c28749e97052f09388969427adf7df641cdcdc22kais/*
c28749e97052f09388969427adf7df641cdcdc22kais * CDDL HEADER START
c28749e97052f09388969427adf7df641cdcdc22kais *
c28749e97052f09388969427adf7df641cdcdc22kais * The contents of this file are subject to the terms of the
c892ebf1bef94f4f922f282c11516677c134dbe0krishna * Common Development and Distribution License (the "License").
c892ebf1bef94f4f922f282c11516677c134dbe0krishna * You may not use this file except in compliance with the License.
c28749e97052f09388969427adf7df641cdcdc22kais *
c28749e97052f09388969427adf7df641cdcdc22kais * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
c28749e97052f09388969427adf7df641cdcdc22kais * or http://www.opensolaris.org/os/licensing.
c28749e97052f09388969427adf7df641cdcdc22kais * See the License for the specific language governing permissions
c28749e97052f09388969427adf7df641cdcdc22kais * and limitations under the License.
c28749e97052f09388969427adf7df641cdcdc22kais *
c28749e97052f09388969427adf7df641cdcdc22kais * When distributing Covered Code, include this CDDL HEADER in each
c28749e97052f09388969427adf7df641cdcdc22kais * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
c28749e97052f09388969427adf7df641cdcdc22kais * If applicable, add the following below this CDDL HEADER, with the
c28749e97052f09388969427adf7df641cdcdc22kais * fields enclosed by brackets "[]" replaced with your own identifying
c28749e97052f09388969427adf7df641cdcdc22kais * information: Portions Copyright [yyyy] [name of copyright owner]
c28749e97052f09388969427adf7df641cdcdc22kais *
c28749e97052f09388969427adf7df641cdcdc22kais * CDDL HEADER END
c28749e97052f09388969427adf7df641cdcdc22kais */
c28749e97052f09388969427adf7df641cdcdc22kais/*
dd49f125507979bb2ab505a8daf2a46d1be27051Anders Persson * Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
c28749e97052f09388969427adf7df641cdcdc22kais */
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais/*
c28749e97052f09388969427adf7df641cdcdc22kais * The system call and DDI interface for the kernel SSL module
c28749e97052f09388969427adf7df641cdcdc22kais */
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais#include <sys/types.h>
c28749e97052f09388969427adf7df641cdcdc22kais#include <sys/modctl.h>
c28749e97052f09388969427adf7df641cdcdc22kais#include <sys/conf.h>
c28749e97052f09388969427adf7df641cdcdc22kais#include <sys/stat.h>
c28749e97052f09388969427adf7df641cdcdc22kais#include <sys/ddi.h>
c28749e97052f09388969427adf7df641cdcdc22kais#include <sys/sunddi.h>
c28749e97052f09388969427adf7df641cdcdc22kais#include <sys/kmem.h>
c28749e97052f09388969427adf7df641cdcdc22kais#include <sys/errno.h>
c28749e97052f09388969427adf7df641cdcdc22kais#include <sys/file.h>
c28749e97052f09388969427adf7df641cdcdc22kais#include <sys/open.h>
c28749e97052f09388969427adf7df641cdcdc22kais#include <sys/cred.h>
c28749e97052f09388969427adf7df641cdcdc22kais#include <sys/proc.h>
c28749e97052f09388969427adf7df641cdcdc22kais#include <sys/task.h>
c28749e97052f09388969427adf7df641cdcdc22kais#include <sys/model.h>
c28749e97052f09388969427adf7df641cdcdc22kais#include <sys/sysmacros.h>
c28749e97052f09388969427adf7df641cdcdc22kais#include <sys/policy.h>
c28749e97052f09388969427adf7df641cdcdc22kais#include <sys/crypto/common.h>
c28749e97052f09388969427adf7df641cdcdc22kais#include <sys/crypto/api.h>
c28749e97052f09388969427adf7df641cdcdc22kais#include <c2/audit.h>
c28749e97052f09388969427adf7df641cdcdc22kais#include <sys/kstat.h>
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais#include "kssl.h"
c28749e97052f09388969427adf7df641cdcdc22kais#include "ksslimpl.h"
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais/*
c28749e97052f09388969427adf7df641cdcdc22kais * DDI entry points.
c28749e97052f09388969427adf7df641cdcdc22kais */
c28749e97052f09388969427adf7df641cdcdc22kaisstatic int kssl_attach(dev_info_t *, ddi_attach_cmd_t);
c28749e97052f09388969427adf7df641cdcdc22kaisstatic int kssl_detach(dev_info_t *, ddi_detach_cmd_t);
c28749e97052f09388969427adf7df641cdcdc22kaisstatic int kssl_getinfo(dev_info_t *, ddi_info_cmd_t, void *, void **);
c28749e97052f09388969427adf7df641cdcdc22kaisstatic int kssl_open(dev_t *, int, int, cred_t *);
c28749e97052f09388969427adf7df641cdcdc22kaisstatic int kssl_close(dev_t, int, int, cred_t *);
c28749e97052f09388969427adf7df641cdcdc22kaisstatic int kssl_ioctl(dev_t, int, intptr_t, int, cred_t *, int *);
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kaisstatic int kssl_constructor(void *buf, void *arg, int kmflags);
c28749e97052f09388969427adf7df641cdcdc22kaisstatic void kssl_destructor(void *buf, void *arg);
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais/*
c28749e97052f09388969427adf7df641cdcdc22kais * Module linkage.
c28749e97052f09388969427adf7df641cdcdc22kais */
c28749e97052f09388969427adf7df641cdcdc22kaisstatic struct cb_ops cbops = {
c28749e97052f09388969427adf7df641cdcdc22kais kssl_open, /* cb_open */
c28749e97052f09388969427adf7df641cdcdc22kais kssl_close, /* cb_close */
c28749e97052f09388969427adf7df641cdcdc22kais nodev, /* cb_strategy */
c28749e97052f09388969427adf7df641cdcdc22kais nodev, /* cb_print */
c28749e97052f09388969427adf7df641cdcdc22kais nodev, /* cb_dump */
c28749e97052f09388969427adf7df641cdcdc22kais nodev, /* cb_read */
c28749e97052f09388969427adf7df641cdcdc22kais nodev, /* cb_write */
c28749e97052f09388969427adf7df641cdcdc22kais kssl_ioctl, /* cb_ioctl */
c28749e97052f09388969427adf7df641cdcdc22kais nodev, /* cb_devmap */
c28749e97052f09388969427adf7df641cdcdc22kais nodev, /* cb_mmap */
c28749e97052f09388969427adf7df641cdcdc22kais nodev, /* cb_segmap */
c28749e97052f09388969427adf7df641cdcdc22kais nochpoll, /* cb_chpoll */
c28749e97052f09388969427adf7df641cdcdc22kais ddi_prop_op, /* cb_prop_op */
c28749e97052f09388969427adf7df641cdcdc22kais NULL, /* cb_streamtab */
c28749e97052f09388969427adf7df641cdcdc22kais D_MP, /* cb_flag */
c28749e97052f09388969427adf7df641cdcdc22kais CB_REV, /* cb_rev */
c28749e97052f09388969427adf7df641cdcdc22kais nodev, /* cb_aread */
c28749e97052f09388969427adf7df641cdcdc22kais nodev, /* cb_awrite */
c28749e97052f09388969427adf7df641cdcdc22kais};
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kaisstatic struct dev_ops devops = {
c28749e97052f09388969427adf7df641cdcdc22kais DEVO_REV, /* devo_rev */
c28749e97052f09388969427adf7df641cdcdc22kais 0, /* devo_refcnt */
c28749e97052f09388969427adf7df641cdcdc22kais kssl_getinfo, /* devo_getinfo */
c28749e97052f09388969427adf7df641cdcdc22kais nulldev, /* devo_identify */
c28749e97052f09388969427adf7df641cdcdc22kais nulldev, /* devo_probe */
c28749e97052f09388969427adf7df641cdcdc22kais kssl_attach, /* devo_attach */
c28749e97052f09388969427adf7df641cdcdc22kais kssl_detach, /* devo_detach */
c28749e97052f09388969427adf7df641cdcdc22kais nodev, /* devo_reset */
c28749e97052f09388969427adf7df641cdcdc22kais &cbops, /* devo_cb_ops */
c28749e97052f09388969427adf7df641cdcdc22kais NULL, /* devo_bus_ops */
c28749e97052f09388969427adf7df641cdcdc22kais NULL, /* devo_power */
193974072f41a843678abf5f61979c748687e66bSherry Moore ddi_quiesce_not_needed, /* devo_quiesce */
c28749e97052f09388969427adf7df641cdcdc22kais};
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kaisstatic struct modldrv modldrv = {
193974072f41a843678abf5f61979c748687e66bSherry Moore &mod_driverops, /* drv_modops */
193974072f41a843678abf5f61979c748687e66bSherry Moore "Kernel SSL Interface", /* drv_linkinfo */
c28749e97052f09388969427adf7df641cdcdc22kais &devops,
c28749e97052f09388969427adf7df641cdcdc22kais};
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kaisstatic struct modlinkage modlinkage = {
c28749e97052f09388969427adf7df641cdcdc22kais MODREV_1, /* ml_rev */
c28749e97052f09388969427adf7df641cdcdc22kais &modldrv, /* ml_linkage */
c28749e97052f09388969427adf7df641cdcdc22kais NULL
c28749e97052f09388969427adf7df641cdcdc22kais};
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kaisstatic dev_info_t *kssl_dip = NULL;
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kaiscrypto_mechanism_t rsa_x509_mech = {CRYPTO_MECH_INVALID, NULL, 0};
c28749e97052f09388969427adf7df641cdcdc22kaiscrypto_mechanism_t hmac_md5_mech = {CRYPTO_MECH_INVALID, NULL, 0};
c28749e97052f09388969427adf7df641cdcdc22kaiscrypto_mechanism_t hmac_sha1_mech = {CRYPTO_MECH_INVALID, NULL, 0};
c28749e97052f09388969427adf7df641cdcdc22kaiscrypto_call_flag_t kssl_call_flag = CRYPTO_ALWAYS_QUEUE;
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kaisKSSLCipherDef cipher_defs[] = { /* indexed by SSL3BulkCipher */
c28749e97052f09388969427adf7df641cdcdc22kais /* type bsize keysz crypto_mech_type_t */
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais {type_stream, 0, 0, CRYPTO_MECH_INVALID},
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais /* mech_type to be initialized with CKM_RC4's */
c28749e97052f09388969427adf7df641cdcdc22kais {type_stream, 0, 16, CRYPTO_MECH_INVALID},
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais /* mech_type to be initialized with CKM_DES_CBC's */
c28749e97052f09388969427adf7df641cdcdc22kais {type_block, 8, 8, CRYPTO_MECH_INVALID},
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais /* mech_type to be initialized with CKM_DES3_CBC's */
c28749e97052f09388969427adf7df641cdcdc22kais {type_block, 8, 24, CRYPTO_MECH_INVALID},
2bd70d4be73561631df9cb3d9eb4c65fa94fa665krishna
2bd70d4be73561631df9cb3d9eb4c65fa94fa665krishna /* mech_type to be initialized with CKM_AES_CBC with 128-bit key */
2bd70d4be73561631df9cb3d9eb4c65fa94fa665krishna {type_block, 16, 16, CRYPTO_MECH_INVALID},
2bd70d4be73561631df9cb3d9eb4c65fa94fa665krishna
2bd70d4be73561631df9cb3d9eb4c65fa94fa665krishna /* mech_type to be initialized with CKM_AES_CBC with 256-bit key */
2bd70d4be73561631df9cb3d9eb4c65fa94fa665krishna {type_block, 16, 32, CRYPTO_MECH_INVALID},
c28749e97052f09388969427adf7df641cdcdc22kais};
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kaisstruct kmem_cache *kssl_cache;
dd49f125507979bb2ab505a8daf2a46d1be27051Anders Perssonstatic crypto_notify_handle_t prov_update_handle = NULL;
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kaisstatic void kssl_global_init();
dd49f125507979bb2ab505a8daf2a46d1be27051Anders Perssonstatic void kssl_global_fini();
c28749e97052f09388969427adf7df641cdcdc22kaisstatic void kssl_init_mechs();
c28749e97052f09388969427adf7df641cdcdc22kaisstatic void kssl_event_callback(uint32_t, void *);
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais/*
c28749e97052f09388969427adf7df641cdcdc22kais * DDI entry points.
c28749e97052f09388969427adf7df641cdcdc22kais */
c28749e97052f09388969427adf7df641cdcdc22kaisint
c28749e97052f09388969427adf7df641cdcdc22kais_init(void)
c28749e97052f09388969427adf7df641cdcdc22kais{
dd49f125507979bb2ab505a8daf2a46d1be27051Anders Persson int error;
dd49f125507979bb2ab505a8daf2a46d1be27051Anders Persson
dd49f125507979bb2ab505a8daf2a46d1be27051Anders Persson kssl_global_init();
dd49f125507979bb2ab505a8daf2a46d1be27051Anders Persson
dd49f125507979bb2ab505a8daf2a46d1be27051Anders Persson if ((error = mod_install(&modlinkage)) != 0) {
dd49f125507979bb2ab505a8daf2a46d1be27051Anders Persson kssl_global_fini();
dd49f125507979bb2ab505a8daf2a46d1be27051Anders Persson return (error);
dd49f125507979bb2ab505a8daf2a46d1be27051Anders Persson }
dd49f125507979bb2ab505a8daf2a46d1be27051Anders Persson return (0);
dd49f125507979bb2ab505a8daf2a46d1be27051Anders Persson}
dd49f125507979bb2ab505a8daf2a46d1be27051Anders Persson
dd49f125507979bb2ab505a8daf2a46d1be27051Anders Perssonint
dd49f125507979bb2ab505a8daf2a46d1be27051Anders Persson_fini(void)
dd49f125507979bb2ab505a8daf2a46d1be27051Anders Persson{
dd49f125507979bb2ab505a8daf2a46d1be27051Anders Persson int error;
dd49f125507979bb2ab505a8daf2a46d1be27051Anders Persson
dd49f125507979bb2ab505a8daf2a46d1be27051Anders Persson if ((error = mod_remove(&modlinkage)) != 0)
dd49f125507979bb2ab505a8daf2a46d1be27051Anders Persson return (error);
dd49f125507979bb2ab505a8daf2a46d1be27051Anders Persson
dd49f125507979bb2ab505a8daf2a46d1be27051Anders Persson if (prov_update_handle != NULL)
dd49f125507979bb2ab505a8daf2a46d1be27051Anders Persson crypto_unnotify_events(prov_update_handle);
dd49f125507979bb2ab505a8daf2a46d1be27051Anders Persson
dd49f125507979bb2ab505a8daf2a46d1be27051Anders Persson kssl_global_fini();
dd49f125507979bb2ab505a8daf2a46d1be27051Anders Persson
dd49f125507979bb2ab505a8daf2a46d1be27051Anders Persson return (0);
c28749e97052f09388969427adf7df641cdcdc22kais}
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kaisint
c28749e97052f09388969427adf7df641cdcdc22kais_info(struct modinfo *modinfop)
c28749e97052f09388969427adf7df641cdcdc22kais{
c28749e97052f09388969427adf7df641cdcdc22kais return (mod_info(&modlinkage, modinfop));
c28749e97052f09388969427adf7df641cdcdc22kais}
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais/* ARGSUSED */
c28749e97052f09388969427adf7df641cdcdc22kaisstatic int
c28749e97052f09388969427adf7df641cdcdc22kaiskssl_getinfo(dev_info_t *dip, ddi_info_cmd_t cmd, void *arg, void **result)
c28749e97052f09388969427adf7df641cdcdc22kais{
c28749e97052f09388969427adf7df641cdcdc22kais switch (cmd) {
c28749e97052f09388969427adf7df641cdcdc22kais case DDI_INFO_DEVT2DEVINFO:
c28749e97052f09388969427adf7df641cdcdc22kais *result = kssl_dip;
c28749e97052f09388969427adf7df641cdcdc22kais return (DDI_SUCCESS);
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais case DDI_INFO_DEVT2INSTANCE:
c28749e97052f09388969427adf7df641cdcdc22kais *result = (void *)0;
c28749e97052f09388969427adf7df641cdcdc22kais return (DDI_SUCCESS);
c28749e97052f09388969427adf7df641cdcdc22kais }
c28749e97052f09388969427adf7df641cdcdc22kais return (DDI_FAILURE);
c28749e97052f09388969427adf7df641cdcdc22kais}
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kaisstatic int
c28749e97052f09388969427adf7df641cdcdc22kaiskssl_attach(dev_info_t *dip, ddi_attach_cmd_t cmd)
c28749e97052f09388969427adf7df641cdcdc22kais{
c28749e97052f09388969427adf7df641cdcdc22kais if (cmd != DDI_ATTACH) {
c28749e97052f09388969427adf7df641cdcdc22kais return (DDI_FAILURE);
c28749e97052f09388969427adf7df641cdcdc22kais }
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais if (ddi_get_instance(dip) != 0) {
c28749e97052f09388969427adf7df641cdcdc22kais /* we only allow instance 0 to attach */
c28749e97052f09388969427adf7df641cdcdc22kais return (DDI_FAILURE);
c28749e97052f09388969427adf7df641cdcdc22kais }
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais /* create the minor node */
c28749e97052f09388969427adf7df641cdcdc22kais if (ddi_create_minor_node(dip, "kssl", S_IFCHR, 0, DDI_PSEUDO, 0) !=
c28749e97052f09388969427adf7df641cdcdc22kais DDI_SUCCESS) {
c28749e97052f09388969427adf7df641cdcdc22kais cmn_err(CE_WARN, "kssl_attach: failed creating minor node");
c28749e97052f09388969427adf7df641cdcdc22kais ddi_remove_minor_node(dip, NULL);
c28749e97052f09388969427adf7df641cdcdc22kais return (DDI_FAILURE);
c28749e97052f09388969427adf7df641cdcdc22kais }
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais kssl_dip = dip;
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais return (DDI_SUCCESS);
c28749e97052f09388969427adf7df641cdcdc22kais}
c28749e97052f09388969427adf7df641cdcdc22kais
5cd9bd63ac79b9a1a6c7a09230426e181988d09akrishnastatic kstat_t *kssl_ksp = NULL;
5cd9bd63ac79b9a1a6c7a09230426e181988d09akrishna
c28749e97052f09388969427adf7df641cdcdc22kaisstatic int
c28749e97052f09388969427adf7df641cdcdc22kaiskssl_detach(dev_info_t *dip, ddi_detach_cmd_t cmd)
c28749e97052f09388969427adf7df641cdcdc22kais{
c28749e97052f09388969427adf7df641cdcdc22kais if (cmd != DDI_DETACH)
c28749e97052f09388969427adf7df641cdcdc22kais return (DDI_FAILURE);
c28749e97052f09388969427adf7df641cdcdc22kais
dd49f125507979bb2ab505a8daf2a46d1be27051Anders Persson if (kssl_entry_tab_nentries != 0)
c28749e97052f09388969427adf7df641cdcdc22kais return (DDI_FAILURE);
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais kssl_dip = NULL;
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais ddi_remove_minor_node(dip, NULL);
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais return (DDI_SUCCESS);
c28749e97052f09388969427adf7df641cdcdc22kais}
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais/* ARGSUSED */
c28749e97052f09388969427adf7df641cdcdc22kaisstatic int
c28749e97052f09388969427adf7df641cdcdc22kaiskssl_open(dev_t *devp, int flag, int otyp, cred_t *credp)
c28749e97052f09388969427adf7df641cdcdc22kais{
c28749e97052f09388969427adf7df641cdcdc22kais if (otyp != OTYP_CHR)
c28749e97052f09388969427adf7df641cdcdc22kais return (ENXIO);
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais if (kssl_dip == NULL)
c28749e97052f09388969427adf7df641cdcdc22kais return (ENXIO);
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais /* first time here? initialize everything */
c28749e97052f09388969427adf7df641cdcdc22kais if (rsa_x509_mech.cm_type == CRYPTO_MECH_INVALID) {
c28749e97052f09388969427adf7df641cdcdc22kais kssl_init_mechs();
c28749e97052f09388969427adf7df641cdcdc22kais prov_update_handle = crypto_notify_events(
c892ebf1bef94f4f922f282c11516677c134dbe0krishna kssl_event_callback, CRYPTO_EVENT_MECHS_CHANGED);
c28749e97052f09388969427adf7df641cdcdc22kais }
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais /* exclusive opens are not supported */
c28749e97052f09388969427adf7df641cdcdc22kais if (flag & FEXCL)
c28749e97052f09388969427adf7df641cdcdc22kais return (ENOTSUP);
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais return (0);
c28749e97052f09388969427adf7df641cdcdc22kais}
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais/* ARGSUSED */
c28749e97052f09388969427adf7df641cdcdc22kaisstatic int
c28749e97052f09388969427adf7df641cdcdc22kaiskssl_close(dev_t dev, int flag, int otyp, cred_t *credp)
c28749e97052f09388969427adf7df641cdcdc22kais{
c28749e97052f09388969427adf7df641cdcdc22kais return (0);
c28749e97052f09388969427adf7df641cdcdc22kais}
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais#define KSSL_MAX_KEYANDCERTS 80000 /* max 64K plus a little margin */
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais/* ARGSUSED */
c28749e97052f09388969427adf7df641cdcdc22kaisstatic int
c28749e97052f09388969427adf7df641cdcdc22kaiskssl_ioctl(dev_t dev, int cmd, intptr_t arg, int mode, cred_t *c,
c28749e97052f09388969427adf7df641cdcdc22kais int *rval)
c28749e97052f09388969427adf7df641cdcdc22kais{
c28749e97052f09388969427adf7df641cdcdc22kais int error = EINVAL;
005d3feb53a9a10272d4a24b03991575d6a9bcb3Marek Pospisil uint32_t auditing = AU_AUDITING();
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais#define ARG ((caddr_t)arg)
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais if (secpolicy_net_config(c, B_FALSE) != 0) {
c28749e97052f09388969427adf7df641cdcdc22kais return (EPERM);
c28749e97052f09388969427adf7df641cdcdc22kais }
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais switch (cmd) {
c28749e97052f09388969427adf7df641cdcdc22kais case KSSL_ADD_ENTRY: {
c28749e97052f09388969427adf7df641cdcdc22kais uint64_t len;
c892ebf1bef94f4f922f282c11516677c134dbe0krishna uint32_t ck_rv;
c892ebf1bef94f4f922f282c11516677c134dbe0krishna size_t off;
c892ebf1bef94f4f922f282c11516677c134dbe0krishna kssl_params_t *kssl_params;
c28749e97052f09388969427adf7df641cdcdc22kais
c892ebf1bef94f4f922f282c11516677c134dbe0krishna off = offsetof(kssl_params_t, kssl_params_size);
c892ebf1bef94f4f922f282c11516677c134dbe0krishna if (copyin(ARG + off, &len, sizeof (len)) != 0) {
c28749e97052f09388969427adf7df641cdcdc22kais return (EFAULT);
c28749e97052f09388969427adf7df641cdcdc22kais }
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais if (len < sizeof (kssl_params_t) ||
c28749e97052f09388969427adf7df641cdcdc22kais len > KSSL_MAX_KEYANDCERTS) {
c28749e97052f09388969427adf7df641cdcdc22kais return (EINVAL);
c28749e97052f09388969427adf7df641cdcdc22kais }
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais kssl_params = kmem_alloc(len, KM_SLEEP);
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais /* Get the whole structure and parameters in one move */
c28749e97052f09388969427adf7df641cdcdc22kais if (copyin(ARG, kssl_params, len) != 0) {
c28749e97052f09388969427adf7df641cdcdc22kais kmem_free(kssl_params, len);
c28749e97052f09388969427adf7df641cdcdc22kais return (EFAULT);
c28749e97052f09388969427adf7df641cdcdc22kais }
c28749e97052f09388969427adf7df641cdcdc22kais error = kssl_add_entry(kssl_params);
005d3feb53a9a10272d4a24b03991575d6a9bcb3Marek Pospisil if (auditing)
c28749e97052f09388969427adf7df641cdcdc22kais audit_kssl(KSSL_ADD_ENTRY, kssl_params, error);
c892ebf1bef94f4f922f282c11516677c134dbe0krishna off = offsetof(kssl_params_t, kssl_token) +
c892ebf1bef94f4f922f282c11516677c134dbe0krishna offsetof(kssl_tokinfo_t, ck_rv);
c892ebf1bef94f4f922f282c11516677c134dbe0krishna ck_rv = kssl_params->kssl_token.ck_rv;
c892ebf1bef94f4f922f282c11516677c134dbe0krishna if (copyout(&ck_rv, ARG + off, sizeof (ck_rv)) != 0) {
c892ebf1bef94f4f922f282c11516677c134dbe0krishna error = EFAULT;
c892ebf1bef94f4f922f282c11516677c134dbe0krishna }
c892ebf1bef94f4f922f282c11516677c134dbe0krishna
c892ebf1bef94f4f922f282c11516677c134dbe0krishna bzero(kssl_params, len);
c28749e97052f09388969427adf7df641cdcdc22kais kmem_free(kssl_params, len);
c28749e97052f09388969427adf7df641cdcdc22kais break;
c28749e97052f09388969427adf7df641cdcdc22kais }
c28749e97052f09388969427adf7df641cdcdc22kais case KSSL_DELETE_ENTRY: {
2ec7cc7fc084163eaed884efee9bbd322cc8951bKrishna Yenduri struct sockaddr_in6 server_addr;
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais if (copyin(ARG, &server_addr, sizeof (server_addr)) != 0) {
c28749e97052f09388969427adf7df641cdcdc22kais return (EFAULT);
c28749e97052f09388969427adf7df641cdcdc22kais }
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais error = kssl_delete_entry(&server_addr);
005d3feb53a9a10272d4a24b03991575d6a9bcb3Marek Pospisil if (auditing)
c28749e97052f09388969427adf7df641cdcdc22kais audit_kssl(KSSL_DELETE_ENTRY, &server_addr, error);
c28749e97052f09388969427adf7df641cdcdc22kais break;
c28749e97052f09388969427adf7df641cdcdc22kais }
c28749e97052f09388969427adf7df641cdcdc22kais }
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais return (error);
c28749e97052f09388969427adf7df641cdcdc22kais}
c28749e97052f09388969427adf7df641cdcdc22kais
2bd70d4be73561631df9cb3d9eb4c65fa94fa665krishna#define NUM_MECHS 7
2ec7cc7fc084163eaed884efee9bbd322cc8951bKrishna Yenduristatic mech_to_cipher_t mech_to_cipher_tab[NUM_MECHS] = {
c28749e97052f09388969427adf7df641cdcdc22kais {CRYPTO_MECH_INVALID, SUN_CKM_RSA_X_509,
c28749e97052f09388969427adf7df641cdcdc22kais {SSL_RSA_WITH_RC4_128_MD5, SSL_RSA_WITH_RC4_128_SHA,
c28749e97052f09388969427adf7df641cdcdc22kais SSL_RSA_WITH_DES_CBC_SHA, SSL_RSA_WITH_3DES_EDE_CBC_SHA,
2bd70d4be73561631df9cb3d9eb4c65fa94fa665krishna TLS_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_256_CBC_SHA,
c28749e97052f09388969427adf7df641cdcdc22kais SSL_RSA_WITH_NULL_SHA}},
c28749e97052f09388969427adf7df641cdcdc22kais {CRYPTO_MECH_INVALID, SUN_CKM_MD5_HMAC, {SSL_RSA_WITH_RC4_128_MD5}},
c28749e97052f09388969427adf7df641cdcdc22kais {CRYPTO_MECH_INVALID, SUN_CKM_SHA1_HMAC,
c28749e97052f09388969427adf7df641cdcdc22kais {SSL_RSA_WITH_RC4_128_SHA, SSL_RSA_WITH_DES_CBC_SHA,
2bd70d4be73561631df9cb3d9eb4c65fa94fa665krishna SSL_RSA_WITH_3DES_EDE_CBC_SHA, SSL_RSA_WITH_NULL_SHA,
2bd70d4be73561631df9cb3d9eb4c65fa94fa665krishna TLS_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_256_CBC_SHA}},
c28749e97052f09388969427adf7df641cdcdc22kais {CRYPTO_MECH_INVALID, SUN_CKM_RC4,
c28749e97052f09388969427adf7df641cdcdc22kais {SSL_RSA_WITH_RC4_128_MD5, SSL_RSA_WITH_RC4_128_SHA}},
c28749e97052f09388969427adf7df641cdcdc22kais {CRYPTO_MECH_INVALID, SUN_CKM_DES_CBC, {SSL_RSA_WITH_DES_CBC_SHA}},
c28749e97052f09388969427adf7df641cdcdc22kais {CRYPTO_MECH_INVALID, SUN_CKM_DES3_CBC,
2bd70d4be73561631df9cb3d9eb4c65fa94fa665krishna {SSL_RSA_WITH_3DES_EDE_CBC_SHA}},
2bd70d4be73561631df9cb3d9eb4c65fa94fa665krishna {CRYPTO_MECH_INVALID, SUN_CKM_AES_CBC,
2bd70d4be73561631df9cb3d9eb4c65fa94fa665krishna {TLS_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_256_CBC_SHA}},
c28749e97052f09388969427adf7df641cdcdc22kais};
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kaisstatic void
c28749e97052f09388969427adf7df641cdcdc22kaiskssl_init_mechs()
c28749e97052f09388969427adf7df641cdcdc22kais{
c28749e97052f09388969427adf7df641cdcdc22kais mech_to_cipher_tab[0].mech = rsa_x509_mech.cm_type =
c28749e97052f09388969427adf7df641cdcdc22kais crypto_mech2id(SUN_CKM_RSA_X_509);
c28749e97052f09388969427adf7df641cdcdc22kais mech_to_cipher_tab[1].mech = hmac_md5_mech.cm_type =
c28749e97052f09388969427adf7df641cdcdc22kais crypto_mech2id(SUN_CKM_MD5_HMAC);
c28749e97052f09388969427adf7df641cdcdc22kais mech_to_cipher_tab[2].mech = hmac_sha1_mech.cm_type =
c28749e97052f09388969427adf7df641cdcdc22kais crypto_mech2id(SUN_CKM_SHA1_HMAC);
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais mech_to_cipher_tab[3].mech = cipher_defs[cipher_rc4].mech_type =
c28749e97052f09388969427adf7df641cdcdc22kais crypto_mech2id(SUN_CKM_RC4);
c28749e97052f09388969427adf7df641cdcdc22kais mech_to_cipher_tab[4].mech = cipher_defs[cipher_des].mech_type =
c28749e97052f09388969427adf7df641cdcdc22kais crypto_mech2id(SUN_CKM_DES_CBC);
c28749e97052f09388969427adf7df641cdcdc22kais mech_to_cipher_tab[5].mech = cipher_defs[cipher_3des].mech_type =
c28749e97052f09388969427adf7df641cdcdc22kais crypto_mech2id(SUN_CKM_DES3_CBC);
2bd70d4be73561631df9cb3d9eb4c65fa94fa665krishna mech_to_cipher_tab[6].mech = cipher_defs[cipher_aes128].mech_type =
2bd70d4be73561631df9cb3d9eb4c65fa94fa665krishna cipher_defs[cipher_aes256].mech_type =
2bd70d4be73561631df9cb3d9eb4c65fa94fa665krishna crypto_mech2id(SUN_CKM_AES_CBC);
c28749e97052f09388969427adf7df641cdcdc22kais}
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kaisstatic int
c28749e97052f09388969427adf7df641cdcdc22kaisis_in_suites(uint16_t s, uint16_t *sarray)
c28749e97052f09388969427adf7df641cdcdc22kais{
c28749e97052f09388969427adf7df641cdcdc22kais int i;
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais for (i = 0; i < CIPHER_SUITE_COUNT; i++) {
c28749e97052f09388969427adf7df641cdcdc22kais if (s == sarray[i])
c28749e97052f09388969427adf7df641cdcdc22kais return (1);
c28749e97052f09388969427adf7df641cdcdc22kais }
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais return (0);
c28749e97052f09388969427adf7df641cdcdc22kais}
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kaisstatic int
c28749e97052f09388969427adf7df641cdcdc22kaisis_in_mechlist(char *name, crypto_mech_name_t *mechs, int count)
c28749e97052f09388969427adf7df641cdcdc22kais{
c28749e97052f09388969427adf7df641cdcdc22kais int i;
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais for (i = 0; i < count; i++) {
c28749e97052f09388969427adf7df641cdcdc22kais if (strncmp(name, mechs[i], CRYPTO_MAX_MECH_NAME) == 0)
c28749e97052f09388969427adf7df641cdcdc22kais return (1);
c28749e97052f09388969427adf7df641cdcdc22kais }
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais return (0);
c28749e97052f09388969427adf7df641cdcdc22kais}
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais/*
c28749e97052f09388969427adf7df641cdcdc22kais * Callback function invoked by the crypto framework when a provider's
c28749e97052f09388969427adf7df641cdcdc22kais * mechanism is available/unavailable. This callback updates entries in the
c28749e97052f09388969427adf7df641cdcdc22kais * kssl_entry_tab[] to make changes to the cipher suites of an entry
2ec7cc7fc084163eaed884efee9bbd322cc8951bKrishna Yenduri * which are affected by the mechanism.
c28749e97052f09388969427adf7df641cdcdc22kais */
c28749e97052f09388969427adf7df641cdcdc22kaisstatic void
c28749e97052f09388969427adf7df641cdcdc22kaiskssl_event_callback(uint32_t event, void *event_arg)
c28749e97052f09388969427adf7df641cdcdc22kais{
c28749e97052f09388969427adf7df641cdcdc22kais int i, j;
c28749e97052f09388969427adf7df641cdcdc22kais int cnt, rcnt;
c28749e97052f09388969427adf7df641cdcdc22kais uint16_t s;
c28749e97052f09388969427adf7df641cdcdc22kais boolean_t changed;
c28749e97052f09388969427adf7df641cdcdc22kais crypto_mech_name_t *mechs;
c28749e97052f09388969427adf7df641cdcdc22kais uint_t mech_count;
c28749e97052f09388969427adf7df641cdcdc22kais mech_to_cipher_t *mc;
c28749e97052f09388969427adf7df641cdcdc22kais kssl_entry_t *old;
c28749e97052f09388969427adf7df641cdcdc22kais kssl_entry_t *new;
c28749e97052f09388969427adf7df641cdcdc22kais uint16_t tmp_suites[CIPHER_SUITE_COUNT];
c28749e97052f09388969427adf7df641cdcdc22kais uint16_t dis_list[CIPHER_SUITE_COUNT];
c28749e97052f09388969427adf7df641cdcdc22kais crypto_notify_event_change_t *prov_change =
c28749e97052f09388969427adf7df641cdcdc22kais (crypto_notify_event_change_t *)event_arg;
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais /* ignore events for which we didn't register */
c892ebf1bef94f4f922f282c11516677c134dbe0krishna if (event != CRYPTO_EVENT_MECHS_CHANGED) {
c28749e97052f09388969427adf7df641cdcdc22kais return;
c28749e97052f09388969427adf7df641cdcdc22kais }
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais for (i = 0; i < NUM_MECHS; i++) {
c28749e97052f09388969427adf7df641cdcdc22kais mc = &(mech_to_cipher_tab[i]);
c28749e97052f09388969427adf7df641cdcdc22kais if (mc->mech == CRYPTO_MECH_INVALID)
c28749e97052f09388969427adf7df641cdcdc22kais continue;
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais /*
c28749e97052f09388969427adf7df641cdcdc22kais * Check if this crypto framework provider mechanism being
c28749e97052f09388969427adf7df641cdcdc22kais * added or removed affects us.
c28749e97052f09388969427adf7df641cdcdc22kais */
c28749e97052f09388969427adf7df641cdcdc22kais if (strncmp(mc->name, prov_change->ec_mech_name,
c28749e97052f09388969427adf7df641cdcdc22kais CRYPTO_MAX_MECH_NAME) == 0)
c28749e97052f09388969427adf7df641cdcdc22kais break;
c28749e97052f09388969427adf7df641cdcdc22kais }
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais if (i == NUM_MECHS)
c28749e97052f09388969427adf7df641cdcdc22kais return;
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais mechs = crypto_get_mech_list(&mech_count, KM_SLEEP);
c28749e97052f09388969427adf7df641cdcdc22kais if (mechs == NULL)
c28749e97052f09388969427adf7df641cdcdc22kais return;
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais mutex_enter(&kssl_tab_mutex);
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais for (i = 0; i < kssl_entry_tab_size; i++) {
c28749e97052f09388969427adf7df641cdcdc22kais if ((old = kssl_entry_tab[i]) == NULL)
c28749e97052f09388969427adf7df641cdcdc22kais continue;
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais cnt = 0;
c28749e97052f09388969427adf7df641cdcdc22kais rcnt = 0;
c28749e97052f09388969427adf7df641cdcdc22kais changed = B_FALSE;
c28749e97052f09388969427adf7df641cdcdc22kais for (j = 0; j < CIPHER_SUITE_COUNT; j++) {
c28749e97052f09388969427adf7df641cdcdc22kais tmp_suites[j] = CIPHER_NOTSET;
c28749e97052f09388969427adf7df641cdcdc22kais dis_list[j] = CIPHER_NOTSET;
c28749e97052f09388969427adf7df641cdcdc22kais }
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais /*
c28749e97052f09388969427adf7df641cdcdc22kais * We start with the saved cipher suite list for the new entry.
c28749e97052f09388969427adf7df641cdcdc22kais * If a mechanism is disabled, resulting in a cipher suite being
c28749e97052f09388969427adf7df641cdcdc22kais * disabled now, we take it out from the list for the new entry.
c28749e97052f09388969427adf7df641cdcdc22kais * If a mechanism is enabled, resulting in a cipher suite being
c28749e97052f09388969427adf7df641cdcdc22kais * enabled now, we don't need to do any thing.
c28749e97052f09388969427adf7df641cdcdc22kais */
c28749e97052f09388969427adf7df641cdcdc22kais if (!is_in_mechlist(mc->name, mechs, mech_count)) {
c28749e97052f09388969427adf7df641cdcdc22kais for (j = 0; j < CIPHER_SUITE_COUNT; j++) {
c28749e97052f09388969427adf7df641cdcdc22kais s = mc->kssl_suites[j];
c28749e97052f09388969427adf7df641cdcdc22kais if (s == 0)
c28749e97052f09388969427adf7df641cdcdc22kais break;
c28749e97052f09388969427adf7df641cdcdc22kais if (is_in_suites(s, old->kssl_saved_Suites)) {
c28749e97052f09388969427adf7df641cdcdc22kais /* Disable this cipher suite */
c28749e97052f09388969427adf7df641cdcdc22kais if (!is_in_suites(s, dis_list))
c28749e97052f09388969427adf7df641cdcdc22kais dis_list[cnt++] = s;
c28749e97052f09388969427adf7df641cdcdc22kais }
c28749e97052f09388969427adf7df641cdcdc22kais }
c28749e97052f09388969427adf7df641cdcdc22kais }
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais for (j = 0; j < CIPHER_SUITE_COUNT; j++) {
c28749e97052f09388969427adf7df641cdcdc22kais s = old->kssl_saved_Suites[j];
c28749e97052f09388969427adf7df641cdcdc22kais if (!is_in_suites(s, dis_list))
c28749e97052f09388969427adf7df641cdcdc22kais tmp_suites[rcnt] = s;
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais if (!changed &&
c28749e97052f09388969427adf7df641cdcdc22kais (tmp_suites[rcnt] != old->kssl_cipherSuites[rcnt]))
c28749e97052f09388969427adf7df641cdcdc22kais changed = B_TRUE;
c28749e97052f09388969427adf7df641cdcdc22kais rcnt++;
c28749e97052f09388969427adf7df641cdcdc22kais }
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais if (changed) {
c28749e97052f09388969427adf7df641cdcdc22kais new = kmem_zalloc(sizeof (kssl_entry_t), KM_NOSLEEP);
c28749e97052f09388969427adf7df641cdcdc22kais if (new == NULL)
c28749e97052f09388969427adf7df641cdcdc22kais continue;
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais *new = *old; /* Structure copy */
c28749e97052f09388969427adf7df641cdcdc22kais old->ke_no_freeall = B_TRUE;
c28749e97052f09388969427adf7df641cdcdc22kais new->ke_refcnt = 0;
c28749e97052f09388969427adf7df641cdcdc22kais new->kssl_cipherSuites_nentries = rcnt;
c28749e97052f09388969427adf7df641cdcdc22kais for (j = 0; j < CIPHER_SUITE_COUNT; j++)
c28749e97052f09388969427adf7df641cdcdc22kais new->kssl_cipherSuites[j] = tmp_suites[j];
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais KSSL_ENTRY_REFHOLD(new);
c28749e97052f09388969427adf7df641cdcdc22kais kssl_entry_tab[i] = new;
c28749e97052f09388969427adf7df641cdcdc22kais KSSL_ENTRY_REFRELE(old);
c28749e97052f09388969427adf7df641cdcdc22kais }
c28749e97052f09388969427adf7df641cdcdc22kais }
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais mutex_exit(&kssl_tab_mutex);
c28749e97052f09388969427adf7df641cdcdc22kais crypto_free_mech_list(mechs, mech_count);
c28749e97052f09388969427adf7df641cdcdc22kais}
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kaiskssl_stats_t *kssl_statp;
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kaisstatic void
c28749e97052f09388969427adf7df641cdcdc22kaiskssl_global_init()
c28749e97052f09388969427adf7df641cdcdc22kais{
c28749e97052f09388969427adf7df641cdcdc22kais mutex_init(&kssl_tab_mutex, NULL, MUTEX_DRIVER, NULL);
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais kssl_cache = kmem_cache_create("kssl_cache", sizeof (ssl_t),
c28749e97052f09388969427adf7df641cdcdc22kais 0, kssl_constructor, kssl_destructor, NULL, NULL, NULL, 0);
c28749e97052f09388969427adf7df641cdcdc22kais
5cd9bd63ac79b9a1a6c7a09230426e181988d09akrishna if ((kssl_ksp = kstat_create("kssl", 0, "kssl_stats", "crypto",
c28749e97052f09388969427adf7df641cdcdc22kais KSTAT_TYPE_NAMED, sizeof (kssl_stats_t) / sizeof (kstat_named_t),
c28749e97052f09388969427adf7df641cdcdc22kais KSTAT_FLAG_PERSISTENT)) != NULL) {
5cd9bd63ac79b9a1a6c7a09230426e181988d09akrishna kssl_statp = kssl_ksp->ks_data;
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais kstat_named_init(&kssl_statp->sid_cache_lookups,
c28749e97052f09388969427adf7df641cdcdc22kais "kssl_sid_cache_lookups", KSTAT_DATA_UINT64);
c28749e97052f09388969427adf7df641cdcdc22kais kstat_named_init(&kssl_statp->sid_cache_hits,
c28749e97052f09388969427adf7df641cdcdc22kais "kssl_sid_cache_hits", KSTAT_DATA_UINT64);
2ec7cc7fc084163eaed884efee9bbd322cc8951bKrishna Yenduri kstat_named_init(&kssl_statp->sid_cached,
2ec7cc7fc084163eaed884efee9bbd322cc8951bKrishna Yenduri "kssl_sid_cached", KSTAT_DATA_UINT64);
c28749e97052f09388969427adf7df641cdcdc22kais kstat_named_init(&kssl_statp->sid_uncached,
c28749e97052f09388969427adf7df641cdcdc22kais "kssl_sid_uncached", KSTAT_DATA_UINT64);
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais kstat_named_init(&kssl_statp->full_handshakes,
c28749e97052f09388969427adf7df641cdcdc22kais "kssl_full_handshakes", KSTAT_DATA_UINT64);
c28749e97052f09388969427adf7df641cdcdc22kais kstat_named_init(&kssl_statp->resumed_sessions,
c28749e97052f09388969427adf7df641cdcdc22kais "kssl_resumed_sessions", KSTAT_DATA_UINT64);
c28749e97052f09388969427adf7df641cdcdc22kais kstat_named_init(&kssl_statp->fallback_connections,
c28749e97052f09388969427adf7df641cdcdc22kais "kssl_fallback_connections", KSTAT_DATA_UINT64);
c28749e97052f09388969427adf7df641cdcdc22kais kstat_named_init(&kssl_statp->proxy_fallback_failed,
c28749e97052f09388969427adf7df641cdcdc22kais "kssl_proxy_fallback_failed", KSTAT_DATA_UINT64);
c28749e97052f09388969427adf7df641cdcdc22kais kstat_named_init(&kssl_statp->appdata_record_ins,
c28749e97052f09388969427adf7df641cdcdc22kais "kssl_appdata_record_ins", KSTAT_DATA_UINT64);
c28749e97052f09388969427adf7df641cdcdc22kais kstat_named_init(&kssl_statp->appdata_record_outs,
c28749e97052f09388969427adf7df641cdcdc22kais "kssl_appdata_record_outs", KSTAT_DATA_UINT64);
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais kstat_named_init(&kssl_statp->alloc_fails, "kssl_alloc_fails",
c28749e97052f09388969427adf7df641cdcdc22kais KSTAT_DATA_UINT64);
c28749e97052f09388969427adf7df641cdcdc22kais kstat_named_init(&kssl_statp->fatal_alerts,
c28749e97052f09388969427adf7df641cdcdc22kais "kssl_fatal_alerts", KSTAT_DATA_UINT64);
c28749e97052f09388969427adf7df641cdcdc22kais kstat_named_init(&kssl_statp->warning_alerts,
c28749e97052f09388969427adf7df641cdcdc22kais "kssl_warning_alerts", KSTAT_DATA_UINT64);
c28749e97052f09388969427adf7df641cdcdc22kais kstat_named_init(&kssl_statp->no_suite_found,
c28749e97052f09388969427adf7df641cdcdc22kais "kssl_no_suite_found", KSTAT_DATA_UINT64);
c28749e97052f09388969427adf7df641cdcdc22kais kstat_named_init(&kssl_statp->compute_mac_failure,
c28749e97052f09388969427adf7df641cdcdc22kais "kssl_compute_mac_failure", KSTAT_DATA_UINT64);
c28749e97052f09388969427adf7df641cdcdc22kais kstat_named_init(&kssl_statp->verify_mac_failure,
c28749e97052f09388969427adf7df641cdcdc22kais "kssl_verify_mac_failure", KSTAT_DATA_UINT64);
c28749e97052f09388969427adf7df641cdcdc22kais kstat_named_init(&kssl_statp->record_decrypt_failure,
c28749e97052f09388969427adf7df641cdcdc22kais "kssl_record_decrypt_failure", KSTAT_DATA_UINT64);
c28749e97052f09388969427adf7df641cdcdc22kais kstat_named_init(&kssl_statp->bad_pre_master_secret,
c28749e97052f09388969427adf7df641cdcdc22kais "kssl_bad_pre_master_secret", KSTAT_DATA_UINT64);
847061414af83968a5942c9af9d73f6a44e43402vk kstat_named_init(&kssl_statp->internal_errors,
847061414af83968a5942c9af9d73f6a44e43402vk "kssl_internal_errors", KSTAT_DATA_UINT64);
c28749e97052f09388969427adf7df641cdcdc22kais
5cd9bd63ac79b9a1a6c7a09230426e181988d09akrishna kstat_install(kssl_ksp);
c28749e97052f09388969427adf7df641cdcdc22kais };
c28749e97052f09388969427adf7df641cdcdc22kais}
c28749e97052f09388969427adf7df641cdcdc22kais
dd49f125507979bb2ab505a8daf2a46d1be27051Anders Perssonstatic void
dd49f125507979bb2ab505a8daf2a46d1be27051Anders Perssonkssl_global_fini(void)
dd49f125507979bb2ab505a8daf2a46d1be27051Anders Persson{
dd49f125507979bb2ab505a8daf2a46d1be27051Anders Persson mutex_destroy(&kssl_tab_mutex);
dd49f125507979bb2ab505a8daf2a46d1be27051Anders Persson
dd49f125507979bb2ab505a8daf2a46d1be27051Anders Persson if (kssl_cache != NULL) {
dd49f125507979bb2ab505a8daf2a46d1be27051Anders Persson kmem_cache_destroy(kssl_cache);
dd49f125507979bb2ab505a8daf2a46d1be27051Anders Persson kssl_cache = NULL;
dd49f125507979bb2ab505a8daf2a46d1be27051Anders Persson }
dd49f125507979bb2ab505a8daf2a46d1be27051Anders Persson
dd49f125507979bb2ab505a8daf2a46d1be27051Anders Persson if (kssl_ksp != NULL) {
dd49f125507979bb2ab505a8daf2a46d1be27051Anders Persson kstat_delete(kssl_ksp);
dd49f125507979bb2ab505a8daf2a46d1be27051Anders Persson kssl_ksp = NULL;
dd49f125507979bb2ab505a8daf2a46d1be27051Anders Persson }
dd49f125507979bb2ab505a8daf2a46d1be27051Anders Persson}
dd49f125507979bb2ab505a8daf2a46d1be27051Anders Persson
c28749e97052f09388969427adf7df641cdcdc22kais/*ARGSUSED*/
c28749e97052f09388969427adf7df641cdcdc22kaisstatic int
c28749e97052f09388969427adf7df641cdcdc22kaiskssl_constructor(void *buf, void *arg, int kmflags)
c28749e97052f09388969427adf7df641cdcdc22kais{
c28749e97052f09388969427adf7df641cdcdc22kais ssl_t *ssl = buf;
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais mutex_init(&ssl->kssl_lock, NULL, MUTEX_DEFAULT, NULL);
dd49f125507979bb2ab505a8daf2a46d1be27051Anders Persson cv_init(&ssl->async_cv, NULL, CV_DEFAULT, NULL);
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais return (0);
c28749e97052f09388969427adf7df641cdcdc22kais}
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais/*ARGSUSED*/
c28749e97052f09388969427adf7df641cdcdc22kaisstatic void
c28749e97052f09388969427adf7df641cdcdc22kaiskssl_destructor(void *buf, void *arg)
c28749e97052f09388969427adf7df641cdcdc22kais{
c28749e97052f09388969427adf7df641cdcdc22kais ssl_t *ssl = buf;
c28749e97052f09388969427adf7df641cdcdc22kais mutex_destroy(&ssl->kssl_lock);
dd49f125507979bb2ab505a8daf2a46d1be27051Anders Persson cv_destroy(&ssl->async_cv);
c28749e97052f09388969427adf7df641cdcdc22kais}
c892ebf1bef94f4f922f282c11516677c134dbe0krishna
c892ebf1bef94f4f922f282c11516677c134dbe0krishna/*
c892ebf1bef94f4f922f282c11516677c134dbe0krishna * Handler routine called by the crypto framework when a
c892ebf1bef94f4f922f282c11516677c134dbe0krishna * provider is unregistered or registered. We invalidate the
c892ebf1bef94f4f922f282c11516677c134dbe0krishna * private key handle if our provider is unregistered. We set
c892ebf1bef94f4f922f282c11516677c134dbe0krishna * a flag to reauthenticate if our provider came back.
c892ebf1bef94f4f922f282c11516677c134dbe0krishna */
c892ebf1bef94f4f922f282c11516677c134dbe0krishnavoid
c892ebf1bef94f4f922f282c11516677c134dbe0krishnakssl_prov_evnt(uint32_t event, void *event_arg)
c892ebf1bef94f4f922f282c11516677c134dbe0krishna{
c892ebf1bef94f4f922f282c11516677c134dbe0krishna int i, rv;
c892ebf1bef94f4f922f282c11516677c134dbe0krishna kssl_entry_t *ep;
c892ebf1bef94f4f922f282c11516677c134dbe0krishna kssl_session_info_t *s;
c892ebf1bef94f4f922f282c11516677c134dbe0krishna crypto_provider_t prov;
c892ebf1bef94f4f922f282c11516677c134dbe0krishna crypto_provider_ext_info_t info;
c892ebf1bef94f4f922f282c11516677c134dbe0krishna
c892ebf1bef94f4f922f282c11516677c134dbe0krishna if (event != CRYPTO_EVENT_PROVIDER_UNREGISTERED &&
c892ebf1bef94f4f922f282c11516677c134dbe0krishna event != CRYPTO_EVENT_PROVIDER_REGISTERED)
c892ebf1bef94f4f922f282c11516677c134dbe0krishna return;
c892ebf1bef94f4f922f282c11516677c134dbe0krishna
c892ebf1bef94f4f922f282c11516677c134dbe0krishna prov = (crypto_provider_t)event_arg;
c892ebf1bef94f4f922f282c11516677c134dbe0krishna if (event == CRYPTO_EVENT_PROVIDER_REGISTERED) {
c892ebf1bef94f4f922f282c11516677c134dbe0krishna rv = crypto_get_provinfo(prov, &info);
c892ebf1bef94f4f922f282c11516677c134dbe0krishna if (rv != CRYPTO_SUCCESS)
c892ebf1bef94f4f922f282c11516677c134dbe0krishna return;
c892ebf1bef94f4f922f282c11516677c134dbe0krishna }
c892ebf1bef94f4f922f282c11516677c134dbe0krishna
c892ebf1bef94f4f922f282c11516677c134dbe0krishna mutex_enter(&kssl_tab_mutex);
c892ebf1bef94f4f922f282c11516677c134dbe0krishna
c892ebf1bef94f4f922f282c11516677c134dbe0krishna for (i = 0; i < kssl_entry_tab_size; i++) {
c892ebf1bef94f4f922f282c11516677c134dbe0krishna if ((ep = kssl_entry_tab[i]) == NULL)
c892ebf1bef94f4f922f282c11516677c134dbe0krishna continue;
c892ebf1bef94f4f922f282c11516677c134dbe0krishna
c892ebf1bef94f4f922f282c11516677c134dbe0krishna s = ep->ke_sessinfo;
51dd2c77f06e5663c28bd4f7a760cae4cf159e79vk DTRACE_PROBE1(kssl_entry_cycle, kssl_entry_t *, ep);
c892ebf1bef94f4f922f282c11516677c134dbe0krishna switch (event) {
c892ebf1bef94f4f922f282c11516677c134dbe0krishna case CRYPTO_EVENT_PROVIDER_UNREGISTERED:
c892ebf1bef94f4f922f282c11516677c134dbe0krishna if (s->is_valid_handle && s->prov == prov) {
c892ebf1bef94f4f922f282c11516677c134dbe0krishna s->is_valid_handle = B_FALSE;
c892ebf1bef94f4f922f282c11516677c134dbe0krishna crypto_release_provider(s->prov);
c892ebf1bef94f4f922f282c11516677c134dbe0krishna }
c892ebf1bef94f4f922f282c11516677c134dbe0krishna break;
c892ebf1bef94f4f922f282c11516677c134dbe0krishna
c892ebf1bef94f4f922f282c11516677c134dbe0krishna case CRYPTO_EVENT_PROVIDER_REGISTERED:
c892ebf1bef94f4f922f282c11516677c134dbe0krishna if (s->is_valid_handle)
c892ebf1bef94f4f922f282c11516677c134dbe0krishna break;
c892ebf1bef94f4f922f282c11516677c134dbe0krishna if (bcmp(s->toklabel, info.ei_label,
c892ebf1bef94f4f922f282c11516677c134dbe0krishna CRYPTO_EXT_SIZE_LABEL) == 0) {
c892ebf1bef94f4f922f282c11516677c134dbe0krishna s->do_reauth = B_TRUE;
c892ebf1bef94f4f922f282c11516677c134dbe0krishna }
c892ebf1bef94f4f922f282c11516677c134dbe0krishna break;
c892ebf1bef94f4f922f282c11516677c134dbe0krishna }
c892ebf1bef94f4f922f282c11516677c134dbe0krishna }
c892ebf1bef94f4f922f282c11516677c134dbe0krishna
c892ebf1bef94f4f922f282c11516677c134dbe0krishna mutex_exit(&kssl_tab_mutex);
c892ebf1bef94f4f922f282c11516677c134dbe0krishna}