1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright 2009 Sun Microsystems, Inc. All rights reserved. 23 * Use is subject to license terms. 24 */ 25 26 #include <sys/types.h> 27 #include <sys/stream.h> 28 #include <sys/stropts.h> 29 #include <sys/strsubr.h> 30 #include <sys/errno.h> 31 #include <sys/ddi.h> 32 #include <sys/debug.h> 33 #include <sys/cmn_err.h> 34 #include <sys/stream.h> 35 #include <sys/strlog.h> 36 #include <sys/kmem.h> 37 #include <sys/sunddi.h> 38 #include <sys/tihdr.h> 39 #include <sys/atomic.h> 40 #include <sys/socket.h> 41 #include <sys/sysmacros.h> 42 #include <sys/crypto/common.h> 43 #include <sys/crypto/api.h> 44 #include <sys/zone.h> 45 #include <netinet/in.h> 46 #include <net/if.h> 47 #include <net/pfkeyv2.h> 48 #include <inet/common.h> 49 #include <netinet/ip6.h> 50 #include <inet/ip.h> 51 #include <inet/ip_ire.h> 52 #include <inet/ip6.h> 53 #include <inet/ipsec_info.h> 54 #include <inet/tcp.h> 55 #include <inet/sadb.h> 56 #include <inet/ipsec_impl.h> 57 #include <inet/ipsecah.h> 58 #include <inet/ipsecesp.h> 59 #include <sys/random.h> 60 #include <sys/dlpi.h> 61 #include <sys/iphada.h> 62 #include <inet/ip_if.h> 63 #include <inet/ipdrop.h> 64 #include <inet/ipclassifier.h> 65 #include <inet/sctp_ip.h> 66 #include <inet/tun.h> 67 68 /* 69 * This source file contains Security Association Database (SADB) common 70 * routines. They are linked in with the AH module. Since AH has no chance 71 * of falling under export control, it was safe to link it in there. 72 */ 73 74 static mblk_t *sadb_extended_acquire(ipsec_selector_t *, ipsec_policy_t *, 75 ipsec_action_t *, boolean_t, uint32_t, uint32_t, netstack_t *); 76 static void sadb_ill_df(ill_t *, mblk_t *, isaf_t *, int, boolean_t); 77 static ipsa_t *sadb_torch_assoc(isaf_t *, ipsa_t *, boolean_t, mblk_t **); 78 static void sadb_drain_torchq(queue_t *, mblk_t *); 79 static void sadb_destroy_acqlist(iacqf_t **, uint_t, boolean_t, 80 netstack_t *); 81 static void sadb_destroy(sadb_t *, netstack_t *); 82 static mblk_t *sadb_sa2msg(ipsa_t *, sadb_msg_t *); 83 84 static time_t sadb_add_time(time_t, uint64_t); 85 static void lifetime_fuzz(ipsa_t *); 86 static void age_pair_peer_list(templist_t *, sadb_t *, boolean_t); 87 static void ipsa_set_replay(ipsa_t *ipsa, uint32_t offset); 88 89 extern void (*cl_inet_getspi)(netstackid_t stack_id, uint8_t protocol, 90 uint8_t *ptr, size_t len, void *args); 91 extern int (*cl_inet_checkspi)(netstackid_t stack_id, uint8_t protocol, 92 uint32_t spi, void *args); 93 extern void (*cl_inet_deletespi)(netstackid_t stack_id, uint8_t protocol, 94 uint32_t spi, void *args); 95 96 /* 97 * ipsacq_maxpackets is defined here to make it tunable 98 * from /etc/system. 99 */ 100 extern uint64_t ipsacq_maxpackets; 101 102 #define SET_EXPIRE(sa, delta, exp) { \ 103 if (((sa)->ipsa_ ## delta) != 0) { \ 104 (sa)->ipsa_ ## exp = sadb_add_time((sa)->ipsa_addtime, \ 105 (sa)->ipsa_ ## delta); \ 106 } \ 107 } 108 109 #define UPDATE_EXPIRE(sa, delta, exp) { \ 110 if (((sa)->ipsa_ ## delta) != 0) { \ 111 time_t tmp = sadb_add_time((sa)->ipsa_usetime, \ 112 (sa)->ipsa_ ## delta); \ 113 if (((sa)->ipsa_ ## exp) == 0) \ 114 (sa)->ipsa_ ## exp = tmp; \ 115 else \ 116 (sa)->ipsa_ ## exp = \ 117 MIN((sa)->ipsa_ ## exp, tmp); \ 118 } \ 119 } 120 121 122 /* wrap the macro so we can pass it as a function pointer */ 123 void 124 sadb_sa_refrele(void *target) 125 { 126 IPSA_REFRELE(((ipsa_t *)target)); 127 } 128 129 /* 130 * We presume that sizeof (long) == sizeof (time_t) and that time_t is 131 * a signed type. 132 */ 133 #define TIME_MAX LONG_MAX 134 135 /* 136 * PF_KEY gives us lifetimes in uint64_t seconds. We presume that 137 * time_t is defined to be a signed type with the same range as 138 * "long". On ILP32 systems, we thus run the risk of wrapping around 139 * at end of time, as well as "overwrapping" the clock back around 140 * into a seemingly valid but incorrect future date earlier than the 141 * desired expiration. 142 * 143 * In order to avoid odd behavior (either negative lifetimes or loss 144 * of high order bits) when someone asks for bizarrely long SA 145 * lifetimes, we do a saturating add for expire times. 146 * 147 * We presume that ILP32 systems will be past end of support life when 148 * the 32-bit time_t overflows (a dangerous assumption, mind you..). 149 * 150 * On LP64, 2^64 seconds are about 5.8e11 years, at which point we 151 * will hopefully have figured out clever ways to avoid the use of 152 * fixed-sized integers in computation. 153 */ 154 static time_t 155 sadb_add_time(time_t base, uint64_t delta) 156 { 157 time_t sum; 158 159 /* 160 * Clip delta to the maximum possible time_t value to 161 * prevent "overwrapping" back into a shorter-than-desired 162 * future time. 163 */ 164 if (delta > TIME_MAX) 165 delta = TIME_MAX; 166 /* 167 * This sum may still overflow. 168 */ 169 sum = base + delta; 170 171 /* 172 * .. so if the result is less than the base, we overflowed. 173 */ 174 if (sum < base) 175 sum = TIME_MAX; 176 177 return (sum); 178 } 179 180 /* 181 * Callers of this function have already created a working security 182 * association, and have found the appropriate table & hash chain. All this 183 * function does is check duplicates, and insert the SA. The caller needs to 184 * hold the hash bucket lock and increment the refcnt before insertion. 185 * 186 * Return 0 if success, EEXIST if collision. 187 */ 188 #define SA_UNIQUE_MATCH(sa1, sa2) \ 189 (((sa1)->ipsa_unique_id & (sa1)->ipsa_unique_mask) == \ 190 ((sa2)->ipsa_unique_id & (sa2)->ipsa_unique_mask)) 191 192 int 193 sadb_insertassoc(ipsa_t *ipsa, isaf_t *bucket) 194 { 195 ipsa_t **ptpn = NULL; 196 ipsa_t *walker; 197 boolean_t unspecsrc; 198 199 ASSERT(MUTEX_HELD(&bucket->isaf_lock)); 200 201 unspecsrc = IPSA_IS_ADDR_UNSPEC(ipsa->ipsa_srcaddr, ipsa->ipsa_addrfam); 202 203 walker = bucket->isaf_ipsa; 204 ASSERT(walker == NULL || ipsa->ipsa_addrfam == walker->ipsa_addrfam); 205 206 /* 207 * Find insertion point (pointed to with **ptpn). Insert at the head 208 * of the list unless there's an unspecified source address, then 209 * insert it after the last SA with a specified source address. 210 * 211 * BTW, you'll have to walk the whole chain, matching on {DST, SPI} 212 * checking for collisions. 213 */ 214 215 while (walker != NULL) { 216 if (IPSA_ARE_ADDR_EQUAL(walker->ipsa_dstaddr, 217 ipsa->ipsa_dstaddr, ipsa->ipsa_addrfam)) { 218 if (walker->ipsa_spi == ipsa->ipsa_spi) 219 return (EEXIST); 220 221 mutex_enter(&walker->ipsa_lock); 222 if (ipsa->ipsa_state == IPSA_STATE_MATURE && 223 (walker->ipsa_flags & IPSA_F_USED) && 224 SA_UNIQUE_MATCH(walker, ipsa)) { 225 walker->ipsa_flags |= IPSA_F_CINVALID; 226 } 227 mutex_exit(&walker->ipsa_lock); 228 } 229 230 if (ptpn == NULL && unspecsrc) { 231 if (IPSA_IS_ADDR_UNSPEC(walker->ipsa_srcaddr, 232 walker->ipsa_addrfam)) 233 ptpn = walker->ipsa_ptpn; 234 else if (walker->ipsa_next == NULL) 235 ptpn = &walker->ipsa_next; 236 } 237 238 walker = walker->ipsa_next; 239 } 240 241 if (ptpn == NULL) 242 ptpn = &bucket->isaf_ipsa; 243 ipsa->ipsa_next = *ptpn; 244 ipsa->ipsa_ptpn = ptpn; 245 if (ipsa->ipsa_next != NULL) 246 ipsa->ipsa_next->ipsa_ptpn = &ipsa->ipsa_next; 247 *ptpn = ipsa; 248 ipsa->ipsa_linklock = &bucket->isaf_lock; 249 250 return (0); 251 } 252 #undef SA_UNIQUE_MATCH 253 254 /* 255 * Free a security association. Its reference count is 0, which means 256 * I must free it. The SA must be unlocked and must not be linked into 257 * any fanout list. 258 */ 259 static void 260 sadb_freeassoc(ipsa_t *ipsa) 261 { 262 ipsec_stack_t *ipss = ipsa->ipsa_netstack->netstack_ipsec; 263 264 ASSERT(ipss != NULL); 265 ASSERT(MUTEX_NOT_HELD(&ipsa->ipsa_lock)); 266 ASSERT(ipsa->ipsa_refcnt == 0); 267 ASSERT(ipsa->ipsa_next == NULL); 268 ASSERT(ipsa->ipsa_ptpn == NULL); 269 270 mutex_enter(&ipsa->ipsa_lock); 271 /* Don't call sadb_clear_lpkt() since we hold the ipsa_lock anyway. */ 272 ip_drop_packet(ipsa->ipsa_lpkt, B_TRUE, NULL, NULL, 273 DROPPER(ipss, ipds_sadb_inlarval_timeout), 274 &ipss->ipsec_sadb_dropper); 275 ipsec_destroy_ctx_tmpl(ipsa, IPSEC_ALG_AUTH); 276 ipsec_destroy_ctx_tmpl(ipsa, IPSEC_ALG_ENCR); 277 mutex_exit(&ipsa->ipsa_lock); 278 279 /* bzero() these fields for paranoia's sake. */ 280 if (ipsa->ipsa_authkey != NULL) { 281 bzero(ipsa->ipsa_authkey, ipsa->ipsa_authkeylen); 282 kmem_free(ipsa->ipsa_authkey, ipsa->ipsa_authkeylen); 283 } 284 if (ipsa->ipsa_encrkey != NULL) { 285 bzero(ipsa->ipsa_encrkey, ipsa->ipsa_encrkeylen); 286 kmem_free(ipsa->ipsa_encrkey, ipsa->ipsa_encrkeylen); 287 } 288 if (ipsa->ipsa_src_cid != NULL) { 289 IPSID_REFRELE(ipsa->ipsa_src_cid); 290 } 291 if (ipsa->ipsa_dst_cid != NULL) { 292 IPSID_REFRELE(ipsa->ipsa_dst_cid); 293 } 294 if (ipsa->ipsa_integ != NULL) 295 kmem_free(ipsa->ipsa_integ, ipsa->ipsa_integlen); 296 if (ipsa->ipsa_sens != NULL) 297 kmem_free(ipsa->ipsa_sens, ipsa->ipsa_senslen); 298 299 mutex_destroy(&ipsa->ipsa_lock); 300 kmem_free(ipsa, sizeof (*ipsa)); 301 } 302 303 /* 304 * Unlink a security association from a hash bucket. Assume the hash bucket 305 * lock is held, but the association's lock is not. 306 * 307 * Note that we do not bump the bucket's generation number here because 308 * we might not be making a visible change to the set of visible SA's. 309 * All callers MUST bump the bucket's generation number before they unlock 310 * the bucket if they use sadb_unlinkassoc to permanetly remove an SA which 311 * was present in the bucket at the time it was locked. 312 */ 313 void 314 sadb_unlinkassoc(ipsa_t *ipsa) 315 { 316 ASSERT(ipsa->ipsa_linklock != NULL); 317 ASSERT(MUTEX_HELD(ipsa->ipsa_linklock)); 318 319 /* These fields are protected by the link lock. */ 320 *(ipsa->ipsa_ptpn) = ipsa->ipsa_next; 321 if (ipsa->ipsa_next != NULL) { 322 ipsa->ipsa_next->ipsa_ptpn = ipsa->ipsa_ptpn; 323 ipsa->ipsa_next = NULL; 324 } 325 326 ipsa->ipsa_ptpn = NULL; 327 328 /* This may destroy the SA. */ 329 IPSA_REFRELE(ipsa); 330 } 331 332 void 333 sadb_delete_cluster(ipsa_t *assoc) 334 { 335 uint8_t protocol; 336 337 if (cl_inet_deletespi && 338 ((assoc->ipsa_state == IPSA_STATE_LARVAL) || 339 (assoc->ipsa_state == IPSA_STATE_MATURE))) { 340 protocol = (assoc->ipsa_type == SADB_SATYPE_AH) ? 341 IPPROTO_AH : IPPROTO_ESP; 342 cl_inet_deletespi(assoc->ipsa_netstack->netstack_stackid, 343 protocol, assoc->ipsa_spi, NULL); 344 } 345 } 346 347 /* 348 * Create a larval security association with the specified SPI. All other 349 * fields are zeroed. 350 */ 351 static ipsa_t * 352 sadb_makelarvalassoc(uint32_t spi, uint32_t *src, uint32_t *dst, int addrfam, 353 netstack_t *ns) 354 { 355 ipsa_t *newbie; 356 357 /* 358 * Allocate... 359 */ 360 361 newbie = (ipsa_t *)kmem_zalloc(sizeof (ipsa_t), KM_NOSLEEP); 362 if (newbie == NULL) { 363 /* Can't make new larval SA. */ 364 return (NULL); 365 } 366 367 /* Assigned requested SPI, assume caller does SPI allocation magic. */ 368 newbie->ipsa_spi = spi; 369 newbie->ipsa_netstack = ns; /* No netstack_hold */ 370 371 /* 372 * Copy addresses... 373 */ 374 375 IPSA_COPY_ADDR(newbie->ipsa_srcaddr, src, addrfam); 376 IPSA_COPY_ADDR(newbie->ipsa_dstaddr, dst, addrfam); 377 378 newbie->ipsa_addrfam = addrfam; 379 380 /* 381 * Set common initialization values, including refcnt. 382 */ 383 mutex_init(&newbie->ipsa_lock, NULL, MUTEX_DEFAULT, NULL); 384 newbie->ipsa_state = IPSA_STATE_LARVAL; 385 newbie->ipsa_refcnt = 1; 386 newbie->ipsa_freefunc = sadb_freeassoc; 387 388 /* 389 * There aren't a lot of other common initialization values, as 390 * they are copied in from the PF_KEY message. 391 */ 392 393 return (newbie); 394 } 395 396 /* 397 * Call me to initialize a security association fanout. 398 */ 399 static int 400 sadb_init_fanout(isaf_t **tablep, uint_t size, int kmflag) 401 { 402 isaf_t *table; 403 int i; 404 405 table = (isaf_t *)kmem_alloc(size * sizeof (*table), kmflag); 406 *tablep = table; 407 408 if (table == NULL) 409 return (ENOMEM); 410 411 for (i = 0; i < size; i++) { 412 mutex_init(&(table[i].isaf_lock), NULL, MUTEX_DEFAULT, NULL); 413 table[i].isaf_ipsa = NULL; 414 table[i].isaf_gen = 0; 415 } 416 417 return (0); 418 } 419 420 /* 421 * Call me to initialize an acquire fanout 422 */ 423 static int 424 sadb_init_acfanout(iacqf_t **tablep, uint_t size, int kmflag) 425 { 426 iacqf_t *table; 427 int i; 428 429 table = (iacqf_t *)kmem_alloc(size * sizeof (*table), kmflag); 430 *tablep = table; 431 432 if (table == NULL) 433 return (ENOMEM); 434 435 for (i = 0; i < size; i++) { 436 mutex_init(&(table[i].iacqf_lock), NULL, MUTEX_DEFAULT, NULL); 437 table[i].iacqf_ipsacq = NULL; 438 } 439 440 return (0); 441 } 442 443 /* 444 * Attempt to initialize an SADB instance. On failure, return ENOMEM; 445 * caller must clean up partial allocations. 446 */ 447 static int 448 sadb_init_trial(sadb_t *sp, uint_t size, int kmflag) 449 { 450 ASSERT(sp->sdb_of == NULL); 451 ASSERT(sp->sdb_if == NULL); 452 ASSERT(sp->sdb_acq == NULL); 453 454 sp->sdb_hashsize = size; 455 if (sadb_init_fanout(&sp->sdb_of, size, kmflag) != 0) 456 return (ENOMEM); 457 if (sadb_init_fanout(&sp->sdb_if, size, kmflag) != 0) 458 return (ENOMEM); 459 if (sadb_init_acfanout(&sp->sdb_acq, size, kmflag) != 0) 460 return (ENOMEM); 461 462 return (0); 463 } 464 465 /* 466 * Call me to initialize an SADB instance; fall back to default size on failure. 467 */ 468 static void 469 sadb_init(const char *name, sadb_t *sp, uint_t size, uint_t ver, 470 netstack_t *ns) 471 { 472 ASSERT(sp->sdb_of == NULL); 473 ASSERT(sp->sdb_if == NULL); 474 ASSERT(sp->sdb_acq == NULL); 475 476 if (size < IPSEC_DEFAULT_HASH_SIZE) 477 size = IPSEC_DEFAULT_HASH_SIZE; 478 479 if (sadb_init_trial(sp, size, KM_NOSLEEP) != 0) { 480 481 cmn_err(CE_WARN, 482 "Unable to allocate %u entry IPv%u %s SADB hash table", 483 size, ver, name); 484 485 sadb_destroy(sp, ns); 486 size = IPSEC_DEFAULT_HASH_SIZE; 487 cmn_err(CE_WARN, "Falling back to %d entries", size); 488 (void) sadb_init_trial(sp, size, KM_SLEEP); 489 } 490 } 491 492 493 /* 494 * Initialize an SADB-pair. 495 */ 496 void 497 sadbp_init(const char *name, sadbp_t *sp, int type, int size, netstack_t *ns) 498 { 499 sadb_init(name, &sp->s_v4, size, 4, ns); 500 sadb_init(name, &sp->s_v6, size, 6, ns); 501 502 sp->s_satype = type; 503 504 ASSERT((type == SADB_SATYPE_AH) || (type == SADB_SATYPE_ESP)); 505 if (type == SADB_SATYPE_AH) { 506 ipsec_stack_t *ipss = ns->netstack_ipsec; 507 508 ip_drop_register(&ipss->ipsec_sadb_dropper, "IPsec SADB"); 509 sp->s_addflags = AH_ADD_SETTABLE_FLAGS; 510 sp->s_updateflags = AH_UPDATE_SETTABLE_FLAGS; 511 } else { 512 sp->s_addflags = ESP_ADD_SETTABLE_FLAGS; 513 sp->s_updateflags = ESP_UPDATE_SETTABLE_FLAGS; 514 } 515 } 516 517 /* 518 * Deliver a single SADB_DUMP message representing a single SA. This is 519 * called many times by sadb_dump(). 520 * 521 * If the return value of this is ENOBUFS (not the same as ENOMEM), then 522 * the caller should take that as a hint that dupb() on the "original answer" 523 * failed, and that perhaps the caller should try again with a copyb()ed 524 * "original answer". 525 */ 526 static int 527 sadb_dump_deliver(queue_t *pfkey_q, mblk_t *original_answer, ipsa_t *ipsa, 528 sadb_msg_t *samsg) 529 { 530 mblk_t *answer; 531 532 answer = dupb(original_answer); 533 if (answer == NULL) 534 return (ENOBUFS); 535 answer->b_cont = sadb_sa2msg(ipsa, samsg); 536 if (answer->b_cont == NULL) { 537 freeb(answer); 538 return (ENOMEM); 539 } 540 541 /* Just do a putnext, and let keysock deal with flow control. */ 542 putnext(pfkey_q, answer); 543 return (0); 544 } 545 546 /* 547 * Common function to allocate and prepare a keysock_out_t M_CTL message. 548 */ 549 mblk_t * 550 sadb_keysock_out(minor_t serial) 551 { 552 mblk_t *mp; 553 keysock_out_t *kso; 554 555 mp = allocb(sizeof (ipsec_info_t), BPRI_HI); 556 if (mp != NULL) { 557 mp->b_datap->db_type = M_CTL; 558 mp->b_wptr += sizeof (ipsec_info_t); 559 kso = (keysock_out_t *)mp->b_rptr; 560 kso->ks_out_type = KEYSOCK_OUT; 561 kso->ks_out_len = sizeof (*kso); 562 kso->ks_out_serial = serial; 563 } 564 565 return (mp); 566 } 567 568 /* 569 * Perform an SADB_DUMP, spewing out every SA in an array of SA fanouts 570 * to keysock. 571 */ 572 static int 573 sadb_dump_fanout(queue_t *pfkey_q, mblk_t *mp, minor_t serial, isaf_t *fanout, 574 int num_entries, boolean_t do_peers, time_t active_time) 575 { 576 int i, error = 0; 577 mblk_t *original_answer; 578 ipsa_t *walker; 579 sadb_msg_t *samsg; 580 time_t current; 581 582 /* 583 * For each IPSA hash bucket do: 584 * - Hold the mutex 585 * - Walk each entry, doing an sadb_dump_deliver() on it. 586 */ 587 ASSERT(mp->b_cont != NULL); 588 samsg = (sadb_msg_t *)mp->b_cont->b_rptr; 589 590 original_answer = sadb_keysock_out(serial); 591 if (original_answer == NULL) 592 return (ENOMEM); 593 594 current = gethrestime_sec(); 595 for (i = 0; i < num_entries; i++) { 596 mutex_enter(&fanout[i].isaf_lock); 597 for (walker = fanout[i].isaf_ipsa; walker != NULL; 598 walker = walker->ipsa_next) { 599 if (!do_peers && walker->ipsa_haspeer) 600 continue; 601 if ((active_time != 0) && 602 ((current - walker->ipsa_lastuse) > active_time)) 603 continue; 604 error = sadb_dump_deliver(pfkey_q, original_answer, 605 walker, samsg); 606 if (error == ENOBUFS) { 607 mblk_t *new_original_answer; 608 609 /* Ran out of dupb's. Try a copyb. */ 610 new_original_answer = copyb(original_answer); 611 if (new_original_answer == NULL) { 612 error = ENOMEM; 613 } else { 614 freeb(original_answer); 615 original_answer = new_original_answer; 616 error = sadb_dump_deliver(pfkey_q, 617 original_answer, walker, samsg); 618 } 619 } 620 if (error != 0) 621 break; /* out of for loop. */ 622 } 623 mutex_exit(&fanout[i].isaf_lock); 624 if (error != 0) 625 break; /* out of for loop. */ 626 } 627 628 freeb(original_answer); 629 return (error); 630 } 631 632 /* 633 * Dump an entire SADB; outbound first, then inbound. 634 */ 635 636 int 637 sadb_dump(queue_t *pfkey_q, mblk_t *mp, keysock_in_t *ksi, sadb_t *sp) 638 { 639 int error; 640 time_t active_time = 0; 641 sadb_x_edump_t *edump = 642 (sadb_x_edump_t *)ksi->ks_in_extv[SADB_X_EXT_EDUMP]; 643 644 if (edump != NULL) { 645 active_time = edump->sadb_x_edump_timeout; 646 } 647 648 /* Dump outbound */ 649 error = sadb_dump_fanout(pfkey_q, mp, ksi->ks_in_serial, sp->sdb_of, 650 sp->sdb_hashsize, B_TRUE, active_time); 651 if (error) 652 return (error); 653 654 /* Dump inbound */ 655 return sadb_dump_fanout(pfkey_q, mp, ksi->ks_in_serial, sp->sdb_if, 656 sp->sdb_hashsize, B_FALSE, active_time); 657 } 658 659 /* 660 * Generic sadb table walker. 661 * 662 * Call "walkfn" for each SA in each bucket in "table"; pass the 663 * bucket, the entry and "cookie" to the callback function. 664 * Take care to ensure that walkfn can delete the SA without screwing 665 * up our traverse. 666 * 667 * The bucket is locked for the duration of the callback, both so that the 668 * callback can just call sadb_unlinkassoc() when it wants to delete something, 669 * and so that no new entries are added while we're walking the list. 670 */ 671 static void 672 sadb_walker(isaf_t *table, uint_t numentries, 673 void (*walkfn)(isaf_t *head, ipsa_t *entry, void *cookie), 674 void *cookie) 675 { 676 int i; 677 for (i = 0; i < numentries; i++) { 678 ipsa_t *entry, *next; 679 680 mutex_enter(&table[i].isaf_lock); 681 682 for (entry = table[i].isaf_ipsa; entry != NULL; 683 entry = next) { 684 next = entry->ipsa_next; 685 (*walkfn)(&table[i], entry, cookie); 686 } 687 mutex_exit(&table[i].isaf_lock); 688 } 689 } 690 691 /* 692 * From the given SA, construct a dl_ct_ipsec_key and 693 * a dl_ct_ipsec structures to be sent to the adapter as part 694 * of a DL_CONTROL_REQ. 695 * 696 * ct_sa must point to the storage allocated for the key 697 * structure and must be followed by storage allocated 698 * for the SA information that must be sent to the driver 699 * as part of the DL_CONTROL_REQ request. 700 * 701 * The is_inbound boolean indicates whether the specified 702 * SA is part of an inbound SA table. 703 * 704 * Returns B_TRUE if the corresponding SA must be passed to 705 * a provider, B_FALSE otherwise; frees *mp if it returns B_FALSE. 706 */ 707 static boolean_t 708 sadb_req_from_sa(ipsa_t *sa, mblk_t *mp, boolean_t is_inbound) 709 { 710 dl_ct_ipsec_key_t *keyp; 711 dl_ct_ipsec_t *sap; 712 void *ct_sa = mp->b_wptr; 713 714 ASSERT(MUTEX_HELD(&sa->ipsa_lock)); 715 716 keyp = (dl_ct_ipsec_key_t *)(ct_sa); 717 sap = (dl_ct_ipsec_t *)(keyp + 1); 718 719 IPSECHW_DEBUG(IPSECHW_CAPAB, ("sadb_req_from_sa: " 720 "is_inbound = %d\n", is_inbound)); 721 722 /* initialize flag */ 723 sap->sadb_sa_flags = 0; 724 if (is_inbound) { 725 sap->sadb_sa_flags |= DL_CT_IPSEC_INBOUND; 726 /* 727 * If an inbound SA has a peer, then mark it has being 728 * an outbound SA as well. 729 */ 730 if (sa->ipsa_haspeer) 731 sap->sadb_sa_flags |= DL_CT_IPSEC_OUTBOUND; 732 } else { 733 /* 734 * If an outbound SA has a peer, then don't send it, 735 * since we will send the copy from the inbound table. 736 */ 737 if (sa->ipsa_haspeer) { 738 freemsg(mp); 739 return (B_FALSE); 740 } 741 sap->sadb_sa_flags |= DL_CT_IPSEC_OUTBOUND; 742 } 743 744 keyp->dl_key_spi = sa->ipsa_spi; 745 bcopy(sa->ipsa_dstaddr, keyp->dl_key_dest_addr, 746 DL_CTL_IPSEC_ADDR_LEN); 747 keyp->dl_key_addr_family = sa->ipsa_addrfam; 748 749 sap->sadb_sa_auth = sa->ipsa_auth_alg; 750 sap->sadb_sa_encrypt = sa->ipsa_encr_alg; 751 752 sap->sadb_key_len_a = sa->ipsa_authkeylen; 753 sap->sadb_key_bits_a = sa->ipsa_authkeybits; 754 bcopy(sa->ipsa_authkey, 755 sap->sadb_key_data_a, sap->sadb_key_len_a); 756 757 sap->sadb_key_len_e = sa->ipsa_encrkeylen; 758 sap->sadb_key_bits_e = sa->ipsa_encrkeybits; 759 bcopy(sa->ipsa_encrkey, 760 sap->sadb_key_data_e, sap->sadb_key_len_e); 761 762 mp->b_wptr += sizeof (dl_ct_ipsec_t) + sizeof (dl_ct_ipsec_key_t); 763 return (B_TRUE); 764 } 765 766 /* 767 * Called from AH or ESP to format a message which will be used to inform 768 * IPsec-acceleration-capable ills of a SADB change. 769 * (It is not possible to send the message to IP directly from this function 770 * since the SA, if any, is locked during the call). 771 * 772 * dl_operation: DL_CONTROL_REQ operation (add, delete, update, etc) 773 * sa_type: identifies whether the operation applies to AH or ESP 774 * (must be one of SADB_SATYPE_AH or SADB_SATYPE_ESP) 775 * sa: Pointer to an SA. Must be non-NULL and locked 776 * for ADD, DELETE, GET, and UPDATE operations. 777 * This function returns an mblk chain that must be passed to IP 778 * for forwarding to the IPsec capable providers. 779 */ 780 mblk_t * 781 sadb_fmt_sa_req(uint_t dl_operation, uint_t sa_type, ipsa_t *sa, 782 boolean_t is_inbound) 783 { 784 mblk_t *mp; 785 dl_control_req_t *ctrl; 786 boolean_t need_key = B_FALSE; 787 mblk_t *ctl_mp = NULL; 788 ipsec_ctl_t *ctl; 789 790 /* 791 * 1 allocate and initialize DL_CONTROL_REQ M_PROTO 792 * 2 if a key is needed for the operation 793 * 2.1 initialize key 794 * 2.2 if a full SA is needed for the operation 795 * 2.2.1 initialize full SA info 796 * 3 return message; caller will call ill_ipsec_capab_send_all() 797 * to send the resulting message to IPsec capable ills. 798 */ 799 800 ASSERT(sa_type == SADB_SATYPE_AH || sa_type == SADB_SATYPE_ESP); 801 802 /* 803 * Allocate DL_CONTROL_REQ M_PROTO 804 * We allocate room for the SA even if it's not needed 805 * by some of the operations (for example flush) 806 */ 807 mp = allocb(sizeof (dl_control_req_t) + 808 sizeof (dl_ct_ipsec_key_t) + sizeof (dl_ct_ipsec_t), BPRI_HI); 809 if (mp == NULL) 810 return (NULL); 811 mp->b_datap->db_type = M_PROTO; 812 813 /* initialize dl_control_req_t */ 814 ctrl = (dl_control_req_t *)mp->b_wptr; 815 ctrl->dl_primitive = DL_CONTROL_REQ; 816 ctrl->dl_operation = dl_operation; 817 ctrl->dl_type = sa_type == SADB_SATYPE_AH ? DL_CT_IPSEC_AH : 818 DL_CT_IPSEC_ESP; 819 ctrl->dl_key_offset = sizeof (dl_control_req_t); 820 ctrl->dl_key_length = sizeof (dl_ct_ipsec_key_t); 821 ctrl->dl_data_offset = sizeof (dl_control_req_t) + 822 sizeof (dl_ct_ipsec_key_t); 823 ctrl->dl_data_length = sizeof (dl_ct_ipsec_t); 824 mp->b_wptr += sizeof (dl_control_req_t); 825 826 if ((dl_operation == DL_CO_SET) || (dl_operation == DL_CO_DELETE)) { 827 ASSERT(sa != NULL); 828 ASSERT(MUTEX_HELD(&sa->ipsa_lock)); 829 830 need_key = B_TRUE; 831 832 /* 833 * Initialize key and SA data. Note that for some 834 * operations the SA data is ignored by the provider 835 * (delete, etc.) 836 */ 837 if (!sadb_req_from_sa(sa, mp, is_inbound)) 838 return (NULL); 839 } 840 841 /* construct control message */ 842 ctl_mp = allocb(sizeof (ipsec_ctl_t), BPRI_HI); 843 if (ctl_mp == NULL) { 844 cmn_err(CE_WARN, "sadb_fmt_sa_req: allocb failed\n"); 845 freemsg(mp); 846 return (NULL); 847 } 848 849 ctl_mp->b_datap->db_type = M_CTL; 850 ctl_mp->b_wptr += sizeof (ipsec_ctl_t); 851 ctl_mp->b_cont = mp; 852 853 ctl = (ipsec_ctl_t *)ctl_mp->b_rptr; 854 ctl->ipsec_ctl_type = IPSEC_CTL; 855 ctl->ipsec_ctl_len = sizeof (ipsec_ctl_t); 856 ctl->ipsec_ctl_sa_type = sa_type; 857 858 if (need_key) { 859 /* 860 * Keep an additional reference on SA, since it will be 861 * needed by IP to send control messages corresponding 862 * to that SA from its perimeter. IP will do a 863 * IPSA_REFRELE when done with the request. 864 */ 865 ASSERT(MUTEX_HELD(&sa->ipsa_lock)); 866 IPSA_REFHOLD(sa); 867 ctl->ipsec_ctl_sa = sa; 868 } else 869 ctl->ipsec_ctl_sa = NULL; 870 871 return (ctl_mp); 872 } 873 874 875 /* 876 * Called by sadb_ill_download() to dump the entries for a specific 877 * fanout table. For each SA entry in the table passed as argument, 878 * use mp as a template and constructs a full DL_CONTROL message, and 879 * call ill_dlpi_send(), provided by IP, to send the resulting 880 * messages to the ill. 881 */ 882 static void 883 sadb_ill_df(ill_t *ill, mblk_t *mp, isaf_t *fanout, int num_entries, 884 boolean_t is_inbound) 885 { 886 ipsa_t *walker; 887 mblk_t *nmp, *salist; 888 int i, error = 0; 889 ip_stack_t *ipst = ill->ill_ipst; 890 netstack_t *ns = ipst->ips_netstack; 891 892 IPSECHW_DEBUG(IPSECHW_SADB, ("sadb_ill_df: fanout at 0x%p ne=%d\n", 893 (void *)fanout, num_entries)); 894 /* 895 * For each IPSA hash bucket do: 896 * - Hold the mutex 897 * - Walk each entry, sending a corresponding request to IP 898 * for it. 899 */ 900 ASSERT(mp->b_datap->db_type == M_PROTO); 901 902 for (i = 0; i < num_entries; i++) { 903 mutex_enter(&fanout[i].isaf_lock); 904 salist = NULL; 905 906 for (walker = fanout[i].isaf_ipsa; walker != NULL; 907 walker = walker->ipsa_next) { 908 IPSECHW_DEBUG(IPSECHW_SADB, 909 ("sadb_ill_df: sending SA to ill via IP \n")); 910 /* 911 * Duplicate the template mp passed and 912 * complete DL_CONTROL_REQ data. 913 * To be more memory efficient, we could use 914 * dupb() for the M_CTL and copyb() for the M_PROTO 915 * as the M_CTL, since the M_CTL is the same for 916 * every SA entry passed down to IP for the same ill. 917 * 918 * Note that copymsg/copyb ensure that the new mblk 919 * is at least as large as the source mblk even if it's 920 * not using all its storage -- therefore, nmp 921 * has trailing space for sadb_req_from_sa to add 922 * the SA-specific bits. 923 */ 924 mutex_enter(&walker->ipsa_lock); 925 if (ipsec_capab_match(ill, 926 ill->ill_phyint->phyint_ifindex, ill->ill_isv6, 927 walker, ns)) { 928 nmp = copymsg(mp); 929 if (nmp == NULL) { 930 IPSECHW_DEBUG(IPSECHW_SADB, 931 ("sadb_ill_df: alloc error\n")); 932 error = ENOMEM; 933 mutex_exit(&walker->ipsa_lock); 934 break; 935 } 936 if (sadb_req_from_sa(walker, nmp, is_inbound)) { 937 nmp->b_next = salist; 938 salist = nmp; 939 } 940 } 941 mutex_exit(&walker->ipsa_lock); 942 } 943 mutex_exit(&fanout[i].isaf_lock); 944 while (salist != NULL) { 945 nmp = salist; 946 salist = nmp->b_next; 947 nmp->b_next = NULL; 948 ill_dlpi_send(ill, nmp); 949 } 950 if (error != 0) 951 break; /* out of for loop. */ 952 } 953 } 954 955 /* 956 * Called by ill_ipsec_capab_add(). Sends a copy of the SADB of 957 * the type specified by sa_type to the specified ill. 958 * 959 * We call for each fanout table defined by the SADB (one per 960 * protocol). sadb_ill_df() finally calls ill_dlpi_send() for 961 * each SADB entry in order to send a corresponding DL_CONTROL_REQ 962 * message to the ill. 963 */ 964 void 965 sadb_ill_download(ill_t *ill, uint_t sa_type) 966 { 967 mblk_t *protomp; /* prototype message */ 968 dl_control_req_t *ctrl; 969 sadbp_t *spp; 970 sadb_t *sp; 971 int dlt; 972 ip_stack_t *ipst = ill->ill_ipst; 973 netstack_t *ns = ipst->ips_netstack; 974 975 ASSERT(sa_type == SADB_SATYPE_AH || sa_type == SADB_SATYPE_ESP); 976 977 /* 978 * Allocate and initialize prototype answer. A duplicate for 979 * each SA is sent down to the interface. 980 */ 981 982 /* DL_CONTROL_REQ M_PROTO mblk_t */ 983 protomp = allocb(sizeof (dl_control_req_t) + 984 sizeof (dl_ct_ipsec_key_t) + sizeof (dl_ct_ipsec_t), BPRI_HI); 985 if (protomp == NULL) 986 return; 987 protomp->b_datap->db_type = M_PROTO; 988 989 dlt = (sa_type == SADB_SATYPE_AH) ? DL_CT_IPSEC_AH : DL_CT_IPSEC_ESP; 990 if (sa_type == SADB_SATYPE_ESP) { 991 ipsecesp_stack_t *espstack = ns->netstack_ipsecesp; 992 993 spp = &espstack->esp_sadb; 994 } else { 995 ipsecah_stack_t *ahstack = ns->netstack_ipsecah; 996 997 spp = &ahstack->ah_sadb; 998 } 999 1000 ctrl = (dl_control_req_t *)protomp->b_wptr; 1001 ctrl->dl_primitive = DL_CONTROL_REQ; 1002 ctrl->dl_operation = DL_CO_SET; 1003 ctrl->dl_type = dlt; 1004 ctrl->dl_key_offset = sizeof (dl_control_req_t); 1005 ctrl->dl_key_length = sizeof (dl_ct_ipsec_key_t); 1006 ctrl->dl_data_offset = sizeof (dl_control_req_t) + 1007 sizeof (dl_ct_ipsec_key_t); 1008 ctrl->dl_data_length = sizeof (dl_ct_ipsec_t); 1009 protomp->b_wptr += sizeof (dl_control_req_t); 1010 1011 /* 1012 * then for each SADB entry, we fill out the dl_ct_ipsec_key_t 1013 * and dl_ct_ipsec_t 1014 */ 1015 sp = ill->ill_isv6 ? &(spp->s_v6) : &(spp->s_v4); 1016 sadb_ill_df(ill, protomp, sp->sdb_of, sp->sdb_hashsize, B_FALSE); 1017 sadb_ill_df(ill, protomp, sp->sdb_if, sp->sdb_hashsize, B_TRUE); 1018 freemsg(protomp); 1019 } 1020 1021 /* 1022 * Call me to free up a security association fanout. Use the forever 1023 * variable to indicate freeing up the SAs (forever == B_FALSE, e.g. 1024 * an SADB_FLUSH message), or destroying everything (forever == B_TRUE, 1025 * when a module is unloaded). 1026 */ 1027 static void 1028 sadb_destroyer(isaf_t **tablep, uint_t numentries, boolean_t forever, 1029 boolean_t inbound) 1030 { 1031 int i; 1032 isaf_t *table = *tablep; 1033 uint8_t protocol; 1034 ipsa_t *sa; 1035 netstackid_t sid; 1036 1037 if (table == NULL) 1038 return; 1039 1040 for (i = 0; i < numentries; i++) { 1041 mutex_enter(&table[i].isaf_lock); 1042 while ((sa = table[i].isaf_ipsa) != NULL) { 1043 if (inbound && cl_inet_deletespi && 1044 (sa->ipsa_state != IPSA_STATE_ACTIVE_ELSEWHERE) && 1045 (sa->ipsa_state != IPSA_STATE_IDLE)) { 1046 protocol = (sa->ipsa_type == SADB_SATYPE_AH) ? 1047 IPPROTO_AH : IPPROTO_ESP; 1048 sid = sa->ipsa_netstack->netstack_stackid; 1049 cl_inet_deletespi(sid, protocol, sa->ipsa_spi, 1050 NULL); 1051 } 1052 sadb_unlinkassoc(sa); 1053 } 1054 table[i].isaf_gen++; 1055 mutex_exit(&table[i].isaf_lock); 1056 if (forever) 1057 mutex_destroy(&(table[i].isaf_lock)); 1058 } 1059 1060 if (forever) { 1061 *tablep = NULL; 1062 kmem_free(table, numentries * sizeof (*table)); 1063 } 1064 } 1065 1066 /* 1067 * Entry points to sadb_destroyer(). 1068 */ 1069 static void 1070 sadb_flush(sadb_t *sp, netstack_t *ns) 1071 { 1072 /* 1073 * Flush out each bucket, one at a time. Were it not for keysock's 1074 * enforcement, there would be a subtlety where I could add on the 1075 * heels of a flush. With keysock's enforcement, however, this 1076 * makes ESP's job easy. 1077 */ 1078 sadb_destroyer(&sp->sdb_of, sp->sdb_hashsize, B_FALSE, B_FALSE); 1079 sadb_destroyer(&sp->sdb_if, sp->sdb_hashsize, B_FALSE, B_TRUE); 1080 1081 /* For each acquire, destroy it; leave the bucket mutex alone. */ 1082 sadb_destroy_acqlist(&sp->sdb_acq, sp->sdb_hashsize, B_FALSE, ns); 1083 } 1084 1085 static void 1086 sadb_destroy(sadb_t *sp, netstack_t *ns) 1087 { 1088 sadb_destroyer(&sp->sdb_of, sp->sdb_hashsize, B_TRUE, B_FALSE); 1089 sadb_destroyer(&sp->sdb_if, sp->sdb_hashsize, B_TRUE, B_TRUE); 1090 1091 /* For each acquire, destroy it, including the bucket mutex. */ 1092 sadb_destroy_acqlist(&sp->sdb_acq, sp->sdb_hashsize, B_TRUE, ns); 1093 1094 ASSERT(sp->sdb_of == NULL); 1095 ASSERT(sp->sdb_if == NULL); 1096 ASSERT(sp->sdb_acq == NULL); 1097 } 1098 1099 static void 1100 sadb_send_flush_req(sadbp_t *spp) 1101 { 1102 mblk_t *ctl_mp; 1103 1104 /* 1105 * we've been unplumbed, or never were plumbed; don't go there. 1106 */ 1107 if (spp->s_ip_q == NULL) 1108 return; 1109 1110 /* have IP send a flush msg to the IPsec accelerators */ 1111 ctl_mp = sadb_fmt_sa_req(DL_CO_FLUSH, spp->s_satype, NULL, B_TRUE); 1112 if (ctl_mp != NULL) 1113 putnext(spp->s_ip_q, ctl_mp); 1114 } 1115 1116 void 1117 sadbp_flush(sadbp_t *spp, netstack_t *ns) 1118 { 1119 sadb_flush(&spp->s_v4, ns); 1120 sadb_flush(&spp->s_v6, ns); 1121 1122 sadb_send_flush_req(spp); 1123 } 1124 1125 void 1126 sadbp_destroy(sadbp_t *spp, netstack_t *ns) 1127 { 1128 sadb_destroy(&spp->s_v4, ns); 1129 sadb_destroy(&spp->s_v6, ns); 1130 1131 sadb_send_flush_req(spp); 1132 if (spp->s_satype == SADB_SATYPE_AH) { 1133 ipsec_stack_t *ipss = ns->netstack_ipsec; 1134 1135 ip_drop_unregister(&ipss->ipsec_sadb_dropper); 1136 } 1137 } 1138 1139 1140 /* 1141 * Check hard vs. soft lifetimes. If there's a reality mismatch (e.g. 1142 * soft lifetimes > hard lifetimes) return an appropriate diagnostic for 1143 * EINVAL. 1144 */ 1145 int 1146 sadb_hardsoftchk(sadb_lifetime_t *hard, sadb_lifetime_t *soft, 1147 sadb_lifetime_t *idle) 1148 { 1149 if (hard == NULL || soft == NULL) 1150 return (0); 1151 1152 if (hard->sadb_lifetime_allocations != 0 && 1153 soft->sadb_lifetime_allocations != 0 && 1154 hard->sadb_lifetime_allocations < soft->sadb_lifetime_allocations) 1155 return (SADB_X_DIAGNOSTIC_ALLOC_HSERR); 1156 1157 if (hard->sadb_lifetime_bytes != 0 && 1158 soft->sadb_lifetime_bytes != 0 && 1159 hard->sadb_lifetime_bytes < soft->sadb_lifetime_bytes) 1160 return (SADB_X_DIAGNOSTIC_BYTES_HSERR); 1161 1162 if (hard->sadb_lifetime_addtime != 0 && 1163 soft->sadb_lifetime_addtime != 0 && 1164 hard->sadb_lifetime_addtime < soft->sadb_lifetime_addtime) 1165 return (SADB_X_DIAGNOSTIC_ADDTIME_HSERR); 1166 1167 if (hard->sadb_lifetime_usetime != 0 && 1168 soft->sadb_lifetime_usetime != 0 && 1169 hard->sadb_lifetime_usetime < soft->sadb_lifetime_usetime) 1170 return (SADB_X_DIAGNOSTIC_USETIME_HSERR); 1171 1172 if (idle != NULL) { 1173 if (hard->sadb_lifetime_addtime != 0 && 1174 idle->sadb_lifetime_addtime != 0 && 1175 hard->sadb_lifetime_addtime < idle->sadb_lifetime_addtime) 1176 return (SADB_X_DIAGNOSTIC_ADDTIME_HSERR); 1177 1178 if (soft->sadb_lifetime_addtime != 0 && 1179 idle->sadb_lifetime_addtime != 0 && 1180 soft->sadb_lifetime_addtime < idle->sadb_lifetime_addtime) 1181 return (SADB_X_DIAGNOSTIC_ADDTIME_HSERR); 1182 1183 if (hard->sadb_lifetime_usetime != 0 && 1184 idle->sadb_lifetime_usetime != 0 && 1185 hard->sadb_lifetime_usetime < idle->sadb_lifetime_usetime) 1186 return (SADB_X_DIAGNOSTIC_USETIME_HSERR); 1187 1188 if (soft->sadb_lifetime_usetime != 0 && 1189 idle->sadb_lifetime_usetime != 0 && 1190 soft->sadb_lifetime_usetime < idle->sadb_lifetime_usetime) 1191 return (SADB_X_DIAGNOSTIC_USETIME_HSERR); 1192 } 1193 1194 return (0); 1195 } 1196 1197 /* 1198 * Clone a security association for the purposes of inserting a single SA 1199 * into inbound and outbound tables respectively. This function should only 1200 * be called from sadb_common_add(). 1201 */ 1202 static ipsa_t * 1203 sadb_cloneassoc(ipsa_t *ipsa) 1204 { 1205 ipsa_t *newbie; 1206 boolean_t error = B_FALSE; 1207 1208 ASSERT(MUTEX_NOT_HELD(&(ipsa->ipsa_lock))); 1209 1210 newbie = kmem_alloc(sizeof (ipsa_t), KM_NOSLEEP); 1211 if (newbie == NULL) 1212 return (NULL); 1213 1214 /* Copy over what we can. */ 1215 *newbie = *ipsa; 1216 1217 /* bzero and initialize locks, in case *_init() allocates... */ 1218 mutex_init(&newbie->ipsa_lock, NULL, MUTEX_DEFAULT, NULL); 1219 1220 /* 1221 * While somewhat dain-bramaged, the most graceful way to 1222 * recover from errors is to keep plowing through the 1223 * allocations, and getting what I can. It's easier to call 1224 * sadb_freeassoc() on the stillborn clone when all the 1225 * pointers aren't pointing to the parent's data. 1226 */ 1227 1228 if (ipsa->ipsa_authkey != NULL) { 1229 newbie->ipsa_authkey = kmem_alloc(newbie->ipsa_authkeylen, 1230 KM_NOSLEEP); 1231 if (newbie->ipsa_authkey == NULL) { 1232 error = B_TRUE; 1233 } else { 1234 bcopy(ipsa->ipsa_authkey, newbie->ipsa_authkey, 1235 newbie->ipsa_authkeylen); 1236 1237 newbie->ipsa_kcfauthkey.ck_data = 1238 newbie->ipsa_authkey; 1239 } 1240 1241 if (newbie->ipsa_amech.cm_param != NULL) { 1242 newbie->ipsa_amech.cm_param = 1243 (char *)&newbie->ipsa_mac_len; 1244 } 1245 } 1246 1247 if (ipsa->ipsa_encrkey != NULL) { 1248 newbie->ipsa_encrkey = kmem_alloc(newbie->ipsa_encrkeylen, 1249 KM_NOSLEEP); 1250 if (newbie->ipsa_encrkey == NULL) { 1251 error = B_TRUE; 1252 } else { 1253 bcopy(ipsa->ipsa_encrkey, newbie->ipsa_encrkey, 1254 newbie->ipsa_encrkeylen); 1255 1256 newbie->ipsa_kcfencrkey.ck_data = 1257 newbie->ipsa_encrkey; 1258 } 1259 } 1260 1261 newbie->ipsa_authtmpl = NULL; 1262 newbie->ipsa_encrtmpl = NULL; 1263 newbie->ipsa_haspeer = B_TRUE; 1264 1265 if (ipsa->ipsa_integ != NULL) { 1266 newbie->ipsa_integ = kmem_alloc(newbie->ipsa_integlen, 1267 KM_NOSLEEP); 1268 if (newbie->ipsa_integ == NULL) { 1269 error = B_TRUE; 1270 } else { 1271 bcopy(ipsa->ipsa_integ, newbie->ipsa_integ, 1272 newbie->ipsa_integlen); 1273 } 1274 } 1275 1276 if (ipsa->ipsa_sens != NULL) { 1277 newbie->ipsa_sens = kmem_alloc(newbie->ipsa_senslen, 1278 KM_NOSLEEP); 1279 if (newbie->ipsa_sens == NULL) { 1280 error = B_TRUE; 1281 } else { 1282 bcopy(ipsa->ipsa_sens, newbie->ipsa_sens, 1283 newbie->ipsa_senslen); 1284 } 1285 } 1286 1287 if (ipsa->ipsa_src_cid != NULL) { 1288 newbie->ipsa_src_cid = ipsa->ipsa_src_cid; 1289 IPSID_REFHOLD(ipsa->ipsa_src_cid); 1290 } 1291 1292 if (ipsa->ipsa_dst_cid != NULL) { 1293 newbie->ipsa_dst_cid = ipsa->ipsa_dst_cid; 1294 IPSID_REFHOLD(ipsa->ipsa_dst_cid); 1295 } 1296 1297 if (error) { 1298 sadb_freeassoc(newbie); 1299 return (NULL); 1300 } 1301 1302 return (newbie); 1303 } 1304 1305 /* 1306 * Initialize a SADB address extension at the address specified by addrext. 1307 * Return a pointer to the end of the new address extension. 1308 */ 1309 static uint8_t * 1310 sadb_make_addr_ext(uint8_t *start, uint8_t *end, uint16_t exttype, 1311 sa_family_t af, uint32_t *addr, uint16_t port, uint8_t proto, int prefix) 1312 { 1313 struct sockaddr_in *sin; 1314 struct sockaddr_in6 *sin6; 1315 uint8_t *cur = start; 1316 int addrext_len; 1317 int sin_len; 1318 sadb_address_t *addrext = (sadb_address_t *)cur; 1319 1320 if (cur == NULL) 1321 return (NULL); 1322 1323 cur += sizeof (*addrext); 1324 if (cur > end) 1325 return (NULL); 1326 1327 addrext->sadb_address_proto = proto; 1328 addrext->sadb_address_prefixlen = prefix; 1329 addrext->sadb_address_reserved = 0; 1330 addrext->sadb_address_exttype = exttype; 1331 1332 switch (af) { 1333 case AF_INET: 1334 sin = (struct sockaddr_in *)cur; 1335 sin_len = sizeof (*sin); 1336 cur += sin_len; 1337 if (cur > end) 1338 return (NULL); 1339 1340 sin->sin_family = af; 1341 bzero(sin->sin_zero, sizeof (sin->sin_zero)); 1342 sin->sin_port = port; 1343 IPSA_COPY_ADDR(&sin->sin_addr, addr, af); 1344 break; 1345 case AF_INET6: 1346 sin6 = (struct sockaddr_in6 *)cur; 1347 sin_len = sizeof (*sin6); 1348 cur += sin_len; 1349 if (cur > end) 1350 return (NULL); 1351 1352 bzero(sin6, sizeof (*sin6)); 1353 sin6->sin6_family = af; 1354 sin6->sin6_port = port; 1355 IPSA_COPY_ADDR(&sin6->sin6_addr, addr, af); 1356 break; 1357 } 1358 1359 addrext_len = roundup(cur - start, sizeof (uint64_t)); 1360 addrext->sadb_address_len = SADB_8TO64(addrext_len); 1361 1362 cur = start + addrext_len; 1363 if (cur > end) 1364 cur = NULL; 1365 1366 return (cur); 1367 } 1368 1369 /* 1370 * Construct a key management cookie extension. 1371 */ 1372 1373 static uint8_t * 1374 sadb_make_kmc_ext(uint8_t *cur, uint8_t *end, uint32_t kmp, uint32_t kmc) 1375 { 1376 sadb_x_kmc_t *kmcext = (sadb_x_kmc_t *)cur; 1377 1378 if (cur == NULL) 1379 return (NULL); 1380 1381 cur += sizeof (*kmcext); 1382 1383 if (cur > end) 1384 return (NULL); 1385 1386 kmcext->sadb_x_kmc_len = SADB_8TO64(sizeof (*kmcext)); 1387 kmcext->sadb_x_kmc_exttype = SADB_X_EXT_KM_COOKIE; 1388 kmcext->sadb_x_kmc_proto = kmp; 1389 kmcext->sadb_x_kmc_cookie = kmc; 1390 kmcext->sadb_x_kmc_reserved = 0; 1391 1392 return (cur); 1393 } 1394 1395 /* 1396 * Given an original message header with sufficient space following it, and an 1397 * SA, construct a full PF_KEY message with all of the relevant extensions. 1398 * This is mostly used for SADB_GET, and SADB_DUMP. 1399 */ 1400 static mblk_t * 1401 sadb_sa2msg(ipsa_t *ipsa, sadb_msg_t *samsg) 1402 { 1403 int alloclen, addrsize, paddrsize, authsize, encrsize; 1404 int srcidsize, dstidsize; 1405 sa_family_t fam, pfam; /* Address family for SADB_EXT_ADDRESS */ 1406 /* src/dst and proxy sockaddrs. */ 1407 /* 1408 * The following are pointers into the PF_KEY message this PF_KEY 1409 * message creates. 1410 */ 1411 sadb_msg_t *newsamsg; 1412 sadb_sa_t *assoc; 1413 sadb_lifetime_t *lt; 1414 sadb_key_t *key; 1415 sadb_ident_t *ident; 1416 sadb_sens_t *sens; 1417 sadb_ext_t *walker; /* For when we need a generic ext. pointer. */ 1418 sadb_x_replay_ctr_t *repl_ctr; 1419 sadb_x_pair_t *pair_ext; 1420 1421 mblk_t *mp; 1422 uint64_t *bitmap; 1423 uint8_t *cur, *end; 1424 /* These indicate the presence of the above extension fields. */ 1425 boolean_t soft, hard, isrc, idst, auth, encr, sensinteg, srcid, dstid; 1426 boolean_t idle; 1427 boolean_t paired; 1428 uint32_t otherspi; 1429 1430 /* First off, figure out the allocation length for this message. */ 1431 1432 /* 1433 * Constant stuff. This includes base, SA, address (src, dst), 1434 * and lifetime (current). 1435 */ 1436 alloclen = sizeof (sadb_msg_t) + sizeof (sadb_sa_t) + 1437 sizeof (sadb_lifetime_t); 1438 1439 fam = ipsa->ipsa_addrfam; 1440 switch (fam) { 1441 case AF_INET: 1442 addrsize = roundup(sizeof (struct sockaddr_in) + 1443 sizeof (sadb_address_t), sizeof (uint64_t)); 1444 break; 1445 case AF_INET6: 1446 addrsize = roundup(sizeof (struct sockaddr_in6) + 1447 sizeof (sadb_address_t), sizeof (uint64_t)); 1448 break; 1449 default: 1450 return (NULL); 1451 } 1452 /* 1453 * Allocate TWO address extensions, for source and destination. 1454 * (Thus, the * 2.) 1455 */ 1456 alloclen += addrsize * 2; 1457 if (ipsa->ipsa_flags & IPSA_F_NATT_REM) 1458 alloclen += addrsize; 1459 if (ipsa->ipsa_flags & IPSA_F_NATT_LOC) 1460 alloclen += addrsize; 1461 1462 if (ipsa->ipsa_flags & IPSA_F_PAIRED) { 1463 paired = B_TRUE; 1464 alloclen += sizeof (sadb_x_pair_t); 1465 otherspi = ipsa->ipsa_otherspi; 1466 } else { 1467 paired = B_FALSE; 1468 } 1469 1470 /* How 'bout other lifetimes? */ 1471 if (ipsa->ipsa_softaddlt != 0 || ipsa->ipsa_softuselt != 0 || 1472 ipsa->ipsa_softbyteslt != 0 || ipsa->ipsa_softalloc != 0) { 1473 alloclen += sizeof (sadb_lifetime_t); 1474 soft = B_TRUE; 1475 } else { 1476 soft = B_FALSE; 1477 } 1478 1479 if (ipsa->ipsa_hardaddlt != 0 || ipsa->ipsa_harduselt != 0 || 1480 ipsa->ipsa_hardbyteslt != 0 || ipsa->ipsa_hardalloc != 0) { 1481 alloclen += sizeof (sadb_lifetime_t); 1482 hard = B_TRUE; 1483 } else { 1484 hard = B_FALSE; 1485 } 1486 1487 if (ipsa->ipsa_idleaddlt != 0 || ipsa->ipsa_idleuselt != 0) { 1488 alloclen += sizeof (sadb_lifetime_t); 1489 idle = B_TRUE; 1490 } else { 1491 idle = B_FALSE; 1492 } 1493 1494 /* Inner addresses. */ 1495 if (ipsa->ipsa_innerfam == 0) { 1496 isrc = B_FALSE; 1497 idst = B_FALSE; 1498 } else { 1499 pfam = ipsa->ipsa_innerfam; 1500 switch (pfam) { 1501 case AF_INET6: 1502 paddrsize = roundup(sizeof (struct sockaddr_in6) + 1503 sizeof (sadb_address_t), sizeof (uint64_t)); 1504 break; 1505 case AF_INET: 1506 paddrsize = roundup(sizeof (struct sockaddr_in) + 1507 sizeof (sadb_address_t), sizeof (uint64_t)); 1508 break; 1509 default: 1510 cmn_err(CE_PANIC, 1511 "IPsec SADB: Proxy length failure.\n"); 1512 break; 1513 } 1514 isrc = B_TRUE; 1515 idst = B_TRUE; 1516 alloclen += 2 * paddrsize; 1517 } 1518 1519 /* For the following fields, assume that length != 0 ==> stuff */ 1520 if (ipsa->ipsa_authkeylen != 0) { 1521 authsize = roundup(sizeof (sadb_key_t) + ipsa->ipsa_authkeylen, 1522 sizeof (uint64_t)); 1523 alloclen += authsize; 1524 auth = B_TRUE; 1525 } else { 1526 auth = B_FALSE; 1527 } 1528 1529 if (ipsa->ipsa_encrkeylen != 0) { 1530 encrsize = roundup(sizeof (sadb_key_t) + ipsa->ipsa_encrkeylen, 1531 sizeof (uint64_t)); 1532 alloclen += encrsize; 1533 encr = B_TRUE; 1534 } else { 1535 encr = B_FALSE; 1536 } 1537 1538 /* No need for roundup on sens and integ. */ 1539 if (ipsa->ipsa_integlen != 0 || ipsa->ipsa_senslen != 0) { 1540 alloclen += sizeof (sadb_key_t) + ipsa->ipsa_integlen + 1541 ipsa->ipsa_senslen; 1542 sensinteg = B_TRUE; 1543 } else { 1544 sensinteg = B_FALSE; 1545 } 1546 1547 /* 1548 * Must use strlen() here for lengths. Identities use NULL 1549 * pointers to indicate their nonexistence. 1550 */ 1551 if (ipsa->ipsa_src_cid != NULL) { 1552 srcidsize = roundup(sizeof (sadb_ident_t) + 1553 strlen(ipsa->ipsa_src_cid->ipsid_cid) + 1, 1554 sizeof (uint64_t)); 1555 alloclen += srcidsize; 1556 srcid = B_TRUE; 1557 } else { 1558 srcid = B_FALSE; 1559 } 1560 1561 if (ipsa->ipsa_dst_cid != NULL) { 1562 dstidsize = roundup(sizeof (sadb_ident_t) + 1563 strlen(ipsa->ipsa_dst_cid->ipsid_cid) + 1, 1564 sizeof (uint64_t)); 1565 alloclen += dstidsize; 1566 dstid = B_TRUE; 1567 } else { 1568 dstid = B_FALSE; 1569 } 1570 1571 if ((ipsa->ipsa_kmp != 0) || (ipsa->ipsa_kmc != 0)) 1572 alloclen += sizeof (sadb_x_kmc_t); 1573 1574 if (ipsa->ipsa_replay != 0) { 1575 alloclen += sizeof (sadb_x_replay_ctr_t); 1576 } 1577 1578 /* Make sure the allocation length is a multiple of 8 bytes. */ 1579 ASSERT((alloclen & 0x7) == 0); 1580 1581 /* XXX Possibly make it esballoc, with a bzero-ing free_ftn. */ 1582 mp = allocb(alloclen, BPRI_HI); 1583 if (mp == NULL) 1584 return (NULL); 1585 1586 mp->b_wptr += alloclen; 1587 end = mp->b_wptr; 1588 newsamsg = (sadb_msg_t *)mp->b_rptr; 1589 *newsamsg = *samsg; 1590 newsamsg->sadb_msg_len = (uint16_t)SADB_8TO64(alloclen); 1591 1592 mutex_enter(&ipsa->ipsa_lock); /* Since I'm grabbing SA fields... */ 1593 1594 newsamsg->sadb_msg_satype = ipsa->ipsa_type; 1595 1596 assoc = (sadb_sa_t *)(newsamsg + 1); 1597 assoc->sadb_sa_len = SADB_8TO64(sizeof (*assoc)); 1598 assoc->sadb_sa_exttype = SADB_EXT_SA; 1599 assoc->sadb_sa_spi = ipsa->ipsa_spi; 1600 assoc->sadb_sa_replay = ipsa->ipsa_replay_wsize; 1601 assoc->sadb_sa_state = ipsa->ipsa_state; 1602 assoc->sadb_sa_auth = ipsa->ipsa_auth_alg; 1603 assoc->sadb_sa_encrypt = ipsa->ipsa_encr_alg; 1604 assoc->sadb_sa_flags = ipsa->ipsa_flags; 1605 1606 lt = (sadb_lifetime_t *)(assoc + 1); 1607 lt->sadb_lifetime_len = SADB_8TO64(sizeof (*lt)); 1608 lt->sadb_lifetime_exttype = SADB_EXT_LIFETIME_CURRENT; 1609 /* We do not support the concept. */ 1610 lt->sadb_lifetime_allocations = 0; 1611 lt->sadb_lifetime_bytes = ipsa->ipsa_bytes; 1612 lt->sadb_lifetime_addtime = ipsa->ipsa_addtime; 1613 lt->sadb_lifetime_usetime = ipsa->ipsa_usetime; 1614 1615 if (hard) { 1616 lt++; 1617 lt->sadb_lifetime_len = SADB_8TO64(sizeof (*lt)); 1618 lt->sadb_lifetime_exttype = SADB_EXT_LIFETIME_HARD; 1619 lt->sadb_lifetime_allocations = ipsa->ipsa_hardalloc; 1620 lt->sadb_lifetime_bytes = ipsa->ipsa_hardbyteslt; 1621 lt->sadb_lifetime_addtime = ipsa->ipsa_hardaddlt; 1622 lt->sadb_lifetime_usetime = ipsa->ipsa_harduselt; 1623 } 1624 1625 if (soft) { 1626 lt++; 1627 lt->sadb_lifetime_len = SADB_8TO64(sizeof (*lt)); 1628 lt->sadb_lifetime_exttype = SADB_EXT_LIFETIME_SOFT; 1629 lt->sadb_lifetime_allocations = ipsa->ipsa_softalloc; 1630 lt->sadb_lifetime_bytes = ipsa->ipsa_softbyteslt; 1631 lt->sadb_lifetime_addtime = ipsa->ipsa_softaddlt; 1632 lt->sadb_lifetime_usetime = ipsa->ipsa_softuselt; 1633 } 1634 1635 if (idle) { 1636 lt++; 1637 lt->sadb_lifetime_len = SADB_8TO64(sizeof (*lt)); 1638 lt->sadb_lifetime_exttype = SADB_X_EXT_LIFETIME_IDLE; 1639 lt->sadb_lifetime_addtime = ipsa->ipsa_idleaddlt; 1640 lt->sadb_lifetime_usetime = ipsa->ipsa_idleuselt; 1641 } 1642 1643 cur = (uint8_t *)(lt + 1); 1644 1645 /* NOTE: Don't fill in ports here if we are a tunnel-mode SA. */ 1646 cur = sadb_make_addr_ext(cur, end, SADB_EXT_ADDRESS_SRC, fam, 1647 ipsa->ipsa_srcaddr, (!isrc && !idst) ? SA_SRCPORT(ipsa) : 0, 1648 SA_PROTO(ipsa), 0); 1649 if (cur == NULL) { 1650 freemsg(mp); 1651 mp = NULL; 1652 goto bail; 1653 } 1654 1655 cur = sadb_make_addr_ext(cur, end, SADB_EXT_ADDRESS_DST, fam, 1656 ipsa->ipsa_dstaddr, (!isrc && !idst) ? SA_DSTPORT(ipsa) : 0, 1657 SA_PROTO(ipsa), 0); 1658 if (cur == NULL) { 1659 freemsg(mp); 1660 mp = NULL; 1661 goto bail; 1662 } 1663 1664 if (ipsa->ipsa_flags & IPSA_F_NATT_LOC) { 1665 cur = sadb_make_addr_ext(cur, end, SADB_X_EXT_ADDRESS_NATT_LOC, 1666 fam, &ipsa->ipsa_natt_addr_loc, ipsa->ipsa_local_nat_port, 1667 IPPROTO_UDP, 0); 1668 if (cur == NULL) { 1669 freemsg(mp); 1670 mp = NULL; 1671 goto bail; 1672 } 1673 } 1674 1675 if (ipsa->ipsa_flags & IPSA_F_NATT_REM) { 1676 cur = sadb_make_addr_ext(cur, end, SADB_X_EXT_ADDRESS_NATT_REM, 1677 fam, &ipsa->ipsa_natt_addr_rem, ipsa->ipsa_remote_nat_port, 1678 IPPROTO_UDP, 0); 1679 if (cur == NULL) { 1680 freemsg(mp); 1681 mp = NULL; 1682 goto bail; 1683 } 1684 } 1685 1686 /* If we are a tunnel-mode SA, fill in the inner-selectors. */ 1687 if (isrc) { 1688 cur = sadb_make_addr_ext(cur, end, SADB_X_EXT_ADDRESS_INNER_SRC, 1689 pfam, ipsa->ipsa_innersrc, SA_SRCPORT(ipsa), 1690 SA_IPROTO(ipsa), ipsa->ipsa_innersrcpfx); 1691 if (cur == NULL) { 1692 freemsg(mp); 1693 mp = NULL; 1694 goto bail; 1695 } 1696 } 1697 1698 if (idst) { 1699 cur = sadb_make_addr_ext(cur, end, SADB_X_EXT_ADDRESS_INNER_DST, 1700 pfam, ipsa->ipsa_innerdst, SA_DSTPORT(ipsa), 1701 SA_IPROTO(ipsa), ipsa->ipsa_innerdstpfx); 1702 if (cur == NULL) { 1703 freemsg(mp); 1704 mp = NULL; 1705 goto bail; 1706 } 1707 } 1708 1709 if ((ipsa->ipsa_kmp != 0) || (ipsa->ipsa_kmc != 0)) { 1710 cur = sadb_make_kmc_ext(cur, end, 1711 ipsa->ipsa_kmp, ipsa->ipsa_kmc); 1712 if (cur == NULL) { 1713 freemsg(mp); 1714 mp = NULL; 1715 goto bail; 1716 } 1717 } 1718 1719 walker = (sadb_ext_t *)cur; 1720 if (auth) { 1721 key = (sadb_key_t *)walker; 1722 key->sadb_key_len = SADB_8TO64(authsize); 1723 key->sadb_key_exttype = SADB_EXT_KEY_AUTH; 1724 key->sadb_key_bits = ipsa->ipsa_authkeybits; 1725 key->sadb_key_reserved = 0; 1726 bcopy(ipsa->ipsa_authkey, key + 1, ipsa->ipsa_authkeylen); 1727 walker = (sadb_ext_t *)((uint64_t *)walker + 1728 walker->sadb_ext_len); 1729 } 1730 1731 if (encr) { 1732 key = (sadb_key_t *)walker; 1733 key->sadb_key_len = SADB_8TO64(encrsize); 1734 key->sadb_key_exttype = SADB_EXT_KEY_ENCRYPT; 1735 key->sadb_key_bits = ipsa->ipsa_encrkeybits; 1736 key->sadb_key_reserved = 0; 1737 bcopy(ipsa->ipsa_encrkey, key + 1, ipsa->ipsa_encrkeylen); 1738 walker = (sadb_ext_t *)((uint64_t *)walker + 1739 walker->sadb_ext_len); 1740 } 1741 1742 if (srcid) { 1743 ident = (sadb_ident_t *)walker; 1744 ident->sadb_ident_len = SADB_8TO64(srcidsize); 1745 ident->sadb_ident_exttype = SADB_EXT_IDENTITY_SRC; 1746 ident->sadb_ident_type = ipsa->ipsa_src_cid->ipsid_type; 1747 ident->sadb_ident_id = 0; 1748 ident->sadb_ident_reserved = 0; 1749 (void) strcpy((char *)(ident + 1), 1750 ipsa->ipsa_src_cid->ipsid_cid); 1751 walker = (sadb_ext_t *)((uint64_t *)walker + 1752 walker->sadb_ext_len); 1753 } 1754 1755 if (dstid) { 1756 ident = (sadb_ident_t *)walker; 1757 ident->sadb_ident_len = SADB_8TO64(dstidsize); 1758 ident->sadb_ident_exttype = SADB_EXT_IDENTITY_DST; 1759 ident->sadb_ident_type = ipsa->ipsa_dst_cid->ipsid_type; 1760 ident->sadb_ident_id = 0; 1761 ident->sadb_ident_reserved = 0; 1762 (void) strcpy((char *)(ident + 1), 1763 ipsa->ipsa_dst_cid->ipsid_cid); 1764 walker = (sadb_ext_t *)((uint64_t *)walker + 1765 walker->sadb_ext_len); 1766 } 1767 1768 if (sensinteg) { 1769 sens = (sadb_sens_t *)walker; 1770 sens->sadb_sens_len = SADB_8TO64(sizeof (sadb_sens_t *) + 1771 ipsa->ipsa_senslen + ipsa->ipsa_integlen); 1772 sens->sadb_sens_dpd = ipsa->ipsa_dpd; 1773 sens->sadb_sens_sens_level = ipsa->ipsa_senslevel; 1774 sens->sadb_sens_integ_level = ipsa->ipsa_integlevel; 1775 sens->sadb_sens_sens_len = SADB_8TO64(ipsa->ipsa_senslen); 1776 sens->sadb_sens_integ_len = SADB_8TO64(ipsa->ipsa_integlen); 1777 sens->sadb_sens_reserved = 0; 1778 bitmap = (uint64_t *)(sens + 1); 1779 if (ipsa->ipsa_sens != NULL) { 1780 bcopy(ipsa->ipsa_sens, bitmap, ipsa->ipsa_senslen); 1781 bitmap += sens->sadb_sens_sens_len; 1782 } 1783 if (ipsa->ipsa_integ != NULL) 1784 bcopy(ipsa->ipsa_integ, bitmap, ipsa->ipsa_integlen); 1785 walker = (sadb_ext_t *)((uint64_t *)walker + 1786 walker->sadb_ext_len); 1787 } 1788 1789 if (paired) { 1790 pair_ext = (sadb_x_pair_t *)walker; 1791 1792 pair_ext->sadb_x_pair_len = SADB_8TO64(sizeof (sadb_x_pair_t)); 1793 pair_ext->sadb_x_pair_exttype = SADB_X_EXT_PAIR; 1794 pair_ext->sadb_x_pair_spi = otherspi; 1795 1796 walker = (sadb_ext_t *)((uint64_t *)walker + 1797 walker->sadb_ext_len); 1798 } 1799 1800 if (ipsa->ipsa_replay != 0) { 1801 repl_ctr = (sadb_x_replay_ctr_t *)walker; 1802 repl_ctr->sadb_x_rc_len = SADB_8TO64(sizeof (*repl_ctr)); 1803 repl_ctr->sadb_x_rc_exttype = SADB_X_EXT_REPLAY_VALUE; 1804 repl_ctr->sadb_x_rc_replay32 = ipsa->ipsa_replay; 1805 repl_ctr->sadb_x_rc_replay64 = 0; 1806 walker = (sadb_ext_t *)(repl_ctr + 1); 1807 } 1808 1809 bail: 1810 /* Pardon any delays... */ 1811 mutex_exit(&ipsa->ipsa_lock); 1812 1813 return (mp); 1814 } 1815 1816 /* 1817 * Strip out key headers or unmarked headers (SADB_EXT_KEY_*, SADB_EXT_UNKNOWN) 1818 * and adjust base message accordingly. 1819 * 1820 * Assume message is pulled up in one piece of contiguous memory. 1821 * 1822 * Say if we start off with: 1823 * 1824 * +------+----+-------------+-----------+---------------+---------------+ 1825 * | base | SA | source addr | dest addr | rsrvd. or key | soft lifetime | 1826 * +------+----+-------------+-----------+---------------+---------------+ 1827 * 1828 * we will end up with 1829 * 1830 * +------+----+-------------+-----------+---------------+ 1831 * | base | SA | source addr | dest addr | soft lifetime | 1832 * +------+----+-------------+-----------+---------------+ 1833 */ 1834 static void 1835 sadb_strip(sadb_msg_t *samsg) 1836 { 1837 sadb_ext_t *ext; 1838 uint8_t *target = NULL; 1839 uint8_t *msgend; 1840 int sofar = SADB_8TO64(sizeof (*samsg)); 1841 int copylen; 1842 1843 ext = (sadb_ext_t *)(samsg + 1); 1844 msgend = (uint8_t *)samsg; 1845 msgend += SADB_64TO8(samsg->sadb_msg_len); 1846 while ((uint8_t *)ext < msgend) { 1847 if (ext->sadb_ext_type == SADB_EXT_RESERVED || 1848 ext->sadb_ext_type == SADB_EXT_KEY_AUTH || 1849 ext->sadb_ext_type == SADB_X_EXT_EDUMP || 1850 ext->sadb_ext_type == SADB_EXT_KEY_ENCRYPT) { 1851 /* 1852 * Aha! I found a header to be erased. 1853 */ 1854 1855 if (target != NULL) { 1856 /* 1857 * If I had a previous header to be erased, 1858 * copy over it. I can get away with just 1859 * copying backwards because the target will 1860 * always be 8 bytes behind the source. 1861 */ 1862 copylen = ((uint8_t *)ext) - (target + 1863 SADB_64TO8( 1864 ((sadb_ext_t *)target)->sadb_ext_len)); 1865 ovbcopy(((uint8_t *)ext - copylen), target, 1866 copylen); 1867 target += copylen; 1868 ((sadb_ext_t *)target)->sadb_ext_len = 1869 SADB_8TO64(((uint8_t *)ext) - target + 1870 SADB_64TO8(ext->sadb_ext_len)); 1871 } else { 1872 target = (uint8_t *)ext; 1873 } 1874 } else { 1875 sofar += ext->sadb_ext_len; 1876 } 1877 1878 ext = (sadb_ext_t *)(((uint64_t *)ext) + ext->sadb_ext_len); 1879 } 1880 1881 ASSERT((uint8_t *)ext == msgend); 1882 1883 if (target != NULL) { 1884 copylen = ((uint8_t *)ext) - (target + 1885 SADB_64TO8(((sadb_ext_t *)target)->sadb_ext_len)); 1886 if (copylen != 0) 1887 ovbcopy(((uint8_t *)ext - copylen), target, copylen); 1888 } 1889 1890 /* Adjust samsg. */ 1891 samsg->sadb_msg_len = (uint16_t)sofar; 1892 1893 /* Assume all of the rest is cleared by caller in sadb_pfkey_echo(). */ 1894 } 1895 1896 /* 1897 * AH needs to send an error to PF_KEY. Assume mp points to an M_CTL 1898 * followed by an M_DATA with a PF_KEY message in it. The serial of 1899 * the sending keysock instance is included. 1900 */ 1901 void 1902 sadb_pfkey_error(queue_t *pfkey_q, mblk_t *mp, int error, int diagnostic, 1903 uint_t serial) 1904 { 1905 mblk_t *msg = mp->b_cont; 1906 sadb_msg_t *samsg; 1907 keysock_out_t *kso; 1908 1909 /* 1910 * Enough functions call this to merit a NULL queue check. 1911 */ 1912 if (pfkey_q == NULL) { 1913 freemsg(mp); 1914 return; 1915 } 1916 1917 ASSERT(msg != NULL); 1918 ASSERT((mp->b_wptr - mp->b_rptr) == sizeof (ipsec_info_t)); 1919 ASSERT((msg->b_wptr - msg->b_rptr) >= sizeof (sadb_msg_t)); 1920 samsg = (sadb_msg_t *)msg->b_rptr; 1921 kso = (keysock_out_t *)mp->b_rptr; 1922 1923 kso->ks_out_type = KEYSOCK_OUT; 1924 kso->ks_out_len = sizeof (*kso); 1925 kso->ks_out_serial = serial; 1926 1927 /* 1928 * Only send the base message up in the event of an error. 1929 * Don't worry about bzero()-ing, because it was probably bogus 1930 * anyway. 1931 */ 1932 msg->b_wptr = msg->b_rptr + sizeof (*samsg); 1933 samsg = (sadb_msg_t *)msg->b_rptr; 1934 samsg->sadb_msg_len = SADB_8TO64(sizeof (*samsg)); 1935 samsg->sadb_msg_errno = (uint8_t)error; 1936 if (diagnostic != SADB_X_DIAGNOSTIC_PRESET) 1937 samsg->sadb_x_msg_diagnostic = (uint16_t)diagnostic; 1938 1939 putnext(pfkey_q, mp); 1940 } 1941 1942 /* 1943 * Send a successful return packet back to keysock via the queue in pfkey_q. 1944 * 1945 * Often, an SA is associated with the reply message, it's passed in if needed, 1946 * and NULL if not. BTW, that ipsa will have its refcnt appropriately held, 1947 * and the caller will release said refcnt. 1948 */ 1949 void 1950 sadb_pfkey_echo(queue_t *pfkey_q, mblk_t *mp, sadb_msg_t *samsg, 1951 keysock_in_t *ksi, ipsa_t *ipsa) 1952 { 1953 keysock_out_t *kso; 1954 mblk_t *mp1; 1955 sadb_msg_t *newsamsg; 1956 uint8_t *oldend; 1957 1958 ASSERT((mp->b_cont != NULL) && 1959 ((void *)samsg == (void *)mp->b_cont->b_rptr) && 1960 ((void *)mp->b_rptr == (void *)ksi)); 1961 1962 switch (samsg->sadb_msg_type) { 1963 case SADB_ADD: 1964 case SADB_UPDATE: 1965 case SADB_X_UPDATEPAIR: 1966 case SADB_X_DELPAIR_STATE: 1967 case SADB_FLUSH: 1968 case SADB_DUMP: 1969 /* 1970 * I have all of the message already. I just need to strip 1971 * out the keying material and echo the message back. 1972 * 1973 * NOTE: for SADB_DUMP, the function sadb_dump() did the 1974 * work. When DUMP reaches here, it should only be a base 1975 * message. 1976 */ 1977 justecho: 1978 if (ksi->ks_in_extv[SADB_EXT_KEY_AUTH] != NULL || 1979 ksi->ks_in_extv[SADB_EXT_KEY_ENCRYPT] != NULL || 1980 ksi->ks_in_extv[SADB_X_EXT_EDUMP] != NULL) { 1981 sadb_strip(samsg); 1982 /* Assume PF_KEY message is contiguous. */ 1983 ASSERT(mp->b_cont->b_cont == NULL); 1984 oldend = mp->b_cont->b_wptr; 1985 mp->b_cont->b_wptr = mp->b_cont->b_rptr + 1986 SADB_64TO8(samsg->sadb_msg_len); 1987 bzero(mp->b_cont->b_wptr, oldend - mp->b_cont->b_wptr); 1988 } 1989 break; 1990 case SADB_GET: 1991 /* 1992 * Do a lot of work here, because of the ipsa I just found. 1993 * First construct the new PF_KEY message, then abandon 1994 * the old one. 1995 */ 1996 mp1 = sadb_sa2msg(ipsa, samsg); 1997 if (mp1 == NULL) { 1998 sadb_pfkey_error(pfkey_q, mp, ENOMEM, 1999 SADB_X_DIAGNOSTIC_NONE, ksi->ks_in_serial); 2000 return; 2001 } 2002 freemsg(mp->b_cont); 2003 mp->b_cont = mp1; 2004 break; 2005 case SADB_DELETE: 2006 case SADB_X_DELPAIR: 2007 if (ipsa == NULL) 2008 goto justecho; 2009 /* 2010 * Because listening KMds may require more info, treat 2011 * DELETE like a special case of GET. 2012 */ 2013 mp1 = sadb_sa2msg(ipsa, samsg); 2014 if (mp1 == NULL) { 2015 sadb_pfkey_error(pfkey_q, mp, ENOMEM, 2016 SADB_X_DIAGNOSTIC_NONE, ksi->ks_in_serial); 2017 return; 2018 } 2019 newsamsg = (sadb_msg_t *)mp1->b_rptr; 2020 sadb_strip(newsamsg); 2021 oldend = mp1->b_wptr; 2022 mp1->b_wptr = mp1->b_rptr + SADB_64TO8(newsamsg->sadb_msg_len); 2023 bzero(mp1->b_wptr, oldend - mp1->b_wptr); 2024 freemsg(mp->b_cont); 2025 mp->b_cont = mp1; 2026 break; 2027 default: 2028 if (mp != NULL) 2029 freemsg(mp); 2030 return; 2031 } 2032 2033 /* ksi is now null and void. */ 2034 kso = (keysock_out_t *)ksi; 2035 kso->ks_out_type = KEYSOCK_OUT; 2036 kso->ks_out_len = sizeof (*kso); 2037 kso->ks_out_serial = ksi->ks_in_serial; 2038 /* We're ready to send... */ 2039 putnext(pfkey_q, mp); 2040 } 2041 2042 /* 2043 * Set up a global pfkey_q instance for AH, ESP, or some other consumer. 2044 */ 2045 void 2046 sadb_keysock_hello(queue_t **pfkey_qp, queue_t *q, mblk_t *mp, 2047 void (*ager)(void *), void *agerarg, timeout_id_t *top, int satype) 2048 { 2049 keysock_hello_ack_t *kha; 2050 queue_t *oldq; 2051 2052 ASSERT(OTHERQ(q) != NULL); 2053 2054 /* 2055 * First, check atomically that I'm the first and only keysock 2056 * instance. 2057 * 2058 * Use OTHERQ(q), because qreply(q, mp) == putnext(OTHERQ(q), mp), 2059 * and I want this module to say putnext(*_pfkey_q, mp) for PF_KEY 2060 * messages. 2061 */ 2062 2063 oldq = casptr((void **)pfkey_qp, NULL, OTHERQ(q)); 2064 if (oldq != NULL) { 2065 ASSERT(oldq != q); 2066 cmn_err(CE_WARN, "Danger! Multiple keysocks on top of %s.\n", 2067 (satype == SADB_SATYPE_ESP)? "ESP" : "AH or other"); 2068 freemsg(mp); 2069 return; 2070 } 2071 2072 kha = (keysock_hello_ack_t *)mp->b_rptr; 2073 kha->ks_hello_len = sizeof (keysock_hello_ack_t); 2074 kha->ks_hello_type = KEYSOCK_HELLO_ACK; 2075 kha->ks_hello_satype = (uint8_t)satype; 2076 2077 /* 2078 * If we made it past the casptr, then we have "exclusive" access 2079 * to the timeout handle. Fire it off in 4 seconds, because it 2080 * just seems like a good interval. 2081 */ 2082 *top = qtimeout(*pfkey_qp, ager, agerarg, drv_usectohz(4000000)); 2083 2084 putnext(*pfkey_qp, mp); 2085 } 2086 2087 /* 2088 * Normalize IPv4-mapped IPv6 addresses (and prefixes) as appropriate. 2089 * 2090 * Check addresses themselves for wildcard or multicast. 2091 * Check ire table for local/non-local/broadcast. 2092 */ 2093 int 2094 sadb_addrcheck(queue_t *pfkey_q, mblk_t *mp, sadb_ext_t *ext, uint_t serial, 2095 netstack_t *ns) 2096 { 2097 sadb_address_t *addr = (sadb_address_t *)ext; 2098 struct sockaddr_in *sin; 2099 struct sockaddr_in6 *sin6; 2100 ire_t *ire; 2101 int diagnostic, type; 2102 boolean_t normalized = B_FALSE; 2103 2104 ASSERT(ext != NULL); 2105 ASSERT((ext->sadb_ext_type == SADB_EXT_ADDRESS_SRC) || 2106 (ext->sadb_ext_type == SADB_EXT_ADDRESS_DST) || 2107 (ext->sadb_ext_type == SADB_X_EXT_ADDRESS_INNER_SRC) || 2108 (ext->sadb_ext_type == SADB_X_EXT_ADDRESS_INNER_DST) || 2109 (ext->sadb_ext_type == SADB_X_EXT_ADDRESS_NATT_LOC) || 2110 (ext->sadb_ext_type == SADB_X_EXT_ADDRESS_NATT_REM)); 2111 2112 /* Assign both sockaddrs, the compiler will do the right thing. */ 2113 sin = (struct sockaddr_in *)(addr + 1); 2114 sin6 = (struct sockaddr_in6 *)(addr + 1); 2115 2116 if (sin6->sin6_family == AF_INET6) { 2117 if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) { 2118 /* 2119 * Convert to an AF_INET sockaddr. This means the 2120 * return messages will have the extra space, but have 2121 * AF_INET sockaddrs instead of AF_INET6. 2122 * 2123 * Yes, RFC 2367 isn't clear on what to do here w.r.t. 2124 * mapped addresses, but since AF_INET6 ::ffff:<v4> is 2125 * equal to AF_INET <v4>, it shouldnt be a huge 2126 * problem. 2127 */ 2128 sin->sin_family = AF_INET; 2129 IN6_V4MAPPED_TO_INADDR(&sin6->sin6_addr, 2130 &sin->sin_addr); 2131 bzero(&sin->sin_zero, sizeof (sin->sin_zero)); 2132 normalized = B_TRUE; 2133 } 2134 } else if (sin->sin_family != AF_INET) { 2135 switch (ext->sadb_ext_type) { 2136 case SADB_EXT_ADDRESS_SRC: 2137 diagnostic = SADB_X_DIAGNOSTIC_BAD_SRC_AF; 2138 break; 2139 case SADB_EXT_ADDRESS_DST: 2140 diagnostic = SADB_X_DIAGNOSTIC_BAD_DST_AF; 2141 break; 2142 case SADB_X_EXT_ADDRESS_INNER_SRC: 2143 diagnostic = SADB_X_DIAGNOSTIC_BAD_PROXY_AF; 2144 break; 2145 case SADB_X_EXT_ADDRESS_INNER_DST: 2146 diagnostic = SADB_X_DIAGNOSTIC_BAD_INNER_DST_AF; 2147 break; 2148 case SADB_X_EXT_ADDRESS_NATT_LOC: 2149 diagnostic = SADB_X_DIAGNOSTIC_BAD_NATT_LOC_AF; 2150 break; 2151 case SADB_X_EXT_ADDRESS_NATT_REM: 2152 diagnostic = SADB_X_DIAGNOSTIC_BAD_NATT_REM_AF; 2153 break; 2154 /* There is no default, see above ASSERT. */ 2155 } 2156 bail: 2157 if (pfkey_q != NULL) { 2158 sadb_pfkey_error(pfkey_q, mp, EINVAL, diagnostic, 2159 serial); 2160 } else { 2161 /* 2162 * Scribble in sadb_msg that we got passed in. 2163 * Overload "mp" to be an sadb_msg pointer. 2164 */ 2165 sadb_msg_t *samsg = (sadb_msg_t *)mp; 2166 2167 samsg->sadb_msg_errno = EINVAL; 2168 samsg->sadb_x_msg_diagnostic = diagnostic; 2169 } 2170 return (KS_IN_ADDR_UNKNOWN); 2171 } 2172 2173 if (ext->sadb_ext_type == SADB_X_EXT_ADDRESS_INNER_SRC || 2174 ext->sadb_ext_type == SADB_X_EXT_ADDRESS_INNER_DST) { 2175 /* 2176 * We need only check for prefix issues. 2177 */ 2178 2179 /* Set diagnostic now, in case we need it later. */ 2180 diagnostic = 2181 (ext->sadb_ext_type == SADB_X_EXT_ADDRESS_INNER_SRC) ? 2182 SADB_X_DIAGNOSTIC_PREFIX_INNER_SRC : 2183 SADB_X_DIAGNOSTIC_PREFIX_INNER_DST; 2184 2185 if (normalized) 2186 addr->sadb_address_prefixlen -= 96; 2187 2188 /* 2189 * Verify and mask out inner-addresses based on prefix length. 2190 */ 2191 if (sin->sin_family == AF_INET) { 2192 if (addr->sadb_address_prefixlen > 32) 2193 goto bail; 2194 sin->sin_addr.s_addr &= 2195 ip_plen_to_mask(addr->sadb_address_prefixlen); 2196 } else { 2197 in6_addr_t mask; 2198 2199 ASSERT(sin->sin_family == AF_INET6); 2200 /* 2201 * ip_plen_to_mask_v6() returns NULL if the value in 2202 * question is out of range. 2203 */ 2204 if (ip_plen_to_mask_v6(addr->sadb_address_prefixlen, 2205 &mask) == NULL) 2206 goto bail; 2207 sin6->sin6_addr.s6_addr32[0] &= mask.s6_addr32[0]; 2208 sin6->sin6_addr.s6_addr32[1] &= mask.s6_addr32[1]; 2209 sin6->sin6_addr.s6_addr32[2] &= mask.s6_addr32[2]; 2210 sin6->sin6_addr.s6_addr32[3] &= mask.s6_addr32[3]; 2211 } 2212 2213 /* We don't care in these cases. */ 2214 return (KS_IN_ADDR_DONTCARE); 2215 } 2216 2217 if (sin->sin_family == AF_INET6) { 2218 /* Check the easy ones now. */ 2219 if (IN6_IS_ADDR_MULTICAST(&sin6->sin6_addr)) 2220 return (KS_IN_ADDR_MBCAST); 2221 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) 2222 return (KS_IN_ADDR_UNSPEC); 2223 /* 2224 * At this point, we're a unicast IPv6 address. 2225 * 2226 * A ctable lookup for local is sufficient here. If we're 2227 * local, return KS_IN_ADDR_ME, otherwise KS_IN_ADDR_NOTME. 2228 * 2229 * XXX Zones alert -> me/notme decision needs to be tempered 2230 * by what zone we're in when we go to zone-aware IPsec. 2231 */ 2232 ire = ire_ctable_lookup_v6(&sin6->sin6_addr, NULL, 2233 IRE_LOCAL, NULL, ALL_ZONES, NULL, MATCH_IRE_TYPE, 2234 ns->netstack_ip); 2235 if (ire != NULL) { 2236 /* Hey hey, it's local. */ 2237 IRE_REFRELE(ire); 2238 return (KS_IN_ADDR_ME); 2239 } 2240 } else { 2241 ASSERT(sin->sin_family == AF_INET); 2242 if (sin->sin_addr.s_addr == INADDR_ANY) 2243 return (KS_IN_ADDR_UNSPEC); 2244 if (CLASSD(sin->sin_addr.s_addr)) 2245 return (KS_IN_ADDR_MBCAST); 2246 /* 2247 * At this point we're a unicast or broadcast IPv4 address. 2248 * 2249 * Lookup on the ctable for IRE_BROADCAST or IRE_LOCAL. 2250 * A NULL return value is NOTME, otherwise, look at the 2251 * returned ire for broadcast or not and return accordingly. 2252 * 2253 * XXX Zones alert -> me/notme decision needs to be tempered 2254 * by what zone we're in when we go to zone-aware IPsec. 2255 */ 2256 ire = ire_ctable_lookup(sin->sin_addr.s_addr, 0, 2257 IRE_LOCAL | IRE_BROADCAST, NULL, ALL_ZONES, NULL, 2258 MATCH_IRE_TYPE, ns->netstack_ip); 2259 if (ire != NULL) { 2260 /* Check for local or broadcast */ 2261 type = ire->ire_type; 2262 IRE_REFRELE(ire); 2263 ASSERT(type == IRE_LOCAL || type == IRE_BROADCAST); 2264 return ((type == IRE_LOCAL) ? KS_IN_ADDR_ME : 2265 KS_IN_ADDR_MBCAST); 2266 } 2267 } 2268 2269 return (KS_IN_ADDR_NOTME); 2270 } 2271 2272 /* 2273 * Address normalizations and reality checks for inbound PF_KEY messages. 2274 * 2275 * For the case of src == unspecified AF_INET6, and dst == AF_INET, convert 2276 * the source to AF_INET. Do the same for the inner sources. 2277 */ 2278 boolean_t 2279 sadb_addrfix(keysock_in_t *ksi, queue_t *pfkey_q, mblk_t *mp, netstack_t *ns) 2280 { 2281 struct sockaddr_in *src, *isrc; 2282 struct sockaddr_in6 *dst, *idst; 2283 sadb_address_t *srcext, *dstext; 2284 uint16_t sport; 2285 sadb_ext_t **extv = ksi->ks_in_extv; 2286 int rc; 2287 2288 if (extv[SADB_EXT_ADDRESS_SRC] != NULL) { 2289 rc = sadb_addrcheck(pfkey_q, mp, extv[SADB_EXT_ADDRESS_SRC], 2290 ksi->ks_in_serial, ns); 2291 if (rc == KS_IN_ADDR_UNKNOWN) 2292 return (B_FALSE); 2293 if (rc == KS_IN_ADDR_MBCAST) { 2294 sadb_pfkey_error(pfkey_q, mp, EINVAL, 2295 SADB_X_DIAGNOSTIC_BAD_SRC, ksi->ks_in_serial); 2296 return (B_FALSE); 2297 } 2298 ksi->ks_in_srctype = rc; 2299 } 2300 2301 if (extv[SADB_EXT_ADDRESS_DST] != NULL) { 2302 rc = sadb_addrcheck(pfkey_q, mp, extv[SADB_EXT_ADDRESS_DST], 2303 ksi->ks_in_serial, ns); 2304 if (rc == KS_IN_ADDR_UNKNOWN) 2305 return (B_FALSE); 2306 if (rc == KS_IN_ADDR_UNSPEC) { 2307 sadb_pfkey_error(pfkey_q, mp, EINVAL, 2308 SADB_X_DIAGNOSTIC_BAD_DST, ksi->ks_in_serial); 2309 return (B_FALSE); 2310 } 2311 ksi->ks_in_dsttype = rc; 2312 } 2313 2314 /* 2315 * NAT-Traversal addrs are simple enough to not require all of 2316 * the checks in sadb_addrcheck(). Just normalize or reject if not 2317 * AF_INET. 2318 */ 2319 if (extv[SADB_X_EXT_ADDRESS_NATT_LOC] != NULL) { 2320 rc = sadb_addrcheck(pfkey_q, mp, 2321 extv[SADB_X_EXT_ADDRESS_NATT_LOC], ksi->ks_in_serial, ns); 2322 2323 /* 2324 * Local NAT-T addresses never use an IRE_LOCAL, so it should 2325 * always be NOTME, or UNSPEC (to handle both tunnel mode 2326 * AND local-port flexibility). 2327 */ 2328 if (rc != KS_IN_ADDR_NOTME && rc != KS_IN_ADDR_UNSPEC) { 2329 sadb_pfkey_error(pfkey_q, mp, EINVAL, 2330 SADB_X_DIAGNOSTIC_MALFORMED_NATT_LOC, 2331 ksi->ks_in_serial); 2332 return (B_FALSE); 2333 } 2334 src = (struct sockaddr_in *) 2335 (((sadb_address_t *)extv[SADB_X_EXT_ADDRESS_NATT_LOC]) + 1); 2336 if (src->sin_family != AF_INET) { 2337 sadb_pfkey_error(pfkey_q, mp, EINVAL, 2338 SADB_X_DIAGNOSTIC_BAD_NATT_LOC_AF, 2339 ksi->ks_in_serial); 2340 return (B_FALSE); 2341 } 2342 } 2343 2344 if (extv[SADB_X_EXT_ADDRESS_NATT_REM] != NULL) { 2345 rc = sadb_addrcheck(pfkey_q, mp, 2346 extv[SADB_X_EXT_ADDRESS_NATT_REM], ksi->ks_in_serial, ns); 2347 2348 /* 2349 * Remote NAT-T addresses never use an IRE_LOCAL, so it should 2350 * always be NOTME, or UNSPEC if it's a tunnel-mode SA. 2351 */ 2352 if (rc != KS_IN_ADDR_NOTME && 2353 !(extv[SADB_X_EXT_ADDRESS_INNER_SRC] != NULL && 2354 rc == KS_IN_ADDR_UNSPEC)) { 2355 sadb_pfkey_error(pfkey_q, mp, EINVAL, 2356 SADB_X_DIAGNOSTIC_MALFORMED_NATT_REM, 2357 ksi->ks_in_serial); 2358 return (B_FALSE); 2359 } 2360 src = (struct sockaddr_in *) 2361 (((sadb_address_t *)extv[SADB_X_EXT_ADDRESS_NATT_REM]) + 1); 2362 if (src->sin_family != AF_INET) { 2363 sadb_pfkey_error(pfkey_q, mp, EINVAL, 2364 SADB_X_DIAGNOSTIC_BAD_NATT_REM_AF, 2365 ksi->ks_in_serial); 2366 return (B_FALSE); 2367 } 2368 } 2369 2370 if (extv[SADB_X_EXT_ADDRESS_INNER_SRC] != NULL) { 2371 if (extv[SADB_X_EXT_ADDRESS_INNER_DST] == NULL) { 2372 sadb_pfkey_error(pfkey_q, mp, EINVAL, 2373 SADB_X_DIAGNOSTIC_MISSING_INNER_DST, 2374 ksi->ks_in_serial); 2375 return (B_FALSE); 2376 } 2377 2378 if (sadb_addrcheck(pfkey_q, mp, 2379 extv[SADB_X_EXT_ADDRESS_INNER_DST], ksi->ks_in_serial, ns) 2380 == KS_IN_ADDR_UNKNOWN || 2381 sadb_addrcheck(pfkey_q, mp, 2382 extv[SADB_X_EXT_ADDRESS_INNER_SRC], ksi->ks_in_serial, ns) 2383 == KS_IN_ADDR_UNKNOWN) 2384 return (B_FALSE); 2385 2386 isrc = (struct sockaddr_in *) 2387 (((sadb_address_t *)extv[SADB_X_EXT_ADDRESS_INNER_SRC]) + 2388 1); 2389 idst = (struct sockaddr_in6 *) 2390 (((sadb_address_t *)extv[SADB_X_EXT_ADDRESS_INNER_DST]) + 2391 1); 2392 if (isrc->sin_family != idst->sin6_family) { 2393 sadb_pfkey_error(pfkey_q, mp, EINVAL, 2394 SADB_X_DIAGNOSTIC_INNER_AF_MISMATCH, 2395 ksi->ks_in_serial); 2396 return (B_FALSE); 2397 } 2398 } else if (extv[SADB_X_EXT_ADDRESS_INNER_DST] != NULL) { 2399 sadb_pfkey_error(pfkey_q, mp, EINVAL, 2400 SADB_X_DIAGNOSTIC_MISSING_INNER_SRC, 2401 ksi->ks_in_serial); 2402 return (B_FALSE); 2403 } else { 2404 isrc = NULL; /* For inner/outer port check below. */ 2405 } 2406 2407 dstext = (sadb_address_t *)extv[SADB_EXT_ADDRESS_DST]; 2408 srcext = (sadb_address_t *)extv[SADB_EXT_ADDRESS_SRC]; 2409 2410 if (dstext == NULL || srcext == NULL) 2411 return (B_TRUE); 2412 2413 dst = (struct sockaddr_in6 *)(dstext + 1); 2414 src = (struct sockaddr_in *)(srcext + 1); 2415 2416 if (isrc != NULL && 2417 (isrc->sin_port != 0 || idst->sin6_port != 0) && 2418 (src->sin_port != 0 || dst->sin6_port != 0)) { 2419 /* Can't set inner and outer ports in one SA. */ 2420 sadb_pfkey_error(pfkey_q, mp, EINVAL, 2421 SADB_X_DIAGNOSTIC_DUAL_PORT_SETS, 2422 ksi->ks_in_serial); 2423 return (B_FALSE); 2424 } 2425 2426 if (dst->sin6_family == src->sin_family) 2427 return (B_TRUE); 2428 2429 if (srcext->sadb_address_proto != dstext->sadb_address_proto) { 2430 if (srcext->sadb_address_proto == 0) { 2431 srcext->sadb_address_proto = dstext->sadb_address_proto; 2432 } else if (dstext->sadb_address_proto == 0) { 2433 dstext->sadb_address_proto = srcext->sadb_address_proto; 2434 } else { 2435 /* Inequal protocols, neither were 0. Report error. */ 2436 sadb_pfkey_error(pfkey_q, mp, EINVAL, 2437 SADB_X_DIAGNOSTIC_PROTO_MISMATCH, 2438 ksi->ks_in_serial); 2439 return (B_FALSE); 2440 } 2441 } 2442 2443 /* 2444 * With the exception of an unspec IPv6 source and an IPv4 2445 * destination, address families MUST me matched. 2446 */ 2447 if (src->sin_family == AF_INET || 2448 ksi->ks_in_srctype != KS_IN_ADDR_UNSPEC) { 2449 sadb_pfkey_error(pfkey_q, mp, EINVAL, 2450 SADB_X_DIAGNOSTIC_AF_MISMATCH, ksi->ks_in_serial); 2451 return (B_FALSE); 2452 } 2453 2454 /* 2455 * Convert "src" to AF_INET INADDR_ANY. We rely on sin_port being 2456 * in the same place for sockaddr_in and sockaddr_in6. 2457 */ 2458 sport = src->sin_port; 2459 bzero(src, sizeof (*src)); 2460 src->sin_family = AF_INET; 2461 src->sin_port = sport; 2462 2463 return (B_TRUE); 2464 } 2465 2466 /* 2467 * Set the results in "addrtype", given an IRE as requested by 2468 * sadb_addrcheck(). 2469 */ 2470 int 2471 sadb_addrset(ire_t *ire) 2472 { 2473 if ((ire->ire_type & IRE_BROADCAST) || 2474 (ire->ire_ipversion == IPV4_VERSION && CLASSD(ire->ire_addr)) || 2475 (ire->ire_ipversion == IPV6_VERSION && 2476 IN6_IS_ADDR_MULTICAST(&(ire->ire_addr_v6)))) 2477 return (KS_IN_ADDR_MBCAST); 2478 if (ire->ire_type & (IRE_LOCAL | IRE_LOOPBACK)) 2479 return (KS_IN_ADDR_ME); 2480 return (KS_IN_ADDR_NOTME); 2481 } 2482 2483 2484 /* 2485 * Walker callback function to delete sa's based on src/dst address. 2486 * Assumes that we're called with *head locked, no other locks held; 2487 * Conveniently, and not coincidentally, this is both what sadb_walker 2488 * gives us and also what sadb_unlinkassoc expects. 2489 */ 2490 2491 struct sadb_purge_state 2492 { 2493 uint32_t *src; 2494 uint32_t *dst; 2495 sa_family_t af; 2496 boolean_t inbnd; 2497 char *sidstr; 2498 char *didstr; 2499 uint16_t sidtype; 2500 uint16_t didtype; 2501 uint32_t kmproto; 2502 uint8_t sadb_sa_state; 2503 mblk_t *mq; 2504 sadb_t *sp; 2505 }; 2506 2507 static void 2508 sadb_purge_cb(isaf_t *head, ipsa_t *entry, void *cookie) 2509 { 2510 struct sadb_purge_state *ps = (struct sadb_purge_state *)cookie; 2511 2512 ASSERT(MUTEX_HELD(&head->isaf_lock)); 2513 2514 mutex_enter(&entry->ipsa_lock); 2515 2516 if ((entry->ipsa_state == IPSA_STATE_LARVAL) || 2517 (ps->src != NULL && 2518 !IPSA_ARE_ADDR_EQUAL(entry->ipsa_srcaddr, ps->src, ps->af)) || 2519 (ps->dst != NULL && 2520 !IPSA_ARE_ADDR_EQUAL(entry->ipsa_dstaddr, ps->dst, ps->af)) || 2521 (ps->didstr != NULL && (entry->ipsa_dst_cid != NULL) && 2522 !(ps->didtype == entry->ipsa_dst_cid->ipsid_type && 2523 strcmp(ps->didstr, entry->ipsa_dst_cid->ipsid_cid) == 0)) || 2524 (ps->sidstr != NULL && (entry->ipsa_src_cid != NULL) && 2525 !(ps->sidtype == entry->ipsa_src_cid->ipsid_type && 2526 strcmp(ps->sidstr, entry->ipsa_src_cid->ipsid_cid) == 0)) || 2527 (ps->kmproto <= SADB_X_KMP_MAX && ps->kmproto != entry->ipsa_kmp)) { 2528 mutex_exit(&entry->ipsa_lock); 2529 return; 2530 } 2531 2532 if (ps->inbnd) { 2533 sadb_delete_cluster(entry); 2534 } 2535 entry->ipsa_state = IPSA_STATE_DEAD; 2536 (void) sadb_torch_assoc(head, entry, ps->inbnd, &ps->mq); 2537 } 2538 2539 /* 2540 * Common code to purge an SA with a matching src or dst address. 2541 * Don't kill larval SA's in such a purge. 2542 */ 2543 int 2544 sadb_purge_sa(mblk_t *mp, keysock_in_t *ksi, sadb_t *sp, queue_t *pfkey_q, 2545 queue_t *ip_q) 2546 { 2547 sadb_address_t *dstext = 2548 (sadb_address_t *)ksi->ks_in_extv[SADB_EXT_ADDRESS_DST]; 2549 sadb_address_t *srcext = 2550 (sadb_address_t *)ksi->ks_in_extv[SADB_EXT_ADDRESS_SRC]; 2551 sadb_ident_t *dstid = 2552 (sadb_ident_t *)ksi->ks_in_extv[SADB_EXT_IDENTITY_DST]; 2553 sadb_ident_t *srcid = 2554 (sadb_ident_t *)ksi->ks_in_extv[SADB_EXT_IDENTITY_SRC]; 2555 sadb_x_kmc_t *kmc = 2556 (sadb_x_kmc_t *)ksi->ks_in_extv[SADB_X_EXT_KM_COOKIE]; 2557 struct sockaddr_in *src, *dst; 2558 struct sockaddr_in6 *src6, *dst6; 2559 struct sadb_purge_state ps; 2560 2561 /* 2562 * Don't worry about IPv6 v4-mapped addresses, sadb_addrcheck() 2563 * takes care of them. 2564 */ 2565 2566 /* enforced by caller */ 2567 ASSERT((dstext != NULL) || (srcext != NULL)); 2568 2569 ps.src = NULL; 2570 ps.dst = NULL; 2571 #ifdef DEBUG 2572 ps.af = (sa_family_t)-1; 2573 #endif 2574 ps.mq = NULL; 2575 ps.sidstr = NULL; 2576 ps.didstr = NULL; 2577 ps.kmproto = SADB_X_KMP_MAX + 1; 2578 2579 if (dstext != NULL) { 2580 dst = (struct sockaddr_in *)(dstext + 1); 2581 ps.af = dst->sin_family; 2582 if (dst->sin_family == AF_INET6) { 2583 dst6 = (struct sockaddr_in6 *)dst; 2584 ps.dst = (uint32_t *)&dst6->sin6_addr; 2585 } else { 2586 ps.dst = (uint32_t *)&dst->sin_addr; 2587 } 2588 } 2589 2590 if (srcext != NULL) { 2591 src = (struct sockaddr_in *)(srcext + 1); 2592 ps.af = src->sin_family; 2593 if (src->sin_family == AF_INET6) { 2594 src6 = (struct sockaddr_in6 *)(srcext + 1); 2595 ps.src = (uint32_t *)&src6->sin6_addr; 2596 } else { 2597 ps.src = (uint32_t *)&src->sin_addr; 2598 } 2599 ASSERT(dstext == NULL || src->sin_family == dst->sin_family); 2600 } 2601 2602 ASSERT(ps.af != (sa_family_t)-1); 2603 2604 if (dstid != NULL) { 2605 /* 2606 * NOTE: May need to copy string in the future 2607 * if the inbound keysock message disappears for some strange 2608 * reason. 2609 */ 2610 ps.didstr = (char *)(dstid + 1); 2611 ps.didtype = dstid->sadb_ident_type; 2612 } 2613 2614 if (srcid != NULL) { 2615 /* 2616 * NOTE: May need to copy string in the future 2617 * if the inbound keysock message disappears for some strange 2618 * reason. 2619 */ 2620 ps.sidstr = (char *)(srcid + 1); 2621 ps.sidtype = srcid->sadb_ident_type; 2622 } 2623 2624 if (kmc != NULL) 2625 ps.kmproto = kmc->sadb_x_kmc_proto; 2626 2627 /* 2628 * This is simple, crude, and effective. 2629 * Unimplemented optimizations (TBD): 2630 * - we can limit how many places we search based on where we 2631 * think the SA is filed. 2632 * - if we get a dst address, we can hash based on dst addr to find 2633 * the correct bucket in the outbound table. 2634 */ 2635 ps.inbnd = B_TRUE; 2636 sadb_walker(sp->sdb_if, sp->sdb_hashsize, sadb_purge_cb, &ps); 2637 ps.inbnd = B_FALSE; 2638 sadb_walker(sp->sdb_of, sp->sdb_hashsize, sadb_purge_cb, &ps); 2639 2640 if (ps.mq != NULL) 2641 sadb_drain_torchq(ip_q, ps.mq); 2642 2643 ASSERT(mp->b_cont != NULL); 2644 sadb_pfkey_echo(pfkey_q, mp, (sadb_msg_t *)mp->b_cont->b_rptr, ksi, 2645 NULL); 2646 return (0); 2647 } 2648 2649 static void 2650 sadb_delpair_state(isaf_t *head, ipsa_t *entry, void *cookie) 2651 { 2652 struct sadb_purge_state *ps = (struct sadb_purge_state *)cookie; 2653 isaf_t *inbound_bucket; 2654 ipsa_t *peer_assoc; 2655 2656 ASSERT(MUTEX_HELD(&head->isaf_lock)); 2657 2658 mutex_enter(&entry->ipsa_lock); 2659 2660 if ((entry->ipsa_state != ps->sadb_sa_state) || 2661 ((ps->src != NULL) && 2662 !IPSA_ARE_ADDR_EQUAL(entry->ipsa_srcaddr, ps->src, ps->af))) { 2663 mutex_exit(&entry->ipsa_lock); 2664 return; 2665 } 2666 2667 /* 2668 * The isaf_t *, which is passed in , is always an outbound bucket, 2669 * and we are preserving the outbound-then-inbound hash-bucket lock 2670 * ordering. The sadb_walker() which triggers this function is called 2671 * only on the outbound fanout, and the corresponding inbound bucket 2672 * lock is safe to acquire here. 2673 */ 2674 2675 if (entry->ipsa_haspeer) { 2676 inbound_bucket = INBOUND_BUCKET(ps->sp, entry->ipsa_spi); 2677 mutex_enter(&inbound_bucket->isaf_lock); 2678 peer_assoc = ipsec_getassocbyspi(inbound_bucket, 2679 entry->ipsa_spi, entry->ipsa_srcaddr, 2680 entry->ipsa_dstaddr, entry->ipsa_addrfam); 2681 } else { 2682 inbound_bucket = INBOUND_BUCKET(ps->sp, entry->ipsa_otherspi); 2683 mutex_enter(&inbound_bucket->isaf_lock); 2684 peer_assoc = ipsec_getassocbyspi(inbound_bucket, 2685 entry->ipsa_otherspi, entry->ipsa_dstaddr, 2686 entry->ipsa_srcaddr, entry->ipsa_addrfam); 2687 } 2688 2689 entry->ipsa_state = IPSA_STATE_DEAD; 2690 (void) sadb_torch_assoc(head, entry, B_FALSE, &ps->mq); 2691 if (peer_assoc != NULL) { 2692 mutex_enter(&peer_assoc->ipsa_lock); 2693 peer_assoc->ipsa_state = IPSA_STATE_DEAD; 2694 (void) sadb_torch_assoc(inbound_bucket, peer_assoc, 2695 B_FALSE, &ps->mq); 2696 } 2697 mutex_exit(&inbound_bucket->isaf_lock); 2698 } 2699 2700 /* 2701 * Common code to delete/get an SA. 2702 */ 2703 int 2704 sadb_delget_sa(mblk_t *mp, keysock_in_t *ksi, sadbp_t *spp, 2705 int *diagnostic, queue_t *pfkey_q, uint8_t sadb_msg_type) 2706 { 2707 sadb_sa_t *assoc = (sadb_sa_t *)ksi->ks_in_extv[SADB_EXT_SA]; 2708 sadb_address_t *srcext = 2709 (sadb_address_t *)ksi->ks_in_extv[SADB_EXT_ADDRESS_SRC]; 2710 sadb_address_t *dstext = 2711 (sadb_address_t *)ksi->ks_in_extv[SADB_EXT_ADDRESS_DST]; 2712 ipsa_t *echo_target = NULL; 2713 ipsap_t *ipsapp; 2714 mblk_t *torchq = NULL; 2715 uint_t error = 0; 2716 2717 if (assoc == NULL) { 2718 *diagnostic = SADB_X_DIAGNOSTIC_MISSING_SA; 2719 return (EINVAL); 2720 } 2721 2722 if (sadb_msg_type == SADB_X_DELPAIR_STATE) { 2723 struct sockaddr_in *src; 2724 struct sockaddr_in6 *src6; 2725 struct sadb_purge_state ps; 2726 2727 if (srcext == NULL) { 2728 *diagnostic = SADB_X_DIAGNOSTIC_MISSING_SRC; 2729 return (EINVAL); 2730 } 2731 ps.src = NULL; 2732 ps.mq = NULL; 2733 src = (struct sockaddr_in *)(srcext + 1); 2734 ps.af = src->sin_family; 2735 if (src->sin_family == AF_INET6) { 2736 src6 = (struct sockaddr_in6 *)(srcext + 1); 2737 ps.src = (uint32_t *)&src6->sin6_addr; 2738 ps.sp = &spp->s_v6; 2739 } else { 2740 ps.src = (uint32_t *)&src->sin_addr; 2741 ps.sp = &spp->s_v4; 2742 } 2743 ps.inbnd = B_FALSE; 2744 ps.sadb_sa_state = assoc->sadb_sa_state; 2745 sadb_walker(ps.sp->sdb_of, ps.sp->sdb_hashsize, 2746 sadb_delpair_state, &ps); 2747 2748 if (ps.mq != NULL) 2749 sadb_drain_torchq(pfkey_q, ps.mq); 2750 2751 ASSERT(mp->b_cont != NULL); 2752 sadb_pfkey_echo(pfkey_q, mp, (sadb_msg_t *)mp->b_cont->b_rptr, 2753 ksi, NULL); 2754 return (0); 2755 } 2756 2757 if (dstext == NULL) { 2758 *diagnostic = SADB_X_DIAGNOSTIC_MISSING_DST; 2759 return (EINVAL); 2760 } 2761 2762 ipsapp = get_ipsa_pair(assoc, srcext, dstext, spp); 2763 if (ipsapp == NULL) { 2764 *diagnostic = SADB_X_DIAGNOSTIC_SA_NOTFOUND; 2765 return (ESRCH); 2766 } 2767 2768 echo_target = ipsapp->ipsap_sa_ptr; 2769 if (echo_target == NULL) 2770 echo_target = ipsapp->ipsap_psa_ptr; 2771 2772 if (sadb_msg_type == SADB_DELETE || sadb_msg_type == SADB_X_DELPAIR) { 2773 /* 2774 * Bucket locks will be required if SA is actually unlinked. 2775 * get_ipsa_pair() returns valid hash bucket pointers even 2776 * if it can't find a pair SA pointer. 2777 */ 2778 mutex_enter(&ipsapp->ipsap_bucket->isaf_lock); 2779 mutex_enter(&ipsapp->ipsap_pbucket->isaf_lock); 2780 2781 if (ipsapp->ipsap_sa_ptr != NULL) { 2782 mutex_enter(&ipsapp->ipsap_sa_ptr->ipsa_lock); 2783 if (ipsapp->ipsap_sa_ptr->ipsa_flags & IPSA_F_INBOUND) { 2784 sadb_delete_cluster(ipsapp->ipsap_sa_ptr); 2785 } 2786 ipsapp->ipsap_sa_ptr->ipsa_state = IPSA_STATE_DEAD; 2787 (void) sadb_torch_assoc(ipsapp->ipsap_bucket, 2788 ipsapp->ipsap_sa_ptr, B_FALSE, &torchq); 2789 /* 2790 * sadb_torch_assoc() releases the ipsa_lock 2791 * and calls sadb_unlinkassoc() which does a 2792 * IPSA_REFRELE. 2793 */ 2794 } 2795 if (ipsapp->ipsap_psa_ptr != NULL) { 2796 mutex_enter(&ipsapp->ipsap_psa_ptr->ipsa_lock); 2797 if (sadb_msg_type == SADB_X_DELPAIR || 2798 ipsapp->ipsap_psa_ptr->ipsa_haspeer) { 2799 if (ipsapp->ipsap_psa_ptr->ipsa_flags & 2800 IPSA_F_INBOUND) { 2801 sadb_delete_cluster( 2802 ipsapp->ipsap_psa_ptr); 2803 } 2804 ipsapp->ipsap_psa_ptr->ipsa_state = 2805 IPSA_STATE_DEAD; 2806 (void) sadb_torch_assoc(ipsapp->ipsap_pbucket, 2807 ipsapp->ipsap_psa_ptr, B_FALSE, &torchq); 2808 } else { 2809 /* 2810 * Only half of the "pair" has been deleted. 2811 * Update the remaining SA and remove references 2812 * to its pair SA, which is now gone. 2813 */ 2814 ipsapp->ipsap_psa_ptr->ipsa_otherspi = 0; 2815 ipsapp->ipsap_psa_ptr->ipsa_flags &= 2816 ~IPSA_F_PAIRED; 2817 mutex_exit(&ipsapp->ipsap_psa_ptr->ipsa_lock); 2818 } 2819 } else if (sadb_msg_type == SADB_X_DELPAIR) { 2820 *diagnostic = SADB_X_DIAGNOSTIC_PAIR_SA_NOTFOUND; 2821 error = ESRCH; 2822 } 2823 mutex_exit(&ipsapp->ipsap_bucket->isaf_lock); 2824 mutex_exit(&ipsapp->ipsap_pbucket->isaf_lock); 2825 } 2826 2827 if (torchq != NULL) 2828 sadb_drain_torchq(spp->s_ip_q, torchq); 2829 2830 ASSERT(mp->b_cont != NULL); 2831 2832 if (error == 0) 2833 sadb_pfkey_echo(pfkey_q, mp, (sadb_msg_t *) 2834 mp->b_cont->b_rptr, ksi, echo_target); 2835 2836 destroy_ipsa_pair(ipsapp); 2837 2838 return (error); 2839 } 2840 2841 /* 2842 * This function takes a sadb_sa_t and finds the ipsa_t structure 2843 * and the isaf_t (hash bucket) that its stored under. If the security 2844 * association has a peer, the ipsa_t structure and bucket for that security 2845 * association are also searched for. The "pair" of ipsa_t's and isaf_t's 2846 * are returned as a ipsap_t. 2847 * 2848 * Note that a "pair" is defined as one (but not both) of the following: 2849 * 2850 * A security association which has a soft reference to another security 2851 * association via its SPI. 2852 * 2853 * A security association that is not obviously "inbound" or "outbound" so 2854 * it appears in both hash tables, the "peer" being the same security 2855 * association in the other hash table. 2856 * 2857 * This function will return NULL if the ipsa_t can't be found in the 2858 * inbound or outbound hash tables (not found). If only one ipsa_t is 2859 * found, the pair ipsa_t will be NULL. Both isaf_t values are valid 2860 * provided at least one ipsa_t is found. 2861 */ 2862 ipsap_t * 2863 get_ipsa_pair(sadb_sa_t *assoc, sadb_address_t *srcext, sadb_address_t *dstext, 2864 sadbp_t *spp) 2865 { 2866 struct sockaddr_in *src, *dst; 2867 struct sockaddr_in6 *src6, *dst6; 2868 sadb_t *sp; 2869 uint32_t *srcaddr, *dstaddr; 2870 isaf_t *outbound_bucket, *inbound_bucket; 2871 boolean_t in_inbound_table = B_FALSE; 2872 ipsap_t *ipsapp; 2873 sa_family_t af; 2874 2875 uint32_t pair_srcaddr[IPSA_MAX_ADDRLEN]; 2876 uint32_t pair_dstaddr[IPSA_MAX_ADDRLEN]; 2877 uint32_t pair_spi; 2878 2879 ipsapp = kmem_zalloc(sizeof (*ipsapp), KM_NOSLEEP); 2880 if (ipsapp == NULL) 2881 return (NULL); 2882 2883 /* 2884 * Don't worry about IPv6 v4-mapped addresses, sadb_addrcheck() 2885 * takes care of them. 2886 */ 2887 2888 dst = (struct sockaddr_in *)(dstext + 1); 2889 af = dst->sin_family; 2890 if (af == AF_INET6) { 2891 sp = &spp->s_v6; 2892 dst6 = (struct sockaddr_in6 *)dst; 2893 dstaddr = (uint32_t *)&dst6->sin6_addr; 2894 if (srcext != NULL) { 2895 src6 = (struct sockaddr_in6 *)(srcext + 1); 2896 srcaddr = (uint32_t *)&src6->sin6_addr; 2897 ASSERT(src6->sin6_family == af); 2898 ASSERT(src6->sin6_family == AF_INET6); 2899 } else { 2900 srcaddr = ALL_ZEROES_PTR; 2901 } 2902 outbound_bucket = OUTBOUND_BUCKET_V6(sp, 2903 *(uint32_t *)dstaddr); 2904 } else { 2905 sp = &spp->s_v4; 2906 dstaddr = (uint32_t *)&dst->sin_addr; 2907 if (srcext != NULL) { 2908 src = (struct sockaddr_in *)(srcext + 1); 2909 srcaddr = (uint32_t *)&src->sin_addr; 2910 ASSERT(src->sin_family == af); 2911 ASSERT(src->sin_family == AF_INET); 2912 } else { 2913 srcaddr = ALL_ZEROES_PTR; 2914 } 2915 outbound_bucket = OUTBOUND_BUCKET_V4(sp, 2916 *(uint32_t *)dstaddr); 2917 } 2918 2919 inbound_bucket = INBOUND_BUCKET(sp, assoc->sadb_sa_spi); 2920 2921 /* Lock down both buckets. */ 2922 mutex_enter(&outbound_bucket->isaf_lock); 2923 mutex_enter(&inbound_bucket->isaf_lock); 2924 2925 if (assoc->sadb_sa_flags & IPSA_F_INBOUND) { 2926 ipsapp->ipsap_sa_ptr = ipsec_getassocbyspi(inbound_bucket, 2927 assoc->sadb_sa_spi, srcaddr, dstaddr, af); 2928 if (ipsapp->ipsap_sa_ptr != NULL) { 2929 ipsapp->ipsap_bucket = inbound_bucket; 2930 ipsapp->ipsap_pbucket = outbound_bucket; 2931 in_inbound_table = B_TRUE; 2932 } else { 2933 ipsapp->ipsap_sa_ptr = 2934 ipsec_getassocbyspi(outbound_bucket, 2935 assoc->sadb_sa_spi, srcaddr, dstaddr, af); 2936 ipsapp->ipsap_bucket = outbound_bucket; 2937 ipsapp->ipsap_pbucket = inbound_bucket; 2938 } 2939 } else { 2940 /* IPSA_F_OUTBOUND is set *or* no directions flags set. */ 2941 ipsapp->ipsap_sa_ptr = 2942 ipsec_getassocbyspi(outbound_bucket, 2943 assoc->sadb_sa_spi, srcaddr, dstaddr, af); 2944 if (ipsapp->ipsap_sa_ptr != NULL) { 2945 ipsapp->ipsap_bucket = outbound_bucket; 2946 ipsapp->ipsap_pbucket = inbound_bucket; 2947 } else { 2948 ipsapp->ipsap_sa_ptr = 2949 ipsec_getassocbyspi(inbound_bucket, 2950 assoc->sadb_sa_spi, srcaddr, dstaddr, af); 2951 ipsapp->ipsap_bucket = inbound_bucket; 2952 ipsapp->ipsap_pbucket = outbound_bucket; 2953 if (ipsapp->ipsap_sa_ptr != NULL) 2954 in_inbound_table = B_TRUE; 2955 } 2956 } 2957 2958 if (ipsapp->ipsap_sa_ptr == NULL) { 2959 mutex_exit(&outbound_bucket->isaf_lock); 2960 mutex_exit(&inbound_bucket->isaf_lock); 2961 kmem_free(ipsapp, sizeof (*ipsapp)); 2962 return (NULL); 2963 } 2964 2965 if ((ipsapp->ipsap_sa_ptr->ipsa_state == IPSA_STATE_LARVAL) && 2966 in_inbound_table) { 2967 mutex_exit(&outbound_bucket->isaf_lock); 2968 mutex_exit(&inbound_bucket->isaf_lock); 2969 return (ipsapp); 2970 } 2971 2972 mutex_enter(&ipsapp->ipsap_sa_ptr->ipsa_lock); 2973 if (ipsapp->ipsap_sa_ptr->ipsa_haspeer) { 2974 /* 2975 * haspeer implies no sa_pairing, look for same spi 2976 * in other hashtable. 2977 */ 2978 ipsapp->ipsap_psa_ptr = 2979 ipsec_getassocbyspi(ipsapp->ipsap_pbucket, 2980 assoc->sadb_sa_spi, srcaddr, dstaddr, af); 2981 mutex_exit(&ipsapp->ipsap_sa_ptr->ipsa_lock); 2982 mutex_exit(&outbound_bucket->isaf_lock); 2983 mutex_exit(&inbound_bucket->isaf_lock); 2984 return (ipsapp); 2985 } 2986 pair_spi = ipsapp->ipsap_sa_ptr->ipsa_otherspi; 2987 IPSA_COPY_ADDR(&pair_srcaddr, 2988 ipsapp->ipsap_sa_ptr->ipsa_srcaddr, af); 2989 IPSA_COPY_ADDR(&pair_dstaddr, 2990 ipsapp->ipsap_sa_ptr->ipsa_dstaddr, af); 2991 mutex_exit(&ipsapp->ipsap_sa_ptr->ipsa_lock); 2992 mutex_exit(&outbound_bucket->isaf_lock); 2993 mutex_exit(&inbound_bucket->isaf_lock); 2994 2995 if (pair_spi == 0) { 2996 ASSERT(ipsapp->ipsap_bucket != NULL); 2997 ASSERT(ipsapp->ipsap_pbucket != NULL); 2998 return (ipsapp); 2999 } 3000 3001 /* found sa in outbound sadb, peer should be inbound */ 3002 3003 if (in_inbound_table) { 3004 /* Found SA in inbound table, pair will be in outbound. */ 3005 if (af == AF_INET6) { 3006 ipsapp->ipsap_pbucket = OUTBOUND_BUCKET_V6(sp, 3007 *(uint32_t *)pair_srcaddr); 3008 } else { 3009 ipsapp->ipsap_pbucket = OUTBOUND_BUCKET_V4(sp, 3010 *(uint32_t *)pair_srcaddr); 3011 } 3012 } else { 3013 ipsapp->ipsap_pbucket = INBOUND_BUCKET(sp, pair_spi); 3014 } 3015 mutex_enter(&ipsapp->ipsap_pbucket->isaf_lock); 3016 ipsapp->ipsap_psa_ptr = ipsec_getassocbyspi(ipsapp->ipsap_pbucket, 3017 pair_spi, pair_dstaddr, pair_srcaddr, af); 3018 mutex_exit(&ipsapp->ipsap_pbucket->isaf_lock); 3019 ASSERT(ipsapp->ipsap_bucket != NULL); 3020 ASSERT(ipsapp->ipsap_pbucket != NULL); 3021 return (ipsapp); 3022 } 3023 3024 /* 3025 * Initialize the mechanism parameters associated with an SA. 3026 * These parameters can be shared by multiple packets, which saves 3027 * us from the overhead of consulting the algorithm table for 3028 * each packet. 3029 */ 3030 static void 3031 sadb_init_alginfo(ipsa_t *sa) 3032 { 3033 ipsec_alginfo_t *alg; 3034 ipsec_stack_t *ipss = sa->ipsa_netstack->netstack_ipsec; 3035 3036 mutex_enter(&ipss->ipsec_alg_lock); 3037 3038 if (sa->ipsa_encrkey != NULL) { 3039 alg = ipss->ipsec_alglists[IPSEC_ALG_ENCR][sa->ipsa_encr_alg]; 3040 if (alg != NULL && ALG_VALID(alg)) { 3041 sa->ipsa_emech.cm_type = alg->alg_mech_type; 3042 sa->ipsa_emech.cm_param = NULL; 3043 sa->ipsa_emech.cm_param_len = 0; 3044 sa->ipsa_iv_len = alg->alg_datalen; 3045 } else 3046 sa->ipsa_emech.cm_type = CRYPTO_MECHANISM_INVALID; 3047 } 3048 3049 if (sa->ipsa_authkey != NULL) { 3050 alg = ipss->ipsec_alglists[IPSEC_ALG_AUTH][sa->ipsa_auth_alg]; 3051 if (alg != NULL && ALG_VALID(alg)) { 3052 sa->ipsa_amech.cm_type = alg->alg_mech_type; 3053 sa->ipsa_amech.cm_param = (char *)&sa->ipsa_mac_len; 3054 sa->ipsa_amech.cm_param_len = sizeof (size_t); 3055 sa->ipsa_mac_len = (size_t)alg->alg_datalen; 3056 } else 3057 sa->ipsa_amech.cm_type = CRYPTO_MECHANISM_INVALID; 3058 } 3059 3060 mutex_exit(&ipss->ipsec_alg_lock); 3061 } 3062 3063 /* 3064 * Perform NAT-traversal cached checksum offset calculations here. 3065 */ 3066 static void 3067 sadb_nat_calculations(ipsa_t *newbie, sadb_address_t *natt_loc_ext, 3068 sadb_address_t *natt_rem_ext, uint32_t *src_addr_ptr, 3069 uint32_t *dst_addr_ptr) 3070 { 3071 struct sockaddr_in *natt_loc, *natt_rem; 3072 uint32_t *natt_loc_ptr = NULL, *natt_rem_ptr = NULL; 3073 uint32_t running_sum = 0; 3074 3075 #define DOWN_SUM(x) (x) = ((x) & 0xFFFF) + ((x) >> 16) 3076 3077 if (natt_rem_ext != NULL) { 3078 uint32_t l_src; 3079 uint32_t l_rem; 3080 3081 natt_rem = (struct sockaddr_in *)(natt_rem_ext + 1); 3082 3083 /* Ensured by sadb_addrfix(). */ 3084 ASSERT(natt_rem->sin_family == AF_INET); 3085 3086 natt_rem_ptr = (uint32_t *)(&natt_rem->sin_addr); 3087 newbie->ipsa_remote_nat_port = natt_rem->sin_port; 3088 l_src = *src_addr_ptr; 3089 l_rem = *natt_rem_ptr; 3090 3091 /* Instead of IPSA_COPY_ADDR(), just copy first 32 bits. */ 3092 newbie->ipsa_natt_addr_rem = *natt_rem_ptr; 3093 3094 l_src = ntohl(l_src); 3095 DOWN_SUM(l_src); 3096 DOWN_SUM(l_src); 3097 l_rem = ntohl(l_rem); 3098 DOWN_SUM(l_rem); 3099 DOWN_SUM(l_rem); 3100 3101 /* 3102 * We're 1's complement for checksums, so check for wraparound 3103 * here. 3104 */ 3105 if (l_rem > l_src) 3106 l_src--; 3107 3108 running_sum += l_src - l_rem; 3109 3110 DOWN_SUM(running_sum); 3111 DOWN_SUM(running_sum); 3112 } 3113 3114 if (natt_loc_ext != NULL) { 3115 natt_loc = (struct sockaddr_in *)(natt_loc_ext + 1); 3116 3117 /* Ensured by sadb_addrfix(). */ 3118 ASSERT(natt_loc->sin_family == AF_INET); 3119 3120 natt_loc_ptr = (uint32_t *)(&natt_loc->sin_addr); 3121 newbie->ipsa_local_nat_port = natt_loc->sin_port; 3122 3123 /* Instead of IPSA_COPY_ADDR(), just copy first 32 bits. */ 3124 newbie->ipsa_natt_addr_loc = *natt_loc_ptr; 3125 3126 /* 3127 * NAT-T port agility means we may have natt_loc_ext, but 3128 * only for a local-port change. 3129 */ 3130 if (natt_loc->sin_addr.s_addr != INADDR_ANY) { 3131 uint32_t l_dst = ntohl(*dst_addr_ptr); 3132 uint32_t l_loc = ntohl(*natt_loc_ptr); 3133 3134 DOWN_SUM(l_loc); 3135 DOWN_SUM(l_loc); 3136 DOWN_SUM(l_dst); 3137 DOWN_SUM(l_dst); 3138 3139 /* 3140 * We're 1's complement for checksums, so check for 3141 * wraparound here. 3142 */ 3143 if (l_loc > l_dst) 3144 l_dst--; 3145 3146 running_sum += l_dst - l_loc; 3147 DOWN_SUM(running_sum); 3148 DOWN_SUM(running_sum); 3149 } 3150 } 3151 3152 newbie->ipsa_inbound_cksum = running_sum; 3153 #undef DOWN_SUM 3154 } 3155 3156 /* 3157 * This function is called from consumers that need to insert a fully-grown 3158 * security association into its tables. This function takes into account that 3159 * SAs can be "inbound", "outbound", or "both". The "primary" and "secondary" 3160 * hash bucket parameters are set in order of what the SA will be most of the 3161 * time. (For example, an SA with an unspecified source, and a multicast 3162 * destination will primarily be an outbound SA. OTOH, if that destination 3163 * is unicast for this node, then the SA will primarily be inbound.) 3164 * 3165 * It takes a lot of parameters because even if clone is B_FALSE, this needs 3166 * to check both buckets for purposes of collision. 3167 * 3168 * Return 0 upon success. Return various errnos (ENOMEM, EEXIST) for 3169 * various error conditions. We may need to set samsg->sadb_x_msg_diagnostic 3170 * with additional diagnostic information because there is at least one EINVAL 3171 * case here. 3172 */ 3173 int 3174 sadb_common_add(queue_t *ip_q, queue_t *pfkey_q, mblk_t *mp, sadb_msg_t *samsg, 3175 keysock_in_t *ksi, isaf_t *primary, isaf_t *secondary, 3176 ipsa_t *newbie, boolean_t clone, boolean_t is_inbound, int *diagnostic, 3177 netstack_t *ns, sadbp_t *spp) 3178 { 3179 ipsa_t *newbie_clone = NULL, *scratch; 3180 ipsap_t *ipsapp = NULL; 3181 sadb_sa_t *assoc = (sadb_sa_t *)ksi->ks_in_extv[SADB_EXT_SA]; 3182 sadb_address_t *srcext = 3183 (sadb_address_t *)ksi->ks_in_extv[SADB_EXT_ADDRESS_SRC]; 3184 sadb_address_t *dstext = 3185 (sadb_address_t *)ksi->ks_in_extv[SADB_EXT_ADDRESS_DST]; 3186 sadb_address_t *isrcext = 3187 (sadb_address_t *)ksi->ks_in_extv[SADB_X_EXT_ADDRESS_INNER_SRC]; 3188 sadb_address_t *idstext = 3189 (sadb_address_t *)ksi->ks_in_extv[SADB_X_EXT_ADDRESS_INNER_DST]; 3190 sadb_x_kmc_t *kmcext = 3191 (sadb_x_kmc_t *)ksi->ks_in_extv[SADB_X_EXT_KM_COOKIE]; 3192 sadb_key_t *akey = (sadb_key_t *)ksi->ks_in_extv[SADB_EXT_KEY_AUTH]; 3193 sadb_key_t *ekey = (sadb_key_t *)ksi->ks_in_extv[SADB_EXT_KEY_ENCRYPT]; 3194 sadb_x_pair_t *pair_ext = 3195 (sadb_x_pair_t *)ksi->ks_in_extv[SADB_X_EXT_PAIR]; 3196 sadb_x_replay_ctr_t *replayext = 3197 (sadb_x_replay_ctr_t *)ksi->ks_in_extv[SADB_X_EXT_REPLAY_VALUE]; 3198 uint8_t protocol = 3199 (samsg->sadb_msg_satype == SADB_SATYPE_AH) ? IPPROTO_AH:IPPROTO_ESP; 3200 #if 0 3201 /* 3202 * XXXMLS - When Trusted Solaris or Multi-Level Secure functionality 3203 * comes to ON, examine these if 0'ed fragments. Look for XXXMLS. 3204 */ 3205 sadb_sens_t *sens = (sadb_sens_t *); 3206 #endif 3207 struct sockaddr_in *src, *dst, *isrc, *idst; 3208 struct sockaddr_in6 *src6, *dst6, *isrc6, *idst6; 3209 sadb_lifetime_t *soft = 3210 (sadb_lifetime_t *)ksi->ks_in_extv[SADB_EXT_LIFETIME_SOFT]; 3211 sadb_lifetime_t *hard = 3212 (sadb_lifetime_t *)ksi->ks_in_extv[SADB_EXT_LIFETIME_HARD]; 3213 sadb_lifetime_t *idle = 3214 (sadb_lifetime_t *)ksi->ks_in_extv[SADB_X_EXT_LIFETIME_IDLE]; 3215 sa_family_t af; 3216 int error = 0; 3217 boolean_t isupdate = (newbie != NULL); 3218 uint32_t *src_addr_ptr, *dst_addr_ptr, *isrc_addr_ptr, *idst_addr_ptr; 3219 mblk_t *ctl_mp = NULL; 3220 ipsec_stack_t *ipss = ns->netstack_ipsec; 3221 int rcode; 3222 3223 if (srcext == NULL) { 3224 *diagnostic = SADB_X_DIAGNOSTIC_MISSING_SRC; 3225 return (EINVAL); 3226 } 3227 if (dstext == NULL) { 3228 *diagnostic = SADB_X_DIAGNOSTIC_MISSING_DST; 3229 return (EINVAL); 3230 } 3231 if (assoc == NULL) { 3232 *diagnostic = SADB_X_DIAGNOSTIC_MISSING_SA; 3233 return (EINVAL); 3234 } 3235 3236 src = (struct sockaddr_in *)(srcext + 1); 3237 src6 = (struct sockaddr_in6 *)(srcext + 1); 3238 dst = (struct sockaddr_in *)(dstext + 1); 3239 dst6 = (struct sockaddr_in6 *)(dstext + 1); 3240 if (isrcext != NULL) { 3241 isrc = (struct sockaddr_in *)(isrcext + 1); 3242 isrc6 = (struct sockaddr_in6 *)(isrcext + 1); 3243 ASSERT(idstext != NULL); 3244 idst = (struct sockaddr_in *)(idstext + 1); 3245 idst6 = (struct sockaddr_in6 *)(idstext + 1); 3246 } else { 3247 isrc = NULL; 3248 isrc6 = NULL; 3249 } 3250 3251 af = src->sin_family; 3252 3253 if (af == AF_INET) { 3254 src_addr_ptr = (uint32_t *)&src->sin_addr; 3255 dst_addr_ptr = (uint32_t *)&dst->sin_addr; 3256 } else { 3257 ASSERT(af == AF_INET6); 3258 src_addr_ptr = (uint32_t *)&src6->sin6_addr; 3259 dst_addr_ptr = (uint32_t *)&dst6->sin6_addr; 3260 } 3261 3262 if (!isupdate && (clone == B_TRUE || is_inbound == B_TRUE) && 3263 cl_inet_checkspi && 3264 (assoc->sadb_sa_state != SADB_X_SASTATE_ACTIVE_ELSEWHERE)) { 3265 rcode = cl_inet_checkspi(ns->netstack_stackid, protocol, 3266 assoc->sadb_sa_spi, NULL); 3267 if (rcode == -1) { 3268 return (EEXIST); 3269 } 3270 } 3271 3272 /* 3273 * Check to see if the new SA will be cloned AND paired. The 3274 * reason a SA will be cloned is the source or destination addresses 3275 * are not specific enough to determine if the SA goes in the outbound 3276 * or the inbound hash table, so its cloned and put in both. If 3277 * the SA is paired, it's soft linked to another SA for the other 3278 * direction. Keeping track and looking up SA's that are direction 3279 * unspecific and linked is too hard. 3280 */ 3281 if (clone && (pair_ext != NULL)) { 3282 *diagnostic = SADB_X_DIAGNOSTIC_PAIR_INAPPROPRIATE; 3283 return (EINVAL); 3284 } 3285 3286 if (!isupdate) { 3287 newbie = sadb_makelarvalassoc(assoc->sadb_sa_spi, 3288 src_addr_ptr, dst_addr_ptr, af, ns); 3289 if (newbie == NULL) 3290 return (ENOMEM); 3291 } 3292 3293 mutex_enter(&newbie->ipsa_lock); 3294 3295 if (isrc != NULL) { 3296 if (isrc->sin_family == AF_INET) { 3297 if (srcext->sadb_address_proto != IPPROTO_ENCAP) { 3298 if (srcext->sadb_address_proto != 0) { 3299 /* 3300 * Mismatched outer-packet protocol 3301 * and inner-packet address family. 3302 */ 3303 mutex_exit(&newbie->ipsa_lock); 3304 error = EPROTOTYPE; 3305 goto error; 3306 } else { 3307 /* Fill in with explicit protocol. */ 3308 srcext->sadb_address_proto = 3309 IPPROTO_ENCAP; 3310 dstext->sadb_address_proto = 3311 IPPROTO_ENCAP; 3312 } 3313 } 3314 isrc_addr_ptr = (uint32_t *)&isrc->sin_addr; 3315 idst_addr_ptr = (uint32_t *)&idst->sin_addr; 3316 } else { 3317 ASSERT(isrc->sin_family == AF_INET6); 3318 if (srcext->sadb_address_proto != IPPROTO_IPV6) { 3319 if (srcext->sadb_address_proto != 0) { 3320 /* 3321 * Mismatched outer-packet protocol 3322 * and inner-packet address family. 3323 */ 3324 mutex_exit(&newbie->ipsa_lock); 3325 error = EPROTOTYPE; 3326 goto error; 3327 } else { 3328 /* Fill in with explicit protocol. */ 3329 srcext->sadb_address_proto = 3330 IPPROTO_IPV6; 3331 dstext->sadb_address_proto = 3332 IPPROTO_IPV6; 3333 } 3334 } 3335 isrc_addr_ptr = (uint32_t *)&isrc6->sin6_addr; 3336 idst_addr_ptr = (uint32_t *)&idst6->sin6_addr; 3337 } 3338 newbie->ipsa_innerfam = isrc->sin_family; 3339 3340 IPSA_COPY_ADDR(newbie->ipsa_innersrc, isrc_addr_ptr, 3341 newbie->ipsa_innerfam); 3342 IPSA_COPY_ADDR(newbie->ipsa_innerdst, idst_addr_ptr, 3343 newbie->ipsa_innerfam); 3344 newbie->ipsa_innersrcpfx = isrcext->sadb_address_prefixlen; 3345 newbie->ipsa_innerdstpfx = idstext->sadb_address_prefixlen; 3346 3347 /* Unique value uses inner-ports for Tunnel Mode... */ 3348 newbie->ipsa_unique_id = SA_UNIQUE_ID(isrc->sin_port, 3349 idst->sin_port, dstext->sadb_address_proto, 3350 idstext->sadb_address_proto); 3351 newbie->ipsa_unique_mask = SA_UNIQUE_MASK(isrc->sin_port, 3352 idst->sin_port, dstext->sadb_address_proto, 3353 idstext->sadb_address_proto); 3354 } else { 3355 /* ... and outer-ports for Transport Mode. */ 3356 newbie->ipsa_unique_id = SA_UNIQUE_ID(src->sin_port, 3357 dst->sin_port, dstext->sadb_address_proto, 0); 3358 newbie->ipsa_unique_mask = SA_UNIQUE_MASK(src->sin_port, 3359 dst->sin_port, dstext->sadb_address_proto, 0); 3360 } 3361 if (newbie->ipsa_unique_mask != (uint64_t)0) 3362 newbie->ipsa_flags |= IPSA_F_UNIQUE; 3363 3364 sadb_nat_calculations(newbie, 3365 (sadb_address_t *)ksi->ks_in_extv[SADB_X_EXT_ADDRESS_NATT_LOC], 3366 (sadb_address_t *)ksi->ks_in_extv[SADB_X_EXT_ADDRESS_NATT_REM], 3367 src_addr_ptr, dst_addr_ptr); 3368 3369 newbie->ipsa_type = samsg->sadb_msg_satype; 3370 ASSERT((assoc->sadb_sa_state == SADB_SASTATE_MATURE) || 3371 (assoc->sadb_sa_state == SADB_X_SASTATE_ACTIVE_ELSEWHERE)); 3372 newbie->ipsa_auth_alg = assoc->sadb_sa_auth; 3373 newbie->ipsa_encr_alg = assoc->sadb_sa_encrypt; 3374 3375 newbie->ipsa_flags |= assoc->sadb_sa_flags; 3376 if ((newbie->ipsa_flags & SADB_X_SAFLAGS_NATT_LOC && 3377 ksi->ks_in_extv[SADB_X_EXT_ADDRESS_NATT_LOC] == NULL) || 3378 (newbie->ipsa_flags & SADB_X_SAFLAGS_NATT_REM && 3379 ksi->ks_in_extv[SADB_X_EXT_ADDRESS_NATT_REM] == NULL) || 3380 (newbie->ipsa_flags & SADB_X_SAFLAGS_TUNNEL && 3381 ksi->ks_in_extv[SADB_X_EXT_ADDRESS_INNER_SRC] == NULL)) { 3382 mutex_exit(&newbie->ipsa_lock); 3383 *diagnostic = SADB_X_DIAGNOSTIC_BAD_SAFLAGS; 3384 error = EINVAL; 3385 goto error; 3386 } 3387 /* 3388 * If unspecified source address, force replay_wsize to 0. 3389 * This is because an SA that has multiple sources of secure 3390 * traffic cannot enforce a replay counter w/o synchronizing the 3391 * senders. 3392 */ 3393 if (ksi->ks_in_srctype != KS_IN_ADDR_UNSPEC) 3394 newbie->ipsa_replay_wsize = assoc->sadb_sa_replay; 3395 else 3396 newbie->ipsa_replay_wsize = 0; 3397 3398 newbie->ipsa_addtime = gethrestime_sec(); 3399 3400 if (kmcext != NULL) { 3401 newbie->ipsa_kmp = kmcext->sadb_x_kmc_proto; 3402 newbie->ipsa_kmc = kmcext->sadb_x_kmc_cookie; 3403 } 3404 3405 /* 3406 * XXX CURRENT lifetime checks MAY BE needed for an UPDATE. 3407 * The spec says that one can update current lifetimes, but 3408 * that seems impractical, especially in the larval-to-mature 3409 * update that this function performs. 3410 */ 3411 if (soft != NULL) { 3412 newbie->ipsa_softaddlt = soft->sadb_lifetime_addtime; 3413 newbie->ipsa_softuselt = soft->sadb_lifetime_usetime; 3414 newbie->ipsa_softbyteslt = soft->sadb_lifetime_bytes; 3415 newbie->ipsa_softalloc = soft->sadb_lifetime_allocations; 3416 SET_EXPIRE(newbie, softaddlt, softexpiretime); 3417 } 3418 if (hard != NULL) { 3419 newbie->ipsa_hardaddlt = hard->sadb_lifetime_addtime; 3420 newbie->ipsa_harduselt = hard->sadb_lifetime_usetime; 3421 newbie->ipsa_hardbyteslt = hard->sadb_lifetime_bytes; 3422 newbie->ipsa_hardalloc = hard->sadb_lifetime_allocations; 3423 SET_EXPIRE(newbie, hardaddlt, hardexpiretime); 3424 } 3425 if (idle != NULL) { 3426 newbie->ipsa_idleaddlt = idle->sadb_lifetime_addtime; 3427 newbie->ipsa_idleuselt = idle->sadb_lifetime_usetime; 3428 newbie->ipsa_idleexpiretime = newbie->ipsa_addtime + 3429 newbie->ipsa_idleaddlt; 3430 newbie->ipsa_idletime = newbie->ipsa_idleaddlt; 3431 } 3432 3433 newbie->ipsa_authtmpl = NULL; 3434 newbie->ipsa_encrtmpl = NULL; 3435 3436 if (akey != NULL) { 3437 newbie->ipsa_authkeybits = akey->sadb_key_bits; 3438 newbie->ipsa_authkeylen = SADB_1TO8(akey->sadb_key_bits); 3439 /* In case we have to round up to the next byte... */ 3440 if ((akey->sadb_key_bits & 0x7) != 0) 3441 newbie->ipsa_authkeylen++; 3442 newbie->ipsa_authkey = kmem_alloc(newbie->ipsa_authkeylen, 3443 KM_NOSLEEP); 3444 if (newbie->ipsa_authkey == NULL) { 3445 error = ENOMEM; 3446 mutex_exit(&newbie->ipsa_lock); 3447 goto error; 3448 } 3449 bcopy(akey + 1, newbie->ipsa_authkey, newbie->ipsa_authkeylen); 3450 bzero(akey + 1, newbie->ipsa_authkeylen); 3451 3452 /* 3453 * Pre-initialize the kernel crypto framework key 3454 * structure. 3455 */ 3456 newbie->ipsa_kcfauthkey.ck_format = CRYPTO_KEY_RAW; 3457 newbie->ipsa_kcfauthkey.ck_length = newbie->ipsa_authkeybits; 3458 newbie->ipsa_kcfauthkey.ck_data = newbie->ipsa_authkey; 3459 3460 mutex_enter(&ipss->ipsec_alg_lock); 3461 error = ipsec_create_ctx_tmpl(newbie, IPSEC_ALG_AUTH); 3462 mutex_exit(&ipss->ipsec_alg_lock); 3463 if (error != 0) { 3464 mutex_exit(&newbie->ipsa_lock); 3465 goto error; 3466 } 3467 } 3468 3469 if (ekey != NULL) { 3470 newbie->ipsa_encrkeybits = ekey->sadb_key_bits; 3471 newbie->ipsa_encrkeylen = SADB_1TO8(ekey->sadb_key_bits); 3472 /* In case we have to round up to the next byte... */ 3473 if ((ekey->sadb_key_bits & 0x7) != 0) 3474 newbie->ipsa_encrkeylen++; 3475 newbie->ipsa_encrkey = kmem_alloc(newbie->ipsa_encrkeylen, 3476 KM_NOSLEEP); 3477 if (newbie->ipsa_encrkey == NULL) { 3478 error = ENOMEM; 3479 mutex_exit(&newbie->ipsa_lock); 3480 goto error; 3481 } 3482 bcopy(ekey + 1, newbie->ipsa_encrkey, newbie->ipsa_encrkeylen); 3483 /* XXX is this safe w.r.t db_ref, etc? */ 3484 bzero(ekey + 1, newbie->ipsa_encrkeylen); 3485 3486 /* 3487 * Pre-initialize the kernel crypto framework key 3488 * structure. 3489 */ 3490 newbie->ipsa_kcfencrkey.ck_format = CRYPTO_KEY_RAW; 3491 newbie->ipsa_kcfencrkey.ck_length = newbie->ipsa_encrkeybits; 3492 newbie->ipsa_kcfencrkey.ck_data = newbie->ipsa_encrkey; 3493 3494 mutex_enter(&ipss->ipsec_alg_lock); 3495 error = ipsec_create_ctx_tmpl(newbie, IPSEC_ALG_ENCR); 3496 mutex_exit(&ipss->ipsec_alg_lock); 3497 if (error != 0) { 3498 mutex_exit(&newbie->ipsa_lock); 3499 goto error; 3500 } 3501 } 3502 3503 sadb_init_alginfo(newbie); 3504 3505 /* 3506 * Ptrs to processing functions. 3507 */ 3508 if (newbie->ipsa_type == SADB_SATYPE_ESP) 3509 ipsecesp_init_funcs(newbie); 3510 else 3511 ipsecah_init_funcs(newbie); 3512 ASSERT(newbie->ipsa_output_func != NULL && 3513 newbie->ipsa_input_func != NULL); 3514 3515 /* 3516 * Certificate ID stuff. 3517 */ 3518 if (ksi->ks_in_extv[SADB_EXT_IDENTITY_SRC] != NULL) { 3519 sadb_ident_t *id = 3520 (sadb_ident_t *)ksi->ks_in_extv[SADB_EXT_IDENTITY_SRC]; 3521 3522 /* 3523 * Can assume strlen() will return okay because ext_check() in 3524 * keysock.c prepares the string for us. 3525 */ 3526 newbie->ipsa_src_cid = ipsid_lookup(id->sadb_ident_type, 3527 (char *)(id+1), ns); 3528 if (newbie->ipsa_src_cid == NULL) { 3529 error = ENOMEM; 3530 mutex_exit(&newbie->ipsa_lock); 3531 goto error; 3532 } 3533 } 3534 3535 if (ksi->ks_in_extv[SADB_EXT_IDENTITY_DST] != NULL) { 3536 sadb_ident_t *id = 3537 (sadb_ident_t *)ksi->ks_in_extv[SADB_EXT_IDENTITY_DST]; 3538 3539 /* 3540 * Can assume strlen() will return okay because ext_check() in 3541 * keysock.c prepares the string for us. 3542 */ 3543 newbie->ipsa_dst_cid = ipsid_lookup(id->sadb_ident_type, 3544 (char *)(id+1), ns); 3545 if (newbie->ipsa_dst_cid == NULL) { 3546 error = ENOMEM; 3547 mutex_exit(&newbie->ipsa_lock); 3548 goto error; 3549 } 3550 } 3551 3552 #if 0 3553 /* XXXMLS SENSITIVITY handling code. */ 3554 if (sens != NULL) { 3555 int i; 3556 uint64_t *bitmap = (uint64_t *)(sens + 1); 3557 3558 newbie->ipsa_dpd = sens->sadb_sens_dpd; 3559 newbie->ipsa_senslevel = sens->sadb_sens_sens_level; 3560 newbie->ipsa_integlevel = sens->sadb_sens_integ_level; 3561 newbie->ipsa_senslen = SADB_64TO8(sens->sadb_sens_sens_len); 3562 newbie->ipsa_integlen = SADB_64TO8(sens->sadb_sens_integ_len); 3563 newbie->ipsa_integ = kmem_alloc(newbie->ipsa_integlen, 3564 KM_NOSLEEP); 3565 if (newbie->ipsa_integ == NULL) { 3566 error = ENOMEM; 3567 mutex_exit(&newbie->ipsa_lock); 3568 goto error; 3569 } 3570 newbie->ipsa_sens = kmem_alloc(newbie->ipsa_senslen, 3571 KM_NOSLEEP); 3572 if (newbie->ipsa_sens == NULL) { 3573 error = ENOMEM; 3574 mutex_exit(&newbie->ipsa_lock); 3575 goto error; 3576 } 3577 for (i = 0; i < sens->sadb_sens_sens_len; i++) { 3578 newbie->ipsa_sens[i] = *bitmap; 3579 bitmap++; 3580 } 3581 for (i = 0; i < sens->sadb_sens_integ_len; i++) { 3582 newbie->ipsa_integ[i] = *bitmap; 3583 bitmap++; 3584 } 3585 } 3586 3587 #endif 3588 3589 if (replayext != NULL) { 3590 if ((replayext->sadb_x_rc_replay32 == 0) && 3591 (replayext->sadb_x_rc_replay64 != 0)) { 3592 error = EOPNOTSUPP; 3593 mutex_exit(&newbie->ipsa_lock); 3594 goto error; 3595 } 3596 newbie->ipsa_replay = replayext->sadb_x_rc_replay32; 3597 } 3598 3599 /* now that the SA has been updated, set its new state */ 3600 newbie->ipsa_state = assoc->sadb_sa_state; 3601 3602 if (clone) { 3603 newbie->ipsa_haspeer = B_TRUE; 3604 } else { 3605 if (!is_inbound) { 3606 lifetime_fuzz(newbie); 3607 } 3608 } 3609 /* 3610 * The less locks I hold when doing an insertion and possible cloning, 3611 * the better! 3612 */ 3613 mutex_exit(&newbie->ipsa_lock); 3614 3615 if (clone) { 3616 newbie_clone = sadb_cloneassoc(newbie); 3617 3618 if (newbie_clone == NULL) { 3619 error = ENOMEM; 3620 goto error; 3621 } 3622 } 3623 3624 /* 3625 * Enter the bucket locks. The order of entry is outbound, 3626 * inbound. We map "primary" and "secondary" into outbound and inbound 3627 * based on the destination address type. If the destination address 3628 * type is for a node that isn't mine (or potentially mine), the 3629 * "primary" bucket is the outbound one. 3630 */ 3631 if (!is_inbound) { 3632 /* primary == outbound */ 3633 mutex_enter(&primary->isaf_lock); 3634 mutex_enter(&secondary->isaf_lock); 3635 } else { 3636 /* primary == inbound */ 3637 mutex_enter(&secondary->isaf_lock); 3638 mutex_enter(&primary->isaf_lock); 3639 } 3640 3641 IPSECHW_DEBUG(IPSECHW_SADB, ("sadb_common_add: spi = 0x%x\n", 3642 newbie->ipsa_spi)); 3643 3644 /* 3645 * sadb_insertassoc() doesn't increment the reference 3646 * count. We therefore have to increment the 3647 * reference count one more time to reflect the 3648 * pointers of the table that reference this SA. 3649 */ 3650 IPSA_REFHOLD(newbie); 3651 3652 if (isupdate) { 3653 /* 3654 * Unlink from larval holding cell in the "inbound" fanout. 3655 */ 3656 ASSERT(newbie->ipsa_linklock == &primary->isaf_lock || 3657 newbie->ipsa_linklock == &secondary->isaf_lock); 3658 sadb_unlinkassoc(newbie); 3659 } 3660 3661 mutex_enter(&newbie->ipsa_lock); 3662 error = sadb_insertassoc(newbie, primary); 3663 if (error == 0) { 3664 ctl_mp = sadb_fmt_sa_req(DL_CO_SET, newbie->ipsa_type, newbie, 3665 is_inbound); 3666 } 3667 mutex_exit(&newbie->ipsa_lock); 3668 3669 if (error != 0) { 3670 /* 3671 * Since sadb_insertassoc() failed, we must decrement the 3672 * refcount again so the cleanup code will actually free 3673 * the offending SA. 3674 */ 3675 IPSA_REFRELE(newbie); 3676 goto error_unlock; 3677 } 3678 3679 if (newbie_clone != NULL) { 3680 mutex_enter(&newbie_clone->ipsa_lock); 3681 error = sadb_insertassoc(newbie_clone, secondary); 3682 mutex_exit(&newbie_clone->ipsa_lock); 3683 if (error != 0) { 3684 /* Collision in secondary table. */ 3685 sadb_unlinkassoc(newbie); /* This does REFRELE. */ 3686 goto error_unlock; 3687 } 3688 IPSA_REFHOLD(newbie_clone); 3689 } else { 3690 ASSERT(primary != secondary); 3691 scratch = ipsec_getassocbyspi(secondary, newbie->ipsa_spi, 3692 ALL_ZEROES_PTR, newbie->ipsa_dstaddr, af); 3693 if (scratch != NULL) { 3694 /* Collision in secondary table. */ 3695 sadb_unlinkassoc(newbie); /* This does REFRELE. */ 3696 /* Set the error, since ipsec_getassocbyspi() can't. */ 3697 error = EEXIST; 3698 goto error_unlock; 3699 } 3700 } 3701 3702 /* OKAY! So let's do some reality check assertions. */ 3703 3704 ASSERT(MUTEX_NOT_HELD(&newbie->ipsa_lock)); 3705 ASSERT(newbie_clone == NULL || 3706 (MUTEX_NOT_HELD(&newbie_clone->ipsa_lock))); 3707 /* 3708 * If hardware acceleration could happen, send it. 3709 */ 3710 if (ctl_mp != NULL) { 3711 putnext(ip_q, ctl_mp); 3712 ctl_mp = NULL; 3713 } 3714 3715 error_unlock: 3716 3717 /* 3718 * We can exit the locks in any order. Only entrance needs to 3719 * follow any protocol. 3720 */ 3721 mutex_exit(&secondary->isaf_lock); 3722 mutex_exit(&primary->isaf_lock); 3723 3724 if (pair_ext != NULL && error == 0) { 3725 /* update pair_spi if it exists. */ 3726 ipsapp = get_ipsa_pair(assoc, srcext, dstext, spp); 3727 if (ipsapp == NULL) { 3728 error = ESRCH; 3729 *diagnostic = SADB_X_DIAGNOSTIC_PAIR_SA_NOTFOUND; 3730 } else if (ipsapp->ipsap_psa_ptr != NULL) { 3731 *diagnostic = SADB_X_DIAGNOSTIC_PAIR_ALREADY; 3732 error = EINVAL; 3733 } else { 3734 /* update_pairing() sets diagnostic */ 3735 error = update_pairing(ipsapp, ksi, diagnostic, spp); 3736 } 3737 } 3738 /* Common error point for this routine. */ 3739 error: 3740 if (newbie != NULL) { 3741 if (error != 0) { 3742 /* This SA is broken, let the reaper clean up. */ 3743 mutex_enter(&newbie->ipsa_lock); 3744 newbie->ipsa_state = IPSA_STATE_DEAD; 3745 newbie->ipsa_hardexpiretime = 1; 3746 mutex_exit(&newbie->ipsa_lock); 3747 } 3748 IPSA_REFRELE(newbie); 3749 } 3750 if (newbie_clone != NULL) { 3751 IPSA_REFRELE(newbie_clone); 3752 } 3753 if (ctl_mp != NULL) 3754 freemsg(ctl_mp); 3755 3756 if (error == 0) { 3757 /* 3758 * Construct favorable PF_KEY return message and send to 3759 * keysock. Update the flags in the original keysock message 3760 * to reflect the actual flags in the new SA. 3761 * (Q: Do I need to pass "newbie"? If I do, 3762 * make sure to REFHOLD, call, then REFRELE.) 3763 */ 3764 assoc->sadb_sa_flags = newbie->ipsa_flags; 3765 sadb_pfkey_echo(pfkey_q, mp, samsg, ksi, NULL); 3766 } 3767 3768 destroy_ipsa_pair(ipsapp); 3769 return (error); 3770 } 3771 3772 /* 3773 * Set the time of first use for a security association. Update any 3774 * expiration times as a result. 3775 */ 3776 void 3777 sadb_set_usetime(ipsa_t *assoc) 3778 { 3779 time_t snapshot = gethrestime_sec(); 3780 3781 mutex_enter(&assoc->ipsa_lock); 3782 assoc->ipsa_lastuse = snapshot; 3783 assoc->ipsa_idleexpiretime = snapshot + assoc->ipsa_idletime; 3784 3785 /* 3786 * Caller does check usetime before calling me usually, and 3787 * double-checking is better than a mutex_enter/exit hit. 3788 */ 3789 if (assoc->ipsa_usetime == 0) { 3790 /* 3791 * This is redundant for outbound SA's, as 3792 * ipsec_getassocbyconn() sets the IPSA_F_USED flag already. 3793 * Inbound SAs, however, have no such protection. 3794 */ 3795 assoc->ipsa_flags |= IPSA_F_USED; 3796 assoc->ipsa_usetime = snapshot; 3797 3798 /* 3799 * After setting the use time, see if we have a use lifetime 3800 * that would cause the actual SA expiration time to shorten. 3801 */ 3802 UPDATE_EXPIRE(assoc, softuselt, softexpiretime); 3803 UPDATE_EXPIRE(assoc, harduselt, hardexpiretime); 3804 } 3805 mutex_exit(&assoc->ipsa_lock); 3806 } 3807 3808 /* 3809 * Send up a PF_KEY expire message for this association. 3810 */ 3811 static void 3812 sadb_expire_assoc(queue_t *pfkey_q, ipsa_t *assoc) 3813 { 3814 mblk_t *mp, *mp1; 3815 int alloclen, af; 3816 sadb_msg_t *samsg; 3817 sadb_lifetime_t *current, *expire; 3818 sadb_sa_t *saext; 3819 uint8_t *end; 3820 boolean_t tunnel_mode; 3821 3822 ASSERT(MUTEX_HELD(&assoc->ipsa_lock)); 3823 3824 /* Don't bother sending if there's no queue. */ 3825 if (pfkey_q == NULL) 3826 return; 3827 3828 /* If the SA is one of a pair, only SOFT expire the OUTBOUND SA */ 3829 if (assoc->ipsa_state == IPSA_STATE_DYING && 3830 (assoc->ipsa_flags & IPSA_F_PAIRED) && 3831 !(assoc->ipsa_flags & IPSA_F_OUTBOUND)) { 3832 return; 3833 } 3834 3835 mp = sadb_keysock_out(0); 3836 if (mp == NULL) { 3837 /* cmn_err(CE_WARN, */ 3838 /* "sadb_expire_assoc: Can't allocate KEYSOCK_OUT.\n"); */ 3839 return; 3840 } 3841 3842 alloclen = sizeof (*samsg) + sizeof (*current) + sizeof (*expire) + 3843 2 * sizeof (sadb_address_t) + sizeof (*saext); 3844 3845 af = assoc->ipsa_addrfam; 3846 switch (af) { 3847 case AF_INET: 3848 alloclen += 2 * sizeof (struct sockaddr_in); 3849 break; 3850 case AF_INET6: 3851 alloclen += 2 * sizeof (struct sockaddr_in6); 3852 break; 3853 default: 3854 /* Won't happen unless there's a kernel bug. */ 3855 freeb(mp); 3856 cmn_err(CE_WARN, 3857 "sadb_expire_assoc: Unknown address length.\n"); 3858 return; 3859 } 3860 3861 tunnel_mode = (assoc->ipsa_flags & IPSA_F_TUNNEL); 3862 if (tunnel_mode) { 3863 alloclen += 2 * sizeof (sadb_address_t); 3864 switch (assoc->ipsa_innerfam) { 3865 case AF_INET: 3866 alloclen += 2 * sizeof (struct sockaddr_in); 3867 break; 3868 case AF_INET6: 3869 alloclen += 2 * sizeof (struct sockaddr_in6); 3870 break; 3871 default: 3872 /* Won't happen unless there's a kernel bug. */ 3873 freeb(mp); 3874 cmn_err(CE_WARN, "sadb_expire_assoc: " 3875 "Unknown inner address length.\n"); 3876 return; 3877 } 3878 } 3879 3880 mp->b_cont = allocb(alloclen, BPRI_HI); 3881 if (mp->b_cont == NULL) { 3882 freeb(mp); 3883 /* cmn_err(CE_WARN, */ 3884 /* "sadb_expire_assoc: Can't allocate message.\n"); */ 3885 return; 3886 } 3887 3888 mp1 = mp; 3889 mp = mp->b_cont; 3890 end = mp->b_wptr + alloclen; 3891 3892 samsg = (sadb_msg_t *)mp->b_wptr; 3893 mp->b_wptr += sizeof (*samsg); 3894 samsg->sadb_msg_version = PF_KEY_V2; 3895 samsg->sadb_msg_type = SADB_EXPIRE; 3896 samsg->sadb_msg_errno = 0; 3897 samsg->sadb_msg_satype = assoc->ipsa_type; 3898 samsg->sadb_msg_len = SADB_8TO64(alloclen); 3899 samsg->sadb_msg_reserved = 0; 3900 samsg->sadb_msg_seq = 0; 3901 samsg->sadb_msg_pid = 0; 3902 3903 saext = (sadb_sa_t *)mp->b_wptr; 3904 mp->b_wptr += sizeof (*saext); 3905 saext->sadb_sa_len = SADB_8TO64(sizeof (*saext)); 3906 saext->sadb_sa_exttype = SADB_EXT_SA; 3907 saext->sadb_sa_spi = assoc->ipsa_spi; 3908 saext->sadb_sa_replay = assoc->ipsa_replay_wsize; 3909 saext->sadb_sa_state = assoc->ipsa_state; 3910 saext->sadb_sa_auth = assoc->ipsa_auth_alg; 3911 saext->sadb_sa_encrypt = assoc->ipsa_encr_alg; 3912 saext->sadb_sa_flags = assoc->ipsa_flags; 3913 3914 current = (sadb_lifetime_t *)mp->b_wptr; 3915 mp->b_wptr += sizeof (sadb_lifetime_t); 3916 current->sadb_lifetime_len = SADB_8TO64(sizeof (*current)); 3917 current->sadb_lifetime_exttype = SADB_EXT_LIFETIME_CURRENT; 3918 /* We do not support the concept. */ 3919 current->sadb_lifetime_allocations = 0; 3920 current->sadb_lifetime_bytes = assoc->ipsa_bytes; 3921 current->sadb_lifetime_addtime = assoc->ipsa_addtime; 3922 current->sadb_lifetime_usetime = assoc->ipsa_usetime; 3923 3924 expire = (sadb_lifetime_t *)mp->b_wptr; 3925 mp->b_wptr += sizeof (*expire); 3926 expire->sadb_lifetime_len = SADB_8TO64(sizeof (*expire)); 3927 3928 if (assoc->ipsa_state == IPSA_STATE_DEAD) { 3929 expire->sadb_lifetime_exttype = SADB_EXT_LIFETIME_HARD; 3930 expire->sadb_lifetime_allocations = assoc->ipsa_hardalloc; 3931 expire->sadb_lifetime_bytes = assoc->ipsa_hardbyteslt; 3932 expire->sadb_lifetime_addtime = assoc->ipsa_hardaddlt; 3933 expire->sadb_lifetime_usetime = assoc->ipsa_harduselt; 3934 } else if (assoc->ipsa_state == IPSA_STATE_DYING) { 3935 expire->sadb_lifetime_exttype = SADB_EXT_LIFETIME_SOFT; 3936 expire->sadb_lifetime_allocations = assoc->ipsa_softalloc; 3937 expire->sadb_lifetime_bytes = assoc->ipsa_softbyteslt; 3938 expire->sadb_lifetime_addtime = assoc->ipsa_softaddlt; 3939 expire->sadb_lifetime_usetime = assoc->ipsa_softuselt; 3940 } else { 3941 ASSERT(assoc->ipsa_state == IPSA_STATE_MATURE); 3942 expire->sadb_lifetime_exttype = SADB_X_EXT_LIFETIME_IDLE; 3943 expire->sadb_lifetime_allocations = 0; 3944 expire->sadb_lifetime_bytes = 0; 3945 expire->sadb_lifetime_addtime = assoc->ipsa_idleaddlt; 3946 expire->sadb_lifetime_usetime = assoc->ipsa_idleuselt; 3947 } 3948 3949 mp->b_wptr = sadb_make_addr_ext(mp->b_wptr, end, SADB_EXT_ADDRESS_SRC, 3950 af, assoc->ipsa_srcaddr, tunnel_mode ? 0 : SA_SRCPORT(assoc), 3951 SA_PROTO(assoc), 0); 3952 ASSERT(mp->b_wptr != NULL); 3953 3954 mp->b_wptr = sadb_make_addr_ext(mp->b_wptr, end, SADB_EXT_ADDRESS_DST, 3955 af, assoc->ipsa_dstaddr, tunnel_mode ? 0 : SA_DSTPORT(assoc), 3956 SA_PROTO(assoc), 0); 3957 ASSERT(mp->b_wptr != NULL); 3958 3959 if (tunnel_mode) { 3960 mp->b_wptr = sadb_make_addr_ext(mp->b_wptr, end, 3961 SADB_X_EXT_ADDRESS_INNER_SRC, assoc->ipsa_innerfam, 3962 assoc->ipsa_innersrc, SA_SRCPORT(assoc), SA_IPROTO(assoc), 3963 assoc->ipsa_innersrcpfx); 3964 ASSERT(mp->b_wptr != NULL); 3965 mp->b_wptr = sadb_make_addr_ext(mp->b_wptr, end, 3966 SADB_X_EXT_ADDRESS_INNER_DST, assoc->ipsa_innerfam, 3967 assoc->ipsa_innerdst, SA_DSTPORT(assoc), SA_IPROTO(assoc), 3968 assoc->ipsa_innerdstpfx); 3969 ASSERT(mp->b_wptr != NULL); 3970 } 3971 3972 /* Can just putnext, we're ready to go! */ 3973 putnext(pfkey_q, mp1); 3974 } 3975 3976 /* 3977 * "Age" the SA with the number of bytes that was used to protect traffic. 3978 * Send an SADB_EXPIRE message if appropriate. Return B_TRUE if there was 3979 * enough "charge" left in the SA to protect the data. Return B_FALSE 3980 * otherwise. (If B_FALSE is returned, the association either was, or became 3981 * DEAD.) 3982 */ 3983 boolean_t 3984 sadb_age_bytes(queue_t *pfkey_q, ipsa_t *assoc, uint64_t bytes, 3985 boolean_t sendmsg) 3986 { 3987 boolean_t rc = B_TRUE; 3988 uint64_t newtotal; 3989 3990 mutex_enter(&assoc->ipsa_lock); 3991 newtotal = assoc->ipsa_bytes + bytes; 3992 if (assoc->ipsa_hardbyteslt != 0 && 3993 newtotal >= assoc->ipsa_hardbyteslt) { 3994 if (assoc->ipsa_state != IPSA_STATE_DEAD) { 3995 sadb_delete_cluster(assoc); 3996 /* 3997 * Send EXPIRE message to PF_KEY. May wish to pawn 3998 * this off on another non-interrupt thread. Also 3999 * unlink this SA immediately. 4000 */ 4001 assoc->ipsa_state = IPSA_STATE_DEAD; 4002 if (sendmsg) 4003 sadb_expire_assoc(pfkey_q, assoc); 4004 /* 4005 * Set non-zero expiration time so sadb_age_assoc() 4006 * will work when reaping. 4007 */ 4008 assoc->ipsa_hardexpiretime = (time_t)1; 4009 } /* Else someone beat me to it! */ 4010 rc = B_FALSE; 4011 } else if (assoc->ipsa_softbyteslt != 0 && 4012 (newtotal >= assoc->ipsa_softbyteslt)) { 4013 if (assoc->ipsa_state < IPSA_STATE_DYING) { 4014 /* 4015 * Send EXPIRE message to PF_KEY. May wish to pawn 4016 * this off on another non-interrupt thread. 4017 */ 4018 assoc->ipsa_state = IPSA_STATE_DYING; 4019 assoc->ipsa_bytes = newtotal; 4020 if (sendmsg) 4021 sadb_expire_assoc(pfkey_q, assoc); 4022 } /* Else someone beat me to it! */ 4023 } 4024 if (rc == B_TRUE) 4025 assoc->ipsa_bytes = newtotal; 4026 mutex_exit(&assoc->ipsa_lock); 4027 return (rc); 4028 } 4029 4030 /* 4031 * Push one or more DL_CO_DELETE messages queued up by 4032 * sadb_torch_assoc down to the underlying driver now that it's a 4033 * convenient time for it (i.e., ipsa bucket locks not held). 4034 */ 4035 static void 4036 sadb_drain_torchq(queue_t *q, mblk_t *mp) 4037 { 4038 while (mp != NULL) { 4039 mblk_t *next = mp->b_next; 4040 mp->b_next = NULL; 4041 if (q != NULL) 4042 putnext(q, mp); 4043 else 4044 freemsg(mp); 4045 mp = next; 4046 } 4047 } 4048 4049 /* 4050 * "Torch" an individual SA. Returns NULL, so it can be tail-called from 4051 * sadb_age_assoc(). 4052 * 4053 * If SA is hardware-accelerated, and we can't allocate the mblk 4054 * containing the DL_CO_DELETE, just return; it will remain in the 4055 * table and be swept up by sadb_ager() in a subsequent pass. 4056 */ 4057 static ipsa_t * 4058 sadb_torch_assoc(isaf_t *head, ipsa_t *sa, boolean_t inbnd, mblk_t **mq) 4059 { 4060 mblk_t *mp; 4061 4062 ASSERT(MUTEX_HELD(&head->isaf_lock)); 4063 ASSERT(MUTEX_HELD(&sa->ipsa_lock)); 4064 ASSERT(sa->ipsa_state == IPSA_STATE_DEAD); 4065 4066 /* 4067 * Force cached SAs to be revalidated.. 4068 */ 4069 head->isaf_gen++; 4070 4071 if (sa->ipsa_flags & IPSA_F_HW) { 4072 mp = sadb_fmt_sa_req(DL_CO_DELETE, sa->ipsa_type, sa, inbnd); 4073 if (mp == NULL) { 4074 mutex_exit(&sa->ipsa_lock); 4075 return (NULL); 4076 } 4077 mp->b_next = *mq; 4078 *mq = mp; 4079 } 4080 mutex_exit(&sa->ipsa_lock); 4081 sadb_unlinkassoc(sa); 4082 4083 return (NULL); 4084 } 4085 4086 /* 4087 * Do various SA-is-idle activities depending on delta (the number of idle 4088 * seconds on the SA) and/or other properties of the SA. 4089 * 4090 * Return B_TRUE if I've sent a packet, because I have to drop the 4091 * association's mutex before sending a packet out the wire. 4092 */ 4093 /* ARGSUSED */ 4094 static boolean_t 4095 sadb_idle_activities(ipsa_t *assoc, time_t delta, boolean_t inbound) 4096 { 4097 ipsecesp_stack_t *espstack = assoc->ipsa_netstack->netstack_ipsecesp; 4098 int nat_t_interval = espstack->ipsecesp_nat_keepalive_interval; 4099 4100 ASSERT(MUTEX_HELD(&assoc->ipsa_lock)); 4101 4102 if (!inbound && (assoc->ipsa_flags & IPSA_F_NATT_LOC) && 4103 delta >= nat_t_interval && 4104 gethrestime_sec() - assoc->ipsa_last_nat_t_ka >= nat_t_interval) { 4105 ASSERT(assoc->ipsa_type == SADB_SATYPE_ESP); 4106 assoc->ipsa_last_nat_t_ka = gethrestime_sec(); 4107 mutex_exit(&assoc->ipsa_lock); 4108 ipsecesp_send_keepalive(assoc); 4109 return (B_TRUE); 4110 } 4111 return (B_FALSE); 4112 } 4113 4114 /* 4115 * Return "assoc" if haspeer is true and I send an expire. This allows 4116 * the consumers' aging functions to tidy up an expired SA's peer. 4117 */ 4118 static ipsa_t * 4119 sadb_age_assoc(isaf_t *head, queue_t *pfkey_q, ipsa_t *assoc, 4120 time_t current, int reap_delay, boolean_t inbound, mblk_t **mq) 4121 { 4122 ipsa_t *retval = NULL; 4123 boolean_t dropped_mutex = B_FALSE; 4124 4125 ASSERT(MUTEX_HELD(&head->isaf_lock)); 4126 4127 mutex_enter(&assoc->ipsa_lock); 4128 4129 if (((assoc->ipsa_state == IPSA_STATE_LARVAL) || 4130 ((assoc->ipsa_state == IPSA_STATE_IDLE) || 4131 (assoc->ipsa_state == IPSA_STATE_ACTIVE_ELSEWHERE) && 4132 (assoc->ipsa_hardexpiretime != 0))) && 4133 (assoc->ipsa_hardexpiretime <= current)) { 4134 assoc->ipsa_state = IPSA_STATE_DEAD; 4135 return (sadb_torch_assoc(head, assoc, inbound, mq)); 4136 } 4137 4138 /* 4139 * Check lifetimes. Fortunately, SA setup is done 4140 * such that there are only two times to look at, 4141 * softexpiretime, and hardexpiretime. 4142 * 4143 * Check hard first. 4144 */ 4145 4146 if (assoc->ipsa_hardexpiretime != 0 && 4147 assoc->ipsa_hardexpiretime <= current) { 4148 if (assoc->ipsa_state == IPSA_STATE_DEAD) 4149 return (sadb_torch_assoc(head, assoc, inbound, mq)); 4150 4151 if (inbound) { 4152 sadb_delete_cluster(assoc); 4153 } 4154 4155 /* 4156 * Send SADB_EXPIRE with hard lifetime, delay for unlinking. 4157 */ 4158 assoc->ipsa_state = IPSA_STATE_DEAD; 4159 if (assoc->ipsa_haspeer || assoc->ipsa_otherspi != 0) { 4160 /* 4161 * If the SA is paired or peered with another, put 4162 * a copy on a list which can be processed later, the 4163 * pair/peer SA needs to be updated so the both die 4164 * at the same time. 4165 * 4166 * If I return assoc, I have to bump up its reference 4167 * count to keep with the ipsa_t reference count 4168 * semantics. 4169 */ 4170 IPSA_REFHOLD(assoc); 4171 retval = assoc; 4172 } 4173 sadb_expire_assoc(pfkey_q, assoc); 4174 assoc->ipsa_hardexpiretime = current + reap_delay; 4175 } else if (assoc->ipsa_softexpiretime != 0 && 4176 assoc->ipsa_softexpiretime <= current && 4177 assoc->ipsa_state < IPSA_STATE_DYING) { 4178 /* 4179 * Send EXPIRE message to PF_KEY. May wish to pawn 4180 * this off on another non-interrupt thread. 4181 */ 4182 assoc->ipsa_state = IPSA_STATE_DYING; 4183 if (assoc->ipsa_haspeer) { 4184 /* 4185 * If the SA has a peer, update the peer's state 4186 * on SOFT_EXPIRE, this is mostly to prevent two 4187 * expire messages from effectively the same SA. 4188 * 4189 * Don't care about paired SA's, then can (and should) 4190 * be able to soft expire at different times. 4191 * 4192 * If I return assoc, I have to bump up its 4193 * reference count to keep with the ipsa_t reference 4194 * count semantics. 4195 */ 4196 IPSA_REFHOLD(assoc); 4197 retval = assoc; 4198 } 4199 sadb_expire_assoc(pfkey_q, assoc); 4200 } else if (assoc->ipsa_idletime != 0 && 4201 assoc->ipsa_idleexpiretime <= current) { 4202 if (assoc->ipsa_state == IPSA_STATE_ACTIVE_ELSEWHERE) { 4203 assoc->ipsa_state = IPSA_STATE_IDLE; 4204 } 4205 4206 /* 4207 * Need to handle Mature case 4208 */ 4209 if (assoc->ipsa_state == IPSA_STATE_MATURE) { 4210 sadb_expire_assoc(pfkey_q, assoc); 4211 } 4212 } else { 4213 /* Check idle time activities. */ 4214 dropped_mutex = sadb_idle_activities(assoc, 4215 current - assoc->ipsa_lastuse, inbound); 4216 } 4217 4218 if (!dropped_mutex) 4219 mutex_exit(&assoc->ipsa_lock); 4220 return (retval); 4221 } 4222 4223 /* 4224 * Called by a consumer protocol to do ther dirty work of reaping dead 4225 * Security Associations. 4226 * 4227 * NOTE: sadb_age_assoc() marks expired SA's as DEAD but only removed 4228 * SA's that are already marked DEAD, so expired SA's are only reaped 4229 * the second time sadb_ager() runs. 4230 */ 4231 void 4232 sadb_ager(sadb_t *sp, queue_t *pfkey_q, queue_t *ip_q, int reap_delay, 4233 netstack_t *ns) 4234 { 4235 int i; 4236 isaf_t *bucket; 4237 ipsa_t *assoc, *spare; 4238 iacqf_t *acqlist; 4239 ipsacq_t *acqrec, *spareacq; 4240 templist_t *haspeerlist, *newbie; 4241 /* Snapshot current time now. */ 4242 time_t current = gethrestime_sec(); 4243 mblk_t *mq = NULL; 4244 haspeerlist = NULL; 4245 4246 /* 4247 * Do my dirty work. This includes aging real entries, aging 4248 * larvals, and aging outstanding ACQUIREs. 4249 * 4250 * I hope I don't tie up resources for too long. 4251 */ 4252 4253 /* Age acquires. */ 4254 4255 for (i = 0; i < sp->sdb_hashsize; i++) { 4256 acqlist = &sp->sdb_acq[i]; 4257 mutex_enter(&acqlist->iacqf_lock); 4258 for (acqrec = acqlist->iacqf_ipsacq; acqrec != NULL; 4259 acqrec = spareacq) { 4260 spareacq = acqrec->ipsacq_next; 4261 if (current > acqrec->ipsacq_expire) 4262 sadb_destroy_acquire(acqrec, ns); 4263 } 4264 mutex_exit(&acqlist->iacqf_lock); 4265 } 4266 4267 /* Age inbound associations. */ 4268 for (i = 0; i < sp->sdb_hashsize; i++) { 4269 bucket = &(sp->sdb_if[i]); 4270 mutex_enter(&bucket->isaf_lock); 4271 for (assoc = bucket->isaf_ipsa; assoc != NULL; 4272 assoc = spare) { 4273 spare = assoc->ipsa_next; 4274 if (sadb_age_assoc(bucket, pfkey_q, assoc, current, 4275 reap_delay, B_TRUE, &mq) != NULL) { 4276 /* 4277 * Put SA's which have a peer or SA's which 4278 * are paired on a list for processing after 4279 * all the hash tables have been walked. 4280 * 4281 * sadb_age_assoc() increments the refcnt, 4282 * effectively doing an IPSA_REFHOLD(). 4283 */ 4284 newbie = kmem_alloc(sizeof (*newbie), 4285 KM_NOSLEEP); 4286 if (newbie == NULL) { 4287 /* 4288 * Don't forget to REFRELE(). 4289 */ 4290 IPSA_REFRELE(assoc); 4291 continue; /* for loop... */ 4292 } 4293 newbie->next = haspeerlist; 4294 newbie->ipsa = assoc; 4295 haspeerlist = newbie; 4296 } 4297 } 4298 mutex_exit(&bucket->isaf_lock); 4299 } 4300 4301 if (mq != NULL) { 4302 sadb_drain_torchq(ip_q, mq); 4303 mq = NULL; 4304 } 4305 age_pair_peer_list(haspeerlist, sp, B_FALSE); 4306 haspeerlist = NULL; 4307 4308 /* Age outbound associations. */ 4309 for (i = 0; i < sp->sdb_hashsize; i++) { 4310 bucket = &(sp->sdb_of[i]); 4311 mutex_enter(&bucket->isaf_lock); 4312 for (assoc = bucket->isaf_ipsa; assoc != NULL; 4313 assoc = spare) { 4314 spare = assoc->ipsa_next; 4315 if (sadb_age_assoc(bucket, pfkey_q, assoc, current, 4316 reap_delay, B_FALSE, &mq) != NULL) { 4317 /* 4318 * sadb_age_assoc() increments the refcnt, 4319 * effectively doing an IPSA_REFHOLD(). 4320 */ 4321 newbie = kmem_alloc(sizeof (*newbie), 4322 KM_NOSLEEP); 4323 if (newbie == NULL) { 4324 /* 4325 * Don't forget to REFRELE(). 4326 */ 4327 IPSA_REFRELE(assoc); 4328 continue; /* for loop... */ 4329 } 4330 newbie->next = haspeerlist; 4331 newbie->ipsa = assoc; 4332 haspeerlist = newbie; 4333 } 4334 } 4335 mutex_exit(&bucket->isaf_lock); 4336 } 4337 if (mq != NULL) { 4338 sadb_drain_torchq(ip_q, mq); 4339 mq = NULL; 4340 } 4341 4342 age_pair_peer_list(haspeerlist, sp, B_TRUE); 4343 4344 /* 4345 * Run a GC pass to clean out dead identities. 4346 */ 4347 ipsid_gc(ns); 4348 } 4349 4350 /* 4351 * Figure out when to reschedule the ager. 4352 */ 4353 timeout_id_t 4354 sadb_retimeout(hrtime_t begin, queue_t *pfkey_q, void (*ager)(void *), 4355 void *agerarg, uint_t *intp, uint_t intmax, short mid) 4356 { 4357 hrtime_t end = gethrtime(); 4358 uint_t interval = *intp; 4359 4360 /* 4361 * See how long this took. If it took too long, increase the 4362 * aging interval. 4363 */ 4364 if ((end - begin) > interval * 1000000) { 4365 if (interval >= intmax) { 4366 /* XXX Rate limit this? Or recommend flush? */ 4367 (void) strlog(mid, 0, 0, SL_ERROR | SL_WARN, 4368 "Too many SA's to age out in %d msec.\n", 4369 intmax); 4370 } else { 4371 /* Double by shifting by one bit. */ 4372 interval <<= 1; 4373 interval = min(interval, intmax); 4374 } 4375 } else if ((end - begin) <= interval * 500000 && 4376 interval > SADB_AGE_INTERVAL_DEFAULT) { 4377 /* 4378 * If I took less than half of the interval, then I should 4379 * ratchet the interval back down. Never automatically 4380 * shift below the default aging interval. 4381 * 4382 * NOTE:This even overrides manual setting of the age 4383 * interval using NDD. 4384 */ 4385 /* Halve by shifting one bit. */ 4386 interval >>= 1; 4387 interval = max(interval, SADB_AGE_INTERVAL_DEFAULT); 4388 } 4389 *intp = interval; 4390 return (qtimeout(pfkey_q, ager, agerarg, 4391 interval * drv_usectohz(1000))); 4392 } 4393 4394 4395 /* 4396 * Update the lifetime values of an SA. This is the path an SADB_UPDATE 4397 * message takes when updating a MATURE or DYING SA. 4398 */ 4399 static void 4400 sadb_update_lifetimes(ipsa_t *assoc, sadb_lifetime_t *hard, 4401 sadb_lifetime_t *soft, sadb_lifetime_t *idle, boolean_t outbound) 4402 { 4403 mutex_enter(&assoc->ipsa_lock); 4404 4405 /* 4406 * XXX RFC 2367 mentions how an SADB_EXT_LIFETIME_CURRENT can be 4407 * passed in during an update message. We currently don't handle 4408 * these. 4409 */ 4410 4411 if (hard != NULL) { 4412 if (hard->sadb_lifetime_bytes != 0) 4413 assoc->ipsa_hardbyteslt = hard->sadb_lifetime_bytes; 4414 if (hard->sadb_lifetime_usetime != 0) 4415 assoc->ipsa_harduselt = hard->sadb_lifetime_usetime; 4416 if (hard->sadb_lifetime_addtime != 0) 4417 assoc->ipsa_hardaddlt = hard->sadb_lifetime_addtime; 4418 if (assoc->ipsa_hardaddlt != 0) { 4419 assoc->ipsa_hardexpiretime = 4420 assoc->ipsa_addtime + assoc->ipsa_hardaddlt; 4421 } 4422 if (assoc->ipsa_harduselt != 0 && 4423 assoc->ipsa_flags & IPSA_F_USED) { 4424 UPDATE_EXPIRE(assoc, harduselt, hardexpiretime); 4425 } 4426 if (hard->sadb_lifetime_allocations != 0) 4427 assoc->ipsa_hardalloc = hard->sadb_lifetime_allocations; 4428 } 4429 4430 if (soft != NULL) { 4431 if (soft->sadb_lifetime_bytes != 0) { 4432 if (soft->sadb_lifetime_bytes > 4433 assoc->ipsa_hardbyteslt) { 4434 assoc->ipsa_softbyteslt = 4435 assoc->ipsa_hardbyteslt; 4436 } else { 4437 assoc->ipsa_softbyteslt = 4438 soft->sadb_lifetime_bytes; 4439 } 4440 } 4441 if (soft->sadb_lifetime_usetime != 0) { 4442 if (soft->sadb_lifetime_usetime > 4443 assoc->ipsa_harduselt) { 4444 assoc->ipsa_softuselt = 4445 assoc->ipsa_harduselt; 4446 } else { 4447 assoc->ipsa_softuselt = 4448 soft->sadb_lifetime_usetime; 4449 } 4450 } 4451 if (soft->sadb_lifetime_addtime != 0) { 4452 if (soft->sadb_lifetime_addtime > 4453 assoc->ipsa_hardexpiretime) { 4454 assoc->ipsa_softexpiretime = 4455 assoc->ipsa_hardexpiretime; 4456 } else { 4457 assoc->ipsa_softaddlt = 4458 soft->sadb_lifetime_addtime; 4459 } 4460 } 4461 if (assoc->ipsa_softaddlt != 0) { 4462 assoc->ipsa_softexpiretime = 4463 assoc->ipsa_addtime + assoc->ipsa_softaddlt; 4464 } 4465 if (assoc->ipsa_softuselt != 0 && 4466 assoc->ipsa_flags & IPSA_F_USED) { 4467 UPDATE_EXPIRE(assoc, softuselt, softexpiretime); 4468 } 4469 if (outbound && assoc->ipsa_softexpiretime != 0) { 4470 if (assoc->ipsa_state == IPSA_STATE_MATURE) 4471 lifetime_fuzz(assoc); 4472 } 4473 4474 if (soft->sadb_lifetime_allocations != 0) 4475 assoc->ipsa_softalloc = soft->sadb_lifetime_allocations; 4476 } 4477 4478 if (idle != NULL) { 4479 time_t current = gethrestime_sec(); 4480 if ((assoc->ipsa_idleexpiretime <= current) && 4481 (assoc->ipsa_idleaddlt == idle->sadb_lifetime_addtime)) { 4482 assoc->ipsa_idleexpiretime = 4483 current + assoc->ipsa_idleaddlt; 4484 } 4485 if (idle->sadb_lifetime_addtime != 0) 4486 assoc->ipsa_idleaddlt = idle->sadb_lifetime_addtime; 4487 if (idle->sadb_lifetime_usetime != 0) 4488 assoc->ipsa_idleuselt = idle->sadb_lifetime_usetime; 4489 if (assoc->ipsa_idleaddlt != 0) { 4490 assoc->ipsa_idleexpiretime = 4491 current + idle->sadb_lifetime_addtime; 4492 assoc->ipsa_idletime = idle->sadb_lifetime_addtime; 4493 } 4494 if (assoc->ipsa_idleuselt != 0) { 4495 if (assoc->ipsa_idletime != 0) { 4496 assoc->ipsa_idletime = min(assoc->ipsa_idletime, 4497 assoc->ipsa_idleuselt); 4498 assoc->ipsa_idleexpiretime = 4499 current + assoc->ipsa_idletime; 4500 } else { 4501 assoc->ipsa_idleexpiretime = 4502 current + assoc->ipsa_idleuselt; 4503 assoc->ipsa_idletime = assoc->ipsa_idleuselt; 4504 } 4505 } 4506 } 4507 mutex_exit(&assoc->ipsa_lock); 4508 } 4509 4510 static int 4511 sadb_update_state(ipsa_t *assoc, uint_t new_state, mblk_t **ipkt_lst) 4512 { 4513 int rcode = 0; 4514 time_t current = gethrestime_sec(); 4515 4516 mutex_enter(&assoc->ipsa_lock); 4517 4518 switch (new_state) { 4519 case SADB_X_SASTATE_ACTIVE_ELSEWHERE: 4520 if (assoc->ipsa_state == SADB_X_SASTATE_IDLE) { 4521 assoc->ipsa_state = IPSA_STATE_ACTIVE_ELSEWHERE; 4522 assoc->ipsa_idleexpiretime = 4523 current + assoc->ipsa_idletime; 4524 } 4525 break; 4526 case SADB_X_SASTATE_IDLE: 4527 if (assoc->ipsa_state == SADB_X_SASTATE_ACTIVE_ELSEWHERE) { 4528 assoc->ipsa_state = IPSA_STATE_IDLE; 4529 assoc->ipsa_idleexpiretime = 4530 current + assoc->ipsa_idletime; 4531 } else { 4532 rcode = EINVAL; 4533 } 4534 break; 4535 4536 case SADB_X_SASTATE_ACTIVE: 4537 if (assoc->ipsa_state != SADB_X_SASTATE_IDLE) { 4538 rcode = EINVAL; 4539 break; 4540 } 4541 assoc->ipsa_state = IPSA_STATE_MATURE; 4542 assoc->ipsa_idleexpiretime = current + assoc->ipsa_idletime; 4543 4544 if (ipkt_lst == NULL) { 4545 break; 4546 } 4547 4548 if (assoc->ipsa_bpkt_head != NULL) { 4549 *ipkt_lst = assoc->ipsa_bpkt_head; 4550 assoc->ipsa_bpkt_head = assoc->ipsa_bpkt_tail = NULL; 4551 assoc->ipsa_mblkcnt = 0; 4552 } else { 4553 *ipkt_lst = NULL; 4554 } 4555 break; 4556 default: 4557 rcode = EINVAL; 4558 break; 4559 } 4560 4561 mutex_exit(&assoc->ipsa_lock); 4562 return (rcode); 4563 } 4564 4565 /* 4566 * Common code to update an SA. 4567 */ 4568 4569 int 4570 sadb_update_sa(mblk_t *mp, keysock_in_t *ksi, mblk_t **ipkt_lst, 4571 sadbp_t *spp, int *diagnostic, queue_t *pfkey_q, 4572 int (*add_sa_func)(mblk_t *, keysock_in_t *, int *, netstack_t *), 4573 netstack_t *ns, uint8_t sadb_msg_type) 4574 { 4575 sadb_sa_t *assoc = (sadb_sa_t *)ksi->ks_in_extv[SADB_EXT_SA]; 4576 sadb_address_t *srcext = 4577 (sadb_address_t *)ksi->ks_in_extv[SADB_EXT_ADDRESS_SRC]; 4578 sadb_address_t *dstext = 4579 (sadb_address_t *)ksi->ks_in_extv[SADB_EXT_ADDRESS_DST]; 4580 sadb_x_kmc_t *kmcext = 4581 (sadb_x_kmc_t *)ksi->ks_in_extv[SADB_X_EXT_KM_COOKIE]; 4582 sadb_key_t *akey = (sadb_key_t *)ksi->ks_in_extv[SADB_EXT_KEY_AUTH]; 4583 sadb_key_t *ekey = (sadb_key_t *)ksi->ks_in_extv[SADB_EXT_KEY_ENCRYPT]; 4584 sadb_x_replay_ctr_t *replext = 4585 (sadb_x_replay_ctr_t *)ksi->ks_in_extv[SADB_X_EXT_REPLAY_VALUE]; 4586 sadb_lifetime_t *soft = 4587 (sadb_lifetime_t *)ksi->ks_in_extv[SADB_EXT_LIFETIME_SOFT]; 4588 sadb_lifetime_t *hard = 4589 (sadb_lifetime_t *)ksi->ks_in_extv[SADB_EXT_LIFETIME_HARD]; 4590 sadb_lifetime_t *idle = 4591 (sadb_lifetime_t *)ksi->ks_in_extv[SADB_X_EXT_LIFETIME_IDLE]; 4592 sadb_x_pair_t *pair_ext = 4593 (sadb_x_pair_t *)ksi->ks_in_extv[SADB_X_EXT_PAIR]; 4594 ipsa_t *echo_target = NULL; 4595 int error = 0; 4596 ipsap_t *ipsapp = NULL; 4597 uint32_t kmp = 0, kmc = 0; 4598 time_t current = gethrestime_sec(); 4599 4600 4601 /* I need certain extensions present for either UPDATE message. */ 4602 if (srcext == NULL) { 4603 *diagnostic = SADB_X_DIAGNOSTIC_MISSING_SRC; 4604 return (EINVAL); 4605 } 4606 if (dstext == NULL) { 4607 *diagnostic = SADB_X_DIAGNOSTIC_MISSING_DST; 4608 return (EINVAL); 4609 } 4610 if (assoc == NULL) { 4611 *diagnostic = SADB_X_DIAGNOSTIC_MISSING_SA; 4612 return (EINVAL); 4613 } 4614 4615 if (kmcext != NULL) { 4616 kmp = kmcext->sadb_x_kmc_proto; 4617 kmc = kmcext->sadb_x_kmc_cookie; 4618 } 4619 4620 ipsapp = get_ipsa_pair(assoc, srcext, dstext, spp); 4621 if (ipsapp == NULL) { 4622 *diagnostic = SADB_X_DIAGNOSTIC_SA_NOTFOUND; 4623 return (ESRCH); 4624 } 4625 4626 if (ipsapp->ipsap_psa_ptr == NULL && ipsapp->ipsap_sa_ptr != NULL) { 4627 if (ipsapp->ipsap_sa_ptr->ipsa_state == IPSA_STATE_LARVAL) { 4628 /* 4629 * REFRELE the target and let the add_sa_func() 4630 * deal with updating a larval SA. 4631 */ 4632 destroy_ipsa_pair(ipsapp); 4633 return (add_sa_func(mp, ksi, diagnostic, ns)); 4634 } 4635 } 4636 4637 if (assoc->sadb_sa_state == SADB_X_SASTATE_ACTIVE_ELSEWHERE) { 4638 if (ipsapp->ipsap_sa_ptr != NULL && 4639 ipsapp->ipsap_sa_ptr->ipsa_state == IPSA_STATE_IDLE) { 4640 if ((error = sadb_update_state(ipsapp->ipsap_sa_ptr, 4641 assoc->sadb_sa_state, NULL)) != 0) { 4642 *diagnostic = SADB_X_DIAGNOSTIC_BAD_SASTATE; 4643 goto bail; 4644 } 4645 } 4646 if (ipsapp->ipsap_psa_ptr != NULL && 4647 ipsapp->ipsap_psa_ptr->ipsa_state == IPSA_STATE_IDLE) { 4648 if ((error = sadb_update_state(ipsapp->ipsap_psa_ptr, 4649 assoc->sadb_sa_state, NULL)) != 0) { 4650 *diagnostic = SADB_X_DIAGNOSTIC_BAD_SASTATE; 4651 goto bail; 4652 } 4653 } 4654 } 4655 if (assoc->sadb_sa_state == SADB_X_SASTATE_ACTIVE) { 4656 if (ipsapp->ipsap_sa_ptr != NULL) { 4657 error = sadb_update_state(ipsapp->ipsap_sa_ptr, 4658 assoc->sadb_sa_state, 4659 (ipsapp->ipsap_sa_ptr->ipsa_flags & 4660 IPSA_F_INBOUND) ? ipkt_lst : NULL); 4661 if (error) { 4662 *diagnostic = SADB_X_DIAGNOSTIC_BAD_SASTATE; 4663 goto bail; 4664 } 4665 } 4666 if (ipsapp->ipsap_psa_ptr != NULL) { 4667 error = sadb_update_state(ipsapp->ipsap_psa_ptr, 4668 assoc->sadb_sa_state, 4669 (ipsapp->ipsap_psa_ptr->ipsa_flags & 4670 IPSA_F_INBOUND) ? ipkt_lst : NULL); 4671 if (error) { 4672 *diagnostic = SADB_X_DIAGNOSTIC_BAD_SASTATE; 4673 goto bail; 4674 } 4675 } 4676 sadb_pfkey_echo(pfkey_q, mp, (sadb_msg_t *)mp->b_cont->b_rptr, 4677 ksi, echo_target); 4678 goto bail; 4679 } 4680 4681 /* 4682 * Reality checks for updates of active associations. 4683 * Sundry first-pass UPDATE-specific reality checks. 4684 * Have to do the checks here, because it's after the add_sa code. 4685 * XXX STATS : logging/stats here? 4686 */ 4687 4688 if (!((assoc->sadb_sa_state == SADB_SASTATE_MATURE) || 4689 (assoc->sadb_sa_state == SADB_X_SASTATE_ACTIVE_ELSEWHERE))) { 4690 *diagnostic = SADB_X_DIAGNOSTIC_BAD_SASTATE; 4691 error = EINVAL; 4692 goto bail; 4693 } 4694 4695 if (assoc->sadb_sa_flags & ~spp->s_updateflags) { 4696 *diagnostic = SADB_X_DIAGNOSTIC_BAD_SAFLAGS; 4697 error = EINVAL; 4698 goto bail; 4699 } 4700 4701 if (ksi->ks_in_extv[SADB_EXT_LIFETIME_CURRENT] != NULL) { 4702 error = EOPNOTSUPP; 4703 goto bail; 4704 } 4705 4706 if ((*diagnostic = sadb_hardsoftchk(hard, soft, idle)) != 0) { 4707 error = EINVAL; 4708 goto bail; 4709 } 4710 if (akey != NULL) { 4711 *diagnostic = SADB_X_DIAGNOSTIC_AKEY_PRESENT; 4712 error = EINVAL; 4713 goto bail; 4714 } 4715 if (ekey != NULL) { 4716 *diagnostic = SADB_X_DIAGNOSTIC_EKEY_PRESENT; 4717 error = EINVAL; 4718 goto bail; 4719 } 4720 4721 if (ipsapp->ipsap_sa_ptr != NULL) { 4722 if (ipsapp->ipsap_sa_ptr->ipsa_state == IPSA_STATE_DEAD) { 4723 error = ESRCH; /* DEAD == Not there, in this case. */ 4724 *diagnostic = SADB_X_DIAGNOSTIC_SA_EXPIRED; 4725 goto bail; 4726 } 4727 if ((kmp != 0) && 4728 ((ipsapp->ipsap_sa_ptr->ipsa_kmp != 0) || 4729 (ipsapp->ipsap_sa_ptr->ipsa_kmp != kmp))) { 4730 *diagnostic = SADB_X_DIAGNOSTIC_DUPLICATE_KMP; 4731 error = EINVAL; 4732 goto bail; 4733 } 4734 if ((kmc != 0) && 4735 ((ipsapp->ipsap_sa_ptr->ipsa_kmc != 0) || 4736 (ipsapp->ipsap_sa_ptr->ipsa_kmc != kmc))) { 4737 *diagnostic = SADB_X_DIAGNOSTIC_DUPLICATE_KMC; 4738 error = EINVAL; 4739 goto bail; 4740 } 4741 /* 4742 * Do not allow replay value change for MATURE or LARVAL SA. 4743 */ 4744 4745 if ((replext != NULL) && 4746 ((ipsapp->ipsap_sa_ptr->ipsa_state == IPSA_STATE_LARVAL) || 4747 (ipsapp->ipsap_sa_ptr->ipsa_state == IPSA_STATE_MATURE))) { 4748 *diagnostic = SADB_X_DIAGNOSTIC_BAD_SASTATE; 4749 error = EINVAL; 4750 goto bail; 4751 } 4752 } 4753 4754 if (ipsapp->ipsap_psa_ptr != NULL) { 4755 if (ipsapp->ipsap_psa_ptr->ipsa_state == IPSA_STATE_DEAD) { 4756 *diagnostic = SADB_X_DIAGNOSTIC_SA_EXPIRED; 4757 error = ESRCH; /* DEAD == Not there, in this case. */ 4758 goto bail; 4759 } 4760 if ((kmp != 0) && 4761 ((ipsapp->ipsap_psa_ptr->ipsa_kmp != 0) || 4762 (ipsapp->ipsap_psa_ptr->ipsa_kmp != kmp))) { 4763 *diagnostic = SADB_X_DIAGNOSTIC_DUPLICATE_KMP; 4764 error = EINVAL; 4765 goto bail; 4766 } 4767 if ((kmc != 0) && 4768 ((ipsapp->ipsap_psa_ptr->ipsa_kmc != 0) || 4769 (ipsapp->ipsap_psa_ptr->ipsa_kmc != kmc))) { 4770 *diagnostic = SADB_X_DIAGNOSTIC_DUPLICATE_KMC; 4771 error = EINVAL; 4772 goto bail; 4773 } 4774 } 4775 4776 if (ipsapp->ipsap_sa_ptr != NULL) { 4777 sadb_update_lifetimes(ipsapp->ipsap_sa_ptr, hard, soft, 4778 idle, B_TRUE); 4779 if (kmp != 0) 4780 ipsapp->ipsap_sa_ptr->ipsa_kmp = kmp; 4781 if (kmc != 0) 4782 ipsapp->ipsap_sa_ptr->ipsa_kmc = kmc; 4783 if ((replext != NULL) && 4784 (ipsapp->ipsap_sa_ptr->ipsa_replay_wsize != 0)) { 4785 /* 4786 * If an inbound SA, update the replay counter 4787 * and check off all the other sequence number 4788 */ 4789 if (ksi->ks_in_dsttype == KS_IN_ADDR_ME) { 4790 if (!sadb_replay_check(ipsapp->ipsap_sa_ptr, 4791 replext->sadb_x_rc_replay32)) { 4792 error = EINVAL; 4793 goto bail; 4794 } 4795 mutex_enter(&ipsapp->ipsap_sa_ptr->ipsa_lock); 4796 ipsapp->ipsap_sa_ptr->ipsa_idleexpiretime = 4797 current + 4798 ipsapp->ipsap_sa_ptr->ipsa_idletime; 4799 mutex_exit(&ipsapp->ipsap_sa_ptr->ipsa_lock); 4800 } else { 4801 mutex_enter(&ipsapp->ipsap_sa_ptr->ipsa_lock); 4802 ipsapp->ipsap_sa_ptr->ipsa_replay = 4803 replext->sadb_x_rc_replay32; 4804 ipsapp->ipsap_sa_ptr->ipsa_idleexpiretime = 4805 current + 4806 ipsapp->ipsap_sa_ptr->ipsa_idletime; 4807 mutex_exit(&ipsapp->ipsap_sa_ptr->ipsa_lock); 4808 } 4809 } 4810 } 4811 4812 if (sadb_msg_type == SADB_X_UPDATEPAIR) { 4813 if (ipsapp->ipsap_psa_ptr != NULL) { 4814 sadb_update_lifetimes(ipsapp->ipsap_psa_ptr, hard, soft, 4815 idle, B_FALSE); 4816 if (kmp != 0) 4817 ipsapp->ipsap_psa_ptr->ipsa_kmp = kmp; 4818 if (kmc != 0) 4819 ipsapp->ipsap_psa_ptr->ipsa_kmc = kmc; 4820 } else { 4821 *diagnostic = SADB_X_DIAGNOSTIC_PAIR_SA_NOTFOUND; 4822 error = ESRCH; 4823 goto bail; 4824 } 4825 } 4826 4827 if (pair_ext != NULL) 4828 error = update_pairing(ipsapp, ksi, diagnostic, spp); 4829 4830 if (error == 0) 4831 sadb_pfkey_echo(pfkey_q, mp, (sadb_msg_t *)mp->b_cont->b_rptr, 4832 ksi, echo_target); 4833 bail: 4834 4835 destroy_ipsa_pair(ipsapp); 4836 4837 return (error); 4838 } 4839 4840 4841 int 4842 update_pairing(ipsap_t *ipsapp, keysock_in_t *ksi, int *diagnostic, 4843 sadbp_t *spp) 4844 { 4845 sadb_sa_t *assoc = (sadb_sa_t *)ksi->ks_in_extv[SADB_EXT_SA]; 4846 sadb_address_t *srcext = 4847 (sadb_address_t *)ksi->ks_in_extv[SADB_EXT_ADDRESS_SRC]; 4848 sadb_address_t *dstext = 4849 (sadb_address_t *)ksi->ks_in_extv[SADB_EXT_ADDRESS_DST]; 4850 sadb_x_pair_t *pair_ext = 4851 (sadb_x_pair_t *)ksi->ks_in_extv[SADB_X_EXT_PAIR]; 4852 int error = 0; 4853 ipsap_t *oipsapp = NULL; 4854 boolean_t undo_pair = B_FALSE; 4855 uint32_t ipsa_flags; 4856 4857 if (pair_ext->sadb_x_pair_spi == 0 || pair_ext->sadb_x_pair_spi == 4858 assoc->sadb_sa_spi) { 4859 *diagnostic = SADB_X_DIAGNOSTIC_PAIR_INAPPROPRIATE; 4860 return (EINVAL); 4861 } 4862 4863 /* 4864 * Assume for now that the spi value provided in the SADB_UPDATE 4865 * message was valid, update the SA with its pair spi value. 4866 * If the spi turns out to be bogus or the SA no longer exists 4867 * then this will be detected when the reverse update is made 4868 * below. 4869 */ 4870 mutex_enter(&ipsapp->ipsap_sa_ptr->ipsa_lock); 4871 ipsapp->ipsap_sa_ptr->ipsa_flags |= IPSA_F_PAIRED; 4872 ipsapp->ipsap_sa_ptr->ipsa_otherspi = pair_ext->sadb_x_pair_spi; 4873 mutex_exit(&ipsapp->ipsap_sa_ptr->ipsa_lock); 4874 4875 /* 4876 * After updating the ipsa_otherspi element of the SA, get_ipsa_pair() 4877 * should now return pointers to the SA *AND* its pair, if this is not 4878 * the case, the "otherspi" either did not exist or was deleted. Also 4879 * check that "otherspi" is not already paired. If everything looks 4880 * good, complete the update. IPSA_REFRELE the first pair_pointer 4881 * after this update to ensure its not deleted until we are done. 4882 */ 4883 oipsapp = get_ipsa_pair(assoc, srcext, dstext, spp); 4884 if (oipsapp == NULL) { 4885 /* 4886 * This should never happen, calling function still has 4887 * IPSA_REFHELD on the SA we just updated. 4888 */ 4889 *diagnostic = SADB_X_DIAGNOSTIC_PAIR_SA_NOTFOUND; 4890 return (EINVAL); 4891 } 4892 4893 if (oipsapp->ipsap_psa_ptr == NULL) { 4894 *diagnostic = SADB_X_DIAGNOSTIC_PAIR_INAPPROPRIATE; 4895 undo_pair = B_TRUE; 4896 } else { 4897 ipsa_flags = oipsapp->ipsap_psa_ptr->ipsa_flags; 4898 if ((oipsapp->ipsap_psa_ptr->ipsa_state == IPSA_STATE_DEAD) || 4899 (oipsapp->ipsap_psa_ptr->ipsa_state == IPSA_STATE_DYING)) { 4900 /* Its dead Jim! */ 4901 *diagnostic = SADB_X_DIAGNOSTIC_PAIR_INAPPROPRIATE; 4902 undo_pair = B_TRUE; 4903 } else if ((ipsa_flags & (IPSA_F_OUTBOUND | IPSA_F_INBOUND)) == 4904 (IPSA_F_OUTBOUND | IPSA_F_INBOUND)) { 4905 /* This SA is in both hashtables. */ 4906 *diagnostic = SADB_X_DIAGNOSTIC_PAIR_INAPPROPRIATE; 4907 undo_pair = B_TRUE; 4908 } else if (ipsa_flags & IPSA_F_PAIRED) { 4909 /* This SA is already paired with another. */ 4910 *diagnostic = SADB_X_DIAGNOSTIC_PAIR_ALREADY; 4911 undo_pair = B_TRUE; 4912 } 4913 } 4914 4915 if (undo_pair) { 4916 /* The pair SA does not exist. */ 4917 mutex_enter(&ipsapp->ipsap_sa_ptr->ipsa_lock); 4918 ipsapp->ipsap_sa_ptr->ipsa_flags &= ~IPSA_F_PAIRED; 4919 ipsapp->ipsap_sa_ptr->ipsa_otherspi = 0; 4920 mutex_exit(&ipsapp->ipsap_sa_ptr->ipsa_lock); 4921 error = EINVAL; 4922 } else { 4923 mutex_enter(&oipsapp->ipsap_psa_ptr->ipsa_lock); 4924 oipsapp->ipsap_psa_ptr->ipsa_otherspi = assoc->sadb_sa_spi; 4925 oipsapp->ipsap_psa_ptr->ipsa_flags |= IPSA_F_PAIRED; 4926 mutex_exit(&oipsapp->ipsap_psa_ptr->ipsa_lock); 4927 } 4928 4929 destroy_ipsa_pair(oipsapp); 4930 return (error); 4931 } 4932 4933 /* 4934 * The following functions deal with ACQUIRE LISTS. An ACQUIRE list is 4935 * a list of outstanding SADB_ACQUIRE messages. If ipsec_getassocbyconn() fails 4936 * for an outbound datagram, that datagram is queued up on an ACQUIRE record, 4937 * and an SADB_ACQUIRE message is sent up. Presumably, a user-space key 4938 * management daemon will process the ACQUIRE, use a SADB_GETSPI to reserve 4939 * an SPI value and a larval SA, then SADB_UPDATE the larval SA, and ADD the 4940 * other direction's SA. 4941 */ 4942 4943 /* 4944 * Check the ACQUIRE lists. If there's an existing ACQUIRE record, 4945 * grab it, lock it, and return it. Otherwise return NULL. 4946 */ 4947 static ipsacq_t * 4948 sadb_checkacquire(iacqf_t *bucket, ipsec_action_t *ap, ipsec_policy_t *pp, 4949 uint32_t *src, uint32_t *dst, uint32_t *isrc, uint32_t *idst, 4950 uint64_t unique_id) 4951 { 4952 ipsacq_t *walker; 4953 sa_family_t fam; 4954 uint32_t blank_address[4] = {0, 0, 0, 0}; 4955 4956 if (isrc == NULL) { 4957 ASSERT(idst == NULL); 4958 isrc = idst = blank_address; 4959 } 4960 4961 /* 4962 * Scan list for duplicates. Check for UNIQUE, src/dest, policy. 4963 * 4964 * XXX May need search for duplicates based on other things too! 4965 */ 4966 for (walker = bucket->iacqf_ipsacq; walker != NULL; 4967 walker = walker->ipsacq_next) { 4968 mutex_enter(&walker->ipsacq_lock); 4969 fam = walker->ipsacq_addrfam; 4970 if (IPSA_ARE_ADDR_EQUAL(dst, walker->ipsacq_dstaddr, fam) && 4971 IPSA_ARE_ADDR_EQUAL(src, walker->ipsacq_srcaddr, fam) && 4972 ip_addr_match((uint8_t *)isrc, walker->ipsacq_innersrcpfx, 4973 (in6_addr_t *)walker->ipsacq_innersrc) && 4974 ip_addr_match((uint8_t *)idst, walker->ipsacq_innerdstpfx, 4975 (in6_addr_t *)walker->ipsacq_innerdst) && 4976 (ap == walker->ipsacq_act) && 4977 (pp == walker->ipsacq_policy) && 4978 /* XXX do deep compares of ap/pp? */ 4979 (unique_id == walker->ipsacq_unique_id)) 4980 break; /* everything matched */ 4981 mutex_exit(&walker->ipsacq_lock); 4982 } 4983 4984 return (walker); 4985 } 4986 4987 /* 4988 * For this mblk, insert a new acquire record. Assume bucket contains addrs 4989 * of all of the same length. Give up (and drop) if memory 4990 * cannot be allocated for a new one; otherwise, invoke callback to 4991 * send the acquire up.. 4992 * 4993 * In cases where we need both AH and ESP, add the SA to the ESP ACQUIRE 4994 * list. The ah_add_sa_finish() routines can look at the packet's ipsec_out_t 4995 * and handle this case specially. 4996 */ 4997 void 4998 sadb_acquire(mblk_t *mp, ipsec_out_t *io, boolean_t need_ah, boolean_t need_esp) 4999 { 5000 sadbp_t *spp; 5001 sadb_t *sp; 5002 ipsacq_t *newbie; 5003 iacqf_t *bucket; 5004 mblk_t *datamp = mp->b_cont; 5005 mblk_t *extended; 5006 ipha_t *ipha = (ipha_t *)datamp->b_rptr; 5007 ip6_t *ip6h = (ip6_t *)datamp->b_rptr; 5008 uint32_t *src, *dst, *isrc, *idst; 5009 ipsec_policy_t *pp = io->ipsec_out_policy; 5010 ipsec_action_t *ap = io->ipsec_out_act; 5011 sa_family_t af; 5012 int hashoffset; 5013 uint32_t seq; 5014 uint64_t unique_id = 0; 5015 ipsec_selector_t sel; 5016 boolean_t tunnel_mode = io->ipsec_out_tunnel; 5017 netstack_t *ns = io->ipsec_out_ns; 5018 ipsec_stack_t *ipss = ns->netstack_ipsec; 5019 5020 ASSERT((pp != NULL) || (ap != NULL)); 5021 5022 ASSERT(need_ah != NULL || need_esp != NULL); 5023 /* Assign sadb pointers */ 5024 if (need_esp) { /* ESP for AH+ESP */ 5025 ipsecesp_stack_t *espstack = ns->netstack_ipsecesp; 5026 5027 spp = &espstack->esp_sadb; 5028 } else { 5029 ipsecah_stack_t *ahstack = ns->netstack_ipsecah; 5030 5031 spp = &ahstack->ah_sadb; 5032 } 5033 sp = io->ipsec_out_v4 ? &spp->s_v4 : &spp->s_v6; 5034 5035 if (ap == NULL) 5036 ap = pp->ipsp_act; 5037 5038 ASSERT(ap != NULL); 5039 5040 if (ap->ipa_act.ipa_apply.ipp_use_unique || tunnel_mode) 5041 unique_id = SA_FORM_UNIQUE_ID(io); 5042 5043 /* 5044 * Set up an ACQUIRE record. 5045 * 5046 * Immediately, make sure the ACQUIRE sequence number doesn't slip 5047 * below the lowest point allowed in the kernel. (In other words, 5048 * make sure the high bit on the sequence number is set.) 5049 */ 5050 5051 seq = keysock_next_seq(ns) | IACQF_LOWEST_SEQ; 5052 5053 if (IPH_HDR_VERSION(ipha) == IP_VERSION) { 5054 src = (uint32_t *)&ipha->ipha_src; 5055 dst = (uint32_t *)&ipha->ipha_dst; 5056 af = AF_INET; 5057 hashoffset = OUTBOUND_HASH_V4(sp, ipha->ipha_dst); 5058 ASSERT(io->ipsec_out_v4 == B_TRUE); 5059 } else { 5060 ASSERT(IPH_HDR_VERSION(ipha) == IPV6_VERSION); 5061 src = (uint32_t *)&ip6h->ip6_src; 5062 dst = (uint32_t *)&ip6h->ip6_dst; 5063 af = AF_INET6; 5064 hashoffset = OUTBOUND_HASH_V6(sp, ip6h->ip6_dst); 5065 ASSERT(io->ipsec_out_v4 == B_FALSE); 5066 } 5067 5068 if (tunnel_mode) { 5069 if (pp == NULL) { 5070 /* 5071 * Tunnel mode with no policy pointer means this is a 5072 * reflected ICMP (like a ECHO REQUEST) that came in 5073 * with self-encapsulated protection. Until we better 5074 * support this, drop the packet. 5075 */ 5076 ip_drop_packet(mp, B_FALSE, NULL, NULL, 5077 DROPPER(ipss, ipds_spd_got_selfencap), 5078 &ipss->ipsec_spd_dropper); 5079 return; 5080 } 5081 /* Snag inner addresses. */ 5082 isrc = io->ipsec_out_insrc; 5083 idst = io->ipsec_out_indst; 5084 } else { 5085 isrc = idst = NULL; 5086 } 5087 5088 /* 5089 * Check buckets to see if there is an existing entry. If so, 5090 * grab it. sadb_checkacquire locks newbie if found. 5091 */ 5092 bucket = &(sp->sdb_acq[hashoffset]); 5093 mutex_enter(&bucket->iacqf_lock); 5094 newbie = sadb_checkacquire(bucket, ap, pp, src, dst, isrc, idst, 5095 unique_id); 5096 5097 if (newbie == NULL) { 5098 /* 5099 * Otherwise, allocate a new one. 5100 */ 5101 newbie = kmem_zalloc(sizeof (*newbie), KM_NOSLEEP); 5102 if (newbie == NULL) { 5103 mutex_exit(&bucket->iacqf_lock); 5104 ip_drop_packet(mp, B_FALSE, NULL, NULL, 5105 DROPPER(ipss, ipds_sadb_acquire_nomem), 5106 &ipss->ipsec_sadb_dropper); 5107 return; 5108 } 5109 newbie->ipsacq_policy = pp; 5110 if (pp != NULL) { 5111 IPPOL_REFHOLD(pp); 5112 } 5113 IPACT_REFHOLD(ap); 5114 newbie->ipsacq_act = ap; 5115 newbie->ipsacq_linklock = &bucket->iacqf_lock; 5116 newbie->ipsacq_next = bucket->iacqf_ipsacq; 5117 newbie->ipsacq_ptpn = &bucket->iacqf_ipsacq; 5118 if (newbie->ipsacq_next != NULL) 5119 newbie->ipsacq_next->ipsacq_ptpn = &newbie->ipsacq_next; 5120 bucket->iacqf_ipsacq = newbie; 5121 mutex_init(&newbie->ipsacq_lock, NULL, MUTEX_DEFAULT, NULL); 5122 mutex_enter(&newbie->ipsacq_lock); 5123 } 5124 5125 mutex_exit(&bucket->iacqf_lock); 5126 5127 /* 5128 * This assert looks silly for now, but we may need to enter newbie's 5129 * mutex during a search. 5130 */ 5131 ASSERT(MUTEX_HELD(&newbie->ipsacq_lock)); 5132 5133 mp->b_next = NULL; 5134 /* Queue up packet. Use b_next. */ 5135 if (newbie->ipsacq_numpackets == 0) { 5136 /* First one. */ 5137 newbie->ipsacq_mp = mp; 5138 newbie->ipsacq_numpackets = 1; 5139 newbie->ipsacq_expire = gethrestime_sec(); 5140 /* 5141 * Extended ACQUIRE with both AH+ESP will use ESP's timeout 5142 * value. 5143 */ 5144 newbie->ipsacq_expire += *spp->s_acquire_timeout; 5145 newbie->ipsacq_seq = seq; 5146 newbie->ipsacq_addrfam = af; 5147 5148 newbie->ipsacq_srcport = io->ipsec_out_src_port; 5149 newbie->ipsacq_dstport = io->ipsec_out_dst_port; 5150 newbie->ipsacq_icmp_type = io->ipsec_out_icmp_type; 5151 newbie->ipsacq_icmp_code = io->ipsec_out_icmp_code; 5152 if (tunnel_mode) { 5153 newbie->ipsacq_inneraddrfam = io->ipsec_out_inaf; 5154 newbie->ipsacq_proto = io->ipsec_out_inaf == AF_INET6 ? 5155 IPPROTO_IPV6 : IPPROTO_ENCAP; 5156 newbie->ipsacq_innersrcpfx = io->ipsec_out_insrcpfx; 5157 newbie->ipsacq_innerdstpfx = io->ipsec_out_indstpfx; 5158 IPSA_COPY_ADDR(newbie->ipsacq_innersrc, 5159 io->ipsec_out_insrc, io->ipsec_out_inaf); 5160 IPSA_COPY_ADDR(newbie->ipsacq_innerdst, 5161 io->ipsec_out_indst, io->ipsec_out_inaf); 5162 } else { 5163 newbie->ipsacq_proto = io->ipsec_out_proto; 5164 } 5165 newbie->ipsacq_unique_id = unique_id; 5166 } else { 5167 /* Scan to the end of the list & insert. */ 5168 mblk_t *lastone = newbie->ipsacq_mp; 5169 5170 while (lastone->b_next != NULL) 5171 lastone = lastone->b_next; 5172 lastone->b_next = mp; 5173 if (newbie->ipsacq_numpackets++ == ipsacq_maxpackets) { 5174 newbie->ipsacq_numpackets = ipsacq_maxpackets; 5175 lastone = newbie->ipsacq_mp; 5176 newbie->ipsacq_mp = lastone->b_next; 5177 lastone->b_next = NULL; 5178 ip_drop_packet(lastone, B_FALSE, NULL, NULL, 5179 DROPPER(ipss, ipds_sadb_acquire_toofull), 5180 &ipss->ipsec_sadb_dropper); 5181 } else { 5182 IP_ACQUIRE_STAT(ipss, qhiwater, 5183 newbie->ipsacq_numpackets); 5184 } 5185 } 5186 5187 /* 5188 * Reset addresses. Set them to the most recently added mblk chain, 5189 * so that the address pointers in the acquire record will point 5190 * at an mblk still attached to the acquire list. 5191 */ 5192 5193 newbie->ipsacq_srcaddr = src; 5194 newbie->ipsacq_dstaddr = dst; 5195 5196 /* 5197 * If the acquire record has more than one queued packet, we've 5198 * already sent an ACQUIRE, and don't need to repeat ourself. 5199 */ 5200 if (newbie->ipsacq_seq != seq || newbie->ipsacq_numpackets > 1) { 5201 /* I have an acquire outstanding already! */ 5202 mutex_exit(&newbie->ipsacq_lock); 5203 return; 5204 } 5205 5206 if (keysock_extended_reg(ns)) { 5207 /* 5208 * Construct an extended ACQUIRE. There are logging 5209 * opportunities here in failure cases. 5210 */ 5211 5212 (void) memset(&sel, 0, sizeof (sel)); 5213 sel.ips_isv4 = io->ipsec_out_v4; 5214 if (tunnel_mode) { 5215 sel.ips_protocol = (io->ipsec_out_inaf == AF_INET) ? 5216 IPPROTO_ENCAP : IPPROTO_IPV6; 5217 } else { 5218 sel.ips_protocol = io->ipsec_out_proto; 5219 sel.ips_local_port = io->ipsec_out_src_port; 5220 sel.ips_remote_port = io->ipsec_out_dst_port; 5221 } 5222 sel.ips_icmp_type = io->ipsec_out_icmp_type; 5223 sel.ips_icmp_code = io->ipsec_out_icmp_code; 5224 sel.ips_is_icmp_inv_acq = 0; 5225 if (af == AF_INET) { 5226 sel.ips_local_addr_v4 = ipha->ipha_src; 5227 sel.ips_remote_addr_v4 = ipha->ipha_dst; 5228 } else { 5229 sel.ips_local_addr_v6 = ip6h->ip6_src; 5230 sel.ips_remote_addr_v6 = ip6h->ip6_dst; 5231 } 5232 5233 extended = sadb_keysock_out(0); 5234 if (extended != NULL) { 5235 extended->b_cont = sadb_extended_acquire(&sel, pp, ap, 5236 tunnel_mode, seq, 0, ns); 5237 if (extended->b_cont == NULL) { 5238 freeb(extended); 5239 extended = NULL; 5240 } 5241 } 5242 } else 5243 extended = NULL; 5244 5245 /* 5246 * Send an ACQUIRE message (and possible an extended ACQUIRE) based on 5247 * this new record. The send-acquire callback assumes that acqrec is 5248 * already locked. 5249 */ 5250 (*spp->s_acqfn)(newbie, extended, ns); 5251 } 5252 5253 /* 5254 * Unlink and free an acquire record. 5255 */ 5256 void 5257 sadb_destroy_acquire(ipsacq_t *acqrec, netstack_t *ns) 5258 { 5259 mblk_t *mp; 5260 ipsec_stack_t *ipss = ns->netstack_ipsec; 5261 5262 ASSERT(MUTEX_HELD(acqrec->ipsacq_linklock)); 5263 5264 if (acqrec->ipsacq_policy != NULL) { 5265 IPPOL_REFRELE(acqrec->ipsacq_policy, ns); 5266 } 5267 if (acqrec->ipsacq_act != NULL) { 5268 IPACT_REFRELE(acqrec->ipsacq_act); 5269 } 5270 5271 /* Unlink */ 5272 *(acqrec->ipsacq_ptpn) = acqrec->ipsacq_next; 5273 if (acqrec->ipsacq_next != NULL) 5274 acqrec->ipsacq_next->ipsacq_ptpn = acqrec->ipsacq_ptpn; 5275 5276 /* 5277 * Free hanging mp's. 5278 * 5279 * XXX Instead of freemsg(), perhaps use IPSEC_REQ_FAILED. 5280 */ 5281 5282 mutex_enter(&acqrec->ipsacq_lock); 5283 while (acqrec->ipsacq_mp != NULL) { 5284 mp = acqrec->ipsacq_mp; 5285 acqrec->ipsacq_mp = mp->b_next; 5286 mp->b_next = NULL; 5287 ip_drop_packet(mp, B_FALSE, NULL, NULL, 5288 DROPPER(ipss, ipds_sadb_acquire_timeout), 5289 &ipss->ipsec_sadb_dropper); 5290 } 5291 mutex_exit(&acqrec->ipsacq_lock); 5292 5293 /* Free */ 5294 mutex_destroy(&acqrec->ipsacq_lock); 5295 kmem_free(acqrec, sizeof (*acqrec)); 5296 } 5297 5298 /* 5299 * Destroy an acquire list fanout. 5300 */ 5301 static void 5302 sadb_destroy_acqlist(iacqf_t **listp, uint_t numentries, boolean_t forever, 5303 netstack_t *ns) 5304 { 5305 int i; 5306 iacqf_t *list = *listp; 5307 5308 if (list == NULL) 5309 return; 5310 5311 for (i = 0; i < numentries; i++) { 5312 mutex_enter(&(list[i].iacqf_lock)); 5313 while (list[i].iacqf_ipsacq != NULL) 5314 sadb_destroy_acquire(list[i].iacqf_ipsacq, ns); 5315 mutex_exit(&(list[i].iacqf_lock)); 5316 if (forever) 5317 mutex_destroy(&(list[i].iacqf_lock)); 5318 } 5319 5320 if (forever) { 5321 *listp = NULL; 5322 kmem_free(list, numentries * sizeof (*list)); 5323 } 5324 } 5325 5326 /* 5327 * Create an algorithm descriptor for an extended ACQUIRE. Filter crypto 5328 * framework's view of reality vs. IPsec's. EF's wins, BTW. 5329 */ 5330 static uint8_t * 5331 sadb_new_algdesc(uint8_t *start, uint8_t *limit, 5332 sadb_x_ecomb_t *ecomb, uint8_t satype, uint8_t algtype, 5333 uint8_t alg, uint16_t minbits, uint16_t maxbits, ipsec_stack_t *ipss) 5334 { 5335 uint8_t *cur = start; 5336 ipsec_alginfo_t *algp; 5337 sadb_x_algdesc_t *algdesc = (sadb_x_algdesc_t *)cur; 5338 5339 cur += sizeof (*algdesc); 5340 if (cur >= limit) 5341 return (NULL); 5342 5343 ecomb->sadb_x_ecomb_numalgs++; 5344 5345 /* 5346 * Normalize vs. crypto framework's limits. This way, you can specify 5347 * a stronger policy, and when the framework loads a stronger version, 5348 * you can just keep plowing w/o rewhacking your SPD. 5349 */ 5350 mutex_enter(&ipss->ipsec_alg_lock); 5351 algp = ipss->ipsec_alglists[(algtype == SADB_X_ALGTYPE_AUTH) ? 5352 IPSEC_ALG_AUTH : IPSEC_ALG_ENCR][alg]; 5353 if (algp == NULL) { 5354 mutex_exit(&ipss->ipsec_alg_lock); 5355 return (NULL); /* Algorithm doesn't exist. Fail gracefully. */ 5356 } 5357 if (minbits < algp->alg_ef_minbits) 5358 minbits = algp->alg_ef_minbits; 5359 if (maxbits > algp->alg_ef_maxbits) 5360 maxbits = algp->alg_ef_maxbits; 5361 mutex_exit(&ipss->ipsec_alg_lock); 5362 5363 algdesc->sadb_x_algdesc_satype = satype; 5364 algdesc->sadb_x_algdesc_algtype = algtype; 5365 algdesc->sadb_x_algdesc_alg = alg; 5366 algdesc->sadb_x_algdesc_minbits = minbits; 5367 algdesc->sadb_x_algdesc_maxbits = maxbits; 5368 algdesc->sadb_x_algdesc_reserved = 0; 5369 return (cur); 5370 } 5371 5372 /* 5373 * Convert the given ipsec_action_t into an ecomb starting at *ecomb 5374 * which must fit before *limit 5375 * 5376 * return NULL if we ran out of room or a pointer to the end of the ecomb. 5377 */ 5378 static uint8_t * 5379 sadb_action_to_ecomb(uint8_t *start, uint8_t *limit, ipsec_action_t *act, 5380 netstack_t *ns) 5381 { 5382 uint8_t *cur = start; 5383 sadb_x_ecomb_t *ecomb = (sadb_x_ecomb_t *)cur; 5384 ipsec_prot_t *ipp; 5385 ipsec_stack_t *ipss = ns->netstack_ipsec; 5386 5387 cur += sizeof (*ecomb); 5388 if (cur >= limit) 5389 return (NULL); 5390 5391 ASSERT(act->ipa_act.ipa_type == IPSEC_ACT_APPLY); 5392 5393 ipp = &act->ipa_act.ipa_apply; 5394 5395 ecomb->sadb_x_ecomb_numalgs = 0; 5396 ecomb->sadb_x_ecomb_reserved = 0; 5397 ecomb->sadb_x_ecomb_reserved2 = 0; 5398 /* 5399 * No limits on allocations, since we really don't support that 5400 * concept currently. 5401 */ 5402 ecomb->sadb_x_ecomb_soft_allocations = 0; 5403 ecomb->sadb_x_ecomb_hard_allocations = 0; 5404 5405 /* 5406 * XXX TBD: Policy or global parameters will eventually be 5407 * able to fill in some of these. 5408 */ 5409 ecomb->sadb_x_ecomb_flags = 0; 5410 ecomb->sadb_x_ecomb_soft_bytes = 0; 5411 ecomb->sadb_x_ecomb_hard_bytes = 0; 5412 ecomb->sadb_x_ecomb_soft_addtime = 0; 5413 ecomb->sadb_x_ecomb_hard_addtime = 0; 5414 ecomb->sadb_x_ecomb_soft_usetime = 0; 5415 ecomb->sadb_x_ecomb_hard_usetime = 0; 5416 5417 if (ipp->ipp_use_ah) { 5418 cur = sadb_new_algdesc(cur, limit, ecomb, 5419 SADB_SATYPE_AH, SADB_X_ALGTYPE_AUTH, ipp->ipp_auth_alg, 5420 ipp->ipp_ah_minbits, ipp->ipp_ah_maxbits, ipss); 5421 if (cur == NULL) 5422 return (NULL); 5423 ipsecah_fill_defs(ecomb, ns); 5424 } 5425 5426 if (ipp->ipp_use_esp) { 5427 if (ipp->ipp_use_espa) { 5428 cur = sadb_new_algdesc(cur, limit, ecomb, 5429 SADB_SATYPE_ESP, SADB_X_ALGTYPE_AUTH, 5430 ipp->ipp_esp_auth_alg, 5431 ipp->ipp_espa_minbits, 5432 ipp->ipp_espa_maxbits, ipss); 5433 if (cur == NULL) 5434 return (NULL); 5435 } 5436 5437 cur = sadb_new_algdesc(cur, limit, ecomb, 5438 SADB_SATYPE_ESP, SADB_X_ALGTYPE_CRYPT, 5439 ipp->ipp_encr_alg, 5440 ipp->ipp_espe_minbits, 5441 ipp->ipp_espe_maxbits, ipss); 5442 if (cur == NULL) 5443 return (NULL); 5444 /* Fill in lifetimes if and only if AH didn't already... */ 5445 if (!ipp->ipp_use_ah) 5446 ipsecesp_fill_defs(ecomb, ns); 5447 } 5448 5449 return (cur); 5450 } 5451 5452 /* 5453 * Construct an extended ACQUIRE message based on a selector and the resulting 5454 * IPsec action. 5455 * 5456 * NOTE: This is used by both inverse ACQUIRE and actual ACQUIRE 5457 * generation. As a consequence, expect this function to evolve 5458 * rapidly. 5459 */ 5460 static mblk_t * 5461 sadb_extended_acquire(ipsec_selector_t *sel, ipsec_policy_t *pol, 5462 ipsec_action_t *act, boolean_t tunnel_mode, uint32_t seq, uint32_t pid, 5463 netstack_t *ns) 5464 { 5465 mblk_t *mp; 5466 sadb_msg_t *samsg; 5467 uint8_t *start, *cur, *end; 5468 uint32_t *saddrptr, *daddrptr; 5469 sa_family_t af; 5470 sadb_prop_t *eprop; 5471 ipsec_action_t *ap, *an; 5472 ipsec_selkey_t *ipsl; 5473 uint8_t proto, pfxlen; 5474 uint16_t lport, rport; 5475 uint32_t kmp, kmc; 5476 5477 /* 5478 * Find the action we want sooner rather than later.. 5479 */ 5480 an = NULL; 5481 if (pol == NULL) { 5482 ap = act; 5483 } else { 5484 ap = pol->ipsp_act; 5485 5486 if (ap != NULL) 5487 an = ap->ipa_next; 5488 } 5489 5490 /* 5491 * Just take a swag for the allocation for now. We can always 5492 * alter it later. 5493 */ 5494 #define SADB_EXTENDED_ACQUIRE_SIZE 4096 5495 mp = allocb(SADB_EXTENDED_ACQUIRE_SIZE, BPRI_HI); 5496 if (mp == NULL) 5497 return (NULL); 5498 5499 start = mp->b_rptr; 5500 end = start + SADB_EXTENDED_ACQUIRE_SIZE; 5501 5502 cur = start; 5503 5504 samsg = (sadb_msg_t *)cur; 5505 cur += sizeof (*samsg); 5506 5507 samsg->sadb_msg_version = PF_KEY_V2; 5508 samsg->sadb_msg_type = SADB_ACQUIRE; 5509 samsg->sadb_msg_errno = 0; 5510 samsg->sadb_msg_reserved = 0; 5511 samsg->sadb_msg_satype = 0; 5512 samsg->sadb_msg_seq = seq; 5513 samsg->sadb_msg_pid = pid; 5514 5515 if (tunnel_mode) { 5516 /* 5517 * Form inner address extensions based NOT on the inner 5518 * selectors (i.e. the packet data), but on the policy's 5519 * selector key (i.e. the policy's selector information). 5520 * 5521 * NOTE: The position of IPv4 and IPv6 addresses is the 5522 * same in ipsec_selkey_t (unless the compiler does very 5523 * strange things with unions, consult your local C language 5524 * lawyer for details). 5525 */ 5526 ASSERT(pol != NULL); 5527 5528 ipsl = &(pol->ipsp_sel->ipsl_key); 5529 if (ipsl->ipsl_valid & IPSL_IPV4) { 5530 af = AF_INET; 5531 ASSERT(sel->ips_protocol == IPPROTO_ENCAP); 5532 ASSERT(!(ipsl->ipsl_valid & IPSL_IPV6)); 5533 } else { 5534 af = AF_INET6; 5535 ASSERT(sel->ips_protocol == IPPROTO_IPV6); 5536 ASSERT(ipsl->ipsl_valid & IPSL_IPV6); 5537 } 5538 5539 if (ipsl->ipsl_valid & IPSL_LOCAL_ADDR) { 5540 saddrptr = (uint32_t *)(&ipsl->ipsl_local); 5541 pfxlen = ipsl->ipsl_local_pfxlen; 5542 } else { 5543 saddrptr = (uint32_t *)(&ipv6_all_zeros); 5544 pfxlen = 0; 5545 } 5546 /* XXX What about ICMP type/code? */ 5547 lport = (ipsl->ipsl_valid & IPSL_LOCAL_PORT) ? 5548 ipsl->ipsl_lport : 0; 5549 proto = (ipsl->ipsl_valid & IPSL_PROTOCOL) ? 5550 ipsl->ipsl_proto : 0; 5551 5552 cur = sadb_make_addr_ext(cur, end, SADB_X_EXT_ADDRESS_INNER_SRC, 5553 af, saddrptr, lport, proto, pfxlen); 5554 if (cur == NULL) { 5555 freeb(mp); 5556 return (NULL); 5557 } 5558 5559 if (ipsl->ipsl_valid & IPSL_REMOTE_ADDR) { 5560 daddrptr = (uint32_t *)(&ipsl->ipsl_remote); 5561 pfxlen = ipsl->ipsl_remote_pfxlen; 5562 } else { 5563 daddrptr = (uint32_t *)(&ipv6_all_zeros); 5564 pfxlen = 0; 5565 } 5566 /* XXX What about ICMP type/code? */ 5567 rport = (ipsl->ipsl_valid & IPSL_REMOTE_PORT) ? 5568 ipsl->ipsl_rport : 0; 5569 5570 cur = sadb_make_addr_ext(cur, end, SADB_X_EXT_ADDRESS_INNER_DST, 5571 af, daddrptr, rport, proto, pfxlen); 5572 if (cur == NULL) { 5573 freeb(mp); 5574 return (NULL); 5575 } 5576 /* 5577 * TODO - if we go to 3408's dream of transport mode IP-in-IP 5578 * _with_ inner-packet address selectors, we'll need to further 5579 * distinguish tunnel mode here. For now, having inner 5580 * addresses and/or ports is sufficient. 5581 * 5582 * Meanwhile, whack proto/ports to reflect IP-in-IP for the 5583 * outer addresses. 5584 */ 5585 proto = sel->ips_protocol; /* Either _ENCAP or _IPV6 */ 5586 lport = rport = 0; 5587 } else if ((ap != NULL) && (!ap->ipa_want_unique)) { 5588 proto = 0; 5589 lport = 0; 5590 rport = 0; 5591 if (pol != NULL) { 5592 ipsl = &(pol->ipsp_sel->ipsl_key); 5593 if (ipsl->ipsl_valid & IPSL_PROTOCOL) 5594 proto = ipsl->ipsl_proto; 5595 if (ipsl->ipsl_valid & IPSL_REMOTE_PORT) 5596 rport = ipsl->ipsl_rport; 5597 if (ipsl->ipsl_valid & IPSL_LOCAL_PORT) 5598 lport = ipsl->ipsl_lport; 5599 } 5600 } else { 5601 proto = sel->ips_protocol; 5602 lport = sel->ips_local_port; 5603 rport = sel->ips_remote_port; 5604 } 5605 5606 af = sel->ips_isv4 ? AF_INET : AF_INET6; 5607 5608 /* 5609 * NOTE: The position of IPv4 and IPv6 addresses is the same in 5610 * ipsec_selector_t. 5611 */ 5612 cur = sadb_make_addr_ext(cur, end, SADB_EXT_ADDRESS_SRC, af, 5613 (uint32_t *)(&sel->ips_local_addr_v6), lport, proto, 0); 5614 5615 if (cur == NULL) { 5616 freeb(mp); 5617 return (NULL); 5618 } 5619 5620 cur = sadb_make_addr_ext(cur, end, SADB_EXT_ADDRESS_DST, af, 5621 (uint32_t *)(&sel->ips_remote_addr_v6), rport, proto, 0); 5622 5623 if (cur == NULL) { 5624 freeb(mp); 5625 return (NULL); 5626 } 5627 5628 /* 5629 * This section will change a lot as policy evolves. 5630 * For now, it'll be relatively simple. 5631 */ 5632 eprop = (sadb_prop_t *)cur; 5633 cur += sizeof (*eprop); 5634 if (cur > end) { 5635 /* no space left */ 5636 freeb(mp); 5637 return (NULL); 5638 } 5639 5640 eprop->sadb_prop_exttype = SADB_X_EXT_EPROP; 5641 eprop->sadb_x_prop_ereserved = 0; 5642 eprop->sadb_x_prop_numecombs = 0; 5643 eprop->sadb_prop_replay = 32; /* default */ 5644 5645 kmc = kmp = 0; 5646 5647 for (; ap != NULL; ap = an) { 5648 an = (pol != NULL) ? ap->ipa_next : NULL; 5649 5650 /* 5651 * Skip non-IPsec policies 5652 */ 5653 if (ap->ipa_act.ipa_type != IPSEC_ACT_APPLY) 5654 continue; 5655 5656 if (ap->ipa_act.ipa_apply.ipp_km_proto) 5657 kmp = ap->ipa_act.ipa_apply.ipp_km_proto; 5658 if (ap->ipa_act.ipa_apply.ipp_km_cookie) 5659 kmc = ap->ipa_act.ipa_apply.ipp_km_cookie; 5660 if (ap->ipa_act.ipa_apply.ipp_replay_depth) { 5661 eprop->sadb_prop_replay = 5662 ap->ipa_act.ipa_apply.ipp_replay_depth; 5663 } 5664 5665 cur = sadb_action_to_ecomb(cur, end, ap, ns); 5666 if (cur == NULL) { /* no space */ 5667 freeb(mp); 5668 return (NULL); 5669 } 5670 eprop->sadb_x_prop_numecombs++; 5671 } 5672 5673 if (eprop->sadb_x_prop_numecombs == 0) { 5674 /* 5675 * This will happen if we fail to find a policy 5676 * allowing for IPsec processing. 5677 * Construct an error message. 5678 */ 5679 samsg->sadb_msg_len = SADB_8TO64(sizeof (*samsg)); 5680 samsg->sadb_msg_errno = ENOENT; 5681 samsg->sadb_x_msg_diagnostic = 0; 5682 return (mp); 5683 } 5684 5685 if ((kmp != 0) || (kmc != 0)) { 5686 cur = sadb_make_kmc_ext(cur, end, kmp, kmc); 5687 if (cur == NULL) { 5688 freeb(mp); 5689 return (NULL); 5690 } 5691 } 5692 5693 eprop->sadb_prop_len = SADB_8TO64(cur - (uint8_t *)eprop); 5694 samsg->sadb_msg_len = SADB_8TO64(cur - start); 5695 mp->b_wptr = cur; 5696 5697 return (mp); 5698 } 5699 5700 /* 5701 * Generic setup of an RFC 2367 ACQUIRE message. Caller sets satype. 5702 * 5703 * NOTE: This function acquires alg_lock as a side-effect if-and-only-if we 5704 * succeed (i.e. return non-NULL). Caller MUST release it. This is to 5705 * maximize code consolidation while preventing algorithm changes from messing 5706 * with the callers finishing touches on the ACQUIRE itself. 5707 */ 5708 mblk_t * 5709 sadb_setup_acquire(ipsacq_t *acqrec, uint8_t satype, ipsec_stack_t *ipss) 5710 { 5711 uint_t allocsize; 5712 mblk_t *pfkeymp, *msgmp; 5713 sa_family_t af; 5714 uint8_t *cur, *end; 5715 sadb_msg_t *samsg; 5716 uint16_t sport_typecode; 5717 uint16_t dport_typecode; 5718 uint8_t check_proto; 5719 boolean_t tunnel_mode = (acqrec->ipsacq_inneraddrfam != 0); 5720 5721 ASSERT(MUTEX_HELD(&acqrec->ipsacq_lock)); 5722 5723 pfkeymp = sadb_keysock_out(0); 5724 if (pfkeymp == NULL) 5725 return (NULL); 5726 5727 /* 5728 * First, allocate a basic ACQUIRE message 5729 */ 5730 allocsize = sizeof (sadb_msg_t) + sizeof (sadb_address_t) + 5731 sizeof (sadb_address_t) + sizeof (sadb_prop_t); 5732 5733 /* Make sure there's enough to cover both AF_INET and AF_INET6. */ 5734 allocsize += 2 * sizeof (struct sockaddr_in6); 5735 5736 mutex_enter(&ipss->ipsec_alg_lock); 5737 /* NOTE: The lock is now held through to this function's return. */ 5738 allocsize += ipss->ipsec_nalgs[IPSEC_ALG_AUTH] * 5739 ipss->ipsec_nalgs[IPSEC_ALG_ENCR] * sizeof (sadb_comb_t); 5740 5741 if (tunnel_mode) { 5742 /* Tunnel mode! */ 5743 allocsize += 2 * sizeof (sadb_address_t); 5744 /* Enough to cover both AF_INET and AF_INET6. */ 5745 allocsize += 2 * sizeof (struct sockaddr_in6); 5746 } 5747 5748 msgmp = allocb(allocsize, BPRI_HI); 5749 if (msgmp == NULL) { 5750 freeb(pfkeymp); 5751 mutex_exit(&ipss->ipsec_alg_lock); 5752 return (NULL); 5753 } 5754 5755 pfkeymp->b_cont = msgmp; 5756 cur = msgmp->b_rptr; 5757 end = cur + allocsize; 5758 samsg = (sadb_msg_t *)cur; 5759 cur += sizeof (sadb_msg_t); 5760 5761 af = acqrec->ipsacq_addrfam; 5762 switch (af) { 5763 case AF_INET: 5764 check_proto = IPPROTO_ICMP; 5765 break; 5766 case AF_INET6: 5767 check_proto = IPPROTO_ICMPV6; 5768 break; 5769 default: 5770 /* This should never happen unless we have kernel bugs. */ 5771 cmn_err(CE_WARN, 5772 "sadb_setup_acquire: corrupt ACQUIRE record.\n"); 5773 ASSERT(0); 5774 mutex_exit(&ipss->ipsec_alg_lock); 5775 return (NULL); 5776 } 5777 5778 samsg->sadb_msg_version = PF_KEY_V2; 5779 samsg->sadb_msg_type = SADB_ACQUIRE; 5780 samsg->sadb_msg_satype = satype; 5781 samsg->sadb_msg_errno = 0; 5782 samsg->sadb_msg_pid = 0; 5783 samsg->sadb_msg_reserved = 0; 5784 samsg->sadb_msg_seq = acqrec->ipsacq_seq; 5785 5786 ASSERT(MUTEX_HELD(&acqrec->ipsacq_lock)); 5787 5788 if ((acqrec->ipsacq_proto == check_proto) || tunnel_mode) { 5789 sport_typecode = dport_typecode = 0; 5790 } else { 5791 sport_typecode = acqrec->ipsacq_srcport; 5792 dport_typecode = acqrec->ipsacq_dstport; 5793 } 5794 5795 cur = sadb_make_addr_ext(cur, end, SADB_EXT_ADDRESS_SRC, af, 5796 acqrec->ipsacq_srcaddr, sport_typecode, acqrec->ipsacq_proto, 0); 5797 5798 cur = sadb_make_addr_ext(cur, end, SADB_EXT_ADDRESS_DST, af, 5799 acqrec->ipsacq_dstaddr, dport_typecode, acqrec->ipsacq_proto, 0); 5800 5801 if (tunnel_mode) { 5802 sport_typecode = acqrec->ipsacq_srcport; 5803 dport_typecode = acqrec->ipsacq_dstport; 5804 cur = sadb_make_addr_ext(cur, end, SADB_X_EXT_ADDRESS_INNER_SRC, 5805 acqrec->ipsacq_inneraddrfam, acqrec->ipsacq_innersrc, 5806 sport_typecode, acqrec->ipsacq_inner_proto, 5807 acqrec->ipsacq_innersrcpfx); 5808 cur = sadb_make_addr_ext(cur, end, SADB_X_EXT_ADDRESS_INNER_DST, 5809 acqrec->ipsacq_inneraddrfam, acqrec->ipsacq_innerdst, 5810 dport_typecode, acqrec->ipsacq_inner_proto, 5811 acqrec->ipsacq_innerdstpfx); 5812 } 5813 5814 /* XXX Insert identity information here. */ 5815 5816 /* XXXMLS Insert sensitivity information here. */ 5817 5818 if (cur != NULL) 5819 samsg->sadb_msg_len = SADB_8TO64(cur - msgmp->b_rptr); 5820 else 5821 mutex_exit(&ipss->ipsec_alg_lock); 5822 5823 return (pfkeymp); 5824 } 5825 5826 /* 5827 * Given an SADB_GETSPI message, find an appropriately ranged SA and 5828 * allocate an SA. If there are message improprieties, return (ipsa_t *)-1. 5829 * If there was a memory allocation error, return NULL. (Assume NULL != 5830 * (ipsa_t *)-1). 5831 * 5832 * master_spi is passed in host order. 5833 */ 5834 ipsa_t * 5835 sadb_getspi(keysock_in_t *ksi, uint32_t master_spi, int *diagnostic, 5836 netstack_t *ns, uint_t sa_type) 5837 { 5838 sadb_address_t *src = 5839 (sadb_address_t *)ksi->ks_in_extv[SADB_EXT_ADDRESS_SRC], 5840 *dst = (sadb_address_t *)ksi->ks_in_extv[SADB_EXT_ADDRESS_DST]; 5841 sadb_spirange_t *range = 5842 (sadb_spirange_t *)ksi->ks_in_extv[SADB_EXT_SPIRANGE]; 5843 struct sockaddr_in *ssa, *dsa; 5844 struct sockaddr_in6 *ssa6, *dsa6; 5845 uint32_t *srcaddr, *dstaddr; 5846 sa_family_t af; 5847 uint32_t add, min, max; 5848 uint8_t protocol = 5849 (sa_type == SADB_SATYPE_AH) ? IPPROTO_AH : IPPROTO_ESP; 5850 5851 if (src == NULL) { 5852 *diagnostic = SADB_X_DIAGNOSTIC_MISSING_SRC; 5853 return ((ipsa_t *)-1); 5854 } 5855 if (dst == NULL) { 5856 *diagnostic = SADB_X_DIAGNOSTIC_MISSING_DST; 5857 return ((ipsa_t *)-1); 5858 } 5859 if (range == NULL) { 5860 *diagnostic = SADB_X_DIAGNOSTIC_MISSING_RANGE; 5861 return ((ipsa_t *)-1); 5862 } 5863 5864 min = ntohl(range->sadb_spirange_min); 5865 max = ntohl(range->sadb_spirange_max); 5866 dsa = (struct sockaddr_in *)(dst + 1); 5867 dsa6 = (struct sockaddr_in6 *)dsa; 5868 5869 ssa = (struct sockaddr_in *)(src + 1); 5870 ssa6 = (struct sockaddr_in6 *)ssa; 5871 ASSERT(dsa->sin_family == ssa->sin_family); 5872 5873 srcaddr = ALL_ZEROES_PTR; 5874 af = dsa->sin_family; 5875 switch (af) { 5876 case AF_INET: 5877 if (src != NULL) 5878 srcaddr = (uint32_t *)(&ssa->sin_addr); 5879 dstaddr = (uint32_t *)(&dsa->sin_addr); 5880 break; 5881 case AF_INET6: 5882 if (src != NULL) 5883 srcaddr = (uint32_t *)(&ssa6->sin6_addr); 5884 dstaddr = (uint32_t *)(&dsa6->sin6_addr); 5885 break; 5886 default: 5887 *diagnostic = SADB_X_DIAGNOSTIC_BAD_DST_AF; 5888 return ((ipsa_t *)-1); 5889 } 5890 5891 if (master_spi < min || master_spi > max) { 5892 /* Return a random value in the range. */ 5893 if (cl_inet_getspi) { 5894 cl_inet_getspi(ns->netstack_stackid, protocol, 5895 (uint8_t *)&add, sizeof (add), NULL); 5896 } else { 5897 (void) random_get_pseudo_bytes((uint8_t *)&add, 5898 sizeof (add)); 5899 } 5900 master_spi = min + (add % (max - min + 1)); 5901 } 5902 5903 /* 5904 * Since master_spi is passed in host order, we need to htonl() it 5905 * for the purposes of creating a new SA. 5906 */ 5907 return (sadb_makelarvalassoc(htonl(master_spi), srcaddr, dstaddr, af, 5908 ns)); 5909 } 5910 5911 /* 5912 * 5913 * Locate an ACQUIRE and nuke it. If I have an samsg that's larger than the 5914 * base header, just ignore it. Otherwise, lock down the whole ACQUIRE list 5915 * and scan for the sequence number in question. I may wish to accept an 5916 * address pair with it, for easier searching. 5917 * 5918 * Caller frees the message, so we don't have to here. 5919 * 5920 * NOTE: The ip_q parameter may be used in the future for ACQUIRE 5921 * failures. 5922 */ 5923 /* ARGSUSED */ 5924 void 5925 sadb_in_acquire(sadb_msg_t *samsg, sadbp_t *sp, queue_t *ip_q, netstack_t *ns) 5926 { 5927 int i; 5928 ipsacq_t *acqrec; 5929 iacqf_t *bucket; 5930 5931 /* 5932 * I only accept the base header for this! 5933 * Though to be honest, requiring the dst address would help 5934 * immensely. 5935 * 5936 * XXX There are already cases where I can get the dst address. 5937 */ 5938 if (samsg->sadb_msg_len > SADB_8TO64(sizeof (*samsg))) 5939 return; 5940 5941 /* 5942 * Using the samsg->sadb_msg_seq, find the ACQUIRE record, delete it, 5943 * (and in the future send a message to IP with the appropriate error 5944 * number). 5945 * 5946 * Q: Do I want to reject if pid != 0? 5947 */ 5948 5949 for (i = 0; i < sp->s_v4.sdb_hashsize; i++) { 5950 bucket = &sp->s_v4.sdb_acq[i]; 5951 mutex_enter(&bucket->iacqf_lock); 5952 for (acqrec = bucket->iacqf_ipsacq; acqrec != NULL; 5953 acqrec = acqrec->ipsacq_next) { 5954 if (samsg->sadb_msg_seq == acqrec->ipsacq_seq) 5955 break; /* for acqrec... loop. */ 5956 } 5957 if (acqrec != NULL) 5958 break; /* for i = 0... loop. */ 5959 5960 mutex_exit(&bucket->iacqf_lock); 5961 } 5962 5963 if (acqrec == NULL) { 5964 for (i = 0; i < sp->s_v6.sdb_hashsize; i++) { 5965 bucket = &sp->s_v6.sdb_acq[i]; 5966 mutex_enter(&bucket->iacqf_lock); 5967 for (acqrec = bucket->iacqf_ipsacq; acqrec != NULL; 5968 acqrec = acqrec->ipsacq_next) { 5969 if (samsg->sadb_msg_seq == acqrec->ipsacq_seq) 5970 break; /* for acqrec... loop. */ 5971 } 5972 if (acqrec != NULL) 5973 break; /* for i = 0... loop. */ 5974 5975 mutex_exit(&bucket->iacqf_lock); 5976 } 5977 } 5978 5979 5980 if (acqrec == NULL) 5981 return; 5982 5983 /* 5984 * What do I do with the errno and IP? I may need mp's services a 5985 * little more. See sadb_destroy_acquire() for future directions 5986 * beyond free the mblk chain on the acquire record. 5987 */ 5988 5989 ASSERT(&bucket->iacqf_lock == acqrec->ipsacq_linklock); 5990 sadb_destroy_acquire(acqrec, ns); 5991 /* Have to exit mutex here, because of breaking out of for loop. */ 5992 mutex_exit(&bucket->iacqf_lock); 5993 } 5994 5995 /* 5996 * The following functions work with the replay windows of an SA. They assume 5997 * the ipsa->ipsa_replay_arr is an array of uint64_t, and that the bit vector 5998 * represents the highest sequence number packet received, and back 5999 * (ipsa->ipsa_replay_wsize) packets. 6000 */ 6001 6002 /* 6003 * Is the replay bit set? 6004 */ 6005 static boolean_t 6006 ipsa_is_replay_set(ipsa_t *ipsa, uint32_t offset) 6007 { 6008 uint64_t bit = (uint64_t)1 << (uint64_t)(offset & 63); 6009 6010 return ((bit & ipsa->ipsa_replay_arr[offset >> 6]) ? B_TRUE : B_FALSE); 6011 } 6012 6013 /* 6014 * Shift the bits of the replay window over. 6015 */ 6016 static void 6017 ipsa_shift_replay(ipsa_t *ipsa, uint32_t shift) 6018 { 6019 int i; 6020 int jump = ((shift - 1) >> 6) + 1; 6021 6022 if (shift == 0) 6023 return; 6024 6025 for (i = (ipsa->ipsa_replay_wsize - 1) >> 6; i >= 0; i--) { 6026 if (i + jump <= (ipsa->ipsa_replay_wsize - 1) >> 6) { 6027 ipsa->ipsa_replay_arr[i + jump] |= 6028 ipsa->ipsa_replay_arr[i] >> (64 - (shift & 63)); 6029 } 6030 ipsa->ipsa_replay_arr[i] <<= shift; 6031 } 6032 } 6033 6034 /* 6035 * Set a bit in the bit vector. 6036 */ 6037 static void 6038 ipsa_set_replay(ipsa_t *ipsa, uint32_t offset) 6039 { 6040 uint64_t bit = (uint64_t)1 << (uint64_t)(offset & 63); 6041 6042 ipsa->ipsa_replay_arr[offset >> 6] |= bit; 6043 } 6044 6045 #define SADB_MAX_REPLAY_VALUE 0xffffffff 6046 6047 /* 6048 * Assume caller has NOT done ntohl() already on seq. Check to see 6049 * if replay sequence number "seq" has been seen already. 6050 */ 6051 boolean_t 6052 sadb_replay_check(ipsa_t *ipsa, uint32_t seq) 6053 { 6054 boolean_t rc; 6055 uint32_t diff; 6056 6057 if (ipsa->ipsa_replay_wsize == 0) 6058 return (B_TRUE); 6059 6060 /* 6061 * NOTE: I've already checked for 0 on the wire in sadb_replay_peek(). 6062 */ 6063 6064 /* Convert sequence number into host order before holding the mutex. */ 6065 seq = ntohl(seq); 6066 6067 mutex_enter(&ipsa->ipsa_lock); 6068 6069 /* Initialize inbound SA's ipsa_replay field to last one received. */ 6070 if (ipsa->ipsa_replay == 0) 6071 ipsa->ipsa_replay = 1; 6072 6073 if (seq > ipsa->ipsa_replay) { 6074 /* 6075 * I have received a new "highest value received". Shift 6076 * the replay window over. 6077 */ 6078 diff = seq - ipsa->ipsa_replay; 6079 if (diff < ipsa->ipsa_replay_wsize) { 6080 /* In replay window, shift bits over. */ 6081 ipsa_shift_replay(ipsa, diff); 6082 } else { 6083 /* WAY FAR AHEAD, clear bits and start again. */ 6084 bzero(ipsa->ipsa_replay_arr, 6085 sizeof (ipsa->ipsa_replay_arr)); 6086 } 6087 ipsa_set_replay(ipsa, 0); 6088 ipsa->ipsa_replay = seq; 6089 rc = B_TRUE; 6090 goto done; 6091 } 6092 diff = ipsa->ipsa_replay - seq; 6093 if (diff >= ipsa->ipsa_replay_wsize || ipsa_is_replay_set(ipsa, diff)) { 6094 rc = B_FALSE; 6095 goto done; 6096 } 6097 /* Set this packet as seen. */ 6098 ipsa_set_replay(ipsa, diff); 6099 6100 rc = B_TRUE; 6101 done: 6102 mutex_exit(&ipsa->ipsa_lock); 6103 return (rc); 6104 } 6105 6106 /* 6107 * "Peek" and see if we should even bother going through the effort of 6108 * running an authentication check on the sequence number passed in. 6109 * this takes into account packets that are below the replay window, 6110 * and collisions with already replayed packets. Return B_TRUE if it 6111 * is okay to proceed, B_FALSE if this packet should be dropped immediately. 6112 * Assume same byte-ordering as sadb_replay_check. 6113 */ 6114 boolean_t 6115 sadb_replay_peek(ipsa_t *ipsa, uint32_t seq) 6116 { 6117 boolean_t rc = B_FALSE; 6118 uint32_t diff; 6119 6120 if (ipsa->ipsa_replay_wsize == 0) 6121 return (B_TRUE); 6122 6123 /* 6124 * 0 is 0, regardless of byte order... :) 6125 * 6126 * If I get 0 on the wire (and there is a replay window) then the 6127 * sender most likely wrapped. This ipsa may need to be marked or 6128 * something. 6129 */ 6130 if (seq == 0) 6131 return (B_FALSE); 6132 6133 seq = ntohl(seq); 6134 mutex_enter(&ipsa->ipsa_lock); 6135 if (seq < ipsa->ipsa_replay - ipsa->ipsa_replay_wsize && 6136 ipsa->ipsa_replay >= ipsa->ipsa_replay_wsize) 6137 goto done; 6138 6139 /* 6140 * If I've hit 0xffffffff, then quite honestly, I don't need to 6141 * bother with formalities. I'm not accepting any more packets 6142 * on this SA. 6143 */ 6144 if (ipsa->ipsa_replay == SADB_MAX_REPLAY_VALUE) { 6145 /* 6146 * Since we're already holding the lock, update the 6147 * expire time ala. sadb_replay_delete() and return. 6148 */ 6149 ipsa->ipsa_hardexpiretime = (time_t)1; 6150 goto done; 6151 } 6152 6153 if (seq <= ipsa->ipsa_replay) { 6154 /* 6155 * This seq is in the replay window. I'm not below it, 6156 * because I already checked for that above! 6157 */ 6158 diff = ipsa->ipsa_replay - seq; 6159 if (ipsa_is_replay_set(ipsa, diff)) 6160 goto done; 6161 } 6162 /* Else return B_TRUE, I'm going to advance the window. */ 6163 6164 rc = B_TRUE; 6165 done: 6166 mutex_exit(&ipsa->ipsa_lock); 6167 return (rc); 6168 } 6169 6170 /* 6171 * Delete a single SA. 6172 * 6173 * For now, use the quick-and-dirty trick of making the association's 6174 * hard-expire lifetime (time_t)1, ensuring deletion by the *_ager(). 6175 */ 6176 void 6177 sadb_replay_delete(ipsa_t *assoc) 6178 { 6179 mutex_enter(&assoc->ipsa_lock); 6180 assoc->ipsa_hardexpiretime = (time_t)1; 6181 mutex_exit(&assoc->ipsa_lock); 6182 } 6183 6184 /* 6185 * Given a queue that presumably points to IP, send a T_BIND_REQ for _proto_ 6186 * down. The caller will handle the T_BIND_ACK locally. 6187 */ 6188 boolean_t 6189 sadb_t_bind_req(queue_t *q, int proto) 6190 { 6191 struct T_bind_req *tbr; 6192 mblk_t *mp; 6193 6194 mp = allocb_cred(sizeof (struct T_bind_req) + 1, kcred, NOPID); 6195 if (mp == NULL) { 6196 /* cmn_err(CE_WARN, */ 6197 /* "sadb_t_bind_req(%d): couldn't allocate mblk\n", proto); */ 6198 return (B_FALSE); 6199 } 6200 mp->b_datap->db_type = M_PCPROTO; 6201 tbr = (struct T_bind_req *)mp->b_rptr; 6202 mp->b_wptr += sizeof (struct T_bind_req); 6203 tbr->PRIM_type = T_BIND_REQ; 6204 tbr->ADDR_length = 0; 6205 tbr->ADDR_offset = 0; 6206 tbr->CONIND_number = 0; 6207 *mp->b_wptr = (uint8_t)proto; 6208 mp->b_wptr++; 6209 6210 putnext(q, mp); 6211 return (B_TRUE); 6212 } 6213 6214 /* 6215 * Special front-end to ipsec_rl_strlog() dealing with SA failure. 6216 * this is designed to take only a format string with "* %x * %s *", so 6217 * that "spi" is printed first, then "addr" is converted using inet_pton(). 6218 * 6219 * This is abstracted out to save the stack space for only when inet_pton() 6220 * is called. Make sure "spi" is in network order; it usually is when this 6221 * would get called. 6222 */ 6223 void 6224 ipsec_assocfailure(short mid, short sid, char level, ushort_t sl, char *fmt, 6225 uint32_t spi, void *addr, int af, netstack_t *ns) 6226 { 6227 char buf[INET6_ADDRSTRLEN]; 6228 6229 ASSERT(af == AF_INET6 || af == AF_INET); 6230 6231 ipsec_rl_strlog(ns, mid, sid, level, sl, fmt, ntohl(spi), 6232 inet_ntop(af, addr, buf, sizeof (buf))); 6233 } 6234 6235 /* 6236 * Fills in a reference to the policy, if any, from the conn, in *ppp 6237 * Releases a reference to the passed conn_t. 6238 */ 6239 static void 6240 ipsec_conn_pol(ipsec_selector_t *sel, conn_t *connp, ipsec_policy_t **ppp) 6241 { 6242 ipsec_policy_t *pp; 6243 ipsec_latch_t *ipl = connp->conn_latch; 6244 6245 if ((ipl != NULL) && (ipl->ipl_out_policy != NULL)) { 6246 pp = ipl->ipl_out_policy; 6247 IPPOL_REFHOLD(pp); 6248 } else { 6249 pp = ipsec_find_policy(IPSEC_TYPE_OUTBOUND, connp, NULL, sel, 6250 connp->conn_netstack); 6251 } 6252 *ppp = pp; 6253 CONN_DEC_REF(connp); 6254 } 6255 6256 /* 6257 * The following functions scan through active conn_t structures 6258 * and return a reference to the best-matching policy it can find. 6259 * Caller must release the reference. 6260 */ 6261 static void 6262 ipsec_udp_pol(ipsec_selector_t *sel, ipsec_policy_t **ppp, ip_stack_t *ipst) 6263 { 6264 connf_t *connfp; 6265 conn_t *connp = NULL; 6266 ipsec_selector_t portonly; 6267 6268 bzero((void *)&portonly, sizeof (portonly)); 6269 6270 if (sel->ips_local_port == 0) 6271 return; 6272 6273 connfp = &ipst->ips_ipcl_udp_fanout[IPCL_UDP_HASH(sel->ips_local_port, 6274 ipst)]; 6275 mutex_enter(&connfp->connf_lock); 6276 6277 if (sel->ips_isv4) { 6278 connp = connfp->connf_head; 6279 while (connp != NULL) { 6280 if (IPCL_UDP_MATCH(connp, sel->ips_local_port, 6281 sel->ips_local_addr_v4, sel->ips_remote_port, 6282 sel->ips_remote_addr_v4)) 6283 break; 6284 connp = connp->conn_next; 6285 } 6286 6287 if (connp == NULL) { 6288 /* Try port-only match in IPv6. */ 6289 portonly.ips_local_port = sel->ips_local_port; 6290 sel = &portonly; 6291 } 6292 } 6293 6294 if (connp == NULL) { 6295 connp = connfp->connf_head; 6296 while (connp != NULL) { 6297 if (IPCL_UDP_MATCH_V6(connp, sel->ips_local_port, 6298 sel->ips_local_addr_v6, sel->ips_remote_port, 6299 sel->ips_remote_addr_v6)) 6300 break; 6301 connp = connp->conn_next; 6302 } 6303 6304 if (connp == NULL) { 6305 mutex_exit(&connfp->connf_lock); 6306 return; 6307 } 6308 } 6309 6310 CONN_INC_REF(connp); 6311 mutex_exit(&connfp->connf_lock); 6312 6313 ipsec_conn_pol(sel, connp, ppp); 6314 } 6315 6316 static conn_t * 6317 ipsec_find_listen_conn(uint16_t *pptr, ipsec_selector_t *sel, ip_stack_t *ipst) 6318 { 6319 connf_t *connfp; 6320 conn_t *connp = NULL; 6321 const in6_addr_t *v6addrmatch = &sel->ips_local_addr_v6; 6322 6323 if (sel->ips_local_port == 0) 6324 return (NULL); 6325 6326 connfp = &ipst->ips_ipcl_bind_fanout[ 6327 IPCL_BIND_HASH(sel->ips_local_port, ipst)]; 6328 mutex_enter(&connfp->connf_lock); 6329 6330 if (sel->ips_isv4) { 6331 connp = connfp->connf_head; 6332 while (connp != NULL) { 6333 if (IPCL_BIND_MATCH(connp, IPPROTO_TCP, 6334 sel->ips_local_addr_v4, pptr[1])) 6335 break; 6336 connp = connp->conn_next; 6337 } 6338 6339 if (connp == NULL) { 6340 /* Match to all-zeroes. */ 6341 v6addrmatch = &ipv6_all_zeros; 6342 } 6343 } 6344 6345 if (connp == NULL) { 6346 connp = connfp->connf_head; 6347 while (connp != NULL) { 6348 if (IPCL_BIND_MATCH_V6(connp, IPPROTO_TCP, 6349 *v6addrmatch, pptr[1])) 6350 break; 6351 connp = connp->conn_next; 6352 } 6353 6354 if (connp == NULL) { 6355 mutex_exit(&connfp->connf_lock); 6356 return (NULL); 6357 } 6358 } 6359 6360 CONN_INC_REF(connp); 6361 mutex_exit(&connfp->connf_lock); 6362 return (connp); 6363 } 6364 6365 static void 6366 ipsec_tcp_pol(ipsec_selector_t *sel, ipsec_policy_t **ppp, ip_stack_t *ipst) 6367 { 6368 connf_t *connfp; 6369 conn_t *connp; 6370 uint32_t ports; 6371 uint16_t *pptr = (uint16_t *)&ports; 6372 6373 /* 6374 * Find TCP state in the following order: 6375 * 1.) Connected conns. 6376 * 2.) Listeners. 6377 * 6378 * Even though #2 will be the common case for inbound traffic, only 6379 * following this order insures correctness. 6380 */ 6381 6382 if (sel->ips_local_port == 0) 6383 return; 6384 6385 /* 6386 * 0 should be fport, 1 should be lport. SRC is the local one here. 6387 * See ipsec_construct_inverse_acquire() for details. 6388 */ 6389 pptr[0] = sel->ips_remote_port; 6390 pptr[1] = sel->ips_local_port; 6391 6392 connfp = &ipst->ips_ipcl_conn_fanout[ 6393 IPCL_CONN_HASH(sel->ips_remote_addr_v4, ports, ipst)]; 6394 mutex_enter(&connfp->connf_lock); 6395 connp = connfp->connf_head; 6396 6397 if (sel->ips_isv4) { 6398 while (connp != NULL) { 6399 if (IPCL_CONN_MATCH(connp, IPPROTO_TCP, 6400 sel->ips_remote_addr_v4, sel->ips_local_addr_v4, 6401 ports)) 6402 break; 6403 connp = connp->conn_next; 6404 } 6405 } else { 6406 while (connp != NULL) { 6407 if (IPCL_CONN_MATCH_V6(connp, IPPROTO_TCP, 6408 sel->ips_remote_addr_v6, sel->ips_local_addr_v6, 6409 ports)) 6410 break; 6411 connp = connp->conn_next; 6412 } 6413 } 6414 6415 if (connp != NULL) { 6416 CONN_INC_REF(connp); 6417 mutex_exit(&connfp->connf_lock); 6418 } else { 6419 mutex_exit(&connfp->connf_lock); 6420 6421 /* Try the listen hash. */ 6422 if ((connp = ipsec_find_listen_conn(pptr, sel, ipst)) == NULL) 6423 return; 6424 } 6425 6426 ipsec_conn_pol(sel, connp, ppp); 6427 } 6428 6429 static void 6430 ipsec_sctp_pol(ipsec_selector_t *sel, ipsec_policy_t **ppp, 6431 ip_stack_t *ipst) 6432 { 6433 conn_t *connp; 6434 uint32_t ports; 6435 uint16_t *pptr = (uint16_t *)&ports; 6436 6437 /* 6438 * Find SCP state in the following order: 6439 * 1.) Connected conns. 6440 * 2.) Listeners. 6441 * 6442 * Even though #2 will be the common case for inbound traffic, only 6443 * following this order insures correctness. 6444 */ 6445 6446 if (sel->ips_local_port == 0) 6447 return; 6448 6449 /* 6450 * 0 should be fport, 1 should be lport. SRC is the local one here. 6451 * See ipsec_construct_inverse_acquire() for details. 6452 */ 6453 pptr[0] = sel->ips_remote_port; 6454 pptr[1] = sel->ips_local_port; 6455 6456 if (sel->ips_isv4) { 6457 in6_addr_t src, dst; 6458 6459 IN6_IPADDR_TO_V4MAPPED(sel->ips_remote_addr_v4, &dst); 6460 IN6_IPADDR_TO_V4MAPPED(sel->ips_local_addr_v4, &src); 6461 connp = sctp_find_conn(&dst, &src, ports, ALL_ZONES, 6462 ipst->ips_netstack->netstack_sctp); 6463 } else { 6464 connp = sctp_find_conn(&sel->ips_remote_addr_v6, 6465 &sel->ips_local_addr_v6, ports, ALL_ZONES, 6466 ipst->ips_netstack->netstack_sctp); 6467 } 6468 if (connp == NULL) 6469 return; 6470 ipsec_conn_pol(sel, connp, ppp); 6471 } 6472 6473 /* 6474 * Fill in a query for the SPD (in "sel") using two PF_KEY address extensions. 6475 * Returns 0 or errno, and always sets *diagnostic to something appropriate 6476 * to PF_KEY. 6477 * 6478 * NOTE: For right now, this function (and ipsec_selector_t for that matter), 6479 * ignore prefix lengths in the address extension. Since we match on first- 6480 * entered policies, this shouldn't matter. Also, since we normalize prefix- 6481 * set addresses to mask out the lower bits, we should get a suitable search 6482 * key for the SPD anyway. This is the function to change if the assumption 6483 * about suitable search keys is wrong. 6484 */ 6485 static int 6486 ipsec_get_inverse_acquire_sel(ipsec_selector_t *sel, sadb_address_t *srcext, 6487 sadb_address_t *dstext, int *diagnostic) 6488 { 6489 struct sockaddr_in *src, *dst; 6490 struct sockaddr_in6 *src6, *dst6; 6491 6492 *diagnostic = 0; 6493 6494 bzero(sel, sizeof (*sel)); 6495 sel->ips_protocol = srcext->sadb_address_proto; 6496 dst = (struct sockaddr_in *)(dstext + 1); 6497 if (dst->sin_family == AF_INET6) { 6498 dst6 = (struct sockaddr_in6 *)dst; 6499 src6 = (struct sockaddr_in6 *)(srcext + 1); 6500 if (src6->sin6_family != AF_INET6) { 6501 *diagnostic = SADB_X_DIAGNOSTIC_AF_MISMATCH; 6502 return (EINVAL); 6503 } 6504 sel->ips_remote_addr_v6 = dst6->sin6_addr; 6505 sel->ips_local_addr_v6 = src6->sin6_addr; 6506 if (sel->ips_protocol == IPPROTO_ICMPV6) { 6507 sel->ips_is_icmp_inv_acq = 1; 6508 } else { 6509 sel->ips_remote_port = dst6->sin6_port; 6510 sel->ips_local_port = src6->sin6_port; 6511 } 6512 sel->ips_isv4 = B_FALSE; 6513 } else { 6514 src = (struct sockaddr_in *)(srcext + 1); 6515 if (src->sin_family != AF_INET) { 6516 *diagnostic = SADB_X_DIAGNOSTIC_AF_MISMATCH; 6517 return (EINVAL); 6518 } 6519 sel->ips_remote_addr_v4 = dst->sin_addr.s_addr; 6520 sel->ips_local_addr_v4 = src->sin_addr.s_addr; 6521 if (sel->ips_protocol == IPPROTO_ICMP) { 6522 sel->ips_is_icmp_inv_acq = 1; 6523 } else { 6524 sel->ips_remote_port = dst->sin_port; 6525 sel->ips_local_port = src->sin_port; 6526 } 6527 sel->ips_isv4 = B_TRUE; 6528 } 6529 return (0); 6530 } 6531 6532 /* 6533 * We have encapsulation. 6534 * - Lookup tun_t by address and look for an associated 6535 * tunnel policy 6536 * - If there are inner selectors 6537 * - check ITPF_P_TUNNEL and ITPF_P_ACTIVE 6538 * - Look up tunnel policy based on selectors 6539 * - Else 6540 * - Sanity check the negotation 6541 * - If appropriate, fall through to global policy 6542 */ 6543 static int 6544 ipsec_tun_pol(ipsec_selector_t *sel, ipsec_policy_t **ppp, 6545 sadb_address_t *innsrcext, sadb_address_t *inndstext, ipsec_tun_pol_t *itp, 6546 int *diagnostic, netstack_t *ns) 6547 { 6548 int err; 6549 ipsec_policy_head_t *polhead; 6550 6551 /* Check for inner selectors and act appropriately */ 6552 6553 if (innsrcext != NULL) { 6554 /* Inner selectors present */ 6555 ASSERT(inndstext != NULL); 6556 if ((itp == NULL) || 6557 (itp->itp_flags & (ITPF_P_ACTIVE | ITPF_P_TUNNEL)) != 6558 (ITPF_P_ACTIVE | ITPF_P_TUNNEL)) { 6559 /* 6560 * If inner packet selectors, we must have negotiate 6561 * tunnel and active policy. If the tunnel has 6562 * transport-mode policy set on it, or has no policy, 6563 * fail. 6564 */ 6565 return (ENOENT); 6566 } else { 6567 /* 6568 * Reset "sel" to indicate inner selectors. Pass 6569 * inner PF_KEY address extensions for this to happen. 6570 */ 6571 err = ipsec_get_inverse_acquire_sel(sel, 6572 innsrcext, inndstext, diagnostic); 6573 if (err != 0) { 6574 ITP_REFRELE(itp, ns); 6575 return (err); 6576 } 6577 /* 6578 * Now look for a tunnel policy based on those inner 6579 * selectors. (Common code is below.) 6580 */ 6581 } 6582 } else { 6583 /* No inner selectors present */ 6584 if ((itp == NULL) || !(itp->itp_flags & ITPF_P_ACTIVE)) { 6585 /* 6586 * Transport mode negotiation with no tunnel policy 6587 * configured - return to indicate a global policy 6588 * check is needed. 6589 */ 6590 if (itp != NULL) { 6591 ITP_REFRELE(itp, ns); 6592 } 6593 return (0); 6594 } else if (itp->itp_flags & ITPF_P_TUNNEL) { 6595 /* Tunnel mode set with no inner selectors. */ 6596 ITP_REFRELE(itp, ns); 6597 return (ENOENT); 6598 } 6599 /* 6600 * Else, this is a tunnel policy configured with ifconfig(1m) 6601 * or "negotiate transport" with ipsecconf(1m). We have an 6602 * itp with policy set based on any match, so don't bother 6603 * changing fields in "sel". 6604 */ 6605 } 6606 6607 ASSERT(itp != NULL); 6608 polhead = itp->itp_policy; 6609 ASSERT(polhead != NULL); 6610 rw_enter(&polhead->iph_lock, RW_READER); 6611 *ppp = ipsec_find_policy_head(NULL, polhead, 6612 IPSEC_TYPE_INBOUND, sel, ns); 6613 rw_exit(&polhead->iph_lock); 6614 ITP_REFRELE(itp, ns); 6615 6616 /* 6617 * Don't default to global if we didn't find a matching policy entry. 6618 * Instead, send ENOENT, just like if we hit a transport-mode tunnel. 6619 */ 6620 if (*ppp == NULL) 6621 return (ENOENT); 6622 6623 return (0); 6624 } 6625 6626 static void 6627 ipsec_oth_pol(ipsec_selector_t *sel, ipsec_policy_t **ppp, 6628 ip_stack_t *ipst) 6629 { 6630 boolean_t isv4 = sel->ips_isv4; 6631 connf_t *connfp; 6632 conn_t *connp; 6633 6634 if (isv4) { 6635 connfp = &ipst->ips_ipcl_proto_fanout[sel->ips_protocol]; 6636 } else { 6637 connfp = &ipst->ips_ipcl_proto_fanout_v6[sel->ips_protocol]; 6638 } 6639 6640 mutex_enter(&connfp->connf_lock); 6641 for (connp = connfp->connf_head; connp != NULL; 6642 connp = connp->conn_next) { 6643 if (!((isv4 && !((connp->conn_src == 0 || 6644 connp->conn_src == sel->ips_local_addr_v4) && 6645 (connp->conn_rem == 0 || 6646 connp->conn_rem == sel->ips_remote_addr_v4))) || 6647 (!isv4 && !((IN6_IS_ADDR_UNSPECIFIED(&connp->conn_srcv6) || 6648 IN6_ARE_ADDR_EQUAL(&connp->conn_srcv6, 6649 &sel->ips_local_addr_v6)) && 6650 (IN6_IS_ADDR_UNSPECIFIED(&connp->conn_remv6) || 6651 IN6_ARE_ADDR_EQUAL(&connp->conn_remv6, 6652 &sel->ips_remote_addr_v6)))))) { 6653 break; 6654 } 6655 } 6656 if (connp == NULL) { 6657 mutex_exit(&connfp->connf_lock); 6658 return; 6659 } 6660 6661 CONN_INC_REF(connp); 6662 mutex_exit(&connfp->connf_lock); 6663 6664 ipsec_conn_pol(sel, connp, ppp); 6665 } 6666 6667 /* 6668 * Construct an inverse ACQUIRE reply based on: 6669 * 6670 * 1.) Current global policy. 6671 * 2.) An conn_t match depending on what all was passed in the extv[]. 6672 * 3.) A tunnel's policy head. 6673 * ... 6674 * N.) Other stuff TBD (e.g. identities) 6675 * 6676 * If there is an error, set sadb_msg_errno and sadb_x_msg_diagnostic 6677 * in this function so the caller can extract them where appropriately. 6678 * 6679 * The SRC address is the local one - just like an outbound ACQUIRE message. 6680 */ 6681 mblk_t * 6682 ipsec_construct_inverse_acquire(sadb_msg_t *samsg, sadb_ext_t *extv[], 6683 netstack_t *ns) 6684 { 6685 int err; 6686 int diagnostic; 6687 sadb_address_t *srcext = (sadb_address_t *)extv[SADB_EXT_ADDRESS_SRC], 6688 *dstext = (sadb_address_t *)extv[SADB_EXT_ADDRESS_DST], 6689 *innsrcext = (sadb_address_t *)extv[SADB_X_EXT_ADDRESS_INNER_SRC], 6690 *inndstext = (sadb_address_t *)extv[SADB_X_EXT_ADDRESS_INNER_DST]; 6691 struct sockaddr_in6 *src, *dst; 6692 struct sockaddr_in6 *isrc, *idst; 6693 ipsec_tun_pol_t *itp = NULL; 6694 ipsec_policy_t *pp = NULL; 6695 ipsec_selector_t sel, isel; 6696 mblk_t *retmp; 6697 ip_stack_t *ipst = ns->netstack_ip; 6698 ipsec_stack_t *ipss = ns->netstack_ipsec; 6699 6700 /* Normalize addresses */ 6701 if (sadb_addrcheck(NULL, (mblk_t *)samsg, (sadb_ext_t *)srcext, 0, ns) 6702 == KS_IN_ADDR_UNKNOWN) { 6703 err = EINVAL; 6704 diagnostic = SADB_X_DIAGNOSTIC_BAD_SRC; 6705 goto bail; 6706 } 6707 src = (struct sockaddr_in6 *)(srcext + 1); 6708 if (sadb_addrcheck(NULL, (mblk_t *)samsg, (sadb_ext_t *)dstext, 0, ns) 6709 == KS_IN_ADDR_UNKNOWN) { 6710 err = EINVAL; 6711 diagnostic = SADB_X_DIAGNOSTIC_BAD_DST; 6712 goto bail; 6713 } 6714 dst = (struct sockaddr_in6 *)(dstext + 1); 6715 if (src->sin6_family != dst->sin6_family) { 6716 err = EINVAL; 6717 diagnostic = SADB_X_DIAGNOSTIC_AF_MISMATCH; 6718 goto bail; 6719 } 6720 6721 /* Check for tunnel mode and act appropriately */ 6722 if (innsrcext != NULL) { 6723 if (inndstext == NULL) { 6724 err = EINVAL; 6725 diagnostic = SADB_X_DIAGNOSTIC_MISSING_INNER_DST; 6726 goto bail; 6727 } 6728 if (sadb_addrcheck(NULL, (mblk_t *)samsg, 6729 (sadb_ext_t *)innsrcext, 0, ns) == KS_IN_ADDR_UNKNOWN) { 6730 err = EINVAL; 6731 diagnostic = SADB_X_DIAGNOSTIC_MALFORMED_INNER_SRC; 6732 goto bail; 6733 } 6734 isrc = (struct sockaddr_in6 *)(innsrcext + 1); 6735 if (sadb_addrcheck(NULL, (mblk_t *)samsg, 6736 (sadb_ext_t *)inndstext, 0, ns) == KS_IN_ADDR_UNKNOWN) { 6737 err = EINVAL; 6738 diagnostic = SADB_X_DIAGNOSTIC_MALFORMED_INNER_DST; 6739 goto bail; 6740 } 6741 idst = (struct sockaddr_in6 *)(inndstext + 1); 6742 if (isrc->sin6_family != idst->sin6_family) { 6743 err = EINVAL; 6744 diagnostic = SADB_X_DIAGNOSTIC_INNER_AF_MISMATCH; 6745 goto bail; 6746 } 6747 if (isrc->sin6_family != AF_INET && 6748 isrc->sin6_family != AF_INET6) { 6749 err = EINVAL; 6750 diagnostic = SADB_X_DIAGNOSTIC_BAD_INNER_SRC_AF; 6751 goto bail; 6752 } 6753 } else if (inndstext != NULL) { 6754 err = EINVAL; 6755 diagnostic = SADB_X_DIAGNOSTIC_MISSING_INNER_SRC; 6756 goto bail; 6757 } 6758 6759 /* Get selectors first, based on outer addresses */ 6760 err = ipsec_get_inverse_acquire_sel(&sel, srcext, dstext, &diagnostic); 6761 if (err != 0) 6762 goto bail; 6763 6764 /* Check for tunnel mode mismatches. */ 6765 if (innsrcext != NULL && 6766 ((isrc->sin6_family == AF_INET && 6767 sel.ips_protocol != IPPROTO_ENCAP && sel.ips_protocol != 0) || 6768 (isrc->sin6_family == AF_INET6 && 6769 sel.ips_protocol != IPPROTO_IPV6 && sel.ips_protocol != 0))) { 6770 err = EPROTOTYPE; 6771 goto bail; 6772 } 6773 6774 /* 6775 * Okay, we have the addresses and other selector information. 6776 * Let's first find a conn... 6777 */ 6778 pp = NULL; 6779 switch (sel.ips_protocol) { 6780 case IPPROTO_TCP: 6781 ipsec_tcp_pol(&sel, &pp, ipst); 6782 break; 6783 case IPPROTO_UDP: 6784 ipsec_udp_pol(&sel, &pp, ipst); 6785 break; 6786 case IPPROTO_SCTP: 6787 ipsec_sctp_pol(&sel, &pp, ipst); 6788 break; 6789 case IPPROTO_ENCAP: 6790 case IPPROTO_IPV6: 6791 rw_enter(&ipss->ipsec_itp_get_byaddr_rw_lock, RW_READER); 6792 /* 6793 * Assume sel.ips_remote_addr_* has the right address at 6794 * that exact position. 6795 */ 6796 itp = ipss->ipsec_itp_get_byaddr( 6797 (uint32_t *)(&sel.ips_local_addr_v6), 6798 (uint32_t *)(&sel.ips_remote_addr_v6), 6799 src->sin6_family, ns); 6800 rw_exit(&ipss->ipsec_itp_get_byaddr_rw_lock); 6801 if (innsrcext == NULL) { 6802 /* 6803 * Transport-mode tunnel, make sure we fake out isel 6804 * to contain something based on the outer protocol. 6805 */ 6806 bzero(&isel, sizeof (isel)); 6807 isel.ips_isv4 = (sel.ips_protocol == IPPROTO_ENCAP); 6808 } /* Else isel is initialized by ipsec_tun_pol(). */ 6809 err = ipsec_tun_pol(&isel, &pp, innsrcext, inndstext, itp, 6810 &diagnostic, ns); 6811 /* 6812 * NOTE: isel isn't used for now, but in RFC 430x IPsec, it 6813 * may be. 6814 */ 6815 if (err != 0) 6816 goto bail; 6817 break; 6818 default: 6819 ipsec_oth_pol(&sel, &pp, ipst); 6820 break; 6821 } 6822 6823 /* 6824 * If we didn't find a matching conn_t or other policy head, take a 6825 * look in the global policy. 6826 */ 6827 if (pp == NULL) { 6828 pp = ipsec_find_policy(IPSEC_TYPE_OUTBOUND, NULL, NULL, &sel, 6829 ns); 6830 if (pp == NULL) { 6831 /* There's no global policy. */ 6832 err = ENOENT; 6833 diagnostic = 0; 6834 goto bail; 6835 } 6836 } 6837 6838 /* 6839 * Now that we have a policy entry/widget, construct an ACQUIRE 6840 * message based on that, fix fields where appropriate, 6841 * and return the message. 6842 */ 6843 retmp = sadb_extended_acquire(&sel, pp, NULL, 6844 (itp != NULL && (itp->itp_flags & ITPF_P_TUNNEL)), 6845 samsg->sadb_msg_seq, samsg->sadb_msg_pid, ns); 6846 if (pp != NULL) { 6847 IPPOL_REFRELE(pp, ns); 6848 } 6849 if (retmp != NULL) { 6850 return (retmp); 6851 } else { 6852 err = ENOMEM; 6853 diagnostic = 0; 6854 } 6855 bail: 6856 samsg->sadb_msg_errno = (uint8_t)err; 6857 samsg->sadb_x_msg_diagnostic = (uint16_t)diagnostic; 6858 return (NULL); 6859 } 6860 6861 /* 6862 * ipsa_lpkt is a one-element queue, only manipulated by the next two 6863 * functions. They have to hold the ipsa_lock because of potential races 6864 * between key management using SADB_UPDATE, and inbound packets that may 6865 * queue up on the larval SA (hence the 'l' in "lpkt"). 6866 */ 6867 6868 /* 6869 * sadb_set_lpkt: Return TRUE if we can swap in a value to ipsa->ipsa_lpkt and 6870 * freemsg the previous value. Return FALSE if we lost the race and the SA is 6871 * in a non-LARVAL state. free clue: ip_drop_packet(NULL) is safe. 6872 */ 6873 boolean_t 6874 sadb_set_lpkt(ipsa_t *ipsa, mblk_t *npkt, netstack_t *ns) 6875 { 6876 mblk_t *opkt; 6877 ipsec_stack_t *ipss = ns->netstack_ipsec; 6878 boolean_t is_larval; 6879 6880 /* 6881 * Check the packet's netstack id in case we go asynch with a 6882 * taskq_dispatch. 6883 */ 6884 ASSERT(((ipsec_in_t *)npkt->b_rptr)->ipsec_in_type == IPSEC_IN); 6885 ASSERT(((ipsec_in_t *)npkt->b_rptr)->ipsec_in_stackid == 6886 ns->netstack_stackid); 6887 6888 mutex_enter(&ipsa->ipsa_lock); 6889 is_larval = (ipsa->ipsa_state == IPSA_STATE_LARVAL); 6890 if (is_larval) { 6891 opkt = ipsa->ipsa_lpkt; 6892 ipsa->ipsa_lpkt = npkt; 6893 } else { 6894 /* We lost the race. */ 6895 opkt = NULL; 6896 ASSERT(ipsa->ipsa_lpkt == NULL); 6897 } 6898 mutex_exit(&ipsa->ipsa_lock); 6899 6900 ip_drop_packet(opkt, B_TRUE, NULL, NULL, 6901 DROPPER(ipss, ipds_sadb_inlarval_replace), 6902 &ipss->ipsec_sadb_dropper); 6903 return (is_larval); 6904 } 6905 6906 /* 6907 * sadb_clear_lpkt: Atomically clear ipsa->ipsa_lpkt and return the 6908 * previous value. 6909 */ 6910 mblk_t * 6911 sadb_clear_lpkt(ipsa_t *ipsa) 6912 { 6913 mblk_t *opkt; 6914 6915 mutex_enter(&ipsa->ipsa_lock); 6916 opkt = ipsa->ipsa_lpkt; 6917 ipsa->ipsa_lpkt = NULL; 6918 mutex_exit(&ipsa->ipsa_lock); 6919 6920 return (opkt); 6921 } 6922 6923 /* 6924 * Buffer a packet that's in IDLE state as set by Solaris Clustering. 6925 */ 6926 void 6927 sadb_buf_pkt(ipsa_t *ipsa, mblk_t *bpkt, netstack_t *ns) 6928 { 6929 ipsec_stack_t *ipss = ns->netstack_ipsec; 6930 extern void (*cl_inet_idlesa)(netstackid_t, uint8_t, uint32_t, 6931 sa_family_t, in6_addr_t, in6_addr_t, void *); 6932 in6_addr_t *srcaddr = (in6_addr_t *)(&ipsa->ipsa_srcaddr); 6933 in6_addr_t *dstaddr = (in6_addr_t *)(&ipsa->ipsa_dstaddr); 6934 6935 ASSERT(ipsa->ipsa_state == IPSA_STATE_IDLE); 6936 6937 if (cl_inet_idlesa == NULL) { 6938 ip_drop_packet(bpkt, B_TRUE, NULL, NULL, 6939 DROPPER(ipss, ipds_sadb_inidle_overflow), 6940 &ipss->ipsec_sadb_dropper); 6941 return; 6942 } 6943 6944 cl_inet_idlesa(ns->netstack_stackid, 6945 (ipsa->ipsa_type == SADB_SATYPE_AH) ? IPPROTO_AH : IPPROTO_ESP, 6946 ipsa->ipsa_spi, ipsa->ipsa_addrfam, *srcaddr, *dstaddr, NULL); 6947 6948 /* 6949 * Check the packet's netstack id in case we go asynch with a 6950 * taskq_dispatch. 6951 */ 6952 ASSERT(((ipsec_in_t *)bpkt->b_rptr)->ipsec_in_type == IPSEC_IN); 6953 ASSERT(((ipsec_in_t *)bpkt->b_rptr)->ipsec_in_stackid == 6954 ns->netstack_stackid); 6955 6956 mutex_enter(&ipsa->ipsa_lock); 6957 ipsa->ipsa_mblkcnt++; 6958 if (ipsa->ipsa_bpkt_head == NULL) { 6959 ipsa->ipsa_bpkt_head = ipsa->ipsa_bpkt_tail = bpkt; 6960 } else { 6961 ipsa->ipsa_bpkt_tail->b_next = bpkt; 6962 ipsa->ipsa_bpkt_tail = bpkt; 6963 if (ipsa->ipsa_mblkcnt > SADB_MAX_IDLEPKTS) { 6964 mblk_t *tmp; 6965 tmp = ipsa->ipsa_bpkt_head; 6966 ipsa->ipsa_bpkt_head = ipsa->ipsa_bpkt_head->b_next; 6967 ip_drop_packet(tmp, B_TRUE, NULL, NULL, 6968 DROPPER(ipss, ipds_sadb_inidle_overflow), 6969 &ipss->ipsec_sadb_dropper); 6970 ipsa->ipsa_mblkcnt --; 6971 } 6972 } 6973 mutex_exit(&ipsa->ipsa_lock); 6974 6975 } 6976 6977 /* 6978 * Stub function that taskq_dispatch() invokes to take the mblk (in arg) 6979 * and put into STREAMS again. 6980 */ 6981 void 6982 sadb_clear_buf_pkt(void *ipkt) 6983 { 6984 mblk_t *tmp, *buf_pkt; 6985 netstack_t *ns; 6986 ipsec_in_t *ii; 6987 6988 buf_pkt = (mblk_t *)ipkt; 6989 6990 ii = (ipsec_in_t *)buf_pkt->b_rptr; 6991 ASSERT(ii->ipsec_in_type == IPSEC_IN); 6992 ns = netstack_find_by_stackid(ii->ipsec_in_stackid); 6993 if (ns != NULL && ns != ii->ipsec_in_ns) { 6994 netstack_rele(ns); 6995 ns = NULL; /* For while-loop below. */ 6996 } 6997 6998 while (buf_pkt != NULL) { 6999 tmp = buf_pkt->b_next; 7000 buf_pkt->b_next = NULL; 7001 if (ns != NULL) 7002 ip_fanout_proto_again(buf_pkt, NULL, NULL, NULL); 7003 else 7004 freemsg(buf_pkt); 7005 buf_pkt = tmp; 7006 } 7007 if (ns != NULL) 7008 netstack_rele(ns); 7009 } 7010 /* 7011 * Walker callback used by sadb_alg_update() to free/create crypto 7012 * context template when a crypto software provider is removed or 7013 * added. 7014 */ 7015 7016 struct sadb_update_alg_state { 7017 ipsec_algtype_t alg_type; 7018 uint8_t alg_id; 7019 boolean_t is_added; 7020 }; 7021 7022 static void 7023 sadb_alg_update_cb(isaf_t *head, ipsa_t *entry, void *cookie) 7024 { 7025 struct sadb_update_alg_state *update_state = 7026 (struct sadb_update_alg_state *)cookie; 7027 crypto_ctx_template_t *ctx_tmpl = NULL; 7028 7029 ASSERT(MUTEX_HELD(&head->isaf_lock)); 7030 7031 if (entry->ipsa_state == IPSA_STATE_LARVAL) 7032 return; 7033 7034 mutex_enter(&entry->ipsa_lock); 7035 7036 switch (update_state->alg_type) { 7037 case IPSEC_ALG_AUTH: 7038 if (entry->ipsa_auth_alg == update_state->alg_id) 7039 ctx_tmpl = &entry->ipsa_authtmpl; 7040 break; 7041 case IPSEC_ALG_ENCR: 7042 if (entry->ipsa_encr_alg == update_state->alg_id) 7043 ctx_tmpl = &entry->ipsa_encrtmpl; 7044 break; 7045 default: 7046 ctx_tmpl = NULL; 7047 } 7048 7049 if (ctx_tmpl == NULL) { 7050 mutex_exit(&entry->ipsa_lock); 7051 return; 7052 } 7053 7054 /* 7055 * The context template of the SA may be affected by the change 7056 * of crypto provider. 7057 */ 7058 if (update_state->is_added) { 7059 /* create the context template if not already done */ 7060 if (*ctx_tmpl == NULL) { 7061 (void) ipsec_create_ctx_tmpl(entry, 7062 update_state->alg_type); 7063 } 7064 } else { 7065 /* 7066 * The crypto provider was removed. If the context template 7067 * exists but it is no longer valid, free it. 7068 */ 7069 if (*ctx_tmpl != NULL) 7070 ipsec_destroy_ctx_tmpl(entry, update_state->alg_type); 7071 } 7072 7073 mutex_exit(&entry->ipsa_lock); 7074 } 7075 7076 /* 7077 * Invoked by IP when an software crypto provider has been updated. 7078 * The type and id of the corresponding algorithm is passed as argument. 7079 * is_added is B_TRUE if the provider was added, B_FALSE if it was 7080 * removed. The function updates the SADB and free/creates the 7081 * context templates associated with SAs if needed. 7082 */ 7083 7084 #define SADB_ALG_UPDATE_WALK(sadb, table) \ 7085 sadb_walker((sadb).table, (sadb).sdb_hashsize, sadb_alg_update_cb, \ 7086 &update_state) 7087 7088 void 7089 sadb_alg_update(ipsec_algtype_t alg_type, uint8_t alg_id, boolean_t is_added, 7090 netstack_t *ns) 7091 { 7092 struct sadb_update_alg_state update_state; 7093 ipsecah_stack_t *ahstack = ns->netstack_ipsecah; 7094 ipsecesp_stack_t *espstack = ns->netstack_ipsecesp; 7095 7096 update_state.alg_type = alg_type; 7097 update_state.alg_id = alg_id; 7098 update_state.is_added = is_added; 7099 7100 if (alg_type == IPSEC_ALG_AUTH) { 7101 /* walk the AH tables only for auth. algorithm changes */ 7102 SADB_ALG_UPDATE_WALK(ahstack->ah_sadb.s_v4, sdb_of); 7103 SADB_ALG_UPDATE_WALK(ahstack->ah_sadb.s_v4, sdb_if); 7104 SADB_ALG_UPDATE_WALK(ahstack->ah_sadb.s_v6, sdb_of); 7105 SADB_ALG_UPDATE_WALK(ahstack->ah_sadb.s_v6, sdb_if); 7106 } 7107 7108 /* walk the ESP tables */ 7109 SADB_ALG_UPDATE_WALK(espstack->esp_sadb.s_v4, sdb_of); 7110 SADB_ALG_UPDATE_WALK(espstack->esp_sadb.s_v4, sdb_if); 7111 SADB_ALG_UPDATE_WALK(espstack->esp_sadb.s_v6, sdb_of); 7112 SADB_ALG_UPDATE_WALK(espstack->esp_sadb.s_v6, sdb_if); 7113 } 7114 7115 /* 7116 * Creates a context template for the specified SA. This function 7117 * is called when an SA is created and when a context template needs 7118 * to be created due to a change of software provider. 7119 */ 7120 int 7121 ipsec_create_ctx_tmpl(ipsa_t *sa, ipsec_algtype_t alg_type) 7122 { 7123 ipsec_alginfo_t *alg; 7124 crypto_mechanism_t mech; 7125 crypto_key_t *key; 7126 crypto_ctx_template_t *sa_tmpl; 7127 int rv; 7128 ipsec_stack_t *ipss = sa->ipsa_netstack->netstack_ipsec; 7129 7130 ASSERT(MUTEX_HELD(&ipss->ipsec_alg_lock)); 7131 ASSERT(MUTEX_HELD(&sa->ipsa_lock)); 7132 7133 /* get pointers to the algorithm info, context template, and key */ 7134 switch (alg_type) { 7135 case IPSEC_ALG_AUTH: 7136 key = &sa->ipsa_kcfauthkey; 7137 sa_tmpl = &sa->ipsa_authtmpl; 7138 alg = ipss->ipsec_alglists[alg_type][sa->ipsa_auth_alg]; 7139 break; 7140 case IPSEC_ALG_ENCR: 7141 key = &sa->ipsa_kcfencrkey; 7142 sa_tmpl = &sa->ipsa_encrtmpl; 7143 alg = ipss->ipsec_alglists[alg_type][sa->ipsa_encr_alg]; 7144 break; 7145 default: 7146 alg = NULL; 7147 } 7148 7149 if (alg == NULL || !ALG_VALID(alg)) 7150 return (EINVAL); 7151 7152 /* initialize the mech info structure for the framework */ 7153 ASSERT(alg->alg_mech_type != CRYPTO_MECHANISM_INVALID); 7154 mech.cm_type = alg->alg_mech_type; 7155 mech.cm_param = NULL; 7156 mech.cm_param_len = 0; 7157 7158 /* create a new context template */ 7159 rv = crypto_create_ctx_template(&mech, key, sa_tmpl, KM_NOSLEEP); 7160 7161 /* 7162 * CRYPTO_MECH_NOT_SUPPORTED can be returned if only hardware 7163 * providers are available for that mechanism. In that case 7164 * we don't fail, and will generate the context template from 7165 * the framework callback when a software provider for that 7166 * mechanism registers. 7167 * 7168 * The context template is assigned the special value 7169 * IPSEC_CTX_TMPL_ALLOC if the allocation failed due to a 7170 * lack of memory. No attempt will be made to use 7171 * the context template if it is set to this value. 7172 */ 7173 if (rv == CRYPTO_HOST_MEMORY) { 7174 *sa_tmpl = IPSEC_CTX_TMPL_ALLOC; 7175 } else if (rv != CRYPTO_SUCCESS) { 7176 *sa_tmpl = NULL; 7177 if (rv != CRYPTO_MECH_NOT_SUPPORTED) 7178 return (EINVAL); 7179 } 7180 7181 return (0); 7182 } 7183 7184 /* 7185 * Destroy the context template of the specified algorithm type 7186 * of the specified SA. Must be called while holding the SA lock. 7187 */ 7188 void 7189 ipsec_destroy_ctx_tmpl(ipsa_t *sa, ipsec_algtype_t alg_type) 7190 { 7191 ASSERT(MUTEX_HELD(&sa->ipsa_lock)); 7192 7193 if (alg_type == IPSEC_ALG_AUTH) { 7194 if (sa->ipsa_authtmpl == IPSEC_CTX_TMPL_ALLOC) 7195 sa->ipsa_authtmpl = NULL; 7196 else if (sa->ipsa_authtmpl != NULL) { 7197 crypto_destroy_ctx_template(sa->ipsa_authtmpl); 7198 sa->ipsa_authtmpl = NULL; 7199 } 7200 } else { 7201 ASSERT(alg_type == IPSEC_ALG_ENCR); 7202 if (sa->ipsa_encrtmpl == IPSEC_CTX_TMPL_ALLOC) 7203 sa->ipsa_encrtmpl = NULL; 7204 else if (sa->ipsa_encrtmpl != NULL) { 7205 crypto_destroy_ctx_template(sa->ipsa_encrtmpl); 7206 sa->ipsa_encrtmpl = NULL; 7207 } 7208 } 7209 } 7210 7211 /* 7212 * Use the kernel crypto framework to check the validity of a key received 7213 * via keysock. Returns 0 if the key is OK, -1 otherwise. 7214 */ 7215 int 7216 ipsec_check_key(crypto_mech_type_t mech_type, sadb_key_t *sadb_key, 7217 boolean_t is_auth, int *diag) 7218 { 7219 crypto_mechanism_t mech; 7220 crypto_key_t crypto_key; 7221 int crypto_rc; 7222 7223 mech.cm_type = mech_type; 7224 mech.cm_param = NULL; 7225 mech.cm_param_len = 0; 7226 7227 crypto_key.ck_format = CRYPTO_KEY_RAW; 7228 crypto_key.ck_data = sadb_key + 1; 7229 crypto_key.ck_length = sadb_key->sadb_key_bits; 7230 7231 crypto_rc = crypto_key_check(&mech, &crypto_key); 7232 7233 switch (crypto_rc) { 7234 case CRYPTO_SUCCESS: 7235 return (0); 7236 case CRYPTO_MECHANISM_INVALID: 7237 case CRYPTO_MECH_NOT_SUPPORTED: 7238 *diag = is_auth ? SADB_X_DIAGNOSTIC_BAD_AALG : 7239 SADB_X_DIAGNOSTIC_BAD_EALG; 7240 break; 7241 case CRYPTO_KEY_SIZE_RANGE: 7242 *diag = is_auth ? SADB_X_DIAGNOSTIC_BAD_AKEYBITS : 7243 SADB_X_DIAGNOSTIC_BAD_EKEYBITS; 7244 break; 7245 case CRYPTO_WEAK_KEY: 7246 *diag = is_auth ? SADB_X_DIAGNOSTIC_WEAK_AKEY : 7247 SADB_X_DIAGNOSTIC_WEAK_EKEY; 7248 break; 7249 } 7250 7251 return (-1); 7252 } 7253 /* 7254 * If this is an outgoing SA then add some fuzz to the 7255 * SOFT EXPIRE time. The reason for this is to stop 7256 * peers trying to renegotiate SOFT expiring SA's at 7257 * the same time. The amount of fuzz needs to be at 7258 * least 10 seconds which is the typical interval 7259 * sadb_ager(), although this is only a guide as it 7260 * selftunes. 7261 */ 7262 void 7263 lifetime_fuzz(ipsa_t *assoc) 7264 { 7265 uint8_t rnd; 7266 7267 if (assoc->ipsa_softaddlt == 0) 7268 return; 7269 7270 (void) random_get_pseudo_bytes(&rnd, sizeof (rnd)); 7271 rnd = (rnd & 0xF) + 10; 7272 assoc->ipsa_softexpiretime -= rnd; 7273 assoc->ipsa_softaddlt -= rnd; 7274 } 7275 void 7276 destroy_ipsa_pair(ipsap_t *ipsapp) 7277 { 7278 if (ipsapp == NULL) 7279 return; 7280 7281 /* 7282 * Because of the multi-line macro nature of IPSA_REFRELE, keep 7283 * them in { }. 7284 */ 7285 if (ipsapp->ipsap_sa_ptr != NULL) { 7286 IPSA_REFRELE(ipsapp->ipsap_sa_ptr); 7287 } 7288 if (ipsapp->ipsap_psa_ptr != NULL) { 7289 IPSA_REFRELE(ipsapp->ipsap_psa_ptr); 7290 } 7291 7292 kmem_free(ipsapp, sizeof (*ipsapp)); 7293 } 7294 7295 /* 7296 * The sadb_ager() function walks through the hash tables of SA's and ages 7297 * them, if the SA expires as a result, its marked as DEAD and will be reaped 7298 * the next time sadb_ager() runs. SA's which are paired or have a peer (same 7299 * SA appears in both the inbound and outbound tables because its not possible 7300 * to determine its direction) are placed on a list when they expire. This is 7301 * to ensure that pair/peer SA's are reaped at the same time, even if they 7302 * expire at different times. 7303 * 7304 * This function is called twice by sadb_ager(), one after processing the 7305 * inbound table, then again after processing the outbound table. 7306 */ 7307 void 7308 age_pair_peer_list(templist_t *haspeerlist, sadb_t *sp, boolean_t outbound) 7309 { 7310 templist_t *listptr; 7311 int outhash; 7312 isaf_t *bucket; 7313 boolean_t haspeer; 7314 ipsa_t *peer_assoc, *dying; 7315 /* 7316 * Haspeer cases will contain both IPv4 and IPv6. This code 7317 * is address independent. 7318 */ 7319 while (haspeerlist != NULL) { 7320 /* "dying" contains the SA that has a peer. */ 7321 dying = haspeerlist->ipsa; 7322 haspeer = (dying->ipsa_haspeer); 7323 listptr = haspeerlist; 7324 haspeerlist = listptr->next; 7325 kmem_free(listptr, sizeof (*listptr)); 7326 /* 7327 * Pick peer bucket based on addrfam. 7328 */ 7329 if (outbound) { 7330 if (haspeer) 7331 bucket = INBOUND_BUCKET(sp, dying->ipsa_spi); 7332 else 7333 bucket = INBOUND_BUCKET(sp, 7334 dying->ipsa_otherspi); 7335 } else { /* inbound */ 7336 if (haspeer) { 7337 if (dying->ipsa_addrfam == AF_INET6) { 7338 outhash = OUTBOUND_HASH_V6(sp, 7339 *((in6_addr_t *)&dying-> 7340 ipsa_dstaddr)); 7341 } else { 7342 outhash = OUTBOUND_HASH_V4(sp, 7343 *((ipaddr_t *)&dying-> 7344 ipsa_dstaddr)); 7345 } 7346 } else if (dying->ipsa_addrfam == AF_INET6) { 7347 outhash = OUTBOUND_HASH_V6(sp, 7348 *((in6_addr_t *)&dying-> 7349 ipsa_srcaddr)); 7350 } else { 7351 outhash = OUTBOUND_HASH_V4(sp, 7352 *((ipaddr_t *)&dying-> 7353 ipsa_srcaddr)); 7354 } 7355 bucket = &(sp->sdb_of[outhash]); 7356 } 7357 7358 mutex_enter(&bucket->isaf_lock); 7359 /* 7360 * "haspeer" SA's have the same src/dst address ordering, 7361 * "paired" SA's have the src/dst addresses reversed. 7362 */ 7363 if (haspeer) { 7364 peer_assoc = ipsec_getassocbyspi(bucket, 7365 dying->ipsa_spi, dying->ipsa_srcaddr, 7366 dying->ipsa_dstaddr, dying->ipsa_addrfam); 7367 } else { 7368 peer_assoc = ipsec_getassocbyspi(bucket, 7369 dying->ipsa_otherspi, dying->ipsa_dstaddr, 7370 dying->ipsa_srcaddr, dying->ipsa_addrfam); 7371 } 7372 7373 mutex_exit(&bucket->isaf_lock); 7374 if (peer_assoc != NULL) { 7375 mutex_enter(&peer_assoc->ipsa_lock); 7376 mutex_enter(&dying->ipsa_lock); 7377 if (!haspeer) { 7378 /* 7379 * Only SA's which have a "peer" or are 7380 * "paired" end up on this list, so this 7381 * must be a "paired" SA, update the flags 7382 * to break the pair. 7383 */ 7384 peer_assoc->ipsa_otherspi = 0; 7385 peer_assoc->ipsa_flags &= ~IPSA_F_PAIRED; 7386 dying->ipsa_otherspi = 0; 7387 dying->ipsa_flags &= ~IPSA_F_PAIRED; 7388 } 7389 if (haspeer || outbound) { 7390 /* 7391 * Update the state of the "inbound" SA when 7392 * the "outbound" SA has expired. Don't update 7393 * the "outbound" SA when the "inbound" SA 7394 * SA expires because setting the hard_addtime 7395 * below will cause this to happen. 7396 */ 7397 peer_assoc->ipsa_state = dying->ipsa_state; 7398 } 7399 if (dying->ipsa_state == IPSA_STATE_DEAD) 7400 peer_assoc->ipsa_hardexpiretime = 1; 7401 7402 mutex_exit(&dying->ipsa_lock); 7403 mutex_exit(&peer_assoc->ipsa_lock); 7404 IPSA_REFRELE(peer_assoc); 7405 } 7406 IPSA_REFRELE(dying); 7407 } 7408 } 7409