tn_ipopt.c revision 0e0e37a8f0c38eb919c913bbb67030114a6b74a9
/*
* CDDL HEADER START
*
* The contents of this file are subject to the terms of the
* Common Development and Distribution License (the "License").
* You may not use this file except in compliance with the License.
*
* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
* or http://www.opensolaris.org/os/licensing.
* See the License for the specific language governing permissions
* and limitations under the License.
*
* When distributing Covered Code, include this CDDL HEADER in each
* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
* If applicable, add the following below this CDDL HEADER, with the
* fields enclosed by brackets "[]" replaced with your own identifying
* information: Portions Copyright [yyyy] [name of copyright owner]
*
* CDDL HEADER END
*/
/*
* Copyright 2009 Sun Microsystems, Inc. All rights reserved.
* Use is subject to license terms.
*/
#include <sys/types.h>
#include <sys/systm.h>
#include <sys/kmem.h>
#include <sys/disp.h>
#include <sys/stream.h>
#include <sys/strsubr.h>
#include <sys/strsun.h>
#include <sys/policy.h>
#include <sys/tsol/label_macro.h>
#include <sys/tsol/tndb.h>
#include <sys/tsol/tnet.h>
#include <inet/ip.h>
#include <inet/ip6.h>
#include <inet/tcp.h>
#include <inet/ipclassifier.h>
#include <inet/ip_ire.h>
#include <inet/ip_ftable.h>
/*
* This routine takes a sensitivity label as input and creates a CIPSO
* option in the specified buffer. It returns the size of the CIPSO option.
* If the sensitivity label is too large for the CIPSO option, then 0
* is returned.
*
* tsol2cipso_tt1 returns 0 for failure and greater than 0 for success
* (more accurately, success means a return value between 10 and 40).
*/
static int
tsol2cipso_tt1(const bslabel_t *sl, unsigned char *cop, uint32_t doi)
{
struct cipso_tag_type_1 *tt1;
const _bslabel_impl_t *bsl;
const uchar_t *ucp;
int i;
if (doi == 0)
return (0);
/* check for Admin High sensitivity label */
if (blequal(sl, label2bslabel(l_admin_high)))
return (0);
/* check whether classification will fit in one octet */
bsl = (const _bslabel_impl_t *)sl;
if (LCLASS(bsl) & 0xFF00)
return (0);
/*
* Check whether compartments will fit in 30 octets.
* Compartments 241 - 256 are not allowed.
*/
if (ntohl(bsl->compartments.c8) & 0x0000FFFF)
return (0);
/*
* Compute option length and tag length.
* 'p' points to the last two bytes in the Sensitivity Label's
* compartments; these cannot be mapped into CIPSO compartments.
*/
ucp = (const uchar_t *)&bsl->compartments.c8 + 2;
while (--ucp >= (const uchar_t *)&bsl->compartments.c1)
if (*ucp != 0)
break;
i = ucp - (const uchar_t *)&bsl->compartments.c1 + 1;
if (cop == NULL)
return (10 + i);
doi = htonl(doi);
ucp = (const uchar_t *)&doi;
cop[IPOPT_OPTVAL] = IPOPT_COMSEC;
cop[IPOPT_OLEN] = 10 + i;
cop[IPOPT_OLEN+1] = ucp[0];
cop[IPOPT_OLEN+2] = ucp[1];
cop[IPOPT_OLEN+3] = ucp[2];
cop[IPOPT_OLEN+4] = ucp[3];
tt1 = (struct cipso_tag_type_1 *)&cop[IPOPT_OLEN + 5];
tt1->tag_type = 1;
tt1->tag_align = 0;
tt1->tag_sl = LCLASS(bsl);
tt1->tag_length = 4 + i;
bcopy(&bsl->compartments.c1, tt1->tag_cat, i);
return (cop[IPOPT_OLEN]);
}
/*
* The following routine searches for a security label in an IPv4 datagram.
* It returns label_type of:
* OPT_CIPSO if a CIPSO IP option is found.
* OPT_NONE if no security label is found.
*
* If OPT_CIPSO, a pointer to the CIPSO IP option will be returned in
* the buffer parameter.
*
* The function will return with B_FALSE if an IP format error
* is encountered.
*/
boolean_t
tsol_get_option_v4(mblk_t *mp, tsol_ip_label_t *label_type, uchar_t **buffer)
{
ipha_t *ipha;
uchar_t *opt;
uint32_t totallen;
uint32_t optval;
uint32_t optlen;
*label_type = OPT_NONE;
/*
* Get length (in 4 byte octets) of IP header options.
* If header doesn't contain options, then return a label_type
* of OPT_NONE.
*/
ipha = (ipha_t *)mp->b_rptr;
totallen = ipha->ipha_version_and_hdr_length -
(uint8_t)((IP_VERSION << 4));
totallen <<= 2;
if (totallen < IP_SIMPLE_HDR_LENGTH || totallen > MBLKL(mp))
return (B_FALSE);
totallen -= IP_SIMPLE_HDR_LENGTH;
if (totallen == 0)
return (B_TRUE);
/*
* Search for CIPSO option.
* If no such option is present, then return OPT_NONE.
*/
opt = (uchar_t *)&ipha[1];
while (totallen != 0) {
switch (optval = opt[IPOPT_OPTVAL]) {
case IPOPT_EOL:
return (B_TRUE);
case IPOPT_NOP:
optlen = 1;
break;
default:
if (totallen <= IPOPT_OLEN)
return (B_FALSE);
optlen = opt[IPOPT_OLEN];
if (optlen < 2)
return (B_FALSE);
}
if (optlen > totallen)
return (B_FALSE);
/*
* Copy pointer to option into '*buffer' and
* return the option type.
*/
switch (optval) {
case IPOPT_COMSEC:
if (TSOL_CIPSO_TAG_OFFSET < optlen &&
opt[TSOL_CIPSO_TAG_OFFSET] == 1) {
*label_type = OPT_CIPSO;
*buffer = opt;
return (B_TRUE);
}
return (B_FALSE);
}
totallen -= optlen;
opt += optlen;
}
return (B_TRUE);
}
/*
* The following routine searches for a security label in an IPv6 datagram.
* It returns label_type of:
* OPT_CIPSO if a CIPSO IP option is found.
* OPT_NONE if no security label is found.
*
* If OPT_CIPSO, a pointer to the IPv4 portion of the CIPSO IP option will
* be returned in the buffer parameter.
*
* The function will return with B_FALSE if an IP format error
* or an unexpected label content error is encountered.
*/
boolean_t
tsol_get_option_v6(mblk_t *mp, tsol_ip_label_t *label_type, uchar_t **buffer)
{
uchar_t *opt_ptr = NULL;
uchar_t *after_secopt;
boolean_t hbh_needed;
const uchar_t *ip6hbh;
size_t optlen;
uint32_t doi;
const ip6_t *ip6h;
*label_type = OPT_NONE;
*buffer = NULL;
ip6h = (const ip6_t *)mp->b_rptr;
if (ip6h->ip6_nxt != IPPROTO_HOPOPTS)
return (B_TRUE);
ip6hbh = (const uchar_t *)&ip6h[1];
if (ip6hbh + MIN_EHDR_LEN > mp->b_wptr)
return (B_FALSE);
optlen = (ip6hbh[1] + 1) << 3;
if (ip6hbh + optlen > mp->b_wptr)
return (B_FALSE);
if (!tsol_find_secopt_v6(ip6hbh, optlen,
&opt_ptr, &after_secopt, &hbh_needed))
return (B_FALSE);
/* tsol_find_secopt_v6 guarantees some sanity */
if (opt_ptr != NULL) {
/*
* IPv6 Option
* opt_ptr[0]: Option type
* opt_ptr[1]: Length of option data in bytes
* opt_ptr[2]: First byte of option data
*/
if ((optlen = opt_ptr[1]) < 8)
return (B_FALSE);
opt_ptr += 2;
/*
* From "Generalized Labeled Security Option for IPv6" draft
* opt_ptr[0] - opt_ptr[4]: DOI = IP6LS_DOI_V4
* opt_ptr[4]: Tag type = IP6LS_TT_V4
* opt_ptr[5]: Tag length in bytes starting at Tag type field
* IPv4 CIPSO Option
* opt_ptr[6]: option type
* opt_ptr[7]: option length in bytes starting at type field
*/
bcopy(opt_ptr, &doi, sizeof (doi));
doi = ntohl(doi);
if (doi == IP6LS_DOI_V4 &&
opt_ptr[4] == IP6LS_TT_V4 &&
opt_ptr[5] <= optlen - 4 &&
opt_ptr[7] <= optlen - 6 &&
opt_ptr[7] <= opt_ptr[5] - 2) {
opt_ptr += sizeof (doi) + 2;
*label_type = OPT_CIPSO;
*buffer = opt_ptr;
return (B_TRUE);
}
return (B_FALSE);
}
return (B_TRUE);
}
/*
* tsol_check_dest()
*
* This routine verifies if a destination is allowed to recieve messages
* based on the security label. If any adjustments to the label are needed
* due to the connection's MAC mode or the destination's ability
* to receive labels, an "effective label" will be returned.
*
* zone_is_global is set if the actual zoneid is global. That is, it is
* not set for an exclusive-IP zone.
*
* On successful return, effective_tsl will point to the new label needed
* or will be NULL if a new label isn't needed. On error, effective_tsl will
* point to NULL.
*
* Returns:
* 0 Label (was|is now) correct
* EHOSTUNREACH The label failed the remote host accreditation
* ENOMEM Memory allocation failure
*/
int
tsol_check_dest(const ts_label_t *tsl, const void *dst,
uchar_t version, uint_t mac_mode, boolean_t zone_is_global,
ts_label_t **effective_tsl)
{
ts_label_t *newtsl = NULL;
tsol_tpc_t *dst_rhtp;
if (effective_tsl != NULL)
*effective_tsl = NULL;
ASSERT(version == IPV4_VERSION ||
(version == IPV6_VERSION &&
!IN6_IS_ADDR_V4MAPPED((in6_addr_t *)dst)));
/* Always pass kernel level communication (NULL label) */
if (tsl == NULL) {
DTRACE_PROBE2(tx__tnopt__log__info__labeling__mac__allownull,
char *, "destination ip(1) with null label was passed",
ipaddr_t, dst);
return (0);
}
if (tsl->tsl_flags & TSLF_IMPLICIT_IN) {
DTRACE_PROBE3(tx__tnopt__log__info__labeling__unresolved__label,
char *,
"implicit-in packet to ip(1) reached tsol_check_dest "
"with implied security label sl(2)",
ipaddr_t, dst, ts_label_t *, tsl);
}
/* Always pass multicast */
if (version == IPV4_VERSION &&
CLASSD(*(ipaddr_t *)dst)) {
DTRACE_PROBE2(tx__tnopt__log__info__labeling__mac__allowmult,
char *, "destination ip(1) with multicast dest was passed",
ipaddr_t, dst);
return (0);
} else if (version == IPV6_VERSION &&
IN6_IS_ADDR_MULTICAST((in6_addr_t *)dst)) {
DTRACE_PROBE2(tx__tnopt__log__info__labeling__mac__allowmult_v6,
char *, "destination ip(1) with multicast dest was passed",
in6_addr_t *, dst);
return (0);
}
/* Never pass an undefined destination */
if ((dst_rhtp = find_tpc(dst, version, B_FALSE)) == NULL) {
DTRACE_PROBE2(tx__tnopt__log__info__labeling__lookupdst,
char *, "destination ip(1) not in tn database.",
void *, dst);
return (EHOSTUNREACH);
}
switch (dst_rhtp->tpc_tp.host_type) {
case UNLABELED:
/*
* Can talk to unlabeled hosts if
* (1) zone's label matches the default label, or
* (2) SO_MAC_EXEMPT is on and we
* dominate the peer's label, or
* (3) SO_MAC_EXEMPT is on and
* this is the global zone
*/
if (dst_rhtp->tpc_tp.tp_doi != tsl->tsl_doi) {
DTRACE_PROBE4(tx__tnopt__log__info__labeling__doi,
char *, "unlabeled dest ip(1)/tpc(2) doi does "
"not match msg label(3) doi.", void *, dst,
tsol_tpc_t *, dst_rhtp, ts_label_t *, tsl);
TPC_RELE(dst_rhtp);
return (EHOSTUNREACH);
}
if (!blequal(&dst_rhtp->tpc_tp.tp_def_label,
&tsl->tsl_label)) {
if (mac_mode != CONN_MAC_AWARE ||
!(zone_is_global ||
bldominates(&tsl->tsl_label,
&dst_rhtp->tpc_tp.tp_def_label))) {
DTRACE_PROBE4(
tx__tnopt__log__info__labeling__mac,
char *, "unlabeled dest ip(1)/tpc(2) does "
"not match msg label(3).", void *, dst,
tsol_tpc_t *, dst_rhtp, ts_label_t *, tsl);
TPC_RELE(dst_rhtp);
return (EHOSTUNREACH);
}
/*
* This is a downlabel MAC-exempt exchange.
* Use the remote destination's default label
* as the label of the message data.
*/
if ((newtsl = labelalloc(&dst_rhtp->tpc_tp.tp_def_label,
dst_rhtp->tpc_tp.tp_doi, KM_NOSLEEP)) == NULL) {
TPC_RELE(dst_rhtp);
return (ENOMEM);
}
newtsl->tsl_flags |= TSLF_UNLABELED;
} else if (!(tsl->tsl_flags & TSLF_UNLABELED)) {
/*
* The security labels are the same but we need
* to flag that the remote node is unlabeled.
*/
if ((newtsl = labeldup(tsl, KM_NOSLEEP)) == NULL) {
TPC_RELE(dst_rhtp);
return (ENOMEM);
}
newtsl->tsl_flags |= TSLF_UNLABELED;
}
break;
case SUN_CIPSO:
/*
* Can talk to labeled hosts if zone's label is within target's
* label range or set.
*/
if (dst_rhtp->tpc_tp.tp_cipso_doi_cipso != tsl->tsl_doi ||
(!_blinrange(&tsl->tsl_label,
&dst_rhtp->tpc_tp.tp_sl_range_cipso) &&
!blinlset(&tsl->tsl_label,
dst_rhtp->tpc_tp.tp_sl_set_cipso))) {
DTRACE_PROBE4(tx__tnopt__log__info__labeling__mac,
char *, "labeled dest ip(1)/tpc(2) does not "
"match msg label(3).", void *, dst,
tsol_tpc_t *, dst_rhtp, ts_label_t *, tsl);
TPC_RELE(dst_rhtp);
return (EHOSTUNREACH);
}
if ((tsl->tsl_flags & TSLF_UNLABELED) ||
(mac_mode == CONN_MAC_IMPLICIT)) {
/*
* Copy label so we can modify the flags
*/
if ((newtsl = labeldup(tsl, KM_NOSLEEP)) == NULL) {
TPC_RELE(dst_rhtp);
return (ENOMEM);
}
/*
* The security label is a match but we need to
* clear the unlabeled flag for this remote node.
*/
newtsl->tsl_flags &= ~TSLF_UNLABELED;
if (mac_mode == CONN_MAC_IMPLICIT)
newtsl->tsl_flags |= TSLF_IMPLICIT_OUT;
}
break;
default:
TPC_RELE(dst_rhtp);
return (EHOSTUNREACH);
}
/*
* Return the new label.
*/
if (newtsl != NULL) {
if (effective_tsl != NULL)
*effective_tsl = newtsl;
else
label_rele(newtsl);
}
TPC_RELE(dst_rhtp);
return (0);
}
/*
* tsol_compute_label_v4()
*
* This routine computes the IP label that should be on a packet based on the
* connection and destination information.
*
* The zoneid is the IP zoneid (i.e., GLOBAL_ZONEID for exlusive-IP zones).
*
* Returns:
* 0 Fetched label
* EHOSTUNREACH No route to destination
* EINVAL Label cannot be computed
*/
int
tsol_compute_label_v4(const ts_label_t *tsl, zoneid_t zoneid, ipaddr_t dst,
uchar_t *opt_storage, ip_stack_t *ipst)
{
uint_t sec_opt_len;
ire_t *ire;
tsol_ire_gw_secattr_t *attrp = NULL;
if (opt_storage != NULL)
opt_storage[IPOPT_OLEN] = 0;
if (tsl == NULL)
return (0);
/* always pass multicast */
if (CLASSD(dst))
return (0);
if (tsl->tsl_flags & TSLF_IMPLICIT_OUT)
return (0);
if (tsl->tsl_flags & TSLF_UNLABELED) {
/*
* The destination is unlabeled. Only add a label if the
* destination is not a broadcast/local/loopback address,
* the destination is not on the same subnet, and the
* next-hop gateway is labeled.
*/
ire = ire_route_recursive_v4(dst, 0, NULL, zoneid, tsl,
MATCH_IRE_SECATTR, B_TRUE, 0, ipst, NULL, &attrp, NULL);
ASSERT(ire != NULL);
if (ire->ire_flags & (RTF_REJECT|RTF_BLACKHOLE)) {
/* no route to destination */
ire_refrele(ire);
DTRACE_PROBE3(
tx__tnopt__log__info__labeling__routedst__v4,
char *, "No route to unlabeled dest ip(1) with "
"with label(2).", ipaddr_t, dst, ts_label_t *, tsl);
return (EHOSTUNREACH);
}
if (ire->ire_type & (IRE_BROADCAST | IRE_LOCAL | IRE_LOOPBACK |
IRE_INTERFACE)) {
ire_refrele(ire);
return (0);
}
/*
* ire_route_recursive gives us the first attrp it finds
* in the recursive lookup.
*/
/*
* Return now if next hop gateway is unlabeled. There is
* no need to generate a CIPSO option for this message.
*/
if (attrp == NULL || attrp->igsa_rhc == NULL ||
attrp->igsa_rhc->rhc_tpc->tpc_tp.host_type == UNLABELED) {
ire_refrele(ire);
return (0);
}
ire_refrele(ire);
}
/* compute the CIPSO option */
sec_opt_len = tsol2cipso_tt1(&tsl->tsl_label, opt_storage,
tsl->tsl_doi);
if (sec_opt_len == 0) {
DTRACE_PROBE3(tx__tnopt__log__error__labeling__lostops__v4,
char *, "options lack length for dest ip(1) with label(2).",
ipaddr_t, dst, ts_label_t *, tsl);
return (EINVAL);
}
return (0);
}
/*
* Remove any existing security option (CIPSO) from the given IP
* header, move the 'buflen' bytes back to fill the gap, and return the number
* of bytes removed (as zero or negative number). Assumes that the headers are
* sane.
*
* Note that tsol_remove_secopt does not adjust ipha_length but
* tsol_remove_secopt_v6 does adjust ip6_plen.
*/
int
tsol_remove_secopt(ipha_t *ipha, int buflen)
{
int remlen, olen, oval, delta;
uchar_t *fptr, *tptr;
boolean_t noop_keep;
remlen = IPH_HDR_LENGTH(ipha) - IP_SIMPLE_HDR_LENGTH;
fptr = tptr = (uchar_t *)(ipha + 1);
noop_keep = B_TRUE;
while (remlen > 0) {
oval = fptr[IPOPT_OPTVAL];
/* terminate on end of list */
if (oval == IPOPT_EOL)
break;
/*
* Delete any no-ops following a deleted option, at least up
* to a 4 octet alignment; copy others.
*/
if (oval == IPOPT_NOP) {
if (((fptr - (uchar_t *)ipha) & 3) == 0)
noop_keep = B_TRUE;
if (noop_keep)
*tptr++ = oval;
fptr++;
remlen--;
continue;
}
/* stop on corrupted list; just do nothing. */
if (remlen < 2)
return (0);
olen = fptr[IPOPT_OLEN];
if (olen < 2 || olen > remlen)
return (0);
/* skip over security options to delete them */
if (oval == IPOPT_COMSEC || oval == IPOPT_SECURITY) {
noop_keep = B_FALSE;
fptr += olen;
remlen -= olen;
continue;
}
/* copy the rest */
noop_keep = B_TRUE;
if (tptr != fptr)
ovbcopy(fptr, tptr, olen);
fptr += olen;
tptr += olen;
remlen -= olen;
}
fptr += remlen;
/* figure how much padding we'll need for header alignment */
olen = (tptr - (uchar_t *)ipha) & 3;
if (olen > 0) {
olen = 4 - olen;
/* pad with end-of-list */
bzero(tptr, olen);
tptr += olen;
}
/* slide back the headers that follow and update the IP header */
delta = fptr - tptr;
if (delta != 0) {
ovbcopy(fptr, tptr, ((uchar_t *)ipha + buflen) - fptr);
ipha->ipha_version_and_hdr_length -= delta / 4;
}
return (-delta);
}
/*
* Insert the option in 'optbuf' into the IP header pointed to by 'ipha', and
* move the data following the IP header (up to buflen) to accomodate the new
* option. Assumes that up to IP_MAX_OPT_LENGTH bytes are available (in total)
* for IP options. Returns the number of bytes actually inserted, or -1 if the
* option cannot be inserted. (Note that negative return values are possible
* when noops must be compressed, and that only -1 indicates error. Successful
* return value is always evenly divisible by 4, by definition.)
*
* Note that tsol_prepend_option does not adjust ipha_length but
* tsol_prepend_option_v6 does adjust ip6_plen.
*/
int
tsol_prepend_option(uchar_t *optbuf, ipha_t *ipha, int buflen)
{
int remlen, padding, lastpad, totlen;
int oval, olen;
int delta;
uchar_t *optr;
uchar_t tempopt[IP_MAX_OPT_LENGTH], *toptr;
if (optbuf[IPOPT_OPTVAL] == IPOPT_EOL ||
optbuf[IPOPT_OPTVAL] == IPOPT_NOP ||
optbuf[IPOPT_OLEN] == 0)
return (0);
ASSERT(optbuf[IPOPT_OLEN] >= 2 &&
optbuf[IPOPT_OLEN] <= IP_MAX_OPT_LENGTH);
/* first find the real (unpadded) length of the existing options */
remlen = IPH_HDR_LENGTH(ipha) - IP_SIMPLE_HDR_LENGTH;
padding = totlen = lastpad = 0;
optr = (uchar_t *)(ipha + 1);
while (remlen > 0) {
oval = optr[IPOPT_OPTVAL];
/* stop at end of list */
if (oval == IPOPT_EOL)
break;
/* skip no-ops, noting that length byte isn't present */
if (oval == IPOPT_NOP) {
optr++;
padding++;
lastpad++;
totlen++;
remlen--;
continue;
}
/* give up on a corrupted list; report failure */
if (remlen < 2)
return (-1);
olen = optr[IPOPT_OLEN];
if (olen < 2 || olen > remlen)
return (-1);
lastpad = 0;
optr += olen;
totlen += olen;
remlen -= olen;
}
/* completely ignore any trailing padding */
totlen -= lastpad;
padding -= lastpad;
/*
* If some sort of inter-option alignment was present, try to preserve
* that alignment. If alignment pushes us out past the maximum, then
* discard it and try to compress to fit. (We just "assume" that any
* padding added was attempting to get 32 bit alignment. If that's
* wrong, that's just too bad.)
*/
if (padding > 0) {
olen = (optbuf[IPOPT_OLEN] + 3) & ~3;
if (olen + totlen > IP_MAX_OPT_LENGTH) {
totlen -= padding;
if (olen + totlen > IP_MAX_OPT_LENGTH)
return (-1);
padding = 0;
}
}
/*
* Since we may need to compress or expand the option list, we write to
* a temporary buffer and then copy the results back to the IP header.
*/
toptr = tempopt;
/* compute actual option to insert */
olen = optbuf[IPOPT_OLEN];
bcopy(optbuf, toptr, olen);
toptr += olen;
if (padding > 0) {
while ((olen & 3) != 0) {
*toptr++ = IPOPT_NOP;
olen++;
}
}
/* copy over the existing options */
optr = (uchar_t *)(ipha + 1);
while (totlen > 0) {
oval = optr[IPOPT_OPTVAL];
/* totlen doesn't include end-of-list marker */
ASSERT(oval != IPOPT_EOL);
/* handle no-ops; copy if desired, ignore otherwise */
if (oval == IPOPT_NOP) {
if (padding > 0) {
/* note: cannot overflow due to checks above */
ASSERT(toptr < tempopt + IP_MAX_OPT_LENGTH);
*toptr++ = oval;
}
optr++;
totlen--;
continue;
}
/* list cannot be corrupt at this point */
ASSERT(totlen >= 2);
olen = optr[IPOPT_OLEN];
ASSERT(olen >= 2 && olen <= totlen);
/* cannot run out of room due to tests above */
ASSERT(toptr + olen <= tempopt + IP_MAX_OPT_LENGTH);
bcopy(optr, toptr, olen);
optr += olen;
toptr += olen;
totlen -= olen;
}
/* figure how much padding we'll need for header alignment */
olen = (toptr - tempopt) & 3;
if (olen > 0) {
olen = 4 - olen;
ASSERT(toptr + olen <= tempopt + IP_MAX_OPT_LENGTH);
/* pad with end-of-list value */
bzero(toptr, olen);
toptr += olen;
}
/* move the headers as needed and update IP header */
olen = (toptr - tempopt) + IP_SIMPLE_HDR_LENGTH;
remlen = IPH_HDR_LENGTH(ipha);
delta = olen - remlen;
if (delta != 0) {
ovbcopy((uchar_t *)ipha + remlen, (uchar_t *)ipha + olen,
buflen - remlen);
ipha->ipha_version_and_hdr_length += delta / 4;
}
/* slap in the new options */
bcopy(tempopt, ipha + 1, olen - IP_SIMPLE_HDR_LENGTH);
return (delta);
}
/*
* tsol_check_label_v4()
*
* This routine computes the IP label that should be on the packet based on the
* connection and destination information. It's called by the IP forwarding
* logic and by ip_output_simple. The ULPs generate the labels before calling
* conn_ip_output. If any adjustments to
* the label are needed due to the connection's MAC-exempt status or
* the destination's ability to receive labels, an "effective label"
* will be returned.
*
* The packet's header is clear before entering IPsec's engine.
*
* The zoneid is the IP zoneid (i.e., GLOBAL_ZONEID for exlusive-IP zones).
* zone_is_global is set if the actual zoneid is global.
*
* On successful return, effective_tslp will point to the new label needed
* or will be NULL if a new label isn't needed. On error, effective_tsl will
* point to NULL.
*
* Returns:
* 0 Label (was|is now) correct
* EACCES The packet failed the remote host accreditation.
* ENOMEM Memory allocation failure.
* EINVAL Label cannot be computed
*/
int
tsol_check_label_v4(const ts_label_t *tsl, zoneid_t zoneid, mblk_t **mpp,
uint_t mac_mode, boolean_t zone_is_global, ip_stack_t *ipst,
ts_label_t **effective_tslp)
{
mblk_t *mp = *mpp;
ipha_t *ipha;
ts_label_t *effective_tsl = NULL;
uchar_t opt_storage[IP_MAX_OPT_LENGTH];
uint_t hlen;
uint_t sec_opt_len;
uchar_t *optr;
int delta_remove = 0, delta_add, adjust;
int retv;
*effective_tslp = NULL;
opt_storage[IPOPT_OPTVAL] = 0;
ipha = (ipha_t *)mp->b_rptr;
/*
* Verify the destination is allowed to receive packets at
* the security label of the message data. tsol_check_dest()
* may create a new effective label or label flags.
*/
retv = tsol_check_dest(tsl, &ipha->ipha_dst, IPV4_VERSION,
mac_mode, zone_is_global, &effective_tsl);
if (retv != 0)
return (retv);
/*
* Calculate the security label to be placed in the text
* of the message (if any).
*/
if (effective_tsl != NULL) {
if ((retv = tsol_compute_label_v4(effective_tsl, zoneid,
ipha->ipha_dst, opt_storage, ipst)) != 0) {
label_rele(effective_tsl);
return (retv);
}
*effective_tslp = effective_tsl;
} else {
if ((retv = tsol_compute_label_v4(tsl, zoneid,
ipha->ipha_dst, opt_storage, ipst)) != 0) {
return (retv);
}
}
optr = (uchar_t *)(ipha + 1);
hlen = IPH_HDR_LENGTH(ipha) - IP_SIMPLE_HDR_LENGTH;
sec_opt_len = opt_storage[IPOPT_OLEN];
if (hlen >= sec_opt_len) {
/* If no option is supposed to be there, make sure it's not */
if (sec_opt_len == 0 && hlen > 0 &&
optr[IPOPT_OPTVAL] != IPOPT_COMSEC &&
optr[IPOPT_OPTVAL] != IPOPT_SECURITY)
return (0);
/* if the option is there, it's always first */
if (sec_opt_len != 0 &&
bcmp(opt_storage, optr, sec_opt_len) == 0)
return (0);
}
/*
* If there is an option there, then it must be the wrong one; delete.
*/
if (hlen > 0) {
delta_remove = tsol_remove_secopt(ipha, MBLKL(mp));
mp->b_wptr += delta_remove;
}
/* Make sure we have room for the worst-case addition */
hlen = IPH_HDR_LENGTH(ipha) + opt_storage[IPOPT_OLEN];
hlen = (hlen + 3) & ~3;
if (hlen > IP_MAX_HDR_LENGTH)
hlen = IP_MAX_HDR_LENGTH;
hlen -= IPH_HDR_LENGTH(ipha);
if (mp->b_wptr + hlen > mp->b_datap->db_lim) {
int copylen;
mblk_t *new_mp;
/* allocate enough to be meaningful, but not *too* much */
copylen = MBLKL(mp);
if (copylen > 256)
copylen = 256;
new_mp = allocb_tmpl(hlen + copylen +
(mp->b_rptr - mp->b_datap->db_base), mp);
if (new_mp == NULL) {
if (effective_tsl != NULL) {
label_rele(effective_tsl);
*effective_tslp = NULL;
}
return (ENOMEM);
}
/* keep the bias */
new_mp->b_rptr += mp->b_rptr - mp->b_datap->db_base;
new_mp->b_wptr = new_mp->b_rptr + copylen;
bcopy(mp->b_rptr, new_mp->b_rptr, copylen);
new_mp->b_cont = mp;
if ((mp->b_rptr += copylen) >= mp->b_wptr) {
new_mp->b_cont = mp->b_cont;
freeb(mp);
}
*mpp = mp = new_mp;
ipha = (ipha_t *)mp->b_rptr;
}
delta_add = tsol_prepend_option(opt_storage, ipha, MBLKL(mp));
if (delta_add == -1)
goto param_prob;
ASSERT((mp->b_wptr + delta_add) <= DB_LIM(mp));
mp->b_wptr += delta_add;
adjust = delta_remove + delta_add;
adjust += ntohs(ipha->ipha_length);
ipha->ipha_length = htons(adjust);
return (0);
param_prob:
if (effective_tsl != NULL) {
label_rele(effective_tsl);
*effective_tslp = NULL;
}
return (EINVAL);
}
/*
* IPv6 HopOpt extension header for the label option layout:
* - One octet giving the type of the 'next extension header'
* - Header extension length in 8-byte words, not including the
* 1st 8 bytes, but including any pad bytes at the end.
* Eg. A value of 2 means 16 bytes not including the 1st 8 bytes.
* - Followed by TLV encoded IPv6 label option. Option layout is
* * One octet, IP6OPT_LS
* * One octet option length in bytes of the option data following
* the length, but not including any pad bytes at the end.
* * Four-octet DOI (IP6LS_DOI_V4)
* * One octet suboption, IP6LS_TT_V4
* * One octet suboption length in bytes of the suboption
* following the suboption length, including the suboption
* header length, but not including any pad bytes at the end.
* - Pad to make the extension header a multiple of 8 bytes.
*
* This function returns the contents of 'IPv6 option structure' in the above.
* i.e starting from the IP6OPT_LS but not including the pad at the end.
* The user must prepend two octets (either padding or next header / length)
* and append padding out to the next 8 octet boundary.
*
* The zoneid is the IP zoneid (i.e., GLOBAL_ZONEID for exlusive-IP zones).
*/
int
tsol_compute_label_v6(const ts_label_t *tsl, zoneid_t zoneid,
const in6_addr_t *dst, uchar_t *opt_storage, ip_stack_t *ipst)
{
uint_t sec_opt_len;
uint32_t doi;
ire_t *ire;
tsol_ire_gw_secattr_t *attrp = NULL;
if (ip6opt_ls == 0)
return (EINVAL);
if (opt_storage != NULL)
opt_storage[IPOPT_OLEN] = 0;
if (tsl == NULL)
return (0);
/* Always pass multicast */
if (IN6_IS_ADDR_MULTICAST(dst))
return (0);
/*
* Fill in a V6 label. If a new format is added here, make certain
* that the maximum size of this label is reflected in sys/tsol/tnet.h
* as TSOL_MAX_IPV6_OPTION.
*/
if (tsl->tsl_flags & TSLF_IMPLICIT_OUT)
return (0);
if (tsl->tsl_flags & TSLF_UNLABELED) {
/*
* The destination is unlabeled. Only add a label if the
* destination is not a broadcast/local/loopback address,
* the destination is not on the same subnet, and the
* next-hop gateway is labeled.
*/
ire = ire_route_recursive_v6(dst, 0, NULL, zoneid, tsl,
MATCH_IRE_SECATTR, B_TRUE, 0, ipst, NULL, &attrp, NULL);
ASSERT(ire != NULL);
if (ire->ire_flags & (RTF_REJECT|RTF_BLACKHOLE)) {
/* no route to destination */
ire_refrele(ire);
DTRACE_PROBE3(
tx__tnopt__log__info__labeling__routedst__v6,
char *, "No route to unlabeled dest ip6(1) with "
"label(2).", in6_addr_t *, dst, ts_label_t *, tsl);
return (EHOSTUNREACH);
}
if (ire->ire_type & (IRE_LOCAL | IRE_LOOPBACK |
IRE_INTERFACE)) {
ire_refrele(ire);
return (0);
}
/*
* ire_route_recursive gives us the first attrp it finds
* in the recursive lookup.
*/
/*
* Return now if next hop gateway is unlabeled. There is
* no need to generate a CIPSO option for this message.
*/
if (attrp == NULL || attrp->igsa_rhc == NULL ||
attrp->igsa_rhc->rhc_tpc->tpc_tp.host_type == UNLABELED) {
ire_refrele(ire);
return (0);
}
ire_refrele(ire);
}
/* compute the CIPSO option */
if (opt_storage != NULL)
opt_storage += 8;
sec_opt_len = tsol2cipso_tt1(&tsl->tsl_label, opt_storage,
tsl->tsl_doi);
if (sec_opt_len == 0) {
DTRACE_PROBE3(tx__tnopt__log__error__labeling__lostops__v6,
char *, "options lack length for dest ip6(1) with "
"label(2).", in6_addr_t *, dst, ts_label_t *, tsl);
return (EINVAL);
}
if (opt_storage == NULL)
return (0);
if (sec_opt_len < IP_MAX_OPT_LENGTH)
opt_storage[sec_opt_len] = IPOPT_EOL;
/*
* Just in case the option length is odd, round it up to the next even
* multiple. The IPv6 option definition doesn't like odd numbers for
* some reason.
*
* Length in the overall option header (IP6OPT_LS) does not include the
* option header itself, but the length in the suboption does include
* the suboption header. Thus, when there's just one suboption, the
* length in the option header is the suboption length plus 4 (for the
* DOI value).
*/
opt_storage[-2] = IP6LS_TT_V4;
opt_storage[-1] = (sec_opt_len + 2 + 1) & ~1;
opt_storage[-8] = ip6opt_ls;
opt_storage[-7] = opt_storage[-1] + 4;
doi = htons(IP6LS_DOI_V4);
bcopy(&doi, opt_storage - 6, 4);
return (0);
}
/*
* Locate the start of the IP6OPT_LS label option and return it.
* Also return the start of the next non-pad option in after_secoptp.
* Usually the label option is the first option at least when packets
* are generated, but for generality we don't assume that on received packets.
*
* The function will return with B_FALSE if an IP format error
* or an unexpected label content error is encountered.
*/
boolean_t
tsol_find_secopt_v6(
const uchar_t *ip6hbh, /* Start of the hop-by-hop extension header */
uint_t hbhlen, /* Length of the hop-by-hop extension header */
uchar_t **secoptp, /* Location of IP6OPT_LS label option */
uchar_t **after_secoptp, /* Non-pad option following the label option */
boolean_t *hbh_needed) /* Is hop-by-hop hdr needed w/o label */
{
uint_t optlen;
uint_t optused;
const uchar_t *optptr;
uchar_t opt_type;
*secoptp = NULL;
*hbh_needed = B_FALSE;
*after_secoptp = NULL;
optlen = hbhlen - 2;
optptr = ip6hbh + 2;
while (optlen != 0) {
opt_type = *optptr;
if (opt_type == IP6OPT_PAD1) {
optptr++;
optlen--;
continue;
}
if (optlen == 1)
return (B_FALSE);
optused = 2 + optptr[1];
if (optused > optlen)
return (B_FALSE);
/*
* if we get here, ip6opt_ls can
* not be 0 because it will always
* match the IP6OPT_PAD1 above.
* Therefore ip6opt_ls == 0 forces
* this test to always fail here.
*/
if (opt_type == ip6opt_ls) {
if (*secoptp != NULL)
/* More than one security option found */
return (B_FALSE);
*secoptp = (uchar_t *)optptr;
} else switch (opt_type) {
case IP6OPT_PADN:
break;
default:
/*
* There is at least 1 option other than
* the label option. So the hop-by-hop header is needed
*/
*hbh_needed = B_TRUE;
if (*secoptp != NULL) {
*after_secoptp = (uchar_t *)optptr;
return (B_TRUE);
}
break;
}
optlen -= optused;
optptr += optused;
}
return (B_TRUE);
}
/*
* Remove the label option from the hop-by-hop options header if it exists.
* 'buflen' is the total length of the packet typically b_wptr - b_rptr.
* Header and data following the label option that is deleted are copied
* (i.e. slid backward) to the right position, and returns the number
* of bytes removed (as zero or negative number.)
*
* Note that tsol_remove_secopt does not adjust ipha_length but
* tsol_remove_secopt_v6 does adjust ip6_plen.
*/
int
tsol_remove_secopt_v6(ip6_t *ip6h, int buflen)
{
uchar_t *ip6hbh; /* hop-by-hop header */
uint_t hbhlen; /* hop-by-hop extension header length */
uchar_t *secopt = NULL;
uchar_t *after_secopt;
uint_t pad;
uint_t delta;
boolean_t hbh_needed;
/*
* hop-by-hop extension header must appear first, if it does not
* exist, there is no label option.
*/
if (ip6h->ip6_nxt != IPPROTO_HOPOPTS)
return (0);
ip6hbh = (uchar_t *)&ip6h[1];
hbhlen = (ip6hbh[1] + 1) << 3;
/*
* Locate the start of the label option if it exists and the end
* of the label option including pads if any.
*/
if (!tsol_find_secopt_v6(ip6hbh, hbhlen, &secopt, &after_secopt,
&hbh_needed)) {
/*
* This function should not see invalid messages.
* If one occurs, it would indicate either an
* option previously verified in the forwarding
* path has been corrupted or an option was
* incorrectly generated locally.
*/
ASSERT(0);
return (0);
}
if (secopt == NULL)
return (0);
if (!hbh_needed) {
uchar_t next_hdr;
/*
* The label option was the only option in the hop-by-hop
* header. We don't need the hop-by-hop header itself any
* longer.
*/
next_hdr = ip6hbh[0];
ovbcopy(ip6hbh + hbhlen, ip6hbh,
buflen - (IPV6_HDR_LEN + hbhlen));
ip6h->ip6_plen = htons(ntohs(ip6h->ip6_plen) - hbhlen);
ip6h->ip6_nxt = next_hdr;
return (-hbhlen);
}
if (after_secopt == NULL) {
/* There is no option following the label option */
after_secopt = ip6hbh + hbhlen;
}
/*
* After deleting the label option, we need to slide the headers
* and data back, while still maintaining the same alignment (module 8)
* for the other options. So we slide the headers and data back only
* by an integral multiple of 8 bytes, and fill the remaining bytes
* with pads.
*/
delta = after_secopt - secopt;
pad = delta % 8;
if (pad == 1) {
secopt[0] = IP6OPT_PAD1;
} else if (pad > 1) {
secopt[0] = IP6OPT_PADN;
secopt[1] = pad - 2;
if (pad > 2)
bzero(&secopt[2], pad - 2);
}
secopt += pad;
delta -= pad;
ovbcopy(after_secopt, secopt,
(uchar_t *)ip6h + buflen - after_secopt);
ip6hbh[1] -= delta/8;
ip6h->ip6_plen = htons(ntohs(ip6h->ip6_plen) - delta);
return (-delta);
}
/*
* 'optbuf' contains a CIPSO label embedded in an IPv6 hop-by-hop option,
* starting with the IP6OPT_LS option type. The format of this hop-by-hop
* option is described in the block comment above tsol_compute_label_v6.
* This function prepends this hop-by-hop option before any other hop-by-hop
* options in the hop-by-hop header if one already exists, else a new
* hop-by-hop header is created and stuffed into the packet following
* the IPv6 header. 'buflen' is the total length of the packet i.e.
* b_wptr - b_rptr. The caller ensures that there is enough space for the
* extra option being added. Header and data following the position where
* the label option is inserted are copied (i.e. slid forward) to the right
* position.
*
* Note that tsol_prepend_option does not adjust ipha_length but
* tsol_prepend_option_v6 does adjust ip6_plen.
*/
int
tsol_prepend_option_v6(uchar_t *optbuf, ip6_t *ip6h, int buflen)
{
/*
* rawlen is the length of the label option in bytes, not including
* any pads, starting from the IP6OPT_LS (option type) byte.
*/
uint_t rawlen;
uint_t optlen; /* rawlen rounded to an 8 byte multiple */
uchar_t *ip6hbh; /* start of the hop-by-hop extension header */
uint_t hbhlen; /* Length of the hop-by-hop extension header */
uint_t pad_len;
uchar_t *pad_position;
int delta; /* Actual number of bytes inserted */
rawlen = optbuf[1] + 2; /* Add 2 for the option type, option length */
ip6hbh = (uchar_t *)&ip6h[1];
if (ip6h->ip6_nxt == IPPROTO_HOPOPTS) {
/*
* There is a hop-by-hop header present already. In order to
* preserve the alignment of the other options at the existing
* value (modulo 8) we need to pad the label option to a
* multiple of 8 bytes before prepending it to the other
* options. Slide the extension headers and data forward to
* accomodate the label option at the start of the hop-by-hop
* header
*/
delta = optlen = (rawlen + 7) & ~7;
pad_len = optlen - rawlen;
pad_position = ip6hbh + 2 + rawlen;
ovbcopy(ip6hbh + 2, ip6hbh + 2 + optlen,
buflen - (IPV6_HDR_LEN + 2));
/*
* Bump up the hop-by-hop extension header length by
* the number of 8-byte words added
*/
optlen >>= 3;
if (ip6hbh[1] + optlen > 255)
return (-1);
ip6hbh[1] += optlen;
} else {
/*
* There is no hop-by-hop header in the packet. Construct a
* new Hop-by-hop extension header (a multiple of 8 bytes).
* Slide any other extension headers and data forward to
* accomodate this hop-by-hop header
*/
delta = hbhlen = (2 + rawlen + 7) & ~7; /* +2 for nxthdr, len */
pad_len = hbhlen - (2 + rawlen);
pad_position = ip6hbh + 2 + rawlen;
ovbcopy(ip6hbh, ip6hbh + hbhlen, buflen - IPV6_HDR_LEN);
ip6hbh[0] = ip6h->ip6_nxt;
/*
* hop-by-hop extension header length in 8-byte words, not
* including the 1st 8 bytes of the hop-by-hop header.
*/
ip6hbh[1] = (hbhlen >> 3) - 1;
ip6h->ip6_nxt = IPPROTO_HOPOPTS;
}
/*
* Copy the label option into the hop-by-hop header and insert any
* needed pads
*/
bcopy(optbuf, ip6hbh + 2, rawlen);
if (pad_len == 1) {
pad_position[0] = IP6OPT_PAD1;
} else if (pad_len > 1) {
pad_position[0] = IP6OPT_PADN;
pad_position[1] = pad_len - 2;
if (pad_len > 2)
bzero(pad_position + 2, pad_len - 2);
}
ip6h->ip6_plen = htons(ntohs(ip6h->ip6_plen) + delta);
return (delta);
}
/*
* tsol_check_label_v6()
*
* This routine computes the IP label that should be on the packet based on the
* connection and destination information. It's called by the IP forwarding
* logic and by ip_output_simple. The ULPs generate the labels before calling
* conn_ip_output. If any adjustments to
* the label are needed due to the connection's MAC-exempt status or
* the destination's ability to receive labels, an "effective label"
* will be returned.
*
* The packet's header is clear before entering IPsec's engine.
*
* The zoneid is the IP zoneid (i.e., GLOBAL_ZONEID for exlusive-IP zones).
* zone_is_global is set if the actual zoneid is global.
*
* On successful return, effective_tslp will point to the new label needed
* or will be NULL if a new label isn't needed. On error, effective_tsl will
* point to NULL.
*
* Returns:
* 0 Label (was|is now) correct
* EACCES The packet failed the remote host accreditation.
* ENOMEM Memory allocation failure.
* EINVAL Label cannot be computed
*/
int
tsol_check_label_v6(const ts_label_t *tsl, zoneid_t zoneid, mblk_t **mpp,
uint_t mac_mode, boolean_t zone_is_global, ip_stack_t *ipst,
ts_label_t **effective_tslp)
{
mblk_t *mp = *mpp;
ip6_t *ip6h;
ts_label_t *effective_tsl = NULL;
/*
* Label option length is limited to IP_MAX_OPT_LENGTH for
* symmetry with IPv4. Can be relaxed if needed
*/
uchar_t opt_storage[TSOL_MAX_IPV6_OPTION];
uint_t hlen;
uint_t sec_opt_len; /* label option length not including type, len */
int delta_remove = 0, delta_add;
int retv;
uchar_t *after_secopt;
uchar_t *secopt = NULL;
uchar_t *ip6hbh;
uint_t hbhlen;
boolean_t hbh_needed;
*effective_tslp = NULL;
/*
* Verify the destination is allowed to receive packets at
* the security label of the message data. tsol_check_dest()
* may create a new effective label or label flags.
*/
ip6h = (ip6_t *)mp->b_rptr;
retv = tsol_check_dest(tsl, &ip6h->ip6_dst, IPV6_VERSION,
mac_mode, zone_is_global, &effective_tsl);
if (retv != 0)
return (retv);
/*
* Calculate the security label to be placed in the text
* of the message (if any).
*/
if (effective_tsl != NULL) {
if ((retv = tsol_compute_label_v6(effective_tsl, zoneid,
&ip6h->ip6_dst, opt_storage, ipst)) != 0) {
label_rele(effective_tsl);
return (retv);
}
*effective_tslp = effective_tsl;
} else {
if ((retv = tsol_compute_label_v6(tsl, zoneid,
&ip6h->ip6_dst, opt_storage, ipst)) != 0)
return (retv);
}
sec_opt_len = opt_storage[1];
if (ip6h->ip6_nxt == IPPROTO_HOPOPTS) {
ip6hbh = (uchar_t *)&ip6h[1];
hbhlen = (ip6hbh[1] + 1) << 3;
if (!tsol_find_secopt_v6(ip6hbh, hbhlen, &secopt,
&after_secopt, &hbh_needed)) {
/*
* This function should not see invalid messages.
* If one occurs, it would indicate either an
* option previously verified in the forwarding
* path has been corrupted or an option was
* incorrectly generated locally.
*/
ASSERT(0);
return (EACCES);
}
}
if (sec_opt_len == 0 && secopt == NULL) {
/*
* The packet is not supposed to have a label, and it
* does not have one currently
*/
return (0);
}
if (secopt != NULL && sec_opt_len != 0 &&
(bcmp(opt_storage, secopt, sec_opt_len + 2) == 0)) {
/* The packet has the correct label already */
return (0);
}
/*
* If there is an option there, then it must be the wrong one; delete.
*/
if (secopt != NULL) {
delta_remove = tsol_remove_secopt_v6(ip6h, MBLKL(mp));
mp->b_wptr += delta_remove;
}
/*
* Make sure we have room for the worst-case addition. Add 2 bytes for
* the hop-by-hop ext header's next header and length fields. Add
* another 2 bytes for the label option type, len and then round
* up to the next 8-byte multiple.
*/
hlen = (4 + sec_opt_len + 7) & ~7;
if (mp->b_wptr + hlen > mp->b_datap->db_lim) {
int copylen;
mblk_t *new_mp;
uint16_t hdr_len;
hdr_len = ip_hdr_length_v6(mp, ip6h);
/*
* Allocate enough to be meaningful, but not *too* much.
* Also all the IPv6 extension headers must be in the same mblk
*/
copylen = MBLKL(mp);
if (copylen > 256)
copylen = 256;
if (copylen < hdr_len)
copylen = hdr_len;
new_mp = allocb_tmpl(hlen + copylen +
(mp->b_rptr - mp->b_datap->db_base), mp);
if (new_mp == NULL) {
if (effective_tsl != NULL) {
label_rele(effective_tsl);
*effective_tslp = NULL;
}
return (ENOMEM);
}
/* keep the bias */
new_mp->b_rptr += mp->b_rptr - mp->b_datap->db_base;
new_mp->b_wptr = new_mp->b_rptr + copylen;
bcopy(mp->b_rptr, new_mp->b_rptr, copylen);
new_mp->b_cont = mp;
if ((mp->b_rptr += copylen) >= mp->b_wptr) {
new_mp->b_cont = mp->b_cont;
freeb(mp);
}
*mpp = mp = new_mp;
ip6h = (ip6_t *)mp->b_rptr;
}
delta_add = tsol_prepend_option_v6(opt_storage, ip6h, MBLKL(mp));
if (delta_add == -1)
goto param_prob;
ASSERT(mp->b_wptr + delta_add <= DB_LIM(mp));
mp->b_wptr += delta_add;
/* tsol_prepend_option_v6 has adjusted ip6_plen */
return (0);
param_prob:
if (effective_tsl != NULL) {
label_rele(effective_tsl);
*effective_tslp = NULL;
}
return (EINVAL);
}