inet/ipf/ip_auth.c

133 int fr_authinit(ifs)
134 ipf_stack_t *ifs;
136 	KMALLOCS(ifs->ifs_fr_auth, frauth_t *,
137 		 ifs->ifs_fr_authsize * sizeof(*ifs->ifs_fr_auth));
138 	if (ifs->ifs_fr_auth != NULL)
139 		bzero((char *)ifs->ifs_fr_auth,
140 		      ifs->ifs_fr_authsize * sizeof(*ifs->ifs_fr_auth));
144 	KMALLOCS(ifs->ifs_fr_authpkts, mb_t **,
145 		 ifs->ifs_fr_authsize * sizeof(*ifs->ifs_fr_authpkts));
146 	if (ifs->ifs_fr_authpkts != NULL)
147 		bzero((char *)ifs->ifs_fr_authpkts,
148 		      ifs->ifs_fr_authsize * sizeof(*ifs->ifs_fr_authpkts));
152 	MUTEX_INIT(&ifs->ifs_ipf_authmx, "ipf auth log mutex");
153 	RWLOCK_INIT(&ifs->ifs_ipf_auth, "ipf IP User-Auth rwlock");
155 	cv_init(&ifs->ifs_ipfauthwait, "ipf auth condvar", CV_DRIVER, NULL);
161 	ifs->ifs_fr_auth_init = 1;
182 	ipf_stack_t *ifs = fin->fin_ifs;
184 	if (ifs->ifs_fr_auth_lock || !ifs->ifs_fr_authused)
190 	READ_ENTER(&ifs->ifs_ipf_auth);
191 	for (i = ifs->ifs_fr_authstart; i != ifs->ifs_fr_authend; ) {
197 		fra = ifs->ifs_fr_auth + i;
228 			RWLOCK_EXIT(&ifs->ifs_ipf_auth);
229 			WRITE_ENTER(&ifs->ifs_ipf_auth);
231 				fr->fr_next = ifs->ifs_fr_authlist;
232 				ifs->ifs_fr_authlist = fr;
234 			ifs->ifs_fr_authstats.fas_hits++;
236 			ifs->ifs_fr_authused--;
237 			if (i == ifs->ifs_fr_authstart) {
241 					if (i == ifs->ifs_fr_authsize) {
243 						fra = ifs->ifs_fr_auth;
245 					ifs->ifs_fr_authstart = i;
246 					if (i == ifs->ifs_fr_authend)
249 				if (ifs->ifs_fr_authstart == ifs->ifs_fr_authend) {
250 					ifs->ifs_fr_authnext = 0;
251 					ifs->ifs_fr_authstart = 0;
252 					ifs->ifs_fr_authend = 0;
255 			RWLOCK_EXIT(&ifs->ifs_ipf_auth);
258 			ATOMIC_INC64(ifs->ifs_fr_authstats.fas_hits);
262 		if (i == ifs->ifs_fr_authsize)
265 	ifs->ifs_fr_authstats.fas_miss++;
266 	RWLOCK_EXIT(&ifs->ifs_ipf_auth);
267 	ATOMIC_INC64(ifs->ifs_fr_authstats.fas_miss);
289 	ipf_stack_t *ifs = fin->fin_ifs;
291 	if (ifs->ifs_fr_auth_lock)
294 	WRITE_ENTER(&ifs->ifs_ipf_auth);
295 	if (ifs->ifs_fr_authstart > ifs->ifs_fr_authend) {
296 		ifs->ifs_fr_authstats.fas_nospace++;
297 		RWLOCK_EXIT(&ifs->ifs_ipf_auth);
300 		if (ifs->ifs_fr_authused == ifs->ifs_fr_authsize) {
301 			ifs->ifs_fr_authstats.fas_nospace++;
302 			RWLOCK_EXIT(&ifs->ifs_ipf_auth);
307 	ifs->ifs_fr_authstats.fas_added++;
308 	ifs->ifs_fr_authused++;
309 	i = ifs->ifs_fr_authend++;
310 	if (ifs->ifs_fr_authend == ifs->ifs_fr_authsize)
311 		ifs->ifs_fr_authend = 0;
312 	RWLOCK_EXIT(&ifs->ifs_ipf_auth);
314 	fra = ifs->ifs_fr_auth + i;
317 	fra->fra_age = ifs->ifs_fr_defaultauthage;
339 	ifs->ifs_fr_authpkts[i] = *(mblk_t **)fin->fin_mp;
340 	cv_signal(&ifs->ifs_ipfauthwait);
348 	ifs->ifs_fr_authpkts[i] = m;
349 	WAKEUP(&ifs->ifs_fr_authnext, 0);
355 int fr_auth_ioctl(data, cmd, mode, uid, ctx, ifs)
360 ipf_stack_t *ifs;
386 		token = ipf_findtoken(IPFGENITER_AUTH, uid, ctx, ifs);
388 			error = fr_authgeniter(token, &iter, ifs);
391 		RWLOCK_EXIT(&ifs->ifs_ipf_tokens);
401 		error = fr_lock(data, &ifs->ifs_fr_auth_lock);
405 		ifs->ifs_fr_authstats.fas_faelist = ifs->ifs_fae_list;
406 		error = fr_outobj(data, &ifs->ifs_fr_authstats,
412 		WRITE_ENTER(&ifs->ifs_ipf_auth);
413 		i = fr_authflush(ifs);
414 		RWLOCK_EXIT(&ifs->ifs_ipf_auth);
422 		READ_ENTER(&ifs->ifs_ipf_auth);
423 		if ((ifs->ifs_fr_authnext != ifs->ifs_fr_authend) &&
424 		    ifs->ifs_fr_authpkts[ifs->ifs_fr_authnext]) {
426 					  &ifs->ifs_fr_auth[ifs->ifs_fr_authnext],
433 				m = ifs->ifs_fr_authpkts[ifs->ifs_fr_authnext];
448 			RWLOCK_EXIT(&ifs->ifs_ipf_auth);
452 			WRITE_ENTER(&ifs->ifs_ipf_auth);
453 			ifs->ifs_fr_authnext++;
454 			if (ifs->ifs_fr_authnext == ifs->ifs_fr_authsize)
455 				ifs->ifs_fr_authnext = 0;
456 			RWLOCK_EXIT(&ifs->ifs_ipf_auth);
460 		RWLOCK_EXIT(&ifs->ifs_ipf_auth);
469 		RWLOCK_EXIT(&ifs->ifs_ipf_global);
471 		MUTEX_ENTER(&ifs->ifs_ipf_authmx);
475 		if (!cv_wait_sig(&ifs->ifs_ipfauthwait, &ifs->ifs_ipf_authmx.ipf_lk))
482 		l = get_sleep_lock(&ifs->ifs_fr_authnext);
483 		error = sleep(&ifs->ifs_fr_authnext, PZERO+1);
488 		error = mpsleep(&ifs->ifs_fr_authnext, PSUSP|PCATCH,
490 				&ifs->ifs_ipf_authmx, MS_LOCK_SIMPLE);
492 		error = SLEEP(&ifs->ifs_fr_authnext, "fr_authnext");
497 		MUTEX_EXIT(&ifs->ifs_ipf_authmx);
498 		READ_ENTER(&ifs->ifs_ipf_global);
500 			READ_ENTER(&ifs->ifs_ipf_auth);
510 		WRITE_ENTER(&ifs->ifs_ipf_auth);
512 		fra = ifs->ifs_fr_auth + i;
513 		if ((i < 0) || (i >= ifs->ifs_fr_authsize) ||
515 			RWLOCK_EXIT(&ifs->ifs_ipf_auth);
519 		m = ifs->ifs_fr_authpkts[i];
522 		ifs->ifs_fr_authpkts[i] = NULL;
523 		RWLOCK_EXIT(&ifs->ifs_ipf_auth);
526 			net_data_p = ifs->ifs_ipf_ipv4;
528 			net_data_p = ifs->ifs_ipf_ipv6;
547 				ifs->ifs_fr_authstats.fas_sendfail++;
549 				ifs->ifs_fr_authstats.fas_sendok++;
562 				ifs->ifs_fr_authstats.fas_sendfail++;
564 				ifs->ifs_fr_authstats.fas_sendok++;
596 				ifs->ifs_fr_authstats.fas_quefail++;
598 				ifs->ifs_fr_authstats.fas_queok++;
610 			ifs->ifs_fr_authused--;
613 			if (i == ifs->ifs_fr_authstart) {
616 					if (i == ifs->ifs_fr_authsize)
618 					ifs->ifs_fr_authstart = i;
619 					if (i == ifs->ifs_fr_authend)
622 				if (ifs->ifs_fr_authstart == ifs->ifs_fr_authend) {
623 					ifs->ifs_fr_authnext = 0;
624 					ifs->ifs_fr_authstart = 0;
625 					ifs->ifs_fr_authend = 0;
645 void fr_authunload(ifs)
646 ipf_stack_t *ifs;
653 	if (ifs->ifs_fr_auth != NULL) {
654 		KFREES(ifs->ifs_fr_auth,
655 		       ifs->ifs_fr_authsize * sizeof(*ifs->ifs_fr_auth));
656 		ifs->ifs_fr_auth = NULL;
659 	if (ifs->ifs_fr_authpkts != NULL) {
660 		for (i = 0; i < ifs->ifs_fr_authsize; i++) {
661 			m = ifs->ifs_fr_authpkts[i];
664 				ifs->ifs_fr_authpkts[i] = NULL;
667 		KFREES(ifs->ifs_fr_authpkts,
668 		       ifs->ifs_fr_authsize * sizeof(*ifs->ifs_fr_authpkts));
669 		ifs->ifs_fr_authpkts = NULL;
672 	faep = &ifs->ifs_fae_list;
677 	ifs->ifs_ipauth = NULL;
679 	if (ifs->ifs_fr_authlist != NULL) {
680 		for (frp = &ifs->ifs_fr_authlist; ((fr = *frp) != NULL); ) {
689 	if (ifs->ifs_fr_auth_init == 1) {
691 		cv_destroy(&ifs->ifs_ipfauthwait);
693 		MUTEX_DESTROY(&ifs->ifs_ipf_authmx);
694 		RW_DESTROY(&ifs->ifs_ipf_auth);
696 		ifs->ifs_fr_auth_init = 0;
705 void fr_authexpire(ifs)
706 ipf_stack_t *ifs;
715 	if (ifs->ifs_fr_auth_lock)
719 	WRITE_ENTER(&ifs->ifs_ipf_auth);
720 	for (i = 0, fra = ifs->ifs_fr_auth; i < ifs->ifs_fr_authsize; i++, fra++) {
722 		if ((fra->fra_age == 0) && (m = ifs->ifs_fr_authpkts[i])) {
724 			ifs->ifs_fr_authpkts[i] = NULL;
725 			ifs->ifs_fr_auth[i].fra_index = -1;
726 			ifs->ifs_fr_authstats.fas_expire++;
727 			ifs->ifs_fr_authused--;
731 	for (faep = &ifs->ifs_fae_list; ((fae = *faep) != NULL); ) {
736 			ifs->ifs_fr_authstats.fas_expire++;
740 	if (ifs->ifs_fae_list != NULL)
741 		ifs->ifs_ipauth = &ifs->ifs_fae_list->fae_fr;
743 		ifs->ifs_ipauth = NULL;
745 	for (frp = &ifs->ifs_fr_authlist; ((fr = *frp) != NULL); ) {
752 	RWLOCK_EXIT(&ifs->ifs_ipf_auth);
756 int fr_preauthcmd(cmd, fr, frptr, ifs)
759 ipf_stack_t *ifs;
768 	for (faep = &ifs->ifs_fae_list; ((fae = *faep) != NULL); ) {
782 			WRITE_ENTER(&ifs->ifs_ipf_auth);
784 			if (ifs->ifs_ipauth == &fae->fae_fr)
785 				ifs->ifs_ipauth = ifs->ifs_fae_list ?
786 				    &ifs->ifs_fae_list->fae_fr : NULL;
787 			RWLOCK_EXIT(&ifs->ifs_ipf_auth);
798 			WRITE_ENTER(&ifs->ifs_ipf_auth);
799 			fae->fae_age = ifs->ifs_fr_defaultauthage;
806 			ifs->ifs_ipauth = &ifs->ifs_fae_list->fae_fr;
807 			RWLOCK_EXIT(&ifs->ifs_ipf_auth);
822 int fr_authflush(ifs)
823 ipf_stack_t *ifs;
828 	if (ifs->ifs_fr_auth_lock)
833 	for (i = 0 ; i < ifs->ifs_fr_authsize; i++) {
834 		m = ifs->ifs_fr_authpkts[i];
837 			ifs->ifs_fr_authpkts[i] = NULL;
838 			ifs->ifs_fr_auth[i].fra_index = -1;
840 			ifs->ifs_fr_authstats.fas_expire++;
841 			ifs->ifs_fr_authused--;
846 	ifs->ifs_fr_authstart = 0;
847 	ifs->ifs_fr_authend = 0;
848 	ifs->ifs_fr_authnext = 0;
860 int fr_authgeniter(token, itp, ifs)
863 ipf_stack_t *ifs;
874 	READ_ENTER(&ifs->ifs_ipf_auth);
881 		next = ifs->ifs_fae_list;
902 	RWLOCK_EXIT(&ifs->ifs_ipf_auth);
911 		ipf_freetoken(token, ifs);
914 			WRITE_ENTER(&ifs->ifs_ipf_auth);
916 			RWLOCK_EXIT(&ifs->ifs_ipf_auth);
919 			ipf_freetoken(token, ifs);