1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright 2008 Sun Microsystems, Inc. All rights reserved. 23 * Use is subject to license terms. 24 */ 25 26 #include <sys/param.h> 27 #include <sys/types.h> 28 #include <sys/stream.h> 29 #include <sys/strsubr.h> 30 #include <sys/strsun.h> 31 #include <sys/stropts.h> 32 #include <sys/zone.h> 33 #include <sys/vnode.h> 34 #include <sys/sysmacros.h> 35 #define _SUN_TPI_VERSION 2 36 #include <sys/tihdr.h> 37 #include <sys/ddi.h> 38 #include <sys/sunddi.h> 39 #include <sys/mkdev.h> 40 #include <sys/debug.h> 41 #include <sys/kmem.h> 42 #include <sys/cmn_err.h> 43 #include <sys/suntpi.h> 44 #include <sys/policy.h> 45 46 #include <sys/socket.h> 47 #include <netinet/in.h> 48 #include <net/pfkeyv2.h> 49 #include <net/pfpolicy.h> 50 51 #include <inet/common.h> 52 #include <netinet/ip6.h> 53 #include <inet/ip.h> 54 #include <inet/ip6.h> 55 #include <inet/mi.h> 56 #include <inet/proto_set.h> 57 #include <inet/nd.h> 58 #include <inet/ip_if.h> 59 #include <inet/tun.h> 60 #include <inet/optcom.h> 61 #include <inet/ipsec_info.h> 62 #include <inet/ipsec_impl.h> 63 #include <inet/spdsock.h> 64 #include <inet/sadb.h> 65 66 #include <sys/isa_defs.h> 67 68 #include <c2/audit.h> 69 70 /* 71 * This is a transport provider for the PF_POLICY IPsec policy 72 * management socket, which provides a management interface into the 73 * SPD, allowing policy rules to be added, deleted, and queried. 74 * 75 * This effectively replaces the old private SIOC*IPSECONFIG ioctls 76 * with an extensible interface which will hopefully be public some 77 * day. 78 * 79 * See <net/pfpolicy.h> for more details on the protocol. 80 * 81 * We link against drv/ip and call directly into it to manipulate the 82 * SPD; see ipsec_impl.h for the policy data structures and spd.c for 83 * the code which maintains them. 84 * 85 * The MT model of this is QPAIR with the addition of some explicit 86 * locking to protect system-wide policy data structures. 87 */ 88 89 static vmem_t *spdsock_vmem; /* for minor numbers. */ 90 91 #define ALIGNED64(x) IS_P2ALIGNED((x), sizeof (uint64_t)) 92 93 /* Default structure copied into T_INFO_ACK messages (from rts.c...) */ 94 static struct T_info_ack spdsock_g_t_info_ack = { 95 T_INFO_ACK, 96 T_INFINITE, /* TSDU_size. Maximum size messages. */ 97 T_INVALID, /* ETSDU_size. No expedited data. */ 98 T_INVALID, /* CDATA_size. No connect data. */ 99 T_INVALID, /* DDATA_size. No disconnect data. */ 100 0, /* ADDR_size. */ 101 0, /* OPT_size. No user-settable options */ 102 64 * 1024, /* TIDU_size. spdsock allows maximum size messages. */ 103 T_COTS, /* SERV_type. spdsock supports connection oriented. */ 104 TS_UNBND, /* CURRENT_state. This is set from spdsock_state. */ 105 (XPG4_1) /* Provider flags */ 106 }; 107 108 /* Named Dispatch Parameter Management Structure */ 109 typedef struct spdsockparam_s { 110 uint_t spdsock_param_min; 111 uint_t spdsock_param_max; 112 uint_t spdsock_param_value; 113 char *spdsock_param_name; 114 } spdsockparam_t; 115 116 /* 117 * Table of NDD variables supported by spdsock. These are loaded into 118 * spdsock_g_nd in spdsock_init_nd. 119 * All of these are alterable, within the min/max values given, at run time. 120 */ 121 static spdsockparam_t lcl_param_arr[] = { 122 /* min max value name */ 123 { 4096, 65536, 8192, "spdsock_xmit_hiwat"}, 124 { 0, 65536, 1024, "spdsock_xmit_lowat"}, 125 { 4096, 65536, 8192, "spdsock_recv_hiwat"}, 126 { 65536, 1024*1024*1024, 256*1024, "spdsock_max_buf"}, 127 { 0, 3, 0, "spdsock_debug"}, 128 }; 129 #define spds_xmit_hiwat spds_params[0].spdsock_param_value 130 #define spds_xmit_lowat spds_params[1].spdsock_param_value 131 #define spds_recv_hiwat spds_params[2].spdsock_param_value 132 #define spds_max_buf spds_params[3].spdsock_param_value 133 #define spds_debug spds_params[4].spdsock_param_value 134 135 #define ss0dbg(a) printf a 136 /* NOTE: != 0 instead of > 0 so lint doesn't complain. */ 137 #define ss1dbg(spds, a) if (spds->spds_debug != 0) printf a 138 #define ss2dbg(spds, a) if (spds->spds_debug > 1) printf a 139 #define ss3dbg(spds, a) if (spds->spds_debug > 2) printf a 140 141 #define RESET_SPDSOCK_DUMP_POLHEAD(ss, iph) { \ 142 ASSERT(RW_READ_HELD(&(iph)->iph_lock)); \ 143 (ss)->spdsock_dump_head = (iph); \ 144 (ss)->spdsock_dump_gen = (iph)->iph_gen; \ 145 (ss)->spdsock_dump_cur_type = 0; \ 146 (ss)->spdsock_dump_cur_af = IPSEC_AF_V4; \ 147 (ss)->spdsock_dump_cur_rule = NULL; \ 148 (ss)->spdsock_dump_count = 0; \ 149 (ss)->spdsock_dump_cur_chain = 0; \ 150 } 151 152 static int spdsock_close(queue_t *); 153 static int spdsock_open(queue_t *, dev_t *, int, int, cred_t *); 154 static void spdsock_wput(queue_t *, mblk_t *); 155 static void spdsock_wsrv(queue_t *); 156 static void spdsock_rsrv(queue_t *); 157 static void *spdsock_stack_init(netstackid_t stackid, netstack_t *ns); 158 static void spdsock_stack_fini(netstackid_t stackid, void *arg); 159 static void spdsock_loadcheck(void *); 160 static void spdsock_merge_algs(spd_stack_t *); 161 static void spdsock_flush_one(ipsec_policy_head_t *, netstack_t *); 162 static mblk_t *spdsock_dump_next_record(spdsock_t *); 163 164 static struct module_info info = { 165 5138, "spdsock", 1, INFPSZ, 512, 128 166 }; 167 168 static struct qinit rinit = { 169 NULL, (pfi_t)spdsock_rsrv, spdsock_open, spdsock_close, 170 NULL, &info 171 }; 172 173 static struct qinit winit = { 174 (pfi_t)spdsock_wput, (pfi_t)spdsock_wsrv, NULL, NULL, NULL, &info 175 }; 176 177 struct streamtab spdsockinfo = { 178 &rinit, &winit 179 }; 180 181 /* mapping from alg type to protocol number, as per RFC 2407 */ 182 static const uint_t algproto[] = { 183 PROTO_IPSEC_AH, 184 PROTO_IPSEC_ESP, 185 }; 186 187 #define NALGPROTOS (sizeof (algproto) / sizeof (algproto[0])) 188 189 /* mapping from kernel exec mode to spdsock exec mode */ 190 static const uint_t execmodes[] = { 191 SPD_ALG_EXEC_MODE_SYNC, 192 SPD_ALG_EXEC_MODE_ASYNC 193 }; 194 195 #define NEXECMODES (sizeof (execmodes) / sizeof (execmodes[0])) 196 197 #define ALL_ACTIVE_POLHEADS ((ipsec_policy_head_t *)-1) 198 #define ALL_INACTIVE_POLHEADS ((ipsec_policy_head_t *)-2) 199 200 #define ITP_NAME(itp) (itp != NULL ? itp->itp_name : NULL) 201 202 /* ARGSUSED */ 203 static int 204 spdsock_param_get(q, mp, cp, cr) 205 queue_t *q; 206 mblk_t *mp; 207 caddr_t cp; 208 cred_t *cr; 209 { 210 spdsockparam_t *spdsockpa = (spdsockparam_t *)cp; 211 uint_t value; 212 spdsock_t *ss = (spdsock_t *)q->q_ptr; 213 spd_stack_t *spds = ss->spdsock_spds; 214 215 mutex_enter(&spds->spds_param_lock); 216 value = spdsockpa->spdsock_param_value; 217 mutex_exit(&spds->spds_param_lock); 218 219 (void) mi_mpprintf(mp, "%u", value); 220 return (0); 221 } 222 223 /* This routine sets an NDD variable in a spdsockparam_t structure. */ 224 /* ARGSUSED */ 225 static int 226 spdsock_param_set(q, mp, value, cp, cr) 227 queue_t *q; 228 mblk_t *mp; 229 char *value; 230 caddr_t cp; 231 cred_t *cr; 232 { 233 ulong_t new_value; 234 spdsockparam_t *spdsockpa = (spdsockparam_t *)cp; 235 spdsock_t *ss = (spdsock_t *)q->q_ptr; 236 spd_stack_t *spds = ss->spdsock_spds; 237 238 /* Convert the value from a string into a long integer. */ 239 if (ddi_strtoul(value, NULL, 10, &new_value) != 0) 240 return (EINVAL); 241 242 mutex_enter(&spds->spds_param_lock); 243 /* 244 * Fail the request if the new value does not lie within the 245 * required bounds. 246 */ 247 if (new_value < spdsockpa->spdsock_param_min || 248 new_value > spdsockpa->spdsock_param_max) { 249 mutex_exit(&spds->spds_param_lock); 250 return (EINVAL); 251 } 252 253 /* Set the new value */ 254 spdsockpa->spdsock_param_value = new_value; 255 mutex_exit(&spds->spds_param_lock); 256 257 return (0); 258 } 259 260 /* 261 * Initialize at module load time 262 */ 263 boolean_t 264 spdsock_ddi_init(void) 265 { 266 spdsock_max_optsize = optcom_max_optsize( 267 spdsock_opt_obj.odb_opt_des_arr, spdsock_opt_obj.odb_opt_arr_cnt); 268 269 spdsock_vmem = vmem_create("spdsock", (void *)1, MAXMIN, 1, 270 NULL, NULL, NULL, 1, VM_SLEEP | VMC_IDENTIFIER); 271 272 /* 273 * We want to be informed each time a stack is created or 274 * destroyed in the kernel, so we can maintain the 275 * set of spd_stack_t's. 276 */ 277 netstack_register(NS_SPDSOCK, spdsock_stack_init, NULL, 278 spdsock_stack_fini); 279 280 return (B_TRUE); 281 } 282 283 /* 284 * Walk through the param array specified registering each element with the 285 * named dispatch handler. 286 */ 287 static boolean_t 288 spdsock_param_register(IDP *ndp, spdsockparam_t *ssp, int cnt) 289 { 290 for (; cnt-- > 0; ssp++) { 291 if (ssp->spdsock_param_name != NULL && 292 ssp->spdsock_param_name[0]) { 293 if (!nd_load(ndp, 294 ssp->spdsock_param_name, 295 spdsock_param_get, spdsock_param_set, 296 (caddr_t)ssp)) { 297 nd_free(ndp); 298 return (B_FALSE); 299 } 300 } 301 } 302 return (B_TRUE); 303 } 304 305 /* 306 * Initialize for each stack instance 307 */ 308 /* ARGSUSED */ 309 static void * 310 spdsock_stack_init(netstackid_t stackid, netstack_t *ns) 311 { 312 spd_stack_t *spds; 313 spdsockparam_t *ssp; 314 315 spds = (spd_stack_t *)kmem_zalloc(sizeof (*spds), KM_SLEEP); 316 spds->spds_netstack = ns; 317 318 ASSERT(spds->spds_g_nd == NULL); 319 320 ssp = (spdsockparam_t *)kmem_alloc(sizeof (lcl_param_arr), KM_SLEEP); 321 spds->spds_params = ssp; 322 bcopy(lcl_param_arr, ssp, sizeof (lcl_param_arr)); 323 324 (void) spdsock_param_register(&spds->spds_g_nd, ssp, 325 A_CNT(lcl_param_arr)); 326 327 mutex_init(&spds->spds_param_lock, NULL, MUTEX_DEFAULT, NULL); 328 mutex_init(&spds->spds_alg_lock, NULL, MUTEX_DEFAULT, NULL); 329 330 return (spds); 331 } 332 333 void 334 spdsock_ddi_destroy(void) 335 { 336 vmem_destroy(spdsock_vmem); 337 338 netstack_unregister(NS_SPDSOCK); 339 } 340 341 /* ARGSUSED */ 342 static void 343 spdsock_stack_fini(netstackid_t stackid, void *arg) 344 { 345 spd_stack_t *spds = (spd_stack_t *)arg; 346 347 freemsg(spds->spds_mp_algs); 348 mutex_destroy(&spds->spds_param_lock); 349 mutex_destroy(&spds->spds_alg_lock); 350 nd_free(&spds->spds_g_nd); 351 kmem_free(spds->spds_params, sizeof (lcl_param_arr)); 352 spds->spds_params = NULL; 353 354 kmem_free(spds, sizeof (*spds)); 355 } 356 357 /* 358 * NOTE: large quantities of this should be shared with keysock. 359 * Would be nice to combine some of this into a common module, but 360 * not possible given time pressures. 361 */ 362 363 /* 364 * High-level reality checking of extensions. 365 */ 366 /* ARGSUSED */ /* XXX */ 367 static boolean_t 368 ext_check(spd_ext_t *ext) 369 { 370 spd_if_t *tunname = (spd_if_t *)ext; 371 int i; 372 char *idstr; 373 374 if (ext->spd_ext_type == SPD_EXT_TUN_NAME) { 375 /* (NOTE: Modified from SADB_EXT_IDENTITY..) */ 376 377 /* 378 * Make sure the strings in these identities are 379 * null-terminated. Let's "proactively" null-terminate the 380 * string at the last byte if it's not terminated sooner. 381 */ 382 i = SPD_64TO8(tunname->spd_if_len) - sizeof (spd_if_t); 383 idstr = (char *)(tunname + 1); 384 while (*idstr != '\0' && i > 0) { 385 i--; 386 idstr++; 387 } 388 if (i == 0) { 389 /* 390 * I.e., if the bozo user didn't NULL-terminate the 391 * string... 392 */ 393 idstr--; 394 *idstr = '\0'; 395 } 396 } 397 return (B_TRUE); /* For now... */ 398 } 399 400 401 402 /* Return values for spdsock_get_ext(). */ 403 #define KGE_OK 0 404 #define KGE_DUP 1 405 #define KGE_UNK 2 406 #define KGE_LEN 3 407 #define KGE_CHK 4 408 409 /* 410 * Parse basic extension headers and return in the passed-in pointer vector. 411 * Return values include: 412 * 413 * KGE_OK Everything's nice and parsed out. 414 * If there are no extensions, place NULL in extv[0]. 415 * KGE_DUP There is a duplicate extension. 416 * First instance in appropriate bin. First duplicate in 417 * extv[0]. 418 * KGE_UNK Unknown extension type encountered. extv[0] contains 419 * unknown header. 420 * KGE_LEN Extension length error. 421 * KGE_CHK High-level reality check failed on specific extension. 422 * 423 * My apologies for some of the pointer arithmetic in here. I'm thinking 424 * like an assembly programmer, yet trying to make the compiler happy. 425 */ 426 static int 427 spdsock_get_ext(spd_ext_t *extv[], spd_msg_t *basehdr, uint_t msgsize) 428 { 429 bzero(extv, sizeof (spd_ext_t *) * (SPD_EXT_MAX + 1)); 430 431 /* Use extv[0] as the "current working pointer". */ 432 433 extv[0] = (spd_ext_t *)(basehdr + 1); 434 435 while (extv[0] < (spd_ext_t *)(((uint8_t *)basehdr) + msgsize)) { 436 /* Check for unknown headers. */ 437 if (extv[0]->spd_ext_type == 0 || 438 extv[0]->spd_ext_type > SPD_EXT_MAX) 439 return (KGE_UNK); 440 441 /* 442 * Check length. Use uint64_t because extlen is in units 443 * of 64-bit words. If length goes beyond the msgsize, 444 * return an error. (Zero length also qualifies here.) 445 */ 446 if (extv[0]->spd_ext_len == 0 || 447 (void *)((uint64_t *)extv[0] + extv[0]->spd_ext_len) > 448 (void *)((uint8_t *)basehdr + msgsize)) 449 return (KGE_LEN); 450 451 /* Check for redundant headers. */ 452 if (extv[extv[0]->spd_ext_type] != NULL) 453 return (KGE_DUP); 454 455 /* 456 * Reality check the extension if possible at the spdsock 457 * level. 458 */ 459 if (!ext_check(extv[0])) 460 return (KGE_CHK); 461 462 /* If I make it here, assign the appropriate bin. */ 463 extv[extv[0]->spd_ext_type] = extv[0]; 464 465 /* Advance pointer (See above for uint64_t ptr reasoning.) */ 466 extv[0] = (spd_ext_t *) 467 ((uint64_t *)extv[0] + extv[0]->spd_ext_len); 468 } 469 470 /* Everything's cool. */ 471 472 /* 473 * If extv[0] == NULL, then there are no extension headers in this 474 * message. Ensure that this is the case. 475 */ 476 if (extv[0] == (spd_ext_t *)(basehdr + 1)) 477 extv[0] = NULL; 478 479 return (KGE_OK); 480 } 481 482 static const int bad_ext_diag[] = { 483 SPD_DIAGNOSTIC_MALFORMED_LCLPORT, 484 SPD_DIAGNOSTIC_MALFORMED_REMPORT, 485 SPD_DIAGNOSTIC_MALFORMED_PROTO, 486 SPD_DIAGNOSTIC_MALFORMED_LCLADDR, 487 SPD_DIAGNOSTIC_MALFORMED_REMADDR, 488 SPD_DIAGNOSTIC_MALFORMED_ACTION, 489 SPD_DIAGNOSTIC_MALFORMED_RULE, 490 SPD_DIAGNOSTIC_MALFORMED_RULESET, 491 SPD_DIAGNOSTIC_MALFORMED_ICMP_TYPECODE 492 }; 493 494 static const int dup_ext_diag[] = { 495 SPD_DIAGNOSTIC_DUPLICATE_LCLPORT, 496 SPD_DIAGNOSTIC_DUPLICATE_REMPORT, 497 SPD_DIAGNOSTIC_DUPLICATE_PROTO, 498 SPD_DIAGNOSTIC_DUPLICATE_LCLADDR, 499 SPD_DIAGNOSTIC_DUPLICATE_REMADDR, 500 SPD_DIAGNOSTIC_DUPLICATE_ACTION, 501 SPD_DIAGNOSTIC_DUPLICATE_RULE, 502 SPD_DIAGNOSTIC_DUPLICATE_RULESET, 503 SPD_DIAGNOSTIC_DUPLICATE_ICMP_TYPECODE 504 }; 505 506 /* 507 * Transmit a PF_POLICY error message to the instance either pointed to 508 * by ks, the instance with serial number serial, or more, depending. 509 * 510 * The faulty message (or a reasonable facsimile thereof) is in mp. 511 * This function will free mp or recycle it for delivery, thereby causing 512 * the stream head to free it. 513 */ 514 static void 515 spdsock_error(queue_t *q, mblk_t *mp, int error, int diagnostic) 516 { 517 spd_msg_t *spmsg = (spd_msg_t *)mp->b_rptr; 518 519 ASSERT(mp->b_datap->db_type == M_DATA); 520 521 if (spmsg->spd_msg_type < SPD_MIN || 522 spmsg->spd_msg_type > SPD_MAX) 523 spmsg->spd_msg_type = SPD_RESERVED; 524 525 /* 526 * Strip out extension headers. 527 */ 528 ASSERT(mp->b_rptr + sizeof (*spmsg) <= mp->b_datap->db_lim); 529 mp->b_wptr = mp->b_rptr + sizeof (*spmsg); 530 spmsg->spd_msg_len = SPD_8TO64(sizeof (spd_msg_t)); 531 spmsg->spd_msg_errno = (uint8_t)error; 532 spmsg->spd_msg_diagnostic = (uint16_t)diagnostic; 533 534 qreply(q, mp); 535 } 536 537 static void 538 spdsock_diag(queue_t *q, mblk_t *mp, int diagnostic) 539 { 540 spdsock_error(q, mp, EINVAL, diagnostic); 541 } 542 543 static void 544 spd_echo(queue_t *q, mblk_t *mp) 545 { 546 qreply(q, mp); 547 } 548 549 /* 550 * Do NOT consume a reference to itp. 551 */ 552 /*ARGSUSED*/ 553 static void 554 spdsock_flush_node(ipsec_tun_pol_t *itp, void *cookie, netstack_t *ns) 555 { 556 boolean_t active = (boolean_t)cookie; 557 ipsec_policy_head_t *iph; 558 559 iph = active ? itp->itp_policy : itp->itp_inactive; 560 IPPH_REFHOLD(iph); 561 mutex_enter(&itp->itp_lock); 562 spdsock_flush_one(iph, ns); 563 if (active) 564 itp->itp_flags &= ~ITPF_PFLAGS; 565 else 566 itp->itp_flags &= ~ITPF_IFLAGS; 567 mutex_exit(&itp->itp_lock); 568 } 569 570 /* 571 * Clear out one polhead. 572 */ 573 static void 574 spdsock_flush_one(ipsec_policy_head_t *iph, netstack_t *ns) 575 { 576 rw_enter(&iph->iph_lock, RW_WRITER); 577 ipsec_polhead_flush(iph, ns); 578 rw_exit(&iph->iph_lock); 579 IPPH_REFRELE(iph, ns); 580 } 581 582 static void 583 spdsock_flush(queue_t *q, ipsec_policy_head_t *iph, ipsec_tun_pol_t *itp, 584 mblk_t *mp) 585 { 586 boolean_t active; 587 spdsock_t *ss = (spdsock_t *)q->q_ptr; 588 netstack_t *ns = ss->spdsock_spds->spds_netstack; 589 590 if (iph != ALL_ACTIVE_POLHEADS && iph != ALL_INACTIVE_POLHEADS) { 591 spdsock_flush_one(iph, ns); 592 if (audit_active) { 593 spd_msg_t *spmsg = (spd_msg_t *)mp->b_rptr; 594 595 active = (spmsg->spd_msg_spdid == SPD_ACTIVE); 596 audit_pf_policy(SPD_FLUSH, DB_CRED(mp), ns, 597 ITP_NAME(itp), active, 0, DB_CPID(mp)); 598 } 599 } else { 600 active = (iph == ALL_ACTIVE_POLHEADS); 601 602 /* First flush the global policy. */ 603 spdsock_flush_one(active ? ipsec_system_policy(ns) : 604 ipsec_inactive_policy(ns), ns); 605 if (audit_active) { 606 audit_pf_policy(SPD_FLUSH, DB_CRED(mp), ns, NULL, 607 active, 0, DB_CPID(mp)); 608 } 609 /* Then flush every tunnel's appropriate one. */ 610 itp_walk(spdsock_flush_node, (void *)active, ns); 611 if (audit_active) 612 audit_pf_policy(SPD_FLUSH, DB_CRED(mp), ns, 613 "all tunnels", active, 0, DB_CPID(mp)); 614 } 615 616 spd_echo(q, mp); 617 } 618 619 static boolean_t 620 spdsock_ext_to_sel(spd_ext_t **extv, ipsec_selkey_t *sel, int *diag) 621 { 622 bzero(sel, sizeof (*sel)); 623 624 if (extv[SPD_EXT_PROTO] != NULL) { 625 struct spd_proto *pr = 626 (struct spd_proto *)extv[SPD_EXT_PROTO]; 627 sel->ipsl_proto = pr->spd_proto_number; 628 sel->ipsl_valid |= IPSL_PROTOCOL; 629 } 630 if (extv[SPD_EXT_LCLPORT] != NULL) { 631 struct spd_portrange *pr = 632 (struct spd_portrange *)extv[SPD_EXT_LCLPORT]; 633 sel->ipsl_lport = pr->spd_ports_minport; 634 sel->ipsl_valid |= IPSL_LOCAL_PORT; 635 } 636 if (extv[SPD_EXT_REMPORT] != NULL) { 637 struct spd_portrange *pr = 638 (struct spd_portrange *)extv[SPD_EXT_REMPORT]; 639 sel->ipsl_rport = pr->spd_ports_minport; 640 sel->ipsl_valid |= IPSL_REMOTE_PORT; 641 } 642 643 if (extv[SPD_EXT_ICMP_TYPECODE] != NULL) { 644 struct spd_typecode *tc= 645 (struct spd_typecode *)extv[SPD_EXT_ICMP_TYPECODE]; 646 647 sel->ipsl_valid |= IPSL_ICMP_TYPE; 648 sel->ipsl_icmp_type = tc->spd_typecode_type; 649 if (tc->spd_typecode_type_end < tc->spd_typecode_type) 650 sel->ipsl_icmp_type_end = tc->spd_typecode_type; 651 else 652 sel->ipsl_icmp_type_end = tc->spd_typecode_type_end; 653 654 if (tc->spd_typecode_code != 255) { 655 sel->ipsl_valid |= IPSL_ICMP_CODE; 656 sel->ipsl_icmp_code = tc->spd_typecode_code; 657 if (tc->spd_typecode_code_end < tc->spd_typecode_code) 658 sel->ipsl_icmp_code_end = tc->spd_typecode_code; 659 else 660 sel->ipsl_icmp_code_end = 661 tc->spd_typecode_code_end; 662 } 663 } 664 #define ADDR2SEL(sel, extv, field, pfield, extn, bit) \ 665 if ((extv)[(extn)] != NULL) { \ 666 uint_t addrlen; \ 667 struct spd_address *ap = \ 668 (struct spd_address *)((extv)[(extn)]); \ 669 addrlen = (ap->spd_address_af == AF_INET6) ? \ 670 IPV6_ADDR_LEN : IP_ADDR_LEN; \ 671 if (SPD_64TO8(ap->spd_address_len) < \ 672 (addrlen + sizeof (*ap))) { \ 673 *diag = SPD_DIAGNOSTIC_BAD_ADDR_LEN; \ 674 return (B_FALSE); \ 675 } \ 676 bcopy((ap+1), &((sel)->field), addrlen); \ 677 (sel)->pfield = ap->spd_address_prefixlen; \ 678 (sel)->ipsl_valid |= (bit); \ 679 (sel)->ipsl_valid |= (ap->spd_address_af == AF_INET6) ? \ 680 IPSL_IPV6 : IPSL_IPV4; \ 681 } 682 683 ADDR2SEL(sel, extv, ipsl_local, ipsl_local_pfxlen, 684 SPD_EXT_LCLADDR, IPSL_LOCAL_ADDR); 685 ADDR2SEL(sel, extv, ipsl_remote, ipsl_remote_pfxlen, 686 SPD_EXT_REMADDR, IPSL_REMOTE_ADDR); 687 688 if ((sel->ipsl_valid & (IPSL_IPV6|IPSL_IPV4)) == 689 (IPSL_IPV6|IPSL_IPV4)) { 690 *diag = SPD_DIAGNOSTIC_MIXED_AF; 691 return (B_FALSE); 692 } 693 694 #undef ADDR2SEL 695 696 return (B_TRUE); 697 } 698 699 static boolean_t 700 spd_convert_type(uint32_t type, ipsec_act_t *act) 701 { 702 switch (type) { 703 case SPD_ACTTYPE_DROP: 704 act->ipa_type = IPSEC_ACT_DISCARD; 705 return (B_TRUE); 706 707 case SPD_ACTTYPE_PASS: 708 act->ipa_type = IPSEC_ACT_CLEAR; 709 return (B_TRUE); 710 711 case SPD_ACTTYPE_IPSEC: 712 act->ipa_type = IPSEC_ACT_APPLY; 713 return (B_TRUE); 714 } 715 return (B_FALSE); 716 } 717 718 static boolean_t 719 spd_convert_flags(uint32_t flags, ipsec_act_t *act) 720 { 721 /* 722 * Note use of !! for boolean canonicalization. 723 */ 724 act->ipa_apply.ipp_use_ah = !!(flags & SPD_APPLY_AH); 725 act->ipa_apply.ipp_use_esp = !!(flags & SPD_APPLY_ESP); 726 act->ipa_apply.ipp_use_espa = !!(flags & SPD_APPLY_ESPA); 727 act->ipa_apply.ipp_use_se = !!(flags & SPD_APPLY_SE); 728 act->ipa_apply.ipp_use_unique = !!(flags & SPD_APPLY_UNIQUE); 729 return (B_TRUE); 730 } 731 732 static void 733 spdsock_reset_act(ipsec_act_t *act) 734 { 735 bzero(act, sizeof (*act)); 736 act->ipa_apply.ipp_espe_maxbits = IPSEC_MAX_KEYBITS; 737 act->ipa_apply.ipp_espa_maxbits = IPSEC_MAX_KEYBITS; 738 act->ipa_apply.ipp_ah_maxbits = IPSEC_MAX_KEYBITS; 739 } 740 741 /* 742 * Sanity check action against reality, and shrink-wrap key sizes.. 743 */ 744 static boolean_t 745 spdsock_check_action(ipsec_act_t *act, boolean_t tunnel_polhead, int *diag, 746 spd_stack_t *spds) 747 { 748 if (tunnel_polhead && act->ipa_apply.ipp_use_unique) { 749 *diag = SPD_DIAGNOSTIC_ADD_INCON_FLAGS; 750 return (B_FALSE); 751 } 752 if ((act->ipa_type != IPSEC_ACT_APPLY) && 753 (act->ipa_apply.ipp_use_ah || 754 act->ipa_apply.ipp_use_esp || 755 act->ipa_apply.ipp_use_espa || 756 act->ipa_apply.ipp_use_se || 757 act->ipa_apply.ipp_use_unique)) { 758 *diag = SPD_DIAGNOSTIC_ADD_INCON_FLAGS; 759 return (B_FALSE); 760 } 761 if ((act->ipa_type == IPSEC_ACT_APPLY) && 762 !act->ipa_apply.ipp_use_ah && 763 !act->ipa_apply.ipp_use_esp) { 764 *diag = SPD_DIAGNOSTIC_ADD_INCON_FLAGS; 765 return (B_FALSE); 766 } 767 return (ipsec_check_action(act, diag, spds->spds_netstack)); 768 } 769 770 /* 771 * We may be short a few error checks here.. 772 */ 773 static boolean_t 774 spdsock_ext_to_actvec(spd_ext_t **extv, ipsec_act_t **actpp, uint_t *nactp, 775 int *diag, spd_stack_t *spds) 776 { 777 struct spd_ext_actions *sactp = 778 (struct spd_ext_actions *)extv[SPD_EXT_ACTION]; 779 ipsec_act_t act, *actp, *endactp; 780 struct spd_attribute *attrp, *endattrp; 781 uint64_t *endp; 782 int nact; 783 boolean_t tunnel_polhead; 784 785 tunnel_polhead = (extv[SPD_EXT_TUN_NAME] != NULL && 786 (((struct spd_rule *)extv[SPD_EXT_RULE])->spd_rule_flags & 787 SPD_RULE_FLAG_TUNNEL)); 788 789 *actpp = NULL; 790 *nactp = 0; 791 792 if (sactp == NULL) { 793 *diag = SPD_DIAGNOSTIC_NO_ACTION_EXT; 794 return (B_FALSE); 795 } 796 797 /* 798 * Parse the "action" extension and convert into an action chain. 799 */ 800 801 nact = sactp->spd_actions_count; 802 803 endp = (uint64_t *)sactp; 804 endp += sactp->spd_actions_len; 805 endattrp = (struct spd_attribute *)endp; 806 807 actp = kmem_alloc(sizeof (*actp) * nact, KM_NOSLEEP); 808 if (actp == NULL) { 809 *diag = SPD_DIAGNOSTIC_ADD_NO_MEM; 810 return (B_FALSE); 811 } 812 *actpp = actp; 813 *nactp = nact; 814 endactp = actp + nact; 815 816 spdsock_reset_act(&act); 817 attrp = (struct spd_attribute *)(&sactp[1]); 818 819 for (; attrp < endattrp; attrp++) { 820 switch (attrp->spd_attr_tag) { 821 case SPD_ATTR_NOP: 822 break; 823 824 case SPD_ATTR_EMPTY: 825 spdsock_reset_act(&act); 826 break; 827 828 case SPD_ATTR_END: 829 attrp = endattrp; 830 /* FALLTHRU */ 831 case SPD_ATTR_NEXT: 832 if (actp >= endactp) { 833 *diag = SPD_DIAGNOSTIC_ADD_WRONG_ACT_COUNT; 834 goto fail; 835 } 836 if (!spdsock_check_action(&act, tunnel_polhead, 837 diag, spds)) 838 goto fail; 839 *actp++ = act; 840 spdsock_reset_act(&act); 841 break; 842 843 case SPD_ATTR_TYPE: 844 if (!spd_convert_type(attrp->spd_attr_value, &act)) { 845 *diag = SPD_DIAGNOSTIC_ADD_BAD_TYPE; 846 goto fail; 847 } 848 break; 849 850 case SPD_ATTR_FLAGS: 851 if (!tunnel_polhead && extv[SPD_EXT_TUN_NAME] != NULL) { 852 /* 853 * Set "sa unique" for transport-mode 854 * tunnels whether we want to or not. 855 */ 856 attrp->spd_attr_value |= SPD_APPLY_UNIQUE; 857 } 858 if (!spd_convert_flags(attrp->spd_attr_value, &act)) { 859 *diag = SPD_DIAGNOSTIC_ADD_BAD_FLAGS; 860 goto fail; 861 } 862 break; 863 864 case SPD_ATTR_AH_AUTH: 865 if (attrp->spd_attr_value == 0) { 866 *diag = SPD_DIAGNOSTIC_UNSUPP_AH_ALG; 867 goto fail; 868 } 869 act.ipa_apply.ipp_auth_alg = attrp->spd_attr_value; 870 break; 871 872 case SPD_ATTR_ESP_ENCR: 873 if (attrp->spd_attr_value == 0) { 874 *diag = SPD_DIAGNOSTIC_UNSUPP_ESP_ENCR_ALG; 875 goto fail; 876 } 877 act.ipa_apply.ipp_encr_alg = attrp->spd_attr_value; 878 break; 879 880 case SPD_ATTR_ESP_AUTH: 881 if (attrp->spd_attr_value == 0) { 882 *diag = SPD_DIAGNOSTIC_UNSUPP_ESP_AUTH_ALG; 883 goto fail; 884 } 885 act.ipa_apply.ipp_esp_auth_alg = attrp->spd_attr_value; 886 break; 887 888 case SPD_ATTR_ENCR_MINBITS: 889 act.ipa_apply.ipp_espe_minbits = attrp->spd_attr_value; 890 break; 891 892 case SPD_ATTR_ENCR_MAXBITS: 893 act.ipa_apply.ipp_espe_maxbits = attrp->spd_attr_value; 894 break; 895 896 case SPD_ATTR_AH_MINBITS: 897 act.ipa_apply.ipp_ah_minbits = attrp->spd_attr_value; 898 break; 899 900 case SPD_ATTR_AH_MAXBITS: 901 act.ipa_apply.ipp_ah_maxbits = attrp->spd_attr_value; 902 break; 903 904 case SPD_ATTR_ESPA_MINBITS: 905 act.ipa_apply.ipp_espa_minbits = attrp->spd_attr_value; 906 break; 907 908 case SPD_ATTR_ESPA_MAXBITS: 909 act.ipa_apply.ipp_espa_maxbits = attrp->spd_attr_value; 910 break; 911 912 case SPD_ATTR_LIFE_SOFT_TIME: 913 case SPD_ATTR_LIFE_HARD_TIME: 914 case SPD_ATTR_LIFE_SOFT_BYTES: 915 case SPD_ATTR_LIFE_HARD_BYTES: 916 break; 917 918 case SPD_ATTR_KM_PROTO: 919 act.ipa_apply.ipp_km_proto = attrp->spd_attr_value; 920 break; 921 922 case SPD_ATTR_KM_COOKIE: 923 act.ipa_apply.ipp_km_cookie = attrp->spd_attr_value; 924 break; 925 926 case SPD_ATTR_REPLAY_DEPTH: 927 act.ipa_apply.ipp_replay_depth = attrp->spd_attr_value; 928 break; 929 } 930 } 931 if (actp != endactp) { 932 *diag = SPD_DIAGNOSTIC_ADD_WRONG_ACT_COUNT; 933 goto fail; 934 } 935 936 return (B_TRUE); 937 fail: 938 ipsec_actvec_free(*actpp, nact); 939 *actpp = NULL; 940 return (B_FALSE); 941 } 942 943 typedef struct 944 { 945 ipsec_policy_t *pol; 946 int dir; 947 } tmprule_t; 948 949 static int 950 mkrule(ipsec_policy_head_t *iph, struct spd_rule *rule, 951 ipsec_selkey_t *sel, ipsec_act_t *actp, int nact, uint_t dir, uint_t af, 952 tmprule_t **rp, uint64_t *index, spd_stack_t *spds) 953 { 954 ipsec_policy_t *pol; 955 956 sel->ipsl_valid &= ~(IPSL_IPV6|IPSL_IPV4); 957 sel->ipsl_valid |= af; 958 959 pol = ipsec_policy_create(sel, actp, nact, rule->spd_rule_priority, 960 index, spds->spds_netstack); 961 if (pol == NULL) 962 return (ENOMEM); 963 964 (*rp)->pol = pol; 965 (*rp)->dir = dir; 966 (*rp)++; 967 968 if (!ipsec_check_policy(iph, pol, dir)) 969 return (EEXIST); 970 971 rule->spd_rule_index = pol->ipsp_index; 972 return (0); 973 } 974 975 static int 976 mkrulepair(ipsec_policy_head_t *iph, struct spd_rule *rule, 977 ipsec_selkey_t *sel, ipsec_act_t *actp, int nact, uint_t dir, uint_t afs, 978 tmprule_t **rp, uint64_t *index, spd_stack_t *spds) 979 { 980 int error; 981 982 if (afs & IPSL_IPV4) { 983 error = mkrule(iph, rule, sel, actp, nact, dir, IPSL_IPV4, rp, 984 index, spds); 985 if (error != 0) 986 return (error); 987 } 988 if (afs & IPSL_IPV6) { 989 error = mkrule(iph, rule, sel, actp, nact, dir, IPSL_IPV6, rp, 990 index, spds); 991 if (error != 0) 992 return (error); 993 } 994 return (0); 995 } 996 997 998 static void 999 spdsock_addrule(queue_t *q, ipsec_policy_head_t *iph, mblk_t *mp, 1000 spd_ext_t **extv, ipsec_tun_pol_t *itp) 1001 { 1002 ipsec_selkey_t sel; 1003 ipsec_act_t *actp; 1004 uint_t nact; 1005 int diag = 0, error, afs; 1006 struct spd_rule *rule = (struct spd_rule *)extv[SPD_EXT_RULE]; 1007 tmprule_t rules[4], *rulep = &rules[0]; 1008 boolean_t tunnel_mode, empty_itp, active; 1009 uint64_t *index = (itp == NULL) ? NULL : &itp->itp_next_policy_index; 1010 spdsock_t *ss = (spdsock_t *)q->q_ptr; 1011 spd_stack_t *spds = ss->spdsock_spds; 1012 1013 if (rule == NULL) { 1014 spdsock_diag(q, mp, SPD_DIAGNOSTIC_NO_RULE_EXT); 1015 if (audit_active) { 1016 spd_msg_t *spmsg = (spd_msg_t *)mp->b_rptr; 1017 1018 active = (spmsg->spd_msg_spdid == SPD_ACTIVE); 1019 audit_pf_policy(SPD_ADDRULE, DB_CRED(mp), 1020 spds->spds_netstack, ITP_NAME(itp), active, 1021 SPD_DIAGNOSTIC_NO_RULE_EXT, DB_CPID(mp)); 1022 } 1023 return; 1024 } 1025 1026 tunnel_mode = (rule->spd_rule_flags & SPD_RULE_FLAG_TUNNEL); 1027 1028 if (itp != NULL) { 1029 mutex_enter(&itp->itp_lock); 1030 ASSERT(itp->itp_policy == iph || itp->itp_inactive == iph); 1031 active = (itp->itp_policy == iph); 1032 if (ITP_P_ISACTIVE(itp, iph)) { 1033 /* Check for mix-and-match of tunnel/transport. */ 1034 if ((tunnel_mode && !ITP_P_ISTUNNEL(itp, iph)) || 1035 (!tunnel_mode && ITP_P_ISTUNNEL(itp, iph))) { 1036 mutex_exit(&itp->itp_lock); 1037 spdsock_error(q, mp, EBUSY, 0); 1038 return; 1039 } 1040 empty_itp = B_FALSE; 1041 } else { 1042 empty_itp = B_TRUE; 1043 itp->itp_flags = active ? ITPF_P_ACTIVE : ITPF_I_ACTIVE; 1044 if (tunnel_mode) 1045 itp->itp_flags |= active ? ITPF_P_TUNNEL : 1046 ITPF_I_TUNNEL; 1047 } 1048 } else { 1049 empty_itp = B_FALSE; 1050 } 1051 1052 if (rule->spd_rule_index != 0) { 1053 diag = SPD_DIAGNOSTIC_INVALID_RULE_INDEX; 1054 error = EINVAL; 1055 goto fail2; 1056 } 1057 1058 if (!spdsock_ext_to_sel(extv, &sel, &diag)) { 1059 error = EINVAL; 1060 goto fail2; 1061 } 1062 1063 if (itp != NULL) { 1064 if (tunnel_mode) { 1065 if (sel.ipsl_valid & 1066 (IPSL_REMOTE_PORT | IPSL_LOCAL_PORT)) { 1067 itp->itp_flags |= active ? 1068 ITPF_P_PER_PORT_SECURITY : 1069 ITPF_I_PER_PORT_SECURITY; 1070 } 1071 } else { 1072 /* 1073 * For now, we don't allow transport-mode on a tunnel 1074 * with ANY specific selectors. Bail if we have such 1075 * a request. 1076 */ 1077 if (sel.ipsl_valid & IPSL_WILDCARD) { 1078 diag = SPD_DIAGNOSTIC_NO_TUNNEL_SELECTORS; 1079 error = EINVAL; 1080 goto fail2; 1081 } 1082 } 1083 } 1084 1085 if (!spdsock_ext_to_actvec(extv, &actp, &nact, &diag, spds)) { 1086 error = EINVAL; 1087 goto fail2; 1088 } 1089 /* 1090 * If no addresses were specified, add both. 1091 */ 1092 afs = sel.ipsl_valid & (IPSL_IPV6|IPSL_IPV4); 1093 if (afs == 0) 1094 afs = (IPSL_IPV6|IPSL_IPV4); 1095 1096 rw_enter(&iph->iph_lock, RW_WRITER); 1097 1098 if (rule->spd_rule_flags & SPD_RULE_FLAG_OUTBOUND) { 1099 error = mkrulepair(iph, rule, &sel, actp, nact, 1100 IPSEC_TYPE_OUTBOUND, afs, &rulep, index, spds); 1101 if (error != 0) 1102 goto fail; 1103 } 1104 1105 if (rule->spd_rule_flags & SPD_RULE_FLAG_INBOUND) { 1106 error = mkrulepair(iph, rule, &sel, actp, nact, 1107 IPSEC_TYPE_INBOUND, afs, &rulep, index, spds); 1108 if (error != 0) 1109 goto fail; 1110 } 1111 1112 while ((--rulep) >= &rules[0]) { 1113 ipsec_enter_policy(iph, rulep->pol, rulep->dir, 1114 spds->spds_netstack); 1115 } 1116 rw_exit(&iph->iph_lock); 1117 if (itp != NULL) 1118 mutex_exit(&itp->itp_lock); 1119 1120 ipsec_actvec_free(actp, nact); 1121 spd_echo(q, mp); 1122 if (audit_active) { 1123 spd_msg_t *spmsg = (spd_msg_t *)mp->b_rptr; 1124 1125 active = (spmsg->spd_msg_spdid == SPD_ACTIVE); 1126 audit_pf_policy(SPD_ADDRULE, DB_CRED(mp), spds->spds_netstack, 1127 ITP_NAME(itp), active, 0, DB_CPID(mp)); 1128 } 1129 return; 1130 1131 fail: 1132 rw_exit(&iph->iph_lock); 1133 while ((--rulep) >= &rules[0]) { 1134 IPPOL_REFRELE(rulep->pol, spds->spds_netstack); 1135 } 1136 ipsec_actvec_free(actp, nact); 1137 fail2: 1138 if (itp != NULL) { 1139 if (empty_itp) 1140 itp->itp_flags = 0; 1141 mutex_exit(&itp->itp_lock); 1142 } 1143 spdsock_error(q, mp, error, diag); 1144 if (audit_active) { 1145 spd_msg_t *spmsg = (spd_msg_t *)mp->b_rptr; 1146 1147 active = (spmsg->spd_msg_spdid == SPD_ACTIVE); 1148 audit_pf_policy(SPD_ADDRULE, DB_CRED(mp), spds->spds_netstack, 1149 ITP_NAME(itp), active, error, DB_CPID(mp)); 1150 } 1151 } 1152 1153 void 1154 spdsock_deleterule(queue_t *q, ipsec_policy_head_t *iph, mblk_t *mp, 1155 spd_ext_t **extv, ipsec_tun_pol_t *itp) 1156 { 1157 ipsec_selkey_t sel; 1158 struct spd_rule *rule = (struct spd_rule *)extv[SPD_EXT_RULE]; 1159 int err, diag = 0; 1160 spdsock_t *ss = (spdsock_t *)q->q_ptr; 1161 netstack_t *ns = ss->spdsock_spds->spds_netstack; 1162 1163 if (rule == NULL) { 1164 spdsock_diag(q, mp, SPD_DIAGNOSTIC_NO_RULE_EXT); 1165 if (audit_active) { 1166 boolean_t active; 1167 spd_msg_t *spmsg = (spd_msg_t *)mp->b_rptr; 1168 1169 active = (spmsg->spd_msg_spdid == SPD_ACTIVE); 1170 audit_pf_policy(SPD_DELETERULE, DB_CRED(mp), ns, 1171 ITP_NAME(itp), active, SPD_DIAGNOSTIC_NO_RULE_EXT, 1172 DB_CPID(mp)); 1173 } 1174 return; 1175 } 1176 1177 /* 1178 * Must enter itp_lock first to avoid deadlock. See tun.c's 1179 * set_sec_simple() for the other case of itp_lock and iph_lock. 1180 */ 1181 if (itp != NULL) 1182 mutex_enter(&itp->itp_lock); 1183 1184 if (rule->spd_rule_index != 0) { 1185 if (ipsec_policy_delete_index(iph, rule->spd_rule_index, ns) != 1186 0) { 1187 err = ESRCH; 1188 goto fail; 1189 } 1190 } else { 1191 if (!spdsock_ext_to_sel(extv, &sel, &diag)) { 1192 err = EINVAL; /* diag already set... */ 1193 goto fail; 1194 } 1195 1196 if ((rule->spd_rule_flags & SPD_RULE_FLAG_INBOUND) && 1197 !ipsec_policy_delete(iph, &sel, IPSEC_TYPE_INBOUND, ns)) { 1198 err = ESRCH; 1199 goto fail; 1200 } 1201 1202 if ((rule->spd_rule_flags & SPD_RULE_FLAG_OUTBOUND) && 1203 !ipsec_policy_delete(iph, &sel, IPSEC_TYPE_OUTBOUND, ns)) { 1204 err = ESRCH; 1205 goto fail; 1206 } 1207 } 1208 1209 if (itp != NULL) { 1210 ASSERT(iph == itp->itp_policy || iph == itp->itp_inactive); 1211 rw_enter(&iph->iph_lock, RW_READER); 1212 if (avl_numnodes(&iph->iph_rulebyid) == 0) { 1213 if (iph == itp->itp_policy) 1214 itp->itp_flags &= ~ITPF_PFLAGS; 1215 else 1216 itp->itp_flags &= ~ITPF_IFLAGS; 1217 } 1218 /* Can exit locks in any order. */ 1219 rw_exit(&iph->iph_lock); 1220 mutex_exit(&itp->itp_lock); 1221 } 1222 spd_echo(q, mp); 1223 if (audit_active) { 1224 boolean_t active; 1225 spd_msg_t *spmsg = (spd_msg_t *)mp->b_rptr; 1226 1227 active = (spmsg->spd_msg_spdid == SPD_ACTIVE); 1228 audit_pf_policy(SPD_DELETERULE, DB_CRED(mp), ns, ITP_NAME(itp), 1229 active, 0, DB_CPID(mp)); 1230 } 1231 return; 1232 fail: 1233 if (itp != NULL) 1234 mutex_exit(&itp->itp_lock); 1235 spdsock_error(q, mp, err, diag); 1236 if (audit_active) { 1237 boolean_t active; 1238 spd_msg_t *spmsg = (spd_msg_t *)mp->b_rptr; 1239 1240 active = (spmsg->spd_msg_spdid == SPD_ACTIVE); 1241 audit_pf_policy(SPD_DELETERULE, DB_CRED(mp), ns, ITP_NAME(itp), 1242 active, err, DB_CPID(mp)); 1243 } 1244 } 1245 1246 /* Do NOT consume a reference to itp. */ 1247 /* ARGSUSED */ 1248 static void 1249 spdsock_flip_node(ipsec_tun_pol_t *itp, void *ignoreme, netstack_t *ns) 1250 { 1251 mutex_enter(&itp->itp_lock); 1252 ITPF_SWAP(itp->itp_flags); 1253 ipsec_swap_policy(itp->itp_policy, itp->itp_inactive, ns); 1254 mutex_exit(&itp->itp_lock); 1255 } 1256 1257 void 1258 spdsock_flip(queue_t *q, mblk_t *mp, spd_if_t *tunname) 1259 { 1260 char *tname; 1261 ipsec_tun_pol_t *itp; 1262 spdsock_t *ss = (spdsock_t *)q->q_ptr; 1263 netstack_t *ns = ss->spdsock_spds->spds_netstack; 1264 1265 if (tunname != NULL) { 1266 tname = (char *)tunname->spd_if_name; 1267 if (*tname == '\0') { 1268 /* can't fail */ 1269 ipsec_swap_global_policy(ns); 1270 if (audit_active) { 1271 boolean_t active; 1272 spd_msg_t *spmsg = (spd_msg_t *)mp->b_rptr; 1273 1274 active = (spmsg->spd_msg_spdid == SPD_ACTIVE); 1275 audit_pf_policy(SPD_FLIP, DB_CRED(mp), 1276 ns, NULL, active, 0, DB_CPID(mp)); 1277 } 1278 itp_walk(spdsock_flip_node, NULL, ns); 1279 if (audit_active) { 1280 boolean_t active; 1281 spd_msg_t *spmsg = (spd_msg_t *)mp->b_rptr; 1282 1283 active = (spmsg->spd_msg_spdid == SPD_ACTIVE); 1284 audit_pf_policy(SPD_FLIP, DB_CRED(mp), ns, 1285 "all tunnels", active, 0, DB_CPID(mp)); 1286 } 1287 } else { 1288 itp = get_tunnel_policy(tname, ns); 1289 if (itp == NULL) { 1290 /* Better idea for "tunnel not found"? */ 1291 spdsock_error(q, mp, ESRCH, 0); 1292 if (audit_active) { 1293 boolean_t active; 1294 spd_msg_t *spmsg = 1295 (spd_msg_t *)mp->b_rptr; 1296 1297 active = (spmsg->spd_msg_spdid == 1298 SPD_ACTIVE); 1299 audit_pf_policy(SPD_FLIP, DB_CRED(mp), 1300 ns, ITP_NAME(itp), active, 1301 ESRCH, DB_CPID(mp)); 1302 } 1303 return; 1304 } 1305 spdsock_flip_node(itp, NULL, NULL); 1306 if (audit_active) { 1307 boolean_t active; 1308 spd_msg_t *spmsg = (spd_msg_t *)mp->b_rptr; 1309 1310 active = (spmsg->spd_msg_spdid == SPD_ACTIVE); 1311 audit_pf_policy(SPD_FLIP, DB_CRED(mp), ns, 1312 ITP_NAME(itp), active, 0, DB_CPID(mp)); 1313 } 1314 ITP_REFRELE(itp, ns); 1315 } 1316 } else { 1317 ipsec_swap_global_policy(ns); /* can't fail */ 1318 if (audit_active) { 1319 boolean_t active; 1320 spd_msg_t *spmsg = (spd_msg_t *)mp->b_rptr; 1321 1322 active = (spmsg->spd_msg_spdid == SPD_ACTIVE); 1323 audit_pf_policy(SPD_FLIP, DB_CRED(mp), 1324 ns, NULL, active, 0, DB_CPID(mp)); 1325 } 1326 } 1327 spd_echo(q, mp); 1328 } 1329 1330 /* 1331 * Unimplemented feature 1332 */ 1333 /* ARGSUSED */ 1334 static void 1335 spdsock_lookup(queue_t *q, ipsec_policy_head_t *iph, mblk_t *mp, 1336 spd_ext_t **extv, ipsec_tun_pol_t *itp) 1337 { 1338 spdsock_error(q, mp, EINVAL, 0); 1339 } 1340 1341 1342 static mblk_t * 1343 spdsock_dump_ruleset(mblk_t *req, ipsec_policy_head_t *iph, 1344 uint32_t count, uint16_t error) 1345 { 1346 size_t len = sizeof (spd_ruleset_ext_t) + sizeof (spd_msg_t); 1347 spd_msg_t *msg; 1348 spd_ruleset_ext_t *ruleset; 1349 mblk_t *m = allocb(len, BPRI_HI); 1350 1351 ASSERT(RW_READ_HELD(&iph->iph_lock)); 1352 1353 if (m == NULL) { 1354 return (NULL); 1355 } 1356 msg = (spd_msg_t *)m->b_rptr; 1357 ruleset = (spd_ruleset_ext_t *)(&msg[1]); 1358 1359 m->b_wptr = (uint8_t *)&ruleset[1]; 1360 1361 *msg = *(spd_msg_t *)(req->b_rptr); 1362 msg->spd_msg_len = SPD_8TO64(len); 1363 msg->spd_msg_errno = error; 1364 1365 ruleset->spd_ruleset_len = SPD_8TO64(sizeof (*ruleset)); 1366 ruleset->spd_ruleset_type = SPD_EXT_RULESET; 1367 ruleset->spd_ruleset_count = count; 1368 ruleset->spd_ruleset_version = iph->iph_gen; 1369 return (m); 1370 } 1371 1372 static mblk_t * 1373 spdsock_dump_finish(spdsock_t *ss, int error) 1374 { 1375 mblk_t *m; 1376 ipsec_policy_head_t *iph = ss->spdsock_dump_head; 1377 mblk_t *req = ss->spdsock_dump_req; 1378 1379 rw_enter(&iph->iph_lock, RW_READER); 1380 m = spdsock_dump_ruleset(req, iph, ss->spdsock_dump_count, error); 1381 rw_exit(&iph->iph_lock); 1382 IPPH_REFRELE(iph, ss->spdsock_spds->spds_netstack); 1383 ss->spdsock_dump_req = NULL; 1384 freemsg(req); 1385 1386 return (m); 1387 } 1388 1389 /* 1390 * Rule encoding functions. 1391 * We do a two-pass encode. 1392 * If base != NULL, fill in encoded rule part starting at base+offset. 1393 * Always return "offset" plus length of to-be-encoded data. 1394 */ 1395 static uint_t 1396 spdsock_encode_typecode(uint8_t *base, uint_t offset, uint8_t type, 1397 uint8_t type_end, uint8_t code, uint8_t code_end) 1398 { 1399 struct spd_typecode *tcp; 1400 1401 ASSERT(ALIGNED64(offset)); 1402 1403 if (base != NULL) { 1404 tcp = (struct spd_typecode *)(base + offset); 1405 tcp->spd_typecode_len = SPD_8TO64(sizeof (*tcp)); 1406 tcp->spd_typecode_exttype = SPD_EXT_ICMP_TYPECODE; 1407 tcp->spd_typecode_code = code; 1408 tcp->spd_typecode_type = type; 1409 tcp->spd_typecode_type_end = type_end; 1410 tcp->spd_typecode_code_end = code_end; 1411 } 1412 offset += sizeof (*tcp); 1413 1414 ASSERT(ALIGNED64(offset)); 1415 1416 return (offset); 1417 } 1418 1419 static uint_t 1420 spdsock_encode_proto(uint8_t *base, uint_t offset, uint8_t proto) 1421 { 1422 struct spd_proto *spp; 1423 1424 ASSERT(ALIGNED64(offset)); 1425 1426 if (base != NULL) { 1427 spp = (struct spd_proto *)(base + offset); 1428 spp->spd_proto_len = SPD_8TO64(sizeof (*spp)); 1429 spp->spd_proto_exttype = SPD_EXT_PROTO; 1430 spp->spd_proto_number = proto; 1431 spp->spd_proto_reserved1 = 0; 1432 spp->spd_proto_reserved2 = 0; 1433 } 1434 offset += sizeof (*spp); 1435 1436 ASSERT(ALIGNED64(offset)); 1437 1438 return (offset); 1439 } 1440 1441 static uint_t 1442 spdsock_encode_port(uint8_t *base, uint_t offset, uint16_t ext, uint16_t port) 1443 { 1444 struct spd_portrange *spp; 1445 1446 ASSERT(ALIGNED64(offset)); 1447 1448 if (base != NULL) { 1449 spp = (struct spd_portrange *)(base + offset); 1450 spp->spd_ports_len = SPD_8TO64(sizeof (*spp)); 1451 spp->spd_ports_exttype = ext; 1452 spp->spd_ports_minport = port; 1453 spp->spd_ports_maxport = port; 1454 } 1455 offset += sizeof (*spp); 1456 1457 ASSERT(ALIGNED64(offset)); 1458 1459 return (offset); 1460 } 1461 1462 static uint_t 1463 spdsock_encode_addr(uint8_t *base, uint_t offset, uint16_t ext, 1464 const ipsec_selkey_t *sel, const ipsec_addr_t *addr, uint_t pfxlen) 1465 { 1466 struct spd_address *sae; 1467 ipsec_addr_t *spdaddr; 1468 uint_t start = offset; 1469 uint_t addrlen; 1470 uint_t af; 1471 1472 if (sel->ipsl_valid & IPSL_IPV4) { 1473 af = AF_INET; 1474 addrlen = IP_ADDR_LEN; 1475 } else { 1476 af = AF_INET6; 1477 addrlen = IPV6_ADDR_LEN; 1478 } 1479 1480 ASSERT(ALIGNED64(offset)); 1481 1482 if (base != NULL) { 1483 sae = (struct spd_address *)(base + offset); 1484 sae->spd_address_exttype = ext; 1485 sae->spd_address_af = af; 1486 sae->spd_address_prefixlen = pfxlen; 1487 sae->spd_address_reserved2 = 0; 1488 1489 spdaddr = (ipsec_addr_t *)(&sae[1]); 1490 bcopy(addr, spdaddr, addrlen); 1491 } 1492 offset += sizeof (*sae); 1493 addrlen = roundup(addrlen, sizeof (uint64_t)); 1494 offset += addrlen; 1495 1496 ASSERT(ALIGNED64(offset)); 1497 1498 if (base != NULL) 1499 sae->spd_address_len = SPD_8TO64(offset - start); 1500 return (offset); 1501 } 1502 1503 static uint_t 1504 spdsock_encode_sel(uint8_t *base, uint_t offset, const ipsec_sel_t *sel) 1505 { 1506 const ipsec_selkey_t *selkey = &sel->ipsl_key; 1507 1508 if (selkey->ipsl_valid & IPSL_PROTOCOL) 1509 offset = spdsock_encode_proto(base, offset, selkey->ipsl_proto); 1510 if (selkey->ipsl_valid & IPSL_LOCAL_PORT) 1511 offset = spdsock_encode_port(base, offset, SPD_EXT_LCLPORT, 1512 selkey->ipsl_lport); 1513 if (selkey->ipsl_valid & IPSL_REMOTE_PORT) 1514 offset = spdsock_encode_port(base, offset, SPD_EXT_REMPORT, 1515 selkey->ipsl_rport); 1516 if (selkey->ipsl_valid & IPSL_REMOTE_ADDR) 1517 offset = spdsock_encode_addr(base, offset, SPD_EXT_REMADDR, 1518 selkey, &selkey->ipsl_remote, selkey->ipsl_remote_pfxlen); 1519 if (selkey->ipsl_valid & IPSL_LOCAL_ADDR) 1520 offset = spdsock_encode_addr(base, offset, SPD_EXT_LCLADDR, 1521 selkey, &selkey->ipsl_local, selkey->ipsl_local_pfxlen); 1522 if (selkey->ipsl_valid & IPSL_ICMP_TYPE) { 1523 offset = spdsock_encode_typecode(base, offset, 1524 selkey->ipsl_icmp_type, selkey->ipsl_icmp_type_end, 1525 (selkey->ipsl_valid & IPSL_ICMP_CODE) ? 1526 selkey->ipsl_icmp_code : 255, 1527 (selkey->ipsl_valid & IPSL_ICMP_CODE) ? 1528 selkey->ipsl_icmp_code_end : 255); 1529 } 1530 return (offset); 1531 } 1532 1533 static uint_t 1534 spdsock_encode_actattr(uint8_t *base, uint_t offset, uint32_t tag, 1535 uint32_t value) 1536 { 1537 struct spd_attribute *attr; 1538 1539 ASSERT(ALIGNED64(offset)); 1540 1541 if (base != NULL) { 1542 attr = (struct spd_attribute *)(base + offset); 1543 attr->spd_attr_tag = tag; 1544 attr->spd_attr_value = value; 1545 } 1546 offset += sizeof (struct spd_attribute); 1547 1548 ASSERT(ALIGNED64(offset)); 1549 1550 return (offset); 1551 } 1552 1553 1554 #define EMIT(t, v) offset = spdsock_encode_actattr(base, offset, (t), (v)) 1555 1556 static uint_t 1557 spdsock_encode_action(uint8_t *base, uint_t offset, const ipsec_action_t *ap) 1558 { 1559 const struct ipsec_act *act = &(ap->ipa_act); 1560 uint_t flags; 1561 1562 EMIT(SPD_ATTR_EMPTY, 0); 1563 switch (act->ipa_type) { 1564 case IPSEC_ACT_DISCARD: 1565 case IPSEC_ACT_REJECT: 1566 EMIT(SPD_ATTR_TYPE, SPD_ACTTYPE_DROP); 1567 break; 1568 case IPSEC_ACT_BYPASS: 1569 case IPSEC_ACT_CLEAR: 1570 EMIT(SPD_ATTR_TYPE, SPD_ACTTYPE_PASS); 1571 break; 1572 1573 case IPSEC_ACT_APPLY: 1574 EMIT(SPD_ATTR_TYPE, SPD_ACTTYPE_IPSEC); 1575 flags = 0; 1576 if (act->ipa_apply.ipp_use_ah) 1577 flags |= SPD_APPLY_AH; 1578 if (act->ipa_apply.ipp_use_esp) 1579 flags |= SPD_APPLY_ESP; 1580 if (act->ipa_apply.ipp_use_espa) 1581 flags |= SPD_APPLY_ESPA; 1582 if (act->ipa_apply.ipp_use_se) 1583 flags |= SPD_APPLY_SE; 1584 if (act->ipa_apply.ipp_use_unique) 1585 flags |= SPD_APPLY_UNIQUE; 1586 EMIT(SPD_ATTR_FLAGS, flags); 1587 if (flags & SPD_APPLY_AH) { 1588 EMIT(SPD_ATTR_AH_AUTH, act->ipa_apply.ipp_auth_alg); 1589 EMIT(SPD_ATTR_AH_MINBITS, 1590 act->ipa_apply.ipp_ah_minbits); 1591 EMIT(SPD_ATTR_AH_MAXBITS, 1592 act->ipa_apply.ipp_ah_maxbits); 1593 } 1594 if (flags & SPD_APPLY_ESP) { 1595 EMIT(SPD_ATTR_ESP_ENCR, act->ipa_apply.ipp_encr_alg); 1596 EMIT(SPD_ATTR_ENCR_MINBITS, 1597 act->ipa_apply.ipp_espe_minbits); 1598 EMIT(SPD_ATTR_ENCR_MAXBITS, 1599 act->ipa_apply.ipp_espe_maxbits); 1600 if (flags & SPD_APPLY_ESPA) { 1601 EMIT(SPD_ATTR_ESP_AUTH, 1602 act->ipa_apply.ipp_esp_auth_alg); 1603 EMIT(SPD_ATTR_ESPA_MINBITS, 1604 act->ipa_apply.ipp_espa_minbits); 1605 EMIT(SPD_ATTR_ESPA_MAXBITS, 1606 act->ipa_apply.ipp_espa_maxbits); 1607 } 1608 } 1609 if (act->ipa_apply.ipp_km_proto != 0) 1610 EMIT(SPD_ATTR_KM_PROTO, act->ipa_apply.ipp_km_proto); 1611 if (act->ipa_apply.ipp_km_cookie != 0) 1612 EMIT(SPD_ATTR_KM_PROTO, act->ipa_apply.ipp_km_cookie); 1613 if (act->ipa_apply.ipp_replay_depth != 0) 1614 EMIT(SPD_ATTR_REPLAY_DEPTH, 1615 act->ipa_apply.ipp_replay_depth); 1616 /* Add more here */ 1617 break; 1618 } 1619 1620 return (offset); 1621 } 1622 1623 static uint_t 1624 spdsock_encode_action_list(uint8_t *base, uint_t offset, 1625 const ipsec_action_t *ap) 1626 { 1627 struct spd_ext_actions *act; 1628 uint_t nact = 0; 1629 uint_t start = offset; 1630 1631 ASSERT(ALIGNED64(offset)); 1632 1633 if (base != NULL) { 1634 act = (struct spd_ext_actions *)(base + offset); 1635 act->spd_actions_len = 0; 1636 act->spd_actions_exttype = SPD_EXT_ACTION; 1637 act->spd_actions_count = 0; 1638 act->spd_actions_reserved = 0; 1639 } 1640 1641 offset += sizeof (*act); 1642 1643 ASSERT(ALIGNED64(offset)); 1644 1645 while (ap != NULL) { 1646 offset = spdsock_encode_action(base, offset, ap); 1647 ap = ap->ipa_next; 1648 nact++; 1649 if (ap != NULL) { 1650 EMIT(SPD_ATTR_NEXT, 0); 1651 } 1652 } 1653 EMIT(SPD_ATTR_END, 0); 1654 1655 ASSERT(ALIGNED64(offset)); 1656 1657 if (base != NULL) { 1658 act->spd_actions_count = nact; 1659 act->spd_actions_len = SPD_8TO64(offset - start); 1660 } 1661 1662 return (offset); 1663 } 1664 1665 #undef EMIT 1666 1667 /* ARGSUSED */ 1668 static uint_t 1669 spdsock_rule_flags(uint_t dir, uint_t af) 1670 { 1671 uint_t flags = 0; 1672 1673 if (dir == IPSEC_TYPE_INBOUND) 1674 flags |= SPD_RULE_FLAG_INBOUND; 1675 if (dir == IPSEC_TYPE_OUTBOUND) 1676 flags |= SPD_RULE_FLAG_OUTBOUND; 1677 1678 return (flags); 1679 } 1680 1681 1682 static uint_t 1683 spdsock_encode_rule_head(uint8_t *base, uint_t offset, spd_msg_t *req, 1684 const ipsec_policy_t *rule, uint_t dir, uint_t af, char *name, 1685 boolean_t tunnel) 1686 { 1687 struct spd_msg *spmsg; 1688 struct spd_rule *spr; 1689 spd_if_t *sid; 1690 1691 uint_t start = offset; 1692 1693 ASSERT(ALIGNED64(offset)); 1694 1695 if (base != NULL) { 1696 spmsg = (struct spd_msg *)(base + offset); 1697 bzero(spmsg, sizeof (*spmsg)); 1698 spmsg->spd_msg_version = PF_POLICY_V1; 1699 spmsg->spd_msg_type = SPD_DUMP; 1700 spmsg->spd_msg_seq = req->spd_msg_seq; 1701 spmsg->spd_msg_pid = req->spd_msg_pid; 1702 } 1703 offset += sizeof (struct spd_msg); 1704 1705 ASSERT(ALIGNED64(offset)); 1706 1707 if (base != NULL) { 1708 spr = (struct spd_rule *)(base + offset); 1709 spr->spd_rule_type = SPD_EXT_RULE; 1710 spr->spd_rule_priority = rule->ipsp_prio; 1711 spr->spd_rule_flags = spdsock_rule_flags(dir, af); 1712 if (tunnel) 1713 spr->spd_rule_flags |= SPD_RULE_FLAG_TUNNEL; 1714 spr->spd_rule_unused = 0; 1715 spr->spd_rule_len = SPD_8TO64(sizeof (*spr)); 1716 spr->spd_rule_index = rule->ipsp_index; 1717 } 1718 offset += sizeof (struct spd_rule); 1719 1720 /* 1721 * If we have an interface name (i.e. if this policy head came from 1722 * a tunnel), add the SPD_EXT_TUN_NAME extension. 1723 */ 1724 if (name != NULL) { 1725 1726 ASSERT(ALIGNED64(offset)); 1727 1728 if (base != NULL) { 1729 sid = (spd_if_t *)(base + offset); 1730 sid->spd_if_exttype = SPD_EXT_TUN_NAME; 1731 sid->spd_if_len = SPD_8TO64(sizeof (spd_if_t) + 1732 roundup((strlen(name) - 4), 8)); 1733 (void) strlcpy((char *)sid->spd_if_name, name, 1734 LIFNAMSIZ); 1735 } 1736 1737 offset += sizeof (spd_if_t) + roundup((strlen(name) - 4), 8); 1738 } 1739 1740 offset = spdsock_encode_sel(base, offset, rule->ipsp_sel); 1741 offset = spdsock_encode_action_list(base, offset, rule->ipsp_act); 1742 1743 ASSERT(ALIGNED64(offset)); 1744 1745 if (base != NULL) { 1746 spmsg->spd_msg_len = SPD_8TO64(offset - start); 1747 } 1748 return (offset); 1749 } 1750 1751 /* ARGSUSED */ 1752 static mblk_t * 1753 spdsock_encode_rule(mblk_t *req, const ipsec_policy_t *rule, 1754 uint_t dir, uint_t af, char *name, boolean_t tunnel) 1755 { 1756 mblk_t *m; 1757 uint_t len; 1758 spd_msg_t *mreq = (spd_msg_t *)req->b_rptr; 1759 1760 /* 1761 * Figure out how much space we'll need. 1762 */ 1763 len = spdsock_encode_rule_head(NULL, 0, mreq, rule, dir, af, name, 1764 tunnel); 1765 1766 /* 1767 * Allocate mblk. 1768 */ 1769 m = allocb(len, BPRI_HI); 1770 if (m == NULL) 1771 return (NULL); 1772 1773 /* 1774 * Fill it in.. 1775 */ 1776 m->b_wptr = m->b_rptr + len; 1777 bzero(m->b_rptr, len); 1778 (void) spdsock_encode_rule_head(m->b_rptr, 0, mreq, rule, dir, af, 1779 name, tunnel); 1780 return (m); 1781 } 1782 1783 static ipsec_policy_t * 1784 spdsock_dump_next_in_chain(spdsock_t *ss, ipsec_policy_head_t *iph, 1785 ipsec_policy_t *cur) 1786 { 1787 ASSERT(RW_READ_HELD(&iph->iph_lock)); 1788 1789 ss->spdsock_dump_count++; 1790 ss->spdsock_dump_cur_rule = cur->ipsp_hash.hash_next; 1791 return (cur); 1792 } 1793 1794 static ipsec_policy_t * 1795 spdsock_dump_next_rule(spdsock_t *ss, ipsec_policy_head_t *iph) 1796 { 1797 ipsec_policy_t *cur; 1798 ipsec_policy_root_t *ipr; 1799 int chain, nchains, type, af; 1800 1801 ASSERT(RW_READ_HELD(&iph->iph_lock)); 1802 1803 cur = ss->spdsock_dump_cur_rule; 1804 1805 if (cur != NULL) 1806 return (spdsock_dump_next_in_chain(ss, iph, cur)); 1807 1808 type = ss->spdsock_dump_cur_type; 1809 1810 next: 1811 chain = ss->spdsock_dump_cur_chain; 1812 ipr = &iph->iph_root[type]; 1813 nchains = ipr->ipr_nchains; 1814 1815 while (chain < nchains) { 1816 cur = ipr->ipr_hash[chain].hash_head; 1817 chain++; 1818 if (cur != NULL) { 1819 ss->spdsock_dump_cur_chain = chain; 1820 return (spdsock_dump_next_in_chain(ss, iph, cur)); 1821 } 1822 } 1823 ss->spdsock_dump_cur_chain = nchains; 1824 1825 af = ss->spdsock_dump_cur_af; 1826 while (af < IPSEC_NAF) { 1827 cur = ipr->ipr_nonhash[af]; 1828 af++; 1829 if (cur != NULL) { 1830 ss->spdsock_dump_cur_af = af; 1831 return (spdsock_dump_next_in_chain(ss, iph, cur)); 1832 } 1833 } 1834 1835 type++; 1836 if (type >= IPSEC_NTYPES) 1837 return (NULL); 1838 1839 ss->spdsock_dump_cur_chain = 0; 1840 ss->spdsock_dump_cur_type = type; 1841 ss->spdsock_dump_cur_af = IPSEC_AF_V4; 1842 goto next; 1843 1844 } 1845 1846 /* 1847 * If we're done with one policy head, but have more to go, we iterate through 1848 * another IPsec tunnel policy head (itp). Return NULL if it is an error 1849 * worthy of returning EAGAIN via PF_POLICY. 1850 */ 1851 static ipsec_tun_pol_t * 1852 spdsock_dump_iterate_next_tunnel(spdsock_t *ss, ipsec_stack_t *ipss) 1853 { 1854 ipsec_tun_pol_t *itp; 1855 1856 ASSERT(RW_READ_HELD(&ipss->ipsec_tunnel_policy_lock)); 1857 if (ipss->ipsec_tunnel_policy_gen > ss->spdsock_dump_tun_gen) { 1858 /* Oops, state of the tunnel polheads changed. */ 1859 itp = NULL; 1860 } else if (ss->spdsock_itp == NULL) { 1861 /* Just finished global, find first node. */ 1862 itp = avl_first(&ipss->ipsec_tunnel_policies); 1863 } else { 1864 /* We just finished current polhead, find the next one. */ 1865 itp = AVL_NEXT(&ipss->ipsec_tunnel_policies, ss->spdsock_itp); 1866 } 1867 if (itp != NULL) { 1868 ITP_REFHOLD(itp); 1869 } 1870 if (ss->spdsock_itp != NULL) { 1871 ITP_REFRELE(ss->spdsock_itp, ipss->ipsec_netstack); 1872 } 1873 ss->spdsock_itp = itp; 1874 return (itp); 1875 } 1876 1877 static mblk_t * 1878 spdsock_dump_next_record(spdsock_t *ss) 1879 { 1880 ipsec_policy_head_t *iph; 1881 ipsec_policy_t *rule; 1882 mblk_t *m; 1883 ipsec_tun_pol_t *itp; 1884 netstack_t *ns = ss->spdsock_spds->spds_netstack; 1885 ipsec_stack_t *ipss = ns->netstack_ipsec; 1886 1887 iph = ss->spdsock_dump_head; 1888 1889 ASSERT(iph != NULL); 1890 1891 rw_enter(&iph->iph_lock, RW_READER); 1892 1893 if (iph->iph_gen != ss->spdsock_dump_gen) { 1894 rw_exit(&iph->iph_lock); 1895 return (spdsock_dump_finish(ss, EAGAIN)); 1896 } 1897 1898 while ((rule = spdsock_dump_next_rule(ss, iph)) == NULL) { 1899 rw_exit(&iph->iph_lock); 1900 if (--(ss->spdsock_dump_remaining_polheads) == 0) 1901 return (spdsock_dump_finish(ss, 0)); 1902 1903 1904 /* 1905 * If we reach here, we have more policy heads (tunnel 1906 * entries) to dump. Let's reset to a new policy head 1907 * and get some more rules. 1908 * 1909 * An empty policy head will have spdsock_dump_next_rule() 1910 * return NULL, and we loop (while dropping the number of 1911 * remaining polheads). If we loop to 0, we finish. We 1912 * keep looping until we hit 0 or until we have a rule to 1913 * encode. 1914 * 1915 * NOTE: No need for ITP_REF*() macros here as we're only 1916 * going after and refholding the policy head itself. 1917 */ 1918 rw_enter(&ipss->ipsec_tunnel_policy_lock, RW_READER); 1919 itp = spdsock_dump_iterate_next_tunnel(ss, ipss); 1920 if (itp == NULL) { 1921 rw_exit(&ipss->ipsec_tunnel_policy_lock); 1922 return (spdsock_dump_finish(ss, EAGAIN)); 1923 } 1924 1925 /* Reset other spdsock_dump thingies. */ 1926 IPPH_REFRELE(ss->spdsock_dump_head, ns); 1927 if (ss->spdsock_dump_active) { 1928 ss->spdsock_dump_tunnel = 1929 itp->itp_flags & ITPF_P_TUNNEL; 1930 iph = itp->itp_policy; 1931 } else { 1932 ss->spdsock_dump_tunnel = 1933 itp->itp_flags & ITPF_I_TUNNEL; 1934 iph = itp->itp_inactive; 1935 } 1936 IPPH_REFHOLD(iph); 1937 rw_exit(&ipss->ipsec_tunnel_policy_lock); 1938 1939 rw_enter(&iph->iph_lock, RW_READER); 1940 RESET_SPDSOCK_DUMP_POLHEAD(ss, iph); 1941 } 1942 1943 m = spdsock_encode_rule(ss->spdsock_dump_req, rule, 1944 ss->spdsock_dump_cur_type, ss->spdsock_dump_cur_af, 1945 (ss->spdsock_itp == NULL) ? NULL : ss->spdsock_itp->itp_name, 1946 ss->spdsock_dump_tunnel); 1947 rw_exit(&iph->iph_lock); 1948 1949 if (m == NULL) 1950 return (spdsock_dump_finish(ss, ENOMEM)); 1951 return (m); 1952 } 1953 1954 /* 1955 * Dump records until we run into flow-control back-pressure. 1956 */ 1957 static void 1958 spdsock_dump_some(queue_t *q, spdsock_t *ss) 1959 { 1960 mblk_t *m, *dataind; 1961 1962 while ((ss->spdsock_dump_req != NULL) && canputnext(q)) { 1963 m = spdsock_dump_next_record(ss); 1964 if (m == NULL) 1965 return; 1966 dataind = allocb(sizeof (struct T_data_req), BPRI_HI); 1967 if (dataind == NULL) { 1968 freemsg(m); 1969 return; 1970 } 1971 dataind->b_cont = m; 1972 dataind->b_wptr += sizeof (struct T_data_req); 1973 ((struct T_data_ind *)dataind->b_rptr)->PRIM_type = T_DATA_IND; 1974 ((struct T_data_ind *)dataind->b_rptr)->MORE_flag = 0; 1975 dataind->b_datap->db_type = M_PROTO; 1976 putnext(q, dataind); 1977 } 1978 } 1979 1980 /* 1981 * Start dumping. 1982 * Format a start-of-dump record, and set up the stream and kick the rsrv 1983 * procedure to continue the job.. 1984 */ 1985 /* ARGSUSED */ 1986 static void 1987 spdsock_dump(queue_t *q, ipsec_policy_head_t *iph, mblk_t *mp) 1988 { 1989 spdsock_t *ss = (spdsock_t *)q->q_ptr; 1990 netstack_t *ns = ss->spdsock_spds->spds_netstack; 1991 ipsec_stack_t *ipss = ns->netstack_ipsec; 1992 mblk_t *mr; 1993 1994 /* spdsock_open() already set spdsock_itp to NULL. */ 1995 if (iph == ALL_ACTIVE_POLHEADS || iph == ALL_INACTIVE_POLHEADS) { 1996 rw_enter(&ipss->ipsec_tunnel_policy_lock, RW_READER); 1997 ss->spdsock_dump_remaining_polheads = 1 + 1998 avl_numnodes(&ipss->ipsec_tunnel_policies); 1999 ss->spdsock_dump_tun_gen = ipss->ipsec_tunnel_policy_gen; 2000 rw_exit(&ipss->ipsec_tunnel_policy_lock); 2001 if (iph == ALL_ACTIVE_POLHEADS) { 2002 iph = ipsec_system_policy(ns); 2003 ss->spdsock_dump_active = B_TRUE; 2004 } else { 2005 iph = ipsec_inactive_policy(ns); 2006 ss->spdsock_dump_active = B_FALSE; 2007 } 2008 ASSERT(ss->spdsock_itp == NULL); 2009 } else { 2010 ss->spdsock_dump_remaining_polheads = 1; 2011 } 2012 2013 rw_enter(&iph->iph_lock, RW_READER); 2014 2015 mr = spdsock_dump_ruleset(mp, iph, 0, 0); 2016 2017 if (!mr) { 2018 rw_exit(&iph->iph_lock); 2019 spdsock_error(q, mp, ENOMEM, 0); 2020 return; 2021 } 2022 2023 ss->spdsock_dump_req = mp; 2024 RESET_SPDSOCK_DUMP_POLHEAD(ss, iph); 2025 2026 rw_exit(&iph->iph_lock); 2027 2028 qreply(q, mr); 2029 qenable(OTHERQ(q)); 2030 } 2031 2032 /* Do NOT consume a reference to ITP. */ 2033 void 2034 spdsock_clone_node(ipsec_tun_pol_t *itp, void *ep, netstack_t *ns) 2035 { 2036 int *errptr = (int *)ep; 2037 2038 if (*errptr != 0) 2039 return; /* We've failed already for some reason. */ 2040 mutex_enter(&itp->itp_lock); 2041 ITPF_CLONE(itp->itp_flags); 2042 *errptr = ipsec_copy_polhead(itp->itp_policy, itp->itp_inactive, ns); 2043 mutex_exit(&itp->itp_lock); 2044 } 2045 2046 void 2047 spdsock_clone(queue_t *q, mblk_t *mp, spd_if_t *tunname) 2048 { 2049 int error; 2050 char *tname; 2051 ipsec_tun_pol_t *itp; 2052 spdsock_t *ss = (spdsock_t *)q->q_ptr; 2053 netstack_t *ns = ss->spdsock_spds->spds_netstack; 2054 2055 if (tunname != NULL) { 2056 tname = (char *)tunname->spd_if_name; 2057 if (*tname == '\0') { 2058 error = ipsec_clone_system_policy(ns); 2059 if (audit_active) { 2060 boolean_t active; 2061 spd_msg_t *spmsg = (spd_msg_t *)mp->b_rptr; 2062 2063 active = (spmsg->spd_msg_spdid == SPD_ACTIVE); 2064 audit_pf_policy(SPD_CLONE, DB_CRED(mp), ns, 2065 NULL, active, error, DB_CPID(mp)); 2066 } 2067 if (error == 0) { 2068 itp_walk(spdsock_clone_node, &error, ns); 2069 if (audit_active) { 2070 boolean_t active; 2071 spd_msg_t *spmsg = 2072 (spd_msg_t *)mp->b_rptr; 2073 2074 active = (spmsg->spd_msg_spdid == 2075 SPD_ACTIVE); 2076 audit_pf_policy(SPD_CLONE, DB_CRED(mp), 2077 ns, "all tunnels", active, 0, 2078 DB_CPID(mp)); 2079 } 2080 } 2081 } else { 2082 itp = get_tunnel_policy(tname, ns); 2083 if (itp == NULL) { 2084 spdsock_error(q, mp, ENOENT, 0); 2085 if (audit_active) { 2086 boolean_t active; 2087 spd_msg_t *spmsg = 2088 (spd_msg_t *)mp->b_rptr; 2089 2090 active = (spmsg->spd_msg_spdid == 2091 SPD_ACTIVE); 2092 audit_pf_policy(SPD_CLONE, DB_CRED(mp), 2093 ns, ITP_NAME(itp), active, ENOENT, 2094 DB_CPID(mp)); 2095 } 2096 return; 2097 } 2098 spdsock_clone_node(itp, &error, NULL); 2099 ITP_REFRELE(itp, ns); 2100 if (audit_active) { 2101 boolean_t active; 2102 spd_msg_t *spmsg = (spd_msg_t *)mp->b_rptr; 2103 2104 active = (spmsg->spd_msg_spdid == SPD_ACTIVE); 2105 audit_pf_policy(SPD_CLONE, DB_CRED(mp), ns, 2106 ITP_NAME(itp), active, error, DB_CPID(mp)); 2107 } 2108 } 2109 } else { 2110 error = ipsec_clone_system_policy(ns); 2111 if (audit_active) { 2112 boolean_t active; 2113 spd_msg_t *spmsg = (spd_msg_t *)mp->b_rptr; 2114 2115 active = (spmsg->spd_msg_spdid == SPD_ACTIVE); 2116 audit_pf_policy(SPD_CLONE, DB_CRED(mp), ns, NULL, 2117 active, error, DB_CPID(mp)); 2118 } 2119 } 2120 2121 if (error != 0) 2122 spdsock_error(q, mp, error, 0); 2123 else 2124 spd_echo(q, mp); 2125 } 2126 2127 /* 2128 * Process a SPD_ALGLIST request. The caller expects separate alg entries 2129 * for AH authentication, ESP authentication, and ESP encryption. 2130 * The same distinction is then used when setting the min and max key 2131 * sizes when defining policies. 2132 */ 2133 2134 #define SPDSOCK_AH_AUTH 0 2135 #define SPDSOCK_ESP_AUTH 1 2136 #define SPDSOCK_ESP_ENCR 2 2137 #define SPDSOCK_NTYPES 3 2138 2139 static const uint_t algattr[SPDSOCK_NTYPES] = { 2140 SPD_ATTR_AH_AUTH, 2141 SPD_ATTR_ESP_AUTH, 2142 SPD_ATTR_ESP_ENCR 2143 }; 2144 static const uint_t minbitsattr[SPDSOCK_NTYPES] = { 2145 SPD_ATTR_AH_MINBITS, 2146 SPD_ATTR_ESPA_MINBITS, 2147 SPD_ATTR_ENCR_MINBITS 2148 }; 2149 static const uint_t maxbitsattr[SPDSOCK_NTYPES] = { 2150 SPD_ATTR_AH_MAXBITS, 2151 SPD_ATTR_ESPA_MAXBITS, 2152 SPD_ATTR_ENCR_MAXBITS 2153 }; 2154 static const uint_t defbitsattr[SPDSOCK_NTYPES] = { 2155 SPD_ATTR_AH_DEFBITS, 2156 SPD_ATTR_ESPA_DEFBITS, 2157 SPD_ATTR_ENCR_DEFBITS 2158 }; 2159 static const uint_t incrbitsattr[SPDSOCK_NTYPES] = { 2160 SPD_ATTR_AH_INCRBITS, 2161 SPD_ATTR_ESPA_INCRBITS, 2162 SPD_ATTR_ENCR_INCRBITS 2163 }; 2164 2165 #define ATTRPERALG 6 /* fixed attributes per algs */ 2166 2167 void 2168 spdsock_alglist(queue_t *q, mblk_t *mp) 2169 { 2170 uint_t algtype; 2171 uint_t algidx; 2172 uint_t algcount; 2173 uint_t size; 2174 mblk_t *m; 2175 uint8_t *cur; 2176 spd_msg_t *msg; 2177 struct spd_ext_actions *act; 2178 struct spd_attribute *attr; 2179 spdsock_t *ss = (spdsock_t *)q->q_ptr; 2180 ipsec_stack_t *ipss = ss->spdsock_spds->spds_netstack->netstack_ipsec; 2181 2182 mutex_enter(&ipss->ipsec_alg_lock); 2183 /* 2184 * The SPD client expects to receive separate entries for 2185 * AH authentication and ESP authentication supported algorithms. 2186 * 2187 * Don't return the "any" algorithms, if defined, as no 2188 * kernel policies can be set for these algorithms. 2189 */ 2190 algcount = 2 * ipss->ipsec_nalgs[IPSEC_ALG_AUTH] + 2191 ipss->ipsec_nalgs[IPSEC_ALG_ENCR]; 2192 2193 if (ipss->ipsec_alglists[IPSEC_ALG_AUTH][SADB_AALG_NONE] != NULL) 2194 algcount--; 2195 if (ipss->ipsec_alglists[IPSEC_ALG_ENCR][SADB_EALG_NONE] != NULL) 2196 algcount--; 2197 2198 /* 2199 * For each algorithm, we encode: 2200 * ALG / MINBITS / MAXBITS / DEFBITS / INCRBITS / {END, NEXT} 2201 */ 2202 2203 size = sizeof (spd_msg_t) + sizeof (struct spd_ext_actions) + 2204 ATTRPERALG * sizeof (struct spd_attribute) * algcount; 2205 2206 ASSERT(ALIGNED64(size)); 2207 2208 m = allocb(size, BPRI_HI); 2209 if (m == NULL) { 2210 mutex_exit(&ipss->ipsec_alg_lock); 2211 spdsock_error(q, mp, ENOMEM, 0); 2212 return; 2213 } 2214 2215 m->b_wptr = m->b_rptr + size; 2216 cur = m->b_rptr; 2217 2218 msg = (spd_msg_t *)cur; 2219 bcopy(mp->b_rptr, cur, sizeof (*msg)); 2220 2221 msg->spd_msg_len = SPD_8TO64(size); 2222 msg->spd_msg_errno = 0; 2223 msg->spd_msg_diagnostic = 0; 2224 2225 cur += sizeof (*msg); 2226 2227 act = (struct spd_ext_actions *)cur; 2228 cur += sizeof (*act); 2229 2230 act->spd_actions_len = SPD_8TO64(size - sizeof (spd_msg_t)); 2231 act->spd_actions_exttype = SPD_EXT_ACTION; 2232 act->spd_actions_count = algcount; 2233 act->spd_actions_reserved = 0; 2234 2235 attr = (struct spd_attribute *)cur; 2236 2237 #define EMIT(tag, value) { \ 2238 attr->spd_attr_tag = (tag); \ 2239 attr->spd_attr_value = (value); \ 2240 attr++; \ 2241 } 2242 2243 /* 2244 * If you change the number of EMIT's here, change 2245 * ATTRPERALG above to match 2246 */ 2247 #define EMITALGATTRS(_type) { \ 2248 EMIT(algattr[_type], algid); /* 1 */ \ 2249 EMIT(minbitsattr[_type], minbits); /* 2 */ \ 2250 EMIT(maxbitsattr[_type], maxbits); /* 3 */ \ 2251 EMIT(defbitsattr[_type], defbits); /* 4 */ \ 2252 EMIT(incrbitsattr[_type], incr); /* 5 */ \ 2253 EMIT(SPD_ATTR_NEXT, 0); /* 6 */ \ 2254 } 2255 2256 for (algtype = 0; algtype < IPSEC_NALGTYPES; algtype++) { 2257 for (algidx = 0; algidx < ipss->ipsec_nalgs[algtype]; 2258 algidx++) { 2259 int algid = ipss->ipsec_sortlist[algtype][algidx]; 2260 ipsec_alginfo_t *alg = 2261 ipss->ipsec_alglists[algtype][algid]; 2262 uint_t minbits = alg->alg_minbits; 2263 uint_t maxbits = alg->alg_maxbits; 2264 uint_t defbits = alg->alg_default_bits; 2265 uint_t incr = alg->alg_increment; 2266 2267 if (algtype == IPSEC_ALG_AUTH) { 2268 if (algid == SADB_AALG_NONE) 2269 continue; 2270 EMITALGATTRS(SPDSOCK_AH_AUTH); 2271 EMITALGATTRS(SPDSOCK_ESP_AUTH); 2272 } else { 2273 if (algid == SADB_EALG_NONE) 2274 continue; 2275 ASSERT(algtype == IPSEC_ALG_ENCR); 2276 EMITALGATTRS(SPDSOCK_ESP_ENCR); 2277 } 2278 } 2279 } 2280 2281 mutex_exit(&ipss->ipsec_alg_lock); 2282 2283 #undef EMITALGATTRS 2284 #undef EMIT 2285 #undef ATTRPERALG 2286 2287 attr--; 2288 attr->spd_attr_tag = SPD_ATTR_END; 2289 2290 freemsg(mp); 2291 qreply(q, m); 2292 } 2293 2294 /* 2295 * Process a SPD_DUMPALGS request. 2296 */ 2297 2298 #define ATTRPERALG 7 /* fixed attributes per algs */ 2299 2300 void 2301 spdsock_dumpalgs(queue_t *q, mblk_t *mp) 2302 { 2303 uint_t algtype; 2304 uint_t algidx; 2305 uint_t size; 2306 mblk_t *m; 2307 uint8_t *cur; 2308 spd_msg_t *msg; 2309 struct spd_ext_actions *act; 2310 struct spd_attribute *attr; 2311 ipsec_alginfo_t *alg; 2312 uint_t algid; 2313 uint_t i; 2314 uint_t alg_size; 2315 spdsock_t *ss = (spdsock_t *)q->q_ptr; 2316 ipsec_stack_t *ipss = ss->spdsock_spds->spds_netstack->netstack_ipsec; 2317 2318 mutex_enter(&ipss->ipsec_alg_lock); 2319 2320 /* 2321 * For each algorithm, we encode: 2322 * ALG / MINBITS / MAXBITS / DEFBITS / INCRBITS / {END, NEXT} 2323 * 2324 * ALG_ID / ALG_PROTO / ALG_INCRBITS / ALG_NKEYSIZES / ALG_KEYSIZE* 2325 * ALG_NBLOCKSIZES / ALG_BLOCKSIZE* / ALG_MECHNAME / {END, NEXT} 2326 */ 2327 2328 /* 2329 * Compute the size of the SPD message. 2330 */ 2331 size = sizeof (spd_msg_t) + sizeof (struct spd_ext_actions); 2332 2333 for (algtype = 0; algtype < IPSEC_NALGTYPES; algtype++) { 2334 for (algidx = 0; algidx < ipss->ipsec_nalgs[algtype]; 2335 algidx++) { 2336 algid = ipss->ipsec_sortlist[algtype][algidx]; 2337 alg = ipss->ipsec_alglists[algtype][algid]; 2338 alg_size = sizeof (struct spd_attribute) * 2339 (ATTRPERALG + alg->alg_nkey_sizes + 2340 alg->alg_nblock_sizes) + CRYPTO_MAX_MECH_NAME; 2341 size += alg_size; 2342 } 2343 } 2344 2345 ASSERT(ALIGNED64(size)); 2346 2347 m = allocb(size, BPRI_HI); 2348 if (m == NULL) { 2349 mutex_exit(&ipss->ipsec_alg_lock); 2350 spdsock_error(q, mp, ENOMEM, 0); 2351 return; 2352 } 2353 2354 m->b_wptr = m->b_rptr + size; 2355 cur = m->b_rptr; 2356 2357 msg = (spd_msg_t *)cur; 2358 bcopy(mp->b_rptr, cur, sizeof (*msg)); 2359 2360 msg->spd_msg_len = SPD_8TO64(size); 2361 msg->spd_msg_errno = 0; 2362 msg->spd_msg_diagnostic = 0; 2363 2364 cur += sizeof (*msg); 2365 2366 act = (struct spd_ext_actions *)cur; 2367 cur += sizeof (*act); 2368 2369 act->spd_actions_len = SPD_8TO64(size - sizeof (spd_msg_t)); 2370 act->spd_actions_exttype = SPD_EXT_ACTION; 2371 act->spd_actions_count = ipss->ipsec_nalgs[IPSEC_ALG_AUTH] + 2372 ipss->ipsec_nalgs[IPSEC_ALG_ENCR]; 2373 act->spd_actions_reserved = 0; 2374 2375 attr = (struct spd_attribute *)cur; 2376 2377 #define EMIT(tag, value) { \ 2378 attr->spd_attr_tag = (tag); \ 2379 attr->spd_attr_value = (value); \ 2380 attr++; \ 2381 } 2382 2383 for (algtype = 0; algtype < IPSEC_NALGTYPES; algtype++) { 2384 for (algidx = 0; algidx < ipss->ipsec_nalgs[algtype]; 2385 algidx++) { 2386 2387 algid = ipss->ipsec_sortlist[algtype][algidx]; 2388 alg = ipss->ipsec_alglists[algtype][algid]; 2389 2390 /* 2391 * If you change the number of EMIT's here, change 2392 * ATTRPERALG above to match 2393 */ 2394 EMIT(SPD_ATTR_ALG_ID, algid); 2395 EMIT(SPD_ATTR_ALG_PROTO, algproto[algtype]); 2396 EMIT(SPD_ATTR_ALG_INCRBITS, alg->alg_increment); 2397 2398 EMIT(SPD_ATTR_ALG_NKEYSIZES, alg->alg_nkey_sizes); 2399 for (i = 0; i < alg->alg_nkey_sizes; i++) 2400 EMIT(SPD_ATTR_ALG_KEYSIZE, 2401 alg->alg_key_sizes[i]); 2402 2403 EMIT(SPD_ATTR_ALG_NBLOCKSIZES, alg->alg_nblock_sizes); 2404 for (i = 0; i < alg->alg_nblock_sizes; i++) 2405 EMIT(SPD_ATTR_ALG_BLOCKSIZE, 2406 alg->alg_block_sizes[i]); 2407 2408 EMIT(SPD_ATTR_ALG_MECHNAME, CRYPTO_MAX_MECH_NAME); 2409 bcopy(alg->alg_mech_name, attr, CRYPTO_MAX_MECH_NAME); 2410 attr = (struct spd_attribute *)((char *)attr + 2411 CRYPTO_MAX_MECH_NAME); 2412 2413 EMIT(SPD_ATTR_NEXT, 0); 2414 } 2415 } 2416 2417 mutex_exit(&ipss->ipsec_alg_lock); 2418 2419 #undef EMITALGATTRS 2420 #undef EMIT 2421 #undef ATTRPERALG 2422 2423 attr--; 2424 attr->spd_attr_tag = SPD_ATTR_END; 2425 2426 freemsg(mp); 2427 qreply(q, m); 2428 } 2429 2430 /* 2431 * Do the actual work of processing an SPD_UPDATEALGS request. Can 2432 * be invoked either once IPsec is loaded on a cached request, or 2433 * when a request is received while IPsec is loaded. 2434 */ 2435 static void 2436 spdsock_do_updatealg(spd_ext_t *extv[], int *diag, spd_stack_t *spds) 2437 { 2438 struct spd_ext_actions *actp; 2439 struct spd_attribute *attr, *endattr; 2440 uint64_t *start, *end; 2441 ipsec_alginfo_t *alg = NULL; 2442 ipsec_algtype_t alg_type = 0; 2443 boolean_t skip_alg = B_TRUE, doing_proto = B_FALSE; 2444 uint_t i, cur_key, cur_block, algid; 2445 2446 *diag = -1; 2447 ASSERT(MUTEX_HELD(&spds->spds_alg_lock)); 2448 2449 /* parse the message, building the list of algorithms */ 2450 2451 actp = (struct spd_ext_actions *)extv[SPD_EXT_ACTION]; 2452 if (actp == NULL) { 2453 *diag = SPD_DIAGNOSTIC_NO_ACTION_EXT; 2454 return; 2455 } 2456 2457 start = (uint64_t *)actp; 2458 end = (start + actp->spd_actions_len); 2459 endattr = (struct spd_attribute *)end; 2460 attr = (struct spd_attribute *)&actp[1]; 2461 2462 bzero(spds->spds_algs, IPSEC_NALGTYPES * IPSEC_MAX_ALGS * 2463 sizeof (ipsec_alginfo_t *)); 2464 2465 alg = kmem_zalloc(sizeof (*alg), KM_SLEEP); 2466 2467 #define ALG_KEY_SIZES(a) (((a)->alg_nkey_sizes + 1) * sizeof (uint16_t)) 2468 #define ALG_BLOCK_SIZES(a) (((a)->alg_nblock_sizes + 1) * sizeof (uint16_t)) 2469 2470 while (attr < endattr) { 2471 switch (attr->spd_attr_tag) { 2472 case SPD_ATTR_NOP: 2473 case SPD_ATTR_EMPTY: 2474 break; 2475 case SPD_ATTR_END: 2476 attr = endattr; 2477 /* FALLTHRU */ 2478 case SPD_ATTR_NEXT: 2479 if (doing_proto) { 2480 doing_proto = B_FALSE; 2481 break; 2482 } 2483 if (skip_alg) { 2484 ipsec_alg_free(alg); 2485 } else { 2486 ipsec_alg_free( 2487 spds->spds_algs[alg_type][alg->alg_id]); 2488 spds->spds_algs[alg_type][alg->alg_id] = 2489 alg; 2490 } 2491 alg = kmem_zalloc(sizeof (*alg), KM_SLEEP); 2492 break; 2493 2494 case SPD_ATTR_ALG_ID: 2495 if (attr->spd_attr_value >= IPSEC_MAX_ALGS) { 2496 ss1dbg(spds, ("spdsock_do_updatealg: " 2497 "invalid alg id %d\n", 2498 attr->spd_attr_value)); 2499 *diag = SPD_DIAGNOSTIC_ALG_ID_RANGE; 2500 goto bail; 2501 } 2502 alg->alg_id = attr->spd_attr_value; 2503 break; 2504 2505 case SPD_ATTR_ALG_PROTO: 2506 /* find the alg type */ 2507 for (i = 0; i < NALGPROTOS; i++) 2508 if (algproto[i] == attr->spd_attr_value) 2509 break; 2510 skip_alg = (i == NALGPROTOS); 2511 if (!skip_alg) 2512 alg_type = i; 2513 break; 2514 2515 case SPD_ATTR_ALG_INCRBITS: 2516 alg->alg_increment = attr->spd_attr_value; 2517 break; 2518 2519 case SPD_ATTR_ALG_NKEYSIZES: 2520 if (alg->alg_key_sizes != NULL) { 2521 kmem_free(alg->alg_key_sizes, 2522 ALG_KEY_SIZES(alg)); 2523 } 2524 alg->alg_nkey_sizes = attr->spd_attr_value; 2525 /* 2526 * Allocate room for the trailing zero key size 2527 * value as well. 2528 */ 2529 alg->alg_key_sizes = kmem_zalloc(ALG_KEY_SIZES(alg), 2530 KM_SLEEP); 2531 cur_key = 0; 2532 break; 2533 2534 case SPD_ATTR_ALG_KEYSIZE: 2535 if (alg->alg_key_sizes == NULL || 2536 cur_key >= alg->alg_nkey_sizes) { 2537 ss1dbg(spds, ("spdsock_do_updatealg: " 2538 "too many key sizes\n")); 2539 *diag = SPD_DIAGNOSTIC_ALG_NUM_KEY_SIZES; 2540 goto bail; 2541 } 2542 alg->alg_key_sizes[cur_key++] = attr->spd_attr_value; 2543 break; 2544 2545 case SPD_ATTR_ALG_NBLOCKSIZES: 2546 if (alg->alg_block_sizes != NULL) { 2547 kmem_free(alg->alg_block_sizes, 2548 ALG_BLOCK_SIZES(alg)); 2549 } 2550 alg->alg_nblock_sizes = attr->spd_attr_value; 2551 /* 2552 * Allocate room for the trailing zero block size 2553 * value as well. 2554 */ 2555 alg->alg_block_sizes = kmem_zalloc(ALG_BLOCK_SIZES(alg), 2556 KM_SLEEP); 2557 cur_block = 0; 2558 break; 2559 2560 case SPD_ATTR_ALG_BLOCKSIZE: 2561 if (alg->alg_block_sizes == NULL || 2562 cur_block >= alg->alg_nblock_sizes) { 2563 ss1dbg(spds, ("spdsock_do_updatealg: " 2564 "too many block sizes\n")); 2565 *diag = SPD_DIAGNOSTIC_ALG_NUM_BLOCK_SIZES; 2566 goto bail; 2567 } 2568 alg->alg_block_sizes[cur_block++] = 2569 attr->spd_attr_value; 2570 break; 2571 2572 case SPD_ATTR_ALG_MECHNAME: { 2573 char *mech_name; 2574 2575 if (attr->spd_attr_value > CRYPTO_MAX_MECH_NAME) { 2576 ss1dbg(spds, ("spdsock_do_updatealg: " 2577 "mech name too long\n")); 2578 *diag = SPD_DIAGNOSTIC_ALG_MECH_NAME_LEN; 2579 goto bail; 2580 } 2581 mech_name = (char *)(attr + 1); 2582 bcopy(mech_name, alg->alg_mech_name, 2583 attr->spd_attr_value); 2584 alg->alg_mech_name[CRYPTO_MAX_MECH_NAME-1] = '\0'; 2585 attr = (struct spd_attribute *)((char *)attr + 2586 attr->spd_attr_value); 2587 break; 2588 } 2589 2590 case SPD_ATTR_PROTO_ID: 2591 doing_proto = B_TRUE; 2592 for (i = 0; i < NALGPROTOS; i++) { 2593 if (algproto[i] == attr->spd_attr_value) { 2594 alg_type = i; 2595 break; 2596 } 2597 } 2598 break; 2599 2600 case SPD_ATTR_PROTO_EXEC_MODE: 2601 if (!doing_proto) 2602 break; 2603 for (i = 0; i < NEXECMODES; i++) { 2604 if (execmodes[i] == attr->spd_attr_value) { 2605 spds->spds_algs_exec_mode[alg_type] = i; 2606 break; 2607 } 2608 } 2609 break; 2610 } 2611 attr++; 2612 } 2613 2614 #undef ALG_KEY_SIZES 2615 #undef ALG_BLOCK_SIZES 2616 2617 /* update the algorithm tables */ 2618 spdsock_merge_algs(spds); 2619 bail: 2620 /* cleanup */ 2621 ipsec_alg_free(alg); 2622 for (alg_type = 0; alg_type < IPSEC_NALGTYPES; alg_type++) 2623 for (algid = 0; algid < IPSEC_MAX_ALGS; algid++) 2624 if (spds->spds_algs[alg_type][algid] != NULL) 2625 ipsec_alg_free(spds->spds_algs[alg_type][algid]); 2626 } 2627 2628 /* 2629 * Process an SPD_UPDATEALGS request. If IPsec is not loaded, queue 2630 * the request until IPsec loads. If IPsec is loaded, act on it 2631 * immediately. 2632 */ 2633 2634 static void 2635 spdsock_updatealg(queue_t *q, mblk_t *mp, spd_ext_t *extv[]) 2636 { 2637 spdsock_t *ss = (spdsock_t *)q->q_ptr; 2638 spd_stack_t *spds = ss->spdsock_spds; 2639 ipsec_stack_t *ipss = spds->spds_netstack->netstack_ipsec; 2640 2641 if (!ipsec_loaded(ipss)) { 2642 /* 2643 * IPsec is not loaded, save request and return nicely, 2644 * the message will be processed once IPsec loads. 2645 */ 2646 mblk_t *new_mp; 2647 2648 /* last update message wins */ 2649 if ((new_mp = copymsg(mp)) == NULL) { 2650 spdsock_error(q, mp, ENOMEM, 0); 2651 return; 2652 } 2653 mutex_enter(&spds->spds_alg_lock); 2654 bcopy(extv, spds->spds_extv_algs, 2655 sizeof (spd_ext_t *) * (SPD_EXT_MAX + 1)); 2656 if (spds->spds_mp_algs != NULL) 2657 freemsg(spds->spds_mp_algs); 2658 spds->spds_mp_algs = mp; 2659 spds->spds_algs_pending = B_TRUE; 2660 mutex_exit(&spds->spds_alg_lock); 2661 if (audit_active) 2662 audit_pf_policy(SPD_UPDATEALGS, DB_CRED(mp), 2663 spds->spds_netstack, NULL, B_TRUE, EAGAIN, 2664 DB_CPID(mp)); 2665 spd_echo(q, new_mp); 2666 } else { 2667 /* 2668 * IPsec is loaded, act on the message immediately. 2669 */ 2670 int diag; 2671 2672 mutex_enter(&spds->spds_alg_lock); 2673 spdsock_do_updatealg(extv, &diag, spds); 2674 mutex_exit(&spds->spds_alg_lock); 2675 if (diag == -1) { 2676 spd_echo(q, mp); 2677 if (audit_active) 2678 audit_pf_policy(SPD_UPDATEALGS, DB_CRED(mp), 2679 spds->spds_netstack, NULL, B_TRUE, 0, 2680 DB_CPID(mp)); 2681 } else { 2682 spdsock_diag(q, mp, diag); 2683 if (audit_active) 2684 audit_pf_policy(SPD_UPDATEALGS, DB_CRED(mp), 2685 spds->spds_netstack, NULL, B_TRUE, diag, 2686 DB_CPID(mp)); 2687 } 2688 } 2689 } 2690 2691 /* 2692 * With a reference-held ill, dig down and find an instance of "tun", and 2693 * assign its tunnel policy pointer, while reference-holding it. Also, 2694 * release ill's refrence when finished. 2695 * 2696 * We'll be messing with q_next, so be VERY careful. 2697 */ 2698 static void 2699 find_tun_and_set_itp(ill_t *ill, ipsec_tun_pol_t *itp) 2700 { 2701 queue_t *q; 2702 tun_t *tun; 2703 2704 /* Don't bother if this ill is going away. */ 2705 if (ill->ill_flags & ILL_CONDEMNED) { 2706 ill_refrele(ill); 2707 return; 2708 } 2709 2710 2711 q = ill->ill_wq; 2712 claimstr(q); /* Lighter-weight than freezestr(). */ 2713 2714 do { 2715 /* Use strcmp() because "tun" is bounded. */ 2716 if (strcmp(q->q_qinfo->qi_minfo->mi_idname, "tun") == 0) { 2717 /* Aha! Got it. */ 2718 tun = (tun_t *)q->q_ptr; 2719 if (tun != NULL) { 2720 mutex_enter(&tun->tun_lock); 2721 if (tun->tun_itp != itp) { 2722 ASSERT(tun->tun_itp == NULL); 2723 ITP_REFHOLD(itp); 2724 tun->tun_itp = itp; 2725 } 2726 mutex_exit(&tun->tun_lock); 2727 goto release_and_return; 2728 } 2729 /* 2730 * Else assume this is some other module named "tun" 2731 * and move on, hoping we find one that actually has 2732 * something in q_ptr. 2733 */ 2734 } 2735 q = q->q_next; 2736 } while (q != NULL); 2737 2738 release_and_return: 2739 releasestr(ill->ill_wq); 2740 ill_refrele(ill); 2741 } 2742 2743 /* 2744 * Sort through the mess of polhead options to retrieve an appropriate one. 2745 * Returns NULL if we send an spdsock error. Returns a valid pointer if we 2746 * found a valid polhead. Returns ALL_ACTIVE_POLHEADS (aka. -1) or 2747 * ALL_INACTIVE_POLHEADS (aka. -2) if the operation calls for the operation to 2748 * act on ALL policy heads. 2749 */ 2750 static ipsec_policy_head_t * 2751 get_appropriate_polhead(queue_t *q, mblk_t *mp, spd_if_t *tunname, int spdid, 2752 int msgtype, ipsec_tun_pol_t **itpp) 2753 { 2754 ipsec_tun_pol_t *itp; 2755 ipsec_policy_head_t *iph; 2756 int errno; 2757 char *tname; 2758 boolean_t active; 2759 spdsock_t *ss = (spdsock_t *)q->q_ptr; 2760 netstack_t *ns = ss->spdsock_spds->spds_netstack; 2761 uint64_t gen; /* Placeholder */ 2762 ill_t *v4, *v6; 2763 2764 active = (spdid == SPD_ACTIVE); 2765 *itpp = NULL; 2766 if (!active && spdid != SPD_STANDBY) { 2767 spdsock_diag(q, mp, SPD_DIAGNOSTIC_BAD_SPDID); 2768 return (NULL); 2769 } 2770 2771 if (tunname != NULL) { 2772 /* Acting on a tunnel's SPD. */ 2773 tname = (char *)tunname->spd_if_name; 2774 if (*tname == '\0') { 2775 /* Handle all-polhead cases here. */ 2776 if (msgtype != SPD_FLUSH && msgtype != SPD_DUMP) { 2777 spdsock_diag(q, mp, 2778 SPD_DIAGNOSTIC_NOT_GLOBAL_OP); 2779 return (NULL); 2780 } 2781 return (active ? ALL_ACTIVE_POLHEADS : 2782 ALL_INACTIVE_POLHEADS); 2783 } 2784 2785 itp = get_tunnel_policy(tname, ns); 2786 if (itp == NULL) { 2787 if (msgtype != SPD_ADDRULE) { 2788 /* "Tunnel not found" */ 2789 spdsock_error(q, mp, ENOENT, 0); 2790 return (NULL); 2791 } 2792 2793 errno = 0; 2794 itp = create_tunnel_policy(tname, &errno, &gen, ns); 2795 if (itp == NULL) { 2796 /* 2797 * Something very bad happened, most likely 2798 * ENOMEM. Return an indicator. 2799 */ 2800 spdsock_error(q, mp, errno, 0); 2801 return (NULL); 2802 } 2803 } 2804 /* 2805 * Troll the plumbed tunnels and see if we have a 2806 * match. We need to do this always in case we add 2807 * policy AFTER plumbing a tunnel. 2808 */ 2809 v4 = ill_lookup_on_name(tname, B_FALSE, B_FALSE, NULL, 2810 NULL, NULL, &errno, NULL, ns->netstack_ip); 2811 if (v4 != NULL) 2812 find_tun_and_set_itp(v4, itp); 2813 v6 = ill_lookup_on_name(tname, B_FALSE, B_TRUE, NULL, 2814 NULL, NULL, &errno, NULL, ns->netstack_ip); 2815 if (v6 != NULL) 2816 find_tun_and_set_itp(v6, itp); 2817 ASSERT(itp != NULL); 2818 *itpp = itp; 2819 /* For spdsock dump state, set the polhead's name. */ 2820 if (msgtype == SPD_DUMP) { 2821 ITP_REFHOLD(itp); 2822 ss->spdsock_itp = itp; 2823 ss->spdsock_dump_tunnel = itp->itp_flags & 2824 (active ? ITPF_P_TUNNEL : ITPF_I_TUNNEL); 2825 } 2826 } else { 2827 itp = NULL; 2828 /* For spdsock dump state, indicate it's global policy. */ 2829 if (msgtype == SPD_DUMP) 2830 ss->spdsock_itp = NULL; 2831 } 2832 2833 if (active) 2834 iph = (itp == NULL) ? ipsec_system_policy(ns) : itp->itp_policy; 2835 else 2836 iph = (itp == NULL) ? ipsec_inactive_policy(ns) : 2837 itp->itp_inactive; 2838 2839 ASSERT(iph != NULL); 2840 if (itp != NULL) { 2841 IPPH_REFHOLD(iph); 2842 } 2843 2844 return (iph); 2845 } 2846 2847 static void 2848 spdsock_parse(queue_t *q, mblk_t *mp) 2849 { 2850 spd_msg_t *spmsg; 2851 spd_ext_t *extv[SPD_EXT_MAX + 1]; 2852 uint_t msgsize; 2853 ipsec_policy_head_t *iph; 2854 ipsec_tun_pol_t *itp; 2855 spd_if_t *tunname; 2856 spdsock_t *ss = (spdsock_t *)q->q_ptr; 2857 spd_stack_t *spds = ss->spdsock_spds; 2858 netstack_t *ns = spds->spds_netstack; 2859 ipsec_stack_t *ipss = ns->netstack_ipsec; 2860 2861 /* Make sure nothing's below me. */ 2862 ASSERT(WR(q)->q_next == NULL); 2863 2864 spmsg = (spd_msg_t *)mp->b_rptr; 2865 2866 msgsize = SPD_64TO8(spmsg->spd_msg_len); 2867 2868 if (msgdsize(mp) != msgsize) { 2869 /* 2870 * Message len incorrect w.r.t. actual size. Send an error 2871 * (EMSGSIZE). It may be necessary to massage things a 2872 * bit. For example, if the spd_msg_type is hosed, 2873 * I need to set it to SPD_RESERVED to get delivery to 2874 * do the right thing. Then again, maybe just letting 2875 * the error delivery do the right thing. 2876 */ 2877 ss2dbg(spds, 2878 ("mblk (%lu) and base (%d) message sizes don't jibe.\n", 2879 msgdsize(mp), msgsize)); 2880 spdsock_error(q, mp, EMSGSIZE, SPD_DIAGNOSTIC_NONE); 2881 return; 2882 } 2883 2884 if (msgsize > (uint_t)(mp->b_wptr - mp->b_rptr)) { 2885 /* Get all message into one mblk. */ 2886 if (pullupmsg(mp, -1) == 0) { 2887 /* 2888 * Something screwy happened. 2889 */ 2890 ss3dbg(spds, ("spdsock_parse: pullupmsg() failed.\n")); 2891 return; 2892 } else { 2893 spmsg = (spd_msg_t *)mp->b_rptr; 2894 } 2895 } 2896 2897 switch (spdsock_get_ext(extv, spmsg, msgsize)) { 2898 case KGE_DUP: 2899 /* Handle duplicate extension. */ 2900 ss1dbg(spds, ("Got duplicate extension of type %d.\n", 2901 extv[0]->spd_ext_type)); 2902 spdsock_diag(q, mp, dup_ext_diag[extv[0]->spd_ext_type]); 2903 return; 2904 case KGE_UNK: 2905 /* Handle unknown extension. */ 2906 ss1dbg(spds, ("Got unknown extension of type %d.\n", 2907 extv[0]->spd_ext_type)); 2908 spdsock_diag(q, mp, SPD_DIAGNOSTIC_UNKNOWN_EXT); 2909 return; 2910 case KGE_LEN: 2911 /* Length error. */ 2912 ss1dbg(spds, ("Length %d on extension type %d overrun or 0.\n", 2913 extv[0]->spd_ext_len, extv[0]->spd_ext_type)); 2914 spdsock_diag(q, mp, SPD_DIAGNOSTIC_BAD_EXTLEN); 2915 return; 2916 case KGE_CHK: 2917 /* Reality check failed. */ 2918 ss1dbg(spds, ("Reality check failed on extension type %d.\n", 2919 extv[0]->spd_ext_type)); 2920 spdsock_diag(q, mp, bad_ext_diag[extv[0]->spd_ext_type]); 2921 return; 2922 default: 2923 /* Default case is no errors. */ 2924 break; 2925 } 2926 2927 /* 2928 * Special-case SPD_UPDATEALGS so as not to load IPsec. 2929 */ 2930 if (!ipsec_loaded(ipss) && spmsg->spd_msg_type != SPD_UPDATEALGS) { 2931 spdsock_t *ss = (spdsock_t *)q->q_ptr; 2932 2933 ASSERT(ss != NULL); 2934 ipsec_loader_loadnow(ipss); 2935 ss->spdsock_timeout_arg = mp; 2936 ss->spdsock_timeout = qtimeout(q, spdsock_loadcheck, 2937 q, LOADCHECK_INTERVAL); 2938 return; 2939 } 2940 2941 /* First check for messages that need no polheads at all. */ 2942 switch (spmsg->spd_msg_type) { 2943 case SPD_UPDATEALGS: 2944 spdsock_updatealg(q, mp, extv); 2945 return; 2946 case SPD_ALGLIST: 2947 spdsock_alglist(q, mp); 2948 return; 2949 case SPD_DUMPALGS: 2950 spdsock_dumpalgs(q, mp); 2951 return; 2952 } 2953 2954 /* 2955 * Then check for ones that need both primary/secondary polheads, 2956 * finding the appropriate tunnel policy if need be. 2957 */ 2958 tunname = (spd_if_t *)extv[SPD_EXT_TUN_NAME]; 2959 switch (spmsg->spd_msg_type) { 2960 case SPD_FLIP: 2961 spdsock_flip(q, mp, tunname); 2962 return; 2963 case SPD_CLONE: 2964 spdsock_clone(q, mp, tunname); 2965 return; 2966 } 2967 2968 /* 2969 * Finally, find ones that operate on exactly one polhead, or 2970 * "all polheads" of a given type (active/inactive). 2971 */ 2972 iph = get_appropriate_polhead(q, mp, tunname, spmsg->spd_msg_spdid, 2973 spmsg->spd_msg_type, &itp); 2974 if (iph == NULL) 2975 return; 2976 2977 /* All-polheads-ready operations. */ 2978 switch (spmsg->spd_msg_type) { 2979 case SPD_FLUSH: 2980 if (itp != NULL) { 2981 mutex_enter(&itp->itp_lock); 2982 if (spmsg->spd_msg_spdid == SPD_ACTIVE) 2983 itp->itp_flags &= ~ITPF_PFLAGS; 2984 else 2985 itp->itp_flags &= ~ITPF_IFLAGS; 2986 mutex_exit(&itp->itp_lock); 2987 ITP_REFRELE(itp, ns); 2988 } 2989 spdsock_flush(q, iph, itp, mp); 2990 return; 2991 case SPD_DUMP: 2992 if (itp != NULL) 2993 ITP_REFRELE(itp, ns); 2994 spdsock_dump(q, iph, mp); 2995 return; 2996 } 2997 2998 if (iph == ALL_ACTIVE_POLHEADS || iph == ALL_INACTIVE_POLHEADS) { 2999 spdsock_diag(q, mp, SPD_DIAGNOSTIC_NOT_GLOBAL_OP); 3000 return; 3001 } 3002 3003 /* Single-polhead-only operations. */ 3004 switch (spmsg->spd_msg_type) { 3005 case SPD_ADDRULE: 3006 spdsock_addrule(q, iph, mp, extv, itp); 3007 break; 3008 case SPD_DELETERULE: 3009 spdsock_deleterule(q, iph, mp, extv, itp); 3010 break; 3011 case SPD_LOOKUP: 3012 spdsock_lookup(q, iph, mp, extv, itp); 3013 break; 3014 default: 3015 spdsock_diag(q, mp, SPD_DIAGNOSTIC_BAD_MSG_TYPE); 3016 break; 3017 } 3018 3019 IPPH_REFRELE(iph, ns); 3020 if (itp != NULL) 3021 ITP_REFRELE(itp, ns); 3022 } 3023 3024 /* 3025 * If an algorithm mapping was received before IPsec was loaded, process it. 3026 * Called from the IPsec loader. 3027 */ 3028 void 3029 spdsock_update_pending_algs(netstack_t *ns) 3030 { 3031 spd_stack_t *spds = ns->netstack_spdsock; 3032 3033 mutex_enter(&spds->spds_alg_lock); 3034 if (spds->spds_algs_pending) { 3035 int diag; 3036 3037 spdsock_do_updatealg(spds->spds_extv_algs, &diag, 3038 spds); 3039 spds->spds_algs_pending = B_FALSE; 3040 } 3041 mutex_exit(&spds->spds_alg_lock); 3042 } 3043 3044 static void 3045 spdsock_loadcheck(void *arg) 3046 { 3047 queue_t *q = (queue_t *)arg; 3048 spdsock_t *ss = (spdsock_t *)q->q_ptr; 3049 mblk_t *mp; 3050 ipsec_stack_t *ipss = ss->spdsock_spds->spds_netstack->netstack_ipsec; 3051 3052 ASSERT(ss != NULL); 3053 3054 ss->spdsock_timeout = 0; 3055 mp = ss->spdsock_timeout_arg; 3056 ASSERT(mp != NULL); 3057 ss->spdsock_timeout_arg = NULL; 3058 if (ipsec_failed(ipss)) 3059 spdsock_error(q, mp, EPROTONOSUPPORT, 0); 3060 else 3061 spdsock_parse(q, mp); 3062 } 3063 3064 /* 3065 * Copy relevant state bits. 3066 */ 3067 static void 3068 spdsock_copy_info(struct T_info_ack *tap, spdsock_t *ss) 3069 { 3070 *tap = spdsock_g_t_info_ack; 3071 tap->CURRENT_state = ss->spdsock_state; 3072 tap->OPT_size = spdsock_max_optsize; 3073 } 3074 3075 /* 3076 * This routine responds to T_CAPABILITY_REQ messages. It is called by 3077 * spdsock_wput. Much of the T_CAPABILITY_ACK information is copied from 3078 * spdsock_g_t_info_ack. The current state of the stream is copied from 3079 * spdsock_state. 3080 */ 3081 static void 3082 spdsock_capability_req(queue_t *q, mblk_t *mp) 3083 { 3084 spdsock_t *ss = (spdsock_t *)q->q_ptr; 3085 t_uscalar_t cap_bits1; 3086 struct T_capability_ack *tcap; 3087 3088 cap_bits1 = ((struct T_capability_req *)mp->b_rptr)->CAP_bits1; 3089 3090 mp = tpi_ack_alloc(mp, sizeof (struct T_capability_ack), 3091 mp->b_datap->db_type, T_CAPABILITY_ACK); 3092 if (mp == NULL) 3093 return; 3094 3095 tcap = (struct T_capability_ack *)mp->b_rptr; 3096 tcap->CAP_bits1 = 0; 3097 3098 if (cap_bits1 & TC1_INFO) { 3099 spdsock_copy_info(&tcap->INFO_ack, ss); 3100 tcap->CAP_bits1 |= TC1_INFO; 3101 } 3102 3103 qreply(q, mp); 3104 } 3105 3106 /* 3107 * This routine responds to T_INFO_REQ messages. It is called by 3108 * spdsock_wput_other. 3109 * Most of the T_INFO_ACK information is copied from spdsock_g_t_info_ack. 3110 * The current state of the stream is copied from spdsock_state. 3111 */ 3112 static void 3113 spdsock_info_req(q, mp) 3114 queue_t *q; 3115 mblk_t *mp; 3116 { 3117 mp = tpi_ack_alloc(mp, sizeof (struct T_info_ack), M_PCPROTO, 3118 T_INFO_ACK); 3119 if (mp == NULL) 3120 return; 3121 spdsock_copy_info((struct T_info_ack *)mp->b_rptr, 3122 (spdsock_t *)q->q_ptr); 3123 qreply(q, mp); 3124 } 3125 3126 /* 3127 * spdsock_err_ack. This routine creates a 3128 * T_ERROR_ACK message and passes it 3129 * upstream. 3130 */ 3131 static void 3132 spdsock_err_ack(q, mp, t_error, sys_error) 3133 queue_t *q; 3134 mblk_t *mp; 3135 int t_error; 3136 int sys_error; 3137 { 3138 if ((mp = mi_tpi_err_ack_alloc(mp, t_error, sys_error)) != NULL) 3139 qreply(q, mp); 3140 } 3141 3142 /* 3143 * This routine retrieves the current status of socket options. 3144 * It returns the size of the option retrieved. 3145 */ 3146 /* ARGSUSED */ 3147 int 3148 spdsock_opt_get(queue_t *q, int level, int name, uchar_t *ptr) 3149 { 3150 int *i1 = (int *)ptr; 3151 3152 switch (level) { 3153 case SOL_SOCKET: 3154 switch (name) { 3155 case SO_TYPE: 3156 *i1 = SOCK_RAW; 3157 break; 3158 /* 3159 * The following two items can be manipulated, 3160 * but changing them should do nothing. 3161 */ 3162 case SO_SNDBUF: 3163 *i1 = (int)q->q_hiwat; 3164 break; 3165 case SO_RCVBUF: 3166 *i1 = (int)(RD(q)->q_hiwat); 3167 break; 3168 } 3169 break; 3170 default: 3171 return (0); 3172 } 3173 return (sizeof (int)); 3174 } 3175 3176 /* 3177 * This routine sets socket options. 3178 */ 3179 /* ARGSUSED */ 3180 int 3181 spdsock_opt_set(queue_t *q, uint_t mgmt_flags, int level, int name, 3182 uint_t inlen, uchar_t *invalp, uint_t *outlenp, uchar_t *outvalp, 3183 void *thisdg_attrs, cred_t *cr, mblk_t *mblk) 3184 { 3185 int *i1 = (int *)invalp; 3186 spdsock_t *ss = (spdsock_t *)q->q_ptr; 3187 spd_stack_t *spds = ss->spdsock_spds; 3188 3189 switch (level) { 3190 case SOL_SOCKET: 3191 switch (name) { 3192 case SO_SNDBUF: 3193 if (*i1 > spds->spds_max_buf) 3194 return (ENOBUFS); 3195 q->q_hiwat = *i1; 3196 break; 3197 case SO_RCVBUF: 3198 if (*i1 > spds->spds_max_buf) 3199 return (ENOBUFS); 3200 RD(q)->q_hiwat = *i1; 3201 (void) proto_set_rx_hiwat(RD(q), NULL, *i1); 3202 break; 3203 } 3204 break; 3205 } 3206 return (0); 3207 } 3208 3209 3210 /* 3211 * Handle STREAMS messages. 3212 */ 3213 static void 3214 spdsock_wput_other(queue_t *q, mblk_t *mp) 3215 { 3216 struct iocblk *iocp; 3217 int error; 3218 spdsock_t *ss = (spdsock_t *)q->q_ptr; 3219 spd_stack_t *spds = ss->spdsock_spds; 3220 cred_t *cr; 3221 3222 switch (mp->b_datap->db_type) { 3223 case M_PROTO: 3224 case M_PCPROTO: 3225 if ((mp->b_wptr - mp->b_rptr) < sizeof (long)) { 3226 ss3dbg(spds, ( 3227 "spdsock_wput_other: Not big enough M_PROTO\n")); 3228 freemsg(mp); 3229 return; 3230 } 3231 cr = zone_get_kcred(netstackid_to_zoneid( 3232 spds->spds_netstack->netstack_stackid)); 3233 ASSERT(cr != NULL); 3234 3235 switch (((union T_primitives *)mp->b_rptr)->type) { 3236 case T_CAPABILITY_REQ: 3237 spdsock_capability_req(q, mp); 3238 break; 3239 case T_INFO_REQ: 3240 spdsock_info_req(q, mp); 3241 break; 3242 case T_SVR4_OPTMGMT_REQ: 3243 (void) svr4_optcom_req(q, mp, DB_CREDDEF(mp, cr), 3244 &spdsock_opt_obj, B_FALSE); 3245 break; 3246 case T_OPTMGMT_REQ: 3247 (void) tpi_optcom_req(q, mp, DB_CREDDEF(mp, cr), 3248 &spdsock_opt_obj, B_FALSE); 3249 break; 3250 case T_DATA_REQ: 3251 case T_EXDATA_REQ: 3252 case T_ORDREL_REQ: 3253 /* Illegal for spdsock. */ 3254 freemsg(mp); 3255 (void) putnextctl1(RD(q), M_ERROR, EPROTO); 3256 break; 3257 default: 3258 /* Not supported by spdsock. */ 3259 spdsock_err_ack(q, mp, TNOTSUPPORT, 0); 3260 break; 3261 } 3262 crfree(cr); 3263 return; 3264 case M_IOCTL: 3265 iocp = (struct iocblk *)mp->b_rptr; 3266 error = EINVAL; 3267 3268 switch (iocp->ioc_cmd) { 3269 case ND_SET: 3270 case ND_GET: 3271 if (nd_getset(q, spds->spds_g_nd, mp)) { 3272 qreply(q, mp); 3273 return; 3274 } else 3275 error = ENOENT; 3276 /* FALLTHRU */ 3277 default: 3278 miocnak(q, mp, 0, error); 3279 return; 3280 } 3281 case M_FLUSH: 3282 if (*mp->b_rptr & FLUSHW) { 3283 flushq(q, FLUSHALL); 3284 *mp->b_rptr &= ~FLUSHW; 3285 } 3286 if (*mp->b_rptr & FLUSHR) { 3287 qreply(q, mp); 3288 return; 3289 } 3290 /* Else FALLTHRU */ 3291 } 3292 3293 /* If fell through, just black-hole the message. */ 3294 freemsg(mp); 3295 } 3296 3297 static void 3298 spdsock_wput(queue_t *q, mblk_t *mp) 3299 { 3300 uint8_t *rptr = mp->b_rptr; 3301 mblk_t *mp1; 3302 spdsock_t *ss = (spdsock_t *)q->q_ptr; 3303 spd_stack_t *spds = ss->spdsock_spds; 3304 3305 /* 3306 * If we're dumping, defer processing other messages until the 3307 * dump completes. 3308 */ 3309 if (ss->spdsock_dump_req != NULL) { 3310 if (!putq(q, mp)) 3311 freemsg(mp); 3312 return; 3313 } 3314 3315 switch (mp->b_datap->db_type) { 3316 case M_DATA: 3317 /* 3318 * Silently discard. 3319 */ 3320 ss2dbg(spds, ("raw M_DATA in spdsock.\n")); 3321 freemsg(mp); 3322 return; 3323 case M_PROTO: 3324 case M_PCPROTO: 3325 if ((mp->b_wptr - rptr) >= sizeof (struct T_data_req)) { 3326 if (((union T_primitives *)rptr)->type == T_DATA_REQ) { 3327 if ((mp1 = mp->b_cont) == NULL) { 3328 /* No data after T_DATA_REQ. */ 3329 ss2dbg(spds, 3330 ("No data after DATA_REQ.\n")); 3331 freemsg(mp); 3332 return; 3333 } 3334 freeb(mp); 3335 mp = mp1; 3336 ss2dbg(spds, ("T_DATA_REQ\n")); 3337 break; /* Out of switch. */ 3338 } 3339 } 3340 /* FALLTHRU */ 3341 default: 3342 ss3dbg(spds, ("In default wput case (%d %d).\n", 3343 mp->b_datap->db_type, ((union T_primitives *)rptr)->type)); 3344 spdsock_wput_other(q, mp); 3345 return; 3346 } 3347 3348 /* I now have a PF_POLICY message in an M_DATA block. */ 3349 spdsock_parse(q, mp); 3350 } 3351 3352 /* 3353 * Device open procedure, called when new queue pair created. 3354 * We are passed the read-side queue. 3355 */ 3356 /* ARGSUSED */ 3357 static int 3358 spdsock_open(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp) 3359 { 3360 spdsock_t *ss; 3361 queue_t *oq = OTHERQ(q); 3362 minor_t ssminor; 3363 netstack_t *ns; 3364 spd_stack_t *spds; 3365 3366 if (secpolicy_ip_config(credp, B_FALSE) != 0) 3367 return (EPERM); 3368 3369 if (q->q_ptr != NULL) 3370 return (0); /* Re-open of an already open instance. */ 3371 3372 if (sflag & MODOPEN) 3373 return (EINVAL); 3374 3375 ns = netstack_find_by_cred(credp); 3376 ASSERT(ns != NULL); 3377 spds = ns->netstack_spdsock; 3378 ASSERT(spds != NULL); 3379 3380 ss2dbg(spds, ("Made it into PF_POLICY socket open.\n")); 3381 3382 ssminor = (minor_t)(uintptr_t)vmem_alloc(spdsock_vmem, 1, VM_NOSLEEP); 3383 if (ssminor == 0) { 3384 netstack_rele(spds->spds_netstack); 3385 return (ENOMEM); 3386 } 3387 ss = kmem_zalloc(sizeof (spdsock_t), KM_NOSLEEP); 3388 if (ss == NULL) { 3389 vmem_free(spdsock_vmem, (void *)(uintptr_t)ssminor, 1); 3390 netstack_rele(spds->spds_netstack); 3391 return (ENOMEM); 3392 } 3393 3394 ss->spdsock_minor = ssminor; 3395 ss->spdsock_state = TS_UNBND; 3396 ss->spdsock_dump_req = NULL; 3397 3398 ss->spdsock_spds = spds; 3399 3400 q->q_ptr = ss; 3401 oq->q_ptr = ss; 3402 3403 q->q_hiwat = spds->spds_recv_hiwat; 3404 3405 oq->q_hiwat = spds->spds_xmit_hiwat; 3406 oq->q_lowat = spds->spds_xmit_lowat; 3407 3408 qprocson(q); 3409 (void) proto_set_rx_hiwat(q, NULL, spds->spds_recv_hiwat); 3410 3411 *devp = makedevice(getmajor(*devp), ss->spdsock_minor); 3412 return (0); 3413 } 3414 3415 /* 3416 * Read-side service procedure, invoked when we get back-enabled 3417 * when buffer space becomes available. 3418 * 3419 * Dump another chunk if we were dumping before; when we finish, kick 3420 * the write-side queue in case it's waiting for read queue space. 3421 */ 3422 void 3423 spdsock_rsrv(queue_t *q) 3424 { 3425 spdsock_t *ss = q->q_ptr; 3426 3427 if (ss->spdsock_dump_req != NULL) 3428 spdsock_dump_some(q, ss); 3429 3430 if (ss->spdsock_dump_req == NULL) 3431 qenable(OTHERQ(q)); 3432 } 3433 3434 /* 3435 * Write-side service procedure, invoked when we defer processing 3436 * if another message is received while a dump is in progress. 3437 */ 3438 void 3439 spdsock_wsrv(queue_t *q) 3440 { 3441 spdsock_t *ss = q->q_ptr; 3442 mblk_t *mp; 3443 ipsec_stack_t *ipss = ss->spdsock_spds->spds_netstack->netstack_ipsec; 3444 3445 if (ss->spdsock_dump_req != NULL) { 3446 qenable(OTHERQ(q)); 3447 return; 3448 } 3449 3450 while ((mp = getq(q)) != NULL) { 3451 if (ipsec_loaded(ipss)) { 3452 spdsock_wput(q, mp); 3453 if (ss->spdsock_dump_req != NULL) 3454 return; 3455 } else if (!ipsec_failed(ipss)) { 3456 (void) putq(q, mp); 3457 } else { 3458 spdsock_error(q, mp, EPFNOSUPPORT, 0); 3459 } 3460 } 3461 } 3462 3463 static int 3464 spdsock_close(queue_t *q) 3465 { 3466 spdsock_t *ss = q->q_ptr; 3467 spd_stack_t *spds = ss->spdsock_spds; 3468 3469 qprocsoff(q); 3470 3471 /* Safe assumption. */ 3472 ASSERT(ss != NULL); 3473 3474 if (ss->spdsock_timeout != 0) 3475 (void) quntimeout(q, ss->spdsock_timeout); 3476 3477 ss3dbg(spds, ("Driver close, PF_POLICY socket is going away.\n")); 3478 3479 vmem_free(spdsock_vmem, (void *)(uintptr_t)ss->spdsock_minor, 1); 3480 netstack_rele(ss->spdsock_spds->spds_netstack); 3481 3482 kmem_free(ss, sizeof (spdsock_t)); 3483 return (0); 3484 } 3485 3486 /* 3487 * Merge the IPsec algorithms tables with the received algorithm information. 3488 */ 3489 void 3490 spdsock_merge_algs(spd_stack_t *spds) 3491 { 3492 ipsec_alginfo_t *alg, *oalg; 3493 ipsec_algtype_t algtype; 3494 uint_t algidx, algid, nalgs; 3495 crypto_mech_name_t *mechs; 3496 uint_t mech_count, mech_idx; 3497 netstack_t *ns = spds->spds_netstack; 3498 ipsec_stack_t *ipss = ns->netstack_ipsec; 3499 3500 ASSERT(MUTEX_HELD(&spds->spds_alg_lock)); 3501 3502 /* 3503 * Get the list of supported mechanisms from the crypto framework. 3504 * If a mechanism is supported by KCF, resolve its mechanism 3505 * id and mark it as being valid. This operation must be done 3506 * without holding alg_lock, since it can cause a provider 3507 * module to be loaded and the provider notification callback to 3508 * be invoked. 3509 */ 3510 mechs = crypto_get_mech_list(&mech_count, KM_SLEEP); 3511 for (algtype = 0; algtype < IPSEC_NALGTYPES; algtype++) { 3512 for (algid = 0; algid < IPSEC_MAX_ALGS; algid++) { 3513 int algflags = 0; 3514 crypto_mech_type_t mt = CRYPTO_MECHANISM_INVALID; 3515 3516 alg = spds->spds_algs[algtype][algid]; 3517 if (alg == NULL) 3518 continue; 3519 3520 /* 3521 * The NULL encryption algorithm is a special 3522 * case because there are no mechanisms, yet 3523 * the algorithm is still valid. 3524 */ 3525 if (alg->alg_id == SADB_EALG_NULL) { 3526 alg->alg_mech_type = CRYPTO_MECHANISM_INVALID; 3527 alg->alg_flags = ALG_FLAG_VALID; 3528 continue; 3529 } 3530 3531 for (mech_idx = 0; mech_idx < mech_count; mech_idx++) { 3532 if (strncmp(alg->alg_mech_name, mechs[mech_idx], 3533 CRYPTO_MAX_MECH_NAME) == 0) { 3534 mt = crypto_mech2id(alg->alg_mech_name); 3535 ASSERT(mt != CRYPTO_MECHANISM_INVALID); 3536 algflags = ALG_FLAG_VALID; 3537 break; 3538 } 3539 } 3540 alg->alg_mech_type = mt; 3541 alg->alg_flags = algflags; 3542 } 3543 } 3544 3545 mutex_enter(&ipss->ipsec_alg_lock); 3546 3547 /* 3548 * For each algorithm currently defined, check if it is 3549 * present in the new tables created from the SPD_UPDATEALGS 3550 * message received from user-space. 3551 * Delete the algorithm entries that are currently defined 3552 * but not part of the new tables. 3553 */ 3554 for (algtype = 0; algtype < IPSEC_NALGTYPES; algtype++) { 3555 nalgs = ipss->ipsec_nalgs[algtype]; 3556 for (algidx = 0; algidx < nalgs; algidx++) { 3557 algid = ipss->ipsec_sortlist[algtype][algidx]; 3558 if (spds->spds_algs[algtype][algid] == NULL) 3559 ipsec_alg_unreg(algtype, algid, ns); 3560 } 3561 } 3562 3563 /* 3564 * For each algorithm we just received, check if it is 3565 * present in the currently defined tables. If it is, swap 3566 * the entry with the one we just allocated. 3567 * If the new algorithm is not in the current tables, 3568 * add it. 3569 */ 3570 for (algtype = 0; algtype < IPSEC_NALGTYPES; algtype++) { 3571 for (algid = 0; algid < IPSEC_MAX_ALGS; algid++) { 3572 alg = spds->spds_algs[algtype][algid]; 3573 if (alg == NULL) 3574 continue; 3575 3576 if ((oalg = ipss->ipsec_alglists[algtype][algid]) == 3577 NULL) { 3578 /* 3579 * New algorithm, add it to the algorithm 3580 * table. 3581 */ 3582 ipsec_alg_reg(algtype, alg, ns); 3583 } else { 3584 /* 3585 * Algorithm is already in the table. Swap 3586 * the existing entry with the new one. 3587 */ 3588 ipsec_alg_fix_min_max(alg, algtype, ns); 3589 ipss->ipsec_alglists[algtype][algid] = alg; 3590 ipsec_alg_free(oalg); 3591 } 3592 spds->spds_algs[algtype][algid] = NULL; 3593 } 3594 } 3595 3596 for (algtype = 0; algtype < IPSEC_NALGTYPES; algtype++) { 3597 ipss->ipsec_algs_exec_mode[algtype] = 3598 spds->spds_algs_exec_mode[algtype]; 3599 } 3600 3601 mutex_exit(&ipss->ipsec_alg_lock); 3602 3603 crypto_free_mech_list(mechs, mech_count); 3604 3605 ipsecah_algs_changed(ns); 3606 ipsecesp_algs_changed(ns); 3607 } 3608