45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * CDDL HEADER START
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * The contents of this file are subject to the terms of the
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * Common Development and Distribution License (the "License").
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * You may not use this file except in compliance with the License.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * See the License for the specific language governing permissions
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * and limitations under the License.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * When distributing Covered Code, include this CDDL HEADER in each
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * If applicable, add the following below this CDDL HEADER, with the
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * fields enclosed by brackets "[]" replaced with your own identifying
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * information: Portions Copyright [yyyy] [name of copyright owner]
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * CDDL HEADER END
9e3469d3db608feb0e43d9955cbf406c22025463Erik Nordmark * Copyright 2010 Sun Microsystems, Inc. All rights reserved.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * Use is subject to license terms.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * This routine takes a sensitivity label as input and creates a CIPSO
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * option in the specified buffer. It returns the size of the CIPSO option.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * If the sensitivity label is too large for the CIPSO option, then 0
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * is returned.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * tsol2cipso_tt1 returns 0 for failure and greater than 0 for success
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * (more accurately, success means a return value between 10 and 40).
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpktsol2cipso_tt1(const bslabel_t *sl, unsigned char *cop, uint32_t doi)
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk return (0);
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk /* check for Admin High sensitivity label */
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk return (0);
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk /* check whether classification will fit in one octet */
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk return (0);
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * Check whether compartments will fit in 30 octets.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * Compartments 241 - 256 are not allowed.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk return (0);
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * Compute option length and tag length.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * 'p' points to the last two bytes in the Sensitivity Label's
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * compartments; these cannot be mapped into CIPSO compartments.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk if (*ucp != 0)
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk return (10 + i);
c4e55c13cee53b72d8c5c01391d9154039975bfbken Powell - Sun Microsystem * The following routine searches for a security label in an IPv4 datagram.
c4e55c13cee53b72d8c5c01391d9154039975bfbken Powell - Sun Microsystem * It returns label_type of:
c4e55c13cee53b72d8c5c01391d9154039975bfbken Powell - Sun Microsystem * OPT_CIPSO if a CIPSO IP option is found.
c4e55c13cee53b72d8c5c01391d9154039975bfbken Powell - Sun Microsystem * OPT_NONE if no security label is found.
c4e55c13cee53b72d8c5c01391d9154039975bfbken Powell - Sun Microsystem * If OPT_CIPSO, a pointer to the CIPSO IP option will be returned in
c4e55c13cee53b72d8c5c01391d9154039975bfbken Powell - Sun Microsystem * the buffer parameter.
c4e55c13cee53b72d8c5c01391d9154039975bfbken Powell - Sun Microsystem * The function will return with B_FALSE if an IP format error
c4e55c13cee53b72d8c5c01391d9154039975bfbken Powell - Sun Microsystem * is encountered.
c4e55c13cee53b72d8c5c01391d9154039975bfbken Powell - Sun Microsystemtsol_get_option_v4(mblk_t *mp, tsol_ip_label_t *label_type, uchar_t **buffer)
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * Get length (in 4 byte octets) of IP header options.
c4e55c13cee53b72d8c5c01391d9154039975bfbken Powell - Sun Microsystem * If header doesn't contain options, then return a label_type
c4e55c13cee53b72d8c5c01391d9154039975bfbken Powell - Sun Microsystem if (totallen < IP_SIMPLE_HDR_LENGTH || totallen > MBLKL(mp))
c4e55c13cee53b72d8c5c01391d9154039975bfbken Powell - Sun Microsystem totallen -= IP_SIMPLE_HDR_LENGTH;
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * Search for CIPSO option.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * If no such option is present, then return OPT_NONE.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk while (totallen != 0) {
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * Copy pointer to option into '*buffer' and
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * return the option type.
c4e55c13cee53b72d8c5c01391d9154039975bfbken Powell - Sun Microsystem opt[TSOL_CIPSO_TAG_OFFSET] == 1) {
c4e55c13cee53b72d8c5c01391d9154039975bfbken Powell - Sun Microsystem * The following routine searches for a security label in an IPv6 datagram.
c4e55c13cee53b72d8c5c01391d9154039975bfbken Powell - Sun Microsystem * It returns label_type of:
c4e55c13cee53b72d8c5c01391d9154039975bfbken Powell - Sun Microsystem * OPT_CIPSO if a CIPSO IP option is found.
c4e55c13cee53b72d8c5c01391d9154039975bfbken Powell - Sun Microsystem * OPT_NONE if no security label is found.
c4e55c13cee53b72d8c5c01391d9154039975bfbken Powell - Sun Microsystem * If OPT_CIPSO, a pointer to the IPv4 portion of the CIPSO IP option will
c4e55c13cee53b72d8c5c01391d9154039975bfbken Powell - Sun Microsystem * be returned in the buffer parameter.
c4e55c13cee53b72d8c5c01391d9154039975bfbken Powell - Sun Microsystem * The function will return with B_FALSE if an IP format error
c4e55c13cee53b72d8c5c01391d9154039975bfbken Powell - Sun Microsystem * or an unexpected label content error is encountered.
c4e55c13cee53b72d8c5c01391d9154039975bfbken Powell - Sun Microsystemtsol_get_option_v6(mblk_t *mp, tsol_ip_label_t *label_type, uchar_t **buffer)
c4e55c13cee53b72d8c5c01391d9154039975bfbken Powell - Sun Microsystem ip6h = (const ip6_t *)mp->b_rptr;
c4e55c13cee53b72d8c5c01391d9154039975bfbken Powell - Sun Microsystem if (ip6h->ip6_nxt != IPPROTO_HOPOPTS)
c4e55c13cee53b72d8c5c01391d9154039975bfbken Powell - Sun Microsystem ip6hbh = (const uchar_t *)&ip6h[1];
c4e55c13cee53b72d8c5c01391d9154039975bfbken Powell - Sun Microsystem if (ip6hbh + MIN_EHDR_LEN > mp->b_wptr)
c4e55c13cee53b72d8c5c01391d9154039975bfbken Powell - Sun Microsystem if (ip6hbh + optlen > mp->b_wptr)
c4e55c13cee53b72d8c5c01391d9154039975bfbken Powell - Sun Microsystem if (!tsol_find_secopt_v6(ip6hbh, optlen,
c4e55c13cee53b72d8c5c01391d9154039975bfbken Powell - Sun Microsystem &opt_ptr, &after_secopt, &hbh_needed))
c4e55c13cee53b72d8c5c01391d9154039975bfbken Powell - Sun Microsystem /* tsol_find_secopt_v6 guarantees some sanity */
c4e55c13cee53b72d8c5c01391d9154039975bfbken Powell - Sun Microsystem * opt_ptr[0]: Option type
c4e55c13cee53b72d8c5c01391d9154039975bfbken Powell - Sun Microsystem * opt_ptr[1]: Length of option data in bytes
c4e55c13cee53b72d8c5c01391d9154039975bfbken Powell - Sun Microsystem * opt_ptr[2]: First byte of option data
c4e55c13cee53b72d8c5c01391d9154039975bfbken Powell - Sun Microsystem * From "Generalized Labeled Security Option for IPv6" draft
c4e55c13cee53b72d8c5c01391d9154039975bfbken Powell - Sun Microsystem * opt_ptr[0] - opt_ptr[4]: DOI = IP6LS_DOI_V4
c4e55c13cee53b72d8c5c01391d9154039975bfbken Powell - Sun Microsystem * opt_ptr[4]: Tag type = IP6LS_TT_V4
c4e55c13cee53b72d8c5c01391d9154039975bfbken Powell - Sun Microsystem * opt_ptr[5]: Tag length in bytes starting at Tag type field
c4e55c13cee53b72d8c5c01391d9154039975bfbken Powell - Sun Microsystem * IPv4 CIPSO Option
c4e55c13cee53b72d8c5c01391d9154039975bfbken Powell - Sun Microsystem * opt_ptr[6]: option type
c4e55c13cee53b72d8c5c01391d9154039975bfbken Powell - Sun Microsystem * opt_ptr[7]: option length in bytes starting at type field
c4e55c13cee53b72d8c5c01391d9154039975bfbken Powell - Sun Microsystem bcopy(opt_ptr, &doi, sizeof (doi));
c4e55c13cee53b72d8c5c01391d9154039975bfbken Powell - Sun Microsystem opt_ptr[7] <= opt_ptr[5] - 2) {
5f9878b0212a5bc5924a85d227160bf7f43712f1ken Powell - Sun Microsystem * tsol_check_dest()
5f9878b0212a5bc5924a85d227160bf7f43712f1ken Powell - Sun Microsystem * This routine verifies if a destination is allowed to recieve messages
bd670b35a010421b6e1a5536c34453a827007c81Erik Nordmark * based on the security label. If any adjustments to the label are needed
bd670b35a010421b6e1a5536c34453a827007c81Erik Nordmark * due to the connection's MAC mode or the destination's ability
bd670b35a010421b6e1a5536c34453a827007c81Erik Nordmark * to receive labels, an "effective label" will be returned.
bd670b35a010421b6e1a5536c34453a827007c81Erik Nordmark * zone_is_global is set if the actual zoneid is global. That is, it is
bd670b35a010421b6e1a5536c34453a827007c81Erik Nordmark * not set for an exclusive-IP zone.
bd670b35a010421b6e1a5536c34453a827007c81Erik Nordmark * On successful return, effective_tsl will point to the new label needed
bd670b35a010421b6e1a5536c34453a827007c81Erik Nordmark * or will be NULL if a new label isn't needed. On error, effective_tsl will
bd670b35a010421b6e1a5536c34453a827007c81Erik Nordmark * point to NULL.
bd670b35a010421b6e1a5536c34453a827007c81Erik Nordmark * 0 Label (was|is now) correct
bd670b35a010421b6e1a5536c34453a827007c81Erik Nordmark * EHOSTUNREACH The label failed the remote host accreditation
5f9878b0212a5bc5924a85d227160bf7f43712f1ken Powell - Sun Microsystem * ENOMEM Memory allocation failure
bd670b35a010421b6e1a5536c34453a827007c81Erik Nordmarktsol_check_dest(const ts_label_t *tsl, const void *dst,
bd670b35a010421b6e1a5536c34453a827007c81Erik Nordmark uchar_t version, uint_t mac_mode, boolean_t zone_is_global,
5f9878b0212a5bc5924a85d227160bf7f43712f1ken Powell - Sun Microsystem ASSERT(version == IPV4_VERSION ||
5f9878b0212a5bc5924a85d227160bf7f43712f1ken Powell - Sun Microsystem !IN6_IS_ADDR_V4MAPPED((in6_addr_t *)dst)));
5f9878b0212a5bc5924a85d227160bf7f43712f1ken Powell - Sun Microsystem /* Always pass kernel level communication (NULL label) */
5f9878b0212a5bc5924a85d227160bf7f43712f1ken Powell - Sun Microsystem DTRACE_PROBE2(tx__tnopt__log__info__labeling__mac__allownull,
bd670b35a010421b6e1a5536c34453a827007c81Erik Nordmark char *, "destination ip(1) with null label was passed",
5d3b8cb7141cfa596d20cdc5043b8a6df635938dBill Sommerfeld DTRACE_PROBE3(tx__tnopt__log__info__labeling__unresolved__label,
5d3b8cb7141cfa596d20cdc5043b8a6df635938dBill Sommerfeld "implicit-in packet to ip(1) reached tsol_check_dest "
5d3b8cb7141cfa596d20cdc5043b8a6df635938dBill Sommerfeld "with implied security label sl(2)",
5f9878b0212a5bc5924a85d227160bf7f43712f1ken Powell - Sun Microsystem /* Always pass multicast */
5f9878b0212a5bc5924a85d227160bf7f43712f1ken Powell - Sun Microsystem DTRACE_PROBE2(tx__tnopt__log__info__labeling__mac__allowmult,
5f9878b0212a5bc5924a85d227160bf7f43712f1ken Powell - Sun Microsystem char *, "destination ip(1) with multicast dest was passed",
5f9878b0212a5bc5924a85d227160bf7f43712f1ken Powell - Sun Microsystem } else if (version == IPV6_VERSION &&
5f9878b0212a5bc5924a85d227160bf7f43712f1ken Powell - Sun Microsystem IN6_IS_ADDR_MULTICAST((in6_addr_t *)dst)) {
5f9878b0212a5bc5924a85d227160bf7f43712f1ken Powell - Sun Microsystem DTRACE_PROBE2(tx__tnopt__log__info__labeling__mac__allowmult_v6,
5f9878b0212a5bc5924a85d227160bf7f43712f1ken Powell - Sun Microsystem char *, "destination ip(1) with multicast dest was passed",
5f9878b0212a5bc5924a85d227160bf7f43712f1ken Powell - Sun Microsystem /* Never pass an undefined destination */
5f9878b0212a5bc5924a85d227160bf7f43712f1ken Powell - Sun Microsystem if ((dst_rhtp = find_tpc(dst, version, B_FALSE)) == NULL) {
5f9878b0212a5bc5924a85d227160bf7f43712f1ken Powell - Sun Microsystem DTRACE_PROBE2(tx__tnopt__log__info__labeling__lookupdst,
5f9878b0212a5bc5924a85d227160bf7f43712f1ken Powell - Sun Microsystem char *, "destination ip(1) not in tn database.",
5f9878b0212a5bc5924a85d227160bf7f43712f1ken Powell - Sun Microsystem switch (dst_rhtp->tpc_tp.host_type) {
5f9878b0212a5bc5924a85d227160bf7f43712f1ken Powell - Sun Microsystem * Can talk to unlabeled hosts if
5f9878b0212a5bc5924a85d227160bf7f43712f1ken Powell - Sun Microsystem * (1) zone's label matches the default label, or
5d3b8cb7141cfa596d20cdc5043b8a6df635938dBill Sommerfeld * (2) SO_MAC_EXEMPT is on and we
5d3b8cb7141cfa596d20cdc5043b8a6df635938dBill Sommerfeld * dominate the peer's label, or
5d3b8cb7141cfa596d20cdc5043b8a6df635938dBill Sommerfeld * (3) SO_MAC_EXEMPT is on and
5d3b8cb7141cfa596d20cdc5043b8a6df635938dBill Sommerfeld * this is the global zone
5f9878b0212a5bc5924a85d227160bf7f43712f1ken Powell - Sun Microsystem if (dst_rhtp->tpc_tp.tp_doi != tsl->tsl_doi) {
c4e55c13cee53b72d8c5c01391d9154039975bfbken Powell - Sun Microsystem DTRACE_PROBE4(tx__tnopt__log__info__labeling__doi,
5f9878b0212a5bc5924a85d227160bf7f43712f1ken Powell - Sun Microsystem char *, "unlabeled dest ip(1)/tpc(2) doi does "
5f9878b0212a5bc5924a85d227160bf7f43712f1ken Powell - Sun Microsystem "not match msg label(3) doi.", void *, dst,
5f9878b0212a5bc5924a85d227160bf7f43712f1ken Powell - Sun Microsystem tsol_tpc_t *, dst_rhtp, ts_label_t *, tsl);
5f9878b0212a5bc5924a85d227160bf7f43712f1ken Powell - Sun Microsystem if (!blequal(&dst_rhtp->tpc_tp.tp_def_label,
5f9878b0212a5bc5924a85d227160bf7f43712f1ken Powell - Sun Microsystem &dst_rhtp->tpc_tp.tp_def_label))) {
5f9878b0212a5bc5924a85d227160bf7f43712f1ken Powell - Sun Microsystem tx__tnopt__log__info__labeling__mac,
5f9878b0212a5bc5924a85d227160bf7f43712f1ken Powell - Sun Microsystem char *, "unlabeled dest ip(1)/tpc(2) does "
5f9878b0212a5bc5924a85d227160bf7f43712f1ken Powell - Sun Microsystem "not match msg label(3).", void *, dst,
5f9878b0212a5bc5924a85d227160bf7f43712f1ken Powell - Sun Microsystem tsol_tpc_t *, dst_rhtp, ts_label_t *, tsl);
5f9878b0212a5bc5924a85d227160bf7f43712f1ken Powell - Sun Microsystem * This is a downlabel MAC-exempt exchange.
5f9878b0212a5bc5924a85d227160bf7f43712f1ken Powell - Sun Microsystem * Use the remote destination's default label
5f9878b0212a5bc5924a85d227160bf7f43712f1ken Powell - Sun Microsystem * as the label of the message data.
5f9878b0212a5bc5924a85d227160bf7f43712f1ken Powell - Sun Microsystem if ((newtsl = labelalloc(&dst_rhtp->tpc_tp.tp_def_label,
5f9878b0212a5bc5924a85d227160bf7f43712f1ken Powell - Sun Microsystem dst_rhtp->tpc_tp.tp_doi, KM_NOSLEEP)) == NULL) {
5f9878b0212a5bc5924a85d227160bf7f43712f1ken Powell - Sun Microsystem newtsl->tsl_flags |= TSLF_UNLABELED;
5f9878b0212a5bc5924a85d227160bf7f43712f1ken Powell - Sun Microsystem } else if (!(tsl->tsl_flags & TSLF_UNLABELED)) {
5f9878b0212a5bc5924a85d227160bf7f43712f1ken Powell - Sun Microsystem * The security labels are the same but we need
5f9878b0212a5bc5924a85d227160bf7f43712f1ken Powell - Sun Microsystem * to flag that the remote node is unlabeled.
5f9878b0212a5bc5924a85d227160bf7f43712f1ken Powell - Sun Microsystem if ((newtsl = labeldup(tsl, KM_NOSLEEP)) == NULL) {
5f9878b0212a5bc5924a85d227160bf7f43712f1ken Powell - Sun Microsystem newtsl->tsl_flags |= TSLF_UNLABELED;
5f9878b0212a5bc5924a85d227160bf7f43712f1ken Powell - Sun Microsystem * Can talk to labeled hosts if zone's label is within target's
5f9878b0212a5bc5924a85d227160bf7f43712f1ken Powell - Sun Microsystem * label range or set.
5f9878b0212a5bc5924a85d227160bf7f43712f1ken Powell - Sun Microsystem if (dst_rhtp->tpc_tp.tp_cipso_doi_cipso != tsl->tsl_doi ||
5f9878b0212a5bc5924a85d227160bf7f43712f1ken Powell - Sun Microsystem &dst_rhtp->tpc_tp.tp_sl_range_cipso) &&
5f9878b0212a5bc5924a85d227160bf7f43712f1ken Powell - Sun Microsystem dst_rhtp->tpc_tp.tp_sl_set_cipso))) {
5f9878b0212a5bc5924a85d227160bf7f43712f1ken Powell - Sun Microsystem DTRACE_PROBE4(tx__tnopt__log__info__labeling__mac,
5f9878b0212a5bc5924a85d227160bf7f43712f1ken Powell - Sun Microsystem char *, "labeled dest ip(1)/tpc(2) does not "
5f9878b0212a5bc5924a85d227160bf7f43712f1ken Powell - Sun Microsystem "match msg label(3).", void *, dst,
5f9878b0212a5bc5924a85d227160bf7f43712f1ken Powell - Sun Microsystem tsol_tpc_t *, dst_rhtp, ts_label_t *, tsl);
5d3b8cb7141cfa596d20cdc5043b8a6df635938dBill Sommerfeld * Copy label so we can modify the flags
5f9878b0212a5bc5924a85d227160bf7f43712f1ken Powell - Sun Microsystem if ((newtsl = labeldup(tsl, KM_NOSLEEP)) == NULL) {
5d3b8cb7141cfa596d20cdc5043b8a6df635938dBill Sommerfeld * The security label is a match but we need to
5d3b8cb7141cfa596d20cdc5043b8a6df635938dBill Sommerfeld * clear the unlabeled flag for this remote node.
bd670b35a010421b6e1a5536c34453a827007c81Erik Nordmark * Return the new label.
bd670b35a010421b6e1a5536c34453a827007c81Erik Nordmark * tsol_compute_label_v4()
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * This routine computes the IP label that should be on a packet based on the
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * connection and destination information.
bd670b35a010421b6e1a5536c34453a827007c81Erik Nordmark * The zoneid is the IP zoneid (i.e., GLOBAL_ZONEID for exlusive-IP zones).
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * Returns:
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * 0 Fetched label
5f9878b0212a5bc5924a85d227160bf7f43712f1ken Powell - Sun Microsystem * EHOSTUNREACH No route to destination
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * EINVAL Label cannot be computed
bd670b35a010421b6e1a5536c34453a827007c81Erik Nordmarktsol_compute_label_v4(const ts_label_t *tsl, zoneid_t zoneid, ipaddr_t dst,
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk return (0);
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk /* always pass multicast */
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk return (0);
5f9878b0212a5bc5924a85d227160bf7f43712f1ken Powell - Sun Microsystem if (tsl->tsl_flags & TSLF_UNLABELED) {
5f9878b0212a5bc5924a85d227160bf7f43712f1ken Powell - Sun Microsystem * The destination is unlabeled. Only add a label if the
5f9878b0212a5bc5924a85d227160bf7f43712f1ken Powell - Sun Microsystem * destination is not a broadcast/local/loopback address,
5f9878b0212a5bc5924a85d227160bf7f43712f1ken Powell - Sun Microsystem * the destination is not on the same subnet, and the
5f9878b0212a5bc5924a85d227160bf7f43712f1ken Powell - Sun Microsystem * next-hop gateway is labeled.
bd670b35a010421b6e1a5536c34453a827007c81Erik Nordmark ire = ire_route_recursive_v4(dst, 0, NULL, zoneid, tsl,
9e3469d3db608feb0e43d9955cbf406c22025463Erik Nordmark MATCH_IRE_SECATTR, IRR_ALLOCATE, 0, ipst, NULL, &attrp,
bd670b35a010421b6e1a5536c34453a827007c81Erik Nordmark if (ire->ire_flags & (RTF_REJECT|RTF_BLACKHOLE)) {
bd670b35a010421b6e1a5536c34453a827007c81Erik Nordmark /* no route to destination */
5f9878b0212a5bc5924a85d227160bf7f43712f1ken Powell - Sun Microsystem char *, "No route to unlabeled dest ip(1) with "
bd670b35a010421b6e1a5536c34453a827007c81Erik Nordmark "with label(2).", ipaddr_t, dst, ts_label_t *, tsl);
bd670b35a010421b6e1a5536c34453a827007c81Erik Nordmark if (ire->ire_type & (IRE_BROADCAST | IRE_LOCAL | IRE_LOOPBACK |
bd670b35a010421b6e1a5536c34453a827007c81Erik Nordmark * ire_route_recursive gives us the first attrp it finds
bd670b35a010421b6e1a5536c34453a827007c81Erik Nordmark * in the recursive lookup.
5f9878b0212a5bc5924a85d227160bf7f43712f1ken Powell - Sun Microsystem * Return now if next hop gateway is unlabeled. There is
5f9878b0212a5bc5924a85d227160bf7f43712f1ken Powell - Sun Microsystem * no need to generate a CIPSO option for this message.
5f9878b0212a5bc5924a85d227160bf7f43712f1ken Powell - Sun Microsystem if (attrp == NULL || attrp->igsa_rhc == NULL ||
5f9878b0212a5bc5924a85d227160bf7f43712f1ken Powell - Sun Microsystem attrp->igsa_rhc->rhc_tpc->tpc_tp.host_type == UNLABELED) {
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk /* compute the CIPSO option */
5f9878b0212a5bc5924a85d227160bf7f43712f1ken Powell - Sun Microsystem sec_opt_len = tsol2cipso_tt1(&tsl->tsl_label, opt_storage,
5f9878b0212a5bc5924a85d227160bf7f43712f1ken Powell - Sun Microsystem DTRACE_PROBE3(tx__tnopt__log__error__labeling__lostops__v4,
bd670b35a010421b6e1a5536c34453a827007c81Erik Nordmark char *, "options lack length for dest ip(1) with label(2).",
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk return (0);
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * Remove any existing security option (CIPSO) from the given IP
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * header, move the 'buflen' bytes back to fill the gap, and return the number
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * of bytes removed (as zero or negative number). Assumes that the headers are
bd670b35a010421b6e1a5536c34453a827007c81Erik Nordmark * Note that tsol_remove_secopt does not adjust ipha_length but
bd670b35a010421b6e1a5536c34453a827007c81Erik Nordmark * tsol_remove_secopt_v6 does adjust ip6_plen.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk while (remlen > 0) {
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk /* terminate on end of list */
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * Delete any no-ops following a deleted option, at least up
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * to a 4 octet alignment; copy others.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk /* stop on corrupted list; just do nothing. */
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk return (0);
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk return (0);
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk /* skip over security options to delete them */
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk /* copy the rest */
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk /* figure how much padding we'll need for header alignment */
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk if (olen > 0) {
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk /* pad with end-of-list */
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk /* slide back the headers that follow and update the IP header */
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk if (delta != 0) {
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk return (-delta);
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * Insert the option in 'optbuf' into the IP header pointed to by 'ipha', and
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * move the data following the IP header (up to buflen) to accomodate the new
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * option. Assumes that up to IP_MAX_OPT_LENGTH bytes are available (in total)
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * for IP options. Returns the number of bytes actually inserted, or -1 if the
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * option cannot be inserted. (Note that negative return values are possible
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * when noops must be compressed, and that only -1 indicates error. Successful
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * return value is always evenly divisible by 4, by definition.)
bd670b35a010421b6e1a5536c34453a827007c81Erik Nordmark * Note that tsol_prepend_option does not adjust ipha_length but
bd670b35a010421b6e1a5536c34453a827007c81Erik Nordmark * tsol_prepend_option_v6 does adjust ip6_plen.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpktsol_prepend_option(uchar_t *optbuf, ipha_t *ipha, int buflen)
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk return (0);
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk /* first find the real (unpadded) length of the existing options */
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk while (remlen > 0) {
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk /* stop at end of list */
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk /* skip no-ops, noting that length byte isn't present */
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk /* give up on a corrupted list; report failure */
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk return (-1);
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk return (-1);
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk /* completely ignore any trailing padding */
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * If some sort of inter-option alignment was present, try to preserve
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * that alignment. If alignment pushes us out past the maximum, then
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * discard it and try to compress to fit. (We just "assume" that any
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * padding added was attempting to get 32 bit alignment. If that's
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * wrong, that's just too bad.)
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk return (-1);
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * Since we may need to compress or expand the option list, we write to
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * a temporary buffer and then copy the results back to the IP header.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk /* compute actual option to insert */
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk /* copy over the existing options */
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk while (totlen > 0) {
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk /* totlen doesn't include end-of-list marker */
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk /* handle no-ops; copy if desired, ignore otherwise */
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk /* note: cannot overflow due to checks above */
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk /* list cannot be corrupt at this point */
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk /* cannot run out of room due to tests above */
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk /* figure how much padding we'll need for header alignment */
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk if (olen > 0) {
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk /* pad with end-of-list value */
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk /* move the headers as needed and update IP header */
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk if (delta != 0) {
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk ovbcopy((uchar_t *)ipha + remlen, (uchar_t *)ipha + olen,
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk /* slap in the new options */
bd670b35a010421b6e1a5536c34453a827007c81Erik Nordmark * tsol_check_label_v4()
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * This routine computes the IP label that should be on the packet based on the
bd670b35a010421b6e1a5536c34453a827007c81Erik Nordmark * connection and destination information. It's called by the IP forwarding
bd670b35a010421b6e1a5536c34453a827007c81Erik Nordmark * logic and by ip_output_simple. The ULPs generate the labels before calling
bd670b35a010421b6e1a5536c34453a827007c81Erik Nordmark * conn_ip_output. If any adjustments to
bd670b35a010421b6e1a5536c34453a827007c81Erik Nordmark * the label are needed due to the connection's MAC-exempt status or
bd670b35a010421b6e1a5536c34453a827007c81Erik Nordmark * the destination's ability to receive labels, an "effective label"
bd670b35a010421b6e1a5536c34453a827007c81Erik Nordmark * will be returned.
222c5bce8762079550e5ccd485a12de1fff5a82ekp * The packet's header is clear before entering IPsec's engine.
bd670b35a010421b6e1a5536c34453a827007c81Erik Nordmark * The zoneid is the IP zoneid (i.e., GLOBAL_ZONEID for exlusive-IP zones).
bd670b35a010421b6e1a5536c34453a827007c81Erik Nordmark * zone_is_global is set if the actual zoneid is global.
bd670b35a010421b6e1a5536c34453a827007c81Erik Nordmark * On successful return, effective_tslp will point to the new label needed
bd670b35a010421b6e1a5536c34453a827007c81Erik Nordmark * or will be NULL if a new label isn't needed. On error, effective_tsl will
bd670b35a010421b6e1a5536c34453a827007c81Erik Nordmark * point to NULL.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * Returns:
0e0e37a8f0c38eb919c913bbb67030114a6b74a9Erik Nordmark * 0 Label (was|is now) correct
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * EACCES The packet failed the remote host accreditation.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * ENOMEM Memory allocation failure.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * EINVAL Label cannot be computed
bd670b35a010421b6e1a5536c34453a827007c81Erik Nordmarktsol_check_label_v4(const ts_label_t *tsl, zoneid_t zoneid, mblk_t **mpp,
bd670b35a010421b6e1a5536c34453a827007c81Erik Nordmark uint_t mac_mode, boolean_t zone_is_global, ip_stack_t *ipst,
5f9878b0212a5bc5924a85d227160bf7f43712f1ken Powell - Sun Microsystem * Verify the destination is allowed to receive packets at
bd670b35a010421b6e1a5536c34453a827007c81Erik Nordmark * the security label of the message data. tsol_check_dest()
bd670b35a010421b6e1a5536c34453a827007c81Erik Nordmark * may create a new effective label or label flags.
bd670b35a010421b6e1a5536c34453a827007c81Erik Nordmark retv = tsol_check_dest(tsl, &ipha->ipha_dst, IPV4_VERSION,
5f9878b0212a5bc5924a85d227160bf7f43712f1ken Powell - Sun Microsystem * Calculate the security label to be placed in the text
5f9878b0212a5bc5924a85d227160bf7f43712f1ken Powell - Sun Microsystem * of the message (if any).
bd670b35a010421b6e1a5536c34453a827007c81Erik Nordmark if ((retv = tsol_compute_label_v4(effective_tsl, zoneid,
5f9878b0212a5bc5924a85d227160bf7f43712f1ken Powell - Sun Microsystem ipha->ipha_dst, opt_storage, ipst)) != 0) {
bd670b35a010421b6e1a5536c34453a827007c81Erik Nordmark if ((retv = tsol_compute_label_v4(tsl, zoneid,
5f9878b0212a5bc5924a85d227160bf7f43712f1ken Powell - Sun Microsystem ipha->ipha_dst, opt_storage, ipst)) != 0) {
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk /* If no option is supposed to be there, make sure it's not */
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk return (0);
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk /* if the option is there, it's always first */
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk return (0);
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * If there is an option there, then it must be the wrong one; delete.
222c5bce8762079550e5ccd485a12de1fff5a82ekp if (hlen > 0) {
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk /* Make sure we have room for the worst-case addition */
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk /* allocate enough to be meaningful, but not *too* much */
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk /* keep the bias */
222c5bce8762079550e5ccd485a12de1fff5a82ekp delta_add = tsol_prepend_option(opt_storage, ipha, MBLKL(mp));
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk return (0);
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * IPv6 HopOpt extension header for the label option layout:
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * - One octet giving the type of the 'next extension header'
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * - Header extension length in 8-byte words, not including the
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * 1st 8 bytes, but including any pad bytes at the end.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * Eg. A value of 2 means 16 bytes not including the 1st 8 bytes.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * - Followed by TLV encoded IPv6 label option. Option layout is
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * * One octet, IP6OPT_LS
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * * One octet option length in bytes of the option data following
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * the length, but not including any pad bytes at the end.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * * Four-octet DOI (IP6LS_DOI_V4)
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * * One octet suboption, IP6LS_TT_V4
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * * One octet suboption length in bytes of the suboption
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * following the suboption length, including the suboption
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * header length, but not including any pad bytes at the end.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * - Pad to make the extension header a multiple of 8 bytes.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * This function returns the contents of 'IPv6 option structure' in the above.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * i.e starting from the IP6OPT_LS but not including the pad at the end.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * The user must prepend two octets (either padding or next header / length)
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * and append padding out to the next 8 octet boundary.
bd670b35a010421b6e1a5536c34453a827007c81Erik Nordmark * The zoneid is the IP zoneid (i.e., GLOBAL_ZONEID for exlusive-IP zones).
bd670b35a010421b6e1a5536c34453a827007c81Erik Nordmarktsol_compute_label_v6(const ts_label_t *tsl, zoneid_t zoneid,
bd670b35a010421b6e1a5536c34453a827007c81Erik Nordmark const in6_addr_t *dst, uchar_t *opt_storage, ip_stack_t *ipst)
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk return (0);
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk /* Always pass multicast */
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk return (0);
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * Fill in a V6 label. If a new format is added here, make certain
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * that the maximum size of this label is reflected in sys/tsol/tnet.h
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * as TSOL_MAX_IPV6_OPTION.
5f9878b0212a5bc5924a85d227160bf7f43712f1ken Powell - Sun Microsystem if (tsl->tsl_flags & TSLF_UNLABELED) {
5f9878b0212a5bc5924a85d227160bf7f43712f1ken Powell - Sun Microsystem * The destination is unlabeled. Only add a label if the
bd670b35a010421b6e1a5536c34453a827007c81Erik Nordmark * destination is not a broadcast/local/loopback address,
5f9878b0212a5bc5924a85d227160bf7f43712f1ken Powell - Sun Microsystem * the destination is not on the same subnet, and the
5f9878b0212a5bc5924a85d227160bf7f43712f1ken Powell - Sun Microsystem * next-hop gateway is labeled.
bd670b35a010421b6e1a5536c34453a827007c81Erik Nordmark ire = ire_route_recursive_v6(dst, 0, NULL, zoneid, tsl,
9e3469d3db608feb0e43d9955cbf406c22025463Erik Nordmark MATCH_IRE_SECATTR, IRR_ALLOCATE, 0, ipst, NULL, &attrp,
bd670b35a010421b6e1a5536c34453a827007c81Erik Nordmark if (ire->ire_flags & (RTF_REJECT|RTF_BLACKHOLE)) {
bd670b35a010421b6e1a5536c34453a827007c81Erik Nordmark /* no route to destination */
5f9878b0212a5bc5924a85d227160bf7f43712f1ken Powell - Sun Microsystem char *, "No route to unlabeled dest ip6(1) with "
bd670b35a010421b6e1a5536c34453a827007c81Erik Nordmark "label(2).", in6_addr_t *, dst, ts_label_t *, tsl);
bd670b35a010421b6e1a5536c34453a827007c81Erik Nordmark if (ire->ire_type & (IRE_LOCAL | IRE_LOOPBACK |
bd670b35a010421b6e1a5536c34453a827007c81Erik Nordmark * ire_route_recursive gives us the first attrp it finds
bd670b35a010421b6e1a5536c34453a827007c81Erik Nordmark * in the recursive lookup.
5f9878b0212a5bc5924a85d227160bf7f43712f1ken Powell - Sun Microsystem * Return now if next hop gateway is unlabeled. There is
5f9878b0212a5bc5924a85d227160bf7f43712f1ken Powell - Sun Microsystem * no need to generate a CIPSO option for this message.
5f9878b0212a5bc5924a85d227160bf7f43712f1ken Powell - Sun Microsystem if (attrp == NULL || attrp->igsa_rhc == NULL ||
5f9878b0212a5bc5924a85d227160bf7f43712f1ken Powell - Sun Microsystem attrp->igsa_rhc->rhc_tpc->tpc_tp.host_type == UNLABELED) {
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk /* compute the CIPSO option */
5f9878b0212a5bc5924a85d227160bf7f43712f1ken Powell - Sun Microsystem sec_opt_len = tsol2cipso_tt1(&tsl->tsl_label, opt_storage,
5f9878b0212a5bc5924a85d227160bf7f43712f1ken Powell - Sun Microsystem DTRACE_PROBE3(tx__tnopt__log__error__labeling__lostops__v6,
5f9878b0212a5bc5924a85d227160bf7f43712f1ken Powell - Sun Microsystem char *, "options lack length for dest ip6(1) with "
bd670b35a010421b6e1a5536c34453a827007c81Erik Nordmark "label(2).", in6_addr_t *, dst, ts_label_t *, tsl);
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk return (0);
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * Just in case the option length is odd, round it up to the next even
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * multiple. The IPv6 option definition doesn't like odd numbers for
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * some reason.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * Length in the overall option header (IP6OPT_LS) does not include the
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * option header itself, but the length in the suboption does include
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * the suboption header. Thus, when there's just one suboption, the
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * length in the option header is the suboption length plus 4 (for the
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * DOI value).
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk return (0);
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * Locate the start of the IP6OPT_LS label option and return it.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * Also return the start of the next non-pad option in after_secoptp.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * Usually the label option is the first option at least when packets
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * are generated, but for generality we don't assume that on received packets.
c4e55c13cee53b72d8c5c01391d9154039975bfbken Powell - Sun Microsystem * The function will return with B_FALSE if an IP format error
c4e55c13cee53b72d8c5c01391d9154039975bfbken Powell - Sun Microsystem * or an unexpected label content error is encountered.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk const uchar_t *ip6hbh, /* Start of the hop-by-hop extension header */
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk uint_t hbhlen, /* Length of the hop-by-hop extension header */
c4e55c13cee53b72d8c5c01391d9154039975bfbken Powell - Sun Microsystem uchar_t **secoptp, /* Location of IP6OPT_LS label option */
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk uchar_t **after_secoptp, /* Non-pad option following the label option */
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk boolean_t *hbh_needed) /* Is hop-by-hop hdr needed w/o label */
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk while (optlen != 0) {
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * if we get here, ip6opt_ls can
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * not be 0 because it will always
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * match the IP6OPT_PAD1 above.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * Therefore ip6opt_ls == 0 forces
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * this test to always fail here.
c4e55c13cee53b72d8c5c01391d9154039975bfbken Powell - Sun Microsystem /* More than one security option found */
c4e55c13cee53b72d8c5c01391d9154039975bfbken Powell - Sun Microsystem } else switch (opt_type) {
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * There is at least 1 option other than
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * the label option. So the hop-by-hop header is needed
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * Remove the label option from the hop-by-hop options header if it exists.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * 'buflen' is the total length of the packet typically b_wptr - b_rptr.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * Header and data following the label option that is deleted are copied
0ec92a15793cedb674b4f9dffc0b3dd9058fc529wy * (i.e. slid backward) to the right position, and returns the number
0ec92a15793cedb674b4f9dffc0b3dd9058fc529wy * of bytes removed (as zero or negative number.)
bd670b35a010421b6e1a5536c34453a827007c81Erik Nordmark * Note that tsol_remove_secopt does not adjust ipha_length but
bd670b35a010421b6e1a5536c34453a827007c81Erik Nordmark * tsol_remove_secopt_v6 does adjust ip6_plen.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * hop-by-hop extension header must appear first, if it does not
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * exist, there is no label option.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk return (0);
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * Locate the start of the label option if it exists and the end
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * of the label option including pads if any.
c4e55c13cee53b72d8c5c01391d9154039975bfbken Powell - Sun Microsystem if (!tsol_find_secopt_v6(ip6hbh, hbhlen, &secopt, &after_secopt,
c4e55c13cee53b72d8c5c01391d9154039975bfbken Powell - Sun Microsystem * This function should not see invalid messages.
c4e55c13cee53b72d8c5c01391d9154039975bfbken Powell - Sun Microsystem * If one occurs, it would indicate either an
c4e55c13cee53b72d8c5c01391d9154039975bfbken Powell - Sun Microsystem * option previously verified in the forwarding
c4e55c13cee53b72d8c5c01391d9154039975bfbken Powell - Sun Microsystem * path has been corrupted or an option was
c4e55c13cee53b72d8c5c01391d9154039975bfbken Powell - Sun Microsystem * incorrectly generated locally.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk return (0);
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * The label option was the only option in the hop-by-hop
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * header. We don't need the hop-by-hop header itself any
0ec92a15793cedb674b4f9dffc0b3dd9058fc529wy return (-hbhlen);
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk /* There is no option following the label option */
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * After deleting the label option, we need to slide the headers
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * and data back, while still maintaining the same alignment (module 8)
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * for the other options. So we slide the headers and data back only
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * by an integral multiple of 8 bytes, and fill the remaining bytes
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * with pads.
0ec92a15793cedb674b4f9dffc0b3dd9058fc529wy return (-delta);
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * 'optbuf' contains a CIPSO label embedded in an IPv6 hop-by-hop option,
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * starting with the IP6OPT_LS option type. The format of this hop-by-hop
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * option is described in the block comment above tsol_compute_label_v6.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * This function prepends this hop-by-hop option before any other hop-by-hop
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * options in the hop-by-hop header if one already exists, else a new
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * hop-by-hop header is created and stuffed into the packet following
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * the IPv6 header. 'buflen' is the total length of the packet i.e.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * b_wptr - b_rptr. The caller ensures that there is enough space for the
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * extra option being added. Header and data following the position where
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * the label option is inserted are copied (i.e. slid forward) to the right
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * position.
bd670b35a010421b6e1a5536c34453a827007c81Erik Nordmark * Note that tsol_prepend_option does not adjust ipha_length but
bd670b35a010421b6e1a5536c34453a827007c81Erik Nordmark * tsol_prepend_option_v6 does adjust ip6_plen.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpktsol_prepend_option_v6(uchar_t *optbuf, ip6_t *ip6h, int buflen)
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * rawlen is the length of the label option in bytes, not including
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * any pads, starting from the IP6OPT_LS (option type) byte.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk uint_t optlen; /* rawlen rounded to an 8 byte multiple */
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk uchar_t *ip6hbh; /* start of the hop-by-hop extension header */
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk uint_t hbhlen; /* Length of the hop-by-hop extension header */
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk rawlen = optbuf[1] + 2; /* Add 2 for the option type, option length */
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * There is a hop-by-hop header present already. In order to
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * preserve the alignment of the other options at the existing
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * value (modulo 8) we need to pad the label option to a
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * multiple of 8 bytes before prepending it to the other
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * options. Slide the extension headers and data forward to
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * accomodate the label option at the start of the hop-by-hop
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * Bump up the hop-by-hop extension header length by
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * the number of 8-byte words added
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk return (-1);
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * There is no hop-by-hop header in the packet. Construct a
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * new Hop-by-hop extension header (a multiple of 8 bytes).
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * Slide any other extension headers and data forward to
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * accomodate this hop-by-hop header
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk delta = hbhlen = (2 + rawlen + 7) & ~7; /* +2 for nxthdr, len */
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk ovbcopy(ip6hbh, ip6hbh + hbhlen, buflen - IPV6_HDR_LEN);
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * hop-by-hop extension header length in 8-byte words, not
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * including the 1st 8 bytes of the hop-by-hop header.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * Copy the label option into the hop-by-hop header and insert any
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * needed pads
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * tsol_check_label_v6()
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * This routine computes the IP label that should be on the packet based on the
bd670b35a010421b6e1a5536c34453a827007c81Erik Nordmark * connection and destination information. It's called by the IP forwarding
bd670b35a010421b6e1a5536c34453a827007c81Erik Nordmark * logic and by ip_output_simple. The ULPs generate the labels before calling
bd670b35a010421b6e1a5536c34453a827007c81Erik Nordmark * conn_ip_output. If any adjustments to
bd670b35a010421b6e1a5536c34453a827007c81Erik Nordmark * the label are needed due to the connection's MAC-exempt status or
bd670b35a010421b6e1a5536c34453a827007c81Erik Nordmark * the destination's ability to receive labels, an "effective label"
bd670b35a010421b6e1a5536c34453a827007c81Erik Nordmark * will be returned.
bd670b35a010421b6e1a5536c34453a827007c81Erik Nordmark * The packet's header is clear before entering IPsec's engine.
bd670b35a010421b6e1a5536c34453a827007c81Erik Nordmark * The zoneid is the IP zoneid (i.e., GLOBAL_ZONEID for exlusive-IP zones).
bd670b35a010421b6e1a5536c34453a827007c81Erik Nordmark * zone_is_global is set if the actual zoneid is global.
bd670b35a010421b6e1a5536c34453a827007c81Erik Nordmark * On successful return, effective_tslp will point to the new label needed
bd670b35a010421b6e1a5536c34453a827007c81Erik Nordmark * or will be NULL if a new label isn't needed. On error, effective_tsl will
bd670b35a010421b6e1a5536c34453a827007c81Erik Nordmark * point to NULL.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * Returns:
0e0e37a8f0c38eb919c913bbb67030114a6b74a9Erik Nordmark * 0 Label (was|is now) correct
5f9878b0212a5bc5924a85d227160bf7f43712f1ken Powell - Sun Microsystem * EACCES The packet failed the remote host accreditation.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * ENOMEM Memory allocation failure.
bd670b35a010421b6e1a5536c34453a827007c81Erik Nordmark * EINVAL Label cannot be computed
bd670b35a010421b6e1a5536c34453a827007c81Erik Nordmarktsol_check_label_v6(const ts_label_t *tsl, zoneid_t zoneid, mblk_t **mpp,
bd670b35a010421b6e1a5536c34453a827007c81Erik Nordmark uint_t mac_mode, boolean_t zone_is_global, ip_stack_t *ipst,
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * Label option length is limited to IP_MAX_OPT_LENGTH for
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * symmetry with IPv4. Can be relaxed if needed
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk uint_t sec_opt_len; /* label option length not including type, len */
5f9878b0212a5bc5924a85d227160bf7f43712f1ken Powell - Sun Microsystem * Verify the destination is allowed to receive packets at
bd670b35a010421b6e1a5536c34453a827007c81Erik Nordmark * the security label of the message data. tsol_check_dest()
bd670b35a010421b6e1a5536c34453a827007c81Erik Nordmark * may create a new effective label or label flags.
bd670b35a010421b6e1a5536c34453a827007c81Erik Nordmark retv = tsol_check_dest(tsl, &ip6h->ip6_dst, IPV6_VERSION,
5f9878b0212a5bc5924a85d227160bf7f43712f1ken Powell - Sun Microsystem * Calculate the security label to be placed in the text
5f9878b0212a5bc5924a85d227160bf7f43712f1ken Powell - Sun Microsystem * of the message (if any).
bd670b35a010421b6e1a5536c34453a827007c81Erik Nordmark if ((retv = tsol_compute_label_v6(effective_tsl, zoneid,
5f9878b0212a5bc5924a85d227160bf7f43712f1ken Powell - Sun Microsystem &ip6h->ip6_dst, opt_storage, ipst)) != 0) {
bd670b35a010421b6e1a5536c34453a827007c81Erik Nordmark if ((retv = tsol_compute_label_v6(tsl, zoneid,
5f9878b0212a5bc5924a85d227160bf7f43712f1ken Powell - Sun Microsystem &ip6h->ip6_dst, opt_storage, ipst)) != 0)
c4e55c13cee53b72d8c5c01391d9154039975bfbken Powell - Sun Microsystem if (!tsol_find_secopt_v6(ip6hbh, hbhlen, &secopt,
c4e55c13cee53b72d8c5c01391d9154039975bfbken Powell - Sun Microsystem * This function should not see invalid messages.
c4e55c13cee53b72d8c5c01391d9154039975bfbken Powell - Sun Microsystem * If one occurs, it would indicate either an
c4e55c13cee53b72d8c5c01391d9154039975bfbken Powell - Sun Microsystem * option previously verified in the forwarding
c4e55c13cee53b72d8c5c01391d9154039975bfbken Powell - Sun Microsystem * path has been corrupted or an option was
c4e55c13cee53b72d8c5c01391d9154039975bfbken Powell - Sun Microsystem * incorrectly generated locally.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * The packet is not supposed to have a label, and it
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * does not have one currently
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk return (0);
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk /* The packet has the correct label already */
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk return (0);
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * If there is an option there, then it must be the wrong one; delete.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * Make sure we have room for the worst-case addition. Add 2 bytes for
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * the hop-by-hop ext header's next header and length fields. Add
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * another 2 bytes for the label option type, len and then round
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * up to the next 8-byte multiple.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * Allocate enough to be meaningful, but not *too* much.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk * Also all the IPv6 extension headers must be in the same mblk
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk /* keep the bias */
222c5bce8762079550e5ccd485a12de1fff5a82ekp delta_add = tsol_prepend_option_v6(opt_storage, ip6h, MBLKL(mp));
bd670b35a010421b6e1a5536c34453a827007c81Erik Nordmark /* tsol_prepend_option_v6 has adjusted ip6_plen */
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk return (0);