Print this page
5045 use atomic_{inc,dec}_* instead of atomic_add_*
| Split |
Close |
| Expand all |
| Collapse all |
--- old/usr/src/uts/common/inet/ip/spd.c
+++ new/usr/src/uts/common/inet/ip/spd.c
1 1 /*
2 2 * CDDL HEADER START
3 3 *
4 4 * The contents of this file are subject to the terms of the
5 5 * Common Development and Distribution License (the "License").
6 6 * You may not use this file except in compliance with the License.
7 7 *
8 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 9 * or http://www.opensolaris.org/os/licensing.
10 10 * See the License for the specific language governing permissions
11 11 * and limitations under the License.
12 12 *
13 13 * When distributing Covered Code, include this CDDL HEADER in each
14 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 15 * If applicable, add the following below this CDDL HEADER, with the
16 16 * fields enclosed by brackets "[]" replaced with your own identifying
17 17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 18 *
19 19 * CDDL HEADER END
20 20 */
21 21 /*
22 22 * Copyright 2010 Sun Microsystems, Inc. All rights reserved.
23 23 * Use is subject to license terms.
24 24 */
25 25
26 26 /*
27 27 * IPsec Security Policy Database.
28 28 *
29 29 * This module maintains the SPD and provides routines used by ip and ip6
30 30 * to apply IPsec policy to inbound and outbound datagrams.
31 31 */
32 32
33 33 #include <sys/types.h>
34 34 #include <sys/stream.h>
35 35 #include <sys/stropts.h>
36 36 #include <sys/sysmacros.h>
37 37 #include <sys/strsubr.h>
38 38 #include <sys/strsun.h>
39 39 #include <sys/strlog.h>
40 40 #include <sys/strsun.h>
41 41 #include <sys/cmn_err.h>
42 42 #include <sys/zone.h>
43 43
44 44 #include <sys/systm.h>
45 45 #include <sys/param.h>
46 46 #include <sys/kmem.h>
47 47 #include <sys/ddi.h>
48 48
49 49 #include <sys/crypto/api.h>
50 50
51 51 #include <inet/common.h>
52 52 #include <inet/mi.h>
53 53
54 54 #include <netinet/ip6.h>
55 55 #include <netinet/icmp6.h>
56 56 #include <netinet/udp.h>
57 57
58 58 #include <inet/ip.h>
59 59 #include <inet/ip6.h>
60 60
61 61 #include <net/pfkeyv2.h>
62 62 #include <net/pfpolicy.h>
63 63 #include <inet/sadb.h>
64 64 #include <inet/ipsec_impl.h>
65 65
66 66 #include <inet/ip_impl.h> /* For IP_MOD_ID */
67 67
68 68 #include <inet/ipsecah.h>
69 69 #include <inet/ipsecesp.h>
70 70 #include <inet/ipdrop.h>
71 71 #include <inet/ipclassifier.h>
72 72 #include <inet/iptun.h>
73 73 #include <inet/iptun/iptun_impl.h>
74 74
75 75 static void ipsec_update_present_flags(ipsec_stack_t *);
76 76 static ipsec_act_t *ipsec_act_wildcard_expand(ipsec_act_t *, uint_t *,
77 77 netstack_t *);
78 78 static mblk_t *ipsec_check_ipsecin_policy(mblk_t *, ipsec_policy_t *,
79 79 ipha_t *, ip6_t *, uint64_t, ip_recv_attr_t *, netstack_t *);
80 80 static void ipsec_action_free_table(ipsec_action_t *);
81 81 static void ipsec_action_reclaim(void *);
82 82 static void ipsec_action_reclaim_stack(ipsec_stack_t *);
83 83 static void ipsid_init(netstack_t *);
84 84 static void ipsid_fini(netstack_t *);
85 85
86 86 /* sel_flags values for ipsec_init_inbound_sel(). */
87 87 #define SEL_NONE 0x0000
88 88 #define SEL_PORT_POLICY 0x0001
89 89 #define SEL_IS_ICMP 0x0002
90 90 #define SEL_TUNNEL_MODE 0x0004
91 91 #define SEL_POST_FRAG 0x0008
92 92
93 93 /* Return values for ipsec_init_inbound_sel(). */
94 94 typedef enum { SELRET_NOMEM, SELRET_BADPKT, SELRET_SUCCESS, SELRET_TUNFRAG}
95 95 selret_t;
96 96
97 97 static selret_t ipsec_init_inbound_sel(ipsec_selector_t *, mblk_t *,
98 98 ipha_t *, ip6_t *, uint8_t);
99 99
100 100 static boolean_t ipsec_check_ipsecin_action(ip_recv_attr_t *, mblk_t *,
101 101 struct ipsec_action_s *, ipha_t *ipha, ip6_t *ip6h, const char **,
102 102 kstat_named_t **, netstack_t *);
103 103 static void ipsec_unregister_prov_update(void);
104 104 static void ipsec_prov_update_callback_stack(uint32_t, void *, netstack_t *);
105 105 static boolean_t ipsec_compare_action(ipsec_policy_t *, ipsec_policy_t *);
106 106 static uint32_t selector_hash(ipsec_selector_t *, ipsec_policy_root_t *);
107 107 static boolean_t ipsec_kstat_init(ipsec_stack_t *);
108 108 static void ipsec_kstat_destroy(ipsec_stack_t *);
109 109 static int ipsec_free_tables(ipsec_stack_t *);
110 110 static int tunnel_compare(const void *, const void *);
111 111 static void ipsec_freemsg_chain(mblk_t *);
112 112 static void ip_drop_packet_chain(mblk_t *, boolean_t, ill_t *,
113 113 struct kstat_named *, ipdropper_t *);
114 114 static boolean_t ipsec_kstat_init(ipsec_stack_t *);
115 115 static void ipsec_kstat_destroy(ipsec_stack_t *);
116 116 static int ipsec_free_tables(ipsec_stack_t *);
117 117 static int tunnel_compare(const void *, const void *);
118 118 static void ipsec_freemsg_chain(mblk_t *);
119 119
120 120 /*
121 121 * Selector hash table is statically sized at module load time.
122 122 * we default to 251 buckets, which is the largest prime number under 255
123 123 */
124 124
125 125 #define IPSEC_SPDHASH_DEFAULT 251
126 126
127 127 /* SPD hash-size tunable per tunnel. */
128 128 #define TUN_SPDHASH_DEFAULT 5
129 129
130 130 uint32_t ipsec_spd_hashsize;
131 131 uint32_t tun_spd_hashsize;
132 132
133 133 #define IPSEC_SEL_NOHASH ((uint32_t)(~0))
134 134
135 135 /*
136 136 * Handle global across all stack instances
137 137 */
138 138 static crypto_notify_handle_t prov_update_handle = NULL;
139 139
140 140 static kmem_cache_t *ipsec_action_cache;
141 141 static kmem_cache_t *ipsec_sel_cache;
142 142 static kmem_cache_t *ipsec_pol_cache;
143 143
144 144 /* Frag cache prototypes */
145 145 static void ipsec_fragcache_clean(ipsec_fragcache_t *, ipsec_stack_t *);
146 146 static ipsec_fragcache_entry_t *fragcache_delentry(int,
147 147 ipsec_fragcache_entry_t *, ipsec_fragcache_t *, ipsec_stack_t *);
148 148 boolean_t ipsec_fragcache_init(ipsec_fragcache_t *);
149 149 void ipsec_fragcache_uninit(ipsec_fragcache_t *, ipsec_stack_t *ipss);
150 150 mblk_t *ipsec_fragcache_add(ipsec_fragcache_t *, mblk_t *, mblk_t *,
151 151 int, ipsec_stack_t *);
152 152
153 153 int ipsec_hdr_pullup_needed = 0;
154 154 int ipsec_weird_null_inbound_policy = 0;
155 155
156 156 #define ALGBITS_ROUND_DOWN(x, align) (((x)/(align))*(align))
157 157 #define ALGBITS_ROUND_UP(x, align) ALGBITS_ROUND_DOWN((x)+(align)-1, align)
158 158
159 159 /*
160 160 * Inbound traffic should have matching identities for both SA's.
161 161 */
162 162
163 163 #define SA_IDS_MATCH(sa1, sa2) \
164 164 (((sa1) == NULL) || ((sa2) == NULL) || \
165 165 (((sa1)->ipsa_src_cid == (sa2)->ipsa_src_cid) && \
166 166 (((sa1)->ipsa_dst_cid == (sa2)->ipsa_dst_cid))))
167 167
168 168 /*
169 169 * IPv6 Fragments
170 170 */
171 171 #define IS_V6_FRAGMENT(ipp) (ipp.ipp_fields & IPPF_FRAGHDR)
172 172
173 173 /*
174 174 * Policy failure messages.
175 175 */
176 176 static char *ipsec_policy_failure_msgs[] = {
177 177
178 178 /* IPSEC_POLICY_NOT_NEEDED */
179 179 "%s: Dropping the datagram because the incoming packet "
180 180 "is %s, but the recipient expects clear; Source %s, "
181 181 "Destination %s.\n",
182 182
183 183 /* IPSEC_POLICY_MISMATCH */
184 184 "%s: Policy Failure for the incoming packet (%s); Source %s, "
185 185 "Destination %s.\n",
186 186
187 187 /* IPSEC_POLICY_AUTH_NOT_NEEDED */
188 188 "%s: Authentication present while not expected in the "
189 189 "incoming %s packet; Source %s, Destination %s.\n",
190 190
191 191 /* IPSEC_POLICY_ENCR_NOT_NEEDED */
192 192 "%s: Encryption present while not expected in the "
193 193 "incoming %s packet; Source %s, Destination %s.\n",
194 194
195 195 /* IPSEC_POLICY_SE_NOT_NEEDED */
196 196 "%s: Self-Encapsulation present while not expected in the "
197 197 "incoming %s packet; Source %s, Destination %s.\n",
198 198 };
199 199
200 200 /*
201 201 * General overviews:
202 202 *
203 203 * Locking:
204 204 *
205 205 * All of the system policy structures are protected by a single
206 206 * rwlock. These structures are threaded in a
207 207 * fairly complex fashion and are not expected to change on a
208 208 * regular basis, so this should not cause scaling/contention
209 209 * problems. As a result, policy checks should (hopefully) be MT-hot.
210 210 *
211 211 * Allocation policy:
212 212 *
213 213 * We use custom kmem cache types for the various
214 214 * bits & pieces of the policy data structures. All allocations
215 215 * use KM_NOSLEEP instead of KM_SLEEP for policy allocation. The
216 216 * policy table is of potentially unbounded size, so we don't
217 217 * want to provide a way to hog all system memory with policy
218 218 * entries..
219 219 */
220 220
221 221 /* Convenient functions for freeing or dropping a b_next linked mblk chain */
222 222
223 223 /* Free all messages in an mblk chain */
224 224 static void
225 225 ipsec_freemsg_chain(mblk_t *mp)
226 226 {
227 227 mblk_t *mpnext;
228 228 while (mp != NULL) {
229 229 ASSERT(mp->b_prev == NULL);
230 230 mpnext = mp->b_next;
231 231 mp->b_next = NULL;
232 232 freemsg(mp);
233 233 mp = mpnext;
234 234 }
235 235 }
236 236
237 237 /*
238 238 * ip_drop all messages in an mblk chain
239 239 * Can handle a b_next chain of ip_recv_attr_t mblks, or just a b_next chain
240 240 * of data.
241 241 */
242 242 static void
243 243 ip_drop_packet_chain(mblk_t *mp, boolean_t inbound, ill_t *ill,
244 244 struct kstat_named *counter, ipdropper_t *who_called)
245 245 {
246 246 mblk_t *mpnext;
247 247 while (mp != NULL) {
248 248 ASSERT(mp->b_prev == NULL);
249 249 mpnext = mp->b_next;
250 250 mp->b_next = NULL;
251 251 if (ip_recv_attr_is_mblk(mp))
252 252 mp = ip_recv_attr_free_mblk(mp);
253 253 ip_drop_packet(mp, inbound, ill, counter, who_called);
254 254 mp = mpnext;
255 255 }
256 256 }
257 257
258 258 /*
259 259 * AVL tree comparison function.
260 260 * the in-kernel avl assumes unique keys for all objects.
261 261 * Since sometimes policy will duplicate rules, we may insert
262 262 * multiple rules with the same rule id, so we need a tie-breaker.
263 263 */
264 264 static int
265 265 ipsec_policy_cmpbyid(const void *a, const void *b)
266 266 {
267 267 const ipsec_policy_t *ipa, *ipb;
268 268 uint64_t idxa, idxb;
269 269
270 270 ipa = (const ipsec_policy_t *)a;
271 271 ipb = (const ipsec_policy_t *)b;
272 272 idxa = ipa->ipsp_index;
273 273 idxb = ipb->ipsp_index;
274 274
275 275 if (idxa < idxb)
276 276 return (-1);
277 277 if (idxa > idxb)
278 278 return (1);
279 279 /*
280 280 * Tie-breaker #1: All installed policy rules have a non-NULL
281 281 * ipsl_sel (selector set), so an entry with a NULL ipsp_sel is not
282 282 * actually in-tree but rather a template node being used in
283 283 * an avl_find query; see ipsec_policy_delete(). This gives us
284 284 * a placeholder in the ordering just before the first entry with
285 285 * a key >= the one we're looking for, so we can walk forward from
286 286 * that point to get the remaining entries with the same id.
287 287 */
288 288 if ((ipa->ipsp_sel == NULL) && (ipb->ipsp_sel != NULL))
289 289 return (-1);
290 290 if ((ipb->ipsp_sel == NULL) && (ipa->ipsp_sel != NULL))
291 291 return (1);
292 292 /*
293 293 * At most one of the arguments to the comparison should have a
294 294 * NULL selector pointer; if not, the tree is broken.
295 295 */
296 296 ASSERT(ipa->ipsp_sel != NULL);
297 297 ASSERT(ipb->ipsp_sel != NULL);
298 298 /*
299 299 * Tie-breaker #2: use the virtual address of the policy node
300 300 * to arbitrarily break ties. Since we use the new tree node in
301 301 * the avl_find() in ipsec_insert_always, the new node will be
302 302 * inserted into the tree in the right place in the sequence.
303 303 */
304 304 if (ipa < ipb)
305 305 return (-1);
306 306 if (ipa > ipb)
307 307 return (1);
308 308 return (0);
309 309 }
310 310
311 311 /*
312 312 * Free what ipsec_alloc_table allocated.
313 313 */
314 314 void
315 315 ipsec_polhead_free_table(ipsec_policy_head_t *iph)
316 316 {
317 317 int dir;
318 318 int i;
319 319
320 320 for (dir = 0; dir < IPSEC_NTYPES; dir++) {
321 321 ipsec_policy_root_t *ipr = &iph->iph_root[dir];
322 322
323 323 if (ipr->ipr_hash == NULL)
324 324 continue;
325 325
326 326 for (i = 0; i < ipr->ipr_nchains; i++) {
327 327 ASSERT(ipr->ipr_hash[i].hash_head == NULL);
328 328 }
329 329 kmem_free(ipr->ipr_hash, ipr->ipr_nchains *
330 330 sizeof (ipsec_policy_hash_t));
331 331 ipr->ipr_hash = NULL;
332 332 }
333 333 }
334 334
335 335 void
336 336 ipsec_polhead_destroy(ipsec_policy_head_t *iph)
337 337 {
338 338 int dir;
339 339
340 340 avl_destroy(&iph->iph_rulebyid);
341 341 rw_destroy(&iph->iph_lock);
342 342
343 343 for (dir = 0; dir < IPSEC_NTYPES; dir++) {
344 344 ipsec_policy_root_t *ipr = &iph->iph_root[dir];
345 345 int chain;
346 346
347 347 for (chain = 0; chain < ipr->ipr_nchains; chain++)
348 348 mutex_destroy(&(ipr->ipr_hash[chain].hash_lock));
349 349
350 350 }
351 351 ipsec_polhead_free_table(iph);
352 352 }
353 353
354 354 /*
355 355 * Free the IPsec stack instance.
356 356 */
357 357 /* ARGSUSED */
358 358 static void
359 359 ipsec_stack_fini(netstackid_t stackid, void *arg)
360 360 {
361 361 ipsec_stack_t *ipss = (ipsec_stack_t *)arg;
362 362 void *cookie;
363 363 ipsec_tun_pol_t *node;
364 364 netstack_t *ns = ipss->ipsec_netstack;
365 365 int i;
366 366 ipsec_algtype_t algtype;
367 367
368 368 ipsec_loader_destroy(ipss);
369 369
370 370 rw_enter(&ipss->ipsec_tunnel_policy_lock, RW_WRITER);
371 371 /*
372 372 * It's possible we can just ASSERT() the tree is empty. After all,
373 373 * we aren't called until IP is ready to unload (and presumably all
374 374 * tunnels have been unplumbed). But we'll play it safe for now, the
375 375 * loop will just exit immediately if it's empty.
376 376 */
377 377 cookie = NULL;
378 378 while ((node = (ipsec_tun_pol_t *)
379 379 avl_destroy_nodes(&ipss->ipsec_tunnel_policies,
380 380 &cookie)) != NULL) {
381 381 ITP_REFRELE(node, ns);
382 382 }
383 383 avl_destroy(&ipss->ipsec_tunnel_policies);
384 384 rw_exit(&ipss->ipsec_tunnel_policy_lock);
385 385 rw_destroy(&ipss->ipsec_tunnel_policy_lock);
386 386
387 387 ipsec_config_flush(ns);
388 388
389 389 ipsec_kstat_destroy(ipss);
390 390
391 391 ip_drop_unregister(&ipss->ipsec_dropper);
392 392
393 393 ip_drop_unregister(&ipss->ipsec_spd_dropper);
394 394 ip_drop_destroy(ipss);
395 395 /*
396 396 * Globals start with ref == 1 to prevent IPPH_REFRELE() from
397 397 * attempting to free them, hence they should have 1 now.
398 398 */
399 399 ipsec_polhead_destroy(&ipss->ipsec_system_policy);
400 400 ASSERT(ipss->ipsec_system_policy.iph_refs == 1);
401 401 ipsec_polhead_destroy(&ipss->ipsec_inactive_policy);
402 402 ASSERT(ipss->ipsec_inactive_policy.iph_refs == 1);
403 403
404 404 for (i = 0; i < IPSEC_ACTION_HASH_SIZE; i++) {
405 405 ipsec_action_free_table(ipss->ipsec_action_hash[i].hash_head);
406 406 ipss->ipsec_action_hash[i].hash_head = NULL;
407 407 mutex_destroy(&(ipss->ipsec_action_hash[i].hash_lock));
408 408 }
409 409
410 410 for (i = 0; i < ipss->ipsec_spd_hashsize; i++) {
411 411 ASSERT(ipss->ipsec_sel_hash[i].hash_head == NULL);
412 412 mutex_destroy(&(ipss->ipsec_sel_hash[i].hash_lock));
413 413 }
414 414
415 415 mutex_enter(&ipss->ipsec_alg_lock);
416 416 for (algtype = 0; algtype < IPSEC_NALGTYPES; algtype ++) {
417 417 int nalgs = ipss->ipsec_nalgs[algtype];
418 418
419 419 for (i = 0; i < nalgs; i++) {
420 420 if (ipss->ipsec_alglists[algtype][i] != NULL)
421 421 ipsec_alg_unreg(algtype, i, ns);
422 422 }
423 423 }
424 424 mutex_exit(&ipss->ipsec_alg_lock);
425 425 mutex_destroy(&ipss->ipsec_alg_lock);
426 426
427 427 ipsid_gc(ns);
428 428 ipsid_fini(ns);
429 429
430 430 (void) ipsec_free_tables(ipss);
431 431 kmem_free(ipss, sizeof (*ipss));
432 432 }
433 433
434 434 void
435 435 ipsec_policy_g_destroy(void)
436 436 {
437 437 kmem_cache_destroy(ipsec_action_cache);
438 438 kmem_cache_destroy(ipsec_sel_cache);
439 439 kmem_cache_destroy(ipsec_pol_cache);
440 440
441 441 ipsec_unregister_prov_update();
442 442
443 443 netstack_unregister(NS_IPSEC);
444 444 }
445 445
446 446
447 447 /*
448 448 * Free what ipsec_alloc_tables allocated.
449 449 * Called when table allocation fails to free the table.
450 450 */
451 451 static int
452 452 ipsec_free_tables(ipsec_stack_t *ipss)
453 453 {
454 454 int i;
455 455
456 456 if (ipss->ipsec_sel_hash != NULL) {
457 457 for (i = 0; i < ipss->ipsec_spd_hashsize; i++) {
458 458 ASSERT(ipss->ipsec_sel_hash[i].hash_head == NULL);
459 459 }
460 460 kmem_free(ipss->ipsec_sel_hash, ipss->ipsec_spd_hashsize *
461 461 sizeof (*ipss->ipsec_sel_hash));
462 462 ipss->ipsec_sel_hash = NULL;
463 463 ipss->ipsec_spd_hashsize = 0;
464 464 }
465 465 ipsec_polhead_free_table(&ipss->ipsec_system_policy);
466 466 ipsec_polhead_free_table(&ipss->ipsec_inactive_policy);
467 467
468 468 return (ENOMEM);
469 469 }
470 470
471 471 /*
472 472 * Attempt to allocate the tables in a single policy head.
473 473 * Return nonzero on failure after cleaning up any work in progress.
474 474 */
475 475 int
476 476 ipsec_alloc_table(ipsec_policy_head_t *iph, int nchains, int kmflag,
477 477 boolean_t global_cleanup, netstack_t *ns)
478 478 {
479 479 int dir;
480 480
481 481 for (dir = 0; dir < IPSEC_NTYPES; dir++) {
482 482 ipsec_policy_root_t *ipr = &iph->iph_root[dir];
483 483
484 484 ipr->ipr_nchains = nchains;
485 485 ipr->ipr_hash = kmem_zalloc(nchains *
486 486 sizeof (ipsec_policy_hash_t), kmflag);
487 487 if (ipr->ipr_hash == NULL)
488 488 return (global_cleanup ?
489 489 ipsec_free_tables(ns->netstack_ipsec) :
490 490 ENOMEM);
491 491 }
492 492 return (0);
493 493 }
494 494
495 495 /*
496 496 * Attempt to allocate the various tables. Return nonzero on failure
497 497 * after cleaning up any work in progress.
498 498 */
499 499 static int
500 500 ipsec_alloc_tables(int kmflag, netstack_t *ns)
501 501 {
502 502 int error;
503 503 ipsec_stack_t *ipss = ns->netstack_ipsec;
504 504
505 505 error = ipsec_alloc_table(&ipss->ipsec_system_policy,
506 506 ipss->ipsec_spd_hashsize, kmflag, B_TRUE, ns);
507 507 if (error != 0)
508 508 return (error);
509 509
510 510 error = ipsec_alloc_table(&ipss->ipsec_inactive_policy,
511 511 ipss->ipsec_spd_hashsize, kmflag, B_TRUE, ns);
512 512 if (error != 0)
513 513 return (error);
514 514
515 515 ipss->ipsec_sel_hash = kmem_zalloc(ipss->ipsec_spd_hashsize *
516 516 sizeof (*ipss->ipsec_sel_hash), kmflag);
517 517
518 518 if (ipss->ipsec_sel_hash == NULL)
519 519 return (ipsec_free_tables(ipss));
520 520
521 521 return (0);
522 522 }
523 523
524 524 /*
525 525 * After table allocation, initialize a policy head.
526 526 */
527 527 void
528 528 ipsec_polhead_init(ipsec_policy_head_t *iph, int nchains)
529 529 {
530 530 int dir, chain;
531 531
532 532 rw_init(&iph->iph_lock, NULL, RW_DEFAULT, NULL);
533 533 avl_create(&iph->iph_rulebyid, ipsec_policy_cmpbyid,
534 534 sizeof (ipsec_policy_t), offsetof(ipsec_policy_t, ipsp_byid));
535 535
536 536 for (dir = 0; dir < IPSEC_NTYPES; dir++) {
537 537 ipsec_policy_root_t *ipr = &iph->iph_root[dir];
538 538 ipr->ipr_nchains = nchains;
539 539
540 540 for (chain = 0; chain < nchains; chain++) {
541 541 mutex_init(&(ipr->ipr_hash[chain].hash_lock),
542 542 NULL, MUTEX_DEFAULT, NULL);
543 543 }
544 544 }
545 545 }
546 546
547 547 static boolean_t
548 548 ipsec_kstat_init(ipsec_stack_t *ipss)
549 549 {
550 550 ipss->ipsec_ksp = kstat_create_netstack("ip", 0, "ipsec_stat", "net",
551 551 KSTAT_TYPE_NAMED, sizeof (ipsec_kstats_t) / sizeof (kstat_named_t),
552 552 KSTAT_FLAG_PERSISTENT, ipss->ipsec_netstack->netstack_stackid);
553 553
554 554 if (ipss->ipsec_ksp == NULL || ipss->ipsec_ksp->ks_data == NULL)
555 555 return (B_FALSE);
556 556
557 557 ipss->ipsec_kstats = ipss->ipsec_ksp->ks_data;
558 558
559 559 #define KI(x) kstat_named_init(&ipss->ipsec_kstats->x, #x, KSTAT_DATA_UINT64)
560 560 KI(esp_stat_in_requests);
561 561 KI(esp_stat_in_discards);
562 562 KI(esp_stat_lookup_failure);
563 563 KI(ah_stat_in_requests);
564 564 KI(ah_stat_in_discards);
565 565 KI(ah_stat_lookup_failure);
566 566 KI(sadb_acquire_maxpackets);
567 567 KI(sadb_acquire_qhiwater);
568 568 #undef KI
569 569
570 570 kstat_install(ipss->ipsec_ksp);
571 571 return (B_TRUE);
572 572 }
573 573
574 574 static void
575 575 ipsec_kstat_destroy(ipsec_stack_t *ipss)
576 576 {
577 577 kstat_delete_netstack(ipss->ipsec_ksp,
578 578 ipss->ipsec_netstack->netstack_stackid);
579 579 ipss->ipsec_kstats = NULL;
580 580
581 581 }
582 582
583 583 /*
584 584 * Initialize the IPsec stack instance.
585 585 */
586 586 /* ARGSUSED */
587 587 static void *
588 588 ipsec_stack_init(netstackid_t stackid, netstack_t *ns)
589 589 {
590 590 ipsec_stack_t *ipss;
591 591 int i;
592 592
593 593 ipss = (ipsec_stack_t *)kmem_zalloc(sizeof (*ipss), KM_SLEEP);
594 594 ipss->ipsec_netstack = ns;
595 595
596 596 /*
597 597 * FIXME: netstack_ipsec is used by some of the routines we call
598 598 * below, but it isn't set until this routine returns.
599 599 * Either we introduce optional xxx_stack_alloc() functions
600 600 * that will be called by the netstack framework before xxx_stack_init,
601 601 * or we switch spd.c and sadb.c to operate on ipsec_stack_t
602 602 * (latter has some include file order issues for sadb.h, but makes
603 603 * sense if we merge some of the ipsec related stack_t's together.
604 604 */
605 605 ns->netstack_ipsec = ipss;
606 606
607 607 /*
608 608 * Make two attempts to allocate policy hash tables; try it at
609 609 * the "preferred" size (may be set in /etc/system) first,
610 610 * then fall back to the default size.
611 611 */
612 612 ipss->ipsec_spd_hashsize = (ipsec_spd_hashsize == 0) ?
613 613 IPSEC_SPDHASH_DEFAULT : ipsec_spd_hashsize;
614 614
615 615 if (ipsec_alloc_tables(KM_NOSLEEP, ns) != 0) {
616 616 cmn_err(CE_WARN,
617 617 "Unable to allocate %d entry IPsec policy hash table",
618 618 ipss->ipsec_spd_hashsize);
619 619 ipss->ipsec_spd_hashsize = IPSEC_SPDHASH_DEFAULT;
620 620 cmn_err(CE_WARN, "Falling back to %d entries",
621 621 ipss->ipsec_spd_hashsize);
622 622 (void) ipsec_alloc_tables(KM_SLEEP, ns);
623 623 }
624 624
625 625 /* Just set a default for tunnels. */
626 626 ipss->ipsec_tun_spd_hashsize = (tun_spd_hashsize == 0) ?
627 627 TUN_SPDHASH_DEFAULT : tun_spd_hashsize;
628 628
629 629 ipsid_init(ns);
630 630 /*
631 631 * Globals need ref == 1 to prevent IPPH_REFRELE() from attempting
632 632 * to free them.
633 633 */
634 634 ipss->ipsec_system_policy.iph_refs = 1;
635 635 ipss->ipsec_inactive_policy.iph_refs = 1;
636 636 ipsec_polhead_init(&ipss->ipsec_system_policy,
637 637 ipss->ipsec_spd_hashsize);
638 638 ipsec_polhead_init(&ipss->ipsec_inactive_policy,
639 639 ipss->ipsec_spd_hashsize);
640 640 rw_init(&ipss->ipsec_tunnel_policy_lock, NULL, RW_DEFAULT, NULL);
641 641 avl_create(&ipss->ipsec_tunnel_policies, tunnel_compare,
642 642 sizeof (ipsec_tun_pol_t), 0);
643 643
644 644 ipss->ipsec_next_policy_index = 1;
645 645
646 646 rw_init(&ipss->ipsec_system_policy.iph_lock, NULL, RW_DEFAULT, NULL);
647 647 rw_init(&ipss->ipsec_inactive_policy.iph_lock, NULL, RW_DEFAULT, NULL);
648 648
649 649 for (i = 0; i < IPSEC_ACTION_HASH_SIZE; i++)
650 650 mutex_init(&(ipss->ipsec_action_hash[i].hash_lock),
651 651 NULL, MUTEX_DEFAULT, NULL);
652 652
653 653 for (i = 0; i < ipss->ipsec_spd_hashsize; i++)
654 654 mutex_init(&(ipss->ipsec_sel_hash[i].hash_lock),
655 655 NULL, MUTEX_DEFAULT, NULL);
656 656
657 657 mutex_init(&ipss->ipsec_alg_lock, NULL, MUTEX_DEFAULT, NULL);
658 658 for (i = 0; i < IPSEC_NALGTYPES; i++) {
659 659 ipss->ipsec_nalgs[i] = 0;
660 660 }
661 661
662 662 ip_drop_init(ipss);
663 663 ip_drop_register(&ipss->ipsec_spd_dropper, "IPsec SPD");
664 664
665 665 /* IP's IPsec code calls the packet dropper */
666 666 ip_drop_register(&ipss->ipsec_dropper, "IP IPsec processing");
667 667
668 668 (void) ipsec_kstat_init(ipss);
669 669
670 670 ipsec_loader_init(ipss);
671 671 ipsec_loader_start(ipss);
672 672
673 673 return (ipss);
674 674 }
675 675
676 676 /* Global across all stack instances */
677 677 void
678 678 ipsec_policy_g_init(void)
679 679 {
680 680 ipsec_action_cache = kmem_cache_create("ipsec_actions",
681 681 sizeof (ipsec_action_t), _POINTER_ALIGNMENT, NULL, NULL,
682 682 ipsec_action_reclaim, NULL, NULL, 0);
683 683 ipsec_sel_cache = kmem_cache_create("ipsec_selectors",
684 684 sizeof (ipsec_sel_t), _POINTER_ALIGNMENT, NULL, NULL,
685 685 NULL, NULL, NULL, 0);
686 686 ipsec_pol_cache = kmem_cache_create("ipsec_policy",
687 687 sizeof (ipsec_policy_t), _POINTER_ALIGNMENT, NULL, NULL,
688 688 NULL, NULL, NULL, 0);
689 689
690 690 /*
691 691 * We want to be informed each time a stack is created or
692 692 * destroyed in the kernel, so we can maintain the
693 693 * set of ipsec_stack_t's.
694 694 */
695 695 netstack_register(NS_IPSEC, ipsec_stack_init, NULL, ipsec_stack_fini);
696 696 }
697 697
698 698 /*
699 699 * Sort algorithm lists.
700 700 *
701 701 * I may need to split this based on
702 702 * authentication/encryption, and I may wish to have an administrator
703 703 * configure this list. Hold on to some NDD variables...
704 704 *
705 705 * XXX For now, sort on minimum key size (GAG!). While minimum key size is
706 706 * not the ideal metric, it's the only quantifiable measure available.
707 707 * We need a better metric for sorting algorithms by preference.
708 708 */
709 709 static void
710 710 alg_insert_sortlist(enum ipsec_algtype at, uint8_t algid, netstack_t *ns)
711 711 {
712 712 ipsec_stack_t *ipss = ns->netstack_ipsec;
713 713 ipsec_alginfo_t *ai = ipss->ipsec_alglists[at][algid];
714 714 uint8_t holder, swap;
715 715 uint_t i;
716 716 uint_t count = ipss->ipsec_nalgs[at];
717 717 ASSERT(ai != NULL);
718 718 ASSERT(algid == ai->alg_id);
719 719
720 720 ASSERT(MUTEX_HELD(&ipss->ipsec_alg_lock));
721 721
722 722 holder = algid;
723 723
724 724 for (i = 0; i < count - 1; i++) {
725 725 ipsec_alginfo_t *alt;
726 726
727 727 alt = ipss->ipsec_alglists[at][ipss->ipsec_sortlist[at][i]];
728 728 /*
729 729 * If you want to give precedence to newly added algs,
730 730 * add the = in the > comparison.
731 731 */
732 732 if ((holder != algid) || (ai->alg_minbits > alt->alg_minbits)) {
733 733 /* Swap sortlist[i] and holder. */
734 734 swap = ipss->ipsec_sortlist[at][i];
735 735 ipss->ipsec_sortlist[at][i] = holder;
736 736 holder = swap;
737 737 ai = alt;
738 738 } /* Else just continue. */
739 739 }
740 740
741 741 /* Store holder in last slot. */
742 742 ipss->ipsec_sortlist[at][i] = holder;
743 743 }
744 744
745 745 /*
746 746 * Remove an algorithm from a sorted algorithm list.
747 747 * This should be considerably easier, even with complex sorting.
748 748 */
749 749 static void
750 750 alg_remove_sortlist(enum ipsec_algtype at, uint8_t algid, netstack_t *ns)
751 751 {
752 752 boolean_t copyback = B_FALSE;
753 753 int i;
754 754 ipsec_stack_t *ipss = ns->netstack_ipsec;
755 755 int newcount = ipss->ipsec_nalgs[at];
756 756
757 757 ASSERT(MUTEX_HELD(&ipss->ipsec_alg_lock));
758 758
759 759 for (i = 0; i <= newcount; i++) {
760 760 if (copyback) {
761 761 ipss->ipsec_sortlist[at][i-1] =
762 762 ipss->ipsec_sortlist[at][i];
763 763 } else if (ipss->ipsec_sortlist[at][i] == algid) {
764 764 copyback = B_TRUE;
765 765 }
766 766 }
767 767 }
768 768
769 769 /*
770 770 * Add the specified algorithm to the algorithm tables.
771 771 * Must be called while holding the algorithm table writer lock.
772 772 */
773 773 void
774 774 ipsec_alg_reg(ipsec_algtype_t algtype, ipsec_alginfo_t *alg, netstack_t *ns)
775 775 {
776 776 ipsec_stack_t *ipss = ns->netstack_ipsec;
777 777
778 778 ASSERT(MUTEX_HELD(&ipss->ipsec_alg_lock));
779 779
780 780 ASSERT(ipss->ipsec_alglists[algtype][alg->alg_id] == NULL);
781 781 ipsec_alg_fix_min_max(alg, algtype, ns);
782 782 ipss->ipsec_alglists[algtype][alg->alg_id] = alg;
783 783
784 784 ipss->ipsec_nalgs[algtype]++;
785 785 alg_insert_sortlist(algtype, alg->alg_id, ns);
786 786 }
787 787
788 788 /*
789 789 * Remove the specified algorithm from the algorithm tables.
790 790 * Must be called while holding the algorithm table writer lock.
791 791 */
792 792 void
793 793 ipsec_alg_unreg(ipsec_algtype_t algtype, uint8_t algid, netstack_t *ns)
794 794 {
795 795 ipsec_stack_t *ipss = ns->netstack_ipsec;
796 796
797 797 ASSERT(MUTEX_HELD(&ipss->ipsec_alg_lock));
798 798
799 799 ASSERT(ipss->ipsec_alglists[algtype][algid] != NULL);
800 800 ipsec_alg_free(ipss->ipsec_alglists[algtype][algid]);
801 801 ipss->ipsec_alglists[algtype][algid] = NULL;
802 802
803 803 ipss->ipsec_nalgs[algtype]--;
804 804 alg_remove_sortlist(algtype, algid, ns);
805 805 }
806 806
807 807 /*
808 808 * Hooks for spdsock to get a grip on system policy.
809 809 */
810 810
811 811 ipsec_policy_head_t *
812 812 ipsec_system_policy(netstack_t *ns)
813 813 {
814 814 ipsec_stack_t *ipss = ns->netstack_ipsec;
815 815 ipsec_policy_head_t *h = &ipss->ipsec_system_policy;
816 816
817 817 IPPH_REFHOLD(h);
818 818 return (h);
819 819 }
820 820
821 821 ipsec_policy_head_t *
822 822 ipsec_inactive_policy(netstack_t *ns)
823 823 {
824 824 ipsec_stack_t *ipss = ns->netstack_ipsec;
825 825 ipsec_policy_head_t *h = &ipss->ipsec_inactive_policy;
826 826
827 827 IPPH_REFHOLD(h);
828 828 return (h);
829 829 }
830 830
831 831 /*
832 832 * Lock inactive policy, then active policy, then exchange policy root
833 833 * pointers.
834 834 */
835 835 void
836 836 ipsec_swap_policy(ipsec_policy_head_t *active, ipsec_policy_head_t *inactive,
837 837 netstack_t *ns)
838 838 {
839 839 int af, dir;
840 840 avl_tree_t r1, r2;
841 841
842 842 rw_enter(&inactive->iph_lock, RW_WRITER);
843 843 rw_enter(&active->iph_lock, RW_WRITER);
844 844
845 845 r1 = active->iph_rulebyid;
846 846 r2 = inactive->iph_rulebyid;
847 847 active->iph_rulebyid = r2;
848 848 inactive->iph_rulebyid = r1;
849 849
850 850 for (dir = 0; dir < IPSEC_NTYPES; dir++) {
851 851 ipsec_policy_hash_t *h1, *h2;
852 852
853 853 h1 = active->iph_root[dir].ipr_hash;
854 854 h2 = inactive->iph_root[dir].ipr_hash;
855 855 active->iph_root[dir].ipr_hash = h2;
856 856 inactive->iph_root[dir].ipr_hash = h1;
857 857
858 858 for (af = 0; af < IPSEC_NAF; af++) {
859 859 ipsec_policy_t *t1, *t2;
860 860
861 861 t1 = active->iph_root[dir].ipr_nonhash[af];
862 862 t2 = inactive->iph_root[dir].ipr_nonhash[af];
863 863 active->iph_root[dir].ipr_nonhash[af] = t2;
864 864 inactive->iph_root[dir].ipr_nonhash[af] = t1;
865 865 if (t1 != NULL) {
866 866 t1->ipsp_hash.hash_pp =
867 867 &(inactive->iph_root[dir].ipr_nonhash[af]);
868 868 }
869 869 if (t2 != NULL) {
870 870 t2->ipsp_hash.hash_pp =
871 871 &(active->iph_root[dir].ipr_nonhash[af]);
872 872 }
873 873
874 874 }
875 875 }
876 876 active->iph_gen++;
877 877 inactive->iph_gen++;
878 878 ipsec_update_present_flags(ns->netstack_ipsec);
879 879 rw_exit(&active->iph_lock);
880 880 rw_exit(&inactive->iph_lock);
881 881 }
882 882
883 883 /*
884 884 * Swap global policy primary/secondary.
885 885 */
886 886 void
887 887 ipsec_swap_global_policy(netstack_t *ns)
888 888 {
889 889 ipsec_stack_t *ipss = ns->netstack_ipsec;
890 890
891 891 ipsec_swap_policy(&ipss->ipsec_system_policy,
892 892 &ipss->ipsec_inactive_policy, ns);
893 893 }
894 894
895 895 /*
896 896 * Clone one policy rule..
897 897 */
898 898 static ipsec_policy_t *
899 899 ipsec_copy_policy(const ipsec_policy_t *src)
900 900 {
901 901 ipsec_policy_t *dst = kmem_cache_alloc(ipsec_pol_cache, KM_NOSLEEP);
902 902
903 903 if (dst == NULL)
904 904 return (NULL);
905 905
906 906 /*
907 907 * Adjust refcounts of cloned state.
908 908 */
909 909 IPACT_REFHOLD(src->ipsp_act);
910 910 src->ipsp_sel->ipsl_refs++;
911 911
912 912 HASH_NULL(dst, ipsp_hash);
913 913 dst->ipsp_netstack = src->ipsp_netstack;
914 914 dst->ipsp_refs = 1;
915 915 dst->ipsp_sel = src->ipsp_sel;
916 916 dst->ipsp_act = src->ipsp_act;
917 917 dst->ipsp_prio = src->ipsp_prio;
918 918 dst->ipsp_index = src->ipsp_index;
919 919
920 920 return (dst);
921 921 }
922 922
923 923 void
924 924 ipsec_insert_always(avl_tree_t *tree, void *new_node)
925 925 {
926 926 void *node;
927 927 avl_index_t where;
928 928
929 929 node = avl_find(tree, new_node, &where);
930 930 ASSERT(node == NULL);
931 931 avl_insert(tree, new_node, where);
932 932 }
933 933
934 934
935 935 static int
936 936 ipsec_copy_chain(ipsec_policy_head_t *dph, ipsec_policy_t *src,
937 937 ipsec_policy_t **dstp)
938 938 {
939 939 for (; src != NULL; src = src->ipsp_hash.hash_next) {
940 940 ipsec_policy_t *dst = ipsec_copy_policy(src);
941 941 if (dst == NULL)
942 942 return (ENOMEM);
943 943
944 944 HASHLIST_INSERT(dst, ipsp_hash, *dstp);
945 945 ipsec_insert_always(&dph->iph_rulebyid, dst);
946 946 }
947 947 return (0);
948 948 }
949 949
950 950
951 951
952 952 /*
953 953 * Make one policy head look exactly like another.
954 954 *
955 955 * As with ipsec_swap_policy, we lock the destination policy head first, then
956 956 * the source policy head. Note that we only need to read-lock the source
957 957 * policy head as we are not changing it.
958 958 */
959 959 int
960 960 ipsec_copy_polhead(ipsec_policy_head_t *sph, ipsec_policy_head_t *dph,
961 961 netstack_t *ns)
962 962 {
963 963 int af, dir, chain, nchains;
964 964
965 965 rw_enter(&dph->iph_lock, RW_WRITER);
966 966
967 967 ipsec_polhead_flush(dph, ns);
968 968
969 969 rw_enter(&sph->iph_lock, RW_READER);
970 970
971 971 for (dir = 0; dir < IPSEC_NTYPES; dir++) {
972 972 ipsec_policy_root_t *dpr = &dph->iph_root[dir];
973 973 ipsec_policy_root_t *spr = &sph->iph_root[dir];
974 974 nchains = dpr->ipr_nchains;
975 975
976 976 ASSERT(dpr->ipr_nchains == spr->ipr_nchains);
977 977
978 978 for (af = 0; af < IPSEC_NAF; af++) {
979 979 if (ipsec_copy_chain(dph, spr->ipr_nonhash[af],
980 980 &dpr->ipr_nonhash[af]))
981 981 goto abort_copy;
982 982 }
983 983
984 984 for (chain = 0; chain < nchains; chain++) {
985 985 if (ipsec_copy_chain(dph,
986 986 spr->ipr_hash[chain].hash_head,
987 987 &dpr->ipr_hash[chain].hash_head))
988 988 goto abort_copy;
989 989 }
990 990 }
991 991
992 992 dph->iph_gen++;
993 993
994 994 rw_exit(&sph->iph_lock);
995 995 rw_exit(&dph->iph_lock);
996 996 return (0);
997 997
998 998 abort_copy:
999 999 ipsec_polhead_flush(dph, ns);
1000 1000 rw_exit(&sph->iph_lock);
1001 1001 rw_exit(&dph->iph_lock);
1002 1002 return (ENOMEM);
1003 1003 }
1004 1004
1005 1005 /*
1006 1006 * Clone currently active policy to the inactive policy list.
1007 1007 */
1008 1008 int
1009 1009 ipsec_clone_system_policy(netstack_t *ns)
1010 1010 {
1011 1011 ipsec_stack_t *ipss = ns->netstack_ipsec;
1012 1012
1013 1013 return (ipsec_copy_polhead(&ipss->ipsec_system_policy,
1014 1014 &ipss->ipsec_inactive_policy, ns));
1015 1015 }
1016 1016
1017 1017 /*
1018 1018 * Extract the string from ipsec_policy_failure_msgs[type] and
1019 1019 * log it.
1020 1020 *
1021 1021 */
1022 1022 void
1023 1023 ipsec_log_policy_failure(int type, char *func_name, ipha_t *ipha, ip6_t *ip6h,
1024 1024 boolean_t secure, netstack_t *ns)
1025 1025 {
1026 1026 char sbuf[INET6_ADDRSTRLEN];
1027 1027 char dbuf[INET6_ADDRSTRLEN];
1028 1028 char *s;
1029 1029 char *d;
1030 1030 ipsec_stack_t *ipss = ns->netstack_ipsec;
1031 1031
1032 1032 ASSERT((ipha == NULL && ip6h != NULL) ||
1033 1033 (ip6h == NULL && ipha != NULL));
1034 1034
1035 1035 if (ipha != NULL) {
1036 1036 s = inet_ntop(AF_INET, &ipha->ipha_src, sbuf, sizeof (sbuf));
1037 1037 d = inet_ntop(AF_INET, &ipha->ipha_dst, dbuf, sizeof (dbuf));
1038 1038 } else {
1039 1039 s = inet_ntop(AF_INET6, &ip6h->ip6_src, sbuf, sizeof (sbuf));
1040 1040 d = inet_ntop(AF_INET6, &ip6h->ip6_dst, dbuf, sizeof (dbuf));
1041 1041
1042 1042 }
1043 1043
1044 1044 /* Always bump the policy failure counter. */
1045 1045 ipss->ipsec_policy_failure_count[type]++;
1046 1046
1047 1047 ipsec_rl_strlog(ns, IP_MOD_ID, 0, 0, SL_ERROR|SL_WARN|SL_CONSOLE,
1048 1048 ipsec_policy_failure_msgs[type], func_name,
1049 1049 (secure ? "secure" : "not secure"), s, d);
1050 1050 }
1051 1051
1052 1052 /*
1053 1053 * Rate-limiting front-end to strlog() for AH and ESP. Uses the ndd variables
1054 1054 * in /dev/ip and the same rate-limiting clock so that there's a single
1055 1055 * knob to turn to throttle the rate of messages.
1056 1056 */
1057 1057 void
1058 1058 ipsec_rl_strlog(netstack_t *ns, short mid, short sid, char level, ushort_t sl,
1059 1059 char *fmt, ...)
1060 1060 {
1061 1061 va_list adx;
1062 1062 hrtime_t current = gethrtime();
1063 1063 ip_stack_t *ipst = ns->netstack_ip;
1064 1064 ipsec_stack_t *ipss = ns->netstack_ipsec;
1065 1065
1066 1066 sl |= SL_CONSOLE;
1067 1067 /*
1068 1068 * Throttle logging to stop syslog from being swamped. If variable
1069 1069 * 'ipsec_policy_log_interval' is zero, don't log any messages at
1070 1070 * all, otherwise log only one message every 'ipsec_policy_log_interval'
1071 1071 * msec. Convert interval (in msec) to hrtime (in nsec).
1072 1072 */
1073 1073
1074 1074 if (ipst->ips_ipsec_policy_log_interval) {
1075 1075 if (ipss->ipsec_policy_failure_last +
1076 1076 MSEC2NSEC(ipst->ips_ipsec_policy_log_interval) <= current) {
1077 1077 va_start(adx, fmt);
1078 1078 (void) vstrlog(mid, sid, level, sl, fmt, adx);
1079 1079 va_end(adx);
1080 1080 ipss->ipsec_policy_failure_last = current;
1081 1081 }
1082 1082 }
1083 1083 }
1084 1084
1085 1085 void
1086 1086 ipsec_config_flush(netstack_t *ns)
1087 1087 {
1088 1088 ipsec_stack_t *ipss = ns->netstack_ipsec;
1089 1089
1090 1090 rw_enter(&ipss->ipsec_system_policy.iph_lock, RW_WRITER);
1091 1091 ipsec_polhead_flush(&ipss->ipsec_system_policy, ns);
1092 1092 ipss->ipsec_next_policy_index = 1;
1093 1093 rw_exit(&ipss->ipsec_system_policy.iph_lock);
1094 1094 ipsec_action_reclaim_stack(ipss);
1095 1095 }
1096 1096
1097 1097 /*
1098 1098 * Clip a policy's min/max keybits vs. the capabilities of the
1099 1099 * algorithm.
1100 1100 */
1101 1101 static void
1102 1102 act_alg_adjust(uint_t algtype, uint_t algid,
1103 1103 uint16_t *minbits, uint16_t *maxbits, netstack_t *ns)
1104 1104 {
1105 1105 ipsec_stack_t *ipss = ns->netstack_ipsec;
1106 1106 ipsec_alginfo_t *algp = ipss->ipsec_alglists[algtype][algid];
1107 1107
1108 1108 if (algp != NULL) {
1109 1109 /*
1110 1110 * If passed-in minbits is zero, we assume the caller trusts
1111 1111 * us with setting the minimum key size. We pick the
1112 1112 * algorithms DEFAULT key size for the minimum in this case.
1113 1113 */
1114 1114 if (*minbits == 0) {
1115 1115 *minbits = algp->alg_default_bits;
1116 1116 ASSERT(*minbits >= algp->alg_minbits);
1117 1117 } else {
1118 1118 *minbits = MAX(MIN(*minbits, algp->alg_maxbits),
1119 1119 algp->alg_minbits);
1120 1120 }
1121 1121 if (*maxbits == 0)
1122 1122 *maxbits = algp->alg_maxbits;
1123 1123 else
1124 1124 *maxbits = MIN(MAX(*maxbits, algp->alg_minbits),
1125 1125 algp->alg_maxbits);
1126 1126 ASSERT(*minbits <= *maxbits);
1127 1127 } else {
1128 1128 *minbits = 0;
1129 1129 *maxbits = 0;
1130 1130 }
1131 1131 }
1132 1132
1133 1133 /*
1134 1134 * Check an action's requested algorithms against the algorithms currently
1135 1135 * loaded in the system.
1136 1136 */
1137 1137 boolean_t
1138 1138 ipsec_check_action(ipsec_act_t *act, int *diag, netstack_t *ns)
1139 1139 {
1140 1140 ipsec_prot_t *ipp;
1141 1141 ipsec_stack_t *ipss = ns->netstack_ipsec;
1142 1142
1143 1143 ipp = &act->ipa_apply;
1144 1144
1145 1145 if (ipp->ipp_use_ah &&
1146 1146 ipss->ipsec_alglists[IPSEC_ALG_AUTH][ipp->ipp_auth_alg] == NULL) {
1147 1147 *diag = SPD_DIAGNOSTIC_UNSUPP_AH_ALG;
1148 1148 return (B_FALSE);
1149 1149 }
1150 1150 if (ipp->ipp_use_espa &&
1151 1151 ipss->ipsec_alglists[IPSEC_ALG_AUTH][ipp->ipp_esp_auth_alg] ==
1152 1152 NULL) {
1153 1153 *diag = SPD_DIAGNOSTIC_UNSUPP_ESP_AUTH_ALG;
1154 1154 return (B_FALSE);
1155 1155 }
1156 1156 if (ipp->ipp_use_esp &&
1157 1157 ipss->ipsec_alglists[IPSEC_ALG_ENCR][ipp->ipp_encr_alg] == NULL) {
1158 1158 *diag = SPD_DIAGNOSTIC_UNSUPP_ESP_ENCR_ALG;
1159 1159 return (B_FALSE);
1160 1160 }
1161 1161
1162 1162 act_alg_adjust(IPSEC_ALG_AUTH, ipp->ipp_auth_alg,
1163 1163 &ipp->ipp_ah_minbits, &ipp->ipp_ah_maxbits, ns);
1164 1164 act_alg_adjust(IPSEC_ALG_AUTH, ipp->ipp_esp_auth_alg,
1165 1165 &ipp->ipp_espa_minbits, &ipp->ipp_espa_maxbits, ns);
1166 1166 act_alg_adjust(IPSEC_ALG_ENCR, ipp->ipp_encr_alg,
1167 1167 &ipp->ipp_espe_minbits, &ipp->ipp_espe_maxbits, ns);
1168 1168
1169 1169 if (ipp->ipp_ah_minbits > ipp->ipp_ah_maxbits) {
1170 1170 *diag = SPD_DIAGNOSTIC_UNSUPP_AH_KEYSIZE;
1171 1171 return (B_FALSE);
1172 1172 }
1173 1173 if (ipp->ipp_espa_minbits > ipp->ipp_espa_maxbits) {
1174 1174 *diag = SPD_DIAGNOSTIC_UNSUPP_ESP_AUTH_KEYSIZE;
1175 1175 return (B_FALSE);
1176 1176 }
1177 1177 if (ipp->ipp_espe_minbits > ipp->ipp_espe_maxbits) {
1178 1178 *diag = SPD_DIAGNOSTIC_UNSUPP_ESP_ENCR_KEYSIZE;
1179 1179 return (B_FALSE);
1180 1180 }
1181 1181 /* TODO: sanity check lifetimes */
1182 1182 return (B_TRUE);
1183 1183 }
1184 1184
1185 1185 /*
1186 1186 * Set up a single action during wildcard expansion..
1187 1187 */
1188 1188 static void
1189 1189 ipsec_setup_act(ipsec_act_t *outact, ipsec_act_t *act,
1190 1190 uint_t auth_alg, uint_t encr_alg, uint_t eauth_alg, netstack_t *ns)
1191 1191 {
1192 1192 ipsec_prot_t *ipp;
1193 1193
1194 1194 *outact = *act;
1195 1195 ipp = &outact->ipa_apply;
1196 1196 ipp->ipp_auth_alg = (uint8_t)auth_alg;
1197 1197 ipp->ipp_encr_alg = (uint8_t)encr_alg;
1198 1198 ipp->ipp_esp_auth_alg = (uint8_t)eauth_alg;
1199 1199
1200 1200 act_alg_adjust(IPSEC_ALG_AUTH, auth_alg,
1201 1201 &ipp->ipp_ah_minbits, &ipp->ipp_ah_maxbits, ns);
1202 1202 act_alg_adjust(IPSEC_ALG_AUTH, eauth_alg,
1203 1203 &ipp->ipp_espa_minbits, &ipp->ipp_espa_maxbits, ns);
1204 1204 act_alg_adjust(IPSEC_ALG_ENCR, encr_alg,
1205 1205 &ipp->ipp_espe_minbits, &ipp->ipp_espe_maxbits, ns);
1206 1206 }
1207 1207
1208 1208 /*
1209 1209 * combinatoric expansion time: expand a wildcarded action into an
1210 1210 * array of wildcarded actions; we return the exploded action list,
1211 1211 * and return a count in *nact (output only).
1212 1212 */
1213 1213 static ipsec_act_t *
1214 1214 ipsec_act_wildcard_expand(ipsec_act_t *act, uint_t *nact, netstack_t *ns)
1215 1215 {
1216 1216 boolean_t use_ah, use_esp, use_espa;
1217 1217 boolean_t wild_auth, wild_encr, wild_eauth;
1218 1218 uint_t auth_alg, auth_idx, auth_min, auth_max;
1219 1219 uint_t eauth_alg, eauth_idx, eauth_min, eauth_max;
1220 1220 uint_t encr_alg, encr_idx, encr_min, encr_max;
1221 1221 uint_t action_count, ai;
1222 1222 ipsec_act_t *outact;
1223 1223 ipsec_stack_t *ipss = ns->netstack_ipsec;
1224 1224
1225 1225 if (act->ipa_type != IPSEC_ACT_APPLY) {
1226 1226 outact = kmem_alloc(sizeof (*act), KM_NOSLEEP);
1227 1227 *nact = 1;
1228 1228 if (outact != NULL)
1229 1229 bcopy(act, outact, sizeof (*act));
1230 1230 return (outact);
1231 1231 }
1232 1232 /*
1233 1233 * compute the combinatoric explosion..
1234 1234 *
1235 1235 * we assume a request for encr if esp_req is PREF_REQUIRED
1236 1236 * we assume a request for ah auth if ah_req is PREF_REQUIRED.
1237 1237 * we assume a request for esp auth if !ah and esp_req is PREF_REQUIRED
1238 1238 */
1239 1239
1240 1240 use_ah = act->ipa_apply.ipp_use_ah;
1241 1241 use_esp = act->ipa_apply.ipp_use_esp;
1242 1242 use_espa = act->ipa_apply.ipp_use_espa;
1243 1243 auth_alg = act->ipa_apply.ipp_auth_alg;
1244 1244 eauth_alg = act->ipa_apply.ipp_esp_auth_alg;
1245 1245 encr_alg = act->ipa_apply.ipp_encr_alg;
1246 1246
1247 1247 wild_auth = use_ah && (auth_alg == 0);
1248 1248 wild_eauth = use_espa && (eauth_alg == 0);
1249 1249 wild_encr = use_esp && (encr_alg == 0);
1250 1250
1251 1251 action_count = 1;
1252 1252 auth_min = auth_max = auth_alg;
1253 1253 eauth_min = eauth_max = eauth_alg;
1254 1254 encr_min = encr_max = encr_alg;
1255 1255
1256 1256 /*
1257 1257 * set up for explosion.. for each dimension, expand output
1258 1258 * size by the explosion factor.
1259 1259 *
1260 1260 * Don't include the "any" algorithms, if defined, as no
1261 1261 * kernel policies should be set for these algorithms.
1262 1262 */
1263 1263
1264 1264 #define SET_EXP_MINMAX(type, wild, alg, min, max, ipss) \
1265 1265 if (wild) { \
1266 1266 int nalgs = ipss->ipsec_nalgs[type]; \
1267 1267 if (ipss->ipsec_alglists[type][alg] != NULL) \
1268 1268 nalgs--; \
1269 1269 action_count *= nalgs; \
1270 1270 min = 0; \
1271 1271 max = ipss->ipsec_nalgs[type] - 1; \
1272 1272 }
1273 1273
1274 1274 SET_EXP_MINMAX(IPSEC_ALG_AUTH, wild_auth, SADB_AALG_NONE,
1275 1275 auth_min, auth_max, ipss);
1276 1276 SET_EXP_MINMAX(IPSEC_ALG_AUTH, wild_eauth, SADB_AALG_NONE,
1277 1277 eauth_min, eauth_max, ipss);
1278 1278 SET_EXP_MINMAX(IPSEC_ALG_ENCR, wild_encr, SADB_EALG_NONE,
1279 1279 encr_min, encr_max, ipss);
1280 1280
1281 1281 #undef SET_EXP_MINMAX
1282 1282
1283 1283 /*
1284 1284 * ok, allocate the whole mess..
1285 1285 */
1286 1286
1287 1287 outact = kmem_alloc(sizeof (*outact) * action_count, KM_NOSLEEP);
1288 1288 if (outact == NULL)
1289 1289 return (NULL);
1290 1290
1291 1291 /*
1292 1292 * Now compute all combinations. Note that non-wildcarded
1293 1293 * dimensions just get a single value from auth_min, while
1294 1294 * wildcarded dimensions indirect through the sortlist.
1295 1295 *
1296 1296 * We do encryption outermost since, at this time, there's
1297 1297 * greater difference in security and performance between
1298 1298 * encryption algorithms vs. authentication algorithms.
1299 1299 */
1300 1300
1301 1301 ai = 0;
1302 1302
1303 1303 #define WHICH_ALG(type, wild, idx, ipss) \
1304 1304 ((wild)?(ipss->ipsec_sortlist[type][idx]):(idx))
1305 1305
1306 1306 for (encr_idx = encr_min; encr_idx <= encr_max; encr_idx++) {
1307 1307 encr_alg = WHICH_ALG(IPSEC_ALG_ENCR, wild_encr, encr_idx, ipss);
1308 1308 if (wild_encr && encr_alg == SADB_EALG_NONE)
1309 1309 continue;
1310 1310 for (auth_idx = auth_min; auth_idx <= auth_max; auth_idx++) {
1311 1311 auth_alg = WHICH_ALG(IPSEC_ALG_AUTH, wild_auth,
1312 1312 auth_idx, ipss);
1313 1313 if (wild_auth && auth_alg == SADB_AALG_NONE)
1314 1314 continue;
1315 1315 for (eauth_idx = eauth_min; eauth_idx <= eauth_max;
1316 1316 eauth_idx++) {
1317 1317 eauth_alg = WHICH_ALG(IPSEC_ALG_AUTH,
1318 1318 wild_eauth, eauth_idx, ipss);
1319 1319 if (wild_eauth && eauth_alg == SADB_AALG_NONE)
1320 1320 continue;
1321 1321
1322 1322 ipsec_setup_act(&outact[ai], act,
1323 1323 auth_alg, encr_alg, eauth_alg, ns);
1324 1324 ai++;
1325 1325 }
1326 1326 }
1327 1327 }
1328 1328
1329 1329 #undef WHICH_ALG
1330 1330
1331 1331 ASSERT(ai == action_count);
1332 1332 *nact = action_count;
1333 1333 return (outact);
1334 1334 }
1335 1335
1336 1336 /*
1337 1337 * Extract the parts of an ipsec_prot_t from an old-style ipsec_req_t.
1338 1338 */
1339 1339 static void
1340 1340 ipsec_prot_from_req(const ipsec_req_t *req, ipsec_prot_t *ipp)
1341 1341 {
1342 1342 bzero(ipp, sizeof (*ipp));
1343 1343 /*
1344 1344 * ipp_use_* are bitfields. Look at "!!" in the following as a
1345 1345 * "boolean canonicalization" operator.
1346 1346 */
1347 1347 ipp->ipp_use_ah = !!(req->ipsr_ah_req & IPSEC_PREF_REQUIRED);
1348 1348 ipp->ipp_use_esp = !!(req->ipsr_esp_req & IPSEC_PREF_REQUIRED);
1349 1349 ipp->ipp_use_espa = !!(req->ipsr_esp_auth_alg);
1350 1350 ipp->ipp_use_se = !!(req->ipsr_self_encap_req & IPSEC_PREF_REQUIRED);
1351 1351 ipp->ipp_use_unique = !!((req->ipsr_ah_req|req->ipsr_esp_req) &
1352 1352 IPSEC_PREF_UNIQUE);
1353 1353 ipp->ipp_encr_alg = req->ipsr_esp_alg;
1354 1354 /*
1355 1355 * SADB_AALG_ANY is a placeholder to distinguish "any" from
1356 1356 * "none" above. If auth is required, as determined above,
1357 1357 * SADB_AALG_ANY becomes 0, which is the representation
1358 1358 * of "any" and "none" in PF_KEY v2.
1359 1359 */
1360 1360 ipp->ipp_auth_alg = (req->ipsr_auth_alg != SADB_AALG_ANY) ?
1361 1361 req->ipsr_auth_alg : 0;
1362 1362 ipp->ipp_esp_auth_alg = (req->ipsr_esp_auth_alg != SADB_AALG_ANY) ?
1363 1363 req->ipsr_esp_auth_alg : 0;
1364 1364 }
1365 1365
1366 1366 /*
1367 1367 * Extract a new-style action from a request.
1368 1368 */
1369 1369 void
1370 1370 ipsec_actvec_from_req(const ipsec_req_t *req, ipsec_act_t **actp, uint_t *nactp,
1371 1371 netstack_t *ns)
1372 1372 {
1373 1373 struct ipsec_act act;
1374 1374
1375 1375 bzero(&act, sizeof (act));
1376 1376 if ((req->ipsr_ah_req & IPSEC_PREF_NEVER) &&
1377 1377 (req->ipsr_esp_req & IPSEC_PREF_NEVER)) {
1378 1378 act.ipa_type = IPSEC_ACT_BYPASS;
1379 1379 } else {
1380 1380 act.ipa_type = IPSEC_ACT_APPLY;
1381 1381 ipsec_prot_from_req(req, &act.ipa_apply);
1382 1382 }
1383 1383 *actp = ipsec_act_wildcard_expand(&act, nactp, ns);
1384 1384 }
1385 1385
1386 1386 /*
1387 1387 * Convert a new-style "prot" back to an ipsec_req_t (more backwards compat).
1388 1388 * We assume caller has already zero'ed *req for us.
1389 1389 */
1390 1390 static int
1391 1391 ipsec_req_from_prot(ipsec_prot_t *ipp, ipsec_req_t *req)
1392 1392 {
1393 1393 req->ipsr_esp_alg = ipp->ipp_encr_alg;
1394 1394 req->ipsr_auth_alg = ipp->ipp_auth_alg;
1395 1395 req->ipsr_esp_auth_alg = ipp->ipp_esp_auth_alg;
1396 1396
1397 1397 if (ipp->ipp_use_unique) {
1398 1398 req->ipsr_ah_req |= IPSEC_PREF_UNIQUE;
1399 1399 req->ipsr_esp_req |= IPSEC_PREF_UNIQUE;
1400 1400 }
1401 1401 if (ipp->ipp_use_se)
1402 1402 req->ipsr_self_encap_req |= IPSEC_PREF_REQUIRED;
1403 1403 if (ipp->ipp_use_ah)
1404 1404 req->ipsr_ah_req |= IPSEC_PREF_REQUIRED;
1405 1405 if (ipp->ipp_use_esp)
1406 1406 req->ipsr_esp_req |= IPSEC_PREF_REQUIRED;
1407 1407 return (sizeof (*req));
1408 1408 }
1409 1409
1410 1410 /*
1411 1411 * Convert a new-style action back to an ipsec_req_t (more backwards compat).
1412 1412 * We assume caller has already zero'ed *req for us.
1413 1413 */
1414 1414 static int
1415 1415 ipsec_req_from_act(ipsec_action_t *ap, ipsec_req_t *req)
1416 1416 {
1417 1417 switch (ap->ipa_act.ipa_type) {
1418 1418 case IPSEC_ACT_BYPASS:
1419 1419 req->ipsr_ah_req = IPSEC_PREF_NEVER;
1420 1420 req->ipsr_esp_req = IPSEC_PREF_NEVER;
1421 1421 return (sizeof (*req));
1422 1422 case IPSEC_ACT_APPLY:
1423 1423 return (ipsec_req_from_prot(&ap->ipa_act.ipa_apply, req));
1424 1424 }
1425 1425 return (sizeof (*req));
1426 1426 }
1427 1427
1428 1428 /*
1429 1429 * Convert a new-style action back to an ipsec_req_t (more backwards compat).
1430 1430 * We assume caller has already zero'ed *req for us.
1431 1431 */
1432 1432 int
1433 1433 ipsec_req_from_head(ipsec_policy_head_t *ph, ipsec_req_t *req, int af)
1434 1434 {
1435 1435 ipsec_policy_t *p;
1436 1436
1437 1437 /*
1438 1438 * FULL-PERSOCK: consult hash table, too?
1439 1439 */
1440 1440 for (p = ph->iph_root[IPSEC_INBOUND].ipr_nonhash[af];
1441 1441 p != NULL;
1442 1442 p = p->ipsp_hash.hash_next) {
1443 1443 if ((p->ipsp_sel->ipsl_key.ipsl_valid & IPSL_WILDCARD) == 0)
1444 1444 return (ipsec_req_from_act(p->ipsp_act, req));
1445 1445 }
1446 1446 return (sizeof (*req));
1447 1447 }
1448 1448
1449 1449 /*
1450 1450 * Based on per-socket or latched policy, convert to an appropriate
1451 1451 * IP_SEC_OPT ipsec_req_t for the socket option; return size so we can
1452 1452 * be tail-called from ip.
1453 1453 */
1454 1454 int
1455 1455 ipsec_req_from_conn(conn_t *connp, ipsec_req_t *req, int af)
1456 1456 {
1457 1457 ipsec_latch_t *ipl;
1458 1458 int rv = sizeof (ipsec_req_t);
1459 1459
1460 1460 bzero(req, sizeof (*req));
1461 1461
1462 1462 ASSERT(MUTEX_HELD(&connp->conn_lock));
1463 1463 ipl = connp->conn_latch;
1464 1464
1465 1465 /*
1466 1466 * Find appropriate policy. First choice is latched action;
1467 1467 * failing that, see latched policy; failing that,
1468 1468 * look at configured policy.
1469 1469 */
1470 1470 if (ipl != NULL) {
1471 1471 if (connp->conn_latch_in_action != NULL) {
1472 1472 rv = ipsec_req_from_act(connp->conn_latch_in_action,
1473 1473 req);
1474 1474 goto done;
1475 1475 }
1476 1476 if (connp->conn_latch_in_policy != NULL) {
1477 1477 rv = ipsec_req_from_act(
1478 1478 connp->conn_latch_in_policy->ipsp_act, req);
1479 1479 goto done;
1480 1480 }
1481 1481 }
1482 1482 if (connp->conn_policy != NULL)
1483 1483 rv = ipsec_req_from_head(connp->conn_policy, req, af);
1484 1484 done:
1485 1485 return (rv);
1486 1486 }
1487 1487
1488 1488 void
1489 1489 ipsec_actvec_free(ipsec_act_t *act, uint_t nact)
1490 1490 {
1491 1491 kmem_free(act, nact * sizeof (*act));
1492 1492 }
1493 1493
1494 1494 /*
1495 1495 * Consumes a reference to ipsp.
1496 1496 */
1497 1497 static mblk_t *
1498 1498 ipsec_check_loopback_policy(mblk_t *data_mp, ip_recv_attr_t *ira,
1499 1499 ipsec_policy_t *ipsp)
1500 1500 {
1501 1501 if (!(ira->ira_flags & IRAF_IPSEC_SECURE))
1502 1502 return (data_mp);
1503 1503
1504 1504 ASSERT(ira->ira_flags & IRAF_LOOPBACK);
1505 1505
1506 1506 IPPOL_REFRELE(ipsp);
1507 1507
1508 1508 /*
1509 1509 * We should do an actual policy check here. Revisit this
1510 1510 * when we revisit the IPsec API. (And pass a conn_t in when we
1511 1511 * get there.)
1512 1512 */
1513 1513
1514 1514 return (data_mp);
1515 1515 }
1516 1516
1517 1517 /*
1518 1518 * Check that packet's inbound ports & proto match the selectors
1519 1519 * expected by the SAs it traversed on the way in.
1520 1520 */
1521 1521 static boolean_t
1522 1522 ipsec_check_ipsecin_unique(ip_recv_attr_t *ira, const char **reason,
1523 1523 kstat_named_t **counter, uint64_t pkt_unique, netstack_t *ns)
1524 1524 {
1525 1525 uint64_t ah_mask, esp_mask;
1526 1526 ipsa_t *ah_assoc;
1527 1527 ipsa_t *esp_assoc;
1528 1528 ipsec_stack_t *ipss = ns->netstack_ipsec;
1529 1529
1530 1530 ASSERT(ira->ira_flags & IRAF_IPSEC_SECURE);
1531 1531 ASSERT(!(ira->ira_flags & IRAF_LOOPBACK));
1532 1532
1533 1533 ah_assoc = ira->ira_ipsec_ah_sa;
1534 1534 esp_assoc = ira->ira_ipsec_esp_sa;
1535 1535 ASSERT((ah_assoc != NULL) || (esp_assoc != NULL));
1536 1536
1537 1537 ah_mask = (ah_assoc != NULL) ? ah_assoc->ipsa_unique_mask : 0;
1538 1538 esp_mask = (esp_assoc != NULL) ? esp_assoc->ipsa_unique_mask : 0;
1539 1539
1540 1540 if ((ah_mask == 0) && (esp_mask == 0))
1541 1541 return (B_TRUE);
1542 1542
1543 1543 /*
1544 1544 * The pkt_unique check will also check for tunnel mode on the SA
1545 1545 * vs. the tunneled_packet boolean. "Be liberal in what you receive"
1546 1546 * should not apply in this case. ;)
1547 1547 */
1548 1548
1549 1549 if (ah_mask != 0 &&
1550 1550 ah_assoc->ipsa_unique_id != (pkt_unique & ah_mask)) {
1551 1551 *reason = "AH inner header mismatch";
1552 1552 *counter = DROPPER(ipss, ipds_spd_ah_innermismatch);
1553 1553 return (B_FALSE);
1554 1554 }
1555 1555 if (esp_mask != 0 &&
1556 1556 esp_assoc->ipsa_unique_id != (pkt_unique & esp_mask)) {
1557 1557 *reason = "ESP inner header mismatch";
1558 1558 *counter = DROPPER(ipss, ipds_spd_esp_innermismatch);
1559 1559 return (B_FALSE);
1560 1560 }
1561 1561 return (B_TRUE);
1562 1562 }
1563 1563
1564 1564 static boolean_t
1565 1565 ipsec_check_ipsecin_action(ip_recv_attr_t *ira, mblk_t *mp, ipsec_action_t *ap,
1566 1566 ipha_t *ipha, ip6_t *ip6h, const char **reason, kstat_named_t **counter,
1567 1567 netstack_t *ns)
1568 1568 {
1569 1569 boolean_t ret = B_TRUE;
1570 1570 ipsec_prot_t *ipp;
1571 1571 ipsa_t *ah_assoc;
1572 1572 ipsa_t *esp_assoc;
1573 1573 boolean_t decaps;
1574 1574 ipsec_stack_t *ipss = ns->netstack_ipsec;
1575 1575
1576 1576 ASSERT((ipha == NULL && ip6h != NULL) ||
1577 1577 (ip6h == NULL && ipha != NULL));
1578 1578
1579 1579 if (ira->ira_flags & IRAF_LOOPBACK) {
1580 1580 /*
1581 1581 * Besides accepting pointer-equivalent actions, we also
1582 1582 * accept any ICMP errors we generated for ourselves,
1583 1583 * regardless of policy. If we do not wish to make this
1584 1584 * assumption in the future, check here, and where
1585 1585 * IXAF_TRUSTED_ICMP is initialized in ip.c and ip6.c.
1586 1586 */
1587 1587 if (ap == ira->ira_ipsec_action ||
1588 1588 (ira->ira_flags & IRAF_TRUSTED_ICMP))
1589 1589 return (B_TRUE);
1590 1590
1591 1591 /* Deep compare necessary here?? */
1592 1592 *counter = DROPPER(ipss, ipds_spd_loopback_mismatch);
1593 1593 *reason = "loopback policy mismatch";
1594 1594 return (B_FALSE);
1595 1595 }
1596 1596 ASSERT(!(ira->ira_flags & IRAF_TRUSTED_ICMP));
1597 1597 ASSERT(ira->ira_flags & IRAF_IPSEC_SECURE);
1598 1598
1599 1599 ah_assoc = ira->ira_ipsec_ah_sa;
1600 1600 esp_assoc = ira->ira_ipsec_esp_sa;
1601 1601
1602 1602 decaps = (ira->ira_flags & IRAF_IPSEC_DECAPS);
1603 1603
1604 1604 switch (ap->ipa_act.ipa_type) {
1605 1605 case IPSEC_ACT_DISCARD:
1606 1606 case IPSEC_ACT_REJECT:
1607 1607 /* Should "fail hard" */
1608 1608 *counter = DROPPER(ipss, ipds_spd_explicit);
1609 1609 *reason = "blocked by policy";
1610 1610 return (B_FALSE);
1611 1611
1612 1612 case IPSEC_ACT_BYPASS:
1613 1613 case IPSEC_ACT_CLEAR:
1614 1614 *counter = DROPPER(ipss, ipds_spd_got_secure);
1615 1615 *reason = "expected clear, got protected";
1616 1616 return (B_FALSE);
1617 1617
1618 1618 case IPSEC_ACT_APPLY:
1619 1619 ipp = &ap->ipa_act.ipa_apply;
1620 1620 /*
1621 1621 * As of now we do the simple checks of whether
1622 1622 * the datagram has gone through the required IPSEC
1623 1623 * protocol constraints or not. We might have more
1624 1624 * in the future like sensitive levels, key bits, etc.
1625 1625 * If it fails the constraints, check whether we would
1626 1626 * have accepted this if it had come in clear.
1627 1627 */
1628 1628 if (ipp->ipp_use_ah) {
1629 1629 if (ah_assoc == NULL) {
1630 1630 ret = ipsec_inbound_accept_clear(mp, ipha,
1631 1631 ip6h);
1632 1632 *counter = DROPPER(ipss, ipds_spd_got_clear);
1633 1633 *reason = "unprotected not accepted";
1634 1634 break;
1635 1635 }
1636 1636 ASSERT(ah_assoc != NULL);
1637 1637 ASSERT(ipp->ipp_auth_alg != 0);
1638 1638
1639 1639 if (ah_assoc->ipsa_auth_alg !=
1640 1640 ipp->ipp_auth_alg) {
1641 1641 *counter = DROPPER(ipss, ipds_spd_bad_ahalg);
1642 1642 *reason = "unacceptable ah alg";
1643 1643 ret = B_FALSE;
1644 1644 break;
1645 1645 }
1646 1646 } else if (ah_assoc != NULL) {
1647 1647 /*
1648 1648 * Don't allow this. Check IPSEC NOTE above
1649 1649 * ip_fanout_proto().
1650 1650 */
1651 1651 *counter = DROPPER(ipss, ipds_spd_got_ah);
1652 1652 *reason = "unexpected AH";
1653 1653 ret = B_FALSE;
1654 1654 break;
1655 1655 }
1656 1656 if (ipp->ipp_use_esp) {
1657 1657 if (esp_assoc == NULL) {
1658 1658 ret = ipsec_inbound_accept_clear(mp, ipha,
1659 1659 ip6h);
1660 1660 *counter = DROPPER(ipss, ipds_spd_got_clear);
1661 1661 *reason = "unprotected not accepted";
1662 1662 break;
1663 1663 }
1664 1664 ASSERT(esp_assoc != NULL);
1665 1665 ASSERT(ipp->ipp_encr_alg != 0);
1666 1666
1667 1667 if (esp_assoc->ipsa_encr_alg !=
1668 1668 ipp->ipp_encr_alg) {
1669 1669 *counter = DROPPER(ipss, ipds_spd_bad_espealg);
1670 1670 *reason = "unacceptable esp alg";
1671 1671 ret = B_FALSE;
1672 1672 break;
1673 1673 }
1674 1674 /*
1675 1675 * If the client does not need authentication,
1676 1676 * we don't verify the alogrithm.
1677 1677 */
1678 1678 if (ipp->ipp_use_espa) {
1679 1679 if (esp_assoc->ipsa_auth_alg !=
1680 1680 ipp->ipp_esp_auth_alg) {
1681 1681 *counter = DROPPER(ipss,
1682 1682 ipds_spd_bad_espaalg);
1683 1683 *reason = "unacceptable esp auth alg";
1684 1684 ret = B_FALSE;
1685 1685 break;
1686 1686 }
1687 1687 }
1688 1688 } else if (esp_assoc != NULL) {
1689 1689 /*
1690 1690 * Don't allow this. Check IPSEC NOTE above
1691 1691 * ip_fanout_proto().
1692 1692 */
1693 1693 *counter = DROPPER(ipss, ipds_spd_got_esp);
1694 1694 *reason = "unexpected ESP";
1695 1695 ret = B_FALSE;
1696 1696 break;
1697 1697 }
1698 1698 if (ipp->ipp_use_se) {
1699 1699 if (!decaps) {
1700 1700 ret = ipsec_inbound_accept_clear(mp, ipha,
1701 1701 ip6h);
1702 1702 if (!ret) {
1703 1703 /* XXX mutant? */
1704 1704 *counter = DROPPER(ipss,
1705 1705 ipds_spd_bad_selfencap);
1706 1706 *reason = "self encap not found";
1707 1707 break;
1708 1708 }
1709 1709 }
1710 1710 } else if (decaps) {
1711 1711 /*
1712 1712 * XXX If the packet comes in tunneled and the
1713 1713 * recipient does not expect it to be tunneled, it
1714 1714 * is okay. But we drop to be consistent with the
1715 1715 * other cases.
1716 1716 */
1717 1717 *counter = DROPPER(ipss, ipds_spd_got_selfencap);
1718 1718 *reason = "unexpected self encap";
1719 1719 ret = B_FALSE;
1720 1720 break;
1721 1721 }
1722 1722 if (ira->ira_ipsec_action != NULL) {
1723 1723 /*
1724 1724 * This can happen if we do a double policy-check on
1725 1725 * a packet
1726 1726 * XXX XXX should fix this case!
1727 1727 */
1728 1728 IPACT_REFRELE(ira->ira_ipsec_action);
1729 1729 }
1730 1730 ASSERT(ira->ira_flags & IRAF_IPSEC_SECURE);
1731 1731 ASSERT(ira->ira_ipsec_action == NULL);
1732 1732 IPACT_REFHOLD(ap);
1733 1733 ira->ira_ipsec_action = ap;
1734 1734 break; /* from switch */
1735 1735 }
1736 1736 return (ret);
1737 1737 }
1738 1738
1739 1739 static boolean_t
1740 1740 spd_match_inbound_ids(ipsec_latch_t *ipl, ipsa_t *sa)
1741 1741 {
1742 1742 ASSERT(ipl->ipl_ids_latched == B_TRUE);
1743 1743 return ipsid_equal(ipl->ipl_remote_cid, sa->ipsa_src_cid) &&
1744 1744 ipsid_equal(ipl->ipl_local_cid, sa->ipsa_dst_cid);
1745 1745 }
1746 1746
1747 1747 /*
1748 1748 * Takes a latched conn and an inbound packet and returns a unique_id suitable
1749 1749 * for SA comparisons. Most of the time we will copy from the conn_t, but
1750 1750 * there are cases when the conn_t is latched but it has wildcard selectors,
1751 1751 * and then we need to fallback to scooping them out of the packet.
1752 1752 *
1753 1753 * Assume we'll never have 0 with a conn_t present, so use 0 as a failure. We
1754 1754 * can get away with this because we only have non-zero ports/proto for
1755 1755 * latched conn_ts.
1756 1756 *
1757 1757 * Ideal candidate for an "inline" keyword, as we're JUST convoluted enough
1758 1758 * to not be a nice macro.
1759 1759 */
1760 1760 static uint64_t
1761 1761 conn_to_unique(conn_t *connp, mblk_t *data_mp, ipha_t *ipha, ip6_t *ip6h)
1762 1762 {
1763 1763 ipsec_selector_t sel;
1764 1764 uint8_t ulp = connp->conn_proto;
1765 1765
1766 1766 ASSERT(connp->conn_latch_in_policy != NULL);
1767 1767
1768 1768 if ((ulp == IPPROTO_TCP || ulp == IPPROTO_UDP || ulp == IPPROTO_SCTP) &&
1769 1769 (connp->conn_fport == 0 || connp->conn_lport == 0)) {
1770 1770 /* Slow path - we gotta grab from the packet. */
1771 1771 if (ipsec_init_inbound_sel(&sel, data_mp, ipha, ip6h,
1772 1772 SEL_NONE) != SELRET_SUCCESS) {
1773 1773 /* Failure -> have caller free packet with ENOMEM. */
1774 1774 return (0);
1775 1775 }
1776 1776 return (SA_UNIQUE_ID(sel.ips_remote_port, sel.ips_local_port,
1777 1777 sel.ips_protocol, 0));
1778 1778 }
1779 1779
1780 1780 #ifdef DEBUG_NOT_UNTIL_6478464
1781 1781 if (ipsec_init_inbound_sel(&sel, data_mp, ipha, ip6h, SEL_NONE) ==
1782 1782 SELRET_SUCCESS) {
1783 1783 ASSERT(sel.ips_local_port == connp->conn_lport);
1784 1784 ASSERT(sel.ips_remote_port == connp->conn_fport);
1785 1785 ASSERT(sel.ips_protocol == connp->conn_proto);
1786 1786 }
1787 1787 ASSERT(connp->conn_proto != 0);
1788 1788 #endif
1789 1789
1790 1790 return (SA_UNIQUE_ID(connp->conn_fport, connp->conn_lport, ulp, 0));
1791 1791 }
1792 1792
1793 1793 /*
1794 1794 * Called to check policy on a latched connection.
1795 1795 * Note that we don't dereference conn_latch or conn_ihere since the conn might
1796 1796 * be closing. The caller passes a held ipsec_latch_t instead.
1797 1797 */
1798 1798 static boolean_t
1799 1799 ipsec_check_ipsecin_latch(ip_recv_attr_t *ira, mblk_t *mp, ipsec_latch_t *ipl,
1800 1800 ipsec_action_t *ap, ipha_t *ipha, ip6_t *ip6h, const char **reason,
1801 1801 kstat_named_t **counter, conn_t *connp, netstack_t *ns)
1802 1802 {
1803 1803 ipsec_stack_t *ipss = ns->netstack_ipsec;
1804 1804
1805 1805 ASSERT(ipl->ipl_ids_latched == B_TRUE);
1806 1806 ASSERT(ira->ira_flags & IRAF_IPSEC_SECURE);
1807 1807
1808 1808 if (!(ira->ira_flags & IRAF_LOOPBACK)) {
1809 1809 /*
1810 1810 * Over loopback, there aren't real security associations,
1811 1811 * so there are neither identities nor "unique" values
1812 1812 * for us to check the packet against.
1813 1813 */
1814 1814 if (ira->ira_ipsec_ah_sa != NULL) {
1815 1815 if (!spd_match_inbound_ids(ipl,
1816 1816 ira->ira_ipsec_ah_sa)) {
1817 1817 *counter = DROPPER(ipss, ipds_spd_ah_badid);
1818 1818 *reason = "AH identity mismatch";
1819 1819 return (B_FALSE);
1820 1820 }
1821 1821 }
1822 1822
1823 1823 if (ira->ira_ipsec_esp_sa != NULL) {
1824 1824 if (!spd_match_inbound_ids(ipl,
1825 1825 ira->ira_ipsec_esp_sa)) {
1826 1826 *counter = DROPPER(ipss, ipds_spd_esp_badid);
1827 1827 *reason = "ESP identity mismatch";
1828 1828 return (B_FALSE);
1829 1829 }
1830 1830 }
1831 1831
1832 1832 /*
1833 1833 * Can fudge pkt_unique from connp because we're latched.
1834 1834 * In DEBUG kernels (see conn_to_unique()'s implementation),
1835 1835 * verify this even if it REALLY slows things down.
1836 1836 */
1837 1837 if (!ipsec_check_ipsecin_unique(ira, reason, counter,
1838 1838 conn_to_unique(connp, mp, ipha, ip6h), ns)) {
1839 1839 return (B_FALSE);
1840 1840 }
1841 1841 }
1842 1842 return (ipsec_check_ipsecin_action(ira, mp, ap, ipha, ip6h, reason,
1843 1843 counter, ns));
1844 1844 }
1845 1845
1846 1846 /*
1847 1847 * Check to see whether this secured datagram meets the policy
1848 1848 * constraints specified in ipsp.
1849 1849 *
1850 1850 * Called from ipsec_check_global_policy, and ipsec_check_inbound_policy.
1851 1851 *
1852 1852 * Consumes a reference to ipsp.
1853 1853 * Returns the mblk if ok.
1854 1854 */
1855 1855 static mblk_t *
1856 1856 ipsec_check_ipsecin_policy(mblk_t *data_mp, ipsec_policy_t *ipsp,
1857 1857 ipha_t *ipha, ip6_t *ip6h, uint64_t pkt_unique, ip_recv_attr_t *ira,
1858 1858 netstack_t *ns)
1859 1859 {
1860 1860 ipsec_action_t *ap;
1861 1861 const char *reason = "no policy actions found";
1862 1862 ip_stack_t *ipst = ns->netstack_ip;
1863 1863 ipsec_stack_t *ipss = ns->netstack_ipsec;
1864 1864 kstat_named_t *counter;
1865 1865
1866 1866 counter = DROPPER(ipss, ipds_spd_got_secure);
1867 1867
1868 1868 ASSERT(ipsp != NULL);
1869 1869
1870 1870 ASSERT((ipha == NULL && ip6h != NULL) ||
1871 1871 (ip6h == NULL && ipha != NULL));
1872 1872
1873 1873 if (ira->ira_flags & IRAF_LOOPBACK)
1874 1874 return (ipsec_check_loopback_policy(data_mp, ira, ipsp));
1875 1875
1876 1876 ASSERT(ira->ira_flags & IRAF_IPSEC_SECURE);
1877 1877
1878 1878 if (ira->ira_ipsec_action != NULL) {
1879 1879 /*
1880 1880 * this can happen if we do a double policy-check on a packet
1881 1881 * Would be nice to be able to delete this test..
1882 1882 */
1883 1883 IPACT_REFRELE(ira->ira_ipsec_action);
1884 1884 }
1885 1885 ASSERT(ira->ira_ipsec_action == NULL);
1886 1886
1887 1887 if (!SA_IDS_MATCH(ira->ira_ipsec_ah_sa, ira->ira_ipsec_esp_sa)) {
1888 1888 reason = "inbound AH and ESP identities differ";
1889 1889 counter = DROPPER(ipss, ipds_spd_ahesp_diffid);
1890 1890 goto drop;
1891 1891 }
1892 1892
1893 1893 if (!ipsec_check_ipsecin_unique(ira, &reason, &counter, pkt_unique,
1894 1894 ns))
1895 1895 goto drop;
1896 1896
1897 1897 /*
1898 1898 * Ok, now loop through the possible actions and see if any
1899 1899 * of them work for us.
1900 1900 */
1901 1901
1902 1902 for (ap = ipsp->ipsp_act; ap != NULL; ap = ap->ipa_next) {
1903 1903 if (ipsec_check_ipsecin_action(ira, data_mp, ap,
1904 1904 ipha, ip6h, &reason, &counter, ns)) {
1905 1905 BUMP_MIB(&ipst->ips_ip_mib, ipsecInSucceeded);
1906 1906 IPPOL_REFRELE(ipsp);
1907 1907 return (data_mp);
1908 1908 }
1909 1909 }
1910 1910 drop:
1911 1911 ipsec_rl_strlog(ns, IP_MOD_ID, 0, 0, SL_ERROR|SL_WARN|SL_CONSOLE,
1912 1912 "ipsec inbound policy mismatch: %s, packet dropped\n",
1913 1913 reason);
1914 1914 IPPOL_REFRELE(ipsp);
1915 1915 ASSERT(ira->ira_ipsec_action == NULL);
1916 1916 BUMP_MIB(&ipst->ips_ip_mib, ipsecInFailed);
1917 1917 ip_drop_packet(data_mp, B_TRUE, NULL, counter,
1918 1918 &ipss->ipsec_spd_dropper);
1919 1919 return (NULL);
1920 1920 }
1921 1921
1922 1922 /*
1923 1923 * sleazy prefix-length-based compare.
1924 1924 * another inlining candidate..
1925 1925 */
1926 1926 boolean_t
1927 1927 ip_addr_match(uint8_t *addr1, int pfxlen, in6_addr_t *addr2p)
1928 1928 {
1929 1929 int offset = pfxlen>>3;
1930 1930 int bitsleft = pfxlen & 7;
1931 1931 uint8_t *addr2 = (uint8_t *)addr2p;
1932 1932
1933 1933 /*
1934 1934 * and there was much evil..
1935 1935 * XXX should inline-expand the bcmp here and do this 32 bits
1936 1936 * or 64 bits at a time..
1937 1937 */
1938 1938 return ((bcmp(addr1, addr2, offset) == 0) &&
1939 1939 ((bitsleft == 0) ||
1940 1940 (((addr1[offset] ^ addr2[offset]) & (0xff<<(8-bitsleft))) == 0)));
1941 1941 }
1942 1942
1943 1943 static ipsec_policy_t *
1944 1944 ipsec_find_policy_chain(ipsec_policy_t *best, ipsec_policy_t *chain,
1945 1945 ipsec_selector_t *sel, boolean_t is_icmp_inv_acq)
1946 1946 {
1947 1947 ipsec_selkey_t *isel;
1948 1948 ipsec_policy_t *p;
1949 1949 int bpri = best ? best->ipsp_prio : 0;
1950 1950
1951 1951 for (p = chain; p != NULL; p = p->ipsp_hash.hash_next) {
1952 1952 uint32_t valid;
1953 1953
1954 1954 if (p->ipsp_prio <= bpri)
1955 1955 continue;
1956 1956 isel = &p->ipsp_sel->ipsl_key;
1957 1957 valid = isel->ipsl_valid;
1958 1958
1959 1959 if ((valid & IPSL_PROTOCOL) &&
1960 1960 (isel->ipsl_proto != sel->ips_protocol))
1961 1961 continue;
1962 1962
1963 1963 if ((valid & IPSL_REMOTE_ADDR) &&
1964 1964 !ip_addr_match((uint8_t *)&isel->ipsl_remote,
1965 1965 isel->ipsl_remote_pfxlen, &sel->ips_remote_addr_v6))
1966 1966 continue;
1967 1967
1968 1968 if ((valid & IPSL_LOCAL_ADDR) &&
1969 1969 !ip_addr_match((uint8_t *)&isel->ipsl_local,
1970 1970 isel->ipsl_local_pfxlen, &sel->ips_local_addr_v6))
1971 1971 continue;
1972 1972
1973 1973 if ((valid & IPSL_REMOTE_PORT) &&
1974 1974 isel->ipsl_rport != sel->ips_remote_port)
1975 1975 continue;
1976 1976
1977 1977 if ((valid & IPSL_LOCAL_PORT) &&
1978 1978 isel->ipsl_lport != sel->ips_local_port)
1979 1979 continue;
1980 1980
1981 1981 if (!is_icmp_inv_acq) {
1982 1982 if ((valid & IPSL_ICMP_TYPE) &&
1983 1983 (isel->ipsl_icmp_type > sel->ips_icmp_type ||
1984 1984 isel->ipsl_icmp_type_end < sel->ips_icmp_type)) {
1985 1985 continue;
1986 1986 }
1987 1987
1988 1988 if ((valid & IPSL_ICMP_CODE) &&
1989 1989 (isel->ipsl_icmp_code > sel->ips_icmp_code ||
1990 1990 isel->ipsl_icmp_code_end <
1991 1991 sel->ips_icmp_code)) {
1992 1992 continue;
1993 1993 }
1994 1994 } else {
1995 1995 /*
1996 1996 * special case for icmp inverse acquire
1997 1997 * we only want policies that aren't drop/pass
1998 1998 */
1999 1999 if (p->ipsp_act->ipa_act.ipa_type != IPSEC_ACT_APPLY)
2000 2000 continue;
2001 2001 }
2002 2002
2003 2003 /* we matched all the packet-port-field selectors! */
2004 2004 best = p;
2005 2005 bpri = p->ipsp_prio;
2006 2006 }
2007 2007
2008 2008 return (best);
2009 2009 }
2010 2010
2011 2011 /*
2012 2012 * Try to find and return the best policy entry under a given policy
2013 2013 * root for a given set of selectors; the first parameter "best" is
2014 2014 * the current best policy so far. If "best" is non-null, we have a
2015 2015 * reference to it. We return a reference to a policy; if that policy
2016 2016 * is not the original "best", we need to release that reference
2017 2017 * before returning.
2018 2018 */
2019 2019 ipsec_policy_t *
2020 2020 ipsec_find_policy_head(ipsec_policy_t *best, ipsec_policy_head_t *head,
2021 2021 int direction, ipsec_selector_t *sel)
2022 2022 {
2023 2023 ipsec_policy_t *curbest;
2024 2024 ipsec_policy_root_t *root;
2025 2025 uint8_t is_icmp_inv_acq = sel->ips_is_icmp_inv_acq;
2026 2026 int af = sel->ips_isv4 ? IPSEC_AF_V4 : IPSEC_AF_V6;
2027 2027
2028 2028 curbest = best;
2029 2029 root = &head->iph_root[direction];
2030 2030
2031 2031 #ifdef DEBUG
2032 2032 if (is_icmp_inv_acq) {
2033 2033 if (sel->ips_isv4) {
2034 2034 if (sel->ips_protocol != IPPROTO_ICMP) {
2035 2035 cmn_err(CE_WARN, "ipsec_find_policy_head:"
2036 2036 " expecting icmp, got %d",
2037 2037 sel->ips_protocol);
2038 2038 }
2039 2039 } else {
2040 2040 if (sel->ips_protocol != IPPROTO_ICMPV6) {
2041 2041 cmn_err(CE_WARN, "ipsec_find_policy_head:"
2042 2042 " expecting icmpv6, got %d",
2043 2043 sel->ips_protocol);
2044 2044 }
2045 2045 }
2046 2046 }
2047 2047 #endif
2048 2048
2049 2049 rw_enter(&head->iph_lock, RW_READER);
2050 2050
2051 2051 if (root->ipr_nchains > 0) {
2052 2052 curbest = ipsec_find_policy_chain(curbest,
2053 2053 root->ipr_hash[selector_hash(sel, root)].hash_head, sel,
2054 2054 is_icmp_inv_acq);
2055 2055 }
2056 2056 curbest = ipsec_find_policy_chain(curbest, root->ipr_nonhash[af], sel,
2057 2057 is_icmp_inv_acq);
2058 2058
2059 2059 /*
2060 2060 * Adjust reference counts if we found anything new.
2061 2061 */
2062 2062 if (curbest != best) {
2063 2063 ASSERT(curbest != NULL);
2064 2064 IPPOL_REFHOLD(curbest);
2065 2065
2066 2066 if (best != NULL) {
2067 2067 IPPOL_REFRELE(best);
2068 2068 }
2069 2069 }
2070 2070
2071 2071 rw_exit(&head->iph_lock);
2072 2072
2073 2073 return (curbest);
2074 2074 }
2075 2075
2076 2076 /*
2077 2077 * Find the best system policy (either global or per-interface) which
2078 2078 * applies to the given selector; look in all the relevant policy roots
2079 2079 * to figure out which policy wins.
2080 2080 *
2081 2081 * Returns a reference to a policy; caller must release this
2082 2082 * reference when done.
2083 2083 */
2084 2084 ipsec_policy_t *
2085 2085 ipsec_find_policy(int direction, const conn_t *connp, ipsec_selector_t *sel,
2086 2086 netstack_t *ns)
2087 2087 {
2088 2088 ipsec_policy_t *p;
2089 2089 ipsec_stack_t *ipss = ns->netstack_ipsec;
2090 2090
2091 2091 p = ipsec_find_policy_head(NULL, &ipss->ipsec_system_policy,
2092 2092 direction, sel);
2093 2093 if ((connp != NULL) && (connp->conn_policy != NULL)) {
2094 2094 p = ipsec_find_policy_head(p, connp->conn_policy,
2095 2095 direction, sel);
2096 2096 }
2097 2097
2098 2098 return (p);
2099 2099 }
2100 2100
2101 2101 /*
2102 2102 * Check with global policy and see whether this inbound
2103 2103 * packet meets the policy constraints.
2104 2104 *
2105 2105 * Locate appropriate policy from global policy, supplemented by the
2106 2106 * conn's configured and/or cached policy if the conn is supplied.
2107 2107 *
2108 2108 * Dispatch to ipsec_check_ipsecin_policy if we have policy and an
2109 2109 * encrypted packet to see if they match.
2110 2110 *
2111 2111 * Otherwise, see if the policy allows cleartext; if not, drop it on the
2112 2112 * floor.
2113 2113 */
2114 2114 mblk_t *
2115 2115 ipsec_check_global_policy(mblk_t *data_mp, conn_t *connp,
2116 2116 ipha_t *ipha, ip6_t *ip6h, ip_recv_attr_t *ira, netstack_t *ns)
2117 2117 {
2118 2118 ipsec_policy_t *p;
2119 2119 ipsec_selector_t sel;
2120 2120 boolean_t policy_present;
2121 2121 kstat_named_t *counter;
2122 2122 uint64_t pkt_unique;
2123 2123 ip_stack_t *ipst = ns->netstack_ip;
2124 2124 ipsec_stack_t *ipss = ns->netstack_ipsec;
2125 2125
2126 2126 sel.ips_is_icmp_inv_acq = 0;
2127 2127
2128 2128 ASSERT((ipha == NULL && ip6h != NULL) ||
2129 2129 (ip6h == NULL && ipha != NULL));
2130 2130
2131 2131 if (ipha != NULL)
2132 2132 policy_present = ipss->ipsec_inbound_v4_policy_present;
2133 2133 else
2134 2134 policy_present = ipss->ipsec_inbound_v6_policy_present;
2135 2135
2136 2136 if (!policy_present && connp == NULL) {
2137 2137 /*
2138 2138 * No global policy and no per-socket policy;
2139 2139 * just pass it back (but we shouldn't get here in that case)
2140 2140 */
2141 2141 return (data_mp);
2142 2142 }
2143 2143
2144 2144 /*
2145 2145 * If we have cached policy, use it.
2146 2146 * Otherwise consult system policy.
2147 2147 */
2148 2148 if ((connp != NULL) && (connp->conn_latch != NULL)) {
2149 2149 p = connp->conn_latch_in_policy;
2150 2150 if (p != NULL) {
2151 2151 IPPOL_REFHOLD(p);
2152 2152 }
2153 2153 /*
2154 2154 * Fudge sel for UNIQUE_ID setting below.
2155 2155 */
2156 2156 pkt_unique = conn_to_unique(connp, data_mp, ipha, ip6h);
2157 2157 } else {
2158 2158 /* Initialize the ports in the selector */
2159 2159 if (ipsec_init_inbound_sel(&sel, data_mp, ipha, ip6h,
2160 2160 SEL_NONE) == SELRET_NOMEM) {
2161 2161 /*
2162 2162 * Technically not a policy mismatch, but it is
2163 2163 * an internal failure.
2164 2164 */
2165 2165 ipsec_log_policy_failure(IPSEC_POLICY_MISMATCH,
2166 2166 "ipsec_init_inbound_sel", ipha, ip6h, B_TRUE, ns);
2167 2167 counter = DROPPER(ipss, ipds_spd_nomem);
2168 2168 goto fail;
2169 2169 }
2170 2170
2171 2171 /*
2172 2172 * Find the policy which best applies.
2173 2173 *
2174 2174 * If we find global policy, we should look at both
2175 2175 * local policy and global policy and see which is
2176 2176 * stronger and match accordingly.
2177 2177 *
2178 2178 * If we don't find a global policy, check with
2179 2179 * local policy alone.
2180 2180 */
2181 2181
2182 2182 p = ipsec_find_policy(IPSEC_TYPE_INBOUND, connp, &sel, ns);
2183 2183 pkt_unique = SA_UNIQUE_ID(sel.ips_remote_port,
2184 2184 sel.ips_local_port, sel.ips_protocol, 0);
2185 2185 }
2186 2186
2187 2187 if (p == NULL) {
2188 2188 if (!(ira->ira_flags & IRAF_IPSEC_SECURE)) {
2189 2189 /*
2190 2190 * We have no policy; default to succeeding.
2191 2191 * XXX paranoid system design doesn't do this.
2192 2192 */
2193 2193 BUMP_MIB(&ipst->ips_ip_mib, ipsecInSucceeded);
2194 2194 return (data_mp);
2195 2195 } else {
2196 2196 counter = DROPPER(ipss, ipds_spd_got_secure);
2197 2197 ipsec_log_policy_failure(IPSEC_POLICY_NOT_NEEDED,
2198 2198 "ipsec_check_global_policy", ipha, ip6h, B_TRUE,
2199 2199 ns);
2200 2200 goto fail;
2201 2201 }
2202 2202 }
2203 2203 if (ira->ira_flags & IRAF_IPSEC_SECURE) {
2204 2204 return (ipsec_check_ipsecin_policy(data_mp, p, ipha, ip6h,
2205 2205 pkt_unique, ira, ns));
2206 2206 }
2207 2207 if (p->ipsp_act->ipa_allow_clear) {
2208 2208 BUMP_MIB(&ipst->ips_ip_mib, ipsecInSucceeded);
2209 2209 IPPOL_REFRELE(p);
2210 2210 return (data_mp);
2211 2211 }
2212 2212 IPPOL_REFRELE(p);
2213 2213 /*
2214 2214 * If we reach here, we will drop the packet because it failed the
2215 2215 * global policy check because the packet was cleartext, and it
2216 2216 * should not have been.
2217 2217 */
2218 2218 ipsec_log_policy_failure(IPSEC_POLICY_MISMATCH,
2219 2219 "ipsec_check_global_policy", ipha, ip6h, B_FALSE, ns);
2220 2220 counter = DROPPER(ipss, ipds_spd_got_clear);
2221 2221
2222 2222 fail:
2223 2223 ip_drop_packet(data_mp, B_TRUE, NULL, counter,
2224 2224 &ipss->ipsec_spd_dropper);
2225 2225 BUMP_MIB(&ipst->ips_ip_mib, ipsecInFailed);
2226 2226 return (NULL);
2227 2227 }
2228 2228
2229 2229 /*
2230 2230 * We check whether an inbound datagram is a valid one
2231 2231 * to accept in clear. If it is secure, it is the job
2232 2232 * of IPSEC to log information appropriately if it
2233 2233 * suspects that it may not be the real one.
2234 2234 *
2235 2235 * It is called only while fanning out to the ULP
2236 2236 * where ULP accepts only secure data and the incoming
2237 2237 * is clear. Usually we never accept clear datagrams in
2238 2238 * such cases. ICMP is the only exception.
2239 2239 *
2240 2240 * NOTE : We don't call this function if the client (ULP)
2241 2241 * is willing to accept things in clear.
2242 2242 */
2243 2243 boolean_t
2244 2244 ipsec_inbound_accept_clear(mblk_t *mp, ipha_t *ipha, ip6_t *ip6h)
2245 2245 {
2246 2246 ushort_t iph_hdr_length;
2247 2247 icmph_t *icmph;
2248 2248 icmp6_t *icmp6;
2249 2249 uint8_t *nexthdrp;
2250 2250
2251 2251 ASSERT((ipha != NULL && ip6h == NULL) ||
2252 2252 (ipha == NULL && ip6h != NULL));
2253 2253
2254 2254 if (ip6h != NULL) {
2255 2255 iph_hdr_length = ip_hdr_length_v6(mp, ip6h);
2256 2256 if (!ip_hdr_length_nexthdr_v6(mp, ip6h, &iph_hdr_length,
2257 2257 &nexthdrp)) {
2258 2258 return (B_FALSE);
2259 2259 }
2260 2260 if (*nexthdrp != IPPROTO_ICMPV6)
2261 2261 return (B_FALSE);
2262 2262 icmp6 = (icmp6_t *)(&mp->b_rptr[iph_hdr_length]);
2263 2263 /* Match IPv6 ICMP policy as closely as IPv4 as possible. */
2264 2264 switch (icmp6->icmp6_type) {
2265 2265 case ICMP6_PARAM_PROB:
2266 2266 /* Corresponds to port/proto unreach in IPv4. */
2267 2267 case ICMP6_ECHO_REQUEST:
2268 2268 /* Just like IPv4. */
2269 2269 return (B_FALSE);
2270 2270
2271 2271 case MLD_LISTENER_QUERY:
2272 2272 case MLD_LISTENER_REPORT:
2273 2273 case MLD_LISTENER_REDUCTION:
2274 2274 /*
2275 2275 * XXX Seperate NDD in IPv4 what about here?
2276 2276 * Plus, mcast is important to ND.
2277 2277 */
2278 2278 case ICMP6_DST_UNREACH:
2279 2279 /* Corresponds to HOST/NET unreachable in IPv4. */
2280 2280 case ICMP6_PACKET_TOO_BIG:
2281 2281 case ICMP6_ECHO_REPLY:
2282 2282 /* These are trusted in IPv4. */
2283 2283 case ND_ROUTER_SOLICIT:
2284 2284 case ND_ROUTER_ADVERT:
2285 2285 case ND_NEIGHBOR_SOLICIT:
2286 2286 case ND_NEIGHBOR_ADVERT:
2287 2287 case ND_REDIRECT:
2288 2288 /* Trust ND messages for now. */
2289 2289 case ICMP6_TIME_EXCEEDED:
2290 2290 default:
2291 2291 return (B_TRUE);
2292 2292 }
2293 2293 } else {
2294 2294 /*
2295 2295 * If it is not ICMP, fail this request.
2296 2296 */
2297 2297 if (ipha->ipha_protocol != IPPROTO_ICMP) {
2298 2298 #ifdef FRAGCACHE_DEBUG
2299 2299 cmn_err(CE_WARN, "Dropping - ipha_proto = %d\n",
2300 2300 ipha->ipha_protocol);
2301 2301 #endif
2302 2302 return (B_FALSE);
2303 2303 }
2304 2304 iph_hdr_length = IPH_HDR_LENGTH(ipha);
2305 2305 icmph = (icmph_t *)&mp->b_rptr[iph_hdr_length];
2306 2306 /*
2307 2307 * It is an insecure icmp message. Check to see whether we are
2308 2308 * willing to accept this one.
2309 2309 */
2310 2310
2311 2311 switch (icmph->icmph_type) {
2312 2312 case ICMP_ECHO_REPLY:
2313 2313 case ICMP_TIME_STAMP_REPLY:
2314 2314 case ICMP_INFO_REPLY:
2315 2315 case ICMP_ROUTER_ADVERTISEMENT:
2316 2316 /*
2317 2317 * We should not encourage clear replies if this
2318 2318 * client expects secure. If somebody is replying
2319 2319 * in clear some mailicious user watching both the
2320 2320 * request and reply, can do chosen-plain-text attacks.
2321 2321 * With global policy we might be just expecting secure
2322 2322 * but sending out clear. We don't know what the right
2323 2323 * thing is. We can't do much here as we can't control
2324 2324 * the sender here. Till we are sure of what to do,
2325 2325 * accept them.
2326 2326 */
2327 2327 return (B_TRUE);
2328 2328 case ICMP_ECHO_REQUEST:
2329 2329 case ICMP_TIME_STAMP_REQUEST:
2330 2330 case ICMP_INFO_REQUEST:
2331 2331 case ICMP_ADDRESS_MASK_REQUEST:
2332 2332 case ICMP_ROUTER_SOLICITATION:
2333 2333 case ICMP_ADDRESS_MASK_REPLY:
2334 2334 /*
2335 2335 * Don't accept this as somebody could be sending
2336 2336 * us plain text to get encrypted data. If we reply,
2337 2337 * it will lead to chosen plain text attack.
2338 2338 */
2339 2339 return (B_FALSE);
2340 2340 case ICMP_DEST_UNREACHABLE:
2341 2341 switch (icmph->icmph_code) {
2342 2342 case ICMP_FRAGMENTATION_NEEDED:
2343 2343 /*
2344 2344 * Be in sync with icmp_inbound, where we have
2345 2345 * already set dce_pmtu
2346 2346 */
2347 2347 #ifdef FRAGCACHE_DEBUG
2348 2348 cmn_err(CE_WARN, "ICMP frag needed\n");
2349 2349 #endif
2350 2350 return (B_TRUE);
2351 2351 case ICMP_HOST_UNREACHABLE:
2352 2352 case ICMP_NET_UNREACHABLE:
2353 2353 /*
2354 2354 * By accepting, we could reset a connection.
2355 2355 * How do we solve the problem of some
2356 2356 * intermediate router sending in-secure ICMP
2357 2357 * messages ?
2358 2358 */
2359 2359 return (B_TRUE);
2360 2360 case ICMP_PORT_UNREACHABLE:
2361 2361 case ICMP_PROTOCOL_UNREACHABLE:
2362 2362 default :
2363 2363 return (B_FALSE);
2364 2364 }
2365 2365 case ICMP_SOURCE_QUENCH:
2366 2366 /*
2367 2367 * If this is an attack, TCP will slow start
2368 2368 * because of this. Is it very harmful ?
2369 2369 */
2370 2370 return (B_TRUE);
2371 2371 case ICMP_PARAM_PROBLEM:
2372 2372 return (B_FALSE);
2373 2373 case ICMP_TIME_EXCEEDED:
2374 2374 return (B_TRUE);
2375 2375 case ICMP_REDIRECT:
2376 2376 return (B_FALSE);
2377 2377 default :
2378 2378 return (B_FALSE);
2379 2379 }
2380 2380 }
2381 2381 }
2382 2382
2383 2383 void
2384 2384 ipsec_latch_ids(ipsec_latch_t *ipl, ipsid_t *local, ipsid_t *remote)
2385 2385 {
2386 2386 mutex_enter(&ipl->ipl_lock);
2387 2387
2388 2388 if (ipl->ipl_ids_latched) {
2389 2389 /* I lost, someone else got here before me */
2390 2390 mutex_exit(&ipl->ipl_lock);
2391 2391 return;
2392 2392 }
2393 2393
2394 2394 if (local != NULL)
2395 2395 IPSID_REFHOLD(local);
2396 2396 if (remote != NULL)
2397 2397 IPSID_REFHOLD(remote);
2398 2398
2399 2399 ipl->ipl_local_cid = local;
2400 2400 ipl->ipl_remote_cid = remote;
2401 2401 ipl->ipl_ids_latched = B_TRUE;
2402 2402 mutex_exit(&ipl->ipl_lock);
2403 2403 }
2404 2404
2405 2405 void
2406 2406 ipsec_latch_inbound(conn_t *connp, ip_recv_attr_t *ira)
2407 2407 {
2408 2408 ipsa_t *sa;
2409 2409 ipsec_latch_t *ipl = connp->conn_latch;
2410 2410
2411 2411 if (!ipl->ipl_ids_latched) {
2412 2412 ipsid_t *local = NULL;
2413 2413 ipsid_t *remote = NULL;
2414 2414
2415 2415 if (!(ira->ira_flags & IRAF_LOOPBACK)) {
2416 2416 ASSERT(ira->ira_flags & IRAF_IPSEC_SECURE);
2417 2417 if (ira->ira_ipsec_esp_sa != NULL)
2418 2418 sa = ira->ira_ipsec_esp_sa;
2419 2419 else
2420 2420 sa = ira->ira_ipsec_ah_sa;
2421 2421 ASSERT(sa != NULL);
2422 2422 local = sa->ipsa_dst_cid;
2423 2423 remote = sa->ipsa_src_cid;
2424 2424 }
2425 2425 ipsec_latch_ids(ipl, local, remote);
2426 2426 }
2427 2427 if (ira->ira_flags & IRAF_IPSEC_SECURE) {
2428 2428 if (connp->conn_latch_in_action != NULL) {
2429 2429 /*
2430 2430 * Previously cached action. This is probably
2431 2431 * harmless, but in DEBUG kernels, check for
2432 2432 * action equality.
2433 2433 *
2434 2434 * Preserve the existing action to preserve latch
2435 2435 * invariance.
2436 2436 */
2437 2437 ASSERT(connp->conn_latch_in_action ==
2438 2438 ira->ira_ipsec_action);
2439 2439 return;
2440 2440 }
2441 2441 connp->conn_latch_in_action = ira->ira_ipsec_action;
2442 2442 IPACT_REFHOLD(connp->conn_latch_in_action);
2443 2443 }
2444 2444 }
2445 2445
2446 2446 /*
2447 2447 * Check whether the policy constraints are met either for an
2448 2448 * inbound datagram; called from IP in numerous places.
2449 2449 *
2450 2450 * Note that this is not a chokepoint for inbound policy checks;
2451 2451 * see also ipsec_check_ipsecin_latch() and ipsec_check_global_policy()
2452 2452 */
2453 2453 mblk_t *
2454 2454 ipsec_check_inbound_policy(mblk_t *mp, conn_t *connp,
2455 2455 ipha_t *ipha, ip6_t *ip6h, ip_recv_attr_t *ira)
2456 2456 {
2457 2457 boolean_t ret;
2458 2458 ipsec_latch_t *ipl;
2459 2459 ipsec_action_t *ap;
2460 2460 uint64_t unique_id;
2461 2461 ipsec_stack_t *ipss;
2462 2462 ip_stack_t *ipst;
2463 2463 netstack_t *ns;
2464 2464 ipsec_policy_head_t *policy_head;
2465 2465 ipsec_policy_t *p = NULL;
2466 2466
2467 2467 ASSERT(connp != NULL);
2468 2468 ns = connp->conn_netstack;
2469 2469 ipss = ns->netstack_ipsec;
2470 2470 ipst = ns->netstack_ip;
2471 2471
2472 2472 if (!(ira->ira_flags & IRAF_IPSEC_SECURE)) {
2473 2473 /*
2474 2474 * This is the case where the incoming datagram is
2475 2475 * cleartext and we need to see whether this client
2476 2476 * would like to receive such untrustworthy things from
2477 2477 * the wire.
2478 2478 */
2479 2479 ASSERT(mp != NULL);
2480 2480
2481 2481 mutex_enter(&connp->conn_lock);
2482 2482 if (connp->conn_state_flags & CONN_CONDEMNED) {
2483 2483 mutex_exit(&connp->conn_lock);
2484 2484 ip_drop_packet(mp, B_TRUE, NULL,
2485 2485 DROPPER(ipss, ipds_spd_got_clear),
2486 2486 &ipss->ipsec_spd_dropper);
2487 2487 BUMP_MIB(&ipst->ips_ip_mib, ipsecInFailed);
2488 2488 return (NULL);
2489 2489 }
2490 2490 if (connp->conn_latch != NULL) {
2491 2491 /* Hold a reference in case the conn is closing */
2492 2492 p = connp->conn_latch_in_policy;
2493 2493 if (p != NULL)
2494 2494 IPPOL_REFHOLD(p);
2495 2495 mutex_exit(&connp->conn_lock);
2496 2496 /*
2497 2497 * Policy is cached in the conn.
2498 2498 */
2499 2499 if (p != NULL && !p->ipsp_act->ipa_allow_clear) {
2500 2500 ret = ipsec_inbound_accept_clear(mp,
2501 2501 ipha, ip6h);
2502 2502 if (ret) {
2503 2503 BUMP_MIB(&ipst->ips_ip_mib,
2504 2504 ipsecInSucceeded);
2505 2505 IPPOL_REFRELE(p);
2506 2506 return (mp);
2507 2507 } else {
2508 2508 ipsec_log_policy_failure(
2509 2509 IPSEC_POLICY_MISMATCH,
2510 2510 "ipsec_check_inbound_policy", ipha,
2511 2511 ip6h, B_FALSE, ns);
2512 2512 ip_drop_packet(mp, B_TRUE, NULL,
2513 2513 DROPPER(ipss, ipds_spd_got_clear),
2514 2514 &ipss->ipsec_spd_dropper);
2515 2515 BUMP_MIB(&ipst->ips_ip_mib,
2516 2516 ipsecInFailed);
2517 2517 IPPOL_REFRELE(p);
2518 2518 return (NULL);
2519 2519 }
2520 2520 } else {
2521 2521 BUMP_MIB(&ipst->ips_ip_mib, ipsecInSucceeded);
2522 2522 if (p != NULL)
2523 2523 IPPOL_REFRELE(p);
2524 2524 return (mp);
2525 2525 }
2526 2526 } else {
2527 2527 policy_head = connp->conn_policy;
2528 2528
2529 2529 /* Hold a reference in case the conn is closing */
2530 2530 if (policy_head != NULL)
2531 2531 IPPH_REFHOLD(policy_head);
2532 2532 mutex_exit(&connp->conn_lock);
2533 2533 /*
2534 2534 * As this is a non-hardbound connection we need
2535 2535 * to look at both per-socket policy and global
2536 2536 * policy.
2537 2537 */
2538 2538 mp = ipsec_check_global_policy(mp, connp,
2539 2539 ipha, ip6h, ira, ns);
2540 2540 if (policy_head != NULL)
2541 2541 IPPH_REFRELE(policy_head, ns);
2542 2542 return (mp);
2543 2543 }
2544 2544 }
2545 2545
2546 2546 mutex_enter(&connp->conn_lock);
2547 2547 /* Connection is closing */
2548 2548 if (connp->conn_state_flags & CONN_CONDEMNED) {
2549 2549 mutex_exit(&connp->conn_lock);
2550 2550 ip_drop_packet(mp, B_TRUE, NULL,
2551 2551 DROPPER(ipss, ipds_spd_got_clear),
2552 2552 &ipss->ipsec_spd_dropper);
2553 2553 BUMP_MIB(&ipst->ips_ip_mib, ipsecInFailed);
2554 2554 return (NULL);
2555 2555 }
2556 2556
2557 2557 /*
2558 2558 * Once a connection is latched it remains so for life, the conn_latch
2559 2559 * pointer on the conn has not changed, simply initializing ipl here
2560 2560 * as the earlier initialization was done only in the cleartext case.
2561 2561 */
2562 2562 if ((ipl = connp->conn_latch) == NULL) {
2563 2563 mblk_t *retmp;
2564 2564 policy_head = connp->conn_policy;
2565 2565
2566 2566 /* Hold a reference in case the conn is closing */
2567 2567 if (policy_head != NULL)
2568 2568 IPPH_REFHOLD(policy_head);
2569 2569 mutex_exit(&connp->conn_lock);
2570 2570 /*
2571 2571 * We don't have policies cached in the conn
2572 2572 * for this stream. So, look at the global
2573 2573 * policy. It will check against conn or global
2574 2574 * depending on whichever is stronger.
2575 2575 */
2576 2576 retmp = ipsec_check_global_policy(mp, connp,
2577 2577 ipha, ip6h, ira, ns);
2578 2578 if (policy_head != NULL)
2579 2579 IPPH_REFRELE(policy_head, ns);
2580 2580 return (retmp);
2581 2581 }
2582 2582
2583 2583 IPLATCH_REFHOLD(ipl);
2584 2584 /* Hold reference on conn_latch_in_action in case conn is closing */
2585 2585 ap = connp->conn_latch_in_action;
2586 2586 if (ap != NULL)
2587 2587 IPACT_REFHOLD(ap);
2588 2588 mutex_exit(&connp->conn_lock);
2589 2589
2590 2590 if (ap != NULL) {
2591 2591 /* Policy is cached & latched; fast(er) path */
2592 2592 const char *reason;
2593 2593 kstat_named_t *counter;
2594 2594
2595 2595 if (ipsec_check_ipsecin_latch(ira, mp, ipl, ap,
2596 2596 ipha, ip6h, &reason, &counter, connp, ns)) {
2597 2597 BUMP_MIB(&ipst->ips_ip_mib, ipsecInSucceeded);
2598 2598 IPLATCH_REFRELE(ipl);
2599 2599 IPACT_REFRELE(ap);
2600 2600 return (mp);
2601 2601 }
2602 2602 ipsec_rl_strlog(ns, IP_MOD_ID, 0, 0,
2603 2603 SL_ERROR|SL_WARN|SL_CONSOLE,
2604 2604 "ipsec inbound policy mismatch: %s, packet dropped\n",
2605 2605 reason);
2606 2606 ip_drop_packet(mp, B_TRUE, NULL, counter,
2607 2607 &ipss->ipsec_spd_dropper);
2608 2608 BUMP_MIB(&ipst->ips_ip_mib, ipsecInFailed);
2609 2609 IPLATCH_REFRELE(ipl);
2610 2610 IPACT_REFRELE(ap);
2611 2611 return (NULL);
2612 2612 }
2613 2613 if ((p = connp->conn_latch_in_policy) == NULL) {
2614 2614 ipsec_weird_null_inbound_policy++;
2615 2615 IPLATCH_REFRELE(ipl);
2616 2616 return (mp);
2617 2617 }
2618 2618
2619 2619 unique_id = conn_to_unique(connp, mp, ipha, ip6h);
2620 2620 IPPOL_REFHOLD(p);
2621 2621 mp = ipsec_check_ipsecin_policy(mp, p, ipha, ip6h, unique_id, ira, ns);
2622 2622 /*
2623 2623 * NOTE: ipsecIn{Failed,Succeeeded} bumped by
2624 2624 * ipsec_check_ipsecin_policy().
2625 2625 */
2626 2626 if (mp != NULL)
2627 2627 ipsec_latch_inbound(connp, ira);
2628 2628 IPLATCH_REFRELE(ipl);
2629 2629 return (mp);
2630 2630 }
2631 2631
2632 2632 /*
2633 2633 * Handle all sorts of cases like tunnel-mode and ICMP.
2634 2634 */
2635 2635 static int
2636 2636 prepended_length(mblk_t *mp, uintptr_t hptr)
2637 2637 {
2638 2638 int rc = 0;
2639 2639
2640 2640 while (mp != NULL) {
2641 2641 if (hptr >= (uintptr_t)mp->b_rptr && hptr <
2642 2642 (uintptr_t)mp->b_wptr) {
2643 2643 rc += (int)(hptr - (uintptr_t)mp->b_rptr);
2644 2644 break; /* out of while loop */
2645 2645 }
2646 2646 rc += (int)MBLKL(mp);
2647 2647 mp = mp->b_cont;
2648 2648 }
2649 2649
2650 2650 if (mp == NULL) {
2651 2651 /*
2652 2652 * IF (big IF) we make it here by naturally exiting the loop,
2653 2653 * then ip6h isn't in the mblk chain "mp" at all.
2654 2654 *
2655 2655 * The only case where this happens is with a reversed IP
2656 2656 * header that gets passed up by inbound ICMP processing.
2657 2657 * This unfortunately triggers longstanding bug 6478464. For
2658 2658 * now, just pass up 0 for the answer.
2659 2659 */
2660 2660 #ifdef DEBUG_NOT_UNTIL_6478464
2661 2661 ASSERT(mp != NULL);
2662 2662 #endif
2663 2663 rc = 0;
2664 2664 }
2665 2665
2666 2666 return (rc);
2667 2667 }
2668 2668
2669 2669 /*
2670 2670 * Returns:
2671 2671 *
2672 2672 * SELRET_NOMEM --> msgpullup() needed to gather things failed.
2673 2673 * SELRET_BADPKT --> If we're being called after tunnel-mode fragment
2674 2674 * gathering, the initial fragment is too short for
2675 2675 * useful data. Only returned if SEL_TUNNEL_FIRSTFRAG is
2676 2676 * set.
2677 2677 * SELRET_SUCCESS --> "sel" now has initialized IPsec selector data.
2678 2678 * SELRET_TUNFRAG --> This is a fragment in a tunnel-mode packet. Caller
2679 2679 * should put this packet in a fragment-gathering queue.
2680 2680 * Only returned if SEL_TUNNEL_MODE and SEL_PORT_POLICY
2681 2681 * is set.
2682 2682 *
2683 2683 * Note that ipha/ip6h can be in a different mblk (mp->b_cont) in the case
2684 2684 * of tunneled packets.
2685 2685 * Also, mp->b_rptr can be an ICMP error where ipha/ip6h is the packet in
2686 2686 * error past the ICMP error.
2687 2687 */
2688 2688 static selret_t
2689 2689 ipsec_init_inbound_sel(ipsec_selector_t *sel, mblk_t *mp, ipha_t *ipha,
2690 2690 ip6_t *ip6h, uint8_t sel_flags)
2691 2691 {
2692 2692 uint16_t *ports;
2693 2693 int outer_hdr_len = 0; /* For ICMP or tunnel-mode cases... */
2694 2694 ushort_t hdr_len;
2695 2695 mblk_t *spare_mp = NULL;
2696 2696 uint8_t *nexthdrp, *transportp;
2697 2697 uint8_t nexthdr;
2698 2698 uint8_t icmp_proto;
2699 2699 ip_pkt_t ipp;
2700 2700 boolean_t port_policy_present = (sel_flags & SEL_PORT_POLICY);
2701 2701 boolean_t is_icmp = (sel_flags & SEL_IS_ICMP);
2702 2702 boolean_t tunnel_mode = (sel_flags & SEL_TUNNEL_MODE);
2703 2703 boolean_t post_frag = (sel_flags & SEL_POST_FRAG);
2704 2704
2705 2705 ASSERT((ipha == NULL && ip6h != NULL) ||
2706 2706 (ipha != NULL && ip6h == NULL));
2707 2707
2708 2708 if (ip6h != NULL) {
2709 2709 outer_hdr_len = prepended_length(mp, (uintptr_t)ip6h);
2710 2710 nexthdr = ip6h->ip6_nxt;
2711 2711 icmp_proto = IPPROTO_ICMPV6;
2712 2712 sel->ips_isv4 = B_FALSE;
2713 2713 sel->ips_local_addr_v6 = ip6h->ip6_dst;
2714 2714 sel->ips_remote_addr_v6 = ip6h->ip6_src;
2715 2715
2716 2716 bzero(&ipp, sizeof (ipp));
2717 2717
2718 2718 switch (nexthdr) {
2719 2719 case IPPROTO_HOPOPTS:
2720 2720 case IPPROTO_ROUTING:
2721 2721 case IPPROTO_DSTOPTS:
2722 2722 case IPPROTO_FRAGMENT:
2723 2723 /*
2724 2724 * Use ip_hdr_length_nexthdr_v6(). And have a spare
2725 2725 * mblk that's contiguous to feed it
2726 2726 */
2727 2727 if ((spare_mp = msgpullup(mp, -1)) == NULL)
2728 2728 return (SELRET_NOMEM);
2729 2729 if (!ip_hdr_length_nexthdr_v6(spare_mp,
2730 2730 (ip6_t *)(spare_mp->b_rptr + outer_hdr_len),
2731 2731 &hdr_len, &nexthdrp)) {
2732 2732 /* Malformed packet - caller frees. */
2733 2733 ipsec_freemsg_chain(spare_mp);
2734 2734 return (SELRET_BADPKT);
2735 2735 }
2736 2736 /* Repopulate now that we have the whole packet */
2737 2737 ip6h = (ip6_t *)(spare_mp->b_rptr + outer_hdr_len);
2738 2738 (void) ip_find_hdr_v6(spare_mp, ip6h, B_FALSE, &ipp,
2739 2739 NULL);
2740 2740 nexthdr = *nexthdrp;
2741 2741 /* We can just extract based on hdr_len now. */
2742 2742 break;
2743 2743 default:
2744 2744 (void) ip_find_hdr_v6(mp, ip6h, B_FALSE, &ipp, NULL);
2745 2745 hdr_len = IPV6_HDR_LEN;
2746 2746 break;
2747 2747 }
2748 2748 if (port_policy_present && IS_V6_FRAGMENT(ipp) && !is_icmp) {
2749 2749 /* IPv6 Fragment */
2750 2750 ipsec_freemsg_chain(spare_mp);
2751 2751 return (SELRET_TUNFRAG);
2752 2752 }
2753 2753 transportp = (uint8_t *)ip6h + hdr_len;
2754 2754 } else {
2755 2755 outer_hdr_len = prepended_length(mp, (uintptr_t)ipha);
2756 2756 icmp_proto = IPPROTO_ICMP;
2757 2757 sel->ips_isv4 = B_TRUE;
2758 2758 sel->ips_local_addr_v4 = ipha->ipha_dst;
2759 2759 sel->ips_remote_addr_v4 = ipha->ipha_src;
2760 2760 nexthdr = ipha->ipha_protocol;
2761 2761 hdr_len = IPH_HDR_LENGTH(ipha);
2762 2762
2763 2763 if (port_policy_present &&
2764 2764 IS_V4_FRAGMENT(ipha->ipha_fragment_offset_and_flags) &&
2765 2765 !is_icmp) {
2766 2766 /* IPv4 Fragment */
2767 2767 ipsec_freemsg_chain(spare_mp);
2768 2768 return (SELRET_TUNFRAG);
2769 2769 }
2770 2770 transportp = (uint8_t *)ipha + hdr_len;
2771 2771 }
2772 2772 sel->ips_protocol = nexthdr;
2773 2773
2774 2774 if ((nexthdr != IPPROTO_TCP && nexthdr != IPPROTO_UDP &&
2775 2775 nexthdr != IPPROTO_SCTP && nexthdr != icmp_proto) ||
2776 2776 (!port_policy_present && !post_frag && tunnel_mode)) {
2777 2777 sel->ips_remote_port = sel->ips_local_port = 0;
2778 2778 ipsec_freemsg_chain(spare_mp);
2779 2779 return (SELRET_SUCCESS);
2780 2780 }
2781 2781
2782 2782 if (transportp + 4 > mp->b_wptr) {
2783 2783 /* If we didn't pullup a copy already, do so now. */
2784 2784 /*
2785 2785 * XXX performance, will upper-layers frequently split TCP/UDP
2786 2786 * apart from IP or options? If so, perhaps we should revisit
2787 2787 * the spare_mp strategy.
2788 2788 */
2789 2789 ipsec_hdr_pullup_needed++;
2790 2790 if (spare_mp == NULL &&
2791 2791 (spare_mp = msgpullup(mp, -1)) == NULL) {
2792 2792 return (SELRET_NOMEM);
2793 2793 }
2794 2794 transportp = &spare_mp->b_rptr[hdr_len + outer_hdr_len];
2795 2795 }
2796 2796
2797 2797 if (nexthdr == icmp_proto) {
2798 2798 sel->ips_icmp_type = *transportp++;
2799 2799 sel->ips_icmp_code = *transportp;
2800 2800 sel->ips_remote_port = sel->ips_local_port = 0;
2801 2801 } else {
2802 2802 ports = (uint16_t *)transportp;
2803 2803 sel->ips_remote_port = *ports++;
2804 2804 sel->ips_local_port = *ports;
2805 2805 }
2806 2806 ipsec_freemsg_chain(spare_mp);
2807 2807 return (SELRET_SUCCESS);
2808 2808 }
2809 2809
2810 2810 /*
2811 2811 * This is called with a b_next chain of messages from the fragcache code,
2812 2812 * hence it needs to discard a chain on error.
2813 2813 */
2814 2814 static boolean_t
2815 2815 ipsec_init_outbound_ports(ipsec_selector_t *sel, mblk_t *mp, ipha_t *ipha,
2816 2816 ip6_t *ip6h, int outer_hdr_len, ipsec_stack_t *ipss)
2817 2817 {
2818 2818 /*
2819 2819 * XXX cut&paste shared with ipsec_init_inbound_sel
2820 2820 */
2821 2821 uint16_t *ports;
2822 2822 ushort_t hdr_len;
2823 2823 mblk_t *spare_mp = NULL;
2824 2824 uint8_t *nexthdrp;
2825 2825 uint8_t nexthdr;
2826 2826 uint8_t *typecode;
2827 2827 uint8_t check_proto;
2828 2828
2829 2829 ASSERT((ipha == NULL && ip6h != NULL) ||
2830 2830 (ipha != NULL && ip6h == NULL));
2831 2831
2832 2832 if (ip6h != NULL) {
2833 2833 check_proto = IPPROTO_ICMPV6;
2834 2834 nexthdr = ip6h->ip6_nxt;
2835 2835 switch (nexthdr) {
2836 2836 case IPPROTO_HOPOPTS:
2837 2837 case IPPROTO_ROUTING:
2838 2838 case IPPROTO_DSTOPTS:
2839 2839 case IPPROTO_FRAGMENT:
2840 2840 /*
2841 2841 * Use ip_hdr_length_nexthdr_v6(). And have a spare
2842 2842 * mblk that's contiguous to feed it
2843 2843 */
2844 2844 spare_mp = msgpullup(mp, -1);
2845 2845 if (spare_mp == NULL ||
2846 2846 !ip_hdr_length_nexthdr_v6(spare_mp,
2847 2847 (ip6_t *)(spare_mp->b_rptr + outer_hdr_len),
2848 2848 &hdr_len, &nexthdrp)) {
2849 2849 /* Always works, even if NULL. */
2850 2850 ipsec_freemsg_chain(spare_mp);
2851 2851 ip_drop_packet_chain(mp, B_FALSE, NULL,
2852 2852 DROPPER(ipss, ipds_spd_nomem),
2853 2853 &ipss->ipsec_spd_dropper);
2854 2854 return (B_FALSE);
2855 2855 } else {
2856 2856 nexthdr = *nexthdrp;
2857 2857 /* We can just extract based on hdr_len now. */
2858 2858 }
2859 2859 break;
2860 2860 default:
2861 2861 hdr_len = IPV6_HDR_LEN;
2862 2862 break;
2863 2863 }
2864 2864 } else {
2865 2865 check_proto = IPPROTO_ICMP;
2866 2866 hdr_len = IPH_HDR_LENGTH(ipha);
2867 2867 nexthdr = ipha->ipha_protocol;
2868 2868 }
2869 2869
2870 2870 sel->ips_protocol = nexthdr;
2871 2871 if (nexthdr != IPPROTO_TCP && nexthdr != IPPROTO_UDP &&
2872 2872 nexthdr != IPPROTO_SCTP && nexthdr != check_proto) {
2873 2873 sel->ips_local_port = sel->ips_remote_port = 0;
2874 2874 ipsec_freemsg_chain(spare_mp); /* Always works, even if NULL */
2875 2875 return (B_TRUE);
2876 2876 }
2877 2877
2878 2878 if (&mp->b_rptr[hdr_len] + 4 + outer_hdr_len > mp->b_wptr) {
2879 2879 /* If we didn't pullup a copy already, do so now. */
2880 2880 /*
2881 2881 * XXX performance, will upper-layers frequently split TCP/UDP
2882 2882 * apart from IP or options? If so, perhaps we should revisit
2883 2883 * the spare_mp strategy.
2884 2884 *
2885 2885 * XXX should this be msgpullup(mp, hdr_len+4) ???
2886 2886 */
2887 2887 if (spare_mp == NULL &&
2888 2888 (spare_mp = msgpullup(mp, -1)) == NULL) {
2889 2889 ip_drop_packet_chain(mp, B_FALSE, NULL,
2890 2890 DROPPER(ipss, ipds_spd_nomem),
2891 2891 &ipss->ipsec_spd_dropper);
2892 2892 return (B_FALSE);
2893 2893 }
2894 2894 ports = (uint16_t *)&spare_mp->b_rptr[hdr_len + outer_hdr_len];
2895 2895 } else {
2896 2896 ports = (uint16_t *)&mp->b_rptr[hdr_len + outer_hdr_len];
2897 2897 }
2898 2898
2899 2899 if (nexthdr == check_proto) {
2900 2900 typecode = (uint8_t *)ports;
2901 2901 sel->ips_icmp_type = *typecode++;
2902 2902 sel->ips_icmp_code = *typecode;
2903 2903 sel->ips_remote_port = sel->ips_local_port = 0;
2904 2904 } else {
2905 2905 sel->ips_local_port = *ports++;
2906 2906 sel->ips_remote_port = *ports;
2907 2907 }
2908 2908 ipsec_freemsg_chain(spare_mp); /* Always works, even if NULL */
2909 2909 return (B_TRUE);
2910 2910 }
2911 2911
2912 2912 /*
2913 2913 * Prepend an mblk with a ipsec_crypto_t to the message chain.
2914 2914 * Frees the argument and returns NULL should the allocation fail.
2915 2915 * Returns the pointer to the crypto data part.
2916 2916 */
2917 2917 mblk_t *
2918 2918 ipsec_add_crypto_data(mblk_t *data_mp, ipsec_crypto_t **icp)
2919 2919 {
2920 2920 mblk_t *mp;
2921 2921
2922 2922 mp = allocb(sizeof (ipsec_crypto_t), BPRI_MED);
2923 2923 if (mp == NULL) {
2924 2924 freemsg(data_mp);
2925 2925 return (NULL);
2926 2926 }
2927 2927 bzero(mp->b_rptr, sizeof (ipsec_crypto_t));
2928 2928 mp->b_wptr += sizeof (ipsec_crypto_t);
2929 2929 mp->b_cont = data_mp;
2930 2930 mp->b_datap->db_type = M_EVENT; /* For ASSERT */
2931 2931 *icp = (ipsec_crypto_t *)mp->b_rptr;
2932 2932 return (mp);
2933 2933 }
2934 2934
2935 2935 /*
2936 2936 * Remove what was prepended above. Return b_cont and a pointer to the
2937 2937 * crypto data.
2938 2938 * The caller must call ipsec_free_crypto_data for mblk once it is done
2939 2939 * with the crypto data.
2940 2940 */
2941 2941 mblk_t *
2942 2942 ipsec_remove_crypto_data(mblk_t *crypto_mp, ipsec_crypto_t **icp)
2943 2943 {
2944 2944 ASSERT(crypto_mp->b_datap->db_type == M_EVENT);
2945 2945 ASSERT(MBLKL(crypto_mp) == sizeof (ipsec_crypto_t));
2946 2946
2947 2947 *icp = (ipsec_crypto_t *)crypto_mp->b_rptr;
2948 2948 return (crypto_mp->b_cont);
2949 2949 }
2950 2950
2951 2951 /*
2952 2952 * Free what was prepended above. Return b_cont.
2953 2953 */
2954 2954 mblk_t *
2955 2955 ipsec_free_crypto_data(mblk_t *crypto_mp)
2956 2956 {
2957 2957 mblk_t *mp;
2958 2958
2959 2959 ASSERT(crypto_mp->b_datap->db_type == M_EVENT);
2960 2960 ASSERT(MBLKL(crypto_mp) == sizeof (ipsec_crypto_t));
2961 2961
2962 2962 mp = crypto_mp->b_cont;
2963 2963 freeb(crypto_mp);
2964 2964 return (mp);
2965 2965 }
2966 2966
2967 2967 /*
2968 2968 * Create an ipsec_action_t based on the way an inbound packet was protected.
2969 2969 * Used to reflect traffic back to a sender.
2970 2970 *
2971 2971 * We don't bother interning the action into the hash table.
2972 2972 */
2973 2973 ipsec_action_t *
2974 2974 ipsec_in_to_out_action(ip_recv_attr_t *ira)
2975 2975 {
2976 2976 ipsa_t *ah_assoc, *esp_assoc;
2977 2977 uint_t auth_alg = 0, encr_alg = 0, espa_alg = 0;
2978 2978 ipsec_action_t *ap;
2979 2979 boolean_t unique;
2980 2980
2981 2981 ap = kmem_cache_alloc(ipsec_action_cache, KM_NOSLEEP);
2982 2982
2983 2983 if (ap == NULL)
2984 2984 return (NULL);
2985 2985
2986 2986 bzero(ap, sizeof (*ap));
2987 2987 HASH_NULL(ap, ipa_hash);
2988 2988 ap->ipa_next = NULL;
2989 2989 ap->ipa_refs = 1;
2990 2990
2991 2991 /*
2992 2992 * Get the algorithms that were used for this packet.
2993 2993 */
2994 2994 ap->ipa_act.ipa_type = IPSEC_ACT_APPLY;
2995 2995 ap->ipa_act.ipa_log = 0;
2996 2996 ASSERT(ira->ira_flags & IRAF_IPSEC_SECURE);
2997 2997
2998 2998 ah_assoc = ira->ira_ipsec_ah_sa;
2999 2999 ap->ipa_act.ipa_apply.ipp_use_ah = (ah_assoc != NULL);
3000 3000
3001 3001 esp_assoc = ira->ira_ipsec_esp_sa;
3002 3002 ap->ipa_act.ipa_apply.ipp_use_esp = (esp_assoc != NULL);
3003 3003
3004 3004 if (esp_assoc != NULL) {
3005 3005 encr_alg = esp_assoc->ipsa_encr_alg;
3006 3006 espa_alg = esp_assoc->ipsa_auth_alg;
3007 3007 ap->ipa_act.ipa_apply.ipp_use_espa = (espa_alg != 0);
3008 3008 }
3009 3009 if (ah_assoc != NULL)
3010 3010 auth_alg = ah_assoc->ipsa_auth_alg;
3011 3011
3012 3012 ap->ipa_act.ipa_apply.ipp_encr_alg = (uint8_t)encr_alg;
3013 3013 ap->ipa_act.ipa_apply.ipp_auth_alg = (uint8_t)auth_alg;
3014 3014 ap->ipa_act.ipa_apply.ipp_esp_auth_alg = (uint8_t)espa_alg;
3015 3015 ap->ipa_act.ipa_apply.ipp_use_se =
3016 3016 !!(ira->ira_flags & IRAF_IPSEC_DECAPS);
3017 3017 unique = B_FALSE;
3018 3018
3019 3019 if (esp_assoc != NULL) {
3020 3020 ap->ipa_act.ipa_apply.ipp_espa_minbits =
3021 3021 esp_assoc->ipsa_authkeybits;
3022 3022 ap->ipa_act.ipa_apply.ipp_espa_maxbits =
3023 3023 esp_assoc->ipsa_authkeybits;
3024 3024 ap->ipa_act.ipa_apply.ipp_espe_minbits =
3025 3025 esp_assoc->ipsa_encrkeybits;
3026 3026 ap->ipa_act.ipa_apply.ipp_espe_maxbits =
3027 3027 esp_assoc->ipsa_encrkeybits;
3028 3028 ap->ipa_act.ipa_apply.ipp_km_proto = esp_assoc->ipsa_kmp;
3029 3029 ap->ipa_act.ipa_apply.ipp_km_cookie = esp_assoc->ipsa_kmc;
3030 3030 if (esp_assoc->ipsa_flags & IPSA_F_UNIQUE)
3031 3031 unique = B_TRUE;
3032 3032 }
3033 3033 if (ah_assoc != NULL) {
3034 3034 ap->ipa_act.ipa_apply.ipp_ah_minbits =
3035 3035 ah_assoc->ipsa_authkeybits;
3036 3036 ap->ipa_act.ipa_apply.ipp_ah_maxbits =
3037 3037 ah_assoc->ipsa_authkeybits;
3038 3038 ap->ipa_act.ipa_apply.ipp_km_proto = ah_assoc->ipsa_kmp;
3039 3039 ap->ipa_act.ipa_apply.ipp_km_cookie = ah_assoc->ipsa_kmc;
3040 3040 if (ah_assoc->ipsa_flags & IPSA_F_UNIQUE)
3041 3041 unique = B_TRUE;
3042 3042 }
3043 3043 ap->ipa_act.ipa_apply.ipp_use_unique = unique;
3044 3044 ap->ipa_want_unique = unique;
3045 3045 ap->ipa_allow_clear = B_FALSE;
3046 3046 ap->ipa_want_se = !!(ira->ira_flags & IRAF_IPSEC_DECAPS);
3047 3047 ap->ipa_want_ah = (ah_assoc != NULL);
3048 3048 ap->ipa_want_esp = (esp_assoc != NULL);
3049 3049
3050 3050 ap->ipa_ovhd = ipsec_act_ovhd(&ap->ipa_act);
3051 3051
3052 3052 ap->ipa_act.ipa_apply.ipp_replay_depth = 0; /* don't care */
3053 3053
3054 3054 return (ap);
3055 3055 }
3056 3056
3057 3057
3058 3058 /*
3059 3059 * Compute the worst-case amount of extra space required by an action.
3060 3060 * Note that, because of the ESP considerations listed below, this is
3061 3061 * actually not the same as the best-case reduction in the MTU; in the
3062 3062 * future, we should pass additional information to this function to
3063 3063 * allow the actual MTU impact to be computed.
3064 3064 *
3065 3065 * AH: Revisit this if we implement algorithms with
3066 3066 * a verifier size of more than 12 bytes.
3067 3067 *
3068 3068 * ESP: A more exact but more messy computation would take into
3069 3069 * account the interaction between the cipher block size and the
3070 3070 * effective MTU, yielding the inner payload size which reflects a
3071 3071 * packet with *minimum* ESP padding..
3072 3072 */
3073 3073 int32_t
3074 3074 ipsec_act_ovhd(const ipsec_act_t *act)
3075 3075 {
3076 3076 int32_t overhead = 0;
3077 3077
3078 3078 if (act->ipa_type == IPSEC_ACT_APPLY) {
3079 3079 const ipsec_prot_t *ipp = &act->ipa_apply;
3080 3080
3081 3081 if (ipp->ipp_use_ah)
3082 3082 overhead += IPSEC_MAX_AH_HDR_SIZE;
3083 3083 if (ipp->ipp_use_esp) {
3084 3084 overhead += IPSEC_MAX_ESP_HDR_SIZE;
3085 3085 overhead += sizeof (struct udphdr);
3086 3086 }
3087 3087 if (ipp->ipp_use_se)
3088 3088 overhead += IP_SIMPLE_HDR_LENGTH;
3089 3089 }
3090 3090 return (overhead);
3091 3091 }
3092 3092
3093 3093 /*
3094 3094 * This hash function is used only when creating policies and thus is not
3095 3095 * performance-critical for packet flows.
3096 3096 *
3097 3097 * Future work: canonicalize the structures hashed with this (i.e.,
3098 3098 * zeroize padding) so the hash works correctly.
3099 3099 */
3100 3100 /* ARGSUSED */
3101 3101 static uint32_t
3102 3102 policy_hash(int size, const void *start, const void *end)
3103 3103 {
3104 3104 return (0);
3105 3105 }
3106 3106
3107 3107
3108 3108 /*
3109 3109 * Hash function macros for each address type.
3110 3110 *
3111 3111 * The IPV6 hash function assumes that the low order 32-bits of the
3112 3112 * address (typically containing the low order 24 bits of the mac
3113 3113 * address) are reasonably well-distributed. Revisit this if we run
3114 3114 * into trouble from lots of collisions on ::1 addresses and the like
3115 3115 * (seems unlikely).
3116 3116 */
3117 3117 #define IPSEC_IPV4_HASH(a, n) ((a) % (n))
3118 3118 #define IPSEC_IPV6_HASH(a, n) (((a).s6_addr32[3]) % (n))
3119 3119
3120 3120 /*
3121 3121 * These two hash functions should produce coordinated values
3122 3122 * but have slightly different roles.
3123 3123 */
3124 3124 static uint32_t
3125 3125 selkey_hash(const ipsec_selkey_t *selkey, netstack_t *ns)
3126 3126 {
3127 3127 uint32_t valid = selkey->ipsl_valid;
3128 3128 ipsec_stack_t *ipss = ns->netstack_ipsec;
3129 3129
3130 3130 if (!(valid & IPSL_REMOTE_ADDR))
3131 3131 return (IPSEC_SEL_NOHASH);
3132 3132
3133 3133 if (valid & IPSL_IPV4) {
3134 3134 if (selkey->ipsl_remote_pfxlen == 32) {
3135 3135 return (IPSEC_IPV4_HASH(selkey->ipsl_remote.ipsad_v4,
3136 3136 ipss->ipsec_spd_hashsize));
3137 3137 }
3138 3138 }
3139 3139 if (valid & IPSL_IPV6) {
3140 3140 if (selkey->ipsl_remote_pfxlen == 128) {
3141 3141 return (IPSEC_IPV6_HASH(selkey->ipsl_remote.ipsad_v6,
3142 3142 ipss->ipsec_spd_hashsize));
3143 3143 }
3144 3144 }
3145 3145 return (IPSEC_SEL_NOHASH);
3146 3146 }
3147 3147
3148 3148 static uint32_t
3149 3149 selector_hash(ipsec_selector_t *sel, ipsec_policy_root_t *root)
3150 3150 {
3151 3151 if (sel->ips_isv4) {
3152 3152 return (IPSEC_IPV4_HASH(sel->ips_remote_addr_v4,
3153 3153 root->ipr_nchains));
3154 3154 }
3155 3155 return (IPSEC_IPV6_HASH(sel->ips_remote_addr_v6, root->ipr_nchains));
3156 3156 }
3157 3157
3158 3158 /*
3159 3159 * Intern actions into the action hash table.
3160 3160 */
3161 3161 ipsec_action_t *
3162 3162 ipsec_act_find(const ipsec_act_t *a, int n, netstack_t *ns)
3163 3163 {
3164 3164 int i;
3165 3165 uint32_t hval;
3166 3166 ipsec_action_t *ap;
3167 3167 ipsec_action_t *prev = NULL;
3168 3168 int32_t overhead, maxovhd = 0;
3169 3169 boolean_t allow_clear = B_FALSE;
3170 3170 boolean_t want_ah = B_FALSE;
3171 3171 boolean_t want_esp = B_FALSE;
3172 3172 boolean_t want_se = B_FALSE;
3173 3173 boolean_t want_unique = B_FALSE;
3174 3174 ipsec_stack_t *ipss = ns->netstack_ipsec;
3175 3175
3176 3176 /*
3177 3177 * TODO: should canonicalize a[] (i.e., zeroize any padding)
3178 3178 * so we can use a non-trivial policy_hash function.
3179 3179 */
3180 3180 for (i = n-1; i >= 0; i--) {
3181 3181 hval = policy_hash(IPSEC_ACTION_HASH_SIZE, &a[i], &a[n]);
3182 3182
3183 3183 HASH_LOCK(ipss->ipsec_action_hash, hval);
3184 3184
3185 3185 for (HASH_ITERATE(ap, ipa_hash,
3186 3186 ipss->ipsec_action_hash, hval)) {
3187 3187 if (bcmp(&ap->ipa_act, &a[i], sizeof (*a)) != 0)
3188 3188 continue;
3189 3189 if (ap->ipa_next != prev)
3190 3190 continue;
3191 3191 break;
3192 3192 }
3193 3193 if (ap != NULL) {
3194 3194 HASH_UNLOCK(ipss->ipsec_action_hash, hval);
3195 3195 prev = ap;
3196 3196 continue;
3197 3197 }
3198 3198 /*
3199 3199 * need to allocate a new one..
3200 3200 */
3201 3201 ap = kmem_cache_alloc(ipsec_action_cache, KM_NOSLEEP);
3202 3202 if (ap == NULL) {
3203 3203 HASH_UNLOCK(ipss->ipsec_action_hash, hval);
3204 3204 if (prev != NULL)
3205 3205 ipsec_action_free(prev);
3206 3206 return (NULL);
3207 3207 }
3208 3208 HASH_INSERT(ap, ipa_hash, ipss->ipsec_action_hash, hval);
3209 3209
3210 3210 ap->ipa_next = prev;
3211 3211 ap->ipa_act = a[i];
3212 3212
3213 3213 overhead = ipsec_act_ovhd(&a[i]);
3214 3214 if (maxovhd < overhead)
3215 3215 maxovhd = overhead;
3216 3216
3217 3217 if ((a[i].ipa_type == IPSEC_ACT_BYPASS) ||
3218 3218 (a[i].ipa_type == IPSEC_ACT_CLEAR))
3219 3219 allow_clear = B_TRUE;
3220 3220 if (a[i].ipa_type == IPSEC_ACT_APPLY) {
3221 3221 const ipsec_prot_t *ipp = &a[i].ipa_apply;
3222 3222
3223 3223 ASSERT(ipp->ipp_use_ah || ipp->ipp_use_esp);
3224 3224 want_ah |= ipp->ipp_use_ah;
3225 3225 want_esp |= ipp->ipp_use_esp;
3226 3226 want_se |= ipp->ipp_use_se;
3227 3227 want_unique |= ipp->ipp_use_unique;
3228 3228 }
3229 3229 ap->ipa_allow_clear = allow_clear;
3230 3230 ap->ipa_want_ah = want_ah;
3231 3231 ap->ipa_want_esp = want_esp;
3232 3232 ap->ipa_want_se = want_se;
3233 3233 ap->ipa_want_unique = want_unique;
3234 3234 ap->ipa_refs = 1; /* from the hash table */
3235 3235 ap->ipa_ovhd = maxovhd;
3236 3236 if (prev)
3237 3237 prev->ipa_refs++;
3238 3238 prev = ap;
3239 3239 HASH_UNLOCK(ipss->ipsec_action_hash, hval);
3240 3240 }
3241 3241
3242 3242 ap->ipa_refs++; /* caller's reference */
3243 3243
3244 3244 return (ap);
3245 3245 }
3246 3246
3247 3247 /*
3248 3248 * Called when refcount goes to 0, indicating that all references to this
3249 3249 * node are gone.
3250 3250 *
3251 3251 * This does not unchain the action from the hash table.
3252 3252 */
3253 3253 void
3254 3254 ipsec_action_free(ipsec_action_t *ap)
3255 3255 {
|
↓ open down ↓ |
3255 lines elided |
↑ open up ↑ |
3256 3256 for (;;) {
3257 3257 ipsec_action_t *np = ap->ipa_next;
3258 3258 ASSERT(ap->ipa_refs == 0);
3259 3259 ASSERT(ap->ipa_hash.hash_pp == NULL);
3260 3260 kmem_cache_free(ipsec_action_cache, ap);
3261 3261 ap = np;
3262 3262 /* Inlined IPACT_REFRELE -- avoid recursion */
3263 3263 if (ap == NULL)
3264 3264 break;
3265 3265 membar_exit();
3266 - if (atomic_add_32_nv(&(ap)->ipa_refs, -1) != 0)
3266 + if (atomic_dec_32_nv(&(ap)->ipa_refs) != 0)
3267 3267 break;
3268 3268 /* End inlined IPACT_REFRELE */
3269 3269 }
3270 3270 }
3271 3271
3272 3272 /*
3273 3273 * Called when the action hash table goes away.
3274 3274 *
3275 3275 * The actions can be queued on an mblk with ipsec_in or
3276 3276 * ipsec_out, hence the actions might still be around.
3277 3277 * But we decrement ipa_refs here since we no longer have
3278 3278 * a reference to the action from the hash table.
3279 3279 */
3280 3280 static void
3281 3281 ipsec_action_free_table(ipsec_action_t *ap)
3282 3282 {
3283 3283 while (ap != NULL) {
3284 3284 ipsec_action_t *np = ap->ipa_next;
3285 3285
3286 3286 /* FIXME: remove? */
3287 3287 (void) printf("ipsec_action_free_table(%p) ref %d\n",
3288 3288 (void *)ap, ap->ipa_refs);
3289 3289 ASSERT(ap->ipa_refs > 0);
3290 3290 IPACT_REFRELE(ap);
3291 3291 ap = np;
3292 3292 }
3293 3293 }
3294 3294
3295 3295 /*
3296 3296 * Need to walk all stack instances since the reclaim function
3297 3297 * is global for all instances
3298 3298 */
3299 3299 /* ARGSUSED */
3300 3300 static void
3301 3301 ipsec_action_reclaim(void *arg)
3302 3302 {
3303 3303 netstack_handle_t nh;
3304 3304 netstack_t *ns;
3305 3305 ipsec_stack_t *ipss;
3306 3306
3307 3307 netstack_next_init(&nh);
3308 3308 while ((ns = netstack_next(&nh)) != NULL) {
3309 3309 /*
3310 3310 * netstack_next() can return a netstack_t with a NULL
3311 3311 * netstack_ipsec at boot time.
3312 3312 */
3313 3313 if ((ipss = ns->netstack_ipsec) == NULL) {
3314 3314 netstack_rele(ns);
3315 3315 continue;
3316 3316 }
3317 3317 ipsec_action_reclaim_stack(ipss);
3318 3318 netstack_rele(ns);
3319 3319 }
3320 3320 netstack_next_fini(&nh);
3321 3321 }
3322 3322
3323 3323 /*
3324 3324 * Periodically sweep action hash table for actions with refcount==1, and
3325 3325 * nuke them. We cannot do this "on demand" (i.e., from IPACT_REFRELE)
3326 3326 * because we can't close the race between another thread finding the action
3327 3327 * in the hash table without holding the bucket lock during IPACT_REFRELE.
3328 3328 * Instead, we run this function sporadically to clean up after ourselves;
3329 3329 * we also set it as the "reclaim" function for the action kmem_cache.
3330 3330 *
3331 3331 * Note that it may take several passes of ipsec_action_gc() to free all
3332 3332 * "stale" actions.
3333 3333 */
3334 3334 static void
3335 3335 ipsec_action_reclaim_stack(ipsec_stack_t *ipss)
3336 3336 {
3337 3337 int i;
3338 3338
3339 3339 for (i = 0; i < IPSEC_ACTION_HASH_SIZE; i++) {
3340 3340 ipsec_action_t *ap, *np;
3341 3341
3342 3342 /* skip the lock if nobody home */
3343 3343 if (ipss->ipsec_action_hash[i].hash_head == NULL)
3344 3344 continue;
3345 3345
3346 3346 HASH_LOCK(ipss->ipsec_action_hash, i);
3347 3347 for (ap = ipss->ipsec_action_hash[i].hash_head;
3348 3348 ap != NULL; ap = np) {
3349 3349 ASSERT(ap->ipa_refs > 0);
3350 3350 np = ap->ipa_hash.hash_next;
3351 3351 if (ap->ipa_refs > 1)
3352 3352 continue;
3353 3353 HASH_UNCHAIN(ap, ipa_hash,
3354 3354 ipss->ipsec_action_hash, i);
3355 3355 IPACT_REFRELE(ap);
3356 3356 }
3357 3357 HASH_UNLOCK(ipss->ipsec_action_hash, i);
3358 3358 }
3359 3359 }
3360 3360
3361 3361 /*
3362 3362 * Intern a selector set into the selector set hash table.
3363 3363 * This is simpler than the actions case..
3364 3364 */
3365 3365 static ipsec_sel_t *
3366 3366 ipsec_find_sel(ipsec_selkey_t *selkey, netstack_t *ns)
3367 3367 {
3368 3368 ipsec_sel_t *sp;
3369 3369 uint32_t hval, bucket;
3370 3370 ipsec_stack_t *ipss = ns->netstack_ipsec;
3371 3371
3372 3372 /*
3373 3373 * Exactly one AF bit should be set in selkey.
3374 3374 */
3375 3375 ASSERT(!(selkey->ipsl_valid & IPSL_IPV4) ^
3376 3376 !(selkey->ipsl_valid & IPSL_IPV6));
3377 3377
3378 3378 hval = selkey_hash(selkey, ns);
3379 3379 /* Set pol_hval to uninitialized until we put it in a polhead. */
3380 3380 selkey->ipsl_sel_hval = hval;
3381 3381
3382 3382 bucket = (hval == IPSEC_SEL_NOHASH) ? 0 : hval;
3383 3383
3384 3384 ASSERT(!HASH_LOCKED(ipss->ipsec_sel_hash, bucket));
3385 3385 HASH_LOCK(ipss->ipsec_sel_hash, bucket);
3386 3386
3387 3387 for (HASH_ITERATE(sp, ipsl_hash, ipss->ipsec_sel_hash, bucket)) {
3388 3388 if (bcmp(&sp->ipsl_key, selkey,
3389 3389 offsetof(ipsec_selkey_t, ipsl_pol_hval)) == 0)
3390 3390 break;
3391 3391 }
3392 3392 if (sp != NULL) {
3393 3393 sp->ipsl_refs++;
3394 3394
3395 3395 HASH_UNLOCK(ipss->ipsec_sel_hash, bucket);
3396 3396 return (sp);
3397 3397 }
3398 3398
3399 3399 sp = kmem_cache_alloc(ipsec_sel_cache, KM_NOSLEEP);
3400 3400 if (sp == NULL) {
3401 3401 HASH_UNLOCK(ipss->ipsec_sel_hash, bucket);
3402 3402 return (NULL);
3403 3403 }
3404 3404
3405 3405 HASH_INSERT(sp, ipsl_hash, ipss->ipsec_sel_hash, bucket);
3406 3406 sp->ipsl_refs = 2; /* one for hash table, one for caller */
3407 3407 sp->ipsl_key = *selkey;
3408 3408 /* Set to uninitalized and have insertion into polhead fix things. */
3409 3409 if (selkey->ipsl_sel_hval != IPSEC_SEL_NOHASH)
3410 3410 sp->ipsl_key.ipsl_pol_hval = 0;
3411 3411 else
3412 3412 sp->ipsl_key.ipsl_pol_hval = IPSEC_SEL_NOHASH;
3413 3413
3414 3414 HASH_UNLOCK(ipss->ipsec_sel_hash, bucket);
3415 3415
3416 3416 return (sp);
3417 3417 }
3418 3418
3419 3419 static void
3420 3420 ipsec_sel_rel(ipsec_sel_t **spp, netstack_t *ns)
3421 3421 {
3422 3422 ipsec_sel_t *sp = *spp;
3423 3423 int hval = sp->ipsl_key.ipsl_sel_hval;
3424 3424 ipsec_stack_t *ipss = ns->netstack_ipsec;
3425 3425
3426 3426 *spp = NULL;
3427 3427
3428 3428 if (hval == IPSEC_SEL_NOHASH)
3429 3429 hval = 0;
3430 3430
3431 3431 ASSERT(!HASH_LOCKED(ipss->ipsec_sel_hash, hval));
3432 3432 HASH_LOCK(ipss->ipsec_sel_hash, hval);
3433 3433 if (--sp->ipsl_refs == 1) {
3434 3434 HASH_UNCHAIN(sp, ipsl_hash, ipss->ipsec_sel_hash, hval);
3435 3435 sp->ipsl_refs--;
3436 3436 HASH_UNLOCK(ipss->ipsec_sel_hash, hval);
3437 3437 ASSERT(sp->ipsl_refs == 0);
3438 3438 kmem_cache_free(ipsec_sel_cache, sp);
3439 3439 /* Caller unlocks */
3440 3440 return;
3441 3441 }
3442 3442
3443 3443 HASH_UNLOCK(ipss->ipsec_sel_hash, hval);
3444 3444 }
3445 3445
3446 3446 /*
3447 3447 * Free a policy rule which we know is no longer being referenced.
3448 3448 */
3449 3449 void
3450 3450 ipsec_policy_free(ipsec_policy_t *ipp)
3451 3451 {
3452 3452 ASSERT(ipp->ipsp_refs == 0);
3453 3453 ASSERT(ipp->ipsp_sel != NULL);
3454 3454 ASSERT(ipp->ipsp_act != NULL);
3455 3455 ASSERT(ipp->ipsp_netstack != NULL);
3456 3456
3457 3457 ipsec_sel_rel(&ipp->ipsp_sel, ipp->ipsp_netstack);
3458 3458 IPACT_REFRELE(ipp->ipsp_act);
3459 3459 kmem_cache_free(ipsec_pol_cache, ipp);
3460 3460 }
3461 3461
3462 3462 /*
3463 3463 * Construction of new policy rules; construct a policy, and add it to
3464 3464 * the appropriate tables.
3465 3465 */
3466 3466 ipsec_policy_t *
3467 3467 ipsec_policy_create(ipsec_selkey_t *keys, const ipsec_act_t *a,
3468 3468 int nacts, int prio, uint64_t *index_ptr, netstack_t *ns)
3469 3469 {
3470 3470 ipsec_action_t *ap;
3471 3471 ipsec_sel_t *sp;
3472 3472 ipsec_policy_t *ipp;
3473 3473 ipsec_stack_t *ipss = ns->netstack_ipsec;
3474 3474
3475 3475 if (index_ptr == NULL)
3476 3476 index_ptr = &ipss->ipsec_next_policy_index;
3477 3477
3478 3478 ipp = kmem_cache_alloc(ipsec_pol_cache, KM_NOSLEEP);
3479 3479 ap = ipsec_act_find(a, nacts, ns);
3480 3480 sp = ipsec_find_sel(keys, ns);
3481 3481
3482 3482 if ((ap == NULL) || (sp == NULL) || (ipp == NULL)) {
3483 3483 if (ap != NULL) {
3484 3484 IPACT_REFRELE(ap);
3485 3485 }
3486 3486 if (sp != NULL)
3487 3487 ipsec_sel_rel(&sp, ns);
3488 3488 if (ipp != NULL)
3489 3489 kmem_cache_free(ipsec_pol_cache, ipp);
3490 3490 return (NULL);
3491 3491 }
3492 3492
3493 3493 HASH_NULL(ipp, ipsp_hash);
3494 3494
3495 3495 ipp->ipsp_netstack = ns; /* Needed for ipsec_policy_free */
3496 3496 ipp->ipsp_refs = 1; /* caller's reference */
3497 3497 ipp->ipsp_sel = sp;
3498 3498 ipp->ipsp_act = ap;
3499 3499 ipp->ipsp_prio = prio; /* rule priority */
3500 3500 ipp->ipsp_index = *index_ptr;
3501 3501 (*index_ptr)++;
3502 3502
3503 3503 return (ipp);
3504 3504 }
3505 3505
3506 3506 static void
3507 3507 ipsec_update_present_flags(ipsec_stack_t *ipss)
3508 3508 {
3509 3509 boolean_t hashpol;
3510 3510
3511 3511 hashpol = (avl_numnodes(&ipss->ipsec_system_policy.iph_rulebyid) > 0);
3512 3512
3513 3513 if (hashpol) {
3514 3514 ipss->ipsec_outbound_v4_policy_present = B_TRUE;
3515 3515 ipss->ipsec_outbound_v6_policy_present = B_TRUE;
3516 3516 ipss->ipsec_inbound_v4_policy_present = B_TRUE;
3517 3517 ipss->ipsec_inbound_v6_policy_present = B_TRUE;
3518 3518 return;
3519 3519 }
3520 3520
3521 3521 ipss->ipsec_outbound_v4_policy_present = (NULL !=
3522 3522 ipss->ipsec_system_policy.iph_root[IPSEC_TYPE_OUTBOUND].
3523 3523 ipr_nonhash[IPSEC_AF_V4]);
3524 3524 ipss->ipsec_outbound_v6_policy_present = (NULL !=
3525 3525 ipss->ipsec_system_policy.iph_root[IPSEC_TYPE_OUTBOUND].
3526 3526 ipr_nonhash[IPSEC_AF_V6]);
3527 3527 ipss->ipsec_inbound_v4_policy_present = (NULL !=
3528 3528 ipss->ipsec_system_policy.iph_root[IPSEC_TYPE_INBOUND].
3529 3529 ipr_nonhash[IPSEC_AF_V4]);
3530 3530 ipss->ipsec_inbound_v6_policy_present = (NULL !=
3531 3531 ipss->ipsec_system_policy.iph_root[IPSEC_TYPE_INBOUND].
3532 3532 ipr_nonhash[IPSEC_AF_V6]);
3533 3533 }
3534 3534
3535 3535 boolean_t
3536 3536 ipsec_policy_delete(ipsec_policy_head_t *php, ipsec_selkey_t *keys, int dir,
3537 3537 netstack_t *ns)
3538 3538 {
3539 3539 ipsec_sel_t *sp;
3540 3540 ipsec_policy_t *ip, *nip, *head;
3541 3541 int af;
3542 3542 ipsec_policy_root_t *pr = &php->iph_root[dir];
3543 3543
3544 3544 sp = ipsec_find_sel(keys, ns);
3545 3545
3546 3546 if (sp == NULL)
3547 3547 return (B_FALSE);
3548 3548
3549 3549 af = (sp->ipsl_key.ipsl_valid & IPSL_IPV4) ? IPSEC_AF_V4 : IPSEC_AF_V6;
3550 3550
3551 3551 rw_enter(&php->iph_lock, RW_WRITER);
3552 3552
3553 3553 if (sp->ipsl_key.ipsl_pol_hval == IPSEC_SEL_NOHASH) {
3554 3554 head = pr->ipr_nonhash[af];
3555 3555 } else {
3556 3556 head = pr->ipr_hash[sp->ipsl_key.ipsl_pol_hval].hash_head;
3557 3557 }
3558 3558
3559 3559 for (ip = head; ip != NULL; ip = nip) {
3560 3560 nip = ip->ipsp_hash.hash_next;
3561 3561 if (ip->ipsp_sel != sp) {
3562 3562 continue;
3563 3563 }
3564 3564
3565 3565 IPPOL_UNCHAIN(php, ip);
3566 3566
3567 3567 php->iph_gen++;
3568 3568 ipsec_update_present_flags(ns->netstack_ipsec);
3569 3569
3570 3570 rw_exit(&php->iph_lock);
3571 3571
3572 3572 ipsec_sel_rel(&sp, ns);
3573 3573
3574 3574 return (B_TRUE);
3575 3575 }
3576 3576
3577 3577 rw_exit(&php->iph_lock);
3578 3578 ipsec_sel_rel(&sp, ns);
3579 3579 return (B_FALSE);
3580 3580 }
3581 3581
3582 3582 int
3583 3583 ipsec_policy_delete_index(ipsec_policy_head_t *php, uint64_t policy_index,
3584 3584 netstack_t *ns)
3585 3585 {
3586 3586 boolean_t found = B_FALSE;
3587 3587 ipsec_policy_t ipkey;
3588 3588 ipsec_policy_t *ip;
3589 3589 avl_index_t where;
3590 3590
3591 3591 bzero(&ipkey, sizeof (ipkey));
3592 3592 ipkey.ipsp_index = policy_index;
3593 3593
3594 3594 rw_enter(&php->iph_lock, RW_WRITER);
3595 3595
3596 3596 /*
3597 3597 * We could be cleverer here about the walk.
3598 3598 * but well, (k+1)*log(N) will do for now (k==number of matches,
3599 3599 * N==number of table entries
3600 3600 */
3601 3601 for (;;) {
3602 3602 ip = (ipsec_policy_t *)avl_find(&php->iph_rulebyid,
3603 3603 (void *)&ipkey, &where);
3604 3604 ASSERT(ip == NULL);
3605 3605
3606 3606 ip = avl_nearest(&php->iph_rulebyid, where, AVL_AFTER);
3607 3607
3608 3608 if (ip == NULL)
3609 3609 break;
3610 3610
3611 3611 if (ip->ipsp_index != policy_index) {
3612 3612 ASSERT(ip->ipsp_index > policy_index);
3613 3613 break;
3614 3614 }
3615 3615
3616 3616 IPPOL_UNCHAIN(php, ip);
3617 3617 found = B_TRUE;
3618 3618 }
3619 3619
3620 3620 if (found) {
3621 3621 php->iph_gen++;
3622 3622 ipsec_update_present_flags(ns->netstack_ipsec);
3623 3623 }
3624 3624
3625 3625 rw_exit(&php->iph_lock);
3626 3626
3627 3627 return (found ? 0 : ENOENT);
3628 3628 }
3629 3629
3630 3630 /*
3631 3631 * Given a constructed ipsec_policy_t policy rule, see if it can be entered
3632 3632 * into the correct policy ruleset. As a side-effect, it sets the hash
3633 3633 * entries on "ipp"'s ipsp_pol_hval.
3634 3634 *
3635 3635 * Returns B_TRUE if it can be entered, B_FALSE if it can't be (because a
3636 3636 * duplicate policy exists with exactly the same selectors), or an icmp
3637 3637 * rule exists with a different encryption/authentication action.
3638 3638 */
3639 3639 boolean_t
3640 3640 ipsec_check_policy(ipsec_policy_head_t *php, ipsec_policy_t *ipp, int direction)
3641 3641 {
3642 3642 ipsec_policy_root_t *pr = &php->iph_root[direction];
3643 3643 int af = -1;
3644 3644 ipsec_policy_t *p2, *head;
3645 3645 uint8_t check_proto;
3646 3646 ipsec_selkey_t *selkey = &ipp->ipsp_sel->ipsl_key;
3647 3647 uint32_t valid = selkey->ipsl_valid;
3648 3648
3649 3649 if (valid & IPSL_IPV6) {
3650 3650 ASSERT(!(valid & IPSL_IPV4));
3651 3651 af = IPSEC_AF_V6;
3652 3652 check_proto = IPPROTO_ICMPV6;
3653 3653 } else {
3654 3654 ASSERT(valid & IPSL_IPV4);
3655 3655 af = IPSEC_AF_V4;
3656 3656 check_proto = IPPROTO_ICMP;
3657 3657 }
3658 3658
3659 3659 ASSERT(RW_WRITE_HELD(&php->iph_lock));
3660 3660
3661 3661 /*
3662 3662 * Double-check that we don't have any duplicate selectors here.
3663 3663 * Because selectors are interned below, we need only compare pointers
3664 3664 * for equality.
3665 3665 */
3666 3666 if (selkey->ipsl_sel_hval == IPSEC_SEL_NOHASH) {
3667 3667 head = pr->ipr_nonhash[af];
3668 3668 } else {
3669 3669 selkey->ipsl_pol_hval =
3670 3670 (selkey->ipsl_valid & IPSL_IPV4) ?
3671 3671 IPSEC_IPV4_HASH(selkey->ipsl_remote.ipsad_v4,
3672 3672 pr->ipr_nchains) :
3673 3673 IPSEC_IPV6_HASH(selkey->ipsl_remote.ipsad_v6,
3674 3674 pr->ipr_nchains);
3675 3675
3676 3676 head = pr->ipr_hash[selkey->ipsl_pol_hval].hash_head;
3677 3677 }
3678 3678
3679 3679 for (p2 = head; p2 != NULL; p2 = p2->ipsp_hash.hash_next) {
3680 3680 if (p2->ipsp_sel == ipp->ipsp_sel)
3681 3681 return (B_FALSE);
3682 3682 }
3683 3683
3684 3684 /*
3685 3685 * If it's ICMP and not a drop or pass rule, run through the ICMP
3686 3686 * rules and make sure the action is either new or the same as any
3687 3687 * other actions. We don't have to check the full chain because
3688 3688 * discard and bypass will override all other actions
3689 3689 */
3690 3690
3691 3691 if (valid & IPSL_PROTOCOL &&
3692 3692 selkey->ipsl_proto == check_proto &&
3693 3693 (ipp->ipsp_act->ipa_act.ipa_type == IPSEC_ACT_APPLY)) {
3694 3694
3695 3695 for (p2 = head; p2 != NULL; p2 = p2->ipsp_hash.hash_next) {
3696 3696
3697 3697 if (p2->ipsp_sel->ipsl_key.ipsl_valid & IPSL_PROTOCOL &&
3698 3698 p2->ipsp_sel->ipsl_key.ipsl_proto == check_proto &&
3699 3699 (p2->ipsp_act->ipa_act.ipa_type ==
3700 3700 IPSEC_ACT_APPLY)) {
3701 3701 return (ipsec_compare_action(p2, ipp));
3702 3702 }
3703 3703 }
3704 3704 }
3705 3705
3706 3706 return (B_TRUE);
3707 3707 }
3708 3708
3709 3709 /*
3710 3710 * compare the action chains of two policies for equality
3711 3711 * B_TRUE -> effective equality
3712 3712 */
3713 3713
3714 3714 static boolean_t
3715 3715 ipsec_compare_action(ipsec_policy_t *p1, ipsec_policy_t *p2)
3716 3716 {
3717 3717
3718 3718 ipsec_action_t *act1, *act2;
3719 3719
3720 3720 /* We have a valid rule. Let's compare the actions */
3721 3721 if (p1->ipsp_act == p2->ipsp_act) {
3722 3722 /* same action. We are good */
3723 3723 return (B_TRUE);
3724 3724 }
3725 3725
3726 3726 /* we have to walk the chain */
3727 3727
3728 3728 act1 = p1->ipsp_act;
3729 3729 act2 = p2->ipsp_act;
3730 3730
3731 3731 while (act1 != NULL && act2 != NULL) {
3732 3732
3733 3733 /* otherwise, Are we close enough? */
3734 3734 if (act1->ipa_allow_clear != act2->ipa_allow_clear ||
3735 3735 act1->ipa_want_ah != act2->ipa_want_ah ||
3736 3736 act1->ipa_want_esp != act2->ipa_want_esp ||
3737 3737 act1->ipa_want_se != act2->ipa_want_se) {
3738 3738 /* Nope, we aren't */
3739 3739 return (B_FALSE);
3740 3740 }
3741 3741
3742 3742 if (act1->ipa_want_ah) {
3743 3743 if (act1->ipa_act.ipa_apply.ipp_auth_alg !=
3744 3744 act2->ipa_act.ipa_apply.ipp_auth_alg) {
3745 3745 return (B_FALSE);
3746 3746 }
3747 3747
3748 3748 if (act1->ipa_act.ipa_apply.ipp_ah_minbits !=
3749 3749 act2->ipa_act.ipa_apply.ipp_ah_minbits ||
3750 3750 act1->ipa_act.ipa_apply.ipp_ah_maxbits !=
3751 3751 act2->ipa_act.ipa_apply.ipp_ah_maxbits) {
3752 3752 return (B_FALSE);
3753 3753 }
3754 3754 }
3755 3755
3756 3756 if (act1->ipa_want_esp) {
3757 3757 if (act1->ipa_act.ipa_apply.ipp_use_esp !=
3758 3758 act2->ipa_act.ipa_apply.ipp_use_esp ||
3759 3759 act1->ipa_act.ipa_apply.ipp_use_espa !=
3760 3760 act2->ipa_act.ipa_apply.ipp_use_espa) {
3761 3761 return (B_FALSE);
3762 3762 }
3763 3763
3764 3764 if (act1->ipa_act.ipa_apply.ipp_use_esp) {
3765 3765 if (act1->ipa_act.ipa_apply.ipp_encr_alg !=
3766 3766 act2->ipa_act.ipa_apply.ipp_encr_alg) {
3767 3767 return (B_FALSE);
3768 3768 }
3769 3769
3770 3770 if (act1->ipa_act.ipa_apply.ipp_espe_minbits !=
3771 3771 act2->ipa_act.ipa_apply.ipp_espe_minbits ||
3772 3772 act1->ipa_act.ipa_apply.ipp_espe_maxbits !=
3773 3773 act2->ipa_act.ipa_apply.ipp_espe_maxbits) {
3774 3774 return (B_FALSE);
3775 3775 }
3776 3776 }
3777 3777
3778 3778 if (act1->ipa_act.ipa_apply.ipp_use_espa) {
3779 3779 if (act1->ipa_act.ipa_apply.ipp_esp_auth_alg !=
3780 3780 act2->ipa_act.ipa_apply.ipp_esp_auth_alg) {
3781 3781 return (B_FALSE);
3782 3782 }
3783 3783
3784 3784 if (act1->ipa_act.ipa_apply.ipp_espa_minbits !=
3785 3785 act2->ipa_act.ipa_apply.ipp_espa_minbits ||
3786 3786 act1->ipa_act.ipa_apply.ipp_espa_maxbits !=
3787 3787 act2->ipa_act.ipa_apply.ipp_espa_maxbits) {
3788 3788 return (B_FALSE);
3789 3789 }
3790 3790 }
3791 3791
3792 3792 }
3793 3793
3794 3794 act1 = act1->ipa_next;
3795 3795 act2 = act2->ipa_next;
3796 3796 }
3797 3797
3798 3798 if (act1 != NULL || act2 != NULL) {
3799 3799 return (B_FALSE);
3800 3800 }
3801 3801
3802 3802 return (B_TRUE);
3803 3803 }
3804 3804
3805 3805
3806 3806 /*
3807 3807 * Given a constructed ipsec_policy_t policy rule, enter it into
3808 3808 * the correct policy ruleset.
3809 3809 *
3810 3810 * ipsec_check_policy() is assumed to have succeeded first (to check for
3811 3811 * duplicates).
3812 3812 */
3813 3813 void
3814 3814 ipsec_enter_policy(ipsec_policy_head_t *php, ipsec_policy_t *ipp, int direction,
3815 3815 netstack_t *ns)
3816 3816 {
3817 3817 ipsec_policy_root_t *pr = &php->iph_root[direction];
3818 3818 ipsec_selkey_t *selkey = &ipp->ipsp_sel->ipsl_key;
3819 3819 uint32_t valid = selkey->ipsl_valid;
3820 3820 uint32_t hval = selkey->ipsl_pol_hval;
3821 3821 int af = -1;
3822 3822
3823 3823 ASSERT(RW_WRITE_HELD(&php->iph_lock));
3824 3824
3825 3825 if (valid & IPSL_IPV6) {
3826 3826 ASSERT(!(valid & IPSL_IPV4));
3827 3827 af = IPSEC_AF_V6;
3828 3828 } else {
3829 3829 ASSERT(valid & IPSL_IPV4);
3830 3830 af = IPSEC_AF_V4;
3831 3831 }
3832 3832
3833 3833 php->iph_gen++;
3834 3834
3835 3835 if (hval == IPSEC_SEL_NOHASH) {
3836 3836 HASHLIST_INSERT(ipp, ipsp_hash, pr->ipr_nonhash[af]);
3837 3837 } else {
3838 3838 HASH_LOCK(pr->ipr_hash, hval);
3839 3839 HASH_INSERT(ipp, ipsp_hash, pr->ipr_hash, hval);
3840 3840 HASH_UNLOCK(pr->ipr_hash, hval);
3841 3841 }
3842 3842
3843 3843 ipsec_insert_always(&php->iph_rulebyid, ipp);
3844 3844
3845 3845 ipsec_update_present_flags(ns->netstack_ipsec);
3846 3846 }
3847 3847
3848 3848 static void
3849 3849 ipsec_ipr_flush(ipsec_policy_head_t *php, ipsec_policy_root_t *ipr)
3850 3850 {
3851 3851 ipsec_policy_t *ip, *nip;
3852 3852 int af, chain, nchain;
3853 3853
3854 3854 for (af = 0; af < IPSEC_NAF; af++) {
3855 3855 for (ip = ipr->ipr_nonhash[af]; ip != NULL; ip = nip) {
3856 3856 nip = ip->ipsp_hash.hash_next;
3857 3857 IPPOL_UNCHAIN(php, ip);
3858 3858 }
3859 3859 ipr->ipr_nonhash[af] = NULL;
3860 3860 }
3861 3861 nchain = ipr->ipr_nchains;
3862 3862
3863 3863 for (chain = 0; chain < nchain; chain++) {
3864 3864 for (ip = ipr->ipr_hash[chain].hash_head; ip != NULL;
3865 3865 ip = nip) {
3866 3866 nip = ip->ipsp_hash.hash_next;
3867 3867 IPPOL_UNCHAIN(php, ip);
3868 3868 }
3869 3869 ipr->ipr_hash[chain].hash_head = NULL;
3870 3870 }
3871 3871 }
3872 3872
3873 3873 /*
3874 3874 * Create and insert inbound or outbound policy associated with actp for the
3875 3875 * address family fam into the policy head ph. Returns B_TRUE if policy was
3876 3876 * inserted, and B_FALSE otherwise.
3877 3877 */
3878 3878 boolean_t
3879 3879 ipsec_polhead_insert(ipsec_policy_head_t *ph, ipsec_act_t *actp, uint_t nact,
3880 3880 int fam, int ptype, netstack_t *ns)
3881 3881 {
3882 3882 ipsec_selkey_t sel;
3883 3883 ipsec_policy_t *pol;
3884 3884 ipsec_policy_root_t *pr;
3885 3885
3886 3886 bzero(&sel, sizeof (sel));
3887 3887 sel.ipsl_valid = (fam == IPSEC_AF_V4 ? IPSL_IPV4 : IPSL_IPV6);
3888 3888 if ((pol = ipsec_policy_create(&sel, actp, nact, IPSEC_PRIO_SOCKET,
3889 3889 NULL, ns)) != NULL) {
3890 3890 pr = &ph->iph_root[ptype];
3891 3891 HASHLIST_INSERT(pol, ipsp_hash, pr->ipr_nonhash[fam]);
3892 3892 ipsec_insert_always(&ph->iph_rulebyid, pol);
3893 3893 }
3894 3894 return (pol != NULL);
3895 3895 }
3896 3896
3897 3897 void
3898 3898 ipsec_polhead_flush(ipsec_policy_head_t *php, netstack_t *ns)
3899 3899 {
3900 3900 int dir;
3901 3901
3902 3902 ASSERT(RW_WRITE_HELD(&php->iph_lock));
3903 3903
3904 3904 for (dir = 0; dir < IPSEC_NTYPES; dir++)
3905 3905 ipsec_ipr_flush(php, &php->iph_root[dir]);
3906 3906
3907 3907 php->iph_gen++;
3908 3908 ipsec_update_present_flags(ns->netstack_ipsec);
3909 3909 }
3910 3910
3911 3911 void
3912 3912 ipsec_polhead_free(ipsec_policy_head_t *php, netstack_t *ns)
3913 3913 {
3914 3914 int dir;
3915 3915
3916 3916 ASSERT(php->iph_refs == 0);
3917 3917
3918 3918 rw_enter(&php->iph_lock, RW_WRITER);
3919 3919 ipsec_polhead_flush(php, ns);
3920 3920 rw_exit(&php->iph_lock);
3921 3921 rw_destroy(&php->iph_lock);
3922 3922 for (dir = 0; dir < IPSEC_NTYPES; dir++) {
3923 3923 ipsec_policy_root_t *ipr = &php->iph_root[dir];
3924 3924 int chain;
3925 3925
3926 3926 for (chain = 0; chain < ipr->ipr_nchains; chain++)
3927 3927 mutex_destroy(&(ipr->ipr_hash[chain].hash_lock));
3928 3928
3929 3929 }
3930 3930 ipsec_polhead_free_table(php);
3931 3931 kmem_free(php, sizeof (*php));
3932 3932 }
3933 3933
3934 3934 static void
3935 3935 ipsec_ipr_init(ipsec_policy_root_t *ipr)
3936 3936 {
3937 3937 int af;
3938 3938
3939 3939 ipr->ipr_nchains = 0;
3940 3940 ipr->ipr_hash = NULL;
3941 3941
3942 3942 for (af = 0; af < IPSEC_NAF; af++) {
3943 3943 ipr->ipr_nonhash[af] = NULL;
3944 3944 }
3945 3945 }
3946 3946
3947 3947 ipsec_policy_head_t *
3948 3948 ipsec_polhead_create(void)
3949 3949 {
3950 3950 ipsec_policy_head_t *php;
3951 3951
3952 3952 php = kmem_alloc(sizeof (*php), KM_NOSLEEP);
3953 3953 if (php == NULL)
3954 3954 return (php);
3955 3955
3956 3956 rw_init(&php->iph_lock, NULL, RW_DEFAULT, NULL);
3957 3957 php->iph_refs = 1;
3958 3958 php->iph_gen = 0;
3959 3959
3960 3960 ipsec_ipr_init(&php->iph_root[IPSEC_TYPE_INBOUND]);
3961 3961 ipsec_ipr_init(&php->iph_root[IPSEC_TYPE_OUTBOUND]);
3962 3962
3963 3963 avl_create(&php->iph_rulebyid, ipsec_policy_cmpbyid,
3964 3964 sizeof (ipsec_policy_t), offsetof(ipsec_policy_t, ipsp_byid));
3965 3965
3966 3966 return (php);
3967 3967 }
3968 3968
3969 3969 /*
3970 3970 * Clone the policy head into a new polhead; release one reference to the
3971 3971 * old one and return the only reference to the new one.
3972 3972 * If the old one had a refcount of 1, just return it.
3973 3973 */
3974 3974 ipsec_policy_head_t *
3975 3975 ipsec_polhead_split(ipsec_policy_head_t *php, netstack_t *ns)
3976 3976 {
3977 3977 ipsec_policy_head_t *nphp;
3978 3978
3979 3979 if (php == NULL)
3980 3980 return (ipsec_polhead_create());
3981 3981 else if (php->iph_refs == 1)
3982 3982 return (php);
3983 3983
3984 3984 nphp = ipsec_polhead_create();
3985 3985 if (nphp == NULL)
3986 3986 return (NULL);
3987 3987
3988 3988 if (ipsec_copy_polhead(php, nphp, ns) != 0) {
3989 3989 ipsec_polhead_free(nphp, ns);
3990 3990 return (NULL);
3991 3991 }
3992 3992 IPPH_REFRELE(php, ns);
3993 3993 return (nphp);
3994 3994 }
3995 3995
3996 3996 /*
3997 3997 * When sending a response to a ICMP request or generating a RST
3998 3998 * in the TCP case, the outbound packets need to go at the same level
3999 3999 * of protection as the incoming ones i.e we associate our outbound
4000 4000 * policy with how the packet came in. We call this after we have
4001 4001 * accepted the incoming packet which may or may not have been in
4002 4002 * clear and hence we are sending the reply back with the policy
4003 4003 * matching the incoming datagram's policy.
4004 4004 *
4005 4005 * NOTE : This technology serves two purposes :
4006 4006 *
4007 4007 * 1) If we have multiple outbound policies, we send out a reply
4008 4008 * matching with how it came in rather than matching the outbound
4009 4009 * policy.
4010 4010 *
4011 4011 * 2) For assymetric policies, we want to make sure that incoming
4012 4012 * and outgoing has the same level of protection. Assymetric
4013 4013 * policies exist only with global policy where we may not have
4014 4014 * both outbound and inbound at the same time.
4015 4015 *
4016 4016 * NOTE2: This function is called by cleartext cases, so it needs to be
4017 4017 * in IP proper.
4018 4018 *
4019 4019 * Note: the caller has moved other parts of ira into ixa already.
4020 4020 */
4021 4021 boolean_t
4022 4022 ipsec_in_to_out(ip_recv_attr_t *ira, ip_xmit_attr_t *ixa, mblk_t *data_mp,
4023 4023 ipha_t *ipha, ip6_t *ip6h)
4024 4024 {
4025 4025 ipsec_selector_t sel;
4026 4026 ipsec_action_t *reflect_action = NULL;
4027 4027 netstack_t *ns = ixa->ixa_ipst->ips_netstack;
4028 4028
4029 4029 bzero((void*)&sel, sizeof (sel));
4030 4030
4031 4031 if (ira->ira_ipsec_action != NULL) {
4032 4032 /* transfer reference.. */
4033 4033 reflect_action = ira->ira_ipsec_action;
4034 4034 ira->ira_ipsec_action = NULL;
4035 4035 } else if (!(ira->ira_flags & IRAF_LOOPBACK))
4036 4036 reflect_action = ipsec_in_to_out_action(ira);
4037 4037
4038 4038 /*
4039 4039 * The caller is going to send the datagram out which might
4040 4040 * go on the wire or delivered locally through ire_send_local.
4041 4041 *
4042 4042 * 1) If it goes out on the wire, new associations will be
4043 4043 * obtained.
4044 4044 * 2) If it is delivered locally, ire_send_local will convert
4045 4045 * this ip_xmit_attr_t back to a ip_recv_attr_t looking at the
4046 4046 * requests.
4047 4047 */
4048 4048 ixa->ixa_ipsec_action = reflect_action;
4049 4049
4050 4050 if (!ipsec_init_outbound_ports(&sel, data_mp, ipha, ip6h, 0,
4051 4051 ns->netstack_ipsec)) {
4052 4052 /* Note: data_mp already consumed and ip_drop_packet done */
4053 4053 return (B_FALSE);
4054 4054 }
4055 4055 ixa->ixa_ipsec_src_port = sel.ips_local_port;
4056 4056 ixa->ixa_ipsec_dst_port = sel.ips_remote_port;
4057 4057 ixa->ixa_ipsec_proto = sel.ips_protocol;
4058 4058 ixa->ixa_ipsec_icmp_type = sel.ips_icmp_type;
4059 4059 ixa->ixa_ipsec_icmp_code = sel.ips_icmp_code;
4060 4060
4061 4061 /*
4062 4062 * Don't use global policy for this, as we want
4063 4063 * to use the same protection that was applied to the inbound packet.
4064 4064 * Thus we set IXAF_NO_IPSEC is it arrived in the clear to make
4065 4065 * it be sent in the clear.
4066 4066 */
4067 4067 if (ira->ira_flags & IRAF_IPSEC_SECURE)
4068 4068 ixa->ixa_flags |= IXAF_IPSEC_SECURE;
4069 4069 else
4070 4070 ixa->ixa_flags |= IXAF_NO_IPSEC;
4071 4071
4072 4072 return (B_TRUE);
4073 4073 }
4074 4074
4075 4075 void
4076 4076 ipsec_out_release_refs(ip_xmit_attr_t *ixa)
4077 4077 {
4078 4078 if (!(ixa->ixa_flags & IXAF_IPSEC_SECURE))
4079 4079 return;
4080 4080
4081 4081 if (ixa->ixa_ipsec_ah_sa != NULL) {
4082 4082 IPSA_REFRELE(ixa->ixa_ipsec_ah_sa);
4083 4083 ixa->ixa_ipsec_ah_sa = NULL;
4084 4084 }
4085 4085 if (ixa->ixa_ipsec_esp_sa != NULL) {
4086 4086 IPSA_REFRELE(ixa->ixa_ipsec_esp_sa);
4087 4087 ixa->ixa_ipsec_esp_sa = NULL;
4088 4088 }
4089 4089 if (ixa->ixa_ipsec_policy != NULL) {
4090 4090 IPPOL_REFRELE(ixa->ixa_ipsec_policy);
4091 4091 ixa->ixa_ipsec_policy = NULL;
4092 4092 }
4093 4093 if (ixa->ixa_ipsec_action != NULL) {
4094 4094 IPACT_REFRELE(ixa->ixa_ipsec_action);
4095 4095 ixa->ixa_ipsec_action = NULL;
4096 4096 }
4097 4097 if (ixa->ixa_ipsec_latch) {
4098 4098 IPLATCH_REFRELE(ixa->ixa_ipsec_latch);
4099 4099 ixa->ixa_ipsec_latch = NULL;
4100 4100 }
4101 4101 /* Clear the soft references to the SAs */
4102 4102 ixa->ixa_ipsec_ref[0].ipsr_sa = NULL;
4103 4103 ixa->ixa_ipsec_ref[0].ipsr_bucket = NULL;
4104 4104 ixa->ixa_ipsec_ref[0].ipsr_gen = 0;
4105 4105 ixa->ixa_ipsec_ref[1].ipsr_sa = NULL;
4106 4106 ixa->ixa_ipsec_ref[1].ipsr_bucket = NULL;
4107 4107 ixa->ixa_ipsec_ref[1].ipsr_gen = 0;
4108 4108 ixa->ixa_flags &= ~IXAF_IPSEC_SECURE;
4109 4109 }
4110 4110
4111 4111 void
4112 4112 ipsec_in_release_refs(ip_recv_attr_t *ira)
4113 4113 {
4114 4114 if (!(ira->ira_flags & IRAF_IPSEC_SECURE))
4115 4115 return;
4116 4116
4117 4117 if (ira->ira_ipsec_ah_sa != NULL) {
4118 4118 IPSA_REFRELE(ira->ira_ipsec_ah_sa);
4119 4119 ira->ira_ipsec_ah_sa = NULL;
4120 4120 }
4121 4121 if (ira->ira_ipsec_esp_sa != NULL) {
4122 4122 IPSA_REFRELE(ira->ira_ipsec_esp_sa);
4123 4123 ira->ira_ipsec_esp_sa = NULL;
4124 4124 }
4125 4125 ira->ira_flags &= ~IRAF_IPSEC_SECURE;
4126 4126 }
4127 4127
4128 4128 /*
4129 4129 * This is called from ire_send_local when a packet
4130 4130 * is looped back. We setup the ip_recv_attr_t "borrowing" the references
4131 4131 * held by the callers.
4132 4132 * Note that we don't do any IPsec but we carry the actions and IPSEC flags
4133 4133 * across so that the fanout policy checks see that IPsec was applied.
4134 4134 *
4135 4135 * The caller should do ipsec_in_release_refs() on the ira by calling
4136 4136 * ira_cleanup().
4137 4137 */
4138 4138 void
4139 4139 ipsec_out_to_in(ip_xmit_attr_t *ixa, ill_t *ill, ip_recv_attr_t *ira)
4140 4140 {
4141 4141 ipsec_policy_t *pol;
4142 4142 ipsec_action_t *act;
4143 4143
4144 4144 /* Non-IPsec operations */
4145 4145 ira->ira_free_flags = 0;
4146 4146 ira->ira_zoneid = ixa->ixa_zoneid;
4147 4147 ira->ira_cred = ixa->ixa_cred;
4148 4148 ira->ira_cpid = ixa->ixa_cpid;
4149 4149 ira->ira_tsl = ixa->ixa_tsl;
4150 4150 ira->ira_ill = ira->ira_rill = ill;
4151 4151 ira->ira_flags = ixa->ixa_flags & IAF_MASK;
4152 4152 ira->ira_no_loop_zoneid = ixa->ixa_no_loop_zoneid;
4153 4153 ira->ira_pktlen = ixa->ixa_pktlen;
4154 4154 ira->ira_ip_hdr_length = ixa->ixa_ip_hdr_length;
4155 4155 ira->ira_protocol = ixa->ixa_protocol;
4156 4156 ira->ira_mhip = NULL;
4157 4157
4158 4158 ira->ira_flags |= IRAF_LOOPBACK | IRAF_L2SRC_LOOPBACK;
4159 4159
4160 4160 ira->ira_sqp = ixa->ixa_sqp;
4161 4161 ira->ira_ring = NULL;
4162 4162
4163 4163 ira->ira_ruifindex = ill->ill_phyint->phyint_ifindex;
4164 4164 ira->ira_rifindex = ira->ira_ruifindex;
4165 4165
4166 4166 if (!(ixa->ixa_flags & IXAF_IPSEC_SECURE))
4167 4167 return;
4168 4168
4169 4169 ira->ira_flags |= IRAF_IPSEC_SECURE;
4170 4170
4171 4171 ira->ira_ipsec_ah_sa = NULL;
4172 4172 ira->ira_ipsec_esp_sa = NULL;
4173 4173
4174 4174 act = ixa->ixa_ipsec_action;
4175 4175 if (act == NULL) {
4176 4176 pol = ixa->ixa_ipsec_policy;
4177 4177 if (pol != NULL) {
4178 4178 act = pol->ipsp_act;
4179 4179 IPACT_REFHOLD(act);
4180 4180 }
4181 4181 }
4182 4182 ixa->ixa_ipsec_action = NULL;
4183 4183 ira->ira_ipsec_action = act;
4184 4184 }
4185 4185
4186 4186 /*
4187 4187 * Consults global policy and per-socket policy to see whether this datagram
4188 4188 * should go out secure. If so it updates the ip_xmit_attr_t
4189 4189 * Should not be used when connecting, since then we want to latch the policy.
4190 4190 *
4191 4191 * If connp is NULL we just look at the global policy.
4192 4192 *
4193 4193 * Returns NULL if the packet was dropped, in which case the MIB has
4194 4194 * been incremented and ip_drop_packet done.
4195 4195 */
4196 4196 mblk_t *
4197 4197 ip_output_attach_policy(mblk_t *mp, ipha_t *ipha, ip6_t *ip6h,
4198 4198 const conn_t *connp, ip_xmit_attr_t *ixa)
4199 4199 {
4200 4200 ipsec_selector_t sel;
4201 4201 boolean_t policy_present;
4202 4202 ip_stack_t *ipst = ixa->ixa_ipst;
4203 4203 netstack_t *ns = ipst->ips_netstack;
4204 4204 ipsec_stack_t *ipss = ns->netstack_ipsec;
4205 4205 ipsec_policy_t *p;
4206 4206
4207 4207 ixa->ixa_ipsec_policy_gen = ipss->ipsec_system_policy.iph_gen;
4208 4208 ASSERT((ipha != NULL && ip6h == NULL) ||
4209 4209 (ip6h != NULL && ipha == NULL));
4210 4210
4211 4211 if (ipha != NULL)
4212 4212 policy_present = ipss->ipsec_outbound_v4_policy_present;
4213 4213 else
4214 4214 policy_present = ipss->ipsec_outbound_v6_policy_present;
4215 4215
4216 4216 if (!policy_present && (connp == NULL || connp->conn_policy == NULL))
4217 4217 return (mp);
4218 4218
4219 4219 bzero((void*)&sel, sizeof (sel));
4220 4220
4221 4221 if (ipha != NULL) {
4222 4222 sel.ips_local_addr_v4 = ipha->ipha_src;
4223 4223 sel.ips_remote_addr_v4 = ip_get_dst(ipha);
4224 4224 sel.ips_isv4 = B_TRUE;
4225 4225 } else {
4226 4226 sel.ips_isv4 = B_FALSE;
4227 4227 sel.ips_local_addr_v6 = ip6h->ip6_src;
4228 4228 sel.ips_remote_addr_v6 = ip_get_dst_v6(ip6h, mp, NULL);
4229 4229 }
4230 4230 sel.ips_protocol = ixa->ixa_protocol;
4231 4231
4232 4232 if (!ipsec_init_outbound_ports(&sel, mp, ipha, ip6h, 0, ipss)) {
4233 4233 if (ipha != NULL) {
4234 4234 BUMP_MIB(&ipst->ips_ip_mib, ipIfStatsOutDiscards);
4235 4235 } else {
4236 4236 BUMP_MIB(&ipst->ips_ip6_mib, ipIfStatsOutDiscards);
4237 4237 }
4238 4238 /* Note: mp already consumed and ip_drop_packet done */
4239 4239 return (NULL);
4240 4240 }
4241 4241
4242 4242 ASSERT(ixa->ixa_ipsec_policy == NULL);
4243 4243 p = ipsec_find_policy(IPSEC_TYPE_OUTBOUND, connp, &sel, ns);
4244 4244 ixa->ixa_ipsec_policy = p;
4245 4245 if (p != NULL) {
4246 4246 ixa->ixa_flags |= IXAF_IPSEC_SECURE;
4247 4247 if (connp == NULL || connp->conn_policy == NULL)
4248 4248 ixa->ixa_flags |= IXAF_IPSEC_GLOBAL_POLICY;
4249 4249 } else {
4250 4250 ixa->ixa_flags &= ~IXAF_IPSEC_SECURE;
4251 4251 }
4252 4252
4253 4253 /*
4254 4254 * Copy the right port information.
4255 4255 */
4256 4256 ixa->ixa_ipsec_src_port = sel.ips_local_port;
4257 4257 ixa->ixa_ipsec_dst_port = sel.ips_remote_port;
4258 4258 ixa->ixa_ipsec_icmp_type = sel.ips_icmp_type;
4259 4259 ixa->ixa_ipsec_icmp_code = sel.ips_icmp_code;
4260 4260 ixa->ixa_ipsec_proto = sel.ips_protocol;
4261 4261 return (mp);
4262 4262 }
4263 4263
4264 4264 /*
4265 4265 * When appropriate, this function caches inbound and outbound policy
4266 4266 * for this connection. The outbound policy is stored in conn_ixa.
4267 4267 * Note that it can not be used for SCTP since conn_faddr isn't set for SCTP.
4268 4268 *
4269 4269 * XXX need to work out more details about per-interface policy and
4270 4270 * caching here!
4271 4271 *
4272 4272 * XXX may want to split inbound and outbound caching for ill..
4273 4273 */
4274 4274 int
4275 4275 ipsec_conn_cache_policy(conn_t *connp, boolean_t isv4)
4276 4276 {
4277 4277 boolean_t global_policy_present;
4278 4278 netstack_t *ns = connp->conn_netstack;
4279 4279 ipsec_stack_t *ipss = ns->netstack_ipsec;
4280 4280
4281 4281 connp->conn_ixa->ixa_ipsec_policy_gen =
4282 4282 ipss->ipsec_system_policy.iph_gen;
4283 4283 /*
4284 4284 * There is no policy latching for ICMP sockets because we can't
4285 4285 * decide on which policy to use until we see the packet and get
4286 4286 * type/code selectors.
4287 4287 */
4288 4288 if (connp->conn_proto == IPPROTO_ICMP ||
4289 4289 connp->conn_proto == IPPROTO_ICMPV6) {
4290 4290 connp->conn_in_enforce_policy =
4291 4291 connp->conn_out_enforce_policy = B_TRUE;
4292 4292 if (connp->conn_latch != NULL) {
4293 4293 IPLATCH_REFRELE(connp->conn_latch);
4294 4294 connp->conn_latch = NULL;
4295 4295 }
4296 4296 if (connp->conn_latch_in_policy != NULL) {
4297 4297 IPPOL_REFRELE(connp->conn_latch_in_policy);
4298 4298 connp->conn_latch_in_policy = NULL;
4299 4299 }
4300 4300 if (connp->conn_latch_in_action != NULL) {
4301 4301 IPACT_REFRELE(connp->conn_latch_in_action);
4302 4302 connp->conn_latch_in_action = NULL;
4303 4303 }
4304 4304 if (connp->conn_ixa->ixa_ipsec_policy != NULL) {
4305 4305 IPPOL_REFRELE(connp->conn_ixa->ixa_ipsec_policy);
4306 4306 connp->conn_ixa->ixa_ipsec_policy = NULL;
4307 4307 }
4308 4308 if (connp->conn_ixa->ixa_ipsec_action != NULL) {
4309 4309 IPACT_REFRELE(connp->conn_ixa->ixa_ipsec_action);
4310 4310 connp->conn_ixa->ixa_ipsec_action = NULL;
4311 4311 }
4312 4312 connp->conn_ixa->ixa_flags &= ~IXAF_IPSEC_SECURE;
4313 4313 return (0);
4314 4314 }
4315 4315
4316 4316 global_policy_present = isv4 ?
4317 4317 (ipss->ipsec_outbound_v4_policy_present ||
4318 4318 ipss->ipsec_inbound_v4_policy_present) :
4319 4319 (ipss->ipsec_outbound_v6_policy_present ||
4320 4320 ipss->ipsec_inbound_v6_policy_present);
4321 4321
4322 4322 if ((connp->conn_policy != NULL) || global_policy_present) {
4323 4323 ipsec_selector_t sel;
4324 4324 ipsec_policy_t *p;
4325 4325
4326 4326 if (connp->conn_latch == NULL &&
4327 4327 (connp->conn_latch = iplatch_create()) == NULL) {
4328 4328 return (ENOMEM);
4329 4329 }
4330 4330
4331 4331 bzero((void*)&sel, sizeof (sel));
4332 4332
4333 4333 sel.ips_protocol = connp->conn_proto;
4334 4334 sel.ips_local_port = connp->conn_lport;
4335 4335 sel.ips_remote_port = connp->conn_fport;
4336 4336 sel.ips_is_icmp_inv_acq = 0;
4337 4337 sel.ips_isv4 = isv4;
4338 4338 if (isv4) {
4339 4339 sel.ips_local_addr_v4 = connp->conn_laddr_v4;
4340 4340 sel.ips_remote_addr_v4 = connp->conn_faddr_v4;
4341 4341 } else {
4342 4342 sel.ips_local_addr_v6 = connp->conn_laddr_v6;
4343 4343 sel.ips_remote_addr_v6 = connp->conn_faddr_v6;
4344 4344 }
4345 4345
4346 4346 p = ipsec_find_policy(IPSEC_TYPE_INBOUND, connp, &sel, ns);
4347 4347 if (connp->conn_latch_in_policy != NULL)
4348 4348 IPPOL_REFRELE(connp->conn_latch_in_policy);
4349 4349 connp->conn_latch_in_policy = p;
4350 4350 connp->conn_in_enforce_policy = (p != NULL);
4351 4351
4352 4352 p = ipsec_find_policy(IPSEC_TYPE_OUTBOUND, connp, &sel, ns);
4353 4353 if (connp->conn_ixa->ixa_ipsec_policy != NULL)
4354 4354 IPPOL_REFRELE(connp->conn_ixa->ixa_ipsec_policy);
4355 4355 connp->conn_ixa->ixa_ipsec_policy = p;
4356 4356 connp->conn_out_enforce_policy = (p != NULL);
4357 4357 if (p != NULL) {
4358 4358 connp->conn_ixa->ixa_flags |= IXAF_IPSEC_SECURE;
4359 4359 if (connp->conn_policy == NULL) {
4360 4360 connp->conn_ixa->ixa_flags |=
4361 4361 IXAF_IPSEC_GLOBAL_POLICY;
4362 4362 }
4363 4363 } else {
4364 4364 connp->conn_ixa->ixa_flags &= ~IXAF_IPSEC_SECURE;
4365 4365 }
4366 4366 /* Clear the latched actions too, in case we're recaching. */
4367 4367 if (connp->conn_ixa->ixa_ipsec_action != NULL) {
4368 4368 IPACT_REFRELE(connp->conn_ixa->ixa_ipsec_action);
4369 4369 connp->conn_ixa->ixa_ipsec_action = NULL;
4370 4370 }
4371 4371 if (connp->conn_latch_in_action != NULL) {
4372 4372 IPACT_REFRELE(connp->conn_latch_in_action);
4373 4373 connp->conn_latch_in_action = NULL;
4374 4374 }
4375 4375 connp->conn_ixa->ixa_ipsec_src_port = sel.ips_local_port;
4376 4376 connp->conn_ixa->ixa_ipsec_dst_port = sel.ips_remote_port;
4377 4377 connp->conn_ixa->ixa_ipsec_icmp_type = sel.ips_icmp_type;
4378 4378 connp->conn_ixa->ixa_ipsec_icmp_code = sel.ips_icmp_code;
4379 4379 connp->conn_ixa->ixa_ipsec_proto = sel.ips_protocol;
4380 4380 } else {
4381 4381 connp->conn_ixa->ixa_flags &= ~IXAF_IPSEC_SECURE;
4382 4382 }
4383 4383
4384 4384 /*
4385 4385 * We may or may not have policy for this endpoint. We still set
4386 4386 * conn_policy_cached so that inbound datagrams don't have to look
4387 4387 * at global policy as policy is considered latched for these
4388 4388 * endpoints. We should not set conn_policy_cached until the conn
4389 4389 * reflects the actual policy. If we *set* this before inheriting
4390 4390 * the policy there is a window where the check
4391 4391 * CONN_INBOUND_POLICY_PRESENT, will neither check with the policy
4392 4392 * on the conn (because we have not yet copied the policy on to
4393 4393 * conn and hence not set conn_in_enforce_policy) nor with the
4394 4394 * global policy (because conn_policy_cached is already set).
4395 4395 */
4396 4396 connp->conn_policy_cached = B_TRUE;
4397 4397 return (0);
4398 4398 }
4399 4399
4400 4400 /*
4401 4401 * When appropriate, this function caches outbound policy for faddr/fport.
4402 4402 * It is used when we are not connected i.e., when we can not latch the
4403 4403 * policy.
4404 4404 */
4405 4405 void
4406 4406 ipsec_cache_outbound_policy(const conn_t *connp, const in6_addr_t *v6src,
4407 4407 const in6_addr_t *v6dst, in_port_t dstport, ip_xmit_attr_t *ixa)
4408 4408 {
4409 4409 boolean_t isv4 = (ixa->ixa_flags & IXAF_IS_IPV4) != 0;
4410 4410 boolean_t global_policy_present;
4411 4411 netstack_t *ns = connp->conn_netstack;
4412 4412 ipsec_stack_t *ipss = ns->netstack_ipsec;
4413 4413
4414 4414 ixa->ixa_ipsec_policy_gen = ipss->ipsec_system_policy.iph_gen;
4415 4415
4416 4416 /*
4417 4417 * There is no policy caching for ICMP sockets because we can't
4418 4418 * decide on which policy to use until we see the packet and get
4419 4419 * type/code selectors.
4420 4420 */
4421 4421 if (connp->conn_proto == IPPROTO_ICMP ||
4422 4422 connp->conn_proto == IPPROTO_ICMPV6) {
4423 4423 ixa->ixa_flags &= ~IXAF_IPSEC_SECURE;
4424 4424 if (ixa->ixa_ipsec_policy != NULL) {
4425 4425 IPPOL_REFRELE(ixa->ixa_ipsec_policy);
4426 4426 ixa->ixa_ipsec_policy = NULL;
4427 4427 }
4428 4428 if (ixa->ixa_ipsec_action != NULL) {
4429 4429 IPACT_REFRELE(ixa->ixa_ipsec_action);
4430 4430 ixa->ixa_ipsec_action = NULL;
4431 4431 }
4432 4432 return;
4433 4433 }
4434 4434
4435 4435 global_policy_present = isv4 ?
4436 4436 (ipss->ipsec_outbound_v4_policy_present ||
4437 4437 ipss->ipsec_inbound_v4_policy_present) :
4438 4438 (ipss->ipsec_outbound_v6_policy_present ||
4439 4439 ipss->ipsec_inbound_v6_policy_present);
4440 4440
4441 4441 if ((connp->conn_policy != NULL) || global_policy_present) {
4442 4442 ipsec_selector_t sel;
4443 4443 ipsec_policy_t *p;
4444 4444
4445 4445 bzero((void*)&sel, sizeof (sel));
4446 4446
4447 4447 sel.ips_protocol = connp->conn_proto;
4448 4448 sel.ips_local_port = connp->conn_lport;
4449 4449 sel.ips_remote_port = dstport;
4450 4450 sel.ips_is_icmp_inv_acq = 0;
4451 4451 sel.ips_isv4 = isv4;
4452 4452 if (isv4) {
4453 4453 IN6_V4MAPPED_TO_IPADDR(v6src, sel.ips_local_addr_v4);
4454 4454 IN6_V4MAPPED_TO_IPADDR(v6dst, sel.ips_remote_addr_v4);
4455 4455 } else {
4456 4456 sel.ips_local_addr_v6 = *v6src;
4457 4457 sel.ips_remote_addr_v6 = *v6dst;
4458 4458 }
4459 4459
4460 4460 p = ipsec_find_policy(IPSEC_TYPE_OUTBOUND, connp, &sel, ns);
4461 4461 if (ixa->ixa_ipsec_policy != NULL)
4462 4462 IPPOL_REFRELE(ixa->ixa_ipsec_policy);
4463 4463 ixa->ixa_ipsec_policy = p;
4464 4464 if (p != NULL) {
4465 4465 ixa->ixa_flags |= IXAF_IPSEC_SECURE;
4466 4466 if (connp->conn_policy == NULL)
4467 4467 ixa->ixa_flags |= IXAF_IPSEC_GLOBAL_POLICY;
4468 4468 } else {
4469 4469 ixa->ixa_flags &= ~IXAF_IPSEC_SECURE;
4470 4470 }
4471 4471 /* Clear the latched actions too, in case we're recaching. */
4472 4472 if (ixa->ixa_ipsec_action != NULL) {
4473 4473 IPACT_REFRELE(ixa->ixa_ipsec_action);
4474 4474 ixa->ixa_ipsec_action = NULL;
4475 4475 }
4476 4476
4477 4477 ixa->ixa_ipsec_src_port = sel.ips_local_port;
4478 4478 ixa->ixa_ipsec_dst_port = sel.ips_remote_port;
4479 4479 ixa->ixa_ipsec_icmp_type = sel.ips_icmp_type;
4480 4480 ixa->ixa_ipsec_icmp_code = sel.ips_icmp_code;
4481 4481 ixa->ixa_ipsec_proto = sel.ips_protocol;
4482 4482 } else {
4483 4483 ixa->ixa_flags &= ~IXAF_IPSEC_SECURE;
4484 4484 if (ixa->ixa_ipsec_policy != NULL) {
4485 4485 IPPOL_REFRELE(ixa->ixa_ipsec_policy);
4486 4486 ixa->ixa_ipsec_policy = NULL;
4487 4487 }
4488 4488 if (ixa->ixa_ipsec_action != NULL) {
4489 4489 IPACT_REFRELE(ixa->ixa_ipsec_action);
4490 4490 ixa->ixa_ipsec_action = NULL;
4491 4491 }
4492 4492 }
4493 4493 }
4494 4494
4495 4495 /*
4496 4496 * Returns B_FALSE if the policy has gone stale.
4497 4497 */
4498 4498 boolean_t
4499 4499 ipsec_outbound_policy_current(ip_xmit_attr_t *ixa)
4500 4500 {
4501 4501 ipsec_stack_t *ipss = ixa->ixa_ipst->ips_netstack->netstack_ipsec;
4502 4502
4503 4503 if (!(ixa->ixa_flags & IXAF_IPSEC_GLOBAL_POLICY))
4504 4504 return (B_TRUE);
4505 4505
4506 4506 return (ixa->ixa_ipsec_policy_gen == ipss->ipsec_system_policy.iph_gen);
4507 4507 }
4508 4508
4509 4509 void
4510 4510 iplatch_free(ipsec_latch_t *ipl)
4511 4511 {
4512 4512 if (ipl->ipl_local_cid != NULL)
4513 4513 IPSID_REFRELE(ipl->ipl_local_cid);
4514 4514 if (ipl->ipl_remote_cid != NULL)
4515 4515 IPSID_REFRELE(ipl->ipl_remote_cid);
4516 4516 mutex_destroy(&ipl->ipl_lock);
4517 4517 kmem_free(ipl, sizeof (*ipl));
4518 4518 }
4519 4519
4520 4520 ipsec_latch_t *
4521 4521 iplatch_create()
4522 4522 {
4523 4523 ipsec_latch_t *ipl = kmem_alloc(sizeof (*ipl), KM_NOSLEEP);
4524 4524 if (ipl == NULL)
4525 4525 return (ipl);
4526 4526 bzero(ipl, sizeof (*ipl));
4527 4527 mutex_init(&ipl->ipl_lock, NULL, MUTEX_DEFAULT, NULL);
4528 4528 ipl->ipl_refcnt = 1;
4529 4529 return (ipl);
4530 4530 }
4531 4531
4532 4532 /*
4533 4533 * Hash function for ID hash table.
4534 4534 */
4535 4535 static uint32_t
4536 4536 ipsid_hash(int idtype, char *idstring)
4537 4537 {
4538 4538 uint32_t hval = idtype;
4539 4539 unsigned char c;
4540 4540
4541 4541 while ((c = *idstring++) != 0) {
4542 4542 hval = (hval << 4) | (hval >> 28);
4543 4543 hval ^= c;
4544 4544 }
4545 4545 hval = hval ^ (hval >> 16);
4546 4546 return (hval & (IPSID_HASHSIZE-1));
4547 4547 }
4548 4548
4549 4549 /*
4550 4550 * Look up identity string in hash table. Return identity object
4551 4551 * corresponding to the name -- either preexisting, or newly allocated.
4552 4552 *
4553 4553 * Return NULL if we need to allocate a new one and can't get memory.
4554 4554 */
4555 4555 ipsid_t *
4556 4556 ipsid_lookup(int idtype, char *idstring, netstack_t *ns)
4557 4557 {
4558 4558 ipsid_t *retval;
4559 4559 char *nstr;
4560 4560 int idlen = strlen(idstring) + 1;
4561 4561 ipsec_stack_t *ipss = ns->netstack_ipsec;
4562 4562 ipsif_t *bucket;
4563 4563
4564 4564 bucket = &ipss->ipsec_ipsid_buckets[ipsid_hash(idtype, idstring)];
4565 4565
4566 4566 mutex_enter(&bucket->ipsif_lock);
4567 4567
4568 4568 for (retval = bucket->ipsif_head; retval != NULL;
4569 4569 retval = retval->ipsid_next) {
4570 4570 if (idtype != retval->ipsid_type)
4571 4571 continue;
4572 4572 if (bcmp(idstring, retval->ipsid_cid, idlen) != 0)
4573 4573 continue;
4574 4574
4575 4575 IPSID_REFHOLD(retval);
4576 4576 mutex_exit(&bucket->ipsif_lock);
4577 4577 return (retval);
4578 4578 }
4579 4579
4580 4580 retval = kmem_alloc(sizeof (*retval), KM_NOSLEEP);
4581 4581 if (!retval) {
4582 4582 mutex_exit(&bucket->ipsif_lock);
4583 4583 return (NULL);
4584 4584 }
4585 4585
4586 4586 nstr = kmem_alloc(idlen, KM_NOSLEEP);
4587 4587 if (!nstr) {
4588 4588 mutex_exit(&bucket->ipsif_lock);
4589 4589 kmem_free(retval, sizeof (*retval));
4590 4590 return (NULL);
4591 4591 }
4592 4592
4593 4593 retval->ipsid_refcnt = 1;
4594 4594 retval->ipsid_next = bucket->ipsif_head;
4595 4595 if (retval->ipsid_next != NULL)
4596 4596 retval->ipsid_next->ipsid_ptpn = &retval->ipsid_next;
4597 4597 retval->ipsid_ptpn = &bucket->ipsif_head;
4598 4598 retval->ipsid_type = idtype;
4599 4599 retval->ipsid_cid = nstr;
4600 4600 bucket->ipsif_head = retval;
4601 4601 bcopy(idstring, nstr, idlen);
4602 4602 mutex_exit(&bucket->ipsif_lock);
4603 4603
4604 4604 return (retval);
4605 4605 }
4606 4606
4607 4607 /*
4608 4608 * Garbage collect the identity hash table.
4609 4609 */
4610 4610 void
4611 4611 ipsid_gc(netstack_t *ns)
4612 4612 {
4613 4613 int i, len;
4614 4614 ipsid_t *id, *nid;
4615 4615 ipsif_t *bucket;
4616 4616 ipsec_stack_t *ipss = ns->netstack_ipsec;
4617 4617
4618 4618 for (i = 0; i < IPSID_HASHSIZE; i++) {
4619 4619 bucket = &ipss->ipsec_ipsid_buckets[i];
4620 4620 mutex_enter(&bucket->ipsif_lock);
4621 4621 for (id = bucket->ipsif_head; id != NULL; id = nid) {
4622 4622 nid = id->ipsid_next;
4623 4623 if (id->ipsid_refcnt == 0) {
4624 4624 *id->ipsid_ptpn = nid;
4625 4625 if (nid != NULL)
4626 4626 nid->ipsid_ptpn = id->ipsid_ptpn;
4627 4627 len = strlen(id->ipsid_cid) + 1;
4628 4628 kmem_free(id->ipsid_cid, len);
4629 4629 kmem_free(id, sizeof (*id));
4630 4630 }
4631 4631 }
4632 4632 mutex_exit(&bucket->ipsif_lock);
4633 4633 }
4634 4634 }
4635 4635
4636 4636 /*
4637 4637 * Return true if two identities are the same.
4638 4638 */
4639 4639 boolean_t
4640 4640 ipsid_equal(ipsid_t *id1, ipsid_t *id2)
4641 4641 {
4642 4642 if (id1 == id2)
4643 4643 return (B_TRUE);
4644 4644 #ifdef DEBUG
4645 4645 if ((id1 == NULL) || (id2 == NULL))
4646 4646 return (B_FALSE);
4647 4647 /*
4648 4648 * test that we're interning id's correctly..
4649 4649 */
4650 4650 ASSERT((strcmp(id1->ipsid_cid, id2->ipsid_cid) != 0) ||
4651 4651 (id1->ipsid_type != id2->ipsid_type));
4652 4652 #endif
4653 4653 return (B_FALSE);
4654 4654 }
4655 4655
4656 4656 /*
4657 4657 * Initialize identity table; called during module initialization.
4658 4658 */
4659 4659 static void
4660 4660 ipsid_init(netstack_t *ns)
4661 4661 {
4662 4662 ipsif_t *bucket;
4663 4663 int i;
4664 4664 ipsec_stack_t *ipss = ns->netstack_ipsec;
4665 4665
4666 4666 for (i = 0; i < IPSID_HASHSIZE; i++) {
4667 4667 bucket = &ipss->ipsec_ipsid_buckets[i];
4668 4668 mutex_init(&bucket->ipsif_lock, NULL, MUTEX_DEFAULT, NULL);
4669 4669 }
4670 4670 }
4671 4671
4672 4672 /*
4673 4673 * Free identity table (preparatory to module unload)
4674 4674 */
4675 4675 static void
4676 4676 ipsid_fini(netstack_t *ns)
4677 4677 {
4678 4678 ipsif_t *bucket;
4679 4679 int i;
4680 4680 ipsec_stack_t *ipss = ns->netstack_ipsec;
4681 4681
4682 4682 for (i = 0; i < IPSID_HASHSIZE; i++) {
4683 4683 bucket = &ipss->ipsec_ipsid_buckets[i];
4684 4684 ASSERT(bucket->ipsif_head == NULL);
4685 4685 mutex_destroy(&bucket->ipsif_lock);
4686 4686 }
4687 4687 }
4688 4688
4689 4689 /*
4690 4690 * Update the minimum and maximum supported key sizes for the
4691 4691 * specified algorithm. Must be called while holding the algorithms lock.
4692 4692 */
4693 4693 void
4694 4694 ipsec_alg_fix_min_max(ipsec_alginfo_t *alg, ipsec_algtype_t alg_type,
4695 4695 netstack_t *ns)
4696 4696 {
4697 4697 size_t crypto_min = (size_t)-1, crypto_max = 0;
4698 4698 size_t cur_crypto_min, cur_crypto_max;
4699 4699 boolean_t is_valid;
4700 4700 crypto_mechanism_info_t *mech_infos;
4701 4701 uint_t nmech_infos;
4702 4702 int crypto_rc, i;
4703 4703 crypto_mech_usage_t mask;
4704 4704 ipsec_stack_t *ipss = ns->netstack_ipsec;
4705 4705
4706 4706 ASSERT(MUTEX_HELD(&ipss->ipsec_alg_lock));
4707 4707
4708 4708 /*
4709 4709 * Compute the min, max, and default key sizes (in number of
4710 4710 * increments to the default key size in bits) as defined
4711 4711 * by the algorithm mappings. This range of key sizes is used
4712 4712 * for policy related operations. The effective key sizes
4713 4713 * supported by the framework could be more limited than
4714 4714 * those defined for an algorithm.
4715 4715 */
4716 4716 alg->alg_default_bits = alg->alg_key_sizes[0];
4717 4717 alg->alg_default = 0;
4718 4718 if (alg->alg_increment != 0) {
4719 4719 /* key sizes are defined by range & increment */
4720 4720 alg->alg_minbits = alg->alg_key_sizes[1];
4721 4721 alg->alg_maxbits = alg->alg_key_sizes[2];
4722 4722 } else if (alg->alg_nkey_sizes == 0) {
4723 4723 /* no specified key size for algorithm */
4724 4724 alg->alg_minbits = alg->alg_maxbits = 0;
4725 4725 } else {
4726 4726 /* key sizes are defined by enumeration */
4727 4727 alg->alg_minbits = (uint16_t)-1;
4728 4728 alg->alg_maxbits = 0;
4729 4729
4730 4730 for (i = 0; i < alg->alg_nkey_sizes; i++) {
4731 4731 if (alg->alg_key_sizes[i] < alg->alg_minbits)
4732 4732 alg->alg_minbits = alg->alg_key_sizes[i];
4733 4733 if (alg->alg_key_sizes[i] > alg->alg_maxbits)
4734 4734 alg->alg_maxbits = alg->alg_key_sizes[i];
4735 4735 }
4736 4736 }
4737 4737
4738 4738 if (!(alg->alg_flags & ALG_FLAG_VALID))
4739 4739 return;
4740 4740
4741 4741 /*
4742 4742 * Mechanisms do not apply to the NULL encryption
4743 4743 * algorithm, so simply return for this case.
4744 4744 */
4745 4745 if (alg->alg_id == SADB_EALG_NULL)
4746 4746 return;
4747 4747
4748 4748 /*
4749 4749 * Find the min and max key sizes supported by the cryptographic
4750 4750 * framework providers.
4751 4751 */
4752 4752
4753 4753 /* get the key sizes supported by the framework */
4754 4754 crypto_rc = crypto_get_all_mech_info(alg->alg_mech_type,
4755 4755 &mech_infos, &nmech_infos, KM_SLEEP);
4756 4756 if (crypto_rc != CRYPTO_SUCCESS || nmech_infos == 0) {
4757 4757 alg->alg_flags &= ~ALG_FLAG_VALID;
4758 4758 return;
4759 4759 }
4760 4760
4761 4761 /* min and max key sizes supported by framework */
4762 4762 for (i = 0, is_valid = B_FALSE; i < nmech_infos; i++) {
4763 4763 int unit_bits;
4764 4764
4765 4765 /*
4766 4766 * Ignore entries that do not support the operations
4767 4767 * needed for the algorithm type.
4768 4768 */
4769 4769 if (alg_type == IPSEC_ALG_AUTH) {
4770 4770 mask = CRYPTO_MECH_USAGE_MAC;
4771 4771 } else {
4772 4772 mask = CRYPTO_MECH_USAGE_ENCRYPT |
4773 4773 CRYPTO_MECH_USAGE_DECRYPT;
4774 4774 }
4775 4775 if ((mech_infos[i].mi_usage & mask) != mask)
4776 4776 continue;
4777 4777
4778 4778 unit_bits = (mech_infos[i].mi_keysize_unit ==
4779 4779 CRYPTO_KEYSIZE_UNIT_IN_BYTES) ? 8 : 1;
4780 4780 /* adjust min/max supported by framework */
4781 4781 cur_crypto_min = mech_infos[i].mi_min_key_size * unit_bits;
4782 4782 cur_crypto_max = mech_infos[i].mi_max_key_size * unit_bits;
4783 4783
4784 4784 if (cur_crypto_min < crypto_min)
4785 4785 crypto_min = cur_crypto_min;
4786 4786
4787 4787 /*
4788 4788 * CRYPTO_EFFECTIVELY_INFINITE is a special value of
4789 4789 * the crypto framework which means "no upper limit".
4790 4790 */
4791 4791 if (mech_infos[i].mi_max_key_size ==
4792 4792 CRYPTO_EFFECTIVELY_INFINITE) {
4793 4793 crypto_max = (size_t)-1;
4794 4794 } else if (cur_crypto_max > crypto_max) {
4795 4795 crypto_max = cur_crypto_max;
4796 4796 }
4797 4797
4798 4798 is_valid = B_TRUE;
4799 4799 }
4800 4800
4801 4801 kmem_free(mech_infos, sizeof (crypto_mechanism_info_t) *
4802 4802 nmech_infos);
4803 4803
4804 4804 if (!is_valid) {
4805 4805 /* no key sizes supported by framework */
4806 4806 alg->alg_flags &= ~ALG_FLAG_VALID;
4807 4807 return;
4808 4808 }
4809 4809
4810 4810 /*
4811 4811 * Determine min and max key sizes from alg_key_sizes[].
4812 4812 * defined for the algorithm entry. Adjust key sizes based on
4813 4813 * those supported by the framework.
4814 4814 */
4815 4815 alg->alg_ef_default_bits = alg->alg_key_sizes[0];
4816 4816
4817 4817 /*
4818 4818 * For backwards compatability, assume that the IV length
4819 4819 * is the same as the data length.
4820 4820 */
4821 4821 alg->alg_ivlen = alg->alg_datalen;
4822 4822
4823 4823 /*
4824 4824 * Copy any algorithm parameters (if provided) into dedicated
4825 4825 * elements in the ipsec_alginfo_t structure.
4826 4826 * There may be a better place to put this code.
4827 4827 */
4828 4828 for (i = 0; i < alg->alg_nparams; i++) {
4829 4829 switch (i) {
4830 4830 case 0:
4831 4831 /* Initialisation Vector length (bytes) */
4832 4832 alg->alg_ivlen = alg->alg_params[0];
4833 4833 break;
4834 4834 case 1:
4835 4835 /* Integrity Check Vector length (bytes) */
4836 4836 alg->alg_icvlen = alg->alg_params[1];
4837 4837 break;
4838 4838 case 2:
4839 4839 /* Salt length (bytes) */
4840 4840 alg->alg_saltlen = (uint8_t)alg->alg_params[2];
4841 4841 break;
4842 4842 default:
4843 4843 break;
4844 4844 }
4845 4845 }
4846 4846
4847 4847 /* Default if the IV length is not specified. */
4848 4848 if (alg_type == IPSEC_ALG_ENCR && alg->alg_ivlen == 0)
4849 4849 alg->alg_ivlen = alg->alg_datalen;
4850 4850
4851 4851 alg_flag_check(alg);
4852 4852
4853 4853 if (alg->alg_increment != 0) {
4854 4854 /* supported key sizes are defined by range & increment */
4855 4855 crypto_min = ALGBITS_ROUND_UP(crypto_min, alg->alg_increment);
4856 4856 crypto_max = ALGBITS_ROUND_DOWN(crypto_max, alg->alg_increment);
4857 4857
4858 4858 alg->alg_ef_minbits = MAX(alg->alg_minbits,
4859 4859 (uint16_t)crypto_min);
4860 4860 alg->alg_ef_maxbits = MIN(alg->alg_maxbits,
4861 4861 (uint16_t)crypto_max);
4862 4862
4863 4863 /*
4864 4864 * If the sizes supported by the framework are outside
4865 4865 * the range of sizes defined by the algorithm mappings,
4866 4866 * the algorithm cannot be used. Check for this
4867 4867 * condition here.
4868 4868 */
4869 4869 if (alg->alg_ef_minbits > alg->alg_ef_maxbits) {
4870 4870 alg->alg_flags &= ~ALG_FLAG_VALID;
4871 4871 return;
4872 4872 }
4873 4873 if (alg->alg_ef_default_bits < alg->alg_ef_minbits)
4874 4874 alg->alg_ef_default_bits = alg->alg_ef_minbits;
4875 4875 if (alg->alg_ef_default_bits > alg->alg_ef_maxbits)
4876 4876 alg->alg_ef_default_bits = alg->alg_ef_maxbits;
4877 4877 } else if (alg->alg_nkey_sizes == 0) {
4878 4878 /* no specified key size for algorithm */
4879 4879 alg->alg_ef_minbits = alg->alg_ef_maxbits = 0;
4880 4880 } else {
4881 4881 /* supported key sizes are defined by enumeration */
4882 4882 alg->alg_ef_minbits = (uint16_t)-1;
4883 4883 alg->alg_ef_maxbits = 0;
4884 4884
4885 4885 for (i = 0, is_valid = B_FALSE; i < alg->alg_nkey_sizes; i++) {
4886 4886 /*
4887 4887 * Ignore the current key size if it is not in the
4888 4888 * range of sizes supported by the framework.
4889 4889 */
4890 4890 if (alg->alg_key_sizes[i] < crypto_min ||
4891 4891 alg->alg_key_sizes[i] > crypto_max)
4892 4892 continue;
4893 4893 if (alg->alg_key_sizes[i] < alg->alg_ef_minbits)
4894 4894 alg->alg_ef_minbits = alg->alg_key_sizes[i];
4895 4895 if (alg->alg_key_sizes[i] > alg->alg_ef_maxbits)
4896 4896 alg->alg_ef_maxbits = alg->alg_key_sizes[i];
4897 4897 is_valid = B_TRUE;
4898 4898 }
4899 4899
4900 4900 if (!is_valid) {
4901 4901 alg->alg_flags &= ~ALG_FLAG_VALID;
4902 4902 return;
4903 4903 }
4904 4904 alg->alg_ef_default = 0;
4905 4905 }
4906 4906 }
4907 4907
4908 4908 /*
4909 4909 * Sanity check parameters provided by ipsecalgs(1m). Assume that
4910 4910 * the algoritm is marked as valid, there is a check at the top
4911 4911 * of this function. If any of the checks below fail, the algorithm
4912 4912 * entry is invalid.
4913 4913 */
4914 4914 void
4915 4915 alg_flag_check(ipsec_alginfo_t *alg)
4916 4916 {
4917 4917 alg->alg_flags &= ~ALG_FLAG_VALID;
4918 4918
4919 4919 /*
4920 4920 * Can't have the algorithm marked as CCM and GCM.
4921 4921 * Check the ALG_FLAG_COMBINED and ALG_FLAG_COUNTERMODE
4922 4922 * flags are set for CCM & GCM.
4923 4923 */
4924 4924 if ((alg->alg_flags & (ALG_FLAG_CCM|ALG_FLAG_GCM)) ==
4925 4925 (ALG_FLAG_CCM|ALG_FLAG_GCM))
4926 4926 return;
4927 4927 if (alg->alg_flags & (ALG_FLAG_CCM|ALG_FLAG_GCM)) {
4928 4928 if (!(alg->alg_flags & ALG_FLAG_COUNTERMODE))
4929 4929 return;
4930 4930 if (!(alg->alg_flags & ALG_FLAG_COMBINED))
4931 4931 return;
4932 4932 }
4933 4933
4934 4934 /*
4935 4935 * For ALG_FLAG_COUNTERMODE, check the parameters
4936 4936 * fit in the ipsec_nonce_t structure.
4937 4937 */
4938 4938 if (alg->alg_flags & ALG_FLAG_COUNTERMODE) {
4939 4939 if (alg->alg_ivlen != sizeof (((ipsec_nonce_t *)NULL)->iv))
4940 4940 return;
4941 4941 if (alg->alg_saltlen > sizeof (((ipsec_nonce_t *)NULL)->salt))
4942 4942 return;
4943 4943 }
4944 4944 if ((alg->alg_flags & ALG_FLAG_COMBINED) &&
4945 4945 (alg->alg_icvlen == 0))
4946 4946 return;
4947 4947
4948 4948 /* all is well. */
4949 4949 alg->alg_flags |= ALG_FLAG_VALID;
4950 4950 }
4951 4951
4952 4952 /*
4953 4953 * Free the memory used by the specified algorithm.
4954 4954 */
4955 4955 void
4956 4956 ipsec_alg_free(ipsec_alginfo_t *alg)
4957 4957 {
4958 4958 if (alg == NULL)
4959 4959 return;
4960 4960
4961 4961 if (alg->alg_key_sizes != NULL) {
4962 4962 kmem_free(alg->alg_key_sizes,
4963 4963 (alg->alg_nkey_sizes + 1) * sizeof (uint16_t));
4964 4964 alg->alg_key_sizes = NULL;
4965 4965 }
4966 4966 if (alg->alg_block_sizes != NULL) {
4967 4967 kmem_free(alg->alg_block_sizes,
4968 4968 (alg->alg_nblock_sizes + 1) * sizeof (uint16_t));
4969 4969 alg->alg_block_sizes = NULL;
4970 4970 }
4971 4971 if (alg->alg_params != NULL) {
4972 4972 kmem_free(alg->alg_params,
4973 4973 (alg->alg_nparams + 1) * sizeof (uint16_t));
4974 4974 alg->alg_params = NULL;
4975 4975 }
4976 4976 kmem_free(alg, sizeof (*alg));
4977 4977 }
4978 4978
4979 4979 /*
4980 4980 * Check the validity of the specified key size for an algorithm.
4981 4981 * Returns B_TRUE if key size is valid, B_FALSE otherwise.
4982 4982 */
4983 4983 boolean_t
4984 4984 ipsec_valid_key_size(uint16_t key_size, ipsec_alginfo_t *alg)
4985 4985 {
4986 4986 if (key_size < alg->alg_ef_minbits || key_size > alg->alg_ef_maxbits)
4987 4987 return (B_FALSE);
4988 4988
4989 4989 if (alg->alg_increment == 0 && alg->alg_nkey_sizes != 0) {
4990 4990 /*
4991 4991 * If the key sizes are defined by enumeration, the new
4992 4992 * key size must be equal to one of the supported values.
4993 4993 */
4994 4994 int i;
4995 4995
4996 4996 for (i = 0; i < alg->alg_nkey_sizes; i++)
4997 4997 if (key_size == alg->alg_key_sizes[i])
4998 4998 break;
4999 4999 if (i == alg->alg_nkey_sizes)
5000 5000 return (B_FALSE);
5001 5001 }
5002 5002
5003 5003 return (B_TRUE);
5004 5004 }
5005 5005
5006 5006 /*
5007 5007 * Callback function invoked by the crypto framework when a provider
5008 5008 * registers or unregisters. This callback updates the algorithms
5009 5009 * tables when a crypto algorithm is no longer available or becomes
5010 5010 * available, and triggers the freeing/creation of context templates
5011 5011 * associated with existing SAs, if needed.
5012 5012 *
5013 5013 * Need to walk all stack instances since the callback is global
5014 5014 * for all instances
5015 5015 */
5016 5016 void
5017 5017 ipsec_prov_update_callback(uint32_t event, void *event_arg)
5018 5018 {
5019 5019 netstack_handle_t nh;
5020 5020 netstack_t *ns;
5021 5021
5022 5022 netstack_next_init(&nh);
5023 5023 while ((ns = netstack_next(&nh)) != NULL) {
5024 5024 ipsec_prov_update_callback_stack(event, event_arg, ns);
5025 5025 netstack_rele(ns);
5026 5026 }
5027 5027 netstack_next_fini(&nh);
5028 5028 }
5029 5029
5030 5030 static void
5031 5031 ipsec_prov_update_callback_stack(uint32_t event, void *event_arg,
5032 5032 netstack_t *ns)
5033 5033 {
5034 5034 crypto_notify_event_change_t *prov_change =
5035 5035 (crypto_notify_event_change_t *)event_arg;
5036 5036 uint_t algidx, algid, algtype, mech_count, mech_idx;
5037 5037 ipsec_alginfo_t *alg;
5038 5038 ipsec_alginfo_t oalg;
5039 5039 crypto_mech_name_t *mechs;
5040 5040 boolean_t alg_changed = B_FALSE;
5041 5041 ipsec_stack_t *ipss = ns->netstack_ipsec;
5042 5042
5043 5043 /* ignore events for which we didn't register */
5044 5044 if (event != CRYPTO_EVENT_MECHS_CHANGED) {
5045 5045 ip1dbg(("ipsec_prov_update_callback: unexpected event 0x%x "
5046 5046 " received from crypto framework\n", event));
5047 5047 return;
5048 5048 }
5049 5049
5050 5050 mechs = crypto_get_mech_list(&mech_count, KM_SLEEP);
5051 5051 if (mechs == NULL)
5052 5052 return;
5053 5053
5054 5054 /*
5055 5055 * Walk the list of currently defined IPsec algorithm. Update
5056 5056 * the algorithm valid flag and trigger an update of the
5057 5057 * SAs that depend on that algorithm.
5058 5058 */
5059 5059 mutex_enter(&ipss->ipsec_alg_lock);
5060 5060 for (algtype = 0; algtype < IPSEC_NALGTYPES; algtype++) {
5061 5061 for (algidx = 0; algidx < ipss->ipsec_nalgs[algtype];
5062 5062 algidx++) {
5063 5063
5064 5064 algid = ipss->ipsec_sortlist[algtype][algidx];
5065 5065 alg = ipss->ipsec_alglists[algtype][algid];
5066 5066 ASSERT(alg != NULL);
5067 5067
5068 5068 /*
5069 5069 * Skip the algorithms which do not map to the
5070 5070 * crypto framework provider being added or removed.
5071 5071 */
5072 5072 if (strncmp(alg->alg_mech_name,
5073 5073 prov_change->ec_mech_name,
5074 5074 CRYPTO_MAX_MECH_NAME) != 0)
5075 5075 continue;
5076 5076
5077 5077 /*
5078 5078 * Determine if the mechanism is valid. If it
5079 5079 * is not, mark the algorithm as being invalid. If
5080 5080 * it is, mark the algorithm as being valid.
5081 5081 */
5082 5082 for (mech_idx = 0; mech_idx < mech_count; mech_idx++)
5083 5083 if (strncmp(alg->alg_mech_name,
5084 5084 mechs[mech_idx], CRYPTO_MAX_MECH_NAME) == 0)
5085 5085 break;
5086 5086 if (mech_idx == mech_count &&
5087 5087 alg->alg_flags & ALG_FLAG_VALID) {
5088 5088 alg->alg_flags &= ~ALG_FLAG_VALID;
5089 5089 alg_changed = B_TRUE;
5090 5090 } else if (mech_idx < mech_count &&
5091 5091 !(alg->alg_flags & ALG_FLAG_VALID)) {
5092 5092 alg->alg_flags |= ALG_FLAG_VALID;
5093 5093 alg_changed = B_TRUE;
5094 5094 }
5095 5095
5096 5096 /*
5097 5097 * Update the supported key sizes, regardless
5098 5098 * of whether a crypto provider was added or
5099 5099 * removed.
5100 5100 */
5101 5101 oalg = *alg;
5102 5102 ipsec_alg_fix_min_max(alg, algtype, ns);
5103 5103 if (!alg_changed &&
5104 5104 alg->alg_ef_minbits != oalg.alg_ef_minbits ||
5105 5105 alg->alg_ef_maxbits != oalg.alg_ef_maxbits ||
5106 5106 alg->alg_ef_default != oalg.alg_ef_default ||
5107 5107 alg->alg_ef_default_bits !=
5108 5108 oalg.alg_ef_default_bits)
5109 5109 alg_changed = B_TRUE;
5110 5110
5111 5111 /*
5112 5112 * Update the affected SAs if a software provider is
5113 5113 * being added or removed.
5114 5114 */
5115 5115 if (prov_change->ec_provider_type ==
5116 5116 CRYPTO_SW_PROVIDER)
5117 5117 sadb_alg_update(algtype, alg->alg_id,
5118 5118 prov_change->ec_change ==
5119 5119 CRYPTO_MECH_ADDED, ns);
5120 5120 }
5121 5121 }
5122 5122 mutex_exit(&ipss->ipsec_alg_lock);
5123 5123 crypto_free_mech_list(mechs, mech_count);
5124 5124
5125 5125 if (alg_changed) {
5126 5126 /*
5127 5127 * An algorithm has changed, i.e. it became valid or
5128 5128 * invalid, or its support key sizes have changed.
5129 5129 * Notify ipsecah and ipsecesp of this change so
5130 5130 * that they can send a SADB_REGISTER to their consumers.
5131 5131 */
5132 5132 ipsecah_algs_changed(ns);
5133 5133 ipsecesp_algs_changed(ns);
5134 5134 }
5135 5135 }
5136 5136
5137 5137 /*
5138 5138 * Registers with the crypto framework to be notified of crypto
5139 5139 * providers changes. Used to update the algorithm tables and
5140 5140 * to free or create context templates if needed. Invoked after IPsec
5141 5141 * is loaded successfully.
5142 5142 *
5143 5143 * This is called separately for each IP instance, so we ensure we only
5144 5144 * register once.
5145 5145 */
5146 5146 void
5147 5147 ipsec_register_prov_update(void)
5148 5148 {
5149 5149 if (prov_update_handle != NULL)
5150 5150 return;
5151 5151
5152 5152 prov_update_handle = crypto_notify_events(
5153 5153 ipsec_prov_update_callback, CRYPTO_EVENT_MECHS_CHANGED);
5154 5154 }
5155 5155
5156 5156 /*
5157 5157 * Unregisters from the framework to be notified of crypto providers
5158 5158 * changes. Called from ipsec_policy_g_destroy().
5159 5159 */
5160 5160 static void
5161 5161 ipsec_unregister_prov_update(void)
5162 5162 {
5163 5163 if (prov_update_handle != NULL)
5164 5164 crypto_unnotify_events(prov_update_handle);
5165 5165 }
5166 5166
5167 5167 /*
5168 5168 * Tunnel-mode support routines.
5169 5169 */
5170 5170
5171 5171 /*
5172 5172 * Returns an mblk chain suitable for putnext() if policies match and IPsec
5173 5173 * SAs are available. If there's no per-tunnel policy, or a match comes back
5174 5174 * with no match, then still return the packet and have global policy take
5175 5175 * a crack at it in IP.
5176 5176 * This updates the ip_xmit_attr with the IPsec policy.
5177 5177 *
5178 5178 * Remember -> we can be forwarding packets. Keep that in mind w.r.t.
5179 5179 * inner-packet contents.
5180 5180 */
5181 5181 mblk_t *
5182 5182 ipsec_tun_outbound(mblk_t *mp, iptun_t *iptun, ipha_t *inner_ipv4,
5183 5183 ip6_t *inner_ipv6, ipha_t *outer_ipv4, ip6_t *outer_ipv6, int outer_hdr_len,
5184 5184 ip_xmit_attr_t *ixa)
5185 5185 {
5186 5186 ipsec_policy_head_t *polhead;
5187 5187 ipsec_selector_t sel;
5188 5188 mblk_t *nmp;
5189 5189 boolean_t is_fragment;
5190 5190 ipsec_policy_t *pol;
5191 5191 ipsec_tun_pol_t *itp = iptun->iptun_itp;
5192 5192 netstack_t *ns = iptun->iptun_ns;
5193 5193 ipsec_stack_t *ipss = ns->netstack_ipsec;
5194 5194
5195 5195 ASSERT(outer_ipv6 != NULL && outer_ipv4 == NULL ||
5196 5196 outer_ipv4 != NULL && outer_ipv6 == NULL);
5197 5197 /* We take care of inners in a bit. */
5198 5198
5199 5199 /* Are the IPsec fields initialized at all? */
5200 5200 if (!(ixa->ixa_flags & IXAF_IPSEC_SECURE)) {
5201 5201 ASSERT(ixa->ixa_ipsec_policy == NULL);
5202 5202 ASSERT(ixa->ixa_ipsec_latch == NULL);
5203 5203 ASSERT(ixa->ixa_ipsec_action == NULL);
5204 5204 ASSERT(ixa->ixa_ipsec_ah_sa == NULL);
5205 5205 ASSERT(ixa->ixa_ipsec_esp_sa == NULL);
5206 5206 }
5207 5207
5208 5208 ASSERT(itp != NULL && (itp->itp_flags & ITPF_P_ACTIVE));
5209 5209 polhead = itp->itp_policy;
5210 5210
5211 5211 bzero(&sel, sizeof (sel));
5212 5212 if (inner_ipv4 != NULL) {
5213 5213 ASSERT(inner_ipv6 == NULL);
5214 5214 sel.ips_isv4 = B_TRUE;
5215 5215 sel.ips_local_addr_v4 = inner_ipv4->ipha_src;
5216 5216 sel.ips_remote_addr_v4 = inner_ipv4->ipha_dst;
5217 5217 sel.ips_protocol = (uint8_t)inner_ipv4->ipha_protocol;
5218 5218 } else {
5219 5219 ASSERT(inner_ipv6 != NULL);
5220 5220 sel.ips_isv4 = B_FALSE;
5221 5221 sel.ips_local_addr_v6 = inner_ipv6->ip6_src;
5222 5222 /*
5223 5223 * We don't care about routing-header dests in the
5224 5224 * forwarding/tunnel path, so just grab ip6_dst.
5225 5225 */
5226 5226 sel.ips_remote_addr_v6 = inner_ipv6->ip6_dst;
5227 5227 }
5228 5228
5229 5229 if (itp->itp_flags & ITPF_P_PER_PORT_SECURITY) {
5230 5230 /*
5231 5231 * Caller can prepend the outer header, which means
5232 5232 * inner_ipv[46] may be stuck in the middle. Pullup the whole
5233 5233 * mess now if need-be, for easier processing later. Don't
5234 5234 * forget to rewire the outer header too.
5235 5235 */
5236 5236 if (mp->b_cont != NULL) {
5237 5237 nmp = msgpullup(mp, -1);
5238 5238 if (nmp == NULL) {
5239 5239 ip_drop_packet(mp, B_FALSE, NULL,
5240 5240 DROPPER(ipss, ipds_spd_nomem),
5241 5241 &ipss->ipsec_spd_dropper);
5242 5242 return (NULL);
5243 5243 }
5244 5244 freemsg(mp);
5245 5245 mp = nmp;
5246 5246 if (outer_ipv4 != NULL)
5247 5247 outer_ipv4 = (ipha_t *)mp->b_rptr;
5248 5248 else
5249 5249 outer_ipv6 = (ip6_t *)mp->b_rptr;
5250 5250 if (inner_ipv4 != NULL) {
5251 5251 inner_ipv4 =
5252 5252 (ipha_t *)(mp->b_rptr + outer_hdr_len);
5253 5253 } else {
5254 5254 inner_ipv6 =
5255 5255 (ip6_t *)(mp->b_rptr + outer_hdr_len);
5256 5256 }
5257 5257 }
5258 5258 if (inner_ipv4 != NULL) {
5259 5259 is_fragment = IS_V4_FRAGMENT(
5260 5260 inner_ipv4->ipha_fragment_offset_and_flags);
5261 5261 } else {
5262 5262 sel.ips_remote_addr_v6 = ip_get_dst_v6(inner_ipv6, mp,
5263 5263 &is_fragment);
5264 5264 }
5265 5265
5266 5266 if (is_fragment) {
5267 5267 ipha_t *oiph;
5268 5268 ipha_t *iph = NULL;
5269 5269 ip6_t *ip6h = NULL;
5270 5270 int hdr_len;
5271 5271 uint16_t ip6_hdr_length;
5272 5272 uint8_t v6_proto;
5273 5273 uint8_t *v6_proto_p;
5274 5274
5275 5275 /*
5276 5276 * We have a fragment we need to track!
5277 5277 */
5278 5278 mp = ipsec_fragcache_add(&itp->itp_fragcache, NULL, mp,
5279 5279 outer_hdr_len, ipss);
5280 5280 if (mp == NULL)
5281 5281 return (NULL);
5282 5282 ASSERT(mp->b_cont == NULL);
5283 5283
5284 5284 /*
5285 5285 * If we get here, we have a full fragment chain
5286 5286 */
5287 5287
5288 5288 oiph = (ipha_t *)mp->b_rptr;
5289 5289 if (IPH_HDR_VERSION(oiph) == IPV4_VERSION) {
5290 5290 hdr_len = ((outer_hdr_len != 0) ?
5291 5291 IPH_HDR_LENGTH(oiph) : 0);
5292 5292 iph = (ipha_t *)(mp->b_rptr + hdr_len);
5293 5293 } else {
5294 5294 ASSERT(IPH_HDR_VERSION(oiph) == IPV6_VERSION);
5295 5295 ip6h = (ip6_t *)mp->b_rptr;
5296 5296 if (!ip_hdr_length_nexthdr_v6(mp, ip6h,
5297 5297 &ip6_hdr_length, &v6_proto_p)) {
5298 5298 ip_drop_packet_chain(mp, B_FALSE, NULL,
5299 5299 DROPPER(ipss,
5300 5300 ipds_spd_malformed_packet),
5301 5301 &ipss->ipsec_spd_dropper);
5302 5302 return (NULL);
5303 5303 }
5304 5304 hdr_len = ip6_hdr_length;
5305 5305 }
5306 5306 outer_hdr_len = hdr_len;
5307 5307
5308 5308 if (sel.ips_isv4) {
5309 5309 if (iph == NULL) {
5310 5310 /* Was v6 outer */
5311 5311 iph = (ipha_t *)(mp->b_rptr + hdr_len);
5312 5312 }
5313 5313 inner_ipv4 = iph;
5314 5314 sel.ips_local_addr_v4 = inner_ipv4->ipha_src;
5315 5315 sel.ips_remote_addr_v4 = inner_ipv4->ipha_dst;
5316 5316 sel.ips_protocol =
5317 5317 (uint8_t)inner_ipv4->ipha_protocol;
5318 5318 } else {
5319 5319 inner_ipv6 = (ip6_t *)(mp->b_rptr +
5320 5320 hdr_len);
5321 5321 sel.ips_local_addr_v6 = inner_ipv6->ip6_src;
5322 5322 sel.ips_remote_addr_v6 = inner_ipv6->ip6_dst;
5323 5323 if (!ip_hdr_length_nexthdr_v6(mp,
5324 5324 inner_ipv6, &ip6_hdr_length, &v6_proto_p)) {
5325 5325 ip_drop_packet_chain(mp, B_FALSE, NULL,
5326 5326 DROPPER(ipss,
5327 5327 ipds_spd_malformed_frag),
5328 5328 &ipss->ipsec_spd_dropper);
5329 5329 return (NULL);
5330 5330 }
5331 5331 v6_proto = *v6_proto_p;
5332 5332 sel.ips_protocol = v6_proto;
5333 5333 #ifdef FRAGCACHE_DEBUG
5334 5334 cmn_err(CE_WARN, "v6_sel.ips_protocol = %d\n",
5335 5335 sel.ips_protocol);
5336 5336 #endif
5337 5337 }
5338 5338 /* Ports are extracted below */
5339 5339 }
5340 5340
5341 5341 /* Get ports... */
5342 5342 if (!ipsec_init_outbound_ports(&sel, mp,
5343 5343 inner_ipv4, inner_ipv6, outer_hdr_len, ipss)) {
5344 5344 /* callee did ip_drop_packet_chain() on mp. */
5345 5345 return (NULL);
5346 5346 }
5347 5347 #ifdef FRAGCACHE_DEBUG
5348 5348 if (inner_ipv4 != NULL)
5349 5349 cmn_err(CE_WARN,
5350 5350 "(v4) sel.ips_protocol = %d, "
5351 5351 "sel.ips_local_port = %d, "
5352 5352 "sel.ips_remote_port = %d\n",
5353 5353 sel.ips_protocol, ntohs(sel.ips_local_port),
5354 5354 ntohs(sel.ips_remote_port));
5355 5355 if (inner_ipv6 != NULL)
5356 5356 cmn_err(CE_WARN,
5357 5357 "(v6) sel.ips_protocol = %d, "
5358 5358 "sel.ips_local_port = %d, "
5359 5359 "sel.ips_remote_port = %d\n",
5360 5360 sel.ips_protocol, ntohs(sel.ips_local_port),
5361 5361 ntohs(sel.ips_remote_port));
5362 5362 #endif
5363 5363 /* Success so far! */
5364 5364 }
5365 5365 rw_enter(&polhead->iph_lock, RW_READER);
5366 5366 pol = ipsec_find_policy_head(NULL, polhead, IPSEC_TYPE_OUTBOUND, &sel);
5367 5367 rw_exit(&polhead->iph_lock);
5368 5368 if (pol == NULL) {
5369 5369 /*
5370 5370 * No matching policy on this tunnel, drop the packet.
5371 5371 *
5372 5372 * NOTE: Tunnel-mode tunnels are different from the
5373 5373 * IP global transport mode policy head. For a tunnel-mode
5374 5374 * tunnel, we drop the packet in lieu of passing it
5375 5375 * along accepted the way a global-policy miss would.
5376 5376 *
5377 5377 * NOTE2: "negotiate transport" tunnels should match ALL
5378 5378 * inbound packets, but we do not uncomment the ASSERT()
5379 5379 * below because if/when we open PF_POLICY, a user can
5380 5380 * shoot him/her-self in the foot with a 0 priority.
5381 5381 */
5382 5382
5383 5383 /* ASSERT(itp->itp_flags & ITPF_P_TUNNEL); */
5384 5384 #ifdef FRAGCACHE_DEBUG
5385 5385 cmn_err(CE_WARN, "ipsec_tun_outbound(): No matching tunnel "
5386 5386 "per-port policy\n");
5387 5387 #endif
5388 5388 ip_drop_packet_chain(mp, B_FALSE, NULL,
5389 5389 DROPPER(ipss, ipds_spd_explicit),
5390 5390 &ipss->ipsec_spd_dropper);
5391 5391 return (NULL);
5392 5392 }
5393 5393
5394 5394 #ifdef FRAGCACHE_DEBUG
5395 5395 cmn_err(CE_WARN, "Having matching tunnel per-port policy\n");
5396 5396 #endif
5397 5397
5398 5398 /*
5399 5399 * NOTE: ixa_cleanup() function will release pol references.
5400 5400 */
5401 5401 ixa->ixa_ipsec_policy = pol;
5402 5402 /*
5403 5403 * NOTE: There is a subtle difference between iptun_zoneid and
5404 5404 * iptun_connp->conn_zoneid explained in iptun_conn_create(). When
5405 5405 * interacting with the ip module, we must use conn_zoneid.
5406 5406 */
5407 5407 ixa->ixa_zoneid = iptun->iptun_connp->conn_zoneid;
5408 5408
5409 5409 ASSERT((outer_ipv4 != NULL) ? (ixa->ixa_flags & IXAF_IS_IPV4) :
5410 5410 !(ixa->ixa_flags & IXAF_IS_IPV4));
5411 5411 ASSERT(ixa->ixa_ipsec_policy != NULL);
5412 5412 ixa->ixa_flags |= IXAF_IPSEC_SECURE;
5413 5413
5414 5414 if (!(itp->itp_flags & ITPF_P_TUNNEL)) {
5415 5415 /* Set up transport mode for tunnelled packets. */
5416 5416 ixa->ixa_ipsec_proto = (inner_ipv4 != NULL) ? IPPROTO_ENCAP :
5417 5417 IPPROTO_IPV6;
5418 5418 return (mp);
5419 5419 }
5420 5420
5421 5421 /* Fill in tunnel-mode goodies here. */
5422 5422 ixa->ixa_flags |= IXAF_IPSEC_TUNNEL;
5423 5423 /* XXX Do I need to fill in all of the goodies here? */
5424 5424 if (inner_ipv4) {
5425 5425 ixa->ixa_ipsec_inaf = AF_INET;
5426 5426 ixa->ixa_ipsec_insrc[0] =
5427 5427 pol->ipsp_sel->ipsl_key.ipsl_local.ipsad_v4;
5428 5428 ixa->ixa_ipsec_indst[0] =
5429 5429 pol->ipsp_sel->ipsl_key.ipsl_remote.ipsad_v4;
5430 5430 } else {
5431 5431 ixa->ixa_ipsec_inaf = AF_INET6;
5432 5432 ixa->ixa_ipsec_insrc[0] =
5433 5433 pol->ipsp_sel->ipsl_key.ipsl_local.ipsad_v6.s6_addr32[0];
5434 5434 ixa->ixa_ipsec_insrc[1] =
5435 5435 pol->ipsp_sel->ipsl_key.ipsl_local.ipsad_v6.s6_addr32[1];
5436 5436 ixa->ixa_ipsec_insrc[2] =
5437 5437 pol->ipsp_sel->ipsl_key.ipsl_local.ipsad_v6.s6_addr32[2];
5438 5438 ixa->ixa_ipsec_insrc[3] =
5439 5439 pol->ipsp_sel->ipsl_key.ipsl_local.ipsad_v6.s6_addr32[3];
5440 5440 ixa->ixa_ipsec_indst[0] =
5441 5441 pol->ipsp_sel->ipsl_key.ipsl_remote.ipsad_v6.s6_addr32[0];
5442 5442 ixa->ixa_ipsec_indst[1] =
5443 5443 pol->ipsp_sel->ipsl_key.ipsl_remote.ipsad_v6.s6_addr32[1];
5444 5444 ixa->ixa_ipsec_indst[2] =
5445 5445 pol->ipsp_sel->ipsl_key.ipsl_remote.ipsad_v6.s6_addr32[2];
5446 5446 ixa->ixa_ipsec_indst[3] =
5447 5447 pol->ipsp_sel->ipsl_key.ipsl_remote.ipsad_v6.s6_addr32[3];
5448 5448 }
5449 5449 ixa->ixa_ipsec_insrcpfx = pol->ipsp_sel->ipsl_key.ipsl_local_pfxlen;
5450 5450 ixa->ixa_ipsec_indstpfx = pol->ipsp_sel->ipsl_key.ipsl_remote_pfxlen;
5451 5451 /* NOTE: These are used for transport mode too. */
5452 5452 ixa->ixa_ipsec_src_port = pol->ipsp_sel->ipsl_key.ipsl_lport;
5453 5453 ixa->ixa_ipsec_dst_port = pol->ipsp_sel->ipsl_key.ipsl_rport;
5454 5454 ixa->ixa_ipsec_proto = pol->ipsp_sel->ipsl_key.ipsl_proto;
5455 5455
5456 5456 return (mp);
5457 5457 }
5458 5458
5459 5459 /*
5460 5460 * NOTE: The following releases pol's reference and
5461 5461 * calls ip_drop_packet() for me on NULL returns.
5462 5462 */
5463 5463 mblk_t *
5464 5464 ipsec_check_ipsecin_policy_reasm(mblk_t *attr_mp, ipsec_policy_t *pol,
5465 5465 ipha_t *inner_ipv4, ip6_t *inner_ipv6, uint64_t pkt_unique, netstack_t *ns)
5466 5466 {
5467 5467 /* Assume attr_mp is a chain of b_next-linked ip_recv_attr mblk. */
5468 5468 mblk_t *data_chain = NULL, *data_tail = NULL;
5469 5469 mblk_t *next;
5470 5470 mblk_t *data_mp;
5471 5471 ip_recv_attr_t iras;
5472 5472
5473 5473 while (attr_mp != NULL) {
5474 5474 ASSERT(ip_recv_attr_is_mblk(attr_mp));
5475 5475 next = attr_mp->b_next;
5476 5476 attr_mp->b_next = NULL; /* No tripping asserts. */
5477 5477
5478 5478 data_mp = attr_mp->b_cont;
5479 5479 attr_mp->b_cont = NULL;
5480 5480 if (!ip_recv_attr_from_mblk(attr_mp, &iras)) {
5481 5481 /* The ill or ip_stack_t disappeared on us */
5482 5482 freemsg(data_mp); /* ip_drop_packet?? */
5483 5483 ira_cleanup(&iras, B_TRUE);
5484 5484 goto fail;
5485 5485 }
5486 5486
5487 5487 /*
5488 5488 * Need IPPOL_REFHOLD(pol) for extras because
5489 5489 * ipsecin_policy does the refrele.
5490 5490 */
5491 5491 IPPOL_REFHOLD(pol);
5492 5492
5493 5493 data_mp = ipsec_check_ipsecin_policy(data_mp, pol, inner_ipv4,
5494 5494 inner_ipv6, pkt_unique, &iras, ns);
5495 5495 ira_cleanup(&iras, B_TRUE);
5496 5496
5497 5497 if (data_mp == NULL)
5498 5498 goto fail;
5499 5499
5500 5500 if (data_tail == NULL) {
5501 5501 /* First one */
5502 5502 data_chain = data_tail = data_mp;
5503 5503 } else {
5504 5504 data_tail->b_next = data_mp;
5505 5505 data_tail = data_mp;
5506 5506 }
5507 5507 attr_mp = next;
5508 5508 }
5509 5509 /*
5510 5510 * One last release because either the loop bumped it up, or we never
5511 5511 * called ipsec_check_ipsecin_policy().
5512 5512 */
5513 5513 IPPOL_REFRELE(pol);
5514 5514
5515 5515 /* data_chain is ready for return to tun module. */
5516 5516 return (data_chain);
5517 5517
5518 5518 fail:
5519 5519 /*
5520 5520 * Need to get rid of any extra pol
5521 5521 * references, and any remaining bits as well.
5522 5522 */
5523 5523 IPPOL_REFRELE(pol);
5524 5524 ipsec_freemsg_chain(data_chain);
5525 5525 ipsec_freemsg_chain(next); /* ipdrop stats? */
5526 5526 return (NULL);
5527 5527 }
5528 5528
5529 5529 /*
5530 5530 * Return a message if the inbound packet passed an IPsec policy check. Returns
5531 5531 * NULL if it failed or if it is a fragment needing its friends before a
5532 5532 * policy check can be performed.
5533 5533 *
5534 5534 * Expects a non-NULL data_mp, and a non-NULL polhead.
5535 5535 * The returned mblk may be a b_next chain of packets if fragments
5536 5536 * neeeded to be collected for a proper policy check.
5537 5537 *
5538 5538 * This function calls ip_drop_packet() on data_mp if need be.
5539 5539 *
5540 5540 * NOTE: outer_hdr_len is signed. If it's a negative value, the caller
5541 5541 * is inspecting an ICMP packet.
5542 5542 */
5543 5543 mblk_t *
5544 5544 ipsec_tun_inbound(ip_recv_attr_t *ira, mblk_t *data_mp, ipsec_tun_pol_t *itp,
5545 5545 ipha_t *inner_ipv4, ip6_t *inner_ipv6, ipha_t *outer_ipv4,
5546 5546 ip6_t *outer_ipv6, int outer_hdr_len, netstack_t *ns)
5547 5547 {
5548 5548 ipsec_policy_head_t *polhead;
5549 5549 ipsec_selector_t sel;
5550 5550 ipsec_policy_t *pol;
5551 5551 uint16_t tmpport;
5552 5552 selret_t rc;
5553 5553 boolean_t port_policy_present, is_icmp, global_present;
5554 5554 in6_addr_t tmpaddr;
5555 5555 ipaddr_t tmp4;
5556 5556 uint8_t flags, *inner_hdr;
5557 5557 ipsec_stack_t *ipss = ns->netstack_ipsec;
5558 5558
5559 5559 sel.ips_is_icmp_inv_acq = 0;
5560 5560
5561 5561 if (outer_ipv4 != NULL) {
5562 5562 ASSERT(outer_ipv6 == NULL);
5563 5563 global_present = ipss->ipsec_inbound_v4_policy_present;
5564 5564 } else {
5565 5565 ASSERT(outer_ipv6 != NULL);
5566 5566 global_present = ipss->ipsec_inbound_v6_policy_present;
5567 5567 }
5568 5568
5569 5569 ASSERT(inner_ipv4 != NULL && inner_ipv6 == NULL ||
5570 5570 inner_ipv4 == NULL && inner_ipv6 != NULL);
5571 5571
5572 5572 if (outer_hdr_len < 0) {
5573 5573 outer_hdr_len = (-outer_hdr_len);
5574 5574 is_icmp = B_TRUE;
5575 5575 } else {
5576 5576 is_icmp = B_FALSE;
5577 5577 }
5578 5578
5579 5579 if (itp != NULL && (itp->itp_flags & ITPF_P_ACTIVE)) {
5580 5580 mblk_t *mp = data_mp;
5581 5581
5582 5582 polhead = itp->itp_policy;
5583 5583 /*
5584 5584 * We need to perform full Tunnel-Mode enforcement,
5585 5585 * and we need to have inner-header data for such enforcement.
5586 5586 *
5587 5587 * See ipsec_init_inbound_sel() for the 0x80000000 on inbound
5588 5588 * and on return.
5589 5589 */
5590 5590
5591 5591 port_policy_present = ((itp->itp_flags &
5592 5592 ITPF_P_PER_PORT_SECURITY) ? B_TRUE : B_FALSE);
5593 5593 /*
5594 5594 * NOTE: Even if our policy is transport mode, set the
5595 5595 * SEL_TUNNEL_MODE flag so ipsec_init_inbound_sel() can
5596 5596 * do the right thing w.r.t. outer headers.
5597 5597 */
5598 5598 flags = ((port_policy_present ? SEL_PORT_POLICY : SEL_NONE) |
5599 5599 (is_icmp ? SEL_IS_ICMP : SEL_NONE) | SEL_TUNNEL_MODE);
5600 5600
5601 5601 rc = ipsec_init_inbound_sel(&sel, data_mp, inner_ipv4,
5602 5602 inner_ipv6, flags);
5603 5603
5604 5604 switch (rc) {
5605 5605 case SELRET_NOMEM:
5606 5606 ip_drop_packet(data_mp, B_TRUE, NULL,
5607 5607 DROPPER(ipss, ipds_spd_nomem),
5608 5608 &ipss->ipsec_spd_dropper);
5609 5609 return (NULL);
5610 5610 case SELRET_TUNFRAG:
5611 5611 /*
5612 5612 * At this point, if we're cleartext, we don't want
5613 5613 * to go there.
5614 5614 */
5615 5615 if (!(ira->ira_flags & IRAF_IPSEC_SECURE)) {
5616 5616 ip_drop_packet(data_mp, B_TRUE, NULL,
5617 5617 DROPPER(ipss, ipds_spd_got_clear),
5618 5618 &ipss->ipsec_spd_dropper);
5619 5619 return (NULL);
5620 5620 }
5621 5621
5622 5622 /*
5623 5623 * Inner and outer headers may not be contiguous.
5624 5624 * Pullup the data_mp now to satisfy assumptions of
5625 5625 * ipsec_fragcache_add()
5626 5626 */
5627 5627 if (data_mp->b_cont != NULL) {
5628 5628 mblk_t *nmp;
5629 5629
5630 5630 nmp = msgpullup(data_mp, -1);
5631 5631 if (nmp == NULL) {
5632 5632 ip_drop_packet(data_mp, B_TRUE, NULL,
5633 5633 DROPPER(ipss, ipds_spd_nomem),
5634 5634 &ipss->ipsec_spd_dropper);
5635 5635 return (NULL);
5636 5636 }
5637 5637 freemsg(data_mp);
5638 5638 data_mp = nmp;
5639 5639 if (outer_ipv4 != NULL)
5640 5640 outer_ipv4 =
5641 5641 (ipha_t *)data_mp->b_rptr;
5642 5642 else
5643 5643 outer_ipv6 =
5644 5644 (ip6_t *)data_mp->b_rptr;
5645 5645 if (inner_ipv4 != NULL) {
5646 5646 inner_ipv4 =
5647 5647 (ipha_t *)(data_mp->b_rptr +
5648 5648 outer_hdr_len);
5649 5649 } else {
5650 5650 inner_ipv6 =
5651 5651 (ip6_t *)(data_mp->b_rptr +
5652 5652 outer_hdr_len);
5653 5653 }
5654 5654 }
5655 5655
5656 5656 /*
5657 5657 * If we need to queue the packet. First we
5658 5658 * get an mblk with the attributes. ipsec_fragcache_add
5659 5659 * will prepend that to the queued data and return
5660 5660 * a list of b_next messages each of which starts with
5661 5661 * the attribute mblk.
5662 5662 */
5663 5663 mp = ip_recv_attr_to_mblk(ira);
5664 5664 if (mp == NULL) {
5665 5665 ip_drop_packet(data_mp, B_TRUE, NULL,
5666 5666 DROPPER(ipss, ipds_spd_nomem),
5667 5667 &ipss->ipsec_spd_dropper);
5668 5668 return (NULL);
5669 5669 }
5670 5670
5671 5671 mp = ipsec_fragcache_add(&itp->itp_fragcache,
5672 5672 mp, data_mp, outer_hdr_len, ipss);
5673 5673
5674 5674 if (mp == NULL) {
5675 5675 /*
5676 5676 * Data is cached, fragment chain is not
5677 5677 * complete.
5678 5678 */
5679 5679 return (NULL);
5680 5680 }
5681 5681
5682 5682 /*
5683 5683 * If we get here, we have a full fragment chain.
5684 5684 * Reacquire headers and selectors from first fragment.
5685 5685 */
5686 5686 ASSERT(ip_recv_attr_is_mblk(mp));
5687 5687 data_mp = mp->b_cont;
5688 5688 inner_hdr = data_mp->b_rptr;
5689 5689 if (outer_ipv4 != NULL) {
5690 5690 inner_hdr += IPH_HDR_LENGTH(
5691 5691 (ipha_t *)data_mp->b_rptr);
5692 5692 } else {
5693 5693 inner_hdr += ip_hdr_length_v6(data_mp,
5694 5694 (ip6_t *)data_mp->b_rptr);
5695 5695 }
5696 5696 ASSERT(inner_hdr <= data_mp->b_wptr);
5697 5697
5698 5698 if (inner_ipv4 != NULL) {
5699 5699 inner_ipv4 = (ipha_t *)inner_hdr;
5700 5700 inner_ipv6 = NULL;
5701 5701 } else {
5702 5702 inner_ipv6 = (ip6_t *)inner_hdr;
5703 5703 inner_ipv4 = NULL;
5704 5704 }
5705 5705
5706 5706 /*
5707 5707 * Use SEL_TUNNEL_MODE to take into account the outer
5708 5708 * header. Use SEL_POST_FRAG so we always get ports.
5709 5709 */
5710 5710 rc = ipsec_init_inbound_sel(&sel, data_mp,
5711 5711 inner_ipv4, inner_ipv6,
5712 5712 SEL_TUNNEL_MODE | SEL_POST_FRAG);
5713 5713 switch (rc) {
5714 5714 case SELRET_SUCCESS:
5715 5715 /*
5716 5716 * Get to same place as first caller's
5717 5717 * SELRET_SUCCESS case.
5718 5718 */
5719 5719 break;
5720 5720 case SELRET_NOMEM:
5721 5721 ip_drop_packet_chain(mp, B_TRUE, NULL,
5722 5722 DROPPER(ipss, ipds_spd_nomem),
5723 5723 &ipss->ipsec_spd_dropper);
5724 5724 return (NULL);
5725 5725 case SELRET_BADPKT:
5726 5726 ip_drop_packet_chain(mp, B_TRUE, NULL,
5727 5727 DROPPER(ipss, ipds_spd_malformed_frag),
5728 5728 &ipss->ipsec_spd_dropper);
5729 5729 return (NULL);
5730 5730 case SELRET_TUNFRAG:
5731 5731 cmn_err(CE_WARN, "(TUNFRAG on 2nd call...)");
5732 5732 /* FALLTHRU */
5733 5733 default:
5734 5734 cmn_err(CE_WARN, "ipsec_init_inbound_sel(mark2)"
5735 5735 " returns bizarro 0x%x", rc);
5736 5736 /* Guaranteed panic! */
5737 5737 ASSERT(rc == SELRET_NOMEM);
5738 5738 return (NULL);
5739 5739 }
5740 5740 /* FALLTHRU */
5741 5741 case SELRET_SUCCESS:
5742 5742 /*
5743 5743 * Common case:
5744 5744 * No per-port policy or a non-fragment. Keep going.
5745 5745 */
5746 5746 break;
5747 5747 case SELRET_BADPKT:
5748 5748 /*
5749 5749 * We may receive ICMP (with IPv6 inner) packets that
5750 5750 * trigger this return value. Send 'em in for
5751 5751 * enforcement checking.
5752 5752 */
5753 5753 cmn_err(CE_NOTE, "ipsec_tun_inbound(): "
5754 5754 "sending 'bad packet' in for enforcement");
5755 5755 break;
5756 5756 default:
5757 5757 cmn_err(CE_WARN,
5758 5758 "ipsec_init_inbound_sel() returns bizarro 0x%x",
5759 5759 rc);
5760 5760 ASSERT(rc == SELRET_NOMEM); /* Guaranteed panic! */
5761 5761 return (NULL);
5762 5762 }
5763 5763
5764 5764 if (is_icmp) {
5765 5765 /*
5766 5766 * Swap local/remote because this is an ICMP packet.
5767 5767 */
5768 5768 tmpaddr = sel.ips_local_addr_v6;
5769 5769 sel.ips_local_addr_v6 = sel.ips_remote_addr_v6;
5770 5770 sel.ips_remote_addr_v6 = tmpaddr;
5771 5771 tmpport = sel.ips_local_port;
5772 5772 sel.ips_local_port = sel.ips_remote_port;
5773 5773 sel.ips_remote_port = tmpport;
5774 5774 }
5775 5775
5776 5776 /* find_policy_head() */
5777 5777 rw_enter(&polhead->iph_lock, RW_READER);
5778 5778 pol = ipsec_find_policy_head(NULL, polhead, IPSEC_TYPE_INBOUND,
5779 5779 &sel);
5780 5780 rw_exit(&polhead->iph_lock);
5781 5781 if (pol != NULL) {
5782 5782 uint64_t pkt_unique;
5783 5783
5784 5784 if (!(ira->ira_flags & IRAF_IPSEC_SECURE)) {
5785 5785 if (!pol->ipsp_act->ipa_allow_clear) {
5786 5786 /*
5787 5787 * XXX should never get here with
5788 5788 * tunnel reassembled fragments?
5789 5789 */
5790 5790 ASSERT(mp == data_mp);
5791 5791 ip_drop_packet(data_mp, B_TRUE, NULL,
5792 5792 DROPPER(ipss, ipds_spd_got_clear),
5793 5793 &ipss->ipsec_spd_dropper);
5794 5794 IPPOL_REFRELE(pol);
5795 5795 return (NULL);
5796 5796 } else {
5797 5797 IPPOL_REFRELE(pol);
5798 5798 return (mp);
5799 5799 }
5800 5800 }
5801 5801 pkt_unique = SA_UNIQUE_ID(sel.ips_remote_port,
5802 5802 sel.ips_local_port,
5803 5803 (inner_ipv4 == NULL) ? IPPROTO_IPV6 :
5804 5804 IPPROTO_ENCAP, sel.ips_protocol);
5805 5805
5806 5806 /*
5807 5807 * NOTE: The following releases pol's reference and
5808 5808 * calls ip_drop_packet() for me on NULL returns.
5809 5809 *
5810 5810 * "sel" is still good here, so let's use it!
5811 5811 */
5812 5812 if (data_mp == mp) {
5813 5813 /* A single packet without attributes */
5814 5814 data_mp = ipsec_check_ipsecin_policy(data_mp,
5815 5815 pol, inner_ipv4, inner_ipv6, pkt_unique,
5816 5816 ira, ns);
5817 5817 } else {
5818 5818 /*
5819 5819 * We pass in the b_next chain of attr_mp's
5820 5820 * and get back a b_next chain of data_mp's.
5821 5821 */
5822 5822 data_mp = ipsec_check_ipsecin_policy_reasm(mp,
5823 5823 pol, inner_ipv4, inner_ipv6, pkt_unique,
5824 5824 ns);
5825 5825 }
5826 5826 return (data_mp);
5827 5827 }
5828 5828
5829 5829 /*
5830 5830 * Else fallthru and check the global policy on the outer
5831 5831 * header(s) if this tunnel is an old-style transport-mode
5832 5832 * one. Drop the packet explicitly (no policy entry) for
5833 5833 * a new-style tunnel-mode tunnel.
5834 5834 */
5835 5835 if ((itp->itp_flags & ITPF_P_TUNNEL) && !is_icmp) {
5836 5836 ip_drop_packet_chain(data_mp, B_TRUE, NULL,
5837 5837 DROPPER(ipss, ipds_spd_explicit),
5838 5838 &ipss->ipsec_spd_dropper);
5839 5839 return (NULL);
5840 5840 }
5841 5841 }
5842 5842
5843 5843 /*
5844 5844 * NOTE: If we reach here, we will not have packet chains from
5845 5845 * fragcache_add(), because the only way I get chains is on a
5846 5846 * tunnel-mode tunnel, which either returns with a pass, or gets
5847 5847 * hit by the ip_drop_packet_chain() call right above here.
5848 5848 */
5849 5849 ASSERT(data_mp->b_next == NULL);
5850 5850
5851 5851 /* If no per-tunnel security, check global policy now. */
5852 5852 if ((ira->ira_flags & IRAF_IPSEC_SECURE) && !global_present) {
5853 5853 if (ira->ira_flags & IRAF_TRUSTED_ICMP) {
5854 5854 /*
5855 5855 * This is an ICMP message that was geenrated locally.
5856 5856 * We should accept it.
5857 5857 */
5858 5858 return (data_mp);
5859 5859 }
5860 5860
5861 5861 ip_drop_packet(data_mp, B_TRUE, NULL,
5862 5862 DROPPER(ipss, ipds_spd_got_secure),
5863 5863 &ipss->ipsec_spd_dropper);
5864 5864 return (NULL);
5865 5865 }
5866 5866
5867 5867 if (is_icmp) {
5868 5868 /*
5869 5869 * For ICMP packets, "outer_ipvN" is set to the outer header
5870 5870 * that is *INSIDE* the ICMP payload. For global policy
5871 5871 * checking, we need to reverse src/dst on the payload in
5872 5872 * order to construct selectors appropriately. See "ripha"
5873 5873 * constructions in ip.c. To avoid a bug like 6478464 (see
5874 5874 * earlier in this file), we will actually exchange src/dst
5875 5875 * in the packet, and reverse if after the call to
5876 5876 * ipsec_check_global_policy().
5877 5877 */
5878 5878 if (outer_ipv4 != NULL) {
5879 5879 tmp4 = outer_ipv4->ipha_src;
5880 5880 outer_ipv4->ipha_src = outer_ipv4->ipha_dst;
5881 5881 outer_ipv4->ipha_dst = tmp4;
5882 5882 } else {
5883 5883 ASSERT(outer_ipv6 != NULL);
5884 5884 tmpaddr = outer_ipv6->ip6_src;
5885 5885 outer_ipv6->ip6_src = outer_ipv6->ip6_dst;
5886 5886 outer_ipv6->ip6_dst = tmpaddr;
5887 5887 }
5888 5888 }
5889 5889
5890 5890 data_mp = ipsec_check_global_policy(data_mp, NULL, outer_ipv4,
5891 5891 outer_ipv6, ira, ns);
5892 5892 if (data_mp == NULL)
5893 5893 return (NULL);
5894 5894
5895 5895 if (is_icmp) {
5896 5896 /* Set things back to normal. */
5897 5897 if (outer_ipv4 != NULL) {
5898 5898 tmp4 = outer_ipv4->ipha_src;
5899 5899 outer_ipv4->ipha_src = outer_ipv4->ipha_dst;
5900 5900 outer_ipv4->ipha_dst = tmp4;
5901 5901 } else {
5902 5902 /* No need for ASSERT()s now. */
5903 5903 tmpaddr = outer_ipv6->ip6_src;
5904 5904 outer_ipv6->ip6_src = outer_ipv6->ip6_dst;
5905 5905 outer_ipv6->ip6_dst = tmpaddr;
5906 5906 }
5907 5907 }
5908 5908
5909 5909 /*
5910 5910 * At this point, we pretend it's a cleartext accepted
5911 5911 * packet.
5912 5912 */
5913 5913 return (data_mp);
5914 5914 }
5915 5915
5916 5916 /*
5917 5917 * AVL comparison routine for our list of tunnel polheads.
5918 5918 */
5919 5919 static int
5920 5920 tunnel_compare(const void *arg1, const void *arg2)
5921 5921 {
5922 5922 ipsec_tun_pol_t *left, *right;
5923 5923 int rc;
5924 5924
5925 5925 left = (ipsec_tun_pol_t *)arg1;
5926 5926 right = (ipsec_tun_pol_t *)arg2;
5927 5927
5928 5928 rc = strncmp(left->itp_name, right->itp_name, LIFNAMSIZ);
5929 5929 return (rc == 0 ? rc : (rc > 0 ? 1 : -1));
5930 5930 }
5931 5931
5932 5932 /*
5933 5933 * Free a tunnel policy node.
5934 5934 */
5935 5935 void
5936 5936 itp_free(ipsec_tun_pol_t *node, netstack_t *ns)
5937 5937 {
5938 5938 if (node->itp_policy != NULL) {
5939 5939 IPPH_REFRELE(node->itp_policy, ns);
5940 5940 node->itp_policy = NULL;
5941 5941 }
5942 5942 if (node->itp_inactive != NULL) {
5943 5943 IPPH_REFRELE(node->itp_inactive, ns);
5944 5944 node->itp_inactive = NULL;
5945 5945 }
5946 5946 mutex_destroy(&node->itp_lock);
5947 5947 kmem_free(node, sizeof (*node));
5948 5948 }
5949 5949
5950 5950 void
5951 5951 itp_unlink(ipsec_tun_pol_t *node, netstack_t *ns)
5952 5952 {
5953 5953 ipsec_stack_t *ipss = ns->netstack_ipsec;
5954 5954
5955 5955 rw_enter(&ipss->ipsec_tunnel_policy_lock, RW_WRITER);
5956 5956 ipss->ipsec_tunnel_policy_gen++;
5957 5957 ipsec_fragcache_uninit(&node->itp_fragcache, ipss);
5958 5958 avl_remove(&ipss->ipsec_tunnel_policies, node);
5959 5959 rw_exit(&ipss->ipsec_tunnel_policy_lock);
5960 5960 ITP_REFRELE(node, ns);
5961 5961 }
5962 5962
5963 5963 /*
5964 5964 * Public interface to look up a tunnel security policy by name. Used by
5965 5965 * spdsock mostly. Returns "node" with a bumped refcnt.
5966 5966 */
5967 5967 ipsec_tun_pol_t *
5968 5968 get_tunnel_policy(char *name, netstack_t *ns)
5969 5969 {
5970 5970 ipsec_tun_pol_t *node, lookup;
5971 5971 ipsec_stack_t *ipss = ns->netstack_ipsec;
5972 5972
5973 5973 (void) strncpy(lookup.itp_name, name, LIFNAMSIZ);
5974 5974
5975 5975 rw_enter(&ipss->ipsec_tunnel_policy_lock, RW_READER);
5976 5976 node = (ipsec_tun_pol_t *)avl_find(&ipss->ipsec_tunnel_policies,
5977 5977 &lookup, NULL);
5978 5978 if (node != NULL) {
5979 5979 ITP_REFHOLD(node);
5980 5980 }
5981 5981 rw_exit(&ipss->ipsec_tunnel_policy_lock);
5982 5982
5983 5983 return (node);
5984 5984 }
5985 5985
5986 5986 /*
5987 5987 * Public interface to walk all tunnel security polcies. Useful for spdsock
5988 5988 * DUMP operations. iterator() will not consume a reference.
5989 5989 */
5990 5990 void
5991 5991 itp_walk(void (*iterator)(ipsec_tun_pol_t *, void *, netstack_t *),
5992 5992 void *arg, netstack_t *ns)
5993 5993 {
5994 5994 ipsec_tun_pol_t *node;
5995 5995 ipsec_stack_t *ipss = ns->netstack_ipsec;
5996 5996
5997 5997 rw_enter(&ipss->ipsec_tunnel_policy_lock, RW_READER);
5998 5998 for (node = avl_first(&ipss->ipsec_tunnel_policies); node != NULL;
5999 5999 node = AVL_NEXT(&ipss->ipsec_tunnel_policies, node)) {
6000 6000 iterator(node, arg, ns);
6001 6001 }
6002 6002 rw_exit(&ipss->ipsec_tunnel_policy_lock);
6003 6003 }
6004 6004
6005 6005 /*
6006 6006 * Initialize policy head. This can only fail if there's a memory problem.
6007 6007 */
6008 6008 static boolean_t
6009 6009 tunnel_polhead_init(ipsec_policy_head_t *iph, netstack_t *ns)
6010 6010 {
6011 6011 ipsec_stack_t *ipss = ns->netstack_ipsec;
6012 6012
6013 6013 rw_init(&iph->iph_lock, NULL, RW_DEFAULT, NULL);
6014 6014 iph->iph_refs = 1;
6015 6015 iph->iph_gen = 0;
6016 6016 if (ipsec_alloc_table(iph, ipss->ipsec_tun_spd_hashsize,
6017 6017 KM_SLEEP, B_FALSE, ns) != 0) {
6018 6018 ipsec_polhead_free_table(iph);
6019 6019 return (B_FALSE);
6020 6020 }
6021 6021 ipsec_polhead_init(iph, ipss->ipsec_tun_spd_hashsize);
6022 6022 return (B_TRUE);
6023 6023 }
6024 6024
6025 6025 /*
6026 6026 * Create a tunnel policy node with "name". Set errno with
6027 6027 * ENOMEM if there's a memory problem, and EEXIST if there's an existing
6028 6028 * node.
6029 6029 */
6030 6030 ipsec_tun_pol_t *
6031 6031 create_tunnel_policy(char *name, int *errno, uint64_t *gen, netstack_t *ns)
6032 6032 {
6033 6033 ipsec_tun_pol_t *newbie, *existing;
6034 6034 avl_index_t where;
6035 6035 ipsec_stack_t *ipss = ns->netstack_ipsec;
6036 6036
6037 6037 newbie = kmem_zalloc(sizeof (*newbie), KM_NOSLEEP);
6038 6038 if (newbie == NULL) {
6039 6039 *errno = ENOMEM;
6040 6040 return (NULL);
6041 6041 }
6042 6042 if (!ipsec_fragcache_init(&newbie->itp_fragcache)) {
6043 6043 kmem_free(newbie, sizeof (*newbie));
6044 6044 *errno = ENOMEM;
6045 6045 return (NULL);
6046 6046 }
6047 6047
6048 6048 (void) strncpy(newbie->itp_name, name, LIFNAMSIZ);
6049 6049
6050 6050 rw_enter(&ipss->ipsec_tunnel_policy_lock, RW_WRITER);
6051 6051 existing = (ipsec_tun_pol_t *)avl_find(&ipss->ipsec_tunnel_policies,
6052 6052 newbie, &where);
6053 6053 if (existing != NULL) {
6054 6054 itp_free(newbie, ns);
6055 6055 *errno = EEXIST;
6056 6056 rw_exit(&ipss->ipsec_tunnel_policy_lock);
6057 6057 return (NULL);
6058 6058 }
6059 6059 ipss->ipsec_tunnel_policy_gen++;
6060 6060 *gen = ipss->ipsec_tunnel_policy_gen;
6061 6061 newbie->itp_refcnt = 2; /* One for the caller, one for the tree. */
6062 6062 newbie->itp_next_policy_index = 1;
6063 6063 avl_insert(&ipss->ipsec_tunnel_policies, newbie, where);
6064 6064 mutex_init(&newbie->itp_lock, NULL, MUTEX_DEFAULT, NULL);
6065 6065 newbie->itp_policy = kmem_zalloc(sizeof (ipsec_policy_head_t),
6066 6066 KM_NOSLEEP);
6067 6067 if (newbie->itp_policy == NULL)
6068 6068 goto nomem;
6069 6069 newbie->itp_inactive = kmem_zalloc(sizeof (ipsec_policy_head_t),
6070 6070 KM_NOSLEEP);
6071 6071 if (newbie->itp_inactive == NULL) {
6072 6072 kmem_free(newbie->itp_policy, sizeof (ipsec_policy_head_t));
6073 6073 goto nomem;
6074 6074 }
6075 6075
6076 6076 if (!tunnel_polhead_init(newbie->itp_policy, ns)) {
6077 6077 kmem_free(newbie->itp_policy, sizeof (ipsec_policy_head_t));
6078 6078 kmem_free(newbie->itp_inactive, sizeof (ipsec_policy_head_t));
6079 6079 goto nomem;
6080 6080 } else if (!tunnel_polhead_init(newbie->itp_inactive, ns)) {
6081 6081 IPPH_REFRELE(newbie->itp_policy, ns);
6082 6082 kmem_free(newbie->itp_inactive, sizeof (ipsec_policy_head_t));
6083 6083 goto nomem;
6084 6084 }
6085 6085 rw_exit(&ipss->ipsec_tunnel_policy_lock);
6086 6086
6087 6087 return (newbie);
6088 6088 nomem:
6089 6089 *errno = ENOMEM;
6090 6090 kmem_free(newbie, sizeof (*newbie));
6091 6091 return (NULL);
6092 6092 }
6093 6093
6094 6094 /*
6095 6095 * Given two addresses, find a tunnel instance's IPsec policy heads.
6096 6096 * Returns NULL on failure.
6097 6097 */
6098 6098 ipsec_tun_pol_t *
6099 6099 itp_get_byaddr(uint32_t *laddr, uint32_t *faddr, int af, ip_stack_t *ipst)
6100 6100 {
6101 6101 conn_t *connp;
6102 6102 iptun_t *iptun;
6103 6103 ipsec_tun_pol_t *itp = NULL;
6104 6104
6105 6105 /* Classifiers are used to "src" being foreign. */
6106 6106 if (af == AF_INET) {
6107 6107 connp = ipcl_iptun_classify_v4((ipaddr_t *)faddr,
6108 6108 (ipaddr_t *)laddr, ipst);
6109 6109 } else {
6110 6110 ASSERT(af == AF_INET6);
6111 6111 ASSERT(!IN6_IS_ADDR_V4MAPPED((in6_addr_t *)laddr));
6112 6112 ASSERT(!IN6_IS_ADDR_V4MAPPED((in6_addr_t *)faddr));
6113 6113 connp = ipcl_iptun_classify_v6((in6_addr_t *)faddr,
6114 6114 (in6_addr_t *)laddr, ipst);
6115 6115 }
6116 6116
6117 6117 if (connp == NULL)
6118 6118 return (NULL);
6119 6119
6120 6120 if (IPCL_IS_IPTUN(connp)) {
6121 6121 iptun = connp->conn_iptun;
6122 6122 if (iptun != NULL) {
6123 6123 itp = iptun->iptun_itp;
6124 6124 if (itp != NULL) {
6125 6125 /* Braces due to the macro's nature... */
6126 6126 ITP_REFHOLD(itp);
6127 6127 }
6128 6128 } /* Else itp is already NULL. */
6129 6129 }
6130 6130
6131 6131 CONN_DEC_REF(connp);
6132 6132 return (itp);
6133 6133 }
6134 6134
6135 6135 /*
6136 6136 * Frag cache code, based on SunScreen 3.2 source
6137 6137 * screen/kernel/common/screen_fragcache.c
6138 6138 */
6139 6139
6140 6140 #define IPSEC_FRAG_TTL_MAX 5
6141 6141 /*
6142 6142 * Note that the following parameters create 256 hash buckets
6143 6143 * with 1024 free entries to be distributed. Things are cleaned
6144 6144 * periodically and are attempted to be cleaned when there is no
6145 6145 * free space, but this system errs on the side of dropping packets
6146 6146 * over creating memory exhaustion. We may decide to make hash
6147 6147 * factor a tunable if this proves to be a bad decision.
6148 6148 */
6149 6149 #define IPSEC_FRAG_HASH_SLOTS (1<<8)
6150 6150 #define IPSEC_FRAG_HASH_FACTOR 4
6151 6151 #define IPSEC_FRAG_HASH_SIZE (IPSEC_FRAG_HASH_SLOTS * IPSEC_FRAG_HASH_FACTOR)
6152 6152
6153 6153 #define IPSEC_FRAG_HASH_MASK (IPSEC_FRAG_HASH_SLOTS - 1)
6154 6154 #define IPSEC_FRAG_HASH_FUNC(id) (((id) & IPSEC_FRAG_HASH_MASK) ^ \
6155 6155 (((id) / \
6156 6156 (ushort_t)IPSEC_FRAG_HASH_SLOTS) & \
6157 6157 IPSEC_FRAG_HASH_MASK))
6158 6158
6159 6159 /* Maximum fragments per packet. 48 bytes payload x 1366 packets > 64KB */
6160 6160 #define IPSEC_MAX_FRAGS 1366
6161 6161
6162 6162 #define V4_FRAG_OFFSET(ipha) ((ntohs(ipha->ipha_fragment_offset_and_flags) & \
6163 6163 IPH_OFFSET) << 3)
6164 6164 #define V4_MORE_FRAGS(ipha) (ntohs(ipha->ipha_fragment_offset_and_flags) & \
6165 6165 IPH_MF)
6166 6166
6167 6167 /*
6168 6168 * Initialize an ipsec fragcache instance.
6169 6169 * Returns B_FALSE if memory allocation fails.
6170 6170 */
6171 6171 boolean_t
6172 6172 ipsec_fragcache_init(ipsec_fragcache_t *frag)
6173 6173 {
6174 6174 ipsec_fragcache_entry_t *ftemp;
6175 6175 int i;
6176 6176
6177 6177 mutex_init(&frag->itpf_lock, NULL, MUTEX_DEFAULT, NULL);
6178 6178 frag->itpf_ptr = (ipsec_fragcache_entry_t **)
6179 6179 kmem_zalloc(sizeof (ipsec_fragcache_entry_t *) *
6180 6180 IPSEC_FRAG_HASH_SLOTS, KM_NOSLEEP);
6181 6181 if (frag->itpf_ptr == NULL)
6182 6182 return (B_FALSE);
6183 6183
6184 6184 ftemp = (ipsec_fragcache_entry_t *)
6185 6185 kmem_zalloc(sizeof (ipsec_fragcache_entry_t) *
6186 6186 IPSEC_FRAG_HASH_SIZE, KM_NOSLEEP);
6187 6187 if (ftemp == NULL) {
6188 6188 kmem_free(frag->itpf_ptr, sizeof (ipsec_fragcache_entry_t *) *
6189 6189 IPSEC_FRAG_HASH_SLOTS);
6190 6190 return (B_FALSE);
6191 6191 }
6192 6192
6193 6193 frag->itpf_freelist = NULL;
6194 6194
6195 6195 for (i = 0; i < IPSEC_FRAG_HASH_SIZE; i++) {
6196 6196 ftemp->itpfe_next = frag->itpf_freelist;
6197 6197 frag->itpf_freelist = ftemp;
6198 6198 ftemp++;
6199 6199 }
6200 6200
6201 6201 frag->itpf_expire_hint = 0;
6202 6202
6203 6203 return (B_TRUE);
6204 6204 }
6205 6205
6206 6206 void
6207 6207 ipsec_fragcache_uninit(ipsec_fragcache_t *frag, ipsec_stack_t *ipss)
6208 6208 {
6209 6209 ipsec_fragcache_entry_t *fep;
6210 6210 int i;
6211 6211
6212 6212 mutex_enter(&frag->itpf_lock);
6213 6213 if (frag->itpf_ptr) {
6214 6214 /* Delete any existing fragcache entry chains */
6215 6215 for (i = 0; i < IPSEC_FRAG_HASH_SLOTS; i++) {
6216 6216 fep = (frag->itpf_ptr)[i];
6217 6217 while (fep != NULL) {
6218 6218 /* Returned fep is next in chain or NULL */
6219 6219 fep = fragcache_delentry(i, fep, frag, ipss);
6220 6220 }
6221 6221 }
6222 6222 /*
6223 6223 * Chase the pointers back to the beginning
6224 6224 * of the memory allocation and then
6225 6225 * get rid of the allocated freelist
6226 6226 */
6227 6227 while (frag->itpf_freelist->itpfe_next != NULL)
6228 6228 frag->itpf_freelist = frag->itpf_freelist->itpfe_next;
6229 6229 /*
6230 6230 * XXX - If we ever dynamically grow the freelist
6231 6231 * then we'll have to free entries individually
6232 6232 * or determine how many entries or chunks we have
6233 6233 * grown since the initial allocation.
6234 6234 */
6235 6235 kmem_free(frag->itpf_freelist,
6236 6236 sizeof (ipsec_fragcache_entry_t) *
6237 6237 IPSEC_FRAG_HASH_SIZE);
6238 6238 /* Free the fragcache structure */
6239 6239 kmem_free(frag->itpf_ptr,
6240 6240 sizeof (ipsec_fragcache_entry_t *) *
6241 6241 IPSEC_FRAG_HASH_SLOTS);
6242 6242 }
6243 6243 mutex_exit(&frag->itpf_lock);
6244 6244 mutex_destroy(&frag->itpf_lock);
6245 6245 }
6246 6246
6247 6247 /*
6248 6248 * Add a fragment to the fragment cache. Consumes mp if NULL is returned.
6249 6249 * Returns mp if a whole fragment has been assembled, NULL otherwise
6250 6250 * The returned mp could be a b_next chain of fragments.
6251 6251 *
6252 6252 * The iramp argument is set on inbound; NULL if outbound.
6253 6253 */
6254 6254 mblk_t *
6255 6255 ipsec_fragcache_add(ipsec_fragcache_t *frag, mblk_t *iramp, mblk_t *mp,
6256 6256 int outer_hdr_len, ipsec_stack_t *ipss)
6257 6257 {
6258 6258 boolean_t is_v4;
6259 6259 time_t itpf_time;
6260 6260 ipha_t *iph;
6261 6261 ipha_t *oiph;
6262 6262 ip6_t *ip6h = NULL;
6263 6263 uint8_t v6_proto;
6264 6264 uint8_t *v6_proto_p;
6265 6265 uint16_t ip6_hdr_length;
6266 6266 ip_pkt_t ipp;
6267 6267 ip6_frag_t *fraghdr;
6268 6268 ipsec_fragcache_entry_t *fep;
6269 6269 int i;
6270 6270 mblk_t *nmp, *prevmp;
6271 6271 int firstbyte, lastbyte;
6272 6272 int offset;
6273 6273 int last;
6274 6274 boolean_t inbound = (iramp != NULL);
6275 6275
6276 6276 #ifdef FRAGCACHE_DEBUG
6277 6277 cmn_err(CE_WARN, "Fragcache: %s\n", inbound ? "INBOUND" : "OUTBOUND");
6278 6278 #endif
6279 6279 /*
6280 6280 * You're on the slow path, so insure that every packet in the
6281 6281 * cache is a single-mblk one.
6282 6282 */
6283 6283 if (mp->b_cont != NULL) {
6284 6284 nmp = msgpullup(mp, -1);
6285 6285 if (nmp == NULL) {
6286 6286 ip_drop_packet(mp, inbound, NULL,
6287 6287 DROPPER(ipss, ipds_spd_nomem),
6288 6288 &ipss->ipsec_spd_dropper);
6289 6289 if (inbound)
6290 6290 (void) ip_recv_attr_free_mblk(iramp);
6291 6291 return (NULL);
6292 6292 }
6293 6293 freemsg(mp);
6294 6294 mp = nmp;
6295 6295 }
6296 6296
6297 6297 mutex_enter(&frag->itpf_lock);
6298 6298
6299 6299 oiph = (ipha_t *)mp->b_rptr;
6300 6300 iph = (ipha_t *)(mp->b_rptr + outer_hdr_len);
6301 6301
6302 6302 if (IPH_HDR_VERSION(iph) == IPV4_VERSION) {
6303 6303 is_v4 = B_TRUE;
6304 6304 } else {
6305 6305 ASSERT(IPH_HDR_VERSION(iph) == IPV6_VERSION);
6306 6306 ip6h = (ip6_t *)(mp->b_rptr + outer_hdr_len);
6307 6307
6308 6308 if (!ip_hdr_length_nexthdr_v6(mp, ip6h, &ip6_hdr_length,
6309 6309 &v6_proto_p)) {
6310 6310 /*
6311 6311 * Find upper layer protocol.
6312 6312 * If it fails we have a malformed packet
6313 6313 */
6314 6314 mutex_exit(&frag->itpf_lock);
6315 6315 ip_drop_packet(mp, inbound, NULL,
6316 6316 DROPPER(ipss, ipds_spd_malformed_packet),
6317 6317 &ipss->ipsec_spd_dropper);
6318 6318 if (inbound)
6319 6319 (void) ip_recv_attr_free_mblk(iramp);
6320 6320 return (NULL);
6321 6321 } else {
6322 6322 v6_proto = *v6_proto_p;
6323 6323 }
6324 6324
6325 6325
6326 6326 bzero(&ipp, sizeof (ipp));
6327 6327 (void) ip_find_hdr_v6(mp, ip6h, B_FALSE, &ipp, NULL);
6328 6328 if (!(ipp.ipp_fields & IPPF_FRAGHDR)) {
6329 6329 /*
6330 6330 * We think this is a fragment, but didn't find
6331 6331 * a fragment header. Something is wrong.
6332 6332 */
6333 6333 mutex_exit(&frag->itpf_lock);
6334 6334 ip_drop_packet(mp, inbound, NULL,
6335 6335 DROPPER(ipss, ipds_spd_malformed_frag),
6336 6336 &ipss->ipsec_spd_dropper);
6337 6337 if (inbound)
6338 6338 (void) ip_recv_attr_free_mblk(iramp);
6339 6339 return (NULL);
6340 6340 }
6341 6341 fraghdr = ipp.ipp_fraghdr;
6342 6342 is_v4 = B_FALSE;
6343 6343 }
6344 6344
6345 6345 /* Anything to cleanup? */
6346 6346
6347 6347 /*
6348 6348 * This cleanup call could be put in a timer loop
6349 6349 * but it may actually be just as reasonable a decision to
6350 6350 * leave it here. The disadvantage is this only gets called when
6351 6351 * frags are added. The advantage is that it is not
6352 6352 * susceptible to race conditions like a time-based cleanup
6353 6353 * may be.
6354 6354 */
6355 6355 itpf_time = gethrestime_sec();
6356 6356 if (itpf_time >= frag->itpf_expire_hint)
6357 6357 ipsec_fragcache_clean(frag, ipss);
6358 6358
6359 6359 /* Lookup to see if there is an existing entry */
6360 6360
6361 6361 if (is_v4)
6362 6362 i = IPSEC_FRAG_HASH_FUNC(iph->ipha_ident);
6363 6363 else
6364 6364 i = IPSEC_FRAG_HASH_FUNC(fraghdr->ip6f_ident);
6365 6365
6366 6366 for (fep = (frag->itpf_ptr)[i]; fep; fep = fep->itpfe_next) {
6367 6367 if (is_v4) {
6368 6368 ASSERT(iph != NULL);
6369 6369 if ((fep->itpfe_id == iph->ipha_ident) &&
6370 6370 (fep->itpfe_src == iph->ipha_src) &&
6371 6371 (fep->itpfe_dst == iph->ipha_dst) &&
6372 6372 (fep->itpfe_proto == iph->ipha_protocol))
6373 6373 break;
6374 6374 } else {
6375 6375 ASSERT(fraghdr != NULL);
6376 6376 ASSERT(fep != NULL);
6377 6377 if ((fep->itpfe_id == fraghdr->ip6f_ident) &&
6378 6378 IN6_ARE_ADDR_EQUAL(&fep->itpfe_src6,
6379 6379 &ip6h->ip6_src) &&
6380 6380 IN6_ARE_ADDR_EQUAL(&fep->itpfe_dst6,
6381 6381 &ip6h->ip6_dst) && (fep->itpfe_proto == v6_proto))
6382 6382 break;
6383 6383 }
6384 6384 }
6385 6385
6386 6386 if (is_v4) {
6387 6387 firstbyte = V4_FRAG_OFFSET(iph);
6388 6388 lastbyte = firstbyte + ntohs(iph->ipha_length) -
6389 6389 IPH_HDR_LENGTH(iph);
6390 6390 last = (V4_MORE_FRAGS(iph) == 0);
6391 6391 #ifdef FRAGCACHE_DEBUG
6392 6392 cmn_err(CE_WARN, "V4 fragcache: firstbyte = %d, lastbyte = %d, "
6393 6393 "is_last_frag = %d, id = %d, mp = %p\n", firstbyte,
6394 6394 lastbyte, last, iph->ipha_ident, mp);
6395 6395 #endif
6396 6396 } else {
6397 6397 firstbyte = ntohs(fraghdr->ip6f_offlg & IP6F_OFF_MASK);
6398 6398 lastbyte = firstbyte + ntohs(ip6h->ip6_plen) +
6399 6399 sizeof (ip6_t) - ip6_hdr_length;
6400 6400 last = (fraghdr->ip6f_offlg & IP6F_MORE_FRAG) == 0;
6401 6401 #ifdef FRAGCACHE_DEBUG
6402 6402 cmn_err(CE_WARN, "V6 fragcache: firstbyte = %d, lastbyte = %d, "
6403 6403 "is_last_frag = %d, id = %d, fraghdr = %p, mp = %p\n",
6404 6404 firstbyte, lastbyte, last, fraghdr->ip6f_ident, fraghdr,
6405 6405 mp);
6406 6406 #endif
6407 6407 }
6408 6408
6409 6409 /* check for bogus fragments and delete the entry */
6410 6410 if (firstbyte > 0 && firstbyte <= 8) {
6411 6411 if (fep != NULL)
6412 6412 (void) fragcache_delentry(i, fep, frag, ipss);
6413 6413 mutex_exit(&frag->itpf_lock);
6414 6414 ip_drop_packet(mp, inbound, NULL,
6415 6415 DROPPER(ipss, ipds_spd_malformed_frag),
6416 6416 &ipss->ipsec_spd_dropper);
6417 6417 if (inbound)
6418 6418 (void) ip_recv_attr_free_mblk(iramp);
6419 6419 return (NULL);
6420 6420 }
6421 6421
6422 6422 /* Not found, allocate a new entry */
6423 6423 if (fep == NULL) {
6424 6424 if (frag->itpf_freelist == NULL) {
6425 6425 /* see if there is some space */
6426 6426 ipsec_fragcache_clean(frag, ipss);
6427 6427 if (frag->itpf_freelist == NULL) {
6428 6428 mutex_exit(&frag->itpf_lock);
6429 6429 ip_drop_packet(mp, inbound, NULL,
6430 6430 DROPPER(ipss, ipds_spd_nomem),
6431 6431 &ipss->ipsec_spd_dropper);
6432 6432 if (inbound)
6433 6433 (void) ip_recv_attr_free_mblk(iramp);
6434 6434 return (NULL);
6435 6435 }
6436 6436 }
6437 6437
6438 6438 fep = frag->itpf_freelist;
6439 6439 frag->itpf_freelist = fep->itpfe_next;
6440 6440
6441 6441 if (is_v4) {
6442 6442 bcopy((caddr_t)&iph->ipha_src, (caddr_t)&fep->itpfe_src,
6443 6443 sizeof (struct in_addr));
6444 6444 bcopy((caddr_t)&iph->ipha_dst, (caddr_t)&fep->itpfe_dst,
6445 6445 sizeof (struct in_addr));
6446 6446 fep->itpfe_id = iph->ipha_ident;
6447 6447 fep->itpfe_proto = iph->ipha_protocol;
6448 6448 i = IPSEC_FRAG_HASH_FUNC(fep->itpfe_id);
6449 6449 } else {
6450 6450 bcopy((in6_addr_t *)&ip6h->ip6_src,
6451 6451 (in6_addr_t *)&fep->itpfe_src6,
6452 6452 sizeof (struct in6_addr));
6453 6453 bcopy((in6_addr_t *)&ip6h->ip6_dst,
6454 6454 (in6_addr_t *)&fep->itpfe_dst6,
6455 6455 sizeof (struct in6_addr));
6456 6456 fep->itpfe_id = fraghdr->ip6f_ident;
6457 6457 fep->itpfe_proto = v6_proto;
6458 6458 i = IPSEC_FRAG_HASH_FUNC(fep->itpfe_id);
6459 6459 }
6460 6460 itpf_time = gethrestime_sec();
6461 6461 fep->itpfe_exp = itpf_time + IPSEC_FRAG_TTL_MAX + 1;
6462 6462 fep->itpfe_last = 0;
6463 6463 fep->itpfe_fraglist = NULL;
6464 6464 fep->itpfe_depth = 0;
6465 6465 fep->itpfe_next = (frag->itpf_ptr)[i];
6466 6466 (frag->itpf_ptr)[i] = fep;
6467 6467
6468 6468 if (frag->itpf_expire_hint > fep->itpfe_exp)
6469 6469 frag->itpf_expire_hint = fep->itpfe_exp;
6470 6470
6471 6471 }
6472 6472
6473 6473 /* Insert it in the frag list */
6474 6474 /* List is in order by starting offset of fragments */
6475 6475
6476 6476 prevmp = NULL;
6477 6477 for (nmp = fep->itpfe_fraglist; nmp; nmp = nmp->b_next) {
6478 6478 ipha_t *niph;
6479 6479 ipha_t *oniph;
6480 6480 ip6_t *nip6h;
6481 6481 ip_pkt_t nipp;
6482 6482 ip6_frag_t *nfraghdr;
6483 6483 uint16_t nip6_hdr_length;
6484 6484 uint8_t *nv6_proto_p;
6485 6485 int nfirstbyte, nlastbyte;
6486 6486 char *data, *ndata;
6487 6487 mblk_t *ndata_mp = (inbound ? nmp->b_cont : nmp);
6488 6488 int hdr_len;
6489 6489
6490 6490 oniph = (ipha_t *)mp->b_rptr;
6491 6491 nip6h = NULL;
6492 6492 niph = NULL;
6493 6493
6494 6494 /*
6495 6495 * Determine outer header type and length and set
6496 6496 * pointers appropriately
6497 6497 */
6498 6498
6499 6499 if (IPH_HDR_VERSION(oniph) == IPV4_VERSION) {
6500 6500 hdr_len = ((outer_hdr_len != 0) ?
6501 6501 IPH_HDR_LENGTH(oiph) : 0);
6502 6502 niph = (ipha_t *)(ndata_mp->b_rptr + hdr_len);
6503 6503 } else {
6504 6504 ASSERT(IPH_HDR_VERSION(oniph) == IPV6_VERSION);
6505 6505 ASSERT(ndata_mp->b_cont == NULL);
6506 6506 nip6h = (ip6_t *)ndata_mp->b_rptr;
6507 6507 (void) ip_hdr_length_nexthdr_v6(ndata_mp, nip6h,
6508 6508 &nip6_hdr_length, &v6_proto_p);
6509 6509 hdr_len = ((outer_hdr_len != 0) ? nip6_hdr_length : 0);
6510 6510 }
6511 6511
6512 6512 /*
6513 6513 * Determine inner header type and length and set
6514 6514 * pointers appropriately
6515 6515 */
6516 6516
6517 6517 if (is_v4) {
6518 6518 if (niph == NULL) {
6519 6519 /* Was v6 outer */
6520 6520 niph = (ipha_t *)(ndata_mp->b_rptr + hdr_len);
6521 6521 }
6522 6522 nfirstbyte = V4_FRAG_OFFSET(niph);
6523 6523 nlastbyte = nfirstbyte + ntohs(niph->ipha_length) -
6524 6524 IPH_HDR_LENGTH(niph);
6525 6525 } else {
6526 6526 ASSERT(ndata_mp->b_cont == NULL);
6527 6527 nip6h = (ip6_t *)(ndata_mp->b_rptr + hdr_len);
6528 6528 if (!ip_hdr_length_nexthdr_v6(ndata_mp, nip6h,
6529 6529 &nip6_hdr_length, &nv6_proto_p)) {
6530 6530 mutex_exit(&frag->itpf_lock);
6531 6531 ip_drop_packet_chain(nmp, inbound, NULL,
6532 6532 DROPPER(ipss, ipds_spd_malformed_frag),
6533 6533 &ipss->ipsec_spd_dropper);
6534 6534 ipsec_freemsg_chain(ndata_mp);
6535 6535 if (inbound)
6536 6536 (void) ip_recv_attr_free_mblk(iramp);
6537 6537 return (NULL);
6538 6538 }
6539 6539 bzero(&nipp, sizeof (nipp));
6540 6540 (void) ip_find_hdr_v6(ndata_mp, nip6h, B_FALSE, &nipp,
6541 6541 NULL);
6542 6542 nfraghdr = nipp.ipp_fraghdr;
6543 6543 nfirstbyte = ntohs(nfraghdr->ip6f_offlg &
6544 6544 IP6F_OFF_MASK);
6545 6545 nlastbyte = nfirstbyte + ntohs(nip6h->ip6_plen) +
6546 6546 sizeof (ip6_t) - nip6_hdr_length;
6547 6547 }
6548 6548
6549 6549 /* Check for overlapping fragments */
6550 6550 if (firstbyte >= nfirstbyte && firstbyte < nlastbyte) {
6551 6551 /*
6552 6552 * Overlap Check:
6553 6553 * ~~~~--------- # Check if the newly
6554 6554 * ~ ndata_mp| # received fragment
6555 6555 * ~~~~--------- # overlaps with the
6556 6556 * ---------~~~~~~ # current fragment.
6557 6557 * | mp ~
6558 6558 * ---------~~~~~~
6559 6559 */
6560 6560 if (is_v4) {
6561 6561 data = (char *)iph + IPH_HDR_LENGTH(iph) +
6562 6562 firstbyte - nfirstbyte;
6563 6563 ndata = (char *)niph + IPH_HDR_LENGTH(niph);
6564 6564 } else {
6565 6565 data = (char *)ip6h +
6566 6566 nip6_hdr_length + firstbyte -
6567 6567 nfirstbyte;
6568 6568 ndata = (char *)nip6h + nip6_hdr_length;
6569 6569 }
6570 6570 if (bcmp(data, ndata, MIN(lastbyte, nlastbyte) -
6571 6571 firstbyte)) {
6572 6572 /* Overlapping data does not match */
6573 6573 (void) fragcache_delentry(i, fep, frag, ipss);
6574 6574 mutex_exit(&frag->itpf_lock);
6575 6575 ip_drop_packet(mp, inbound, NULL,
6576 6576 DROPPER(ipss, ipds_spd_overlap_frag),
6577 6577 &ipss->ipsec_spd_dropper);
6578 6578 if (inbound)
6579 6579 (void) ip_recv_attr_free_mblk(iramp);
6580 6580 return (NULL);
6581 6581 }
6582 6582 /* Part of defense for jolt2.c fragmentation attack */
6583 6583 if (firstbyte >= nfirstbyte && lastbyte <= nlastbyte) {
6584 6584 /*
6585 6585 * Check for identical or subset fragments:
6586 6586 * ---------- ~~~~--------~~~~~
6587 6587 * | nmp | or ~ nmp ~
6588 6588 * ---------- ~~~~--------~~~~~
6589 6589 * ---------- ------
6590 6590 * | mp | | mp |
6591 6591 * ---------- ------
6592 6592 */
6593 6593 mutex_exit(&frag->itpf_lock);
6594 6594 ip_drop_packet(mp, inbound, NULL,
6595 6595 DROPPER(ipss, ipds_spd_evil_frag),
6596 6596 &ipss->ipsec_spd_dropper);
6597 6597 if (inbound)
6598 6598 (void) ip_recv_attr_free_mblk(iramp);
6599 6599 return (NULL);
6600 6600 }
6601 6601
6602 6602 }
6603 6603
6604 6604 /* Correct location for this fragment? */
6605 6605 if (firstbyte <= nfirstbyte) {
6606 6606 /*
6607 6607 * Check if the tail end of the new fragment overlaps
6608 6608 * with the head of the current fragment.
6609 6609 * --------~~~~~~~
6610 6610 * | nmp ~
6611 6611 * --------~~~~~~~
6612 6612 * ~~~~~--------
6613 6613 * ~ mp |
6614 6614 * ~~~~~--------
6615 6615 */
6616 6616 if (lastbyte > nfirstbyte) {
6617 6617 /* Fragments overlap */
6618 6618 data = (char *)iph + IPH_HDR_LENGTH(iph) +
6619 6619 firstbyte - nfirstbyte;
6620 6620 ndata = (char *)niph + IPH_HDR_LENGTH(niph);
6621 6621 if (is_v4) {
6622 6622 data = (char *)iph +
6623 6623 IPH_HDR_LENGTH(iph) + firstbyte -
6624 6624 nfirstbyte;
6625 6625 ndata = (char *)niph +
6626 6626 IPH_HDR_LENGTH(niph);
6627 6627 } else {
6628 6628 data = (char *)ip6h +
6629 6629 nip6_hdr_length + firstbyte -
6630 6630 nfirstbyte;
6631 6631 ndata = (char *)nip6h + nip6_hdr_length;
6632 6632 }
6633 6633 if (bcmp(data, ndata, MIN(lastbyte, nlastbyte)
6634 6634 - nfirstbyte)) {
6635 6635 /* Overlap mismatch */
6636 6636 (void) fragcache_delentry(i, fep, frag,
6637 6637 ipss);
6638 6638 mutex_exit(&frag->itpf_lock);
6639 6639 ip_drop_packet(mp, inbound, NULL,
6640 6640 DROPPER(ipss,
6641 6641 ipds_spd_overlap_frag),
6642 6642 &ipss->ipsec_spd_dropper);
6643 6643 if (inbound) {
6644 6644 (void) ip_recv_attr_free_mblk(
6645 6645 iramp);
6646 6646 }
6647 6647 return (NULL);
6648 6648 }
6649 6649 }
6650 6650
6651 6651 /*
6652 6652 * Fragment does not illegally overlap and can now
6653 6653 * be inserted into the chain
6654 6654 */
6655 6655 break;
6656 6656 }
6657 6657
6658 6658 prevmp = nmp;
6659 6659 }
6660 6660 /* Prepend the attributes before we link it in */
6661 6661 if (iramp != NULL) {
6662 6662 ASSERT(iramp->b_cont == NULL);
6663 6663 iramp->b_cont = mp;
6664 6664 mp = iramp;
6665 6665 iramp = NULL;
6666 6666 }
6667 6667 mp->b_next = nmp;
6668 6668
6669 6669 if (prevmp == NULL) {
6670 6670 fep->itpfe_fraglist = mp;
6671 6671 } else {
6672 6672 prevmp->b_next = mp;
6673 6673 }
6674 6674 if (last)
6675 6675 fep->itpfe_last = 1;
6676 6676
6677 6677 /* Part of defense for jolt2.c fragmentation attack */
6678 6678 if (++(fep->itpfe_depth) > IPSEC_MAX_FRAGS) {
6679 6679 (void) fragcache_delentry(i, fep, frag, ipss);
6680 6680 mutex_exit(&frag->itpf_lock);
6681 6681 if (inbound)
6682 6682 mp = ip_recv_attr_free_mblk(mp);
6683 6683
6684 6684 ip_drop_packet(mp, inbound, NULL,
6685 6685 DROPPER(ipss, ipds_spd_max_frags),
6686 6686 &ipss->ipsec_spd_dropper);
6687 6687 return (NULL);
6688 6688 }
6689 6689
6690 6690 /* Check for complete packet */
6691 6691
6692 6692 if (!fep->itpfe_last) {
6693 6693 mutex_exit(&frag->itpf_lock);
6694 6694 #ifdef FRAGCACHE_DEBUG
6695 6695 cmn_err(CE_WARN, "Fragment cached, last not yet seen.\n");
6696 6696 #endif
6697 6697 return (NULL);
6698 6698 }
6699 6699
6700 6700 offset = 0;
6701 6701 for (mp = fep->itpfe_fraglist; mp; mp = mp->b_next) {
6702 6702 mblk_t *data_mp = (inbound ? mp->b_cont : mp);
6703 6703 int hdr_len;
6704 6704
6705 6705 oiph = (ipha_t *)data_mp->b_rptr;
6706 6706 ip6h = NULL;
6707 6707 iph = NULL;
6708 6708
6709 6709 if (IPH_HDR_VERSION(oiph) == IPV4_VERSION) {
6710 6710 hdr_len = ((outer_hdr_len != 0) ?
6711 6711 IPH_HDR_LENGTH(oiph) : 0);
6712 6712 iph = (ipha_t *)(data_mp->b_rptr + hdr_len);
6713 6713 } else {
6714 6714 ASSERT(IPH_HDR_VERSION(oiph) == IPV6_VERSION);
6715 6715 ASSERT(data_mp->b_cont == NULL);
6716 6716 ip6h = (ip6_t *)data_mp->b_rptr;
6717 6717 (void) ip_hdr_length_nexthdr_v6(data_mp, ip6h,
6718 6718 &ip6_hdr_length, &v6_proto_p);
6719 6719 hdr_len = ((outer_hdr_len != 0) ? ip6_hdr_length : 0);
6720 6720 }
6721 6721
6722 6722 /* Calculate current fragment start/end */
6723 6723 if (is_v4) {
6724 6724 if (iph == NULL) {
6725 6725 /* Was v6 outer */
6726 6726 iph = (ipha_t *)(data_mp->b_rptr + hdr_len);
6727 6727 }
6728 6728 firstbyte = V4_FRAG_OFFSET(iph);
6729 6729 lastbyte = firstbyte + ntohs(iph->ipha_length) -
6730 6730 IPH_HDR_LENGTH(iph);
6731 6731 } else {
6732 6732 ASSERT(data_mp->b_cont == NULL);
6733 6733 ip6h = (ip6_t *)(data_mp->b_rptr + hdr_len);
6734 6734 if (!ip_hdr_length_nexthdr_v6(data_mp, ip6h,
6735 6735 &ip6_hdr_length, &v6_proto_p)) {
6736 6736 mutex_exit(&frag->itpf_lock);
6737 6737 ip_drop_packet_chain(mp, inbound, NULL,
6738 6738 DROPPER(ipss, ipds_spd_malformed_frag),
6739 6739 &ipss->ipsec_spd_dropper);
6740 6740 return (NULL);
6741 6741 }
6742 6742 v6_proto = *v6_proto_p;
6743 6743 bzero(&ipp, sizeof (ipp));
6744 6744 (void) ip_find_hdr_v6(data_mp, ip6h, B_FALSE, &ipp,
6745 6745 NULL);
6746 6746 fraghdr = ipp.ipp_fraghdr;
6747 6747 firstbyte = ntohs(fraghdr->ip6f_offlg &
6748 6748 IP6F_OFF_MASK);
6749 6749 lastbyte = firstbyte + ntohs(ip6h->ip6_plen) +
6750 6750 sizeof (ip6_t) - ip6_hdr_length;
6751 6751 }
6752 6752
6753 6753 /*
6754 6754 * If this fragment is greater than current offset,
6755 6755 * we have a missing fragment so return NULL
6756 6756 */
6757 6757 if (firstbyte > offset) {
6758 6758 mutex_exit(&frag->itpf_lock);
6759 6759 #ifdef FRAGCACHE_DEBUG
6760 6760 /*
6761 6761 * Note, this can happen when the last frag
6762 6762 * gets sent through because it is smaller
6763 6763 * than the MTU. It is not necessarily an
6764 6764 * error condition.
6765 6765 */
6766 6766 cmn_err(CE_WARN, "Frag greater than offset! : "
6767 6767 "missing fragment: firstbyte = %d, offset = %d, "
6768 6768 "mp = %p\n", firstbyte, offset, mp);
6769 6769 #endif
6770 6770 return (NULL);
6771 6771 }
6772 6772 #ifdef FRAGCACHE_DEBUG
6773 6773 cmn_err(CE_WARN, "Frag offsets : "
6774 6774 "firstbyte = %d, offset = %d, mp = %p\n",
6775 6775 firstbyte, offset, mp);
6776 6776 #endif
6777 6777
6778 6778 /*
6779 6779 * If we are at the last fragment, we have the complete
6780 6780 * packet, so rechain things and return it to caller
6781 6781 * for processing
6782 6782 */
6783 6783
6784 6784 if ((is_v4 && !V4_MORE_FRAGS(iph)) ||
6785 6785 (!is_v4 && !(fraghdr->ip6f_offlg & IP6F_MORE_FRAG))) {
6786 6786 mp = fep->itpfe_fraglist;
6787 6787 fep->itpfe_fraglist = NULL;
6788 6788 (void) fragcache_delentry(i, fep, frag, ipss);
6789 6789 mutex_exit(&frag->itpf_lock);
6790 6790
6791 6791 if ((is_v4 && (firstbyte + ntohs(iph->ipha_length) >
6792 6792 65535)) || (!is_v4 && (firstbyte +
6793 6793 ntohs(ip6h->ip6_plen) > 65535))) {
6794 6794 /* It is an invalid "ping-o-death" packet */
6795 6795 /* Discard it */
6796 6796 ip_drop_packet_chain(mp, inbound, NULL,
6797 6797 DROPPER(ipss, ipds_spd_evil_frag),
6798 6798 &ipss->ipsec_spd_dropper);
6799 6799 return (NULL);
6800 6800 }
6801 6801 #ifdef FRAGCACHE_DEBUG
6802 6802 cmn_err(CE_WARN, "Fragcache returning mp = %p, "
6803 6803 "mp->b_next = %p", mp, mp->b_next);
6804 6804 #endif
6805 6805 /*
6806 6806 * For inbound case, mp has attrmp b_next'd chain
6807 6807 * For outbound case, it is just data mp chain
6808 6808 */
6809 6809 return (mp);
6810 6810 }
6811 6811
6812 6812 /*
6813 6813 * Update new ending offset if this
6814 6814 * fragment extends the packet
6815 6815 */
6816 6816 if (offset < lastbyte)
6817 6817 offset = lastbyte;
6818 6818 }
6819 6819
6820 6820 mutex_exit(&frag->itpf_lock);
6821 6821
6822 6822 /* Didn't find last fragment, so return NULL */
6823 6823 return (NULL);
6824 6824 }
6825 6825
6826 6826 static void
6827 6827 ipsec_fragcache_clean(ipsec_fragcache_t *frag, ipsec_stack_t *ipss)
6828 6828 {
6829 6829 ipsec_fragcache_entry_t *fep;
6830 6830 int i;
6831 6831 ipsec_fragcache_entry_t *earlyfep = NULL;
6832 6832 time_t itpf_time;
6833 6833 int earlyexp;
6834 6834 int earlyi = 0;
6835 6835
6836 6836 ASSERT(MUTEX_HELD(&frag->itpf_lock));
6837 6837
6838 6838 itpf_time = gethrestime_sec();
6839 6839 earlyexp = itpf_time + 10000;
6840 6840
6841 6841 for (i = 0; i < IPSEC_FRAG_HASH_SLOTS; i++) {
6842 6842 fep = (frag->itpf_ptr)[i];
6843 6843 while (fep) {
6844 6844 if (fep->itpfe_exp < itpf_time) {
6845 6845 /* found */
6846 6846 fep = fragcache_delentry(i, fep, frag, ipss);
6847 6847 } else {
6848 6848 if (fep->itpfe_exp < earlyexp) {
6849 6849 earlyfep = fep;
6850 6850 earlyexp = fep->itpfe_exp;
6851 6851 earlyi = i;
6852 6852 }
6853 6853 fep = fep->itpfe_next;
6854 6854 }
6855 6855 }
6856 6856 }
6857 6857
6858 6858 frag->itpf_expire_hint = earlyexp;
6859 6859
6860 6860 /* if (!found) */
6861 6861 if (frag->itpf_freelist == NULL)
6862 6862 (void) fragcache_delentry(earlyi, earlyfep, frag, ipss);
6863 6863 }
6864 6864
6865 6865 static ipsec_fragcache_entry_t *
6866 6866 fragcache_delentry(int slot, ipsec_fragcache_entry_t *fep,
6867 6867 ipsec_fragcache_t *frag, ipsec_stack_t *ipss)
6868 6868 {
6869 6869 ipsec_fragcache_entry_t *targp;
6870 6870 ipsec_fragcache_entry_t *nextp = fep->itpfe_next;
6871 6871
6872 6872 ASSERT(MUTEX_HELD(&frag->itpf_lock));
6873 6873
6874 6874 /* Free up any fragment list still in cache entry */
6875 6875 if (fep->itpfe_fraglist != NULL) {
6876 6876 ip_drop_packet_chain(fep->itpfe_fraglist,
6877 6877 ip_recv_attr_is_mblk(fep->itpfe_fraglist), NULL,
6878 6878 DROPPER(ipss, ipds_spd_expired_frags),
6879 6879 &ipss->ipsec_spd_dropper);
6880 6880 }
6881 6881 fep->itpfe_fraglist = NULL;
6882 6882
6883 6883 targp = (frag->itpf_ptr)[slot];
6884 6884 ASSERT(targp != 0);
6885 6885
6886 6886 if (targp == fep) {
6887 6887 /* unlink from head of hash chain */
6888 6888 (frag->itpf_ptr)[slot] = nextp;
6889 6889 /* link into free list */
6890 6890 fep->itpfe_next = frag->itpf_freelist;
6891 6891 frag->itpf_freelist = fep;
6892 6892 return (nextp);
6893 6893 }
6894 6894
6895 6895 /* maybe should use double linked list to make update faster */
6896 6896 /* must be past front of chain */
6897 6897 while (targp) {
6898 6898 if (targp->itpfe_next == fep) {
6899 6899 /* unlink from hash chain */
6900 6900 targp->itpfe_next = nextp;
6901 6901 /* link into free list */
6902 6902 fep->itpfe_next = frag->itpf_freelist;
6903 6903 frag->itpf_freelist = fep;
6904 6904 return (nextp);
6905 6905 }
6906 6906 targp = targp->itpfe_next;
6907 6907 ASSERT(targp != 0);
6908 6908 }
6909 6909 /* NOTREACHED */
6910 6910 return (NULL);
6911 6911 }
|
↓ open down ↓ |
3635 lines elided |
↑ open up ↑ |
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX