8322 nl: misleading-indentation

[unleashed/tickless.git] / usr / src / uts / common / inet / kssl / ksslapi.c

/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
 */

#include <sys/types.h>
#include <sys/stream.h>
#include <sys/strsun.h>
#include <sys/kmem.h>
#include <sys/cpuvar.h>
#include <sys/atomic.h>
#include <sys/sysmacros.h>

#include <inet/common.h>
#include <inet/ip.h>

#include <sys/systm.h>
#include <sys/param.h>
#include <sys/tihdr.h>

#include "ksslimpl.h"
#include "ksslproto.h"
#include "ksslapi.h"

static kssl_cmd_t kssl_handle_any_record(kssl_ctx_t ctx, mblk_t *mp,
    mblk_t **decrmp, kssl_callback_t cbfn, void *arg);
static boolean_t kssl_enqueue(kssl_chain_t **head, void *item);
static void kssl_dequeue(kssl_chain_t **head, void *item);
static kssl_status_t kssl_build_single_record(ssl_t *ssl, mblk_t *mp);

/*
 * The socket bind request is intercepted and re-routed here
 * to see is there is SSL relevant job to do, based on the kssl config
 * in the kssl_entry_tab.
 * Looks up the kernel SSL proxy table, to find an entry that matches the
 * same serveraddr, and has one of the following two criteria:
 * 1. in_port is an ssl_port. This endpoint can be used later as a fallback
 *    to complete connections that cannot be handled by the SSL kernel proxy
 *    (typically non supported ciphersuite). The cookie for the calling client
 *    is saved with the kssl_entry to be retrieved for the fallback.
 *    The function returns KSSL_HAS_PROXY.
 *
 * 2. in_port is a proxy port for another ssl port. The ssl port is then
 *    substituted to the in_port in the bind_req TPI structure, so that
 *    the bind falls through to the SSL port. At the end of this operation,
 *    all the packets arriving to the SSL port will be delivered to an
 *    accepted endpoint child of this bound socket.
 *    The  kssl_entry_t is returned in *ksslent, for later use by the
 *    lower modules' SSL hooks that handle the Handshake messages.
 *    The function returns KSSL_IS_PROXY.
 *
 * The function returns KSSL_NO_PROXY otherwise.
 */

kssl_endpt_type_t
kssl_check_proxy(struct sockaddr *addr, socklen_t len, void *cookie,
    kssl_ent_t *ksslent)
{
        int i;
        kssl_endpt_type_t ret;
        kssl_entry_t *ep;
        sin_t *sin;
        sin6_t *sin6;
        in6_addr_t mapped_v4addr;
        in6_addr_t *v6addr;
        in_port_t in_port;

        if (kssl_entry_tab_nentries == 0) {
                return (KSSL_NO_PROXY);
        }

        ret = KSSL_NO_PROXY;
        sin = (struct sockaddr_in *)addr;

        switch (len) {
        case sizeof (sin_t):
                in_port = ntohs(sin->sin_port);
                IN6_IPADDR_TO_V4MAPPED(sin->sin_addr.s_addr, &mapped_v4addr);
                v6addr = &mapped_v4addr;
                break;

        case sizeof (sin6_t):
                sin6 = (sin6_t *)sin;
                in_port = ntohs(sin6->sin6_port);
                v6addr = &sin6->sin6_addr;
                break;

        default:
                return (ret);
        }

        mutex_enter(&kssl_tab_mutex);

        for (i = 0; i < kssl_entry_tab_size; i++) {
                if ((ep = kssl_entry_tab[i]) == NULL)
                        continue;

                if (IN6_ARE_ADDR_EQUAL(&ep->ke_laddr, v6addr) ||
                    IN6_IS_ADDR_UNSPECIFIED(&ep->ke_laddr)) {

                        /* This is an SSL port to fallback to */
                        if (ep->ke_ssl_port == in_port) {

                                /*
                                 * Let's see first if there's at least
                                 * an endpoint for a proxy server.
                                 * If there's none, then we return as we have
                                 * no proxy, so that the bind() to the
                                 * transport layer goes through.
                                 * The calling module will ask for this
                                 * cookie if it wants to fall back to it,
                                 * so add this one to the list of fallback
                                 * clients.
                                 */
                                if (!kssl_enqueue((kssl_chain_t **)
                                    &(ep->ke_fallback_head), cookie)) {
                                        break;
                                }

                                KSSL_ENTRY_REFHOLD(ep);
                                *ksslent = (kssl_ent_t)ep;

                                ret = KSSL_HAS_PROXY;
                                break;
                        }

                        /* This is a proxy port. */
                        if (ep->ke_proxy_port == in_port) {
                                /* Add the caller's cookie to proxies list */

                                if (!kssl_enqueue((kssl_chain_t **)
                                    &(ep->ke_proxy_head), cookie)) {
                                        break;
                                }

                                /*
                                 * Make this look  like the SSL port to the
                                 * transport below
                                 */
                                sin->sin_port = htons(ep->ke_ssl_port);

                                KSSL_ENTRY_REFHOLD(ep);
                                *ksslent = (kssl_ent_t)ep;

                                ret = KSSL_IS_PROXY;
                                break;
                        }
                }
        }

        mutex_exit(&kssl_tab_mutex);
        return (ret);
}

/*
 * Retrieved an endpoint "bound" to the SSL entry.
 * Such endpoint has previously called kssl_check_proxy(), got itself
 * linked to the kssl_entry's ke_fallback_head list.
 * This routine returns the cookie from that SSL entry ke_fallback_head list.
 */
void *
kssl_find_fallback(kssl_ent_t ksslent)
{
        kssl_entry_t *kssl_entry = (kssl_entry_t *)ksslent;

        if (kssl_entry->ke_fallback_head != NULL)
                return (kssl_entry->ke_fallback_head->fallback_bound);

        KSSL_COUNTER(proxy_fallback_failed, 1);

        return (NULL);
}

/*
 * Re-usable code for adding and removing an element to/from a chain that
 * matches "item"
 * The chain is simple-linked and NULL ended.
 */

/*
 * This routine returns TRUE if the item was either successfully added to
 * the chain, or is already there. It returns FALSE otherwise.
 */
static boolean_t
kssl_enqueue(kssl_chain_t **head, void *item)
{
        kssl_chain_t *newchain, *cur;

        /* Lookup the existing entries to avoid duplicates */
        cur = *head;
        while (cur != NULL) {
                if (cur->item == item) {
                        return (B_TRUE);
                }
                cur = cur->next;
        }

        newchain = kmem_alloc(sizeof (kssl_chain_t), KM_NOSLEEP);
        if (newchain == NULL) {
                return (B_FALSE);
        }

        newchain->item = item;
        newchain->next = *head;
        *head = newchain;
        return (B_TRUE);
}

static void
kssl_dequeue(kssl_chain_t **head, void *item)
{
        kssl_chain_t *prev, *cur;

        prev = cur = *head;
        while (cur != NULL) {
                if (cur->item == item) {
                        if (cur == *head)
                                *head = (*head)->next;
                        else
                                prev->next = cur->next;
                        kmem_free(cur, sizeof (kssl_chain_t));
                        return;
                }
                prev = cur;
                cur = cur->next;
        }
}

/*
 * Holds the kssl_entry
 */
void
kssl_hold_ent(kssl_ent_t ksslent)
{
        KSSL_ENTRY_REFHOLD((kssl_entry_t *)ksslent);
}

/*
 * Releases the kssl_entry
 * If the caller passes a cookie, then it should be removed from both
 * proxies and fallbacks chains.
 */
void
kssl_release_ent(kssl_ent_t ksslent, void *cookie, kssl_endpt_type_t endpt_type)
{
        kssl_entry_t *kssl_entry = (kssl_entry_t *)ksslent;

        if (cookie != NULL) {
                if (endpt_type == KSSL_IS_PROXY) {
                        ASSERT(kssl_entry->ke_proxy_head != NULL);
                        kssl_dequeue(
                            (kssl_chain_t **)&kssl_entry->ke_proxy_head,
                            cookie);
                }
                if (endpt_type == KSSL_HAS_PROXY) {
                        ASSERT(kssl_entry->ke_fallback_head != NULL);
                        kssl_dequeue(
                            (kssl_chain_t **)&kssl_entry->ke_fallback_head,
                            cookie);
                }
        }
        KSSL_ENTRY_REFRELE(kssl_entry);
}

/*
 * Releases the kssl_context
 */
void
kssl_release_ctx(kssl_ctx_t ksslctx)
{
        kssl_free_context((ssl_t *)ksslctx);
}

/*
 * Done with asynchronous processing
 */
void
kssl_async_done(kssl_ctx_t ksslctx)
{
        ssl_t *ssl = (ssl_t *)ksslctx;

        mutex_enter(&ssl->kssl_lock);
        if (--ssl->async_ops_pending == 0)
                cv_signal(&ssl->async_cv);
        mutex_exit(&ssl->kssl_lock);
}

/*
 * Packets are accumulated here, if there are packets already queued,
 * or if the context is active.
 * The context is active when an incoming record processing function
 * is already executing on a different thread.
 * Queued packets are handled either when an mblk arrived and completes
 * a record, or, when the active context processor finishes the task at
 * hand.
 * The caller has to keep calling this routine in a loop until it returns
 * B_FALSE in *more. The reason for this is SSL3: The protocol
 * allows the client to send its first application_data message right
 * after it had sent its Finished message, and not wait for the server
 * ChangeCipherSpec and Finished. This overlap means we can't batch up
 * a returned Handshake message to be sent on the wire
 * with a decrypted application_data to be delivered to the application.
 */
kssl_cmd_t
kssl_input(kssl_ctx_t ctx, mblk_t *mp, mblk_t **decrmp, boolean_t *more,
    kssl_callback_t cbfn, void *arg)
{
        mblk_t *recmp, *outmp = NULL;
        kssl_cmd_t kssl_cmd;
        ssl_t *ssl;
        uint8_t *rec_sz_p;
        int mplen;
        SSL3ContentType content_type;
        uint16_t rec_sz;

        ASSERT(ctx != NULL);

        if (mp != NULL) {
                ASSERT(mp->b_prev == NULL && mp->b_next == NULL);
        }

        ssl = (ssl_t *)(ctx);

        *decrmp = NULL;
        *more = B_FALSE;

        mutex_enter(&ssl->kssl_lock);

        if (ssl->close_notify_clnt == B_TRUE) {
                DTRACE_PROBE(kssl_err__close_notify);
                goto sendnewalert;
        }

        /* Whomever is currently processing this connection will get to this */
        if (ssl->activeinput) {
                if (mp != NULL) {
                        KSSL_ENQUEUE_MP(ssl, mp);
                }
                mutex_exit(&ssl->kssl_lock);
                return (KSSL_CMD_NONE);
        }

        /*
         * Fast path for complete incoming application_data records on an empty
         * queue.
         * This is by far the most frequently encountered case
         */

        if ((!ssl->activeinput) && (ssl->rec_ass_head == NULL) &&
            ((mp != NULL) && (mplen = MBLKL(mp)) > SSL3_HDR_LEN)) {

                DTRACE_PROBE1(kssl_mblk__fast_path, mblk_t *, mp);
                content_type = (SSL3ContentType)mp->b_rptr[0];

                if ((content_type == content_application_data) &&
                    (ssl->hs_waitstate == idle_handshake)) {
                        rec_sz_p = SSL3_REC_SIZE(mp);
                        rec_sz = BE16_TO_U16(rec_sz_p);

                        if ((mp->b_cont == NULL) && (mplen == rec_sz)) {

                                *decrmp = mp;
                                mutex_exit(&ssl->kssl_lock);
                                return (KSSL_CMD_DELIVER_PROXY);
                        }
                }
        }

        ssl->activeinput = B_TRUE;
        /* Accumulate at least one record */
        if (mp != NULL) {
                KSSL_ENQUEUE_MP(ssl, mp);
                mp = NULL;
        }
        recmp = kssl_get_next_record(ssl);

        if (recmp == NULL) {
                ssl->activeinput = B_FALSE;
                if (ssl->alert_sendbuf != NULL) {
                        DTRACE_PROBE(kssl_err__alert_to_send);
                        goto sendalert;
                }
                /* Not even a complete header yet. wait for the rest */
                mutex_exit(&ssl->kssl_lock);
                return (KSSL_CMD_NONE);
        }

        do {
                DTRACE_PROBE1(kssl_mblk__kssl_input_cycle, mblk_t *, recmp);
                content_type = (SSL3ContentType)recmp->b_rptr[0];

                switch (content_type) {
                case content_application_data:
                        /*
                         * application_data records are decrypted and
                         * MAC-verified by the stream head, and in the context
                         * a read()'ing thread. This avoids unfairly charging
                         * the cost of handling this record on the whole system,
                         * and prevents doing it while in the shared IP
                         * perimeter.
                         */
                        ssl->activeinput = B_FALSE;
                        if (ssl->hs_waitstate != idle_handshake) {
                                DTRACE_PROBE(kssl_err__waitstate_not_idle);
                                goto sendnewalert;
                        }
                        outmp = recmp;
                        kssl_cmd = KSSL_CMD_DELIVER_PROXY;
                        break;
                case content_change_cipher_spec:
                case content_alert:
                case content_handshake:
                case content_handshake_v2:
                        /*
                         * If we're past the initial handshake, start letting
                         * the stream head process all records, in particular
                         * the close_notify.
                         * This is needed to avoid processing them out of
                         * sequence when previous application data packets are
                         * waiting to be decrypted/MAC'ed and delivered.
                         */
                        if (ssl->hs_waitstate == idle_handshake) {
                                ssl->activeinput = B_FALSE;
                                outmp = recmp;
                                kssl_cmd = KSSL_CMD_DELIVER_PROXY;
                        } else {
                                kssl_cmd = kssl_handle_any_record(ssl, recmp,
                                    &outmp, cbfn, arg);
                        }
                        break;
                default:
                        ssl->activeinput = B_FALSE;
                        DTRACE_PROBE(kssl_err__invalid_content_type);
                        goto sendnewalert;
                }

                /* Priority to Alert messages */
                if (ssl->alert_sendbuf != NULL) {
                        DTRACE_PROBE(kssl_err__alert_to_send_cycle);
                        goto sendalert;
                }

                /* Then handshake messages */
                if (ssl->handshake_sendbuf) {
                        if (*decrmp != NULL) {
                                linkb(*decrmp, ssl->handshake_sendbuf);
                        } else {
                                *decrmp = ssl->handshake_sendbuf;
                        }
                        ssl->handshake_sendbuf = NULL;

                        *more = ((ssl->rec_ass_head != NULL) &&
                            (!ssl->activeinput));
                        mutex_exit(&ssl->kssl_lock);
                        return (kssl_cmd);
                }

                if (ssl->hs_waitstate == idle_handshake) {
                        *more = ((ssl->rec_ass_head != NULL) &&
                            (!ssl->activeinput));
                }

                if (outmp != NULL) {
                        *decrmp = outmp;
                        /*
                         * Don't process any packet after an application_data.
                         * We could well receive the close_notify which should
                         * be handled separately.
                         */
                        mutex_exit(&ssl->kssl_lock);
                        return (kssl_cmd);
                }
                /*
                 * The current record isn't done yet. Don't start the next one
                 */
                if (ssl->activeinput) {
                        mutex_exit(&ssl->kssl_lock);
                        return (kssl_cmd);
                }
        } while ((recmp = kssl_get_next_record(ssl)) != NULL);

        mutex_exit(&ssl->kssl_lock);
        return (kssl_cmd);

sendnewalert:
        kssl_send_alert(ssl, alert_fatal, unexpected_message);
        if (mp != NULL) {
                freeb(mp);
        }

sendalert:
        *decrmp = ssl->alert_sendbuf;
        ssl->alert_sendbuf = NULL;
        mutex_exit(&ssl->kssl_lock);
        return (KSSL_CMD_SEND);
}

/*
 * Decrypt and verify the MAC of an incoming chain of application_data record.
 * Each block has exactly one SSL record.
 */
kssl_cmd_t
kssl_handle_mblk(kssl_ctx_t ctx, mblk_t **mpp, mblk_t **outmp)
{
        uchar_t *recend, *rec_sz_p;
        uchar_t *real_recend;
        mblk_t *prevmp = NULL, *nextmp, *firstmp, *mp, *copybp;
        int mac_sz;
        uchar_t version[2];
        uint16_t rec_sz;
        SSL3AlertDescription desc;
        SSL3ContentType content_type;
        ssl_t *ssl;
        KSSLCipherSpec *spec;
        int error, ret;
        kssl_cmd_t kssl_cmd = KSSL_CMD_DELIVER_PROXY;
        boolean_t deliverit = B_FALSE;
        crypto_data_t cipher_data;

        ASSERT(ctx != NULL);

        ssl = (ssl_t *)(ctx);

        mp = firstmp = *mpp;
        *outmp = NULL;
more:

        while (mp != NULL) {
                ASSERT(DB_TYPE(mp) == M_DATA);

                if (DB_REF(mp) > 1) {
                        /*
                         * Fortunately copyb() preserves the offset,
                         * tail space and alignment so the copy is
                         * ready to be made an SSL record.
                         */
                        if ((copybp = copyb(mp)) == NULL)
                                return (NULL);

                        copybp->b_cont = mp->b_cont;
                        if (mp == firstmp) {
                                *mpp = copybp;
                        } else if (prevmp != NULL) {
                                prevmp->b_cont = copybp;
                        }
                        freeb(mp);
                        mp = copybp;
                }

                DTRACE_PROBE1(kssl_mblk__handle_record_cycle, mblk_t *, mp);
                content_type = (SSL3ContentType)mp->b_rptr[0];

                switch (content_type) {
                case content_application_data:
                        break;
                case content_change_cipher_spec:
                case content_alert:
                case content_handshake:
                case content_handshake_v2:
                        nextmp = mp->b_cont;

                        /* Remove this message */
                        if (prevmp != NULL) {
                                prevmp->b_cont = nextmp;

                                /*
                                 * If we had processed blocks that need to
                                 * be delivered, then remember that error code
                                 */
                                if (kssl_cmd == KSSL_CMD_DELIVER_PROXY)
                                        deliverit = B_TRUE;
                        }

                        mutex_enter(&ssl->kssl_lock);
                        /* NOTE: This routine could free mp. */
                        kssl_cmd = kssl_handle_any_record(ssl, mp, outmp,
                            NULL, NULL);

                        if (ssl->alert_sendbuf != NULL) {
                                mp = nextmp;
                                DTRACE_PROBE(kssl_err__alert_after_handle_any);
                                goto sendalert;
                        }
                        mutex_exit(&ssl->kssl_lock);

                        if (deliverit) {
                                kssl_cmd = KSSL_CMD_DELIVER_PROXY;
                        }

                        mp = nextmp;
                        continue;       /* to the while loop */
                default:
                        desc = decode_error;
                        KSSL_COUNTER(internal_errors, 1);
                        DTRACE_PROBE(kssl_err__decode_error);
                        goto makealert;
                }

                version[0] = mp->b_rptr[1];
                version[1] = mp->b_rptr[2];
                rec_sz_p = SSL3_REC_SIZE(mp);
                rec_sz = BE16_TO_U16(rec_sz_p);

                mp->b_rptr += SSL3_HDR_LEN;
                recend = mp->b_rptr + rec_sz;
                real_recend = recend;

                /*
                 * Check the assumption that each mblk contains exactly
                 * one complete SSL record. We bail out if the check fails.
                 */
                ASSERT(recend == mp->b_wptr);
                if (recend != mp->b_wptr) {
                        desc = decode_error;
                        KSSL_COUNTER(internal_errors, 1);
                        DTRACE_PROBE(kssl_err__not_complete_record);
                        goto makealert;
                }

                spec = &ssl->spec[KSSL_READ];
                mac_sz = spec->mac_hashsz;
                if (spec->cipher_ctx != 0) {

                        /*
                         * The record length must be a multiple of the
                         * block size for block ciphers.
                         * The cipher_bsize is always a power of 2.
                         */
                        if ((spec->cipher_type == type_block) &&
                            ((rec_sz & (spec->cipher_bsize - 1)) != 0)) {
                                DTRACE_PROBE2(kssl_err__bad_record_size,
                                    uint16_t, rec_sz,
                                    int, spec->cipher_bsize);
                                KSSL_COUNTER(record_decrypt_failure, 1);
                                mp->b_rptr = recend;
                                desc = decrypt_error;
                                goto makealert;
                        }

                        cipher_data.cd_format = CRYPTO_DATA_RAW;
                        cipher_data.cd_offset = 0;
                        cipher_data.cd_length = rec_sz;
                        cipher_data.cd_miscdata = NULL;
                        cipher_data.cd_raw.iov_base = (char *)mp->b_rptr;
                        cipher_data.cd_raw.iov_len = rec_sz;
                        error = crypto_decrypt_update(spec->cipher_ctx,
                            &cipher_data, NULL, NULL);
                        if (CRYPTO_ERR(error)) {
                                DTRACE_PROBE1(
                                    kssl_err__crypto_decrypt_update_failed,
                                    int, error);
                                KSSL_COUNTER(record_decrypt_failure, 1);
                                mp->b_rptr = recend;
                                desc = decrypt_error;
                                goto makealert;
                        }
                }
                if (spec->cipher_type == type_block) {
                        uint_t pad_sz = recend[-1];
                        pad_sz++;
                        if (pad_sz + mac_sz > rec_sz) {
                                DTRACE_PROBE(kssl_err__pad_mac_bigger);
                                mp->b_rptr = recend;
                                desc = bad_record_mac;
                                goto makealert;
                        }
                        rec_sz -= pad_sz;
                        recend -= pad_sz;
                }
                if (mac_sz != 0) {
                        uchar_t hash[MAX_HASH_LEN];
                        if (rec_sz < mac_sz) {
                                DTRACE_PROBE(kssl_err__pad_smaller_mac);
                                mp->b_rptr = real_recend;
                                desc = bad_record_mac;
                                goto makealert;
                        }
                        rec_sz -= mac_sz;
                        recend -= mac_sz;
                        ret = kssl_compute_record_mac(ssl, KSSL_READ,
                            ssl->seq_num[KSSL_READ], content_type,
                            version, mp->b_rptr, rec_sz, hash);
                        if (ret != CRYPTO_SUCCESS ||
                            bcmp(hash, recend, mac_sz)) {
                                DTRACE_PROBE1(kssl_mblk__MACmismatch_handlerec,
                                    mblk_t *, mp);
                                mp->b_rptr = real_recend;
                                desc = bad_record_mac;
                                DTRACE_PROBE(kssl_err__msg_MAC_mismatch);
                                KSSL_COUNTER(verify_mac_failure, 1);
                                goto makealert;
                        }
                        ssl->seq_num[KSSL_READ]++;
                }

                if (ssl->hs_waitstate != idle_handshake) {
                        DTRACE_PROBE1(kssl_err__unexpected_msg,
                            SSL3WaitState, ssl->hs_waitstate);
                        mp->b_rptr = real_recend;
                        desc = unexpected_message;
                        goto makealert;
                }
                mp->b_wptr = recend;

                DTRACE_PROBE1(kssl_mblk__dblk_cooked, mblk_t *, mp);
                KSSL_COUNTER(appdata_record_ins, 1);

                prevmp = mp;
                mp = mp->b_cont;
        }

        return (kssl_cmd);

makealert:
        nextmp = mp->b_cont;
        freeb(mp);
        mp = nextmp;
        mutex_enter(&ssl->kssl_lock);
        kssl_send_alert(ssl, alert_fatal, desc);

        if (ssl->alert_sendbuf == NULL) {
                /* internal memory allocation failure. just return. */
                DTRACE_PROBE(kssl_err__alert_msg_alloc_failed);
                mutex_exit(&ssl->kssl_lock);

                if (mp) {
                        prevmp = NULL;
                        goto more;
                }

                return (KSSL_CMD_NONE);
        }
        kssl_cmd = KSSL_CMD_SEND;
sendalert:
        if (*outmp == NULL) {
                *outmp = ssl->alert_sendbuf;
        } else {
                linkb(*outmp, ssl->alert_sendbuf);
        }
        ssl->alert_sendbuf = NULL;
        mutex_exit(&ssl->kssl_lock);

        if (mp) {
                prevmp = NULL;
                goto more;
        }

        return (kssl_cmd);
}
/*
 * This is the routine that handles incoming SSL records.
 * When called the first time, with a NULL context, this routine expects
 * a ClientHello SSL Handshake packet and shall allocate a context
 * of a new SSL connection.
 * During the rest of the handshake packets, the routine adjusts the
 * state of the context according to the record received.
 * After the ChangeCipherSpec message is received, the routine first
 * decrypts/authenticated the packet using the key materials in the
 * connection's context.
 * The return code tells the caller what to do with the returned packet.
 */
static kssl_cmd_t
kssl_handle_any_record(kssl_ctx_t ctx, mblk_t *mp, mblk_t **decrmp,
    kssl_callback_t cbfn, void *arg)
{
        uchar_t *recend, *rec_sz_p;
        uchar_t version[2];
        uchar_t *real_recend, *save_rptr, *save_wptr;
        int rhsz = SSL3_HDR_LEN;
        uint16_t rec_sz;
        int sz;
        int mac_sz;
        SSL3AlertDescription desc;
        SSL3AlertLevel level;
        SSL3ContentType content_type;
        ssl_t *ssl;
        KSSLCipherSpec *spec;
        int error = 0, ret;

        ASSERT(ctx != NULL);

        ssl = (ssl_t *)(ctx);

        *decrmp = NULL;

        save_rptr = mp->b_rptr;
        save_wptr = mp->b_wptr;

        ASSERT(MUTEX_HELD(&ssl->kssl_lock));

        content_type = (SSL3ContentType)mp->b_rptr[0];
        if (content_type == content_handshake_v2) {
                if (ssl->hs_waitstate == wait_client_hello) {
                        /* V2 compatible ClientHello */
                        if (mp->b_rptr[3] == 0x03 &&
                            (mp->b_rptr[4] == 0x01 ||
                            mp->b_rptr[4] == 0x00)) {
                                ssl->major_version = version[0] = mp->b_rptr[3];
                                ssl->minor_version = version[1] = mp->b_rptr[4];
                        } else {
                        /* We don't support "pure" SSLv2 */
                                DTRACE_PROBE(kssl_err__no_SSLv2);
                                ssl->major_version = mp->b_rptr[3];
                                ssl->minor_version = mp->b_rptr[4];
                                desc = protocol_version;
                                goto sendalert;
                        }
                }
                rec_sz = (uint16_t)mp->b_rptr[1];
                rhsz = 2;
        } else {
                ssl->major_version = version[0] = mp->b_rptr[1];
                ssl->minor_version = version[1] = mp->b_rptr[2];
                rec_sz_p = SSL3_REC_SIZE(mp);
                rec_sz = BE16_TO_U16(rec_sz_p);
        }

        mp->b_rptr += rhsz;
        recend = mp->b_rptr + rec_sz;
        real_recend = recend;

        /*
         * Check the assumption that each mblk contains exactly
         * one complete SSL record. We bail out if the check fails.
         */
        ASSERT(recend == mp->b_wptr);
        if (recend != mp->b_wptr) {
                DTRACE_PROBE3(kssl_mblk__handle_any_record_recszerr,
                    mblk_t *, mp, int, rhsz, int, rec_sz);
                DTRACE_PROBE(kssl_err__record_size);
                desc = decode_error;
                KSSL_COUNTER(internal_errors, 1);
                goto sendalert;
        }

        spec = &ssl->spec[KSSL_READ];
        mac_sz = spec->mac_hashsz;
        if (spec->cipher_ctx != 0) {
                /*
                 * The record length must be a multiple of the
                 * block size for block ciphers.
                 */
                if ((spec->cipher_type == type_block) &&
                    ((rec_sz & (spec->cipher_bsize - 1)) != 0)) {
                        DTRACE_PROBE2(kssl_err__bad_record_size,
                            uint16_t, rec_sz, int, spec->cipher_bsize);
                        KSSL_COUNTER(record_decrypt_failure, 1);
                        mp->b_rptr = recend;
                        desc = decrypt_error;
                        goto sendalert;
                }

                spec->cipher_data.cd_length = rec_sz;
                spec->cipher_data.cd_raw.iov_base = (char *)mp->b_rptr;
                spec->cipher_data.cd_raw.iov_len = rec_sz;
                error = crypto_decrypt_update(spec->cipher_ctx,
                    &spec->cipher_data, NULL, NULL);
                if (CRYPTO_ERR(error)) {
                        DTRACE_PROBE1(kssl_err__crypto_decrypt_update_failed,
                            int, error);
                        KSSL_COUNTER(record_decrypt_failure, 1);
                        mp->b_rptr = recend;
                        desc = decrypt_error;
                        goto sendalert;
                }
        }
        if (spec->cipher_type == type_block) {
                uint_t pad_sz = recend[-1];
                pad_sz++;
                if (pad_sz + mac_sz > rec_sz) {
                        DTRACE_PROBE2(kssl_err__pad_mac_mismatch,
                            int, pad_sz, int, mac_sz);
                        mp->b_rptr = recend;
                        desc = bad_record_mac;
                        goto sendalert;
                }
                rec_sz -= pad_sz;
                recend -= pad_sz;
        }
        if (mac_sz != 0) {
                uchar_t hash[MAX_HASH_LEN];
                if (rec_sz < mac_sz) {
                        DTRACE_PROBE1(kssl_err__mac_size_too_big,
                            int, mac_sz);
                        mp->b_rptr = real_recend;
                        desc = bad_record_mac;
                        goto sendalert;
                }
                rec_sz -= mac_sz;
                recend -= mac_sz;
                ret = kssl_compute_record_mac(ssl, KSSL_READ,
                    ssl->seq_num[KSSL_READ], content_type,
                    version, mp->b_rptr, rec_sz, hash);
                if (ret != CRYPTO_SUCCESS ||
                    bcmp(hash, recend, mac_sz)) {
                        DTRACE_PROBE1(kssl_mblk__MACmismatch_anyrecord,
                            mblk_t *, mp);
                        mp->b_rptr = real_recend;
                        desc = bad_record_mac;
                        DTRACE_PROBE(kssl_err__msg_MAC_mismatch);
                        KSSL_COUNTER(verify_mac_failure, 1);
                        goto sendalert;
                }
                ssl->seq_num[KSSL_READ]++;
                DTRACE_PROBE1(kssl_mblk__after_compute_MAC,
                    mblk_t *, mp);
        }

        switch (content_type) {
        case content_handshake:
                do {
                        DTRACE_PROBE1(kssl_mblk__content_handshake_cycle,
                            mblk_t *, mp);
                        if (error != 0 ||
                            /* ignore client renegotiation for now */
                            ssl->hs_waitstate == idle_handshake) {
                                mp->b_rptr = recend;
                                DTRACE_PROBE(kssl_renegotiation_request);
                        }
                        if (mp->b_rptr == recend) {
                                mp->b_rptr = real_recend;
                                if (error != 0) {
                                        goto error;
                                }
                                freeb(mp);

                                if (ssl->hs_waitstate == wait_client_key_done)
                                        return (KSSL_CMD_QUEUED);

                                return ((ssl->handshake_sendbuf != NULL) ?
                                    KSSL_CMD_SEND : KSSL_CMD_NONE);
                        }
                        if (ssl->msg.state < MSG_BODY) {
                                if (ssl->msg.state == MSG_INIT) {
                                        ssl->msg.type =
                                            (SSL3HandshakeType)*mp->b_rptr++;
                                        ssl->msg.state = MSG_INIT_LEN;
                                }
                                if (ssl->msg.state == MSG_INIT_LEN) {
                                        int msglenb =
                                            ssl->msg.msglen_bytes;
                                        int msglen = ssl->msg.msglen;
                                        while (mp->b_rptr < recend &&
                                            msglenb < 3) {
                                                msglen = (msglen << 8) +
                                                    (uint_t)(*mp->b_rptr++);
                                                msglenb++;
                                        }
                                        ssl->msg.msglen_bytes = msglenb;
                                        ssl->msg.msglen = msglen;
                                        if (msglenb == 3) {
                                                ssl->msg.state = MSG_BODY;
                                        }
                                }
                                if (mp->b_rptr == recend) {
                                        mp->b_rptr = real_recend;
                                        freeb(mp);
                                        return (KSSL_CMD_NONE);
                                }
                        }
                        ASSERT(ssl->msg.state == MSG_BODY);

                        sz = recend - mp->b_rptr;

                        if (ssl->msg.head == NULL &&
                            ssl->msg.msglen <= sz) {
                                continue;
                        }
                        if (ssl->msg.head != NULL) {
                                sz += msgdsize(ssl->msg.head);
                                if (ssl->msg.msglen <= sz) {
                                        ssl->msg.tail->b_cont = mp;
                                        mp = ssl->msg.head;
                                        ssl->sslcnt = 100;
                                        ssl->msg.head = NULL;
                                        ssl->msg.tail = NULL;
                                        if (pullupmsg(mp, -1)) {
                                                recend = mp->b_rptr + sz;
                                                ASSERT(recend <= mp->b_wptr);
                                                continue;
                                        }
                                        mp->b_rptr = real_recend;
                                        error = ENOMEM;
                                        KSSL_COUNTER(alloc_fails, 1);
                                        goto error;
                                }
                        }

                        mp->b_wptr = recend;

                        if (ssl->msg.head == NULL) {
                                ssl->msg.head = mp;
                                ssl->msg.tail = mp;
                                return (KSSL_CMD_NONE);
                        } else {
                                ssl->msg.tail->b_cont = mp;
                                ssl->msg.tail = mp;
                                return (KSSL_CMD_NONE);
                        }
                } while (kssl_handle_handshake_message(ssl, mp, &error, cbfn,
                    arg));
                if (error == SSL_MISS) {
                        mp->b_rptr = save_rptr;
                        mp->b_wptr = save_wptr;
                        KSSL_COUNTER(fallback_connections, 1);
                        return (KSSL_CMD_NOT_SUPPORTED);
                }
                if (ssl->hs_waitstate == wait_client_key_done) {
                        return (KSSL_CMD_QUEUED);
                } else {
                        return (KSSL_CMD_NONE);
                }
        case content_alert:
                DTRACE_PROBE1(kssl_mblk__content_alert, mblk_t *, mp);
                if (rec_sz != 2) {
                        DTRACE_PROBE(kssl_err__illegal_param);
                        mp->b_rptr = real_recend;
                        desc = illegal_parameter;
                        goto sendalert;
                } else {
                        level = *mp->b_rptr++;
                        desc = *mp->b_rptr++;
                        mp->b_rptr = real_recend;
                        if (level != alert_warning || desc != close_notify) {
                                if (ssl->sid.cached == B_TRUE) {
                                        kssl_uncache_sid(&ssl->sid,
                                            ssl->kssl_entry);
                                }
                                DTRACE_PROBE2(kssl_err__bad_content_alert,
                                    SSL3AlertLevel, level,
                                    SSL3AlertDescription, desc);
                                ssl->fatal_alert = B_TRUE;
                                error = EBADMSG;
                                goto error;
                        } else {
                                ssl->close_notify_clnt = B_TRUE;
                                ssl->activeinput = B_FALSE;
                                freeb(mp);
                                return (KSSL_CMD_NONE);
                        }
                }
        case content_change_cipher_spec:
                DTRACE_PROBE1(kssl_mblk__change_cipher_spec,
                    mblk_t *, mp);
                if (ssl->hs_waitstate != wait_change_cipher) {
                        desc = unexpected_message;
                } else if (rec_sz != 1 || *mp->b_rptr != 1) {
                        desc = illegal_parameter;
                } else {
                        mp->b_rptr = real_recend;
                        ssl->hs_waitstate = wait_finished;
                        ssl->seq_num[KSSL_READ] = 0;
                        if ((error = kssl_spec_init(ssl, KSSL_READ)) != 0) {
                                DTRACE_PROBE1(kssl_err__kssl_spec_init_error,
                                    int, error);
                                goto error;
                        }
                        ssl->activeinput = B_FALSE;
                        freeb(mp);
                        return (KSSL_CMD_NONE);
                }
                mp->b_rptr = real_recend;
                DTRACE_PROBE(kssl_err__change_cipher_spec);
                goto sendalert;

        case content_application_data:
                DTRACE_PROBE1(kssl_mblk__content_app_data,
                    mblk_t *, mp);
                if (ssl->hs_waitstate != idle_handshake) {
                        DTRACE_PROBE(kssl_err__content_app_data);
                        mp->b_rptr = real_recend;
                        desc = unexpected_message;
                        goto sendalert;
                }
                mp->b_wptr = recend;
                *decrmp = mp;
                ssl->activeinput = B_FALSE;
                return (KSSL_CMD_DELIVER_PROXY);

        case content_handshake_v2:
                DTRACE_PROBE1(kssl_mblk__content_handshake_v2,
                    mblk_t *, mp);
                error = kssl_handle_v2client_hello(ssl, mp, rec_sz);
                if (error == SSL_MISS) {
                        mp->b_rptr = save_rptr;
                        mp->b_wptr = save_wptr;
                        KSSL_COUNTER(fallback_connections, 1);
                        return (KSSL_CMD_NOT_SUPPORTED);
                } else if (error != 0) {
                        DTRACE_PROBE(kssl_err__v2client_hello_failed);
                        goto error;
                }
                freeb(mp);
                return (KSSL_CMD_SEND);
        default:
                DTRACE_PROBE1(kssl_mblk__unexpected_msg,
                    mblk_t *, mp);
                mp->b_rptr = real_recend;
                desc = unexpected_message;
                break;
        }

sendalert:
        kssl_send_alert(ssl, alert_fatal, desc);
        *decrmp = ssl->alert_sendbuf;
        ssl->alert_sendbuf = NULL;
        freeb(mp);
        return ((*decrmp != NULL) ? KSSL_CMD_SEND : KSSL_CMD_NONE);
error:
        freeb(mp);
        return (KSSL_CMD_NONE);
}

/*
 * Initialize the context of an SSL connection, coming to the specified
 * address. The ssl structure is returned held.
 */
kssl_status_t
kssl_init_context(kssl_ent_t kssl_ent, struct sockaddr *addr, int mss,
    kssl_ctx_t *kssl_ctxp)
{
        ssl_t *ssl = kmem_cache_alloc(kssl_cache, KM_NOSLEEP);
        struct sockaddr_in *sin = (struct sockaddr_in *)addr;

        if (ssl == NULL) {
                return (KSSL_STS_ERR);
        }

        bzero(ssl, sizeof (ssl_t));

        ssl->kssl_entry = (kssl_entry_t *)kssl_ent;
        KSSL_ENTRY_REFHOLD(ssl->kssl_entry);

        if (sin->sin_family == AF_INET) {
                IN6_IPADDR_TO_V4MAPPED(sin->sin_addr.s_addr, &ssl->faddr);
        } else {
                /* struct assignment */
                ssl->faddr = ((struct sockaddr_in6 *)addr)->sin6_addr;
        }
        ssl->tcp_mss = mss;
        ssl->sendalert_level = alert_warning;
        ssl->sendalert_desc = close_notify;
        ssl->sid.cached = B_FALSE;

        *kssl_ctxp = (kssl_ctx_t)ssl;
        return (KSSL_STS_OK);
}

void
kssl_set_mss(kssl_ctx_t ctx, uint32_t mss)
{
        ssl_t *ssl = (ssl_t *)ctx;
        ssl->tcp_mss = mss;
}

/*
 * Builds SSL records out of the chain of mblks, and returns it.
 * Takes a copy of the message before encrypting it if it has another
 * reference.
 * In case of failure, NULL is returned, and the message will be
 * freed by the caller.
 * A NULL mp means a close_notify is requested.
 */
mblk_t *
kssl_build_record(kssl_ctx_t ctx, mblk_t *mp)
{
        ssl_t *ssl = (ssl_t *)ctx;
        mblk_t *retmp = mp, *bp = mp, *prevbp = mp, *copybp;

        ASSERT(ssl != NULL);

        /*
         * Produce new close_notify message. This is necessary to perform
         * proper cleanup w.r.t. SSL protocol spec by sending close_notify SSL
         * alert record if running with KSSL proxy.
         * This should be done prior to sending the FIN so the client side can
         * attempt to do graceful cleanup. Ideally, we should wait for client's
         * close_notify but not all clients send it which would hang the
         * connection. This way of closing the SSL session (Incomplete Close)
         * prevents truncation attacks for protocols without end-of-data
         * markers (as opposed to the Premature Close).
         * Checking the close_notify_srvr flag will prevent from sending the
         * close_notify message twice in case of duplicate shutdown() calls.
         */
        if (mp == NULL && !ssl->close_notify_srvr) {
                kssl_send_alert(ssl, alert_warning, close_notify);
                if (ssl->alert_sendbuf == NULL)
                        return (NULL);
                mp = bp = retmp = prevbp = ssl->alert_sendbuf;
                ssl->alert_sendbuf = NULL;
                ssl->close_notify_srvr = B_TRUE;
        }

        ASSERT(mp != NULL);
        ASSERT(bp != NULL);

        do {
                if (DB_REF(bp) > 1) {
                        /*
                         * Fortunately copyb() preserves the offset,
                         * tail space and alignment so the copy is
                         * ready to be made an SSL record.
                         */
                        if ((copybp = copyb(bp)) == NULL)
                                return (NULL);

                        copybp->b_cont = bp->b_cont;
                        if (bp == mp) {
                                retmp = copybp;
                        } else {
                                prevbp->b_cont = copybp;
                        }
                        freeb(bp);
                        bp = copybp;
                }

                if (kssl_build_single_record(ssl, bp) != KSSL_STS_OK)
                        return (NULL);

                prevbp = bp;
                bp = bp->b_cont;
        } while (bp != NULL);

        return (retmp);
}

/*
 * Builds a single SSL record by prepending SSL header (optional) and performing
 * encryption and MAC. The encryption of the record is done in-line.
 * Expects an mblk with associated dblk's base to have space for the SSL header
 * or an mblk which already has the header present. In both cases it presumes
 * that the mblk's dblk limit has space for the MAC + padding.
 * If the close_notify_srvr flag is set it is presumed that the mblk already
 * contains SSL header in which case only the record length field will be
 * adjusted with the MAC/padding size.
 */
static kssl_status_t
kssl_build_single_record(ssl_t *ssl, mblk_t *mp)
{
        int len;
        int reclen;
        uchar_t *recstart, *versionp;
        KSSLCipherSpec *spec;
        int mac_sz;
        int pad_sz;

        spec = &ssl->spec[KSSL_WRITE];
        mac_sz = spec->mac_hashsz;

        ASSERT(DB_REF(mp) == 1);
        /* The dblk must always have space for the padding and MAC suffix. */
        ASSERT(mp->b_datap->db_lim - mp->b_wptr >= mac_sz + spec->cipher_bsize);

        /* kssl_send_alert() constructs the SSL header by itself. */
        if (!ssl->close_notify_srvr)
                len = MBLKL(mp) - SSL3_HDR_LEN;
        else
                len = MBLKL(mp);

        ASSERT(len > 0);

        mutex_enter(&ssl->kssl_lock);

        recstart = mp->b_rptr;
        if (!ssl->close_notify_srvr) {
                /* The dblk must have space for the SSL header prefix. */
                ASSERT(mp->b_rptr - mp->b_datap->db_base >= SSL3_HDR_LEN);
                recstart = mp->b_rptr = mp->b_rptr - SSL3_HDR_LEN;
                recstart[0] = content_application_data;
                recstart[1] = ssl->major_version;
                recstart[2] = ssl->minor_version;
        }
        versionp = &recstart[1];

        reclen = len + mac_sz;
        if (spec->cipher_type == type_block) {
                pad_sz = spec->cipher_bsize -
                    (reclen & (spec->cipher_bsize - 1));
                ASSERT(reclen + pad_sz <=
                    SSL3_MAX_RECORD_LENGTH);
                reclen += pad_sz;
        }
        recstart[3] = (reclen >> 8) & 0xff;
        recstart[4] = reclen & 0xff;

        if (kssl_mac_encrypt_record(ssl, recstart[0], versionp,
            recstart, mp) != 0) {
                /* Do we need an internal_error Alert here? */
                mutex_exit(&ssl->kssl_lock);
                return (KSSL_STS_ERR);
        }

        /* Alert messages are accounted in kssl_send_alert(). */
        if (recstart[0] == content_application_data)
                KSSL_COUNTER(appdata_record_outs, 1);
        mutex_exit(&ssl->kssl_lock);
        return (KSSL_STS_OK);
}