Print this page
6141 use kmem_zalloc instead of kmem_alloc + bzero/memset
| Split |
Close |
| Expand all |
| Collapse all |
--- old/usr/src/uts/common/inet/ip/spd.c
+++ new/usr/src/uts/common/inet/ip/spd.c
1 1 /*
2 2 * CDDL HEADER START
3 3 *
4 4 * The contents of this file are subject to the terms of the
5 5 * Common Development and Distribution License (the "License").
6 6 * You may not use this file except in compliance with the License.
7 7 *
8 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 9 * or http://www.opensolaris.org/os/licensing.
10 10 * See the License for the specific language governing permissions
11 11 * and limitations under the License.
12 12 *
13 13 * When distributing Covered Code, include this CDDL HEADER in each
14 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 15 * If applicable, add the following below this CDDL HEADER, with the
16 16 * fields enclosed by brackets "[]" replaced with your own identifying
17 17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 18 *
19 19 * CDDL HEADER END
20 20 */
21 21 /*
22 22 * Copyright 2010 Sun Microsystems, Inc. All rights reserved.
23 23 * Use is subject to license terms.
24 24 */
25 25
26 26 /*
27 27 * IPsec Security Policy Database.
28 28 *
29 29 * This module maintains the SPD and provides routines used by ip and ip6
30 30 * to apply IPsec policy to inbound and outbound datagrams.
31 31 */
32 32
33 33 #include <sys/types.h>
34 34 #include <sys/stream.h>
35 35 #include <sys/stropts.h>
36 36 #include <sys/sysmacros.h>
37 37 #include <sys/strsubr.h>
38 38 #include <sys/strsun.h>
39 39 #include <sys/strlog.h>
40 40 #include <sys/strsun.h>
41 41 #include <sys/cmn_err.h>
42 42 #include <sys/zone.h>
43 43
44 44 #include <sys/systm.h>
45 45 #include <sys/param.h>
46 46 #include <sys/kmem.h>
47 47 #include <sys/ddi.h>
48 48
49 49 #include <sys/crypto/api.h>
50 50
51 51 #include <inet/common.h>
52 52 #include <inet/mi.h>
53 53
54 54 #include <netinet/ip6.h>
55 55 #include <netinet/icmp6.h>
56 56 #include <netinet/udp.h>
57 57
58 58 #include <inet/ip.h>
59 59 #include <inet/ip6.h>
60 60
61 61 #include <net/pfkeyv2.h>
62 62 #include <net/pfpolicy.h>
63 63 #include <inet/sadb.h>
64 64 #include <inet/ipsec_impl.h>
65 65
66 66 #include <inet/ip_impl.h> /* For IP_MOD_ID */
67 67
68 68 #include <inet/ipsecah.h>
69 69 #include <inet/ipsecesp.h>
70 70 #include <inet/ipdrop.h>
71 71 #include <inet/ipclassifier.h>
72 72 #include <inet/iptun.h>
73 73 #include <inet/iptun/iptun_impl.h>
74 74
75 75 static void ipsec_update_present_flags(ipsec_stack_t *);
76 76 static ipsec_act_t *ipsec_act_wildcard_expand(ipsec_act_t *, uint_t *,
77 77 netstack_t *);
78 78 static mblk_t *ipsec_check_ipsecin_policy(mblk_t *, ipsec_policy_t *,
79 79 ipha_t *, ip6_t *, uint64_t, ip_recv_attr_t *, netstack_t *);
80 80 static void ipsec_action_free_table(ipsec_action_t *);
81 81 static void ipsec_action_reclaim(void *);
82 82 static void ipsec_action_reclaim_stack(ipsec_stack_t *);
83 83 static void ipsid_init(netstack_t *);
84 84 static void ipsid_fini(netstack_t *);
85 85
86 86 /* sel_flags values for ipsec_init_inbound_sel(). */
87 87 #define SEL_NONE 0x0000
88 88 #define SEL_PORT_POLICY 0x0001
89 89 #define SEL_IS_ICMP 0x0002
90 90 #define SEL_TUNNEL_MODE 0x0004
91 91 #define SEL_POST_FRAG 0x0008
92 92
93 93 /* Return values for ipsec_init_inbound_sel(). */
94 94 typedef enum { SELRET_NOMEM, SELRET_BADPKT, SELRET_SUCCESS, SELRET_TUNFRAG}
95 95 selret_t;
96 96
97 97 static selret_t ipsec_init_inbound_sel(ipsec_selector_t *, mblk_t *,
98 98 ipha_t *, ip6_t *, uint8_t);
99 99
100 100 static boolean_t ipsec_check_ipsecin_action(ip_recv_attr_t *, mblk_t *,
101 101 struct ipsec_action_s *, ipha_t *ipha, ip6_t *ip6h, const char **,
102 102 kstat_named_t **, netstack_t *);
103 103 static void ipsec_unregister_prov_update(void);
104 104 static void ipsec_prov_update_callback_stack(uint32_t, void *, netstack_t *);
105 105 static boolean_t ipsec_compare_action(ipsec_policy_t *, ipsec_policy_t *);
106 106 static uint32_t selector_hash(ipsec_selector_t *, ipsec_policy_root_t *);
107 107 static boolean_t ipsec_kstat_init(ipsec_stack_t *);
108 108 static void ipsec_kstat_destroy(ipsec_stack_t *);
109 109 static int ipsec_free_tables(ipsec_stack_t *);
110 110 static int tunnel_compare(const void *, const void *);
111 111 static void ipsec_freemsg_chain(mblk_t *);
112 112 static void ip_drop_packet_chain(mblk_t *, boolean_t, ill_t *,
113 113 struct kstat_named *, ipdropper_t *);
114 114 static boolean_t ipsec_kstat_init(ipsec_stack_t *);
115 115 static void ipsec_kstat_destroy(ipsec_stack_t *);
116 116 static int ipsec_free_tables(ipsec_stack_t *);
117 117 static int tunnel_compare(const void *, const void *);
118 118 static void ipsec_freemsg_chain(mblk_t *);
119 119
120 120 /*
121 121 * Selector hash table is statically sized at module load time.
122 122 * we default to 251 buckets, which is the largest prime number under 255
123 123 */
124 124
125 125 #define IPSEC_SPDHASH_DEFAULT 251
126 126
127 127 /* SPD hash-size tunable per tunnel. */
128 128 #define TUN_SPDHASH_DEFAULT 5
129 129
130 130 uint32_t ipsec_spd_hashsize;
131 131 uint32_t tun_spd_hashsize;
132 132
133 133 #define IPSEC_SEL_NOHASH ((uint32_t)(~0))
134 134
135 135 /*
136 136 * Handle global across all stack instances
137 137 */
138 138 static crypto_notify_handle_t prov_update_handle = NULL;
139 139
140 140 static kmem_cache_t *ipsec_action_cache;
141 141 static kmem_cache_t *ipsec_sel_cache;
142 142 static kmem_cache_t *ipsec_pol_cache;
143 143
144 144 /* Frag cache prototypes */
145 145 static void ipsec_fragcache_clean(ipsec_fragcache_t *, ipsec_stack_t *);
146 146 static ipsec_fragcache_entry_t *fragcache_delentry(int,
147 147 ipsec_fragcache_entry_t *, ipsec_fragcache_t *, ipsec_stack_t *);
148 148 boolean_t ipsec_fragcache_init(ipsec_fragcache_t *);
149 149 void ipsec_fragcache_uninit(ipsec_fragcache_t *, ipsec_stack_t *ipss);
150 150 mblk_t *ipsec_fragcache_add(ipsec_fragcache_t *, mblk_t *, mblk_t *,
151 151 int, ipsec_stack_t *);
152 152
153 153 int ipsec_hdr_pullup_needed = 0;
154 154 int ipsec_weird_null_inbound_policy = 0;
155 155
156 156 #define ALGBITS_ROUND_DOWN(x, align) (((x)/(align))*(align))
157 157 #define ALGBITS_ROUND_UP(x, align) ALGBITS_ROUND_DOWN((x)+(align)-1, align)
158 158
159 159 /*
160 160 * Inbound traffic should have matching identities for both SA's.
161 161 */
162 162
163 163 #define SA_IDS_MATCH(sa1, sa2) \
164 164 (((sa1) == NULL) || ((sa2) == NULL) || \
165 165 (((sa1)->ipsa_src_cid == (sa2)->ipsa_src_cid) && \
166 166 (((sa1)->ipsa_dst_cid == (sa2)->ipsa_dst_cid))))
167 167
168 168 /*
169 169 * IPv6 Fragments
170 170 */
171 171 #define IS_V6_FRAGMENT(ipp) (ipp.ipp_fields & IPPF_FRAGHDR)
172 172
173 173 /*
174 174 * Policy failure messages.
175 175 */
176 176 static char *ipsec_policy_failure_msgs[] = {
177 177
178 178 /* IPSEC_POLICY_NOT_NEEDED */
179 179 "%s: Dropping the datagram because the incoming packet "
180 180 "is %s, but the recipient expects clear; Source %s, "
181 181 "Destination %s.\n",
182 182
183 183 /* IPSEC_POLICY_MISMATCH */
184 184 "%s: Policy Failure for the incoming packet (%s); Source %s, "
185 185 "Destination %s.\n",
186 186
187 187 /* IPSEC_POLICY_AUTH_NOT_NEEDED */
188 188 "%s: Authentication present while not expected in the "
189 189 "incoming %s packet; Source %s, Destination %s.\n",
190 190
191 191 /* IPSEC_POLICY_ENCR_NOT_NEEDED */
192 192 "%s: Encryption present while not expected in the "
193 193 "incoming %s packet; Source %s, Destination %s.\n",
194 194
195 195 /* IPSEC_POLICY_SE_NOT_NEEDED */
196 196 "%s: Self-Encapsulation present while not expected in the "
197 197 "incoming %s packet; Source %s, Destination %s.\n",
198 198 };
199 199
200 200 /*
201 201 * General overviews:
202 202 *
203 203 * Locking:
204 204 *
205 205 * All of the system policy structures are protected by a single
206 206 * rwlock. These structures are threaded in a
207 207 * fairly complex fashion and are not expected to change on a
208 208 * regular basis, so this should not cause scaling/contention
209 209 * problems. As a result, policy checks should (hopefully) be MT-hot.
210 210 *
211 211 * Allocation policy:
212 212 *
213 213 * We use custom kmem cache types for the various
214 214 * bits & pieces of the policy data structures. All allocations
215 215 * use KM_NOSLEEP instead of KM_SLEEP for policy allocation. The
216 216 * policy table is of potentially unbounded size, so we don't
217 217 * want to provide a way to hog all system memory with policy
218 218 * entries..
219 219 */
220 220
221 221 /* Convenient functions for freeing or dropping a b_next linked mblk chain */
222 222
223 223 /* Free all messages in an mblk chain */
224 224 static void
225 225 ipsec_freemsg_chain(mblk_t *mp)
226 226 {
227 227 mblk_t *mpnext;
228 228 while (mp != NULL) {
229 229 ASSERT(mp->b_prev == NULL);
230 230 mpnext = mp->b_next;
231 231 mp->b_next = NULL;
232 232 freemsg(mp);
233 233 mp = mpnext;
234 234 }
235 235 }
236 236
237 237 /*
238 238 * ip_drop all messages in an mblk chain
239 239 * Can handle a b_next chain of ip_recv_attr_t mblks, or just a b_next chain
240 240 * of data.
241 241 */
242 242 static void
243 243 ip_drop_packet_chain(mblk_t *mp, boolean_t inbound, ill_t *ill,
244 244 struct kstat_named *counter, ipdropper_t *who_called)
245 245 {
246 246 mblk_t *mpnext;
247 247 while (mp != NULL) {
248 248 ASSERT(mp->b_prev == NULL);
249 249 mpnext = mp->b_next;
250 250 mp->b_next = NULL;
251 251 if (ip_recv_attr_is_mblk(mp))
252 252 mp = ip_recv_attr_free_mblk(mp);
253 253 ip_drop_packet(mp, inbound, ill, counter, who_called);
254 254 mp = mpnext;
255 255 }
256 256 }
257 257
258 258 /*
259 259 * AVL tree comparison function.
260 260 * the in-kernel avl assumes unique keys for all objects.
261 261 * Since sometimes policy will duplicate rules, we may insert
262 262 * multiple rules with the same rule id, so we need a tie-breaker.
263 263 */
264 264 static int
265 265 ipsec_policy_cmpbyid(const void *a, const void *b)
266 266 {
267 267 const ipsec_policy_t *ipa, *ipb;
268 268 uint64_t idxa, idxb;
269 269
270 270 ipa = (const ipsec_policy_t *)a;
271 271 ipb = (const ipsec_policy_t *)b;
272 272 idxa = ipa->ipsp_index;
273 273 idxb = ipb->ipsp_index;
274 274
275 275 if (idxa < idxb)
276 276 return (-1);
277 277 if (idxa > idxb)
278 278 return (1);
279 279 /*
280 280 * Tie-breaker #1: All installed policy rules have a non-NULL
281 281 * ipsl_sel (selector set), so an entry with a NULL ipsp_sel is not
282 282 * actually in-tree but rather a template node being used in
283 283 * an avl_find query; see ipsec_policy_delete(). This gives us
284 284 * a placeholder in the ordering just before the first entry with
285 285 * a key >= the one we're looking for, so we can walk forward from
286 286 * that point to get the remaining entries with the same id.
287 287 */
288 288 if ((ipa->ipsp_sel == NULL) && (ipb->ipsp_sel != NULL))
289 289 return (-1);
290 290 if ((ipb->ipsp_sel == NULL) && (ipa->ipsp_sel != NULL))
291 291 return (1);
292 292 /*
293 293 * At most one of the arguments to the comparison should have a
294 294 * NULL selector pointer; if not, the tree is broken.
295 295 */
296 296 ASSERT(ipa->ipsp_sel != NULL);
297 297 ASSERT(ipb->ipsp_sel != NULL);
298 298 /*
299 299 * Tie-breaker #2: use the virtual address of the policy node
300 300 * to arbitrarily break ties. Since we use the new tree node in
301 301 * the avl_find() in ipsec_insert_always, the new node will be
302 302 * inserted into the tree in the right place in the sequence.
303 303 */
304 304 if (ipa < ipb)
305 305 return (-1);
306 306 if (ipa > ipb)
307 307 return (1);
308 308 return (0);
309 309 }
310 310
311 311 /*
312 312 * Free what ipsec_alloc_table allocated.
313 313 */
314 314 void
315 315 ipsec_polhead_free_table(ipsec_policy_head_t *iph)
316 316 {
317 317 int dir;
318 318 int i;
319 319
320 320 for (dir = 0; dir < IPSEC_NTYPES; dir++) {
321 321 ipsec_policy_root_t *ipr = &iph->iph_root[dir];
322 322
323 323 if (ipr->ipr_hash == NULL)
324 324 continue;
325 325
326 326 for (i = 0; i < ipr->ipr_nchains; i++) {
327 327 ASSERT(ipr->ipr_hash[i].hash_head == NULL);
328 328 }
329 329 kmem_free(ipr->ipr_hash, ipr->ipr_nchains *
330 330 sizeof (ipsec_policy_hash_t));
331 331 ipr->ipr_hash = NULL;
332 332 }
333 333 }
334 334
335 335 void
336 336 ipsec_polhead_destroy(ipsec_policy_head_t *iph)
337 337 {
338 338 int dir;
339 339
340 340 avl_destroy(&iph->iph_rulebyid);
341 341 rw_destroy(&iph->iph_lock);
342 342
343 343 for (dir = 0; dir < IPSEC_NTYPES; dir++) {
344 344 ipsec_policy_root_t *ipr = &iph->iph_root[dir];
345 345 int chain;
346 346
347 347 for (chain = 0; chain < ipr->ipr_nchains; chain++)
348 348 mutex_destroy(&(ipr->ipr_hash[chain].hash_lock));
349 349
350 350 }
351 351 ipsec_polhead_free_table(iph);
352 352 }
353 353
354 354 /*
355 355 * Free the IPsec stack instance.
356 356 */
357 357 /* ARGSUSED */
358 358 static void
359 359 ipsec_stack_fini(netstackid_t stackid, void *arg)
360 360 {
361 361 ipsec_stack_t *ipss = (ipsec_stack_t *)arg;
362 362 void *cookie;
363 363 ipsec_tun_pol_t *node;
364 364 netstack_t *ns = ipss->ipsec_netstack;
365 365 int i;
366 366 ipsec_algtype_t algtype;
367 367
368 368 ipsec_loader_destroy(ipss);
369 369
370 370 rw_enter(&ipss->ipsec_tunnel_policy_lock, RW_WRITER);
371 371 /*
372 372 * It's possible we can just ASSERT() the tree is empty. After all,
373 373 * we aren't called until IP is ready to unload (and presumably all
374 374 * tunnels have been unplumbed). But we'll play it safe for now, the
375 375 * loop will just exit immediately if it's empty.
376 376 */
377 377 cookie = NULL;
378 378 while ((node = (ipsec_tun_pol_t *)
379 379 avl_destroy_nodes(&ipss->ipsec_tunnel_policies,
380 380 &cookie)) != NULL) {
381 381 ITP_REFRELE(node, ns);
382 382 }
383 383 avl_destroy(&ipss->ipsec_tunnel_policies);
384 384 rw_exit(&ipss->ipsec_tunnel_policy_lock);
385 385 rw_destroy(&ipss->ipsec_tunnel_policy_lock);
386 386
387 387 ipsec_config_flush(ns);
388 388
389 389 ipsec_kstat_destroy(ipss);
390 390
391 391 ip_drop_unregister(&ipss->ipsec_dropper);
392 392
393 393 ip_drop_unregister(&ipss->ipsec_spd_dropper);
394 394 ip_drop_destroy(ipss);
395 395 /*
396 396 * Globals start with ref == 1 to prevent IPPH_REFRELE() from
397 397 * attempting to free them, hence they should have 1 now.
398 398 */
399 399 ipsec_polhead_destroy(&ipss->ipsec_system_policy);
400 400 ASSERT(ipss->ipsec_system_policy.iph_refs == 1);
401 401 ipsec_polhead_destroy(&ipss->ipsec_inactive_policy);
402 402 ASSERT(ipss->ipsec_inactive_policy.iph_refs == 1);
403 403
404 404 for (i = 0; i < IPSEC_ACTION_HASH_SIZE; i++) {
405 405 ipsec_action_free_table(ipss->ipsec_action_hash[i].hash_head);
406 406 ipss->ipsec_action_hash[i].hash_head = NULL;
407 407 mutex_destroy(&(ipss->ipsec_action_hash[i].hash_lock));
408 408 }
409 409
410 410 for (i = 0; i < ipss->ipsec_spd_hashsize; i++) {
411 411 ASSERT(ipss->ipsec_sel_hash[i].hash_head == NULL);
412 412 mutex_destroy(&(ipss->ipsec_sel_hash[i].hash_lock));
413 413 }
414 414
415 415 mutex_enter(&ipss->ipsec_alg_lock);
416 416 for (algtype = 0; algtype < IPSEC_NALGTYPES; algtype ++) {
417 417 int nalgs = ipss->ipsec_nalgs[algtype];
418 418
419 419 for (i = 0; i < nalgs; i++) {
420 420 if (ipss->ipsec_alglists[algtype][i] != NULL)
421 421 ipsec_alg_unreg(algtype, i, ns);
422 422 }
423 423 }
424 424 mutex_exit(&ipss->ipsec_alg_lock);
425 425 mutex_destroy(&ipss->ipsec_alg_lock);
426 426
427 427 ipsid_gc(ns);
428 428 ipsid_fini(ns);
429 429
430 430 (void) ipsec_free_tables(ipss);
431 431 kmem_free(ipss, sizeof (*ipss));
432 432 }
433 433
434 434 void
435 435 ipsec_policy_g_destroy(void)
436 436 {
437 437 kmem_cache_destroy(ipsec_action_cache);
438 438 kmem_cache_destroy(ipsec_sel_cache);
439 439 kmem_cache_destroy(ipsec_pol_cache);
440 440
441 441 ipsec_unregister_prov_update();
442 442
443 443 netstack_unregister(NS_IPSEC);
444 444 }
445 445
446 446
447 447 /*
448 448 * Free what ipsec_alloc_tables allocated.
449 449 * Called when table allocation fails to free the table.
450 450 */
451 451 static int
452 452 ipsec_free_tables(ipsec_stack_t *ipss)
453 453 {
454 454 int i;
455 455
456 456 if (ipss->ipsec_sel_hash != NULL) {
457 457 for (i = 0; i < ipss->ipsec_spd_hashsize; i++) {
458 458 ASSERT(ipss->ipsec_sel_hash[i].hash_head == NULL);
459 459 }
460 460 kmem_free(ipss->ipsec_sel_hash, ipss->ipsec_spd_hashsize *
461 461 sizeof (*ipss->ipsec_sel_hash));
462 462 ipss->ipsec_sel_hash = NULL;
463 463 ipss->ipsec_spd_hashsize = 0;
464 464 }
465 465 ipsec_polhead_free_table(&ipss->ipsec_system_policy);
466 466 ipsec_polhead_free_table(&ipss->ipsec_inactive_policy);
467 467
468 468 return (ENOMEM);
469 469 }
470 470
471 471 /*
472 472 * Attempt to allocate the tables in a single policy head.
473 473 * Return nonzero on failure after cleaning up any work in progress.
474 474 */
475 475 int
476 476 ipsec_alloc_table(ipsec_policy_head_t *iph, int nchains, int kmflag,
477 477 boolean_t global_cleanup, netstack_t *ns)
478 478 {
479 479 int dir;
480 480
481 481 for (dir = 0; dir < IPSEC_NTYPES; dir++) {
482 482 ipsec_policy_root_t *ipr = &iph->iph_root[dir];
483 483
484 484 ipr->ipr_nchains = nchains;
485 485 ipr->ipr_hash = kmem_zalloc(nchains *
486 486 sizeof (ipsec_policy_hash_t), kmflag);
487 487 if (ipr->ipr_hash == NULL)
488 488 return (global_cleanup ?
489 489 ipsec_free_tables(ns->netstack_ipsec) :
490 490 ENOMEM);
491 491 }
492 492 return (0);
493 493 }
494 494
495 495 /*
496 496 * Attempt to allocate the various tables. Return nonzero on failure
497 497 * after cleaning up any work in progress.
498 498 */
499 499 static int
500 500 ipsec_alloc_tables(int kmflag, netstack_t *ns)
501 501 {
502 502 int error;
503 503 ipsec_stack_t *ipss = ns->netstack_ipsec;
504 504
505 505 error = ipsec_alloc_table(&ipss->ipsec_system_policy,
506 506 ipss->ipsec_spd_hashsize, kmflag, B_TRUE, ns);
507 507 if (error != 0)
508 508 return (error);
509 509
510 510 error = ipsec_alloc_table(&ipss->ipsec_inactive_policy,
511 511 ipss->ipsec_spd_hashsize, kmflag, B_TRUE, ns);
512 512 if (error != 0)
513 513 return (error);
514 514
515 515 ipss->ipsec_sel_hash = kmem_zalloc(ipss->ipsec_spd_hashsize *
516 516 sizeof (*ipss->ipsec_sel_hash), kmflag);
517 517
518 518 if (ipss->ipsec_sel_hash == NULL)
519 519 return (ipsec_free_tables(ipss));
520 520
521 521 return (0);
522 522 }
523 523
524 524 /*
525 525 * After table allocation, initialize a policy head.
526 526 */
527 527 void
528 528 ipsec_polhead_init(ipsec_policy_head_t *iph, int nchains)
529 529 {
530 530 int dir, chain;
531 531
532 532 rw_init(&iph->iph_lock, NULL, RW_DEFAULT, NULL);
533 533 avl_create(&iph->iph_rulebyid, ipsec_policy_cmpbyid,
534 534 sizeof (ipsec_policy_t), offsetof(ipsec_policy_t, ipsp_byid));
535 535
536 536 for (dir = 0; dir < IPSEC_NTYPES; dir++) {
537 537 ipsec_policy_root_t *ipr = &iph->iph_root[dir];
538 538 ipr->ipr_nchains = nchains;
539 539
540 540 for (chain = 0; chain < nchains; chain++) {
541 541 mutex_init(&(ipr->ipr_hash[chain].hash_lock),
542 542 NULL, MUTEX_DEFAULT, NULL);
543 543 }
544 544 }
545 545 }
546 546
547 547 static boolean_t
548 548 ipsec_kstat_init(ipsec_stack_t *ipss)
549 549 {
550 550 ipss->ipsec_ksp = kstat_create_netstack("ip", 0, "ipsec_stat", "net",
551 551 KSTAT_TYPE_NAMED, sizeof (ipsec_kstats_t) / sizeof (kstat_named_t),
552 552 KSTAT_FLAG_PERSISTENT, ipss->ipsec_netstack->netstack_stackid);
553 553
554 554 if (ipss->ipsec_ksp == NULL || ipss->ipsec_ksp->ks_data == NULL)
555 555 return (B_FALSE);
556 556
557 557 ipss->ipsec_kstats = ipss->ipsec_ksp->ks_data;
558 558
559 559 #define KI(x) kstat_named_init(&ipss->ipsec_kstats->x, #x, KSTAT_DATA_UINT64)
560 560 KI(esp_stat_in_requests);
561 561 KI(esp_stat_in_discards);
562 562 KI(esp_stat_lookup_failure);
563 563 KI(ah_stat_in_requests);
564 564 KI(ah_stat_in_discards);
565 565 KI(ah_stat_lookup_failure);
566 566 KI(sadb_acquire_maxpackets);
567 567 KI(sadb_acquire_qhiwater);
568 568 #undef KI
569 569
570 570 kstat_install(ipss->ipsec_ksp);
571 571 return (B_TRUE);
572 572 }
573 573
574 574 static void
575 575 ipsec_kstat_destroy(ipsec_stack_t *ipss)
576 576 {
577 577 kstat_delete_netstack(ipss->ipsec_ksp,
578 578 ipss->ipsec_netstack->netstack_stackid);
579 579 ipss->ipsec_kstats = NULL;
580 580
581 581 }
582 582
583 583 /*
584 584 * Initialize the IPsec stack instance.
585 585 */
586 586 /* ARGSUSED */
587 587 static void *
588 588 ipsec_stack_init(netstackid_t stackid, netstack_t *ns)
589 589 {
590 590 ipsec_stack_t *ipss;
591 591 int i;
592 592
593 593 ipss = (ipsec_stack_t *)kmem_zalloc(sizeof (*ipss), KM_SLEEP);
594 594 ipss->ipsec_netstack = ns;
595 595
596 596 /*
597 597 * FIXME: netstack_ipsec is used by some of the routines we call
598 598 * below, but it isn't set until this routine returns.
599 599 * Either we introduce optional xxx_stack_alloc() functions
600 600 * that will be called by the netstack framework before xxx_stack_init,
601 601 * or we switch spd.c and sadb.c to operate on ipsec_stack_t
602 602 * (latter has some include file order issues for sadb.h, but makes
603 603 * sense if we merge some of the ipsec related stack_t's together.
604 604 */
605 605 ns->netstack_ipsec = ipss;
606 606
607 607 /*
608 608 * Make two attempts to allocate policy hash tables; try it at
609 609 * the "preferred" size (may be set in /etc/system) first,
610 610 * then fall back to the default size.
611 611 */
612 612 ipss->ipsec_spd_hashsize = (ipsec_spd_hashsize == 0) ?
613 613 IPSEC_SPDHASH_DEFAULT : ipsec_spd_hashsize;
614 614
615 615 if (ipsec_alloc_tables(KM_NOSLEEP, ns) != 0) {
616 616 cmn_err(CE_WARN,
617 617 "Unable to allocate %d entry IPsec policy hash table",
618 618 ipss->ipsec_spd_hashsize);
619 619 ipss->ipsec_spd_hashsize = IPSEC_SPDHASH_DEFAULT;
620 620 cmn_err(CE_WARN, "Falling back to %d entries",
621 621 ipss->ipsec_spd_hashsize);
622 622 (void) ipsec_alloc_tables(KM_SLEEP, ns);
623 623 }
624 624
625 625 /* Just set a default for tunnels. */
626 626 ipss->ipsec_tun_spd_hashsize = (tun_spd_hashsize == 0) ?
627 627 TUN_SPDHASH_DEFAULT : tun_spd_hashsize;
628 628
629 629 ipsid_init(ns);
630 630 /*
631 631 * Globals need ref == 1 to prevent IPPH_REFRELE() from attempting
632 632 * to free them.
633 633 */
634 634 ipss->ipsec_system_policy.iph_refs = 1;
635 635 ipss->ipsec_inactive_policy.iph_refs = 1;
636 636 ipsec_polhead_init(&ipss->ipsec_system_policy,
637 637 ipss->ipsec_spd_hashsize);
638 638 ipsec_polhead_init(&ipss->ipsec_inactive_policy,
639 639 ipss->ipsec_spd_hashsize);
640 640 rw_init(&ipss->ipsec_tunnel_policy_lock, NULL, RW_DEFAULT, NULL);
641 641 avl_create(&ipss->ipsec_tunnel_policies, tunnel_compare,
642 642 sizeof (ipsec_tun_pol_t), 0);
643 643
644 644 ipss->ipsec_next_policy_index = 1;
645 645
646 646 rw_init(&ipss->ipsec_system_policy.iph_lock, NULL, RW_DEFAULT, NULL);
647 647 rw_init(&ipss->ipsec_inactive_policy.iph_lock, NULL, RW_DEFAULT, NULL);
648 648
649 649 for (i = 0; i < IPSEC_ACTION_HASH_SIZE; i++)
650 650 mutex_init(&(ipss->ipsec_action_hash[i].hash_lock),
651 651 NULL, MUTEX_DEFAULT, NULL);
652 652
653 653 for (i = 0; i < ipss->ipsec_spd_hashsize; i++)
654 654 mutex_init(&(ipss->ipsec_sel_hash[i].hash_lock),
655 655 NULL, MUTEX_DEFAULT, NULL);
656 656
657 657 mutex_init(&ipss->ipsec_alg_lock, NULL, MUTEX_DEFAULT, NULL);
658 658 for (i = 0; i < IPSEC_NALGTYPES; i++) {
659 659 ipss->ipsec_nalgs[i] = 0;
660 660 }
661 661
662 662 ip_drop_init(ipss);
663 663 ip_drop_register(&ipss->ipsec_spd_dropper, "IPsec SPD");
664 664
665 665 /* IP's IPsec code calls the packet dropper */
666 666 ip_drop_register(&ipss->ipsec_dropper, "IP IPsec processing");
667 667
668 668 (void) ipsec_kstat_init(ipss);
669 669
670 670 ipsec_loader_init(ipss);
671 671 ipsec_loader_start(ipss);
672 672
673 673 return (ipss);
674 674 }
675 675
676 676 /* Global across all stack instances */
677 677 void
678 678 ipsec_policy_g_init(void)
679 679 {
680 680 ipsec_action_cache = kmem_cache_create("ipsec_actions",
681 681 sizeof (ipsec_action_t), _POINTER_ALIGNMENT, NULL, NULL,
682 682 ipsec_action_reclaim, NULL, NULL, 0);
683 683 ipsec_sel_cache = kmem_cache_create("ipsec_selectors",
684 684 sizeof (ipsec_sel_t), _POINTER_ALIGNMENT, NULL, NULL,
685 685 NULL, NULL, NULL, 0);
686 686 ipsec_pol_cache = kmem_cache_create("ipsec_policy",
687 687 sizeof (ipsec_policy_t), _POINTER_ALIGNMENT, NULL, NULL,
688 688 NULL, NULL, NULL, 0);
689 689
690 690 /*
691 691 * We want to be informed each time a stack is created or
692 692 * destroyed in the kernel, so we can maintain the
693 693 * set of ipsec_stack_t's.
694 694 */
695 695 netstack_register(NS_IPSEC, ipsec_stack_init, NULL, ipsec_stack_fini);
696 696 }
697 697
698 698 /*
699 699 * Sort algorithm lists.
700 700 *
701 701 * I may need to split this based on
702 702 * authentication/encryption, and I may wish to have an administrator
703 703 * configure this list. Hold on to some NDD variables...
704 704 *
705 705 * XXX For now, sort on minimum key size (GAG!). While minimum key size is
706 706 * not the ideal metric, it's the only quantifiable measure available.
707 707 * We need a better metric for sorting algorithms by preference.
708 708 */
709 709 static void
710 710 alg_insert_sortlist(enum ipsec_algtype at, uint8_t algid, netstack_t *ns)
711 711 {
712 712 ipsec_stack_t *ipss = ns->netstack_ipsec;
713 713 ipsec_alginfo_t *ai = ipss->ipsec_alglists[at][algid];
714 714 uint8_t holder, swap;
715 715 uint_t i;
716 716 uint_t count = ipss->ipsec_nalgs[at];
717 717 ASSERT(ai != NULL);
718 718 ASSERT(algid == ai->alg_id);
719 719
720 720 ASSERT(MUTEX_HELD(&ipss->ipsec_alg_lock));
721 721
722 722 holder = algid;
723 723
724 724 for (i = 0; i < count - 1; i++) {
725 725 ipsec_alginfo_t *alt;
726 726
727 727 alt = ipss->ipsec_alglists[at][ipss->ipsec_sortlist[at][i]];
728 728 /*
729 729 * If you want to give precedence to newly added algs,
730 730 * add the = in the > comparison.
731 731 */
732 732 if ((holder != algid) || (ai->alg_minbits > alt->alg_minbits)) {
733 733 /* Swap sortlist[i] and holder. */
734 734 swap = ipss->ipsec_sortlist[at][i];
735 735 ipss->ipsec_sortlist[at][i] = holder;
736 736 holder = swap;
737 737 ai = alt;
738 738 } /* Else just continue. */
739 739 }
740 740
741 741 /* Store holder in last slot. */
742 742 ipss->ipsec_sortlist[at][i] = holder;
743 743 }
744 744
745 745 /*
746 746 * Remove an algorithm from a sorted algorithm list.
747 747 * This should be considerably easier, even with complex sorting.
748 748 */
749 749 static void
750 750 alg_remove_sortlist(enum ipsec_algtype at, uint8_t algid, netstack_t *ns)
751 751 {
752 752 boolean_t copyback = B_FALSE;
753 753 int i;
754 754 ipsec_stack_t *ipss = ns->netstack_ipsec;
755 755 int newcount = ipss->ipsec_nalgs[at];
756 756
757 757 ASSERT(MUTEX_HELD(&ipss->ipsec_alg_lock));
758 758
759 759 for (i = 0; i <= newcount; i++) {
760 760 if (copyback) {
761 761 ipss->ipsec_sortlist[at][i-1] =
762 762 ipss->ipsec_sortlist[at][i];
763 763 } else if (ipss->ipsec_sortlist[at][i] == algid) {
764 764 copyback = B_TRUE;
765 765 }
766 766 }
767 767 }
768 768
769 769 /*
770 770 * Add the specified algorithm to the algorithm tables.
771 771 * Must be called while holding the algorithm table writer lock.
772 772 */
773 773 void
774 774 ipsec_alg_reg(ipsec_algtype_t algtype, ipsec_alginfo_t *alg, netstack_t *ns)
775 775 {
776 776 ipsec_stack_t *ipss = ns->netstack_ipsec;
777 777
778 778 ASSERT(MUTEX_HELD(&ipss->ipsec_alg_lock));
779 779
780 780 ASSERT(ipss->ipsec_alglists[algtype][alg->alg_id] == NULL);
781 781 ipsec_alg_fix_min_max(alg, algtype, ns);
782 782 ipss->ipsec_alglists[algtype][alg->alg_id] = alg;
783 783
784 784 ipss->ipsec_nalgs[algtype]++;
785 785 alg_insert_sortlist(algtype, alg->alg_id, ns);
786 786 }
787 787
788 788 /*
789 789 * Remove the specified algorithm from the algorithm tables.
790 790 * Must be called while holding the algorithm table writer lock.
791 791 */
792 792 void
793 793 ipsec_alg_unreg(ipsec_algtype_t algtype, uint8_t algid, netstack_t *ns)
794 794 {
795 795 ipsec_stack_t *ipss = ns->netstack_ipsec;
796 796
797 797 ASSERT(MUTEX_HELD(&ipss->ipsec_alg_lock));
798 798
799 799 ASSERT(ipss->ipsec_alglists[algtype][algid] != NULL);
800 800 ipsec_alg_free(ipss->ipsec_alglists[algtype][algid]);
801 801 ipss->ipsec_alglists[algtype][algid] = NULL;
802 802
803 803 ipss->ipsec_nalgs[algtype]--;
804 804 alg_remove_sortlist(algtype, algid, ns);
805 805 }
806 806
807 807 /*
808 808 * Hooks for spdsock to get a grip on system policy.
809 809 */
810 810
811 811 ipsec_policy_head_t *
812 812 ipsec_system_policy(netstack_t *ns)
813 813 {
814 814 ipsec_stack_t *ipss = ns->netstack_ipsec;
815 815 ipsec_policy_head_t *h = &ipss->ipsec_system_policy;
816 816
817 817 IPPH_REFHOLD(h);
818 818 return (h);
819 819 }
820 820
821 821 ipsec_policy_head_t *
822 822 ipsec_inactive_policy(netstack_t *ns)
823 823 {
824 824 ipsec_stack_t *ipss = ns->netstack_ipsec;
825 825 ipsec_policy_head_t *h = &ipss->ipsec_inactive_policy;
826 826
827 827 IPPH_REFHOLD(h);
828 828 return (h);
829 829 }
830 830
831 831 /*
832 832 * Lock inactive policy, then active policy, then exchange policy root
833 833 * pointers.
834 834 */
835 835 void
836 836 ipsec_swap_policy(ipsec_policy_head_t *active, ipsec_policy_head_t *inactive,
837 837 netstack_t *ns)
838 838 {
839 839 int af, dir;
840 840 avl_tree_t r1, r2;
841 841
842 842 rw_enter(&inactive->iph_lock, RW_WRITER);
843 843 rw_enter(&active->iph_lock, RW_WRITER);
844 844
845 845 r1 = active->iph_rulebyid;
846 846 r2 = inactive->iph_rulebyid;
847 847 active->iph_rulebyid = r2;
848 848 inactive->iph_rulebyid = r1;
849 849
850 850 for (dir = 0; dir < IPSEC_NTYPES; dir++) {
851 851 ipsec_policy_hash_t *h1, *h2;
852 852
853 853 h1 = active->iph_root[dir].ipr_hash;
854 854 h2 = inactive->iph_root[dir].ipr_hash;
855 855 active->iph_root[dir].ipr_hash = h2;
856 856 inactive->iph_root[dir].ipr_hash = h1;
857 857
858 858 for (af = 0; af < IPSEC_NAF; af++) {
859 859 ipsec_policy_t *t1, *t2;
860 860
861 861 t1 = active->iph_root[dir].ipr_nonhash[af];
862 862 t2 = inactive->iph_root[dir].ipr_nonhash[af];
863 863 active->iph_root[dir].ipr_nonhash[af] = t2;
864 864 inactive->iph_root[dir].ipr_nonhash[af] = t1;
865 865 if (t1 != NULL) {
866 866 t1->ipsp_hash.hash_pp =
867 867 &(inactive->iph_root[dir].ipr_nonhash[af]);
868 868 }
869 869 if (t2 != NULL) {
870 870 t2->ipsp_hash.hash_pp =
871 871 &(active->iph_root[dir].ipr_nonhash[af]);
872 872 }
873 873
874 874 }
875 875 }
876 876 active->iph_gen++;
877 877 inactive->iph_gen++;
878 878 ipsec_update_present_flags(ns->netstack_ipsec);
879 879 rw_exit(&active->iph_lock);
880 880 rw_exit(&inactive->iph_lock);
881 881 }
882 882
883 883 /*
884 884 * Swap global policy primary/secondary.
885 885 */
886 886 void
887 887 ipsec_swap_global_policy(netstack_t *ns)
888 888 {
889 889 ipsec_stack_t *ipss = ns->netstack_ipsec;
890 890
891 891 ipsec_swap_policy(&ipss->ipsec_system_policy,
892 892 &ipss->ipsec_inactive_policy, ns);
893 893 }
894 894
895 895 /*
896 896 * Clone one policy rule..
897 897 */
898 898 static ipsec_policy_t *
899 899 ipsec_copy_policy(const ipsec_policy_t *src)
900 900 {
901 901 ipsec_policy_t *dst = kmem_cache_alloc(ipsec_pol_cache, KM_NOSLEEP);
902 902
903 903 if (dst == NULL)
904 904 return (NULL);
905 905
906 906 /*
907 907 * Adjust refcounts of cloned state.
908 908 */
909 909 IPACT_REFHOLD(src->ipsp_act);
910 910 src->ipsp_sel->ipsl_refs++;
911 911
912 912 HASH_NULL(dst, ipsp_hash);
913 913 dst->ipsp_netstack = src->ipsp_netstack;
914 914 dst->ipsp_refs = 1;
915 915 dst->ipsp_sel = src->ipsp_sel;
916 916 dst->ipsp_act = src->ipsp_act;
917 917 dst->ipsp_prio = src->ipsp_prio;
918 918 dst->ipsp_index = src->ipsp_index;
919 919
920 920 return (dst);
921 921 }
922 922
923 923 void
924 924 ipsec_insert_always(avl_tree_t *tree, void *new_node)
925 925 {
926 926 void *node;
927 927 avl_index_t where;
928 928
929 929 node = avl_find(tree, new_node, &where);
930 930 ASSERT(node == NULL);
931 931 avl_insert(tree, new_node, where);
932 932 }
933 933
934 934
935 935 static int
936 936 ipsec_copy_chain(ipsec_policy_head_t *dph, ipsec_policy_t *src,
937 937 ipsec_policy_t **dstp)
938 938 {
939 939 for (; src != NULL; src = src->ipsp_hash.hash_next) {
940 940 ipsec_policy_t *dst = ipsec_copy_policy(src);
941 941 if (dst == NULL)
942 942 return (ENOMEM);
943 943
944 944 HASHLIST_INSERT(dst, ipsp_hash, *dstp);
945 945 ipsec_insert_always(&dph->iph_rulebyid, dst);
946 946 }
947 947 return (0);
948 948 }
949 949
950 950
951 951
952 952 /*
953 953 * Make one policy head look exactly like another.
954 954 *
955 955 * As with ipsec_swap_policy, we lock the destination policy head first, then
956 956 * the source policy head. Note that we only need to read-lock the source
957 957 * policy head as we are not changing it.
958 958 */
959 959 int
960 960 ipsec_copy_polhead(ipsec_policy_head_t *sph, ipsec_policy_head_t *dph,
961 961 netstack_t *ns)
962 962 {
963 963 int af, dir, chain, nchains;
964 964
965 965 rw_enter(&dph->iph_lock, RW_WRITER);
966 966
967 967 ipsec_polhead_flush(dph, ns);
968 968
969 969 rw_enter(&sph->iph_lock, RW_READER);
970 970
971 971 for (dir = 0; dir < IPSEC_NTYPES; dir++) {
972 972 ipsec_policy_root_t *dpr = &dph->iph_root[dir];
973 973 ipsec_policy_root_t *spr = &sph->iph_root[dir];
974 974 nchains = dpr->ipr_nchains;
975 975
976 976 ASSERT(dpr->ipr_nchains == spr->ipr_nchains);
977 977
978 978 for (af = 0; af < IPSEC_NAF; af++) {
979 979 if (ipsec_copy_chain(dph, spr->ipr_nonhash[af],
980 980 &dpr->ipr_nonhash[af]))
981 981 goto abort_copy;
982 982 }
983 983
984 984 for (chain = 0; chain < nchains; chain++) {
985 985 if (ipsec_copy_chain(dph,
986 986 spr->ipr_hash[chain].hash_head,
987 987 &dpr->ipr_hash[chain].hash_head))
988 988 goto abort_copy;
989 989 }
990 990 }
991 991
992 992 dph->iph_gen++;
993 993
994 994 rw_exit(&sph->iph_lock);
995 995 rw_exit(&dph->iph_lock);
996 996 return (0);
997 997
998 998 abort_copy:
999 999 ipsec_polhead_flush(dph, ns);
1000 1000 rw_exit(&sph->iph_lock);
1001 1001 rw_exit(&dph->iph_lock);
1002 1002 return (ENOMEM);
1003 1003 }
1004 1004
1005 1005 /*
1006 1006 * Clone currently active policy to the inactive policy list.
1007 1007 */
1008 1008 int
1009 1009 ipsec_clone_system_policy(netstack_t *ns)
1010 1010 {
1011 1011 ipsec_stack_t *ipss = ns->netstack_ipsec;
1012 1012
1013 1013 return (ipsec_copy_polhead(&ipss->ipsec_system_policy,
1014 1014 &ipss->ipsec_inactive_policy, ns));
1015 1015 }
1016 1016
1017 1017 /*
1018 1018 * Extract the string from ipsec_policy_failure_msgs[type] and
1019 1019 * log it.
1020 1020 *
1021 1021 */
1022 1022 void
1023 1023 ipsec_log_policy_failure(int type, char *func_name, ipha_t *ipha, ip6_t *ip6h,
1024 1024 boolean_t secure, netstack_t *ns)
1025 1025 {
1026 1026 char sbuf[INET6_ADDRSTRLEN];
1027 1027 char dbuf[INET6_ADDRSTRLEN];
1028 1028 char *s;
1029 1029 char *d;
1030 1030 ipsec_stack_t *ipss = ns->netstack_ipsec;
1031 1031
1032 1032 ASSERT((ipha == NULL && ip6h != NULL) ||
1033 1033 (ip6h == NULL && ipha != NULL));
1034 1034
1035 1035 if (ipha != NULL) {
1036 1036 s = inet_ntop(AF_INET, &ipha->ipha_src, sbuf, sizeof (sbuf));
1037 1037 d = inet_ntop(AF_INET, &ipha->ipha_dst, dbuf, sizeof (dbuf));
1038 1038 } else {
1039 1039 s = inet_ntop(AF_INET6, &ip6h->ip6_src, sbuf, sizeof (sbuf));
1040 1040 d = inet_ntop(AF_INET6, &ip6h->ip6_dst, dbuf, sizeof (dbuf));
1041 1041
1042 1042 }
1043 1043
1044 1044 /* Always bump the policy failure counter. */
1045 1045 ipss->ipsec_policy_failure_count[type]++;
1046 1046
1047 1047 ipsec_rl_strlog(ns, IP_MOD_ID, 0, 0, SL_ERROR|SL_WARN|SL_CONSOLE,
1048 1048 ipsec_policy_failure_msgs[type], func_name,
1049 1049 (secure ? "secure" : "not secure"), s, d);
1050 1050 }
1051 1051
1052 1052 /*
1053 1053 * Rate-limiting front-end to strlog() for AH and ESP. Uses the ndd variables
1054 1054 * in /dev/ip and the same rate-limiting clock so that there's a single
1055 1055 * knob to turn to throttle the rate of messages.
1056 1056 */
1057 1057 void
1058 1058 ipsec_rl_strlog(netstack_t *ns, short mid, short sid, char level, ushort_t sl,
1059 1059 char *fmt, ...)
1060 1060 {
1061 1061 va_list adx;
1062 1062 hrtime_t current = gethrtime();
1063 1063 ip_stack_t *ipst = ns->netstack_ip;
1064 1064 ipsec_stack_t *ipss = ns->netstack_ipsec;
1065 1065
1066 1066 sl |= SL_CONSOLE;
1067 1067 /*
1068 1068 * Throttle logging to stop syslog from being swamped. If variable
1069 1069 * 'ipsec_policy_log_interval' is zero, don't log any messages at
1070 1070 * all, otherwise log only one message every 'ipsec_policy_log_interval'
1071 1071 * msec. Convert interval (in msec) to hrtime (in nsec).
1072 1072 */
1073 1073
1074 1074 if (ipst->ips_ipsec_policy_log_interval) {
1075 1075 if (ipss->ipsec_policy_failure_last +
1076 1076 MSEC2NSEC(ipst->ips_ipsec_policy_log_interval) <= current) {
1077 1077 va_start(adx, fmt);
1078 1078 (void) vstrlog(mid, sid, level, sl, fmt, adx);
1079 1079 va_end(adx);
1080 1080 ipss->ipsec_policy_failure_last = current;
1081 1081 }
1082 1082 }
1083 1083 }
1084 1084
1085 1085 void
1086 1086 ipsec_config_flush(netstack_t *ns)
1087 1087 {
1088 1088 ipsec_stack_t *ipss = ns->netstack_ipsec;
1089 1089
1090 1090 rw_enter(&ipss->ipsec_system_policy.iph_lock, RW_WRITER);
1091 1091 ipsec_polhead_flush(&ipss->ipsec_system_policy, ns);
1092 1092 ipss->ipsec_next_policy_index = 1;
1093 1093 rw_exit(&ipss->ipsec_system_policy.iph_lock);
1094 1094 ipsec_action_reclaim_stack(ipss);
1095 1095 }
1096 1096
1097 1097 /*
1098 1098 * Clip a policy's min/max keybits vs. the capabilities of the
1099 1099 * algorithm.
1100 1100 */
1101 1101 static void
1102 1102 act_alg_adjust(uint_t algtype, uint_t algid,
1103 1103 uint16_t *minbits, uint16_t *maxbits, netstack_t *ns)
1104 1104 {
1105 1105 ipsec_stack_t *ipss = ns->netstack_ipsec;
1106 1106 ipsec_alginfo_t *algp = ipss->ipsec_alglists[algtype][algid];
1107 1107
1108 1108 if (algp != NULL) {
1109 1109 /*
1110 1110 * If passed-in minbits is zero, we assume the caller trusts
1111 1111 * us with setting the minimum key size. We pick the
1112 1112 * algorithms DEFAULT key size for the minimum in this case.
1113 1113 */
1114 1114 if (*minbits == 0) {
1115 1115 *minbits = algp->alg_default_bits;
1116 1116 ASSERT(*minbits >= algp->alg_minbits);
1117 1117 } else {
1118 1118 *minbits = MAX(MIN(*minbits, algp->alg_maxbits),
1119 1119 algp->alg_minbits);
1120 1120 }
1121 1121 if (*maxbits == 0)
1122 1122 *maxbits = algp->alg_maxbits;
1123 1123 else
1124 1124 *maxbits = MIN(MAX(*maxbits, algp->alg_minbits),
1125 1125 algp->alg_maxbits);
1126 1126 ASSERT(*minbits <= *maxbits);
1127 1127 } else {
1128 1128 *minbits = 0;
1129 1129 *maxbits = 0;
1130 1130 }
1131 1131 }
1132 1132
1133 1133 /*
1134 1134 * Check an action's requested algorithms against the algorithms currently
1135 1135 * loaded in the system.
1136 1136 */
1137 1137 boolean_t
1138 1138 ipsec_check_action(ipsec_act_t *act, int *diag, netstack_t *ns)
1139 1139 {
1140 1140 ipsec_prot_t *ipp;
1141 1141 ipsec_stack_t *ipss = ns->netstack_ipsec;
1142 1142
1143 1143 ipp = &act->ipa_apply;
1144 1144
1145 1145 if (ipp->ipp_use_ah &&
1146 1146 ipss->ipsec_alglists[IPSEC_ALG_AUTH][ipp->ipp_auth_alg] == NULL) {
1147 1147 *diag = SPD_DIAGNOSTIC_UNSUPP_AH_ALG;
1148 1148 return (B_FALSE);
1149 1149 }
1150 1150 if (ipp->ipp_use_espa &&
1151 1151 ipss->ipsec_alglists[IPSEC_ALG_AUTH][ipp->ipp_esp_auth_alg] ==
1152 1152 NULL) {
1153 1153 *diag = SPD_DIAGNOSTIC_UNSUPP_ESP_AUTH_ALG;
1154 1154 return (B_FALSE);
1155 1155 }
1156 1156 if (ipp->ipp_use_esp &&
1157 1157 ipss->ipsec_alglists[IPSEC_ALG_ENCR][ipp->ipp_encr_alg] == NULL) {
1158 1158 *diag = SPD_DIAGNOSTIC_UNSUPP_ESP_ENCR_ALG;
1159 1159 return (B_FALSE);
1160 1160 }
1161 1161
1162 1162 act_alg_adjust(IPSEC_ALG_AUTH, ipp->ipp_auth_alg,
1163 1163 &ipp->ipp_ah_minbits, &ipp->ipp_ah_maxbits, ns);
1164 1164 act_alg_adjust(IPSEC_ALG_AUTH, ipp->ipp_esp_auth_alg,
1165 1165 &ipp->ipp_espa_minbits, &ipp->ipp_espa_maxbits, ns);
1166 1166 act_alg_adjust(IPSEC_ALG_ENCR, ipp->ipp_encr_alg,
1167 1167 &ipp->ipp_espe_minbits, &ipp->ipp_espe_maxbits, ns);
1168 1168
1169 1169 if (ipp->ipp_ah_minbits > ipp->ipp_ah_maxbits) {
1170 1170 *diag = SPD_DIAGNOSTIC_UNSUPP_AH_KEYSIZE;
1171 1171 return (B_FALSE);
1172 1172 }
1173 1173 if (ipp->ipp_espa_minbits > ipp->ipp_espa_maxbits) {
1174 1174 *diag = SPD_DIAGNOSTIC_UNSUPP_ESP_AUTH_KEYSIZE;
1175 1175 return (B_FALSE);
1176 1176 }
1177 1177 if (ipp->ipp_espe_minbits > ipp->ipp_espe_maxbits) {
1178 1178 *diag = SPD_DIAGNOSTIC_UNSUPP_ESP_ENCR_KEYSIZE;
1179 1179 return (B_FALSE);
1180 1180 }
1181 1181 /* TODO: sanity check lifetimes */
1182 1182 return (B_TRUE);
1183 1183 }
1184 1184
1185 1185 /*
1186 1186 * Set up a single action during wildcard expansion..
1187 1187 */
1188 1188 static void
1189 1189 ipsec_setup_act(ipsec_act_t *outact, ipsec_act_t *act,
1190 1190 uint_t auth_alg, uint_t encr_alg, uint_t eauth_alg, netstack_t *ns)
1191 1191 {
1192 1192 ipsec_prot_t *ipp;
1193 1193
1194 1194 *outact = *act;
1195 1195 ipp = &outact->ipa_apply;
1196 1196 ipp->ipp_auth_alg = (uint8_t)auth_alg;
1197 1197 ipp->ipp_encr_alg = (uint8_t)encr_alg;
1198 1198 ipp->ipp_esp_auth_alg = (uint8_t)eauth_alg;
1199 1199
1200 1200 act_alg_adjust(IPSEC_ALG_AUTH, auth_alg,
1201 1201 &ipp->ipp_ah_minbits, &ipp->ipp_ah_maxbits, ns);
1202 1202 act_alg_adjust(IPSEC_ALG_AUTH, eauth_alg,
1203 1203 &ipp->ipp_espa_minbits, &ipp->ipp_espa_maxbits, ns);
1204 1204 act_alg_adjust(IPSEC_ALG_ENCR, encr_alg,
1205 1205 &ipp->ipp_espe_minbits, &ipp->ipp_espe_maxbits, ns);
1206 1206 }
1207 1207
1208 1208 /*
1209 1209 * combinatoric expansion time: expand a wildcarded action into an
1210 1210 * array of wildcarded actions; we return the exploded action list,
1211 1211 * and return a count in *nact (output only).
1212 1212 */
1213 1213 static ipsec_act_t *
1214 1214 ipsec_act_wildcard_expand(ipsec_act_t *act, uint_t *nact, netstack_t *ns)
1215 1215 {
1216 1216 boolean_t use_ah, use_esp, use_espa;
1217 1217 boolean_t wild_auth, wild_encr, wild_eauth;
1218 1218 uint_t auth_alg, auth_idx, auth_min, auth_max;
1219 1219 uint_t eauth_alg, eauth_idx, eauth_min, eauth_max;
1220 1220 uint_t encr_alg, encr_idx, encr_min, encr_max;
1221 1221 uint_t action_count, ai;
1222 1222 ipsec_act_t *outact;
1223 1223 ipsec_stack_t *ipss = ns->netstack_ipsec;
1224 1224
1225 1225 if (act->ipa_type != IPSEC_ACT_APPLY) {
1226 1226 outact = kmem_alloc(sizeof (*act), KM_NOSLEEP);
1227 1227 *nact = 1;
1228 1228 if (outact != NULL)
1229 1229 bcopy(act, outact, sizeof (*act));
1230 1230 return (outact);
1231 1231 }
1232 1232 /*
1233 1233 * compute the combinatoric explosion..
1234 1234 *
1235 1235 * we assume a request for encr if esp_req is PREF_REQUIRED
1236 1236 * we assume a request for ah auth if ah_req is PREF_REQUIRED.
1237 1237 * we assume a request for esp auth if !ah and esp_req is PREF_REQUIRED
1238 1238 */
1239 1239
1240 1240 use_ah = act->ipa_apply.ipp_use_ah;
1241 1241 use_esp = act->ipa_apply.ipp_use_esp;
1242 1242 use_espa = act->ipa_apply.ipp_use_espa;
1243 1243 auth_alg = act->ipa_apply.ipp_auth_alg;
1244 1244 eauth_alg = act->ipa_apply.ipp_esp_auth_alg;
1245 1245 encr_alg = act->ipa_apply.ipp_encr_alg;
1246 1246
1247 1247 wild_auth = use_ah && (auth_alg == 0);
1248 1248 wild_eauth = use_espa && (eauth_alg == 0);
1249 1249 wild_encr = use_esp && (encr_alg == 0);
1250 1250
1251 1251 action_count = 1;
1252 1252 auth_min = auth_max = auth_alg;
1253 1253 eauth_min = eauth_max = eauth_alg;
1254 1254 encr_min = encr_max = encr_alg;
1255 1255
1256 1256 /*
1257 1257 * set up for explosion.. for each dimension, expand output
1258 1258 * size by the explosion factor.
1259 1259 *
1260 1260 * Don't include the "any" algorithms, if defined, as no
1261 1261 * kernel policies should be set for these algorithms.
1262 1262 */
1263 1263
1264 1264 #define SET_EXP_MINMAX(type, wild, alg, min, max, ipss) \
1265 1265 if (wild) { \
1266 1266 int nalgs = ipss->ipsec_nalgs[type]; \
1267 1267 if (ipss->ipsec_alglists[type][alg] != NULL) \
1268 1268 nalgs--; \
1269 1269 action_count *= nalgs; \
1270 1270 min = 0; \
1271 1271 max = ipss->ipsec_nalgs[type] - 1; \
1272 1272 }
1273 1273
1274 1274 SET_EXP_MINMAX(IPSEC_ALG_AUTH, wild_auth, SADB_AALG_NONE,
1275 1275 auth_min, auth_max, ipss);
1276 1276 SET_EXP_MINMAX(IPSEC_ALG_AUTH, wild_eauth, SADB_AALG_NONE,
1277 1277 eauth_min, eauth_max, ipss);
1278 1278 SET_EXP_MINMAX(IPSEC_ALG_ENCR, wild_encr, SADB_EALG_NONE,
1279 1279 encr_min, encr_max, ipss);
1280 1280
1281 1281 #undef SET_EXP_MINMAX
1282 1282
1283 1283 /*
1284 1284 * ok, allocate the whole mess..
1285 1285 */
1286 1286
1287 1287 outact = kmem_alloc(sizeof (*outact) * action_count, KM_NOSLEEP);
1288 1288 if (outact == NULL)
1289 1289 return (NULL);
1290 1290
1291 1291 /*
1292 1292 * Now compute all combinations. Note that non-wildcarded
1293 1293 * dimensions just get a single value from auth_min, while
1294 1294 * wildcarded dimensions indirect through the sortlist.
1295 1295 *
1296 1296 * We do encryption outermost since, at this time, there's
1297 1297 * greater difference in security and performance between
1298 1298 * encryption algorithms vs. authentication algorithms.
1299 1299 */
1300 1300
1301 1301 ai = 0;
1302 1302
1303 1303 #define WHICH_ALG(type, wild, idx, ipss) \
1304 1304 ((wild)?(ipss->ipsec_sortlist[type][idx]):(idx))
1305 1305
1306 1306 for (encr_idx = encr_min; encr_idx <= encr_max; encr_idx++) {
1307 1307 encr_alg = WHICH_ALG(IPSEC_ALG_ENCR, wild_encr, encr_idx, ipss);
1308 1308 if (wild_encr && encr_alg == SADB_EALG_NONE)
1309 1309 continue;
1310 1310 for (auth_idx = auth_min; auth_idx <= auth_max; auth_idx++) {
1311 1311 auth_alg = WHICH_ALG(IPSEC_ALG_AUTH, wild_auth,
1312 1312 auth_idx, ipss);
1313 1313 if (wild_auth && auth_alg == SADB_AALG_NONE)
1314 1314 continue;
1315 1315 for (eauth_idx = eauth_min; eauth_idx <= eauth_max;
1316 1316 eauth_idx++) {
1317 1317 eauth_alg = WHICH_ALG(IPSEC_ALG_AUTH,
1318 1318 wild_eauth, eauth_idx, ipss);
1319 1319 if (wild_eauth && eauth_alg == SADB_AALG_NONE)
1320 1320 continue;
1321 1321
1322 1322 ipsec_setup_act(&outact[ai], act,
1323 1323 auth_alg, encr_alg, eauth_alg, ns);
1324 1324 ai++;
1325 1325 }
1326 1326 }
1327 1327 }
1328 1328
1329 1329 #undef WHICH_ALG
1330 1330
1331 1331 ASSERT(ai == action_count);
1332 1332 *nact = action_count;
1333 1333 return (outact);
1334 1334 }
1335 1335
1336 1336 /*
1337 1337 * Extract the parts of an ipsec_prot_t from an old-style ipsec_req_t.
1338 1338 */
1339 1339 static void
1340 1340 ipsec_prot_from_req(const ipsec_req_t *req, ipsec_prot_t *ipp)
1341 1341 {
1342 1342 bzero(ipp, sizeof (*ipp));
1343 1343 /*
1344 1344 * ipp_use_* are bitfields. Look at "!!" in the following as a
1345 1345 * "boolean canonicalization" operator.
1346 1346 */
1347 1347 ipp->ipp_use_ah = !!(req->ipsr_ah_req & IPSEC_PREF_REQUIRED);
1348 1348 ipp->ipp_use_esp = !!(req->ipsr_esp_req & IPSEC_PREF_REQUIRED);
1349 1349 ipp->ipp_use_espa = !!(req->ipsr_esp_auth_alg);
1350 1350 ipp->ipp_use_se = !!(req->ipsr_self_encap_req & IPSEC_PREF_REQUIRED);
1351 1351 ipp->ipp_use_unique = !!((req->ipsr_ah_req|req->ipsr_esp_req) &
1352 1352 IPSEC_PREF_UNIQUE);
1353 1353 ipp->ipp_encr_alg = req->ipsr_esp_alg;
1354 1354 /*
1355 1355 * SADB_AALG_ANY is a placeholder to distinguish "any" from
1356 1356 * "none" above. If auth is required, as determined above,
1357 1357 * SADB_AALG_ANY becomes 0, which is the representation
1358 1358 * of "any" and "none" in PF_KEY v2.
1359 1359 */
1360 1360 ipp->ipp_auth_alg = (req->ipsr_auth_alg != SADB_AALG_ANY) ?
1361 1361 req->ipsr_auth_alg : 0;
1362 1362 ipp->ipp_esp_auth_alg = (req->ipsr_esp_auth_alg != SADB_AALG_ANY) ?
1363 1363 req->ipsr_esp_auth_alg : 0;
1364 1364 }
1365 1365
1366 1366 /*
1367 1367 * Extract a new-style action from a request.
1368 1368 */
1369 1369 void
1370 1370 ipsec_actvec_from_req(const ipsec_req_t *req, ipsec_act_t **actp, uint_t *nactp,
1371 1371 netstack_t *ns)
1372 1372 {
1373 1373 struct ipsec_act act;
1374 1374
1375 1375 bzero(&act, sizeof (act));
1376 1376 if ((req->ipsr_ah_req & IPSEC_PREF_NEVER) &&
1377 1377 (req->ipsr_esp_req & IPSEC_PREF_NEVER)) {
1378 1378 act.ipa_type = IPSEC_ACT_BYPASS;
1379 1379 } else {
1380 1380 act.ipa_type = IPSEC_ACT_APPLY;
1381 1381 ipsec_prot_from_req(req, &act.ipa_apply);
1382 1382 }
1383 1383 *actp = ipsec_act_wildcard_expand(&act, nactp, ns);
1384 1384 }
1385 1385
1386 1386 /*
1387 1387 * Convert a new-style "prot" back to an ipsec_req_t (more backwards compat).
1388 1388 * We assume caller has already zero'ed *req for us.
1389 1389 */
1390 1390 static int
1391 1391 ipsec_req_from_prot(ipsec_prot_t *ipp, ipsec_req_t *req)
1392 1392 {
1393 1393 req->ipsr_esp_alg = ipp->ipp_encr_alg;
1394 1394 req->ipsr_auth_alg = ipp->ipp_auth_alg;
1395 1395 req->ipsr_esp_auth_alg = ipp->ipp_esp_auth_alg;
1396 1396
1397 1397 if (ipp->ipp_use_unique) {
1398 1398 req->ipsr_ah_req |= IPSEC_PREF_UNIQUE;
1399 1399 req->ipsr_esp_req |= IPSEC_PREF_UNIQUE;
1400 1400 }
1401 1401 if (ipp->ipp_use_se)
1402 1402 req->ipsr_self_encap_req |= IPSEC_PREF_REQUIRED;
1403 1403 if (ipp->ipp_use_ah)
1404 1404 req->ipsr_ah_req |= IPSEC_PREF_REQUIRED;
1405 1405 if (ipp->ipp_use_esp)
1406 1406 req->ipsr_esp_req |= IPSEC_PREF_REQUIRED;
1407 1407 return (sizeof (*req));
1408 1408 }
1409 1409
1410 1410 /*
1411 1411 * Convert a new-style action back to an ipsec_req_t (more backwards compat).
1412 1412 * We assume caller has already zero'ed *req for us.
1413 1413 */
1414 1414 static int
1415 1415 ipsec_req_from_act(ipsec_action_t *ap, ipsec_req_t *req)
1416 1416 {
1417 1417 switch (ap->ipa_act.ipa_type) {
1418 1418 case IPSEC_ACT_BYPASS:
1419 1419 req->ipsr_ah_req = IPSEC_PREF_NEVER;
1420 1420 req->ipsr_esp_req = IPSEC_PREF_NEVER;
1421 1421 return (sizeof (*req));
1422 1422 case IPSEC_ACT_APPLY:
1423 1423 return (ipsec_req_from_prot(&ap->ipa_act.ipa_apply, req));
1424 1424 }
1425 1425 return (sizeof (*req));
1426 1426 }
1427 1427
1428 1428 /*
1429 1429 * Convert a new-style action back to an ipsec_req_t (more backwards compat).
1430 1430 * We assume caller has already zero'ed *req for us.
1431 1431 */
1432 1432 int
1433 1433 ipsec_req_from_head(ipsec_policy_head_t *ph, ipsec_req_t *req, int af)
1434 1434 {
1435 1435 ipsec_policy_t *p;
1436 1436
1437 1437 /*
1438 1438 * FULL-PERSOCK: consult hash table, too?
1439 1439 */
1440 1440 for (p = ph->iph_root[IPSEC_INBOUND].ipr_nonhash[af];
1441 1441 p != NULL;
1442 1442 p = p->ipsp_hash.hash_next) {
1443 1443 if ((p->ipsp_sel->ipsl_key.ipsl_valid & IPSL_WILDCARD) == 0)
1444 1444 return (ipsec_req_from_act(p->ipsp_act, req));
1445 1445 }
1446 1446 return (sizeof (*req));
1447 1447 }
1448 1448
1449 1449 /*
1450 1450 * Based on per-socket or latched policy, convert to an appropriate
1451 1451 * IP_SEC_OPT ipsec_req_t for the socket option; return size so we can
1452 1452 * be tail-called from ip.
1453 1453 */
1454 1454 int
1455 1455 ipsec_req_from_conn(conn_t *connp, ipsec_req_t *req, int af)
1456 1456 {
1457 1457 ipsec_latch_t *ipl;
1458 1458 int rv = sizeof (ipsec_req_t);
1459 1459
1460 1460 bzero(req, sizeof (*req));
1461 1461
1462 1462 ASSERT(MUTEX_HELD(&connp->conn_lock));
1463 1463 ipl = connp->conn_latch;
1464 1464
1465 1465 /*
1466 1466 * Find appropriate policy. First choice is latched action;
1467 1467 * failing that, see latched policy; failing that,
1468 1468 * look at configured policy.
1469 1469 */
1470 1470 if (ipl != NULL) {
1471 1471 if (connp->conn_latch_in_action != NULL) {
1472 1472 rv = ipsec_req_from_act(connp->conn_latch_in_action,
1473 1473 req);
1474 1474 goto done;
1475 1475 }
1476 1476 if (connp->conn_latch_in_policy != NULL) {
1477 1477 rv = ipsec_req_from_act(
1478 1478 connp->conn_latch_in_policy->ipsp_act, req);
1479 1479 goto done;
1480 1480 }
1481 1481 }
1482 1482 if (connp->conn_policy != NULL)
1483 1483 rv = ipsec_req_from_head(connp->conn_policy, req, af);
1484 1484 done:
1485 1485 return (rv);
1486 1486 }
1487 1487
1488 1488 void
1489 1489 ipsec_actvec_free(ipsec_act_t *act, uint_t nact)
1490 1490 {
1491 1491 kmem_free(act, nact * sizeof (*act));
1492 1492 }
1493 1493
1494 1494 /*
1495 1495 * Consumes a reference to ipsp.
1496 1496 */
1497 1497 static mblk_t *
1498 1498 ipsec_check_loopback_policy(mblk_t *data_mp, ip_recv_attr_t *ira,
1499 1499 ipsec_policy_t *ipsp)
1500 1500 {
1501 1501 if (!(ira->ira_flags & IRAF_IPSEC_SECURE))
1502 1502 return (data_mp);
1503 1503
1504 1504 ASSERT(ira->ira_flags & IRAF_LOOPBACK);
1505 1505
1506 1506 IPPOL_REFRELE(ipsp);
1507 1507
1508 1508 /*
1509 1509 * We should do an actual policy check here. Revisit this
1510 1510 * when we revisit the IPsec API. (And pass a conn_t in when we
1511 1511 * get there.)
1512 1512 */
1513 1513
1514 1514 return (data_mp);
1515 1515 }
1516 1516
1517 1517 /*
1518 1518 * Check that packet's inbound ports & proto match the selectors
1519 1519 * expected by the SAs it traversed on the way in.
1520 1520 */
1521 1521 static boolean_t
1522 1522 ipsec_check_ipsecin_unique(ip_recv_attr_t *ira, const char **reason,
1523 1523 kstat_named_t **counter, uint64_t pkt_unique, netstack_t *ns)
1524 1524 {
1525 1525 uint64_t ah_mask, esp_mask;
1526 1526 ipsa_t *ah_assoc;
1527 1527 ipsa_t *esp_assoc;
1528 1528 ipsec_stack_t *ipss = ns->netstack_ipsec;
1529 1529
1530 1530 ASSERT(ira->ira_flags & IRAF_IPSEC_SECURE);
1531 1531 ASSERT(!(ira->ira_flags & IRAF_LOOPBACK));
1532 1532
1533 1533 ah_assoc = ira->ira_ipsec_ah_sa;
1534 1534 esp_assoc = ira->ira_ipsec_esp_sa;
1535 1535 ASSERT((ah_assoc != NULL) || (esp_assoc != NULL));
1536 1536
1537 1537 ah_mask = (ah_assoc != NULL) ? ah_assoc->ipsa_unique_mask : 0;
1538 1538 esp_mask = (esp_assoc != NULL) ? esp_assoc->ipsa_unique_mask : 0;
1539 1539
1540 1540 if ((ah_mask == 0) && (esp_mask == 0))
1541 1541 return (B_TRUE);
1542 1542
1543 1543 /*
1544 1544 * The pkt_unique check will also check for tunnel mode on the SA
1545 1545 * vs. the tunneled_packet boolean. "Be liberal in what you receive"
1546 1546 * should not apply in this case. ;)
1547 1547 */
1548 1548
1549 1549 if (ah_mask != 0 &&
1550 1550 ah_assoc->ipsa_unique_id != (pkt_unique & ah_mask)) {
1551 1551 *reason = "AH inner header mismatch";
1552 1552 *counter = DROPPER(ipss, ipds_spd_ah_innermismatch);
1553 1553 return (B_FALSE);
1554 1554 }
1555 1555 if (esp_mask != 0 &&
1556 1556 esp_assoc->ipsa_unique_id != (pkt_unique & esp_mask)) {
1557 1557 *reason = "ESP inner header mismatch";
1558 1558 *counter = DROPPER(ipss, ipds_spd_esp_innermismatch);
1559 1559 return (B_FALSE);
1560 1560 }
1561 1561 return (B_TRUE);
1562 1562 }
1563 1563
1564 1564 static boolean_t
1565 1565 ipsec_check_ipsecin_action(ip_recv_attr_t *ira, mblk_t *mp, ipsec_action_t *ap,
1566 1566 ipha_t *ipha, ip6_t *ip6h, const char **reason, kstat_named_t **counter,
1567 1567 netstack_t *ns)
1568 1568 {
1569 1569 boolean_t ret = B_TRUE;
1570 1570 ipsec_prot_t *ipp;
1571 1571 ipsa_t *ah_assoc;
1572 1572 ipsa_t *esp_assoc;
1573 1573 boolean_t decaps;
1574 1574 ipsec_stack_t *ipss = ns->netstack_ipsec;
1575 1575
1576 1576 ASSERT((ipha == NULL && ip6h != NULL) ||
1577 1577 (ip6h == NULL && ipha != NULL));
1578 1578
1579 1579 if (ira->ira_flags & IRAF_LOOPBACK) {
1580 1580 /*
1581 1581 * Besides accepting pointer-equivalent actions, we also
1582 1582 * accept any ICMP errors we generated for ourselves,
1583 1583 * regardless of policy. If we do not wish to make this
1584 1584 * assumption in the future, check here, and where
1585 1585 * IXAF_TRUSTED_ICMP is initialized in ip.c and ip6.c.
1586 1586 */
1587 1587 if (ap == ira->ira_ipsec_action ||
1588 1588 (ira->ira_flags & IRAF_TRUSTED_ICMP))
1589 1589 return (B_TRUE);
1590 1590
1591 1591 /* Deep compare necessary here?? */
1592 1592 *counter = DROPPER(ipss, ipds_spd_loopback_mismatch);
1593 1593 *reason = "loopback policy mismatch";
1594 1594 return (B_FALSE);
1595 1595 }
1596 1596 ASSERT(!(ira->ira_flags & IRAF_TRUSTED_ICMP));
1597 1597 ASSERT(ira->ira_flags & IRAF_IPSEC_SECURE);
1598 1598
1599 1599 ah_assoc = ira->ira_ipsec_ah_sa;
1600 1600 esp_assoc = ira->ira_ipsec_esp_sa;
1601 1601
1602 1602 decaps = (ira->ira_flags & IRAF_IPSEC_DECAPS);
1603 1603
1604 1604 switch (ap->ipa_act.ipa_type) {
1605 1605 case IPSEC_ACT_DISCARD:
1606 1606 case IPSEC_ACT_REJECT:
1607 1607 /* Should "fail hard" */
1608 1608 *counter = DROPPER(ipss, ipds_spd_explicit);
1609 1609 *reason = "blocked by policy";
1610 1610 return (B_FALSE);
1611 1611
1612 1612 case IPSEC_ACT_BYPASS:
1613 1613 case IPSEC_ACT_CLEAR:
1614 1614 *counter = DROPPER(ipss, ipds_spd_got_secure);
1615 1615 *reason = "expected clear, got protected";
1616 1616 return (B_FALSE);
1617 1617
1618 1618 case IPSEC_ACT_APPLY:
1619 1619 ipp = &ap->ipa_act.ipa_apply;
1620 1620 /*
1621 1621 * As of now we do the simple checks of whether
1622 1622 * the datagram has gone through the required IPSEC
1623 1623 * protocol constraints or not. We might have more
1624 1624 * in the future like sensitive levels, key bits, etc.
1625 1625 * If it fails the constraints, check whether we would
1626 1626 * have accepted this if it had come in clear.
1627 1627 */
1628 1628 if (ipp->ipp_use_ah) {
1629 1629 if (ah_assoc == NULL) {
1630 1630 ret = ipsec_inbound_accept_clear(mp, ipha,
1631 1631 ip6h);
1632 1632 *counter = DROPPER(ipss, ipds_spd_got_clear);
1633 1633 *reason = "unprotected not accepted";
1634 1634 break;
1635 1635 }
1636 1636 ASSERT(ah_assoc != NULL);
1637 1637 ASSERT(ipp->ipp_auth_alg != 0);
1638 1638
1639 1639 if (ah_assoc->ipsa_auth_alg !=
1640 1640 ipp->ipp_auth_alg) {
1641 1641 *counter = DROPPER(ipss, ipds_spd_bad_ahalg);
1642 1642 *reason = "unacceptable ah alg";
1643 1643 ret = B_FALSE;
1644 1644 break;
1645 1645 }
1646 1646 } else if (ah_assoc != NULL) {
1647 1647 /*
1648 1648 * Don't allow this. Check IPSEC NOTE above
1649 1649 * ip_fanout_proto().
1650 1650 */
1651 1651 *counter = DROPPER(ipss, ipds_spd_got_ah);
1652 1652 *reason = "unexpected AH";
1653 1653 ret = B_FALSE;
1654 1654 break;
1655 1655 }
1656 1656 if (ipp->ipp_use_esp) {
1657 1657 if (esp_assoc == NULL) {
1658 1658 ret = ipsec_inbound_accept_clear(mp, ipha,
1659 1659 ip6h);
1660 1660 *counter = DROPPER(ipss, ipds_spd_got_clear);
1661 1661 *reason = "unprotected not accepted";
1662 1662 break;
1663 1663 }
1664 1664 ASSERT(esp_assoc != NULL);
1665 1665 ASSERT(ipp->ipp_encr_alg != 0);
1666 1666
1667 1667 if (esp_assoc->ipsa_encr_alg !=
1668 1668 ipp->ipp_encr_alg) {
1669 1669 *counter = DROPPER(ipss, ipds_spd_bad_espealg);
1670 1670 *reason = "unacceptable esp alg";
1671 1671 ret = B_FALSE;
1672 1672 break;
1673 1673 }
1674 1674 /*
1675 1675 * If the client does not need authentication,
1676 1676 * we don't verify the alogrithm.
1677 1677 */
1678 1678 if (ipp->ipp_use_espa) {
1679 1679 if (esp_assoc->ipsa_auth_alg !=
1680 1680 ipp->ipp_esp_auth_alg) {
1681 1681 *counter = DROPPER(ipss,
1682 1682 ipds_spd_bad_espaalg);
1683 1683 *reason = "unacceptable esp auth alg";
1684 1684 ret = B_FALSE;
1685 1685 break;
1686 1686 }
1687 1687 }
1688 1688 } else if (esp_assoc != NULL) {
1689 1689 /*
1690 1690 * Don't allow this. Check IPSEC NOTE above
1691 1691 * ip_fanout_proto().
1692 1692 */
1693 1693 *counter = DROPPER(ipss, ipds_spd_got_esp);
1694 1694 *reason = "unexpected ESP";
1695 1695 ret = B_FALSE;
1696 1696 break;
1697 1697 }
1698 1698 if (ipp->ipp_use_se) {
1699 1699 if (!decaps) {
1700 1700 ret = ipsec_inbound_accept_clear(mp, ipha,
1701 1701 ip6h);
1702 1702 if (!ret) {
1703 1703 /* XXX mutant? */
1704 1704 *counter = DROPPER(ipss,
1705 1705 ipds_spd_bad_selfencap);
1706 1706 *reason = "self encap not found";
1707 1707 break;
1708 1708 }
1709 1709 }
1710 1710 } else if (decaps) {
1711 1711 /*
1712 1712 * XXX If the packet comes in tunneled and the
1713 1713 * recipient does not expect it to be tunneled, it
1714 1714 * is okay. But we drop to be consistent with the
1715 1715 * other cases.
1716 1716 */
1717 1717 *counter = DROPPER(ipss, ipds_spd_got_selfencap);
1718 1718 *reason = "unexpected self encap";
1719 1719 ret = B_FALSE;
1720 1720 break;
1721 1721 }
1722 1722 if (ira->ira_ipsec_action != NULL) {
1723 1723 /*
1724 1724 * This can happen if we do a double policy-check on
1725 1725 * a packet
1726 1726 * XXX XXX should fix this case!
1727 1727 */
1728 1728 IPACT_REFRELE(ira->ira_ipsec_action);
1729 1729 }
1730 1730 ASSERT(ira->ira_flags & IRAF_IPSEC_SECURE);
1731 1731 ASSERT(ira->ira_ipsec_action == NULL);
1732 1732 IPACT_REFHOLD(ap);
1733 1733 ira->ira_ipsec_action = ap;
1734 1734 break; /* from switch */
1735 1735 }
1736 1736 return (ret);
1737 1737 }
1738 1738
1739 1739 static boolean_t
1740 1740 spd_match_inbound_ids(ipsec_latch_t *ipl, ipsa_t *sa)
1741 1741 {
1742 1742 ASSERT(ipl->ipl_ids_latched == B_TRUE);
1743 1743 return ipsid_equal(ipl->ipl_remote_cid, sa->ipsa_src_cid) &&
1744 1744 ipsid_equal(ipl->ipl_local_cid, sa->ipsa_dst_cid);
1745 1745 }
1746 1746
1747 1747 /*
1748 1748 * Takes a latched conn and an inbound packet and returns a unique_id suitable
1749 1749 * for SA comparisons. Most of the time we will copy from the conn_t, but
1750 1750 * there are cases when the conn_t is latched but it has wildcard selectors,
1751 1751 * and then we need to fallback to scooping them out of the packet.
1752 1752 *
1753 1753 * Assume we'll never have 0 with a conn_t present, so use 0 as a failure. We
1754 1754 * can get away with this because we only have non-zero ports/proto for
1755 1755 * latched conn_ts.
1756 1756 *
1757 1757 * Ideal candidate for an "inline" keyword, as we're JUST convoluted enough
1758 1758 * to not be a nice macro.
1759 1759 */
1760 1760 static uint64_t
1761 1761 conn_to_unique(conn_t *connp, mblk_t *data_mp, ipha_t *ipha, ip6_t *ip6h)
1762 1762 {
1763 1763 ipsec_selector_t sel;
1764 1764 uint8_t ulp = connp->conn_proto;
1765 1765
1766 1766 ASSERT(connp->conn_latch_in_policy != NULL);
1767 1767
1768 1768 if ((ulp == IPPROTO_TCP || ulp == IPPROTO_UDP || ulp == IPPROTO_SCTP) &&
1769 1769 (connp->conn_fport == 0 || connp->conn_lport == 0)) {
1770 1770 /* Slow path - we gotta grab from the packet. */
1771 1771 if (ipsec_init_inbound_sel(&sel, data_mp, ipha, ip6h,
1772 1772 SEL_NONE) != SELRET_SUCCESS) {
1773 1773 /* Failure -> have caller free packet with ENOMEM. */
1774 1774 return (0);
1775 1775 }
1776 1776 return (SA_UNIQUE_ID(sel.ips_remote_port, sel.ips_local_port,
1777 1777 sel.ips_protocol, 0));
1778 1778 }
1779 1779
1780 1780 #ifdef DEBUG_NOT_UNTIL_6478464
1781 1781 if (ipsec_init_inbound_sel(&sel, data_mp, ipha, ip6h, SEL_NONE) ==
1782 1782 SELRET_SUCCESS) {
1783 1783 ASSERT(sel.ips_local_port == connp->conn_lport);
1784 1784 ASSERT(sel.ips_remote_port == connp->conn_fport);
1785 1785 ASSERT(sel.ips_protocol == connp->conn_proto);
1786 1786 }
1787 1787 ASSERT(connp->conn_proto != 0);
1788 1788 #endif
1789 1789
1790 1790 return (SA_UNIQUE_ID(connp->conn_fport, connp->conn_lport, ulp, 0));
1791 1791 }
1792 1792
1793 1793 /*
1794 1794 * Called to check policy on a latched connection.
1795 1795 * Note that we don't dereference conn_latch or conn_ihere since the conn might
1796 1796 * be closing. The caller passes a held ipsec_latch_t instead.
1797 1797 */
1798 1798 static boolean_t
1799 1799 ipsec_check_ipsecin_latch(ip_recv_attr_t *ira, mblk_t *mp, ipsec_latch_t *ipl,
1800 1800 ipsec_action_t *ap, ipha_t *ipha, ip6_t *ip6h, const char **reason,
1801 1801 kstat_named_t **counter, conn_t *connp, netstack_t *ns)
1802 1802 {
1803 1803 ipsec_stack_t *ipss = ns->netstack_ipsec;
1804 1804
1805 1805 ASSERT(ipl->ipl_ids_latched == B_TRUE);
1806 1806 ASSERT(ira->ira_flags & IRAF_IPSEC_SECURE);
1807 1807
1808 1808 if (!(ira->ira_flags & IRAF_LOOPBACK)) {
1809 1809 /*
1810 1810 * Over loopback, there aren't real security associations,
1811 1811 * so there are neither identities nor "unique" values
1812 1812 * for us to check the packet against.
1813 1813 */
1814 1814 if (ira->ira_ipsec_ah_sa != NULL) {
1815 1815 if (!spd_match_inbound_ids(ipl,
1816 1816 ira->ira_ipsec_ah_sa)) {
1817 1817 *counter = DROPPER(ipss, ipds_spd_ah_badid);
1818 1818 *reason = "AH identity mismatch";
1819 1819 return (B_FALSE);
1820 1820 }
1821 1821 }
1822 1822
1823 1823 if (ira->ira_ipsec_esp_sa != NULL) {
1824 1824 if (!spd_match_inbound_ids(ipl,
1825 1825 ira->ira_ipsec_esp_sa)) {
1826 1826 *counter = DROPPER(ipss, ipds_spd_esp_badid);
1827 1827 *reason = "ESP identity mismatch";
1828 1828 return (B_FALSE);
1829 1829 }
1830 1830 }
1831 1831
1832 1832 /*
1833 1833 * Can fudge pkt_unique from connp because we're latched.
1834 1834 * In DEBUG kernels (see conn_to_unique()'s implementation),
1835 1835 * verify this even if it REALLY slows things down.
1836 1836 */
1837 1837 if (!ipsec_check_ipsecin_unique(ira, reason, counter,
1838 1838 conn_to_unique(connp, mp, ipha, ip6h), ns)) {
1839 1839 return (B_FALSE);
1840 1840 }
1841 1841 }
1842 1842 return (ipsec_check_ipsecin_action(ira, mp, ap, ipha, ip6h, reason,
1843 1843 counter, ns));
1844 1844 }
1845 1845
1846 1846 /*
1847 1847 * Check to see whether this secured datagram meets the policy
1848 1848 * constraints specified in ipsp.
1849 1849 *
1850 1850 * Called from ipsec_check_global_policy, and ipsec_check_inbound_policy.
1851 1851 *
1852 1852 * Consumes a reference to ipsp.
1853 1853 * Returns the mblk if ok.
1854 1854 */
1855 1855 static mblk_t *
1856 1856 ipsec_check_ipsecin_policy(mblk_t *data_mp, ipsec_policy_t *ipsp,
1857 1857 ipha_t *ipha, ip6_t *ip6h, uint64_t pkt_unique, ip_recv_attr_t *ira,
1858 1858 netstack_t *ns)
1859 1859 {
1860 1860 ipsec_action_t *ap;
1861 1861 const char *reason = "no policy actions found";
1862 1862 ip_stack_t *ipst = ns->netstack_ip;
1863 1863 ipsec_stack_t *ipss = ns->netstack_ipsec;
1864 1864 kstat_named_t *counter;
1865 1865
1866 1866 counter = DROPPER(ipss, ipds_spd_got_secure);
1867 1867
1868 1868 ASSERT(ipsp != NULL);
1869 1869
1870 1870 ASSERT((ipha == NULL && ip6h != NULL) ||
1871 1871 (ip6h == NULL && ipha != NULL));
1872 1872
1873 1873 if (ira->ira_flags & IRAF_LOOPBACK)
1874 1874 return (ipsec_check_loopback_policy(data_mp, ira, ipsp));
1875 1875
1876 1876 ASSERT(ira->ira_flags & IRAF_IPSEC_SECURE);
1877 1877
1878 1878 if (ira->ira_ipsec_action != NULL) {
1879 1879 /*
1880 1880 * this can happen if we do a double policy-check on a packet
1881 1881 * Would be nice to be able to delete this test..
1882 1882 */
1883 1883 IPACT_REFRELE(ira->ira_ipsec_action);
1884 1884 }
1885 1885 ASSERT(ira->ira_ipsec_action == NULL);
1886 1886
1887 1887 if (!SA_IDS_MATCH(ira->ira_ipsec_ah_sa, ira->ira_ipsec_esp_sa)) {
1888 1888 reason = "inbound AH and ESP identities differ";
1889 1889 counter = DROPPER(ipss, ipds_spd_ahesp_diffid);
1890 1890 goto drop;
1891 1891 }
1892 1892
1893 1893 if (!ipsec_check_ipsecin_unique(ira, &reason, &counter, pkt_unique,
1894 1894 ns))
1895 1895 goto drop;
1896 1896
1897 1897 /*
1898 1898 * Ok, now loop through the possible actions and see if any
1899 1899 * of them work for us.
1900 1900 */
1901 1901
1902 1902 for (ap = ipsp->ipsp_act; ap != NULL; ap = ap->ipa_next) {
1903 1903 if (ipsec_check_ipsecin_action(ira, data_mp, ap,
1904 1904 ipha, ip6h, &reason, &counter, ns)) {
1905 1905 BUMP_MIB(&ipst->ips_ip_mib, ipsecInSucceeded);
1906 1906 IPPOL_REFRELE(ipsp);
1907 1907 return (data_mp);
1908 1908 }
1909 1909 }
1910 1910 drop:
1911 1911 ipsec_rl_strlog(ns, IP_MOD_ID, 0, 0, SL_ERROR|SL_WARN|SL_CONSOLE,
1912 1912 "ipsec inbound policy mismatch: %s, packet dropped\n",
1913 1913 reason);
1914 1914 IPPOL_REFRELE(ipsp);
1915 1915 ASSERT(ira->ira_ipsec_action == NULL);
1916 1916 BUMP_MIB(&ipst->ips_ip_mib, ipsecInFailed);
1917 1917 ip_drop_packet(data_mp, B_TRUE, NULL, counter,
1918 1918 &ipss->ipsec_spd_dropper);
1919 1919 return (NULL);
1920 1920 }
1921 1921
1922 1922 /*
1923 1923 * sleazy prefix-length-based compare.
1924 1924 * another inlining candidate..
1925 1925 */
1926 1926 boolean_t
1927 1927 ip_addr_match(uint8_t *addr1, int pfxlen, in6_addr_t *addr2p)
1928 1928 {
1929 1929 int offset = pfxlen>>3;
1930 1930 int bitsleft = pfxlen & 7;
1931 1931 uint8_t *addr2 = (uint8_t *)addr2p;
1932 1932
1933 1933 /*
1934 1934 * and there was much evil..
1935 1935 * XXX should inline-expand the bcmp here and do this 32 bits
1936 1936 * or 64 bits at a time..
1937 1937 */
1938 1938 return ((bcmp(addr1, addr2, offset) == 0) &&
1939 1939 ((bitsleft == 0) ||
1940 1940 (((addr1[offset] ^ addr2[offset]) & (0xff<<(8-bitsleft))) == 0)));
1941 1941 }
1942 1942
1943 1943 static ipsec_policy_t *
1944 1944 ipsec_find_policy_chain(ipsec_policy_t *best, ipsec_policy_t *chain,
1945 1945 ipsec_selector_t *sel, boolean_t is_icmp_inv_acq)
1946 1946 {
1947 1947 ipsec_selkey_t *isel;
1948 1948 ipsec_policy_t *p;
1949 1949 int bpri = best ? best->ipsp_prio : 0;
1950 1950
1951 1951 for (p = chain; p != NULL; p = p->ipsp_hash.hash_next) {
1952 1952 uint32_t valid;
1953 1953
1954 1954 if (p->ipsp_prio <= bpri)
1955 1955 continue;
1956 1956 isel = &p->ipsp_sel->ipsl_key;
1957 1957 valid = isel->ipsl_valid;
1958 1958
1959 1959 if ((valid & IPSL_PROTOCOL) &&
1960 1960 (isel->ipsl_proto != sel->ips_protocol))
1961 1961 continue;
1962 1962
1963 1963 if ((valid & IPSL_REMOTE_ADDR) &&
1964 1964 !ip_addr_match((uint8_t *)&isel->ipsl_remote,
1965 1965 isel->ipsl_remote_pfxlen, &sel->ips_remote_addr_v6))
1966 1966 continue;
1967 1967
1968 1968 if ((valid & IPSL_LOCAL_ADDR) &&
1969 1969 !ip_addr_match((uint8_t *)&isel->ipsl_local,
1970 1970 isel->ipsl_local_pfxlen, &sel->ips_local_addr_v6))
1971 1971 continue;
1972 1972
1973 1973 if ((valid & IPSL_REMOTE_PORT) &&
1974 1974 isel->ipsl_rport != sel->ips_remote_port)
1975 1975 continue;
1976 1976
1977 1977 if ((valid & IPSL_LOCAL_PORT) &&
1978 1978 isel->ipsl_lport != sel->ips_local_port)
1979 1979 continue;
1980 1980
1981 1981 if (!is_icmp_inv_acq) {
1982 1982 if ((valid & IPSL_ICMP_TYPE) &&
1983 1983 (isel->ipsl_icmp_type > sel->ips_icmp_type ||
1984 1984 isel->ipsl_icmp_type_end < sel->ips_icmp_type)) {
1985 1985 continue;
1986 1986 }
1987 1987
1988 1988 if ((valid & IPSL_ICMP_CODE) &&
1989 1989 (isel->ipsl_icmp_code > sel->ips_icmp_code ||
1990 1990 isel->ipsl_icmp_code_end <
1991 1991 sel->ips_icmp_code)) {
1992 1992 continue;
1993 1993 }
1994 1994 } else {
1995 1995 /*
1996 1996 * special case for icmp inverse acquire
1997 1997 * we only want policies that aren't drop/pass
1998 1998 */
1999 1999 if (p->ipsp_act->ipa_act.ipa_type != IPSEC_ACT_APPLY)
2000 2000 continue;
2001 2001 }
2002 2002
2003 2003 /* we matched all the packet-port-field selectors! */
2004 2004 best = p;
2005 2005 bpri = p->ipsp_prio;
2006 2006 }
2007 2007
2008 2008 return (best);
2009 2009 }
2010 2010
2011 2011 /*
2012 2012 * Try to find and return the best policy entry under a given policy
2013 2013 * root for a given set of selectors; the first parameter "best" is
2014 2014 * the current best policy so far. If "best" is non-null, we have a
2015 2015 * reference to it. We return a reference to a policy; if that policy
2016 2016 * is not the original "best", we need to release that reference
2017 2017 * before returning.
2018 2018 */
2019 2019 ipsec_policy_t *
2020 2020 ipsec_find_policy_head(ipsec_policy_t *best, ipsec_policy_head_t *head,
2021 2021 int direction, ipsec_selector_t *sel)
2022 2022 {
2023 2023 ipsec_policy_t *curbest;
2024 2024 ipsec_policy_root_t *root;
2025 2025 uint8_t is_icmp_inv_acq = sel->ips_is_icmp_inv_acq;
2026 2026 int af = sel->ips_isv4 ? IPSEC_AF_V4 : IPSEC_AF_V6;
2027 2027
2028 2028 curbest = best;
2029 2029 root = &head->iph_root[direction];
2030 2030
2031 2031 #ifdef DEBUG
2032 2032 if (is_icmp_inv_acq) {
2033 2033 if (sel->ips_isv4) {
2034 2034 if (sel->ips_protocol != IPPROTO_ICMP) {
2035 2035 cmn_err(CE_WARN, "ipsec_find_policy_head:"
2036 2036 " expecting icmp, got %d",
2037 2037 sel->ips_protocol);
2038 2038 }
2039 2039 } else {
2040 2040 if (sel->ips_protocol != IPPROTO_ICMPV6) {
2041 2041 cmn_err(CE_WARN, "ipsec_find_policy_head:"
2042 2042 " expecting icmpv6, got %d",
2043 2043 sel->ips_protocol);
2044 2044 }
2045 2045 }
2046 2046 }
2047 2047 #endif
2048 2048
2049 2049 rw_enter(&head->iph_lock, RW_READER);
2050 2050
2051 2051 if (root->ipr_nchains > 0) {
2052 2052 curbest = ipsec_find_policy_chain(curbest,
2053 2053 root->ipr_hash[selector_hash(sel, root)].hash_head, sel,
2054 2054 is_icmp_inv_acq);
2055 2055 }
2056 2056 curbest = ipsec_find_policy_chain(curbest, root->ipr_nonhash[af], sel,
2057 2057 is_icmp_inv_acq);
2058 2058
2059 2059 /*
2060 2060 * Adjust reference counts if we found anything new.
2061 2061 */
2062 2062 if (curbest != best) {
2063 2063 ASSERT(curbest != NULL);
2064 2064 IPPOL_REFHOLD(curbest);
2065 2065
2066 2066 if (best != NULL) {
2067 2067 IPPOL_REFRELE(best);
2068 2068 }
2069 2069 }
2070 2070
2071 2071 rw_exit(&head->iph_lock);
2072 2072
2073 2073 return (curbest);
2074 2074 }
2075 2075
2076 2076 /*
2077 2077 * Find the best system policy (either global or per-interface) which
2078 2078 * applies to the given selector; look in all the relevant policy roots
2079 2079 * to figure out which policy wins.
2080 2080 *
2081 2081 * Returns a reference to a policy; caller must release this
2082 2082 * reference when done.
2083 2083 */
2084 2084 ipsec_policy_t *
2085 2085 ipsec_find_policy(int direction, const conn_t *connp, ipsec_selector_t *sel,
2086 2086 netstack_t *ns)
2087 2087 {
2088 2088 ipsec_policy_t *p;
2089 2089 ipsec_stack_t *ipss = ns->netstack_ipsec;
2090 2090
2091 2091 p = ipsec_find_policy_head(NULL, &ipss->ipsec_system_policy,
2092 2092 direction, sel);
2093 2093 if ((connp != NULL) && (connp->conn_policy != NULL)) {
2094 2094 p = ipsec_find_policy_head(p, connp->conn_policy,
2095 2095 direction, sel);
2096 2096 }
2097 2097
2098 2098 return (p);
2099 2099 }
2100 2100
2101 2101 /*
2102 2102 * Check with global policy and see whether this inbound
2103 2103 * packet meets the policy constraints.
2104 2104 *
2105 2105 * Locate appropriate policy from global policy, supplemented by the
2106 2106 * conn's configured and/or cached policy if the conn is supplied.
2107 2107 *
2108 2108 * Dispatch to ipsec_check_ipsecin_policy if we have policy and an
2109 2109 * encrypted packet to see if they match.
2110 2110 *
2111 2111 * Otherwise, see if the policy allows cleartext; if not, drop it on the
2112 2112 * floor.
2113 2113 */
2114 2114 mblk_t *
2115 2115 ipsec_check_global_policy(mblk_t *data_mp, conn_t *connp,
2116 2116 ipha_t *ipha, ip6_t *ip6h, ip_recv_attr_t *ira, netstack_t *ns)
2117 2117 {
2118 2118 ipsec_policy_t *p;
2119 2119 ipsec_selector_t sel;
2120 2120 boolean_t policy_present;
2121 2121 kstat_named_t *counter;
2122 2122 uint64_t pkt_unique;
2123 2123 ip_stack_t *ipst = ns->netstack_ip;
2124 2124 ipsec_stack_t *ipss = ns->netstack_ipsec;
2125 2125
2126 2126 sel.ips_is_icmp_inv_acq = 0;
2127 2127
2128 2128 ASSERT((ipha == NULL && ip6h != NULL) ||
2129 2129 (ip6h == NULL && ipha != NULL));
2130 2130
2131 2131 if (ipha != NULL)
2132 2132 policy_present = ipss->ipsec_inbound_v4_policy_present;
2133 2133 else
2134 2134 policy_present = ipss->ipsec_inbound_v6_policy_present;
2135 2135
2136 2136 if (!policy_present && connp == NULL) {
2137 2137 /*
2138 2138 * No global policy and no per-socket policy;
2139 2139 * just pass it back (but we shouldn't get here in that case)
2140 2140 */
2141 2141 return (data_mp);
2142 2142 }
2143 2143
2144 2144 /*
2145 2145 * If we have cached policy, use it.
2146 2146 * Otherwise consult system policy.
2147 2147 */
2148 2148 if ((connp != NULL) && (connp->conn_latch != NULL)) {
2149 2149 p = connp->conn_latch_in_policy;
2150 2150 if (p != NULL) {
2151 2151 IPPOL_REFHOLD(p);
2152 2152 }
2153 2153 /*
2154 2154 * Fudge sel for UNIQUE_ID setting below.
2155 2155 */
2156 2156 pkt_unique = conn_to_unique(connp, data_mp, ipha, ip6h);
2157 2157 } else {
2158 2158 /* Initialize the ports in the selector */
2159 2159 if (ipsec_init_inbound_sel(&sel, data_mp, ipha, ip6h,
2160 2160 SEL_NONE) == SELRET_NOMEM) {
2161 2161 /*
2162 2162 * Technically not a policy mismatch, but it is
2163 2163 * an internal failure.
2164 2164 */
2165 2165 ipsec_log_policy_failure(IPSEC_POLICY_MISMATCH,
2166 2166 "ipsec_init_inbound_sel", ipha, ip6h, B_TRUE, ns);
2167 2167 counter = DROPPER(ipss, ipds_spd_nomem);
2168 2168 goto fail;
2169 2169 }
2170 2170
2171 2171 /*
2172 2172 * Find the policy which best applies.
2173 2173 *
2174 2174 * If we find global policy, we should look at both
2175 2175 * local policy and global policy and see which is
2176 2176 * stronger and match accordingly.
2177 2177 *
2178 2178 * If we don't find a global policy, check with
2179 2179 * local policy alone.
2180 2180 */
2181 2181
2182 2182 p = ipsec_find_policy(IPSEC_TYPE_INBOUND, connp, &sel, ns);
2183 2183 pkt_unique = SA_UNIQUE_ID(sel.ips_remote_port,
2184 2184 sel.ips_local_port, sel.ips_protocol, 0);
2185 2185 }
2186 2186
2187 2187 if (p == NULL) {
2188 2188 if (!(ira->ira_flags & IRAF_IPSEC_SECURE)) {
2189 2189 /*
2190 2190 * We have no policy; default to succeeding.
2191 2191 * XXX paranoid system design doesn't do this.
2192 2192 */
2193 2193 BUMP_MIB(&ipst->ips_ip_mib, ipsecInSucceeded);
2194 2194 return (data_mp);
2195 2195 } else {
2196 2196 counter = DROPPER(ipss, ipds_spd_got_secure);
2197 2197 ipsec_log_policy_failure(IPSEC_POLICY_NOT_NEEDED,
2198 2198 "ipsec_check_global_policy", ipha, ip6h, B_TRUE,
2199 2199 ns);
2200 2200 goto fail;
2201 2201 }
2202 2202 }
2203 2203 if (ira->ira_flags & IRAF_IPSEC_SECURE) {
2204 2204 return (ipsec_check_ipsecin_policy(data_mp, p, ipha, ip6h,
2205 2205 pkt_unique, ira, ns));
2206 2206 }
2207 2207 if (p->ipsp_act->ipa_allow_clear) {
2208 2208 BUMP_MIB(&ipst->ips_ip_mib, ipsecInSucceeded);
2209 2209 IPPOL_REFRELE(p);
2210 2210 return (data_mp);
2211 2211 }
2212 2212 IPPOL_REFRELE(p);
2213 2213 /*
2214 2214 * If we reach here, we will drop the packet because it failed the
2215 2215 * global policy check because the packet was cleartext, and it
2216 2216 * should not have been.
2217 2217 */
2218 2218 ipsec_log_policy_failure(IPSEC_POLICY_MISMATCH,
2219 2219 "ipsec_check_global_policy", ipha, ip6h, B_FALSE, ns);
2220 2220 counter = DROPPER(ipss, ipds_spd_got_clear);
2221 2221
2222 2222 fail:
2223 2223 ip_drop_packet(data_mp, B_TRUE, NULL, counter,
2224 2224 &ipss->ipsec_spd_dropper);
2225 2225 BUMP_MIB(&ipst->ips_ip_mib, ipsecInFailed);
2226 2226 return (NULL);
2227 2227 }
2228 2228
2229 2229 /*
2230 2230 * We check whether an inbound datagram is a valid one
2231 2231 * to accept in clear. If it is secure, it is the job
2232 2232 * of IPSEC to log information appropriately if it
2233 2233 * suspects that it may not be the real one.
2234 2234 *
2235 2235 * It is called only while fanning out to the ULP
2236 2236 * where ULP accepts only secure data and the incoming
2237 2237 * is clear. Usually we never accept clear datagrams in
2238 2238 * such cases. ICMP is the only exception.
2239 2239 *
2240 2240 * NOTE : We don't call this function if the client (ULP)
2241 2241 * is willing to accept things in clear.
2242 2242 */
2243 2243 boolean_t
2244 2244 ipsec_inbound_accept_clear(mblk_t *mp, ipha_t *ipha, ip6_t *ip6h)
2245 2245 {
2246 2246 ushort_t iph_hdr_length;
2247 2247 icmph_t *icmph;
2248 2248 icmp6_t *icmp6;
2249 2249 uint8_t *nexthdrp;
2250 2250
2251 2251 ASSERT((ipha != NULL && ip6h == NULL) ||
2252 2252 (ipha == NULL && ip6h != NULL));
2253 2253
2254 2254 if (ip6h != NULL) {
2255 2255 iph_hdr_length = ip_hdr_length_v6(mp, ip6h);
2256 2256 if (!ip_hdr_length_nexthdr_v6(mp, ip6h, &iph_hdr_length,
2257 2257 &nexthdrp)) {
2258 2258 return (B_FALSE);
2259 2259 }
2260 2260 if (*nexthdrp != IPPROTO_ICMPV6)
2261 2261 return (B_FALSE);
2262 2262 icmp6 = (icmp6_t *)(&mp->b_rptr[iph_hdr_length]);
2263 2263 /* Match IPv6 ICMP policy as closely as IPv4 as possible. */
2264 2264 switch (icmp6->icmp6_type) {
2265 2265 case ICMP6_PARAM_PROB:
2266 2266 /* Corresponds to port/proto unreach in IPv4. */
2267 2267 case ICMP6_ECHO_REQUEST:
2268 2268 /* Just like IPv4. */
2269 2269 return (B_FALSE);
2270 2270
2271 2271 case MLD_LISTENER_QUERY:
2272 2272 case MLD_LISTENER_REPORT:
2273 2273 case MLD_LISTENER_REDUCTION:
2274 2274 /*
2275 2275 * XXX Seperate NDD in IPv4 what about here?
2276 2276 * Plus, mcast is important to ND.
2277 2277 */
2278 2278 case ICMP6_DST_UNREACH:
2279 2279 /* Corresponds to HOST/NET unreachable in IPv4. */
2280 2280 case ICMP6_PACKET_TOO_BIG:
2281 2281 case ICMP6_ECHO_REPLY:
2282 2282 /* These are trusted in IPv4. */
2283 2283 case ND_ROUTER_SOLICIT:
2284 2284 case ND_ROUTER_ADVERT:
2285 2285 case ND_NEIGHBOR_SOLICIT:
2286 2286 case ND_NEIGHBOR_ADVERT:
2287 2287 case ND_REDIRECT:
2288 2288 /* Trust ND messages for now. */
2289 2289 case ICMP6_TIME_EXCEEDED:
2290 2290 default:
2291 2291 return (B_TRUE);
2292 2292 }
2293 2293 } else {
2294 2294 /*
2295 2295 * If it is not ICMP, fail this request.
2296 2296 */
2297 2297 if (ipha->ipha_protocol != IPPROTO_ICMP) {
2298 2298 #ifdef FRAGCACHE_DEBUG
2299 2299 cmn_err(CE_WARN, "Dropping - ipha_proto = %d\n",
2300 2300 ipha->ipha_protocol);
2301 2301 #endif
2302 2302 return (B_FALSE);
2303 2303 }
2304 2304 iph_hdr_length = IPH_HDR_LENGTH(ipha);
2305 2305 icmph = (icmph_t *)&mp->b_rptr[iph_hdr_length];
2306 2306 /*
2307 2307 * It is an insecure icmp message. Check to see whether we are
2308 2308 * willing to accept this one.
2309 2309 */
2310 2310
2311 2311 switch (icmph->icmph_type) {
2312 2312 case ICMP_ECHO_REPLY:
2313 2313 case ICMP_TIME_STAMP_REPLY:
2314 2314 case ICMP_INFO_REPLY:
2315 2315 case ICMP_ROUTER_ADVERTISEMENT:
2316 2316 /*
2317 2317 * We should not encourage clear replies if this
2318 2318 * client expects secure. If somebody is replying
2319 2319 * in clear some mailicious user watching both the
2320 2320 * request and reply, can do chosen-plain-text attacks.
2321 2321 * With global policy we might be just expecting secure
2322 2322 * but sending out clear. We don't know what the right
2323 2323 * thing is. We can't do much here as we can't control
2324 2324 * the sender here. Till we are sure of what to do,
2325 2325 * accept them.
2326 2326 */
2327 2327 return (B_TRUE);
2328 2328 case ICMP_ECHO_REQUEST:
2329 2329 case ICMP_TIME_STAMP_REQUEST:
2330 2330 case ICMP_INFO_REQUEST:
2331 2331 case ICMP_ADDRESS_MASK_REQUEST:
2332 2332 case ICMP_ROUTER_SOLICITATION:
2333 2333 case ICMP_ADDRESS_MASK_REPLY:
2334 2334 /*
2335 2335 * Don't accept this as somebody could be sending
2336 2336 * us plain text to get encrypted data. If we reply,
2337 2337 * it will lead to chosen plain text attack.
2338 2338 */
2339 2339 return (B_FALSE);
2340 2340 case ICMP_DEST_UNREACHABLE:
2341 2341 switch (icmph->icmph_code) {
2342 2342 case ICMP_FRAGMENTATION_NEEDED:
2343 2343 /*
2344 2344 * Be in sync with icmp_inbound, where we have
2345 2345 * already set dce_pmtu
2346 2346 */
2347 2347 #ifdef FRAGCACHE_DEBUG
2348 2348 cmn_err(CE_WARN, "ICMP frag needed\n");
2349 2349 #endif
2350 2350 return (B_TRUE);
2351 2351 case ICMP_HOST_UNREACHABLE:
2352 2352 case ICMP_NET_UNREACHABLE:
2353 2353 /*
2354 2354 * By accepting, we could reset a connection.
2355 2355 * How do we solve the problem of some
2356 2356 * intermediate router sending in-secure ICMP
2357 2357 * messages ?
2358 2358 */
2359 2359 return (B_TRUE);
2360 2360 case ICMP_PORT_UNREACHABLE:
2361 2361 case ICMP_PROTOCOL_UNREACHABLE:
2362 2362 default :
2363 2363 return (B_FALSE);
2364 2364 }
2365 2365 case ICMP_SOURCE_QUENCH:
2366 2366 /*
2367 2367 * If this is an attack, TCP will slow start
2368 2368 * because of this. Is it very harmful ?
2369 2369 */
2370 2370 return (B_TRUE);
2371 2371 case ICMP_PARAM_PROBLEM:
2372 2372 return (B_FALSE);
2373 2373 case ICMP_TIME_EXCEEDED:
2374 2374 return (B_TRUE);
2375 2375 case ICMP_REDIRECT:
2376 2376 return (B_FALSE);
2377 2377 default :
2378 2378 return (B_FALSE);
2379 2379 }
2380 2380 }
2381 2381 }
2382 2382
2383 2383 void
2384 2384 ipsec_latch_ids(ipsec_latch_t *ipl, ipsid_t *local, ipsid_t *remote)
2385 2385 {
2386 2386 mutex_enter(&ipl->ipl_lock);
2387 2387
2388 2388 if (ipl->ipl_ids_latched) {
2389 2389 /* I lost, someone else got here before me */
2390 2390 mutex_exit(&ipl->ipl_lock);
2391 2391 return;
2392 2392 }
2393 2393
2394 2394 if (local != NULL)
2395 2395 IPSID_REFHOLD(local);
2396 2396 if (remote != NULL)
2397 2397 IPSID_REFHOLD(remote);
2398 2398
2399 2399 ipl->ipl_local_cid = local;
2400 2400 ipl->ipl_remote_cid = remote;
2401 2401 ipl->ipl_ids_latched = B_TRUE;
2402 2402 mutex_exit(&ipl->ipl_lock);
2403 2403 }
2404 2404
2405 2405 void
2406 2406 ipsec_latch_inbound(conn_t *connp, ip_recv_attr_t *ira)
2407 2407 {
2408 2408 ipsa_t *sa;
2409 2409 ipsec_latch_t *ipl = connp->conn_latch;
2410 2410
2411 2411 if (!ipl->ipl_ids_latched) {
2412 2412 ipsid_t *local = NULL;
2413 2413 ipsid_t *remote = NULL;
2414 2414
2415 2415 if (!(ira->ira_flags & IRAF_LOOPBACK)) {
2416 2416 ASSERT(ira->ira_flags & IRAF_IPSEC_SECURE);
2417 2417 if (ira->ira_ipsec_esp_sa != NULL)
2418 2418 sa = ira->ira_ipsec_esp_sa;
2419 2419 else
2420 2420 sa = ira->ira_ipsec_ah_sa;
2421 2421 ASSERT(sa != NULL);
2422 2422 local = sa->ipsa_dst_cid;
2423 2423 remote = sa->ipsa_src_cid;
2424 2424 }
2425 2425 ipsec_latch_ids(ipl, local, remote);
2426 2426 }
2427 2427 if (ira->ira_flags & IRAF_IPSEC_SECURE) {
2428 2428 if (connp->conn_latch_in_action != NULL) {
2429 2429 /*
2430 2430 * Previously cached action. This is probably
2431 2431 * harmless, but in DEBUG kernels, check for
2432 2432 * action equality.
2433 2433 *
2434 2434 * Preserve the existing action to preserve latch
2435 2435 * invariance.
2436 2436 */
2437 2437 ASSERT(connp->conn_latch_in_action ==
2438 2438 ira->ira_ipsec_action);
2439 2439 return;
2440 2440 }
2441 2441 connp->conn_latch_in_action = ira->ira_ipsec_action;
2442 2442 IPACT_REFHOLD(connp->conn_latch_in_action);
2443 2443 }
2444 2444 }
2445 2445
2446 2446 /*
2447 2447 * Check whether the policy constraints are met either for an
2448 2448 * inbound datagram; called from IP in numerous places.
2449 2449 *
2450 2450 * Note that this is not a chokepoint for inbound policy checks;
2451 2451 * see also ipsec_check_ipsecin_latch() and ipsec_check_global_policy()
2452 2452 */
2453 2453 mblk_t *
2454 2454 ipsec_check_inbound_policy(mblk_t *mp, conn_t *connp,
2455 2455 ipha_t *ipha, ip6_t *ip6h, ip_recv_attr_t *ira)
2456 2456 {
2457 2457 boolean_t ret;
2458 2458 ipsec_latch_t *ipl;
2459 2459 ipsec_action_t *ap;
2460 2460 uint64_t unique_id;
2461 2461 ipsec_stack_t *ipss;
2462 2462 ip_stack_t *ipst;
2463 2463 netstack_t *ns;
2464 2464 ipsec_policy_head_t *policy_head;
2465 2465 ipsec_policy_t *p = NULL;
2466 2466
2467 2467 ASSERT(connp != NULL);
2468 2468 ns = connp->conn_netstack;
2469 2469 ipss = ns->netstack_ipsec;
2470 2470 ipst = ns->netstack_ip;
2471 2471
2472 2472 if (!(ira->ira_flags & IRAF_IPSEC_SECURE)) {
2473 2473 /*
2474 2474 * This is the case where the incoming datagram is
2475 2475 * cleartext and we need to see whether this client
2476 2476 * would like to receive such untrustworthy things from
2477 2477 * the wire.
2478 2478 */
2479 2479 ASSERT(mp != NULL);
2480 2480
2481 2481 mutex_enter(&connp->conn_lock);
2482 2482 if (connp->conn_state_flags & CONN_CONDEMNED) {
2483 2483 mutex_exit(&connp->conn_lock);
2484 2484 ip_drop_packet(mp, B_TRUE, NULL,
2485 2485 DROPPER(ipss, ipds_spd_got_clear),
2486 2486 &ipss->ipsec_spd_dropper);
2487 2487 BUMP_MIB(&ipst->ips_ip_mib, ipsecInFailed);
2488 2488 return (NULL);
2489 2489 }
2490 2490 if (connp->conn_latch != NULL) {
2491 2491 /* Hold a reference in case the conn is closing */
2492 2492 p = connp->conn_latch_in_policy;
2493 2493 if (p != NULL)
2494 2494 IPPOL_REFHOLD(p);
2495 2495 mutex_exit(&connp->conn_lock);
2496 2496 /*
2497 2497 * Policy is cached in the conn.
2498 2498 */
2499 2499 if (p != NULL && !p->ipsp_act->ipa_allow_clear) {
2500 2500 ret = ipsec_inbound_accept_clear(mp,
2501 2501 ipha, ip6h);
2502 2502 if (ret) {
2503 2503 BUMP_MIB(&ipst->ips_ip_mib,
2504 2504 ipsecInSucceeded);
2505 2505 IPPOL_REFRELE(p);
2506 2506 return (mp);
2507 2507 } else {
2508 2508 ipsec_log_policy_failure(
2509 2509 IPSEC_POLICY_MISMATCH,
2510 2510 "ipsec_check_inbound_policy", ipha,
2511 2511 ip6h, B_FALSE, ns);
2512 2512 ip_drop_packet(mp, B_TRUE, NULL,
2513 2513 DROPPER(ipss, ipds_spd_got_clear),
2514 2514 &ipss->ipsec_spd_dropper);
2515 2515 BUMP_MIB(&ipst->ips_ip_mib,
2516 2516 ipsecInFailed);
2517 2517 IPPOL_REFRELE(p);
2518 2518 return (NULL);
2519 2519 }
2520 2520 } else {
2521 2521 BUMP_MIB(&ipst->ips_ip_mib, ipsecInSucceeded);
2522 2522 if (p != NULL)
2523 2523 IPPOL_REFRELE(p);
2524 2524 return (mp);
2525 2525 }
2526 2526 } else {
2527 2527 policy_head = connp->conn_policy;
2528 2528
2529 2529 /* Hold a reference in case the conn is closing */
2530 2530 if (policy_head != NULL)
2531 2531 IPPH_REFHOLD(policy_head);
2532 2532 mutex_exit(&connp->conn_lock);
2533 2533 /*
2534 2534 * As this is a non-hardbound connection we need
2535 2535 * to look at both per-socket policy and global
2536 2536 * policy.
2537 2537 */
2538 2538 mp = ipsec_check_global_policy(mp, connp,
2539 2539 ipha, ip6h, ira, ns);
2540 2540 if (policy_head != NULL)
2541 2541 IPPH_REFRELE(policy_head, ns);
2542 2542 return (mp);
2543 2543 }
2544 2544 }
2545 2545
2546 2546 mutex_enter(&connp->conn_lock);
2547 2547 /* Connection is closing */
2548 2548 if (connp->conn_state_flags & CONN_CONDEMNED) {
2549 2549 mutex_exit(&connp->conn_lock);
2550 2550 ip_drop_packet(mp, B_TRUE, NULL,
2551 2551 DROPPER(ipss, ipds_spd_got_clear),
2552 2552 &ipss->ipsec_spd_dropper);
2553 2553 BUMP_MIB(&ipst->ips_ip_mib, ipsecInFailed);
2554 2554 return (NULL);
2555 2555 }
2556 2556
2557 2557 /*
2558 2558 * Once a connection is latched it remains so for life, the conn_latch
2559 2559 * pointer on the conn has not changed, simply initializing ipl here
2560 2560 * as the earlier initialization was done only in the cleartext case.
2561 2561 */
2562 2562 if ((ipl = connp->conn_latch) == NULL) {
2563 2563 mblk_t *retmp;
2564 2564 policy_head = connp->conn_policy;
2565 2565
2566 2566 /* Hold a reference in case the conn is closing */
2567 2567 if (policy_head != NULL)
2568 2568 IPPH_REFHOLD(policy_head);
2569 2569 mutex_exit(&connp->conn_lock);
2570 2570 /*
2571 2571 * We don't have policies cached in the conn
2572 2572 * for this stream. So, look at the global
2573 2573 * policy. It will check against conn or global
2574 2574 * depending on whichever is stronger.
2575 2575 */
2576 2576 retmp = ipsec_check_global_policy(mp, connp,
2577 2577 ipha, ip6h, ira, ns);
2578 2578 if (policy_head != NULL)
2579 2579 IPPH_REFRELE(policy_head, ns);
2580 2580 return (retmp);
2581 2581 }
2582 2582
2583 2583 IPLATCH_REFHOLD(ipl);
2584 2584 /* Hold reference on conn_latch_in_action in case conn is closing */
2585 2585 ap = connp->conn_latch_in_action;
2586 2586 if (ap != NULL)
2587 2587 IPACT_REFHOLD(ap);
2588 2588 mutex_exit(&connp->conn_lock);
2589 2589
2590 2590 if (ap != NULL) {
2591 2591 /* Policy is cached & latched; fast(er) path */
2592 2592 const char *reason;
2593 2593 kstat_named_t *counter;
2594 2594
2595 2595 if (ipsec_check_ipsecin_latch(ira, mp, ipl, ap,
2596 2596 ipha, ip6h, &reason, &counter, connp, ns)) {
2597 2597 BUMP_MIB(&ipst->ips_ip_mib, ipsecInSucceeded);
2598 2598 IPLATCH_REFRELE(ipl);
2599 2599 IPACT_REFRELE(ap);
2600 2600 return (mp);
2601 2601 }
2602 2602 ipsec_rl_strlog(ns, IP_MOD_ID, 0, 0,
2603 2603 SL_ERROR|SL_WARN|SL_CONSOLE,
2604 2604 "ipsec inbound policy mismatch: %s, packet dropped\n",
2605 2605 reason);
2606 2606 ip_drop_packet(mp, B_TRUE, NULL, counter,
2607 2607 &ipss->ipsec_spd_dropper);
2608 2608 BUMP_MIB(&ipst->ips_ip_mib, ipsecInFailed);
2609 2609 IPLATCH_REFRELE(ipl);
2610 2610 IPACT_REFRELE(ap);
2611 2611 return (NULL);
2612 2612 }
2613 2613 if ((p = connp->conn_latch_in_policy) == NULL) {
2614 2614 ipsec_weird_null_inbound_policy++;
2615 2615 IPLATCH_REFRELE(ipl);
2616 2616 return (mp);
2617 2617 }
2618 2618
2619 2619 unique_id = conn_to_unique(connp, mp, ipha, ip6h);
2620 2620 IPPOL_REFHOLD(p);
2621 2621 mp = ipsec_check_ipsecin_policy(mp, p, ipha, ip6h, unique_id, ira, ns);
2622 2622 /*
2623 2623 * NOTE: ipsecIn{Failed,Succeeeded} bumped by
2624 2624 * ipsec_check_ipsecin_policy().
2625 2625 */
2626 2626 if (mp != NULL)
2627 2627 ipsec_latch_inbound(connp, ira);
2628 2628 IPLATCH_REFRELE(ipl);
2629 2629 return (mp);
2630 2630 }
2631 2631
2632 2632 /*
2633 2633 * Handle all sorts of cases like tunnel-mode and ICMP.
2634 2634 */
2635 2635 static int
2636 2636 prepended_length(mblk_t *mp, uintptr_t hptr)
2637 2637 {
2638 2638 int rc = 0;
2639 2639
2640 2640 while (mp != NULL) {
2641 2641 if (hptr >= (uintptr_t)mp->b_rptr && hptr <
2642 2642 (uintptr_t)mp->b_wptr) {
2643 2643 rc += (int)(hptr - (uintptr_t)mp->b_rptr);
2644 2644 break; /* out of while loop */
2645 2645 }
2646 2646 rc += (int)MBLKL(mp);
2647 2647 mp = mp->b_cont;
2648 2648 }
2649 2649
2650 2650 if (mp == NULL) {
2651 2651 /*
2652 2652 * IF (big IF) we make it here by naturally exiting the loop,
2653 2653 * then ip6h isn't in the mblk chain "mp" at all.
2654 2654 *
2655 2655 * The only case where this happens is with a reversed IP
2656 2656 * header that gets passed up by inbound ICMP processing.
2657 2657 * This unfortunately triggers longstanding bug 6478464. For
2658 2658 * now, just pass up 0 for the answer.
2659 2659 */
2660 2660 #ifdef DEBUG_NOT_UNTIL_6478464
2661 2661 ASSERT(mp != NULL);
2662 2662 #endif
2663 2663 rc = 0;
2664 2664 }
2665 2665
2666 2666 return (rc);
2667 2667 }
2668 2668
2669 2669 /*
2670 2670 * Returns:
2671 2671 *
2672 2672 * SELRET_NOMEM --> msgpullup() needed to gather things failed.
2673 2673 * SELRET_BADPKT --> If we're being called after tunnel-mode fragment
2674 2674 * gathering, the initial fragment is too short for
2675 2675 * useful data. Only returned if SEL_TUNNEL_FIRSTFRAG is
2676 2676 * set.
2677 2677 * SELRET_SUCCESS --> "sel" now has initialized IPsec selector data.
2678 2678 * SELRET_TUNFRAG --> This is a fragment in a tunnel-mode packet. Caller
2679 2679 * should put this packet in a fragment-gathering queue.
2680 2680 * Only returned if SEL_TUNNEL_MODE and SEL_PORT_POLICY
2681 2681 * is set.
2682 2682 *
2683 2683 * Note that ipha/ip6h can be in a different mblk (mp->b_cont) in the case
2684 2684 * of tunneled packets.
2685 2685 * Also, mp->b_rptr can be an ICMP error where ipha/ip6h is the packet in
2686 2686 * error past the ICMP error.
2687 2687 */
2688 2688 static selret_t
2689 2689 ipsec_init_inbound_sel(ipsec_selector_t *sel, mblk_t *mp, ipha_t *ipha,
2690 2690 ip6_t *ip6h, uint8_t sel_flags)
2691 2691 {
2692 2692 uint16_t *ports;
2693 2693 int outer_hdr_len = 0; /* For ICMP or tunnel-mode cases... */
2694 2694 ushort_t hdr_len;
2695 2695 mblk_t *spare_mp = NULL;
2696 2696 uint8_t *nexthdrp, *transportp;
2697 2697 uint8_t nexthdr;
2698 2698 uint8_t icmp_proto;
2699 2699 ip_pkt_t ipp;
2700 2700 boolean_t port_policy_present = (sel_flags & SEL_PORT_POLICY);
2701 2701 boolean_t is_icmp = (sel_flags & SEL_IS_ICMP);
2702 2702 boolean_t tunnel_mode = (sel_flags & SEL_TUNNEL_MODE);
2703 2703 boolean_t post_frag = (sel_flags & SEL_POST_FRAG);
2704 2704
2705 2705 ASSERT((ipha == NULL && ip6h != NULL) ||
2706 2706 (ipha != NULL && ip6h == NULL));
2707 2707
2708 2708 if (ip6h != NULL) {
2709 2709 outer_hdr_len = prepended_length(mp, (uintptr_t)ip6h);
2710 2710 nexthdr = ip6h->ip6_nxt;
2711 2711 icmp_proto = IPPROTO_ICMPV6;
2712 2712 sel->ips_isv4 = B_FALSE;
2713 2713 sel->ips_local_addr_v6 = ip6h->ip6_dst;
2714 2714 sel->ips_remote_addr_v6 = ip6h->ip6_src;
2715 2715
2716 2716 bzero(&ipp, sizeof (ipp));
2717 2717
2718 2718 switch (nexthdr) {
2719 2719 case IPPROTO_HOPOPTS:
2720 2720 case IPPROTO_ROUTING:
2721 2721 case IPPROTO_DSTOPTS:
2722 2722 case IPPROTO_FRAGMENT:
2723 2723 /*
2724 2724 * Use ip_hdr_length_nexthdr_v6(). And have a spare
2725 2725 * mblk that's contiguous to feed it
2726 2726 */
2727 2727 if ((spare_mp = msgpullup(mp, -1)) == NULL)
2728 2728 return (SELRET_NOMEM);
2729 2729 if (!ip_hdr_length_nexthdr_v6(spare_mp,
2730 2730 (ip6_t *)(spare_mp->b_rptr + outer_hdr_len),
2731 2731 &hdr_len, &nexthdrp)) {
2732 2732 /* Malformed packet - caller frees. */
2733 2733 ipsec_freemsg_chain(spare_mp);
2734 2734 return (SELRET_BADPKT);
2735 2735 }
2736 2736 /* Repopulate now that we have the whole packet */
2737 2737 ip6h = (ip6_t *)(spare_mp->b_rptr + outer_hdr_len);
2738 2738 (void) ip_find_hdr_v6(spare_mp, ip6h, B_FALSE, &ipp,
2739 2739 NULL);
2740 2740 nexthdr = *nexthdrp;
2741 2741 /* We can just extract based on hdr_len now. */
2742 2742 break;
2743 2743 default:
2744 2744 (void) ip_find_hdr_v6(mp, ip6h, B_FALSE, &ipp, NULL);
2745 2745 hdr_len = IPV6_HDR_LEN;
2746 2746 break;
2747 2747 }
2748 2748 if (port_policy_present && IS_V6_FRAGMENT(ipp) && !is_icmp) {
2749 2749 /* IPv6 Fragment */
2750 2750 ipsec_freemsg_chain(spare_mp);
2751 2751 return (SELRET_TUNFRAG);
2752 2752 }
2753 2753 transportp = (uint8_t *)ip6h + hdr_len;
2754 2754 } else {
2755 2755 outer_hdr_len = prepended_length(mp, (uintptr_t)ipha);
2756 2756 icmp_proto = IPPROTO_ICMP;
2757 2757 sel->ips_isv4 = B_TRUE;
2758 2758 sel->ips_local_addr_v4 = ipha->ipha_dst;
2759 2759 sel->ips_remote_addr_v4 = ipha->ipha_src;
2760 2760 nexthdr = ipha->ipha_protocol;
2761 2761 hdr_len = IPH_HDR_LENGTH(ipha);
2762 2762
2763 2763 if (port_policy_present &&
2764 2764 IS_V4_FRAGMENT(ipha->ipha_fragment_offset_and_flags) &&
2765 2765 !is_icmp) {
2766 2766 /* IPv4 Fragment */
2767 2767 ipsec_freemsg_chain(spare_mp);
2768 2768 return (SELRET_TUNFRAG);
2769 2769 }
2770 2770 transportp = (uint8_t *)ipha + hdr_len;
2771 2771 }
2772 2772 sel->ips_protocol = nexthdr;
2773 2773
2774 2774 if ((nexthdr != IPPROTO_TCP && nexthdr != IPPROTO_UDP &&
2775 2775 nexthdr != IPPROTO_SCTP && nexthdr != icmp_proto) ||
2776 2776 (!port_policy_present && !post_frag && tunnel_mode)) {
2777 2777 sel->ips_remote_port = sel->ips_local_port = 0;
2778 2778 ipsec_freemsg_chain(spare_mp);
2779 2779 return (SELRET_SUCCESS);
2780 2780 }
2781 2781
2782 2782 if (transportp + 4 > mp->b_wptr) {
2783 2783 /* If we didn't pullup a copy already, do so now. */
2784 2784 /*
2785 2785 * XXX performance, will upper-layers frequently split TCP/UDP
2786 2786 * apart from IP or options? If so, perhaps we should revisit
2787 2787 * the spare_mp strategy.
2788 2788 */
2789 2789 ipsec_hdr_pullup_needed++;
2790 2790 if (spare_mp == NULL &&
2791 2791 (spare_mp = msgpullup(mp, -1)) == NULL) {
2792 2792 return (SELRET_NOMEM);
2793 2793 }
2794 2794 transportp = &spare_mp->b_rptr[hdr_len + outer_hdr_len];
2795 2795 }
2796 2796
2797 2797 if (nexthdr == icmp_proto) {
2798 2798 sel->ips_icmp_type = *transportp++;
2799 2799 sel->ips_icmp_code = *transportp;
2800 2800 sel->ips_remote_port = sel->ips_local_port = 0;
2801 2801 } else {
2802 2802 ports = (uint16_t *)transportp;
2803 2803 sel->ips_remote_port = *ports++;
2804 2804 sel->ips_local_port = *ports;
2805 2805 }
2806 2806 ipsec_freemsg_chain(spare_mp);
2807 2807 return (SELRET_SUCCESS);
2808 2808 }
2809 2809
2810 2810 /*
2811 2811 * This is called with a b_next chain of messages from the fragcache code,
2812 2812 * hence it needs to discard a chain on error.
2813 2813 */
2814 2814 static boolean_t
2815 2815 ipsec_init_outbound_ports(ipsec_selector_t *sel, mblk_t *mp, ipha_t *ipha,
2816 2816 ip6_t *ip6h, int outer_hdr_len, ipsec_stack_t *ipss)
2817 2817 {
2818 2818 /*
2819 2819 * XXX cut&paste shared with ipsec_init_inbound_sel
2820 2820 */
2821 2821 uint16_t *ports;
2822 2822 ushort_t hdr_len;
2823 2823 mblk_t *spare_mp = NULL;
2824 2824 uint8_t *nexthdrp;
2825 2825 uint8_t nexthdr;
2826 2826 uint8_t *typecode;
2827 2827 uint8_t check_proto;
2828 2828
2829 2829 ASSERT((ipha == NULL && ip6h != NULL) ||
2830 2830 (ipha != NULL && ip6h == NULL));
2831 2831
2832 2832 if (ip6h != NULL) {
2833 2833 check_proto = IPPROTO_ICMPV6;
2834 2834 nexthdr = ip6h->ip6_nxt;
2835 2835 switch (nexthdr) {
2836 2836 case IPPROTO_HOPOPTS:
2837 2837 case IPPROTO_ROUTING:
2838 2838 case IPPROTO_DSTOPTS:
2839 2839 case IPPROTO_FRAGMENT:
2840 2840 /*
2841 2841 * Use ip_hdr_length_nexthdr_v6(). And have a spare
2842 2842 * mblk that's contiguous to feed it
2843 2843 */
2844 2844 spare_mp = msgpullup(mp, -1);
2845 2845 if (spare_mp == NULL ||
2846 2846 !ip_hdr_length_nexthdr_v6(spare_mp,
2847 2847 (ip6_t *)(spare_mp->b_rptr + outer_hdr_len),
2848 2848 &hdr_len, &nexthdrp)) {
2849 2849 /* Always works, even if NULL. */
2850 2850 ipsec_freemsg_chain(spare_mp);
2851 2851 ip_drop_packet_chain(mp, B_FALSE, NULL,
2852 2852 DROPPER(ipss, ipds_spd_nomem),
2853 2853 &ipss->ipsec_spd_dropper);
2854 2854 return (B_FALSE);
2855 2855 } else {
2856 2856 nexthdr = *nexthdrp;
2857 2857 /* We can just extract based on hdr_len now. */
2858 2858 }
2859 2859 break;
2860 2860 default:
2861 2861 hdr_len = IPV6_HDR_LEN;
2862 2862 break;
2863 2863 }
2864 2864 } else {
2865 2865 check_proto = IPPROTO_ICMP;
2866 2866 hdr_len = IPH_HDR_LENGTH(ipha);
2867 2867 nexthdr = ipha->ipha_protocol;
2868 2868 }
2869 2869
2870 2870 sel->ips_protocol = nexthdr;
2871 2871 if (nexthdr != IPPROTO_TCP && nexthdr != IPPROTO_UDP &&
2872 2872 nexthdr != IPPROTO_SCTP && nexthdr != check_proto) {
2873 2873 sel->ips_local_port = sel->ips_remote_port = 0;
2874 2874 ipsec_freemsg_chain(spare_mp); /* Always works, even if NULL */
2875 2875 return (B_TRUE);
2876 2876 }
2877 2877
2878 2878 if (&mp->b_rptr[hdr_len] + 4 + outer_hdr_len > mp->b_wptr) {
2879 2879 /* If we didn't pullup a copy already, do so now. */
2880 2880 /*
2881 2881 * XXX performance, will upper-layers frequently split TCP/UDP
2882 2882 * apart from IP or options? If so, perhaps we should revisit
2883 2883 * the spare_mp strategy.
2884 2884 *
2885 2885 * XXX should this be msgpullup(mp, hdr_len+4) ???
2886 2886 */
2887 2887 if (spare_mp == NULL &&
2888 2888 (spare_mp = msgpullup(mp, -1)) == NULL) {
2889 2889 ip_drop_packet_chain(mp, B_FALSE, NULL,
2890 2890 DROPPER(ipss, ipds_spd_nomem),
2891 2891 &ipss->ipsec_spd_dropper);
2892 2892 return (B_FALSE);
2893 2893 }
2894 2894 ports = (uint16_t *)&spare_mp->b_rptr[hdr_len + outer_hdr_len];
2895 2895 } else {
2896 2896 ports = (uint16_t *)&mp->b_rptr[hdr_len + outer_hdr_len];
2897 2897 }
2898 2898
2899 2899 if (nexthdr == check_proto) {
2900 2900 typecode = (uint8_t *)ports;
2901 2901 sel->ips_icmp_type = *typecode++;
2902 2902 sel->ips_icmp_code = *typecode;
2903 2903 sel->ips_remote_port = sel->ips_local_port = 0;
2904 2904 } else {
2905 2905 sel->ips_local_port = *ports++;
2906 2906 sel->ips_remote_port = *ports;
2907 2907 }
2908 2908 ipsec_freemsg_chain(spare_mp); /* Always works, even if NULL */
2909 2909 return (B_TRUE);
2910 2910 }
2911 2911
2912 2912 /*
2913 2913 * Prepend an mblk with a ipsec_crypto_t to the message chain.
2914 2914 * Frees the argument and returns NULL should the allocation fail.
2915 2915 * Returns the pointer to the crypto data part.
2916 2916 */
2917 2917 mblk_t *
2918 2918 ipsec_add_crypto_data(mblk_t *data_mp, ipsec_crypto_t **icp)
2919 2919 {
2920 2920 mblk_t *mp;
2921 2921
2922 2922 mp = allocb(sizeof (ipsec_crypto_t), BPRI_MED);
2923 2923 if (mp == NULL) {
2924 2924 freemsg(data_mp);
2925 2925 return (NULL);
2926 2926 }
2927 2927 bzero(mp->b_rptr, sizeof (ipsec_crypto_t));
2928 2928 mp->b_wptr += sizeof (ipsec_crypto_t);
2929 2929 mp->b_cont = data_mp;
2930 2930 mp->b_datap->db_type = M_EVENT; /* For ASSERT */
2931 2931 *icp = (ipsec_crypto_t *)mp->b_rptr;
2932 2932 return (mp);
2933 2933 }
2934 2934
2935 2935 /*
2936 2936 * Remove what was prepended above. Return b_cont and a pointer to the
2937 2937 * crypto data.
2938 2938 * The caller must call ipsec_free_crypto_data for mblk once it is done
2939 2939 * with the crypto data.
2940 2940 */
2941 2941 mblk_t *
2942 2942 ipsec_remove_crypto_data(mblk_t *crypto_mp, ipsec_crypto_t **icp)
2943 2943 {
2944 2944 ASSERT(crypto_mp->b_datap->db_type == M_EVENT);
2945 2945 ASSERT(MBLKL(crypto_mp) == sizeof (ipsec_crypto_t));
2946 2946
2947 2947 *icp = (ipsec_crypto_t *)crypto_mp->b_rptr;
2948 2948 return (crypto_mp->b_cont);
2949 2949 }
2950 2950
2951 2951 /*
2952 2952 * Free what was prepended above. Return b_cont.
2953 2953 */
2954 2954 mblk_t *
2955 2955 ipsec_free_crypto_data(mblk_t *crypto_mp)
2956 2956 {
2957 2957 mblk_t *mp;
2958 2958
2959 2959 ASSERT(crypto_mp->b_datap->db_type == M_EVENT);
2960 2960 ASSERT(MBLKL(crypto_mp) == sizeof (ipsec_crypto_t));
2961 2961
2962 2962 mp = crypto_mp->b_cont;
2963 2963 freeb(crypto_mp);
2964 2964 return (mp);
2965 2965 }
2966 2966
2967 2967 /*
2968 2968 * Create an ipsec_action_t based on the way an inbound packet was protected.
2969 2969 * Used to reflect traffic back to a sender.
2970 2970 *
2971 2971 * We don't bother interning the action into the hash table.
2972 2972 */
2973 2973 ipsec_action_t *
2974 2974 ipsec_in_to_out_action(ip_recv_attr_t *ira)
2975 2975 {
2976 2976 ipsa_t *ah_assoc, *esp_assoc;
2977 2977 uint_t auth_alg = 0, encr_alg = 0, espa_alg = 0;
2978 2978 ipsec_action_t *ap;
2979 2979 boolean_t unique;
2980 2980
2981 2981 ap = kmem_cache_alloc(ipsec_action_cache, KM_NOSLEEP);
2982 2982
2983 2983 if (ap == NULL)
2984 2984 return (NULL);
2985 2985
2986 2986 bzero(ap, sizeof (*ap));
2987 2987 HASH_NULL(ap, ipa_hash);
2988 2988 ap->ipa_next = NULL;
2989 2989 ap->ipa_refs = 1;
2990 2990
2991 2991 /*
2992 2992 * Get the algorithms that were used for this packet.
2993 2993 */
2994 2994 ap->ipa_act.ipa_type = IPSEC_ACT_APPLY;
2995 2995 ap->ipa_act.ipa_log = 0;
2996 2996 ASSERT(ira->ira_flags & IRAF_IPSEC_SECURE);
2997 2997
2998 2998 ah_assoc = ira->ira_ipsec_ah_sa;
2999 2999 ap->ipa_act.ipa_apply.ipp_use_ah = (ah_assoc != NULL);
3000 3000
3001 3001 esp_assoc = ira->ira_ipsec_esp_sa;
3002 3002 ap->ipa_act.ipa_apply.ipp_use_esp = (esp_assoc != NULL);
3003 3003
3004 3004 if (esp_assoc != NULL) {
3005 3005 encr_alg = esp_assoc->ipsa_encr_alg;
3006 3006 espa_alg = esp_assoc->ipsa_auth_alg;
3007 3007 ap->ipa_act.ipa_apply.ipp_use_espa = (espa_alg != 0);
3008 3008 }
3009 3009 if (ah_assoc != NULL)
3010 3010 auth_alg = ah_assoc->ipsa_auth_alg;
3011 3011
3012 3012 ap->ipa_act.ipa_apply.ipp_encr_alg = (uint8_t)encr_alg;
3013 3013 ap->ipa_act.ipa_apply.ipp_auth_alg = (uint8_t)auth_alg;
3014 3014 ap->ipa_act.ipa_apply.ipp_esp_auth_alg = (uint8_t)espa_alg;
3015 3015 ap->ipa_act.ipa_apply.ipp_use_se =
3016 3016 !!(ira->ira_flags & IRAF_IPSEC_DECAPS);
3017 3017 unique = B_FALSE;
3018 3018
3019 3019 if (esp_assoc != NULL) {
3020 3020 ap->ipa_act.ipa_apply.ipp_espa_minbits =
3021 3021 esp_assoc->ipsa_authkeybits;
3022 3022 ap->ipa_act.ipa_apply.ipp_espa_maxbits =
3023 3023 esp_assoc->ipsa_authkeybits;
3024 3024 ap->ipa_act.ipa_apply.ipp_espe_minbits =
3025 3025 esp_assoc->ipsa_encrkeybits;
3026 3026 ap->ipa_act.ipa_apply.ipp_espe_maxbits =
3027 3027 esp_assoc->ipsa_encrkeybits;
3028 3028 ap->ipa_act.ipa_apply.ipp_km_proto = esp_assoc->ipsa_kmp;
3029 3029 ap->ipa_act.ipa_apply.ipp_km_cookie = esp_assoc->ipsa_kmc;
3030 3030 if (esp_assoc->ipsa_flags & IPSA_F_UNIQUE)
3031 3031 unique = B_TRUE;
3032 3032 }
3033 3033 if (ah_assoc != NULL) {
3034 3034 ap->ipa_act.ipa_apply.ipp_ah_minbits =
3035 3035 ah_assoc->ipsa_authkeybits;
3036 3036 ap->ipa_act.ipa_apply.ipp_ah_maxbits =
3037 3037 ah_assoc->ipsa_authkeybits;
3038 3038 ap->ipa_act.ipa_apply.ipp_km_proto = ah_assoc->ipsa_kmp;
3039 3039 ap->ipa_act.ipa_apply.ipp_km_cookie = ah_assoc->ipsa_kmc;
3040 3040 if (ah_assoc->ipsa_flags & IPSA_F_UNIQUE)
3041 3041 unique = B_TRUE;
3042 3042 }
3043 3043 ap->ipa_act.ipa_apply.ipp_use_unique = unique;
3044 3044 ap->ipa_want_unique = unique;
3045 3045 ap->ipa_allow_clear = B_FALSE;
3046 3046 ap->ipa_want_se = !!(ira->ira_flags & IRAF_IPSEC_DECAPS);
3047 3047 ap->ipa_want_ah = (ah_assoc != NULL);
3048 3048 ap->ipa_want_esp = (esp_assoc != NULL);
3049 3049
3050 3050 ap->ipa_ovhd = ipsec_act_ovhd(&ap->ipa_act);
3051 3051
3052 3052 ap->ipa_act.ipa_apply.ipp_replay_depth = 0; /* don't care */
3053 3053
3054 3054 return (ap);
3055 3055 }
3056 3056
3057 3057
3058 3058 /*
3059 3059 * Compute the worst-case amount of extra space required by an action.
3060 3060 * Note that, because of the ESP considerations listed below, this is
3061 3061 * actually not the same as the best-case reduction in the MTU; in the
3062 3062 * future, we should pass additional information to this function to
3063 3063 * allow the actual MTU impact to be computed.
3064 3064 *
3065 3065 * AH: Revisit this if we implement algorithms with
3066 3066 * a verifier size of more than 12 bytes.
3067 3067 *
3068 3068 * ESP: A more exact but more messy computation would take into
3069 3069 * account the interaction between the cipher block size and the
3070 3070 * effective MTU, yielding the inner payload size which reflects a
3071 3071 * packet with *minimum* ESP padding..
3072 3072 */
3073 3073 int32_t
3074 3074 ipsec_act_ovhd(const ipsec_act_t *act)
3075 3075 {
3076 3076 int32_t overhead = 0;
3077 3077
3078 3078 if (act->ipa_type == IPSEC_ACT_APPLY) {
3079 3079 const ipsec_prot_t *ipp = &act->ipa_apply;
3080 3080
3081 3081 if (ipp->ipp_use_ah)
3082 3082 overhead += IPSEC_MAX_AH_HDR_SIZE;
3083 3083 if (ipp->ipp_use_esp) {
3084 3084 overhead += IPSEC_MAX_ESP_HDR_SIZE;
3085 3085 overhead += sizeof (struct udphdr);
3086 3086 }
3087 3087 if (ipp->ipp_use_se)
3088 3088 overhead += IP_SIMPLE_HDR_LENGTH;
3089 3089 }
3090 3090 return (overhead);
3091 3091 }
3092 3092
3093 3093 /*
3094 3094 * This hash function is used only when creating policies and thus is not
3095 3095 * performance-critical for packet flows.
3096 3096 *
3097 3097 * Future work: canonicalize the structures hashed with this (i.e.,
3098 3098 * zeroize padding) so the hash works correctly.
3099 3099 */
3100 3100 /* ARGSUSED */
3101 3101 static uint32_t
3102 3102 policy_hash(int size, const void *start, const void *end)
3103 3103 {
3104 3104 return (0);
3105 3105 }
3106 3106
3107 3107
3108 3108 /*
3109 3109 * Hash function macros for each address type.
3110 3110 *
3111 3111 * The IPV6 hash function assumes that the low order 32-bits of the
3112 3112 * address (typically containing the low order 24 bits of the mac
3113 3113 * address) are reasonably well-distributed. Revisit this if we run
3114 3114 * into trouble from lots of collisions on ::1 addresses and the like
3115 3115 * (seems unlikely).
3116 3116 */
3117 3117 #define IPSEC_IPV4_HASH(a, n) ((a) % (n))
3118 3118 #define IPSEC_IPV6_HASH(a, n) (((a).s6_addr32[3]) % (n))
3119 3119
3120 3120 /*
3121 3121 * These two hash functions should produce coordinated values
3122 3122 * but have slightly different roles.
3123 3123 */
3124 3124 static uint32_t
3125 3125 selkey_hash(const ipsec_selkey_t *selkey, netstack_t *ns)
3126 3126 {
3127 3127 uint32_t valid = selkey->ipsl_valid;
3128 3128 ipsec_stack_t *ipss = ns->netstack_ipsec;
3129 3129
3130 3130 if (!(valid & IPSL_REMOTE_ADDR))
3131 3131 return (IPSEC_SEL_NOHASH);
3132 3132
3133 3133 if (valid & IPSL_IPV4) {
3134 3134 if (selkey->ipsl_remote_pfxlen == 32) {
3135 3135 return (IPSEC_IPV4_HASH(selkey->ipsl_remote.ipsad_v4,
3136 3136 ipss->ipsec_spd_hashsize));
3137 3137 }
3138 3138 }
3139 3139 if (valid & IPSL_IPV6) {
3140 3140 if (selkey->ipsl_remote_pfxlen == 128) {
3141 3141 return (IPSEC_IPV6_HASH(selkey->ipsl_remote.ipsad_v6,
3142 3142 ipss->ipsec_spd_hashsize));
3143 3143 }
3144 3144 }
3145 3145 return (IPSEC_SEL_NOHASH);
3146 3146 }
3147 3147
3148 3148 static uint32_t
3149 3149 selector_hash(ipsec_selector_t *sel, ipsec_policy_root_t *root)
3150 3150 {
3151 3151 if (sel->ips_isv4) {
3152 3152 return (IPSEC_IPV4_HASH(sel->ips_remote_addr_v4,
3153 3153 root->ipr_nchains));
3154 3154 }
3155 3155 return (IPSEC_IPV6_HASH(sel->ips_remote_addr_v6, root->ipr_nchains));
3156 3156 }
3157 3157
3158 3158 /*
3159 3159 * Intern actions into the action hash table.
3160 3160 */
3161 3161 ipsec_action_t *
3162 3162 ipsec_act_find(const ipsec_act_t *a, int n, netstack_t *ns)
3163 3163 {
3164 3164 int i;
3165 3165 uint32_t hval;
3166 3166 ipsec_action_t *ap;
3167 3167 ipsec_action_t *prev = NULL;
3168 3168 int32_t overhead, maxovhd = 0;
3169 3169 boolean_t allow_clear = B_FALSE;
3170 3170 boolean_t want_ah = B_FALSE;
3171 3171 boolean_t want_esp = B_FALSE;
3172 3172 boolean_t want_se = B_FALSE;
3173 3173 boolean_t want_unique = B_FALSE;
3174 3174 ipsec_stack_t *ipss = ns->netstack_ipsec;
3175 3175
3176 3176 /*
3177 3177 * TODO: should canonicalize a[] (i.e., zeroize any padding)
3178 3178 * so we can use a non-trivial policy_hash function.
3179 3179 */
3180 3180 for (i = n-1; i >= 0; i--) {
3181 3181 hval = policy_hash(IPSEC_ACTION_HASH_SIZE, &a[i], &a[n]);
3182 3182
3183 3183 HASH_LOCK(ipss->ipsec_action_hash, hval);
3184 3184
3185 3185 for (HASH_ITERATE(ap, ipa_hash,
3186 3186 ipss->ipsec_action_hash, hval)) {
3187 3187 if (bcmp(&ap->ipa_act, &a[i], sizeof (*a)) != 0)
3188 3188 continue;
3189 3189 if (ap->ipa_next != prev)
3190 3190 continue;
3191 3191 break;
3192 3192 }
3193 3193 if (ap != NULL) {
3194 3194 HASH_UNLOCK(ipss->ipsec_action_hash, hval);
3195 3195 prev = ap;
3196 3196 continue;
3197 3197 }
3198 3198 /*
3199 3199 * need to allocate a new one..
3200 3200 */
3201 3201 ap = kmem_cache_alloc(ipsec_action_cache, KM_NOSLEEP);
3202 3202 if (ap == NULL) {
3203 3203 HASH_UNLOCK(ipss->ipsec_action_hash, hval);
3204 3204 if (prev != NULL)
3205 3205 ipsec_action_free(prev);
3206 3206 return (NULL);
3207 3207 }
3208 3208 HASH_INSERT(ap, ipa_hash, ipss->ipsec_action_hash, hval);
3209 3209
3210 3210 ap->ipa_next = prev;
3211 3211 ap->ipa_act = a[i];
3212 3212
3213 3213 overhead = ipsec_act_ovhd(&a[i]);
3214 3214 if (maxovhd < overhead)
3215 3215 maxovhd = overhead;
3216 3216
3217 3217 if ((a[i].ipa_type == IPSEC_ACT_BYPASS) ||
3218 3218 (a[i].ipa_type == IPSEC_ACT_CLEAR))
3219 3219 allow_clear = B_TRUE;
3220 3220 if (a[i].ipa_type == IPSEC_ACT_APPLY) {
3221 3221 const ipsec_prot_t *ipp = &a[i].ipa_apply;
3222 3222
3223 3223 ASSERT(ipp->ipp_use_ah || ipp->ipp_use_esp);
3224 3224 want_ah |= ipp->ipp_use_ah;
3225 3225 want_esp |= ipp->ipp_use_esp;
3226 3226 want_se |= ipp->ipp_use_se;
3227 3227 want_unique |= ipp->ipp_use_unique;
3228 3228 }
3229 3229 ap->ipa_allow_clear = allow_clear;
3230 3230 ap->ipa_want_ah = want_ah;
3231 3231 ap->ipa_want_esp = want_esp;
3232 3232 ap->ipa_want_se = want_se;
3233 3233 ap->ipa_want_unique = want_unique;
3234 3234 ap->ipa_refs = 1; /* from the hash table */
3235 3235 ap->ipa_ovhd = maxovhd;
3236 3236 if (prev)
3237 3237 prev->ipa_refs++;
3238 3238 prev = ap;
3239 3239 HASH_UNLOCK(ipss->ipsec_action_hash, hval);
3240 3240 }
3241 3241
3242 3242 ap->ipa_refs++; /* caller's reference */
3243 3243
3244 3244 return (ap);
3245 3245 }
3246 3246
3247 3247 /*
3248 3248 * Called when refcount goes to 0, indicating that all references to this
3249 3249 * node are gone.
3250 3250 *
3251 3251 * This does not unchain the action from the hash table.
3252 3252 */
3253 3253 void
3254 3254 ipsec_action_free(ipsec_action_t *ap)
3255 3255 {
3256 3256 for (;;) {
3257 3257 ipsec_action_t *np = ap->ipa_next;
3258 3258 ASSERT(ap->ipa_refs == 0);
3259 3259 ASSERT(ap->ipa_hash.hash_pp == NULL);
3260 3260 kmem_cache_free(ipsec_action_cache, ap);
3261 3261 ap = np;
3262 3262 /* Inlined IPACT_REFRELE -- avoid recursion */
3263 3263 if (ap == NULL)
3264 3264 break;
3265 3265 membar_exit();
3266 3266 if (atomic_dec_32_nv(&(ap)->ipa_refs) != 0)
3267 3267 break;
3268 3268 /* End inlined IPACT_REFRELE */
3269 3269 }
3270 3270 }
3271 3271
3272 3272 /*
3273 3273 * Called when the action hash table goes away.
3274 3274 *
3275 3275 * The actions can be queued on an mblk with ipsec_in or
3276 3276 * ipsec_out, hence the actions might still be around.
3277 3277 * But we decrement ipa_refs here since we no longer have
3278 3278 * a reference to the action from the hash table.
3279 3279 */
3280 3280 static void
3281 3281 ipsec_action_free_table(ipsec_action_t *ap)
3282 3282 {
3283 3283 while (ap != NULL) {
3284 3284 ipsec_action_t *np = ap->ipa_next;
3285 3285
3286 3286 /* FIXME: remove? */
3287 3287 (void) printf("ipsec_action_free_table(%p) ref %d\n",
3288 3288 (void *)ap, ap->ipa_refs);
3289 3289 ASSERT(ap->ipa_refs > 0);
3290 3290 IPACT_REFRELE(ap);
3291 3291 ap = np;
3292 3292 }
3293 3293 }
3294 3294
3295 3295 /*
3296 3296 * Need to walk all stack instances since the reclaim function
3297 3297 * is global for all instances
3298 3298 */
3299 3299 /* ARGSUSED */
3300 3300 static void
3301 3301 ipsec_action_reclaim(void *arg)
3302 3302 {
3303 3303 netstack_handle_t nh;
3304 3304 netstack_t *ns;
3305 3305 ipsec_stack_t *ipss;
3306 3306
3307 3307 netstack_next_init(&nh);
3308 3308 while ((ns = netstack_next(&nh)) != NULL) {
3309 3309 /*
3310 3310 * netstack_next() can return a netstack_t with a NULL
3311 3311 * netstack_ipsec at boot time.
3312 3312 */
3313 3313 if ((ipss = ns->netstack_ipsec) == NULL) {
3314 3314 netstack_rele(ns);
3315 3315 continue;
3316 3316 }
3317 3317 ipsec_action_reclaim_stack(ipss);
3318 3318 netstack_rele(ns);
3319 3319 }
3320 3320 netstack_next_fini(&nh);
3321 3321 }
3322 3322
3323 3323 /*
3324 3324 * Periodically sweep action hash table for actions with refcount==1, and
3325 3325 * nuke them. We cannot do this "on demand" (i.e., from IPACT_REFRELE)
3326 3326 * because we can't close the race between another thread finding the action
3327 3327 * in the hash table without holding the bucket lock during IPACT_REFRELE.
3328 3328 * Instead, we run this function sporadically to clean up after ourselves;
3329 3329 * we also set it as the "reclaim" function for the action kmem_cache.
3330 3330 *
3331 3331 * Note that it may take several passes of ipsec_action_gc() to free all
3332 3332 * "stale" actions.
3333 3333 */
3334 3334 static void
3335 3335 ipsec_action_reclaim_stack(ipsec_stack_t *ipss)
3336 3336 {
3337 3337 int i;
3338 3338
3339 3339 for (i = 0; i < IPSEC_ACTION_HASH_SIZE; i++) {
3340 3340 ipsec_action_t *ap, *np;
3341 3341
3342 3342 /* skip the lock if nobody home */
3343 3343 if (ipss->ipsec_action_hash[i].hash_head == NULL)
3344 3344 continue;
3345 3345
3346 3346 HASH_LOCK(ipss->ipsec_action_hash, i);
3347 3347 for (ap = ipss->ipsec_action_hash[i].hash_head;
3348 3348 ap != NULL; ap = np) {
3349 3349 ASSERT(ap->ipa_refs > 0);
3350 3350 np = ap->ipa_hash.hash_next;
3351 3351 if (ap->ipa_refs > 1)
3352 3352 continue;
3353 3353 HASH_UNCHAIN(ap, ipa_hash,
3354 3354 ipss->ipsec_action_hash, i);
3355 3355 IPACT_REFRELE(ap);
3356 3356 }
3357 3357 HASH_UNLOCK(ipss->ipsec_action_hash, i);
3358 3358 }
3359 3359 }
3360 3360
3361 3361 /*
3362 3362 * Intern a selector set into the selector set hash table.
3363 3363 * This is simpler than the actions case..
3364 3364 */
3365 3365 static ipsec_sel_t *
3366 3366 ipsec_find_sel(ipsec_selkey_t *selkey, netstack_t *ns)
3367 3367 {
3368 3368 ipsec_sel_t *sp;
3369 3369 uint32_t hval, bucket;
3370 3370 ipsec_stack_t *ipss = ns->netstack_ipsec;
3371 3371
3372 3372 /*
3373 3373 * Exactly one AF bit should be set in selkey.
3374 3374 */
3375 3375 ASSERT(!(selkey->ipsl_valid & IPSL_IPV4) ^
3376 3376 !(selkey->ipsl_valid & IPSL_IPV6));
3377 3377
3378 3378 hval = selkey_hash(selkey, ns);
3379 3379 /* Set pol_hval to uninitialized until we put it in a polhead. */
3380 3380 selkey->ipsl_sel_hval = hval;
3381 3381
3382 3382 bucket = (hval == IPSEC_SEL_NOHASH) ? 0 : hval;
3383 3383
3384 3384 ASSERT(!HASH_LOCKED(ipss->ipsec_sel_hash, bucket));
3385 3385 HASH_LOCK(ipss->ipsec_sel_hash, bucket);
3386 3386
3387 3387 for (HASH_ITERATE(sp, ipsl_hash, ipss->ipsec_sel_hash, bucket)) {
3388 3388 if (bcmp(&sp->ipsl_key, selkey,
3389 3389 offsetof(ipsec_selkey_t, ipsl_pol_hval)) == 0)
3390 3390 break;
3391 3391 }
3392 3392 if (sp != NULL) {
3393 3393 sp->ipsl_refs++;
3394 3394
3395 3395 HASH_UNLOCK(ipss->ipsec_sel_hash, bucket);
3396 3396 return (sp);
3397 3397 }
3398 3398
3399 3399 sp = kmem_cache_alloc(ipsec_sel_cache, KM_NOSLEEP);
3400 3400 if (sp == NULL) {
3401 3401 HASH_UNLOCK(ipss->ipsec_sel_hash, bucket);
3402 3402 return (NULL);
3403 3403 }
3404 3404
3405 3405 HASH_INSERT(sp, ipsl_hash, ipss->ipsec_sel_hash, bucket);
3406 3406 sp->ipsl_refs = 2; /* one for hash table, one for caller */
3407 3407 sp->ipsl_key = *selkey;
3408 3408 /* Set to uninitalized and have insertion into polhead fix things. */
3409 3409 if (selkey->ipsl_sel_hval != IPSEC_SEL_NOHASH)
3410 3410 sp->ipsl_key.ipsl_pol_hval = 0;
3411 3411 else
3412 3412 sp->ipsl_key.ipsl_pol_hval = IPSEC_SEL_NOHASH;
3413 3413
3414 3414 HASH_UNLOCK(ipss->ipsec_sel_hash, bucket);
3415 3415
3416 3416 return (sp);
3417 3417 }
3418 3418
3419 3419 static void
3420 3420 ipsec_sel_rel(ipsec_sel_t **spp, netstack_t *ns)
3421 3421 {
3422 3422 ipsec_sel_t *sp = *spp;
3423 3423 int hval = sp->ipsl_key.ipsl_sel_hval;
3424 3424 ipsec_stack_t *ipss = ns->netstack_ipsec;
3425 3425
3426 3426 *spp = NULL;
3427 3427
3428 3428 if (hval == IPSEC_SEL_NOHASH)
3429 3429 hval = 0;
3430 3430
3431 3431 ASSERT(!HASH_LOCKED(ipss->ipsec_sel_hash, hval));
3432 3432 HASH_LOCK(ipss->ipsec_sel_hash, hval);
3433 3433 if (--sp->ipsl_refs == 1) {
3434 3434 HASH_UNCHAIN(sp, ipsl_hash, ipss->ipsec_sel_hash, hval);
3435 3435 sp->ipsl_refs--;
3436 3436 HASH_UNLOCK(ipss->ipsec_sel_hash, hval);
3437 3437 ASSERT(sp->ipsl_refs == 0);
3438 3438 kmem_cache_free(ipsec_sel_cache, sp);
3439 3439 /* Caller unlocks */
3440 3440 return;
3441 3441 }
3442 3442
3443 3443 HASH_UNLOCK(ipss->ipsec_sel_hash, hval);
3444 3444 }
3445 3445
3446 3446 /*
3447 3447 * Free a policy rule which we know is no longer being referenced.
3448 3448 */
3449 3449 void
3450 3450 ipsec_policy_free(ipsec_policy_t *ipp)
3451 3451 {
3452 3452 ASSERT(ipp->ipsp_refs == 0);
3453 3453 ASSERT(ipp->ipsp_sel != NULL);
3454 3454 ASSERT(ipp->ipsp_act != NULL);
3455 3455 ASSERT(ipp->ipsp_netstack != NULL);
3456 3456
3457 3457 ipsec_sel_rel(&ipp->ipsp_sel, ipp->ipsp_netstack);
3458 3458 IPACT_REFRELE(ipp->ipsp_act);
3459 3459 kmem_cache_free(ipsec_pol_cache, ipp);
3460 3460 }
3461 3461
3462 3462 /*
3463 3463 * Construction of new policy rules; construct a policy, and add it to
3464 3464 * the appropriate tables.
3465 3465 */
3466 3466 ipsec_policy_t *
3467 3467 ipsec_policy_create(ipsec_selkey_t *keys, const ipsec_act_t *a,
3468 3468 int nacts, int prio, uint64_t *index_ptr, netstack_t *ns)
3469 3469 {
3470 3470 ipsec_action_t *ap;
3471 3471 ipsec_sel_t *sp;
3472 3472 ipsec_policy_t *ipp;
3473 3473 ipsec_stack_t *ipss = ns->netstack_ipsec;
3474 3474
3475 3475 if (index_ptr == NULL)
3476 3476 index_ptr = &ipss->ipsec_next_policy_index;
3477 3477
3478 3478 ipp = kmem_cache_alloc(ipsec_pol_cache, KM_NOSLEEP);
3479 3479 ap = ipsec_act_find(a, nacts, ns);
3480 3480 sp = ipsec_find_sel(keys, ns);
3481 3481
3482 3482 if ((ap == NULL) || (sp == NULL) || (ipp == NULL)) {
3483 3483 if (ap != NULL) {
3484 3484 IPACT_REFRELE(ap);
3485 3485 }
3486 3486 if (sp != NULL)
3487 3487 ipsec_sel_rel(&sp, ns);
3488 3488 if (ipp != NULL)
3489 3489 kmem_cache_free(ipsec_pol_cache, ipp);
3490 3490 return (NULL);
3491 3491 }
3492 3492
3493 3493 HASH_NULL(ipp, ipsp_hash);
3494 3494
3495 3495 ipp->ipsp_netstack = ns; /* Needed for ipsec_policy_free */
3496 3496 ipp->ipsp_refs = 1; /* caller's reference */
3497 3497 ipp->ipsp_sel = sp;
3498 3498 ipp->ipsp_act = ap;
3499 3499 ipp->ipsp_prio = prio; /* rule priority */
3500 3500 ipp->ipsp_index = *index_ptr;
3501 3501 (*index_ptr)++;
3502 3502
3503 3503 return (ipp);
3504 3504 }
3505 3505
3506 3506 static void
3507 3507 ipsec_update_present_flags(ipsec_stack_t *ipss)
3508 3508 {
3509 3509 boolean_t hashpol;
3510 3510
3511 3511 hashpol = (avl_numnodes(&ipss->ipsec_system_policy.iph_rulebyid) > 0);
3512 3512
3513 3513 if (hashpol) {
3514 3514 ipss->ipsec_outbound_v4_policy_present = B_TRUE;
3515 3515 ipss->ipsec_outbound_v6_policy_present = B_TRUE;
3516 3516 ipss->ipsec_inbound_v4_policy_present = B_TRUE;
3517 3517 ipss->ipsec_inbound_v6_policy_present = B_TRUE;
3518 3518 return;
3519 3519 }
3520 3520
3521 3521 ipss->ipsec_outbound_v4_policy_present = (NULL !=
3522 3522 ipss->ipsec_system_policy.iph_root[IPSEC_TYPE_OUTBOUND].
3523 3523 ipr_nonhash[IPSEC_AF_V4]);
3524 3524 ipss->ipsec_outbound_v6_policy_present = (NULL !=
3525 3525 ipss->ipsec_system_policy.iph_root[IPSEC_TYPE_OUTBOUND].
3526 3526 ipr_nonhash[IPSEC_AF_V6]);
3527 3527 ipss->ipsec_inbound_v4_policy_present = (NULL !=
3528 3528 ipss->ipsec_system_policy.iph_root[IPSEC_TYPE_INBOUND].
3529 3529 ipr_nonhash[IPSEC_AF_V4]);
3530 3530 ipss->ipsec_inbound_v6_policy_present = (NULL !=
3531 3531 ipss->ipsec_system_policy.iph_root[IPSEC_TYPE_INBOUND].
3532 3532 ipr_nonhash[IPSEC_AF_V6]);
3533 3533 }
3534 3534
3535 3535 boolean_t
3536 3536 ipsec_policy_delete(ipsec_policy_head_t *php, ipsec_selkey_t *keys, int dir,
3537 3537 netstack_t *ns)
3538 3538 {
3539 3539 ipsec_sel_t *sp;
3540 3540 ipsec_policy_t *ip, *nip, *head;
3541 3541 int af;
3542 3542 ipsec_policy_root_t *pr = &php->iph_root[dir];
3543 3543
3544 3544 sp = ipsec_find_sel(keys, ns);
3545 3545
3546 3546 if (sp == NULL)
3547 3547 return (B_FALSE);
3548 3548
3549 3549 af = (sp->ipsl_key.ipsl_valid & IPSL_IPV4) ? IPSEC_AF_V4 : IPSEC_AF_V6;
3550 3550
3551 3551 rw_enter(&php->iph_lock, RW_WRITER);
3552 3552
3553 3553 if (sp->ipsl_key.ipsl_pol_hval == IPSEC_SEL_NOHASH) {
3554 3554 head = pr->ipr_nonhash[af];
3555 3555 } else {
3556 3556 head = pr->ipr_hash[sp->ipsl_key.ipsl_pol_hval].hash_head;
3557 3557 }
3558 3558
3559 3559 for (ip = head; ip != NULL; ip = nip) {
3560 3560 nip = ip->ipsp_hash.hash_next;
3561 3561 if (ip->ipsp_sel != sp) {
3562 3562 continue;
3563 3563 }
3564 3564
3565 3565 IPPOL_UNCHAIN(php, ip);
3566 3566
3567 3567 php->iph_gen++;
3568 3568 ipsec_update_present_flags(ns->netstack_ipsec);
3569 3569
3570 3570 rw_exit(&php->iph_lock);
3571 3571
3572 3572 ipsec_sel_rel(&sp, ns);
3573 3573
3574 3574 return (B_TRUE);
3575 3575 }
3576 3576
3577 3577 rw_exit(&php->iph_lock);
3578 3578 ipsec_sel_rel(&sp, ns);
3579 3579 return (B_FALSE);
3580 3580 }
3581 3581
3582 3582 int
3583 3583 ipsec_policy_delete_index(ipsec_policy_head_t *php, uint64_t policy_index,
3584 3584 netstack_t *ns)
3585 3585 {
3586 3586 boolean_t found = B_FALSE;
3587 3587 ipsec_policy_t ipkey;
3588 3588 ipsec_policy_t *ip;
3589 3589 avl_index_t where;
3590 3590
3591 3591 bzero(&ipkey, sizeof (ipkey));
3592 3592 ipkey.ipsp_index = policy_index;
3593 3593
3594 3594 rw_enter(&php->iph_lock, RW_WRITER);
3595 3595
3596 3596 /*
3597 3597 * We could be cleverer here about the walk.
3598 3598 * but well, (k+1)*log(N) will do for now (k==number of matches,
3599 3599 * N==number of table entries
3600 3600 */
3601 3601 for (;;) {
3602 3602 ip = (ipsec_policy_t *)avl_find(&php->iph_rulebyid,
3603 3603 (void *)&ipkey, &where);
3604 3604 ASSERT(ip == NULL);
3605 3605
3606 3606 ip = avl_nearest(&php->iph_rulebyid, where, AVL_AFTER);
3607 3607
3608 3608 if (ip == NULL)
3609 3609 break;
3610 3610
3611 3611 if (ip->ipsp_index != policy_index) {
3612 3612 ASSERT(ip->ipsp_index > policy_index);
3613 3613 break;
3614 3614 }
3615 3615
3616 3616 IPPOL_UNCHAIN(php, ip);
3617 3617 found = B_TRUE;
3618 3618 }
3619 3619
3620 3620 if (found) {
3621 3621 php->iph_gen++;
3622 3622 ipsec_update_present_flags(ns->netstack_ipsec);
3623 3623 }
3624 3624
3625 3625 rw_exit(&php->iph_lock);
3626 3626
3627 3627 return (found ? 0 : ENOENT);
3628 3628 }
3629 3629
3630 3630 /*
3631 3631 * Given a constructed ipsec_policy_t policy rule, see if it can be entered
3632 3632 * into the correct policy ruleset. As a side-effect, it sets the hash
3633 3633 * entries on "ipp"'s ipsp_pol_hval.
3634 3634 *
3635 3635 * Returns B_TRUE if it can be entered, B_FALSE if it can't be (because a
3636 3636 * duplicate policy exists with exactly the same selectors), or an icmp
3637 3637 * rule exists with a different encryption/authentication action.
3638 3638 */
3639 3639 boolean_t
3640 3640 ipsec_check_policy(ipsec_policy_head_t *php, ipsec_policy_t *ipp, int direction)
3641 3641 {
3642 3642 ipsec_policy_root_t *pr = &php->iph_root[direction];
3643 3643 int af = -1;
3644 3644 ipsec_policy_t *p2, *head;
3645 3645 uint8_t check_proto;
3646 3646 ipsec_selkey_t *selkey = &ipp->ipsp_sel->ipsl_key;
3647 3647 uint32_t valid = selkey->ipsl_valid;
3648 3648
3649 3649 if (valid & IPSL_IPV6) {
3650 3650 ASSERT(!(valid & IPSL_IPV4));
3651 3651 af = IPSEC_AF_V6;
3652 3652 check_proto = IPPROTO_ICMPV6;
3653 3653 } else {
3654 3654 ASSERT(valid & IPSL_IPV4);
3655 3655 af = IPSEC_AF_V4;
3656 3656 check_proto = IPPROTO_ICMP;
3657 3657 }
3658 3658
3659 3659 ASSERT(RW_WRITE_HELD(&php->iph_lock));
3660 3660
3661 3661 /*
3662 3662 * Double-check that we don't have any duplicate selectors here.
3663 3663 * Because selectors are interned below, we need only compare pointers
3664 3664 * for equality.
3665 3665 */
3666 3666 if (selkey->ipsl_sel_hval == IPSEC_SEL_NOHASH) {
3667 3667 head = pr->ipr_nonhash[af];
3668 3668 } else {
3669 3669 selkey->ipsl_pol_hval =
3670 3670 (selkey->ipsl_valid & IPSL_IPV4) ?
3671 3671 IPSEC_IPV4_HASH(selkey->ipsl_remote.ipsad_v4,
3672 3672 pr->ipr_nchains) :
3673 3673 IPSEC_IPV6_HASH(selkey->ipsl_remote.ipsad_v6,
3674 3674 pr->ipr_nchains);
3675 3675
3676 3676 head = pr->ipr_hash[selkey->ipsl_pol_hval].hash_head;
3677 3677 }
3678 3678
3679 3679 for (p2 = head; p2 != NULL; p2 = p2->ipsp_hash.hash_next) {
3680 3680 if (p2->ipsp_sel == ipp->ipsp_sel)
3681 3681 return (B_FALSE);
3682 3682 }
3683 3683
3684 3684 /*
3685 3685 * If it's ICMP and not a drop or pass rule, run through the ICMP
3686 3686 * rules and make sure the action is either new or the same as any
3687 3687 * other actions. We don't have to check the full chain because
3688 3688 * discard and bypass will override all other actions
3689 3689 */
3690 3690
3691 3691 if (valid & IPSL_PROTOCOL &&
3692 3692 selkey->ipsl_proto == check_proto &&
3693 3693 (ipp->ipsp_act->ipa_act.ipa_type == IPSEC_ACT_APPLY)) {
3694 3694
3695 3695 for (p2 = head; p2 != NULL; p2 = p2->ipsp_hash.hash_next) {
3696 3696
3697 3697 if (p2->ipsp_sel->ipsl_key.ipsl_valid & IPSL_PROTOCOL &&
3698 3698 p2->ipsp_sel->ipsl_key.ipsl_proto == check_proto &&
3699 3699 (p2->ipsp_act->ipa_act.ipa_type ==
3700 3700 IPSEC_ACT_APPLY)) {
3701 3701 return (ipsec_compare_action(p2, ipp));
3702 3702 }
3703 3703 }
3704 3704 }
3705 3705
3706 3706 return (B_TRUE);
3707 3707 }
3708 3708
3709 3709 /*
3710 3710 * compare the action chains of two policies for equality
3711 3711 * B_TRUE -> effective equality
3712 3712 */
3713 3713
3714 3714 static boolean_t
3715 3715 ipsec_compare_action(ipsec_policy_t *p1, ipsec_policy_t *p2)
3716 3716 {
3717 3717
3718 3718 ipsec_action_t *act1, *act2;
3719 3719
3720 3720 /* We have a valid rule. Let's compare the actions */
3721 3721 if (p1->ipsp_act == p2->ipsp_act) {
3722 3722 /* same action. We are good */
3723 3723 return (B_TRUE);
3724 3724 }
3725 3725
3726 3726 /* we have to walk the chain */
3727 3727
3728 3728 act1 = p1->ipsp_act;
3729 3729 act2 = p2->ipsp_act;
3730 3730
3731 3731 while (act1 != NULL && act2 != NULL) {
3732 3732
3733 3733 /* otherwise, Are we close enough? */
3734 3734 if (act1->ipa_allow_clear != act2->ipa_allow_clear ||
3735 3735 act1->ipa_want_ah != act2->ipa_want_ah ||
3736 3736 act1->ipa_want_esp != act2->ipa_want_esp ||
3737 3737 act1->ipa_want_se != act2->ipa_want_se) {
3738 3738 /* Nope, we aren't */
3739 3739 return (B_FALSE);
3740 3740 }
3741 3741
3742 3742 if (act1->ipa_want_ah) {
3743 3743 if (act1->ipa_act.ipa_apply.ipp_auth_alg !=
3744 3744 act2->ipa_act.ipa_apply.ipp_auth_alg) {
3745 3745 return (B_FALSE);
3746 3746 }
3747 3747
3748 3748 if (act1->ipa_act.ipa_apply.ipp_ah_minbits !=
3749 3749 act2->ipa_act.ipa_apply.ipp_ah_minbits ||
3750 3750 act1->ipa_act.ipa_apply.ipp_ah_maxbits !=
3751 3751 act2->ipa_act.ipa_apply.ipp_ah_maxbits) {
3752 3752 return (B_FALSE);
3753 3753 }
3754 3754 }
3755 3755
3756 3756 if (act1->ipa_want_esp) {
3757 3757 if (act1->ipa_act.ipa_apply.ipp_use_esp !=
3758 3758 act2->ipa_act.ipa_apply.ipp_use_esp ||
3759 3759 act1->ipa_act.ipa_apply.ipp_use_espa !=
3760 3760 act2->ipa_act.ipa_apply.ipp_use_espa) {
3761 3761 return (B_FALSE);
3762 3762 }
3763 3763
3764 3764 if (act1->ipa_act.ipa_apply.ipp_use_esp) {
3765 3765 if (act1->ipa_act.ipa_apply.ipp_encr_alg !=
3766 3766 act2->ipa_act.ipa_apply.ipp_encr_alg) {
3767 3767 return (B_FALSE);
3768 3768 }
3769 3769
3770 3770 if (act1->ipa_act.ipa_apply.ipp_espe_minbits !=
3771 3771 act2->ipa_act.ipa_apply.ipp_espe_minbits ||
3772 3772 act1->ipa_act.ipa_apply.ipp_espe_maxbits !=
3773 3773 act2->ipa_act.ipa_apply.ipp_espe_maxbits) {
3774 3774 return (B_FALSE);
3775 3775 }
3776 3776 }
3777 3777
3778 3778 if (act1->ipa_act.ipa_apply.ipp_use_espa) {
3779 3779 if (act1->ipa_act.ipa_apply.ipp_esp_auth_alg !=
3780 3780 act2->ipa_act.ipa_apply.ipp_esp_auth_alg) {
3781 3781 return (B_FALSE);
3782 3782 }
3783 3783
3784 3784 if (act1->ipa_act.ipa_apply.ipp_espa_minbits !=
3785 3785 act2->ipa_act.ipa_apply.ipp_espa_minbits ||
3786 3786 act1->ipa_act.ipa_apply.ipp_espa_maxbits !=
3787 3787 act2->ipa_act.ipa_apply.ipp_espa_maxbits) {
3788 3788 return (B_FALSE);
3789 3789 }
3790 3790 }
3791 3791
3792 3792 }
3793 3793
3794 3794 act1 = act1->ipa_next;
3795 3795 act2 = act2->ipa_next;
3796 3796 }
3797 3797
3798 3798 if (act1 != NULL || act2 != NULL) {
3799 3799 return (B_FALSE);
3800 3800 }
3801 3801
3802 3802 return (B_TRUE);
3803 3803 }
3804 3804
3805 3805
3806 3806 /*
3807 3807 * Given a constructed ipsec_policy_t policy rule, enter it into
3808 3808 * the correct policy ruleset.
3809 3809 *
3810 3810 * ipsec_check_policy() is assumed to have succeeded first (to check for
3811 3811 * duplicates).
3812 3812 */
3813 3813 void
3814 3814 ipsec_enter_policy(ipsec_policy_head_t *php, ipsec_policy_t *ipp, int direction,
3815 3815 netstack_t *ns)
3816 3816 {
3817 3817 ipsec_policy_root_t *pr = &php->iph_root[direction];
3818 3818 ipsec_selkey_t *selkey = &ipp->ipsp_sel->ipsl_key;
3819 3819 uint32_t valid = selkey->ipsl_valid;
3820 3820 uint32_t hval = selkey->ipsl_pol_hval;
3821 3821 int af = -1;
3822 3822
3823 3823 ASSERT(RW_WRITE_HELD(&php->iph_lock));
3824 3824
3825 3825 if (valid & IPSL_IPV6) {
3826 3826 ASSERT(!(valid & IPSL_IPV4));
3827 3827 af = IPSEC_AF_V6;
3828 3828 } else {
3829 3829 ASSERT(valid & IPSL_IPV4);
3830 3830 af = IPSEC_AF_V4;
3831 3831 }
3832 3832
3833 3833 php->iph_gen++;
3834 3834
3835 3835 if (hval == IPSEC_SEL_NOHASH) {
3836 3836 HASHLIST_INSERT(ipp, ipsp_hash, pr->ipr_nonhash[af]);
3837 3837 } else {
3838 3838 HASH_LOCK(pr->ipr_hash, hval);
3839 3839 HASH_INSERT(ipp, ipsp_hash, pr->ipr_hash, hval);
3840 3840 HASH_UNLOCK(pr->ipr_hash, hval);
3841 3841 }
3842 3842
3843 3843 ipsec_insert_always(&php->iph_rulebyid, ipp);
3844 3844
3845 3845 ipsec_update_present_flags(ns->netstack_ipsec);
3846 3846 }
3847 3847
3848 3848 static void
3849 3849 ipsec_ipr_flush(ipsec_policy_head_t *php, ipsec_policy_root_t *ipr)
3850 3850 {
3851 3851 ipsec_policy_t *ip, *nip;
3852 3852 int af, chain, nchain;
3853 3853
3854 3854 for (af = 0; af < IPSEC_NAF; af++) {
3855 3855 for (ip = ipr->ipr_nonhash[af]; ip != NULL; ip = nip) {
3856 3856 nip = ip->ipsp_hash.hash_next;
3857 3857 IPPOL_UNCHAIN(php, ip);
3858 3858 }
3859 3859 ipr->ipr_nonhash[af] = NULL;
3860 3860 }
3861 3861 nchain = ipr->ipr_nchains;
3862 3862
3863 3863 for (chain = 0; chain < nchain; chain++) {
3864 3864 for (ip = ipr->ipr_hash[chain].hash_head; ip != NULL;
3865 3865 ip = nip) {
3866 3866 nip = ip->ipsp_hash.hash_next;
3867 3867 IPPOL_UNCHAIN(php, ip);
3868 3868 }
3869 3869 ipr->ipr_hash[chain].hash_head = NULL;
3870 3870 }
3871 3871 }
3872 3872
3873 3873 /*
3874 3874 * Create and insert inbound or outbound policy associated with actp for the
3875 3875 * address family fam into the policy head ph. Returns B_TRUE if policy was
3876 3876 * inserted, and B_FALSE otherwise.
3877 3877 */
3878 3878 boolean_t
3879 3879 ipsec_polhead_insert(ipsec_policy_head_t *ph, ipsec_act_t *actp, uint_t nact,
3880 3880 int fam, int ptype, netstack_t *ns)
3881 3881 {
3882 3882 ipsec_selkey_t sel;
3883 3883 ipsec_policy_t *pol;
3884 3884 ipsec_policy_root_t *pr;
3885 3885
3886 3886 bzero(&sel, sizeof (sel));
3887 3887 sel.ipsl_valid = (fam == IPSEC_AF_V4 ? IPSL_IPV4 : IPSL_IPV6);
3888 3888 if ((pol = ipsec_policy_create(&sel, actp, nact, IPSEC_PRIO_SOCKET,
3889 3889 NULL, ns)) != NULL) {
3890 3890 pr = &ph->iph_root[ptype];
3891 3891 HASHLIST_INSERT(pol, ipsp_hash, pr->ipr_nonhash[fam]);
3892 3892 ipsec_insert_always(&ph->iph_rulebyid, pol);
3893 3893 }
3894 3894 return (pol != NULL);
3895 3895 }
3896 3896
3897 3897 void
3898 3898 ipsec_polhead_flush(ipsec_policy_head_t *php, netstack_t *ns)
3899 3899 {
3900 3900 int dir;
3901 3901
3902 3902 ASSERT(RW_WRITE_HELD(&php->iph_lock));
3903 3903
3904 3904 for (dir = 0; dir < IPSEC_NTYPES; dir++)
3905 3905 ipsec_ipr_flush(php, &php->iph_root[dir]);
3906 3906
3907 3907 php->iph_gen++;
3908 3908 ipsec_update_present_flags(ns->netstack_ipsec);
3909 3909 }
3910 3910
3911 3911 void
3912 3912 ipsec_polhead_free(ipsec_policy_head_t *php, netstack_t *ns)
3913 3913 {
3914 3914 int dir;
3915 3915
3916 3916 ASSERT(php->iph_refs == 0);
3917 3917
3918 3918 rw_enter(&php->iph_lock, RW_WRITER);
3919 3919 ipsec_polhead_flush(php, ns);
3920 3920 rw_exit(&php->iph_lock);
3921 3921 rw_destroy(&php->iph_lock);
3922 3922 for (dir = 0; dir < IPSEC_NTYPES; dir++) {
3923 3923 ipsec_policy_root_t *ipr = &php->iph_root[dir];
3924 3924 int chain;
3925 3925
3926 3926 for (chain = 0; chain < ipr->ipr_nchains; chain++)
3927 3927 mutex_destroy(&(ipr->ipr_hash[chain].hash_lock));
3928 3928
3929 3929 }
3930 3930 ipsec_polhead_free_table(php);
3931 3931 kmem_free(php, sizeof (*php));
3932 3932 }
3933 3933
3934 3934 static void
3935 3935 ipsec_ipr_init(ipsec_policy_root_t *ipr)
3936 3936 {
3937 3937 int af;
3938 3938
3939 3939 ipr->ipr_nchains = 0;
3940 3940 ipr->ipr_hash = NULL;
3941 3941
3942 3942 for (af = 0; af < IPSEC_NAF; af++) {
3943 3943 ipr->ipr_nonhash[af] = NULL;
3944 3944 }
3945 3945 }
3946 3946
3947 3947 ipsec_policy_head_t *
3948 3948 ipsec_polhead_create(void)
3949 3949 {
3950 3950 ipsec_policy_head_t *php;
3951 3951
3952 3952 php = kmem_alloc(sizeof (*php), KM_NOSLEEP);
3953 3953 if (php == NULL)
3954 3954 return (php);
3955 3955
3956 3956 rw_init(&php->iph_lock, NULL, RW_DEFAULT, NULL);
3957 3957 php->iph_refs = 1;
3958 3958 php->iph_gen = 0;
3959 3959
3960 3960 ipsec_ipr_init(&php->iph_root[IPSEC_TYPE_INBOUND]);
3961 3961 ipsec_ipr_init(&php->iph_root[IPSEC_TYPE_OUTBOUND]);
3962 3962
3963 3963 avl_create(&php->iph_rulebyid, ipsec_policy_cmpbyid,
3964 3964 sizeof (ipsec_policy_t), offsetof(ipsec_policy_t, ipsp_byid));
3965 3965
3966 3966 return (php);
3967 3967 }
3968 3968
3969 3969 /*
3970 3970 * Clone the policy head into a new polhead; release one reference to the
3971 3971 * old one and return the only reference to the new one.
3972 3972 * If the old one had a refcount of 1, just return it.
3973 3973 */
3974 3974 ipsec_policy_head_t *
3975 3975 ipsec_polhead_split(ipsec_policy_head_t *php, netstack_t *ns)
3976 3976 {
3977 3977 ipsec_policy_head_t *nphp;
3978 3978
3979 3979 if (php == NULL)
3980 3980 return (ipsec_polhead_create());
3981 3981 else if (php->iph_refs == 1)
3982 3982 return (php);
3983 3983
3984 3984 nphp = ipsec_polhead_create();
3985 3985 if (nphp == NULL)
3986 3986 return (NULL);
3987 3987
3988 3988 if (ipsec_copy_polhead(php, nphp, ns) != 0) {
3989 3989 ipsec_polhead_free(nphp, ns);
3990 3990 return (NULL);
3991 3991 }
3992 3992 IPPH_REFRELE(php, ns);
3993 3993 return (nphp);
3994 3994 }
3995 3995
3996 3996 /*
3997 3997 * When sending a response to a ICMP request or generating a RST
3998 3998 * in the TCP case, the outbound packets need to go at the same level
3999 3999 * of protection as the incoming ones i.e we associate our outbound
4000 4000 * policy with how the packet came in. We call this after we have
4001 4001 * accepted the incoming packet which may or may not have been in
4002 4002 * clear and hence we are sending the reply back with the policy
4003 4003 * matching the incoming datagram's policy.
4004 4004 *
4005 4005 * NOTE : This technology serves two purposes :
4006 4006 *
4007 4007 * 1) If we have multiple outbound policies, we send out a reply
4008 4008 * matching with how it came in rather than matching the outbound
4009 4009 * policy.
4010 4010 *
4011 4011 * 2) For assymetric policies, we want to make sure that incoming
4012 4012 * and outgoing has the same level of protection. Assymetric
4013 4013 * policies exist only with global policy where we may not have
4014 4014 * both outbound and inbound at the same time.
4015 4015 *
4016 4016 * NOTE2: This function is called by cleartext cases, so it needs to be
4017 4017 * in IP proper.
4018 4018 *
4019 4019 * Note: the caller has moved other parts of ira into ixa already.
4020 4020 */
4021 4021 boolean_t
4022 4022 ipsec_in_to_out(ip_recv_attr_t *ira, ip_xmit_attr_t *ixa, mblk_t *data_mp,
4023 4023 ipha_t *ipha, ip6_t *ip6h)
4024 4024 {
4025 4025 ipsec_selector_t sel;
4026 4026 ipsec_action_t *reflect_action = NULL;
4027 4027 netstack_t *ns = ixa->ixa_ipst->ips_netstack;
4028 4028
4029 4029 bzero((void*)&sel, sizeof (sel));
4030 4030
4031 4031 if (ira->ira_ipsec_action != NULL) {
4032 4032 /* transfer reference.. */
4033 4033 reflect_action = ira->ira_ipsec_action;
4034 4034 ira->ira_ipsec_action = NULL;
4035 4035 } else if (!(ira->ira_flags & IRAF_LOOPBACK))
4036 4036 reflect_action = ipsec_in_to_out_action(ira);
4037 4037
4038 4038 /*
4039 4039 * The caller is going to send the datagram out which might
4040 4040 * go on the wire or delivered locally through ire_send_local.
4041 4041 *
4042 4042 * 1) If it goes out on the wire, new associations will be
4043 4043 * obtained.
4044 4044 * 2) If it is delivered locally, ire_send_local will convert
4045 4045 * this ip_xmit_attr_t back to a ip_recv_attr_t looking at the
4046 4046 * requests.
4047 4047 */
4048 4048 ixa->ixa_ipsec_action = reflect_action;
4049 4049
4050 4050 if (!ipsec_init_outbound_ports(&sel, data_mp, ipha, ip6h, 0,
4051 4051 ns->netstack_ipsec)) {
4052 4052 /* Note: data_mp already consumed and ip_drop_packet done */
4053 4053 return (B_FALSE);
4054 4054 }
4055 4055 ixa->ixa_ipsec_src_port = sel.ips_local_port;
4056 4056 ixa->ixa_ipsec_dst_port = sel.ips_remote_port;
4057 4057 ixa->ixa_ipsec_proto = sel.ips_protocol;
4058 4058 ixa->ixa_ipsec_icmp_type = sel.ips_icmp_type;
4059 4059 ixa->ixa_ipsec_icmp_code = sel.ips_icmp_code;
4060 4060
4061 4061 /*
4062 4062 * Don't use global policy for this, as we want
4063 4063 * to use the same protection that was applied to the inbound packet.
4064 4064 * Thus we set IXAF_NO_IPSEC is it arrived in the clear to make
4065 4065 * it be sent in the clear.
4066 4066 */
4067 4067 if (ira->ira_flags & IRAF_IPSEC_SECURE)
4068 4068 ixa->ixa_flags |= IXAF_IPSEC_SECURE;
4069 4069 else
4070 4070 ixa->ixa_flags |= IXAF_NO_IPSEC;
4071 4071
4072 4072 return (B_TRUE);
4073 4073 }
4074 4074
4075 4075 void
4076 4076 ipsec_out_release_refs(ip_xmit_attr_t *ixa)
4077 4077 {
4078 4078 if (!(ixa->ixa_flags & IXAF_IPSEC_SECURE))
4079 4079 return;
4080 4080
4081 4081 if (ixa->ixa_ipsec_ah_sa != NULL) {
4082 4082 IPSA_REFRELE(ixa->ixa_ipsec_ah_sa);
4083 4083 ixa->ixa_ipsec_ah_sa = NULL;
4084 4084 }
4085 4085 if (ixa->ixa_ipsec_esp_sa != NULL) {
4086 4086 IPSA_REFRELE(ixa->ixa_ipsec_esp_sa);
4087 4087 ixa->ixa_ipsec_esp_sa = NULL;
4088 4088 }
4089 4089 if (ixa->ixa_ipsec_policy != NULL) {
4090 4090 IPPOL_REFRELE(ixa->ixa_ipsec_policy);
4091 4091 ixa->ixa_ipsec_policy = NULL;
4092 4092 }
4093 4093 if (ixa->ixa_ipsec_action != NULL) {
4094 4094 IPACT_REFRELE(ixa->ixa_ipsec_action);
4095 4095 ixa->ixa_ipsec_action = NULL;
4096 4096 }
4097 4097 if (ixa->ixa_ipsec_latch) {
4098 4098 IPLATCH_REFRELE(ixa->ixa_ipsec_latch);
4099 4099 ixa->ixa_ipsec_latch = NULL;
4100 4100 }
4101 4101 /* Clear the soft references to the SAs */
4102 4102 ixa->ixa_ipsec_ref[0].ipsr_sa = NULL;
4103 4103 ixa->ixa_ipsec_ref[0].ipsr_bucket = NULL;
4104 4104 ixa->ixa_ipsec_ref[0].ipsr_gen = 0;
4105 4105 ixa->ixa_ipsec_ref[1].ipsr_sa = NULL;
4106 4106 ixa->ixa_ipsec_ref[1].ipsr_bucket = NULL;
4107 4107 ixa->ixa_ipsec_ref[1].ipsr_gen = 0;
4108 4108 ixa->ixa_flags &= ~IXAF_IPSEC_SECURE;
4109 4109 }
4110 4110
4111 4111 void
4112 4112 ipsec_in_release_refs(ip_recv_attr_t *ira)
4113 4113 {
4114 4114 if (!(ira->ira_flags & IRAF_IPSEC_SECURE))
4115 4115 return;
4116 4116
4117 4117 if (ira->ira_ipsec_ah_sa != NULL) {
4118 4118 IPSA_REFRELE(ira->ira_ipsec_ah_sa);
4119 4119 ira->ira_ipsec_ah_sa = NULL;
4120 4120 }
4121 4121 if (ira->ira_ipsec_esp_sa != NULL) {
4122 4122 IPSA_REFRELE(ira->ira_ipsec_esp_sa);
4123 4123 ira->ira_ipsec_esp_sa = NULL;
4124 4124 }
4125 4125 ira->ira_flags &= ~IRAF_IPSEC_SECURE;
4126 4126 }
4127 4127
4128 4128 /*
4129 4129 * This is called from ire_send_local when a packet
4130 4130 * is looped back. We setup the ip_recv_attr_t "borrowing" the references
4131 4131 * held by the callers.
4132 4132 * Note that we don't do any IPsec but we carry the actions and IPSEC flags
4133 4133 * across so that the fanout policy checks see that IPsec was applied.
4134 4134 *
4135 4135 * The caller should do ipsec_in_release_refs() on the ira by calling
4136 4136 * ira_cleanup().
4137 4137 */
4138 4138 void
4139 4139 ipsec_out_to_in(ip_xmit_attr_t *ixa, ill_t *ill, ip_recv_attr_t *ira)
4140 4140 {
4141 4141 ipsec_policy_t *pol;
4142 4142 ipsec_action_t *act;
4143 4143
4144 4144 /* Non-IPsec operations */
4145 4145 ira->ira_free_flags = 0;
4146 4146 ira->ira_zoneid = ixa->ixa_zoneid;
4147 4147 ira->ira_cred = ixa->ixa_cred;
4148 4148 ira->ira_cpid = ixa->ixa_cpid;
4149 4149 ira->ira_tsl = ixa->ixa_tsl;
4150 4150 ira->ira_ill = ira->ira_rill = ill;
4151 4151 ira->ira_flags = ixa->ixa_flags & IAF_MASK;
4152 4152 ira->ira_no_loop_zoneid = ixa->ixa_no_loop_zoneid;
4153 4153 ira->ira_pktlen = ixa->ixa_pktlen;
4154 4154 ira->ira_ip_hdr_length = ixa->ixa_ip_hdr_length;
4155 4155 ira->ira_protocol = ixa->ixa_protocol;
4156 4156 ira->ira_mhip = NULL;
4157 4157
4158 4158 ira->ira_flags |= IRAF_LOOPBACK | IRAF_L2SRC_LOOPBACK;
4159 4159
4160 4160 ira->ira_sqp = ixa->ixa_sqp;
4161 4161 ira->ira_ring = NULL;
4162 4162
4163 4163 ira->ira_ruifindex = ill->ill_phyint->phyint_ifindex;
4164 4164 ira->ira_rifindex = ira->ira_ruifindex;
4165 4165
4166 4166 if (!(ixa->ixa_flags & IXAF_IPSEC_SECURE))
4167 4167 return;
4168 4168
4169 4169 ira->ira_flags |= IRAF_IPSEC_SECURE;
4170 4170
4171 4171 ira->ira_ipsec_ah_sa = NULL;
4172 4172 ira->ira_ipsec_esp_sa = NULL;
4173 4173
4174 4174 act = ixa->ixa_ipsec_action;
4175 4175 if (act == NULL) {
4176 4176 pol = ixa->ixa_ipsec_policy;
4177 4177 if (pol != NULL) {
4178 4178 act = pol->ipsp_act;
4179 4179 IPACT_REFHOLD(act);
4180 4180 }
4181 4181 }
4182 4182 ixa->ixa_ipsec_action = NULL;
4183 4183 ira->ira_ipsec_action = act;
4184 4184 }
4185 4185
4186 4186 /*
4187 4187 * Consults global policy and per-socket policy to see whether this datagram
4188 4188 * should go out secure. If so it updates the ip_xmit_attr_t
4189 4189 * Should not be used when connecting, since then we want to latch the policy.
4190 4190 *
4191 4191 * If connp is NULL we just look at the global policy.
4192 4192 *
4193 4193 * Returns NULL if the packet was dropped, in which case the MIB has
4194 4194 * been incremented and ip_drop_packet done.
4195 4195 */
4196 4196 mblk_t *
4197 4197 ip_output_attach_policy(mblk_t *mp, ipha_t *ipha, ip6_t *ip6h,
4198 4198 const conn_t *connp, ip_xmit_attr_t *ixa)
4199 4199 {
4200 4200 ipsec_selector_t sel;
4201 4201 boolean_t policy_present;
4202 4202 ip_stack_t *ipst = ixa->ixa_ipst;
4203 4203 netstack_t *ns = ipst->ips_netstack;
4204 4204 ipsec_stack_t *ipss = ns->netstack_ipsec;
4205 4205 ipsec_policy_t *p;
4206 4206
4207 4207 ixa->ixa_ipsec_policy_gen = ipss->ipsec_system_policy.iph_gen;
4208 4208 ASSERT((ipha != NULL && ip6h == NULL) ||
4209 4209 (ip6h != NULL && ipha == NULL));
4210 4210
4211 4211 if (ipha != NULL)
4212 4212 policy_present = ipss->ipsec_outbound_v4_policy_present;
4213 4213 else
4214 4214 policy_present = ipss->ipsec_outbound_v6_policy_present;
4215 4215
4216 4216 if (!policy_present && (connp == NULL || connp->conn_policy == NULL))
4217 4217 return (mp);
4218 4218
4219 4219 bzero((void*)&sel, sizeof (sel));
4220 4220
4221 4221 if (ipha != NULL) {
4222 4222 sel.ips_local_addr_v4 = ipha->ipha_src;
4223 4223 sel.ips_remote_addr_v4 = ip_get_dst(ipha);
4224 4224 sel.ips_isv4 = B_TRUE;
4225 4225 } else {
4226 4226 sel.ips_isv4 = B_FALSE;
4227 4227 sel.ips_local_addr_v6 = ip6h->ip6_src;
4228 4228 sel.ips_remote_addr_v6 = ip_get_dst_v6(ip6h, mp, NULL);
4229 4229 }
4230 4230 sel.ips_protocol = ixa->ixa_protocol;
4231 4231
4232 4232 if (!ipsec_init_outbound_ports(&sel, mp, ipha, ip6h, 0, ipss)) {
4233 4233 if (ipha != NULL) {
4234 4234 BUMP_MIB(&ipst->ips_ip_mib, ipIfStatsOutDiscards);
4235 4235 } else {
4236 4236 BUMP_MIB(&ipst->ips_ip6_mib, ipIfStatsOutDiscards);
4237 4237 }
4238 4238 /* Note: mp already consumed and ip_drop_packet done */
4239 4239 return (NULL);
4240 4240 }
4241 4241
4242 4242 ASSERT(ixa->ixa_ipsec_policy == NULL);
4243 4243 p = ipsec_find_policy(IPSEC_TYPE_OUTBOUND, connp, &sel, ns);
4244 4244 ixa->ixa_ipsec_policy = p;
4245 4245 if (p != NULL) {
4246 4246 ixa->ixa_flags |= IXAF_IPSEC_SECURE;
4247 4247 if (connp == NULL || connp->conn_policy == NULL)
4248 4248 ixa->ixa_flags |= IXAF_IPSEC_GLOBAL_POLICY;
4249 4249 } else {
4250 4250 ixa->ixa_flags &= ~IXAF_IPSEC_SECURE;
4251 4251 }
4252 4252
4253 4253 /*
4254 4254 * Copy the right port information.
4255 4255 */
4256 4256 ixa->ixa_ipsec_src_port = sel.ips_local_port;
4257 4257 ixa->ixa_ipsec_dst_port = sel.ips_remote_port;
4258 4258 ixa->ixa_ipsec_icmp_type = sel.ips_icmp_type;
4259 4259 ixa->ixa_ipsec_icmp_code = sel.ips_icmp_code;
4260 4260 ixa->ixa_ipsec_proto = sel.ips_protocol;
4261 4261 return (mp);
4262 4262 }
4263 4263
4264 4264 /*
4265 4265 * When appropriate, this function caches inbound and outbound policy
4266 4266 * for this connection. The outbound policy is stored in conn_ixa.
4267 4267 * Note that it can not be used for SCTP since conn_faddr isn't set for SCTP.
4268 4268 *
4269 4269 * XXX need to work out more details about per-interface policy and
4270 4270 * caching here!
4271 4271 *
4272 4272 * XXX may want to split inbound and outbound caching for ill..
4273 4273 */
4274 4274 int
4275 4275 ipsec_conn_cache_policy(conn_t *connp, boolean_t isv4)
4276 4276 {
4277 4277 boolean_t global_policy_present;
4278 4278 netstack_t *ns = connp->conn_netstack;
4279 4279 ipsec_stack_t *ipss = ns->netstack_ipsec;
4280 4280
4281 4281 connp->conn_ixa->ixa_ipsec_policy_gen =
4282 4282 ipss->ipsec_system_policy.iph_gen;
4283 4283 /*
4284 4284 * There is no policy latching for ICMP sockets because we can't
4285 4285 * decide on which policy to use until we see the packet and get
4286 4286 * type/code selectors.
4287 4287 */
4288 4288 if (connp->conn_proto == IPPROTO_ICMP ||
4289 4289 connp->conn_proto == IPPROTO_ICMPV6) {
4290 4290 connp->conn_in_enforce_policy =
4291 4291 connp->conn_out_enforce_policy = B_TRUE;
4292 4292 if (connp->conn_latch != NULL) {
4293 4293 IPLATCH_REFRELE(connp->conn_latch);
4294 4294 connp->conn_latch = NULL;
4295 4295 }
4296 4296 if (connp->conn_latch_in_policy != NULL) {
4297 4297 IPPOL_REFRELE(connp->conn_latch_in_policy);
4298 4298 connp->conn_latch_in_policy = NULL;
4299 4299 }
4300 4300 if (connp->conn_latch_in_action != NULL) {
4301 4301 IPACT_REFRELE(connp->conn_latch_in_action);
4302 4302 connp->conn_latch_in_action = NULL;
4303 4303 }
4304 4304 if (connp->conn_ixa->ixa_ipsec_policy != NULL) {
4305 4305 IPPOL_REFRELE(connp->conn_ixa->ixa_ipsec_policy);
4306 4306 connp->conn_ixa->ixa_ipsec_policy = NULL;
4307 4307 }
4308 4308 if (connp->conn_ixa->ixa_ipsec_action != NULL) {
4309 4309 IPACT_REFRELE(connp->conn_ixa->ixa_ipsec_action);
4310 4310 connp->conn_ixa->ixa_ipsec_action = NULL;
4311 4311 }
4312 4312 connp->conn_ixa->ixa_flags &= ~IXAF_IPSEC_SECURE;
4313 4313 return (0);
4314 4314 }
4315 4315
4316 4316 global_policy_present = isv4 ?
4317 4317 (ipss->ipsec_outbound_v4_policy_present ||
4318 4318 ipss->ipsec_inbound_v4_policy_present) :
4319 4319 (ipss->ipsec_outbound_v6_policy_present ||
4320 4320 ipss->ipsec_inbound_v6_policy_present);
4321 4321
4322 4322 if ((connp->conn_policy != NULL) || global_policy_present) {
4323 4323 ipsec_selector_t sel;
4324 4324 ipsec_policy_t *p;
4325 4325
4326 4326 if (connp->conn_latch == NULL &&
4327 4327 (connp->conn_latch = iplatch_create()) == NULL) {
4328 4328 return (ENOMEM);
4329 4329 }
4330 4330
4331 4331 bzero((void*)&sel, sizeof (sel));
4332 4332
4333 4333 sel.ips_protocol = connp->conn_proto;
4334 4334 sel.ips_local_port = connp->conn_lport;
4335 4335 sel.ips_remote_port = connp->conn_fport;
4336 4336 sel.ips_is_icmp_inv_acq = 0;
4337 4337 sel.ips_isv4 = isv4;
4338 4338 if (isv4) {
4339 4339 sel.ips_local_addr_v4 = connp->conn_laddr_v4;
4340 4340 sel.ips_remote_addr_v4 = connp->conn_faddr_v4;
4341 4341 } else {
4342 4342 sel.ips_local_addr_v6 = connp->conn_laddr_v6;
4343 4343 sel.ips_remote_addr_v6 = connp->conn_faddr_v6;
4344 4344 }
4345 4345
4346 4346 p = ipsec_find_policy(IPSEC_TYPE_INBOUND, connp, &sel, ns);
4347 4347 if (connp->conn_latch_in_policy != NULL)
4348 4348 IPPOL_REFRELE(connp->conn_latch_in_policy);
4349 4349 connp->conn_latch_in_policy = p;
4350 4350 connp->conn_in_enforce_policy = (p != NULL);
4351 4351
4352 4352 p = ipsec_find_policy(IPSEC_TYPE_OUTBOUND, connp, &sel, ns);
4353 4353 if (connp->conn_ixa->ixa_ipsec_policy != NULL)
4354 4354 IPPOL_REFRELE(connp->conn_ixa->ixa_ipsec_policy);
4355 4355 connp->conn_ixa->ixa_ipsec_policy = p;
4356 4356 connp->conn_out_enforce_policy = (p != NULL);
4357 4357 if (p != NULL) {
4358 4358 connp->conn_ixa->ixa_flags |= IXAF_IPSEC_SECURE;
4359 4359 if (connp->conn_policy == NULL) {
4360 4360 connp->conn_ixa->ixa_flags |=
4361 4361 IXAF_IPSEC_GLOBAL_POLICY;
4362 4362 }
4363 4363 } else {
4364 4364 connp->conn_ixa->ixa_flags &= ~IXAF_IPSEC_SECURE;
4365 4365 }
4366 4366 /* Clear the latched actions too, in case we're recaching. */
4367 4367 if (connp->conn_ixa->ixa_ipsec_action != NULL) {
4368 4368 IPACT_REFRELE(connp->conn_ixa->ixa_ipsec_action);
4369 4369 connp->conn_ixa->ixa_ipsec_action = NULL;
4370 4370 }
4371 4371 if (connp->conn_latch_in_action != NULL) {
4372 4372 IPACT_REFRELE(connp->conn_latch_in_action);
4373 4373 connp->conn_latch_in_action = NULL;
4374 4374 }
4375 4375 connp->conn_ixa->ixa_ipsec_src_port = sel.ips_local_port;
4376 4376 connp->conn_ixa->ixa_ipsec_dst_port = sel.ips_remote_port;
4377 4377 connp->conn_ixa->ixa_ipsec_icmp_type = sel.ips_icmp_type;
4378 4378 connp->conn_ixa->ixa_ipsec_icmp_code = sel.ips_icmp_code;
4379 4379 connp->conn_ixa->ixa_ipsec_proto = sel.ips_protocol;
4380 4380 } else {
4381 4381 connp->conn_ixa->ixa_flags &= ~IXAF_IPSEC_SECURE;
4382 4382 }
4383 4383
4384 4384 /*
4385 4385 * We may or may not have policy for this endpoint. We still set
4386 4386 * conn_policy_cached so that inbound datagrams don't have to look
4387 4387 * at global policy as policy is considered latched for these
4388 4388 * endpoints. We should not set conn_policy_cached until the conn
4389 4389 * reflects the actual policy. If we *set* this before inheriting
4390 4390 * the policy there is a window where the check
4391 4391 * CONN_INBOUND_POLICY_PRESENT, will neither check with the policy
4392 4392 * on the conn (because we have not yet copied the policy on to
4393 4393 * conn and hence not set conn_in_enforce_policy) nor with the
4394 4394 * global policy (because conn_policy_cached is already set).
4395 4395 */
4396 4396 connp->conn_policy_cached = B_TRUE;
4397 4397 return (0);
4398 4398 }
4399 4399
4400 4400 /*
4401 4401 * When appropriate, this function caches outbound policy for faddr/fport.
4402 4402 * It is used when we are not connected i.e., when we can not latch the
4403 4403 * policy.
4404 4404 */
4405 4405 void
4406 4406 ipsec_cache_outbound_policy(const conn_t *connp, const in6_addr_t *v6src,
4407 4407 const in6_addr_t *v6dst, in_port_t dstport, ip_xmit_attr_t *ixa)
4408 4408 {
4409 4409 boolean_t isv4 = (ixa->ixa_flags & IXAF_IS_IPV4) != 0;
4410 4410 boolean_t global_policy_present;
4411 4411 netstack_t *ns = connp->conn_netstack;
4412 4412 ipsec_stack_t *ipss = ns->netstack_ipsec;
4413 4413
4414 4414 ixa->ixa_ipsec_policy_gen = ipss->ipsec_system_policy.iph_gen;
4415 4415
4416 4416 /*
4417 4417 * There is no policy caching for ICMP sockets because we can't
4418 4418 * decide on which policy to use until we see the packet and get
4419 4419 * type/code selectors.
4420 4420 */
4421 4421 if (connp->conn_proto == IPPROTO_ICMP ||
4422 4422 connp->conn_proto == IPPROTO_ICMPV6) {
4423 4423 ixa->ixa_flags &= ~IXAF_IPSEC_SECURE;
4424 4424 if (ixa->ixa_ipsec_policy != NULL) {
4425 4425 IPPOL_REFRELE(ixa->ixa_ipsec_policy);
4426 4426 ixa->ixa_ipsec_policy = NULL;
4427 4427 }
4428 4428 if (ixa->ixa_ipsec_action != NULL) {
4429 4429 IPACT_REFRELE(ixa->ixa_ipsec_action);
4430 4430 ixa->ixa_ipsec_action = NULL;
4431 4431 }
4432 4432 return;
4433 4433 }
4434 4434
4435 4435 global_policy_present = isv4 ?
4436 4436 (ipss->ipsec_outbound_v4_policy_present ||
4437 4437 ipss->ipsec_inbound_v4_policy_present) :
4438 4438 (ipss->ipsec_outbound_v6_policy_present ||
4439 4439 ipss->ipsec_inbound_v6_policy_present);
4440 4440
4441 4441 if ((connp->conn_policy != NULL) || global_policy_present) {
4442 4442 ipsec_selector_t sel;
4443 4443 ipsec_policy_t *p;
4444 4444
4445 4445 bzero((void*)&sel, sizeof (sel));
4446 4446
4447 4447 sel.ips_protocol = connp->conn_proto;
4448 4448 sel.ips_local_port = connp->conn_lport;
4449 4449 sel.ips_remote_port = dstport;
4450 4450 sel.ips_is_icmp_inv_acq = 0;
4451 4451 sel.ips_isv4 = isv4;
4452 4452 if (isv4) {
4453 4453 IN6_V4MAPPED_TO_IPADDR(v6src, sel.ips_local_addr_v4);
4454 4454 IN6_V4MAPPED_TO_IPADDR(v6dst, sel.ips_remote_addr_v4);
4455 4455 } else {
4456 4456 sel.ips_local_addr_v6 = *v6src;
4457 4457 sel.ips_remote_addr_v6 = *v6dst;
4458 4458 }
4459 4459
4460 4460 p = ipsec_find_policy(IPSEC_TYPE_OUTBOUND, connp, &sel, ns);
4461 4461 if (ixa->ixa_ipsec_policy != NULL)
4462 4462 IPPOL_REFRELE(ixa->ixa_ipsec_policy);
4463 4463 ixa->ixa_ipsec_policy = p;
4464 4464 if (p != NULL) {
4465 4465 ixa->ixa_flags |= IXAF_IPSEC_SECURE;
4466 4466 if (connp->conn_policy == NULL)
4467 4467 ixa->ixa_flags |= IXAF_IPSEC_GLOBAL_POLICY;
4468 4468 } else {
4469 4469 ixa->ixa_flags &= ~IXAF_IPSEC_SECURE;
4470 4470 }
4471 4471 /* Clear the latched actions too, in case we're recaching. */
4472 4472 if (ixa->ixa_ipsec_action != NULL) {
4473 4473 IPACT_REFRELE(ixa->ixa_ipsec_action);
4474 4474 ixa->ixa_ipsec_action = NULL;
4475 4475 }
4476 4476
4477 4477 ixa->ixa_ipsec_src_port = sel.ips_local_port;
4478 4478 ixa->ixa_ipsec_dst_port = sel.ips_remote_port;
4479 4479 ixa->ixa_ipsec_icmp_type = sel.ips_icmp_type;
4480 4480 ixa->ixa_ipsec_icmp_code = sel.ips_icmp_code;
4481 4481 ixa->ixa_ipsec_proto = sel.ips_protocol;
4482 4482 } else {
4483 4483 ixa->ixa_flags &= ~IXAF_IPSEC_SECURE;
4484 4484 if (ixa->ixa_ipsec_policy != NULL) {
4485 4485 IPPOL_REFRELE(ixa->ixa_ipsec_policy);
4486 4486 ixa->ixa_ipsec_policy = NULL;
4487 4487 }
4488 4488 if (ixa->ixa_ipsec_action != NULL) {
4489 4489 IPACT_REFRELE(ixa->ixa_ipsec_action);
4490 4490 ixa->ixa_ipsec_action = NULL;
4491 4491 }
4492 4492 }
4493 4493 }
4494 4494
4495 4495 /*
4496 4496 * Returns B_FALSE if the policy has gone stale.
4497 4497 */
4498 4498 boolean_t
4499 4499 ipsec_outbound_policy_current(ip_xmit_attr_t *ixa)
4500 4500 {
4501 4501 ipsec_stack_t *ipss = ixa->ixa_ipst->ips_netstack->netstack_ipsec;
4502 4502
4503 4503 if (!(ixa->ixa_flags & IXAF_IPSEC_GLOBAL_POLICY))
4504 4504 return (B_TRUE);
4505 4505
4506 4506 return (ixa->ixa_ipsec_policy_gen == ipss->ipsec_system_policy.iph_gen);
4507 4507 }
4508 4508
4509 4509 void
4510 4510 iplatch_free(ipsec_latch_t *ipl)
4511 4511 {
4512 4512 if (ipl->ipl_local_cid != NULL)
|
↓ open down ↓ |
4512 lines elided |
↑ open up ↑ |
4513 4513 IPSID_REFRELE(ipl->ipl_local_cid);
4514 4514 if (ipl->ipl_remote_cid != NULL)
4515 4515 IPSID_REFRELE(ipl->ipl_remote_cid);
4516 4516 mutex_destroy(&ipl->ipl_lock);
4517 4517 kmem_free(ipl, sizeof (*ipl));
4518 4518 }
4519 4519
4520 4520 ipsec_latch_t *
4521 4521 iplatch_create()
4522 4522 {
4523 - ipsec_latch_t *ipl = kmem_alloc(sizeof (*ipl), KM_NOSLEEP);
4523 + ipsec_latch_t *ipl = kmem_zalloc(sizeof (*ipl), KM_NOSLEEP);
4524 4524 if (ipl == NULL)
4525 4525 return (ipl);
4526 - bzero(ipl, sizeof (*ipl));
4527 4526 mutex_init(&ipl->ipl_lock, NULL, MUTEX_DEFAULT, NULL);
4528 4527 ipl->ipl_refcnt = 1;
4529 4528 return (ipl);
4530 4529 }
4531 4530
4532 4531 /*
4533 4532 * Hash function for ID hash table.
4534 4533 */
4535 4534 static uint32_t
4536 4535 ipsid_hash(int idtype, char *idstring)
4537 4536 {
4538 4537 uint32_t hval = idtype;
4539 4538 unsigned char c;
4540 4539
4541 4540 while ((c = *idstring++) != 0) {
4542 4541 hval = (hval << 4) | (hval >> 28);
4543 4542 hval ^= c;
4544 4543 }
4545 4544 hval = hval ^ (hval >> 16);
4546 4545 return (hval & (IPSID_HASHSIZE-1));
4547 4546 }
4548 4547
4549 4548 /*
4550 4549 * Look up identity string in hash table. Return identity object
4551 4550 * corresponding to the name -- either preexisting, or newly allocated.
4552 4551 *
4553 4552 * Return NULL if we need to allocate a new one and can't get memory.
4554 4553 */
4555 4554 ipsid_t *
4556 4555 ipsid_lookup(int idtype, char *idstring, netstack_t *ns)
4557 4556 {
4558 4557 ipsid_t *retval;
4559 4558 char *nstr;
4560 4559 int idlen = strlen(idstring) + 1;
4561 4560 ipsec_stack_t *ipss = ns->netstack_ipsec;
4562 4561 ipsif_t *bucket;
4563 4562
4564 4563 bucket = &ipss->ipsec_ipsid_buckets[ipsid_hash(idtype, idstring)];
4565 4564
4566 4565 mutex_enter(&bucket->ipsif_lock);
4567 4566
4568 4567 for (retval = bucket->ipsif_head; retval != NULL;
4569 4568 retval = retval->ipsid_next) {
4570 4569 if (idtype != retval->ipsid_type)
4571 4570 continue;
4572 4571 if (bcmp(idstring, retval->ipsid_cid, idlen) != 0)
4573 4572 continue;
4574 4573
4575 4574 IPSID_REFHOLD(retval);
4576 4575 mutex_exit(&bucket->ipsif_lock);
4577 4576 return (retval);
4578 4577 }
4579 4578
4580 4579 retval = kmem_alloc(sizeof (*retval), KM_NOSLEEP);
4581 4580 if (!retval) {
4582 4581 mutex_exit(&bucket->ipsif_lock);
4583 4582 return (NULL);
4584 4583 }
4585 4584
4586 4585 nstr = kmem_alloc(idlen, KM_NOSLEEP);
4587 4586 if (!nstr) {
4588 4587 mutex_exit(&bucket->ipsif_lock);
4589 4588 kmem_free(retval, sizeof (*retval));
4590 4589 return (NULL);
4591 4590 }
4592 4591
4593 4592 retval->ipsid_refcnt = 1;
4594 4593 retval->ipsid_next = bucket->ipsif_head;
4595 4594 if (retval->ipsid_next != NULL)
4596 4595 retval->ipsid_next->ipsid_ptpn = &retval->ipsid_next;
4597 4596 retval->ipsid_ptpn = &bucket->ipsif_head;
4598 4597 retval->ipsid_type = idtype;
4599 4598 retval->ipsid_cid = nstr;
4600 4599 bucket->ipsif_head = retval;
4601 4600 bcopy(idstring, nstr, idlen);
4602 4601 mutex_exit(&bucket->ipsif_lock);
4603 4602
4604 4603 return (retval);
4605 4604 }
4606 4605
4607 4606 /*
4608 4607 * Garbage collect the identity hash table.
4609 4608 */
4610 4609 void
4611 4610 ipsid_gc(netstack_t *ns)
4612 4611 {
4613 4612 int i, len;
4614 4613 ipsid_t *id, *nid;
4615 4614 ipsif_t *bucket;
4616 4615 ipsec_stack_t *ipss = ns->netstack_ipsec;
4617 4616
4618 4617 for (i = 0; i < IPSID_HASHSIZE; i++) {
4619 4618 bucket = &ipss->ipsec_ipsid_buckets[i];
4620 4619 mutex_enter(&bucket->ipsif_lock);
4621 4620 for (id = bucket->ipsif_head; id != NULL; id = nid) {
4622 4621 nid = id->ipsid_next;
4623 4622 if (id->ipsid_refcnt == 0) {
4624 4623 *id->ipsid_ptpn = nid;
4625 4624 if (nid != NULL)
4626 4625 nid->ipsid_ptpn = id->ipsid_ptpn;
4627 4626 len = strlen(id->ipsid_cid) + 1;
4628 4627 kmem_free(id->ipsid_cid, len);
4629 4628 kmem_free(id, sizeof (*id));
4630 4629 }
4631 4630 }
4632 4631 mutex_exit(&bucket->ipsif_lock);
4633 4632 }
4634 4633 }
4635 4634
4636 4635 /*
4637 4636 * Return true if two identities are the same.
4638 4637 */
4639 4638 boolean_t
4640 4639 ipsid_equal(ipsid_t *id1, ipsid_t *id2)
4641 4640 {
4642 4641 if (id1 == id2)
4643 4642 return (B_TRUE);
4644 4643 #ifdef DEBUG
4645 4644 if ((id1 == NULL) || (id2 == NULL))
4646 4645 return (B_FALSE);
4647 4646 /*
4648 4647 * test that we're interning id's correctly..
4649 4648 */
4650 4649 ASSERT((strcmp(id1->ipsid_cid, id2->ipsid_cid) != 0) ||
4651 4650 (id1->ipsid_type != id2->ipsid_type));
4652 4651 #endif
4653 4652 return (B_FALSE);
4654 4653 }
4655 4654
4656 4655 /*
4657 4656 * Initialize identity table; called during module initialization.
4658 4657 */
4659 4658 static void
4660 4659 ipsid_init(netstack_t *ns)
4661 4660 {
4662 4661 ipsif_t *bucket;
4663 4662 int i;
4664 4663 ipsec_stack_t *ipss = ns->netstack_ipsec;
4665 4664
4666 4665 for (i = 0; i < IPSID_HASHSIZE; i++) {
4667 4666 bucket = &ipss->ipsec_ipsid_buckets[i];
4668 4667 mutex_init(&bucket->ipsif_lock, NULL, MUTEX_DEFAULT, NULL);
4669 4668 }
4670 4669 }
4671 4670
4672 4671 /*
4673 4672 * Free identity table (preparatory to module unload)
4674 4673 */
4675 4674 static void
4676 4675 ipsid_fini(netstack_t *ns)
4677 4676 {
4678 4677 ipsif_t *bucket;
4679 4678 int i;
4680 4679 ipsec_stack_t *ipss = ns->netstack_ipsec;
4681 4680
4682 4681 for (i = 0; i < IPSID_HASHSIZE; i++) {
4683 4682 bucket = &ipss->ipsec_ipsid_buckets[i];
4684 4683 ASSERT(bucket->ipsif_head == NULL);
4685 4684 mutex_destroy(&bucket->ipsif_lock);
4686 4685 }
4687 4686 }
4688 4687
4689 4688 /*
4690 4689 * Update the minimum and maximum supported key sizes for the
4691 4690 * specified algorithm. Must be called while holding the algorithms lock.
4692 4691 */
4693 4692 void
4694 4693 ipsec_alg_fix_min_max(ipsec_alginfo_t *alg, ipsec_algtype_t alg_type,
4695 4694 netstack_t *ns)
4696 4695 {
4697 4696 size_t crypto_min = (size_t)-1, crypto_max = 0;
4698 4697 size_t cur_crypto_min, cur_crypto_max;
4699 4698 boolean_t is_valid;
4700 4699 crypto_mechanism_info_t *mech_infos;
4701 4700 uint_t nmech_infos;
4702 4701 int crypto_rc, i;
4703 4702 crypto_mech_usage_t mask;
4704 4703 ipsec_stack_t *ipss = ns->netstack_ipsec;
4705 4704
4706 4705 ASSERT(MUTEX_HELD(&ipss->ipsec_alg_lock));
4707 4706
4708 4707 /*
4709 4708 * Compute the min, max, and default key sizes (in number of
4710 4709 * increments to the default key size in bits) as defined
4711 4710 * by the algorithm mappings. This range of key sizes is used
4712 4711 * for policy related operations. The effective key sizes
4713 4712 * supported by the framework could be more limited than
4714 4713 * those defined for an algorithm.
4715 4714 */
4716 4715 alg->alg_default_bits = alg->alg_key_sizes[0];
4717 4716 alg->alg_default = 0;
4718 4717 if (alg->alg_increment != 0) {
4719 4718 /* key sizes are defined by range & increment */
4720 4719 alg->alg_minbits = alg->alg_key_sizes[1];
4721 4720 alg->alg_maxbits = alg->alg_key_sizes[2];
4722 4721 } else if (alg->alg_nkey_sizes == 0) {
4723 4722 /* no specified key size for algorithm */
4724 4723 alg->alg_minbits = alg->alg_maxbits = 0;
4725 4724 } else {
4726 4725 /* key sizes are defined by enumeration */
4727 4726 alg->alg_minbits = (uint16_t)-1;
4728 4727 alg->alg_maxbits = 0;
4729 4728
4730 4729 for (i = 0; i < alg->alg_nkey_sizes; i++) {
4731 4730 if (alg->alg_key_sizes[i] < alg->alg_minbits)
4732 4731 alg->alg_minbits = alg->alg_key_sizes[i];
4733 4732 if (alg->alg_key_sizes[i] > alg->alg_maxbits)
4734 4733 alg->alg_maxbits = alg->alg_key_sizes[i];
4735 4734 }
4736 4735 }
4737 4736
4738 4737 if (!(alg->alg_flags & ALG_FLAG_VALID))
4739 4738 return;
4740 4739
4741 4740 /*
4742 4741 * Mechanisms do not apply to the NULL encryption
4743 4742 * algorithm, so simply return for this case.
4744 4743 */
4745 4744 if (alg->alg_id == SADB_EALG_NULL)
4746 4745 return;
4747 4746
4748 4747 /*
4749 4748 * Find the min and max key sizes supported by the cryptographic
4750 4749 * framework providers.
4751 4750 */
4752 4751
4753 4752 /* get the key sizes supported by the framework */
4754 4753 crypto_rc = crypto_get_all_mech_info(alg->alg_mech_type,
4755 4754 &mech_infos, &nmech_infos, KM_SLEEP);
4756 4755 if (crypto_rc != CRYPTO_SUCCESS || nmech_infos == 0) {
4757 4756 alg->alg_flags &= ~ALG_FLAG_VALID;
4758 4757 return;
4759 4758 }
4760 4759
4761 4760 /* min and max key sizes supported by framework */
4762 4761 for (i = 0, is_valid = B_FALSE; i < nmech_infos; i++) {
4763 4762 int unit_bits;
4764 4763
4765 4764 /*
4766 4765 * Ignore entries that do not support the operations
4767 4766 * needed for the algorithm type.
4768 4767 */
4769 4768 if (alg_type == IPSEC_ALG_AUTH) {
4770 4769 mask = CRYPTO_MECH_USAGE_MAC;
4771 4770 } else {
4772 4771 mask = CRYPTO_MECH_USAGE_ENCRYPT |
4773 4772 CRYPTO_MECH_USAGE_DECRYPT;
4774 4773 }
4775 4774 if ((mech_infos[i].mi_usage & mask) != mask)
4776 4775 continue;
4777 4776
4778 4777 unit_bits = (mech_infos[i].mi_keysize_unit ==
4779 4778 CRYPTO_KEYSIZE_UNIT_IN_BYTES) ? 8 : 1;
4780 4779 /* adjust min/max supported by framework */
4781 4780 cur_crypto_min = mech_infos[i].mi_min_key_size * unit_bits;
4782 4781 cur_crypto_max = mech_infos[i].mi_max_key_size * unit_bits;
4783 4782
4784 4783 if (cur_crypto_min < crypto_min)
4785 4784 crypto_min = cur_crypto_min;
4786 4785
4787 4786 /*
4788 4787 * CRYPTO_EFFECTIVELY_INFINITE is a special value of
4789 4788 * the crypto framework which means "no upper limit".
4790 4789 */
4791 4790 if (mech_infos[i].mi_max_key_size ==
4792 4791 CRYPTO_EFFECTIVELY_INFINITE) {
4793 4792 crypto_max = (size_t)-1;
4794 4793 } else if (cur_crypto_max > crypto_max) {
4795 4794 crypto_max = cur_crypto_max;
4796 4795 }
4797 4796
4798 4797 is_valid = B_TRUE;
4799 4798 }
4800 4799
4801 4800 kmem_free(mech_infos, sizeof (crypto_mechanism_info_t) *
4802 4801 nmech_infos);
4803 4802
4804 4803 if (!is_valid) {
4805 4804 /* no key sizes supported by framework */
4806 4805 alg->alg_flags &= ~ALG_FLAG_VALID;
4807 4806 return;
4808 4807 }
4809 4808
4810 4809 /*
4811 4810 * Determine min and max key sizes from alg_key_sizes[].
4812 4811 * defined for the algorithm entry. Adjust key sizes based on
4813 4812 * those supported by the framework.
4814 4813 */
4815 4814 alg->alg_ef_default_bits = alg->alg_key_sizes[0];
4816 4815
4817 4816 /*
4818 4817 * For backwards compatability, assume that the IV length
4819 4818 * is the same as the data length.
4820 4819 */
4821 4820 alg->alg_ivlen = alg->alg_datalen;
4822 4821
4823 4822 /*
4824 4823 * Copy any algorithm parameters (if provided) into dedicated
4825 4824 * elements in the ipsec_alginfo_t structure.
4826 4825 * There may be a better place to put this code.
4827 4826 */
4828 4827 for (i = 0; i < alg->alg_nparams; i++) {
4829 4828 switch (i) {
4830 4829 case 0:
4831 4830 /* Initialisation Vector length (bytes) */
4832 4831 alg->alg_ivlen = alg->alg_params[0];
4833 4832 break;
4834 4833 case 1:
4835 4834 /* Integrity Check Vector length (bytes) */
4836 4835 alg->alg_icvlen = alg->alg_params[1];
4837 4836 break;
4838 4837 case 2:
4839 4838 /* Salt length (bytes) */
4840 4839 alg->alg_saltlen = (uint8_t)alg->alg_params[2];
4841 4840 break;
4842 4841 default:
4843 4842 break;
4844 4843 }
4845 4844 }
4846 4845
4847 4846 /* Default if the IV length is not specified. */
4848 4847 if (alg_type == IPSEC_ALG_ENCR && alg->alg_ivlen == 0)
4849 4848 alg->alg_ivlen = alg->alg_datalen;
4850 4849
4851 4850 alg_flag_check(alg);
4852 4851
4853 4852 if (alg->alg_increment != 0) {
4854 4853 /* supported key sizes are defined by range & increment */
4855 4854 crypto_min = ALGBITS_ROUND_UP(crypto_min, alg->alg_increment);
4856 4855 crypto_max = ALGBITS_ROUND_DOWN(crypto_max, alg->alg_increment);
4857 4856
4858 4857 alg->alg_ef_minbits = MAX(alg->alg_minbits,
4859 4858 (uint16_t)crypto_min);
4860 4859 alg->alg_ef_maxbits = MIN(alg->alg_maxbits,
4861 4860 (uint16_t)crypto_max);
4862 4861
4863 4862 /*
4864 4863 * If the sizes supported by the framework are outside
4865 4864 * the range of sizes defined by the algorithm mappings,
4866 4865 * the algorithm cannot be used. Check for this
4867 4866 * condition here.
4868 4867 */
4869 4868 if (alg->alg_ef_minbits > alg->alg_ef_maxbits) {
4870 4869 alg->alg_flags &= ~ALG_FLAG_VALID;
4871 4870 return;
4872 4871 }
4873 4872 if (alg->alg_ef_default_bits < alg->alg_ef_minbits)
4874 4873 alg->alg_ef_default_bits = alg->alg_ef_minbits;
4875 4874 if (alg->alg_ef_default_bits > alg->alg_ef_maxbits)
4876 4875 alg->alg_ef_default_bits = alg->alg_ef_maxbits;
4877 4876 } else if (alg->alg_nkey_sizes == 0) {
4878 4877 /* no specified key size for algorithm */
4879 4878 alg->alg_ef_minbits = alg->alg_ef_maxbits = 0;
4880 4879 } else {
4881 4880 /* supported key sizes are defined by enumeration */
4882 4881 alg->alg_ef_minbits = (uint16_t)-1;
4883 4882 alg->alg_ef_maxbits = 0;
4884 4883
4885 4884 for (i = 0, is_valid = B_FALSE; i < alg->alg_nkey_sizes; i++) {
4886 4885 /*
4887 4886 * Ignore the current key size if it is not in the
4888 4887 * range of sizes supported by the framework.
4889 4888 */
4890 4889 if (alg->alg_key_sizes[i] < crypto_min ||
4891 4890 alg->alg_key_sizes[i] > crypto_max)
4892 4891 continue;
4893 4892 if (alg->alg_key_sizes[i] < alg->alg_ef_minbits)
4894 4893 alg->alg_ef_minbits = alg->alg_key_sizes[i];
4895 4894 if (alg->alg_key_sizes[i] > alg->alg_ef_maxbits)
4896 4895 alg->alg_ef_maxbits = alg->alg_key_sizes[i];
4897 4896 is_valid = B_TRUE;
4898 4897 }
4899 4898
4900 4899 if (!is_valid) {
4901 4900 alg->alg_flags &= ~ALG_FLAG_VALID;
4902 4901 return;
4903 4902 }
4904 4903 alg->alg_ef_default = 0;
4905 4904 }
4906 4905 }
4907 4906
4908 4907 /*
4909 4908 * Sanity check parameters provided by ipsecalgs(1m). Assume that
4910 4909 * the algoritm is marked as valid, there is a check at the top
4911 4910 * of this function. If any of the checks below fail, the algorithm
4912 4911 * entry is invalid.
4913 4912 */
4914 4913 void
4915 4914 alg_flag_check(ipsec_alginfo_t *alg)
4916 4915 {
4917 4916 alg->alg_flags &= ~ALG_FLAG_VALID;
4918 4917
4919 4918 /*
4920 4919 * Can't have the algorithm marked as CCM and GCM.
4921 4920 * Check the ALG_FLAG_COMBINED and ALG_FLAG_COUNTERMODE
4922 4921 * flags are set for CCM & GCM.
4923 4922 */
4924 4923 if ((alg->alg_flags & (ALG_FLAG_CCM|ALG_FLAG_GCM)) ==
4925 4924 (ALG_FLAG_CCM|ALG_FLAG_GCM))
4926 4925 return;
4927 4926 if (alg->alg_flags & (ALG_FLAG_CCM|ALG_FLAG_GCM)) {
4928 4927 if (!(alg->alg_flags & ALG_FLAG_COUNTERMODE))
4929 4928 return;
4930 4929 if (!(alg->alg_flags & ALG_FLAG_COMBINED))
4931 4930 return;
4932 4931 }
4933 4932
4934 4933 /*
4935 4934 * For ALG_FLAG_COUNTERMODE, check the parameters
4936 4935 * fit in the ipsec_nonce_t structure.
4937 4936 */
4938 4937 if (alg->alg_flags & ALG_FLAG_COUNTERMODE) {
4939 4938 if (alg->alg_ivlen != sizeof (((ipsec_nonce_t *)NULL)->iv))
4940 4939 return;
4941 4940 if (alg->alg_saltlen > sizeof (((ipsec_nonce_t *)NULL)->salt))
4942 4941 return;
4943 4942 }
4944 4943 if ((alg->alg_flags & ALG_FLAG_COMBINED) &&
4945 4944 (alg->alg_icvlen == 0))
4946 4945 return;
4947 4946
4948 4947 /* all is well. */
4949 4948 alg->alg_flags |= ALG_FLAG_VALID;
4950 4949 }
4951 4950
4952 4951 /*
4953 4952 * Free the memory used by the specified algorithm.
4954 4953 */
4955 4954 void
4956 4955 ipsec_alg_free(ipsec_alginfo_t *alg)
4957 4956 {
4958 4957 if (alg == NULL)
4959 4958 return;
4960 4959
4961 4960 if (alg->alg_key_sizes != NULL) {
4962 4961 kmem_free(alg->alg_key_sizes,
4963 4962 (alg->alg_nkey_sizes + 1) * sizeof (uint16_t));
4964 4963 alg->alg_key_sizes = NULL;
4965 4964 }
4966 4965 if (alg->alg_block_sizes != NULL) {
4967 4966 kmem_free(alg->alg_block_sizes,
4968 4967 (alg->alg_nblock_sizes + 1) * sizeof (uint16_t));
4969 4968 alg->alg_block_sizes = NULL;
4970 4969 }
4971 4970 if (alg->alg_params != NULL) {
4972 4971 kmem_free(alg->alg_params,
4973 4972 (alg->alg_nparams + 1) * sizeof (uint16_t));
4974 4973 alg->alg_params = NULL;
4975 4974 }
4976 4975 kmem_free(alg, sizeof (*alg));
4977 4976 }
4978 4977
4979 4978 /*
4980 4979 * Check the validity of the specified key size for an algorithm.
4981 4980 * Returns B_TRUE if key size is valid, B_FALSE otherwise.
4982 4981 */
4983 4982 boolean_t
4984 4983 ipsec_valid_key_size(uint16_t key_size, ipsec_alginfo_t *alg)
4985 4984 {
4986 4985 if (key_size < alg->alg_ef_minbits || key_size > alg->alg_ef_maxbits)
4987 4986 return (B_FALSE);
4988 4987
4989 4988 if (alg->alg_increment == 0 && alg->alg_nkey_sizes != 0) {
4990 4989 /*
4991 4990 * If the key sizes are defined by enumeration, the new
4992 4991 * key size must be equal to one of the supported values.
4993 4992 */
4994 4993 int i;
4995 4994
4996 4995 for (i = 0; i < alg->alg_nkey_sizes; i++)
4997 4996 if (key_size == alg->alg_key_sizes[i])
4998 4997 break;
4999 4998 if (i == alg->alg_nkey_sizes)
5000 4999 return (B_FALSE);
5001 5000 }
5002 5001
5003 5002 return (B_TRUE);
5004 5003 }
5005 5004
5006 5005 /*
5007 5006 * Callback function invoked by the crypto framework when a provider
5008 5007 * registers or unregisters. This callback updates the algorithms
5009 5008 * tables when a crypto algorithm is no longer available or becomes
5010 5009 * available, and triggers the freeing/creation of context templates
5011 5010 * associated with existing SAs, if needed.
5012 5011 *
5013 5012 * Need to walk all stack instances since the callback is global
5014 5013 * for all instances
5015 5014 */
5016 5015 void
5017 5016 ipsec_prov_update_callback(uint32_t event, void *event_arg)
5018 5017 {
5019 5018 netstack_handle_t nh;
5020 5019 netstack_t *ns;
5021 5020
5022 5021 netstack_next_init(&nh);
5023 5022 while ((ns = netstack_next(&nh)) != NULL) {
5024 5023 ipsec_prov_update_callback_stack(event, event_arg, ns);
5025 5024 netstack_rele(ns);
5026 5025 }
5027 5026 netstack_next_fini(&nh);
5028 5027 }
5029 5028
5030 5029 static void
5031 5030 ipsec_prov_update_callback_stack(uint32_t event, void *event_arg,
5032 5031 netstack_t *ns)
5033 5032 {
5034 5033 crypto_notify_event_change_t *prov_change =
5035 5034 (crypto_notify_event_change_t *)event_arg;
5036 5035 uint_t algidx, algid, algtype, mech_count, mech_idx;
5037 5036 ipsec_alginfo_t *alg;
5038 5037 ipsec_alginfo_t oalg;
5039 5038 crypto_mech_name_t *mechs;
5040 5039 boolean_t alg_changed = B_FALSE;
5041 5040 ipsec_stack_t *ipss = ns->netstack_ipsec;
5042 5041
5043 5042 /* ignore events for which we didn't register */
5044 5043 if (event != CRYPTO_EVENT_MECHS_CHANGED) {
5045 5044 ip1dbg(("ipsec_prov_update_callback: unexpected event 0x%x "
5046 5045 " received from crypto framework\n", event));
5047 5046 return;
5048 5047 }
5049 5048
5050 5049 mechs = crypto_get_mech_list(&mech_count, KM_SLEEP);
5051 5050 if (mechs == NULL)
5052 5051 return;
5053 5052
5054 5053 /*
5055 5054 * Walk the list of currently defined IPsec algorithm. Update
5056 5055 * the algorithm valid flag and trigger an update of the
5057 5056 * SAs that depend on that algorithm.
5058 5057 */
5059 5058 mutex_enter(&ipss->ipsec_alg_lock);
5060 5059 for (algtype = 0; algtype < IPSEC_NALGTYPES; algtype++) {
5061 5060 for (algidx = 0; algidx < ipss->ipsec_nalgs[algtype];
5062 5061 algidx++) {
5063 5062
5064 5063 algid = ipss->ipsec_sortlist[algtype][algidx];
5065 5064 alg = ipss->ipsec_alglists[algtype][algid];
5066 5065 ASSERT(alg != NULL);
5067 5066
5068 5067 /*
5069 5068 * Skip the algorithms which do not map to the
5070 5069 * crypto framework provider being added or removed.
5071 5070 */
5072 5071 if (strncmp(alg->alg_mech_name,
5073 5072 prov_change->ec_mech_name,
5074 5073 CRYPTO_MAX_MECH_NAME) != 0)
5075 5074 continue;
5076 5075
5077 5076 /*
5078 5077 * Determine if the mechanism is valid. If it
5079 5078 * is not, mark the algorithm as being invalid. If
5080 5079 * it is, mark the algorithm as being valid.
5081 5080 */
5082 5081 for (mech_idx = 0; mech_idx < mech_count; mech_idx++)
5083 5082 if (strncmp(alg->alg_mech_name,
5084 5083 mechs[mech_idx], CRYPTO_MAX_MECH_NAME) == 0)
5085 5084 break;
5086 5085 if (mech_idx == mech_count &&
5087 5086 alg->alg_flags & ALG_FLAG_VALID) {
5088 5087 alg->alg_flags &= ~ALG_FLAG_VALID;
5089 5088 alg_changed = B_TRUE;
5090 5089 } else if (mech_idx < mech_count &&
5091 5090 !(alg->alg_flags & ALG_FLAG_VALID)) {
5092 5091 alg->alg_flags |= ALG_FLAG_VALID;
5093 5092 alg_changed = B_TRUE;
5094 5093 }
5095 5094
5096 5095 /*
5097 5096 * Update the supported key sizes, regardless
5098 5097 * of whether a crypto provider was added or
5099 5098 * removed.
5100 5099 */
5101 5100 oalg = *alg;
5102 5101 ipsec_alg_fix_min_max(alg, algtype, ns);
5103 5102 if (!alg_changed &&
5104 5103 alg->alg_ef_minbits != oalg.alg_ef_minbits ||
5105 5104 alg->alg_ef_maxbits != oalg.alg_ef_maxbits ||
5106 5105 alg->alg_ef_default != oalg.alg_ef_default ||
5107 5106 alg->alg_ef_default_bits !=
5108 5107 oalg.alg_ef_default_bits)
5109 5108 alg_changed = B_TRUE;
5110 5109
5111 5110 /*
5112 5111 * Update the affected SAs if a software provider is
5113 5112 * being added or removed.
5114 5113 */
5115 5114 if (prov_change->ec_provider_type ==
5116 5115 CRYPTO_SW_PROVIDER)
5117 5116 sadb_alg_update(algtype, alg->alg_id,
5118 5117 prov_change->ec_change ==
5119 5118 CRYPTO_MECH_ADDED, ns);
5120 5119 }
5121 5120 }
5122 5121 mutex_exit(&ipss->ipsec_alg_lock);
5123 5122 crypto_free_mech_list(mechs, mech_count);
5124 5123
5125 5124 if (alg_changed) {
5126 5125 /*
5127 5126 * An algorithm has changed, i.e. it became valid or
5128 5127 * invalid, or its support key sizes have changed.
5129 5128 * Notify ipsecah and ipsecesp of this change so
5130 5129 * that they can send a SADB_REGISTER to their consumers.
5131 5130 */
5132 5131 ipsecah_algs_changed(ns);
5133 5132 ipsecesp_algs_changed(ns);
5134 5133 }
5135 5134 }
5136 5135
5137 5136 /*
5138 5137 * Registers with the crypto framework to be notified of crypto
5139 5138 * providers changes. Used to update the algorithm tables and
5140 5139 * to free or create context templates if needed. Invoked after IPsec
5141 5140 * is loaded successfully.
5142 5141 *
5143 5142 * This is called separately for each IP instance, so we ensure we only
5144 5143 * register once.
5145 5144 */
5146 5145 void
5147 5146 ipsec_register_prov_update(void)
5148 5147 {
5149 5148 if (prov_update_handle != NULL)
5150 5149 return;
5151 5150
5152 5151 prov_update_handle = crypto_notify_events(
5153 5152 ipsec_prov_update_callback, CRYPTO_EVENT_MECHS_CHANGED);
5154 5153 }
5155 5154
5156 5155 /*
5157 5156 * Unregisters from the framework to be notified of crypto providers
5158 5157 * changes. Called from ipsec_policy_g_destroy().
5159 5158 */
5160 5159 static void
5161 5160 ipsec_unregister_prov_update(void)
5162 5161 {
5163 5162 if (prov_update_handle != NULL)
5164 5163 crypto_unnotify_events(prov_update_handle);
5165 5164 }
5166 5165
5167 5166 /*
5168 5167 * Tunnel-mode support routines.
5169 5168 */
5170 5169
5171 5170 /*
5172 5171 * Returns an mblk chain suitable for putnext() if policies match and IPsec
5173 5172 * SAs are available. If there's no per-tunnel policy, or a match comes back
5174 5173 * with no match, then still return the packet and have global policy take
5175 5174 * a crack at it in IP.
5176 5175 * This updates the ip_xmit_attr with the IPsec policy.
5177 5176 *
5178 5177 * Remember -> we can be forwarding packets. Keep that in mind w.r.t.
5179 5178 * inner-packet contents.
5180 5179 */
5181 5180 mblk_t *
5182 5181 ipsec_tun_outbound(mblk_t *mp, iptun_t *iptun, ipha_t *inner_ipv4,
5183 5182 ip6_t *inner_ipv6, ipha_t *outer_ipv4, ip6_t *outer_ipv6, int outer_hdr_len,
5184 5183 ip_xmit_attr_t *ixa)
5185 5184 {
5186 5185 ipsec_policy_head_t *polhead;
5187 5186 ipsec_selector_t sel;
5188 5187 mblk_t *nmp;
5189 5188 boolean_t is_fragment;
5190 5189 ipsec_policy_t *pol;
5191 5190 ipsec_tun_pol_t *itp = iptun->iptun_itp;
5192 5191 netstack_t *ns = iptun->iptun_ns;
5193 5192 ipsec_stack_t *ipss = ns->netstack_ipsec;
5194 5193
5195 5194 ASSERT(outer_ipv6 != NULL && outer_ipv4 == NULL ||
5196 5195 outer_ipv4 != NULL && outer_ipv6 == NULL);
5197 5196 /* We take care of inners in a bit. */
5198 5197
5199 5198 /* Are the IPsec fields initialized at all? */
5200 5199 if (!(ixa->ixa_flags & IXAF_IPSEC_SECURE)) {
5201 5200 ASSERT(ixa->ixa_ipsec_policy == NULL);
5202 5201 ASSERT(ixa->ixa_ipsec_latch == NULL);
5203 5202 ASSERT(ixa->ixa_ipsec_action == NULL);
5204 5203 ASSERT(ixa->ixa_ipsec_ah_sa == NULL);
5205 5204 ASSERT(ixa->ixa_ipsec_esp_sa == NULL);
5206 5205 }
5207 5206
5208 5207 ASSERT(itp != NULL && (itp->itp_flags & ITPF_P_ACTIVE));
5209 5208 polhead = itp->itp_policy;
5210 5209
5211 5210 bzero(&sel, sizeof (sel));
5212 5211 if (inner_ipv4 != NULL) {
5213 5212 ASSERT(inner_ipv6 == NULL);
5214 5213 sel.ips_isv4 = B_TRUE;
5215 5214 sel.ips_local_addr_v4 = inner_ipv4->ipha_src;
5216 5215 sel.ips_remote_addr_v4 = inner_ipv4->ipha_dst;
5217 5216 sel.ips_protocol = (uint8_t)inner_ipv4->ipha_protocol;
5218 5217 } else {
5219 5218 ASSERT(inner_ipv6 != NULL);
5220 5219 sel.ips_isv4 = B_FALSE;
5221 5220 sel.ips_local_addr_v6 = inner_ipv6->ip6_src;
5222 5221 /*
5223 5222 * We don't care about routing-header dests in the
5224 5223 * forwarding/tunnel path, so just grab ip6_dst.
5225 5224 */
5226 5225 sel.ips_remote_addr_v6 = inner_ipv6->ip6_dst;
5227 5226 }
5228 5227
5229 5228 if (itp->itp_flags & ITPF_P_PER_PORT_SECURITY) {
5230 5229 /*
5231 5230 * Caller can prepend the outer header, which means
5232 5231 * inner_ipv[46] may be stuck in the middle. Pullup the whole
5233 5232 * mess now if need-be, for easier processing later. Don't
5234 5233 * forget to rewire the outer header too.
5235 5234 */
5236 5235 if (mp->b_cont != NULL) {
5237 5236 nmp = msgpullup(mp, -1);
5238 5237 if (nmp == NULL) {
5239 5238 ip_drop_packet(mp, B_FALSE, NULL,
5240 5239 DROPPER(ipss, ipds_spd_nomem),
5241 5240 &ipss->ipsec_spd_dropper);
5242 5241 return (NULL);
5243 5242 }
5244 5243 freemsg(mp);
5245 5244 mp = nmp;
5246 5245 if (outer_ipv4 != NULL)
5247 5246 outer_ipv4 = (ipha_t *)mp->b_rptr;
5248 5247 else
5249 5248 outer_ipv6 = (ip6_t *)mp->b_rptr;
5250 5249 if (inner_ipv4 != NULL) {
5251 5250 inner_ipv4 =
5252 5251 (ipha_t *)(mp->b_rptr + outer_hdr_len);
5253 5252 } else {
5254 5253 inner_ipv6 =
5255 5254 (ip6_t *)(mp->b_rptr + outer_hdr_len);
5256 5255 }
5257 5256 }
5258 5257 if (inner_ipv4 != NULL) {
5259 5258 is_fragment = IS_V4_FRAGMENT(
5260 5259 inner_ipv4->ipha_fragment_offset_and_flags);
5261 5260 } else {
5262 5261 sel.ips_remote_addr_v6 = ip_get_dst_v6(inner_ipv6, mp,
5263 5262 &is_fragment);
5264 5263 }
5265 5264
5266 5265 if (is_fragment) {
5267 5266 ipha_t *oiph;
5268 5267 ipha_t *iph = NULL;
5269 5268 ip6_t *ip6h = NULL;
5270 5269 int hdr_len;
5271 5270 uint16_t ip6_hdr_length;
5272 5271 uint8_t v6_proto;
5273 5272 uint8_t *v6_proto_p;
5274 5273
5275 5274 /*
5276 5275 * We have a fragment we need to track!
5277 5276 */
5278 5277 mp = ipsec_fragcache_add(&itp->itp_fragcache, NULL, mp,
5279 5278 outer_hdr_len, ipss);
5280 5279 if (mp == NULL)
5281 5280 return (NULL);
5282 5281 ASSERT(mp->b_cont == NULL);
5283 5282
5284 5283 /*
5285 5284 * If we get here, we have a full fragment chain
5286 5285 */
5287 5286
5288 5287 oiph = (ipha_t *)mp->b_rptr;
5289 5288 if (IPH_HDR_VERSION(oiph) == IPV4_VERSION) {
5290 5289 hdr_len = ((outer_hdr_len != 0) ?
5291 5290 IPH_HDR_LENGTH(oiph) : 0);
5292 5291 iph = (ipha_t *)(mp->b_rptr + hdr_len);
5293 5292 } else {
5294 5293 ASSERT(IPH_HDR_VERSION(oiph) == IPV6_VERSION);
5295 5294 ip6h = (ip6_t *)mp->b_rptr;
5296 5295 if (!ip_hdr_length_nexthdr_v6(mp, ip6h,
5297 5296 &ip6_hdr_length, &v6_proto_p)) {
5298 5297 ip_drop_packet_chain(mp, B_FALSE, NULL,
5299 5298 DROPPER(ipss,
5300 5299 ipds_spd_malformed_packet),
5301 5300 &ipss->ipsec_spd_dropper);
5302 5301 return (NULL);
5303 5302 }
5304 5303 hdr_len = ip6_hdr_length;
5305 5304 }
5306 5305 outer_hdr_len = hdr_len;
5307 5306
5308 5307 if (sel.ips_isv4) {
5309 5308 if (iph == NULL) {
5310 5309 /* Was v6 outer */
5311 5310 iph = (ipha_t *)(mp->b_rptr + hdr_len);
5312 5311 }
5313 5312 inner_ipv4 = iph;
5314 5313 sel.ips_local_addr_v4 = inner_ipv4->ipha_src;
5315 5314 sel.ips_remote_addr_v4 = inner_ipv4->ipha_dst;
5316 5315 sel.ips_protocol =
5317 5316 (uint8_t)inner_ipv4->ipha_protocol;
5318 5317 } else {
5319 5318 inner_ipv6 = (ip6_t *)(mp->b_rptr +
5320 5319 hdr_len);
5321 5320 sel.ips_local_addr_v6 = inner_ipv6->ip6_src;
5322 5321 sel.ips_remote_addr_v6 = inner_ipv6->ip6_dst;
5323 5322 if (!ip_hdr_length_nexthdr_v6(mp,
5324 5323 inner_ipv6, &ip6_hdr_length, &v6_proto_p)) {
5325 5324 ip_drop_packet_chain(mp, B_FALSE, NULL,
5326 5325 DROPPER(ipss,
5327 5326 ipds_spd_malformed_frag),
5328 5327 &ipss->ipsec_spd_dropper);
5329 5328 return (NULL);
5330 5329 }
5331 5330 v6_proto = *v6_proto_p;
5332 5331 sel.ips_protocol = v6_proto;
5333 5332 #ifdef FRAGCACHE_DEBUG
5334 5333 cmn_err(CE_WARN, "v6_sel.ips_protocol = %d\n",
5335 5334 sel.ips_protocol);
5336 5335 #endif
5337 5336 }
5338 5337 /* Ports are extracted below */
5339 5338 }
5340 5339
5341 5340 /* Get ports... */
5342 5341 if (!ipsec_init_outbound_ports(&sel, mp,
5343 5342 inner_ipv4, inner_ipv6, outer_hdr_len, ipss)) {
5344 5343 /* callee did ip_drop_packet_chain() on mp. */
5345 5344 return (NULL);
5346 5345 }
5347 5346 #ifdef FRAGCACHE_DEBUG
5348 5347 if (inner_ipv4 != NULL)
5349 5348 cmn_err(CE_WARN,
5350 5349 "(v4) sel.ips_protocol = %d, "
5351 5350 "sel.ips_local_port = %d, "
5352 5351 "sel.ips_remote_port = %d\n",
5353 5352 sel.ips_protocol, ntohs(sel.ips_local_port),
5354 5353 ntohs(sel.ips_remote_port));
5355 5354 if (inner_ipv6 != NULL)
5356 5355 cmn_err(CE_WARN,
5357 5356 "(v6) sel.ips_protocol = %d, "
5358 5357 "sel.ips_local_port = %d, "
5359 5358 "sel.ips_remote_port = %d\n",
5360 5359 sel.ips_protocol, ntohs(sel.ips_local_port),
5361 5360 ntohs(sel.ips_remote_port));
5362 5361 #endif
5363 5362 /* Success so far! */
5364 5363 }
5365 5364 rw_enter(&polhead->iph_lock, RW_READER);
5366 5365 pol = ipsec_find_policy_head(NULL, polhead, IPSEC_TYPE_OUTBOUND, &sel);
5367 5366 rw_exit(&polhead->iph_lock);
5368 5367 if (pol == NULL) {
5369 5368 /*
5370 5369 * No matching policy on this tunnel, drop the packet.
5371 5370 *
5372 5371 * NOTE: Tunnel-mode tunnels are different from the
5373 5372 * IP global transport mode policy head. For a tunnel-mode
5374 5373 * tunnel, we drop the packet in lieu of passing it
5375 5374 * along accepted the way a global-policy miss would.
5376 5375 *
5377 5376 * NOTE2: "negotiate transport" tunnels should match ALL
5378 5377 * inbound packets, but we do not uncomment the ASSERT()
5379 5378 * below because if/when we open PF_POLICY, a user can
5380 5379 * shoot him/her-self in the foot with a 0 priority.
5381 5380 */
5382 5381
5383 5382 /* ASSERT(itp->itp_flags & ITPF_P_TUNNEL); */
5384 5383 #ifdef FRAGCACHE_DEBUG
5385 5384 cmn_err(CE_WARN, "ipsec_tun_outbound(): No matching tunnel "
5386 5385 "per-port policy\n");
5387 5386 #endif
5388 5387 ip_drop_packet_chain(mp, B_FALSE, NULL,
5389 5388 DROPPER(ipss, ipds_spd_explicit),
5390 5389 &ipss->ipsec_spd_dropper);
5391 5390 return (NULL);
5392 5391 }
5393 5392
5394 5393 #ifdef FRAGCACHE_DEBUG
5395 5394 cmn_err(CE_WARN, "Having matching tunnel per-port policy\n");
5396 5395 #endif
5397 5396
5398 5397 /*
5399 5398 * NOTE: ixa_cleanup() function will release pol references.
5400 5399 */
5401 5400 ixa->ixa_ipsec_policy = pol;
5402 5401 /*
5403 5402 * NOTE: There is a subtle difference between iptun_zoneid and
5404 5403 * iptun_connp->conn_zoneid explained in iptun_conn_create(). When
5405 5404 * interacting with the ip module, we must use conn_zoneid.
5406 5405 */
5407 5406 ixa->ixa_zoneid = iptun->iptun_connp->conn_zoneid;
5408 5407
5409 5408 ASSERT((outer_ipv4 != NULL) ? (ixa->ixa_flags & IXAF_IS_IPV4) :
5410 5409 !(ixa->ixa_flags & IXAF_IS_IPV4));
5411 5410 ASSERT(ixa->ixa_ipsec_policy != NULL);
5412 5411 ixa->ixa_flags |= IXAF_IPSEC_SECURE;
5413 5412
5414 5413 if (!(itp->itp_flags & ITPF_P_TUNNEL)) {
5415 5414 /* Set up transport mode for tunnelled packets. */
5416 5415 ixa->ixa_ipsec_proto = (inner_ipv4 != NULL) ? IPPROTO_ENCAP :
5417 5416 IPPROTO_IPV6;
5418 5417 return (mp);
5419 5418 }
5420 5419
5421 5420 /* Fill in tunnel-mode goodies here. */
5422 5421 ixa->ixa_flags |= IXAF_IPSEC_TUNNEL;
5423 5422 /* XXX Do I need to fill in all of the goodies here? */
5424 5423 if (inner_ipv4) {
5425 5424 ixa->ixa_ipsec_inaf = AF_INET;
5426 5425 ixa->ixa_ipsec_insrc[0] =
5427 5426 pol->ipsp_sel->ipsl_key.ipsl_local.ipsad_v4;
5428 5427 ixa->ixa_ipsec_indst[0] =
5429 5428 pol->ipsp_sel->ipsl_key.ipsl_remote.ipsad_v4;
5430 5429 } else {
5431 5430 ixa->ixa_ipsec_inaf = AF_INET6;
5432 5431 ixa->ixa_ipsec_insrc[0] =
5433 5432 pol->ipsp_sel->ipsl_key.ipsl_local.ipsad_v6.s6_addr32[0];
5434 5433 ixa->ixa_ipsec_insrc[1] =
5435 5434 pol->ipsp_sel->ipsl_key.ipsl_local.ipsad_v6.s6_addr32[1];
5436 5435 ixa->ixa_ipsec_insrc[2] =
5437 5436 pol->ipsp_sel->ipsl_key.ipsl_local.ipsad_v6.s6_addr32[2];
5438 5437 ixa->ixa_ipsec_insrc[3] =
5439 5438 pol->ipsp_sel->ipsl_key.ipsl_local.ipsad_v6.s6_addr32[3];
5440 5439 ixa->ixa_ipsec_indst[0] =
5441 5440 pol->ipsp_sel->ipsl_key.ipsl_remote.ipsad_v6.s6_addr32[0];
5442 5441 ixa->ixa_ipsec_indst[1] =
5443 5442 pol->ipsp_sel->ipsl_key.ipsl_remote.ipsad_v6.s6_addr32[1];
5444 5443 ixa->ixa_ipsec_indst[2] =
5445 5444 pol->ipsp_sel->ipsl_key.ipsl_remote.ipsad_v6.s6_addr32[2];
5446 5445 ixa->ixa_ipsec_indst[3] =
5447 5446 pol->ipsp_sel->ipsl_key.ipsl_remote.ipsad_v6.s6_addr32[3];
5448 5447 }
5449 5448 ixa->ixa_ipsec_insrcpfx = pol->ipsp_sel->ipsl_key.ipsl_local_pfxlen;
5450 5449 ixa->ixa_ipsec_indstpfx = pol->ipsp_sel->ipsl_key.ipsl_remote_pfxlen;
5451 5450 /* NOTE: These are used for transport mode too. */
5452 5451 ixa->ixa_ipsec_src_port = pol->ipsp_sel->ipsl_key.ipsl_lport;
5453 5452 ixa->ixa_ipsec_dst_port = pol->ipsp_sel->ipsl_key.ipsl_rport;
5454 5453 ixa->ixa_ipsec_proto = pol->ipsp_sel->ipsl_key.ipsl_proto;
5455 5454
5456 5455 return (mp);
5457 5456 }
5458 5457
5459 5458 /*
5460 5459 * NOTE: The following releases pol's reference and
5461 5460 * calls ip_drop_packet() for me on NULL returns.
5462 5461 */
5463 5462 mblk_t *
5464 5463 ipsec_check_ipsecin_policy_reasm(mblk_t *attr_mp, ipsec_policy_t *pol,
5465 5464 ipha_t *inner_ipv4, ip6_t *inner_ipv6, uint64_t pkt_unique, netstack_t *ns)
5466 5465 {
5467 5466 /* Assume attr_mp is a chain of b_next-linked ip_recv_attr mblk. */
5468 5467 mblk_t *data_chain = NULL, *data_tail = NULL;
5469 5468 mblk_t *next;
5470 5469 mblk_t *data_mp;
5471 5470 ip_recv_attr_t iras;
5472 5471
5473 5472 while (attr_mp != NULL) {
5474 5473 ASSERT(ip_recv_attr_is_mblk(attr_mp));
5475 5474 next = attr_mp->b_next;
5476 5475 attr_mp->b_next = NULL; /* No tripping asserts. */
5477 5476
5478 5477 data_mp = attr_mp->b_cont;
5479 5478 attr_mp->b_cont = NULL;
5480 5479 if (!ip_recv_attr_from_mblk(attr_mp, &iras)) {
5481 5480 /* The ill or ip_stack_t disappeared on us */
5482 5481 freemsg(data_mp); /* ip_drop_packet?? */
5483 5482 ira_cleanup(&iras, B_TRUE);
5484 5483 goto fail;
5485 5484 }
5486 5485
5487 5486 /*
5488 5487 * Need IPPOL_REFHOLD(pol) for extras because
5489 5488 * ipsecin_policy does the refrele.
5490 5489 */
5491 5490 IPPOL_REFHOLD(pol);
5492 5491
5493 5492 data_mp = ipsec_check_ipsecin_policy(data_mp, pol, inner_ipv4,
5494 5493 inner_ipv6, pkt_unique, &iras, ns);
5495 5494 ira_cleanup(&iras, B_TRUE);
5496 5495
5497 5496 if (data_mp == NULL)
5498 5497 goto fail;
5499 5498
5500 5499 if (data_tail == NULL) {
5501 5500 /* First one */
5502 5501 data_chain = data_tail = data_mp;
5503 5502 } else {
5504 5503 data_tail->b_next = data_mp;
5505 5504 data_tail = data_mp;
5506 5505 }
5507 5506 attr_mp = next;
5508 5507 }
5509 5508 /*
5510 5509 * One last release because either the loop bumped it up, or we never
5511 5510 * called ipsec_check_ipsecin_policy().
5512 5511 */
5513 5512 IPPOL_REFRELE(pol);
5514 5513
5515 5514 /* data_chain is ready for return to tun module. */
5516 5515 return (data_chain);
5517 5516
5518 5517 fail:
5519 5518 /*
5520 5519 * Need to get rid of any extra pol
5521 5520 * references, and any remaining bits as well.
5522 5521 */
5523 5522 IPPOL_REFRELE(pol);
5524 5523 ipsec_freemsg_chain(data_chain);
5525 5524 ipsec_freemsg_chain(next); /* ipdrop stats? */
5526 5525 return (NULL);
5527 5526 }
5528 5527
5529 5528 /*
5530 5529 * Return a message if the inbound packet passed an IPsec policy check. Returns
5531 5530 * NULL if it failed or if it is a fragment needing its friends before a
5532 5531 * policy check can be performed.
5533 5532 *
5534 5533 * Expects a non-NULL data_mp, and a non-NULL polhead.
5535 5534 * The returned mblk may be a b_next chain of packets if fragments
5536 5535 * neeeded to be collected for a proper policy check.
5537 5536 *
5538 5537 * This function calls ip_drop_packet() on data_mp if need be.
5539 5538 *
5540 5539 * NOTE: outer_hdr_len is signed. If it's a negative value, the caller
5541 5540 * is inspecting an ICMP packet.
5542 5541 */
5543 5542 mblk_t *
5544 5543 ipsec_tun_inbound(ip_recv_attr_t *ira, mblk_t *data_mp, ipsec_tun_pol_t *itp,
5545 5544 ipha_t *inner_ipv4, ip6_t *inner_ipv6, ipha_t *outer_ipv4,
5546 5545 ip6_t *outer_ipv6, int outer_hdr_len, netstack_t *ns)
5547 5546 {
5548 5547 ipsec_policy_head_t *polhead;
5549 5548 ipsec_selector_t sel;
5550 5549 ipsec_policy_t *pol;
5551 5550 uint16_t tmpport;
5552 5551 selret_t rc;
5553 5552 boolean_t port_policy_present, is_icmp, global_present;
5554 5553 in6_addr_t tmpaddr;
5555 5554 ipaddr_t tmp4;
5556 5555 uint8_t flags, *inner_hdr;
5557 5556 ipsec_stack_t *ipss = ns->netstack_ipsec;
5558 5557
5559 5558 sel.ips_is_icmp_inv_acq = 0;
5560 5559
5561 5560 if (outer_ipv4 != NULL) {
5562 5561 ASSERT(outer_ipv6 == NULL);
5563 5562 global_present = ipss->ipsec_inbound_v4_policy_present;
5564 5563 } else {
5565 5564 ASSERT(outer_ipv6 != NULL);
5566 5565 global_present = ipss->ipsec_inbound_v6_policy_present;
5567 5566 }
5568 5567
5569 5568 ASSERT(inner_ipv4 != NULL && inner_ipv6 == NULL ||
5570 5569 inner_ipv4 == NULL && inner_ipv6 != NULL);
5571 5570
5572 5571 if (outer_hdr_len < 0) {
5573 5572 outer_hdr_len = (-outer_hdr_len);
5574 5573 is_icmp = B_TRUE;
5575 5574 } else {
5576 5575 is_icmp = B_FALSE;
5577 5576 }
5578 5577
5579 5578 if (itp != NULL && (itp->itp_flags & ITPF_P_ACTIVE)) {
5580 5579 mblk_t *mp = data_mp;
5581 5580
5582 5581 polhead = itp->itp_policy;
5583 5582 /*
5584 5583 * We need to perform full Tunnel-Mode enforcement,
5585 5584 * and we need to have inner-header data for such enforcement.
5586 5585 *
5587 5586 * See ipsec_init_inbound_sel() for the 0x80000000 on inbound
5588 5587 * and on return.
5589 5588 */
5590 5589
5591 5590 port_policy_present = ((itp->itp_flags &
5592 5591 ITPF_P_PER_PORT_SECURITY) ? B_TRUE : B_FALSE);
5593 5592 /*
5594 5593 * NOTE: Even if our policy is transport mode, set the
5595 5594 * SEL_TUNNEL_MODE flag so ipsec_init_inbound_sel() can
5596 5595 * do the right thing w.r.t. outer headers.
5597 5596 */
5598 5597 flags = ((port_policy_present ? SEL_PORT_POLICY : SEL_NONE) |
5599 5598 (is_icmp ? SEL_IS_ICMP : SEL_NONE) | SEL_TUNNEL_MODE);
5600 5599
5601 5600 rc = ipsec_init_inbound_sel(&sel, data_mp, inner_ipv4,
5602 5601 inner_ipv6, flags);
5603 5602
5604 5603 switch (rc) {
5605 5604 case SELRET_NOMEM:
5606 5605 ip_drop_packet(data_mp, B_TRUE, NULL,
5607 5606 DROPPER(ipss, ipds_spd_nomem),
5608 5607 &ipss->ipsec_spd_dropper);
5609 5608 return (NULL);
5610 5609 case SELRET_TUNFRAG:
5611 5610 /*
5612 5611 * At this point, if we're cleartext, we don't want
5613 5612 * to go there.
5614 5613 */
5615 5614 if (!(ira->ira_flags & IRAF_IPSEC_SECURE)) {
5616 5615 ip_drop_packet(data_mp, B_TRUE, NULL,
5617 5616 DROPPER(ipss, ipds_spd_got_clear),
5618 5617 &ipss->ipsec_spd_dropper);
5619 5618 return (NULL);
5620 5619 }
5621 5620
5622 5621 /*
5623 5622 * Inner and outer headers may not be contiguous.
5624 5623 * Pullup the data_mp now to satisfy assumptions of
5625 5624 * ipsec_fragcache_add()
5626 5625 */
5627 5626 if (data_mp->b_cont != NULL) {
5628 5627 mblk_t *nmp;
5629 5628
5630 5629 nmp = msgpullup(data_mp, -1);
5631 5630 if (nmp == NULL) {
5632 5631 ip_drop_packet(data_mp, B_TRUE, NULL,
5633 5632 DROPPER(ipss, ipds_spd_nomem),
5634 5633 &ipss->ipsec_spd_dropper);
5635 5634 return (NULL);
5636 5635 }
5637 5636 freemsg(data_mp);
5638 5637 data_mp = nmp;
5639 5638 if (outer_ipv4 != NULL)
5640 5639 outer_ipv4 =
5641 5640 (ipha_t *)data_mp->b_rptr;
5642 5641 else
5643 5642 outer_ipv6 =
5644 5643 (ip6_t *)data_mp->b_rptr;
5645 5644 if (inner_ipv4 != NULL) {
5646 5645 inner_ipv4 =
5647 5646 (ipha_t *)(data_mp->b_rptr +
5648 5647 outer_hdr_len);
5649 5648 } else {
5650 5649 inner_ipv6 =
5651 5650 (ip6_t *)(data_mp->b_rptr +
5652 5651 outer_hdr_len);
5653 5652 }
5654 5653 }
5655 5654
5656 5655 /*
5657 5656 * If we need to queue the packet. First we
5658 5657 * get an mblk with the attributes. ipsec_fragcache_add
5659 5658 * will prepend that to the queued data and return
5660 5659 * a list of b_next messages each of which starts with
5661 5660 * the attribute mblk.
5662 5661 */
5663 5662 mp = ip_recv_attr_to_mblk(ira);
5664 5663 if (mp == NULL) {
5665 5664 ip_drop_packet(data_mp, B_TRUE, NULL,
5666 5665 DROPPER(ipss, ipds_spd_nomem),
5667 5666 &ipss->ipsec_spd_dropper);
5668 5667 return (NULL);
5669 5668 }
5670 5669
5671 5670 mp = ipsec_fragcache_add(&itp->itp_fragcache,
5672 5671 mp, data_mp, outer_hdr_len, ipss);
5673 5672
5674 5673 if (mp == NULL) {
5675 5674 /*
5676 5675 * Data is cached, fragment chain is not
5677 5676 * complete.
5678 5677 */
5679 5678 return (NULL);
5680 5679 }
5681 5680
5682 5681 /*
5683 5682 * If we get here, we have a full fragment chain.
5684 5683 * Reacquire headers and selectors from first fragment.
5685 5684 */
5686 5685 ASSERT(ip_recv_attr_is_mblk(mp));
5687 5686 data_mp = mp->b_cont;
5688 5687 inner_hdr = data_mp->b_rptr;
5689 5688 if (outer_ipv4 != NULL) {
5690 5689 inner_hdr += IPH_HDR_LENGTH(
5691 5690 (ipha_t *)data_mp->b_rptr);
5692 5691 } else {
5693 5692 inner_hdr += ip_hdr_length_v6(data_mp,
5694 5693 (ip6_t *)data_mp->b_rptr);
5695 5694 }
5696 5695 ASSERT(inner_hdr <= data_mp->b_wptr);
5697 5696
5698 5697 if (inner_ipv4 != NULL) {
5699 5698 inner_ipv4 = (ipha_t *)inner_hdr;
5700 5699 inner_ipv6 = NULL;
5701 5700 } else {
5702 5701 inner_ipv6 = (ip6_t *)inner_hdr;
5703 5702 inner_ipv4 = NULL;
5704 5703 }
5705 5704
5706 5705 /*
5707 5706 * Use SEL_TUNNEL_MODE to take into account the outer
5708 5707 * header. Use SEL_POST_FRAG so we always get ports.
5709 5708 */
5710 5709 rc = ipsec_init_inbound_sel(&sel, data_mp,
5711 5710 inner_ipv4, inner_ipv6,
5712 5711 SEL_TUNNEL_MODE | SEL_POST_FRAG);
5713 5712 switch (rc) {
5714 5713 case SELRET_SUCCESS:
5715 5714 /*
5716 5715 * Get to same place as first caller's
5717 5716 * SELRET_SUCCESS case.
5718 5717 */
5719 5718 break;
5720 5719 case SELRET_NOMEM:
5721 5720 ip_drop_packet_chain(mp, B_TRUE, NULL,
5722 5721 DROPPER(ipss, ipds_spd_nomem),
5723 5722 &ipss->ipsec_spd_dropper);
5724 5723 return (NULL);
5725 5724 case SELRET_BADPKT:
5726 5725 ip_drop_packet_chain(mp, B_TRUE, NULL,
5727 5726 DROPPER(ipss, ipds_spd_malformed_frag),
5728 5727 &ipss->ipsec_spd_dropper);
5729 5728 return (NULL);
5730 5729 case SELRET_TUNFRAG:
5731 5730 cmn_err(CE_WARN, "(TUNFRAG on 2nd call...)");
5732 5731 /* FALLTHRU */
5733 5732 default:
5734 5733 cmn_err(CE_WARN, "ipsec_init_inbound_sel(mark2)"
5735 5734 " returns bizarro 0x%x", rc);
5736 5735 /* Guaranteed panic! */
5737 5736 ASSERT(rc == SELRET_NOMEM);
5738 5737 return (NULL);
5739 5738 }
5740 5739 /* FALLTHRU */
5741 5740 case SELRET_SUCCESS:
5742 5741 /*
5743 5742 * Common case:
5744 5743 * No per-port policy or a non-fragment. Keep going.
5745 5744 */
5746 5745 break;
5747 5746 case SELRET_BADPKT:
5748 5747 /*
5749 5748 * We may receive ICMP (with IPv6 inner) packets that
5750 5749 * trigger this return value. Send 'em in for
5751 5750 * enforcement checking.
5752 5751 */
5753 5752 cmn_err(CE_NOTE, "ipsec_tun_inbound(): "
5754 5753 "sending 'bad packet' in for enforcement");
5755 5754 break;
5756 5755 default:
5757 5756 cmn_err(CE_WARN,
5758 5757 "ipsec_init_inbound_sel() returns bizarro 0x%x",
5759 5758 rc);
5760 5759 ASSERT(rc == SELRET_NOMEM); /* Guaranteed panic! */
5761 5760 return (NULL);
5762 5761 }
5763 5762
5764 5763 if (is_icmp) {
5765 5764 /*
5766 5765 * Swap local/remote because this is an ICMP packet.
5767 5766 */
5768 5767 tmpaddr = sel.ips_local_addr_v6;
5769 5768 sel.ips_local_addr_v6 = sel.ips_remote_addr_v6;
5770 5769 sel.ips_remote_addr_v6 = tmpaddr;
5771 5770 tmpport = sel.ips_local_port;
5772 5771 sel.ips_local_port = sel.ips_remote_port;
5773 5772 sel.ips_remote_port = tmpport;
5774 5773 }
5775 5774
5776 5775 /* find_policy_head() */
5777 5776 rw_enter(&polhead->iph_lock, RW_READER);
5778 5777 pol = ipsec_find_policy_head(NULL, polhead, IPSEC_TYPE_INBOUND,
5779 5778 &sel);
5780 5779 rw_exit(&polhead->iph_lock);
5781 5780 if (pol != NULL) {
5782 5781 uint64_t pkt_unique;
5783 5782
5784 5783 if (!(ira->ira_flags & IRAF_IPSEC_SECURE)) {
5785 5784 if (!pol->ipsp_act->ipa_allow_clear) {
5786 5785 /*
5787 5786 * XXX should never get here with
5788 5787 * tunnel reassembled fragments?
5789 5788 */
5790 5789 ASSERT(mp == data_mp);
5791 5790 ip_drop_packet(data_mp, B_TRUE, NULL,
5792 5791 DROPPER(ipss, ipds_spd_got_clear),
5793 5792 &ipss->ipsec_spd_dropper);
5794 5793 IPPOL_REFRELE(pol);
5795 5794 return (NULL);
5796 5795 } else {
5797 5796 IPPOL_REFRELE(pol);
5798 5797 return (mp);
5799 5798 }
5800 5799 }
5801 5800 pkt_unique = SA_UNIQUE_ID(sel.ips_remote_port,
5802 5801 sel.ips_local_port,
5803 5802 (inner_ipv4 == NULL) ? IPPROTO_IPV6 :
5804 5803 IPPROTO_ENCAP, sel.ips_protocol);
5805 5804
5806 5805 /*
5807 5806 * NOTE: The following releases pol's reference and
5808 5807 * calls ip_drop_packet() for me on NULL returns.
5809 5808 *
5810 5809 * "sel" is still good here, so let's use it!
5811 5810 */
5812 5811 if (data_mp == mp) {
5813 5812 /* A single packet without attributes */
5814 5813 data_mp = ipsec_check_ipsecin_policy(data_mp,
5815 5814 pol, inner_ipv4, inner_ipv6, pkt_unique,
5816 5815 ira, ns);
5817 5816 } else {
5818 5817 /*
5819 5818 * We pass in the b_next chain of attr_mp's
5820 5819 * and get back a b_next chain of data_mp's.
5821 5820 */
5822 5821 data_mp = ipsec_check_ipsecin_policy_reasm(mp,
5823 5822 pol, inner_ipv4, inner_ipv6, pkt_unique,
5824 5823 ns);
5825 5824 }
5826 5825 return (data_mp);
5827 5826 }
5828 5827
5829 5828 /*
5830 5829 * Else fallthru and check the global policy on the outer
5831 5830 * header(s) if this tunnel is an old-style transport-mode
5832 5831 * one. Drop the packet explicitly (no policy entry) for
5833 5832 * a new-style tunnel-mode tunnel.
5834 5833 */
5835 5834 if ((itp->itp_flags & ITPF_P_TUNNEL) && !is_icmp) {
5836 5835 ip_drop_packet_chain(data_mp, B_TRUE, NULL,
5837 5836 DROPPER(ipss, ipds_spd_explicit),
5838 5837 &ipss->ipsec_spd_dropper);
5839 5838 return (NULL);
5840 5839 }
5841 5840 }
5842 5841
5843 5842 /*
5844 5843 * NOTE: If we reach here, we will not have packet chains from
5845 5844 * fragcache_add(), because the only way I get chains is on a
5846 5845 * tunnel-mode tunnel, which either returns with a pass, or gets
5847 5846 * hit by the ip_drop_packet_chain() call right above here.
5848 5847 */
5849 5848 ASSERT(data_mp->b_next == NULL);
5850 5849
5851 5850 /* If no per-tunnel security, check global policy now. */
5852 5851 if ((ira->ira_flags & IRAF_IPSEC_SECURE) && !global_present) {
5853 5852 if (ira->ira_flags & IRAF_TRUSTED_ICMP) {
5854 5853 /*
5855 5854 * This is an ICMP message that was geenrated locally.
5856 5855 * We should accept it.
5857 5856 */
5858 5857 return (data_mp);
5859 5858 }
5860 5859
5861 5860 ip_drop_packet(data_mp, B_TRUE, NULL,
5862 5861 DROPPER(ipss, ipds_spd_got_secure),
5863 5862 &ipss->ipsec_spd_dropper);
5864 5863 return (NULL);
5865 5864 }
5866 5865
5867 5866 if (is_icmp) {
5868 5867 /*
5869 5868 * For ICMP packets, "outer_ipvN" is set to the outer header
5870 5869 * that is *INSIDE* the ICMP payload. For global policy
5871 5870 * checking, we need to reverse src/dst on the payload in
5872 5871 * order to construct selectors appropriately. See "ripha"
5873 5872 * constructions in ip.c. To avoid a bug like 6478464 (see
5874 5873 * earlier in this file), we will actually exchange src/dst
5875 5874 * in the packet, and reverse if after the call to
5876 5875 * ipsec_check_global_policy().
5877 5876 */
5878 5877 if (outer_ipv4 != NULL) {
5879 5878 tmp4 = outer_ipv4->ipha_src;
5880 5879 outer_ipv4->ipha_src = outer_ipv4->ipha_dst;
5881 5880 outer_ipv4->ipha_dst = tmp4;
5882 5881 } else {
5883 5882 ASSERT(outer_ipv6 != NULL);
5884 5883 tmpaddr = outer_ipv6->ip6_src;
5885 5884 outer_ipv6->ip6_src = outer_ipv6->ip6_dst;
5886 5885 outer_ipv6->ip6_dst = tmpaddr;
5887 5886 }
5888 5887 }
5889 5888
5890 5889 data_mp = ipsec_check_global_policy(data_mp, NULL, outer_ipv4,
5891 5890 outer_ipv6, ira, ns);
5892 5891 if (data_mp == NULL)
5893 5892 return (NULL);
5894 5893
5895 5894 if (is_icmp) {
5896 5895 /* Set things back to normal. */
5897 5896 if (outer_ipv4 != NULL) {
5898 5897 tmp4 = outer_ipv4->ipha_src;
5899 5898 outer_ipv4->ipha_src = outer_ipv4->ipha_dst;
5900 5899 outer_ipv4->ipha_dst = tmp4;
5901 5900 } else {
5902 5901 /* No need for ASSERT()s now. */
5903 5902 tmpaddr = outer_ipv6->ip6_src;
5904 5903 outer_ipv6->ip6_src = outer_ipv6->ip6_dst;
5905 5904 outer_ipv6->ip6_dst = tmpaddr;
5906 5905 }
5907 5906 }
5908 5907
5909 5908 /*
5910 5909 * At this point, we pretend it's a cleartext accepted
5911 5910 * packet.
5912 5911 */
5913 5912 return (data_mp);
5914 5913 }
5915 5914
5916 5915 /*
5917 5916 * AVL comparison routine for our list of tunnel polheads.
5918 5917 */
5919 5918 static int
5920 5919 tunnel_compare(const void *arg1, const void *arg2)
5921 5920 {
5922 5921 ipsec_tun_pol_t *left, *right;
5923 5922 int rc;
5924 5923
5925 5924 left = (ipsec_tun_pol_t *)arg1;
5926 5925 right = (ipsec_tun_pol_t *)arg2;
5927 5926
5928 5927 rc = strncmp(left->itp_name, right->itp_name, LIFNAMSIZ);
5929 5928 return (rc == 0 ? rc : (rc > 0 ? 1 : -1));
5930 5929 }
5931 5930
5932 5931 /*
5933 5932 * Free a tunnel policy node.
5934 5933 */
5935 5934 void
5936 5935 itp_free(ipsec_tun_pol_t *node, netstack_t *ns)
5937 5936 {
5938 5937 if (node->itp_policy != NULL) {
5939 5938 IPPH_REFRELE(node->itp_policy, ns);
5940 5939 node->itp_policy = NULL;
5941 5940 }
5942 5941 if (node->itp_inactive != NULL) {
5943 5942 IPPH_REFRELE(node->itp_inactive, ns);
5944 5943 node->itp_inactive = NULL;
5945 5944 }
5946 5945 mutex_destroy(&node->itp_lock);
5947 5946 kmem_free(node, sizeof (*node));
5948 5947 }
5949 5948
5950 5949 void
5951 5950 itp_unlink(ipsec_tun_pol_t *node, netstack_t *ns)
5952 5951 {
5953 5952 ipsec_stack_t *ipss = ns->netstack_ipsec;
5954 5953
5955 5954 rw_enter(&ipss->ipsec_tunnel_policy_lock, RW_WRITER);
5956 5955 ipss->ipsec_tunnel_policy_gen++;
5957 5956 ipsec_fragcache_uninit(&node->itp_fragcache, ipss);
5958 5957 avl_remove(&ipss->ipsec_tunnel_policies, node);
5959 5958 rw_exit(&ipss->ipsec_tunnel_policy_lock);
5960 5959 ITP_REFRELE(node, ns);
5961 5960 }
5962 5961
5963 5962 /*
5964 5963 * Public interface to look up a tunnel security policy by name. Used by
5965 5964 * spdsock mostly. Returns "node" with a bumped refcnt.
5966 5965 */
5967 5966 ipsec_tun_pol_t *
5968 5967 get_tunnel_policy(char *name, netstack_t *ns)
5969 5968 {
5970 5969 ipsec_tun_pol_t *node, lookup;
5971 5970 ipsec_stack_t *ipss = ns->netstack_ipsec;
5972 5971
5973 5972 (void) strncpy(lookup.itp_name, name, LIFNAMSIZ);
5974 5973
5975 5974 rw_enter(&ipss->ipsec_tunnel_policy_lock, RW_READER);
5976 5975 node = (ipsec_tun_pol_t *)avl_find(&ipss->ipsec_tunnel_policies,
5977 5976 &lookup, NULL);
5978 5977 if (node != NULL) {
5979 5978 ITP_REFHOLD(node);
5980 5979 }
5981 5980 rw_exit(&ipss->ipsec_tunnel_policy_lock);
5982 5981
5983 5982 return (node);
5984 5983 }
5985 5984
5986 5985 /*
5987 5986 * Public interface to walk all tunnel security polcies. Useful for spdsock
5988 5987 * DUMP operations. iterator() will not consume a reference.
5989 5988 */
5990 5989 void
5991 5990 itp_walk(void (*iterator)(ipsec_tun_pol_t *, void *, netstack_t *),
5992 5991 void *arg, netstack_t *ns)
5993 5992 {
5994 5993 ipsec_tun_pol_t *node;
5995 5994 ipsec_stack_t *ipss = ns->netstack_ipsec;
5996 5995
5997 5996 rw_enter(&ipss->ipsec_tunnel_policy_lock, RW_READER);
5998 5997 for (node = avl_first(&ipss->ipsec_tunnel_policies); node != NULL;
5999 5998 node = AVL_NEXT(&ipss->ipsec_tunnel_policies, node)) {
6000 5999 iterator(node, arg, ns);
6001 6000 }
6002 6001 rw_exit(&ipss->ipsec_tunnel_policy_lock);
6003 6002 }
6004 6003
6005 6004 /*
6006 6005 * Initialize policy head. This can only fail if there's a memory problem.
6007 6006 */
6008 6007 static boolean_t
6009 6008 tunnel_polhead_init(ipsec_policy_head_t *iph, netstack_t *ns)
6010 6009 {
6011 6010 ipsec_stack_t *ipss = ns->netstack_ipsec;
6012 6011
6013 6012 rw_init(&iph->iph_lock, NULL, RW_DEFAULT, NULL);
6014 6013 iph->iph_refs = 1;
6015 6014 iph->iph_gen = 0;
6016 6015 if (ipsec_alloc_table(iph, ipss->ipsec_tun_spd_hashsize,
6017 6016 KM_SLEEP, B_FALSE, ns) != 0) {
6018 6017 ipsec_polhead_free_table(iph);
6019 6018 return (B_FALSE);
6020 6019 }
6021 6020 ipsec_polhead_init(iph, ipss->ipsec_tun_spd_hashsize);
6022 6021 return (B_TRUE);
6023 6022 }
6024 6023
6025 6024 /*
6026 6025 * Create a tunnel policy node with "name". Set errno with
6027 6026 * ENOMEM if there's a memory problem, and EEXIST if there's an existing
6028 6027 * node.
6029 6028 */
6030 6029 ipsec_tun_pol_t *
6031 6030 create_tunnel_policy(char *name, int *errno, uint64_t *gen, netstack_t *ns)
6032 6031 {
6033 6032 ipsec_tun_pol_t *newbie, *existing;
6034 6033 avl_index_t where;
6035 6034 ipsec_stack_t *ipss = ns->netstack_ipsec;
6036 6035
6037 6036 newbie = kmem_zalloc(sizeof (*newbie), KM_NOSLEEP);
6038 6037 if (newbie == NULL) {
6039 6038 *errno = ENOMEM;
6040 6039 return (NULL);
6041 6040 }
6042 6041 if (!ipsec_fragcache_init(&newbie->itp_fragcache)) {
6043 6042 kmem_free(newbie, sizeof (*newbie));
6044 6043 *errno = ENOMEM;
6045 6044 return (NULL);
6046 6045 }
6047 6046
6048 6047 (void) strncpy(newbie->itp_name, name, LIFNAMSIZ);
6049 6048
6050 6049 rw_enter(&ipss->ipsec_tunnel_policy_lock, RW_WRITER);
6051 6050 existing = (ipsec_tun_pol_t *)avl_find(&ipss->ipsec_tunnel_policies,
6052 6051 newbie, &where);
6053 6052 if (existing != NULL) {
6054 6053 itp_free(newbie, ns);
6055 6054 *errno = EEXIST;
6056 6055 rw_exit(&ipss->ipsec_tunnel_policy_lock);
6057 6056 return (NULL);
6058 6057 }
6059 6058 ipss->ipsec_tunnel_policy_gen++;
6060 6059 *gen = ipss->ipsec_tunnel_policy_gen;
6061 6060 newbie->itp_refcnt = 2; /* One for the caller, one for the tree. */
6062 6061 newbie->itp_next_policy_index = 1;
6063 6062 avl_insert(&ipss->ipsec_tunnel_policies, newbie, where);
6064 6063 mutex_init(&newbie->itp_lock, NULL, MUTEX_DEFAULT, NULL);
6065 6064 newbie->itp_policy = kmem_zalloc(sizeof (ipsec_policy_head_t),
6066 6065 KM_NOSLEEP);
6067 6066 if (newbie->itp_policy == NULL)
6068 6067 goto nomem;
6069 6068 newbie->itp_inactive = kmem_zalloc(sizeof (ipsec_policy_head_t),
6070 6069 KM_NOSLEEP);
6071 6070 if (newbie->itp_inactive == NULL) {
6072 6071 kmem_free(newbie->itp_policy, sizeof (ipsec_policy_head_t));
6073 6072 goto nomem;
6074 6073 }
6075 6074
6076 6075 if (!tunnel_polhead_init(newbie->itp_policy, ns)) {
6077 6076 kmem_free(newbie->itp_policy, sizeof (ipsec_policy_head_t));
6078 6077 kmem_free(newbie->itp_inactive, sizeof (ipsec_policy_head_t));
6079 6078 goto nomem;
6080 6079 } else if (!tunnel_polhead_init(newbie->itp_inactive, ns)) {
6081 6080 IPPH_REFRELE(newbie->itp_policy, ns);
6082 6081 kmem_free(newbie->itp_inactive, sizeof (ipsec_policy_head_t));
6083 6082 goto nomem;
6084 6083 }
6085 6084 rw_exit(&ipss->ipsec_tunnel_policy_lock);
6086 6085
6087 6086 return (newbie);
6088 6087 nomem:
6089 6088 *errno = ENOMEM;
6090 6089 kmem_free(newbie, sizeof (*newbie));
6091 6090 return (NULL);
6092 6091 }
6093 6092
6094 6093 /*
6095 6094 * Given two addresses, find a tunnel instance's IPsec policy heads.
6096 6095 * Returns NULL on failure.
6097 6096 */
6098 6097 ipsec_tun_pol_t *
6099 6098 itp_get_byaddr(uint32_t *laddr, uint32_t *faddr, int af, ip_stack_t *ipst)
6100 6099 {
6101 6100 conn_t *connp;
6102 6101 iptun_t *iptun;
6103 6102 ipsec_tun_pol_t *itp = NULL;
6104 6103
6105 6104 /* Classifiers are used to "src" being foreign. */
6106 6105 if (af == AF_INET) {
6107 6106 connp = ipcl_iptun_classify_v4((ipaddr_t *)faddr,
6108 6107 (ipaddr_t *)laddr, ipst);
6109 6108 } else {
6110 6109 ASSERT(af == AF_INET6);
6111 6110 ASSERT(!IN6_IS_ADDR_V4MAPPED((in6_addr_t *)laddr));
6112 6111 ASSERT(!IN6_IS_ADDR_V4MAPPED((in6_addr_t *)faddr));
6113 6112 connp = ipcl_iptun_classify_v6((in6_addr_t *)faddr,
6114 6113 (in6_addr_t *)laddr, ipst);
6115 6114 }
6116 6115
6117 6116 if (connp == NULL)
6118 6117 return (NULL);
6119 6118
6120 6119 if (IPCL_IS_IPTUN(connp)) {
6121 6120 iptun = connp->conn_iptun;
6122 6121 if (iptun != NULL) {
6123 6122 itp = iptun->iptun_itp;
6124 6123 if (itp != NULL) {
6125 6124 /* Braces due to the macro's nature... */
6126 6125 ITP_REFHOLD(itp);
6127 6126 }
6128 6127 } /* Else itp is already NULL. */
6129 6128 }
6130 6129
6131 6130 CONN_DEC_REF(connp);
6132 6131 return (itp);
6133 6132 }
6134 6133
6135 6134 /*
6136 6135 * Frag cache code, based on SunScreen 3.2 source
6137 6136 * screen/kernel/common/screen_fragcache.c
6138 6137 */
6139 6138
6140 6139 #define IPSEC_FRAG_TTL_MAX 5
6141 6140 /*
6142 6141 * Note that the following parameters create 256 hash buckets
6143 6142 * with 1024 free entries to be distributed. Things are cleaned
6144 6143 * periodically and are attempted to be cleaned when there is no
6145 6144 * free space, but this system errs on the side of dropping packets
6146 6145 * over creating memory exhaustion. We may decide to make hash
6147 6146 * factor a tunable if this proves to be a bad decision.
6148 6147 */
6149 6148 #define IPSEC_FRAG_HASH_SLOTS (1<<8)
6150 6149 #define IPSEC_FRAG_HASH_FACTOR 4
6151 6150 #define IPSEC_FRAG_HASH_SIZE (IPSEC_FRAG_HASH_SLOTS * IPSEC_FRAG_HASH_FACTOR)
6152 6151
6153 6152 #define IPSEC_FRAG_HASH_MASK (IPSEC_FRAG_HASH_SLOTS - 1)
6154 6153 #define IPSEC_FRAG_HASH_FUNC(id) (((id) & IPSEC_FRAG_HASH_MASK) ^ \
6155 6154 (((id) / \
6156 6155 (ushort_t)IPSEC_FRAG_HASH_SLOTS) & \
6157 6156 IPSEC_FRAG_HASH_MASK))
6158 6157
6159 6158 /* Maximum fragments per packet. 48 bytes payload x 1366 packets > 64KB */
6160 6159 #define IPSEC_MAX_FRAGS 1366
6161 6160
6162 6161 #define V4_FRAG_OFFSET(ipha) ((ntohs(ipha->ipha_fragment_offset_and_flags) & \
6163 6162 IPH_OFFSET) << 3)
6164 6163 #define V4_MORE_FRAGS(ipha) (ntohs(ipha->ipha_fragment_offset_and_flags) & \
6165 6164 IPH_MF)
6166 6165
6167 6166 /*
6168 6167 * Initialize an ipsec fragcache instance.
6169 6168 * Returns B_FALSE if memory allocation fails.
6170 6169 */
6171 6170 boolean_t
6172 6171 ipsec_fragcache_init(ipsec_fragcache_t *frag)
6173 6172 {
6174 6173 ipsec_fragcache_entry_t *ftemp;
6175 6174 int i;
6176 6175
6177 6176 mutex_init(&frag->itpf_lock, NULL, MUTEX_DEFAULT, NULL);
6178 6177 frag->itpf_ptr = (ipsec_fragcache_entry_t **)
6179 6178 kmem_zalloc(sizeof (ipsec_fragcache_entry_t *) *
6180 6179 IPSEC_FRAG_HASH_SLOTS, KM_NOSLEEP);
6181 6180 if (frag->itpf_ptr == NULL)
6182 6181 return (B_FALSE);
6183 6182
6184 6183 ftemp = (ipsec_fragcache_entry_t *)
6185 6184 kmem_zalloc(sizeof (ipsec_fragcache_entry_t) *
6186 6185 IPSEC_FRAG_HASH_SIZE, KM_NOSLEEP);
6187 6186 if (ftemp == NULL) {
6188 6187 kmem_free(frag->itpf_ptr, sizeof (ipsec_fragcache_entry_t *) *
6189 6188 IPSEC_FRAG_HASH_SLOTS);
6190 6189 return (B_FALSE);
6191 6190 }
6192 6191
6193 6192 frag->itpf_freelist = NULL;
6194 6193
6195 6194 for (i = 0; i < IPSEC_FRAG_HASH_SIZE; i++) {
6196 6195 ftemp->itpfe_next = frag->itpf_freelist;
6197 6196 frag->itpf_freelist = ftemp;
6198 6197 ftemp++;
6199 6198 }
6200 6199
6201 6200 frag->itpf_expire_hint = 0;
6202 6201
6203 6202 return (B_TRUE);
6204 6203 }
6205 6204
6206 6205 void
6207 6206 ipsec_fragcache_uninit(ipsec_fragcache_t *frag, ipsec_stack_t *ipss)
6208 6207 {
6209 6208 ipsec_fragcache_entry_t *fep;
6210 6209 int i;
6211 6210
6212 6211 mutex_enter(&frag->itpf_lock);
6213 6212 if (frag->itpf_ptr) {
6214 6213 /* Delete any existing fragcache entry chains */
6215 6214 for (i = 0; i < IPSEC_FRAG_HASH_SLOTS; i++) {
6216 6215 fep = (frag->itpf_ptr)[i];
6217 6216 while (fep != NULL) {
6218 6217 /* Returned fep is next in chain or NULL */
6219 6218 fep = fragcache_delentry(i, fep, frag, ipss);
6220 6219 }
6221 6220 }
6222 6221 /*
6223 6222 * Chase the pointers back to the beginning
6224 6223 * of the memory allocation and then
6225 6224 * get rid of the allocated freelist
6226 6225 */
6227 6226 while (frag->itpf_freelist->itpfe_next != NULL)
6228 6227 frag->itpf_freelist = frag->itpf_freelist->itpfe_next;
6229 6228 /*
6230 6229 * XXX - If we ever dynamically grow the freelist
6231 6230 * then we'll have to free entries individually
6232 6231 * or determine how many entries or chunks we have
6233 6232 * grown since the initial allocation.
6234 6233 */
6235 6234 kmem_free(frag->itpf_freelist,
6236 6235 sizeof (ipsec_fragcache_entry_t) *
6237 6236 IPSEC_FRAG_HASH_SIZE);
6238 6237 /* Free the fragcache structure */
6239 6238 kmem_free(frag->itpf_ptr,
6240 6239 sizeof (ipsec_fragcache_entry_t *) *
6241 6240 IPSEC_FRAG_HASH_SLOTS);
6242 6241 }
6243 6242 mutex_exit(&frag->itpf_lock);
6244 6243 mutex_destroy(&frag->itpf_lock);
6245 6244 }
6246 6245
6247 6246 /*
6248 6247 * Add a fragment to the fragment cache. Consumes mp if NULL is returned.
6249 6248 * Returns mp if a whole fragment has been assembled, NULL otherwise
6250 6249 * The returned mp could be a b_next chain of fragments.
6251 6250 *
6252 6251 * The iramp argument is set on inbound; NULL if outbound.
6253 6252 */
6254 6253 mblk_t *
6255 6254 ipsec_fragcache_add(ipsec_fragcache_t *frag, mblk_t *iramp, mblk_t *mp,
6256 6255 int outer_hdr_len, ipsec_stack_t *ipss)
6257 6256 {
6258 6257 boolean_t is_v4;
6259 6258 time_t itpf_time;
6260 6259 ipha_t *iph;
6261 6260 ipha_t *oiph;
6262 6261 ip6_t *ip6h = NULL;
6263 6262 uint8_t v6_proto;
6264 6263 uint8_t *v6_proto_p;
6265 6264 uint16_t ip6_hdr_length;
6266 6265 ip_pkt_t ipp;
6267 6266 ip6_frag_t *fraghdr;
6268 6267 ipsec_fragcache_entry_t *fep;
6269 6268 int i;
6270 6269 mblk_t *nmp, *prevmp;
6271 6270 int firstbyte, lastbyte;
6272 6271 int offset;
6273 6272 int last;
6274 6273 boolean_t inbound = (iramp != NULL);
6275 6274
6276 6275 #ifdef FRAGCACHE_DEBUG
6277 6276 cmn_err(CE_WARN, "Fragcache: %s\n", inbound ? "INBOUND" : "OUTBOUND");
6278 6277 #endif
6279 6278 /*
6280 6279 * You're on the slow path, so insure that every packet in the
6281 6280 * cache is a single-mblk one.
6282 6281 */
6283 6282 if (mp->b_cont != NULL) {
6284 6283 nmp = msgpullup(mp, -1);
6285 6284 if (nmp == NULL) {
6286 6285 ip_drop_packet(mp, inbound, NULL,
6287 6286 DROPPER(ipss, ipds_spd_nomem),
6288 6287 &ipss->ipsec_spd_dropper);
6289 6288 if (inbound)
6290 6289 (void) ip_recv_attr_free_mblk(iramp);
6291 6290 return (NULL);
6292 6291 }
6293 6292 freemsg(mp);
6294 6293 mp = nmp;
6295 6294 }
6296 6295
6297 6296 mutex_enter(&frag->itpf_lock);
6298 6297
6299 6298 oiph = (ipha_t *)mp->b_rptr;
6300 6299 iph = (ipha_t *)(mp->b_rptr + outer_hdr_len);
6301 6300
6302 6301 if (IPH_HDR_VERSION(iph) == IPV4_VERSION) {
6303 6302 is_v4 = B_TRUE;
6304 6303 } else {
6305 6304 ASSERT(IPH_HDR_VERSION(iph) == IPV6_VERSION);
6306 6305 ip6h = (ip6_t *)(mp->b_rptr + outer_hdr_len);
6307 6306
6308 6307 if (!ip_hdr_length_nexthdr_v6(mp, ip6h, &ip6_hdr_length,
6309 6308 &v6_proto_p)) {
6310 6309 /*
6311 6310 * Find upper layer protocol.
6312 6311 * If it fails we have a malformed packet
6313 6312 */
6314 6313 mutex_exit(&frag->itpf_lock);
6315 6314 ip_drop_packet(mp, inbound, NULL,
6316 6315 DROPPER(ipss, ipds_spd_malformed_packet),
6317 6316 &ipss->ipsec_spd_dropper);
6318 6317 if (inbound)
6319 6318 (void) ip_recv_attr_free_mblk(iramp);
6320 6319 return (NULL);
6321 6320 } else {
6322 6321 v6_proto = *v6_proto_p;
6323 6322 }
6324 6323
6325 6324
6326 6325 bzero(&ipp, sizeof (ipp));
6327 6326 (void) ip_find_hdr_v6(mp, ip6h, B_FALSE, &ipp, NULL);
6328 6327 if (!(ipp.ipp_fields & IPPF_FRAGHDR)) {
6329 6328 /*
6330 6329 * We think this is a fragment, but didn't find
6331 6330 * a fragment header. Something is wrong.
6332 6331 */
6333 6332 mutex_exit(&frag->itpf_lock);
6334 6333 ip_drop_packet(mp, inbound, NULL,
6335 6334 DROPPER(ipss, ipds_spd_malformed_frag),
6336 6335 &ipss->ipsec_spd_dropper);
6337 6336 if (inbound)
6338 6337 (void) ip_recv_attr_free_mblk(iramp);
6339 6338 return (NULL);
6340 6339 }
6341 6340 fraghdr = ipp.ipp_fraghdr;
6342 6341 is_v4 = B_FALSE;
6343 6342 }
6344 6343
6345 6344 /* Anything to cleanup? */
6346 6345
6347 6346 /*
6348 6347 * This cleanup call could be put in a timer loop
6349 6348 * but it may actually be just as reasonable a decision to
6350 6349 * leave it here. The disadvantage is this only gets called when
6351 6350 * frags are added. The advantage is that it is not
6352 6351 * susceptible to race conditions like a time-based cleanup
6353 6352 * may be.
6354 6353 */
6355 6354 itpf_time = gethrestime_sec();
6356 6355 if (itpf_time >= frag->itpf_expire_hint)
6357 6356 ipsec_fragcache_clean(frag, ipss);
6358 6357
6359 6358 /* Lookup to see if there is an existing entry */
6360 6359
6361 6360 if (is_v4)
6362 6361 i = IPSEC_FRAG_HASH_FUNC(iph->ipha_ident);
6363 6362 else
6364 6363 i = IPSEC_FRAG_HASH_FUNC(fraghdr->ip6f_ident);
6365 6364
6366 6365 for (fep = (frag->itpf_ptr)[i]; fep; fep = fep->itpfe_next) {
6367 6366 if (is_v4) {
6368 6367 ASSERT(iph != NULL);
6369 6368 if ((fep->itpfe_id == iph->ipha_ident) &&
6370 6369 (fep->itpfe_src == iph->ipha_src) &&
6371 6370 (fep->itpfe_dst == iph->ipha_dst) &&
6372 6371 (fep->itpfe_proto == iph->ipha_protocol))
6373 6372 break;
6374 6373 } else {
6375 6374 ASSERT(fraghdr != NULL);
6376 6375 ASSERT(fep != NULL);
6377 6376 if ((fep->itpfe_id == fraghdr->ip6f_ident) &&
6378 6377 IN6_ARE_ADDR_EQUAL(&fep->itpfe_src6,
6379 6378 &ip6h->ip6_src) &&
6380 6379 IN6_ARE_ADDR_EQUAL(&fep->itpfe_dst6,
6381 6380 &ip6h->ip6_dst) && (fep->itpfe_proto == v6_proto))
6382 6381 break;
6383 6382 }
6384 6383 }
6385 6384
6386 6385 if (is_v4) {
6387 6386 firstbyte = V4_FRAG_OFFSET(iph);
6388 6387 lastbyte = firstbyte + ntohs(iph->ipha_length) -
6389 6388 IPH_HDR_LENGTH(iph);
6390 6389 last = (V4_MORE_FRAGS(iph) == 0);
6391 6390 #ifdef FRAGCACHE_DEBUG
6392 6391 cmn_err(CE_WARN, "V4 fragcache: firstbyte = %d, lastbyte = %d, "
6393 6392 "is_last_frag = %d, id = %d, mp = %p\n", firstbyte,
6394 6393 lastbyte, last, iph->ipha_ident, mp);
6395 6394 #endif
6396 6395 } else {
6397 6396 firstbyte = ntohs(fraghdr->ip6f_offlg & IP6F_OFF_MASK);
6398 6397 lastbyte = firstbyte + ntohs(ip6h->ip6_plen) +
6399 6398 sizeof (ip6_t) - ip6_hdr_length;
6400 6399 last = (fraghdr->ip6f_offlg & IP6F_MORE_FRAG) == 0;
6401 6400 #ifdef FRAGCACHE_DEBUG
6402 6401 cmn_err(CE_WARN, "V6 fragcache: firstbyte = %d, lastbyte = %d, "
6403 6402 "is_last_frag = %d, id = %d, fraghdr = %p, mp = %p\n",
6404 6403 firstbyte, lastbyte, last, fraghdr->ip6f_ident, fraghdr,
6405 6404 mp);
6406 6405 #endif
6407 6406 }
6408 6407
6409 6408 /* check for bogus fragments and delete the entry */
6410 6409 if (firstbyte > 0 && firstbyte <= 8) {
6411 6410 if (fep != NULL)
6412 6411 (void) fragcache_delentry(i, fep, frag, ipss);
6413 6412 mutex_exit(&frag->itpf_lock);
6414 6413 ip_drop_packet(mp, inbound, NULL,
6415 6414 DROPPER(ipss, ipds_spd_malformed_frag),
6416 6415 &ipss->ipsec_spd_dropper);
6417 6416 if (inbound)
6418 6417 (void) ip_recv_attr_free_mblk(iramp);
6419 6418 return (NULL);
6420 6419 }
6421 6420
6422 6421 /* Not found, allocate a new entry */
6423 6422 if (fep == NULL) {
6424 6423 if (frag->itpf_freelist == NULL) {
6425 6424 /* see if there is some space */
6426 6425 ipsec_fragcache_clean(frag, ipss);
6427 6426 if (frag->itpf_freelist == NULL) {
6428 6427 mutex_exit(&frag->itpf_lock);
6429 6428 ip_drop_packet(mp, inbound, NULL,
6430 6429 DROPPER(ipss, ipds_spd_nomem),
6431 6430 &ipss->ipsec_spd_dropper);
6432 6431 if (inbound)
6433 6432 (void) ip_recv_attr_free_mblk(iramp);
6434 6433 return (NULL);
6435 6434 }
6436 6435 }
6437 6436
6438 6437 fep = frag->itpf_freelist;
6439 6438 frag->itpf_freelist = fep->itpfe_next;
6440 6439
6441 6440 if (is_v4) {
6442 6441 bcopy((caddr_t)&iph->ipha_src, (caddr_t)&fep->itpfe_src,
6443 6442 sizeof (struct in_addr));
6444 6443 bcopy((caddr_t)&iph->ipha_dst, (caddr_t)&fep->itpfe_dst,
6445 6444 sizeof (struct in_addr));
6446 6445 fep->itpfe_id = iph->ipha_ident;
6447 6446 fep->itpfe_proto = iph->ipha_protocol;
6448 6447 i = IPSEC_FRAG_HASH_FUNC(fep->itpfe_id);
6449 6448 } else {
6450 6449 bcopy((in6_addr_t *)&ip6h->ip6_src,
6451 6450 (in6_addr_t *)&fep->itpfe_src6,
6452 6451 sizeof (struct in6_addr));
6453 6452 bcopy((in6_addr_t *)&ip6h->ip6_dst,
6454 6453 (in6_addr_t *)&fep->itpfe_dst6,
6455 6454 sizeof (struct in6_addr));
6456 6455 fep->itpfe_id = fraghdr->ip6f_ident;
6457 6456 fep->itpfe_proto = v6_proto;
6458 6457 i = IPSEC_FRAG_HASH_FUNC(fep->itpfe_id);
6459 6458 }
6460 6459 itpf_time = gethrestime_sec();
6461 6460 fep->itpfe_exp = itpf_time + IPSEC_FRAG_TTL_MAX + 1;
6462 6461 fep->itpfe_last = 0;
6463 6462 fep->itpfe_fraglist = NULL;
6464 6463 fep->itpfe_depth = 0;
6465 6464 fep->itpfe_next = (frag->itpf_ptr)[i];
6466 6465 (frag->itpf_ptr)[i] = fep;
6467 6466
6468 6467 if (frag->itpf_expire_hint > fep->itpfe_exp)
6469 6468 frag->itpf_expire_hint = fep->itpfe_exp;
6470 6469
6471 6470 }
6472 6471
6473 6472 /* Insert it in the frag list */
6474 6473 /* List is in order by starting offset of fragments */
6475 6474
6476 6475 prevmp = NULL;
6477 6476 for (nmp = fep->itpfe_fraglist; nmp; nmp = nmp->b_next) {
6478 6477 ipha_t *niph;
6479 6478 ipha_t *oniph;
6480 6479 ip6_t *nip6h;
6481 6480 ip_pkt_t nipp;
6482 6481 ip6_frag_t *nfraghdr;
6483 6482 uint16_t nip6_hdr_length;
6484 6483 uint8_t *nv6_proto_p;
6485 6484 int nfirstbyte, nlastbyte;
6486 6485 char *data, *ndata;
6487 6486 mblk_t *ndata_mp = (inbound ? nmp->b_cont : nmp);
6488 6487 int hdr_len;
6489 6488
6490 6489 oniph = (ipha_t *)mp->b_rptr;
6491 6490 nip6h = NULL;
6492 6491 niph = NULL;
6493 6492
6494 6493 /*
6495 6494 * Determine outer header type and length and set
6496 6495 * pointers appropriately
6497 6496 */
6498 6497
6499 6498 if (IPH_HDR_VERSION(oniph) == IPV4_VERSION) {
6500 6499 hdr_len = ((outer_hdr_len != 0) ?
6501 6500 IPH_HDR_LENGTH(oiph) : 0);
6502 6501 niph = (ipha_t *)(ndata_mp->b_rptr + hdr_len);
6503 6502 } else {
6504 6503 ASSERT(IPH_HDR_VERSION(oniph) == IPV6_VERSION);
6505 6504 ASSERT(ndata_mp->b_cont == NULL);
6506 6505 nip6h = (ip6_t *)ndata_mp->b_rptr;
6507 6506 (void) ip_hdr_length_nexthdr_v6(ndata_mp, nip6h,
6508 6507 &nip6_hdr_length, &v6_proto_p);
6509 6508 hdr_len = ((outer_hdr_len != 0) ? nip6_hdr_length : 0);
6510 6509 }
6511 6510
6512 6511 /*
6513 6512 * Determine inner header type and length and set
6514 6513 * pointers appropriately
6515 6514 */
6516 6515
6517 6516 if (is_v4) {
6518 6517 if (niph == NULL) {
6519 6518 /* Was v6 outer */
6520 6519 niph = (ipha_t *)(ndata_mp->b_rptr + hdr_len);
6521 6520 }
6522 6521 nfirstbyte = V4_FRAG_OFFSET(niph);
6523 6522 nlastbyte = nfirstbyte + ntohs(niph->ipha_length) -
6524 6523 IPH_HDR_LENGTH(niph);
6525 6524 } else {
6526 6525 ASSERT(ndata_mp->b_cont == NULL);
6527 6526 nip6h = (ip6_t *)(ndata_mp->b_rptr + hdr_len);
6528 6527 if (!ip_hdr_length_nexthdr_v6(ndata_mp, nip6h,
6529 6528 &nip6_hdr_length, &nv6_proto_p)) {
6530 6529 mutex_exit(&frag->itpf_lock);
6531 6530 ip_drop_packet_chain(nmp, inbound, NULL,
6532 6531 DROPPER(ipss, ipds_spd_malformed_frag),
6533 6532 &ipss->ipsec_spd_dropper);
6534 6533 ipsec_freemsg_chain(ndata_mp);
6535 6534 if (inbound)
6536 6535 (void) ip_recv_attr_free_mblk(iramp);
6537 6536 return (NULL);
6538 6537 }
6539 6538 bzero(&nipp, sizeof (nipp));
6540 6539 (void) ip_find_hdr_v6(ndata_mp, nip6h, B_FALSE, &nipp,
6541 6540 NULL);
6542 6541 nfraghdr = nipp.ipp_fraghdr;
6543 6542 nfirstbyte = ntohs(nfraghdr->ip6f_offlg &
6544 6543 IP6F_OFF_MASK);
6545 6544 nlastbyte = nfirstbyte + ntohs(nip6h->ip6_plen) +
6546 6545 sizeof (ip6_t) - nip6_hdr_length;
6547 6546 }
6548 6547
6549 6548 /* Check for overlapping fragments */
6550 6549 if (firstbyte >= nfirstbyte && firstbyte < nlastbyte) {
6551 6550 /*
6552 6551 * Overlap Check:
6553 6552 * ~~~~--------- # Check if the newly
6554 6553 * ~ ndata_mp| # received fragment
6555 6554 * ~~~~--------- # overlaps with the
6556 6555 * ---------~~~~~~ # current fragment.
6557 6556 * | mp ~
6558 6557 * ---------~~~~~~
6559 6558 */
6560 6559 if (is_v4) {
6561 6560 data = (char *)iph + IPH_HDR_LENGTH(iph) +
6562 6561 firstbyte - nfirstbyte;
6563 6562 ndata = (char *)niph + IPH_HDR_LENGTH(niph);
6564 6563 } else {
6565 6564 data = (char *)ip6h +
6566 6565 nip6_hdr_length + firstbyte -
6567 6566 nfirstbyte;
6568 6567 ndata = (char *)nip6h + nip6_hdr_length;
6569 6568 }
6570 6569 if (bcmp(data, ndata, MIN(lastbyte, nlastbyte) -
6571 6570 firstbyte)) {
6572 6571 /* Overlapping data does not match */
6573 6572 (void) fragcache_delentry(i, fep, frag, ipss);
6574 6573 mutex_exit(&frag->itpf_lock);
6575 6574 ip_drop_packet(mp, inbound, NULL,
6576 6575 DROPPER(ipss, ipds_spd_overlap_frag),
6577 6576 &ipss->ipsec_spd_dropper);
6578 6577 if (inbound)
6579 6578 (void) ip_recv_attr_free_mblk(iramp);
6580 6579 return (NULL);
6581 6580 }
6582 6581 /* Part of defense for jolt2.c fragmentation attack */
6583 6582 if (firstbyte >= nfirstbyte && lastbyte <= nlastbyte) {
6584 6583 /*
6585 6584 * Check for identical or subset fragments:
6586 6585 * ---------- ~~~~--------~~~~~
6587 6586 * | nmp | or ~ nmp ~
6588 6587 * ---------- ~~~~--------~~~~~
6589 6588 * ---------- ------
6590 6589 * | mp | | mp |
6591 6590 * ---------- ------
6592 6591 */
6593 6592 mutex_exit(&frag->itpf_lock);
6594 6593 ip_drop_packet(mp, inbound, NULL,
6595 6594 DROPPER(ipss, ipds_spd_evil_frag),
6596 6595 &ipss->ipsec_spd_dropper);
6597 6596 if (inbound)
6598 6597 (void) ip_recv_attr_free_mblk(iramp);
6599 6598 return (NULL);
6600 6599 }
6601 6600
6602 6601 }
6603 6602
6604 6603 /* Correct location for this fragment? */
6605 6604 if (firstbyte <= nfirstbyte) {
6606 6605 /*
6607 6606 * Check if the tail end of the new fragment overlaps
6608 6607 * with the head of the current fragment.
6609 6608 * --------~~~~~~~
6610 6609 * | nmp ~
6611 6610 * --------~~~~~~~
6612 6611 * ~~~~~--------
6613 6612 * ~ mp |
6614 6613 * ~~~~~--------
6615 6614 */
6616 6615 if (lastbyte > nfirstbyte) {
6617 6616 /* Fragments overlap */
6618 6617 data = (char *)iph + IPH_HDR_LENGTH(iph) +
6619 6618 firstbyte - nfirstbyte;
6620 6619 ndata = (char *)niph + IPH_HDR_LENGTH(niph);
6621 6620 if (is_v4) {
6622 6621 data = (char *)iph +
6623 6622 IPH_HDR_LENGTH(iph) + firstbyte -
6624 6623 nfirstbyte;
6625 6624 ndata = (char *)niph +
6626 6625 IPH_HDR_LENGTH(niph);
6627 6626 } else {
6628 6627 data = (char *)ip6h +
6629 6628 nip6_hdr_length + firstbyte -
6630 6629 nfirstbyte;
6631 6630 ndata = (char *)nip6h + nip6_hdr_length;
6632 6631 }
6633 6632 if (bcmp(data, ndata, MIN(lastbyte, nlastbyte)
6634 6633 - nfirstbyte)) {
6635 6634 /* Overlap mismatch */
6636 6635 (void) fragcache_delentry(i, fep, frag,
6637 6636 ipss);
6638 6637 mutex_exit(&frag->itpf_lock);
6639 6638 ip_drop_packet(mp, inbound, NULL,
6640 6639 DROPPER(ipss,
6641 6640 ipds_spd_overlap_frag),
6642 6641 &ipss->ipsec_spd_dropper);
6643 6642 if (inbound) {
6644 6643 (void) ip_recv_attr_free_mblk(
6645 6644 iramp);
6646 6645 }
6647 6646 return (NULL);
6648 6647 }
6649 6648 }
6650 6649
6651 6650 /*
6652 6651 * Fragment does not illegally overlap and can now
6653 6652 * be inserted into the chain
6654 6653 */
6655 6654 break;
6656 6655 }
6657 6656
6658 6657 prevmp = nmp;
6659 6658 }
6660 6659 /* Prepend the attributes before we link it in */
6661 6660 if (iramp != NULL) {
6662 6661 ASSERT(iramp->b_cont == NULL);
6663 6662 iramp->b_cont = mp;
6664 6663 mp = iramp;
6665 6664 iramp = NULL;
6666 6665 }
6667 6666 mp->b_next = nmp;
6668 6667
6669 6668 if (prevmp == NULL) {
6670 6669 fep->itpfe_fraglist = mp;
6671 6670 } else {
6672 6671 prevmp->b_next = mp;
6673 6672 }
6674 6673 if (last)
6675 6674 fep->itpfe_last = 1;
6676 6675
6677 6676 /* Part of defense for jolt2.c fragmentation attack */
6678 6677 if (++(fep->itpfe_depth) > IPSEC_MAX_FRAGS) {
6679 6678 (void) fragcache_delentry(i, fep, frag, ipss);
6680 6679 mutex_exit(&frag->itpf_lock);
6681 6680 if (inbound)
6682 6681 mp = ip_recv_attr_free_mblk(mp);
6683 6682
6684 6683 ip_drop_packet(mp, inbound, NULL,
6685 6684 DROPPER(ipss, ipds_spd_max_frags),
6686 6685 &ipss->ipsec_spd_dropper);
6687 6686 return (NULL);
6688 6687 }
6689 6688
6690 6689 /* Check for complete packet */
6691 6690
6692 6691 if (!fep->itpfe_last) {
6693 6692 mutex_exit(&frag->itpf_lock);
6694 6693 #ifdef FRAGCACHE_DEBUG
6695 6694 cmn_err(CE_WARN, "Fragment cached, last not yet seen.\n");
6696 6695 #endif
6697 6696 return (NULL);
6698 6697 }
6699 6698
6700 6699 offset = 0;
6701 6700 for (mp = fep->itpfe_fraglist; mp; mp = mp->b_next) {
6702 6701 mblk_t *data_mp = (inbound ? mp->b_cont : mp);
6703 6702 int hdr_len;
6704 6703
6705 6704 oiph = (ipha_t *)data_mp->b_rptr;
6706 6705 ip6h = NULL;
6707 6706 iph = NULL;
6708 6707
6709 6708 if (IPH_HDR_VERSION(oiph) == IPV4_VERSION) {
6710 6709 hdr_len = ((outer_hdr_len != 0) ?
6711 6710 IPH_HDR_LENGTH(oiph) : 0);
6712 6711 iph = (ipha_t *)(data_mp->b_rptr + hdr_len);
6713 6712 } else {
6714 6713 ASSERT(IPH_HDR_VERSION(oiph) == IPV6_VERSION);
6715 6714 ASSERT(data_mp->b_cont == NULL);
6716 6715 ip6h = (ip6_t *)data_mp->b_rptr;
6717 6716 (void) ip_hdr_length_nexthdr_v6(data_mp, ip6h,
6718 6717 &ip6_hdr_length, &v6_proto_p);
6719 6718 hdr_len = ((outer_hdr_len != 0) ? ip6_hdr_length : 0);
6720 6719 }
6721 6720
6722 6721 /* Calculate current fragment start/end */
6723 6722 if (is_v4) {
6724 6723 if (iph == NULL) {
6725 6724 /* Was v6 outer */
6726 6725 iph = (ipha_t *)(data_mp->b_rptr + hdr_len);
6727 6726 }
6728 6727 firstbyte = V4_FRAG_OFFSET(iph);
6729 6728 lastbyte = firstbyte + ntohs(iph->ipha_length) -
6730 6729 IPH_HDR_LENGTH(iph);
6731 6730 } else {
6732 6731 ASSERT(data_mp->b_cont == NULL);
6733 6732 ip6h = (ip6_t *)(data_mp->b_rptr + hdr_len);
6734 6733 if (!ip_hdr_length_nexthdr_v6(data_mp, ip6h,
6735 6734 &ip6_hdr_length, &v6_proto_p)) {
6736 6735 mutex_exit(&frag->itpf_lock);
6737 6736 ip_drop_packet_chain(mp, inbound, NULL,
6738 6737 DROPPER(ipss, ipds_spd_malformed_frag),
6739 6738 &ipss->ipsec_spd_dropper);
6740 6739 return (NULL);
6741 6740 }
6742 6741 v6_proto = *v6_proto_p;
6743 6742 bzero(&ipp, sizeof (ipp));
6744 6743 (void) ip_find_hdr_v6(data_mp, ip6h, B_FALSE, &ipp,
6745 6744 NULL);
6746 6745 fraghdr = ipp.ipp_fraghdr;
6747 6746 firstbyte = ntohs(fraghdr->ip6f_offlg &
6748 6747 IP6F_OFF_MASK);
6749 6748 lastbyte = firstbyte + ntohs(ip6h->ip6_plen) +
6750 6749 sizeof (ip6_t) - ip6_hdr_length;
6751 6750 }
6752 6751
6753 6752 /*
6754 6753 * If this fragment is greater than current offset,
6755 6754 * we have a missing fragment so return NULL
6756 6755 */
6757 6756 if (firstbyte > offset) {
6758 6757 mutex_exit(&frag->itpf_lock);
6759 6758 #ifdef FRAGCACHE_DEBUG
6760 6759 /*
6761 6760 * Note, this can happen when the last frag
6762 6761 * gets sent through because it is smaller
6763 6762 * than the MTU. It is not necessarily an
6764 6763 * error condition.
6765 6764 */
6766 6765 cmn_err(CE_WARN, "Frag greater than offset! : "
6767 6766 "missing fragment: firstbyte = %d, offset = %d, "
6768 6767 "mp = %p\n", firstbyte, offset, mp);
6769 6768 #endif
6770 6769 return (NULL);
6771 6770 }
6772 6771 #ifdef FRAGCACHE_DEBUG
6773 6772 cmn_err(CE_WARN, "Frag offsets : "
6774 6773 "firstbyte = %d, offset = %d, mp = %p\n",
6775 6774 firstbyte, offset, mp);
6776 6775 #endif
6777 6776
6778 6777 /*
6779 6778 * If we are at the last fragment, we have the complete
6780 6779 * packet, so rechain things and return it to caller
6781 6780 * for processing
6782 6781 */
6783 6782
6784 6783 if ((is_v4 && !V4_MORE_FRAGS(iph)) ||
6785 6784 (!is_v4 && !(fraghdr->ip6f_offlg & IP6F_MORE_FRAG))) {
6786 6785 mp = fep->itpfe_fraglist;
6787 6786 fep->itpfe_fraglist = NULL;
6788 6787 (void) fragcache_delentry(i, fep, frag, ipss);
6789 6788 mutex_exit(&frag->itpf_lock);
6790 6789
6791 6790 if ((is_v4 && (firstbyte + ntohs(iph->ipha_length) >
6792 6791 65535)) || (!is_v4 && (firstbyte +
6793 6792 ntohs(ip6h->ip6_plen) > 65535))) {
6794 6793 /* It is an invalid "ping-o-death" packet */
6795 6794 /* Discard it */
6796 6795 ip_drop_packet_chain(mp, inbound, NULL,
6797 6796 DROPPER(ipss, ipds_spd_evil_frag),
6798 6797 &ipss->ipsec_spd_dropper);
6799 6798 return (NULL);
6800 6799 }
6801 6800 #ifdef FRAGCACHE_DEBUG
6802 6801 cmn_err(CE_WARN, "Fragcache returning mp = %p, "
6803 6802 "mp->b_next = %p", mp, mp->b_next);
6804 6803 #endif
6805 6804 /*
6806 6805 * For inbound case, mp has attrmp b_next'd chain
6807 6806 * For outbound case, it is just data mp chain
6808 6807 */
6809 6808 return (mp);
6810 6809 }
6811 6810
6812 6811 /*
6813 6812 * Update new ending offset if this
6814 6813 * fragment extends the packet
6815 6814 */
6816 6815 if (offset < lastbyte)
6817 6816 offset = lastbyte;
6818 6817 }
6819 6818
6820 6819 mutex_exit(&frag->itpf_lock);
6821 6820
6822 6821 /* Didn't find last fragment, so return NULL */
6823 6822 return (NULL);
6824 6823 }
6825 6824
6826 6825 static void
6827 6826 ipsec_fragcache_clean(ipsec_fragcache_t *frag, ipsec_stack_t *ipss)
6828 6827 {
6829 6828 ipsec_fragcache_entry_t *fep;
6830 6829 int i;
6831 6830 ipsec_fragcache_entry_t *earlyfep = NULL;
6832 6831 time_t itpf_time;
6833 6832 int earlyexp;
6834 6833 int earlyi = 0;
6835 6834
6836 6835 ASSERT(MUTEX_HELD(&frag->itpf_lock));
6837 6836
6838 6837 itpf_time = gethrestime_sec();
6839 6838 earlyexp = itpf_time + 10000;
6840 6839
6841 6840 for (i = 0; i < IPSEC_FRAG_HASH_SLOTS; i++) {
6842 6841 fep = (frag->itpf_ptr)[i];
6843 6842 while (fep) {
6844 6843 if (fep->itpfe_exp < itpf_time) {
6845 6844 /* found */
6846 6845 fep = fragcache_delentry(i, fep, frag, ipss);
6847 6846 } else {
6848 6847 if (fep->itpfe_exp < earlyexp) {
6849 6848 earlyfep = fep;
6850 6849 earlyexp = fep->itpfe_exp;
6851 6850 earlyi = i;
6852 6851 }
6853 6852 fep = fep->itpfe_next;
6854 6853 }
6855 6854 }
6856 6855 }
6857 6856
6858 6857 frag->itpf_expire_hint = earlyexp;
6859 6858
6860 6859 /* if (!found) */
6861 6860 if (frag->itpf_freelist == NULL)
6862 6861 (void) fragcache_delentry(earlyi, earlyfep, frag, ipss);
6863 6862 }
6864 6863
6865 6864 static ipsec_fragcache_entry_t *
6866 6865 fragcache_delentry(int slot, ipsec_fragcache_entry_t *fep,
6867 6866 ipsec_fragcache_t *frag, ipsec_stack_t *ipss)
6868 6867 {
6869 6868 ipsec_fragcache_entry_t *targp;
6870 6869 ipsec_fragcache_entry_t *nextp = fep->itpfe_next;
6871 6870
6872 6871 ASSERT(MUTEX_HELD(&frag->itpf_lock));
6873 6872
6874 6873 /* Free up any fragment list still in cache entry */
6875 6874 if (fep->itpfe_fraglist != NULL) {
6876 6875 ip_drop_packet_chain(fep->itpfe_fraglist,
6877 6876 ip_recv_attr_is_mblk(fep->itpfe_fraglist), NULL,
6878 6877 DROPPER(ipss, ipds_spd_expired_frags),
6879 6878 &ipss->ipsec_spd_dropper);
6880 6879 }
6881 6880 fep->itpfe_fraglist = NULL;
6882 6881
6883 6882 targp = (frag->itpf_ptr)[slot];
6884 6883 ASSERT(targp != 0);
6885 6884
6886 6885 if (targp == fep) {
6887 6886 /* unlink from head of hash chain */
6888 6887 (frag->itpf_ptr)[slot] = nextp;
6889 6888 /* link into free list */
6890 6889 fep->itpfe_next = frag->itpf_freelist;
6891 6890 frag->itpf_freelist = fep;
6892 6891 return (nextp);
6893 6892 }
6894 6893
6895 6894 /* maybe should use double linked list to make update faster */
6896 6895 /* must be past front of chain */
6897 6896 while (targp) {
6898 6897 if (targp->itpfe_next == fep) {
6899 6898 /* unlink from hash chain */
6900 6899 targp->itpfe_next = nextp;
6901 6900 /* link into free list */
6902 6901 fep->itpfe_next = frag->itpf_freelist;
6903 6902 frag->itpf_freelist = fep;
6904 6903 return (nextp);
6905 6904 }
6906 6905 targp = targp->itpfe_next;
6907 6906 ASSERT(targp != 0);
6908 6907 }
6909 6908 /* NOTREACHED */
6910 6909 return (NULL);
6911 6910 }
|
↓ open down ↓ |
2375 lines elided |
↑ open up ↑ |
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX