Home | History | Annotate | Download | only in ip
      1 /*
      2  * CDDL HEADER START
      3  *
      4  * The contents of this file are subject to the terms of the
      5  * Common Development and Distribution License (the "License").
      6  * You may not use this file except in compliance with the License.
      7  *
      8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
      9  * or http://www.opensolaris.org/os/licensing.
     10  * See the License for the specific language governing permissions
     11  * and limitations under the License.
     12  *
     13  * When distributing Covered Code, include this CDDL HEADER in each
     14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
     15  * If applicable, add the following below this CDDL HEADER, with the
     16  * fields enclosed by brackets "[]" replaced with your own identifying
     17  * information: Portions Copyright [yyyy] [name of copyright owner]
     18  *
     19  * CDDL HEADER END
     20  */
     21 /*
     22  * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
     23  * Use is subject to license terms.
     24  */
     25 
     26 #include <sys/types.h>
     27 #include <sys/stream.h>
     28 #include <sys/strsun.h>
     29 #include <sys/sunddi.h>
     30 #include <sys/kstat.h>
     31 #include <sys/kmem.h>
     32 #include <net/pfkeyv2.h>
     33 #include <inet/common.h>
     34 #include <inet/ip.h>
     35 #include <inet/ip6.h>
     36 #include <inet/ipsec_info.h>
     37 #include <inet/ipsec_impl.h>
     38 #include <inet/ipdrop.h>
     39 
     40 /*
     41  * Packet drop facility.
     42  */
     43 
     44 /*
     45  * Initialize drop facility kstats.
     46  */
     47 void
     48 ip_drop_init(ipsec_stack_t *ipss)
     49 {
     50 	ipss->ipsec_ip_drop_kstat = kstat_create_netstack("ip", 0, "ipdrop",
     51 	    "net", KSTAT_TYPE_NAMED,
     52 	    sizeof (struct ip_dropstats) / sizeof (kstat_named_t),
     53 	    KSTAT_FLAG_PERSISTENT, ipss->ipsec_netstack->netstack_stackid);
     54 
     55 	if (ipss->ipsec_ip_drop_kstat == NULL ||
     56 	    ipss->ipsec_ip_drop_kstat->ks_data == NULL)
     57 		return;
     58 
     59 	/*
     60 	 * Note: here ipss->ipsec_ip_drop_types is initialized, however,
     61 	 * if the previous kstat_create_netstack failed, it will remain
     62 	 * NULL. Note this is done for all stack instances, so it *could*
     63 	 * be NULL. Hence a non-NULL checking is added where
     64 	 * ipss->ipsec_ip_drop_types is used. This checking is hidden in
     65 	 * the DROPPER macro.
     66 	 */
     67 	ipss->ipsec_ip_drop_types = ipss->ipsec_ip_drop_kstat->ks_data;
     68 
     69 	/* TCP IPsec drop statistics. */
     70 	kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_tcp_clear,
     71 	    "tcp_clear", KSTAT_DATA_UINT64);
     72 	kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_tcp_secure,
     73 	    "tcp_secure", KSTAT_DATA_UINT64);
     74 	kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_tcp_mismatch,
     75 	    "tcp_mismatch", KSTAT_DATA_UINT64);
     76 	kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_tcp_ipsec_alloc,
     77 	    "tcp_ipsec_alloc", KSTAT_DATA_UINT64);
     78 
     79 	/* SADB-specific drop statistics. */
     80 	kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_sadb_inlarval_timeout,
     81 	    "sadb_inlarval_timeout", KSTAT_DATA_UINT64);
     82 	kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_sadb_inlarval_replace,
     83 	    "sadb_inlarval_replace", KSTAT_DATA_UINT64);
     84 	kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_sadb_inidle_overflow,
     85 	    "sadb_inidle_overflow", KSTAT_DATA_UINT64);
     86 	kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_sadb_inidle_timeout,
     87 	    "sadb_inidle_timeout", KSTAT_DATA_UINT64);
     88 	kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_sadb_acquire_nomem,
     89 	    "sadb_acquire_nomem", KSTAT_DATA_UINT64);
     90 	kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_sadb_acquire_toofull,
     91 	    "sadb_acquire_toofull", KSTAT_DATA_UINT64);
     92 	kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_sadb_acquire_timeout,
     93 	    "sadb_acquire_timeout", KSTAT_DATA_UINT64);
     94 
     95 	/* SPD drop statistics. */
     96 	kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_spd_ahesp_diffid,
     97 	    "spd_ahesp_diffid", KSTAT_DATA_UINT64);
     98 	kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_spd_loopback_mismatch,
     99 	    "spd_loopback_mismatch", KSTAT_DATA_UINT64);
    100 	kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_spd_explicit,
    101 	    "spd_explicit", KSTAT_DATA_UINT64);
    102 	kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_spd_got_secure,
    103 	    "spd_got_secure", KSTAT_DATA_UINT64);
    104 	kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_spd_got_clear,
    105 	    "spd_got_clear", KSTAT_DATA_UINT64);
    106 	kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_spd_bad_ahalg,
    107 	    "spd_bad_ahalg", KSTAT_DATA_UINT64);
    108 	kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_spd_got_ah,
    109 	    "spd_got_ah", KSTAT_DATA_UINT64);
    110 	kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_spd_bad_espealg,
    111 	    "spd_bad_espealg", KSTAT_DATA_UINT64);
    112 	kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_spd_bad_espaalg,
    113 	    "spd_bad_espaalg", KSTAT_DATA_UINT64);
    114 	kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_spd_got_esp,
    115 	    "spd_got_esp", KSTAT_DATA_UINT64);
    116 	kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_spd_got_selfencap,
    117 	    "spd_got_selfencap", KSTAT_DATA_UINT64);
    118 	kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_spd_bad_selfencap,
    119 	    "spd_bad_selfencap", KSTAT_DATA_UINT64);
    120 	kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_spd_nomem,
    121 	    "spd_nomem", KSTAT_DATA_UINT64);
    122 	kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_spd_ah_badid,
    123 	    "spd_ah_badid", KSTAT_DATA_UINT64);
    124 	kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_spd_ah_innermismatch,
    125 	    "spd_ah_innermismatch", KSTAT_DATA_UINT64);
    126 	kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_spd_esp_innermismatch,
    127 	    "spd_esp_innermismatch", KSTAT_DATA_UINT64);
    128 	kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_spd_esp_badid,
    129 	    "spd_esp_badid", KSTAT_DATA_UINT64);
    130 	kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_spd_no_policy,
    131 	    "spd_no_policy", KSTAT_DATA_UINT64);
    132 	kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_spd_malformed_packet,
    133 	    "spd_malformed_packet", KSTAT_DATA_UINT64);
    134 	kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_spd_malformed_frag,
    135 	    "spd_malformed_frag", KSTAT_DATA_UINT64);
    136 	kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_spd_overlap_frag,
    137 	    "spd_overlap_frag", KSTAT_DATA_UINT64);
    138 	kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_spd_evil_frag,
    139 	    "spd_evil_frag", KSTAT_DATA_UINT64);
    140 	kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_spd_max_frags,
    141 	    "spd_max_frags", KSTAT_DATA_UINT64);
    142 
    143 	/* ESP-specific drop statistics. */
    144 
    145 	kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_esp_nomem,
    146 	    "esp_nomem", KSTAT_DATA_UINT64);
    147 	kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_esp_no_sa,
    148 	    "esp_no_sa", KSTAT_DATA_UINT64);
    149 	kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_esp_early_replay,
    150 	    "esp_early_replay", KSTAT_DATA_UINT64);
    151 	kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_esp_replay,
    152 	    "esp_replay", KSTAT_DATA_UINT64);
    153 	kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_esp_bytes_expire,
    154 	    "esp_bytes_expire", KSTAT_DATA_UINT64);
    155 	kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_esp_bad_padlen,
    156 	    "esp_bad_padlen", KSTAT_DATA_UINT64);
    157 	kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_esp_bad_padding,
    158 	    "esp_bad_padding", KSTAT_DATA_UINT64);
    159 	kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_esp_bad_auth,
    160 	    "esp_bad_auth", KSTAT_DATA_UINT64);
    161 	kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_esp_crypto_failed,
    162 	    "esp_crypto_failed", KSTAT_DATA_UINT64);
    163 	kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_esp_icmp,
    164 	    "esp_icmp", KSTAT_DATA_UINT64);
    165 	kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_esp_nat_t_ipsec,
    166 	    "esp_nat_t_ipsec", KSTAT_DATA_UINT64);
    167 	kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_esp_nat_t_ka,
    168 	    "esp_nat_t_ka", KSTAT_DATA_UINT64);
    169 
    170 	/* AH-specific drop statistics. */
    171 	kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_ah_nomem,
    172 	    "ah_nomem", KSTAT_DATA_UINT64);
    173 	kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_ah_bad_v6_hdrs,
    174 	    "ah_bad_v6_hdrs", KSTAT_DATA_UINT64);
    175 	kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_ah_bad_v4_opts,
    176 	    "ah_bad_v4_opts", KSTAT_DATA_UINT64);
    177 	kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_ah_no_sa,
    178 	    "ah_no_sa", KSTAT_DATA_UINT64);
    179 	kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_ah_bad_length,
    180 	    "ah_bad_length", KSTAT_DATA_UINT64);
    181 	kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_ah_bad_auth,
    182 	    "ah_bad_auth", KSTAT_DATA_UINT64);
    183 	kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_ah_crypto_failed,
    184 	    "ah_crypto_failed", KSTAT_DATA_UINT64);
    185 	kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_ah_early_replay,
    186 	    "ah_early_replay", KSTAT_DATA_UINT64);
    187 	kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_ah_replay,
    188 	    "ah_replay", KSTAT_DATA_UINT64);
    189 	kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_ah_bytes_expire,
    190 	    "ah_bytes_expire", KSTAT_DATA_UINT64);
    191 
    192 	/* IP-specific drop statistics. */
    193 	kstat_named_init(&ipss->ipsec_ip_drop_types->ipds_ip_ipsec_not_loaded,
    194 	    "ip_ipsec_not_loaded", KSTAT_DATA_UINT64);
    195 
    196 	kstat_install(ipss->ipsec_ip_drop_kstat);
    197 }
    198 
    199 void
    200 ip_drop_destroy(ipsec_stack_t *ipss)
    201 {
    202 	kstat_delete_netstack(ipss->ipsec_ip_drop_kstat,
    203 	    ipss->ipsec_netstack->netstack_stackid);
    204 	ipss->ipsec_ip_drop_kstat = NULL;
    205 	ipss->ipsec_ip_drop_types = NULL;
    206 }
    207 
    208 /*
    209  * Register a packet dropper.
    210  */
    211 void
    212 ip_drop_register(ipdropper_t *ipd, char *name)
    213 {
    214 	if (ipd->ipd_name != NULL) {
    215 		cmn_err(CE_WARN,
    216 		    "ip_drop_register: ipdropper %s already registered with %s",
    217 		    name, ipd->ipd_name);
    218 		return;
    219 	}
    220 
    221 	/* Assume that name is reasonable in length.  This isn't user-land. */
    222 	ipd->ipd_name = kmem_alloc(strlen(name) + 1, KM_SLEEP);
    223 	(void) strcpy(ipd->ipd_name, name);
    224 }
    225 
    226 /*
    227  * Un-register a packet dropper.
    228  */
    229 void
    230 ip_drop_unregister(ipdropper_t *ipd)
    231 {
    232 	if (ipd->ipd_name == NULL) {
    233 		cmn_err(CE_WARN,
    234 		    "ip_drop_unregister: not registered (%p)\n",
    235 		    (void *)ipd);
    236 		return;
    237 	}
    238 	kmem_free(ipd->ipd_name, strlen(ipd->ipd_name) + 1);
    239 
    240 	ipd->ipd_name = NULL;
    241 }
    242 
    243 /*
    244  * Actually drop a packet.  Many things could happen here, but at the least,
    245  * the packet will be freemsg()ed.
    246  */
    247 /* ARGSUSED */
    248 void
    249 ip_drop_packet(mblk_t *mp, boolean_t inbound, ill_t *arriving,
    250     ire_t *outbound_ire, struct kstat_named *counter, ipdropper_t *who_called)
    251 {
    252 	mblk_t *ipsec_mp = NULL;
    253 	ipsec_in_t *ii = NULL;
    254 	ipsec_out_t *io = NULL;
    255 	ipsec_info_t *in;
    256 	uint8_t vers;
    257 
    258 	if (mp == NULL) {
    259 		/*
    260 		 * Return immediately - NULL packets should not affect any
    261 		 * statistics.
    262 		 */
    263 		return;
    264 	}
    265 
    266 	if (DB_TYPE(mp) == M_CTL) {
    267 		in = (ipsec_info_t *)mp->b_rptr;
    268 
    269 		if (in->ipsec_info_type == IPSEC_IN)
    270 			ii = (ipsec_in_t *)in;
    271 		else if (in->ipsec_info_type == IPSEC_OUT)
    272 			io = (ipsec_out_t *)in;
    273 
    274 		/* See if this is an ICMP packet (check for v4/v6). */
    275 		vers = (*mp->b_rptr) >> 4;
    276 		if (vers != IPV4_VERSION && vers != IPV6_VERSION) {
    277 			/*
    278 			 * If not, it's some other sort of M_CTL to be freed.
    279 			 * For now, treat it like an ordinary packet.
    280 			 */
    281 			ipsec_mp = mp;
    282 			mp = mp->b_cont;
    283 		}
    284 	}
    285 
    286 	/* Reality checks */
    287 	if (inbound && io != NULL)
    288 		cmn_err(CE_WARN,
    289 		    "ip_drop_packet: inbound packet with IPSEC_OUT");
    290 
    291 	if (outbound_ire != NULL && ii != NULL)
    292 		cmn_err(CE_WARN,
    293 		    "ip_drop_packet: outbound packet with IPSEC_IN");
    294 
    295 	/* At this point, mp always points to the data. */
    296 	/*
    297 	 * Can't make the assertion yet - It could be an inbound ICMP
    298 	 * message, which is M_CTL but with data in it.
    299 	 */
    300 	/* ASSERT(mp->b_datap->db_type == M_DATA); */
    301 
    302 	/* Increment the bean counter, if available. */
    303 	if (counter != NULL) {
    304 		switch (counter->data_type) {
    305 		case KSTAT_DATA_INT32:
    306 			counter->value.i32++;
    307 			break;
    308 		case KSTAT_DATA_UINT32:
    309 			counter->value.ui32++;
    310 			break;
    311 		case KSTAT_DATA_INT64:
    312 			counter->value.i64++;
    313 			break;
    314 		case KSTAT_DATA_UINT64:
    315 			counter->value.ui64++;
    316 			break;
    317 		/* Other types we can't handle for now. */
    318 		}
    319 
    320 		/* TODO?  Copy out kstat name for use in logging. */
    321 	}
    322 
    323 	/* TODO: log the packet details if logging is called for. */
    324 	/* TODO: queue the packet onto a snoop-friendly queue. */
    325 
    326 	/* If I haven't queued the packet or some such nonsense, free it. */
    327 	if (ipsec_mp != NULL)
    328 		freeb(ipsec_mp);
    329 	/*
    330 	 * ASSERT this isn't a b_next linked mblk chain where a
    331 	 * chained dropper should be used instead
    332 	 */
    333 	ASSERT(mp->b_prev == NULL && mp->b_next == NULL);
    334 	freemsg(mp);
    335 }
    336