1 /* $KAME: key.c,v 1.191 2001/06/27 10:46:49 sakane Exp $ */
2
3 /*-
4 * SPDX-License-Identifier: BSD-3-Clause
5 *
6 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
7 * All rights reserved.
8 *
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted provided that the following conditions
11 * are met:
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 * 2. Redistributions in binary form must reproduce the above copyright
15 * notice, this list of conditions and the following disclaimer in the
16 * documentation and/or other materials provided with the distribution.
17 * 3. Neither the name of the project nor the names of its contributors
18 * may be used to endorse or promote products derived from this software
19 * without specific prior written permission.
20 *
21 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31 * SUCH DAMAGE.
32 */
33
34 /*
35 * This code is referd to RFC 2367
36 */
37
38 #include "opt_inet.h"
39 #include "opt_inet6.h"
40 #include "opt_ipsec.h"
41
42 #include <sys/types.h>
43 #include <sys/param.h>
44 #include <sys/systm.h>
45 #include <sys/kernel.h>
46 #include <sys/fnv_hash.h>
47 #include <sys/lock.h>
48 #include <sys/mutex.h>
49 #include <sys/mbuf.h>
50 #include <sys/domain.h>
51 #include <sys/protosw.h>
52 #include <sys/malloc.h>
53 #include <sys/rmlock.h>
54 #include <sys/socket.h>
55 #include <sys/socketvar.h>
56 #include <sys/sysctl.h>
57 #include <sys/errno.h>
58 #include <sys/proc.h>
59 #include <sys/queue.h>
60 #include <sys/refcount.h>
61 #include <sys/stdarg.h>
62 #include <sys/syslog.h>
63
64 #include <vm/uma.h>
65
66 #include <net/if.h>
67 #include <net/if_var.h>
68 #include <net/vnet.h>
69
70 #include <netinet/in.h>
71 #include <netinet/in_systm.h>
72 #include <netinet/ip.h>
73 #include <netinet/in_var.h>
74 #include <netinet/udp.h>
75
76 #ifdef INET6
77 #include <netinet/ip6.h>
78 #include <netinet6/in6_var.h>
79 #include <netinet6/ip6_var.h>
80 #endif /* INET6 */
81
82 #include <net/pfkeyv2.h>
83 #include <netipsec/keydb.h>
84 #include <netipsec/key.h>
85 #include <netipsec/keysock.h>
86 #include <netipsec/key_debug.h>
87 #include <netipsec/ipsec_offload.h>
88
89 #include <netipsec/ipsec.h>
90 #ifdef INET6
91 #include <netipsec/ipsec6.h>
92 #endif
93
94 #include <netipsec/xform.h>
95 #include <netipsec/ipsec_offload.h>
96 #include <machine/in_cksum.h>
97
98 /* randomness */
99 #include <sys/random.h>
100
101 #ifdef IPSEC_OFFLOAD
102 void (*ipsec_accel_sa_newkey_p)(struct secasvar *sav);
103 void (*ipsec_accel_forget_sav_p)(struct secasvar *sav);
104 void (*ipsec_accel_spdadd_p)(struct secpolicy *sp, struct inpcb *inp);
105 void (*ipsec_accel_spddel_p)(struct secpolicy *sp);
106 int (*ipsec_accel_sa_lifetime_op_p)(struct secasvar *sav,
107 struct seclifetime *lft_c, if_t ifp, enum IF_SA_CNT_WHICH op,
108 struct rm_priotracker *sahtree_trackerp);
109 void (*ipsec_accel_sync_p)(void);
110 bool (*ipsec_accel_is_accel_sav_p)(struct secasvar *sav);
111 struct mbuf *(*ipsec_accel_key_setaccelif_p)(struct secasvar *sav);
112 void (*ipsec_accel_on_ifdown_p)(struct ifnet *ifp);
113 void (*ipsec_accel_drv_sa_lifetime_update_p)(struct secasvar *sav, if_t ifp,
114 u_int drv_spi, uint64_t octets, uint64_t allocs);
115 int (*ipsec_accel_drv_sa_lifetime_fetch_p)(struct secasvar *sav, if_t ifp,
116 u_int drv_spi, uint64_t *octets, uint64_t *allocs);
117 bool (*ipsec_accel_fill_xh_p)(if_t ifp, uint32_t drv_spi,
118 struct xform_history *xh);
119 #endif
120
121 #define FULLMASK 0xff
122 #define _BITS(bytes) ((bytes) << 3)
123
124 #define UINT32_80PCT 0xcccccccc
125 /*
126 * Note on SA reference counting:
127 * - SAs that are not in DEAD state will have (total external reference + 1)
128 * following value in reference count field. they cannot be freed and are
129 * referenced from SA header.
130 * - SAs that are in DEAD state will have (total external reference)
131 * in reference count field. they are ready to be freed. reference from
132 * SA header will be removed in key_delsav(), when the reference count
133 * field hits 0 (= no external reference other than from SA header.
134 */
135
136 VNET_DEFINE(u_int32_t, key_debug_level) = 0;
137 VNET_DEFINE_STATIC(u_int, key_spi_trycnt) = 1000;
138 VNET_DEFINE_STATIC(u_int32_t, key_spi_minval) = 0x100;
139 VNET_DEFINE_STATIC(u_int32_t, key_spi_maxval) = 0x0fffffff; /* XXX */
140 VNET_DEFINE_STATIC(u_int32_t, policy_id) = 0;
141 /*interval to initialize randseed,1(m)*/
142 VNET_DEFINE_STATIC(u_int, key_int_random) = 60;
143 /* interval to expire acquiring, 30(s)*/
144 VNET_DEFINE_STATIC(u_int, key_larval_lifetime) = 30;
145 /* counter for blocking SADB_ACQUIRE.*/
146 VNET_DEFINE_STATIC(int, key_blockacq_count) = 10;
147 /* lifetime for blocking SADB_ACQUIRE.*/
148 VNET_DEFINE_STATIC(int, key_blockacq_lifetime) = 20;
149 /* preferred old sa rather than new sa.*/
150 VNET_DEFINE_STATIC(int, key_preferred_oldsa) = 1;
151 #define V_key_spi_trycnt VNET(key_spi_trycnt)
152 #define V_key_spi_minval VNET(key_spi_minval)
153 #define V_key_spi_maxval VNET(key_spi_maxval)
154 #define V_policy_id VNET(policy_id)
155 #define V_key_int_random VNET(key_int_random)
156 #define V_key_larval_lifetime VNET(key_larval_lifetime)
157 #define V_key_blockacq_count VNET(key_blockacq_count)
158 #define V_key_blockacq_lifetime VNET(key_blockacq_lifetime)
159 #define V_key_preferred_oldsa VNET(key_preferred_oldsa)
160
161 VNET_DEFINE_STATIC(u_int32_t, acq_seq) = 0;
162 #define V_acq_seq VNET(acq_seq)
163
164 VNET_DEFINE_STATIC(uint32_t, sp_genid) = 0;
165 #define V_sp_genid VNET(sp_genid)
166
167 /* SPD */
168 TAILQ_HEAD(secpolicy_queue, secpolicy);
169 LIST_HEAD(secpolicy_list, secpolicy);
170 VNET_DEFINE_STATIC(struct secpolicy_queue, sptree[IPSEC_DIR_MAX]);
171 VNET_DEFINE_STATIC(struct secpolicy_queue, sptree_ifnet[IPSEC_DIR_MAX]);
172 static struct rmlock sptree_lock;
173 #define V_sptree VNET(sptree)
174 #define V_sptree_ifnet VNET(sptree_ifnet)
175 #define SPTREE_LOCK_INIT() rm_init(&sptree_lock, "sptree")
176 #define SPTREE_LOCK_DESTROY() rm_destroy(&sptree_lock)
177 #define SPTREE_RLOCK_TRACKER struct rm_priotracker sptree_tracker
178 #define SPTREE_RLOCK() rm_rlock(&sptree_lock, &sptree_tracker)
179 #define SPTREE_RUNLOCK() rm_runlock(&sptree_lock, &sptree_tracker)
180 #define SPTREE_RLOCK_ASSERT() rm_assert(&sptree_lock, RA_RLOCKED)
181 #define SPTREE_WLOCK() rm_wlock(&sptree_lock)
182 #define SPTREE_WUNLOCK() rm_wunlock(&sptree_lock)
183 #define SPTREE_WLOCK_ASSERT() rm_assert(&sptree_lock, RA_WLOCKED)
184 #define SPTREE_UNLOCK_ASSERT() rm_assert(&sptree_lock, RA_UNLOCKED)
185
186 /* Hash table for lookup SP using unique id */
187 VNET_DEFINE_STATIC(struct secpolicy_list *, sphashtbl);
188 VNET_DEFINE_STATIC(u_long, sphash_mask);
189 #define V_sphashtbl VNET(sphashtbl)
190 #define V_sphash_mask VNET(sphash_mask)
191
192 #define SPHASH_NHASH_LOG2 7
193 #define SPHASH_NHASH (1 << SPHASH_NHASH_LOG2)
194 #define SPHASH_HASHVAL(id) (key_u32hash(id) & V_sphash_mask)
195 #define SPHASH_HASH(id) &V_sphashtbl[SPHASH_HASHVAL(id)]
196
197 /* SPD cache */
198 struct spdcache_entry {
199 struct secpolicyindex spidx; /* secpolicyindex */
200 struct secpolicy *sp; /* cached policy to be used */
201
202 LIST_ENTRY(spdcache_entry) chain;
203 };
204 LIST_HEAD(spdcache_entry_list, spdcache_entry);
205
206 #define SPDCACHE_MAX_ENTRIES_PER_HASH 8
207
208 VNET_DEFINE_STATIC(u_int, key_spdcache_maxentries) = 0;
209 #define V_key_spdcache_maxentries VNET(key_spdcache_maxentries)
210 VNET_DEFINE_STATIC(u_int, key_spdcache_threshold) = 32;
211 #define V_key_spdcache_threshold VNET(key_spdcache_threshold)
212 VNET_DEFINE_STATIC(unsigned long, spd_size) = 0;
213 #define V_spd_size VNET(spd_size)
214
215 #define SPDCACHE_ENABLED() (V_key_spdcache_maxentries != 0)
216 #define SPDCACHE_ACTIVE() \
217 (SPDCACHE_ENABLED() && V_spd_size >= V_key_spdcache_threshold)
218
219 VNET_DEFINE_STATIC(struct spdcache_entry_list *, spdcachehashtbl);
220 VNET_DEFINE_STATIC(u_long, spdcachehash_mask);
221 #define V_spdcachehashtbl VNET(spdcachehashtbl)
222 #define V_spdcachehash_mask VNET(spdcachehash_mask)
223
224 #define SPDCACHE_HASHVAL(idx) \
225 (key_addrprotohash(&(idx)->src, &(idx)->dst, &(idx)->ul_proto) & \
226 V_spdcachehash_mask)
227
228 /* Each cache line is protected by a mutex */
229 VNET_DEFINE_STATIC(struct mtx *, spdcache_lock);
230 #define V_spdcache_lock VNET(spdcache_lock)
231
232 #define SPDCACHE_LOCK_INIT(a) \
233 mtx_init(&V_spdcache_lock[a], "spdcache", \
234 "fast ipsec SPD cache", MTX_DEF|MTX_DUPOK)
235 #define SPDCACHE_LOCK_DESTROY(a) mtx_destroy(&V_spdcache_lock[a])
236 #define SPDCACHE_LOCK(a) mtx_lock(&V_spdcache_lock[a]);
237 #define SPDCACHE_UNLOCK(a) mtx_unlock(&V_spdcache_lock[a]);
238
239 static struct sx spi_alloc_lock;
240 #define SPI_ALLOC_LOCK_INIT() sx_init(&spi_alloc_lock, "spialloc")
241 #define SPI_ALLOC_LOCK_DESTROY() sx_destroy(&spi_alloc_lock)
242 #define SPI_ALLOC_LOCK() sx_xlock(&spi_alloc_lock)
243 #define SPI_ALLOC_UNLOCK() sx_unlock(&spi_alloc_lock)
244 #define SPI_ALLOC_LOCK_ASSERT() sx_assert(&spi_alloc_lock, SA_XLOCKED)
245
246 /* SAD */
247 TAILQ_HEAD(secashead_queue, secashead);
248 LIST_HEAD(secashead_list, secashead);
249 VNET_DEFINE_STATIC(struct secashead_queue, sahtree);
250 static struct rmlock sahtree_lock;
251 #define V_sahtree VNET(sahtree)
252 #define SAHTREE_LOCK_INIT() rm_init(&sahtree_lock, "sahtree")
253 #define SAHTREE_LOCK_DESTROY() rm_destroy(&sahtree_lock)
254 #define SAHTREE_RLOCK_TRACKER struct rm_priotracker sahtree_tracker
255 #define SAHTREE_RLOCK() rm_rlock(&sahtree_lock, &sahtree_tracker)
256 #define SAHTREE_RUNLOCK() rm_runlock(&sahtree_lock, &sahtree_tracker)
257 #define SAHTREE_RLOCK_ASSERT() rm_assert(&sahtree_lock, RA_RLOCKED)
258 #define SAHTREE_WLOCK() rm_wlock(&sahtree_lock)
259 #define SAHTREE_WUNLOCK() rm_wunlock(&sahtree_lock)
260 #define SAHTREE_WLOCK_ASSERT() rm_assert(&sahtree_lock, RA_WLOCKED)
261 #define SAHTREE_UNLOCK_ASSERT() rm_assert(&sahtree_lock, RA_UNLOCKED)
262
263 /* Hash table for lookup in SAD using SA addresses */
264 VNET_DEFINE_STATIC(struct secashead_list *, sahaddrhashtbl);
265 VNET_DEFINE_STATIC(u_long, sahaddrhash_mask);
266 #define V_sahaddrhashtbl VNET(sahaddrhashtbl)
267 #define V_sahaddrhash_mask VNET(sahaddrhash_mask)
268
269 #define SAHHASH_NHASH_LOG2 7
270 #define SAHHASH_NHASH (1 << SAHHASH_NHASH_LOG2)
271 #define SAHADDRHASH_HASHVAL(idx) \
272 (key_addrprotohash(&(idx)->src, &(idx)->dst, &(idx)->proto) & \
273 V_sahaddrhash_mask)
274 #define SAHADDRHASH_HASH(saidx) \
275 &V_sahaddrhashtbl[SAHADDRHASH_HASHVAL(saidx)]
276
277 /* Hash table for lookup in SAD using SPI */
278 LIST_HEAD(secasvar_list, secasvar);
279 VNET_DEFINE_STATIC(struct secasvar_list *, savhashtbl);
280 VNET_DEFINE_STATIC(u_long, savhash_mask);
281 #define V_savhashtbl VNET(savhashtbl)
282 #define V_savhash_mask VNET(savhash_mask)
283 #define SAVHASH_NHASH_LOG2 7
284 #define SAVHASH_NHASH (1 << SAVHASH_NHASH_LOG2)
285 #define SAVHASH_HASHVAL(spi) (key_u32hash(spi) & V_savhash_mask)
286 #define SAVHASH_HASH(spi) &V_savhashtbl[SAVHASH_HASHVAL(spi)]
287
288 static uint32_t
key_addrprotohash(const union sockaddr_union * src,const union sockaddr_union * dst,const uint8_t * proto)289 key_addrprotohash(const union sockaddr_union *src,
290 const union sockaddr_union *dst, const uint8_t *proto)
291 {
292 uint32_t hval;
293
294 hval = fnv_32_buf(proto, sizeof(*proto),
295 FNV1_32_INIT);
296 switch (dst->sa.sa_family) {
297 #ifdef INET
298 case AF_INET:
299 hval = fnv_32_buf(&src->sin.sin_addr,
300 sizeof(in_addr_t), hval);
301 hval = fnv_32_buf(&dst->sin.sin_addr,
302 sizeof(in_addr_t), hval);
303 break;
304 #endif
305 #ifdef INET6
306 case AF_INET6:
307 hval = fnv_32_buf(&src->sin6.sin6_addr,
308 sizeof(struct in6_addr), hval);
309 hval = fnv_32_buf(&dst->sin6.sin6_addr,
310 sizeof(struct in6_addr), hval);
311 break;
312 #endif
313 default:
314 hval = 0;
315 ipseclog((LOG_DEBUG, "%s: unknown address family %d\n",
316 __func__, dst->sa.sa_family));
317 }
318 return (hval);
319 }
320
321 static uint32_t
key_u32hash(uint32_t val)322 key_u32hash(uint32_t val)
323 {
324
325 return (fnv_32_buf(&val, sizeof(val), FNV1_32_INIT));
326 }
327
328 /* registed list */
329 VNET_DEFINE_STATIC(LIST_HEAD(_regtree, secreg), regtree[SADB_SATYPE_MAX + 1]);
330 #define V_regtree VNET(regtree)
331 static struct mtx regtree_lock;
332 #define REGTREE_LOCK_INIT() \
333 mtx_init(®tree_lock, "regtree", "fast ipsec regtree", MTX_DEF)
334 #define REGTREE_LOCK_DESTROY() mtx_destroy(®tree_lock)
335 #define REGTREE_LOCK() mtx_lock(®tree_lock)
336 #define REGTREE_UNLOCK() mtx_unlock(®tree_lock)
337 #define REGTREE_LOCK_ASSERT() mtx_assert(®tree_lock, MA_OWNED)
338
339 /* Acquiring list */
340 LIST_HEAD(secacq_list, secacq);
341 VNET_DEFINE_STATIC(struct secacq_list, acqtree);
342 #define V_acqtree VNET(acqtree)
343 static struct mtx acq_lock;
344 #define ACQ_LOCK_INIT() \
345 mtx_init(&acq_lock, "acqtree", "ipsec SA acquiring list", MTX_DEF)
346 #define ACQ_LOCK_DESTROY() mtx_destroy(&acq_lock)
347 #define ACQ_LOCK() mtx_lock(&acq_lock)
348 #define ACQ_UNLOCK() mtx_unlock(&acq_lock)
349 #define ACQ_LOCK_ASSERT() mtx_assert(&acq_lock, MA_OWNED)
350
351 /* Hash table for lookup in ACQ list using SA addresses */
352 VNET_DEFINE_STATIC(struct secacq_list *, acqaddrhashtbl);
353 VNET_DEFINE_STATIC(u_long, acqaddrhash_mask);
354 #define V_acqaddrhashtbl VNET(acqaddrhashtbl)
355 #define V_acqaddrhash_mask VNET(acqaddrhash_mask)
356
357 /* Hash table for lookup in ACQ list using SEQ number */
358 VNET_DEFINE_STATIC(struct secacq_list *, acqseqhashtbl);
359 VNET_DEFINE_STATIC(u_long, acqseqhash_mask);
360 #define V_acqseqhashtbl VNET(acqseqhashtbl)
361 #define V_acqseqhash_mask VNET(acqseqhash_mask)
362
363 #define ACQHASH_NHASH_LOG2 7
364 #define ACQHASH_NHASH (1 << ACQHASH_NHASH_LOG2)
365 #define ACQADDRHASH_HASHVAL(idx) \
366 (key_addrprotohash(&(idx)->src, &(idx)->dst, &(idx)->proto) & \
367 V_acqaddrhash_mask)
368 #define ACQSEQHASH_HASHVAL(seq) \
369 (key_u32hash(seq) & V_acqseqhash_mask)
370 #define ACQADDRHASH_HASH(saidx) \
371 &V_acqaddrhashtbl[ACQADDRHASH_HASHVAL(saidx)]
372 #define ACQSEQHASH_HASH(seq) \
373 &V_acqseqhashtbl[ACQSEQHASH_HASHVAL(seq)]
374 /* SP acquiring list */
375 VNET_DEFINE_STATIC(LIST_HEAD(_spacqtree, secspacq), spacqtree);
376 #define V_spacqtree VNET(spacqtree)
377 static struct mtx spacq_lock;
378 #define SPACQ_LOCK_INIT() \
379 mtx_init(&spacq_lock, "spacqtree", \
380 "fast ipsec security policy acquire list", MTX_DEF)
381 #define SPACQ_LOCK_DESTROY() mtx_destroy(&spacq_lock)
382 #define SPACQ_LOCK() mtx_lock(&spacq_lock)
383 #define SPACQ_UNLOCK() mtx_unlock(&spacq_lock)
384 #define SPACQ_LOCK_ASSERT() mtx_assert(&spacq_lock, MA_OWNED)
385
386 static const int minsize[] = {
387 [SADB_EXT_RESERVED] = sizeof(struct sadb_msg),
388 [SADB_EXT_SA] = sizeof(struct sadb_sa),
389 [SADB_EXT_LIFETIME_CURRENT] = sizeof(struct sadb_lifetime),
390 [SADB_EXT_LIFETIME_HARD] = sizeof(struct sadb_lifetime),
391 [SADB_EXT_LIFETIME_SOFT] = sizeof(struct sadb_lifetime),
392 [SADB_EXT_ADDRESS_SRC] = sizeof(struct sadb_address),
393 [SADB_EXT_ADDRESS_DST] = sizeof(struct sadb_address),
394 [SADB_EXT_ADDRESS_PROXY] = sizeof(struct sadb_address),
395 [SADB_EXT_KEY_AUTH] = sizeof(struct sadb_key),
396 [SADB_EXT_KEY_ENCRYPT] = sizeof(struct sadb_key),
397 [SADB_EXT_IDENTITY_SRC] = sizeof(struct sadb_ident),
398 [SADB_EXT_IDENTITY_DST] = sizeof(struct sadb_ident),
399 [SADB_EXT_SENSITIVITY] = sizeof(struct sadb_sens),
400 [SADB_EXT_PROPOSAL] = sizeof(struct sadb_prop),
401 [SADB_EXT_SUPPORTED_AUTH] = sizeof(struct sadb_supported),
402 [SADB_EXT_SUPPORTED_ENCRYPT] = sizeof(struct sadb_supported),
403 [SADB_EXT_SPIRANGE] = sizeof(struct sadb_spirange),
404 [SADB_X_EXT_KMPRIVATE] = 0,
405 [SADB_X_EXT_POLICY] = sizeof(struct sadb_x_policy),
406 [SADB_X_EXT_SA2] = sizeof(struct sadb_x_sa2),
407 [SADB_X_EXT_NAT_T_TYPE] = sizeof(struct sadb_x_nat_t_type),
408 [SADB_X_EXT_NAT_T_SPORT] = sizeof(struct sadb_x_nat_t_port),
409 [SADB_X_EXT_NAT_T_DPORT] = sizeof(struct sadb_x_nat_t_port),
410 [SADB_X_EXT_NAT_T_OAI] = sizeof(struct sadb_address),
411 [SADB_X_EXT_NAT_T_OAR] = sizeof(struct sadb_address),
412 [SADB_X_EXT_NAT_T_FRAG] = sizeof(struct sadb_x_nat_t_frag),
413 [SADB_X_EXT_SA_REPLAY] = sizeof(struct sadb_x_sa_replay),
414 [SADB_X_EXT_NEW_ADDRESS_SRC] = sizeof(struct sadb_address),
415 [SADB_X_EXT_NEW_ADDRESS_DST] = sizeof(struct sadb_address),
416 [SADB_X_EXT_LFT_CUR_SW_OFFL] = sizeof(struct sadb_lifetime),
417 [SADB_X_EXT_LFT_CUR_HW_OFFL] = sizeof(struct sadb_lifetime),
418 [SADB_X_EXT_IF_HW_OFFL] = sizeof(struct sadb_x_if_hw_offl),
419 };
420 _Static_assert(nitems(minsize) == SADB_EXT_MAX + 1, "minsize size mismatch");
421
422 static const int maxsize[] = {
423 [SADB_EXT_RESERVED] = sizeof(struct sadb_msg),
424 [SADB_EXT_SA] = sizeof(struct sadb_sa),
425 [SADB_EXT_LIFETIME_CURRENT] = sizeof(struct sadb_lifetime),
426 [SADB_EXT_LIFETIME_HARD] = sizeof(struct sadb_lifetime),
427 [SADB_EXT_LIFETIME_SOFT] = sizeof(struct sadb_lifetime),
428 [SADB_EXT_ADDRESS_SRC] = 0,
429 [SADB_EXT_ADDRESS_DST] = 0,
430 [SADB_EXT_ADDRESS_PROXY] = 0,
431 [SADB_EXT_KEY_AUTH] = 0,
432 [SADB_EXT_KEY_ENCRYPT] = 0,
433 [SADB_EXT_IDENTITY_SRC] = 0,
434 [SADB_EXT_IDENTITY_DST] = 0,
435 [SADB_EXT_SENSITIVITY] = 0,
436 [SADB_EXT_PROPOSAL] = 0,
437 [SADB_EXT_SUPPORTED_AUTH] = 0,
438 [SADB_EXT_SUPPORTED_ENCRYPT] = 0,
439 [SADB_EXT_SPIRANGE] = sizeof(struct sadb_spirange),
440 [SADB_X_EXT_KMPRIVATE] = 0,
441 [SADB_X_EXT_POLICY] = 0,
442 [SADB_X_EXT_SA2] = sizeof(struct sadb_x_sa2),
443 [SADB_X_EXT_NAT_T_TYPE] = sizeof(struct sadb_x_nat_t_type),
444 [SADB_X_EXT_NAT_T_SPORT] = sizeof(struct sadb_x_nat_t_port),
445 [SADB_X_EXT_NAT_T_DPORT] = sizeof(struct sadb_x_nat_t_port),
446 [SADB_X_EXT_NAT_T_OAI] = 0,
447 [SADB_X_EXT_NAT_T_OAR] = 0,
448 [SADB_X_EXT_NAT_T_FRAG] = sizeof(struct sadb_x_nat_t_frag),
449 [SADB_X_EXT_SA_REPLAY] = sizeof(struct sadb_x_sa_replay),
450 [SADB_X_EXT_NEW_ADDRESS_SRC] = 0,
451 [SADB_X_EXT_NEW_ADDRESS_DST] = 0,
452 [SADB_X_EXT_LFT_CUR_SW_OFFL] = sizeof(struct sadb_lifetime),
453 [SADB_X_EXT_LFT_CUR_HW_OFFL] = sizeof(struct sadb_lifetime),
454 [SADB_X_EXT_IF_HW_OFFL] = sizeof(struct sadb_x_if_hw_offl),
455 };
456 _Static_assert(nitems(maxsize) == SADB_EXT_MAX + 1, "maxsize size mismatch");
457
458 /*
459 * Internal values for SA flags:
460 * SADB_X_EXT_F_CLONED means that SA was cloned by key_updateaddresses,
461 * thus we will not free the most of SA content in key_delsav().
462 */
463 #define SADB_X_EXT_F_CLONED 0x80000000
464
465 #define SADB_CHECKLEN(_mhp, _ext) \
466 ((_mhp)->extlen[(_ext)] < minsize[(_ext)] || (maxsize[(_ext)] != 0 && \
467 ((_mhp)->extlen[(_ext)] > maxsize[(_ext)])))
468 #define SADB_CHECKHDR(_mhp, _ext) ((_mhp)->ext[(_ext)] == NULL)
469
470 VNET_DEFINE_STATIC(int, ipsec_esp_keymin) = 256;
471 VNET_DEFINE_STATIC(int, ipsec_esp_auth) = 0;
472 VNET_DEFINE_STATIC(int, ipsec_ah_keymin) = 128;
473
474 #define V_ipsec_esp_keymin VNET(ipsec_esp_keymin)
475 #define V_ipsec_esp_auth VNET(ipsec_esp_auth)
476 #define V_ipsec_ah_keymin VNET(ipsec_ah_keymin)
477
478 #ifdef IPSEC_DEBUG
479 VNET_DEFINE(int, ipsec_debug) = 1;
480 #else
481 VNET_DEFINE(int, ipsec_debug) = 0;
482 #endif
483
484 #ifdef INET
485 SYSCTL_DECL(_net_inet_ipsec);
486 SYSCTL_INT(_net_inet_ipsec, IPSECCTL_DEBUG, debug,
487 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ipsec_debug), 0,
488 "Enable IPsec debugging output when set.");
489 #endif
490 #ifdef INET6
491 SYSCTL_DECL(_net_inet6_ipsec6);
492 SYSCTL_INT(_net_inet6_ipsec6, IPSECCTL_DEBUG, debug,
493 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ipsec_debug), 0,
494 "Enable IPsec debugging output when set.");
495 #endif
496
497 SYSCTL_INT(_net_key, KEYCTL_DEBUG_LEVEL, debug,
498 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(key_debug_level), 0, "");
499
500 /* max count of trial for the decision of spi value */
501 SYSCTL_INT(_net_key, KEYCTL_SPI_TRY, spi_trycnt,
502 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(key_spi_trycnt), 0, "");
503
504 /* minimum spi value to allocate automatically. */
505 SYSCTL_INT(_net_key, KEYCTL_SPI_MIN_VALUE, spi_minval,
506 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(key_spi_minval), 0, "");
507
508 /* maximun spi value to allocate automatically. */
509 SYSCTL_INT(_net_key, KEYCTL_SPI_MAX_VALUE, spi_maxval,
510 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(key_spi_maxval), 0, "");
511
512 /* interval to initialize randseed */
513 SYSCTL_INT(_net_key, KEYCTL_RANDOM_INT, int_random,
514 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(key_int_random), 0, "");
515
516 /* lifetime for larval SA */
517 SYSCTL_INT(_net_key, KEYCTL_LARVAL_LIFETIME, larval_lifetime,
518 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(key_larval_lifetime), 0, "");
519
520 /* counter for blocking to send SADB_ACQUIRE to IKEd */
521 SYSCTL_INT(_net_key, KEYCTL_BLOCKACQ_COUNT, blockacq_count,
522 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(key_blockacq_count), 0, "");
523
524 /* lifetime for blocking to send SADB_ACQUIRE to IKEd */
525 SYSCTL_INT(_net_key, KEYCTL_BLOCKACQ_LIFETIME, blockacq_lifetime,
526 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(key_blockacq_lifetime), 0, "");
527
528 /* ESP auth */
529 SYSCTL_INT(_net_key, KEYCTL_ESP_AUTH, esp_auth,
530 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ipsec_esp_auth), 0, "");
531
532 /* minimum ESP key length */
533 SYSCTL_INT(_net_key, KEYCTL_ESP_KEYMIN, esp_keymin,
534 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ipsec_esp_keymin), 0, "");
535
536 /* minimum AH key length */
537 SYSCTL_INT(_net_key, KEYCTL_AH_KEYMIN, ah_keymin,
538 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ipsec_ah_keymin), 0, "");
539
540 /* perfered old SA rather than new SA */
541 SYSCTL_INT(_net_key, KEYCTL_PREFERED_OLDSA, preferred_oldsa,
542 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(key_preferred_oldsa), 0, "");
543
544 SYSCTL_NODE(_net_key, OID_AUTO, spdcache, CTLFLAG_RW | CTLFLAG_MPSAFE, 0,
545 "SPD cache");
546
547 SYSCTL_UINT(_net_key_spdcache, OID_AUTO, maxentries,
548 CTLFLAG_VNET | CTLFLAG_RDTUN, &VNET_NAME(key_spdcache_maxentries), 0,
549 "Maximum number of entries in the SPD cache"
550 " (power of 2, 0 to disable)");
551
552 SYSCTL_UINT(_net_key_spdcache, OID_AUTO, threshold,
553 CTLFLAG_VNET | CTLFLAG_RDTUN, &VNET_NAME(key_spdcache_threshold), 0,
554 "Number of SPs that make the SPD cache active");
555
556 #define __LIST_CHAINED(elm) \
557 (!((elm)->chain.le_next == NULL && (elm)->chain.le_prev == NULL))
558
559 MALLOC_DEFINE(M_IPSEC_SA, "secasvar", "ipsec security association");
560 MALLOC_DEFINE(M_IPSEC_SAH, "sahead", "ipsec sa head");
561 MALLOC_DEFINE(M_IPSEC_SP, "ipsecpolicy", "ipsec security policy");
562 MALLOC_DEFINE(M_IPSEC_SR, "ipsecrequest", "ipsec security request");
563 MALLOC_DEFINE(M_IPSEC_MISC, "ipsec-misc", "ipsec miscellaneous");
564 MALLOC_DEFINE(M_IPSEC_SAQ, "ipsec-saq", "ipsec sa acquire");
565 MALLOC_DEFINE(M_IPSEC_SAR, "ipsec-reg", "ipsec sa acquire");
566 MALLOC_DEFINE(M_IPSEC_SPDCACHE, "ipsec-spdcache", "ipsec SPD cache");
567
568 static uma_zone_t __read_mostly ipsec_key_lft_zone;
569
570 static int key_checksockaddrs(const struct sockaddr *src,
571 const struct sockaddr *dst);
572
573 /*
574 * set parameters into secpolicyindex buffer.
575 * Must allocate secpolicyindex buffer passed to this function.
576 */
577 static void
key_setsecspidx(uint8_t dir,const void * s,const void * d,uint8_t prefs,uint8_t prefd,uint8_t ul_proto,struct secpolicyindex * idx)578 key_setsecspidx(uint8_t dir, const void *s, const void *d, uint8_t prefs,
579 uint8_t prefd, uint8_t ul_proto, struct secpolicyindex *idx)
580 {
581 MPASS(key_checksockaddrs((const struct sockaddr *)s,
582 (const struct sockaddr *)d) == 0);
583
584 memset(idx, 0, sizeof(*idx));
585 idx->dir = dir;
586 idx->prefs = prefs;
587 idx->prefd = prefd;
588 idx->ul_proto = ul_proto;
589 memcpy(&idx->src, s, ((const struct sockaddr *)s)->sa_len);
590 memcpy(&idx->dst, d, ((const struct sockaddr *)d)->sa_len);
591 }
592
593 /*
594 * set parameters into secasindex buffer.
595 * Must allocate secasindex buffer before calling this function.
596 */
597 static void
key_setsecasidx(uint8_t proto,uint8_t mode,uint32_t reqid,const void * s,const void * d,struct secasindex * idx)598 key_setsecasidx(uint8_t proto, uint8_t mode, uint32_t reqid,
599 const void *s, const void *d, struct secasindex *idx)
600 {
601 MPASS(key_checksockaddrs((const struct sockaddr *)s,
602 (const struct sockaddr *)d) == 0);
603
604 memset(idx, 0, sizeof(*idx));
605 idx->proto = proto;
606 idx->mode = mode;
607 idx->reqid = reqid;
608 memcpy(&idx->src, s, ((const struct sockaddr *)s)->sa_len);
609 memcpy(&idx->dst, d, ((const struct sockaddr *)d)->sa_len);
610 key_porttosaddr(&idx->src.sa, 0);
611 key_porttosaddr(&idx->dst.sa, 0);
612 }
613
614 /* key statistics */
615 struct _keystat {
616 u_long getspi_count; /* the avarage of count to try to get new SPI */
617 } keystat;
618
619 struct sadb_msghdr {
620 struct sadb_msg *msg;
621 struct sadb_ext *ext[SADB_EXT_MAX + 1];
622 int extoff[SADB_EXT_MAX + 1];
623 int extlen[SADB_EXT_MAX + 1];
624 };
625
626 static const struct supported_ealgs {
627 int sadb_alg;
628 const struct enc_xform *xform;
629 } supported_ealgs[] = {
630 { SADB_X_EALG_AES, &enc_xform_aes_cbc },
631 { SADB_EALG_NULL, &enc_xform_null },
632 { SADB_X_EALG_AESCTR, &enc_xform_aes_icm },
633 { SADB_X_EALG_AESGCM16, &enc_xform_aes_nist_gcm },
634 { SADB_X_EALG_AESGMAC, &enc_xform_aes_nist_gmac },
635 { SADB_X_EALG_CHACHA20POLY1305, &enc_xform_chacha20_poly1305 },
636 };
637
638 static const struct supported_aalgs {
639 int sadb_alg;
640 const struct auth_hash *xform;
641 } supported_aalgs[] = {
642 { SADB_X_AALG_NULL, &auth_hash_null },
643 { SADB_AALG_SHA1HMAC, &auth_hash_hmac_sha1 },
644 { SADB_X_AALG_SHA2_256, &auth_hash_hmac_sha2_256 },
645 { SADB_X_AALG_SHA2_384, &auth_hash_hmac_sha2_384 },
646 { SADB_X_AALG_SHA2_512, &auth_hash_hmac_sha2_512 },
647 { SADB_X_AALG_AES128GMAC, &auth_hash_nist_gmac_aes_128 },
648 { SADB_X_AALG_AES192GMAC, &auth_hash_nist_gmac_aes_192 },
649 { SADB_X_AALG_AES256GMAC, &auth_hash_nist_gmac_aes_256 },
650 { SADB_X_AALG_CHACHA20POLY1305, &auth_hash_poly1305 },
651 };
652
653 static const struct supported_calgs {
654 int sadb_alg;
655 const struct comp_algo *xform;
656 } supported_calgs[] = {
657 { SADB_X_CALG_DEFLATE, &comp_algo_deflate },
658 };
659
660 #ifndef IPSEC_DEBUG2
661 static struct callout key_timer;
662 #endif
663
664 static void key_unlink(struct secpolicy *);
665 static void key_detach(struct secpolicy *);
666 static struct secpolicy *key_getsp(struct secpolicyindex *);
667 static struct secpolicy *key_getspbyid(u_int32_t);
668 static struct mbuf *key_gather_mbuf(struct mbuf *,
669 const struct sadb_msghdr *, int, int, ...);
670 static int key_spdadd(struct socket *, struct mbuf *,
671 const struct sadb_msghdr *);
672 static uint32_t key_getnewspid(void);
673 static int key_spddelete(struct socket *, struct mbuf *,
674 const struct sadb_msghdr *);
675 static int key_spddelete2(struct socket *, struct mbuf *,
676 const struct sadb_msghdr *);
677 static int key_spdget(struct socket *, struct mbuf *,
678 const struct sadb_msghdr *);
679 static int key_spdflush(struct socket *, struct mbuf *,
680 const struct sadb_msghdr *);
681 static int key_spddump(struct socket *, struct mbuf *,
682 const struct sadb_msghdr *);
683 static struct mbuf *key_setdumpsp(struct secpolicy *,
684 u_int8_t, u_int32_t, u_int32_t);
685 static struct mbuf *key_sp2mbuf(struct secpolicy *);
686 static size_t key_getspreqmsglen(struct secpolicy *);
687 static int key_spdexpire(struct secpolicy *);
688 static struct secashead *key_newsah(struct secasindex *);
689 static void key_freesah(struct secashead **);
690 static void key_delsah(struct secashead *);
691 static struct secasvar *key_newsav(const struct sadb_msghdr *,
692 struct secasindex *, uint32_t, int *);
693 static void key_delsav(struct secasvar *);
694 static void key_unlinksav(struct secasvar *);
695 static struct secashead *key_getsah(struct secasindex *);
696 static int key_checkspidup(uint32_t);
697 static struct secasvar *key_getsavbyspi(uint32_t);
698 static int key_setnatt(struct secasvar *, const struct sadb_msghdr *);
699 static int key_setsaval(struct secasvar *, const struct sadb_msghdr *);
700 static int key_updatelifetimes(struct secasvar *, const struct sadb_msghdr *);
701 static int key_updateaddresses(struct socket *, struct mbuf *,
702 const struct sadb_msghdr *, struct secasvar *, struct secasindex *);
703
704 static struct mbuf *key_setdumpsa(struct secasvar *, u_int8_t,
705 u_int8_t, u_int32_t, u_int32_t, struct rm_priotracker *);
706 static struct mbuf *key_setsadbmsg(u_int8_t, u_int16_t, u_int8_t,
707 u_int32_t, pid_t, u_int16_t);
708 static struct mbuf *key_setsadbsa(struct secasvar *);
709 static struct mbuf *key_setsadbaddr(u_int16_t,
710 const struct sockaddr *, u_int8_t, u_int16_t);
711 static struct mbuf *key_setsadbxport(u_int16_t, u_int16_t);
712 static struct mbuf *key_setsadbxtype(u_int16_t);
713 static struct mbuf *key_setsadbxsa2(u_int8_t, u_int32_t, u_int32_t);
714 static struct mbuf *key_setsadbxsareplay(u_int32_t);
715 static struct mbuf *key_setsadbxpolicy(u_int16_t, u_int8_t,
716 u_int32_t, u_int32_t);
717 static struct seckey *key_dup_keymsg(const struct sadb_key *,
718 struct malloc_type *);
719 static struct seclifetime *key_dup_lifemsg(const struct sadb_lifetime *src,
720 struct malloc_type *);
721
722 /* flags for key_cmpsaidx() */
723 #define CMP_HEAD 1 /* protocol, addresses. */
724 #define CMP_MODE_REQID 2 /* additionally HEAD, reqid, mode. */
725 #define CMP_REQID 3 /* additionally HEAD, reaid. */
726 #define CMP_EXACTLY 4 /* all elements. */
727 static int key_cmpsaidx(const struct secasindex *,
728 const struct secasindex *, int);
729 static int key_cmpspidx_exactly(struct secpolicyindex *,
730 struct secpolicyindex *);
731 static int key_cmpspidx_withmask(struct secpolicyindex *,
732 struct secpolicyindex *);
733 static int key_bbcmp(const void *, const void *, u_int);
734 static uint8_t key_satype2proto(uint8_t);
735 static uint8_t key_proto2satype(uint8_t);
736
737 static int key_getspi(struct socket *, struct mbuf *,
738 const struct sadb_msghdr *);
739 static uint32_t key_do_getnewspi(struct sadb_spirange *, struct secasindex *);
740 static int key_update(struct socket *, struct mbuf *,
741 const struct sadb_msghdr *);
742 static int key_add(struct socket *, struct mbuf *,
743 const struct sadb_msghdr *);
744 static int key_setident(struct secashead *, const struct sadb_msghdr *);
745 static struct mbuf *key_getmsgbuf_x1(struct mbuf *,
746 const struct sadb_msghdr *);
747 static int key_delete(struct socket *, struct mbuf *,
748 const struct sadb_msghdr *);
749 static int key_delete_all(struct socket *, struct mbuf *,
750 const struct sadb_msghdr *, struct secasindex *);
751 static int key_get(struct socket *, struct mbuf *,
752 const struct sadb_msghdr *);
753
754 static void key_getcomb_setlifetime(struct sadb_comb *);
755 static struct mbuf *key_getcomb_ealg(void);
756 static struct mbuf *key_getcomb_ah(void);
757 static struct mbuf *key_getcomb_ipcomp(void);
758 static struct mbuf *key_getprop(const struct secasindex *);
759
760 static int key_acquire(const struct secasindex *, struct secpolicy *);
761 static uint32_t key_newacq(const struct secasindex *, int *);
762 static uint32_t key_getacq(const struct secasindex *, int *);
763 static int key_acqdone(const struct secasindex *, uint32_t);
764 static int key_acqreset(uint32_t);
765 static struct secspacq *key_newspacq(struct secpolicyindex *);
766 static struct secspacq *key_getspacq(struct secpolicyindex *);
767 static int key_acquire2(struct socket *, struct mbuf *,
768 const struct sadb_msghdr *);
769 static int key_register(struct socket *, struct mbuf *,
770 const struct sadb_msghdr *);
771 static int key_expire(struct secasvar *, int);
772 static int key_flush(struct socket *, struct mbuf *,
773 const struct sadb_msghdr *);
774 static int key_dump(struct socket *, struct mbuf *,
775 const struct sadb_msghdr *);
776 static int key_promisc(struct socket *, struct mbuf *,
777 const struct sadb_msghdr *);
778 static int key_senderror(struct socket *, struct mbuf *, int);
779 static int key_validate_ext(const struct sadb_ext *, int);
780 static int key_align(struct mbuf *, struct sadb_msghdr *);
781 static struct mbuf *key_setlifetime(struct seclifetime *, uint16_t);
782 static struct mbuf *key_setkey(struct seckey *, uint16_t);
783
784 static void spdcache_init(void);
785 static void spdcache_clear(void);
786 static struct spdcache_entry *spdcache_entry_alloc(
787 const struct secpolicyindex *spidx,
788 struct secpolicy *policy);
789 static void spdcache_entry_free(struct spdcache_entry *entry);
790 #ifdef VIMAGE
791 static void spdcache_destroy(void);
792 #endif
793
794 #define DBG_IPSEC_INITREF(t, p) do { \
795 refcount_init(&(p)->refcnt, 1); \
796 KEYDBG(KEY_STAMP, \
797 printf("%s: Initialize refcnt %s(%p) = %u\n", \
798 __func__, #t, (p), (p)->refcnt)); \
799 } while (0)
800 #define DBG_IPSEC_ADDREF(t, p) do { \
801 refcount_acquire(&(p)->refcnt); \
802 KEYDBG(KEY_STAMP, \
803 printf("%s: Acquire refcnt %s(%p) -> %u\n", \
804 __func__, #t, (p), (p)->refcnt)); \
805 } while (0)
806 #define DBG_IPSEC_DELREF(t, p) do { \
807 KEYDBG(KEY_STAMP, \
808 printf("%s: Release refcnt %s(%p) -> %u\n", \
809 __func__, #t, (p), (p)->refcnt - 1)); \
810 refcount_release(&(p)->refcnt); \
811 } while (0)
812
813 #define IPSEC_INITREF(t, p) refcount_init(&(p)->refcnt, 1)
814 #define IPSEC_ADDREF(t, p) refcount_acquire(&(p)->refcnt)
815 #define IPSEC_DELREF(t, p) refcount_release(&(p)->refcnt)
816
817 #define SP_INITREF(p) IPSEC_INITREF(SP, p)
818 #define SP_ADDREF(p) IPSEC_ADDREF(SP, p)
819 #define SP_DELREF(p) IPSEC_DELREF(SP, p)
820
821 #define SAH_INITREF(p) IPSEC_INITREF(SAH, p)
822 #define SAH_ADDREF(p) IPSEC_ADDREF(SAH, p)
823 #define SAH_DELREF(p) IPSEC_DELREF(SAH, p)
824
825 #define SAV_INITREF(p) IPSEC_INITREF(SAV, p)
826 #define SAV_ADDREF(p) IPSEC_ADDREF(SAV, p)
827 #define SAV_DELREF(p) IPSEC_DELREF(SAV, p)
828
829 /*
830 * Update the refcnt while holding the SPTREE lock.
831 */
832 void
key_addref(struct secpolicy * sp)833 key_addref(struct secpolicy *sp)
834 {
835
836 SP_ADDREF(sp);
837 }
838
839 /*
840 * Return 0 when there are known to be no SP's for the specified
841 * direction. Otherwise return 1. This is used by IPsec code
842 * to optimize performance.
843 */
844 int
key_havesp(u_int dir)845 key_havesp(u_int dir)
846 {
847
848 IPSEC_ASSERT(dir == IPSEC_DIR_INBOUND || dir == IPSEC_DIR_OUTBOUND,
849 ("invalid direction %u", dir));
850 return (TAILQ_FIRST(&V_sptree[dir]) != NULL);
851 }
852
853 int
key_havesp_any(void)854 key_havesp_any(void)
855 {
856
857 return (V_spd_size != 0);
858 }
859
860 /*
861 * Allocate a single mbuf with a buffer of the desired length. The buffer is
862 * pre-zeroed to help ensure that uninitialized pad bytes are not leaked.
863 */
864 static struct mbuf *
key_mget(u_int len)865 key_mget(u_int len)
866 {
867 struct mbuf *m;
868
869 KASSERT(len <= MCLBYTES,
870 ("%s: invalid buffer length %u", __func__, len));
871
872 m = m_get2(len, M_NOWAIT, MT_DATA, M_PKTHDR);
873 if (m == NULL)
874 return (NULL);
875 memset(mtod(m, void *), 0, len);
876 return (m);
877 }
878
879 /* %%% IPsec policy management */
880 /*
881 * Return current SPDB generation.
882 */
883 uint32_t
key_getspgen(void)884 key_getspgen(void)
885 {
886
887 return (V_sp_genid);
888 }
889
890 void
key_bumpspgen(void)891 key_bumpspgen(void)
892 {
893
894 V_sp_genid++;
895 }
896
897 static int
key_checksockaddrs(const struct sockaddr * src,const struct sockaddr * dst)898 key_checksockaddrs(const struct sockaddr *src, const struct sockaddr *dst)
899 {
900
901 /* family match */
902 if (src->sa_family != dst->sa_family)
903 return (EINVAL);
904 /* sa_len match */
905 if (src->sa_len != dst->sa_len)
906 return (EINVAL);
907 switch (src->sa_family) {
908 #ifdef INET
909 case AF_INET:
910 if (src->sa_len != sizeof(struct sockaddr_in))
911 return (EINVAL);
912 break;
913 #endif
914 #ifdef INET6
915 case AF_INET6:
916 if (src->sa_len != sizeof(struct sockaddr_in6))
917 return (EINVAL);
918 break;
919 #endif
920 default:
921 return (EAFNOSUPPORT);
922 }
923 return (0);
924 }
925
926 struct secpolicy *
key_do_allocsp(struct secpolicyindex * spidx,u_int dir)927 key_do_allocsp(struct secpolicyindex *spidx, u_int dir)
928 {
929 SPTREE_RLOCK_TRACKER;
930 struct secpolicy *sp;
931
932 IPSEC_ASSERT(spidx != NULL, ("null spidx"));
933 IPSEC_ASSERT(dir == IPSEC_DIR_INBOUND || dir == IPSEC_DIR_OUTBOUND,
934 ("invalid direction %u", dir));
935
936 SPTREE_RLOCK();
937 TAILQ_FOREACH(sp, &V_sptree[dir], chain) {
938 if (key_cmpspidx_withmask(&sp->spidx, spidx)) {
939 SP_ADDREF(sp);
940 break;
941 }
942 }
943 SPTREE_RUNLOCK();
944 return (sp);
945 }
946
947 /*
948 * allocating a SP for OUTBOUND or INBOUND packet.
949 * Must call key_freesp() later.
950 * OUT: NULL: not found
951 * others: found and return the pointer.
952 */
953 struct secpolicy *
key_allocsp(struct secpolicyindex * spidx,u_int dir)954 key_allocsp(struct secpolicyindex *spidx, u_int dir)
955 {
956 struct spdcache_entry *entry, *lastentry, *tmpentry;
957 struct secpolicy *sp;
958 uint32_t hashv;
959 time_t ts;
960 int nb_entries;
961
962 if (!SPDCACHE_ACTIVE()) {
963 sp = key_do_allocsp(spidx, dir);
964 goto out;
965 }
966
967 hashv = SPDCACHE_HASHVAL(spidx);
968 SPDCACHE_LOCK(hashv);
969 nb_entries = 0;
970 LIST_FOREACH_SAFE(entry, &V_spdcachehashtbl[hashv], chain, tmpentry) {
971 /* Removed outdated entries */
972 if (entry->sp != NULL &&
973 entry->sp->state == IPSEC_SPSTATE_DEAD) {
974 LIST_REMOVE(entry, chain);
975 spdcache_entry_free(entry);
976 continue;
977 }
978
979 nb_entries++;
980 if (!key_cmpspidx_exactly(&entry->spidx, spidx)) {
981 lastentry = entry;
982 continue;
983 }
984
985 sp = entry->sp;
986 if (entry->sp != NULL)
987 SP_ADDREF(sp);
988
989 /* IPSECSTAT_INC(ips_spdcache_hits); */
990
991 SPDCACHE_UNLOCK(hashv);
992 goto out;
993 }
994
995 /* IPSECSTAT_INC(ips_spdcache_misses); */
996
997 sp = key_do_allocsp(spidx, dir);
998 entry = spdcache_entry_alloc(spidx, sp);
999 if (entry != NULL) {
1000 if (nb_entries >= SPDCACHE_MAX_ENTRIES_PER_HASH) {
1001 LIST_REMOVE(lastentry, chain);
1002 spdcache_entry_free(lastentry);
1003 }
1004
1005 LIST_INSERT_HEAD(&V_spdcachehashtbl[hashv], entry, chain);
1006 }
1007
1008 SPDCACHE_UNLOCK(hashv);
1009
1010 out:
1011 if (sp != NULL) { /* found a SPD entry */
1012 ts = time_second;
1013 if (__predict_false(sp->lastused != ts))
1014 sp->lastused = ts;
1015 KEYDBG(IPSEC_STAMP,
1016 printf("%s: return SP(%p)\n", __func__, sp));
1017 KEYDBG(IPSEC_DATA, kdebug_secpolicy(sp));
1018 } else {
1019 KEYDBG(IPSEC_DATA,
1020 printf("%s: lookup failed for ", __func__);
1021 kdebug_secpolicyindex(spidx, NULL));
1022 }
1023 return (sp);
1024 }
1025
1026 /*
1027 * Allocating an SA entry for an *INBOUND* or *OUTBOUND* TCP packet, signed
1028 * or should be signed by MD5 signature.
1029 * We don't use key_allocsa() for such lookups, because we don't know SPI.
1030 * Unlike ESP and AH protocols, SPI isn't transmitted in the TCP header with
1031 * signed packet. We use SADB only as storage for password.
1032 * OUT: positive: corresponding SA for given saidx found.
1033 * NULL: SA not found
1034 */
1035 struct secasvar *
key_allocsa_tcpmd5(struct secasindex * saidx)1036 key_allocsa_tcpmd5(struct secasindex *saidx)
1037 {
1038 SAHTREE_RLOCK_TRACKER;
1039 struct secashead *sah;
1040 struct secasvar *sav;
1041
1042 IPSEC_ASSERT(saidx->proto == IPPROTO_TCP,
1043 ("unexpected security protocol %u", saidx->proto));
1044 IPSEC_ASSERT(saidx->mode == IPSEC_MODE_TCPMD5,
1045 ("unexpected mode %u", saidx->mode));
1046
1047 SAHTREE_RLOCK();
1048 LIST_FOREACH(sah, SAHADDRHASH_HASH(saidx), addrhash) {
1049 KEYDBG(IPSEC_DUMP,
1050 printf("%s: checking SAH\n", __func__);
1051 kdebug_secash(sah, " "));
1052 if (sah->saidx.proto != IPPROTO_TCP)
1053 continue;
1054 if (!key_sockaddrcmp(&saidx->dst.sa, &sah->saidx.dst.sa, 0) &&
1055 !key_sockaddrcmp(&saidx->src.sa, &sah->saidx.src.sa, 0))
1056 break;
1057 }
1058 if (sah != NULL) {
1059 if (V_key_preferred_oldsa)
1060 sav = TAILQ_LAST(&sah->savtree_alive, secasvar_queue);
1061 else
1062 sav = TAILQ_FIRST(&sah->savtree_alive);
1063 if (sav != NULL)
1064 SAV_ADDREF(sav);
1065 } else
1066 sav = NULL;
1067 SAHTREE_RUNLOCK();
1068
1069 if (sav != NULL) {
1070 KEYDBG(IPSEC_STAMP,
1071 printf("%s: return SA(%p)\n", __func__, sav));
1072 KEYDBG(IPSEC_DATA, kdebug_secasv(sav));
1073 } else {
1074 KEYDBG(IPSEC_STAMP,
1075 printf("%s: SA not found\n", __func__));
1076 KEYDBG(IPSEC_DATA, kdebug_secasindex(saidx, NULL));
1077 }
1078 return (sav);
1079 }
1080
1081 /*
1082 * Allocating an SA entry for an *OUTBOUND* packet.
1083 * OUT: positive: corresponding SA for given saidx found.
1084 * NULL: SA not found, but will be acquired, check *error
1085 * for acquiring status.
1086 */
1087 struct secasvar *
key_allocsa_policy(struct secpolicy * sp,const struct secasindex * saidx,int * error)1088 key_allocsa_policy(struct secpolicy *sp, const struct secasindex *saidx,
1089 int *error)
1090 {
1091 SAHTREE_RLOCK_TRACKER;
1092 struct secashead *sah;
1093 struct secasvar *sav;
1094
1095 IPSEC_ASSERT(saidx != NULL, ("null saidx"));
1096 IPSEC_ASSERT(saidx->mode == IPSEC_MODE_TRANSPORT ||
1097 saidx->mode == IPSEC_MODE_TUNNEL,
1098 ("unexpected policy %u", saidx->mode));
1099
1100 /*
1101 * We check new SA in the IPsec request because a different
1102 * SA may be involved each time this request is checked, either
1103 * because new SAs are being configured, or this request is
1104 * associated with an unconnected datagram socket, or this request
1105 * is associated with a system default policy.
1106 */
1107 SAHTREE_RLOCK();
1108 LIST_FOREACH(sah, SAHADDRHASH_HASH(saidx), addrhash) {
1109 KEYDBG(IPSEC_DUMP,
1110 printf("%s: checking SAH\n", __func__);
1111 kdebug_secash(sah, " "));
1112 if (key_cmpsaidx(&sah->saidx, saidx, CMP_MODE_REQID))
1113 break;
1114 }
1115 if (sah != NULL) {
1116 /*
1117 * Allocate the oldest SA available according to
1118 * draft-jenkins-ipsec-rekeying-03.
1119 */
1120 if (V_key_preferred_oldsa)
1121 sav = TAILQ_LAST(&sah->savtree_alive, secasvar_queue);
1122 else
1123 sav = TAILQ_FIRST(&sah->savtree_alive);
1124 if (sav != NULL)
1125 SAV_ADDREF(sav);
1126 } else
1127 sav = NULL;
1128 SAHTREE_RUNLOCK();
1129
1130 if (sav != NULL) {
1131 *error = 0;
1132 KEYDBG(IPSEC_STAMP,
1133 printf("%s: chosen SA(%p) for SP(%p)\n", __func__,
1134 sav, sp));
1135 KEYDBG(IPSEC_DATA, kdebug_secasv(sav));
1136 return (sav); /* return referenced SA */
1137 }
1138
1139 /* there is no SA */
1140 *error = key_acquire(saidx, sp);
1141 if ((*error) != 0)
1142 ipseclog((LOG_DEBUG,
1143 "%s: error %d returned from key_acquire()\n",
1144 __func__, *error));
1145 KEYDBG(IPSEC_STAMP,
1146 printf("%s: acquire SA for SP(%p), error %d\n",
1147 __func__, sp, *error));
1148 KEYDBG(IPSEC_DATA, kdebug_secasindex(saidx, NULL));
1149 return (NULL);
1150 }
1151
1152 /*
1153 * allocating a usable SA entry for a *INBOUND* packet.
1154 * Must call key_freesav() later.
1155 * OUT: positive: pointer to a usable sav (i.e. MATURE or DYING state).
1156 * NULL: not found, or error occurred.
1157 *
1158 * According to RFC 2401 SA is uniquely identified by a triple SPI,
1159 * destination address, and security protocol. But according to RFC 4301,
1160 * SPI by itself suffices to specify an SA.
1161 *
1162 * Note that, however, we do need to keep source address in IPsec SA.
1163 * IKE specification and PF_KEY specification do assume that we
1164 * keep source address in IPsec SA. We see a tricky situation here.
1165 */
1166 struct secasvar *
key_allocsa(union sockaddr_union * dst,uint8_t proto,uint32_t spi)1167 key_allocsa(union sockaddr_union *dst, uint8_t proto, uint32_t spi)
1168 {
1169 SAHTREE_RLOCK_TRACKER;
1170 struct secasvar *sav;
1171
1172 IPSEC_ASSERT(proto == IPPROTO_ESP || proto == IPPROTO_AH ||
1173 proto == IPPROTO_IPCOMP, ("unexpected security protocol %u",
1174 proto));
1175
1176 SAHTREE_RLOCK();
1177 LIST_FOREACH(sav, SAVHASH_HASH(spi), spihash) {
1178 if (sav->spi == spi)
1179 break;
1180 }
1181 /*
1182 * We use single SPI namespace for all protocols, so it is
1183 * impossible to have SPI duplicates in the SAVHASH.
1184 */
1185 if (sav != NULL) {
1186 if (sav->state != SADB_SASTATE_LARVAL &&
1187 sav->sah->saidx.proto == proto &&
1188 key_sockaddrcmp(&dst->sa,
1189 &sav->sah->saidx.dst.sa, 0) == 0)
1190 SAV_ADDREF(sav);
1191 else
1192 sav = NULL;
1193 }
1194 SAHTREE_RUNLOCK();
1195
1196 if (sav == NULL) {
1197 KEYDBG(IPSEC_STAMP,
1198 char buf[IPSEC_ADDRSTRLEN];
1199 printf("%s: SA not found for spi %u proto %u dst %s\n",
1200 __func__, ntohl(spi), proto, ipsec_address(dst, buf,
1201 sizeof(buf))));
1202 } else {
1203 KEYDBG(IPSEC_STAMP,
1204 printf("%s: return SA(%p)\n", __func__, sav));
1205 KEYDBG(IPSEC_DATA, kdebug_secasv(sav));
1206 }
1207 return (sav);
1208 }
1209
1210 struct secasvar *
key_allocsa_tunnel(union sockaddr_union * src,union sockaddr_union * dst,uint8_t proto)1211 key_allocsa_tunnel(union sockaddr_union *src, union sockaddr_union *dst,
1212 uint8_t proto)
1213 {
1214 SAHTREE_RLOCK_TRACKER;
1215 struct secasindex saidx;
1216 struct secashead *sah;
1217 struct secasvar *sav;
1218
1219 IPSEC_ASSERT(src != NULL, ("null src address"));
1220 IPSEC_ASSERT(dst != NULL, ("null dst address"));
1221
1222 key_setsecasidx(proto, IPSEC_MODE_TUNNEL, 0, &src->sa,
1223 &dst->sa, &saidx);
1224
1225 sav = NULL;
1226 SAHTREE_RLOCK();
1227 LIST_FOREACH(sah, SAHADDRHASH_HASH(&saidx), addrhash) {
1228 if (IPSEC_MODE_TUNNEL != sah->saidx.mode)
1229 continue;
1230 if (proto != sah->saidx.proto)
1231 continue;
1232 if (key_sockaddrcmp(&src->sa, &sah->saidx.src.sa, 0) != 0)
1233 continue;
1234 if (key_sockaddrcmp(&dst->sa, &sah->saidx.dst.sa, 0) != 0)
1235 continue;
1236 /* XXXAE: is key_preferred_oldsa reasonably?*/
1237 if (V_key_preferred_oldsa)
1238 sav = TAILQ_LAST(&sah->savtree_alive, secasvar_queue);
1239 else
1240 sav = TAILQ_FIRST(&sah->savtree_alive);
1241 if (sav != NULL) {
1242 SAV_ADDREF(sav);
1243 break;
1244 }
1245 }
1246 SAHTREE_RUNLOCK();
1247 KEYDBG(IPSEC_STAMP,
1248 printf("%s: return SA(%p)\n", __func__, sav));
1249 if (sav != NULL)
1250 KEYDBG(IPSEC_DATA, kdebug_secasv(sav));
1251 return (sav);
1252 }
1253
1254 /*
1255 * Must be called after calling key_allocsp().
1256 */
1257 void
key_freesp(struct secpolicy ** spp)1258 key_freesp(struct secpolicy **spp)
1259 {
1260 struct secpolicy *sp = *spp;
1261
1262 IPSEC_ASSERT(sp != NULL, ("null sp"));
1263 if (SP_DELREF(sp) == 0)
1264 return;
1265
1266 KEYDBG(IPSEC_STAMP,
1267 printf("%s: last reference to SP(%p)\n", __func__, sp));
1268 KEYDBG(IPSEC_DATA, kdebug_secpolicy(sp));
1269
1270 *spp = NULL;
1271 #ifdef IPSEC_OFFLOAD
1272 KASSERT(CK_LIST_EMPTY(&sp->accel_ifps),
1273 ("key_freesp: sp %p still offloaded", sp));
1274 free(__DECONST(char *, sp->accel_ifname), M_IPSEC_MISC);
1275 #endif
1276 while (sp->tcount > 0)
1277 ipsec_delisr(sp->req[--sp->tcount]);
1278 free(sp, M_IPSEC_SP);
1279 }
1280
1281 static void
key_unlink(struct secpolicy * sp)1282 key_unlink(struct secpolicy *sp)
1283 {
1284 SPTREE_WLOCK();
1285 key_detach(sp);
1286 SPTREE_WUNLOCK();
1287 if (SPDCACHE_ENABLED())
1288 spdcache_clear();
1289 ipsec_accel_sync();
1290 key_freesp(&sp);
1291 }
1292
1293 static void
key_detach(struct secpolicy * sp)1294 key_detach(struct secpolicy *sp)
1295 {
1296 IPSEC_ASSERT(sp->spidx.dir == IPSEC_DIR_INBOUND ||
1297 sp->spidx.dir == IPSEC_DIR_OUTBOUND,
1298 ("invalid direction %u", sp->spidx.dir));
1299 SPTREE_WLOCK_ASSERT();
1300
1301 KEYDBG(KEY_STAMP,
1302 printf("%s: SP(%p)\n", __func__, sp));
1303 if (sp->state != IPSEC_SPSTATE_ALIVE) {
1304 /* SP is already unlinked */
1305 return;
1306 }
1307 sp->state = IPSEC_SPSTATE_DEAD;
1308 ipsec_accel_spddel(sp);
1309 TAILQ_REMOVE(&V_sptree[sp->spidx.dir], sp, chain);
1310 V_spd_size--;
1311 LIST_REMOVE(sp, idhash);
1312 V_sp_genid++;
1313 }
1314
1315 /*
1316 * insert a secpolicy into the SP database. Lower priorities first
1317 */
1318 static void
key_insertsp(struct secpolicy * newsp)1319 key_insertsp(struct secpolicy *newsp)
1320 {
1321 struct secpolicy *sp;
1322
1323 SPTREE_WLOCK_ASSERT();
1324 TAILQ_FOREACH(sp, &V_sptree[newsp->spidx.dir], chain) {
1325 if (newsp->priority < sp->priority) {
1326 TAILQ_INSERT_BEFORE(sp, newsp, chain);
1327 goto done;
1328 }
1329 }
1330 TAILQ_INSERT_TAIL(&V_sptree[newsp->spidx.dir], newsp, chain);
1331 done:
1332 LIST_INSERT_HEAD(SPHASH_HASH(newsp->id), newsp, idhash);
1333 newsp->state = IPSEC_SPSTATE_ALIVE;
1334 V_spd_size++;
1335 V_sp_genid++;
1336 ipsec_accel_spdadd(newsp, NULL);
1337 }
1338
1339 /*
1340 * Insert a bunch of VTI secpolicies into the SPDB.
1341 * We keep VTI policies in the separate list due to following reasons:
1342 * 1) they should be immutable to user's or some deamon's attempts to
1343 * delete. The only way delete such policies - destroy or unconfigure
1344 * corresponding virtual inteface.
1345 * 2) such policies have traffic selector that matches all traffic per
1346 * address family.
1347 * Since all VTI policies have the same priority, we don't care about
1348 * policies order.
1349 */
1350 int
key_register_ifnet(struct secpolicy ** spp,u_int count)1351 key_register_ifnet(struct secpolicy **spp, u_int count)
1352 {
1353 struct mbuf *m;
1354 u_int i;
1355
1356 SPTREE_WLOCK();
1357 /*
1358 * First of try to acquire id for each SP.
1359 */
1360 for (i = 0; i < count; i++) {
1361 IPSEC_ASSERT(spp[i]->spidx.dir == IPSEC_DIR_INBOUND ||
1362 spp[i]->spidx.dir == IPSEC_DIR_OUTBOUND,
1363 ("invalid direction %u", spp[i]->spidx.dir));
1364
1365 if ((spp[i]->id = key_getnewspid()) == 0) {
1366 SPTREE_WUNLOCK();
1367 return (EAGAIN);
1368 }
1369 }
1370 for (i = 0; i < count; i++) {
1371 TAILQ_INSERT_TAIL(&V_sptree_ifnet[spp[i]->spidx.dir],
1372 spp[i], chain);
1373 /*
1374 * NOTE: despite the fact that we keep VTI SP in the
1375 * separate list, SPHASH contains policies from both
1376 * sources. Thus SADB_X_SPDGET will correctly return
1377 * SP by id, because it uses SPHASH for lookups.
1378 */
1379 LIST_INSERT_HEAD(SPHASH_HASH(spp[i]->id), spp[i], idhash);
1380 spp[i]->state = IPSEC_SPSTATE_IFNET;
1381 ipsec_accel_spdadd(spp[i], NULL);
1382 }
1383 SPTREE_WUNLOCK();
1384 /*
1385 * Notify user processes about new SP.
1386 */
1387 for (i = 0; i < count; i++) {
1388 m = key_setdumpsp(spp[i], SADB_X_SPDADD, 0, 0);
1389 if (m != NULL)
1390 key_sendup_mbuf(NULL, m, KEY_SENDUP_ALL);
1391 }
1392 return (0);
1393 }
1394
1395 void
key_unregister_ifnet(struct secpolicy ** spp,u_int count)1396 key_unregister_ifnet(struct secpolicy **spp, u_int count)
1397 {
1398 struct mbuf *m;
1399 u_int i;
1400
1401 SPTREE_WLOCK();
1402 for (i = 0; i < count; i++) {
1403 IPSEC_ASSERT(spp[i]->spidx.dir == IPSEC_DIR_INBOUND ||
1404 spp[i]->spidx.dir == IPSEC_DIR_OUTBOUND,
1405 ("invalid direction %u", spp[i]->spidx.dir));
1406
1407 if (spp[i]->state != IPSEC_SPSTATE_IFNET)
1408 continue;
1409 spp[i]->state = IPSEC_SPSTATE_DEAD;
1410 ipsec_accel_spddel(spp[i]);
1411 TAILQ_REMOVE(&V_sptree_ifnet[spp[i]->spidx.dir],
1412 spp[i], chain);
1413 V_spd_size--;
1414 LIST_REMOVE(spp[i], idhash);
1415 }
1416 SPTREE_WUNLOCK();
1417 if (SPDCACHE_ENABLED())
1418 spdcache_clear();
1419 ipsec_accel_sync();
1420
1421 for (i = 0; i < count; i++) {
1422 m = key_setdumpsp(spp[i], SADB_X_SPDDELETE, 0, 0);
1423 if (m != NULL)
1424 key_sendup_mbuf(NULL, m, KEY_SENDUP_ALL);
1425 }
1426 }
1427
1428 /*
1429 * Must be called after calling key_allocsa().
1430 * This function is called by key_freesp() to free some SA allocated
1431 * for a policy.
1432 */
1433 void
key_freesav(struct secasvar ** psav)1434 key_freesav(struct secasvar **psav)
1435 {
1436 struct secasvar *sav = *psav;
1437
1438 IPSEC_ASSERT(sav != NULL, ("null sav"));
1439 CURVNET_ASSERT_SET();
1440 if (SAV_DELREF(sav) == 0)
1441 return;
1442
1443 KEYDBG(IPSEC_STAMP,
1444 printf("%s: last reference to SA(%p)\n", __func__, sav));
1445
1446 *psav = NULL;
1447 key_delsav(sav);
1448 }
1449
1450 /*
1451 * Unlink SA from SAH and SPI hash under SAHTREE_WLOCK.
1452 * Expect that SA has extra reference due to lookup.
1453 * Release this references, also release SAH reference after unlink.
1454 */
1455 static void
key_unlinksav(struct secasvar * sav)1456 key_unlinksav(struct secasvar *sav)
1457 {
1458 struct secashead *sah;
1459
1460 KEYDBG(KEY_STAMP,
1461 printf("%s: SA(%p)\n", __func__, sav));
1462
1463 CURVNET_ASSERT_SET();
1464 SAHTREE_UNLOCK_ASSERT();
1465 SAHTREE_WLOCK();
1466 if (sav->state == SADB_SASTATE_DEAD) {
1467 /* SA is already unlinked */
1468 SAHTREE_WUNLOCK();
1469 return;
1470 }
1471 /* Unlink from SAH */
1472 if (sav->state == SADB_SASTATE_LARVAL)
1473 TAILQ_REMOVE(&sav->sah->savtree_larval, sav, chain);
1474 else
1475 TAILQ_REMOVE(&sav->sah->savtree_alive, sav, chain);
1476 /* Unlink from SPI hash */
1477 LIST_REMOVE(sav, spihash);
1478 sav->state = SADB_SASTATE_DEAD;
1479 ipsec_accel_forget_sav(sav);
1480 sah = sav->sah;
1481 SAHTREE_WUNLOCK();
1482 key_freesav(&sav);
1483 /* Since we are unlinked, release reference to SAH */
1484 key_freesah(&sah);
1485 }
1486
1487 /* %%% SPD management */
1488 /*
1489 * search SPD
1490 * OUT: NULL : not found
1491 * others : found, pointer to a SP.
1492 */
1493 static struct secpolicy *
key_getsp(struct secpolicyindex * spidx)1494 key_getsp(struct secpolicyindex *spidx)
1495 {
1496 SPTREE_RLOCK_TRACKER;
1497 struct secpolicy *sp;
1498
1499 IPSEC_ASSERT(spidx != NULL, ("null spidx"));
1500
1501 SPTREE_RLOCK();
1502 TAILQ_FOREACH(sp, &V_sptree[spidx->dir], chain) {
1503 if (key_cmpspidx_exactly(spidx, &sp->spidx)) {
1504 SP_ADDREF(sp);
1505 break;
1506 }
1507 }
1508 SPTREE_RUNLOCK();
1509
1510 return sp;
1511 }
1512
1513 /*
1514 * get SP by index.
1515 * OUT: NULL : not found
1516 * others : found, pointer to referenced SP.
1517 */
1518 static struct secpolicy *
key_getspbyid(uint32_t id)1519 key_getspbyid(uint32_t id)
1520 {
1521 SPTREE_RLOCK_TRACKER;
1522 struct secpolicy *sp;
1523
1524 SPTREE_RLOCK();
1525 LIST_FOREACH(sp, SPHASH_HASH(id), idhash) {
1526 if (sp->id == id) {
1527 SP_ADDREF(sp);
1528 break;
1529 }
1530 }
1531 SPTREE_RUNLOCK();
1532 return (sp);
1533 }
1534
1535 struct secpolicy *
key_newsp(void)1536 key_newsp(void)
1537 {
1538 struct secpolicy *sp;
1539
1540 sp = malloc(sizeof(*sp), M_IPSEC_SP, M_NOWAIT | M_ZERO);
1541 if (sp != NULL)
1542 SP_INITREF(sp);
1543 return (sp);
1544 }
1545
1546 struct ipsecrequest *
ipsec_newisr(void)1547 ipsec_newisr(void)
1548 {
1549
1550 return (malloc(sizeof(struct ipsecrequest), M_IPSEC_SR,
1551 M_NOWAIT | M_ZERO));
1552 }
1553
1554 void
ipsec_delisr(struct ipsecrequest * p)1555 ipsec_delisr(struct ipsecrequest *p)
1556 {
1557
1558 free(p, M_IPSEC_SR);
1559 }
1560
1561 /*
1562 * create secpolicy structure from sadb_x_policy structure.
1563 * NOTE: `state', `secpolicyindex' and 'id' in secpolicy structure
1564 * are not set, so must be set properly later.
1565 */
1566 struct secpolicy *
key_msg2sp(struct sadb_x_policy * xpl0,size_t len,int * error)1567 key_msg2sp(struct sadb_x_policy *xpl0, size_t len, int *error)
1568 {
1569 struct secpolicy *newsp;
1570
1571 IPSEC_ASSERT(xpl0 != NULL, ("null xpl0"));
1572 IPSEC_ASSERT(len >= sizeof(*xpl0), ("policy too short: %zu", len));
1573
1574 if (len != PFKEY_EXTLEN(xpl0)) {
1575 ipseclog((LOG_DEBUG, "%s: Invalid msg length.\n", __func__));
1576 *error = EINVAL;
1577 return NULL;
1578 }
1579
1580 if ((newsp = key_newsp()) == NULL) {
1581 *error = ENOBUFS;
1582 return NULL;
1583 }
1584
1585 newsp->spidx.dir = xpl0->sadb_x_policy_dir;
1586 newsp->policy = xpl0->sadb_x_policy_type;
1587 newsp->priority = xpl0->sadb_x_policy_priority;
1588 newsp->tcount = 0;
1589
1590 /* check policy */
1591 switch (xpl0->sadb_x_policy_type) {
1592 case IPSEC_POLICY_DISCARD:
1593 case IPSEC_POLICY_NONE:
1594 case IPSEC_POLICY_ENTRUST:
1595 case IPSEC_POLICY_BYPASS:
1596 break;
1597
1598 case IPSEC_POLICY_IPSEC:
1599 {
1600 struct sadb_x_ipsecrequest *xisr;
1601 struct ipsecrequest *isr;
1602 int tlen;
1603
1604 /* validity check */
1605 if (PFKEY_EXTLEN(xpl0) < sizeof(*xpl0)) {
1606 ipseclog((LOG_DEBUG, "%s: Invalid msg length.\n",
1607 __func__));
1608 key_freesp(&newsp);
1609 *error = EINVAL;
1610 return NULL;
1611 }
1612
1613 tlen = PFKEY_EXTLEN(xpl0) - sizeof(*xpl0);
1614 xisr = (struct sadb_x_ipsecrequest *)(xpl0 + 1);
1615
1616 while (tlen > 0) {
1617 /* length check */
1618 if (xisr->sadb_x_ipsecrequest_len < sizeof(*xisr) ||
1619 xisr->sadb_x_ipsecrequest_len > tlen) {
1620 ipseclog((LOG_DEBUG, "%s: invalid ipsecrequest "
1621 "length.\n", __func__));
1622 key_freesp(&newsp);
1623 *error = EINVAL;
1624 return NULL;
1625 }
1626
1627 if (newsp->tcount >= IPSEC_MAXREQ) {
1628 ipseclog((LOG_DEBUG,
1629 "%s: too many ipsecrequests.\n",
1630 __func__));
1631 key_freesp(&newsp);
1632 *error = EINVAL;
1633 return (NULL);
1634 }
1635
1636 /* allocate request buffer */
1637 /* NB: data structure is zero'd */
1638 isr = ipsec_newisr();
1639 if (isr == NULL) {
1640 ipseclog((LOG_DEBUG,
1641 "%s: No more memory.\n", __func__));
1642 key_freesp(&newsp);
1643 *error = ENOBUFS;
1644 return NULL;
1645 }
1646
1647 newsp->req[newsp->tcount++] = isr;
1648
1649 /* set values */
1650 switch (xisr->sadb_x_ipsecrequest_proto) {
1651 case IPPROTO_ESP:
1652 case IPPROTO_AH:
1653 case IPPROTO_IPCOMP:
1654 break;
1655 default:
1656 ipseclog((LOG_DEBUG,
1657 "%s: invalid proto type=%u\n", __func__,
1658 xisr->sadb_x_ipsecrequest_proto));
1659 key_freesp(&newsp);
1660 *error = EPROTONOSUPPORT;
1661 return NULL;
1662 }
1663 isr->saidx.proto =
1664 (uint8_t)xisr->sadb_x_ipsecrequest_proto;
1665
1666 switch (xisr->sadb_x_ipsecrequest_mode) {
1667 case IPSEC_MODE_TRANSPORT:
1668 case IPSEC_MODE_TUNNEL:
1669 break;
1670 case IPSEC_MODE_ANY:
1671 default:
1672 ipseclog((LOG_DEBUG,
1673 "%s: invalid mode=%u\n", __func__,
1674 xisr->sadb_x_ipsecrequest_mode));
1675 key_freesp(&newsp);
1676 *error = EINVAL;
1677 return NULL;
1678 }
1679 isr->saidx.mode = xisr->sadb_x_ipsecrequest_mode;
1680
1681 switch (xisr->sadb_x_ipsecrequest_level) {
1682 case IPSEC_LEVEL_DEFAULT:
1683 case IPSEC_LEVEL_USE:
1684 case IPSEC_LEVEL_REQUIRE:
1685 break;
1686 case IPSEC_LEVEL_UNIQUE:
1687 /* validity check */
1688 /*
1689 * If range violation of reqid, kernel will
1690 * update it, don't refuse it.
1691 */
1692 if (xisr->sadb_x_ipsecrequest_reqid
1693 > IPSEC_MANUAL_REQID_MAX) {
1694 ipseclog((LOG_DEBUG,
1695 "%s: reqid=%d range "
1696 "violation, updated by kernel.\n",
1697 __func__,
1698 xisr->sadb_x_ipsecrequest_reqid));
1699 xisr->sadb_x_ipsecrequest_reqid = 0;
1700 }
1701
1702 /* allocate new reqid id if reqid is zero. */
1703 if (xisr->sadb_x_ipsecrequest_reqid == 0) {
1704 u_int32_t reqid;
1705 if ((reqid = key_newreqid()) == 0) {
1706 key_freesp(&newsp);
1707 *error = ENOBUFS;
1708 return NULL;
1709 }
1710 isr->saidx.reqid = reqid;
1711 xisr->sadb_x_ipsecrequest_reqid = reqid;
1712 } else {
1713 /* set it for manual keying. */
1714 isr->saidx.reqid =
1715 xisr->sadb_x_ipsecrequest_reqid;
1716 }
1717 break;
1718
1719 default:
1720 ipseclog((LOG_DEBUG, "%s: invalid level=%u\n",
1721 __func__,
1722 xisr->sadb_x_ipsecrequest_level));
1723 key_freesp(&newsp);
1724 *error = EINVAL;
1725 return NULL;
1726 }
1727 isr->level = xisr->sadb_x_ipsecrequest_level;
1728
1729 /* set IP addresses if there */
1730 if (xisr->sadb_x_ipsecrequest_len > sizeof(*xisr)) {
1731 struct sockaddr *paddr;
1732
1733 len = tlen - sizeof(*xisr);
1734 paddr = (struct sockaddr *)(xisr + 1);
1735 /* validity check */
1736 if (len < sizeof(struct sockaddr) ||
1737 len < 2 * paddr->sa_len ||
1738 paddr->sa_len > sizeof(isr->saidx.src)) {
1739 ipseclog((LOG_DEBUG, "%s: invalid "
1740 "request address length.\n",
1741 __func__));
1742 key_freesp(&newsp);
1743 *error = EINVAL;
1744 return NULL;
1745 }
1746 /*
1747 * Request length should be enough to keep
1748 * source and destination addresses.
1749 */
1750 if (xisr->sadb_x_ipsecrequest_len <
1751 sizeof(*xisr) + 2 * paddr->sa_len) {
1752 ipseclog((LOG_DEBUG, "%s: invalid "
1753 "ipsecrequest length.\n",
1754 __func__));
1755 key_freesp(&newsp);
1756 *error = EINVAL;
1757 return (NULL);
1758 }
1759 bcopy(paddr, &isr->saidx.src, paddr->sa_len);
1760 paddr = (struct sockaddr *)((caddr_t)paddr +
1761 paddr->sa_len);
1762
1763 /* validity check */
1764 if (paddr->sa_len !=
1765 isr->saidx.src.sa.sa_len) {
1766 ipseclog((LOG_DEBUG, "%s: invalid "
1767 "request address length.\n",
1768 __func__));
1769 key_freesp(&newsp);
1770 *error = EINVAL;
1771 return NULL;
1772 }
1773 /* AF family should match */
1774 if (paddr->sa_family !=
1775 isr->saidx.src.sa.sa_family) {
1776 ipseclog((LOG_DEBUG, "%s: address "
1777 "family doesn't match.\n",
1778 __func__));
1779 key_freesp(&newsp);
1780 *error = EINVAL;
1781 return (NULL);
1782 }
1783 bcopy(paddr, &isr->saidx.dst, paddr->sa_len);
1784 } else {
1785 /*
1786 * Addresses for TUNNEL mode requests are
1787 * mandatory.
1788 */
1789 if (isr->saidx.mode == IPSEC_MODE_TUNNEL) {
1790 ipseclog((LOG_DEBUG, "%s: missing "
1791 "request addresses.\n", __func__));
1792 key_freesp(&newsp);
1793 *error = EINVAL;
1794 return (NULL);
1795 }
1796 }
1797 tlen -= xisr->sadb_x_ipsecrequest_len;
1798
1799 /* validity check */
1800 if (tlen < 0) {
1801 ipseclog((LOG_DEBUG, "%s: becoming tlen < 0.\n",
1802 __func__));
1803 key_freesp(&newsp);
1804 *error = EINVAL;
1805 return NULL;
1806 }
1807
1808 xisr = (struct sadb_x_ipsecrequest *)((caddr_t)xisr
1809 + xisr->sadb_x_ipsecrequest_len);
1810 }
1811 /* XXXAE: LARVAL SP */
1812 if (newsp->tcount < 1) {
1813 ipseclog((LOG_DEBUG, "%s: valid IPSEC transforms "
1814 "not found.\n", __func__));
1815 key_freesp(&newsp);
1816 *error = EINVAL;
1817 return (NULL);
1818 }
1819 }
1820 break;
1821 default:
1822 ipseclog((LOG_DEBUG, "%s: invalid policy type.\n", __func__));
1823 key_freesp(&newsp);
1824 *error = EINVAL;
1825 return NULL;
1826 }
1827
1828 *error = 0;
1829 return (newsp);
1830 }
1831
1832 uint32_t
key_newreqid(void)1833 key_newreqid(void)
1834 {
1835 static uint32_t auto_reqid = IPSEC_MANUAL_REQID_MAX + 1;
1836
1837 if (auto_reqid == ~0)
1838 auto_reqid = IPSEC_MANUAL_REQID_MAX + 1;
1839 else
1840 auto_reqid++;
1841
1842 /* XXX should be unique check */
1843 return (auto_reqid);
1844 }
1845
1846 /*
1847 * copy secpolicy struct to sadb_x_policy structure indicated.
1848 */
1849 static struct mbuf *
key_sp2mbuf(struct secpolicy * sp)1850 key_sp2mbuf(struct secpolicy *sp)
1851 {
1852 struct mbuf *m;
1853 size_t tlen;
1854
1855 tlen = key_getspreqmsglen(sp);
1856 m = m_get2(tlen, M_NOWAIT, MT_DATA, 0);
1857 if (m == NULL)
1858 return (NULL);
1859 m_align(m, tlen);
1860 m->m_len = tlen;
1861 if (key_sp2msg(sp, m->m_data, &tlen) != 0) {
1862 m_freem(m);
1863 return (NULL);
1864 }
1865 return (m);
1866 }
1867
1868 int
key_sp2msg(struct secpolicy * sp,void * request,size_t * len)1869 key_sp2msg(struct secpolicy *sp, void *request, size_t *len)
1870 {
1871 struct sadb_x_ipsecrequest *xisr;
1872 struct sadb_x_policy *xpl;
1873 struct ipsecrequest *isr;
1874 size_t xlen, ilen;
1875 caddr_t p;
1876 int error, i;
1877 #ifdef IPSEC_OFFLOAD
1878 struct sadb_x_if_hw_offl *xif;
1879 #endif
1880
1881 IPSEC_ASSERT(sp != NULL, ("null policy"));
1882
1883 xlen = sizeof(*xpl);
1884 if (*len < xlen)
1885 return (EINVAL);
1886
1887 error = 0;
1888 bzero(request, *len);
1889 xpl = (struct sadb_x_policy *)request;
1890 xpl->sadb_x_policy_exttype = SADB_X_EXT_POLICY;
1891 xpl->sadb_x_policy_type = sp->policy;
1892 xpl->sadb_x_policy_dir = sp->spidx.dir;
1893 xpl->sadb_x_policy_id = sp->id;
1894 xpl->sadb_x_policy_priority = sp->priority;
1895 switch (sp->state) {
1896 case IPSEC_SPSTATE_IFNET:
1897 xpl->sadb_x_policy_scope = IPSEC_POLICYSCOPE_IFNET;
1898 break;
1899 case IPSEC_SPSTATE_PCB:
1900 xpl->sadb_x_policy_scope = IPSEC_POLICYSCOPE_PCB;
1901 break;
1902 default:
1903 xpl->sadb_x_policy_scope = IPSEC_POLICYSCOPE_GLOBAL;
1904 }
1905
1906 /* if is the policy for ipsec ? */
1907 if (sp->policy == IPSEC_POLICY_IPSEC) {
1908 p = (caddr_t)xpl + sizeof(*xpl);
1909 for (i = 0; i < sp->tcount; i++) {
1910 isr = sp->req[i];
1911 ilen = PFKEY_ALIGN8(sizeof(*xisr) +
1912 isr->saidx.src.sa.sa_len +
1913 isr->saidx.dst.sa.sa_len);
1914 xlen += ilen;
1915 if (xlen > *len) {
1916 error = ENOBUFS;
1917 /* Calculate needed size */
1918 continue;
1919 }
1920 xisr = (struct sadb_x_ipsecrequest *)p;
1921 xisr->sadb_x_ipsecrequest_len = ilen;
1922 xisr->sadb_x_ipsecrequest_proto = isr->saidx.proto;
1923 xisr->sadb_x_ipsecrequest_mode = isr->saidx.mode;
1924 xisr->sadb_x_ipsecrequest_level = isr->level;
1925 xisr->sadb_x_ipsecrequest_reqid = isr->saidx.reqid;
1926
1927 p += sizeof(*xisr);
1928 bcopy(&isr->saidx.src, p, isr->saidx.src.sa.sa_len);
1929 p += isr->saidx.src.sa.sa_len;
1930 bcopy(&isr->saidx.dst, p, isr->saidx.dst.sa.sa_len);
1931 p += isr->saidx.dst.sa.sa_len;
1932 }
1933 }
1934 xpl->sadb_x_policy_len = PFKEY_UNIT64(xlen);
1935 #ifdef IPSEC_OFFLOAD
1936 if (error == 0 && sp->accel_ifname != NULL) {
1937 xif = (struct sadb_x_if_hw_offl *)(xpl + 1);
1938 bzero(xif, sizeof(*xif));
1939 xif->sadb_x_if_hw_offl_len = PFKEY_UNIT64(sizeof(*xif));
1940 xif->sadb_x_if_hw_offl_exttype = SADB_X_EXT_IF_HW_OFFL;
1941 xif->sadb_x_if_hw_offl_flags = 0;
1942 strncpy(xif->sadb_x_if_hw_offl_if, sp->accel_ifname,
1943 sizeof(xif->sadb_x_if_hw_offl_if));
1944 xlen += sizeof(*xif);
1945 }
1946 #endif
1947 if (error == 0)
1948 *len = xlen;
1949 else
1950 *len = sizeof(*xpl);
1951 return (error);
1952 }
1953
1954 /* m will not be freed nor modified */
1955 static struct mbuf *
key_gather_mbuf(struct mbuf * m,const struct sadb_msghdr * mhp,int ndeep,int nitem,...)1956 key_gather_mbuf(struct mbuf *m, const struct sadb_msghdr *mhp,
1957 int ndeep, int nitem, ...)
1958 {
1959 va_list ap;
1960 int idx;
1961 int i;
1962 struct mbuf *result = NULL, *n;
1963 int len;
1964
1965 IPSEC_ASSERT(m != NULL, ("null mbuf"));
1966 IPSEC_ASSERT(mhp != NULL, ("null msghdr"));
1967
1968 va_start(ap, nitem);
1969 for (i = 0; i < nitem; i++) {
1970 idx = va_arg(ap, int);
1971 if (idx < 0 || idx > SADB_EXT_MAX)
1972 goto fail;
1973 /* don't attempt to pull empty extension */
1974 if (idx == SADB_EXT_RESERVED && mhp->msg == NULL)
1975 continue;
1976 if (idx != SADB_EXT_RESERVED &&
1977 (mhp->ext[idx] == NULL || mhp->extlen[idx] == 0))
1978 continue;
1979
1980 if (idx == SADB_EXT_RESERVED) {
1981 len = PFKEY_ALIGN8(sizeof(struct sadb_msg));
1982
1983 IPSEC_ASSERT(len <= MHLEN, ("header too big %u", len));
1984
1985 MGETHDR(n, M_NOWAIT, MT_DATA);
1986 if (!n)
1987 goto fail;
1988 n->m_len = len;
1989 n->m_next = NULL;
1990 m_copydata(m, 0, sizeof(struct sadb_msg),
1991 mtod(n, caddr_t));
1992 } else if (i < ndeep) {
1993 len = mhp->extlen[idx];
1994 n = m_get2(len, M_NOWAIT, MT_DATA, 0);
1995 if (n == NULL)
1996 goto fail;
1997 m_align(n, len);
1998 n->m_len = len;
1999 m_copydata(m, mhp->extoff[idx], mhp->extlen[idx],
2000 mtod(n, caddr_t));
2001 } else {
2002 n = m_copym(m, mhp->extoff[idx], mhp->extlen[idx],
2003 M_NOWAIT);
2004 }
2005 if (n == NULL)
2006 goto fail;
2007
2008 if (result)
2009 m_cat(result, n);
2010 else
2011 result = n;
2012 }
2013 va_end(ap);
2014
2015 if ((result->m_flags & M_PKTHDR) != 0) {
2016 result->m_pkthdr.len = 0;
2017 for (n = result; n; n = n->m_next)
2018 result->m_pkthdr.len += n->m_len;
2019 }
2020
2021 return result;
2022
2023 fail:
2024 m_freem(result);
2025 va_end(ap);
2026 return NULL;
2027 }
2028
2029 /*
2030 * SADB_X_SPDADD, SADB_X_SPDSETIDX or SADB_X_SPDUPDATE processing
2031 * add an entry to SP database, when received
2032 * <base, address(SD), (lifetime(H),) policy>
2033 * from the user(?).
2034 * Adding to SP database,
2035 * and send
2036 * <base, address(SD), (lifetime(H),) policy>
2037 * to the socket which was send.
2038 *
2039 * SPDADD set a unique policy entry.
2040 * SPDSETIDX like SPDADD without a part of policy requests.
2041 * SPDUPDATE replace a unique policy entry.
2042 *
2043 * XXXAE: serialize this in PF_KEY to avoid races.
2044 * m will always be freed.
2045 */
2046 static int
key_spdadd(struct socket * so,struct mbuf * m,const struct sadb_msghdr * mhp)2047 key_spdadd(struct socket *so, struct mbuf *m, const struct sadb_msghdr *mhp)
2048 {
2049 struct secpolicyindex spidx;
2050 struct sadb_address *src0, *dst0;
2051 struct sadb_x_policy *xpl0, *xpl;
2052 struct sadb_lifetime *lft = NULL;
2053 struct secpolicy *newsp, *oldsp;
2054 int error;
2055
2056 IPSEC_ASSERT(so != NULL, ("null socket"));
2057 IPSEC_ASSERT(m != NULL, ("null mbuf"));
2058 IPSEC_ASSERT(mhp != NULL, ("null msghdr"));
2059 IPSEC_ASSERT(mhp->msg != NULL, ("null msg"));
2060
2061 if (SADB_CHECKHDR(mhp, SADB_EXT_ADDRESS_SRC) ||
2062 SADB_CHECKHDR(mhp, SADB_EXT_ADDRESS_DST) ||
2063 SADB_CHECKHDR(mhp, SADB_X_EXT_POLICY)) {
2064 ipseclog((LOG_DEBUG,
2065 "%s: invalid message: missing required header.\n",
2066 __func__));
2067 return key_senderror(so, m, EINVAL);
2068 }
2069 if (SADB_CHECKLEN(mhp, SADB_EXT_ADDRESS_SRC) ||
2070 SADB_CHECKLEN(mhp, SADB_EXT_ADDRESS_DST) ||
2071 SADB_CHECKLEN(mhp, SADB_X_EXT_POLICY)) {
2072 ipseclog((LOG_DEBUG,
2073 "%s: invalid message: wrong header size.\n", __func__));
2074 return key_senderror(so, m, EINVAL);
2075 }
2076 if (!SADB_CHECKHDR(mhp, SADB_EXT_LIFETIME_HARD)) {
2077 if (SADB_CHECKLEN(mhp, SADB_EXT_LIFETIME_HARD)) {
2078 ipseclog((LOG_DEBUG,
2079 "%s: invalid message: wrong header size.\n",
2080 __func__));
2081 return key_senderror(so, m, EINVAL);
2082 }
2083 lft = (struct sadb_lifetime *)mhp->ext[SADB_EXT_LIFETIME_HARD];
2084 }
2085
2086 src0 = (struct sadb_address *)mhp->ext[SADB_EXT_ADDRESS_SRC];
2087 dst0 = (struct sadb_address *)mhp->ext[SADB_EXT_ADDRESS_DST];
2088 xpl0 = (struct sadb_x_policy *)mhp->ext[SADB_X_EXT_POLICY];
2089
2090 /* check the direciton */
2091 switch (xpl0->sadb_x_policy_dir) {
2092 case IPSEC_DIR_INBOUND:
2093 case IPSEC_DIR_OUTBOUND:
2094 break;
2095 default:
2096 ipseclog((LOG_DEBUG, "%s: invalid SP direction.\n", __func__));
2097 return key_senderror(so, m, EINVAL);
2098 }
2099 /* key_spdadd() accepts DISCARD, NONE and IPSEC. */
2100 if (xpl0->sadb_x_policy_type != IPSEC_POLICY_DISCARD &&
2101 xpl0->sadb_x_policy_type != IPSEC_POLICY_NONE &&
2102 xpl0->sadb_x_policy_type != IPSEC_POLICY_IPSEC) {
2103 ipseclog((LOG_DEBUG, "%s: invalid policy type.\n", __func__));
2104 return key_senderror(so, m, EINVAL);
2105 }
2106
2107 /* policy requests are mandatory when action is ipsec. */
2108 if (xpl0->sadb_x_policy_type == IPSEC_POLICY_IPSEC &&
2109 mhp->extlen[SADB_X_EXT_POLICY] <= sizeof(*xpl0)) {
2110 ipseclog((LOG_DEBUG,
2111 "%s: policy requests required.\n", __func__));
2112 return key_senderror(so, m, EINVAL);
2113 }
2114
2115 error = key_checksockaddrs((struct sockaddr *)(src0 + 1),
2116 (struct sockaddr *)(dst0 + 1));
2117 if (error != 0 ||
2118 src0->sadb_address_proto != dst0->sadb_address_proto) {
2119 ipseclog((LOG_DEBUG, "%s: invalid sockaddr.\n", __func__));
2120 return key_senderror(so, m, error);
2121 }
2122 /* make secindex */
2123 key_setsecspidx(xpl0->sadb_x_policy_dir, src0 + 1, dst0 + 1,
2124 src0->sadb_address_prefixlen, dst0->sadb_address_prefixlen,
2125 src0->sadb_address_proto, &spidx);
2126 /* Checking there is SP already or not. */
2127 oldsp = key_getsp(&spidx);
2128 if (oldsp != NULL) {
2129 if (mhp->msg->sadb_msg_type == SADB_X_SPDUPDATE) {
2130 KEYDBG(KEY_STAMP,
2131 printf("%s: unlink SP(%p) for SPDUPDATE\n",
2132 __func__, oldsp));
2133 KEYDBG(KEY_DATA, kdebug_secpolicy(oldsp));
2134 } else {
2135 key_freesp(&oldsp);
2136 ipseclog((LOG_DEBUG,
2137 "%s: a SP entry exists already.\n", __func__));
2138 return (key_senderror(so, m, EEXIST));
2139 }
2140 }
2141
2142 /* allocate new SP entry */
2143 if ((newsp = key_msg2sp(xpl0, PFKEY_EXTLEN(xpl0), &error)) == NULL) {
2144 if (oldsp != NULL) {
2145 key_unlink(oldsp);
2146 key_freesp(&oldsp); /* second for our reference */
2147 }
2148 return key_senderror(so, m, error);
2149 }
2150
2151 newsp->lastused = newsp->created = time_second;
2152 newsp->lifetime = lft ? lft->sadb_lifetime_addtime : 0;
2153 newsp->validtime = lft ? lft->sadb_lifetime_usetime : 0;
2154 bcopy(&spidx, &newsp->spidx, sizeof(spidx));
2155 #ifdef IPSEC_OFFLOAD
2156 if (!SADB_CHECKHDR(mhp, SADB_X_EXT_IF_HW_OFFL) &&
2157 !SADB_CHECKLEN(mhp, SADB_X_EXT_IF_HW_OFFL)) {
2158 struct sadb_x_if_hw_offl *xof;
2159
2160 xof = (struct sadb_x_if_hw_offl *)mhp->ext[
2161 SADB_X_EXT_IF_HW_OFFL];
2162 newsp->accel_ifname = malloc(sizeof(xof->sadb_x_if_hw_offl_if),
2163 M_IPSEC_MISC, M_NOWAIT);
2164 if (newsp->accel_ifname == NULL) {
2165 ipseclog((LOG_DEBUG, "%s: cannot alloc accel_ifname.\n",
2166 __func__));
2167 key_freesp(&newsp);
2168 return (key_senderror(so, m, error));
2169 }
2170 strncpy(__DECONST(char *, newsp->accel_ifname),
2171 xof->sadb_x_if_hw_offl_if,
2172 sizeof(xof->sadb_x_if_hw_offl_if));
2173 }
2174
2175 #endif
2176
2177 SPTREE_WLOCK();
2178 if ((newsp->id = key_getnewspid()) == 0) {
2179 if (oldsp != NULL)
2180 key_detach(oldsp);
2181 SPTREE_WUNLOCK();
2182 if (oldsp != NULL) {
2183 ipsec_accel_sync();
2184 key_freesp(&oldsp); /* first for key_detach */
2185 IPSEC_ASSERT(oldsp != NULL, ("null oldsp: refcount bug"));
2186 key_freesp(&oldsp); /* second for our reference */
2187 if (SPDCACHE_ENABLED()) /* refresh cache because of key_detach */
2188 spdcache_clear();
2189 }
2190 key_freesp(&newsp);
2191 return key_senderror(so, m, ENOBUFS);
2192 }
2193 if (oldsp != NULL)
2194 key_detach(oldsp);
2195 key_insertsp(newsp);
2196 SPTREE_WUNLOCK();
2197 if (oldsp != NULL) {
2198 ipsec_accel_sync();
2199 key_freesp(&oldsp); /* first for key_detach */
2200 IPSEC_ASSERT(oldsp != NULL, ("null oldsp: refcount bug"));
2201 key_freesp(&oldsp); /* second for our reference */
2202 }
2203 if (SPDCACHE_ENABLED())
2204 spdcache_clear();
2205 KEYDBG(KEY_STAMP,
2206 printf("%s: SP(%p)\n", __func__, newsp));
2207 KEYDBG(KEY_DATA, kdebug_secpolicy(newsp));
2208
2209 {
2210 struct mbuf *n, *mpolicy;
2211 struct sadb_msg *newmsg;
2212 int off;
2213
2214 /* create new sadb_msg to reply. */
2215 if (lft) {
2216 n = key_gather_mbuf(m, mhp, 2, 5, SADB_EXT_RESERVED,
2217 SADB_X_EXT_POLICY, SADB_EXT_LIFETIME_HARD,
2218 SADB_EXT_ADDRESS_SRC, SADB_EXT_ADDRESS_DST);
2219 } else {
2220 n = key_gather_mbuf(m, mhp, 2, 4, SADB_EXT_RESERVED,
2221 SADB_X_EXT_POLICY,
2222 SADB_EXT_ADDRESS_SRC, SADB_EXT_ADDRESS_DST);
2223 }
2224 if (!n)
2225 return key_senderror(so, m, ENOBUFS);
2226
2227 if (n->m_len < sizeof(*newmsg)) {
2228 n = m_pullup(n, sizeof(*newmsg));
2229 if (!n)
2230 return key_senderror(so, m, ENOBUFS);
2231 }
2232 newmsg = mtod(n, struct sadb_msg *);
2233 newmsg->sadb_msg_errno = 0;
2234 newmsg->sadb_msg_len = PFKEY_UNIT64(n->m_pkthdr.len);
2235
2236 off = 0;
2237 mpolicy = m_pulldown(n, PFKEY_ALIGN8(sizeof(struct sadb_msg)),
2238 sizeof(*xpl), &off);
2239 if (mpolicy == NULL) {
2240 /* n is already freed */
2241 return key_senderror(so, m, ENOBUFS);
2242 }
2243 xpl = (struct sadb_x_policy *)(mtod(mpolicy, caddr_t) + off);
2244 if (xpl->sadb_x_policy_exttype != SADB_X_EXT_POLICY) {
2245 m_freem(n);
2246 return key_senderror(so, m, EINVAL);
2247 }
2248 xpl->sadb_x_policy_id = newsp->id;
2249
2250 m_freem(m);
2251 return key_sendup_mbuf(so, n, KEY_SENDUP_ALL);
2252 }
2253 }
2254
2255 /*
2256 * get new policy id.
2257 * OUT:
2258 * 0: failure.
2259 * others: success.
2260 */
2261 static uint32_t
key_getnewspid(void)2262 key_getnewspid(void)
2263 {
2264 struct secpolicy *sp;
2265 uint32_t newid = 0;
2266 int tries, limit;
2267
2268 SPTREE_WLOCK_ASSERT();
2269
2270 limit = atomic_load_int(&V_key_spi_trycnt);
2271 for (tries = 0; tries < limit; tries++) {
2272 if (V_policy_id == ~0) /* overflowed */
2273 newid = V_policy_id = 1;
2274 else
2275 newid = ++V_policy_id;
2276 LIST_FOREACH(sp, SPHASH_HASH(newid), idhash) {
2277 if (sp->id == newid)
2278 break;
2279 }
2280 if (sp == NULL)
2281 break;
2282 }
2283 if (tries == limit || newid == 0) {
2284 ipseclog((LOG_DEBUG, "%s: failed to allocate policy id.\n",
2285 __func__));
2286 return (0);
2287 }
2288 return (newid);
2289 }
2290
2291 /*
2292 * SADB_SPDDELETE processing
2293 * receive
2294 * <base, address(SD), policy(*)>
2295 * from the user(?), and set SADB_SASTATE_DEAD,
2296 * and send,
2297 * <base, address(SD), policy(*)>
2298 * to the ikmpd.
2299 * policy(*) including direction of policy.
2300 *
2301 * m will always be freed.
2302 */
2303 static int
key_spddelete(struct socket * so,struct mbuf * m,const struct sadb_msghdr * mhp)2304 key_spddelete(struct socket *so, struct mbuf *m,
2305 const struct sadb_msghdr *mhp)
2306 {
2307 struct secpolicyindex spidx;
2308 struct sadb_address *src0, *dst0;
2309 struct sadb_x_policy *xpl0;
2310 struct secpolicy *sp;
2311
2312 IPSEC_ASSERT(so != NULL, ("null so"));
2313 IPSEC_ASSERT(m != NULL, ("null mbuf"));
2314 IPSEC_ASSERT(mhp != NULL, ("null msghdr"));
2315 IPSEC_ASSERT(mhp->msg != NULL, ("null msg"));
2316
2317 if (SADB_CHECKHDR(mhp, SADB_EXT_ADDRESS_SRC) ||
2318 SADB_CHECKHDR(mhp, SADB_EXT_ADDRESS_DST) ||
2319 SADB_CHECKHDR(mhp, SADB_X_EXT_POLICY)) {
2320 ipseclog((LOG_DEBUG,
2321 "%s: invalid message: missing required header.\n",
2322 __func__));
2323 return key_senderror(so, m, EINVAL);
2324 }
2325 if (SADB_CHECKLEN(mhp, SADB_EXT_ADDRESS_SRC) ||
2326 SADB_CHECKLEN(mhp, SADB_EXT_ADDRESS_DST) ||
2327 SADB_CHECKLEN(mhp, SADB_X_EXT_POLICY)) {
2328 ipseclog((LOG_DEBUG,
2329 "%s: invalid message: wrong header size.\n", __func__));
2330 return key_senderror(so, m, EINVAL);
2331 }
2332
2333 src0 = (struct sadb_address *)mhp->ext[SADB_EXT_ADDRESS_SRC];
2334 dst0 = (struct sadb_address *)mhp->ext[SADB_EXT_ADDRESS_DST];
2335 xpl0 = (struct sadb_x_policy *)mhp->ext[SADB_X_EXT_POLICY];
2336
2337 /* check the direciton */
2338 switch (xpl0->sadb_x_policy_dir) {
2339 case IPSEC_DIR_INBOUND:
2340 case IPSEC_DIR_OUTBOUND:
2341 break;
2342 default:
2343 ipseclog((LOG_DEBUG, "%s: invalid SP direction.\n", __func__));
2344 return key_senderror(so, m, EINVAL);
2345 }
2346 /* Only DISCARD, NONE and IPSEC are allowed */
2347 if (xpl0->sadb_x_policy_type != IPSEC_POLICY_DISCARD &&
2348 xpl0->sadb_x_policy_type != IPSEC_POLICY_NONE &&
2349 xpl0->sadb_x_policy_type != IPSEC_POLICY_IPSEC) {
2350 ipseclog((LOG_DEBUG, "%s: invalid policy type.\n", __func__));
2351 return key_senderror(so, m, EINVAL);
2352 }
2353 if (key_checksockaddrs((struct sockaddr *)(src0 + 1),
2354 (struct sockaddr *)(dst0 + 1)) != 0 ||
2355 src0->sadb_address_proto != dst0->sadb_address_proto) {
2356 ipseclog((LOG_DEBUG, "%s: invalid sockaddr.\n", __func__));
2357 return key_senderror(so, m, EINVAL);
2358 }
2359 /* make secindex */
2360 key_setsecspidx(xpl0->sadb_x_policy_dir, src0 + 1, dst0 + 1,
2361 src0->sadb_address_prefixlen, dst0->sadb_address_prefixlen,
2362 src0->sadb_address_proto, &spidx);
2363
2364 /* Is there SP in SPD ? */
2365 if ((sp = key_getsp(&spidx)) == NULL) {
2366 ipseclog((LOG_DEBUG, "%s: no SP found.\n", __func__));
2367 return key_senderror(so, m, EINVAL);
2368 }
2369
2370 /* save policy id to buffer to be returned. */
2371 xpl0->sadb_x_policy_id = sp->id;
2372
2373 KEYDBG(KEY_STAMP,
2374 printf("%s: SP(%p)\n", __func__, sp));
2375 KEYDBG(KEY_DATA, kdebug_secpolicy(sp));
2376 ipsec_accel_spddel(sp);
2377 key_unlink(sp);
2378 key_freesp(&sp);
2379
2380 {
2381 struct mbuf *n;
2382 struct sadb_msg *newmsg;
2383
2384 /* create new sadb_msg to reply. */
2385 n = key_gather_mbuf(m, mhp, 1, 4, SADB_EXT_RESERVED,
2386 SADB_X_EXT_POLICY, SADB_EXT_ADDRESS_SRC, SADB_EXT_ADDRESS_DST);
2387 if (!n)
2388 return key_senderror(so, m, ENOBUFS);
2389
2390 newmsg = mtod(n, struct sadb_msg *);
2391 newmsg->sadb_msg_errno = 0;
2392 newmsg->sadb_msg_len = PFKEY_UNIT64(n->m_pkthdr.len);
2393
2394 m_freem(m);
2395 return key_sendup_mbuf(so, n, KEY_SENDUP_ALL);
2396 }
2397 }
2398
2399 /*
2400 * SADB_SPDDELETE2 processing
2401 * receive
2402 * <base, policy(*)>
2403 * from the user(?), and set SADB_SASTATE_DEAD,
2404 * and send,
2405 * <base, policy(*)>
2406 * to the ikmpd.
2407 * policy(*) including direction of policy.
2408 *
2409 * m will always be freed.
2410 */
2411 static int
key_spddelete2(struct socket * so,struct mbuf * m,const struct sadb_msghdr * mhp)2412 key_spddelete2(struct socket *so, struct mbuf *m,
2413 const struct sadb_msghdr *mhp)
2414 {
2415 struct secpolicy *sp;
2416 uint32_t id;
2417
2418 IPSEC_ASSERT(so != NULL, ("null socket"));
2419 IPSEC_ASSERT(m != NULL, ("null mbuf"));
2420 IPSEC_ASSERT(mhp != NULL, ("null msghdr"));
2421 IPSEC_ASSERT(mhp->msg != NULL, ("null msg"));
2422
2423 if (SADB_CHECKHDR(mhp, SADB_X_EXT_POLICY) ||
2424 SADB_CHECKLEN(mhp, SADB_X_EXT_POLICY)) {
2425 ipseclog((LOG_DEBUG, "%s: invalid message is passed.\n",
2426 __func__));
2427 return key_senderror(so, m, EINVAL);
2428 }
2429
2430 id = ((struct sadb_x_policy *)
2431 mhp->ext[SADB_X_EXT_POLICY])->sadb_x_policy_id;
2432
2433 /* Is there SP in SPD ? */
2434 if ((sp = key_getspbyid(id)) == NULL) {
2435 ipseclog((LOG_DEBUG, "%s: no SP found for id %u.\n",
2436 __func__, id));
2437 return key_senderror(so, m, EINVAL);
2438 }
2439
2440 KEYDBG(KEY_STAMP,
2441 printf("%s: SP(%p)\n", __func__, sp));
2442 KEYDBG(KEY_DATA, kdebug_secpolicy(sp));
2443 key_unlink(sp);
2444 if (sp->state != IPSEC_SPSTATE_DEAD) {
2445 ipseclog((LOG_DEBUG, "%s: failed to delete SP with id %u.\n",
2446 __func__, id));
2447 key_freesp(&sp);
2448 return (key_senderror(so, m, EACCES));
2449 }
2450 key_freesp(&sp);
2451
2452 {
2453 struct mbuf *n, *nn;
2454 struct sadb_msg *newmsg;
2455 int off, len;
2456
2457 /* create new sadb_msg to reply. */
2458 len = PFKEY_ALIGN8(sizeof(struct sadb_msg));
2459
2460 n = key_mget(len);
2461 if (n == NULL)
2462 return key_senderror(so, m, ENOBUFS);
2463
2464 n->m_len = len;
2465 n->m_next = NULL;
2466 off = 0;
2467
2468 m_copydata(m, 0, sizeof(struct sadb_msg), mtod(n, caddr_t) + off);
2469 off += PFKEY_ALIGN8(sizeof(struct sadb_msg));
2470
2471 IPSEC_ASSERT(off == len, ("length inconsistency (off %u len %u)",
2472 off, len));
2473
2474 n->m_next = m_copym(m, mhp->extoff[SADB_X_EXT_POLICY],
2475 mhp->extlen[SADB_X_EXT_POLICY], M_NOWAIT);
2476 if (!n->m_next) {
2477 m_freem(n);
2478 return key_senderror(so, m, ENOBUFS);
2479 }
2480
2481 n->m_pkthdr.len = 0;
2482 for (nn = n; nn; nn = nn->m_next)
2483 n->m_pkthdr.len += nn->m_len;
2484
2485 newmsg = mtod(n, struct sadb_msg *);
2486 newmsg->sadb_msg_errno = 0;
2487 newmsg->sadb_msg_len = PFKEY_UNIT64(n->m_pkthdr.len);
2488
2489 m_freem(m);
2490 return key_sendup_mbuf(so, n, KEY_SENDUP_ALL);
2491 }
2492 }
2493
2494 /*
2495 * SADB_X_SPDGET processing
2496 * receive
2497 * <base, policy(*)>
2498 * from the user(?),
2499 * and send,
2500 * <base, address(SD), policy>
2501 * to the ikmpd.
2502 * policy(*) including direction of policy.
2503 *
2504 * m will always be freed.
2505 */
2506 static int
key_spdget(struct socket * so,struct mbuf * m,const struct sadb_msghdr * mhp)2507 key_spdget(struct socket *so, struct mbuf *m, const struct sadb_msghdr *mhp)
2508 {
2509 struct secpolicy *sp;
2510 struct mbuf *n;
2511 uint32_t id;
2512
2513 IPSEC_ASSERT(so != NULL, ("null socket"));
2514 IPSEC_ASSERT(m != NULL, ("null mbuf"));
2515 IPSEC_ASSERT(mhp != NULL, ("null msghdr"));
2516 IPSEC_ASSERT(mhp->msg != NULL, ("null msg"));
2517
2518 if (SADB_CHECKHDR(mhp, SADB_X_EXT_POLICY) ||
2519 SADB_CHECKLEN(mhp, SADB_X_EXT_POLICY)) {
2520 ipseclog((LOG_DEBUG, "%s: invalid message is passed.\n",
2521 __func__));
2522 return key_senderror(so, m, EINVAL);
2523 }
2524
2525 id = ((struct sadb_x_policy *)
2526 mhp->ext[SADB_X_EXT_POLICY])->sadb_x_policy_id;
2527
2528 /* Is there SP in SPD ? */
2529 if ((sp = key_getspbyid(id)) == NULL) {
2530 ipseclog((LOG_DEBUG, "%s: no SP found for id %u.\n",
2531 __func__, id));
2532 return key_senderror(so, m, ENOENT);
2533 }
2534
2535 n = key_setdumpsp(sp, SADB_X_SPDGET, mhp->msg->sadb_msg_seq,
2536 mhp->msg->sadb_msg_pid);
2537 key_freesp(&sp);
2538 if (n != NULL) {
2539 m_freem(m);
2540 return key_sendup_mbuf(so, n, KEY_SENDUP_ONE);
2541 } else
2542 return key_senderror(so, m, ENOBUFS);
2543 }
2544
2545 /*
2546 * SADB_X_SPDACQUIRE processing.
2547 * Acquire policy and SA(s) for a *OUTBOUND* packet.
2548 * send
2549 * <base, policy(*)>
2550 * to KMD, and expect to receive
2551 * <base> with SADB_X_SPDACQUIRE if error occurred,
2552 * or
2553 * <base, policy>
2554 * with SADB_X_SPDUPDATE from KMD by PF_KEY.
2555 * policy(*) is without policy requests.
2556 *
2557 * 0 : succeed
2558 * others: error number
2559 */
2560 int
key_spdacquire(struct secpolicy * sp)2561 key_spdacquire(struct secpolicy *sp)
2562 {
2563 struct mbuf *result = NULL, *m;
2564 struct secspacq *newspacq;
2565
2566 IPSEC_ASSERT(sp != NULL, ("null secpolicy"));
2567 IPSEC_ASSERT(sp->req == NULL, ("policy exists"));
2568 IPSEC_ASSERT(sp->policy == IPSEC_POLICY_IPSEC,
2569 ("policy not IPSEC %u", sp->policy));
2570
2571 /* Get an entry to check whether sent message or not. */
2572 newspacq = key_getspacq(&sp->spidx);
2573 if (newspacq != NULL) {
2574 if (V_key_blockacq_count < newspacq->count) {
2575 /* reset counter and do send message. */
2576 newspacq->count = 0;
2577 } else {
2578 /* increment counter and do nothing. */
2579 newspacq->count++;
2580 SPACQ_UNLOCK();
2581 return (0);
2582 }
2583 SPACQ_UNLOCK();
2584 } else {
2585 /* make new entry for blocking to send SADB_ACQUIRE. */
2586 newspacq = key_newspacq(&sp->spidx);
2587 if (newspacq == NULL)
2588 return ENOBUFS;
2589 }
2590
2591 /* create new sadb_msg to reply. */
2592 m = key_setsadbmsg(SADB_X_SPDACQUIRE, 0, 0, 0, 0, 0);
2593 if (!m)
2594 return ENOBUFS;
2595
2596 result = m;
2597
2598 result->m_pkthdr.len = 0;
2599 for (m = result; m; m = m->m_next)
2600 result->m_pkthdr.len += m->m_len;
2601
2602 mtod(result, struct sadb_msg *)->sadb_msg_len =
2603 PFKEY_UNIT64(result->m_pkthdr.len);
2604
2605 return key_sendup_mbuf(NULL, result, KEY_SENDUP_REGISTERED);
2606 }
2607
2608 /*
2609 * SADB_SPDFLUSH processing
2610 * receive
2611 * <base>
2612 * from the user, and free all entries in secpctree.
2613 * and send,
2614 * <base>
2615 * to the user.
2616 * NOTE: what to do is only marking SADB_SASTATE_DEAD.
2617 *
2618 * m will always be freed.
2619 */
2620 static int
key_spdflush(struct socket * so,struct mbuf * m,const struct sadb_msghdr * mhp)2621 key_spdflush(struct socket *so, struct mbuf *m, const struct sadb_msghdr *mhp)
2622 {
2623 struct secpolicy_queue drainq;
2624 struct sadb_msg *newmsg;
2625 struct secpolicy *sp, *nextsp;
2626 u_int dir;
2627
2628 IPSEC_ASSERT(so != NULL, ("null socket"));
2629 IPSEC_ASSERT(m != NULL, ("null mbuf"));
2630 IPSEC_ASSERT(mhp != NULL, ("null msghdr"));
2631 IPSEC_ASSERT(mhp->msg != NULL, ("null msg"));
2632
2633 if (m->m_len != PFKEY_ALIGN8(sizeof(struct sadb_msg)))
2634 return key_senderror(so, m, EINVAL);
2635
2636 TAILQ_INIT(&drainq);
2637 SPTREE_WLOCK();
2638 for (dir = 0; dir < IPSEC_DIR_MAX; dir++) {
2639 TAILQ_CONCAT(&drainq, &V_sptree[dir], chain);
2640 }
2641 /*
2642 * We need to set state to DEAD for each policy to be sure,
2643 * that another thread won't try to unlink it.
2644 * Also remove SP from sphash.
2645 */
2646 TAILQ_FOREACH(sp, &drainq, chain) {
2647 sp->state = IPSEC_SPSTATE_DEAD;
2648 ipsec_accel_spddel(sp);
2649 LIST_REMOVE(sp, idhash);
2650 }
2651 V_sp_genid++;
2652 V_spd_size = 0;
2653 SPTREE_WUNLOCK();
2654 if (SPDCACHE_ENABLED())
2655 spdcache_clear();
2656 sp = TAILQ_FIRST(&drainq);
2657 while (sp != NULL) {
2658 nextsp = TAILQ_NEXT(sp, chain);
2659 key_freesp(&sp);
2660 sp = nextsp;
2661 }
2662
2663 if (sizeof(struct sadb_msg) > m->m_len + M_TRAILINGSPACE(m)) {
2664 ipseclog((LOG_DEBUG, "%s: No more memory.\n", __func__));
2665 return key_senderror(so, m, ENOBUFS);
2666 }
2667
2668 if (m->m_next)
2669 m_freem(m->m_next);
2670 m->m_next = NULL;
2671 m->m_pkthdr.len = m->m_len = PFKEY_ALIGN8(sizeof(struct sadb_msg));
2672 newmsg = mtod(m, struct sadb_msg *);
2673 newmsg->sadb_msg_errno = 0;
2674 newmsg->sadb_msg_len = PFKEY_UNIT64(m->m_pkthdr.len);
2675
2676 return key_sendup_mbuf(so, m, KEY_SENDUP_ALL);
2677 }
2678
2679 static uint8_t
key_satype2scopemask(uint8_t satype)2680 key_satype2scopemask(uint8_t satype)
2681 {
2682
2683 if (satype == IPSEC_POLICYSCOPE_ANY)
2684 return (0xff);
2685 return (satype);
2686 }
2687 /*
2688 * SADB_SPDDUMP processing
2689 * receive
2690 * <base>
2691 * from the user, and dump all SP leaves and send,
2692 * <base> .....
2693 * to the ikmpd.
2694 *
2695 * NOTE:
2696 * sadb_msg_satype is considered as mask of policy scopes.
2697 * m will always be freed.
2698 */
2699 static int
key_spddump(struct socket * so,struct mbuf * m,const struct sadb_msghdr * mhp)2700 key_spddump(struct socket *so, struct mbuf *m, const struct sadb_msghdr *mhp)
2701 {
2702 SPTREE_RLOCK_TRACKER;
2703 struct secpolicy *sp;
2704 struct mbuf *n;
2705 int cnt;
2706 u_int dir, scope;
2707
2708 IPSEC_ASSERT(so != NULL, ("null socket"));
2709 IPSEC_ASSERT(m != NULL, ("null mbuf"));
2710 IPSEC_ASSERT(mhp != NULL, ("null msghdr"));
2711 IPSEC_ASSERT(mhp->msg != NULL, ("null msg"));
2712
2713 /* search SPD entry and get buffer size. */
2714 cnt = 0;
2715 scope = key_satype2scopemask(mhp->msg->sadb_msg_satype);
2716 SPTREE_RLOCK();
2717 for (dir = 0; dir < IPSEC_DIR_MAX; dir++) {
2718 if (scope & IPSEC_POLICYSCOPE_GLOBAL) {
2719 TAILQ_FOREACH(sp, &V_sptree[dir], chain)
2720 cnt++;
2721 }
2722 if (scope & IPSEC_POLICYSCOPE_IFNET) {
2723 TAILQ_FOREACH(sp, &V_sptree_ifnet[dir], chain)
2724 cnt++;
2725 }
2726 }
2727
2728 if (cnt == 0) {
2729 SPTREE_RUNLOCK();
2730 return key_senderror(so, m, ENOENT);
2731 }
2732
2733 for (dir = 0; dir < IPSEC_DIR_MAX; dir++) {
2734 if (scope & IPSEC_POLICYSCOPE_GLOBAL) {
2735 TAILQ_FOREACH(sp, &V_sptree[dir], chain) {
2736 --cnt;
2737 n = key_setdumpsp(sp, SADB_X_SPDDUMP, cnt,
2738 mhp->msg->sadb_msg_pid);
2739
2740 if (n != NULL)
2741 key_sendup_mbuf(so, n, KEY_SENDUP_ONE);
2742 }
2743 }
2744 if (scope & IPSEC_POLICYSCOPE_IFNET) {
2745 TAILQ_FOREACH(sp, &V_sptree_ifnet[dir], chain) {
2746 --cnt;
2747 n = key_setdumpsp(sp, SADB_X_SPDDUMP, cnt,
2748 mhp->msg->sadb_msg_pid);
2749
2750 if (n != NULL)
2751 key_sendup_mbuf(so, n, KEY_SENDUP_ONE);
2752 }
2753 }
2754 }
2755
2756 SPTREE_RUNLOCK();
2757 m_freem(m);
2758 return (0);
2759 }
2760
2761 static struct mbuf *
key_setdumpsp(struct secpolicy * sp,u_int8_t type,u_int32_t seq,u_int32_t pid)2762 key_setdumpsp(struct secpolicy *sp, u_int8_t type, u_int32_t seq,
2763 u_int32_t pid)
2764 {
2765 struct mbuf *result = NULL, *m;
2766 struct seclifetime lt;
2767
2768 m = key_setsadbmsg(type, 0, SADB_SATYPE_UNSPEC, seq, pid, sp->refcnt);
2769 if (!m)
2770 goto fail;
2771 result = m;
2772
2773 m = key_setsadbaddr(SADB_EXT_ADDRESS_SRC,
2774 &sp->spidx.src.sa, sp->spidx.prefs,
2775 sp->spidx.ul_proto);
2776 if (!m)
2777 goto fail;
2778 m_cat(result, m);
2779
2780 m = key_setsadbaddr(SADB_EXT_ADDRESS_DST,
2781 &sp->spidx.dst.sa, sp->spidx.prefd,
2782 sp->spidx.ul_proto);
2783 if (!m)
2784 goto fail;
2785 m_cat(result, m);
2786
2787 m = key_sp2mbuf(sp);
2788 if (!m)
2789 goto fail;
2790 m_cat(result, m);
2791
2792 if(sp->lifetime){
2793 lt.addtime=sp->created;
2794 lt.usetime= sp->lastused;
2795 m = key_setlifetime(<, SADB_EXT_LIFETIME_CURRENT);
2796 if (!m)
2797 goto fail;
2798 m_cat(result, m);
2799
2800 lt.addtime=sp->lifetime;
2801 lt.usetime= sp->validtime;
2802 m = key_setlifetime(<, SADB_EXT_LIFETIME_HARD);
2803 if (!m)
2804 goto fail;
2805 m_cat(result, m);
2806 }
2807
2808 if ((result->m_flags & M_PKTHDR) == 0)
2809 goto fail;
2810
2811 if (result->m_len < sizeof(struct sadb_msg)) {
2812 result = m_pullup(result, sizeof(struct sadb_msg));
2813 if (result == NULL)
2814 goto fail;
2815 }
2816
2817 result->m_pkthdr.len = 0;
2818 for (m = result; m; m = m->m_next)
2819 result->m_pkthdr.len += m->m_len;
2820
2821 mtod(result, struct sadb_msg *)->sadb_msg_len =
2822 PFKEY_UNIT64(result->m_pkthdr.len);
2823
2824 return result;
2825
2826 fail:
2827 m_freem(result);
2828 return NULL;
2829 }
2830 /*
2831 * get PFKEY message length for security policy and request.
2832 */
2833 static size_t
key_getspreqmsglen(struct secpolicy * sp)2834 key_getspreqmsglen(struct secpolicy *sp)
2835 {
2836 size_t tlen, len;
2837 int i;
2838
2839 tlen = sizeof(struct sadb_x_policy);
2840 /* if is the policy for ipsec ? */
2841 if (sp->policy != IPSEC_POLICY_IPSEC)
2842 return (tlen);
2843
2844 /* get length of ipsec requests */
2845 for (i = 0; i < sp->tcount; i++) {
2846 len = sizeof(struct sadb_x_ipsecrequest)
2847 + sp->req[i]->saidx.src.sa.sa_len
2848 + sp->req[i]->saidx.dst.sa.sa_len;
2849
2850 tlen += PFKEY_ALIGN8(len);
2851 }
2852 #ifdef IPSEC_OFFLOAD
2853 if (sp->accel_ifname != NULL)
2854 tlen += sizeof(struct sadb_x_if_hw_offl);
2855 #endif
2856 return (tlen);
2857 }
2858
2859 /*
2860 * SADB_SPDEXPIRE processing
2861 * send
2862 * <base, address(SD), lifetime(CH), policy>
2863 * to KMD by PF_KEY.
2864 *
2865 * OUT: 0 : succeed
2866 * others : error number
2867 */
2868 static int
key_spdexpire(struct secpolicy * sp)2869 key_spdexpire(struct secpolicy *sp)
2870 {
2871 struct sadb_lifetime *lt;
2872 struct mbuf *result = NULL, *m;
2873 int len, error = -1;
2874
2875 IPSEC_ASSERT(sp != NULL, ("null secpolicy"));
2876
2877 KEYDBG(KEY_STAMP,
2878 printf("%s: SP(%p)\n", __func__, sp));
2879 KEYDBG(KEY_DATA, kdebug_secpolicy(sp));
2880
2881 /* set msg header */
2882 m = key_setsadbmsg(SADB_X_SPDEXPIRE, 0, 0, 0, 0, 0);
2883 if (!m) {
2884 error = ENOBUFS;
2885 goto fail;
2886 }
2887 result = m;
2888
2889 /* create lifetime extension (current and hard) */
2890 len = PFKEY_ALIGN8(sizeof(*lt)) * 2;
2891 m = m_get2(len, M_NOWAIT, MT_DATA, 0);
2892 if (m == NULL) {
2893 error = ENOBUFS;
2894 goto fail;
2895 }
2896 m_align(m, len);
2897 m->m_len = len;
2898 bzero(mtod(m, caddr_t), len);
2899 lt = mtod(m, struct sadb_lifetime *);
2900 lt->sadb_lifetime_len = PFKEY_UNIT64(sizeof(struct sadb_lifetime));
2901 lt->sadb_lifetime_exttype = SADB_EXT_LIFETIME_CURRENT;
2902 lt->sadb_lifetime_allocations = 0;
2903 lt->sadb_lifetime_bytes = 0;
2904 lt->sadb_lifetime_addtime = sp->created;
2905 lt->sadb_lifetime_usetime = sp->lastused;
2906 lt = (struct sadb_lifetime *)(mtod(m, caddr_t) + len / 2);
2907 lt->sadb_lifetime_len = PFKEY_UNIT64(sizeof(struct sadb_lifetime));
2908 lt->sadb_lifetime_exttype = SADB_EXT_LIFETIME_HARD;
2909 lt->sadb_lifetime_allocations = 0;
2910 lt->sadb_lifetime_bytes = 0;
2911 lt->sadb_lifetime_addtime = sp->lifetime;
2912 lt->sadb_lifetime_usetime = sp->validtime;
2913 m_cat(result, m);
2914
2915 /* set sadb_address for source */
2916 m = key_setsadbaddr(SADB_EXT_ADDRESS_SRC,
2917 &sp->spidx.src.sa,
2918 sp->spidx.prefs, sp->spidx.ul_proto);
2919 if (!m) {
2920 error = ENOBUFS;
2921 goto fail;
2922 }
2923 m_cat(result, m);
2924
2925 /* set sadb_address for destination */
2926 m = key_setsadbaddr(SADB_EXT_ADDRESS_DST,
2927 &sp->spidx.dst.sa,
2928 sp->spidx.prefd, sp->spidx.ul_proto);
2929 if (!m) {
2930 error = ENOBUFS;
2931 goto fail;
2932 }
2933 m_cat(result, m);
2934
2935 /* set secpolicy */
2936 m = key_sp2mbuf(sp);
2937 if (!m) {
2938 error = ENOBUFS;
2939 goto fail;
2940 }
2941 m_cat(result, m);
2942
2943 if ((result->m_flags & M_PKTHDR) == 0) {
2944 error = EINVAL;
2945 goto fail;
2946 }
2947
2948 if (result->m_len < sizeof(struct sadb_msg)) {
2949 result = m_pullup(result, sizeof(struct sadb_msg));
2950 if (result == NULL) {
2951 error = ENOBUFS;
2952 goto fail;
2953 }
2954 }
2955
2956 result->m_pkthdr.len = 0;
2957 for (m = result; m; m = m->m_next)
2958 result->m_pkthdr.len += m->m_len;
2959
2960 mtod(result, struct sadb_msg *)->sadb_msg_len =
2961 PFKEY_UNIT64(result->m_pkthdr.len);
2962
2963 return key_sendup_mbuf(NULL, result, KEY_SENDUP_REGISTERED);
2964
2965 fail:
2966 if (result)
2967 m_freem(result);
2968 return error;
2969 }
2970
2971 /* %%% SAD management */
2972 /*
2973 * allocating and initialize new SA head.
2974 * OUT: NULL : failure due to the lack of memory.
2975 * others : pointer to new SA head.
2976 */
2977 static struct secashead *
key_newsah(struct secasindex * saidx)2978 key_newsah(struct secasindex *saidx)
2979 {
2980 struct secashead *sah;
2981
2982 sah = malloc(sizeof(struct secashead), M_IPSEC_SAH,
2983 M_NOWAIT | M_ZERO);
2984 if (sah == NULL) {
2985 PFKEYSTAT_INC(in_nomem);
2986 return (NULL);
2987 }
2988 TAILQ_INIT(&sah->savtree_larval);
2989 TAILQ_INIT(&sah->savtree_alive);
2990 sah->saidx = *saidx;
2991 sah->state = SADB_SASTATE_DEAD;
2992 SAH_INITREF(sah);
2993
2994 KEYDBG(KEY_STAMP,
2995 printf("%s: SAH(%p)\n", __func__, sah));
2996 KEYDBG(KEY_DATA, kdebug_secash(sah, NULL));
2997 return (sah);
2998 }
2999
3000 static void
key_freesah(struct secashead ** psah)3001 key_freesah(struct secashead **psah)
3002 {
3003 struct secashead *sah = *psah;
3004
3005 CURVNET_ASSERT_SET();
3006
3007 if (SAH_DELREF(sah) == 0)
3008 return;
3009
3010 KEYDBG(KEY_STAMP,
3011 printf("%s: last reference to SAH(%p)\n", __func__, sah));
3012 KEYDBG(KEY_DATA, kdebug_secash(sah, NULL));
3013
3014 *psah = NULL;
3015 key_delsah(sah);
3016 }
3017
3018 static void
key_delsah(struct secashead * sah)3019 key_delsah(struct secashead *sah)
3020 {
3021 IPSEC_ASSERT(sah != NULL, ("NULL sah"));
3022 IPSEC_ASSERT(sah->state == SADB_SASTATE_DEAD,
3023 ("Attempt to free non DEAD SAH %p", sah));
3024 IPSEC_ASSERT(TAILQ_EMPTY(&sah->savtree_larval),
3025 ("Attempt to free SAH %p with LARVAL SA", sah));
3026 IPSEC_ASSERT(TAILQ_EMPTY(&sah->savtree_alive),
3027 ("Attempt to free SAH %p with ALIVE SA", sah));
3028
3029 free(sah, M_IPSEC_SAH);
3030 }
3031
3032 /*
3033 * allocating a new SA for key_add() and key_getspi() call,
3034 * and copy the values of mhp into new buffer.
3035 * When SAD message type is SADB_GETSPI set SA state to LARVAL.
3036 * For SADB_ADD create and initialize SA with MATURE state.
3037 * OUT: NULL : fail
3038 * others : pointer to new secasvar.
3039 */
3040 static struct secasvar *
key_newsav(const struct sadb_msghdr * mhp,struct secasindex * saidx,uint32_t spi,int * errp)3041 key_newsav(const struct sadb_msghdr *mhp, struct secasindex *saidx,
3042 uint32_t spi, int *errp)
3043 {
3044 struct secashead *sah;
3045 struct secasvar *sav;
3046 int isnew;
3047
3048 IPSEC_ASSERT(mhp != NULL, ("null msghdr"));
3049 IPSEC_ASSERT(mhp->msg != NULL, ("null msg"));
3050 IPSEC_ASSERT(mhp->msg->sadb_msg_type == SADB_GETSPI ||
3051 mhp->msg->sadb_msg_type == SADB_ADD, ("wrong message type"));
3052
3053 sav = NULL;
3054 sah = NULL;
3055 /* check SPI value */
3056 switch (saidx->proto) {
3057 case IPPROTO_ESP:
3058 case IPPROTO_AH:
3059 /*
3060 * RFC 4302, 2.4. Security Parameters Index (SPI), SPI values
3061 * 1-255 reserved by IANA for future use,
3062 * 0 for implementation specific, local use.
3063 */
3064 if (ntohl(spi) <= 255) {
3065 ipseclog((LOG_DEBUG, "%s: illegal range of SPI %u.\n",
3066 __func__, ntohl(spi)));
3067 *errp = EINVAL;
3068 goto done;
3069 }
3070 break;
3071 }
3072
3073 sav = malloc(sizeof(struct secasvar), M_IPSEC_SA, M_NOWAIT | M_ZERO);
3074 if (sav == NULL) {
3075 *errp = ENOBUFS;
3076 goto done;
3077 }
3078 sav->lock = malloc_aligned(max(sizeof(struct rmlock),
3079 CACHE_LINE_SIZE), CACHE_LINE_SIZE, M_IPSEC_MISC,
3080 M_NOWAIT | M_ZERO);
3081 if (sav->lock == NULL) {
3082 *errp = ENOBUFS;
3083 goto done;
3084 }
3085 rm_init(sav->lock, "ipsec association");
3086 sav->lft_c = uma_zalloc_pcpu(ipsec_key_lft_zone, M_NOWAIT | M_ZERO);
3087 if (sav->lft_c == NULL) {
3088 *errp = ENOBUFS;
3089 goto done;
3090 }
3091
3092 sav->spi = spi;
3093 sav->seq = mhp->msg->sadb_msg_seq;
3094 sav->state = SADB_SASTATE_LARVAL;
3095 sav->pid = (pid_t)mhp->msg->sadb_msg_pid;
3096 SAV_INITREF(sav);
3097 #ifdef IPSEC_OFFLOAD
3098 CK_LIST_INIT(&sav->accel_ifps);
3099 sav->accel_forget_tq = 0;
3100 sav->accel_lft_sw = uma_zalloc_pcpu(ipsec_key_lft_zone,
3101 M_NOWAIT | M_ZERO);
3102 if (sav->accel_lft_sw == NULL) {
3103 *errp = ENOBUFS;
3104 goto done;
3105 }
3106 if (!SADB_CHECKHDR(mhp, SADB_X_EXT_IF_HW_OFFL) &&
3107 !SADB_CHECKLEN(mhp, SADB_X_EXT_IF_HW_OFFL)) {
3108 struct sadb_x_if_hw_offl *xof;
3109
3110 xof = (struct sadb_x_if_hw_offl *)mhp->ext[
3111 SADB_X_EXT_IF_HW_OFFL];
3112 sav->accel_ifname = malloc(sizeof(xof->sadb_x_if_hw_offl_if),
3113 M_IPSEC_MISC, M_NOWAIT);
3114 if (sav->accel_ifname == NULL) {
3115 *errp = ENOBUFS;
3116 goto done;
3117 }
3118 strncpy(__DECONST(char *, sav->accel_ifname),
3119 xof->sadb_x_if_hw_offl_if,
3120 sizeof(xof->sadb_x_if_hw_offl_if));
3121 }
3122 #endif
3123 again:
3124 sah = key_getsah(saidx);
3125 if (sah == NULL) {
3126 /* create a new SA index */
3127 sah = key_newsah(saidx);
3128 if (sah == NULL) {
3129 ipseclog((LOG_DEBUG,
3130 "%s: No more memory.\n", __func__));
3131 *errp = ENOBUFS;
3132 goto done;
3133 }
3134 isnew = 1;
3135 } else
3136 isnew = 0;
3137
3138 sav->sah = sah;
3139 if (mhp->msg->sadb_msg_type == SADB_GETSPI) {
3140 sav->created = time_second;
3141 } else if (sav->state == SADB_SASTATE_LARVAL) {
3142 /*
3143 * Do not call key_setsaval() second time in case
3144 * of `goto again`. We will have MATURE state.
3145 */
3146 *errp = key_setsaval(sav, mhp);
3147 if (*errp != 0)
3148 goto done;
3149 sav->state = SADB_SASTATE_MATURE;
3150 }
3151
3152 SAHTREE_WLOCK();
3153 /*
3154 * Check that existing SAH wasn't unlinked.
3155 * Since we didn't hold the SAHTREE lock, it is possible,
3156 * that callout handler or key_flush() or key_delete() could
3157 * unlink this SAH.
3158 */
3159 if (isnew == 0 && sah->state == SADB_SASTATE_DEAD) {
3160 SAHTREE_WUNLOCK();
3161 key_freesah(&sah); /* reference from key_getsah() */
3162 goto again;
3163 }
3164 if (isnew != 0) {
3165 /*
3166 * Add new SAH into SADB.
3167 *
3168 * XXXAE: we can serialize key_add and key_getspi calls, so
3169 * several threads will not fight in the race.
3170 * Otherwise we should check under SAHTREE lock, that this
3171 * SAH would not added twice.
3172 */
3173 TAILQ_INSERT_HEAD(&V_sahtree, sah, chain);
3174 /* Add new SAH into hash by addresses */
3175 LIST_INSERT_HEAD(SAHADDRHASH_HASH(saidx), sah, addrhash);
3176 /* Now we are linked in the chain */
3177 sah->state = SADB_SASTATE_MATURE;
3178 /*
3179 * SAV references this new SAH.
3180 * In case of existing SAH we reuse reference
3181 * from key_getsah().
3182 */
3183 SAH_ADDREF(sah);
3184 }
3185 /* Link SAV with SAH */
3186 if (sav->state == SADB_SASTATE_MATURE) {
3187 TAILQ_INSERT_HEAD(&sah->savtree_alive, sav, chain);
3188 ipsec_accel_sa_newkey(sav);
3189 } else
3190 TAILQ_INSERT_HEAD(&sah->savtree_larval, sav, chain);
3191 /* Add SAV into SPI hash */
3192 LIST_INSERT_HEAD(SAVHASH_HASH(sav->spi), sav, spihash);
3193 SAHTREE_WUNLOCK();
3194 *errp = 0; /* success */
3195 done:
3196 if (*errp != 0) {
3197 if (sav != NULL) {
3198 if (sav->lock != NULL) {
3199 rm_destroy(sav->lock);
3200 free(sav->lock, M_IPSEC_MISC);
3201 }
3202 if (sav->lft_c != NULL)
3203 uma_zfree_pcpu(ipsec_key_lft_zone, sav->lft_c);
3204 #ifdef IPSEC_OFFLOAD
3205 if (sav->accel_lft_sw != NULL)
3206 uma_zfree_pcpu(ipsec_key_lft_zone,
3207 sav->accel_lft_sw);
3208 free(__DECONST(char *, sav->accel_ifname),
3209 M_IPSEC_MISC);
3210 #endif
3211 free(sav, M_IPSEC_SA), sav = NULL;
3212 }
3213 if (sah != NULL)
3214 key_freesah(&sah);
3215 if (*errp == ENOBUFS) {
3216 ipseclog((LOG_DEBUG, "%s: No more memory.\n",
3217 __func__));
3218 PFKEYSTAT_INC(in_nomem);
3219 }
3220 }
3221 return (sav);
3222 }
3223
3224 /*
3225 * free() SA variable entry.
3226 */
3227 static void
key_cleansav(struct secasvar * sav)3228 key_cleansav(struct secasvar *sav)
3229 {
3230
3231 if (sav->natt != NULL) {
3232 free(sav->natt, M_IPSEC_MISC);
3233 sav->natt = NULL;
3234 }
3235 if (sav->flags & SADB_X_EXT_F_CLONED)
3236 return;
3237 if (sav->tdb_xform != NULL) {
3238 sav->tdb_xform->xf_cleanup(sav);
3239 sav->tdb_xform = NULL;
3240 }
3241 if (sav->key_auth != NULL) {
3242 zfree(sav->key_auth->key_data, M_IPSEC_MISC);
3243 free(sav->key_auth, M_IPSEC_MISC);
3244 sav->key_auth = NULL;
3245 }
3246 if (sav->key_enc != NULL) {
3247 zfree(sav->key_enc->key_data, M_IPSEC_MISC);
3248 free(sav->key_enc, M_IPSEC_MISC);
3249 sav->key_enc = NULL;
3250 }
3251 if (sav->replay != NULL) {
3252 mtx_destroy(&sav->replay->lock);
3253 if (sav->replay->bitmap != NULL)
3254 free(sav->replay->bitmap, M_IPSEC_MISC);
3255 free(sav->replay, M_IPSEC_MISC);
3256 sav->replay = NULL;
3257 }
3258 if (sav->lft_h != NULL) {
3259 free(sav->lft_h, M_IPSEC_MISC);
3260 sav->lft_h = NULL;
3261 }
3262 if (sav->lft_s != NULL) {
3263 free(sav->lft_s, M_IPSEC_MISC);
3264 sav->lft_s = NULL;
3265 }
3266 }
3267
3268 /*
3269 * free() SA variable entry.
3270 */
3271 static void
key_delsav(struct secasvar * sav)3272 key_delsav(struct secasvar *sav)
3273 {
3274 IPSEC_ASSERT(sav != NULL, ("null sav"));
3275 IPSEC_ASSERT(sav->state == SADB_SASTATE_DEAD,
3276 ("attempt to free non DEAD SA %p", sav));
3277 IPSEC_ASSERT(sav->refcnt == 0, ("reference count %u > 0",
3278 sav->refcnt));
3279 #ifdef IPSEC_OFFLOAD
3280 KASSERT(CK_LIST_EMPTY(&sav->accel_ifps),
3281 ("key_unlinksav: sav %p still offloaded", sav));
3282 #endif
3283
3284 /*
3285 * SA must be unlinked from the chain and hashtbl.
3286 * If SA was cloned, we leave all fields untouched,
3287 * except NAT-T config.
3288 */
3289 key_cleansav(sav);
3290 if ((sav->flags & SADB_X_EXT_F_CLONED) == 0) {
3291 rm_destroy(sav->lock);
3292 free(sav->lock, M_IPSEC_MISC);
3293 uma_zfree_pcpu(ipsec_key_lft_zone, sav->lft_c);
3294 }
3295 #ifdef IPSEC_OFFLOAD
3296 /* XXXKIB should this be moved to key_cleansav()? */
3297 uma_zfree_pcpu(ipsec_key_lft_zone, sav->accel_lft_sw);
3298 free(__DECONST(char *, sav->accel_ifname), M_IPSEC_MISC);
3299 #endif
3300 free(sav, M_IPSEC_SA);
3301 }
3302
3303 /*
3304 * search SAH.
3305 * OUT:
3306 * NULL : not found
3307 * others : found, referenced pointer to a SAH.
3308 */
3309 static struct secashead *
key_getsah(struct secasindex * saidx)3310 key_getsah(struct secasindex *saidx)
3311 {
3312 SAHTREE_RLOCK_TRACKER;
3313 struct secashead *sah;
3314
3315 SAHTREE_RLOCK();
3316 LIST_FOREACH(sah, SAHADDRHASH_HASH(saidx), addrhash) {
3317 if (key_cmpsaidx(&sah->saidx, saidx, CMP_MODE_REQID) != 0) {
3318 SAH_ADDREF(sah);
3319 break;
3320 }
3321 }
3322 SAHTREE_RUNLOCK();
3323 return (sah);
3324 }
3325
3326 /*
3327 * Check not to be duplicated SPI.
3328 * OUT:
3329 * 0 : not found
3330 * 1 : found SA with given SPI.
3331 */
3332 static int
key_checkspidup(uint32_t spi)3333 key_checkspidup(uint32_t spi)
3334 {
3335 SAHTREE_RLOCK_TRACKER;
3336 struct secasvar *sav;
3337
3338 /* Assume SPI is in network byte order */
3339 SAHTREE_RLOCK();
3340 LIST_FOREACH(sav, SAVHASH_HASH(spi), spihash) {
3341 if (sav->spi == spi)
3342 break;
3343 }
3344 SAHTREE_RUNLOCK();
3345 return (sav != NULL);
3346 }
3347
3348 /*
3349 * Search SA by SPI.
3350 * OUT:
3351 * NULL : not found
3352 * others : found, referenced pointer to a SA.
3353 */
3354 static struct secasvar *
key_getsavbyspi(uint32_t spi)3355 key_getsavbyspi(uint32_t spi)
3356 {
3357 SAHTREE_RLOCK_TRACKER;
3358 struct secasvar *sav;
3359
3360 /* Assume SPI is in network byte order */
3361 SAHTREE_RLOCK();
3362 LIST_FOREACH(sav, SAVHASH_HASH(spi), spihash) {
3363 if (sav->spi != spi)
3364 continue;
3365 SAV_ADDREF(sav);
3366 break;
3367 }
3368 SAHTREE_RUNLOCK();
3369 return (sav);
3370 }
3371
3372 static int
key_updatelifetimes(struct secasvar * sav,const struct sadb_msghdr * mhp)3373 key_updatelifetimes(struct secasvar *sav, const struct sadb_msghdr *mhp)
3374 {
3375 struct seclifetime *lft_h, *lft_s, *tmp;
3376
3377 /* Lifetime extension is optional, check that it is present. */
3378 if (SADB_CHECKHDR(mhp, SADB_EXT_LIFETIME_HARD) &&
3379 SADB_CHECKHDR(mhp, SADB_EXT_LIFETIME_SOFT)) {
3380 /*
3381 * In case of SADB_UPDATE we may need to change
3382 * existing lifetimes.
3383 */
3384 if (sav->state == SADB_SASTATE_MATURE) {
3385 lft_h = lft_s = NULL;
3386 goto reset;
3387 }
3388 return (0);
3389 }
3390 /* Both HARD and SOFT extensions must present */
3391 if ((SADB_CHECKHDR(mhp, SADB_EXT_LIFETIME_HARD) &&
3392 !SADB_CHECKHDR(mhp, SADB_EXT_LIFETIME_SOFT)) ||
3393 (SADB_CHECKHDR(mhp, SADB_EXT_LIFETIME_SOFT) &&
3394 !SADB_CHECKHDR(mhp, SADB_EXT_LIFETIME_HARD))) {
3395 ipseclog((LOG_DEBUG,
3396 "%s: invalid message: missing required header.\n",
3397 __func__));
3398 return (EINVAL);
3399 }
3400 if (SADB_CHECKLEN(mhp, SADB_EXT_LIFETIME_HARD) ||
3401 SADB_CHECKLEN(mhp, SADB_EXT_LIFETIME_SOFT)) {
3402 ipseclog((LOG_DEBUG,
3403 "%s: invalid message: wrong header size.\n", __func__));
3404 return (EINVAL);
3405 }
3406 lft_h = key_dup_lifemsg((const struct sadb_lifetime *)
3407 mhp->ext[SADB_EXT_LIFETIME_HARD], M_IPSEC_MISC);
3408 if (lft_h == NULL) {
3409 PFKEYSTAT_INC(in_nomem);
3410 ipseclog((LOG_DEBUG, "%s: No more memory.\n", __func__));
3411 return (ENOBUFS);
3412 }
3413 lft_s = key_dup_lifemsg((const struct sadb_lifetime *)
3414 mhp->ext[SADB_EXT_LIFETIME_SOFT], M_IPSEC_MISC);
3415 if (lft_s == NULL) {
3416 PFKEYSTAT_INC(in_nomem);
3417 free(lft_h, M_IPSEC_MISC);
3418 ipseclog((LOG_DEBUG, "%s: No more memory.\n", __func__));
3419 return (ENOBUFS);
3420 }
3421 reset:
3422 if (sav->state != SADB_SASTATE_LARVAL) {
3423 /*
3424 * key_update() holds reference to this SA,
3425 * so it won't be deleted in meanwhile.
3426 */
3427 SECASVAR_WLOCK(sav);
3428 tmp = sav->lft_h;
3429 sav->lft_h = lft_h;
3430 lft_h = tmp;
3431
3432 tmp = sav->lft_s;
3433 sav->lft_s = lft_s;
3434 lft_s = tmp;
3435 SECASVAR_WUNLOCK(sav);
3436 if (lft_h != NULL)
3437 free(lft_h, M_IPSEC_MISC);
3438 if (lft_s != NULL)
3439 free(lft_s, M_IPSEC_MISC);
3440 return (0);
3441 }
3442 /* We can update lifetime without holding a lock */
3443 IPSEC_ASSERT(sav->lft_h == NULL, ("lft_h is already initialized\n"));
3444 IPSEC_ASSERT(sav->lft_s == NULL, ("lft_s is already initialized\n"));
3445 sav->lft_h = lft_h;
3446 sav->lft_s = lft_s;
3447 return (0);
3448 }
3449
3450 /*
3451 * copy SA values from PF_KEY message except *SPI, SEQ, PID and TYPE*.
3452 * You must update these if need. Expects only LARVAL SAs.
3453 * OUT: 0: success.
3454 * !0: failure.
3455 */
3456 static int
key_setsaval(struct secasvar * sav,const struct sadb_msghdr * mhp)3457 key_setsaval(struct secasvar *sav, const struct sadb_msghdr *mhp)
3458 {
3459 const struct sadb_sa *sa0;
3460 const struct sadb_key *key0;
3461 uint32_t replay;
3462 size_t len;
3463 int error;
3464
3465 IPSEC_ASSERT(mhp != NULL, ("null msghdr"));
3466 IPSEC_ASSERT(mhp->msg != NULL, ("null msg"));
3467 IPSEC_ASSERT(sav->state == SADB_SASTATE_LARVAL,
3468 ("Attempt to update non LARVAL SA"));
3469
3470 /* XXX rewrite */
3471 error = key_setident(sav->sah, mhp);
3472 if (error != 0)
3473 goto fail;
3474
3475 /* SA */
3476 if (!SADB_CHECKHDR(mhp, SADB_EXT_SA)) {
3477 if (SADB_CHECKLEN(mhp, SADB_EXT_SA)) {
3478 error = EINVAL;
3479 goto fail;
3480 }
3481 sa0 = (const struct sadb_sa *)mhp->ext[SADB_EXT_SA];
3482 sav->alg_auth = sa0->sadb_sa_auth;
3483 sav->alg_enc = sa0->sadb_sa_encrypt;
3484 sav->flags = sa0->sadb_sa_flags;
3485 if ((sav->flags & SADB_KEY_FLAGS_MAX) != sav->flags) {
3486 ipseclog((LOG_DEBUG,
3487 "%s: invalid sa_flags 0x%08x.\n", __func__,
3488 sav->flags));
3489 error = EINVAL;
3490 goto fail;
3491 }
3492
3493 /* Optional replay window */
3494 replay = 0;
3495 if ((sa0->sadb_sa_flags & SADB_X_EXT_OLD) == 0)
3496 replay = sa0->sadb_sa_replay;
3497 if (!SADB_CHECKHDR(mhp, SADB_X_EXT_SA_REPLAY)) {
3498 if (SADB_CHECKLEN(mhp, SADB_X_EXT_SA_REPLAY)) {
3499 error = EINVAL;
3500 goto fail;
3501 }
3502 replay = ((const struct sadb_x_sa_replay *)
3503 mhp->ext[SADB_X_EXT_SA_REPLAY])->sadb_x_sa_replay_replay;
3504
3505 if (replay > UINT32_MAX - 32) {
3506 ipseclog((LOG_DEBUG,
3507 "%s: replay window too big.\n", __func__));
3508 error = EINVAL;
3509 goto fail;
3510 }
3511
3512 replay = (replay + 7) >> 3;
3513 }
3514
3515 sav->replay = malloc(sizeof(struct secreplay), M_IPSEC_MISC,
3516 M_NOWAIT | M_ZERO);
3517 if (sav->replay == NULL) {
3518 PFKEYSTAT_INC(in_nomem);
3519 ipseclog((LOG_DEBUG, "%s: No more memory.\n",
3520 __func__));
3521 error = ENOBUFS;
3522 goto fail;
3523 }
3524 mtx_init(&sav->replay->lock, "ipsec replay", NULL, MTX_DEF);
3525
3526 if (replay != 0) {
3527 /* number of 32b blocks to be allocated */
3528 uint32_t bitmap_size;
3529
3530 /* RFC 6479:
3531 * - the allocated replay window size must be
3532 * a power of two.
3533 * - use an extra 32b block as a redundant window.
3534 */
3535 bitmap_size = 1;
3536 while (replay + 4 > bitmap_size)
3537 bitmap_size <<= 1;
3538 bitmap_size = bitmap_size / 4;
3539
3540 sav->replay->bitmap = malloc(
3541 bitmap_size * sizeof(uint32_t), M_IPSEC_MISC,
3542 M_NOWAIT | M_ZERO);
3543 if (sav->replay->bitmap == NULL) {
3544 PFKEYSTAT_INC(in_nomem);
3545 ipseclog((LOG_DEBUG, "%s: No more memory.\n",
3546 __func__));
3547 error = ENOBUFS;
3548 goto fail;
3549 }
3550 sav->replay->bitmap_size = bitmap_size;
3551 sav->replay->wsize = replay;
3552 }
3553 }
3554
3555 /* Authentication keys */
3556 if (!SADB_CHECKHDR(mhp, SADB_EXT_KEY_AUTH)) {
3557 if (SADB_CHECKLEN(mhp, SADB_EXT_KEY_AUTH)) {
3558 error = EINVAL;
3559 goto fail;
3560 }
3561 error = 0;
3562 key0 = (const struct sadb_key *)mhp->ext[SADB_EXT_KEY_AUTH];
3563 len = mhp->extlen[SADB_EXT_KEY_AUTH];
3564 switch (mhp->msg->sadb_msg_satype) {
3565 case SADB_SATYPE_AH:
3566 case SADB_SATYPE_ESP:
3567 case SADB_X_SATYPE_TCPSIGNATURE:
3568 if (len == PFKEY_ALIGN8(sizeof(struct sadb_key)) &&
3569 sav->alg_auth != SADB_X_AALG_NULL)
3570 error = EINVAL;
3571 if (key0->sadb_key_bits == 0 || (sizeof(struct sadb_key) +
3572 (key0->sadb_key_bits >> 3)) > len)
3573 error = EINVAL;
3574 break;
3575 case SADB_X_SATYPE_IPCOMP:
3576 default:
3577 error = EINVAL;
3578 break;
3579 }
3580 if (error) {
3581 ipseclog((LOG_DEBUG, "%s: invalid key_auth values.\n",
3582 __func__));
3583 goto fail;
3584 }
3585
3586 sav->key_auth = key_dup_keymsg(key0, M_IPSEC_MISC);
3587 if (sav->key_auth == NULL ) {
3588 ipseclog((LOG_DEBUG, "%s: No more memory.\n",
3589 __func__));
3590 PFKEYSTAT_INC(in_nomem);
3591 error = ENOBUFS;
3592 goto fail;
3593 }
3594 }
3595
3596 /* Encryption key */
3597 if (!SADB_CHECKHDR(mhp, SADB_EXT_KEY_ENCRYPT)) {
3598 if (SADB_CHECKLEN(mhp, SADB_EXT_KEY_ENCRYPT)) {
3599 error = EINVAL;
3600 goto fail;
3601 }
3602 error = 0;
3603 key0 = (const struct sadb_key *)mhp->ext[SADB_EXT_KEY_ENCRYPT];
3604 len = mhp->extlen[SADB_EXT_KEY_ENCRYPT];
3605 switch (mhp->msg->sadb_msg_satype) {
3606 case SADB_SATYPE_ESP:
3607 if (len == PFKEY_ALIGN8(sizeof(struct sadb_key)) &&
3608 sav->alg_enc != SADB_EALG_NULL) {
3609 error = EINVAL;
3610 break;
3611 }
3612 if (key0->sadb_key_bits == 0 || (sizeof(struct sadb_key) +
3613 (key0->sadb_key_bits >> 3)) > len) {
3614 error = EINVAL;
3615 break;
3616 }
3617 sav->key_enc = key_dup_keymsg(key0, M_IPSEC_MISC);
3618 if (sav->key_enc == NULL) {
3619 ipseclog((LOG_DEBUG, "%s: No more memory.\n",
3620 __func__));
3621 PFKEYSTAT_INC(in_nomem);
3622 error = ENOBUFS;
3623 goto fail;
3624 }
3625 break;
3626 case SADB_X_SATYPE_IPCOMP:
3627 if (len != PFKEY_ALIGN8(sizeof(struct sadb_key)))
3628 error = EINVAL;
3629 sav->key_enc = NULL; /*just in case*/
3630 break;
3631 case SADB_SATYPE_AH:
3632 case SADB_X_SATYPE_TCPSIGNATURE:
3633 default:
3634 error = EINVAL;
3635 break;
3636 }
3637 if (error) {
3638 ipseclog((LOG_DEBUG, "%s: invalid key_enc value.\n",
3639 __func__));
3640 goto fail;
3641 }
3642 }
3643
3644 /* set iv */
3645 sav->ivlen = 0;
3646 switch (mhp->msg->sadb_msg_satype) {
3647 case SADB_SATYPE_AH:
3648 if (sav->flags & SADB_X_EXT_DERIV) {
3649 ipseclog((LOG_DEBUG, "%s: invalid flag (derived) "
3650 "given to AH SA.\n", __func__));
3651 error = EINVAL;
3652 goto fail;
3653 }
3654 if (sav->alg_enc != SADB_EALG_NONE) {
3655 ipseclog((LOG_DEBUG, "%s: protocol and algorithm "
3656 "mismated.\n", __func__));
3657 error = EINVAL;
3658 goto fail;
3659 }
3660 error = xform_init(sav, XF_AH);
3661 break;
3662 case SADB_SATYPE_ESP:
3663 if ((sav->flags & (SADB_X_EXT_OLD | SADB_X_EXT_DERIV)) ==
3664 (SADB_X_EXT_OLD | SADB_X_EXT_DERIV)) {
3665 ipseclog((LOG_DEBUG, "%s: invalid flag (derived) "
3666 "given to old-esp.\n", __func__));
3667 error = EINVAL;
3668 goto fail;
3669 }
3670 error = xform_init(sav, XF_ESP);
3671 break;
3672 case SADB_X_SATYPE_IPCOMP:
3673 if (sav->alg_auth != SADB_AALG_NONE) {
3674 ipseclog((LOG_DEBUG, "%s: protocol and algorithm "
3675 "mismated.\n", __func__));
3676 error = EINVAL;
3677 goto fail;
3678 }
3679 if ((sav->flags & SADB_X_EXT_RAWCPI) == 0 &&
3680 ntohl(sav->spi) >= 0x10000) {
3681 ipseclog((LOG_DEBUG, "%s: invalid cpi for IPComp.\n",
3682 __func__));
3683 error = EINVAL;
3684 goto fail;
3685 }
3686 error = xform_init(sav, XF_IPCOMP);
3687 break;
3688 case SADB_X_SATYPE_TCPSIGNATURE:
3689 if (sav->alg_enc != SADB_EALG_NONE) {
3690 ipseclog((LOG_DEBUG, "%s: protocol and algorithm "
3691 "mismated.\n", __func__));
3692 error = EINVAL;
3693 goto fail;
3694 }
3695 error = xform_init(sav, XF_TCPSIGNATURE);
3696 break;
3697 default:
3698 ipseclog((LOG_DEBUG, "%s: Invalid satype.\n", __func__));
3699 error = EPROTONOSUPPORT;
3700 goto fail;
3701 }
3702 if (error) {
3703 ipseclog((LOG_DEBUG, "%s: unable to initialize SA type %u.\n",
3704 __func__, mhp->msg->sadb_msg_satype));
3705 goto fail;
3706 }
3707
3708 /* Handle NAT-T headers */
3709 error = key_setnatt(sav, mhp);
3710 if (error != 0)
3711 goto fail;
3712
3713 /* Initialize lifetime for CURRENT */
3714 sav->firstused = 0;
3715 sav->created = time_second;
3716
3717 /* lifetimes for HARD and SOFT */
3718 error = key_updatelifetimes(sav, mhp);
3719 if (error == 0)
3720 return (0);
3721 fail:
3722 key_cleansav(sav);
3723 return (error);
3724 }
3725
3726 /*
3727 * subroutine for SADB_GET and SADB_DUMP.
3728 */
3729 static struct mbuf *
key_setdumpsa(struct secasvar * sav,uint8_t type,uint8_t satype,uint32_t seq,uint32_t pid,struct rm_priotracker * sahtree_trackerp)3730 key_setdumpsa(struct secasvar *sav, uint8_t type, uint8_t satype,
3731 uint32_t seq, uint32_t pid, struct rm_priotracker *sahtree_trackerp)
3732 {
3733 struct seclifetime lft_c;
3734 struct mbuf *result = NULL, *tres = NULL, *m;
3735 int i, dumporder[] = {
3736 SADB_EXT_SA, SADB_X_EXT_SA2, SADB_X_EXT_SA_REPLAY,
3737 SADB_EXT_LIFETIME_HARD, SADB_EXT_LIFETIME_SOFT,
3738 SADB_EXT_LIFETIME_CURRENT, SADB_EXT_ADDRESS_SRC,
3739 SADB_EXT_ADDRESS_DST, SADB_EXT_ADDRESS_PROXY,
3740 SADB_EXT_KEY_AUTH, SADB_EXT_KEY_ENCRYPT,
3741 SADB_EXT_IDENTITY_SRC, SADB_EXT_IDENTITY_DST,
3742 SADB_EXT_SENSITIVITY,
3743 SADB_X_EXT_NAT_T_TYPE,
3744 SADB_X_EXT_NAT_T_SPORT, SADB_X_EXT_NAT_T_DPORT,
3745 SADB_X_EXT_NAT_T_OAI, SADB_X_EXT_NAT_T_OAR,
3746 SADB_X_EXT_NAT_T_FRAG,
3747 #ifdef IPSEC_OFFLOAD
3748 SADB_X_EXT_LFT_CUR_SW_OFFL, SADB_X_EXT_LFT_CUR_HW_OFFL,
3749 SADB_X_EXT_IF_HW_OFFL,
3750 #endif
3751 };
3752 uint32_t replay_count;
3753 #ifdef IPSEC_OFFLOAD
3754 int error;
3755 #endif
3756
3757 SECASVAR_RLOCK_TRACKER;
3758
3759 m = key_setsadbmsg(type, 0, satype, seq, pid, sav->refcnt);
3760 if (m == NULL)
3761 goto fail;
3762 result = m;
3763
3764 for (i = nitems(dumporder) - 1; i >= 0; i--) {
3765 m = NULL;
3766 switch (dumporder[i]) {
3767 case SADB_EXT_SA:
3768 m = key_setsadbsa(sav);
3769 if (!m)
3770 goto fail;
3771 break;
3772
3773 case SADB_X_EXT_SA2: {
3774 SECASVAR_RLOCK(sav);
3775 replay_count = sav->replay ? sav->replay->count : 0;
3776 SECASVAR_RUNLOCK(sav);
3777 m = key_setsadbxsa2(sav->sah->saidx.mode, replay_count,
3778 sav->sah->saidx.reqid);
3779 if (!m)
3780 goto fail;
3781 break;
3782 }
3783 case SADB_X_EXT_SA_REPLAY:
3784 if (sav->replay == NULL ||
3785 sav->replay->wsize <= UINT8_MAX)
3786 continue;
3787
3788 m = key_setsadbxsareplay(sav->replay->wsize);
3789 if (!m)
3790 goto fail;
3791 break;
3792
3793 case SADB_EXT_ADDRESS_SRC:
3794 m = key_setsadbaddr(SADB_EXT_ADDRESS_SRC,
3795 &sav->sah->saidx.src.sa,
3796 FULLMASK, IPSEC_ULPROTO_ANY);
3797 if (!m)
3798 goto fail;
3799 break;
3800
3801 case SADB_EXT_ADDRESS_DST:
3802 m = key_setsadbaddr(SADB_EXT_ADDRESS_DST,
3803 &sav->sah->saidx.dst.sa,
3804 FULLMASK, IPSEC_ULPROTO_ANY);
3805 if (!m)
3806 goto fail;
3807 break;
3808
3809 case SADB_EXT_KEY_AUTH:
3810 if (!sav->key_auth)
3811 continue;
3812 m = key_setkey(sav->key_auth, SADB_EXT_KEY_AUTH);
3813 if (!m)
3814 goto fail;
3815 break;
3816
3817 case SADB_EXT_KEY_ENCRYPT:
3818 if (!sav->key_enc)
3819 continue;
3820 m = key_setkey(sav->key_enc, SADB_EXT_KEY_ENCRYPT);
3821 if (!m)
3822 goto fail;
3823 break;
3824
3825 case SADB_EXT_LIFETIME_CURRENT:
3826 lft_c.addtime = sav->created;
3827 lft_c.allocations = (uint32_t)counter_u64_fetch(
3828 sav->lft_c_allocations);
3829 lft_c.bytes = counter_u64_fetch(sav->lft_c_bytes);
3830 lft_c.usetime = sav->firstused;
3831 m = key_setlifetime(&lft_c, SADB_EXT_LIFETIME_CURRENT);
3832 if (!m)
3833 goto fail;
3834 break;
3835
3836 case SADB_EXT_LIFETIME_HARD:
3837 if (!sav->lft_h)
3838 continue;
3839 m = key_setlifetime(sav->lft_h,
3840 SADB_EXT_LIFETIME_HARD);
3841 if (!m)
3842 goto fail;
3843 break;
3844
3845 case SADB_EXT_LIFETIME_SOFT:
3846 if (!sav->lft_s)
3847 continue;
3848 m = key_setlifetime(sav->lft_s,
3849 SADB_EXT_LIFETIME_SOFT);
3850
3851 if (!m)
3852 goto fail;
3853 break;
3854
3855 case SADB_X_EXT_NAT_T_TYPE:
3856 if (sav->natt == NULL)
3857 continue;
3858 m = key_setsadbxtype(UDP_ENCAP_ESPINUDP);
3859 if (!m)
3860 goto fail;
3861 break;
3862
3863 case SADB_X_EXT_NAT_T_DPORT:
3864 if (sav->natt == NULL)
3865 continue;
3866 m = key_setsadbxport(sav->natt->dport,
3867 SADB_X_EXT_NAT_T_DPORT);
3868 if (!m)
3869 goto fail;
3870 break;
3871
3872 case SADB_X_EXT_NAT_T_SPORT:
3873 if (sav->natt == NULL)
3874 continue;
3875 m = key_setsadbxport(sav->natt->sport,
3876 SADB_X_EXT_NAT_T_SPORT);
3877 if (!m)
3878 goto fail;
3879 break;
3880
3881 case SADB_X_EXT_NAT_T_OAI:
3882 if (sav->natt == NULL ||
3883 (sav->natt->flags & IPSEC_NATT_F_OAI) == 0)
3884 continue;
3885 m = key_setsadbaddr(SADB_X_EXT_NAT_T_OAI,
3886 &sav->natt->oai.sa, FULLMASK, IPSEC_ULPROTO_ANY);
3887 if (!m)
3888 goto fail;
3889 break;
3890 case SADB_X_EXT_NAT_T_OAR:
3891 if (sav->natt == NULL ||
3892 (sav->natt->flags & IPSEC_NATT_F_OAR) == 0)
3893 continue;
3894 m = key_setsadbaddr(SADB_X_EXT_NAT_T_OAR,
3895 &sav->natt->oar.sa, FULLMASK, IPSEC_ULPROTO_ANY);
3896 if (!m)
3897 goto fail;
3898 break;
3899 case SADB_X_EXT_NAT_T_FRAG:
3900 /* We do not (yet) support those. */
3901 continue;
3902 #ifdef IPSEC_OFFLOAD
3903 case SADB_X_EXT_LFT_CUR_SW_OFFL:
3904 if (!ipsec_accel_is_accel_sav(sav))
3905 continue;
3906 SAV_ADDREF(sav);
3907 error = ipsec_accel_sa_lifetime_op(sav, &lft_c,
3908 NULL, IF_SA_CNT_TOTAL_SW_VAL, sahtree_trackerp);
3909 if (error != 0) {
3910 m = NULL;
3911 goto fail;
3912 }
3913 m = key_setlifetime(&lft_c, dumporder[i]);
3914 if (m == NULL)
3915 goto fail;
3916 key_freesav(&sav);
3917 if (sav == NULL) {
3918 m_freem(m);
3919 goto fail;
3920 }
3921 break;
3922 case SADB_X_EXT_LFT_CUR_HW_OFFL:
3923 if (!ipsec_accel_is_accel_sav(sav))
3924 continue;
3925 memset(&lft_c, 0, sizeof(lft_c));
3926 lft_c.bytes = sav->accel_hw_octets;
3927 lft_c.allocations = sav->accel_hw_allocs;
3928 m = key_setlifetime(&lft_c, dumporder[i]);
3929 if (m == NULL)
3930 goto fail;
3931 break;
3932 case SADB_X_EXT_IF_HW_OFFL:
3933 if (!ipsec_accel_is_accel_sav(sav))
3934 continue;
3935 m = ipsec_accel_key_setaccelif(sav);
3936 if (m == NULL)
3937 continue; /* benigh */
3938 break;
3939 #endif
3940
3941 case SADB_EXT_ADDRESS_PROXY:
3942 case SADB_EXT_IDENTITY_SRC:
3943 case SADB_EXT_IDENTITY_DST:
3944 /* XXX: should we brought from SPD ? */
3945 case SADB_EXT_SENSITIVITY:
3946 default:
3947 continue;
3948 }
3949
3950 if (!m)
3951 goto fail;
3952 if (tres)
3953 m_cat(m, tres);
3954 tres = m;
3955 }
3956
3957 m_cat(result, tres);
3958 tres = NULL;
3959 if (result->m_len < sizeof(struct sadb_msg)) {
3960 result = m_pullup(result, sizeof(struct sadb_msg));
3961 if (result == NULL)
3962 goto fail;
3963 }
3964
3965 result->m_pkthdr.len = 0;
3966 for (m = result; m; m = m->m_next)
3967 result->m_pkthdr.len += m->m_len;
3968
3969 mtod(result, struct sadb_msg *)->sadb_msg_len =
3970 PFKEY_UNIT64(result->m_pkthdr.len);
3971
3972 return result;
3973
3974 fail:
3975 m_freem(result);
3976 m_freem(tres);
3977 return NULL;
3978 }
3979
3980 /*
3981 * set data into sadb_msg.
3982 */
3983 static struct mbuf *
key_setsadbmsg(u_int8_t type,u_int16_t tlen,u_int8_t satype,u_int32_t seq,pid_t pid,u_int16_t reserved)3984 key_setsadbmsg(u_int8_t type, u_int16_t tlen, u_int8_t satype, u_int32_t seq,
3985 pid_t pid, u_int16_t reserved)
3986 {
3987 struct mbuf *m;
3988 struct sadb_msg *p;
3989 int len;
3990
3991 len = PFKEY_ALIGN8(sizeof(struct sadb_msg));
3992 if (len > MCLBYTES)
3993 return NULL;
3994 m = key_mget(len);
3995 if (m == NULL)
3996 return NULL;
3997 m->m_pkthdr.len = m->m_len = len;
3998 m->m_next = NULL;
3999
4000 p = mtod(m, struct sadb_msg *);
4001
4002 bzero(p, len);
4003 p->sadb_msg_version = PF_KEY_V2;
4004 p->sadb_msg_type = type;
4005 p->sadb_msg_errno = 0;
4006 p->sadb_msg_satype = satype;
4007 p->sadb_msg_len = PFKEY_UNIT64(tlen);
4008 p->sadb_msg_reserved = reserved;
4009 p->sadb_msg_seq = seq;
4010 p->sadb_msg_pid = (u_int32_t)pid;
4011
4012 return m;
4013 }
4014
4015 /*
4016 * copy secasvar data into sadb_address.
4017 */
4018 static struct mbuf *
key_setsadbsa(struct secasvar * sav)4019 key_setsadbsa(struct secasvar *sav)
4020 {
4021 struct mbuf *m;
4022 struct sadb_sa *p;
4023 int len;
4024
4025 len = PFKEY_ALIGN8(sizeof(struct sadb_sa));
4026 m = m_get2(len, M_NOWAIT, MT_DATA, 0);
4027 if (m == NULL)
4028 return (NULL);
4029 m_align(m, len);
4030 m->m_len = len;
4031 p = mtod(m, struct sadb_sa *);
4032 bzero(p, len);
4033 p->sadb_sa_len = PFKEY_UNIT64(len);
4034 p->sadb_sa_exttype = SADB_EXT_SA;
4035 p->sadb_sa_spi = sav->spi;
4036 p->sadb_sa_replay = sav->replay ?
4037 (sav->replay->wsize > UINT8_MAX ? UINT8_MAX :
4038 sav->replay->wsize): 0;
4039 p->sadb_sa_state = sav->state;
4040 p->sadb_sa_auth = sav->alg_auth;
4041 p->sadb_sa_encrypt = sav->alg_enc;
4042 p->sadb_sa_flags = sav->flags & SADB_KEY_FLAGS_MAX;
4043 return (m);
4044 }
4045
4046 /*
4047 * set data into sadb_address.
4048 */
4049 static struct mbuf *
key_setsadbaddr(u_int16_t exttype,const struct sockaddr * saddr,u_int8_t prefixlen,u_int16_t ul_proto)4050 key_setsadbaddr(u_int16_t exttype, const struct sockaddr *saddr,
4051 u_int8_t prefixlen, u_int16_t ul_proto)
4052 {
4053 struct mbuf *m;
4054 struct sadb_address *p;
4055 size_t len;
4056
4057 len = PFKEY_ALIGN8(sizeof(struct sadb_address)) +
4058 PFKEY_ALIGN8(saddr->sa_len);
4059 m = m_get2(len, M_NOWAIT, MT_DATA, 0);
4060 if (m == NULL)
4061 return (NULL);
4062 m_align(m, len);
4063 m->m_len = len;
4064 p = mtod(m, struct sadb_address *);
4065
4066 bzero(p, len);
4067 p->sadb_address_len = PFKEY_UNIT64(len);
4068 p->sadb_address_exttype = exttype;
4069 p->sadb_address_proto = ul_proto;
4070 if (prefixlen == FULLMASK) {
4071 switch (saddr->sa_family) {
4072 case AF_INET:
4073 prefixlen = sizeof(struct in_addr) << 3;
4074 break;
4075 case AF_INET6:
4076 prefixlen = sizeof(struct in6_addr) << 3;
4077 break;
4078 default:
4079 ; /*XXX*/
4080 }
4081 }
4082 p->sadb_address_prefixlen = prefixlen;
4083 p->sadb_address_reserved = 0;
4084
4085 bcopy(saddr,
4086 mtod(m, caddr_t) + PFKEY_ALIGN8(sizeof(struct sadb_address)),
4087 saddr->sa_len);
4088
4089 return m;
4090 }
4091
4092 /*
4093 * set data into sadb_x_sa2.
4094 */
4095 static struct mbuf *
key_setsadbxsa2(u_int8_t mode,u_int32_t seq,u_int32_t reqid)4096 key_setsadbxsa2(u_int8_t mode, u_int32_t seq, u_int32_t reqid)
4097 {
4098 struct mbuf *m;
4099 struct sadb_x_sa2 *p;
4100 size_t len;
4101
4102 len = PFKEY_ALIGN8(sizeof(struct sadb_x_sa2));
4103 m = m_get2(len, M_NOWAIT, MT_DATA, 0);
4104 if (m == NULL)
4105 return (NULL);
4106 m_align(m, len);
4107 m->m_len = len;
4108 p = mtod(m, struct sadb_x_sa2 *);
4109
4110 bzero(p, len);
4111 p->sadb_x_sa2_len = PFKEY_UNIT64(len);
4112 p->sadb_x_sa2_exttype = SADB_X_EXT_SA2;
4113 p->sadb_x_sa2_mode = mode;
4114 p->sadb_x_sa2_reserved1 = 0;
4115 p->sadb_x_sa2_reserved2 = 0;
4116 p->sadb_x_sa2_sequence = seq;
4117 p->sadb_x_sa2_reqid = reqid;
4118
4119 return m;
4120 }
4121
4122 /*
4123 * Set data into sadb_x_sa_replay.
4124 */
4125 static struct mbuf *
key_setsadbxsareplay(u_int32_t replay)4126 key_setsadbxsareplay(u_int32_t replay)
4127 {
4128 struct mbuf *m;
4129 struct sadb_x_sa_replay *p;
4130 size_t len;
4131
4132 len = PFKEY_ALIGN8(sizeof(struct sadb_x_sa_replay));
4133 m = m_get2(len, M_NOWAIT, MT_DATA, 0);
4134 if (m == NULL)
4135 return (NULL);
4136 m_align(m, len);
4137 m->m_len = len;
4138 p = mtod(m, struct sadb_x_sa_replay *);
4139
4140 bzero(p, len);
4141 p->sadb_x_sa_replay_len = PFKEY_UNIT64(len);
4142 p->sadb_x_sa_replay_exttype = SADB_X_EXT_SA_REPLAY;
4143 p->sadb_x_sa_replay_replay = (replay << 3);
4144
4145 return m;
4146 }
4147
4148 /*
4149 * Set a type in sadb_x_nat_t_type.
4150 */
4151 static struct mbuf *
key_setsadbxtype(u_int16_t type)4152 key_setsadbxtype(u_int16_t type)
4153 {
4154 struct mbuf *m;
4155 size_t len;
4156 struct sadb_x_nat_t_type *p;
4157
4158 len = PFKEY_ALIGN8(sizeof(struct sadb_x_nat_t_type));
4159
4160 m = m_get2(len, M_NOWAIT, MT_DATA, 0);
4161 if (m == NULL)
4162 return (NULL);
4163 m_align(m, len);
4164 m->m_len = len;
4165 p = mtod(m, struct sadb_x_nat_t_type *);
4166
4167 bzero(p, len);
4168 p->sadb_x_nat_t_type_len = PFKEY_UNIT64(len);
4169 p->sadb_x_nat_t_type_exttype = SADB_X_EXT_NAT_T_TYPE;
4170 p->sadb_x_nat_t_type_type = type;
4171
4172 return (m);
4173 }
4174 /*
4175 * Set a port in sadb_x_nat_t_port.
4176 * In contrast to default RFC 2367 behaviour, port is in network byte order.
4177 */
4178 static struct mbuf *
key_setsadbxport(u_int16_t port,u_int16_t type)4179 key_setsadbxport(u_int16_t port, u_int16_t type)
4180 {
4181 struct mbuf *m;
4182 size_t len;
4183 struct sadb_x_nat_t_port *p;
4184
4185 len = PFKEY_ALIGN8(sizeof(struct sadb_x_nat_t_port));
4186
4187 m = m_get2(len, M_NOWAIT, MT_DATA, 0);
4188 if (m == NULL)
4189 return (NULL);
4190 m_align(m, len);
4191 m->m_len = len;
4192 p = mtod(m, struct sadb_x_nat_t_port *);
4193
4194 bzero(p, len);
4195 p->sadb_x_nat_t_port_len = PFKEY_UNIT64(len);
4196 p->sadb_x_nat_t_port_exttype = type;
4197 p->sadb_x_nat_t_port_port = port;
4198
4199 return (m);
4200 }
4201
4202 /*
4203 * Get port from sockaddr. Port is in network byte order.
4204 */
4205 uint16_t
key_portfromsaddr(struct sockaddr * sa)4206 key_portfromsaddr(struct sockaddr *sa)
4207 {
4208
4209 switch (sa->sa_family) {
4210 #ifdef INET
4211 case AF_INET:
4212 return ((struct sockaddr_in *)sa)->sin_port;
4213 #endif
4214 #ifdef INET6
4215 case AF_INET6:
4216 return ((struct sockaddr_in6 *)sa)->sin6_port;
4217 #endif
4218 }
4219 return (0);
4220 }
4221
4222 /*
4223 * Set port in struct sockaddr. Port is in network byte order.
4224 */
4225 void
key_porttosaddr(struct sockaddr * sa,uint16_t port)4226 key_porttosaddr(struct sockaddr *sa, uint16_t port)
4227 {
4228
4229 switch (sa->sa_family) {
4230 #ifdef INET
4231 case AF_INET:
4232 ((struct sockaddr_in *)sa)->sin_port = port;
4233 break;
4234 #endif
4235 #ifdef INET6
4236 case AF_INET6:
4237 ((struct sockaddr_in6 *)sa)->sin6_port = port;
4238 break;
4239 #endif
4240 default:
4241 ipseclog((LOG_DEBUG, "%s: unexpected address family %d.\n",
4242 __func__, sa->sa_family));
4243 break;
4244 }
4245 }
4246
4247 /*
4248 * set data into sadb_x_policy
4249 */
4250 static struct mbuf *
key_setsadbxpolicy(u_int16_t type,u_int8_t dir,u_int32_t id,u_int32_t priority)4251 key_setsadbxpolicy(u_int16_t type, u_int8_t dir, u_int32_t id, u_int32_t priority)
4252 {
4253 struct mbuf *m;
4254 struct sadb_x_policy *p;
4255 size_t len;
4256
4257 len = PFKEY_ALIGN8(sizeof(struct sadb_x_policy));
4258 m = m_get2(len, M_NOWAIT, MT_DATA, 0);
4259 if (m == NULL)
4260 return (NULL);
4261 m_align(m, len);
4262 m->m_len = len;
4263 p = mtod(m, struct sadb_x_policy *);
4264
4265 bzero(p, len);
4266 p->sadb_x_policy_len = PFKEY_UNIT64(len);
4267 p->sadb_x_policy_exttype = SADB_X_EXT_POLICY;
4268 p->sadb_x_policy_type = type;
4269 p->sadb_x_policy_dir = dir;
4270 p->sadb_x_policy_id = id;
4271 p->sadb_x_policy_priority = priority;
4272
4273 return m;
4274 }
4275
4276 /* %%% utilities */
4277 /* Take a key message (sadb_key) from the socket and turn it into one
4278 * of the kernel's key structures (seckey).
4279 *
4280 * IN: pointer to the src
4281 * OUT: NULL no more memory
4282 */
4283 struct seckey *
key_dup_keymsg(const struct sadb_key * src,struct malloc_type * type)4284 key_dup_keymsg(const struct sadb_key *src, struct malloc_type *type)
4285 {
4286 struct seckey *dst;
4287 size_t len;
4288
4289 dst = malloc(sizeof(*dst), type, M_NOWAIT);
4290 if (dst != NULL) {
4291 len = src->sadb_key_bits >> 3;
4292 dst->bits = src->sadb_key_bits;
4293 dst->key_data = malloc(len, type, M_NOWAIT);
4294 if (dst->key_data != NULL) {
4295 bcopy((const char *)(src + 1), dst->key_data, len);
4296 } else {
4297 ipseclog((LOG_DEBUG, "%s: No more memory.\n",
4298 __func__));
4299 free(dst, type);
4300 dst = NULL;
4301 }
4302 } else {
4303 ipseclog((LOG_DEBUG, "%s: No more memory.\n",
4304 __func__));
4305 }
4306 return (dst);
4307 }
4308
4309 /* Take a lifetime message (sadb_lifetime) passed in on a socket and
4310 * turn it into one of the kernel's lifetime structures (seclifetime).
4311 *
4312 * IN: pointer to the destination, source and malloc type
4313 * OUT: NULL, no more memory
4314 */
4315
4316 static struct seclifetime *
key_dup_lifemsg(const struct sadb_lifetime * src,struct malloc_type * type)4317 key_dup_lifemsg(const struct sadb_lifetime *src, struct malloc_type *type)
4318 {
4319 struct seclifetime *dst;
4320
4321 dst = malloc(sizeof(*dst), type, M_NOWAIT);
4322 if (dst == NULL) {
4323 ipseclog((LOG_DEBUG, "%s: No more memory.\n", __func__));
4324 return (NULL);
4325 }
4326 dst->allocations = src->sadb_lifetime_allocations;
4327 dst->bytes = src->sadb_lifetime_bytes;
4328 dst->addtime = src->sadb_lifetime_addtime;
4329 dst->usetime = src->sadb_lifetime_usetime;
4330 return (dst);
4331 }
4332
4333 /*
4334 * compare two secasindex structure.
4335 * flag can specify to compare 2 saidxes.
4336 * compare two secasindex structure without both mode and reqid.
4337 * don't compare port.
4338 * IN:
4339 * saidx0: source, it can be in SAD.
4340 * saidx1: object.
4341 * OUT:
4342 * 1 : equal
4343 * 0 : not equal
4344 */
4345 static int
key_cmpsaidx(const struct secasindex * saidx0,const struct secasindex * saidx1,int flag)4346 key_cmpsaidx(const struct secasindex *saidx0, const struct secasindex *saidx1,
4347 int flag)
4348 {
4349
4350 /* sanity */
4351 if (saidx0 == NULL && saidx1 == NULL)
4352 return 1;
4353
4354 if (saidx0 == NULL || saidx1 == NULL)
4355 return 0;
4356
4357 if (saidx0->proto != saidx1->proto)
4358 return 0;
4359
4360 if (flag == CMP_EXACTLY) {
4361 if (saidx0->mode != saidx1->mode)
4362 return 0;
4363 if (saidx0->reqid != saidx1->reqid)
4364 return 0;
4365 if (bcmp(&saidx0->src, &saidx1->src,
4366 saidx0->src.sa.sa_len) != 0 ||
4367 bcmp(&saidx0->dst, &saidx1->dst,
4368 saidx0->dst.sa.sa_len) != 0)
4369 return 0;
4370 } else {
4371 /* CMP_MODE_REQID, CMP_REQID, CMP_HEAD */
4372 if (flag == CMP_MODE_REQID || flag == CMP_REQID) {
4373 /*
4374 * If reqid of SPD is non-zero, unique SA is required.
4375 * The result must be of same reqid in this case.
4376 */
4377 if (saidx1->reqid != 0 &&
4378 saidx0->reqid != saidx1->reqid)
4379 return 0;
4380 }
4381
4382 if (flag == CMP_MODE_REQID) {
4383 if (saidx0->mode != IPSEC_MODE_ANY
4384 && saidx0->mode != saidx1->mode)
4385 return 0;
4386 }
4387
4388 if (key_sockaddrcmp(&saidx0->src.sa, &saidx1->src.sa, 0) != 0)
4389 return 0;
4390 if (key_sockaddrcmp(&saidx0->dst.sa, &saidx1->dst.sa, 0) != 0)
4391 return 0;
4392 }
4393
4394 return 1;
4395 }
4396
4397 /*
4398 * compare two secindex structure exactly.
4399 * IN:
4400 * spidx0: source, it is often in SPD.
4401 * spidx1: object, it is often from PFKEY message.
4402 * OUT:
4403 * 1 : equal
4404 * 0 : not equal
4405 */
4406 static int
key_cmpspidx_exactly(struct secpolicyindex * spidx0,struct secpolicyindex * spidx1)4407 key_cmpspidx_exactly(struct secpolicyindex *spidx0,
4408 struct secpolicyindex *spidx1)
4409 {
4410 /* sanity */
4411 if (spidx0 == NULL && spidx1 == NULL)
4412 return 1;
4413
4414 if (spidx0 == NULL || spidx1 == NULL)
4415 return 0;
4416
4417 if (spidx0->prefs != spidx1->prefs
4418 || spidx0->prefd != spidx1->prefd
4419 || spidx0->ul_proto != spidx1->ul_proto
4420 || spidx0->dir != spidx1->dir)
4421 return 0;
4422
4423 return key_sockaddrcmp(&spidx0->src.sa, &spidx1->src.sa, 1) == 0 &&
4424 key_sockaddrcmp(&spidx0->dst.sa, &spidx1->dst.sa, 1) == 0;
4425 }
4426
4427 /*
4428 * compare two secindex structure with mask.
4429 * IN:
4430 * spidx0: source, it is often in SPD.
4431 * spidx1: object, it is often from IP header.
4432 * OUT:
4433 * 1 : equal
4434 * 0 : not equal
4435 */
4436 static int
key_cmpspidx_withmask(struct secpolicyindex * spidx0,struct secpolicyindex * spidx1)4437 key_cmpspidx_withmask(struct secpolicyindex *spidx0,
4438 struct secpolicyindex *spidx1)
4439 {
4440 /* sanity */
4441 if (spidx0 == NULL && spidx1 == NULL)
4442 return 1;
4443
4444 if (spidx0 == NULL || spidx1 == NULL)
4445 return 0;
4446
4447 if (spidx0->src.sa.sa_family != spidx1->src.sa.sa_family ||
4448 spidx0->dst.sa.sa_family != spidx1->dst.sa.sa_family ||
4449 spidx0->src.sa.sa_len != spidx1->src.sa.sa_len ||
4450 spidx0->dst.sa.sa_len != spidx1->dst.sa.sa_len)
4451 return 0;
4452
4453 /* if spidx.ul_proto == IPSEC_ULPROTO_ANY, ignore. */
4454 if (spidx0->ul_proto != (u_int16_t)IPSEC_ULPROTO_ANY
4455 && spidx0->ul_proto != spidx1->ul_proto)
4456 return 0;
4457
4458 switch (spidx0->src.sa.sa_family) {
4459 case AF_INET:
4460 if (spidx0->src.sin.sin_port != IPSEC_PORT_ANY
4461 && spidx0->src.sin.sin_port != spidx1->src.sin.sin_port)
4462 return 0;
4463 if (!key_bbcmp(&spidx0->src.sin.sin_addr,
4464 &spidx1->src.sin.sin_addr, spidx0->prefs))
4465 return 0;
4466 break;
4467 case AF_INET6:
4468 if (spidx0->src.sin6.sin6_port != IPSEC_PORT_ANY
4469 && spidx0->src.sin6.sin6_port != spidx1->src.sin6.sin6_port)
4470 return 0;
4471 /*
4472 * scope_id check. if sin6_scope_id is 0, we regard it
4473 * as a wildcard scope, which matches any scope zone ID.
4474 */
4475 if (spidx0->src.sin6.sin6_scope_id &&
4476 spidx1->src.sin6.sin6_scope_id &&
4477 spidx0->src.sin6.sin6_scope_id != spidx1->src.sin6.sin6_scope_id)
4478 return 0;
4479 if (!key_bbcmp(&spidx0->src.sin6.sin6_addr,
4480 &spidx1->src.sin6.sin6_addr, spidx0->prefs))
4481 return 0;
4482 break;
4483 default:
4484 /* XXX */
4485 if (bcmp(&spidx0->src, &spidx1->src, spidx0->src.sa.sa_len) != 0)
4486 return 0;
4487 break;
4488 }
4489
4490 switch (spidx0->dst.sa.sa_family) {
4491 case AF_INET:
4492 if (spidx0->dst.sin.sin_port != IPSEC_PORT_ANY
4493 && spidx0->dst.sin.sin_port != spidx1->dst.sin.sin_port)
4494 return 0;
4495 if (!key_bbcmp(&spidx0->dst.sin.sin_addr,
4496 &spidx1->dst.sin.sin_addr, spidx0->prefd))
4497 return 0;
4498 break;
4499 case AF_INET6:
4500 if (spidx0->dst.sin6.sin6_port != IPSEC_PORT_ANY
4501 && spidx0->dst.sin6.sin6_port != spidx1->dst.sin6.sin6_port)
4502 return 0;
4503 /*
4504 * scope_id check. if sin6_scope_id is 0, we regard it
4505 * as a wildcard scope, which matches any scope zone ID.
4506 */
4507 if (spidx0->dst.sin6.sin6_scope_id &&
4508 spidx1->dst.sin6.sin6_scope_id &&
4509 spidx0->dst.sin6.sin6_scope_id != spidx1->dst.sin6.sin6_scope_id)
4510 return 0;
4511 if (!key_bbcmp(&spidx0->dst.sin6.sin6_addr,
4512 &spidx1->dst.sin6.sin6_addr, spidx0->prefd))
4513 return 0;
4514 break;
4515 default:
4516 /* XXX */
4517 if (bcmp(&spidx0->dst, &spidx1->dst, spidx0->dst.sa.sa_len) != 0)
4518 return 0;
4519 break;
4520 }
4521
4522 /* XXX Do we check other field ? e.g. flowinfo */
4523
4524 return 1;
4525 }
4526
4527 #ifdef satosin
4528 #undef satosin
4529 #endif
4530 #define satosin(s) ((const struct sockaddr_in *)s)
4531 #ifdef satosin6
4532 #undef satosin6
4533 #endif
4534 #define satosin6(s) ((const struct sockaddr_in6 *)s)
4535 /* returns 0 on match */
4536 int
key_sockaddrcmp(const struct sockaddr * sa1,const struct sockaddr * sa2,int port)4537 key_sockaddrcmp(const struct sockaddr *sa1, const struct sockaddr *sa2,
4538 int port)
4539 {
4540 if (sa1->sa_family != sa2->sa_family || sa1->sa_len != sa2->sa_len)
4541 return 1;
4542
4543 switch (sa1->sa_family) {
4544 #ifdef INET
4545 case AF_INET:
4546 if (sa1->sa_len != sizeof(struct sockaddr_in))
4547 return 1;
4548 if (satosin(sa1)->sin_addr.s_addr !=
4549 satosin(sa2)->sin_addr.s_addr) {
4550 return 1;
4551 }
4552 if (port && satosin(sa1)->sin_port != satosin(sa2)->sin_port)
4553 return 1;
4554 break;
4555 #endif
4556 #ifdef INET6
4557 case AF_INET6:
4558 if (sa1->sa_len != sizeof(struct sockaddr_in6))
4559 return 1; /*EINVAL*/
4560 if (satosin6(sa1)->sin6_scope_id !=
4561 satosin6(sa2)->sin6_scope_id) {
4562 return 1;
4563 }
4564 if (!IN6_ARE_ADDR_EQUAL(&satosin6(sa1)->sin6_addr,
4565 &satosin6(sa2)->sin6_addr)) {
4566 return 1;
4567 }
4568 if (port &&
4569 satosin6(sa1)->sin6_port != satosin6(sa2)->sin6_port) {
4570 return 1;
4571 }
4572 break;
4573 #endif
4574 default:
4575 if (bcmp(sa1, sa2, sa1->sa_len) != 0)
4576 return 1;
4577 break;
4578 }
4579
4580 return 0;
4581 }
4582
4583 /* returns 0 on match */
4584 int
key_sockaddrcmp_withmask(const struct sockaddr * sa1,const struct sockaddr * sa2,size_t mask)4585 key_sockaddrcmp_withmask(const struct sockaddr *sa1,
4586 const struct sockaddr *sa2, size_t mask)
4587 {
4588 if (sa1->sa_family != sa2->sa_family || sa1->sa_len != sa2->sa_len)
4589 return (1);
4590
4591 switch (sa1->sa_family) {
4592 #ifdef INET
4593 case AF_INET:
4594 return (!key_bbcmp(&satosin(sa1)->sin_addr,
4595 &satosin(sa2)->sin_addr, mask));
4596 #endif
4597 #ifdef INET6
4598 case AF_INET6:
4599 if (satosin6(sa1)->sin6_scope_id !=
4600 satosin6(sa2)->sin6_scope_id)
4601 return (1);
4602 return (!key_bbcmp(&satosin6(sa1)->sin6_addr,
4603 &satosin6(sa2)->sin6_addr, mask));
4604 #endif
4605 }
4606 return (1);
4607 }
4608 #undef satosin
4609 #undef satosin6
4610
4611 /*
4612 * compare two buffers with mask.
4613 * IN:
4614 * addr1: source
4615 * addr2: object
4616 * bits: Number of bits to compare
4617 * OUT:
4618 * 1 : equal
4619 * 0 : not equal
4620 */
4621 static int
key_bbcmp(const void * a1,const void * a2,u_int bits)4622 key_bbcmp(const void *a1, const void *a2, u_int bits)
4623 {
4624 const unsigned char *p1 = a1;
4625 const unsigned char *p2 = a2;
4626
4627 /* XXX: This could be considerably faster if we compare a word
4628 * at a time, but it is complicated on LSB Endian machines */
4629
4630 /* Handle null pointers */
4631 if (p1 == NULL || p2 == NULL)
4632 return (p1 == p2);
4633
4634 while (bits >= 8) {
4635 if (*p1++ != *p2++)
4636 return 0;
4637 bits -= 8;
4638 }
4639
4640 if (bits > 0) {
4641 u_int8_t mask = ~((1<<(8-bits))-1);
4642 if ((*p1 & mask) != (*p2 & mask))
4643 return 0;
4644 }
4645 return 1; /* Match! */
4646 }
4647
4648 static void
key_flush_spd(time_t now)4649 key_flush_spd(time_t now)
4650 {
4651 SPTREE_RLOCK_TRACKER;
4652 struct secpolicy_list drainq;
4653 struct secpolicy *sp, *nextsp;
4654 u_int dir;
4655
4656 LIST_INIT(&drainq);
4657 SPTREE_RLOCK();
4658 for (dir = 0; dir < IPSEC_DIR_MAX; dir++) {
4659 TAILQ_FOREACH(sp, &V_sptree[dir], chain) {
4660 if (sp->lifetime == 0 && sp->validtime == 0)
4661 continue;
4662 if ((sp->lifetime &&
4663 now - sp->created > sp->lifetime) ||
4664 (sp->validtime &&
4665 now - sp->lastused > sp->validtime)) {
4666 /* Hold extra reference to send SPDEXPIRE */
4667 SP_ADDREF(sp);
4668 LIST_INSERT_HEAD(&drainq, sp, drainq);
4669 }
4670 }
4671 }
4672 SPTREE_RUNLOCK();
4673 if (LIST_EMPTY(&drainq))
4674 return;
4675
4676 SPTREE_WLOCK();
4677 sp = LIST_FIRST(&drainq);
4678 while (sp != NULL) {
4679 nextsp = LIST_NEXT(sp, drainq);
4680 /* Check that SP is still linked */
4681 if (sp->state != IPSEC_SPSTATE_ALIVE) {
4682 LIST_REMOVE(sp, drainq);
4683 key_freesp(&sp); /* release extra reference */
4684 sp = nextsp;
4685 continue;
4686 }
4687 TAILQ_REMOVE(&V_sptree[sp->spidx.dir], sp, chain);
4688 V_spd_size--;
4689 LIST_REMOVE(sp, idhash);
4690 sp->state = IPSEC_SPSTATE_DEAD;
4691 ipsec_accel_spddel(sp);
4692 sp = nextsp;
4693 }
4694 V_sp_genid++;
4695 SPTREE_WUNLOCK();
4696 if (SPDCACHE_ENABLED())
4697 spdcache_clear();
4698
4699 sp = LIST_FIRST(&drainq);
4700 while (sp != NULL) {
4701 nextsp = LIST_NEXT(sp, drainq);
4702 key_spdexpire(sp);
4703 key_freesp(&sp); /* release extra reference */
4704 key_freesp(&sp); /* release last reference */
4705 sp = nextsp;
4706 }
4707 }
4708
4709 static void
key_flush_sad(time_t now)4710 key_flush_sad(time_t now)
4711 {
4712 SAHTREE_RLOCK_TRACKER;
4713 struct secashead_list emptyq;
4714 struct secasvar_list drainq, hexpireq, sexpireq, freeq;
4715 struct secashead *sah, *nextsah;
4716 struct secasvar *sav, *nextsav;
4717
4718 SECASVAR_RLOCK_TRACKER;
4719
4720 LIST_INIT(&drainq);
4721 LIST_INIT(&hexpireq);
4722 LIST_INIT(&sexpireq);
4723 LIST_INIT(&emptyq);
4724
4725 SAHTREE_RLOCK();
4726 TAILQ_FOREACH(sah, &V_sahtree, chain) {
4727 /* Check for empty SAH */
4728 if (TAILQ_EMPTY(&sah->savtree_larval) &&
4729 TAILQ_EMPTY(&sah->savtree_alive)) {
4730 SAH_ADDREF(sah);
4731 LIST_INSERT_HEAD(&emptyq, sah, drainq);
4732 continue;
4733 }
4734 /* Add all stale LARVAL SAs into drainq */
4735 TAILQ_FOREACH(sav, &sah->savtree_larval, chain) {
4736 if (now - sav->created < V_key_larval_lifetime)
4737 continue;
4738 SAV_ADDREF(sav);
4739 LIST_INSERT_HEAD(&drainq, sav, drainq);
4740 }
4741 TAILQ_FOREACH(sav, &sah->savtree_alive, chain) {
4742 /* lifetimes aren't specified */
4743 if (sav->lft_h == NULL)
4744 continue;
4745 SECASVAR_RLOCK(sav);
4746 /*
4747 * Check again with lock held, because it may
4748 * be updated by SADB_UPDATE.
4749 */
4750 if (sav->lft_h == NULL) {
4751 SECASVAR_RUNLOCK(sav);
4752 continue;
4753 }
4754 /*
4755 * RFC 2367:
4756 * HARD lifetimes MUST take precedence over SOFT
4757 * lifetimes, meaning if the HARD and SOFT lifetimes
4758 * are the same, the HARD lifetime will appear on the
4759 * EXPIRE message.
4760 */
4761 /* check HARD lifetime */
4762 if ((sav->lft_h->addtime != 0 &&
4763 now - sav->created > sav->lft_h->addtime) ||
4764 (sav->lft_h->usetime != 0 && sav->firstused &&
4765 now - sav->firstused > sav->lft_h->usetime) ||
4766 (sav->lft_h->bytes != 0 && counter_u64_fetch(
4767 sav->lft_c_bytes) > sav->lft_h->bytes)) {
4768 SECASVAR_RUNLOCK(sav);
4769 SAV_ADDREF(sav);
4770 LIST_INSERT_HEAD(&hexpireq, sav, drainq);
4771 continue;
4772 }
4773 /* check SOFT lifetime (only for MATURE SAs) */
4774 if (sav->state == SADB_SASTATE_MATURE && (
4775 (sav->lft_s->addtime != 0 &&
4776 now - sav->created > sav->lft_s->addtime) ||
4777 (sav->lft_s->usetime != 0 && sav->firstused &&
4778 now - sav->firstused > sav->lft_s->usetime) ||
4779 (sav->lft_s->bytes != 0 && counter_u64_fetch(
4780 sav->lft_c_bytes) > sav->lft_s->bytes) ||
4781 (!(sav->flags & SADB_X_SAFLAGS_ESN) &&
4782 (sav->replay != NULL) && (
4783 (sav->replay->count > UINT32_80PCT) ||
4784 (sav->replay->last > UINT32_80PCT))))) {
4785 SECASVAR_RUNLOCK(sav);
4786 SAV_ADDREF(sav);
4787 LIST_INSERT_HEAD(&sexpireq, sav, drainq);
4788 continue;
4789 }
4790 SECASVAR_RUNLOCK(sav);
4791 }
4792 }
4793 SAHTREE_RUNLOCK();
4794
4795 if (LIST_EMPTY(&emptyq) && LIST_EMPTY(&drainq) &&
4796 LIST_EMPTY(&hexpireq) && LIST_EMPTY(&sexpireq))
4797 return;
4798
4799 LIST_INIT(&freeq);
4800 SAHTREE_WLOCK();
4801 /* Unlink stale LARVAL SAs */
4802 sav = LIST_FIRST(&drainq);
4803 while (sav != NULL) {
4804 nextsav = LIST_NEXT(sav, drainq);
4805 /* Check that SA is still LARVAL */
4806 if (sav->state != SADB_SASTATE_LARVAL) {
4807 LIST_REMOVE(sav, drainq);
4808 LIST_INSERT_HEAD(&freeq, sav, drainq);
4809 sav = nextsav;
4810 continue;
4811 }
4812 TAILQ_REMOVE(&sav->sah->savtree_larval, sav, chain);
4813 LIST_REMOVE(sav, spihash);
4814 sav->state = SADB_SASTATE_DEAD;
4815 ipsec_accel_forget_sav(sav);
4816 sav = nextsav;
4817 }
4818 /* Unlink all SAs with expired HARD lifetime */
4819 sav = LIST_FIRST(&hexpireq);
4820 while (sav != NULL) {
4821 nextsav = LIST_NEXT(sav, drainq);
4822 /* Check that SA is not unlinked */
4823 if (sav->state == SADB_SASTATE_DEAD) {
4824 LIST_REMOVE(sav, drainq);
4825 LIST_INSERT_HEAD(&freeq, sav, drainq);
4826 sav = nextsav;
4827 continue;
4828 }
4829 TAILQ_REMOVE(&sav->sah->savtree_alive, sav, chain);
4830 LIST_REMOVE(sav, spihash);
4831 sav->state = SADB_SASTATE_DEAD;
4832 ipsec_accel_forget_sav(sav);
4833 sav = nextsav;
4834 }
4835 /* Mark all SAs with expired SOFT lifetime as DYING */
4836 sav = LIST_FIRST(&sexpireq);
4837 while (sav != NULL) {
4838 nextsav = LIST_NEXT(sav, drainq);
4839 /* Check that SA is not unlinked */
4840 if (sav->state == SADB_SASTATE_DEAD) {
4841 LIST_REMOVE(sav, drainq);
4842 LIST_INSERT_HEAD(&freeq, sav, drainq);
4843 sav = nextsav;
4844 continue;
4845 }
4846 /*
4847 * NOTE: this doesn't change SA order in the chain.
4848 */
4849 sav->state = SADB_SASTATE_DYING;
4850 sav = nextsav;
4851 }
4852 /* Unlink empty SAHs */
4853 sah = LIST_FIRST(&emptyq);
4854 while (sah != NULL) {
4855 nextsah = LIST_NEXT(sah, drainq);
4856 /* Check that SAH is still empty and not unlinked */
4857 if (sah->state == SADB_SASTATE_DEAD ||
4858 !TAILQ_EMPTY(&sah->savtree_larval) ||
4859 !TAILQ_EMPTY(&sah->savtree_alive)) {
4860 LIST_REMOVE(sah, drainq);
4861 key_freesah(&sah); /* release extra reference */
4862 sah = nextsah;
4863 continue;
4864 }
4865 TAILQ_REMOVE(&V_sahtree, sah, chain);
4866 LIST_REMOVE(sah, addrhash);
4867 sah->state = SADB_SASTATE_DEAD;
4868 sah = nextsah;
4869 }
4870 SAHTREE_WUNLOCK();
4871
4872 /* Send SPDEXPIRE messages */
4873 sav = LIST_FIRST(&hexpireq);
4874 while (sav != NULL) {
4875 nextsav = LIST_NEXT(sav, drainq);
4876 key_expire(sav, 1);
4877 key_freesah(&sav->sah); /* release reference from SAV */
4878 key_freesav(&sav); /* release extra reference */
4879 key_freesav(&sav); /* release last reference */
4880 sav = nextsav;
4881 }
4882 sav = LIST_FIRST(&sexpireq);
4883 while (sav != NULL) {
4884 nextsav = LIST_NEXT(sav, drainq);
4885 key_expire(sav, 0);
4886 key_freesav(&sav); /* release extra reference */
4887 sav = nextsav;
4888 }
4889 /* Free stale LARVAL SAs */
4890 sav = LIST_FIRST(&drainq);
4891 while (sav != NULL) {
4892 nextsav = LIST_NEXT(sav, drainq);
4893 key_freesah(&sav->sah); /* release reference from SAV */
4894 key_freesav(&sav); /* release extra reference */
4895 key_freesav(&sav); /* release last reference */
4896 sav = nextsav;
4897 }
4898 /* Free SAs that were unlinked/changed by someone else */
4899 sav = LIST_FIRST(&freeq);
4900 while (sav != NULL) {
4901 nextsav = LIST_NEXT(sav, drainq);
4902 key_freesav(&sav); /* release extra reference */
4903 sav = nextsav;
4904 }
4905 /* Free empty SAH */
4906 sah = LIST_FIRST(&emptyq);
4907 while (sah != NULL) {
4908 nextsah = LIST_NEXT(sah, drainq);
4909 key_freesah(&sah); /* release extra reference */
4910 key_freesah(&sah); /* release last reference */
4911 sah = nextsah;
4912 }
4913 }
4914
4915 static void
key_flush_acq(time_t now)4916 key_flush_acq(time_t now)
4917 {
4918 struct secacq *acq, *nextacq;
4919
4920 /* ACQ tree */
4921 ACQ_LOCK();
4922 acq = LIST_FIRST(&V_acqtree);
4923 while (acq != NULL) {
4924 nextacq = LIST_NEXT(acq, chain);
4925 if (now - acq->created > V_key_blockacq_lifetime) {
4926 LIST_REMOVE(acq, chain);
4927 LIST_REMOVE(acq, addrhash);
4928 LIST_REMOVE(acq, seqhash);
4929 free(acq, M_IPSEC_SAQ);
4930 }
4931 acq = nextacq;
4932 }
4933 ACQ_UNLOCK();
4934 }
4935
4936 static void
key_flush_spacq(time_t now)4937 key_flush_spacq(time_t now)
4938 {
4939 struct secspacq *acq, *nextacq;
4940
4941 /* SP ACQ tree */
4942 SPACQ_LOCK();
4943 for (acq = LIST_FIRST(&V_spacqtree); acq != NULL; acq = nextacq) {
4944 nextacq = LIST_NEXT(acq, chain);
4945 if (now - acq->created > V_key_blockacq_lifetime
4946 && __LIST_CHAINED(acq)) {
4947 LIST_REMOVE(acq, chain);
4948 free(acq, M_IPSEC_SAQ);
4949 }
4950 }
4951 SPACQ_UNLOCK();
4952 }
4953
4954 /*
4955 * time handler.
4956 * scanning SPD and SAD to check status for each entries,
4957 * and do to remove or to expire.
4958 * XXX: year 2038 problem may remain.
4959 */
4960 static void
key_timehandler(void * arg)4961 key_timehandler(void *arg)
4962 {
4963 VNET_ITERATOR_DECL(vnet_iter);
4964 time_t now = time_second;
4965
4966 VNET_LIST_RLOCK_NOSLEEP();
4967 VNET_FOREACH(vnet_iter) {
4968 CURVNET_SET(vnet_iter);
4969 key_flush_spd(now);
4970 key_flush_sad(now);
4971 key_flush_acq(now);
4972 key_flush_spacq(now);
4973 CURVNET_RESTORE();
4974 }
4975 VNET_LIST_RUNLOCK_NOSLEEP();
4976
4977 #ifndef IPSEC_DEBUG2
4978 /* do exchange to tick time !! */
4979 callout_schedule(&key_timer, hz);
4980 #endif /* IPSEC_DEBUG2 */
4981 }
4982
4983 u_long
key_random(void)4984 key_random(void)
4985 {
4986 u_long value;
4987
4988 arc4random_buf(&value, sizeof(value));
4989 return value;
4990 }
4991
4992 /*
4993 * map SADB_SATYPE_* to IPPROTO_*.
4994 * if satype == SADB_SATYPE then satype is mapped to ~0.
4995 * OUT:
4996 * 0: invalid satype.
4997 */
4998 static uint8_t
key_satype2proto(uint8_t satype)4999 key_satype2proto(uint8_t satype)
5000 {
5001 switch (satype) {
5002 case SADB_SATYPE_UNSPEC:
5003 return IPSEC_PROTO_ANY;
5004 case SADB_SATYPE_AH:
5005 return IPPROTO_AH;
5006 case SADB_SATYPE_ESP:
5007 return IPPROTO_ESP;
5008 case SADB_X_SATYPE_IPCOMP:
5009 return IPPROTO_IPCOMP;
5010 case SADB_X_SATYPE_TCPSIGNATURE:
5011 return IPPROTO_TCP;
5012 default:
5013 return 0;
5014 }
5015 /* NOTREACHED */
5016 }
5017
5018 /*
5019 * map IPPROTO_* to SADB_SATYPE_*
5020 * OUT:
5021 * 0: invalid protocol type.
5022 */
5023 static uint8_t
key_proto2satype(uint8_t proto)5024 key_proto2satype(uint8_t proto)
5025 {
5026 switch (proto) {
5027 case IPPROTO_AH:
5028 return SADB_SATYPE_AH;
5029 case IPPROTO_ESP:
5030 return SADB_SATYPE_ESP;
5031 case IPPROTO_IPCOMP:
5032 return SADB_X_SATYPE_IPCOMP;
5033 case IPPROTO_TCP:
5034 return SADB_X_SATYPE_TCPSIGNATURE;
5035 default:
5036 return 0;
5037 }
5038 /* NOTREACHED */
5039 }
5040
5041 /* %%% PF_KEY */
5042 /*
5043 * SADB_GETSPI processing is to receive
5044 * <base, (SA2), src address, dst address, (SPI range)>
5045 * from the IKMPd, to assign a unique spi value, to hang on the INBOUND
5046 * tree with the status of LARVAL, and send
5047 * <base, SA(*), address(SD)>
5048 * to the IKMPd.
5049 *
5050 * IN: mhp: pointer to the pointer to each header.
5051 * OUT: NULL if fail.
5052 * other if success, return pointer to the message to send.
5053 */
5054 static int
key_getspi(struct socket * so,struct mbuf * m,const struct sadb_msghdr * mhp)5055 key_getspi(struct socket *so, struct mbuf *m, const struct sadb_msghdr *mhp)
5056 {
5057 struct secasindex saidx;
5058 struct sadb_address *src0, *dst0;
5059 struct secasvar *sav;
5060 uint32_t reqid, spi;
5061 int error;
5062 uint8_t mode, proto;
5063
5064 IPSEC_ASSERT(so != NULL, ("null socket"));
5065 IPSEC_ASSERT(m != NULL, ("null mbuf"));
5066 IPSEC_ASSERT(mhp != NULL, ("null msghdr"));
5067 IPSEC_ASSERT(mhp->msg != NULL, ("null msg"));
5068
5069 if (SADB_CHECKHDR(mhp, SADB_EXT_ADDRESS_SRC) ||
5070 SADB_CHECKHDR(mhp, SADB_EXT_ADDRESS_DST)
5071 #ifdef PFKEY_STRICT_CHECKS
5072 || SADB_CHECKHDR(mhp, SADB_EXT_SPIRANGE)
5073 #endif
5074 ) {
5075 ipseclog((LOG_DEBUG,
5076 "%s: invalid message: missing required header.\n",
5077 __func__));
5078 error = EINVAL;
5079 goto fail;
5080 }
5081 if (SADB_CHECKLEN(mhp, SADB_EXT_ADDRESS_SRC) ||
5082 SADB_CHECKLEN(mhp, SADB_EXT_ADDRESS_DST)
5083 #ifdef PFKEY_STRICT_CHECKS
5084 || SADB_CHECKLEN(mhp, SADB_EXT_SPIRANGE)
5085 #endif
5086 ) {
5087 ipseclog((LOG_DEBUG,
5088 "%s: invalid message: wrong header size.\n", __func__));
5089 error = EINVAL;
5090 goto fail;
5091 }
5092 if (SADB_CHECKHDR(mhp, SADB_X_EXT_SA2)) {
5093 mode = IPSEC_MODE_ANY;
5094 reqid = 0;
5095 } else {
5096 if (SADB_CHECKLEN(mhp, SADB_X_EXT_SA2)) {
5097 ipseclog((LOG_DEBUG,
5098 "%s: invalid message: wrong header size.\n",
5099 __func__));
5100 error = EINVAL;
5101 goto fail;
5102 }
5103 mode = ((struct sadb_x_sa2 *)
5104 mhp->ext[SADB_X_EXT_SA2])->sadb_x_sa2_mode;
5105 reqid = ((struct sadb_x_sa2 *)
5106 mhp->ext[SADB_X_EXT_SA2])->sadb_x_sa2_reqid;
5107 }
5108
5109 src0 = (struct sadb_address *)(mhp->ext[SADB_EXT_ADDRESS_SRC]);
5110 dst0 = (struct sadb_address *)(mhp->ext[SADB_EXT_ADDRESS_DST]);
5111
5112 /* map satype to proto */
5113 if ((proto = key_satype2proto(mhp->msg->sadb_msg_satype)) == 0) {
5114 ipseclog((LOG_DEBUG, "%s: invalid satype is passed.\n",
5115 __func__));
5116 error = EINVAL;
5117 goto fail;
5118 }
5119 error = key_checksockaddrs((struct sockaddr *)(src0 + 1),
5120 (struct sockaddr *)(dst0 + 1));
5121 if (error != 0) {
5122 ipseclog((LOG_DEBUG, "%s: invalid sockaddr.\n", __func__));
5123 error = EINVAL;
5124 goto fail;
5125 }
5126 key_setsecasidx(proto, mode, reqid, src0 + 1, dst0 + 1, &saidx);
5127
5128 /* SPI allocation */
5129 SPI_ALLOC_LOCK();
5130 spi = key_do_getnewspi(
5131 (struct sadb_spirange *)mhp->ext[SADB_EXT_SPIRANGE], &saidx);
5132 if (spi == 0) {
5133 /*
5134 * Requested SPI or SPI range is not available or
5135 * already used.
5136 */
5137 SPI_ALLOC_UNLOCK();
5138 error = EEXIST;
5139 goto fail;
5140 }
5141 sav = key_newsav(mhp, &saidx, spi, &error);
5142 SPI_ALLOC_UNLOCK();
5143 if (sav == NULL)
5144 goto fail;
5145
5146 if (sav->seq != 0) {
5147 /*
5148 * RFC2367:
5149 * If the SADB_GETSPI message is in response to a
5150 * kernel-generated SADB_ACQUIRE, the sadb_msg_seq
5151 * MUST be the same as the SADB_ACQUIRE message.
5152 *
5153 * XXXAE: However it doesn't definethe behaviour how to
5154 * check this and what to do if it doesn't match.
5155 * Also what we should do if it matches?
5156 *
5157 * We can compare saidx used in SADB_ACQUIRE with saidx
5158 * used in SADB_GETSPI, but this probably can break
5159 * existing software. For now just warn if it doesn't match.
5160 *
5161 * XXXAE: anyway it looks useless.
5162 */
5163 key_acqdone(&saidx, sav->seq);
5164 }
5165 KEYDBG(KEY_STAMP,
5166 printf("%s: SA(%p)\n", __func__, sav));
5167 KEYDBG(KEY_DATA, kdebug_secasv(sav));
5168
5169 {
5170 struct mbuf *n, *nn;
5171 struct sadb_sa *m_sa;
5172 struct sadb_msg *newmsg;
5173 int off, len;
5174
5175 /* create new sadb_msg to reply. */
5176 len = PFKEY_ALIGN8(sizeof(struct sadb_msg)) +
5177 PFKEY_ALIGN8(sizeof(struct sadb_sa));
5178
5179 n = key_mget(len);
5180 if (n == NULL) {
5181 error = ENOBUFS;
5182 goto fail;
5183 }
5184
5185 n->m_len = len;
5186 n->m_next = NULL;
5187 off = 0;
5188
5189 m_copydata(m, 0, sizeof(struct sadb_msg), mtod(n, caddr_t) + off);
5190 off += PFKEY_ALIGN8(sizeof(struct sadb_msg));
5191
5192 m_sa = (struct sadb_sa *)(mtod(n, caddr_t) + off);
5193 m_sa->sadb_sa_len = PFKEY_UNIT64(sizeof(struct sadb_sa));
5194 m_sa->sadb_sa_exttype = SADB_EXT_SA;
5195 m_sa->sadb_sa_spi = spi; /* SPI is already in network byte order */
5196 off += PFKEY_ALIGN8(sizeof(struct sadb_sa));
5197
5198 IPSEC_ASSERT(off == len,
5199 ("length inconsistency (off %u len %u)", off, len));
5200
5201 n->m_next = key_gather_mbuf(m, mhp, 0, 2, SADB_EXT_ADDRESS_SRC,
5202 SADB_EXT_ADDRESS_DST);
5203 if (!n->m_next) {
5204 m_freem(n);
5205 error = ENOBUFS;
5206 goto fail;
5207 }
5208
5209 if (n->m_len < sizeof(struct sadb_msg)) {
5210 n = m_pullup(n, sizeof(struct sadb_msg));
5211 if (n == NULL)
5212 return key_sendup_mbuf(so, m, KEY_SENDUP_ONE);
5213 }
5214
5215 n->m_pkthdr.len = 0;
5216 for (nn = n; nn; nn = nn->m_next)
5217 n->m_pkthdr.len += nn->m_len;
5218
5219 newmsg = mtod(n, struct sadb_msg *);
5220 newmsg->sadb_msg_seq = sav->seq;
5221 newmsg->sadb_msg_errno = 0;
5222 newmsg->sadb_msg_len = PFKEY_UNIT64(n->m_pkthdr.len);
5223
5224 m_freem(m);
5225 return key_sendup_mbuf(so, n, KEY_SENDUP_ONE);
5226 }
5227
5228 fail:
5229 return (key_senderror(so, m, error));
5230 }
5231
5232 /*
5233 * allocating new SPI
5234 * called by key_getspi().
5235 * OUT:
5236 * 0: failure.
5237 * others: success, SPI in network byte order.
5238 */
5239 static uint32_t
key_do_getnewspi(struct sadb_spirange * spirange,struct secasindex * saidx)5240 key_do_getnewspi(struct sadb_spirange *spirange, struct secasindex *saidx)
5241 {
5242 uint32_t min, max, newspi, t;
5243 int tries, limit;
5244
5245 SPI_ALLOC_LOCK_ASSERT();
5246
5247 /* set spi range to allocate */
5248 if (spirange != NULL) {
5249 min = spirange->sadb_spirange_min;
5250 max = spirange->sadb_spirange_max;
5251 } else {
5252 min = V_key_spi_minval;
5253 max = V_key_spi_maxval;
5254 }
5255 /* IPCOMP needs 2-byte SPI */
5256 if (saidx->proto == IPPROTO_IPCOMP) {
5257 if (min >= 0x10000)
5258 min = 0xffff;
5259 if (max >= 0x10000)
5260 max = 0xffff;
5261 if (min > max) {
5262 t = min; min = max; max = t;
5263 }
5264 }
5265
5266 if (min == max) {
5267 if (key_checkspidup(htonl(min))) {
5268 ipseclog((LOG_DEBUG, "%s: SPI %u exists already.\n",
5269 __func__, min));
5270 return 0;
5271 }
5272
5273 tries = 1;
5274 newspi = min;
5275 } else {
5276 /* init SPI */
5277 newspi = 0;
5278
5279 limit = atomic_load_int(&V_key_spi_trycnt);
5280 /* when requesting to allocate spi ranged */
5281 for (tries = 0; tries < limit; tries++) {
5282 /* generate pseudo-random SPI value ranged. */
5283 newspi = min + (key_random() % (max - min + 1));
5284 if (!key_checkspidup(htonl(newspi)))
5285 break;
5286 }
5287
5288 if (tries == limit || newspi == 0) {
5289 ipseclog((LOG_DEBUG,
5290 "%s: failed to allocate SPI.\n", __func__));
5291 return 0;
5292 }
5293 }
5294
5295 /* statistics */
5296 keystat.getspi_count =
5297 (keystat.getspi_count + tries) / 2;
5298
5299 return (htonl(newspi));
5300 }
5301
5302 /*
5303 * Find TCP-MD5 SA with corresponding secasindex.
5304 * If not found, return NULL and fill SPI with usable value if needed.
5305 */
5306 static struct secasvar *
key_getsav_tcpmd5(struct secasindex * saidx,uint32_t * spi)5307 key_getsav_tcpmd5(struct secasindex *saidx, uint32_t *spi)
5308 {
5309 SAHTREE_RLOCK_TRACKER;
5310 struct secashead *sah;
5311 struct secasvar *sav;
5312
5313 IPSEC_ASSERT(saidx->proto == IPPROTO_TCP, ("wrong proto"));
5314 SAHTREE_RLOCK();
5315 LIST_FOREACH(sah, SAHADDRHASH_HASH(saidx), addrhash) {
5316 if (sah->saidx.proto != IPPROTO_TCP)
5317 continue;
5318 if (!key_sockaddrcmp(&saidx->dst.sa, &sah->saidx.dst.sa, 0) &&
5319 !key_sockaddrcmp(&saidx->src.sa, &sah->saidx.src.sa, 0))
5320 break;
5321 }
5322 if (sah != NULL) {
5323 if (V_key_preferred_oldsa)
5324 sav = TAILQ_LAST(&sah->savtree_alive, secasvar_queue);
5325 else
5326 sav = TAILQ_FIRST(&sah->savtree_alive);
5327 if (sav != NULL) {
5328 SAV_ADDREF(sav);
5329 SAHTREE_RUNLOCK();
5330 return (sav);
5331 }
5332 }
5333 if (spi == NULL) {
5334 /* No SPI required */
5335 SAHTREE_RUNLOCK();
5336 return (NULL);
5337 }
5338 /* Check that SPI is unique */
5339 LIST_FOREACH(sav, SAVHASH_HASH(*spi), spihash) {
5340 if (sav->spi == *spi)
5341 break;
5342 }
5343 if (sav == NULL) {
5344 SAHTREE_RUNLOCK();
5345 /* SPI is already unique */
5346 return (NULL);
5347 }
5348 SAHTREE_RUNLOCK();
5349 /* XXX: not optimal */
5350 *spi = key_do_getnewspi(NULL, saidx);
5351 return (NULL);
5352 }
5353
5354 static int
key_updateaddresses(struct socket * so,struct mbuf * m,const struct sadb_msghdr * mhp,struct secasvar * sav,struct secasindex * saidx)5355 key_updateaddresses(struct socket *so, struct mbuf *m,
5356 const struct sadb_msghdr *mhp, struct secasvar *sav,
5357 struct secasindex *saidx)
5358 {
5359 struct sockaddr *dnewaddr, *snewaddr;
5360 struct secashead *sah;
5361 struct secasvar *newsav, *tmp;
5362 struct mbuf *n;
5363 int error, isnew;
5364 bool newsaidx;
5365
5366 newsaidx = false;
5367 /* Check that we need to change SAH */
5368 if (!SADB_CHECKHDR(mhp, SADB_X_EXT_NEW_ADDRESS_SRC)) {
5369 snewaddr = (struct sockaddr *)(((struct sadb_address *)
5370 mhp->ext[SADB_X_EXT_NEW_ADDRESS_SRC]) + 1);
5371 newsaidx = true;
5372 } else {
5373 snewaddr = &saidx->src.sa;
5374 }
5375 if (!SADB_CHECKHDR(mhp, SADB_X_EXT_NEW_ADDRESS_DST)) {
5376 dnewaddr = (struct sockaddr *)(((struct sadb_address *)
5377 mhp->ext[SADB_X_EXT_NEW_ADDRESS_DST]) + 1);
5378 newsaidx = true;
5379 } else {
5380 dnewaddr = &saidx->dst.sa;
5381 }
5382 error = key_checksockaddrs(snewaddr, dnewaddr);
5383 if (error != 0) {
5384 ipseclog((LOG_DEBUG, "%s: invalid new sockaddr.\n",
5385 __func__));
5386 return (error);
5387 }
5388 if (!SADB_CHECKHDR(mhp, SADB_X_EXT_NEW_ADDRESS_SRC)) {
5389 memcpy(&saidx->src, snewaddr, snewaddr->sa_len);
5390 key_porttosaddr(&saidx->src.sa, 0);
5391 }
5392 if (!SADB_CHECKHDR(mhp, SADB_X_EXT_NEW_ADDRESS_DST)) {
5393 memcpy(&saidx->dst, dnewaddr, dnewaddr->sa_len);
5394 key_porttosaddr(&saidx->dst.sa, 0);
5395 }
5396 if (newsaidx) {
5397 sah = key_getsah(saidx);
5398 if (sah == NULL) {
5399 /* create a new SA index */
5400 sah = key_newsah(saidx);
5401 if (sah == NULL) {
5402 ipseclog((LOG_DEBUG,
5403 "%s: No more memory.\n", __func__));
5404 return (ENOBUFS);
5405 }
5406 isnew = 2; /* SAH is new */
5407 } else
5408 isnew = 1; /* existing SAH is referenced */
5409 } else {
5410 /*
5411 * src and dst addresses are still the same.
5412 * Do we want to change NAT-T config?
5413 */
5414 if (sav->sah->saidx.proto != IPPROTO_ESP ||
5415 SADB_CHECKHDR(mhp, SADB_X_EXT_NAT_T_TYPE) ||
5416 SADB_CHECKHDR(mhp, SADB_X_EXT_NAT_T_SPORT) ||
5417 SADB_CHECKHDR(mhp, SADB_X_EXT_NAT_T_DPORT)) {
5418 ipseclog((LOG_DEBUG,
5419 "%s: invalid message: missing required header.\n",
5420 __func__));
5421 return (EINVAL);
5422 }
5423 /* We hold reference to SA, thus SAH will be referenced too. */
5424 sah = sav->sah;
5425 isnew = 0;
5426 }
5427
5428 newsav = malloc(sizeof(struct secasvar), M_IPSEC_SA,
5429 M_NOWAIT | M_ZERO);
5430 if (newsav == NULL) {
5431 ipseclog((LOG_DEBUG, "%s: No more memory.\n", __func__));
5432 error = ENOBUFS;
5433 goto fail;
5434 }
5435
5436 /* Clone SA's content into newsav */
5437 SAV_INITREF(newsav);
5438 bcopy(sav, newsav, offsetof(struct secasvar, chain));
5439 #ifdef IPSEC_OFFLOAD
5440 CK_LIST_INIT(&newsav->accel_ifps);
5441 newsav->accel_forget_tq = 0;
5442 newsav->accel_lft_sw = uma_zalloc_pcpu(ipsec_key_lft_zone,
5443 M_NOWAIT | M_ZERO);
5444 if (newsav->accel_lft_sw == NULL) {
5445 error = ENOBUFS;
5446 goto fail;
5447 }
5448 if (sav->accel_ifname != NULL) {
5449 struct sadb_x_if_hw_offl xof;
5450
5451 newsav->accel_ifname = malloc(sizeof(xof.sadb_x_if_hw_offl_if),
5452 M_IPSEC_MISC, M_NOWAIT);
5453 if (newsav->accel_ifname == NULL) {
5454 error = ENOBUFS;
5455 goto fail;
5456 }
5457 strncpy(__DECONST(char *, sav->accel_ifname),
5458 newsav->accel_ifname,
5459 sizeof(xof.sadb_x_if_hw_offl_if));
5460 }
5461 #endif
5462
5463 /*
5464 * We create new NAT-T config if it is needed.
5465 * Old NAT-T config will be freed by key_cleansav() when
5466 * last reference to SA will be released.
5467 */
5468 newsav->natt = NULL;
5469 newsav->sah = sah;
5470 newsav->state = SADB_SASTATE_MATURE;
5471 error = key_setnatt(newsav, mhp);
5472 if (error != 0)
5473 goto fail;
5474
5475 SAHTREE_WLOCK();
5476 /* Check that SA is still alive */
5477 if (sav->state == SADB_SASTATE_DEAD) {
5478 /* SA was unlinked */
5479 SAHTREE_WUNLOCK();
5480 error = ESRCH;
5481 goto fail;
5482 }
5483
5484 /* Unlink SA from SAH and SPI hash */
5485 IPSEC_ASSERT((sav->flags & SADB_X_EXT_F_CLONED) == 0,
5486 ("SA is already cloned"));
5487 IPSEC_ASSERT(sav->state == SADB_SASTATE_MATURE ||
5488 sav->state == SADB_SASTATE_DYING,
5489 ("Wrong SA state %u\n", sav->state));
5490 TAILQ_REMOVE(&sav->sah->savtree_alive, sav, chain);
5491 LIST_REMOVE(sav, spihash);
5492 sav->state = SADB_SASTATE_DEAD;
5493 ipsec_accel_forget_sav(sav);
5494
5495 /*
5496 * Link new SA with SAH. Keep SAs ordered by
5497 * create time (newer are first).
5498 */
5499 TAILQ_FOREACH(tmp, &sah->savtree_alive, chain) {
5500 if (newsav->created > tmp->created) {
5501 TAILQ_INSERT_BEFORE(tmp, newsav, chain);
5502 break;
5503 }
5504 }
5505 if (tmp == NULL)
5506 TAILQ_INSERT_TAIL(&sah->savtree_alive, newsav, chain);
5507
5508 /* Add new SA into SPI hash. */
5509 LIST_INSERT_HEAD(SAVHASH_HASH(newsav->spi), newsav, spihash);
5510
5511 /* Add new SAH into SADB. */
5512 if (isnew == 2) {
5513 TAILQ_INSERT_HEAD(&V_sahtree, sah, chain);
5514 LIST_INSERT_HEAD(SAHADDRHASH_HASH(saidx), sah, addrhash);
5515 sah->state = SADB_SASTATE_MATURE;
5516 SAH_ADDREF(sah); /* newsav references new SAH */
5517 }
5518 /*
5519 * isnew == 1 -> @sah was referenced by key_getsah().
5520 * isnew == 0 -> we use the same @sah, that was used by @sav,
5521 * and we use its reference for @newsav.
5522 */
5523 SECASVAR_WLOCK(sav);
5524 /* XXX: replace cntr with pointer? */
5525 newsav->cntr = sav->cntr;
5526 sav->flags |= SADB_X_EXT_F_CLONED;
5527 SECASVAR_WUNLOCK(sav);
5528
5529 SAHTREE_WUNLOCK();
5530
5531 KEYDBG(KEY_STAMP,
5532 printf("%s: SA(%p) cloned into SA(%p)\n",
5533 __func__, sav, newsav));
5534 KEYDBG(KEY_DATA, kdebug_secasv(newsav));
5535
5536 key_freesav(&sav); /* release last reference */
5537
5538 /* set msg buf from mhp */
5539 n = key_getmsgbuf_x1(m, mhp);
5540 if (n == NULL) {
5541 ipseclog((LOG_DEBUG, "%s: No more memory.\n", __func__));
5542 return (ENOBUFS);
5543 }
5544 m_freem(m);
5545 key_sendup_mbuf(so, n, KEY_SENDUP_ALL);
5546 return (0);
5547 fail:
5548 if (isnew != 0)
5549 key_freesah(&sah);
5550 if (newsav != NULL) {
5551 #ifdef IPSEC_OFFLOAD
5552 uma_zfree_pcpu(ipsec_key_lft_zone, newsav->accel_lft_sw);
5553 free(__DECONST(char *, newsav->accel_ifname), M_IPSEC_MISC);
5554 #endif
5555 if (newsav->natt != NULL)
5556 free(newsav->natt, M_IPSEC_MISC);
5557 free(newsav, M_IPSEC_SA);
5558 }
5559 return (error);
5560 }
5561
5562 /*
5563 * SADB_UPDATE processing
5564 * receive
5565 * <base, SA, (SA2), (lifetime(HSC),) address(SD), (address(P),)
5566 * key(AE), (identity(SD),) (sensitivity)>
5567 * from the ikmpd, and update a secasvar entry whose status is SADB_SASTATE_LARVAL.
5568 * and send
5569 * <base, SA, (SA2), (lifetime(HSC),) address(SD), (address(P),)
5570 * (identity(SD),) (sensitivity)>
5571 * to the ikmpd.
5572 *
5573 * m will always be freed.
5574 */
5575 static int
key_update(struct socket * so,struct mbuf * m,const struct sadb_msghdr * mhp)5576 key_update(struct socket *so, struct mbuf *m, const struct sadb_msghdr *mhp)
5577 {
5578 struct secasindex saidx;
5579 struct sadb_address *src0, *dst0;
5580 struct sadb_sa *sa0;
5581 struct secasvar *sav;
5582 uint32_t reqid;
5583 int error;
5584 uint8_t mode, proto;
5585
5586 IPSEC_ASSERT(so != NULL, ("null socket"));
5587 IPSEC_ASSERT(m != NULL, ("null mbuf"));
5588 IPSEC_ASSERT(mhp != NULL, ("null msghdr"));
5589 IPSEC_ASSERT(mhp->msg != NULL, ("null msg"));
5590
5591 /* map satype to proto */
5592 if ((proto = key_satype2proto(mhp->msg->sadb_msg_satype)) == 0) {
5593 ipseclog((LOG_DEBUG, "%s: invalid satype is passed.\n",
5594 __func__));
5595 return key_senderror(so, m, EINVAL);
5596 }
5597
5598 if (SADB_CHECKHDR(mhp, SADB_EXT_SA) ||
5599 SADB_CHECKHDR(mhp, SADB_EXT_ADDRESS_SRC) ||
5600 SADB_CHECKHDR(mhp, SADB_EXT_ADDRESS_DST) ||
5601 (SADB_CHECKHDR(mhp, SADB_EXT_LIFETIME_HARD) &&
5602 !SADB_CHECKHDR(mhp, SADB_EXT_LIFETIME_SOFT)) ||
5603 (SADB_CHECKHDR(mhp, SADB_EXT_LIFETIME_SOFT) &&
5604 !SADB_CHECKHDR(mhp, SADB_EXT_LIFETIME_HARD))) {
5605 ipseclog((LOG_DEBUG,
5606 "%s: invalid message: missing required header.\n",
5607 __func__));
5608 return key_senderror(so, m, EINVAL);
5609 }
5610 if (SADB_CHECKLEN(mhp, SADB_EXT_SA) ||
5611 SADB_CHECKLEN(mhp, SADB_EXT_ADDRESS_SRC) ||
5612 SADB_CHECKLEN(mhp, SADB_EXT_ADDRESS_DST)) {
5613 ipseclog((LOG_DEBUG,
5614 "%s: invalid message: wrong header size.\n", __func__));
5615 return key_senderror(so, m, EINVAL);
5616 }
5617 if (SADB_CHECKHDR(mhp, SADB_X_EXT_SA2)) {
5618 mode = IPSEC_MODE_ANY;
5619 reqid = 0;
5620 } else {
5621 if (SADB_CHECKLEN(mhp, SADB_X_EXT_SA2)) {
5622 ipseclog((LOG_DEBUG,
5623 "%s: invalid message: wrong header size.\n",
5624 __func__));
5625 return key_senderror(so, m, EINVAL);
5626 }
5627 mode = ((struct sadb_x_sa2 *)
5628 mhp->ext[SADB_X_EXT_SA2])->sadb_x_sa2_mode;
5629 reqid = ((struct sadb_x_sa2 *)
5630 mhp->ext[SADB_X_EXT_SA2])->sadb_x_sa2_reqid;
5631 }
5632
5633 sa0 = (struct sadb_sa *)mhp->ext[SADB_EXT_SA];
5634 src0 = (struct sadb_address *)(mhp->ext[SADB_EXT_ADDRESS_SRC]);
5635 dst0 = (struct sadb_address *)(mhp->ext[SADB_EXT_ADDRESS_DST]);
5636
5637 /*
5638 * Only SADB_SASTATE_MATURE SAs may be submitted in an
5639 * SADB_UPDATE message.
5640 */
5641 if (sa0->sadb_sa_state != SADB_SASTATE_MATURE) {
5642 ipseclog((LOG_DEBUG, "%s: invalid state.\n", __func__));
5643 #ifdef PFKEY_STRICT_CHECKS
5644 return key_senderror(so, m, EINVAL);
5645 #endif
5646 }
5647 error = key_checksockaddrs((struct sockaddr *)(src0 + 1),
5648 (struct sockaddr *)(dst0 + 1));
5649 if (error != 0) {
5650 ipseclog((LOG_DEBUG, "%s: invalid sockaddr.\n", __func__));
5651 return key_senderror(so, m, error);
5652 }
5653 key_setsecasidx(proto, mode, reqid, src0 + 1, dst0 + 1, &saidx);
5654 sav = key_getsavbyspi(sa0->sadb_sa_spi);
5655 if (sav == NULL) {
5656 ipseclog((LOG_DEBUG, "%s: no SA found for SPI %u\n",
5657 __func__, ntohl(sa0->sadb_sa_spi)));
5658 return key_senderror(so, m, EINVAL);
5659 }
5660 /*
5661 * Check that SADB_UPDATE issued by the same process that did
5662 * SADB_GETSPI or SADB_ADD.
5663 */
5664 if (sav->pid != mhp->msg->sadb_msg_pid) {
5665 ipseclog((LOG_DEBUG,
5666 "%s: pid mismatched (SPI %u, pid %u vs. %u)\n", __func__,
5667 ntohl(sav->spi), sav->pid, mhp->msg->sadb_msg_pid));
5668 key_freesav(&sav);
5669 return key_senderror(so, m, EINVAL);
5670 }
5671 /* saidx should match with SA. */
5672 if (key_cmpsaidx(&sav->sah->saidx, &saidx, CMP_MODE_REQID) == 0) {
5673 ipseclog((LOG_DEBUG, "%s: saidx mismatched for SPI %u\n",
5674 __func__, ntohl(sav->spi)));
5675 key_freesav(&sav);
5676 return key_senderror(so, m, ESRCH);
5677 }
5678
5679 if (sav->state == SADB_SASTATE_LARVAL) {
5680 if ((mhp->msg->sadb_msg_satype == SADB_SATYPE_ESP &&
5681 SADB_CHECKHDR(mhp, SADB_EXT_KEY_ENCRYPT)) ||
5682 (mhp->msg->sadb_msg_satype == SADB_SATYPE_AH &&
5683 SADB_CHECKHDR(mhp, SADB_EXT_KEY_AUTH))) {
5684 ipseclog((LOG_DEBUG,
5685 "%s: invalid message: missing required header.\n",
5686 __func__));
5687 key_freesav(&sav);
5688 return key_senderror(so, m, EINVAL);
5689 }
5690 /*
5691 * We can set any values except src, dst and SPI.
5692 */
5693 error = key_setsaval(sav, mhp);
5694 if (error != 0) {
5695 key_freesav(&sav);
5696 return (key_senderror(so, m, error));
5697 }
5698 /* Change SA state to MATURE */
5699 SAHTREE_WLOCK();
5700 if (sav->state != SADB_SASTATE_LARVAL) {
5701 /* SA was deleted or another thread made it MATURE. */
5702 SAHTREE_WUNLOCK();
5703 key_freesav(&sav);
5704 return (key_senderror(so, m, ESRCH));
5705 }
5706 /*
5707 * NOTE: we keep SAs in savtree_alive ordered by created
5708 * time. When SA's state changed from LARVAL to MATURE,
5709 * we update its created time in key_setsaval() and move
5710 * it into head of savtree_alive.
5711 */
5712 TAILQ_REMOVE(&sav->sah->savtree_larval, sav, chain);
5713 TAILQ_INSERT_HEAD(&sav->sah->savtree_alive, sav, chain);
5714 sav->state = SADB_SASTATE_MATURE;
5715 SAHTREE_WUNLOCK();
5716 } else {
5717 /*
5718 * For DYING and MATURE SA we can change only state
5719 * and lifetimes. Report EINVAL if something else attempted
5720 * to change.
5721 */
5722 if (!SADB_CHECKHDR(mhp, SADB_EXT_KEY_ENCRYPT) ||
5723 !SADB_CHECKHDR(mhp, SADB_EXT_KEY_AUTH)) {
5724 key_freesav(&sav);
5725 return (key_senderror(so, m, EINVAL));
5726 }
5727 error = key_updatelifetimes(sav, mhp);
5728 if (error != 0) {
5729 key_freesav(&sav);
5730 return (key_senderror(so, m, error));
5731 }
5732 /*
5733 * This is FreeBSD extension to RFC2367.
5734 * IKEd can specify SADB_X_EXT_NEW_ADDRESS_SRC and/or
5735 * SADB_X_EXT_NEW_ADDRESS_DST when it wants to change
5736 * SA addresses (for example to implement MOBIKE protocol
5737 * as described in RFC4555). Also we allow to change
5738 * NAT-T config.
5739 */
5740 if (!SADB_CHECKHDR(mhp, SADB_X_EXT_NEW_ADDRESS_SRC) ||
5741 !SADB_CHECKHDR(mhp, SADB_X_EXT_NEW_ADDRESS_DST) ||
5742 !SADB_CHECKHDR(mhp, SADB_X_EXT_NAT_T_TYPE) ||
5743 sav->natt != NULL) {
5744 error = key_updateaddresses(so, m, mhp, sav, &saidx);
5745 key_freesav(&sav);
5746 if (error != 0)
5747 return (key_senderror(so, m, error));
5748 return (0);
5749 }
5750 /* Check that SA is still alive */
5751 SAHTREE_WLOCK();
5752 if (sav->state == SADB_SASTATE_DEAD) {
5753 /* SA was unlinked */
5754 SAHTREE_WUNLOCK();
5755 key_freesav(&sav);
5756 return (key_senderror(so, m, ESRCH));
5757 }
5758 /*
5759 * NOTE: there is possible state moving from DYING to MATURE,
5760 * but this doesn't change created time, so we won't reorder
5761 * this SA.
5762 */
5763 sav->state = SADB_SASTATE_MATURE;
5764 SAHTREE_WUNLOCK();
5765 }
5766 KEYDBG(KEY_STAMP,
5767 printf("%s: SA(%p)\n", __func__, sav));
5768 KEYDBG(KEY_DATA, kdebug_secasv(sav));
5769 ipsec_accel_sa_newkey(sav);
5770 key_freesav(&sav);
5771
5772 {
5773 struct mbuf *n;
5774
5775 /* set msg buf from mhp */
5776 n = key_getmsgbuf_x1(m, mhp);
5777 if (n == NULL) {
5778 ipseclog((LOG_DEBUG, "%s: No more memory.\n", __func__));
5779 return key_senderror(so, m, ENOBUFS);
5780 }
5781
5782 m_freem(m);
5783 return key_sendup_mbuf(so, n, KEY_SENDUP_ALL);
5784 }
5785 }
5786
5787 /*
5788 * SADB_ADD processing
5789 * add an entry to SA database, when received
5790 * <base, SA, (SA2), (lifetime(HSC),) address(SD), (address(P),)
5791 * key(AE), (identity(SD),) (sensitivity)>
5792 * from the ikmpd,
5793 * and send
5794 * <base, SA, (SA2), (lifetime(HSC),) address(SD), (address(P),)
5795 * (identity(SD),) (sensitivity)>
5796 * to the ikmpd.
5797 *
5798 * IGNORE identity and sensitivity messages.
5799 *
5800 * m will always be freed.
5801 */
5802 static int
key_add(struct socket * so,struct mbuf * m,const struct sadb_msghdr * mhp)5803 key_add(struct socket *so, struct mbuf *m, const struct sadb_msghdr *mhp)
5804 {
5805 struct secasindex saidx;
5806 struct sadb_address *src0, *dst0;
5807 struct sadb_sa *sa0;
5808 struct secasvar *sav;
5809 uint32_t reqid, spi;
5810 uint8_t mode, proto;
5811 int error;
5812
5813 IPSEC_ASSERT(so != NULL, ("null socket"));
5814 IPSEC_ASSERT(m != NULL, ("null mbuf"));
5815 IPSEC_ASSERT(mhp != NULL, ("null msghdr"));
5816 IPSEC_ASSERT(mhp->msg != NULL, ("null msg"));
5817
5818 /* map satype to proto */
5819 if ((proto = key_satype2proto(mhp->msg->sadb_msg_satype)) == 0) {
5820 ipseclog((LOG_DEBUG, "%s: invalid satype is passed.\n",
5821 __func__));
5822 return key_senderror(so, m, EINVAL);
5823 }
5824
5825 if (SADB_CHECKHDR(mhp, SADB_EXT_SA) ||
5826 SADB_CHECKHDR(mhp, SADB_EXT_ADDRESS_SRC) ||
5827 SADB_CHECKHDR(mhp, SADB_EXT_ADDRESS_DST) ||
5828 (mhp->msg->sadb_msg_satype == SADB_SATYPE_ESP && (
5829 SADB_CHECKHDR(mhp, SADB_EXT_KEY_ENCRYPT) ||
5830 SADB_CHECKLEN(mhp, SADB_EXT_KEY_ENCRYPT))) ||
5831 (mhp->msg->sadb_msg_satype == SADB_SATYPE_AH && (
5832 SADB_CHECKHDR(mhp, SADB_EXT_KEY_AUTH) ||
5833 SADB_CHECKLEN(mhp, SADB_EXT_KEY_AUTH))) ||
5834 (SADB_CHECKHDR(mhp, SADB_EXT_LIFETIME_HARD) &&
5835 !SADB_CHECKHDR(mhp, SADB_EXT_LIFETIME_SOFT)) ||
5836 (SADB_CHECKHDR(mhp, SADB_EXT_LIFETIME_SOFT) &&
5837 !SADB_CHECKHDR(mhp, SADB_EXT_LIFETIME_HARD))) {
5838 ipseclog((LOG_DEBUG,
5839 "%s: invalid message: missing required header.\n",
5840 __func__));
5841 return key_senderror(so, m, EINVAL);
5842 }
5843 if (SADB_CHECKLEN(mhp, SADB_EXT_SA) ||
5844 SADB_CHECKLEN(mhp, SADB_EXT_ADDRESS_SRC) ||
5845 SADB_CHECKLEN(mhp, SADB_EXT_ADDRESS_DST)) {
5846 ipseclog((LOG_DEBUG,
5847 "%s: invalid message: wrong header size.\n", __func__));
5848 return key_senderror(so, m, EINVAL);
5849 }
5850 if (SADB_CHECKHDR(mhp, SADB_X_EXT_SA2)) {
5851 mode = IPSEC_MODE_ANY;
5852 reqid = 0;
5853 } else {
5854 if (SADB_CHECKLEN(mhp, SADB_X_EXT_SA2)) {
5855 ipseclog((LOG_DEBUG,
5856 "%s: invalid message: wrong header size.\n",
5857 __func__));
5858 return key_senderror(so, m, EINVAL);
5859 }
5860 mode = ((struct sadb_x_sa2 *)
5861 mhp->ext[SADB_X_EXT_SA2])->sadb_x_sa2_mode;
5862 reqid = ((struct sadb_x_sa2 *)
5863 mhp->ext[SADB_X_EXT_SA2])->sadb_x_sa2_reqid;
5864 }
5865
5866 sa0 = (struct sadb_sa *)mhp->ext[SADB_EXT_SA];
5867 src0 = (struct sadb_address *)mhp->ext[SADB_EXT_ADDRESS_SRC];
5868 dst0 = (struct sadb_address *)mhp->ext[SADB_EXT_ADDRESS_DST];
5869
5870 /*
5871 * Only SADB_SASTATE_MATURE SAs may be submitted in an
5872 * SADB_ADD message.
5873 */
5874 if (sa0->sadb_sa_state != SADB_SASTATE_MATURE) {
5875 ipseclog((LOG_DEBUG, "%s: invalid state.\n", __func__));
5876 #ifdef PFKEY_STRICT_CHECKS
5877 return key_senderror(so, m, EINVAL);
5878 #endif
5879 }
5880 error = key_checksockaddrs((struct sockaddr *)(src0 + 1),
5881 (struct sockaddr *)(dst0 + 1));
5882 if (error != 0) {
5883 ipseclog((LOG_DEBUG, "%s: invalid sockaddr.\n", __func__));
5884 return key_senderror(so, m, error);
5885 }
5886 key_setsecasidx(proto, mode, reqid, src0 + 1, dst0 + 1, &saidx);
5887 spi = sa0->sadb_sa_spi;
5888 /*
5889 * For TCP-MD5 SAs we don't use SPI. Check the uniqueness using
5890 * secasindex.
5891 * XXXAE: IPComp seems also doesn't use SPI.
5892 */
5893 SPI_ALLOC_LOCK();
5894 if (proto == IPPROTO_TCP) {
5895 sav = key_getsav_tcpmd5(&saidx, &spi);
5896 if (sav == NULL && spi == 0) {
5897 SPI_ALLOC_UNLOCK();
5898 /* Failed to allocate SPI */
5899 ipseclog((LOG_DEBUG, "%s: SA already exists.\n",
5900 __func__));
5901 return key_senderror(so, m, EEXIST);
5902 }
5903 /* XXX: SPI that we report back can have another value */
5904 } else {
5905 /* We can create new SA only if SPI is different. */
5906 sav = key_getsavbyspi(spi);
5907 }
5908 if (sav != NULL) {
5909 SPI_ALLOC_UNLOCK();
5910 key_freesav(&sav);
5911 ipseclog((LOG_DEBUG, "%s: SA already exists.\n", __func__));
5912 return key_senderror(so, m, EEXIST);
5913 }
5914
5915 sav = key_newsav(mhp, &saidx, spi, &error);
5916 SPI_ALLOC_UNLOCK();
5917 if (sav == NULL)
5918 return key_senderror(so, m, error);
5919 KEYDBG(KEY_STAMP,
5920 printf("%s: return SA(%p)\n", __func__, sav));
5921 KEYDBG(KEY_DATA, kdebug_secasv(sav));
5922 ipsec_accel_sa_newkey(sav);
5923 /*
5924 * If SADB_ADD was in response to SADB_ACQUIRE, we need to schedule
5925 * ACQ for deletion.
5926 */
5927 if (sav->seq != 0)
5928 key_acqdone(&saidx, sav->seq);
5929
5930 {
5931 /*
5932 * Don't call key_freesav() on error here, as we would like to
5933 * keep the SA in the database.
5934 */
5935 struct mbuf *n;
5936
5937 /* set msg buf from mhp */
5938 n = key_getmsgbuf_x1(m, mhp);
5939 if (n == NULL) {
5940 ipseclog((LOG_DEBUG, "%s: No more memory.\n", __func__));
5941 return key_senderror(so, m, ENOBUFS);
5942 }
5943
5944 m_freem(m);
5945 return key_sendup_mbuf(so, n, KEY_SENDUP_ALL);
5946 }
5947 }
5948
5949 /*
5950 * NAT-T support.
5951 * IKEd may request the use ESP in UDP encapsulation when it detects the
5952 * presence of NAT. It uses NAT-T extension headers for such SAs to specify
5953 * parameters needed for encapsulation and decapsulation. These PF_KEY
5954 * extension headers are not standardized, so this comment addresses our
5955 * implementation.
5956 * SADB_X_EXT_NAT_T_TYPE specifies type of encapsulation, we support only
5957 * UDP_ENCAP_ESPINUDP as described in RFC3948.
5958 * SADB_X_EXT_NAT_T_SPORT/DPORT specifies source and destination ports for
5959 * UDP header. We use these ports in UDP encapsulation procedure, also we
5960 * can check them in UDP decapsulation procedure.
5961 * SADB_X_EXT_NAT_T_OA[IR] specifies original address of initiator or
5962 * responder. These addresses can be used for transport mode to adjust
5963 * checksum after decapsulation and decryption. Since original IP addresses
5964 * used by peer usually different (we detected presence of NAT), TCP/UDP
5965 * pseudo header checksum and IP header checksum was calculated using original
5966 * addresses. After decapsulation and decryption we need to adjust checksum
5967 * to have correct datagram.
5968 *
5969 * We expect presence of NAT-T extension headers only in SADB_ADD and
5970 * SADB_UPDATE messages. We report NAT-T extension headers in replies
5971 * to SADB_ADD, SADB_UPDATE, SADB_GET, and SADB_DUMP messages.
5972 */
5973 static int
key_setnatt(struct secasvar * sav,const struct sadb_msghdr * mhp)5974 key_setnatt(struct secasvar *sav, const struct sadb_msghdr *mhp)
5975 {
5976 struct sadb_x_nat_t_port *port;
5977 struct sadb_x_nat_t_type *type;
5978 struct sadb_address *oai, *oar;
5979 struct sockaddr *sa;
5980 uint32_t addr;
5981 uint16_t cksum;
5982 int i;
5983
5984 IPSEC_ASSERT(sav->natt == NULL, ("natt is already initialized"));
5985 /*
5986 * Ignore NAT-T headers if sproto isn't ESP.
5987 */
5988 if (sav->sah->saidx.proto != IPPROTO_ESP)
5989 return (0);
5990
5991 if (!SADB_CHECKHDR(mhp, SADB_X_EXT_NAT_T_TYPE) &&
5992 !SADB_CHECKHDR(mhp, SADB_X_EXT_NAT_T_SPORT) &&
5993 !SADB_CHECKHDR(mhp, SADB_X_EXT_NAT_T_DPORT)) {
5994 if (SADB_CHECKLEN(mhp, SADB_X_EXT_NAT_T_TYPE) ||
5995 SADB_CHECKLEN(mhp, SADB_X_EXT_NAT_T_SPORT) ||
5996 SADB_CHECKLEN(mhp, SADB_X_EXT_NAT_T_DPORT)) {
5997 ipseclog((LOG_DEBUG,
5998 "%s: invalid message: wrong header size.\n",
5999 __func__));
6000 return (EINVAL);
6001 }
6002 } else
6003 return (0);
6004
6005 type = (struct sadb_x_nat_t_type *)mhp->ext[SADB_X_EXT_NAT_T_TYPE];
6006 if (type->sadb_x_nat_t_type_type != UDP_ENCAP_ESPINUDP) {
6007 ipseclog((LOG_DEBUG, "%s: unsupported NAT-T type %u.\n",
6008 __func__, type->sadb_x_nat_t_type_type));
6009 return (EINVAL);
6010 }
6011 /*
6012 * Allocate storage for NAT-T config.
6013 * On error it will be released by key_cleansav().
6014 */
6015 sav->natt = malloc(sizeof(struct secnatt), M_IPSEC_MISC,
6016 M_NOWAIT | M_ZERO);
6017 if (sav->natt == NULL) {
6018 PFKEYSTAT_INC(in_nomem);
6019 ipseclog((LOG_DEBUG, "%s: No more memory.\n", __func__));
6020 return (ENOBUFS);
6021 }
6022 port = (struct sadb_x_nat_t_port *)mhp->ext[SADB_X_EXT_NAT_T_SPORT];
6023 if (port->sadb_x_nat_t_port_port == 0) {
6024 ipseclog((LOG_DEBUG, "%s: invalid NAT-T sport specified.\n",
6025 __func__));
6026 return (EINVAL);
6027 }
6028 sav->natt->sport = port->sadb_x_nat_t_port_port;
6029 port = (struct sadb_x_nat_t_port *)mhp->ext[SADB_X_EXT_NAT_T_DPORT];
6030 if (port->sadb_x_nat_t_port_port == 0) {
6031 ipseclog((LOG_DEBUG, "%s: invalid NAT-T dport specified.\n",
6032 __func__));
6033 return (EINVAL);
6034 }
6035 sav->natt->dport = port->sadb_x_nat_t_port_port;
6036
6037 /*
6038 * SADB_X_EXT_NAT_T_OAI and SADB_X_EXT_NAT_T_OAR are optional
6039 * and needed only for transport mode IPsec.
6040 * Usually NAT translates only one address, but it is possible,
6041 * that both addresses could be translated.
6042 * NOTE: Value of SADB_X_EXT_NAT_T_OAI is equal to SADB_X_EXT_NAT_T_OA.
6043 */
6044 if (!SADB_CHECKHDR(mhp, SADB_X_EXT_NAT_T_OAI)) {
6045 if (SADB_CHECKLEN(mhp, SADB_X_EXT_NAT_T_OAI)) {
6046 ipseclog((LOG_DEBUG,
6047 "%s: invalid message: wrong header size.\n",
6048 __func__));
6049 return (EINVAL);
6050 }
6051 oai = (struct sadb_address *)mhp->ext[SADB_X_EXT_NAT_T_OAI];
6052 } else
6053 oai = NULL;
6054 if (!SADB_CHECKHDR(mhp, SADB_X_EXT_NAT_T_OAR)) {
6055 if (SADB_CHECKLEN(mhp, SADB_X_EXT_NAT_T_OAR)) {
6056 ipseclog((LOG_DEBUG,
6057 "%s: invalid message: wrong header size.\n",
6058 __func__));
6059 return (EINVAL);
6060 }
6061 oar = (struct sadb_address *)mhp->ext[SADB_X_EXT_NAT_T_OAR];
6062 } else
6063 oar = NULL;
6064
6065 /* Initialize addresses only for transport mode */
6066 if (sav->sah->saidx.mode != IPSEC_MODE_TUNNEL) {
6067 cksum = 0;
6068 if (oai != NULL) {
6069 sa = (struct sockaddr *)(oai + 1);
6070 switch (sa->sa_family) {
6071 #ifdef AF_INET
6072 case AF_INET:
6073 if (sa->sa_len != sizeof(struct sockaddr_in)) {
6074 ipseclog((LOG_DEBUG,
6075 "%s: wrong NAT-OAi header.\n",
6076 __func__));
6077 return (EINVAL);
6078 }
6079 /* Ignore address if it the same */
6080 if (((struct sockaddr_in *)sa)->sin_addr.s_addr !=
6081 sav->sah->saidx.src.sin.sin_addr.s_addr) {
6082 bcopy(sa, &sav->natt->oai.sa, sa->sa_len);
6083 sav->natt->flags |= IPSEC_NATT_F_OAI;
6084 /* Calculate checksum delta */
6085 addr = sav->sah->saidx.src.sin.sin_addr.s_addr;
6086 cksum = in_addword(cksum, ~addr >> 16);
6087 cksum = in_addword(cksum, ~addr & 0xffff);
6088 addr = sav->natt->oai.sin.sin_addr.s_addr;
6089 cksum = in_addword(cksum, addr >> 16);
6090 cksum = in_addword(cksum, addr & 0xffff);
6091 }
6092 break;
6093 #endif
6094 #ifdef AF_INET6
6095 case AF_INET6:
6096 if (sa->sa_len != sizeof(struct sockaddr_in6)) {
6097 ipseclog((LOG_DEBUG,
6098 "%s: wrong NAT-OAi header.\n",
6099 __func__));
6100 return (EINVAL);
6101 }
6102 /* Ignore address if it the same */
6103 if (memcmp(&((struct sockaddr_in6 *)sa)->sin6_addr.s6_addr,
6104 &sav->sah->saidx.src.sin6.sin6_addr.s6_addr,
6105 sizeof(struct in6_addr)) != 0) {
6106 bcopy(sa, &sav->natt->oai.sa, sa->sa_len);
6107 sav->natt->flags |= IPSEC_NATT_F_OAI;
6108 /* Calculate checksum delta */
6109 for (i = 0; i < 8; i++) {
6110 cksum = in_addword(cksum,
6111 ~sav->sah->saidx.src.sin6.sin6_addr.s6_addr16[i]);
6112 cksum = in_addword(cksum,
6113 sav->natt->oai.sin6.sin6_addr.s6_addr16[i]);
6114 }
6115 }
6116 break;
6117 #endif
6118 default:
6119 ipseclog((LOG_DEBUG,
6120 "%s: wrong NAT-OAi header.\n",
6121 __func__));
6122 return (EINVAL);
6123 }
6124 }
6125 if (oar != NULL) {
6126 sa = (struct sockaddr *)(oar + 1);
6127 switch (sa->sa_family) {
6128 #ifdef AF_INET
6129 case AF_INET:
6130 if (sa->sa_len != sizeof(struct sockaddr_in)) {
6131 ipseclog((LOG_DEBUG,
6132 "%s: wrong NAT-OAr header.\n",
6133 __func__));
6134 return (EINVAL);
6135 }
6136 /* Ignore address if it the same */
6137 if (((struct sockaddr_in *)sa)->sin_addr.s_addr !=
6138 sav->sah->saidx.dst.sin.sin_addr.s_addr) {
6139 bcopy(sa, &sav->natt->oar.sa, sa->sa_len);
6140 sav->natt->flags |= IPSEC_NATT_F_OAR;
6141 /* Calculate checksum delta */
6142 addr = sav->sah->saidx.dst.sin.sin_addr.s_addr;
6143 cksum = in_addword(cksum, ~addr >> 16);
6144 cksum = in_addword(cksum, ~addr & 0xffff);
6145 addr = sav->natt->oar.sin.sin_addr.s_addr;
6146 cksum = in_addword(cksum, addr >> 16);
6147 cksum = in_addword(cksum, addr & 0xffff);
6148 }
6149 break;
6150 #endif
6151 #ifdef AF_INET6
6152 case AF_INET6:
6153 if (sa->sa_len != sizeof(struct sockaddr_in6)) {
6154 ipseclog((LOG_DEBUG,
6155 "%s: wrong NAT-OAr header.\n",
6156 __func__));
6157 return (EINVAL);
6158 }
6159 /* Ignore address if it the same */
6160 if (memcmp(&((struct sockaddr_in6 *)sa)->sin6_addr.s6_addr,
6161 &sav->sah->saidx.dst.sin6.sin6_addr.s6_addr, 16) != 0) {
6162 bcopy(sa, &sav->natt->oar.sa, sa->sa_len);
6163 sav->natt->flags |= IPSEC_NATT_F_OAR;
6164 /* Calculate checksum delta */
6165 for (i = 0; i < 8; i++) {
6166 cksum = in_addword(cksum,
6167 ~sav->sah->saidx.dst.sin6.sin6_addr.s6_addr16[i]);
6168 cksum = in_addword(cksum,
6169 sav->natt->oar.sin6.sin6_addr.s6_addr16[i]);
6170 }
6171 }
6172 break;
6173 #endif
6174 default:
6175 ipseclog((LOG_DEBUG,
6176 "%s: wrong NAT-OAr header.\n",
6177 __func__));
6178 return (EINVAL);
6179 }
6180 }
6181 sav->natt->cksum = cksum;
6182 }
6183 return (0);
6184 }
6185
6186 static int
key_setident(struct secashead * sah,const struct sadb_msghdr * mhp)6187 key_setident(struct secashead *sah, const struct sadb_msghdr *mhp)
6188 {
6189 const struct sadb_ident *idsrc, *iddst;
6190
6191 IPSEC_ASSERT(sah != NULL, ("null secashead"));
6192 IPSEC_ASSERT(mhp != NULL, ("null msghdr"));
6193 IPSEC_ASSERT(mhp->msg != NULL, ("null msg"));
6194
6195 /* don't make buffer if not there */
6196 if (SADB_CHECKHDR(mhp, SADB_EXT_IDENTITY_SRC) &&
6197 SADB_CHECKHDR(mhp, SADB_EXT_IDENTITY_DST)) {
6198 sah->idents = NULL;
6199 sah->identd = NULL;
6200 return (0);
6201 }
6202
6203 if (SADB_CHECKHDR(mhp, SADB_EXT_IDENTITY_SRC) ||
6204 SADB_CHECKHDR(mhp, SADB_EXT_IDENTITY_DST)) {
6205 ipseclog((LOG_DEBUG, "%s: invalid identity.\n", __func__));
6206 return (EINVAL);
6207 }
6208
6209 idsrc = (const struct sadb_ident *)mhp->ext[SADB_EXT_IDENTITY_SRC];
6210 iddst = (const struct sadb_ident *)mhp->ext[SADB_EXT_IDENTITY_DST];
6211
6212 /* validity check */
6213 if (idsrc->sadb_ident_type != iddst->sadb_ident_type) {
6214 ipseclog((LOG_DEBUG, "%s: ident type mismatch.\n", __func__));
6215 return EINVAL;
6216 }
6217
6218 switch (idsrc->sadb_ident_type) {
6219 case SADB_IDENTTYPE_PREFIX:
6220 case SADB_IDENTTYPE_FQDN:
6221 case SADB_IDENTTYPE_USERFQDN:
6222 default:
6223 /* XXX do nothing */
6224 sah->idents = NULL;
6225 sah->identd = NULL;
6226 return 0;
6227 }
6228
6229 /* make structure */
6230 sah->idents = malloc(sizeof(struct secident), M_IPSEC_MISC, M_NOWAIT);
6231 if (sah->idents == NULL) {
6232 ipseclog((LOG_DEBUG, "%s: No more memory.\n", __func__));
6233 return ENOBUFS;
6234 }
6235 sah->identd = malloc(sizeof(struct secident), M_IPSEC_MISC, M_NOWAIT);
6236 if (sah->identd == NULL) {
6237 free(sah->idents, M_IPSEC_MISC);
6238 sah->idents = NULL;
6239 ipseclog((LOG_DEBUG, "%s: No more memory.\n", __func__));
6240 return ENOBUFS;
6241 }
6242 sah->idents->type = idsrc->sadb_ident_type;
6243 sah->idents->id = idsrc->sadb_ident_id;
6244
6245 sah->identd->type = iddst->sadb_ident_type;
6246 sah->identd->id = iddst->sadb_ident_id;
6247
6248 return 0;
6249 }
6250
6251 /*
6252 * m will not be freed on return.
6253 * it is caller's responsibility to free the result.
6254 *
6255 * Called from SADB_ADD and SADB_UPDATE. Reply will contain headers
6256 * from the request in defined order.
6257 */
6258 static struct mbuf *
key_getmsgbuf_x1(struct mbuf * m,const struct sadb_msghdr * mhp)6259 key_getmsgbuf_x1(struct mbuf *m, const struct sadb_msghdr *mhp)
6260 {
6261 struct mbuf *n;
6262
6263 IPSEC_ASSERT(m != NULL, ("null mbuf"));
6264 IPSEC_ASSERT(mhp != NULL, ("null msghdr"));
6265 IPSEC_ASSERT(mhp->msg != NULL, ("null msg"));
6266
6267 /* create new sadb_msg to reply. */
6268 n = key_gather_mbuf(m, mhp, 1, 16, SADB_EXT_RESERVED,
6269 SADB_EXT_SA, SADB_X_EXT_SA2,
6270 SADB_EXT_ADDRESS_SRC, SADB_EXT_ADDRESS_DST,
6271 SADB_EXT_LIFETIME_HARD, SADB_EXT_LIFETIME_SOFT,
6272 SADB_EXT_IDENTITY_SRC, SADB_EXT_IDENTITY_DST,
6273 SADB_X_EXT_NAT_T_TYPE, SADB_X_EXT_NAT_T_SPORT,
6274 SADB_X_EXT_NAT_T_DPORT, SADB_X_EXT_NAT_T_OAI,
6275 SADB_X_EXT_NAT_T_OAR, SADB_X_EXT_NEW_ADDRESS_SRC,
6276 SADB_X_EXT_NEW_ADDRESS_DST);
6277 if (!n)
6278 return NULL;
6279
6280 if (n->m_len < sizeof(struct sadb_msg)) {
6281 n = m_pullup(n, sizeof(struct sadb_msg));
6282 if (n == NULL)
6283 return NULL;
6284 }
6285 mtod(n, struct sadb_msg *)->sadb_msg_errno = 0;
6286 mtod(n, struct sadb_msg *)->sadb_msg_len =
6287 PFKEY_UNIT64(n->m_pkthdr.len);
6288
6289 return n;
6290 }
6291
6292 /*
6293 * SADB_DELETE processing
6294 * receive
6295 * <base, SA(*), address(SD)>
6296 * from the ikmpd, and set SADB_SASTATE_DEAD,
6297 * and send,
6298 * <base, SA(*), address(SD)>
6299 * to the ikmpd.
6300 *
6301 * m will always be freed.
6302 */
6303 static int
key_delete(struct socket * so,struct mbuf * m,const struct sadb_msghdr * mhp)6304 key_delete(struct socket *so, struct mbuf *m, const struct sadb_msghdr *mhp)
6305 {
6306 struct secasindex saidx;
6307 struct sadb_address *src0, *dst0;
6308 struct secasvar *sav;
6309 struct sadb_sa *sa0;
6310 uint8_t proto;
6311
6312 IPSEC_ASSERT(so != NULL, ("null socket"));
6313 IPSEC_ASSERT(m != NULL, ("null mbuf"));
6314 IPSEC_ASSERT(mhp != NULL, ("null msghdr"));
6315 IPSEC_ASSERT(mhp->msg != NULL, ("null msg"));
6316
6317 /* map satype to proto */
6318 if ((proto = key_satype2proto(mhp->msg->sadb_msg_satype)) == 0) {
6319 ipseclog((LOG_DEBUG, "%s: invalid satype is passed.\n",
6320 __func__));
6321 return key_senderror(so, m, EINVAL);
6322 }
6323
6324 if (SADB_CHECKHDR(mhp, SADB_EXT_ADDRESS_SRC) ||
6325 SADB_CHECKHDR(mhp, SADB_EXT_ADDRESS_DST) ||
6326 SADB_CHECKLEN(mhp, SADB_EXT_ADDRESS_SRC) ||
6327 SADB_CHECKLEN(mhp, SADB_EXT_ADDRESS_DST)) {
6328 ipseclog((LOG_DEBUG, "%s: invalid message is passed.\n",
6329 __func__));
6330 return key_senderror(so, m, EINVAL);
6331 }
6332
6333 src0 = (struct sadb_address *)(mhp->ext[SADB_EXT_ADDRESS_SRC]);
6334 dst0 = (struct sadb_address *)(mhp->ext[SADB_EXT_ADDRESS_DST]);
6335
6336 if (key_checksockaddrs((struct sockaddr *)(src0 + 1),
6337 (struct sockaddr *)(dst0 + 1)) != 0) {
6338 ipseclog((LOG_DEBUG, "%s: invalid sockaddr.\n", __func__));
6339 return (key_senderror(so, m, EINVAL));
6340 }
6341 key_setsecasidx(proto, IPSEC_MODE_ANY, 0, src0 + 1, dst0 + 1, &saidx);
6342 if (SADB_CHECKHDR(mhp, SADB_EXT_SA)) {
6343 /*
6344 * Caller wants us to delete all non-LARVAL SAs
6345 * that match the src/dst. This is used during
6346 * IKE INITIAL-CONTACT.
6347 * XXXAE: this looks like some extension to RFC2367.
6348 */
6349 ipseclog((LOG_DEBUG, "%s: doing delete all.\n", __func__));
6350 return (key_delete_all(so, m, mhp, &saidx));
6351 }
6352 if (SADB_CHECKLEN(mhp, SADB_EXT_SA)) {
6353 ipseclog((LOG_DEBUG,
6354 "%s: invalid message: wrong header size.\n", __func__));
6355 return (key_senderror(so, m, EINVAL));
6356 }
6357 sa0 = (struct sadb_sa *)mhp->ext[SADB_EXT_SA];
6358 SPI_ALLOC_LOCK();
6359 if (proto == IPPROTO_TCP)
6360 sav = key_getsav_tcpmd5(&saidx, NULL);
6361 else
6362 sav = key_getsavbyspi(sa0->sadb_sa_spi);
6363 SPI_ALLOC_UNLOCK();
6364 if (sav == NULL) {
6365 ipseclog((LOG_DEBUG, "%s: no SA found for SPI %u.\n",
6366 __func__, ntohl(sa0->sadb_sa_spi)));
6367 return (key_senderror(so, m, ESRCH));
6368 }
6369 if (key_cmpsaidx(&sav->sah->saidx, &saidx, CMP_HEAD) == 0) {
6370 ipseclog((LOG_DEBUG, "%s: saidx mismatched for SPI %u.\n",
6371 __func__, ntohl(sav->spi)));
6372 key_freesav(&sav);
6373 return (key_senderror(so, m, ESRCH));
6374 }
6375 KEYDBG(KEY_STAMP,
6376 printf("%s: SA(%p)\n", __func__, sav));
6377 KEYDBG(KEY_DATA, kdebug_secasv(sav));
6378 key_unlinksav(sav);
6379 key_freesav(&sav);
6380
6381 {
6382 struct mbuf *n;
6383 struct sadb_msg *newmsg;
6384
6385 /* create new sadb_msg to reply. */
6386 n = key_gather_mbuf(m, mhp, 1, 4, SADB_EXT_RESERVED,
6387 SADB_EXT_SA, SADB_EXT_ADDRESS_SRC, SADB_EXT_ADDRESS_DST);
6388 if (!n)
6389 return key_senderror(so, m, ENOBUFS);
6390
6391 if (n->m_len < sizeof(struct sadb_msg)) {
6392 n = m_pullup(n, sizeof(struct sadb_msg));
6393 if (n == NULL)
6394 return key_senderror(so, m, ENOBUFS);
6395 }
6396 newmsg = mtod(n, struct sadb_msg *);
6397 newmsg->sadb_msg_errno = 0;
6398 newmsg->sadb_msg_len = PFKEY_UNIT64(n->m_pkthdr.len);
6399
6400 m_freem(m);
6401 return key_sendup_mbuf(so, n, KEY_SENDUP_ALL);
6402 }
6403 }
6404
6405 /*
6406 * delete all SAs for src/dst. Called from key_delete().
6407 */
6408 static int
key_delete_all(struct socket * so,struct mbuf * m,const struct sadb_msghdr * mhp,struct secasindex * saidx)6409 key_delete_all(struct socket *so, struct mbuf *m,
6410 const struct sadb_msghdr *mhp, struct secasindex *saidx)
6411 {
6412 struct secasvar_queue drainq;
6413 struct secashead *sah;
6414 struct secasvar *sav, *nextsav;
6415
6416 TAILQ_INIT(&drainq);
6417 SAHTREE_WLOCK();
6418 LIST_FOREACH(sah, SAHADDRHASH_HASH(saidx), addrhash) {
6419 if (key_cmpsaidx(&sah->saidx, saidx, CMP_HEAD) == 0)
6420 continue;
6421 /* Move all ALIVE SAs into drainq */
6422 TAILQ_CONCAT(&drainq, &sah->savtree_alive, chain);
6423 }
6424 /* Unlink all queued SAs from SPI hash */
6425 TAILQ_FOREACH(sav, &drainq, chain) {
6426 sav->state = SADB_SASTATE_DEAD;
6427 ipsec_accel_forget_sav(sav);
6428 LIST_REMOVE(sav, spihash);
6429 }
6430 SAHTREE_WUNLOCK();
6431 /* Now we can release reference for all SAs in drainq */
6432 sav = TAILQ_FIRST(&drainq);
6433 while (sav != NULL) {
6434 KEYDBG(KEY_STAMP,
6435 printf("%s: SA(%p)\n", __func__, sav));
6436 KEYDBG(KEY_DATA, kdebug_secasv(sav));
6437 nextsav = TAILQ_NEXT(sav, chain);
6438 key_freesah(&sav->sah); /* release reference from SAV */
6439 key_freesav(&sav); /* release last reference */
6440 sav = nextsav;
6441 }
6442
6443 {
6444 struct mbuf *n;
6445 struct sadb_msg *newmsg;
6446
6447 /* create new sadb_msg to reply. */
6448 n = key_gather_mbuf(m, mhp, 1, 3, SADB_EXT_RESERVED,
6449 SADB_EXT_ADDRESS_SRC, SADB_EXT_ADDRESS_DST);
6450 if (!n)
6451 return key_senderror(so, m, ENOBUFS);
6452
6453 if (n->m_len < sizeof(struct sadb_msg)) {
6454 n = m_pullup(n, sizeof(struct sadb_msg));
6455 if (n == NULL)
6456 return key_senderror(so, m, ENOBUFS);
6457 }
6458 newmsg = mtod(n, struct sadb_msg *);
6459 newmsg->sadb_msg_errno = 0;
6460 newmsg->sadb_msg_len = PFKEY_UNIT64(n->m_pkthdr.len);
6461
6462 m_freem(m);
6463 return key_sendup_mbuf(so, n, KEY_SENDUP_ALL);
6464 }
6465 }
6466
6467 /*
6468 * Delete all alive SAs for corresponding xform.
6469 * Larval SAs have not initialized tdb_xform, so it is safe to leave them
6470 * here when xform disappears.
6471 */
6472 void
key_delete_xform(const struct xformsw * xsp)6473 key_delete_xform(const struct xformsw *xsp)
6474 {
6475 struct secasvar_queue drainq;
6476 struct secashead *sah;
6477 struct secasvar *sav, *nextsav;
6478
6479 TAILQ_INIT(&drainq);
6480 SAHTREE_WLOCK();
6481 TAILQ_FOREACH(sah, &V_sahtree, chain) {
6482 sav = TAILQ_FIRST(&sah->savtree_alive);
6483 if (sav == NULL)
6484 continue;
6485 if (sav->tdb_xform != xsp)
6486 continue;
6487 /*
6488 * It is supposed that all SAs in the chain are related to
6489 * one xform.
6490 */
6491 TAILQ_CONCAT(&drainq, &sah->savtree_alive, chain);
6492 }
6493 /* Unlink all queued SAs from SPI hash */
6494 TAILQ_FOREACH(sav, &drainq, chain) {
6495 sav->state = SADB_SASTATE_DEAD;
6496 ipsec_accel_forget_sav(sav);
6497 LIST_REMOVE(sav, spihash);
6498 }
6499 SAHTREE_WUNLOCK();
6500
6501 /* Now we can release reference for all SAs in drainq */
6502 sav = TAILQ_FIRST(&drainq);
6503 while (sav != NULL) {
6504 KEYDBG(KEY_STAMP,
6505 printf("%s: SA(%p)\n", __func__, sav));
6506 KEYDBG(KEY_DATA, kdebug_secasv(sav));
6507 nextsav = TAILQ_NEXT(sav, chain);
6508 key_freesah(&sav->sah); /* release reference from SAV */
6509 key_freesav(&sav); /* release last reference */
6510 sav = nextsav;
6511 }
6512 }
6513
6514 /*
6515 * SADB_GET processing
6516 * receive
6517 * <base, SA(*), address(SD)>
6518 * from the ikmpd, and get a SP and a SA to respond,
6519 * and send,
6520 * <base, SA, (lifetime(HSC),) address(SD), (address(P),) key(AE),
6521 * (identity(SD),) (sensitivity)>
6522 * to the ikmpd.
6523 *
6524 * m will always be freed.
6525 */
6526 static int
key_get(struct socket * so,struct mbuf * m,const struct sadb_msghdr * mhp)6527 key_get(struct socket *so, struct mbuf *m, const struct sadb_msghdr *mhp)
6528 {
6529 struct secasindex saidx;
6530 struct sadb_address *src0, *dst0;
6531 struct sadb_sa *sa0;
6532 struct secasvar *sav;
6533 uint8_t proto;
6534
6535 IPSEC_ASSERT(so != NULL, ("null socket"));
6536 IPSEC_ASSERT(m != NULL, ("null mbuf"));
6537 IPSEC_ASSERT(mhp != NULL, ("null msghdr"));
6538 IPSEC_ASSERT(mhp->msg != NULL, ("null msg"));
6539
6540 /* map satype to proto */
6541 if ((proto = key_satype2proto(mhp->msg->sadb_msg_satype)) == 0) {
6542 ipseclog((LOG_DEBUG, "%s: invalid satype is passed.\n",
6543 __func__));
6544 return key_senderror(so, m, EINVAL);
6545 }
6546
6547 if (SADB_CHECKHDR(mhp, SADB_EXT_SA) ||
6548 SADB_CHECKHDR(mhp, SADB_EXT_ADDRESS_SRC) ||
6549 SADB_CHECKHDR(mhp, SADB_EXT_ADDRESS_DST)) {
6550 ipseclog((LOG_DEBUG,
6551 "%s: invalid message: missing required header.\n",
6552 __func__));
6553 return key_senderror(so, m, EINVAL);
6554 }
6555 if (SADB_CHECKLEN(mhp, SADB_EXT_SA) ||
6556 SADB_CHECKLEN(mhp, SADB_EXT_ADDRESS_SRC) ||
6557 SADB_CHECKLEN(mhp, SADB_EXT_ADDRESS_DST)) {
6558 ipseclog((LOG_DEBUG,
6559 "%s: invalid message: wrong header size.\n", __func__));
6560 return key_senderror(so, m, EINVAL);
6561 }
6562
6563 sa0 = (struct sadb_sa *)mhp->ext[SADB_EXT_SA];
6564 src0 = (struct sadb_address *)mhp->ext[SADB_EXT_ADDRESS_SRC];
6565 dst0 = (struct sadb_address *)mhp->ext[SADB_EXT_ADDRESS_DST];
6566
6567 if (key_checksockaddrs((struct sockaddr *)(src0 + 1),
6568 (struct sockaddr *)(dst0 + 1)) != 0) {
6569 ipseclog((LOG_DEBUG, "%s: invalid sockaddr.\n", __func__));
6570 return key_senderror(so, m, EINVAL);
6571 }
6572 key_setsecasidx(proto, IPSEC_MODE_ANY, 0, src0 + 1, dst0 + 1, &saidx);
6573
6574 SPI_ALLOC_LOCK();
6575 if (proto == IPPROTO_TCP)
6576 sav = key_getsav_tcpmd5(&saidx, NULL);
6577 else
6578 sav = key_getsavbyspi(sa0->sadb_sa_spi);
6579 SPI_ALLOC_UNLOCK();
6580 if (sav == NULL) {
6581 ipseclog((LOG_DEBUG, "%s: no SA found.\n", __func__));
6582 return key_senderror(so, m, ESRCH);
6583 }
6584 if (key_cmpsaidx(&sav->sah->saidx, &saidx, CMP_HEAD) == 0) {
6585 ipseclog((LOG_DEBUG, "%s: saidx mismatched for SPI %u.\n",
6586 __func__, ntohl(sa0->sadb_sa_spi)));
6587 key_freesav(&sav);
6588 return (key_senderror(so, m, ESRCH));
6589 }
6590
6591 {
6592 struct mbuf *n;
6593 uint8_t satype;
6594
6595 /* map proto to satype */
6596 if ((satype = key_proto2satype(sav->sah->saidx.proto)) == 0) {
6597 ipseclog((LOG_DEBUG, "%s: there was invalid proto in SAD.\n",
6598 __func__));
6599 key_freesav(&sav);
6600 return key_senderror(so, m, EINVAL);
6601 }
6602
6603 /* create new sadb_msg to reply. */
6604 n = key_setdumpsa(sav, SADB_GET, satype, mhp->msg->sadb_msg_seq,
6605 mhp->msg->sadb_msg_pid, NULL);
6606
6607 key_freesav(&sav);
6608 if (!n)
6609 return key_senderror(so, m, ENOBUFS);
6610
6611 m_freem(m);
6612 return key_sendup_mbuf(so, n, KEY_SENDUP_ONE);
6613 }
6614 }
6615
6616 /* XXX make it sysctl-configurable? */
6617 static void
key_getcomb_setlifetime(struct sadb_comb * comb)6618 key_getcomb_setlifetime(struct sadb_comb *comb)
6619 {
6620
6621 comb->sadb_comb_soft_allocations = 1;
6622 comb->sadb_comb_hard_allocations = 1;
6623 comb->sadb_comb_soft_bytes = 0;
6624 comb->sadb_comb_hard_bytes = 0;
6625 comb->sadb_comb_hard_addtime = 86400; /* 1 day */
6626 comb->sadb_comb_soft_addtime = comb->sadb_comb_soft_addtime * 80 / 100;
6627 comb->sadb_comb_soft_usetime = 28800; /* 8 hours */
6628 comb->sadb_comb_hard_usetime = comb->sadb_comb_hard_usetime * 80 / 100;
6629 }
6630
6631 /*
6632 * XXX reorder combinations by preference
6633 * XXX no idea if the user wants ESP authentication or not
6634 */
6635 static struct mbuf *
key_getcomb_ealg(void)6636 key_getcomb_ealg(void)
6637 {
6638 struct sadb_comb *comb;
6639 const struct enc_xform *algo;
6640 struct mbuf *result = NULL, *m, *n;
6641 int encmin;
6642 int i, off, o;
6643 int totlen;
6644 const int l = PFKEY_ALIGN8(sizeof(struct sadb_comb));
6645
6646 m = NULL;
6647 for (i = 1; i <= SADB_EALG_MAX; i++) {
6648 algo = enc_algorithm_lookup(i);
6649 if (algo == NULL)
6650 continue;
6651
6652 /* discard algorithms with key size smaller than system min */
6653 if (_BITS(algo->maxkey) < V_ipsec_esp_keymin)
6654 continue;
6655 if (_BITS(algo->minkey) < V_ipsec_esp_keymin)
6656 encmin = V_ipsec_esp_keymin;
6657 else
6658 encmin = _BITS(algo->minkey);
6659
6660 if (V_ipsec_esp_auth)
6661 m = key_getcomb_ah();
6662 else {
6663 IPSEC_ASSERT(l <= MLEN,
6664 ("l=%u > MLEN=%lu", l, (u_long) MLEN));
6665 MGET(m, M_NOWAIT, MT_DATA);
6666 if (m) {
6667 M_ALIGN(m, l);
6668 m->m_len = l;
6669 m->m_next = NULL;
6670 bzero(mtod(m, caddr_t), m->m_len);
6671 }
6672 }
6673 if (!m)
6674 goto fail;
6675
6676 totlen = 0;
6677 for (n = m; n; n = n->m_next)
6678 totlen += n->m_len;
6679 IPSEC_ASSERT((totlen % l) == 0, ("totlen=%u, l=%u", totlen, l));
6680
6681 for (off = 0; off < totlen; off += l) {
6682 n = m_pulldown(m, off, l, &o);
6683 if (!n) {
6684 /* m is already freed */
6685 goto fail;
6686 }
6687 comb = (struct sadb_comb *)(mtod(n, caddr_t) + o);
6688 bzero(comb, sizeof(*comb));
6689 key_getcomb_setlifetime(comb);
6690 comb->sadb_comb_encrypt = i;
6691 comb->sadb_comb_encrypt_minbits = encmin;
6692 comb->sadb_comb_encrypt_maxbits = _BITS(algo->maxkey);
6693 }
6694
6695 if (!result)
6696 result = m;
6697 else
6698 m_cat(result, m);
6699 }
6700
6701 return result;
6702
6703 fail:
6704 if (result)
6705 m_freem(result);
6706 return NULL;
6707 }
6708
6709 static void
key_getsizes_ah(const struct auth_hash * ah,int alg,u_int16_t * min,u_int16_t * max)6710 key_getsizes_ah(const struct auth_hash *ah, int alg, u_int16_t* min,
6711 u_int16_t* max)
6712 {
6713
6714 *min = *max = ah->hashsize;
6715 if (ah->keysize == 0) {
6716 /*
6717 * Transform takes arbitrary key size but algorithm
6718 * key size is restricted. Enforce this here.
6719 */
6720 switch (alg) {
6721 case SADB_X_AALG_NULL: *min = 1; *max = 256; break;
6722 case SADB_X_AALG_SHA2_256: *min = *max = 32; break;
6723 case SADB_X_AALG_SHA2_384: *min = *max = 48; break;
6724 case SADB_X_AALG_SHA2_512: *min = *max = 64; break;
6725 default:
6726 DPRINTF(("%s: unknown AH algorithm %u\n",
6727 __func__, alg));
6728 break;
6729 }
6730 }
6731 }
6732
6733 /*
6734 * XXX reorder combinations by preference
6735 */
6736 static struct mbuf *
key_getcomb_ah(void)6737 key_getcomb_ah(void)
6738 {
6739 const struct auth_hash *algo;
6740 struct sadb_comb *comb;
6741 struct mbuf *m;
6742 u_int16_t minkeysize, maxkeysize;
6743 int i;
6744 const int l = PFKEY_ALIGN8(sizeof(struct sadb_comb));
6745
6746 m = NULL;
6747 for (i = 1; i <= SADB_AALG_MAX; i++) {
6748 #if 1
6749 /* we prefer HMAC algorithms, not old algorithms */
6750 if (i != SADB_AALG_SHA1HMAC &&
6751 i != SADB_X_AALG_SHA2_256 &&
6752 i != SADB_X_AALG_SHA2_384 &&
6753 i != SADB_X_AALG_SHA2_512)
6754 continue;
6755 #endif
6756 algo = auth_algorithm_lookup(i);
6757 if (!algo)
6758 continue;
6759 key_getsizes_ah(algo, i, &minkeysize, &maxkeysize);
6760 /* discard algorithms with key size smaller than system min */
6761 if (_BITS(minkeysize) < V_ipsec_ah_keymin)
6762 continue;
6763
6764 if (!m) {
6765 IPSEC_ASSERT(l <= MLEN,
6766 ("l=%u > MLEN=%lu", l, (u_long) MLEN));
6767 MGET(m, M_NOWAIT, MT_DATA);
6768 if (m) {
6769 M_ALIGN(m, l);
6770 m->m_len = l;
6771 m->m_next = NULL;
6772 }
6773 } else
6774 M_PREPEND(m, l, M_NOWAIT);
6775 if (!m)
6776 return NULL;
6777
6778 comb = mtod(m, struct sadb_comb *);
6779 bzero(comb, sizeof(*comb));
6780 key_getcomb_setlifetime(comb);
6781 comb->sadb_comb_auth = i;
6782 comb->sadb_comb_auth_minbits = _BITS(minkeysize);
6783 comb->sadb_comb_auth_maxbits = _BITS(maxkeysize);
6784 }
6785
6786 return m;
6787 }
6788
6789 /*
6790 * not really an official behavior. discussed in pf_key@inner.net in Sep2000.
6791 * XXX reorder combinations by preference
6792 */
6793 static struct mbuf *
key_getcomb_ipcomp(void)6794 key_getcomb_ipcomp(void)
6795 {
6796 const struct comp_algo *algo;
6797 struct sadb_comb *comb;
6798 struct mbuf *m;
6799 int i;
6800 const int l = PFKEY_ALIGN8(sizeof(struct sadb_comb));
6801
6802 m = NULL;
6803 for (i = 1; i <= SADB_X_CALG_MAX; i++) {
6804 algo = comp_algorithm_lookup(i);
6805 if (!algo)
6806 continue;
6807
6808 if (!m) {
6809 IPSEC_ASSERT(l <= MLEN,
6810 ("l=%u > MLEN=%lu", l, (u_long) MLEN));
6811 MGET(m, M_NOWAIT, MT_DATA);
6812 if (m) {
6813 M_ALIGN(m, l);
6814 m->m_len = l;
6815 m->m_next = NULL;
6816 }
6817 } else
6818 M_PREPEND(m, l, M_NOWAIT);
6819 if (!m)
6820 return NULL;
6821
6822 comb = mtod(m, struct sadb_comb *);
6823 bzero(comb, sizeof(*comb));
6824 key_getcomb_setlifetime(comb);
6825 comb->sadb_comb_encrypt = i;
6826 /* what should we set into sadb_comb_*_{min,max}bits? */
6827 }
6828
6829 return m;
6830 }
6831
6832 /*
6833 * XXX no way to pass mode (transport/tunnel) to userland
6834 * XXX replay checking?
6835 * XXX sysctl interface to ipsec_{ah,esp}_keymin
6836 */
6837 static struct mbuf *
key_getprop(const struct secasindex * saidx)6838 key_getprop(const struct secasindex *saidx)
6839 {
6840 struct sadb_prop *prop;
6841 struct mbuf *m, *n;
6842 const int l = PFKEY_ALIGN8(sizeof(struct sadb_prop));
6843 int totlen;
6844
6845 switch (saidx->proto) {
6846 case IPPROTO_ESP:
6847 m = key_getcomb_ealg();
6848 break;
6849 case IPPROTO_AH:
6850 m = key_getcomb_ah();
6851 break;
6852 case IPPROTO_IPCOMP:
6853 m = key_getcomb_ipcomp();
6854 break;
6855 default:
6856 return NULL;
6857 }
6858
6859 if (!m)
6860 return NULL;
6861 M_PREPEND(m, l, M_NOWAIT);
6862 if (!m)
6863 return NULL;
6864
6865 totlen = 0;
6866 for (n = m; n; n = n->m_next)
6867 totlen += n->m_len;
6868
6869 prop = mtod(m, struct sadb_prop *);
6870 bzero(prop, sizeof(*prop));
6871 prop->sadb_prop_len = PFKEY_UNIT64(totlen);
6872 prop->sadb_prop_exttype = SADB_EXT_PROPOSAL;
6873 prop->sadb_prop_replay = 32; /* XXX */
6874
6875 return m;
6876 }
6877
6878 /*
6879 * SADB_ACQUIRE processing called by key_checkrequest() and key_acquire2().
6880 * send
6881 * <base, SA, address(SD), (address(P)), x_policy,
6882 * (identity(SD),) (sensitivity,) proposal>
6883 * to KMD, and expect to receive
6884 * <base> with SADB_ACQUIRE if error occurred,
6885 * or
6886 * <base, src address, dst address, (SPI range)> with SADB_GETSPI
6887 * from KMD by PF_KEY.
6888 *
6889 * XXX x_policy is outside of RFC2367 (KAME extension).
6890 * XXX sensitivity is not supported.
6891 * XXX for ipcomp, RFC2367 does not define how to fill in proposal.
6892 * see comment for key_getcomb_ipcomp().
6893 *
6894 * OUT:
6895 * 0 : succeed
6896 * others: error number
6897 */
6898 static int
key_acquire(const struct secasindex * saidx,struct secpolicy * sp)6899 key_acquire(const struct secasindex *saidx, struct secpolicy *sp)
6900 {
6901 union sockaddr_union addr;
6902 struct mbuf *result, *m;
6903 uint32_t seq;
6904 int error;
6905 uint16_t ul_proto;
6906 uint8_t mask, satype;
6907
6908 IPSEC_ASSERT(saidx != NULL, ("null saidx"));
6909 satype = key_proto2satype(saidx->proto);
6910 IPSEC_ASSERT(satype != 0, ("null satype, protocol %u", saidx->proto));
6911
6912 error = -1;
6913 result = NULL;
6914 ul_proto = IPSEC_ULPROTO_ANY;
6915
6916 /* Get seq number to check whether sending message or not. */
6917 seq = key_getacq(saidx, &error);
6918 if (seq == 0)
6919 return (error);
6920
6921 m = key_setsadbmsg(SADB_ACQUIRE, 0, satype, seq, 0, 0);
6922 if (!m) {
6923 error = ENOBUFS;
6924 goto fail;
6925 }
6926 result = m;
6927
6928 /*
6929 * set sadb_address for saidx's.
6930 *
6931 * Note that if sp is supplied, then we're being called from
6932 * key_allocsa_policy() and should supply port and protocol
6933 * information.
6934 * XXXAE: why only TCP and UDP? ICMP and SCTP looks applicable too.
6935 * XXXAE: probably we can handle this in the ipsec[46]_allocsa().
6936 * XXXAE: it looks like we should save this info in the ACQ entry.
6937 */
6938 if (sp != NULL && (sp->spidx.ul_proto == IPPROTO_TCP ||
6939 sp->spidx.ul_proto == IPPROTO_UDP))
6940 ul_proto = sp->spidx.ul_proto;
6941
6942 addr = saidx->src;
6943 mask = FULLMASK;
6944 if (ul_proto != IPSEC_ULPROTO_ANY) {
6945 switch (sp->spidx.src.sa.sa_family) {
6946 case AF_INET:
6947 if (sp->spidx.src.sin.sin_port != IPSEC_PORT_ANY) {
6948 addr.sin.sin_port = sp->spidx.src.sin.sin_port;
6949 mask = sp->spidx.prefs;
6950 }
6951 break;
6952 case AF_INET6:
6953 if (sp->spidx.src.sin6.sin6_port != IPSEC_PORT_ANY) {
6954 addr.sin6.sin6_port =
6955 sp->spidx.src.sin6.sin6_port;
6956 mask = sp->spidx.prefs;
6957 }
6958 break;
6959 default:
6960 break;
6961 }
6962 }
6963 m = key_setsadbaddr(SADB_EXT_ADDRESS_SRC, &addr.sa, mask, ul_proto);
6964 if (!m) {
6965 error = ENOBUFS;
6966 goto fail;
6967 }
6968 m_cat(result, m);
6969
6970 addr = saidx->dst;
6971 mask = FULLMASK;
6972 if (ul_proto != IPSEC_ULPROTO_ANY) {
6973 switch (sp->spidx.dst.sa.sa_family) {
6974 case AF_INET:
6975 if (sp->spidx.dst.sin.sin_port != IPSEC_PORT_ANY) {
6976 addr.sin.sin_port = sp->spidx.dst.sin.sin_port;
6977 mask = sp->spidx.prefd;
6978 }
6979 break;
6980 case AF_INET6:
6981 if (sp->spidx.dst.sin6.sin6_port != IPSEC_PORT_ANY) {
6982 addr.sin6.sin6_port =
6983 sp->spidx.dst.sin6.sin6_port;
6984 mask = sp->spidx.prefd;
6985 }
6986 break;
6987 default:
6988 break;
6989 }
6990 }
6991 m = key_setsadbaddr(SADB_EXT_ADDRESS_DST, &addr.sa, mask, ul_proto);
6992 if (!m) {
6993 error = ENOBUFS;
6994 goto fail;
6995 }
6996 m_cat(result, m);
6997
6998 /* XXX proxy address (optional) */
6999
7000 /*
7001 * Set sadb_x_policy. This is KAME extension to RFC2367.
7002 */
7003 if (sp != NULL) {
7004 m = key_setsadbxpolicy(sp->policy, sp->spidx.dir, sp->id,
7005 sp->priority);
7006 if (!m) {
7007 error = ENOBUFS;
7008 goto fail;
7009 }
7010 m_cat(result, m);
7011 }
7012
7013 /*
7014 * Set sadb_x_sa2 extension if saidx->reqid is not zero.
7015 * This is FreeBSD extension to RFC2367.
7016 */
7017 if (saidx->reqid != 0) {
7018 m = key_setsadbxsa2(saidx->mode, 0, saidx->reqid);
7019 if (m == NULL) {
7020 error = ENOBUFS;
7021 goto fail;
7022 }
7023 m_cat(result, m);
7024 }
7025 /* XXX identity (optional) */
7026 #if 0
7027 if (idexttype && fqdn) {
7028 /* create identity extension (FQDN) */
7029 struct sadb_ident *id;
7030 int fqdnlen;
7031
7032 fqdnlen = strlen(fqdn) + 1; /* +1 for terminating-NUL */
7033 id = (struct sadb_ident *)p;
7034 bzero(id, sizeof(*id) + PFKEY_ALIGN8(fqdnlen));
7035 id->sadb_ident_len = PFKEY_UNIT64(sizeof(*id) + PFKEY_ALIGN8(fqdnlen));
7036 id->sadb_ident_exttype = idexttype;
7037 id->sadb_ident_type = SADB_IDENTTYPE_FQDN;
7038 bcopy(fqdn, id + 1, fqdnlen);
7039 p += sizeof(struct sadb_ident) + PFKEY_ALIGN8(fqdnlen);
7040 }
7041
7042 if (idexttype) {
7043 /* create identity extension (USERFQDN) */
7044 struct sadb_ident *id;
7045 int userfqdnlen;
7046
7047 if (userfqdn) {
7048 /* +1 for terminating-NUL */
7049 userfqdnlen = strlen(userfqdn) + 1;
7050 } else
7051 userfqdnlen = 0;
7052 id = (struct sadb_ident *)p;
7053 bzero(id, sizeof(*id) + PFKEY_ALIGN8(userfqdnlen));
7054 id->sadb_ident_len = PFKEY_UNIT64(sizeof(*id) + PFKEY_ALIGN8(userfqdnlen));
7055 id->sadb_ident_exttype = idexttype;
7056 id->sadb_ident_type = SADB_IDENTTYPE_USERFQDN;
7057 /* XXX is it correct? */
7058 if (curproc && curproc->p_cred)
7059 id->sadb_ident_id = curproc->p_cred->p_ruid;
7060 if (userfqdn && userfqdnlen)
7061 bcopy(userfqdn, id + 1, userfqdnlen);
7062 p += sizeof(struct sadb_ident) + PFKEY_ALIGN8(userfqdnlen);
7063 }
7064 #endif
7065
7066 /* XXX sensitivity (optional) */
7067
7068 /* create proposal/combination extension */
7069 m = key_getprop(saidx);
7070 #if 0
7071 /*
7072 * spec conformant: always attach proposal/combination extension,
7073 * the problem is that we have no way to attach it for ipcomp,
7074 * due to the way sadb_comb is declared in RFC2367.
7075 */
7076 if (!m) {
7077 error = ENOBUFS;
7078 goto fail;
7079 }
7080 m_cat(result, m);
7081 #else
7082 /*
7083 * outside of spec; make proposal/combination extension optional.
7084 */
7085 if (m)
7086 m_cat(result, m);
7087 #endif
7088
7089 if ((result->m_flags & M_PKTHDR) == 0) {
7090 error = EINVAL;
7091 goto fail;
7092 }
7093
7094 if (result->m_len < sizeof(struct sadb_msg)) {
7095 result = m_pullup(result, sizeof(struct sadb_msg));
7096 if (result == NULL) {
7097 error = ENOBUFS;
7098 goto fail;
7099 }
7100 }
7101
7102 result->m_pkthdr.len = 0;
7103 for (m = result; m; m = m->m_next)
7104 result->m_pkthdr.len += m->m_len;
7105
7106 mtod(result, struct sadb_msg *)->sadb_msg_len =
7107 PFKEY_UNIT64(result->m_pkthdr.len);
7108
7109 KEYDBG(KEY_STAMP,
7110 printf("%s: SP(%p)\n", __func__, sp));
7111 KEYDBG(KEY_DATA, kdebug_secasindex(saidx, NULL));
7112
7113 return key_sendup_mbuf(NULL, result, KEY_SENDUP_REGISTERED);
7114
7115 fail:
7116 if (result)
7117 m_freem(result);
7118 return error;
7119 }
7120
7121 static uint32_t
key_newacq(const struct secasindex * saidx,int * perror)7122 key_newacq(const struct secasindex *saidx, int *perror)
7123 {
7124 struct secacq *acq;
7125 uint32_t seq;
7126
7127 acq = malloc(sizeof(*acq), M_IPSEC_SAQ, M_NOWAIT | M_ZERO);
7128 if (acq == NULL) {
7129 ipseclog((LOG_DEBUG, "%s: No more memory.\n", __func__));
7130 *perror = ENOBUFS;
7131 return (0);
7132 }
7133
7134 /* copy secindex */
7135 bcopy(saidx, &acq->saidx, sizeof(acq->saidx));
7136 acq->created = time_second;
7137 acq->count = 0;
7138
7139 /* add to acqtree */
7140 ACQ_LOCK();
7141 seq = acq->seq = (V_acq_seq == ~0 ? 1 : ++V_acq_seq);
7142 LIST_INSERT_HEAD(&V_acqtree, acq, chain);
7143 LIST_INSERT_HEAD(ACQADDRHASH_HASH(saidx), acq, addrhash);
7144 LIST_INSERT_HEAD(ACQSEQHASH_HASH(seq), acq, seqhash);
7145 ACQ_UNLOCK();
7146 *perror = 0;
7147 return (seq);
7148 }
7149
7150 static uint32_t
key_getacq(const struct secasindex * saidx,int * perror)7151 key_getacq(const struct secasindex *saidx, int *perror)
7152 {
7153 struct secacq *acq;
7154 uint32_t seq;
7155
7156 ACQ_LOCK();
7157 LIST_FOREACH(acq, ACQADDRHASH_HASH(saidx), addrhash) {
7158 if (key_cmpsaidx(&acq->saidx, saidx, CMP_EXACTLY)) {
7159 if (acq->count > V_key_blockacq_count) {
7160 /*
7161 * Reset counter and send message.
7162 * Also reset created time to keep ACQ for
7163 * this saidx.
7164 */
7165 acq->created = time_second;
7166 acq->count = 0;
7167 seq = acq->seq;
7168 } else {
7169 /*
7170 * Increment counter and do nothing.
7171 * We send SADB_ACQUIRE message only
7172 * for each V_key_blockacq_count packet.
7173 */
7174 acq->count++;
7175 seq = 0;
7176 }
7177 break;
7178 }
7179 }
7180 ACQ_UNLOCK();
7181 if (acq != NULL) {
7182 *perror = 0;
7183 return (seq);
7184 }
7185 /* allocate new entry */
7186 return (key_newacq(saidx, perror));
7187 }
7188
7189 static int
key_acqreset(uint32_t seq)7190 key_acqreset(uint32_t seq)
7191 {
7192 struct secacq *acq;
7193
7194 ACQ_LOCK();
7195 LIST_FOREACH(acq, ACQSEQHASH_HASH(seq), seqhash) {
7196 if (acq->seq == seq) {
7197 acq->count = 0;
7198 acq->created = time_second;
7199 break;
7200 }
7201 }
7202 ACQ_UNLOCK();
7203 if (acq == NULL)
7204 return (ESRCH);
7205 return (0);
7206 }
7207 /*
7208 * Mark ACQ entry as stale to remove it in key_flush_acq().
7209 * Called after successful SADB_GETSPI message.
7210 */
7211 static int
key_acqdone(const struct secasindex * saidx,uint32_t seq)7212 key_acqdone(const struct secasindex *saidx, uint32_t seq)
7213 {
7214 struct secacq *acq;
7215
7216 ACQ_LOCK();
7217 LIST_FOREACH(acq, ACQSEQHASH_HASH(seq), seqhash) {
7218 if (acq->seq == seq)
7219 break;
7220 }
7221 if (acq != NULL) {
7222 if (key_cmpsaidx(&acq->saidx, saidx, CMP_EXACTLY) == 0) {
7223 ipseclog((LOG_DEBUG,
7224 "%s: Mismatched saidx for ACQ %u\n", __func__, seq));
7225 acq = NULL;
7226 } else {
7227 acq->created = 0;
7228 }
7229 } else {
7230 ipseclog((LOG_DEBUG,
7231 "%s: ACQ %u is not found.\n", __func__, seq));
7232 }
7233 ACQ_UNLOCK();
7234 if (acq == NULL)
7235 return (ESRCH);
7236 return (0);
7237 }
7238
7239 static struct secspacq *
key_newspacq(struct secpolicyindex * spidx)7240 key_newspacq(struct secpolicyindex *spidx)
7241 {
7242 struct secspacq *acq;
7243
7244 /* get new entry */
7245 acq = malloc(sizeof(struct secspacq), M_IPSEC_SAQ, M_NOWAIT|M_ZERO);
7246 if (acq == NULL) {
7247 ipseclog((LOG_DEBUG, "%s: No more memory.\n", __func__));
7248 return NULL;
7249 }
7250
7251 /* copy secindex */
7252 bcopy(spidx, &acq->spidx, sizeof(acq->spidx));
7253 acq->created = time_second;
7254 acq->count = 0;
7255
7256 /* add to spacqtree */
7257 SPACQ_LOCK();
7258 LIST_INSERT_HEAD(&V_spacqtree, acq, chain);
7259 SPACQ_UNLOCK();
7260
7261 return acq;
7262 }
7263
7264 static struct secspacq *
key_getspacq(struct secpolicyindex * spidx)7265 key_getspacq(struct secpolicyindex *spidx)
7266 {
7267 struct secspacq *acq;
7268
7269 SPACQ_LOCK();
7270 LIST_FOREACH(acq, &V_spacqtree, chain) {
7271 if (key_cmpspidx_exactly(spidx, &acq->spidx)) {
7272 /* NB: return holding spacq_lock */
7273 return acq;
7274 }
7275 }
7276 SPACQ_UNLOCK();
7277
7278 return NULL;
7279 }
7280
7281 /*
7282 * SADB_ACQUIRE processing,
7283 * in first situation, is receiving
7284 * <base>
7285 * from the ikmpd, and clear sequence of its secasvar entry.
7286 *
7287 * In second situation, is receiving
7288 * <base, address(SD), (address(P),) (identity(SD),) (sensitivity,) proposal>
7289 * from a user land process, and return
7290 * <base, address(SD), (address(P),) (identity(SD),) (sensitivity,) proposal>
7291 * to the socket.
7292 *
7293 * m will always be freed.
7294 */
7295 static int
key_acquire2(struct socket * so,struct mbuf * m,const struct sadb_msghdr * mhp)7296 key_acquire2(struct socket *so, struct mbuf *m, const struct sadb_msghdr *mhp)
7297 {
7298 SAHTREE_RLOCK_TRACKER;
7299 struct sadb_address *src0, *dst0;
7300 struct secasindex saidx;
7301 struct secashead *sah;
7302 uint32_t reqid;
7303 int error;
7304 uint8_t mode, proto;
7305
7306 IPSEC_ASSERT(so != NULL, ("null socket"));
7307 IPSEC_ASSERT(m != NULL, ("null mbuf"));
7308 IPSEC_ASSERT(mhp != NULL, ("null msghdr"));
7309 IPSEC_ASSERT(mhp->msg != NULL, ("null msg"));
7310
7311 /*
7312 * Error message from KMd.
7313 * We assume that if error was occurred in IKEd, the length of PFKEY
7314 * message is equal to the size of sadb_msg structure.
7315 * We do not raise error even if error occurred in this function.
7316 */
7317 if (mhp->msg->sadb_msg_len == PFKEY_UNIT64(sizeof(struct sadb_msg))) {
7318 /* check sequence number */
7319 if (mhp->msg->sadb_msg_seq == 0 ||
7320 mhp->msg->sadb_msg_errno == 0) {
7321 ipseclog((LOG_DEBUG, "%s: must specify sequence "
7322 "number and errno.\n", __func__));
7323 } else {
7324 /*
7325 * IKEd reported that error occurred.
7326 * XXXAE: what it expects from the kernel?
7327 * Probably we should send SADB_ACQUIRE again?
7328 * If so, reset ACQ's state.
7329 * XXXAE: it looks useless.
7330 */
7331 key_acqreset(mhp->msg->sadb_msg_seq);
7332 }
7333 m_freem(m);
7334 return (0);
7335 }
7336
7337 /*
7338 * This message is from user land.
7339 */
7340
7341 /* map satype to proto */
7342 if ((proto = key_satype2proto(mhp->msg->sadb_msg_satype)) == 0) {
7343 ipseclog((LOG_DEBUG, "%s: invalid satype is passed.\n",
7344 __func__));
7345 return key_senderror(so, m, EINVAL);
7346 }
7347
7348 if (SADB_CHECKHDR(mhp, SADB_EXT_ADDRESS_SRC) ||
7349 SADB_CHECKHDR(mhp, SADB_EXT_ADDRESS_DST) ||
7350 SADB_CHECKHDR(mhp, SADB_EXT_PROPOSAL)) {
7351 ipseclog((LOG_DEBUG,
7352 "%s: invalid message: missing required header.\n",
7353 __func__));
7354 return key_senderror(so, m, EINVAL);
7355 }
7356 if (SADB_CHECKLEN(mhp, SADB_EXT_ADDRESS_SRC) ||
7357 SADB_CHECKLEN(mhp, SADB_EXT_ADDRESS_DST) ||
7358 SADB_CHECKLEN(mhp, SADB_EXT_PROPOSAL)) {
7359 ipseclog((LOG_DEBUG,
7360 "%s: invalid message: wrong header size.\n", __func__));
7361 return key_senderror(so, m, EINVAL);
7362 }
7363
7364 if (SADB_CHECKHDR(mhp, SADB_X_EXT_SA2)) {
7365 mode = IPSEC_MODE_ANY;
7366 reqid = 0;
7367 } else {
7368 if (SADB_CHECKLEN(mhp, SADB_X_EXT_SA2)) {
7369 ipseclog((LOG_DEBUG,
7370 "%s: invalid message: wrong header size.\n",
7371 __func__));
7372 return key_senderror(so, m, EINVAL);
7373 }
7374 mode = ((struct sadb_x_sa2 *)
7375 mhp->ext[SADB_X_EXT_SA2])->sadb_x_sa2_mode;
7376 reqid = ((struct sadb_x_sa2 *)
7377 mhp->ext[SADB_X_EXT_SA2])->sadb_x_sa2_reqid;
7378 }
7379
7380 src0 = (struct sadb_address *)mhp->ext[SADB_EXT_ADDRESS_SRC];
7381 dst0 = (struct sadb_address *)mhp->ext[SADB_EXT_ADDRESS_DST];
7382
7383 error = key_checksockaddrs((struct sockaddr *)(src0 + 1),
7384 (struct sockaddr *)(dst0 + 1));
7385 if (error != 0) {
7386 ipseclog((LOG_DEBUG, "%s: invalid sockaddr.\n", __func__));
7387 return key_senderror(so, m, EINVAL);
7388 }
7389 key_setsecasidx(proto, mode, reqid, src0 + 1, dst0 + 1, &saidx);
7390
7391 /* get a SA index */
7392 SAHTREE_RLOCK();
7393 LIST_FOREACH(sah, SAHADDRHASH_HASH(&saidx), addrhash) {
7394 if (key_cmpsaidx(&sah->saidx, &saidx, CMP_MODE_REQID))
7395 break;
7396 }
7397 SAHTREE_RUNLOCK();
7398 if (sah != NULL) {
7399 ipseclog((LOG_DEBUG, "%s: a SA exists already.\n", __func__));
7400 return key_senderror(so, m, EEXIST);
7401 }
7402
7403 error = key_acquire(&saidx, NULL);
7404 if (error != 0) {
7405 ipseclog((LOG_DEBUG,
7406 "%s: error %d returned from key_acquire()\n",
7407 __func__, error));
7408 return key_senderror(so, m, error);
7409 }
7410 m_freem(m);
7411 return (0);
7412 }
7413
7414 /*
7415 * SADB_REGISTER processing.
7416 * If SATYPE_UNSPEC has been passed as satype, only return sabd_supported.
7417 * receive
7418 * <base>
7419 * from the ikmpd, and register a socket to send PF_KEY messages,
7420 * and send
7421 * <base, supported>
7422 * to KMD by PF_KEY.
7423 * If socket is detached, must free from regnode.
7424 *
7425 * m will always be freed.
7426 */
7427 static int
key_register(struct socket * so,struct mbuf * m,const struct sadb_msghdr * mhp)7428 key_register(struct socket *so, struct mbuf *m, const struct sadb_msghdr *mhp)
7429 {
7430 struct secreg *reg, *newreg = NULL;
7431
7432 IPSEC_ASSERT(so != NULL, ("null socket"));
7433 IPSEC_ASSERT(m != NULL, ("null mbuf"));
7434 IPSEC_ASSERT(mhp != NULL, ("null msghdr"));
7435 IPSEC_ASSERT(mhp->msg != NULL, ("null msg"));
7436
7437 /* check for invalid register message */
7438 if (mhp->msg->sadb_msg_satype >= sizeof(V_regtree)/sizeof(V_regtree[0]))
7439 return key_senderror(so, m, EINVAL);
7440
7441 /* When SATYPE_UNSPEC is specified, only return sabd_supported. */
7442 if (mhp->msg->sadb_msg_satype == SADB_SATYPE_UNSPEC)
7443 goto setmsg;
7444
7445 /* check whether existing or not */
7446 REGTREE_LOCK();
7447 LIST_FOREACH(reg, &V_regtree[mhp->msg->sadb_msg_satype], chain) {
7448 if (reg->so == so) {
7449 REGTREE_UNLOCK();
7450 ipseclog((LOG_DEBUG, "%s: socket exists already.\n",
7451 __func__));
7452 return key_senderror(so, m, EEXIST);
7453 }
7454 }
7455
7456 /* create regnode */
7457 newreg = malloc(sizeof(struct secreg), M_IPSEC_SAR, M_NOWAIT|M_ZERO);
7458 if (newreg == NULL) {
7459 REGTREE_UNLOCK();
7460 ipseclog((LOG_DEBUG, "%s: No more memory.\n", __func__));
7461 return key_senderror(so, m, ENOBUFS);
7462 }
7463
7464 newreg->so = so;
7465 ((struct keycb *)(so->so_pcb))->kp_registered++;
7466
7467 /* add regnode to regtree. */
7468 LIST_INSERT_HEAD(&V_regtree[mhp->msg->sadb_msg_satype], newreg, chain);
7469 REGTREE_UNLOCK();
7470
7471 setmsg:
7472 {
7473 struct mbuf *n;
7474 struct sadb_msg *newmsg;
7475 struct sadb_supported *sup;
7476 u_int len, alen, elen;
7477 int off;
7478 int i;
7479 struct sadb_alg *alg;
7480
7481 /* create new sadb_msg to reply. */
7482 alen = 0;
7483 for (i = 1; i <= SADB_AALG_MAX; i++) {
7484 if (auth_algorithm_lookup(i))
7485 alen += sizeof(struct sadb_alg);
7486 }
7487 if (alen)
7488 alen += sizeof(struct sadb_supported);
7489 elen = 0;
7490 for (i = 1; i <= SADB_EALG_MAX; i++) {
7491 if (enc_algorithm_lookup(i))
7492 elen += sizeof(struct sadb_alg);
7493 }
7494 if (elen)
7495 elen += sizeof(struct sadb_supported);
7496
7497 len = sizeof(struct sadb_msg) + alen + elen;
7498
7499 if (len > MCLBYTES)
7500 return key_senderror(so, m, ENOBUFS);
7501
7502 n = key_mget(len);
7503 if (n == NULL)
7504 return key_senderror(so, m, ENOBUFS);
7505
7506 n->m_pkthdr.len = n->m_len = len;
7507 n->m_next = NULL;
7508 off = 0;
7509
7510 m_copydata(m, 0, sizeof(struct sadb_msg), mtod(n, caddr_t) + off);
7511 newmsg = mtod(n, struct sadb_msg *);
7512 newmsg->sadb_msg_errno = 0;
7513 newmsg->sadb_msg_len = PFKEY_UNIT64(len);
7514 off += PFKEY_ALIGN8(sizeof(struct sadb_msg));
7515
7516 /* for authentication algorithm */
7517 if (alen) {
7518 sup = (struct sadb_supported *)(mtod(n, caddr_t) + off);
7519 sup->sadb_supported_len = PFKEY_UNIT64(alen);
7520 sup->sadb_supported_exttype = SADB_EXT_SUPPORTED_AUTH;
7521 off += PFKEY_ALIGN8(sizeof(*sup));
7522
7523 for (i = 1; i <= SADB_AALG_MAX; i++) {
7524 const struct auth_hash *aalgo;
7525 u_int16_t minkeysize, maxkeysize;
7526
7527 aalgo = auth_algorithm_lookup(i);
7528 if (!aalgo)
7529 continue;
7530 alg = (struct sadb_alg *)(mtod(n, caddr_t) + off);
7531 alg->sadb_alg_id = i;
7532 alg->sadb_alg_ivlen = 0;
7533 key_getsizes_ah(aalgo, i, &minkeysize, &maxkeysize);
7534 alg->sadb_alg_minbits = _BITS(minkeysize);
7535 alg->sadb_alg_maxbits = _BITS(maxkeysize);
7536 off += PFKEY_ALIGN8(sizeof(*alg));
7537 }
7538 }
7539
7540 /* for encryption algorithm */
7541 if (elen) {
7542 sup = (struct sadb_supported *)(mtod(n, caddr_t) + off);
7543 sup->sadb_supported_len = PFKEY_UNIT64(elen);
7544 sup->sadb_supported_exttype = SADB_EXT_SUPPORTED_ENCRYPT;
7545 off += PFKEY_ALIGN8(sizeof(*sup));
7546
7547 for (i = 1; i <= SADB_EALG_MAX; i++) {
7548 const struct enc_xform *ealgo;
7549
7550 ealgo = enc_algorithm_lookup(i);
7551 if (!ealgo)
7552 continue;
7553 alg = (struct sadb_alg *)(mtod(n, caddr_t) + off);
7554 alg->sadb_alg_id = i;
7555 alg->sadb_alg_ivlen = ealgo->ivsize;
7556 alg->sadb_alg_minbits = _BITS(ealgo->minkey);
7557 alg->sadb_alg_maxbits = _BITS(ealgo->maxkey);
7558 off += PFKEY_ALIGN8(sizeof(struct sadb_alg));
7559 }
7560 }
7561
7562 IPSEC_ASSERT(off == len,
7563 ("length assumption failed (off %u len %u)", off, len));
7564
7565 m_freem(m);
7566 return key_sendup_mbuf(so, n, KEY_SENDUP_REGISTERED);
7567 }
7568 }
7569
7570 /*
7571 * free secreg entry registered.
7572 * XXX: I want to do free a socket marked done SADB_RESIGER to socket.
7573 */
7574 void
key_freereg(struct socket * so)7575 key_freereg(struct socket *so)
7576 {
7577 struct secreg *reg;
7578 int i;
7579
7580 IPSEC_ASSERT(so != NULL, ("NULL so"));
7581
7582 /*
7583 * check whether existing or not.
7584 * check all type of SA, because there is a potential that
7585 * one socket is registered to multiple type of SA.
7586 */
7587 REGTREE_LOCK();
7588 for (i = 0; i <= SADB_SATYPE_MAX; i++) {
7589 LIST_FOREACH(reg, &V_regtree[i], chain) {
7590 if (reg->so == so && __LIST_CHAINED(reg)) {
7591 LIST_REMOVE(reg, chain);
7592 free(reg, M_IPSEC_SAR);
7593 break;
7594 }
7595 }
7596 }
7597 REGTREE_UNLOCK();
7598 }
7599
7600 /*
7601 * SADB_EXPIRE processing
7602 * send
7603 * <base, SA, SA2, lifetime(C and one of HS), address(SD)>
7604 * to KMD by PF_KEY.
7605 * NOTE: We send only soft lifetime extension.
7606 *
7607 * OUT: 0 : succeed
7608 * others : error number
7609 */
7610 static int
key_expire(struct secasvar * sav,int hard)7611 key_expire(struct secasvar *sav, int hard)
7612 {
7613 struct mbuf *result = NULL, *m;
7614 struct sadb_lifetime *lt;
7615 uint32_t replay_count;
7616 int error, len;
7617 uint8_t satype;
7618
7619 SECASVAR_RLOCK_TRACKER;
7620
7621 IPSEC_ASSERT (sav != NULL, ("null sav"));
7622 IPSEC_ASSERT (sav->sah != NULL, ("null sa header"));
7623
7624 KEYDBG(KEY_STAMP,
7625 printf("%s: SA(%p) expired %s lifetime\n", __func__,
7626 sav, hard ? "hard": "soft"));
7627 KEYDBG(KEY_DATA, kdebug_secasv(sav));
7628 /* set msg header */
7629 satype = key_proto2satype(sav->sah->saidx.proto);
7630 IPSEC_ASSERT(satype != 0, ("invalid proto, satype %u", satype));
7631 m = key_setsadbmsg(SADB_EXPIRE, 0, satype, sav->seq, 0, sav->refcnt);
7632 if (!m) {
7633 error = ENOBUFS;
7634 goto fail;
7635 }
7636 result = m;
7637
7638 /* create SA extension */
7639 m = key_setsadbsa(sav);
7640 if (!m) {
7641 error = ENOBUFS;
7642 goto fail;
7643 }
7644 m_cat(result, m);
7645
7646 /* create SA extension */
7647 SECASVAR_RLOCK(sav);
7648 replay_count = sav->replay ? sav->replay->count : 0;
7649 SECASVAR_RUNLOCK(sav);
7650
7651 m = key_setsadbxsa2(sav->sah->saidx.mode, replay_count,
7652 sav->sah->saidx.reqid);
7653 if (!m) {
7654 error = ENOBUFS;
7655 goto fail;
7656 }
7657 m_cat(result, m);
7658
7659 if (sav->replay && sav->replay->wsize > UINT8_MAX) {
7660 m = key_setsadbxsareplay(sav->replay->wsize);
7661 if (!m) {
7662 error = ENOBUFS;
7663 goto fail;
7664 }
7665 m_cat(result, m);
7666 }
7667
7668 /* create lifetime extension (current and soft) */
7669 len = PFKEY_ALIGN8(sizeof(*lt)) * 2;
7670 m = m_get2(len, M_NOWAIT, MT_DATA, 0);
7671 if (m == NULL) {
7672 error = ENOBUFS;
7673 goto fail;
7674 }
7675 m_align(m, len);
7676 m->m_len = len;
7677 bzero(mtod(m, caddr_t), len);
7678 lt = mtod(m, struct sadb_lifetime *);
7679 lt->sadb_lifetime_len = PFKEY_UNIT64(sizeof(struct sadb_lifetime));
7680 lt->sadb_lifetime_exttype = SADB_EXT_LIFETIME_CURRENT;
7681 lt->sadb_lifetime_allocations =
7682 (uint32_t)counter_u64_fetch(sav->lft_c_allocations);
7683 lt->sadb_lifetime_bytes =
7684 counter_u64_fetch(sav->lft_c_bytes);
7685 lt->sadb_lifetime_addtime = sav->created;
7686 lt->sadb_lifetime_usetime = sav->firstused;
7687 lt = (struct sadb_lifetime *)(mtod(m, caddr_t) + len / 2);
7688 lt->sadb_lifetime_len = PFKEY_UNIT64(sizeof(struct sadb_lifetime));
7689 if (hard) {
7690 lt->sadb_lifetime_exttype = SADB_EXT_LIFETIME_HARD;
7691 lt->sadb_lifetime_allocations = sav->lft_h->allocations;
7692 lt->sadb_lifetime_bytes = sav->lft_h->bytes;
7693 lt->sadb_lifetime_addtime = sav->lft_h->addtime;
7694 lt->sadb_lifetime_usetime = sav->lft_h->usetime;
7695 } else {
7696 lt->sadb_lifetime_exttype = SADB_EXT_LIFETIME_SOFT;
7697 lt->sadb_lifetime_allocations = sav->lft_s->allocations;
7698 lt->sadb_lifetime_bytes = sav->lft_s->bytes;
7699 lt->sadb_lifetime_addtime = sav->lft_s->addtime;
7700 lt->sadb_lifetime_usetime = sav->lft_s->usetime;
7701 }
7702 m_cat(result, m);
7703
7704 /* set sadb_address for source */
7705 m = key_setsadbaddr(SADB_EXT_ADDRESS_SRC,
7706 &sav->sah->saidx.src.sa,
7707 FULLMASK, IPSEC_ULPROTO_ANY);
7708 if (!m) {
7709 error = ENOBUFS;
7710 goto fail;
7711 }
7712 m_cat(result, m);
7713
7714 /* set sadb_address for destination */
7715 m = key_setsadbaddr(SADB_EXT_ADDRESS_DST,
7716 &sav->sah->saidx.dst.sa,
7717 FULLMASK, IPSEC_ULPROTO_ANY);
7718 if (!m) {
7719 error = ENOBUFS;
7720 goto fail;
7721 }
7722 m_cat(result, m);
7723
7724 /*
7725 * XXX-BZ Handle NAT-T extensions here.
7726 * XXXAE: it doesn't seem quite useful. IKEs should not depend on
7727 * this information, we report only significant SA fields.
7728 */
7729
7730 if ((result->m_flags & M_PKTHDR) == 0) {
7731 error = EINVAL;
7732 goto fail;
7733 }
7734
7735 if (result->m_len < sizeof(struct sadb_msg)) {
7736 result = m_pullup(result, sizeof(struct sadb_msg));
7737 if (result == NULL) {
7738 error = ENOBUFS;
7739 goto fail;
7740 }
7741 }
7742
7743 result->m_pkthdr.len = 0;
7744 for (m = result; m; m = m->m_next)
7745 result->m_pkthdr.len += m->m_len;
7746
7747 mtod(result, struct sadb_msg *)->sadb_msg_len =
7748 PFKEY_UNIT64(result->m_pkthdr.len);
7749
7750 return key_sendup_mbuf(NULL, result, KEY_SENDUP_REGISTERED);
7751
7752 fail:
7753 if (result)
7754 m_freem(result);
7755 return error;
7756 }
7757
7758 static void
key_freesah_flushed(struct secashead_queue * flushq)7759 key_freesah_flushed(struct secashead_queue *flushq)
7760 {
7761 struct secashead *sah, *nextsah;
7762 struct secasvar *sav, *nextsav;
7763
7764 sah = TAILQ_FIRST(flushq);
7765 while (sah != NULL) {
7766 sav = TAILQ_FIRST(&sah->savtree_larval);
7767 while (sav != NULL) {
7768 nextsav = TAILQ_NEXT(sav, chain);
7769 TAILQ_REMOVE(&sah->savtree_larval, sav, chain);
7770 key_freesav(&sav); /* release last reference */
7771 key_freesah(&sah); /* release reference from SAV */
7772 sav = nextsav;
7773 }
7774 sav = TAILQ_FIRST(&sah->savtree_alive);
7775 while (sav != NULL) {
7776 nextsav = TAILQ_NEXT(sav, chain);
7777 TAILQ_REMOVE(&sah->savtree_alive, sav, chain);
7778 key_freesav(&sav); /* release last reference */
7779 key_freesah(&sah); /* release reference from SAV */
7780 sav = nextsav;
7781 }
7782 nextsah = TAILQ_NEXT(sah, chain);
7783 key_freesah(&sah); /* release last reference */
7784 sah = nextsah;
7785 }
7786 }
7787
7788 /*
7789 * SADB_FLUSH processing
7790 * receive
7791 * <base>
7792 * from the ikmpd, and free all entries in secastree.
7793 * and send,
7794 * <base>
7795 * to the ikmpd.
7796 * NOTE: to do is only marking SADB_SASTATE_DEAD.
7797 *
7798 * m will always be freed.
7799 */
7800 static int
key_flush(struct socket * so,struct mbuf * m,const struct sadb_msghdr * mhp)7801 key_flush(struct socket *so, struct mbuf *m, const struct sadb_msghdr *mhp)
7802 {
7803 struct secashead_queue flushq;
7804 struct sadb_msg *newmsg;
7805 struct secashead *sah, *nextsah;
7806 struct secasvar *sav;
7807 uint8_t proto;
7808 int i;
7809
7810 IPSEC_ASSERT(so != NULL, ("null socket"));
7811 IPSEC_ASSERT(mhp != NULL, ("null msghdr"));
7812 IPSEC_ASSERT(mhp->msg != NULL, ("null msg"));
7813
7814 /* map satype to proto */
7815 if ((proto = key_satype2proto(mhp->msg->sadb_msg_satype)) == 0) {
7816 ipseclog((LOG_DEBUG, "%s: invalid satype is passed.\n",
7817 __func__));
7818 return key_senderror(so, m, EINVAL);
7819 }
7820 KEYDBG(KEY_STAMP,
7821 printf("%s: proto %u\n", __func__, proto));
7822
7823 TAILQ_INIT(&flushq);
7824 if (proto == IPSEC_PROTO_ANY) {
7825 /* no SATYPE specified, i.e. flushing all SA. */
7826 SAHTREE_WLOCK();
7827 /* Move all SAHs into flushq */
7828 TAILQ_CONCAT(&flushq, &V_sahtree, chain);
7829 /* Flush all buckets in SPI hash */
7830 for (i = 0; i < V_savhash_mask + 1; i++)
7831 LIST_INIT(&V_savhashtbl[i]);
7832 /* Flush all buckets in SAHADDRHASH */
7833 for (i = 0; i < V_sahaddrhash_mask + 1; i++)
7834 LIST_INIT(&V_sahaddrhashtbl[i]);
7835 /* Mark all SAHs as unlinked */
7836 TAILQ_FOREACH(sah, &flushq, chain) {
7837 sah->state = SADB_SASTATE_DEAD;
7838 /*
7839 * Callout handler makes its job using
7840 * RLOCK and drain queues. In case, when this
7841 * function will be called just before it
7842 * acquires WLOCK, we need to mark SAs as
7843 * unlinked to prevent second unlink.
7844 */
7845 TAILQ_FOREACH(sav, &sah->savtree_larval, chain) {
7846 sav->state = SADB_SASTATE_DEAD;
7847 ipsec_accel_forget_sav(sav);
7848 }
7849 TAILQ_FOREACH(sav, &sah->savtree_alive, chain) {
7850 sav->state = SADB_SASTATE_DEAD;
7851 ipsec_accel_forget_sav(sav);
7852 }
7853 }
7854 SAHTREE_WUNLOCK();
7855 } else {
7856 SAHTREE_WLOCK();
7857 sah = TAILQ_FIRST(&V_sahtree);
7858 while (sah != NULL) {
7859 IPSEC_ASSERT(sah->state != SADB_SASTATE_DEAD,
7860 ("DEAD SAH %p in SADB_FLUSH", sah));
7861 nextsah = TAILQ_NEXT(sah, chain);
7862 if (sah->saidx.proto != proto) {
7863 sah = nextsah;
7864 continue;
7865 }
7866 sah->state = SADB_SASTATE_DEAD;
7867 TAILQ_REMOVE(&V_sahtree, sah, chain);
7868 LIST_REMOVE(sah, addrhash);
7869 /* Unlink all SAs from SPI hash */
7870 TAILQ_FOREACH(sav, &sah->savtree_larval, chain) {
7871 LIST_REMOVE(sav, spihash);
7872 sav->state = SADB_SASTATE_DEAD;
7873 ipsec_accel_forget_sav(sav);
7874 }
7875 TAILQ_FOREACH(sav, &sah->savtree_alive, chain) {
7876 LIST_REMOVE(sav, spihash);
7877 sav->state = SADB_SASTATE_DEAD;
7878 ipsec_accel_forget_sav(sav);
7879 }
7880 /* Add SAH into flushq */
7881 TAILQ_INSERT_HEAD(&flushq, sah, chain);
7882 sah = nextsah;
7883 }
7884 SAHTREE_WUNLOCK();
7885 }
7886
7887 key_freesah_flushed(&flushq);
7888 /* Free all queued SAs and SAHs */
7889 if (m->m_len < sizeof(struct sadb_msg) ||
7890 sizeof(struct sadb_msg) > m->m_len + M_TRAILINGSPACE(m)) {
7891 ipseclog((LOG_DEBUG, "%s: No more memory.\n", __func__));
7892 return key_senderror(so, m, ENOBUFS);
7893 }
7894
7895 if (m->m_next)
7896 m_freem(m->m_next);
7897 m->m_next = NULL;
7898 m->m_pkthdr.len = m->m_len = sizeof(struct sadb_msg);
7899 newmsg = mtod(m, struct sadb_msg *);
7900 newmsg->sadb_msg_errno = 0;
7901 newmsg->sadb_msg_len = PFKEY_UNIT64(m->m_pkthdr.len);
7902
7903 return key_sendup_mbuf(so, m, KEY_SENDUP_ALL);
7904 }
7905
7906 /*
7907 * SADB_DUMP processing
7908 * dump all entries including status of DEAD in SAD.
7909 * receive
7910 * <base>
7911 * from the ikmpd, and dump all secasvar leaves
7912 * and send,
7913 * <base> .....
7914 * to the ikmpd.
7915 *
7916 * m will always be freed.
7917 */
7918 static int
key_dump(struct socket * so,struct mbuf * m,const struct sadb_msghdr * mhp)7919 key_dump(struct socket *so, struct mbuf *m, const struct sadb_msghdr *mhp)
7920 {
7921 SAHTREE_RLOCK_TRACKER;
7922 struct secashead *sah;
7923 struct secasvar *sav;
7924 struct mbuf *n;
7925 uint32_t cnt;
7926 uint8_t proto, satype;
7927
7928 IPSEC_ASSERT(so != NULL, ("null socket"));
7929 IPSEC_ASSERT(m != NULL, ("null mbuf"));
7930 IPSEC_ASSERT(mhp != NULL, ("null msghdr"));
7931 IPSEC_ASSERT(mhp->msg != NULL, ("null msg"));
7932
7933 /* map satype to proto */
7934 if ((proto = key_satype2proto(mhp->msg->sadb_msg_satype)) == 0) {
7935 ipseclog((LOG_DEBUG, "%s: invalid satype is passed.\n",
7936 __func__));
7937 return key_senderror(so, m, EINVAL);
7938 }
7939
7940 /* count sav entries to be sent to the userland. */
7941 cnt = 0;
7942 IFNET_RLOCK();
7943 SAHTREE_RLOCK();
7944 TAILQ_FOREACH(sah, &V_sahtree, chain) {
7945 if (mhp->msg->sadb_msg_satype != SADB_SATYPE_UNSPEC &&
7946 proto != sah->saidx.proto)
7947 continue;
7948
7949 TAILQ_FOREACH(sav, &sah->savtree_larval, chain)
7950 cnt++;
7951 TAILQ_FOREACH(sav, &sah->savtree_alive, chain)
7952 cnt++;
7953 }
7954
7955 if (cnt == 0) {
7956 SAHTREE_RUNLOCK();
7957 IFNET_RUNLOCK();
7958 return key_senderror(so, m, ENOENT);
7959 }
7960
7961 /* send this to the userland, one at a time. */
7962 TAILQ_FOREACH(sah, &V_sahtree, chain) {
7963 if (mhp->msg->sadb_msg_satype != SADB_SATYPE_UNSPEC &&
7964 proto != sah->saidx.proto)
7965 continue;
7966
7967 /* map proto to satype */
7968 if ((satype = key_proto2satype(sah->saidx.proto)) == 0) {
7969 SAHTREE_RUNLOCK();
7970 IFNET_RUNLOCK();
7971 ipseclog((LOG_DEBUG, "%s: there was invalid proto in "
7972 "SAD.\n", __func__));
7973 return key_senderror(so, m, EINVAL);
7974 }
7975 TAILQ_FOREACH(sav, &sah->savtree_larval, chain) {
7976 n = key_setdumpsa(sav, SADB_DUMP, satype,
7977 --cnt, mhp->msg->sadb_msg_pid, &sahtree_tracker);
7978 if (n == NULL) {
7979 SAHTREE_RUNLOCK();
7980 IFNET_RUNLOCK();
7981 return key_senderror(so, m, ENOBUFS);
7982 }
7983 key_sendup_mbuf(so, n, KEY_SENDUP_ONE);
7984 }
7985 TAILQ_FOREACH(sav, &sah->savtree_alive, chain) {
7986 n = key_setdumpsa(sav, SADB_DUMP, satype,
7987 --cnt, mhp->msg->sadb_msg_pid, &sahtree_tracker);
7988 if (n == NULL) {
7989 SAHTREE_RUNLOCK();
7990 IFNET_RUNLOCK();
7991 return key_senderror(so, m, ENOBUFS);
7992 }
7993 key_sendup_mbuf(so, n, KEY_SENDUP_ONE);
7994 }
7995 }
7996 SAHTREE_RUNLOCK();
7997 IFNET_RUNLOCK();
7998 m_freem(m);
7999 return (0);
8000 }
8001 /*
8002 * SADB_X_PROMISC processing
8003 *
8004 * m will always be freed.
8005 */
8006 static int
key_promisc(struct socket * so,struct mbuf * m,const struct sadb_msghdr * mhp)8007 key_promisc(struct socket *so, struct mbuf *m, const struct sadb_msghdr *mhp)
8008 {
8009 int olen;
8010
8011 IPSEC_ASSERT(so != NULL, ("null socket"));
8012 IPSEC_ASSERT(m != NULL, ("null mbuf"));
8013 IPSEC_ASSERT(mhp != NULL, ("null msghdr"));
8014 IPSEC_ASSERT(mhp->msg != NULL, ("null msg"));
8015
8016 olen = PFKEY_UNUNIT64(mhp->msg->sadb_msg_len);
8017
8018 if (olen < sizeof(struct sadb_msg)) {
8019 #if 1
8020 return key_senderror(so, m, EINVAL);
8021 #else
8022 m_freem(m);
8023 return 0;
8024 #endif
8025 } else if (olen == sizeof(struct sadb_msg)) {
8026 /* enable/disable promisc mode */
8027 struct keycb *kp;
8028
8029 if ((kp = so->so_pcb) == NULL)
8030 return key_senderror(so, m, EINVAL);
8031 mhp->msg->sadb_msg_errno = 0;
8032 switch (mhp->msg->sadb_msg_satype) {
8033 case 0:
8034 case 1:
8035 kp->kp_promisc = mhp->msg->sadb_msg_satype;
8036 break;
8037 default:
8038 return key_senderror(so, m, EINVAL);
8039 }
8040
8041 /* send the original message back to everyone */
8042 mhp->msg->sadb_msg_errno = 0;
8043 return key_sendup_mbuf(so, m, KEY_SENDUP_ALL);
8044 } else {
8045 /* send packet as is */
8046
8047 m_adj(m, PFKEY_ALIGN8(sizeof(struct sadb_msg)));
8048
8049 /* TODO: if sadb_msg_seq is specified, send to specific pid */
8050 return key_sendup_mbuf(so, m, KEY_SENDUP_ALL);
8051 }
8052 }
8053
8054 static int (*key_typesw[])(struct socket *, struct mbuf *,
8055 const struct sadb_msghdr *) = {
8056 [SADB_RESERVED] = NULL,
8057 [SADB_GETSPI] = key_getspi,
8058 [SADB_UPDATE] = key_update,
8059 [SADB_ADD] = key_add,
8060 [SADB_DELETE] = key_delete,
8061 [SADB_GET] = key_get,
8062 [SADB_ACQUIRE] = key_acquire2,
8063 [SADB_REGISTER] = key_register,
8064 [SADB_EXPIRE] = NULL,
8065 [SADB_FLUSH] = key_flush,
8066 [SADB_DUMP] = key_dump,
8067 [SADB_X_PROMISC] = key_promisc,
8068 [SADB_X_PCHANGE] = NULL,
8069 [SADB_X_SPDUPDATE] = key_spdadd,
8070 [SADB_X_SPDADD] = key_spdadd,
8071 [SADB_X_SPDDELETE] = key_spddelete,
8072 [SADB_X_SPDGET] = key_spdget,
8073 [SADB_X_SPDACQUIRE] = NULL,
8074 [SADB_X_SPDDUMP] = key_spddump,
8075 [SADB_X_SPDFLUSH] = key_spdflush,
8076 [SADB_X_SPDSETIDX] = key_spdadd,
8077 [SADB_X_SPDEXPIRE] = NULL,
8078 [SADB_X_SPDDELETE2] = key_spddelete2,
8079 };
8080
8081 /*
8082 * parse sadb_msg buffer to process PFKEYv2,
8083 * and create a data to response if needed.
8084 * I think to be dealed with mbuf directly.
8085 * IN:
8086 * msgp : pointer to pointer to a received buffer pulluped.
8087 * This is rewrited to response.
8088 * so : pointer to socket.
8089 * OUT:
8090 * length for buffer to send to user process.
8091 */
8092 int
key_parse(struct mbuf * m,struct socket * so)8093 key_parse(struct mbuf *m, struct socket *so)
8094 {
8095 struct sadb_msg *msg;
8096 struct sadb_msghdr mh;
8097 u_int orglen;
8098 int error;
8099 int target;
8100
8101 IPSEC_ASSERT(so != NULL, ("null socket"));
8102 IPSEC_ASSERT(m != NULL, ("null mbuf"));
8103
8104 if (m->m_len < sizeof(struct sadb_msg)) {
8105 m = m_pullup(m, sizeof(struct sadb_msg));
8106 if (!m)
8107 return ENOBUFS;
8108 }
8109 msg = mtod(m, struct sadb_msg *);
8110 orglen = PFKEY_UNUNIT64(msg->sadb_msg_len);
8111 target = KEY_SENDUP_ONE;
8112
8113 if ((m->m_flags & M_PKTHDR) == 0 || m->m_pkthdr.len != orglen) {
8114 ipseclog((LOG_DEBUG, "%s: invalid message length.\n",__func__));
8115 PFKEYSTAT_INC(out_invlen);
8116 error = EINVAL;
8117 goto senderror;
8118 }
8119
8120 if (msg->sadb_msg_version != PF_KEY_V2) {
8121 ipseclog((LOG_DEBUG, "%s: PF_KEY version %u is mismatched.\n",
8122 __func__, msg->sadb_msg_version));
8123 PFKEYSTAT_INC(out_invver);
8124 error = EINVAL;
8125 goto senderror;
8126 }
8127
8128 if (msg->sadb_msg_type > SADB_MAX) {
8129 ipseclog((LOG_DEBUG, "%s: invalid type %u is passed.\n",
8130 __func__, msg->sadb_msg_type));
8131 PFKEYSTAT_INC(out_invmsgtype);
8132 error = EINVAL;
8133 goto senderror;
8134 }
8135
8136 /* for old-fashioned code - should be nuked */
8137 if (m->m_pkthdr.len > MCLBYTES) {
8138 m_freem(m);
8139 return ENOBUFS;
8140 }
8141 if (m->m_next) {
8142 struct mbuf *n;
8143
8144 n = key_mget(m->m_pkthdr.len);
8145 if (n == NULL) {
8146 m_freem(m);
8147 return ENOBUFS;
8148 }
8149 m_copydata(m, 0, m->m_pkthdr.len, mtod(n, caddr_t));
8150 n->m_pkthdr.len = n->m_len = m->m_pkthdr.len;
8151 n->m_next = NULL;
8152 m_freem(m);
8153 m = n;
8154 }
8155
8156 /* align the mbuf chain so that extensions are in contiguous region. */
8157 error = key_align(m, &mh);
8158 if (error)
8159 return error;
8160
8161 msg = mh.msg;
8162
8163 /* We use satype as scope mask for spddump */
8164 if (msg->sadb_msg_type == SADB_X_SPDDUMP) {
8165 switch (msg->sadb_msg_satype) {
8166 case IPSEC_POLICYSCOPE_ANY:
8167 case IPSEC_POLICYSCOPE_GLOBAL:
8168 case IPSEC_POLICYSCOPE_IFNET:
8169 case IPSEC_POLICYSCOPE_PCB:
8170 break;
8171 default:
8172 ipseclog((LOG_DEBUG, "%s: illegal satype=%u\n",
8173 __func__, msg->sadb_msg_type));
8174 PFKEYSTAT_INC(out_invsatype);
8175 error = EINVAL;
8176 goto senderror;
8177 }
8178 } else {
8179 switch (msg->sadb_msg_satype) { /* check SA type */
8180 case SADB_SATYPE_UNSPEC:
8181 switch (msg->sadb_msg_type) {
8182 case SADB_GETSPI:
8183 case SADB_UPDATE:
8184 case SADB_ADD:
8185 case SADB_DELETE:
8186 case SADB_GET:
8187 case SADB_ACQUIRE:
8188 case SADB_EXPIRE:
8189 ipseclog((LOG_DEBUG, "%s: must specify satype "
8190 "when msg type=%u.\n", __func__,
8191 msg->sadb_msg_type));
8192 PFKEYSTAT_INC(out_invsatype);
8193 error = EINVAL;
8194 goto senderror;
8195 }
8196 break;
8197 case SADB_SATYPE_AH:
8198 case SADB_SATYPE_ESP:
8199 case SADB_X_SATYPE_IPCOMP:
8200 case SADB_X_SATYPE_TCPSIGNATURE:
8201 switch (msg->sadb_msg_type) {
8202 case SADB_X_SPDADD:
8203 case SADB_X_SPDDELETE:
8204 case SADB_X_SPDGET:
8205 case SADB_X_SPDFLUSH:
8206 case SADB_X_SPDSETIDX:
8207 case SADB_X_SPDUPDATE:
8208 case SADB_X_SPDDELETE2:
8209 ipseclog((LOG_DEBUG, "%s: illegal satype=%u\n",
8210 __func__, msg->sadb_msg_type));
8211 PFKEYSTAT_INC(out_invsatype);
8212 error = EINVAL;
8213 goto senderror;
8214 }
8215 break;
8216 case SADB_SATYPE_RSVP:
8217 case SADB_SATYPE_OSPFV2:
8218 case SADB_SATYPE_RIPV2:
8219 case SADB_SATYPE_MIP:
8220 ipseclog((LOG_DEBUG, "%s: type %u isn't supported.\n",
8221 __func__, msg->sadb_msg_satype));
8222 PFKEYSTAT_INC(out_invsatype);
8223 error = EOPNOTSUPP;
8224 goto senderror;
8225 case 1: /* XXX: What does it do? */
8226 if (msg->sadb_msg_type == SADB_X_PROMISC)
8227 break;
8228 /*FALLTHROUGH*/
8229 default:
8230 ipseclog((LOG_DEBUG, "%s: invalid type %u is passed.\n",
8231 __func__, msg->sadb_msg_satype));
8232 PFKEYSTAT_INC(out_invsatype);
8233 error = EINVAL;
8234 goto senderror;
8235 }
8236 }
8237
8238 /* check field of upper layer protocol and address family */
8239 if (mh.ext[SADB_EXT_ADDRESS_SRC] != NULL
8240 && mh.ext[SADB_EXT_ADDRESS_DST] != NULL) {
8241 struct sadb_address *src0, *dst0;
8242 u_int plen;
8243
8244 src0 = (struct sadb_address *)(mh.ext[SADB_EXT_ADDRESS_SRC]);
8245 dst0 = (struct sadb_address *)(mh.ext[SADB_EXT_ADDRESS_DST]);
8246
8247 /* check upper layer protocol */
8248 if (src0->sadb_address_proto != dst0->sadb_address_proto) {
8249 ipseclog((LOG_DEBUG, "%s: upper layer protocol "
8250 "mismatched.\n", __func__));
8251 PFKEYSTAT_INC(out_invaddr);
8252 error = EINVAL;
8253 goto senderror;
8254 }
8255
8256 /* check family */
8257 if (PFKEY_ADDR_SADDR(src0)->sa_family !=
8258 PFKEY_ADDR_SADDR(dst0)->sa_family) {
8259 ipseclog((LOG_DEBUG, "%s: address family mismatched.\n",
8260 __func__));
8261 PFKEYSTAT_INC(out_invaddr);
8262 error = EINVAL;
8263 goto senderror;
8264 }
8265 if (PFKEY_ADDR_SADDR(src0)->sa_len !=
8266 PFKEY_ADDR_SADDR(dst0)->sa_len) {
8267 ipseclog((LOG_DEBUG, "%s: address struct size "
8268 "mismatched.\n", __func__));
8269 PFKEYSTAT_INC(out_invaddr);
8270 error = EINVAL;
8271 goto senderror;
8272 }
8273
8274 switch (PFKEY_ADDR_SADDR(src0)->sa_family) {
8275 case AF_INET:
8276 if (PFKEY_ADDR_SADDR(src0)->sa_len !=
8277 sizeof(struct sockaddr_in)) {
8278 PFKEYSTAT_INC(out_invaddr);
8279 error = EINVAL;
8280 goto senderror;
8281 }
8282 break;
8283 case AF_INET6:
8284 if (PFKEY_ADDR_SADDR(src0)->sa_len !=
8285 sizeof(struct sockaddr_in6)) {
8286 PFKEYSTAT_INC(out_invaddr);
8287 error = EINVAL;
8288 goto senderror;
8289 }
8290 break;
8291 default:
8292 ipseclog((LOG_DEBUG, "%s: unsupported address family\n",
8293 __func__));
8294 PFKEYSTAT_INC(out_invaddr);
8295 error = EAFNOSUPPORT;
8296 goto senderror;
8297 }
8298
8299 switch (PFKEY_ADDR_SADDR(src0)->sa_family) {
8300 case AF_INET:
8301 plen = sizeof(struct in_addr) << 3;
8302 break;
8303 case AF_INET6:
8304 plen = sizeof(struct in6_addr) << 3;
8305 break;
8306 default:
8307 plen = 0; /*fool gcc*/
8308 break;
8309 }
8310
8311 /* check max prefix length */
8312 if (src0->sadb_address_prefixlen > plen ||
8313 dst0->sadb_address_prefixlen > plen) {
8314 ipseclog((LOG_DEBUG, "%s: illegal prefixlen.\n",
8315 __func__));
8316 PFKEYSTAT_INC(out_invaddr);
8317 error = EINVAL;
8318 goto senderror;
8319 }
8320
8321 /*
8322 * prefixlen == 0 is valid because there can be a case when
8323 * all addresses are matched.
8324 */
8325 }
8326
8327 if (msg->sadb_msg_type >= nitems(key_typesw) ||
8328 key_typesw[msg->sadb_msg_type] == NULL) {
8329 PFKEYSTAT_INC(out_invmsgtype);
8330 error = EINVAL;
8331 goto senderror;
8332 }
8333
8334 return (*key_typesw[msg->sadb_msg_type])(so, m, &mh);
8335
8336 senderror:
8337 msg->sadb_msg_errno = error;
8338 return key_sendup_mbuf(so, m, target);
8339 }
8340
8341 static int
key_senderror(struct socket * so,struct mbuf * m,int code)8342 key_senderror(struct socket *so, struct mbuf *m, int code)
8343 {
8344 struct sadb_msg *msg;
8345
8346 IPSEC_ASSERT(m->m_len >= sizeof(struct sadb_msg),
8347 ("mbuf too small, len %u", m->m_len));
8348
8349 msg = mtod(m, struct sadb_msg *);
8350 msg->sadb_msg_errno = code;
8351 return key_sendup_mbuf(so, m, KEY_SENDUP_ONE);
8352 }
8353
8354 /*
8355 * set the pointer to each header into message buffer.
8356 * m will be freed on error.
8357 * XXX larger-than-MCLBYTES extension?
8358 */
8359 static int
key_align(struct mbuf * m,struct sadb_msghdr * mhp)8360 key_align(struct mbuf *m, struct sadb_msghdr *mhp)
8361 {
8362 struct mbuf *n;
8363 struct sadb_ext *ext;
8364 size_t off, end;
8365 int extlen;
8366 int toff;
8367
8368 IPSEC_ASSERT(m != NULL, ("null mbuf"));
8369 IPSEC_ASSERT(mhp != NULL, ("null msghdr"));
8370 IPSEC_ASSERT(m->m_len >= sizeof(struct sadb_msg),
8371 ("mbuf too small, len %u", m->m_len));
8372
8373 /* initialize */
8374 bzero(mhp, sizeof(*mhp));
8375
8376 mhp->msg = mtod(m, struct sadb_msg *);
8377 mhp->ext[0] = (struct sadb_ext *)mhp->msg; /*XXX backward compat */
8378
8379 end = PFKEY_UNUNIT64(mhp->msg->sadb_msg_len);
8380 extlen = end; /*just in case extlen is not updated*/
8381 for (off = sizeof(struct sadb_msg); off < end; off += extlen) {
8382 n = m_pulldown(m, off, sizeof(struct sadb_ext), &toff);
8383 if (!n) {
8384 /* m is already freed */
8385 return ENOBUFS;
8386 }
8387 ext = (struct sadb_ext *)(mtod(n, caddr_t) + toff);
8388
8389 /* set pointer */
8390 switch (ext->sadb_ext_type) {
8391 case SADB_EXT_SA:
8392 case SADB_EXT_ADDRESS_SRC:
8393 case SADB_EXT_ADDRESS_DST:
8394 case SADB_EXT_ADDRESS_PROXY:
8395 case SADB_EXT_LIFETIME_CURRENT:
8396 case SADB_EXT_LIFETIME_HARD:
8397 case SADB_EXT_LIFETIME_SOFT:
8398 case SADB_EXT_KEY_AUTH:
8399 case SADB_EXT_KEY_ENCRYPT:
8400 case SADB_EXT_IDENTITY_SRC:
8401 case SADB_EXT_IDENTITY_DST:
8402 case SADB_EXT_SENSITIVITY:
8403 case SADB_EXT_PROPOSAL:
8404 case SADB_EXT_SUPPORTED_AUTH:
8405 case SADB_EXT_SUPPORTED_ENCRYPT:
8406 case SADB_EXT_SPIRANGE:
8407 case SADB_X_EXT_POLICY:
8408 case SADB_X_EXT_SA2:
8409 case SADB_X_EXT_NAT_T_TYPE:
8410 case SADB_X_EXT_NAT_T_SPORT:
8411 case SADB_X_EXT_NAT_T_DPORT:
8412 case SADB_X_EXT_NAT_T_OAI:
8413 case SADB_X_EXT_NAT_T_OAR:
8414 case SADB_X_EXT_NAT_T_FRAG:
8415 case SADB_X_EXT_SA_REPLAY:
8416 case SADB_X_EXT_NEW_ADDRESS_SRC:
8417 case SADB_X_EXT_NEW_ADDRESS_DST:
8418 #ifdef IPSEC_OFFLOAD
8419 case SADB_X_EXT_LFT_CUR_SW_OFFL:
8420 case SADB_X_EXT_LFT_CUR_HW_OFFL:
8421 case SADB_X_EXT_IF_HW_OFFL:
8422 #endif
8423 /* duplicate check */
8424 /*
8425 * XXX Are there duplication payloads of either
8426 * KEY_AUTH or KEY_ENCRYPT ?
8427 */
8428 if (mhp->ext[ext->sadb_ext_type] != NULL) {
8429 ipseclog((LOG_DEBUG, "%s: duplicate ext_type "
8430 "%u\n", __func__, ext->sadb_ext_type));
8431 m_freem(m);
8432 PFKEYSTAT_INC(out_dupext);
8433 return EINVAL;
8434 }
8435 break;
8436 default:
8437 ipseclog((LOG_DEBUG, "%s: invalid ext_type %u\n",
8438 __func__, ext->sadb_ext_type));
8439 m_freem(m);
8440 PFKEYSTAT_INC(out_invexttype);
8441 return EINVAL;
8442 }
8443
8444 extlen = PFKEY_UNUNIT64(ext->sadb_ext_len);
8445
8446 if (key_validate_ext(ext, extlen)) {
8447 m_freem(m);
8448 PFKEYSTAT_INC(out_invlen);
8449 return EINVAL;
8450 }
8451
8452 n = m_pulldown(m, off, extlen, &toff);
8453 if (!n) {
8454 /* m is already freed */
8455 return ENOBUFS;
8456 }
8457 ext = (struct sadb_ext *)(mtod(n, caddr_t) + toff);
8458
8459 mhp->ext[ext->sadb_ext_type] = ext;
8460 mhp->extoff[ext->sadb_ext_type] = off;
8461 mhp->extlen[ext->sadb_ext_type] = extlen;
8462 }
8463
8464 if (off != end) {
8465 m_freem(m);
8466 PFKEYSTAT_INC(out_invlen);
8467 return EINVAL;
8468 }
8469
8470 return 0;
8471 }
8472
8473 static int
key_validate_ext(const struct sadb_ext * ext,int len)8474 key_validate_ext(const struct sadb_ext *ext, int len)
8475 {
8476 const struct sockaddr *sa;
8477 enum { NONE, ADDR } checktype = NONE;
8478 int baselen = 0;
8479 const int sal = offsetof(struct sockaddr, sa_len) + sizeof(sa->sa_len);
8480
8481 if (len != PFKEY_UNUNIT64(ext->sadb_ext_len))
8482 return EINVAL;
8483
8484 /* if it does not match minimum/maximum length, bail */
8485 if (ext->sadb_ext_type >= nitems(minsize) ||
8486 ext->sadb_ext_type >= nitems(maxsize))
8487 return EINVAL;
8488 if (!minsize[ext->sadb_ext_type] || len < minsize[ext->sadb_ext_type])
8489 return EINVAL;
8490 if (maxsize[ext->sadb_ext_type] && len > maxsize[ext->sadb_ext_type])
8491 return EINVAL;
8492
8493 /* more checks based on sadb_ext_type XXX need more */
8494 switch (ext->sadb_ext_type) {
8495 case SADB_EXT_ADDRESS_SRC:
8496 case SADB_EXT_ADDRESS_DST:
8497 case SADB_EXT_ADDRESS_PROXY:
8498 case SADB_X_EXT_NAT_T_OAI:
8499 case SADB_X_EXT_NAT_T_OAR:
8500 case SADB_X_EXT_NEW_ADDRESS_SRC:
8501 case SADB_X_EXT_NEW_ADDRESS_DST:
8502 baselen = PFKEY_ALIGN8(sizeof(struct sadb_address));
8503 checktype = ADDR;
8504 break;
8505 case SADB_EXT_IDENTITY_SRC:
8506 case SADB_EXT_IDENTITY_DST:
8507 if (((const struct sadb_ident *)ext)->sadb_ident_type ==
8508 SADB_X_IDENTTYPE_ADDR) {
8509 baselen = PFKEY_ALIGN8(sizeof(struct sadb_ident));
8510 checktype = ADDR;
8511 } else
8512 checktype = NONE;
8513 break;
8514 default:
8515 checktype = NONE;
8516 break;
8517 }
8518
8519 switch (checktype) {
8520 case NONE:
8521 break;
8522 case ADDR:
8523 sa = (const struct sockaddr *)(((const u_int8_t*)ext)+baselen);
8524 if (len < baselen + sal)
8525 return EINVAL;
8526 if (baselen + PFKEY_ALIGN8(sa->sa_len) != len)
8527 return EINVAL;
8528 break;
8529 }
8530
8531 return 0;
8532 }
8533
8534 void
spdcache_init(void)8535 spdcache_init(void)
8536 {
8537 int i;
8538
8539 TUNABLE_INT_FETCH("net.key.spdcache.maxentries",
8540 &V_key_spdcache_maxentries);
8541 TUNABLE_INT_FETCH("net.key.spdcache.threshold",
8542 &V_key_spdcache_threshold);
8543
8544 if (V_key_spdcache_maxentries) {
8545 V_key_spdcache_maxentries = MAX(V_key_spdcache_maxentries,
8546 SPDCACHE_MAX_ENTRIES_PER_HASH);
8547 V_spdcachehashtbl = hashinit(V_key_spdcache_maxentries /
8548 SPDCACHE_MAX_ENTRIES_PER_HASH,
8549 M_IPSEC_SPDCACHE, &V_spdcachehash_mask);
8550 V_key_spdcache_maxentries = (V_spdcachehash_mask + 1)
8551 * SPDCACHE_MAX_ENTRIES_PER_HASH;
8552
8553 V_spdcache_lock = malloc(sizeof(struct mtx) *
8554 (V_spdcachehash_mask + 1),
8555 M_IPSEC_SPDCACHE, M_WAITOK | M_ZERO);
8556
8557 for (i = 0; i < V_spdcachehash_mask + 1; ++i)
8558 SPDCACHE_LOCK_INIT(i);
8559 }
8560 }
8561
8562 struct spdcache_entry *
spdcache_entry_alloc(const struct secpolicyindex * spidx,struct secpolicy * sp)8563 spdcache_entry_alloc(const struct secpolicyindex *spidx, struct secpolicy *sp)
8564 {
8565 struct spdcache_entry *entry;
8566
8567 entry = malloc(sizeof(struct spdcache_entry), M_IPSEC_SPDCACHE,
8568 M_NOWAIT | M_ZERO);
8569 if (entry == NULL)
8570 return (NULL);
8571
8572 if (sp != NULL)
8573 SP_ADDREF(sp);
8574
8575 entry->spidx = *spidx;
8576 entry->sp = sp;
8577
8578 return (entry);
8579 }
8580
8581 void
spdcache_entry_free(struct spdcache_entry * entry)8582 spdcache_entry_free(struct spdcache_entry *entry)
8583 {
8584
8585 if (entry->sp != NULL)
8586 key_freesp(&entry->sp);
8587 free(entry, M_IPSEC_SPDCACHE);
8588 }
8589
8590 void
spdcache_clear(void)8591 spdcache_clear(void)
8592 {
8593 struct spdcache_entry *entry;
8594 int i;
8595
8596 for (i = 0; i < V_spdcachehash_mask + 1; ++i) {
8597 SPDCACHE_LOCK(i);
8598 while (!LIST_EMPTY(&V_spdcachehashtbl[i])) {
8599 entry = LIST_FIRST(&V_spdcachehashtbl[i]);
8600 LIST_REMOVE(entry, chain);
8601 spdcache_entry_free(entry);
8602 }
8603 SPDCACHE_UNLOCK(i);
8604 }
8605 }
8606
8607 #ifdef VIMAGE
8608 void
spdcache_destroy(void)8609 spdcache_destroy(void)
8610 {
8611 int i;
8612
8613 if (SPDCACHE_ENABLED()) {
8614 spdcache_clear();
8615 hashdestroy(V_spdcachehashtbl, M_IPSEC_SPDCACHE, V_spdcachehash_mask);
8616
8617 for (i = 0; i < V_spdcachehash_mask + 1; ++i)
8618 SPDCACHE_LOCK_DESTROY(i);
8619
8620 free(V_spdcache_lock, M_IPSEC_SPDCACHE);
8621 }
8622 }
8623 #endif
8624
8625 static void
key_vnet_init(void * arg __unused)8626 key_vnet_init(void *arg __unused)
8627 {
8628 int i;
8629
8630 for (i = 0; i < IPSEC_DIR_MAX; i++) {
8631 TAILQ_INIT(&V_sptree[i]);
8632 TAILQ_INIT(&V_sptree_ifnet[i]);
8633 }
8634
8635 TAILQ_INIT(&V_sahtree);
8636 V_sphashtbl = hashinit(SPHASH_NHASH, M_IPSEC_SP, &V_sphash_mask);
8637 V_savhashtbl = hashinit(SAVHASH_NHASH, M_IPSEC_SA, &V_savhash_mask);
8638 V_sahaddrhashtbl = hashinit(SAHHASH_NHASH, M_IPSEC_SAH,
8639 &V_sahaddrhash_mask);
8640 V_acqaddrhashtbl = hashinit(ACQHASH_NHASH, M_IPSEC_SAQ,
8641 &V_acqaddrhash_mask);
8642 V_acqseqhashtbl = hashinit(ACQHASH_NHASH, M_IPSEC_SAQ,
8643 &V_acqseqhash_mask);
8644
8645 spdcache_init();
8646
8647 for (i = 0; i <= SADB_SATYPE_MAX; i++)
8648 LIST_INIT(&V_regtree[i]);
8649
8650 LIST_INIT(&V_acqtree);
8651 LIST_INIT(&V_spacqtree);
8652 }
8653 VNET_SYSINIT(key_vnet_init, SI_SUB_PROTO_DOMAIN, SI_ORDER_SECOND,
8654 key_vnet_init, NULL);
8655
8656 static void
key_init(void * arg __unused)8657 key_init(void *arg __unused)
8658 {
8659
8660 ipsec_key_lft_zone = uma_zcreate("IPsec SA lft_c",
8661 sizeof(uint64_t) * 2, NULL, NULL, NULL, NULL,
8662 UMA_ALIGN_PTR, UMA_ZONE_PCPU);
8663
8664 SPTREE_LOCK_INIT();
8665 REGTREE_LOCK_INIT();
8666 SAHTREE_LOCK_INIT();
8667 ACQ_LOCK_INIT();
8668 SPACQ_LOCK_INIT();
8669 SPI_ALLOC_LOCK_INIT();
8670
8671 #ifndef IPSEC_DEBUG2
8672 callout_init(&key_timer, 1);
8673 callout_reset(&key_timer, hz, key_timehandler, NULL);
8674 #endif /*IPSEC_DEBUG2*/
8675
8676 /* initialize key statistics */
8677 keystat.getspi_count = 1;
8678
8679 if (bootverbose)
8680 printf("IPsec: Initialized Security Association Processing.\n");
8681 }
8682 SYSINIT(key_init, SI_SUB_PROTO_DOMAIN, SI_ORDER_FIRST, key_init, NULL);
8683
8684 #ifdef VIMAGE
8685 static void
key_vnet_destroy(void * arg __unused)8686 key_vnet_destroy(void *arg __unused)
8687 {
8688 struct secashead_queue sahdrainq;
8689 struct secpolicy_queue drainq;
8690 struct secpolicy *sp, *nextsp;
8691 struct secacq *acq, *nextacq;
8692 struct secspacq *spacq, *nextspacq;
8693 struct secashead *sah;
8694 struct secasvar *sav;
8695 struct secreg *reg;
8696 int i;
8697
8698 /*
8699 * XXX: can we just call free() for each object without
8700 * walking through safe way with releasing references?
8701 */
8702 TAILQ_INIT(&drainq);
8703 SPTREE_WLOCK();
8704 for (i = 0; i < IPSEC_DIR_MAX; i++) {
8705 TAILQ_CONCAT(&drainq, &V_sptree[i], chain);
8706 TAILQ_CONCAT(&drainq, &V_sptree_ifnet[i], chain);
8707 }
8708 for (i = 0; i < V_sphash_mask + 1; i++)
8709 LIST_INIT(&V_sphashtbl[i]);
8710 SPTREE_WUNLOCK();
8711 spdcache_destroy();
8712
8713 sp = TAILQ_FIRST(&drainq);
8714 while (sp != NULL) {
8715 nextsp = TAILQ_NEXT(sp, chain);
8716 key_freesp(&sp);
8717 sp = nextsp;
8718 }
8719
8720 TAILQ_INIT(&sahdrainq);
8721 SAHTREE_WLOCK();
8722 TAILQ_CONCAT(&sahdrainq, &V_sahtree, chain);
8723 for (i = 0; i < V_savhash_mask + 1; i++)
8724 LIST_INIT(&V_savhashtbl[i]);
8725 for (i = 0; i < V_sahaddrhash_mask + 1; i++)
8726 LIST_INIT(&V_sahaddrhashtbl[i]);
8727 TAILQ_FOREACH(sah, &sahdrainq, chain) {
8728 sah->state = SADB_SASTATE_DEAD;
8729 TAILQ_FOREACH(sav, &sah->savtree_larval, chain) {
8730 sav->state = SADB_SASTATE_DEAD;
8731 ipsec_accel_forget_sav(sav);
8732 }
8733 TAILQ_FOREACH(sav, &sah->savtree_alive, chain) {
8734 sav->state = SADB_SASTATE_DEAD;
8735 ipsec_accel_forget_sav(sav);
8736 }
8737 }
8738 SAHTREE_WUNLOCK();
8739
8740 /* Wait for async work referencing this VNET to finish. */
8741 ipsec_accel_sync();
8742
8743 key_freesah_flushed(&sahdrainq);
8744 hashdestroy(V_sphashtbl, M_IPSEC_SP, V_sphash_mask);
8745 hashdestroy(V_savhashtbl, M_IPSEC_SA, V_savhash_mask);
8746 hashdestroy(V_sahaddrhashtbl, M_IPSEC_SAH, V_sahaddrhash_mask);
8747
8748 REGTREE_LOCK();
8749 for (i = 0; i <= SADB_SATYPE_MAX; i++) {
8750 LIST_FOREACH(reg, &V_regtree[i], chain) {
8751 if (__LIST_CHAINED(reg)) {
8752 LIST_REMOVE(reg, chain);
8753 free(reg, M_IPSEC_SAR);
8754 break;
8755 }
8756 }
8757 }
8758 REGTREE_UNLOCK();
8759
8760 ACQ_LOCK();
8761 acq = LIST_FIRST(&V_acqtree);
8762 while (acq != NULL) {
8763 nextacq = LIST_NEXT(acq, chain);
8764 LIST_REMOVE(acq, chain);
8765 free(acq, M_IPSEC_SAQ);
8766 acq = nextacq;
8767 }
8768 for (i = 0; i < V_acqaddrhash_mask + 1; i++)
8769 LIST_INIT(&V_acqaddrhashtbl[i]);
8770 for (i = 0; i < V_acqseqhash_mask + 1; i++)
8771 LIST_INIT(&V_acqseqhashtbl[i]);
8772 ACQ_UNLOCK();
8773
8774 SPACQ_LOCK();
8775 for (spacq = LIST_FIRST(&V_spacqtree); spacq != NULL;
8776 spacq = nextspacq) {
8777 nextspacq = LIST_NEXT(spacq, chain);
8778 if (__LIST_CHAINED(spacq)) {
8779 LIST_REMOVE(spacq, chain);
8780 free(spacq, M_IPSEC_SAQ);
8781 }
8782 }
8783 SPACQ_UNLOCK();
8784 hashdestroy(V_acqaddrhashtbl, M_IPSEC_SAQ, V_acqaddrhash_mask);
8785 hashdestroy(V_acqseqhashtbl, M_IPSEC_SAQ, V_acqseqhash_mask);
8786 }
8787 VNET_SYSUNINIT(key_vnet_destroy, SI_SUB_PROTO_DOMAIN, SI_ORDER_SECOND,
8788 key_vnet_destroy, NULL);
8789 #endif
8790
8791 /*
8792 * XXX: as long as domains are not unloadable, this function is never called,
8793 * provided for consistensy and future unload support.
8794 */
8795 static void
key_destroy(void * arg __unused)8796 key_destroy(void *arg __unused)
8797 {
8798 uma_zdestroy(ipsec_key_lft_zone);
8799
8800 #ifndef IPSEC_DEBUG2
8801 callout_drain(&key_timer);
8802 #endif
8803 SPTREE_LOCK_DESTROY();
8804 REGTREE_LOCK_DESTROY();
8805 SAHTREE_LOCK_DESTROY();
8806 ACQ_LOCK_DESTROY();
8807 SPACQ_LOCK_DESTROY();
8808 SPI_ALLOC_LOCK_DESTROY();
8809 }
8810 SYSUNINIT(key_destroy, SI_SUB_PROTO_DOMAIN, SI_ORDER_FIRST, key_destroy, NULL);
8811
8812 /* record data transfer on SA, and update timestamps */
8813 void
key_sa_recordxfer(struct secasvar * sav,struct mbuf * m)8814 key_sa_recordxfer(struct secasvar *sav, struct mbuf *m)
8815 {
8816 IPSEC_ASSERT(sav != NULL, ("Null secasvar"));
8817 IPSEC_ASSERT(m != NULL, ("Null mbuf"));
8818
8819 /*
8820 * XXX Currently, there is a difference of bytes size
8821 * between inbound and outbound processing.
8822 */
8823 counter_u64_add(sav->lft_c_bytes, m->m_pkthdr.len);
8824
8825 /*
8826 * We use the number of packets as the unit of
8827 * allocations. We increment the variable
8828 * whenever {esp,ah}_{in,out}put is called.
8829 */
8830 counter_u64_add(sav->lft_c_allocations, 1);
8831
8832 /*
8833 * NOTE: We record CURRENT usetime by using wall clock,
8834 * in seconds. HARD and SOFT lifetime are measured by the time
8835 * difference (again in seconds) from usetime.
8836 *
8837 * usetime
8838 * v expire expire
8839 * -----+-----+--------+---> t
8840 * <--------------> HARD
8841 * <-----> SOFT
8842 */
8843 if (sav->firstused == 0)
8844 sav->firstused = time_second;
8845 }
8846
8847 /*
8848 * Take one of the kernel's security keys and convert it into a PF_KEY
8849 * structure within an mbuf, suitable for sending up to a waiting
8850 * application in user land.
8851 *
8852 * IN:
8853 * src: A pointer to a kernel security key.
8854 * exttype: Which type of key this is. Refer to the PF_KEY data structures.
8855 * OUT:
8856 * a valid mbuf or NULL indicating an error
8857 *
8858 */
8859
8860 static struct mbuf *
key_setkey(struct seckey * src,uint16_t exttype)8861 key_setkey(struct seckey *src, uint16_t exttype)
8862 {
8863 struct mbuf *m;
8864 struct sadb_key *p;
8865 int len;
8866
8867 if (src == NULL)
8868 return NULL;
8869
8870 len = PFKEY_ALIGN8(sizeof(struct sadb_key) + _KEYLEN(src));
8871 m = m_get2(len, M_NOWAIT, MT_DATA, 0);
8872 if (m == NULL)
8873 return NULL;
8874 m_align(m, len);
8875 m->m_len = len;
8876 p = mtod(m, struct sadb_key *);
8877 bzero(p, len);
8878 p->sadb_key_len = PFKEY_UNIT64(len);
8879 p->sadb_key_exttype = exttype;
8880 p->sadb_key_bits = src->bits;
8881 bcopy(src->key_data, _KEYBUF(p), _KEYLEN(src));
8882
8883 return m;
8884 }
8885
8886 #ifdef IPSEC_OFFLOAD
8887 struct mbuf *
key_setaccelif(const char * ifname)8888 key_setaccelif(const char *ifname)
8889 {
8890 struct mbuf *m = NULL;
8891 struct sadb_x_if_hw_offl *p;
8892 int len = PFKEY_ALIGN8(sizeof(*p));
8893
8894 m = m_get2(len, M_NOWAIT, MT_DATA, 0);
8895 if (m == NULL)
8896 return (m);
8897 m_align(m, len);
8898 m->m_len = len;
8899 p = mtod(m, struct sadb_x_if_hw_offl *);
8900
8901 bzero(p, len);
8902 p->sadb_x_if_hw_offl_len = PFKEY_UNIT64(len);
8903 p->sadb_x_if_hw_offl_exttype = SADB_X_EXT_IF_HW_OFFL;
8904 p->sadb_x_if_hw_offl_flags = 0;
8905 strncpy(p->sadb_x_if_hw_offl_if, ifname,
8906 sizeof(p->sadb_x_if_hw_offl_if));
8907
8908 return (m);
8909 }
8910 #endif
8911
8912 /*
8913 * Take one of the kernel's lifetime data structures and convert it
8914 * into a PF_KEY structure within an mbuf, suitable for sending up to
8915 * a waiting application in user land.
8916 *
8917 * IN:
8918 * src: A pointer to a kernel lifetime structure.
8919 * exttype: Which type of lifetime this is. Refer to the PF_KEY
8920 * data structures for more information.
8921 * OUT:
8922 * a valid mbuf or NULL indicating an error
8923 *
8924 */
8925
8926 static struct mbuf *
key_setlifetime(struct seclifetime * src,uint16_t exttype)8927 key_setlifetime(struct seclifetime *src, uint16_t exttype)
8928 {
8929 struct mbuf *m = NULL;
8930 struct sadb_lifetime *p;
8931 int len = PFKEY_ALIGN8(sizeof(struct sadb_lifetime));
8932
8933 if (src == NULL)
8934 return NULL;
8935
8936 m = m_get2(len, M_NOWAIT, MT_DATA, 0);
8937 if (m == NULL)
8938 return m;
8939 m_align(m, len);
8940 m->m_len = len;
8941 p = mtod(m, struct sadb_lifetime *);
8942
8943 bzero(p, len);
8944 p->sadb_lifetime_len = PFKEY_UNIT64(len);
8945 p->sadb_lifetime_exttype = exttype;
8946 p->sadb_lifetime_allocations = src->allocations;
8947 p->sadb_lifetime_bytes = src->bytes;
8948 p->sadb_lifetime_addtime = src->addtime;
8949 p->sadb_lifetime_usetime = src->usetime;
8950
8951 return m;
8952
8953 }
8954
8955 const struct enc_xform *
enc_algorithm_lookup(int alg)8956 enc_algorithm_lookup(int alg)
8957 {
8958 int i;
8959
8960 for (i = 0; i < nitems(supported_ealgs); i++)
8961 if (alg == supported_ealgs[i].sadb_alg)
8962 return (supported_ealgs[i].xform);
8963 return (NULL);
8964 }
8965
8966 const struct auth_hash *
auth_algorithm_lookup(int alg)8967 auth_algorithm_lookup(int alg)
8968 {
8969 int i;
8970
8971 for (i = 0; i < nitems(supported_aalgs); i++)
8972 if (alg == supported_aalgs[i].sadb_alg)
8973 return (supported_aalgs[i].xform);
8974 return (NULL);
8975 }
8976
8977 const struct comp_algo *
comp_algorithm_lookup(int alg)8978 comp_algorithm_lookup(int alg)
8979 {
8980 int i;
8981
8982 for (i = 0; i < nitems(supported_calgs); i++)
8983 if (alg == supported_calgs[i].sadb_alg)
8984 return (supported_calgs[i].xform);
8985 return (NULL);
8986 }
8987
8988 void
ipsec_sahtree_runlock(struct rm_priotracker * sahtree_trackerp)8989 ipsec_sahtree_runlock(struct rm_priotracker *sahtree_trackerp)
8990 {
8991 rm_runlock(&sahtree_lock, sahtree_trackerp);
8992 }
8993
8994 void
ipsec_sahtree_rlock(struct rm_priotracker * sahtree_trackerp)8995 ipsec_sahtree_rlock(struct rm_priotracker *sahtree_trackerp)
8996 {
8997 rm_rlock(&sahtree_lock, sahtree_trackerp);
8998 }
8999
9000 #ifdef IPSEC_OFFLOAD
9001 void
ipsec_accel_on_ifdown(struct ifnet * ifp)9002 ipsec_accel_on_ifdown(struct ifnet *ifp)
9003 {
9004 void (*p)(struct ifnet *ifp);
9005
9006 p = atomic_load_ptr(&ipsec_accel_on_ifdown_p);
9007 if (p != NULL)
9008 p(ifp);
9009 }
9010
9011 void
ipsec_accel_drv_sa_lifetime_update(struct secasvar * sav,if_t ifp,u_int drv_spi,uint64_t octets,uint64_t allocs)9012 ipsec_accel_drv_sa_lifetime_update(struct secasvar *sav, if_t ifp,
9013 u_int drv_spi, uint64_t octets, uint64_t allocs)
9014 {
9015 void (*p)(struct secasvar *sav, if_t ifp, u_int drv_spi,
9016 uint64_t octets, uint64_t allocs);
9017
9018 p = atomic_load_ptr(&ipsec_accel_drv_sa_lifetime_update_p);
9019 if (p != NULL)
9020 p(sav, ifp, drv_spi, octets, allocs);
9021 }
9022
9023 int
ipsec_accel_drv_sa_lifetime_fetch(struct secasvar * sav,if_t ifp,u_int drv_spi,uint64_t * octets,uint64_t * allocs)9024 ipsec_accel_drv_sa_lifetime_fetch(struct secasvar *sav,
9025 if_t ifp, u_int drv_spi, uint64_t *octets, uint64_t *allocs)
9026 {
9027 int (*p)(struct secasvar *sav, if_t ifp, u_int drv_spi,
9028 uint64_t *octets, uint64_t *allocs);
9029
9030 p = atomic_load_ptr(&ipsec_accel_drv_sa_lifetime_fetch_p);
9031 if (p == NULL)
9032 return (EOPNOTSUPP);
9033 return (p(sav, ifp, drv_spi, octets, allocs));
9034 }
9035 #endif
9036