kernel/net/ip/ipdrop.c

   1 /*
   2  * CDDL HEADER START
   3  *
   4  * The contents of this file are subject to the terms of the
   5  * Common Development and Distribution License (the "License").
   6  * You may not use this file except in compliance with the License.
   7  *
   8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
   9  * or http://www.opensolaris.org/os/licensing.
  10  * See the License for the specific language governing permissions
  11  * and limitations under the License.
  12  *
  13  * When distributing Covered Code, include this CDDL HEADER in each
  14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  15  * If applicable, add the following below this CDDL HEADER, with the
  16  * fields enclosed by brackets "[]" replaced with your own identifying
  17  * information: Portions Copyright [yyyy] [name of copyright owner]
  18  *
  19  * CDDL HEADER END
  20  */
  21 /*
  22  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
  23  * Use is subject to license terms.
  24  */
  25
  26 #include <sys/types.h>
  27 #include <sys/stream.h>
  28 #include <sys/strsun.h>
  29 #include <sys/sunddi.h>
  30 #include <sys/kstat.h>
  31 #include <sys/kmem.h>
  32 #include <sys/sdt.h>
  33 #include <net/pfkeyv2.h>
  34 #include <inet/common.h>
  35 #include <inet/ip.h>
  36 #include <inet/ip6.h>
  37 #include <inet/ipsec_impl.h>
  38 #include <inet/ipdrop.h>
  39
  40 /*
  41  * Packet drop facility.
  42  */
  43
  44 /*
  45  * Initialize drop facility kstats.
  46  */
  47 void
  48 ip_drop_init(ipsec_stack_t *ipss)
  49 {
  50         ipss->ipsec_ip_drop_kstat = kstat_create_netstack("ip", 0, "ipdrop",
  51             "net", KSTAT_TYPE_NAMED,
  52             sizeof (struct ip_dropstats) / sizeof (kstat_named_t),
  53             KSTAT_FLAG_PERSISTENT, ipss->ipsec_netstack->netstack_stackid);
  54
  55         if (ipss->ipsec_ip_drop_kstat == NULL ||
  56             ipss->ipsec_ip_drop_kstat->ks_data == NULL)
  57                 return;
  58
  59         /*
  60          * Note: here ipss->ipsec_ip_drop_types is initialized, however,
  61          * if the previous kstat_create_netstack failed, it will remain
  62          * NULL. Note this is done for all stack instances, so it *could*
  63          * be NULL. Hence a non-NULL checking is added where
  64          * ipss->ipsec_ip_drop_types is used. This checking is hidden in
  65          * the DROPPER macro.
  66          */
  67         ipss->ipsec_ip_drop_types = ipss->ipsec_ip_drop_kstat->ks_data;
  68
  69         /* TCP IPsec drop statistics. */
  70         kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_tcp_clear,
  71             "tcp_clear", KSTAT_DATA_UINT64);
  72         kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_tcp_secure,
  73             "tcp_secure", KSTAT_DATA_UINT64);
  74         kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_tcp_mismatch,
  75             "tcp_mismatch", KSTAT_DATA_UINT64);
  76         kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_tcp_ipsec_alloc,
  77             "tcp_ipsec_alloc", KSTAT_DATA_UINT64);
  78
  79         /* SADB-specific drop statistics. */
  80         kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_sadb_inlarval_timeout,
  81             "sadb_inlarval_timeout", KSTAT_DATA_UINT64);
  82         kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_sadb_inlarval_replace,
  83             "sadb_inlarval_replace", KSTAT_DATA_UINT64);
  84         kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_sadb_inidle_overflow,
  85             "sadb_inidle_overflow", KSTAT_DATA_UINT64);
  86         kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_sadb_inidle_timeout,
  87             "sadb_inidle_timeout", KSTAT_DATA_UINT64);
  88         kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_sadb_acquire_nomem,
  89             "sadb_acquire_nomem", KSTAT_DATA_UINT64);
  90         kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_sadb_acquire_toofull,
  91             "sadb_acquire_toofull", KSTAT_DATA_UINT64);
  92         kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_sadb_acquire_timeout,
  93             "sadb_acquire_timeout", KSTAT_DATA_UINT64);
  94
  95         /* SPD drop statistics. */
  96         kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_spd_ahesp_diffid,
  97             "spd_ahesp_diffid", KSTAT_DATA_UINT64);
  98         kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_spd_loopback_mismatch,
  99             "spd_loopback_mismatch", KSTAT_DATA_UINT64);
 100         kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_spd_explicit,
 101             "spd_explicit", KSTAT_DATA_UINT64);
 102         kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_spd_got_secure,
 103             "spd_got_secure", KSTAT_DATA_UINT64);
 104         kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_spd_got_clear,
 105             "spd_got_clear", KSTAT_DATA_UINT64);
 106         kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_spd_bad_ahalg,
 107             "spd_bad_ahalg", KSTAT_DATA_UINT64);
 108         kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_spd_got_ah,
 109             "spd_got_ah", KSTAT_DATA_UINT64);
 110         kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_spd_bad_espealg,
 111             "spd_bad_espealg", KSTAT_DATA_UINT64);
 112         kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_spd_bad_espaalg,
 113             "spd_bad_espaalg", KSTAT_DATA_UINT64);
 114         kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_spd_got_esp,
 115             "spd_got_esp", KSTAT_DATA_UINT64);
 116         kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_spd_got_selfencap,
 117             "spd_got_selfencap", KSTAT_DATA_UINT64);
 118         kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_spd_bad_selfencap,
 119             "spd_bad_selfencap", KSTAT_DATA_UINT64);
 120         kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_spd_nomem,
 121             "spd_nomem", KSTAT_DATA_UINT64);
 122         kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_spd_ah_badid,
 123             "spd_ah_badid", KSTAT_DATA_UINT64);
 124         kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_spd_ah_innermismatch,
 125             "spd_ah_innermismatch", KSTAT_DATA_UINT64);
 126         kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_spd_esp_innermismatch,
 127             "spd_esp_innermismatch", KSTAT_DATA_UINT64);
 128         kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_spd_esp_badid,
 129             "spd_esp_badid", KSTAT_DATA_UINT64);
 130         kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_spd_no_policy,
 131             "spd_no_policy", KSTAT_DATA_UINT64);
 132         kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_spd_malformed_packet,
 133             "spd_malformed_packet", KSTAT_DATA_UINT64);
 134         kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_spd_malformed_frag,
 135             "spd_malformed_frag", KSTAT_DATA_UINT64);
 136         kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_spd_overlap_frag,
 137             "spd_overlap_frag", KSTAT_DATA_UINT64);
 138         kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_spd_evil_frag,
 139             "spd_evil_frag", KSTAT_DATA_UINT64);
 140         kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_spd_max_frags,
 141             "spd_max_frags", KSTAT_DATA_UINT64);
 142         kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_spd_expired_frags,
 143             "spd_expired_frags", KSTAT_DATA_UINT64);
 144
 145         /* ESP-specific drop statistics. */
 146
 147         kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_esp_nomem,
 148             "esp_nomem", KSTAT_DATA_UINT64);
 149         kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_esp_no_sa,
 150             "esp_no_sa", KSTAT_DATA_UINT64);
 151         kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_esp_early_replay,
 152             "esp_early_replay", KSTAT_DATA_UINT64);
 153         kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_esp_replay,
 154             "esp_replay", KSTAT_DATA_UINT64);
 155         kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_esp_bytes_expire,
 156             "esp_bytes_expire", KSTAT_DATA_UINT64);
 157         kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_esp_bad_padlen,
 158             "esp_bad_padlen", KSTAT_DATA_UINT64);
 159         kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_esp_bad_padding,
 160             "esp_bad_padding", KSTAT_DATA_UINT64);
 161         kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_esp_bad_auth,
 162             "esp_bad_auth", KSTAT_DATA_UINT64);
 163         kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_esp_crypto_failed,
 164             "esp_crypto_failed", KSTAT_DATA_UINT64);
 165         kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_esp_icmp,
 166             "esp_icmp", KSTAT_DATA_UINT64);
 167         kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_esp_nat_t_ipsec,
 168             "esp_nat_t_ipsec", KSTAT_DATA_UINT64);
 169         kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_esp_nat_t_ka,
 170             "esp_nat_t_ka", KSTAT_DATA_UINT64);
 171         kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_esp_iv_wrap,
 172             "esp_iv_wrap", KSTAT_DATA_UINT64);
 173
 174         /* AH-specific drop statistics. */
 175         kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_ah_nomem,
 176             "ah_nomem", KSTAT_DATA_UINT64);
 177         kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_ah_bad_v6_hdrs,
 178             "ah_bad_v6_hdrs", KSTAT_DATA_UINT64);
 179         kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_ah_bad_v4_opts,
 180             "ah_bad_v4_opts", KSTAT_DATA_UINT64);
 181         kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_ah_no_sa,
 182             "ah_no_sa", KSTAT_DATA_UINT64);
 183         kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_ah_bad_length,
 184             "ah_bad_length", KSTAT_DATA_UINT64);
 185         kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_ah_bad_auth,
 186             "ah_bad_auth", KSTAT_DATA_UINT64);
 187         kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_ah_crypto_failed,
 188             "ah_crypto_failed", KSTAT_DATA_UINT64);
 189         kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_ah_early_replay,
 190             "ah_early_replay", KSTAT_DATA_UINT64);
 191         kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_ah_replay,
 192             "ah_replay", KSTAT_DATA_UINT64);
 193         kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_ah_bytes_expire,
 194             "ah_bytes_expire", KSTAT_DATA_UINT64);
 195
 196         /* IP-specific drop statistics. */
 197         kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_ip_ipsec_not_loaded,
 198             "ip_ipsec_not_loaded", KSTAT_DATA_UINT64);
 199
 200         kstat_install(ipss->ipsec_ip_drop_kstat);
 201 }
 202
 203 void
 204 ip_drop_destroy(ipsec_stack_t *ipss)
 205 {
 206         kstat_delete_netstack(ipss->ipsec_ip_drop_kstat,
 207             ipss->ipsec_netstack->netstack_stackid);
 208         ipss->ipsec_ip_drop_kstat = NULL;
 209         ipss->ipsec_ip_drop_types = NULL;
 210 }
 211
 212 /*
 213  * Register a packet dropper.
 214  */
 215 void
 216 ip_drop_register(ipdropper_t *ipd, char *name)
 217 {
 218         if (ipd->ipd_name != NULL) {
 219                 cmn_err(CE_WARN,
 220                     "ip_drop_register: ipdropper %s already registered with %s",
 221                     name, ipd->ipd_name);
 222                 return;
 223         }
 224
 225         /* Assume that name is reasonable in length.  This isn't user-land. */
 226         ipd->ipd_name = kmem_alloc(strlen(name) + 1, KM_SLEEP);
 227         (void) strcpy(ipd->ipd_name, name);
 228 }
 229
 230 /*
 231  * Un-register a packet dropper.
 232  */
 233 void
 234 ip_drop_unregister(ipdropper_t *ipd)
 235 {
 236         if (ipd->ipd_name == NULL) {
 237                 cmn_err(CE_WARN,
 238                     "ip_drop_unregister: not registered (%p)\n",
 239                     (void *)ipd);
 240                 return;
 241         }
 242         kmem_free(ipd->ipd_name, strlen(ipd->ipd_name) + 1);
 243
 244         ipd->ipd_name = NULL;
 245 }
 246
 247 /*
 248  * Actually drop a packet.  Many things could happen here, but at the least,
 249  * the packet will be freemsg()ed.
 250  */
 251 void
 252 ip_drop_packet(mblk_t *mp, boolean_t inbound, ill_t *ill,
 253     struct kstat_named *counter, ipdropper_t *who_called)
 254 {
 255         char *str;
 256
 257         if (mp == NULL) {
 258                 /*
 259                  * Return immediately - NULL packets should not affect any
 260                  * statistics.
 261                  */
 262                 return;
 263         }
 264
 265         ASSERT(mp->b_datap->db_type == M_DATA);
 266
 267         /* Increment the bean counter, if available. */
 268         if (counter != NULL) {
 269                 switch (counter->data_type) {
 270                 case KSTAT_DATA_INT32:
 271                         counter->value.i32++;
 272                         break;
 273                 case KSTAT_DATA_UINT32:
 274                         counter->value.ui32++;
 275                         break;
 276                 case KSTAT_DATA_INT64:
 277                         counter->value.i64++;
 278                         break;
 279                 case KSTAT_DATA_UINT64:
 280                         counter->value.ui64++;
 281                         break;
 282                 /* Other types we can't handle for now. */
 283                 }
 284         }
 285
 286         if (counter != NULL)
 287                 str = counter->name;
 288         else if (who_called != NULL)
 289                 str = who_called->ipd_name;
 290         else
 291                 str = "Unspecified IPsec drop";
 292
 293         if (inbound)
 294                 ip_drop_input(str, mp, ill);
 295         else
 296                 ip_drop_output(str, mp, ill);
 297
 298         /* TODO: queue the packet onto a snoop-friendly queue. */
 299
 300         /*
 301          * ASSERT this isn't a b_next linked mblk chain where a
 302          * chained dropper should be used instead
 303          */
 304         ASSERT(mp->b_prev == NULL && mp->b_next == NULL);
 305         freemsg(mp);
 306 }
 307
 308 /*
 309  * This is just a convinient place for dtrace to see dropped packets
 310  */
 311 /*ARGSUSED*/
 312 void
 313 ip_drop_input(char *str, mblk_t *mp, ill_t *ill)
 314 {
 315         if (mp == NULL)
 316                 return;
 317
 318         if (IPH_HDR_VERSION(mp->b_rptr) == IPV4_VERSION) {
 319                 ipha_t *ipha = (ipha_t *)mp->b_rptr;
 320
 321                 DTRACE_IP7(drop__in, mblk_t *, mp, conn_t *, NULL, void_ip_t *,
 322                     ipha, __dtrace_ipsr_ill_t *, ill, ipha_t *, ipha,
 323                     ip6_t *, NULL, int, 0);
 324         } else {
 325                 ip6_t *ip6h = (ip6_t *)mp->b_rptr;
 326
 327                 DTRACE_IP7(drop__in, mblk_t *, mp, conn_t *, NULL, void_ip_t *,
 328                     ip6h, __dtrace_ipsr_ill_t *, ill, ipha_t *, NULL,
 329                     ip6_t *, ip6h, int, 0);
 330         }
 331 }
 332
 333 /*ARGSUSED*/
 334 void
 335 ip_drop_output(char *str, mblk_t *mp, ill_t *ill)
 336 {
 337         if (mp == NULL)
 338                 return;
 339
 340         if (IPH_HDR_VERSION(mp->b_rptr) == IPV4_VERSION) {
 341                 ipha_t *ipha = (ipha_t *)mp->b_rptr;
 342
 343                 DTRACE_IP7(drop__out, mblk_t *, mp, conn_t *, NULL, void_ip_t *,
 344                     ipha, __dtrace_ipsr_ill_t *, ill, ipha_t *, ipha,
 345                     ip6_t *, NULL, int, 0);
 346         } else {
 347                 ip6_t *ip6h = (ip6_t *)mp->b_rptr;
 348
 349                 DTRACE_IP7(drop__out, mblk_t *, mp, conn_t *, NULL, void_ip_t *,
 350                     ip6h, __dtrace_ipsr_ill_t *, ill, ipha_t *, NULL,
 351                     ip6_t *, ip6h, int, 0);
 352         }
 353 }