Print this page
Bayard's initial drop, needs finishing, or at least testing.
| Split |
Close |
| Expand all |
| Collapse all |
--- old/usr/src/uts/common/inet/ip/ipsecah.c
+++ new/usr/src/uts/common/inet/ip/ipsecah.c
1 1 /*
2 2 * CDDL HEADER START
3 3 *
4 4 * The contents of this file are subject to the terms of the
5 5 * Common Development and Distribution License (the "License").
6 6 * You may not use this file except in compliance with the License.
7 7 *
8 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 9 * or http://www.opensolaris.org/os/licensing.
10 10 * See the License for the specific language governing permissions
11 11 * and limitations under the License.
12 12 *
13 13 * When distributing Covered Code, include this CDDL HEADER in each
|
↓ open down ↓ |
13 lines elided |
↑ open up ↑ |
14 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 15 * If applicable, add the following below this CDDL HEADER, with the
16 16 * fields enclosed by brackets "[]" replaced with your own identifying
17 17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 18 *
19 19 * CDDL HEADER END
20 20 */
21 21 /*
22 22 * Copyright 2010 Sun Microsystems, Inc. All rights reserved.
23 23 * Use is subject to license terms.
24 + * Copyright (c) 2012 Nexenta Systems, Inc. All rights reserved.
24 25 */
25 26
26 27 #include <sys/types.h>
27 28 #include <sys/stream.h>
28 29 #include <sys/stropts.h>
29 30 #include <sys/errno.h>
30 31 #include <sys/strlog.h>
31 32 #include <sys/tihdr.h>
32 33 #include <sys/socket.h>
33 34 #include <sys/ddi.h>
34 35 #include <sys/sunddi.h>
35 36 #include <sys/mkdev.h>
36 37 #include <sys/kmem.h>
37 38 #include <sys/zone.h>
38 39 #include <sys/sysmacros.h>
39 40 #include <sys/cmn_err.h>
40 41 #include <sys/vtrace.h>
41 42 #include <sys/debug.h>
42 43 #include <sys/atomic.h>
43 44 #include <sys/strsun.h>
44 45 #include <sys/random.h>
45 46 #include <netinet/in.h>
46 47 #include <net/if.h>
47 48 #include <netinet/ip6.h>
48 49 #include <netinet/icmp6.h>
49 50 #include <net/pfkeyv2.h>
50 51 #include <net/pfpolicy.h>
51 52
52 53 #include <inet/common.h>
53 54 #include <inet/mi.h>
54 55 #include <inet/ip.h>
55 56 #include <inet/ip6.h>
56 57 #include <inet/nd.h>
57 58 #include <inet/ip_if.h>
58 59 #include <inet/ip_ndp.h>
59 60 #include <inet/ipsec_info.h>
60 61 #include <inet/ipsec_impl.h>
61 62 #include <inet/sadb.h>
62 63 #include <inet/ipsecah.h>
63 64 #include <inet/ipsec_impl.h>
64 65 #include <inet/ipdrop.h>
65 66 #include <sys/taskq.h>
66 67 #include <sys/policy.h>
67 68 #include <sys/strsun.h>
68 69
69 70 #include <sys/crypto/common.h>
70 71 #include <sys/crypto/api.h>
71 72 #include <sys/kstat.h>
72 73 #include <sys/strsubr.h>
73 74
74 75 #include <sys/tsol/tnet.h>
75 76
76 77 /*
77 78 * Table of ND variables supported by ipsecah. These are loaded into
78 79 * ipsecah_g_nd in ipsecah_init_nd.
79 80 * All of these are alterable, within the min/max values given, at run time.
80 81 */
81 82 static ipsecahparam_t lcl_param_arr[] = {
82 83 /* min max value name */
83 84 { 0, 3, 0, "ipsecah_debug"},
84 85 { 125, 32000, SADB_AGE_INTERVAL_DEFAULT, "ipsecah_age_interval"},
85 86 { 1, 10, 1, "ipsecah_reap_delay"},
86 87 { 1, SADB_MAX_REPLAY, 64, "ipsecah_replay_size"},
87 88 { 1, 300, 15, "ipsecah_acquire_timeout"},
|
↓ open down ↓ |
54 lines elided |
↑ open up ↑ |
88 89 { 1, 1800, 90, "ipsecah_larval_timeout"},
89 90 /* Default lifetime values for ACQUIRE messages. */
90 91 { 0, 0xffffffffU, 0, "ipsecah_default_soft_bytes"},
91 92 { 0, 0xffffffffU, 0, "ipsecah_default_hard_bytes"},
92 93 { 0, 0xffffffffU, 24000, "ipsecah_default_soft_addtime"},
93 94 { 0, 0xffffffffU, 28800, "ipsecah_default_hard_addtime"},
94 95 { 0, 0xffffffffU, 0, "ipsecah_default_soft_usetime"},
95 96 { 0, 0xffffffffU, 0, "ipsecah_default_hard_usetime"},
96 97 { 0, 1, 0, "ipsecah_log_unknown_spi"},
97 98 };
98 -#define ipsecah_debug ipsecah_params[0].ipsecah_param_value
99 -#define ipsecah_age_interval ipsecah_params[1].ipsecah_param_value
100 -#define ipsecah_age_int_max ipsecah_params[1].ipsecah_param_max
101 -#define ipsecah_reap_delay ipsecah_params[2].ipsecah_param_value
102 -#define ipsecah_replay_size ipsecah_params[3].ipsecah_param_value
103 -#define ipsecah_acquire_timeout ipsecah_params[4].ipsecah_param_value
104 -#define ipsecah_larval_timeout ipsecah_params[5].ipsecah_param_value
105 -#define ipsecah_default_soft_bytes ipsecah_params[6].ipsecah_param_value
106 -#define ipsecah_default_hard_bytes ipsecah_params[7].ipsecah_param_value
107 -#define ipsecah_default_soft_addtime ipsecah_params[8].ipsecah_param_value
108 -#define ipsecah_default_hard_addtime ipsecah_params[9].ipsecah_param_value
109 -#define ipsecah_default_soft_usetime ipsecah_params[10].ipsecah_param_value
110 -#define ipsecah_default_hard_usetime ipsecah_params[11].ipsecah_param_value
111 -#define ipsecah_log_unknown_spi ipsecah_params[12].ipsecah_param_value
112 99
113 100 #define ah0dbg(a) printf a
114 101 /* NOTE: != 0 instead of > 0 so lint doesn't complain. */
115 102 #define ah1dbg(ahstack, a) if (ahstack->ipsecah_debug != 0) printf a
116 103 #define ah2dbg(ahstack, a) if (ahstack->ipsecah_debug > 1) printf a
117 104 #define ah3dbg(ahstack, a) if (ahstack->ipsecah_debug > 2) printf a
118 105
119 106 /*
120 107 * XXX This is broken. Padding should be determined dynamically
121 108 * depending on the ICV size and IP version number so that the
122 109 * total AH header size is a multiple of 32 bits or 64 bits
123 110 * for V4 and V6 respectively. For 96bit ICVs we have no problems.
124 111 * Anything different from that, we need to fix our code.
125 112 */
126 113 #define IPV4_PADDING_ALIGN 0x04 /* Multiple of 32 bits */
127 114 #define IPV6_PADDING_ALIGN 0x04 /* Multiple of 32 bits */
128 115
129 116 /*
130 117 * Helper macro. Avoids a call to msgdsize if there is only one
131 118 * mblk in the chain.
132 119 */
133 120 #define AH_MSGSIZE(mp) ((mp)->b_cont != NULL ? msgdsize(mp) : MBLKL(mp))
134 121
135 122
136 123 static mblk_t *ah_auth_out_done(mblk_t *, ip_xmit_attr_t *, ipsec_crypto_t *);
137 124 static mblk_t *ah_auth_in_done(mblk_t *, ip_recv_attr_t *, ipsec_crypto_t *);
138 125 static mblk_t *ah_process_ip_options_v4(mblk_t *, ipsa_t *, int *, uint_t,
139 126 boolean_t, ipsecah_stack_t *);
140 127 static mblk_t *ah_process_ip_options_v6(mblk_t *, ipsa_t *, int *, uint_t,
|
↓ open down ↓ |
19 lines elided |
↑ open up ↑ |
141 128 boolean_t, ipsecah_stack_t *);
142 129 static void ah_getspi(mblk_t *, keysock_in_t *, ipsecah_stack_t *);
143 130 static void ah_inbound_restart(mblk_t *, ip_recv_attr_t *);
144 131
145 132 static mblk_t *ah_outbound(mblk_t *, ip_xmit_attr_t *);
146 133 static void ah_outbound_finish(mblk_t *, ip_xmit_attr_t *);
147 134
148 135 static int ipsecah_open(queue_t *, dev_t *, int, int, cred_t *);
149 136 static int ipsecah_close(queue_t *);
150 137 static void ipsecah_wput(queue_t *, mblk_t *);
151 -static void ah_send_acquire(ipsacq_t *, mblk_t *, netstack_t *);
152 138 static boolean_t ah_register_out(uint32_t, uint32_t, uint_t, ipsecah_stack_t *,
153 139 cred_t *);
154 140 static void *ipsecah_stack_init(netstackid_t stackid, netstack_t *ns);
155 141 static void ipsecah_stack_fini(netstackid_t stackid, void *arg);
156 142
157 143 /* Setable in /etc/system */
158 144 uint32_t ah_hash_size = IPSEC_DEFAULT_HASH_SIZE;
159 145
160 146 static taskq_t *ah_taskq;
161 147
162 148 static struct module_info info = {
163 149 5136, "ipsecah", 0, INFPSZ, 65536, 1024
164 150 };
165 151
166 152 static struct qinit rinit = {
167 153 (pfi_t)putnext, NULL, ipsecah_open, ipsecah_close, NULL, &info,
168 154 NULL
169 155 };
170 156
171 157 static struct qinit winit = {
172 158 (pfi_t)ipsecah_wput, NULL, ipsecah_open, ipsecah_close, NULL, &info,
173 159 NULL
174 160 };
175 161
176 162 struct streamtab ipsecahinfo = {
177 163 &rinit, &winit, NULL, NULL
178 164 };
179 165
180 166 static int ah_kstat_update(kstat_t *, int);
181 167
182 168 uint64_t ipsacq_maxpackets = IPSACQ_MAXPACKETS;
183 169
184 170 static boolean_t
185 171 ah_kstat_init(ipsecah_stack_t *ahstack, netstackid_t stackid)
186 172 {
187 173 ipsec_stack_t *ipss = ahstack->ipsecah_netstack->netstack_ipsec;
188 174
189 175 ahstack->ah_ksp = kstat_create_netstack("ipsecah", 0, "ah_stat", "net",
190 176 KSTAT_TYPE_NAMED, sizeof (ah_kstats_t) / sizeof (kstat_named_t),
191 177 KSTAT_FLAG_PERSISTENT, stackid);
192 178
193 179 if (ahstack->ah_ksp == NULL || ahstack->ah_ksp->ks_data == NULL)
194 180 return (B_FALSE);
195 181
196 182 ahstack->ah_kstats = ahstack->ah_ksp->ks_data;
197 183
198 184 ahstack->ah_ksp->ks_update = ah_kstat_update;
199 185 ahstack->ah_ksp->ks_private = (void *)(uintptr_t)stackid;
200 186
201 187 #define K64 KSTAT_DATA_UINT64
202 188 #define KI(x) kstat_named_init(&(ahstack->ah_kstats->ah_stat_##x), #x, K64)
203 189
204 190 KI(num_aalgs);
205 191 KI(good_auth);
206 192 KI(bad_auth);
207 193 KI(replay_failures);
208 194 KI(replay_early_failures);
209 195 KI(keysock_in);
210 196 KI(out_requests);
211 197 KI(acquire_requests);
212 198 KI(bytes_expired);
213 199 KI(out_discards);
214 200 KI(crypto_sync);
215 201 KI(crypto_async);
216 202 KI(crypto_failures);
217 203
218 204 #undef KI
219 205 #undef K64
220 206
221 207 kstat_install(ahstack->ah_ksp);
222 208 IP_ACQUIRE_STAT(ipss, maxpackets, ipsacq_maxpackets);
223 209 return (B_TRUE);
224 210 }
225 211
226 212 static int
227 213 ah_kstat_update(kstat_t *kp, int rw)
228 214 {
229 215 ah_kstats_t *ekp;
230 216 netstackid_t stackid = (netstackid_t)(uintptr_t)kp->ks_private;
231 217 netstack_t *ns;
232 218 ipsec_stack_t *ipss;
233 219
234 220 if ((kp == NULL) || (kp->ks_data == NULL))
235 221 return (EIO);
236 222
237 223 if (rw == KSTAT_WRITE)
238 224 return (EACCES);
239 225
|
↓ open down ↓ |
78 lines elided |
↑ open up ↑ |
240 226 ns = netstack_find_by_stackid(stackid);
241 227 if (ns == NULL)
242 228 return (-1);
243 229 ipss = ns->netstack_ipsec;
244 230 if (ipss == NULL) {
245 231 netstack_rele(ns);
246 232 return (-1);
247 233 }
248 234 ekp = (ah_kstats_t *)kp->ks_data;
249 235
250 - mutex_enter(&ipss->ipsec_alg_lock);
236 + rw_enter(&ipss->ipsec_alg_lock, RW_READER);
251 237 ekp->ah_stat_num_aalgs.value.ui64 = ipss->ipsec_nalgs[IPSEC_ALG_AUTH];
252 - mutex_exit(&ipss->ipsec_alg_lock);
238 + rw_exit(&ipss->ipsec_alg_lock);
253 239
254 240 netstack_rele(ns);
255 241 return (0);
256 242 }
257 243
258 244 /*
259 245 * Don't have to lock ipsec_age_interval, as only one thread will access it at
260 246 * a time, because I control the one function that does a qtimeout() on
261 247 * ah_pfkey_q.
262 248 */
263 249 static void
264 250 ah_ager(void *arg)
265 251 {
266 252 ipsecah_stack_t *ahstack = (ipsecah_stack_t *)arg;
267 253 netstack_t *ns = ahstack->ipsecah_netstack;
268 254 hrtime_t begin = gethrtime();
269 255
270 256 sadb_ager(&ahstack->ah_sadb.s_v4, ahstack->ah_pfkey_q,
271 257 ahstack->ipsecah_reap_delay, ns);
272 258 sadb_ager(&ahstack->ah_sadb.s_v6, ahstack->ah_pfkey_q,
273 259 ahstack->ipsecah_reap_delay, ns);
274 260
275 261 ahstack->ah_event = sadb_retimeout(begin, ahstack->ah_pfkey_q,
276 262 ah_ager, ahstack,
277 263 &ahstack->ipsecah_age_interval, ahstack->ipsecah_age_int_max,
278 264 info.mi_idnum);
279 265 }
280 266
281 267 /*
282 268 * Get an AH NDD parameter.
283 269 */
284 270 /* ARGSUSED */
285 271 static int
286 272 ipsecah_param_get(q, mp, cp, cr)
287 273 queue_t *q;
288 274 mblk_t *mp;
289 275 caddr_t cp;
290 276 cred_t *cr;
291 277 {
292 278 ipsecahparam_t *ipsecahpa = (ipsecahparam_t *)cp;
293 279 uint_t value;
294 280 ipsecah_stack_t *ahstack = (ipsecah_stack_t *)q->q_ptr;
295 281
296 282 mutex_enter(&ahstack->ipsecah_param_lock);
297 283 value = ipsecahpa->ipsecah_param_value;
298 284 mutex_exit(&ahstack->ipsecah_param_lock);
299 285
300 286 (void) mi_mpprintf(mp, "%u", value);
301 287 return (0);
302 288 }
303 289
304 290 /*
305 291 * This routine sets an NDD variable in a ipsecahparam_t structure.
306 292 */
307 293 /* ARGSUSED */
308 294 static int
309 295 ipsecah_param_set(q, mp, value, cp, cr)
310 296 queue_t *q;
311 297 mblk_t *mp;
312 298 char *value;
313 299 caddr_t cp;
314 300 cred_t *cr;
315 301 {
316 302 ulong_t new_value;
317 303 ipsecahparam_t *ipsecahpa = (ipsecahparam_t *)cp;
318 304 ipsecah_stack_t *ahstack = (ipsecah_stack_t *)q->q_ptr;
319 305
320 306 /*
321 307 * Fail the request if the new value does not lie within the
322 308 * required bounds.
323 309 */
324 310 if (ddi_strtoul(value, NULL, 10, &new_value) != 0 ||
325 311 new_value < ipsecahpa->ipsecah_param_min ||
326 312 new_value > ipsecahpa->ipsecah_param_max) {
327 313 return (EINVAL);
328 314 }
329 315
330 316 /* Set the new value */
331 317 mutex_enter(&ahstack->ipsecah_param_lock);
332 318 ipsecahpa->ipsecah_param_value = new_value;
333 319 mutex_exit(&ahstack->ipsecah_param_lock);
334 320 return (0);
335 321 }
336 322
337 323 /*
338 324 * Using lifetime NDD variables, fill in an extended combination's
339 325 * lifetime information.
340 326 */
341 327 void
342 328 ipsecah_fill_defs(sadb_x_ecomb_t *ecomb, netstack_t *ns)
343 329 {
344 330 ipsecah_stack_t *ahstack = ns->netstack_ipsecah;
345 331
346 332 ecomb->sadb_x_ecomb_soft_bytes = ahstack->ipsecah_default_soft_bytes;
347 333 ecomb->sadb_x_ecomb_hard_bytes = ahstack->ipsecah_default_hard_bytes;
348 334 ecomb->sadb_x_ecomb_soft_addtime =
349 335 ahstack->ipsecah_default_soft_addtime;
350 336 ecomb->sadb_x_ecomb_hard_addtime =
351 337 ahstack->ipsecah_default_hard_addtime;
352 338 ecomb->sadb_x_ecomb_soft_usetime =
353 339 ahstack->ipsecah_default_soft_usetime;
354 340 ecomb->sadb_x_ecomb_hard_usetime =
355 341 ahstack->ipsecah_default_hard_usetime;
356 342 }
357 343
358 344 /*
359 345 * Initialize things for AH at module load time.
360 346 */
361 347 boolean_t
362 348 ipsecah_ddi_init(void)
363 349 {
364 350 ah_taskq = taskq_create("ah_taskq", 1, minclsyspri,
365 351 IPSEC_TASKQ_MIN, IPSEC_TASKQ_MAX, 0);
366 352
367 353 /*
368 354 * We want to be informed each time a stack is created or
369 355 * destroyed in the kernel, so we can maintain the
370 356 * set of ipsecah_stack_t's.
371 357 */
372 358 netstack_register(NS_IPSECAH, ipsecah_stack_init, NULL,
373 359 ipsecah_stack_fini);
374 360
375 361 return (B_TRUE);
376 362 }
377 363
378 364 /*
379 365 * Walk through the param array specified registering each element with the
380 366 * named dispatch handler.
381 367 */
382 368 static boolean_t
383 369 ipsecah_param_register(IDP *ndp, ipsecahparam_t *ahp, int cnt)
384 370 {
385 371 for (; cnt-- > 0; ahp++) {
386 372 if (ahp->ipsecah_param_name != NULL &&
387 373 ahp->ipsecah_param_name[0]) {
388 374 if (!nd_load(ndp,
389 375 ahp->ipsecah_param_name,
390 376 ipsecah_param_get, ipsecah_param_set,
391 377 (caddr_t)ahp)) {
392 378 nd_free(ndp);
393 379 return (B_FALSE);
394 380 }
395 381 }
396 382 }
397 383 return (B_TRUE);
398 384 }
399 385
400 386 /*
401 387 * Initialize things for AH for each stack instance
402 388 */
403 389 static void *
404 390 ipsecah_stack_init(netstackid_t stackid, netstack_t *ns)
405 391 {
406 392 ipsecah_stack_t *ahstack;
407 393 ipsecahparam_t *ahp;
408 394
409 395 ahstack = (ipsecah_stack_t *)kmem_zalloc(sizeof (*ahstack), KM_SLEEP);
410 396 ahstack->ipsecah_netstack = ns;
411 397
|
↓ open down ↓ |
149 lines elided |
↑ open up ↑ |
412 398 ahp = (ipsecahparam_t *)kmem_alloc(sizeof (lcl_param_arr), KM_SLEEP);
413 399 ahstack->ipsecah_params = ahp;
414 400 bcopy(lcl_param_arr, ahp, sizeof (lcl_param_arr));
415 401
416 402 (void) ipsecah_param_register(&ahstack->ipsecah_g_nd, ahp,
417 403 A_CNT(lcl_param_arr));
418 404
419 405 (void) ah_kstat_init(ahstack, stackid);
420 406
421 407 ahstack->ah_sadb.s_acquire_timeout = &ahstack->ipsecah_acquire_timeout;
422 - ahstack->ah_sadb.s_acqfn = ah_send_acquire;
423 408 sadbp_init("AH", &ahstack->ah_sadb, SADB_SATYPE_AH, ah_hash_size,
424 409 ahstack->ipsecah_netstack);
425 410
426 411 mutex_init(&ahstack->ipsecah_param_lock, NULL, MUTEX_DEFAULT, 0);
427 412
428 413 ip_drop_register(&ahstack->ah_dropper, "IPsec AH");
429 414 return (ahstack);
430 415 }
431 416
432 417 /*
433 418 * Destroy things for AH at module unload time.
434 419 */
435 420 void
436 421 ipsecah_ddi_destroy(void)
437 422 {
438 423 netstack_unregister(NS_IPSECAH);
439 424 taskq_destroy(ah_taskq);
440 425 }
441 426
442 427 /*
|
↓ open down ↓ |
10 lines elided |
↑ open up ↑ |
443 428 * Destroy things for AH for one stack... Never called?
444 429 */
445 430 static void
446 431 ipsecah_stack_fini(netstackid_t stackid, void *arg)
447 432 {
448 433 ipsecah_stack_t *ahstack = (ipsecah_stack_t *)arg;
449 434
450 435 if (ahstack->ah_pfkey_q != NULL) {
451 436 (void) quntimeout(ahstack->ah_pfkey_q, ahstack->ah_event);
452 437 }
453 - ahstack->ah_sadb.s_acqfn = NULL;
454 438 ahstack->ah_sadb.s_acquire_timeout = NULL;
455 439 sadbp_destroy(&ahstack->ah_sadb, ahstack->ipsecah_netstack);
456 440 ip_drop_unregister(&ahstack->ah_dropper);
457 441 mutex_destroy(&ahstack->ipsecah_param_lock);
458 442 nd_free(&ahstack->ipsecah_g_nd);
459 443
460 444 kmem_free(ahstack->ipsecah_params, sizeof (lcl_param_arr));
461 445 ahstack->ipsecah_params = NULL;
462 446 kstat_delete_netstack(ahstack->ah_ksp, stackid);
463 447 ahstack->ah_ksp = NULL;
464 448 ahstack->ah_kstats = NULL;
465 449
466 450 kmem_free(ahstack, sizeof (*ahstack));
467 451 }
468 452
469 453 /*
470 454 * AH module open routine, which is here for keysock plumbing.
471 455 * Keysock is pushed over {AH,ESP} which is an artifact from the Bad Old
472 456 * Days of export control, and fears that ESP would not be allowed
473 457 * to be shipped at all by default. Eventually, keysock should
474 458 * either access AH and ESP via modstubs or krtld dependencies, or
475 459 * perhaps be folded in with AH and ESP into a single IPsec/netsec
476 460 * module ("netsec" if PF_KEY provides more than AH/ESP keying tables).
477 461 */
478 462 /* ARGSUSED */
479 463 static int
480 464 ipsecah_open(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp)
481 465 {
482 466 netstack_t *ns;
483 467 ipsecah_stack_t *ahstack;
484 468
485 469 if (secpolicy_ip_config(credp, B_FALSE) != 0)
486 470 return (EPERM);
487 471
488 472 if (q->q_ptr != NULL)
489 473 return (0); /* Re-open of an already open instance. */
490 474
491 475 if (sflag != MODOPEN)
492 476 return (EINVAL);
493 477
494 478 ns = netstack_find_by_cred(credp);
495 479 ASSERT(ns != NULL);
496 480 ahstack = ns->netstack_ipsecah;
497 481 ASSERT(ahstack != NULL);
498 482
499 483 q->q_ptr = ahstack;
500 484 WR(q)->q_ptr = q->q_ptr;
501 485
502 486 qprocson(q);
503 487 return (0);
504 488 }
505 489
506 490 /*
507 491 * AH module close routine.
508 492 */
509 493 static int
510 494 ipsecah_close(queue_t *q)
511 495 {
512 496 ipsecah_stack_t *ahstack = (ipsecah_stack_t *)q->q_ptr;
513 497
514 498 /*
515 499 * Clean up q_ptr, if needed.
516 500 */
517 501 qprocsoff(q);
518 502
519 503 /* Keysock queue check is safe, because of OCEXCL perimeter. */
520 504
521 505 if (q == ahstack->ah_pfkey_q) {
522 506 ah1dbg(ahstack,
523 507 ("ipsecah_close: Ummm... keysock is closing AH.\n"));
524 508 ahstack->ah_pfkey_q = NULL;
525 509 /* Detach qtimeouts. */
526 510 (void) quntimeout(q, ahstack->ah_event);
527 511 }
528 512
529 513 netstack_rele(ahstack->ipsecah_netstack);
530 514 return (0);
531 515 }
532 516
533 517 /*
534 518 * Construct an SADB_REGISTER message with the current algorithms.
535 519 */
536 520 static boolean_t
537 521 ah_register_out(uint32_t sequence, uint32_t pid, uint_t serial,
538 522 ipsecah_stack_t *ahstack, cred_t *cr)
539 523 {
540 524 mblk_t *mp;
541 525 boolean_t rc = B_TRUE;
542 526 sadb_msg_t *samsg;
543 527 sadb_supported_t *sasupp;
544 528 sadb_alg_t *saalg;
545 529 uint_t allocsize = sizeof (*samsg);
546 530 uint_t i, numalgs_snap;
547 531 ipsec_alginfo_t **authalgs;
548 532 uint_t num_aalgs;
549 533 ipsec_stack_t *ipss = ahstack->ipsecah_netstack->netstack_ipsec;
550 534 sadb_sens_t *sens;
551 535 size_t sens_len = 0;
552 536 sadb_ext_t *nextext;
553 537 ts_label_t *sens_tsl = NULL;
554 538
555 539 /* Allocate the KEYSOCK_OUT. */
556 540 mp = sadb_keysock_out(serial);
557 541 if (mp == NULL) {
558 542 ah0dbg(("ah_register_out: couldn't allocate mblk.\n"));
559 543 return (B_FALSE);
560 544 }
561 545
562 546 if (is_system_labeled() && (cr != NULL)) {
563 547 sens_tsl = crgetlabel(cr);
564 548 if (sens_tsl != NULL) {
565 549 sens_len = sadb_sens_len_from_label(sens_tsl);
|
↓ open down ↓ |
102 lines elided |
↑ open up ↑ |
566 550 allocsize += sens_len;
567 551 }
568 552 }
569 553
570 554 /*
571 555 * Allocate the PF_KEY message that follows KEYSOCK_OUT.
572 556 * The alg reader lock needs to be held while allocating
573 557 * the variable part (i.e. the algorithms) of the message.
574 558 */
575 559
576 - mutex_enter(&ipss->ipsec_alg_lock);
560 + rw_enter(&ipss->ipsec_alg_lock, RW_READER);
577 561
578 562 /*
579 563 * Return only valid algorithms, so the number of algorithms
580 564 * to send up may be less than the number of algorithm entries
581 565 * in the table.
582 566 */
583 567 authalgs = ipss->ipsec_alglists[IPSEC_ALG_AUTH];
584 568 for (num_aalgs = 0, i = 0; i < IPSEC_MAX_ALGS; i++)
585 569 if (authalgs[i] != NULL && ALG_VALID(authalgs[i]))
586 570 num_aalgs++;
587 571
|
↓ open down ↓ |
1 lines elided |
↑ open up ↑ |
588 572 /*
589 573 * Fill SADB_REGISTER message's algorithm descriptors. Hold
590 574 * down the lock while filling it.
591 575 */
592 576 if (num_aalgs != 0) {
593 577 allocsize += (num_aalgs * sizeof (*saalg));
594 578 allocsize += sizeof (*sasupp);
595 579 }
596 580 mp->b_cont = allocb(allocsize, BPRI_HI);
597 581 if (mp->b_cont == NULL) {
598 - mutex_exit(&ipss->ipsec_alg_lock);
582 + rw_exit(&ipss->ipsec_alg_lock);
599 583 freemsg(mp);
600 584 return (B_FALSE);
601 585 }
602 586
603 587 mp->b_cont->b_wptr += allocsize;
604 588 nextext = (sadb_ext_t *)(mp->b_cont->b_rptr + sizeof (*samsg));
605 589
606 590 if (num_aalgs != 0) {
607 591
608 592 saalg = (sadb_alg_t *)(((uint8_t *)nextext) + sizeof (*sasupp));
609 593 ASSERT(((ulong_t)saalg & 0x7) == 0);
610 594
611 595 numalgs_snap = 0;
612 596 for (i = 0;
613 597 ((i < IPSEC_MAX_ALGS) && (numalgs_snap < num_aalgs));
614 598 i++) {
615 599 if (authalgs[i] == NULL || !ALG_VALID(authalgs[i]))
616 600 continue;
617 601
618 602 saalg->sadb_alg_id = authalgs[i]->alg_id;
619 603 saalg->sadb_alg_ivlen = 0;
620 604 saalg->sadb_alg_minbits = authalgs[i]->alg_ef_minbits;
621 605 saalg->sadb_alg_maxbits = authalgs[i]->alg_ef_maxbits;
622 606 saalg->sadb_x_alg_increment =
623 607 authalgs[i]->alg_increment;
624 608 /* For now, salt is meaningless in AH. */
625 609 ASSERT(authalgs[i]->alg_saltlen == 0);
626 610 saalg->sadb_x_alg_saltbits =
627 611 SADB_8TO1(authalgs[i]->alg_saltlen);
628 612 numalgs_snap++;
629 613 saalg++;
630 614 }
631 615 ASSERT(numalgs_snap == num_aalgs);
632 616 #ifdef DEBUG
633 617 /*
634 618 * Reality check to make sure I snagged all of the
|
↓ open down ↓ |
26 lines elided |
↑ open up ↑ |
635 619 * algorithms.
636 620 */
637 621 for (; i < IPSEC_MAX_ALGS; i++)
638 622 if (authalgs[i] != NULL && ALG_VALID(authalgs[i]))
639 623 cmn_err(CE_PANIC,
640 624 "ah_register_out()! Missed #%d.\n", i);
641 625 #endif /* DEBUG */
642 626 nextext = (sadb_ext_t *)saalg;
643 627 }
644 628
645 - mutex_exit(&ipss->ipsec_alg_lock);
629 + rw_exit(&ipss->ipsec_alg_lock);
646 630
647 631 if (sens_tsl != NULL) {
648 632 sens = (sadb_sens_t *)nextext;
649 633 sadb_sens_from_label(sens, SADB_EXT_SENSITIVITY,
650 634 sens_tsl, sens_len);
651 635
652 636 nextext = (sadb_ext_t *)(((uint8_t *)sens) + sens_len);
653 637 }
654 638
655 639 /* Now fill the restof the SADB_REGISTER message. */
656 640
657 641 samsg = (sadb_msg_t *)mp->b_cont->b_rptr;
658 642 samsg->sadb_msg_version = PF_KEY_V2;
659 643 samsg->sadb_msg_type = SADB_REGISTER;
660 644 samsg->sadb_msg_errno = 0;
661 645 samsg->sadb_msg_satype = SADB_SATYPE_AH;
662 646 samsg->sadb_msg_len = SADB_8TO64(allocsize);
663 647 samsg->sadb_msg_reserved = 0;
664 648 /*
665 649 * Assume caller has sufficient sequence/pid number info. If it's one
666 650 * from me over a new alg., I could give two hoots about sequence.
667 651 */
668 652 samsg->sadb_msg_seq = sequence;
669 653 samsg->sadb_msg_pid = pid;
670 654
671 655 if (num_aalgs != 0) {
672 656 sasupp = (sadb_supported_t *)(samsg + 1);
673 657 sasupp->sadb_supported_len = SADB_8TO64(
674 658 sizeof (*sasupp) + sizeof (*saalg) * num_aalgs);
675 659 sasupp->sadb_supported_exttype = SADB_EXT_SUPPORTED_AUTH;
676 660 sasupp->sadb_supported_reserved = 0;
677 661 }
678 662
679 663 if (ahstack->ah_pfkey_q != NULL)
680 664 putnext(ahstack->ah_pfkey_q, mp);
681 665 else {
682 666 rc = B_FALSE;
683 667 freemsg(mp);
684 668 }
685 669
686 670 return (rc);
687 671 }
688 672
689 673 /*
690 674 * Invoked when the algorithm table changes. Causes SADB_REGISTER
691 675 * messages continaining the current list of algorithms to be
692 676 * sent up to the AH listeners.
693 677 */
694 678 void
695 679 ipsecah_algs_changed(netstack_t *ns)
696 680 {
697 681 ipsecah_stack_t *ahstack = ns->netstack_ipsecah;
698 682
699 683 /*
700 684 * Time to send a PF_KEY SADB_REGISTER message to AH listeners
701 685 * everywhere. (The function itself checks for NULL ah_pfkey_q.)
702 686 */
703 687 (void) ah_register_out(0, 0, 0, ahstack, NULL);
704 688 }
705 689
706 690 /*
707 691 * Stub function that taskq_dispatch() invokes to take the mblk (in arg)
708 692 * and send it into AH and IP again.
709 693 */
710 694 static void
711 695 inbound_task(void *arg)
712 696 {
713 697 mblk_t *mp = (mblk_t *)arg;
714 698 mblk_t *async_mp;
715 699 ip_recv_attr_t iras;
716 700
717 701 async_mp = mp;
718 702 mp = async_mp->b_cont;
719 703 async_mp->b_cont = NULL;
720 704 if (!ip_recv_attr_from_mblk(async_mp, &iras)) {
721 705 /* The ill or ip_stack_t disappeared on us */
722 706 ip_drop_input("ip_recv_attr_from_mblk", mp, NULL);
723 707 freemsg(mp);
724 708 goto done;
725 709 }
726 710
727 711 ah_inbound_restart(mp, &iras);
728 712 done:
729 713 ira_cleanup(&iras, B_TRUE);
730 714 }
731 715
732 716 /*
733 717 * Restart ESP after the SA has been added.
734 718 */
735 719 static void
736 720 ah_inbound_restart(mblk_t *mp, ip_recv_attr_t *ira)
737 721 {
738 722 ah_t *ah;
739 723 netstack_t *ns;
740 724 ipsecah_stack_t *ahstack;
741 725
742 726 ns = ira->ira_ill->ill_ipst->ips_netstack;
743 727 ahstack = ns->netstack_ipsecah;
744 728
745 729 ASSERT(ahstack != NULL);
746 730 mp = ipsec_inbound_ah_sa(mp, ira, &ah);
747 731 if (mp == NULL)
748 732 return;
749 733
750 734 ASSERT(ah != NULL);
751 735 ASSERT(ira->ira_flags & IRAF_IPSEC_SECURE);
752 736 ASSERT(ira->ira_ipsec_ah_sa != NULL);
753 737
754 738 mp = ira->ira_ipsec_ah_sa->ipsa_input_func(mp, ah, ira);
755 739 if (mp == NULL) {
756 740 /*
757 741 * Either it failed or is pending. In the former case
758 742 * ipIfStatsInDiscards was increased.
759 743 */
760 744 return;
761 745 }
762 746 ip_input_post_ipsec(mp, ira);
763 747 }
764 748
765 749 /*
766 750 * Now that weak-key passed, actually ADD the security association, and
767 751 * send back a reply ADD message.
768 752 */
769 753 static int
770 754 ah_add_sa_finish(mblk_t *mp, sadb_msg_t *samsg, keysock_in_t *ksi,
771 755 int *diagnostic, ipsecah_stack_t *ahstack)
772 756 {
773 757 isaf_t *primary = NULL, *secondary;
774 758 boolean_t clone = B_FALSE, is_inbound = B_FALSE;
775 759 sadb_sa_t *assoc = (sadb_sa_t *)ksi->ks_in_extv[SADB_EXT_SA];
776 760 ipsa_t *larval;
777 761 ipsacq_t *acqrec;
778 762 iacqf_t *acq_bucket;
779 763 mblk_t *acq_msgs = NULL;
780 764 mblk_t *lpkt;
781 765 int rc;
782 766 ipsa_query_t sq;
783 767 int error;
784 768 netstack_t *ns = ahstack->ipsecah_netstack;
785 769 ipsec_stack_t *ipss = ns->netstack_ipsec;
786 770
787 771 /*
788 772 * Locate the appropriate table(s).
789 773 */
790 774
791 775 sq.spp = &ahstack->ah_sadb;
792 776 error = sadb_form_query(ksi, IPSA_Q_SA|IPSA_Q_DST,
793 777 IPSA_Q_SA|IPSA_Q_DST|IPSA_Q_INBOUND|IPSA_Q_OUTBOUND,
794 778 &sq, diagnostic);
795 779 if (error)
796 780 return (error);
797 781
798 782 /*
799 783 * Use the direction flags provided by the KMD to determine
800 784 * if the inbound or outbound table should be the primary
801 785 * for this SA. If these flags were absent then make this
802 786 * decision based on the addresses.
803 787 */
804 788 if (assoc->sadb_sa_flags & IPSA_F_INBOUND) {
805 789 primary = sq.inbound;
806 790 secondary = sq.outbound;
807 791 is_inbound = B_TRUE;
808 792 if (assoc->sadb_sa_flags & IPSA_F_OUTBOUND)
809 793 clone = B_TRUE;
810 794 } else {
811 795 if (assoc->sadb_sa_flags & IPSA_F_OUTBOUND) {
812 796 primary = sq.outbound;
813 797 secondary = sq.inbound;
814 798 }
815 799 }
816 800 if (primary == NULL) {
817 801 /*
818 802 * The KMD did not set a direction flag, determine which
819 803 * table to insert the SA into based on addresses.
820 804 */
821 805 switch (ksi->ks_in_dsttype) {
822 806 case KS_IN_ADDR_MBCAST:
823 807 clone = B_TRUE; /* All mcast SAs can be bidirectional */
824 808 assoc->sadb_sa_flags |= IPSA_F_OUTBOUND;
825 809 /* FALLTHRU */
826 810 /*
827 811 * If the source address is either one of mine, or unspecified
828 812 * (which is best summed up by saying "not 'not mine'"),
829 813 * then the association is potentially bi-directional,
830 814 * in that it can be used for inbound traffic and outbound
831 815 * traffic. The best example of such and SA is a multicast
832 816 * SA (which allows me to receive the outbound traffic).
833 817 */
834 818 case KS_IN_ADDR_ME:
835 819 assoc->sadb_sa_flags |= IPSA_F_INBOUND;
836 820 primary = sq.inbound;
837 821 secondary = sq.outbound;
838 822 if (ksi->ks_in_srctype != KS_IN_ADDR_NOTME)
839 823 clone = B_TRUE;
840 824 is_inbound = B_TRUE;
841 825 break;
842 826
843 827 /*
844 828 * If the source address literally not mine (either
845 829 * unspecified or not mine), then this SA may have an
846 830 * address that WILL be mine after some configuration.
847 831 * We pay the price for this by making it a bi-directional
848 832 * SA.
849 833 */
850 834 case KS_IN_ADDR_NOTME:
851 835 assoc->sadb_sa_flags |= IPSA_F_OUTBOUND;
852 836 primary = sq.outbound;
853 837 secondary = sq.inbound;
854 838 if (ksi->ks_in_srctype != KS_IN_ADDR_ME) {
855 839 assoc->sadb_sa_flags |= IPSA_F_INBOUND;
856 840 clone = B_TRUE;
857 841 }
858 842 break;
859 843 default:
860 844 *diagnostic = SADB_X_DIAGNOSTIC_BAD_DST;
861 845 return (EINVAL);
862 846 }
863 847 }
864 848
865 849 /*
866 850 * Find a ACQUIRE list entry if possible. If we've added an SA that
867 851 * suits the needs of an ACQUIRE list entry, we can eliminate the
868 852 * ACQUIRE list entry and transmit the enqueued packets. Use the
869 853 * high-bit of the sequence number to queue it. Key off destination
870 854 * addr, and change acqrec's state.
871 855 */
872 856
873 857 if (samsg->sadb_msg_seq & IACQF_LOWEST_SEQ) {
874 858 acq_bucket = &(sq.sp->sdb_acq[sq.outhash]);
875 859 mutex_enter(&acq_bucket->iacqf_lock);
876 860 for (acqrec = acq_bucket->iacqf_ipsacq; acqrec != NULL;
877 861 acqrec = acqrec->ipsacq_next) {
878 862 mutex_enter(&acqrec->ipsacq_lock);
879 863 /*
880 864 * Q: I only check sequence. Should I check dst?
881 865 * A: Yes, check dest because those are the packets
882 866 * that are queued up.
883 867 */
884 868 if (acqrec->ipsacq_seq == samsg->sadb_msg_seq &&
885 869 IPSA_ARE_ADDR_EQUAL(sq.dstaddr,
886 870 acqrec->ipsacq_dstaddr, acqrec->ipsacq_addrfam))
887 871 break;
888 872 mutex_exit(&acqrec->ipsacq_lock);
889 873 }
890 874 if (acqrec != NULL) {
891 875 /*
892 876 * AHA! I found an ACQUIRE record for this SA.
893 877 * Grab the msg list, and free the acquire record.
894 878 * I already am holding the lock for this record,
895 879 * so all I have to do is free it.
896 880 */
897 881 acq_msgs = acqrec->ipsacq_mp;
898 882 acqrec->ipsacq_mp = NULL;
899 883 mutex_exit(&acqrec->ipsacq_lock);
900 884 sadb_destroy_acquire(acqrec, ns);
901 885 }
902 886 mutex_exit(&acq_bucket->iacqf_lock);
903 887 }
904 888
905 889 /*
906 890 * Find PF_KEY message, and see if I'm an update. If so, find entry
907 891 * in larval list (if there).
908 892 */
909 893
910 894 larval = NULL;
911 895
912 896 if (samsg->sadb_msg_type == SADB_UPDATE) {
913 897 mutex_enter(&sq.inbound->isaf_lock);
914 898 larval = ipsec_getassocbyspi(sq.inbound, sq.assoc->sadb_sa_spi,
915 899 ALL_ZEROES_PTR, sq.dstaddr, sq.dst->sin_family);
916 900 mutex_exit(&sq.inbound->isaf_lock);
917 901
918 902 if ((larval == NULL) ||
919 903 (larval->ipsa_state != IPSA_STATE_LARVAL)) {
920 904 *diagnostic = SADB_X_DIAGNOSTIC_SA_NOTFOUND;
921 905 if (larval != NULL) {
922 906 IPSA_REFRELE(larval);
923 907 }
924 908 ah0dbg(("Larval update, but larval disappeared.\n"));
925 909 return (ESRCH);
926 910 } /* Else sadb_common_add unlinks it for me! */
927 911 }
928 912
929 913 if (larval != NULL) {
930 914 /*
931 915 * Hold again, because sadb_common_add() consumes a reference,
932 916 * and we don't want to clear_lpkt() without a reference.
933 917 */
934 918 IPSA_REFHOLD(larval);
935 919 }
936 920
937 921 rc = sadb_common_add(ahstack->ah_pfkey_q, mp,
938 922 samsg, ksi, primary, secondary, larval, clone, is_inbound,
939 923 diagnostic, ns, &ahstack->ah_sadb);
940 924
941 925 if (larval != NULL) {
942 926 if (rc == 0) {
943 927 lpkt = sadb_clear_lpkt(larval);
944 928 if (lpkt != NULL) {
945 929 rc = !taskq_dispatch(ah_taskq, inbound_task,
946 930 lpkt, TQ_NOSLEEP);
947 931 }
948 932 }
949 933 IPSA_REFRELE(larval);
950 934 }
951 935
952 936 /*
953 937 * How much more stack will I create with all of these
954 938 * ah_outbound_*() calls?
955 939 */
956 940
957 941 /* Handle the packets queued waiting for the SA */
958 942 while (acq_msgs != NULL) {
959 943 mblk_t *asyncmp;
960 944 mblk_t *data_mp;
961 945 ip_xmit_attr_t ixas;
962 946 ill_t *ill;
963 947
964 948 asyncmp = acq_msgs;
965 949 acq_msgs = acq_msgs->b_next;
966 950 asyncmp->b_next = NULL;
967 951
968 952 /*
969 953 * Extract the ip_xmit_attr_t from the first mblk.
970 954 * Verifies that the netstack and ill is still around; could
971 955 * have vanished while iked was doing its work.
972 956 * On succesful return we have a nce_t and the ill/ipst can't
973 957 * disappear until we do the nce_refrele in ixa_cleanup.
974 958 */
975 959 data_mp = asyncmp->b_cont;
976 960 asyncmp->b_cont = NULL;
977 961 if (!ip_xmit_attr_from_mblk(asyncmp, &ixas)) {
978 962 AH_BUMP_STAT(ahstack, out_discards);
979 963 ip_drop_packet(data_mp, B_FALSE, NULL,
980 964 DROPPER(ipss, ipds_sadb_acquire_timeout),
981 965 &ahstack->ah_dropper);
982 966 } else if (rc != 0) {
983 967 ill = ixas.ixa_nce->nce_ill;
984 968 AH_BUMP_STAT(ahstack, out_discards);
985 969 ip_drop_packet(data_mp, B_FALSE, ill,
986 970 DROPPER(ipss, ipds_sadb_acquire_timeout),
987 971 &ahstack->ah_dropper);
988 972 BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutDiscards);
989 973 } else {
990 974 ah_outbound_finish(data_mp, &ixas);
991 975 }
992 976 ixa_cleanup(&ixas);
993 977 }
994 978
995 979 return (rc);
996 980 }
997 981
998 982
999 983 /*
1000 984 * Process one of the queued messages (from ipsacq_mp) once the SA
1001 985 * has been added.
1002 986 */
1003 987 static void
1004 988 ah_outbound_finish(mblk_t *data_mp, ip_xmit_attr_t *ixa)
1005 989 {
1006 990 netstack_t *ns = ixa->ixa_ipst->ips_netstack;
1007 991 ipsecah_stack_t *ahstack = ns->netstack_ipsecah;
1008 992 ipsec_stack_t *ipss = ns->netstack_ipsec;
1009 993 ill_t *ill = ixa->ixa_nce->nce_ill;
1010 994
1011 995 if (!ipsec_outbound_sa(data_mp, ixa, IPPROTO_AH)) {
1012 996 AH_BUMP_STAT(ahstack, out_discards);
1013 997 ip_drop_packet(data_mp, B_FALSE, ill,
1014 998 DROPPER(ipss, ipds_sadb_acquire_timeout),
1015 999 &ahstack->ah_dropper);
1016 1000 BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutDiscards);
1017 1001 return;
1018 1002 }
1019 1003
1020 1004 data_mp = ah_outbound(data_mp, ixa);
1021 1005 if (data_mp == NULL)
1022 1006 return;
1023 1007
1024 1008 (void) ip_output_post_ipsec(data_mp, ixa);
1025 1009 }
1026 1010
1027 1011 /*
1028 1012 * Add new AH security association. This may become a generic AH/ESP
1029 1013 * routine eventually.
1030 1014 */
1031 1015 static int
1032 1016 ah_add_sa(mblk_t *mp, keysock_in_t *ksi, int *diagnostic, netstack_t *ns)
1033 1017 {
1034 1018 sadb_sa_t *assoc = (sadb_sa_t *)ksi->ks_in_extv[SADB_EXT_SA];
1035 1019 sadb_address_t *srcext =
1036 1020 (sadb_address_t *)ksi->ks_in_extv[SADB_EXT_ADDRESS_SRC];
1037 1021 sadb_address_t *dstext =
1038 1022 (sadb_address_t *)ksi->ks_in_extv[SADB_EXT_ADDRESS_DST];
1039 1023 sadb_address_t *isrcext =
1040 1024 (sadb_address_t *)ksi->ks_in_extv[SADB_X_EXT_ADDRESS_INNER_SRC];
1041 1025 sadb_address_t *idstext =
1042 1026 (sadb_address_t *)ksi->ks_in_extv[SADB_X_EXT_ADDRESS_INNER_DST];
1043 1027 sadb_key_t *key = (sadb_key_t *)ksi->ks_in_extv[SADB_EXT_KEY_AUTH];
1044 1028 struct sockaddr_in *src, *dst;
1045 1029 /* We don't need sockaddr_in6 for now. */
1046 1030 sadb_lifetime_t *soft =
1047 1031 (sadb_lifetime_t *)ksi->ks_in_extv[SADB_EXT_LIFETIME_SOFT];
1048 1032 sadb_lifetime_t *hard =
1049 1033 (sadb_lifetime_t *)ksi->ks_in_extv[SADB_EXT_LIFETIME_HARD];
1050 1034 sadb_lifetime_t *idle =
1051 1035 (sadb_lifetime_t *)ksi->ks_in_extv[SADB_X_EXT_LIFETIME_IDLE];
1052 1036 ipsec_alginfo_t *aalg;
1053 1037 ipsecah_stack_t *ahstack = ns->netstack_ipsecah;
1054 1038 ipsec_stack_t *ipss = ns->netstack_ipsec;
1055 1039
1056 1040 /* I need certain extensions present for an ADD message. */
1057 1041 if (srcext == NULL) {
1058 1042 *diagnostic = SADB_X_DIAGNOSTIC_MISSING_SRC;
1059 1043 return (EINVAL);
1060 1044 }
1061 1045 if (dstext == NULL) {
1062 1046 *diagnostic = SADB_X_DIAGNOSTIC_MISSING_DST;
1063 1047 return (EINVAL);
1064 1048 }
1065 1049 if (isrcext == NULL && idstext != NULL) {
1066 1050 *diagnostic = SADB_X_DIAGNOSTIC_MISSING_INNER_SRC;
1067 1051 return (EINVAL);
1068 1052 }
1069 1053 if (isrcext != NULL && idstext == NULL) {
1070 1054 *diagnostic = SADB_X_DIAGNOSTIC_MISSING_INNER_DST;
1071 1055 return (EINVAL);
1072 1056 }
1073 1057 if (assoc == NULL) {
1074 1058 *diagnostic = SADB_X_DIAGNOSTIC_MISSING_SA;
1075 1059 return (EINVAL);
1076 1060 }
1077 1061 if (key == NULL) {
1078 1062 *diagnostic = SADB_X_DIAGNOSTIC_MISSING_AKEY;
1079 1063 return (EINVAL);
1080 1064 }
1081 1065
1082 1066 src = (struct sockaddr_in *)(srcext + 1);
1083 1067 dst = (struct sockaddr_in *)(dstext + 1);
1084 1068
1085 1069 /* Sundry ADD-specific reality checks. */
1086 1070 /* XXX STATS : Logging/stats here? */
1087 1071
1088 1072 if ((assoc->sadb_sa_state != SADB_SASTATE_MATURE) &&
1089 1073 (assoc->sadb_sa_state != SADB_X_SASTATE_ACTIVE_ELSEWHERE)) {
1090 1074 *diagnostic = SADB_X_DIAGNOSTIC_BAD_SASTATE;
1091 1075 return (EINVAL);
1092 1076 }
1093 1077 if (assoc->sadb_sa_encrypt != SADB_EALG_NONE) {
1094 1078 *diagnostic = SADB_X_DIAGNOSTIC_ENCR_NOTSUPP;
1095 1079 return (EINVAL);
1096 1080 }
1097 1081 if (assoc->sadb_sa_flags & ~ahstack->ah_sadb.s_addflags) {
1098 1082 *diagnostic = SADB_X_DIAGNOSTIC_BAD_SAFLAGS;
1099 1083 return (EINVAL);
1100 1084 }
1101 1085 if ((*diagnostic = sadb_hardsoftchk(hard, soft, idle)) != 0)
1102 1086 return (EINVAL);
1103 1087
1104 1088 ASSERT(src->sin_family == dst->sin_family);
1105 1089
1106 1090 /* Stuff I don't support, for now. XXX Diagnostic? */
1107 1091 if (ksi->ks_in_extv[SADB_EXT_LIFETIME_CURRENT] != NULL)
1108 1092 return (EOPNOTSUPP);
1109 1093
1110 1094 if (ksi->ks_in_extv[SADB_EXT_SENSITIVITY] != NULL) {
1111 1095 if (!is_system_labeled())
1112 1096 return (EOPNOTSUPP);
1113 1097 }
1114 1098
1115 1099 if (ksi->ks_in_extv[SADB_X_EXT_OUTER_SENS] != NULL) {
|
↓ open down ↓ |
460 lines elided |
↑ open up ↑ |
1116 1100 if (!is_system_labeled())
1117 1101 return (EOPNOTSUPP);
1118 1102 }
1119 1103 /*
1120 1104 * XXX Policy : I'm not checking identities at this time, but
1121 1105 * if I did, I'd do them here, before I sent the weak key
1122 1106 * check up to the algorithm.
1123 1107 */
1124 1108
1125 1109 /* verify that there is a mapping for the specified algorithm */
1126 - mutex_enter(&ipss->ipsec_alg_lock);
1110 + rw_enter(&ipss->ipsec_alg_lock, RW_READER);
1127 1111 aalg = ipss->ipsec_alglists[IPSEC_ALG_AUTH][assoc->sadb_sa_auth];
1128 1112 if (aalg == NULL || !ALG_VALID(aalg)) {
1129 - mutex_exit(&ipss->ipsec_alg_lock);
1113 + rw_exit(&ipss->ipsec_alg_lock);
1130 1114 ah1dbg(ahstack, ("Couldn't find auth alg #%d.\n",
1131 1115 assoc->sadb_sa_auth));
1132 1116 *diagnostic = SADB_X_DIAGNOSTIC_BAD_AALG;
1133 1117 return (EINVAL);
1134 1118 }
1135 1119 ASSERT(aalg->alg_mech_type != CRYPTO_MECHANISM_INVALID);
1136 1120
1137 1121 /* sanity check key sizes */
1138 1122 if (!ipsec_valid_key_size(key->sadb_key_bits, aalg)) {
1139 - mutex_exit(&ipss->ipsec_alg_lock);
1123 + rw_exit(&ipss->ipsec_alg_lock);
1140 1124 *diagnostic = SADB_X_DIAGNOSTIC_BAD_AKEYBITS;
1141 1125 return (EINVAL);
1142 1126 }
1143 1127
1144 1128 /* check key and fix parity if needed */
1145 1129 if (ipsec_check_key(aalg->alg_mech_type, key, B_TRUE,
1146 1130 diagnostic) != 0) {
1147 - mutex_exit(&ipss->ipsec_alg_lock);
1131 + rw_exit(&ipss->ipsec_alg_lock);
1148 1132 return (EINVAL);
1149 1133 }
1150 1134
1151 - mutex_exit(&ipss->ipsec_alg_lock);
1135 + rw_exit(&ipss->ipsec_alg_lock);
1152 1136
1153 1137 return (ah_add_sa_finish(mp, (sadb_msg_t *)mp->b_cont->b_rptr, ksi,
1154 1138 diagnostic, ahstack));
1155 1139 }
1156 1140
1157 1141 /* Refactor me */
1158 1142 /*
1159 1143 * Update a security association. Updates come in two varieties. The first
1160 1144 * is an update of lifetimes on a non-larval SA. The second is an update of
1161 1145 * a larval SA, which ends up looking a lot more like an add.
1162 1146 */
1163 1147 static int
1164 1148 ah_update_sa(mblk_t *mp, keysock_in_t *ksi, int *diagnostic,
1165 1149 ipsecah_stack_t *ahstack, uint8_t sadb_msg_type)
1166 1150 {
1167 1151 sadb_sa_t *assoc = (sadb_sa_t *)ksi->ks_in_extv[SADB_EXT_SA];
1168 1152 sadb_address_t *dstext =
1169 1153 (sadb_address_t *)ksi->ks_in_extv[SADB_EXT_ADDRESS_DST];
1170 1154 mblk_t *buf_pkt;
1171 1155 int rcode;
1172 1156
1173 1157 if (dstext == NULL) {
1174 1158 *diagnostic = SADB_X_DIAGNOSTIC_MISSING_DST;
1175 1159 return (EINVAL);
1176 1160 }
1177 1161
1178 1162 rcode = sadb_update_sa(mp, ksi, &buf_pkt, &ahstack->ah_sadb,
1179 1163 diagnostic, ahstack->ah_pfkey_q, ah_add_sa,
1180 1164 ahstack->ipsecah_netstack, sadb_msg_type);
1181 1165
1182 1166 if ((assoc->sadb_sa_state != SADB_X_SASTATE_ACTIVE) ||
1183 1167 (rcode != 0)) {
1184 1168 return (rcode);
1185 1169 }
1186 1170
1187 1171 HANDLE_BUF_PKT(ah_taskq, ahstack->ipsecah_netstack->netstack_ipsec,
1188 1172 ahstack->ah_dropper, buf_pkt);
1189 1173
1190 1174 return (rcode);
1191 1175 }
1192 1176
1193 1177 /* Refactor me */
1194 1178 /*
1195 1179 * Delete a security association. This is REALLY likely to be code common to
1196 1180 * both AH and ESP. Find the association, then unlink it.
1197 1181 */
1198 1182 static int
1199 1183 ah_del_sa(mblk_t *mp, keysock_in_t *ksi, int *diagnostic,
1200 1184 ipsecah_stack_t *ahstack, uint8_t sadb_msg_type)
1201 1185 {
1202 1186 sadb_sa_t *assoc = (sadb_sa_t *)ksi->ks_in_extv[SADB_EXT_SA];
1203 1187 sadb_address_t *dstext =
1204 1188 (sadb_address_t *)ksi->ks_in_extv[SADB_EXT_ADDRESS_DST];
1205 1189 sadb_address_t *srcext =
1206 1190 (sadb_address_t *)ksi->ks_in_extv[SADB_EXT_ADDRESS_SRC];
1207 1191 struct sockaddr_in *sin;
1208 1192
1209 1193 if (assoc == NULL) {
1210 1194 if (dstext != NULL)
1211 1195 sin = (struct sockaddr_in *)(dstext + 1);
1212 1196 else if (srcext != NULL)
1213 1197 sin = (struct sockaddr_in *)(srcext + 1);
1214 1198 else {
1215 1199 *diagnostic = SADB_X_DIAGNOSTIC_MISSING_SA;
1216 1200 return (EINVAL);
1217 1201 }
1218 1202 return (sadb_purge_sa(mp, ksi,
1219 1203 (sin->sin_family == AF_INET6) ? &ahstack->ah_sadb.s_v6 :
1220 1204 &ahstack->ah_sadb.s_v4, diagnostic, ahstack->ah_pfkey_q));
1221 1205 }
1222 1206
1223 1207 return (sadb_delget_sa(mp, ksi, &ahstack->ah_sadb, diagnostic,
1224 1208 ahstack->ah_pfkey_q, sadb_msg_type));
1225 1209 }
1226 1210
1227 1211 /* Refactor me */
1228 1212 /*
1229 1213 * Convert the entire contents of all of AH's SA tables into PF_KEY SADB_DUMP
1230 1214 * messages.
1231 1215 */
1232 1216 static void
1233 1217 ah_dump(mblk_t *mp, keysock_in_t *ksi, ipsecah_stack_t *ahstack)
1234 1218 {
1235 1219 int error;
1236 1220 sadb_msg_t *samsg;
1237 1221
1238 1222 /*
1239 1223 * Dump each fanout, bailing if error is non-zero.
1240 1224 */
1241 1225
1242 1226 error = sadb_dump(ahstack->ah_pfkey_q, mp, ksi, &ahstack->ah_sadb.s_v4);
1243 1227 if (error != 0)
1244 1228 goto bail;
1245 1229
1246 1230 error = sadb_dump(ahstack->ah_pfkey_q, mp, ksi, &ahstack->ah_sadb.s_v6);
1247 1231 bail:
1248 1232 ASSERT(mp->b_cont != NULL);
1249 1233 samsg = (sadb_msg_t *)mp->b_cont->b_rptr;
1250 1234 samsg->sadb_msg_errno = (uint8_t)error;
1251 1235 sadb_pfkey_echo(ahstack->ah_pfkey_q, mp,
1252 1236 (sadb_msg_t *)mp->b_cont->b_rptr, ksi, NULL);
1253 1237 }
1254 1238
1255 1239 /*
1256 1240 * First-cut reality check for an inbound PF_KEY message.
1257 1241 */
1258 1242 static boolean_t
1259 1243 ah_pfkey_reality_failures(mblk_t *mp, keysock_in_t *ksi,
1260 1244 ipsecah_stack_t *ahstack)
1261 1245 {
1262 1246 int diagnostic;
1263 1247
1264 1248 if (mp->b_cont == NULL) {
1265 1249 freemsg(mp);
1266 1250 return (B_TRUE);
1267 1251 }
1268 1252
1269 1253 if (ksi->ks_in_extv[SADB_EXT_KEY_ENCRYPT] != NULL) {
1270 1254 diagnostic = SADB_X_DIAGNOSTIC_EKEY_PRESENT;
1271 1255 goto badmsg;
1272 1256 }
1273 1257 if (ksi->ks_in_extv[SADB_EXT_PROPOSAL] != NULL) {
1274 1258 diagnostic = SADB_X_DIAGNOSTIC_PROP_PRESENT;
1275 1259 goto badmsg;
1276 1260 }
1277 1261 if (ksi->ks_in_extv[SADB_EXT_SUPPORTED_AUTH] != NULL ||
1278 1262 ksi->ks_in_extv[SADB_EXT_SUPPORTED_ENCRYPT] != NULL) {
1279 1263 diagnostic = SADB_X_DIAGNOSTIC_SUPP_PRESENT;
1280 1264 goto badmsg;
1281 1265 }
1282 1266 return (B_FALSE); /* False ==> no failures */
1283 1267
1284 1268 badmsg:
1285 1269 sadb_pfkey_error(ahstack->ah_pfkey_q, mp, EINVAL,
1286 1270 diagnostic, ksi->ks_in_serial);
1287 1271 return (B_TRUE); /* True ==> failures */
1288 1272 }
1289 1273
1290 1274 /*
1291 1275 * AH parsing of PF_KEY messages. Keysock did most of the really silly
1292 1276 * error cases. What I receive is a fully-formed, syntactically legal
1293 1277 * PF_KEY message. I then need to check semantics...
1294 1278 *
1295 1279 * This code may become common to AH and ESP. Stay tuned.
1296 1280 *
1297 1281 * I also make the assumption that db_ref's are cool. If this assumption
1298 1282 * is wrong, this means that someone other than keysock or me has been
1299 1283 * mucking with PF_KEY messages.
1300 1284 */
1301 1285 static void
1302 1286 ah_parse_pfkey(mblk_t *mp, ipsecah_stack_t *ahstack)
1303 1287 {
1304 1288 mblk_t *msg = mp->b_cont;
1305 1289 sadb_msg_t *samsg;
1306 1290 keysock_in_t *ksi;
1307 1291 int error;
1308 1292 int diagnostic = SADB_X_DIAGNOSTIC_NONE;
1309 1293
1310 1294 ASSERT(msg != NULL);
1311 1295
1312 1296 samsg = (sadb_msg_t *)msg->b_rptr;
1313 1297 ksi = (keysock_in_t *)mp->b_rptr;
1314 1298
1315 1299 /*
1316 1300 * If applicable, convert unspecified AF_INET6 to unspecified
1317 1301 * AF_INET.
1318 1302 */
1319 1303 if (!sadb_addrfix(ksi, ahstack->ah_pfkey_q, mp,
1320 1304 ahstack->ipsecah_netstack) ||
1321 1305 ah_pfkey_reality_failures(mp, ksi, ahstack)) {
1322 1306 return;
1323 1307 }
1324 1308
1325 1309 switch (samsg->sadb_msg_type) {
1326 1310 case SADB_ADD:
1327 1311 error = ah_add_sa(mp, ksi, &diagnostic,
1328 1312 ahstack->ipsecah_netstack);
1329 1313 if (error != 0) {
1330 1314 sadb_pfkey_error(ahstack->ah_pfkey_q, mp, error,
1331 1315 diagnostic, ksi->ks_in_serial);
1332 1316 }
1333 1317 /* else ah_add_sa() took care of things. */
1334 1318 break;
1335 1319 case SADB_DELETE:
1336 1320 case SADB_X_DELPAIR:
1337 1321 case SADB_X_DELPAIR_STATE:
1338 1322 error = ah_del_sa(mp, ksi, &diagnostic, ahstack,
1339 1323 samsg->sadb_msg_type);
1340 1324 if (error != 0) {
1341 1325 sadb_pfkey_error(ahstack->ah_pfkey_q, mp, error,
1342 1326 diagnostic, ksi->ks_in_serial);
1343 1327 }
1344 1328 /* Else ah_del_sa() took care of things. */
1345 1329 break;
1346 1330 case SADB_GET:
1347 1331 error = sadb_delget_sa(mp, ksi, &ahstack->ah_sadb, &diagnostic,
1348 1332 ahstack->ah_pfkey_q, samsg->sadb_msg_type);
1349 1333 if (error != 0) {
1350 1334 sadb_pfkey_error(ahstack->ah_pfkey_q, mp, error,
1351 1335 diagnostic, ksi->ks_in_serial);
1352 1336 }
1353 1337 /* Else sadb_get_sa() took care of things. */
1354 1338 break;
1355 1339 case SADB_FLUSH:
1356 1340 sadbp_flush(&ahstack->ah_sadb, ahstack->ipsecah_netstack);
1357 1341 sadb_pfkey_echo(ahstack->ah_pfkey_q, mp, samsg, ksi, NULL);
1358 1342 break;
1359 1343 case SADB_REGISTER:
1360 1344 /*
1361 1345 * Hmmm, let's do it! Check for extensions (there should
1362 1346 * be none), extract the fields, call ah_register_out(),
1363 1347 * then either free or report an error.
1364 1348 *
1365 1349 * Keysock takes care of the PF_KEY bookkeeping for this.
1366 1350 */
1367 1351 if (ah_register_out(samsg->sadb_msg_seq, samsg->sadb_msg_pid,
1368 1352 ksi->ks_in_serial, ahstack, msg_getcred(mp, NULL))) {
1369 1353 freemsg(mp);
1370 1354 } else {
1371 1355 /*
1372 1356 * Only way this path hits is if there is a memory
1373 1357 * failure. It will not return B_FALSE because of
1374 1358 * lack of ah_pfkey_q if I am in wput().
1375 1359 */
1376 1360 sadb_pfkey_error(ahstack->ah_pfkey_q, mp, ENOMEM,
1377 1361 diagnostic, ksi->ks_in_serial);
1378 1362 }
1379 1363 break;
1380 1364 case SADB_UPDATE:
1381 1365 case SADB_X_UPDATEPAIR:
1382 1366 /*
1383 1367 * Find a larval, if not there, find a full one and get
1384 1368 * strict.
1385 1369 */
1386 1370 error = ah_update_sa(mp, ksi, &diagnostic, ahstack,
1387 1371 samsg->sadb_msg_type);
1388 1372 if (error != 0) {
1389 1373 sadb_pfkey_error(ahstack->ah_pfkey_q, mp, error,
1390 1374 diagnostic, ksi->ks_in_serial);
1391 1375 }
1392 1376 /* else ah_update_sa() took care of things. */
1393 1377 break;
1394 1378 case SADB_GETSPI:
1395 1379 /*
1396 1380 * Reserve a new larval entry.
1397 1381 */
1398 1382 ah_getspi(mp, ksi, ahstack);
1399 1383 break;
1400 1384 case SADB_ACQUIRE:
1401 1385 /*
1402 1386 * Find larval and/or ACQUIRE record and kill it (them), I'm
1403 1387 * most likely an error. Inbound ACQUIRE messages should only
1404 1388 * have the base header.
1405 1389 */
1406 1390 sadb_in_acquire(samsg, &ahstack->ah_sadb, ahstack->ah_pfkey_q,
1407 1391 ahstack->ipsecah_netstack);
1408 1392 freemsg(mp);
1409 1393 break;
1410 1394 case SADB_DUMP:
1411 1395 /*
1412 1396 * Dump all entries.
1413 1397 */
1414 1398 ah_dump(mp, ksi, ahstack);
1415 1399 /* ah_dump will take care of the return message, etc. */
1416 1400 break;
1417 1401 case SADB_EXPIRE:
1418 1402 /* Should never reach me. */
1419 1403 sadb_pfkey_error(ahstack->ah_pfkey_q, mp, EOPNOTSUPP,
1420 1404 diagnostic, ksi->ks_in_serial);
1421 1405 break;
1422 1406 default:
1423 1407 sadb_pfkey_error(ahstack->ah_pfkey_q, mp, EINVAL,
1424 1408 SADB_X_DIAGNOSTIC_UNKNOWN_MSG, ksi->ks_in_serial);
1425 1409 break;
1426 1410 }
1427 1411 }
1428 1412
1429 1413 /*
1430 1414 * Handle case where PF_KEY says it can't find a keysock for one of my
1431 1415 * ACQUIRE messages.
1432 1416 */
1433 1417 static void
1434 1418 ah_keysock_no_socket(mblk_t *mp, ipsecah_stack_t *ahstack)
1435 1419 {
1436 1420 sadb_msg_t *samsg;
1437 1421 keysock_out_err_t *kse = (keysock_out_err_t *)mp->b_rptr;
1438 1422
1439 1423 if (mp->b_cont == NULL) {
1440 1424 freemsg(mp);
1441 1425 return;
1442 1426 }
1443 1427 samsg = (sadb_msg_t *)mp->b_cont->b_rptr;
1444 1428
1445 1429 /*
1446 1430 * If keysock can't find any registered, delete the acquire record
1447 1431 * immediately, and handle errors.
1448 1432 */
1449 1433 if (samsg->sadb_msg_type == SADB_ACQUIRE) {
1450 1434 samsg->sadb_msg_errno = kse->ks_err_errno;
1451 1435 samsg->sadb_msg_len = SADB_8TO64(sizeof (*samsg));
1452 1436 /*
1453 1437 * Use the write-side of the ah_pfkey_q
1454 1438 */
1455 1439 sadb_in_acquire(samsg, &ahstack->ah_sadb,
1456 1440 WR(ahstack->ah_pfkey_q), ahstack->ipsecah_netstack);
1457 1441 }
1458 1442
1459 1443 freemsg(mp);
1460 1444 }
1461 1445
1462 1446 /*
1463 1447 * AH module write put routine.
1464 1448 */
1465 1449 static void
1466 1450 ipsecah_wput(queue_t *q, mblk_t *mp)
1467 1451 {
1468 1452 ipsec_info_t *ii;
1469 1453 struct iocblk *iocp;
1470 1454 ipsecah_stack_t *ahstack = (ipsecah_stack_t *)q->q_ptr;
1471 1455
1472 1456 ah3dbg(ahstack, ("In ah_wput().\n"));
1473 1457
1474 1458 /* NOTE: Each case must take care of freeing or passing mp. */
1475 1459 switch (mp->b_datap->db_type) {
1476 1460 case M_CTL:
1477 1461 if ((mp->b_wptr - mp->b_rptr) < sizeof (ipsec_info_t)) {
1478 1462 /* Not big enough message. */
1479 1463 freemsg(mp);
1480 1464 break;
1481 1465 }
1482 1466 ii = (ipsec_info_t *)mp->b_rptr;
1483 1467
1484 1468 switch (ii->ipsec_info_type) {
1485 1469 case KEYSOCK_OUT_ERR:
1486 1470 ah1dbg(ahstack, ("Got KEYSOCK_OUT_ERR message.\n"));
1487 1471 ah_keysock_no_socket(mp, ahstack);
1488 1472 break;
1489 1473 case KEYSOCK_IN:
1490 1474 AH_BUMP_STAT(ahstack, keysock_in);
1491 1475 ah3dbg(ahstack, ("Got KEYSOCK_IN message.\n"));
1492 1476
1493 1477 /* Parse the message. */
1494 1478 ah_parse_pfkey(mp, ahstack);
1495 1479 break;
1496 1480 case KEYSOCK_HELLO:
1497 1481 sadb_keysock_hello(&ahstack->ah_pfkey_q, q, mp,
1498 1482 ah_ager, (void *)ahstack, &ahstack->ah_event,
1499 1483 SADB_SATYPE_AH);
1500 1484 break;
1501 1485 default:
1502 1486 ah1dbg(ahstack, ("Got M_CTL from above of 0x%x.\n",
1503 1487 ii->ipsec_info_type));
1504 1488 freemsg(mp);
1505 1489 break;
1506 1490 }
1507 1491 break;
1508 1492 case M_IOCTL:
1509 1493 iocp = (struct iocblk *)mp->b_rptr;
1510 1494 switch (iocp->ioc_cmd) {
1511 1495 case ND_SET:
1512 1496 case ND_GET:
1513 1497 if (nd_getset(q, ahstack->ipsecah_g_nd, mp)) {
1514 1498 qreply(q, mp);
1515 1499 return;
1516 1500 } else {
1517 1501 iocp->ioc_error = ENOENT;
1518 1502 }
1519 1503 /* FALLTHRU */
1520 1504 default:
1521 1505 /* We really don't support any other ioctls, do we? */
1522 1506
1523 1507 /* Return EINVAL */
1524 1508 if (iocp->ioc_error != ENOENT)
1525 1509 iocp->ioc_error = EINVAL;
1526 1510 iocp->ioc_count = 0;
1527 1511 mp->b_datap->db_type = M_IOCACK;
1528 1512 qreply(q, mp);
1529 1513 return;
1530 1514 }
1531 1515 default:
1532 1516 ah3dbg(ahstack,
1533 1517 ("Got default message, type %d, passing to IP.\n",
1534 1518 mp->b_datap->db_type));
1535 1519 putnext(q, mp);
1536 1520 }
1537 1521 }
1538 1522
1539 1523 /* Refactor me */
1540 1524 /*
1541 1525 * Updating use times can be tricky business if the ipsa_haspeer flag is
1542 1526 * set. This function is called once in an SA's lifetime.
1543 1527 *
1544 1528 * Caller has to REFRELE "assoc" which is passed in. This function has
1545 1529 * to REFRELE any peer SA that is obtained.
1546 1530 */
1547 1531 static void
1548 1532 ah_set_usetime(ipsa_t *assoc, boolean_t inbound)
1549 1533 {
1550 1534 ipsa_t *inassoc, *outassoc;
1551 1535 isaf_t *bucket;
1552 1536 sadb_t *sp;
1553 1537 int outhash;
1554 1538 boolean_t isv6;
1555 1539 netstack_t *ns = assoc->ipsa_netstack;
1556 1540 ipsecah_stack_t *ahstack = ns->netstack_ipsecah;
1557 1541
1558 1542 /* No peer? No problem! */
1559 1543 if (!assoc->ipsa_haspeer) {
1560 1544 sadb_set_usetime(assoc);
1561 1545 return;
1562 1546 }
1563 1547
1564 1548 /*
1565 1549 * Otherwise, we want to grab both the original assoc and its peer.
1566 1550 * There might be a race for this, but if it's a real race, the times
1567 1551 * will be out-of-synch by at most a second, and since our time
1568 1552 * granularity is a second, this won't be a problem.
1569 1553 *
1570 1554 * If we need tight synchronization on the peer SA, then we need to
1571 1555 * reconsider.
1572 1556 */
1573 1557
1574 1558 /* Use address family to select IPv6/IPv4 */
1575 1559 isv6 = (assoc->ipsa_addrfam == AF_INET6);
1576 1560 if (isv6) {
1577 1561 sp = &ahstack->ah_sadb.s_v6;
1578 1562 } else {
1579 1563 sp = &ahstack->ah_sadb.s_v4;
1580 1564 ASSERT(assoc->ipsa_addrfam == AF_INET);
1581 1565 }
1582 1566 if (inbound) {
1583 1567 inassoc = assoc;
1584 1568 if (isv6)
1585 1569 outhash = OUTBOUND_HASH_V6(sp,
1586 1570 *((in6_addr_t *)&inassoc->ipsa_dstaddr));
1587 1571 else
1588 1572 outhash = OUTBOUND_HASH_V4(sp,
1589 1573 *((ipaddr_t *)&inassoc->ipsa_dstaddr));
1590 1574 bucket = &sp->sdb_of[outhash];
1591 1575
1592 1576 mutex_enter(&bucket->isaf_lock);
1593 1577 outassoc = ipsec_getassocbyspi(bucket, inassoc->ipsa_spi,
1594 1578 inassoc->ipsa_srcaddr, inassoc->ipsa_dstaddr,
1595 1579 inassoc->ipsa_addrfam);
1596 1580 mutex_exit(&bucket->isaf_lock);
1597 1581 if (outassoc == NULL) {
1598 1582 /* Q: Do we wish to set haspeer == B_FALSE? */
1599 1583 ah0dbg(("ah_set_usetime: "
1600 1584 "can't find peer for inbound.\n"));
1601 1585 sadb_set_usetime(inassoc);
1602 1586 return;
1603 1587 }
1604 1588 } else {
1605 1589 outassoc = assoc;
1606 1590 bucket = INBOUND_BUCKET(sp, outassoc->ipsa_spi);
1607 1591 mutex_enter(&bucket->isaf_lock);
1608 1592 inassoc = ipsec_getassocbyspi(bucket, outassoc->ipsa_spi,
1609 1593 outassoc->ipsa_srcaddr, outassoc->ipsa_dstaddr,
1610 1594 outassoc->ipsa_addrfam);
1611 1595 mutex_exit(&bucket->isaf_lock);
1612 1596 if (inassoc == NULL) {
1613 1597 /* Q: Do we wish to set haspeer == B_FALSE? */
1614 1598 ah0dbg(("ah_set_usetime: "
1615 1599 "can't find peer for outbound.\n"));
1616 1600 sadb_set_usetime(outassoc);
1617 1601 return;
1618 1602 }
1619 1603 }
1620 1604
1621 1605 /* Update usetime on both. */
1622 1606 sadb_set_usetime(inassoc);
1623 1607 sadb_set_usetime(outassoc);
1624 1608
1625 1609 /*
1626 1610 * REFRELE any peer SA.
1627 1611 *
1628 1612 * Because of the multi-line macro nature of IPSA_REFRELE, keep
1629 1613 * them in { }.
1630 1614 */
1631 1615 if (inbound) {
1632 1616 IPSA_REFRELE(outassoc);
1633 1617 } else {
1634 1618 IPSA_REFRELE(inassoc);
1635 1619 }
1636 1620 }
1637 1621
1638 1622 /* Refactor me */
1639 1623 /*
1640 1624 * Add a number of bytes to what the SA has protected so far. Return
1641 1625 * B_TRUE if the SA can still protect that many bytes.
1642 1626 *
1643 1627 * Caller must REFRELE the passed-in assoc. This function must REFRELE
1644 1628 * any obtained peer SA.
1645 1629 */
1646 1630 static boolean_t
1647 1631 ah_age_bytes(ipsa_t *assoc, uint64_t bytes, boolean_t inbound)
1648 1632 {
1649 1633 ipsa_t *inassoc, *outassoc;
1650 1634 isaf_t *bucket;
1651 1635 boolean_t inrc, outrc, isv6;
1652 1636 sadb_t *sp;
1653 1637 int outhash;
1654 1638 netstack_t *ns = assoc->ipsa_netstack;
1655 1639 ipsecah_stack_t *ahstack = ns->netstack_ipsecah;
1656 1640
1657 1641 /* No peer? No problem! */
1658 1642 if (!assoc->ipsa_haspeer) {
1659 1643 return (sadb_age_bytes(ahstack->ah_pfkey_q, assoc, bytes,
1660 1644 B_TRUE));
1661 1645 }
1662 1646
1663 1647 /*
1664 1648 * Otherwise, we want to grab both the original assoc and its peer.
1665 1649 * There might be a race for this, but if it's a real race, two
1666 1650 * expire messages may occur. We limit this by only sending the
1667 1651 * expire message on one of the peers, we'll pick the inbound
1668 1652 * arbitrarily.
1669 1653 *
1670 1654 * If we need tight synchronization on the peer SA, then we need to
1671 1655 * reconsider.
1672 1656 */
1673 1657
1674 1658 /* Pick v4/v6 bucket based on addrfam. */
1675 1659 isv6 = (assoc->ipsa_addrfam == AF_INET6);
1676 1660 if (isv6) {
1677 1661 sp = &ahstack->ah_sadb.s_v6;
1678 1662 } else {
1679 1663 sp = &ahstack->ah_sadb.s_v4;
1680 1664 ASSERT(assoc->ipsa_addrfam == AF_INET);
1681 1665 }
1682 1666 if (inbound) {
1683 1667 inassoc = assoc;
1684 1668 if (isv6)
1685 1669 outhash = OUTBOUND_HASH_V6(sp,
1686 1670 *((in6_addr_t *)&inassoc->ipsa_dstaddr));
1687 1671 else
1688 1672 outhash = OUTBOUND_HASH_V4(sp,
1689 1673 *((ipaddr_t *)&inassoc->ipsa_dstaddr));
1690 1674 bucket = &sp->sdb_of[outhash];
1691 1675 mutex_enter(&bucket->isaf_lock);
1692 1676 outassoc = ipsec_getassocbyspi(bucket, inassoc->ipsa_spi,
1693 1677 inassoc->ipsa_srcaddr, inassoc->ipsa_dstaddr,
1694 1678 inassoc->ipsa_addrfam);
1695 1679 mutex_exit(&bucket->isaf_lock);
1696 1680 if (outassoc == NULL) {
1697 1681 /* Q: Do we wish to set haspeer == B_FALSE? */
1698 1682 ah0dbg(("ah_age_bytes: "
1699 1683 "can't find peer for inbound.\n"));
1700 1684 return (sadb_age_bytes(ahstack->ah_pfkey_q, inassoc,
1701 1685 bytes, B_TRUE));
1702 1686 }
1703 1687 } else {
1704 1688 outassoc = assoc;
1705 1689 bucket = INBOUND_BUCKET(sp, outassoc->ipsa_spi);
1706 1690 mutex_enter(&bucket->isaf_lock);
1707 1691 inassoc = ipsec_getassocbyspi(bucket, outassoc->ipsa_spi,
1708 1692 outassoc->ipsa_srcaddr, outassoc->ipsa_dstaddr,
1709 1693 outassoc->ipsa_addrfam);
1710 1694 mutex_exit(&bucket->isaf_lock);
1711 1695 if (inassoc == NULL) {
1712 1696 /* Q: Do we wish to set haspeer == B_FALSE? */
1713 1697 ah0dbg(("ah_age_bytes: "
1714 1698 "can't find peer for outbound.\n"));
1715 1699 return (sadb_age_bytes(ahstack->ah_pfkey_q, outassoc,
1716 1700 bytes, B_TRUE));
1717 1701 }
1718 1702 }
1719 1703
1720 1704 inrc = sadb_age_bytes(ahstack->ah_pfkey_q, inassoc, bytes, B_TRUE);
1721 1705 outrc = sadb_age_bytes(ahstack->ah_pfkey_q, outassoc, bytes, B_FALSE);
1722 1706
1723 1707 /*
1724 1708 * REFRELE any peer SA.
1725 1709 *
1726 1710 * Because of the multi-line macro nature of IPSA_REFRELE, keep
1727 1711 * them in { }.
|
↓ open down ↓ |
566 lines elided |
↑ open up ↑ |
1728 1712 */
1729 1713 if (inbound) {
1730 1714 IPSA_REFRELE(outassoc);
1731 1715 } else {
1732 1716 IPSA_REFRELE(inassoc);
1733 1717 }
1734 1718
1735 1719 return (inrc && outrc);
1736 1720 }
1737 1721
1738 -/*
1739 - * Perform the really difficult work of inserting the proposed situation.
1740 - * Called while holding the algorithm lock.
1741 - */
1742 -static void
1743 -ah_insert_prop(sadb_prop_t *prop, ipsacq_t *acqrec, uint_t combs,
1744 - netstack_t *ns)
1745 -{
1746 - sadb_comb_t *comb = (sadb_comb_t *)(prop + 1);
1747 - ipsec_action_t *ap;
1748 - ipsec_prot_t *prot;
1749 - ipsecah_stack_t *ahstack = ns->netstack_ipsecah;
1750 - ipsec_stack_t *ipss = ns->netstack_ipsec;
1751 -
1752 - ASSERT(MUTEX_HELD(&ipss->ipsec_alg_lock));
1753 -
1754 - prop->sadb_prop_exttype = SADB_EXT_PROPOSAL;
1755 - prop->sadb_prop_len = SADB_8TO64(sizeof (sadb_prop_t));
1756 - *(uint32_t *)(&prop->sadb_prop_replay) = 0; /* Quick zero-out! */
1757 -
1758 - prop->sadb_prop_replay = ahstack->ipsecah_replay_size;
1759 -
1760 - /*
1761 - * Based upon algorithm properties, and what-not, prioritize a
1762 - * proposal, based on the ordering of the AH algorithms in the
1763 - * alternatives in the policy rule or socket that was placed
1764 - * in the acquire record.
1765 - */
1766 -
1767 - for (ap = acqrec->ipsacq_act; ap != NULL;
1768 - ap = ap->ipa_next) {
1769 - ipsec_alginfo_t *aalg;
1770 -
1771 - if ((ap->ipa_act.ipa_type != IPSEC_POLICY_APPLY) ||
1772 - (!ap->ipa_act.ipa_apply.ipp_use_ah))
1773 - continue;
1774 -
1775 - prot = &ap->ipa_act.ipa_apply;
1776 -
1777 - ASSERT(prot->ipp_auth_alg > 0);
1778 -
1779 - aalg = ipss->ipsec_alglists[IPSEC_ALG_AUTH]
1780 - [prot->ipp_auth_alg];
1781 - if (aalg == NULL || !ALG_VALID(aalg))
1782 - continue;
1783 -
1784 - /* XXX check aalg for duplicates??.. */
1785 -
1786 - comb->sadb_comb_flags = 0;
1787 - comb->sadb_comb_reserved = 0;
1788 - comb->sadb_comb_encrypt = 0;
1789 - comb->sadb_comb_encrypt_minbits = 0;
1790 - comb->sadb_comb_encrypt_maxbits = 0;
1791 -
1792 - comb->sadb_comb_auth = aalg->alg_id;
1793 - comb->sadb_comb_auth_minbits =
1794 - MAX(prot->ipp_ah_minbits, aalg->alg_ef_minbits);
1795 - comb->sadb_comb_auth_maxbits =
1796 - MIN(prot->ipp_ah_maxbits, aalg->alg_ef_maxbits);
1797 -
1798 - /*
1799 - * The following may be based on algorithm
1800 - * properties, but in the meantime, we just pick
1801 - * some good, sensible numbers. Key mgmt. can
1802 - * (and perhaps should) be the place to finalize
1803 - * such decisions.
1804 - */
1805 -
1806 - /*
1807 - * No limits on allocations, since we really don't
1808 - * support that concept currently.
1809 - */
1810 - comb->sadb_comb_soft_allocations = 0;
1811 - comb->sadb_comb_hard_allocations = 0;
1812 -
1813 - /*
1814 - * These may want to come from policy rule..
1815 - */
1816 - comb->sadb_comb_soft_bytes =
1817 - ahstack->ipsecah_default_soft_bytes;
1818 - comb->sadb_comb_hard_bytes =
1819 - ahstack->ipsecah_default_hard_bytes;
1820 - comb->sadb_comb_soft_addtime =
1821 - ahstack->ipsecah_default_soft_addtime;
1822 - comb->sadb_comb_hard_addtime =
1823 - ahstack->ipsecah_default_hard_addtime;
1824 - comb->sadb_comb_soft_usetime =
1825 - ahstack->ipsecah_default_soft_usetime;
1826 - comb->sadb_comb_hard_usetime =
1827 - ahstack->ipsecah_default_hard_usetime;
1828 -
1829 - prop->sadb_prop_len += SADB_8TO64(sizeof (*comb));
1830 - if (--combs == 0)
1831 - return; /* out of space.. */
1832 - comb++;
1833 - }
1834 -}
1835 -
1836 -/*
1837 - * Prepare and actually send the SADB_ACQUIRE message to PF_KEY.
1838 - */
1839 -static void
1840 -ah_send_acquire(ipsacq_t *acqrec, mblk_t *extended, netstack_t *ns)
1841 -{
1842 - uint_t combs;
1843 - sadb_msg_t *samsg;
1844 - sadb_prop_t *prop;
1845 - mblk_t *pfkeymp, *msgmp;
1846 - ipsecah_stack_t *ahstack = ns->netstack_ipsecah;
1847 - ipsec_stack_t *ipss = ns->netstack_ipsec;
1848 -
1849 - AH_BUMP_STAT(ahstack, acquire_requests);
1850 -
1851 - if (ahstack->ah_pfkey_q == NULL) {
1852 - mutex_exit(&acqrec->ipsacq_lock);
1853 - return;
1854 - }
1855 -
1856 - /* Set up ACQUIRE. */
1857 - pfkeymp = sadb_setup_acquire(acqrec, SADB_SATYPE_AH,
1858 - ns->netstack_ipsec);
1859 - if (pfkeymp == NULL) {
1860 - ah0dbg(("sadb_setup_acquire failed.\n"));
1861 - mutex_exit(&acqrec->ipsacq_lock);
1862 - return;
1863 - }
1864 - ASSERT(MUTEX_HELD(&ipss->ipsec_alg_lock));
1865 - combs = ipss->ipsec_nalgs[IPSEC_ALG_AUTH];
1866 - msgmp = pfkeymp->b_cont;
1867 - samsg = (sadb_msg_t *)(msgmp->b_rptr);
1868 -
1869 - /* Insert proposal here. */
1870 -
1871 - prop = (sadb_prop_t *)(((uint64_t *)samsg) + samsg->sadb_msg_len);
1872 - ah_insert_prop(prop, acqrec, combs, ns);
1873 - samsg->sadb_msg_len += prop->sadb_prop_len;
1874 - msgmp->b_wptr += SADB_64TO8(samsg->sadb_msg_len);
1875 -
1876 - mutex_exit(&ipss->ipsec_alg_lock);
1877 -
1878 - /*
1879 - * Must mutex_exit() before sending PF_KEY message up, in
1880 - * order to avoid recursive mutex_enter() if there are no registered
1881 - * listeners.
1882 - *
1883 - * Once I've sent the message, I'm cool anyway.
1884 - */
1885 - mutex_exit(&acqrec->ipsacq_lock);
1886 - if (extended != NULL) {
1887 - putnext(ahstack->ah_pfkey_q, extended);
1888 - }
1889 - putnext(ahstack->ah_pfkey_q, pfkeymp);
1890 -}
1891 -
1892 1722 /* Refactor me */
1893 1723 /*
1894 1724 * Handle the SADB_GETSPI message. Create a larval SA.
1895 1725 */
1896 1726 static void
1897 1727 ah_getspi(mblk_t *mp, keysock_in_t *ksi, ipsecah_stack_t *ahstack)
1898 1728 {
1899 1729 ipsa_t *newbie, *target;
1900 1730 isaf_t *outbound, *inbound;
1901 1731 int rc, diagnostic;
1902 1732 sadb_sa_t *assoc;
1903 1733 keysock_out_t *kso;
1904 1734 uint32_t newspi;
1905 1735
1906 1736 /*
1907 1737 * Randomly generate a proposed SPI value.
1908 1738 */
1909 1739 if (cl_inet_getspi != NULL) {
1910 1740 cl_inet_getspi(ahstack->ipsecah_netstack->netstack_stackid,
1911 1741 IPPROTO_AH, (uint8_t *)&newspi, sizeof (uint32_t), NULL);
1912 1742 } else {
1913 1743 (void) random_get_pseudo_bytes((uint8_t *)&newspi,
1914 1744 sizeof (uint32_t));
1915 1745 }
1916 1746 newbie = sadb_getspi(ksi, newspi, &diagnostic,
1917 1747 ahstack->ipsecah_netstack, IPPROTO_AH);
1918 1748
1919 1749 if (newbie == NULL) {
1920 1750 sadb_pfkey_error(ahstack->ah_pfkey_q, mp, ENOMEM, diagnostic,
1921 1751 ksi->ks_in_serial);
1922 1752 return;
1923 1753 } else if (newbie == (ipsa_t *)-1) {
1924 1754 sadb_pfkey_error(ahstack->ah_pfkey_q, mp, EINVAL, diagnostic,
1925 1755 ksi->ks_in_serial);
1926 1756 return;
1927 1757 }
1928 1758
1929 1759 /*
1930 1760 * XXX - We may randomly collide. We really should recover from this.
1931 1761 * Unfortunately, that could require spending way-too-much-time
1932 1762 * in here. For now, let the user retry.
1933 1763 */
1934 1764
1935 1765 if (newbie->ipsa_addrfam == AF_INET6) {
1936 1766 outbound = OUTBOUND_BUCKET_V6(&ahstack->ah_sadb.s_v6,
1937 1767 *(uint32_t *)(newbie->ipsa_dstaddr));
1938 1768 inbound = INBOUND_BUCKET(&ahstack->ah_sadb.s_v6,
1939 1769 newbie->ipsa_spi);
1940 1770 } else {
1941 1771 outbound = OUTBOUND_BUCKET_V4(&ahstack->ah_sadb.s_v4,
1942 1772 *(uint32_t *)(newbie->ipsa_dstaddr));
1943 1773 inbound = INBOUND_BUCKET(&ahstack->ah_sadb.s_v4,
1944 1774 newbie->ipsa_spi);
1945 1775 }
1946 1776
1947 1777 mutex_enter(&outbound->isaf_lock);
1948 1778 mutex_enter(&inbound->isaf_lock);
1949 1779
1950 1780 /*
1951 1781 * Check for collisions (i.e. did sadb_getspi() return with something
1952 1782 * that already exists?).
1953 1783 *
1954 1784 * Try outbound first. Even though SADB_GETSPI is traditionally
1955 1785 * for inbound SAs, you never know what a user might do.
1956 1786 */
1957 1787 target = ipsec_getassocbyspi(outbound, newbie->ipsa_spi,
1958 1788 newbie->ipsa_srcaddr, newbie->ipsa_dstaddr, newbie->ipsa_addrfam);
1959 1789 if (target == NULL) {
1960 1790 target = ipsec_getassocbyspi(inbound, newbie->ipsa_spi,
1961 1791 newbie->ipsa_srcaddr, newbie->ipsa_dstaddr,
1962 1792 newbie->ipsa_addrfam);
1963 1793 }
1964 1794
1965 1795 /*
1966 1796 * I don't have collisions elsewhere!
1967 1797 * (Nor will I because I'm still holding inbound/outbound locks.)
1968 1798 */
1969 1799
1970 1800 if (target != NULL) {
1971 1801 rc = EEXIST;
1972 1802 IPSA_REFRELE(target);
1973 1803 } else {
1974 1804 /*
1975 1805 * sadb_insertassoc() also checks for collisions, so
1976 1806 * if there's a colliding larval entry, rc will be set
1977 1807 * to EEXIST.
1978 1808 */
1979 1809 rc = sadb_insertassoc(newbie, inbound);
1980 1810 newbie->ipsa_hardexpiretime = gethrestime_sec();
1981 1811 newbie->ipsa_hardexpiretime += ahstack->ipsecah_larval_timeout;
1982 1812 }
1983 1813
1984 1814 /*
1985 1815 * Can exit outbound mutex. Hold inbound until we're done with
1986 1816 * newbie.
1987 1817 */
1988 1818 mutex_exit(&outbound->isaf_lock);
1989 1819
1990 1820 if (rc != 0) {
1991 1821 mutex_exit(&inbound->isaf_lock);
1992 1822 IPSA_REFRELE(newbie);
1993 1823 sadb_pfkey_error(ahstack->ah_pfkey_q, mp, rc,
1994 1824 SADB_X_DIAGNOSTIC_NONE, ksi->ks_in_serial);
1995 1825 return;
1996 1826 }
1997 1827
1998 1828 /* Can write here because I'm still holding the bucket lock. */
1999 1829 newbie->ipsa_type = SADB_SATYPE_AH;
2000 1830
2001 1831 /*
2002 1832 * Construct successful return message. We have one thing going
2003 1833 * for us in PF_KEY v2. That's the fact that
2004 1834 * sizeof (sadb_spirange_t) == sizeof (sadb_sa_t)
2005 1835 */
2006 1836 assoc = (sadb_sa_t *)ksi->ks_in_extv[SADB_EXT_SPIRANGE];
2007 1837 assoc->sadb_sa_exttype = SADB_EXT_SA;
2008 1838 assoc->sadb_sa_spi = newbie->ipsa_spi;
2009 1839 *((uint64_t *)(&assoc->sadb_sa_replay)) = 0;
2010 1840 mutex_exit(&inbound->isaf_lock);
2011 1841
2012 1842 /* Convert KEYSOCK_IN to KEYSOCK_OUT. */
2013 1843 kso = (keysock_out_t *)ksi;
2014 1844 kso->ks_out_len = sizeof (*kso);
2015 1845 kso->ks_out_serial = ksi->ks_in_serial;
2016 1846 kso->ks_out_type = KEYSOCK_OUT;
2017 1847
2018 1848 /*
2019 1849 * Can safely putnext() to ah_pfkey_q, because this is a turnaround
2020 1850 * from the ah_pfkey_q.
2021 1851 */
2022 1852 putnext(ahstack->ah_pfkey_q, mp);
2023 1853 }
2024 1854
2025 1855 /*
2026 1856 * IPv6 sends up the ICMP errors for validation and the removal of the AH
2027 1857 * header.
2028 1858 * If succesful, the mp has been modified to not include the AH header so
2029 1859 * that the caller can fanout to the ULP's icmp error handler.
2030 1860 */
2031 1861 static mblk_t *
2032 1862 ah_icmp_error_v6(mblk_t *mp, ip_recv_attr_t *ira, ipsecah_stack_t *ahstack)
2033 1863 {
2034 1864 ip6_t *ip6h, *oip6h;
2035 1865 uint16_t hdr_length, ah_length;
2036 1866 uint8_t *nexthdrp;
2037 1867 ah_t *ah;
2038 1868 icmp6_t *icmp6;
2039 1869 isaf_t *isaf;
2040 1870 ipsa_t *assoc;
2041 1871 uint8_t *post_ah_ptr;
2042 1872 ipsec_stack_t *ipss = ahstack->ipsecah_netstack->netstack_ipsec;
2043 1873
2044 1874 /*
2045 1875 * Eat the cost of a pullupmsg() for now. It makes the rest of this
2046 1876 * code far less convoluted.
2047 1877 */
2048 1878 if (!pullupmsg(mp, -1) ||
2049 1879 !ip_hdr_length_nexthdr_v6(mp, (ip6_t *)mp->b_rptr, &hdr_length,
2050 1880 &nexthdrp) ||
2051 1881 mp->b_rptr + hdr_length + sizeof (icmp6_t) + sizeof (ip6_t) +
2052 1882 sizeof (ah_t) > mp->b_wptr) {
2053 1883 IP_AH_BUMP_STAT(ipss, in_discards);
2054 1884 ip_drop_packet(mp, B_TRUE, ira->ira_ill,
2055 1885 DROPPER(ipss, ipds_ah_nomem),
2056 1886 &ahstack->ah_dropper);
2057 1887 return (NULL);
2058 1888 }
2059 1889
2060 1890 oip6h = (ip6_t *)mp->b_rptr;
2061 1891 icmp6 = (icmp6_t *)((uint8_t *)oip6h + hdr_length);
2062 1892 ip6h = (ip6_t *)(icmp6 + 1);
2063 1893 if (!ip_hdr_length_nexthdr_v6(mp, ip6h, &hdr_length, &nexthdrp)) {
2064 1894 IP_AH_BUMP_STAT(ipss, in_discards);
2065 1895 ip_drop_packet(mp, B_TRUE, ira->ira_ill,
2066 1896 DROPPER(ipss, ipds_ah_bad_v6_hdrs),
2067 1897 &ahstack->ah_dropper);
2068 1898 return (NULL);
2069 1899 }
2070 1900 ah = (ah_t *)((uint8_t *)ip6h + hdr_length);
2071 1901
2072 1902 isaf = OUTBOUND_BUCKET_V6(&ahstack->ah_sadb.s_v6, ip6h->ip6_dst);
2073 1903 mutex_enter(&isaf->isaf_lock);
2074 1904 assoc = ipsec_getassocbyspi(isaf, ah->ah_spi,
2075 1905 (uint32_t *)&ip6h->ip6_src, (uint32_t *)&ip6h->ip6_dst, AF_INET6);
2076 1906 mutex_exit(&isaf->isaf_lock);
2077 1907
2078 1908 if (assoc == NULL) {
2079 1909 IP_AH_BUMP_STAT(ipss, lookup_failure);
2080 1910 IP_AH_BUMP_STAT(ipss, in_discards);
2081 1911 if (ahstack->ipsecah_log_unknown_spi) {
2082 1912 ipsec_assocfailure(info.mi_idnum, 0, 0,
2083 1913 SL_CONSOLE | SL_WARN | SL_ERROR,
2084 1914 "Bad ICMP message - No association for the "
2085 1915 "attached AH header whose spi is 0x%x, "
2086 1916 "sender is 0x%x\n",
2087 1917 ah->ah_spi, &oip6h->ip6_src, AF_INET6,
2088 1918 ahstack->ipsecah_netstack);
2089 1919 }
2090 1920 ip_drop_packet(mp, B_TRUE, ira->ira_ill,
2091 1921 DROPPER(ipss, ipds_ah_no_sa),
2092 1922 &ahstack->ah_dropper);
2093 1923 return (NULL);
2094 1924 }
2095 1925
2096 1926 IPSA_REFRELE(assoc);
2097 1927
2098 1928 /*
2099 1929 * There seems to be a valid association. If there is enough of AH
2100 1930 * header remove it, otherwise bail. One could check whether it has
2101 1931 * complete AH header plus 8 bytes but it does not make sense if an
2102 1932 * icmp error is returned for ICMP messages e.g ICMP time exceeded,
2103 1933 * that are being sent up. Let the caller figure out.
2104 1934 *
2105 1935 * NOTE: ah_length is the number of 32 bit words minus 2.
2106 1936 */
2107 1937 ah_length = (ah->ah_length << 2) + 8;
2108 1938 post_ah_ptr = (uint8_t *)ah + ah_length;
2109 1939
2110 1940 if (post_ah_ptr > mp->b_wptr) {
2111 1941 IP_AH_BUMP_STAT(ipss, in_discards);
2112 1942 ip_drop_packet(mp, B_TRUE, ira->ira_ill,
2113 1943 DROPPER(ipss, ipds_ah_bad_length),
2114 1944 &ahstack->ah_dropper);
2115 1945 return (NULL);
2116 1946 }
2117 1947
2118 1948 ip6h->ip6_plen = htons(ntohs(ip6h->ip6_plen) - ah_length);
2119 1949 *nexthdrp = ah->ah_nexthdr;
2120 1950 ovbcopy(post_ah_ptr, ah,
2121 1951 (size_t)((uintptr_t)mp->b_wptr - (uintptr_t)post_ah_ptr));
2122 1952 mp->b_wptr -= ah_length;
2123 1953
2124 1954 return (mp);
2125 1955 }
2126 1956
2127 1957 /*
2128 1958 * IP sends up the ICMP errors for validation and the removal of
2129 1959 * the AH header.
2130 1960 * If succesful, the mp has been modified to not include the AH header so
2131 1961 * that the caller can fanout to the ULP's icmp error handler.
2132 1962 */
2133 1963 static mblk_t *
2134 1964 ah_icmp_error_v4(mblk_t *mp, ip_recv_attr_t *ira, ipsecah_stack_t *ahstack)
2135 1965 {
2136 1966 mblk_t *mp1;
2137 1967 icmph_t *icmph;
2138 1968 int iph_hdr_length;
2139 1969 int hdr_length;
2140 1970 isaf_t *hptr;
2141 1971 ipsa_t *assoc;
2142 1972 int ah_length;
2143 1973 ipha_t *ipha;
2144 1974 ipha_t *oipha;
2145 1975 ah_t *ah;
2146 1976 uint32_t length;
2147 1977 int alloc_size;
2148 1978 uint8_t nexthdr;
2149 1979 ipsec_stack_t *ipss = ahstack->ipsecah_netstack->netstack_ipsec;
2150 1980
2151 1981 oipha = ipha = (ipha_t *)mp->b_rptr;
2152 1982 iph_hdr_length = IPH_HDR_LENGTH(ipha);
2153 1983 icmph = (icmph_t *)&mp->b_rptr[iph_hdr_length];
2154 1984
2155 1985 ipha = (ipha_t *)&icmph[1];
2156 1986 hdr_length = IPH_HDR_LENGTH(ipha);
2157 1987
2158 1988 /*
2159 1989 * See if we have enough to locate the SPI
2160 1990 */
2161 1991 if ((uchar_t *)ipha + hdr_length + 8 > mp->b_wptr) {
2162 1992 if (!pullupmsg(mp, (uchar_t *)ipha + hdr_length + 8 -
2163 1993 mp->b_rptr)) {
2164 1994 ipsec_rl_strlog(ahstack->ipsecah_netstack,
2165 1995 info.mi_idnum, 0, 0,
2166 1996 SL_WARN | SL_ERROR,
2167 1997 "ICMP error: Small AH header\n");
2168 1998 IP_AH_BUMP_STAT(ipss, in_discards);
2169 1999 ip_drop_packet(mp, B_TRUE, ira->ira_ill,
2170 2000 DROPPER(ipss, ipds_ah_bad_length),
2171 2001 &ahstack->ah_dropper);
2172 2002 return (NULL);
2173 2003 }
2174 2004 icmph = (icmph_t *)&mp->b_rptr[iph_hdr_length];
2175 2005 ipha = (ipha_t *)&icmph[1];
2176 2006 }
2177 2007
2178 2008 ah = (ah_t *)((uint8_t *)ipha + hdr_length);
2179 2009 nexthdr = ah->ah_nexthdr;
2180 2010
2181 2011 hptr = OUTBOUND_BUCKET_V4(&ahstack->ah_sadb.s_v4, ipha->ipha_dst);
2182 2012 mutex_enter(&hptr->isaf_lock);
2183 2013 assoc = ipsec_getassocbyspi(hptr, ah->ah_spi,
2184 2014 (uint32_t *)&ipha->ipha_src, (uint32_t *)&ipha->ipha_dst, AF_INET);
2185 2015 mutex_exit(&hptr->isaf_lock);
2186 2016
2187 2017 if (assoc == NULL) {
2188 2018 IP_AH_BUMP_STAT(ipss, lookup_failure);
2189 2019 IP_AH_BUMP_STAT(ipss, in_discards);
2190 2020 if (ahstack->ipsecah_log_unknown_spi) {
2191 2021 ipsec_assocfailure(info.mi_idnum, 0, 0,
2192 2022 SL_CONSOLE | SL_WARN | SL_ERROR,
2193 2023 "Bad ICMP message - No association for the "
2194 2024 "attached AH header whose spi is 0x%x, "
2195 2025 "sender is 0x%x\n",
2196 2026 ah->ah_spi, &oipha->ipha_src, AF_INET,
2197 2027 ahstack->ipsecah_netstack);
2198 2028 }
2199 2029 ip_drop_packet(mp, B_TRUE, ira->ira_ill,
2200 2030 DROPPER(ipss, ipds_ah_no_sa),
2201 2031 &ahstack->ah_dropper);
2202 2032 return (NULL);
2203 2033 }
2204 2034
2205 2035 IPSA_REFRELE(assoc);
2206 2036 /*
2207 2037 * There seems to be a valid association. If there
2208 2038 * is enough of AH header remove it, otherwise remove
2209 2039 * as much as possible and send it back. One could check
2210 2040 * whether it has complete AH header plus 8 bytes but it
2211 2041 * does not make sense if an icmp error is returned for
2212 2042 * ICMP messages e.g ICMP time exceeded, that are being
2213 2043 * sent up. Let the caller figure out.
2214 2044 *
2215 2045 * NOTE: ah_length is the number of 32 bit words minus 2.
2216 2046 */
2217 2047 ah_length = (ah->ah_length << 2) + 8;
2218 2048
2219 2049 if ((uchar_t *)ipha + hdr_length + ah_length > mp->b_wptr) {
2220 2050 if (mp->b_cont == NULL) {
2221 2051 /*
2222 2052 * There is nothing to pullup. Just remove as
2223 2053 * much as possible. This is a common case for
2224 2054 * IPV4.
2225 2055 */
2226 2056 ah_length = (mp->b_wptr - ((uchar_t *)ipha +
2227 2057 hdr_length));
2228 2058 goto done;
2229 2059 }
2230 2060 /* Pullup the full ah header */
2231 2061 if (!pullupmsg(mp, (uchar_t *)ah + ah_length - mp->b_rptr)) {
2232 2062 /*
2233 2063 * pullupmsg could have failed if there was not
2234 2064 * enough to pullup or memory allocation failed.
2235 2065 * We tried hard, give up now.
2236 2066 */
2237 2067 IP_AH_BUMP_STAT(ipss, in_discards);
2238 2068 ip_drop_packet(mp, B_TRUE, ira->ira_ill,
2239 2069 DROPPER(ipss, ipds_ah_nomem),
2240 2070 &ahstack->ah_dropper);
2241 2071 return (NULL);
2242 2072 }
2243 2073 icmph = (icmph_t *)&mp->b_rptr[iph_hdr_length];
2244 2074 ipha = (ipha_t *)&icmph[1];
2245 2075 }
2246 2076 done:
2247 2077 /*
2248 2078 * Remove the AH header and change the protocol.
2249 2079 * Don't update the spi fields in the ip_recv_attr_t
2250 2080 * as we are called just to validate the
2251 2081 * message attached to the ICMP message.
2252 2082 *
2253 2083 * If we never pulled up since all of the message
2254 2084 * is in one single mblk, we can't remove the AH header
2255 2085 * by just setting the b_wptr to the beginning of the
2256 2086 * AH header. We need to allocate a mblk that can hold
2257 2087 * up until the inner IP header and copy them.
2258 2088 */
2259 2089 alloc_size = iph_hdr_length + sizeof (icmph_t) + hdr_length;
2260 2090
2261 2091 if ((mp1 = allocb(alloc_size, BPRI_LO)) == NULL) {
2262 2092 IP_AH_BUMP_STAT(ipss, in_discards);
2263 2093 ip_drop_packet(mp, B_TRUE, ira->ira_ill,
2264 2094 DROPPER(ipss, ipds_ah_nomem),
2265 2095 &ahstack->ah_dropper);
2266 2096 return (NULL);
2267 2097 }
2268 2098 bcopy(mp->b_rptr, mp1->b_rptr, alloc_size);
2269 2099 mp1->b_wptr += alloc_size;
2270 2100
2271 2101 /*
2272 2102 * Skip whatever we have copied and as much of AH header
2273 2103 * possible. If we still have something left in the original
2274 2104 * message, tag on.
2275 2105 */
2276 2106 mp->b_rptr = (uchar_t *)ipha + hdr_length + ah_length;
2277 2107
2278 2108 if (mp->b_rptr != mp->b_wptr) {
2279 2109 mp1->b_cont = mp;
2280 2110 } else {
2281 2111 if (mp->b_cont != NULL)
2282 2112 mp1->b_cont = mp->b_cont;
2283 2113 freeb(mp);
2284 2114 }
2285 2115
2286 2116 ipha = (ipha_t *)(mp1->b_rptr + iph_hdr_length + sizeof (icmph_t));
2287 2117 ipha->ipha_protocol = nexthdr;
2288 2118 length = ntohs(ipha->ipha_length);
2289 2119 length -= ah_length;
2290 2120 ipha->ipha_length = htons((uint16_t)length);
2291 2121 ipha->ipha_hdr_checksum = 0;
2292 2122 ipha->ipha_hdr_checksum = (uint16_t)ip_csum_hdr(ipha);
2293 2123
2294 2124 return (mp1);
2295 2125 }
2296 2126
2297 2127 /*
2298 2128 * IP calls this to validate the ICMP errors that
2299 2129 * we got from the network.
2300 2130 */
2301 2131 mblk_t *
2302 2132 ipsecah_icmp_error(mblk_t *data_mp, ip_recv_attr_t *ira)
2303 2133 {
2304 2134 netstack_t *ns = ira->ira_ill->ill_ipst->ips_netstack;
2305 2135 ipsecah_stack_t *ahstack = ns->netstack_ipsecah;
2306 2136
2307 2137 if (ira->ira_flags & IRAF_IS_IPV4)
2308 2138 return (ah_icmp_error_v4(data_mp, ira, ahstack));
2309 2139 else
2310 2140 return (ah_icmp_error_v6(data_mp, ira, ahstack));
2311 2141 }
2312 2142
2313 2143 static int
2314 2144 ah_fix_tlv_options_v6(uint8_t *oi_opt, uint8_t *pi_opt, uint_t ehdrlen,
2315 2145 uint8_t hdr_type, boolean_t copy_always)
2316 2146 {
2317 2147 uint8_t opt_type;
2318 2148 uint_t optlen;
2319 2149
2320 2150 ASSERT(hdr_type == IPPROTO_DSTOPTS || hdr_type == IPPROTO_HOPOPTS);
2321 2151
2322 2152 /*
2323 2153 * Copy the next header and hdr ext. len of the HOP-by-HOP
2324 2154 * and Destination option.
2325 2155 */
2326 2156 *pi_opt++ = *oi_opt++;
2327 2157 *pi_opt++ = *oi_opt++;
2328 2158 ehdrlen -= 2;
2329 2159
2330 2160 /*
2331 2161 * Now handle all the TLV encoded options.
2332 2162 */
2333 2163 while (ehdrlen != 0) {
2334 2164 opt_type = *oi_opt;
2335 2165
2336 2166 if (opt_type == IP6OPT_PAD1) {
2337 2167 optlen = 1;
2338 2168 } else {
2339 2169 if (ehdrlen < 2)
2340 2170 goto bad_opt;
2341 2171 optlen = 2 + oi_opt[1];
2342 2172 if (optlen > ehdrlen)
2343 2173 goto bad_opt;
2344 2174 }
2345 2175 if (copy_always || !(opt_type & IP6OPT_MUTABLE)) {
2346 2176 bcopy(oi_opt, pi_opt, optlen);
2347 2177 } else {
2348 2178 if (optlen == 1) {
2349 2179 *pi_opt = 0;
2350 2180 } else {
2351 2181 /*
2352 2182 * Copy the type and data length fields.
2353 2183 * Zero the option data by skipping
2354 2184 * option type and option data len
2355 2185 * fields.
2356 2186 */
2357 2187 *pi_opt = *oi_opt;
2358 2188 *(pi_opt + 1) = *(oi_opt + 1);
2359 2189 bzero(pi_opt + 2, optlen - 2);
2360 2190 }
2361 2191 }
2362 2192 ehdrlen -= optlen;
2363 2193 oi_opt += optlen;
2364 2194 pi_opt += optlen;
2365 2195 }
2366 2196 return (0);
2367 2197 bad_opt:
2368 2198 return (-1);
2369 2199 }
2370 2200
2371 2201 /*
2372 2202 * Construct a pseudo header for AH, processing all the options.
2373 2203 *
2374 2204 * oip6h is the IPv6 header of the incoming or outgoing packet.
2375 2205 * ip6h is the pointer to the pseudo headers IPV6 header. All
2376 2206 * the space needed for the options have been allocated including
2377 2207 * the AH header.
2378 2208 *
2379 2209 * If copy_always is set, all the options that appear before AH are copied
2380 2210 * blindly without checking for IP6OPT_MUTABLE. This is used by
2381 2211 * ah_auth_out_done(). Please refer to that function for details.
2382 2212 *
2383 2213 * NOTE :
2384 2214 *
2385 2215 * * AH header is never copied in this function even if copy_always
2386 2216 * is set. It just returns the ah_offset - offset of the AH header
2387 2217 * and the caller needs to do the copying. This is done so that we
2388 2218 * don't have pass extra arguments e.g. SA etc. and also,
2389 2219 * it is not needed when ah_auth_out_done is calling this function.
2390 2220 */
2391 2221 static uint_t
2392 2222 ah_fix_phdr_v6(ip6_t *ip6h, ip6_t *oip6h, boolean_t outbound,
2393 2223 boolean_t copy_always)
2394 2224 {
2395 2225 uint8_t *oi_opt;
2396 2226 uint8_t *pi_opt;
2397 2227 uint8_t nexthdr;
2398 2228 uint8_t *prev_nexthdr;
2399 2229 ip6_hbh_t *hbhhdr;
2400 2230 ip6_dest_t *dsthdr = NULL;
2401 2231 ip6_rthdr0_t *rthdr;
2402 2232 int ehdrlen;
2403 2233 ah_t *ah;
2404 2234 int ret;
2405 2235
2406 2236 /*
2407 2237 * In the outbound case for source route, ULP has already moved
2408 2238 * the first hop, which is now in ip6_dst. We need to re-arrange
2409 2239 * the header to make it look like how it would appear in the
2410 2240 * receiver i.e
2411 2241 *
2412 2242 * Because of ip_massage_options_v6 the header looks like
2413 2243 * this :
2414 2244 *
2415 2245 * ip6_src = S, ip6_dst = I1. followed by I2,I3,D.
2416 2246 *
2417 2247 * When it reaches the receiver, it would look like
2418 2248 *
2419 2249 * ip6_src = S, ip6_dst = D. followed by I1,I2,I3.
2420 2250 *
2421 2251 * NOTE : We assume that there are no problems with the options
2422 2252 * as IP should have already checked this.
2423 2253 */
2424 2254
2425 2255 oi_opt = (uchar_t *)&oip6h[1];
2426 2256 pi_opt = (uchar_t *)&ip6h[1];
2427 2257
2428 2258 /*
2429 2259 * We set the prev_nexthdr properly in the pseudo header.
2430 2260 * After we finish authentication and come back from the
2431 2261 * algorithm module, pseudo header will become the real
2432 2262 * IP header.
2433 2263 */
2434 2264 prev_nexthdr = (uint8_t *)&ip6h->ip6_nxt;
2435 2265 nexthdr = oip6h->ip6_nxt;
2436 2266 /* Assume IP has already stripped it */
2437 2267 ASSERT(nexthdr != IPPROTO_FRAGMENT);
2438 2268 ah = NULL;
2439 2269 dsthdr = NULL;
2440 2270 for (;;) {
2441 2271 switch (nexthdr) {
2442 2272 case IPPROTO_HOPOPTS:
2443 2273 hbhhdr = (ip6_hbh_t *)oi_opt;
2444 2274 nexthdr = hbhhdr->ip6h_nxt;
2445 2275 ehdrlen = 8 * (hbhhdr->ip6h_len + 1);
2446 2276 ret = ah_fix_tlv_options_v6(oi_opt, pi_opt, ehdrlen,
2447 2277 IPPROTO_HOPOPTS, copy_always);
2448 2278 /*
2449 2279 * Return a zero offset indicating error if there
2450 2280 * was error.
2451 2281 */
2452 2282 if (ret == -1)
2453 2283 return (0);
2454 2284 hbhhdr = (ip6_hbh_t *)pi_opt;
2455 2285 prev_nexthdr = (uint8_t *)&hbhhdr->ip6h_nxt;
2456 2286 break;
2457 2287 case IPPROTO_ROUTING:
2458 2288 rthdr = (ip6_rthdr0_t *)oi_opt;
2459 2289 nexthdr = rthdr->ip6r0_nxt;
2460 2290 ehdrlen = 8 * (rthdr->ip6r0_len + 1);
2461 2291 if (!copy_always && outbound) {
2462 2292 int i, left;
2463 2293 ip6_rthdr0_t *prthdr;
2464 2294 in6_addr_t *ap, *pap;
2465 2295
2466 2296 left = rthdr->ip6r0_segleft;
2467 2297 prthdr = (ip6_rthdr0_t *)pi_opt;
2468 2298 pap = (in6_addr_t *)(prthdr + 1);
2469 2299 ap = (in6_addr_t *)(rthdr + 1);
2470 2300 /*
2471 2301 * First eight bytes except seg_left
2472 2302 * does not change en route.
2473 2303 */
2474 2304 bcopy(oi_opt, pi_opt, 8);
2475 2305 prthdr->ip6r0_segleft = 0;
2476 2306 /*
2477 2307 * First address has been moved to
2478 2308 * the destination address of the
2479 2309 * ip header by ip_massage_options_v6.
2480 2310 * And the real destination address is
2481 2311 * in the last address part of the
2482 2312 * option.
2483 2313 */
2484 2314 *pap = oip6h->ip6_dst;
2485 2315 for (i = 1; i < left - 1; i++)
2486 2316 pap[i] = ap[i - 1];
2487 2317 ip6h->ip6_dst = *(ap + left - 1);
2488 2318 } else {
2489 2319 bcopy(oi_opt, pi_opt, ehdrlen);
2490 2320 }
2491 2321 rthdr = (ip6_rthdr0_t *)pi_opt;
2492 2322 prev_nexthdr = (uint8_t *)&rthdr->ip6r0_nxt;
2493 2323 break;
2494 2324 case IPPROTO_DSTOPTS:
2495 2325 /*
2496 2326 * Destination options are tricky. If there is
2497 2327 * a terminal (e.g. non-IPv6-extension) header
2498 2328 * following the destination options, don't
2499 2329 * reset prev_nexthdr or advance the AH insertion
2500 2330 * point and just treat this as a terminal header.
2501 2331 *
2502 2332 * If this is an inbound packet, just deal with
2503 2333 * it as is.
2504 2334 */
2505 2335 dsthdr = (ip6_dest_t *)oi_opt;
2506 2336 /*
2507 2337 * XXX I hope common-subexpression elimination
2508 2338 * saves us the double-evaluate.
2509 2339 */
2510 2340 if (outbound && dsthdr->ip6d_nxt != IPPROTO_ROUTING &&
2511 2341 dsthdr->ip6d_nxt != IPPROTO_HOPOPTS)
2512 2342 goto terminal_hdr;
2513 2343 nexthdr = dsthdr->ip6d_nxt;
2514 2344 ehdrlen = 8 * (dsthdr->ip6d_len + 1);
2515 2345 ret = ah_fix_tlv_options_v6(oi_opt, pi_opt, ehdrlen,
2516 2346 IPPROTO_DSTOPTS, copy_always);
2517 2347 /*
2518 2348 * Return a zero offset indicating error if there
2519 2349 * was error.
2520 2350 */
2521 2351 if (ret == -1)
2522 2352 return (0);
2523 2353 break;
2524 2354 case IPPROTO_AH:
2525 2355 /*
2526 2356 * Be conservative in what you send. We shouldn't
2527 2357 * see two same-scoped AH's in one packet.
2528 2358 * (Inner-IP-scoped AH will be hit by terminal
2529 2359 * header of IP or IPv6.)
2530 2360 */
2531 2361 ASSERT(!outbound);
2532 2362 return ((uint_t)(pi_opt - (uint8_t *)ip6h));
2533 2363 default:
2534 2364 ASSERT(outbound);
2535 2365 terminal_hdr:
2536 2366 *prev_nexthdr = IPPROTO_AH;
2537 2367 ah = (ah_t *)pi_opt;
2538 2368 ah->ah_nexthdr = nexthdr;
2539 2369 return ((uint_t)(pi_opt - (uint8_t *)ip6h));
2540 2370 }
2541 2371 pi_opt += ehdrlen;
2542 2372 oi_opt += ehdrlen;
2543 2373 }
2544 2374 /* NOTREACHED */
2545 2375 }
2546 2376
2547 2377 static boolean_t
2548 2378 ah_finish_up(ah_t *phdr_ah, ah_t *inbound_ah, ipsa_t *assoc,
2549 2379 int ah_data_sz, int ah_align_sz, ipsecah_stack_t *ahstack)
2550 2380 {
2551 2381 int i;
2552 2382
2553 2383 /*
2554 2384 * Padding :
2555 2385 *
2556 2386 * 1) Authentication data may have to be padded
2557 2387 * before ICV calculation if ICV is not a multiple
2558 2388 * of 64 bits. This padding is arbitrary and transmitted
2559 2389 * with the packet at the end of the authentication data.
2560 2390 * Payload length should include the padding bytes.
2561 2391 *
2562 2392 * 2) Explicit padding of the whole datagram may be
2563 2393 * required by the algorithm which need not be
2564 2394 * transmitted. It is assumed that this will be taken
2565 2395 * care by the algorithm module.
2566 2396 */
2567 2397 bzero(phdr_ah + 1, ah_data_sz); /* Zero out ICV for pseudo-hdr. */
2568 2398
2569 2399 if (inbound_ah == NULL) {
2570 2400 /* Outbound AH datagram. */
2571 2401
2572 2402 phdr_ah->ah_length = (ah_align_sz >> 2) + 1;
2573 2403 phdr_ah->ah_reserved = 0;
2574 2404 phdr_ah->ah_spi = assoc->ipsa_spi;
2575 2405
2576 2406 phdr_ah->ah_replay =
2577 2407 htonl(atomic_inc_32_nv(&assoc->ipsa_replay));
2578 2408 if (phdr_ah->ah_replay == 0 && assoc->ipsa_replay_wsize != 0) {
2579 2409 /*
2580 2410 * XXX We have replay counter wrapping. We probably
2581 2411 * want to nuke this SA (and its peer).
2582 2412 */
2583 2413 ipsec_assocfailure(info.mi_idnum, 0, 0,
2584 2414 SL_ERROR | SL_CONSOLE | SL_WARN,
2585 2415 "Outbound AH SA (0x%x), dst %s has wrapped "
2586 2416 "sequence.\n", phdr_ah->ah_spi,
2587 2417 assoc->ipsa_dstaddr, assoc->ipsa_addrfam,
2588 2418 ahstack->ipsecah_netstack);
2589 2419
2590 2420 sadb_replay_delete(assoc);
2591 2421 /* Caller will free phdr_mp and return NULL. */
2592 2422 return (B_FALSE);
2593 2423 }
2594 2424
2595 2425 if (ah_data_sz != ah_align_sz) {
2596 2426 uchar_t *pad = ((uchar_t *)phdr_ah + sizeof (ah_t) +
2597 2427 ah_data_sz);
2598 2428
2599 2429 for (i = 0; i < (ah_align_sz - ah_data_sz); i++) {
2600 2430 pad[i] = (uchar_t)i; /* Fill the padding */
2601 2431 }
2602 2432 }
2603 2433 } else {
2604 2434 /* Inbound AH datagram. */
2605 2435 phdr_ah->ah_nexthdr = inbound_ah->ah_nexthdr;
2606 2436 phdr_ah->ah_length = inbound_ah->ah_length;
2607 2437 phdr_ah->ah_reserved = 0;
2608 2438 ASSERT(inbound_ah->ah_spi == assoc->ipsa_spi);
2609 2439 phdr_ah->ah_spi = inbound_ah->ah_spi;
2610 2440 phdr_ah->ah_replay = inbound_ah->ah_replay;
2611 2441
2612 2442 if (ah_data_sz != ah_align_sz) {
2613 2443 uchar_t *opad = ((uchar_t *)inbound_ah +
2614 2444 sizeof (ah_t) + ah_data_sz);
2615 2445 uchar_t *pad = ((uchar_t *)phdr_ah + sizeof (ah_t) +
2616 2446 ah_data_sz);
2617 2447
2618 2448 for (i = 0; i < (ah_align_sz - ah_data_sz); i++) {
2619 2449 pad[i] = opad[i]; /* Copy the padding */
2620 2450 }
2621 2451 }
2622 2452 }
2623 2453
2624 2454 return (B_TRUE);
2625 2455 }
2626 2456
2627 2457 /*
2628 2458 * Called upon failing the inbound ICV check. The message passed as
2629 2459 * argument is freed.
2630 2460 */
2631 2461 static void
2632 2462 ah_log_bad_auth(mblk_t *mp, ip_recv_attr_t *ira, ipsec_crypto_t *ic)
2633 2463 {
2634 2464 boolean_t isv4 = (ira->ira_flags & IRAF_IS_IPV4);
2635 2465 ipsa_t *assoc = ira->ira_ipsec_ah_sa;
2636 2466 int af;
2637 2467 void *addr;
2638 2468 netstack_t *ns = ira->ira_ill->ill_ipst->ips_netstack;
2639 2469 ipsecah_stack_t *ahstack = ns->netstack_ipsecah;
2640 2470 ipsec_stack_t *ipss = ns->netstack_ipsec;
2641 2471
2642 2472 ASSERT(mp->b_datap->db_type == M_DATA);
2643 2473
2644 2474 mp->b_rptr -= ic->ic_skip_len;
2645 2475
2646 2476 if (isv4) {
2647 2477 ipha_t *ipha = (ipha_t *)mp->b_rptr;
2648 2478 addr = &ipha->ipha_dst;
2649 2479 af = AF_INET;
2650 2480 } else {
2651 2481 ip6_t *ip6h = (ip6_t *)mp->b_rptr;
2652 2482 addr = &ip6h->ip6_dst;
2653 2483 af = AF_INET6;
2654 2484 }
2655 2485
2656 2486 /*
2657 2487 * Log the event. Don't print to the console, block
2658 2488 * potential denial-of-service attack.
2659 2489 */
2660 2490 AH_BUMP_STAT(ahstack, bad_auth);
2661 2491
2662 2492 ipsec_assocfailure(info.mi_idnum, 0, 0, SL_ERROR | SL_WARN,
2663 2493 "AH Authentication failed spi %x, dst_addr %s",
2664 2494 assoc->ipsa_spi, addr, af, ahstack->ipsecah_netstack);
2665 2495
2666 2496 IP_AH_BUMP_STAT(ipss, in_discards);
2667 2497 ip_drop_packet(mp, B_TRUE, ira->ira_ill,
2668 2498 DROPPER(ipss, ipds_ah_bad_auth),
2669 2499 &ahstack->ah_dropper);
2670 2500 }
2671 2501
2672 2502 /*
2673 2503 * Kernel crypto framework callback invoked after completion of async
2674 2504 * crypto requests for outbound packets.
2675 2505 */
2676 2506 static void
2677 2507 ah_kcf_callback_outbound(void *arg, int status)
2678 2508 {
2679 2509 mblk_t *mp = (mblk_t *)arg;
2680 2510 mblk_t *async_mp;
2681 2511 netstack_t *ns;
2682 2512 ipsec_stack_t *ipss;
2683 2513 ipsecah_stack_t *ahstack;
2684 2514 mblk_t *data_mp;
2685 2515 ip_xmit_attr_t ixas;
2686 2516 ipsec_crypto_t *ic;
2687 2517 ill_t *ill;
2688 2518
2689 2519 /*
2690 2520 * First remove the ipsec_crypto_t mblk
2691 2521 * Note that we need to ipsec_free_crypto_data(mp) once done with ic.
2692 2522 */
2693 2523 async_mp = ipsec_remove_crypto_data(mp, &ic);
2694 2524 ASSERT(async_mp != NULL);
2695 2525
2696 2526 /*
2697 2527 * Extract the ip_xmit_attr_t from the first mblk.
2698 2528 * Verifies that the netstack and ill is still around; could
2699 2529 * have vanished while kEf was doing its work.
2700 2530 * On succesful return we have a nce_t and the ill/ipst can't
2701 2531 * disappear until we do the nce_refrele in ixa_cleanup.
2702 2532 */
2703 2533 data_mp = async_mp->b_cont;
2704 2534 async_mp->b_cont = NULL;
2705 2535 if (!ip_xmit_attr_from_mblk(async_mp, &ixas)) {
2706 2536 /* Disappeared on us - no ill/ipst for MIB */
2707 2537 if (ixas.ixa_nce != NULL) {
2708 2538 ill = ixas.ixa_nce->nce_ill;
2709 2539 BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutDiscards);
2710 2540 ip_drop_output("ipIfStatsOutDiscards", data_mp, ill);
2711 2541 }
2712 2542 freemsg(data_mp);
2713 2543 goto done;
2714 2544 }
2715 2545 ns = ixas.ixa_ipst->ips_netstack;
2716 2546 ahstack = ns->netstack_ipsecah;
2717 2547 ipss = ns->netstack_ipsec;
2718 2548 ill = ixas.ixa_nce->nce_ill;
2719 2549
2720 2550 if (status == CRYPTO_SUCCESS) {
2721 2551 data_mp = ah_auth_out_done(data_mp, &ixas, ic);
2722 2552 if (data_mp == NULL)
2723 2553 goto done;
2724 2554
2725 2555 (void) ip_output_post_ipsec(data_mp, &ixas);
2726 2556 } else {
2727 2557 /* Outbound shouldn't see invalid MAC */
2728 2558 ASSERT(status != CRYPTO_INVALID_MAC);
2729 2559
2730 2560 ah1dbg(ahstack,
2731 2561 ("ah_kcf_callback_outbound: crypto failed with 0x%x\n",
2732 2562 status));
2733 2563 AH_BUMP_STAT(ahstack, crypto_failures);
2734 2564 AH_BUMP_STAT(ahstack, out_discards);
2735 2565
2736 2566 ip_drop_packet(data_mp, B_FALSE, ill,
2737 2567 DROPPER(ipss, ipds_ah_crypto_failed),
2738 2568 &ahstack->ah_dropper);
2739 2569 BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutDiscards);
2740 2570 }
2741 2571 done:
2742 2572 ixa_cleanup(&ixas);
2743 2573 (void) ipsec_free_crypto_data(mp);
2744 2574 }
2745 2575
2746 2576 /*
2747 2577 * Kernel crypto framework callback invoked after completion of async
2748 2578 * crypto requests for inbound packets.
2749 2579 */
2750 2580 static void
2751 2581 ah_kcf_callback_inbound(void *arg, int status)
2752 2582 {
2753 2583 mblk_t *mp = (mblk_t *)arg;
2754 2584 mblk_t *async_mp;
2755 2585 netstack_t *ns;
2756 2586 ipsec_stack_t *ipss;
2757 2587 ipsecah_stack_t *ahstack;
2758 2588 mblk_t *data_mp;
2759 2589 ip_recv_attr_t iras;
2760 2590 ipsec_crypto_t *ic;
2761 2591
2762 2592 /*
2763 2593 * First remove the ipsec_crypto_t mblk
2764 2594 * Note that we need to ipsec_free_crypto_data(mp) once done with ic.
2765 2595 */
2766 2596 async_mp = ipsec_remove_crypto_data(mp, &ic);
2767 2597 ASSERT(async_mp != NULL);
2768 2598
2769 2599 /*
2770 2600 * Extract the ip_xmit_attr_t from the first mblk.
2771 2601 * Verifies that the netstack and ill is still around; could
2772 2602 * have vanished while kEf was doing its work.
2773 2603 */
2774 2604 data_mp = async_mp->b_cont;
2775 2605 async_mp->b_cont = NULL;
2776 2606 if (!ip_recv_attr_from_mblk(async_mp, &iras)) {
2777 2607 /* The ill or ip_stack_t disappeared on us */
2778 2608 ip_drop_input("ip_recv_attr_from_mblk", data_mp, NULL);
2779 2609 freemsg(data_mp);
2780 2610 goto done;
2781 2611 }
2782 2612 ns = iras.ira_ill->ill_ipst->ips_netstack;
2783 2613 ahstack = ns->netstack_ipsecah;
2784 2614 ipss = ns->netstack_ipsec;
2785 2615
2786 2616 if (status == CRYPTO_SUCCESS) {
2787 2617 data_mp = ah_auth_in_done(data_mp, &iras, ic);
2788 2618 if (data_mp == NULL)
2789 2619 goto done;
2790 2620
2791 2621 /* finish IPsec processing */
2792 2622 ip_input_post_ipsec(data_mp, &iras);
2793 2623
2794 2624 } else if (status == CRYPTO_INVALID_MAC) {
2795 2625 ah_log_bad_auth(data_mp, &iras, ic);
2796 2626 } else {
2797 2627 ah1dbg(ahstack,
2798 2628 ("ah_kcf_callback_inbound: crypto failed with 0x%x\n",
2799 2629 status));
2800 2630 AH_BUMP_STAT(ahstack, crypto_failures);
2801 2631 IP_AH_BUMP_STAT(ipss, in_discards);
2802 2632 ip_drop_packet(data_mp, B_TRUE, iras.ira_ill,
2803 2633 DROPPER(ipss, ipds_ah_crypto_failed),
2804 2634 &ahstack->ah_dropper);
2805 2635 BUMP_MIB(iras.ira_ill->ill_ip_mib, ipIfStatsInDiscards);
2806 2636 }
2807 2637 done:
2808 2638 ira_cleanup(&iras, B_TRUE);
2809 2639 (void) ipsec_free_crypto_data(mp);
2810 2640 }
2811 2641
2812 2642 /*
2813 2643 * Invoked on kernel crypto failure during inbound and outbound processing.
2814 2644 */
2815 2645 static void
2816 2646 ah_crypto_failed(mblk_t *data_mp, boolean_t is_inbound, int kef_rc,
2817 2647 ill_t *ill, ipsecah_stack_t *ahstack)
2818 2648 {
2819 2649 ipsec_stack_t *ipss = ahstack->ipsecah_netstack->netstack_ipsec;
2820 2650
2821 2651 ah1dbg(ahstack, ("crypto failed for %s AH with 0x%x\n",
2822 2652 is_inbound ? "inbound" : "outbound", kef_rc));
2823 2653 ip_drop_packet(data_mp, is_inbound, ill,
2824 2654 DROPPER(ipss, ipds_ah_crypto_failed),
2825 2655 &ahstack->ah_dropper);
2826 2656 AH_BUMP_STAT(ahstack, crypto_failures);
2827 2657 if (is_inbound)
2828 2658 IP_AH_BUMP_STAT(ipss, in_discards);
2829 2659 else
2830 2660 AH_BUMP_STAT(ahstack, out_discards);
2831 2661 }
2832 2662
2833 2663 /*
2834 2664 * Helper macros for the ah_submit_req_{inbound,outbound}() functions.
2835 2665 */
2836 2666
2837 2667 /*
2838 2668 * A statement-equivalent macro, _cr MUST point to a modifiable
2839 2669 * crypto_call_req_t.
2840 2670 */
2841 2671 #define AH_INIT_CALLREQ(_cr, _mp, _callback) \
2842 2672 (_cr)->cr_flag = CRYPTO_SKIP_REQID|CRYPTO_ALWAYS_QUEUE; \
2843 2673 (_cr)->cr_callback_arg = (_mp); \
2844 2674 (_cr)->cr_callback_func = (_callback)
2845 2675
2846 2676 #define AH_INIT_CRYPTO_DATA(data, msglen, mblk) { \
2847 2677 (data)->cd_format = CRYPTO_DATA_MBLK; \
2848 2678 (data)->cd_mp = mblk; \
2849 2679 (data)->cd_offset = 0; \
2850 2680 (data)->cd_length = msglen; \
2851 2681 }
2852 2682
2853 2683 #define AH_INIT_CRYPTO_MAC(mac, icvlen, icvbuf) { \
2854 2684 (mac)->cd_format = CRYPTO_DATA_RAW; \
2855 2685 (mac)->cd_offset = 0; \
2856 2686 (mac)->cd_length = icvlen; \
2857 2687 (mac)->cd_raw.iov_base = icvbuf; \
2858 2688 (mac)->cd_raw.iov_len = icvlen; \
2859 2689 }
2860 2690
2861 2691 /*
2862 2692 * Submit an inbound packet for processing by the crypto framework.
2863 2693 */
2864 2694 static mblk_t *
2865 2695 ah_submit_req_inbound(mblk_t *phdr_mp, ip_recv_attr_t *ira,
2866 2696 size_t skip_len, uint32_t ah_offset, ipsa_t *assoc)
2867 2697 {
2868 2698 int kef_rc;
2869 2699 mblk_t *mp;
2870 2700 crypto_call_req_t call_req, *callrp;
2871 2701 uint_t icv_len = assoc->ipsa_mac_len;
2872 2702 crypto_ctx_template_t ctx_tmpl;
2873 2703 ipsecah_stack_t *ahstack;
2874 2704 ipsec_crypto_t *ic, icstack;
2875 2705 boolean_t force = (assoc->ipsa_flags & IPSA_F_ASYNC);
2876 2706
2877 2707 ahstack = ira->ira_ill->ill_ipst->ips_netstack->netstack_ipsecah;
2878 2708
2879 2709 ASSERT(phdr_mp != NULL);
2880 2710 ASSERT(phdr_mp->b_datap->db_type == M_DATA);
2881 2711
2882 2712 if (force) {
2883 2713 /* We are doing asynch; allocate mblks to hold state */
2884 2714 if ((mp = ip_recv_attr_to_mblk(ira)) == NULL ||
2885 2715 (mp = ipsec_add_crypto_data(mp, &ic)) == NULL) {
2886 2716 BUMP_MIB(ira->ira_ill->ill_ip_mib, ipIfStatsInDiscards);
2887 2717 ip_drop_input("ipIfStatsInDiscards", phdr_mp,
2888 2718 ira->ira_ill);
2889 2719 freemsg(phdr_mp);
2890 2720 return (NULL);
2891 2721 }
2892 2722
2893 2723 linkb(mp, phdr_mp);
2894 2724 callrp = &call_req;
2895 2725 AH_INIT_CALLREQ(callrp, mp, ah_kcf_callback_inbound);
2896 2726 } else {
2897 2727 /*
2898 2728 * If we know we are going to do sync then ipsec_crypto_t
2899 2729 * should be on the stack.
2900 2730 */
2901 2731 ic = &icstack;
2902 2732 bzero(ic, sizeof (*ic));
2903 2733 callrp = NULL;
2904 2734 }
2905 2735
2906 2736 /* init arguments for the crypto framework */
2907 2737 AH_INIT_CRYPTO_DATA(&ic->ic_crypto_data, AH_MSGSIZE(phdr_mp),
2908 2738 phdr_mp);
2909 2739
2910 2740 AH_INIT_CRYPTO_MAC(&ic->ic_crypto_mac, icv_len,
2911 2741 (char *)phdr_mp->b_cont->b_rptr - skip_len + ah_offset +
2912 2742 sizeof (ah_t));
2913 2743
2914 2744 ic->ic_skip_len = skip_len;
2915 2745
2916 2746 IPSEC_CTX_TMPL(assoc, ipsa_authtmpl, IPSEC_ALG_AUTH, ctx_tmpl);
2917 2747
2918 2748 /* call KEF to do the MAC operation */
2919 2749 kef_rc = crypto_mac_verify(&assoc->ipsa_amech,
2920 2750 &ic->ic_crypto_data, &assoc->ipsa_kcfauthkey, ctx_tmpl,
2921 2751 &ic->ic_crypto_mac, callrp);
2922 2752
2923 2753 switch (kef_rc) {
2924 2754 case CRYPTO_SUCCESS:
2925 2755 AH_BUMP_STAT(ahstack, crypto_sync);
2926 2756 phdr_mp = ah_auth_in_done(phdr_mp, ira, ic);
2927 2757 if (force) {
2928 2758 /* Free mp after we are done with ic */
2929 2759 mp = ipsec_free_crypto_data(mp);
2930 2760 (void) ip_recv_attr_free_mblk(mp);
2931 2761 }
2932 2762 return (phdr_mp);
2933 2763 case CRYPTO_QUEUED:
2934 2764 /* ah_kcf_callback_inbound() will be invoked on completion */
2935 2765 AH_BUMP_STAT(ahstack, crypto_async);
2936 2766 return (NULL);
2937 2767 case CRYPTO_INVALID_MAC:
2938 2768 /* Free mp after we are done with ic */
2939 2769 AH_BUMP_STAT(ahstack, crypto_sync);
2940 2770 BUMP_MIB(ira->ira_ill->ill_ip_mib, ipIfStatsInDiscards);
2941 2771 ah_log_bad_auth(phdr_mp, ira, ic);
2942 2772 /* phdr_mp was passed to ip_drop_packet */
2943 2773 if (force) {
2944 2774 mp = ipsec_free_crypto_data(mp);
2945 2775 (void) ip_recv_attr_free_mblk(mp);
2946 2776 }
2947 2777 return (NULL);
2948 2778 }
2949 2779
2950 2780 if (force) {
2951 2781 mp = ipsec_free_crypto_data(mp);
2952 2782 phdr_mp = ip_recv_attr_free_mblk(mp);
2953 2783 }
2954 2784 BUMP_MIB(ira->ira_ill->ill_ip_mib, ipIfStatsInDiscards);
2955 2785 ah_crypto_failed(phdr_mp, B_TRUE, kef_rc, ira->ira_ill, ahstack);
2956 2786 /* phdr_mp was passed to ip_drop_packet */
2957 2787 return (NULL);
2958 2788 }
2959 2789
2960 2790 /*
2961 2791 * Submit an outbound packet for processing by the crypto framework.
2962 2792 */
2963 2793 static mblk_t *
2964 2794 ah_submit_req_outbound(mblk_t *phdr_mp, ip_xmit_attr_t *ixa,
2965 2795 size_t skip_len, ipsa_t *assoc)
2966 2796 {
2967 2797 int kef_rc;
2968 2798 mblk_t *mp;
2969 2799 crypto_call_req_t call_req, *callrp;
2970 2800 uint_t icv_len = assoc->ipsa_mac_len;
2971 2801 ipsecah_stack_t *ahstack;
2972 2802 ipsec_crypto_t *ic, icstack;
2973 2803 ill_t *ill = ixa->ixa_nce->nce_ill;
2974 2804 boolean_t force = (assoc->ipsa_flags & IPSA_F_ASYNC);
2975 2805
2976 2806 ahstack = ill->ill_ipst->ips_netstack->netstack_ipsecah;
2977 2807
2978 2808 ASSERT(phdr_mp != NULL);
2979 2809 ASSERT(phdr_mp->b_datap->db_type == M_DATA);
2980 2810
2981 2811 if (force) {
2982 2812 /* We are doing asynch; allocate mblks to hold state */
2983 2813 if ((mp = ip_xmit_attr_to_mblk(ixa)) == NULL ||
2984 2814 (mp = ipsec_add_crypto_data(mp, &ic)) == NULL) {
2985 2815 BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutDiscards);
2986 2816 ip_drop_output("ipIfStatsOutDiscards", phdr_mp, ill);
2987 2817 freemsg(phdr_mp);
2988 2818 return (NULL);
2989 2819 }
2990 2820 linkb(mp, phdr_mp);
2991 2821 callrp = &call_req;
2992 2822 AH_INIT_CALLREQ(callrp, mp, ah_kcf_callback_outbound);
2993 2823 } else {
2994 2824 /*
2995 2825 * If we know we are going to do sync then ipsec_crypto_t
2996 2826 * should be on the stack.
2997 2827 */
2998 2828 ic = &icstack;
2999 2829 bzero(ic, sizeof (*ic));
3000 2830 callrp = NULL;
3001 2831 }
3002 2832
3003 2833 /* init arguments for the crypto framework */
3004 2834 AH_INIT_CRYPTO_DATA(&ic->ic_crypto_data, AH_MSGSIZE(phdr_mp),
3005 2835 phdr_mp);
3006 2836
3007 2837 AH_INIT_CRYPTO_MAC(&ic->ic_crypto_mac, icv_len,
3008 2838 (char *)phdr_mp->b_wptr);
3009 2839
3010 2840 ic->ic_skip_len = skip_len;
3011 2841
3012 2842 ASSERT(ixa->ixa_ipsec_ah_sa != NULL);
3013 2843
3014 2844 /* call KEF to do the MAC operation */
3015 2845 kef_rc = crypto_mac(&assoc->ipsa_amech, &ic->ic_crypto_data,
3016 2846 &assoc->ipsa_kcfauthkey, assoc->ipsa_authtmpl,
3017 2847 &ic->ic_crypto_mac, callrp);
3018 2848
3019 2849 switch (kef_rc) {
3020 2850 case CRYPTO_SUCCESS:
3021 2851 AH_BUMP_STAT(ahstack, crypto_sync);
3022 2852 phdr_mp = ah_auth_out_done(phdr_mp, ixa, ic);
3023 2853 if (force) {
3024 2854 /* Free mp after we are done with ic */
3025 2855 mp = ipsec_free_crypto_data(mp);
3026 2856 (void) ip_xmit_attr_free_mblk(mp);
3027 2857 }
3028 2858 return (phdr_mp);
3029 2859 case CRYPTO_QUEUED:
3030 2860 /* ah_kcf_callback_outbound() will be invoked on completion */
3031 2861 AH_BUMP_STAT(ahstack, crypto_async);
3032 2862 return (NULL);
3033 2863 }
3034 2864
3035 2865 if (force) {
3036 2866 mp = ipsec_free_crypto_data(mp);
3037 2867 phdr_mp = ip_xmit_attr_free_mblk(mp);
3038 2868 }
3039 2869 BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutDiscards);
3040 2870 ah_crypto_failed(phdr_mp, B_FALSE, kef_rc, NULL, ahstack);
3041 2871 /* phdr_mp was passed to ip_drop_packet */
3042 2872 return (NULL);
3043 2873 }
3044 2874
3045 2875 /*
3046 2876 * This function constructs a pseudo header by looking at the IP header
3047 2877 * and options if any. This is called for both outbound and inbound,
3048 2878 * before computing the ICV.
3049 2879 */
3050 2880 static mblk_t *
3051 2881 ah_process_ip_options_v6(mblk_t *mp, ipsa_t *assoc, int *length_to_skip,
3052 2882 uint_t ah_data_sz, boolean_t outbound, ipsecah_stack_t *ahstack)
3053 2883 {
3054 2884 ip6_t *ip6h;
3055 2885 ip6_t *oip6h;
3056 2886 mblk_t *phdr_mp;
3057 2887 int option_length;
3058 2888 uint_t ah_align_sz;
3059 2889 uint_t ah_offset;
3060 2890 int hdr_size;
3061 2891
3062 2892 /*
3063 2893 * Allocate space for the authentication data also. It is
3064 2894 * useful both during the ICV calculation where we need to
3065 2895 * feed in zeroes and while sending the datagram back to IP
3066 2896 * where we will be using the same space.
3067 2897 *
3068 2898 * We need to allocate space for padding bytes if it is not
3069 2899 * a multiple of IPV6_PADDING_ALIGN.
3070 2900 *
3071 2901 * In addition, we allocate space for the ICV computed by
3072 2902 * the kernel crypto framework, saving us a separate kmem
3073 2903 * allocation down the road.
3074 2904 */
3075 2905
3076 2906 ah_align_sz = P2ALIGN(ah_data_sz + IPV6_PADDING_ALIGN - 1,
3077 2907 IPV6_PADDING_ALIGN);
3078 2908
3079 2909 ASSERT(ah_align_sz >= ah_data_sz);
3080 2910
3081 2911 hdr_size = ipsec_ah_get_hdr_size_v6(mp, B_FALSE);
3082 2912 option_length = hdr_size - IPV6_HDR_LEN;
3083 2913
3084 2914 /* This was not included in ipsec_ah_get_hdr_size_v6() */
3085 2915 hdr_size += (sizeof (ah_t) + ah_align_sz);
3086 2916
3087 2917 if (!outbound && (MBLKL(mp) < hdr_size)) {
3088 2918 /*
3089 2919 * We have post-AH header options in a separate mblk,
3090 2920 * a pullup is required.
3091 2921 */
3092 2922 if (!pullupmsg(mp, hdr_size))
3093 2923 return (NULL);
3094 2924 }
3095 2925
3096 2926 if ((phdr_mp = allocb_tmpl(hdr_size + ah_data_sz, mp)) == NULL) {
3097 2927 return (NULL);
3098 2928 }
3099 2929
3100 2930 oip6h = (ip6_t *)mp->b_rptr;
3101 2931
3102 2932 /*
3103 2933 * Form the basic IP header first. Zero out the header
3104 2934 * so that the mutable fields are zeroed out.
3105 2935 */
3106 2936 ip6h = (ip6_t *)phdr_mp->b_rptr;
3107 2937 bzero(ip6h, sizeof (ip6_t));
3108 2938 ip6h->ip6_vcf = IPV6_DEFAULT_VERS_AND_FLOW;
3109 2939
3110 2940 if (outbound) {
3111 2941 /*
3112 2942 * Include the size of AH and authentication data.
3113 2943 * This is how our recipient would compute the
3114 2944 * authentication data. Look at what we do in the
3115 2945 * inbound case below.
3116 2946 */
3117 2947 ip6h->ip6_plen = htons(ntohs(oip6h->ip6_plen) +
3118 2948 sizeof (ah_t) + ah_align_sz);
3119 2949 } else {
3120 2950 ip6h->ip6_plen = oip6h->ip6_plen;
3121 2951 }
3122 2952
3123 2953 ip6h->ip6_src = oip6h->ip6_src;
3124 2954 ip6h->ip6_dst = oip6h->ip6_dst;
3125 2955
3126 2956 *length_to_skip = IPV6_HDR_LEN;
3127 2957 if (option_length == 0) {
3128 2958 /* Form the AH header */
3129 2959 ip6h->ip6_nxt = IPPROTO_AH;
3130 2960 ((ah_t *)(ip6h + 1))->ah_nexthdr = oip6h->ip6_nxt;
3131 2961 ah_offset = *length_to_skip;
3132 2962 } else {
3133 2963 ip6h->ip6_nxt = oip6h->ip6_nxt;
3134 2964 /* option_length does not include the AH header's size */
3135 2965 *length_to_skip += option_length;
3136 2966
3137 2967 ah_offset = ah_fix_phdr_v6(ip6h, oip6h, outbound, B_FALSE);
3138 2968 if (ah_offset == 0) {
3139 2969 return (NULL);
3140 2970 }
3141 2971 }
3142 2972
3143 2973 if (!ah_finish_up(((ah_t *)((uint8_t *)ip6h + ah_offset)),
3144 2974 (outbound ? NULL : ((ah_t *)((uint8_t *)oip6h + ah_offset))),
3145 2975 assoc, ah_data_sz, ah_align_sz, ahstack)) {
3146 2976 freeb(phdr_mp);
3147 2977 /*
3148 2978 * Returning NULL will tell the caller to
3149 2979 * IPSA_REFELE(), free the memory, etc.
3150 2980 */
3151 2981 return (NULL);
3152 2982 }
3153 2983
3154 2984 phdr_mp->b_wptr = ((uint8_t *)ip6h + ah_offset + sizeof (ah_t) +
3155 2985 ah_align_sz);
3156 2986 if (!outbound)
3157 2987 *length_to_skip += sizeof (ah_t) + ah_align_sz;
3158 2988 return (phdr_mp);
3159 2989 }
3160 2990
3161 2991 /*
3162 2992 * This function constructs a pseudo header by looking at the IP header
3163 2993 * and options if any. This is called for both outbound and inbound,
3164 2994 * before computing the ICV.
3165 2995 */
3166 2996 static mblk_t *
3167 2997 ah_process_ip_options_v4(mblk_t *mp, ipsa_t *assoc, int *length_to_skip,
3168 2998 uint_t ah_data_sz, boolean_t outbound, ipsecah_stack_t *ahstack)
3169 2999 {
3170 3000 ipoptp_t opts;
3171 3001 uint32_t option_length;
3172 3002 ipha_t *ipha;
3173 3003 ipha_t *oipha;
3174 3004 mblk_t *phdr_mp;
3175 3005 int size;
3176 3006 uchar_t *optptr;
3177 3007 uint8_t optval;
3178 3008 uint8_t optlen;
3179 3009 ipaddr_t dst;
3180 3010 uint32_t v_hlen_tos_len;
3181 3011 int ip_hdr_length;
3182 3012 uint_t ah_align_sz;
3183 3013 uint32_t off;
3184 3014
3185 3015 #ifdef _BIG_ENDIAN
3186 3016 #define V_HLEN (v_hlen_tos_len >> 24)
3187 3017 #else
3188 3018 #define V_HLEN (v_hlen_tos_len & 0xFF)
3189 3019 #endif
3190 3020
3191 3021 oipha = (ipha_t *)mp->b_rptr;
3192 3022 v_hlen_tos_len = ((uint32_t *)oipha)[0];
3193 3023
3194 3024 /*
3195 3025 * Allocate space for the authentication data also. It is
3196 3026 * useful both during the ICV calculation where we need to
3197 3027 * feed in zeroes and while sending the datagram back to IP
3198 3028 * where we will be using the same space.
3199 3029 *
3200 3030 * We need to allocate space for padding bytes if it is not
3201 3031 * a multiple of IPV4_PADDING_ALIGN.
3202 3032 *
3203 3033 * In addition, we allocate space for the ICV computed by
3204 3034 * the kernel crypto framework, saving us a separate kmem
3205 3035 * allocation down the road.
3206 3036 */
3207 3037
3208 3038 ah_align_sz = P2ALIGN(ah_data_sz + IPV4_PADDING_ALIGN - 1,
3209 3039 IPV4_PADDING_ALIGN);
3210 3040
3211 3041 ASSERT(ah_align_sz >= ah_data_sz);
3212 3042
3213 3043 size = IP_SIMPLE_HDR_LENGTH + sizeof (ah_t) + ah_align_sz +
3214 3044 ah_data_sz;
3215 3045
3216 3046 if (V_HLEN != IP_SIMPLE_HDR_VERSION) {
3217 3047 option_length = oipha->ipha_version_and_hdr_length -
3218 3048 (uint8_t)((IP_VERSION << 4) +
3219 3049 IP_SIMPLE_HDR_LENGTH_IN_WORDS);
3220 3050 option_length <<= 2;
3221 3051 size += option_length;
3222 3052 }
3223 3053
3224 3054 if ((phdr_mp = allocb_tmpl(size, mp)) == NULL) {
3225 3055 return (NULL);
3226 3056 }
3227 3057
3228 3058 /*
3229 3059 * Form the basic IP header first.
3230 3060 */
3231 3061 ipha = (ipha_t *)phdr_mp->b_rptr;
3232 3062 ipha->ipha_version_and_hdr_length = oipha->ipha_version_and_hdr_length;
3233 3063 ipha->ipha_type_of_service = 0;
3234 3064
3235 3065 if (outbound) {
3236 3066 /*
3237 3067 * Include the size of AH and authentication data.
3238 3068 * This is how our recipient would compute the
3239 3069 * authentication data. Look at what we do in the
3240 3070 * inbound case below.
3241 3071 */
3242 3072 ipha->ipha_length = ntohs(htons(oipha->ipha_length) +
3243 3073 sizeof (ah_t) + ah_align_sz);
3244 3074 } else {
3245 3075 ipha->ipha_length = oipha->ipha_length;
3246 3076 }
3247 3077
3248 3078 ipha->ipha_ident = oipha->ipha_ident;
3249 3079 ipha->ipha_fragment_offset_and_flags = 0;
3250 3080 ipha->ipha_ttl = 0;
3251 3081 ipha->ipha_protocol = IPPROTO_AH;
3252 3082 ipha->ipha_hdr_checksum = 0;
3253 3083 ipha->ipha_src = oipha->ipha_src;
3254 3084 ipha->ipha_dst = dst = oipha->ipha_dst;
3255 3085
3256 3086 /*
3257 3087 * If there is no option to process return now.
3258 3088 */
3259 3089 ip_hdr_length = IP_SIMPLE_HDR_LENGTH;
3260 3090
3261 3091 if (V_HLEN == IP_SIMPLE_HDR_VERSION) {
3262 3092 /* Form the AH header */
3263 3093 goto ah_hdr;
3264 3094 }
3265 3095
3266 3096 ip_hdr_length += option_length;
3267 3097
3268 3098 /*
3269 3099 * We have options. In the outbound case for source route,
3270 3100 * ULP has already moved the first hop, which is now in
3271 3101 * ipha_dst. We need the final destination for the calculation
3272 3102 * of authentication data. And also make sure that mutable
3273 3103 * and experimental fields are zeroed out in the IP options.
3274 3104 */
3275 3105
3276 3106 bcopy(&oipha[1], &ipha[1], option_length);
3277 3107
3278 3108 for (optval = ipoptp_first(&opts, ipha);
3279 3109 optval != IPOPT_EOL;
3280 3110 optval = ipoptp_next(&opts)) {
3281 3111 optptr = opts.ipoptp_cur;
3282 3112 optlen = opts.ipoptp_len;
3283 3113 switch (optval) {
3284 3114 case IPOPT_EXTSEC:
3285 3115 case IPOPT_COMSEC:
3286 3116 case IPOPT_RA:
3287 3117 case IPOPT_SDMDD:
3288 3118 case IPOPT_SECURITY:
3289 3119 /*
3290 3120 * These options are Immutable, leave them as-is.
3291 3121 * Note that IPOPT_NOP is also Immutable, but it
3292 3122 * was skipped by ipoptp_next() and thus remains
3293 3123 * intact in the header.
3294 3124 */
3295 3125 break;
3296 3126 case IPOPT_SSRR:
3297 3127 case IPOPT_LSRR:
3298 3128 if ((opts.ipoptp_flags & IPOPTP_ERROR) != 0)
3299 3129 goto bad_ipv4opt;
3300 3130 /*
3301 3131 * These two are mutable and will be zeroed, but
3302 3132 * first get the final destination.
3303 3133 */
3304 3134 off = optptr[IPOPT_OFFSET];
3305 3135 /*
3306 3136 * If one of the conditions is true, it means
3307 3137 * end of options and dst already has the right
3308 3138 * value. So, just fall through.
3309 3139 */
3310 3140 if (!(optlen < IP_ADDR_LEN || off > optlen - 3)) {
3311 3141 off = optlen - IP_ADDR_LEN;
3312 3142 bcopy(&optptr[off], &dst, IP_ADDR_LEN);
3313 3143 }
3314 3144 /* FALLTHRU */
3315 3145 case IPOPT_RR:
3316 3146 case IPOPT_TS:
3317 3147 case IPOPT_SATID:
3318 3148 default:
3319 3149 /*
3320 3150 * optlen should include from the beginning of an
3321 3151 * option.
3322 3152 * NOTE : Stream Identifier Option (SID): RFC 791
3323 3153 * shows the bit pattern of optlen as 2 and documents
3324 3154 * the length as 4. We assume it to be 2 here.
3325 3155 */
3326 3156 bzero(optptr, optlen);
3327 3157 break;
3328 3158 }
3329 3159 }
3330 3160
3331 3161 if ((opts.ipoptp_flags & IPOPTP_ERROR) != 0) {
3332 3162 bad_ipv4opt:
3333 3163 ah1dbg(ahstack, ("AH : bad IPv4 option"));
3334 3164 freeb(phdr_mp);
3335 3165 return (NULL);
3336 3166 }
3337 3167
3338 3168 /*
3339 3169 * Don't change ipha_dst for an inbound datagram as it points
3340 3170 * to the right value. Only for the outbound with LSRR/SSRR,
3341 3171 * because of ip_massage_options called by the ULP, ipha_dst
3342 3172 * points to the first hop and we need to use the final
3343 3173 * destination for computing the ICV.
3344 3174 */
3345 3175
3346 3176 if (outbound)
3347 3177 ipha->ipha_dst = dst;
3348 3178 ah_hdr:
3349 3179 ((ah_t *)((uint8_t *)ipha + ip_hdr_length))->ah_nexthdr =
3350 3180 oipha->ipha_protocol;
3351 3181 if (!ah_finish_up(((ah_t *)((uint8_t *)ipha + ip_hdr_length)),
3352 3182 (outbound ? NULL : ((ah_t *)((uint8_t *)oipha + ip_hdr_length))),
3353 3183 assoc, ah_data_sz, ah_align_sz, ahstack)) {
3354 3184 freeb(phdr_mp);
3355 3185 /*
3356 3186 * Returning NULL will tell the caller to IPSA_REFELE(), free
3357 3187 * the memory, etc.
3358 3188 */
3359 3189 return (NULL);
3360 3190 }
3361 3191
3362 3192 phdr_mp->b_wptr = ((uchar_t *)ipha + ip_hdr_length +
3363 3193 sizeof (ah_t) + ah_align_sz);
3364 3194
3365 3195 ASSERT(phdr_mp->b_wptr <= phdr_mp->b_datap->db_lim);
3366 3196 if (outbound)
3367 3197 *length_to_skip = ip_hdr_length;
3368 3198 else
3369 3199 *length_to_skip = ip_hdr_length + sizeof (ah_t) + ah_align_sz;
3370 3200 return (phdr_mp);
3371 3201 }
3372 3202
3373 3203 /*
3374 3204 * Authenticate an outbound datagram. This function is called
3375 3205 * whenever IP sends an outbound datagram that needs authentication.
3376 3206 * Returns a modified packet if done. Returns NULL if error or queued.
3377 3207 * If error return then ipIfStatsOutDiscards has been increased.
3378 3208 */
3379 3209 static mblk_t *
3380 3210 ah_outbound(mblk_t *data_mp, ip_xmit_attr_t *ixa)
3381 3211 {
3382 3212 mblk_t *phdr_mp;
3383 3213 ipsa_t *assoc;
3384 3214 int length_to_skip;
3385 3215 uint_t ah_align_sz;
3386 3216 uint_t age_bytes;
3387 3217 netstack_t *ns = ixa->ixa_ipst->ips_netstack;
3388 3218 ipsecah_stack_t *ahstack = ns->netstack_ipsecah;
3389 3219 ipsec_stack_t *ipss = ns->netstack_ipsec;
3390 3220 ill_t *ill = ixa->ixa_nce->nce_ill;
3391 3221 boolean_t need_refrele = B_FALSE;
3392 3222
3393 3223 /*
3394 3224 * Construct the chain of mblks
3395 3225 *
3396 3226 * PSEUDO_HDR->DATA
3397 3227 *
3398 3228 * one by one.
3399 3229 */
3400 3230
3401 3231 AH_BUMP_STAT(ahstack, out_requests);
3402 3232
3403 3233 ASSERT(data_mp->b_datap->db_type == M_DATA);
3404 3234
3405 3235 assoc = ixa->ixa_ipsec_ah_sa;
3406 3236 ASSERT(assoc != NULL);
3407 3237
3408 3238
3409 3239 /*
3410 3240 * Get the outer IP header in shape to escape this system..
3411 3241 */
3412 3242 if (is_system_labeled() && (assoc->ipsa_otsl != NULL)) {
3413 3243 /*
3414 3244 * Need to update packet with any CIPSO option and update
3415 3245 * ixa_tsl to capture the new label.
3416 3246 * We allocate a separate ixa for that purpose.
3417 3247 */
3418 3248 ixa = ip_xmit_attr_duplicate(ixa);
3419 3249 if (ixa == NULL) {
3420 3250 ip_drop_packet(data_mp, B_FALSE, ill,
3421 3251 DROPPER(ipss, ipds_ah_nomem),
3422 3252 &ahstack->ah_dropper);
3423 3253 return (NULL);
3424 3254 }
3425 3255 need_refrele = B_TRUE;
3426 3256
3427 3257 label_hold(assoc->ipsa_otsl);
3428 3258 ip_xmit_attr_replace_tsl(ixa, assoc->ipsa_otsl);
3429 3259
3430 3260 data_mp = sadb_whack_label(data_mp, assoc, ixa,
3431 3261 DROPPER(ipss, ipds_ah_nomem), &ahstack->ah_dropper);
3432 3262 if (data_mp == NULL) {
3433 3263 /* Packet dropped by sadb_whack_label */
3434 3264 ixa_refrele(ixa);
3435 3265 return (NULL);
3436 3266 }
3437 3267 }
3438 3268
3439 3269 /*
3440 3270 * Age SA according to number of bytes that will be sent after
3441 3271 * adding the AH header, ICV, and padding to the packet.
3442 3272 */
3443 3273
3444 3274 if (ixa->ixa_flags & IXAF_IS_IPV4) {
3445 3275 ipha_t *ipha = (ipha_t *)data_mp->b_rptr;
3446 3276 ah_align_sz = P2ALIGN(assoc->ipsa_mac_len +
3447 3277 IPV4_PADDING_ALIGN - 1, IPV4_PADDING_ALIGN);
3448 3278 age_bytes = ntohs(ipha->ipha_length) + sizeof (ah_t) +
3449 3279 ah_align_sz;
3450 3280 } else {
3451 3281 ip6_t *ip6h = (ip6_t *)data_mp->b_rptr;
3452 3282 ah_align_sz = P2ALIGN(assoc->ipsa_mac_len +
3453 3283 IPV6_PADDING_ALIGN - 1, IPV6_PADDING_ALIGN);
3454 3284 age_bytes = sizeof (ip6_t) + ntohs(ip6h->ip6_plen) +
3455 3285 sizeof (ah_t) + ah_align_sz;
3456 3286 }
3457 3287
3458 3288 if (!ah_age_bytes(assoc, age_bytes, B_FALSE)) {
3459 3289 /* rig things as if ipsec_getassocbyconn() failed */
3460 3290 ipsec_assocfailure(info.mi_idnum, 0, 0, SL_ERROR | SL_WARN,
3461 3291 "AH association 0x%x, dst %s had bytes expire.\n",
3462 3292 ntohl(assoc->ipsa_spi), assoc->ipsa_dstaddr, AF_INET,
3463 3293 ahstack->ipsecah_netstack);
3464 3294 BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutDiscards);
3465 3295 ip_drop_output("ipIfStatsOutDiscards", data_mp, ill);
3466 3296 freemsg(data_mp);
3467 3297 if (need_refrele)
3468 3298 ixa_refrele(ixa);
3469 3299 return (NULL);
3470 3300 }
3471 3301
3472 3302 /*
3473 3303 * XXX We need to have fixed up the outer label before we get here.
3474 3304 * (AH is computing the checksum over the outer label).
3475 3305 */
3476 3306
3477 3307 /*
3478 3308 * Insert pseudo header:
3479 3309 * [IP, ULP] => [IP, AH, ICV] -> ULP
3480 3310 */
3481 3311
3482 3312 if (ixa->ixa_flags & IXAF_IS_IPV4) {
3483 3313 phdr_mp = ah_process_ip_options_v4(data_mp, assoc,
3484 3314 &length_to_skip, assoc->ipsa_mac_len, B_TRUE, ahstack);
3485 3315 } else {
3486 3316 phdr_mp = ah_process_ip_options_v6(data_mp, assoc,
3487 3317 &length_to_skip, assoc->ipsa_mac_len, B_TRUE, ahstack);
3488 3318 }
3489 3319
3490 3320 if (phdr_mp == NULL) {
3491 3321 AH_BUMP_STAT(ahstack, out_discards);
3492 3322 ip_drop_packet(data_mp, B_FALSE, ixa->ixa_nce->nce_ill,
3493 3323 DROPPER(ipss, ipds_ah_bad_v4_opts),
3494 3324 &ahstack->ah_dropper);
3495 3325 BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutDiscards);
3496 3326 if (need_refrele)
3497 3327 ixa_refrele(ixa);
3498 3328 return (NULL);
3499 3329 }
3500 3330
3501 3331 phdr_mp->b_cont = data_mp;
3502 3332 data_mp->b_rptr += length_to_skip;
3503 3333 data_mp = phdr_mp;
3504 3334
3505 3335 /*
3506 3336 * At this point data_mp points to
3507 3337 * an mblk containing the pseudo header (IP header,
3508 3338 * AH header, and ICV with mutable fields zero'ed out).
3509 3339 * mp points to the mblk containing the ULP data. The original
3510 3340 * IP header is kept before the ULP data in data_mp.
3511 3341 */
3512 3342
3513 3343 /* submit MAC request to KCF */
3514 3344 data_mp = ah_submit_req_outbound(data_mp, ixa, length_to_skip, assoc);
3515 3345 if (need_refrele)
3516 3346 ixa_refrele(ixa);
3517 3347 return (data_mp);
3518 3348 }
3519 3349
3520 3350 static mblk_t *
3521 3351 ah_inbound(mblk_t *data_mp, void *arg, ip_recv_attr_t *ira)
3522 3352 {
3523 3353 ah_t *ah = (ah_t *)arg;
3524 3354 ipsa_t *assoc = ira->ira_ipsec_ah_sa;
3525 3355 int length_to_skip;
3526 3356 int ah_length;
3527 3357 mblk_t *phdr_mp;
3528 3358 uint32_t ah_offset;
3529 3359 netstack_t *ns = ira->ira_ill->ill_ipst->ips_netstack;
3530 3360 ipsecah_stack_t *ahstack = ns->netstack_ipsecah;
3531 3361 ipsec_stack_t *ipss = ns->netstack_ipsec;
3532 3362
3533 3363 ASSERT(assoc != NULL);
3534 3364
3535 3365 /*
3536 3366 * We may wish to check replay in-range-only here as an optimization.
3537 3367 * Include the reality check of ipsa->ipsa_replay >
3538 3368 * ipsa->ipsa_replay_wsize for times when it's the first N packets,
3539 3369 * where N == ipsa->ipsa_replay_wsize.
3540 3370 *
3541 3371 * Another check that may come here later is the "collision" check.
3542 3372 * If legitimate packets flow quickly enough, this won't be a problem,
3543 3373 * but collisions may cause authentication algorithm crunching to
3544 3374 * take place when it doesn't need to.
3545 3375 */
3546 3376 if (!sadb_replay_peek(assoc, ah->ah_replay)) {
3547 3377 AH_BUMP_STAT(ahstack, replay_early_failures);
3548 3378 IP_AH_BUMP_STAT(ipss, in_discards);
3549 3379 ip_drop_packet(data_mp, B_TRUE, ira->ira_ill,
3550 3380 DROPPER(ipss, ipds_ah_early_replay),
3551 3381 &ahstack->ah_dropper);
3552 3382 BUMP_MIB(ira->ira_ill->ill_ip_mib, ipIfStatsInDiscards);
3553 3383 return (NULL);
3554 3384 }
3555 3385
3556 3386 /*
3557 3387 * The offset of the AH header can be computed from its pointer
3558 3388 * within the data mblk, which was pulled up until the AH header
3559 3389 * by ipsec_inbound_ah_sa() during SA selection.
3560 3390 */
3561 3391 ah_offset = (uchar_t *)ah - data_mp->b_rptr;
3562 3392
3563 3393 /*
3564 3394 * We need to pullup until the ICV before we call
3565 3395 * ah_process_ip_options_v6.
3566 3396 */
3567 3397 ah_length = (ah->ah_length << 2) + 8;
3568 3398
3569 3399 /*
3570 3400 * NOTE : If we want to use any field of IP/AH header, you need
3571 3401 * to re-assign following the pullup.
3572 3402 */
3573 3403 if (((uchar_t *)ah + ah_length) > data_mp->b_wptr) {
3574 3404 if (!pullupmsg(data_mp, (uchar_t *)ah + ah_length -
3575 3405 data_mp->b_rptr)) {
3576 3406 (void) ipsec_rl_strlog(ns, info.mi_idnum, 0, 0,
3577 3407 SL_WARN | SL_ERROR,
3578 3408 "ah_inbound: Small AH header\n");
3579 3409 IP_AH_BUMP_STAT(ipss, in_discards);
3580 3410 ip_drop_packet(data_mp, B_TRUE, ira->ira_ill,
3581 3411 DROPPER(ipss, ipds_ah_nomem),
3582 3412 &ahstack->ah_dropper);
3583 3413 BUMP_MIB(ira->ira_ill->ill_ip_mib, ipIfStatsInDiscards);
3584 3414 return (NULL);
3585 3415 }
3586 3416 }
3587 3417
3588 3418 /*
3589 3419 * Insert pseudo header:
3590 3420 * [IP, ULP] => [IP, AH, ICV] -> ULP
3591 3421 */
3592 3422 if (ira->ira_flags & IRAF_IS_IPV4) {
3593 3423 phdr_mp = ah_process_ip_options_v4(data_mp, assoc,
3594 3424 &length_to_skip, assoc->ipsa_mac_len, B_FALSE, ahstack);
3595 3425 } else {
3596 3426 phdr_mp = ah_process_ip_options_v6(data_mp, assoc,
3597 3427 &length_to_skip, assoc->ipsa_mac_len, B_FALSE, ahstack);
3598 3428 }
3599 3429
3600 3430 if (phdr_mp == NULL) {
3601 3431 IP_AH_BUMP_STAT(ipss, in_discards);
3602 3432 ip_drop_packet(data_mp, B_TRUE, ira->ira_ill,
3603 3433 ((ira->ira_flags & IRAF_IS_IPV4) ?
3604 3434 DROPPER(ipss, ipds_ah_bad_v4_opts) :
3605 3435 DROPPER(ipss, ipds_ah_bad_v6_hdrs)),
3606 3436 &ahstack->ah_dropper);
3607 3437 BUMP_MIB(ira->ira_ill->ill_ip_mib, ipIfStatsInDiscards);
3608 3438 return (NULL);
3609 3439 }
3610 3440
3611 3441 phdr_mp->b_cont = data_mp;
3612 3442 data_mp->b_rptr += length_to_skip;
3613 3443 data_mp = phdr_mp;
3614 3444
3615 3445 /* submit request to KCF */
3616 3446 return (ah_submit_req_inbound(data_mp, ira, length_to_skip, ah_offset,
3617 3447 assoc));
3618 3448 }
3619 3449
3620 3450 /*
3621 3451 * Invoked after processing of an inbound packet by the
3622 3452 * kernel crypto framework. Called by ah_submit_req() for a sync request,
3623 3453 * or by the kcf callback for an async request.
3624 3454 * Returns NULL if the mblk chain is consumed.
3625 3455 */
3626 3456 static mblk_t *
3627 3457 ah_auth_in_done(mblk_t *phdr_mp, ip_recv_attr_t *ira, ipsec_crypto_t *ic)
3628 3458 {
3629 3459 ipha_t *ipha;
3630 3460 uint_t ah_offset = 0;
3631 3461 mblk_t *mp;
3632 3462 int align_len, newpos;
3633 3463 ah_t *ah;
3634 3464 uint32_t length;
3635 3465 uint32_t *dest32;
3636 3466 uint8_t *dest;
3637 3467 boolean_t isv4;
3638 3468 ip6_t *ip6h;
3639 3469 uint_t icv_len;
3640 3470 ipsa_t *assoc;
3641 3471 kstat_named_t *counter;
3642 3472 netstack_t *ns = ira->ira_ill->ill_ipst->ips_netstack;
3643 3473 ipsecah_stack_t *ahstack = ns->netstack_ipsecah;
3644 3474 ipsec_stack_t *ipss = ns->netstack_ipsec;
3645 3475
3646 3476 isv4 = (ira->ira_flags & IRAF_IS_IPV4);
3647 3477 assoc = ira->ira_ipsec_ah_sa;
3648 3478 icv_len = (uint_t)ic->ic_crypto_mac.cd_raw.iov_len;
3649 3479
3650 3480 if (phdr_mp == NULL) {
3651 3481 ip_drop_packet(phdr_mp, B_TRUE, ira->ira_ill,
3652 3482 DROPPER(ipss, ipds_ah_nomem),
3653 3483 &ahstack->ah_dropper);
3654 3484 BUMP_MIB(ira->ira_ill->ill_ip_mib, ipIfStatsInDiscards);
3655 3485 return (NULL);
3656 3486 }
3657 3487
3658 3488 mp = phdr_mp->b_cont;
3659 3489 if (mp == NULL) {
3660 3490 ip_drop_packet(phdr_mp, B_TRUE, ira->ira_ill,
3661 3491 DROPPER(ipss, ipds_ah_nomem),
3662 3492 &ahstack->ah_dropper);
3663 3493 BUMP_MIB(ira->ira_ill->ill_ip_mib, ipIfStatsInDiscards);
3664 3494 return (NULL);
3665 3495 }
3666 3496 mp->b_rptr -= ic->ic_skip_len;
3667 3497
3668 3498 ah_set_usetime(assoc, B_TRUE);
3669 3499
3670 3500 if (isv4) {
3671 3501 ipha = (ipha_t *)mp->b_rptr;
3672 3502 ah_offset = ipha->ipha_version_and_hdr_length -
3673 3503 (uint8_t)((IP_VERSION << 4));
3674 3504 ah_offset <<= 2;
3675 3505 align_len = P2ALIGN(icv_len + IPV4_PADDING_ALIGN - 1,
3676 3506 IPV4_PADDING_ALIGN);
3677 3507 } else {
3678 3508 ip6h = (ip6_t *)mp->b_rptr;
3679 3509 ah_offset = ipsec_ah_get_hdr_size_v6(mp, B_TRUE);
3680 3510 ASSERT((mp->b_wptr - mp->b_rptr) >= ah_offset);
3681 3511 align_len = P2ALIGN(icv_len + IPV6_PADDING_ALIGN - 1,
3682 3512 IPV6_PADDING_ALIGN);
3683 3513 }
3684 3514
3685 3515 ah = (ah_t *)(mp->b_rptr + ah_offset);
3686 3516 newpos = sizeof (ah_t) + align_len;
3687 3517
3688 3518 /*
3689 3519 * We get here only when authentication passed.
3690 3520 */
3691 3521
3692 3522 ah3dbg(ahstack, ("AH succeeded, checking replay\n"));
3693 3523 AH_BUMP_STAT(ahstack, good_auth);
3694 3524
3695 3525 if (!sadb_replay_check(assoc, ah->ah_replay)) {
3696 3526 int af;
3697 3527 void *addr;
3698 3528
3699 3529 if (isv4) {
3700 3530 addr = &ipha->ipha_dst;
3701 3531 af = AF_INET;
3702 3532 } else {
3703 3533 addr = &ip6h->ip6_dst;
3704 3534 af = AF_INET6;
3705 3535 }
3706 3536
3707 3537 /*
3708 3538 * Log the event. As of now we print out an event.
3709 3539 * Do not print the replay failure number, or else
3710 3540 * syslog cannot collate the error messages. Printing
3711 3541 * the replay number that failed (or printing to the
3712 3542 * console) opens a denial-of-service attack.
3713 3543 */
3714 3544 AH_BUMP_STAT(ahstack, replay_failures);
3715 3545 ipsec_assocfailure(info.mi_idnum, 0, 0,
3716 3546 SL_ERROR | SL_WARN,
3717 3547 "Replay failed for AH spi %x, dst_addr %s",
3718 3548 assoc->ipsa_spi, addr, af, ahstack->ipsecah_netstack);
3719 3549 counter = DROPPER(ipss, ipds_ah_replay);
3720 3550 goto ah_in_discard;
3721 3551 }
3722 3552
3723 3553 /*
3724 3554 * We need to remove the AH header from the original
3725 3555 * datagram. Best way to do this is to move the pre-AH headers
3726 3556 * forward in the (relatively simple) IPv4 case. In IPv6, it's
3727 3557 * a bit more complicated because of IPv6's next-header chaining,
3728 3558 * but it's doable.
3729 3559 */
3730 3560 if (isv4) {
3731 3561 /*
3732 3562 * Assign the right protocol, adjust the length as we
3733 3563 * are removing the AH header and adjust the checksum to
3734 3564 * account for the protocol and length.
3735 3565 */
3736 3566 length = ntohs(ipha->ipha_length);
3737 3567 if (!ah_age_bytes(assoc, length, B_TRUE)) {
3738 3568 /* The ipsa has hit hard expiration, LOG and AUDIT. */
3739 3569 ipsec_assocfailure(info.mi_idnum, 0, 0,
3740 3570 SL_ERROR | SL_WARN,
3741 3571 "AH Association 0x%x, dst %s had bytes expire.\n",
3742 3572 assoc->ipsa_spi, assoc->ipsa_dstaddr,
3743 3573 AF_INET, ahstack->ipsecah_netstack);
3744 3574 AH_BUMP_STAT(ahstack, bytes_expired);
3745 3575 counter = DROPPER(ipss, ipds_ah_bytes_expire);
3746 3576 goto ah_in_discard;
3747 3577 }
3748 3578 ipha->ipha_protocol = ah->ah_nexthdr;
3749 3579 length -= newpos;
3750 3580
3751 3581 ipha->ipha_length = htons((uint16_t)length);
3752 3582 ipha->ipha_hdr_checksum = 0;
3753 3583 ipha->ipha_hdr_checksum = (uint16_t)ip_csum_hdr(ipha);
3754 3584 } else {
3755 3585 uchar_t *whereptr;
3756 3586 int hdrlen;
3757 3587 uint8_t *nexthdr;
3758 3588 ip6_hbh_t *hbhhdr;
3759 3589 ip6_dest_t *dsthdr;
3760 3590 ip6_rthdr0_t *rthdr;
3761 3591
3762 3592 /*
3763 3593 * Make phdr_mp hold until the AH header and make
3764 3594 * mp hold everything past AH header.
3765 3595 */
3766 3596 length = ntohs(ip6h->ip6_plen);
3767 3597 if (!ah_age_bytes(assoc, length + sizeof (ip6_t), B_TRUE)) {
3768 3598 /* The ipsa has hit hard expiration, LOG and AUDIT. */
3769 3599 ipsec_assocfailure(info.mi_idnum, 0, 0,
3770 3600 SL_ERROR | SL_WARN,
3771 3601 "AH Association 0x%x, dst %s had bytes "
3772 3602 "expire.\n", assoc->ipsa_spi, &ip6h->ip6_dst,
3773 3603 AF_INET6, ahstack->ipsecah_netstack);
3774 3604 AH_BUMP_STAT(ahstack, bytes_expired);
3775 3605 counter = DROPPER(ipss, ipds_ah_bytes_expire);
3776 3606 goto ah_in_discard;
3777 3607 }
3778 3608
3779 3609 /*
3780 3610 * Update the next header field of the header preceding
3781 3611 * AH with the next header field of AH. Start with the
3782 3612 * IPv6 header and proceed with the extension headers
3783 3613 * until we find what we're looking for.
3784 3614 */
3785 3615 nexthdr = &ip6h->ip6_nxt;
3786 3616 whereptr = (uchar_t *)ip6h;
3787 3617 hdrlen = sizeof (ip6_t);
3788 3618
3789 3619 while (*nexthdr != IPPROTO_AH) {
3790 3620 whereptr += hdrlen;
3791 3621 /* Assume IP has already stripped it */
3792 3622 ASSERT(*nexthdr != IPPROTO_FRAGMENT);
3793 3623 switch (*nexthdr) {
3794 3624 case IPPROTO_HOPOPTS:
3795 3625 hbhhdr = (ip6_hbh_t *)whereptr;
3796 3626 nexthdr = &hbhhdr->ip6h_nxt;
3797 3627 hdrlen = 8 * (hbhhdr->ip6h_len + 1);
3798 3628 break;
3799 3629 case IPPROTO_DSTOPTS:
3800 3630 dsthdr = (ip6_dest_t *)whereptr;
3801 3631 nexthdr = &dsthdr->ip6d_nxt;
3802 3632 hdrlen = 8 * (dsthdr->ip6d_len + 1);
3803 3633 break;
3804 3634 case IPPROTO_ROUTING:
3805 3635 rthdr = (ip6_rthdr0_t *)whereptr;
3806 3636 nexthdr = &rthdr->ip6r0_nxt;
3807 3637 hdrlen = 8 * (rthdr->ip6r0_len + 1);
3808 3638 break;
3809 3639 }
3810 3640 }
3811 3641 *nexthdr = ah->ah_nexthdr;
3812 3642 length -= newpos;
3813 3643 ip6h->ip6_plen = htons((uint16_t)length);
3814 3644 }
3815 3645
3816 3646 /* Now that we've fixed the IP header, move it forward. */
3817 3647 mp->b_rptr += newpos;
3818 3648 if (IS_P2ALIGNED(mp->b_rptr, sizeof (uint32_t))) {
3819 3649 dest32 = (uint32_t *)(mp->b_rptr + ah_offset);
3820 3650 while (--dest32 >= (uint32_t *)mp->b_rptr)
3821 3651 *dest32 = *(dest32 - (newpos >> 2));
3822 3652 } else {
3823 3653 dest = mp->b_rptr + ah_offset;
3824 3654 while (--dest >= mp->b_rptr)
3825 3655 *dest = *(dest - newpos);
3826 3656 }
3827 3657 freeb(phdr_mp);
3828 3658
3829 3659 /*
3830 3660 * If SA is labelled, use its label, else inherit the label
3831 3661 */
3832 3662 if (is_system_labeled() && (assoc->ipsa_tsl != NULL)) {
3833 3663 if (!ip_recv_attr_replace_label(ira, assoc->ipsa_tsl)) {
3834 3664 ip_drop_packet(mp, B_TRUE, ira->ira_ill,
3835 3665 DROPPER(ipss, ipds_ah_nomem), &ahstack->ah_dropper);
3836 3666 BUMP_MIB(ira->ira_ill->ill_ip_mib, ipIfStatsInDiscards);
3837 3667 return (NULL);
3838 3668 }
3839 3669 }
3840 3670
3841 3671 if (assoc->ipsa_state == IPSA_STATE_IDLE) {
3842 3672 /*
3843 3673 * Cluster buffering case. Tell caller that we're
3844 3674 * handling the packet.
3845 3675 */
3846 3676 sadb_buf_pkt(assoc, mp, ira);
3847 3677 return (NULL);
3848 3678 }
3849 3679
3850 3680 return (mp);
3851 3681
3852 3682 ah_in_discard:
3853 3683 IP_AH_BUMP_STAT(ipss, in_discards);
3854 3684 ip_drop_packet(phdr_mp, B_TRUE, ira->ira_ill, counter,
3855 3685 &ahstack->ah_dropper);
3856 3686 BUMP_MIB(ira->ira_ill->ill_ip_mib, ipIfStatsInDiscards);
3857 3687 return (NULL);
3858 3688 }
3859 3689
3860 3690 /*
3861 3691 * Invoked after processing of an outbound packet by the
3862 3692 * kernel crypto framework, either by ah_submit_req() for a request
3863 3693 * executed syncrhonously, or by the KEF callback for a request
3864 3694 * executed asynchronously.
3865 3695 */
3866 3696 static mblk_t *
3867 3697 ah_auth_out_done(mblk_t *phdr_mp, ip_xmit_attr_t *ixa, ipsec_crypto_t *ic)
3868 3698 {
3869 3699 mblk_t *mp;
3870 3700 int align_len;
3871 3701 uint32_t hdrs_length;
3872 3702 uchar_t *ptr;
3873 3703 uint32_t length;
3874 3704 boolean_t isv4;
3875 3705 size_t icv_len;
3876 3706 netstack_t *ns = ixa->ixa_ipst->ips_netstack;
3877 3707 ipsecah_stack_t *ahstack = ns->netstack_ipsecah;
3878 3708 ipsec_stack_t *ipss = ns->netstack_ipsec;
3879 3709 ill_t *ill = ixa->ixa_nce->nce_ill;
3880 3710
3881 3711 isv4 = (ixa->ixa_flags & IXAF_IS_IPV4);
3882 3712 icv_len = ic->ic_crypto_mac.cd_raw.iov_len;
3883 3713
3884 3714 mp = phdr_mp->b_cont;
3885 3715 if (mp == NULL) {
3886 3716 ip_drop_packet(phdr_mp, B_FALSE, ill,
3887 3717 DROPPER(ipss, ipds_ah_nomem),
3888 3718 &ahstack->ah_dropper);
3889 3719 BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutDiscards);
3890 3720 return (NULL);
3891 3721 }
3892 3722 mp->b_rptr -= ic->ic_skip_len;
3893 3723
3894 3724 ASSERT(ixa->ixa_flags & IXAF_IPSEC_SECURE);
3895 3725 ASSERT(ixa->ixa_ipsec_ah_sa != NULL);
3896 3726 ah_set_usetime(ixa->ixa_ipsec_ah_sa, B_FALSE);
3897 3727
3898 3728 if (isv4) {
3899 3729 ipha_t *ipha;
3900 3730 ipha_t *nipha;
3901 3731
3902 3732 ipha = (ipha_t *)mp->b_rptr;
3903 3733 hdrs_length = ipha->ipha_version_and_hdr_length -
3904 3734 (uint8_t)((IP_VERSION << 4));
3905 3735 hdrs_length <<= 2;
3906 3736 align_len = P2ALIGN(icv_len + IPV4_PADDING_ALIGN - 1,
3907 3737 IPV4_PADDING_ALIGN);
3908 3738 /*
3909 3739 * phdr_mp must have the right amount of space for the
3910 3740 * combined IP and AH header. Copy the IP header and
3911 3741 * the ack_data onto AH. Note that the AH header was
3912 3742 * already formed before the ICV calculation and hence
3913 3743 * you don't have to copy it here.
3914 3744 */
3915 3745 bcopy(mp->b_rptr, phdr_mp->b_rptr, hdrs_length);
3916 3746
3917 3747 ptr = phdr_mp->b_rptr + hdrs_length + sizeof (ah_t);
3918 3748 bcopy(phdr_mp->b_wptr, ptr, icv_len);
3919 3749
3920 3750 /*
3921 3751 * Compute the new header checksum as we are assigning
3922 3752 * IPPROTO_AH and adjusting the length here.
3923 3753 */
3924 3754 nipha = (ipha_t *)phdr_mp->b_rptr;
3925 3755
3926 3756 nipha->ipha_protocol = IPPROTO_AH;
3927 3757 length = ntohs(nipha->ipha_length);
3928 3758 length += (sizeof (ah_t) + align_len);
3929 3759 nipha->ipha_length = htons((uint16_t)length);
3930 3760 nipha->ipha_hdr_checksum = 0;
3931 3761 nipha->ipha_hdr_checksum = (uint16_t)ip_csum_hdr(nipha);
3932 3762 } else {
3933 3763 ip6_t *ip6h;
3934 3764 ip6_t *nip6h;
3935 3765 uint_t ah_offset;
3936 3766
3937 3767 ip6h = (ip6_t *)mp->b_rptr;
3938 3768 nip6h = (ip6_t *)phdr_mp->b_rptr;
3939 3769 align_len = P2ALIGN(icv_len + IPV6_PADDING_ALIGN - 1,
3940 3770 IPV6_PADDING_ALIGN);
3941 3771 /*
3942 3772 * phdr_mp must have the right amount of space for the
3943 3773 * combined IP and AH header. Copy the IP header with
3944 3774 * options into the pseudo header. When we constructed
3945 3775 * a pseudo header, we did not copy some of the mutable
3946 3776 * fields. We do it now by calling ah_fix_phdr_v6()
3947 3777 * with the last argument B_TRUE. It returns the
3948 3778 * ah_offset into the pseudo header.
3949 3779 */
3950 3780
3951 3781 bcopy(ip6h, nip6h, IPV6_HDR_LEN);
3952 3782 ah_offset = ah_fix_phdr_v6(nip6h, ip6h, B_TRUE, B_TRUE);
3953 3783 ASSERT(ah_offset != 0);
3954 3784 /*
3955 3785 * phdr_mp can hold exactly the whole IP header with options
3956 3786 * plus the AH header also. Thus subtracting the AH header's
3957 3787 * size should give exactly how much of the original header
3958 3788 * should be skipped.
3959 3789 */
3960 3790 hdrs_length = (phdr_mp->b_wptr - phdr_mp->b_rptr) -
3961 3791 sizeof (ah_t) - icv_len;
3962 3792 bcopy(phdr_mp->b_wptr, ((uint8_t *)nip6h + ah_offset +
3963 3793 sizeof (ah_t)), icv_len);
3964 3794 length = ntohs(nip6h->ip6_plen);
3965 3795 length += (sizeof (ah_t) + align_len);
3966 3796 nip6h->ip6_plen = htons((uint16_t)length);
3967 3797 }
3968 3798
3969 3799 /* Skip the original IP header */
3970 3800 mp->b_rptr += hdrs_length;
3971 3801 if (mp->b_rptr == mp->b_wptr) {
3972 3802 phdr_mp->b_cont = mp->b_cont;
3973 3803 freeb(mp);
3974 3804 }
3975 3805
3976 3806 return (phdr_mp);
3977 3807 }
3978 3808
3979 3809 /* Refactor me */
3980 3810 /*
3981 3811 * Wrapper to allow IP to trigger an AH association failure message
3982 3812 * during SA inbound selection.
3983 3813 */
3984 3814 void
3985 3815 ipsecah_in_assocfailure(mblk_t *mp, char level, ushort_t sl, char *fmt,
3986 3816 uint32_t spi, void *addr, int af, ip_recv_attr_t *ira)
3987 3817 {
3988 3818 netstack_t *ns = ira->ira_ill->ill_ipst->ips_netstack;
3989 3819 ipsecah_stack_t *ahstack = ns->netstack_ipsecah;
3990 3820 ipsec_stack_t *ipss = ns->netstack_ipsec;
3991 3821
3992 3822 if (ahstack->ipsecah_log_unknown_spi) {
3993 3823 ipsec_assocfailure(info.mi_idnum, 0, level, sl, fmt, spi,
3994 3824 addr, af, ahstack->ipsecah_netstack);
3995 3825 }
3996 3826
3997 3827 ip_drop_packet(mp, B_TRUE, ira->ira_ill,
3998 3828 DROPPER(ipss, ipds_ah_no_sa),
3999 3829 &ahstack->ah_dropper);
4000 3830 }
4001 3831
4002 3832 /*
4003 3833 * Initialize the AH input and output processing functions.
4004 3834 */
4005 3835 void
4006 3836 ipsecah_init_funcs(ipsa_t *sa)
4007 3837 {
4008 3838 if (sa->ipsa_output_func == NULL)
4009 3839 sa->ipsa_output_func = ah_outbound;
4010 3840 if (sa->ipsa_input_func == NULL)
4011 3841 sa->ipsa_input_func = ah_inbound;
4012 3842 }
|
↓ open down ↓ |
2111 lines elided |
↑ open up ↑ |
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX