194 } 7195 7196 /* 7197 * Use the kernel crypto framework to check the validity of a key received 7198 * via keysock. Returns 0 if the key is OK, -1 otherwise. 7199 */ 7200 int 7201 ipsec_check_key(crypto_mech_type_t mech_type, sadb_key_t *sadb_key, 7202 boolean_t is_auth, int *diag) 7203 { 7204 crypto_mechanism_t mech; 7205 crypto_key_t crypto_key; 7206 int crypto_rc; 7207 7208 mech.cm_type = mech_type; 7209 mech.cm_param = NULL; 7210 mech.cm_param_len = 0; 7211 7212 crypto_key.ck_format = CRYPTO_KEY_RAW; 7213 crypto_key.ck_data = sadb_key + 1; 7214 crypto_key.ck_length = sadb_key->sadb_key_bits; 7215 7216 crypto_rc = crypto_key_check(&mech, &crypto_key); 7217 7218 switch (crypto_rc) { 7219 case CRYPTO_SUCCESS: 7220 return (0); 7221 case CRYPTO_MECHANISM_INVALID: 7222 case CRYPTO_MECH_NOT_SUPPORTED: 7223 *diag = is_auth ? SADB_X_DIAGNOSTIC_BAD_AALG : 7224 SADB_X_DIAGNOSTIC_BAD_EALG; 7225 break; 7226 case CRYPTO_KEY_SIZE_RANGE: 7227 *diag = is_auth ? SADB_X_DIAGNOSTIC_BAD_AKEYBITS : 7228 SADB_X_DIAGNOSTIC_BAD_EKEYBITS; 7229 break; 7230 case CRYPTO_WEAK_KEY: 7231 *diag = is_auth ? SADB_X_DIAGNOSTIC_WEAK_AKEY : 7232 SADB_X_DIAGNOSTIC_WEAK_EKEY; 7233 break; 7234 } 7235 7236 return (-1); 7237 } 7238 /* 7239 * If this is an outgoing SA then add some fuzz to the 7240 * SOFT EXPIRE time. The reason for this is to stop 7241 * peers trying to renegotiate SOFT expiring SA's at 7242 * the same time. The amount of fuzz needs to be at 7243 * least 10 seconds which is the typical interval 7244 * sadb_ager(), although this is only a guide as it 7245 * selftunes. 7246 */ 7247 void 7248 lifetime_fuzz(ipsa_t *assoc) 7249 { 7250 uint8_t rnd; 7251 7252 if (assoc->ipsa_softaddlt == 0) 7253 return; 7254 7255 (void) random_get_pseudo_bytes(&rnd, sizeof (rnd)); 7256 rnd = (rnd & 0xF) + 10; 7257 assoc->ipsa_softexpiretime -= rnd; 7258 assoc->ipsa_softaddlt -= rnd; 7259 } 7260 void 7261 destroy_ipsa_pair(ipsap_t *ipsapp) 7262 { 7263 if (ipsapp == NULL) 7264 return; 7265 7266 /* 7267 * Because of the multi-line macro nature of IPSA_REFRELE, keep 7268 * them in { }. 7269 */ 7270 if (ipsapp->ipsap_sa_ptr != NULL) { 7271 IPSA_REFRELE(ipsapp->ipsap_sa_ptr); 7272 } 7273 if (ipsapp->ipsap_psa_ptr != NULL) { 7274 IPSA_REFRELE(ipsapp->ipsap_psa_ptr); 7275 } 7276 7277 kmem_free(ipsapp, sizeof (*ipsapp)); 7278 } 7279 7280 /* 7281 * The sadb_ager() function walks through the hash tables of SA's and ages 7282 * them, if the SA expires as a result, its marked as DEAD and will be reaped 7283 * the next time sadb_ager() runs. SA's which are paired or have a peer (same 7284 * SA appears in both the inbound and outbound tables because its not possible 7285 * to determine its direction) are placed on a list when they expire. This is 7286 * to ensure that pair/peer SA's are reaped at the same time, even if they 7287 * expire at different times. 7288 * 7289 * This function is called twice by sadb_ager(), one after processing the 7290 * inbound table, then again after processing the outbound table. 7291 */ 7292 void 7293 age_pair_peer_list(templist_t *haspeerlist, sadb_t *sp, boolean_t outbound) 7294 { 7295 templist_t *listptr; 7296 int outhash; 7297 isaf_t *bucket; 7298 boolean_t haspeer; 7299 ipsa_t *peer_assoc, *dying; 7300 /* 7301 * Haspeer cases will contain both IPv4 and IPv6. This code 7302 * is address independent. 7303 */ 7304 while (haspeerlist != NULL) { 7305 /* "dying" contains the SA that has a peer. */ 7306 dying = haspeerlist->ipsa; 7307 haspeer = (dying->ipsa_haspeer); 7308 listptr = haspeerlist; 7309 haspeerlist = listptr->next; 7310 kmem_free(listptr, sizeof (*listptr)); 7311 /* 7312 * Pick peer bucket based on addrfam. 7313 */ 7314 if (outbound) { 7315 if (haspeer) 7316 bucket = INBOUND_BUCKET(sp, dying->ipsa_spi); 7317 else 7318 bucket = INBOUND_BUCKET(sp, 7319 dying->ipsa_otherspi); 7320 } else { /* inbound */ 7321 if (haspeer) { 7322 if (dying->ipsa_addrfam == AF_INET6) { 7323 outhash = OUTBOUND_HASH_V6(sp, 7324 *((in6_addr_t *)&dying-> 7325 ipsa_dstaddr)); 7326 } else { 7327 outhash = OUTBOUND_HASH_V4(sp, 7328 *((ipaddr_t *)&dying-> 7329 ipsa_dstaddr)); 7330 } 7331 } else if (dying->ipsa_addrfam == AF_INET6) { 7332 outhash = OUTBOUND_HASH_V6(sp, 7333 *((in6_addr_t *)&dying-> 7334 ipsa_srcaddr)); 7335 } else { 7336 outhash = OUTBOUND_HASH_V4(sp, 7337 *((ipaddr_t *)&dying-> 7338 ipsa_srcaddr)); 7339 } 7340 bucket = &(sp->sdb_of[outhash]); 7341 } 7342 7343 mutex_enter(&bucket->isaf_lock); 7344 /* 7345 * "haspeer" SA's have the same src/dst address ordering, 7346 * "paired" SA's have the src/dst addresses reversed. 7347 */ 7348 if (haspeer) { 7349 peer_assoc = ipsec_getassocbyspi(bucket, 7350 dying->ipsa_spi, dying->ipsa_srcaddr, 7351 dying->ipsa_dstaddr, dying->ipsa_addrfam); 7352 } else { 7353 peer_assoc = ipsec_getassocbyspi(bucket, 7354 dying->ipsa_otherspi, dying->ipsa_dstaddr, 7355 dying->ipsa_srcaddr, dying->ipsa_addrfam); 7356 } 7357 7358 mutex_exit(&bucket->isaf_lock); 7359 if (peer_assoc != NULL) { 7360 mutex_enter(&peer_assoc->ipsa_lock); 7361 mutex_enter(&dying->ipsa_lock); 7362 if (!haspeer) { 7363 /* 7364 * Only SA's which have a "peer" or are 7365 * "paired" end up on this list, so this 7366 * must be a "paired" SA, update the flags 7367 * to break the pair. 7368 */ 7369 peer_assoc->ipsa_otherspi = 0; 7370 peer_assoc->ipsa_flags &= ~IPSA_F_PAIRED; 7371 dying->ipsa_otherspi = 0; 7372 dying->ipsa_flags &= ~IPSA_F_PAIRED; 7373 } 7374 if (haspeer || outbound) { 7375 /* 7376 * Update the state of the "inbound" SA when 7377 * the "outbound" SA has expired. Don't update 7378 * the "outbound" SA when the "inbound" SA 7379 * SA expires because setting the hard_addtime 7380 * below will cause this to happen. 7381 */ 7382 peer_assoc->ipsa_state = dying->ipsa_state; 7383 } 7384 if (dying->ipsa_state == IPSA_STATE_DEAD) 7385 peer_assoc->ipsa_hardexpiretime = 1; 7386 7387 mutex_exit(&dying->ipsa_lock); 7388 mutex_exit(&peer_assoc->ipsa_lock); 7389 IPSA_REFRELE(peer_assoc); 7390 } 7391 IPSA_REFRELE(dying); 7392 } 7393 } 7394