10Sstevel@tonic-gate /* 20Sstevel@tonic-gate * CDDL HEADER START 30Sstevel@tonic-gate * 40Sstevel@tonic-gate * The contents of this file are subject to the terms of the 53055Sdanmcd * Common Development and Distribution License (the "License"). 63055Sdanmcd * You may not use this file except in compliance with the License. 70Sstevel@tonic-gate * 80Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 90Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing. 100Sstevel@tonic-gate * See the License for the specific language governing permissions 110Sstevel@tonic-gate * and limitations under the License. 120Sstevel@tonic-gate * 130Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each 140Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 150Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the 160Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying 170Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner] 180Sstevel@tonic-gate * 190Sstevel@tonic-gate * CDDL HEADER END 200Sstevel@tonic-gate */ 210Sstevel@tonic-gate /* 2211456Sdanmcd@sun.com * Copyright 2010 Sun Microsystems, Inc. All rights reserved. 230Sstevel@tonic-gate * Use is subject to license terms. 240Sstevel@tonic-gate */ 250Sstevel@tonic-gate 260Sstevel@tonic-gate #include <sys/param.h> 270Sstevel@tonic-gate #include <sys/types.h> 280Sstevel@tonic-gate #include <sys/stream.h> 290Sstevel@tonic-gate #include <sys/strsubr.h> 300Sstevel@tonic-gate #include <sys/strsun.h> 310Sstevel@tonic-gate #include <sys/stropts.h> 323448Sdh155122 #include <sys/zone.h> 330Sstevel@tonic-gate #include <sys/vnode.h> 340Sstevel@tonic-gate #include <sys/sysmacros.h> 350Sstevel@tonic-gate #define _SUN_TPI_VERSION 2 360Sstevel@tonic-gate #include <sys/tihdr.h> 370Sstevel@tonic-gate #include <sys/ddi.h> 380Sstevel@tonic-gate #include <sys/sunddi.h> 390Sstevel@tonic-gate #include <sys/mkdev.h> 400Sstevel@tonic-gate #include <sys/debug.h> 410Sstevel@tonic-gate #include <sys/kmem.h> 420Sstevel@tonic-gate #include <sys/cmn_err.h> 430Sstevel@tonic-gate #include <sys/suntpi.h> 440Sstevel@tonic-gate #include <sys/policy.h> 4510616SSebastien.Roy@Sun.COM #include <sys/dls.h> 460Sstevel@tonic-gate 470Sstevel@tonic-gate #include <sys/socket.h> 480Sstevel@tonic-gate #include <netinet/in.h> 490Sstevel@tonic-gate #include <net/pfkeyv2.h> 500Sstevel@tonic-gate #include <net/pfpolicy.h> 510Sstevel@tonic-gate 520Sstevel@tonic-gate #include <inet/common.h> 530Sstevel@tonic-gate #include <netinet/ip6.h> 540Sstevel@tonic-gate #include <inet/ip.h> 550Sstevel@tonic-gate #include <inet/ip6.h> 560Sstevel@tonic-gate #include <inet/mi.h> 578348SEric.Yu@Sun.COM #include <inet/proto_set.h> 580Sstevel@tonic-gate #include <inet/nd.h> 593055Sdanmcd #include <inet/ip_if.h> 600Sstevel@tonic-gate #include <inet/optcom.h> 610Sstevel@tonic-gate #include <inet/ipsec_impl.h> 620Sstevel@tonic-gate #include <inet/spdsock.h> 630Sstevel@tonic-gate #include <inet/sadb.h> 6410616SSebastien.Roy@Sun.COM #include <inet/iptun.h> 6510616SSebastien.Roy@Sun.COM #include <inet/iptun/iptun_impl.h> 660Sstevel@tonic-gate 670Sstevel@tonic-gate #include <sys/isa_defs.h> 680Sstevel@tonic-gate 694307Spwernau #include <c2/audit.h> 704307Spwernau 710Sstevel@tonic-gate /* 720Sstevel@tonic-gate * This is a transport provider for the PF_POLICY IPsec policy 730Sstevel@tonic-gate * management socket, which provides a management interface into the 740Sstevel@tonic-gate * SPD, allowing policy rules to be added, deleted, and queried. 750Sstevel@tonic-gate * 760Sstevel@tonic-gate * This effectively replaces the old private SIOC*IPSECONFIG ioctls 770Sstevel@tonic-gate * with an extensible interface which will hopefully be public some 780Sstevel@tonic-gate * day. 790Sstevel@tonic-gate * 800Sstevel@tonic-gate * See <net/pfpolicy.h> for more details on the protocol. 810Sstevel@tonic-gate * 820Sstevel@tonic-gate * We link against drv/ip and call directly into it to manipulate the 830Sstevel@tonic-gate * SPD; see ipsec_impl.h for the policy data structures and spd.c for 840Sstevel@tonic-gate * the code which maintains them. 850Sstevel@tonic-gate * 860Sstevel@tonic-gate * The MT model of this is QPAIR with the addition of some explicit 870Sstevel@tonic-gate * locking to protect system-wide policy data structures. 880Sstevel@tonic-gate */ 890Sstevel@tonic-gate 900Sstevel@tonic-gate static vmem_t *spdsock_vmem; /* for minor numbers. */ 910Sstevel@tonic-gate 920Sstevel@tonic-gate #define ALIGNED64(x) IS_P2ALIGNED((x), sizeof (uint64_t)) 930Sstevel@tonic-gate 940Sstevel@tonic-gate /* Default structure copied into T_INFO_ACK messages (from rts.c...) */ 950Sstevel@tonic-gate static struct T_info_ack spdsock_g_t_info_ack = { 960Sstevel@tonic-gate T_INFO_ACK, 970Sstevel@tonic-gate T_INFINITE, /* TSDU_size. Maximum size messages. */ 980Sstevel@tonic-gate T_INVALID, /* ETSDU_size. No expedited data. */ 990Sstevel@tonic-gate T_INVALID, /* CDATA_size. No connect data. */ 1000Sstevel@tonic-gate T_INVALID, /* DDATA_size. No disconnect data. */ 1010Sstevel@tonic-gate 0, /* ADDR_size. */ 1020Sstevel@tonic-gate 0, /* OPT_size. No user-settable options */ 1030Sstevel@tonic-gate 64 * 1024, /* TIDU_size. spdsock allows maximum size messages. */ 1040Sstevel@tonic-gate T_COTS, /* SERV_type. spdsock supports connection oriented. */ 1050Sstevel@tonic-gate TS_UNBND, /* CURRENT_state. This is set from spdsock_state. */ 1060Sstevel@tonic-gate (XPG4_1) /* Provider flags */ 1070Sstevel@tonic-gate }; 1080Sstevel@tonic-gate 1090Sstevel@tonic-gate /* Named Dispatch Parameter Management Structure */ 1103448Sdh155122 typedef struct spdsockparam_s { 1110Sstevel@tonic-gate uint_t spdsock_param_min; 1120Sstevel@tonic-gate uint_t spdsock_param_max; 1130Sstevel@tonic-gate uint_t spdsock_param_value; 1140Sstevel@tonic-gate char *spdsock_param_name; 1150Sstevel@tonic-gate } spdsockparam_t; 1160Sstevel@tonic-gate 1170Sstevel@tonic-gate /* 1180Sstevel@tonic-gate * Table of NDD variables supported by spdsock. These are loaded into 1190Sstevel@tonic-gate * spdsock_g_nd in spdsock_init_nd. 1200Sstevel@tonic-gate * All of these are alterable, within the min/max values given, at run time. 1210Sstevel@tonic-gate */ 1223448Sdh155122 static spdsockparam_t lcl_param_arr[] = { 1230Sstevel@tonic-gate /* min max value name */ 1240Sstevel@tonic-gate { 4096, 65536, 8192, "spdsock_xmit_hiwat"}, 1250Sstevel@tonic-gate { 0, 65536, 1024, "spdsock_xmit_lowat"}, 1260Sstevel@tonic-gate { 4096, 65536, 8192, "spdsock_recv_hiwat"}, 1270Sstevel@tonic-gate { 65536, 1024*1024*1024, 256*1024, "spdsock_max_buf"}, 1280Sstevel@tonic-gate { 0, 3, 0, "spdsock_debug"}, 1290Sstevel@tonic-gate }; 1303448Sdh155122 #define spds_xmit_hiwat spds_params[0].spdsock_param_value 1313448Sdh155122 #define spds_xmit_lowat spds_params[1].spdsock_param_value 1323448Sdh155122 #define spds_recv_hiwat spds_params[2].spdsock_param_value 1333448Sdh155122 #define spds_max_buf spds_params[3].spdsock_param_value 1343448Sdh155122 #define spds_debug spds_params[4].spdsock_param_value 1350Sstevel@tonic-gate 1360Sstevel@tonic-gate #define ss0dbg(a) printf a 1370Sstevel@tonic-gate /* NOTE: != 0 instead of > 0 so lint doesn't complain. */ 1383448Sdh155122 #define ss1dbg(spds, a) if (spds->spds_debug != 0) printf a 1393448Sdh155122 #define ss2dbg(spds, a) if (spds->spds_debug > 1) printf a 1403448Sdh155122 #define ss3dbg(spds, a) if (spds->spds_debug > 2) printf a 1410Sstevel@tonic-gate 1426430Sdanmcd #define RESET_SPDSOCK_DUMP_POLHEAD(ss, iph) { \ 1436430Sdanmcd ASSERT(RW_READ_HELD(&(iph)->iph_lock)); \ 1446430Sdanmcd (ss)->spdsock_dump_head = (iph); \ 1456430Sdanmcd (ss)->spdsock_dump_gen = (iph)->iph_gen; \ 1466430Sdanmcd (ss)->spdsock_dump_cur_type = 0; \ 1476430Sdanmcd (ss)->spdsock_dump_cur_af = IPSEC_AF_V4; \ 1486430Sdanmcd (ss)->spdsock_dump_cur_rule = NULL; \ 1496430Sdanmcd (ss)->spdsock_dump_count = 0; \ 1506430Sdanmcd (ss)->spdsock_dump_cur_chain = 0; \ 1516430Sdanmcd } 1526430Sdanmcd 1530Sstevel@tonic-gate static int spdsock_close(queue_t *); 1540Sstevel@tonic-gate static int spdsock_open(queue_t *, dev_t *, int, int, cred_t *); 1550Sstevel@tonic-gate static void spdsock_wput(queue_t *, mblk_t *); 1560Sstevel@tonic-gate static void spdsock_wsrv(queue_t *); 1570Sstevel@tonic-gate static void spdsock_rsrv(queue_t *); 1583448Sdh155122 static void *spdsock_stack_init(netstackid_t stackid, netstack_t *ns); 1593448Sdh155122 static void spdsock_stack_fini(netstackid_t stackid, void *arg); 1600Sstevel@tonic-gate static void spdsock_loadcheck(void *); 1613448Sdh155122 static void spdsock_merge_algs(spd_stack_t *); 1623448Sdh155122 static void spdsock_flush_one(ipsec_policy_head_t *, netstack_t *); 1633055Sdanmcd static mblk_t *spdsock_dump_next_record(spdsock_t *); 16411456Sdanmcd@sun.com static void update_iptun_policy(ipsec_tun_pol_t *); 1650Sstevel@tonic-gate 1660Sstevel@tonic-gate static struct module_info info = { 1670Sstevel@tonic-gate 5138, "spdsock", 1, INFPSZ, 512, 128 1680Sstevel@tonic-gate }; 1690Sstevel@tonic-gate 1700Sstevel@tonic-gate static struct qinit rinit = { 1710Sstevel@tonic-gate NULL, (pfi_t)spdsock_rsrv, spdsock_open, spdsock_close, 1720Sstevel@tonic-gate NULL, &info 1730Sstevel@tonic-gate }; 1740Sstevel@tonic-gate 1750Sstevel@tonic-gate static struct qinit winit = { 1760Sstevel@tonic-gate (pfi_t)spdsock_wput, (pfi_t)spdsock_wsrv, NULL, NULL, NULL, &info 1770Sstevel@tonic-gate }; 1780Sstevel@tonic-gate 1790Sstevel@tonic-gate struct streamtab spdsockinfo = { 1800Sstevel@tonic-gate &rinit, &winit 1810Sstevel@tonic-gate }; 1820Sstevel@tonic-gate 1830Sstevel@tonic-gate /* mapping from alg type to protocol number, as per RFC 2407 */ 1840Sstevel@tonic-gate static const uint_t algproto[] = { 1850Sstevel@tonic-gate PROTO_IPSEC_AH, 1860Sstevel@tonic-gate PROTO_IPSEC_ESP, 1870Sstevel@tonic-gate }; 1880Sstevel@tonic-gate 1890Sstevel@tonic-gate #define NALGPROTOS (sizeof (algproto) / sizeof (algproto[0])) 1900Sstevel@tonic-gate 1910Sstevel@tonic-gate /* mapping from kernel exec mode to spdsock exec mode */ 1920Sstevel@tonic-gate static const uint_t execmodes[] = { 1930Sstevel@tonic-gate SPD_ALG_EXEC_MODE_SYNC, 1940Sstevel@tonic-gate SPD_ALG_EXEC_MODE_ASYNC 1950Sstevel@tonic-gate }; 1960Sstevel@tonic-gate 1970Sstevel@tonic-gate #define NEXECMODES (sizeof (execmodes) / sizeof (execmodes[0])) 1980Sstevel@tonic-gate 1993055Sdanmcd #define ALL_ACTIVE_POLHEADS ((ipsec_policy_head_t *)-1) 2003055Sdanmcd #define ALL_INACTIVE_POLHEADS ((ipsec_policy_head_t *)-2) 2013055Sdanmcd 2024307Spwernau #define ITP_NAME(itp) (itp != NULL ? itp->itp_name : NULL) 2034307Spwernau 2040Sstevel@tonic-gate /* ARGSUSED */ 2050Sstevel@tonic-gate static int 2060Sstevel@tonic-gate spdsock_param_get(q, mp, cp, cr) 2070Sstevel@tonic-gate queue_t *q; 2080Sstevel@tonic-gate mblk_t *mp; 2090Sstevel@tonic-gate caddr_t cp; 2100Sstevel@tonic-gate cred_t *cr; 2110Sstevel@tonic-gate { 2120Sstevel@tonic-gate spdsockparam_t *spdsockpa = (spdsockparam_t *)cp; 2130Sstevel@tonic-gate uint_t value; 2143448Sdh155122 spdsock_t *ss = (spdsock_t *)q->q_ptr; 2153448Sdh155122 spd_stack_t *spds = ss->spdsock_spds; 2163448Sdh155122 2173448Sdh155122 mutex_enter(&spds->spds_param_lock); 2180Sstevel@tonic-gate value = spdsockpa->spdsock_param_value; 2193448Sdh155122 mutex_exit(&spds->spds_param_lock); 2200Sstevel@tonic-gate 2210Sstevel@tonic-gate (void) mi_mpprintf(mp, "%u", value); 2220Sstevel@tonic-gate return (0); 2230Sstevel@tonic-gate } 2240Sstevel@tonic-gate 2250Sstevel@tonic-gate /* This routine sets an NDD variable in a spdsockparam_t structure. */ 2260Sstevel@tonic-gate /* ARGSUSED */ 2270Sstevel@tonic-gate static int 2280Sstevel@tonic-gate spdsock_param_set(q, mp, value, cp, cr) 2290Sstevel@tonic-gate queue_t *q; 2300Sstevel@tonic-gate mblk_t *mp; 2310Sstevel@tonic-gate char *value; 2320Sstevel@tonic-gate caddr_t cp; 2330Sstevel@tonic-gate cred_t *cr; 2340Sstevel@tonic-gate { 2350Sstevel@tonic-gate ulong_t new_value; 2360Sstevel@tonic-gate spdsockparam_t *spdsockpa = (spdsockparam_t *)cp; 2373448Sdh155122 spdsock_t *ss = (spdsock_t *)q->q_ptr; 2383448Sdh155122 spd_stack_t *spds = ss->spdsock_spds; 2390Sstevel@tonic-gate 2400Sstevel@tonic-gate /* Convert the value from a string into a long integer. */ 2410Sstevel@tonic-gate if (ddi_strtoul(value, NULL, 10, &new_value) != 0) 2420Sstevel@tonic-gate return (EINVAL); 2430Sstevel@tonic-gate 2443448Sdh155122 mutex_enter(&spds->spds_param_lock); 2450Sstevel@tonic-gate /* 2460Sstevel@tonic-gate * Fail the request if the new value does not lie within the 2470Sstevel@tonic-gate * required bounds. 2480Sstevel@tonic-gate */ 2490Sstevel@tonic-gate if (new_value < spdsockpa->spdsock_param_min || 2500Sstevel@tonic-gate new_value > spdsockpa->spdsock_param_max) { 2513448Sdh155122 mutex_exit(&spds->spds_param_lock); 2520Sstevel@tonic-gate return (EINVAL); 2530Sstevel@tonic-gate } 2540Sstevel@tonic-gate 2550Sstevel@tonic-gate /* Set the new value */ 2560Sstevel@tonic-gate spdsockpa->spdsock_param_value = new_value; 2573448Sdh155122 mutex_exit(&spds->spds_param_lock); 2580Sstevel@tonic-gate 2590Sstevel@tonic-gate return (0); 2600Sstevel@tonic-gate } 2610Sstevel@tonic-gate 2623448Sdh155122 /* 2633448Sdh155122 * Initialize at module load time 2643448Sdh155122 */ 2650Sstevel@tonic-gate boolean_t 2660Sstevel@tonic-gate spdsock_ddi_init(void) 2670Sstevel@tonic-gate { 2680Sstevel@tonic-gate spdsock_max_optsize = optcom_max_optsize( 2690Sstevel@tonic-gate spdsock_opt_obj.odb_opt_des_arr, spdsock_opt_obj.odb_opt_arr_cnt); 2700Sstevel@tonic-gate 2710Sstevel@tonic-gate spdsock_vmem = vmem_create("spdsock", (void *)1, MAXMIN, 1, 2720Sstevel@tonic-gate NULL, NULL, NULL, 1, VM_SLEEP | VMC_IDENTIFIER); 2730Sstevel@tonic-gate 2743448Sdh155122 /* 2753448Sdh155122 * We want to be informed each time a stack is created or 2763448Sdh155122 * destroyed in the kernel, so we can maintain the 2773448Sdh155122 * set of spd_stack_t's. 2783448Sdh155122 */ 2793448Sdh155122 netstack_register(NS_SPDSOCK, spdsock_stack_init, NULL, 2803448Sdh155122 spdsock_stack_fini); 2810Sstevel@tonic-gate 2820Sstevel@tonic-gate return (B_TRUE); 2830Sstevel@tonic-gate } 2840Sstevel@tonic-gate 2853448Sdh155122 /* 2863448Sdh155122 * Walk through the param array specified registering each element with the 2873448Sdh155122 * named dispatch handler. 2883448Sdh155122 */ 2893448Sdh155122 static boolean_t 2903448Sdh155122 spdsock_param_register(IDP *ndp, spdsockparam_t *ssp, int cnt) 2913448Sdh155122 { 2923448Sdh155122 for (; cnt-- > 0; ssp++) { 2933448Sdh155122 if (ssp->spdsock_param_name != NULL && 2943448Sdh155122 ssp->spdsock_param_name[0]) { 2953448Sdh155122 if (!nd_load(ndp, 2963448Sdh155122 ssp->spdsock_param_name, 2973448Sdh155122 spdsock_param_get, spdsock_param_set, 2983448Sdh155122 (caddr_t)ssp)) { 2993448Sdh155122 nd_free(ndp); 3003448Sdh155122 return (B_FALSE); 3013448Sdh155122 } 3023448Sdh155122 } 3033448Sdh155122 } 3043448Sdh155122 return (B_TRUE); 3053448Sdh155122 } 3063448Sdh155122 3073448Sdh155122 /* 3083448Sdh155122 * Initialize for each stack instance 3093448Sdh155122 */ 3103448Sdh155122 /* ARGSUSED */ 3113448Sdh155122 static void * 3123448Sdh155122 spdsock_stack_init(netstackid_t stackid, netstack_t *ns) 3133448Sdh155122 { 3143448Sdh155122 spd_stack_t *spds; 3153448Sdh155122 spdsockparam_t *ssp; 3163448Sdh155122 3173448Sdh155122 spds = (spd_stack_t *)kmem_zalloc(sizeof (*spds), KM_SLEEP); 3183448Sdh155122 spds->spds_netstack = ns; 3193448Sdh155122 3203448Sdh155122 ASSERT(spds->spds_g_nd == NULL); 3213448Sdh155122 3223448Sdh155122 ssp = (spdsockparam_t *)kmem_alloc(sizeof (lcl_param_arr), KM_SLEEP); 3233448Sdh155122 spds->spds_params = ssp; 3243448Sdh155122 bcopy(lcl_param_arr, ssp, sizeof (lcl_param_arr)); 3253448Sdh155122 3263448Sdh155122 (void) spdsock_param_register(&spds->spds_g_nd, ssp, 3273448Sdh155122 A_CNT(lcl_param_arr)); 3283448Sdh155122 3293448Sdh155122 mutex_init(&spds->spds_param_lock, NULL, MUTEX_DEFAULT, NULL); 3303448Sdh155122 mutex_init(&spds->spds_alg_lock, NULL, MUTEX_DEFAULT, NULL); 3313448Sdh155122 3323448Sdh155122 return (spds); 3333448Sdh155122 } 3343448Sdh155122 3350Sstevel@tonic-gate void 3360Sstevel@tonic-gate spdsock_ddi_destroy(void) 3370Sstevel@tonic-gate { 3380Sstevel@tonic-gate vmem_destroy(spdsock_vmem); 3393448Sdh155122 3403448Sdh155122 netstack_unregister(NS_SPDSOCK); 3413448Sdh155122 } 3423448Sdh155122 3433448Sdh155122 /* ARGSUSED */ 3443448Sdh155122 static void 3453448Sdh155122 spdsock_stack_fini(netstackid_t stackid, void *arg) 3463448Sdh155122 { 3473448Sdh155122 spd_stack_t *spds = (spd_stack_t *)arg; 3483448Sdh155122 3496430Sdanmcd freemsg(spds->spds_mp_algs); 3503448Sdh155122 mutex_destroy(&spds->spds_param_lock); 3513448Sdh155122 mutex_destroy(&spds->spds_alg_lock); 3523448Sdh155122 nd_free(&spds->spds_g_nd); 3533448Sdh155122 kmem_free(spds->spds_params, sizeof (lcl_param_arr)); 3543448Sdh155122 spds->spds_params = NULL; 3553448Sdh155122 3563448Sdh155122 kmem_free(spds, sizeof (*spds)); 3570Sstevel@tonic-gate } 3580Sstevel@tonic-gate 3590Sstevel@tonic-gate /* 3600Sstevel@tonic-gate * NOTE: large quantities of this should be shared with keysock. 3610Sstevel@tonic-gate * Would be nice to combine some of this into a common module, but 3620Sstevel@tonic-gate * not possible given time pressures. 3630Sstevel@tonic-gate */ 3640Sstevel@tonic-gate 3650Sstevel@tonic-gate /* 3660Sstevel@tonic-gate * High-level reality checking of extensions. 3670Sstevel@tonic-gate */ 3680Sstevel@tonic-gate /* ARGSUSED */ /* XXX */ 3690Sstevel@tonic-gate static boolean_t 3700Sstevel@tonic-gate ext_check(spd_ext_t *ext) 3710Sstevel@tonic-gate { 3723055Sdanmcd spd_if_t *tunname = (spd_if_t *)ext; 3733055Sdanmcd int i; 3743055Sdanmcd char *idstr; 3753055Sdanmcd 3763055Sdanmcd if (ext->spd_ext_type == SPD_EXT_TUN_NAME) { 3773055Sdanmcd /* (NOTE: Modified from SADB_EXT_IDENTITY..) */ 3783055Sdanmcd 3793055Sdanmcd /* 3803055Sdanmcd * Make sure the strings in these identities are 3813055Sdanmcd * null-terminated. Let's "proactively" null-terminate the 3823055Sdanmcd * string at the last byte if it's not terminated sooner. 3833055Sdanmcd */ 3843055Sdanmcd i = SPD_64TO8(tunname->spd_if_len) - sizeof (spd_if_t); 3853055Sdanmcd idstr = (char *)(tunname + 1); 3863055Sdanmcd while (*idstr != '\0' && i > 0) { 3873055Sdanmcd i--; 3883055Sdanmcd idstr++; 3893055Sdanmcd } 3903055Sdanmcd if (i == 0) { 3913055Sdanmcd /* 3923055Sdanmcd * I.e., if the bozo user didn't NULL-terminate the 3933055Sdanmcd * string... 3943055Sdanmcd */ 3953055Sdanmcd idstr--; 3963055Sdanmcd *idstr = '\0'; 3973055Sdanmcd } 3983055Sdanmcd } 3990Sstevel@tonic-gate return (B_TRUE); /* For now... */ 4000Sstevel@tonic-gate } 4010Sstevel@tonic-gate 4020Sstevel@tonic-gate 4030Sstevel@tonic-gate 4040Sstevel@tonic-gate /* Return values for spdsock_get_ext(). */ 4050Sstevel@tonic-gate #define KGE_OK 0 4060Sstevel@tonic-gate #define KGE_DUP 1 4070Sstevel@tonic-gate #define KGE_UNK 2 4080Sstevel@tonic-gate #define KGE_LEN 3 4090Sstevel@tonic-gate #define KGE_CHK 4 4100Sstevel@tonic-gate 4110Sstevel@tonic-gate /* 4120Sstevel@tonic-gate * Parse basic extension headers and return in the passed-in pointer vector. 4130Sstevel@tonic-gate * Return values include: 4140Sstevel@tonic-gate * 4150Sstevel@tonic-gate * KGE_OK Everything's nice and parsed out. 4160Sstevel@tonic-gate * If there are no extensions, place NULL in extv[0]. 4170Sstevel@tonic-gate * KGE_DUP There is a duplicate extension. 4180Sstevel@tonic-gate * First instance in appropriate bin. First duplicate in 4190Sstevel@tonic-gate * extv[0]. 4200Sstevel@tonic-gate * KGE_UNK Unknown extension type encountered. extv[0] contains 4210Sstevel@tonic-gate * unknown header. 4220Sstevel@tonic-gate * KGE_LEN Extension length error. 4230Sstevel@tonic-gate * KGE_CHK High-level reality check failed on specific extension. 4240Sstevel@tonic-gate * 4250Sstevel@tonic-gate * My apologies for some of the pointer arithmetic in here. I'm thinking 4260Sstevel@tonic-gate * like an assembly programmer, yet trying to make the compiler happy. 4270Sstevel@tonic-gate */ 4280Sstevel@tonic-gate static int 4290Sstevel@tonic-gate spdsock_get_ext(spd_ext_t *extv[], spd_msg_t *basehdr, uint_t msgsize) 4300Sstevel@tonic-gate { 4310Sstevel@tonic-gate bzero(extv, sizeof (spd_ext_t *) * (SPD_EXT_MAX + 1)); 4320Sstevel@tonic-gate 4330Sstevel@tonic-gate /* Use extv[0] as the "current working pointer". */ 4340Sstevel@tonic-gate 4350Sstevel@tonic-gate extv[0] = (spd_ext_t *)(basehdr + 1); 4360Sstevel@tonic-gate 4370Sstevel@tonic-gate while (extv[0] < (spd_ext_t *)(((uint8_t *)basehdr) + msgsize)) { 4380Sstevel@tonic-gate /* Check for unknown headers. */ 4390Sstevel@tonic-gate if (extv[0]->spd_ext_type == 0 || 4400Sstevel@tonic-gate extv[0]->spd_ext_type > SPD_EXT_MAX) 4410Sstevel@tonic-gate return (KGE_UNK); 4420Sstevel@tonic-gate 4430Sstevel@tonic-gate /* 4440Sstevel@tonic-gate * Check length. Use uint64_t because extlen is in units 4450Sstevel@tonic-gate * of 64-bit words. If length goes beyond the msgsize, 4460Sstevel@tonic-gate * return an error. (Zero length also qualifies here.) 4470Sstevel@tonic-gate */ 4480Sstevel@tonic-gate if (extv[0]->spd_ext_len == 0 || 4490Sstevel@tonic-gate (void *)((uint64_t *)extv[0] + extv[0]->spd_ext_len) > 4500Sstevel@tonic-gate (void *)((uint8_t *)basehdr + msgsize)) 4510Sstevel@tonic-gate return (KGE_LEN); 4520Sstevel@tonic-gate 4530Sstevel@tonic-gate /* Check for redundant headers. */ 4540Sstevel@tonic-gate if (extv[extv[0]->spd_ext_type] != NULL) 4550Sstevel@tonic-gate return (KGE_DUP); 4560Sstevel@tonic-gate 4570Sstevel@tonic-gate /* 4580Sstevel@tonic-gate * Reality check the extension if possible at the spdsock 4590Sstevel@tonic-gate * level. 4600Sstevel@tonic-gate */ 4610Sstevel@tonic-gate if (!ext_check(extv[0])) 4620Sstevel@tonic-gate return (KGE_CHK); 4630Sstevel@tonic-gate 4640Sstevel@tonic-gate /* If I make it here, assign the appropriate bin. */ 4650Sstevel@tonic-gate extv[extv[0]->spd_ext_type] = extv[0]; 4660Sstevel@tonic-gate 4670Sstevel@tonic-gate /* Advance pointer (See above for uint64_t ptr reasoning.) */ 4680Sstevel@tonic-gate extv[0] = (spd_ext_t *) 4690Sstevel@tonic-gate ((uint64_t *)extv[0] + extv[0]->spd_ext_len); 4700Sstevel@tonic-gate } 4710Sstevel@tonic-gate 4720Sstevel@tonic-gate /* Everything's cool. */ 4730Sstevel@tonic-gate 4740Sstevel@tonic-gate /* 4750Sstevel@tonic-gate * If extv[0] == NULL, then there are no extension headers in this 4760Sstevel@tonic-gate * message. Ensure that this is the case. 4770Sstevel@tonic-gate */ 4780Sstevel@tonic-gate if (extv[0] == (spd_ext_t *)(basehdr + 1)) 4790Sstevel@tonic-gate extv[0] = NULL; 4800Sstevel@tonic-gate 4810Sstevel@tonic-gate return (KGE_OK); 4820Sstevel@tonic-gate } 4830Sstevel@tonic-gate 4840Sstevel@tonic-gate static const int bad_ext_diag[] = { 4850Sstevel@tonic-gate SPD_DIAGNOSTIC_MALFORMED_LCLPORT, 4860Sstevel@tonic-gate SPD_DIAGNOSTIC_MALFORMED_REMPORT, 4870Sstevel@tonic-gate SPD_DIAGNOSTIC_MALFORMED_PROTO, 4880Sstevel@tonic-gate SPD_DIAGNOSTIC_MALFORMED_LCLADDR, 4890Sstevel@tonic-gate SPD_DIAGNOSTIC_MALFORMED_REMADDR, 4900Sstevel@tonic-gate SPD_DIAGNOSTIC_MALFORMED_ACTION, 4910Sstevel@tonic-gate SPD_DIAGNOSTIC_MALFORMED_RULE, 4920Sstevel@tonic-gate SPD_DIAGNOSTIC_MALFORMED_RULESET, 4930Sstevel@tonic-gate SPD_DIAGNOSTIC_MALFORMED_ICMP_TYPECODE 4940Sstevel@tonic-gate }; 4950Sstevel@tonic-gate 4960Sstevel@tonic-gate static const int dup_ext_diag[] = { 4970Sstevel@tonic-gate SPD_DIAGNOSTIC_DUPLICATE_LCLPORT, 4980Sstevel@tonic-gate SPD_DIAGNOSTIC_DUPLICATE_REMPORT, 4990Sstevel@tonic-gate SPD_DIAGNOSTIC_DUPLICATE_PROTO, 5000Sstevel@tonic-gate SPD_DIAGNOSTIC_DUPLICATE_LCLADDR, 5010Sstevel@tonic-gate SPD_DIAGNOSTIC_DUPLICATE_REMADDR, 5020Sstevel@tonic-gate SPD_DIAGNOSTIC_DUPLICATE_ACTION, 5030Sstevel@tonic-gate SPD_DIAGNOSTIC_DUPLICATE_RULE, 5040Sstevel@tonic-gate SPD_DIAGNOSTIC_DUPLICATE_RULESET, 5050Sstevel@tonic-gate SPD_DIAGNOSTIC_DUPLICATE_ICMP_TYPECODE 5060Sstevel@tonic-gate }; 5070Sstevel@tonic-gate 5080Sstevel@tonic-gate /* 5090Sstevel@tonic-gate * Transmit a PF_POLICY error message to the instance either pointed to 5100Sstevel@tonic-gate * by ks, the instance with serial number serial, or more, depending. 5110Sstevel@tonic-gate * 5120Sstevel@tonic-gate * The faulty message (or a reasonable facsimile thereof) is in mp. 5130Sstevel@tonic-gate * This function will free mp or recycle it for delivery, thereby causing 5140Sstevel@tonic-gate * the stream head to free it. 5150Sstevel@tonic-gate */ 5160Sstevel@tonic-gate static void 5170Sstevel@tonic-gate spdsock_error(queue_t *q, mblk_t *mp, int error, int diagnostic) 5180Sstevel@tonic-gate { 5190Sstevel@tonic-gate spd_msg_t *spmsg = (spd_msg_t *)mp->b_rptr; 5200Sstevel@tonic-gate 5210Sstevel@tonic-gate ASSERT(mp->b_datap->db_type == M_DATA); 5220Sstevel@tonic-gate 5230Sstevel@tonic-gate if (spmsg->spd_msg_type < SPD_MIN || 5240Sstevel@tonic-gate spmsg->spd_msg_type > SPD_MAX) 5250Sstevel@tonic-gate spmsg->spd_msg_type = SPD_RESERVED; 5260Sstevel@tonic-gate 5270Sstevel@tonic-gate /* 5280Sstevel@tonic-gate * Strip out extension headers. 5290Sstevel@tonic-gate */ 5300Sstevel@tonic-gate ASSERT(mp->b_rptr + sizeof (*spmsg) <= mp->b_datap->db_lim); 5310Sstevel@tonic-gate mp->b_wptr = mp->b_rptr + sizeof (*spmsg); 5320Sstevel@tonic-gate spmsg->spd_msg_len = SPD_8TO64(sizeof (spd_msg_t)); 5330Sstevel@tonic-gate spmsg->spd_msg_errno = (uint8_t)error; 5340Sstevel@tonic-gate spmsg->spd_msg_diagnostic = (uint16_t)diagnostic; 5350Sstevel@tonic-gate 5360Sstevel@tonic-gate qreply(q, mp); 5370Sstevel@tonic-gate } 5380Sstevel@tonic-gate 5390Sstevel@tonic-gate static void 5400Sstevel@tonic-gate spdsock_diag(queue_t *q, mblk_t *mp, int diagnostic) 5410Sstevel@tonic-gate { 5420Sstevel@tonic-gate spdsock_error(q, mp, EINVAL, diagnostic); 5430Sstevel@tonic-gate } 5440Sstevel@tonic-gate 5450Sstevel@tonic-gate static void 5460Sstevel@tonic-gate spd_echo(queue_t *q, mblk_t *mp) 5470Sstevel@tonic-gate { 5480Sstevel@tonic-gate qreply(q, mp); 5490Sstevel@tonic-gate } 5500Sstevel@tonic-gate 5513055Sdanmcd /* 5523055Sdanmcd * Do NOT consume a reference to itp. 5533055Sdanmcd */ 5543448Sdh155122 /*ARGSUSED*/ 5550Sstevel@tonic-gate static void 5563448Sdh155122 spdsock_flush_node(ipsec_tun_pol_t *itp, void *cookie, netstack_t *ns) 5573055Sdanmcd { 5583055Sdanmcd boolean_t active = (boolean_t)cookie; 5593055Sdanmcd ipsec_policy_head_t *iph; 5603055Sdanmcd 5613055Sdanmcd iph = active ? itp->itp_policy : itp->itp_inactive; 5623055Sdanmcd IPPH_REFHOLD(iph); 5633055Sdanmcd mutex_enter(&itp->itp_lock); 56411456Sdanmcd@sun.com spdsock_flush_one(iph, ns); /* Releases iph refhold. */ 5653055Sdanmcd if (active) 5663055Sdanmcd itp->itp_flags &= ~ITPF_PFLAGS; 5673055Sdanmcd else 5683055Sdanmcd itp->itp_flags &= ~ITPF_IFLAGS; 5693055Sdanmcd mutex_exit(&itp->itp_lock); 57011456Sdanmcd@sun.com /* SPD_FLUSH is worth a tunnel MTU check. */ 57111456Sdanmcd@sun.com update_iptun_policy(itp); 5723055Sdanmcd } 5733055Sdanmcd 5743055Sdanmcd /* 5753055Sdanmcd * Clear out one polhead. 5763055Sdanmcd */ 5773055Sdanmcd static void 5783448Sdh155122 spdsock_flush_one(ipsec_policy_head_t *iph, netstack_t *ns) 5790Sstevel@tonic-gate { 5800Sstevel@tonic-gate rw_enter(&iph->iph_lock, RW_WRITER); 5813448Sdh155122 ipsec_polhead_flush(iph, ns); 5820Sstevel@tonic-gate rw_exit(&iph->iph_lock); 5833448Sdh155122 IPPH_REFRELE(iph, ns); 5843055Sdanmcd } 5853055Sdanmcd 5863055Sdanmcd static void 5874307Spwernau spdsock_flush(queue_t *q, ipsec_policy_head_t *iph, ipsec_tun_pol_t *itp, 5884307Spwernau mblk_t *mp) 5893055Sdanmcd { 5903055Sdanmcd boolean_t active; 5913448Sdh155122 spdsock_t *ss = (spdsock_t *)q->q_ptr; 5926430Sdanmcd netstack_t *ns = ss->spdsock_spds->spds_netstack; 593*11861SMarek.Pospisil@Sun.COM uint32_t auditing = AU_AUDITING(); 5943055Sdanmcd 5953055Sdanmcd if (iph != ALL_ACTIVE_POLHEADS && iph != ALL_INACTIVE_POLHEADS) { 5966430Sdanmcd spdsock_flush_one(iph, ns); 597*11861SMarek.Pospisil@Sun.COM if (auditing) { 5984307Spwernau spd_msg_t *spmsg = (spd_msg_t *)mp->b_rptr; 5998778SErik.Nordmark@Sun.COM cred_t *cr; 6008778SErik.Nordmark@Sun.COM pid_t cpid; 6018778SErik.Nordmark@Sun.COM 6028778SErik.Nordmark@Sun.COM cr = msg_getcred(mp, &cpid); 6034307Spwernau active = (spmsg->spd_msg_spdid == SPD_ACTIVE); 6048778SErik.Nordmark@Sun.COM audit_pf_policy(SPD_FLUSH, cr, ns, 6058778SErik.Nordmark@Sun.COM ITP_NAME(itp), active, 0, cpid); 6064307Spwernau } 6073055Sdanmcd } else { 6083055Sdanmcd active = (iph == ALL_ACTIVE_POLHEADS); 6093055Sdanmcd 6103055Sdanmcd /* First flush the global policy. */ 6113448Sdh155122 spdsock_flush_one(active ? ipsec_system_policy(ns) : 6123448Sdh155122 ipsec_inactive_policy(ns), ns); 613*11861SMarek.Pospisil@Sun.COM if (auditing) { 6148778SErik.Nordmark@Sun.COM cred_t *cr; 6158778SErik.Nordmark@Sun.COM pid_t cpid; 6168778SErik.Nordmark@Sun.COM 6178778SErik.Nordmark@Sun.COM cr = msg_getcred(mp, &cpid); 6188778SErik.Nordmark@Sun.COM audit_pf_policy(SPD_FLUSH, cr, ns, NULL, 6198778SErik.Nordmark@Sun.COM active, 0, cpid); 6204307Spwernau } 6213055Sdanmcd /* Then flush every tunnel's appropriate one. */ 6226430Sdanmcd itp_walk(spdsock_flush_node, (void *)active, ns); 623*11861SMarek.Pospisil@Sun.COM if (auditing) { 6248778SErik.Nordmark@Sun.COM cred_t *cr; 6258778SErik.Nordmark@Sun.COM pid_t cpid; 6268778SErik.Nordmark@Sun.COM 6278778SErik.Nordmark@Sun.COM cr = msg_getcred(mp, &cpid); 6288778SErik.Nordmark@Sun.COM audit_pf_policy(SPD_FLUSH, cr, ns, 6298778SErik.Nordmark@Sun.COM "all tunnels", active, 0, cpid); 6308778SErik.Nordmark@Sun.COM } 6313055Sdanmcd } 6320Sstevel@tonic-gate 6330Sstevel@tonic-gate spd_echo(q, mp); 6340Sstevel@tonic-gate } 6350Sstevel@tonic-gate 6360Sstevel@tonic-gate static boolean_t 6370Sstevel@tonic-gate spdsock_ext_to_sel(spd_ext_t **extv, ipsec_selkey_t *sel, int *diag) 6380Sstevel@tonic-gate { 6390Sstevel@tonic-gate bzero(sel, sizeof (*sel)); 6400Sstevel@tonic-gate 6410Sstevel@tonic-gate if (extv[SPD_EXT_PROTO] != NULL) { 6420Sstevel@tonic-gate struct spd_proto *pr = 6430Sstevel@tonic-gate (struct spd_proto *)extv[SPD_EXT_PROTO]; 6440Sstevel@tonic-gate sel->ipsl_proto = pr->spd_proto_number; 6450Sstevel@tonic-gate sel->ipsl_valid |= IPSL_PROTOCOL; 6460Sstevel@tonic-gate } 6470Sstevel@tonic-gate if (extv[SPD_EXT_LCLPORT] != NULL) { 6480Sstevel@tonic-gate struct spd_portrange *pr = 6490Sstevel@tonic-gate (struct spd_portrange *)extv[SPD_EXT_LCLPORT]; 6500Sstevel@tonic-gate sel->ipsl_lport = pr->spd_ports_minport; 6510Sstevel@tonic-gate sel->ipsl_valid |= IPSL_LOCAL_PORT; 6520Sstevel@tonic-gate } 6530Sstevel@tonic-gate if (extv[SPD_EXT_REMPORT] != NULL) { 6540Sstevel@tonic-gate struct spd_portrange *pr = 6550Sstevel@tonic-gate (struct spd_portrange *)extv[SPD_EXT_REMPORT]; 6560Sstevel@tonic-gate sel->ipsl_rport = pr->spd_ports_minport; 6570Sstevel@tonic-gate sel->ipsl_valid |= IPSL_REMOTE_PORT; 6580Sstevel@tonic-gate } 6590Sstevel@tonic-gate 6600Sstevel@tonic-gate if (extv[SPD_EXT_ICMP_TYPECODE] != NULL) { 6610Sstevel@tonic-gate struct spd_typecode *tc= 6620Sstevel@tonic-gate (struct spd_typecode *)extv[SPD_EXT_ICMP_TYPECODE]; 6630Sstevel@tonic-gate 6640Sstevel@tonic-gate sel->ipsl_valid |= IPSL_ICMP_TYPE; 6650Sstevel@tonic-gate sel->ipsl_icmp_type = tc->spd_typecode_type; 6660Sstevel@tonic-gate if (tc->spd_typecode_type_end < tc->spd_typecode_type) 6670Sstevel@tonic-gate sel->ipsl_icmp_type_end = tc->spd_typecode_type; 6680Sstevel@tonic-gate else 6690Sstevel@tonic-gate sel->ipsl_icmp_type_end = tc->spd_typecode_type_end; 6700Sstevel@tonic-gate 6710Sstevel@tonic-gate if (tc->spd_typecode_code != 255) { 6720Sstevel@tonic-gate sel->ipsl_valid |= IPSL_ICMP_CODE; 6730Sstevel@tonic-gate sel->ipsl_icmp_code = tc->spd_typecode_code; 6740Sstevel@tonic-gate if (tc->spd_typecode_code_end < tc->spd_typecode_code) 6750Sstevel@tonic-gate sel->ipsl_icmp_code_end = tc->spd_typecode_code; 6760Sstevel@tonic-gate else 6770Sstevel@tonic-gate sel->ipsl_icmp_code_end = 6780Sstevel@tonic-gate tc->spd_typecode_code_end; 6790Sstevel@tonic-gate } 6800Sstevel@tonic-gate } 6810Sstevel@tonic-gate #define ADDR2SEL(sel, extv, field, pfield, extn, bit) \ 6820Sstevel@tonic-gate if ((extv)[(extn)] != NULL) { \ 6830Sstevel@tonic-gate uint_t addrlen; \ 6840Sstevel@tonic-gate struct spd_address *ap = \ 6850Sstevel@tonic-gate (struct spd_address *)((extv)[(extn)]); \ 6860Sstevel@tonic-gate addrlen = (ap->spd_address_af == AF_INET6) ? \ 6870Sstevel@tonic-gate IPV6_ADDR_LEN : IP_ADDR_LEN; \ 6880Sstevel@tonic-gate if (SPD_64TO8(ap->spd_address_len) < \ 6890Sstevel@tonic-gate (addrlen + sizeof (*ap))) { \ 6900Sstevel@tonic-gate *diag = SPD_DIAGNOSTIC_BAD_ADDR_LEN; \ 6910Sstevel@tonic-gate return (B_FALSE); \ 6920Sstevel@tonic-gate } \ 6930Sstevel@tonic-gate bcopy((ap+1), &((sel)->field), addrlen); \ 6940Sstevel@tonic-gate (sel)->pfield = ap->spd_address_prefixlen; \ 6950Sstevel@tonic-gate (sel)->ipsl_valid |= (bit); \ 6960Sstevel@tonic-gate (sel)->ipsl_valid |= (ap->spd_address_af == AF_INET6) ? \ 6970Sstevel@tonic-gate IPSL_IPV6 : IPSL_IPV4; \ 6980Sstevel@tonic-gate } 6990Sstevel@tonic-gate 7000Sstevel@tonic-gate ADDR2SEL(sel, extv, ipsl_local, ipsl_local_pfxlen, 7010Sstevel@tonic-gate SPD_EXT_LCLADDR, IPSL_LOCAL_ADDR); 7020Sstevel@tonic-gate ADDR2SEL(sel, extv, ipsl_remote, ipsl_remote_pfxlen, 7030Sstevel@tonic-gate SPD_EXT_REMADDR, IPSL_REMOTE_ADDR); 7040Sstevel@tonic-gate 7050Sstevel@tonic-gate if ((sel->ipsl_valid & (IPSL_IPV6|IPSL_IPV4)) == 7060Sstevel@tonic-gate (IPSL_IPV6|IPSL_IPV4)) { 7070Sstevel@tonic-gate *diag = SPD_DIAGNOSTIC_MIXED_AF; 7080Sstevel@tonic-gate return (B_FALSE); 7090Sstevel@tonic-gate } 7100Sstevel@tonic-gate 7110Sstevel@tonic-gate #undef ADDR2SEL 7120Sstevel@tonic-gate 7130Sstevel@tonic-gate return (B_TRUE); 7140Sstevel@tonic-gate } 7150Sstevel@tonic-gate 7160Sstevel@tonic-gate static boolean_t 7170Sstevel@tonic-gate spd_convert_type(uint32_t type, ipsec_act_t *act) 7180Sstevel@tonic-gate { 7190Sstevel@tonic-gate switch (type) { 7200Sstevel@tonic-gate case SPD_ACTTYPE_DROP: 7210Sstevel@tonic-gate act->ipa_type = IPSEC_ACT_DISCARD; 7220Sstevel@tonic-gate return (B_TRUE); 7230Sstevel@tonic-gate 7240Sstevel@tonic-gate case SPD_ACTTYPE_PASS: 7250Sstevel@tonic-gate act->ipa_type = IPSEC_ACT_CLEAR; 7260Sstevel@tonic-gate return (B_TRUE); 7270Sstevel@tonic-gate 7280Sstevel@tonic-gate case SPD_ACTTYPE_IPSEC: 7290Sstevel@tonic-gate act->ipa_type = IPSEC_ACT_APPLY; 7300Sstevel@tonic-gate return (B_TRUE); 7310Sstevel@tonic-gate } 7320Sstevel@tonic-gate return (B_FALSE); 7330Sstevel@tonic-gate } 7340Sstevel@tonic-gate 7350Sstevel@tonic-gate static boolean_t 7360Sstevel@tonic-gate spd_convert_flags(uint32_t flags, ipsec_act_t *act) 7370Sstevel@tonic-gate { 7380Sstevel@tonic-gate /* 7390Sstevel@tonic-gate * Note use of !! for boolean canonicalization. 7400Sstevel@tonic-gate */ 7410Sstevel@tonic-gate act->ipa_apply.ipp_use_ah = !!(flags & SPD_APPLY_AH); 7420Sstevel@tonic-gate act->ipa_apply.ipp_use_esp = !!(flags & SPD_APPLY_ESP); 7430Sstevel@tonic-gate act->ipa_apply.ipp_use_espa = !!(flags & SPD_APPLY_ESPA); 7440Sstevel@tonic-gate act->ipa_apply.ipp_use_se = !!(flags & SPD_APPLY_SE); 7450Sstevel@tonic-gate act->ipa_apply.ipp_use_unique = !!(flags & SPD_APPLY_UNIQUE); 7460Sstevel@tonic-gate return (B_TRUE); 7470Sstevel@tonic-gate } 7480Sstevel@tonic-gate 7490Sstevel@tonic-gate static void 7500Sstevel@tonic-gate spdsock_reset_act(ipsec_act_t *act) 7510Sstevel@tonic-gate { 7520Sstevel@tonic-gate bzero(act, sizeof (*act)); 7530Sstevel@tonic-gate act->ipa_apply.ipp_espe_maxbits = IPSEC_MAX_KEYBITS; 7540Sstevel@tonic-gate act->ipa_apply.ipp_espa_maxbits = IPSEC_MAX_KEYBITS; 7550Sstevel@tonic-gate act->ipa_apply.ipp_ah_maxbits = IPSEC_MAX_KEYBITS; 7560Sstevel@tonic-gate } 7570Sstevel@tonic-gate 7580Sstevel@tonic-gate /* 7590Sstevel@tonic-gate * Sanity check action against reality, and shrink-wrap key sizes.. 7600Sstevel@tonic-gate */ 7610Sstevel@tonic-gate static boolean_t 7623448Sdh155122 spdsock_check_action(ipsec_act_t *act, boolean_t tunnel_polhead, int *diag, 7633448Sdh155122 spd_stack_t *spds) 7640Sstevel@tonic-gate { 7653055Sdanmcd if (tunnel_polhead && act->ipa_apply.ipp_use_unique) { 7663055Sdanmcd *diag = SPD_DIAGNOSTIC_ADD_INCON_FLAGS; 7673055Sdanmcd return (B_FALSE); 7683055Sdanmcd } 7690Sstevel@tonic-gate if ((act->ipa_type != IPSEC_ACT_APPLY) && 7700Sstevel@tonic-gate (act->ipa_apply.ipp_use_ah || 7715240Snordmark act->ipa_apply.ipp_use_esp || 7725240Snordmark act->ipa_apply.ipp_use_espa || 7735240Snordmark act->ipa_apply.ipp_use_se || 7745240Snordmark act->ipa_apply.ipp_use_unique)) { 7750Sstevel@tonic-gate *diag = SPD_DIAGNOSTIC_ADD_INCON_FLAGS; 7760Sstevel@tonic-gate return (B_FALSE); 7770Sstevel@tonic-gate } 7780Sstevel@tonic-gate if ((act->ipa_type == IPSEC_ACT_APPLY) && 7790Sstevel@tonic-gate !act->ipa_apply.ipp_use_ah && 7800Sstevel@tonic-gate !act->ipa_apply.ipp_use_esp) { 7810Sstevel@tonic-gate *diag = SPD_DIAGNOSTIC_ADD_INCON_FLAGS; 7820Sstevel@tonic-gate return (B_FALSE); 7830Sstevel@tonic-gate } 7843448Sdh155122 return (ipsec_check_action(act, diag, spds->spds_netstack)); 7850Sstevel@tonic-gate } 7860Sstevel@tonic-gate 7870Sstevel@tonic-gate /* 7880Sstevel@tonic-gate * We may be short a few error checks here.. 7890Sstevel@tonic-gate */ 7900Sstevel@tonic-gate static boolean_t 7910Sstevel@tonic-gate spdsock_ext_to_actvec(spd_ext_t **extv, ipsec_act_t **actpp, uint_t *nactp, 7923448Sdh155122 int *diag, spd_stack_t *spds) 7930Sstevel@tonic-gate { 7940Sstevel@tonic-gate struct spd_ext_actions *sactp = 7950Sstevel@tonic-gate (struct spd_ext_actions *)extv[SPD_EXT_ACTION]; 7960Sstevel@tonic-gate ipsec_act_t act, *actp, *endactp; 7970Sstevel@tonic-gate struct spd_attribute *attrp, *endattrp; 7980Sstevel@tonic-gate uint64_t *endp; 7990Sstevel@tonic-gate int nact; 8003055Sdanmcd boolean_t tunnel_polhead; 8013055Sdanmcd 8023055Sdanmcd tunnel_polhead = (extv[SPD_EXT_TUN_NAME] != NULL && 8033055Sdanmcd (((struct spd_rule *)extv[SPD_EXT_RULE])->spd_rule_flags & 8045240Snordmark SPD_RULE_FLAG_TUNNEL)); 8050Sstevel@tonic-gate 8060Sstevel@tonic-gate *actpp = NULL; 8070Sstevel@tonic-gate *nactp = 0; 8080Sstevel@tonic-gate 8090Sstevel@tonic-gate if (sactp == NULL) { 8100Sstevel@tonic-gate *diag = SPD_DIAGNOSTIC_NO_ACTION_EXT; 8110Sstevel@tonic-gate return (B_FALSE); 8120Sstevel@tonic-gate } 8130Sstevel@tonic-gate 8140Sstevel@tonic-gate /* 8150Sstevel@tonic-gate * Parse the "action" extension and convert into an action chain. 8160Sstevel@tonic-gate */ 8170Sstevel@tonic-gate 8180Sstevel@tonic-gate nact = sactp->spd_actions_count; 8190Sstevel@tonic-gate 8200Sstevel@tonic-gate endp = (uint64_t *)sactp; 8210Sstevel@tonic-gate endp += sactp->spd_actions_len; 8220Sstevel@tonic-gate endattrp = (struct spd_attribute *)endp; 8230Sstevel@tonic-gate 8240Sstevel@tonic-gate actp = kmem_alloc(sizeof (*actp) * nact, KM_NOSLEEP); 8250Sstevel@tonic-gate if (actp == NULL) { 8260Sstevel@tonic-gate *diag = SPD_DIAGNOSTIC_ADD_NO_MEM; 8270Sstevel@tonic-gate return (B_FALSE); 8280Sstevel@tonic-gate } 8290Sstevel@tonic-gate *actpp = actp; 8300Sstevel@tonic-gate *nactp = nact; 8310Sstevel@tonic-gate endactp = actp + nact; 8320Sstevel@tonic-gate 8330Sstevel@tonic-gate spdsock_reset_act(&act); 8340Sstevel@tonic-gate attrp = (struct spd_attribute *)(&sactp[1]); 8350Sstevel@tonic-gate 8360Sstevel@tonic-gate for (; attrp < endattrp; attrp++) { 8370Sstevel@tonic-gate switch (attrp->spd_attr_tag) { 8380Sstevel@tonic-gate case SPD_ATTR_NOP: 8390Sstevel@tonic-gate break; 8400Sstevel@tonic-gate 8410Sstevel@tonic-gate case SPD_ATTR_EMPTY: 8420Sstevel@tonic-gate spdsock_reset_act(&act); 8430Sstevel@tonic-gate break; 8440Sstevel@tonic-gate 8450Sstevel@tonic-gate case SPD_ATTR_END: 8460Sstevel@tonic-gate attrp = endattrp; 8470Sstevel@tonic-gate /* FALLTHRU */ 8480Sstevel@tonic-gate case SPD_ATTR_NEXT: 8490Sstevel@tonic-gate if (actp >= endactp) { 8500Sstevel@tonic-gate *diag = SPD_DIAGNOSTIC_ADD_WRONG_ACT_COUNT; 8510Sstevel@tonic-gate goto fail; 8520Sstevel@tonic-gate } 8533448Sdh155122 if (!spdsock_check_action(&act, tunnel_polhead, 8543448Sdh155122 diag, spds)) 8550Sstevel@tonic-gate goto fail; 8560Sstevel@tonic-gate *actp++ = act; 8573055Sdanmcd spdsock_reset_act(&act); 8580Sstevel@tonic-gate break; 8590Sstevel@tonic-gate 8600Sstevel@tonic-gate case SPD_ATTR_TYPE: 8610Sstevel@tonic-gate if (!spd_convert_type(attrp->spd_attr_value, &act)) { 8620Sstevel@tonic-gate *diag = SPD_DIAGNOSTIC_ADD_BAD_TYPE; 8630Sstevel@tonic-gate goto fail; 8640Sstevel@tonic-gate } 8650Sstevel@tonic-gate break; 8660Sstevel@tonic-gate 8670Sstevel@tonic-gate case SPD_ATTR_FLAGS: 8683055Sdanmcd if (!tunnel_polhead && extv[SPD_EXT_TUN_NAME] != NULL) { 8693055Sdanmcd /* 8703055Sdanmcd * Set "sa unique" for transport-mode 8713055Sdanmcd * tunnels whether we want to or not. 8723055Sdanmcd */ 8733055Sdanmcd attrp->spd_attr_value |= SPD_APPLY_UNIQUE; 8743055Sdanmcd } 8750Sstevel@tonic-gate if (!spd_convert_flags(attrp->spd_attr_value, &act)) { 8760Sstevel@tonic-gate *diag = SPD_DIAGNOSTIC_ADD_BAD_FLAGS; 8770Sstevel@tonic-gate goto fail; 8780Sstevel@tonic-gate } 8790Sstevel@tonic-gate break; 8800Sstevel@tonic-gate 8810Sstevel@tonic-gate case SPD_ATTR_AH_AUTH: 8823055Sdanmcd if (attrp->spd_attr_value == 0) { 8833055Sdanmcd *diag = SPD_DIAGNOSTIC_UNSUPP_AH_ALG; 8843055Sdanmcd goto fail; 8853055Sdanmcd } 8860Sstevel@tonic-gate act.ipa_apply.ipp_auth_alg = attrp->spd_attr_value; 8870Sstevel@tonic-gate break; 8880Sstevel@tonic-gate 8890Sstevel@tonic-gate case SPD_ATTR_ESP_ENCR: 8903055Sdanmcd if (attrp->spd_attr_value == 0) { 8913055Sdanmcd *diag = SPD_DIAGNOSTIC_UNSUPP_ESP_ENCR_ALG; 8923055Sdanmcd goto fail; 8933055Sdanmcd } 8940Sstevel@tonic-gate act.ipa_apply.ipp_encr_alg = attrp->spd_attr_value; 8950Sstevel@tonic-gate break; 8960Sstevel@tonic-gate 8970Sstevel@tonic-gate case SPD_ATTR_ESP_AUTH: 8983055Sdanmcd if (attrp->spd_attr_value == 0) { 8993055Sdanmcd *diag = SPD_DIAGNOSTIC_UNSUPP_ESP_AUTH_ALG; 9003055Sdanmcd goto fail; 9013055Sdanmcd } 9020Sstevel@tonic-gate act.ipa_apply.ipp_esp_auth_alg = attrp->spd_attr_value; 9030Sstevel@tonic-gate break; 9040Sstevel@tonic-gate 9050Sstevel@tonic-gate case SPD_ATTR_ENCR_MINBITS: 9060Sstevel@tonic-gate act.ipa_apply.ipp_espe_minbits = attrp->spd_attr_value; 9070Sstevel@tonic-gate break; 9080Sstevel@tonic-gate 9090Sstevel@tonic-gate case SPD_ATTR_ENCR_MAXBITS: 9100Sstevel@tonic-gate act.ipa_apply.ipp_espe_maxbits = attrp->spd_attr_value; 9110Sstevel@tonic-gate break; 9120Sstevel@tonic-gate 9130Sstevel@tonic-gate case SPD_ATTR_AH_MINBITS: 9140Sstevel@tonic-gate act.ipa_apply.ipp_ah_minbits = attrp->spd_attr_value; 9150Sstevel@tonic-gate break; 9160Sstevel@tonic-gate 9170Sstevel@tonic-gate case SPD_ATTR_AH_MAXBITS: 9180Sstevel@tonic-gate act.ipa_apply.ipp_ah_maxbits = attrp->spd_attr_value; 9190Sstevel@tonic-gate break; 9200Sstevel@tonic-gate 9210Sstevel@tonic-gate case SPD_ATTR_ESPA_MINBITS: 9220Sstevel@tonic-gate act.ipa_apply.ipp_espa_minbits = attrp->spd_attr_value; 9230Sstevel@tonic-gate break; 9240Sstevel@tonic-gate 9250Sstevel@tonic-gate case SPD_ATTR_ESPA_MAXBITS: 9260Sstevel@tonic-gate act.ipa_apply.ipp_espa_maxbits = attrp->spd_attr_value; 9270Sstevel@tonic-gate break; 9280Sstevel@tonic-gate 9290Sstevel@tonic-gate case SPD_ATTR_LIFE_SOFT_TIME: 9300Sstevel@tonic-gate case SPD_ATTR_LIFE_HARD_TIME: 9310Sstevel@tonic-gate case SPD_ATTR_LIFE_SOFT_BYTES: 9320Sstevel@tonic-gate case SPD_ATTR_LIFE_HARD_BYTES: 9330Sstevel@tonic-gate break; 9340Sstevel@tonic-gate 9350Sstevel@tonic-gate case SPD_ATTR_KM_PROTO: 9360Sstevel@tonic-gate act.ipa_apply.ipp_km_proto = attrp->spd_attr_value; 9370Sstevel@tonic-gate break; 9380Sstevel@tonic-gate 9390Sstevel@tonic-gate case SPD_ATTR_KM_COOKIE: 9400Sstevel@tonic-gate act.ipa_apply.ipp_km_cookie = attrp->spd_attr_value; 9410Sstevel@tonic-gate break; 9420Sstevel@tonic-gate 9430Sstevel@tonic-gate case SPD_ATTR_REPLAY_DEPTH: 9440Sstevel@tonic-gate act.ipa_apply.ipp_replay_depth = attrp->spd_attr_value; 9450Sstevel@tonic-gate break; 9460Sstevel@tonic-gate } 9470Sstevel@tonic-gate } 9480Sstevel@tonic-gate if (actp != endactp) { 9490Sstevel@tonic-gate *diag = SPD_DIAGNOSTIC_ADD_WRONG_ACT_COUNT; 9500Sstevel@tonic-gate goto fail; 9510Sstevel@tonic-gate } 9520Sstevel@tonic-gate 9530Sstevel@tonic-gate return (B_TRUE); 9540Sstevel@tonic-gate fail: 9550Sstevel@tonic-gate ipsec_actvec_free(*actpp, nact); 9560Sstevel@tonic-gate *actpp = NULL; 9570Sstevel@tonic-gate return (B_FALSE); 9580Sstevel@tonic-gate } 9590Sstevel@tonic-gate 9600Sstevel@tonic-gate typedef struct 9610Sstevel@tonic-gate { 9620Sstevel@tonic-gate ipsec_policy_t *pol; 9630Sstevel@tonic-gate int dir; 9640Sstevel@tonic-gate } tmprule_t; 9650Sstevel@tonic-gate 9660Sstevel@tonic-gate static int 9670Sstevel@tonic-gate mkrule(ipsec_policy_head_t *iph, struct spd_rule *rule, 9680Sstevel@tonic-gate ipsec_selkey_t *sel, ipsec_act_t *actp, int nact, uint_t dir, uint_t af, 9693448Sdh155122 tmprule_t **rp, uint64_t *index, spd_stack_t *spds) 9700Sstevel@tonic-gate { 9710Sstevel@tonic-gate ipsec_policy_t *pol; 9720Sstevel@tonic-gate 9730Sstevel@tonic-gate sel->ipsl_valid &= ~(IPSL_IPV6|IPSL_IPV4); 9740Sstevel@tonic-gate sel->ipsl_valid |= af; 9750Sstevel@tonic-gate 9763055Sdanmcd pol = ipsec_policy_create(sel, actp, nact, rule->spd_rule_priority, 9773448Sdh155122 index, spds->spds_netstack); 9780Sstevel@tonic-gate if (pol == NULL) 9790Sstevel@tonic-gate return (ENOMEM); 9800Sstevel@tonic-gate 9810Sstevel@tonic-gate (*rp)->pol = pol; 9820Sstevel@tonic-gate (*rp)->dir = dir; 9830Sstevel@tonic-gate (*rp)++; 9840Sstevel@tonic-gate 9850Sstevel@tonic-gate if (!ipsec_check_policy(iph, pol, dir)) 9860Sstevel@tonic-gate return (EEXIST); 9870Sstevel@tonic-gate 9880Sstevel@tonic-gate rule->spd_rule_index = pol->ipsp_index; 9890Sstevel@tonic-gate return (0); 9900Sstevel@tonic-gate } 9910Sstevel@tonic-gate 9920Sstevel@tonic-gate static int 9930Sstevel@tonic-gate mkrulepair(ipsec_policy_head_t *iph, struct spd_rule *rule, 9940Sstevel@tonic-gate ipsec_selkey_t *sel, ipsec_act_t *actp, int nact, uint_t dir, uint_t afs, 9953448Sdh155122 tmprule_t **rp, uint64_t *index, spd_stack_t *spds) 9960Sstevel@tonic-gate { 9970Sstevel@tonic-gate int error; 9980Sstevel@tonic-gate 9990Sstevel@tonic-gate if (afs & IPSL_IPV4) { 10003055Sdanmcd error = mkrule(iph, rule, sel, actp, nact, dir, IPSL_IPV4, rp, 10013448Sdh155122 index, spds); 10020Sstevel@tonic-gate if (error != 0) 10030Sstevel@tonic-gate return (error); 10040Sstevel@tonic-gate } 10050Sstevel@tonic-gate if (afs & IPSL_IPV6) { 10063055Sdanmcd error = mkrule(iph, rule, sel, actp, nact, dir, IPSL_IPV6, rp, 10073448Sdh155122 index, spds); 10080Sstevel@tonic-gate if (error != 0) 10090Sstevel@tonic-gate return (error); 10100Sstevel@tonic-gate } 10110Sstevel@tonic-gate return (0); 10120Sstevel@tonic-gate } 10130Sstevel@tonic-gate 10140Sstevel@tonic-gate 10150Sstevel@tonic-gate static void 10163055Sdanmcd spdsock_addrule(queue_t *q, ipsec_policy_head_t *iph, mblk_t *mp, 10173055Sdanmcd spd_ext_t **extv, ipsec_tun_pol_t *itp) 10180Sstevel@tonic-gate { 10190Sstevel@tonic-gate ipsec_selkey_t sel; 10200Sstevel@tonic-gate ipsec_act_t *actp; 10210Sstevel@tonic-gate uint_t nact; 10223055Sdanmcd int diag = 0, error, afs; 10230Sstevel@tonic-gate struct spd_rule *rule = (struct spd_rule *)extv[SPD_EXT_RULE]; 10240Sstevel@tonic-gate tmprule_t rules[4], *rulep = &rules[0]; 10253055Sdanmcd boolean_t tunnel_mode, empty_itp, active; 10263055Sdanmcd uint64_t *index = (itp == NULL) ? NULL : &itp->itp_next_policy_index; 10273448Sdh155122 spdsock_t *ss = (spdsock_t *)q->q_ptr; 1028*11861SMarek.Pospisil@Sun.COM spd_stack_t *spds = ss->spdsock_spds; 1029*11861SMarek.Pospisil@Sun.COM uint32_t auditing = AU_AUDITING(); 10300Sstevel@tonic-gate 10310Sstevel@tonic-gate if (rule == NULL) { 10320Sstevel@tonic-gate spdsock_diag(q, mp, SPD_DIAGNOSTIC_NO_RULE_EXT); 1033*11861SMarek.Pospisil@Sun.COM if (auditing) { 10344307Spwernau spd_msg_t *spmsg = (spd_msg_t *)mp->b_rptr; 10358778SErik.Nordmark@Sun.COM cred_t *cr; 10368778SErik.Nordmark@Sun.COM pid_t cpid; 10378778SErik.Nordmark@Sun.COM 10388778SErik.Nordmark@Sun.COM cr = msg_getcred(mp, &cpid); 10394307Spwernau active = (spmsg->spd_msg_spdid == SPD_ACTIVE); 10408778SErik.Nordmark@Sun.COM audit_pf_policy(SPD_ADDRULE, cr, 10414307Spwernau spds->spds_netstack, ITP_NAME(itp), active, 10428778SErik.Nordmark@Sun.COM SPD_DIAGNOSTIC_NO_RULE_EXT, cpid); 10434307Spwernau } 10440Sstevel@tonic-gate return; 10450Sstevel@tonic-gate } 10460Sstevel@tonic-gate 10473055Sdanmcd tunnel_mode = (rule->spd_rule_flags & SPD_RULE_FLAG_TUNNEL); 10483055Sdanmcd 10493055Sdanmcd if (itp != NULL) { 10503055Sdanmcd mutex_enter(&itp->itp_lock); 10513055Sdanmcd ASSERT(itp->itp_policy == iph || itp->itp_inactive == iph); 10523055Sdanmcd active = (itp->itp_policy == iph); 10533055Sdanmcd if (ITP_P_ISACTIVE(itp, iph)) { 10543055Sdanmcd /* Check for mix-and-match of tunnel/transport. */ 10553055Sdanmcd if ((tunnel_mode && !ITP_P_ISTUNNEL(itp, iph)) || 10563055Sdanmcd (!tunnel_mode && ITP_P_ISTUNNEL(itp, iph))) { 10573055Sdanmcd mutex_exit(&itp->itp_lock); 10583055Sdanmcd spdsock_error(q, mp, EBUSY, 0); 10593055Sdanmcd return; 10603055Sdanmcd } 10613055Sdanmcd empty_itp = B_FALSE; 10623055Sdanmcd } else { 10633055Sdanmcd empty_itp = B_TRUE; 10643055Sdanmcd itp->itp_flags = active ? ITPF_P_ACTIVE : ITPF_I_ACTIVE; 10653055Sdanmcd if (tunnel_mode) 10663055Sdanmcd itp->itp_flags |= active ? ITPF_P_TUNNEL : 10673055Sdanmcd ITPF_I_TUNNEL; 10683055Sdanmcd } 10693055Sdanmcd } else { 10703055Sdanmcd empty_itp = B_FALSE; 10713055Sdanmcd } 10723055Sdanmcd 10730Sstevel@tonic-gate if (rule->spd_rule_index != 0) { 10743055Sdanmcd diag = SPD_DIAGNOSTIC_INVALID_RULE_INDEX; 10753055Sdanmcd error = EINVAL; 10763055Sdanmcd goto fail2; 10770Sstevel@tonic-gate } 10780Sstevel@tonic-gate 10790Sstevel@tonic-gate if (!spdsock_ext_to_sel(extv, &sel, &diag)) { 10803055Sdanmcd error = EINVAL; 10813055Sdanmcd goto fail2; 10823055Sdanmcd } 10833055Sdanmcd 10843055Sdanmcd if (itp != NULL) { 10853055Sdanmcd if (tunnel_mode) { 10863055Sdanmcd if (sel.ipsl_valid & 10873055Sdanmcd (IPSL_REMOTE_PORT | IPSL_LOCAL_PORT)) { 10883055Sdanmcd itp->itp_flags |= active ? 10893055Sdanmcd ITPF_P_PER_PORT_SECURITY : 10903055Sdanmcd ITPF_I_PER_PORT_SECURITY; 10913055Sdanmcd } 10923055Sdanmcd } else { 10933055Sdanmcd /* 10943055Sdanmcd * For now, we don't allow transport-mode on a tunnel 10953055Sdanmcd * with ANY specific selectors. Bail if we have such 10963055Sdanmcd * a request. 10973055Sdanmcd */ 10983055Sdanmcd if (sel.ipsl_valid & IPSL_WILDCARD) { 10993055Sdanmcd diag = SPD_DIAGNOSTIC_NO_TUNNEL_SELECTORS; 11003055Sdanmcd error = EINVAL; 11013055Sdanmcd goto fail2; 11023055Sdanmcd } 11033055Sdanmcd } 11040Sstevel@tonic-gate } 11050Sstevel@tonic-gate 11063448Sdh155122 if (!spdsock_ext_to_actvec(extv, &actp, &nact, &diag, spds)) { 11073055Sdanmcd error = EINVAL; 11083055Sdanmcd goto fail2; 11090Sstevel@tonic-gate } 11100Sstevel@tonic-gate /* 11110Sstevel@tonic-gate * If no addresses were specified, add both. 11120Sstevel@tonic-gate */ 11130Sstevel@tonic-gate afs = sel.ipsl_valid & (IPSL_IPV6|IPSL_IPV4); 11140Sstevel@tonic-gate if (afs == 0) 11150Sstevel@tonic-gate afs = (IPSL_IPV6|IPSL_IPV4); 11160Sstevel@tonic-gate 11170Sstevel@tonic-gate rw_enter(&iph->iph_lock, RW_WRITER); 11180Sstevel@tonic-gate 11190Sstevel@tonic-gate if (rule->spd_rule_flags & SPD_RULE_FLAG_OUTBOUND) { 11200Sstevel@tonic-gate error = mkrulepair(iph, rule, &sel, actp, nact, 11213448Sdh155122 IPSEC_TYPE_OUTBOUND, afs, &rulep, index, spds); 11220Sstevel@tonic-gate if (error != 0) 11230Sstevel@tonic-gate goto fail; 11240Sstevel@tonic-gate } 11250Sstevel@tonic-gate 11260Sstevel@tonic-gate if (rule->spd_rule_flags & SPD_RULE_FLAG_INBOUND) { 11270Sstevel@tonic-gate error = mkrulepair(iph, rule, &sel, actp, nact, 11283448Sdh155122 IPSEC_TYPE_INBOUND, afs, &rulep, index, spds); 11290Sstevel@tonic-gate if (error != 0) 11300Sstevel@tonic-gate goto fail; 11310Sstevel@tonic-gate } 11320Sstevel@tonic-gate 11333448Sdh155122 while ((--rulep) >= &rules[0]) { 11343448Sdh155122 ipsec_enter_policy(iph, rulep->pol, rulep->dir, 11353448Sdh155122 spds->spds_netstack); 11363448Sdh155122 } 11370Sstevel@tonic-gate rw_exit(&iph->iph_lock); 11383055Sdanmcd if (itp != NULL) 11393055Sdanmcd mutex_exit(&itp->itp_lock); 11400Sstevel@tonic-gate 11410Sstevel@tonic-gate ipsec_actvec_free(actp, nact); 11420Sstevel@tonic-gate spd_echo(q, mp); 1143*11861SMarek.Pospisil@Sun.COM if (auditing) { 11444307Spwernau spd_msg_t *spmsg = (spd_msg_t *)mp->b_rptr; 11458778SErik.Nordmark@Sun.COM cred_t *cr; 11468778SErik.Nordmark@Sun.COM pid_t cpid; 11478778SErik.Nordmark@Sun.COM 11488778SErik.Nordmark@Sun.COM cr = msg_getcred(mp, &cpid); 11494307Spwernau active = (spmsg->spd_msg_spdid == SPD_ACTIVE); 11508778SErik.Nordmark@Sun.COM audit_pf_policy(SPD_ADDRULE, cr, spds->spds_netstack, 11518778SErik.Nordmark@Sun.COM ITP_NAME(itp), active, 0, cpid); 11524307Spwernau } 11530Sstevel@tonic-gate return; 11540Sstevel@tonic-gate 11550Sstevel@tonic-gate fail: 11560Sstevel@tonic-gate rw_exit(&iph->iph_lock); 115711042SErik.Nordmark@Sun.COM while ((--rulep) >= &rules[0]) 115811042SErik.Nordmark@Sun.COM IPPOL_REFRELE(rulep->pol); 11590Sstevel@tonic-gate ipsec_actvec_free(actp, nact); 11603055Sdanmcd fail2: 11613055Sdanmcd if (itp != NULL) { 11623055Sdanmcd if (empty_itp) 11633055Sdanmcd itp->itp_flags = 0; 11643055Sdanmcd mutex_exit(&itp->itp_lock); 11653055Sdanmcd } 11663055Sdanmcd spdsock_error(q, mp, error, diag); 1167*11861SMarek.Pospisil@Sun.COM if (auditing) { 11684307Spwernau spd_msg_t *spmsg = (spd_msg_t *)mp->b_rptr; 11698778SErik.Nordmark@Sun.COM cred_t *cr; 11708778SErik.Nordmark@Sun.COM pid_t cpid; 11718778SErik.Nordmark@Sun.COM 11728778SErik.Nordmark@Sun.COM cr = msg_getcred(mp, &cpid); 11734307Spwernau active = (spmsg->spd_msg_spdid == SPD_ACTIVE); 11748778SErik.Nordmark@Sun.COM audit_pf_policy(SPD_ADDRULE, cr, spds->spds_netstack, 11758778SErik.Nordmark@Sun.COM ITP_NAME(itp), active, error, cpid); 11764307Spwernau } 11770Sstevel@tonic-gate } 11780Sstevel@tonic-gate 11790Sstevel@tonic-gate void 11803055Sdanmcd spdsock_deleterule(queue_t *q, ipsec_policy_head_t *iph, mblk_t *mp, 11813055Sdanmcd spd_ext_t **extv, ipsec_tun_pol_t *itp) 11820Sstevel@tonic-gate { 11830Sstevel@tonic-gate ipsec_selkey_t sel; 11840Sstevel@tonic-gate struct spd_rule *rule = (struct spd_rule *)extv[SPD_EXT_RULE]; 11853055Sdanmcd int err, diag = 0; 11863448Sdh155122 spdsock_t *ss = (spdsock_t *)q->q_ptr; 11876430Sdanmcd netstack_t *ns = ss->spdsock_spds->spds_netstack; 1188*11861SMarek.Pospisil@Sun.COM uint32_t auditing = AU_AUDITING(); 11890Sstevel@tonic-gate 11900Sstevel@tonic-gate if (rule == NULL) { 11910Sstevel@tonic-gate spdsock_diag(q, mp, SPD_DIAGNOSTIC_NO_RULE_EXT); 1192*11861SMarek.Pospisil@Sun.COM if (auditing) { 11934307Spwernau boolean_t active; 11944307Spwernau spd_msg_t *spmsg = (spd_msg_t *)mp->b_rptr; 11958778SErik.Nordmark@Sun.COM cred_t *cr; 11968778SErik.Nordmark@Sun.COM pid_t cpid; 11978778SErik.Nordmark@Sun.COM 11988778SErik.Nordmark@Sun.COM cr = msg_getcred(mp, &cpid); 11994307Spwernau active = (spmsg->spd_msg_spdid == SPD_ACTIVE); 12008778SErik.Nordmark@Sun.COM audit_pf_policy(SPD_DELETERULE, cr, ns, 12016430Sdanmcd ITP_NAME(itp), active, SPD_DIAGNOSTIC_NO_RULE_EXT, 12028778SErik.Nordmark@Sun.COM cpid); 12034307Spwernau } 12040Sstevel@tonic-gate return; 12050Sstevel@tonic-gate } 12060Sstevel@tonic-gate 12073055Sdanmcd /* 12083055Sdanmcd * Must enter itp_lock first to avoid deadlock. See tun.c's 12093055Sdanmcd * set_sec_simple() for the other case of itp_lock and iph_lock. 12103055Sdanmcd */ 12113055Sdanmcd if (itp != NULL) 12123055Sdanmcd mutex_enter(&itp->itp_lock); 12133055Sdanmcd 12140Sstevel@tonic-gate if (rule->spd_rule_index != 0) { 12156430Sdanmcd if (ipsec_policy_delete_index(iph, rule->spd_rule_index, ns) != 12166430Sdanmcd 0) { 12173055Sdanmcd err = ESRCH; 12183055Sdanmcd goto fail; 12190Sstevel@tonic-gate } 12200Sstevel@tonic-gate } else { 12210Sstevel@tonic-gate if (!spdsock_ext_to_sel(extv, &sel, &diag)) { 12223055Sdanmcd err = EINVAL; /* diag already set... */ 12233055Sdanmcd goto fail; 12243055Sdanmcd } 12253055Sdanmcd 12263055Sdanmcd if ((rule->spd_rule_flags & SPD_RULE_FLAG_INBOUND) && 12276430Sdanmcd !ipsec_policy_delete(iph, &sel, IPSEC_TYPE_INBOUND, ns)) { 12283055Sdanmcd err = ESRCH; 12293055Sdanmcd goto fail; 12303055Sdanmcd } 12313055Sdanmcd 12323055Sdanmcd if ((rule->spd_rule_flags & SPD_RULE_FLAG_OUTBOUND) && 12336430Sdanmcd !ipsec_policy_delete(iph, &sel, IPSEC_TYPE_OUTBOUND, ns)) { 12343055Sdanmcd err = ESRCH; 12353055Sdanmcd goto fail; 12360Sstevel@tonic-gate } 12373055Sdanmcd } 12383055Sdanmcd 12393055Sdanmcd if (itp != NULL) { 12403055Sdanmcd ASSERT(iph == itp->itp_policy || iph == itp->itp_inactive); 12413055Sdanmcd rw_enter(&iph->iph_lock, RW_READER); 12423055Sdanmcd if (avl_numnodes(&iph->iph_rulebyid) == 0) { 12433055Sdanmcd if (iph == itp->itp_policy) 12443055Sdanmcd itp->itp_flags &= ~ITPF_PFLAGS; 12453055Sdanmcd else 12463055Sdanmcd itp->itp_flags &= ~ITPF_IFLAGS; 12470Sstevel@tonic-gate } 12483055Sdanmcd /* Can exit locks in any order. */ 12493055Sdanmcd rw_exit(&iph->iph_lock); 12503055Sdanmcd mutex_exit(&itp->itp_lock); 12510Sstevel@tonic-gate } 12520Sstevel@tonic-gate spd_echo(q, mp); 1253*11861SMarek.Pospisil@Sun.COM if (auditing) { 12544307Spwernau boolean_t active; 12554307Spwernau spd_msg_t *spmsg = (spd_msg_t *)mp->b_rptr; 12568778SErik.Nordmark@Sun.COM cred_t *cr; 12578778SErik.Nordmark@Sun.COM pid_t cpid; 12588778SErik.Nordmark@Sun.COM 12598778SErik.Nordmark@Sun.COM cr = msg_getcred(mp, &cpid); 12604307Spwernau active = (spmsg->spd_msg_spdid == SPD_ACTIVE); 12618778SErik.Nordmark@Sun.COM audit_pf_policy(SPD_DELETERULE, cr, ns, ITP_NAME(itp), 12628778SErik.Nordmark@Sun.COM active, 0, cpid); 12634307Spwernau } 12640Sstevel@tonic-gate return; 12650Sstevel@tonic-gate fail: 12663055Sdanmcd if (itp != NULL) 12673055Sdanmcd mutex_exit(&itp->itp_lock); 12683055Sdanmcd spdsock_error(q, mp, err, diag); 1269*11861SMarek.Pospisil@Sun.COM if (auditing) { 12704307Spwernau boolean_t active; 12714307Spwernau spd_msg_t *spmsg = (spd_msg_t *)mp->b_rptr; 12728778SErik.Nordmark@Sun.COM cred_t *cr; 12738778SErik.Nordmark@Sun.COM pid_t cpid; 12748778SErik.Nordmark@Sun.COM 12758778SErik.Nordmark@Sun.COM cr = msg_getcred(mp, &cpid); 12764307Spwernau active = (spmsg->spd_msg_spdid == SPD_ACTIVE); 12778778SErik.Nordmark@Sun.COM audit_pf_policy(SPD_DELETERULE, cr, ns, ITP_NAME(itp), 12788778SErik.Nordmark@Sun.COM active, err, cpid); 12794307Spwernau } 12803055Sdanmcd } 12813055Sdanmcd 12823055Sdanmcd /* Do NOT consume a reference to itp. */ 12833055Sdanmcd /* ARGSUSED */ 12843055Sdanmcd static void 12853448Sdh155122 spdsock_flip_node(ipsec_tun_pol_t *itp, void *ignoreme, netstack_t *ns) 12863055Sdanmcd { 12873055Sdanmcd mutex_enter(&itp->itp_lock); 12883055Sdanmcd ITPF_SWAP(itp->itp_flags); 12893448Sdh155122 ipsec_swap_policy(itp->itp_policy, itp->itp_inactive, ns); 12903055Sdanmcd mutex_exit(&itp->itp_lock); 129111456Sdanmcd@sun.com /* SPD_FLIP is worth a tunnel MTU check. */ 129211456Sdanmcd@sun.com update_iptun_policy(itp); 12930Sstevel@tonic-gate } 12940Sstevel@tonic-gate 12950Sstevel@tonic-gate void 12963055Sdanmcd spdsock_flip(queue_t *q, mblk_t *mp, spd_if_t *tunname) 12970Sstevel@tonic-gate { 12983055Sdanmcd char *tname; 12993055Sdanmcd ipsec_tun_pol_t *itp; 13003448Sdh155122 spdsock_t *ss = (spdsock_t *)q->q_ptr; 13016430Sdanmcd netstack_t *ns = ss->spdsock_spds->spds_netstack; 1302*11861SMarek.Pospisil@Sun.COM uint32_t auditing = AU_AUDITING(); 13033055Sdanmcd 13043055Sdanmcd if (tunname != NULL) { 13053055Sdanmcd tname = (char *)tunname->spd_if_name; 13063055Sdanmcd if (*tname == '\0') { 13073448Sdh155122 /* can't fail */ 13086430Sdanmcd ipsec_swap_global_policy(ns); 1309*11861SMarek.Pospisil@Sun.COM if (auditing) { 13104307Spwernau boolean_t active; 13114307Spwernau spd_msg_t *spmsg = (spd_msg_t *)mp->b_rptr; 13128778SErik.Nordmark@Sun.COM cred_t *cr; 13138778SErik.Nordmark@Sun.COM pid_t cpid; 13148778SErik.Nordmark@Sun.COM 13158778SErik.Nordmark@Sun.COM cr = msg_getcred(mp, &cpid); 13164307Spwernau active = (spmsg->spd_msg_spdid == SPD_ACTIVE); 13178778SErik.Nordmark@Sun.COM audit_pf_policy(SPD_FLIP, cr, ns, 13188778SErik.Nordmark@Sun.COM NULL, active, 0, cpid); 13194307Spwernau } 13206430Sdanmcd itp_walk(spdsock_flip_node, NULL, ns); 1321*11861SMarek.Pospisil@Sun.COM if (auditing) { 13224307Spwernau boolean_t active; 13234307Spwernau spd_msg_t *spmsg = (spd_msg_t *)mp->b_rptr; 13248778SErik.Nordmark@Sun.COM cred_t *cr; 13258778SErik.Nordmark@Sun.COM pid_t cpid; 13268778SErik.Nordmark@Sun.COM 13278778SErik.Nordmark@Sun.COM cr = msg_getcred(mp, &cpid); 13284307Spwernau active = (spmsg->spd_msg_spdid == SPD_ACTIVE); 13298778SErik.Nordmark@Sun.COM audit_pf_policy(SPD_FLIP, cr, ns, 13308778SErik.Nordmark@Sun.COM "all tunnels", active, 0, cpid); 13314307Spwernau } 13323055Sdanmcd } else { 13336430Sdanmcd itp = get_tunnel_policy(tname, ns); 13343055Sdanmcd if (itp == NULL) { 13353055Sdanmcd /* Better idea for "tunnel not found"? */ 13363055Sdanmcd spdsock_error(q, mp, ESRCH, 0); 1337*11861SMarek.Pospisil@Sun.COM if (auditing) { 13384307Spwernau boolean_t active; 13394307Spwernau spd_msg_t *spmsg = 13404307Spwernau (spd_msg_t *)mp->b_rptr; 13418778SErik.Nordmark@Sun.COM cred_t *cr; 13428778SErik.Nordmark@Sun.COM pid_t cpid; 13438778SErik.Nordmark@Sun.COM 13448778SErik.Nordmark@Sun.COM cr = msg_getcred(mp, &cpid); 13454307Spwernau active = (spmsg->spd_msg_spdid == 13464307Spwernau SPD_ACTIVE); 13478778SErik.Nordmark@Sun.COM audit_pf_policy(SPD_FLIP, cr, ns, 13488778SErik.Nordmark@Sun.COM ITP_NAME(itp), active, 13498778SErik.Nordmark@Sun.COM ESRCH, cpid); 13504307Spwernau } 13513055Sdanmcd return; 13523055Sdanmcd } 135311456Sdanmcd@sun.com spdsock_flip_node(itp, NULL, ns); 1354*11861SMarek.Pospisil@Sun.COM if (auditing) { 13554307Spwernau boolean_t active; 13564307Spwernau spd_msg_t *spmsg = (spd_msg_t *)mp->b_rptr; 13578778SErik.Nordmark@Sun.COM cred_t *cr; 13588778SErik.Nordmark@Sun.COM pid_t cpid; 13598778SErik.Nordmark@Sun.COM 13608778SErik.Nordmark@Sun.COM cr = msg_getcred(mp, &cpid); 13614307Spwernau active = (spmsg->spd_msg_spdid == SPD_ACTIVE); 13628778SErik.Nordmark@Sun.COM audit_pf_policy(SPD_FLIP, cr, ns, 13638778SErik.Nordmark@Sun.COM ITP_NAME(itp), active, 0, cpid); 13644307Spwernau } 13656430Sdanmcd ITP_REFRELE(itp, ns); 13663055Sdanmcd } 13673055Sdanmcd } else { 13686430Sdanmcd ipsec_swap_global_policy(ns); /* can't fail */ 1369*11861SMarek.Pospisil@Sun.COM if (auditing) { 13704307Spwernau boolean_t active; 13714307Spwernau spd_msg_t *spmsg = (spd_msg_t *)mp->b_rptr; 13728778SErik.Nordmark@Sun.COM cred_t *cr; 13738778SErik.Nordmark@Sun.COM pid_t cpid; 13748778SErik.Nordmark@Sun.COM 13758778SErik.Nordmark@Sun.COM cr = msg_getcred(mp, &cpid); 13764307Spwernau active = (spmsg->spd_msg_spdid == SPD_ACTIVE); 13778778SErik.Nordmark@Sun.COM audit_pf_policy(SPD_FLIP, cr, 13788778SErik.Nordmark@Sun.COM ns, NULL, active, 0, cpid); 13794307Spwernau } 13803055Sdanmcd } 13810Sstevel@tonic-gate spd_echo(q, mp); 13820Sstevel@tonic-gate } 13830Sstevel@tonic-gate 13840Sstevel@tonic-gate /* 13850Sstevel@tonic-gate * Unimplemented feature 13860Sstevel@tonic-gate */ 13870Sstevel@tonic-gate /* ARGSUSED */ 13880Sstevel@tonic-gate static void 13893055Sdanmcd spdsock_lookup(queue_t *q, ipsec_policy_head_t *iph, mblk_t *mp, 13903055Sdanmcd spd_ext_t **extv, ipsec_tun_pol_t *itp) 13910Sstevel@tonic-gate { 13920Sstevel@tonic-gate spdsock_error(q, mp, EINVAL, 0); 13930Sstevel@tonic-gate } 13940Sstevel@tonic-gate 13950Sstevel@tonic-gate 13960Sstevel@tonic-gate static mblk_t * 13970Sstevel@tonic-gate spdsock_dump_ruleset(mblk_t *req, ipsec_policy_head_t *iph, 13980Sstevel@tonic-gate uint32_t count, uint16_t error) 13990Sstevel@tonic-gate { 14000Sstevel@tonic-gate size_t len = sizeof (spd_ruleset_ext_t) + sizeof (spd_msg_t); 14010Sstevel@tonic-gate spd_msg_t *msg; 14020Sstevel@tonic-gate spd_ruleset_ext_t *ruleset; 14030Sstevel@tonic-gate mblk_t *m = allocb(len, BPRI_HI); 14040Sstevel@tonic-gate 14050Sstevel@tonic-gate ASSERT(RW_READ_HELD(&iph->iph_lock)); 14060Sstevel@tonic-gate 14070Sstevel@tonic-gate if (m == NULL) { 14080Sstevel@tonic-gate return (NULL); 14090Sstevel@tonic-gate } 14100Sstevel@tonic-gate msg = (spd_msg_t *)m->b_rptr; 14110Sstevel@tonic-gate ruleset = (spd_ruleset_ext_t *)(&msg[1]); 14120Sstevel@tonic-gate 14130Sstevel@tonic-gate m->b_wptr = (uint8_t *)&ruleset[1]; 14140Sstevel@tonic-gate 14150Sstevel@tonic-gate *msg = *(spd_msg_t *)(req->b_rptr); 14160Sstevel@tonic-gate msg->spd_msg_len = SPD_8TO64(len); 14170Sstevel@tonic-gate msg->spd_msg_errno = error; 14180Sstevel@tonic-gate 14190Sstevel@tonic-gate ruleset->spd_ruleset_len = SPD_8TO64(sizeof (*ruleset)); 14200Sstevel@tonic-gate ruleset->spd_ruleset_type = SPD_EXT_RULESET; 14210Sstevel@tonic-gate ruleset->spd_ruleset_count = count; 14220Sstevel@tonic-gate ruleset->spd_ruleset_version = iph->iph_gen; 14230Sstevel@tonic-gate return (m); 14240Sstevel@tonic-gate } 14250Sstevel@tonic-gate 14260Sstevel@tonic-gate static mblk_t * 14270Sstevel@tonic-gate spdsock_dump_finish(spdsock_t *ss, int error) 14280Sstevel@tonic-gate { 14290Sstevel@tonic-gate mblk_t *m; 14300Sstevel@tonic-gate ipsec_policy_head_t *iph = ss->spdsock_dump_head; 14310Sstevel@tonic-gate mblk_t *req = ss->spdsock_dump_req; 143210592Sdanmcd@sun.com netstack_t *ns = ss->spdsock_spds->spds_netstack; 14330Sstevel@tonic-gate 14340Sstevel@tonic-gate rw_enter(&iph->iph_lock, RW_READER); 14350Sstevel@tonic-gate m = spdsock_dump_ruleset(req, iph, ss->spdsock_dump_count, error); 14360Sstevel@tonic-gate rw_exit(&iph->iph_lock); 143710592Sdanmcd@sun.com IPPH_REFRELE(iph, ns); 143810592Sdanmcd@sun.com if (ss->spdsock_itp != NULL) { 143910592Sdanmcd@sun.com ITP_REFRELE(ss->spdsock_itp, ns); 144010592Sdanmcd@sun.com ss->spdsock_itp = NULL; 144110592Sdanmcd@sun.com } 14420Sstevel@tonic-gate ss->spdsock_dump_req = NULL; 14430Sstevel@tonic-gate freemsg(req); 14440Sstevel@tonic-gate 14450Sstevel@tonic-gate return (m); 14460Sstevel@tonic-gate } 14470Sstevel@tonic-gate 14480Sstevel@tonic-gate /* 14490Sstevel@tonic-gate * Rule encoding functions. 14500Sstevel@tonic-gate * We do a two-pass encode. 14510Sstevel@tonic-gate * If base != NULL, fill in encoded rule part starting at base+offset. 14520Sstevel@tonic-gate * Always return "offset" plus length of to-be-encoded data. 14530Sstevel@tonic-gate */ 14540Sstevel@tonic-gate static uint_t 14550Sstevel@tonic-gate spdsock_encode_typecode(uint8_t *base, uint_t offset, uint8_t type, 14560Sstevel@tonic-gate uint8_t type_end, uint8_t code, uint8_t code_end) 14570Sstevel@tonic-gate { 14580Sstevel@tonic-gate struct spd_typecode *tcp; 14590Sstevel@tonic-gate 14600Sstevel@tonic-gate ASSERT(ALIGNED64(offset)); 14610Sstevel@tonic-gate 14620Sstevel@tonic-gate if (base != NULL) { 14630Sstevel@tonic-gate tcp = (struct spd_typecode *)(base + offset); 14640Sstevel@tonic-gate tcp->spd_typecode_len = SPD_8TO64(sizeof (*tcp)); 14650Sstevel@tonic-gate tcp->spd_typecode_exttype = SPD_EXT_ICMP_TYPECODE; 14660Sstevel@tonic-gate tcp->spd_typecode_code = code; 14670Sstevel@tonic-gate tcp->spd_typecode_type = type; 14680Sstevel@tonic-gate tcp->spd_typecode_type_end = type_end; 14690Sstevel@tonic-gate tcp->spd_typecode_code_end = code_end; 14700Sstevel@tonic-gate } 14710Sstevel@tonic-gate offset += sizeof (*tcp); 14720Sstevel@tonic-gate 14730Sstevel@tonic-gate ASSERT(ALIGNED64(offset)); 14740Sstevel@tonic-gate 14750Sstevel@tonic-gate return (offset); 14760Sstevel@tonic-gate } 14770Sstevel@tonic-gate 14780Sstevel@tonic-gate static uint_t 14790Sstevel@tonic-gate spdsock_encode_proto(uint8_t *base, uint_t offset, uint8_t proto) 14800Sstevel@tonic-gate { 14810Sstevel@tonic-gate struct spd_proto *spp; 14820Sstevel@tonic-gate 14830Sstevel@tonic-gate ASSERT(ALIGNED64(offset)); 14840Sstevel@tonic-gate 14850Sstevel@tonic-gate if (base != NULL) { 14860Sstevel@tonic-gate spp = (struct spd_proto *)(base + offset); 14870Sstevel@tonic-gate spp->spd_proto_len = SPD_8TO64(sizeof (*spp)); 14880Sstevel@tonic-gate spp->spd_proto_exttype = SPD_EXT_PROTO; 14890Sstevel@tonic-gate spp->spd_proto_number = proto; 14900Sstevel@tonic-gate spp->spd_proto_reserved1 = 0; 14910Sstevel@tonic-gate spp->spd_proto_reserved2 = 0; 14920Sstevel@tonic-gate } 14930Sstevel@tonic-gate offset += sizeof (*spp); 14940Sstevel@tonic-gate 14950Sstevel@tonic-gate ASSERT(ALIGNED64(offset)); 14960Sstevel@tonic-gate 14970Sstevel@tonic-gate return (offset); 14980Sstevel@tonic-gate } 14990Sstevel@tonic-gate 15000Sstevel@tonic-gate static uint_t 15010Sstevel@tonic-gate spdsock_encode_port(uint8_t *base, uint_t offset, uint16_t ext, uint16_t port) 15020Sstevel@tonic-gate { 15030Sstevel@tonic-gate struct spd_portrange *spp; 15040Sstevel@tonic-gate 15050Sstevel@tonic-gate ASSERT(ALIGNED64(offset)); 15060Sstevel@tonic-gate 15070Sstevel@tonic-gate if (base != NULL) { 15080Sstevel@tonic-gate spp = (struct spd_portrange *)(base + offset); 15090Sstevel@tonic-gate spp->spd_ports_len = SPD_8TO64(sizeof (*spp)); 15100Sstevel@tonic-gate spp->spd_ports_exttype = ext; 15110Sstevel@tonic-gate spp->spd_ports_minport = port; 15120Sstevel@tonic-gate spp->spd_ports_maxport = port; 15130Sstevel@tonic-gate } 15140Sstevel@tonic-gate offset += sizeof (*spp); 15150Sstevel@tonic-gate 15160Sstevel@tonic-gate ASSERT(ALIGNED64(offset)); 15170Sstevel@tonic-gate 15180Sstevel@tonic-gate return (offset); 15190Sstevel@tonic-gate } 15200Sstevel@tonic-gate 15210Sstevel@tonic-gate static uint_t 15220Sstevel@tonic-gate spdsock_encode_addr(uint8_t *base, uint_t offset, uint16_t ext, 15230Sstevel@tonic-gate const ipsec_selkey_t *sel, const ipsec_addr_t *addr, uint_t pfxlen) 15240Sstevel@tonic-gate { 15250Sstevel@tonic-gate struct spd_address *sae; 15260Sstevel@tonic-gate ipsec_addr_t *spdaddr; 15270Sstevel@tonic-gate uint_t start = offset; 15280Sstevel@tonic-gate uint_t addrlen; 15290Sstevel@tonic-gate uint_t af; 15300Sstevel@tonic-gate 15310Sstevel@tonic-gate if (sel->ipsl_valid & IPSL_IPV4) { 15320Sstevel@tonic-gate af = AF_INET; 15330Sstevel@tonic-gate addrlen = IP_ADDR_LEN; 15340Sstevel@tonic-gate } else { 15350Sstevel@tonic-gate af = AF_INET6; 15360Sstevel@tonic-gate addrlen = IPV6_ADDR_LEN; 15370Sstevel@tonic-gate } 15380Sstevel@tonic-gate 15390Sstevel@tonic-gate ASSERT(ALIGNED64(offset)); 15400Sstevel@tonic-gate 15410Sstevel@tonic-gate if (base != NULL) { 15420Sstevel@tonic-gate sae = (struct spd_address *)(base + offset); 15430Sstevel@tonic-gate sae->spd_address_exttype = ext; 15440Sstevel@tonic-gate sae->spd_address_af = af; 15450Sstevel@tonic-gate sae->spd_address_prefixlen = pfxlen; 15460Sstevel@tonic-gate sae->spd_address_reserved2 = 0; 15470Sstevel@tonic-gate 15480Sstevel@tonic-gate spdaddr = (ipsec_addr_t *)(&sae[1]); 15490Sstevel@tonic-gate bcopy(addr, spdaddr, addrlen); 15500Sstevel@tonic-gate } 15510Sstevel@tonic-gate offset += sizeof (*sae); 15520Sstevel@tonic-gate addrlen = roundup(addrlen, sizeof (uint64_t)); 15530Sstevel@tonic-gate offset += addrlen; 15540Sstevel@tonic-gate 15550Sstevel@tonic-gate ASSERT(ALIGNED64(offset)); 15560Sstevel@tonic-gate 15570Sstevel@tonic-gate if (base != NULL) 15580Sstevel@tonic-gate sae->spd_address_len = SPD_8TO64(offset - start); 15590Sstevel@tonic-gate return (offset); 15600Sstevel@tonic-gate } 15610Sstevel@tonic-gate 15620Sstevel@tonic-gate static uint_t 15630Sstevel@tonic-gate spdsock_encode_sel(uint8_t *base, uint_t offset, const ipsec_sel_t *sel) 15640Sstevel@tonic-gate { 15650Sstevel@tonic-gate const ipsec_selkey_t *selkey = &sel->ipsl_key; 15660Sstevel@tonic-gate 15670Sstevel@tonic-gate if (selkey->ipsl_valid & IPSL_PROTOCOL) 15680Sstevel@tonic-gate offset = spdsock_encode_proto(base, offset, selkey->ipsl_proto); 15690Sstevel@tonic-gate if (selkey->ipsl_valid & IPSL_LOCAL_PORT) 15700Sstevel@tonic-gate offset = spdsock_encode_port(base, offset, SPD_EXT_LCLPORT, 15710Sstevel@tonic-gate selkey->ipsl_lport); 15720Sstevel@tonic-gate if (selkey->ipsl_valid & IPSL_REMOTE_PORT) 15730Sstevel@tonic-gate offset = spdsock_encode_port(base, offset, SPD_EXT_REMPORT, 15740Sstevel@tonic-gate selkey->ipsl_rport); 15750Sstevel@tonic-gate if (selkey->ipsl_valid & IPSL_REMOTE_ADDR) 15760Sstevel@tonic-gate offset = spdsock_encode_addr(base, offset, SPD_EXT_REMADDR, 15770Sstevel@tonic-gate selkey, &selkey->ipsl_remote, selkey->ipsl_remote_pfxlen); 15780Sstevel@tonic-gate if (selkey->ipsl_valid & IPSL_LOCAL_ADDR) 15790Sstevel@tonic-gate offset = spdsock_encode_addr(base, offset, SPD_EXT_LCLADDR, 15800Sstevel@tonic-gate selkey, &selkey->ipsl_local, selkey->ipsl_local_pfxlen); 15810Sstevel@tonic-gate if (selkey->ipsl_valid & IPSL_ICMP_TYPE) { 15820Sstevel@tonic-gate offset = spdsock_encode_typecode(base, offset, 15830Sstevel@tonic-gate selkey->ipsl_icmp_type, selkey->ipsl_icmp_type_end, 15840Sstevel@tonic-gate (selkey->ipsl_valid & IPSL_ICMP_CODE) ? 15855240Snordmark selkey->ipsl_icmp_code : 255, 15860Sstevel@tonic-gate (selkey->ipsl_valid & IPSL_ICMP_CODE) ? 15875240Snordmark selkey->ipsl_icmp_code_end : 255); 15880Sstevel@tonic-gate } 15890Sstevel@tonic-gate return (offset); 15900Sstevel@tonic-gate } 15910Sstevel@tonic-gate 15920Sstevel@tonic-gate static uint_t 15930Sstevel@tonic-gate spdsock_encode_actattr(uint8_t *base, uint_t offset, uint32_t tag, 15940Sstevel@tonic-gate uint32_t value) 15950Sstevel@tonic-gate { 15960Sstevel@tonic-gate struct spd_attribute *attr; 15970Sstevel@tonic-gate 15980Sstevel@tonic-gate ASSERT(ALIGNED64(offset)); 15990Sstevel@tonic-gate 16000Sstevel@tonic-gate if (base != NULL) { 16010Sstevel@tonic-gate attr = (struct spd_attribute *)(base + offset); 16020Sstevel@tonic-gate attr->spd_attr_tag = tag; 16030Sstevel@tonic-gate attr->spd_attr_value = value; 16040Sstevel@tonic-gate } 16050Sstevel@tonic-gate offset += sizeof (struct spd_attribute); 16060Sstevel@tonic-gate 16070Sstevel@tonic-gate ASSERT(ALIGNED64(offset)); 16080Sstevel@tonic-gate 16090Sstevel@tonic-gate return (offset); 16100Sstevel@tonic-gate } 16110Sstevel@tonic-gate 16120Sstevel@tonic-gate 16130Sstevel@tonic-gate #define EMIT(t, v) offset = spdsock_encode_actattr(base, offset, (t), (v)) 16140Sstevel@tonic-gate 16150Sstevel@tonic-gate static uint_t 16160Sstevel@tonic-gate spdsock_encode_action(uint8_t *base, uint_t offset, const ipsec_action_t *ap) 16170Sstevel@tonic-gate { 16180Sstevel@tonic-gate const struct ipsec_act *act = &(ap->ipa_act); 16190Sstevel@tonic-gate uint_t flags; 16200Sstevel@tonic-gate 16210Sstevel@tonic-gate EMIT(SPD_ATTR_EMPTY, 0); 16220Sstevel@tonic-gate switch (act->ipa_type) { 16230Sstevel@tonic-gate case IPSEC_ACT_DISCARD: 16240Sstevel@tonic-gate case IPSEC_ACT_REJECT: 16250Sstevel@tonic-gate EMIT(SPD_ATTR_TYPE, SPD_ACTTYPE_DROP); 16260Sstevel@tonic-gate break; 16270Sstevel@tonic-gate case IPSEC_ACT_BYPASS: 16280Sstevel@tonic-gate case IPSEC_ACT_CLEAR: 16290Sstevel@tonic-gate EMIT(SPD_ATTR_TYPE, SPD_ACTTYPE_PASS); 16300Sstevel@tonic-gate break; 16310Sstevel@tonic-gate 16320Sstevel@tonic-gate case IPSEC_ACT_APPLY: 16330Sstevel@tonic-gate EMIT(SPD_ATTR_TYPE, SPD_ACTTYPE_IPSEC); 16340Sstevel@tonic-gate flags = 0; 16350Sstevel@tonic-gate if (act->ipa_apply.ipp_use_ah) 16360Sstevel@tonic-gate flags |= SPD_APPLY_AH; 16370Sstevel@tonic-gate if (act->ipa_apply.ipp_use_esp) 16380Sstevel@tonic-gate flags |= SPD_APPLY_ESP; 16390Sstevel@tonic-gate if (act->ipa_apply.ipp_use_espa) 16400Sstevel@tonic-gate flags |= SPD_APPLY_ESPA; 16410Sstevel@tonic-gate if (act->ipa_apply.ipp_use_se) 16420Sstevel@tonic-gate flags |= SPD_APPLY_SE; 16430Sstevel@tonic-gate if (act->ipa_apply.ipp_use_unique) 16440Sstevel@tonic-gate flags |= SPD_APPLY_UNIQUE; 16450Sstevel@tonic-gate EMIT(SPD_ATTR_FLAGS, flags); 16460Sstevel@tonic-gate if (flags & SPD_APPLY_AH) { 16470Sstevel@tonic-gate EMIT(SPD_ATTR_AH_AUTH, act->ipa_apply.ipp_auth_alg); 16480Sstevel@tonic-gate EMIT(SPD_ATTR_AH_MINBITS, 16490Sstevel@tonic-gate act->ipa_apply.ipp_ah_minbits); 16500Sstevel@tonic-gate EMIT(SPD_ATTR_AH_MAXBITS, 16510Sstevel@tonic-gate act->ipa_apply.ipp_ah_maxbits); 16520Sstevel@tonic-gate } 16530Sstevel@tonic-gate if (flags & SPD_APPLY_ESP) { 16540Sstevel@tonic-gate EMIT(SPD_ATTR_ESP_ENCR, act->ipa_apply.ipp_encr_alg); 16550Sstevel@tonic-gate EMIT(SPD_ATTR_ENCR_MINBITS, 16560Sstevel@tonic-gate act->ipa_apply.ipp_espe_minbits); 16570Sstevel@tonic-gate EMIT(SPD_ATTR_ENCR_MAXBITS, 16580Sstevel@tonic-gate act->ipa_apply.ipp_espe_maxbits); 16590Sstevel@tonic-gate if (flags & SPD_APPLY_ESPA) { 16600Sstevel@tonic-gate EMIT(SPD_ATTR_ESP_AUTH, 16610Sstevel@tonic-gate act->ipa_apply.ipp_esp_auth_alg); 16620Sstevel@tonic-gate EMIT(SPD_ATTR_ESPA_MINBITS, 16630Sstevel@tonic-gate act->ipa_apply.ipp_espa_minbits); 16640Sstevel@tonic-gate EMIT(SPD_ATTR_ESPA_MAXBITS, 16650Sstevel@tonic-gate act->ipa_apply.ipp_espa_maxbits); 16660Sstevel@tonic-gate } 16670Sstevel@tonic-gate } 16680Sstevel@tonic-gate if (act->ipa_apply.ipp_km_proto != 0) 16690Sstevel@tonic-gate EMIT(SPD_ATTR_KM_PROTO, act->ipa_apply.ipp_km_proto); 16700Sstevel@tonic-gate if (act->ipa_apply.ipp_km_cookie != 0) 16710Sstevel@tonic-gate EMIT(SPD_ATTR_KM_PROTO, act->ipa_apply.ipp_km_cookie); 16720Sstevel@tonic-gate if (act->ipa_apply.ipp_replay_depth != 0) 16730Sstevel@tonic-gate EMIT(SPD_ATTR_REPLAY_DEPTH, 16740Sstevel@tonic-gate act->ipa_apply.ipp_replay_depth); 16750Sstevel@tonic-gate /* Add more here */ 16760Sstevel@tonic-gate break; 16770Sstevel@tonic-gate } 16780Sstevel@tonic-gate 16790Sstevel@tonic-gate return (offset); 16800Sstevel@tonic-gate } 16810Sstevel@tonic-gate 16820Sstevel@tonic-gate static uint_t 16830Sstevel@tonic-gate spdsock_encode_action_list(uint8_t *base, uint_t offset, 16840Sstevel@tonic-gate const ipsec_action_t *ap) 16850Sstevel@tonic-gate { 16860Sstevel@tonic-gate struct spd_ext_actions *act; 16870Sstevel@tonic-gate uint_t nact = 0; 16880Sstevel@tonic-gate uint_t start = offset; 16890Sstevel@tonic-gate 16900Sstevel@tonic-gate ASSERT(ALIGNED64(offset)); 16910Sstevel@tonic-gate 16920Sstevel@tonic-gate if (base != NULL) { 16930Sstevel@tonic-gate act = (struct spd_ext_actions *)(base + offset); 16940Sstevel@tonic-gate act->spd_actions_len = 0; 16950Sstevel@tonic-gate act->spd_actions_exttype = SPD_EXT_ACTION; 16960Sstevel@tonic-gate act->spd_actions_count = 0; 16970Sstevel@tonic-gate act->spd_actions_reserved = 0; 16980Sstevel@tonic-gate } 16990Sstevel@tonic-gate 17000Sstevel@tonic-gate offset += sizeof (*act); 17010Sstevel@tonic-gate 17020Sstevel@tonic-gate ASSERT(ALIGNED64(offset)); 17030Sstevel@tonic-gate 17040Sstevel@tonic-gate while (ap != NULL) { 17050Sstevel@tonic-gate offset = spdsock_encode_action(base, offset, ap); 17060Sstevel@tonic-gate ap = ap->ipa_next; 17070Sstevel@tonic-gate nact++; 17080Sstevel@tonic-gate if (ap != NULL) { 17090Sstevel@tonic-gate EMIT(SPD_ATTR_NEXT, 0); 17100Sstevel@tonic-gate } 17110Sstevel@tonic-gate } 17120Sstevel@tonic-gate EMIT(SPD_ATTR_END, 0); 17130Sstevel@tonic-gate 17140Sstevel@tonic-gate ASSERT(ALIGNED64(offset)); 17150Sstevel@tonic-gate 17160Sstevel@tonic-gate if (base != NULL) { 17170Sstevel@tonic-gate act->spd_actions_count = nact; 17180Sstevel@tonic-gate act->spd_actions_len = SPD_8TO64(offset - start); 17190Sstevel@tonic-gate } 17200Sstevel@tonic-gate 17210Sstevel@tonic-gate return (offset); 17220Sstevel@tonic-gate } 17230Sstevel@tonic-gate 17240Sstevel@tonic-gate #undef EMIT 17250Sstevel@tonic-gate 17260Sstevel@tonic-gate /* ARGSUSED */ 17270Sstevel@tonic-gate static uint_t 17280Sstevel@tonic-gate spdsock_rule_flags(uint_t dir, uint_t af) 17290Sstevel@tonic-gate { 17300Sstevel@tonic-gate uint_t flags = 0; 17310Sstevel@tonic-gate 17320Sstevel@tonic-gate if (dir == IPSEC_TYPE_INBOUND) 17330Sstevel@tonic-gate flags |= SPD_RULE_FLAG_INBOUND; 17340Sstevel@tonic-gate if (dir == IPSEC_TYPE_OUTBOUND) 17350Sstevel@tonic-gate flags |= SPD_RULE_FLAG_OUTBOUND; 17360Sstevel@tonic-gate 17370Sstevel@tonic-gate return (flags); 17380Sstevel@tonic-gate } 17390Sstevel@tonic-gate 17400Sstevel@tonic-gate 17410Sstevel@tonic-gate static uint_t 17423055Sdanmcd spdsock_encode_rule_head(uint8_t *base, uint_t offset, spd_msg_t *req, 17433055Sdanmcd const ipsec_policy_t *rule, uint_t dir, uint_t af, char *name, 17443055Sdanmcd boolean_t tunnel) 17450Sstevel@tonic-gate { 17460Sstevel@tonic-gate struct spd_msg *spmsg; 17470Sstevel@tonic-gate struct spd_rule *spr; 17483055Sdanmcd spd_if_t *sid; 17490Sstevel@tonic-gate 17500Sstevel@tonic-gate uint_t start = offset; 17510Sstevel@tonic-gate 17520Sstevel@tonic-gate ASSERT(ALIGNED64(offset)); 17530Sstevel@tonic-gate 17540Sstevel@tonic-gate if (base != NULL) { 17550Sstevel@tonic-gate spmsg = (struct spd_msg *)(base + offset); 17560Sstevel@tonic-gate bzero(spmsg, sizeof (*spmsg)); 17570Sstevel@tonic-gate spmsg->spd_msg_version = PF_POLICY_V1; 17580Sstevel@tonic-gate spmsg->spd_msg_type = SPD_DUMP; 17590Sstevel@tonic-gate spmsg->spd_msg_seq = req->spd_msg_seq; 17600Sstevel@tonic-gate spmsg->spd_msg_pid = req->spd_msg_pid; 17610Sstevel@tonic-gate } 17620Sstevel@tonic-gate offset += sizeof (struct spd_msg); 17630Sstevel@tonic-gate 17640Sstevel@tonic-gate ASSERT(ALIGNED64(offset)); 17650Sstevel@tonic-gate 17660Sstevel@tonic-gate if (base != NULL) { 17670Sstevel@tonic-gate spr = (struct spd_rule *)(base + offset); 17680Sstevel@tonic-gate spr->spd_rule_type = SPD_EXT_RULE; 17690Sstevel@tonic-gate spr->spd_rule_priority = rule->ipsp_prio; 17700Sstevel@tonic-gate spr->spd_rule_flags = spdsock_rule_flags(dir, af); 17713055Sdanmcd if (tunnel) 17723055Sdanmcd spr->spd_rule_flags |= SPD_RULE_FLAG_TUNNEL; 17730Sstevel@tonic-gate spr->spd_rule_unused = 0; 17740Sstevel@tonic-gate spr->spd_rule_len = SPD_8TO64(sizeof (*spr)); 17750Sstevel@tonic-gate spr->spd_rule_index = rule->ipsp_index; 17760Sstevel@tonic-gate } 17770Sstevel@tonic-gate offset += sizeof (struct spd_rule); 17783055Sdanmcd 17793055Sdanmcd /* 17803055Sdanmcd * If we have an interface name (i.e. if this policy head came from 17813055Sdanmcd * a tunnel), add the SPD_EXT_TUN_NAME extension. 17823055Sdanmcd */ 17836466Sdanmcd if (name != NULL) { 17843055Sdanmcd 17853055Sdanmcd ASSERT(ALIGNED64(offset)); 17863055Sdanmcd 17873055Sdanmcd if (base != NULL) { 17883055Sdanmcd sid = (spd_if_t *)(base + offset); 17893055Sdanmcd sid->spd_if_exttype = SPD_EXT_TUN_NAME; 17903055Sdanmcd sid->spd_if_len = SPD_8TO64(sizeof (spd_if_t) + 17913055Sdanmcd roundup((strlen(name) - 4), 8)); 17923055Sdanmcd (void) strlcpy((char *)sid->spd_if_name, name, 17933055Sdanmcd LIFNAMSIZ); 17943055Sdanmcd } 17953055Sdanmcd 17963055Sdanmcd offset += sizeof (spd_if_t) + roundup((strlen(name) - 4), 8); 17973055Sdanmcd } 17983055Sdanmcd 17990Sstevel@tonic-gate offset = spdsock_encode_sel(base, offset, rule->ipsp_sel); 18000Sstevel@tonic-gate offset = spdsock_encode_action_list(base, offset, rule->ipsp_act); 18010Sstevel@tonic-gate 18020Sstevel@tonic-gate ASSERT(ALIGNED64(offset)); 18030Sstevel@tonic-gate 18040Sstevel@tonic-gate if (base != NULL) { 18050Sstevel@tonic-gate spmsg->spd_msg_len = SPD_8TO64(offset - start); 18060Sstevel@tonic-gate } 18070Sstevel@tonic-gate return (offset); 18080Sstevel@tonic-gate } 18090Sstevel@tonic-gate 18100Sstevel@tonic-gate /* ARGSUSED */ 18110Sstevel@tonic-gate static mblk_t * 18120Sstevel@tonic-gate spdsock_encode_rule(mblk_t *req, const ipsec_policy_t *rule, 18133055Sdanmcd uint_t dir, uint_t af, char *name, boolean_t tunnel) 18140Sstevel@tonic-gate { 18150Sstevel@tonic-gate mblk_t *m; 18160Sstevel@tonic-gate uint_t len; 18170Sstevel@tonic-gate spd_msg_t *mreq = (spd_msg_t *)req->b_rptr; 18180Sstevel@tonic-gate 18190Sstevel@tonic-gate /* 18200Sstevel@tonic-gate * Figure out how much space we'll need. 18210Sstevel@tonic-gate */ 18223055Sdanmcd len = spdsock_encode_rule_head(NULL, 0, mreq, rule, dir, af, name, 18233055Sdanmcd tunnel); 18240Sstevel@tonic-gate 18250Sstevel@tonic-gate /* 18260Sstevel@tonic-gate * Allocate mblk. 18270Sstevel@tonic-gate */ 18280Sstevel@tonic-gate m = allocb(len, BPRI_HI); 18290Sstevel@tonic-gate if (m == NULL) 18300Sstevel@tonic-gate return (NULL); 18310Sstevel@tonic-gate 18320Sstevel@tonic-gate /* 18330Sstevel@tonic-gate * Fill it in.. 18340Sstevel@tonic-gate */ 18350Sstevel@tonic-gate m->b_wptr = m->b_rptr + len; 18360Sstevel@tonic-gate bzero(m->b_rptr, len); 18373055Sdanmcd (void) spdsock_encode_rule_head(m->b_rptr, 0, mreq, rule, dir, af, 18383055Sdanmcd name, tunnel); 18390Sstevel@tonic-gate return (m); 18400Sstevel@tonic-gate } 18410Sstevel@tonic-gate 18420Sstevel@tonic-gate static ipsec_policy_t * 184381Ssommerfe spdsock_dump_next_in_chain(spdsock_t *ss, ipsec_policy_head_t *iph, 184481Ssommerfe ipsec_policy_t *cur) 184581Ssommerfe { 184681Ssommerfe ASSERT(RW_READ_HELD(&iph->iph_lock)); 184781Ssommerfe 184881Ssommerfe ss->spdsock_dump_count++; 184981Ssommerfe ss->spdsock_dump_cur_rule = cur->ipsp_hash.hash_next; 185081Ssommerfe return (cur); 185181Ssommerfe } 185281Ssommerfe 185381Ssommerfe static ipsec_policy_t * 18540Sstevel@tonic-gate spdsock_dump_next_rule(spdsock_t *ss, ipsec_policy_head_t *iph) 18550Sstevel@tonic-gate { 18560Sstevel@tonic-gate ipsec_policy_t *cur; 185781Ssommerfe ipsec_policy_root_t *ipr; 185881Ssommerfe int chain, nchains, type, af; 18590Sstevel@tonic-gate 18600Sstevel@tonic-gate ASSERT(RW_READ_HELD(&iph->iph_lock)); 18610Sstevel@tonic-gate 18620Sstevel@tonic-gate cur = ss->spdsock_dump_cur_rule; 18630Sstevel@tonic-gate 186481Ssommerfe if (cur != NULL) 186581Ssommerfe return (spdsock_dump_next_in_chain(ss, iph, cur)); 186681Ssommerfe 186781Ssommerfe type = ss->spdsock_dump_cur_type; 186881Ssommerfe 186981Ssommerfe next: 187081Ssommerfe chain = ss->spdsock_dump_cur_chain; 187181Ssommerfe ipr = &iph->iph_root[type]; 187281Ssommerfe nchains = ipr->ipr_nchains; 187381Ssommerfe 187481Ssommerfe while (chain < nchains) { 187581Ssommerfe cur = ipr->ipr_hash[chain].hash_head; 187681Ssommerfe chain++; 187781Ssommerfe if (cur != NULL) { 187881Ssommerfe ss->spdsock_dump_cur_chain = chain; 187981Ssommerfe return (spdsock_dump_next_in_chain(ss, iph, cur)); 188081Ssommerfe } 18810Sstevel@tonic-gate } 188281Ssommerfe ss->spdsock_dump_cur_chain = nchains; 188381Ssommerfe 188481Ssommerfe af = ss->spdsock_dump_cur_af; 188581Ssommerfe while (af < IPSEC_NAF) { 188681Ssommerfe cur = ipr->ipr_nonhash[af]; 188781Ssommerfe af++; 188881Ssommerfe if (cur != NULL) { 188981Ssommerfe ss->spdsock_dump_cur_af = af; 189081Ssommerfe return (spdsock_dump_next_in_chain(ss, iph, cur)); 189181Ssommerfe } 189281Ssommerfe } 189381Ssommerfe 189481Ssommerfe type++; 189581Ssommerfe if (type >= IPSEC_NTYPES) 189681Ssommerfe return (NULL); 189781Ssommerfe 189881Ssommerfe ss->spdsock_dump_cur_chain = 0; 189981Ssommerfe ss->spdsock_dump_cur_type = type; 190081Ssommerfe ss->spdsock_dump_cur_af = IPSEC_AF_V4; 190181Ssommerfe goto next; 190281Ssommerfe 19030Sstevel@tonic-gate } 19040Sstevel@tonic-gate 19056430Sdanmcd /* 19066430Sdanmcd * If we're done with one policy head, but have more to go, we iterate through 19076430Sdanmcd * another IPsec tunnel policy head (itp). Return NULL if it is an error 19086430Sdanmcd * worthy of returning EAGAIN via PF_POLICY. 19096430Sdanmcd */ 19106430Sdanmcd static ipsec_tun_pol_t * 19116430Sdanmcd spdsock_dump_iterate_next_tunnel(spdsock_t *ss, ipsec_stack_t *ipss) 19126430Sdanmcd { 19136430Sdanmcd ipsec_tun_pol_t *itp; 19146430Sdanmcd 19156430Sdanmcd ASSERT(RW_READ_HELD(&ipss->ipsec_tunnel_policy_lock)); 19166430Sdanmcd if (ipss->ipsec_tunnel_policy_gen > ss->spdsock_dump_tun_gen) { 19176430Sdanmcd /* Oops, state of the tunnel polheads changed. */ 19186430Sdanmcd itp = NULL; 19196430Sdanmcd } else if (ss->spdsock_itp == NULL) { 19206430Sdanmcd /* Just finished global, find first node. */ 19216430Sdanmcd itp = avl_first(&ipss->ipsec_tunnel_policies); 19226430Sdanmcd } else { 19236430Sdanmcd /* We just finished current polhead, find the next one. */ 19246430Sdanmcd itp = AVL_NEXT(&ipss->ipsec_tunnel_policies, ss->spdsock_itp); 19256430Sdanmcd } 19266430Sdanmcd if (itp != NULL) { 19276430Sdanmcd ITP_REFHOLD(itp); 19286430Sdanmcd } 19296430Sdanmcd if (ss->spdsock_itp != NULL) { 19306430Sdanmcd ITP_REFRELE(ss->spdsock_itp, ipss->ipsec_netstack); 19316430Sdanmcd } 19326430Sdanmcd ss->spdsock_itp = itp; 19336430Sdanmcd return (itp); 19346430Sdanmcd } 19356430Sdanmcd 19360Sstevel@tonic-gate static mblk_t * 19370Sstevel@tonic-gate spdsock_dump_next_record(spdsock_t *ss) 19380Sstevel@tonic-gate { 19390Sstevel@tonic-gate ipsec_policy_head_t *iph; 19400Sstevel@tonic-gate ipsec_policy_t *rule; 19410Sstevel@tonic-gate mblk_t *m; 19426430Sdanmcd ipsec_tun_pol_t *itp; 19436430Sdanmcd netstack_t *ns = ss->spdsock_spds->spds_netstack; 19446430Sdanmcd ipsec_stack_t *ipss = ns->netstack_ipsec; 19450Sstevel@tonic-gate 19460Sstevel@tonic-gate iph = ss->spdsock_dump_head; 19470Sstevel@tonic-gate 19480Sstevel@tonic-gate ASSERT(iph != NULL); 19490Sstevel@tonic-gate 19500Sstevel@tonic-gate rw_enter(&iph->iph_lock, RW_READER); 19510Sstevel@tonic-gate 19520Sstevel@tonic-gate if (iph->iph_gen != ss->spdsock_dump_gen) { 19530Sstevel@tonic-gate rw_exit(&iph->iph_lock); 19540Sstevel@tonic-gate return (spdsock_dump_finish(ss, EAGAIN)); 19550Sstevel@tonic-gate } 19560Sstevel@tonic-gate 19576430Sdanmcd while ((rule = spdsock_dump_next_rule(ss, iph)) == NULL) { 19580Sstevel@tonic-gate rw_exit(&iph->iph_lock); 19596430Sdanmcd if (--(ss->spdsock_dump_remaining_polheads) == 0) 19606430Sdanmcd return (spdsock_dump_finish(ss, 0)); 19616430Sdanmcd 19626430Sdanmcd 19636430Sdanmcd /* 19646430Sdanmcd * If we reach here, we have more policy heads (tunnel 19656430Sdanmcd * entries) to dump. Let's reset to a new policy head 19666430Sdanmcd * and get some more rules. 19676430Sdanmcd * 19686430Sdanmcd * An empty policy head will have spdsock_dump_next_rule() 19696430Sdanmcd * return NULL, and we loop (while dropping the number of 19706430Sdanmcd * remaining polheads). If we loop to 0, we finish. We 19716430Sdanmcd * keep looping until we hit 0 or until we have a rule to 19726430Sdanmcd * encode. 19736430Sdanmcd * 19746430Sdanmcd * NOTE: No need for ITP_REF*() macros here as we're only 19756430Sdanmcd * going after and refholding the policy head itself. 19766430Sdanmcd */ 19776430Sdanmcd rw_enter(&ipss->ipsec_tunnel_policy_lock, RW_READER); 19786430Sdanmcd itp = spdsock_dump_iterate_next_tunnel(ss, ipss); 19796430Sdanmcd if (itp == NULL) { 19806430Sdanmcd rw_exit(&ipss->ipsec_tunnel_policy_lock); 19816430Sdanmcd return (spdsock_dump_finish(ss, EAGAIN)); 19826430Sdanmcd } 19836430Sdanmcd 19846430Sdanmcd /* Reset other spdsock_dump thingies. */ 19856430Sdanmcd IPPH_REFRELE(ss->spdsock_dump_head, ns); 19866430Sdanmcd if (ss->spdsock_dump_active) { 19876430Sdanmcd ss->spdsock_dump_tunnel = 19886430Sdanmcd itp->itp_flags & ITPF_P_TUNNEL; 19896430Sdanmcd iph = itp->itp_policy; 19906430Sdanmcd } else { 19916430Sdanmcd ss->spdsock_dump_tunnel = 19926430Sdanmcd itp->itp_flags & ITPF_I_TUNNEL; 19936430Sdanmcd iph = itp->itp_inactive; 19946430Sdanmcd } 19956430Sdanmcd IPPH_REFHOLD(iph); 19966430Sdanmcd rw_exit(&ipss->ipsec_tunnel_policy_lock); 19976430Sdanmcd 19986430Sdanmcd rw_enter(&iph->iph_lock, RW_READER); 19996430Sdanmcd RESET_SPDSOCK_DUMP_POLHEAD(ss, iph); 20000Sstevel@tonic-gate } 20010Sstevel@tonic-gate 20026430Sdanmcd m = spdsock_encode_rule(ss->spdsock_dump_req, rule, 20036430Sdanmcd ss->spdsock_dump_cur_type, ss->spdsock_dump_cur_af, 20046466Sdanmcd (ss->spdsock_itp == NULL) ? NULL : ss->spdsock_itp->itp_name, 20056466Sdanmcd ss->spdsock_dump_tunnel); 20060Sstevel@tonic-gate rw_exit(&iph->iph_lock); 20070Sstevel@tonic-gate 20080Sstevel@tonic-gate if (m == NULL) 20090Sstevel@tonic-gate return (spdsock_dump_finish(ss, ENOMEM)); 20100Sstevel@tonic-gate return (m); 20110Sstevel@tonic-gate } 20120Sstevel@tonic-gate 20130Sstevel@tonic-gate /* 20140Sstevel@tonic-gate * Dump records until we run into flow-control back-pressure. 20150Sstevel@tonic-gate */ 20160Sstevel@tonic-gate static void 20170Sstevel@tonic-gate spdsock_dump_some(queue_t *q, spdsock_t *ss) 20180Sstevel@tonic-gate { 20190Sstevel@tonic-gate mblk_t *m, *dataind; 20200Sstevel@tonic-gate 20210Sstevel@tonic-gate while ((ss->spdsock_dump_req != NULL) && canputnext(q)) { 20220Sstevel@tonic-gate m = spdsock_dump_next_record(ss); 20230Sstevel@tonic-gate if (m == NULL) 20240Sstevel@tonic-gate return; 20250Sstevel@tonic-gate dataind = allocb(sizeof (struct T_data_req), BPRI_HI); 20260Sstevel@tonic-gate if (dataind == NULL) { 20270Sstevel@tonic-gate freemsg(m); 20280Sstevel@tonic-gate return; 20290Sstevel@tonic-gate } 20300Sstevel@tonic-gate dataind->b_cont = m; 20310Sstevel@tonic-gate dataind->b_wptr += sizeof (struct T_data_req); 20320Sstevel@tonic-gate ((struct T_data_ind *)dataind->b_rptr)->PRIM_type = T_DATA_IND; 20330Sstevel@tonic-gate ((struct T_data_ind *)dataind->b_rptr)->MORE_flag = 0; 20340Sstevel@tonic-gate dataind->b_datap->db_type = M_PROTO; 20350Sstevel@tonic-gate putnext(q, dataind); 20360Sstevel@tonic-gate } 20370Sstevel@tonic-gate } 20380Sstevel@tonic-gate 20390Sstevel@tonic-gate /* 20400Sstevel@tonic-gate * Start dumping. 20410Sstevel@tonic-gate * Format a start-of-dump record, and set up the stream and kick the rsrv 20420Sstevel@tonic-gate * procedure to continue the job.. 20430Sstevel@tonic-gate */ 20440Sstevel@tonic-gate /* ARGSUSED */ 20450Sstevel@tonic-gate static void 20463055Sdanmcd spdsock_dump(queue_t *q, ipsec_policy_head_t *iph, mblk_t *mp) 20470Sstevel@tonic-gate { 20480Sstevel@tonic-gate spdsock_t *ss = (spdsock_t *)q->q_ptr; 20496430Sdanmcd netstack_t *ns = ss->spdsock_spds->spds_netstack; 20503448Sdh155122 ipsec_stack_t *ipss = ns->netstack_ipsec; 20510Sstevel@tonic-gate mblk_t *mr; 20520Sstevel@tonic-gate 20536430Sdanmcd /* spdsock_open() already set spdsock_itp to NULL. */ 20543055Sdanmcd if (iph == ALL_ACTIVE_POLHEADS || iph == ALL_INACTIVE_POLHEADS) { 20553448Sdh155122 rw_enter(&ipss->ipsec_tunnel_policy_lock, RW_READER); 20563055Sdanmcd ss->spdsock_dump_remaining_polheads = 1 + 20573448Sdh155122 avl_numnodes(&ipss->ipsec_tunnel_policies); 20583448Sdh155122 ss->spdsock_dump_tun_gen = ipss->ipsec_tunnel_policy_gen; 20593448Sdh155122 rw_exit(&ipss->ipsec_tunnel_policy_lock); 20603055Sdanmcd if (iph == ALL_ACTIVE_POLHEADS) { 20613448Sdh155122 iph = ipsec_system_policy(ns); 20623055Sdanmcd ss->spdsock_dump_active = B_TRUE; 20633055Sdanmcd } else { 20646430Sdanmcd iph = ipsec_inactive_policy(ns); 20653055Sdanmcd ss->spdsock_dump_active = B_FALSE; 20663055Sdanmcd } 20676430Sdanmcd ASSERT(ss->spdsock_itp == NULL); 20683055Sdanmcd } else { 20693055Sdanmcd ss->spdsock_dump_remaining_polheads = 1; 20703055Sdanmcd } 20713055Sdanmcd 20720Sstevel@tonic-gate rw_enter(&iph->iph_lock, RW_READER); 20730Sstevel@tonic-gate 20740Sstevel@tonic-gate mr = spdsock_dump_ruleset(mp, iph, 0, 0); 20750Sstevel@tonic-gate 20760Sstevel@tonic-gate if (!mr) { 20770Sstevel@tonic-gate rw_exit(&iph->iph_lock); 20780Sstevel@tonic-gate spdsock_error(q, mp, ENOMEM, 0); 20790Sstevel@tonic-gate return; 20800Sstevel@tonic-gate } 20810Sstevel@tonic-gate 20820Sstevel@tonic-gate ss->spdsock_dump_req = mp; 20836430Sdanmcd RESET_SPDSOCK_DUMP_POLHEAD(ss, iph); 20846430Sdanmcd 20850Sstevel@tonic-gate rw_exit(&iph->iph_lock); 20860Sstevel@tonic-gate 20870Sstevel@tonic-gate qreply(q, mr); 20880Sstevel@tonic-gate qenable(OTHERQ(q)); 20890Sstevel@tonic-gate } 20900Sstevel@tonic-gate 20913055Sdanmcd /* Do NOT consume a reference to ITP. */ 20920Sstevel@tonic-gate void 20933448Sdh155122 spdsock_clone_node(ipsec_tun_pol_t *itp, void *ep, netstack_t *ns) 20943055Sdanmcd { 20953055Sdanmcd int *errptr = (int *)ep; 20963055Sdanmcd 20973055Sdanmcd if (*errptr != 0) 20983055Sdanmcd return; /* We've failed already for some reason. */ 20993055Sdanmcd mutex_enter(&itp->itp_lock); 21003055Sdanmcd ITPF_CLONE(itp->itp_flags); 21013448Sdh155122 *errptr = ipsec_copy_polhead(itp->itp_policy, itp->itp_inactive, ns); 21023055Sdanmcd mutex_exit(&itp->itp_lock); 21033055Sdanmcd } 21043055Sdanmcd 21053055Sdanmcd void 21063055Sdanmcd spdsock_clone(queue_t *q, mblk_t *mp, spd_if_t *tunname) 21070Sstevel@tonic-gate { 21083055Sdanmcd int error; 21093055Sdanmcd char *tname; 21103055Sdanmcd ipsec_tun_pol_t *itp; 21113448Sdh155122 spdsock_t *ss = (spdsock_t *)q->q_ptr; 21126430Sdanmcd netstack_t *ns = ss->spdsock_spds->spds_netstack; 2113*11861SMarek.Pospisil@Sun.COM uint32_t auditing = AU_AUDITING(); 21143055Sdanmcd 21153055Sdanmcd if (tunname != NULL) { 21163055Sdanmcd tname = (char *)tunname->spd_if_name; 21173055Sdanmcd if (*tname == '\0') { 21186430Sdanmcd error = ipsec_clone_system_policy(ns); 2119*11861SMarek.Pospisil@Sun.COM if (auditing) { 21204307Spwernau boolean_t active; 21214307Spwernau spd_msg_t *spmsg = (spd_msg_t *)mp->b_rptr; 21228778SErik.Nordmark@Sun.COM cred_t *cr; 21238778SErik.Nordmark@Sun.COM pid_t cpid; 21248778SErik.Nordmark@Sun.COM 21258778SErik.Nordmark@Sun.COM cr = msg_getcred(mp, &cpid); 21264307Spwernau active = (spmsg->spd_msg_spdid == SPD_ACTIVE); 21278778SErik.Nordmark@Sun.COM audit_pf_policy(SPD_CLONE, cr, ns, 21288778SErik.Nordmark@Sun.COM NULL, active, error, cpid); 21294307Spwernau } 21304307Spwernau if (error == 0) { 21316430Sdanmcd itp_walk(spdsock_clone_node, &error, ns); 2132*11861SMarek.Pospisil@Sun.COM if (auditing) { 21334307Spwernau boolean_t active; 21344307Spwernau spd_msg_t *spmsg = 21354307Spwernau (spd_msg_t *)mp->b_rptr; 21368778SErik.Nordmark@Sun.COM cred_t *cr; 21378778SErik.Nordmark@Sun.COM pid_t cpid; 21388778SErik.Nordmark@Sun.COM 21398778SErik.Nordmark@Sun.COM cr = msg_getcred(mp, &cpid); 21404307Spwernau active = (spmsg->spd_msg_spdid == 21414307Spwernau SPD_ACTIVE); 21428778SErik.Nordmark@Sun.COM audit_pf_policy(SPD_CLONE, cr, 21436430Sdanmcd ns, "all tunnels", active, 0, 21448778SErik.Nordmark@Sun.COM cpid); 21454307Spwernau } 21464307Spwernau } 21473055Sdanmcd } else { 21486430Sdanmcd itp = get_tunnel_policy(tname, ns); 21493055Sdanmcd if (itp == NULL) { 21503055Sdanmcd spdsock_error(q, mp, ENOENT, 0); 2151*11861SMarek.Pospisil@Sun.COM if (auditing) { 21524307Spwernau boolean_t active; 21534307Spwernau spd_msg_t *spmsg = 21544307Spwernau (spd_msg_t *)mp->b_rptr; 21558778SErik.Nordmark@Sun.COM cred_t *cr; 21568778SErik.Nordmark@Sun.COM pid_t cpid; 21578778SErik.Nordmark@Sun.COM 21588778SErik.Nordmark@Sun.COM cr = msg_getcred(mp, &cpid); 21594307Spwernau active = (spmsg->spd_msg_spdid == 21604307Spwernau SPD_ACTIVE); 21618778SErik.Nordmark@Sun.COM audit_pf_policy(SPD_CLONE, cr, 216210764Sdanmcd@sun.com ns, NULL, active, ENOENT, cpid); 21634307Spwernau } 21643055Sdanmcd return; 21653055Sdanmcd } 21663448Sdh155122 spdsock_clone_node(itp, &error, NULL); 2167*11861SMarek.Pospisil@Sun.COM if (auditing) { 21684307Spwernau boolean_t active; 21694307Spwernau spd_msg_t *spmsg = (spd_msg_t *)mp->b_rptr; 21708778SErik.Nordmark@Sun.COM cred_t *cr; 21718778SErik.Nordmark@Sun.COM pid_t cpid; 21728778SErik.Nordmark@Sun.COM 21738778SErik.Nordmark@Sun.COM cr = msg_getcred(mp, &cpid); 21744307Spwernau active = (spmsg->spd_msg_spdid == SPD_ACTIVE); 21758778SErik.Nordmark@Sun.COM audit_pf_policy(SPD_CLONE, cr, ns, 21768778SErik.Nordmark@Sun.COM ITP_NAME(itp), active, error, cpid); 21774307Spwernau } 217810764Sdanmcd@sun.com ITP_REFRELE(itp, ns); 21793055Sdanmcd } 21803055Sdanmcd } else { 21816430Sdanmcd error = ipsec_clone_system_policy(ns); 2182*11861SMarek.Pospisil@Sun.COM if (auditing) { 21834307Spwernau boolean_t active; 21844307Spwernau spd_msg_t *spmsg = (spd_msg_t *)mp->b_rptr; 21858778SErik.Nordmark@Sun.COM cred_t *cr; 21868778SErik.Nordmark@Sun.COM pid_t cpid; 21878778SErik.Nordmark@Sun.COM 21888778SErik.Nordmark@Sun.COM cr = msg_getcred(mp, &cpid); 21894307Spwernau active = (spmsg->spd_msg_spdid == SPD_ACTIVE); 21908778SErik.Nordmark@Sun.COM audit_pf_policy(SPD_CLONE, cr, ns, NULL, 21918778SErik.Nordmark@Sun.COM active, error, cpid); 21924307Spwernau } 21933055Sdanmcd } 21943055Sdanmcd 21950Sstevel@tonic-gate if (error != 0) 21960Sstevel@tonic-gate spdsock_error(q, mp, error, 0); 21970Sstevel@tonic-gate else 21980Sstevel@tonic-gate spd_echo(q, mp); 21990Sstevel@tonic-gate } 22000Sstevel@tonic-gate 22010Sstevel@tonic-gate /* 22020Sstevel@tonic-gate * Process a SPD_ALGLIST request. The caller expects separate alg entries 22030Sstevel@tonic-gate * for AH authentication, ESP authentication, and ESP encryption. 22040Sstevel@tonic-gate * The same distinction is then used when setting the min and max key 22050Sstevel@tonic-gate * sizes when defining policies. 22060Sstevel@tonic-gate */ 22070Sstevel@tonic-gate 22080Sstevel@tonic-gate #define SPDSOCK_AH_AUTH 0 22090Sstevel@tonic-gate #define SPDSOCK_ESP_AUTH 1 22100Sstevel@tonic-gate #define SPDSOCK_ESP_ENCR 2 22110Sstevel@tonic-gate #define SPDSOCK_NTYPES 3 22120Sstevel@tonic-gate 22130Sstevel@tonic-gate static const uint_t algattr[SPDSOCK_NTYPES] = { 22140Sstevel@tonic-gate SPD_ATTR_AH_AUTH, 22150Sstevel@tonic-gate SPD_ATTR_ESP_AUTH, 22160Sstevel@tonic-gate SPD_ATTR_ESP_ENCR 22170Sstevel@tonic-gate }; 22180Sstevel@tonic-gate static const uint_t minbitsattr[SPDSOCK_NTYPES] = { 22190Sstevel@tonic-gate SPD_ATTR_AH_MINBITS, 22200Sstevel@tonic-gate SPD_ATTR_ESPA_MINBITS, 22210Sstevel@tonic-gate SPD_ATTR_ENCR_MINBITS 22220Sstevel@tonic-gate }; 22230Sstevel@tonic-gate static const uint_t maxbitsattr[SPDSOCK_NTYPES] = { 22240Sstevel@tonic-gate SPD_ATTR_AH_MAXBITS, 22250Sstevel@tonic-gate SPD_ATTR_ESPA_MAXBITS, 22260Sstevel@tonic-gate SPD_ATTR_ENCR_MAXBITS 22270Sstevel@tonic-gate }; 22280Sstevel@tonic-gate static const uint_t defbitsattr[SPDSOCK_NTYPES] = { 22290Sstevel@tonic-gate SPD_ATTR_AH_DEFBITS, 22300Sstevel@tonic-gate SPD_ATTR_ESPA_DEFBITS, 22310Sstevel@tonic-gate SPD_ATTR_ENCR_DEFBITS 22320Sstevel@tonic-gate }; 22330Sstevel@tonic-gate static const uint_t incrbitsattr[SPDSOCK_NTYPES] = { 22340Sstevel@tonic-gate SPD_ATTR_AH_INCRBITS, 22350Sstevel@tonic-gate SPD_ATTR_ESPA_INCRBITS, 22360Sstevel@tonic-gate SPD_ATTR_ENCR_INCRBITS 22370Sstevel@tonic-gate }; 22380Sstevel@tonic-gate 22390Sstevel@tonic-gate #define ATTRPERALG 6 /* fixed attributes per algs */ 22400Sstevel@tonic-gate 22410Sstevel@tonic-gate void 22420Sstevel@tonic-gate spdsock_alglist(queue_t *q, mblk_t *mp) 22430Sstevel@tonic-gate { 22440Sstevel@tonic-gate uint_t algtype; 22450Sstevel@tonic-gate uint_t algidx; 22460Sstevel@tonic-gate uint_t algcount; 22470Sstevel@tonic-gate uint_t size; 22480Sstevel@tonic-gate mblk_t *m; 22490Sstevel@tonic-gate uint8_t *cur; 22500Sstevel@tonic-gate spd_msg_t *msg; 22510Sstevel@tonic-gate struct spd_ext_actions *act; 22520Sstevel@tonic-gate struct spd_attribute *attr; 22533448Sdh155122 spdsock_t *ss = (spdsock_t *)q->q_ptr; 22546430Sdanmcd ipsec_stack_t *ipss = ss->spdsock_spds->spds_netstack->netstack_ipsec; 22553448Sdh155122 22563448Sdh155122 mutex_enter(&ipss->ipsec_alg_lock); 22570Sstevel@tonic-gate /* 22580Sstevel@tonic-gate * The SPD client expects to receive separate entries for 22590Sstevel@tonic-gate * AH authentication and ESP authentication supported algorithms. 22600Sstevel@tonic-gate * 22610Sstevel@tonic-gate * Don't return the "any" algorithms, if defined, as no 22620Sstevel@tonic-gate * kernel policies can be set for these algorithms. 22630Sstevel@tonic-gate */ 22643448Sdh155122 algcount = 2 * ipss->ipsec_nalgs[IPSEC_ALG_AUTH] + 22653448Sdh155122 ipss->ipsec_nalgs[IPSEC_ALG_ENCR]; 22663448Sdh155122 22673448Sdh155122 if (ipss->ipsec_alglists[IPSEC_ALG_AUTH][SADB_AALG_NONE] != NULL) 22680Sstevel@tonic-gate algcount--; 22693448Sdh155122 if (ipss->ipsec_alglists[IPSEC_ALG_ENCR][SADB_EALG_NONE] != NULL) 22700Sstevel@tonic-gate algcount--; 22710Sstevel@tonic-gate 22720Sstevel@tonic-gate /* 22730Sstevel@tonic-gate * For each algorithm, we encode: 22740Sstevel@tonic-gate * ALG / MINBITS / MAXBITS / DEFBITS / INCRBITS / {END, NEXT} 22750Sstevel@tonic-gate */ 22760Sstevel@tonic-gate 22770Sstevel@tonic-gate size = sizeof (spd_msg_t) + sizeof (struct spd_ext_actions) + 22780Sstevel@tonic-gate ATTRPERALG * sizeof (struct spd_attribute) * algcount; 22790Sstevel@tonic-gate 22800Sstevel@tonic-gate ASSERT(ALIGNED64(size)); 22810Sstevel@tonic-gate 22820Sstevel@tonic-gate m = allocb(size, BPRI_HI); 22830Sstevel@tonic-gate if (m == NULL) { 22843448Sdh155122 mutex_exit(&ipss->ipsec_alg_lock); 22850Sstevel@tonic-gate spdsock_error(q, mp, ENOMEM, 0); 22860Sstevel@tonic-gate return; 22870Sstevel@tonic-gate } 22880Sstevel@tonic-gate 22890Sstevel@tonic-gate m->b_wptr = m->b_rptr + size; 22900Sstevel@tonic-gate cur = m->b_rptr; 22910Sstevel@tonic-gate 22920Sstevel@tonic-gate msg = (spd_msg_t *)cur; 22930Sstevel@tonic-gate bcopy(mp->b_rptr, cur, sizeof (*msg)); 22940Sstevel@tonic-gate 22950Sstevel@tonic-gate msg->spd_msg_len = SPD_8TO64(size); 22960Sstevel@tonic-gate msg->spd_msg_errno = 0; 22970Sstevel@tonic-gate msg->spd_msg_diagnostic = 0; 22980Sstevel@tonic-gate 22990Sstevel@tonic-gate cur += sizeof (*msg); 23000Sstevel@tonic-gate 23010Sstevel@tonic-gate act = (struct spd_ext_actions *)cur; 23020Sstevel@tonic-gate cur += sizeof (*act); 23030Sstevel@tonic-gate 23040Sstevel@tonic-gate act->spd_actions_len = SPD_8TO64(size - sizeof (spd_msg_t)); 23050Sstevel@tonic-gate act->spd_actions_exttype = SPD_EXT_ACTION; 23060Sstevel@tonic-gate act->spd_actions_count = algcount; 23070Sstevel@tonic-gate act->spd_actions_reserved = 0; 23080Sstevel@tonic-gate 23090Sstevel@tonic-gate attr = (struct spd_attribute *)cur; 23100Sstevel@tonic-gate 23110Sstevel@tonic-gate #define EMIT(tag, value) { \ 23120Sstevel@tonic-gate attr->spd_attr_tag = (tag); \ 23130Sstevel@tonic-gate attr->spd_attr_value = (value); \ 23140Sstevel@tonic-gate attr++; \ 23150Sstevel@tonic-gate } 23160Sstevel@tonic-gate 23170Sstevel@tonic-gate /* 23180Sstevel@tonic-gate * If you change the number of EMIT's here, change 23190Sstevel@tonic-gate * ATTRPERALG above to match 23200Sstevel@tonic-gate */ 23210Sstevel@tonic-gate #define EMITALGATTRS(_type) { \ 23220Sstevel@tonic-gate EMIT(algattr[_type], algid); /* 1 */ \ 23230Sstevel@tonic-gate EMIT(minbitsattr[_type], minbits); /* 2 */ \ 23240Sstevel@tonic-gate EMIT(maxbitsattr[_type], maxbits); /* 3 */ \ 23250Sstevel@tonic-gate EMIT(defbitsattr[_type], defbits); /* 4 */ \ 23260Sstevel@tonic-gate EMIT(incrbitsattr[_type], incr); /* 5 */ \ 23270Sstevel@tonic-gate EMIT(SPD_ATTR_NEXT, 0); /* 6 */ \ 23280Sstevel@tonic-gate } 23290Sstevel@tonic-gate 23300Sstevel@tonic-gate for (algtype = 0; algtype < IPSEC_NALGTYPES; algtype++) { 23313448Sdh155122 for (algidx = 0; algidx < ipss->ipsec_nalgs[algtype]; 23323448Sdh155122 algidx++) { 23333448Sdh155122 int algid = ipss->ipsec_sortlist[algtype][algidx]; 23343448Sdh155122 ipsec_alginfo_t *alg = 23353448Sdh155122 ipss->ipsec_alglists[algtype][algid]; 23360Sstevel@tonic-gate uint_t minbits = alg->alg_minbits; 23370Sstevel@tonic-gate uint_t maxbits = alg->alg_maxbits; 23380Sstevel@tonic-gate uint_t defbits = alg->alg_default_bits; 23390Sstevel@tonic-gate uint_t incr = alg->alg_increment; 23400Sstevel@tonic-gate 23410Sstevel@tonic-gate if (algtype == IPSEC_ALG_AUTH) { 23420Sstevel@tonic-gate if (algid == SADB_AALG_NONE) 23430Sstevel@tonic-gate continue; 23440Sstevel@tonic-gate EMITALGATTRS(SPDSOCK_AH_AUTH); 23450Sstevel@tonic-gate EMITALGATTRS(SPDSOCK_ESP_AUTH); 23460Sstevel@tonic-gate } else { 23470Sstevel@tonic-gate if (algid == SADB_EALG_NONE) 23480Sstevel@tonic-gate continue; 23490Sstevel@tonic-gate ASSERT(algtype == IPSEC_ALG_ENCR); 23500Sstevel@tonic-gate EMITALGATTRS(SPDSOCK_ESP_ENCR); 23510Sstevel@tonic-gate } 23520Sstevel@tonic-gate } 23530Sstevel@tonic-gate } 23540Sstevel@tonic-gate 23553448Sdh155122 mutex_exit(&ipss->ipsec_alg_lock); 23560Sstevel@tonic-gate 23570Sstevel@tonic-gate #undef EMITALGATTRS 23580Sstevel@tonic-gate #undef EMIT 23590Sstevel@tonic-gate #undef ATTRPERALG 23600Sstevel@tonic-gate 23610Sstevel@tonic-gate attr--; 23620Sstevel@tonic-gate attr->spd_attr_tag = SPD_ATTR_END; 23630Sstevel@tonic-gate 23640Sstevel@tonic-gate freemsg(mp); 23650Sstevel@tonic-gate qreply(q, m); 23660Sstevel@tonic-gate } 23670Sstevel@tonic-gate 23680Sstevel@tonic-gate /* 23690Sstevel@tonic-gate * Process a SPD_DUMPALGS request. 23700Sstevel@tonic-gate */ 23710Sstevel@tonic-gate 237210824SMark.Fenwick@Sun.COM #define ATTRPERALG 9 /* fixed attributes per algs */ 23730Sstevel@tonic-gate 23740Sstevel@tonic-gate void 23750Sstevel@tonic-gate spdsock_dumpalgs(queue_t *q, mblk_t *mp) 23760Sstevel@tonic-gate { 23770Sstevel@tonic-gate uint_t algtype; 23780Sstevel@tonic-gate uint_t algidx; 23790Sstevel@tonic-gate uint_t size; 23800Sstevel@tonic-gate mblk_t *m; 23810Sstevel@tonic-gate uint8_t *cur; 23820Sstevel@tonic-gate spd_msg_t *msg; 23830Sstevel@tonic-gate struct spd_ext_actions *act; 23840Sstevel@tonic-gate struct spd_attribute *attr; 23850Sstevel@tonic-gate ipsec_alginfo_t *alg; 23860Sstevel@tonic-gate uint_t algid; 23870Sstevel@tonic-gate uint_t i; 23880Sstevel@tonic-gate uint_t alg_size; 23893448Sdh155122 spdsock_t *ss = (spdsock_t *)q->q_ptr; 23906430Sdanmcd ipsec_stack_t *ipss = ss->spdsock_spds->spds_netstack->netstack_ipsec; 23913448Sdh155122 23923448Sdh155122 mutex_enter(&ipss->ipsec_alg_lock); 23930Sstevel@tonic-gate 23940Sstevel@tonic-gate /* 23950Sstevel@tonic-gate * For each algorithm, we encode: 23960Sstevel@tonic-gate * ALG / MINBITS / MAXBITS / DEFBITS / INCRBITS / {END, NEXT} 23970Sstevel@tonic-gate * 23980Sstevel@tonic-gate * ALG_ID / ALG_PROTO / ALG_INCRBITS / ALG_NKEYSIZES / ALG_KEYSIZE* 239910824SMark.Fenwick@Sun.COM * ALG_NBLOCKSIZES / ALG_BLOCKSIZE* / ALG_NPARAMS / ALG_PARAMS* / 240010824SMark.Fenwick@Sun.COM * ALG_MECHNAME / ALG_FLAGS / {END, NEXT} 24010Sstevel@tonic-gate */ 24020Sstevel@tonic-gate 24030Sstevel@tonic-gate /* 24040Sstevel@tonic-gate * Compute the size of the SPD message. 24050Sstevel@tonic-gate */ 24060Sstevel@tonic-gate size = sizeof (spd_msg_t) + sizeof (struct spd_ext_actions); 24070Sstevel@tonic-gate 24080Sstevel@tonic-gate for (algtype = 0; algtype < IPSEC_NALGTYPES; algtype++) { 24093448Sdh155122 for (algidx = 0; algidx < ipss->ipsec_nalgs[algtype]; 24103448Sdh155122 algidx++) { 24113448Sdh155122 algid = ipss->ipsec_sortlist[algtype][algidx]; 24123448Sdh155122 alg = ipss->ipsec_alglists[algtype][algid]; 24130Sstevel@tonic-gate alg_size = sizeof (struct spd_attribute) * 24140Sstevel@tonic-gate (ATTRPERALG + alg->alg_nkey_sizes + 241510824SMark.Fenwick@Sun.COM alg->alg_nblock_sizes + alg->alg_nparams) + 241610824SMark.Fenwick@Sun.COM CRYPTO_MAX_MECH_NAME; 24170Sstevel@tonic-gate size += alg_size; 24180Sstevel@tonic-gate } 24190Sstevel@tonic-gate } 24200Sstevel@tonic-gate 24210Sstevel@tonic-gate ASSERT(ALIGNED64(size)); 24220Sstevel@tonic-gate 24230Sstevel@tonic-gate m = allocb(size, BPRI_HI); 24240Sstevel@tonic-gate if (m == NULL) { 24253448Sdh155122 mutex_exit(&ipss->ipsec_alg_lock); 24260Sstevel@tonic-gate spdsock_error(q, mp, ENOMEM, 0); 24270Sstevel@tonic-gate return; 24280Sstevel@tonic-gate } 24290Sstevel@tonic-gate 24300Sstevel@tonic-gate m->b_wptr = m->b_rptr + size; 24310Sstevel@tonic-gate cur = m->b_rptr; 24320Sstevel@tonic-gate 24330Sstevel@tonic-gate msg = (spd_msg_t *)cur; 24340Sstevel@tonic-gate bcopy(mp->b_rptr, cur, sizeof (*msg)); 24350Sstevel@tonic-gate 24360Sstevel@tonic-gate msg->spd_msg_len = SPD_8TO64(size); 24370Sstevel@tonic-gate msg->spd_msg_errno = 0; 243810019SMark.Fenwick@Sun.COM msg->spd_msg_type = SPD_ALGLIST; 243910019SMark.Fenwick@Sun.COM 24400Sstevel@tonic-gate msg->spd_msg_diagnostic = 0; 24410Sstevel@tonic-gate 24420Sstevel@tonic-gate cur += sizeof (*msg); 24430Sstevel@tonic-gate 24440Sstevel@tonic-gate act = (struct spd_ext_actions *)cur; 24450Sstevel@tonic-gate cur += sizeof (*act); 24460Sstevel@tonic-gate 24470Sstevel@tonic-gate act->spd_actions_len = SPD_8TO64(size - sizeof (spd_msg_t)); 24480Sstevel@tonic-gate act->spd_actions_exttype = SPD_EXT_ACTION; 24493448Sdh155122 act->spd_actions_count = ipss->ipsec_nalgs[IPSEC_ALG_AUTH] + 24503448Sdh155122 ipss->ipsec_nalgs[IPSEC_ALG_ENCR]; 24510Sstevel@tonic-gate act->spd_actions_reserved = 0; 24520Sstevel@tonic-gate 245310019SMark.Fenwick@Sun.COM /* 245410019SMark.Fenwick@Sun.COM * If there aren't any algorithms registered, return an empty message. 245510019SMark.Fenwick@Sun.COM * spdsock_get_ext() knows how to deal with this. 245610019SMark.Fenwick@Sun.COM */ 245710019SMark.Fenwick@Sun.COM if (act->spd_actions_count == 0) { 245810019SMark.Fenwick@Sun.COM act->spd_actions_len = 0; 245910019SMark.Fenwick@Sun.COM mutex_exit(&ipss->ipsec_alg_lock); 246010019SMark.Fenwick@Sun.COM goto error; 246110019SMark.Fenwick@Sun.COM } 246210019SMark.Fenwick@Sun.COM 24630Sstevel@tonic-gate attr = (struct spd_attribute *)cur; 24640Sstevel@tonic-gate 24650Sstevel@tonic-gate #define EMIT(tag, value) { \ 24660Sstevel@tonic-gate attr->spd_attr_tag = (tag); \ 24670Sstevel@tonic-gate attr->spd_attr_value = (value); \ 24680Sstevel@tonic-gate attr++; \ 24690Sstevel@tonic-gate } 24700Sstevel@tonic-gate 24710Sstevel@tonic-gate for (algtype = 0; algtype < IPSEC_NALGTYPES; algtype++) { 24723448Sdh155122 for (algidx = 0; algidx < ipss->ipsec_nalgs[algtype]; 24733448Sdh155122 algidx++) { 24743448Sdh155122 24753448Sdh155122 algid = ipss->ipsec_sortlist[algtype][algidx]; 24763448Sdh155122 alg = ipss->ipsec_alglists[algtype][algid]; 24770Sstevel@tonic-gate 24780Sstevel@tonic-gate /* 24790Sstevel@tonic-gate * If you change the number of EMIT's here, change 24800Sstevel@tonic-gate * ATTRPERALG above to match 24810Sstevel@tonic-gate */ 24820Sstevel@tonic-gate EMIT(SPD_ATTR_ALG_ID, algid); 24830Sstevel@tonic-gate EMIT(SPD_ATTR_ALG_PROTO, algproto[algtype]); 24840Sstevel@tonic-gate EMIT(SPD_ATTR_ALG_INCRBITS, alg->alg_increment); 24850Sstevel@tonic-gate EMIT(SPD_ATTR_ALG_NKEYSIZES, alg->alg_nkey_sizes); 24860Sstevel@tonic-gate for (i = 0; i < alg->alg_nkey_sizes; i++) 24870Sstevel@tonic-gate EMIT(SPD_ATTR_ALG_KEYSIZE, 24880Sstevel@tonic-gate alg->alg_key_sizes[i]); 24890Sstevel@tonic-gate 24900Sstevel@tonic-gate EMIT(SPD_ATTR_ALG_NBLOCKSIZES, alg->alg_nblock_sizes); 24910Sstevel@tonic-gate for (i = 0; i < alg->alg_nblock_sizes; i++) 24920Sstevel@tonic-gate EMIT(SPD_ATTR_ALG_BLOCKSIZE, 24930Sstevel@tonic-gate alg->alg_block_sizes[i]); 24940Sstevel@tonic-gate 249510824SMark.Fenwick@Sun.COM EMIT(SPD_ATTR_ALG_NPARAMS, alg->alg_nparams); 249610824SMark.Fenwick@Sun.COM for (i = 0; i < alg->alg_nparams; i++) 249710824SMark.Fenwick@Sun.COM EMIT(SPD_ATTR_ALG_PARAMS, 249810824SMark.Fenwick@Sun.COM alg->alg_params[i]); 249910824SMark.Fenwick@Sun.COM 250010824SMark.Fenwick@Sun.COM EMIT(SPD_ATTR_ALG_FLAGS, alg->alg_flags); 250110824SMark.Fenwick@Sun.COM 25020Sstevel@tonic-gate EMIT(SPD_ATTR_ALG_MECHNAME, CRYPTO_MAX_MECH_NAME); 25030Sstevel@tonic-gate bcopy(alg->alg_mech_name, attr, CRYPTO_MAX_MECH_NAME); 25040Sstevel@tonic-gate attr = (struct spd_attribute *)((char *)attr + 25050Sstevel@tonic-gate CRYPTO_MAX_MECH_NAME); 25060Sstevel@tonic-gate 25070Sstevel@tonic-gate EMIT(SPD_ATTR_NEXT, 0); 25080Sstevel@tonic-gate } 25090Sstevel@tonic-gate } 25100Sstevel@tonic-gate 25113448Sdh155122 mutex_exit(&ipss->ipsec_alg_lock); 25120Sstevel@tonic-gate 25130Sstevel@tonic-gate #undef EMITALGATTRS 25140Sstevel@tonic-gate #undef EMIT 25150Sstevel@tonic-gate #undef ATTRPERALG 25160Sstevel@tonic-gate 25170Sstevel@tonic-gate attr--; 25180Sstevel@tonic-gate attr->spd_attr_tag = SPD_ATTR_END; 25190Sstevel@tonic-gate 252010019SMark.Fenwick@Sun.COM error: 25210Sstevel@tonic-gate freemsg(mp); 25220Sstevel@tonic-gate qreply(q, m); 25230Sstevel@tonic-gate } 25240Sstevel@tonic-gate 25250Sstevel@tonic-gate /* 25260Sstevel@tonic-gate * Do the actual work of processing an SPD_UPDATEALGS request. Can 25270Sstevel@tonic-gate * be invoked either once IPsec is loaded on a cached request, or 25280Sstevel@tonic-gate * when a request is received while IPsec is loaded. 25290Sstevel@tonic-gate */ 253011042SErik.Nordmark@Sun.COM static int 253111042SErik.Nordmark@Sun.COM spdsock_do_updatealg(spd_ext_t *extv[], spd_stack_t *spds) 25320Sstevel@tonic-gate { 25330Sstevel@tonic-gate struct spd_ext_actions *actp; 25340Sstevel@tonic-gate struct spd_attribute *attr, *endattr; 25350Sstevel@tonic-gate uint64_t *start, *end; 25360Sstevel@tonic-gate ipsec_alginfo_t *alg = NULL; 25370Sstevel@tonic-gate ipsec_algtype_t alg_type = 0; 25380Sstevel@tonic-gate boolean_t skip_alg = B_TRUE, doing_proto = B_FALSE; 25390Sstevel@tonic-gate uint_t i, cur_key, cur_block, algid; 254011042SErik.Nordmark@Sun.COM int diag = -1; 254111042SErik.Nordmark@Sun.COM 25423448Sdh155122 ASSERT(MUTEX_HELD(&spds->spds_alg_lock)); 25430Sstevel@tonic-gate 25440Sstevel@tonic-gate /* parse the message, building the list of algorithms */ 25450Sstevel@tonic-gate 25460Sstevel@tonic-gate actp = (struct spd_ext_actions *)extv[SPD_EXT_ACTION]; 254711042SErik.Nordmark@Sun.COM if (actp == NULL) 254811042SErik.Nordmark@Sun.COM return (SPD_DIAGNOSTIC_NO_ACTION_EXT); 25490Sstevel@tonic-gate 25500Sstevel@tonic-gate start = (uint64_t *)actp; 25510Sstevel@tonic-gate end = (start + actp->spd_actions_len); 25520Sstevel@tonic-gate endattr = (struct spd_attribute *)end; 25530Sstevel@tonic-gate attr = (struct spd_attribute *)&actp[1]; 25540Sstevel@tonic-gate 25553448Sdh155122 bzero(spds->spds_algs, IPSEC_NALGTYPES * IPSEC_MAX_ALGS * 25560Sstevel@tonic-gate sizeof (ipsec_alginfo_t *)); 25570Sstevel@tonic-gate 25580Sstevel@tonic-gate alg = kmem_zalloc(sizeof (*alg), KM_SLEEP); 25590Sstevel@tonic-gate 25600Sstevel@tonic-gate #define ALG_KEY_SIZES(a) (((a)->alg_nkey_sizes + 1) * sizeof (uint16_t)) 25610Sstevel@tonic-gate #define ALG_BLOCK_SIZES(a) (((a)->alg_nblock_sizes + 1) * sizeof (uint16_t)) 256211136SMark.Fenwick@Sun.COM #define ALG_PARAM_SIZES(a) (((a)->alg_nparams + 1) * sizeof (uint16_t)) 25630Sstevel@tonic-gate 25640Sstevel@tonic-gate while (attr < endattr) { 25650Sstevel@tonic-gate switch (attr->spd_attr_tag) { 25660Sstevel@tonic-gate case SPD_ATTR_NOP: 25670Sstevel@tonic-gate case SPD_ATTR_EMPTY: 25680Sstevel@tonic-gate break; 25690Sstevel@tonic-gate case SPD_ATTR_END: 25700Sstevel@tonic-gate attr = endattr; 25710Sstevel@tonic-gate /* FALLTHRU */ 25720Sstevel@tonic-gate case SPD_ATTR_NEXT: 25730Sstevel@tonic-gate if (doing_proto) { 25740Sstevel@tonic-gate doing_proto = B_FALSE; 25750Sstevel@tonic-gate break; 25760Sstevel@tonic-gate } 25770Sstevel@tonic-gate if (skip_alg) { 25780Sstevel@tonic-gate ipsec_alg_free(alg); 25790Sstevel@tonic-gate } else { 25800Sstevel@tonic-gate ipsec_alg_free( 25813448Sdh155122 spds->spds_algs[alg_type][alg->alg_id]); 25823448Sdh155122 spds->spds_algs[alg_type][alg->alg_id] = 25833448Sdh155122 alg; 25840Sstevel@tonic-gate } 25850Sstevel@tonic-gate alg = kmem_zalloc(sizeof (*alg), KM_SLEEP); 25860Sstevel@tonic-gate break; 25870Sstevel@tonic-gate 25880Sstevel@tonic-gate case SPD_ATTR_ALG_ID: 25890Sstevel@tonic-gate if (attr->spd_attr_value >= IPSEC_MAX_ALGS) { 25903448Sdh155122 ss1dbg(spds, ("spdsock_do_updatealg: " 25910Sstevel@tonic-gate "invalid alg id %d\n", 25920Sstevel@tonic-gate attr->spd_attr_value)); 259311042SErik.Nordmark@Sun.COM diag = SPD_DIAGNOSTIC_ALG_ID_RANGE; 25940Sstevel@tonic-gate goto bail; 25950Sstevel@tonic-gate } 25960Sstevel@tonic-gate alg->alg_id = attr->spd_attr_value; 25970Sstevel@tonic-gate break; 25980Sstevel@tonic-gate 25990Sstevel@tonic-gate case SPD_ATTR_ALG_PROTO: 26000Sstevel@tonic-gate /* find the alg type */ 26010Sstevel@tonic-gate for (i = 0; i < NALGPROTOS; i++) 26020Sstevel@tonic-gate if (algproto[i] == attr->spd_attr_value) 26030Sstevel@tonic-gate break; 26040Sstevel@tonic-gate skip_alg = (i == NALGPROTOS); 26050Sstevel@tonic-gate if (!skip_alg) 26060Sstevel@tonic-gate alg_type = i; 26070Sstevel@tonic-gate break; 26080Sstevel@tonic-gate 26090Sstevel@tonic-gate case SPD_ATTR_ALG_INCRBITS: 26100Sstevel@tonic-gate alg->alg_increment = attr->spd_attr_value; 26110Sstevel@tonic-gate break; 26120Sstevel@tonic-gate 26130Sstevel@tonic-gate case SPD_ATTR_ALG_NKEYSIZES: 26140Sstevel@tonic-gate if (alg->alg_key_sizes != NULL) { 26150Sstevel@tonic-gate kmem_free(alg->alg_key_sizes, 26160Sstevel@tonic-gate ALG_KEY_SIZES(alg)); 26170Sstevel@tonic-gate } 26180Sstevel@tonic-gate alg->alg_nkey_sizes = attr->spd_attr_value; 26190Sstevel@tonic-gate /* 26200Sstevel@tonic-gate * Allocate room for the trailing zero key size 26210Sstevel@tonic-gate * value as well. 26220Sstevel@tonic-gate */ 26230Sstevel@tonic-gate alg->alg_key_sizes = kmem_zalloc(ALG_KEY_SIZES(alg), 26240Sstevel@tonic-gate KM_SLEEP); 26250Sstevel@tonic-gate cur_key = 0; 26260Sstevel@tonic-gate break; 26270Sstevel@tonic-gate 26280Sstevel@tonic-gate case SPD_ATTR_ALG_KEYSIZE: 26290Sstevel@tonic-gate if (alg->alg_key_sizes == NULL || 26300Sstevel@tonic-gate cur_key >= alg->alg_nkey_sizes) { 26313448Sdh155122 ss1dbg(spds, ("spdsock_do_updatealg: " 26325240Snordmark "too many key sizes\n")); 263311042SErik.Nordmark@Sun.COM diag = SPD_DIAGNOSTIC_ALG_NUM_KEY_SIZES; 26340Sstevel@tonic-gate goto bail; 26350Sstevel@tonic-gate } 26360Sstevel@tonic-gate alg->alg_key_sizes[cur_key++] = attr->spd_attr_value; 26370Sstevel@tonic-gate break; 26380Sstevel@tonic-gate 263910824SMark.Fenwick@Sun.COM case SPD_ATTR_ALG_FLAGS: 264010824SMark.Fenwick@Sun.COM /* 264110824SMark.Fenwick@Sun.COM * Flags (bit mask). The alg_flags element of 264210824SMark.Fenwick@Sun.COM * ipsecalg_flags_t is only 8 bits wide. The 264310824SMark.Fenwick@Sun.COM * user can set the VALID bit, but we will ignore it 264410824SMark.Fenwick@Sun.COM * and make the decision is the algorithm is valid. 264510824SMark.Fenwick@Sun.COM */ 264610824SMark.Fenwick@Sun.COM alg->alg_flags |= (uint8_t)attr->spd_attr_value; 264710824SMark.Fenwick@Sun.COM break; 264810824SMark.Fenwick@Sun.COM 26490Sstevel@tonic-gate case SPD_ATTR_ALG_NBLOCKSIZES: 26500Sstevel@tonic-gate if (alg->alg_block_sizes != NULL) { 26510Sstevel@tonic-gate kmem_free(alg->alg_block_sizes, 26520Sstevel@tonic-gate ALG_BLOCK_SIZES(alg)); 26530Sstevel@tonic-gate } 26540Sstevel@tonic-gate alg->alg_nblock_sizes = attr->spd_attr_value; 26550Sstevel@tonic-gate /* 26560Sstevel@tonic-gate * Allocate room for the trailing zero block size 26570Sstevel@tonic-gate * value as well. 26580Sstevel@tonic-gate */ 26590Sstevel@tonic-gate alg->alg_block_sizes = kmem_zalloc(ALG_BLOCK_SIZES(alg), 26600Sstevel@tonic-gate KM_SLEEP); 26610Sstevel@tonic-gate cur_block = 0; 26620Sstevel@tonic-gate break; 26630Sstevel@tonic-gate 26640Sstevel@tonic-gate case SPD_ATTR_ALG_BLOCKSIZE: 26650Sstevel@tonic-gate if (alg->alg_block_sizes == NULL || 26660Sstevel@tonic-gate cur_block >= alg->alg_nblock_sizes) { 26673448Sdh155122 ss1dbg(spds, ("spdsock_do_updatealg: " 26685240Snordmark "too many block sizes\n")); 266911042SErik.Nordmark@Sun.COM diag = SPD_DIAGNOSTIC_ALG_NUM_BLOCK_SIZES; 26700Sstevel@tonic-gate goto bail; 26710Sstevel@tonic-gate } 26720Sstevel@tonic-gate alg->alg_block_sizes[cur_block++] = 26730Sstevel@tonic-gate attr->spd_attr_value; 26740Sstevel@tonic-gate break; 26750Sstevel@tonic-gate 267610824SMark.Fenwick@Sun.COM case SPD_ATTR_ALG_NPARAMS: 267710824SMark.Fenwick@Sun.COM if (alg->alg_params != NULL) { 267810824SMark.Fenwick@Sun.COM kmem_free(alg->alg_params, 267911136SMark.Fenwick@Sun.COM ALG_PARAM_SIZES(alg)); 268010824SMark.Fenwick@Sun.COM } 268110824SMark.Fenwick@Sun.COM alg->alg_nparams = attr->spd_attr_value; 268210824SMark.Fenwick@Sun.COM /* 268310824SMark.Fenwick@Sun.COM * Allocate room for the trailing zero block size 268410824SMark.Fenwick@Sun.COM * value as well. 268510824SMark.Fenwick@Sun.COM */ 268611136SMark.Fenwick@Sun.COM alg->alg_params = kmem_zalloc(ALG_PARAM_SIZES(alg), 268710824SMark.Fenwick@Sun.COM KM_SLEEP); 268810824SMark.Fenwick@Sun.COM cur_block = 0; 268910824SMark.Fenwick@Sun.COM break; 269010824SMark.Fenwick@Sun.COM 269110824SMark.Fenwick@Sun.COM case SPD_ATTR_ALG_PARAMS: 269210824SMark.Fenwick@Sun.COM if (alg->alg_params == NULL || 269310824SMark.Fenwick@Sun.COM cur_block >= alg->alg_nparams) { 269410824SMark.Fenwick@Sun.COM ss1dbg(spds, ("spdsock_do_updatealg: " 269510824SMark.Fenwick@Sun.COM "too many params\n")); 269611042SErik.Nordmark@Sun.COM diag = SPD_DIAGNOSTIC_ALG_NUM_BLOCK_SIZES; 269710824SMark.Fenwick@Sun.COM goto bail; 269810824SMark.Fenwick@Sun.COM } 269910824SMark.Fenwick@Sun.COM /* 270010824SMark.Fenwick@Sun.COM * Array contains: iv_len, icv_len, salt_len 270110824SMark.Fenwick@Sun.COM * Any additional parameters are currently ignored. 270210824SMark.Fenwick@Sun.COM */ 270310824SMark.Fenwick@Sun.COM alg->alg_params[cur_block++] = 270410824SMark.Fenwick@Sun.COM attr->spd_attr_value; 270510824SMark.Fenwick@Sun.COM break; 270610824SMark.Fenwick@Sun.COM 27070Sstevel@tonic-gate case SPD_ATTR_ALG_MECHNAME: { 27080Sstevel@tonic-gate char *mech_name; 27090Sstevel@tonic-gate 27100Sstevel@tonic-gate if (attr->spd_attr_value > CRYPTO_MAX_MECH_NAME) { 27113448Sdh155122 ss1dbg(spds, ("spdsock_do_updatealg: " 27125240Snordmark "mech name too long\n")); 271311042SErik.Nordmark@Sun.COM diag = SPD_DIAGNOSTIC_ALG_MECH_NAME_LEN; 27140Sstevel@tonic-gate goto bail; 27150Sstevel@tonic-gate } 27160Sstevel@tonic-gate mech_name = (char *)(attr + 1); 27170Sstevel@tonic-gate bcopy(mech_name, alg->alg_mech_name, 27180Sstevel@tonic-gate attr->spd_attr_value); 27190Sstevel@tonic-gate alg->alg_mech_name[CRYPTO_MAX_MECH_NAME-1] = '\0'; 27200Sstevel@tonic-gate attr = (struct spd_attribute *)((char *)attr + 27210Sstevel@tonic-gate attr->spd_attr_value); 27220Sstevel@tonic-gate break; 27230Sstevel@tonic-gate } 27240Sstevel@tonic-gate 27250Sstevel@tonic-gate case SPD_ATTR_PROTO_ID: 27260Sstevel@tonic-gate doing_proto = B_TRUE; 27270Sstevel@tonic-gate for (i = 0; i < NALGPROTOS; i++) { 27280Sstevel@tonic-gate if (algproto[i] == attr->spd_attr_value) { 27290Sstevel@tonic-gate alg_type = i; 27300Sstevel@tonic-gate break; 27310Sstevel@tonic-gate } 27320Sstevel@tonic-gate } 27330Sstevel@tonic-gate break; 27340Sstevel@tonic-gate 27350Sstevel@tonic-gate case SPD_ATTR_PROTO_EXEC_MODE: 27360Sstevel@tonic-gate if (!doing_proto) 27370Sstevel@tonic-gate break; 27380Sstevel@tonic-gate for (i = 0; i < NEXECMODES; i++) { 27390Sstevel@tonic-gate if (execmodes[i] == attr->spd_attr_value) { 27403448Sdh155122 spds->spds_algs_exec_mode[alg_type] = i; 27410Sstevel@tonic-gate break; 27420Sstevel@tonic-gate } 27430Sstevel@tonic-gate } 27440Sstevel@tonic-gate break; 27450Sstevel@tonic-gate } 27460Sstevel@tonic-gate attr++; 27470Sstevel@tonic-gate } 27480Sstevel@tonic-gate 27490Sstevel@tonic-gate #undef ALG_KEY_SIZES 27500Sstevel@tonic-gate #undef ALG_BLOCK_SIZES 275111136SMark.Fenwick@Sun.COM #undef ALG_PARAM_SIZES 27520Sstevel@tonic-gate 27530Sstevel@tonic-gate /* update the algorithm tables */ 27543448Sdh155122 spdsock_merge_algs(spds); 27550Sstevel@tonic-gate bail: 27560Sstevel@tonic-gate /* cleanup */ 27570Sstevel@tonic-gate ipsec_alg_free(alg); 27580Sstevel@tonic-gate for (alg_type = 0; alg_type < IPSEC_NALGTYPES; alg_type++) 27595240Snordmark for (algid = 0; algid < IPSEC_MAX_ALGS; algid++) 27603448Sdh155122 if (spds->spds_algs[alg_type][algid] != NULL) 27615240Snordmark ipsec_alg_free(spds->spds_algs[alg_type][algid]); 276211042SErik.Nordmark@Sun.COM return (diag); 27630Sstevel@tonic-gate } 27640Sstevel@tonic-gate 27650Sstevel@tonic-gate /* 27660Sstevel@tonic-gate * Process an SPD_UPDATEALGS request. If IPsec is not loaded, queue 27670Sstevel@tonic-gate * the request until IPsec loads. If IPsec is loaded, act on it 27680Sstevel@tonic-gate * immediately. 27690Sstevel@tonic-gate */ 27700Sstevel@tonic-gate 27710Sstevel@tonic-gate static void 27720Sstevel@tonic-gate spdsock_updatealg(queue_t *q, mblk_t *mp, spd_ext_t *extv[]) 27730Sstevel@tonic-gate { 27743448Sdh155122 spdsock_t *ss = (spdsock_t *)q->q_ptr; 27753448Sdh155122 spd_stack_t *spds = ss->spdsock_spds; 27763448Sdh155122 ipsec_stack_t *ipss = spds->spds_netstack->netstack_ipsec; 2777*11861SMarek.Pospisil@Sun.COM uint32_t auditing = AU_AUDITING(); 27783448Sdh155122 27793448Sdh155122 if (!ipsec_loaded(ipss)) { 27800Sstevel@tonic-gate /* 27810Sstevel@tonic-gate * IPsec is not loaded, save request and return nicely, 27820Sstevel@tonic-gate * the message will be processed once IPsec loads. 27830Sstevel@tonic-gate */ 27840Sstevel@tonic-gate mblk_t *new_mp; 27850Sstevel@tonic-gate 27860Sstevel@tonic-gate /* last update message wins */ 27870Sstevel@tonic-gate if ((new_mp = copymsg(mp)) == NULL) { 27880Sstevel@tonic-gate spdsock_error(q, mp, ENOMEM, 0); 27890Sstevel@tonic-gate return; 27900Sstevel@tonic-gate } 27913448Sdh155122 mutex_enter(&spds->spds_alg_lock); 27923448Sdh155122 bcopy(extv, spds->spds_extv_algs, 27930Sstevel@tonic-gate sizeof (spd_ext_t *) * (SPD_EXT_MAX + 1)); 27943448Sdh155122 if (spds->spds_mp_algs != NULL) 27953448Sdh155122 freemsg(spds->spds_mp_algs); 27963448Sdh155122 spds->spds_mp_algs = mp; 27973448Sdh155122 spds->spds_algs_pending = B_TRUE; 27983448Sdh155122 mutex_exit(&spds->spds_alg_lock); 2799*11861SMarek.Pospisil@Sun.COM if (auditing) { 28008778SErik.Nordmark@Sun.COM cred_t *cr; 28018778SErik.Nordmark@Sun.COM pid_t cpid; 28028778SErik.Nordmark@Sun.COM 28038778SErik.Nordmark@Sun.COM cr = msg_getcred(mp, &cpid); 28048778SErik.Nordmark@Sun.COM audit_pf_policy(SPD_UPDATEALGS, cr, 28054307Spwernau spds->spds_netstack, NULL, B_TRUE, EAGAIN, 28068778SErik.Nordmark@Sun.COM cpid); 28078778SErik.Nordmark@Sun.COM } 28080Sstevel@tonic-gate spd_echo(q, new_mp); 28090Sstevel@tonic-gate } else { 28100Sstevel@tonic-gate /* 28110Sstevel@tonic-gate * IPsec is loaded, act on the message immediately. 28120Sstevel@tonic-gate */ 28130Sstevel@tonic-gate int diag; 28140Sstevel@tonic-gate 28153448Sdh155122 mutex_enter(&spds->spds_alg_lock); 281611042SErik.Nordmark@Sun.COM diag = spdsock_do_updatealg(extv, spds); 28174307Spwernau if (diag == -1) { 281811042SErik.Nordmark@Sun.COM /* Keep the lock held while we walk the SA tables. */ 281911042SErik.Nordmark@Sun.COM sadb_alg_update(IPSEC_ALG_ALL, 0, 0, 282011042SErik.Nordmark@Sun.COM spds->spds_netstack); 282111042SErik.Nordmark@Sun.COM mutex_exit(&spds->spds_alg_lock); 28220Sstevel@tonic-gate spd_echo(q, mp); 2823*11861SMarek.Pospisil@Sun.COM if (auditing) { 28248778SErik.Nordmark@Sun.COM cred_t *cr; 28258778SErik.Nordmark@Sun.COM pid_t cpid; 28268778SErik.Nordmark@Sun.COM 28278778SErik.Nordmark@Sun.COM cr = msg_getcred(mp, &cpid); 28288778SErik.Nordmark@Sun.COM audit_pf_policy(SPD_UPDATEALGS, cr, 28298778SErik.Nordmark@Sun.COM spds->spds_netstack, NULL, B_TRUE, 0, 28308778SErik.Nordmark@Sun.COM cpid); 28318778SErik.Nordmark@Sun.COM } 28324307Spwernau } else { 283311042SErik.Nordmark@Sun.COM mutex_exit(&spds->spds_alg_lock); 28340Sstevel@tonic-gate spdsock_diag(q, mp, diag); 2835*11861SMarek.Pospisil@Sun.COM if (auditing) { 28368778SErik.Nordmark@Sun.COM cred_t *cr; 28378778SErik.Nordmark@Sun.COM pid_t cpid; 28388778SErik.Nordmark@Sun.COM 28398778SErik.Nordmark@Sun.COM cr = msg_getcred(mp, &cpid); 28408778SErik.Nordmark@Sun.COM audit_pf_policy(SPD_UPDATEALGS, cr, 28418778SErik.Nordmark@Sun.COM spds->spds_netstack, NULL, B_TRUE, diag, 28428778SErik.Nordmark@Sun.COM cpid); 28438778SErik.Nordmark@Sun.COM } 28444307Spwernau } 28450Sstevel@tonic-gate } 28460Sstevel@tonic-gate } 28470Sstevel@tonic-gate 28483055Sdanmcd /* 284911456Sdanmcd@sun.com * Find a tunnel instance (using the name to link ID mapping), and 285011456Sdanmcd@sun.com * update it after an IPsec change. We need to do this always in case 285111456Sdanmcd@sun.com * we add policy AFTER plumbing a tunnel. We also need to do this 285211456Sdanmcd@sun.com * because, as a side-effect, the tunnel's MTU is updated to reflect 285311456Sdanmcd@sun.com * any IPsec overhead in the itp's policy. 285411456Sdanmcd@sun.com */ 285511456Sdanmcd@sun.com static void 285611456Sdanmcd@sun.com update_iptun_policy(ipsec_tun_pol_t *itp) 285711456Sdanmcd@sun.com { 285811456Sdanmcd@sun.com datalink_id_t linkid; 285911456Sdanmcd@sun.com 286011456Sdanmcd@sun.com if (dls_mgmt_get_linkid(itp->itp_name, &linkid) == 0) 286111456Sdanmcd@sun.com iptun_set_policy(linkid, itp); 286211456Sdanmcd@sun.com } 286311456Sdanmcd@sun.com 286411456Sdanmcd@sun.com /* 28653055Sdanmcd * Sort through the mess of polhead options to retrieve an appropriate one. 28663055Sdanmcd * Returns NULL if we send an spdsock error. Returns a valid pointer if we 28673055Sdanmcd * found a valid polhead. Returns ALL_ACTIVE_POLHEADS (aka. -1) or 28683055Sdanmcd * ALL_INACTIVE_POLHEADS (aka. -2) if the operation calls for the operation to 28693055Sdanmcd * act on ALL policy heads. 28703055Sdanmcd */ 28713055Sdanmcd static ipsec_policy_head_t * 28723055Sdanmcd get_appropriate_polhead(queue_t *q, mblk_t *mp, spd_if_t *tunname, int spdid, 28733055Sdanmcd int msgtype, ipsec_tun_pol_t **itpp) 28743055Sdanmcd { 28753055Sdanmcd ipsec_tun_pol_t *itp; 28763055Sdanmcd ipsec_policy_head_t *iph; 28773055Sdanmcd int errno; 28783055Sdanmcd char *tname; 28793055Sdanmcd boolean_t active; 28803055Sdanmcd spdsock_t *ss = (spdsock_t *)q->q_ptr; 28816430Sdanmcd netstack_t *ns = ss->spdsock_spds->spds_netstack; 28823055Sdanmcd uint64_t gen; /* Placeholder */ 28833055Sdanmcd 28843055Sdanmcd active = (spdid == SPD_ACTIVE); 28853055Sdanmcd *itpp = NULL; 28863055Sdanmcd if (!active && spdid != SPD_STANDBY) { 28873055Sdanmcd spdsock_diag(q, mp, SPD_DIAGNOSTIC_BAD_SPDID); 28883055Sdanmcd return (NULL); 28893055Sdanmcd } 28903055Sdanmcd 28913055Sdanmcd if (tunname != NULL) { 28923055Sdanmcd /* Acting on a tunnel's SPD. */ 28933055Sdanmcd tname = (char *)tunname->spd_if_name; 28943055Sdanmcd if (*tname == '\0') { 28953055Sdanmcd /* Handle all-polhead cases here. */ 28963055Sdanmcd if (msgtype != SPD_FLUSH && msgtype != SPD_DUMP) { 28973055Sdanmcd spdsock_diag(q, mp, 28983055Sdanmcd SPD_DIAGNOSTIC_NOT_GLOBAL_OP); 28993055Sdanmcd return (NULL); 29003055Sdanmcd } 29013055Sdanmcd return (active ? ALL_ACTIVE_POLHEADS : 29023055Sdanmcd ALL_INACTIVE_POLHEADS); 29033055Sdanmcd } 29043055Sdanmcd 29056430Sdanmcd itp = get_tunnel_policy(tname, ns); 29063055Sdanmcd if (itp == NULL) { 29073055Sdanmcd if (msgtype != SPD_ADDRULE) { 29083055Sdanmcd /* "Tunnel not found" */ 29093055Sdanmcd spdsock_error(q, mp, ENOENT, 0); 29103055Sdanmcd return (NULL); 29113055Sdanmcd } 29123055Sdanmcd 29133055Sdanmcd errno = 0; 29146430Sdanmcd itp = create_tunnel_policy(tname, &errno, &gen, ns); 29153055Sdanmcd if (itp == NULL) { 29163055Sdanmcd /* 29173055Sdanmcd * Something very bad happened, most likely 29183055Sdanmcd * ENOMEM. Return an indicator. 29193055Sdanmcd */ 29203055Sdanmcd spdsock_error(q, mp, errno, 0); 29213055Sdanmcd return (NULL); 29223055Sdanmcd } 29233055Sdanmcd } 292411456Sdanmcd@sun.com 292511456Sdanmcd@sun.com /* Match up the itp to an iptun instance. */ 292611456Sdanmcd@sun.com update_iptun_policy(itp); 292710616SSebastien.Roy@Sun.COM 29283055Sdanmcd *itpp = itp; 29293055Sdanmcd /* For spdsock dump state, set the polhead's name. */ 29303055Sdanmcd if (msgtype == SPD_DUMP) { 29316430Sdanmcd ITP_REFHOLD(itp); 29326430Sdanmcd ss->spdsock_itp = itp; 29333055Sdanmcd ss->spdsock_dump_tunnel = itp->itp_flags & 29343055Sdanmcd (active ? ITPF_P_TUNNEL : ITPF_I_TUNNEL); 29353055Sdanmcd } 29363055Sdanmcd } else { 29373055Sdanmcd itp = NULL; 29383055Sdanmcd /* For spdsock dump state, indicate it's global policy. */ 29393055Sdanmcd if (msgtype == SPD_DUMP) 29406430Sdanmcd ss->spdsock_itp = NULL; 29413055Sdanmcd } 29423055Sdanmcd 29433055Sdanmcd if (active) 29443448Sdh155122 iph = (itp == NULL) ? ipsec_system_policy(ns) : itp->itp_policy; 29453055Sdanmcd else 29463448Sdh155122 iph = (itp == NULL) ? ipsec_inactive_policy(ns) : 29473055Sdanmcd itp->itp_inactive; 29483055Sdanmcd 29493055Sdanmcd ASSERT(iph != NULL); 29503055Sdanmcd if (itp != NULL) { 29513055Sdanmcd IPPH_REFHOLD(iph); 29523055Sdanmcd } 29533055Sdanmcd 29543055Sdanmcd return (iph); 29553055Sdanmcd } 29563055Sdanmcd 29570Sstevel@tonic-gate static void 29580Sstevel@tonic-gate spdsock_parse(queue_t *q, mblk_t *mp) 29590Sstevel@tonic-gate { 29600Sstevel@tonic-gate spd_msg_t *spmsg; 29610Sstevel@tonic-gate spd_ext_t *extv[SPD_EXT_MAX + 1]; 29620Sstevel@tonic-gate uint_t msgsize; 29630Sstevel@tonic-gate ipsec_policy_head_t *iph; 29643055Sdanmcd ipsec_tun_pol_t *itp; 29653055Sdanmcd spd_if_t *tunname; 29663448Sdh155122 spdsock_t *ss = (spdsock_t *)q->q_ptr; 29673448Sdh155122 spd_stack_t *spds = ss->spdsock_spds; 29683448Sdh155122 netstack_t *ns = spds->spds_netstack; 29693448Sdh155122 ipsec_stack_t *ipss = ns->netstack_ipsec; 29700Sstevel@tonic-gate 29710Sstevel@tonic-gate /* Make sure nothing's below me. */ 29720Sstevel@tonic-gate ASSERT(WR(q)->q_next == NULL); 29730Sstevel@tonic-gate 29740Sstevel@tonic-gate spmsg = (spd_msg_t *)mp->b_rptr; 29750Sstevel@tonic-gate 29760Sstevel@tonic-gate msgsize = SPD_64TO8(spmsg->spd_msg_len); 29770Sstevel@tonic-gate 29780Sstevel@tonic-gate if (msgdsize(mp) != msgsize) { 29790Sstevel@tonic-gate /* 29800Sstevel@tonic-gate * Message len incorrect w.r.t. actual size. Send an error 29810Sstevel@tonic-gate * (EMSGSIZE). It may be necessary to massage things a 29820Sstevel@tonic-gate * bit. For example, if the spd_msg_type is hosed, 29830Sstevel@tonic-gate * I need to set it to SPD_RESERVED to get delivery to 29840Sstevel@tonic-gate * do the right thing. Then again, maybe just letting 29850Sstevel@tonic-gate * the error delivery do the right thing. 29860Sstevel@tonic-gate */ 29873448Sdh155122 ss2dbg(spds, 29883448Sdh155122 ("mblk (%lu) and base (%d) message sizes don't jibe.\n", 29890Sstevel@tonic-gate msgdsize(mp), msgsize)); 29900Sstevel@tonic-gate spdsock_error(q, mp, EMSGSIZE, SPD_DIAGNOSTIC_NONE); 29910Sstevel@tonic-gate return; 29920Sstevel@tonic-gate } 29930Sstevel@tonic-gate 29940Sstevel@tonic-gate if (msgsize > (uint_t)(mp->b_wptr - mp->b_rptr)) { 29950Sstevel@tonic-gate /* Get all message into one mblk. */ 29960Sstevel@tonic-gate if (pullupmsg(mp, -1) == 0) { 29970Sstevel@tonic-gate /* 29980Sstevel@tonic-gate * Something screwy happened. 29990Sstevel@tonic-gate */ 30003448Sdh155122 ss3dbg(spds, ("spdsock_parse: pullupmsg() failed.\n")); 30010Sstevel@tonic-gate return; 30020Sstevel@tonic-gate } else { 30030Sstevel@tonic-gate spmsg = (spd_msg_t *)mp->b_rptr; 30040Sstevel@tonic-gate } 30050Sstevel@tonic-gate } 30060Sstevel@tonic-gate 30070Sstevel@tonic-gate switch (spdsock_get_ext(extv, spmsg, msgsize)) { 30080Sstevel@tonic-gate case KGE_DUP: 30090Sstevel@tonic-gate /* Handle duplicate extension. */ 30103448Sdh155122 ss1dbg(spds, ("Got duplicate extension of type %d.\n", 30110Sstevel@tonic-gate extv[0]->spd_ext_type)); 30120Sstevel@tonic-gate spdsock_diag(q, mp, dup_ext_diag[extv[0]->spd_ext_type]); 30130Sstevel@tonic-gate return; 30140Sstevel@tonic-gate case KGE_UNK: 30150Sstevel@tonic-gate /* Handle unknown extension. */ 30163448Sdh155122 ss1dbg(spds, ("Got unknown extension of type %d.\n", 30170Sstevel@tonic-gate extv[0]->spd_ext_type)); 30180Sstevel@tonic-gate spdsock_diag(q, mp, SPD_DIAGNOSTIC_UNKNOWN_EXT); 30190Sstevel@tonic-gate return; 30200Sstevel@tonic-gate case KGE_LEN: 30210Sstevel@tonic-gate /* Length error. */ 30223448Sdh155122 ss1dbg(spds, ("Length %d on extension type %d overrun or 0.\n", 30230Sstevel@tonic-gate extv[0]->spd_ext_len, extv[0]->spd_ext_type)); 30240Sstevel@tonic-gate spdsock_diag(q, mp, SPD_DIAGNOSTIC_BAD_EXTLEN); 30250Sstevel@tonic-gate return; 30260Sstevel@tonic-gate case KGE_CHK: 30270Sstevel@tonic-gate /* Reality check failed. */ 30283448Sdh155122 ss1dbg(spds, ("Reality check failed on extension type %d.\n", 30290Sstevel@tonic-gate extv[0]->spd_ext_type)); 30300Sstevel@tonic-gate spdsock_diag(q, mp, bad_ext_diag[extv[0]->spd_ext_type]); 30310Sstevel@tonic-gate return; 30320Sstevel@tonic-gate default: 30330Sstevel@tonic-gate /* Default case is no errors. */ 30340Sstevel@tonic-gate break; 30350Sstevel@tonic-gate } 30360Sstevel@tonic-gate 30370Sstevel@tonic-gate /* 30380Sstevel@tonic-gate * Special-case SPD_UPDATEALGS so as not to load IPsec. 30390Sstevel@tonic-gate */ 30403448Sdh155122 if (!ipsec_loaded(ipss) && spmsg->spd_msg_type != SPD_UPDATEALGS) { 30410Sstevel@tonic-gate spdsock_t *ss = (spdsock_t *)q->q_ptr; 30420Sstevel@tonic-gate 30430Sstevel@tonic-gate ASSERT(ss != NULL); 30443448Sdh155122 ipsec_loader_loadnow(ipss); 30450Sstevel@tonic-gate ss->spdsock_timeout_arg = mp; 30460Sstevel@tonic-gate ss->spdsock_timeout = qtimeout(q, spdsock_loadcheck, 30470Sstevel@tonic-gate q, LOADCHECK_INTERVAL); 30480Sstevel@tonic-gate return; 30490Sstevel@tonic-gate } 30500Sstevel@tonic-gate 30513055Sdanmcd /* First check for messages that need no polheads at all. */ 30520Sstevel@tonic-gate switch (spmsg->spd_msg_type) { 30530Sstevel@tonic-gate case SPD_UPDATEALGS: 30540Sstevel@tonic-gate spdsock_updatealg(q, mp, extv); 30550Sstevel@tonic-gate return; 30560Sstevel@tonic-gate case SPD_ALGLIST: 30570Sstevel@tonic-gate spdsock_alglist(q, mp); 30580Sstevel@tonic-gate return; 30590Sstevel@tonic-gate case SPD_DUMPALGS: 30600Sstevel@tonic-gate spdsock_dumpalgs(q, mp); 30610Sstevel@tonic-gate return; 30623055Sdanmcd } 30633055Sdanmcd 30643055Sdanmcd /* 30653055Sdanmcd * Then check for ones that need both primary/secondary polheads, 30663055Sdanmcd * finding the appropriate tunnel policy if need be. 30673055Sdanmcd */ 30683055Sdanmcd tunname = (spd_if_t *)extv[SPD_EXT_TUN_NAME]; 30693055Sdanmcd switch (spmsg->spd_msg_type) { 30703055Sdanmcd case SPD_FLIP: 30713055Sdanmcd spdsock_flip(q, mp, tunname); 30723055Sdanmcd return; 30733055Sdanmcd case SPD_CLONE: 30743055Sdanmcd spdsock_clone(q, mp, tunname); 30753055Sdanmcd return; 30763055Sdanmcd } 30773055Sdanmcd 30783055Sdanmcd /* 30793055Sdanmcd * Finally, find ones that operate on exactly one polhead, or 30803055Sdanmcd * "all polheads" of a given type (active/inactive). 30813055Sdanmcd */ 30823055Sdanmcd iph = get_appropriate_polhead(q, mp, tunname, spmsg->spd_msg_spdid, 30833055Sdanmcd spmsg->spd_msg_type, &itp); 30843055Sdanmcd if (iph == NULL) 30853055Sdanmcd return; 30863055Sdanmcd 30873055Sdanmcd /* All-polheads-ready operations. */ 30883055Sdanmcd switch (spmsg->spd_msg_type) { 30893055Sdanmcd case SPD_FLUSH: 30903055Sdanmcd if (itp != NULL) { 30913055Sdanmcd mutex_enter(&itp->itp_lock); 30923055Sdanmcd if (spmsg->spd_msg_spdid == SPD_ACTIVE) 30933055Sdanmcd itp->itp_flags &= ~ITPF_PFLAGS; 30943055Sdanmcd else 30953055Sdanmcd itp->itp_flags &= ~ITPF_IFLAGS; 30963055Sdanmcd mutex_exit(&itp->itp_lock); 309711456Sdanmcd@sun.com } 309811456Sdanmcd@sun.com 309911456Sdanmcd@sun.com spdsock_flush(q, iph, itp, mp); 310011456Sdanmcd@sun.com 310111456Sdanmcd@sun.com if (itp != NULL) { 310211456Sdanmcd@sun.com /* SPD_FLUSH is worth a tunnel MTU check. */ 310311456Sdanmcd@sun.com update_iptun_policy(itp); 31043448Sdh155122 ITP_REFRELE(itp, ns); 31053055Sdanmcd } 31063055Sdanmcd return; 31073055Sdanmcd case SPD_DUMP: 31083055Sdanmcd if (itp != NULL) 31093448Sdh155122 ITP_REFRELE(itp, ns); 31103055Sdanmcd spdsock_dump(q, iph, mp); 31113055Sdanmcd return; 31123055Sdanmcd } 31133055Sdanmcd 31143055Sdanmcd if (iph == ALL_ACTIVE_POLHEADS || iph == ALL_INACTIVE_POLHEADS) { 31153055Sdanmcd spdsock_diag(q, mp, SPD_DIAGNOSTIC_NOT_GLOBAL_OP); 31163055Sdanmcd return; 31173055Sdanmcd } 31183055Sdanmcd 31193055Sdanmcd /* Single-polhead-only operations. */ 31203055Sdanmcd switch (spmsg->spd_msg_type) { 31213055Sdanmcd case SPD_ADDRULE: 31223055Sdanmcd spdsock_addrule(q, iph, mp, extv, itp); 31233055Sdanmcd break; 31243055Sdanmcd case SPD_DELETERULE: 31253055Sdanmcd spdsock_deleterule(q, iph, mp, extv, itp); 31263055Sdanmcd break; 31273055Sdanmcd case SPD_LOOKUP: 31283055Sdanmcd spdsock_lookup(q, iph, mp, extv, itp); 31293055Sdanmcd break; 31300Sstevel@tonic-gate default: 31310Sstevel@tonic-gate spdsock_diag(q, mp, SPD_DIAGNOSTIC_BAD_MSG_TYPE); 31323055Sdanmcd break; 31330Sstevel@tonic-gate } 31343055Sdanmcd 31356430Sdanmcd IPPH_REFRELE(iph, ns); 313611456Sdanmcd@sun.com if (itp != NULL) { 313711456Sdanmcd@sun.com /* SPD_{ADD,DELETE}RULE are worth a tunnel MTU check. */ 313811456Sdanmcd@sun.com if (spmsg->spd_msg_type == SPD_ADDRULE || 313911456Sdanmcd@sun.com spmsg->spd_msg_type == SPD_DELETERULE) 314011456Sdanmcd@sun.com update_iptun_policy(itp); 31413448Sdh155122 ITP_REFRELE(itp, ns); 314211456Sdanmcd@sun.com } 31430Sstevel@tonic-gate } 31440Sstevel@tonic-gate 31450Sstevel@tonic-gate /* 31460Sstevel@tonic-gate * If an algorithm mapping was received before IPsec was loaded, process it. 31470Sstevel@tonic-gate * Called from the IPsec loader. 31480Sstevel@tonic-gate */ 31490Sstevel@tonic-gate void 31503448Sdh155122 spdsock_update_pending_algs(netstack_t *ns) 31510Sstevel@tonic-gate { 31523448Sdh155122 spd_stack_t *spds = ns->netstack_spdsock; 31533448Sdh155122 31543448Sdh155122 mutex_enter(&spds->spds_alg_lock); 31553448Sdh155122 if (spds->spds_algs_pending) { 315611042SErik.Nordmark@Sun.COM (void) spdsock_do_updatealg(spds->spds_extv_algs, spds); 31573448Sdh155122 spds->spds_algs_pending = B_FALSE; 31580Sstevel@tonic-gate } 31593448Sdh155122 mutex_exit(&spds->spds_alg_lock); 31600Sstevel@tonic-gate } 31610Sstevel@tonic-gate 31620Sstevel@tonic-gate static void 31630Sstevel@tonic-gate spdsock_loadcheck(void *arg) 31640Sstevel@tonic-gate { 31650Sstevel@tonic-gate queue_t *q = (queue_t *)arg; 31660Sstevel@tonic-gate spdsock_t *ss = (spdsock_t *)q->q_ptr; 31670Sstevel@tonic-gate mblk_t *mp; 31686430Sdanmcd ipsec_stack_t *ipss = ss->spdsock_spds->spds_netstack->netstack_ipsec; 31690Sstevel@tonic-gate 31700Sstevel@tonic-gate ASSERT(ss != NULL); 31710Sstevel@tonic-gate 31720Sstevel@tonic-gate ss->spdsock_timeout = 0; 31730Sstevel@tonic-gate mp = ss->spdsock_timeout_arg; 31740Sstevel@tonic-gate ASSERT(mp != NULL); 31750Sstevel@tonic-gate ss->spdsock_timeout_arg = NULL; 31763448Sdh155122 if (ipsec_failed(ipss)) 31770Sstevel@tonic-gate spdsock_error(q, mp, EPROTONOSUPPORT, 0); 31780Sstevel@tonic-gate else 31790Sstevel@tonic-gate spdsock_parse(q, mp); 31800Sstevel@tonic-gate } 31810Sstevel@tonic-gate 31820Sstevel@tonic-gate /* 31830Sstevel@tonic-gate * Copy relevant state bits. 31840Sstevel@tonic-gate */ 31850Sstevel@tonic-gate static void 31860Sstevel@tonic-gate spdsock_copy_info(struct T_info_ack *tap, spdsock_t *ss) 31870Sstevel@tonic-gate { 31880Sstevel@tonic-gate *tap = spdsock_g_t_info_ack; 31890Sstevel@tonic-gate tap->CURRENT_state = ss->spdsock_state; 31900Sstevel@tonic-gate tap->OPT_size = spdsock_max_optsize; 31910Sstevel@tonic-gate } 31920Sstevel@tonic-gate 31930Sstevel@tonic-gate /* 31940Sstevel@tonic-gate * This routine responds to T_CAPABILITY_REQ messages. It is called by 31950Sstevel@tonic-gate * spdsock_wput. Much of the T_CAPABILITY_ACK information is copied from 31960Sstevel@tonic-gate * spdsock_g_t_info_ack. The current state of the stream is copied from 31970Sstevel@tonic-gate * spdsock_state. 31980Sstevel@tonic-gate */ 31990Sstevel@tonic-gate static void 32000Sstevel@tonic-gate spdsock_capability_req(queue_t *q, mblk_t *mp) 32010Sstevel@tonic-gate { 32020Sstevel@tonic-gate spdsock_t *ss = (spdsock_t *)q->q_ptr; 32030Sstevel@tonic-gate t_uscalar_t cap_bits1; 32040Sstevel@tonic-gate struct T_capability_ack *tcap; 32050Sstevel@tonic-gate 32060Sstevel@tonic-gate cap_bits1 = ((struct T_capability_req *)mp->b_rptr)->CAP_bits1; 32070Sstevel@tonic-gate 32080Sstevel@tonic-gate mp = tpi_ack_alloc(mp, sizeof (struct T_capability_ack), 32095240Snordmark mp->b_datap->db_type, T_CAPABILITY_ACK); 32100Sstevel@tonic-gate if (mp == NULL) 32110Sstevel@tonic-gate return; 32120Sstevel@tonic-gate 32130Sstevel@tonic-gate tcap = (struct T_capability_ack *)mp->b_rptr; 32140Sstevel@tonic-gate tcap->CAP_bits1 = 0; 32150Sstevel@tonic-gate 32160Sstevel@tonic-gate if (cap_bits1 & TC1_INFO) { 32170Sstevel@tonic-gate spdsock_copy_info(&tcap->INFO_ack, ss); 32180Sstevel@tonic-gate tcap->CAP_bits1 |= TC1_INFO; 32190Sstevel@tonic-gate } 32200Sstevel@tonic-gate 32210Sstevel@tonic-gate qreply(q, mp); 32220Sstevel@tonic-gate } 32230Sstevel@tonic-gate 32240Sstevel@tonic-gate /* 32250Sstevel@tonic-gate * This routine responds to T_INFO_REQ messages. It is called by 32260Sstevel@tonic-gate * spdsock_wput_other. 32270Sstevel@tonic-gate * Most of the T_INFO_ACK information is copied from spdsock_g_t_info_ack. 32280Sstevel@tonic-gate * The current state of the stream is copied from spdsock_state. 32290Sstevel@tonic-gate */ 32300Sstevel@tonic-gate static void 32310Sstevel@tonic-gate spdsock_info_req(q, mp) 32320Sstevel@tonic-gate queue_t *q; 32330Sstevel@tonic-gate mblk_t *mp; 32340Sstevel@tonic-gate { 32350Sstevel@tonic-gate mp = tpi_ack_alloc(mp, sizeof (struct T_info_ack), M_PCPROTO, 32360Sstevel@tonic-gate T_INFO_ACK); 32370Sstevel@tonic-gate if (mp == NULL) 32380Sstevel@tonic-gate return; 32390Sstevel@tonic-gate spdsock_copy_info((struct T_info_ack *)mp->b_rptr, 32400Sstevel@tonic-gate (spdsock_t *)q->q_ptr); 32410Sstevel@tonic-gate qreply(q, mp); 32420Sstevel@tonic-gate } 32430Sstevel@tonic-gate 32440Sstevel@tonic-gate /* 32450Sstevel@tonic-gate * spdsock_err_ack. This routine creates a 32460Sstevel@tonic-gate * T_ERROR_ACK message and passes it 32470Sstevel@tonic-gate * upstream. 32480Sstevel@tonic-gate */ 32490Sstevel@tonic-gate static void 32500Sstevel@tonic-gate spdsock_err_ack(q, mp, t_error, sys_error) 32510Sstevel@tonic-gate queue_t *q; 32520Sstevel@tonic-gate mblk_t *mp; 32530Sstevel@tonic-gate int t_error; 32540Sstevel@tonic-gate int sys_error; 32550Sstevel@tonic-gate { 32560Sstevel@tonic-gate if ((mp = mi_tpi_err_ack_alloc(mp, t_error, sys_error)) != NULL) 32570Sstevel@tonic-gate qreply(q, mp); 32580Sstevel@tonic-gate } 32590Sstevel@tonic-gate 32600Sstevel@tonic-gate /* 32610Sstevel@tonic-gate * This routine retrieves the current status of socket options. 32620Sstevel@tonic-gate * It returns the size of the option retrieved. 32630Sstevel@tonic-gate */ 32640Sstevel@tonic-gate /* ARGSUSED */ 32650Sstevel@tonic-gate int 32660Sstevel@tonic-gate spdsock_opt_get(queue_t *q, int level, int name, uchar_t *ptr) 32670Sstevel@tonic-gate { 32680Sstevel@tonic-gate int *i1 = (int *)ptr; 32690Sstevel@tonic-gate 32700Sstevel@tonic-gate switch (level) { 32710Sstevel@tonic-gate case SOL_SOCKET: 32720Sstevel@tonic-gate switch (name) { 32730Sstevel@tonic-gate case SO_TYPE: 32740Sstevel@tonic-gate *i1 = SOCK_RAW; 32750Sstevel@tonic-gate break; 32760Sstevel@tonic-gate /* 32770Sstevel@tonic-gate * The following two items can be manipulated, 32780Sstevel@tonic-gate * but changing them should do nothing. 32790Sstevel@tonic-gate */ 32800Sstevel@tonic-gate case SO_SNDBUF: 32810Sstevel@tonic-gate *i1 = (int)q->q_hiwat; 32820Sstevel@tonic-gate break; 32830Sstevel@tonic-gate case SO_RCVBUF: 32840Sstevel@tonic-gate *i1 = (int)(RD(q)->q_hiwat); 32850Sstevel@tonic-gate break; 32860Sstevel@tonic-gate } 32870Sstevel@tonic-gate break; 32880Sstevel@tonic-gate default: 32890Sstevel@tonic-gate return (0); 32900Sstevel@tonic-gate } 32910Sstevel@tonic-gate return (sizeof (int)); 32920Sstevel@tonic-gate } 32930Sstevel@tonic-gate 32940Sstevel@tonic-gate /* 32950Sstevel@tonic-gate * This routine sets socket options. 32960Sstevel@tonic-gate */ 32970Sstevel@tonic-gate /* ARGSUSED */ 32980Sstevel@tonic-gate int 32990Sstevel@tonic-gate spdsock_opt_set(queue_t *q, uint_t mgmt_flags, int level, int name, 33000Sstevel@tonic-gate uint_t inlen, uchar_t *invalp, uint_t *outlenp, uchar_t *outvalp, 330111042SErik.Nordmark@Sun.COM void *thisdg_attrs, cred_t *cr) 33020Sstevel@tonic-gate { 33030Sstevel@tonic-gate int *i1 = (int *)invalp; 33043448Sdh155122 spdsock_t *ss = (spdsock_t *)q->q_ptr; 33053448Sdh155122 spd_stack_t *spds = ss->spdsock_spds; 33060Sstevel@tonic-gate 33070Sstevel@tonic-gate switch (level) { 33080Sstevel@tonic-gate case SOL_SOCKET: 33090Sstevel@tonic-gate switch (name) { 33100Sstevel@tonic-gate case SO_SNDBUF: 33113448Sdh155122 if (*i1 > spds->spds_max_buf) 33120Sstevel@tonic-gate return (ENOBUFS); 33130Sstevel@tonic-gate q->q_hiwat = *i1; 33140Sstevel@tonic-gate break; 33150Sstevel@tonic-gate case SO_RCVBUF: 33163448Sdh155122 if (*i1 > spds->spds_max_buf) 33170Sstevel@tonic-gate return (ENOBUFS); 33180Sstevel@tonic-gate RD(q)->q_hiwat = *i1; 33198348SEric.Yu@Sun.COM (void) proto_set_rx_hiwat(RD(q), NULL, *i1); 33200Sstevel@tonic-gate break; 33210Sstevel@tonic-gate } 33220Sstevel@tonic-gate break; 33230Sstevel@tonic-gate } 33240Sstevel@tonic-gate return (0); 33250Sstevel@tonic-gate } 33260Sstevel@tonic-gate 33270Sstevel@tonic-gate 33280Sstevel@tonic-gate /* 33290Sstevel@tonic-gate * Handle STREAMS messages. 33300Sstevel@tonic-gate */ 33310Sstevel@tonic-gate static void 33320Sstevel@tonic-gate spdsock_wput_other(queue_t *q, mblk_t *mp) 33330Sstevel@tonic-gate { 33340Sstevel@tonic-gate struct iocblk *iocp; 33350Sstevel@tonic-gate int error; 33363448Sdh155122 spdsock_t *ss = (spdsock_t *)q->q_ptr; 33373448Sdh155122 spd_stack_t *spds = ss->spdsock_spds; 33383448Sdh155122 cred_t *cr; 33390Sstevel@tonic-gate 33400Sstevel@tonic-gate switch (mp->b_datap->db_type) { 33410Sstevel@tonic-gate case M_PROTO: 33420Sstevel@tonic-gate case M_PCPROTO: 33430Sstevel@tonic-gate if ((mp->b_wptr - mp->b_rptr) < sizeof (long)) { 33443448Sdh155122 ss3dbg(spds, ( 33450Sstevel@tonic-gate "spdsock_wput_other: Not big enough M_PROTO\n")); 33460Sstevel@tonic-gate freemsg(mp); 33470Sstevel@tonic-gate return; 33480Sstevel@tonic-gate } 33490Sstevel@tonic-gate switch (((union T_primitives *)mp->b_rptr)->type) { 33500Sstevel@tonic-gate case T_CAPABILITY_REQ: 33510Sstevel@tonic-gate spdsock_capability_req(q, mp); 33523448Sdh155122 break; 33530Sstevel@tonic-gate case T_INFO_REQ: 33540Sstevel@tonic-gate spdsock_info_req(q, mp); 33553448Sdh155122 break; 33560Sstevel@tonic-gate case T_SVR4_OPTMGMT_REQ: 33570Sstevel@tonic-gate case T_OPTMGMT_REQ: 33588778SErik.Nordmark@Sun.COM /* 33598778SErik.Nordmark@Sun.COM * All Solaris components should pass a db_credp 33608778SErik.Nordmark@Sun.COM * for this TPI message, hence we ASSERT. 33618778SErik.Nordmark@Sun.COM * But in case there is some other M_PROTO that looks 33628778SErik.Nordmark@Sun.COM * like a TPI message sent by some other kernel 33638778SErik.Nordmark@Sun.COM * component, we check and return an error. 33648778SErik.Nordmark@Sun.COM */ 33658778SErik.Nordmark@Sun.COM cr = msg_getcred(mp, NULL); 33668778SErik.Nordmark@Sun.COM ASSERT(cr != NULL); 33678778SErik.Nordmark@Sun.COM if (cr == NULL) { 33688778SErik.Nordmark@Sun.COM spdsock_err_ack(q, mp, TSYSERR, EINVAL); 33698778SErik.Nordmark@Sun.COM return; 33708778SErik.Nordmark@Sun.COM } 33718778SErik.Nordmark@Sun.COM if (((union T_primitives *)mp->b_rptr)->type == 33728778SErik.Nordmark@Sun.COM T_SVR4_OPTMGMT_REQ) { 337311042SErik.Nordmark@Sun.COM svr4_optcom_req(q, mp, cr, &spdsock_opt_obj); 33748778SErik.Nordmark@Sun.COM } else { 337511042SErik.Nordmark@Sun.COM tpi_optcom_req(q, mp, cr, &spdsock_opt_obj); 33768778SErik.Nordmark@Sun.COM } 33773448Sdh155122 break; 33780Sstevel@tonic-gate case T_DATA_REQ: 33790Sstevel@tonic-gate case T_EXDATA_REQ: 33800Sstevel@tonic-gate case T_ORDREL_REQ: 33810Sstevel@tonic-gate /* Illegal for spdsock. */ 33820Sstevel@tonic-gate freemsg(mp); 33830Sstevel@tonic-gate (void) putnextctl1(RD(q), M_ERROR, EPROTO); 33843448Sdh155122 break; 33850Sstevel@tonic-gate default: 33860Sstevel@tonic-gate /* Not supported by spdsock. */ 33870Sstevel@tonic-gate spdsock_err_ack(q, mp, TNOTSUPPORT, 0); 33883448Sdh155122 break; 33890Sstevel@tonic-gate } 33903448Sdh155122 return; 33910Sstevel@tonic-gate case M_IOCTL: 33920Sstevel@tonic-gate iocp = (struct iocblk *)mp->b_rptr; 33930Sstevel@tonic-gate error = EINVAL; 33940Sstevel@tonic-gate 33950Sstevel@tonic-gate switch (iocp->ioc_cmd) { 33960Sstevel@tonic-gate case ND_SET: 33970Sstevel@tonic-gate case ND_GET: 33983448Sdh155122 if (nd_getset(q, spds->spds_g_nd, mp)) { 33990Sstevel@tonic-gate qreply(q, mp); 34000Sstevel@tonic-gate return; 34010Sstevel@tonic-gate } else 34020Sstevel@tonic-gate error = ENOENT; 34030Sstevel@tonic-gate /* FALLTHRU */ 34040Sstevel@tonic-gate default: 34050Sstevel@tonic-gate miocnak(q, mp, 0, error); 34060Sstevel@tonic-gate return; 34070Sstevel@tonic-gate } 34080Sstevel@tonic-gate case M_FLUSH: 34090Sstevel@tonic-gate if (*mp->b_rptr & FLUSHW) { 34100Sstevel@tonic-gate flushq(q, FLUSHALL); 34110Sstevel@tonic-gate *mp->b_rptr &= ~FLUSHW; 34120Sstevel@tonic-gate } 34130Sstevel@tonic-gate if (*mp->b_rptr & FLUSHR) { 34140Sstevel@tonic-gate qreply(q, mp); 34150Sstevel@tonic-gate return; 34160Sstevel@tonic-gate } 34170Sstevel@tonic-gate /* Else FALLTHRU */ 34180Sstevel@tonic-gate } 34190Sstevel@tonic-gate 34200Sstevel@tonic-gate /* If fell through, just black-hole the message. */ 34210Sstevel@tonic-gate freemsg(mp); 34220Sstevel@tonic-gate } 34230Sstevel@tonic-gate 34240Sstevel@tonic-gate static void 34250Sstevel@tonic-gate spdsock_wput(queue_t *q, mblk_t *mp) 34260Sstevel@tonic-gate { 34270Sstevel@tonic-gate uint8_t *rptr = mp->b_rptr; 34280Sstevel@tonic-gate mblk_t *mp1; 34290Sstevel@tonic-gate spdsock_t *ss = (spdsock_t *)q->q_ptr; 34303448Sdh155122 spd_stack_t *spds = ss->spdsock_spds; 34310Sstevel@tonic-gate 34320Sstevel@tonic-gate /* 34330Sstevel@tonic-gate * If we're dumping, defer processing other messages until the 34340Sstevel@tonic-gate * dump completes. 34350Sstevel@tonic-gate */ 34360Sstevel@tonic-gate if (ss->spdsock_dump_req != NULL) { 34370Sstevel@tonic-gate if (!putq(q, mp)) 34380Sstevel@tonic-gate freemsg(mp); 34390Sstevel@tonic-gate return; 34400Sstevel@tonic-gate } 34410Sstevel@tonic-gate 34420Sstevel@tonic-gate switch (mp->b_datap->db_type) { 34430Sstevel@tonic-gate case M_DATA: 34440Sstevel@tonic-gate /* 34450Sstevel@tonic-gate * Silently discard. 34460Sstevel@tonic-gate */ 34473448Sdh155122 ss2dbg(spds, ("raw M_DATA in spdsock.\n")); 34480Sstevel@tonic-gate freemsg(mp); 34490Sstevel@tonic-gate return; 34500Sstevel@tonic-gate case M_PROTO: 34510Sstevel@tonic-gate case M_PCPROTO: 34520Sstevel@tonic-gate if ((mp->b_wptr - rptr) >= sizeof (struct T_data_req)) { 34530Sstevel@tonic-gate if (((union T_primitives *)rptr)->type == T_DATA_REQ) { 34540Sstevel@tonic-gate if ((mp1 = mp->b_cont) == NULL) { 34550Sstevel@tonic-gate /* No data after T_DATA_REQ. */ 34563448Sdh155122 ss2dbg(spds, 34573448Sdh155122 ("No data after DATA_REQ.\n")); 34580Sstevel@tonic-gate freemsg(mp); 34590Sstevel@tonic-gate return; 34600Sstevel@tonic-gate } 34610Sstevel@tonic-gate freeb(mp); 34620Sstevel@tonic-gate mp = mp1; 34633448Sdh155122 ss2dbg(spds, ("T_DATA_REQ\n")); 34640Sstevel@tonic-gate break; /* Out of switch. */ 34650Sstevel@tonic-gate } 34660Sstevel@tonic-gate } 34670Sstevel@tonic-gate /* FALLTHRU */ 34680Sstevel@tonic-gate default: 34693448Sdh155122 ss3dbg(spds, ("In default wput case (%d %d).\n", 34700Sstevel@tonic-gate mp->b_datap->db_type, ((union T_primitives *)rptr)->type)); 34710Sstevel@tonic-gate spdsock_wput_other(q, mp); 34720Sstevel@tonic-gate return; 34730Sstevel@tonic-gate } 34740Sstevel@tonic-gate 34750Sstevel@tonic-gate /* I now have a PF_POLICY message in an M_DATA block. */ 34760Sstevel@tonic-gate spdsock_parse(q, mp); 34770Sstevel@tonic-gate } 34780Sstevel@tonic-gate 34790Sstevel@tonic-gate /* 34800Sstevel@tonic-gate * Device open procedure, called when new queue pair created. 34810Sstevel@tonic-gate * We are passed the read-side queue. 34820Sstevel@tonic-gate */ 34830Sstevel@tonic-gate /* ARGSUSED */ 34840Sstevel@tonic-gate static int 34850Sstevel@tonic-gate spdsock_open(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp) 34860Sstevel@tonic-gate { 34870Sstevel@tonic-gate spdsock_t *ss; 34880Sstevel@tonic-gate queue_t *oq = OTHERQ(q); 34890Sstevel@tonic-gate minor_t ssminor; 34903448Sdh155122 netstack_t *ns; 34913448Sdh155122 spd_stack_t *spds; 34923448Sdh155122 34933448Sdh155122 if (secpolicy_ip_config(credp, B_FALSE) != 0) 34940Sstevel@tonic-gate return (EPERM); 34950Sstevel@tonic-gate 34960Sstevel@tonic-gate if (q->q_ptr != NULL) 34970Sstevel@tonic-gate return (0); /* Re-open of an already open instance. */ 34980Sstevel@tonic-gate 34990Sstevel@tonic-gate if (sflag & MODOPEN) 35000Sstevel@tonic-gate return (EINVAL); 35010Sstevel@tonic-gate 35023448Sdh155122 ns = netstack_find_by_cred(credp); 35033448Sdh155122 ASSERT(ns != NULL); 35043448Sdh155122 spds = ns->netstack_spdsock; 35053448Sdh155122 ASSERT(spds != NULL); 35063448Sdh155122 35073448Sdh155122 ss2dbg(spds, ("Made it into PF_POLICY socket open.\n")); 35080Sstevel@tonic-gate 35090Sstevel@tonic-gate ssminor = (minor_t)(uintptr_t)vmem_alloc(spdsock_vmem, 1, VM_NOSLEEP); 35103448Sdh155122 if (ssminor == 0) { 35113448Sdh155122 netstack_rele(spds->spds_netstack); 35120Sstevel@tonic-gate return (ENOMEM); 35133448Sdh155122 } 35140Sstevel@tonic-gate ss = kmem_zalloc(sizeof (spdsock_t), KM_NOSLEEP); 35150Sstevel@tonic-gate if (ss == NULL) { 35160Sstevel@tonic-gate vmem_free(spdsock_vmem, (void *)(uintptr_t)ssminor, 1); 35173448Sdh155122 netstack_rele(spds->spds_netstack); 35180Sstevel@tonic-gate return (ENOMEM); 35190Sstevel@tonic-gate } 35200Sstevel@tonic-gate 35210Sstevel@tonic-gate ss->spdsock_minor = ssminor; 35220Sstevel@tonic-gate ss->spdsock_state = TS_UNBND; 35230Sstevel@tonic-gate ss->spdsock_dump_req = NULL; 35240Sstevel@tonic-gate 35253448Sdh155122 ss->spdsock_spds = spds; 35263448Sdh155122 35270Sstevel@tonic-gate q->q_ptr = ss; 35280Sstevel@tonic-gate oq->q_ptr = ss; 35290Sstevel@tonic-gate 35303448Sdh155122 q->q_hiwat = spds->spds_recv_hiwat; 35313448Sdh155122 35323448Sdh155122 oq->q_hiwat = spds->spds_xmit_hiwat; 35333448Sdh155122 oq->q_lowat = spds->spds_xmit_lowat; 35340Sstevel@tonic-gate 35350Sstevel@tonic-gate qprocson(q); 35368348SEric.Yu@Sun.COM (void) proto_set_rx_hiwat(q, NULL, spds->spds_recv_hiwat); 35370Sstevel@tonic-gate 35380Sstevel@tonic-gate *devp = makedevice(getmajor(*devp), ss->spdsock_minor); 35390Sstevel@tonic-gate return (0); 35400Sstevel@tonic-gate } 35410Sstevel@tonic-gate 35420Sstevel@tonic-gate /* 35430Sstevel@tonic-gate * Read-side service procedure, invoked when we get back-enabled 35440Sstevel@tonic-gate * when buffer space becomes available. 35450Sstevel@tonic-gate * 35460Sstevel@tonic-gate * Dump another chunk if we were dumping before; when we finish, kick 35470Sstevel@tonic-gate * the write-side queue in case it's waiting for read queue space. 35480Sstevel@tonic-gate */ 35490Sstevel@tonic-gate void 35500Sstevel@tonic-gate spdsock_rsrv(queue_t *q) 35510Sstevel@tonic-gate { 35520Sstevel@tonic-gate spdsock_t *ss = q->q_ptr; 35530Sstevel@tonic-gate 35540Sstevel@tonic-gate if (ss->spdsock_dump_req != NULL) 35550Sstevel@tonic-gate spdsock_dump_some(q, ss); 35560Sstevel@tonic-gate 35570Sstevel@tonic-gate if (ss->spdsock_dump_req == NULL) 35580Sstevel@tonic-gate qenable(OTHERQ(q)); 35590Sstevel@tonic-gate } 35600Sstevel@tonic-gate 35610Sstevel@tonic-gate /* 35620Sstevel@tonic-gate * Write-side service procedure, invoked when we defer processing 35630Sstevel@tonic-gate * if another message is received while a dump is in progress. 35640Sstevel@tonic-gate */ 35650Sstevel@tonic-gate void 35660Sstevel@tonic-gate spdsock_wsrv(queue_t *q) 35670Sstevel@tonic-gate { 35680Sstevel@tonic-gate spdsock_t *ss = q->q_ptr; 35690Sstevel@tonic-gate mblk_t *mp; 35706430Sdanmcd ipsec_stack_t *ipss = ss->spdsock_spds->spds_netstack->netstack_ipsec; 35710Sstevel@tonic-gate 35720Sstevel@tonic-gate if (ss->spdsock_dump_req != NULL) { 35730Sstevel@tonic-gate qenable(OTHERQ(q)); 35740Sstevel@tonic-gate return; 35750Sstevel@tonic-gate } 35760Sstevel@tonic-gate 35770Sstevel@tonic-gate while ((mp = getq(q)) != NULL) { 35783448Sdh155122 if (ipsec_loaded(ipss)) { 35790Sstevel@tonic-gate spdsock_wput(q, mp); 35800Sstevel@tonic-gate if (ss->spdsock_dump_req != NULL) 35810Sstevel@tonic-gate return; 35823448Sdh155122 } else if (!ipsec_failed(ipss)) { 35830Sstevel@tonic-gate (void) putq(q, mp); 35840Sstevel@tonic-gate } else { 35850Sstevel@tonic-gate spdsock_error(q, mp, EPFNOSUPPORT, 0); 35860Sstevel@tonic-gate } 35870Sstevel@tonic-gate } 35880Sstevel@tonic-gate } 35890Sstevel@tonic-gate 35900Sstevel@tonic-gate static int 35910Sstevel@tonic-gate spdsock_close(queue_t *q) 35920Sstevel@tonic-gate { 35930Sstevel@tonic-gate spdsock_t *ss = q->q_ptr; 35943448Sdh155122 spd_stack_t *spds = ss->spdsock_spds; 35950Sstevel@tonic-gate 35960Sstevel@tonic-gate qprocsoff(q); 35970Sstevel@tonic-gate 35980Sstevel@tonic-gate /* Safe assumption. */ 35990Sstevel@tonic-gate ASSERT(ss != NULL); 36000Sstevel@tonic-gate 36010Sstevel@tonic-gate if (ss->spdsock_timeout != 0) 36020Sstevel@tonic-gate (void) quntimeout(q, ss->spdsock_timeout); 36030Sstevel@tonic-gate 36043448Sdh155122 ss3dbg(spds, ("Driver close, PF_POLICY socket is going away.\n")); 36050Sstevel@tonic-gate 36060Sstevel@tonic-gate vmem_free(spdsock_vmem, (void *)(uintptr_t)ss->spdsock_minor, 1); 36073448Sdh155122 netstack_rele(ss->spdsock_spds->spds_netstack); 36080Sstevel@tonic-gate 36090Sstevel@tonic-gate kmem_free(ss, sizeof (spdsock_t)); 36100Sstevel@tonic-gate return (0); 36110Sstevel@tonic-gate } 36120Sstevel@tonic-gate 36130Sstevel@tonic-gate /* 36140Sstevel@tonic-gate * Merge the IPsec algorithms tables with the received algorithm information. 36150Sstevel@tonic-gate */ 36160Sstevel@tonic-gate void 36173448Sdh155122 spdsock_merge_algs(spd_stack_t *spds) 36180Sstevel@tonic-gate { 36190Sstevel@tonic-gate ipsec_alginfo_t *alg, *oalg; 36200Sstevel@tonic-gate ipsec_algtype_t algtype; 36210Sstevel@tonic-gate uint_t algidx, algid, nalgs; 36220Sstevel@tonic-gate crypto_mech_name_t *mechs; 36230Sstevel@tonic-gate uint_t mech_count, mech_idx; 36243448Sdh155122 netstack_t *ns = spds->spds_netstack; 36253448Sdh155122 ipsec_stack_t *ipss = ns->netstack_ipsec; 36263448Sdh155122 36273448Sdh155122 ASSERT(MUTEX_HELD(&spds->spds_alg_lock)); 36280Sstevel@tonic-gate 36290Sstevel@tonic-gate /* 36300Sstevel@tonic-gate * Get the list of supported mechanisms from the crypto framework. 36310Sstevel@tonic-gate * If a mechanism is supported by KCF, resolve its mechanism 36320Sstevel@tonic-gate * id and mark it as being valid. This operation must be done 36330Sstevel@tonic-gate * without holding alg_lock, since it can cause a provider 36340Sstevel@tonic-gate * module to be loaded and the provider notification callback to 36350Sstevel@tonic-gate * be invoked. 36360Sstevel@tonic-gate */ 36370Sstevel@tonic-gate mechs = crypto_get_mech_list(&mech_count, KM_SLEEP); 36380Sstevel@tonic-gate for (algtype = 0; algtype < IPSEC_NALGTYPES; algtype++) { 36390Sstevel@tonic-gate for (algid = 0; algid < IPSEC_MAX_ALGS; algid++) { 36400Sstevel@tonic-gate int algflags = 0; 36410Sstevel@tonic-gate crypto_mech_type_t mt = CRYPTO_MECHANISM_INVALID; 36420Sstevel@tonic-gate 36433448Sdh155122 alg = spds->spds_algs[algtype][algid]; 36443448Sdh155122 if (alg == NULL) 36450Sstevel@tonic-gate continue; 36460Sstevel@tonic-gate 36470Sstevel@tonic-gate /* 36480Sstevel@tonic-gate * The NULL encryption algorithm is a special 36490Sstevel@tonic-gate * case because there are no mechanisms, yet 36500Sstevel@tonic-gate * the algorithm is still valid. 36510Sstevel@tonic-gate */ 36520Sstevel@tonic-gate if (alg->alg_id == SADB_EALG_NULL) { 36530Sstevel@tonic-gate alg->alg_mech_type = CRYPTO_MECHANISM_INVALID; 365410824SMark.Fenwick@Sun.COM alg->alg_flags |= ALG_FLAG_VALID; 36550Sstevel@tonic-gate continue; 36560Sstevel@tonic-gate } 36570Sstevel@tonic-gate 36580Sstevel@tonic-gate for (mech_idx = 0; mech_idx < mech_count; mech_idx++) { 36590Sstevel@tonic-gate if (strncmp(alg->alg_mech_name, mechs[mech_idx], 36600Sstevel@tonic-gate CRYPTO_MAX_MECH_NAME) == 0) { 36610Sstevel@tonic-gate mt = crypto_mech2id(alg->alg_mech_name); 36620Sstevel@tonic-gate ASSERT(mt != CRYPTO_MECHANISM_INVALID); 36630Sstevel@tonic-gate algflags = ALG_FLAG_VALID; 36640Sstevel@tonic-gate break; 36650Sstevel@tonic-gate } 36660Sstevel@tonic-gate } 36670Sstevel@tonic-gate alg->alg_mech_type = mt; 366810824SMark.Fenwick@Sun.COM alg->alg_flags |= algflags; 36690Sstevel@tonic-gate } 36700Sstevel@tonic-gate } 36710Sstevel@tonic-gate 36723448Sdh155122 mutex_enter(&ipss->ipsec_alg_lock); 36730Sstevel@tonic-gate 36740Sstevel@tonic-gate /* 36750Sstevel@tonic-gate * For each algorithm currently defined, check if it is 36760Sstevel@tonic-gate * present in the new tables created from the SPD_UPDATEALGS 36770Sstevel@tonic-gate * message received from user-space. 36780Sstevel@tonic-gate * Delete the algorithm entries that are currently defined 36790Sstevel@tonic-gate * but not part of the new tables. 36800Sstevel@tonic-gate */ 36810Sstevel@tonic-gate for (algtype = 0; algtype < IPSEC_NALGTYPES; algtype++) { 36823448Sdh155122 nalgs = ipss->ipsec_nalgs[algtype]; 36830Sstevel@tonic-gate for (algidx = 0; algidx < nalgs; algidx++) { 36843448Sdh155122 algid = ipss->ipsec_sortlist[algtype][algidx]; 36853448Sdh155122 if (spds->spds_algs[algtype][algid] == NULL) 36863448Sdh155122 ipsec_alg_unreg(algtype, algid, ns); 36870Sstevel@tonic-gate } 36880Sstevel@tonic-gate } 36890Sstevel@tonic-gate 36900Sstevel@tonic-gate /* 36910Sstevel@tonic-gate * For each algorithm we just received, check if it is 36920Sstevel@tonic-gate * present in the currently defined tables. If it is, swap 36930Sstevel@tonic-gate * the entry with the one we just allocated. 36940Sstevel@tonic-gate * If the new algorithm is not in the current tables, 36950Sstevel@tonic-gate * add it. 36960Sstevel@tonic-gate */ 36970Sstevel@tonic-gate for (algtype = 0; algtype < IPSEC_NALGTYPES; algtype++) { 36980Sstevel@tonic-gate for (algid = 0; algid < IPSEC_MAX_ALGS; algid++) { 36993448Sdh155122 alg = spds->spds_algs[algtype][algid]; 37003448Sdh155122 if (alg == NULL) 37010Sstevel@tonic-gate continue; 37020Sstevel@tonic-gate 37033448Sdh155122 if ((oalg = ipss->ipsec_alglists[algtype][algid]) == 37043448Sdh155122 NULL) { 37050Sstevel@tonic-gate /* 37060Sstevel@tonic-gate * New algorithm, add it to the algorithm 37070Sstevel@tonic-gate * table. 37080Sstevel@tonic-gate */ 37093448Sdh155122 ipsec_alg_reg(algtype, alg, ns); 37100Sstevel@tonic-gate } else { 37110Sstevel@tonic-gate /* 37120Sstevel@tonic-gate * Algorithm is already in the table. Swap 37130Sstevel@tonic-gate * the existing entry with the new one. 37140Sstevel@tonic-gate */ 37153448Sdh155122 ipsec_alg_fix_min_max(alg, algtype, ns); 37163448Sdh155122 ipss->ipsec_alglists[algtype][algid] = alg; 37170Sstevel@tonic-gate ipsec_alg_free(oalg); 37180Sstevel@tonic-gate } 37193448Sdh155122 spds->spds_algs[algtype][algid] = NULL; 37200Sstevel@tonic-gate } 37210Sstevel@tonic-gate } 37220Sstevel@tonic-gate 37233448Sdh155122 for (algtype = 0; algtype < IPSEC_NALGTYPES; algtype++) { 37243448Sdh155122 ipss->ipsec_algs_exec_mode[algtype] = 37253448Sdh155122 spds->spds_algs_exec_mode[algtype]; 37263448Sdh155122 } 37273448Sdh155122 37283448Sdh155122 mutex_exit(&ipss->ipsec_alg_lock); 37290Sstevel@tonic-gate 37300Sstevel@tonic-gate crypto_free_mech_list(mechs, mech_count); 37310Sstevel@tonic-gate 37323448Sdh155122 ipsecah_algs_changed(ns); 37333448Sdh155122 ipsecesp_algs_changed(ns); 37340Sstevel@tonic-gate } 3735