xref: /titanic_51/usr/src/uts/common/inet/ip/spd.c (revision c39ec06460092d7e823aedf427c9b7fc12d475af)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  */
25 
26 #pragma ident	"@(#)spd.c	1.61	08/07/15 SMI"
27 
28 /*
29  * IPsec Security Policy Database.
30  *
31  * This module maintains the SPD and provides routines used by ip and ip6
32  * to apply IPsec policy to inbound and outbound datagrams.
33  */
34 
35 #include <sys/types.h>
36 #include <sys/stream.h>
37 #include <sys/stropts.h>
38 #include <sys/sysmacros.h>
39 #include <sys/strsubr.h>
40 #include <sys/strlog.h>
41 #include <sys/cmn_err.h>
42 #include <sys/zone.h>
43 
44 #include <sys/systm.h>
45 #include <sys/param.h>
46 #include <sys/kmem.h>
47 #include <sys/ddi.h>
48 
49 #include <sys/crypto/api.h>
50 
51 #include <inet/common.h>
52 #include <inet/mi.h>
53 
54 #include <netinet/ip6.h>
55 #include <netinet/icmp6.h>
56 #include <netinet/udp.h>
57 
58 #include <inet/ip.h>
59 #include <inet/ip6.h>
60 
61 #include <net/pfkeyv2.h>
62 #include <net/pfpolicy.h>
63 #include <inet/ipsec_info.h>
64 #include <inet/sadb.h>
65 #include <inet/ipsec_impl.h>
66 
67 #include <inet/ip_impl.h>	/* For IP_MOD_ID */
68 
69 #include <inet/ipsecah.h>
70 #include <inet/ipsecesp.h>
71 #include <inet/ipdrop.h>
72 #include <inet/ipclassifier.h>
73 #include <inet/tun.h>
74 
75 static void ipsec_update_present_flags(ipsec_stack_t *);
76 static ipsec_act_t *ipsec_act_wildcard_expand(ipsec_act_t *, uint_t *,
77     netstack_t *);
78 static void ipsec_out_free(void *);
79 static void ipsec_in_free(void *);
80 static mblk_t *ipsec_attach_global_policy(mblk_t **, conn_t *,
81     ipsec_selector_t *, netstack_t *);
82 static mblk_t *ipsec_apply_global_policy(mblk_t *, conn_t *,
83     ipsec_selector_t *, netstack_t *);
84 static mblk_t *ipsec_check_ipsecin_policy(mblk_t *, ipsec_policy_t *,
85     ipha_t *, ip6_t *, uint64_t, netstack_t *);
86 static void ipsec_in_release_refs(ipsec_in_t *);
87 static void ipsec_out_release_refs(ipsec_out_t *);
88 static void ipsec_action_free_table(ipsec_action_t *);
89 static void ipsec_action_reclaim(void *);
90 static void ipsec_action_reclaim_stack(netstack_t *);
91 static void ipsid_init(netstack_t *);
92 static void ipsid_fini(netstack_t *);
93 
94 /* sel_flags values for ipsec_init_inbound_sel(). */
95 #define	SEL_NONE	0x0000
96 #define	SEL_PORT_POLICY	0x0001
97 #define	SEL_IS_ICMP	0x0002
98 #define	SEL_TUNNEL_MODE	0x0004
99 
100 /* Return values for ipsec_init_inbound_sel(). */
101 typedef enum { SELRET_NOMEM, SELRET_BADPKT, SELRET_SUCCESS, SELRET_TUNFRAG}
102     selret_t;
103 
104 static selret_t ipsec_init_inbound_sel(ipsec_selector_t *, mblk_t *,
105     ipha_t *, ip6_t *, uint8_t);
106 
107 static boolean_t ipsec_check_ipsecin_action(struct ipsec_in_s *, mblk_t *,
108     struct ipsec_action_s *, ipha_t *ipha, ip6_t *ip6h, const char **,
109     kstat_named_t **);
110 static void ipsec_unregister_prov_update(void);
111 static void ipsec_prov_update_callback_stack(uint32_t, void *, netstack_t *);
112 static boolean_t ipsec_compare_action(ipsec_policy_t *, ipsec_policy_t *);
113 static uint32_t selector_hash(ipsec_selector_t *, ipsec_policy_root_t *);
114 static boolean_t ipsec_kstat_init(ipsec_stack_t *);
115 static void ipsec_kstat_destroy(ipsec_stack_t *);
116 static int ipsec_free_tables(ipsec_stack_t *);
117 static int tunnel_compare(const void *, const void *);
118 static void ipsec_freemsg_chain(mblk_t *);
119 static void ip_drop_packet_chain(mblk_t *, boolean_t, ill_t *, ire_t *,
120     struct kstat_named *, ipdropper_t *);
121 static boolean_t ipsec_kstat_init(ipsec_stack_t *);
122 static void ipsec_kstat_destroy(ipsec_stack_t *);
123 static int ipsec_free_tables(ipsec_stack_t *);
124 static int tunnel_compare(const void *, const void *);
125 static void ipsec_freemsg_chain(mblk_t *);
126 static void ip_drop_packet_chain(mblk_t *, boolean_t, ill_t *, ire_t *,
127     struct kstat_named *, ipdropper_t *);
128 
129 /*
130  * Selector hash table is statically sized at module load time.
131  * we default to 251 buckets, which is the largest prime number under 255
132  */
133 
134 #define	IPSEC_SPDHASH_DEFAULT 251
135 
136 /* SPD hash-size tunable per tunnel. */
137 #define	TUN_SPDHASH_DEFAULT 5
138 
139 uint32_t ipsec_spd_hashsize;
140 uint32_t tun_spd_hashsize;
141 
142 #define	IPSEC_SEL_NOHASH ((uint32_t)(~0))
143 
144 /*
145  * Handle global across all stack instances
146  */
147 static crypto_notify_handle_t prov_update_handle = NULL;
148 
149 static kmem_cache_t *ipsec_action_cache;
150 static kmem_cache_t *ipsec_sel_cache;
151 static kmem_cache_t *ipsec_pol_cache;
152 static kmem_cache_t *ipsec_info_cache;
153 
154 /* Frag cache prototypes */
155 static void ipsec_fragcache_clean(ipsec_fragcache_t *);
156 static ipsec_fragcache_entry_t *fragcache_delentry(int,
157     ipsec_fragcache_entry_t *, ipsec_fragcache_t *);
158 boolean_t ipsec_fragcache_init(ipsec_fragcache_t *);
159 void ipsec_fragcache_uninit(ipsec_fragcache_t *);
160 mblk_t *ipsec_fragcache_add(ipsec_fragcache_t *, mblk_t *, mblk_t *, int,
161     ipsec_stack_t *);
162 
163 int ipsec_hdr_pullup_needed = 0;
164 int ipsec_weird_null_inbound_policy = 0;
165 
166 #define	ALGBITS_ROUND_DOWN(x, align)	(((x)/(align))*(align))
167 #define	ALGBITS_ROUND_UP(x, align)	ALGBITS_ROUND_DOWN((x)+(align)-1, align)
168 
169 /*
170  * Inbound traffic should have matching identities for both SA's.
171  */
172 
173 #define	SA_IDS_MATCH(sa1, sa2) 						\
174 	(((sa1) == NULL) || ((sa2) == NULL) ||				\
175 	(((sa1)->ipsa_src_cid == (sa2)->ipsa_src_cid) &&		\
176 	    (((sa1)->ipsa_dst_cid == (sa2)->ipsa_dst_cid))))
177 
178 /*
179  * IPv6 Fragments
180  */
181 #define	IS_V6_FRAGMENT(ipp)	(ipp.ipp_fields & IPPF_FRAGHDR)
182 
183 /*
184  * Policy failure messages.
185  */
186 static char *ipsec_policy_failure_msgs[] = {
187 
188 	/* IPSEC_POLICY_NOT_NEEDED */
189 	"%s: Dropping the datagram because the incoming packet "
190 	"is %s, but the recipient expects clear; Source %s, "
191 	"Destination %s.\n",
192 
193 	/* IPSEC_POLICY_MISMATCH */
194 	"%s: Policy Failure for the incoming packet (%s); Source %s, "
195 	"Destination %s.\n",
196 
197 	/* IPSEC_POLICY_AUTH_NOT_NEEDED	*/
198 	"%s: Authentication present while not expected in the "
199 	"incoming %s packet; Source %s, Destination %s.\n",
200 
201 	/* IPSEC_POLICY_ENCR_NOT_NEEDED */
202 	"%s: Encryption present while not expected in the "
203 	"incoming %s packet; Source %s, Destination %s.\n",
204 
205 	/* IPSEC_POLICY_SE_NOT_NEEDED */
206 	"%s: Self-Encapsulation present while not expected in the "
207 	"incoming %s packet; Source %s, Destination %s.\n",
208 };
209 
210 /*
211  * General overviews:
212  *
213  * Locking:
214  *
215  *	All of the system policy structures are protected by a single
216  *	rwlock.  These structures are threaded in a
217  *	fairly complex fashion and are not expected to change on a
218  *	regular basis, so this should not cause scaling/contention
219  *	problems.  As a result, policy checks should (hopefully) be MT-hot.
220  *
221  * Allocation policy:
222  *
223  *	We use custom kmem cache types for the various
224  *	bits & pieces of the policy data structures.  All allocations
225  *	use KM_NOSLEEP instead of KM_SLEEP for policy allocation.  The
226  *	policy table is of potentially unbounded size, so we don't
227  *	want to provide a way to hog all system memory with policy
228  *	entries..
229  */
230 
231 /* Convenient functions for freeing or dropping a b_next linked mblk chain */
232 
233 /* Free all messages in an mblk chain */
234 static void
235 ipsec_freemsg_chain(mblk_t *mp)
236 {
237 	mblk_t *mpnext;
238 	while (mp != NULL) {
239 		ASSERT(mp->b_prev == NULL);
240 		mpnext = mp->b_next;
241 		mp->b_next = NULL;
242 		freemsg(mp);	/* Always works, even if NULL */
243 		mp = mpnext;
244 	}
245 }
246 
247 /* ip_drop all messages in an mblk chain */
248 static void
249 ip_drop_packet_chain(mblk_t *mp, boolean_t inbound, ill_t *arriving,
250     ire_t *outbound_ire, struct kstat_named *counter, ipdropper_t *who_called)
251 {
252 	mblk_t *mpnext;
253 	while (mp != NULL) {
254 		ASSERT(mp->b_prev == NULL);
255 		mpnext = mp->b_next;
256 		mp->b_next = NULL;
257 		ip_drop_packet(mp, inbound, arriving, outbound_ire, counter,
258 		    who_called);
259 		mp = mpnext;
260 	}
261 }
262 
263 /*
264  * AVL tree comparison function.
265  * the in-kernel avl assumes unique keys for all objects.
266  * Since sometimes policy will duplicate rules, we may insert
267  * multiple rules with the same rule id, so we need a tie-breaker.
268  */
269 static int
270 ipsec_policy_cmpbyid(const void *a, const void *b)
271 {
272 	const ipsec_policy_t *ipa, *ipb;
273 	uint64_t idxa, idxb;
274 
275 	ipa = (const ipsec_policy_t *)a;
276 	ipb = (const ipsec_policy_t *)b;
277 	idxa = ipa->ipsp_index;
278 	idxb = ipb->ipsp_index;
279 
280 	if (idxa < idxb)
281 		return (-1);
282 	if (idxa > idxb)
283 		return (1);
284 	/*
285 	 * Tie-breaker #1: All installed policy rules have a non-NULL
286 	 * ipsl_sel (selector set), so an entry with a NULL ipsp_sel is not
287 	 * actually in-tree but rather a template node being used in
288 	 * an avl_find query; see ipsec_policy_delete().  This gives us
289 	 * a placeholder in the ordering just before the the first entry with
290 	 * a key >= the one we're looking for, so we can walk forward from
291 	 * that point to get the remaining entries with the same id.
292 	 */
293 	if ((ipa->ipsp_sel == NULL) && (ipb->ipsp_sel != NULL))
294 		return (-1);
295 	if ((ipb->ipsp_sel == NULL) && (ipa->ipsp_sel != NULL))
296 		return (1);
297 	/*
298 	 * At most one of the arguments to the comparison should have a
299 	 * NULL selector pointer; if not, the tree is broken.
300 	 */
301 	ASSERT(ipa->ipsp_sel != NULL);
302 	ASSERT(ipb->ipsp_sel != NULL);
303 	/*
304 	 * Tie-breaker #2: use the virtual address of the policy node
305 	 * to arbitrarily break ties.  Since we use the new tree node in
306 	 * the avl_find() in ipsec_insert_always, the new node will be
307 	 * inserted into the tree in the right place in the sequence.
308 	 */
309 	if (ipa < ipb)
310 		return (-1);
311 	if (ipa > ipb)
312 		return (1);
313 	return (0);
314 }
315 
316 /*
317  * Free what ipsec_alloc_table allocated.
318  */
319 void
320 ipsec_polhead_free_table(ipsec_policy_head_t *iph)
321 {
322 	int dir;
323 	int i;
324 
325 	for (dir = 0; dir < IPSEC_NTYPES; dir++) {
326 		ipsec_policy_root_t *ipr = &iph->iph_root[dir];
327 
328 		if (ipr->ipr_hash == NULL)
329 			continue;
330 
331 		for (i = 0; i < ipr->ipr_nchains; i++) {
332 			ASSERT(ipr->ipr_hash[i].hash_head == NULL);
333 		}
334 		kmem_free(ipr->ipr_hash, ipr->ipr_nchains *
335 		    sizeof (ipsec_policy_hash_t));
336 		ipr->ipr_hash = NULL;
337 	}
338 }
339 
340 void
341 ipsec_polhead_destroy(ipsec_policy_head_t *iph)
342 {
343 	int dir;
344 
345 	avl_destroy(&iph->iph_rulebyid);
346 	rw_destroy(&iph->iph_lock);
347 
348 	for (dir = 0; dir < IPSEC_NTYPES; dir++) {
349 		ipsec_policy_root_t *ipr = &iph->iph_root[dir];
350 		int chain;
351 
352 		for (chain = 0; chain < ipr->ipr_nchains; chain++)
353 			mutex_destroy(&(ipr->ipr_hash[chain].hash_lock));
354 
355 	}
356 	ipsec_polhead_free_table(iph);
357 }
358 
359 /*
360  * Free the IPsec stack instance.
361  */
362 /* ARGSUSED */
363 static void
364 ipsec_stack_fini(netstackid_t stackid, void *arg)
365 {
366 	ipsec_stack_t	*ipss = (ipsec_stack_t *)arg;
367 	void *cookie;
368 	ipsec_tun_pol_t *node;
369 	netstack_t	*ns = ipss->ipsec_netstack;
370 	int		i;
371 	ipsec_algtype_t	algtype;
372 
373 	ipsec_loader_destroy(ipss);
374 
375 	rw_enter(&ipss->ipsec_tunnel_policy_lock, RW_WRITER);
376 	/*
377 	 * It's possible we can just ASSERT() the tree is empty.  After all,
378 	 * we aren't called until IP is ready to unload (and presumably all
379 	 * tunnels have been unplumbed).  But we'll play it safe for now, the
380 	 * loop will just exit immediately if it's empty.
381 	 */
382 	cookie = NULL;
383 	while ((node = (ipsec_tun_pol_t *)
384 	    avl_destroy_nodes(&ipss->ipsec_tunnel_policies,
385 	    &cookie)) != NULL) {
386 		ITP_REFRELE(node, ns);
387 	}
388 	avl_destroy(&ipss->ipsec_tunnel_policies);
389 	rw_exit(&ipss->ipsec_tunnel_policy_lock);
390 	rw_destroy(&ipss->ipsec_tunnel_policy_lock);
391 
392 	ipsec_config_flush(ns);
393 
394 	ipsec_kstat_destroy(ipss);
395 
396 	ip_drop_unregister(&ipss->ipsec_dropper);
397 
398 	ip_drop_unregister(&ipss->ipsec_spd_dropper);
399 	ip_drop_destroy(ipss);
400 	/*
401 	 * Globals start with ref == 1 to prevent IPPH_REFRELE() from
402 	 * attempting to free them, hence they should have 1 now.
403 	 */
404 	ipsec_polhead_destroy(&ipss->ipsec_system_policy);
405 	ASSERT(ipss->ipsec_system_policy.iph_refs == 1);
406 	ipsec_polhead_destroy(&ipss->ipsec_inactive_policy);
407 	ASSERT(ipss->ipsec_inactive_policy.iph_refs == 1);
408 
409 	for (i = 0; i < IPSEC_ACTION_HASH_SIZE; i++) {
410 		ipsec_action_free_table(ipss->ipsec_action_hash[i].hash_head);
411 		ipss->ipsec_action_hash[i].hash_head = NULL;
412 		mutex_destroy(&(ipss->ipsec_action_hash[i].hash_lock));
413 	}
414 
415 	for (i = 0; i < ipss->ipsec_spd_hashsize; i++) {
416 		ASSERT(ipss->ipsec_sel_hash[i].hash_head == NULL);
417 		mutex_destroy(&(ipss->ipsec_sel_hash[i].hash_lock));
418 	}
419 
420 	mutex_enter(&ipss->ipsec_alg_lock);
421 	for (algtype = 0; algtype < IPSEC_NALGTYPES; algtype ++) {
422 		int nalgs = ipss->ipsec_nalgs[algtype];
423 
424 		for (i = 0; i < nalgs; i++) {
425 			if (ipss->ipsec_alglists[algtype][i] != NULL)
426 				ipsec_alg_unreg(algtype, i, ns);
427 		}
428 	}
429 	mutex_exit(&ipss->ipsec_alg_lock);
430 	mutex_destroy(&ipss->ipsec_alg_lock);
431 
432 	ipsid_gc(ns);
433 	ipsid_fini(ns);
434 
435 	(void) ipsec_free_tables(ipss);
436 	kmem_free(ipss, sizeof (*ipss));
437 }
438 
439 void
440 ipsec_policy_g_destroy(void)
441 {
442 	kmem_cache_destroy(ipsec_action_cache);
443 	kmem_cache_destroy(ipsec_sel_cache);
444 	kmem_cache_destroy(ipsec_pol_cache);
445 	kmem_cache_destroy(ipsec_info_cache);
446 
447 	ipsec_unregister_prov_update();
448 
449 	netstack_unregister(NS_IPSEC);
450 }
451 
452 
453 /*
454  * Free what ipsec_alloc_tables allocated.
455  * Called when table allocation fails to free the table.
456  */
457 static int
458 ipsec_free_tables(ipsec_stack_t *ipss)
459 {
460 	int i;
461 
462 	if (ipss->ipsec_sel_hash != NULL) {
463 		for (i = 0; i < ipss->ipsec_spd_hashsize; i++) {
464 			ASSERT(ipss->ipsec_sel_hash[i].hash_head == NULL);
465 		}
466 		kmem_free(ipss->ipsec_sel_hash, ipss->ipsec_spd_hashsize *
467 		    sizeof (*ipss->ipsec_sel_hash));
468 		ipss->ipsec_sel_hash = NULL;
469 		ipss->ipsec_spd_hashsize = 0;
470 	}
471 	ipsec_polhead_free_table(&ipss->ipsec_system_policy);
472 	ipsec_polhead_free_table(&ipss->ipsec_inactive_policy);
473 
474 	return (ENOMEM);
475 }
476 
477 /*
478  * Attempt to allocate the tables in a single policy head.
479  * Return nonzero on failure after cleaning up any work in progress.
480  */
481 int
482 ipsec_alloc_table(ipsec_policy_head_t *iph, int nchains, int kmflag,
483     boolean_t global_cleanup, netstack_t *ns)
484 {
485 	int dir;
486 
487 	for (dir = 0; dir < IPSEC_NTYPES; dir++) {
488 		ipsec_policy_root_t *ipr = &iph->iph_root[dir];
489 
490 		ipr->ipr_nchains = nchains;
491 		ipr->ipr_hash = kmem_zalloc(nchains *
492 		    sizeof (ipsec_policy_hash_t), kmflag);
493 		if (ipr->ipr_hash == NULL)
494 			return (global_cleanup ?
495 			    ipsec_free_tables(ns->netstack_ipsec) :
496 			    ENOMEM);
497 	}
498 	return (0);
499 }
500 
501 /*
502  * Attempt to allocate the various tables.  Return nonzero on failure
503  * after cleaning up any work in progress.
504  */
505 static int
506 ipsec_alloc_tables(int kmflag, netstack_t *ns)
507 {
508 	int error;
509 	ipsec_stack_t	*ipss = ns->netstack_ipsec;
510 
511 	error = ipsec_alloc_table(&ipss->ipsec_system_policy,
512 	    ipss->ipsec_spd_hashsize, kmflag, B_TRUE, ns);
513 	if (error != 0)
514 		return (error);
515 
516 	error = ipsec_alloc_table(&ipss->ipsec_inactive_policy,
517 	    ipss->ipsec_spd_hashsize, kmflag, B_TRUE, ns);
518 	if (error != 0)
519 		return (error);
520 
521 	ipss->ipsec_sel_hash = kmem_zalloc(ipss->ipsec_spd_hashsize *
522 	    sizeof (*ipss->ipsec_sel_hash), kmflag);
523 
524 	if (ipss->ipsec_sel_hash == NULL)
525 		return (ipsec_free_tables(ipss));
526 
527 	return (0);
528 }
529 
530 /*
531  * After table allocation, initialize a policy head.
532  */
533 void
534 ipsec_polhead_init(ipsec_policy_head_t *iph, int nchains)
535 {
536 	int dir, chain;
537 
538 	rw_init(&iph->iph_lock, NULL, RW_DEFAULT, NULL);
539 	avl_create(&iph->iph_rulebyid, ipsec_policy_cmpbyid,
540 	    sizeof (ipsec_policy_t), offsetof(ipsec_policy_t, ipsp_byid));
541 
542 	for (dir = 0; dir < IPSEC_NTYPES; dir++) {
543 		ipsec_policy_root_t *ipr = &iph->iph_root[dir];
544 		ipr->ipr_nchains = nchains;
545 
546 		for (chain = 0; chain < nchains; chain++) {
547 			mutex_init(&(ipr->ipr_hash[chain].hash_lock),
548 			    NULL, MUTEX_DEFAULT, NULL);
549 		}
550 	}
551 }
552 
553 static boolean_t
554 ipsec_kstat_init(ipsec_stack_t *ipss)
555 {
556 	ipss->ipsec_ksp = kstat_create_netstack("ip", 0, "ipsec_stat", "net",
557 	    KSTAT_TYPE_NAMED, sizeof (ipsec_kstats_t) / sizeof (kstat_named_t),
558 	    KSTAT_FLAG_PERSISTENT, ipss->ipsec_netstack->netstack_stackid);
559 
560 	if (ipss->ipsec_ksp == NULL || ipss->ipsec_ksp->ks_data == NULL)
561 		return (B_FALSE);
562 
563 	ipss->ipsec_kstats = ipss->ipsec_ksp->ks_data;
564 
565 #define	KI(x) kstat_named_init(&ipss->ipsec_kstats->x, #x, KSTAT_DATA_UINT64)
566 	KI(esp_stat_in_requests);
567 	KI(esp_stat_in_discards);
568 	KI(esp_stat_lookup_failure);
569 	KI(ah_stat_in_requests);
570 	KI(ah_stat_in_discards);
571 	KI(ah_stat_lookup_failure);
572 	KI(sadb_acquire_maxpackets);
573 	KI(sadb_acquire_qhiwater);
574 #undef KI
575 
576 	kstat_install(ipss->ipsec_ksp);
577 	return (B_TRUE);
578 }
579 
580 static void
581 ipsec_kstat_destroy(ipsec_stack_t *ipss)
582 {
583 	kstat_delete_netstack(ipss->ipsec_ksp,
584 	    ipss->ipsec_netstack->netstack_stackid);
585 	ipss->ipsec_kstats = NULL;
586 
587 }
588 
589 /*
590  * Initialize the IPsec stack instance.
591  */
592 /* ARGSUSED */
593 static void *
594 ipsec_stack_init(netstackid_t stackid, netstack_t *ns)
595 {
596 	ipsec_stack_t	*ipss;
597 	int i;
598 
599 	ipss = (ipsec_stack_t *)kmem_zalloc(sizeof (*ipss), KM_SLEEP);
600 	ipss->ipsec_netstack = ns;
601 
602 	/*
603 	 * FIXME: netstack_ipsec is used by some of the routines we call
604 	 * below, but it isn't set until this routine returns.
605 	 * Either we introduce optional xxx_stack_alloc() functions
606 	 * that will be called by the netstack framework before xxx_stack_init,
607 	 * or we switch spd.c and sadb.c to operate on ipsec_stack_t
608 	 * (latter has some include file order issues for sadb.h, but makes
609 	 * sense if we merge some of the ipsec related stack_t's together.
610 	 */
611 	ns->netstack_ipsec = ipss;
612 
613 	/*
614 	 * Make two attempts to allocate policy hash tables; try it at
615 	 * the "preferred" size (may be set in /etc/system) first,
616 	 * then fall back to the default size.
617 	 */
618 	ipss->ipsec_spd_hashsize = (ipsec_spd_hashsize == 0) ?
619 	    IPSEC_SPDHASH_DEFAULT : ipsec_spd_hashsize;
620 
621 	if (ipsec_alloc_tables(KM_NOSLEEP, ns) != 0) {
622 		cmn_err(CE_WARN,
623 		    "Unable to allocate %d entry IPsec policy hash table",
624 		    ipss->ipsec_spd_hashsize);
625 		ipss->ipsec_spd_hashsize = IPSEC_SPDHASH_DEFAULT;
626 		cmn_err(CE_WARN, "Falling back to %d entries",
627 		    ipss->ipsec_spd_hashsize);
628 		(void) ipsec_alloc_tables(KM_SLEEP, ns);
629 	}
630 
631 	/* Just set a default for tunnels. */
632 	ipss->ipsec_tun_spd_hashsize = (tun_spd_hashsize == 0) ?
633 	    TUN_SPDHASH_DEFAULT : tun_spd_hashsize;
634 
635 	ipsid_init(ns);
636 	/*
637 	 * Globals need ref == 1 to prevent IPPH_REFRELE() from attempting
638 	 * to free them.
639 	 */
640 	ipss->ipsec_system_policy.iph_refs = 1;
641 	ipss->ipsec_inactive_policy.iph_refs = 1;
642 	ipsec_polhead_init(&ipss->ipsec_system_policy,
643 	    ipss->ipsec_spd_hashsize);
644 	ipsec_polhead_init(&ipss->ipsec_inactive_policy,
645 	    ipss->ipsec_spd_hashsize);
646 	rw_init(&ipss->ipsec_tunnel_policy_lock, NULL, RW_DEFAULT, NULL);
647 	avl_create(&ipss->ipsec_tunnel_policies, tunnel_compare,
648 	    sizeof (ipsec_tun_pol_t), 0);
649 
650 	ipss->ipsec_next_policy_index = 1;
651 
652 	rw_init(&ipss->ipsec_system_policy.iph_lock, NULL, RW_DEFAULT, NULL);
653 	rw_init(&ipss->ipsec_inactive_policy.iph_lock, NULL, RW_DEFAULT, NULL);
654 
655 	for (i = 0; i < IPSEC_ACTION_HASH_SIZE; i++)
656 		mutex_init(&(ipss->ipsec_action_hash[i].hash_lock),
657 		    NULL, MUTEX_DEFAULT, NULL);
658 
659 	for (i = 0; i < ipss->ipsec_spd_hashsize; i++)
660 		mutex_init(&(ipss->ipsec_sel_hash[i].hash_lock),
661 		    NULL, MUTEX_DEFAULT, NULL);
662 
663 	mutex_init(&ipss->ipsec_alg_lock, NULL, MUTEX_DEFAULT, NULL);
664 	for (i = 0; i < IPSEC_NALGTYPES; i++) {
665 		ipss->ipsec_nalgs[i] = 0;
666 	}
667 
668 	ip_drop_init(ipss);
669 	ip_drop_register(&ipss->ipsec_spd_dropper, "IPsec SPD");
670 
671 	/* Set function to dummy until tun is loaded */
672 	rw_init(&ipss->ipsec_itp_get_byaddr_rw_lock, NULL, RW_DEFAULT, NULL);
673 	rw_enter(&ipss->ipsec_itp_get_byaddr_rw_lock, RW_WRITER);
674 	ipss->ipsec_itp_get_byaddr = itp_get_byaddr_dummy;
675 	rw_exit(&ipss->ipsec_itp_get_byaddr_rw_lock);
676 
677 	/* IP's IPsec code calls the packet dropper */
678 	ip_drop_register(&ipss->ipsec_dropper, "IP IPsec processing");
679 
680 	(void) ipsec_kstat_init(ipss);
681 
682 	ipsec_loader_init(ipss);
683 	ipsec_loader_start(ipss);
684 
685 	return (ipss);
686 }
687 
688 /* Global across all stack instances */
689 void
690 ipsec_policy_g_init(void)
691 {
692 	ipsec_action_cache = kmem_cache_create("ipsec_actions",
693 	    sizeof (ipsec_action_t), _POINTER_ALIGNMENT, NULL, NULL,
694 	    ipsec_action_reclaim, NULL, NULL, 0);
695 	ipsec_sel_cache = kmem_cache_create("ipsec_selectors",
696 	    sizeof (ipsec_sel_t), _POINTER_ALIGNMENT, NULL, NULL,
697 	    NULL, NULL, NULL, 0);
698 	ipsec_pol_cache = kmem_cache_create("ipsec_policy",
699 	    sizeof (ipsec_policy_t), _POINTER_ALIGNMENT, NULL, NULL,
700 	    NULL, NULL, NULL, 0);
701 	ipsec_info_cache = kmem_cache_create("ipsec_info",
702 	    sizeof (ipsec_info_t), _POINTER_ALIGNMENT, NULL, NULL,
703 	    NULL, NULL, NULL, 0);
704 
705 	/*
706 	 * We want to be informed each time a stack is created or
707 	 * destroyed in the kernel, so we can maintain the
708 	 * set of ipsec_stack_t's.
709 	 */
710 	netstack_register(NS_IPSEC, ipsec_stack_init, NULL, ipsec_stack_fini);
711 }
712 
713 /*
714  * Sort algorithm lists.
715  *
716  * I may need to split this based on
717  * authentication/encryption, and I may wish to have an administrator
718  * configure this list.  Hold on to some NDD variables...
719  *
720  * XXX For now, sort on minimum key size (GAG!).  While minimum key size is
721  * not the ideal metric, it's the only quantifiable measure available.
722  * We need a better metric for sorting algorithms by preference.
723  */
724 static void
725 alg_insert_sortlist(enum ipsec_algtype at, uint8_t algid, netstack_t *ns)
726 {
727 	ipsec_stack_t	*ipss = ns->netstack_ipsec;
728 	ipsec_alginfo_t *ai = ipss->ipsec_alglists[at][algid];
729 	uint8_t holder, swap;
730 	uint_t i;
731 	uint_t count = ipss->ipsec_nalgs[at];
732 	ASSERT(ai != NULL);
733 	ASSERT(algid == ai->alg_id);
734 
735 	ASSERT(MUTEX_HELD(&ipss->ipsec_alg_lock));
736 
737 	holder = algid;
738 
739 	for (i = 0; i < count - 1; i++) {
740 		ipsec_alginfo_t *alt;
741 
742 		alt = ipss->ipsec_alglists[at][ipss->ipsec_sortlist[at][i]];
743 		/*
744 		 * If you want to give precedence to newly added algs,
745 		 * add the = in the > comparison.
746 		 */
747 		if ((holder != algid) || (ai->alg_minbits > alt->alg_minbits)) {
748 			/* Swap sortlist[i] and holder. */
749 			swap = ipss->ipsec_sortlist[at][i];
750 			ipss->ipsec_sortlist[at][i] = holder;
751 			holder = swap;
752 			ai = alt;
753 		} /* Else just continue. */
754 	}
755 
756 	/* Store holder in last slot. */
757 	ipss->ipsec_sortlist[at][i] = holder;
758 }
759 
760 /*
761  * Remove an algorithm from a sorted algorithm list.
762  * This should be considerably easier, even with complex sorting.
763  */
764 static void
765 alg_remove_sortlist(enum ipsec_algtype at, uint8_t algid, netstack_t *ns)
766 {
767 	boolean_t copyback = B_FALSE;
768 	int i;
769 	ipsec_stack_t	*ipss = ns->netstack_ipsec;
770 	int newcount = ipss->ipsec_nalgs[at];
771 
772 	ASSERT(MUTEX_HELD(&ipss->ipsec_alg_lock));
773 
774 	for (i = 0; i <= newcount; i++) {
775 		if (copyback) {
776 			ipss->ipsec_sortlist[at][i-1] =
777 			    ipss->ipsec_sortlist[at][i];
778 		} else if (ipss->ipsec_sortlist[at][i] == algid) {
779 			copyback = B_TRUE;
780 		}
781 	}
782 }
783 
784 /*
785  * Add the specified algorithm to the algorithm tables.
786  * Must be called while holding the algorithm table writer lock.
787  */
788 void
789 ipsec_alg_reg(ipsec_algtype_t algtype, ipsec_alginfo_t *alg, netstack_t *ns)
790 {
791 	ipsec_stack_t	*ipss = ns->netstack_ipsec;
792 
793 	ASSERT(MUTEX_HELD(&ipss->ipsec_alg_lock));
794 
795 	ASSERT(ipss->ipsec_alglists[algtype][alg->alg_id] == NULL);
796 	ipsec_alg_fix_min_max(alg, algtype, ns);
797 	ipss->ipsec_alglists[algtype][alg->alg_id] = alg;
798 
799 	ipss->ipsec_nalgs[algtype]++;
800 	alg_insert_sortlist(algtype, alg->alg_id, ns);
801 }
802 
803 /*
804  * Remove the specified algorithm from the algorithm tables.
805  * Must be called while holding the algorithm table writer lock.
806  */
807 void
808 ipsec_alg_unreg(ipsec_algtype_t algtype, uint8_t algid, netstack_t *ns)
809 {
810 	ipsec_stack_t	*ipss = ns->netstack_ipsec;
811 
812 	ASSERT(MUTEX_HELD(&ipss->ipsec_alg_lock));
813 
814 	ASSERT(ipss->ipsec_alglists[algtype][algid] != NULL);
815 	ipsec_alg_free(ipss->ipsec_alglists[algtype][algid]);
816 	ipss->ipsec_alglists[algtype][algid] = NULL;
817 
818 	ipss->ipsec_nalgs[algtype]--;
819 	alg_remove_sortlist(algtype, algid, ns);
820 }
821 
822 /*
823  * Hooks for spdsock to get a grip on system policy.
824  */
825 
826 ipsec_policy_head_t *
827 ipsec_system_policy(netstack_t *ns)
828 {
829 	ipsec_stack_t	*ipss = ns->netstack_ipsec;
830 	ipsec_policy_head_t *h = &ipss->ipsec_system_policy;
831 
832 	IPPH_REFHOLD(h);
833 	return (h);
834 }
835 
836 ipsec_policy_head_t *
837 ipsec_inactive_policy(netstack_t *ns)
838 {
839 	ipsec_stack_t	*ipss = ns->netstack_ipsec;
840 	ipsec_policy_head_t *h = &ipss->ipsec_inactive_policy;
841 
842 	IPPH_REFHOLD(h);
843 	return (h);
844 }
845 
846 /*
847  * Lock inactive policy, then active policy, then exchange policy root
848  * pointers.
849  */
850 void
851 ipsec_swap_policy(ipsec_policy_head_t *active, ipsec_policy_head_t *inactive,
852     netstack_t *ns)
853 {
854 	int af, dir;
855 	avl_tree_t r1, r2;
856 
857 	rw_enter(&inactive->iph_lock, RW_WRITER);
858 	rw_enter(&active->iph_lock, RW_WRITER);
859 
860 	r1 = active->iph_rulebyid;
861 	r2 = inactive->iph_rulebyid;
862 	active->iph_rulebyid = r2;
863 	inactive->iph_rulebyid = r1;
864 
865 	for (dir = 0; dir < IPSEC_NTYPES; dir++) {
866 		ipsec_policy_hash_t *h1, *h2;
867 
868 		h1 = active->iph_root[dir].ipr_hash;
869 		h2 = inactive->iph_root[dir].ipr_hash;
870 		active->iph_root[dir].ipr_hash = h2;
871 		inactive->iph_root[dir].ipr_hash = h1;
872 
873 		for (af = 0; af < IPSEC_NAF; af++) {
874 			ipsec_policy_t *t1, *t2;
875 
876 			t1 = active->iph_root[dir].ipr_nonhash[af];
877 			t2 = inactive->iph_root[dir].ipr_nonhash[af];
878 			active->iph_root[dir].ipr_nonhash[af] = t2;
879 			inactive->iph_root[dir].ipr_nonhash[af] = t1;
880 			if (t1 != NULL) {
881 				t1->ipsp_hash.hash_pp =
882 				    &(inactive->iph_root[dir].ipr_nonhash[af]);
883 			}
884 			if (t2 != NULL) {
885 				t2->ipsp_hash.hash_pp =
886 				    &(active->iph_root[dir].ipr_nonhash[af]);
887 			}
888 
889 		}
890 	}
891 	active->iph_gen++;
892 	inactive->iph_gen++;
893 	ipsec_update_present_flags(ns->netstack_ipsec);
894 	rw_exit(&active->iph_lock);
895 	rw_exit(&inactive->iph_lock);
896 }
897 
898 /*
899  * Swap global policy primary/secondary.
900  */
901 void
902 ipsec_swap_global_policy(netstack_t *ns)
903 {
904 	ipsec_stack_t	*ipss = ns->netstack_ipsec;
905 
906 	ipsec_swap_policy(&ipss->ipsec_system_policy,
907 	    &ipss->ipsec_inactive_policy, ns);
908 }
909 
910 /*
911  * Clone one policy rule..
912  */
913 static ipsec_policy_t *
914 ipsec_copy_policy(const ipsec_policy_t *src)
915 {
916 	ipsec_policy_t *dst = kmem_cache_alloc(ipsec_pol_cache, KM_NOSLEEP);
917 
918 	if (dst == NULL)
919 		return (NULL);
920 
921 	/*
922 	 * Adjust refcounts of cloned state.
923 	 */
924 	IPACT_REFHOLD(src->ipsp_act);
925 	src->ipsp_sel->ipsl_refs++;
926 
927 	HASH_NULL(dst, ipsp_hash);
928 	dst->ipsp_refs = 1;
929 	dst->ipsp_sel = src->ipsp_sel;
930 	dst->ipsp_act = src->ipsp_act;
931 	dst->ipsp_prio = src->ipsp_prio;
932 	dst->ipsp_index = src->ipsp_index;
933 
934 	return (dst);
935 }
936 
937 void
938 ipsec_insert_always(avl_tree_t *tree, void *new_node)
939 {
940 	void *node;
941 	avl_index_t where;
942 
943 	node = avl_find(tree, new_node, &where);
944 	ASSERT(node == NULL);
945 	avl_insert(tree, new_node, where);
946 }
947 
948 
949 static int
950 ipsec_copy_chain(ipsec_policy_head_t *dph, ipsec_policy_t *src,
951     ipsec_policy_t **dstp)
952 {
953 	for (; src != NULL; src = src->ipsp_hash.hash_next) {
954 		ipsec_policy_t *dst = ipsec_copy_policy(src);
955 		if (dst == NULL)
956 			return (ENOMEM);
957 
958 		HASHLIST_INSERT(dst, ipsp_hash, *dstp);
959 		ipsec_insert_always(&dph->iph_rulebyid, dst);
960 	}
961 	return (0);
962 }
963 
964 
965 
966 /*
967  * Make one policy head look exactly like another.
968  *
969  * As with ipsec_swap_policy, we lock the destination policy head first, then
970  * the source policy head. Note that we only need to read-lock the source
971  * policy head as we are not changing it.
972  */
973 int
974 ipsec_copy_polhead(ipsec_policy_head_t *sph, ipsec_policy_head_t *dph,
975     netstack_t *ns)
976 {
977 	int af, dir, chain, nchains;
978 
979 	rw_enter(&dph->iph_lock, RW_WRITER);
980 
981 	ipsec_polhead_flush(dph, ns);
982 
983 	rw_enter(&sph->iph_lock, RW_READER);
984 
985 	for (dir = 0; dir < IPSEC_NTYPES; dir++) {
986 		ipsec_policy_root_t *dpr = &dph->iph_root[dir];
987 		ipsec_policy_root_t *spr = &sph->iph_root[dir];
988 		nchains = dpr->ipr_nchains;
989 
990 		ASSERT(dpr->ipr_nchains == spr->ipr_nchains);
991 
992 		for (af = 0; af < IPSEC_NAF; af++) {
993 			if (ipsec_copy_chain(dph, spr->ipr_nonhash[af],
994 			    &dpr->ipr_nonhash[af]))
995 				goto abort_copy;
996 		}
997 
998 		for (chain = 0; chain < nchains; chain++) {
999 			if (ipsec_copy_chain(dph,
1000 			    spr->ipr_hash[chain].hash_head,
1001 			    &dpr->ipr_hash[chain].hash_head))
1002 				goto abort_copy;
1003 		}
1004 	}
1005 
1006 	dph->iph_gen++;
1007 
1008 	rw_exit(&sph->iph_lock);
1009 	rw_exit(&dph->iph_lock);
1010 	return (0);
1011 
1012 abort_copy:
1013 	ipsec_polhead_flush(dph, ns);
1014 	rw_exit(&sph->iph_lock);
1015 	rw_exit(&dph->iph_lock);
1016 	return (ENOMEM);
1017 }
1018 
1019 /*
1020  * Clone currently active policy to the inactive policy list.
1021  */
1022 int
1023 ipsec_clone_system_policy(netstack_t *ns)
1024 {
1025 	ipsec_stack_t	*ipss = ns->netstack_ipsec;
1026 
1027 	return (ipsec_copy_polhead(&ipss->ipsec_system_policy,
1028 	    &ipss->ipsec_inactive_policy, ns));
1029 }
1030 
1031 /*
1032  * Generic "do we have IPvN policy" answer.
1033  */
1034 boolean_t
1035 iph_ipvN(ipsec_policy_head_t *iph, boolean_t v6)
1036 {
1037 	int i, hval;
1038 	uint32_t valbit;
1039 	ipsec_policy_root_t *ipr;
1040 	ipsec_policy_t *ipp;
1041 
1042 	if (v6) {
1043 		valbit = IPSL_IPV6;
1044 		hval = IPSEC_AF_V6;
1045 	} else {
1046 		valbit = IPSL_IPV4;
1047 		hval = IPSEC_AF_V4;
1048 	}
1049 
1050 	ASSERT(RW_LOCK_HELD(&iph->iph_lock));
1051 	for (ipr = iph->iph_root; ipr < &(iph->iph_root[IPSEC_NTYPES]); ipr++) {
1052 		if (ipr->ipr_nonhash[hval] != NULL)
1053 			return (B_TRUE);
1054 		for (i = 0; i < ipr->ipr_nchains; i++) {
1055 			for (ipp = ipr->ipr_hash[i].hash_head; ipp != NULL;
1056 			    ipp = ipp->ipsp_hash.hash_next) {
1057 				if (ipp->ipsp_sel->ipsl_key.ipsl_valid & valbit)
1058 					return (B_TRUE);
1059 			}
1060 		}
1061 	}
1062 
1063 	return (B_FALSE);
1064 }
1065 
1066 /*
1067  * Extract the string from ipsec_policy_failure_msgs[type] and
1068  * log it.
1069  *
1070  */
1071 void
1072 ipsec_log_policy_failure(int type, char *func_name, ipha_t *ipha, ip6_t *ip6h,
1073     boolean_t secure, netstack_t *ns)
1074 {
1075 	char	sbuf[INET6_ADDRSTRLEN];
1076 	char	dbuf[INET6_ADDRSTRLEN];
1077 	char	*s;
1078 	char	*d;
1079 	ipsec_stack_t	*ipss = ns->netstack_ipsec;
1080 
1081 	ASSERT((ipha == NULL && ip6h != NULL) ||
1082 	    (ip6h == NULL && ipha != NULL));
1083 
1084 	if (ipha != NULL) {
1085 		s = inet_ntop(AF_INET, &ipha->ipha_src, sbuf, sizeof (sbuf));
1086 		d = inet_ntop(AF_INET, &ipha->ipha_dst, dbuf, sizeof (dbuf));
1087 	} else {
1088 		s = inet_ntop(AF_INET6, &ip6h->ip6_src, sbuf, sizeof (sbuf));
1089 		d = inet_ntop(AF_INET6, &ip6h->ip6_dst, dbuf, sizeof (dbuf));
1090 
1091 	}
1092 
1093 	/* Always bump the policy failure counter. */
1094 	ipss->ipsec_policy_failure_count[type]++;
1095 
1096 	ipsec_rl_strlog(ns, IP_MOD_ID, 0, 0, SL_ERROR|SL_WARN|SL_CONSOLE,
1097 	    ipsec_policy_failure_msgs[type], func_name,
1098 	    (secure ? "secure" : "not secure"), s, d);
1099 }
1100 
1101 /*
1102  * Rate-limiting front-end to strlog() for AH and ESP.	Uses the ndd variables
1103  * in /dev/ip and the same rate-limiting clock so that there's a single
1104  * knob to turn to throttle the rate of messages.
1105  */
1106 void
1107 ipsec_rl_strlog(netstack_t *ns, short mid, short sid, char level, ushort_t sl,
1108     char *fmt, ...)
1109 {
1110 	va_list adx;
1111 	hrtime_t current = gethrtime();
1112 	ip_stack_t	*ipst = ns->netstack_ip;
1113 	ipsec_stack_t	*ipss = ns->netstack_ipsec;
1114 
1115 	sl |= SL_CONSOLE;
1116 	/*
1117 	 * Throttle logging to stop syslog from being swamped. If variable
1118 	 * 'ipsec_policy_log_interval' is zero, don't log any messages at
1119 	 * all, otherwise log only one message every 'ipsec_policy_log_interval'
1120 	 * msec. Convert interval (in msec) to hrtime (in nsec).
1121 	 */
1122 
1123 	if (ipst->ips_ipsec_policy_log_interval) {
1124 		if (ipss->ipsec_policy_failure_last +
1125 		    ((hrtime_t)ipst->ips_ipsec_policy_log_interval *
1126 		    (hrtime_t)1000000) <= current) {
1127 			va_start(adx, fmt);
1128 			(void) vstrlog(mid, sid, level, sl, fmt, adx);
1129 			va_end(adx);
1130 			ipss->ipsec_policy_failure_last = current;
1131 		}
1132 	}
1133 }
1134 
1135 void
1136 ipsec_config_flush(netstack_t *ns)
1137 {
1138 	ipsec_stack_t	*ipss = ns->netstack_ipsec;
1139 
1140 	rw_enter(&ipss->ipsec_system_policy.iph_lock, RW_WRITER);
1141 	ipsec_polhead_flush(&ipss->ipsec_system_policy, ns);
1142 	ipss->ipsec_next_policy_index = 1;
1143 	rw_exit(&ipss->ipsec_system_policy.iph_lock);
1144 	ipsec_action_reclaim_stack(ns);
1145 }
1146 
1147 /*
1148  * Clip a policy's min/max keybits vs. the capabilities of the
1149  * algorithm.
1150  */
1151 static void
1152 act_alg_adjust(uint_t algtype, uint_t algid,
1153     uint16_t *minbits, uint16_t *maxbits, netstack_t *ns)
1154 {
1155 	ipsec_stack_t	*ipss = ns->netstack_ipsec;
1156 	ipsec_alginfo_t *algp = ipss->ipsec_alglists[algtype][algid];
1157 
1158 	if (algp != NULL) {
1159 		/*
1160 		 * If passed-in minbits is zero, we assume the caller trusts
1161 		 * us with setting the minimum key size.  We pick the
1162 		 * algorithms DEFAULT key size for the minimum in this case.
1163 		 */
1164 		if (*minbits == 0) {
1165 			*minbits = algp->alg_default_bits;
1166 			ASSERT(*minbits >= algp->alg_minbits);
1167 		} else {
1168 			*minbits = MAX(MIN(*minbits, algp->alg_maxbits),
1169 			    algp->alg_minbits);
1170 		}
1171 		if (*maxbits == 0)
1172 			*maxbits = algp->alg_maxbits;
1173 		else
1174 			*maxbits = MIN(MAX(*maxbits, algp->alg_minbits),
1175 			    algp->alg_maxbits);
1176 		ASSERT(*minbits <= *maxbits);
1177 	} else {
1178 		*minbits = 0;
1179 		*maxbits = 0;
1180 	}
1181 }
1182 
1183 /*
1184  * Check an action's requested algorithms against the algorithms currently
1185  * loaded in the system.
1186  */
1187 boolean_t
1188 ipsec_check_action(ipsec_act_t *act, int *diag, netstack_t *ns)
1189 {
1190 	ipsec_prot_t *ipp;
1191 	ipsec_stack_t	*ipss = ns->netstack_ipsec;
1192 
1193 	ipp = &act->ipa_apply;
1194 
1195 	if (ipp->ipp_use_ah &&
1196 	    ipss->ipsec_alglists[IPSEC_ALG_AUTH][ipp->ipp_auth_alg] == NULL) {
1197 		*diag = SPD_DIAGNOSTIC_UNSUPP_AH_ALG;
1198 		return (B_FALSE);
1199 	}
1200 	if (ipp->ipp_use_espa &&
1201 	    ipss->ipsec_alglists[IPSEC_ALG_AUTH][ipp->ipp_esp_auth_alg] ==
1202 	    NULL) {
1203 		*diag = SPD_DIAGNOSTIC_UNSUPP_ESP_AUTH_ALG;
1204 		return (B_FALSE);
1205 	}
1206 	if (ipp->ipp_use_esp &&
1207 	    ipss->ipsec_alglists[IPSEC_ALG_ENCR][ipp->ipp_encr_alg] == NULL) {
1208 		*diag = SPD_DIAGNOSTIC_UNSUPP_ESP_ENCR_ALG;
1209 		return (B_FALSE);
1210 	}
1211 
1212 	act_alg_adjust(IPSEC_ALG_AUTH, ipp->ipp_auth_alg,
1213 	    &ipp->ipp_ah_minbits, &ipp->ipp_ah_maxbits, ns);
1214 	act_alg_adjust(IPSEC_ALG_AUTH, ipp->ipp_esp_auth_alg,
1215 	    &ipp->ipp_espa_minbits, &ipp->ipp_espa_maxbits, ns);
1216 	act_alg_adjust(IPSEC_ALG_ENCR, ipp->ipp_encr_alg,
1217 	    &ipp->ipp_espe_minbits, &ipp->ipp_espe_maxbits, ns);
1218 
1219 	if (ipp->ipp_ah_minbits > ipp->ipp_ah_maxbits) {
1220 		*diag = SPD_DIAGNOSTIC_UNSUPP_AH_KEYSIZE;
1221 		return (B_FALSE);
1222 	}
1223 	if (ipp->ipp_espa_minbits > ipp->ipp_espa_maxbits) {
1224 		*diag = SPD_DIAGNOSTIC_UNSUPP_ESP_AUTH_KEYSIZE;
1225 		return (B_FALSE);
1226 	}
1227 	if (ipp->ipp_espe_minbits > ipp->ipp_espe_maxbits) {
1228 		*diag = SPD_DIAGNOSTIC_UNSUPP_ESP_ENCR_KEYSIZE;
1229 		return (B_FALSE);
1230 	}
1231 	/* TODO: sanity check lifetimes */
1232 	return (B_TRUE);
1233 }
1234 
1235 /*
1236  * Set up a single action during wildcard expansion..
1237  */
1238 static void
1239 ipsec_setup_act(ipsec_act_t *outact, ipsec_act_t *act,
1240     uint_t auth_alg, uint_t encr_alg, uint_t eauth_alg, netstack_t *ns)
1241 {
1242 	ipsec_prot_t *ipp;
1243 
1244 	*outact = *act;
1245 	ipp = &outact->ipa_apply;
1246 	ipp->ipp_auth_alg = (uint8_t)auth_alg;
1247 	ipp->ipp_encr_alg = (uint8_t)encr_alg;
1248 	ipp->ipp_esp_auth_alg = (uint8_t)eauth_alg;
1249 
1250 	act_alg_adjust(IPSEC_ALG_AUTH, auth_alg,
1251 	    &ipp->ipp_ah_minbits, &ipp->ipp_ah_maxbits, ns);
1252 	act_alg_adjust(IPSEC_ALG_AUTH, eauth_alg,
1253 	    &ipp->ipp_espa_minbits, &ipp->ipp_espa_maxbits, ns);
1254 	act_alg_adjust(IPSEC_ALG_ENCR, encr_alg,
1255 	    &ipp->ipp_espe_minbits, &ipp->ipp_espe_maxbits, ns);
1256 }
1257 
1258 /*
1259  * combinatoric expansion time: expand a wildcarded action into an
1260  * array of wildcarded actions; we return the exploded action list,
1261  * and return a count in *nact (output only).
1262  */
1263 static ipsec_act_t *
1264 ipsec_act_wildcard_expand(ipsec_act_t *act, uint_t *nact, netstack_t *ns)
1265 {
1266 	boolean_t use_ah, use_esp, use_espa;
1267 	boolean_t wild_auth, wild_encr, wild_eauth;
1268 	uint_t	auth_alg, auth_idx, auth_min, auth_max;
1269 	uint_t	eauth_alg, eauth_idx, eauth_min, eauth_max;
1270 	uint_t  encr_alg, encr_idx, encr_min, encr_max;
1271 	uint_t	action_count, ai;
1272 	ipsec_act_t *outact;
1273 	ipsec_stack_t	*ipss = ns->netstack_ipsec;
1274 
1275 	if (act->ipa_type != IPSEC_ACT_APPLY) {
1276 		outact = kmem_alloc(sizeof (*act), KM_NOSLEEP);
1277 		*nact = 1;
1278 		if (outact != NULL)
1279 			bcopy(act, outact, sizeof (*act));
1280 		return (outact);
1281 	}
1282 	/*
1283 	 * compute the combinatoric explosion..
1284 	 *
1285 	 * we assume a request for encr if esp_req is PREF_REQUIRED
1286 	 * we assume a request for ah auth if ah_req is PREF_REQUIRED.
1287 	 * we assume a request for esp auth if !ah and esp_req is PREF_REQUIRED
1288 	 */
1289 
1290 	use_ah = act->ipa_apply.ipp_use_ah;
1291 	use_esp = act->ipa_apply.ipp_use_esp;
1292 	use_espa = act->ipa_apply.ipp_use_espa;
1293 	auth_alg = act->ipa_apply.ipp_auth_alg;
1294 	eauth_alg = act->ipa_apply.ipp_esp_auth_alg;
1295 	encr_alg = act->ipa_apply.ipp_encr_alg;
1296 
1297 	wild_auth = use_ah && (auth_alg == 0);
1298 	wild_eauth = use_espa && (eauth_alg == 0);
1299 	wild_encr = use_esp && (encr_alg == 0);
1300 
1301 	action_count = 1;
1302 	auth_min = auth_max = auth_alg;
1303 	eauth_min = eauth_max = eauth_alg;
1304 	encr_min = encr_max = encr_alg;
1305 
1306 	/*
1307 	 * set up for explosion.. for each dimension, expand output
1308 	 * size by the explosion factor.
1309 	 *
1310 	 * Don't include the "any" algorithms, if defined, as no
1311 	 * kernel policies should be set for these algorithms.
1312 	 */
1313 
1314 #define	SET_EXP_MINMAX(type, wild, alg, min, max, ipss)		\
1315 	if (wild) {						\
1316 		int nalgs = ipss->ipsec_nalgs[type];		\
1317 		if (ipss->ipsec_alglists[type][alg] != NULL)	\
1318 			nalgs--;				\
1319 		action_count *= nalgs;				\
1320 		min = 0;					\
1321 		max = ipss->ipsec_nalgs[type] - 1;		\
1322 	}
1323 
1324 	SET_EXP_MINMAX(IPSEC_ALG_AUTH, wild_auth, SADB_AALG_NONE,
1325 	    auth_min, auth_max, ipss);
1326 	SET_EXP_MINMAX(IPSEC_ALG_AUTH, wild_eauth, SADB_AALG_NONE,
1327 	    eauth_min, eauth_max, ipss);
1328 	SET_EXP_MINMAX(IPSEC_ALG_ENCR, wild_encr, SADB_EALG_NONE,
1329 	    encr_min, encr_max, ipss);
1330 
1331 #undef	SET_EXP_MINMAX
1332 
1333 	/*
1334 	 * ok, allocate the whole mess..
1335 	 */
1336 
1337 	outact = kmem_alloc(sizeof (*outact) * action_count, KM_NOSLEEP);
1338 	if (outact == NULL)
1339 		return (NULL);
1340 
1341 	/*
1342 	 * Now compute all combinations.  Note that non-wildcarded
1343 	 * dimensions just get a single value from auth_min, while
1344 	 * wildcarded dimensions indirect through the sortlist.
1345 	 *
1346 	 * We do encryption outermost since, at this time, there's
1347 	 * greater difference in security and performance between
1348 	 * encryption algorithms vs. authentication algorithms.
1349 	 */
1350 
1351 	ai = 0;
1352 
1353 #define	WHICH_ALG(type, wild, idx, ipss) \
1354 	((wild)?(ipss->ipsec_sortlist[type][idx]):(idx))
1355 
1356 	for (encr_idx = encr_min; encr_idx <= encr_max; encr_idx++) {
1357 		encr_alg = WHICH_ALG(IPSEC_ALG_ENCR, wild_encr, encr_idx, ipss);
1358 		if (wild_encr && encr_alg == SADB_EALG_NONE)
1359 			continue;
1360 		for (auth_idx = auth_min; auth_idx <= auth_max; auth_idx++) {
1361 			auth_alg = WHICH_ALG(IPSEC_ALG_AUTH, wild_auth,
1362 			    auth_idx, ipss);
1363 			if (wild_auth && auth_alg == SADB_AALG_NONE)
1364 				continue;
1365 			for (eauth_idx = eauth_min; eauth_idx <= eauth_max;
1366 			    eauth_idx++) {
1367 				eauth_alg = WHICH_ALG(IPSEC_ALG_AUTH,
1368 				    wild_eauth, eauth_idx, ipss);
1369 				if (wild_eauth && eauth_alg == SADB_AALG_NONE)
1370 					continue;
1371 
1372 				ipsec_setup_act(&outact[ai], act,
1373 				    auth_alg, encr_alg, eauth_alg, ns);
1374 				ai++;
1375 			}
1376 		}
1377 	}
1378 
1379 #undef WHICH_ALG
1380 
1381 	ASSERT(ai == action_count);
1382 	*nact = action_count;
1383 	return (outact);
1384 }
1385 
1386 /*
1387  * Extract the parts of an ipsec_prot_t from an old-style ipsec_req_t.
1388  */
1389 static void
1390 ipsec_prot_from_req(ipsec_req_t *req, ipsec_prot_t *ipp)
1391 {
1392 	bzero(ipp, sizeof (*ipp));
1393 	/*
1394 	 * ipp_use_* are bitfields.  Look at "!!" in the following as a
1395 	 * "boolean canonicalization" operator.
1396 	 */
1397 	ipp->ipp_use_ah = !!(req->ipsr_ah_req & IPSEC_PREF_REQUIRED);
1398 	ipp->ipp_use_esp = !!(req->ipsr_esp_req & IPSEC_PREF_REQUIRED);
1399 	ipp->ipp_use_espa = !!(req->ipsr_esp_auth_alg);
1400 	ipp->ipp_use_se = !!(req->ipsr_self_encap_req & IPSEC_PREF_REQUIRED);
1401 	ipp->ipp_use_unique = !!((req->ipsr_ah_req|req->ipsr_esp_req) &
1402 	    IPSEC_PREF_UNIQUE);
1403 	ipp->ipp_encr_alg = req->ipsr_esp_alg;
1404 	/*
1405 	 * SADB_AALG_ANY is a placeholder to distinguish "any" from
1406 	 * "none" above.  If auth is required, as determined above,
1407 	 * SADB_AALG_ANY becomes 0, which is the representation
1408 	 * of "any" and "none" in PF_KEY v2.
1409 	 */
1410 	ipp->ipp_auth_alg = (req->ipsr_auth_alg != SADB_AALG_ANY) ?
1411 	    req->ipsr_auth_alg : 0;
1412 	ipp->ipp_esp_auth_alg = (req->ipsr_esp_auth_alg != SADB_AALG_ANY) ?
1413 	    req->ipsr_esp_auth_alg : 0;
1414 }
1415 
1416 /*
1417  * Extract a new-style action from a request.
1418  */
1419 void
1420 ipsec_actvec_from_req(ipsec_req_t *req, ipsec_act_t **actp, uint_t *nactp,
1421     netstack_t *ns)
1422 {
1423 	struct ipsec_act act;
1424 
1425 	bzero(&act, sizeof (act));
1426 	if ((req->ipsr_ah_req & IPSEC_PREF_NEVER) &&
1427 	    (req->ipsr_esp_req & IPSEC_PREF_NEVER)) {
1428 		act.ipa_type = IPSEC_ACT_BYPASS;
1429 	} else {
1430 		act.ipa_type = IPSEC_ACT_APPLY;
1431 		ipsec_prot_from_req(req, &act.ipa_apply);
1432 	}
1433 	*actp = ipsec_act_wildcard_expand(&act, nactp, ns);
1434 }
1435 
1436 /*
1437  * Convert a new-style "prot" back to an ipsec_req_t (more backwards compat).
1438  * We assume caller has already zero'ed *req for us.
1439  */
1440 static int
1441 ipsec_req_from_prot(ipsec_prot_t *ipp, ipsec_req_t *req)
1442 {
1443 	req->ipsr_esp_alg = ipp->ipp_encr_alg;
1444 	req->ipsr_auth_alg = ipp->ipp_auth_alg;
1445 	req->ipsr_esp_auth_alg = ipp->ipp_esp_auth_alg;
1446 
1447 	if (ipp->ipp_use_unique) {
1448 		req->ipsr_ah_req |= IPSEC_PREF_UNIQUE;
1449 		req->ipsr_esp_req |= IPSEC_PREF_UNIQUE;
1450 	}
1451 	if (ipp->ipp_use_se)
1452 		req->ipsr_self_encap_req |= IPSEC_PREF_REQUIRED;
1453 	if (ipp->ipp_use_ah)
1454 		req->ipsr_ah_req |= IPSEC_PREF_REQUIRED;
1455 	if (ipp->ipp_use_esp)
1456 		req->ipsr_esp_req |= IPSEC_PREF_REQUIRED;
1457 	return (sizeof (*req));
1458 }
1459 
1460 /*
1461  * Convert a new-style action back to an ipsec_req_t (more backwards compat).
1462  * We assume caller has already zero'ed *req for us.
1463  */
1464 static int
1465 ipsec_req_from_act(ipsec_action_t *ap, ipsec_req_t *req)
1466 {
1467 	switch (ap->ipa_act.ipa_type) {
1468 	case IPSEC_ACT_BYPASS:
1469 		req->ipsr_ah_req = IPSEC_PREF_NEVER;
1470 		req->ipsr_esp_req = IPSEC_PREF_NEVER;
1471 		return (sizeof (*req));
1472 	case IPSEC_ACT_APPLY:
1473 		return (ipsec_req_from_prot(&ap->ipa_act.ipa_apply, req));
1474 	}
1475 	return (sizeof (*req));
1476 }
1477 
1478 /*
1479  * Convert a new-style action back to an ipsec_req_t (more backwards compat).
1480  * We assume caller has already zero'ed *req for us.
1481  */
1482 int
1483 ipsec_req_from_head(ipsec_policy_head_t *ph, ipsec_req_t *req, int af)
1484 {
1485 	ipsec_policy_t *p;
1486 
1487 	/*
1488 	 * FULL-PERSOCK: consult hash table, too?
1489 	 */
1490 	for (p = ph->iph_root[IPSEC_INBOUND].ipr_nonhash[af];
1491 	    p != NULL;
1492 	    p = p->ipsp_hash.hash_next) {
1493 		if ((p->ipsp_sel->ipsl_key.ipsl_valid & IPSL_WILDCARD) == 0)
1494 			return (ipsec_req_from_act(p->ipsp_act, req));
1495 	}
1496 	return (sizeof (*req));
1497 }
1498 
1499 /*
1500  * Based on per-socket or latched policy, convert to an appropriate
1501  * IP_SEC_OPT ipsec_req_t for the socket option; return size so we can
1502  * be tail-called from ip.
1503  */
1504 int
1505 ipsec_req_from_conn(conn_t *connp, ipsec_req_t *req, int af)
1506 {
1507 	ipsec_latch_t *ipl;
1508 	int rv = sizeof (ipsec_req_t);
1509 
1510 	bzero(req, sizeof (*req));
1511 
1512 	mutex_enter(&connp->conn_lock);
1513 	ipl = connp->conn_latch;
1514 
1515 	/*
1516 	 * Find appropriate policy.  First choice is latched action;
1517 	 * failing that, see latched policy; failing that,
1518 	 * look at configured policy.
1519 	 */
1520 	if (ipl != NULL) {
1521 		if (ipl->ipl_in_action != NULL) {
1522 			rv = ipsec_req_from_act(ipl->ipl_in_action, req);
1523 			goto done;
1524 		}
1525 		if (ipl->ipl_in_policy != NULL) {
1526 			rv = ipsec_req_from_act(ipl->ipl_in_policy->ipsp_act,
1527 			    req);
1528 			goto done;
1529 		}
1530 	}
1531 	if (connp->conn_policy != NULL)
1532 		rv = ipsec_req_from_head(connp->conn_policy, req, af);
1533 done:
1534 	mutex_exit(&connp->conn_lock);
1535 	return (rv);
1536 }
1537 
1538 void
1539 ipsec_actvec_free(ipsec_act_t *act, uint_t nact)
1540 {
1541 	kmem_free(act, nact * sizeof (*act));
1542 }
1543 
1544 /*
1545  * When outbound policy is not cached, look it up the hard way and attach
1546  * an ipsec_out_t to the packet..
1547  */
1548 static mblk_t *
1549 ipsec_attach_global_policy(mblk_t **mp, conn_t *connp, ipsec_selector_t *sel,
1550     netstack_t *ns)
1551 {
1552 	ipsec_policy_t *p;
1553 
1554 	p = ipsec_find_policy(IPSEC_TYPE_OUTBOUND, connp, NULL, sel, ns);
1555 
1556 	if (p == NULL)
1557 		return (NULL);
1558 	return (ipsec_attach_ipsec_out(mp, connp, p, sel->ips_protocol, ns));
1559 }
1560 
1561 /*
1562  * We have an ipsec_out already, but don't have cached policy; fill it in
1563  * with the right actions.
1564  */
1565 static mblk_t *
1566 ipsec_apply_global_policy(mblk_t *ipsec_mp, conn_t *connp,
1567     ipsec_selector_t *sel, netstack_t *ns)
1568 {
1569 	ipsec_out_t *io;
1570 	ipsec_policy_t *p;
1571 
1572 	ASSERT(ipsec_mp->b_datap->db_type == M_CTL);
1573 	ASSERT(ipsec_mp->b_cont->b_datap->db_type == M_DATA);
1574 
1575 	io = (ipsec_out_t *)ipsec_mp->b_rptr;
1576 
1577 	if (io->ipsec_out_policy == NULL) {
1578 		p = ipsec_find_policy(IPSEC_TYPE_OUTBOUND, connp, io, sel, ns);
1579 		io->ipsec_out_policy = p;
1580 	}
1581 	return (ipsec_mp);
1582 }
1583 
1584 
1585 /*
1586  * Consumes a reference to ipsp.
1587  */
1588 static mblk_t *
1589 ipsec_check_loopback_policy(mblk_t *first_mp, boolean_t mctl_present,
1590     ipsec_policy_t *ipsp)
1591 {
1592 	mblk_t *ipsec_mp;
1593 	ipsec_in_t *ii;
1594 	netstack_t	*ns;
1595 
1596 	if (!mctl_present)
1597 		return (first_mp);
1598 
1599 	ipsec_mp = first_mp;
1600 
1601 	ii = (ipsec_in_t *)ipsec_mp->b_rptr;
1602 	ns = ii->ipsec_in_ns;
1603 	ASSERT(ii->ipsec_in_loopback);
1604 	IPPOL_REFRELE(ipsp, ns);
1605 
1606 	/*
1607 	 * We should do an actual policy check here.  Revisit this
1608 	 * when we revisit the IPsec API.  (And pass a conn_t in when we
1609 	 * get there.)
1610 	 */
1611 
1612 	return (first_mp);
1613 }
1614 
1615 /*
1616  * Check that packet's inbound ports & proto match the selectors
1617  * expected by the SAs it traversed on the way in.
1618  */
1619 static boolean_t
1620 ipsec_check_ipsecin_unique(ipsec_in_t *ii, const char **reason,
1621     kstat_named_t **counter, uint64_t pkt_unique)
1622 {
1623 	uint64_t ah_mask, esp_mask;
1624 	ipsa_t *ah_assoc;
1625 	ipsa_t *esp_assoc;
1626 	netstack_t	*ns = ii->ipsec_in_ns;
1627 	ipsec_stack_t	*ipss = ns->netstack_ipsec;
1628 
1629 	ASSERT(ii->ipsec_in_secure);
1630 	ASSERT(!ii->ipsec_in_loopback);
1631 
1632 	ah_assoc = ii->ipsec_in_ah_sa;
1633 	esp_assoc = ii->ipsec_in_esp_sa;
1634 	ASSERT((ah_assoc != NULL) || (esp_assoc != NULL));
1635 
1636 	ah_mask = (ah_assoc != NULL) ? ah_assoc->ipsa_unique_mask : 0;
1637 	esp_mask = (esp_assoc != NULL) ? esp_assoc->ipsa_unique_mask : 0;
1638 
1639 	if ((ah_mask == 0) && (esp_mask == 0))
1640 		return (B_TRUE);
1641 
1642 	/*
1643 	 * The pkt_unique check will also check for tunnel mode on the SA
1644 	 * vs. the tunneled_packet boolean.  "Be liberal in what you receive"
1645 	 * should not apply in this case.  ;)
1646 	 */
1647 
1648 	if (ah_mask != 0 &&
1649 	    ah_assoc->ipsa_unique_id != (pkt_unique & ah_mask)) {
1650 		*reason = "AH inner header mismatch";
1651 		*counter = DROPPER(ipss, ipds_spd_ah_innermismatch);
1652 		return (B_FALSE);
1653 	}
1654 	if (esp_mask != 0 &&
1655 	    esp_assoc->ipsa_unique_id != (pkt_unique & esp_mask)) {
1656 		*reason = "ESP inner header mismatch";
1657 		*counter = DROPPER(ipss, ipds_spd_esp_innermismatch);
1658 		return (B_FALSE);
1659 	}
1660 	return (B_TRUE);
1661 }
1662 
1663 static boolean_t
1664 ipsec_check_ipsecin_action(ipsec_in_t *ii, mblk_t *mp, ipsec_action_t *ap,
1665     ipha_t *ipha, ip6_t *ip6h, const char **reason, kstat_named_t **counter)
1666 {
1667 	boolean_t ret = B_TRUE;
1668 	ipsec_prot_t *ipp;
1669 	ipsa_t *ah_assoc;
1670 	ipsa_t *esp_assoc;
1671 	boolean_t decaps;
1672 	netstack_t	*ns = ii->ipsec_in_ns;
1673 	ipsec_stack_t	*ipss = ns->netstack_ipsec;
1674 
1675 	ASSERT((ipha == NULL && ip6h != NULL) ||
1676 	    (ip6h == NULL && ipha != NULL));
1677 
1678 	if (ii->ipsec_in_loopback) {
1679 		/*
1680 		 * Besides accepting pointer-equivalent actions, we also
1681 		 * accept any ICMP errors we generated for ourselves,
1682 		 * regardless of policy.  If we do not wish to make this
1683 		 * assumption in the future, check here, and where
1684 		 * icmp_loopback is initialized in ip.c and ip6.c.  (Look for
1685 		 * ipsec_out_icmp_loopback.)
1686 		 */
1687 		if (ap == ii->ipsec_in_action || ii->ipsec_in_icmp_loopback)
1688 			return (B_TRUE);
1689 
1690 		/* Deep compare necessary here?? */
1691 		*counter = DROPPER(ipss, ipds_spd_loopback_mismatch);
1692 		*reason = "loopback policy mismatch";
1693 		return (B_FALSE);
1694 	}
1695 	ASSERT(!ii->ipsec_in_icmp_loopback);
1696 
1697 	ah_assoc = ii->ipsec_in_ah_sa;
1698 	esp_assoc = ii->ipsec_in_esp_sa;
1699 
1700 	decaps = ii->ipsec_in_decaps;
1701 
1702 	switch (ap->ipa_act.ipa_type) {
1703 	case IPSEC_ACT_DISCARD:
1704 	case IPSEC_ACT_REJECT:
1705 		/* Should "fail hard" */
1706 		*counter = DROPPER(ipss, ipds_spd_explicit);
1707 		*reason = "blocked by policy";
1708 		return (B_FALSE);
1709 
1710 	case IPSEC_ACT_BYPASS:
1711 	case IPSEC_ACT_CLEAR:
1712 		*counter = DROPPER(ipss, ipds_spd_got_secure);
1713 		*reason = "expected clear, got protected";
1714 		return (B_FALSE);
1715 
1716 	case IPSEC_ACT_APPLY:
1717 		ipp = &ap->ipa_act.ipa_apply;
1718 		/*
1719 		 * As of now we do the simple checks of whether
1720 		 * the datagram has gone through the required IPSEC
1721 		 * protocol constraints or not. We might have more
1722 		 * in the future like sensitive levels, key bits, etc.
1723 		 * If it fails the constraints, check whether we would
1724 		 * have accepted this if it had come in clear.
1725 		 */
1726 		if (ipp->ipp_use_ah) {
1727 			if (ah_assoc == NULL) {
1728 				ret = ipsec_inbound_accept_clear(mp, ipha,
1729 				    ip6h);
1730 				*counter = DROPPER(ipss, ipds_spd_got_clear);
1731 				*reason = "unprotected not accepted";
1732 				break;
1733 			}
1734 			ASSERT(ah_assoc != NULL);
1735 			ASSERT(ipp->ipp_auth_alg != 0);
1736 
1737 			if (ah_assoc->ipsa_auth_alg !=
1738 			    ipp->ipp_auth_alg) {
1739 				*counter = DROPPER(ipss, ipds_spd_bad_ahalg);
1740 				*reason = "unacceptable ah alg";
1741 				ret = B_FALSE;
1742 				break;
1743 			}
1744 		} else if (ah_assoc != NULL) {
1745 			/*
1746 			 * Don't allow this. Check IPSEC NOTE above
1747 			 * ip_fanout_proto().
1748 			 */
1749 			*counter = DROPPER(ipss, ipds_spd_got_ah);
1750 			*reason = "unexpected AH";
1751 			ret = B_FALSE;
1752 			break;
1753 		}
1754 		if (ipp->ipp_use_esp) {
1755 			if (esp_assoc == NULL) {
1756 				ret = ipsec_inbound_accept_clear(mp, ipha,
1757 				    ip6h);
1758 				*counter = DROPPER(ipss, ipds_spd_got_clear);
1759 				*reason = "unprotected not accepted";
1760 				break;
1761 			}
1762 			ASSERT(esp_assoc != NULL);
1763 			ASSERT(ipp->ipp_encr_alg != 0);
1764 
1765 			if (esp_assoc->ipsa_encr_alg !=
1766 			    ipp->ipp_encr_alg) {
1767 				*counter = DROPPER(ipss, ipds_spd_bad_espealg);
1768 				*reason = "unacceptable esp alg";
1769 				ret = B_FALSE;
1770 				break;
1771 			}
1772 			/*
1773 			 * If the client does not need authentication,
1774 			 * we don't verify the alogrithm.
1775 			 */
1776 			if (ipp->ipp_use_espa) {
1777 				if (esp_assoc->ipsa_auth_alg !=
1778 				    ipp->ipp_esp_auth_alg) {
1779 					*counter = DROPPER(ipss,
1780 					    ipds_spd_bad_espaalg);
1781 					*reason = "unacceptable esp auth alg";
1782 					ret = B_FALSE;
1783 					break;
1784 				}
1785 			}
1786 		} else if (esp_assoc != NULL) {
1787 				/*
1788 				 * Don't allow this. Check IPSEC NOTE above
1789 				 * ip_fanout_proto().
1790 				 */
1791 			*counter = DROPPER(ipss, ipds_spd_got_esp);
1792 			*reason = "unexpected ESP";
1793 			ret = B_FALSE;
1794 			break;
1795 		}
1796 		if (ipp->ipp_use_se) {
1797 			if (!decaps) {
1798 				ret = ipsec_inbound_accept_clear(mp, ipha,
1799 				    ip6h);
1800 				if (!ret) {
1801 					/* XXX mutant? */
1802 					*counter = DROPPER(ipss,
1803 					    ipds_spd_bad_selfencap);
1804 					*reason = "self encap not found";
1805 					break;
1806 				}
1807 			}
1808 		} else if (decaps) {
1809 			/*
1810 			 * XXX If the packet comes in tunneled and the
1811 			 * recipient does not expect it to be tunneled, it
1812 			 * is okay. But we drop to be consistent with the
1813 			 * other cases.
1814 			 */
1815 			*counter = DROPPER(ipss, ipds_spd_got_selfencap);
1816 			*reason = "unexpected self encap";
1817 			ret = B_FALSE;
1818 			break;
1819 		}
1820 		if (ii->ipsec_in_action != NULL) {
1821 			/*
1822 			 * This can happen if we do a double policy-check on
1823 			 * a packet
1824 			 * XXX XXX should fix this case!
1825 			 */
1826 			IPACT_REFRELE(ii->ipsec_in_action);
1827 		}
1828 		ASSERT(ii->ipsec_in_action == NULL);
1829 		IPACT_REFHOLD(ap);
1830 		ii->ipsec_in_action = ap;
1831 		break;	/* from switch */
1832 	}
1833 	return (ret);
1834 }
1835 
1836 static boolean_t
1837 spd_match_inbound_ids(ipsec_latch_t *ipl, ipsa_t *sa)
1838 {
1839 	ASSERT(ipl->ipl_ids_latched == B_TRUE);
1840 	return ipsid_equal(ipl->ipl_remote_cid, sa->ipsa_src_cid) &&
1841 	    ipsid_equal(ipl->ipl_local_cid, sa->ipsa_dst_cid);
1842 }
1843 
1844 /*
1845  * Takes a latched conn and an inbound packet and returns a unique_id suitable
1846  * for SA comparisons.  Most of the time we will copy from the conn_t, but
1847  * there are cases when the conn_t is latched but it has wildcard selectors,
1848  * and then we need to fallback to scooping them out of the packet.
1849  *
1850  * Assume we'll never have 0 with a conn_t present, so use 0 as a failure.  We
1851  * can get away with this because we only have non-zero ports/proto for
1852  * latched conn_ts.
1853  *
1854  * Ideal candidate for an "inline" keyword, as we're JUST convoluted enough
1855  * to not be a nice macro.
1856  */
1857 static uint64_t
1858 conn_to_unique(conn_t *connp, mblk_t *data_mp, ipha_t *ipha, ip6_t *ip6h)
1859 {
1860 	ipsec_selector_t sel;
1861 	uint8_t ulp = connp->conn_ulp;
1862 
1863 	ASSERT(connp->conn_latch->ipl_in_policy != NULL);
1864 
1865 	if ((ulp == IPPROTO_TCP || ulp == IPPROTO_UDP || ulp == IPPROTO_SCTP) &&
1866 	    (connp->conn_fport == 0 || connp->conn_lport == 0)) {
1867 		/* Slow path - we gotta grab from the packet. */
1868 		if (ipsec_init_inbound_sel(&sel, data_mp, ipha, ip6h,
1869 		    SEL_NONE) != SELRET_SUCCESS) {
1870 			/* Failure -> have caller free packet with ENOMEM. */
1871 			return (0);
1872 		}
1873 		return (SA_UNIQUE_ID(sel.ips_remote_port, sel.ips_local_port,
1874 		    sel.ips_protocol, 0));
1875 	}
1876 
1877 #ifdef DEBUG_NOT_UNTIL_6478464
1878 	if (ipsec_init_inbound_sel(&sel, data_mp, ipha, ip6h, SEL_NONE) ==
1879 	    SELRET_SUCCESS) {
1880 		ASSERT(sel.ips_local_port == connp->conn_lport);
1881 		ASSERT(sel.ips_remote_port == connp->conn_fport);
1882 		ASSERT(sel.ips_protocol == connp->conn_ulp);
1883 	}
1884 	ASSERT(connp->conn_ulp != 0);
1885 #endif
1886 
1887 	return (SA_UNIQUE_ID(connp->conn_fport, connp->conn_lport, ulp, 0));
1888 }
1889 
1890 /*
1891  * Called to check policy on a latched connection, both from this file
1892  * and from tcp.c
1893  */
1894 boolean_t
1895 ipsec_check_ipsecin_latch(ipsec_in_t *ii, mblk_t *mp, ipsec_latch_t *ipl,
1896     ipha_t *ipha, ip6_t *ip6h, const char **reason, kstat_named_t **counter,
1897     conn_t *connp)
1898 {
1899 	netstack_t	*ns = ii->ipsec_in_ns;
1900 	ipsec_stack_t	*ipss = ns->netstack_ipsec;
1901 
1902 	ASSERT(ipl->ipl_ids_latched == B_TRUE);
1903 
1904 	if (!ii->ipsec_in_loopback) {
1905 		/*
1906 		 * Over loopback, there aren't real security associations,
1907 		 * so there are neither identities nor "unique" values
1908 		 * for us to check the packet against.
1909 		 */
1910 		if ((ii->ipsec_in_ah_sa != NULL) &&
1911 		    (!spd_match_inbound_ids(ipl, ii->ipsec_in_ah_sa))) {
1912 			*counter = DROPPER(ipss, ipds_spd_ah_badid);
1913 			*reason = "AH identity mismatch";
1914 			return (B_FALSE);
1915 		}
1916 
1917 		if ((ii->ipsec_in_esp_sa != NULL) &&
1918 		    (!spd_match_inbound_ids(ipl, ii->ipsec_in_esp_sa))) {
1919 			*counter = DROPPER(ipss, ipds_spd_esp_badid);
1920 			*reason = "ESP identity mismatch";
1921 			return (B_FALSE);
1922 		}
1923 
1924 		/*
1925 		 * Can fudge pkt_unique from connp because we're latched.
1926 		 * In DEBUG kernels (see conn_to_unique()'s implementation),
1927 		 * verify this even if it REALLY slows things down.
1928 		 */
1929 		if (!ipsec_check_ipsecin_unique(ii, reason, counter,
1930 		    conn_to_unique(connp, mp, ipha, ip6h))) {
1931 			return (B_FALSE);
1932 		}
1933 	}
1934 
1935 	return (ipsec_check_ipsecin_action(ii, mp, ipl->ipl_in_action,
1936 	    ipha, ip6h, reason, counter));
1937 }
1938 
1939 /*
1940  * Check to see whether this secured datagram meets the policy
1941  * constraints specified in ipsp.
1942  *
1943  * Called from ipsec_check_global_policy, and ipsec_check_inbound_policy.
1944  *
1945  * Consumes a reference to ipsp.
1946  */
1947 static mblk_t *
1948 ipsec_check_ipsecin_policy(mblk_t *first_mp, ipsec_policy_t *ipsp,
1949     ipha_t *ipha, ip6_t *ip6h, uint64_t pkt_unique, netstack_t *ns)
1950 {
1951 	ipsec_in_t *ii;
1952 	ipsec_action_t *ap;
1953 	const char *reason = "no policy actions found";
1954 	mblk_t *data_mp, *ipsec_mp;
1955 	ipsec_stack_t	*ipss = ns->netstack_ipsec;
1956 	ip_stack_t	*ipst = ns->netstack_ip;
1957 	kstat_named_t *counter;
1958 
1959 	counter = DROPPER(ipss, ipds_spd_got_secure);
1960 
1961 	data_mp = first_mp->b_cont;
1962 	ipsec_mp = first_mp;
1963 
1964 	ASSERT(ipsp != NULL);
1965 
1966 	ASSERT((ipha == NULL && ip6h != NULL) ||
1967 	    (ip6h == NULL && ipha != NULL));
1968 
1969 	ii = (ipsec_in_t *)ipsec_mp->b_rptr;
1970 
1971 	if (ii->ipsec_in_loopback)
1972 		return (ipsec_check_loopback_policy(first_mp, B_TRUE, ipsp));
1973 	ASSERT(ii->ipsec_in_type == IPSEC_IN);
1974 	ASSERT(ii->ipsec_in_secure);
1975 
1976 	if (ii->ipsec_in_action != NULL) {
1977 		/*
1978 		 * this can happen if we do a double policy-check on a packet
1979 		 * Would be nice to be able to delete this test..
1980 		 */
1981 		IPACT_REFRELE(ii->ipsec_in_action);
1982 	}
1983 	ASSERT(ii->ipsec_in_action == NULL);
1984 
1985 	if (!SA_IDS_MATCH(ii->ipsec_in_ah_sa, ii->ipsec_in_esp_sa)) {
1986 		reason = "inbound AH and ESP identities differ";
1987 		counter = DROPPER(ipss, ipds_spd_ahesp_diffid);
1988 		goto drop;
1989 	}
1990 
1991 	if (!ipsec_check_ipsecin_unique(ii, &reason, &counter, pkt_unique))
1992 		goto drop;
1993 
1994 	/*
1995 	 * Ok, now loop through the possible actions and see if any
1996 	 * of them work for us.
1997 	 */
1998 
1999 	for (ap = ipsp->ipsp_act; ap != NULL; ap = ap->ipa_next) {
2000 		if (ipsec_check_ipsecin_action(ii, data_mp, ap,
2001 		    ipha, ip6h, &reason, &counter)) {
2002 			BUMP_MIB(&ipst->ips_ip_mib, ipsecInSucceeded);
2003 			IPPOL_REFRELE(ipsp, ns);
2004 			return (first_mp);
2005 		}
2006 	}
2007 drop:
2008 	ipsec_rl_strlog(ns, IP_MOD_ID, 0, 0, SL_ERROR|SL_WARN|SL_CONSOLE,
2009 	    "ipsec inbound policy mismatch: %s, packet dropped\n",
2010 	    reason);
2011 	IPPOL_REFRELE(ipsp, ns);
2012 	ASSERT(ii->ipsec_in_action == NULL);
2013 	BUMP_MIB(&ipst->ips_ip_mib, ipsecInFailed);
2014 	ip_drop_packet(first_mp, B_TRUE, NULL, NULL, counter,
2015 	    &ipss->ipsec_spd_dropper);
2016 	return (NULL);
2017 }
2018 
2019 /*
2020  * sleazy prefix-length-based compare.
2021  * another inlining candidate..
2022  */
2023 boolean_t
2024 ip_addr_match(uint8_t *addr1, int pfxlen, in6_addr_t *addr2p)
2025 {
2026 	int offset = pfxlen>>3;
2027 	int bitsleft = pfxlen & 7;
2028 	uint8_t *addr2 = (uint8_t *)addr2p;
2029 
2030 	/*
2031 	 * and there was much evil..
2032 	 * XXX should inline-expand the bcmp here and do this 32 bits
2033 	 * or 64 bits at a time..
2034 	 */
2035 	return ((bcmp(addr1, addr2, offset) == 0) &&
2036 	    ((bitsleft == 0) ||
2037 	    (((addr1[offset] ^ addr2[offset]) & (0xff<<(8-bitsleft))) == 0)));
2038 }
2039 
2040 static ipsec_policy_t *
2041 ipsec_find_policy_chain(ipsec_policy_t *best, ipsec_policy_t *chain,
2042     ipsec_selector_t *sel, boolean_t is_icmp_inv_acq)
2043 {
2044 	ipsec_selkey_t *isel;
2045 	ipsec_policy_t *p;
2046 	int bpri = best ? best->ipsp_prio : 0;
2047 
2048 	for (p = chain; p != NULL; p = p->ipsp_hash.hash_next) {
2049 		uint32_t valid;
2050 
2051 		if (p->ipsp_prio <= bpri)
2052 			continue;
2053 		isel = &p->ipsp_sel->ipsl_key;
2054 		valid = isel->ipsl_valid;
2055 
2056 		if ((valid & IPSL_PROTOCOL) &&
2057 		    (isel->ipsl_proto != sel->ips_protocol))
2058 			continue;
2059 
2060 		if ((valid & IPSL_REMOTE_ADDR) &&
2061 		    !ip_addr_match((uint8_t *)&isel->ipsl_remote,
2062 		    isel->ipsl_remote_pfxlen, &sel->ips_remote_addr_v6))
2063 			continue;
2064 
2065 		if ((valid & IPSL_LOCAL_ADDR) &&
2066 		    !ip_addr_match((uint8_t *)&isel->ipsl_local,
2067 		    isel->ipsl_local_pfxlen, &sel->ips_local_addr_v6))
2068 			continue;
2069 
2070 		if ((valid & IPSL_REMOTE_PORT) &&
2071 		    isel->ipsl_rport != sel->ips_remote_port)
2072 			continue;
2073 
2074 		if ((valid & IPSL_LOCAL_PORT) &&
2075 		    isel->ipsl_lport != sel->ips_local_port)
2076 			continue;
2077 
2078 		if (!is_icmp_inv_acq) {
2079 			if ((valid & IPSL_ICMP_TYPE) &&
2080 			    (isel->ipsl_icmp_type > sel->ips_icmp_type ||
2081 			    isel->ipsl_icmp_type_end < sel->ips_icmp_type)) {
2082 				continue;
2083 			}
2084 
2085 			if ((valid & IPSL_ICMP_CODE) &&
2086 			    (isel->ipsl_icmp_code > sel->ips_icmp_code ||
2087 			    isel->ipsl_icmp_code_end <
2088 			    sel->ips_icmp_code)) {
2089 				continue;
2090 			}
2091 		} else {
2092 			/*
2093 			 * special case for icmp inverse acquire
2094 			 * we only want policies that aren't drop/pass
2095 			 */
2096 			if (p->ipsp_act->ipa_act.ipa_type != IPSEC_ACT_APPLY)
2097 				continue;
2098 		}
2099 
2100 		/* we matched all the packet-port-field selectors! */
2101 		best = p;
2102 		bpri = p->ipsp_prio;
2103 	}
2104 
2105 	return (best);
2106 }
2107 
2108 /*
2109  * Try to find and return the best policy entry under a given policy
2110  * root for a given set of selectors; the first parameter "best" is
2111  * the current best policy so far.  If "best" is non-null, we have a
2112  * reference to it.  We return a reference to a policy; if that policy
2113  * is not the original "best", we need to release that reference
2114  * before returning.
2115  */
2116 ipsec_policy_t *
2117 ipsec_find_policy_head(ipsec_policy_t *best, ipsec_policy_head_t *head,
2118     int direction, ipsec_selector_t *sel, netstack_t *ns)
2119 {
2120 	ipsec_policy_t *curbest;
2121 	ipsec_policy_root_t *root;
2122 	uint8_t is_icmp_inv_acq = sel->ips_is_icmp_inv_acq;
2123 	int af = sel->ips_isv4 ? IPSEC_AF_V4 : IPSEC_AF_V6;
2124 
2125 	curbest = best;
2126 	root = &head->iph_root[direction];
2127 
2128 #ifdef DEBUG
2129 	if (is_icmp_inv_acq) {
2130 		if (sel->ips_isv4) {
2131 			if (sel->ips_protocol != IPPROTO_ICMP) {
2132 				cmn_err(CE_WARN, "ipsec_find_policy_head:"
2133 				    " expecting icmp, got %d",
2134 				    sel->ips_protocol);
2135 			}
2136 		} else {
2137 			if (sel->ips_protocol != IPPROTO_ICMPV6) {
2138 				cmn_err(CE_WARN, "ipsec_find_policy_head:"
2139 				    " expecting icmpv6, got %d",
2140 				    sel->ips_protocol);
2141 			}
2142 		}
2143 	}
2144 #endif
2145 
2146 	rw_enter(&head->iph_lock, RW_READER);
2147 
2148 	if (root->ipr_nchains > 0) {
2149 		curbest = ipsec_find_policy_chain(curbest,
2150 		    root->ipr_hash[selector_hash(sel, root)].hash_head, sel,
2151 		    is_icmp_inv_acq);
2152 	}
2153 	curbest = ipsec_find_policy_chain(curbest, root->ipr_nonhash[af], sel,
2154 	    is_icmp_inv_acq);
2155 
2156 	/*
2157 	 * Adjust reference counts if we found anything new.
2158 	 */
2159 	if (curbest != best) {
2160 		ASSERT(curbest != NULL);
2161 		IPPOL_REFHOLD(curbest);
2162 
2163 		if (best != NULL) {
2164 			IPPOL_REFRELE(best, ns);
2165 		}
2166 	}
2167 
2168 	rw_exit(&head->iph_lock);
2169 
2170 	return (curbest);
2171 }
2172 
2173 /*
2174  * Find the best system policy (either global or per-interface) which
2175  * applies to the given selector; look in all the relevant policy roots
2176  * to figure out which policy wins.
2177  *
2178  * Returns a reference to a policy; caller must release this
2179  * reference when done.
2180  */
2181 ipsec_policy_t *
2182 ipsec_find_policy(int direction, conn_t *connp, ipsec_out_t *io,
2183     ipsec_selector_t *sel, netstack_t *ns)
2184 {
2185 	ipsec_policy_t *p;
2186 	ipsec_stack_t	*ipss = ns->netstack_ipsec;
2187 
2188 	p = ipsec_find_policy_head(NULL, &ipss->ipsec_system_policy,
2189 	    direction, sel, ns);
2190 	if ((connp != NULL) && (connp->conn_policy != NULL)) {
2191 		p = ipsec_find_policy_head(p, connp->conn_policy,
2192 		    direction, sel, ns);
2193 	} else if ((io != NULL) && (io->ipsec_out_polhead != NULL)) {
2194 		p = ipsec_find_policy_head(p, io->ipsec_out_polhead,
2195 		    direction, sel, ns);
2196 	}
2197 
2198 	return (p);
2199 }
2200 
2201 /*
2202  * Check with global policy and see whether this inbound
2203  * packet meets the policy constraints.
2204  *
2205  * Locate appropriate policy from global policy, supplemented by the
2206  * conn's configured and/or cached policy if the conn is supplied.
2207  *
2208  * Dispatch to ipsec_check_ipsecin_policy if we have policy and an
2209  * encrypted packet to see if they match.
2210  *
2211  * Otherwise, see if the policy allows cleartext; if not, drop it on the
2212  * floor.
2213  */
2214 mblk_t *
2215 ipsec_check_global_policy(mblk_t *first_mp, conn_t *connp,
2216     ipha_t *ipha, ip6_t *ip6h, boolean_t mctl_present, netstack_t *ns)
2217 {
2218 	ipsec_policy_t *p;
2219 	ipsec_selector_t sel;
2220 	mblk_t *data_mp, *ipsec_mp;
2221 	boolean_t policy_present;
2222 	kstat_named_t *counter;
2223 	ipsec_in_t *ii = NULL;
2224 	uint64_t pkt_unique;
2225 	ipsec_stack_t	*ipss = ns->netstack_ipsec;
2226 	ip_stack_t	*ipst = ns->netstack_ip;
2227 
2228 	data_mp = mctl_present ? first_mp->b_cont : first_mp;
2229 	ipsec_mp = mctl_present ? first_mp : NULL;
2230 
2231 	sel.ips_is_icmp_inv_acq = 0;
2232 
2233 	ASSERT((ipha == NULL && ip6h != NULL) ||
2234 	    (ip6h == NULL && ipha != NULL));
2235 
2236 	if (ipha != NULL)
2237 		policy_present = ipss->ipsec_inbound_v4_policy_present;
2238 	else
2239 		policy_present = ipss->ipsec_inbound_v6_policy_present;
2240 
2241 	if (!policy_present && connp == NULL) {
2242 		/*
2243 		 * No global policy and no per-socket policy;
2244 		 * just pass it back (but we shouldn't get here in that case)
2245 		 */
2246 		return (first_mp);
2247 	}
2248 
2249 	if (ipsec_mp != NULL) {
2250 		ASSERT(ipsec_mp->b_datap->db_type == M_CTL);
2251 		ii = (ipsec_in_t *)(ipsec_mp->b_rptr);
2252 		ASSERT(ii->ipsec_in_type == IPSEC_IN);
2253 	}
2254 
2255 	/*
2256 	 * If we have cached policy, use it.
2257 	 * Otherwise consult system policy.
2258 	 */
2259 	if ((connp != NULL) && (connp->conn_latch != NULL)) {
2260 		p = connp->conn_latch->ipl_in_policy;
2261 		if (p != NULL) {
2262 			IPPOL_REFHOLD(p);
2263 		}
2264 		/*
2265 		 * Fudge sel for UNIQUE_ID setting below.
2266 		 */
2267 		pkt_unique = conn_to_unique(connp, data_mp, ipha, ip6h);
2268 	} else {
2269 		/* Initialize the ports in the selector */
2270 		if (ipsec_init_inbound_sel(&sel, data_mp, ipha, ip6h,
2271 		    SEL_NONE) == SELRET_NOMEM) {
2272 			/*
2273 			 * Technically not a policy mismatch, but it is
2274 			 * an internal failure.
2275 			 */
2276 			ipsec_log_policy_failure(IPSEC_POLICY_MISMATCH,
2277 			    "ipsec_init_inbound_sel", ipha, ip6h, B_FALSE, ns);
2278 			counter = DROPPER(ipss, ipds_spd_nomem);
2279 			goto fail;
2280 		}
2281 
2282 		/*
2283 		 * Find the policy which best applies.
2284 		 *
2285 		 * If we find global policy, we should look at both
2286 		 * local policy and global policy and see which is
2287 		 * stronger and match accordingly.
2288 		 *
2289 		 * If we don't find a global policy, check with
2290 		 * local policy alone.
2291 		 */
2292 
2293 		p = ipsec_find_policy(IPSEC_TYPE_INBOUND, connp, NULL, &sel,
2294 		    ns);
2295 		pkt_unique = SA_UNIQUE_ID(sel.ips_remote_port,
2296 		    sel.ips_local_port, sel.ips_protocol, 0);
2297 	}
2298 
2299 	if (p == NULL) {
2300 		if (ipsec_mp == NULL) {
2301 			/*
2302 			 * We have no policy; default to succeeding.
2303 			 * XXX paranoid system design doesn't do this.
2304 			 */
2305 			BUMP_MIB(&ipst->ips_ip_mib, ipsecInSucceeded);
2306 			return (first_mp);
2307 		} else {
2308 			counter = DROPPER(ipss, ipds_spd_got_secure);
2309 			ipsec_log_policy_failure(IPSEC_POLICY_NOT_NEEDED,
2310 			    "ipsec_check_global_policy", ipha, ip6h, B_TRUE,
2311 			    ns);
2312 			goto fail;
2313 		}
2314 	}
2315 	if ((ii != NULL) && (ii->ipsec_in_secure)) {
2316 		return (ipsec_check_ipsecin_policy(ipsec_mp, p, ipha, ip6h,
2317 		    pkt_unique, ns));
2318 	}
2319 	if (p->ipsp_act->ipa_allow_clear) {
2320 		BUMP_MIB(&ipst->ips_ip_mib, ipsecInSucceeded);
2321 		IPPOL_REFRELE(p, ns);
2322 		return (first_mp);
2323 	}
2324 	IPPOL_REFRELE(p, ns);
2325 	/*
2326 	 * If we reach here, we will drop the packet because it failed the
2327 	 * global policy check because the packet was cleartext, and it
2328 	 * should not have been.
2329 	 */
2330 	ipsec_log_policy_failure(IPSEC_POLICY_MISMATCH,
2331 	    "ipsec_check_global_policy", ipha, ip6h, B_FALSE, ns);
2332 	counter = DROPPER(ipss, ipds_spd_got_clear);
2333 
2334 fail:
2335 	ip_drop_packet(first_mp, B_TRUE, NULL, NULL, counter,
2336 	    &ipss->ipsec_spd_dropper);
2337 	BUMP_MIB(&ipst->ips_ip_mib, ipsecInFailed);
2338 	return (NULL);
2339 }
2340 
2341 /*
2342  * We check whether an inbound datagram is a valid one
2343  * to accept in clear. If it is secure, it is the job
2344  * of IPSEC to log information appropriately if it
2345  * suspects that it may not be the real one.
2346  *
2347  * It is called only while fanning out to the ULP
2348  * where ULP accepts only secure data and the incoming
2349  * is clear. Usually we never accept clear datagrams in
2350  * such cases. ICMP is the only exception.
2351  *
2352  * NOTE : We don't call this function if the client (ULP)
2353  * is willing to accept things in clear.
2354  */
2355 boolean_t
2356 ipsec_inbound_accept_clear(mblk_t *mp, ipha_t *ipha, ip6_t *ip6h)
2357 {
2358 	ushort_t iph_hdr_length;
2359 	icmph_t *icmph;
2360 	icmp6_t *icmp6;
2361 	uint8_t *nexthdrp;
2362 
2363 	ASSERT((ipha != NULL && ip6h == NULL) ||
2364 	    (ipha == NULL && ip6h != NULL));
2365 
2366 	if (ip6h != NULL) {
2367 		iph_hdr_length = ip_hdr_length_v6(mp, ip6h);
2368 		if (!ip_hdr_length_nexthdr_v6(mp, ip6h, &iph_hdr_length,
2369 		    &nexthdrp)) {
2370 			return (B_FALSE);
2371 		}
2372 		if (*nexthdrp != IPPROTO_ICMPV6)
2373 			return (B_FALSE);
2374 		icmp6 = (icmp6_t *)(&mp->b_rptr[iph_hdr_length]);
2375 		/* Match IPv6 ICMP policy as closely as IPv4 as possible. */
2376 		switch (icmp6->icmp6_type) {
2377 		case ICMP6_PARAM_PROB:
2378 			/* Corresponds to port/proto unreach in IPv4. */
2379 		case ICMP6_ECHO_REQUEST:
2380 			/* Just like IPv4. */
2381 			return (B_FALSE);
2382 
2383 		case MLD_LISTENER_QUERY:
2384 		case MLD_LISTENER_REPORT:
2385 		case MLD_LISTENER_REDUCTION:
2386 			/*
2387 			 * XXX Seperate NDD in IPv4 what about here?
2388 			 * Plus, mcast is important to ND.
2389 			 */
2390 		case ICMP6_DST_UNREACH:
2391 			/* Corresponds to HOST/NET unreachable in IPv4. */
2392 		case ICMP6_PACKET_TOO_BIG:
2393 		case ICMP6_ECHO_REPLY:
2394 			/* These are trusted in IPv4. */
2395 		case ND_ROUTER_SOLICIT:
2396 		case ND_ROUTER_ADVERT:
2397 		case ND_NEIGHBOR_SOLICIT:
2398 		case ND_NEIGHBOR_ADVERT:
2399 		case ND_REDIRECT:
2400 			/* Trust ND messages for now. */
2401 		case ICMP6_TIME_EXCEEDED:
2402 		default:
2403 			return (B_TRUE);
2404 		}
2405 	} else {
2406 		/*
2407 		 * If it is not ICMP, fail this request.
2408 		 */
2409 		if (ipha->ipha_protocol != IPPROTO_ICMP) {
2410 #ifdef FRAGCACHE_DEBUG
2411 			cmn_err(CE_WARN, "Dropping - ipha_proto = %d\n",
2412 			    ipha->ipha_protocol);
2413 #endif
2414 			return (B_FALSE);
2415 		}
2416 		iph_hdr_length = IPH_HDR_LENGTH(ipha);
2417 		icmph = (icmph_t *)&mp->b_rptr[iph_hdr_length];
2418 		/*
2419 		 * It is an insecure icmp message. Check to see whether we are
2420 		 * willing to accept this one.
2421 		 */
2422 
2423 		switch (icmph->icmph_type) {
2424 		case ICMP_ECHO_REPLY:
2425 		case ICMP_TIME_STAMP_REPLY:
2426 		case ICMP_INFO_REPLY:
2427 		case ICMP_ROUTER_ADVERTISEMENT:
2428 			/*
2429 			 * We should not encourage clear replies if this
2430 			 * client expects secure. If somebody is replying
2431 			 * in clear some mailicious user watching both the
2432 			 * request and reply, can do chosen-plain-text attacks.
2433 			 * With global policy we might be just expecting secure
2434 			 * but sending out clear. We don't know what the right
2435 			 * thing is. We can't do much here as we can't control
2436 			 * the sender here. Till we are sure of what to do,
2437 			 * accept them.
2438 			 */
2439 			return (B_TRUE);
2440 		case ICMP_ECHO_REQUEST:
2441 		case ICMP_TIME_STAMP_REQUEST:
2442 		case ICMP_INFO_REQUEST:
2443 		case ICMP_ADDRESS_MASK_REQUEST:
2444 		case ICMP_ROUTER_SOLICITATION:
2445 		case ICMP_ADDRESS_MASK_REPLY:
2446 			/*
2447 			 * Don't accept this as somebody could be sending
2448 			 * us plain text to get encrypted data. If we reply,
2449 			 * it will lead to chosen plain text attack.
2450 			 */
2451 			return (B_FALSE);
2452 		case ICMP_DEST_UNREACHABLE:
2453 			switch (icmph->icmph_code) {
2454 			case ICMP_FRAGMENTATION_NEEDED:
2455 				/*
2456 				 * Be in sync with icmp_inbound, where we have
2457 				 * already set ire_max_frag.
2458 				 */
2459 #ifdef FRAGCACHE_DEBUG
2460 			cmn_err(CE_WARN, "ICMP frag needed\n");
2461 #endif
2462 				return (B_TRUE);
2463 			case ICMP_HOST_UNREACHABLE:
2464 			case ICMP_NET_UNREACHABLE:
2465 				/*
2466 				 * By accepting, we could reset a connection.
2467 				 * How do we solve the problem of some
2468 				 * intermediate router sending in-secure ICMP
2469 				 * messages ?
2470 				 */
2471 				return (B_TRUE);
2472 			case ICMP_PORT_UNREACHABLE:
2473 			case ICMP_PROTOCOL_UNREACHABLE:
2474 			default :
2475 				return (B_FALSE);
2476 			}
2477 		case ICMP_SOURCE_QUENCH:
2478 			/*
2479 			 * If this is an attack, TCP will slow start
2480 			 * because of this. Is it very harmful ?
2481 			 */
2482 			return (B_TRUE);
2483 		case ICMP_PARAM_PROBLEM:
2484 			return (B_FALSE);
2485 		case ICMP_TIME_EXCEEDED:
2486 			return (B_TRUE);
2487 		case ICMP_REDIRECT:
2488 			return (B_FALSE);
2489 		default :
2490 			return (B_FALSE);
2491 		}
2492 	}
2493 }
2494 
2495 void
2496 ipsec_latch_ids(ipsec_latch_t *ipl, ipsid_t *local, ipsid_t *remote)
2497 {
2498 	mutex_enter(&ipl->ipl_lock);
2499 
2500 	if (ipl->ipl_ids_latched) {
2501 		/* I lost, someone else got here before me */
2502 		mutex_exit(&ipl->ipl_lock);
2503 		return;
2504 	}
2505 
2506 	if (local != NULL)
2507 		IPSID_REFHOLD(local);
2508 	if (remote != NULL)
2509 		IPSID_REFHOLD(remote);
2510 
2511 	ipl->ipl_local_cid = local;
2512 	ipl->ipl_remote_cid = remote;
2513 	ipl->ipl_ids_latched = B_TRUE;
2514 	mutex_exit(&ipl->ipl_lock);
2515 }
2516 
2517 void
2518 ipsec_latch_inbound(ipsec_latch_t *ipl, ipsec_in_t *ii)
2519 {
2520 	ipsa_t *sa;
2521 
2522 	if (!ipl->ipl_ids_latched) {
2523 		ipsid_t *local = NULL;
2524 		ipsid_t *remote = NULL;
2525 
2526 		if (!ii->ipsec_in_loopback) {
2527 			if (ii->ipsec_in_esp_sa != NULL)
2528 				sa = ii->ipsec_in_esp_sa;
2529 			else
2530 				sa = ii->ipsec_in_ah_sa;
2531 			ASSERT(sa != NULL);
2532 			local = sa->ipsa_dst_cid;
2533 			remote = sa->ipsa_src_cid;
2534 		}
2535 		ipsec_latch_ids(ipl, local, remote);
2536 	}
2537 	ipl->ipl_in_action = ii->ipsec_in_action;
2538 	IPACT_REFHOLD(ipl->ipl_in_action);
2539 }
2540 
2541 /*
2542  * Check whether the policy constraints are met either for an
2543  * inbound datagram; called from IP in numerous places.
2544  *
2545  * Note that this is not a chokepoint for inbound policy checks;
2546  * see also ipsec_check_ipsecin_latch() and ipsec_check_global_policy()
2547  */
2548 mblk_t *
2549 ipsec_check_inbound_policy(mblk_t *first_mp, conn_t *connp,
2550     ipha_t *ipha, ip6_t *ip6h, boolean_t mctl_present)
2551 {
2552 	ipsec_in_t *ii;
2553 	boolean_t ret;
2554 	mblk_t *mp = mctl_present ? first_mp->b_cont : first_mp;
2555 	mblk_t *ipsec_mp = mctl_present ? first_mp : NULL;
2556 	ipsec_latch_t *ipl;
2557 	uint64_t unique_id;
2558 	ipsec_stack_t	*ipss;
2559 	ip_stack_t	*ipst;
2560 	netstack_t	*ns;
2561 	ipsec_policy_head_t *policy_head;
2562 
2563 	ASSERT(connp != NULL);
2564 	ns = connp->conn_netstack;
2565 	ipss = ns->netstack_ipsec;
2566 	ipst = ns->netstack_ip;
2567 
2568 	if (ipsec_mp == NULL) {
2569 clear:
2570 		/*
2571 		 * This is the case where the incoming datagram is
2572 		 * cleartext and we need to see whether this client
2573 		 * would like to receive such untrustworthy things from
2574 		 * the wire.
2575 		 */
2576 		ASSERT(mp != NULL);
2577 
2578 		mutex_enter(&connp->conn_lock);
2579 		if (connp->conn_state_flags & CONN_CONDEMNED) {
2580 			mutex_exit(&connp->conn_lock);
2581 			ip_drop_packet(first_mp, B_TRUE, NULL,
2582 			    NULL, DROPPER(ipss, ipds_spd_got_clear),
2583 			    &ipss->ipsec_spd_dropper);
2584 			BUMP_MIB(&ipst->ips_ip_mib, ipsecInFailed);
2585 			return (NULL);
2586 		}
2587 		if ((ipl = connp->conn_latch) != NULL) {
2588 			/* Hold a reference in case the conn is closing */
2589 			IPLATCH_REFHOLD(ipl);
2590 			mutex_exit(&connp->conn_lock);
2591 			/*
2592 			 * Policy is cached in the conn.
2593 			 */
2594 			if ((ipl->ipl_in_policy != NULL) &&
2595 			    (!ipl->ipl_in_policy->ipsp_act->ipa_allow_clear)) {
2596 				ret = ipsec_inbound_accept_clear(mp,
2597 				    ipha, ip6h);
2598 				if (ret) {
2599 					BUMP_MIB(&ipst->ips_ip_mib,
2600 					    ipsecInSucceeded);
2601 					IPLATCH_REFRELE(ipl, ns);
2602 					return (first_mp);
2603 				} else {
2604 					ipsec_log_policy_failure(
2605 					    IPSEC_POLICY_MISMATCH,
2606 					    "ipsec_check_inbound_policy", ipha,
2607 					    ip6h, B_FALSE, ns);
2608 					ip_drop_packet(first_mp, B_TRUE, NULL,
2609 					    NULL,
2610 					    DROPPER(ipss, ipds_spd_got_clear),
2611 					    &ipss->ipsec_spd_dropper);
2612 					BUMP_MIB(&ipst->ips_ip_mib,
2613 					    ipsecInFailed);
2614 					IPLATCH_REFRELE(ipl, ns);
2615 					return (NULL);
2616 				}
2617 			} else {
2618 				BUMP_MIB(&ipst->ips_ip_mib, ipsecInSucceeded);
2619 				IPLATCH_REFRELE(ipl, ns);
2620 				return (first_mp);
2621 			}
2622 		} else {
2623 			uchar_t db_type;
2624 			policy_head = connp->conn_policy;
2625 
2626 			/* Hold a reference in case the conn is closing */
2627 			if (policy_head != NULL)
2628 				IPPH_REFHOLD(policy_head);
2629 			mutex_exit(&connp->conn_lock);
2630 			/*
2631 			 * As this is a non-hardbound connection we need
2632 			 * to look at both per-socket policy and global
2633 			 * policy. As this is cleartext, mark the mp as
2634 			 * M_DATA in case if it is an ICMP error being
2635 			 * reported before calling ipsec_check_global_policy
2636 			 * so that it does not mistake it for IPSEC_IN.
2637 			 */
2638 			db_type = mp->b_datap->db_type;
2639 			mp->b_datap->db_type = M_DATA;
2640 			first_mp = ipsec_check_global_policy(first_mp, connp,
2641 			    ipha, ip6h, mctl_present, ns);
2642 			if (policy_head != NULL)
2643 				IPPH_REFRELE(policy_head, ns);
2644 			if (first_mp != NULL)
2645 				mp->b_datap->db_type = db_type;
2646 			return (first_mp);
2647 		}
2648 	}
2649 	/*
2650 	 * If it is inbound check whether the attached message
2651 	 * is secure or not. We have a special case for ICMP,
2652 	 * where we have a IPSEC_IN message and the attached
2653 	 * message is not secure. See icmp_inbound_error_fanout
2654 	 * for details.
2655 	 */
2656 	ASSERT(ipsec_mp != NULL);
2657 	ASSERT(ipsec_mp->b_datap->db_type == M_CTL);
2658 	ii = (ipsec_in_t *)ipsec_mp->b_rptr;
2659 
2660 	if (!ii->ipsec_in_secure)
2661 		goto clear;
2662 
2663 	/*
2664 	 * mp->b_cont could be either a M_CTL message
2665 	 * for icmp errors being sent up or a M_DATA message.
2666 	 */
2667 	ASSERT(mp->b_datap->db_type == M_CTL || mp->b_datap->db_type == M_DATA);
2668 
2669 	ASSERT(ii->ipsec_in_type == IPSEC_IN);
2670 
2671 	mutex_enter(&connp->conn_lock);
2672 	/* Connection is closing */
2673 	if (connp->conn_state_flags & CONN_CONDEMNED) {
2674 		mutex_exit(&connp->conn_lock);
2675 		ip_drop_packet(first_mp, B_TRUE, NULL,
2676 		    NULL, DROPPER(ipss, ipds_spd_got_clear),
2677 		    &ipss->ipsec_spd_dropper);
2678 		BUMP_MIB(&ipst->ips_ip_mib, ipsecInFailed);
2679 		return (NULL);
2680 	}
2681 
2682 	/*
2683 	 * Once a connection is latched it remains so for life, the conn_latch
2684 	 * pointer on the conn has not changed, simply initializing ipl here
2685 	 * as the earlier initialization was done only in the cleartext case.
2686 	 */
2687 	if ((ipl = connp->conn_latch) == NULL) {
2688 		mblk_t *retmp;
2689 		policy_head = connp->conn_policy;
2690 
2691 		/* Hold a reference in case the conn is closing */
2692 		if (policy_head != NULL)
2693 			IPPH_REFHOLD(policy_head);
2694 		mutex_exit(&connp->conn_lock);
2695 		/*
2696 		 * We don't have policies cached in the conn
2697 		 * for this stream. So, look at the global
2698 		 * policy. It will check against conn or global
2699 		 * depending on whichever is stronger.
2700 		 */
2701 		retmp = ipsec_check_global_policy(first_mp, connp,
2702 		    ipha, ip6h, mctl_present, ns);
2703 		if (policy_head != NULL)
2704 			IPPH_REFRELE(policy_head, ns);
2705 		return (retmp);
2706 	}
2707 
2708 	IPLATCH_REFHOLD(ipl);
2709 	mutex_exit(&connp->conn_lock);
2710 
2711 	if (ipl->ipl_in_action != NULL) {
2712 		/* Policy is cached & latched; fast(er) path */
2713 		const char *reason;
2714 		kstat_named_t *counter;
2715 
2716 		if (ipsec_check_ipsecin_latch(ii, mp, ipl,
2717 		    ipha, ip6h, &reason, &counter, connp)) {
2718 			BUMP_MIB(&ipst->ips_ip_mib, ipsecInSucceeded);
2719 			IPLATCH_REFRELE(ipl, ns);
2720 			return (first_mp);
2721 		}
2722 		ipsec_rl_strlog(ns, IP_MOD_ID, 0, 0,
2723 		    SL_ERROR|SL_WARN|SL_CONSOLE,
2724 		    "ipsec inbound policy mismatch: %s, packet dropped\n",
2725 		    reason);
2726 		ip_drop_packet(first_mp, B_TRUE, NULL, NULL, counter,
2727 		    &ipss->ipsec_spd_dropper);
2728 		BUMP_MIB(&ipst->ips_ip_mib, ipsecInFailed);
2729 		IPLATCH_REFRELE(ipl, ns);
2730 		return (NULL);
2731 	} else if (ipl->ipl_in_policy == NULL) {
2732 		ipsec_weird_null_inbound_policy++;
2733 		IPLATCH_REFRELE(ipl, ns);
2734 		return (first_mp);
2735 	}
2736 
2737 	unique_id = conn_to_unique(connp, mp, ipha, ip6h);
2738 	IPPOL_REFHOLD(ipl->ipl_in_policy);
2739 	first_mp = ipsec_check_ipsecin_policy(first_mp, ipl->ipl_in_policy,
2740 	    ipha, ip6h, unique_id, ns);
2741 	/*
2742 	 * NOTE: ipsecIn{Failed,Succeeeded} bumped by
2743 	 * ipsec_check_ipsecin_policy().
2744 	 */
2745 	if (first_mp != NULL)
2746 		ipsec_latch_inbound(ipl, ii);
2747 	IPLATCH_REFRELE(ipl, ns);
2748 	return (first_mp);
2749 }
2750 
2751 /*
2752  * Returns:
2753  *
2754  * SELRET_NOMEM --> msgpullup() needed to gather things failed.
2755  * SELRET_BADPKT --> If we're being called after tunnel-mode fragment
2756  *		     gathering, the initial fragment is too short for
2757  *		     useful data.  Only returned if SEL_TUNNEL_FIRSTFRAG is
2758  *		     set.
2759  * SELRET_SUCCESS --> "sel" now has initialized IPsec selector data.
2760  * SELRET_TUNFRAG --> This is a fragment in a tunnel-mode packet.  Caller
2761  *		      should put this packet in a fragment-gathering queue.
2762  *		      Only returned if SEL_TUNNEL_MODE and SEL_PORT_POLICY
2763  *		      is set.
2764  */
2765 static selret_t
2766 ipsec_init_inbound_sel(ipsec_selector_t *sel, mblk_t *mp, ipha_t *ipha,
2767     ip6_t *ip6h, uint8_t sel_flags)
2768 {
2769 	uint16_t *ports;
2770 	ushort_t hdr_len;
2771 	int outer_hdr_len = 0;	/* For ICMP tunnel-mode cases... */
2772 	mblk_t *spare_mp = NULL;
2773 	uint8_t *nexthdrp;
2774 	uint8_t nexthdr;
2775 	uint8_t *typecode;
2776 	uint8_t check_proto;
2777 	ip6_pkt_t ipp;
2778 	boolean_t port_policy_present = (sel_flags & SEL_PORT_POLICY);
2779 	boolean_t is_icmp = (sel_flags & SEL_IS_ICMP);
2780 	boolean_t tunnel_mode = (sel_flags & SEL_TUNNEL_MODE);
2781 
2782 	ASSERT((ipha == NULL && ip6h != NULL) ||
2783 	    (ipha != NULL && ip6h == NULL));
2784 
2785 	if (ip6h != NULL) {
2786 		if (is_icmp)
2787 			outer_hdr_len = ((uint8_t *)ip6h) - mp->b_rptr;
2788 
2789 		check_proto = IPPROTO_ICMPV6;
2790 		sel->ips_isv4 = B_FALSE;
2791 		sel->ips_local_addr_v6 = ip6h->ip6_dst;
2792 		sel->ips_remote_addr_v6 = ip6h->ip6_src;
2793 
2794 		bzero(&ipp, sizeof (ipp));
2795 		(void) ip_find_hdr_v6(mp, ip6h, &ipp, NULL);
2796 
2797 		nexthdr = ip6h->ip6_nxt;
2798 		switch (nexthdr) {
2799 		case IPPROTO_HOPOPTS:
2800 		case IPPROTO_ROUTING:
2801 		case IPPROTO_DSTOPTS:
2802 		case IPPROTO_FRAGMENT:
2803 			/*
2804 			 * Use ip_hdr_length_nexthdr_v6().  And have a spare
2805 			 * mblk that's contiguous to feed it
2806 			 */
2807 			if ((spare_mp = msgpullup(mp, -1)) == NULL)
2808 				return (SELRET_NOMEM);
2809 			if (!ip_hdr_length_nexthdr_v6(spare_mp,
2810 			    (ip6_t *)(spare_mp->b_rptr + outer_hdr_len),
2811 			    &hdr_len, &nexthdrp)) {
2812 				/* Malformed packet - caller frees. */
2813 				ipsec_freemsg_chain(spare_mp);
2814 				return (SELRET_BADPKT);
2815 			}
2816 			nexthdr = *nexthdrp;
2817 			/* We can just extract based on hdr_len now. */
2818 			break;
2819 		default:
2820 			hdr_len = IPV6_HDR_LEN;
2821 			break;
2822 		}
2823 
2824 		if (port_policy_present && IS_V6_FRAGMENT(ipp) && !is_icmp) {
2825 			/* IPv6 Fragment */
2826 			ipsec_freemsg_chain(spare_mp);
2827 			return (SELRET_TUNFRAG);
2828 		}
2829 	} else {
2830 		if (is_icmp)
2831 			outer_hdr_len = ((uint8_t *)ipha) - mp->b_rptr;
2832 		check_proto = IPPROTO_ICMP;
2833 		sel->ips_isv4 = B_TRUE;
2834 		sel->ips_local_addr_v4 = ipha->ipha_dst;
2835 		sel->ips_remote_addr_v4 = ipha->ipha_src;
2836 		nexthdr = ipha->ipha_protocol;
2837 		hdr_len = IPH_HDR_LENGTH(ipha);
2838 
2839 		if (port_policy_present &&
2840 		    IS_V4_FRAGMENT(ipha->ipha_fragment_offset_and_flags) &&
2841 		    !is_icmp) {
2842 			/* IPv4 Fragment */
2843 			ipsec_freemsg_chain(spare_mp);
2844 			return (SELRET_TUNFRAG);
2845 		}
2846 
2847 	}
2848 	sel->ips_protocol = nexthdr;
2849 
2850 	if ((nexthdr != IPPROTO_TCP && nexthdr != IPPROTO_UDP &&
2851 	    nexthdr != IPPROTO_SCTP && nexthdr != check_proto) ||
2852 	    (!port_policy_present && tunnel_mode)) {
2853 		sel->ips_remote_port = sel->ips_local_port = 0;
2854 		ipsec_freemsg_chain(spare_mp);
2855 		return (SELRET_SUCCESS);
2856 	}
2857 
2858 	if (&mp->b_rptr[hdr_len] + 4 > mp->b_wptr) {
2859 		/* If we didn't pullup a copy already, do so now. */
2860 		/*
2861 		 * XXX performance, will upper-layers frequently split TCP/UDP
2862 		 * apart from IP or options?  If so, perhaps we should revisit
2863 		 * the spare_mp strategy.
2864 		 */
2865 		ipsec_hdr_pullup_needed++;
2866 		if (spare_mp == NULL &&
2867 		    (spare_mp = msgpullup(mp, -1)) == NULL) {
2868 			return (SELRET_NOMEM);
2869 		}
2870 		ports = (uint16_t *)&spare_mp->b_rptr[hdr_len + outer_hdr_len];
2871 	} else {
2872 		ports = (uint16_t *)&mp->b_rptr[hdr_len + outer_hdr_len];
2873 	}
2874 
2875 	if (nexthdr == check_proto) {
2876 		typecode = (uint8_t *)ports;
2877 		sel->ips_icmp_type = *typecode++;
2878 		sel->ips_icmp_code = *typecode;
2879 		sel->ips_remote_port = sel->ips_local_port = 0;
2880 	} else {
2881 		sel->ips_remote_port = *ports++;
2882 		sel->ips_local_port = *ports;
2883 	}
2884 	ipsec_freemsg_chain(spare_mp);
2885 	return (SELRET_SUCCESS);
2886 }
2887 
2888 static boolean_t
2889 ipsec_init_outbound_ports(ipsec_selector_t *sel, mblk_t *mp, ipha_t *ipha,
2890     ip6_t *ip6h, int outer_hdr_len, ipsec_stack_t *ipss)
2891 {
2892 	/*
2893 	 * XXX cut&paste shared with ipsec_init_inbound_sel
2894 	 */
2895 	uint16_t *ports;
2896 	ushort_t hdr_len;
2897 	mblk_t *spare_mp = NULL;
2898 	uint8_t *nexthdrp;
2899 	uint8_t nexthdr;
2900 	uint8_t *typecode;
2901 	uint8_t check_proto;
2902 
2903 	ASSERT((ipha == NULL && ip6h != NULL) ||
2904 	    (ipha != NULL && ip6h == NULL));
2905 
2906 	if (ip6h != NULL) {
2907 		check_proto = IPPROTO_ICMPV6;
2908 		nexthdr = ip6h->ip6_nxt;
2909 		switch (nexthdr) {
2910 		case IPPROTO_HOPOPTS:
2911 		case IPPROTO_ROUTING:
2912 		case IPPROTO_DSTOPTS:
2913 		case IPPROTO_FRAGMENT:
2914 			/*
2915 			 * Use ip_hdr_length_nexthdr_v6().  And have a spare
2916 			 * mblk that's contiguous to feed it
2917 			 */
2918 			spare_mp = msgpullup(mp, -1);
2919 			if (spare_mp == NULL ||
2920 			    !ip_hdr_length_nexthdr_v6(spare_mp,
2921 			    (ip6_t *)(spare_mp->b_rptr + outer_hdr_len),
2922 			    &hdr_len, &nexthdrp)) {
2923 				/* Always works, even if NULL. */
2924 				ipsec_freemsg_chain(spare_mp);
2925 				ip_drop_packet_chain(mp, B_FALSE, NULL, NULL,
2926 				    DROPPER(ipss, ipds_spd_nomem),
2927 				    &ipss->ipsec_spd_dropper);
2928 				return (B_FALSE);
2929 			} else {
2930 				nexthdr = *nexthdrp;
2931 				/* We can just extract based on hdr_len now. */
2932 			}
2933 			break;
2934 		default:
2935 			hdr_len = IPV6_HDR_LEN;
2936 			break;
2937 		}
2938 	} else {
2939 		check_proto = IPPROTO_ICMP;
2940 		hdr_len = IPH_HDR_LENGTH(ipha);
2941 		nexthdr = ipha->ipha_protocol;
2942 	}
2943 
2944 	sel->ips_protocol = nexthdr;
2945 	if (nexthdr != IPPROTO_TCP && nexthdr != IPPROTO_UDP &&
2946 	    nexthdr != IPPROTO_SCTP && nexthdr != check_proto) {
2947 		sel->ips_local_port = sel->ips_remote_port = 0;
2948 		ipsec_freemsg_chain(spare_mp); /* Always works, even if NULL */
2949 		return (B_TRUE);
2950 	}
2951 
2952 	if (&mp->b_rptr[hdr_len] + 4 + outer_hdr_len > mp->b_wptr) {
2953 		/* If we didn't pullup a copy already, do so now. */
2954 		/*
2955 		 * XXX performance, will upper-layers frequently split TCP/UDP
2956 		 * apart from IP or options?  If so, perhaps we should revisit
2957 		 * the spare_mp strategy.
2958 		 *
2959 		 * XXX should this be msgpullup(mp, hdr_len+4) ???
2960 		 */
2961 		if (spare_mp == NULL &&
2962 		    (spare_mp = msgpullup(mp, -1)) == NULL) {
2963 			ip_drop_packet_chain(mp, B_FALSE, NULL, NULL,
2964 			    DROPPER(ipss, ipds_spd_nomem),
2965 			    &ipss->ipsec_spd_dropper);
2966 			return (B_FALSE);
2967 		}
2968 		ports = (uint16_t *)&spare_mp->b_rptr[hdr_len + outer_hdr_len];
2969 	} else {
2970 		ports = (uint16_t *)&mp->b_rptr[hdr_len + outer_hdr_len];
2971 	}
2972 
2973 	if (nexthdr == check_proto) {
2974 		typecode = (uint8_t *)ports;
2975 		sel->ips_icmp_type = *typecode++;
2976 		sel->ips_icmp_code = *typecode;
2977 		sel->ips_remote_port = sel->ips_local_port = 0;
2978 	} else {
2979 		sel->ips_local_port = *ports++;
2980 		sel->ips_remote_port = *ports;
2981 	}
2982 	ipsec_freemsg_chain(spare_mp);	/* Always works, even if NULL */
2983 	return (B_TRUE);
2984 }
2985 
2986 /*
2987  * Create an ipsec_action_t based on the way an inbound packet was protected.
2988  * Used to reflect traffic back to a sender.
2989  *
2990  * We don't bother interning the action into the hash table.
2991  */
2992 ipsec_action_t *
2993 ipsec_in_to_out_action(ipsec_in_t *ii)
2994 {
2995 	ipsa_t *ah_assoc, *esp_assoc;
2996 	uint_t auth_alg = 0, encr_alg = 0, espa_alg = 0;
2997 	ipsec_action_t *ap;
2998 	boolean_t unique;
2999 
3000 	ap = kmem_cache_alloc(ipsec_action_cache, KM_NOSLEEP);
3001 
3002 	if (ap == NULL)
3003 		return (NULL);
3004 
3005 	bzero(ap, sizeof (*ap));
3006 	HASH_NULL(ap, ipa_hash);
3007 	ap->ipa_next = NULL;
3008 	ap->ipa_refs = 1;
3009 
3010 	/*
3011 	 * Get the algorithms that were used for this packet.
3012 	 */
3013 	ap->ipa_act.ipa_type = IPSEC_ACT_APPLY;
3014 	ap->ipa_act.ipa_log = 0;
3015 	ah_assoc = ii->ipsec_in_ah_sa;
3016 	ap->ipa_act.ipa_apply.ipp_use_ah = (ah_assoc != NULL);
3017 
3018 	esp_assoc = ii->ipsec_in_esp_sa;
3019 	ap->ipa_act.ipa_apply.ipp_use_esp = (esp_assoc != NULL);
3020 
3021 	if (esp_assoc != NULL) {
3022 		encr_alg = esp_assoc->ipsa_encr_alg;
3023 		espa_alg = esp_assoc->ipsa_auth_alg;
3024 		ap->ipa_act.ipa_apply.ipp_use_espa = (espa_alg != 0);
3025 	}
3026 	if (ah_assoc != NULL)
3027 		auth_alg = ah_assoc->ipsa_auth_alg;
3028 
3029 	ap->ipa_act.ipa_apply.ipp_encr_alg = (uint8_t)encr_alg;
3030 	ap->ipa_act.ipa_apply.ipp_auth_alg = (uint8_t)auth_alg;
3031 	ap->ipa_act.ipa_apply.ipp_esp_auth_alg = (uint8_t)espa_alg;
3032 	ap->ipa_act.ipa_apply.ipp_use_se = ii->ipsec_in_decaps;
3033 	unique = B_FALSE;
3034 
3035 	if (esp_assoc != NULL) {
3036 		ap->ipa_act.ipa_apply.ipp_espa_minbits =
3037 		    esp_assoc->ipsa_authkeybits;
3038 		ap->ipa_act.ipa_apply.ipp_espa_maxbits =
3039 		    esp_assoc->ipsa_authkeybits;
3040 		ap->ipa_act.ipa_apply.ipp_espe_minbits =
3041 		    esp_assoc->ipsa_encrkeybits;
3042 		ap->ipa_act.ipa_apply.ipp_espe_maxbits =
3043 		    esp_assoc->ipsa_encrkeybits;
3044 		ap->ipa_act.ipa_apply.ipp_km_proto = esp_assoc->ipsa_kmp;
3045 		ap->ipa_act.ipa_apply.ipp_km_cookie = esp_assoc->ipsa_kmc;
3046 		if (esp_assoc->ipsa_flags & IPSA_F_UNIQUE)
3047 			unique = B_TRUE;
3048 	}
3049 	if (ah_assoc != NULL) {
3050 		ap->ipa_act.ipa_apply.ipp_ah_minbits =
3051 		    ah_assoc->ipsa_authkeybits;
3052 		ap->ipa_act.ipa_apply.ipp_ah_maxbits =
3053 		    ah_assoc->ipsa_authkeybits;
3054 		ap->ipa_act.ipa_apply.ipp_km_proto = ah_assoc->ipsa_kmp;
3055 		ap->ipa_act.ipa_apply.ipp_km_cookie = ah_assoc->ipsa_kmc;
3056 		if (ah_assoc->ipsa_flags & IPSA_F_UNIQUE)
3057 			unique = B_TRUE;
3058 	}
3059 	ap->ipa_act.ipa_apply.ipp_use_unique = unique;
3060 	ap->ipa_want_unique = unique;
3061 	ap->ipa_allow_clear = B_FALSE;
3062 	ap->ipa_want_se = ii->ipsec_in_decaps;
3063 	ap->ipa_want_ah = (ah_assoc != NULL);
3064 	ap->ipa_want_esp = (esp_assoc != NULL);
3065 
3066 	ap->ipa_ovhd = ipsec_act_ovhd(&ap->ipa_act);
3067 
3068 	ap->ipa_act.ipa_apply.ipp_replay_depth = 0; /* don't care */
3069 
3070 	return (ap);
3071 }
3072 
3073 
3074 /*
3075  * Compute the worst-case amount of extra space required by an action.
3076  * Note that, because of the ESP considerations listed below, this is
3077  * actually not the same as the best-case reduction in the MTU; in the
3078  * future, we should pass additional information to this function to
3079  * allow the actual MTU impact to be computed.
3080  *
3081  * AH: Revisit this if we implement algorithms with
3082  * a verifier size of more than 12 bytes.
3083  *
3084  * ESP: A more exact but more messy computation would take into
3085  * account the interaction between the cipher block size and the
3086  * effective MTU, yielding the inner payload size which reflects a
3087  * packet with *minimum* ESP padding..
3088  */
3089 int32_t
3090 ipsec_act_ovhd(const ipsec_act_t *act)
3091 {
3092 	int32_t overhead = 0;
3093 
3094 	if (act->ipa_type == IPSEC_ACT_APPLY) {
3095 		const ipsec_prot_t *ipp = &act->ipa_apply;
3096 
3097 		if (ipp->ipp_use_ah)
3098 			overhead += IPSEC_MAX_AH_HDR_SIZE;
3099 		if (ipp->ipp_use_esp) {
3100 			overhead += IPSEC_MAX_ESP_HDR_SIZE;
3101 			overhead += sizeof (struct udphdr);
3102 		}
3103 		if (ipp->ipp_use_se)
3104 			overhead += IP_SIMPLE_HDR_LENGTH;
3105 	}
3106 	return (overhead);
3107 }
3108 
3109 /*
3110  * This hash function is used only when creating policies and thus is not
3111  * performance-critical for packet flows.
3112  *
3113  * Future work: canonicalize the structures hashed with this (i.e.,
3114  * zeroize padding) so the hash works correctly.
3115  */
3116 /* ARGSUSED */
3117 static uint32_t
3118 policy_hash(int size, const void *start, const void *end)
3119 {
3120 	return (0);
3121 }
3122 
3123 
3124 /*
3125  * Hash function macros for each address type.
3126  *
3127  * The IPV6 hash function assumes that the low order 32-bits of the
3128  * address (typically containing the low order 24 bits of the mac
3129  * address) are reasonably well-distributed.  Revisit this if we run
3130  * into trouble from lots of collisions on ::1 addresses and the like
3131  * (seems unlikely).
3132  */
3133 #define	IPSEC_IPV4_HASH(a, n) ((a) % (n))
3134 #define	IPSEC_IPV6_HASH(a, n) (((a).s6_addr32[3]) % (n))
3135 
3136 /*
3137  * These two hash functions should produce coordinated values
3138  * but have slightly different roles.
3139  */
3140 static uint32_t
3141 selkey_hash(const ipsec_selkey_t *selkey, netstack_t *ns)
3142 {
3143 	uint32_t valid = selkey->ipsl_valid;
3144 	ipsec_stack_t	*ipss = ns->netstack_ipsec;
3145 
3146 	if (!(valid & IPSL_REMOTE_ADDR))
3147 		return (IPSEC_SEL_NOHASH);
3148 
3149 	if (valid & IPSL_IPV4) {
3150 		if (selkey->ipsl_remote_pfxlen == 32) {
3151 			return (IPSEC_IPV4_HASH(selkey->ipsl_remote.ipsad_v4,
3152 			    ipss->ipsec_spd_hashsize));
3153 		}
3154 	}
3155 	if (valid & IPSL_IPV6) {
3156 		if (selkey->ipsl_remote_pfxlen == 128) {
3157 			return (IPSEC_IPV6_HASH(selkey->ipsl_remote.ipsad_v6,
3158 			    ipss->ipsec_spd_hashsize));
3159 		}
3160 	}
3161 	return (IPSEC_SEL_NOHASH);
3162 }
3163 
3164 static uint32_t
3165 selector_hash(ipsec_selector_t *sel, ipsec_policy_root_t *root)
3166 {
3167 	if (sel->ips_isv4) {
3168 		return (IPSEC_IPV4_HASH(sel->ips_remote_addr_v4,
3169 		    root->ipr_nchains));
3170 	}
3171 	return (IPSEC_IPV6_HASH(sel->ips_remote_addr_v6, root->ipr_nchains));
3172 }
3173 
3174 /*
3175  * Intern actions into the action hash table.
3176  */
3177 ipsec_action_t *
3178 ipsec_act_find(const ipsec_act_t *a, int n, netstack_t *ns)
3179 {
3180 	int i;
3181 	uint32_t hval;
3182 	ipsec_action_t *ap;
3183 	ipsec_action_t *prev = NULL;
3184 	int32_t overhead, maxovhd = 0;
3185 	boolean_t allow_clear = B_FALSE;
3186 	boolean_t want_ah = B_FALSE;
3187 	boolean_t want_esp = B_FALSE;
3188 	boolean_t want_se = B_FALSE;
3189 	boolean_t want_unique = B_FALSE;
3190 	ipsec_stack_t	*ipss = ns->netstack_ipsec;
3191 
3192 	/*
3193 	 * TODO: should canonicalize a[] (i.e., zeroize any padding)
3194 	 * so we can use a non-trivial policy_hash function.
3195 	 */
3196 	for (i = n-1; i >= 0; i--) {
3197 		hval = policy_hash(IPSEC_ACTION_HASH_SIZE, &a[i], &a[n]);
3198 
3199 		HASH_LOCK(ipss->ipsec_action_hash, hval);
3200 
3201 		for (HASH_ITERATE(ap, ipa_hash,
3202 		    ipss->ipsec_action_hash, hval)) {
3203 			if (bcmp(&ap->ipa_act, &a[i], sizeof (*a)) != 0)
3204 				continue;
3205 			if (ap->ipa_next != prev)
3206 				continue;
3207 			break;
3208 		}
3209 		if (ap != NULL) {
3210 			HASH_UNLOCK(ipss->ipsec_action_hash, hval);
3211 			prev = ap;
3212 			continue;
3213 		}
3214 		/*
3215 		 * need to allocate a new one..
3216 		 */
3217 		ap = kmem_cache_alloc(ipsec_action_cache, KM_NOSLEEP);
3218 		if (ap == NULL) {
3219 			HASH_UNLOCK(ipss->ipsec_action_hash, hval);
3220 			if (prev != NULL)
3221 				ipsec_action_free(prev);
3222 			return (NULL);
3223 		}
3224 		HASH_INSERT(ap, ipa_hash, ipss->ipsec_action_hash, hval);
3225 
3226 		ap->ipa_next = prev;
3227 		ap->ipa_act = a[i];
3228 
3229 		overhead = ipsec_act_ovhd(&a[i]);
3230 		if (maxovhd < overhead)
3231 			maxovhd = overhead;
3232 
3233 		if ((a[i].ipa_type == IPSEC_ACT_BYPASS) ||
3234 		    (a[i].ipa_type == IPSEC_ACT_CLEAR))
3235 			allow_clear = B_TRUE;
3236 		if (a[i].ipa_type == IPSEC_ACT_APPLY) {
3237 			const ipsec_prot_t *ipp = &a[i].ipa_apply;
3238 
3239 			ASSERT(ipp->ipp_use_ah || ipp->ipp_use_esp);
3240 			want_ah |= ipp->ipp_use_ah;
3241 			want_esp |= ipp->ipp_use_esp;
3242 			want_se |= ipp->ipp_use_se;
3243 			want_unique |= ipp->ipp_use_unique;
3244 		}
3245 		ap->ipa_allow_clear = allow_clear;
3246 		ap->ipa_want_ah = want_ah;
3247 		ap->ipa_want_esp = want_esp;
3248 		ap->ipa_want_se = want_se;
3249 		ap->ipa_want_unique = want_unique;
3250 		ap->ipa_refs = 1; /* from the hash table */
3251 		ap->ipa_ovhd = maxovhd;
3252 		if (prev)
3253 			prev->ipa_refs++;
3254 		prev = ap;
3255 		HASH_UNLOCK(ipss->ipsec_action_hash, hval);
3256 	}
3257 
3258 	ap->ipa_refs++;		/* caller's reference */
3259 
3260 	return (ap);
3261 }
3262 
3263 /*
3264  * Called when refcount goes to 0, indicating that all references to this
3265  * node are gone.
3266  *
3267  * This does not unchain the action from the hash table.
3268  */
3269 void
3270 ipsec_action_free(ipsec_action_t *ap)
3271 {
3272 	for (;;) {
3273 		ipsec_action_t *np = ap->ipa_next;
3274 		ASSERT(ap->ipa_refs == 0);
3275 		ASSERT(ap->ipa_hash.hash_pp == NULL);
3276 		kmem_cache_free(ipsec_action_cache, ap);
3277 		ap = np;
3278 		/* Inlined IPACT_REFRELE -- avoid recursion */
3279 		if (ap == NULL)
3280 			break;
3281 		membar_exit();
3282 		if (atomic_add_32_nv(&(ap)->ipa_refs, -1) != 0)
3283 			break;
3284 		/* End inlined IPACT_REFRELE */
3285 	}
3286 }
3287 
3288 /*
3289  * Called when the action hash table goes away.
3290  *
3291  * The actions can be queued on an mblk with ipsec_in or
3292  * ipsec_out, hence the actions might still be around.
3293  * But we decrement ipa_refs here since we no longer have
3294  * a reference to the action from the hash table.
3295  */
3296 static void
3297 ipsec_action_free_table(ipsec_action_t *ap)
3298 {
3299 	while (ap != NULL) {
3300 		ipsec_action_t *np = ap->ipa_next;
3301 
3302 		/* FIXME: remove? */
3303 		(void) printf("ipsec_action_free_table(%p) ref %d\n",
3304 		    (void *)ap, ap->ipa_refs);
3305 		ASSERT(ap->ipa_refs > 0);
3306 		IPACT_REFRELE(ap);
3307 		ap = np;
3308 	}
3309 }
3310 
3311 /*
3312  * Need to walk all stack instances since the reclaim function
3313  * is global for all instances
3314  */
3315 /* ARGSUSED */
3316 static void
3317 ipsec_action_reclaim(void *arg)
3318 {
3319 	netstack_handle_t nh;
3320 	netstack_t *ns;
3321 
3322 	netstack_next_init(&nh);
3323 	while ((ns = netstack_next(&nh)) != NULL) {
3324 		ipsec_action_reclaim_stack(ns);
3325 		netstack_rele(ns);
3326 	}
3327 	netstack_next_fini(&nh);
3328 }
3329 
3330 /*
3331  * Periodically sweep action hash table for actions with refcount==1, and
3332  * nuke them.  We cannot do this "on demand" (i.e., from IPACT_REFRELE)
3333  * because we can't close the race between another thread finding the action
3334  * in the hash table without holding the bucket lock during IPACT_REFRELE.
3335  * Instead, we run this function sporadically to clean up after ourselves;
3336  * we also set it as the "reclaim" function for the action kmem_cache.
3337  *
3338  * Note that it may take several passes of ipsec_action_gc() to free all
3339  * "stale" actions.
3340  */
3341 static void
3342 ipsec_action_reclaim_stack(netstack_t *ns)
3343 {
3344 	int i;
3345 	ipsec_stack_t	*ipss = ns->netstack_ipsec;
3346 
3347 	for (i = 0; i < IPSEC_ACTION_HASH_SIZE; i++) {
3348 		ipsec_action_t *ap, *np;
3349 
3350 		/* skip the lock if nobody home */
3351 		if (ipss->ipsec_action_hash[i].hash_head == NULL)
3352 			continue;
3353 
3354 		HASH_LOCK(ipss->ipsec_action_hash, i);
3355 		for (ap = ipss->ipsec_action_hash[i].hash_head;
3356 		    ap != NULL; ap = np) {
3357 			ASSERT(ap->ipa_refs > 0);
3358 			np = ap->ipa_hash.hash_next;
3359 			if (ap->ipa_refs > 1)
3360 				continue;
3361 			HASH_UNCHAIN(ap, ipa_hash,
3362 			    ipss->ipsec_action_hash, i);
3363 			IPACT_REFRELE(ap);
3364 		}
3365 		HASH_UNLOCK(ipss->ipsec_action_hash, i);
3366 	}
3367 }
3368 
3369 /*
3370  * Intern a selector set into the selector set hash table.
3371  * This is simpler than the actions case..
3372  */
3373 static ipsec_sel_t *
3374 ipsec_find_sel(ipsec_selkey_t *selkey, netstack_t *ns)
3375 {
3376 	ipsec_sel_t *sp;
3377 	uint32_t hval, bucket;
3378 	ipsec_stack_t	*ipss = ns->netstack_ipsec;
3379 
3380 	/*
3381 	 * Exactly one AF bit should be set in selkey.
3382 	 */
3383 	ASSERT(!(selkey->ipsl_valid & IPSL_IPV4) ^
3384 	    !(selkey->ipsl_valid & IPSL_IPV6));
3385 
3386 	hval = selkey_hash(selkey, ns);
3387 	/* Set pol_hval to uninitialized until we put it in a polhead. */
3388 	selkey->ipsl_sel_hval = hval;
3389 
3390 	bucket = (hval == IPSEC_SEL_NOHASH) ? 0 : hval;
3391 
3392 	ASSERT(!HASH_LOCKED(ipss->ipsec_sel_hash, bucket));
3393 	HASH_LOCK(ipss->ipsec_sel_hash, bucket);
3394 
3395 	for (HASH_ITERATE(sp, ipsl_hash, ipss->ipsec_sel_hash, bucket)) {
3396 		if (bcmp(&sp->ipsl_key, selkey,
3397 		    offsetof(ipsec_selkey_t, ipsl_pol_hval)) == 0)
3398 			break;
3399 	}
3400 	if (sp != NULL) {
3401 		sp->ipsl_refs++;
3402 
3403 		HASH_UNLOCK(ipss->ipsec_sel_hash, bucket);
3404 		return (sp);
3405 	}
3406 
3407 	sp = kmem_cache_alloc(ipsec_sel_cache, KM_NOSLEEP);
3408 	if (sp == NULL) {
3409 		HASH_UNLOCK(ipss->ipsec_sel_hash, bucket);
3410 		return (NULL);
3411 	}
3412 
3413 	HASH_INSERT(sp, ipsl_hash, ipss->ipsec_sel_hash, bucket);
3414 	sp->ipsl_refs = 2;	/* one for hash table, one for caller */
3415 	sp->ipsl_key = *selkey;
3416 	/* Set to uninitalized and have insertion into polhead fix things. */
3417 	if (selkey->ipsl_sel_hval != IPSEC_SEL_NOHASH)
3418 		sp->ipsl_key.ipsl_pol_hval = 0;
3419 	else
3420 		sp->ipsl_key.ipsl_pol_hval = IPSEC_SEL_NOHASH;
3421 
3422 	HASH_UNLOCK(ipss->ipsec_sel_hash, bucket);
3423 
3424 	return (sp);
3425 }
3426 
3427 static void
3428 ipsec_sel_rel(ipsec_sel_t **spp, netstack_t *ns)
3429 {
3430 	ipsec_sel_t *sp = *spp;
3431 	int hval = sp->ipsl_key.ipsl_sel_hval;
3432 	ipsec_stack_t	*ipss = ns->netstack_ipsec;
3433 
3434 	*spp = NULL;
3435 
3436 	if (hval == IPSEC_SEL_NOHASH)
3437 		hval = 0;
3438 
3439 	ASSERT(!HASH_LOCKED(ipss->ipsec_sel_hash, hval));
3440 	HASH_LOCK(ipss->ipsec_sel_hash, hval);
3441 	if (--sp->ipsl_refs == 1) {
3442 		HASH_UNCHAIN(sp, ipsl_hash, ipss->ipsec_sel_hash, hval);
3443 		sp->ipsl_refs--;
3444 		HASH_UNLOCK(ipss->ipsec_sel_hash, hval);
3445 		ASSERT(sp->ipsl_refs == 0);
3446 		kmem_cache_free(ipsec_sel_cache, sp);
3447 		/* Caller unlocks */
3448 		return;
3449 	}
3450 
3451 	HASH_UNLOCK(ipss->ipsec_sel_hash, hval);
3452 }
3453 
3454 /*
3455  * Free a policy rule which we know is no longer being referenced.
3456  */
3457 void
3458 ipsec_policy_free(ipsec_policy_t *ipp, netstack_t *ns)
3459 {
3460 	ASSERT(ipp->ipsp_refs == 0);
3461 	ASSERT(ipp->ipsp_sel != NULL);
3462 	ASSERT(ipp->ipsp_act != NULL);
3463 
3464 	ipsec_sel_rel(&ipp->ipsp_sel, ns);
3465 	IPACT_REFRELE(ipp->ipsp_act);
3466 	kmem_cache_free(ipsec_pol_cache, ipp);
3467 }
3468 
3469 /*
3470  * Construction of new policy rules; construct a policy, and add it to
3471  * the appropriate tables.
3472  */
3473 ipsec_policy_t *
3474 ipsec_policy_create(ipsec_selkey_t *keys, const ipsec_act_t *a,
3475     int nacts, int prio, uint64_t *index_ptr, netstack_t *ns)
3476 {
3477 	ipsec_action_t *ap;
3478 	ipsec_sel_t *sp;
3479 	ipsec_policy_t *ipp;
3480 	ipsec_stack_t	*ipss = ns->netstack_ipsec;
3481 
3482 	if (index_ptr == NULL)
3483 		index_ptr = &ipss->ipsec_next_policy_index;
3484 
3485 	ipp = kmem_cache_alloc(ipsec_pol_cache, KM_NOSLEEP);
3486 	ap = ipsec_act_find(a, nacts, ns);
3487 	sp = ipsec_find_sel(keys, ns);
3488 
3489 	if ((ap == NULL) || (sp == NULL) || (ipp == NULL)) {
3490 		if (ap != NULL) {
3491 			IPACT_REFRELE(ap);
3492 		}
3493 		if (sp != NULL)
3494 			ipsec_sel_rel(&sp, ns);
3495 		if (ipp != NULL)
3496 			kmem_cache_free(ipsec_pol_cache, ipp);
3497 		return (NULL);
3498 	}
3499 
3500 	HASH_NULL(ipp, ipsp_hash);
3501 
3502 	ipp->ipsp_refs = 1;	/* caller's reference */
3503 	ipp->ipsp_sel = sp;
3504 	ipp->ipsp_act = ap;
3505 	ipp->ipsp_prio = prio;	/* rule priority */
3506 	ipp->ipsp_index = *index_ptr;
3507 	(*index_ptr)++;
3508 
3509 	return (ipp);
3510 }
3511 
3512 static void
3513 ipsec_update_present_flags(ipsec_stack_t *ipss)
3514 {
3515 	boolean_t hashpol;
3516 
3517 	hashpol = (avl_numnodes(&ipss->ipsec_system_policy.iph_rulebyid) > 0);
3518 
3519 	if (hashpol) {
3520 		ipss->ipsec_outbound_v4_policy_present = B_TRUE;
3521 		ipss->ipsec_outbound_v6_policy_present = B_TRUE;
3522 		ipss->ipsec_inbound_v4_policy_present = B_TRUE;
3523 		ipss->ipsec_inbound_v6_policy_present = B_TRUE;
3524 		return;
3525 	}
3526 
3527 	ipss->ipsec_outbound_v4_policy_present = (NULL !=
3528 	    ipss->ipsec_system_policy.iph_root[IPSEC_TYPE_OUTBOUND].
3529 	    ipr_nonhash[IPSEC_AF_V4]);
3530 	ipss->ipsec_outbound_v6_policy_present = (NULL !=
3531 	    ipss->ipsec_system_policy.iph_root[IPSEC_TYPE_OUTBOUND].
3532 	    ipr_nonhash[IPSEC_AF_V6]);
3533 	ipss->ipsec_inbound_v4_policy_present = (NULL !=
3534 	    ipss->ipsec_system_policy.iph_root[IPSEC_TYPE_INBOUND].
3535 	    ipr_nonhash[IPSEC_AF_V4]);
3536 	ipss->ipsec_inbound_v6_policy_present = (NULL !=
3537 	    ipss->ipsec_system_policy.iph_root[IPSEC_TYPE_INBOUND].
3538 	    ipr_nonhash[IPSEC_AF_V6]);
3539 }
3540 
3541 boolean_t
3542 ipsec_policy_delete(ipsec_policy_head_t *php, ipsec_selkey_t *keys, int dir,
3543 	netstack_t *ns)
3544 {
3545 	ipsec_sel_t *sp;
3546 	ipsec_policy_t *ip, *nip, *head;
3547 	int af;
3548 	ipsec_policy_root_t *pr = &php->iph_root[dir];
3549 
3550 	sp = ipsec_find_sel(keys, ns);
3551 
3552 	if (sp == NULL)
3553 		return (B_FALSE);
3554 
3555 	af = (sp->ipsl_key.ipsl_valid & IPSL_IPV4) ? IPSEC_AF_V4 : IPSEC_AF_V6;
3556 
3557 	rw_enter(&php->iph_lock, RW_WRITER);
3558 
3559 	if (sp->ipsl_key.ipsl_pol_hval == IPSEC_SEL_NOHASH) {
3560 		head = pr->ipr_nonhash[af];
3561 	} else {
3562 		head = pr->ipr_hash[sp->ipsl_key.ipsl_pol_hval].hash_head;
3563 	}
3564 
3565 	for (ip = head; ip != NULL; ip = nip) {
3566 		nip = ip->ipsp_hash.hash_next;
3567 		if (ip->ipsp_sel != sp) {
3568 			continue;
3569 		}
3570 
3571 		IPPOL_UNCHAIN(php, ip, ns);
3572 
3573 		php->iph_gen++;
3574 		ipsec_update_present_flags(ns->netstack_ipsec);
3575 
3576 		rw_exit(&php->iph_lock);
3577 
3578 		ipsec_sel_rel(&sp, ns);
3579 
3580 		return (B_TRUE);
3581 	}
3582 
3583 	rw_exit(&php->iph_lock);
3584 	ipsec_sel_rel(&sp, ns);
3585 	return (B_FALSE);
3586 }
3587 
3588 int
3589 ipsec_policy_delete_index(ipsec_policy_head_t *php, uint64_t policy_index,
3590     netstack_t *ns)
3591 {
3592 	boolean_t found = B_FALSE;
3593 	ipsec_policy_t ipkey;
3594 	ipsec_policy_t *ip;
3595 	avl_index_t where;
3596 
3597 	(void) memset(&ipkey, 0, sizeof (ipkey));
3598 	ipkey.ipsp_index = policy_index;
3599 
3600 	rw_enter(&php->iph_lock, RW_WRITER);
3601 
3602 	/*
3603 	 * We could be cleverer here about the walk.
3604 	 * but well, (k+1)*log(N) will do for now (k==number of matches,
3605 	 * N==number of table entries
3606 	 */
3607 	for (;;) {
3608 		ip = (ipsec_policy_t *)avl_find(&php->iph_rulebyid,
3609 		    (void *)&ipkey, &where);
3610 		ASSERT(ip == NULL);
3611 
3612 		ip = avl_nearest(&php->iph_rulebyid, where, AVL_AFTER);
3613 
3614 		if (ip == NULL)
3615 			break;
3616 
3617 		if (ip->ipsp_index != policy_index) {
3618 			ASSERT(ip->ipsp_index > policy_index);
3619 			break;
3620 		}
3621 
3622 		IPPOL_UNCHAIN(php, ip, ns);
3623 		found = B_TRUE;
3624 	}
3625 
3626 	if (found) {
3627 		php->iph_gen++;
3628 		ipsec_update_present_flags(ns->netstack_ipsec);
3629 	}
3630 
3631 	rw_exit(&php->iph_lock);
3632 
3633 	return (found ? 0 : ENOENT);
3634 }
3635 
3636 /*
3637  * Given a constructed ipsec_policy_t policy rule, see if it can be entered
3638  * into the correct policy ruleset.  As a side-effect, it sets the hash
3639  * entries on "ipp"'s ipsp_pol_hval.
3640  *
3641  * Returns B_TRUE if it can be entered, B_FALSE if it can't be (because a
3642  * duplicate policy exists with exactly the same selectors), or an icmp
3643  * rule exists with a different encryption/authentication action.
3644  */
3645 boolean_t
3646 ipsec_check_policy(ipsec_policy_head_t *php, ipsec_policy_t *ipp, int direction)
3647 {
3648 	ipsec_policy_root_t *pr = &php->iph_root[direction];
3649 	int af = -1;
3650 	ipsec_policy_t *p2, *head;
3651 	uint8_t check_proto;
3652 	ipsec_selkey_t *selkey = &ipp->ipsp_sel->ipsl_key;
3653 	uint32_t	valid = selkey->ipsl_valid;
3654 
3655 	if (valid & IPSL_IPV6) {
3656 		ASSERT(!(valid & IPSL_IPV4));
3657 		af = IPSEC_AF_V6;
3658 		check_proto = IPPROTO_ICMPV6;
3659 	} else {
3660 		ASSERT(valid & IPSL_IPV4);
3661 		af = IPSEC_AF_V4;
3662 		check_proto = IPPROTO_ICMP;
3663 	}
3664 
3665 	ASSERT(RW_WRITE_HELD(&php->iph_lock));
3666 
3667 	/*
3668 	 * Double-check that we don't have any duplicate selectors here.
3669 	 * Because selectors are interned below, we need only compare pointers
3670 	 * for equality.
3671 	 */
3672 	if (selkey->ipsl_sel_hval == IPSEC_SEL_NOHASH) {
3673 		head = pr->ipr_nonhash[af];
3674 	} else {
3675 		selkey->ipsl_pol_hval =
3676 		    (selkey->ipsl_valid & IPSL_IPV4) ?
3677 		    IPSEC_IPV4_HASH(selkey->ipsl_remote.ipsad_v4,
3678 		    pr->ipr_nchains) :
3679 		    IPSEC_IPV6_HASH(selkey->ipsl_remote.ipsad_v6,
3680 		    pr->ipr_nchains);
3681 
3682 		head = pr->ipr_hash[selkey->ipsl_pol_hval].hash_head;
3683 	}
3684 
3685 	for (p2 = head; p2 != NULL; p2 = p2->ipsp_hash.hash_next) {
3686 		if (p2->ipsp_sel == ipp->ipsp_sel)
3687 			return (B_FALSE);
3688 	}
3689 
3690 	/*
3691 	 * If it's ICMP and not a drop or pass rule, run through the ICMP
3692 	 * rules and make sure the action is either new or the same as any
3693 	 * other actions.  We don't have to check the full chain because
3694 	 * discard and bypass will override all other actions
3695 	 */
3696 
3697 	if (valid & IPSL_PROTOCOL &&
3698 	    selkey->ipsl_proto == check_proto &&
3699 	    (ipp->ipsp_act->ipa_act.ipa_type == IPSEC_ACT_APPLY)) {
3700 
3701 		for (p2 = head; p2 != NULL; p2 = p2->ipsp_hash.hash_next) {
3702 
3703 			if (p2->ipsp_sel->ipsl_key.ipsl_valid & IPSL_PROTOCOL &&
3704 			    p2->ipsp_sel->ipsl_key.ipsl_proto == check_proto &&
3705 			    (p2->ipsp_act->ipa_act.ipa_type ==
3706 			    IPSEC_ACT_APPLY)) {
3707 				return (ipsec_compare_action(p2, ipp));
3708 			}
3709 		}
3710 	}
3711 
3712 	return (B_TRUE);
3713 }
3714 
3715 /*
3716  * compare the action chains of two policies for equality
3717  * B_TRUE -> effective equality
3718  */
3719 
3720 static boolean_t
3721 ipsec_compare_action(ipsec_policy_t *p1, ipsec_policy_t *p2)
3722 {
3723 
3724 	ipsec_action_t *act1, *act2;
3725 
3726 	/* We have a valid rule. Let's compare the actions */
3727 	if (p1->ipsp_act == p2->ipsp_act) {
3728 		/* same action. We are good */
3729 		return (B_TRUE);
3730 	}
3731 
3732 	/* we have to walk the chain */
3733 
3734 	act1 = p1->ipsp_act;
3735 	act2 = p2->ipsp_act;
3736 
3737 	while (act1 != NULL && act2 != NULL) {
3738 
3739 		/* otherwise, Are we close enough? */
3740 		if (act1->ipa_allow_clear != act2->ipa_allow_clear ||
3741 		    act1->ipa_want_ah != act2->ipa_want_ah ||
3742 		    act1->ipa_want_esp != act2->ipa_want_esp ||
3743 		    act1->ipa_want_se != act2->ipa_want_se) {
3744 			/* Nope, we aren't */
3745 			return (B_FALSE);
3746 		}
3747 
3748 		if (act1->ipa_want_ah) {
3749 			if (act1->ipa_act.ipa_apply.ipp_auth_alg !=
3750 			    act2->ipa_act.ipa_apply.ipp_auth_alg) {
3751 				return (B_FALSE);
3752 			}
3753 
3754 			if (act1->ipa_act.ipa_apply.ipp_ah_minbits !=
3755 			    act2->ipa_act.ipa_apply.ipp_ah_minbits ||
3756 			    act1->ipa_act.ipa_apply.ipp_ah_maxbits !=
3757 			    act2->ipa_act.ipa_apply.ipp_ah_maxbits) {
3758 				return (B_FALSE);
3759 			}
3760 		}
3761 
3762 		if (act1->ipa_want_esp) {
3763 			if (act1->ipa_act.ipa_apply.ipp_use_esp !=
3764 			    act2->ipa_act.ipa_apply.ipp_use_esp ||
3765 			    act1->ipa_act.ipa_apply.ipp_use_espa !=
3766 			    act2->ipa_act.ipa_apply.ipp_use_espa) {
3767 				return (B_FALSE);
3768 			}
3769 
3770 			if (act1->ipa_act.ipa_apply.ipp_use_esp) {
3771 				if (act1->ipa_act.ipa_apply.ipp_encr_alg !=
3772 				    act2->ipa_act.ipa_apply.ipp_encr_alg) {
3773 					return (B_FALSE);
3774 				}
3775 
3776 				if (act1->ipa_act.ipa_apply.ipp_espe_minbits !=
3777 				    act2->ipa_act.ipa_apply.ipp_espe_minbits ||
3778 				    act1->ipa_act.ipa_apply.ipp_espe_maxbits !=
3779 				    act2->ipa_act.ipa_apply.ipp_espe_maxbits) {
3780 					return (B_FALSE);
3781 				}
3782 			}
3783 
3784 			if (act1->ipa_act.ipa_apply.ipp_use_espa) {
3785 				if (act1->ipa_act.ipa_apply.ipp_esp_auth_alg !=
3786 				    act2->ipa_act.ipa_apply.ipp_esp_auth_alg) {
3787 					return (B_FALSE);
3788 				}
3789 
3790 				if (act1->ipa_act.ipa_apply.ipp_espa_minbits !=
3791 				    act2->ipa_act.ipa_apply.ipp_espa_minbits ||
3792 				    act1->ipa_act.ipa_apply.ipp_espa_maxbits !=
3793 				    act2->ipa_act.ipa_apply.ipp_espa_maxbits) {
3794 					return (B_FALSE);
3795 				}
3796 			}
3797 
3798 		}
3799 
3800 		act1 = act1->ipa_next;
3801 		act2 = act2->ipa_next;
3802 	}
3803 
3804 	if (act1 != NULL || act2 != NULL) {
3805 		return (B_FALSE);
3806 	}
3807 
3808 	return (B_TRUE);
3809 }
3810 
3811 
3812 /*
3813  * Given a constructed ipsec_policy_t policy rule, enter it into
3814  * the correct policy ruleset.
3815  *
3816  * ipsec_check_policy() is assumed to have succeeded first (to check for
3817  * duplicates).
3818  */
3819 void
3820 ipsec_enter_policy(ipsec_policy_head_t *php, ipsec_policy_t *ipp, int direction,
3821     netstack_t *ns)
3822 {
3823 	ipsec_policy_root_t *pr = &php->iph_root[direction];
3824 	ipsec_selkey_t *selkey = &ipp->ipsp_sel->ipsl_key;
3825 	uint32_t valid = selkey->ipsl_valid;
3826 	uint32_t hval = selkey->ipsl_pol_hval;
3827 	int af = -1;
3828 
3829 	ASSERT(RW_WRITE_HELD(&php->iph_lock));
3830 
3831 	if (valid & IPSL_IPV6) {
3832 		ASSERT(!(valid & IPSL_IPV4));
3833 		af = IPSEC_AF_V6;
3834 	} else {
3835 		ASSERT(valid & IPSL_IPV4);
3836 		af = IPSEC_AF_V4;
3837 	}
3838 
3839 	php->iph_gen++;
3840 
3841 	if (hval == IPSEC_SEL_NOHASH) {
3842 		HASHLIST_INSERT(ipp, ipsp_hash, pr->ipr_nonhash[af]);
3843 	} else {
3844 		HASH_LOCK(pr->ipr_hash, hval);
3845 		HASH_INSERT(ipp, ipsp_hash, pr->ipr_hash, hval);
3846 		HASH_UNLOCK(pr->ipr_hash, hval);
3847 	}
3848 
3849 	ipsec_insert_always(&php->iph_rulebyid, ipp);
3850 
3851 	ipsec_update_present_flags(ns->netstack_ipsec);
3852 }
3853 
3854 static void
3855 ipsec_ipr_flush(ipsec_policy_head_t *php, ipsec_policy_root_t *ipr,
3856     netstack_t *ns)
3857 {
3858 	ipsec_policy_t *ip, *nip;
3859 	int af, chain, nchain;
3860 
3861 	for (af = 0; af < IPSEC_NAF; af++) {
3862 		for (ip = ipr->ipr_nonhash[af]; ip != NULL; ip = nip) {
3863 			nip = ip->ipsp_hash.hash_next;
3864 			IPPOL_UNCHAIN(php, ip, ns);
3865 		}
3866 		ipr->ipr_nonhash[af] = NULL;
3867 	}
3868 	nchain = ipr->ipr_nchains;
3869 
3870 	for (chain = 0; chain < nchain; chain++) {
3871 		for (ip = ipr->ipr_hash[chain].hash_head; ip != NULL;
3872 		    ip = nip) {
3873 			nip = ip->ipsp_hash.hash_next;
3874 			IPPOL_UNCHAIN(php, ip, ns);
3875 		}
3876 		ipr->ipr_hash[chain].hash_head = NULL;
3877 	}
3878 }
3879 
3880 void
3881 ipsec_polhead_flush(ipsec_policy_head_t *php, netstack_t *ns)
3882 {
3883 	int dir;
3884 
3885 	ASSERT(RW_WRITE_HELD(&php->iph_lock));
3886 
3887 	for (dir = 0; dir < IPSEC_NTYPES; dir++)
3888 		ipsec_ipr_flush(php, &php->iph_root[dir], ns);
3889 
3890 	ipsec_update_present_flags(ns->netstack_ipsec);
3891 }
3892 
3893 void
3894 ipsec_polhead_free(ipsec_policy_head_t *php, netstack_t *ns)
3895 {
3896 	int dir;
3897 
3898 	ASSERT(php->iph_refs == 0);
3899 
3900 	rw_enter(&php->iph_lock, RW_WRITER);
3901 	ipsec_polhead_flush(php, ns);
3902 	rw_exit(&php->iph_lock);
3903 	rw_destroy(&php->iph_lock);
3904 	for (dir = 0; dir < IPSEC_NTYPES; dir++) {
3905 		ipsec_policy_root_t *ipr = &php->iph_root[dir];
3906 		int chain;
3907 
3908 		for (chain = 0; chain < ipr->ipr_nchains; chain++)
3909 			mutex_destroy(&(ipr->ipr_hash[chain].hash_lock));
3910 
3911 	}
3912 	ipsec_polhead_free_table(php);
3913 	kmem_free(php, sizeof (*php));
3914 }
3915 
3916 static void
3917 ipsec_ipr_init(ipsec_policy_root_t *ipr)
3918 {
3919 	int af;
3920 
3921 	ipr->ipr_nchains = 0;
3922 	ipr->ipr_hash = NULL;
3923 
3924 	for (af = 0; af < IPSEC_NAF; af++) {
3925 		ipr->ipr_nonhash[af] = NULL;
3926 	}
3927 }
3928 
3929 ipsec_policy_head_t *
3930 ipsec_polhead_create(void)
3931 {
3932 	ipsec_policy_head_t *php;
3933 
3934 	php = kmem_alloc(sizeof (*php), KM_NOSLEEP);
3935 	if (php == NULL)
3936 		return (php);
3937 
3938 	rw_init(&php->iph_lock, NULL, RW_DEFAULT, NULL);
3939 	php->iph_refs = 1;
3940 	php->iph_gen = 0;
3941 
3942 	ipsec_ipr_init(&php->iph_root[IPSEC_TYPE_INBOUND]);
3943 	ipsec_ipr_init(&php->iph_root[IPSEC_TYPE_OUTBOUND]);
3944 
3945 	avl_create(&php->iph_rulebyid, ipsec_policy_cmpbyid,
3946 	    sizeof (ipsec_policy_t), offsetof(ipsec_policy_t, ipsp_byid));
3947 
3948 	return (php);
3949 }
3950 
3951 /*
3952  * Clone the policy head into a new polhead; release one reference to the
3953  * old one and return the only reference to the new one.
3954  * If the old one had a refcount of 1, just return it.
3955  */
3956 ipsec_policy_head_t *
3957 ipsec_polhead_split(ipsec_policy_head_t *php, netstack_t *ns)
3958 {
3959 	ipsec_policy_head_t *nphp;
3960 
3961 	if (php == NULL)
3962 		return (ipsec_polhead_create());
3963 	else if (php->iph_refs == 1)
3964 		return (php);
3965 
3966 	nphp = ipsec_polhead_create();
3967 	if (nphp == NULL)
3968 		return (NULL);
3969 
3970 	if (ipsec_copy_polhead(php, nphp, ns) != 0) {
3971 		ipsec_polhead_free(nphp, ns);
3972 		return (NULL);
3973 	}
3974 	IPPH_REFRELE(php, ns);
3975 	return (nphp);
3976 }
3977 
3978 /*
3979  * When sending a response to a ICMP request or generating a RST
3980  * in the TCP case, the outbound packets need to go at the same level
3981  * of protection as the incoming ones i.e we associate our outbound
3982  * policy with how the packet came in. We call this after we have
3983  * accepted the incoming packet which may or may not have been in
3984  * clear and hence we are sending the reply back with the policy
3985  * matching the incoming datagram's policy.
3986  *
3987  * NOTE : This technology serves two purposes :
3988  *
3989  * 1) If we have multiple outbound policies, we send out a reply
3990  *    matching with how it came in rather than matching the outbound
3991  *    policy.
3992  *
3993  * 2) For assymetric policies, we want to make sure that incoming
3994  *    and outgoing has the same level of protection. Assymetric
3995  *    policies exist only with global policy where we may not have
3996  *    both outbound and inbound at the same time.
3997  *
3998  * NOTE2:	This function is called by cleartext cases, so it needs to be
3999  *		in IP proper.
4000  */
4001 boolean_t
4002 ipsec_in_to_out(mblk_t *ipsec_mp, ipha_t *ipha, ip6_t *ip6h)
4003 {
4004 	ipsec_in_t  *ii;
4005 	ipsec_out_t  *io;
4006 	boolean_t v4;
4007 	mblk_t *mp;
4008 	boolean_t secure;
4009 	uint_t ifindex;
4010 	ipsec_selector_t sel;
4011 	ipsec_action_t *reflect_action = NULL;
4012 	zoneid_t zoneid;
4013 	netstack_t	*ns;
4014 
4015 	ASSERT(ipsec_mp->b_datap->db_type == M_CTL);
4016 
4017 	bzero((void*)&sel, sizeof (sel));
4018 
4019 	ii = (ipsec_in_t *)ipsec_mp->b_rptr;
4020 
4021 	mp = ipsec_mp->b_cont;
4022 	ASSERT(mp != NULL);
4023 
4024 	if (ii->ipsec_in_action != NULL) {
4025 		/* transfer reference.. */
4026 		reflect_action = ii->ipsec_in_action;
4027 		ii->ipsec_in_action = NULL;
4028 	} else if (!ii->ipsec_in_loopback)
4029 		reflect_action = ipsec_in_to_out_action(ii);
4030 	secure = ii->ipsec_in_secure;
4031 	ifindex = ii->ipsec_in_ill_index;
4032 	zoneid = ii->ipsec_in_zoneid;
4033 	ASSERT(zoneid != ALL_ZONES);
4034 	ns = ii->ipsec_in_ns;
4035 	v4 = ii->ipsec_in_v4;
4036 
4037 	ipsec_in_release_refs(ii);	/* No netstack_rele/hold needed */
4038 
4039 	/*
4040 	 * The caller is going to send the datagram out which might
4041 	 * go on the wire or delivered locally through ip_wput_local.
4042 	 *
4043 	 * 1) If it goes out on the wire, new associations will be
4044 	 *    obtained.
4045 	 * 2) If it is delivered locally, ip_wput_local will convert
4046 	 *    this IPSEC_OUT to a IPSEC_IN looking at the requests.
4047 	 */
4048 
4049 	io = (ipsec_out_t *)ipsec_mp->b_rptr;
4050 	bzero(io, sizeof (ipsec_out_t));
4051 	io->ipsec_out_type = IPSEC_OUT;
4052 	io->ipsec_out_len = sizeof (ipsec_out_t);
4053 	io->ipsec_out_frtn.free_func = ipsec_out_free;
4054 	io->ipsec_out_frtn.free_arg = (char *)io;
4055 	io->ipsec_out_act = reflect_action;
4056 
4057 	if (!ipsec_init_outbound_ports(&sel, mp, ipha, ip6h, 0,
4058 	    ns->netstack_ipsec))
4059 		return (B_FALSE);
4060 
4061 	io->ipsec_out_src_port = sel.ips_local_port;
4062 	io->ipsec_out_dst_port = sel.ips_remote_port;
4063 	io->ipsec_out_proto = sel.ips_protocol;
4064 	io->ipsec_out_icmp_type = sel.ips_icmp_type;
4065 	io->ipsec_out_icmp_code = sel.ips_icmp_code;
4066 
4067 	/*
4068 	 * Don't use global policy for this, as we want
4069 	 * to use the same protection that was applied to the inbound packet.
4070 	 */
4071 	io->ipsec_out_use_global_policy = B_FALSE;
4072 	io->ipsec_out_proc_begin = B_FALSE;
4073 	io->ipsec_out_secure = secure;
4074 	io->ipsec_out_v4 = v4;
4075 	io->ipsec_out_ill_index = ifindex;
4076 	io->ipsec_out_zoneid = zoneid;
4077 	io->ipsec_out_ns = ns;		/* No netstack_hold */
4078 
4079 	return (B_TRUE);
4080 }
4081 
4082 mblk_t *
4083 ipsec_in_tag(mblk_t *mp, mblk_t *cont, netstack_t *ns)
4084 {
4085 	ipsec_in_t *ii = (ipsec_in_t *)mp->b_rptr;
4086 	ipsec_in_t *nii;
4087 	mblk_t *nmp;
4088 	frtn_t nfrtn;
4089 	ipsec_stack_t *ipss = ns->netstack_ipsec;
4090 
4091 	ASSERT(ii->ipsec_in_type == IPSEC_IN);
4092 	ASSERT(ii->ipsec_in_len == sizeof (ipsec_in_t));
4093 
4094 	nmp = ipsec_in_alloc(ii->ipsec_in_v4, ns);
4095 	if (nmp == NULL) {
4096 		ip_drop_packet_chain(cont, B_FALSE, NULL, NULL,
4097 		    DROPPER(ipss, ipds_spd_nomem),
4098 		    &ipss->ipsec_spd_dropper);
4099 		return (NULL);
4100 	}
4101 
4102 	ASSERT(nmp->b_datap->db_type == M_CTL);
4103 	ASSERT(nmp->b_wptr == (nmp->b_rptr + sizeof (ipsec_info_t)));
4104 
4105 	/*
4106 	 * Bump refcounts.
4107 	 */
4108 	if (ii->ipsec_in_ah_sa != NULL)
4109 		IPSA_REFHOLD(ii->ipsec_in_ah_sa);
4110 	if (ii->ipsec_in_esp_sa != NULL)
4111 		IPSA_REFHOLD(ii->ipsec_in_esp_sa);
4112 	if (ii->ipsec_in_policy != NULL)
4113 		IPPH_REFHOLD(ii->ipsec_in_policy);
4114 
4115 	/*
4116 	 * Copy everything, but preserve the free routine provided by
4117 	 * ipsec_in_alloc().
4118 	 */
4119 	nii = (ipsec_in_t *)nmp->b_rptr;
4120 	nfrtn = nii->ipsec_in_frtn;
4121 	bcopy(ii, nii, sizeof (*ii));
4122 	nii->ipsec_in_frtn = nfrtn;
4123 
4124 	nmp->b_cont = cont;
4125 
4126 	return (nmp);
4127 }
4128 
4129 mblk_t *
4130 ipsec_out_tag(mblk_t *mp, mblk_t *cont, netstack_t *ns)
4131 {
4132 	ipsec_out_t *io = (ipsec_out_t *)mp->b_rptr;
4133 	ipsec_out_t *nio;
4134 	mblk_t *nmp;
4135 	frtn_t nfrtn;
4136 	ipsec_stack_t *ipss = ns->netstack_ipsec;
4137 
4138 	ASSERT(io->ipsec_out_type == IPSEC_OUT);
4139 	ASSERT(io->ipsec_out_len == sizeof (ipsec_out_t));
4140 
4141 	nmp = ipsec_alloc_ipsec_out(ns);
4142 	if (nmp == NULL) {
4143 		ip_drop_packet_chain(cont, B_FALSE, NULL, NULL,
4144 		    DROPPER(ipss, ipds_spd_nomem),
4145 		    &ipss->ipsec_spd_dropper);
4146 		return (NULL);
4147 	}
4148 	ASSERT(nmp->b_datap->db_type == M_CTL);
4149 	ASSERT(nmp->b_wptr == (nmp->b_rptr + sizeof (ipsec_info_t)));
4150 
4151 	/*
4152 	 * Bump refcounts.
4153 	 */
4154 	if (io->ipsec_out_ah_sa != NULL)
4155 		IPSA_REFHOLD(io->ipsec_out_ah_sa);
4156 	if (io->ipsec_out_esp_sa != NULL)
4157 		IPSA_REFHOLD(io->ipsec_out_esp_sa);
4158 	if (io->ipsec_out_polhead != NULL)
4159 		IPPH_REFHOLD(io->ipsec_out_polhead);
4160 	if (io->ipsec_out_policy != NULL)
4161 		IPPOL_REFHOLD(io->ipsec_out_policy);
4162 	if (io->ipsec_out_act != NULL)
4163 		IPACT_REFHOLD(io->ipsec_out_act);
4164 	if (io->ipsec_out_latch != NULL)
4165 		IPLATCH_REFHOLD(io->ipsec_out_latch);
4166 	if (io->ipsec_out_cred != NULL)
4167 		crhold(io->ipsec_out_cred);
4168 
4169 	/*
4170 	 * Copy everything, but preserve the free routine provided by
4171 	 * ipsec_alloc_ipsec_out().
4172 	 */
4173 	nio = (ipsec_out_t *)nmp->b_rptr;
4174 	nfrtn = nio->ipsec_out_frtn;
4175 	bcopy(io, nio, sizeof (*io));
4176 	nio->ipsec_out_frtn = nfrtn;
4177 
4178 	nmp->b_cont = cont;
4179 
4180 	return (nmp);
4181 }
4182 
4183 static void
4184 ipsec_out_release_refs(ipsec_out_t *io)
4185 {
4186 	netstack_t	*ns = io->ipsec_out_ns;
4187 
4188 	ASSERT(io->ipsec_out_type == IPSEC_OUT);
4189 	ASSERT(io->ipsec_out_len == sizeof (ipsec_out_t));
4190 	ASSERT(io->ipsec_out_ns != NULL);
4191 
4192 	/* Note: IPSA_REFRELE is multi-line macro */
4193 	if (io->ipsec_out_ah_sa != NULL)
4194 		IPSA_REFRELE(io->ipsec_out_ah_sa);
4195 	if (io->ipsec_out_esp_sa != NULL)
4196 		IPSA_REFRELE(io->ipsec_out_esp_sa);
4197 	if (io->ipsec_out_polhead != NULL)
4198 		IPPH_REFRELE(io->ipsec_out_polhead, ns);
4199 	if (io->ipsec_out_policy != NULL)
4200 		IPPOL_REFRELE(io->ipsec_out_policy, ns);
4201 	if (io->ipsec_out_act != NULL)
4202 		IPACT_REFRELE(io->ipsec_out_act);
4203 	if (io->ipsec_out_cred != NULL) {
4204 		crfree(io->ipsec_out_cred);
4205 		io->ipsec_out_cred = NULL;
4206 	}
4207 	if (io->ipsec_out_latch) {
4208 		IPLATCH_REFRELE(io->ipsec_out_latch, ns);
4209 		io->ipsec_out_latch = NULL;
4210 	}
4211 }
4212 
4213 static void
4214 ipsec_out_free(void *arg)
4215 {
4216 	ipsec_out_t *io = (ipsec_out_t *)arg;
4217 	ipsec_out_release_refs(io);
4218 	kmem_cache_free(ipsec_info_cache, arg);
4219 }
4220 
4221 static void
4222 ipsec_in_release_refs(ipsec_in_t *ii)
4223 {
4224 	netstack_t	*ns = ii->ipsec_in_ns;
4225 
4226 	ASSERT(ii->ipsec_in_ns != NULL);
4227 
4228 	/* Note: IPSA_REFRELE is multi-line macro */
4229 	if (ii->ipsec_in_ah_sa != NULL)
4230 		IPSA_REFRELE(ii->ipsec_in_ah_sa);
4231 	if (ii->ipsec_in_esp_sa != NULL)
4232 		IPSA_REFRELE(ii->ipsec_in_esp_sa);
4233 	if (ii->ipsec_in_policy != NULL)
4234 		IPPH_REFRELE(ii->ipsec_in_policy, ns);
4235 	if (ii->ipsec_in_da != NULL) {
4236 		freeb(ii->ipsec_in_da);
4237 		ii->ipsec_in_da = NULL;
4238 	}
4239 }
4240 
4241 static void
4242 ipsec_in_free(void *arg)
4243 {
4244 	ipsec_in_t *ii = (ipsec_in_t *)arg;
4245 	ipsec_in_release_refs(ii);
4246 	kmem_cache_free(ipsec_info_cache, arg);
4247 }
4248 
4249 /*
4250  * This is called only for outbound datagrams if the datagram needs to
4251  * go out secure.  A NULL mp can be passed to get an ipsec_out. This
4252  * facility is used by ip_unbind.
4253  *
4254  * NOTE : o As the data part could be modified by ipsec_out_process etc.
4255  *	    we can't make it fast by calling a dup.
4256  */
4257 mblk_t *
4258 ipsec_alloc_ipsec_out(netstack_t *ns)
4259 {
4260 	mblk_t *ipsec_mp;
4261 	ipsec_out_t *io = kmem_cache_alloc(ipsec_info_cache, KM_NOSLEEP);
4262 
4263 	if (io == NULL)
4264 		return (NULL);
4265 
4266 	bzero(io, sizeof (ipsec_out_t));
4267 
4268 	io->ipsec_out_type = IPSEC_OUT;
4269 	io->ipsec_out_len = sizeof (ipsec_out_t);
4270 	io->ipsec_out_frtn.free_func = ipsec_out_free;
4271 	io->ipsec_out_frtn.free_arg = (char *)io;
4272 
4273 	/*
4274 	 * Set the zoneid to ALL_ZONES which is used as an invalid value. Code
4275 	 * using ipsec_out_zoneid should assert that the zoneid has been set to
4276 	 * a sane value.
4277 	 */
4278 	io->ipsec_out_zoneid = ALL_ZONES;
4279 	io->ipsec_out_ns = ns;		/* No netstack_hold */
4280 
4281 	ipsec_mp = desballoc((uint8_t *)io, sizeof (ipsec_info_t), BPRI_HI,
4282 	    &io->ipsec_out_frtn);
4283 	if (ipsec_mp == NULL) {
4284 		ipsec_out_free(io);
4285 
4286 		return (NULL);
4287 	}
4288 	ipsec_mp->b_datap->db_type = M_CTL;
4289 	ipsec_mp->b_wptr = ipsec_mp->b_rptr + sizeof (ipsec_info_t);
4290 
4291 	return (ipsec_mp);
4292 }
4293 
4294 /*
4295  * Attach an IPSEC_OUT; use pol for policy if it is non-null.
4296  * Otherwise initialize using conn.
4297  *
4298  * If pol is non-null, we consume a reference to it.
4299  */
4300 mblk_t *
4301 ipsec_attach_ipsec_out(mblk_t **mp, conn_t *connp, ipsec_policy_t *pol,
4302     uint8_t proto, netstack_t *ns)
4303 {
4304 	mblk_t *ipsec_mp;
4305 	ipsec_stack_t	*ipss = ns->netstack_ipsec;
4306 
4307 	ASSERT((pol != NULL) || (connp != NULL));
4308 
4309 	ipsec_mp = ipsec_alloc_ipsec_out(ns);
4310 	if (ipsec_mp == NULL) {
4311 		ipsec_rl_strlog(ns, IP_MOD_ID, 0, 0, SL_ERROR|SL_NOTE,
4312 		    "ipsec_attach_ipsec_out: Allocation failure\n");
4313 		ip_drop_packet(*mp, B_FALSE, NULL, NULL,
4314 		    DROPPER(ipss, ipds_spd_nomem),
4315 		    &ipss->ipsec_spd_dropper);
4316 		*mp = NULL;
4317 		return (NULL);
4318 	}
4319 	ipsec_mp->b_cont = *mp;
4320 	/*
4321 	 * If *mp is NULL, ipsec_init_ipsec_out() won't/should not be using it.
4322 	 */
4323 	return (ipsec_init_ipsec_out(ipsec_mp, mp, connp, pol, proto, ns));
4324 }
4325 
4326 /*
4327  * Initialize the IPSEC_OUT (ipsec_mp) using pol if it is non-null.
4328  * Otherwise initialize using conn.
4329  *
4330  * If pol is non-null, we consume a reference to it.
4331  */
4332 mblk_t *
4333 ipsec_init_ipsec_out(mblk_t *ipsec_mp, mblk_t **mp, conn_t *connp,
4334     ipsec_policy_t *pol, uint8_t proto, netstack_t *ns)
4335 {
4336 	ipsec_out_t *io;
4337 	ipsec_policy_t *p;
4338 	ipha_t *ipha;
4339 	ip6_t *ip6h;
4340 	ipsec_stack_t *ipss = ns->netstack_ipsec;
4341 
4342 	ASSERT(ipsec_mp->b_cont == *mp);
4343 
4344 	ASSERT((pol != NULL) || (connp != NULL));
4345 
4346 	ASSERT(ipsec_mp->b_datap->db_type == M_CTL);
4347 	ASSERT(ipsec_mp->b_wptr == (ipsec_mp->b_rptr + sizeof (ipsec_info_t)));
4348 	io = (ipsec_out_t *)ipsec_mp->b_rptr;
4349 	ASSERT(io->ipsec_out_type == IPSEC_OUT);
4350 	ASSERT(io->ipsec_out_len == sizeof (ipsec_out_t));
4351 	io->ipsec_out_latch = NULL;
4352 	/*
4353 	 * Set the zoneid when we have the connp.
4354 	 * Otherwise, we're called from ip_wput_attach_policy() who will take
4355 	 * care of setting the zoneid.
4356 	 */
4357 	if (connp != NULL)
4358 		io->ipsec_out_zoneid = connp->conn_zoneid;
4359 
4360 	io->ipsec_out_ns = ns;		/* No netstack_hold */
4361 
4362 	if (*mp != NULL) {
4363 		ipha = (ipha_t *)(*mp)->b_rptr;
4364 		if (IPH_HDR_VERSION(ipha) == IP_VERSION) {
4365 			io->ipsec_out_v4 = B_TRUE;
4366 			ip6h = NULL;
4367 		} else {
4368 			io->ipsec_out_v4 = B_FALSE;
4369 			ip6h = (ip6_t *)ipha;
4370 			ipha = NULL;
4371 		}
4372 	} else {
4373 		ASSERT(connp != NULL && connp->conn_policy_cached);
4374 		ip6h = NULL;
4375 		ipha = NULL;
4376 		io->ipsec_out_v4 = !connp->conn_pkt_isv6;
4377 	}
4378 
4379 	p = NULL;
4380 
4381 	/*
4382 	 * Take latched policies over global policy.  Check here again for
4383 	 * this, in case we had conn_latch set while the packet was flying
4384 	 * around in IP.
4385 	 */
4386 	if (connp != NULL && connp->conn_latch != NULL) {
4387 		ASSERT(ns == connp->conn_netstack);
4388 		p = connp->conn_latch->ipl_out_policy;
4389 		io->ipsec_out_latch = connp->conn_latch;
4390 		IPLATCH_REFHOLD(connp->conn_latch);
4391 		if (p != NULL) {
4392 			IPPOL_REFHOLD(p);
4393 		}
4394 		io->ipsec_out_src_port = connp->conn_lport;
4395 		io->ipsec_out_dst_port = connp->conn_fport;
4396 		io->ipsec_out_icmp_type = io->ipsec_out_icmp_code = 0;
4397 		if (pol != NULL)
4398 			IPPOL_REFRELE(pol, ns);
4399 	} else if (pol != NULL) {
4400 		ipsec_selector_t sel;
4401 
4402 		bzero((void*)&sel, sizeof (sel));
4403 
4404 		p = pol;
4405 		/*
4406 		 * conn does not have the port information. Get
4407 		 * it from the packet.
4408 		 */
4409 
4410 		if (!ipsec_init_outbound_ports(&sel, *mp, ipha, ip6h, 0,
4411 		    ns->netstack_ipsec)) {
4412 			/* Callee did ip_drop_packet() on *mp. */
4413 			*mp = NULL;
4414 			freeb(ipsec_mp);
4415 			return (NULL);
4416 		}
4417 		io->ipsec_out_src_port = sel.ips_local_port;
4418 		io->ipsec_out_dst_port = sel.ips_remote_port;
4419 		io->ipsec_out_icmp_type = sel.ips_icmp_type;
4420 		io->ipsec_out_icmp_code = sel.ips_icmp_code;
4421 	}
4422 
4423 	io->ipsec_out_proto = proto;
4424 	io->ipsec_out_use_global_policy = B_TRUE;
4425 	io->ipsec_out_secure = (p != NULL);
4426 	io->ipsec_out_policy = p;
4427 
4428 	if (p == NULL) {
4429 		if (connp->conn_policy != NULL) {
4430 			io->ipsec_out_secure = B_TRUE;
4431 			ASSERT(io->ipsec_out_latch == NULL);
4432 			ASSERT(io->ipsec_out_use_global_policy == B_TRUE);
4433 			io->ipsec_out_need_policy = B_TRUE;
4434 			ASSERT(io->ipsec_out_polhead == NULL);
4435 			IPPH_REFHOLD(connp->conn_policy);
4436 			io->ipsec_out_polhead = connp->conn_policy;
4437 		}
4438 	} else {
4439 		/* Handle explicit drop action. */
4440 		if (p->ipsp_act->ipa_act.ipa_type == IPSEC_ACT_DISCARD ||
4441 		    p->ipsp_act->ipa_act.ipa_type == IPSEC_ACT_REJECT) {
4442 			ip_drop_packet(ipsec_mp, B_FALSE, NULL, NULL,
4443 			    DROPPER(ipss, ipds_spd_explicit),
4444 			    &ipss->ipsec_spd_dropper);
4445 			*mp = NULL;
4446 			ipsec_mp = NULL;
4447 		}
4448 	}
4449 
4450 	return (ipsec_mp);
4451 }
4452 
4453 /*
4454  * Allocate an IPSEC_IN mblk.  This will be prepended to an inbound datagram
4455  * and keep track of what-if-any IPsec processing will be applied to the
4456  * datagram.
4457  */
4458 mblk_t *
4459 ipsec_in_alloc(boolean_t isv4, netstack_t *ns)
4460 {
4461 	mblk_t *ipsec_in;
4462 	ipsec_in_t *ii = kmem_cache_alloc(ipsec_info_cache, KM_NOSLEEP);
4463 
4464 	if (ii == NULL)
4465 		return (NULL);
4466 
4467 	bzero(ii, sizeof (ipsec_info_t));
4468 	ii->ipsec_in_type = IPSEC_IN;
4469 	ii->ipsec_in_len = sizeof (ipsec_in_t);
4470 
4471 	ii->ipsec_in_v4 = isv4;
4472 	ii->ipsec_in_secure = B_TRUE;
4473 	ii->ipsec_in_ns = ns;		/* No netstack_hold */
4474 	ii->ipsec_in_stackid = ns->netstack_stackid;
4475 
4476 	ii->ipsec_in_frtn.free_func = ipsec_in_free;
4477 	ii->ipsec_in_frtn.free_arg = (char *)ii;
4478 
4479 	ipsec_in = desballoc((uint8_t *)ii, sizeof (ipsec_info_t), BPRI_HI,
4480 	    &ii->ipsec_in_frtn);
4481 	if (ipsec_in == NULL) {
4482 		ip1dbg(("ipsec_in_alloc: IPSEC_IN allocation failure.\n"));
4483 		ipsec_in_free(ii);
4484 		return (NULL);
4485 	}
4486 
4487 	ipsec_in->b_datap->db_type = M_CTL;
4488 	ipsec_in->b_wptr += sizeof (ipsec_info_t);
4489 
4490 	return (ipsec_in);
4491 }
4492 
4493 /*
4494  * This is called from ip_wput_local when a packet which needs
4495  * security is looped back, to convert the IPSEC_OUT to a IPSEC_IN
4496  * before fanout, where the policy check happens.  In most of the
4497  * cases, IPSEC processing has *never* been done.  There is one case
4498  * (ip_wput_ire_fragmentit -> ip_wput_frag -> icmp_frag_needed) where
4499  * the packet is destined for localhost, IPSEC processing has already
4500  * been done.
4501  *
4502  * Future: This could happen after SA selection has occurred for
4503  * outbound.. which will tell us who the src and dst identities are..
4504  * Then it's just a matter of splicing the ah/esp SA pointers from the
4505  * ipsec_out_t to the ipsec_in_t.
4506  */
4507 void
4508 ipsec_out_to_in(mblk_t *ipsec_mp)
4509 {
4510 	ipsec_in_t  *ii;
4511 	ipsec_out_t *io;
4512 	ipsec_policy_t *pol;
4513 	ipsec_action_t *act;
4514 	boolean_t v4, icmp_loopback;
4515 	zoneid_t zoneid;
4516 	netstack_t *ns;
4517 
4518 	ASSERT(ipsec_mp->b_datap->db_type == M_CTL);
4519 
4520 	io = (ipsec_out_t *)ipsec_mp->b_rptr;
4521 
4522 	v4 = io->ipsec_out_v4;
4523 	zoneid = io->ipsec_out_zoneid;
4524 	icmp_loopback = io->ipsec_out_icmp_loopback;
4525 	ns = io->ipsec_out_ns;
4526 
4527 	act = io->ipsec_out_act;
4528 	if (act == NULL) {
4529 		pol = io->ipsec_out_policy;
4530 		if (pol != NULL) {
4531 			act = pol->ipsp_act;
4532 			IPACT_REFHOLD(act);
4533 		}
4534 	}
4535 	io->ipsec_out_act = NULL;
4536 
4537 	ipsec_out_release_refs(io);	/* No netstack_rele/hold needed */
4538 
4539 	ii = (ipsec_in_t *)ipsec_mp->b_rptr;
4540 	bzero(ii, sizeof (ipsec_in_t));
4541 	ii->ipsec_in_type = IPSEC_IN;
4542 	ii->ipsec_in_len = sizeof (ipsec_in_t);
4543 	ii->ipsec_in_loopback = B_TRUE;
4544 	ii->ipsec_in_ns = ns;		/* No netstack_hold */
4545 
4546 	ii->ipsec_in_frtn.free_func = ipsec_in_free;
4547 	ii->ipsec_in_frtn.free_arg = (char *)ii;
4548 	ii->ipsec_in_action = act;
4549 	ii->ipsec_in_zoneid = zoneid;
4550 
4551 	/*
4552 	 * In most of the cases, we can't look at the ipsec_out_XXX_sa
4553 	 * because this never went through IPSEC processing. So, look at
4554 	 * the requests and infer whether it would have gone through
4555 	 * IPSEC processing or not. Initialize the "done" fields with
4556 	 * the requests. The possible values for "done" fields are :
4557 	 *
4558 	 * 1) zero, indicates that a particular preference was never
4559 	 *    requested.
4560 	 * 2) non-zero, indicates that it could be IPSEC_PREF_REQUIRED/
4561 	 *    IPSEC_PREF_NEVER. If IPSEC_REQ_DONE is set, it means that
4562 	 *    IPSEC processing has been completed.
4563 	 */
4564 	ii->ipsec_in_secure = B_TRUE;
4565 	ii->ipsec_in_v4 = v4;
4566 	ii->ipsec_in_icmp_loopback = icmp_loopback;
4567 }
4568 
4569 /*
4570  * Consults global policy to see whether this datagram should
4571  * go out secure. If so it attaches a ipsec_mp in front and
4572  * returns.
4573  */
4574 mblk_t *
4575 ip_wput_attach_policy(mblk_t *ipsec_mp, ipha_t *ipha, ip6_t *ip6h, ire_t *ire,
4576     conn_t *connp, boolean_t unspec_src, zoneid_t zoneid)
4577 {
4578 	mblk_t *mp;
4579 	ipsec_out_t *io = NULL;
4580 	ipsec_selector_t sel;
4581 	uint_t	ill_index;
4582 	boolean_t conn_dontroutex;
4583 	boolean_t conn_multicast_loopx;
4584 	boolean_t policy_present;
4585 	ip_stack_t	*ipst = ire->ire_ipst;
4586 	netstack_t	*ns = ipst->ips_netstack;
4587 	ipsec_stack_t	*ipss = ns->netstack_ipsec;
4588 
4589 	ASSERT((ipha != NULL && ip6h == NULL) ||
4590 	    (ip6h != NULL && ipha == NULL));
4591 
4592 	bzero((void*)&sel, sizeof (sel));
4593 
4594 	if (ipha != NULL)
4595 		policy_present = ipss->ipsec_outbound_v4_policy_present;
4596 	else
4597 		policy_present = ipss->ipsec_outbound_v6_policy_present;
4598 	/*
4599 	 * Fast Path to see if there is any policy.
4600 	 */
4601 	if (!policy_present) {
4602 		if (ipsec_mp->b_datap->db_type == M_CTL) {
4603 			io = (ipsec_out_t *)ipsec_mp->b_rptr;
4604 			if (!io->ipsec_out_secure) {
4605 				/*
4606 				 * If there is no global policy and ip_wput
4607 				 * or ip_wput_multicast has attached this mp
4608 				 * for multicast case, free the ipsec_mp and
4609 				 * return the original mp.
4610 				 */
4611 				mp = ipsec_mp->b_cont;
4612 				freeb(ipsec_mp);
4613 				ipsec_mp = mp;
4614 				io = NULL;
4615 			}
4616 			ASSERT(io == NULL || !io->ipsec_out_tunnel);
4617 		}
4618 		if (((io == NULL) || (io->ipsec_out_polhead == NULL)) &&
4619 		    ((connp == NULL) || (connp->conn_policy == NULL)))
4620 			return (ipsec_mp);
4621 	}
4622 
4623 	ill_index = 0;
4624 	conn_multicast_loopx = conn_dontroutex = B_FALSE;
4625 	mp = ipsec_mp;
4626 	if (ipsec_mp->b_datap->db_type == M_CTL) {
4627 		mp = ipsec_mp->b_cont;
4628 		/*
4629 		 * This is a connection where we have some per-socket
4630 		 * policy or ip_wput has attached an ipsec_mp for
4631 		 * the multicast datagram.
4632 		 */
4633 		io = (ipsec_out_t *)ipsec_mp->b_rptr;
4634 		if (!io->ipsec_out_secure) {
4635 			/*
4636 			 * This ipsec_mp was allocated in ip_wput or
4637 			 * ip_wput_multicast so that we will know the
4638 			 * value of ill_index, conn_dontroute,
4639 			 * conn_multicast_loop in the multicast case if
4640 			 * we inherit global policy here.
4641 			 */
4642 			ill_index = io->ipsec_out_ill_index;
4643 			conn_dontroutex = io->ipsec_out_dontroute;
4644 			conn_multicast_loopx = io->ipsec_out_multicast_loop;
4645 			freeb(ipsec_mp);
4646 			ipsec_mp = mp;
4647 			io = NULL;
4648 		}
4649 		ASSERT(io == NULL || !io->ipsec_out_tunnel);
4650 	}
4651 
4652 	if (ipha != NULL) {
4653 		sel.ips_local_addr_v4 = (ipha->ipha_src != 0 ?
4654 		    ipha->ipha_src : ire->ire_src_addr);
4655 		sel.ips_remote_addr_v4 = ip_get_dst(ipha);
4656 		sel.ips_protocol = (uint8_t)ipha->ipha_protocol;
4657 		sel.ips_isv4 = B_TRUE;
4658 	} else {
4659 		ushort_t hdr_len;
4660 		uint8_t	*nexthdrp;
4661 		boolean_t is_fragment;
4662 
4663 		sel.ips_isv4 = B_FALSE;
4664 		if (IN6_IS_ADDR_UNSPECIFIED(&ip6h->ip6_src)) {
4665 			if (!unspec_src)
4666 				sel.ips_local_addr_v6 = ire->ire_src_addr_v6;
4667 		} else {
4668 			sel.ips_local_addr_v6 = ip6h->ip6_src;
4669 		}
4670 
4671 		sel.ips_remote_addr_v6 = ip_get_dst_v6(ip6h, mp, &is_fragment);
4672 		if (is_fragment) {
4673 			/*
4674 			 * It's a packet fragment for a packet that
4675 			 * we have already processed (since IPsec processing
4676 			 * is done before fragmentation), so we don't
4677 			 * have to do policy checks again. Fragments can
4678 			 * come back to us for processing if they have
4679 			 * been queued up due to flow control.
4680 			 */
4681 			if (ipsec_mp->b_datap->db_type == M_CTL) {
4682 				mp = ipsec_mp->b_cont;
4683 				freeb(ipsec_mp);
4684 				ipsec_mp = mp;
4685 			}
4686 			return (ipsec_mp);
4687 		}
4688 
4689 		/* IPv6 common-case. */
4690 		sel.ips_protocol = ip6h->ip6_nxt;
4691 		switch (ip6h->ip6_nxt) {
4692 		case IPPROTO_TCP:
4693 		case IPPROTO_UDP:
4694 		case IPPROTO_SCTP:
4695 		case IPPROTO_ICMPV6:
4696 			break;
4697 		default:
4698 			if (!ip_hdr_length_nexthdr_v6(mp, ip6h,
4699 			    &hdr_len, &nexthdrp)) {
4700 				BUMP_MIB(&ipst->ips_ip6_mib,
4701 				    ipIfStatsOutDiscards);
4702 				freemsg(ipsec_mp); /* Not IPsec-related drop. */
4703 				return (NULL);
4704 			}
4705 			sel.ips_protocol = *nexthdrp;
4706 			break;
4707 		}
4708 	}
4709 
4710 	if (!ipsec_init_outbound_ports(&sel, mp, ipha, ip6h, 0, ipss)) {
4711 		if (ipha != NULL) {
4712 			BUMP_MIB(&ipst->ips_ip_mib, ipIfStatsOutDiscards);
4713 		} else {
4714 			BUMP_MIB(&ipst->ips_ip6_mib, ipIfStatsOutDiscards);
4715 		}
4716 
4717 		/* Callee dropped the packet. */
4718 		return (NULL);
4719 	}
4720 
4721 	if (io != NULL) {
4722 		/*
4723 		 * We seem to have some local policy (we already have
4724 		 * an ipsec_out).  Look at global policy and see
4725 		 * whether we have to inherit or not.
4726 		 */
4727 		io->ipsec_out_need_policy = B_FALSE;
4728 		ipsec_mp = ipsec_apply_global_policy(ipsec_mp, connp,
4729 		    &sel, ns);
4730 		ASSERT((io->ipsec_out_policy != NULL) ||
4731 		    (io->ipsec_out_act != NULL));
4732 		ASSERT(io->ipsec_out_need_policy == B_FALSE);
4733 		return (ipsec_mp);
4734 	}
4735 	/*
4736 	 * We pass in a pointer to a pointer because mp can become
4737 	 * NULL due to allocation failures or explicit drops.  Callers
4738 	 * of this function should assume a NULL mp means the packet
4739 	 * was dropped.
4740 	 */
4741 	ipsec_mp = ipsec_attach_global_policy(&mp, connp, &sel, ns);
4742 	if (ipsec_mp == NULL)
4743 		return (mp);
4744 
4745 	/*
4746 	 * Copy the right port information.
4747 	 */
4748 	ASSERT(ipsec_mp->b_datap->db_type == M_CTL);
4749 	io = (ipsec_out_t *)ipsec_mp->b_rptr;
4750 
4751 	ASSERT(io->ipsec_out_need_policy == B_FALSE);
4752 	ASSERT((io->ipsec_out_policy != NULL) ||
4753 	    (io->ipsec_out_act != NULL));
4754 	io->ipsec_out_src_port = sel.ips_local_port;
4755 	io->ipsec_out_dst_port = sel.ips_remote_port;
4756 	io->ipsec_out_icmp_type = sel.ips_icmp_type;
4757 	io->ipsec_out_icmp_code = sel.ips_icmp_code;
4758 	/*
4759 	 * Set ill_index, conn_dontroute and conn_multicast_loop
4760 	 * for multicast datagrams.
4761 	 */
4762 	io->ipsec_out_ill_index = ill_index;
4763 	io->ipsec_out_dontroute = conn_dontroutex;
4764 	io->ipsec_out_multicast_loop = conn_multicast_loopx;
4765 
4766 	if (zoneid == ALL_ZONES)
4767 		zoneid = GLOBAL_ZONEID;
4768 	io->ipsec_out_zoneid = zoneid;
4769 	return (ipsec_mp);
4770 }
4771 
4772 /*
4773  * When appropriate, this function caches inbound and outbound policy
4774  * for this connection.
4775  *
4776  * XXX need to work out more details about per-interface policy and
4777  * caching here!
4778  *
4779  * XXX may want to split inbound and outbound caching for ill..
4780  */
4781 int
4782 ipsec_conn_cache_policy(conn_t *connp, boolean_t isv4)
4783 {
4784 	boolean_t global_policy_present;
4785 	netstack_t	*ns = connp->conn_netstack;
4786 	ipsec_stack_t	*ipss = ns->netstack_ipsec;
4787 
4788 	/*
4789 	 * There is no policy latching for ICMP sockets because we can't
4790 	 * decide on which policy to use until we see the packet and get
4791 	 * type/code selectors.
4792 	 */
4793 	if (connp->conn_ulp == IPPROTO_ICMP ||
4794 	    connp->conn_ulp == IPPROTO_ICMPV6) {
4795 		connp->conn_in_enforce_policy =
4796 		    connp->conn_out_enforce_policy = B_TRUE;
4797 		if (connp->conn_latch != NULL) {
4798 			IPLATCH_REFRELE(connp->conn_latch, ns);
4799 			connp->conn_latch = NULL;
4800 		}
4801 		connp->conn_flags |= IPCL_CHECK_POLICY;
4802 		return (0);
4803 	}
4804 
4805 	global_policy_present = isv4 ?
4806 	    (ipss->ipsec_outbound_v4_policy_present ||
4807 	    ipss->ipsec_inbound_v4_policy_present) :
4808 	    (ipss->ipsec_outbound_v6_policy_present ||
4809 	    ipss->ipsec_inbound_v6_policy_present);
4810 
4811 	if ((connp->conn_policy != NULL) || global_policy_present) {
4812 		ipsec_selector_t sel;
4813 		ipsec_policy_t	*p;
4814 
4815 		if (connp->conn_latch == NULL &&
4816 		    (connp->conn_latch = iplatch_create()) == NULL) {
4817 			return (ENOMEM);
4818 		}
4819 
4820 		sel.ips_protocol = connp->conn_ulp;
4821 		sel.ips_local_port = connp->conn_lport;
4822 		sel.ips_remote_port = connp->conn_fport;
4823 		sel.ips_is_icmp_inv_acq = 0;
4824 		sel.ips_isv4 = isv4;
4825 		if (isv4) {
4826 			sel.ips_local_addr_v4 = connp->conn_src;
4827 			sel.ips_remote_addr_v4 = connp->conn_rem;
4828 		} else {
4829 			sel.ips_local_addr_v6 = connp->conn_srcv6;
4830 			sel.ips_remote_addr_v6 = connp->conn_remv6;
4831 		}
4832 
4833 		p = ipsec_find_policy(IPSEC_TYPE_INBOUND, connp, NULL, &sel,
4834 		    ns);
4835 		if (connp->conn_latch->ipl_in_policy != NULL)
4836 			IPPOL_REFRELE(connp->conn_latch->ipl_in_policy, ns);
4837 		connp->conn_latch->ipl_in_policy = p;
4838 		connp->conn_in_enforce_policy = (p != NULL);
4839 
4840 		p = ipsec_find_policy(IPSEC_TYPE_OUTBOUND, connp, NULL, &sel,
4841 		    ns);
4842 		if (connp->conn_latch->ipl_out_policy != NULL)
4843 			IPPOL_REFRELE(connp->conn_latch->ipl_out_policy, ns);
4844 		connp->conn_latch->ipl_out_policy = p;
4845 		connp->conn_out_enforce_policy = (p != NULL);
4846 
4847 		/* Clear the latched actions too, in case we're recaching. */
4848 		if (connp->conn_latch->ipl_out_action != NULL)
4849 			IPACT_REFRELE(connp->conn_latch->ipl_out_action);
4850 		if (connp->conn_latch->ipl_in_action != NULL)
4851 			IPACT_REFRELE(connp->conn_latch->ipl_in_action);
4852 	}
4853 
4854 	/*
4855 	 * We may or may not have policy for this endpoint.  We still set
4856 	 * conn_policy_cached so that inbound datagrams don't have to look
4857 	 * at global policy as policy is considered latched for these
4858 	 * endpoints.  We should not set conn_policy_cached until the conn
4859 	 * reflects the actual policy. If we *set* this before inheriting
4860 	 * the policy there is a window where the check
4861 	 * CONN_INBOUND_POLICY_PRESENT, will neither check with the policy
4862 	 * on the conn (because we have not yet copied the policy on to
4863 	 * conn and hence not set conn_in_enforce_policy) nor with the
4864 	 * global policy (because conn_policy_cached is already set).
4865 	 */
4866 	connp->conn_policy_cached = B_TRUE;
4867 	if (connp->conn_in_enforce_policy)
4868 		connp->conn_flags |= IPCL_CHECK_POLICY;
4869 	return (0);
4870 }
4871 
4872 void
4873 iplatch_free(ipsec_latch_t *ipl, netstack_t *ns)
4874 {
4875 	if (ipl->ipl_out_policy != NULL)
4876 		IPPOL_REFRELE(ipl->ipl_out_policy, ns);
4877 	if (ipl->ipl_in_policy != NULL)
4878 		IPPOL_REFRELE(ipl->ipl_in_policy, ns);
4879 	if (ipl->ipl_in_action != NULL)
4880 		IPACT_REFRELE(ipl->ipl_in_action);
4881 	if (ipl->ipl_out_action != NULL)
4882 		IPACT_REFRELE(ipl->ipl_out_action);
4883 	if (ipl->ipl_local_cid != NULL)
4884 		IPSID_REFRELE(ipl->ipl_local_cid);
4885 	if (ipl->ipl_remote_cid != NULL)
4886 		IPSID_REFRELE(ipl->ipl_remote_cid);
4887 	if (ipl->ipl_local_id != NULL)
4888 		crfree(ipl->ipl_local_id);
4889 	mutex_destroy(&ipl->ipl_lock);
4890 	kmem_free(ipl, sizeof (*ipl));
4891 }
4892 
4893 ipsec_latch_t *
4894 iplatch_create()
4895 {
4896 	ipsec_latch_t *ipl = kmem_alloc(sizeof (*ipl), KM_NOSLEEP);
4897 	if (ipl == NULL)
4898 		return (ipl);
4899 	bzero(ipl, sizeof (*ipl));
4900 	mutex_init(&ipl->ipl_lock, NULL, MUTEX_DEFAULT, NULL);
4901 	ipl->ipl_refcnt = 1;
4902 	return (ipl);
4903 }
4904 
4905 /*
4906  * Hash function for ID hash table.
4907  */
4908 static uint32_t
4909 ipsid_hash(int idtype, char *idstring)
4910 {
4911 	uint32_t hval = idtype;
4912 	unsigned char c;
4913 
4914 	while ((c = *idstring++) != 0) {
4915 		hval = (hval << 4) | (hval >> 28);
4916 		hval ^= c;
4917 	}
4918 	hval = hval ^ (hval >> 16);
4919 	return (hval & (IPSID_HASHSIZE-1));
4920 }
4921 
4922 /*
4923  * Look up identity string in hash table.  Return identity object
4924  * corresponding to the name -- either preexisting, or newly allocated.
4925  *
4926  * Return NULL if we need to allocate a new one and can't get memory.
4927  */
4928 ipsid_t *
4929 ipsid_lookup(int idtype, char *idstring, netstack_t *ns)
4930 {
4931 	ipsid_t *retval;
4932 	char *nstr;
4933 	int idlen = strlen(idstring) + 1;
4934 	ipsec_stack_t	*ipss = ns->netstack_ipsec;
4935 	ipsif_t *bucket;
4936 
4937 	bucket = &ipss->ipsec_ipsid_buckets[ipsid_hash(idtype, idstring)];
4938 
4939 	mutex_enter(&bucket->ipsif_lock);
4940 
4941 	for (retval = bucket->ipsif_head; retval != NULL;
4942 	    retval = retval->ipsid_next) {
4943 		if (idtype != retval->ipsid_type)
4944 			continue;
4945 		if (bcmp(idstring, retval->ipsid_cid, idlen) != 0)
4946 			continue;
4947 
4948 		IPSID_REFHOLD(retval);
4949 		mutex_exit(&bucket->ipsif_lock);
4950 		return (retval);
4951 	}
4952 
4953 	retval = kmem_alloc(sizeof (*retval), KM_NOSLEEP);
4954 	if (!retval) {
4955 		mutex_exit(&bucket->ipsif_lock);
4956 		return (NULL);
4957 	}
4958 
4959 	nstr = kmem_alloc(idlen, KM_NOSLEEP);
4960 	if (!nstr) {
4961 		mutex_exit(&bucket->ipsif_lock);
4962 		kmem_free(retval, sizeof (*retval));
4963 		return (NULL);
4964 	}
4965 
4966 	retval->ipsid_refcnt = 1;
4967 	retval->ipsid_next = bucket->ipsif_head;
4968 	if (retval->ipsid_next != NULL)
4969 		retval->ipsid_next->ipsid_ptpn = &retval->ipsid_next;
4970 	retval->ipsid_ptpn = &bucket->ipsif_head;
4971 	retval->ipsid_type = idtype;
4972 	retval->ipsid_cid = nstr;
4973 	bucket->ipsif_head = retval;
4974 	bcopy(idstring, nstr, idlen);
4975 	mutex_exit(&bucket->ipsif_lock);
4976 
4977 	return (retval);
4978 }
4979 
4980 /*
4981  * Garbage collect the identity hash table.
4982  */
4983 void
4984 ipsid_gc(netstack_t *ns)
4985 {
4986 	int i, len;
4987 	ipsid_t *id, *nid;
4988 	ipsif_t *bucket;
4989 	ipsec_stack_t	*ipss = ns->netstack_ipsec;
4990 
4991 	for (i = 0; i < IPSID_HASHSIZE; i++) {
4992 		bucket = &ipss->ipsec_ipsid_buckets[i];
4993 		mutex_enter(&bucket->ipsif_lock);
4994 		for (id = bucket->ipsif_head; id != NULL; id = nid) {
4995 			nid = id->ipsid_next;
4996 			if (id->ipsid_refcnt == 0) {
4997 				*id->ipsid_ptpn = nid;
4998 				if (nid != NULL)
4999 					nid->ipsid_ptpn = id->ipsid_ptpn;
5000 				len = strlen(id->ipsid_cid) + 1;
5001 				kmem_free(id->ipsid_cid, len);
5002 				kmem_free(id, sizeof (*id));
5003 			}
5004 		}
5005 		mutex_exit(&bucket->ipsif_lock);
5006 	}
5007 }
5008 
5009 /*
5010  * Return true if two identities are the same.
5011  */
5012 boolean_t
5013 ipsid_equal(ipsid_t *id1, ipsid_t *id2)
5014 {
5015 	if (id1 == id2)
5016 		return (B_TRUE);
5017 #ifdef DEBUG
5018 	if ((id1 == NULL) || (id2 == NULL))
5019 		return (B_FALSE);
5020 	/*
5021 	 * test that we're interning id's correctly..
5022 	 */
5023 	ASSERT((strcmp(id1->ipsid_cid, id2->ipsid_cid) != 0) ||
5024 	    (id1->ipsid_type != id2->ipsid_type));
5025 #endif
5026 	return (B_FALSE);
5027 }
5028 
5029 /*
5030  * Initialize identity table; called during module initialization.
5031  */
5032 static void
5033 ipsid_init(netstack_t *ns)
5034 {
5035 	ipsif_t *bucket;
5036 	int i;
5037 	ipsec_stack_t	*ipss = ns->netstack_ipsec;
5038 
5039 	for (i = 0; i < IPSID_HASHSIZE; i++) {
5040 		bucket = &ipss->ipsec_ipsid_buckets[i];
5041 		mutex_init(&bucket->ipsif_lock, NULL, MUTEX_DEFAULT, NULL);
5042 	}
5043 }
5044 
5045 /*
5046  * Free identity table (preparatory to module unload)
5047  */
5048 static void
5049 ipsid_fini(netstack_t *ns)
5050 {
5051 	ipsif_t *bucket;
5052 	int i;
5053 	ipsec_stack_t	*ipss = ns->netstack_ipsec;
5054 
5055 	for (i = 0; i < IPSID_HASHSIZE; i++) {
5056 		bucket = &ipss->ipsec_ipsid_buckets[i];
5057 		ASSERT(bucket->ipsif_head == NULL);
5058 		mutex_destroy(&bucket->ipsif_lock);
5059 	}
5060 }
5061 
5062 /*
5063  * Update the minimum and maximum supported key sizes for the
5064  * specified algorithm. Must be called while holding the algorithms lock.
5065  */
5066 void
5067 ipsec_alg_fix_min_max(ipsec_alginfo_t *alg, ipsec_algtype_t alg_type,
5068     netstack_t *ns)
5069 {
5070 	size_t crypto_min = (size_t)-1, crypto_max = 0;
5071 	size_t cur_crypto_min, cur_crypto_max;
5072 	boolean_t is_valid;
5073 	crypto_mechanism_info_t *mech_infos;
5074 	uint_t nmech_infos;
5075 	int crypto_rc, i;
5076 	crypto_mech_usage_t mask;
5077 	ipsec_stack_t	*ipss = ns->netstack_ipsec;
5078 
5079 	ASSERT(MUTEX_HELD(&ipss->ipsec_alg_lock));
5080 
5081 	/*
5082 	 * Compute the min, max, and default key sizes (in number of
5083 	 * increments to the default key size in bits) as defined
5084 	 * by the algorithm mappings. This range of key sizes is used
5085 	 * for policy related operations. The effective key sizes
5086 	 * supported by the framework could be more limited than
5087 	 * those defined for an algorithm.
5088 	 */
5089 	alg->alg_default_bits = alg->alg_key_sizes[0];
5090 	if (alg->alg_increment != 0) {
5091 		/* key sizes are defined by range & increment */
5092 		alg->alg_minbits = alg->alg_key_sizes[1];
5093 		alg->alg_maxbits = alg->alg_key_sizes[2];
5094 
5095 		alg->alg_default = SADB_ALG_DEFAULT_INCR(alg->alg_minbits,
5096 		    alg->alg_increment, alg->alg_default_bits);
5097 	} else if (alg->alg_nkey_sizes == 0) {
5098 		/* no specified key size for algorithm */
5099 		alg->alg_minbits = alg->alg_maxbits = 0;
5100 	} else {
5101 		/* key sizes are defined by enumeration */
5102 		alg->alg_minbits = (uint16_t)-1;
5103 		alg->alg_maxbits = 0;
5104 
5105 		for (i = 0; i < alg->alg_nkey_sizes; i++) {
5106 			if (alg->alg_key_sizes[i] < alg->alg_minbits)
5107 				alg->alg_minbits = alg->alg_key_sizes[i];
5108 			if (alg->alg_key_sizes[i] > alg->alg_maxbits)
5109 				alg->alg_maxbits = alg->alg_key_sizes[i];
5110 		}
5111 		alg->alg_default = 0;
5112 	}
5113 
5114 	if (!(alg->alg_flags & ALG_FLAG_VALID))
5115 		return;
5116 
5117 	/*
5118 	 * Mechanisms do not apply to the NULL encryption
5119 	 * algorithm, so simply return for this case.
5120 	 */
5121 	if (alg->alg_id == SADB_EALG_NULL)
5122 		return;
5123 
5124 	/*
5125 	 * Find the min and max key sizes supported by the cryptographic
5126 	 * framework providers.
5127 	 */
5128 
5129 	/* get the key sizes supported by the framework */
5130 	crypto_rc = crypto_get_all_mech_info(alg->alg_mech_type,
5131 	    &mech_infos, &nmech_infos, KM_SLEEP);
5132 	if (crypto_rc != CRYPTO_SUCCESS || nmech_infos == 0) {
5133 		alg->alg_flags &= ~ALG_FLAG_VALID;
5134 		return;
5135 	}
5136 
5137 	/* min and max key sizes supported by framework */
5138 	for (i = 0, is_valid = B_FALSE; i < nmech_infos; i++) {
5139 		int unit_bits;
5140 
5141 		/*
5142 		 * Ignore entries that do not support the operations
5143 		 * needed for the algorithm type.
5144 		 */
5145 		if (alg_type == IPSEC_ALG_AUTH) {
5146 			mask = CRYPTO_MECH_USAGE_MAC;
5147 		} else {
5148 			mask = CRYPTO_MECH_USAGE_ENCRYPT |
5149 			    CRYPTO_MECH_USAGE_DECRYPT;
5150 		}
5151 		if ((mech_infos[i].mi_usage & mask) != mask)
5152 			continue;
5153 
5154 		unit_bits = (mech_infos[i].mi_keysize_unit ==
5155 		    CRYPTO_KEYSIZE_UNIT_IN_BYTES)  ? 8 : 1;
5156 		/* adjust min/max supported by framework */
5157 		cur_crypto_min = mech_infos[i].mi_min_key_size * unit_bits;
5158 		cur_crypto_max = mech_infos[i].mi_max_key_size * unit_bits;
5159 
5160 		if (cur_crypto_min < crypto_min)
5161 			crypto_min = cur_crypto_min;
5162 
5163 		/*
5164 		 * CRYPTO_EFFECTIVELY_INFINITE is a special value of
5165 		 * the crypto framework which means "no upper limit".
5166 		 */
5167 		if (mech_infos[i].mi_max_key_size ==
5168 		    CRYPTO_EFFECTIVELY_INFINITE) {
5169 			crypto_max = (size_t)-1;
5170 		} else if (cur_crypto_max > crypto_max) {
5171 			crypto_max = cur_crypto_max;
5172 		}
5173 
5174 		is_valid = B_TRUE;
5175 	}
5176 
5177 	kmem_free(mech_infos, sizeof (crypto_mechanism_info_t) *
5178 	    nmech_infos);
5179 
5180 	if (!is_valid) {
5181 		/* no key sizes supported by framework */
5182 		alg->alg_flags &= ~ALG_FLAG_VALID;
5183 		return;
5184 	}
5185 
5186 	/*
5187 	 * Determine min and max key sizes from alg_key_sizes[].
5188 	 * defined for the algorithm entry. Adjust key sizes based on
5189 	 * those supported by the framework.
5190 	 */
5191 	alg->alg_ef_default_bits = alg->alg_key_sizes[0];
5192 	if (alg->alg_increment != 0) {
5193 		/* supported key sizes are defined by range  & increment */
5194 		crypto_min = ALGBITS_ROUND_UP(crypto_min, alg->alg_increment);
5195 		crypto_max = ALGBITS_ROUND_DOWN(crypto_max, alg->alg_increment);
5196 
5197 		alg->alg_ef_minbits = MAX(alg->alg_minbits,
5198 		    (uint16_t)crypto_min);
5199 		alg->alg_ef_maxbits = MIN(alg->alg_maxbits,
5200 		    (uint16_t)crypto_max);
5201 
5202 		/*
5203 		 * If the sizes supported by the framework are outside
5204 		 * the range of sizes defined by the algorithm mappings,
5205 		 * the algorithm cannot be used. Check for this
5206 		 * condition here.
5207 		 */
5208 		if (alg->alg_ef_minbits > alg->alg_ef_maxbits) {
5209 			alg->alg_flags &= ~ALG_FLAG_VALID;
5210 			return;
5211 		}
5212 
5213 		if (alg->alg_ef_default_bits < alg->alg_ef_minbits)
5214 			alg->alg_ef_default_bits = alg->alg_ef_minbits;
5215 		if (alg->alg_ef_default_bits > alg->alg_ef_maxbits)
5216 			alg->alg_ef_default_bits = alg->alg_ef_maxbits;
5217 
5218 		alg->alg_ef_default = SADB_ALG_DEFAULT_INCR(alg->alg_ef_minbits,
5219 		    alg->alg_increment, alg->alg_ef_default_bits);
5220 	} else if (alg->alg_nkey_sizes == 0) {
5221 		/* no specified key size for algorithm */
5222 		alg->alg_ef_minbits = alg->alg_ef_maxbits = 0;
5223 	} else {
5224 		/* supported key sizes are defined by enumeration */
5225 		alg->alg_ef_minbits = (uint16_t)-1;
5226 		alg->alg_ef_maxbits = 0;
5227 
5228 		for (i = 0, is_valid = B_FALSE; i < alg->alg_nkey_sizes; i++) {
5229 			/*
5230 			 * Ignore the current key size if it is not in the
5231 			 * range of sizes supported by the framework.
5232 			 */
5233 			if (alg->alg_key_sizes[i] < crypto_min ||
5234 			    alg->alg_key_sizes[i] > crypto_max)
5235 				continue;
5236 			if (alg->alg_key_sizes[i] < alg->alg_ef_minbits)
5237 				alg->alg_ef_minbits = alg->alg_key_sizes[i];
5238 			if (alg->alg_key_sizes[i] > alg->alg_ef_maxbits)
5239 				alg->alg_ef_maxbits = alg->alg_key_sizes[i];
5240 			is_valid = B_TRUE;
5241 		}
5242 
5243 		if (!is_valid) {
5244 			alg->alg_flags &= ~ALG_FLAG_VALID;
5245 			return;
5246 		}
5247 		alg->alg_ef_default = 0;
5248 	}
5249 }
5250 
5251 /*
5252  * Free the memory used by the specified algorithm.
5253  */
5254 void
5255 ipsec_alg_free(ipsec_alginfo_t *alg)
5256 {
5257 	if (alg == NULL)
5258 		return;
5259 
5260 	if (alg->alg_key_sizes != NULL) {
5261 		kmem_free(alg->alg_key_sizes,
5262 		    (alg->alg_nkey_sizes + 1) * sizeof (uint16_t));
5263 		alg->alg_key_sizes = NULL;
5264 	}
5265 	if (alg->alg_block_sizes != NULL) {
5266 		kmem_free(alg->alg_block_sizes,
5267 		    (alg->alg_nblock_sizes + 1) * sizeof (uint16_t));
5268 		alg->alg_block_sizes = NULL;
5269 	}
5270 	kmem_free(alg, sizeof (*alg));
5271 }
5272 
5273 /*
5274  * Check the validity of the specified key size for an algorithm.
5275  * Returns B_TRUE if key size is valid, B_FALSE otherwise.
5276  */
5277 boolean_t
5278 ipsec_valid_key_size(uint16_t key_size, ipsec_alginfo_t *alg)
5279 {
5280 	if (key_size < alg->alg_ef_minbits || key_size > alg->alg_ef_maxbits)
5281 		return (B_FALSE);
5282 
5283 	if (alg->alg_increment == 0 && alg->alg_nkey_sizes != 0) {
5284 		/*
5285 		 * If the key sizes are defined by enumeration, the new
5286 		 * key size must be equal to one of the supported values.
5287 		 */
5288 		int i;
5289 
5290 		for (i = 0; i < alg->alg_nkey_sizes; i++)
5291 			if (key_size == alg->alg_key_sizes[i])
5292 				break;
5293 		if (i == alg->alg_nkey_sizes)
5294 			return (B_FALSE);
5295 	}
5296 
5297 	return (B_TRUE);
5298 }
5299 
5300 /*
5301  * Callback function invoked by the crypto framework when a provider
5302  * registers or unregisters. This callback updates the algorithms
5303  * tables when a crypto algorithm is no longer available or becomes
5304  * available, and triggers the freeing/creation of context templates
5305  * associated with existing SAs, if needed.
5306  *
5307  * Need to walk all stack instances since the callback is global
5308  * for all instances
5309  */
5310 void
5311 ipsec_prov_update_callback(uint32_t event, void *event_arg)
5312 {
5313 	netstack_handle_t nh;
5314 	netstack_t *ns;
5315 
5316 	netstack_next_init(&nh);
5317 	while ((ns = netstack_next(&nh)) != NULL) {
5318 		ipsec_prov_update_callback_stack(event, event_arg, ns);
5319 		netstack_rele(ns);
5320 	}
5321 	netstack_next_fini(&nh);
5322 }
5323 
5324 static void
5325 ipsec_prov_update_callback_stack(uint32_t event, void *event_arg,
5326     netstack_t *ns)
5327 {
5328 	crypto_notify_event_change_t *prov_change =
5329 	    (crypto_notify_event_change_t *)event_arg;
5330 	uint_t algidx, algid, algtype, mech_count, mech_idx;
5331 	ipsec_alginfo_t *alg;
5332 	ipsec_alginfo_t oalg;
5333 	crypto_mech_name_t *mechs;
5334 	boolean_t alg_changed = B_FALSE;
5335 	ipsec_stack_t	*ipss = ns->netstack_ipsec;
5336 
5337 	/* ignore events for which we didn't register */
5338 	if (event != CRYPTO_EVENT_MECHS_CHANGED) {
5339 		ip1dbg(("ipsec_prov_update_callback: unexpected event 0x%x "
5340 		    " received from crypto framework\n", event));
5341 		return;
5342 	}
5343 
5344 	mechs = crypto_get_mech_list(&mech_count, KM_SLEEP);
5345 	if (mechs == NULL)
5346 		return;
5347 
5348 	/*
5349 	 * Walk the list of currently defined IPsec algorithm. Update
5350 	 * the algorithm valid flag and trigger an update of the
5351 	 * SAs that depend on that algorithm.
5352 	 */
5353 	mutex_enter(&ipss->ipsec_alg_lock);
5354 	for (algtype = 0; algtype < IPSEC_NALGTYPES; algtype++) {
5355 		for (algidx = 0; algidx < ipss->ipsec_nalgs[algtype];
5356 		    algidx++) {
5357 
5358 			algid = ipss->ipsec_sortlist[algtype][algidx];
5359 			alg = ipss->ipsec_alglists[algtype][algid];
5360 			ASSERT(alg != NULL);
5361 
5362 			/*
5363 			 * Skip the algorithms which do not map to the
5364 			 * crypto framework provider being added or removed.
5365 			 */
5366 			if (strncmp(alg->alg_mech_name,
5367 			    prov_change->ec_mech_name,
5368 			    CRYPTO_MAX_MECH_NAME) != 0)
5369 				continue;
5370 
5371 			/*
5372 			 * Determine if the mechanism is valid. If it
5373 			 * is not, mark the algorithm as being invalid. If
5374 			 * it is, mark the algorithm as being valid.
5375 			 */
5376 			for (mech_idx = 0; mech_idx < mech_count; mech_idx++)
5377 				if (strncmp(alg->alg_mech_name,
5378 				    mechs[mech_idx], CRYPTO_MAX_MECH_NAME) == 0)
5379 					break;
5380 			if (mech_idx == mech_count &&
5381 			    alg->alg_flags & ALG_FLAG_VALID) {
5382 				alg->alg_flags &= ~ALG_FLAG_VALID;
5383 				alg_changed = B_TRUE;
5384 			} else if (mech_idx < mech_count &&
5385 			    !(alg->alg_flags & ALG_FLAG_VALID)) {
5386 				alg->alg_flags |= ALG_FLAG_VALID;
5387 				alg_changed = B_TRUE;
5388 			}
5389 
5390 			/*
5391 			 * Update the supported key sizes, regardless
5392 			 * of whether a crypto provider was added or
5393 			 * removed.
5394 			 */
5395 			oalg = *alg;
5396 			ipsec_alg_fix_min_max(alg, algtype, ns);
5397 			if (!alg_changed &&
5398 			    alg->alg_ef_minbits != oalg.alg_ef_minbits ||
5399 			    alg->alg_ef_maxbits != oalg.alg_ef_maxbits ||
5400 			    alg->alg_ef_default != oalg.alg_ef_default ||
5401 			    alg->alg_ef_default_bits !=
5402 			    oalg.alg_ef_default_bits)
5403 				alg_changed = B_TRUE;
5404 
5405 			/*
5406 			 * Update the affected SAs if a software provider is
5407 			 * being added or removed.
5408 			 */
5409 			if (prov_change->ec_provider_type ==
5410 			    CRYPTO_SW_PROVIDER)
5411 				sadb_alg_update(algtype, alg->alg_id,
5412 				    prov_change->ec_change ==
5413 				    CRYPTO_MECH_ADDED, ns);
5414 		}
5415 	}
5416 	mutex_exit(&ipss->ipsec_alg_lock);
5417 	crypto_free_mech_list(mechs, mech_count);
5418 
5419 	if (alg_changed) {
5420 		/*
5421 		 * An algorithm has changed, i.e. it became valid or
5422 		 * invalid, or its support key sizes have changed.
5423 		 * Notify ipsecah and ipsecesp of this change so
5424 		 * that they can send a SADB_REGISTER to their consumers.
5425 		 */
5426 		ipsecah_algs_changed(ns);
5427 		ipsecesp_algs_changed(ns);
5428 	}
5429 }
5430 
5431 /*
5432  * Registers with the crypto framework to be notified of crypto
5433  * providers changes. Used to update the algorithm tables and
5434  * to free or create context templates if needed. Invoked after IPsec
5435  * is loaded successfully.
5436  *
5437  * This is called separately for each IP instance, so we ensure we only
5438  * register once.
5439  */
5440 void
5441 ipsec_register_prov_update(void)
5442 {
5443 	if (prov_update_handle != NULL)
5444 		return;
5445 
5446 	prov_update_handle = crypto_notify_events(
5447 	    ipsec_prov_update_callback, CRYPTO_EVENT_MECHS_CHANGED);
5448 }
5449 
5450 /*
5451  * Unregisters from the framework to be notified of crypto providers
5452  * changes. Called from ipsec_policy_g_destroy().
5453  */
5454 static void
5455 ipsec_unregister_prov_update(void)
5456 {
5457 	if (prov_update_handle != NULL)
5458 		crypto_unnotify_events(prov_update_handle);
5459 }
5460 
5461 /*
5462  * Tunnel-mode support routines.
5463  */
5464 
5465 /*
5466  * Returns an mblk chain suitable for putnext() if policies match and IPsec
5467  * SAs are available.  If there's no per-tunnel policy, or a match comes back
5468  * with no match, then still return the packet and have global policy take
5469  * a crack at it in IP.
5470  *
5471  * Remember -> we can be forwarding packets.  Keep that in mind w.r.t.
5472  * inner-packet contents.
5473  */
5474 mblk_t *
5475 ipsec_tun_outbound(mblk_t *mp, tun_t *atp, ipha_t *inner_ipv4,
5476     ip6_t *inner_ipv6, ipha_t *outer_ipv4, ip6_t *outer_ipv6, int outer_hdr_len,
5477     netstack_t *ns)
5478 {
5479 	ipsec_tun_pol_t *itp = atp->tun_itp;
5480 	ipsec_policy_head_t *polhead;
5481 	ipsec_selector_t sel;
5482 	mblk_t *ipsec_mp, *ipsec_mp_head, *nmp;
5483 	ipsec_out_t *io;
5484 	boolean_t is_fragment;
5485 	ipsec_policy_t *pol;
5486 	ipsec_stack_t *ipss = ns->netstack_ipsec;
5487 
5488 	ASSERT(outer_ipv6 != NULL && outer_ipv4 == NULL ||
5489 	    outer_ipv4 != NULL && outer_ipv6 == NULL);
5490 	/* We take care of inners in a bit. */
5491 
5492 	/* No policy on this tunnel - let global policy have at it. */
5493 	if (itp == NULL || !(itp->itp_flags & ITPF_P_ACTIVE))
5494 		return (mp);
5495 	polhead = itp->itp_policy;
5496 
5497 	bzero(&sel, sizeof (sel));
5498 	if (inner_ipv4 != NULL) {
5499 		ASSERT(inner_ipv6 == NULL);
5500 		sel.ips_isv4 = B_TRUE;
5501 		sel.ips_local_addr_v4 = inner_ipv4->ipha_src;
5502 		sel.ips_remote_addr_v4 = inner_ipv4->ipha_dst;
5503 		sel.ips_protocol = (uint8_t)inner_ipv4->ipha_protocol;
5504 	} else {
5505 		ASSERT(inner_ipv6 != NULL);
5506 		sel.ips_isv4 = B_FALSE;
5507 		sel.ips_local_addr_v6 = inner_ipv6->ip6_src;
5508 		/*
5509 		 * We don't care about routing-header dests in the
5510 		 * forwarding/tunnel path, so just grab ip6_dst.
5511 		 */
5512 		sel.ips_remote_addr_v6 = inner_ipv6->ip6_dst;
5513 	}
5514 
5515 	if (itp->itp_flags & ITPF_P_PER_PORT_SECURITY) {
5516 		/*
5517 		 * Caller can prepend the outer header, which means
5518 		 * inner_ipv[46] may be stuck in the middle.  Pullup the whole
5519 		 * mess now if need-be, for easier processing later.  Don't
5520 		 * forget to rewire the outer header too.
5521 		 */
5522 		if (mp->b_cont != NULL) {
5523 			nmp = msgpullup(mp, -1);
5524 			if (nmp == NULL) {
5525 				ip_drop_packet(mp, B_FALSE, NULL, NULL,
5526 				    DROPPER(ipss, ipds_spd_nomem),
5527 				    &ipss->ipsec_spd_dropper);
5528 				return (NULL);
5529 			}
5530 			freemsg(mp);
5531 			mp = nmp;
5532 			if (outer_ipv4 != NULL)
5533 				outer_ipv4 = (ipha_t *)mp->b_rptr;
5534 			else
5535 				outer_ipv6 = (ip6_t *)mp->b_rptr;
5536 			if (inner_ipv4 != NULL) {
5537 				inner_ipv4 =
5538 				    (ipha_t *)(mp->b_rptr + outer_hdr_len);
5539 			} else {
5540 				inner_ipv6 =
5541 				    (ip6_t *)(mp->b_rptr + outer_hdr_len);
5542 			}
5543 		}
5544 		if (inner_ipv4 != NULL) {
5545 			is_fragment = IS_V4_FRAGMENT(
5546 			    inner_ipv4->ipha_fragment_offset_and_flags);
5547 		} else {
5548 			sel.ips_remote_addr_v6 = ip_get_dst_v6(inner_ipv6, mp,
5549 			    &is_fragment);
5550 		}
5551 
5552 		if (is_fragment) {
5553 			ipha_t *oiph;
5554 			ipha_t *iph = NULL;
5555 			ip6_t *ip6h = NULL;
5556 			int hdr_len;
5557 			uint16_t ip6_hdr_length;
5558 			uint8_t v6_proto;
5559 			uint8_t *v6_proto_p;
5560 
5561 			/*
5562 			 * We have a fragment we need to track!
5563 			 */
5564 			mp = ipsec_fragcache_add(&itp->itp_fragcache, NULL, mp,
5565 			    outer_hdr_len, ipss);
5566 			if (mp == NULL)
5567 				return (NULL);
5568 			ASSERT(mp->b_cont == NULL);
5569 
5570 			/*
5571 			 * If we get here, we have a full
5572 			 * fragment chain
5573 			 */
5574 
5575 			oiph = (ipha_t *)mp->b_rptr;
5576 			if (IPH_HDR_VERSION(oiph) == IPV4_VERSION) {
5577 				hdr_len = ((outer_hdr_len != 0) ?
5578 				    IPH_HDR_LENGTH(oiph) : 0);
5579 				iph = (ipha_t *)(mp->b_rptr + hdr_len);
5580 			} else {
5581 				ASSERT(IPH_HDR_VERSION(oiph) == IPV6_VERSION);
5582 				ip6h = (ip6_t *)mp->b_rptr;
5583 				if (!ip_hdr_length_nexthdr_v6(mp, ip6h,
5584 				    &ip6_hdr_length, &v6_proto_p)) {
5585 					ip_drop_packet_chain(mp, B_FALSE,
5586 					    NULL, NULL, DROPPER(ipss,
5587 					    ipds_spd_malformed_packet),
5588 					    &ipss->ipsec_spd_dropper);
5589 					return (NULL);
5590 				}
5591 				hdr_len = ip6_hdr_length;
5592 			}
5593 			outer_hdr_len = hdr_len;
5594 
5595 			if (sel.ips_isv4) {
5596 				if (iph == NULL) {
5597 					/* Was v6 outer */
5598 					iph = (ipha_t *)(mp->b_rptr + hdr_len);
5599 				}
5600 				inner_ipv4 = iph;
5601 				sel.ips_local_addr_v4 = inner_ipv4->ipha_src;
5602 				sel.ips_remote_addr_v4 = inner_ipv4->ipha_dst;
5603 				sel.ips_protocol =
5604 				    (uint8_t)inner_ipv4->ipha_protocol;
5605 			} else {
5606 				inner_ipv6 = (ip6_t *)(mp->b_rptr +
5607 				    hdr_len);
5608 				sel.ips_local_addr_v6 = inner_ipv6->ip6_src;
5609 				sel.ips_remote_addr_v6 = inner_ipv6->ip6_dst;
5610 				if (!ip_hdr_length_nexthdr_v6(mp,
5611 				    inner_ipv6, &ip6_hdr_length, &v6_proto_p)) {
5612 					ip_drop_packet_chain(mp, B_FALSE,
5613 					    NULL, NULL, DROPPER(ipss,
5614 					    ipds_spd_malformed_frag),
5615 					    &ipss->ipsec_spd_dropper);
5616 					return (NULL);
5617 				}
5618 				v6_proto = *v6_proto_p;
5619 				sel.ips_protocol = v6_proto;
5620 #ifdef FRAGCACHE_DEBUG
5621 				cmn_err(CE_WARN, "v6_sel.ips_protocol = %d\n",
5622 				    sel.ips_protocol);
5623 #endif
5624 			}
5625 			/* Ports are extracted below */
5626 		}
5627 
5628 		/* Get ports... */
5629 		if (!ipsec_init_outbound_ports(&sel, mp,
5630 		    inner_ipv4, inner_ipv6, outer_hdr_len, ipss)) {
5631 			/* callee did ip_drop_packet_chain() on mp. */
5632 			return (NULL);
5633 		}
5634 #ifdef FRAGCACHE_DEBUG
5635 		if (inner_ipv4 != NULL)
5636 			cmn_err(CE_WARN,
5637 			    "(v4) sel.ips_protocol = %d, "
5638 			    "sel.ips_local_port = %d, "
5639 			    "sel.ips_remote_port = %d\n",
5640 			    sel.ips_protocol, ntohs(sel.ips_local_port),
5641 			    ntohs(sel.ips_remote_port));
5642 		if (inner_ipv6 != NULL)
5643 			cmn_err(CE_WARN,
5644 			    "(v6) sel.ips_protocol = %d, "
5645 			    "sel.ips_local_port = %d, "
5646 			    "sel.ips_remote_port = %d\n",
5647 			    sel.ips_protocol, ntohs(sel.ips_local_port),
5648 			    ntohs(sel.ips_remote_port));
5649 #endif
5650 		/* Success so far! */
5651 	}
5652 	rw_enter(&polhead->iph_lock, RW_READER);
5653 	pol = ipsec_find_policy_head(NULL, polhead, IPSEC_TYPE_OUTBOUND,
5654 	    &sel, ns);
5655 	rw_exit(&polhead->iph_lock);
5656 	if (pol == NULL) {
5657 		/*
5658 		 * No matching policy on this tunnel, drop the packet.
5659 		 *
5660 		 * NOTE:  Tunnel-mode tunnels are different from the
5661 		 * IP global transport mode policy head.  For a tunnel-mode
5662 		 * tunnel, we drop the packet in lieu of passing it
5663 		 * along accepted the way a global-policy miss would.
5664 		 *
5665 		 * NOTE2:  "negotiate transport" tunnels should match ALL
5666 		 * inbound packets, but we do not uncomment the ASSERT()
5667 		 * below because if/when we open PF_POLICY, a user can
5668 		 * shoot him/her-self in the foot with a 0 priority.
5669 		 */
5670 
5671 		/* ASSERT(itp->itp_flags & ITPF_P_TUNNEL); */
5672 #ifdef FRAGCACHE_DEBUG
5673 		cmn_err(CE_WARN, "ipsec_tun_outbound(): No matching tunnel "
5674 		    "per-port policy\n");
5675 #endif
5676 		ip_drop_packet_chain(mp, B_FALSE, NULL, NULL,
5677 		    DROPPER(ipss, ipds_spd_explicit),
5678 		    &ipss->ipsec_spd_dropper);
5679 		return (NULL);
5680 	}
5681 
5682 #ifdef FRAGCACHE_DEBUG
5683 	cmn_err(CE_WARN, "Having matching tunnel per-port policy\n");
5684 #endif
5685 
5686 	/* Construct an IPSEC_OUT message. */
5687 	ipsec_mp = ipsec_mp_head = ipsec_alloc_ipsec_out(ns);
5688 	if (ipsec_mp == NULL) {
5689 		IPPOL_REFRELE(pol, ns);
5690 		ip_drop_packet(mp, B_FALSE, NULL, NULL,
5691 		    DROPPER(ipss, ipds_spd_nomem),
5692 		    &ipss->ipsec_spd_dropper);
5693 		return (NULL);
5694 	}
5695 	ipsec_mp->b_cont = mp;
5696 	io = (ipsec_out_t *)ipsec_mp->b_rptr;
5697 	IPPH_REFHOLD(polhead);
5698 	/*
5699 	 * NOTE: free() function of ipsec_out mblk will release polhead and
5700 	 * pol references.
5701 	 */
5702 	io->ipsec_out_polhead = polhead;
5703 	io->ipsec_out_policy = pol;
5704 	io->ipsec_out_zoneid = atp->tun_zoneid;
5705 	io->ipsec_out_v4 = (outer_ipv4 != NULL);
5706 	io->ipsec_out_secure = B_TRUE;
5707 
5708 	if (!(itp->itp_flags & ITPF_P_TUNNEL)) {
5709 		/* Set up transport mode for tunnelled packets. */
5710 		io->ipsec_out_proto = (inner_ipv4 != NULL) ? IPPROTO_ENCAP :
5711 		    IPPROTO_IPV6;
5712 		return (ipsec_mp);
5713 	}
5714 
5715 	/* Fill in tunnel-mode goodies here. */
5716 	io->ipsec_out_tunnel = B_TRUE;
5717 	/* XXX Do I need to fill in all of the goodies here? */
5718 	if (inner_ipv4) {
5719 		io->ipsec_out_inaf = AF_INET;
5720 		io->ipsec_out_insrc[0] =
5721 		    pol->ipsp_sel->ipsl_key.ipsl_local.ipsad_v4;
5722 		io->ipsec_out_indst[0] =
5723 		    pol->ipsp_sel->ipsl_key.ipsl_remote.ipsad_v4;
5724 	} else {
5725 		io->ipsec_out_inaf = AF_INET6;
5726 		io->ipsec_out_insrc[0] =
5727 		    pol->ipsp_sel->ipsl_key.ipsl_local.ipsad_v6.s6_addr32[0];
5728 		io->ipsec_out_insrc[1] =
5729 		    pol->ipsp_sel->ipsl_key.ipsl_local.ipsad_v6.s6_addr32[1];
5730 		io->ipsec_out_insrc[2] =
5731 		    pol->ipsp_sel->ipsl_key.ipsl_local.ipsad_v6.s6_addr32[2];
5732 		io->ipsec_out_insrc[3] =
5733 		    pol->ipsp_sel->ipsl_key.ipsl_local.ipsad_v6.s6_addr32[3];
5734 		io->ipsec_out_indst[0] =
5735 		    pol->ipsp_sel->ipsl_key.ipsl_remote.ipsad_v6.s6_addr32[0];
5736 		io->ipsec_out_indst[1] =
5737 		    pol->ipsp_sel->ipsl_key.ipsl_remote.ipsad_v6.s6_addr32[1];
5738 		io->ipsec_out_indst[2] =
5739 		    pol->ipsp_sel->ipsl_key.ipsl_remote.ipsad_v6.s6_addr32[2];
5740 		io->ipsec_out_indst[3] =
5741 		    pol->ipsp_sel->ipsl_key.ipsl_remote.ipsad_v6.s6_addr32[3];
5742 	}
5743 	io->ipsec_out_insrcpfx = pol->ipsp_sel->ipsl_key.ipsl_local_pfxlen;
5744 	io->ipsec_out_indstpfx = pol->ipsp_sel->ipsl_key.ipsl_remote_pfxlen;
5745 	/* NOTE:  These are used for transport mode too. */
5746 	io->ipsec_out_src_port = pol->ipsp_sel->ipsl_key.ipsl_lport;
5747 	io->ipsec_out_dst_port = pol->ipsp_sel->ipsl_key.ipsl_rport;
5748 	io->ipsec_out_proto = pol->ipsp_sel->ipsl_key.ipsl_proto;
5749 
5750 	/*
5751 	 * The mp pointer still valid
5752 	 * Add ipsec_out to each fragment.
5753 	 * The fragment head already has one
5754 	 */
5755 	nmp = mp->b_next;
5756 	mp->b_next = NULL;
5757 	mp = nmp;
5758 	ASSERT(ipsec_mp != NULL);
5759 	while (mp != NULL) {
5760 		nmp = mp->b_next;
5761 		ipsec_mp->b_next = ipsec_out_tag(ipsec_mp_head, mp, ns);
5762 		if (ipsec_mp->b_next == NULL) {
5763 			ip_drop_packet_chain(ipsec_mp_head, B_FALSE, NULL, NULL,
5764 			    DROPPER(ipss, ipds_spd_nomem),
5765 			    &ipss->ipsec_spd_dropper);
5766 			ip_drop_packet_chain(mp, B_FALSE, NULL, NULL,
5767 			    DROPPER(ipss, ipds_spd_nomem),
5768 			    &ipss->ipsec_spd_dropper);
5769 			return (NULL);
5770 		}
5771 		ipsec_mp = ipsec_mp->b_next;
5772 		mp->b_next = NULL;
5773 		mp = nmp;
5774 	}
5775 	return (ipsec_mp_head);
5776 }
5777 
5778 /*
5779  * NOTE: The following releases pol's reference and
5780  * calls ip_drop_packet() for me on NULL returns.
5781  */
5782 mblk_t *
5783 ipsec_check_ipsecin_policy_reasm(mblk_t *ipsec_mp, ipsec_policy_t *pol,
5784     ipha_t *inner_ipv4, ip6_t *inner_ipv6, uint64_t pkt_unique, netstack_t *ns)
5785 {
5786 	/* Assume ipsec_mp is a chain of b_next-linked IPSEC_IN M_CTLs. */
5787 	mblk_t *data_chain = NULL, *data_tail = NULL;
5788 	mblk_t *ii_next;
5789 
5790 	while (ipsec_mp != NULL) {
5791 		ii_next = ipsec_mp->b_next;
5792 		ipsec_mp->b_next = NULL;  /* No tripping asserts. */
5793 
5794 		/*
5795 		 * Need IPPOL_REFHOLD(pol) for extras because
5796 		 * ipsecin_policy does the refrele.
5797 		 */
5798 		IPPOL_REFHOLD(pol);
5799 
5800 		if (ipsec_check_ipsecin_policy(ipsec_mp, pol, inner_ipv4,
5801 		    inner_ipv6, pkt_unique, ns) != NULL) {
5802 			if (data_tail == NULL) {
5803 				/* First one */
5804 				data_chain = data_tail = ipsec_mp->b_cont;
5805 			} else {
5806 				data_tail->b_next = ipsec_mp->b_cont;
5807 				data_tail = data_tail->b_next;
5808 			}
5809 			freeb(ipsec_mp);
5810 		} else {
5811 			/*
5812 			 * ipsec_check_ipsecin_policy() freed ipsec_mp
5813 			 * already.   Need to get rid of any extra pol
5814 			 * references, and any remaining bits as well.
5815 			 */
5816 			IPPOL_REFRELE(pol, ns);
5817 			ipsec_freemsg_chain(data_chain);
5818 			ipsec_freemsg_chain(ii_next);	/* ipdrop stats? */
5819 			return (NULL);
5820 		}
5821 		ipsec_mp = ii_next;
5822 	}
5823 	/*
5824 	 * One last release because either the loop bumped it up, or we never
5825 	 * called ipsec_check_ipsecin_policy().
5826 	 */
5827 	IPPOL_REFRELE(pol, ns);
5828 
5829 	/* data_chain is ready for return to tun module. */
5830 	return (data_chain);
5831 }
5832 
5833 
5834 /*
5835  * Returns B_TRUE if the inbound packet passed an IPsec policy check.  Returns
5836  * B_FALSE if it failed or if it is a fragment needing its friends before a
5837  * policy check can be performed.
5838  *
5839  * Expects a non-NULL *data_mp, an optional ipsec_mp, and a non-NULL polhead.
5840  * data_mp may be reassigned with a b_next chain of packets if fragments
5841  * neeeded to be collected for a proper policy check.
5842  *
5843  * Always frees ipsec_mp, but only frees data_mp if returns B_FALSE.  This
5844  * function calls ip_drop_packet() on data_mp if need be.
5845  *
5846  * NOTE:  outer_hdr_len is signed.  If it's a negative value, the caller
5847  * is inspecting an ICMP packet.
5848  */
5849 boolean_t
5850 ipsec_tun_inbound(mblk_t *ipsec_mp, mblk_t **data_mp, ipsec_tun_pol_t *itp,
5851     ipha_t *inner_ipv4, ip6_t *inner_ipv6, ipha_t *outer_ipv4,
5852     ip6_t *outer_ipv6, int outer_hdr_len, netstack_t *ns)
5853 {
5854 	ipsec_policy_head_t *polhead;
5855 	ipsec_selector_t sel;
5856 	mblk_t *message = (ipsec_mp == NULL) ? *data_mp : ipsec_mp;
5857 	ipsec_policy_t *pol;
5858 	uint16_t tmpport;
5859 	selret_t rc;
5860 	boolean_t retval, port_policy_present, is_icmp, global_present;
5861 	in6_addr_t tmpaddr;
5862 	ipaddr_t tmp4;
5863 	ipsec_stack_t *ipss = ns->netstack_ipsec;
5864 	uint8_t flags, *holder, *outer_hdr;
5865 
5866 	sel.ips_is_icmp_inv_acq = 0;
5867 
5868 	if (outer_ipv4 != NULL) {
5869 		ASSERT(outer_ipv6 == NULL);
5870 		outer_hdr = (uint8_t *)outer_ipv4;
5871 		global_present = ipss->ipsec_inbound_v4_policy_present;
5872 	} else {
5873 		outer_hdr = (uint8_t *)outer_ipv6;
5874 		global_present = ipss->ipsec_inbound_v6_policy_present;
5875 	}
5876 	ASSERT(outer_hdr != NULL);
5877 
5878 	ASSERT(inner_ipv4 != NULL && inner_ipv6 == NULL ||
5879 	    inner_ipv4 == NULL && inner_ipv6 != NULL);
5880 	ASSERT(message == *data_mp || message->b_cont == *data_mp);
5881 
5882 	if (outer_hdr_len < 0) {
5883 		outer_hdr_len = (-outer_hdr_len);
5884 		is_icmp = B_TRUE;
5885 	} else {
5886 		is_icmp = B_FALSE;
5887 	}
5888 
5889 	if (itp != NULL && (itp->itp_flags & ITPF_P_ACTIVE)) {
5890 		polhead = itp->itp_policy;
5891 		/*
5892 		 * We need to perform full Tunnel-Mode enforcement,
5893 		 * and we need to have inner-header data for such enforcement.
5894 		 *
5895 		 * See ipsec_init_inbound_sel() for the 0x80000000 on inbound
5896 		 * and on return.
5897 		 */
5898 
5899 		port_policy_present = ((itp->itp_flags &
5900 		    ITPF_P_PER_PORT_SECURITY) ? B_TRUE : B_FALSE);
5901 		flags = ((port_policy_present ? SEL_PORT_POLICY : SEL_NONE) |
5902 		    (is_icmp ? SEL_IS_ICMP : SEL_NONE) | SEL_TUNNEL_MODE);
5903 
5904 		rc = ipsec_init_inbound_sel(&sel, *data_mp, inner_ipv4,
5905 		    inner_ipv6, flags);
5906 
5907 		switch (rc) {
5908 		case SELRET_NOMEM:
5909 			ip_drop_packet(message, B_TRUE, NULL, NULL,
5910 			    DROPPER(ipss, ipds_spd_nomem),
5911 			    &ipss->ipsec_spd_dropper);
5912 			return (B_FALSE);
5913 		case SELRET_TUNFRAG:
5914 			/*
5915 			 * At this point, if we're cleartext, we don't want
5916 			 * to go there.
5917 			 */
5918 			if (ipsec_mp == NULL) {
5919 				ip_drop_packet(*data_mp, B_TRUE, NULL, NULL,
5920 				    DROPPER(ipss, ipds_spd_got_clear),
5921 				    &ipss->ipsec_spd_dropper);
5922 				*data_mp = NULL;
5923 				return (B_FALSE);
5924 			}
5925 			ASSERT(((ipsec_in_t *)ipsec_mp->b_rptr)->
5926 			    ipsec_in_secure);
5927 			message = ipsec_fragcache_add(&itp->itp_fragcache,
5928 			    ipsec_mp, *data_mp, outer_hdr_len, ipss);
5929 
5930 			if (message == NULL) {
5931 				/*
5932 				 * Data is cached, fragment chain is not
5933 				 * complete.  I consume ipsec_mp and data_mp
5934 				 */
5935 				return (B_FALSE);
5936 			}
5937 
5938 			/*
5939 			 * If we get here, we have a full fragment chain.
5940 			 * Reacquire headers and selectors from first fragment.
5941 			 */
5942 			if (inner_ipv4 != NULL) {
5943 				inner_ipv4 = (ipha_t *)message->b_cont->b_rptr;
5944 				ASSERT(message->b_cont->b_wptr -
5945 				    message->b_cont->b_rptr > sizeof (ipha_t));
5946 			} else {
5947 				inner_ipv6 = (ip6_t *)message->b_cont->b_rptr;
5948 				ASSERT(message->b_cont->b_wptr -
5949 				    message->b_cont->b_rptr > sizeof (ip6_t));
5950 			}
5951 			/* Use SEL_NONE so we always get ports! */
5952 			rc = ipsec_init_inbound_sel(&sel, message->b_cont,
5953 			    inner_ipv4, inner_ipv6, SEL_NONE);
5954 			switch (rc) {
5955 			case SELRET_SUCCESS:
5956 				/*
5957 				 * Get to same place as first caller's
5958 				 * SELRET_SUCCESS case.
5959 				 */
5960 				break;
5961 			case SELRET_NOMEM:
5962 				ip_drop_packet_chain(message, B_TRUE,
5963 				    NULL, NULL,
5964 				    DROPPER(ipss, ipds_spd_nomem),
5965 				    &ipss->ipsec_spd_dropper);
5966 				return (B_FALSE);
5967 			case SELRET_BADPKT:
5968 				ip_drop_packet_chain(message, B_TRUE,
5969 				    NULL, NULL,
5970 				    DROPPER(ipss, ipds_spd_malformed_frag),
5971 				    &ipss->ipsec_spd_dropper);
5972 				return (B_FALSE);
5973 			case SELRET_TUNFRAG:
5974 				cmn_err(CE_WARN, "(TUNFRAG on 2nd call...)");
5975 				/* FALLTHRU */
5976 			default:
5977 				cmn_err(CE_WARN, "ipsec_init_inbound_sel(mark2)"
5978 				    " returns bizarro 0x%x", rc);
5979 				/* Guaranteed panic! */
5980 				ASSERT(rc == SELRET_NOMEM);
5981 				return (B_FALSE);
5982 			}
5983 			/* FALLTHRU */
5984 		case SELRET_SUCCESS:
5985 			/*
5986 			 * Common case:
5987 			 * No per-port policy or a non-fragment.  Keep going.
5988 			 */
5989 			break;
5990 		case SELRET_BADPKT:
5991 			/*
5992 			 * We may receive ICMP (with IPv6 inner) packets that
5993 			 * trigger this return value.  Send 'em in for
5994 			 * enforcement checking.
5995 			 */
5996 			cmn_err(CE_NOTE, "ipsec_tun_inbound(): "
5997 			    "sending 'bad packet' in for enforcement");
5998 			break;
5999 		default:
6000 			cmn_err(CE_WARN,
6001 			    "ipsec_init_inbound_sel() returns bizarro 0x%x",
6002 			    rc);
6003 			ASSERT(rc == SELRET_NOMEM);	/* Guaranteed panic! */
6004 			return (B_FALSE);
6005 		}
6006 
6007 		if (is_icmp) {
6008 			/*
6009 			 * Swap local/remote because this is an ICMP packet.
6010 			 */
6011 			tmpaddr = sel.ips_local_addr_v6;
6012 			sel.ips_local_addr_v6 = sel.ips_remote_addr_v6;
6013 			sel.ips_remote_addr_v6 = tmpaddr;
6014 			tmpport = sel.ips_local_port;
6015 			sel.ips_local_port = sel.ips_remote_port;
6016 			sel.ips_remote_port = tmpport;
6017 		}
6018 
6019 		/* find_policy_head() */
6020 		rw_enter(&polhead->iph_lock, RW_READER);
6021 		pol = ipsec_find_policy_head(NULL, polhead, IPSEC_TYPE_INBOUND,
6022 		    &sel, ns);
6023 		rw_exit(&polhead->iph_lock);
6024 		if (pol != NULL) {
6025 			if (ipsec_mp == NULL ||
6026 			    !((ipsec_in_t *)ipsec_mp->b_rptr)->
6027 			    ipsec_in_secure) {
6028 				retval = pol->ipsp_act->ipa_allow_clear;
6029 				if (!retval) {
6030 					/*
6031 					 * XXX should never get here with
6032 					 * tunnel reassembled fragments?
6033 					 */
6034 					ASSERT(message->b_next == NULL);
6035 					ip_drop_packet(message, B_TRUE, NULL,
6036 					    NULL,
6037 					    DROPPER(ipss, ipds_spd_got_clear),
6038 					    &ipss->ipsec_spd_dropper);
6039 				} else if (ipsec_mp != NULL) {
6040 					freeb(ipsec_mp);
6041 				}
6042 
6043 				IPPOL_REFRELE(pol, ns);
6044 				return (retval);
6045 			}
6046 			/*
6047 			 * NOTE: The following releases pol's reference and
6048 			 * calls ip_drop_packet() for me on NULL returns.
6049 			 *
6050 			 * "sel" is still good here, so let's use it!
6051 			 */
6052 			*data_mp = ipsec_check_ipsecin_policy_reasm(message,
6053 			    pol, inner_ipv4, inner_ipv6, SA_UNIQUE_ID(
6054 			    sel.ips_remote_port, sel.ips_local_port,
6055 			    (inner_ipv4 == NULL) ? IPPROTO_IPV6 :
6056 			    IPPROTO_ENCAP, sel.ips_protocol), ns);
6057 			return (*data_mp != NULL);
6058 		}
6059 
6060 		/*
6061 		 * Else fallthru and check the global policy on the outer
6062 		 * header(s) if this tunnel is an old-style transport-mode
6063 		 * one.  Drop the packet explicitly (no policy entry) for
6064 		 * a new-style tunnel-mode tunnel.
6065 		 */
6066 		if ((itp->itp_flags & ITPF_P_TUNNEL) && !is_icmp) {
6067 			ip_drop_packet_chain(message, B_TRUE, NULL,
6068 			    NULL,
6069 			    DROPPER(ipss, ipds_spd_explicit),
6070 			    &ipss->ipsec_spd_dropper);
6071 			return (B_FALSE);
6072 		}
6073 	}
6074 
6075 	/*
6076 	 * NOTE:  If we reach here, we will not have packet chains from
6077 	 * fragcache_add(), because the only way I get chains is on a
6078 	 * tunnel-mode tunnel, which either returns with a pass, or gets
6079 	 * hit by the ip_drop_packet_chain() call right above here.
6080 	 */
6081 
6082 	/* If no per-tunnel security, check global policy now. */
6083 	if (ipsec_mp != NULL && !global_present) {
6084 		if (((ipsec_in_t *)(ipsec_mp->b_rptr))->
6085 		    ipsec_in_icmp_loopback) {
6086 			/*
6087 			 * This is an ICMP message with an ipsec_mp
6088 			 * attached.  We should accept it.
6089 			 */
6090 			if (ipsec_mp != NULL)
6091 				freeb(ipsec_mp);
6092 			return (B_TRUE);
6093 		}
6094 
6095 		ip_drop_packet(ipsec_mp, B_TRUE, NULL, NULL,
6096 		    DROPPER(ipss, ipds_spd_got_secure),
6097 		    &ipss->ipsec_spd_dropper);
6098 		return (B_FALSE);
6099 	}
6100 
6101 	/*
6102 	 * The following assertion is valid because only the tun module alters
6103 	 * the mblk chain - stripping the outer header by advancing mp->b_rptr.
6104 	 */
6105 	ASSERT(is_icmp || ((*data_mp)->b_datap->db_base <= outer_hdr &&
6106 	    outer_hdr < (*data_mp)->b_rptr));
6107 	holder = (*data_mp)->b_rptr;
6108 	(*data_mp)->b_rptr = outer_hdr;
6109 
6110 	if (is_icmp) {
6111 		/*
6112 		 * For ICMP packets, "outer_ipvN" is set to the outer header
6113 		 * that is *INSIDE* the ICMP payload.  For global policy
6114 		 * checking, we need to reverse src/dst on the payload in
6115 		 * order to construct selectors appropriately.  See "ripha"
6116 		 * constructions in ip.c.  To avoid a bug like 6478464 (see
6117 		 * earlier in this file), we will actually exchange src/dst
6118 		 * in the packet, and reverse if after the call to
6119 		 * ipsec_check_global_policy().
6120 		 */
6121 		if (outer_ipv4 != NULL) {
6122 			tmp4 = outer_ipv4->ipha_src;
6123 			outer_ipv4->ipha_src = outer_ipv4->ipha_dst;
6124 			outer_ipv4->ipha_dst = tmp4;
6125 		} else {
6126 			ASSERT(outer_ipv6 != NULL);
6127 			tmpaddr = outer_ipv6->ip6_src;
6128 			outer_ipv6->ip6_src = outer_ipv6->ip6_dst;
6129 			outer_ipv6->ip6_dst = tmpaddr;
6130 		}
6131 	}
6132 
6133 	/* NOTE:  Frees message if it returns NULL. */
6134 	if (ipsec_check_global_policy(message, NULL, outer_ipv4, outer_ipv6,
6135 	    (ipsec_mp != NULL), ns) == NULL) {
6136 		return (B_FALSE);
6137 	}
6138 
6139 	if (is_icmp) {
6140 		/* Set things back to normal. */
6141 		if (outer_ipv4 != NULL) {
6142 			tmp4 = outer_ipv4->ipha_src;
6143 			outer_ipv4->ipha_src = outer_ipv4->ipha_dst;
6144 			outer_ipv4->ipha_dst = tmp4;
6145 		} else {
6146 			/* No need for ASSERT()s now. */
6147 			tmpaddr = outer_ipv6->ip6_src;
6148 			outer_ipv6->ip6_src = outer_ipv6->ip6_dst;
6149 			outer_ipv6->ip6_dst = tmpaddr;
6150 		}
6151 	}
6152 
6153 	(*data_mp)->b_rptr = holder;
6154 
6155 	if (ipsec_mp != NULL)
6156 		freeb(ipsec_mp);
6157 
6158 	/*
6159 	 * At this point, we pretend it's a cleartext accepted
6160 	 * packet.
6161 	 */
6162 	return (B_TRUE);
6163 }
6164 
6165 /*
6166  * AVL comparison routine for our list of tunnel polheads.
6167  */
6168 static int
6169 tunnel_compare(const void *arg1, const void *arg2)
6170 {
6171 	ipsec_tun_pol_t *left, *right;
6172 	int rc;
6173 
6174 	left = (ipsec_tun_pol_t *)arg1;
6175 	right = (ipsec_tun_pol_t *)arg2;
6176 
6177 	rc = strncmp(left->itp_name, right->itp_name, LIFNAMSIZ);
6178 	return (rc == 0 ? rc : (rc > 0 ? 1 : -1));
6179 }
6180 
6181 /*
6182  * Free a tunnel policy node.
6183  */
6184 void
6185 itp_free(ipsec_tun_pol_t *node, netstack_t *ns)
6186 {
6187 	IPPH_REFRELE(node->itp_policy, ns);
6188 	IPPH_REFRELE(node->itp_inactive, ns);
6189 	mutex_destroy(&node->itp_lock);
6190 	kmem_free(node, sizeof (*node));
6191 }
6192 
6193 void
6194 itp_unlink(ipsec_tun_pol_t *node, netstack_t *ns)
6195 {
6196 	ipsec_stack_t *ipss = ns->netstack_ipsec;
6197 
6198 	rw_enter(&ipss->ipsec_tunnel_policy_lock, RW_WRITER);
6199 	ipss->ipsec_tunnel_policy_gen++;
6200 	ipsec_fragcache_uninit(&node->itp_fragcache);
6201 	avl_remove(&ipss->ipsec_tunnel_policies, node);
6202 	rw_exit(&ipss->ipsec_tunnel_policy_lock);
6203 	ITP_REFRELE(node, ns);
6204 }
6205 
6206 /*
6207  * Public interface to look up a tunnel security policy by name.  Used by
6208  * spdsock mostly.  Returns "node" with a bumped refcnt.
6209  */
6210 ipsec_tun_pol_t *
6211 get_tunnel_policy(char *name, netstack_t *ns)
6212 {
6213 	ipsec_tun_pol_t *node, lookup;
6214 	ipsec_stack_t *ipss = ns->netstack_ipsec;
6215 
6216 	(void) strncpy(lookup.itp_name, name, LIFNAMSIZ);
6217 
6218 	rw_enter(&ipss->ipsec_tunnel_policy_lock, RW_READER);
6219 	node = (ipsec_tun_pol_t *)avl_find(&ipss->ipsec_tunnel_policies,
6220 	    &lookup, NULL);
6221 	if (node != NULL) {
6222 		ITP_REFHOLD(node);
6223 	}
6224 	rw_exit(&ipss->ipsec_tunnel_policy_lock);
6225 
6226 	return (node);
6227 }
6228 
6229 /*
6230  * Public interface to walk all tunnel security polcies.  Useful for spdsock
6231  * DUMP operations.  iterator() will not consume a reference.
6232  */
6233 void
6234 itp_walk(void (*iterator)(ipsec_tun_pol_t *, void *, netstack_t *),
6235     void *arg, netstack_t *ns)
6236 {
6237 	ipsec_tun_pol_t *node;
6238 	ipsec_stack_t *ipss = ns->netstack_ipsec;
6239 
6240 	rw_enter(&ipss->ipsec_tunnel_policy_lock, RW_READER);
6241 	for (node = avl_first(&ipss->ipsec_tunnel_policies); node != NULL;
6242 	    node = AVL_NEXT(&ipss->ipsec_tunnel_policies, node)) {
6243 		iterator(node, arg, ns);
6244 	}
6245 	rw_exit(&ipss->ipsec_tunnel_policy_lock);
6246 }
6247 
6248 /*
6249  * Initialize policy head.  This can only fail if there's a memory problem.
6250  */
6251 static boolean_t
6252 tunnel_polhead_init(ipsec_policy_head_t *iph, netstack_t *ns)
6253 {
6254 	ipsec_stack_t *ipss = ns->netstack_ipsec;
6255 
6256 	rw_init(&iph->iph_lock, NULL, RW_DEFAULT, NULL);
6257 	iph->iph_refs = 1;
6258 	iph->iph_gen = 0;
6259 	if (ipsec_alloc_table(iph, ipss->ipsec_tun_spd_hashsize,
6260 	    KM_SLEEP, B_FALSE, ns) != 0) {
6261 		ipsec_polhead_free_table(iph);
6262 		return (B_FALSE);
6263 	}
6264 	ipsec_polhead_init(iph, ipss->ipsec_tun_spd_hashsize);
6265 	return (B_TRUE);
6266 }
6267 
6268 /*
6269  * Create a tunnel policy node with "name".  Set errno with
6270  * ENOMEM if there's a memory problem, and EEXIST if there's an existing
6271  * node.
6272  */
6273 ipsec_tun_pol_t *
6274 create_tunnel_policy(char *name, int *errno, uint64_t *gen, netstack_t *ns)
6275 {
6276 	ipsec_tun_pol_t *newbie, *existing;
6277 	avl_index_t where;
6278 	ipsec_stack_t *ipss = ns->netstack_ipsec;
6279 
6280 	newbie = kmem_zalloc(sizeof (*newbie), KM_NOSLEEP);
6281 	if (newbie == NULL) {
6282 		*errno = ENOMEM;
6283 		return (NULL);
6284 	}
6285 	if (!ipsec_fragcache_init(&newbie->itp_fragcache)) {
6286 		kmem_free(newbie, sizeof (*newbie));
6287 		*errno = ENOMEM;
6288 		return (NULL);
6289 	}
6290 
6291 	(void) strncpy(newbie->itp_name, name, LIFNAMSIZ);
6292 
6293 	rw_enter(&ipss->ipsec_tunnel_policy_lock, RW_WRITER);
6294 	existing = (ipsec_tun_pol_t *)avl_find(&ipss->ipsec_tunnel_policies,
6295 	    newbie, &where);
6296 	if (existing != NULL) {
6297 		itp_free(newbie, ns);
6298 		*errno = EEXIST;
6299 		rw_exit(&ipss->ipsec_tunnel_policy_lock);
6300 		return (NULL);
6301 	}
6302 	ipss->ipsec_tunnel_policy_gen++;
6303 	*gen = ipss->ipsec_tunnel_policy_gen;
6304 	newbie->itp_refcnt = 2;	/* One for the caller, one for the tree. */
6305 	newbie->itp_next_policy_index = 1;
6306 	avl_insert(&ipss->ipsec_tunnel_policies, newbie, where);
6307 	mutex_init(&newbie->itp_lock, NULL, MUTEX_DEFAULT, NULL);
6308 	newbie->itp_policy = kmem_zalloc(sizeof (ipsec_policy_head_t),
6309 	    KM_NOSLEEP);
6310 	if (newbie->itp_policy == NULL)
6311 		goto nomem;
6312 	newbie->itp_inactive = kmem_zalloc(sizeof (ipsec_policy_head_t),
6313 	    KM_NOSLEEP);
6314 	if (newbie->itp_inactive == NULL) {
6315 		kmem_free(newbie->itp_policy, sizeof (ipsec_policy_head_t));
6316 		goto nomem;
6317 	}
6318 
6319 	if (!tunnel_polhead_init(newbie->itp_policy, ns)) {
6320 		kmem_free(newbie->itp_policy, sizeof (ipsec_policy_head_t));
6321 		kmem_free(newbie->itp_inactive, sizeof (ipsec_policy_head_t));
6322 		goto nomem;
6323 	} else if (!tunnel_polhead_init(newbie->itp_inactive, ns)) {
6324 		IPPH_REFRELE(newbie->itp_policy, ns);
6325 		kmem_free(newbie->itp_inactive, sizeof (ipsec_policy_head_t));
6326 		goto nomem;
6327 	}
6328 	rw_exit(&ipss->ipsec_tunnel_policy_lock);
6329 
6330 	return (newbie);
6331 nomem:
6332 	*errno = ENOMEM;
6333 	kmem_free(newbie, sizeof (*newbie));
6334 	return (NULL);
6335 }
6336 
6337 /*
6338  * We can't call the tun_t lookup function until tun is
6339  * loaded, so create a dummy function to avoid symbol
6340  * lookup errors on boot.
6341  */
6342 /* ARGSUSED */
6343 ipsec_tun_pol_t *
6344 itp_get_byaddr_dummy(uint32_t *laddr, uint32_t *faddr, int af, netstack_t *ns)
6345 {
6346 	return (NULL);  /* Always return NULL. */
6347 }
6348 
6349 /*
6350  * Frag cache code, based on SunScreen 3.2 source
6351  *	screen/kernel/common/screen_fragcache.c
6352  */
6353 
6354 #define	IPSEC_FRAG_TTL_MAX	5
6355 /*
6356  * Note that the following parameters create 256 hash buckets
6357  * with 1024 free entries to be distributed.  Things are cleaned
6358  * periodically and are attempted to be cleaned when there is no
6359  * free space, but this system errs on the side of dropping packets
6360  * over creating memory exhaustion.  We may decide to make hash
6361  * factor a tunable if this proves to be a bad decision.
6362  */
6363 #define	IPSEC_FRAG_HASH_SLOTS	(1<<8)
6364 #define	IPSEC_FRAG_HASH_FACTOR	4
6365 #define	IPSEC_FRAG_HASH_SIZE	(IPSEC_FRAG_HASH_SLOTS * IPSEC_FRAG_HASH_FACTOR)
6366 
6367 #define	IPSEC_FRAG_HASH_MASK		(IPSEC_FRAG_HASH_SLOTS - 1)
6368 #define	IPSEC_FRAG_HASH_FUNC(id)	(((id) & IPSEC_FRAG_HASH_MASK) ^ \
6369 					    (((id) / \
6370 					    (ushort_t)IPSEC_FRAG_HASH_SLOTS) & \
6371 					    IPSEC_FRAG_HASH_MASK))
6372 
6373 /* Maximum fragments per packet.  48 bytes payload x 1366 packets > 64KB */
6374 #define	IPSEC_MAX_FRAGS		1366
6375 
6376 #define	V4_FRAG_OFFSET(ipha) ((ntohs(ipha->ipha_fragment_offset_and_flags) & \
6377 				    IPH_OFFSET) << 3)
6378 #define	V4_MORE_FRAGS(ipha) (ntohs(ipha->ipha_fragment_offset_and_flags) & \
6379 		IPH_MF)
6380 
6381 /*
6382  * Initialize an ipsec fragcache instance.
6383  * Returns B_FALSE if memory allocation fails.
6384  */
6385 boolean_t
6386 ipsec_fragcache_init(ipsec_fragcache_t *frag)
6387 {
6388 	ipsec_fragcache_entry_t *ftemp;
6389 	int i;
6390 
6391 	mutex_init(&frag->itpf_lock, NULL, MUTEX_DEFAULT, NULL);
6392 	frag->itpf_ptr = (ipsec_fragcache_entry_t **)
6393 	    kmem_zalloc(sizeof (ipsec_fragcache_entry_t *) *
6394 	    IPSEC_FRAG_HASH_SLOTS, KM_NOSLEEP);
6395 	if (frag->itpf_ptr == NULL)
6396 		return (B_FALSE);
6397 
6398 	ftemp = (ipsec_fragcache_entry_t *)
6399 	    kmem_zalloc(sizeof (ipsec_fragcache_entry_t) *
6400 	    IPSEC_FRAG_HASH_SIZE, KM_NOSLEEP);
6401 	if (ftemp == NULL) {
6402 		kmem_free(frag->itpf_ptr, sizeof (ipsec_fragcache_entry_t *) *
6403 		    IPSEC_FRAG_HASH_SLOTS);
6404 		return (B_FALSE);
6405 	}
6406 
6407 	frag->itpf_freelist = NULL;
6408 
6409 	for (i = 0; i < IPSEC_FRAG_HASH_SIZE; i++) {
6410 		ftemp->itpfe_next = frag->itpf_freelist;
6411 		frag->itpf_freelist = ftemp;
6412 		ftemp++;
6413 	}
6414 
6415 	frag->itpf_expire_hint = 0;
6416 
6417 	return (B_TRUE);
6418 }
6419 
6420 void
6421 ipsec_fragcache_uninit(ipsec_fragcache_t *frag)
6422 {
6423 	ipsec_fragcache_entry_t *fep;
6424 	int i;
6425 
6426 	mutex_enter(&frag->itpf_lock);
6427 	if (frag->itpf_ptr) {
6428 		/* Delete any existing fragcache entry chains */
6429 		for (i = 0; i < IPSEC_FRAG_HASH_SLOTS; i++) {
6430 			fep = (frag->itpf_ptr)[i];
6431 			while (fep != NULL) {
6432 				/* Returned fep is next in chain or NULL */
6433 				fep = fragcache_delentry(i, fep, frag);
6434 			}
6435 		}
6436 		/*
6437 		 * Chase the pointers back to the beginning
6438 		 * of the memory allocation and then
6439 		 * get rid of the allocated freelist
6440 		 */
6441 		while (frag->itpf_freelist->itpfe_next != NULL)
6442 			frag->itpf_freelist = frag->itpf_freelist->itpfe_next;
6443 		/*
6444 		 * XXX - If we ever dynamically grow the freelist
6445 		 * then we'll have to free entries individually
6446 		 * or determine how many entries or chunks we have
6447 		 * grown since the initial allocation.
6448 		 */
6449 		kmem_free(frag->itpf_freelist,
6450 		    sizeof (ipsec_fragcache_entry_t) *
6451 		    IPSEC_FRAG_HASH_SIZE);
6452 		/* Free the fragcache structure */
6453 		kmem_free(frag->itpf_ptr,
6454 		    sizeof (ipsec_fragcache_entry_t *) *
6455 		    IPSEC_FRAG_HASH_SLOTS);
6456 	}
6457 	mutex_exit(&frag->itpf_lock);
6458 	mutex_destroy(&frag->itpf_lock);
6459 }
6460 
6461 /*
6462  * Add a fragment to the fragment cache.   Consumes mp if NULL is returned.
6463  * Returns mp if a whole fragment has been assembled, NULL otherwise
6464  */
6465 
6466 mblk_t *
6467 ipsec_fragcache_add(ipsec_fragcache_t *frag, mblk_t *ipsec_mp, mblk_t *mp,
6468     int outer_hdr_len, ipsec_stack_t *ipss)
6469 {
6470 	boolean_t is_v4;
6471 	time_t itpf_time;
6472 	ipha_t *iph;
6473 	ipha_t *oiph;
6474 	ip6_t *ip6h = NULL;
6475 	uint8_t v6_proto;
6476 	uint8_t *v6_proto_p;
6477 	uint16_t ip6_hdr_length;
6478 	ip6_pkt_t ipp;
6479 	ip6_frag_t *fraghdr;
6480 	ipsec_fragcache_entry_t *fep;
6481 	int i;
6482 	mblk_t *nmp, *prevmp;
6483 	int firstbyte, lastbyte;
6484 	int offset;
6485 	int last;
6486 	boolean_t inbound = (ipsec_mp != NULL);
6487 	mblk_t *first_mp = inbound ? ipsec_mp : mp;
6488 
6489 	ASSERT(first_mp == mp || first_mp->b_cont == mp);
6490 
6491 	/*
6492 	 * You're on the slow path, so insure that every packet in the
6493 	 * cache is a single-mblk one.
6494 	 */
6495 	if (mp->b_cont != NULL) {
6496 		nmp = msgpullup(mp, -1);
6497 		if (nmp == NULL) {
6498 			ip_drop_packet(first_mp, inbound, NULL, NULL,
6499 			    DROPPER(ipss, ipds_spd_nomem),
6500 			    &ipss->ipsec_spd_dropper);
6501 			return (NULL);
6502 		}
6503 		freemsg(mp);
6504 		if (ipsec_mp != NULL)
6505 			ipsec_mp->b_cont = nmp;
6506 		mp = nmp;
6507 	}
6508 
6509 	mutex_enter(&frag->itpf_lock);
6510 
6511 	oiph  = (ipha_t *)mp->b_rptr;
6512 	iph  = (ipha_t *)(mp->b_rptr + outer_hdr_len);
6513 
6514 	if (IPH_HDR_VERSION(iph) == IPV4_VERSION) {
6515 		is_v4 = B_TRUE;
6516 	} else {
6517 		ASSERT(IPH_HDR_VERSION(iph) == IPV6_VERSION);
6518 		ip6h = (ip6_t *)(mp->b_rptr + outer_hdr_len);
6519 
6520 		if (!ip_hdr_length_nexthdr_v6(mp, ip6h, &ip6_hdr_length,
6521 		    &v6_proto_p)) {
6522 			/*
6523 			 * Find upper layer protocol.
6524 			 * If it fails we have a malformed packet
6525 			 */
6526 			mutex_exit(&frag->itpf_lock);
6527 			ip_drop_packet(first_mp, inbound, NULL, NULL,
6528 			    DROPPER(ipss, ipds_spd_malformed_packet),
6529 			    &ipss->ipsec_spd_dropper);
6530 			return (NULL);
6531 		} else {
6532 			v6_proto = *v6_proto_p;
6533 		}
6534 
6535 
6536 		bzero(&ipp, sizeof (ipp));
6537 		(void) ip_find_hdr_v6(mp, ip6h, &ipp, NULL);
6538 		if (!(ipp.ipp_fields & IPPF_FRAGHDR)) {
6539 			/*
6540 			 * We think this is a fragment, but didn't find
6541 			 * a fragment header.  Something is wrong.
6542 			 */
6543 			mutex_exit(&frag->itpf_lock);
6544 			ip_drop_packet(first_mp, inbound, NULL, NULL,
6545 			    DROPPER(ipss, ipds_spd_malformed_frag),
6546 			    &ipss->ipsec_spd_dropper);
6547 			return (NULL);
6548 		}
6549 		fraghdr = ipp.ipp_fraghdr;
6550 		is_v4 = B_FALSE;
6551 	}
6552 
6553 	/* Anything to cleanup? */
6554 
6555 	/*
6556 	 * This cleanup call could be put in a timer loop
6557 	 * but it may actually be just as reasonable a decision to
6558 	 * leave it here.  The disadvantage is this only gets called when
6559 	 * frags are added.  The advantage is that it is not
6560 	 * susceptible to race conditions like a time-based cleanup
6561 	 * may be.
6562 	 */
6563 	itpf_time = gethrestime_sec();
6564 	if (itpf_time >= frag->itpf_expire_hint)
6565 		ipsec_fragcache_clean(frag);
6566 
6567 	/* Lookup to see if there is an existing entry */
6568 
6569 	if (is_v4)
6570 		i = IPSEC_FRAG_HASH_FUNC(iph->ipha_ident);
6571 	else
6572 		i = IPSEC_FRAG_HASH_FUNC(fraghdr->ip6f_ident);
6573 
6574 	for (fep = (frag->itpf_ptr)[i]; fep; fep = fep->itpfe_next) {
6575 		if (is_v4) {
6576 			ASSERT(iph != NULL);
6577 			if ((fep->itpfe_id == iph->ipha_ident) &&
6578 			    (fep->itpfe_src == iph->ipha_src) &&
6579 			    (fep->itpfe_dst == iph->ipha_dst) &&
6580 			    (fep->itpfe_proto == iph->ipha_protocol))
6581 				break;
6582 		} else {
6583 			ASSERT(fraghdr != NULL);
6584 			ASSERT(fep != NULL);
6585 			if ((fep->itpfe_id == fraghdr->ip6f_ident) &&
6586 			    IN6_ARE_ADDR_EQUAL(&fep->itpfe_src6,
6587 			    &ip6h->ip6_src) &&
6588 			    IN6_ARE_ADDR_EQUAL(&fep->itpfe_dst6,
6589 			    &ip6h->ip6_dst) && (fep->itpfe_proto == v6_proto))
6590 				break;
6591 		}
6592 	}
6593 
6594 	if (is_v4) {
6595 		firstbyte = V4_FRAG_OFFSET(iph);
6596 		lastbyte  = firstbyte + ntohs(iph->ipha_length) -
6597 		    IPH_HDR_LENGTH(iph);
6598 		last = (V4_MORE_FRAGS(iph) == 0);
6599 #ifdef FRAGCACHE_DEBUG
6600 		cmn_err(CE_WARN, "V4 fragcache: firstbyte = %d, lastbyte = %d, "
6601 		    "last = %d, id = %d\n", firstbyte, lastbyte, last,
6602 		    iph->ipha_ident);
6603 #endif
6604 	} else {
6605 		firstbyte = ntohs(fraghdr->ip6f_offlg & IP6F_OFF_MASK);
6606 		lastbyte  = firstbyte + ntohs(ip6h->ip6_plen) +
6607 		    sizeof (ip6_t) - ip6_hdr_length;
6608 		last = (fraghdr->ip6f_offlg & IP6F_MORE_FRAG) == 0;
6609 #ifdef FRAGCACHE_DEBUG
6610 		cmn_err(CE_WARN, "V6 fragcache: firstbyte = %d, lastbyte = %d, "
6611 		    "last = %d, id = %d, fraghdr = %p, mp = %p\n",
6612 		    firstbyte, lastbyte, last, fraghdr->ip6f_ident,
6613 		    fraghdr, mp);
6614 #endif
6615 	}
6616 
6617 	/* check for bogus fragments and delete the entry */
6618 	if (firstbyte > 0 && firstbyte <= 8) {
6619 		if (fep != NULL)
6620 			(void) fragcache_delentry(i, fep, frag);
6621 		mutex_exit(&frag->itpf_lock);
6622 		ip_drop_packet(first_mp, inbound, NULL, NULL,
6623 		    DROPPER(ipss, ipds_spd_malformed_frag),
6624 		    &ipss->ipsec_spd_dropper);
6625 		return (NULL);
6626 	}
6627 
6628 	/* Not found, allocate a new entry */
6629 	if (fep == NULL) {
6630 		if (frag->itpf_freelist == NULL) {
6631 			/* see if there is some space */
6632 			ipsec_fragcache_clean(frag);
6633 			if (frag->itpf_freelist == NULL) {
6634 				mutex_exit(&frag->itpf_lock);
6635 				ip_drop_packet(first_mp, inbound, NULL, NULL,
6636 				    DROPPER(ipss, ipds_spd_nomem),
6637 				    &ipss->ipsec_spd_dropper);
6638 				return (NULL);
6639 			}
6640 		}
6641 
6642 		fep = frag->itpf_freelist;
6643 		frag->itpf_freelist = fep->itpfe_next;
6644 
6645 		if (is_v4) {
6646 			bcopy((caddr_t)&iph->ipha_src, (caddr_t)&fep->itpfe_src,
6647 			    sizeof (struct in_addr));
6648 			bcopy((caddr_t)&iph->ipha_dst, (caddr_t)&fep->itpfe_dst,
6649 			    sizeof (struct in_addr));
6650 			fep->itpfe_id = iph->ipha_ident;
6651 			fep->itpfe_proto = iph->ipha_protocol;
6652 			i = IPSEC_FRAG_HASH_FUNC(fep->itpfe_id);
6653 		} else {
6654 			bcopy((in6_addr_t *)&ip6h->ip6_src,
6655 			    (in6_addr_t *)&fep->itpfe_src6,
6656 			    sizeof (struct in6_addr));
6657 			bcopy((in6_addr_t *)&ip6h->ip6_dst,
6658 			    (in6_addr_t *)&fep->itpfe_dst6,
6659 			    sizeof (struct in6_addr));
6660 			fep->itpfe_id = fraghdr->ip6f_ident;
6661 			fep->itpfe_proto = v6_proto;
6662 			i = IPSEC_FRAG_HASH_FUNC(fep->itpfe_id);
6663 		}
6664 		itpf_time = gethrestime_sec();
6665 		fep->itpfe_exp = itpf_time + IPSEC_FRAG_TTL_MAX + 1;
6666 		fep->itpfe_last = 0;
6667 		fep->itpfe_fraglist = NULL;
6668 		fep->itpfe_depth = 0;
6669 		fep->itpfe_next = (frag->itpf_ptr)[i];
6670 		(frag->itpf_ptr)[i] = fep;
6671 
6672 		if (frag->itpf_expire_hint > fep->itpfe_exp)
6673 			frag->itpf_expire_hint = fep->itpfe_exp;
6674 
6675 	}
6676 
6677 	/* Insert it in the frag list */
6678 	/* List is in order by starting offset of fragments */
6679 
6680 	prevmp = NULL;
6681 	for (nmp = fep->itpfe_fraglist; nmp; nmp = nmp->b_next) {
6682 		ipha_t *niph;
6683 		ipha_t *oniph;
6684 		ip6_t *nip6h;
6685 		ip6_pkt_t nipp;
6686 		ip6_frag_t *nfraghdr;
6687 		uint16_t nip6_hdr_length;
6688 		uint8_t *nv6_proto_p;
6689 		int nfirstbyte, nlastbyte;
6690 		char *data, *ndata;
6691 		mblk_t *ndata_mp = (inbound ? nmp->b_cont : nmp);
6692 		int hdr_len;
6693 
6694 		oniph  = (ipha_t *)mp->b_rptr;
6695 		nip6h = NULL;
6696 		niph = NULL;
6697 
6698 		/*
6699 		 * Determine outer header type and length and set
6700 		 * pointers appropriately
6701 		 */
6702 
6703 		if (IPH_HDR_VERSION(oniph) == IPV4_VERSION) {
6704 			hdr_len = ((outer_hdr_len != 0) ?
6705 			    IPH_HDR_LENGTH(oiph) : 0);
6706 			niph = (ipha_t *)(ndata_mp->b_rptr + hdr_len);
6707 		} else {
6708 			ASSERT(IPH_HDR_VERSION(oniph) == IPV6_VERSION);
6709 			ASSERT(ndata_mp->b_cont == NULL);
6710 			nip6h = (ip6_t *)ndata_mp->b_rptr;
6711 			(void) ip_hdr_length_nexthdr_v6(ndata_mp, nip6h,
6712 			    &nip6_hdr_length, &v6_proto_p);
6713 			hdr_len = ((outer_hdr_len != 0) ? nip6_hdr_length : 0);
6714 		}
6715 
6716 		/*
6717 		 * Determine inner header type and length and set
6718 		 * pointers appropriately
6719 		 */
6720 
6721 		if (is_v4) {
6722 			if (niph == NULL) {
6723 				/* Was v6 outer */
6724 				niph = (ipha_t *)(ndata_mp->b_rptr + hdr_len);
6725 			}
6726 			nfirstbyte = V4_FRAG_OFFSET(niph);
6727 			nlastbyte = nfirstbyte + ntohs(niph->ipha_length) -
6728 			    IPH_HDR_LENGTH(niph);
6729 		} else {
6730 			ASSERT(ndata_mp->b_cont == NULL);
6731 			nip6h = (ip6_t *)(ndata_mp->b_rptr + hdr_len);
6732 			if (!ip_hdr_length_nexthdr_v6(ndata_mp, nip6h,
6733 			    &nip6_hdr_length, &nv6_proto_p)) {
6734 				mutex_exit(&frag->itpf_lock);
6735 				ip_drop_packet_chain(nmp, inbound, NULL, NULL,
6736 				    DROPPER(ipss, ipds_spd_malformed_frag),
6737 				    &ipss->ipsec_spd_dropper);
6738 				ipsec_freemsg_chain(ndata_mp);
6739 				return (NULL);
6740 			}
6741 			bzero(&nipp, sizeof (nipp));
6742 			(void) ip_find_hdr_v6(ndata_mp, nip6h, &nipp, NULL);
6743 			nfraghdr = nipp.ipp_fraghdr;
6744 			nfirstbyte = ntohs(nfraghdr->ip6f_offlg &
6745 			    IP6F_OFF_MASK);
6746 			nlastbyte  = nfirstbyte + ntohs(nip6h->ip6_plen) +
6747 			    sizeof (ip6_t) - nip6_hdr_length;
6748 		}
6749 
6750 		/* Check for overlapping fragments */
6751 		if (firstbyte >= nfirstbyte && firstbyte < nlastbyte) {
6752 			/*
6753 			 * Overlap Check:
6754 			 *  ~~~~---------		# Check if the newly
6755 			 * ~	ndata_mp|		# received fragment
6756 			 *  ~~~~---------		# overlaps with the
6757 			 *	 ---------~~~~~~	# current fragment.
6758 			 *	|    mp		~
6759 			 *	 ---------~~~~~~
6760 			 */
6761 			if (is_v4) {
6762 				data  = (char *)iph  + IPH_HDR_LENGTH(iph) +
6763 				    firstbyte - nfirstbyte;
6764 				ndata = (char *)niph + IPH_HDR_LENGTH(niph);
6765 			} else {
6766 				data  = (char *)ip6h  +
6767 				    nip6_hdr_length + firstbyte -
6768 				    nfirstbyte;
6769 				ndata = (char *)nip6h + nip6_hdr_length;
6770 			}
6771 			if (bcmp(data, ndata, MIN(lastbyte, nlastbyte) -
6772 			    firstbyte)) {
6773 				/* Overlapping data does not match */
6774 				(void) fragcache_delentry(i, fep, frag);
6775 				mutex_exit(&frag->itpf_lock);
6776 				ip_drop_packet(first_mp, inbound, NULL, NULL,
6777 				    DROPPER(ipss, ipds_spd_overlap_frag),
6778 				    &ipss->ipsec_spd_dropper);
6779 				return (NULL);
6780 			}
6781 			/* Part of defense for jolt2.c fragmentation attack */
6782 			if (firstbyte >= nfirstbyte && lastbyte <= nlastbyte) {
6783 				/*
6784 				 * Check for identical or subset fragments:
6785 				 *  ----------	    ~~~~--------~~~~~
6786 				 * |    nmp   | or  ~	   nmp	    ~
6787 				 *  ----------	    ~~~~--------~~~~~
6788 				 *  ----------		  ------
6789 				 * |	mp    |		 |  mp  |
6790 				 *  ----------		  ------
6791 				 */
6792 				mutex_exit(&frag->itpf_lock);
6793 				ip_drop_packet(first_mp, inbound, NULL, NULL,
6794 				    DROPPER(ipss, ipds_spd_evil_frag),
6795 				    &ipss->ipsec_spd_dropper);
6796 				return (NULL);
6797 			}
6798 
6799 		}
6800 
6801 		/* Correct location for this fragment? */
6802 		if (firstbyte <= nfirstbyte) {
6803 			/*
6804 			 * Check if the tail end of the new fragment overlaps
6805 			 * with the head of the current fragment.
6806 			 *	  --------~~~~~~~
6807 			 *	 |    nmp	~
6808 			 *	  --------~~~~~~~
6809 			 *  ~~~~~--------
6810 			 *  ~	mp	 |
6811 			 *  ~~~~~--------
6812 			 */
6813 			if (lastbyte > nfirstbyte) {
6814 				/* Fragments overlap */
6815 				data  = (char *)iph  + IPH_HDR_LENGTH(iph) +
6816 				    firstbyte - nfirstbyte;
6817 				ndata = (char *)niph + IPH_HDR_LENGTH(niph);
6818 				if (is_v4) {
6819 					data  = (char *)iph +
6820 					    IPH_HDR_LENGTH(iph) + firstbyte -
6821 					    nfirstbyte;
6822 					ndata = (char *)niph +
6823 					    IPH_HDR_LENGTH(niph);
6824 				} else {
6825 					data  = (char *)ip6h  +
6826 					    nip6_hdr_length + firstbyte -
6827 					    nfirstbyte;
6828 					ndata = (char *)nip6h + nip6_hdr_length;
6829 				}
6830 				if (bcmp(data, ndata, MIN(lastbyte, nlastbyte)
6831 				    - nfirstbyte)) {
6832 					/* Overlap mismatch */
6833 					(void) fragcache_delentry(i, fep, frag);
6834 					mutex_exit(&frag->itpf_lock);
6835 					ip_drop_packet(first_mp, inbound, NULL,
6836 					    NULL, DROPPER(ipss,
6837 					    ipds_spd_overlap_frag),
6838 					    &ipss->ipsec_spd_dropper);
6839 					return (NULL);
6840 				}
6841 			}
6842 
6843 			/*
6844 			 * Fragment does not illegally overlap and can now
6845 			 * be inserted into the chain
6846 			 */
6847 			break;
6848 		}
6849 
6850 		prevmp = nmp;
6851 	}
6852 	first_mp->b_next = nmp;
6853 
6854 	if (prevmp == NULL) {
6855 		fep->itpfe_fraglist = first_mp;
6856 	} else {
6857 		prevmp->b_next = first_mp;
6858 	}
6859 	if (last)
6860 		fep->itpfe_last = 1;
6861 
6862 	/* Part of defense for jolt2.c fragmentation attack */
6863 	if (++(fep->itpfe_depth) > IPSEC_MAX_FRAGS) {
6864 		(void) fragcache_delentry(i, fep, frag);
6865 		mutex_exit(&frag->itpf_lock);
6866 		ip_drop_packet(first_mp, inbound, NULL, NULL,
6867 		    DROPPER(ipss, ipds_spd_max_frags),
6868 		    &ipss->ipsec_spd_dropper);
6869 		return (NULL);
6870 	}
6871 
6872 	/* Check for complete packet */
6873 
6874 	if (!fep->itpfe_last) {
6875 		mutex_exit(&frag->itpf_lock);
6876 #ifdef FRAGCACHE_DEBUG
6877 		cmn_err(CE_WARN, "Fragment cached, not last.\n");
6878 #endif
6879 		return (NULL);
6880 	}
6881 
6882 #ifdef FRAGCACHE_DEBUG
6883 	cmn_err(CE_WARN, "Last fragment cached.\n");
6884 	cmn_err(CE_WARN, "mp = %p, first_mp = %p.\n", mp, first_mp);
6885 #endif
6886 
6887 	offset = 0;
6888 	for (mp = fep->itpfe_fraglist; mp; mp = mp->b_next) {
6889 		mblk_t *data_mp = (inbound ? mp->b_cont : mp);
6890 		int hdr_len;
6891 
6892 		oiph  = (ipha_t *)data_mp->b_rptr;
6893 		ip6h = NULL;
6894 		iph = NULL;
6895 
6896 		if (IPH_HDR_VERSION(oiph) == IPV4_VERSION) {
6897 			hdr_len = ((outer_hdr_len != 0) ?
6898 			    IPH_HDR_LENGTH(oiph) : 0);
6899 			iph = (ipha_t *)(data_mp->b_rptr + hdr_len);
6900 		} else {
6901 			ASSERT(IPH_HDR_VERSION(oiph) == IPV6_VERSION);
6902 			ASSERT(data_mp->b_cont == NULL);
6903 			ip6h = (ip6_t *)data_mp->b_rptr;
6904 			(void) ip_hdr_length_nexthdr_v6(data_mp, ip6h,
6905 			    &ip6_hdr_length, &v6_proto_p);
6906 			hdr_len = ((outer_hdr_len != 0) ? ip6_hdr_length : 0);
6907 		}
6908 
6909 		/* Calculate current fragment start/end */
6910 		if (is_v4) {
6911 			if (iph == NULL) {
6912 				/* Was v6 outer */
6913 				iph = (ipha_t *)(data_mp->b_rptr + hdr_len);
6914 			}
6915 			firstbyte = V4_FRAG_OFFSET(iph);
6916 			lastbyte = firstbyte + ntohs(iph->ipha_length) -
6917 			    IPH_HDR_LENGTH(iph);
6918 		} else {
6919 			ASSERT(data_mp->b_cont == NULL);
6920 			ip6h = (ip6_t *)(data_mp->b_rptr + hdr_len);
6921 			if (!ip_hdr_length_nexthdr_v6(data_mp, ip6h,
6922 			    &ip6_hdr_length, &v6_proto_p)) {
6923 				mutex_exit(&frag->itpf_lock);
6924 				ip_drop_packet_chain(mp, inbound, NULL, NULL,
6925 				    DROPPER(ipss, ipds_spd_malformed_frag),
6926 				    &ipss->ipsec_spd_dropper);
6927 				return (NULL);
6928 			}
6929 			v6_proto = *v6_proto_p;
6930 			bzero(&ipp, sizeof (ipp));
6931 			(void) ip_find_hdr_v6(data_mp, ip6h, &ipp, NULL);
6932 			fraghdr = ipp.ipp_fraghdr;
6933 			firstbyte = ntohs(fraghdr->ip6f_offlg &
6934 			    IP6F_OFF_MASK);
6935 			lastbyte  = firstbyte + ntohs(ip6h->ip6_plen) +
6936 			    sizeof (ip6_t) - ip6_hdr_length;
6937 		}
6938 
6939 		/*
6940 		 * If this fragment is greater than current offset,
6941 		 * we have a missing fragment so return NULL
6942 		 */
6943 		if (firstbyte > offset) {
6944 			mutex_exit(&frag->itpf_lock);
6945 #ifdef FRAGCACHE_DEBUG
6946 			/*
6947 			 * Note, this can happen when the last frag
6948 			 * gets sent through because it is smaller
6949 			 * than the MTU.  It is not necessarily an
6950 			 * error condition.
6951 			 */
6952 			cmn_err(CE_WARN, "Frag greater than offset! : "
6953 			    "missing fragment: firstbyte = %d, offset = %d, "
6954 			    "mp = %p\n", firstbyte, offset, mp);
6955 #endif
6956 			return (NULL);
6957 		}
6958 
6959 		/*
6960 		 * If we are at the last fragment, we have the complete
6961 		 * packet, so rechain things and return it to caller
6962 		 * for processing
6963 		 */
6964 
6965 		if ((is_v4 && !V4_MORE_FRAGS(iph)) ||
6966 		    (!is_v4 && !(fraghdr->ip6f_offlg & IP6F_MORE_FRAG))) {
6967 			mp = fep->itpfe_fraglist;
6968 			fep->itpfe_fraglist = NULL;
6969 			(void) fragcache_delentry(i, fep, frag);
6970 			mutex_exit(&frag->itpf_lock);
6971 
6972 			if ((is_v4 && (firstbyte + ntohs(iph->ipha_length) >
6973 			    65535)) || (!is_v4 && (firstbyte +
6974 			    ntohs(ip6h->ip6_plen) > 65535))) {
6975 				/* It is an invalid "ping-o-death" packet */
6976 				/* Discard it */
6977 				ip_drop_packet_chain(mp, inbound, NULL, NULL,
6978 				    DROPPER(ipss, ipds_spd_evil_frag),
6979 				    &ipss->ipsec_spd_dropper);
6980 				return (NULL);
6981 			}
6982 #ifdef FRAGCACHE_DEBUG
6983 			cmn_err(CE_WARN, "Fragcache returning mp = %p, "
6984 			    "mp->b_next = %p", mp, mp->b_next);
6985 #endif
6986 			/*
6987 			 * For inbound case, mp has ipsec_in b_next'd chain
6988 			 * For outbound case, it is just data mp chain
6989 			 */
6990 			return (mp);
6991 		}
6992 
6993 		/*
6994 		 * Update new ending offset if this
6995 		 * fragment extends the packet
6996 		 */
6997 		if (offset < lastbyte)
6998 			offset = lastbyte;
6999 	}
7000 
7001 	mutex_exit(&frag->itpf_lock);
7002 
7003 	/* Didn't find last fragment, so return NULL */
7004 	return (NULL);
7005 }
7006 
7007 static void
7008 ipsec_fragcache_clean(ipsec_fragcache_t *frag)
7009 {
7010 	ipsec_fragcache_entry_t *fep;
7011 	int i;
7012 	ipsec_fragcache_entry_t *earlyfep = NULL;
7013 	time_t itpf_time;
7014 	int earlyexp;
7015 	int earlyi = 0;
7016 
7017 	ASSERT(MUTEX_HELD(&frag->itpf_lock));
7018 
7019 	itpf_time = gethrestime_sec();
7020 	earlyexp = itpf_time + 10000;
7021 
7022 	for (i = 0; i < IPSEC_FRAG_HASH_SLOTS; i++) {
7023 		fep = (frag->itpf_ptr)[i];
7024 		while (fep) {
7025 			if (fep->itpfe_exp < itpf_time) {
7026 				/* found */
7027 				fep = fragcache_delentry(i, fep, frag);
7028 			} else {
7029 				if (fep->itpfe_exp < earlyexp) {
7030 					earlyfep = fep;
7031 					earlyexp = fep->itpfe_exp;
7032 					earlyi = i;
7033 				}
7034 				fep = fep->itpfe_next;
7035 			}
7036 		}
7037 	}
7038 
7039 	frag->itpf_expire_hint = earlyexp;
7040 
7041 	/* if (!found) */
7042 	if (frag->itpf_freelist == NULL)
7043 		(void) fragcache_delentry(earlyi, earlyfep, frag);
7044 }
7045 
7046 static ipsec_fragcache_entry_t *
7047 fragcache_delentry(int slot, ipsec_fragcache_entry_t *fep,
7048     ipsec_fragcache_t *frag)
7049 {
7050 	ipsec_fragcache_entry_t *targp;
7051 	ipsec_fragcache_entry_t *nextp = fep->itpfe_next;
7052 
7053 	ASSERT(MUTEX_HELD(&frag->itpf_lock));
7054 
7055 	/* Free up any fragment list still in cache entry */
7056 	ipsec_freemsg_chain(fep->itpfe_fraglist);
7057 
7058 	targp = (frag->itpf_ptr)[slot];
7059 	ASSERT(targp != 0);
7060 
7061 	if (targp == fep) {
7062 		/* unlink from head of hash chain */
7063 		(frag->itpf_ptr)[slot] = nextp;
7064 		/* link into free list */
7065 		fep->itpfe_next = frag->itpf_freelist;
7066 		frag->itpf_freelist = fep;
7067 		return (nextp);
7068 	}
7069 
7070 	/* maybe should use double linked list to make update faster */
7071 	/* must be past front of chain */
7072 	while (targp) {
7073 		if (targp->itpfe_next == fep) {
7074 			/* unlink from hash chain */
7075 			targp->itpfe_next = nextp;
7076 			/* link into free list */
7077 			fep->itpfe_next = frag->itpf_freelist;
7078 			frag->itpf_freelist = fep;
7079 			return (nextp);
7080 		}
7081 		targp = targp->itpfe_next;
7082 		ASSERT(targp != 0);
7083 	}
7084 	/* NOTREACHED */
7085 	return (NULL);
7086 }
7087