1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved. 23 */ 24 25 /* 26 * iptun - IP Tunneling Driver 27 * 28 * This module is a GLDv3 driver that implements virtual datalinks over IP 29 * (a.k.a, IP tunneling). The datalinks are managed through a dld ioctl 30 * interface (see iptun_ctl.c), and registered with GLDv3 using 31 * mac_register(). It implements the logic for various forms of IP (IPv4 or 32 * IPv6) encapsulation within IP (IPv4 or IPv6) by interacting with the ip 33 * module below it. Each virtual IP tunnel datalink has a conn_t associated 34 * with it representing the "outer" IP connection. 35 * 36 * The module implements the following locking semantics: 37 * 38 * Lookups and deletions in iptun_hash are synchronized using iptun_hash_lock. 39 * See comments above iptun_hash_lock for details. 40 * 41 * No locks are ever held while calling up to GLDv3. The general architecture 42 * of GLDv3 requires this, as the mac perimeter (essentially a lock) for a 43 * given link will be held while making downcalls (iptun_m_*() callbacks). 44 * Because we need to hold locks while handling downcalls, holding these locks 45 * while issuing upcalls results in deadlock scenarios. See the block comment 46 * above iptun_task_cb() for details on how we safely issue upcalls without 47 * holding any locks. 48 * 49 * The contents of each iptun_t is protected by an iptun_mutex which is held 50 * in iptun_enter() (called by iptun_enter_by_linkid()), and exited in 51 * iptun_exit(). 52 * 53 * See comments in iptun_delete() and iptun_free() for details on how the 54 * iptun_t is deleted safely. 55 */ 56 57 #include <sys/types.h> 58 #include <sys/kmem.h> 59 #include <sys/errno.h> 60 #include <sys/modhash.h> 61 #include <sys/list.h> 62 #include <sys/strsun.h> 63 #include <sys/file.h> 64 #include <sys/systm.h> 65 #include <sys/tihdr.h> 66 #include <sys/param.h> 67 #include <sys/mac_provider.h> 68 #include <sys/mac_ipv4.h> 69 #include <sys/mac_ipv6.h> 70 #include <sys/mac_6to4.h> 71 #include <sys/tsol/tnet.h> 72 #include <sys/sunldi.h> 73 #include <netinet/in.h> 74 #include <netinet/ip6.h> 75 #include <inet/ip.h> 76 #include <inet/ip_ire.h> 77 #include <inet/ipsec_impl.h> 78 #include <sys/tsol/label.h> 79 #include <sys/tsol/tnet.h> 80 #include <inet/iptun.h> 81 #include "iptun_impl.h" 82 83 /* Do the tunnel type and address family match? */ 84 #define IPTUN_ADDR_MATCH(iptun_type, family) \ 85 ((iptun_type == IPTUN_TYPE_IPV4 && family == AF_INET) || \ 86 (iptun_type == IPTUN_TYPE_IPV6 && family == AF_INET6) || \ 87 (iptun_type == IPTUN_TYPE_6TO4 && family == AF_INET)) 88 89 #define IPTUN_HASH_KEY(key) ((mod_hash_key_t)(uintptr_t)(key)) 90 91 #define IPTUN_MIN_IPV4_MTU 576 /* ip.h still uses 68 (!) */ 92 #define IPTUN_MIN_IPV6_MTU IPV6_MIN_MTU 93 #define IPTUN_MAX_IPV4_MTU (IP_MAXPACKET - sizeof (ipha_t)) 94 #define IPTUN_MAX_IPV6_MTU (IP_MAXPACKET - sizeof (ip6_t) - \ 95 sizeof (iptun_encaplim_t)) 96 97 #define IPTUN_MIN_HOPLIMIT 1 98 #define IPTUN_MAX_HOPLIMIT UINT8_MAX 99 100 #define IPTUN_MIN_ENCAPLIMIT 0 101 #define IPTUN_MAX_ENCAPLIMIT UINT8_MAX 102 103 #define IPTUN_IPSEC_REQ_MASK (IPSEC_PREF_REQUIRED | IPSEC_PREF_NEVER) 104 105 static iptun_encaplim_t iptun_encaplim_init = { 106 { IPPROTO_NONE, 0 }, 107 IP6OPT_TUNNEL_LIMIT, 108 1, 109 IPTUN_DEFAULT_ENCAPLIMIT, /* filled in with actual value later */ 110 IP6OPT_PADN, 111 1, 112 0 113 }; 114 115 /* 116 * Table containing per-iptun-type information. 117 * Since IPv6 can run over all of these we have the IPv6 min as the min MTU. 118 */ 119 static iptun_typeinfo_t iptun_type_table[] = { 120 { IPTUN_TYPE_IPV4, MAC_PLUGIN_IDENT_IPV4, IPV4_VERSION, 121 IPTUN_MIN_IPV6_MTU, IPTUN_MAX_IPV4_MTU, B_TRUE }, 122 { IPTUN_TYPE_IPV6, MAC_PLUGIN_IDENT_IPV6, IPV6_VERSION, 123 IPTUN_MIN_IPV6_MTU, IPTUN_MAX_IPV6_MTU, B_TRUE }, 124 { IPTUN_TYPE_6TO4, MAC_PLUGIN_IDENT_6TO4, IPV4_VERSION, 125 IPTUN_MIN_IPV6_MTU, IPTUN_MAX_IPV4_MTU, B_FALSE }, 126 { IPTUN_TYPE_UNKNOWN, NULL, 0, 0, 0, B_FALSE } 127 }; 128 129 /* 130 * iptun_hash is an iptun_t lookup table by link ID protected by 131 * iptun_hash_lock. While the hash table's integrity is maintained via 132 * internal locking in the mod_hash_*() functions, we need additional locking 133 * so that an iptun_t cannot be deleted after a hash lookup has returned an 134 * iptun_t and before iptun_lock has been entered. As such, we use 135 * iptun_hash_lock when doing lookups and removals from iptun_hash. 136 */ 137 mod_hash_t *iptun_hash; 138 static kmutex_t iptun_hash_lock; 139 140 static uint_t iptun_tunnelcount; /* total for all stacks */ 141 kmem_cache_t *iptun_cache; 142 ddi_taskq_t *iptun_taskq; 143 144 typedef enum { 145 IPTUN_TASK_MTU_UPDATE, /* tell mac about new tunnel link MTU */ 146 IPTUN_TASK_LADDR_UPDATE, /* tell mac about new local address */ 147 IPTUN_TASK_RADDR_UPDATE, /* tell mac about new remote address */ 148 IPTUN_TASK_LINK_UPDATE, /* tell mac about new link state */ 149 IPTUN_TASK_PDATA_UPDATE /* tell mac about updated plugin data */ 150 } iptun_task_t; 151 152 typedef struct iptun_task_data_s { 153 iptun_task_t itd_task; 154 datalink_id_t itd_linkid; 155 } iptun_task_data_t; 156 157 static void iptun_task_dispatch(iptun_t *, iptun_task_t); 158 static int iptun_enter(iptun_t *); 159 static void iptun_exit(iptun_t *); 160 static void iptun_headergen(iptun_t *, boolean_t); 161 static void iptun_drop_pkt(mblk_t *, uint64_t *); 162 static void iptun_input(void *, mblk_t *, void *, ip_recv_attr_t *); 163 static void iptun_input_icmp(void *, mblk_t *, void *, ip_recv_attr_t *); 164 static void iptun_output(iptun_t *, mblk_t *); 165 static uint32_t iptun_get_maxmtu(iptun_t *, ip_xmit_attr_t *, uint32_t); 166 static uint32_t iptun_update_mtu(iptun_t *, ip_xmit_attr_t *, uint32_t); 167 static uint32_t iptun_get_dst_pmtu(iptun_t *, ip_xmit_attr_t *); 168 static void iptun_update_dst_pmtu(iptun_t *, ip_xmit_attr_t *); 169 static int iptun_setladdr(iptun_t *, const struct sockaddr_storage *); 170 171 static void iptun_output_6to4(iptun_t *, mblk_t *); 172 static void iptun_output_common(iptun_t *, ip_xmit_attr_t *, mblk_t *); 173 static boolean_t iptun_verifyicmp(conn_t *, void *, icmph_t *, icmp6_t *, 174 ip_recv_attr_t *); 175 176 static void iptun_notify(void *, ip_xmit_attr_t *, ixa_notify_type_t, 177 ixa_notify_arg_t); 178 179 static mac_callbacks_t iptun_m_callbacks; 180 181 static int 182 iptun_m_getstat(void *arg, uint_t stat, uint64_t *val) 183 { 184 iptun_t *iptun = arg; 185 int err = 0; 186 187 switch (stat) { 188 case MAC_STAT_IERRORS: 189 *val = iptun->iptun_ierrors; 190 break; 191 case MAC_STAT_OERRORS: 192 *val = iptun->iptun_oerrors; 193 break; 194 case MAC_STAT_RBYTES: 195 *val = iptun->iptun_rbytes; 196 break; 197 case MAC_STAT_IPACKETS: 198 *val = iptun->iptun_ipackets; 199 break; 200 case MAC_STAT_OBYTES: 201 *val = iptun->iptun_obytes; 202 break; 203 case MAC_STAT_OPACKETS: 204 *val = iptun->iptun_opackets; 205 break; 206 case MAC_STAT_NORCVBUF: 207 *val = iptun->iptun_norcvbuf; 208 break; 209 case MAC_STAT_NOXMTBUF: 210 *val = iptun->iptun_noxmtbuf; 211 break; 212 default: 213 err = ENOTSUP; 214 } 215 216 return (err); 217 } 218 219 static int 220 iptun_m_start(void *arg) 221 { 222 iptun_t *iptun = arg; 223 int err; 224 225 if ((err = iptun_enter(iptun)) == 0) { 226 iptun->iptun_flags |= IPTUN_MAC_STARTED; 227 iptun_task_dispatch(iptun, IPTUN_TASK_LINK_UPDATE); 228 iptun_exit(iptun); 229 } 230 return (err); 231 } 232 233 static void 234 iptun_m_stop(void *arg) 235 { 236 iptun_t *iptun = arg; 237 238 if (iptun_enter(iptun) == 0) { 239 iptun->iptun_flags &= ~IPTUN_MAC_STARTED; 240 iptun_task_dispatch(iptun, IPTUN_TASK_LINK_UPDATE); 241 iptun_exit(iptun); 242 } 243 } 244 245 /* 246 * iptun_m_setpromisc() does nothing and always succeeds. This is because a 247 * tunnel data-link only ever receives packets that are destined exclusively 248 * for the local address of the tunnel. 249 */ 250 /* ARGSUSED */ 251 static int 252 iptun_m_setpromisc(void *arg, boolean_t on) 253 { 254 return (0); 255 } 256 257 /* ARGSUSED */ 258 static int 259 iptun_m_multicst(void *arg, boolean_t add, const uint8_t *addrp) 260 { 261 return (ENOTSUP); 262 } 263 264 /* 265 * iptun_m_unicst() sets the local address. 266 */ 267 /* ARGSUSED */ 268 static int 269 iptun_m_unicst(void *arg, const uint8_t *addrp) 270 { 271 iptun_t *iptun = arg; 272 int err; 273 struct sockaddr_storage ss; 274 struct sockaddr_in *sin; 275 struct sockaddr_in6 *sin6; 276 277 if ((err = iptun_enter(iptun)) == 0) { 278 switch (iptun->iptun_typeinfo->iti_ipvers) { 279 case IPV4_VERSION: 280 sin = (struct sockaddr_in *)&ss; 281 sin->sin_family = AF_INET; 282 bcopy(addrp, &sin->sin_addr, sizeof (in_addr_t)); 283 break; 284 case IPV6_VERSION: 285 sin6 = (struct sockaddr_in6 *)&ss; 286 sin6->sin6_family = AF_INET6; 287 bcopy(addrp, &sin6->sin6_addr, sizeof (in6_addr_t)); 288 break; 289 default: 290 ASSERT(0); 291 } 292 err = iptun_setladdr(iptun, &ss); 293 iptun_exit(iptun); 294 } 295 return (err); 296 } 297 298 static mblk_t * 299 iptun_m_tx(void *arg, mblk_t *mpchain) 300 { 301 mblk_t *mp, *nmp; 302 iptun_t *iptun = arg; 303 304 if (!IS_IPTUN_RUNNING(iptun)) { 305 iptun_drop_pkt(mpchain, &iptun->iptun_noxmtbuf); 306 return (NULL); 307 } 308 309 for (mp = mpchain; mp != NULL; mp = nmp) { 310 nmp = mp->b_next; 311 mp->b_next = NULL; 312 iptun_output(iptun, mp); 313 } 314 315 return (NULL); 316 } 317 318 /* ARGSUSED */ 319 static int 320 iptun_m_setprop(void *barg, const char *pr_name, mac_prop_id_t pr_num, 321 uint_t pr_valsize, const void *pr_val) 322 { 323 iptun_t *iptun = barg; 324 uint32_t value = *(uint32_t *)pr_val; 325 int err; 326 327 /* 328 * We need to enter this iptun_t since we'll be modifying the outer 329 * header. 330 */ 331 if ((err = iptun_enter(iptun)) != 0) 332 return (err); 333 334 switch (pr_num) { 335 case MAC_PROP_IPTUN_HOPLIMIT: 336 if (value < IPTUN_MIN_HOPLIMIT || value > IPTUN_MAX_HOPLIMIT) { 337 err = EINVAL; 338 break; 339 } 340 if (value != iptun->iptun_hoplimit) { 341 iptun->iptun_hoplimit = (uint8_t)value; 342 iptun_headergen(iptun, B_TRUE); 343 } 344 break; 345 case MAC_PROP_IPTUN_ENCAPLIMIT: 346 if (iptun->iptun_typeinfo->iti_type != IPTUN_TYPE_IPV6 || 347 value > IPTUN_MAX_ENCAPLIMIT) { 348 err = EINVAL; 349 break; 350 } 351 if (value != iptun->iptun_encaplimit) { 352 iptun->iptun_encaplimit = (uint8_t)value; 353 iptun_headergen(iptun, B_TRUE); 354 } 355 break; 356 case MAC_PROP_MTU: { 357 uint32_t maxmtu = iptun_get_maxmtu(iptun, NULL, 0); 358 359 if (value < iptun->iptun_typeinfo->iti_minmtu || 360 value > maxmtu) { 361 err = EINVAL; 362 break; 363 } 364 iptun->iptun_flags |= IPTUN_FIXED_MTU; 365 if (value != iptun->iptun_mtu) { 366 iptun->iptun_mtu = value; 367 iptun_task_dispatch(iptun, IPTUN_TASK_MTU_UPDATE); 368 } 369 break; 370 } 371 default: 372 err = EINVAL; 373 } 374 iptun_exit(iptun); 375 return (err); 376 } 377 378 /* ARGSUSED */ 379 static int 380 iptun_m_getprop(void *barg, const char *pr_name, mac_prop_id_t pr_num, 381 uint_t pr_valsize, void *pr_val) 382 { 383 iptun_t *iptun = barg; 384 int err; 385 386 if ((err = iptun_enter(iptun)) != 0) 387 return (err); 388 389 switch (pr_num) { 390 case MAC_PROP_IPTUN_HOPLIMIT: 391 ASSERT(pr_valsize >= sizeof (uint32_t)); 392 *(uint32_t *)pr_val = iptun->iptun_hoplimit; 393 break; 394 395 case MAC_PROP_IPTUN_ENCAPLIMIT: 396 *(uint32_t *)pr_val = iptun->iptun_encaplimit; 397 break; 398 default: 399 err = ENOTSUP; 400 } 401 done: 402 iptun_exit(iptun); 403 return (err); 404 } 405 406 /* ARGSUSED */ 407 static void 408 iptun_m_propinfo(void *barg, const char *pr_name, mac_prop_id_t pr_num, 409 mac_prop_info_handle_t prh) 410 { 411 iptun_t *iptun = barg; 412 413 switch (pr_num) { 414 case MAC_PROP_IPTUN_HOPLIMIT: 415 mac_prop_info_set_range_uint32(prh, 416 IPTUN_MIN_HOPLIMIT, IPTUN_MAX_HOPLIMIT); 417 mac_prop_info_set_default_uint32(prh, IPTUN_DEFAULT_HOPLIMIT); 418 break; 419 420 case MAC_PROP_IPTUN_ENCAPLIMIT: 421 if (iptun->iptun_typeinfo->iti_type != IPTUN_TYPE_IPV6) 422 break; 423 mac_prop_info_set_range_uint32(prh, 424 IPTUN_MIN_ENCAPLIMIT, IPTUN_MAX_ENCAPLIMIT); 425 mac_prop_info_set_default_uint32(prh, IPTUN_DEFAULT_ENCAPLIMIT); 426 break; 427 case MAC_PROP_MTU: 428 mac_prop_info_set_range_uint32(prh, 429 iptun->iptun_typeinfo->iti_minmtu, 430 iptun_get_maxmtu(iptun, NULL, 0)); 431 break; 432 } 433 } 434 435 uint_t 436 iptun_count(void) 437 { 438 return (iptun_tunnelcount); 439 } 440 441 /* 442 * Enter an iptun_t exclusively. This is essentially just a mutex, but we 443 * don't allow iptun_enter() to succeed on a tunnel if it's in the process of 444 * being deleted. 445 */ 446 static int 447 iptun_enter(iptun_t *iptun) 448 { 449 mutex_enter(&iptun->iptun_lock); 450 while (iptun->iptun_flags & IPTUN_DELETE_PENDING) 451 cv_wait(&iptun->iptun_enter_cv, &iptun->iptun_lock); 452 if (iptun->iptun_flags & IPTUN_CONDEMNED) { 453 mutex_exit(&iptun->iptun_lock); 454 return (ENOENT); 455 } 456 return (0); 457 } 458 459 /* 460 * Exit the tunnel entered in iptun_enter(). 461 */ 462 static void 463 iptun_exit(iptun_t *iptun) 464 { 465 mutex_exit(&iptun->iptun_lock); 466 } 467 468 /* 469 * Enter the IP tunnel instance by datalink ID. 470 */ 471 static int 472 iptun_enter_by_linkid(datalink_id_t linkid, iptun_t **iptun) 473 { 474 int err; 475 476 mutex_enter(&iptun_hash_lock); 477 if (mod_hash_find(iptun_hash, IPTUN_HASH_KEY(linkid), 478 (mod_hash_val_t *)iptun) == 0) 479 err = iptun_enter(*iptun); 480 else 481 err = ENOENT; 482 if (err != 0) 483 *iptun = NULL; 484 mutex_exit(&iptun_hash_lock); 485 return (err); 486 } 487 488 /* 489 * Handle tasks that were deferred through the iptun_taskq because they require 490 * calling up to the mac module, and we can't call up to the mac module while 491 * holding locks. 492 * 493 * This is tricky to get right without introducing race conditions and 494 * deadlocks with the mac module, as we cannot issue an upcall while in the 495 * iptun_t. The reason is that upcalls may try and enter the mac perimeter, 496 * while iptun callbacks (such as iptun_m_setprop()) called from the mac 497 * module will already have the perimeter held, and will then try and enter 498 * the iptun_t. You can see the lock ordering problem with this; this will 499 * deadlock. 500 * 501 * The safe way to do this is to enter the iptun_t in question and copy the 502 * information we need out of it so that we can exit it and know that the 503 * information being passed up to the upcalls won't be subject to modification 504 * by other threads. The problem now is that we need to exit it prior to 505 * issuing the upcall, but once we do this, a thread could come along and 506 * delete the iptun_t and thus the mac handle required to issue the upcall. 507 * To prevent this, we set the IPTUN_UPCALL_PENDING flag prior to exiting the 508 * iptun_t. This flag is the condition associated with iptun_upcall_cv, which 509 * iptun_delete() will cv_wait() on. When the upcall completes, we clear 510 * IPTUN_UPCALL_PENDING and cv_signal() any potentially waiting 511 * iptun_delete(). We can thus still safely use iptun->iptun_mh after having 512 * exited the iptun_t. 513 */ 514 static void 515 iptun_task_cb(void *arg) 516 { 517 iptun_task_data_t *itd = arg; 518 iptun_task_t task = itd->itd_task; 519 datalink_id_t linkid = itd->itd_linkid; 520 iptun_t *iptun; 521 uint32_t mtu; 522 iptun_addr_t addr; 523 link_state_t linkstate; 524 size_t header_size; 525 iptun_header_t header; 526 527 kmem_free(itd, sizeof (*itd)); 528 529 /* 530 * Note that if the lookup fails, it's because the tunnel was deleted 531 * between the time the task was dispatched and now. That isn't an 532 * error. 533 */ 534 if (iptun_enter_by_linkid(linkid, &iptun) != 0) 535 return; 536 537 iptun->iptun_flags |= IPTUN_UPCALL_PENDING; 538 539 switch (task) { 540 case IPTUN_TASK_MTU_UPDATE: 541 mtu = iptun->iptun_mtu; 542 break; 543 case IPTUN_TASK_LADDR_UPDATE: 544 addr = iptun->iptun_laddr; 545 break; 546 case IPTUN_TASK_RADDR_UPDATE: 547 addr = iptun->iptun_raddr; 548 break; 549 case IPTUN_TASK_LINK_UPDATE: 550 linkstate = IS_IPTUN_RUNNING(iptun) ? 551 LINK_STATE_UP : LINK_STATE_DOWN; 552 break; 553 case IPTUN_TASK_PDATA_UPDATE: 554 header_size = iptun->iptun_header_size; 555 header = iptun->iptun_header; 556 break; 557 default: 558 ASSERT(0); 559 } 560 561 iptun_exit(iptun); 562 563 switch (task) { 564 case IPTUN_TASK_MTU_UPDATE: 565 (void) mac_maxsdu_update(iptun->iptun_mh, mtu); 566 break; 567 case IPTUN_TASK_LADDR_UPDATE: 568 mac_unicst_update(iptun->iptun_mh, (uint8_t *)&addr.ia_addr); 569 break; 570 case IPTUN_TASK_RADDR_UPDATE: 571 mac_dst_update(iptun->iptun_mh, (uint8_t *)&addr.ia_addr); 572 break; 573 case IPTUN_TASK_LINK_UPDATE: 574 mac_link_update(iptun->iptun_mh, linkstate); 575 break; 576 case IPTUN_TASK_PDATA_UPDATE: 577 if (mac_pdata_update(iptun->iptun_mh, 578 header_size == 0 ? NULL : &header, header_size) != 0) 579 atomic_inc_64(&iptun->iptun_taskq_fail); 580 break; 581 } 582 583 mutex_enter(&iptun->iptun_lock); 584 iptun->iptun_flags &= ~IPTUN_UPCALL_PENDING; 585 cv_signal(&iptun->iptun_upcall_cv); 586 mutex_exit(&iptun->iptun_lock); 587 } 588 589 static void 590 iptun_task_dispatch(iptun_t *iptun, iptun_task_t iptun_task) 591 { 592 iptun_task_data_t *itd; 593 594 itd = kmem_alloc(sizeof (*itd), KM_NOSLEEP); 595 if (itd == NULL) { 596 atomic_inc_64(&iptun->iptun_taskq_fail); 597 return; 598 } 599 itd->itd_task = iptun_task; 600 itd->itd_linkid = iptun->iptun_linkid; 601 if (ddi_taskq_dispatch(iptun_taskq, iptun_task_cb, itd, DDI_NOSLEEP)) { 602 atomic_inc_64(&iptun->iptun_taskq_fail); 603 kmem_free(itd, sizeof (*itd)); 604 } 605 } 606 607 /* 608 * Convert an iptun_addr_t to sockaddr_storage. 609 */ 610 static void 611 iptun_getaddr(iptun_addr_t *iptun_addr, struct sockaddr_storage *ss) 612 { 613 struct sockaddr_in *sin; 614 struct sockaddr_in6 *sin6; 615 616 bzero(ss, sizeof (*ss)); 617 switch (iptun_addr->ia_family) { 618 case AF_INET: 619 sin = (struct sockaddr_in *)ss; 620 sin->sin_addr.s_addr = iptun_addr->ia_addr.iau_addr4; 621 break; 622 case AF_INET6: 623 sin6 = (struct sockaddr_in6 *)ss; 624 sin6->sin6_addr = iptun_addr->ia_addr.iau_addr6; 625 break; 626 default: 627 ASSERT(0); 628 } 629 ss->ss_family = iptun_addr->ia_family; 630 } 631 632 /* 633 * General purpose function to set an IP tunnel source or destination address. 634 */ 635 static int 636 iptun_setaddr(iptun_type_t iptun_type, iptun_addr_t *iptun_addr, 637 const struct sockaddr_storage *ss) 638 { 639 if (!IPTUN_ADDR_MATCH(iptun_type, ss->ss_family)) 640 return (EINVAL); 641 642 switch (ss->ss_family) { 643 case AF_INET: { 644 struct sockaddr_in *sin = (struct sockaddr_in *)ss; 645 646 if ((sin->sin_addr.s_addr == INADDR_ANY) || 647 (sin->sin_addr.s_addr == INADDR_BROADCAST) || 648 CLASSD(sin->sin_addr.s_addr)) { 649 return (EADDRNOTAVAIL); 650 } 651 iptun_addr->ia_addr.iau_addr4 = sin->sin_addr.s_addr; 652 break; 653 } 654 case AF_INET6: { 655 struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)ss; 656 657 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr) || 658 IN6_IS_ADDR_MULTICAST(&sin6->sin6_addr) || 659 IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) { 660 return (EADDRNOTAVAIL); 661 } 662 iptun_addr->ia_addr.iau_addr6 = sin6->sin6_addr; 663 break; 664 } 665 default: 666 return (EAFNOSUPPORT); 667 } 668 iptun_addr->ia_family = ss->ss_family; 669 return (0); 670 } 671 672 static int 673 iptun_setladdr(iptun_t *iptun, const struct sockaddr_storage *laddr) 674 { 675 return (iptun_setaddr(iptun->iptun_typeinfo->iti_type, 676 &iptun->iptun_laddr, laddr)); 677 } 678 679 static int 680 iptun_setraddr(iptun_t *iptun, const struct sockaddr_storage *raddr) 681 { 682 if (!(iptun->iptun_typeinfo->iti_hasraddr)) 683 return (EINVAL); 684 return (iptun_setaddr(iptun->iptun_typeinfo->iti_type, 685 &iptun->iptun_raddr, raddr)); 686 } 687 688 static boolean_t 689 iptun_canbind(iptun_t *iptun) 690 { 691 /* 692 * A tunnel may bind when its source address has been set, and if its 693 * tunnel type requires one, also its destination address. 694 */ 695 return ((iptun->iptun_flags & IPTUN_LADDR) && 696 ((iptun->iptun_flags & IPTUN_RADDR) || 697 !(iptun->iptun_typeinfo->iti_hasraddr))); 698 } 699 700 /* 701 * Verify that the local address is valid, and insert in the fanout 702 */ 703 static int 704 iptun_bind(iptun_t *iptun) 705 { 706 conn_t *connp = iptun->iptun_connp; 707 int error = 0; 708 ip_xmit_attr_t *ixa; 709 ip_xmit_attr_t *oldixa; 710 iulp_t uinfo; 711 ip_stack_t *ipst = connp->conn_netstack->netstack_ip; 712 713 /* 714 * Get an exclusive ixa for this thread. 715 * We defer updating conn_ixa until later to handle any concurrent 716 * conn_ixa_cleanup thread. 717 */ 718 ixa = conn_get_ixa(connp, B_FALSE); 719 if (ixa == NULL) 720 return (ENOMEM); 721 722 /* We create PMTU state including for 6to4 */ 723 ixa->ixa_flags |= IXAF_PMTU_DISCOVERY; 724 725 ASSERT(iptun_canbind(iptun)); 726 727 mutex_enter(&connp->conn_lock); 728 /* 729 * Note that conn_proto can't be set since the upper protocol 730 * can be both 41 and 4 when IPv6 and IPv4 are over the same tunnel. 731 * ipcl_iptun_classify doesn't use conn_proto. 732 */ 733 connp->conn_ipversion = iptun->iptun_typeinfo->iti_ipvers; 734 735 switch (iptun->iptun_typeinfo->iti_type) { 736 case IPTUN_TYPE_IPV4: 737 IN6_IPADDR_TO_V4MAPPED(iptun->iptun_laddr4, 738 &connp->conn_laddr_v6); 739 IN6_IPADDR_TO_V4MAPPED(iptun->iptun_raddr4, 740 &connp->conn_faddr_v6); 741 ixa->ixa_flags |= IXAF_IS_IPV4; 742 if (ip_laddr_verify_v4(iptun->iptun_laddr4, IPCL_ZONEID(connp), 743 ipst, B_FALSE) != IPVL_UNICAST_UP) { 744 mutex_exit(&connp->conn_lock); 745 error = EADDRNOTAVAIL; 746 goto done; 747 } 748 break; 749 case IPTUN_TYPE_IPV6: 750 connp->conn_laddr_v6 = iptun->iptun_laddr6; 751 connp->conn_faddr_v6 = iptun->iptun_raddr6; 752 ixa->ixa_flags &= ~IXAF_IS_IPV4; 753 /* We use a zero scopeid for now */ 754 if (ip_laddr_verify_v6(&iptun->iptun_laddr6, IPCL_ZONEID(connp), 755 ipst, B_FALSE, 0) != IPVL_UNICAST_UP) { 756 mutex_exit(&connp->conn_lock); 757 error = EADDRNOTAVAIL; 758 goto done; 759 } 760 break; 761 case IPTUN_TYPE_6TO4: 762 IN6_IPADDR_TO_V4MAPPED(iptun->iptun_laddr4, 763 &connp->conn_laddr_v6); 764 IN6_IPADDR_TO_V4MAPPED(INADDR_ANY, &connp->conn_faddr_v6); 765 ixa->ixa_flags |= IXAF_IS_IPV4; 766 mutex_exit(&connp->conn_lock); 767 768 switch (ip_laddr_verify_v4(iptun->iptun_laddr4, 769 IPCL_ZONEID(connp), ipst, B_FALSE)) { 770 case IPVL_UNICAST_UP: 771 case IPVL_UNICAST_DOWN: 772 break; 773 default: 774 error = EADDRNOTAVAIL; 775 goto done; 776 } 777 goto insert; 778 } 779 780 /* In case previous destination was multirt */ 781 ip_attr_newdst(ixa); 782 783 /* 784 * When we set a tunnel's destination address, we do not 785 * care if the destination is reachable. Transient routing 786 * issues should not inhibit the creation of a tunnel 787 * interface, for example. Thus we pass B_FALSE here. 788 */ 789 connp->conn_saddr_v6 = connp->conn_laddr_v6; 790 mutex_exit(&connp->conn_lock); 791 792 /* As long as the MTU is large we avoid fragmentation */ 793 ixa->ixa_flags |= IXAF_DONTFRAG | IXAF_PMTU_IPV4_DF; 794 795 /* We handle IPsec in iptun_output_common */ 796 error = ip_attr_connect(connp, ixa, &connp->conn_saddr_v6, 797 &connp->conn_faddr_v6, &connp->conn_faddr_v6, 0, 798 &connp->conn_saddr_v6, &uinfo, 0); 799 800 if (error != 0) 801 goto done; 802 803 /* saddr shouldn't change since it was already set */ 804 ASSERT(IN6_ARE_ADDR_EQUAL(&connp->conn_laddr_v6, 805 &connp->conn_saddr_v6)); 806 807 /* We set IXAF_VERIFY_PMTU to catch PMTU increases */ 808 ixa->ixa_flags |= IXAF_VERIFY_PMTU; 809 ASSERT(uinfo.iulp_mtu != 0); 810 811 /* 812 * Allow setting new policies. 813 * The addresses/ports are already set, thus the IPsec policy calls 814 * can handle their passed-in conn's. 815 */ 816 connp->conn_policy_cached = B_FALSE; 817 818 insert: 819 error = ipcl_conn_insert(connp); 820 if (error != 0) 821 goto done; 822 823 /* Atomically update v6lastdst and conn_ixa */ 824 mutex_enter(&connp->conn_lock); 825 /* Record this as the "last" send even though we haven't sent any */ 826 connp->conn_v6lastdst = connp->conn_faddr_v6; 827 828 iptun->iptun_flags |= IPTUN_BOUND; 829 830 oldixa = conn_replace_ixa(connp, ixa); 831 /* Done with conn_t */ 832 mutex_exit(&connp->conn_lock); 833 ixa_refrele(oldixa); 834 835 /* 836 * Now that we're bound with ip below us, this is a good 837 * time to initialize the destination path MTU and to 838 * re-calculate the tunnel's link MTU. 839 */ 840 (void) iptun_update_mtu(iptun, ixa, 0); 841 842 if (IS_IPTUN_RUNNING(iptun)) 843 iptun_task_dispatch(iptun, IPTUN_TASK_LINK_UPDATE); 844 845 done: 846 ixa_refrele(ixa); 847 return (error); 848 } 849 850 static void 851 iptun_unbind(iptun_t *iptun) 852 { 853 ASSERT(iptun->iptun_flags & IPTUN_BOUND); 854 ASSERT(mutex_owned(&iptun->iptun_lock) || 855 (iptun->iptun_flags & IPTUN_CONDEMNED)); 856 ip_unbind(iptun->iptun_connp); 857 iptun->iptun_flags &= ~IPTUN_BOUND; 858 if (!(iptun->iptun_flags & IPTUN_CONDEMNED)) 859 iptun_task_dispatch(iptun, IPTUN_TASK_LINK_UPDATE); 860 } 861 862 /* 863 * Re-generate the template data-link header for a given IP tunnel given the 864 * tunnel's current parameters. 865 */ 866 static void 867 iptun_headergen(iptun_t *iptun, boolean_t update_mac) 868 { 869 switch (iptun->iptun_typeinfo->iti_ipvers) { 870 case IPV4_VERSION: 871 /* 872 * We only need to use a custom IP header if the administrator 873 * has supplied a non-default hoplimit. 874 */ 875 if (iptun->iptun_hoplimit == IPTUN_DEFAULT_HOPLIMIT) { 876 iptun->iptun_header_size = 0; 877 break; 878 } 879 iptun->iptun_header_size = sizeof (ipha_t); 880 iptun->iptun_header4.ipha_version_and_hdr_length = 881 IP_SIMPLE_HDR_VERSION; 882 iptun->iptun_header4.ipha_fragment_offset_and_flags = 883 htons(IPH_DF); 884 iptun->iptun_header4.ipha_ttl = iptun->iptun_hoplimit; 885 break; 886 case IPV6_VERSION: { 887 ip6_t *ip6hp = &iptun->iptun_header6.it6h_ip6h; 888 889 /* 890 * We only need to use a custom IPv6 header if either the 891 * administrator has supplied a non-default hoplimit, or we 892 * need to include an encapsulation limit option in the outer 893 * header. 894 */ 895 if (iptun->iptun_hoplimit == IPTUN_DEFAULT_HOPLIMIT && 896 iptun->iptun_encaplimit == 0) { 897 iptun->iptun_header_size = 0; 898 break; 899 } 900 901 (void) memset(ip6hp, 0, sizeof (*ip6hp)); 902 if (iptun->iptun_encaplimit == 0) { 903 iptun->iptun_header_size = sizeof (ip6_t); 904 ip6hp->ip6_nxt = IPPROTO_NONE; 905 } else { 906 iptun_encaplim_t *iel; 907 908 iptun->iptun_header_size = sizeof (iptun_ipv6hdrs_t); 909 /* 910 * The mac_ipv6 plugin requires ip6_plen to be in host 911 * byte order and reflect the extension headers 912 * present in the template. The actual network byte 913 * order ip6_plen will be set on a per-packet basis on 914 * transmit. 915 */ 916 ip6hp->ip6_plen = sizeof (*iel); 917 ip6hp->ip6_nxt = IPPROTO_DSTOPTS; 918 iel = &iptun->iptun_header6.it6h_encaplim; 919 *iel = iptun_encaplim_init; 920 iel->iel_telopt.ip6ot_encap_limit = 921 iptun->iptun_encaplimit; 922 } 923 924 ip6hp->ip6_hlim = iptun->iptun_hoplimit; 925 break; 926 } 927 } 928 929 if (update_mac) 930 iptun_task_dispatch(iptun, IPTUN_TASK_PDATA_UPDATE); 931 } 932 933 /* 934 * Insert inbound and outbound IPv4 and IPv6 policy into the given policy 935 * head. 936 */ 937 static boolean_t 938 iptun_insert_simple_policies(ipsec_policy_head_t *ph, ipsec_act_t *actp, 939 uint_t n, netstack_t *ns) 940 { 941 int f = IPSEC_AF_V4; 942 943 if (!ipsec_polhead_insert(ph, actp, n, f, IPSEC_TYPE_INBOUND, ns) || 944 !ipsec_polhead_insert(ph, actp, n, f, IPSEC_TYPE_OUTBOUND, ns)) 945 return (B_FALSE); 946 947 f = IPSEC_AF_V6; 948 return (ipsec_polhead_insert(ph, actp, n, f, IPSEC_TYPE_INBOUND, ns) && 949 ipsec_polhead_insert(ph, actp, n, f, IPSEC_TYPE_OUTBOUND, ns)); 950 } 951 952 /* 953 * Used to set IPsec policy when policy is set through the IPTUN_CREATE or 954 * IPTUN_MODIFY ioctls. 955 */ 956 static int 957 iptun_set_sec_simple(iptun_t *iptun, const ipsec_req_t *ipsr) 958 { 959 int rc = 0; 960 uint_t nact; 961 ipsec_act_t *actp = NULL; 962 boolean_t clear_all, old_policy = B_FALSE; 963 ipsec_tun_pol_t *itp; 964 char name[MAXLINKNAMELEN]; 965 uint64_t gen; 966 netstack_t *ns = iptun->iptun_ns; 967 968 /* Can't specify self-encap on a tunnel. */ 969 if (ipsr->ipsr_self_encap_req != 0) 970 return (EINVAL); 971 972 /* 973 * If it's a "clear-all" entry, unset the security flags and resume 974 * normal cleartext (or inherit-from-global) policy. 975 */ 976 clear_all = ((ipsr->ipsr_ah_req & IPTUN_IPSEC_REQ_MASK) == 0 && 977 (ipsr->ipsr_esp_req & IPTUN_IPSEC_REQ_MASK) == 0); 978 979 ASSERT(mutex_owned(&iptun->iptun_lock)); 980 itp = iptun->iptun_itp; 981 if (itp == NULL) { 982 if (clear_all) 983 goto bail; 984 if ((rc = dls_mgmt_get_linkinfo(iptun->iptun_linkid, name, NULL, 985 NULL, NULL)) != 0) 986 goto bail; 987 ASSERT(name[0] != '\0'); 988 if ((itp = create_tunnel_policy(name, &rc, &gen, ns)) == NULL) 989 goto bail; 990 iptun->iptun_itp = itp; 991 } 992 993 /* Allocate the actvec now, before holding itp or polhead locks. */ 994 ipsec_actvec_from_req(ipsr, &actp, &nact, ns); 995 if (actp == NULL) { 996 rc = ENOMEM; 997 goto bail; 998 } 999 1000 /* 1001 * Just write on the active polhead. Save the primary/secondary stuff 1002 * for spdsock operations. 1003 * 1004 * Mutex because we need to write to the polhead AND flags atomically. 1005 * Other threads will acquire the polhead lock as a reader if the 1006 * (unprotected) flag is set. 1007 */ 1008 mutex_enter(&itp->itp_lock); 1009 if (itp->itp_flags & ITPF_P_TUNNEL) { 1010 /* Oops, we lost a race. Let's get out of here. */ 1011 rc = EBUSY; 1012 goto mutex_bail; 1013 } 1014 old_policy = ((itp->itp_flags & ITPF_P_ACTIVE) != 0); 1015 1016 if (old_policy) { 1017 ITPF_CLONE(itp->itp_flags); 1018 rc = ipsec_copy_polhead(itp->itp_policy, itp->itp_inactive, ns); 1019 if (rc != 0) { 1020 /* inactive has already been cleared. */ 1021 itp->itp_flags &= ~ITPF_IFLAGS; 1022 goto mutex_bail; 1023 } 1024 rw_enter(&itp->itp_policy->iph_lock, RW_WRITER); 1025 ipsec_polhead_flush(itp->itp_policy, ns); 1026 } else { 1027 /* Else assume itp->itp_policy is already flushed. */ 1028 rw_enter(&itp->itp_policy->iph_lock, RW_WRITER); 1029 } 1030 1031 if (clear_all) { 1032 ASSERT(avl_numnodes(&itp->itp_policy->iph_rulebyid) == 0); 1033 itp->itp_flags &= ~ITPF_PFLAGS; 1034 rw_exit(&itp->itp_policy->iph_lock); 1035 old_policy = B_FALSE; /* Clear out the inactive one too. */ 1036 goto recover_bail; 1037 } 1038 1039 if (iptun_insert_simple_policies(itp->itp_policy, actp, nact, ns)) { 1040 rw_exit(&itp->itp_policy->iph_lock); 1041 /* 1042 * Adjust MTU and make sure the DL side knows what's up. 1043 */ 1044 itp->itp_flags = ITPF_P_ACTIVE; 1045 (void) iptun_update_mtu(iptun, NULL, 0); 1046 old_policy = B_FALSE; /* Blank out inactive - we succeeded */ 1047 } else { 1048 rw_exit(&itp->itp_policy->iph_lock); 1049 rc = ENOMEM; 1050 } 1051 1052 recover_bail: 1053 if (old_policy) { 1054 /* Recover policy in in active polhead. */ 1055 ipsec_swap_policy(itp->itp_policy, itp->itp_inactive, ns); 1056 ITPF_SWAP(itp->itp_flags); 1057 } 1058 1059 /* Clear policy in inactive polhead. */ 1060 itp->itp_flags &= ~ITPF_IFLAGS; 1061 rw_enter(&itp->itp_inactive->iph_lock, RW_WRITER); 1062 ipsec_polhead_flush(itp->itp_inactive, ns); 1063 rw_exit(&itp->itp_inactive->iph_lock); 1064 1065 mutex_bail: 1066 mutex_exit(&itp->itp_lock); 1067 1068 bail: 1069 if (actp != NULL) 1070 ipsec_actvec_free(actp, nact); 1071 1072 return (rc); 1073 } 1074 1075 static iptun_typeinfo_t * 1076 iptun_gettypeinfo(iptun_type_t type) 1077 { 1078 int i; 1079 1080 for (i = 0; iptun_type_table[i].iti_type != IPTUN_TYPE_UNKNOWN; i++) { 1081 if (iptun_type_table[i].iti_type == type) 1082 break; 1083 } 1084 return (&iptun_type_table[i]); 1085 } 1086 1087 /* 1088 * Set the parameters included in ik on the tunnel iptun. Parameters that can 1089 * only be set at creation time are set in iptun_create(). 1090 */ 1091 static int 1092 iptun_setparams(iptun_t *iptun, const iptun_kparams_t *ik) 1093 { 1094 int err = 0; 1095 netstack_t *ns = iptun->iptun_ns; 1096 iptun_addr_t orig_laddr, orig_raddr; 1097 uint_t orig_flags = iptun->iptun_flags; 1098 1099 if (ik->iptun_kparam_flags & IPTUN_KPARAM_LADDR) { 1100 if (orig_flags & IPTUN_LADDR) 1101 orig_laddr = iptun->iptun_laddr; 1102 if ((err = iptun_setladdr(iptun, &ik->iptun_kparam_laddr)) != 0) 1103 return (err); 1104 iptun->iptun_flags |= IPTUN_LADDR; 1105 } 1106 1107 if (ik->iptun_kparam_flags & IPTUN_KPARAM_RADDR) { 1108 if (orig_flags & IPTUN_RADDR) 1109 orig_raddr = iptun->iptun_raddr; 1110 if ((err = iptun_setraddr(iptun, &ik->iptun_kparam_raddr)) != 0) 1111 goto done; 1112 iptun->iptun_flags |= IPTUN_RADDR; 1113 } 1114 1115 if (ik->iptun_kparam_flags & IPTUN_KPARAM_SECINFO) { 1116 /* 1117 * Set IPsec policy originating from the ifconfig(1M) command 1118 * line. This is traditionally called "simple" policy because 1119 * the ipsec_req_t (iptun_kparam_secinfo) can only describe a 1120 * simple policy of "do ESP on everything" and/or "do AH on 1121 * everything" (as opposed to the rich policy that can be 1122 * defined with ipsecconf(1M)). 1123 */ 1124 if (iptun->iptun_typeinfo->iti_type == IPTUN_TYPE_6TO4) { 1125 /* 1126 * Can't set security properties for automatic 1127 * tunnels. 1128 */ 1129 err = EINVAL; 1130 goto done; 1131 } 1132 1133 if (!ipsec_loaded(ns->netstack_ipsec)) { 1134 /* If IPsec can be loaded, try and load it now. */ 1135 if (ipsec_failed(ns->netstack_ipsec)) { 1136 err = EPROTONOSUPPORT; 1137 goto done; 1138 } 1139 ipsec_loader_loadnow(ns->netstack_ipsec); 1140 /* 1141 * ipsec_loader_loadnow() returns while IPsec is 1142 * loaded asynchronously. While a method exists to 1143 * wait for IPsec to load (ipsec_loader_wait()), it 1144 * requires use of a STREAMS queue to do a qwait(). 1145 * We're not in STREAMS context here, and so we can't 1146 * use it. This is not a problem in practice because 1147 * in the vast majority of cases, key management and 1148 * global policy will have loaded before any tunnels 1149 * are plumbed, and so IPsec will already have been 1150 * loaded. 1151 */ 1152 err = EAGAIN; 1153 goto done; 1154 } 1155 1156 err = iptun_set_sec_simple(iptun, &ik->iptun_kparam_secinfo); 1157 if (err == 0) { 1158 iptun->iptun_flags |= IPTUN_SIMPLE_POLICY; 1159 iptun->iptun_simple_policy = ik->iptun_kparam_secinfo; 1160 } 1161 } 1162 done: 1163 if (err != 0) { 1164 /* Restore original source and destination. */ 1165 if (ik->iptun_kparam_flags & IPTUN_KPARAM_LADDR && 1166 (orig_flags & IPTUN_LADDR)) 1167 iptun->iptun_laddr = orig_laddr; 1168 if ((ik->iptun_kparam_flags & IPTUN_KPARAM_RADDR) && 1169 (orig_flags & IPTUN_RADDR)) 1170 iptun->iptun_raddr = orig_raddr; 1171 iptun->iptun_flags = orig_flags; 1172 } 1173 return (err); 1174 } 1175 1176 static int 1177 iptun_register(iptun_t *iptun) 1178 { 1179 mac_register_t *mac; 1180 int err; 1181 1182 ASSERT(!(iptun->iptun_flags & IPTUN_MAC_REGISTERED)); 1183 1184 if ((mac = mac_alloc(MAC_VERSION)) == NULL) 1185 return (EINVAL); 1186 1187 mac->m_type_ident = iptun->iptun_typeinfo->iti_ident; 1188 mac->m_driver = iptun; 1189 mac->m_dip = iptun_dip; 1190 mac->m_instance = (uint_t)-1; 1191 mac->m_src_addr = (uint8_t *)&iptun->iptun_laddr.ia_addr; 1192 mac->m_dst_addr = iptun->iptun_typeinfo->iti_hasraddr ? 1193 (uint8_t *)&iptun->iptun_raddr.ia_addr : NULL; 1194 mac->m_callbacks = &iptun_m_callbacks; 1195 mac->m_min_sdu = iptun->iptun_typeinfo->iti_minmtu; 1196 mac->m_max_sdu = iptun->iptun_mtu; 1197 if (iptun->iptun_header_size != 0) { 1198 mac->m_pdata = &iptun->iptun_header; 1199 mac->m_pdata_size = iptun->iptun_header_size; 1200 } 1201 if ((err = mac_register(mac, &iptun->iptun_mh)) == 0) 1202 iptun->iptun_flags |= IPTUN_MAC_REGISTERED; 1203 mac_free(mac); 1204 return (err); 1205 } 1206 1207 static int 1208 iptun_unregister(iptun_t *iptun) 1209 { 1210 int err; 1211 1212 ASSERT(iptun->iptun_flags & IPTUN_MAC_REGISTERED); 1213 if ((err = mac_unregister(iptun->iptun_mh)) == 0) 1214 iptun->iptun_flags &= ~IPTUN_MAC_REGISTERED; 1215 return (err); 1216 } 1217 1218 static conn_t * 1219 iptun_conn_create(iptun_t *iptun, netstack_t *ns, cred_t *credp) 1220 { 1221 conn_t *connp; 1222 1223 if ((connp = ipcl_conn_create(IPCL_IPCCONN, KM_NOSLEEP, ns)) == NULL) 1224 return (NULL); 1225 1226 connp->conn_flags |= IPCL_IPTUN; 1227 connp->conn_iptun = iptun; 1228 connp->conn_recv = iptun_input; 1229 connp->conn_recvicmp = iptun_input_icmp; 1230 connp->conn_verifyicmp = iptun_verifyicmp; 1231 1232 /* 1233 * Register iptun_notify to listen to capability changes detected by IP. 1234 * This upcall is made in the context of the call to conn_ip_output. 1235 */ 1236 connp->conn_ixa->ixa_notify = iptun_notify; 1237 connp->conn_ixa->ixa_notify_cookie = iptun; 1238 1239 /* 1240 * For exclusive stacks we set conn_zoneid to GLOBAL_ZONEID as is done 1241 * for all other conn_t's. 1242 * 1243 * Note that there's an important distinction between iptun_zoneid and 1244 * conn_zoneid. The conn_zoneid is set to GLOBAL_ZONEID in non-global 1245 * exclusive stack zones to make the ip module believe that the 1246 * non-global zone is actually a global zone. Therefore, when 1247 * interacting with the ip module, we must always use conn_zoneid. 1248 */ 1249 connp->conn_zoneid = (ns->netstack_stackid == GLOBAL_NETSTACKID) ? 1250 crgetzoneid(credp) : GLOBAL_ZONEID; 1251 connp->conn_cred = credp; 1252 /* crfree() is done in ipcl_conn_destroy(), called by CONN_DEC_REF() */ 1253 crhold(connp->conn_cred); 1254 connp->conn_cpid = NOPID; 1255 1256 /* conn_allzones can not be set this early, hence no IPCL_ZONEID */ 1257 connp->conn_ixa->ixa_zoneid = connp->conn_zoneid; 1258 ASSERT(connp->conn_ref == 1); 1259 1260 /* Cache things in ixa without an extra refhold */ 1261 ASSERT(!(connp->conn_ixa->ixa_free_flags & IXA_FREE_CRED)); 1262 connp->conn_ixa->ixa_cred = connp->conn_cred; 1263 connp->conn_ixa->ixa_cpid = connp->conn_cpid; 1264 if (is_system_labeled()) 1265 connp->conn_ixa->ixa_tsl = crgetlabel(connp->conn_cred); 1266 1267 /* 1268 * Have conn_ip_output drop packets should our outer source 1269 * go invalid 1270 */ 1271 connp->conn_ixa->ixa_flags |= IXAF_VERIFY_SOURCE; 1272 1273 switch (iptun->iptun_typeinfo->iti_ipvers) { 1274 case IPV4_VERSION: 1275 connp->conn_family = AF_INET6; 1276 break; 1277 case IPV6_VERSION: 1278 connp->conn_family = AF_INET; 1279 break; 1280 } 1281 mutex_enter(&connp->conn_lock); 1282 connp->conn_state_flags &= ~CONN_INCIPIENT; 1283 mutex_exit(&connp->conn_lock); 1284 return (connp); 1285 } 1286 1287 static void 1288 iptun_conn_destroy(conn_t *connp) 1289 { 1290 ip_quiesce_conn(connp); 1291 connp->conn_iptun = NULL; 1292 ASSERT(connp->conn_ref == 1); 1293 CONN_DEC_REF(connp); 1294 } 1295 1296 static iptun_t * 1297 iptun_alloc(void) 1298 { 1299 iptun_t *iptun; 1300 1301 if ((iptun = kmem_cache_alloc(iptun_cache, KM_NOSLEEP)) != NULL) { 1302 bzero(iptun, sizeof (*iptun)); 1303 atomic_inc_32(&iptun_tunnelcount); 1304 } 1305 return (iptun); 1306 } 1307 1308 static void 1309 iptun_free(iptun_t *iptun) 1310 { 1311 ASSERT(iptun->iptun_flags & IPTUN_CONDEMNED); 1312 1313 if (iptun->iptun_flags & IPTUN_HASH_INSERTED) { 1314 iptun_stack_t *iptuns = iptun->iptun_iptuns; 1315 1316 mutex_enter(&iptun_hash_lock); 1317 VERIFY(mod_hash_remove(iptun_hash, 1318 IPTUN_HASH_KEY(iptun->iptun_linkid), 1319 (mod_hash_val_t *)&iptun) == 0); 1320 mutex_exit(&iptun_hash_lock); 1321 iptun->iptun_flags &= ~IPTUN_HASH_INSERTED; 1322 mutex_enter(&iptuns->iptuns_lock); 1323 list_remove(&iptuns->iptuns_iptunlist, iptun); 1324 mutex_exit(&iptuns->iptuns_lock); 1325 } 1326 1327 if (iptun->iptun_flags & IPTUN_BOUND) 1328 iptun_unbind(iptun); 1329 1330 /* 1331 * After iptun_unregister(), there will be no threads executing a 1332 * downcall from the mac module, including in the tx datapath. 1333 */ 1334 if (iptun->iptun_flags & IPTUN_MAC_REGISTERED) 1335 VERIFY(iptun_unregister(iptun) == 0); 1336 1337 if (iptun->iptun_itp != NULL) { 1338 /* 1339 * Remove from the AVL tree, AND release the reference iptun_t 1340 * itself holds on the ITP. 1341 */ 1342 itp_unlink(iptun->iptun_itp, iptun->iptun_ns); 1343 ITP_REFRELE(iptun->iptun_itp, iptun->iptun_ns); 1344 iptun->iptun_itp = NULL; 1345 iptun->iptun_flags &= ~IPTUN_SIMPLE_POLICY; 1346 } 1347 1348 /* 1349 * After ipcl_conn_destroy(), there will be no threads executing an 1350 * upcall from ip (i.e., iptun_input()), and it is then safe to free 1351 * the iptun_t. 1352 */ 1353 if (iptun->iptun_connp != NULL) { 1354 iptun_conn_destroy(iptun->iptun_connp); 1355 iptun->iptun_connp = NULL; 1356 } 1357 1358 kmem_cache_free(iptun_cache, iptun); 1359 atomic_dec_32(&iptun_tunnelcount); 1360 } 1361 1362 int 1363 iptun_create(iptun_kparams_t *ik, cred_t *credp) 1364 { 1365 iptun_t *iptun = NULL; 1366 int err = 0, mherr; 1367 char linkname[MAXLINKNAMELEN]; 1368 ipsec_tun_pol_t *itp; 1369 netstack_t *ns = NULL; 1370 iptun_stack_t *iptuns; 1371 datalink_id_t tmpid; 1372 zoneid_t zoneid = crgetzoneid(credp); 1373 boolean_t link_created = B_FALSE; 1374 1375 /* The tunnel type is mandatory */ 1376 if (!(ik->iptun_kparam_flags & IPTUN_KPARAM_TYPE)) 1377 return (EINVAL); 1378 1379 /* 1380 * Is the linkid that the caller wishes to associate with this new 1381 * tunnel assigned to this zone? 1382 */ 1383 if (zone_check_datalink(&zoneid, ik->iptun_kparam_linkid) != 0) { 1384 if (zoneid != GLOBAL_ZONEID) 1385 return (EINVAL); 1386 } else if (zoneid == GLOBAL_ZONEID) { 1387 return (EINVAL); 1388 } 1389 1390 /* 1391 * Make sure that we're not trying to create a tunnel that has already 1392 * been created. 1393 */ 1394 if (iptun_enter_by_linkid(ik->iptun_kparam_linkid, &iptun) == 0) { 1395 iptun_exit(iptun); 1396 iptun = NULL; 1397 err = EEXIST; 1398 goto done; 1399 } 1400 1401 ns = netstack_find_by_cred(credp); 1402 iptuns = ns->netstack_iptun; 1403 1404 if ((iptun = iptun_alloc()) == NULL) { 1405 err = ENOMEM; 1406 goto done; 1407 } 1408 1409 iptun->iptun_linkid = ik->iptun_kparam_linkid; 1410 iptun->iptun_zoneid = zoneid; 1411 iptun->iptun_ns = ns; 1412 1413 iptun->iptun_typeinfo = iptun_gettypeinfo(ik->iptun_kparam_type); 1414 if (iptun->iptun_typeinfo->iti_type == IPTUN_TYPE_UNKNOWN) { 1415 err = EINVAL; 1416 goto done; 1417 } 1418 1419 if (ik->iptun_kparam_flags & IPTUN_KPARAM_IMPLICIT) 1420 iptun->iptun_flags |= IPTUN_IMPLICIT; 1421 1422 if ((err = iptun_setparams(iptun, ik)) != 0) 1423 goto done; 1424 1425 iptun->iptun_hoplimit = IPTUN_DEFAULT_HOPLIMIT; 1426 if (iptun->iptun_typeinfo->iti_type == IPTUN_TYPE_IPV6) 1427 iptun->iptun_encaplimit = IPTUN_DEFAULT_ENCAPLIMIT; 1428 1429 iptun_headergen(iptun, B_FALSE); 1430 1431 iptun->iptun_connp = iptun_conn_create(iptun, ns, credp); 1432 if (iptun->iptun_connp == NULL) { 1433 err = ENOMEM; 1434 goto done; 1435 } 1436 1437 iptun->iptun_mtu = iptun->iptun_typeinfo->iti_maxmtu; 1438 iptun->iptun_dpmtu = iptun->iptun_mtu; 1439 1440 /* 1441 * Find an ITP based on linkname. If we have parms already set via 1442 * the iptun_setparams() call above, it may have created an ITP for 1443 * us. We always try get_tunnel_policy() for DEBUG correctness 1444 * checks, and we may wish to refactor this to only check when 1445 * iptun_itp is NULL. 1446 */ 1447 if ((err = dls_mgmt_get_linkinfo(iptun->iptun_linkid, linkname, NULL, 1448 NULL, NULL)) != 0) 1449 goto done; 1450 if ((itp = get_tunnel_policy(linkname, ns)) != NULL) 1451 iptun->iptun_itp = itp; 1452 1453 /* 1454 * See if we have the necessary IP addresses assigned to this tunnel 1455 * to try and bind them with ip underneath us. If we're not ready to 1456 * bind yet, then we'll defer the bind operation until the addresses 1457 * are modified. 1458 */ 1459 if (iptun_canbind(iptun) && ((err = iptun_bind(iptun)) != 0)) 1460 goto done; 1461 1462 if ((err = iptun_register(iptun)) != 0) 1463 goto done; 1464 1465 err = dls_devnet_create(iptun->iptun_mh, iptun->iptun_linkid, 1466 iptun->iptun_zoneid); 1467 if (err != 0) 1468 goto done; 1469 link_created = B_TRUE; 1470 1471 /* 1472 * We hash by link-id as that is the key used by all other iptun 1473 * interfaces (modify, delete, etc.). 1474 */ 1475 if ((mherr = mod_hash_insert(iptun_hash, 1476 IPTUN_HASH_KEY(iptun->iptun_linkid), (mod_hash_val_t)iptun)) == 0) { 1477 mutex_enter(&iptuns->iptuns_lock); 1478 list_insert_head(&iptuns->iptuns_iptunlist, iptun); 1479 mutex_exit(&iptuns->iptuns_lock); 1480 iptun->iptun_flags |= IPTUN_HASH_INSERTED; 1481 } else if (mherr == MH_ERR_NOMEM) { 1482 err = ENOMEM; 1483 } else if (mherr == MH_ERR_DUPLICATE) { 1484 err = EEXIST; 1485 } else { 1486 err = EINVAL; 1487 } 1488 1489 done: 1490 if (iptun == NULL && ns != NULL) 1491 netstack_rele(ns); 1492 if (err != 0 && iptun != NULL) { 1493 if (link_created) { 1494 (void) dls_devnet_destroy(iptun->iptun_mh, &tmpid, 1495 B_TRUE); 1496 } 1497 iptun->iptun_flags |= IPTUN_CONDEMNED; 1498 iptun_free(iptun); 1499 } 1500 return (err); 1501 } 1502 1503 int 1504 iptun_delete(datalink_id_t linkid, cred_t *credp) 1505 { 1506 int err; 1507 iptun_t *iptun = NULL; 1508 1509 if ((err = iptun_enter_by_linkid(linkid, &iptun)) != 0) 1510 return (err); 1511 1512 /* One cannot delete a tunnel that belongs to another zone. */ 1513 if (iptun->iptun_zoneid != crgetzoneid(credp)) { 1514 iptun_exit(iptun); 1515 return (EACCES); 1516 } 1517 1518 /* 1519 * We need to exit iptun in order to issue calls up the stack such as 1520 * dls_devnet_destroy(). If we call up while still in iptun, deadlock 1521 * with calls coming down the stack is possible. We prevent other 1522 * threads from entering this iptun after we've exited it by setting 1523 * the IPTUN_DELETE_PENDING flag. This will cause callers of 1524 * iptun_enter() to block waiting on iptun_enter_cv. The assumption 1525 * here is that the functions we're calling while IPTUN_DELETE_PENDING 1526 * is set dont resuult in an iptun_enter() call, as that would result 1527 * in deadlock. 1528 */ 1529 iptun->iptun_flags |= IPTUN_DELETE_PENDING; 1530 1531 /* Wait for any pending upcall to the mac module to complete. */ 1532 while (iptun->iptun_flags & IPTUN_UPCALL_PENDING) 1533 cv_wait(&iptun->iptun_upcall_cv, &iptun->iptun_lock); 1534 1535 iptun_exit(iptun); 1536 1537 if ((err = dls_devnet_destroy(iptun->iptun_mh, &linkid, B_TRUE)) == 0) { 1538 /* 1539 * mac_disable() will fail with EBUSY if there are references 1540 * to the iptun MAC. If there are none, then mac_disable() 1541 * will assure that none can be acquired until the MAC is 1542 * unregistered. 1543 * 1544 * XXX CR 6791335 prevents us from calling mac_disable() prior 1545 * to dls_devnet_destroy(), so we unfortunately need to 1546 * attempt to re-create the devnet node if mac_disable() 1547 * fails. 1548 */ 1549 if ((err = mac_disable(iptun->iptun_mh)) != 0) { 1550 (void) dls_devnet_create(iptun->iptun_mh, linkid, 1551 iptun->iptun_zoneid); 1552 } 1553 } 1554 1555 /* 1556 * Now that we know the fate of this iptun_t, we need to clear 1557 * IPTUN_DELETE_PENDING, and set IPTUN_CONDEMNED if the iptun_t is 1558 * slated to be freed. Either way, we need to signal the threads 1559 * waiting in iptun_enter() so that they can either fail if 1560 * IPTUN_CONDEMNED is set, or continue if it's not. 1561 */ 1562 mutex_enter(&iptun->iptun_lock); 1563 iptun->iptun_flags &= ~IPTUN_DELETE_PENDING; 1564 if (err == 0) 1565 iptun->iptun_flags |= IPTUN_CONDEMNED; 1566 cv_broadcast(&iptun->iptun_enter_cv); 1567 mutex_exit(&iptun->iptun_lock); 1568 1569 /* 1570 * Note that there is no danger in calling iptun_free() after having 1571 * dropped the iptun_lock since callers of iptun_enter() at this point 1572 * are doing so from iptun_enter_by_linkid() (mac_disable() got rid of 1573 * threads entering from mac callbacks which call iptun_enter() 1574 * directly) which holds iptun_hash_lock, and iptun_free() grabs this 1575 * lock in order to remove the iptun_t from the hash table. 1576 */ 1577 if (err == 0) 1578 iptun_free(iptun); 1579 1580 return (err); 1581 } 1582 1583 int 1584 iptun_modify(const iptun_kparams_t *ik, cred_t *credp) 1585 { 1586 iptun_t *iptun; 1587 boolean_t laddr_change = B_FALSE, raddr_change = B_FALSE; 1588 int err; 1589 1590 if ((err = iptun_enter_by_linkid(ik->iptun_kparam_linkid, &iptun)) != 0) 1591 return (err); 1592 1593 /* One cannot modify a tunnel that belongs to another zone. */ 1594 if (iptun->iptun_zoneid != crgetzoneid(credp)) { 1595 err = EACCES; 1596 goto done; 1597 } 1598 1599 /* The tunnel type cannot be changed */ 1600 if (ik->iptun_kparam_flags & IPTUN_KPARAM_TYPE) { 1601 err = EINVAL; 1602 goto done; 1603 } 1604 1605 if ((err = iptun_setparams(iptun, ik)) != 0) 1606 goto done; 1607 iptun_headergen(iptun, B_FALSE); 1608 1609 /* 1610 * If any of the tunnel's addresses has been modified and the tunnel 1611 * has the necessary addresses assigned to it, we need to try to bind 1612 * with ip underneath us. If we're not ready to bind yet, then we'll 1613 * try again when the addresses are modified later. 1614 */ 1615 laddr_change = (ik->iptun_kparam_flags & IPTUN_KPARAM_LADDR); 1616 raddr_change = (ik->iptun_kparam_flags & IPTUN_KPARAM_RADDR); 1617 if (laddr_change || raddr_change) { 1618 if (iptun->iptun_flags & IPTUN_BOUND) 1619 iptun_unbind(iptun); 1620 if (iptun_canbind(iptun) && (err = iptun_bind(iptun)) != 0) { 1621 if (laddr_change) 1622 iptun->iptun_flags &= ~IPTUN_LADDR; 1623 if (raddr_change) 1624 iptun->iptun_flags &= ~IPTUN_RADDR; 1625 goto done; 1626 } 1627 } 1628 1629 if (laddr_change) 1630 iptun_task_dispatch(iptun, IPTUN_TASK_LADDR_UPDATE); 1631 if (raddr_change) 1632 iptun_task_dispatch(iptun, IPTUN_TASK_RADDR_UPDATE); 1633 1634 done: 1635 iptun_exit(iptun); 1636 return (err); 1637 } 1638 1639 /* Given an IP tunnel's datalink id, fill in its parameters. */ 1640 int 1641 iptun_info(iptun_kparams_t *ik, cred_t *credp) 1642 { 1643 iptun_t *iptun; 1644 int err; 1645 1646 /* Is the tunnel link visible from the caller's zone? */ 1647 if (!dls_devnet_islinkvisible(ik->iptun_kparam_linkid, 1648 crgetzoneid(credp))) 1649 return (ENOENT); 1650 1651 if ((err = iptun_enter_by_linkid(ik->iptun_kparam_linkid, &iptun)) != 0) 1652 return (err); 1653 1654 bzero(ik, sizeof (iptun_kparams_t)); 1655 1656 ik->iptun_kparam_linkid = iptun->iptun_linkid; 1657 ik->iptun_kparam_type = iptun->iptun_typeinfo->iti_type; 1658 ik->iptun_kparam_flags |= IPTUN_KPARAM_TYPE; 1659 1660 if (iptun->iptun_flags & IPTUN_LADDR) { 1661 iptun_getaddr(&iptun->iptun_laddr, &ik->iptun_kparam_laddr); 1662 ik->iptun_kparam_flags |= IPTUN_KPARAM_LADDR; 1663 } 1664 if (iptun->iptun_flags & IPTUN_RADDR) { 1665 iptun_getaddr(&iptun->iptun_raddr, &ik->iptun_kparam_raddr); 1666 ik->iptun_kparam_flags |= IPTUN_KPARAM_RADDR; 1667 } 1668 1669 if (iptun->iptun_flags & IPTUN_IMPLICIT) 1670 ik->iptun_kparam_flags |= IPTUN_KPARAM_IMPLICIT; 1671 1672 if (iptun->iptun_itp != NULL) { 1673 mutex_enter(&iptun->iptun_itp->itp_lock); 1674 if (iptun->iptun_itp->itp_flags & ITPF_P_ACTIVE) { 1675 ik->iptun_kparam_flags |= IPTUN_KPARAM_IPSECPOL; 1676 if (iptun->iptun_flags & IPTUN_SIMPLE_POLICY) { 1677 ik->iptun_kparam_flags |= IPTUN_KPARAM_SECINFO; 1678 ik->iptun_kparam_secinfo = 1679 iptun->iptun_simple_policy; 1680 } 1681 } 1682 mutex_exit(&iptun->iptun_itp->itp_lock); 1683 } 1684 1685 done: 1686 iptun_exit(iptun); 1687 return (err); 1688 } 1689 1690 int 1691 iptun_set_6to4relay(netstack_t *ns, ipaddr_t relay_addr) 1692 { 1693 if (relay_addr == INADDR_BROADCAST || CLASSD(relay_addr)) 1694 return (EADDRNOTAVAIL); 1695 ns->netstack_iptun->iptuns_relay_rtr_addr = relay_addr; 1696 return (0); 1697 } 1698 1699 void 1700 iptun_get_6to4relay(netstack_t *ns, ipaddr_t *relay_addr) 1701 { 1702 *relay_addr = ns->netstack_iptun->iptuns_relay_rtr_addr; 1703 } 1704 1705 void 1706 iptun_set_policy(datalink_id_t linkid, ipsec_tun_pol_t *itp) 1707 { 1708 iptun_t *iptun; 1709 1710 if (iptun_enter_by_linkid(linkid, &iptun) != 0) 1711 return; 1712 if (iptun->iptun_itp != itp) { 1713 ASSERT(iptun->iptun_itp == NULL); 1714 ITP_REFHOLD(itp); 1715 iptun->iptun_itp = itp; 1716 } 1717 /* 1718 * IPsec policy means IPsec overhead, which means lower MTU. 1719 * Refresh the MTU for this tunnel. 1720 */ 1721 (void) iptun_update_mtu(iptun, NULL, 0); 1722 iptun_exit(iptun); 1723 } 1724 1725 /* 1726 * Obtain the path MTU to the tunnel destination. 1727 * Can return zero in some cases. 1728 */ 1729 static uint32_t 1730 iptun_get_dst_pmtu(iptun_t *iptun, ip_xmit_attr_t *ixa) 1731 { 1732 uint32_t pmtu = 0; 1733 conn_t *connp = iptun->iptun_connp; 1734 boolean_t need_rele = B_FALSE; 1735 1736 /* 1737 * We only obtain the pmtu for tunnels that have a remote tunnel 1738 * address. 1739 */ 1740 if (!(iptun->iptun_flags & IPTUN_RADDR)) 1741 return (0); 1742 1743 if (ixa == NULL) { 1744 ixa = conn_get_ixa(connp, B_FALSE); 1745 if (ixa == NULL) 1746 return (0); 1747 need_rele = B_TRUE; 1748 } 1749 /* 1750 * Guard against ICMP errors before we have sent, as well as against 1751 * and a thread which held conn_ixa. 1752 */ 1753 if (ixa->ixa_ire != NULL) { 1754 pmtu = ip_get_pmtu(ixa); 1755 1756 /* 1757 * For both IPv4 and IPv6 we can have indication that the outer 1758 * header needs fragmentation. 1759 */ 1760 if (ixa->ixa_flags & IXAF_PMTU_TOO_SMALL) { 1761 /* Must allow fragmentation in ip_output */ 1762 ixa->ixa_flags &= ~IXAF_DONTFRAG; 1763 } else if (iptun->iptun_typeinfo->iti_type != IPTUN_TYPE_6TO4) { 1764 ixa->ixa_flags |= IXAF_DONTFRAG; 1765 } else { 1766 /* ip_get_pmtu might have set this - we don't want it */ 1767 ixa->ixa_flags &= ~IXAF_PMTU_IPV4_DF; 1768 } 1769 } 1770 1771 if (need_rele) 1772 ixa_refrele(ixa); 1773 return (pmtu); 1774 } 1775 1776 /* 1777 * Update the ip_xmit_attr_t to capture the current lower path mtu as known 1778 * by ip. 1779 */ 1780 static void 1781 iptun_update_dst_pmtu(iptun_t *iptun, ip_xmit_attr_t *ixa) 1782 { 1783 uint32_t pmtu; 1784 conn_t *connp = iptun->iptun_connp; 1785 boolean_t need_rele = B_FALSE; 1786 1787 /* IXAF_VERIFY_PMTU is not set if we don't have a fixed destination */ 1788 if (!(iptun->iptun_flags & IPTUN_RADDR)) 1789 return; 1790 1791 if (ixa == NULL) { 1792 ixa = conn_get_ixa(connp, B_FALSE); 1793 if (ixa == NULL) 1794 return; 1795 need_rele = B_TRUE; 1796 } 1797 /* 1798 * Guard against ICMP errors before we have sent, as well as against 1799 * and a thread which held conn_ixa. 1800 */ 1801 if (ixa->ixa_ire != NULL) { 1802 pmtu = ip_get_pmtu(ixa); 1803 /* 1804 * Update ixa_fragsize and ixa_pmtu. 1805 */ 1806 ixa->ixa_fragsize = ixa->ixa_pmtu = pmtu; 1807 1808 /* 1809 * For both IPv4 and IPv6 we can have indication that the outer 1810 * header needs fragmentation. 1811 */ 1812 if (ixa->ixa_flags & IXAF_PMTU_TOO_SMALL) { 1813 /* Must allow fragmentation in ip_output */ 1814 ixa->ixa_flags &= ~IXAF_DONTFRAG; 1815 } else if (iptun->iptun_typeinfo->iti_type != IPTUN_TYPE_6TO4) { 1816 ixa->ixa_flags |= IXAF_DONTFRAG; 1817 } else { 1818 /* ip_get_pmtu might have set this - we don't want it */ 1819 ixa->ixa_flags &= ~IXAF_PMTU_IPV4_DF; 1820 } 1821 } 1822 1823 if (need_rele) 1824 ixa_refrele(ixa); 1825 } 1826 1827 /* 1828 * There is nothing that iptun can verify in addition to IP having 1829 * verified the IP addresses in the fanout. 1830 */ 1831 /* ARGSUSED */ 1832 static boolean_t 1833 iptun_verifyicmp(conn_t *connp, void *arg2, icmph_t *icmph, icmp6_t *icmp6, 1834 ip_recv_attr_t *ira) 1835 { 1836 return (B_TRUE); 1837 } 1838 1839 /* 1840 * Notify function registered with ip_xmit_attr_t. 1841 */ 1842 static void 1843 iptun_notify(void *arg, ip_xmit_attr_t *ixa, ixa_notify_type_t ntype, 1844 ixa_notify_arg_t narg) 1845 { 1846 iptun_t *iptun = (iptun_t *)arg; 1847 1848 switch (ntype) { 1849 case IXAN_PMTU: 1850 (void) iptun_update_mtu(iptun, ixa, narg); 1851 break; 1852 } 1853 } 1854 1855 /* 1856 * Returns the max of old_ovhd and the overhead associated with pol. 1857 */ 1858 static uint32_t 1859 iptun_max_policy_overhead(ipsec_policy_t *pol, uint32_t old_ovhd) 1860 { 1861 uint32_t new_ovhd = old_ovhd; 1862 1863 while (pol != NULL) { 1864 new_ovhd = max(new_ovhd, 1865 ipsec_act_ovhd(&pol->ipsp_act->ipa_act)); 1866 pol = pol->ipsp_hash.hash_next; 1867 } 1868 return (new_ovhd); 1869 } 1870 1871 static uint32_t 1872 iptun_get_ipsec_overhead(iptun_t *iptun) 1873 { 1874 ipsec_policy_root_t *ipr; 1875 ipsec_policy_head_t *iph; 1876 ipsec_policy_t *pol; 1877 ipsec_selector_t sel; 1878 int i; 1879 uint32_t ipsec_ovhd = 0; 1880 ipsec_tun_pol_t *itp = iptun->iptun_itp; 1881 netstack_t *ns = iptun->iptun_ns; 1882 1883 if (itp == NULL || !(itp->itp_flags & ITPF_P_ACTIVE)) { 1884 /* 1885 * Consult global policy, just in case. This will only work 1886 * if we have both source and destination addresses to work 1887 * with. 1888 */ 1889 if ((iptun->iptun_flags & (IPTUN_LADDR|IPTUN_RADDR)) != 1890 (IPTUN_LADDR|IPTUN_RADDR)) 1891 return (0); 1892 1893 iph = ipsec_system_policy(ns); 1894 bzero(&sel, sizeof (sel)); 1895 sel.ips_isv4 = 1896 (iptun->iptun_typeinfo->iti_ipvers == IPV4_VERSION); 1897 switch (iptun->iptun_typeinfo->iti_ipvers) { 1898 case IPV4_VERSION: 1899 sel.ips_local_addr_v4 = iptun->iptun_laddr4; 1900 sel.ips_remote_addr_v4 = iptun->iptun_raddr4; 1901 break; 1902 case IPV6_VERSION: 1903 sel.ips_local_addr_v6 = iptun->iptun_laddr6; 1904 sel.ips_remote_addr_v6 = iptun->iptun_raddr6; 1905 break; 1906 } 1907 /* Check for both IPv4 and IPv6. */ 1908 sel.ips_protocol = IPPROTO_ENCAP; 1909 pol = ipsec_find_policy_head(NULL, iph, IPSEC_TYPE_OUTBOUND, 1910 &sel); 1911 if (pol != NULL) { 1912 ipsec_ovhd = ipsec_act_ovhd(&pol->ipsp_act->ipa_act); 1913 IPPOL_REFRELE(pol); 1914 } 1915 sel.ips_protocol = IPPROTO_IPV6; 1916 pol = ipsec_find_policy_head(NULL, iph, IPSEC_TYPE_OUTBOUND, 1917 &sel); 1918 if (pol != NULL) { 1919 ipsec_ovhd = max(ipsec_ovhd, 1920 ipsec_act_ovhd(&pol->ipsp_act->ipa_act)); 1921 IPPOL_REFRELE(pol); 1922 } 1923 IPPH_REFRELE(iph, ns); 1924 } else { 1925 /* 1926 * Look through all of the possible IPsec actions for the 1927 * tunnel, and find the largest potential IPsec overhead. 1928 */ 1929 iph = itp->itp_policy; 1930 rw_enter(&iph->iph_lock, RW_READER); 1931 ipr = &(iph->iph_root[IPSEC_TYPE_OUTBOUND]); 1932 ipsec_ovhd = iptun_max_policy_overhead( 1933 ipr->ipr_nonhash[IPSEC_AF_V4], 0); 1934 ipsec_ovhd = iptun_max_policy_overhead( 1935 ipr->ipr_nonhash[IPSEC_AF_V6], ipsec_ovhd); 1936 for (i = 0; i < ipr->ipr_nchains; i++) { 1937 ipsec_ovhd = iptun_max_policy_overhead( 1938 ipr->ipr_hash[i].hash_head, ipsec_ovhd); 1939 } 1940 rw_exit(&iph->iph_lock); 1941 } 1942 1943 return (ipsec_ovhd); 1944 } 1945 1946 /* 1947 * Calculate and return the maximum possible upper MTU for the given tunnel. 1948 * 1949 * If new_pmtu is set then we also need to update the lower path MTU information 1950 * in the ip_xmit_attr_t. That is needed since we set IXAF_VERIFY_PMTU so that 1951 * we are notified by conn_ip_output() when the path MTU increases. 1952 */ 1953 static uint32_t 1954 iptun_get_maxmtu(iptun_t *iptun, ip_xmit_attr_t *ixa, uint32_t new_pmtu) 1955 { 1956 size_t header_size, ipsec_overhead; 1957 uint32_t maxmtu, pmtu; 1958 1959 /* 1960 * Start with the path-MTU to the remote address, which is either 1961 * provided as the new_pmtu argument, or obtained using 1962 * iptun_get_dst_pmtu(). 1963 */ 1964 if (new_pmtu != 0) { 1965 if (iptun->iptun_flags & IPTUN_RADDR) 1966 iptun->iptun_dpmtu = new_pmtu; 1967 pmtu = new_pmtu; 1968 } else if (iptun->iptun_flags & IPTUN_RADDR) { 1969 if ((pmtu = iptun_get_dst_pmtu(iptun, ixa)) == 0) { 1970 /* 1971 * We weren't able to obtain the path-MTU of the 1972 * destination. Use the previous value. 1973 */ 1974 pmtu = iptun->iptun_dpmtu; 1975 } else { 1976 iptun->iptun_dpmtu = pmtu; 1977 } 1978 } else { 1979 /* 1980 * We have no path-MTU information to go on, use the maximum 1981 * possible value. 1982 */ 1983 pmtu = iptun->iptun_typeinfo->iti_maxmtu; 1984 } 1985 1986 /* 1987 * Now calculate tunneling overhead and subtract that from the 1988 * path-MTU information obtained above. 1989 */ 1990 if (iptun->iptun_header_size != 0) { 1991 header_size = iptun->iptun_header_size; 1992 } else { 1993 switch (iptun->iptun_typeinfo->iti_ipvers) { 1994 case IPV4_VERSION: 1995 header_size = sizeof (ipha_t); 1996 if (is_system_labeled()) 1997 header_size += IP_MAX_OPT_LENGTH; 1998 break; 1999 case IPV6_VERSION: 2000 header_size = sizeof (iptun_ipv6hdrs_t); 2001 break; 2002 } 2003 } 2004 2005 ipsec_overhead = iptun_get_ipsec_overhead(iptun); 2006 2007 maxmtu = pmtu - (header_size + ipsec_overhead); 2008 return (max(maxmtu, iptun->iptun_typeinfo->iti_minmtu)); 2009 } 2010 2011 /* 2012 * Re-calculate the tunnel's MTU as seen from above and notify the MAC layer 2013 * of any change in MTU. The new_pmtu argument is the new lower path MTU to 2014 * the tunnel destination to be used in the tunnel MTU calculation. Passing 2015 * in 0 for new_pmtu causes the lower path MTU to be dynamically updated using 2016 * ip_get_pmtu(). 2017 * 2018 * If the calculated tunnel MTU is different than its previous value, then we 2019 * notify the MAC layer above us of this change using mac_maxsdu_update(). 2020 */ 2021 static uint32_t 2022 iptun_update_mtu(iptun_t *iptun, ip_xmit_attr_t *ixa, uint32_t new_pmtu) 2023 { 2024 uint32_t newmtu; 2025 2026 /* We always update the ixa since we might have set IXAF_VERIFY_PMTU */ 2027 iptun_update_dst_pmtu(iptun, ixa); 2028 2029 /* 2030 * We return the current MTU without updating it if it was pegged to a 2031 * static value using the MAC_PROP_MTU link property. 2032 */ 2033 if (iptun->iptun_flags & IPTUN_FIXED_MTU) 2034 return (iptun->iptun_mtu); 2035 2036 /* If the MTU isn't fixed, then use the maximum possible value. */ 2037 newmtu = iptun_get_maxmtu(iptun, ixa, new_pmtu); 2038 /* 2039 * We only dynamically adjust the tunnel MTU for tunnels with 2040 * destinations because dynamic MTU calculations are based on the 2041 * destination path-MTU. 2042 */ 2043 if ((iptun->iptun_flags & IPTUN_RADDR) && newmtu != iptun->iptun_mtu) { 2044 iptun->iptun_mtu = newmtu; 2045 if (iptun->iptun_flags & IPTUN_MAC_REGISTERED) 2046 iptun_task_dispatch(iptun, IPTUN_TASK_MTU_UPDATE); 2047 } 2048 2049 return (newmtu); 2050 } 2051 2052 /* 2053 * Frees a packet or packet chain and bumps stat for each freed packet. 2054 */ 2055 static void 2056 iptun_drop_pkt(mblk_t *mp, uint64_t *stat) 2057 { 2058 mblk_t *pktmp; 2059 2060 for (pktmp = mp; pktmp != NULL; pktmp = mp) { 2061 mp = mp->b_next; 2062 pktmp->b_next = NULL; 2063 if (stat != NULL) 2064 atomic_inc_64(stat); 2065 freemsg(pktmp); 2066 } 2067 } 2068 2069 /* 2070 * Allocate and return a new mblk to hold an IP and ICMP header, and chain the 2071 * original packet to its b_cont. Returns NULL on failure. 2072 */ 2073 static mblk_t * 2074 iptun_build_icmperr(size_t hdrs_size, mblk_t *orig_pkt) 2075 { 2076 mblk_t *icmperr_mp; 2077 2078 if ((icmperr_mp = allocb(hdrs_size, BPRI_MED)) != NULL) { 2079 icmperr_mp->b_wptr += hdrs_size; 2080 /* tack on the offending packet */ 2081 icmperr_mp->b_cont = orig_pkt; 2082 } 2083 return (icmperr_mp); 2084 } 2085 2086 /* 2087 * Transmit an ICMP error. mp->b_rptr points at the packet to be included in 2088 * the ICMP error. 2089 */ 2090 static void 2091 iptun_sendicmp_v4(iptun_t *iptun, icmph_t *icmp, ipha_t *orig_ipha, mblk_t *mp, 2092 ts_label_t *tsl) 2093 { 2094 size_t orig_pktsize, hdrs_size; 2095 mblk_t *icmperr_mp; 2096 ipha_t *new_ipha; 2097 icmph_t *new_icmp; 2098 ip_xmit_attr_t ixas; 2099 conn_t *connp = iptun->iptun_connp; 2100 2101 orig_pktsize = msgdsize(mp); 2102 hdrs_size = sizeof (ipha_t) + sizeof (icmph_t); 2103 if ((icmperr_mp = iptun_build_icmperr(hdrs_size, mp)) == NULL) { 2104 iptun_drop_pkt(mp, &iptun->iptun_noxmtbuf); 2105 return; 2106 } 2107 2108 new_ipha = (ipha_t *)icmperr_mp->b_rptr; 2109 new_icmp = (icmph_t *)(new_ipha + 1); 2110 2111 new_ipha->ipha_version_and_hdr_length = IP_SIMPLE_HDR_VERSION; 2112 new_ipha->ipha_type_of_service = 0; 2113 new_ipha->ipha_ident = 0; 2114 new_ipha->ipha_fragment_offset_and_flags = 0; 2115 new_ipha->ipha_ttl = orig_ipha->ipha_ttl; 2116 new_ipha->ipha_protocol = IPPROTO_ICMP; 2117 new_ipha->ipha_src = orig_ipha->ipha_dst; 2118 new_ipha->ipha_dst = orig_ipha->ipha_src; 2119 new_ipha->ipha_hdr_checksum = 0; /* will be computed by ip */ 2120 new_ipha->ipha_length = htons(hdrs_size + orig_pktsize); 2121 2122 *new_icmp = *icmp; 2123 new_icmp->icmph_checksum = 0; 2124 new_icmp->icmph_checksum = IP_CSUM(icmperr_mp, sizeof (ipha_t), 0); 2125 2126 bzero(&ixas, sizeof (ixas)); 2127 ixas.ixa_flags = IXAF_BASIC_SIMPLE_V4; 2128 if (new_ipha->ipha_src == INADDR_ANY) { 2129 ixas.ixa_flags &= ~IXAF_VERIFY_SOURCE; 2130 ixas.ixa_flags |= IXAF_SET_SOURCE; 2131 } 2132 2133 ixas.ixa_zoneid = IPCL_ZONEID(connp); 2134 ixas.ixa_ipst = connp->conn_netstack->netstack_ip; 2135 ixas.ixa_cred = connp->conn_cred; 2136 ixas.ixa_cpid = NOPID; 2137 if (is_system_labeled()) 2138 ixas.ixa_tsl = tsl; 2139 2140 ixas.ixa_ifindex = 0; 2141 ixas.ixa_multicast_ttl = IP_DEFAULT_MULTICAST_TTL; 2142 2143 (void) ip_output_simple(icmperr_mp, &ixas); 2144 ixa_cleanup(&ixas); 2145 } 2146 2147 static void 2148 iptun_sendicmp_v6(iptun_t *iptun, icmp6_t *icmp6, ip6_t *orig_ip6h, mblk_t *mp, 2149 ts_label_t *tsl) 2150 { 2151 size_t orig_pktsize, hdrs_size; 2152 mblk_t *icmp6err_mp; 2153 ip6_t *new_ip6h; 2154 icmp6_t *new_icmp6; 2155 ip_xmit_attr_t ixas; 2156 conn_t *connp = iptun->iptun_connp; 2157 2158 orig_pktsize = msgdsize(mp); 2159 hdrs_size = sizeof (ip6_t) + sizeof (icmp6_t); 2160 if ((icmp6err_mp = iptun_build_icmperr(hdrs_size, mp)) == NULL) { 2161 iptun_drop_pkt(mp, &iptun->iptun_noxmtbuf); 2162 return; 2163 } 2164 2165 new_ip6h = (ip6_t *)icmp6err_mp->b_rptr; 2166 new_icmp6 = (icmp6_t *)(new_ip6h + 1); 2167 2168 new_ip6h->ip6_vcf = orig_ip6h->ip6_vcf; 2169 new_ip6h->ip6_plen = htons(sizeof (icmp6_t) + orig_pktsize); 2170 new_ip6h->ip6_hops = orig_ip6h->ip6_hops; 2171 new_ip6h->ip6_nxt = IPPROTO_ICMPV6; 2172 new_ip6h->ip6_src = orig_ip6h->ip6_dst; 2173 new_ip6h->ip6_dst = orig_ip6h->ip6_src; 2174 2175 *new_icmp6 = *icmp6; 2176 /* The checksum is calculated in ip_output_simple and friends. */ 2177 new_icmp6->icmp6_cksum = new_ip6h->ip6_plen; 2178 2179 bzero(&ixas, sizeof (ixas)); 2180 ixas.ixa_flags = IXAF_BASIC_SIMPLE_V6; 2181 if (IN6_IS_ADDR_UNSPECIFIED(&new_ip6h->ip6_src)) { 2182 ixas.ixa_flags &= ~IXAF_VERIFY_SOURCE; 2183 ixas.ixa_flags |= IXAF_SET_SOURCE; 2184 } 2185 2186 ixas.ixa_zoneid = IPCL_ZONEID(connp); 2187 ixas.ixa_ipst = connp->conn_netstack->netstack_ip; 2188 ixas.ixa_cred = connp->conn_cred; 2189 ixas.ixa_cpid = NOPID; 2190 if (is_system_labeled()) 2191 ixas.ixa_tsl = tsl; 2192 2193 ixas.ixa_ifindex = 0; 2194 ixas.ixa_multicast_ttl = IP_DEFAULT_MULTICAST_TTL; 2195 2196 (void) ip_output_simple(icmp6err_mp, &ixas); 2197 ixa_cleanup(&ixas); 2198 } 2199 2200 static void 2201 iptun_icmp_error_v4(iptun_t *iptun, ipha_t *orig_ipha, mblk_t *mp, 2202 uint8_t type, uint8_t code, ts_label_t *tsl) 2203 { 2204 icmph_t icmp; 2205 2206 bzero(&icmp, sizeof (icmp)); 2207 icmp.icmph_type = type; 2208 icmp.icmph_code = code; 2209 2210 iptun_sendicmp_v4(iptun, &icmp, orig_ipha, mp, tsl); 2211 } 2212 2213 static void 2214 iptun_icmp_fragneeded_v4(iptun_t *iptun, uint32_t newmtu, ipha_t *orig_ipha, 2215 mblk_t *mp, ts_label_t *tsl) 2216 { 2217 icmph_t icmp; 2218 2219 icmp.icmph_type = ICMP_DEST_UNREACHABLE; 2220 icmp.icmph_code = ICMP_FRAGMENTATION_NEEDED; 2221 icmp.icmph_du_zero = 0; 2222 icmp.icmph_du_mtu = htons(newmtu); 2223 2224 iptun_sendicmp_v4(iptun, &icmp, orig_ipha, mp, tsl); 2225 } 2226 2227 static void 2228 iptun_icmp_error_v6(iptun_t *iptun, ip6_t *orig_ip6h, mblk_t *mp, 2229 uint8_t type, uint8_t code, uint32_t offset, ts_label_t *tsl) 2230 { 2231 icmp6_t icmp6; 2232 2233 bzero(&icmp6, sizeof (icmp6)); 2234 icmp6.icmp6_type = type; 2235 icmp6.icmp6_code = code; 2236 if (type == ICMP6_PARAM_PROB) 2237 icmp6.icmp6_pptr = htonl(offset); 2238 2239 iptun_sendicmp_v6(iptun, &icmp6, orig_ip6h, mp, tsl); 2240 } 2241 2242 static void 2243 iptun_icmp_toobig_v6(iptun_t *iptun, uint32_t newmtu, ip6_t *orig_ip6h, 2244 mblk_t *mp, ts_label_t *tsl) 2245 { 2246 icmp6_t icmp6; 2247 2248 icmp6.icmp6_type = ICMP6_PACKET_TOO_BIG; 2249 icmp6.icmp6_code = 0; 2250 icmp6.icmp6_mtu = htonl(newmtu); 2251 2252 iptun_sendicmp_v6(iptun, &icmp6, orig_ip6h, mp, tsl); 2253 } 2254 2255 /* 2256 * Determines if the packet pointed to by ipha or ip6h is an ICMP error. The 2257 * mp argument is only used to do bounds checking. 2258 */ 2259 static boolean_t 2260 is_icmp_error(mblk_t *mp, ipha_t *ipha, ip6_t *ip6h) 2261 { 2262 uint16_t hlen; 2263 2264 if (ipha != NULL) { 2265 icmph_t *icmph; 2266 2267 ASSERT(ip6h == NULL); 2268 if (ipha->ipha_protocol != IPPROTO_ICMP) 2269 return (B_FALSE); 2270 2271 hlen = IPH_HDR_LENGTH(ipha); 2272 icmph = (icmph_t *)((uint8_t *)ipha + hlen); 2273 return (ICMP_IS_ERROR(icmph->icmph_type) || 2274 icmph->icmph_type == ICMP_REDIRECT); 2275 } else { 2276 icmp6_t *icmp6; 2277 uint8_t *nexthdrp; 2278 2279 ASSERT(ip6h != NULL); 2280 if (!ip_hdr_length_nexthdr_v6(mp, ip6h, &hlen, &nexthdrp) || 2281 *nexthdrp != IPPROTO_ICMPV6) { 2282 return (B_FALSE); 2283 } 2284 2285 icmp6 = (icmp6_t *)((uint8_t *)ip6h + hlen); 2286 return (ICMP6_IS_ERROR(icmp6->icmp6_type) || 2287 icmp6->icmp6_type == ND_REDIRECT); 2288 } 2289 } 2290 2291 /* 2292 * Find inner and outer IP headers from a tunneled packet as setup for calls 2293 * into ipsec_tun_{in,out}bound(). 2294 * Note that we need to allow the outer header to be in a separate mblk from 2295 * the inner header. 2296 * If the caller knows the outer_hlen, the caller passes it in. Otherwise zero. 2297 */ 2298 static size_t 2299 iptun_find_headers(mblk_t *mp, size_t outer_hlen, ipha_t **outer4, 2300 ipha_t **inner4, ip6_t **outer6, ip6_t **inner6) 2301 { 2302 ipha_t *ipha; 2303 size_t first_mblkl = MBLKL(mp); 2304 mblk_t *inner_mp; 2305 2306 /* 2307 * Don't bother handling packets that don't have a full IP header in 2308 * the fist mblk. For the input path, the ip module ensures that this 2309 * won't happen, and on the output path, the IP tunneling MAC-type 2310 * plugins ensure that this also won't happen. 2311 */ 2312 if (first_mblkl < sizeof (ipha_t)) 2313 return (0); 2314 ipha = (ipha_t *)(mp->b_rptr); 2315 switch (IPH_HDR_VERSION(ipha)) { 2316 case IPV4_VERSION: 2317 *outer4 = ipha; 2318 *outer6 = NULL; 2319 if (outer_hlen == 0) 2320 outer_hlen = IPH_HDR_LENGTH(ipha); 2321 break; 2322 case IPV6_VERSION: 2323 *outer4 = NULL; 2324 *outer6 = (ip6_t *)ipha; 2325 if (outer_hlen == 0) 2326 outer_hlen = ip_hdr_length_v6(mp, (ip6_t *)ipha); 2327 break; 2328 default: 2329 return (0); 2330 } 2331 2332 if (first_mblkl < outer_hlen || 2333 (first_mblkl == outer_hlen && mp->b_cont == NULL)) 2334 return (0); 2335 2336 /* 2337 * We don't bother doing a pullup here since the outer header will 2338 * just get stripped off soon on input anyway. We just want to ensure 2339 * that the inner* pointer points to a full header. 2340 */ 2341 if (first_mblkl == outer_hlen) { 2342 inner_mp = mp->b_cont; 2343 ipha = (ipha_t *)inner_mp->b_rptr; 2344 } else { 2345 inner_mp = mp; 2346 ipha = (ipha_t *)(mp->b_rptr + outer_hlen); 2347 } 2348 switch (IPH_HDR_VERSION(ipha)) { 2349 case IPV4_VERSION: 2350 if (inner_mp->b_wptr - (uint8_t *)ipha < sizeof (ipha_t)) 2351 return (0); 2352 *inner4 = ipha; 2353 *inner6 = NULL; 2354 break; 2355 case IPV6_VERSION: 2356 if (inner_mp->b_wptr - (uint8_t *)ipha < sizeof (ip6_t)) 2357 return (0); 2358 *inner4 = NULL; 2359 *inner6 = (ip6_t *)ipha; 2360 break; 2361 default: 2362 return (0); 2363 } 2364 2365 return (outer_hlen); 2366 } 2367 2368 /* 2369 * Received ICMP error in response to an X over IPv4 packet that we 2370 * transmitted. 2371 * 2372 * NOTE: "outer" refers to what's inside the ICMP payload. We will get one of 2373 * the following: 2374 * 2375 * [IPv4(0)][ICMPv4][IPv4(1)][IPv4(2)][ULP] 2376 * 2377 * or 2378 * 2379 * [IPv4(0)][ICMPv4][IPv4(1)][IPv6][ULP] 2380 * 2381 * And "outer4" will get set to IPv4(1), and inner[46] will correspond to 2382 * whatever the very-inner packet is (IPv4(2) or IPv6). 2383 */ 2384 static void 2385 iptun_input_icmp_v4(iptun_t *iptun, mblk_t *data_mp, icmph_t *icmph, 2386 ip_recv_attr_t *ira) 2387 { 2388 uint8_t *orig; 2389 ipha_t *outer4, *inner4; 2390 ip6_t *outer6, *inner6; 2391 int outer_hlen; 2392 uint8_t type, code; 2393 2394 ASSERT(data_mp->b_cont == NULL); 2395 /* 2396 * Temporarily move b_rptr forward so that iptun_find_headers() can 2397 * find headers in the ICMP packet payload. 2398 */ 2399 orig = data_mp->b_rptr; 2400 data_mp->b_rptr = (uint8_t *)(icmph + 1); 2401 /* 2402 * The ip module ensures that ICMP errors contain at least the 2403 * original IP header (otherwise, the error would never have made it 2404 * here). 2405 */ 2406 ASSERT(MBLKL(data_mp) >= 0); 2407 outer_hlen = iptun_find_headers(data_mp, 0, &outer4, &inner4, &outer6, 2408 &inner6); 2409 ASSERT(outer6 == NULL); 2410 data_mp->b_rptr = orig; 2411 if (outer_hlen == 0) { 2412 iptun_drop_pkt(data_mp, &iptun->iptun_ierrors); 2413 return; 2414 } 2415 2416 /* Only ICMP errors due to tunneled packets should reach here. */ 2417 ASSERT(outer4->ipha_protocol == IPPROTO_ENCAP || 2418 outer4->ipha_protocol == IPPROTO_IPV6); 2419 2420 data_mp = ipsec_tun_inbound(ira, data_mp, iptun->iptun_itp, 2421 inner4, inner6, outer4, outer6, -outer_hlen, iptun->iptun_ns); 2422 if (data_mp == NULL) { 2423 /* Callee did all of the freeing. */ 2424 atomic_inc_64(&iptun->iptun_ierrors); 2425 return; 2426 } 2427 /* We should never see reassembled fragment here. */ 2428 ASSERT(data_mp->b_next == NULL); 2429 2430 data_mp->b_rptr = (uint8_t *)outer4 + outer_hlen; 2431 2432 /* 2433 * If the original packet being transmitted was itself an ICMP error, 2434 * then drop this packet. We don't want to generate an ICMP error in 2435 * response to an ICMP error. 2436 */ 2437 if (is_icmp_error(data_mp, inner4, inner6)) { 2438 iptun_drop_pkt(data_mp, &iptun->iptun_norcvbuf); 2439 return; 2440 } 2441 2442 switch (icmph->icmph_type) { 2443 case ICMP_DEST_UNREACHABLE: 2444 type = (inner4 != NULL ? icmph->icmph_type : ICMP6_DST_UNREACH); 2445 switch (icmph->icmph_code) { 2446 case ICMP_FRAGMENTATION_NEEDED: { 2447 uint32_t newmtu; 2448 2449 /* 2450 * We reconcile this with the fact that the tunnel may 2451 * also have IPsec policy by letting iptun_update_mtu 2452 * take care of it. 2453 */ 2454 newmtu = iptun_update_mtu(iptun, NULL, 2455 ntohs(icmph->icmph_du_mtu)); 2456 2457 if (inner4 != NULL) { 2458 iptun_icmp_fragneeded_v4(iptun, newmtu, inner4, 2459 data_mp, ira->ira_tsl); 2460 } else { 2461 iptun_icmp_toobig_v6(iptun, newmtu, inner6, 2462 data_mp, ira->ira_tsl); 2463 } 2464 return; 2465 } 2466 case ICMP_DEST_NET_UNREACH_ADMIN: 2467 case ICMP_DEST_HOST_UNREACH_ADMIN: 2468 code = (inner4 != NULL ? ICMP_DEST_NET_UNREACH_ADMIN : 2469 ICMP6_DST_UNREACH_ADMIN); 2470 break; 2471 default: 2472 code = (inner4 != NULL ? ICMP_HOST_UNREACHABLE : 2473 ICMP6_DST_UNREACH_ADDR); 2474 break; 2475 } 2476 break; 2477 case ICMP_TIME_EXCEEDED: 2478 if (inner6 != NULL) { 2479 type = ICMP6_TIME_EXCEEDED; 2480 code = 0; 2481 } /* else we're already set. */ 2482 break; 2483 case ICMP_PARAM_PROBLEM: 2484 /* 2485 * This is a problem with the outer header we transmitted. 2486 * Treat this as an output error. 2487 */ 2488 iptun_drop_pkt(data_mp, &iptun->iptun_oerrors); 2489 return; 2490 default: 2491 iptun_drop_pkt(data_mp, &iptun->iptun_norcvbuf); 2492 return; 2493 } 2494 2495 if (inner4 != NULL) { 2496 iptun_icmp_error_v4(iptun, inner4, data_mp, type, code, 2497 ira->ira_tsl); 2498 } else { 2499 iptun_icmp_error_v6(iptun, inner6, data_mp, type, code, 0, 2500 ira->ira_tsl); 2501 } 2502 } 2503 2504 /* 2505 * Return B_TRUE if the IPv6 packet pointed to by ip6h contains a Tunnel 2506 * Encapsulation Limit destination option. If there is one, set encaplim_ptr 2507 * to point to the option value. 2508 */ 2509 static boolean_t 2510 iptun_find_encaplimit(mblk_t *mp, ip6_t *ip6h, uint8_t **encaplim_ptr) 2511 { 2512 ip_pkt_t pkt; 2513 uint8_t *endptr; 2514 ip6_dest_t *destp; 2515 struct ip6_opt *optp; 2516 2517 pkt.ipp_fields = 0; /* must be initialized */ 2518 (void) ip_find_hdr_v6(mp, ip6h, B_FALSE, &pkt, NULL); 2519 if ((pkt.ipp_fields & IPPF_DSTOPTS) != 0) { 2520 destp = pkt.ipp_dstopts; 2521 } else if ((pkt.ipp_fields & IPPF_RTHDRDSTOPTS) != 0) { 2522 destp = pkt.ipp_rthdrdstopts; 2523 } else { 2524 return (B_FALSE); 2525 } 2526 2527 endptr = (uint8_t *)destp + 8 * (destp->ip6d_len + 1); 2528 optp = (struct ip6_opt *)(destp + 1); 2529 while (endptr - (uint8_t *)optp > sizeof (*optp)) { 2530 if (optp->ip6o_type == IP6OPT_TUNNEL_LIMIT) { 2531 if ((uint8_t *)(optp + 1) >= endptr) 2532 return (B_FALSE); 2533 *encaplim_ptr = (uint8_t *)&optp[1]; 2534 return (B_TRUE); 2535 } 2536 optp = (struct ip6_opt *)((uint8_t *)optp + optp->ip6o_len + 2); 2537 } 2538 return (B_FALSE); 2539 } 2540 2541 /* 2542 * Received ICMPv6 error in response to an X over IPv6 packet that we 2543 * transmitted. 2544 * 2545 * NOTE: "outer" refers to what's inside the ICMP payload. We will get one of 2546 * the following: 2547 * 2548 * [IPv6(0)][ICMPv6][IPv6(1)][IPv4][ULP] 2549 * 2550 * or 2551 * 2552 * [IPv6(0)][ICMPv6][IPv6(1)][IPv6(2)][ULP] 2553 * 2554 * And "outer6" will get set to IPv6(1), and inner[46] will correspond to 2555 * whatever the very-inner packet is (IPv4 or IPv6(2)). 2556 */ 2557 static void 2558 iptun_input_icmp_v6(iptun_t *iptun, mblk_t *data_mp, icmp6_t *icmp6h, 2559 ip_recv_attr_t *ira) 2560 { 2561 uint8_t *orig; 2562 ipha_t *outer4, *inner4; 2563 ip6_t *outer6, *inner6; 2564 int outer_hlen; 2565 uint8_t type, code; 2566 2567 ASSERT(data_mp->b_cont == NULL); 2568 2569 /* 2570 * Temporarily move b_rptr forward so that iptun_find_headers() can 2571 * find IP headers in the ICMP packet payload. 2572 */ 2573 orig = data_mp->b_rptr; 2574 data_mp->b_rptr = (uint8_t *)(icmp6h + 1); 2575 /* 2576 * The ip module ensures that ICMP errors contain at least the 2577 * original IP header (otherwise, the error would never have made it 2578 * here). 2579 */ 2580 ASSERT(MBLKL(data_mp) >= 0); 2581 outer_hlen = iptun_find_headers(data_mp, 0, &outer4, &inner4, &outer6, 2582 &inner6); 2583 ASSERT(outer4 == NULL); 2584 data_mp->b_rptr = orig; /* Restore r_ptr */ 2585 if (outer_hlen == 0) { 2586 iptun_drop_pkt(data_mp, &iptun->iptun_ierrors); 2587 return; 2588 } 2589 2590 data_mp = ipsec_tun_inbound(ira, data_mp, iptun->iptun_itp, 2591 inner4, inner6, outer4, outer6, -outer_hlen, iptun->iptun_ns); 2592 if (data_mp == NULL) { 2593 /* Callee did all of the freeing. */ 2594 atomic_inc_64(&iptun->iptun_ierrors); 2595 return; 2596 } 2597 /* We should never see reassembled fragment here. */ 2598 ASSERT(data_mp->b_next == NULL); 2599 2600 data_mp->b_rptr = (uint8_t *)outer6 + outer_hlen; 2601 2602 /* 2603 * If the original packet being transmitted was itself an ICMP error, 2604 * then drop this packet. We don't want to generate an ICMP error in 2605 * response to an ICMP error. 2606 */ 2607 if (is_icmp_error(data_mp, inner4, inner6)) { 2608 iptun_drop_pkt(data_mp, &iptun->iptun_norcvbuf); 2609 return; 2610 } 2611 2612 switch (icmp6h->icmp6_type) { 2613 case ICMP6_PARAM_PROB: { 2614 uint8_t *encaplim_ptr; 2615 2616 /* 2617 * If the ICMPv6 error points to a valid Tunnel Encapsulation 2618 * Limit option and the limit value is 0, then fall through 2619 * and send a host unreachable message. Otherwise, treat the 2620 * error as an output error, as there must have been a problem 2621 * with a packet we sent. 2622 */ 2623 if (!iptun_find_encaplimit(data_mp, outer6, &encaplim_ptr) || 2624 (icmp6h->icmp6_pptr != 2625 ((ptrdiff_t)encaplim_ptr - (ptrdiff_t)outer6)) || 2626 *encaplim_ptr != 0) { 2627 iptun_drop_pkt(data_mp, &iptun->iptun_oerrors); 2628 return; 2629 } 2630 /* FALLTHRU */ 2631 } 2632 case ICMP6_TIME_EXCEEDED: 2633 case ICMP6_DST_UNREACH: 2634 type = (inner4 != NULL ? ICMP_DEST_UNREACHABLE : 2635 ICMP6_DST_UNREACH); 2636 code = (inner4 != NULL ? ICMP_HOST_UNREACHABLE : 2637 ICMP6_DST_UNREACH_ADDR); 2638 break; 2639 case ICMP6_PACKET_TOO_BIG: { 2640 uint32_t newmtu; 2641 2642 /* 2643 * We reconcile this with the fact that the tunnel may also 2644 * have IPsec policy by letting iptun_update_mtu take care of 2645 * it. 2646 */ 2647 newmtu = iptun_update_mtu(iptun, NULL, 2648 ntohl(icmp6h->icmp6_mtu)); 2649 2650 if (inner4 != NULL) { 2651 iptun_icmp_fragneeded_v4(iptun, newmtu, inner4, 2652 data_mp, ira->ira_tsl); 2653 } else { 2654 iptun_icmp_toobig_v6(iptun, newmtu, inner6, data_mp, 2655 ira->ira_tsl); 2656 } 2657 return; 2658 } 2659 default: 2660 iptun_drop_pkt(data_mp, &iptun->iptun_norcvbuf); 2661 return; 2662 } 2663 2664 if (inner4 != NULL) { 2665 iptun_icmp_error_v4(iptun, inner4, data_mp, type, code, 2666 ira->ira_tsl); 2667 } else { 2668 iptun_icmp_error_v6(iptun, inner6, data_mp, type, code, 0, 2669 ira->ira_tsl); 2670 } 2671 } 2672 2673 /* 2674 * Called as conn_recvicmp from IP for ICMP errors. 2675 */ 2676 /* ARGSUSED2 */ 2677 static void 2678 iptun_input_icmp(void *arg, mblk_t *mp, void *arg2, ip_recv_attr_t *ira) 2679 { 2680 conn_t *connp = arg; 2681 iptun_t *iptun = connp->conn_iptun; 2682 mblk_t *tmpmp; 2683 size_t hlen; 2684 2685 ASSERT(IPCL_IS_IPTUN(connp)); 2686 2687 if (mp->b_cont != NULL) { 2688 /* 2689 * Since ICMP error processing necessitates access to bits 2690 * that are within the ICMP error payload (the original packet 2691 * that caused the error), pull everything up into a single 2692 * block for convenience. 2693 */ 2694 if ((tmpmp = msgpullup(mp, -1)) == NULL) { 2695 iptun_drop_pkt(mp, &iptun->iptun_norcvbuf); 2696 return; 2697 } 2698 freemsg(mp); 2699 mp = tmpmp; 2700 } 2701 2702 hlen = ira->ira_ip_hdr_length; 2703 switch (iptun->iptun_typeinfo->iti_ipvers) { 2704 case IPV4_VERSION: 2705 /* 2706 * The outer IP header coming up from IP is always ipha_t 2707 * alligned (otherwise, we would have crashed in ip). 2708 */ 2709 iptun_input_icmp_v4(iptun, mp, (icmph_t *)(mp->b_rptr + hlen), 2710 ira); 2711 break; 2712 case IPV6_VERSION: 2713 iptun_input_icmp_v6(iptun, mp, (icmp6_t *)(mp->b_rptr + hlen), 2714 ira); 2715 break; 2716 } 2717 } 2718 2719 static boolean_t 2720 iptun_in_6to4_ok(iptun_t *iptun, ipha_t *outer4, ip6_t *inner6) 2721 { 2722 ipaddr_t v4addr; 2723 2724 /* 2725 * It's possible that someone sent us an IPv4-in-IPv4 packet with the 2726 * IPv4 address of a 6to4 tunnel as the destination. 2727 */ 2728 if (inner6 == NULL) 2729 return (B_FALSE); 2730 2731 /* 2732 * Make sure that the IPv6 destination is within the site that this 2733 * 6to4 tunnel is routing for. We don't want people bouncing random 2734 * tunneled IPv6 packets through this 6to4 router. 2735 */ 2736 IN6_6TO4_TO_V4ADDR(&inner6->ip6_dst, (struct in_addr *)&v4addr); 2737 if (outer4->ipha_dst != v4addr) 2738 return (B_FALSE); 2739 2740 if (IN6_IS_ADDR_6TO4(&inner6->ip6_src)) { 2741 /* 2742 * Section 9 of RFC 3056 (security considerations) suggests 2743 * that when a packet is from a 6to4 site (i.e., it's not a 2744 * global address being forwarded froma relay router), make 2745 * sure that the packet was tunneled by that site's 6to4 2746 * router. 2747 */ 2748 IN6_6TO4_TO_V4ADDR(&inner6->ip6_src, (struct in_addr *)&v4addr); 2749 if (outer4->ipha_src != v4addr) 2750 return (B_FALSE); 2751 } else { 2752 /* 2753 * Only accept packets from a relay router if we've configured 2754 * outbound relay router functionality. 2755 */ 2756 if (iptun->iptun_iptuns->iptuns_relay_rtr_addr == INADDR_ANY) 2757 return (B_FALSE); 2758 } 2759 2760 return (B_TRUE); 2761 } 2762 2763 /* 2764 * Input function for everything that comes up from the ip module below us. 2765 * This is called directly from the ip module via connp->conn_recv(). 2766 * 2767 * We receive M_DATA messages with IP-in-IP tunneled packets. 2768 */ 2769 /* ARGSUSED2 */ 2770 static void 2771 iptun_input(void *arg, mblk_t *data_mp, void *arg2, ip_recv_attr_t *ira) 2772 { 2773 conn_t *connp = arg; 2774 iptun_t *iptun = connp->conn_iptun; 2775 int outer_hlen; 2776 ipha_t *outer4, *inner4; 2777 ip6_t *outer6, *inner6; 2778 2779 ASSERT(IPCL_IS_IPTUN(connp)); 2780 ASSERT(DB_TYPE(data_mp) == M_DATA); 2781 2782 outer_hlen = iptun_find_headers(data_mp, ira->ira_ip_hdr_length, 2783 &outer4, &inner4, &outer6, &inner6); 2784 if (outer_hlen == 0) 2785 goto drop; 2786 2787 /* 2788 * If the system is labeled, we call tsol_check_dest() on the packet 2789 * destination (our local tunnel address) to ensure that the packet as 2790 * labeled should be allowed to be sent to us. We don't need to call 2791 * the more involved tsol_receive_local() since the tunnel link itself 2792 * cannot be assigned to shared-stack non-global zones. 2793 */ 2794 if (ira->ira_flags & IRAF_SYSTEM_LABELED) { 2795 if (ira->ira_tsl == NULL) 2796 goto drop; 2797 if (tsol_check_dest(ira->ira_tsl, (outer4 != NULL ? 2798 (void *)&outer4->ipha_dst : (void *)&outer6->ip6_dst), 2799 (outer4 != NULL ? IPV4_VERSION : IPV6_VERSION), 2800 CONN_MAC_DEFAULT, B_FALSE, NULL) != 0) 2801 goto drop; 2802 } 2803 2804 data_mp = ipsec_tun_inbound(ira, data_mp, iptun->iptun_itp, 2805 inner4, inner6, outer4, outer6, outer_hlen, iptun->iptun_ns); 2806 if (data_mp == NULL) { 2807 /* Callee did all of the freeing. */ 2808 return; 2809 } 2810 2811 if (iptun->iptun_typeinfo->iti_type == IPTUN_TYPE_6TO4 && 2812 !iptun_in_6to4_ok(iptun, outer4, inner6)) 2813 goto drop; 2814 2815 /* 2816 * We need to statistically account for each packet individually, so 2817 * we might as well split up any b_next chains here. 2818 */ 2819 do { 2820 mblk_t *mp; 2821 2822 mp = data_mp->b_next; 2823 data_mp->b_next = NULL; 2824 2825 atomic_inc_64(&iptun->iptun_ipackets); 2826 atomic_add_64(&iptun->iptun_rbytes, msgdsize(data_mp)); 2827 mac_rx(iptun->iptun_mh, NULL, data_mp); 2828 2829 data_mp = mp; 2830 } while (data_mp != NULL); 2831 return; 2832 drop: 2833 iptun_drop_pkt(data_mp, &iptun->iptun_ierrors); 2834 } 2835 2836 /* 2837 * Do 6to4-specific header-processing on output. Return B_TRUE if the packet 2838 * was processed without issue, or B_FALSE if the packet had issues and should 2839 * be dropped. 2840 */ 2841 static boolean_t 2842 iptun_out_process_6to4(iptun_t *iptun, ipha_t *outer4, ip6_t *inner6) 2843 { 2844 ipaddr_t v4addr; 2845 2846 /* 2847 * IPv6 source must be a 6to4 address. This is because a conscious 2848 * decision was made to not allow a Solaris system to be used as a 2849 * relay router (for security reasons) when 6to4 was initially 2850 * integrated. If this decision is ever reversed, the following check 2851 * can be removed. 2852 */ 2853 if (!IN6_IS_ADDR_6TO4(&inner6->ip6_src)) 2854 return (B_FALSE); 2855 2856 /* 2857 * RFC3056 mandates that the IPv4 source MUST be set to the IPv4 2858 * portion of the 6to4 IPv6 source address. In other words, make sure 2859 * that we're tunneling packets from our own 6to4 site. 2860 */ 2861 IN6_6TO4_TO_V4ADDR(&inner6->ip6_src, (struct in_addr *)&v4addr); 2862 if (outer4->ipha_src != v4addr) 2863 return (B_FALSE); 2864 2865 /* 2866 * Automatically set the destination of the outer IPv4 header as 2867 * described in RFC3056. There are two possibilities: 2868 * 2869 * a. If the IPv6 destination is a 6to4 address, set the IPv4 address 2870 * to the IPv4 portion of the 6to4 address. 2871 * b. If the IPv6 destination is a native IPv6 address, set the IPv4 2872 * destination to the address of a relay router. 2873 * 2874 * Design Note: b shouldn't be necessary here, and this is a flaw in 2875 * the design of the 6to4relay command. Instead of setting a 6to4 2876 * relay address in this module via an ioctl, the 6to4relay command 2877 * could simply add a IPv6 route for native IPv6 addresses (such as a 2878 * default route) in the forwarding table that uses a 6to4 destination 2879 * as its next hop, and the IPv4 portion of that address could be a 2880 * 6to4 relay address. In order for this to work, IP would have to 2881 * resolve the next hop address, which would necessitate a link-layer 2882 * address resolver for 6to4 links, which doesn't exist today. 2883 * 2884 * In fact, if a resolver existed for 6to4 links, then setting the 2885 * IPv4 destination in the outer header could be done as part of 2886 * link-layer address resolution and fast-path header generation, and 2887 * not here. 2888 */ 2889 if (IN6_IS_ADDR_6TO4(&inner6->ip6_dst)) { 2890 /* destination is a 6to4 router */ 2891 IN6_6TO4_TO_V4ADDR(&inner6->ip6_dst, 2892 (struct in_addr *)&outer4->ipha_dst); 2893 2894 /* Reject attempts to send to INADDR_ANY */ 2895 if (outer4->ipha_dst == INADDR_ANY) 2896 return (B_FALSE); 2897 } else { 2898 /* 2899 * The destination is a native IPv6 address. If output to a 2900 * relay-router is enabled, use the relay-router's IPv4 2901 * address as the destination. 2902 */ 2903 if (iptun->iptun_iptuns->iptuns_relay_rtr_addr == INADDR_ANY) 2904 return (B_FALSE); 2905 outer4->ipha_dst = iptun->iptun_iptuns->iptuns_relay_rtr_addr; 2906 } 2907 2908 /* 2909 * If the outer source and destination are equal, this means that the 2910 * 6to4 router somehow forwarded an IPv6 packet destined for its own 2911 * 6to4 site to its 6to4 tunnel interface, which will result in this 2912 * packet infinitely bouncing between ip and iptun. 2913 */ 2914 return (outer4->ipha_src != outer4->ipha_dst); 2915 } 2916 2917 /* 2918 * Process output packets with outer IPv4 headers. Frees mp and bumps stat on 2919 * error. 2920 */ 2921 static mblk_t * 2922 iptun_out_process_ipv4(iptun_t *iptun, mblk_t *mp, ipha_t *outer4, 2923 ipha_t *inner4, ip6_t *inner6, ip_xmit_attr_t *ixa) 2924 { 2925 uint8_t *innerptr = (inner4 != NULL ? 2926 (uint8_t *)inner4 : (uint8_t *)inner6); 2927 size_t minmtu = iptun->iptun_typeinfo->iti_minmtu; 2928 2929 if (inner4 != NULL) { 2930 ASSERT(outer4->ipha_protocol == IPPROTO_ENCAP); 2931 /* 2932 * Copy the tos from the inner IPv4 header. We mask off ECN 2933 * bits (bits 6 and 7) because there is currently no 2934 * tunnel-tunnel communication to determine if both sides 2935 * support ECN. We opt for the safe choice: don't copy the 2936 * ECN bits when doing encapsulation. 2937 */ 2938 outer4->ipha_type_of_service = 2939 inner4->ipha_type_of_service & ~0x03; 2940 } else { 2941 ASSERT(outer4->ipha_protocol == IPPROTO_IPV6 && 2942 inner6 != NULL); 2943 } 2944 if (ixa->ixa_flags & IXAF_PMTU_IPV4_DF) 2945 outer4->ipha_fragment_offset_and_flags |= IPH_DF_HTONS; 2946 else 2947 outer4->ipha_fragment_offset_and_flags &= ~IPH_DF_HTONS; 2948 2949 /* 2950 * As described in section 3.2.2 of RFC4213, if the packet payload is 2951 * less than or equal to the minimum MTU size, then we need to allow 2952 * IPv4 to fragment the packet. The reason is that even if we end up 2953 * receiving an ICMP frag-needed, the interface above this tunnel 2954 * won't be allowed to drop its MTU as a result, since the packet was 2955 * already smaller than the smallest allowable MTU for that interface. 2956 */ 2957 if (mp->b_wptr - innerptr <= minmtu) { 2958 outer4->ipha_fragment_offset_and_flags = 0; 2959 ixa->ixa_flags &= ~IXAF_DONTFRAG; 2960 } else if (!(ixa->ixa_flags & IXAF_PMTU_TOO_SMALL) && 2961 (iptun->iptun_typeinfo->iti_type != IPTUN_TYPE_6TO4)) { 2962 ixa->ixa_flags |= IXAF_DONTFRAG; 2963 } 2964 2965 ixa->ixa_ip_hdr_length = IPH_HDR_LENGTH(outer4); 2966 ixa->ixa_pktlen = msgdsize(mp); 2967 ixa->ixa_protocol = outer4->ipha_protocol; 2968 2969 outer4->ipha_length = htons(ixa->ixa_pktlen); 2970 return (mp); 2971 } 2972 2973 /* 2974 * Insert an encapsulation limit destination option in the packet provided. 2975 * Always consumes the mp argument and returns a new mblk pointer. 2976 */ 2977 static mblk_t * 2978 iptun_insert_encaplimit(iptun_t *iptun, mblk_t *mp, ip6_t *outer6, 2979 uint8_t limit) 2980 { 2981 mblk_t *newmp; 2982 iptun_ipv6hdrs_t *newouter6; 2983 2984 ASSERT(outer6->ip6_nxt == IPPROTO_IPV6); 2985 ASSERT(mp->b_cont == NULL); 2986 2987 mp->b_rptr += sizeof (ip6_t); 2988 newmp = allocb(sizeof (iptun_ipv6hdrs_t) + MBLKL(mp), BPRI_MED); 2989 if (newmp == NULL) { 2990 iptun_drop_pkt(mp, &iptun->iptun_noxmtbuf); 2991 return (NULL); 2992 } 2993 newmp->b_wptr += sizeof (iptun_ipv6hdrs_t); 2994 /* Copy the payload (Starting with the inner IPv6 header). */ 2995 bcopy(mp->b_rptr, newmp->b_wptr, MBLKL(mp)); 2996 newmp->b_wptr += MBLKL(mp); 2997 newouter6 = (iptun_ipv6hdrs_t *)newmp->b_rptr; 2998 /* Now copy the outer IPv6 header. */ 2999 bcopy(outer6, &newouter6->it6h_ip6h, sizeof (ip6_t)); 3000 newouter6->it6h_ip6h.ip6_nxt = IPPROTO_DSTOPTS; 3001 newouter6->it6h_encaplim = iptun_encaplim_init; 3002 newouter6->it6h_encaplim.iel_destopt.ip6d_nxt = outer6->ip6_nxt; 3003 newouter6->it6h_encaplim.iel_telopt.ip6ot_encap_limit = limit; 3004 3005 /* 3006 * The payload length will be set at the end of 3007 * iptun_out_process_ipv6(). 3008 */ 3009 3010 freemsg(mp); 3011 return (newmp); 3012 } 3013 3014 /* 3015 * Process output packets with outer IPv6 headers. Frees mp and bumps stats 3016 * on error. 3017 */ 3018 static mblk_t * 3019 iptun_out_process_ipv6(iptun_t *iptun, mblk_t *mp, ip6_t *outer6, 3020 ipha_t *inner4, ip6_t *inner6, ip_xmit_attr_t *ixa) 3021 { 3022 uint8_t *innerptr = (inner4 != NULL ? 3023 (uint8_t *)inner4 : (uint8_t *)inner6); 3024 size_t minmtu = iptun->iptun_typeinfo->iti_minmtu; 3025 uint8_t *limit, *configlimit; 3026 uint32_t offset; 3027 iptun_ipv6hdrs_t *v6hdrs; 3028 3029 if (inner6 != NULL && iptun_find_encaplimit(mp, inner6, &limit)) { 3030 /* 3031 * The inner packet is an IPv6 packet which itself contains an 3032 * encapsulation limit option. The limit variable points to 3033 * the value in the embedded option. Process the 3034 * encapsulation limit option as specified in RFC 2473. 3035 * 3036 * If limit is 0, then we've exceeded the limit and we need to 3037 * send back an ICMPv6 parameter problem message. 3038 * 3039 * If limit is > 0, then we decrement it by 1 and make sure 3040 * that the encapsulation limit option in the outer header 3041 * reflects that (adding an option if one isn't already 3042 * there). 3043 */ 3044 ASSERT(limit > mp->b_rptr && limit < mp->b_wptr); 3045 if (*limit == 0) { 3046 mp->b_rptr = (uint8_t *)inner6; 3047 offset = limit - mp->b_rptr; 3048 iptun_icmp_error_v6(iptun, inner6, mp, ICMP6_PARAM_PROB, 3049 0, offset, ixa->ixa_tsl); 3050 atomic_inc_64(&iptun->iptun_noxmtbuf); 3051 return (NULL); 3052 } 3053 3054 /* 3055 * The outer header requires an encapsulation limit option. 3056 * If there isn't one already, add one. 3057 */ 3058 if (iptun->iptun_encaplimit == 0) { 3059 if ((mp = iptun_insert_encaplimit(iptun, mp, outer6, 3060 (*limit - 1))) == NULL) 3061 return (NULL); 3062 v6hdrs = (iptun_ipv6hdrs_t *)mp->b_rptr; 3063 } else { 3064 /* 3065 * There is an existing encapsulation limit option in 3066 * the outer header. If the inner encapsulation limit 3067 * is less than the configured encapsulation limit, 3068 * update the outer encapsulation limit to reflect 3069 * this lesser value. 3070 */ 3071 v6hdrs = (iptun_ipv6hdrs_t *)mp->b_rptr; 3072 configlimit = 3073 &v6hdrs->it6h_encaplim.iel_telopt.ip6ot_encap_limit; 3074 if ((*limit - 1) < *configlimit) 3075 *configlimit = (*limit - 1); 3076 } 3077 ixa->ixa_ip_hdr_length = sizeof (iptun_ipv6hdrs_t); 3078 ixa->ixa_protocol = v6hdrs->it6h_encaplim.iel_destopt.ip6d_nxt; 3079 } else { 3080 ixa->ixa_ip_hdr_length = sizeof (ip6_t); 3081 ixa->ixa_protocol = outer6->ip6_nxt; 3082 } 3083 /* 3084 * See iptun_output_process_ipv4() why we allow fragmentation for 3085 * small packets 3086 */ 3087 if (mp->b_wptr - innerptr <= minmtu) 3088 ixa->ixa_flags &= ~IXAF_DONTFRAG; 3089 else if (!(ixa->ixa_flags & IXAF_PMTU_TOO_SMALL)) 3090 ixa->ixa_flags |= IXAF_DONTFRAG; 3091 3092 ixa->ixa_pktlen = msgdsize(mp); 3093 outer6->ip6_plen = htons(ixa->ixa_pktlen - sizeof (ip6_t)); 3094 return (mp); 3095 } 3096 3097 /* 3098 * The IP tunneling MAC-type plugins have already done most of the header 3099 * processing and validity checks. We are simply responsible for multiplexing 3100 * down to the ip module below us. 3101 */ 3102 static void 3103 iptun_output(iptun_t *iptun, mblk_t *mp) 3104 { 3105 conn_t *connp = iptun->iptun_connp; 3106 mblk_t *newmp; 3107 int error; 3108 ip_xmit_attr_t *ixa; 3109 3110 ASSERT(mp->b_datap->db_type == M_DATA); 3111 3112 if (mp->b_cont != NULL) { 3113 if ((newmp = msgpullup(mp, -1)) == NULL) { 3114 iptun_drop_pkt(mp, &iptun->iptun_noxmtbuf); 3115 return; 3116 } 3117 freemsg(mp); 3118 mp = newmp; 3119 } 3120 3121 if (iptun->iptun_typeinfo->iti_type == IPTUN_TYPE_6TO4) { 3122 iptun_output_6to4(iptun, mp); 3123 return; 3124 } 3125 3126 if (is_system_labeled()) { 3127 /* 3128 * Since the label can be different meaning a potentially 3129 * different IRE,we always use a unique ip_xmit_attr_t. 3130 */ 3131 ixa = conn_get_ixa_exclusive(connp); 3132 } else { 3133 /* 3134 * If no other thread is using conn_ixa this just gets a 3135 * reference to conn_ixa. Otherwise we get a safe copy of 3136 * conn_ixa. 3137 */ 3138 ixa = conn_get_ixa(connp, B_FALSE); 3139 } 3140 if (ixa == NULL) { 3141 iptun_drop_pkt(mp, &iptun->iptun_oerrors); 3142 return; 3143 } 3144 3145 /* 3146 * In case we got a safe copy of conn_ixa, then we need 3147 * to fill in any pointers in it. 3148 */ 3149 if (ixa->ixa_ire == NULL) { 3150 error = ip_attr_connect(connp, ixa, &connp->conn_saddr_v6, 3151 &connp->conn_faddr_v6, &connp->conn_faddr_v6, 0, 3152 NULL, NULL, 0); 3153 if (error != 0) { 3154 if (ixa->ixa_ire != NULL && 3155 (error == EHOSTUNREACH || error == ENETUNREACH)) { 3156 /* 3157 * Let conn_ip_output/ire_send_noroute return 3158 * the error and send any local ICMP error. 3159 */ 3160 error = 0; 3161 } else { 3162 ixa_refrele(ixa); 3163 iptun_drop_pkt(mp, &iptun->iptun_oerrors); 3164 return; 3165 } 3166 } 3167 } 3168 3169 iptun_output_common(iptun, ixa, mp); 3170 ixa_refrele(ixa); 3171 } 3172 3173 /* 3174 * We use an ixa based on the last destination. 3175 */ 3176 static void 3177 iptun_output_6to4(iptun_t *iptun, mblk_t *mp) 3178 { 3179 conn_t *connp = iptun->iptun_connp; 3180 ipha_t *outer4, *inner4; 3181 ip6_t *outer6, *inner6; 3182 ip_xmit_attr_t *ixa; 3183 ip_xmit_attr_t *oldixa; 3184 int error; 3185 boolean_t need_connect; 3186 in6_addr_t v6dst; 3187 3188 ASSERT(mp->b_cont == NULL); /* Verified by iptun_output */ 3189 3190 /* Make sure we set ipha_dst before we look at ipha_dst */ 3191 3192 (void) iptun_find_headers(mp, 0, &outer4, &inner4, &outer6, &inner6); 3193 ASSERT(outer4 != NULL); 3194 if (!iptun_out_process_6to4(iptun, outer4, inner6)) { 3195 iptun_drop_pkt(mp, &iptun->iptun_oerrors); 3196 return; 3197 } 3198 3199 if (is_system_labeled()) { 3200 /* 3201 * Since the label can be different meaning a potentially 3202 * different IRE,we always use a unique ip_xmit_attr_t. 3203 */ 3204 ixa = conn_get_ixa_exclusive(connp); 3205 } else { 3206 /* 3207 * If no other thread is using conn_ixa this just gets a 3208 * reference to conn_ixa. Otherwise we get a safe copy of 3209 * conn_ixa. 3210 */ 3211 ixa = conn_get_ixa(connp, B_FALSE); 3212 } 3213 if (ixa == NULL) { 3214 iptun_drop_pkt(mp, &iptun->iptun_oerrors); 3215 return; 3216 } 3217 3218 mutex_enter(&connp->conn_lock); 3219 if (connp->conn_v4lastdst == outer4->ipha_dst) { 3220 need_connect = (ixa->ixa_ire == NULL); 3221 } else { 3222 /* In case previous destination was multirt */ 3223 ip_attr_newdst(ixa); 3224 3225 /* 3226 * We later update conn_ixa when we update conn_v4lastdst 3227 * which enables subsequent packets to avoid redoing 3228 * ip_attr_connect 3229 */ 3230 need_connect = B_TRUE; 3231 } 3232 mutex_exit(&connp->conn_lock); 3233 3234 /* 3235 * In case we got a safe copy of conn_ixa, or otherwise we don't 3236 * have a current ixa_ire, then we need to fill in any pointers in 3237 * the ixa. 3238 */ 3239 if (need_connect) { 3240 IN6_IPADDR_TO_V4MAPPED(outer4->ipha_dst, &v6dst); 3241 3242 /* We handle IPsec in iptun_output_common */ 3243 error = ip_attr_connect(connp, ixa, &connp->conn_saddr_v6, 3244 &v6dst, &v6dst, 0, NULL, NULL, 0); 3245 if (error != 0) { 3246 if (ixa->ixa_ire != NULL && 3247 (error == EHOSTUNREACH || error == ENETUNREACH)) { 3248 /* 3249 * Let conn_ip_output/ire_send_noroute return 3250 * the error and send any local ICMP error. 3251 */ 3252 error = 0; 3253 } else { 3254 ixa_refrele(ixa); 3255 iptun_drop_pkt(mp, &iptun->iptun_oerrors); 3256 return; 3257 } 3258 } 3259 } 3260 3261 iptun_output_common(iptun, ixa, mp); 3262 3263 /* Atomically replace conn_ixa and conn_v4lastdst */ 3264 mutex_enter(&connp->conn_lock); 3265 if (connp->conn_v4lastdst != outer4->ipha_dst) { 3266 /* Remember the dst which corresponds to conn_ixa */ 3267 connp->conn_v6lastdst = v6dst; 3268 oldixa = conn_replace_ixa(connp, ixa); 3269 } else { 3270 oldixa = NULL; 3271 } 3272 mutex_exit(&connp->conn_lock); 3273 ixa_refrele(ixa); 3274 if (oldixa != NULL) 3275 ixa_refrele(oldixa); 3276 } 3277 3278 /* 3279 * Check the destination/label. Modifies *mpp by adding/removing CIPSO. 3280 * 3281 * We get the label from the message in order to honor the 3282 * ULPs/IPs choice of label. This will be NULL for forwarded 3283 * packets, neighbor discovery packets and some others. 3284 */ 3285 static int 3286 iptun_output_check_label(mblk_t **mpp, ip_xmit_attr_t *ixa) 3287 { 3288 cred_t *cr; 3289 int adjust; 3290 int iplen; 3291 int err; 3292 ts_label_t *effective_tsl = NULL; 3293 3294 3295 ASSERT(is_system_labeled()); 3296 3297 cr = msg_getcred(*mpp, NULL); 3298 if (cr == NULL) 3299 return (0); 3300 3301 /* 3302 * We need to start with a label based on the IP/ULP above us 3303 */ 3304 ip_xmit_attr_restore_tsl(ixa, cr); 3305 3306 /* 3307 * Need to update packet with any CIPSO option since 3308 * conn_ip_output doesn't do that. 3309 */ 3310 if (ixa->ixa_flags & IXAF_IS_IPV4) { 3311 ipha_t *ipha; 3312 3313 ipha = (ipha_t *)(*mpp)->b_rptr; 3314 iplen = ntohs(ipha->ipha_length); 3315 err = tsol_check_label_v4(ixa->ixa_tsl, 3316 ixa->ixa_zoneid, mpp, CONN_MAC_DEFAULT, B_FALSE, 3317 ixa->ixa_ipst, &effective_tsl); 3318 if (err != 0) 3319 return (err); 3320 3321 ipha = (ipha_t *)(*mpp)->b_rptr; 3322 adjust = (int)ntohs(ipha->ipha_length) - iplen; 3323 } else { 3324 ip6_t *ip6h; 3325 3326 ip6h = (ip6_t *)(*mpp)->b_rptr; 3327 iplen = ntohs(ip6h->ip6_plen); 3328 3329 err = tsol_check_label_v6(ixa->ixa_tsl, 3330 ixa->ixa_zoneid, mpp, CONN_MAC_DEFAULT, B_FALSE, 3331 ixa->ixa_ipst, &effective_tsl); 3332 if (err != 0) 3333 return (err); 3334 3335 ip6h = (ip6_t *)(*mpp)->b_rptr; 3336 adjust = (int)ntohs(ip6h->ip6_plen) - iplen; 3337 } 3338 3339 if (effective_tsl != NULL) { 3340 /* Update the label */ 3341 ip_xmit_attr_replace_tsl(ixa, effective_tsl); 3342 } 3343 ixa->ixa_pktlen += adjust; 3344 ixa->ixa_ip_hdr_length += adjust; 3345 return (0); 3346 } 3347 3348 3349 static void 3350 iptun_output_common(iptun_t *iptun, ip_xmit_attr_t *ixa, mblk_t *mp) 3351 { 3352 ipsec_tun_pol_t *itp = iptun->iptun_itp; 3353 int outer_hlen; 3354 mblk_t *newmp; 3355 ipha_t *outer4, *inner4; 3356 ip6_t *outer6, *inner6; 3357 int error; 3358 boolean_t update_pktlen; 3359 3360 ASSERT(ixa->ixa_ire != NULL); 3361 3362 outer_hlen = iptun_find_headers(mp, 0, &outer4, &inner4, &outer6, 3363 &inner6); 3364 if (outer_hlen == 0) { 3365 iptun_drop_pkt(mp, &iptun->iptun_oerrors); 3366 return; 3367 } 3368 3369 /* Save IXAF_DONTFRAG value */ 3370 iaflags_t dontfrag = ixa->ixa_flags & IXAF_DONTFRAG; 3371 3372 /* Perform header processing. */ 3373 if (outer4 != NULL) { 3374 mp = iptun_out_process_ipv4(iptun, mp, outer4, inner4, inner6, 3375 ixa); 3376 } else { 3377 mp = iptun_out_process_ipv6(iptun, mp, outer6, inner4, inner6, 3378 ixa); 3379 } 3380 if (mp == NULL) 3381 return; 3382 3383 /* 3384 * Let's hope the compiler optimizes this with "branch taken". 3385 */ 3386 if (itp != NULL && (itp->itp_flags & ITPF_P_ACTIVE)) { 3387 /* This updates the ip_xmit_attr_t */ 3388 mp = ipsec_tun_outbound(mp, iptun, inner4, inner6, outer4, 3389 outer6, outer_hlen, ixa); 3390 if (mp == NULL) { 3391 atomic_inc_64(&iptun->iptun_oerrors); 3392 return; 3393 } 3394 if (is_system_labeled()) { 3395 /* 3396 * Might change the packet by adding/removing CIPSO. 3397 * After this caller inner* and outer* and outer_hlen 3398 * might be invalid. 3399 */ 3400 error = iptun_output_check_label(&mp, ixa); 3401 if (error != 0) { 3402 ip2dbg(("label check failed (%d)\n", error)); 3403 iptun_drop_pkt(mp, &iptun->iptun_oerrors); 3404 return; 3405 } 3406 } 3407 3408 /* 3409 * ipsec_tun_outbound() returns a chain of tunneled IP 3410 * fragments linked with b_next (or a single message if the 3411 * tunneled packet wasn't a fragment). 3412 * If fragcache returned a list then we need to update 3413 * ixa_pktlen for all packets in the list. 3414 */ 3415 update_pktlen = (mp->b_next != NULL); 3416 3417 /* 3418 * Otherwise, we're good to go. The ixa has been updated with 3419 * instructions for outbound IPsec processing. 3420 */ 3421 for (newmp = mp; newmp != NULL; newmp = mp) { 3422 size_t minmtu = iptun->iptun_typeinfo->iti_minmtu; 3423 3424 atomic_inc_64(&iptun->iptun_opackets); 3425 atomic_add_64(&iptun->iptun_obytes, ixa->ixa_pktlen); 3426 mp = mp->b_next; 3427 newmp->b_next = NULL; 3428 3429 /* 3430 * The IXAF_DONTFRAG flag is global, but there is 3431 * a chain here. Check if we're really already 3432 * smaller than the minimum allowed MTU and reset here 3433 * appropriately. Otherwise one small packet can kill 3434 * the whole chain's path mtu discovery. 3435 * In addition, update the pktlen to the length of 3436 * the actual packet being processed. 3437 */ 3438 if (update_pktlen) { 3439 ixa->ixa_pktlen = msgdsize(newmp); 3440 if (ixa->ixa_pktlen <= minmtu) 3441 ixa->ixa_flags &= ~IXAF_DONTFRAG; 3442 } 3443 3444 atomic_inc_64(&iptun->iptun_opackets); 3445 atomic_add_64(&iptun->iptun_obytes, ixa->ixa_pktlen); 3446 3447 error = conn_ip_output(newmp, ixa); 3448 3449 /* Restore IXAF_DONTFRAG value */ 3450 ixa->ixa_flags |= dontfrag; 3451 3452 if (error == EMSGSIZE) { 3453 /* IPsec policy might have changed */ 3454 (void) iptun_update_mtu(iptun, ixa, 0); 3455 } 3456 } 3457 } else { 3458 /* 3459 * The ip module will potentially apply global policy to the 3460 * packet in its output path if there's no active tunnel 3461 * policy. 3462 */ 3463 ASSERT(ixa->ixa_ipsec_policy == NULL); 3464 mp = ip_output_attach_policy(mp, outer4, outer6, NULL, ixa); 3465 if (mp == NULL) { 3466 atomic_inc_64(&iptun->iptun_oerrors); 3467 return; 3468 } 3469 if (is_system_labeled()) { 3470 /* 3471 * Might change the packet by adding/removing CIPSO. 3472 * After this caller inner* and outer* and outer_hlen 3473 * might be invalid. 3474 */ 3475 error = iptun_output_check_label(&mp, ixa); 3476 if (error != 0) { 3477 ip2dbg(("label check failed (%d)\n", error)); 3478 iptun_drop_pkt(mp, &iptun->iptun_oerrors); 3479 return; 3480 } 3481 } 3482 3483 atomic_inc_64(&iptun->iptun_opackets); 3484 atomic_add_64(&iptun->iptun_obytes, ixa->ixa_pktlen); 3485 3486 error = conn_ip_output(mp, ixa); 3487 if (error == EMSGSIZE) { 3488 /* IPsec policy might have changed */ 3489 (void) iptun_update_mtu(iptun, ixa, 0); 3490 } 3491 } 3492 if (ixa->ixa_flags & IXAF_IPSEC_SECURE) 3493 ipsec_out_release_refs(ixa); 3494 } 3495 3496 static mac_callbacks_t iptun_m_callbacks = { 3497 .mc_callbacks = (MC_SETPROP | MC_GETPROP | MC_PROPINFO), 3498 .mc_getstat = iptun_m_getstat, 3499 .mc_start = iptun_m_start, 3500 .mc_stop = iptun_m_stop, 3501 .mc_setpromisc = iptun_m_setpromisc, 3502 .mc_multicst = iptun_m_multicst, 3503 .mc_unicst = iptun_m_unicst, 3504 .mc_tx = iptun_m_tx, 3505 .mc_reserved = NULL, 3506 .mc_setprop = iptun_m_setprop, 3507 .mc_getprop = iptun_m_getprop, 3508 .mc_propinfo = iptun_m_propinfo 3509 }; 3510