--- old/exception_lists/packaging	Mon Feb 22 16:47:14 2016
+++ new/exception_lists/packaging	Mon Feb 22 16:47:14 2016
@@ -62,6 +62,9 @@
 usr/lib/amd64/llib-lsoftcrypto.ln	i386
 usr/lib/sparcv9/llib-lsoftcrypto.ln	sparc
 
+# libRLike for IKE rate-limiting
+usr/lib/llib-lRLike
+
 #
 # The following files are used by the DHCP service, the
 # standalone's DHCP implementation, and the kernel (nfs_dlboot).
--- old/usr/src/cmd/cmd-inet/usr.lib/Makefile	Mon Feb 22 16:47:14 2016
+++ new/usr/src/cmd/cmd-inet/usr.lib/Makefile	Mon Feb 22 16:47:14 2016
@@ -22,10 +22,11 @@
 #
 # Copyright (c) 1996, 2010, Oracle and/or its affiliates. All rights reserved.
 # Copyright 2014 Garrett D'Amore <garrett@damore.org>
+# Copyright 2016, OmniTI Computer Consulting, Inc. All rights reserved.
 #
 
 SUBDIRS=	bridged ilbd in.chargend in.daytimed \
-		in.discardd in.echod in.mpathd in.ndpd \
+		in.discardd in.echod in.iked in.mpathd in.ndpd \
 		in.ripngd in.timed inetd mdnsd ncaconfd pppoe \
 		slpd vrrpd wanboot wpad
 
@@ -50,10 +51,7 @@
 all clean clobber lint: $(SUBDIRS)
 
 install: $(SUBDIRS)
-	-$(RM) $(ROOTLIBINET)/in.iked
-	-$(LN) $(ISAEXEC) $(ROOTLIBINET)/in.iked
 
-
 _msg: $(MSGSUBDIRS)
 
 $(SUBDIRS): FRC
--- /dev/null	Mon Feb 22 16:47:14 2016
+++ new/usr/src/cmd/cmd-inet/usr.lib/in.iked/Makefile	Mon Feb 22 16:47:14 2016
@@ -0,0 +1,38 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2016 OmniTI Computer Consulting, Inc. All rights reserved.
+#
+
+#
+# cmd/cmd-inet/usr.lib/in.iked/Makefile
+# NOTE: The SMF manifest comes in with the closed binaries.
+#
+
+PROG=		in.iked
+CLOBBEROBJS += $(PROG)
+CLEANOBJS += $(PROG)
+
+include		../../../Makefile.cmd
+
+all: $(PROG)
+
+lint:
+
+clean:
+	$(RM) $(PROG)
+
+include		../Makefile.lib
+
+install: all $(ROOTLIBINETPROG)
+
+include		../../../Makefile.targ
--- /dev/null	Mon Feb 22 16:47:15 2016
+++ new/usr/src/cmd/cmd-inet/usr.lib/in.iked/in.iked.sh	Mon Feb 22 16:47:15 2016
@@ -0,0 +1,47 @@
+#!/usr/bin/pfsh
+
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2016 OmniTI Computer Consulting, Inc. All rights reserved.
+#
+
+#
+# in.iked used to be a hard link to "isaexec", but thanks to its closed-source
+# and recent discoveries about amplification attacks, we need to instead
+# put a wrapper around the actual executables and LD_PRELOAD an interposer to
+# __xnet_sendmsg to rate-limit messages.
+#
+
+# First determine the right in.iked binary.
+EXECDIR=`/usr/bin/dirname $0`
+ISA=`/usr/bin/isainfo -k`
+
+if [ $ISA = "i386" ]; then
+    ISADIR="i86"
+else
+    # Should work for "amd64", "sparc", and "sparcv9".
+    ISADIR=$ISA
+fi
+
+# Then set up LD_PRELOAD to interpose on __xnet_sendmsg().
+if [ -e $LD_PRELOAD ]; then
+    LD_PRELOAD=libRLike.so
+else
+    LD_PRELOAD="libRLike.so $LD_PRELOAD"
+fi
+
+export LD_PRELOAD
+
+# echo "LD_PRELOAD is " $LD_PRELOAD
+# echo "Would execute $EXECDIR/$ISADIR/in.iked"
+exec $EXECDIR/$ISADIR/in.iked
--- old/usr/src/lib/Makefile	Mon Feb 22 16:47:15 2016
+++ new/usr/src/lib/Makefile	Mon Feb 22 16:47:15 2016
@@ -184,6 +184,7 @@
 	libresolv	\
 	libresolv2	\
 	librestart	\
+	libRLike	\
 	librpcsvc	\
 	librsm		\
 	librstp		\
--- /dev/null	Mon Feb 22 16:47:15 2016
+++ new/usr/src/lib/libRLike/Makefile	Mon Feb 22 16:47:15 2016
@@ -0,0 +1,38 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2016 OmniTI Computer Consulting, Inc. All rights reserved.
+#
+
+include ../Makefile.lib
+
+SUBDIRS	=	$(MACH)
+$(BUILD64)SUBDIRS += $(MACH64)
+
+all := 		TARGET = all
+clean :=	TARGET = clean
+clobber :=	TARGET = clobber
+install	:=	TARGET = install
+lint :=		TARGET = lint
+
+all clean clobber install lint: $(SUBDIRS)
+
+install_h:
+
+include ../../Makefile.msg.targ
+
+$(SUBDIRS): FRC
+	@cd $@; pwd; $(MAKE) $(TARGET)
+
+FRC:
+
+include ../Makefile.targ
--- /dev/null	Mon Feb 22 16:47:15 2016
+++ new/usr/src/lib/libRLike/Makefile.com	Mon Feb 22 16:47:15 2016
@@ -0,0 +1,37 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2016 OmniTI Computer Consulting, Inc. All rights reserved.
+#
+
+LIBRARY =	libRLike.a
+VERS =		.1
+OBJECTS =	RLike.o
+
+include ../../Makefile.lib
+
+LIBS +=		$(DYNLIB)
+
+LDLIBS +=	-lc -lsocket
+
+SRCDIR =	../common
+
+CFLAGS +=	$(CCVERBOSE)
+CPPFLAGS +=	-I$(SRCDIR)
+
+.KEEP_STATE:
+
+all: $(LIBS)
+
+lint: lintcheck
+
+include ../../Makefile.targ
--- /dev/null	Mon Feb 22 16:47:15 2016
+++ new/usr/src/lib/libRLike/amd64/Makefile	Mon Feb 22 16:47:15 2016
@@ -0,0 +1,19 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2016 OmniTI Computer Consulting, Inc. All rights reserved.
+#
+
+include ../Makefile.com
+include ../../Makefile.lib.64
+
+install: all $(ROOTLIBS64) $(ROOTLINKS64)
--- /dev/null	Mon Feb 22 16:47:15 2016
+++ new/usr/src/lib/libRLike/common/RLike.c	Mon Feb 22 16:47:15 2016
@@ -0,0 +1,130 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2016 OmniTI Computer Consulting, Inc. All rights reserved.
+ */
+
+/*
+ * Replacement for __xnet_sendmsg() which will perform rate-limiting based
+ * on various factors.
+ *
+ * This should only be LD_PRELOAD-ed against in.iked, which is closed source,
+ * but we do know a few things about it:
+ *
+ * 1.) It's single-threaded, apart from the IKE door thread.  The door thread
+ * is kept in check by a mutex deep inside libike, which is held during
+ * most of its runtime, including calls to sendmsg().
+ *
+ * 2.) By default, it has one socket for every local address, bound to
+ * UDP port 500, and one for every IPv4 local addres, bound to UDP port 4500
+ * (NAT-Traversal).
+ *
+ * We can exploit what we know to make simplifying assumptions, keep global
+ * state, and other fun things.
+ */
+
+#include <sys/types.h>
+#include <sys/time.h>
+#include <sys/socket.h>
+#include <sys/stropts.h>
+#include <sys/stream.h>
+#include <sys/socketvar.h>
+#include <sys/sockio.h>
+
+#include <errno.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <stropts.h>
+#include <stdio.h>
+#include <strings.h>
+
+/* For the actual syscall... */
+extern int _so_sendmsg();
+
+/* For now, settable with mdb -p `pgrep in.iked` */
+/* XXX KEBE ASKS, should we sugar-coat that with "ikeadm ratelimit {on,off}"? */
+boolean_t RL_ike_sendmsg;
+
+hrtime_t last_packet_sent = 0;
+hrtime_t rapid_fire_threshold = MSEC2NSEC(500);	/* 1/2 second */
+int rapid_fire_count = 8;
+int current_spray = 0;
+
+/*
+ * Return B_TRUE if we think we can send the packet.
+ *
+ * For starters, base it on more than "rapid_fire_count" packets
+ * taking less than "rapid_fire_threshhold" each.  No DPI.
+ */
+/* ARGSUSED */
+static boolean_t
+evaluate_situation(int sock, const struct msghdr *msg)
+{
+	hrtime_t now;
+	struct sockaddr_in6 sin6;
+	socklen_t socklen = sizeof (sin6);
+
+	if (getsockname(sock, (struct sockaddr *)&sin6, &socklen) == -1) {
+		/* HUH wha?!? */
+		/* XXX KEBE SAYS PUT A DTRACE PROBE IN HERE! */
+		return (B_TRUE);
+	}
+	/* sin6_port & sin_port have the same offset. */
+	if (htons(sin6.sin6_port) != 500 && htons(sin6.sin6_port) != 4500) {
+		/* Must be doing DNS or LDAP... not an IKE packet. */
+		/* XXX KEBE SAYS PUT A DTRACE PROBE IN HERE! */
+		return (B_TRUE);
+	}
+
+	now = gethrtime();
+	if (last_packet_sent + rapid_fire_threshold < now) {
+		if (current_spray > 0) 
+			current_spray--;
+		goto good;
+	}
+
+	/* XXX KEBE ASKS DTRACE PROBE FOR RAPID FIRE INCREASE? */
+	current_spray++;
+	if (current_spray < rapid_fire_count)
+		goto good;
+
+	/* We should never have the current spray exceed rapid_fire_count. */
+	current_spray = rapid_fire_count;
+
+	/* XXX KEBE SAYS PUT A DTRACE PROBE IN HERE! */
+
+	/* Drop the packet. */
+	return (B_FALSE);
+
+good:
+	last_packet_sent = now;
+	return (B_TRUE);
+}
+
+int
+__xnet_sendmsg(int sock, const struct msghdr *msg, int flags)
+{
+	/* Fast path... */
+	if (!RL_ike_sendmsg || evaluate_situation(sock, msg))
+		return (_so_sendmsg(sock, msg, flags | MSG_XPG4_2));
+	else {
+		/*
+		 * Don't actually send the message, but pretend like you did.
+		 *
+		 * Maybe we could return -1 and set errno to something, but
+		 * knowing what's right would require further disassembling of
+		 * libike, or having libike source (which is closed).
+		 */
+		return (0);
+	}
+}
+
--- /dev/null	Mon Feb 22 16:47:15 2016
+++ new/usr/src/lib/libRLike/common/llib-lRLike	Mon Feb 22 16:47:15 2016
@@ -0,0 +1,17 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2016 OmniTI Computer Consulting, Inc. All rights reserved.
+ */
+
+/* LINTLIBRARY */
+/* PROTOLIB1 */
--- /dev/null	Mon Feb 22 16:47:15 2016
+++ new/usr/src/lib/libRLike/common/mapfile-vers	Mon Feb 22 16:47:15 2016
@@ -0,0 +1,37 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2016 OmniTI Computer Consulting, Inc. All rights reserved.
+#
+
+#
+# MAPFILE HEADER START
+#
+# WARNING:  STOP NOW.  DO NOT MODIFY THIS FILE.
+# Object versioning must comply with the rules detailed in
+#
+#	usr/src/lib/README.mapfiles
+#
+# You should not be making modifications here until you've read the most current
+# copy of that file. If you need help, contact a gatekeeper for guidance.
+#
+# MAPFILE HEADER END
+#
+
+$mapfile_version 2
+
+SYMBOL_VERSION SUNWprivate_1.1 {
+    global:
+	__xnet_sendmsg			{ FLAGS = NODIRECT };
+    local:
+	*;
+};
--- /dev/null	Mon Feb 22 16:47:15 2016
+++ new/usr/src/lib/libRLike/i386/Makefile	Mon Feb 22 16:47:15 2016
@@ -0,0 +1,18 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2016 OmniTI Computer Consulting, Inc. All rights reserved.
+#
+
+include ../Makefile.com
+
+install: all $(ROOTLIBS) $(ROOTLINKS) $(ROOTLINT)
--- /dev/null	Mon Feb 22 16:47:15 2016
+++ new/usr/src/lib/libRLike/sparc/Makefile	Mon Feb 22 16:47:15 2016
@@ -0,0 +1,18 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2016 OmniTI Computer Consulting, Inc. All rights reserved.
+#
+
+include ../Makefile.com
+
+install: all $(ROOTLIBS) $(ROOTLINKS) $(ROOTLINT)
--- /dev/null	Mon Feb 22 16:47:15 2016
+++ new/usr/src/lib/libRLike/sparcv9/Makefile	Mon Feb 22 16:47:15 2016
@@ -0,0 +1,19 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2016 OmniTI Computer Consulting, Inc. All rights reserved.
+#
+
+include ../Makefile.com
+include ../../Makefile.lib.64
+
+install: all $(ROOTLIBS64) $(ROOTLINKS64)
--- old/usr/src/pkg/manifests/SUNWcs.mf	Mon Feb 22 16:47:15 2016
+++ new/usr/src/pkg/manifests/SUNWcs.mf	Mon Feb 22 16:47:15 2016
@@ -1210,6 +1210,7 @@
 file path=usr/lib/inet/certdb mode=0555
 file path=usr/lib/inet/certlocal mode=0555
 file path=usr/lib/inet/certrldb mode=0555
+file path=usr/lib/inet/in.iked mode=0555
 file path=usr/lib/inet/inetd mode=0555
 file path=usr/lib/intrd mode=0555
 file path=usr/lib/isaexec mode=0555
@@ -1566,7 +1567,6 @@
 hardlink path=usr/lib/fs/ufs/fstyp target=../../../sbin/fstyp
 hardlink path=usr/lib/fs/ufs/quotaon \
     target=../../../../usr/lib/fs/ufs/quotaoff
-hardlink path=usr/lib/inet/in.iked target=../../../usr/lib/isaexec
 hardlink path=usr/sadm/bin/dispgid target=../../../usr/bin/ckgid
 hardlink path=usr/sadm/bin/dispuid target=../../../usr/bin/ckuid
 hardlink path=usr/sadm/bin/errange target=../../../usr/bin/ckrange
--- old/usr/src/pkg/manifests/system-library.mf	Mon Feb 22 16:47:15 2016
+++ new/usr/src/pkg/manifests/system-library.mf	Mon Feb 22 16:47:15 2016
@@ -321,6 +321,7 @@
 file path=lib/nss_user.so.1
 file path=usr/lib/$(ARCH64)/0@0.so.1
 file path=usr/lib/$(ARCH64)/getloginx.so.1
+file path=usr/lib/$(ARCH64)/libRLike.so.1
 file path=usr/lib/$(ARCH64)/libads.so.1
 file path=usr/lib/$(ARCH64)/libadutils.so.1
 file path=usr/lib/$(ARCH64)/libast.so.1
@@ -393,6 +394,7 @@
 file path=usr/lib/extendedFILE.so.1
 file path=usr/lib/getloginx.so.1
 file path=usr/lib/lib.b mode=0444
+file path=usr/lib/libRLike.so.1
 file path=usr/lib/libads.so.1
 file path=usr/lib/libadutils.so.1
 file path=usr/lib/libast.so.1
@@ -755,6 +757,7 @@
 link path=usr/ccs/lib/libtermcap.so target=../../../lib/libtermcap.so.1
 link path=usr/ccs/lib/libtermlib.so target=../../../lib/libcurses.so.1
 link path=usr/ccs/lib/liby.so target=../../lib/liby.so.1
+link path=usr/lib/$(ARCH64)/libRLike.so target=./libRLike.so.1
 link path=usr/lib/$(ARCH64)/libadm.so \
     target=../../../lib/$(ARCH64)/libadm.so.1
 link path=usr/lib/$(ARCH64)/libadm.so.1 \
@@ -1040,6 +1043,7 @@
 link path=usr/lib/cfgadm/scsi.so target=./scsi.so.1
 link path=usr/lib/cfgadm/shp.so target=./shp.so.1
 link path=usr/lib/cfgadm/usb.so target=./usb.so.1
+link path=usr/lib/libRLike.so target=./libRLike.so.1
 link path=usr/lib/libadm.so target=../../lib/libadm.so.1
 link path=usr/lib/libadm.so.1 target=../../lib/libadm.so.1
 link path=usr/lib/libads.so target=./libads.so.1
