ipdrop.c revision 9c2c14ab194d42014417b385d6bf226ba1a37995
/*
* CDDL HEADER START
*
* The contents of this file are subject to the terms of the
* Common Development and Distribution License (the "License").
* You may not use this file except in compliance with the License.
*
* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
* See the License for the specific language governing permissions
* and limitations under the License.
*
* When distributing Covered Code, include this CDDL HEADER in each
* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
* If applicable, add the following below this CDDL HEADER, with the
* fields enclosed by brackets "[]" replaced with your own identifying
* information: Portions Copyright [yyyy] [name of copyright owner]
*
* CDDL HEADER END
*/
/*
* Copyright 2008 Sun Microsystems, Inc. All rights reserved.
* Use is subject to license terms.
*/
#include <inet/ipsec_info.h>
#include <inet/ipsec_impl.h>
/*
* Packet drop facility.
*/
/*
* Initialize drop facility kstats.
*/
void
{
"net", KSTAT_TYPE_NAMED,
sizeof (struct ip_dropstats) / sizeof (kstat_named_t),
return;
/*
* Note: here ipss->ipsec_ip_drop_types is initialized, however,
* if the previous kstat_create_netstack failed, it will remain
* NULL. Note this is done for all stack instances, so it *could*
* be NULL. Hence a non-NULL checking is added where
* ipss->ipsec_ip_drop_types is used. This checking is hidden in
* the DROPPER macro.
*/
/* TCP IPsec drop statistics. */
"tcp_clear", KSTAT_DATA_UINT64);
"tcp_secure", KSTAT_DATA_UINT64);
"tcp_mismatch", KSTAT_DATA_UINT64);
"tcp_ipsec_alloc", KSTAT_DATA_UINT64);
/* SADB-specific drop statistics. */
"sadb_inlarval_timeout", KSTAT_DATA_UINT64);
"sadb_inlarval_replace", KSTAT_DATA_UINT64);
"sadb_inidle_overflow", KSTAT_DATA_UINT64);
"sadb_inidle_timeout", KSTAT_DATA_UINT64);
"sadb_acquire_nomem", KSTAT_DATA_UINT64);
"sadb_acquire_toofull", KSTAT_DATA_UINT64);
"sadb_acquire_timeout", KSTAT_DATA_UINT64);
/* SPD drop statistics. */
"spd_ahesp_diffid", KSTAT_DATA_UINT64);
"spd_loopback_mismatch", KSTAT_DATA_UINT64);
"spd_explicit", KSTAT_DATA_UINT64);
"spd_got_secure", KSTAT_DATA_UINT64);
"spd_got_clear", KSTAT_DATA_UINT64);
"spd_bad_ahalg", KSTAT_DATA_UINT64);
"spd_got_ah", KSTAT_DATA_UINT64);
"spd_bad_espealg", KSTAT_DATA_UINT64);
"spd_bad_espaalg", KSTAT_DATA_UINT64);
"spd_got_esp", KSTAT_DATA_UINT64);
"spd_got_selfencap", KSTAT_DATA_UINT64);
"spd_bad_selfencap", KSTAT_DATA_UINT64);
"spd_nomem", KSTAT_DATA_UINT64);
"spd_ah_badid", KSTAT_DATA_UINT64);
"spd_ah_innermismatch", KSTAT_DATA_UINT64);
"spd_esp_innermismatch", KSTAT_DATA_UINT64);
"spd_esp_badid", KSTAT_DATA_UINT64);
"spd_no_policy", KSTAT_DATA_UINT64);
"spd_malformed_packet", KSTAT_DATA_UINT64);
"spd_malformed_frag", KSTAT_DATA_UINT64);
"spd_overlap_frag", KSTAT_DATA_UINT64);
"spd_evil_frag", KSTAT_DATA_UINT64);
"spd_max_frags", KSTAT_DATA_UINT64);
/* ESP-specific drop statistics. */
"esp_nomem", KSTAT_DATA_UINT64);
"esp_no_sa", KSTAT_DATA_UINT64);
"esp_early_replay", KSTAT_DATA_UINT64);
"esp_replay", KSTAT_DATA_UINT64);
"esp_bytes_expire", KSTAT_DATA_UINT64);
"esp_bad_padlen", KSTAT_DATA_UINT64);
"esp_bad_padding", KSTAT_DATA_UINT64);
"esp_bad_auth", KSTAT_DATA_UINT64);
"esp_crypto_failed", KSTAT_DATA_UINT64);
"esp_icmp", KSTAT_DATA_UINT64);
"esp_nat_t_ipsec", KSTAT_DATA_UINT64);
"esp_nat_t_ka", KSTAT_DATA_UINT64);
/* AH-specific drop statistics. */
"ah_nomem", KSTAT_DATA_UINT64);
"ah_bad_v6_hdrs", KSTAT_DATA_UINT64);
"ah_bad_v4_opts", KSTAT_DATA_UINT64);
"ah_no_sa", KSTAT_DATA_UINT64);
"ah_bad_length", KSTAT_DATA_UINT64);
"ah_bad_auth", KSTAT_DATA_UINT64);
"ah_crypto_failed", KSTAT_DATA_UINT64);
"ah_early_replay", KSTAT_DATA_UINT64);
"ah_replay", KSTAT_DATA_UINT64);
"ah_bytes_expire", KSTAT_DATA_UINT64);
/* IP-specific drop statistics. */
"ip_ipsec_not_loaded", KSTAT_DATA_UINT64);
}
void
{
}
/*
* Register a packet dropper.
*/
void
{
"ip_drop_register: ipdropper %s already registered with %s",
return;
}
/* Assume that name is reasonable in length. This isn't user-land. */
}
/*
* Un-register a packet dropper.
*/
void
{
"ip_drop_unregister: not registered (%p)\n",
(void *)ipd);
return;
}
}
/*
* Actually drop a packet. Many things could happen here, but at the least,
* the packet will be freemsg()ed.
*/
/* ARGSUSED */
void
{
/*
* Return immediately - NULL packets should not affect any
* statistics.
*/
return;
}
/*
* If not, it's some other sort of M_CTL to be freed.
* For now, treat it like an ordinary packet.
*/
}
}
/* Reality checks */
"ip_drop_packet: inbound packet with IPSEC_OUT");
"ip_drop_packet: outbound packet with IPSEC_IN");
/* At this point, mp always points to the data. */
/*
* Can't make the assertion yet - It could be an inbound ICMP
* message, which is M_CTL but with data in it.
*/
/* ASSERT(mp->b_datap->db_type == M_DATA); */
/* Increment the bean counter, if available. */
case KSTAT_DATA_INT32:
break;
case KSTAT_DATA_UINT32:
break;
case KSTAT_DATA_INT64:
break;
case KSTAT_DATA_UINT64:
break;
/* Other types we can't handle for now. */
}
/* TODO? Copy out kstat name for use in logging. */
}
/* TODO: log the packet details if logging is called for. */
/* TODO: queue the packet onto a snoop-friendly queue. */
/* If I haven't queued the packet or some such nonsense, free it. */
/*
* ASSERT this isn't a b_next linked mblk chain where a
* chained dropper should be used instead
*/
}