xref: /onnv/onnv-gate/usr/src/uts/common/inet/ip/sadb.c

/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

#pragma ident	"%Z%%M%	%I%	%E% SMI"

#include <sys/types.h>
#include <sys/stream.h>
#include <sys/stropts.h>
#include <sys/errno.h>
#include <sys/ddi.h>
#include <sys/debug.h>
#include <sys/cmn_err.h>
#include <sys/stream.h>
#include <sys/strlog.h>
#include <sys/kmem.h>
#include <sys/sunddi.h>
#include <sys/tihdr.h>
#include <sys/atomic.h>
#include <sys/socket.h>
#include <sys/sysmacros.h>
#include <sys/crypto/common.h>
#include <sys/crypto/api.h>
#include <sys/zone.h>
#include <netinet/in.h>
#include <net/if.h>
#include <net/pfkeyv2.h>
#include <inet/common.h>
#include <netinet/ip6.h>
#include <inet/ip.h>
#include <inet/ip_ire.h>
#include <inet/ip6.h>
#include <inet/ipsec_info.h>
#include <inet/tcp.h>
#include <inet/sadb.h>
#include <inet/ipsec_impl.h>
#include <inet/ipsecah.h>
#include <inet/ipsecesp.h>
#include <sys/random.h>
#include <sys/dlpi.h>
#include <sys/iphada.h>
#include <inet/ip_if.h>
#include <inet/ipdrop.h>
#include <inet/ipclassifier.h>
#include <inet/sctp_ip.h>
#include <inet/tun.h>

/*
 * This source file contains Security Association Database (SADB) common
 * routines.  They are linked in with the AH module.  Since AH has no chance
 * of falling under export control, it was safe to link it in there.
 */

static mblk_t *sadb_extended_acquire(ipsec_selector_t *, ipsec_policy_t *,
    ipsec_action_t *, boolean_t, uint32_t, uint32_t, netstack_t *);
static void sadb_ill_df(ill_t *, mblk_t *, isaf_t *, int, boolean_t);
static ipsa_t *sadb_torch_assoc(isaf_t *, ipsa_t *, boolean_t, mblk_t **);
static void sadb_drain_torchq(queue_t *, mblk_t *);
static void sadb_destroy_acqlist(iacqf_t **, uint_t, boolean_t,
			    netstack_t *);
static void sadb_destroy(sadb_t *, netstack_t *);
static mblk_t *sadb_sa2msg(ipsa_t *, sadb_msg_t *);

static time_t sadb_add_time(time_t, uint64_t);
static void lifetime_fuzz(ipsa_t *);
static void age_pair_peer_list(templist_t *, sadb_t *, boolean_t);

/*
 * ipsacq_maxpackets is defined here to make it tunable
 * from /etc/system.
 */
extern uint64_t ipsacq_maxpackets;

#define	SET_EXPIRE(sa, delta, exp) {				\
	if (((sa)->ipsa_ ## delta) != 0) {				\
		(sa)->ipsa_ ## exp = sadb_add_time((sa)->ipsa_addtime,	\
			(sa)->ipsa_ ## delta);				\
	}								\
}

#define	UPDATE_EXPIRE(sa, delta, exp) {					\
	if (((sa)->ipsa_ ## delta) != 0) {				\
		time_t tmp = sadb_add_time((sa)->ipsa_usetime,		\
			(sa)->ipsa_ ## delta);				\
		if (((sa)->ipsa_ ## exp) == 0)				\
			(sa)->ipsa_ ## exp = tmp;			\
		else							\
			(sa)->ipsa_ ## exp = 				\
			    MIN((sa)->ipsa_ ## exp, tmp); 		\
	}								\
}


/* wrap the macro so we can pass it as a function pointer */
void
sadb_sa_refrele(void *target)
{
	IPSA_REFRELE(((ipsa_t *)target));
}

/*
 * We presume that sizeof (long) == sizeof (time_t) and that time_t is
 * a signed type.
 */
#define	TIME_MAX LONG_MAX

/*
 * PF_KEY gives us lifetimes in uint64_t seconds.  We presume that
 * time_t is defined to be a signed type with the same range as
 * "long".  On ILP32 systems, we thus run the risk of wrapping around
 * at end of time, as well as "overwrapping" the clock back around
 * into a seemingly valid but incorrect future date earlier than the
 * desired expiration.
 *
 * In order to avoid odd behavior (either negative lifetimes or loss
 * of high order bits) when someone asks for bizarrely long SA
 * lifetimes, we do a saturating add for expire times.
 *
 * We presume that ILP32 systems will be past end of support life when
 * the 32-bit time_t overflows (a dangerous assumption, mind you..).
 *
 * On LP64, 2^64 seconds are about 5.8e11 years, at which point we
 * will hopefully have figured out clever ways to avoid the use of
 * fixed-sized integers in computation.
 */
static time_t
sadb_add_time(time_t base, uint64_t delta)
{
	time_t sum;

	/*
	 * Clip delta to the maximum possible time_t value to
	 * prevent "overwrapping" back into a shorter-than-desired
	 * future time.
	 */
	if (delta > TIME_MAX)
		delta = TIME_MAX;
	/*
	 * This sum may still overflow.
	 */
	sum = base + delta;

	/*
	 * .. so if the result is less than the base, we overflowed.
	 */
	if (sum < base)
		sum = TIME_MAX;

	return (sum);
}

/*
 * Callers of this function have already created a working security
 * association, and have found the appropriate table & hash chain.  All this
 * function does is check duplicates, and insert the SA.  The caller needs to
 * hold the hash bucket lock and increment the refcnt before insertion.
 *
 * Return 0 if success, EEXIST if collision.
 */
#define	SA_UNIQUE_MATCH(sa1, sa2) \
	(((sa1)->ipsa_unique_id & (sa1)->ipsa_unique_mask) == \
	((sa2)->ipsa_unique_id & (sa2)->ipsa_unique_mask))

int
sadb_insertassoc(ipsa_t *ipsa, isaf_t *bucket)
{
	ipsa_t **ptpn = NULL;
	ipsa_t *walker;
	boolean_t unspecsrc;

	ASSERT(MUTEX_HELD(&bucket->isaf_lock));

	unspecsrc = IPSA_IS_ADDR_UNSPEC(ipsa->ipsa_srcaddr, ipsa->ipsa_addrfam);

	walker = bucket->isaf_ipsa;
	ASSERT(walker == NULL || ipsa->ipsa_addrfam == walker->ipsa_addrfam);

	/*
	 * Find insertion point (pointed to with **ptpn).  Insert at the head
	 * of the list unless there's an unspecified source address, then
	 * insert it after the last SA with a specified source address.
	 *
	 * BTW, you'll have to walk the whole chain, matching on {DST, SPI}
	 * checking for collisions.
	 */

	while (walker != NULL) {
		if (IPSA_ARE_ADDR_EQUAL(walker->ipsa_dstaddr,
		    ipsa->ipsa_dstaddr, ipsa->ipsa_addrfam)) {
			if (walker->ipsa_spi == ipsa->ipsa_spi)
				return (EEXIST);

			mutex_enter(&walker->ipsa_lock);
			if (ipsa->ipsa_state == IPSA_STATE_MATURE &&
			    (walker->ipsa_flags & IPSA_F_USED) &&
			    SA_UNIQUE_MATCH(walker, ipsa)) {
				walker->ipsa_flags |= IPSA_F_CINVALID;
			}
			mutex_exit(&walker->ipsa_lock);
		}

		if (ptpn == NULL && unspecsrc) {
			if (IPSA_IS_ADDR_UNSPEC(walker->ipsa_srcaddr,
			    walker->ipsa_addrfam))
				ptpn = walker->ipsa_ptpn;
			else if (walker->ipsa_next == NULL)
				ptpn = &walker->ipsa_next;
		}

		walker = walker->ipsa_next;
	}

	if (ptpn == NULL)
		ptpn = &bucket->isaf_ipsa;
	ipsa->ipsa_next = *ptpn;
	ipsa->ipsa_ptpn = ptpn;
	if (ipsa->ipsa_next != NULL)
		ipsa->ipsa_next->ipsa_ptpn = &ipsa->ipsa_next;
	*ptpn = ipsa;
	ipsa->ipsa_linklock = &bucket->isaf_lock;

	return (0);
}
#undef SA_UNIQUE_MATCH

/*
 * Free a security association.  Its reference count is 0, which means
 * I must free it.  The SA must be unlocked and must not be linked into
 * any fanout list.
 */
static void
sadb_freeassoc(ipsa_t *ipsa)
{
	ipsec_stack_t	*ipss = ipsa->ipsa_netstack->netstack_ipsec;

	ASSERT(ipss != NULL);
	ASSERT(!MUTEX_HELD(&ipsa->ipsa_lock));
	ASSERT(ipsa->ipsa_refcnt == 0);
	ASSERT(ipsa->ipsa_next == NULL);
	ASSERT(ipsa->ipsa_ptpn == NULL);

	ip_drop_packet(sadb_clear_lpkt(ipsa), B_TRUE, NULL, NULL,
	    DROPPER(ipss, ipds_sadb_inlarval_timeout),
	    &ipss->ipsec_sadb_dropper);

	mutex_enter(&ipsa->ipsa_lock);
	ipsec_destroy_ctx_tmpl(ipsa, IPSEC_ALG_AUTH);
	ipsec_destroy_ctx_tmpl(ipsa, IPSEC_ALG_ENCR);
	mutex_exit(&ipsa->ipsa_lock);

	/* bzero() these fields for paranoia's sake. */
	if (ipsa->ipsa_authkey != NULL) {
		bzero(ipsa->ipsa_authkey, ipsa->ipsa_authkeylen);
		kmem_free(ipsa->ipsa_authkey, ipsa->ipsa_authkeylen);
	}
	if (ipsa->ipsa_encrkey != NULL) {
		bzero(ipsa->ipsa_encrkey, ipsa->ipsa_encrkeylen);
		kmem_free(ipsa->ipsa_encrkey, ipsa->ipsa_encrkeylen);
	}
	if (ipsa->ipsa_src_cid != NULL) {
		IPSID_REFRELE(ipsa->ipsa_src_cid);
	}
	if (ipsa->ipsa_dst_cid != NULL) {
		IPSID_REFRELE(ipsa->ipsa_dst_cid);
	}
	if (ipsa->ipsa_integ != NULL)
		kmem_free(ipsa->ipsa_integ, ipsa->ipsa_integlen);
	if (ipsa->ipsa_sens != NULL)
		kmem_free(ipsa->ipsa_sens, ipsa->ipsa_senslen);

	mutex_destroy(&ipsa->ipsa_lock);
	kmem_free(ipsa, sizeof (*ipsa));
}

/*
 * Unlink a security association from a hash bucket.  Assume the hash bucket
 * lock is held, but the association's lock is not.
 *
 * Note that we do not bump the bucket's generation number here because
 * we might not be making a visible change to the set of visible SA's.
 * All callers MUST bump the bucket's generation number before they unlock
 * the bucket if they use sadb_unlinkassoc to permanetly remove an SA which
 * was present in the bucket at the time it was locked.
 */
void
sadb_unlinkassoc(ipsa_t *ipsa)
{
	ASSERT(ipsa->ipsa_linklock != NULL);
	ASSERT(MUTEX_HELD(ipsa->ipsa_linklock));

	/* These fields are protected by the link lock. */
	*(ipsa->ipsa_ptpn) = ipsa->ipsa_next;
	if (ipsa->ipsa_next != NULL) {
		ipsa->ipsa_next->ipsa_ptpn = ipsa->ipsa_ptpn;
		ipsa->ipsa_next = NULL;
	}

	ipsa->ipsa_ptpn = NULL;

	/* This may destroy the SA. */
	IPSA_REFRELE(ipsa);
}

/*
 * Create a larval security association with the specified SPI.	 All other
 * fields are zeroed.
 */
static ipsa_t *
sadb_makelarvalassoc(uint32_t spi, uint32_t *src, uint32_t *dst, int addrfam,
    netstack_t *ns)
{
	ipsa_t *newbie;

	/*
	 * Allocate...
	 */

	newbie = (ipsa_t *)kmem_zalloc(sizeof (ipsa_t), KM_NOSLEEP);
	if (newbie == NULL) {
		/* Can't make new larval SA. */
		return (NULL);
	}

	/* Assigned requested SPI, assume caller does SPI allocation magic. */
	newbie->ipsa_spi = spi;
	newbie->ipsa_netstack = ns;	/* No netstack_hold */

	/*
	 * Copy addresses...
	 */

	IPSA_COPY_ADDR(newbie->ipsa_srcaddr, src, addrfam);
	IPSA_COPY_ADDR(newbie->ipsa_dstaddr, dst, addrfam);

	newbie->ipsa_addrfam = addrfam;

	/*
	 * Set common initialization values, including refcnt.
	 */
	mutex_init(&newbie->ipsa_lock, NULL, MUTEX_DEFAULT, NULL);
	newbie->ipsa_state = IPSA_STATE_LARVAL;
	newbie->ipsa_refcnt = 1;
	newbie->ipsa_freefunc = sadb_freeassoc;

	/*
	 * There aren't a lot of other common initialization values, as
	 * they are copied in from the PF_KEY message.
	 */

	return (newbie);
}

/*
 * Call me to initialize a security association fanout.
 */
static int
sadb_init_fanout(isaf_t **tablep, uint_t size, int kmflag)
{
	isaf_t *table;
	int i;

	table = (isaf_t *)kmem_alloc(size * sizeof (*table), kmflag);
	*tablep = table;

	if (table == NULL)
		return (ENOMEM);

	for (i = 0; i < size; i++) {
		mutex_init(&(table[i].isaf_lock), NULL, MUTEX_DEFAULT, NULL);
		table[i].isaf_ipsa = NULL;
		table[i].isaf_gen = 0;
	}

	return (0);
}

/*
 * Call me to initialize an acquire fanout
 */
static int
sadb_init_acfanout(iacqf_t **tablep, uint_t size, int kmflag)
{
	iacqf_t *table;
	int i;

	table = (iacqf_t *)kmem_alloc(size * sizeof (*table), kmflag);
	*tablep = table;

	if (table == NULL)
		return (ENOMEM);

	for (i = 0; i < size; i++) {
		mutex_init(&(table[i].iacqf_lock), NULL, MUTEX_DEFAULT, NULL);
		table[i].iacqf_ipsacq = NULL;
	}

	return (0);
}

/*
 * Attempt to initialize an SADB instance.  On failure, return ENOMEM;
 * caller must clean up partial allocations.
 */
static int
sadb_init_trial(sadb_t *sp, uint_t size, int kmflag)
{
	ASSERT(sp->sdb_of == NULL);
	ASSERT(sp->sdb_if == NULL);
	ASSERT(sp->sdb_acq == NULL);

	sp->sdb_hashsize = size;
	if (sadb_init_fanout(&sp->sdb_of, size, kmflag) != 0)
		return (ENOMEM);
	if (sadb_init_fanout(&sp->sdb_if, size, kmflag) != 0)
		return (ENOMEM);
	if (sadb_init_acfanout(&sp->sdb_acq, size, kmflag) != 0)
		return (ENOMEM);

	return (0);
}

/*
 * Call me to initialize an SADB instance; fall back to default size on failure.
 */
static void
sadb_init(const char *name, sadb_t *sp, uint_t size, uint_t ver,
    netstack_t *ns)
{
	ASSERT(sp->sdb_of == NULL);
	ASSERT(sp->sdb_if == NULL);
	ASSERT(sp->sdb_acq == NULL);

	if (size < IPSEC_DEFAULT_HASH_SIZE)
		size = IPSEC_DEFAULT_HASH_SIZE;

	if (sadb_init_trial(sp, size, KM_NOSLEEP) != 0) {

		cmn_err(CE_WARN,
		    "Unable to allocate %u entry IPv%u %s SADB hash table",
		    size, ver, name);

		sadb_destroy(sp, ns);
		size = IPSEC_DEFAULT_HASH_SIZE;
		cmn_err(CE_WARN, "Falling back to %d entries", size);
		(void) sadb_init_trial(sp, size, KM_SLEEP);
	}
}


/*
 * Initialize an SADB-pair.
 */
void
sadbp_init(const char *name, sadbp_t *sp, int type, int size, netstack_t *ns)
{
	sadb_init(name, &sp->s_v4, size, 4, ns);
	sadb_init(name, &sp->s_v6, size, 6, ns);

	sp->s_satype = type;

	ASSERT((type == SADB_SATYPE_AH) || (type == SADB_SATYPE_ESP));
	if (type == SADB_SATYPE_AH) {
		ipsec_stack_t	*ipss = ns->netstack_ipsec;

		ip_drop_register(&ipss->ipsec_sadb_dropper, "IPsec SADB");
	}
}

/*
 * Deliver a single SADB_DUMP message representing a single SA.  This is
 * called many times by sadb_dump().
 *
 * If the return value of this is ENOBUFS (not the same as ENOMEM), then
 * the caller should take that as a hint that dupb() on the "original answer"
 * failed, and that perhaps the caller should try again with a copyb()ed
 * "original answer".
 */
static int
sadb_dump_deliver(queue_t *pfkey_q, mblk_t *original_answer, ipsa_t *ipsa,
    sadb_msg_t *samsg)
{
	mblk_t *answer;

	answer = dupb(original_answer);
	if (answer == NULL)
		return (ENOBUFS);
	answer->b_cont = sadb_sa2msg(ipsa, samsg);
	if (answer->b_cont == NULL) {
		freeb(answer);
		return (ENOMEM);
	}

	/* Just do a putnext, and let keysock deal with flow control. */
	putnext(pfkey_q, answer);
	return (0);
}

/*
 * Common function to allocate and prepare a keysock_out_t M_CTL message.
 */
mblk_t *
sadb_keysock_out(minor_t serial)
{
	mblk_t *mp;
	keysock_out_t *kso;

	mp = allocb(sizeof (ipsec_info_t), BPRI_HI);
	if (mp != NULL) {
		mp->b_datap->db_type = M_CTL;
		mp->b_wptr += sizeof (ipsec_info_t);
		kso = (keysock_out_t *)mp->b_rptr;
		kso->ks_out_type = KEYSOCK_OUT;
		kso->ks_out_len = sizeof (*kso);
		kso->ks_out_serial = serial;
	}

	return (mp);
}

/*
 * Perform an SADB_DUMP, spewing out every SA in an array of SA fanouts
 * to keysock.
 */
static int
sadb_dump_fanout(queue_t *pfkey_q, mblk_t *mp, minor_t serial, isaf_t *fanout,
    int num_entries, boolean_t do_peers)
{
	int i, error = 0;
	mblk_t *original_answer;
	ipsa_t *walker;
	sadb_msg_t *samsg;

	/*
	 * For each IPSA hash bucket do:
	 *	- Hold the mutex
	 *	- Walk each entry, doing an sadb_dump_deliver() on it.
	 */
	ASSERT(mp->b_cont != NULL);
	samsg = (sadb_msg_t *)mp->b_cont->b_rptr;

	original_answer = sadb_keysock_out(serial);
	if (original_answer == NULL)
		return (ENOMEM);

	for (i = 0; i < num_entries; i++) {
		mutex_enter(&fanout[i].isaf_lock);
		for (walker = fanout[i].isaf_ipsa; walker != NULL;
		    walker = walker->ipsa_next) {
			if (!do_peers && walker->ipsa_haspeer)
				continue;
			error = sadb_dump_deliver(pfkey_q, original_answer,
			    walker, samsg);
			if (error == ENOBUFS) {
				mblk_t *new_original_answer;

				/* Ran out of dupb's.  Try a copyb. */
				new_original_answer = copyb(original_answer);
				if (new_original_answer == NULL) {
					error = ENOMEM;
				} else {
					freeb(original_answer);
					original_answer = new_original_answer;
					error = sadb_dump_deliver(pfkey_q,
					    original_answer, walker, samsg);
				}
			}
			if (error != 0)
				break;	/* out of for loop. */
		}
		mutex_exit(&fanout[i].isaf_lock);
		if (error != 0)
			break;	/* out of for loop. */
	}

	freeb(original_answer);
	return (error);
}

/*
 * Dump an entire SADB; outbound first, then inbound.
 */

int
sadb_dump(queue_t *pfkey_q, mblk_t *mp, minor_t serial, sadb_t *sp)
{
	int error;

	/* Dump outbound */
	error = sadb_dump_fanout(pfkey_q, mp, serial, sp->sdb_of,
	    sp->sdb_hashsize, B_TRUE);
	if (error)
		return (error);

	/* Dump inbound */
	return sadb_dump_fanout(pfkey_q, mp, serial, sp->sdb_if,
	    sp->sdb_hashsize, B_FALSE);
}

/*
 * Generic sadb table walker.
 *
 * Call "walkfn" for each SA in each bucket in "table"; pass the
 * bucket, the entry and "cookie" to the callback function.
 * Take care to ensure that walkfn can delete the SA without screwing
 * up our traverse.
 *
 * The bucket is locked for the duration of the callback, both so that the
 * callback can just call sadb_unlinkassoc() when it wants to delete something,
 * and so that no new entries are added while we're walking the list.
 */
static void
sadb_walker(isaf_t *table, uint_t numentries,
    void (*walkfn)(isaf_t *head, ipsa_t *entry, void *cookie),
    void *cookie)
{
	int i;
	for (i = 0; i < numentries; i++) {
		ipsa_t *entry, *next;

		mutex_enter(&table[i].isaf_lock);

		for (entry = table[i].isaf_ipsa; entry != NULL;
		    entry = next) {
			next = entry->ipsa_next;
			(*walkfn)(&table[i], entry, cookie);
		}
		mutex_exit(&table[i].isaf_lock);
	}
}

/*
 * From the given SA, construct a dl_ct_ipsec_key and
 * a dl_ct_ipsec structures to be sent to the adapter as part
 * of a DL_CONTROL_REQ.
 *
 * ct_sa must point to the storage allocated for the key
 * structure and must be followed by storage allocated
 * for the SA information that must be sent to the driver
 * as part of the DL_CONTROL_REQ request.
 *
 * The is_inbound boolean indicates whether the specified
 * SA is part of an inbound SA table.
 *
 * Returns B_TRUE if the corresponding SA must be passed to
 * a provider, B_FALSE otherwise; frees *mp if it returns B_FALSE.
 */
static boolean_t
sadb_req_from_sa(ipsa_t *sa, mblk_t *mp, boolean_t is_inbound)
{
	dl_ct_ipsec_key_t *keyp;
	dl_ct_ipsec_t *sap;
	void *ct_sa = mp->b_wptr;

	ASSERT(MUTEX_HELD(&sa->ipsa_lock));

	keyp = (dl_ct_ipsec_key_t *)(ct_sa);
	sap = (dl_ct_ipsec_t *)(keyp + 1);

	IPSECHW_DEBUG(IPSECHW_CAPAB, ("sadb_req_from_sa: "
	    "is_inbound = %d\n", is_inbound));

	/* initialize flag */
	sap->sadb_sa_flags = 0;
	if (is_inbound) {
		sap->sadb_sa_flags |= DL_CT_IPSEC_INBOUND;
		/*
		 * If an inbound SA has a peer, then mark it has being
		 * an outbound SA as well.
		 */
		if (sa->ipsa_haspeer)
			sap->sadb_sa_flags |= DL_CT_IPSEC_OUTBOUND;
	} else {
		/*
		 * If an outbound SA has a peer, then don't send it,
		 * since we will send the copy from the inbound table.
		 */
		if (sa->ipsa_haspeer) {
			freemsg(mp);
			return (B_FALSE);
		}
		sap->sadb_sa_flags |= DL_CT_IPSEC_OUTBOUND;
	}

	keyp->dl_key_spi = sa->ipsa_spi;
	bcopy(sa->ipsa_dstaddr, keyp->dl_key_dest_addr,
	    DL_CTL_IPSEC_ADDR_LEN);
	keyp->dl_key_addr_family = sa->ipsa_addrfam;

	sap->sadb_sa_auth = sa->ipsa_auth_alg;
	sap->sadb_sa_encrypt = sa->ipsa_encr_alg;

	sap->sadb_key_len_a = sa->ipsa_authkeylen;
	sap->sadb_key_bits_a = sa->ipsa_authkeybits;
	bcopy(sa->ipsa_authkey,
	    sap->sadb_key_data_a, sap->sadb_key_len_a);

	sap->sadb_key_len_e = sa->ipsa_encrkeylen;
	sap->sadb_key_bits_e = sa->ipsa_encrkeybits;
	bcopy(sa->ipsa_encrkey,
	    sap->sadb_key_data_e, sap->sadb_key_len_e);

	mp->b_wptr += sizeof (dl_ct_ipsec_t) + sizeof (dl_ct_ipsec_key_t);
	return (B_TRUE);
}

/*
 * Called from AH or ESP to format a message which will be used to inform
 * IPsec-acceleration-capable ills of a SADB change.
 * (It is not possible to send the message to IP directly from this function
 * since the SA, if any, is locked during the call).
 *
 * dl_operation: DL_CONTROL_REQ operation (add, delete, update, etc)
 * sa_type: identifies whether the operation applies to AH or ESP
 *	(must be one of SADB_SATYPE_AH or SADB_SATYPE_ESP)
 * sa: Pointer to an SA.  Must be non-NULL and locked
 *	for ADD, DELETE, GET, and UPDATE operations.
 * This function returns an mblk chain that must be passed to IP
 * for forwarding to the IPsec capable providers.
 */
mblk_t *
sadb_fmt_sa_req(uint_t dl_operation, uint_t sa_type, ipsa_t *sa,
    boolean_t is_inbound)
{
	mblk_t *mp;
	dl_control_req_t *ctrl;
	boolean_t need_key = B_FALSE;
	mblk_t *ctl_mp = NULL;
	ipsec_ctl_t *ctl;

	/*
	 * 1 allocate and initialize DL_CONTROL_REQ M_PROTO
	 * 2 if a key is needed for the operation
	 *    2.1 initialize key
	 *    2.2 if a full SA is needed for the operation
	 *	2.2.1 initialize full SA info
	 * 3 return message; caller will call ill_ipsec_capab_send_all()
	 * to send the resulting message to IPsec capable ills.
	 */

	ASSERT(sa_type == SADB_SATYPE_AH || sa_type == SADB_SATYPE_ESP);

	/*
	 * Allocate DL_CONTROL_REQ M_PROTO
	 * We allocate room for the SA even if it's not needed
	 * by some of the operations (for example flush)
	 */
	mp = allocb(sizeof (dl_control_req_t) +
	    sizeof (dl_ct_ipsec_key_t) + sizeof (dl_ct_ipsec_t), BPRI_HI);
	if (mp == NULL)
		return (NULL);
	mp->b_datap->db_type = M_PROTO;

	/* initialize dl_control_req_t */
	ctrl = (dl_control_req_t *)mp->b_wptr;
	ctrl->dl_primitive = DL_CONTROL_REQ;
	ctrl->dl_operation = dl_operation;
	ctrl->dl_type = sa_type == SADB_SATYPE_AH ? DL_CT_IPSEC_AH :
	    DL_CT_IPSEC_ESP;
	ctrl->dl_key_offset = sizeof (dl_control_req_t);
	ctrl->dl_key_length = sizeof (dl_ct_ipsec_key_t);
	ctrl->dl_data_offset = sizeof (dl_control_req_t) +
	    sizeof (dl_ct_ipsec_key_t);
	ctrl->dl_data_length = sizeof (dl_ct_ipsec_t);
	mp->b_wptr += sizeof (dl_control_req_t);

	if ((dl_operation == DL_CO_SET) || (dl_operation == DL_CO_DELETE)) {
		ASSERT(sa != NULL);
		ASSERT(MUTEX_HELD(&sa->ipsa_lock));

		need_key = B_TRUE;

		/*
		 * Initialize key and SA data. Note that for some
		 * operations the SA data is ignored by the provider
		 * (delete, etc.)
		 */
		if (!sadb_req_from_sa(sa, mp, is_inbound))
			return (NULL);
	}

	/* construct control message */
	ctl_mp = allocb(sizeof (ipsec_ctl_t), BPRI_HI);
	if (ctl_mp == NULL) {
		cmn_err(CE_WARN, "sadb_fmt_sa_req: allocb failed\n");
		freemsg(mp);
		return (NULL);
	}

	ctl_mp->b_datap->db_type = M_CTL;
	ctl_mp->b_wptr += sizeof (ipsec_ctl_t);
	ctl_mp->b_cont = mp;

	ctl = (ipsec_ctl_t *)ctl_mp->b_rptr;
	ctl->ipsec_ctl_type = IPSEC_CTL;
	ctl->ipsec_ctl_len  = sizeof (ipsec_ctl_t);
	ctl->ipsec_ctl_sa_type = sa_type;

	if (need_key) {
		/*
		 * Keep an additional reference on SA, since it will be
		 * needed by IP to send control messages corresponding
		 * to that SA from its perimeter. IP will do a
		 * IPSA_REFRELE when done with the request.
		 */
		ASSERT(MUTEX_HELD(&sa->ipsa_lock));
		IPSA_REFHOLD(sa);
		ctl->ipsec_ctl_sa = sa;
	} else
		ctl->ipsec_ctl_sa = NULL;

	return (ctl_mp);
}


/*
 * Called by sadb_ill_download() to dump the entries for a specific
 * fanout table.  For each SA entry in the table passed as argument,
 * use mp as a template and constructs a full DL_CONTROL message, and
 * call ill_dlpi_send(), provided by IP, to send the resulting
 * messages to the ill.
 */
static void
sadb_ill_df(ill_t *ill, mblk_t *mp, isaf_t *fanout, int num_entries,
    boolean_t is_inbound)
{
	ipsa_t *walker;
	mblk_t *nmp, *salist;
	int i, error = 0;
	ip_stack_t	*ipst = ill->ill_ipst;
	netstack_t	*ns = ipst->ips_netstack;

	IPSECHW_DEBUG(IPSECHW_SADB, ("sadb_ill_df: fanout at 0x%p ne=%d\n",
	    (void *)fanout, num_entries));
	/*
	 * For each IPSA hash bucket do:
	 *	- Hold the mutex
	 *	- Walk each entry, sending a corresponding request to IP
	 *	  for it.
	 */
	ASSERT(mp->b_datap->db_type == M_PROTO);

	for (i = 0; i < num_entries; i++) {
		mutex_enter(&fanout[i].isaf_lock);
		salist = NULL;

		for (walker = fanout[i].isaf_ipsa; walker != NULL;
		    walker = walker->ipsa_next) {
			IPSECHW_DEBUG(IPSECHW_SADB,
			    ("sadb_ill_df: sending SA to ill via IP \n"));
			/*
			 * Duplicate the template mp passed and
			 * complete DL_CONTROL_REQ data.
			 * To be more memory efficient, we could use
			 * dupb() for the M_CTL and copyb() for the M_PROTO
			 * as the M_CTL, since the M_CTL is the same for
			 * every SA entry passed down to IP for the same ill.
			 *
			 * Note that copymsg/copyb ensure that the new mblk
			 * is at least as large as the source mblk even if it's
			 * not using all its storage -- therefore, nmp
			 * has trailing space for sadb_req_from_sa to add
			 * the SA-specific bits.
			 */
			mutex_enter(&walker->ipsa_lock);
			if (ipsec_capab_match(ill,
			    ill->ill_phyint->phyint_ifindex, ill->ill_isv6,
			    walker, ns)) {
				nmp = copymsg(mp);
				if (nmp == NULL) {
					IPSECHW_DEBUG(IPSECHW_SADB,
					    ("sadb_ill_df: alloc error\n"));
					error = ENOMEM;
					mutex_exit(&walker->ipsa_lock);
					break;
				}
				if (sadb_req_from_sa(walker, nmp, is_inbound)) {
					nmp->b_next = salist;
					salist = nmp;
				}
			}
			mutex_exit(&walker->ipsa_lock);
		}
		mutex_exit(&fanout[i].isaf_lock);
		while (salist != NULL) {
			nmp = salist;
			salist = nmp->b_next;
			nmp->b_next = NULL;
			ill_dlpi_send(ill, nmp);
		}
		if (error != 0)
			break;	/* out of for loop. */
	}
}

/*
 * Called by ill_ipsec_capab_add(). Sends a copy of the SADB of
 * the type specified by sa_type to the specified ill.
 *
 * We call for each fanout table defined by the SADB (one per
 * protocol). sadb_ill_df() finally calls ill_dlpi_send() for
 * each SADB entry in order to send a corresponding DL_CONTROL_REQ
 * message to the ill.
 */
void
sadb_ill_download(ill_t *ill, uint_t sa_type)
{
	mblk_t *protomp;	/* prototype message */
	dl_control_req_t *ctrl;
	sadbp_t *spp;
	sadb_t *sp;
	int dlt;
	ip_stack_t	*ipst = ill->ill_ipst;
	netstack_t	*ns = ipst->ips_netstack;

	ASSERT(sa_type == SADB_SATYPE_AH || sa_type == SADB_SATYPE_ESP);

	/*
	 * Allocate and initialize prototype answer. A duplicate for
	 * each SA is sent down to the interface.
	 */

	/* DL_CONTROL_REQ M_PROTO mblk_t */
	protomp = allocb(sizeof (dl_control_req_t) +
	    sizeof (dl_ct_ipsec_key_t) + sizeof (dl_ct_ipsec_t), BPRI_HI);
	if (protomp == NULL)
		return;
	protomp->b_datap->db_type = M_PROTO;

	dlt = (sa_type == SADB_SATYPE_AH) ? DL_CT_IPSEC_AH : DL_CT_IPSEC_ESP;
	if (sa_type == SADB_SATYPE_ESP) {
		ipsecesp_stack_t *espstack = ns->netstack_ipsecesp;

		spp = &espstack->esp_sadb;
	} else {
		ipsecah_stack_t	*ahstack = ns->netstack_ipsecah;

		spp = &ahstack->ah_sadb;
	}

	ctrl = (dl_control_req_t *)protomp->b_wptr;
	ctrl->dl_primitive = DL_CONTROL_REQ;
	ctrl->dl_operation = DL_CO_SET;
	ctrl->dl_type = dlt;
	ctrl->dl_key_offset = sizeof (dl_control_req_t);
	ctrl->dl_key_length = sizeof (dl_ct_ipsec_key_t);
	ctrl->dl_data_offset = sizeof (dl_control_req_t) +
	    sizeof (dl_ct_ipsec_key_t);
	ctrl->dl_data_length = sizeof (dl_ct_ipsec_t);
	protomp->b_wptr += sizeof (dl_control_req_t);

	/*
	 * then for each SADB entry, we fill out the dl_ct_ipsec_key_t
	 * and dl_ct_ipsec_t
	 */
	sp = ill->ill_isv6 ? &(spp->s_v6) : &(spp->s_v4);
	sadb_ill_df(ill, protomp, sp->sdb_of, sp->sdb_hashsize, B_FALSE);
	sadb_ill_df(ill, protomp, sp->sdb_if, sp->sdb_hashsize, B_TRUE);
	freemsg(protomp);
}

/*
 * Call me to free up a security association fanout.  Use the forever
 * variable to indicate freeing up the SAs (forever == B_FALSE, e.g.
 * an SADB_FLUSH message), or destroying everything (forever == B_TRUE,
 * when a module is unloaded).
 */
static void
sadb_destroyer(isaf_t **tablep, uint_t numentries, boolean_t forever)
{
	int i;
	isaf_t *table = *tablep;

	if (table == NULL)
		return;

	for (i = 0; i < numentries; i++) {
		mutex_enter(&table[i].isaf_lock);
		while (table[i].isaf_ipsa != NULL)
			sadb_unlinkassoc(table[i].isaf_ipsa);
		table[i].isaf_gen++;
		mutex_exit(&table[i].isaf_lock);
		if (forever)
			mutex_destroy(&(table[i].isaf_lock));
	}

	if (forever) {
		*tablep = NULL;
		kmem_free(table, numentries * sizeof (*table));
	}
}

/*
 * Entry points to sadb_destroyer().
 */
static void
sadb_flush(sadb_t *sp, netstack_t *ns)
{
	/*
	 * Flush out each bucket, one at a time.  Were it not for keysock's
	 * enforcement, there would be a subtlety where I could add on the
	 * heels of a flush.  With keysock's enforcement, however, this
	 * makes ESP's job easy.
	 */
	sadb_destroyer(&sp->sdb_of, sp->sdb_hashsize, B_FALSE);
	sadb_destroyer(&sp->sdb_if, sp->sdb_hashsize, B_FALSE);

	/* For each acquire, destroy it; leave the bucket mutex alone. */
	sadb_destroy_acqlist(&sp->sdb_acq, sp->sdb_hashsize, B_FALSE, ns);
}

static void
sadb_destroy(sadb_t *sp, netstack_t *ns)
{
	sadb_destroyer(&sp->sdb_of, sp->sdb_hashsize, B_TRUE);
	sadb_destroyer(&sp->sdb_if, sp->sdb_hashsize, B_TRUE);

	/* For each acquire, destroy it, including the bucket mutex. */
	sadb_destroy_acqlist(&sp->sdb_acq, sp->sdb_hashsize, B_TRUE, ns);

	ASSERT(sp->sdb_of == NULL);
	ASSERT(sp->sdb_if == NULL);
	ASSERT(sp->sdb_acq == NULL);
}

static void
sadb_send_flush_req(sadbp_t *spp)
{
	mblk_t *ctl_mp;

	/*
	 * we've been unplumbed, or never were plumbed; don't go there.
	 */
	if (spp->s_ip_q == NULL)
		return;

	/* have IP send a flush msg to the IPsec accelerators */
	ctl_mp = sadb_fmt_sa_req(DL_CO_FLUSH, spp