?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Merge commit 'b1e7e97d3b60469b243b3b2e22c7d8cbd11c7c90'
[unleashed.git] / kernel / net / ip / spdsock.c
blobd76113df4289df22ef806d38da845592dad3d65d
1 /*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21 /*
22 * Copyright (c) 2001, 2010, Oracle and/or its affiliates. All rights reserved.
23 * Copyright (c) 2012 Nexenta Systems, Inc. All rights reserved.
24 * Copyright 2017 Joyent, Inc.
25 */
26
27 #include <sys/param.h>
28 #include <sys/types.h>
29 #include <sys/stream.h>
30 #include <sys/strsubr.h>
31 #include <sys/strsun.h>
32 #include <sys/stropts.h>
33 #include <sys/zone.h>
34 #include <sys/vnode.h>
35 #include <sys/sysmacros.h>
36 #define _SUN_TPI_VERSION 2
37 #include <sys/tihdr.h>
38 #include <sys/timod.h>
39 #include <sys/ddi.h>
40 #include <sys/sunddi.h>
41 #include <sys/mkdev.h>
42 #include <sys/debug.h>
43 #include <sys/kmem.h>
44 #include <sys/cmn_err.h>
45 #include <sys/suntpi.h>
46 #include <sys/policy.h>
47 #include <sys/dls.h>
48
49 #include <sys/socket.h>
50 #include <netinet/in.h>
51 #include <net/pfkeyv2.h>
52 #include <net/pfpolicy.h>
53
54 #include <inet/common.h>
55 #include <netinet/ip6.h>
56 #include <inet/ip.h>
57 #include <inet/ip6.h>
58 #include <inet/mi.h>
59 #include <inet/proto_set.h>
60 #include <inet/nd.h>
61 #include <inet/ip_if.h>
62 #include <inet/optcom.h>
63 #include <inet/ipsec_impl.h>
64 #include <inet/spdsock.h>
65 #include <inet/sadb.h>
66 #include <inet/iptun.h>
67 #include <inet/iptun/iptun_impl.h>
68
69 #include <sys/isa_defs.h>
70
71 /*
72 * This is a transport provider for the PF_POLICY IPsec policy
73 * management socket, which provides a management interface into the
74 * SPD, allowing policy rules to be added, deleted, and queried.
75 *
76 * This effectively replaces the old private SIOC*IPSECONFIG ioctls
77 * with an extensible interface which will hopefully be public some
78 * day.
79 *
80 * See <net/pfpolicy.h> for more details on the protocol.
81 *
82 * We link against drv/ip and call directly into it to manipulate the
83 * SPD; see ipsec_impl.h for the policy data structures and spd.c for
84 * the code which maintains them.
85 *
86 * The MT model of this is QPAIR with the addition of some explicit
87 * locking to protect system-wide policy data structures.
88 */
89
90 static vmem_t *spdsock_vmem; /* for minor numbers. */
91
92 #define ALIGNED64(x) IS_P2ALIGNED((x), sizeof (uint64_t))
93
94 /* Default structure copied into T_INFO_ACK messages (from rts.c...) */
95 static struct T_info_ack spdsock_g_t_info_ack = {
96 T_INFO_ACK,
97 T_INFINITE, /* TSDU_size. Maximum size messages. */
98 T_INVALID, /* ETSDU_size. No expedited data. */
99 T_INVALID, /* CDATA_size. No connect data. */
100 T_INVALID, /* DDATA_size. No disconnect data. */
101 0, /* ADDR_size. */
102 0, /* OPT_size. No user-settable options */
103 64 * 1024, /* TIDU_size. spdsock allows maximum size messages. */
104 T_COTS, /* SERV_type. spdsock supports connection oriented. */
105 TS_UNBND, /* CURRENT_state. This is set from spdsock_state. */
106 (XPG4_1) /* Provider flags */
107 };
108
109 /* Named Dispatch Parameter Management Structure */
110 typedef struct spdsockparam_s {
111 uint_t spdsock_param_min;
112 uint_t spdsock_param_max;
113 uint_t spdsock_param_value;
114 char *spdsock_param_name;
115 } spdsockparam_t;
116
117 /*
118 * Table of NDD variables supported by spdsock. These are loaded into
119 * spdsock_g_nd in spdsock_init_nd.
120 * All of these are alterable, within the min/max values given, at run time.
121 */
122 static spdsockparam_t lcl_param_arr[] = {
123 /* min max value name */
124 { 4096, 65536, 8192, "spdsock_xmit_hiwat"},
125 { 0, 65536, 1024, "spdsock_xmit_lowat"},
126 { 4096, 65536, 8192, "spdsock_recv_hiwat"},
127 { 65536, 1024*1024*1024, 256*1024, "spdsock_max_buf"},
128 { 0, 3, 0, "spdsock_debug"},
129 };
130 #define spds_xmit_hiwat spds_params[0].spdsock_param_value
131 #define spds_xmit_lowat spds_params[1].spdsock_param_value
132 #define spds_recv_hiwat spds_params[2].spdsock_param_value
133 #define spds_max_buf spds_params[3].spdsock_param_value
134 #define spds_debug spds_params[4].spdsock_param_value
135
136 #define ss0dbg(a) printf a
137 /* NOTE: != 0 instead of > 0 so lint doesn't complain. */
138 #define ss1dbg(spds, a) if (spds->spds_debug != 0) printf a
139 #define ss2dbg(spds, a) if (spds->spds_debug > 1) printf a
140 #define ss3dbg(spds, a) if (spds->spds_debug > 2) printf a
141
142 #define RESET_SPDSOCK_DUMP_POLHEAD(ss, iph) { \
143 ASSERT(RW_READ_HELD(&(iph)->iph_lock)); \
144 (ss)->spdsock_dump_head = (iph); \
145 (ss)->spdsock_dump_gen = (iph)->iph_gen; \
146 (ss)->spdsock_dump_cur_type = 0; \
147 (ss)->spdsock_dump_cur_af = IPSEC_AF_V4; \
148 (ss)->spdsock_dump_cur_rule = NULL; \
149 (ss)->spdsock_dump_count = 0; \
150 (ss)->spdsock_dump_cur_chain = 0; \
151 }
152
153 static int spdsock_close(queue_t *);
154 static int spdsock_open(queue_t *, dev_t *, int, int, cred_t *);
155 static void spdsock_wput(queue_t *, mblk_t *);
156 static void spdsock_wsrv(queue_t *);
157 static void spdsock_rsrv(queue_t *);
158 static void *spdsock_stack_init(netstackid_t stackid, netstack_t *ns);
159 static void spdsock_stack_shutdown(netstackid_t stackid, void *arg);
160 static void spdsock_stack_fini(netstackid_t stackid, void *arg);
161 static void spdsock_loadcheck(void *);
162 static void spdsock_merge_algs(spd_stack_t *);
163 static void spdsock_flush_one(ipsec_policy_head_t *, netstack_t *);
164 static mblk_t *spdsock_dump_next_record(spdsock_t *);
165 static void update_iptun_policy(ipsec_tun_pol_t *);
166
167 static struct module_info info = {
168 5138, "spdsock", 1, INFPSZ, 512, 128
169 };
170
171 static struct qinit rinit = {
172 NULL, (pfi_t)spdsock_rsrv, spdsock_open, spdsock_close,
173 NULL, &info
174 };
175
176 static struct qinit winit = {
177 (pfi_t)spdsock_wput, (pfi_t)spdsock_wsrv, NULL, NULL, NULL, &info
178 };
179
180 struct streamtab spdsockinfo = {
181 &rinit, &winit
182 };
183
184 /* mapping from alg type to protocol number, as per RFC 2407 */
185 static const uint_t algproto[] = {
186 PROTO_IPSEC_AH,
187 PROTO_IPSEC_ESP,
188 };
189
190 #define NALGPROTOS (sizeof (algproto) / sizeof (algproto[0]))
191
192 /* mapping from kernel exec mode to spdsock exec mode */
193 static const uint_t execmodes[] = {
194 SPD_ALG_EXEC_MODE_SYNC,
195 SPD_ALG_EXEC_MODE_ASYNC
196 };
197
198 #define NEXECMODES (sizeof (execmodes) / sizeof (execmodes[0]))
199
200 #define ALL_ACTIVE_POLHEADS ((ipsec_policy_head_t *)-1)
201 #define ALL_INACTIVE_POLHEADS ((ipsec_policy_head_t *)-2)
202
203 #define ITP_NAME(itp) (itp != NULL ? itp->itp_name : NULL)
204
205 /* ARGSUSED */
206 static int
207 spdsock_param_get(
208 queue_t *q,
209 mblk_t *mp,
210 caddr_t cp,
211 cred_t *cr)
212 {
213 spdsockparam_t *spdsockpa = (spdsockparam_t *)cp;
214 uint_t value;
215 spdsock_t *ss = (spdsock_t *)q->q_ptr;
216 spd_stack_t *spds = ss->spdsock_spds;
217
218 mutex_enter(&spds->spds_param_lock);
219 value = spdsockpa->spdsock_param_value;
220 mutex_exit(&spds->spds_param_lock);
221
222 (void) mi_mpprintf(mp, "%u", value);
223 return (0);
224 }
225
226 /* This routine sets an NDD variable in a spdsockparam_t structure. */
227 /* ARGSUSED */
228 static int
229 spdsock_param_set(
230 queue_t *q,
231 mblk_t *mp,
232 char *value,
233 caddr_t cp,
234 cred_t *cr)
235 {
236 ulong_t new_value;
237 spdsockparam_t *spdsockpa = (spdsockparam_t *)cp;
238 spdsock_t *ss = (spdsock_t *)q->q_ptr;
239 spd_stack_t *spds = ss->spdsock_spds;
240
241 /* Convert the value from a string into a long integer. */
242 if (ddi_strtoul(value, NULL, 10, &new_value) != 0)
243 return (EINVAL);
244
245 mutex_enter(&spds->spds_param_lock);
246 /*
247 * Fail the request if the new value does not lie within the
248 * required bounds.
249 */
250 if (new_value < spdsockpa->spdsock_param_min ||
251 new_value > spdsockpa->spdsock_param_max) {
252 mutex_exit(&spds->spds_param_lock);
253 return (EINVAL);
254 }
255
256 /* Set the new value */
257 spdsockpa->spdsock_param_value = new_value;
258 mutex_exit(&spds->spds_param_lock);
259
260 return (0);
261 }
262
263 /*
264 * Initialize at module load time
265 */
266 boolean_t
267 spdsock_ddi_init(void)
268 {
269 spdsock_max_optsize = optcom_max_optsize(
270 spdsock_opt_obj.odb_opt_des_arr, spdsock_opt_obj.odb_opt_arr_cnt);
271
272 spdsock_vmem = vmem_create("spdsock", (void *)1, MAXMIN, 1,
273 NULL, NULL, NULL, 1, VM_SLEEP | VMC_IDENTIFIER);
274
275 /*
276 * We want to be informed each time a stack is created or
277 * destroyed in the kernel, so we can maintain the
278 * set of spd_stack_t's.
279 */
280 netstack_register(NS_SPDSOCK, spdsock_stack_init,
281 spdsock_stack_shutdown, spdsock_stack_fini);
282
283 return (B_TRUE);
284 }
285
286 /*
287 * Walk through the param array specified registering each element with the
288 * named dispatch handler.
289 */
290 static boolean_t
291 spdsock_param_register(IDP *ndp, spdsockparam_t *ssp, int cnt)
292 {
293 for (; cnt-- > 0; ssp++) {
294 if (ssp->spdsock_param_name != NULL &&
295 ssp->spdsock_param_name[0]) {
296 if (!nd_load(ndp,
297 ssp->spdsock_param_name,
298 spdsock_param_get, spdsock_param_set,
299 (caddr_t)ssp)) {
300 nd_free(ndp);
301 return (B_FALSE);
302 }
303 }
304 }
305 return (B_TRUE);
306 }
307
308 /*
309 * Initialize for each stack instance
310 */
311 /* ARGSUSED */
312 static void *
313 spdsock_stack_init(netstackid_t stackid, netstack_t *ns)
314 {
315 spd_stack_t *spds;
316 spdsockparam_t *ssp;
317
318 spds = (spd_stack_t *)kmem_zalloc(sizeof (*spds), KM_SLEEP);
319 spds->spds_netstack = ns;
320
321 ASSERT(spds->spds_g_nd == NULL);
322
323 ssp = (spdsockparam_t *)kmem_alloc(sizeof (lcl_param_arr), KM_SLEEP);
324 spds->spds_params = ssp;
325 bcopy(lcl_param_arr, ssp, sizeof (lcl_param_arr));
326
327 (void) spdsock_param_register(&spds->spds_g_nd, ssp,
328 A_CNT(lcl_param_arr));
329
330 mutex_init(&spds->spds_param_lock, NULL, MUTEX_DEFAULT, NULL);
331 mutex_init(&spds->spds_alg_lock, NULL, MUTEX_DEFAULT, NULL);
332
333 return (spds);
334 }
335
336 void
337 spdsock_ddi_destroy(void)
338 {
339 vmem_destroy(spdsock_vmem);
340
341 netstack_unregister(NS_SPDSOCK);
342 }
343
344 /*
345 * Do pre-removal cleanup.
346 */
347 /* ARGSUSED */
348 static void
349 spdsock_stack_shutdown(netstackid_t stackid, void *arg)
350 {
351 spd_stack_t *spds = (spd_stack_t *)arg;
352
353 if (spds->spds_mp_algs != NULL) {
354 freemsg(spds->spds_mp_algs);
355 spds->spds_mp_algs = NULL;
356 }
357 }
358
359 /* ARGSUSED */
360 static void
361 spdsock_stack_fini(netstackid_t stackid, void *arg)
362 {
363 spd_stack_t *spds = (spd_stack_t *)arg;
364
365 ASSERT(spds->spds_mp_algs == NULL);
366 mutex_destroy(&spds->spds_param_lock);
367 mutex_destroy(&spds->spds_alg_lock);
368 nd_free(&spds->spds_g_nd);
369 kmem_free(spds->spds_params, sizeof (lcl_param_arr));
370 spds->spds_params = NULL;
371
372 kmem_free(spds, sizeof (*spds));
373 }
374
375 /*
376 * NOTE: large quantities of this should be shared with keysock.
377 * Would be nice to combine some of this into a common module, but
378 * not possible given time pressures.
379 */
380
381 /*
382 * High-level reality checking of extensions.
383 */
384 /* ARGSUSED */ /* XXX */
385 static boolean_t
386 ext_check(spd_ext_t *ext)
387 {
388 spd_if_t *tunname = (spd_if_t *)ext;
389 int i;
390 char *idstr;
391
392 if (ext->spd_ext_type == SPD_EXT_TUN_NAME) {
393 /* (NOTE: Modified from SADB_EXT_IDENTITY..) */
394
395 /*
396 * Make sure the strings in these identities are
397 * null-terminated. Let's "proactively" null-terminate the
398 * string at the last byte if it's not terminated sooner.
399 */
400 i = SPD_64TO8(tunname->spd_if_len) - sizeof (spd_if_t);
401 idstr = (char *)(tunname + 1);
402 while (*idstr != '\0' && i > 0) {
403 i--;
404 idstr++;
405 }
406 if (i == 0) {
407 /*
408 * I.e., if the bozo user didn't NULL-terminate the
409 * string...
410 */
411 idstr--;
412 *idstr = '\0';
413 }
414 }
415 return (B_TRUE); /* For now... */
416 }
417
418
419
420 /* Return values for spdsock_get_ext(). */
421 #define KGE_OK 0
422 #define KGE_DUP 1
423 #define KGE_UNK 2
424 #define KGE_LEN 3
425 #define KGE_CHK 4
426
427 /*
428 * Parse basic extension headers and return in the passed-in pointer vector.
429 * Return values include:
430 *
431 * KGE_OK Everything's nice and parsed out.
432 * If there are no extensions, place NULL in extv[0].
433 * KGE_DUP There is a duplicate extension.
434 * First instance in appropriate bin. First duplicate in
435 * extv[0].
436 * KGE_UNK Unknown extension type encountered. extv[0] contains
437 * unknown header.
438 * KGE_LEN Extension length error.
439 * KGE_CHK High-level reality check failed on specific extension.
440 *
441 * My apologies for some of the pointer arithmetic in here. I'm thinking
442 * like an assembly programmer, yet trying to make the compiler happy.
443 */
444 static int
445 spdsock_get_ext(spd_ext_t *extv[], spd_msg_t *basehdr, uint_t msgsize)
446 {
447 bzero(extv, sizeof (spd_ext_t *) * (SPD_EXT_MAX + 1));
448
449 /* Use extv[0] as the "current working pointer". */
450
451 extv[0] = (spd_ext_t *)(basehdr + 1);
452
453 while (extv[0] < (spd_ext_t *)(((uint8_t *)basehdr) + msgsize)) {
454 /* Check for unknown headers. */
455 if (extv[0]->spd_ext_type == 0 ||
456 extv[0]->spd_ext_type > SPD_EXT_MAX)
457 return (KGE_UNK);
458
459 /*
460 * Check length. Use uint64_t because extlen is in units
461 * of 64-bit words. If length goes beyond the msgsize,
462 * return an error. (Zero length also qualifies here.)
463 */
464 if (extv[0]->spd_ext_len == 0 ||
465 (void *)((uint64_t *)extv[0] + extv[0]->spd_ext_len) >
466 (void *)((uint8_t *)basehdr + msgsize))
467 return (KGE_LEN);
468
469 /* Check for redundant headers. */
470 if (extv[extv[0]->spd_ext_type] != NULL)
471 return (KGE_DUP);
472
473 /*
474 * Reality check the extension if possible at the spdsock
475 * level.
476 */
477 if (!ext_check(extv[0]))
478 return (KGE_CHK);
479
480 /* If I make it here, assign the appropriate bin. */
481 extv[extv[0]->spd_ext_type] = extv[0];
482
483 /* Advance pointer (See above for uint64_t ptr reasoning.) */
484 extv[0] = (spd_ext_t *)
485 ((uint64_t *)extv[0] + extv[0]->spd_ext_len);
486 }
487
488 /* Everything's cool. */
489
490 /*
491 * If extv[0] == NULL, then there are no extension headers in this
492 * message. Ensure that this is the case.
493 */
494 if (extv[0] == (spd_ext_t *)(basehdr + 1))
495 extv[0] = NULL;
496
497 return (KGE_OK);
498 }
499
500 static const int bad_ext_diag[] = {
501 SPD_DIAGNOSTIC_MALFORMED_LCLPORT,
502 SPD_DIAGNOSTIC_MALFORMED_REMPORT,
503 SPD_DIAGNOSTIC_MALFORMED_PROTO,
504 SPD_DIAGNOSTIC_MALFORMED_LCLADDR,
505 SPD_DIAGNOSTIC_MALFORMED_REMADDR,
506 SPD_DIAGNOSTIC_MALFORMED_ACTION,
507 SPD_DIAGNOSTIC_MALFORMED_RULE,
508 SPD_DIAGNOSTIC_MALFORMED_RULESET,
509 SPD_DIAGNOSTIC_MALFORMED_ICMP_TYPECODE
510 };
511
512 static const int dup_ext_diag[] = {
513 SPD_DIAGNOSTIC_DUPLICATE_LCLPORT,
514 SPD_DIAGNOSTIC_DUPLICATE_REMPORT,
515 SPD_DIAGNOSTIC_DUPLICATE_PROTO,
516 SPD_DIAGNOSTIC_DUPLICATE_LCLADDR,
517 SPD_DIAGNOSTIC_DUPLICATE_REMADDR,
518 SPD_DIAGNOSTIC_DUPLICATE_ACTION,
519 SPD_DIAGNOSTIC_DUPLICATE_RULE,
520 SPD_DIAGNOSTIC_DUPLICATE_RULESET,
521 SPD_DIAGNOSTIC_DUPLICATE_ICMP_TYPECODE
522 };
523
524 /*
525 * Transmit a PF_POLICY error message to the instance either pointed to
526 * by ks, the instance with serial number serial, or more, depending.
527 *
528 * The faulty message (or a reasonable facsimile thereof) is in mp.
529 * This function will free mp or recycle it for delivery, thereby causing
530 * the stream head to free it.
531 */
532 static void
533 spdsock_error(queue_t *q, mblk_t *mp, int error, int diagnostic)
534 {
535 spd_msg_t *spmsg = (spd_msg_t *)mp->b_rptr;
536
537 ASSERT(mp->b_datap->db_type == M_DATA);
538
539 if (spmsg->spd_msg_type < SPD_MIN ||
540 spmsg->spd_msg_type > SPD_MAX)
541 spmsg->spd_msg_type = SPD_RESERVED;
542
543 /*
544 * Strip out extension headers.
545 */
546 ASSERT(mp->b_rptr + sizeof (*spmsg) <= mp->b_datap->db_lim);
547 mp->b_wptr = mp->b_rptr + sizeof (*spmsg);
548 spmsg->spd_msg_len = SPD_8TO64(sizeof (spd_msg_t));
549 spmsg->spd_msg_errno = (uint8_t)error;
550 spmsg->spd_msg_diagnostic = (uint16_t)diagnostic;
551
552 qreply(q, mp);
553 }
554
555 static void
556 spdsock_diag(queue_t *q, mblk_t *mp, int diagnostic)
557 {
558 spdsock_error(q, mp, EINVAL, diagnostic);
559 }
560
561 static void
562 spd_echo(queue_t *q, mblk_t *mp)
563 {
564 qreply(q, mp);
565 }
566
567 /*
568 * Do NOT consume a reference to itp.
569 */
570 /*ARGSUSED*/
571 static void
572 spdsock_flush_node(ipsec_tun_pol_t *itp, void *cookie, netstack_t *ns)
573 {
574 boolean_t active = (boolean_t)cookie;
575 ipsec_policy_head_t *iph;
576
577 iph = active ? itp->itp_policy : itp->itp_inactive;
578 IPPH_REFHOLD(iph);
579 mutex_enter(&itp->itp_lock);
580 spdsock_flush_one(iph, ns); /* Releases iph refhold. */
581 if (active)
582 itp->itp_flags &= ~ITPF_PFLAGS;
583 else
584 itp->itp_flags &= ~ITPF_IFLAGS;
585 mutex_exit(&itp->itp_lock);
586 /* SPD_FLUSH is worth a tunnel MTU check. */
587 update_iptun_policy(itp);
588 }
589
590 /*
591 * Clear out one polhead.
592 */
593 static void
594 spdsock_flush_one(ipsec_policy_head_t *iph, netstack_t *ns)
595 {
596 rw_enter(&iph->iph_lock, RW_WRITER);
597 ipsec_polhead_flush(iph, ns);
598 rw_exit(&iph->iph_lock);
599 IPPH_REFRELE(iph, ns);
600 }
601
602 static void
603 spdsock_flush(queue_t *q, ipsec_policy_head_t *iph, ipsec_tun_pol_t *itp,
604 mblk_t *mp)
605 {
606 boolean_t active;
607 spdsock_t *ss = (spdsock_t *)q->q_ptr;
608 netstack_t *ns = ss->spdsock_spds->spds_netstack;
609
610 if (iph != ALL_ACTIVE_POLHEADS && iph != ALL_INACTIVE_POLHEADS) {
611 spdsock_flush_one(iph, ns);
612 } else {
613 active = (iph == ALL_ACTIVE_POLHEADS);
614
615 /* First flush the global policy. */
616 spdsock_flush_one(active ? ipsec_system_policy(ns) :
617 ipsec_inactive_policy(ns), ns);
618 /* Then flush every tunnel's appropriate one. */
619 itp_walk(spdsock_flush_node, (void *)active, ns);
620 }
621
622 spd_echo(q, mp);
623 }
624
625 static boolean_t
626 spdsock_ext_to_sel(spd_ext_t **extv, ipsec_selkey_t *sel, int *diag)
627 {
628 bzero(sel, sizeof (*sel));
629
630 if (extv[SPD_EXT_PROTO] != NULL) {
631 struct spd_proto *pr =
632 (struct spd_proto *)extv[SPD_EXT_PROTO];
633 sel->ipsl_proto = pr->spd_proto_number;
634 sel->ipsl_valid |= IPSL_PROTOCOL;
635 }
636 if (extv[SPD_EXT_LCLPORT] != NULL) {
637 struct spd_portrange *pr =
638 (struct spd_portrange *)extv[SPD_EXT_LCLPORT];
639 sel->ipsl_lport = pr->spd_ports_minport;
640 sel->ipsl_valid |= IPSL_LOCAL_PORT;
641 }
642 if (extv[SPD_EXT_REMPORT] != NULL) {
643 struct spd_portrange *pr =
644 (struct spd_portrange *)extv[SPD_EXT_REMPORT];
645 sel->ipsl_rport = pr->spd_ports_minport;
646 sel->ipsl_valid |= IPSL_REMOTE_PORT;
647 }
648
649 if (extv[SPD_EXT_ICMP_TYPECODE] != NULL) {
650 struct spd_typecode *tc=
651 (struct spd_typecode *)extv[SPD_EXT_ICMP_TYPECODE];
652
653 sel->ipsl_valid |= IPSL_ICMP_TYPE;
654 sel->ipsl_icmp_type = tc->spd_typecode_type;
655 if (tc->spd_typecode_type_end < tc->spd_typecode_type)
656 sel->ipsl_icmp_type_end = tc->spd_typecode_type;
657 else
658 sel->ipsl_icmp_type_end = tc->spd_typecode_type_end;
659
660 if (tc->spd_typecode_code != 255) {
661 sel->ipsl_valid |= IPSL_ICMP_CODE;
662 sel->ipsl_icmp_code = tc->spd_typecode_code;
663 if (tc->spd_typecode_code_end < tc->spd_typecode_code)
664 sel->ipsl_icmp_code_end = tc->spd_typecode_code;
665 else
666 sel->ipsl_icmp_code_end =
667 tc->spd_typecode_code_end;
668 }
669 }
670 #define ADDR2SEL(sel, extv, field, pfield, extn, bit) \
671 if ((extv)[(extn)] != NULL) { \
672 uint_t addrlen; \
673 struct spd_address *ap = \
674 (struct spd_address *)((extv)[(extn)]); \
675 addrlen = (ap->spd_address_af == AF_INET6) ? \
676 IPV6_ADDR_LEN : IP_ADDR_LEN; \
677 if (SPD_64TO8(ap->spd_address_len) < \
678 (addrlen + sizeof (*ap))) { \
679 *diag = SPD_DIAGNOSTIC_BAD_ADDR_LEN; \
680 return (B_FALSE); \
681 } \
682 bcopy((ap+1), &((sel)->field), addrlen); \
683 (sel)->pfield = ap->spd_address_prefixlen; \
684 (sel)->ipsl_valid |= (bit); \
685 (sel)->ipsl_valid |= (ap->spd_address_af == AF_INET6) ? \
686 IPSL_IPV6 : IPSL_IPV4; \
687 }
688
689 ADDR2SEL(sel, extv, ipsl_local, ipsl_local_pfxlen,
690 SPD_EXT_LCLADDR, IPSL_LOCAL_ADDR);
691 ADDR2SEL(sel, extv, ipsl_remote, ipsl_remote_pfxlen,
692 SPD_EXT_REMADDR, IPSL_REMOTE_ADDR);
693
694 if ((sel->ipsl_valid & (IPSL_IPV6|IPSL_IPV4)) ==
695 (IPSL_IPV6|IPSL_IPV4)) {
696 *diag = SPD_DIAGNOSTIC_MIXED_AF;
697 return (B_FALSE);
698 }
699
700 #undef ADDR2SEL
701
702 return (B_TRUE);
703 }
704
705 static boolean_t
706 spd_convert_type(uint32_t type, ipsec_act_t *act)
707 {
708 switch (type) {
709 case SPD_ACTTYPE_DROP:
710 act->ipa_type = IPSEC_ACT_DISCARD;
711 return (B_TRUE);
712
713 case SPD_ACTTYPE_PASS:
714 act->ipa_type = IPSEC_ACT_CLEAR;
715 return (B_TRUE);
716
717 case SPD_ACTTYPE_IPSEC:
718 act->ipa_type = IPSEC_ACT_APPLY;
719 return (B_TRUE);
720 }
721 return (B_FALSE);
722 }
723
724 static boolean_t
725 spd_convert_flags(uint32_t flags, ipsec_act_t *act)
726 {
727 /*
728 * Note use of !! for boolean canonicalization.
729 */
730 act->ipa_apply.ipp_use_ah = !!(flags & SPD_APPLY_AH);
731 act->ipa_apply.ipp_use_esp = !!(flags & SPD_APPLY_ESP);
732 act->ipa_apply.ipp_use_espa = !!(flags & SPD_APPLY_ESPA);
733 act->ipa_apply.ipp_use_se = !!(flags & SPD_APPLY_SE);
734 act->ipa_apply.ipp_use_unique = !!(flags & SPD_APPLY_UNIQUE);
735 return (B_TRUE);
736 }
737
738 static void
739 spdsock_reset_act(ipsec_act_t *act)
740 {
741 bzero(act, sizeof (*act));
742 act->ipa_apply.ipp_espe_maxbits = IPSEC_MAX_KEYBITS;
743 act->ipa_apply.ipp_espa_maxbits = IPSEC_MAX_KEYBITS;
744 act->ipa_apply.ipp_ah_maxbits = IPSEC_MAX_KEYBITS;
745 }
746
747 /*
748 * Sanity check action against reality, and shrink-wrap key sizes..
749 */
750 static boolean_t
751 spdsock_check_action(ipsec_act_t *act, boolean_t tunnel_polhead, int *diag,
752 spd_stack_t *spds)
753 {
754 if (tunnel_polhead && act->ipa_apply.ipp_use_unique) {
755 *diag = SPD_DIAGNOSTIC_ADD_INCON_FLAGS;
756 return (B_FALSE);
757 }
758 if ((act->ipa_type != IPSEC_ACT_APPLY) &&
759 (act->ipa_apply.ipp_use_ah ||
760 act->ipa_apply.ipp_use_esp ||
761 act->ipa_apply.ipp_use_espa ||
762 act->ipa_apply.ipp_use_se ||
763 act->ipa_apply.ipp_use_unique)) {
764 *diag = SPD_DIAGNOSTIC_ADD_INCON_FLAGS;
765 return (B_FALSE);
766 }
767 if ((act->ipa_type == IPSEC_ACT_APPLY) &&
768 !act->ipa_apply.ipp_use_ah &&
769 !act->ipa_apply.ipp_use_esp) {
770 *diag = SPD_DIAGNOSTIC_ADD_INCON_FLAGS;
771 return (B_FALSE);
772 }
773 return (ipsec_check_action(act, diag, spds->spds_netstack));
774 }
775
776 /*
777 * We may be short a few error checks here..
778 */
779 static boolean_t
780 spdsock_ext_to_actvec(spd_ext_t **extv, ipsec_act_t **actpp, uint_t *nactp,
781 int *diag, spd_stack_t *spds)
782 {
783 struct spd_ext_actions *sactp =
784 (struct spd_ext_actions *)extv[SPD_EXT_ACTION];
785 ipsec_act_t act, *actp, *endactp;
786 struct spd_attribute *attrp, *endattrp;
787 uint64_t *endp;
788 int nact;
789 boolean_t tunnel_polhead;
790
791 tunnel_polhead = (extv[SPD_EXT_TUN_NAME] != NULL &&
792 (((struct spd_rule *)extv[SPD_EXT_RULE])->spd_rule_flags &
793 SPD_RULE_FLAG_TUNNEL));
794
795 *actpp = NULL;
796 *nactp = 0;
797
798 if (sactp == NULL) {
799 *diag = SPD_DIAGNOSTIC_NO_ACTION_EXT;
800 return (B_FALSE);
801 }
802
803 /*
804 * Parse the "action" extension and convert into an action chain.
805 */
806
807 nact = sactp->spd_actions_count;
808
809 endp = (uint64_t *)sactp;
810 endp += sactp->spd_actions_len;
811 endattrp = (struct spd_attribute *)endp;
812
813 actp = kmem_alloc(sizeof (*actp) * nact, KM_NOSLEEP);
814 if (actp == NULL) {
815 *diag = SPD_DIAGNOSTIC_ADD_NO_MEM;
816 return (B_FALSE);
817 }
818 *actpp = actp;
819 *nactp = nact;
820 endactp = actp + nact;
821
822 spdsock_reset_act(&act);
823 attrp = (struct spd_attribute *)(&sactp[1]);
824
825 for (; attrp < endattrp; attrp++) {
826 switch (attrp->spd_attr_tag) {
827 case SPD_ATTR_NOP:
828 break;
829
830 case SPD_ATTR_EMPTY:
831 spdsock_reset_act(&act);
832 break;
833
834 case SPD_ATTR_END:
835 attrp = endattrp;
836 /* FALLTHRU */
837 case SPD_ATTR_NEXT:
838 if (actp >= endactp) {
839 *diag = SPD_DIAGNOSTIC_ADD_WRONG_ACT_COUNT;
840 goto fail;
841 }
842 if (!spdsock_check_action(&act, tunnel_polhead,
843 diag, spds))
844 goto fail;
845 *actp++ = act;
846 spdsock_reset_act(&act);
847 break;
848
849 case SPD_ATTR_TYPE:
850 if (!spd_convert_type(attrp->spd_attr_value, &act)) {
851 *diag = SPD_DIAGNOSTIC_ADD_BAD_TYPE;
852 goto fail;
853 }
854 break;
855
856 case SPD_ATTR_FLAGS:
857 if (!tunnel_polhead && extv[SPD_EXT_TUN_NAME] != NULL) {
858 /*
859 * Set "sa unique" for transport-mode
860 * tunnels whether we want to or not.
861 */
862 attrp->spd_attr_value |= SPD_APPLY_UNIQUE;
863 }
864 if (!spd_convert_flags(attrp->spd_attr_value, &act)) {
865 *diag = SPD_DIAGNOSTIC_ADD_BAD_FLAGS;
866 goto fail;
867 }
868 break;
869
870 case SPD_ATTR_AH_AUTH:
871 if (attrp->spd_attr_value == 0) {
872 *diag = SPD_DIAGNOSTIC_UNSUPP_AH_ALG;
873 goto fail;
874 }
875 act.ipa_apply.ipp_auth_alg = attrp->spd_attr_value;
876 break;
877
878 case SPD_ATTR_ESP_ENCR:
879 if (attrp->spd_attr_value == 0) {
880 *diag = SPD_DIAGNOSTIC_UNSUPP_ESP_ENCR_ALG;
881 goto fail;
882 }
883 act.ipa_apply.ipp_encr_alg = attrp->spd_attr_value;
884 break;
885
886 case SPD_ATTR_ESP_AUTH:
887 if (attrp->spd_attr_value == 0) {
888 *diag = SPD_DIAGNOSTIC_UNSUPP_ESP_AUTH_ALG;
889 goto fail;
890 }
891 act.ipa_apply.ipp_esp_auth_alg = attrp->spd_attr_value;
892 break;
893
894 case SPD_ATTR_ENCR_MINBITS:
895 act.ipa_apply.ipp_espe_minbits = attrp->spd_attr_value;
896 break;
897
898 case SPD_ATTR_ENCR_MAXBITS:
899 act.ipa_apply.ipp_espe_maxbits = attrp->spd_attr_value;
900 break;
901
902 case SPD_ATTR_AH_MINBITS:
903 act.ipa_apply.ipp_ah_minbits = attrp->spd_attr_value;
904 break;
905
906 case SPD_ATTR_AH_MAXBITS:
907 act.ipa_apply.ipp_ah_maxbits = attrp->spd_attr_value;
908 break;
909
910 case SPD_ATTR_ESPA_MINBITS:
911 act.ipa_apply.ipp_espa_minbits = attrp->spd_attr_value;
912 break;
913
914 case SPD_ATTR_ESPA_MAXBITS:
915 act.ipa_apply.ipp_espa_maxbits = attrp->spd_attr_value;
916 break;
917
918 case SPD_ATTR_LIFE_SOFT_TIME:
919 case SPD_ATTR_LIFE_HARD_TIME:
920 case SPD_ATTR_LIFE_SOFT_BYTES:
921 case SPD_ATTR_LIFE_HARD_BYTES:
922 break;
923
924 case SPD_ATTR_KM_PROTO:
925 act.ipa_apply.ipp_km_proto = attrp->spd_attr_value;
926 break;
927
928 case SPD_ATTR_KM_COOKIE:
929 act.ipa_apply.ipp_km_cookie = attrp->spd_attr_value;
930 break;
931
932 case SPD_ATTR_REPLAY_DEPTH:
933 act.ipa_apply.ipp_replay_depth = attrp->spd_attr_value;
934 break;
935 }
936 }
937 if (actp != endactp) {
938 *diag = SPD_DIAGNOSTIC_ADD_WRONG_ACT_COUNT;
939 goto fail;
940 }
941
942 return (B_TRUE);
943 fail:
944 ipsec_actvec_free(*actpp, nact);
945 *actpp = NULL;
946 return (B_FALSE);
947 }
948
949 typedef struct
950 {
951 ipsec_policy_t *pol;
952 int dir;
953 } tmprule_t;
954
955 static int
956 mkrule(ipsec_policy_head_t *iph, struct spd_rule *rule,
957 ipsec_selkey_t *sel, ipsec_act_t *actp, int nact, uint_t dir, uint_t af,
958 tmprule_t **rp, uint64_t *index, spd_stack_t *spds)
959 {
960 ipsec_policy_t *pol;
961
962 sel->ipsl_valid &= ~(IPSL_IPV6|IPSL_IPV4);
963 sel->ipsl_valid |= af;
964
965 pol = ipsec_policy_create(sel, actp, nact, rule->spd_rule_priority,
966 index, spds->spds_netstack);
967 if (pol == NULL)
968 return (ENOMEM);
969
970 (*rp)->pol = pol;
971 (*rp)->dir = dir;
972 (*rp)++;
973
974 if (!ipsec_check_policy(iph, pol, dir))
975 return (EEXIST);
976
977 rule->spd_rule_index = pol->ipsp_index;
978 return (0);
979 }
980
981 static int
982 mkrulepair(ipsec_policy_head_t *iph, struct spd_rule *rule,
983 ipsec_selkey_t *sel, ipsec_act_t *actp, int nact, uint_t dir, uint_t afs,
984 tmprule_t **rp, uint64_t *index, spd_stack_t *spds)
985 {
986 int error;
987
988 if (afs & IPSL_IPV4) {
989 error = mkrule(iph, rule, sel, actp, nact, dir, IPSL_IPV4, rp,
990 index, spds);
991 if (error != 0)
992 return (error);
993 }
994 if (afs & IPSL_IPV6) {
995 error = mkrule(iph, rule, sel, actp, nact, dir, IPSL_IPV6, rp,
996 index, spds);
997 if (error != 0)
998 return (error);
999 }
1000 return (0);
1001 }
1002
1003
1004 static void
1005 spdsock_addrule(queue_t *q, ipsec_policy_head_t *iph, mblk_t *mp,
1006 spd_ext_t **extv, ipsec_tun_pol_t *itp)
1007 {
1008 ipsec_selkey_t sel;
1009 ipsec_act_t *actp;
1010 uint_t nact;
1011 int diag = 0, error, afs;
1012 struct spd_rule *rule = (struct spd_rule *)extv[SPD_EXT_RULE];
1013 tmprule_t rules[4], *rulep = &rules[0];
1014 boolean_t tunnel_mode, empty_itp, active;
1015 uint64_t *index = (itp == NULL) ? NULL : &itp->itp_next_policy_index;
1016 spdsock_t *ss = (spdsock_t *)q->q_ptr;
1017 spd_stack_t *spds = ss->spdsock_spds;
1018
1019 if (rule == NULL) {
1020 spdsock_diag(q, mp, SPD_DIAGNOSTIC_NO_RULE_EXT);
1021 return;
1022 }
1023
1024 tunnel_mode = (rule->spd_rule_flags & SPD_RULE_FLAG_TUNNEL);
1025
1026 if (itp != NULL) {
1027 mutex_enter(&itp->itp_lock);
1028 ASSERT(itp->itp_policy == iph || itp->itp_inactive == iph);
1029 active = (itp->itp_policy == iph);
1030 if (ITP_P_ISACTIVE(itp, iph)) {
1031 /* Check for mix-and-match of tunnel/transport. */
1032 if ((tunnel_mode && !ITP_P_ISTUNNEL(itp, iph)) ||
1033 (!tunnel_mode && ITP_P_ISTUNNEL(itp, iph))) {
1034 mutex_exit(&itp->itp_lock);
1035 spdsock_error(q, mp, EBUSY, 0);
1036 return;
1037 }
1038 empty_itp = B_FALSE;
1039 } else {
1040 empty_itp = B_TRUE;
1041 itp->itp_flags = active ? ITPF_P_ACTIVE : ITPF_I_ACTIVE;
1042 if (tunnel_mode)
1043 itp->itp_flags |= active ? ITPF_P_TUNNEL :
1044 ITPF_I_TUNNEL;
1045 }
1046 } else {
1047 empty_itp = B_FALSE;
1048 }
1049
1050 if (rule->spd_rule_index != 0) {
1051 diag = SPD_DIAGNOSTIC_INVALID_RULE_INDEX;
1052 error = EINVAL;
1053 goto fail2;
1054 }
1055
1056 if (!spdsock_ext_to_sel(extv, &sel, &diag)) {
1057 error = EINVAL;
1058 goto fail2;
1059 }
1060
1061 if (itp != NULL) {
1062 if (tunnel_mode) {
1063 if (sel.ipsl_valid &
1064 (IPSL_REMOTE_PORT | IPSL_LOCAL_PORT)) {
1065 itp->itp_flags |= active ?
1066 ITPF_P_PER_PORT_SECURITY :
1067 ITPF_I_PER_PORT_SECURITY;
1068 }
1069 } else {
1070 /*
1071 * For now, we don't allow transport-mode on a tunnel
1072 * with ANY specific selectors. Bail if we have such
1073 * a request.
1074 */
1075 if (sel.ipsl_valid & IPSL_WILDCARD) {
1076 diag = SPD_DIAGNOSTIC_NO_TUNNEL_SELECTORS;
1077 error = EINVAL;
1078 goto fail2;
1079 }
1080 }
1081 }
1082
1083 if (!spdsock_ext_to_actvec(extv, &actp, &nact, &diag, spds)) {
1084 error = EINVAL;
1085 goto fail2;
1086 }
1087 /*
1088 * If no addresses were specified, add both.
1089 */
1090 afs = sel.ipsl_valid & (IPSL_IPV6|IPSL_IPV4);
1091 if (afs == 0)
1092 afs = (IPSL_IPV6|IPSL_IPV4);
1093
1094 rw_enter(&iph->iph_lock, RW_WRITER);
1095
1096 if (rule->spd_rule_flags & SPD_RULE_FLAG_OUTBOUND) {
1097 error = mkrulepair(iph, rule, &sel, actp, nact,
1098 IPSEC_TYPE_OUTBOUND, afs, &rulep, index, spds);
1099 if (error != 0)
1100 goto fail;
1101 }
1102
1103 if (rule->spd_rule_flags & SPD_RULE_FLAG_INBOUND) {
1104 error = mkrulepair(iph, rule, &sel, actp, nact,
1105 IPSEC_TYPE_INBOUND, afs, &rulep, index, spds);
1106 if (error != 0)
1107 goto fail;
1108 }
1109
1110 while ((--rulep) >= &rules[0]) {
1111 ipsec_enter_policy(iph, rulep->pol, rulep->dir,
1112 spds->spds_netstack);
1113 }
1114 rw_exit(&iph->iph_lock);
1115 if (itp != NULL)
1116 mutex_exit(&itp->itp_lock);
1117
1118 ipsec_actvec_free(actp, nact);
1119 spd_echo(q, mp);
1120 return;
1121
1122 fail:
1123 rw_exit(&iph->iph_lock);
1124 while ((--rulep) >= &rules[0])
1125 IPPOL_REFRELE(rulep->pol);
1126 ipsec_actvec_free(actp, nact);
1127 fail2:
1128 if (itp != NULL) {
1129 if (empty_itp)
1130 itp->itp_flags = 0;
1131 mutex_exit(&itp->itp_lock);
1132 }
1133 spdsock_error(q, mp, error, diag);
1134 }
1135
1136 void
1137 spdsock_deleterule(queue_t *q, ipsec_policy_head_t *iph, mblk_t *mp,
1138 spd_ext_t **extv, ipsec_tun_pol_t *itp)
1139 {
1140 ipsec_selkey_t sel;
1141 struct spd_rule *rule = (struct spd_rule *)extv[SPD_EXT_RULE];
1142 int err, diag = 0;
1143 spdsock_t *ss = (spdsock_t *)q->q_ptr;
1144 netstack_t *ns = ss->spdsock_spds->spds_netstack;
1145
1146 if (rule == NULL) {
1147 spdsock_diag(q, mp, SPD_DIAGNOSTIC_NO_RULE_EXT);
1148 return;
1149 }
1150
1151 /*
1152 * Must enter itp_lock first to avoid deadlock. See tun.c's
1153 * set_sec_simple() for the other case of itp_lock and iph_lock.
1154 */
1155 if (itp != NULL)
1156 mutex_enter(&itp->itp_lock);
1157
1158 if (rule->spd_rule_index != 0) {
1159 if (ipsec_policy_delete_index(iph, rule->spd_rule_index, ns) !=
1160 0) {
1161 err = ESRCH;
1162 goto fail;
1163 }
1164 } else {
1165 if (!spdsock_ext_to_sel(extv, &sel, &diag)) {
1166 err = EINVAL; /* diag already set... */
1167 goto fail;
1168 }
1169
1170 if ((rule->spd_rule_flags & SPD_RULE_FLAG_INBOUND) &&
1171 !ipsec_policy_delete(iph, &sel, IPSEC_TYPE_INBOUND, ns)) {
1172 err = ESRCH;
1173 goto fail;
1174 }
1175
1176 if ((rule->spd_rule_flags & SPD_RULE_FLAG_OUTBOUND) &&
1177 !ipsec_policy_delete(iph, &sel, IPSEC_TYPE_OUTBOUND, ns)) {
1178 err = ESRCH;
1179 goto fail;
1180 }
1181 }
1182
1183 if (itp != NULL) {
1184 ASSERT(iph == itp->itp_policy || iph == itp->itp_inactive);
1185 rw_enter(&iph->iph_lock, RW_READER);
1186 if (avl_numnodes(&iph->iph_rulebyid) == 0) {
1187 if (iph == itp->itp_policy)
1188 itp->itp_flags &= ~ITPF_PFLAGS;
1189 else
1190 itp->itp_flags &= ~ITPF_IFLAGS;
1191 }
1192 /* Can exit locks in any order. */
1193 rw_exit(&iph->iph_lock);
1194 mutex_exit(&itp->itp_lock);
1195 }
1196 spd_echo(q, mp);
1197 return;
1198 fail:
1199 if (itp != NULL)
1200 mutex_exit(&itp->itp_lock);
1201 spdsock_error(q, mp, err, diag);
1202 }
1203
1204 /* Do NOT consume a reference to itp. */
1205 /* ARGSUSED */
1206 static void
1207 spdsock_flip_node(ipsec_tun_pol_t *itp, void *ignoreme, netstack_t *ns)
1208 {
1209 mutex_enter(&itp->itp_lock);
1210 ITPF_SWAP(itp->itp_flags);
1211 ipsec_swap_policy(itp->itp_policy, itp->itp_inactive, ns);
1212 mutex_exit(&itp->itp_lock);
1213 /* SPD_FLIP is worth a tunnel MTU check. */
1214 update_iptun_policy(itp);
1215 }
1216
1217 void
1218 spdsock_flip(queue_t *q, mblk_t *mp, spd_if_t *tunname)
1219 {
1220 char *tname;
1221 ipsec_tun_pol_t *itp;
1222 spdsock_t *ss = (spdsock_t *)q->q_ptr;
1223 netstack_t *ns = ss->spdsock_spds->spds_netstack;
1224
1225 if (tunname != NULL) {
1226 tname = (char *)tunname->spd_if_name;
1227 if (*tname == '\0') {
1228 /* can't fail */
1229 ipsec_swap_global_policy(ns);
1230 itp_walk(spdsock_flip_node, NULL, ns);
1231 } else {
1232 itp = get_tunnel_policy(tname, ns);
1233 if (itp == NULL) {
1234 /* Better idea for "tunnel not found"? */
1235 spdsock_error(q, mp, ESRCH, 0);
1236 return;
1237 }
1238 spdsock_flip_node(itp, NULL, ns);
1239 ITP_REFRELE(itp, ns);
1240 }
1241 } else {
1242 ipsec_swap_global_policy(ns); /* can't fail */
1243 }
1244 spd_echo(q, mp);
1245 }
1246
1247 /*
1248 * Unimplemented feature
1249 */
1250 /* ARGSUSED */
1251 static void
1252 spdsock_lookup(queue_t *q, ipsec_policy_head_t *iph, mblk_t *mp,
1253 spd_ext_t **extv, ipsec_tun_pol_t *itp)
1254 {
1255 spdsock_error(q, mp, EINVAL, 0);
1256 }
1257
1258
1259 static mblk_t *
1260 spdsock_dump_ruleset(mblk_t *req, ipsec_policy_head_t *iph,
1261 uint32_t count, uint16_t error)
1262 {
1263 size_t len = sizeof (spd_ruleset_ext_t) + sizeof (spd_msg_t);
1264 spd_msg_t *msg;
1265 spd_ruleset_ext_t *ruleset;
1266 mblk_t *m = allocb(len, BPRI_HI);
1267
1268 ASSERT(RW_READ_HELD(&iph->iph_lock));
1269
1270 if (m == NULL) {
1271 return (NULL);
1272 }
1273 msg = (spd_msg_t *)m->b_rptr;
1274 ruleset = (spd_ruleset_ext_t *)(&msg[1]);
1275
1276 m->b_wptr = (uint8_t *)&ruleset[1];
1277
1278 *msg = *(spd_msg_t *)(req->b_rptr);
1279 msg->spd_msg_len = SPD_8TO64(len);
1280 msg->spd_msg_errno = error;
1281
1282 ruleset->spd_ruleset_len = SPD_8TO64(sizeof (*ruleset));
1283 ruleset->spd_ruleset_type = SPD_EXT_RULESET;
1284 ruleset->spd_ruleset_count = count;
1285 ruleset->spd_ruleset_version = iph->iph_gen;
1286 return (m);
1287 }
1288
1289 static mblk_t *
1290 spdsock_dump_finish(spdsock_t *ss, int error)
1291 {
1292 mblk_t *m;
1293 ipsec_policy_head_t *iph = ss->spdsock_dump_head;
1294 mblk_t *req = ss->spdsock_dump_req;
1295 netstack_t *ns = ss->spdsock_spds->spds_netstack;
1296
1297 rw_enter(&iph->iph_lock, RW_READER);
1298 m = spdsock_dump_ruleset(req, iph, ss->spdsock_dump_count, error);
1299 rw_exit(&iph->iph_lock);
1300 IPPH_REFRELE(iph, ns);
1301 if (ss->spdsock_itp != NULL) {
1302 ITP_REFRELE(ss->spdsock_itp, ns);
1303 ss->spdsock_itp = NULL;
1304 }
1305 ss->spdsock_dump_req = NULL;
1306 freemsg(req);
1307
1308 return (m);
1309 }
1310
1311 /*
1312 * Rule encoding functions.
1313 * We do a two-pass encode.
1314 * If base != NULL, fill in encoded rule part starting at base+offset.
1315 * Always return "offset" plus length of to-be-encoded data.
1316 */
1317 static uint_t
1318 spdsock_encode_typecode(uint8_t *base, uint_t offset, uint8_t type,
1319 uint8_t type_end, uint8_t code, uint8_t code_end)
1320 {
1321 struct spd_typecode *tcp;
1322
1323 ASSERT(ALIGNED64(offset));
1324
1325 if (base != NULL) {
1326 tcp = (struct spd_typecode *)(base + offset);
1327 tcp->spd_typecode_len = SPD_8TO64(sizeof (*tcp));
1328 tcp->spd_typecode_exttype = SPD_EXT_ICMP_TYPECODE;
1329 tcp->spd_typecode_code = code;
1330 tcp->spd_typecode_type = type;
1331 tcp->spd_typecode_type_end = type_end;
1332 tcp->spd_typecode_code_end = code_end;
1333 }
1334 offset += sizeof (*tcp);
1335
1336 ASSERT(ALIGNED64(offset));
1337
1338 return (offset);
1339 }
1340
1341 static uint_t
1342 spdsock_encode_proto(uint8_t *base, uint_t offset, uint8_t proto)
1343 {
1344 struct spd_proto *spp;
1345
1346 ASSERT(ALIGNED64(offset));
1347
1348 if (base != NULL) {
1349 spp = (struct spd_proto *)(base + offset);
1350 spp->spd_proto_len = SPD_8TO64(sizeof (*spp));
1351 spp->spd_proto_exttype = SPD_EXT_PROTO;
1352 spp->spd_proto_number = proto;
1353 spp->spd_proto_reserved1 = 0;
1354 spp->spd_proto_reserved2 = 0;
1355 }
1356 offset += sizeof (*spp);
1357
1358 ASSERT(ALIGNED64(offset));
1359
1360 return (offset);
1361 }
1362
1363 static uint_t
1364 spdsock_encode_port(uint8_t *base, uint_t offset, uint16_t ext, uint16_t port)
1365 {
1366 struct spd_portrange *spp;
1367
1368 ASSERT(ALIGNED64(offset));
1369
1370 if (base != NULL) {
1371 spp = (struct spd_portrange *)(base + offset);
1372 spp->spd_ports_len = SPD_8TO64(sizeof (*spp));
1373 spp->spd_ports_exttype = ext;
1374 spp->spd_ports_minport = port;
1375 spp->spd_ports_maxport = port;
1376 }
1377 offset += sizeof (*spp);
1378
1379 ASSERT(ALIGNED64(offset));
1380
1381 return (offset);
1382 }
1383
1384 static uint_t
1385 spdsock_encode_addr(uint8_t *base, uint_t offset, uint16_t ext,
1386 const ipsec_selkey_t *sel, const ipsec_addr_t *addr, uint_t pfxlen)
1387 {
1388 struct spd_address *sae;
1389 ipsec_addr_t *spdaddr;
1390 uint_t start = offset;
1391 uint_t addrlen;
1392 uint_t af;
1393
1394 if (sel->ipsl_valid & IPSL_IPV4) {
1395 af = AF_INET;
1396 addrlen = IP_ADDR_LEN;
1397 } else {
1398 af = AF_INET6;
1399 addrlen = IPV6_ADDR_LEN;
1400 }
1401
1402 ASSERT(ALIGNED64(offset));
1403
1404 if (base != NULL) {
1405 sae = (struct spd_address *)(base + offset);
1406 sae->spd_address_exttype = ext;
1407 sae->spd_address_af = af;
1408 sae->spd_address_prefixlen = pfxlen;
1409 sae->spd_address_reserved2 = 0;
1410
1411 spdaddr = (ipsec_addr_t *)(&sae[1]);
1412 bcopy(addr, spdaddr, addrlen);
1413 }
1414 offset += sizeof (*sae);
1415 addrlen = roundup(addrlen, sizeof (uint64_t));
1416 offset += addrlen;
1417
1418 ASSERT(ALIGNED64(offset));
1419
1420 if (base != NULL)
1421 sae->spd_address_len = SPD_8TO64(offset - start);
1422 return (offset);
1423 }
1424
1425 static uint_t
1426 spdsock_encode_sel(uint8_t *base, uint_t offset, const ipsec_sel_t *sel)
1427 {
1428 const ipsec_selkey_t *selkey = &sel->ipsl_key;
1429
1430 if (selkey->ipsl_valid & IPSL_PROTOCOL)
1431 offset = spdsock_encode_proto(base, offset, selkey->ipsl_proto);
1432 if (selkey->ipsl_valid & IPSL_LOCAL_PORT)
1433 offset = spdsock_encode_port(base, offset, SPD_EXT_LCLPORT,
1434 selkey->ipsl_lport);
1435 if (selkey->ipsl_valid & IPSL_REMOTE_PORT)
1436 offset = spdsock_encode_port(base, offset, SPD_EXT_REMPORT,
1437 selkey->ipsl_rport);
1438 if (selkey->ipsl_valid & IPSL_REMOTE_ADDR)
1439 offset = spdsock_encode_addr(base, offset, SPD_EXT_REMADDR,
1440 selkey, &selkey->ipsl_remote, selkey->ipsl_remote_pfxlen);
1441 if (selkey->ipsl_valid & IPSL_LOCAL_ADDR)
1442 offset = spdsock_encode_addr(base, offset, SPD_EXT_LCLADDR,
1443 selkey, &selkey->ipsl_local, selkey->ipsl_local_pfxlen);
1444 if (selkey->ipsl_valid & IPSL_ICMP_TYPE) {
1445 offset = spdsock_encode_typecode(base, offset,
1446 selkey->ipsl_icmp_type, selkey->ipsl_icmp_type_end,
1447 (selkey->ipsl_valid & IPSL_ICMP_CODE) ?
1448 selkey->ipsl_icmp_code : 255,
1449 (selkey->ipsl_valid & IPSL_ICMP_CODE) ?
1450 selkey->ipsl_icmp_code_end : 255);
1451 }
1452 return (offset);
1453 }
1454
1455 static uint_t
1456 spdsock_encode_actattr(uint8_t *base, uint_t offset, uint32_t tag,
1457 uint32_t value)
1458 {
1459 struct spd_attribute *attr;
1460
1461 ASSERT(ALIGNED64(offset));
1462
1463 if (base != NULL) {
1464 attr = (struct spd_attribute *)(base + offset);
1465 attr->spd_attr_tag = tag;
1466 attr->spd_attr_value = value;
1467 }
1468 offset += sizeof (struct spd_attribute);
1469
1470 ASSERT(ALIGNED64(offset));
1471
1472 return (offset);
1473 }
1474
1475
1476 #define EMIT(t, v) offset = spdsock_encode_actattr(base, offset, (t), (v))
1477
1478 static uint_t
1479 spdsock_encode_action(uint8_t *base, uint_t offset, const ipsec_action_t *ap)
1480 {
1481 const struct ipsec_act *act = &(ap->ipa_act);
1482 uint_t flags;
1483
1484 EMIT(SPD_ATTR_EMPTY, 0);
1485 switch (act->ipa_type) {
1486 case IPSEC_ACT_DISCARD:
1487 case IPSEC_ACT_REJECT:
1488 EMIT(SPD_ATTR_TYPE, SPD_ACTTYPE_DROP);
1489 break;
1490 case IPSEC_ACT_BYPASS:
1491 case IPSEC_ACT_CLEAR:
1492 EMIT(SPD_ATTR_TYPE, SPD_ACTTYPE_PASS);
1493 break;
1494
1495 case IPSEC_ACT_APPLY:
1496 EMIT(SPD_ATTR_TYPE, SPD_ACTTYPE_IPSEC);
1497 flags = 0;
1498 if (act->ipa_apply.ipp_use_ah)
1499 flags |= SPD_APPLY_AH;
1500 if (act->ipa_apply.ipp_use_esp)
1501 flags |= SPD_APPLY_ESP;
1502 if (act->ipa_apply.ipp_use_espa)
1503 flags |= SPD_APPLY_ESPA;
1504 if (act->ipa_apply.ipp_use_se)
1505 flags |= SPD_APPLY_SE;
1506 if (act->ipa_apply.ipp_use_unique)
1507 flags |= SPD_APPLY_UNIQUE;
1508 EMIT(SPD_ATTR_FLAGS, flags);
1509 if (flags & SPD_APPLY_AH) {
1510 EMIT(SPD_ATTR_AH_AUTH, act->ipa_apply.ipp_auth_alg);
1511 EMIT(SPD_ATTR_AH_MINBITS,
1512 act->ipa_apply.ipp_ah_minbits);
1513 EMIT(SPD_ATTR_AH_MAXBITS,
1514 act->ipa_apply.ipp_ah_maxbits);
1515 }
1516 if (flags & SPD_APPLY_ESP) {
1517 EMIT(SPD_ATTR_ESP_ENCR, act->ipa_apply.ipp_encr_alg);
1518 EMIT(SPD_ATTR_ENCR_MINBITS,
1519 act->ipa_apply.ipp_espe_minbits);
1520 EMIT(SPD_ATTR_ENCR_MAXBITS,
1521 act->ipa_apply.ipp_espe_maxbits);
1522 if (flags & SPD_APPLY_ESPA) {
1523 EMIT(SPD_ATTR_ESP_AUTH,
1524 act->ipa_apply.ipp_esp_auth_alg);
1525 EMIT(SPD_ATTR_ESPA_MINBITS,
1526 act->ipa_apply.ipp_espa_minbits);
1527 EMIT(SPD_ATTR_ESPA_MAXBITS,
1528 act->ipa_apply.ipp_espa_maxbits);
1529 }
1530 }
1531 if (act->ipa_apply.ipp_km_proto != 0)
1532 EMIT(SPD_ATTR_KM_PROTO, act->ipa_apply.ipp_km_proto);
1533 if (act->ipa_apply.ipp_km_cookie != 0)
1534 EMIT(SPD_ATTR_KM_PROTO, act->ipa_apply.ipp_km_cookie);
1535 if (act->ipa_apply.ipp_replay_depth != 0)
1536 EMIT(SPD_ATTR_REPLAY_DEPTH,
1537 act->ipa_apply.ipp_replay_depth);
1538 /* Add more here */
1539 break;
1540 }
1541
1542 return (offset);
1543 }
1544
1545 static uint_t
1546 spdsock_encode_action_list(uint8_t *base, uint_t offset,
1547 const ipsec_action_t *ap)
1548 {
1549 struct spd_ext_actions *act;
1550 uint_t nact = 0;
1551 uint_t start = offset;
1552
1553 ASSERT(ALIGNED64(offset));
1554
1555 if (base != NULL) {
1556 act = (struct spd_ext_actions *)(base + offset);
1557 act->spd_actions_len = 0;
1558 act->spd_actions_exttype = SPD_EXT_ACTION;
1559 act->spd_actions_count = 0;
1560 act->spd_actions_reserved = 0;
1561 }
1562
1563 offset += sizeof (*act);
1564
1565 ASSERT(ALIGNED64(offset));
1566
1567 while (ap != NULL) {
1568 offset = spdsock_encode_action(base, offset, ap);
1569 ap = ap->ipa_next;
1570 nact++;
1571 if (ap != NULL) {
1572 EMIT(SPD_ATTR_NEXT, 0);
1573 }
1574 }
1575 EMIT(SPD_ATTR_END, 0);
1576
1577 ASSERT(ALIGNED64(offset));
1578
1579 if (base != NULL) {
1580 act->spd_actions_count = nact;
1581 act->spd_actions_len = SPD_8TO64(offset - start);
1582 }
1583
1584 return (offset);
1585 }
1586
1587 #undef EMIT
1588
1589 /* ARGSUSED */
1590 static uint_t
1591 spdsock_rule_flags(uint_t dir, uint_t af)
1592 {
1593 uint_t flags = 0;
1594
1595 if (dir == IPSEC_TYPE_INBOUND)
1596 flags |= SPD_RULE_FLAG_INBOUND;
1597 if (dir == IPSEC_TYPE_OUTBOUND)
1598 flags |= SPD_RULE_FLAG_OUTBOUND;
1599
1600 return (flags);
1601 }
1602
1603
1604 static uint_t
1605 spdsock_encode_rule_head(uint8_t *base, uint_t offset, spd_msg_t *req,
1606 const ipsec_policy_t *rule, uint_t dir, uint_t af, char *name,
1607 boolean_t tunnel)
1608 {
1609 struct spd_msg *spmsg;
1610 struct spd_rule *spr;
1611 spd_if_t *sid;
1612
1613 uint_t start = offset;
1614
1615 ASSERT(ALIGNED64(offset));
1616
1617 if (base != NULL) {
1618 spmsg = (struct spd_msg *)(base + offset);
1619 bzero(spmsg, sizeof (*spmsg));
1620 spmsg->spd_msg_version = PF_POLICY_V1;
1621 spmsg->spd_msg_type = SPD_DUMP;
1622 spmsg->spd_msg_seq = req->spd_msg_seq;
1623 spmsg->spd_msg_pid = req->spd_msg_pid;
1624 }
1625 offset += sizeof (struct spd_msg);
1626
1627 ASSERT(ALIGNED64(offset));
1628
1629 if (base != NULL) {
1630 spr = (struct spd_rule *)(base + offset);
1631 spr->spd_rule_type = SPD_EXT_RULE;
1632 spr->spd_rule_priority = rule->ipsp_prio;
1633 spr->spd_rule_flags = spdsock_rule_flags(dir, af);
1634 if (tunnel)
1635 spr->spd_rule_flags |= SPD_RULE_FLAG_TUNNEL;
1636 spr->spd_rule_unused = 0;
1637 spr->spd_rule_len = SPD_8TO64(sizeof (*spr));
1638 spr->spd_rule_index = rule->ipsp_index;
1639 }
1640 offset += sizeof (struct spd_rule);
1641
1642 /*
1643 * If we have an interface name (i.e. if this policy head came from
1644 * a tunnel), add the SPD_EXT_TUN_NAME extension.
1645 */
1646 if (name != NULL) {
1647
1648 ASSERT(ALIGNED64(offset));
1649
1650 if (base != NULL) {
1651 sid = (spd_if_t *)(base + offset);
1652 sid->spd_if_exttype = SPD_EXT_TUN_NAME;
1653 sid->spd_if_len = SPD_8TO64(sizeof (spd_if_t) +
1654 roundup((strlen(name) - 4), 8));
1655 (void) strlcpy((char *)sid->spd_if_name, name,
1656 LIFNAMSIZ);
1657 }
1658
1659 offset += sizeof (spd_if_t) + roundup((strlen(name) - 4), 8);
1660 }
1661
1662 offset = spdsock_encode_sel(base, offset, rule->ipsp_sel);
1663 offset = spdsock_encode_action_list(base, offset, rule->ipsp_act);
1664
1665 ASSERT(ALIGNED64(offset));
1666
1667 if (base != NULL) {
1668 spmsg->spd_msg_len = SPD_8TO64(offset - start);
1669 }
1670 return (offset);
1671 }
1672
1673 /* ARGSUSED */
1674 static mblk_t *
1675 spdsock_encode_rule(mblk_t *req, const ipsec_policy_t *rule,
1676 uint_t dir, uint_t af, char *name, boolean_t tunnel)
1677 {
1678 mblk_t *m;
1679 uint_t len;
1680 spd_msg_t *mreq = (spd_msg_t *)req->b_rptr;
1681
1682 /*
1683 * Figure out how much space we'll need.
1684 */
1685 len = spdsock_encode_rule_head(NULL, 0, mreq, rule, dir, af, name,
1686 tunnel);
1687
1688 /*
1689 * Allocate mblk.
1690 */
1691 m = allocb(len, BPRI_HI);
1692 if (m == NULL)
1693 return (NULL);
1694
1695 /*
1696 * Fill it in..
1697 */
1698 m->b_wptr = m->b_rptr + len;
1699 bzero(m->b_rptr, len);
1700 (void) spdsock_encode_rule_head(m->b_rptr, 0, mreq, rule, dir, af,
1701 name, tunnel);
1702 return (m);
1703 }
1704
1705 static ipsec_policy_t *
1706 spdsock_dump_next_in_chain(spdsock_t *ss, ipsec_policy_head_t *iph,
1707 ipsec_policy_t *cur)
1708 {
1709 ASSERT(RW_READ_HELD(&iph->iph_lock));
1710
1711 ss->spdsock_dump_count++;
1712 ss->spdsock_dump_cur_rule = cur->ipsp_hash.hash_next;
1713 return (cur);
1714 }
1715
1716 static ipsec_policy_t *
1717 spdsock_dump_next_rule(spdsock_t *ss, ipsec_policy_head_t *iph)
1718 {
1719 ipsec_policy_t *cur;
1720 ipsec_policy_root_t *ipr;
1721 int chain, nchains, type, af;
1722
1723 ASSERT(RW_READ_HELD(&iph->iph_lock));
1724
1725 cur = ss->spdsock_dump_cur_rule;
1726
1727 if (cur != NULL)
1728 return (spdsock_dump_next_in_chain(ss, iph, cur));
1729
1730 type = ss->spdsock_dump_cur_type;
1731
1732 next:
1733 chain = ss->spdsock_dump_cur_chain;
1734 ipr = &iph->iph_root[type];
1735 nchains = ipr->ipr_nchains;
1736
1737 while (chain < nchains) {
1738 cur = ipr->ipr_hash[chain].hash_head;
1739 chain++;
1740 if (cur != NULL) {
1741 ss->spdsock_dump_cur_chain = chain;
1742 return (spdsock_dump_next_in_chain(ss, iph, cur));
1743 }
1744 }
1745 ss->spdsock_dump_cur_chain = nchains;
1746
1747 af = ss->spdsock_dump_cur_af;
1748 while (af < IPSEC_NAF) {
1749 cur = ipr->ipr_nonhash[af];
1750 af++;
1751 if (cur != NULL) {
1752 ss->spdsock_dump_cur_af = af;
1753 return (spdsock_dump_next_in_chain(ss, iph, cur));
1754 }
1755 }
1756
1757 type++;
1758 if (type >= IPSEC_NTYPES)
1759 return (NULL);
1760
1761 ss->spdsock_dump_cur_chain = 0;
1762 ss->spdsock_dump_cur_type = type;
1763 ss->spdsock_dump_cur_af = IPSEC_AF_V4;
1764 goto next;
1765
1766 }
1767
1768 /*
1769 * If we're done with one policy head, but have more to go, we iterate through
1770 * another IPsec tunnel policy head (itp). Return NULL if it is an error
1771 * worthy of returning EAGAIN via PF_POLICY.
1772 */
1773 static ipsec_tun_pol_t *
1774 spdsock_dump_iterate_next_tunnel(spdsock_t *ss, ipsec_stack_t *ipss)
1775 {
1776 ipsec_tun_pol_t *itp;
1777
1778 ASSERT(RW_READ_HELD(&ipss->ipsec_tunnel_policy_lock));
1779 if (ipss->ipsec_tunnel_policy_gen > ss->spdsock_dump_tun_gen) {
1780 /* Oops, state of the tunnel polheads changed. */
1781 itp = NULL;
1782 } else if (ss->spdsock_itp == NULL) {
1783 /* Just finished global, find first node. */
1784 itp = avl_first(&ipss->ipsec_tunnel_policies);
1785 } else {
1786 /* We just finished current polhead, find the next one. */
1787 itp = AVL_NEXT(&ipss->ipsec_tunnel_policies, ss->spdsock_itp);
1788 }
1789 if (itp != NULL) {
1790 ITP_REFHOLD(itp);
1791 }
1792 if (ss->spdsock_itp != NULL) {
1793 ITP_REFRELE(ss->spdsock_itp, ipss->ipsec_netstack);
1794 }
1795 ss->spdsock_itp = itp;
1796 return (itp);
1797 }
1798
1799 static mblk_t *
1800 spdsock_dump_next_record(spdsock_t *ss)
1801 {
1802 ipsec_policy_head_t *iph;
1803 ipsec_policy_t *rule;
1804 mblk_t *m;
1805 ipsec_tun_pol_t *itp;
1806 netstack_t *ns = ss->spdsock_spds->spds_netstack;
1807 ipsec_stack_t *ipss = ns->netstack_ipsec;
1808
1809 iph = ss->spdsock_dump_head;
1810
1811 ASSERT(iph != NULL);
1812
1813 rw_enter(&iph->iph_lock, RW_READER);
1814
1815 if (iph->iph_gen != ss->spdsock_dump_gen) {
1816 rw_exit(&iph->iph_lock);
1817 return (spdsock_dump_finish(ss, EAGAIN));
1818 }
1819
1820 while ((rule = spdsock_dump_next_rule(ss, iph)) == NULL) {
1821 rw_exit(&iph->iph_lock);
1822 if (--(ss->spdsock_dump_remaining_polheads) == 0)
1823 return (spdsock_dump_finish(ss, 0));
1824
1825
1826 /*
1827 * If we reach here, we have more policy heads (tunnel
1828 * entries) to dump. Let's reset to a new policy head
1829 * and get some more rules.
1830 *
1831 * An empty policy head will have spdsock_dump_next_rule()
1832 * return NULL, and we loop (while dropping the number of
1833 * remaining polheads). If we loop to 0, we finish. We
1834 * keep looping until we hit 0 or until we have a rule to
1835 * encode.
1836 *
1837 * NOTE: No need for ITP_REF*() macros here as we're only
1838 * going after and refholding the policy head itself.
1839 */
1840 rw_enter(&ipss->ipsec_tunnel_policy_lock, RW_READER);
1841 itp = spdsock_dump_iterate_next_tunnel(ss, ipss);
1842 if (itp == NULL) {
1843 rw_exit(&ipss->ipsec_tunnel_policy_lock);
1844 return (spdsock_dump_finish(ss, EAGAIN));
1845 }
1846
1847 /* Reset other spdsock_dump thingies. */
1848 IPPH_REFRELE(ss->spdsock_dump_head, ns);
1849 if (ss->spdsock_dump_active) {
1850 ss->spdsock_dump_tunnel =
1851 itp->itp_flags & ITPF_P_TUNNEL;
1852 iph = itp->itp_policy;
1853 } else {
1854 ss->spdsock_dump_tunnel =
1855 itp->itp_flags & ITPF_I_TUNNEL;
1856 iph = itp->itp_inactive;
1857 }
1858 IPPH_REFHOLD(iph);
1859 rw_exit(&ipss->ipsec_tunnel_policy_lock);
1860
1861 rw_enter(&iph->iph_lock, RW_READER);
1862 RESET_SPDSOCK_DUMP_POLHEAD(ss, iph);
1863 }
1864
1865 m = spdsock_encode_rule(ss->spdsock_dump_req, rule,
1866 ss->spdsock_dump_cur_type, ss->spdsock_dump_cur_af,
1867 (ss->spdsock_itp == NULL) ? NULL : ss->spdsock_itp->itp_name,
1868 ss->spdsock_dump_tunnel);
1869 rw_exit(&iph->iph_lock);
1870
1871 if (m == NULL)
1872 return (spdsock_dump_finish(ss, ENOMEM));
1873 return (m);
1874 }
1875
1876 /*
1877 * Dump records until we run into flow-control back-pressure.
1878 */
1879 static void
1880 spdsock_dump_some(queue_t *q, spdsock_t *ss)
1881 {
1882 mblk_t *m, *dataind;
1883
1884 while ((ss->spdsock_dump_req != NULL) && canputnext(q)) {
1885 m = spdsock_dump_next_record(ss);
1886 if (m == NULL)
1887 return;
1888 dataind = allocb(sizeof (struct T_data_req), BPRI_HI);
1889 if (dataind == NULL) {
1890 freemsg(m);
1891 return;
1892 }
1893 dataind->b_cont = m;
1894 dataind->b_wptr += sizeof (struct T_data_req);
1895 ((struct T_data_ind *)dataind->b_rptr)->PRIM_type = T_DATA_IND;
1896 ((struct T_data_ind *)dataind->b_rptr)->MORE_flag = 0;
1897 dataind->b_datap->db_type = M_PROTO;
1898 putnext(q, dataind);
1899 }
1900 }
1901
1902 /*
1903 * Start dumping.
1904 * Format a start-of-dump record, and set up the stream and kick the rsrv
1905 * procedure to continue the job..
1906 */
1907 /* ARGSUSED */
1908 static void
1909 spdsock_dump(queue_t *q, ipsec_policy_head_t *iph, mblk_t *mp)
1910 {
1911 spdsock_t *ss = (spdsock_t *)q->q_ptr;
1912 netstack_t *ns = ss->spdsock_spds->spds_netstack;
1913 ipsec_stack_t *ipss = ns->netstack_ipsec;
1914 mblk_t *mr;
1915
1916 /* spdsock_open() already set spdsock_itp to NULL. */
1917 if (iph == ALL_ACTIVE_POLHEADS || iph == ALL_INACTIVE_POLHEADS) {
1918 rw_enter(&ipss->ipsec_tunnel_policy_lock, RW_READER);
1919 ss->spdsock_dump_remaining_polheads = 1 +
1920 avl_numnodes(&ipss->ipsec_tunnel_policies);
1921 ss->spdsock_dump_tun_gen = ipss->ipsec_tunnel_policy_gen;
1922 rw_exit(&ipss->ipsec_tunnel_policy_lock);
1923 if (iph == ALL_ACTIVE_POLHEADS) {
1924 iph = ipsec_system_policy(ns);
1925 ss->spdsock_dump_active = B_TRUE;
1926 } else {
1927 iph = ipsec_inactive_policy(ns);
1928 ss->spdsock_dump_active = B_FALSE;
1929 }
1930 ASSERT(ss->spdsock_itp == NULL);
1931 } else {
1932 ss->spdsock_dump_remaining_polheads = 1;
1933 }
1934
1935 rw_enter(&iph->iph_lock, RW_READER);
1936
1937 mr = spdsock_dump_ruleset(mp, iph, 0, 0);
1938
1939 if (!mr) {
1940 rw_exit(&iph->iph_lock);
1941 spdsock_error(q, mp, ENOMEM, 0);
1942 return;
1943 }
1944
1945 ss->spdsock_dump_req = mp;
1946 RESET_SPDSOCK_DUMP_POLHEAD(ss, iph);
1947
1948 rw_exit(&iph->iph_lock);
1949
1950 qreply(q, mr);
1951 qenable(OTHERQ(q));
1952 }
1953
1954 /* Do NOT consume a reference to ITP. */
1955 void
1956 spdsock_clone_node(ipsec_tun_pol_t *itp, void *ep, netstack_t *ns)
1957 {
1958 int *errptr = (int *)ep;
1959
1960 if (*errptr != 0)
1961 return; /* We've failed already for some reason. */
1962 mutex_enter(&itp->itp_lock);
1963 ITPF_CLONE(itp->itp_flags);
1964 *errptr = ipsec_copy_polhead(itp->itp_policy, itp->itp_inactive, ns);
1965 mutex_exit(&itp->itp_lock);
1966 }
1967
1968 void
1969 spdsock_clone(queue_t *q, mblk_t *mp, spd_if_t *tunname)
1970 {
1971 int error;
1972 char *tname;
1973 ipsec_tun_pol_t *itp;
1974 spdsock_t *ss = (spdsock_t *)q->q_ptr;
1975 netstack_t *ns = ss->spdsock_spds->spds_netstack;
1976
1977 if (tunname != NULL) {
1978 tname = (char *)tunname->spd_if_name;
1979 if (*tname == '\0') {
1980 error = ipsec_clone_system_policy(ns);
1981 if (error == 0) {
1982 itp_walk(spdsock_clone_node, &error, ns);
1983 }
1984 } else {
1985 itp = get_tunnel_policy(tname, ns);
1986 if (itp == NULL) {
1987 spdsock_error(q, mp, ENOENT, 0);
1988 return;
1989 }
1990 spdsock_clone_node(itp, &error, NULL);
1991 ITP_REFRELE(itp, ns);
1992 }
1993 } else {
1994 error = ipsec_clone_system_policy(ns);
1995 }
1996
1997 if (error != 0)
1998 spdsock_error(q, mp, error, 0);
1999 else
2000 spd_echo(q, mp);
2001 }
2002
2003 /*
2004 * Process a SPD_ALGLIST request. The caller expects separate alg entries
2005 * for AH authentication, ESP authentication, and ESP encryption.
2006 * The same distinction is then used when setting the min and max key
2007 * sizes when defining policies.
2008 */
2009
2010 #define SPDSOCK_AH_AUTH 0
2011 #define SPDSOCK_ESP_AUTH 1
2012 #define SPDSOCK_ESP_ENCR 2
2013 #define SPDSOCK_NTYPES 3
2014
2015 static const uint_t algattr[SPDSOCK_NTYPES] = {
2016 SPD_ATTR_AH_AUTH,
2017 SPD_ATTR_ESP_AUTH,
2018 SPD_ATTR_ESP_ENCR
2019 };
2020 static const uint_t minbitsattr[SPDSOCK_NTYPES] = {
2021 SPD_ATTR_AH_MINBITS,
2022 SPD_ATTR_ESPA_MINBITS,
2023 SPD_ATTR_ENCR_MINBITS
2024 };
2025 static const uint_t maxbitsattr[SPDSOCK_NTYPES] = {
2026 SPD_ATTR_AH_MAXBITS,
2027 SPD_ATTR_ESPA_MAXBITS,
2028 SPD_ATTR_ENCR_MAXBITS
2029 };
2030 static const uint_t defbitsattr[SPDSOCK_NTYPES] = {
2031 SPD_ATTR_AH_DEFBITS,
2032 SPD_ATTR_ESPA_DEFBITS,
2033 SPD_ATTR_ENCR_DEFBITS
2034 };
2035 static const uint_t incrbitsattr[SPDSOCK_NTYPES] = {
2036 SPD_ATTR_AH_INCRBITS,
2037 SPD_ATTR_ESPA_INCRBITS,
2038 SPD_ATTR_ENCR_INCRBITS
2039 };
2040
2041 #define ATTRPERALG 6 /* fixed attributes per algs */
2042
2043 void
2044 spdsock_alglist(queue_t *q, mblk_t *mp)
2045 {
2046 uint_t algtype;
2047 uint_t algidx;
2048 uint_t algcount;
2049 uint_t size;
2050 mblk_t *m;
2051 uint8_t *cur;
2052 spd_msg_t *msg;
2053 struct spd_ext_actions *act;
2054 struct spd_attribute *attr;
2055 spdsock_t *ss = (spdsock_t *)q->q_ptr;
2056 ipsec_stack_t *ipss = ss->spdsock_spds->spds_netstack->netstack_ipsec;
2057
2058 rw_enter(&ipss->ipsec_alg_lock, RW_READER);
2059 /*
2060 * The SPD client expects to receive separate entries for
2061 * AH authentication and ESP authentication supported algorithms.
2062 *
2063 * Don't return the "any" algorithms, if defined, as no
2064 * kernel policies can be set for these algorithms.
2065 */
2066 algcount = 2 * ipss->ipsec_nalgs[IPSEC_ALG_AUTH] +
2067 ipss->ipsec_nalgs[IPSEC_ALG_ENCR];
2068
2069 if (ipss->ipsec_alglists[IPSEC_ALG_AUTH][SADB_AALG_NONE] != NULL)
2070 algcount--;
2071 if (ipss->ipsec_alglists[IPSEC_ALG_ENCR][SADB_EALG_NONE] != NULL)
2072 algcount--;
2073
2074 /*
2075 * For each algorithm, we encode:
2076 * ALG / MINBITS / MAXBITS / DEFBITS / INCRBITS / {END, NEXT}
2077 */
2078
2079 size = sizeof (spd_msg_t) + sizeof (struct spd_ext_actions) +
2080 ATTRPERALG * sizeof (struct spd_attribute) * algcount;
2081
2082 ASSERT(ALIGNED64(size));
2083
2084 m = allocb(size, BPRI_HI);
2085 if (m == NULL) {
2086 rw_exit(&ipss->ipsec_alg_lock);
2087 spdsock_error(q, mp, ENOMEM, 0);
2088 return;
2089 }
2090
2091 m->b_wptr = m->b_rptr + size;
2092 cur = m->b_rptr;
2093
2094 msg = (spd_msg_t *)cur;
2095 bcopy(mp->b_rptr, cur, sizeof (*msg));
2096
2097 msg->spd_msg_len = SPD_8TO64(size);
2098 msg->spd_msg_errno = 0;
2099 msg->spd_msg_diagnostic = 0;
2100
2101 cur += sizeof (*msg);
2102
2103 act = (struct spd_ext_actions *)cur;
2104 cur += sizeof (*act);
2105
2106 act->spd_actions_len = SPD_8TO64(size - sizeof (spd_msg_t));
2107 act->spd_actions_exttype = SPD_EXT_ACTION;
2108 act->spd_actions_count = algcount;
2109 act->spd_actions_reserved = 0;
2110
2111 attr = (struct spd_attribute *)cur;
2112
2113 #define EMIT(tag, value) { \
2114 attr->spd_attr_tag = (tag); \
2115 attr->spd_attr_value = (value); \
2116 attr++; \
2117 }
2118
2119 /*
2120 * If you change the number of EMIT's here, change
2121 * ATTRPERALG above to match
2122 */
2123 #define EMITALGATTRS(_type) { \
2124 EMIT(algattr[_type], algid); /* 1 */ \
2125 EMIT(minbitsattr[_type], minbits); /* 2 */ \
2126 EMIT(maxbitsattr[_type], maxbits); /* 3 */ \
2127 EMIT(defbitsattr[_type], defbits); /* 4 */ \
2128 EMIT(incrbitsattr[_type], incr); /* 5 */ \
2129 EMIT(SPD_ATTR_NEXT, 0); /* 6 */ \
2130 }
2131
2132 for (algtype = 0; algtype < IPSEC_NALGTYPES; algtype++) {
2133 for (algidx = 0; algidx < ipss->ipsec_nalgs[algtype];
2134 algidx++) {
2135 int algid = ipss->ipsec_sortlist[algtype][algidx];
2136 ipsec_alginfo_t *alg =
2137 ipss->ipsec_alglists[algtype][algid];
2138 uint_t minbits = alg->alg_minbits;
2139 uint_t maxbits = alg->alg_maxbits;
2140 uint_t defbits = alg->alg_default_bits;
2141 uint_t incr = alg->alg_increment;
2142
2143 if (algtype == IPSEC_ALG_AUTH) {
2144 if (algid == SADB_AALG_NONE)
2145 continue;
2146 EMITALGATTRS(SPDSOCK_AH_AUTH);
2147 EMITALGATTRS(SPDSOCK_ESP_AUTH);
2148 } else {
2149 if (algid == SADB_EALG_NONE)
2150 continue;
2151 ASSERT(algtype == IPSEC_ALG_ENCR);
2152 EMITALGATTRS(SPDSOCK_ESP_ENCR);
2153 }
2154 }
2155 }
2156
2157 rw_exit(&ipss->ipsec_alg_lock);
2158
2159 #undef EMITALGATTRS
2160 #undef EMIT
2161 #undef ATTRPERALG
2162
2163 attr--;
2164 attr->spd_attr_tag = SPD_ATTR_END;
2165
2166 freemsg(mp);
2167 qreply(q, m);
2168 }
2169
2170 /*
2171 * Process a SPD_DUMPALGS request.
2172 */
2173
2174 #define ATTRPERALG 9 /* fixed attributes per algs */
2175
2176 void
2177 spdsock_dumpalgs(queue_t *q, mblk_t *mp)
2178 {
2179 uint_t algtype;
2180 uint_t algidx;
2181 uint_t size;
2182 mblk_t *m;
2183 uint8_t *cur;
2184 spd_msg_t *msg;
2185 struct spd_ext_actions *act;
2186 struct spd_attribute *attr;
2187 ipsec_alginfo_t *alg;
2188 uint_t algid;
2189 uint_t i;
2190 uint_t alg_size;
2191 spdsock_t *ss = (spdsock_t *)q->q_ptr;
2192 ipsec_stack_t *ipss = ss->spdsock_spds->spds_netstack->netstack_ipsec;
2193
2194 rw_enter(&ipss->ipsec_alg_lock, RW_READER);
2195
2196 /*
2197 * For each algorithm, we encode:
2198 * ALG / MINBITS / MAXBITS / DEFBITS / INCRBITS / {END, NEXT}
2199 *
2200 * ALG_ID / ALG_PROTO / ALG_INCRBITS / ALG_NKEYSIZES / ALG_KEYSIZE*
2201 * ALG_NBLOCKSIZES / ALG_BLOCKSIZE* / ALG_NPARAMS / ALG_PARAMS* /
2202 * ALG_MECHNAME / ALG_FLAGS / {END, NEXT}
2203 */
2204
2205 /*
2206 * Compute the size of the SPD message.
2207 */
2208 size = sizeof (spd_msg_t) + sizeof (struct spd_ext_actions);
2209
2210 for (algtype = 0; algtype < IPSEC_NALGTYPES; algtype++) {
2211 for (algidx = 0; algidx < ipss->ipsec_nalgs[algtype];
2212 algidx++) {
2213 algid = ipss->ipsec_sortlist[algtype][algidx];
2214 alg = ipss->ipsec_alglists[algtype][algid];
2215 alg_size = sizeof (struct spd_attribute) *
2216 (ATTRPERALG + alg->alg_nkey_sizes +
2217 alg->alg_nblock_sizes + alg->alg_nparams) +
2218 CRYPTO_MAX_MECH_NAME;
2219 size += alg_size;
2220 }
2221 }
2222
2223 ASSERT(ALIGNED64(size));
2224
2225 m = allocb(size, BPRI_HI);
2226 if (m == NULL) {
2227 rw_exit(&ipss->ipsec_alg_lock);
2228 spdsock_error(q, mp, ENOMEM, 0);
2229 return;
2230 }
2231
2232 m->b_wptr = m->b_rptr + size;
2233 cur = m->b_rptr;
2234
2235 msg = (spd_msg_t *)cur;
2236 bcopy(mp->b_rptr, cur, sizeof (*msg));
2237
2238 msg->spd_msg_len = SPD_8TO64(size);
2239 msg->spd_msg_errno = 0;
2240 msg->spd_msg_type = SPD_ALGLIST;
2241
2242 msg->spd_msg_diagnostic = 0;
2243
2244 cur += sizeof (*msg);
2245
2246 act = (struct spd_ext_actions *)cur;
2247 cur += sizeof (*act);
2248
2249 act->spd_actions_len = SPD_8TO64(size - sizeof (spd_msg_t));
2250 act->spd_actions_exttype = SPD_EXT_ACTION;
2251 act->spd_actions_count = ipss->ipsec_nalgs[IPSEC_ALG_AUTH] +
2252 ipss->ipsec_nalgs[IPSEC_ALG_ENCR];
2253 act->spd_actions_reserved = 0;
2254
2255 /*
2256 * If there aren't any algorithms registered, return an empty message.
2257 * spdsock_get_ext() knows how to deal with this.
2258 */
2259 if (act->spd_actions_count == 0) {
2260 act->spd_actions_len = 0;
2261 rw_exit(&ipss->ipsec_alg_lock);
2262 goto error;
2263 }
2264
2265 attr = (struct spd_attribute *)cur;
2266
2267 #define EMIT(tag, value) { \
2268 attr->spd_attr_tag = (tag); \
2269 attr->spd_attr_value = (value); \
2270 attr++; \
2271 }
2272
2273 for (algtype = 0; algtype < IPSEC_NALGTYPES; algtype++) {
2274 for (algidx = 0; algidx < ipss->ipsec_nalgs[algtype];
2275 algidx++) {
2276
2277 algid = ipss->ipsec_sortlist[algtype][algidx];
2278 alg = ipss->ipsec_alglists[algtype][algid];
2279
2280 /*
2281 * If you change the number of EMIT's here, change
2282 * ATTRPERALG above to match
2283 */
2284 EMIT(SPD_ATTR_ALG_ID, algid);
2285 EMIT(SPD_ATTR_ALG_PROTO, algproto[algtype]);
2286 EMIT(SPD_ATTR_ALG_INCRBITS, alg->alg_increment);
2287 EMIT(SPD_ATTR_ALG_NKEYSIZES, alg->alg_nkey_sizes);
2288 for (i = 0; i < alg->alg_nkey_sizes; i++)
2289 EMIT(SPD_ATTR_ALG_KEYSIZE,
2290 alg->alg_key_sizes[i]);
2291
2292 EMIT(SPD_ATTR_ALG_NBLOCKSIZES, alg->alg_nblock_sizes);
2293 for (i = 0; i < alg->alg_nblock_sizes; i++)
2294 EMIT(SPD_ATTR_ALG_BLOCKSIZE,
2295 alg->alg_block_sizes[i]);
2296
2297 EMIT(SPD_ATTR_ALG_NPARAMS, alg->alg_nparams);
2298 for (i = 0; i < alg->alg_nparams; i++)
2299 EMIT(SPD_ATTR_ALG_PARAMS,
2300 alg->alg_params[i]);
2301
2302 EMIT(SPD_ATTR_ALG_FLAGS, alg->alg_flags);
2303
2304 EMIT(SPD_ATTR_ALG_MECHNAME, CRYPTO_MAX_MECH_NAME);
2305 bcopy(alg->alg_mech_name, attr, CRYPTO_MAX_MECH_NAME);
2306 attr = (struct spd_attribute *)((char *)attr +
2307 CRYPTO_MAX_MECH_NAME);
2308
2309 EMIT(SPD_ATTR_NEXT, 0);
2310 }
2311 }
2312
2313 rw_exit(&ipss->ipsec_alg_lock);
2314
2315 #undef EMITALGATTRS
2316 #undef EMIT
2317 #undef ATTRPERALG
2318
2319 attr--;
2320 attr->spd_attr_tag = SPD_ATTR_END;
2321
2322 error:
2323 freemsg(mp);
2324 qreply(q, m);
2325 }
2326
2327 /*
2328 * Do the actual work of processing an SPD_UPDATEALGS request. Can
2329 * be invoked either once IPsec is loaded on a cached request, or
2330 * when a request is received while IPsec is loaded.
2331 */
2332 static int
2333 spdsock_do_updatealg(spd_ext_t *extv[], spd_stack_t *spds)
2334 {
2335 struct spd_ext_actions *actp;
2336 struct spd_attribute *attr, *endattr;
2337 uint64_t *start, *end;
2338 ipsec_alginfo_t *alg = NULL;
2339 ipsec_algtype_t alg_type = 0;
2340 boolean_t skip_alg = B_TRUE, doing_proto = B_FALSE;
2341 uint_t i, cur_key, cur_block, algid;
2342 int diag = -1;
2343
2344 ASSERT(MUTEX_HELD(&spds->spds_alg_lock));
2345
2346 /* parse the message, building the list of algorithms */
2347
2348 actp = (struct spd_ext_actions *)extv[SPD_EXT_ACTION];
2349 if (actp == NULL)
2350 return (SPD_DIAGNOSTIC_NO_ACTION_EXT);
2351
2352 start = (uint64_t *)actp;
2353 end = (start + actp->spd_actions_len);
2354 endattr = (struct spd_attribute *)end;
2355 attr = (struct spd_attribute *)&actp[1];
2356
2357 bzero(spds->spds_algs, IPSEC_NALGTYPES * IPSEC_MAX_ALGS *
2358 sizeof (ipsec_alginfo_t *));
2359
2360 alg = kmem_zalloc(sizeof (*alg), KM_SLEEP);
2361
2362 #define ALG_KEY_SIZES(a) (((a)->alg_nkey_sizes + 1) * sizeof (uint16_t))
2363 #define ALG_BLOCK_SIZES(a) (((a)->alg_nblock_sizes + 1) * sizeof (uint16_t))
2364 #define ALG_PARAM_SIZES(a) (((a)->alg_nparams + 1) * sizeof (uint16_t))
2365
2366 while (attr < endattr) {
2367 switch (attr->spd_attr_tag) {
2368 case SPD_ATTR_NOP:
2369 case SPD_ATTR_EMPTY:
2370 break;
2371 case SPD_ATTR_END:
2372 attr = endattr;
2373 /* FALLTHRU */
2374 case SPD_ATTR_NEXT:
2375 if (doing_proto) {
2376 doing_proto = B_FALSE;
2377 break;
2378 }
2379 if (skip_alg) {
2380 ipsec_alg_free(alg);
2381 } else {
2382 ipsec_alg_free(
2383 spds->spds_algs[alg_type][alg->alg_id]);
2384 spds->spds_algs[alg_type][alg->alg_id] =
2385 alg;
2386 }
2387 alg = kmem_zalloc(sizeof (*alg), KM_SLEEP);
2388 break;
2389
2390 case SPD_ATTR_ALG_ID:
2391 if (attr->spd_attr_value >= IPSEC_MAX_ALGS) {
2392 ss1dbg(spds, ("spdsock_do_updatealg: "
2393 "invalid alg id %d\n",
2394 attr->spd_attr_value));
2395 diag = SPD_DIAGNOSTIC_ALG_ID_RANGE;
2396 goto bail;
2397 }
2398 alg->alg_id = attr->spd_attr_value;
2399 break;
2400
2401 case SPD_ATTR_ALG_PROTO:
2402 /* find the alg type */
2403 for (i = 0; i < NALGPROTOS; i++)
2404 if (algproto[i] == attr->spd_attr_value)
2405 break;
2406 skip_alg = (i == NALGPROTOS);
2407 if (!skip_alg)
2408 alg_type = i;
2409 break;
2410
2411 case SPD_ATTR_ALG_INCRBITS:
2412 alg->alg_increment = attr->spd_attr_value;
2413 break;
2414
2415 case SPD_ATTR_ALG_NKEYSIZES:
2416 if (alg->alg_key_sizes != NULL) {
2417 kmem_free(alg->alg_key_sizes,
2418 ALG_KEY_SIZES(alg));
2419 }
2420 alg->alg_nkey_sizes = attr->spd_attr_value;
2421 /*
2422 * Allocate room for the trailing zero key size
2423 * value as well.
2424 */
2425 alg->alg_key_sizes = kmem_zalloc(ALG_KEY_SIZES(alg),
2426 KM_SLEEP);
2427 cur_key = 0;
2428 break;
2429
2430 case SPD_ATTR_ALG_KEYSIZE:
2431 if (alg->alg_key_sizes == NULL ||
2432 cur_key >= alg->alg_nkey_sizes) {
2433 ss1dbg(spds, ("spdsock_do_updatealg: "
2434 "too many key sizes\n"));
2435 diag = SPD_DIAGNOSTIC_ALG_NUM_KEY_SIZES;
2436 goto bail;
2437 }
2438 alg->alg_key_sizes[cur_key++] = attr->spd_attr_value;
2439 break;
2440
2441 case SPD_ATTR_ALG_FLAGS:
2442 /*
2443 * Flags (bit mask). The alg_flags element of
2444 * ipsecalg_flags_t is only 8 bits wide. The
2445 * user can set the VALID bit, but we will ignore it
2446 * and make the decision is the algorithm is valid.
2447 */
2448 alg->alg_flags |= (uint8_t)attr->spd_attr_value;
2449 break;
2450
2451 case SPD_ATTR_ALG_NBLOCKSIZES:
2452 if (alg->alg_block_sizes != NULL) {
2453 kmem_free(alg->alg_block_sizes,
2454 ALG_BLOCK_SIZES(alg));
2455 }
2456 alg->alg_nblock_sizes = attr->spd_attr_value;
2457 /*
2458 * Allocate room for the trailing zero block size
2459 * value as well.
2460 */
2461 alg->alg_block_sizes = kmem_zalloc(ALG_BLOCK_SIZES(alg),
2462 KM_SLEEP);
2463 cur_block = 0;
2464 break;
2465
2466 case SPD_ATTR_ALG_BLOCKSIZE:
2467 if (alg->alg_block_sizes == NULL ||
2468 cur_block >= alg->alg_nblock_sizes) {
2469 ss1dbg(spds, ("spdsock_do_updatealg: "
2470 "too many block sizes\n"));
2471 diag = SPD_DIAGNOSTIC_ALG_NUM_BLOCK_SIZES;
2472 goto bail;
2473 }
2474 alg->alg_block_sizes[cur_block++] =
2475 attr->spd_attr_value;
2476 break;
2477
2478 case SPD_ATTR_ALG_NPARAMS:
2479 if (alg->alg_params != NULL) {
2480 kmem_free(alg->alg_params,
2481 ALG_PARAM_SIZES(alg));
2482 }
2483 alg->alg_nparams = attr->spd_attr_value;
2484 /*
2485 * Allocate room for the trailing zero block size
2486 * value as well.
2487 */
2488 alg->alg_params = kmem_zalloc(ALG_PARAM_SIZES(alg),
2489 KM_SLEEP);
2490 cur_block = 0;
2491 break;
2492
2493 case SPD_ATTR_ALG_PARAMS:
2494 if (alg->alg_params == NULL ||
2495 cur_block >= alg->alg_nparams) {
2496 ss1dbg(spds, ("spdsock_do_updatealg: "
2497 "too many params\n"));
2498 diag = SPD_DIAGNOSTIC_ALG_NUM_BLOCK_SIZES;
2499 goto bail;
2500 }
2501 /*
2502 * Array contains: iv_len, icv_len, salt_len
2503 * Any additional parameters are currently ignored.
2504 */
2505 alg->alg_params[cur_block++] =
2506 attr->spd_attr_value;
2507 break;
2508
2509 case SPD_ATTR_ALG_MECHNAME: {
2510 char *mech_name;
2511
2512 if (attr->spd_attr_value > CRYPTO_MAX_MECH_NAME) {
2513 ss1dbg(spds, ("spdsock_do_updatealg: "
2514 "mech name too long\n"));
2515 diag = SPD_DIAGNOSTIC_ALG_MECH_NAME_LEN;
2516 goto bail;
2517 }
2518 mech_name = (char *)(attr + 1);
2519 bcopy(mech_name, alg->alg_mech_name,
2520 attr->spd_attr_value);
2521 alg->alg_mech_name[CRYPTO_MAX_MECH_NAME-1] = '\0';
2522 attr = (struct spd_attribute *)((char *)attr +
2523 attr->spd_attr_value);
2524 break;
2525 }
2526
2527 case SPD_ATTR_PROTO_ID:
2528 doing_proto = B_TRUE;
2529 for (i = 0; i < NALGPROTOS; i++) {
2530 if (algproto[i] == attr->spd_attr_value) {
2531 alg_type = i;
2532 break;
2533 }
2534 }
2535 break;
2536
2537 case SPD_ATTR_PROTO_EXEC_MODE:
2538 if (!doing_proto)
2539 break;
2540 for (i = 0; i < NEXECMODES; i++) {
2541 if (execmodes[i] == attr->spd_attr_value) {
2542 spds->spds_algs_exec_mode[alg_type] = i;
2543 break;
2544 }
2545 }
2546 break;
2547 }
2548 attr++;
2549 }
2550
2551 #undef ALG_KEY_SIZES
2552 #undef ALG_BLOCK_SIZES
2553 #undef ALG_PARAM_SIZES
2554
2555 /* update the algorithm tables */
2556 spdsock_merge_algs(spds);
2557 bail:
2558 /* cleanup */
2559 ipsec_alg_free(alg);
2560 for (alg_type = 0; alg_type < IPSEC_NALGTYPES; alg_type++)
2561 for (algid = 0; algid < IPSEC_MAX_ALGS; algid++)
2562 if (spds->spds_algs[alg_type][algid] != NULL)
2563 ipsec_alg_free(spds->spds_algs[alg_type][algid]);
2564 return (diag);
2565 }
2566
2567 /*
2568 * Process an SPD_UPDATEALGS request. If IPsec is not loaded, queue
2569 * the request until IPsec loads. If IPsec is loaded, act on it
2570 * immediately.
2571 */
2572
2573 static void
2574 spdsock_updatealg(queue_t *q, mblk_t *mp, spd_ext_t *extv[])
2575 {
2576 spdsock_t *ss = (spdsock_t *)q->q_ptr;
2577 spd_stack_t *spds = ss->spdsock_spds;
2578 ipsec_stack_t *ipss = spds->spds_netstack->netstack_ipsec;
2579
2580 if (!ipsec_loaded(ipss)) {
2581 /*
2582 * IPsec is not loaded, save request and return nicely,
2583 * the message will be processed once IPsec loads.
2584 */
2585 mblk_t *new_mp;
2586
2587 /* last update message wins */
2588 if ((new_mp = copymsg(mp)) == NULL) {
2589 spdsock_error(q, mp, ENOMEM, 0);
2590 return;
2591 }
2592 mutex_enter(&spds->spds_alg_lock);
2593 bcopy(extv, spds->spds_extv_algs,
2594 sizeof (spd_ext_t *) * (SPD_EXT_MAX + 1));
2595 if (spds->spds_mp_algs != NULL)
2596 freemsg(spds->spds_mp_algs);
2597 spds->spds_mp_algs = mp;
2598 mutex_exit(&spds->spds_alg_lock);
2599 spd_echo(q, new_mp);
2600 } else {
2601 /*
2602 * IPsec is loaded, act on the message immediately.
2603 */
2604 int diag;
2605
2606 mutex_enter(&spds->spds_alg_lock);
2607 diag = spdsock_do_updatealg(extv, spds);
2608 if (diag == -1) {
2609 /* Keep the lock held while we walk the SA tables. */
2610 sadb_alg_update(IPSEC_ALG_ALL, 0, 0,
2611 spds->spds_netstack);
2612 mutex_exit(&spds->spds_alg_lock);
2613 spd_echo(q, mp);
2614 } else {
2615 mutex_exit(&spds->spds_alg_lock);
2616 spdsock_diag(q, mp, diag);
2617 }
2618 }
2619 }
2620
2621 /*
2622 * Find a tunnel instance (using the name to link ID mapping), and
2623 * update it after an IPsec change. We need to do this always in case
2624 * we add policy AFTER plumbing a tunnel. We also need to do this
2625 * because, as a side-effect, the tunnel's MTU is updated to reflect
2626 * any IPsec overhead in the itp's policy.
2627 */
2628 static void
2629 update_iptun_policy(ipsec_tun_pol_t *itp)
2630 {
2631 datalink_id_t linkid;
2632
2633 if (dls_mgmt_get_linkid(itp->itp_name, &linkid) == 0)
2634 iptun_set_policy(linkid, itp);
2635 }
2636
2637 /*
2638 * Sort through the mess of polhead options to retrieve an appropriate one.
2639 * Returns NULL if we send an spdsock error. Returns a valid pointer if we
2640 * found a valid polhead. Returns ALL_ACTIVE_POLHEADS (aka. -1) or
2641 * ALL_INACTIVE_POLHEADS (aka. -2) if the operation calls for the operation to
2642 * act on ALL policy heads.
2643 */
2644 static ipsec_policy_head_t *
2645 get_appropriate_polhead(queue_t *q, mblk_t *mp, spd_if_t *tunname, int spdid,
2646 int msgtype, ipsec_tun_pol_t **itpp)
2647 {
2648 ipsec_tun_pol_t *itp;
2649 ipsec_policy_head_t *iph;
2650 int errno;
2651 char *tname;
2652 boolean_t active;
2653 spdsock_t *ss = (spdsock_t *)q->q_ptr;
2654 netstack_t *ns = ss->spdsock_spds->spds_netstack;
2655 uint64_t gen; /* Placeholder */
2656
2657 active = (spdid == SPD_ACTIVE);
2658 *itpp = NULL;
2659 if (!active && spdid != SPD_STANDBY) {
2660 spdsock_diag(q, mp, SPD_DIAGNOSTIC_BAD_SPDID);
2661 return (NULL);
2662 }
2663
2664 if (tunname != NULL) {
2665 /* Acting on a tunnel's SPD. */
2666 tname = (char *)tunname->spd_if_name;
2667 if (*tname == '\0') {
2668 /* Handle all-polhead cases here. */
2669 if (msgtype != SPD_FLUSH && msgtype != SPD_DUMP) {
2670 spdsock_diag(q, mp,
2671 SPD_DIAGNOSTIC_NOT_GLOBAL_OP);
2672 return (NULL);
2673 }
2674 return (active ? ALL_ACTIVE_POLHEADS :
2675 ALL_INACTIVE_POLHEADS);
2676 }
2677
2678 itp = get_tunnel_policy(tname, ns);
2679 if (itp == NULL) {
2680 if (msgtype != SPD_ADDRULE) {
2681 /* "Tunnel not found" */
2682 spdsock_error(q, mp, ENOENT, 0);
2683 return (NULL);
2684 }
2685
2686 errno = 0;
2687 itp = create_tunnel_policy(tname, &errno, &gen, ns);
2688 if (itp == NULL) {
2689 /*
2690 * Something very bad happened, most likely
2691 * ENOMEM. Return an indicator.
2692 */
2693 spdsock_error(q, mp, errno, 0);
2694 return (NULL);
2695 }
2696 }
2697
2698 /* Match up the itp to an iptun instance. */
2699 update_iptun_policy(itp);
2700
2701 *itpp = itp;
2702 /* For spdsock dump state, set the polhead's name. */
2703 if (msgtype == SPD_DUMP) {
2704 ITP_REFHOLD(itp);
2705 ss->spdsock_itp = itp;
2706 ss->spdsock_dump_tunnel = itp->itp_flags &
2707 (active ? ITPF_P_TUNNEL : ITPF_I_TUNNEL);
2708 }
2709 } else {
2710 itp = NULL;
2711 /* For spdsock dump state, indicate it's global policy. */
2712 if (msgtype == SPD_DUMP)
2713 ss->spdsock_itp = NULL;
2714 }
2715
2716 if (active)
2717 iph = (itp == NULL) ? ipsec_system_policy(ns) : itp->itp_policy;
2718 else
2719 iph = (itp == NULL) ? ipsec_inactive_policy(ns) :
2720 itp->itp_inactive;
2721
2722 ASSERT(iph != NULL);
2723 if (itp != NULL) {
2724 IPPH_REFHOLD(iph);
2725 }
2726
2727 return (iph);
2728 }
2729
2730 static void
2731 spdsock_parse(queue_t *q, mblk_t *mp)
2732 {
2733 spd_msg_t *spmsg;
2734 spd_ext_t *extv[SPD_EXT_MAX + 1];
2735 uint_t msgsize;
2736 ipsec_policy_head_t *iph;
2737 ipsec_tun_pol_t *itp;
2738 spd_if_t *tunname;
2739 spdsock_t *ss = (spdsock_t *)q->q_ptr;
2740 spd_stack_t *spds = ss->spdsock_spds;
2741 netstack_t *ns = spds->spds_netstack;
2742 ipsec_stack_t *ipss = ns->netstack_ipsec;
2743
2744 /* Make sure nothing's below me. */
2745 ASSERT(WR(q)->q_next == NULL);
2746
2747 spmsg = (spd_msg_t *)mp->b_rptr;
2748
2749 msgsize = SPD_64TO8(spmsg->spd_msg_len);
2750
2751 if (msgdsize(mp) != msgsize) {
2752 /*
2753 * Message len incorrect w.r.t. actual size. Send an error
2754 * (EMSGSIZE). It may be necessary to massage things a
2755 * bit. For example, if the spd_msg_type is hosed,
2756 * I need to set it to SPD_RESERVED to get delivery to
2757 * do the right thing. Then again, maybe just letting
2758 * the error delivery do the right thing.
2759 */
2760 ss2dbg(spds,
2761 ("mblk (%lu) and base (%d) message sizes don't jibe.\n",
2762 msgdsize(mp), msgsize));
2763 spdsock_error(q, mp, EMSGSIZE, SPD_DIAGNOSTIC_NONE);
2764 return;
2765 }
2766
2767 if (msgsize > (uint_t)(mp->b_wptr - mp->b_rptr)) {
2768 /* Get all message into one mblk. */
2769 if (pullupmsg(mp, -1) == 0) {
2770 /*
2771 * Something screwy happened.
2772 */
2773 ss3dbg(spds, ("spdsock_parse: pullupmsg() failed.\n"));
2774 return;
2775 } else {
2776 spmsg = (spd_msg_t *)mp->b_rptr;
2777 }
2778 }
2779
2780 switch (spdsock_get_ext(extv, spmsg, msgsize)) {
2781 case KGE_DUP:
2782 /* Handle duplicate extension. */
2783 ss1dbg(spds, ("Got duplicate extension of type %d.\n",
2784 extv[0]->spd_ext_type));
2785 spdsock_diag(q, mp, dup_ext_diag[extv[0]->spd_ext_type]);
2786 return;
2787 case KGE_UNK:
2788 /* Handle unknown extension. */
2789 ss1dbg(spds, ("Got unknown extension of type %d.\n",
2790 extv[0]->spd_ext_type));
2791 spdsock_diag(q, mp, SPD_DIAGNOSTIC_UNKNOWN_EXT);
2792 return;
2793 case KGE_LEN:
2794 /* Length error. */
2795 ss1dbg(spds, ("Length %d on extension type %d overrun or 0.\n",
2796 extv[0]->spd_ext_len, extv[0]->spd_ext_type));
2797 spdsock_diag(q, mp, SPD_DIAGNOSTIC_BAD_EXTLEN);
2798 return;
2799 case KGE_CHK:
2800 /* Reality check failed. */
2801 ss1dbg(spds, ("Reality check failed on extension type %d.\n",
2802 extv[0]->spd_ext_type));
2803 spdsock_diag(q, mp, bad_ext_diag[extv[0]->spd_ext_type]);
2804 return;
2805 default:
2806 /* Default case is no errors. */
2807 break;
2808 }
2809
2810 /*
2811 * Special-case SPD_UPDATEALGS so as not to load IPsec.
2812 */
2813 if (!ipsec_loaded(ipss) && spmsg->spd_msg_type != SPD_UPDATEALGS) {
2814 spdsock_t *ss = (spdsock_t *)q->q_ptr;
2815
2816 ASSERT(ss != NULL);
2817 ipsec_loader_loadnow(ipss);
2818 ss->spdsock_timeout_arg = mp;
2819 ss->spdsock_timeout = qtimeout(q, spdsock_loadcheck,
2820 q, LOADCHECK_INTERVAL);
2821 return;
2822 }
2823
2824 /* First check for messages that need no polheads at all. */
2825 switch (spmsg->spd_msg_type) {
2826 case SPD_UPDATEALGS:
2827 spdsock_updatealg(q, mp, extv);
2828 return;
2829 case SPD_ALGLIST:
2830 spdsock_alglist(q, mp);
2831 return;
2832 case SPD_DUMPALGS:
2833 spdsock_dumpalgs(q, mp);
2834 return;
2835 }
2836
2837 /*
2838 * Then check for ones that need both primary/secondary polheads,
2839 * finding the appropriate tunnel policy if need be.
2840 */
2841 tunname = (spd_if_t *)extv[SPD_EXT_TUN_NAME];
2842 switch (spmsg->spd_msg_type) {
2843 case SPD_FLIP:
2844 spdsock_flip(q, mp, tunname);
2845 return;
2846 case SPD_CLONE:
2847 spdsock_clone(q, mp, tunname);
2848 return;
2849 }
2850
2851 /*
2852 * Finally, find ones that operate on exactly one polhead, or
2853 * "all polheads" of a given type (active/inactive).
2854 */
2855 iph = get_appropriate_polhead(q, mp, tunname, spmsg->spd_msg_spdid,
2856 spmsg->spd_msg_type, &itp);
2857 if (iph == NULL)
2858 return;
2859
2860 /* All-polheads-ready operations. */
2861 switch (spmsg->spd_msg_type) {
2862 case SPD_FLUSH:
2863 if (itp != NULL) {
2864 mutex_enter(&itp->itp_lock);
2865 if (spmsg->spd_msg_spdid == SPD_ACTIVE)
2866 itp->itp_flags &= ~ITPF_PFLAGS;
2867 else
2868 itp->itp_flags &= ~ITPF_IFLAGS;
2869 mutex_exit(&itp->itp_lock);
2870 }
2871
2872 spdsock_flush(q, iph, itp, mp);
2873
2874 if (itp != NULL) {
2875 /* SPD_FLUSH is worth a tunnel MTU check. */
2876 update_iptun_policy(itp);
2877 ITP_REFRELE(itp, ns);
2878 }
2879 return;
2880 case SPD_DUMP:
2881 if (itp != NULL)
2882 ITP_REFRELE(itp, ns);
2883 spdsock_dump(q, iph, mp);
2884 return;
2885 }
2886
2887 if (iph == ALL_ACTIVE_POLHEADS || iph == ALL_INACTIVE_POLHEADS) {
2888 spdsock_diag(q, mp, SPD_DIAGNOSTIC_NOT_GLOBAL_OP);
2889 return;
2890 }
2891
2892 /* Single-polhead-only operations. */
2893 switch (spmsg->spd_msg_type) {
2894 case SPD_ADDRULE:
2895 spdsock_addrule(q, iph, mp, extv, itp);
2896 break;
2897 case SPD_DELETERULE:
2898 spdsock_deleterule(q, iph, mp, extv, itp);
2899 break;
2900 case SPD_LOOKUP:
2901 spdsock_lookup(q, iph, mp, extv, itp);
2902 break;
2903 default:
2904 spdsock_diag(q, mp, SPD_DIAGNOSTIC_BAD_MSG_TYPE);
2905 break;
2906 }
2907
2908 IPPH_REFRELE(iph, ns);
2909 if (itp != NULL) {
2910 /* SPD_{ADD,DELETE}RULE are worth a tunnel MTU check. */
2911 if (spmsg->spd_msg_type == SPD_ADDRULE ||
2912 spmsg->spd_msg_type == SPD_DELETERULE)
2913 update_iptun_policy(itp);
2914 ITP_REFRELE(itp, ns);
2915 }
2916 }
2917
2918 /*
2919 * If an algorithm mapping was received before IPsec was loaded, process it.
2920 * Called from the IPsec loader.
2921 */
2922 void
2923 spdsock_update_pending_algs(netstack_t *ns)
2924 {
2925 spd_stack_t *spds = ns->netstack_spdsock;
2926
2927 mutex_enter(&spds->spds_alg_lock);
2928 if (spds->spds_mp_algs != NULL) {
2929 (void) spdsock_do_updatealg(spds->spds_extv_algs, spds);
2930 freemsg(spds->spds_mp_algs);
2931 spds->spds_mp_algs = NULL;
2932 }
2933 mutex_exit(&spds->spds_alg_lock);
2934 }
2935
2936 static void
2937 spdsock_loadcheck(void *arg)
2938 {
2939 queue_t *q = (queue_t *)arg;
2940 spdsock_t *ss = (spdsock_t *)q->q_ptr;
2941 mblk_t *mp;
2942 ipsec_stack_t *ipss = ss->spdsock_spds->spds_netstack->netstack_ipsec;
2943
2944 ASSERT(ss != NULL);
2945
2946 ss->spdsock_timeout = 0;
2947 mp = ss->spdsock_timeout_arg;
2948 ASSERT(mp != NULL);
2949 ss->spdsock_timeout_arg = NULL;
2950 if (ipsec_failed(ipss))
2951 spdsock_error(q, mp, EPROTONOSUPPORT, 0);
2952 else
2953 spdsock_parse(q, mp);
2954 }
2955
2956 /*
2957 * Copy relevant state bits.
2958 */
2959 static void
2960 spdsock_copy_info(struct T_info_ack *tap, spdsock_t *ss)
2961 {
2962 *tap = spdsock_g_t_info_ack;
2963 tap->CURRENT_state = ss->spdsock_state;
2964 tap->OPT_size = spdsock_max_optsize;
2965 }
2966
2967 /*
2968 * This routine responds to T_CAPABILITY_REQ messages. It is called by
2969 * spdsock_wput. Much of the T_CAPABILITY_ACK information is copied from
2970 * spdsock_g_t_info_ack. The current state of the stream is copied from
2971 * spdsock_state.
2972 */
2973 static void
2974 spdsock_capability_req(queue_t *q, mblk_t *mp)
2975 {
2976 spdsock_t *ss = (spdsock_t *)q->q_ptr;
2977 t_uscalar_t cap_bits1;
2978 struct T_capability_ack *tcap;
2979
2980 cap_bits1 = ((struct T_capability_req *)mp->b_rptr)->CAP_bits1;
2981
2982 mp = tpi_ack_alloc(mp, sizeof (struct T_capability_ack),
2983 mp->b_datap->db_type, T_CAPABILITY_ACK);
2984 if (mp == NULL)
2985 return;
2986
2987 tcap = (struct T_capability_ack *)mp->b_rptr;
2988 tcap->CAP_bits1 = 0;
2989
2990 if (cap_bits1 & TC1_INFO) {
2991 spdsock_copy_info(&tcap->INFO_ack, ss);
2992 tcap->CAP_bits1 |= TC1_INFO;
2993 }
2994
2995 qreply(q, mp);
2996 }
2997
2998 /*
2999 * This routine responds to T_INFO_REQ messages. It is called by
3000 * spdsock_wput_other.
3001 * Most of the T_INFO_ACK information is copied from spdsock_g_t_info_ack.
3002 * The current state of the stream is copied from spdsock_state.
3003 */
3004 static void
3005 spdsock_info_req(
3006 queue_t *q,
3007 mblk_t *mp)
3008 {
3009 mp = tpi_ack_alloc(mp, sizeof (struct T_info_ack), M_PCPROTO,
3010 T_INFO_ACK);
3011 if (mp == NULL)
3012 return;
3013 spdsock_copy_info((struct T_info_ack *)mp->b_rptr,
3014 (spdsock_t *)q->q_ptr);
3015 qreply(q, mp);
3016 }
3017
3018 /*
3019 * spdsock_err_ack. This routine creates a
3020 * T_ERROR_ACK message and passes it
3021 * upstream.
3022 */
3023 static void
3024 spdsock_err_ack(
3025 queue_t *q,
3026 mblk_t *mp,
3027 int t_error,
3028 int sys_error)
3029 {
3030 if ((mp = mi_tpi_err_ack_alloc(mp, t_error, sys_error)) != NULL)
3031 qreply(q, mp);
3032 }
3033
3034 /*
3035 * This routine retrieves the current status of socket options.
3036 * It returns the size of the option retrieved.
3037 */
3038 /* ARGSUSED */
3039 int
3040 spdsock_opt_get(queue_t *q, int level, int name, uchar_t *ptr)
3041 {
3042 int *i1 = (int *)ptr;
3043
3044 switch (level) {
3045 case SOL_SOCKET:
3046 switch (name) {
3047 case SO_TYPE:
3048 *i1 = SOCK_RAW;
3049 break;
3050 /*
3051 * The following two items can be manipulated,
3052 * but changing them should do nothing.
3053 */
3054 case SO_SNDBUF:
3055 *i1 = (int)q->q_hiwat;
3056 break;
3057 case SO_RCVBUF:
3058 *i1 = (int)(RD(q)->q_hiwat);
3059 break;
3060 }
3061 break;
3062 default:
3063 return (0);
3064 }
3065 return (sizeof (int));
3066 }
3067
3068 /*
3069 * This routine sets socket options.
3070 */
3071 /* ARGSUSED */
3072 int
3073 spdsock_opt_set(queue_t *q, uint_t mgmt_flags, int level, int name,
3074 uint_t inlen, uchar_t *invalp, uint_t *outlenp, uchar_t *outvalp,
3075 void *thisdg_attrs, cred_t *cr)
3076 {
3077 int *i1 = (int *)invalp;
3078 spdsock_t *ss = (spdsock_t *)q->q_ptr;
3079 spd_stack_t *spds = ss->spdsock_spds;
3080
3081 switch (level) {
3082 case SOL_SOCKET:
3083 switch (name) {
3084 case SO_SNDBUF:
3085 if (*i1 > spds->spds_max_buf)
3086 return (ENOBUFS);
3087 q->q_hiwat = *i1;
3088 break;
3089 case SO_RCVBUF:
3090 if (*i1 > spds->spds_max_buf)
3091 return (ENOBUFS);
3092 RD(q)->q_hiwat = *i1;
3093 (void) proto_set_rx_hiwat(RD(q), NULL, *i1);
3094 break;
3095 }
3096 break;
3097 }
3098 return (0);
3099 }
3100
3101
3102 /*
3103 * Handle STREAMS messages.
3104 */
3105 static void
3106 spdsock_wput_other(queue_t *q, mblk_t *mp)
3107 {
3108 struct iocblk *iocp;
3109 int error;
3110 spdsock_t *ss = (spdsock_t *)q->q_ptr;
3111 spd_stack_t *spds = ss->spdsock_spds;
3112 cred_t *cr;
3113
3114 switch (mp->b_datap->db_type) {
3115 case M_PROTO:
3116 case M_PCPROTO:
3117 if ((mp->b_wptr - mp->b_rptr) < sizeof (long)) {
3118 ss3dbg(spds, (
3119 "spdsock_wput_other: Not big enough M_PROTO\n"));
3120 freemsg(mp);
3121 return;
3122 }
3123 switch (((union T_primitives *)mp->b_rptr)->type) {
3124 case T_CAPABILITY_REQ:
3125 spdsock_capability_req(q, mp);
3126 break;
3127 case T_INFO_REQ:
3128 spdsock_info_req(q, mp);
3129 break;
3130 case T_SVR4_OPTMGMT_REQ:
3131 case T_OPTMGMT_REQ:
3132 /*
3133 * All Solaris components should pass a db_credp
3134 * for this TPI message, hence we ASSERT.
3135 * But in case there is some other M_PROTO that looks
3136 * like a TPI message sent by some other kernel
3137 * component, we check and return an error.
3138 */
3139 cr = msg_getcred(mp, NULL);
3140 ASSERT(cr != NULL);
3141 if (cr == NULL) {
3142 spdsock_err_ack(q, mp, TSYSERR, EINVAL);
3143 return;
3144 }
3145 if (((union T_primitives *)mp->b_rptr)->type ==
3146 T_SVR4_OPTMGMT_REQ) {
3147 svr4_optcom_req(q, mp, cr, &spdsock_opt_obj);
3148 } else {
3149 tpi_optcom_req(q, mp, cr, &spdsock_opt_obj);
3150 }
3151 break;
3152 case T_DATA_REQ:
3153 case T_EXDATA_REQ:
3154 case T_ORDREL_REQ:
3155 /* Illegal for spdsock. */
3156 freemsg(mp);
3157 (void) putnextctl1(RD(q), M_ERROR, EPROTO);
3158 break;
3159 default:
3160 /* Not supported by spdsock. */
3161 spdsock_err_ack(q, mp, TNOTSUPPORT, 0);
3162 break;
3163 }
3164 return;
3165 case M_IOCDATA:
3166 keysock_spdsock_wput_iocdata(q, mp, PF_POLICY);
3167 return;
3168 case M_IOCTL:
3169 iocp = (struct iocblk *)mp->b_rptr;
3170 error = EINVAL;
3171
3172 switch (iocp->ioc_cmd) {
3173 case TI_GETMYNAME:
3174 case TI_GETPEERNAME:
3175 /*
3176 * For pfiles(1) observability with getsockname().
3177 * See keysock_spdsock_wput_iocdata() for the rest of
3178 * this.
3179 */
3180 mi_copyin(q, mp, NULL,
3181 SIZEOF_STRUCT(strbuf, iocp->ioc_flag));
3182 return;
3183 case ND_SET:
3184 case ND_GET:
3185 if (nd_getset(q, spds->spds_g_nd, mp)) {
3186 qreply(q, mp);
3187 return;
3188 } else
3189 error = ENOENT;
3190 /* FALLTHRU */
3191 default:
3192 miocnak(q, mp, 0, error);
3193 return;
3194 }
3195 case M_FLUSH:
3196 if (*mp->b_rptr & FLUSHW) {
3197 flushq(q, FLUSHALL);
3198 *mp->b_rptr &= ~FLUSHW;
3199 }
3200 if (*mp->b_rptr & FLUSHR) {
3201 qreply(q, mp);
3202 return;
3203 }
3204 /* Else FALLTHRU */
3205 }
3206
3207 /* If fell through, just black-hole the message. */
3208 freemsg(mp);
3209 }
3210
3211 static void
3212 spdsock_wput(queue_t *q, mblk_t *mp)
3213 {
3214 uint8_t *rptr = mp->b_rptr;
3215 mblk_t *mp1;
3216 spdsock_t *ss = (spdsock_t *)q->q_ptr;
3217 spd_stack_t *spds = ss->spdsock_spds;
3218
3219 /*
3220 * If we're dumping, defer processing other messages until the
3221 * dump completes.
3222 */
3223 if (ss->spdsock_dump_req != NULL) {
3224 if (!putq(q, mp))
3225 freemsg(mp);
3226 return;
3227 }
3228
3229 switch (mp->b_datap->db_type) {
3230 case M_DATA:
3231 /*
3232 * Silently discard.
3233 */
3234 ss2dbg(spds, ("raw M_DATA in spdsock.\n"));
3235 freemsg(mp);
3236 return;
3237 case M_PROTO:
3238 case M_PCPROTO:
3239 if ((mp->b_wptr - rptr) >= sizeof (struct T_data_req)) {
3240 if (((union T_primitives *)rptr)->type == T_DATA_REQ) {
3241 if ((mp1 = mp->b_cont) == NULL) {
3242 /* No data after T_DATA_REQ. */
3243 ss2dbg(spds,
3244 ("No data after DATA_REQ.\n"));
3245 freemsg(mp);
3246 return;
3247 }
3248 freeb(mp);
3249 mp = mp1;
3250 ss2dbg(spds, ("T_DATA_REQ\n"));
3251 break; /* Out of switch. */
3252 }
3253 }
3254 /* FALLTHRU */
3255 default:
3256 ss3dbg(spds, ("In default wput case (%d %d).\n",
3257 mp->b_datap->db_type, ((union T_primitives *)rptr)->type));
3258 spdsock_wput_other(q, mp);
3259 return;
3260 }
3261
3262 /* I now have a PF_POLICY message in an M_DATA block. */
3263 spdsock_parse(q, mp);
3264 }
3265
3266 /*
3267 * Device open procedure, called when new queue pair created.
3268 * We are passed the read-side queue.
3269 */
3270 /* ARGSUSED */
3271 static int
3272 spdsock_open(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp)
3273 {
3274 spdsock_t *ss;
3275 queue_t *oq = OTHERQ(q);
3276 minor_t ssminor;
3277 netstack_t *ns;
3278 spd_stack_t *spds;
3279
3280 if (secpolicy_ip_config(credp, B_FALSE) != 0)
3281 return (EPERM);
3282
3283 if (q->q_ptr != NULL)
3284 return (0); /* Re-open of an already open instance. */
3285
3286 if (sflag & MODOPEN)
3287 return (EINVAL);
3288
3289 ns = netstack_find_by_cred(credp);
3290 ASSERT(ns != NULL);
3291 spds = ns->netstack_spdsock;
3292 ASSERT(spds != NULL);
3293
3294 ss2dbg(spds, ("Made it into PF_POLICY socket open.\n"));
3295
3296 ssminor = (minor_t)(uintptr_t)vmem_alloc(spdsock_vmem, 1, VM_NOSLEEP);
3297 if (ssminor == 0) {
3298 netstack_rele(spds->spds_netstack);
3299 return (ENOMEM);
3300 }
3301 ss = kmem_zalloc(sizeof (spdsock_t), KM_NOSLEEP);
3302 if (ss == NULL) {
3303 vmem_free(spdsock_vmem, (void *)(uintptr_t)ssminor, 1);
3304 netstack_rele(spds->spds_netstack);
3305 return (ENOMEM);
3306 }
3307
3308 ss->spdsock_minor = ssminor;
3309 ss->spdsock_state = TS_UNBND;
3310 ss->spdsock_dump_req = NULL;
3311
3312 ss->spdsock_spds = spds;
3313
3314 q->q_ptr = ss;
3315 oq->q_ptr = ss;
3316
3317 q->q_hiwat = spds->spds_recv_hiwat;
3318
3319 oq->q_hiwat = spds->spds_xmit_hiwat;
3320 oq->q_lowat = spds->spds_xmit_lowat;
3321
3322 qprocson(q);
3323 (void) proto_set_rx_hiwat(q, NULL, spds->spds_recv_hiwat);
3324
3325 *devp = makedevice(getmajor(*devp), ss->spdsock_minor);
3326 return (0);
3327 }
3328
3329 /*
3330 * Read-side service procedure, invoked when we get back-enabled
3331 * when buffer space becomes available.
3332 *
3333 * Dump another chunk if we were dumping before; when we finish, kick
3334 * the write-side queue in case it's waiting for read queue space.
3335 */
3336 void
3337 spdsock_rsrv(queue_t *q)
3338 {
3339 spdsock_t *ss = q->q_ptr;
3340
3341 if (ss->spdsock_dump_req != NULL)
3342 spdsock_dump_some(q, ss);
3343
3344 if (ss->spdsock_dump_req == NULL)
3345 qenable(OTHERQ(q));
3346 }
3347
3348 /*
3349 * Write-side service procedure, invoked when we defer processing
3350 * if another message is received while a dump is in progress.
3351 */
3352 void
3353 spdsock_wsrv(queue_t *q)
3354 {
3355 spdsock_t *ss = q->q_ptr;
3356 mblk_t *mp;
3357 ipsec_stack_t *ipss = ss->spdsock_spds->spds_netstack->netstack_ipsec;
3358
3359 if (ss->spdsock_dump_req != NULL) {
3360 qenable(OTHERQ(q));
3361 return;
3362 }
3363
3364 while ((mp = getq(q)) != NULL) {
3365 if (ipsec_loaded(ipss)) {
3366 spdsock_wput(q, mp);
3367 if (ss->spdsock_dump_req != NULL)
3368 return;
3369 } else if (!ipsec_failed(ipss)) {
3370 (void) putq(q, mp);
3371 } else {
3372 spdsock_error(q, mp, EPFNOSUPPORT, 0);
3373 }
3374 }
3375 }
3376
3377 static int
3378 spdsock_close(queue_t *q)
3379 {
3380 spdsock_t *ss = q->q_ptr;
3381 spd_stack_t *spds = ss->spdsock_spds;
3382
3383 qprocsoff(q);
3384
3385 /* Safe assumption. */
3386 ASSERT(ss != NULL);
3387
3388 if (ss->spdsock_timeout != 0)
3389 (void) quntimeout(q, ss->spdsock_timeout);
3390
3391 ss3dbg(spds, ("Driver close, PF_POLICY socket is going away.\n"));
3392
3393 vmem_free(spdsock_vmem, (void *)(uintptr_t)ss->spdsock_minor, 1);
3394 netstack_rele(ss->spdsock_spds->spds_netstack);
3395
3396 kmem_free(ss, sizeof (spdsock_t));
3397 return (0);
3398 }
3399
3400 /*
3401 * Merge the IPsec algorithms tables with the received algorithm information.
3402 */
3403 void
3404 spdsock_merge_algs(spd_stack_t *spds)
3405 {
3406 ipsec_alginfo_t *alg, *oalg;
3407 ipsec_algtype_t algtype;
3408 uint_t algidx, algid, nalgs;
3409 crypto_mech_name_t *mechs;
3410 uint_t mech_count, mech_idx;
3411 netstack_t *ns = spds->spds_netstack;
3412 ipsec_stack_t *ipss = ns->netstack_ipsec;
3413
3414 ASSERT(MUTEX_HELD(&spds->spds_alg_lock));
3415
3416 /*
3417 * Get the list of supported mechanisms from the crypto framework.
3418 * If a mechanism is supported by KCF, resolve its mechanism
3419 * id and mark it as being valid. This operation must be done
3420 * without holding alg_lock, since it can cause a provider
3421 * module to be loaded and the provider notification callback to
3422 * be invoked.
3423 */
3424 mechs = crypto_get_mech_list(&mech_count, KM_SLEEP);
3425 for (algtype = 0; algtype < IPSEC_NALGTYPES; algtype++) {
3426 for (algid = 0; algid < IPSEC_MAX_ALGS; algid++) {
3427 int algflags = 0;
3428 crypto_mech_type_t mt = CRYPTO_MECHANISM_INVALID;
3429
3430 alg = spds->spds_algs[algtype][algid];
3431 if (alg == NULL)
3432 continue;
3433
3434 /*
3435 * The NULL encryption algorithm is a special
3436 * case because there are no mechanisms, yet
3437 * the algorithm is still valid.
3438 */
3439 if (alg->alg_id == SADB_EALG_NULL) {
3440 alg->alg_mech_type = CRYPTO_MECHANISM_INVALID;
3441 alg->alg_flags |= ALG_FLAG_VALID;
3442 continue;
3443 }
3444
3445 for (mech_idx = 0; mech_idx < mech_count; mech_idx++) {
3446 if (strncmp(alg->alg_mech_name, mechs[mech_idx],
3447 CRYPTO_MAX_MECH_NAME) == 0) {
3448 mt = crypto_mech2id(alg->alg_mech_name);
3449 ASSERT(mt != CRYPTO_MECHANISM_INVALID);
3450 algflags = ALG_FLAG_VALID;
3451 break;
3452 }
3453 }
3454 alg->alg_mech_type = mt;
3455 alg->alg_flags |= algflags;
3456 }
3457 }
3458
3459 rw_enter(&ipss->ipsec_alg_lock, RW_WRITER);
3460
3461 /*
3462 * For each algorithm currently defined, check if it is
3463 * present in the new tables created from the SPD_UPDATEALGS
3464 * message received from user-space.
3465 * Delete the algorithm entries that are currently defined
3466 * but not part of the new tables.
3467 */
3468 for (algtype = 0; algtype < IPSEC_NALGTYPES; algtype++) {
3469 nalgs = ipss->ipsec_nalgs[algtype];
3470 for (algidx = 0; algidx < nalgs; algidx++) {
3471 algid = ipss->ipsec_sortlist[algtype][algidx];
3472 if (spds->spds_algs[algtype][algid] == NULL)
3473 ipsec_alg_unreg(algtype, algid, ns);
3474 }
3475 }
3476
3477 /*
3478 * For each algorithm we just received, check if it is
3479 * present in the currently defined tables. If it is, swap
3480 * the entry with the one we just allocated.
3481 * If the new algorithm is not in the current tables,
3482 * add it.
3483 */
3484 for (algtype = 0; algtype < IPSEC_NALGTYPES; algtype++) {
3485 for (algid = 0; algid < IPSEC_MAX_ALGS; algid++) {
3486 alg = spds->spds_algs[algtype][algid];
3487 if (alg == NULL)
3488 continue;
3489
3490 if ((oalg = ipss->ipsec_alglists[algtype][algid]) ==
3491 NULL) {
3492 /*
3493 * New algorithm, add it to the algorithm
3494 * table.
3495 */
3496 ipsec_alg_reg(algtype, alg, ns);
3497 } else {
3498 /*
3499 * Algorithm is already in the table. Swap
3500 * the existing entry with the new one.
3501 */
3502 ipsec_alg_fix_min_max(alg, algtype, ns);
3503 ipss->ipsec_alglists[algtype][algid] = alg;
3504 ipsec_alg_free(oalg);
3505 }
3506 spds->spds_algs[algtype][algid] = NULL;
3507 }
3508 }
3509
3510 for (algtype = 0; algtype < IPSEC_NALGTYPES; algtype++) {
3511 ipss->ipsec_algs_exec_mode[algtype] =
3512 spds->spds_algs_exec_mode[algtype];
3513 }
3514
3515 rw_exit(&ipss->ipsec_alg_lock);
3516
3517 crypto_free_mech_list(mechs, mech_count);
3518
3519 ipsecah_algs_changed(ns);
3520 ipsecesp_algs_changed(ns);
3521 }
Unleashed OS