1 /* $KAME: key.c,v 1.191 2001/06/27 10:46:49 sakane Exp $ */ 2 3 /*- 4 * SPDX-License-Identifier: BSD-3-Clause 5 * 6 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. 7 * All rights reserved. 8 * 9 * Redistribution and use in source and binary forms, with or without 10 * modification, are permitted provided that the following conditions 11 * are met: 12 * 1. Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * 2. Redistributions in binary form must reproduce the above copyright 15 * notice, this list of conditions and the following disclaimer in the 16 * documentation and/or other materials provided with the distribution. 17 * 3. Neither the name of the project nor the names of its contributors 18 * may be used to endorse or promote products derived from this software 19 * without specific prior written permission. 20 * 21 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND 22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 24 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE 25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 31 * SUCH DAMAGE. 32 */ 33 34 /* 35 * This code is referd to RFC 2367 36 */ 37 38 #include "opt_inet.h" 39 #include "opt_inet6.h" 40 #include "opt_ipsec.h" 41 42 #include <sys/types.h> 43 #include <sys/param.h> 44 #include <sys/systm.h> 45 #include <sys/kernel.h> 46 #include <sys/fnv_hash.h> 47 #include <sys/lock.h> 48 #include <sys/mutex.h> 49 #include <sys/mbuf.h> 50 #include <sys/domain.h> 51 #include <sys/protosw.h> 52 #include <sys/malloc.h> 53 #include <sys/rmlock.h> 54 #include <sys/socket.h> 55 #include <sys/socketvar.h> 56 #include <sys/sysctl.h> 57 #include <sys/errno.h> 58 #include <sys/proc.h> 59 #include <sys/queue.h> 60 #include <sys/refcount.h> 61 #include <sys/syslog.h> 62 63 #include <vm/uma.h> 64 65 #include <net/if.h> 66 #include <net/if_var.h> 67 #include <net/vnet.h> 68 69 #include <netinet/in.h> 70 #include <netinet/in_systm.h> 71 #include <netinet/ip.h> 72 #include <netinet/in_var.h> 73 #include <netinet/udp.h> 74 75 #ifdef INET6 76 #include <netinet/ip6.h> 77 #include <netinet6/in6_var.h> 78 #include <netinet6/ip6_var.h> 79 #endif /* INET6 */ 80 81 #include <net/pfkeyv2.h> 82 #include <netipsec/keydb.h> 83 #include <netipsec/key.h> 84 #include <netipsec/keysock.h> 85 #include <netipsec/key_debug.h> 86 #include <netipsec/ipsec_offload.h> 87 88 #include <netipsec/ipsec.h> 89 #ifdef INET6 90 #include <netipsec/ipsec6.h> 91 #endif 92 93 #include <netipsec/xform.h> 94 #include <netipsec/ipsec_offload.h> 95 #include <machine/in_cksum.h> 96 #include <machine/stdarg.h> 97 98 /* randomness */ 99 #include <sys/random.h> 100 101 #ifdef IPSEC_OFFLOAD 102 void (*ipsec_accel_sa_newkey_p)(struct secasvar *sav); 103 void (*ipsec_accel_forget_sav_p)(struct secasvar *sav); 104 void (*ipsec_accel_spdadd_p)(struct secpolicy *sp, struct inpcb *inp); 105 void (*ipsec_accel_spddel_p)(struct secpolicy *sp); 106 int (*ipsec_accel_sa_lifetime_op_p)(struct secasvar *sav, 107 struct seclifetime *lft_c, if_t ifp, enum IF_SA_CNT_WHICH op, 108 struct rm_priotracker *sahtree_trackerp); 109 void (*ipsec_accel_sync_p)(void); 110 bool (*ipsec_accel_is_accel_sav_p)(struct secasvar *sav); 111 struct mbuf *(*ipsec_accel_key_setaccelif_p)(struct secasvar *sav); 112 #endif 113 114 #define FULLMASK 0xff 115 #define _BITS(bytes) ((bytes) << 3) 116 117 #define UINT32_80PCT 0xcccccccc 118 /* 119 * Note on SA reference counting: 120 * - SAs that are not in DEAD state will have (total external reference + 1) 121 * following value in reference count field. they cannot be freed and are 122 * referenced from SA header. 123 * - SAs that are in DEAD state will have (total external reference) 124 * in reference count field. they are ready to be freed. reference from 125 * SA header will be removed in key_delsav(), when the reference count 126 * field hits 0 (= no external reference other than from SA header. 127 */ 128 129 VNET_DEFINE(u_int32_t, key_debug_level) = 0; 130 VNET_DEFINE_STATIC(u_int, key_spi_trycnt) = 1000; 131 VNET_DEFINE_STATIC(u_int32_t, key_spi_minval) = 0x100; 132 VNET_DEFINE_STATIC(u_int32_t, key_spi_maxval) = 0x0fffffff; /* XXX */ 133 VNET_DEFINE_STATIC(u_int32_t, policy_id) = 0; 134 /*interval to initialize randseed,1(m)*/ 135 VNET_DEFINE_STATIC(u_int, key_int_random) = 60; 136 /* interval to expire acquiring, 30(s)*/ 137 VNET_DEFINE_STATIC(u_int, key_larval_lifetime) = 30; 138 /* counter for blocking SADB_ACQUIRE.*/ 139 VNET_DEFINE_STATIC(int, key_blockacq_count) = 10; 140 /* lifetime for blocking SADB_ACQUIRE.*/ 141 VNET_DEFINE_STATIC(int, key_blockacq_lifetime) = 20; 142 /* preferred old sa rather than new sa.*/ 143 VNET_DEFINE_STATIC(int, key_preferred_oldsa) = 1; 144 #define V_key_spi_trycnt VNET(key_spi_trycnt) 145 #define V_key_spi_minval VNET(key_spi_minval) 146 #define V_key_spi_maxval VNET(key_spi_maxval) 147 #define V_policy_id VNET(policy_id) 148 #define V_key_int_random VNET(key_int_random) 149 #define V_key_larval_lifetime VNET(key_larval_lifetime) 150 #define V_key_blockacq_count VNET(key_blockacq_count) 151 #define V_key_blockacq_lifetime VNET(key_blockacq_lifetime) 152 #define V_key_preferred_oldsa VNET(key_preferred_oldsa) 153 154 VNET_DEFINE_STATIC(u_int32_t, acq_seq) = 0; 155 #define V_acq_seq VNET(acq_seq) 156 157 VNET_DEFINE_STATIC(uint32_t, sp_genid) = 0; 158 #define V_sp_genid VNET(sp_genid) 159 160 /* SPD */ 161 TAILQ_HEAD(secpolicy_queue, secpolicy); 162 LIST_HEAD(secpolicy_list, secpolicy); 163 VNET_DEFINE_STATIC(struct secpolicy_queue, sptree[IPSEC_DIR_MAX]); 164 VNET_DEFINE_STATIC(struct secpolicy_queue, sptree_ifnet[IPSEC_DIR_MAX]); 165 static struct rmlock sptree_lock; 166 #define V_sptree VNET(sptree) 167 #define V_sptree_ifnet VNET(sptree_ifnet) 168 #define SPTREE_LOCK_INIT() rm_init(&sptree_lock, "sptree") 169 #define SPTREE_LOCK_DESTROY() rm_destroy(&sptree_lock) 170 #define SPTREE_RLOCK_TRACKER struct rm_priotracker sptree_tracker 171 #define SPTREE_RLOCK() rm_rlock(&sptree_lock, &sptree_tracker) 172 #define SPTREE_RUNLOCK() rm_runlock(&sptree_lock, &sptree_tracker) 173 #define SPTREE_RLOCK_ASSERT() rm_assert(&sptree_lock, RA_RLOCKED) 174 #define SPTREE_WLOCK() rm_wlock(&sptree_lock) 175 #define SPTREE_WUNLOCK() rm_wunlock(&sptree_lock) 176 #define SPTREE_WLOCK_ASSERT() rm_assert(&sptree_lock, RA_WLOCKED) 177 #define SPTREE_UNLOCK_ASSERT() rm_assert(&sptree_lock, RA_UNLOCKED) 178 179 /* Hash table for lookup SP using unique id */ 180 VNET_DEFINE_STATIC(struct secpolicy_list *, sphashtbl); 181 VNET_DEFINE_STATIC(u_long, sphash_mask); 182 #define V_sphashtbl VNET(sphashtbl) 183 #define V_sphash_mask VNET(sphash_mask) 184 185 #define SPHASH_NHASH_LOG2 7 186 #define SPHASH_NHASH (1 << SPHASH_NHASH_LOG2) 187 #define SPHASH_HASHVAL(id) (key_u32hash(id) & V_sphash_mask) 188 #define SPHASH_HASH(id) &V_sphashtbl[SPHASH_HASHVAL(id)] 189 190 /* SPD cache */ 191 struct spdcache_entry { 192 struct secpolicyindex spidx; /* secpolicyindex */ 193 struct secpolicy *sp; /* cached policy to be used */ 194 195 LIST_ENTRY(spdcache_entry) chain; 196 }; 197 LIST_HEAD(spdcache_entry_list, spdcache_entry); 198 199 #define SPDCACHE_MAX_ENTRIES_PER_HASH 8 200 201 VNET_DEFINE_STATIC(u_int, key_spdcache_maxentries) = 0; 202 #define V_key_spdcache_maxentries VNET(key_spdcache_maxentries) 203 VNET_DEFINE_STATIC(u_int, key_spdcache_threshold) = 32; 204 #define V_key_spdcache_threshold VNET(key_spdcache_threshold) 205 VNET_DEFINE_STATIC(unsigned long, spd_size) = 0; 206 #define V_spd_size VNET(spd_size) 207 208 #define SPDCACHE_ENABLED() (V_key_spdcache_maxentries != 0) 209 #define SPDCACHE_ACTIVE() \ 210 (SPDCACHE_ENABLED() && V_spd_size >= V_key_spdcache_threshold) 211 212 VNET_DEFINE_STATIC(struct spdcache_entry_list *, spdcachehashtbl); 213 VNET_DEFINE_STATIC(u_long, spdcachehash_mask); 214 #define V_spdcachehashtbl VNET(spdcachehashtbl) 215 #define V_spdcachehash_mask VNET(spdcachehash_mask) 216 217 #define SPDCACHE_HASHVAL(idx) \ 218 (key_addrprotohash(&(idx)->src, &(idx)->dst, &(idx)->ul_proto) & \ 219 V_spdcachehash_mask) 220 221 /* Each cache line is protected by a mutex */ 222 VNET_DEFINE_STATIC(struct mtx *, spdcache_lock); 223 #define V_spdcache_lock VNET(spdcache_lock) 224 225 #define SPDCACHE_LOCK_INIT(a) \ 226 mtx_init(&V_spdcache_lock[a], "spdcache", \ 227 "fast ipsec SPD cache", MTX_DEF|MTX_DUPOK) 228 #define SPDCACHE_LOCK_DESTROY(a) mtx_destroy(&V_spdcache_lock[a]) 229 #define SPDCACHE_LOCK(a) mtx_lock(&V_spdcache_lock[a]); 230 #define SPDCACHE_UNLOCK(a) mtx_unlock(&V_spdcache_lock[a]); 231 232 static struct sx spi_alloc_lock; 233 #define SPI_ALLOC_LOCK_INIT() sx_init(&spi_alloc_lock, "spialloc") 234 #define SPI_ALLOC_LOCK_DESTROY() sx_destroy(&spi_alloc_lock) 235 #define SPI_ALLOC_LOCK() sx_xlock(&spi_alloc_lock) 236 #define SPI_ALLOC_UNLOCK() sx_unlock(&spi_alloc_lock) 237 #define SPI_ALLOC_LOCK_ASSERT() sx_assert(&spi_alloc_lock, SA_XLOCKED) 238 239 /* SAD */ 240 TAILQ_HEAD(secashead_queue, secashead); 241 LIST_HEAD(secashead_list, secashead); 242 VNET_DEFINE_STATIC(struct secashead_queue, sahtree); 243 static struct rmlock sahtree_lock; 244 #define V_sahtree VNET(sahtree) 245 #define SAHTREE_LOCK_INIT() rm_init(&sahtree_lock, "sahtree") 246 #define SAHTREE_LOCK_DESTROY() rm_destroy(&sahtree_lock) 247 #define SAHTREE_RLOCK_TRACKER struct rm_priotracker sahtree_tracker 248 #define SAHTREE_RLOCK() rm_rlock(&sahtree_lock, &sahtree_tracker) 249 #define SAHTREE_RUNLOCK() rm_runlock(&sahtree_lock, &sahtree_tracker) 250 #define SAHTREE_RLOCK_ASSERT() rm_assert(&sahtree_lock, RA_RLOCKED) 251 #define SAHTREE_WLOCK() rm_wlock(&sahtree_lock) 252 #define SAHTREE_WUNLOCK() rm_wunlock(&sahtree_lock) 253 #define SAHTREE_WLOCK_ASSERT() rm_assert(&sahtree_lock, RA_WLOCKED) 254 #define SAHTREE_UNLOCK_ASSERT() rm_assert(&sahtree_lock, RA_UNLOCKED) 255 256 /* Hash table for lookup in SAD using SA addresses */ 257 VNET_DEFINE_STATIC(struct secashead_list *, sahaddrhashtbl); 258 VNET_DEFINE_STATIC(u_long, sahaddrhash_mask); 259 #define V_sahaddrhashtbl VNET(sahaddrhashtbl) 260 #define V_sahaddrhash_mask VNET(sahaddrhash_mask) 261 262 #define SAHHASH_NHASH_LOG2 7 263 #define SAHHASH_NHASH (1 << SAHHASH_NHASH_LOG2) 264 #define SAHADDRHASH_HASHVAL(idx) \ 265 (key_addrprotohash(&(idx)->src, &(idx)->dst, &(idx)->proto) & \ 266 V_sahaddrhash_mask) 267 #define SAHADDRHASH_HASH(saidx) \ 268 &V_sahaddrhashtbl[SAHADDRHASH_HASHVAL(saidx)] 269 270 /* Hash table for lookup in SAD using SPI */ 271 LIST_HEAD(secasvar_list, secasvar); 272 VNET_DEFINE_STATIC(struct secasvar_list *, savhashtbl); 273 VNET_DEFINE_STATIC(u_long, savhash_mask); 274 #define V_savhashtbl VNET(savhashtbl) 275 #define V_savhash_mask VNET(savhash_mask) 276 #define SAVHASH_NHASH_LOG2 7 277 #define SAVHASH_NHASH (1 << SAVHASH_NHASH_LOG2) 278 #define SAVHASH_HASHVAL(spi) (key_u32hash(spi) & V_savhash_mask) 279 #define SAVHASH_HASH(spi) &V_savhashtbl[SAVHASH_HASHVAL(spi)] 280 281 static uint32_t 282 key_addrprotohash(const union sockaddr_union *src, 283 const union sockaddr_union *dst, const uint8_t *proto) 284 { 285 uint32_t hval; 286 287 hval = fnv_32_buf(proto, sizeof(*proto), 288 FNV1_32_INIT); 289 switch (dst->sa.sa_family) { 290 #ifdef INET 291 case AF_INET: 292 hval = fnv_32_buf(&src->sin.sin_addr, 293 sizeof(in_addr_t), hval); 294 hval = fnv_32_buf(&dst->sin.sin_addr, 295 sizeof(in_addr_t), hval); 296 break; 297 #endif 298 #ifdef INET6 299 case AF_INET6: 300 hval = fnv_32_buf(&src->sin6.sin6_addr, 301 sizeof(struct in6_addr), hval); 302 hval = fnv_32_buf(&dst->sin6.sin6_addr, 303 sizeof(struct in6_addr), hval); 304 break; 305 #endif 306 default: 307 hval = 0; 308 ipseclog((LOG_DEBUG, "%s: unknown address family %d\n", 309 __func__, dst->sa.sa_family)); 310 } 311 return (hval); 312 } 313 314 static uint32_t 315 key_u32hash(uint32_t val) 316 { 317 318 return (fnv_32_buf(&val, sizeof(val), FNV1_32_INIT)); 319 } 320 321 /* registed list */ 322 VNET_DEFINE_STATIC(LIST_HEAD(_regtree, secreg), regtree[SADB_SATYPE_MAX + 1]); 323 #define V_regtree VNET(regtree) 324 static struct mtx regtree_lock; 325 #define REGTREE_LOCK_INIT() \ 326 mtx_init(®tree_lock, "regtree", "fast ipsec regtree", MTX_DEF) 327 #define REGTREE_LOCK_DESTROY() mtx_destroy(®tree_lock) 328 #define REGTREE_LOCK() mtx_lock(®tree_lock) 329 #define REGTREE_UNLOCK() mtx_unlock(®tree_lock) 330 #define REGTREE_LOCK_ASSERT() mtx_assert(®tree_lock, MA_OWNED) 331 332 /* Acquiring list */ 333 LIST_HEAD(secacq_list, secacq); 334 VNET_DEFINE_STATIC(struct secacq_list, acqtree); 335 #define V_acqtree VNET(acqtree) 336 static struct mtx acq_lock; 337 #define ACQ_LOCK_INIT() \ 338 mtx_init(&acq_lock, "acqtree", "ipsec SA acquiring list", MTX_DEF) 339 #define ACQ_LOCK_DESTROY() mtx_destroy(&acq_lock) 340 #define ACQ_LOCK() mtx_lock(&acq_lock) 341 #define ACQ_UNLOCK() mtx_unlock(&acq_lock) 342 #define ACQ_LOCK_ASSERT() mtx_assert(&acq_lock, MA_OWNED) 343 344 /* Hash table for lookup in ACQ list using SA addresses */ 345 VNET_DEFINE_STATIC(struct secacq_list *, acqaddrhashtbl); 346 VNET_DEFINE_STATIC(u_long, acqaddrhash_mask); 347 #define V_acqaddrhashtbl VNET(acqaddrhashtbl) 348 #define V_acqaddrhash_mask VNET(acqaddrhash_mask) 349 350 /* Hash table for lookup in ACQ list using SEQ number */ 351 VNET_DEFINE_STATIC(struct secacq_list *, acqseqhashtbl); 352 VNET_DEFINE_STATIC(u_long, acqseqhash_mask); 353 #define V_acqseqhashtbl VNET(acqseqhashtbl) 354 #define V_acqseqhash_mask VNET(acqseqhash_mask) 355 356 #define ACQHASH_NHASH_LOG2 7 357 #define ACQHASH_NHASH (1 << ACQHASH_NHASH_LOG2) 358 #define ACQADDRHASH_HASHVAL(idx) \ 359 (key_addrprotohash(&(idx)->src, &(idx)->dst, &(idx)->proto) & \ 360 V_acqaddrhash_mask) 361 #define ACQSEQHASH_HASHVAL(seq) \ 362 (key_u32hash(seq) & V_acqseqhash_mask) 363 #define ACQADDRHASH_HASH(saidx) \ 364 &V_acqaddrhashtbl[ACQADDRHASH_HASHVAL(saidx)] 365 #define ACQSEQHASH_HASH(seq) \ 366 &V_acqseqhashtbl[ACQSEQHASH_HASHVAL(seq)] 367 /* SP acquiring list */ 368 VNET_DEFINE_STATIC(LIST_HEAD(_spacqtree, secspacq), spacqtree); 369 #define V_spacqtree VNET(spacqtree) 370 static struct mtx spacq_lock; 371 #define SPACQ_LOCK_INIT() \ 372 mtx_init(&spacq_lock, "spacqtree", \ 373 "fast ipsec security policy acquire list", MTX_DEF) 374 #define SPACQ_LOCK_DESTROY() mtx_destroy(&spacq_lock) 375 #define SPACQ_LOCK() mtx_lock(&spacq_lock) 376 #define SPACQ_UNLOCK() mtx_unlock(&spacq_lock) 377 #define SPACQ_LOCK_ASSERT() mtx_assert(&spacq_lock, MA_OWNED) 378 379 static const int minsize[] = { 380 [SADB_EXT_RESERVED] = sizeof(struct sadb_msg), 381 [SADB_EXT_SA] = sizeof(struct sadb_sa), 382 [SADB_EXT_LIFETIME_CURRENT] = sizeof(struct sadb_lifetime), 383 [SADB_EXT_LIFETIME_HARD] = sizeof(struct sadb_lifetime), 384 [SADB_EXT_LIFETIME_SOFT] = sizeof(struct sadb_lifetime), 385 [SADB_EXT_ADDRESS_SRC] = sizeof(struct sadb_address), 386 [SADB_EXT_ADDRESS_DST] = sizeof(struct sadb_address), 387 [SADB_EXT_ADDRESS_PROXY] = sizeof(struct sadb_address), 388 [SADB_EXT_KEY_AUTH] = sizeof(struct sadb_key), 389 [SADB_EXT_KEY_ENCRYPT] = sizeof(struct sadb_key), 390 [SADB_EXT_IDENTITY_SRC] = sizeof(struct sadb_ident), 391 [SADB_EXT_IDENTITY_DST] = sizeof(struct sadb_ident), 392 [SADB_EXT_SENSITIVITY] = sizeof(struct sadb_sens), 393 [SADB_EXT_PROPOSAL] = sizeof(struct sadb_prop), 394 [SADB_EXT_SUPPORTED_AUTH] = sizeof(struct sadb_supported), 395 [SADB_EXT_SUPPORTED_ENCRYPT] = sizeof(struct sadb_supported), 396 [SADB_EXT_SPIRANGE] = sizeof(struct sadb_spirange), 397 [SADB_X_EXT_KMPRIVATE] = 0, 398 [SADB_X_EXT_POLICY] = sizeof(struct sadb_x_policy), 399 [SADB_X_EXT_SA2] = sizeof(struct sadb_x_sa2), 400 [SADB_X_EXT_NAT_T_TYPE] = sizeof(struct sadb_x_nat_t_type), 401 [SADB_X_EXT_NAT_T_SPORT] = sizeof(struct sadb_x_nat_t_port), 402 [SADB_X_EXT_NAT_T_DPORT] = sizeof(struct sadb_x_nat_t_port), 403 [SADB_X_EXT_NAT_T_OAI] = sizeof(struct sadb_address), 404 [SADB_X_EXT_NAT_T_OAR] = sizeof(struct sadb_address), 405 [SADB_X_EXT_NAT_T_FRAG] = sizeof(struct sadb_x_nat_t_frag), 406 [SADB_X_EXT_SA_REPLAY] = sizeof(struct sadb_x_sa_replay), 407 [SADB_X_EXT_NEW_ADDRESS_SRC] = sizeof(struct sadb_address), 408 [SADB_X_EXT_NEW_ADDRESS_DST] = sizeof(struct sadb_address), 409 [SADB_X_EXT_LFT_CUR_SW_OFFL] = sizeof(struct sadb_lifetime), 410 [SADB_X_EXT_LFT_CUR_HW_OFFL] = sizeof(struct sadb_lifetime), 411 [SADB_X_EXT_IF_HW_OFFL] = sizeof(struct sadb_x_if_hw_offl), 412 }; 413 _Static_assert(nitems(minsize) == SADB_EXT_MAX + 1, "minsize size mismatch"); 414 415 static const int maxsize[] = { 416 [SADB_EXT_RESERVED] = sizeof(struct sadb_msg), 417 [SADB_EXT_SA] = sizeof(struct sadb_sa), 418 [SADB_EXT_LIFETIME_CURRENT] = sizeof(struct sadb_lifetime), 419 [SADB_EXT_LIFETIME_HARD] = sizeof(struct sadb_lifetime), 420 [SADB_EXT_LIFETIME_SOFT] = sizeof(struct sadb_lifetime), 421 [SADB_EXT_ADDRESS_SRC] = 0, 422 [SADB_EXT_ADDRESS_DST] = 0, 423 [SADB_EXT_ADDRESS_PROXY] = 0, 424 [SADB_EXT_KEY_AUTH] = 0, 425 [SADB_EXT_KEY_ENCRYPT] = 0, 426 [SADB_EXT_IDENTITY_SRC] = 0, 427 [SADB_EXT_IDENTITY_DST] = 0, 428 [SADB_EXT_SENSITIVITY] = 0, 429 [SADB_EXT_PROPOSAL] = 0, 430 [SADB_EXT_SUPPORTED_AUTH] = 0, 431 [SADB_EXT_SUPPORTED_ENCRYPT] = 0, 432 [SADB_EXT_SPIRANGE] = sizeof(struct sadb_spirange), 433 [SADB_X_EXT_KMPRIVATE] = 0, 434 [SADB_X_EXT_POLICY] = 0, 435 [SADB_X_EXT_SA2] = sizeof(struct sadb_x_sa2), 436 [SADB_X_EXT_NAT_T_TYPE] = sizeof(struct sadb_x_nat_t_type), 437 [SADB_X_EXT_NAT_T_SPORT] = sizeof(struct sadb_x_nat_t_port), 438 [SADB_X_EXT_NAT_T_DPORT] = sizeof(struct sadb_x_nat_t_port), 439 [SADB_X_EXT_NAT_T_OAI] = 0, 440 [SADB_X_EXT_NAT_T_OAR] = 0, 441 [SADB_X_EXT_NAT_T_FRAG] = sizeof(struct sadb_x_nat_t_frag), 442 [SADB_X_EXT_SA_REPLAY] = sizeof(struct sadb_x_sa_replay), 443 [SADB_X_EXT_NEW_ADDRESS_SRC] = 0, 444 [SADB_X_EXT_NEW_ADDRESS_DST] = 0, 445 [SADB_X_EXT_LFT_CUR_SW_OFFL] = sizeof(struct sadb_lifetime), 446 [SADB_X_EXT_LFT_CUR_HW_OFFL] = sizeof(struct sadb_lifetime), 447 [SADB_X_EXT_IF_HW_OFFL] = sizeof(struct sadb_x_if_hw_offl), 448 }; 449 _Static_assert(nitems(maxsize) == SADB_EXT_MAX + 1, "maxsize size mismatch"); 450 451 /* 452 * Internal values for SA flags: 453 * SADB_X_EXT_F_CLONED means that SA was cloned by key_updateaddresses, 454 * thus we will not free the most of SA content in key_delsav(). 455 */ 456 #define SADB_X_EXT_F_CLONED 0x80000000 457 458 #define SADB_CHECKLEN(_mhp, _ext) \ 459 ((_mhp)->extlen[(_ext)] < minsize[(_ext)] || (maxsize[(_ext)] != 0 && \ 460 ((_mhp)->extlen[(_ext)] > maxsize[(_ext)]))) 461 #define SADB_CHECKHDR(_mhp, _ext) ((_mhp)->ext[(_ext)] == NULL) 462 463 VNET_DEFINE_STATIC(int, ipsec_esp_keymin) = 256; 464 VNET_DEFINE_STATIC(int, ipsec_esp_auth) = 0; 465 VNET_DEFINE_STATIC(int, ipsec_ah_keymin) = 128; 466 467 #define V_ipsec_esp_keymin VNET(ipsec_esp_keymin) 468 #define V_ipsec_esp_auth VNET(ipsec_esp_auth) 469 #define V_ipsec_ah_keymin VNET(ipsec_ah_keymin) 470 471 #ifdef IPSEC_DEBUG 472 VNET_DEFINE(int, ipsec_debug) = 1; 473 #else 474 VNET_DEFINE(int, ipsec_debug) = 0; 475 #endif 476 477 #ifdef INET 478 SYSCTL_DECL(_net_inet_ipsec); 479 SYSCTL_INT(_net_inet_ipsec, IPSECCTL_DEBUG, debug, 480 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ipsec_debug), 0, 481 "Enable IPsec debugging output when set."); 482 #endif 483 #ifdef INET6 484 SYSCTL_DECL(_net_inet6_ipsec6); 485 SYSCTL_INT(_net_inet6_ipsec6, IPSECCTL_DEBUG, debug, 486 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ipsec_debug), 0, 487 "Enable IPsec debugging output when set."); 488 #endif 489 490 SYSCTL_INT(_net_key, KEYCTL_DEBUG_LEVEL, debug, 491 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(key_debug_level), 0, ""); 492 493 /* max count of trial for the decision of spi value */ 494 SYSCTL_INT(_net_key, KEYCTL_SPI_TRY, spi_trycnt, 495 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(key_spi_trycnt), 0, ""); 496 497 /* minimum spi value to allocate automatically. */ 498 SYSCTL_INT(_net_key, KEYCTL_SPI_MIN_VALUE, spi_minval, 499 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(key_spi_minval), 0, ""); 500 501 /* maximun spi value to allocate automatically. */ 502 SYSCTL_INT(_net_key, KEYCTL_SPI_MAX_VALUE, spi_maxval, 503 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(key_spi_maxval), 0, ""); 504 505 /* interval to initialize randseed */ 506 SYSCTL_INT(_net_key, KEYCTL_RANDOM_INT, int_random, 507 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(key_int_random), 0, ""); 508 509 /* lifetime for larval SA */ 510 SYSCTL_INT(_net_key, KEYCTL_LARVAL_LIFETIME, larval_lifetime, 511 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(key_larval_lifetime), 0, ""); 512 513 /* counter for blocking to send SADB_ACQUIRE to IKEd */ 514 SYSCTL_INT(_net_key, KEYCTL_BLOCKACQ_COUNT, blockacq_count, 515 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(key_blockacq_count), 0, ""); 516 517 /* lifetime for blocking to send SADB_ACQUIRE to IKEd */ 518 SYSCTL_INT(_net_key, KEYCTL_BLOCKACQ_LIFETIME, blockacq_lifetime, 519 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(key_blockacq_lifetime), 0, ""); 520 521 /* ESP auth */ 522 SYSCTL_INT(_net_key, KEYCTL_ESP_AUTH, esp_auth, 523 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ipsec_esp_auth), 0, ""); 524 525 /* minimum ESP key length */ 526 SYSCTL_INT(_net_key, KEYCTL_ESP_KEYMIN, esp_keymin, 527 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ipsec_esp_keymin), 0, ""); 528 529 /* minimum AH key length */ 530 SYSCTL_INT(_net_key, KEYCTL_AH_KEYMIN, ah_keymin, 531 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ipsec_ah_keymin), 0, ""); 532 533 /* perfered old SA rather than new SA */ 534 SYSCTL_INT(_net_key, KEYCTL_PREFERED_OLDSA, preferred_oldsa, 535 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(key_preferred_oldsa), 0, ""); 536 537 SYSCTL_NODE(_net_key, OID_AUTO, spdcache, CTLFLAG_RW | CTLFLAG_MPSAFE, 0, 538 "SPD cache"); 539 540 SYSCTL_UINT(_net_key_spdcache, OID_AUTO, maxentries, 541 CTLFLAG_VNET | CTLFLAG_RDTUN, &VNET_NAME(key_spdcache_maxentries), 0, 542 "Maximum number of entries in the SPD cache" 543 " (power of 2, 0 to disable)"); 544 545 SYSCTL_UINT(_net_key_spdcache, OID_AUTO, threshold, 546 CTLFLAG_VNET | CTLFLAG_RDTUN, &VNET_NAME(key_spdcache_threshold), 0, 547 "Number of SPs that make the SPD cache active"); 548 549 #define __LIST_CHAINED(elm) \ 550 (!((elm)->chain.le_next == NULL && (elm)->chain.le_prev == NULL)) 551 552 MALLOC_DEFINE(M_IPSEC_SA, "secasvar", "ipsec security association"); 553 MALLOC_DEFINE(M_IPSEC_SAH, "sahead", "ipsec sa head"); 554 MALLOC_DEFINE(M_IPSEC_SP, "ipsecpolicy", "ipsec security policy"); 555 MALLOC_DEFINE(M_IPSEC_SR, "ipsecrequest", "ipsec security request"); 556 MALLOC_DEFINE(M_IPSEC_MISC, "ipsec-misc", "ipsec miscellaneous"); 557 MALLOC_DEFINE(M_IPSEC_SAQ, "ipsec-saq", "ipsec sa acquire"); 558 MALLOC_DEFINE(M_IPSEC_SAR, "ipsec-reg", "ipsec sa acquire"); 559 MALLOC_DEFINE(M_IPSEC_SPDCACHE, "ipsec-spdcache", "ipsec SPD cache"); 560 561 static uma_zone_t __read_mostly ipsec_key_lft_zone; 562 563 /* 564 * set parameters into secpolicyindex buffer. 565 * Must allocate secpolicyindex buffer passed to this function. 566 */ 567 #define KEY_SETSECSPIDX(_dir, s, d, ps, pd, ulp, idx) \ 568 do { \ 569 bzero((idx), sizeof(struct secpolicyindex)); \ 570 (idx)->dir = (_dir); \ 571 (idx)->prefs = (ps); \ 572 (idx)->prefd = (pd); \ 573 (idx)->ul_proto = (ulp); \ 574 bcopy((s), &(idx)->src, ((const struct sockaddr *)(s))->sa_len); \ 575 bcopy((d), &(idx)->dst, ((const struct sockaddr *)(d))->sa_len); \ 576 } while (0) 577 578 /* 579 * set parameters into secasindex buffer. 580 * Must allocate secasindex buffer before calling this function. 581 */ 582 #define KEY_SETSECASIDX(p, m, r, s, d, idx) \ 583 do { \ 584 bzero((idx), sizeof(struct secasindex)); \ 585 (idx)->proto = (p); \ 586 (idx)->mode = (m); \ 587 (idx)->reqid = (r); \ 588 bcopy((s), &(idx)->src, ((const struct sockaddr *)(s))->sa_len); \ 589 bcopy((d), &(idx)->dst, ((const struct sockaddr *)(d))->sa_len); \ 590 key_porttosaddr(&(idx)->src.sa, 0); \ 591 key_porttosaddr(&(idx)->dst.sa, 0); \ 592 } while (0) 593 594 /* key statistics */ 595 struct _keystat { 596 u_long getspi_count; /* the avarage of count to try to get new SPI */ 597 } keystat; 598 599 struct sadb_msghdr { 600 struct sadb_msg *msg; 601 struct sadb_ext *ext[SADB_EXT_MAX + 1]; 602 int extoff[SADB_EXT_MAX + 1]; 603 int extlen[SADB_EXT_MAX + 1]; 604 }; 605 606 static const struct supported_ealgs { 607 int sadb_alg; 608 const struct enc_xform *xform; 609 } supported_ealgs[] = { 610 { SADB_X_EALG_AES, &enc_xform_aes_cbc }, 611 { SADB_EALG_NULL, &enc_xform_null }, 612 { SADB_X_EALG_AESCTR, &enc_xform_aes_icm }, 613 { SADB_X_EALG_AESGCM16, &enc_xform_aes_nist_gcm }, 614 { SADB_X_EALG_AESGMAC, &enc_xform_aes_nist_gmac }, 615 { SADB_X_EALG_CHACHA20POLY1305, &enc_xform_chacha20_poly1305 }, 616 }; 617 618 static const struct supported_aalgs { 619 int sadb_alg; 620 const struct auth_hash *xform; 621 } supported_aalgs[] = { 622 { SADB_X_AALG_NULL, &auth_hash_null }, 623 { SADB_AALG_SHA1HMAC, &auth_hash_hmac_sha1 }, 624 { SADB_X_AALG_SHA2_256, &auth_hash_hmac_sha2_256 }, 625 { SADB_X_AALG_SHA2_384, &auth_hash_hmac_sha2_384 }, 626 { SADB_X_AALG_SHA2_512, &auth_hash_hmac_sha2_512 }, 627 { SADB_X_AALG_AES128GMAC, &auth_hash_nist_gmac_aes_128 }, 628 { SADB_X_AALG_AES192GMAC, &auth_hash_nist_gmac_aes_192 }, 629 { SADB_X_AALG_AES256GMAC, &auth_hash_nist_gmac_aes_256 }, 630 { SADB_X_AALG_CHACHA20POLY1305, &auth_hash_poly1305 }, 631 }; 632 633 static const struct supported_calgs { 634 int sadb_alg; 635 const struct comp_algo *xform; 636 } supported_calgs[] = { 637 { SADB_X_CALG_DEFLATE, &comp_algo_deflate }, 638 }; 639 640 #ifndef IPSEC_DEBUG2 641 static struct callout key_timer; 642 #endif 643 644 static void key_unlink(struct secpolicy *); 645 static void key_detach(struct secpolicy *); 646 static struct secpolicy *key_getsp(struct secpolicyindex *); 647 static struct secpolicy *key_getspbyid(u_int32_t); 648 static struct mbuf *key_gather_mbuf(struct mbuf *, 649 const struct sadb_msghdr *, int, int, ...); 650 static int key_spdadd(struct socket *, struct mbuf *, 651 const struct sadb_msghdr *); 652 static uint32_t key_getnewspid(void); 653 static int key_spddelete(struct socket *, struct mbuf *, 654 const struct sadb_msghdr *); 655 static int key_spddelete2(struct socket *, struct mbuf *, 656 const struct sadb_msghdr *); 657 static int key_spdget(struct socket *, struct mbuf *, 658 const struct sadb_msghdr *); 659 static int key_spdflush(struct socket *, struct mbuf *, 660 const struct sadb_msghdr *); 661 static int key_spddump(struct socket *, struct mbuf *, 662 const struct sadb_msghdr *); 663 static struct mbuf *key_setdumpsp(struct secpolicy *, 664 u_int8_t, u_int32_t, u_int32_t); 665 static struct mbuf *key_sp2mbuf(struct secpolicy *); 666 static size_t key_getspreqmsglen(struct secpolicy *); 667 static int key_spdexpire(struct secpolicy *); 668 static struct secashead *key_newsah(struct secasindex *); 669 static void key_freesah(struct secashead **); 670 static void key_delsah(struct secashead *); 671 static struct secasvar *key_newsav(const struct sadb_msghdr *, 672 struct secasindex *, uint32_t, int *); 673 static void key_delsav(struct secasvar *); 674 static void key_unlinksav(struct secasvar *); 675 static struct secashead *key_getsah(struct secasindex *); 676 static int key_checkspidup(uint32_t); 677 static struct secasvar *key_getsavbyspi(uint32_t); 678 static int key_setnatt(struct secasvar *, const struct sadb_msghdr *); 679 static int key_setsaval(struct secasvar *, const struct sadb_msghdr *); 680 static int key_updatelifetimes(struct secasvar *, const struct sadb_msghdr *); 681 static int key_updateaddresses(struct socket *, struct mbuf *, 682 const struct sadb_msghdr *, struct secasvar *, struct secasindex *); 683 684 static struct mbuf *key_setdumpsa(struct secasvar *, u_int8_t, 685 u_int8_t, u_int32_t, u_int32_t, struct rm_priotracker *); 686 static struct mbuf *key_setsadbmsg(u_int8_t, u_int16_t, u_int8_t, 687 u_int32_t, pid_t, u_int16_t); 688 static struct mbuf *key_setsadbsa(struct secasvar *); 689 static struct mbuf *key_setsadbaddr(u_int16_t, 690 const struct sockaddr *, u_int8_t, u_int16_t); 691 static struct mbuf *key_setsadbxport(u_int16_t, u_int16_t); 692 static struct mbuf *key_setsadbxtype(u_int16_t); 693 static struct mbuf *key_setsadbxsa2(u_int8_t, u_int32_t, u_int32_t); 694 static struct mbuf *key_setsadbxsareplay(u_int32_t); 695 static struct mbuf *key_setsadbxpolicy(u_int16_t, u_int8_t, 696 u_int32_t, u_int32_t); 697 static struct seckey *key_dup_keymsg(const struct sadb_key *, size_t, 698 struct malloc_type *); 699 static struct seclifetime *key_dup_lifemsg(const struct sadb_lifetime *src, 700 struct malloc_type *); 701 702 /* flags for key_cmpsaidx() */ 703 #define CMP_HEAD 1 /* protocol, addresses. */ 704 #define CMP_MODE_REQID 2 /* additionally HEAD, reqid, mode. */ 705 #define CMP_REQID 3 /* additionally HEAD, reaid. */ 706 #define CMP_EXACTLY 4 /* all elements. */ 707 static int key_cmpsaidx(const struct secasindex *, 708 const struct secasindex *, int); 709 static int key_cmpspidx_exactly(struct secpolicyindex *, 710 struct secpolicyindex *); 711 static int key_cmpspidx_withmask(struct secpolicyindex *, 712 struct secpolicyindex *); 713 static int key_bbcmp(const void *, const void *, u_int); 714 static uint8_t key_satype2proto(uint8_t); 715 static uint8_t key_proto2satype(uint8_t); 716 717 static int key_getspi(struct socket *, struct mbuf *, 718 const struct sadb_msghdr *); 719 static uint32_t key_do_getnewspi(struct sadb_spirange *, struct secasindex *); 720 static int key_update(struct socket *, struct mbuf *, 721 const struct sadb_msghdr *); 722 static int key_add(struct socket *, struct mbuf *, 723 const struct sadb_msghdr *); 724 static int key_setident(struct secashead *, const struct sadb_msghdr *); 725 static struct mbuf *key_getmsgbuf_x1(struct mbuf *, 726 const struct sadb_msghdr *); 727 static int key_delete(struct socket *, struct mbuf *, 728 const struct sadb_msghdr *); 729 static int key_delete_all(struct socket *, struct mbuf *, 730 const struct sadb_msghdr *, struct secasindex *); 731 static int key_get(struct socket *, struct mbuf *, 732 const struct sadb_msghdr *); 733 734 static void key_getcomb_setlifetime(struct sadb_comb *); 735 static struct mbuf *key_getcomb_ealg(void); 736 static struct mbuf *key_getcomb_ah(void); 737 static struct mbuf *key_getcomb_ipcomp(void); 738 static struct mbuf *key_getprop(const struct secasindex *); 739 740 static int key_acquire(const struct secasindex *, struct secpolicy *); 741 static uint32_t key_newacq(const struct secasindex *, int *); 742 static uint32_t key_getacq(const struct secasindex *, int *); 743 static int key_acqdone(const struct secasindex *, uint32_t); 744 static int key_acqreset(uint32_t); 745 static struct secspacq *key_newspacq(struct secpolicyindex *); 746 static struct secspacq *key_getspacq(struct secpolicyindex *); 747 static int key_acquire2(struct socket *, struct mbuf *, 748 const struct sadb_msghdr *); 749 static int key_register(struct socket *, struct mbuf *, 750 const struct sadb_msghdr *); 751 static int key_expire(struct secasvar *, int); 752 static int key_flush(struct socket *, struct mbuf *, 753 const struct sadb_msghdr *); 754 static int key_dump(struct socket *, struct mbuf *, 755 const struct sadb_msghdr *); 756 static int key_promisc(struct socket *, struct mbuf *, 757 const struct sadb_msghdr *); 758 static int key_senderror(struct socket *, struct mbuf *, int); 759 static int key_validate_ext(const struct sadb_ext *, int); 760 static int key_align(struct mbuf *, struct sadb_msghdr *); 761 static struct mbuf *key_setlifetime(struct seclifetime *, uint16_t); 762 static struct mbuf *key_setkey(struct seckey *, uint16_t); 763 764 static void spdcache_init(void); 765 static void spdcache_clear(void); 766 static struct spdcache_entry *spdcache_entry_alloc( 767 const struct secpolicyindex *spidx, 768 struct secpolicy *policy); 769 static void spdcache_entry_free(struct spdcache_entry *entry); 770 #ifdef VIMAGE 771 static void spdcache_destroy(void); 772 #endif 773 774 #define DBG_IPSEC_INITREF(t, p) do { \ 775 refcount_init(&(p)->refcnt, 1); \ 776 KEYDBG(KEY_STAMP, \ 777 printf("%s: Initialize refcnt %s(%p) = %u\n", \ 778 __func__, #t, (p), (p)->refcnt)); \ 779 } while (0) 780 #define DBG_IPSEC_ADDREF(t, p) do { \ 781 refcount_acquire(&(p)->refcnt); \ 782 KEYDBG(KEY_STAMP, \ 783 printf("%s: Acquire refcnt %s(%p) -> %u\n", \ 784 __func__, #t, (p), (p)->refcnt)); \ 785 } while (0) 786 #define DBG_IPSEC_DELREF(t, p) do { \ 787 KEYDBG(KEY_STAMP, \ 788 printf("%s: Release refcnt %s(%p) -> %u\n", \ 789 __func__, #t, (p), (p)->refcnt - 1)); \ 790 refcount_release(&(p)->refcnt); \ 791 } while (0) 792 793 #define IPSEC_INITREF(t, p) refcount_init(&(p)->refcnt, 1) 794 #define IPSEC_ADDREF(t, p) refcount_acquire(&(p)->refcnt) 795 #define IPSEC_DELREF(t, p) refcount_release(&(p)->refcnt) 796 797 #define SP_INITREF(p) IPSEC_INITREF(SP, p) 798 #define SP_ADDREF(p) IPSEC_ADDREF(SP, p) 799 #define SP_DELREF(p) IPSEC_DELREF(SP, p) 800 801 #define SAH_INITREF(p) IPSEC_INITREF(SAH, p) 802 #define SAH_ADDREF(p) IPSEC_ADDREF(SAH, p) 803 #define SAH_DELREF(p) IPSEC_DELREF(SAH, p) 804 805 #define SAV_INITREF(p) IPSEC_INITREF(SAV, p) 806 #define SAV_ADDREF(p) IPSEC_ADDREF(SAV, p) 807 #define SAV_DELREF(p) IPSEC_DELREF(SAV, p) 808 809 /* 810 * Update the refcnt while holding the SPTREE lock. 811 */ 812 void 813 key_addref(struct secpolicy *sp) 814 { 815 816 SP_ADDREF(sp); 817 } 818 819 /* 820 * Return 0 when there are known to be no SP's for the specified 821 * direction. Otherwise return 1. This is used by IPsec code 822 * to optimize performance. 823 */ 824 int 825 key_havesp(u_int dir) 826 { 827 828 IPSEC_ASSERT(dir == IPSEC_DIR_INBOUND || dir == IPSEC_DIR_OUTBOUND, 829 ("invalid direction %u", dir)); 830 return (TAILQ_FIRST(&V_sptree[dir]) != NULL); 831 } 832 833 int 834 key_havesp_any(void) 835 { 836 837 return (V_spd_size != 0); 838 } 839 840 /* 841 * Allocate a single mbuf with a buffer of the desired length. The buffer is 842 * pre-zeroed to help ensure that uninitialized pad bytes are not leaked. 843 */ 844 static struct mbuf * 845 key_mget(u_int len) 846 { 847 struct mbuf *m; 848 849 KASSERT(len <= MCLBYTES, 850 ("%s: invalid buffer length %u", __func__, len)); 851 852 m = m_get2(len, M_NOWAIT, MT_DATA, M_PKTHDR); 853 if (m == NULL) 854 return (NULL); 855 memset(mtod(m, void *), 0, len); 856 return (m); 857 } 858 859 /* %%% IPsec policy management */ 860 /* 861 * Return current SPDB generation. 862 */ 863 uint32_t 864 key_getspgen(void) 865 { 866 867 return (V_sp_genid); 868 } 869 870 void 871 key_bumpspgen(void) 872 { 873 874 V_sp_genid++; 875 } 876 877 static int 878 key_checksockaddrs(struct sockaddr *src, struct sockaddr *dst) 879 { 880 881 /* family match */ 882 if (src->sa_family != dst->sa_family) 883 return (EINVAL); 884 /* sa_len match */ 885 if (src->sa_len != dst->sa_len) 886 return (EINVAL); 887 switch (src->sa_family) { 888 #ifdef INET 889 case AF_INET: 890 if (src->sa_len != sizeof(struct sockaddr_in)) 891 return (EINVAL); 892 break; 893 #endif 894 #ifdef INET6 895 case AF_INET6: 896 if (src->sa_len != sizeof(struct sockaddr_in6)) 897 return (EINVAL); 898 break; 899 #endif 900 default: 901 return (EAFNOSUPPORT); 902 } 903 return (0); 904 } 905 906 struct secpolicy * 907 key_do_allocsp(struct secpolicyindex *spidx, u_int dir) 908 { 909 SPTREE_RLOCK_TRACKER; 910 struct secpolicy *sp; 911 912 IPSEC_ASSERT(spidx != NULL, ("null spidx")); 913 IPSEC_ASSERT(dir == IPSEC_DIR_INBOUND || dir == IPSEC_DIR_OUTBOUND, 914 ("invalid direction %u", dir)); 915 916 SPTREE_RLOCK(); 917 TAILQ_FOREACH(sp, &V_sptree[dir], chain) { 918 if (key_cmpspidx_withmask(&sp->spidx, spidx)) { 919 SP_ADDREF(sp); 920 break; 921 } 922 } 923 SPTREE_RUNLOCK(); 924 return (sp); 925 } 926 927 /* 928 * allocating a SP for OUTBOUND or INBOUND packet. 929 * Must call key_freesp() later. 930 * OUT: NULL: not found 931 * others: found and return the pointer. 932 */ 933 struct secpolicy * 934 key_allocsp(struct secpolicyindex *spidx, u_int dir) 935 { 936 struct spdcache_entry *entry, *lastentry, *tmpentry; 937 struct secpolicy *sp; 938 uint32_t hashv; 939 time_t ts; 940 int nb_entries; 941 942 if (!SPDCACHE_ACTIVE()) { 943 sp = key_do_allocsp(spidx, dir); 944 goto out; 945 } 946 947 hashv = SPDCACHE_HASHVAL(spidx); 948 SPDCACHE_LOCK(hashv); 949 nb_entries = 0; 950 LIST_FOREACH_SAFE(entry, &V_spdcachehashtbl[hashv], chain, tmpentry) { 951 /* Removed outdated entries */ 952 if (entry->sp != NULL && 953 entry->sp->state == IPSEC_SPSTATE_DEAD) { 954 LIST_REMOVE(entry, chain); 955 spdcache_entry_free(entry); 956 continue; 957 } 958 959 nb_entries++; 960 if (!key_cmpspidx_exactly(&entry->spidx, spidx)) { 961 lastentry = entry; 962 continue; 963 } 964 965 sp = entry->sp; 966 if (entry->sp != NULL) 967 SP_ADDREF(sp); 968 969 /* IPSECSTAT_INC(ips_spdcache_hits); */ 970 971 SPDCACHE_UNLOCK(hashv); 972 goto out; 973 } 974 975 /* IPSECSTAT_INC(ips_spdcache_misses); */ 976 977 sp = key_do_allocsp(spidx, dir); 978 entry = spdcache_entry_alloc(spidx, sp); 979 if (entry != NULL) { 980 if (nb_entries >= SPDCACHE_MAX_ENTRIES_PER_HASH) { 981 LIST_REMOVE(lastentry, chain); 982 spdcache_entry_free(lastentry); 983 } 984 985 LIST_INSERT_HEAD(&V_spdcachehashtbl[hashv], entry, chain); 986 } 987 988 SPDCACHE_UNLOCK(hashv); 989 990 out: 991 if (sp != NULL) { /* found a SPD entry */ 992 ts = time_second; 993 if (__predict_false(sp->lastused != ts)) 994 sp->lastused = ts; 995 KEYDBG(IPSEC_STAMP, 996 printf("%s: return SP(%p)\n", __func__, sp)); 997 KEYDBG(IPSEC_DATA, kdebug_secpolicy(sp)); 998 } else { 999 KEYDBG(IPSEC_DATA, 1000 printf("%s: lookup failed for ", __func__); 1001 kdebug_secpolicyindex(spidx, NULL)); 1002 } 1003 return (sp); 1004 } 1005 1006 /* 1007 * Allocating an SA entry for an *INBOUND* or *OUTBOUND* TCP packet, signed 1008 * or should be signed by MD5 signature. 1009 * We don't use key_allocsa() for such lookups, because we don't know SPI. 1010 * Unlike ESP and AH protocols, SPI isn't transmitted in the TCP header with 1011 * signed packet. We use SADB only as storage for password. 1012 * OUT: positive: corresponding SA for given saidx found. 1013 * NULL: SA not found 1014 */ 1015 struct secasvar * 1016 key_allocsa_tcpmd5(struct secasindex *saidx) 1017 { 1018 SAHTREE_RLOCK_TRACKER; 1019 struct secashead *sah; 1020 struct secasvar *sav; 1021 1022 IPSEC_ASSERT(saidx->proto == IPPROTO_TCP, 1023 ("unexpected security protocol %u", saidx->proto)); 1024 IPSEC_ASSERT(saidx->mode == IPSEC_MODE_TCPMD5, 1025 ("unexpected mode %u", saidx->mode)); 1026 1027 SAHTREE_RLOCK(); 1028 LIST_FOREACH(sah, SAHADDRHASH_HASH(saidx), addrhash) { 1029 KEYDBG(IPSEC_DUMP, 1030 printf("%s: checking SAH\n", __func__); 1031 kdebug_secash(sah, " ")); 1032 if (sah->saidx.proto != IPPROTO_TCP) 1033 continue; 1034 if (!key_sockaddrcmp(&saidx->dst.sa, &sah->saidx.dst.sa, 0) && 1035 !key_sockaddrcmp(&saidx->src.sa, &sah->saidx.src.sa, 0)) 1036 break; 1037 } 1038 if (sah != NULL) { 1039 if (V_key_preferred_oldsa) 1040 sav = TAILQ_LAST(&sah->savtree_alive, secasvar_queue); 1041 else 1042 sav = TAILQ_FIRST(&sah->savtree_alive); 1043 if (sav != NULL) 1044 SAV_ADDREF(sav); 1045 } else 1046 sav = NULL; 1047 SAHTREE_RUNLOCK(); 1048 1049 if (sav != NULL) { 1050 KEYDBG(IPSEC_STAMP, 1051 printf("%s: return SA(%p)\n", __func__, sav)); 1052 KEYDBG(IPSEC_DATA, kdebug_secasv(sav)); 1053 } else { 1054 KEYDBG(IPSEC_STAMP, 1055 printf("%s: SA not found\n", __func__)); 1056 KEYDBG(IPSEC_DATA, kdebug_secasindex(saidx, NULL)); 1057 } 1058 return (sav); 1059 } 1060 1061 /* 1062 * Allocating an SA entry for an *OUTBOUND* packet. 1063 * OUT: positive: corresponding SA for given saidx found. 1064 * NULL: SA not found, but will be acquired, check *error 1065 * for acquiring status. 1066 */ 1067 struct secasvar * 1068 key_allocsa_policy(struct secpolicy *sp, const struct secasindex *saidx, 1069 int *error) 1070 { 1071 SAHTREE_RLOCK_TRACKER; 1072 struct secashead *sah; 1073 struct secasvar *sav; 1074 1075 IPSEC_ASSERT(saidx != NULL, ("null saidx")); 1076 IPSEC_ASSERT(saidx->mode == IPSEC_MODE_TRANSPORT || 1077 saidx->mode == IPSEC_MODE_TUNNEL, 1078 ("unexpected policy %u", saidx->mode)); 1079 1080 /* 1081 * We check new SA in the IPsec request because a different 1082 * SA may be involved each time this request is checked, either 1083 * because new SAs are being configured, or this request is 1084 * associated with an unconnected datagram socket, or this request 1085 * is associated with a system default policy. 1086 */ 1087 SAHTREE_RLOCK(); 1088 LIST_FOREACH(sah, SAHADDRHASH_HASH(saidx), addrhash) { 1089 KEYDBG(IPSEC_DUMP, 1090 printf("%s: checking SAH\n", __func__); 1091 kdebug_secash(sah, " ")); 1092 if (key_cmpsaidx(&sah->saidx, saidx, CMP_MODE_REQID)) 1093 break; 1094 } 1095 if (sah != NULL) { 1096 /* 1097 * Allocate the oldest SA available according to 1098 * draft-jenkins-ipsec-rekeying-03. 1099 */ 1100 if (V_key_preferred_oldsa) 1101 sav = TAILQ_LAST(&sah->savtree_alive, secasvar_queue); 1102 else 1103 sav = TAILQ_FIRST(&sah->savtree_alive); 1104 if (sav != NULL) 1105 SAV_ADDREF(sav); 1106 } else 1107 sav = NULL; 1108 SAHTREE_RUNLOCK(); 1109 1110 if (sav != NULL) { 1111 *error = 0; 1112 KEYDBG(IPSEC_STAMP, 1113 printf("%s: chosen SA(%p) for SP(%p)\n", __func__, 1114 sav, sp)); 1115 KEYDBG(IPSEC_DATA, kdebug_secasv(sav)); 1116 return (sav); /* return referenced SA */ 1117 } 1118 1119 /* there is no SA */ 1120 *error = key_acquire(saidx, sp); 1121 if ((*error) != 0) 1122 ipseclog((LOG_DEBUG, 1123 "%s: error %d returned from key_acquire()\n", 1124 __func__, *error)); 1125 KEYDBG(IPSEC_STAMP, 1126 printf("%s: acquire SA for SP(%p), error %d\n", 1127 __func__, sp, *error)); 1128 KEYDBG(IPSEC_DATA, kdebug_secasindex(saidx, NULL)); 1129 return (NULL); 1130 } 1131 1132 /* 1133 * allocating a usable SA entry for a *INBOUND* packet. 1134 * Must call key_freesav() later. 1135 * OUT: positive: pointer to a usable sav (i.e. MATURE or DYING state). 1136 * NULL: not found, or error occurred. 1137 * 1138 * According to RFC 2401 SA is uniquely identified by a triple SPI, 1139 * destination address, and security protocol. But according to RFC 4301, 1140 * SPI by itself suffices to specify an SA. 1141 * 1142 * Note that, however, we do need to keep source address in IPsec SA. 1143 * IKE specification and PF_KEY specification do assume that we 1144 * keep source address in IPsec SA. We see a tricky situation here. 1145 */ 1146 struct secasvar * 1147 key_allocsa(union sockaddr_union *dst, uint8_t proto, uint32_t spi) 1148 { 1149 SAHTREE_RLOCK_TRACKER; 1150 struct secasvar *sav; 1151 1152 IPSEC_ASSERT(proto == IPPROTO_ESP || proto == IPPROTO_AH || 1153 proto == IPPROTO_IPCOMP, ("unexpected security protocol %u", 1154 proto)); 1155 1156 SAHTREE_RLOCK(); 1157 LIST_FOREACH(sav, SAVHASH_HASH(spi), spihash) { 1158 if (sav->spi == spi) 1159 break; 1160 } 1161 /* 1162 * We use single SPI namespace for all protocols, so it is 1163 * impossible to have SPI duplicates in the SAVHASH. 1164 */ 1165 if (sav != NULL) { 1166 if (sav->state != SADB_SASTATE_LARVAL && 1167 sav->sah->saidx.proto == proto && 1168 key_sockaddrcmp(&dst->sa, 1169 &sav->sah->saidx.dst.sa, 0) == 0) 1170 SAV_ADDREF(sav); 1171 else 1172 sav = NULL; 1173 } 1174 SAHTREE_RUNLOCK(); 1175 1176 if (sav == NULL) { 1177 KEYDBG(IPSEC_STAMP, 1178 char buf[IPSEC_ADDRSTRLEN]; 1179 printf("%s: SA not found for spi %u proto %u dst %s\n", 1180 __func__, ntohl(spi), proto, ipsec_address(dst, buf, 1181 sizeof(buf)))); 1182 } else { 1183 KEYDBG(IPSEC_STAMP, 1184 printf("%s: return SA(%p)\n", __func__, sav)); 1185 KEYDBG(IPSEC_DATA, kdebug_secasv(sav)); 1186 } 1187 return (sav); 1188 } 1189 1190 struct secasvar * 1191 key_allocsa_tunnel(union sockaddr_union *src, union sockaddr_union *dst, 1192 uint8_t proto) 1193 { 1194 SAHTREE_RLOCK_TRACKER; 1195 struct secasindex saidx; 1196 struct secashead *sah; 1197 struct secasvar *sav; 1198 1199 IPSEC_ASSERT(src != NULL, ("null src address")); 1200 IPSEC_ASSERT(dst != NULL, ("null dst address")); 1201 1202 KEY_SETSECASIDX(proto, IPSEC_MODE_TUNNEL, 0, &src->sa, 1203 &dst->sa, &saidx); 1204 1205 sav = NULL; 1206 SAHTREE_RLOCK(); 1207 LIST_FOREACH(sah, SAHADDRHASH_HASH(&saidx), addrhash) { 1208 if (IPSEC_MODE_TUNNEL != sah->saidx.mode) 1209 continue; 1210 if (proto != sah->saidx.proto) 1211 continue; 1212 if (key_sockaddrcmp(&src->sa, &sah->saidx.src.sa, 0) != 0) 1213 continue; 1214 if (key_sockaddrcmp(&dst->sa, &sah->saidx.dst.sa, 0) != 0) 1215 continue; 1216 /* XXXAE: is key_preferred_oldsa reasonably?*/ 1217 if (V_key_preferred_oldsa) 1218 sav = TAILQ_LAST(&sah->savtree_alive, secasvar_queue); 1219 else 1220 sav = TAILQ_FIRST(&sah->savtree_alive); 1221 if (sav != NULL) { 1222 SAV_ADDREF(sav); 1223 break; 1224 } 1225 } 1226 SAHTREE_RUNLOCK(); 1227 KEYDBG(IPSEC_STAMP, 1228 printf("%s: return SA(%p)\n", __func__, sav)); 1229 if (sav != NULL) 1230 KEYDBG(IPSEC_DATA, kdebug_secasv(sav)); 1231 return (sav); 1232 } 1233 1234 /* 1235 * Must be called after calling key_allocsp(). 1236 */ 1237 void 1238 key_freesp(struct secpolicy **spp) 1239 { 1240 struct secpolicy *sp = *spp; 1241 1242 IPSEC_ASSERT(sp != NULL, ("null sp")); 1243 if (SP_DELREF(sp) == 0) 1244 return; 1245 1246 KEYDBG(IPSEC_STAMP, 1247 printf("%s: last reference to SP(%p)\n", __func__, sp)); 1248 KEYDBG(IPSEC_DATA, kdebug_secpolicy(sp)); 1249 1250 *spp = NULL; 1251 #ifdef IPSEC_OFFLOAD 1252 KASSERT(CK_LIST_EMPTY(&sp->accel_ifps), 1253 ("key_freesp: sp %p still offloaded", sp)); 1254 free(__DECONST(char *, sp->accel_ifname), M_IPSEC_MISC); 1255 #endif 1256 while (sp->tcount > 0) 1257 ipsec_delisr(sp->req[--sp->tcount]); 1258 free(sp, M_IPSEC_SP); 1259 } 1260 1261 static void 1262 key_unlink(struct secpolicy *sp) 1263 { 1264 SPTREE_WLOCK(); 1265 key_detach(sp); 1266 SPTREE_WUNLOCK(); 1267 if (SPDCACHE_ENABLED()) 1268 spdcache_clear(); 1269 ipsec_accel_sync(); 1270 key_freesp(&sp); 1271 } 1272 1273 static void 1274 key_detach(struct secpolicy *sp) 1275 { 1276 IPSEC_ASSERT(sp->spidx.dir == IPSEC_DIR_INBOUND || 1277 sp->spidx.dir == IPSEC_DIR_OUTBOUND, 1278 ("invalid direction %u", sp->spidx.dir)); 1279 SPTREE_WLOCK_ASSERT(); 1280 1281 KEYDBG(KEY_STAMP, 1282 printf("%s: SP(%p)\n", __func__, sp)); 1283 if (sp->state != IPSEC_SPSTATE_ALIVE) { 1284 /* SP is already unlinked */ 1285 return; 1286 } 1287 sp->state = IPSEC_SPSTATE_DEAD; 1288 ipsec_accel_spddel(sp); 1289 TAILQ_REMOVE(&V_sptree[sp->spidx.dir], sp, chain); 1290 V_spd_size--; 1291 LIST_REMOVE(sp, idhash); 1292 V_sp_genid++; 1293 } 1294 1295 /* 1296 * insert a secpolicy into the SP database. Lower priorities first 1297 */ 1298 static void 1299 key_insertsp(struct secpolicy *newsp) 1300 { 1301 struct secpolicy *sp; 1302 1303 SPTREE_WLOCK_ASSERT(); 1304 TAILQ_FOREACH(sp, &V_sptree[newsp->spidx.dir], chain) { 1305 if (newsp->priority < sp->priority) { 1306 TAILQ_INSERT_BEFORE(sp, newsp, chain); 1307 goto done; 1308 } 1309 } 1310 TAILQ_INSERT_TAIL(&V_sptree[newsp->spidx.dir], newsp, chain); 1311 done: 1312 LIST_INSERT_HEAD(SPHASH_HASH(newsp->id), newsp, idhash); 1313 newsp->state = IPSEC_SPSTATE_ALIVE; 1314 V_spd_size++; 1315 V_sp_genid++; 1316 ipsec_accel_spdadd(newsp, NULL); 1317 } 1318 1319 /* 1320 * Insert a bunch of VTI secpolicies into the SPDB. 1321 * We keep VTI policies in the separate list due to following reasons: 1322 * 1) they should be immutable to user's or some deamon's attempts to 1323 * delete. The only way delete such policies - destroy or unconfigure 1324 * corresponding virtual inteface. 1325 * 2) such policies have traffic selector that matches all traffic per 1326 * address family. 1327 * Since all VTI policies have the same priority, we don't care about 1328 * policies order. 1329 */ 1330 int 1331 key_register_ifnet(struct secpolicy **spp, u_int count) 1332 { 1333 struct mbuf *m; 1334 u_int i; 1335 1336 SPTREE_WLOCK(); 1337 /* 1338 * First of try to acquire id for each SP. 1339 */ 1340 for (i = 0; i < count; i++) { 1341 IPSEC_ASSERT(spp[i]->spidx.dir == IPSEC_DIR_INBOUND || 1342 spp[i]->spidx.dir == IPSEC_DIR_OUTBOUND, 1343 ("invalid direction %u", spp[i]->spidx.dir)); 1344 1345 if ((spp[i]->id = key_getnewspid()) == 0) { 1346 SPTREE_WUNLOCK(); 1347 return (EAGAIN); 1348 } 1349 } 1350 for (i = 0; i < count; i++) { 1351 TAILQ_INSERT_TAIL(&V_sptree_ifnet[spp[i]->spidx.dir], 1352 spp[i], chain); 1353 /* 1354 * NOTE: despite the fact that we keep VTI SP in the 1355 * separate list, SPHASH contains policies from both 1356 * sources. Thus SADB_X_SPDGET will correctly return 1357 * SP by id, because it uses SPHASH for lookups. 1358 */ 1359 LIST_INSERT_HEAD(SPHASH_HASH(spp[i]->id), spp[i], idhash); 1360 spp[i]->state = IPSEC_SPSTATE_IFNET; 1361 ipsec_accel_spdadd(spp[i], NULL); 1362 } 1363 SPTREE_WUNLOCK(); 1364 /* 1365 * Notify user processes about new SP. 1366 */ 1367 for (i = 0; i < count; i++) { 1368 m = key_setdumpsp(spp[i], SADB_X_SPDADD, 0, 0); 1369 if (m != NULL) 1370 key_sendup_mbuf(NULL, m, KEY_SENDUP_ALL); 1371 } 1372 return (0); 1373 } 1374 1375 void 1376 key_unregister_ifnet(struct secpolicy **spp, u_int count) 1377 { 1378 struct mbuf *m; 1379 u_int i; 1380 1381 SPTREE_WLOCK(); 1382 for (i = 0; i < count; i++) { 1383 IPSEC_ASSERT(spp[i]->spidx.dir == IPSEC_DIR_INBOUND || 1384 spp[i]->spidx.dir == IPSEC_DIR_OUTBOUND, 1385 ("invalid direction %u", spp[i]->spidx.dir)); 1386 1387 if (spp[i]->state != IPSEC_SPSTATE_IFNET) 1388 continue; 1389 spp[i]->state = IPSEC_SPSTATE_DEAD; 1390 ipsec_accel_spddel(spp[i]); 1391 TAILQ_REMOVE(&V_sptree_ifnet[spp[i]->spidx.dir], 1392 spp[i], chain); 1393 V_spd_size--; 1394 LIST_REMOVE(spp[i], idhash); 1395 } 1396 SPTREE_WUNLOCK(); 1397 if (SPDCACHE_ENABLED()) 1398 spdcache_clear(); 1399 ipsec_accel_sync(); 1400 1401 for (i = 0; i < count; i++) { 1402 m = key_setdumpsp(spp[i], SADB_X_SPDDELETE, 0, 0); 1403 if (m != NULL) 1404 key_sendup_mbuf(NULL, m, KEY_SENDUP_ALL); 1405 } 1406 } 1407 1408 /* 1409 * Must be called after calling key_allocsa(). 1410 * This function is called by key_freesp() to free some SA allocated 1411 * for a policy. 1412 */ 1413 void 1414 key_freesav(struct secasvar **psav) 1415 { 1416 struct secasvar *sav = *psav; 1417 1418 IPSEC_ASSERT(sav != NULL, ("null sav")); 1419 CURVNET_ASSERT_SET(); 1420 if (SAV_DELREF(sav) == 0) 1421 return; 1422 1423 KEYDBG(IPSEC_STAMP, 1424 printf("%s: last reference to SA(%p)\n", __func__, sav)); 1425 1426 *psav = NULL; 1427 key_delsav(sav); 1428 } 1429 1430 /* 1431 * Unlink SA from SAH and SPI hash under SAHTREE_WLOCK. 1432 * Expect that SA has extra reference due to lookup. 1433 * Release this references, also release SAH reference after unlink. 1434 */ 1435 static void 1436 key_unlinksav(struct secasvar *sav) 1437 { 1438 struct secashead *sah; 1439 1440 KEYDBG(KEY_STAMP, 1441 printf("%s: SA(%p)\n", __func__, sav)); 1442 1443 CURVNET_ASSERT_SET(); 1444 SAHTREE_UNLOCK_ASSERT(); 1445 SAHTREE_WLOCK(); 1446 if (sav->state == SADB_SASTATE_DEAD) { 1447 /* SA is already unlinked */ 1448 SAHTREE_WUNLOCK(); 1449 return; 1450 } 1451 /* Unlink from SAH */ 1452 if (sav->state == SADB_SASTATE_LARVAL) 1453 TAILQ_REMOVE(&sav->sah->savtree_larval, sav, chain); 1454 else 1455 TAILQ_REMOVE(&sav->sah->savtree_alive, sav, chain); 1456 /* Unlink from SPI hash */ 1457 LIST_REMOVE(sav, spihash); 1458 sav->state = SADB_SASTATE_DEAD; 1459 ipsec_accel_forget_sav(sav); 1460 sah = sav->sah; 1461 SAHTREE_WUNLOCK(); 1462 key_freesav(&sav); 1463 /* Since we are unlinked, release reference to SAH */ 1464 key_freesah(&sah); 1465 } 1466 1467 /* %%% SPD management */ 1468 /* 1469 * search SPD 1470 * OUT: NULL : not found 1471 * others : found, pointer to a SP. 1472 */ 1473 static struct secpolicy * 1474 key_getsp(struct secpolicyindex *spidx) 1475 { 1476 SPTREE_RLOCK_TRACKER; 1477 struct secpolicy *sp; 1478 1479 IPSEC_ASSERT(spidx != NULL, ("null spidx")); 1480 1481 SPTREE_RLOCK(); 1482 TAILQ_FOREACH(sp, &V_sptree[spidx->dir], chain) { 1483 if (key_cmpspidx_exactly(spidx, &sp->spidx)) { 1484 SP_ADDREF(sp); 1485 break; 1486 } 1487 } 1488 SPTREE_RUNLOCK(); 1489 1490 return sp; 1491 } 1492 1493 /* 1494 * get SP by index. 1495 * OUT: NULL : not found 1496 * others : found, pointer to referenced SP. 1497 */ 1498 static struct secpolicy * 1499 key_getspbyid(uint32_t id) 1500 { 1501 SPTREE_RLOCK_TRACKER; 1502 struct secpolicy *sp; 1503 1504 SPTREE_RLOCK(); 1505 LIST_FOREACH(sp, SPHASH_HASH(id), idhash) { 1506 if (sp->id == id) { 1507 SP_ADDREF(sp); 1508 break; 1509 } 1510 } 1511 SPTREE_RUNLOCK(); 1512 return (sp); 1513 } 1514 1515 struct secpolicy * 1516 key_newsp(void) 1517 { 1518 struct secpolicy *sp; 1519 1520 sp = malloc(sizeof(*sp), M_IPSEC_SP, M_NOWAIT | M_ZERO); 1521 if (sp != NULL) 1522 SP_INITREF(sp); 1523 return (sp); 1524 } 1525 1526 struct ipsecrequest * 1527 ipsec_newisr(void) 1528 { 1529 1530 return (malloc(sizeof(struct ipsecrequest), M_IPSEC_SR, 1531 M_NOWAIT | M_ZERO)); 1532 } 1533 1534 void 1535 ipsec_delisr(struct ipsecrequest *p) 1536 { 1537 1538 free(p, M_IPSEC_SR); 1539 } 1540 1541 /* 1542 * create secpolicy structure from sadb_x_policy structure. 1543 * NOTE: `state', `secpolicyindex' and 'id' in secpolicy structure 1544 * are not set, so must be set properly later. 1545 */ 1546 struct secpolicy * 1547 key_msg2sp(struct sadb_x_policy *xpl0, size_t len, int *error) 1548 { 1549 struct secpolicy *newsp; 1550 1551 IPSEC_ASSERT(xpl0 != NULL, ("null xpl0")); 1552 IPSEC_ASSERT(len >= sizeof(*xpl0), ("policy too short: %zu", len)); 1553 1554 if (len != PFKEY_EXTLEN(xpl0)) { 1555 ipseclog((LOG_DEBUG, "%s: Invalid msg length.\n", __func__)); 1556 *error = EINVAL; 1557 return NULL; 1558 } 1559 1560 if ((newsp = key_newsp()) == NULL) { 1561 *error = ENOBUFS; 1562 return NULL; 1563 } 1564 1565 newsp->spidx.dir = xpl0->sadb_x_policy_dir; 1566 newsp->policy = xpl0->sadb_x_policy_type; 1567 newsp->priority = xpl0->sadb_x_policy_priority; 1568 newsp->tcount = 0; 1569 1570 /* check policy */ 1571 switch (xpl0->sadb_x_policy_type) { 1572 case IPSEC_POLICY_DISCARD: 1573 case IPSEC_POLICY_NONE: 1574 case IPSEC_POLICY_ENTRUST: 1575 case IPSEC_POLICY_BYPASS: 1576 break; 1577 1578 case IPSEC_POLICY_IPSEC: 1579 { 1580 struct sadb_x_ipsecrequest *xisr; 1581 struct ipsecrequest *isr; 1582 int tlen; 1583 1584 /* validity check */ 1585 if (PFKEY_EXTLEN(xpl0) < sizeof(*xpl0)) { 1586 ipseclog((LOG_DEBUG, "%s: Invalid msg length.\n", 1587 __func__)); 1588 key_freesp(&newsp); 1589 *error = EINVAL; 1590 return NULL; 1591 } 1592 1593 tlen = PFKEY_EXTLEN(xpl0) - sizeof(*xpl0); 1594 xisr = (struct sadb_x_ipsecrequest *)(xpl0 + 1); 1595 1596 while (tlen > 0) { 1597 /* length check */ 1598 if (xisr->sadb_x_ipsecrequest_len < sizeof(*xisr) || 1599 xisr->sadb_x_ipsecrequest_len > tlen) { 1600 ipseclog((LOG_DEBUG, "%s: invalid ipsecrequest " 1601 "length.\n", __func__)); 1602 key_freesp(&newsp); 1603 *error = EINVAL; 1604 return NULL; 1605 } 1606 1607 if (newsp->tcount >= IPSEC_MAXREQ) { 1608 ipseclog((LOG_DEBUG, 1609 "%s: too many ipsecrequests.\n", 1610 __func__)); 1611 key_freesp(&newsp); 1612 *error = EINVAL; 1613 return (NULL); 1614 } 1615 1616 /* allocate request buffer */ 1617 /* NB: data structure is zero'd */ 1618 isr = ipsec_newisr(); 1619 if (isr == NULL) { 1620 ipseclog((LOG_DEBUG, 1621 "%s: No more memory.\n", __func__)); 1622 key_freesp(&newsp); 1623 *error = ENOBUFS; 1624 return NULL; 1625 } 1626 1627 newsp->req[newsp->tcount++] = isr; 1628 1629 /* set values */ 1630 switch (xisr->sadb_x_ipsecrequest_proto) { 1631 case IPPROTO_ESP: 1632 case IPPROTO_AH: 1633 case IPPROTO_IPCOMP: 1634 break; 1635 default: 1636 ipseclog((LOG_DEBUG, 1637 "%s: invalid proto type=%u\n", __func__, 1638 xisr->sadb_x_ipsecrequest_proto)); 1639 key_freesp(&newsp); 1640 *error = EPROTONOSUPPORT; 1641 return NULL; 1642 } 1643 isr->saidx.proto = 1644 (uint8_t)xisr->sadb_x_ipsecrequest_proto; 1645 1646 switch (xisr->sadb_x_ipsecrequest_mode) { 1647 case IPSEC_MODE_TRANSPORT: 1648 case IPSEC_MODE_TUNNEL: 1649 break; 1650 case IPSEC_MODE_ANY: 1651 default: 1652 ipseclog((LOG_DEBUG, 1653 "%s: invalid mode=%u\n", __func__, 1654 xisr->sadb_x_ipsecrequest_mode)); 1655 key_freesp(&newsp); 1656 *error = EINVAL; 1657 return NULL; 1658 } 1659 isr->saidx.mode = xisr->sadb_x_ipsecrequest_mode; 1660 1661 switch (xisr->sadb_x_ipsecrequest_level) { 1662 case IPSEC_LEVEL_DEFAULT: 1663 case IPSEC_LEVEL_USE: 1664 case IPSEC_LEVEL_REQUIRE: 1665 break; 1666 case IPSEC_LEVEL_UNIQUE: 1667 /* validity check */ 1668 /* 1669 * If range violation of reqid, kernel will 1670 * update it, don't refuse it. 1671 */ 1672 if (xisr->sadb_x_ipsecrequest_reqid 1673 > IPSEC_MANUAL_REQID_MAX) { 1674 ipseclog((LOG_DEBUG, 1675 "%s: reqid=%d range " 1676 "violation, updated by kernel.\n", 1677 __func__, 1678 xisr->sadb_x_ipsecrequest_reqid)); 1679 xisr->sadb_x_ipsecrequest_reqid = 0; 1680 } 1681 1682 /* allocate new reqid id if reqid is zero. */ 1683 if (xisr->sadb_x_ipsecrequest_reqid == 0) { 1684 u_int32_t reqid; 1685 if ((reqid = key_newreqid()) == 0) { 1686 key_freesp(&newsp); 1687 *error = ENOBUFS; 1688 return NULL; 1689 } 1690 isr->saidx.reqid = reqid; 1691 xisr->sadb_x_ipsecrequest_reqid = reqid; 1692 } else { 1693 /* set it for manual keying. */ 1694 isr->saidx.reqid = 1695 xisr->sadb_x_ipsecrequest_reqid; 1696 } 1697 break; 1698 1699 default: 1700 ipseclog((LOG_DEBUG, "%s: invalid level=%u\n", 1701 __func__, 1702 xisr->sadb_x_ipsecrequest_level)); 1703 key_freesp(&newsp); 1704 *error = EINVAL; 1705 return NULL; 1706 } 1707 isr->level = xisr->sadb_x_ipsecrequest_level; 1708 1709 /* set IP addresses if there */ 1710 if (xisr->sadb_x_ipsecrequest_len > sizeof(*xisr)) { 1711 struct sockaddr *paddr; 1712 1713 len = tlen - sizeof(*xisr); 1714 paddr = (struct sockaddr *)(xisr + 1); 1715 /* validity check */ 1716 if (len < sizeof(struct sockaddr) || 1717 len < 2 * paddr->sa_len || 1718 paddr->sa_len > sizeof(isr->saidx.src)) { 1719 ipseclog((LOG_DEBUG, "%s: invalid " 1720 "request address length.\n", 1721 __func__)); 1722 key_freesp(&newsp); 1723 *error = EINVAL; 1724 return NULL; 1725 } 1726 /* 1727 * Request length should be enough to keep 1728 * source and destination addresses. 1729 */ 1730 if (xisr->sadb_x_ipsecrequest_len < 1731 sizeof(*xisr) + 2 * paddr->sa_len) { 1732 ipseclog((LOG_DEBUG, "%s: invalid " 1733 "ipsecrequest length.\n", 1734 __func__)); 1735 key_freesp(&newsp); 1736 *error = EINVAL; 1737 return (NULL); 1738 } 1739 bcopy(paddr, &isr->saidx.src, paddr->sa_len); 1740 paddr = (struct sockaddr *)((caddr_t)paddr + 1741 paddr->sa_len); 1742 1743 /* validity check */ 1744 if (paddr->sa_len != 1745 isr->saidx.src.sa.sa_len) { 1746 ipseclog((LOG_DEBUG, "%s: invalid " 1747 "request address length.\n", 1748 __func__)); 1749 key_freesp(&newsp); 1750 *error = EINVAL; 1751 return NULL; 1752 } 1753 /* AF family should match */ 1754 if (paddr->sa_family != 1755 isr->saidx.src.sa.sa_family) { 1756 ipseclog((LOG_DEBUG, "%s: address " 1757 "family doesn't match.\n", 1758 __func__)); 1759 key_freesp(&newsp); 1760 *error = EINVAL; 1761 return (NULL); 1762 } 1763 bcopy(paddr, &isr->saidx.dst, paddr->sa_len); 1764 } else { 1765 /* 1766 * Addresses for TUNNEL mode requests are 1767 * mandatory. 1768 */ 1769 if (isr->saidx.mode == IPSEC_MODE_TUNNEL) { 1770 ipseclog((LOG_DEBUG, "%s: missing " 1771 "request addresses.\n", __func__)); 1772 key_freesp(&newsp); 1773 *error = EINVAL; 1774 return (NULL); 1775 } 1776 } 1777 tlen -= xisr->sadb_x_ipsecrequest_len; 1778 1779 /* validity check */ 1780 if (tlen < 0) { 1781 ipseclog((LOG_DEBUG, "%s: becoming tlen < 0.\n", 1782 __func__)); 1783 key_freesp(&newsp); 1784 *error = EINVAL; 1785 return NULL; 1786 } 1787 1788 xisr = (struct sadb_x_ipsecrequest *)((caddr_t)xisr 1789 + xisr->sadb_x_ipsecrequest_len); 1790 } 1791 /* XXXAE: LARVAL SP */ 1792 if (newsp->tcount < 1) { 1793 ipseclog((LOG_DEBUG, "%s: valid IPSEC transforms " 1794 "not found.\n", __func__)); 1795 key_freesp(&newsp); 1796 *error = EINVAL; 1797 return (NULL); 1798 } 1799 } 1800 break; 1801 default: 1802 ipseclog((LOG_DEBUG, "%s: invalid policy type.\n", __func__)); 1803 key_freesp(&newsp); 1804 *error = EINVAL; 1805 return NULL; 1806 } 1807 1808 *error = 0; 1809 return (newsp); 1810 } 1811 1812 uint32_t 1813 key_newreqid(void) 1814 { 1815 static uint32_t auto_reqid = IPSEC_MANUAL_REQID_MAX + 1; 1816 1817 if (auto_reqid == ~0) 1818 auto_reqid = IPSEC_MANUAL_REQID_MAX + 1; 1819 else 1820 auto_reqid++; 1821 1822 /* XXX should be unique check */ 1823 return (auto_reqid); 1824 } 1825 1826 /* 1827 * copy secpolicy struct to sadb_x_policy structure indicated. 1828 */ 1829 static struct mbuf * 1830 key_sp2mbuf(struct secpolicy *sp) 1831 { 1832 struct mbuf *m; 1833 size_t tlen; 1834 1835 tlen = key_getspreqmsglen(sp); 1836 m = m_get2(tlen, M_NOWAIT, MT_DATA, 0); 1837 if (m == NULL) 1838 return (NULL); 1839 m_align(m, tlen); 1840 m->m_len = tlen; 1841 if (key_sp2msg(sp, m->m_data, &tlen) != 0) { 1842 m_freem(m); 1843 return (NULL); 1844 } 1845 return (m); 1846 } 1847 1848 int 1849 key_sp2msg(struct secpolicy *sp, void *request, size_t *len) 1850 { 1851 struct sadb_x_ipsecrequest *xisr; 1852 struct sadb_x_policy *xpl; 1853 struct ipsecrequest *isr; 1854 size_t xlen, ilen; 1855 caddr_t p; 1856 int error, i; 1857 #ifdef IPSEC_OFFLOAD 1858 struct sadb_x_if_hw_offl *xif; 1859 #endif 1860 1861 IPSEC_ASSERT(sp != NULL, ("null policy")); 1862 1863 xlen = sizeof(*xpl); 1864 if (*len < xlen) 1865 return (EINVAL); 1866 1867 error = 0; 1868 bzero(request, *len); 1869 xpl = (struct sadb_x_policy *)request; 1870 xpl->sadb_x_policy_exttype = SADB_X_EXT_POLICY; 1871 xpl->sadb_x_policy_type = sp->policy; 1872 xpl->sadb_x_policy_dir = sp->spidx.dir; 1873 xpl->sadb_x_policy_id = sp->id; 1874 xpl->sadb_x_policy_priority = sp->priority; 1875 switch (sp->state) { 1876 case IPSEC_SPSTATE_IFNET: 1877 xpl->sadb_x_policy_scope = IPSEC_POLICYSCOPE_IFNET; 1878 break; 1879 case IPSEC_SPSTATE_PCB: 1880 xpl->sadb_x_policy_scope = IPSEC_POLICYSCOPE_PCB; 1881 break; 1882 default: 1883 xpl->sadb_x_policy_scope = IPSEC_POLICYSCOPE_GLOBAL; 1884 } 1885 1886 /* if is the policy for ipsec ? */ 1887 if (sp->policy == IPSEC_POLICY_IPSEC) { 1888 p = (caddr_t)xpl + sizeof(*xpl); 1889 for (i = 0; i < sp->tcount; i++) { 1890 isr = sp->req[i]; 1891 ilen = PFKEY_ALIGN8(sizeof(*xisr) + 1892 isr->saidx.src.sa.sa_len + 1893 isr->saidx.dst.sa.sa_len); 1894 xlen += ilen; 1895 if (xlen > *len) { 1896 error = ENOBUFS; 1897 /* Calculate needed size */ 1898 continue; 1899 } 1900 xisr = (struct sadb_x_ipsecrequest *)p; 1901 xisr->sadb_x_ipsecrequest_len = ilen; 1902 xisr->sadb_x_ipsecrequest_proto = isr->saidx.proto; 1903 xisr->sadb_x_ipsecrequest_mode = isr->saidx.mode; 1904 xisr->sadb_x_ipsecrequest_level = isr->level; 1905 xisr->sadb_x_ipsecrequest_reqid = isr->saidx.reqid; 1906 1907 p += sizeof(*xisr); 1908 bcopy(&isr->saidx.src, p, isr->saidx.src.sa.sa_len); 1909 p += isr->saidx.src.sa.sa_len; 1910 bcopy(&isr->saidx.dst, p, isr->saidx.dst.sa.sa_len); 1911 p += isr->saidx.dst.sa.sa_len; 1912 } 1913 } 1914 xpl->sadb_x_policy_len = PFKEY_UNIT64(xlen); 1915 #ifdef IPSEC_OFFLOAD 1916 if (error == 0 && sp->accel_ifname != NULL) { 1917 xif = (struct sadb_x_if_hw_offl *)(xpl + 1); 1918 bzero(xif, sizeof(*xif)); 1919 xif->sadb_x_if_hw_offl_len = PFKEY_UNIT64(sizeof(*xif)); 1920 xif->sadb_x_if_hw_offl_exttype = SADB_X_EXT_IF_HW_OFFL; 1921 xif->sadb_x_if_hw_offl_flags = 0; 1922 strncpy(xif->sadb_x_if_hw_offl_if, sp->accel_ifname, 1923 sizeof(xif->sadb_x_if_hw_offl_if)); 1924 xlen += sizeof(*xif); 1925 } 1926 #endif 1927 if (error == 0) 1928 *len = xlen; 1929 else 1930 *len = sizeof(*xpl); 1931 return (error); 1932 } 1933 1934 /* m will not be freed nor modified */ 1935 static struct mbuf * 1936 key_gather_mbuf(struct mbuf *m, const struct sadb_msghdr *mhp, 1937 int ndeep, int nitem, ...) 1938 { 1939 va_list ap; 1940 int idx; 1941 int i; 1942 struct mbuf *result = NULL, *n; 1943 int len; 1944 1945 IPSEC_ASSERT(m != NULL, ("null mbuf")); 1946 IPSEC_ASSERT(mhp != NULL, ("null msghdr")); 1947 1948 va_start(ap, nitem); 1949 for (i = 0; i < nitem; i++) { 1950 idx = va_arg(ap, int); 1951 if (idx < 0 || idx > SADB_EXT_MAX) 1952 goto fail; 1953 /* don't attempt to pull empty extension */ 1954 if (idx == SADB_EXT_RESERVED && mhp->msg == NULL) 1955 continue; 1956 if (idx != SADB_EXT_RESERVED && 1957 (mhp->ext[idx] == NULL || mhp->extlen[idx] == 0)) 1958 continue; 1959 1960 if (idx == SADB_EXT_RESERVED) { 1961 len = PFKEY_ALIGN8(sizeof(struct sadb_msg)); 1962 1963 IPSEC_ASSERT(len <= MHLEN, ("header too big %u", len)); 1964 1965 MGETHDR(n, M_NOWAIT, MT_DATA); 1966 if (!n) 1967 goto fail; 1968 n->m_len = len; 1969 n->m_next = NULL; 1970 m_copydata(m, 0, sizeof(struct sadb_msg), 1971 mtod(n, caddr_t)); 1972 } else if (i < ndeep) { 1973 len = mhp->extlen[idx]; 1974 n = m_get2(len, M_NOWAIT, MT_DATA, 0); 1975 if (n == NULL) 1976 goto fail; 1977 m_align(n, len); 1978 n->m_len = len; 1979 m_copydata(m, mhp->extoff[idx], mhp->extlen[idx], 1980 mtod(n, caddr_t)); 1981 } else { 1982 n = m_copym(m, mhp->extoff[idx], mhp->extlen[idx], 1983 M_NOWAIT); 1984 } 1985 if (n == NULL) 1986 goto fail; 1987 1988 if (result) 1989 m_cat(result, n); 1990 else 1991 result = n; 1992 } 1993 va_end(ap); 1994 1995 if ((result->m_flags & M_PKTHDR) != 0) { 1996 result->m_pkthdr.len = 0; 1997 for (n = result; n; n = n->m_next) 1998 result->m_pkthdr.len += n->m_len; 1999 } 2000 2001 return result; 2002 2003 fail: 2004 m_freem(result); 2005 va_end(ap); 2006 return NULL; 2007 } 2008 2009 /* 2010 * SADB_X_SPDADD, SADB_X_SPDSETIDX or SADB_X_SPDUPDATE processing 2011 * add an entry to SP database, when received 2012 * <base, address(SD), (lifetime(H),) policy> 2013 * from the user(?). 2014 * Adding to SP database, 2015 * and send 2016 * <base, address(SD), (lifetime(H),) policy> 2017 * to the socket which was send. 2018 * 2019 * SPDADD set a unique policy entry. 2020 * SPDSETIDX like SPDADD without a part of policy requests. 2021 * SPDUPDATE replace a unique policy entry. 2022 * 2023 * XXXAE: serialize this in PF_KEY to avoid races. 2024 * m will always be freed. 2025 */ 2026 static int 2027 key_spdadd(struct socket *so, struct mbuf *m, const struct sadb_msghdr *mhp) 2028 { 2029 struct secpolicyindex spidx; 2030 struct sadb_address *src0, *dst0; 2031 struct sadb_x_policy *xpl0, *xpl; 2032 struct sadb_lifetime *lft = NULL; 2033 struct secpolicy *newsp, *oldsp; 2034 int error; 2035 2036 IPSEC_ASSERT(so != NULL, ("null socket")); 2037 IPSEC_ASSERT(m != NULL, ("null mbuf")); 2038 IPSEC_ASSERT(mhp != NULL, ("null msghdr")); 2039 IPSEC_ASSERT(mhp->msg != NULL, ("null msg")); 2040 2041 if (SADB_CHECKHDR(mhp, SADB_EXT_ADDRESS_SRC) || 2042 SADB_CHECKHDR(mhp, SADB_EXT_ADDRESS_DST) || 2043 SADB_CHECKHDR(mhp, SADB_X_EXT_POLICY)) { 2044 ipseclog((LOG_DEBUG, 2045 "%s: invalid message: missing required header.\n", 2046 __func__)); 2047 return key_senderror(so, m, EINVAL); 2048 } 2049 if (SADB_CHECKLEN(mhp, SADB_EXT_ADDRESS_SRC) || 2050 SADB_CHECKLEN(mhp, SADB_EXT_ADDRESS_DST) || 2051 SADB_CHECKLEN(mhp, SADB_X_EXT_POLICY)) { 2052 ipseclog((LOG_DEBUG, 2053 "%s: invalid message: wrong header size.\n", __func__)); 2054 return key_senderror(so, m, EINVAL); 2055 } 2056 if (!SADB_CHECKHDR(mhp, SADB_EXT_LIFETIME_HARD)) { 2057 if (SADB_CHECKLEN(mhp, SADB_EXT_LIFETIME_HARD)) { 2058 ipseclog((LOG_DEBUG, 2059 "%s: invalid message: wrong header size.\n", 2060 __func__)); 2061 return key_senderror(so, m, EINVAL); 2062 } 2063 lft = (struct sadb_lifetime *)mhp->ext[SADB_EXT_LIFETIME_HARD]; 2064 } 2065 2066 src0 = (struct sadb_address *)mhp->ext[SADB_EXT_ADDRESS_SRC]; 2067 dst0 = (struct sadb_address *)mhp->ext[SADB_EXT_ADDRESS_DST]; 2068 xpl0 = (struct sadb_x_policy *)mhp->ext[SADB_X_EXT_POLICY]; 2069 2070 /* check the direciton */ 2071 switch (xpl0->sadb_x_policy_dir) { 2072 case IPSEC_DIR_INBOUND: 2073 case IPSEC_DIR_OUTBOUND: 2074 break; 2075 default: 2076 ipseclog((LOG_DEBUG, "%s: invalid SP direction.\n", __func__)); 2077 return key_senderror(so, m, EINVAL); 2078 } 2079 /* key_spdadd() accepts DISCARD, NONE and IPSEC. */ 2080 if (xpl0->sadb_x_policy_type != IPSEC_POLICY_DISCARD && 2081 xpl0->sadb_x_policy_type != IPSEC_POLICY_NONE && 2082 xpl0->sadb_x_policy_type != IPSEC_POLICY_IPSEC) { 2083 ipseclog((LOG_DEBUG, "%s: invalid policy type.\n", __func__)); 2084 return key_senderror(so, m, EINVAL); 2085 } 2086 2087 /* policy requests are mandatory when action is ipsec. */ 2088 if (xpl0->sadb_x_policy_type == IPSEC_POLICY_IPSEC && 2089 mhp->extlen[SADB_X_EXT_POLICY] <= sizeof(*xpl0)) { 2090 ipseclog((LOG_DEBUG, 2091 "%s: policy requests required.\n", __func__)); 2092 return key_senderror(so, m, EINVAL); 2093 } 2094 2095 error = key_checksockaddrs((struct sockaddr *)(src0 + 1), 2096 (struct sockaddr *)(dst0 + 1)); 2097 if (error != 0 || 2098 src0->sadb_address_proto != dst0->sadb_address_proto) { 2099 ipseclog((LOG_DEBUG, "%s: invalid sockaddr.\n", __func__)); 2100 return key_senderror(so, m, error); 2101 } 2102 /* make secindex */ 2103 KEY_SETSECSPIDX(xpl0->sadb_x_policy_dir, 2104 src0 + 1, 2105 dst0 + 1, 2106 src0->sadb_address_prefixlen, 2107 dst0->sadb_address_prefixlen, 2108 src0->sadb_address_proto, 2109 &spidx); 2110 /* Checking there is SP already or not. */ 2111 oldsp = key_getsp(&spidx); 2112 if (oldsp != NULL) { 2113 if (mhp->msg->sadb_msg_type == SADB_X_SPDUPDATE) { 2114 KEYDBG(KEY_STAMP, 2115 printf("%s: unlink SP(%p) for SPDUPDATE\n", 2116 __func__, oldsp)); 2117 KEYDBG(KEY_DATA, kdebug_secpolicy(oldsp)); 2118 } else { 2119 key_freesp(&oldsp); 2120 ipseclog((LOG_DEBUG, 2121 "%s: a SP entry exists already.\n", __func__)); 2122 return (key_senderror(so, m, EEXIST)); 2123 } 2124 } 2125 2126 /* allocate new SP entry */ 2127 if ((newsp = key_msg2sp(xpl0, PFKEY_EXTLEN(xpl0), &error)) == NULL) { 2128 if (oldsp != NULL) { 2129 key_unlink(oldsp); 2130 key_freesp(&oldsp); /* second for our reference */ 2131 } 2132 return key_senderror(so, m, error); 2133 } 2134 2135 newsp->lastused = newsp->created = time_second; 2136 newsp->lifetime = lft ? lft->sadb_lifetime_addtime : 0; 2137 newsp->validtime = lft ? lft->sadb_lifetime_usetime : 0; 2138 bcopy(&spidx, &newsp->spidx, sizeof(spidx)); 2139 #ifdef IPSEC_OFFLOAD 2140 if (!SADB_CHECKHDR(mhp, SADB_X_EXT_IF_HW_OFFL) && 2141 !SADB_CHECKLEN(mhp, SADB_X_EXT_IF_HW_OFFL)) { 2142 struct sadb_x_if_hw_offl *xof; 2143 2144 xof = (struct sadb_x_if_hw_offl *)mhp->ext[ 2145 SADB_X_EXT_IF_HW_OFFL]; 2146 newsp->accel_ifname = malloc(sizeof(xof->sadb_x_if_hw_offl_if), 2147 M_IPSEC_MISC, M_NOWAIT); 2148 if (newsp->accel_ifname == NULL) { 2149 ipseclog((LOG_DEBUG, "%s: cannot alloc accel_ifname.\n", 2150 __func__)); 2151 key_freesp(&newsp); 2152 return (key_senderror(so, m, error)); 2153 } 2154 strncpy(__DECONST(char *, newsp->accel_ifname), 2155 xof->sadb_x_if_hw_offl_if, 2156 sizeof(xof->sadb_x_if_hw_offl_if)); 2157 } 2158 2159 #endif 2160 2161 SPTREE_WLOCK(); 2162 if ((newsp->id = key_getnewspid()) == 0) { 2163 if (oldsp != NULL) 2164 key_detach(oldsp); 2165 SPTREE_WUNLOCK(); 2166 if (oldsp != NULL) { 2167 ipsec_accel_sync(); 2168 key_freesp(&oldsp); /* first for key_detach */ 2169 IPSEC_ASSERT(oldsp != NULL, ("null oldsp: refcount bug")); 2170 key_freesp(&oldsp); /* second for our reference */ 2171 if (SPDCACHE_ENABLED()) /* refresh cache because of key_detach */ 2172 spdcache_clear(); 2173 } 2174 key_freesp(&newsp); 2175 return key_senderror(so, m, ENOBUFS); 2176 } 2177 if (oldsp != NULL) 2178 key_detach(oldsp); 2179 key_insertsp(newsp); 2180 SPTREE_WUNLOCK(); 2181 if (oldsp != NULL) { 2182 ipsec_accel_sync(); 2183 key_freesp(&oldsp); /* first for key_detach */ 2184 IPSEC_ASSERT(oldsp != NULL, ("null oldsp: refcount bug")); 2185 key_freesp(&oldsp); /* second for our reference */ 2186 } 2187 if (SPDCACHE_ENABLED()) 2188 spdcache_clear(); 2189 KEYDBG(KEY_STAMP, 2190 printf("%s: SP(%p)\n", __func__, newsp)); 2191 KEYDBG(KEY_DATA, kdebug_secpolicy(newsp)); 2192 2193 { 2194 struct mbuf *n, *mpolicy; 2195 struct sadb_msg *newmsg; 2196 int off; 2197 2198 /* create new sadb_msg to reply. */ 2199 if (lft) { 2200 n = key_gather_mbuf(m, mhp, 2, 5, SADB_EXT_RESERVED, 2201 SADB_X_EXT_POLICY, SADB_EXT_LIFETIME_HARD, 2202 SADB_EXT_ADDRESS_SRC, SADB_EXT_ADDRESS_DST); 2203 } else { 2204 n = key_gather_mbuf(m, mhp, 2, 4, SADB_EXT_RESERVED, 2205 SADB_X_EXT_POLICY, 2206 SADB_EXT_ADDRESS_SRC, SADB_EXT_ADDRESS_DST); 2207 } 2208 if (!n) 2209 return key_senderror(so, m, ENOBUFS); 2210 2211 if (n->m_len < sizeof(*newmsg)) { 2212 n = m_pullup(n, sizeof(*newmsg)); 2213 if (!n) 2214 return key_senderror(so, m, ENOBUFS); 2215 } 2216 newmsg = mtod(n, struct sadb_msg *); 2217 newmsg->sadb_msg_errno = 0; 2218 newmsg->sadb_msg_len = PFKEY_UNIT64(n->m_pkthdr.len); 2219 2220 off = 0; 2221 mpolicy = m_pulldown(n, PFKEY_ALIGN8(sizeof(struct sadb_msg)), 2222 sizeof(*xpl), &off); 2223 if (mpolicy == NULL) { 2224 /* n is already freed */ 2225 return key_senderror(so, m, ENOBUFS); 2226 } 2227 xpl = (struct sadb_x_policy *)(mtod(mpolicy, caddr_t) + off); 2228 if (xpl->sadb_x_policy_exttype != SADB_X_EXT_POLICY) { 2229 m_freem(n); 2230 return key_senderror(so, m, EINVAL); 2231 } 2232 xpl->sadb_x_policy_id = newsp->id; 2233 2234 m_freem(m); 2235 return key_sendup_mbuf(so, n, KEY_SENDUP_ALL); 2236 } 2237 } 2238 2239 /* 2240 * get new policy id. 2241 * OUT: 2242 * 0: failure. 2243 * others: success. 2244 */ 2245 static uint32_t 2246 key_getnewspid(void) 2247 { 2248 struct secpolicy *sp; 2249 uint32_t newid = 0; 2250 int tries, limit; 2251 2252 SPTREE_WLOCK_ASSERT(); 2253 2254 limit = atomic_load_int(&V_key_spi_trycnt); 2255 for (tries = 0; tries < limit; tries++) { 2256 if (V_policy_id == ~0) /* overflowed */ 2257 newid = V_policy_id = 1; 2258 else 2259 newid = ++V_policy_id; 2260 LIST_FOREACH(sp, SPHASH_HASH(newid), idhash) { 2261 if (sp->id == newid) 2262 break; 2263 } 2264 if (sp == NULL) 2265 break; 2266 } 2267 if (tries == limit || newid == 0) { 2268 ipseclog((LOG_DEBUG, "%s: failed to allocate policy id.\n", 2269 __func__)); 2270 return (0); 2271 } 2272 return (newid); 2273 } 2274 2275 /* 2276 * SADB_SPDDELETE processing 2277 * receive 2278 * <base, address(SD), policy(*)> 2279 * from the user(?), and set SADB_SASTATE_DEAD, 2280 * and send, 2281 * <base, address(SD), policy(*)> 2282 * to the ikmpd. 2283 * policy(*) including direction of policy. 2284 * 2285 * m will always be freed. 2286 */ 2287 static int 2288 key_spddelete(struct socket *so, struct mbuf *m, 2289 const struct sadb_msghdr *mhp) 2290 { 2291 struct secpolicyindex spidx; 2292 struct sadb_address *src0, *dst0; 2293 struct sadb_x_policy *xpl0; 2294 struct secpolicy *sp; 2295 2296 IPSEC_ASSERT(so != NULL, ("null so")); 2297 IPSEC_ASSERT(m != NULL, ("null mbuf")); 2298 IPSEC_ASSERT(mhp != NULL, ("null msghdr")); 2299 IPSEC_ASSERT(mhp->msg != NULL, ("null msg")); 2300 2301 if (SADB_CHECKHDR(mhp, SADB_EXT_ADDRESS_SRC) || 2302 SADB_CHECKHDR(mhp, SADB_EXT_ADDRESS_DST) || 2303 SADB_CHECKHDR(mhp, SADB_X_EXT_POLICY)) { 2304 ipseclog((LOG_DEBUG, 2305 "%s: invalid message: missing required header.\n", 2306 __func__)); 2307 return key_senderror(so, m, EINVAL); 2308 } 2309 if (SADB_CHECKLEN(mhp, SADB_EXT_ADDRESS_SRC) || 2310 SADB_CHECKLEN(mhp, SADB_EXT_ADDRESS_DST) || 2311 SADB_CHECKLEN(mhp, SADB_X_EXT_POLICY)) { 2312 ipseclog((LOG_DEBUG, 2313 "%s: invalid message: wrong header size.\n", __func__)); 2314 return key_senderror(so, m, EINVAL); 2315 } 2316 2317 src0 = (struct sadb_address *)mhp->ext[SADB_EXT_ADDRESS_SRC]; 2318 dst0 = (struct sadb_address *)mhp->ext[SADB_EXT_ADDRESS_DST]; 2319 xpl0 = (struct sadb_x_policy *)mhp->ext[SADB_X_EXT_POLICY]; 2320 2321 /* check the direciton */ 2322 switch (xpl0->sadb_x_policy_dir) { 2323 case IPSEC_DIR_INBOUND: 2324 case IPSEC_DIR_OUTBOUND: 2325 break; 2326 default: 2327 ipseclog((LOG_DEBUG, "%s: invalid SP direction.\n", __func__)); 2328 return key_senderror(so, m, EINVAL); 2329 } 2330 /* Only DISCARD, NONE and IPSEC are allowed */ 2331 if (xpl0->sadb_x_policy_type != IPSEC_POLICY_DISCARD && 2332 xpl0->sadb_x_policy_type != IPSEC_POLICY_NONE && 2333 xpl0->sadb_x_policy_type != IPSEC_POLICY_IPSEC) { 2334 ipseclog((LOG_DEBUG, "%s: invalid policy type.\n", __func__)); 2335 return key_senderror(so, m, EINVAL); 2336 } 2337 if (key_checksockaddrs((struct sockaddr *)(src0 + 1), 2338 (struct sockaddr *)(dst0 + 1)) != 0 || 2339 src0->sadb_address_proto != dst0->sadb_address_proto) { 2340 ipseclog((LOG_DEBUG, "%s: invalid sockaddr.\n", __func__)); 2341 return key_senderror(so, m, EINVAL); 2342 } 2343 /* make secindex */ 2344 KEY_SETSECSPIDX(xpl0->sadb_x_policy_dir, 2345 src0 + 1, 2346 dst0 + 1, 2347 src0->sadb_address_prefixlen, 2348 dst0->sadb_address_prefixlen, 2349 src0->sadb_address_proto, 2350 &spidx); 2351 2352 /* Is there SP in SPD ? */ 2353 if ((sp = key_getsp(&spidx)) == NULL) { 2354 ipseclog((LOG_DEBUG, "%s: no SP found.\n", __func__)); 2355 return key_senderror(so, m, EINVAL); 2356 } 2357 2358 /* save policy id to buffer to be returned. */ 2359 xpl0->sadb_x_policy_id = sp->id; 2360 2361 KEYDBG(KEY_STAMP, 2362 printf("%s: SP(%p)\n", __func__, sp)); 2363 KEYDBG(KEY_DATA, kdebug_secpolicy(sp)); 2364 ipsec_accel_spddel(sp); 2365 key_unlink(sp); 2366 key_freesp(&sp); 2367 2368 { 2369 struct mbuf *n; 2370 struct sadb_msg *newmsg; 2371 2372 /* create new sadb_msg to reply. */ 2373 n = key_gather_mbuf(m, mhp, 1, 4, SADB_EXT_RESERVED, 2374 SADB_X_EXT_POLICY, SADB_EXT_ADDRESS_SRC, SADB_EXT_ADDRESS_DST); 2375 if (!n) 2376 return key_senderror(so, m, ENOBUFS); 2377 2378 newmsg = mtod(n, struct sadb_msg *); 2379 newmsg->sadb_msg_errno = 0; 2380 newmsg->sadb_msg_len = PFKEY_UNIT64(n->m_pkthdr.len); 2381 2382 m_freem(m); 2383 return key_sendup_mbuf(so, n, KEY_SENDUP_ALL); 2384 } 2385 } 2386 2387 /* 2388 * SADB_SPDDELETE2 processing 2389 * receive 2390 * <base, policy(*)> 2391 * from the user(?), and set SADB_SASTATE_DEAD, 2392 * and send, 2393 * <base, policy(*)> 2394 * to the ikmpd. 2395 * policy(*) including direction of policy. 2396 * 2397 * m will always be freed. 2398 */ 2399 static int 2400 key_spddelete2(struct socket *so, struct mbuf *m, 2401 const struct sadb_msghdr *mhp) 2402 { 2403 struct secpolicy *sp; 2404 uint32_t id; 2405 2406 IPSEC_ASSERT(so != NULL, ("null socket")); 2407 IPSEC_ASSERT(m != NULL, ("null mbuf")); 2408 IPSEC_ASSERT(mhp != NULL, ("null msghdr")); 2409 IPSEC_ASSERT(mhp->msg != NULL, ("null msg")); 2410 2411 if (SADB_CHECKHDR(mhp, SADB_X_EXT_POLICY) || 2412 SADB_CHECKLEN(mhp, SADB_X_EXT_POLICY)) { 2413 ipseclog((LOG_DEBUG, "%s: invalid message is passed.\n", 2414 __func__)); 2415 return key_senderror(so, m, EINVAL); 2416 } 2417 2418 id = ((struct sadb_x_policy *) 2419 mhp->ext[SADB_X_EXT_POLICY])->sadb_x_policy_id; 2420 2421 /* Is there SP in SPD ? */ 2422 if ((sp = key_getspbyid(id)) == NULL) { 2423 ipseclog((LOG_DEBUG, "%s: no SP found for id %u.\n", 2424 __func__, id)); 2425 return key_senderror(so, m, EINVAL); 2426 } 2427 2428 KEYDBG(KEY_STAMP, 2429 printf("%s: SP(%p)\n", __func__, sp)); 2430 KEYDBG(KEY_DATA, kdebug_secpolicy(sp)); 2431 key_unlink(sp); 2432 if (sp->state != IPSEC_SPSTATE_DEAD) { 2433 ipseclog((LOG_DEBUG, "%s: failed to delete SP with id %u.\n", 2434 __func__, id)); 2435 key_freesp(&sp); 2436 return (key_senderror(so, m, EACCES)); 2437 } 2438 key_freesp(&sp); 2439 2440 { 2441 struct mbuf *n, *nn; 2442 struct sadb_msg *newmsg; 2443 int off, len; 2444 2445 /* create new sadb_msg to reply. */ 2446 len = PFKEY_ALIGN8(sizeof(struct sadb_msg)); 2447 2448 n = key_mget(len); 2449 if (n == NULL) 2450 return key_senderror(so, m, ENOBUFS); 2451 2452 n->m_len = len; 2453 n->m_next = NULL; 2454 off = 0; 2455 2456 m_copydata(m, 0, sizeof(struct sadb_msg), mtod(n, caddr_t) + off); 2457 off += PFKEY_ALIGN8(sizeof(struct sadb_msg)); 2458 2459 IPSEC_ASSERT(off == len, ("length inconsistency (off %u len %u)", 2460 off, len)); 2461 2462 n->m_next = m_copym(m, mhp->extoff[SADB_X_EXT_POLICY], 2463 mhp->extlen[SADB_X_EXT_POLICY], M_NOWAIT); 2464 if (!n->m_next) { 2465 m_freem(n); 2466 return key_senderror(so, m, ENOBUFS); 2467 } 2468 2469 n->m_pkthdr.len = 0; 2470 for (nn = n; nn; nn = nn->m_next) 2471 n->m_pkthdr.len += nn->m_len; 2472 2473 newmsg = mtod(n, struct sadb_msg *); 2474 newmsg->sadb_msg_errno = 0; 2475 newmsg->sadb_msg_len = PFKEY_UNIT64(n->m_pkthdr.len); 2476 2477 m_freem(m); 2478 return key_sendup_mbuf(so, n, KEY_SENDUP_ALL); 2479 } 2480 } 2481 2482 /* 2483 * SADB_X_SPDGET processing 2484 * receive 2485 * <base, policy(*)> 2486 * from the user(?), 2487 * and send, 2488 * <base, address(SD), policy> 2489 * to the ikmpd. 2490 * policy(*) including direction of policy. 2491 * 2492 * m will always be freed. 2493 */ 2494 static int 2495 key_spdget(struct socket *so, struct mbuf *m, const struct sadb_msghdr *mhp) 2496 { 2497 struct secpolicy *sp; 2498 struct mbuf *n; 2499 uint32_t id; 2500 2501 IPSEC_ASSERT(so != NULL, ("null socket")); 2502 IPSEC_ASSERT(m != NULL, ("null mbuf")); 2503 IPSEC_ASSERT(mhp != NULL, ("null msghdr")); 2504 IPSEC_ASSERT(mhp->msg != NULL, ("null msg")); 2505 2506 if (SADB_CHECKHDR(mhp, SADB_X_EXT_POLICY) || 2507 SADB_CHECKLEN(mhp, SADB_X_EXT_POLICY)) { 2508 ipseclog((LOG_DEBUG, "%s: invalid message is passed.\n", 2509 __func__)); 2510 return key_senderror(so, m, EINVAL); 2511 } 2512 2513 id = ((struct sadb_x_policy *) 2514 mhp->ext[SADB_X_EXT_POLICY])->sadb_x_policy_id; 2515 2516 /* Is there SP in SPD ? */ 2517 if ((sp = key_getspbyid(id)) == NULL) { 2518 ipseclog((LOG_DEBUG, "%s: no SP found for id %u.\n", 2519 __func__, id)); 2520 return key_senderror(so, m, ENOENT); 2521 } 2522 2523 n = key_setdumpsp(sp, SADB_X_SPDGET, mhp->msg->sadb_msg_seq, 2524 mhp->msg->sadb_msg_pid); 2525 key_freesp(&sp); 2526 if (n != NULL) { 2527 m_freem(m); 2528 return key_sendup_mbuf(so, n, KEY_SENDUP_ONE); 2529 } else 2530 return key_senderror(so, m, ENOBUFS); 2531 } 2532 2533 /* 2534 * SADB_X_SPDACQUIRE processing. 2535 * Acquire policy and SA(s) for a *OUTBOUND* packet. 2536 * send 2537 * <base, policy(*)> 2538 * to KMD, and expect to receive 2539 * <base> with SADB_X_SPDACQUIRE if error occurred, 2540 * or 2541 * <base, policy> 2542 * with SADB_X_SPDUPDATE from KMD by PF_KEY. 2543 * policy(*) is without policy requests. 2544 * 2545 * 0 : succeed 2546 * others: error number 2547 */ 2548 int 2549 key_spdacquire(struct secpolicy *sp) 2550 { 2551 struct mbuf *result = NULL, *m; 2552 struct secspacq *newspacq; 2553 2554 IPSEC_ASSERT(sp != NULL, ("null secpolicy")); 2555 IPSEC_ASSERT(sp->req == NULL, ("policy exists")); 2556 IPSEC_ASSERT(sp->policy == IPSEC_POLICY_IPSEC, 2557 ("policy not IPSEC %u", sp->policy)); 2558 2559 /* Get an entry to check whether sent message or not. */ 2560 newspacq = key_getspacq(&sp->spidx); 2561 if (newspacq != NULL) { 2562 if (V_key_blockacq_count < newspacq->count) { 2563 /* reset counter and do send message. */ 2564 newspacq->count = 0; 2565 } else { 2566 /* increment counter and do nothing. */ 2567 newspacq->count++; 2568 SPACQ_UNLOCK(); 2569 return (0); 2570 } 2571 SPACQ_UNLOCK(); 2572 } else { 2573 /* make new entry for blocking to send SADB_ACQUIRE. */ 2574 newspacq = key_newspacq(&sp->spidx); 2575 if (newspacq == NULL) 2576 return ENOBUFS; 2577 } 2578 2579 /* create new sadb_msg to reply. */ 2580 m = key_setsadbmsg(SADB_X_SPDACQUIRE, 0, 0, 0, 0, 0); 2581 if (!m) 2582 return ENOBUFS; 2583 2584 result = m; 2585 2586 result->m_pkthdr.len = 0; 2587 for (m = result; m; m = m->m_next) 2588 result->m_pkthdr.len += m->m_len; 2589 2590 mtod(result, struct sadb_msg *)->sadb_msg_len = 2591 PFKEY_UNIT64(result->m_pkthdr.len); 2592 2593 return key_sendup_mbuf(NULL, m, KEY_SENDUP_REGISTERED); 2594 } 2595 2596 /* 2597 * SADB_SPDFLUSH processing 2598 * receive 2599 * <base> 2600 * from the user, and free all entries in secpctree. 2601 * and send, 2602 * <base> 2603 * to the user. 2604 * NOTE: what to do is only marking SADB_SASTATE_DEAD. 2605 * 2606 * m will always be freed. 2607 */ 2608 static int 2609 key_spdflush(struct socket *so, struct mbuf *m, const struct sadb_msghdr *mhp) 2610 { 2611 struct secpolicy_queue drainq; 2612 struct sadb_msg *newmsg; 2613 struct secpolicy *sp, *nextsp; 2614 u_int dir; 2615 2616 IPSEC_ASSERT(so != NULL, ("null socket")); 2617 IPSEC_ASSERT(m != NULL, ("null mbuf")); 2618 IPSEC_ASSERT(mhp != NULL, ("null msghdr")); 2619 IPSEC_ASSERT(mhp->msg != NULL, ("null msg")); 2620 2621 if (m->m_len != PFKEY_ALIGN8(sizeof(struct sadb_msg))) 2622 return key_senderror(so, m, EINVAL); 2623 2624 TAILQ_INIT(&drainq); 2625 SPTREE_WLOCK(); 2626 for (dir = 0; dir < IPSEC_DIR_MAX; dir++) { 2627 TAILQ_CONCAT(&drainq, &V_sptree[dir], chain); 2628 } 2629 /* 2630 * We need to set state to DEAD for each policy to be sure, 2631 * that another thread won't try to unlink it. 2632 * Also remove SP from sphash. 2633 */ 2634 TAILQ_FOREACH(sp, &drainq, chain) { 2635 sp->state = IPSEC_SPSTATE_DEAD; 2636 ipsec_accel_spddel(sp); 2637 LIST_REMOVE(sp, idhash); 2638 } 2639 V_sp_genid++; 2640 V_spd_size = 0; 2641 SPTREE_WUNLOCK(); 2642 if (SPDCACHE_ENABLED()) 2643 spdcache_clear(); 2644 sp = TAILQ_FIRST(&drainq); 2645 while (sp != NULL) { 2646 nextsp = TAILQ_NEXT(sp, chain); 2647 key_freesp(&sp); 2648 sp = nextsp; 2649 } 2650 2651 if (sizeof(struct sadb_msg) > m->m_len + M_TRAILINGSPACE(m)) { 2652 ipseclog((LOG_DEBUG, "%s: No more memory.\n", __func__)); 2653 return key_senderror(so, m, ENOBUFS); 2654 } 2655 2656 if (m->m_next) 2657 m_freem(m->m_next); 2658 m->m_next = NULL; 2659 m->m_pkthdr.len = m->m_len = PFKEY_ALIGN8(sizeof(struct sadb_msg)); 2660 newmsg = mtod(m, struct sadb_msg *); 2661 newmsg->sadb_msg_errno = 0; 2662 newmsg->sadb_msg_len = PFKEY_UNIT64(m->m_pkthdr.len); 2663 2664 return key_sendup_mbuf(so, m, KEY_SENDUP_ALL); 2665 } 2666 2667 static uint8_t 2668 key_satype2scopemask(uint8_t satype) 2669 { 2670 2671 if (satype == IPSEC_POLICYSCOPE_ANY) 2672 return (0xff); 2673 return (satype); 2674 } 2675 /* 2676 * SADB_SPDDUMP processing 2677 * receive 2678 * <base> 2679 * from the user, and dump all SP leaves and send, 2680 * <base> ..... 2681 * to the ikmpd. 2682 * 2683 * NOTE: 2684 * sadb_msg_satype is considered as mask of policy scopes. 2685 * m will always be freed. 2686 */ 2687 static int 2688 key_spddump(struct socket *so, struct mbuf *m, const struct sadb_msghdr *mhp) 2689 { 2690 SPTREE_RLOCK_TRACKER; 2691 struct secpolicy *sp; 2692 struct mbuf *n; 2693 int cnt; 2694 u_int dir, scope; 2695 2696 IPSEC_ASSERT(so != NULL, ("null socket")); 2697 IPSEC_ASSERT(m != NULL, ("null mbuf")); 2698 IPSEC_ASSERT(mhp != NULL, ("null msghdr")); 2699 IPSEC_ASSERT(mhp->msg != NULL, ("null msg")); 2700 2701 /* search SPD entry and get buffer size. */ 2702 cnt = 0; 2703 scope = key_satype2scopemask(mhp->msg->sadb_msg_satype); 2704 SPTREE_RLOCK(); 2705 for (dir = 0; dir < IPSEC_DIR_MAX; dir++) { 2706 if (scope & IPSEC_POLICYSCOPE_GLOBAL) { 2707 TAILQ_FOREACH(sp, &V_sptree[dir], chain) 2708 cnt++; 2709 } 2710 if (scope & IPSEC_POLICYSCOPE_IFNET) { 2711 TAILQ_FOREACH(sp, &V_sptree_ifnet[dir], chain) 2712 cnt++; 2713 } 2714 } 2715 2716 if (cnt == 0) { 2717 SPTREE_RUNLOCK(); 2718 return key_senderror(so, m, ENOENT); 2719 } 2720 2721 for (dir = 0; dir < IPSEC_DIR_MAX; dir++) { 2722 if (scope & IPSEC_POLICYSCOPE_GLOBAL) { 2723 TAILQ_FOREACH(sp, &V_sptree[dir], chain) { 2724 --cnt; 2725 n = key_setdumpsp(sp, SADB_X_SPDDUMP, cnt, 2726 mhp->msg->sadb_msg_pid); 2727 2728 if (n != NULL) 2729 key_sendup_mbuf(so, n, KEY_SENDUP_ONE); 2730 } 2731 } 2732 if (scope & IPSEC_POLICYSCOPE_IFNET) { 2733 TAILQ_FOREACH(sp, &V_sptree_ifnet[dir], chain) { 2734 --cnt; 2735 n = key_setdumpsp(sp, SADB_X_SPDDUMP, cnt, 2736 mhp->msg->sadb_msg_pid); 2737 2738 if (n != NULL) 2739 key_sendup_mbuf(so, n, KEY_SENDUP_ONE); 2740 } 2741 } 2742 } 2743 2744 SPTREE_RUNLOCK(); 2745 m_freem(m); 2746 return (0); 2747 } 2748 2749 static struct mbuf * 2750 key_setdumpsp(struct secpolicy *sp, u_int8_t type, u_int32_t seq, 2751 u_int32_t pid) 2752 { 2753 struct mbuf *result = NULL, *m; 2754 struct seclifetime lt; 2755 2756 m = key_setsadbmsg(type, 0, SADB_SATYPE_UNSPEC, seq, pid, sp->refcnt); 2757 if (!m) 2758 goto fail; 2759 result = m; 2760 2761 m = key_setsadbaddr(SADB_EXT_ADDRESS_SRC, 2762 &sp->spidx.src.sa, sp->spidx.prefs, 2763 sp->spidx.ul_proto); 2764 if (!m) 2765 goto fail; 2766 m_cat(result, m); 2767 2768 m = key_setsadbaddr(SADB_EXT_ADDRESS_DST, 2769 &sp->spidx.dst.sa, sp->spidx.prefd, 2770 sp->spidx.ul_proto); 2771 if (!m) 2772 goto fail; 2773 m_cat(result, m); 2774 2775 m = key_sp2mbuf(sp); 2776 if (!m) 2777 goto fail; 2778 m_cat(result, m); 2779 2780 if(sp->lifetime){ 2781 lt.addtime=sp->created; 2782 lt.usetime= sp->lastused; 2783 m = key_setlifetime(<, SADB_EXT_LIFETIME_CURRENT); 2784 if (!m) 2785 goto fail; 2786 m_cat(result, m); 2787 2788 lt.addtime=sp->lifetime; 2789 lt.usetime= sp->validtime; 2790 m = key_setlifetime(<, SADB_EXT_LIFETIME_HARD); 2791 if (!m) 2792 goto fail; 2793 m_cat(result, m); 2794 } 2795 2796 if ((result->m_flags & M_PKTHDR) == 0) 2797 goto fail; 2798 2799 if (result->m_len < sizeof(struct sadb_msg)) { 2800 result = m_pullup(result, sizeof(struct sadb_msg)); 2801 if (result == NULL) 2802 goto fail; 2803 } 2804 2805 result->m_pkthdr.len = 0; 2806 for (m = result; m; m = m->m_next) 2807 result->m_pkthdr.len += m->m_len; 2808 2809 mtod(result, struct sadb_msg *)->sadb_msg_len = 2810 PFKEY_UNIT64(result->m_pkthdr.len); 2811 2812 return result; 2813 2814 fail: 2815 m_freem(result); 2816 return NULL; 2817 } 2818 /* 2819 * get PFKEY message length for security policy and request. 2820 */ 2821 static size_t 2822 key_getspreqmsglen(struct secpolicy *sp) 2823 { 2824 size_t tlen, len; 2825 int i; 2826 2827 tlen = sizeof(struct sadb_x_policy); 2828 /* if is the policy for ipsec ? */ 2829 if (sp->policy != IPSEC_POLICY_IPSEC) 2830 return (tlen); 2831 2832 /* get length of ipsec requests */ 2833 for (i = 0; i < sp->tcount; i++) { 2834 len = sizeof(struct sadb_x_ipsecrequest) 2835 + sp->req[i]->saidx.src.sa.sa_len 2836 + sp->req[i]->saidx.dst.sa.sa_len; 2837 2838 tlen += PFKEY_ALIGN8(len); 2839 } 2840 #ifdef IPSEC_OFFLOAD 2841 if (sp->accel_ifname != NULL) 2842 tlen += sizeof(struct sadb_x_if_hw_offl); 2843 #endif 2844 return (tlen); 2845 } 2846 2847 /* 2848 * SADB_SPDEXPIRE processing 2849 * send 2850 * <base, address(SD), lifetime(CH), policy> 2851 * to KMD by PF_KEY. 2852 * 2853 * OUT: 0 : succeed 2854 * others : error number 2855 */ 2856 static int 2857 key_spdexpire(struct secpolicy *sp) 2858 { 2859 struct sadb_lifetime *lt; 2860 struct mbuf *result = NULL, *m; 2861 int len, error = -1; 2862 2863 IPSEC_ASSERT(sp != NULL, ("null secpolicy")); 2864 2865 KEYDBG(KEY_STAMP, 2866 printf("%s: SP(%p)\n", __func__, sp)); 2867 KEYDBG(KEY_DATA, kdebug_secpolicy(sp)); 2868 2869 /* set msg header */ 2870 m = key_setsadbmsg(SADB_X_SPDEXPIRE, 0, 0, 0, 0, 0); 2871 if (!m) { 2872 error = ENOBUFS; 2873 goto fail; 2874 } 2875 result = m; 2876 2877 /* create lifetime extension (current and hard) */ 2878 len = PFKEY_ALIGN8(sizeof(*lt)) * 2; 2879 m = m_get2(len, M_NOWAIT, MT_DATA, 0); 2880 if (m == NULL) { 2881 error = ENOBUFS; 2882 goto fail; 2883 } 2884 m_align(m, len); 2885 m->m_len = len; 2886 bzero(mtod(m, caddr_t), len); 2887 lt = mtod(m, struct sadb_lifetime *); 2888 lt->sadb_lifetime_len = PFKEY_UNIT64(sizeof(struct sadb_lifetime)); 2889 lt->sadb_lifetime_exttype = SADB_EXT_LIFETIME_CURRENT; 2890 lt->sadb_lifetime_allocations = 0; 2891 lt->sadb_lifetime_bytes = 0; 2892 lt->sadb_lifetime_addtime = sp->created; 2893 lt->sadb_lifetime_usetime = sp->lastused; 2894 lt = (struct sadb_lifetime *)(mtod(m, caddr_t) + len / 2); 2895 lt->sadb_lifetime_len = PFKEY_UNIT64(sizeof(struct sadb_lifetime)); 2896 lt->sadb_lifetime_exttype = SADB_EXT_LIFETIME_HARD; 2897 lt->sadb_lifetime_allocations = 0; 2898 lt->sadb_lifetime_bytes = 0; 2899 lt->sadb_lifetime_addtime = sp->lifetime; 2900 lt->sadb_lifetime_usetime = sp->validtime; 2901 m_cat(result, m); 2902 2903 /* set sadb_address for source */ 2904 m = key_setsadbaddr(SADB_EXT_ADDRESS_SRC, 2905 &sp->spidx.src.sa, 2906 sp->spidx.prefs, sp->spidx.ul_proto); 2907 if (!m) { 2908 error = ENOBUFS; 2909 goto fail; 2910 } 2911 m_cat(result, m); 2912 2913 /* set sadb_address for destination */ 2914 m = key_setsadbaddr(SADB_EXT_ADDRESS_DST, 2915 &sp->spidx.dst.sa, 2916 sp->spidx.prefd, sp->spidx.ul_proto); 2917 if (!m) { 2918 error = ENOBUFS; 2919 goto fail; 2920 } 2921 m_cat(result, m); 2922 2923 /* set secpolicy */ 2924 m = key_sp2mbuf(sp); 2925 if (!m) { 2926 error = ENOBUFS; 2927 goto fail; 2928 } 2929 m_cat(result, m); 2930 2931 if ((result->m_flags & M_PKTHDR) == 0) { 2932 error = EINVAL; 2933 goto fail; 2934 } 2935 2936 if (result->m_len < sizeof(struct sadb_msg)) { 2937 result = m_pullup(result, sizeof(struct sadb_msg)); 2938 if (result == NULL) { 2939 error = ENOBUFS; 2940 goto fail; 2941 } 2942 } 2943 2944 result->m_pkthdr.len = 0; 2945 for (m = result; m; m = m->m_next) 2946 result->m_pkthdr.len += m->m_len; 2947 2948 mtod(result, struct sadb_msg *)->sadb_msg_len = 2949 PFKEY_UNIT64(result->m_pkthdr.len); 2950 2951 return key_sendup_mbuf(NULL, result, KEY_SENDUP_REGISTERED); 2952 2953 fail: 2954 if (result) 2955 m_freem(result); 2956 return error; 2957 } 2958 2959 /* %%% SAD management */ 2960 /* 2961 * allocating and initialize new SA head. 2962 * OUT: NULL : failure due to the lack of memory. 2963 * others : pointer to new SA head. 2964 */ 2965 static struct secashead * 2966 key_newsah(struct secasindex *saidx) 2967 { 2968 struct secashead *sah; 2969 2970 sah = malloc(sizeof(struct secashead), M_IPSEC_SAH, 2971 M_NOWAIT | M_ZERO); 2972 if (sah == NULL) { 2973 PFKEYSTAT_INC(in_nomem); 2974 return (NULL); 2975 } 2976 TAILQ_INIT(&sah->savtree_larval); 2977 TAILQ_INIT(&sah->savtree_alive); 2978 sah->saidx = *saidx; 2979 sah->state = SADB_SASTATE_DEAD; 2980 SAH_INITREF(sah); 2981 2982 KEYDBG(KEY_STAMP, 2983 printf("%s: SAH(%p)\n", __func__, sah)); 2984 KEYDBG(KEY_DATA, kdebug_secash(sah, NULL)); 2985 return (sah); 2986 } 2987 2988 static void 2989 key_freesah(struct secashead **psah) 2990 { 2991 struct secashead *sah = *psah; 2992 2993 CURVNET_ASSERT_SET(); 2994 2995 if (SAH_DELREF(sah) == 0) 2996 return; 2997 2998 KEYDBG(KEY_STAMP, 2999 printf("%s: last reference to SAH(%p)\n", __func__, sah)); 3000 KEYDBG(KEY_DATA, kdebug_secash(sah, NULL)); 3001 3002 *psah = NULL; 3003 key_delsah(sah); 3004 } 3005 3006 static void 3007 key_delsah(struct secashead *sah) 3008 { 3009 IPSEC_ASSERT(sah != NULL, ("NULL sah")); 3010 IPSEC_ASSERT(sah->state == SADB_SASTATE_DEAD, 3011 ("Attempt to free non DEAD SAH %p", sah)); 3012 IPSEC_ASSERT(TAILQ_EMPTY(&sah->savtree_larval), 3013 ("Attempt to free SAH %p with LARVAL SA", sah)); 3014 IPSEC_ASSERT(TAILQ_EMPTY(&sah->savtree_alive), 3015 ("Attempt to free SAH %p with ALIVE SA", sah)); 3016 3017 free(sah, M_IPSEC_SAH); 3018 } 3019 3020 /* 3021 * allocating a new SA for key_add() and key_getspi() call, 3022 * and copy the values of mhp into new buffer. 3023 * When SAD message type is SADB_GETSPI set SA state to LARVAL. 3024 * For SADB_ADD create and initialize SA with MATURE state. 3025 * OUT: NULL : fail 3026 * others : pointer to new secasvar. 3027 */ 3028 static struct secasvar * 3029 key_newsav(const struct sadb_msghdr *mhp, struct secasindex *saidx, 3030 uint32_t spi, int *errp) 3031 { 3032 struct secashead *sah; 3033 struct secasvar *sav; 3034 int isnew; 3035 3036 IPSEC_ASSERT(mhp != NULL, ("null msghdr")); 3037 IPSEC_ASSERT(mhp->msg != NULL, ("null msg")); 3038 IPSEC_ASSERT(mhp->msg->sadb_msg_type == SADB_GETSPI || 3039 mhp->msg->sadb_msg_type == SADB_ADD, ("wrong message type")); 3040 3041 sav = NULL; 3042 sah = NULL; 3043 /* check SPI value */ 3044 switch (saidx->proto) { 3045 case IPPROTO_ESP: 3046 case IPPROTO_AH: 3047 /* 3048 * RFC 4302, 2.4. Security Parameters Index (SPI), SPI values 3049 * 1-255 reserved by IANA for future use, 3050 * 0 for implementation specific, local use. 3051 */ 3052 if (ntohl(spi) <= 255) { 3053 ipseclog((LOG_DEBUG, "%s: illegal range of SPI %u.\n", 3054 __func__, ntohl(spi))); 3055 *errp = EINVAL; 3056 goto done; 3057 } 3058 break; 3059 } 3060 3061 sav = malloc(sizeof(struct secasvar), M_IPSEC_SA, M_NOWAIT | M_ZERO); 3062 if (sav == NULL) { 3063 *errp = ENOBUFS; 3064 goto done; 3065 } 3066 sav->lock = malloc_aligned(max(sizeof(struct rmlock), 3067 CACHE_LINE_SIZE), CACHE_LINE_SIZE, M_IPSEC_MISC, 3068 M_NOWAIT | M_ZERO); 3069 if (sav->lock == NULL) { 3070 *errp = ENOBUFS; 3071 goto done; 3072 } 3073 rm_init(sav->lock, "ipsec association"); 3074 sav->lft_c = uma_zalloc_pcpu(ipsec_key_lft_zone, M_NOWAIT | M_ZERO); 3075 if (sav->lft_c == NULL) { 3076 *errp = ENOBUFS; 3077 goto done; 3078 } 3079 3080 sav->spi = spi; 3081 sav->seq = mhp->msg->sadb_msg_seq; 3082 sav->state = SADB_SASTATE_LARVAL; 3083 sav->pid = (pid_t)mhp->msg->sadb_msg_pid; 3084 SAV_INITREF(sav); 3085 #ifdef IPSEC_OFFLOAD 3086 CK_LIST_INIT(&sav->accel_ifps); 3087 sav->accel_forget_tq = 0; 3088 sav->accel_lft_sw = uma_zalloc_pcpu(ipsec_key_lft_zone, 3089 M_NOWAIT | M_ZERO); 3090 if (sav->accel_lft_sw == NULL) { 3091 *errp = ENOBUFS; 3092 goto done; 3093 } 3094 if (!SADB_CHECKHDR(mhp, SADB_X_EXT_IF_HW_OFFL) && 3095 !SADB_CHECKLEN(mhp, SADB_X_EXT_IF_HW_OFFL)) { 3096 struct sadb_x_if_hw_offl *xof; 3097 3098 xof = (struct sadb_x_if_hw_offl *)mhp->ext[ 3099 SADB_X_EXT_IF_HW_OFFL]; 3100 sav->accel_ifname = malloc(sizeof(xof->sadb_x_if_hw_offl_if), 3101 M_IPSEC_MISC, M_NOWAIT); 3102 if (sav->accel_ifname == NULL) { 3103 *errp = ENOBUFS; 3104 goto done; 3105 } 3106 strncpy(__DECONST(char *, sav->accel_ifname), 3107 xof->sadb_x_if_hw_offl_if, 3108 sizeof(xof->sadb_x_if_hw_offl_if)); 3109 } 3110 #endif 3111 again: 3112 sah = key_getsah(saidx); 3113 if (sah == NULL) { 3114 /* create a new SA index */ 3115 sah = key_newsah(saidx); 3116 if (sah == NULL) { 3117 ipseclog((LOG_DEBUG, 3118 "%s: No more memory.\n", __func__)); 3119 *errp = ENOBUFS; 3120 goto done; 3121 } 3122 isnew = 1; 3123 } else 3124 isnew = 0; 3125 3126 sav->sah = sah; 3127 if (mhp->msg->sadb_msg_type == SADB_GETSPI) { 3128 sav->created = time_second; 3129 } else if (sav->state == SADB_SASTATE_LARVAL) { 3130 /* 3131 * Do not call key_setsaval() second time in case 3132 * of `goto again`. We will have MATURE state. 3133 */ 3134 *errp = key_setsaval(sav, mhp); 3135 if (*errp != 0) 3136 goto done; 3137 sav->state = SADB_SASTATE_MATURE; 3138 } 3139 3140 SAHTREE_WLOCK(); 3141 /* 3142 * Check that existing SAH wasn't unlinked. 3143 * Since we didn't hold the SAHTREE lock, it is possible, 3144 * that callout handler or key_flush() or key_delete() could 3145 * unlink this SAH. 3146 */ 3147 if (isnew == 0 && sah->state == SADB_SASTATE_DEAD) { 3148 SAHTREE_WUNLOCK(); 3149 key_freesah(&sah); /* reference from key_getsah() */ 3150 goto again; 3151 } 3152 if (isnew != 0) { 3153 /* 3154 * Add new SAH into SADB. 3155 * 3156 * XXXAE: we can serialize key_add and key_getspi calls, so 3157 * several threads will not fight in the race. 3158 * Otherwise we should check under SAHTREE lock, that this 3159 * SAH would not added twice. 3160 */ 3161 TAILQ_INSERT_HEAD(&V_sahtree, sah, chain); 3162 /* Add new SAH into hash by addresses */ 3163 LIST_INSERT_HEAD(SAHADDRHASH_HASH(saidx), sah, addrhash); 3164 /* Now we are linked in the chain */ 3165 sah->state = SADB_SASTATE_MATURE; 3166 /* 3167 * SAV references this new SAH. 3168 * In case of existing SAH we reuse reference 3169 * from key_getsah(). 3170 */ 3171 SAH_ADDREF(sah); 3172 } 3173 /* Link SAV with SAH */ 3174 if (sav->state == SADB_SASTATE_MATURE) { 3175 TAILQ_INSERT_HEAD(&sah->savtree_alive, sav, chain); 3176 ipsec_accel_sa_newkey(sav); 3177 } else 3178 TAILQ_INSERT_HEAD(&sah->savtree_larval, sav, chain); 3179 /* Add SAV into SPI hash */ 3180 LIST_INSERT_HEAD(SAVHASH_HASH(sav->spi), sav, spihash); 3181 SAHTREE_WUNLOCK(); 3182 *errp = 0; /* success */ 3183 done: 3184 if (*errp != 0) { 3185 if (sav != NULL) { 3186 if (sav->lock != NULL) { 3187 rm_destroy(sav->lock); 3188 free(sav->lock, M_IPSEC_MISC); 3189 } 3190 if (sav->lft_c != NULL) 3191 uma_zfree_pcpu(ipsec_key_lft_zone, sav->lft_c); 3192 #ifdef IPSEC_OFFLOAD 3193 if (sav->accel_lft_sw != NULL) 3194 uma_zfree_pcpu(ipsec_key_lft_zone, 3195 sav->accel_lft_sw); 3196 free(__DECONST(char *, sav->accel_ifname), 3197 M_IPSEC_MISC); 3198 #endif 3199 free(sav, M_IPSEC_SA), sav = NULL; 3200 } 3201 if (sah != NULL) 3202 key_freesah(&sah); 3203 if (*errp == ENOBUFS) { 3204 ipseclog((LOG_DEBUG, "%s: No more memory.\n", 3205 __func__)); 3206 PFKEYSTAT_INC(in_nomem); 3207 } 3208 } 3209 return (sav); 3210 } 3211 3212 /* 3213 * free() SA variable entry. 3214 */ 3215 static void 3216 key_cleansav(struct secasvar *sav) 3217 { 3218 3219 if (sav->natt != NULL) { 3220 free(sav->natt, M_IPSEC_MISC); 3221 sav->natt = NULL; 3222 } 3223 if (sav->flags & SADB_X_EXT_F_CLONED) 3224 return; 3225 if (sav->tdb_xform != NULL) { 3226 sav->tdb_xform->xf_cleanup(sav); 3227 sav->tdb_xform = NULL; 3228 } 3229 if (sav->key_auth != NULL) { 3230 zfree(sav->key_auth->key_data, M_IPSEC_MISC); 3231 free(sav->key_auth, M_IPSEC_MISC); 3232 sav->key_auth = NULL; 3233 } 3234 if (sav->key_enc != NULL) { 3235 zfree(sav->key_enc->key_data, M_IPSEC_MISC); 3236 free(sav->key_enc, M_IPSEC_MISC); 3237 sav->key_enc = NULL; 3238 } 3239 if (sav->replay != NULL) { 3240 mtx_destroy(&sav->replay->lock); 3241 if (sav->replay->bitmap != NULL) 3242 free(sav->replay->bitmap, M_IPSEC_MISC); 3243 free(sav->replay, M_IPSEC_MISC); 3244 sav->replay = NULL; 3245 } 3246 if (sav->lft_h != NULL) { 3247 free(sav->lft_h, M_IPSEC_MISC); 3248 sav->lft_h = NULL; 3249 } 3250 if (sav->lft_s != NULL) { 3251 free(sav->lft_s, M_IPSEC_MISC); 3252 sav->lft_s = NULL; 3253 } 3254 } 3255 3256 /* 3257 * free() SA variable entry. 3258 */ 3259 static void 3260 key_delsav(struct secasvar *sav) 3261 { 3262 IPSEC_ASSERT(sav != NULL, ("null sav")); 3263 IPSEC_ASSERT(sav->state == SADB_SASTATE_DEAD, 3264 ("attempt to free non DEAD SA %p", sav)); 3265 IPSEC_ASSERT(sav->refcnt == 0, ("reference count %u > 0", 3266 sav->refcnt)); 3267 #ifdef IPSEC_OFFLOAD 3268 KASSERT(CK_LIST_EMPTY(&sav->accel_ifps), 3269 ("key_unlinksav: sav %p still offloaded", sav)); 3270 #endif 3271 3272 /* 3273 * SA must be unlinked from the chain and hashtbl. 3274 * If SA was cloned, we leave all fields untouched, 3275 * except NAT-T config. 3276 */ 3277 key_cleansav(sav); 3278 if ((sav->flags & SADB_X_EXT_F_CLONED) == 0) { 3279 rm_destroy(sav->lock); 3280 free(sav->lock, M_IPSEC_MISC); 3281 uma_zfree_pcpu(ipsec_key_lft_zone, sav->lft_c); 3282 } 3283 #ifdef IPSEC_OFFLOAD 3284 /* XXXKIB should this be moved to key_cleansav()? */ 3285 uma_zfree_pcpu(ipsec_key_lft_zone, sav->accel_lft_sw); 3286 free(__DECONST(char *, sav->accel_ifname), M_IPSEC_MISC); 3287 #endif 3288 free(sav, M_IPSEC_SA); 3289 } 3290 3291 /* 3292 * search SAH. 3293 * OUT: 3294 * NULL : not found 3295 * others : found, referenced pointer to a SAH. 3296 */ 3297 static struct secashead * 3298 key_getsah(struct secasindex *saidx) 3299 { 3300 SAHTREE_RLOCK_TRACKER; 3301 struct secashead *sah; 3302 3303 SAHTREE_RLOCK(); 3304 LIST_FOREACH(sah, SAHADDRHASH_HASH(saidx), addrhash) { 3305 if (key_cmpsaidx(&sah->saidx, saidx, CMP_MODE_REQID) != 0) { 3306 SAH_ADDREF(sah); 3307 break; 3308 } 3309 } 3310 SAHTREE_RUNLOCK(); 3311 return (sah); 3312 } 3313 3314 /* 3315 * Check not to be duplicated SPI. 3316 * OUT: 3317 * 0 : not found 3318 * 1 : found SA with given SPI. 3319 */ 3320 static int 3321 key_checkspidup(uint32_t spi) 3322 { 3323 SAHTREE_RLOCK_TRACKER; 3324 struct secasvar *sav; 3325 3326 /* Assume SPI is in network byte order */ 3327 SAHTREE_RLOCK(); 3328 LIST_FOREACH(sav, SAVHASH_HASH(spi), spihash) { 3329 if (sav->spi == spi) 3330 break; 3331 } 3332 SAHTREE_RUNLOCK(); 3333 return (sav != NULL); 3334 } 3335 3336 /* 3337 * Search SA by SPI. 3338 * OUT: 3339 * NULL : not found 3340 * others : found, referenced pointer to a SA. 3341 */ 3342 static struct secasvar * 3343 key_getsavbyspi(uint32_t spi) 3344 { 3345 SAHTREE_RLOCK_TRACKER; 3346 struct secasvar *sav; 3347 3348 /* Assume SPI is in network byte order */ 3349 SAHTREE_RLOCK(); 3350 LIST_FOREACH(sav, SAVHASH_HASH(spi), spihash) { 3351 if (sav->spi != spi) 3352 continue; 3353 SAV_ADDREF(sav); 3354 break; 3355 } 3356 SAHTREE_RUNLOCK(); 3357 return (sav); 3358 } 3359 3360 static int 3361 key_updatelifetimes(struct secasvar *sav, const struct sadb_msghdr *mhp) 3362 { 3363 struct seclifetime *lft_h, *lft_s, *tmp; 3364 3365 /* Lifetime extension is optional, check that it is present. */ 3366 if (SADB_CHECKHDR(mhp, SADB_EXT_LIFETIME_HARD) && 3367 SADB_CHECKHDR(mhp, SADB_EXT_LIFETIME_SOFT)) { 3368 /* 3369 * In case of SADB_UPDATE we may need to change 3370 * existing lifetimes. 3371 */ 3372 if (sav->state == SADB_SASTATE_MATURE) { 3373 lft_h = lft_s = NULL; 3374 goto reset; 3375 } 3376 return (0); 3377 } 3378 /* Both HARD and SOFT extensions must present */ 3379 if ((SADB_CHECKHDR(mhp, SADB_EXT_LIFETIME_HARD) && 3380 !SADB_CHECKHDR(mhp, SADB_EXT_LIFETIME_SOFT)) || 3381 (SADB_CHECKHDR(mhp, SADB_EXT_LIFETIME_SOFT) && 3382 !SADB_CHECKHDR(mhp, SADB_EXT_LIFETIME_HARD))) { 3383 ipseclog((LOG_DEBUG, 3384 "%s: invalid message: missing required header.\n", 3385 __func__)); 3386 return (EINVAL); 3387 } 3388 if (SADB_CHECKLEN(mhp, SADB_EXT_LIFETIME_HARD) || 3389 SADB_CHECKLEN(mhp, SADB_EXT_LIFETIME_SOFT)) { 3390 ipseclog((LOG_DEBUG, 3391 "%s: invalid message: wrong header size.\n", __func__)); 3392 return (EINVAL); 3393 } 3394 lft_h = key_dup_lifemsg((const struct sadb_lifetime *) 3395 mhp->ext[SADB_EXT_LIFETIME_HARD], M_IPSEC_MISC); 3396 if (lft_h == NULL) { 3397 PFKEYSTAT_INC(in_nomem); 3398 ipseclog((LOG_DEBUG, "%s: No more memory.\n", __func__)); 3399 return (ENOBUFS); 3400 } 3401 lft_s = key_dup_lifemsg((const struct sadb_lifetime *) 3402 mhp->ext[SADB_EXT_LIFETIME_SOFT], M_IPSEC_MISC); 3403 if (lft_s == NULL) { 3404 PFKEYSTAT_INC(in_nomem); 3405 free(lft_h, M_IPSEC_MISC); 3406 ipseclog((LOG_DEBUG, "%s: No more memory.\n", __func__)); 3407 return (ENOBUFS); 3408 } 3409 reset: 3410 if (sav->state != SADB_SASTATE_LARVAL) { 3411 /* 3412 * key_update() holds reference to this SA, 3413 * so it won't be deleted in meanwhile. 3414 */ 3415 SECASVAR_WLOCK(sav); 3416 tmp = sav->lft_h; 3417 sav->lft_h = lft_h; 3418 lft_h = tmp; 3419 3420 tmp = sav->lft_s; 3421 sav->lft_s = lft_s; 3422 lft_s = tmp; 3423 SECASVAR_WUNLOCK(sav); 3424 if (lft_h != NULL) 3425 free(lft_h, M_IPSEC_MISC); 3426 if (lft_s != NULL) 3427 free(lft_s, M_IPSEC_MISC); 3428 return (0); 3429 } 3430 /* We can update lifetime without holding a lock */ 3431 IPSEC_ASSERT(sav->lft_h == NULL, ("lft_h is already initialized\n")); 3432 IPSEC_ASSERT(sav->lft_s == NULL, ("lft_s is already initialized\n")); 3433 sav->lft_h = lft_h; 3434 sav->lft_s = lft_s; 3435 return (0); 3436 } 3437 3438 /* 3439 * copy SA values from PF_KEY message except *SPI, SEQ, PID and TYPE*. 3440 * You must update these if need. Expects only LARVAL SAs. 3441 * OUT: 0: success. 3442 * !0: failure. 3443 */ 3444 static int 3445 key_setsaval(struct secasvar *sav, const struct sadb_msghdr *mhp) 3446 { 3447 const struct sadb_sa *sa0; 3448 const struct sadb_key *key0; 3449 uint32_t replay; 3450 size_t len; 3451 int error; 3452 3453 IPSEC_ASSERT(mhp != NULL, ("null msghdr")); 3454 IPSEC_ASSERT(mhp->msg != NULL, ("null msg")); 3455 IPSEC_ASSERT(sav->state == SADB_SASTATE_LARVAL, 3456 ("Attempt to update non LARVAL SA")); 3457 3458 /* XXX rewrite */ 3459 error = key_setident(sav->sah, mhp); 3460 if (error != 0) 3461 goto fail; 3462 3463 /* SA */ 3464 if (!SADB_CHECKHDR(mhp, SADB_EXT_SA)) { 3465 if (SADB_CHECKLEN(mhp, SADB_EXT_SA)) { 3466 error = EINVAL; 3467 goto fail; 3468 } 3469 sa0 = (const struct sadb_sa *)mhp->ext[SADB_EXT_SA]; 3470 sav->alg_auth = sa0->sadb_sa_auth; 3471 sav->alg_enc = sa0->sadb_sa_encrypt; 3472 sav->flags = sa0->sadb_sa_flags; 3473 if ((sav->flags & SADB_KEY_FLAGS_MAX) != sav->flags) { 3474 ipseclog((LOG_DEBUG, 3475 "%s: invalid sa_flags 0x%08x.\n", __func__, 3476 sav->flags)); 3477 error = EINVAL; 3478 goto fail; 3479 } 3480 3481 /* Optional replay window */ 3482 replay = 0; 3483 if ((sa0->sadb_sa_flags & SADB_X_EXT_OLD) == 0) 3484 replay = sa0->sadb_sa_replay; 3485 if (!SADB_CHECKHDR(mhp, SADB_X_EXT_SA_REPLAY)) { 3486 if (SADB_CHECKLEN(mhp, SADB_X_EXT_SA_REPLAY)) { 3487 error = EINVAL; 3488 goto fail; 3489 } 3490 replay = ((const struct sadb_x_sa_replay *) 3491 mhp->ext[SADB_X_EXT_SA_REPLAY])->sadb_x_sa_replay_replay; 3492 3493 if (replay > UINT32_MAX - 32) { 3494 ipseclog((LOG_DEBUG, 3495 "%s: replay window too big.\n", __func__)); 3496 error = EINVAL; 3497 goto fail; 3498 } 3499 3500 replay = (replay + 7) >> 3; 3501 } 3502 3503 sav->replay = malloc(sizeof(struct secreplay), M_IPSEC_MISC, 3504 M_NOWAIT | M_ZERO); 3505 if (sav->replay == NULL) { 3506 PFKEYSTAT_INC(in_nomem); 3507 ipseclog((LOG_DEBUG, "%s: No more memory.\n", 3508 __func__)); 3509 error = ENOBUFS; 3510 goto fail; 3511 } 3512 mtx_init(&sav->replay->lock, "ipsec replay", NULL, MTX_DEF); 3513 3514 if (replay != 0) { 3515 /* number of 32b blocks to be allocated */ 3516 uint32_t bitmap_size; 3517 3518 /* RFC 6479: 3519 * - the allocated replay window size must be 3520 * a power of two. 3521 * - use an extra 32b block as a redundant window. 3522 */ 3523 bitmap_size = 1; 3524 while (replay + 4 > bitmap_size) 3525 bitmap_size <<= 1; 3526 bitmap_size = bitmap_size / 4; 3527 3528 sav->replay->bitmap = malloc( 3529 bitmap_size * sizeof(uint32_t), M_IPSEC_MISC, 3530 M_NOWAIT | M_ZERO); 3531 if (sav->replay->bitmap == NULL) { 3532 PFKEYSTAT_INC(in_nomem); 3533 ipseclog((LOG_DEBUG, "%s: No more memory.\n", 3534 __func__)); 3535 error = ENOBUFS; 3536 goto fail; 3537 } 3538 sav->replay->bitmap_size = bitmap_size; 3539 sav->replay->wsize = replay; 3540 } 3541 } 3542 3543 /* Authentication keys */ 3544 if (!SADB_CHECKHDR(mhp, SADB_EXT_KEY_AUTH)) { 3545 if (SADB_CHECKLEN(mhp, SADB_EXT_KEY_AUTH)) { 3546 error = EINVAL; 3547 goto fail; 3548 } 3549 error = 0; 3550 key0 = (const struct sadb_key *)mhp->ext[SADB_EXT_KEY_AUTH]; 3551 len = mhp->extlen[SADB_EXT_KEY_AUTH]; 3552 switch (mhp->msg->sadb_msg_satype) { 3553 case SADB_SATYPE_AH: 3554 case SADB_SATYPE_ESP: 3555 case SADB_X_SATYPE_TCPSIGNATURE: 3556 if (len == PFKEY_ALIGN8(sizeof(struct sadb_key)) && 3557 sav->alg_auth != SADB_X_AALG_NULL) 3558 error = EINVAL; 3559 break; 3560 case SADB_X_SATYPE_IPCOMP: 3561 default: 3562 error = EINVAL; 3563 break; 3564 } 3565 if (error) { 3566 ipseclog((LOG_DEBUG, "%s: invalid key_auth values.\n", 3567 __func__)); 3568 goto fail; 3569 } 3570 3571 sav->key_auth = key_dup_keymsg(key0, len, M_IPSEC_MISC); 3572 if (sav->key_auth == NULL ) { 3573 ipseclog((LOG_DEBUG, "%s: No more memory.\n", 3574 __func__)); 3575 PFKEYSTAT_INC(in_nomem); 3576 error = ENOBUFS; 3577 goto fail; 3578 } 3579 } 3580 3581 /* Encryption key */ 3582 if (!SADB_CHECKHDR(mhp, SADB_EXT_KEY_ENCRYPT)) { 3583 if (SADB_CHECKLEN(mhp, SADB_EXT_KEY_ENCRYPT)) { 3584 error = EINVAL; 3585 goto fail; 3586 } 3587 error = 0; 3588 key0 = (const struct sadb_key *)mhp->ext[SADB_EXT_KEY_ENCRYPT]; 3589 len = mhp->extlen[SADB_EXT_KEY_ENCRYPT]; 3590 switch (mhp->msg->sadb_msg_satype) { 3591 case SADB_SATYPE_ESP: 3592 if (len == PFKEY_ALIGN8(sizeof(struct sadb_key)) && 3593 sav->alg_enc != SADB_EALG_NULL) { 3594 error = EINVAL; 3595 break; 3596 } 3597 sav->key_enc = key_dup_keymsg(key0, len, M_IPSEC_MISC); 3598 if (sav->key_enc == NULL) { 3599 ipseclog((LOG_DEBUG, "%s: No more memory.\n", 3600 __func__)); 3601 PFKEYSTAT_INC(in_nomem); 3602 error = ENOBUFS; 3603 goto fail; 3604 } 3605 break; 3606 case SADB_X_SATYPE_IPCOMP: 3607 if (len != PFKEY_ALIGN8(sizeof(struct sadb_key))) 3608 error = EINVAL; 3609 sav->key_enc = NULL; /*just in case*/ 3610 break; 3611 case SADB_SATYPE_AH: 3612 case SADB_X_SATYPE_TCPSIGNATURE: 3613 default: 3614 error = EINVAL; 3615 break; 3616 } 3617 if (error) { 3618 ipseclog((LOG_DEBUG, "%s: invalid key_enc value.\n", 3619 __func__)); 3620 goto fail; 3621 } 3622 } 3623 3624 /* set iv */ 3625 sav->ivlen = 0; 3626 switch (mhp->msg->sadb_msg_satype) { 3627 case SADB_SATYPE_AH: 3628 if (sav->flags & SADB_X_EXT_DERIV) { 3629 ipseclog((LOG_DEBUG, "%s: invalid flag (derived) " 3630 "given to AH SA.\n", __func__)); 3631 error = EINVAL; 3632 goto fail; 3633 } 3634 if (sav->alg_enc != SADB_EALG_NONE) { 3635 ipseclog((LOG_DEBUG, "%s: protocol and algorithm " 3636 "mismated.\n", __func__)); 3637 error = EINVAL; 3638 goto fail; 3639 } 3640 error = xform_init(sav, XF_AH); 3641 break; 3642 case SADB_SATYPE_ESP: 3643 if ((sav->flags & (SADB_X_EXT_OLD | SADB_X_EXT_DERIV)) == 3644 (SADB_X_EXT_OLD | SADB_X_EXT_DERIV)) { 3645 ipseclog((LOG_DEBUG, "%s: invalid flag (derived) " 3646 "given to old-esp.\n", __func__)); 3647 error = EINVAL; 3648 goto fail; 3649 } 3650 error = xform_init(sav, XF_ESP); 3651 break; 3652 case SADB_X_SATYPE_IPCOMP: 3653 if (sav->alg_auth != SADB_AALG_NONE) { 3654 ipseclog((LOG_DEBUG, "%s: protocol and algorithm " 3655 "mismated.\n", __func__)); 3656 error = EINVAL; 3657 goto fail; 3658 } 3659 if ((sav->flags & SADB_X_EXT_RAWCPI) == 0 && 3660 ntohl(sav->spi) >= 0x10000) { 3661 ipseclog((LOG_DEBUG, "%s: invalid cpi for IPComp.\n", 3662 __func__)); 3663 error = EINVAL; 3664 goto fail; 3665 } 3666 error = xform_init(sav, XF_IPCOMP); 3667 break; 3668 case SADB_X_SATYPE_TCPSIGNATURE: 3669 if (sav->alg_enc != SADB_EALG_NONE) { 3670 ipseclog((LOG_DEBUG, "%s: protocol and algorithm " 3671 "mismated.\n", __func__)); 3672 error = EINVAL; 3673 goto fail; 3674 } 3675 error = xform_init(sav, XF_TCPSIGNATURE); 3676 break; 3677 default: 3678 ipseclog((LOG_DEBUG, "%s: Invalid satype.\n", __func__)); 3679 error = EPROTONOSUPPORT; 3680 goto fail; 3681 } 3682 if (error) { 3683 ipseclog((LOG_DEBUG, "%s: unable to initialize SA type %u.\n", 3684 __func__, mhp->msg->sadb_msg_satype)); 3685 goto fail; 3686 } 3687 3688 /* Handle NAT-T headers */ 3689 error = key_setnatt(sav, mhp); 3690 if (error != 0) 3691 goto fail; 3692 3693 /* Initialize lifetime for CURRENT */ 3694 sav->firstused = 0; 3695 sav->created = time_second; 3696 3697 /* lifetimes for HARD and SOFT */ 3698 error = key_updatelifetimes(sav, mhp); 3699 if (error == 0) 3700 return (0); 3701 fail: 3702 key_cleansav(sav); 3703 return (error); 3704 } 3705 3706 /* 3707 * subroutine for SADB_GET and SADB_DUMP. 3708 */ 3709 static struct mbuf * 3710 key_setdumpsa(struct secasvar *sav, uint8_t type, uint8_t satype, 3711 uint32_t seq, uint32_t pid, struct rm_priotracker *sahtree_trackerp) 3712 { 3713 struct seclifetime lft_c; 3714 struct mbuf *result = NULL, *tres = NULL, *m; 3715 int i, dumporder[] = { 3716 SADB_EXT_SA, SADB_X_EXT_SA2, SADB_X_EXT_SA_REPLAY, 3717 SADB_EXT_LIFETIME_HARD, SADB_EXT_LIFETIME_SOFT, 3718 SADB_EXT_LIFETIME_CURRENT, SADB_EXT_ADDRESS_SRC, 3719 SADB_EXT_ADDRESS_DST, SADB_EXT_ADDRESS_PROXY, 3720 SADB_EXT_KEY_AUTH, SADB_EXT_KEY_ENCRYPT, 3721 SADB_EXT_IDENTITY_SRC, SADB_EXT_IDENTITY_DST, 3722 SADB_EXT_SENSITIVITY, 3723 SADB_X_EXT_NAT_T_TYPE, 3724 SADB_X_EXT_NAT_T_SPORT, SADB_X_EXT_NAT_T_DPORT, 3725 SADB_X_EXT_NAT_T_OAI, SADB_X_EXT_NAT_T_OAR, 3726 SADB_X_EXT_NAT_T_FRAG, 3727 #ifdef IPSEC_OFFLOAD 3728 SADB_X_EXT_LFT_CUR_SW_OFFL, SADB_X_EXT_LFT_CUR_HW_OFFL, 3729 SADB_X_EXT_IF_HW_OFFL, 3730 #endif 3731 }; 3732 uint32_t replay_count; 3733 #ifdef IPSEC_OFFLOAD 3734 int error; 3735 #endif 3736 3737 SECASVAR_RLOCK_TRACKER; 3738 3739 m = key_setsadbmsg(type, 0, satype, seq, pid, sav->refcnt); 3740 if (m == NULL) 3741 goto fail; 3742 result = m; 3743 3744 for (i = nitems(dumporder) - 1; i >= 0; i--) { 3745 m = NULL; 3746 switch (dumporder[i]) { 3747 case SADB_EXT_SA: 3748 m = key_setsadbsa(sav); 3749 if (!m) 3750 goto fail; 3751 break; 3752 3753 case SADB_X_EXT_SA2: { 3754 SECASVAR_RLOCK(sav); 3755 replay_count = sav->replay ? sav->replay->count : 0; 3756 SECASVAR_RUNLOCK(sav); 3757 m = key_setsadbxsa2(sav->sah->saidx.mode, replay_count, 3758 sav->sah->saidx.reqid); 3759 if (!m) 3760 goto fail; 3761 break; 3762 } 3763 case SADB_X_EXT_SA_REPLAY: 3764 if (sav->replay == NULL || 3765 sav->replay->wsize <= UINT8_MAX) 3766 continue; 3767 3768 m = key_setsadbxsareplay(sav->replay->wsize); 3769 if (!m) 3770 goto fail; 3771 break; 3772 3773 case SADB_EXT_ADDRESS_SRC: 3774 m = key_setsadbaddr(SADB_EXT_ADDRESS_SRC, 3775 &sav->sah->saidx.src.sa, 3776 FULLMASK, IPSEC_ULPROTO_ANY); 3777 if (!m) 3778 goto fail; 3779 break; 3780 3781 case SADB_EXT_ADDRESS_DST: 3782 m = key_setsadbaddr(SADB_EXT_ADDRESS_DST, 3783 &sav->sah->saidx.dst.sa, 3784 FULLMASK, IPSEC_ULPROTO_ANY); 3785 if (!m) 3786 goto fail; 3787 break; 3788 3789 case SADB_EXT_KEY_AUTH: 3790 if (!sav->key_auth) 3791 continue; 3792 m = key_setkey(sav->key_auth, SADB_EXT_KEY_AUTH); 3793 if (!m) 3794 goto fail; 3795 break; 3796 3797 case SADB_EXT_KEY_ENCRYPT: 3798 if (!sav->key_enc) 3799 continue; 3800 m = key_setkey(sav->key_enc, SADB_EXT_KEY_ENCRYPT); 3801 if (!m) 3802 goto fail; 3803 break; 3804 3805 case SADB_EXT_LIFETIME_CURRENT: 3806 lft_c.addtime = sav->created; 3807 lft_c.allocations = (uint32_t)counter_u64_fetch( 3808 sav->lft_c_allocations); 3809 lft_c.bytes = counter_u64_fetch(sav->lft_c_bytes); 3810 lft_c.usetime = sav->firstused; 3811 m = key_setlifetime(&lft_c, SADB_EXT_LIFETIME_CURRENT); 3812 if (!m) 3813 goto fail; 3814 break; 3815 3816 case SADB_EXT_LIFETIME_HARD: 3817 if (!sav->lft_h) 3818 continue; 3819 m = key_setlifetime(sav->lft_h, 3820 SADB_EXT_LIFETIME_HARD); 3821 if (!m) 3822 goto fail; 3823 break; 3824 3825 case SADB_EXT_LIFETIME_SOFT: 3826 if (!sav->lft_s) 3827 continue; 3828 m = key_setlifetime(sav->lft_s, 3829 SADB_EXT_LIFETIME_SOFT); 3830 3831 if (!m) 3832 goto fail; 3833 break; 3834 3835 case SADB_X_EXT_NAT_T_TYPE: 3836 if (sav->natt == NULL) 3837 continue; 3838 m = key_setsadbxtype(UDP_ENCAP_ESPINUDP); 3839 if (!m) 3840 goto fail; 3841 break; 3842 3843 case SADB_X_EXT_NAT_T_DPORT: 3844 if (sav->natt == NULL) 3845 continue; 3846 m = key_setsadbxport(sav->natt->dport, 3847 SADB_X_EXT_NAT_T_DPORT); 3848 if (!m) 3849 goto fail; 3850 break; 3851 3852 case SADB_X_EXT_NAT_T_SPORT: 3853 if (sav->natt == NULL) 3854 continue; 3855 m = key_setsadbxport(sav->natt->sport, 3856 SADB_X_EXT_NAT_T_SPORT); 3857 if (!m) 3858 goto fail; 3859 break; 3860 3861 case SADB_X_EXT_NAT_T_OAI: 3862 if (sav->natt == NULL || 3863 (sav->natt->flags & IPSEC_NATT_F_OAI) == 0) 3864 continue; 3865 m = key_setsadbaddr(SADB_X_EXT_NAT_T_OAI, 3866 &sav->natt->oai.sa, FULLMASK, IPSEC_ULPROTO_ANY); 3867 if (!m) 3868 goto fail; 3869 break; 3870 case SADB_X_EXT_NAT_T_OAR: 3871 if (sav->natt == NULL || 3872 (sav->natt->flags & IPSEC_NATT_F_OAR) == 0) 3873 continue; 3874 m = key_setsadbaddr(SADB_X_EXT_NAT_T_OAR, 3875 &sav->natt->oar.sa, FULLMASK, IPSEC_ULPROTO_ANY); 3876 if (!m) 3877 goto fail; 3878 break; 3879 case SADB_X_EXT_NAT_T_FRAG: 3880 /* We do not (yet) support those. */ 3881 continue; 3882 #ifdef IPSEC_OFFLOAD 3883 case SADB_X_EXT_LFT_CUR_SW_OFFL: 3884 if (!ipsec_accel_is_accel_sav(sav)) 3885 continue; 3886 SAV_ADDREF(sav); 3887 error = ipsec_accel_sa_lifetime_op(sav, &lft_c, 3888 NULL, IF_SA_CNT_TOTAL_SW_VAL, sahtree_trackerp); 3889 if (error != 0) { 3890 m = NULL; 3891 goto fail; 3892 } 3893 m = key_setlifetime(&lft_c, dumporder[i]); 3894 if (m == NULL) 3895 goto fail; 3896 key_freesav(&sav); 3897 if (sav == NULL) { 3898 m_freem(m); 3899 goto fail; 3900 } 3901 break; 3902 case SADB_X_EXT_LFT_CUR_HW_OFFL: 3903 if (!ipsec_accel_is_accel_sav(sav)) 3904 continue; 3905 memset(&lft_c, 0, sizeof(lft_c)); 3906 lft_c.bytes = sav->accel_hw_octets; 3907 lft_c.allocations = sav->accel_hw_allocs; 3908 m = key_setlifetime(&lft_c, dumporder[i]); 3909 if (m == NULL) 3910 goto fail; 3911 break; 3912 case SADB_X_EXT_IF_HW_OFFL: 3913 if (!ipsec_accel_is_accel_sav(sav)) 3914 continue; 3915 m = ipsec_accel_key_setaccelif(sav); 3916 if (m == NULL) 3917 continue; /* benigh */ 3918 break; 3919 #endif 3920 3921 case SADB_EXT_ADDRESS_PROXY: 3922 case SADB_EXT_IDENTITY_SRC: 3923 case SADB_EXT_IDENTITY_DST: 3924 /* XXX: should we brought from SPD ? */ 3925 case SADB_EXT_SENSITIVITY: 3926 default: 3927 continue; 3928 } 3929 3930 if (!m) 3931 goto fail; 3932 if (tres) 3933 m_cat(m, tres); 3934 tres = m; 3935 } 3936 3937 m_cat(result, tres); 3938 tres = NULL; 3939 if (result->m_len < sizeof(struct sadb_msg)) { 3940 result = m_pullup(result, sizeof(struct sadb_msg)); 3941 if (result == NULL) 3942 goto fail; 3943 } 3944 3945 result->m_pkthdr.len = 0; 3946 for (m = result; m; m = m->m_next) 3947 result->m_pkthdr.len += m->m_len; 3948 3949 mtod(result, struct sadb_msg *)->sadb_msg_len = 3950 PFKEY_UNIT64(result->m_pkthdr.len); 3951 3952 return result; 3953 3954 fail: 3955 m_freem(result); 3956 m_freem(tres); 3957 return NULL; 3958 } 3959 3960 /* 3961 * set data into sadb_msg. 3962 */ 3963 static struct mbuf * 3964 key_setsadbmsg(u_int8_t type, u_int16_t tlen, u_int8_t satype, u_int32_t seq, 3965 pid_t pid, u_int16_t reserved) 3966 { 3967 struct mbuf *m; 3968 struct sadb_msg *p; 3969 int len; 3970 3971 len = PFKEY_ALIGN8(sizeof(struct sadb_msg)); 3972 if (len > MCLBYTES) 3973 return NULL; 3974 m = key_mget(len); 3975 if (m == NULL) 3976 return NULL; 3977 m->m_pkthdr.len = m->m_len = len; 3978 m->m_next = NULL; 3979 3980 p = mtod(m, struct sadb_msg *); 3981 3982 bzero(p, len); 3983 p->sadb_msg_version = PF_KEY_V2; 3984 p->sadb_msg_type = type; 3985 p->sadb_msg_errno = 0; 3986 p->sadb_msg_satype = satype; 3987 p->sadb_msg_len = PFKEY_UNIT64(tlen); 3988 p->sadb_msg_reserved = reserved; 3989 p->sadb_msg_seq = seq; 3990 p->sadb_msg_pid = (u_int32_t)pid; 3991 3992 return m; 3993 } 3994 3995 /* 3996 * copy secasvar data into sadb_address. 3997 */ 3998 static struct mbuf * 3999 key_setsadbsa(struct secasvar *sav) 4000 { 4001 struct mbuf *m; 4002 struct sadb_sa *p; 4003 int len; 4004 4005 len = PFKEY_ALIGN8(sizeof(struct sadb_sa)); 4006 m = m_get2(len, M_NOWAIT, MT_DATA, 0); 4007 if (m == NULL) 4008 return (NULL); 4009 m_align(m, len); 4010 m->m_len = len; 4011 p = mtod(m, struct sadb_sa *); 4012 bzero(p, len); 4013 p->sadb_sa_len = PFKEY_UNIT64(len); 4014 p->sadb_sa_exttype = SADB_EXT_SA; 4015 p->sadb_sa_spi = sav->spi; 4016 p->sadb_sa_replay = sav->replay ? 4017 (sav->replay->wsize > UINT8_MAX ? UINT8_MAX : 4018 sav->replay->wsize): 0; 4019 p->sadb_sa_state = sav->state; 4020 p->sadb_sa_auth = sav->alg_auth; 4021 p->sadb_sa_encrypt = sav->alg_enc; 4022 p->sadb_sa_flags = sav->flags & SADB_KEY_FLAGS_MAX; 4023 return (m); 4024 } 4025 4026 /* 4027 * set data into sadb_address. 4028 */ 4029 static struct mbuf * 4030 key_setsadbaddr(u_int16_t exttype, const struct sockaddr *saddr, 4031 u_int8_t prefixlen, u_int16_t ul_proto) 4032 { 4033 struct mbuf *m; 4034 struct sadb_address *p; 4035 size_t len; 4036 4037 len = PFKEY_ALIGN8(sizeof(struct sadb_address)) + 4038 PFKEY_ALIGN8(saddr->sa_len); 4039 m = m_get2(len, M_NOWAIT, MT_DATA, 0); 4040 if (m == NULL) 4041 return (NULL); 4042 m_align(m, len); 4043 m->m_len = len; 4044 p = mtod(m, struct sadb_address *); 4045 4046 bzero(p, len); 4047 p->sadb_address_len = PFKEY_UNIT64(len); 4048 p->sadb_address_exttype = exttype; 4049 p->sadb_address_proto = ul_proto; 4050 if (prefixlen == FULLMASK) { 4051 switch (saddr->sa_family) { 4052 case AF_INET: 4053 prefixlen = sizeof(struct in_addr) << 3; 4054 break; 4055 case AF_INET6: 4056 prefixlen = sizeof(struct in6_addr) << 3; 4057 break; 4058 default: 4059 ; /*XXX*/ 4060 } 4061 } 4062 p->sadb_address_prefixlen = prefixlen; 4063 p->sadb_address_reserved = 0; 4064 4065 bcopy(saddr, 4066 mtod(m, caddr_t) + PFKEY_ALIGN8(sizeof(struct sadb_address)), 4067 saddr->sa_len); 4068 4069 return m; 4070 } 4071 4072 /* 4073 * set data into sadb_x_sa2. 4074 */ 4075 static struct mbuf * 4076 key_setsadbxsa2(u_int8_t mode, u_int32_t seq, u_int32_t reqid) 4077 { 4078 struct mbuf *m; 4079 struct sadb_x_sa2 *p; 4080 size_t len; 4081 4082 len = PFKEY_ALIGN8(sizeof(struct sadb_x_sa2)); 4083 m = m_get2(len, M_NOWAIT, MT_DATA, 0); 4084 if (m == NULL) 4085 return (NULL); 4086 m_align(m, len); 4087 m->m_len = len; 4088 p = mtod(m, struct sadb_x_sa2 *); 4089 4090 bzero(p, len); 4091 p->sadb_x_sa2_len = PFKEY_UNIT64(len); 4092 p->sadb_x_sa2_exttype = SADB_X_EXT_SA2; 4093 p->sadb_x_sa2_mode = mode; 4094 p->sadb_x_sa2_reserved1 = 0; 4095 p->sadb_x_sa2_reserved2 = 0; 4096 p->sadb_x_sa2_sequence = seq; 4097 p->sadb_x_sa2_reqid = reqid; 4098 4099 return m; 4100 } 4101 4102 /* 4103 * Set data into sadb_x_sa_replay. 4104 */ 4105 static struct mbuf * 4106 key_setsadbxsareplay(u_int32_t replay) 4107 { 4108 struct mbuf *m; 4109 struct sadb_x_sa_replay *p; 4110 size_t len; 4111 4112 len = PFKEY_ALIGN8(sizeof(struct sadb_x_sa_replay)); 4113 m = m_get2(len, M_NOWAIT, MT_DATA, 0); 4114 if (m == NULL) 4115 return (NULL); 4116 m_align(m, len); 4117 m->m_len = len; 4118 p = mtod(m, struct sadb_x_sa_replay *); 4119 4120 bzero(p, len); 4121 p->sadb_x_sa_replay_len = PFKEY_UNIT64(len); 4122 p->sadb_x_sa_replay_exttype = SADB_X_EXT_SA_REPLAY; 4123 p->sadb_x_sa_replay_replay = (replay << 3); 4124 4125 return m; 4126 } 4127 4128 /* 4129 * Set a type in sadb_x_nat_t_type. 4130 */ 4131 static struct mbuf * 4132 key_setsadbxtype(u_int16_t type) 4133 { 4134 struct mbuf *m; 4135 size_t len; 4136 struct sadb_x_nat_t_type *p; 4137 4138 len = PFKEY_ALIGN8(sizeof(struct sadb_x_nat_t_type)); 4139 4140 m = m_get2(len, M_NOWAIT, MT_DATA, 0); 4141 if (m == NULL) 4142 return (NULL); 4143 m_align(m, len); 4144 m->m_len = len; 4145 p = mtod(m, struct sadb_x_nat_t_type *); 4146 4147 bzero(p, len); 4148 p->sadb_x_nat_t_type_len = PFKEY_UNIT64(len); 4149 p->sadb_x_nat_t_type_exttype = SADB_X_EXT_NAT_T_TYPE; 4150 p->sadb_x_nat_t_type_type = type; 4151 4152 return (m); 4153 } 4154 /* 4155 * Set a port in sadb_x_nat_t_port. 4156 * In contrast to default RFC 2367 behaviour, port is in network byte order. 4157 */ 4158 static struct mbuf * 4159 key_setsadbxport(u_int16_t port, u_int16_t type) 4160 { 4161 struct mbuf *m; 4162 size_t len; 4163 struct sadb_x_nat_t_port *p; 4164 4165 len = PFKEY_ALIGN8(sizeof(struct sadb_x_nat_t_port)); 4166 4167 m = m_get2(len, M_NOWAIT, MT_DATA, 0); 4168 if (m == NULL) 4169 return (NULL); 4170 m_align(m, len); 4171 m->m_len = len; 4172 p = mtod(m, struct sadb_x_nat_t_port *); 4173 4174 bzero(p, len); 4175 p->sadb_x_nat_t_port_len = PFKEY_UNIT64(len); 4176 p->sadb_x_nat_t_port_exttype = type; 4177 p->sadb_x_nat_t_port_port = port; 4178 4179 return (m); 4180 } 4181 4182 /* 4183 * Get port from sockaddr. Port is in network byte order. 4184 */ 4185 uint16_t 4186 key_portfromsaddr(struct sockaddr *sa) 4187 { 4188 4189 switch (sa->sa_family) { 4190 #ifdef INET 4191 case AF_INET: 4192 return ((struct sockaddr_in *)sa)->sin_port; 4193 #endif 4194 #ifdef INET6 4195 case AF_INET6: 4196 return ((struct sockaddr_in6 *)sa)->sin6_port; 4197 #endif 4198 } 4199 return (0); 4200 } 4201 4202 /* 4203 * Set port in struct sockaddr. Port is in network byte order. 4204 */ 4205 void 4206 key_porttosaddr(struct sockaddr *sa, uint16_t port) 4207 { 4208 4209 switch (sa->sa_family) { 4210 #ifdef INET 4211 case AF_INET: 4212 ((struct sockaddr_in *)sa)->sin_port = port; 4213 break; 4214 #endif 4215 #ifdef INET6 4216 case AF_INET6: 4217 ((struct sockaddr_in6 *)sa)->sin6_port = port; 4218 break; 4219 #endif 4220 default: 4221 ipseclog((LOG_DEBUG, "%s: unexpected address family %d.\n", 4222 __func__, sa->sa_family)); 4223 break; 4224 } 4225 } 4226 4227 /* 4228 * set data into sadb_x_policy 4229 */ 4230 static struct mbuf * 4231 key_setsadbxpolicy(u_int16_t type, u_int8_t dir, u_int32_t id, u_int32_t priority) 4232 { 4233 struct mbuf *m; 4234 struct sadb_x_policy *p; 4235 size_t len; 4236 4237 len = PFKEY_ALIGN8(sizeof(struct sadb_x_policy)); 4238 m = m_get2(len, M_NOWAIT, MT_DATA, 0); 4239 if (m == NULL) 4240 return (NULL); 4241 m_align(m, len); 4242 m->m_len = len; 4243 p = mtod(m, struct sadb_x_policy *); 4244 4245 bzero(p, len); 4246 p->sadb_x_policy_len = PFKEY_UNIT64(len); 4247 p->sadb_x_policy_exttype = SADB_X_EXT_POLICY; 4248 p->sadb_x_policy_type = type; 4249 p->sadb_x_policy_dir = dir; 4250 p->sadb_x_policy_id = id; 4251 p->sadb_x_policy_priority = priority; 4252 4253 return m; 4254 } 4255 4256 /* %%% utilities */ 4257 /* Take a key message (sadb_key) from the socket and turn it into one 4258 * of the kernel's key structures (seckey). 4259 * 4260 * IN: pointer to the src 4261 * OUT: NULL no more memory 4262 */ 4263 struct seckey * 4264 key_dup_keymsg(const struct sadb_key *src, size_t len, 4265 struct malloc_type *type) 4266 { 4267 struct seckey *dst; 4268 4269 dst = malloc(sizeof(*dst), type, M_NOWAIT); 4270 if (dst != NULL) { 4271 dst->bits = src->sadb_key_bits; 4272 dst->key_data = malloc(len, type, M_NOWAIT); 4273 if (dst->key_data != NULL) { 4274 bcopy((const char *)(src + 1), dst->key_data, len); 4275 } else { 4276 ipseclog((LOG_DEBUG, "%s: No more memory.\n", 4277 __func__)); 4278 free(dst, type); 4279 dst = NULL; 4280 } 4281 } else { 4282 ipseclog((LOG_DEBUG, "%s: No more memory.\n", 4283 __func__)); 4284 } 4285 return (dst); 4286 } 4287 4288 /* Take a lifetime message (sadb_lifetime) passed in on a socket and 4289 * turn it into one of the kernel's lifetime structures (seclifetime). 4290 * 4291 * IN: pointer to the destination, source and malloc type 4292 * OUT: NULL, no more memory 4293 */ 4294 4295 static struct seclifetime * 4296 key_dup_lifemsg(const struct sadb_lifetime *src, struct malloc_type *type) 4297 { 4298 struct seclifetime *dst; 4299 4300 dst = malloc(sizeof(*dst), type, M_NOWAIT); 4301 if (dst == NULL) { 4302 ipseclog((LOG_DEBUG, "%s: No more memory.\n", __func__)); 4303 return (NULL); 4304 } 4305 dst->allocations = src->sadb_lifetime_allocations; 4306 dst->bytes = src->sadb_lifetime_bytes; 4307 dst->addtime = src->sadb_lifetime_addtime; 4308 dst->usetime = src->sadb_lifetime_usetime; 4309 return (dst); 4310 } 4311 4312 /* 4313 * compare two secasindex structure. 4314 * flag can specify to compare 2 saidxes. 4315 * compare two secasindex structure without both mode and reqid. 4316 * don't compare port. 4317 * IN: 4318 * saidx0: source, it can be in SAD. 4319 * saidx1: object. 4320 * OUT: 4321 * 1 : equal 4322 * 0 : not equal 4323 */ 4324 static int 4325 key_cmpsaidx(const struct secasindex *saidx0, const struct secasindex *saidx1, 4326 int flag) 4327 { 4328 4329 /* sanity */ 4330 if (saidx0 == NULL && saidx1 == NULL) 4331 return 1; 4332 4333 if (saidx0 == NULL || saidx1 == NULL) 4334 return 0; 4335 4336 if (saidx0->proto != saidx1->proto) 4337 return 0; 4338 4339 if (flag == CMP_EXACTLY) { 4340 if (saidx0->mode != saidx1->mode) 4341 return 0; 4342 if (saidx0->reqid != saidx1->reqid) 4343 return 0; 4344 if (bcmp(&saidx0->src, &saidx1->src, 4345 saidx0->src.sa.sa_len) != 0 || 4346 bcmp(&saidx0->dst, &saidx1->dst, 4347 saidx0->dst.sa.sa_len) != 0) 4348 return 0; 4349 } else { 4350 /* CMP_MODE_REQID, CMP_REQID, CMP_HEAD */ 4351 if (flag == CMP_MODE_REQID || flag == CMP_REQID) { 4352 /* 4353 * If reqid of SPD is non-zero, unique SA is required. 4354 * The result must be of same reqid in this case. 4355 */ 4356 if (saidx1->reqid != 0 && 4357 saidx0->reqid != saidx1->reqid) 4358 return 0; 4359 } 4360 4361 if (flag == CMP_MODE_REQID) { 4362 if (saidx0->mode != IPSEC_MODE_ANY 4363 && saidx0->mode != saidx1->mode) 4364 return 0; 4365 } 4366 4367 if (key_sockaddrcmp(&saidx0->src.sa, &saidx1->src.sa, 0) != 0) 4368 return 0; 4369 if (key_sockaddrcmp(&saidx0->dst.sa, &saidx1->dst.sa, 0) != 0) 4370 return 0; 4371 } 4372 4373 return 1; 4374 } 4375 4376 /* 4377 * compare two secindex structure exactly. 4378 * IN: 4379 * spidx0: source, it is often in SPD. 4380 * spidx1: object, it is often from PFKEY message. 4381 * OUT: 4382 * 1 : equal 4383 * 0 : not equal 4384 */ 4385 static int 4386 key_cmpspidx_exactly(struct secpolicyindex *spidx0, 4387 struct secpolicyindex *spidx1) 4388 { 4389 /* sanity */ 4390 if (spidx0 == NULL && spidx1 == NULL) 4391 return 1; 4392 4393 if (spidx0 == NULL || spidx1 == NULL) 4394 return 0; 4395 4396 if (spidx0->prefs != spidx1->prefs 4397 || spidx0->prefd != spidx1->prefd 4398 || spidx0->ul_proto != spidx1->ul_proto 4399 || spidx0->dir != spidx1->dir) 4400 return 0; 4401 4402 return key_sockaddrcmp(&spidx0->src.sa, &spidx1->src.sa, 1) == 0 && 4403 key_sockaddrcmp(&spidx0->dst.sa, &spidx1->dst.sa, 1) == 0; 4404 } 4405 4406 /* 4407 * compare two secindex structure with mask. 4408 * IN: 4409 * spidx0: source, it is often in SPD. 4410 * spidx1: object, it is often from IP header. 4411 * OUT: 4412 * 1 : equal 4413 * 0 : not equal 4414 */ 4415 static int 4416 key_cmpspidx_withmask(struct secpolicyindex *spidx0, 4417 struct secpolicyindex *spidx1) 4418 { 4419 /* sanity */ 4420 if (spidx0 == NULL && spidx1 == NULL) 4421 return 1; 4422 4423 if (spidx0 == NULL || spidx1 == NULL) 4424 return 0; 4425 4426 if (spidx0->src.sa.sa_family != spidx1->src.sa.sa_family || 4427 spidx0->dst.sa.sa_family != spidx1->dst.sa.sa_family || 4428 spidx0->src.sa.sa_len != spidx1->src.sa.sa_len || 4429 spidx0->dst.sa.sa_len != spidx1->dst.sa.sa_len) 4430 return 0; 4431 4432 /* if spidx.ul_proto == IPSEC_ULPROTO_ANY, ignore. */ 4433 if (spidx0->ul_proto != (u_int16_t)IPSEC_ULPROTO_ANY 4434 && spidx0->ul_proto != spidx1->ul_proto) 4435 return 0; 4436 4437 switch (spidx0->src.sa.sa_family) { 4438 case AF_INET: 4439 if (spidx0->src.sin.sin_port != IPSEC_PORT_ANY 4440 && spidx0->src.sin.sin_port != spidx1->src.sin.sin_port) 4441 return 0; 4442 if (!key_bbcmp(&spidx0->src.sin.sin_addr, 4443 &spidx1->src.sin.sin_addr, spidx0->prefs)) 4444 return 0; 4445 break; 4446 case AF_INET6: 4447 if (spidx0->src.sin6.sin6_port != IPSEC_PORT_ANY 4448 && spidx0->src.sin6.sin6_port != spidx1->src.sin6.sin6_port) 4449 return 0; 4450 /* 4451 * scope_id check. if sin6_scope_id is 0, we regard it 4452 * as a wildcard scope, which matches any scope zone ID. 4453 */ 4454 if (spidx0->src.sin6.sin6_scope_id && 4455 spidx1->src.sin6.sin6_scope_id && 4456 spidx0->src.sin6.sin6_scope_id != spidx1->src.sin6.sin6_scope_id) 4457 return 0; 4458 if (!key_bbcmp(&spidx0->src.sin6.sin6_addr, 4459 &spidx1->src.sin6.sin6_addr, spidx0->prefs)) 4460 return 0; 4461 break; 4462 default: 4463 /* XXX */ 4464 if (bcmp(&spidx0->src, &spidx1->src, spidx0->src.sa.sa_len) != 0) 4465 return 0; 4466 break; 4467 } 4468 4469 switch (spidx0->dst.sa.sa_family) { 4470 case AF_INET: 4471 if (spidx0->dst.sin.sin_port != IPSEC_PORT_ANY 4472 && spidx0->dst.sin.sin_port != spidx1->dst.sin.sin_port) 4473 return 0; 4474 if (!key_bbcmp(&spidx0->dst.sin.sin_addr, 4475 &spidx1->dst.sin.sin_addr, spidx0->prefd)) 4476 return 0; 4477 break; 4478 case AF_INET6: 4479 if (spidx0->dst.sin6.sin6_port != IPSEC_PORT_ANY 4480 && spidx0->dst.sin6.sin6_port != spidx1->dst.sin6.sin6_port) 4481 return 0; 4482 /* 4483 * scope_id check. if sin6_scope_id is 0, we regard it 4484 * as a wildcard scope, which matches any scope zone ID. 4485 */ 4486 if (spidx0->dst.sin6.sin6_scope_id && 4487 spidx1->dst.sin6.sin6_scope_id && 4488 spidx0->dst.sin6.sin6_scope_id != spidx1->dst.sin6.sin6_scope_id) 4489 return 0; 4490 if (!key_bbcmp(&spidx0->dst.sin6.sin6_addr, 4491 &spidx1->dst.sin6.sin6_addr, spidx0->prefd)) 4492 return 0; 4493 break; 4494 default: 4495 /* XXX */ 4496 if (bcmp(&spidx0->dst, &spidx1->dst, spidx0->dst.sa.sa_len) != 0) 4497 return 0; 4498 break; 4499 } 4500 4501 /* XXX Do we check other field ? e.g. flowinfo */ 4502 4503 return 1; 4504 } 4505 4506 #ifdef satosin 4507 #undef satosin 4508 #endif 4509 #define satosin(s) ((const struct sockaddr_in *)s) 4510 #ifdef satosin6 4511 #undef satosin6 4512 #endif 4513 #define satosin6(s) ((const struct sockaddr_in6 *)s) 4514 /* returns 0 on match */ 4515 int 4516 key_sockaddrcmp(const struct sockaddr *sa1, const struct sockaddr *sa2, 4517 int port) 4518 { 4519 if (sa1->sa_family != sa2->sa_family || sa1->sa_len != sa2->sa_len) 4520 return 1; 4521 4522 switch (sa1->sa_family) { 4523 #ifdef INET 4524 case AF_INET: 4525 if (sa1->sa_len != sizeof(struct sockaddr_in)) 4526 return 1; 4527 if (satosin(sa1)->sin_addr.s_addr != 4528 satosin(sa2)->sin_addr.s_addr) { 4529 return 1; 4530 } 4531 if (port && satosin(sa1)->sin_port != satosin(sa2)->sin_port) 4532 return 1; 4533 break; 4534 #endif 4535 #ifdef INET6 4536 case AF_INET6: 4537 if (sa1->sa_len != sizeof(struct sockaddr_in6)) 4538 return 1; /*EINVAL*/ 4539 if (satosin6(sa1)->sin6_scope_id != 4540 satosin6(sa2)->sin6_scope_id) { 4541 return 1; 4542 } 4543 if (!IN6_ARE_ADDR_EQUAL(&satosin6(sa1)->sin6_addr, 4544 &satosin6(sa2)->sin6_addr)) { 4545 return 1; 4546 } 4547 if (port && 4548 satosin6(sa1)->sin6_port != satosin6(sa2)->sin6_port) { 4549 return 1; 4550 } 4551 break; 4552 #endif 4553 default: 4554 if (bcmp(sa1, sa2, sa1->sa_len) != 0) 4555 return 1; 4556 break; 4557 } 4558 4559 return 0; 4560 } 4561 4562 /* returns 0 on match */ 4563 int 4564 key_sockaddrcmp_withmask(const struct sockaddr *sa1, 4565 const struct sockaddr *sa2, size_t mask) 4566 { 4567 if (sa1->sa_family != sa2->sa_family || sa1->sa_len != sa2->sa_len) 4568 return (1); 4569 4570 switch (sa1->sa_family) { 4571 #ifdef INET 4572 case AF_INET: 4573 return (!key_bbcmp(&satosin(sa1)->sin_addr, 4574 &satosin(sa2)->sin_addr, mask)); 4575 #endif 4576 #ifdef INET6 4577 case AF_INET6: 4578 if (satosin6(sa1)->sin6_scope_id != 4579 satosin6(sa2)->sin6_scope_id) 4580 return (1); 4581 return (!key_bbcmp(&satosin6(sa1)->sin6_addr, 4582 &satosin6(sa2)->sin6_addr, mask)); 4583 #endif 4584 } 4585 return (1); 4586 } 4587 #undef satosin 4588 #undef satosin6 4589 4590 /* 4591 * compare two buffers with mask. 4592 * IN: 4593 * addr1: source 4594 * addr2: object 4595 * bits: Number of bits to compare 4596 * OUT: 4597 * 1 : equal 4598 * 0 : not equal 4599 */ 4600 static int 4601 key_bbcmp(const void *a1, const void *a2, u_int bits) 4602 { 4603 const unsigned char *p1 = a1; 4604 const unsigned char *p2 = a2; 4605 4606 /* XXX: This could be considerably faster if we compare a word 4607 * at a time, but it is complicated on LSB Endian machines */ 4608 4609 /* Handle null pointers */ 4610 if (p1 == NULL || p2 == NULL) 4611 return (p1 == p2); 4612 4613 while (bits >= 8) { 4614 if (*p1++ != *p2++) 4615 return 0; 4616 bits -= 8; 4617 } 4618 4619 if (bits > 0) { 4620 u_int8_t mask = ~((1<<(8-bits))-1); 4621 if ((*p1 & mask) != (*p2 & mask)) 4622 return 0; 4623 } 4624 return 1; /* Match! */ 4625 } 4626 4627 static void 4628 key_flush_spd(time_t now) 4629 { 4630 SPTREE_RLOCK_TRACKER; 4631 struct secpolicy_list drainq; 4632 struct secpolicy *sp, *nextsp; 4633 u_int dir; 4634 4635 LIST_INIT(&drainq); 4636 SPTREE_RLOCK(); 4637 for (dir = 0; dir < IPSEC_DIR_MAX; dir++) { 4638 TAILQ_FOREACH(sp, &V_sptree[dir], chain) { 4639 if (sp->lifetime == 0 && sp->validtime == 0) 4640 continue; 4641 if ((sp->lifetime && 4642 now - sp->created > sp->lifetime) || 4643 (sp->validtime && 4644 now - sp->lastused > sp->validtime)) { 4645 /* Hold extra reference to send SPDEXPIRE */ 4646 SP_ADDREF(sp); 4647 LIST_INSERT_HEAD(&drainq, sp, drainq); 4648 } 4649 } 4650 } 4651 SPTREE_RUNLOCK(); 4652 if (LIST_EMPTY(&drainq)) 4653 return; 4654 4655 SPTREE_WLOCK(); 4656 sp = LIST_FIRST(&drainq); 4657 while (sp != NULL) { 4658 nextsp = LIST_NEXT(sp, drainq); 4659 /* Check that SP is still linked */ 4660 if (sp->state != IPSEC_SPSTATE_ALIVE) { 4661 LIST_REMOVE(sp, drainq); 4662 key_freesp(&sp); /* release extra reference */ 4663 sp = nextsp; 4664 continue; 4665 } 4666 TAILQ_REMOVE(&V_sptree[sp->spidx.dir], sp, chain); 4667 V_spd_size--; 4668 LIST_REMOVE(sp, idhash); 4669 sp->state = IPSEC_SPSTATE_DEAD; 4670 ipsec_accel_spddel(sp); 4671 sp = nextsp; 4672 } 4673 V_sp_genid++; 4674 SPTREE_WUNLOCK(); 4675 if (SPDCACHE_ENABLED()) 4676 spdcache_clear(); 4677 4678 sp = LIST_FIRST(&drainq); 4679 while (sp != NULL) { 4680 nextsp = LIST_NEXT(sp, drainq); 4681 key_spdexpire(sp); 4682 key_freesp(&sp); /* release extra reference */ 4683 key_freesp(&sp); /* release last reference */ 4684 sp = nextsp; 4685 } 4686 } 4687 4688 static void 4689 key_flush_sad(time_t now) 4690 { 4691 SAHTREE_RLOCK_TRACKER; 4692 struct secashead_list emptyq; 4693 struct secasvar_list drainq, hexpireq, sexpireq, freeq; 4694 struct secashead *sah, *nextsah; 4695 struct secasvar *sav, *nextsav; 4696 4697 SECASVAR_RLOCK_TRACKER; 4698 4699 LIST_INIT(&drainq); 4700 LIST_INIT(&hexpireq); 4701 LIST_INIT(&sexpireq); 4702 LIST_INIT(&emptyq); 4703 4704 SAHTREE_RLOCK(); 4705 TAILQ_FOREACH(sah, &V_sahtree, chain) { 4706 /* Check for empty SAH */ 4707 if (TAILQ_EMPTY(&sah->savtree_larval) && 4708 TAILQ_EMPTY(&sah->savtree_alive)) { 4709 SAH_ADDREF(sah); 4710 LIST_INSERT_HEAD(&emptyq, sah, drainq); 4711 continue; 4712 } 4713 /* Add all stale LARVAL SAs into drainq */ 4714 TAILQ_FOREACH(sav, &sah->savtree_larval, chain) { 4715 if (now - sav->created < V_key_larval_lifetime) 4716 continue; 4717 SAV_ADDREF(sav); 4718 LIST_INSERT_HEAD(&drainq, sav, drainq); 4719 } 4720 TAILQ_FOREACH(sav, &sah->savtree_alive, chain) { 4721 /* lifetimes aren't specified */ 4722 if (sav->lft_h == NULL) 4723 continue; 4724 SECASVAR_RLOCK(sav); 4725 /* 4726 * Check again with lock held, because it may 4727 * be updated by SADB_UPDATE. 4728 */ 4729 if (sav->lft_h == NULL) { 4730 SECASVAR_RUNLOCK(sav); 4731 continue; 4732 } 4733 /* 4734 * RFC 2367: 4735 * HARD lifetimes MUST take precedence over SOFT 4736 * lifetimes, meaning if the HARD and SOFT lifetimes 4737 * are the same, the HARD lifetime will appear on the 4738 * EXPIRE message. 4739 */ 4740 /* check HARD lifetime */ 4741 if ((sav->lft_h->addtime != 0 && 4742 now - sav->created > sav->lft_h->addtime) || 4743 (sav->lft_h->usetime != 0 && sav->firstused && 4744 now - sav->firstused > sav->lft_h->usetime) || 4745 (sav->lft_h->bytes != 0 && counter_u64_fetch( 4746 sav->lft_c_bytes) > sav->lft_h->bytes)) { 4747 SECASVAR_RUNLOCK(sav); 4748 SAV_ADDREF(sav); 4749 LIST_INSERT_HEAD(&hexpireq, sav, drainq); 4750 continue; 4751 } 4752 /* check SOFT lifetime (only for MATURE SAs) */ 4753 if (sav->state == SADB_SASTATE_MATURE && ( 4754 (sav->lft_s->addtime != 0 && 4755 now - sav->created > sav->lft_s->addtime) || 4756 (sav->lft_s->usetime != 0 && sav->firstused && 4757 now - sav->firstused > sav->lft_s->usetime) || 4758 (sav->lft_s->bytes != 0 && counter_u64_fetch( 4759 sav->lft_c_bytes) > sav->lft_s->bytes) || 4760 (!(sav->flags & SADB_X_SAFLAGS_ESN) && 4761 (sav->replay != NULL) && ( 4762 (sav->replay->count > UINT32_80PCT) || 4763 (sav->replay->last > UINT32_80PCT))))) { 4764 SECASVAR_RUNLOCK(sav); 4765 SAV_ADDREF(sav); 4766 LIST_INSERT_HEAD(&sexpireq, sav, drainq); 4767 continue; 4768 } 4769 SECASVAR_RUNLOCK(sav); 4770 } 4771 } 4772 SAHTREE_RUNLOCK(); 4773 4774 if (LIST_EMPTY(&emptyq) && LIST_EMPTY(&drainq) && 4775 LIST_EMPTY(&hexpireq) && LIST_EMPTY(&sexpireq)) 4776 return; 4777 4778 LIST_INIT(&freeq); 4779 SAHTREE_WLOCK(); 4780 /* Unlink stale LARVAL SAs */ 4781 sav = LIST_FIRST(&drainq); 4782 while (sav != NULL) { 4783 nextsav = LIST_NEXT(sav, drainq); 4784 /* Check that SA is still LARVAL */ 4785 if (sav->state != SADB_SASTATE_LARVAL) { 4786 LIST_REMOVE(sav, drainq); 4787 LIST_INSERT_HEAD(&freeq, sav, drainq); 4788 sav = nextsav; 4789 continue; 4790 } 4791 TAILQ_REMOVE(&sav->sah->savtree_larval, sav, chain); 4792 LIST_REMOVE(sav, spihash); 4793 sav->state = SADB_SASTATE_DEAD; 4794 ipsec_accel_forget_sav(sav); 4795 sav = nextsav; 4796 } 4797 /* Unlink all SAs with expired HARD lifetime */ 4798 sav = LIST_FIRST(&hexpireq); 4799 while (sav != NULL) { 4800 nextsav = LIST_NEXT(sav, drainq); 4801 /* Check that SA is not unlinked */ 4802 if (sav->state == SADB_SASTATE_DEAD) { 4803 LIST_REMOVE(sav, drainq); 4804 LIST_INSERT_HEAD(&freeq, sav, drainq); 4805 sav = nextsav; 4806 continue; 4807 } 4808 TAILQ_REMOVE(&sav->sah->savtree_alive, sav, chain); 4809 LIST_REMOVE(sav, spihash); 4810 sav->state = SADB_SASTATE_DEAD; 4811 ipsec_accel_forget_sav(sav); 4812 sav = nextsav; 4813 } 4814 /* Mark all SAs with expired SOFT lifetime as DYING */ 4815 sav = LIST_FIRST(&sexpireq); 4816 while (sav != NULL) { 4817 nextsav = LIST_NEXT(sav, drainq); 4818 /* Check that SA is not unlinked */ 4819 if (sav->state == SADB_SASTATE_DEAD) { 4820 LIST_REMOVE(sav, drainq); 4821 LIST_INSERT_HEAD(&freeq, sav, drainq); 4822 sav = nextsav; 4823 continue; 4824 } 4825 /* 4826 * NOTE: this doesn't change SA order in the chain. 4827 */ 4828 sav->state = SADB_SASTATE_DYING; 4829 sav = nextsav; 4830 } 4831 /* Unlink empty SAHs */ 4832 sah = LIST_FIRST(&emptyq); 4833 while (sah != NULL) { 4834 nextsah = LIST_NEXT(sah, drainq); 4835 /* Check that SAH is still empty and not unlinked */ 4836 if (sah->state == SADB_SASTATE_DEAD || 4837 !TAILQ_EMPTY(&sah->savtree_larval) || 4838 !TAILQ_EMPTY(&sah->savtree_alive)) { 4839 LIST_REMOVE(sah, drainq); 4840 key_freesah(&sah); /* release extra reference */ 4841 sah = nextsah; 4842 continue; 4843 } 4844 TAILQ_REMOVE(&V_sahtree, sah, chain); 4845 LIST_REMOVE(sah, addrhash); 4846 sah->state = SADB_SASTATE_DEAD; 4847 sah = nextsah; 4848 } 4849 SAHTREE_WUNLOCK(); 4850 4851 /* Send SPDEXPIRE messages */ 4852 sav = LIST_FIRST(&hexpireq); 4853 while (sav != NULL) { 4854 nextsav = LIST_NEXT(sav, drainq); 4855 key_expire(sav, 1); 4856 key_freesah(&sav->sah); /* release reference from SAV */ 4857 key_freesav(&sav); /* release extra reference */ 4858 key_freesav(&sav); /* release last reference */ 4859 sav = nextsav; 4860 } 4861 sav = LIST_FIRST(&sexpireq); 4862 while (sav != NULL) { 4863 nextsav = LIST_NEXT(sav, drainq); 4864 key_expire(sav, 0); 4865 key_freesav(&sav); /* release extra reference */ 4866 sav = nextsav; 4867 } 4868 /* Free stale LARVAL SAs */ 4869 sav = LIST_FIRST(&drainq); 4870 while (sav != NULL) { 4871 nextsav = LIST_NEXT(sav, drainq); 4872 key_freesah(&sav->sah); /* release reference from SAV */ 4873 key_freesav(&sav); /* release extra reference */ 4874 key_freesav(&sav); /* release last reference */ 4875 sav = nextsav; 4876 } 4877 /* Free SAs that were unlinked/changed by someone else */ 4878 sav = LIST_FIRST(&freeq); 4879 while (sav != NULL) { 4880 nextsav = LIST_NEXT(sav, drainq); 4881 key_freesav(&sav); /* release extra reference */ 4882 sav = nextsav; 4883 } 4884 /* Free empty SAH */ 4885 sah = LIST_FIRST(&emptyq); 4886 while (sah != NULL) { 4887 nextsah = LIST_NEXT(sah, drainq); 4888 key_freesah(&sah); /* release extra reference */ 4889 key_freesah(&sah); /* release last reference */ 4890 sah = nextsah; 4891 } 4892 } 4893 4894 static void 4895 key_flush_acq(time_t now) 4896 { 4897 struct secacq *acq, *nextacq; 4898 4899 /* ACQ tree */ 4900 ACQ_LOCK(); 4901 acq = LIST_FIRST(&V_acqtree); 4902 while (acq != NULL) { 4903 nextacq = LIST_NEXT(acq, chain); 4904 if (now - acq->created > V_key_blockacq_lifetime) { 4905 LIST_REMOVE(acq, chain); 4906 LIST_REMOVE(acq, addrhash); 4907 LIST_REMOVE(acq, seqhash); 4908 free(acq, M_IPSEC_SAQ); 4909 } 4910 acq = nextacq; 4911 } 4912 ACQ_UNLOCK(); 4913 } 4914 4915 static void 4916 key_flush_spacq(time_t now) 4917 { 4918 struct secspacq *acq, *nextacq; 4919 4920 /* SP ACQ tree */ 4921 SPACQ_LOCK(); 4922 for (acq = LIST_FIRST(&V_spacqtree); acq != NULL; acq = nextacq) { 4923 nextacq = LIST_NEXT(acq, chain); 4924 if (now - acq->created > V_key_blockacq_lifetime 4925 && __LIST_CHAINED(acq)) { 4926 LIST_REMOVE(acq, chain); 4927 free(acq, M_IPSEC_SAQ); 4928 } 4929 } 4930 SPACQ_UNLOCK(); 4931 } 4932 4933 /* 4934 * time handler. 4935 * scanning SPD and SAD to check status for each entries, 4936 * and do to remove or to expire. 4937 * XXX: year 2038 problem may remain. 4938 */ 4939 static void 4940 key_timehandler(void *arg) 4941 { 4942 VNET_ITERATOR_DECL(vnet_iter); 4943 time_t now = time_second; 4944 4945 VNET_LIST_RLOCK_NOSLEEP(); 4946 VNET_FOREACH(vnet_iter) { 4947 CURVNET_SET(vnet_iter); 4948 key_flush_spd(now); 4949 key_flush_sad(now); 4950 key_flush_acq(now); 4951 key_flush_spacq(now); 4952 CURVNET_RESTORE(); 4953 } 4954 VNET_LIST_RUNLOCK_NOSLEEP(); 4955 4956 #ifndef IPSEC_DEBUG2 4957 /* do exchange to tick time !! */ 4958 callout_schedule(&key_timer, hz); 4959 #endif /* IPSEC_DEBUG2 */ 4960 } 4961 4962 u_long 4963 key_random(void) 4964 { 4965 u_long value; 4966 4967 arc4random_buf(&value, sizeof(value)); 4968 return value; 4969 } 4970 4971 /* 4972 * map SADB_SATYPE_* to IPPROTO_*. 4973 * if satype == SADB_SATYPE then satype is mapped to ~0. 4974 * OUT: 4975 * 0: invalid satype. 4976 */ 4977 static uint8_t 4978 key_satype2proto(uint8_t satype) 4979 { 4980 switch (satype) { 4981 case SADB_SATYPE_UNSPEC: 4982 return IPSEC_PROTO_ANY; 4983 case SADB_SATYPE_AH: 4984 return IPPROTO_AH; 4985 case SADB_SATYPE_ESP: 4986 return IPPROTO_ESP; 4987 case SADB_X_SATYPE_IPCOMP: 4988 return IPPROTO_IPCOMP; 4989 case SADB_X_SATYPE_TCPSIGNATURE: 4990 return IPPROTO_TCP; 4991 default: 4992 return 0; 4993 } 4994 /* NOTREACHED */ 4995 } 4996 4997 /* 4998 * map IPPROTO_* to SADB_SATYPE_* 4999 * OUT: 5000 * 0: invalid protocol type. 5001 */ 5002 static uint8_t 5003 key_proto2satype(uint8_t proto) 5004 { 5005 switch (proto) { 5006 case IPPROTO_AH: 5007 return SADB_SATYPE_AH; 5008 case IPPROTO_ESP: 5009 return SADB_SATYPE_ESP; 5010 case IPPROTO_IPCOMP: 5011 return SADB_X_SATYPE_IPCOMP; 5012 case IPPROTO_TCP: 5013 return SADB_X_SATYPE_TCPSIGNATURE; 5014 default: 5015 return 0; 5016 } 5017 /* NOTREACHED */ 5018 } 5019 5020 /* %%% PF_KEY */ 5021 /* 5022 * SADB_GETSPI processing is to receive 5023 * <base, (SA2), src address, dst address, (SPI range)> 5024 * from the IKMPd, to assign a unique spi value, to hang on the INBOUND 5025 * tree with the status of LARVAL, and send 5026 * <base, SA(*), address(SD)> 5027 * to the IKMPd. 5028 * 5029 * IN: mhp: pointer to the pointer to each header. 5030 * OUT: NULL if fail. 5031 * other if success, return pointer to the message to send. 5032 */ 5033 static int 5034 key_getspi(struct socket *so, struct mbuf *m, const struct sadb_msghdr *mhp) 5035 { 5036 struct secasindex saidx; 5037 struct sadb_address *src0, *dst0; 5038 struct secasvar *sav; 5039 uint32_t reqid, spi; 5040 int error; 5041 uint8_t mode, proto; 5042 5043 IPSEC_ASSERT(so != NULL, ("null socket")); 5044 IPSEC_ASSERT(m != NULL, ("null mbuf")); 5045 IPSEC_ASSERT(mhp != NULL, ("null msghdr")); 5046 IPSEC_ASSERT(mhp->msg != NULL, ("null msg")); 5047 5048 if (SADB_CHECKHDR(mhp, SADB_EXT_ADDRESS_SRC) || 5049 SADB_CHECKHDR(mhp, SADB_EXT_ADDRESS_DST) 5050 #ifdef PFKEY_STRICT_CHECKS 5051 || SADB_CHECKHDR(mhp, SADB_EXT_SPIRANGE) 5052 #endif 5053 ) { 5054 ipseclog((LOG_DEBUG, 5055 "%s: invalid message: missing required header.\n", 5056 __func__)); 5057 error = EINVAL; 5058 goto fail; 5059 } 5060 if (SADB_CHECKLEN(mhp, SADB_EXT_ADDRESS_SRC) || 5061 SADB_CHECKLEN(mhp, SADB_EXT_ADDRESS_DST) 5062 #ifdef PFKEY_STRICT_CHECKS 5063 || SADB_CHECKLEN(mhp, SADB_EXT_SPIRANGE) 5064 #endif 5065 ) { 5066 ipseclog((LOG_DEBUG, 5067 "%s: invalid message: wrong header size.\n", __func__)); 5068 error = EINVAL; 5069 goto fail; 5070 } 5071 if (SADB_CHECKHDR(mhp, SADB_X_EXT_SA2)) { 5072 mode = IPSEC_MODE_ANY; 5073 reqid = 0; 5074 } else { 5075 if (SADB_CHECKLEN(mhp, SADB_X_EXT_SA2)) { 5076 ipseclog((LOG_DEBUG, 5077 "%s: invalid message: wrong header size.\n", 5078 __func__)); 5079 error = EINVAL; 5080 goto fail; 5081 } 5082 mode = ((struct sadb_x_sa2 *) 5083 mhp->ext[SADB_X_EXT_SA2])->sadb_x_sa2_mode; 5084 reqid = ((struct sadb_x_sa2 *) 5085 mhp->ext[SADB_X_EXT_SA2])->sadb_x_sa2_reqid; 5086 } 5087 5088 src0 = (struct sadb_address *)(mhp->ext[SADB_EXT_ADDRESS_SRC]); 5089 dst0 = (struct sadb_address *)(mhp->ext[SADB_EXT_ADDRESS_DST]); 5090 5091 /* map satype to proto */ 5092 if ((proto = key_satype2proto(mhp->msg->sadb_msg_satype)) == 0) { 5093 ipseclog((LOG_DEBUG, "%s: invalid satype is passed.\n", 5094 __func__)); 5095 error = EINVAL; 5096 goto fail; 5097 } 5098 error = key_checksockaddrs((struct sockaddr *)(src0 + 1), 5099 (struct sockaddr *)(dst0 + 1)); 5100 if (error != 0) { 5101 ipseclog((LOG_DEBUG, "%s: invalid sockaddr.\n", __func__)); 5102 error = EINVAL; 5103 goto fail; 5104 } 5105 KEY_SETSECASIDX(proto, mode, reqid, src0 + 1, dst0 + 1, &saidx); 5106 5107 /* SPI allocation */ 5108 SPI_ALLOC_LOCK(); 5109 spi = key_do_getnewspi( 5110 (struct sadb_spirange *)mhp->ext[SADB_EXT_SPIRANGE], &saidx); 5111 if (spi == 0) { 5112 /* 5113 * Requested SPI or SPI range is not available or 5114 * already used. 5115 */ 5116 SPI_ALLOC_UNLOCK(); 5117 error = EEXIST; 5118 goto fail; 5119 } 5120 sav = key_newsav(mhp, &saidx, spi, &error); 5121 SPI_ALLOC_UNLOCK(); 5122 if (sav == NULL) 5123 goto fail; 5124 5125 if (sav->seq != 0) { 5126 /* 5127 * RFC2367: 5128 * If the SADB_GETSPI message is in response to a 5129 * kernel-generated SADB_ACQUIRE, the sadb_msg_seq 5130 * MUST be the same as the SADB_ACQUIRE message. 5131 * 5132 * XXXAE: However it doesn't definethe behaviour how to 5133 * check this and what to do if it doesn't match. 5134 * Also what we should do if it matches? 5135 * 5136 * We can compare saidx used in SADB_ACQUIRE with saidx 5137 * used in SADB_GETSPI, but this probably can break 5138 * existing software. For now just warn if it doesn't match. 5139 * 5140 * XXXAE: anyway it looks useless. 5141 */ 5142 key_acqdone(&saidx, sav->seq); 5143 } 5144 KEYDBG(KEY_STAMP, 5145 printf("%s: SA(%p)\n", __func__, sav)); 5146 KEYDBG(KEY_DATA, kdebug_secasv(sav)); 5147 5148 { 5149 struct mbuf *n, *nn; 5150 struct sadb_sa *m_sa; 5151 struct sadb_msg *newmsg; 5152 int off, len; 5153 5154 /* create new sadb_msg to reply. */ 5155 len = PFKEY_ALIGN8(sizeof(struct sadb_msg)) + 5156 PFKEY_ALIGN8(sizeof(struct sadb_sa)); 5157 5158 n = key_mget(len); 5159 if (n == NULL) { 5160 error = ENOBUFS; 5161 goto fail; 5162 } 5163 5164 n->m_len = len; 5165 n->m_next = NULL; 5166 off = 0; 5167 5168 m_copydata(m, 0, sizeof(struct sadb_msg), mtod(n, caddr_t) + off); 5169 off += PFKEY_ALIGN8(sizeof(struct sadb_msg)); 5170 5171 m_sa = (struct sadb_sa *)(mtod(n, caddr_t) + off); 5172 m_sa->sadb_sa_len = PFKEY_UNIT64(sizeof(struct sadb_sa)); 5173 m_sa->sadb_sa_exttype = SADB_EXT_SA; 5174 m_sa->sadb_sa_spi = spi; /* SPI is already in network byte order */ 5175 off += PFKEY_ALIGN8(sizeof(struct sadb_sa)); 5176 5177 IPSEC_ASSERT(off == len, 5178 ("length inconsistency (off %u len %u)", off, len)); 5179 5180 n->m_next = key_gather_mbuf(m, mhp, 0, 2, SADB_EXT_ADDRESS_SRC, 5181 SADB_EXT_ADDRESS_DST); 5182 if (!n->m_next) { 5183 m_freem(n); 5184 error = ENOBUFS; 5185 goto fail; 5186 } 5187 5188 if (n->m_len < sizeof(struct sadb_msg)) { 5189 n = m_pullup(n, sizeof(struct sadb_msg)); 5190 if (n == NULL) 5191 return key_sendup_mbuf(so, m, KEY_SENDUP_ONE); 5192 } 5193 5194 n->m_pkthdr.len = 0; 5195 for (nn = n; nn; nn = nn->m_next) 5196 n->m_pkthdr.len += nn->m_len; 5197 5198 newmsg = mtod(n, struct sadb_msg *); 5199 newmsg->sadb_msg_seq = sav->seq; 5200 newmsg->sadb_msg_errno = 0; 5201 newmsg->sadb_msg_len = PFKEY_UNIT64(n->m_pkthdr.len); 5202 5203 m_freem(m); 5204 return key_sendup_mbuf(so, n, KEY_SENDUP_ONE); 5205 } 5206 5207 fail: 5208 return (key_senderror(so, m, error)); 5209 } 5210 5211 /* 5212 * allocating new SPI 5213 * called by key_getspi(). 5214 * OUT: 5215 * 0: failure. 5216 * others: success, SPI in network byte order. 5217 */ 5218 static uint32_t 5219 key_do_getnewspi(struct sadb_spirange *spirange, struct secasindex *saidx) 5220 { 5221 uint32_t min, max, newspi, t; 5222 int tries, limit; 5223 5224 SPI_ALLOC_LOCK_ASSERT(); 5225 5226 /* set spi range to allocate */ 5227 if (spirange != NULL) { 5228 min = spirange->sadb_spirange_min; 5229 max = spirange->sadb_spirange_max; 5230 } else { 5231 min = V_key_spi_minval; 5232 max = V_key_spi_maxval; 5233 } 5234 /* IPCOMP needs 2-byte SPI */ 5235 if (saidx->proto == IPPROTO_IPCOMP) { 5236 if (min >= 0x10000) 5237 min = 0xffff; 5238 if (max >= 0x10000) 5239 max = 0xffff; 5240 if (min > max) { 5241 t = min; min = max; max = t; 5242 } 5243 } 5244 5245 if (min == max) { 5246 if (key_checkspidup(htonl(min))) { 5247 ipseclog((LOG_DEBUG, "%s: SPI %u exists already.\n", 5248 __func__, min)); 5249 return 0; 5250 } 5251 5252 tries = 1; 5253 newspi = min; 5254 } else { 5255 /* init SPI */ 5256 newspi = 0; 5257 5258 limit = atomic_load_int(&V_key_spi_trycnt); 5259 /* when requesting to allocate spi ranged */ 5260 for (tries = 0; tries < limit; tries++) { 5261 /* generate pseudo-random SPI value ranged. */ 5262 newspi = min + (key_random() % (max - min + 1)); 5263 if (!key_checkspidup(htonl(newspi))) 5264 break; 5265 } 5266 5267 if (tries == limit || newspi == 0) { 5268 ipseclog((LOG_DEBUG, 5269 "%s: failed to allocate SPI.\n", __func__)); 5270 return 0; 5271 } 5272 } 5273 5274 /* statistics */ 5275 keystat.getspi_count = 5276 (keystat.getspi_count + tries) / 2; 5277 5278 return (htonl(newspi)); 5279 } 5280 5281 /* 5282 * Find TCP-MD5 SA with corresponding secasindex. 5283 * If not found, return NULL and fill SPI with usable value if needed. 5284 */ 5285 static struct secasvar * 5286 key_getsav_tcpmd5(struct secasindex *saidx, uint32_t *spi) 5287 { 5288 SAHTREE_RLOCK_TRACKER; 5289 struct secashead *sah; 5290 struct secasvar *sav; 5291 5292 IPSEC_ASSERT(saidx->proto == IPPROTO_TCP, ("wrong proto")); 5293 SAHTREE_RLOCK(); 5294 LIST_FOREACH(sah, SAHADDRHASH_HASH(saidx), addrhash) { 5295 if (sah->saidx.proto != IPPROTO_TCP) 5296 continue; 5297 if (!key_sockaddrcmp(&saidx->dst.sa, &sah->saidx.dst.sa, 0) && 5298 !key_sockaddrcmp(&saidx->src.sa, &sah->saidx.src.sa, 0)) 5299 break; 5300 } 5301 if (sah != NULL) { 5302 if (V_key_preferred_oldsa) 5303 sav = TAILQ_LAST(&sah->savtree_alive, secasvar_queue); 5304 else 5305 sav = TAILQ_FIRST(&sah->savtree_alive); 5306 if (sav != NULL) { 5307 SAV_ADDREF(sav); 5308 SAHTREE_RUNLOCK(); 5309 return (sav); 5310 } 5311 } 5312 if (spi == NULL) { 5313 /* No SPI required */ 5314 SAHTREE_RUNLOCK(); 5315 return (NULL); 5316 } 5317 /* Check that SPI is unique */ 5318 LIST_FOREACH(sav, SAVHASH_HASH(*spi), spihash) { 5319 if (sav->spi == *spi) 5320 break; 5321 } 5322 if (sav == NULL) { 5323 SAHTREE_RUNLOCK(); 5324 /* SPI is already unique */ 5325 return (NULL); 5326 } 5327 SAHTREE_RUNLOCK(); 5328 /* XXX: not optimal */ 5329 *spi = key_do_getnewspi(NULL, saidx); 5330 return (NULL); 5331 } 5332 5333 static int 5334 key_updateaddresses(struct socket *so, struct mbuf *m, 5335 const struct sadb_msghdr *mhp, struct secasvar *sav, 5336 struct secasindex *saidx) 5337 { 5338 struct sockaddr *newaddr; 5339 struct secashead *sah; 5340 struct secasvar *newsav, *tmp; 5341 struct mbuf *n; 5342 int error, isnew; 5343 5344 /* Check that we need to change SAH */ 5345 if (!SADB_CHECKHDR(mhp, SADB_X_EXT_NEW_ADDRESS_SRC)) { 5346 newaddr = (struct sockaddr *)( 5347 ((struct sadb_address *) 5348 mhp->ext[SADB_X_EXT_NEW_ADDRESS_SRC]) + 1); 5349 bcopy(newaddr, &saidx->src, newaddr->sa_len); 5350 key_porttosaddr(&saidx->src.sa, 0); 5351 } 5352 if (!SADB_CHECKHDR(mhp, SADB_X_EXT_NEW_ADDRESS_DST)) { 5353 newaddr = (struct sockaddr *)( 5354 ((struct sadb_address *) 5355 mhp->ext[SADB_X_EXT_NEW_ADDRESS_DST]) + 1); 5356 bcopy(newaddr, &saidx->dst, newaddr->sa_len); 5357 key_porttosaddr(&saidx->dst.sa, 0); 5358 } 5359 if (!SADB_CHECKHDR(mhp, SADB_X_EXT_NEW_ADDRESS_SRC) || 5360 !SADB_CHECKHDR(mhp, SADB_X_EXT_NEW_ADDRESS_DST)) { 5361 error = key_checksockaddrs(&saidx->src.sa, &saidx->dst.sa); 5362 if (error != 0) { 5363 ipseclog((LOG_DEBUG, "%s: invalid new sockaddr.\n", 5364 __func__)); 5365 return (error); 5366 } 5367 5368 sah = key_getsah(saidx); 5369 if (sah == NULL) { 5370 /* create a new SA index */ 5371 sah = key_newsah(saidx); 5372 if (sah == NULL) { 5373 ipseclog((LOG_DEBUG, 5374 "%s: No more memory.\n", __func__)); 5375 return (ENOBUFS); 5376 } 5377 isnew = 2; /* SAH is new */ 5378 } else 5379 isnew = 1; /* existing SAH is referenced */ 5380 } else { 5381 /* 5382 * src and dst addresses are still the same. 5383 * Do we want to change NAT-T config? 5384 */ 5385 if (sav->sah->saidx.proto != IPPROTO_ESP || 5386 SADB_CHECKHDR(mhp, SADB_X_EXT_NAT_T_TYPE) || 5387 SADB_CHECKHDR(mhp, SADB_X_EXT_NAT_T_SPORT) || 5388 SADB_CHECKHDR(mhp, SADB_X_EXT_NAT_T_DPORT)) { 5389 ipseclog((LOG_DEBUG, 5390 "%s: invalid message: missing required header.\n", 5391 __func__)); 5392 return (EINVAL); 5393 } 5394 /* We hold reference to SA, thus SAH will be referenced too. */ 5395 sah = sav->sah; 5396 isnew = 0; 5397 } 5398 5399 newsav = malloc(sizeof(struct secasvar), M_IPSEC_SA, 5400 M_NOWAIT | M_ZERO); 5401 if (newsav == NULL) { 5402 ipseclog((LOG_DEBUG, "%s: No more memory.\n", __func__)); 5403 error = ENOBUFS; 5404 goto fail; 5405 } 5406 5407 /* Clone SA's content into newsav */ 5408 SAV_INITREF(newsav); 5409 bcopy(sav, newsav, offsetof(struct secasvar, chain)); 5410 #ifdef IPSEC_OFFLOAD 5411 CK_LIST_INIT(&newsav->accel_ifps); 5412 newsav->accel_forget_tq = 0; 5413 newsav->accel_lft_sw = uma_zalloc_pcpu(ipsec_key_lft_zone, 5414 M_NOWAIT | M_ZERO); 5415 if (newsav->accel_lft_sw == NULL) { 5416 error = ENOBUFS; 5417 goto fail; 5418 } 5419 if (sav->accel_ifname != NULL) { 5420 struct sadb_x_if_hw_offl xof; 5421 5422 newsav->accel_ifname = malloc(sizeof(xof.sadb_x_if_hw_offl_if), 5423 M_IPSEC_MISC, M_NOWAIT); 5424 if (newsav->accel_ifname == NULL) { 5425 error = ENOBUFS; 5426 goto fail; 5427 } 5428 strncpy(__DECONST(char *, sav->accel_ifname), 5429 newsav->accel_ifname, 5430 sizeof(xof.sadb_x_if_hw_offl_if)); 5431 } 5432 #endif 5433 5434 /* 5435 * We create new NAT-T config if it is needed. 5436 * Old NAT-T config will be freed by key_cleansav() when 5437 * last reference to SA will be released. 5438 */ 5439 newsav->natt = NULL; 5440 newsav->sah = sah; 5441 newsav->state = SADB_SASTATE_MATURE; 5442 error = key_setnatt(newsav, mhp); 5443 if (error != 0) 5444 goto fail; 5445 5446 SAHTREE_WLOCK(); 5447 /* Check that SA is still alive */ 5448 if (sav->state == SADB_SASTATE_DEAD) { 5449 /* SA was unlinked */ 5450 SAHTREE_WUNLOCK(); 5451 error = ESRCH; 5452 goto fail; 5453 } 5454 5455 /* Unlink SA from SAH and SPI hash */ 5456 IPSEC_ASSERT((sav->flags & SADB_X_EXT_F_CLONED) == 0, 5457 ("SA is already cloned")); 5458 IPSEC_ASSERT(sav->state == SADB_SASTATE_MATURE || 5459 sav->state == SADB_SASTATE_DYING, 5460 ("Wrong SA state %u\n", sav->state)); 5461 TAILQ_REMOVE(&sav->sah->savtree_alive, sav, chain); 5462 LIST_REMOVE(sav, spihash); 5463 sav->state = SADB_SASTATE_DEAD; 5464 ipsec_accel_forget_sav(sav); 5465 5466 /* 5467 * Link new SA with SAH. Keep SAs ordered by 5468 * create time (newer are first). 5469 */ 5470 TAILQ_FOREACH(tmp, &sah->savtree_alive, chain) { 5471 if (newsav->created > tmp->created) { 5472 TAILQ_INSERT_BEFORE(tmp, newsav, chain); 5473 break; 5474 } 5475 } 5476 if (tmp == NULL) 5477 TAILQ_INSERT_TAIL(&sah->savtree_alive, newsav, chain); 5478 5479 /* Add new SA into SPI hash. */ 5480 LIST_INSERT_HEAD(SAVHASH_HASH(newsav->spi), newsav, spihash); 5481 5482 /* Add new SAH into SADB. */ 5483 if (isnew == 2) { 5484 TAILQ_INSERT_HEAD(&V_sahtree, sah, chain); 5485 LIST_INSERT_HEAD(SAHADDRHASH_HASH(saidx), sah, addrhash); 5486 sah->state = SADB_SASTATE_MATURE; 5487 SAH_ADDREF(sah); /* newsav references new SAH */ 5488 } 5489 /* 5490 * isnew == 1 -> @sah was referenced by key_getsah(). 5491 * isnew == 0 -> we use the same @sah, that was used by @sav, 5492 * and we use its reference for @newsav. 5493 */ 5494 SECASVAR_WLOCK(sav); 5495 /* XXX: replace cntr with pointer? */ 5496 newsav->cntr = sav->cntr; 5497 sav->flags |= SADB_X_EXT_F_CLONED; 5498 SECASVAR_WUNLOCK(sav); 5499 5500 SAHTREE_WUNLOCK(); 5501 5502 KEYDBG(KEY_STAMP, 5503 printf("%s: SA(%p) cloned into SA(%p)\n", 5504 __func__, sav, newsav)); 5505 KEYDBG(KEY_DATA, kdebug_secasv(newsav)); 5506 5507 key_freesav(&sav); /* release last reference */ 5508 5509 /* set msg buf from mhp */ 5510 n = key_getmsgbuf_x1(m, mhp); 5511 if (n == NULL) { 5512 ipseclog((LOG_DEBUG, "%s: No more memory.\n", __func__)); 5513 return (ENOBUFS); 5514 } 5515 m_freem(m); 5516 key_sendup_mbuf(so, n, KEY_SENDUP_ALL); 5517 return (0); 5518 fail: 5519 if (isnew != 0) 5520 key_freesah(&sah); 5521 if (newsav != NULL) { 5522 #ifdef IPSEC_OFFLOAD 5523 uma_zfree_pcpu(ipsec_key_lft_zone, newsav->accel_lft_sw); 5524 free(__DECONST(char *, newsav->accel_ifname), M_IPSEC_MISC); 5525 #endif 5526 if (newsav->natt != NULL) 5527 free(newsav->natt, M_IPSEC_MISC); 5528 free(newsav, M_IPSEC_SA); 5529 } 5530 return (error); 5531 } 5532 5533 /* 5534 * SADB_UPDATE processing 5535 * receive 5536 * <base, SA, (SA2), (lifetime(HSC),) address(SD), (address(P),) 5537 * key(AE), (identity(SD),) (sensitivity)> 5538 * from the ikmpd, and update a secasvar entry whose status is SADB_SASTATE_LARVAL. 5539 * and send 5540 * <base, SA, (SA2), (lifetime(HSC),) address(SD), (address(P),) 5541 * (identity(SD),) (sensitivity)> 5542 * to the ikmpd. 5543 * 5544 * m will always be freed. 5545 */ 5546 static int 5547 key_update(struct socket *so, struct mbuf *m, const struct sadb_msghdr *mhp) 5548 { 5549 struct secasindex saidx; 5550 struct sadb_address *src0, *dst0; 5551 struct sadb_sa *sa0; 5552 struct secasvar *sav; 5553 uint32_t reqid; 5554 int error; 5555 uint8_t mode, proto; 5556 5557 IPSEC_ASSERT(so != NULL, ("null socket")); 5558 IPSEC_ASSERT(m != NULL, ("null mbuf")); 5559 IPSEC_ASSERT(mhp != NULL, ("null msghdr")); 5560 IPSEC_ASSERT(mhp->msg != NULL, ("null msg")); 5561 5562 /* map satype to proto */ 5563 if ((proto = key_satype2proto(mhp->msg->sadb_msg_satype)) == 0) { 5564 ipseclog((LOG_DEBUG, "%s: invalid satype is passed.\n", 5565 __func__)); 5566 return key_senderror(so, m, EINVAL); 5567 } 5568 5569 if (SADB_CHECKHDR(mhp, SADB_EXT_SA) || 5570 SADB_CHECKHDR(mhp, SADB_EXT_ADDRESS_SRC) || 5571 SADB_CHECKHDR(mhp, SADB_EXT_ADDRESS_DST) || 5572 (SADB_CHECKHDR(mhp, SADB_EXT_LIFETIME_HARD) && 5573 !SADB_CHECKHDR(mhp, SADB_EXT_LIFETIME_SOFT)) || 5574 (SADB_CHECKHDR(mhp, SADB_EXT_LIFETIME_SOFT) && 5575 !SADB_CHECKHDR(mhp, SADB_EXT_LIFETIME_HARD))) { 5576 ipseclog((LOG_DEBUG, 5577 "%s: invalid message: missing required header.\n", 5578 __func__)); 5579 return key_senderror(so, m, EINVAL); 5580 } 5581 if (SADB_CHECKLEN(mhp, SADB_EXT_SA) || 5582 SADB_CHECKLEN(mhp, SADB_EXT_ADDRESS_SRC) || 5583 SADB_CHECKLEN(mhp, SADB_EXT_ADDRESS_DST)) { 5584 ipseclog((LOG_DEBUG, 5585 "%s: invalid message: wrong header size.\n", __func__)); 5586 return key_senderror(so, m, EINVAL); 5587 } 5588 if (SADB_CHECKHDR(mhp, SADB_X_EXT_SA2)) { 5589 mode = IPSEC_MODE_ANY; 5590 reqid = 0; 5591 } else { 5592 if (SADB_CHECKLEN(mhp, SADB_X_EXT_SA2)) { 5593 ipseclog((LOG_DEBUG, 5594 "%s: invalid message: wrong header size.\n", 5595 __func__)); 5596 return key_senderror(so, m, EINVAL); 5597 } 5598 mode = ((struct sadb_x_sa2 *) 5599 mhp->ext[SADB_X_EXT_SA2])->sadb_x_sa2_mode; 5600 reqid = ((struct sadb_x_sa2 *) 5601 mhp->ext[SADB_X_EXT_SA2])->sadb_x_sa2_reqid; 5602 } 5603 5604 sa0 = (struct sadb_sa *)mhp->ext[SADB_EXT_SA]; 5605 src0 = (struct sadb_address *)(mhp->ext[SADB_EXT_ADDRESS_SRC]); 5606 dst0 = (struct sadb_address *)(mhp->ext[SADB_EXT_ADDRESS_DST]); 5607 5608 /* 5609 * Only SADB_SASTATE_MATURE SAs may be submitted in an 5610 * SADB_UPDATE message. 5611 */ 5612 if (sa0->sadb_sa_state != SADB_SASTATE_MATURE) { 5613 ipseclog((LOG_DEBUG, "%s: invalid state.\n", __func__)); 5614 #ifdef PFKEY_STRICT_CHECKS 5615 return key_senderror(so, m, EINVAL); 5616 #endif 5617 } 5618 error = key_checksockaddrs((struct sockaddr *)(src0 + 1), 5619 (struct sockaddr *)(dst0 + 1)); 5620 if (error != 0) { 5621 ipseclog((LOG_DEBUG, "%s: invalid sockaddr.\n", __func__)); 5622 return key_senderror(so, m, error); 5623 } 5624 KEY_SETSECASIDX(proto, mode, reqid, src0 + 1, dst0 + 1, &saidx); 5625 sav = key_getsavbyspi(sa0->sadb_sa_spi); 5626 if (sav == NULL) { 5627 ipseclog((LOG_DEBUG, "%s: no SA found for SPI %u\n", 5628 __func__, ntohl(sa0->sadb_sa_spi))); 5629 return key_senderror(so, m, EINVAL); 5630 } 5631 /* 5632 * Check that SADB_UPDATE issued by the same process that did 5633 * SADB_GETSPI or SADB_ADD. 5634 */ 5635 if (sav->pid != mhp->msg->sadb_msg_pid) { 5636 ipseclog((LOG_DEBUG, 5637 "%s: pid mismatched (SPI %u, pid %u vs. %u)\n", __func__, 5638 ntohl(sav->spi), sav->pid, mhp->msg->sadb_msg_pid)); 5639 key_freesav(&sav); 5640 return key_senderror(so, m, EINVAL); 5641 } 5642 /* saidx should match with SA. */ 5643 if (key_cmpsaidx(&sav->sah->saidx, &saidx, CMP_MODE_REQID) == 0) { 5644 ipseclog((LOG_DEBUG, "%s: saidx mismatched for SPI %u\n", 5645 __func__, ntohl(sav->spi))); 5646 key_freesav(&sav); 5647 return key_senderror(so, m, ESRCH); 5648 } 5649 5650 if (sav->state == SADB_SASTATE_LARVAL) { 5651 if ((mhp->msg->sadb_msg_satype == SADB_SATYPE_ESP && 5652 SADB_CHECKHDR(mhp, SADB_EXT_KEY_ENCRYPT)) || 5653 (mhp->msg->sadb_msg_satype == SADB_SATYPE_AH && 5654 SADB_CHECKHDR(mhp, SADB_EXT_KEY_AUTH))) { 5655 ipseclog((LOG_DEBUG, 5656 "%s: invalid message: missing required header.\n", 5657 __func__)); 5658 key_freesav(&sav); 5659 return key_senderror(so, m, EINVAL); 5660 } 5661 /* 5662 * We can set any values except src, dst and SPI. 5663 */ 5664 error = key_setsaval(sav, mhp); 5665 if (error != 0) { 5666 key_freesav(&sav); 5667 return (key_senderror(so, m, error)); 5668 } 5669 /* Change SA state to MATURE */ 5670 SAHTREE_WLOCK(); 5671 if (sav->state != SADB_SASTATE_LARVAL) { 5672 /* SA was deleted or another thread made it MATURE. */ 5673 SAHTREE_WUNLOCK(); 5674 key_freesav(&sav); 5675 return (key_senderror(so, m, ESRCH)); 5676 } 5677 /* 5678 * NOTE: we keep SAs in savtree_alive ordered by created 5679 * time. When SA's state changed from LARVAL to MATURE, 5680 * we update its created time in key_setsaval() and move 5681 * it into head of savtree_alive. 5682 */ 5683 TAILQ_REMOVE(&sav->sah->savtree_larval, sav, chain); 5684 TAILQ_INSERT_HEAD(&sav->sah->savtree_alive, sav, chain); 5685 sav->state = SADB_SASTATE_MATURE; 5686 SAHTREE_WUNLOCK(); 5687 } else { 5688 /* 5689 * For DYING and MATURE SA we can change only state 5690 * and lifetimes. Report EINVAL if something else attempted 5691 * to change. 5692 */ 5693 if (!SADB_CHECKHDR(mhp, SADB_EXT_KEY_ENCRYPT) || 5694 !SADB_CHECKHDR(mhp, SADB_EXT_KEY_AUTH)) { 5695 key_freesav(&sav); 5696 return (key_senderror(so, m, EINVAL)); 5697 } 5698 error = key_updatelifetimes(sav, mhp); 5699 if (error != 0) { 5700 key_freesav(&sav); 5701 return (key_senderror(so, m, error)); 5702 } 5703 /* 5704 * This is FreeBSD extension to RFC2367. 5705 * IKEd can specify SADB_X_EXT_NEW_ADDRESS_SRC and/or 5706 * SADB_X_EXT_NEW_ADDRESS_DST when it wants to change 5707 * SA addresses (for example to implement MOBIKE protocol 5708 * as described in RFC4555). Also we allow to change 5709 * NAT-T config. 5710 */ 5711 if (!SADB_CHECKHDR(mhp, SADB_X_EXT_NEW_ADDRESS_SRC) || 5712 !SADB_CHECKHDR(mhp, SADB_X_EXT_NEW_ADDRESS_DST) || 5713 !SADB_CHECKHDR(mhp, SADB_X_EXT_NAT_T_TYPE) || 5714 sav->natt != NULL) { 5715 error = key_updateaddresses(so, m, mhp, sav, &saidx); 5716 key_freesav(&sav); 5717 if (error != 0) 5718 return (key_senderror(so, m, error)); 5719 return (0); 5720 } 5721 /* Check that SA is still alive */ 5722 SAHTREE_WLOCK(); 5723 if (sav->state == SADB_SASTATE_DEAD) { 5724 /* SA was unlinked */ 5725 SAHTREE_WUNLOCK(); 5726 key_freesav(&sav); 5727 return (key_senderror(so, m, ESRCH)); 5728 } 5729 /* 5730 * NOTE: there is possible state moving from DYING to MATURE, 5731 * but this doesn't change created time, so we won't reorder 5732 * this SA. 5733 */ 5734 sav->state = SADB_SASTATE_MATURE; 5735 SAHTREE_WUNLOCK(); 5736 } 5737 KEYDBG(KEY_STAMP, 5738 printf("%s: SA(%p)\n", __func__, sav)); 5739 KEYDBG(KEY_DATA, kdebug_secasv(sav)); 5740 ipsec_accel_sa_newkey(sav); 5741 key_freesav(&sav); 5742 5743 { 5744 struct mbuf *n; 5745 5746 /* set msg buf from mhp */ 5747 n = key_getmsgbuf_x1(m, mhp); 5748 if (n == NULL) { 5749 ipseclog((LOG_DEBUG, "%s: No more memory.\n", __func__)); 5750 return key_senderror(so, m, ENOBUFS); 5751 } 5752 5753 m_freem(m); 5754 return key_sendup_mbuf(so, n, KEY_SENDUP_ALL); 5755 } 5756 } 5757 5758 /* 5759 * SADB_ADD processing 5760 * add an entry to SA database, when received 5761 * <base, SA, (SA2), (lifetime(HSC),) address(SD), (address(P),) 5762 * key(AE), (identity(SD),) (sensitivity)> 5763 * from the ikmpd, 5764 * and send 5765 * <base, SA, (SA2), (lifetime(HSC),) address(SD), (address(P),) 5766 * (identity(SD),) (sensitivity)> 5767 * to the ikmpd. 5768 * 5769 * IGNORE identity and sensitivity messages. 5770 * 5771 * m will always be freed. 5772 */ 5773 static int 5774 key_add(struct socket *so, struct mbuf *m, const struct sadb_msghdr *mhp) 5775 { 5776 struct secasindex saidx; 5777 struct sadb_address *src0, *dst0; 5778 struct sadb_sa *sa0; 5779 struct secasvar *sav; 5780 uint32_t reqid, spi; 5781 uint8_t mode, proto; 5782 int error; 5783 5784 IPSEC_ASSERT(so != NULL, ("null socket")); 5785 IPSEC_ASSERT(m != NULL, ("null mbuf")); 5786 IPSEC_ASSERT(mhp != NULL, ("null msghdr")); 5787 IPSEC_ASSERT(mhp->msg != NULL, ("null msg")); 5788 5789 /* map satype to proto */ 5790 if ((proto = key_satype2proto(mhp->msg->sadb_msg_satype)) == 0) { 5791 ipseclog((LOG_DEBUG, "%s: invalid satype is passed.\n", 5792 __func__)); 5793 return key_senderror(so, m, EINVAL); 5794 } 5795 5796 if (SADB_CHECKHDR(mhp, SADB_EXT_SA) || 5797 SADB_CHECKHDR(mhp, SADB_EXT_ADDRESS_SRC) || 5798 SADB_CHECKHDR(mhp, SADB_EXT_ADDRESS_DST) || 5799 (mhp->msg->sadb_msg_satype == SADB_SATYPE_ESP && ( 5800 SADB_CHECKHDR(mhp, SADB_EXT_KEY_ENCRYPT) || 5801 SADB_CHECKLEN(mhp, SADB_EXT_KEY_ENCRYPT))) || 5802 (mhp->msg->sadb_msg_satype == SADB_SATYPE_AH && ( 5803 SADB_CHECKHDR(mhp, SADB_EXT_KEY_AUTH) || 5804 SADB_CHECKLEN(mhp, SADB_EXT_KEY_AUTH))) || 5805 (SADB_CHECKHDR(mhp, SADB_EXT_LIFETIME_HARD) && 5806 !SADB_CHECKHDR(mhp, SADB_EXT_LIFETIME_SOFT)) || 5807 (SADB_CHECKHDR(mhp, SADB_EXT_LIFETIME_SOFT) && 5808 !SADB_CHECKHDR(mhp, SADB_EXT_LIFETIME_HARD))) { 5809 ipseclog((LOG_DEBUG, 5810 "%s: invalid message: missing required header.\n", 5811 __func__)); 5812 return key_senderror(so, m, EINVAL); 5813 } 5814 if (SADB_CHECKLEN(mhp, SADB_EXT_SA) || 5815 SADB_CHECKLEN(mhp, SADB_EXT_ADDRESS_SRC) || 5816 SADB_CHECKLEN(mhp, SADB_EXT_ADDRESS_DST)) { 5817 ipseclog((LOG_DEBUG, 5818 "%s: invalid message: wrong header size.\n", __func__)); 5819 return key_senderror(so, m, EINVAL); 5820 } 5821 if (SADB_CHECKHDR(mhp, SADB_X_EXT_SA2)) { 5822 mode = IPSEC_MODE_ANY; 5823 reqid = 0; 5824 } else { 5825 if (SADB_CHECKLEN(mhp, SADB_X_EXT_SA2)) { 5826 ipseclog((LOG_DEBUG, 5827 "%s: invalid message: wrong header size.\n", 5828 __func__)); 5829 return key_senderror(so, m, EINVAL); 5830 } 5831 mode = ((struct sadb_x_sa2 *) 5832 mhp->ext[SADB_X_EXT_SA2])->sadb_x_sa2_mode; 5833 reqid = ((struct sadb_x_sa2 *) 5834 mhp->ext[SADB_X_EXT_SA2])->sadb_x_sa2_reqid; 5835 } 5836 5837 sa0 = (struct sadb_sa *)mhp->ext[SADB_EXT_SA]; 5838 src0 = (struct sadb_address *)mhp->ext[SADB_EXT_ADDRESS_SRC]; 5839 dst0 = (struct sadb_address *)mhp->ext[SADB_EXT_ADDRESS_DST]; 5840 5841 /* 5842 * Only SADB_SASTATE_MATURE SAs may be submitted in an 5843 * SADB_ADD message. 5844 */ 5845 if (sa0->sadb_sa_state != SADB_SASTATE_MATURE) { 5846 ipseclog((LOG_DEBUG, "%s: invalid state.\n", __func__)); 5847 #ifdef PFKEY_STRICT_CHECKS 5848 return key_senderror(so, m, EINVAL); 5849 #endif 5850 } 5851 error = key_checksockaddrs((struct sockaddr *)(src0 + 1), 5852 (struct sockaddr *)(dst0 + 1)); 5853 if (error != 0) { 5854 ipseclog((LOG_DEBUG, "%s: invalid sockaddr.\n", __func__)); 5855 return key_senderror(so, m, error); 5856 } 5857 KEY_SETSECASIDX(proto, mode, reqid, src0 + 1, dst0 + 1, &saidx); 5858 spi = sa0->sadb_sa_spi; 5859 /* 5860 * For TCP-MD5 SAs we don't use SPI. Check the uniqueness using 5861 * secasindex. 5862 * XXXAE: IPComp seems also doesn't use SPI. 5863 */ 5864 SPI_ALLOC_LOCK(); 5865 if (proto == IPPROTO_TCP) { 5866 sav = key_getsav_tcpmd5(&saidx, &spi); 5867 if (sav == NULL && spi == 0) { 5868 SPI_ALLOC_UNLOCK(); 5869 /* Failed to allocate SPI */ 5870 ipseclog((LOG_DEBUG, "%s: SA already exists.\n", 5871 __func__)); 5872 return key_senderror(so, m, EEXIST); 5873 } 5874 /* XXX: SPI that we report back can have another value */ 5875 } else { 5876 /* We can create new SA only if SPI is different. */ 5877 sav = key_getsavbyspi(spi); 5878 } 5879 if (sav != NULL) { 5880 SPI_ALLOC_UNLOCK(); 5881 key_freesav(&sav); 5882 ipseclog((LOG_DEBUG, "%s: SA already exists.\n", __func__)); 5883 return key_senderror(so, m, EEXIST); 5884 } 5885 5886 sav = key_newsav(mhp, &saidx, spi, &error); 5887 SPI_ALLOC_UNLOCK(); 5888 if (sav == NULL) 5889 return key_senderror(so, m, error); 5890 KEYDBG(KEY_STAMP, 5891 printf("%s: return SA(%p)\n", __func__, sav)); 5892 KEYDBG(KEY_DATA, kdebug_secasv(sav)); 5893 ipsec_accel_sa_newkey(sav); 5894 /* 5895 * If SADB_ADD was in response to SADB_ACQUIRE, we need to schedule 5896 * ACQ for deletion. 5897 */ 5898 if (sav->seq != 0) 5899 key_acqdone(&saidx, sav->seq); 5900 5901 { 5902 /* 5903 * Don't call key_freesav() on error here, as we would like to 5904 * keep the SA in the database. 5905 */ 5906 struct mbuf *n; 5907 5908 /* set msg buf from mhp */ 5909 n = key_getmsgbuf_x1(m, mhp); 5910 if (n == NULL) { 5911 ipseclog((LOG_DEBUG, "%s: No more memory.\n", __func__)); 5912 return key_senderror(so, m, ENOBUFS); 5913 } 5914 5915 m_freem(m); 5916 return key_sendup_mbuf(so, n, KEY_SENDUP_ALL); 5917 } 5918 } 5919 5920 /* 5921 * NAT-T support. 5922 * IKEd may request the use ESP in UDP encapsulation when it detects the 5923 * presence of NAT. It uses NAT-T extension headers for such SAs to specify 5924 * parameters needed for encapsulation and decapsulation. These PF_KEY 5925 * extension headers are not standardized, so this comment addresses our 5926 * implementation. 5927 * SADB_X_EXT_NAT_T_TYPE specifies type of encapsulation, we support only 5928 * UDP_ENCAP_ESPINUDP as described in RFC3948. 5929 * SADB_X_EXT_NAT_T_SPORT/DPORT specifies source and destination ports for 5930 * UDP header. We use these ports in UDP encapsulation procedure, also we 5931 * can check them in UDP decapsulation procedure. 5932 * SADB_X_EXT_NAT_T_OA[IR] specifies original address of initiator or 5933 * responder. These addresses can be used for transport mode to adjust 5934 * checksum after decapsulation and decryption. Since original IP addresses 5935 * used by peer usually different (we detected presence of NAT), TCP/UDP 5936 * pseudo header checksum and IP header checksum was calculated using original 5937 * addresses. After decapsulation and decryption we need to adjust checksum 5938 * to have correct datagram. 5939 * 5940 * We expect presence of NAT-T extension headers only in SADB_ADD and 5941 * SADB_UPDATE messages. We report NAT-T extension headers in replies 5942 * to SADB_ADD, SADB_UPDATE, SADB_GET, and SADB_DUMP messages. 5943 */ 5944 static int 5945 key_setnatt(struct secasvar *sav, const struct sadb_msghdr *mhp) 5946 { 5947 struct sadb_x_nat_t_port *port; 5948 struct sadb_x_nat_t_type *type; 5949 struct sadb_address *oai, *oar; 5950 struct sockaddr *sa; 5951 uint32_t addr; 5952 uint16_t cksum; 5953 int i; 5954 5955 IPSEC_ASSERT(sav->natt == NULL, ("natt is already initialized")); 5956 /* 5957 * Ignore NAT-T headers if sproto isn't ESP. 5958 */ 5959 if (sav->sah->saidx.proto != IPPROTO_ESP) 5960 return (0); 5961 5962 if (!SADB_CHECKHDR(mhp, SADB_X_EXT_NAT_T_TYPE) && 5963 !SADB_CHECKHDR(mhp, SADB_X_EXT_NAT_T_SPORT) && 5964 !SADB_CHECKHDR(mhp, SADB_X_EXT_NAT_T_DPORT)) { 5965 if (SADB_CHECKLEN(mhp, SADB_X_EXT_NAT_T_TYPE) || 5966 SADB_CHECKLEN(mhp, SADB_X_EXT_NAT_T_SPORT) || 5967 SADB_CHECKLEN(mhp, SADB_X_EXT_NAT_T_DPORT)) { 5968 ipseclog((LOG_DEBUG, 5969 "%s: invalid message: wrong header size.\n", 5970 __func__)); 5971 return (EINVAL); 5972 } 5973 } else 5974 return (0); 5975 5976 type = (struct sadb_x_nat_t_type *)mhp->ext[SADB_X_EXT_NAT_T_TYPE]; 5977 if (type->sadb_x_nat_t_type_type != UDP_ENCAP_ESPINUDP) { 5978 ipseclog((LOG_DEBUG, "%s: unsupported NAT-T type %u.\n", 5979 __func__, type->sadb_x_nat_t_type_type)); 5980 return (EINVAL); 5981 } 5982 /* 5983 * Allocate storage for NAT-T config. 5984 * On error it will be released by key_cleansav(). 5985 */ 5986 sav->natt = malloc(sizeof(struct secnatt), M_IPSEC_MISC, 5987 M_NOWAIT | M_ZERO); 5988 if (sav->natt == NULL) { 5989 PFKEYSTAT_INC(in_nomem); 5990 ipseclog((LOG_DEBUG, "%s: No more memory.\n", __func__)); 5991 return (ENOBUFS); 5992 } 5993 port = (struct sadb_x_nat_t_port *)mhp->ext[SADB_X_EXT_NAT_T_SPORT]; 5994 if (port->sadb_x_nat_t_port_port == 0) { 5995 ipseclog((LOG_DEBUG, "%s: invalid NAT-T sport specified.\n", 5996 __func__)); 5997 return (EINVAL); 5998 } 5999 sav->natt->sport = port->sadb_x_nat_t_port_port; 6000 port = (struct sadb_x_nat_t_port *)mhp->ext[SADB_X_EXT_NAT_T_DPORT]; 6001 if (port->sadb_x_nat_t_port_port == 0) { 6002 ipseclog((LOG_DEBUG, "%s: invalid NAT-T dport specified.\n", 6003 __func__)); 6004 return (EINVAL); 6005 } 6006 sav->natt->dport = port->sadb_x_nat_t_port_port; 6007 6008 /* 6009 * SADB_X_EXT_NAT_T_OAI and SADB_X_EXT_NAT_T_OAR are optional 6010 * and needed only for transport mode IPsec. 6011 * Usually NAT translates only one address, but it is possible, 6012 * that both addresses could be translated. 6013 * NOTE: Value of SADB_X_EXT_NAT_T_OAI is equal to SADB_X_EXT_NAT_T_OA. 6014 */ 6015 if (!SADB_CHECKHDR(mhp, SADB_X_EXT_NAT_T_OAI)) { 6016 if (SADB_CHECKLEN(mhp, SADB_X_EXT_NAT_T_OAI)) { 6017 ipseclog((LOG_DEBUG, 6018 "%s: invalid message: wrong header size.\n", 6019 __func__)); 6020 return (EINVAL); 6021 } 6022 oai = (struct sadb_address *)mhp->ext[SADB_X_EXT_NAT_T_OAI]; 6023 } else 6024 oai = NULL; 6025 if (!SADB_CHECKHDR(mhp, SADB_X_EXT_NAT_T_OAR)) { 6026 if (SADB_CHECKLEN(mhp, SADB_X_EXT_NAT_T_OAR)) { 6027 ipseclog((LOG_DEBUG, 6028 "%s: invalid message: wrong header size.\n", 6029 __func__)); 6030 return (EINVAL); 6031 } 6032 oar = (struct sadb_address *)mhp->ext[SADB_X_EXT_NAT_T_OAR]; 6033 } else 6034 oar = NULL; 6035 6036 /* Initialize addresses only for transport mode */ 6037 if (sav->sah->saidx.mode != IPSEC_MODE_TUNNEL) { 6038 cksum = 0; 6039 if (oai != NULL) { 6040 sa = (struct sockaddr *)(oai + 1); 6041 switch (sa->sa_family) { 6042 #ifdef AF_INET 6043 case AF_INET: 6044 if (sa->sa_len != sizeof(struct sockaddr_in)) { 6045 ipseclog((LOG_DEBUG, 6046 "%s: wrong NAT-OAi header.\n", 6047 __func__)); 6048 return (EINVAL); 6049 } 6050 /* Ignore address if it the same */ 6051 if (((struct sockaddr_in *)sa)->sin_addr.s_addr != 6052 sav->sah->saidx.src.sin.sin_addr.s_addr) { 6053 bcopy(sa, &sav->natt->oai.sa, sa->sa_len); 6054 sav->natt->flags |= IPSEC_NATT_F_OAI; 6055 /* Calculate checksum delta */ 6056 addr = sav->sah->saidx.src.sin.sin_addr.s_addr; 6057 cksum = in_addword(cksum, ~addr >> 16); 6058 cksum = in_addword(cksum, ~addr & 0xffff); 6059 addr = sav->natt->oai.sin.sin_addr.s_addr; 6060 cksum = in_addword(cksum, addr >> 16); 6061 cksum = in_addword(cksum, addr & 0xffff); 6062 } 6063 break; 6064 #endif 6065 #ifdef AF_INET6 6066 case AF_INET6: 6067 if (sa->sa_len != sizeof(struct sockaddr_in6)) { 6068 ipseclog((LOG_DEBUG, 6069 "%s: wrong NAT-OAi header.\n", 6070 __func__)); 6071 return (EINVAL); 6072 } 6073 /* Ignore address if it the same */ 6074 if (memcmp(&((struct sockaddr_in6 *)sa)->sin6_addr.s6_addr, 6075 &sav->sah->saidx.src.sin6.sin6_addr.s6_addr, 6076 sizeof(struct in6_addr)) != 0) { 6077 bcopy(sa, &sav->natt->oai.sa, sa->sa_len); 6078 sav->natt->flags |= IPSEC_NATT_F_OAI; 6079 /* Calculate checksum delta */ 6080 for (i = 0; i < 8; i++) { 6081 cksum = in_addword(cksum, 6082 ~sav->sah->saidx.src.sin6.sin6_addr.s6_addr16[i]); 6083 cksum = in_addword(cksum, 6084 sav->natt->oai.sin6.sin6_addr.s6_addr16[i]); 6085 } 6086 } 6087 break; 6088 #endif 6089 default: 6090 ipseclog((LOG_DEBUG, 6091 "%s: wrong NAT-OAi header.\n", 6092 __func__)); 6093 return (EINVAL); 6094 } 6095 } 6096 if (oar != NULL) { 6097 sa = (struct sockaddr *)(oar + 1); 6098 switch (sa->sa_family) { 6099 #ifdef AF_INET 6100 case AF_INET: 6101 if (sa->sa_len != sizeof(struct sockaddr_in)) { 6102 ipseclog((LOG_DEBUG, 6103 "%s: wrong NAT-OAr header.\n", 6104 __func__)); 6105 return (EINVAL); 6106 } 6107 /* Ignore address if it the same */ 6108 if (((struct sockaddr_in *)sa)->sin_addr.s_addr != 6109 sav->sah->saidx.dst.sin.sin_addr.s_addr) { 6110 bcopy(sa, &sav->natt->oar.sa, sa->sa_len); 6111 sav->natt->flags |= IPSEC_NATT_F_OAR; 6112 /* Calculate checksum delta */ 6113 addr = sav->sah->saidx.dst.sin.sin_addr.s_addr; 6114 cksum = in_addword(cksum, ~addr >> 16); 6115 cksum = in_addword(cksum, ~addr & 0xffff); 6116 addr = sav->natt->oar.sin.sin_addr.s_addr; 6117 cksum = in_addword(cksum, addr >> 16); 6118 cksum = in_addword(cksum, addr & 0xffff); 6119 } 6120 break; 6121 #endif 6122 #ifdef AF_INET6 6123 case AF_INET6: 6124 if (sa->sa_len != sizeof(struct sockaddr_in6)) { 6125 ipseclog((LOG_DEBUG, 6126 "%s: wrong NAT-OAr header.\n", 6127 __func__)); 6128 return (EINVAL); 6129 } 6130 /* Ignore address if it the same */ 6131 if (memcmp(&((struct sockaddr_in6 *)sa)->sin6_addr.s6_addr, 6132 &sav->sah->saidx.dst.sin6.sin6_addr.s6_addr, 16) != 0) { 6133 bcopy(sa, &sav->natt->oar.sa, sa->sa_len); 6134 sav->natt->flags |= IPSEC_NATT_F_OAR; 6135 /* Calculate checksum delta */ 6136 for (i = 0; i < 8; i++) { 6137 cksum = in_addword(cksum, 6138 ~sav->sah->saidx.dst.sin6.sin6_addr.s6_addr16[i]); 6139 cksum = in_addword(cksum, 6140 sav->natt->oar.sin6.sin6_addr.s6_addr16[i]); 6141 } 6142 } 6143 break; 6144 #endif 6145 default: 6146 ipseclog((LOG_DEBUG, 6147 "%s: wrong NAT-OAr header.\n", 6148 __func__)); 6149 return (EINVAL); 6150 } 6151 } 6152 sav->natt->cksum = cksum; 6153 } 6154 return (0); 6155 } 6156 6157 static int 6158 key_setident(struct secashead *sah, const struct sadb_msghdr *mhp) 6159 { 6160 const struct sadb_ident *idsrc, *iddst; 6161 6162 IPSEC_ASSERT(sah != NULL, ("null secashead")); 6163 IPSEC_ASSERT(mhp != NULL, ("null msghdr")); 6164 IPSEC_ASSERT(mhp->msg != NULL, ("null msg")); 6165 6166 /* don't make buffer if not there */ 6167 if (SADB_CHECKHDR(mhp, SADB_EXT_IDENTITY_SRC) && 6168 SADB_CHECKHDR(mhp, SADB_EXT_IDENTITY_DST)) { 6169 sah->idents = NULL; 6170 sah->identd = NULL; 6171 return (0); 6172 } 6173 6174 if (SADB_CHECKHDR(mhp, SADB_EXT_IDENTITY_SRC) || 6175 SADB_CHECKHDR(mhp, SADB_EXT_IDENTITY_DST)) { 6176 ipseclog((LOG_DEBUG, "%s: invalid identity.\n", __func__)); 6177 return (EINVAL); 6178 } 6179 6180 idsrc = (const struct sadb_ident *)mhp->ext[SADB_EXT_IDENTITY_SRC]; 6181 iddst = (const struct sadb_ident *)mhp->ext[SADB_EXT_IDENTITY_DST]; 6182 6183 /* validity check */ 6184 if (idsrc->sadb_ident_type != iddst->sadb_ident_type) { 6185 ipseclog((LOG_DEBUG, "%s: ident type mismatch.\n", __func__)); 6186 return EINVAL; 6187 } 6188 6189 switch (idsrc->sadb_ident_type) { 6190 case SADB_IDENTTYPE_PREFIX: 6191 case SADB_IDENTTYPE_FQDN: 6192 case SADB_IDENTTYPE_USERFQDN: 6193 default: 6194 /* XXX do nothing */ 6195 sah->idents = NULL; 6196 sah->identd = NULL; 6197 return 0; 6198 } 6199 6200 /* make structure */ 6201 sah->idents = malloc(sizeof(struct secident), M_IPSEC_MISC, M_NOWAIT); 6202 if (sah->idents == NULL) { 6203 ipseclog((LOG_DEBUG, "%s: No more memory.\n", __func__)); 6204 return ENOBUFS; 6205 } 6206 sah->identd = malloc(sizeof(struct secident), M_IPSEC_MISC, M_NOWAIT); 6207 if (sah->identd == NULL) { 6208 free(sah->idents, M_IPSEC_MISC); 6209 sah->idents = NULL; 6210 ipseclog((LOG_DEBUG, "%s: No more memory.\n", __func__)); 6211 return ENOBUFS; 6212 } 6213 sah->idents->type = idsrc->sadb_ident_type; 6214 sah->idents->id = idsrc->sadb_ident_id; 6215 6216 sah->identd->type = iddst->sadb_ident_type; 6217 sah->identd->id = iddst->sadb_ident_id; 6218 6219 return 0; 6220 } 6221 6222 /* 6223 * m will not be freed on return. 6224 * it is caller's responsibility to free the result. 6225 * 6226 * Called from SADB_ADD and SADB_UPDATE. Reply will contain headers 6227 * from the request in defined order. 6228 */ 6229 static struct mbuf * 6230 key_getmsgbuf_x1(struct mbuf *m, const struct sadb_msghdr *mhp) 6231 { 6232 struct mbuf *n; 6233 6234 IPSEC_ASSERT(m != NULL, ("null mbuf")); 6235 IPSEC_ASSERT(mhp != NULL, ("null msghdr")); 6236 IPSEC_ASSERT(mhp->msg != NULL, ("null msg")); 6237 6238 /* create new sadb_msg to reply. */ 6239 n = key_gather_mbuf(m, mhp, 1, 16, SADB_EXT_RESERVED, 6240 SADB_EXT_SA, SADB_X_EXT_SA2, 6241 SADB_EXT_ADDRESS_SRC, SADB_EXT_ADDRESS_DST, 6242 SADB_EXT_LIFETIME_HARD, SADB_EXT_LIFETIME_SOFT, 6243 SADB_EXT_IDENTITY_SRC, SADB_EXT_IDENTITY_DST, 6244 SADB_X_EXT_NAT_T_TYPE, SADB_X_EXT_NAT_T_SPORT, 6245 SADB_X_EXT_NAT_T_DPORT, SADB_X_EXT_NAT_T_OAI, 6246 SADB_X_EXT_NAT_T_OAR, SADB_X_EXT_NEW_ADDRESS_SRC, 6247 SADB_X_EXT_NEW_ADDRESS_DST); 6248 if (!n) 6249 return NULL; 6250 6251 if (n->m_len < sizeof(struct sadb_msg)) { 6252 n = m_pullup(n, sizeof(struct sadb_msg)); 6253 if (n == NULL) 6254 return NULL; 6255 } 6256 mtod(n, struct sadb_msg *)->sadb_msg_errno = 0; 6257 mtod(n, struct sadb_msg *)->sadb_msg_len = 6258 PFKEY_UNIT64(n->m_pkthdr.len); 6259 6260 return n; 6261 } 6262 6263 /* 6264 * SADB_DELETE processing 6265 * receive 6266 * <base, SA(*), address(SD)> 6267 * from the ikmpd, and set SADB_SASTATE_DEAD, 6268 * and send, 6269 * <base, SA(*), address(SD)> 6270 * to the ikmpd. 6271 * 6272 * m will always be freed. 6273 */ 6274 static int 6275 key_delete(struct socket *so, struct mbuf *m, const struct sadb_msghdr *mhp) 6276 { 6277 struct secasindex saidx; 6278 struct sadb_address *src0, *dst0; 6279 struct secasvar *sav; 6280 struct sadb_sa *sa0; 6281 uint8_t proto; 6282 6283 IPSEC_ASSERT(so != NULL, ("null socket")); 6284 IPSEC_ASSERT(m != NULL, ("null mbuf")); 6285 IPSEC_ASSERT(mhp != NULL, ("null msghdr")); 6286 IPSEC_ASSERT(mhp->msg != NULL, ("null msg")); 6287 6288 /* map satype to proto */ 6289 if ((proto = key_satype2proto(mhp->msg->sadb_msg_satype)) == 0) { 6290 ipseclog((LOG_DEBUG, "%s: invalid satype is passed.\n", 6291 __func__)); 6292 return key_senderror(so, m, EINVAL); 6293 } 6294 6295 if (SADB_CHECKHDR(mhp, SADB_EXT_ADDRESS_SRC) || 6296 SADB_CHECKHDR(mhp, SADB_EXT_ADDRESS_DST) || 6297 SADB_CHECKLEN(mhp, SADB_EXT_ADDRESS_SRC) || 6298 SADB_CHECKLEN(mhp, SADB_EXT_ADDRESS_DST)) { 6299 ipseclog((LOG_DEBUG, "%s: invalid message is passed.\n", 6300 __func__)); 6301 return key_senderror(so, m, EINVAL); 6302 } 6303 6304 src0 = (struct sadb_address *)(mhp->ext[SADB_EXT_ADDRESS_SRC]); 6305 dst0 = (struct sadb_address *)(mhp->ext[SADB_EXT_ADDRESS_DST]); 6306 6307 if (key_checksockaddrs((struct sockaddr *)(src0 + 1), 6308 (struct sockaddr *)(dst0 + 1)) != 0) { 6309 ipseclog((LOG_DEBUG, "%s: invalid sockaddr.\n", __func__)); 6310 return (key_senderror(so, m, EINVAL)); 6311 } 6312 KEY_SETSECASIDX(proto, IPSEC_MODE_ANY, 0, src0 + 1, dst0 + 1, &saidx); 6313 if (SADB_CHECKHDR(mhp, SADB_EXT_SA)) { 6314 /* 6315 * Caller wants us to delete all non-LARVAL SAs 6316 * that match the src/dst. This is used during 6317 * IKE INITIAL-CONTACT. 6318 * XXXAE: this looks like some extension to RFC2367. 6319 */ 6320 ipseclog((LOG_DEBUG, "%s: doing delete all.\n", __func__)); 6321 return (key_delete_all(so, m, mhp, &saidx)); 6322 } 6323 if (SADB_CHECKLEN(mhp, SADB_EXT_SA)) { 6324 ipseclog((LOG_DEBUG, 6325 "%s: invalid message: wrong header size.\n", __func__)); 6326 return (key_senderror(so, m, EINVAL)); 6327 } 6328 sa0 = (struct sadb_sa *)mhp->ext[SADB_EXT_SA]; 6329 SPI_ALLOC_LOCK(); 6330 if (proto == IPPROTO_TCP) 6331 sav = key_getsav_tcpmd5(&saidx, NULL); 6332 else 6333 sav = key_getsavbyspi(sa0->sadb_sa_spi); 6334 SPI_ALLOC_UNLOCK(); 6335 if (sav == NULL) { 6336 ipseclog((LOG_DEBUG, "%s: no SA found for SPI %u.\n", 6337 __func__, ntohl(sa0->sadb_sa_spi))); 6338 return (key_senderror(so, m, ESRCH)); 6339 } 6340 if (key_cmpsaidx(&sav->sah->saidx, &saidx, CMP_HEAD) == 0) { 6341 ipseclog((LOG_DEBUG, "%s: saidx mismatched for SPI %u.\n", 6342 __func__, ntohl(sav->spi))); 6343 key_freesav(&sav); 6344 return (key_senderror(so, m, ESRCH)); 6345 } 6346 KEYDBG(KEY_STAMP, 6347 printf("%s: SA(%p)\n", __func__, sav)); 6348 KEYDBG(KEY_DATA, kdebug_secasv(sav)); 6349 key_unlinksav(sav); 6350 key_freesav(&sav); 6351 6352 { 6353 struct mbuf *n; 6354 struct sadb_msg *newmsg; 6355 6356 /* create new sadb_msg to reply. */ 6357 n = key_gather_mbuf(m, mhp, 1, 4, SADB_EXT_RESERVED, 6358 SADB_EXT_SA, SADB_EXT_ADDRESS_SRC, SADB_EXT_ADDRESS_DST); 6359 if (!n) 6360 return key_senderror(so, m, ENOBUFS); 6361 6362 if (n->m_len < sizeof(struct sadb_msg)) { 6363 n = m_pullup(n, sizeof(struct sadb_msg)); 6364 if (n == NULL) 6365 return key_senderror(so, m, ENOBUFS); 6366 } 6367 newmsg = mtod(n, struct sadb_msg *); 6368 newmsg->sadb_msg_errno = 0; 6369 newmsg->sadb_msg_len = PFKEY_UNIT64(n->m_pkthdr.len); 6370 6371 m_freem(m); 6372 return key_sendup_mbuf(so, n, KEY_SENDUP_ALL); 6373 } 6374 } 6375 6376 /* 6377 * delete all SAs for src/dst. Called from key_delete(). 6378 */ 6379 static int 6380 key_delete_all(struct socket *so, struct mbuf *m, 6381 const struct sadb_msghdr *mhp, struct secasindex *saidx) 6382 { 6383 struct secasvar_queue drainq; 6384 struct secashead *sah; 6385 struct secasvar *sav, *nextsav; 6386 6387 TAILQ_INIT(&drainq); 6388 SAHTREE_WLOCK(); 6389 LIST_FOREACH(sah, SAHADDRHASH_HASH(saidx), addrhash) { 6390 if (key_cmpsaidx(&sah->saidx, saidx, CMP_HEAD) == 0) 6391 continue; 6392 /* Move all ALIVE SAs into drainq */ 6393 TAILQ_CONCAT(&drainq, &sah->savtree_alive, chain); 6394 } 6395 /* Unlink all queued SAs from SPI hash */ 6396 TAILQ_FOREACH(sav, &drainq, chain) { 6397 sav->state = SADB_SASTATE_DEAD; 6398 ipsec_accel_forget_sav(sav); 6399 LIST_REMOVE(sav, spihash); 6400 } 6401 SAHTREE_WUNLOCK(); 6402 /* Now we can release reference for all SAs in drainq */ 6403 sav = TAILQ_FIRST(&drainq); 6404 while (sav != NULL) { 6405 KEYDBG(KEY_STAMP, 6406 printf("%s: SA(%p)\n", __func__, sav)); 6407 KEYDBG(KEY_DATA, kdebug_secasv(sav)); 6408 nextsav = TAILQ_NEXT(sav, chain); 6409 key_freesah(&sav->sah); /* release reference from SAV */ 6410 key_freesav(&sav); /* release last reference */ 6411 sav = nextsav; 6412 } 6413 6414 { 6415 struct mbuf *n; 6416 struct sadb_msg *newmsg; 6417 6418 /* create new sadb_msg to reply. */ 6419 n = key_gather_mbuf(m, mhp, 1, 3, SADB_EXT_RESERVED, 6420 SADB_EXT_ADDRESS_SRC, SADB_EXT_ADDRESS_DST); 6421 if (!n) 6422 return key_senderror(so, m, ENOBUFS); 6423 6424 if (n->m_len < sizeof(struct sadb_msg)) { 6425 n = m_pullup(n, sizeof(struct sadb_msg)); 6426 if (n == NULL) 6427 return key_senderror(so, m, ENOBUFS); 6428 } 6429 newmsg = mtod(n, struct sadb_msg *); 6430 newmsg->sadb_msg_errno = 0; 6431 newmsg->sadb_msg_len = PFKEY_UNIT64(n->m_pkthdr.len); 6432 6433 m_freem(m); 6434 return key_sendup_mbuf(so, n, KEY_SENDUP_ALL); 6435 } 6436 } 6437 6438 /* 6439 * Delete all alive SAs for corresponding xform. 6440 * Larval SAs have not initialized tdb_xform, so it is safe to leave them 6441 * here when xform disappears. 6442 */ 6443 void 6444 key_delete_xform(const struct xformsw *xsp) 6445 { 6446 struct secasvar_queue drainq; 6447 struct secashead *sah; 6448 struct secasvar *sav, *nextsav; 6449 6450 TAILQ_INIT(&drainq); 6451 SAHTREE_WLOCK(); 6452 TAILQ_FOREACH(sah, &V_sahtree, chain) { 6453 sav = TAILQ_FIRST(&sah->savtree_alive); 6454 if (sav == NULL) 6455 continue; 6456 if (sav->tdb_xform != xsp) 6457 continue; 6458 /* 6459 * It is supposed that all SAs in the chain are related to 6460 * one xform. 6461 */ 6462 TAILQ_CONCAT(&drainq, &sah->savtree_alive, chain); 6463 } 6464 /* Unlink all queued SAs from SPI hash */ 6465 TAILQ_FOREACH(sav, &drainq, chain) { 6466 sav->state = SADB_SASTATE_DEAD; 6467 ipsec_accel_forget_sav(sav); 6468 LIST_REMOVE(sav, spihash); 6469 } 6470 SAHTREE_WUNLOCK(); 6471 6472 /* Now we can release reference for all SAs in drainq */ 6473 sav = TAILQ_FIRST(&drainq); 6474 while (sav != NULL) { 6475 KEYDBG(KEY_STAMP, 6476 printf("%s: SA(%p)\n", __func__, sav)); 6477 KEYDBG(KEY_DATA, kdebug_secasv(sav)); 6478 nextsav = TAILQ_NEXT(sav, chain); 6479 key_freesah(&sav->sah); /* release reference from SAV */ 6480 key_freesav(&sav); /* release last reference */ 6481 sav = nextsav; 6482 } 6483 } 6484 6485 /* 6486 * SADB_GET processing 6487 * receive 6488 * <base, SA(*), address(SD)> 6489 * from the ikmpd, and get a SP and a SA to respond, 6490 * and send, 6491 * <base, SA, (lifetime(HSC),) address(SD), (address(P),) key(AE), 6492 * (identity(SD),) (sensitivity)> 6493 * to the ikmpd. 6494 * 6495 * m will always be freed. 6496 */ 6497 static int 6498 key_get(struct socket *so, struct mbuf *m, const struct sadb_msghdr *mhp) 6499 { 6500 struct secasindex saidx; 6501 struct sadb_address *src0, *dst0; 6502 struct sadb_sa *sa0; 6503 struct secasvar *sav; 6504 uint8_t proto; 6505 6506 IPSEC_ASSERT(so != NULL, ("null socket")); 6507 IPSEC_ASSERT(m != NULL, ("null mbuf")); 6508 IPSEC_ASSERT(mhp != NULL, ("null msghdr")); 6509 IPSEC_ASSERT(mhp->msg != NULL, ("null msg")); 6510 6511 /* map satype to proto */ 6512 if ((proto = key_satype2proto(mhp->msg->sadb_msg_satype)) == 0) { 6513 ipseclog((LOG_DEBUG, "%s: invalid satype is passed.\n", 6514 __func__)); 6515 return key_senderror(so, m, EINVAL); 6516 } 6517 6518 if (SADB_CHECKHDR(mhp, SADB_EXT_SA) || 6519 SADB_CHECKHDR(mhp, SADB_EXT_ADDRESS_SRC) || 6520 SADB_CHECKHDR(mhp, SADB_EXT_ADDRESS_DST)) { 6521 ipseclog((LOG_DEBUG, 6522 "%s: invalid message: missing required header.\n", 6523 __func__)); 6524 return key_senderror(so, m, EINVAL); 6525 } 6526 if (SADB_CHECKLEN(mhp, SADB_EXT_SA) || 6527 SADB_CHECKLEN(mhp, SADB_EXT_ADDRESS_SRC) || 6528 SADB_CHECKLEN(mhp, SADB_EXT_ADDRESS_DST)) { 6529 ipseclog((LOG_DEBUG, 6530 "%s: invalid message: wrong header size.\n", __func__)); 6531 return key_senderror(so, m, EINVAL); 6532 } 6533 6534 sa0 = (struct sadb_sa *)mhp->ext[SADB_EXT_SA]; 6535 src0 = (struct sadb_address *)mhp->ext[SADB_EXT_ADDRESS_SRC]; 6536 dst0 = (struct sadb_address *)mhp->ext[SADB_EXT_ADDRESS_DST]; 6537 6538 if (key_checksockaddrs((struct sockaddr *)(src0 + 1), 6539 (struct sockaddr *)(dst0 + 1)) != 0) { 6540 ipseclog((LOG_DEBUG, "%s: invalid sockaddr.\n", __func__)); 6541 return key_senderror(so, m, EINVAL); 6542 } 6543 KEY_SETSECASIDX(proto, IPSEC_MODE_ANY, 0, src0 + 1, dst0 + 1, &saidx); 6544 6545 SPI_ALLOC_LOCK(); 6546 if (proto == IPPROTO_TCP) 6547 sav = key_getsav_tcpmd5(&saidx, NULL); 6548 else 6549 sav = key_getsavbyspi(sa0->sadb_sa_spi); 6550 SPI_ALLOC_UNLOCK(); 6551 if (sav == NULL) { 6552 ipseclog((LOG_DEBUG, "%s: no SA found.\n", __func__)); 6553 return key_senderror(so, m, ESRCH); 6554 } 6555 if (key_cmpsaidx(&sav->sah->saidx, &saidx, CMP_HEAD) == 0) { 6556 ipseclog((LOG_DEBUG, "%s: saidx mismatched for SPI %u.\n", 6557 __func__, ntohl(sa0->sadb_sa_spi))); 6558 key_freesav(&sav); 6559 return (key_senderror(so, m, ESRCH)); 6560 } 6561 6562 { 6563 struct mbuf *n; 6564 uint8_t satype; 6565 6566 /* map proto to satype */ 6567 if ((satype = key_proto2satype(sav->sah->saidx.proto)) == 0) { 6568 ipseclog((LOG_DEBUG, "%s: there was invalid proto in SAD.\n", 6569 __func__)); 6570 key_freesav(&sav); 6571 return key_senderror(so, m, EINVAL); 6572 } 6573 6574 /* create new sadb_msg to reply. */ 6575 n = key_setdumpsa(sav, SADB_GET, satype, mhp->msg->sadb_msg_seq, 6576 mhp->msg->sadb_msg_pid, NULL); 6577 6578 key_freesav(&sav); 6579 if (!n) 6580 return key_senderror(so, m, ENOBUFS); 6581 6582 m_freem(m); 6583 return key_sendup_mbuf(so, n, KEY_SENDUP_ONE); 6584 } 6585 } 6586 6587 /* XXX make it sysctl-configurable? */ 6588 static void 6589 key_getcomb_setlifetime(struct sadb_comb *comb) 6590 { 6591 6592 comb->sadb_comb_soft_allocations = 1; 6593 comb->sadb_comb_hard_allocations = 1; 6594 comb->sadb_comb_soft_bytes = 0; 6595 comb->sadb_comb_hard_bytes = 0; 6596 comb->sadb_comb_hard_addtime = 86400; /* 1 day */ 6597 comb->sadb_comb_soft_addtime = comb->sadb_comb_soft_addtime * 80 / 100; 6598 comb->sadb_comb_soft_usetime = 28800; /* 8 hours */ 6599 comb->sadb_comb_hard_usetime = comb->sadb_comb_hard_usetime * 80 / 100; 6600 } 6601 6602 /* 6603 * XXX reorder combinations by preference 6604 * XXX no idea if the user wants ESP authentication or not 6605 */ 6606 static struct mbuf * 6607 key_getcomb_ealg(void) 6608 { 6609 struct sadb_comb *comb; 6610 const struct enc_xform *algo; 6611 struct mbuf *result = NULL, *m, *n; 6612 int encmin; 6613 int i, off, o; 6614 int totlen; 6615 const int l = PFKEY_ALIGN8(sizeof(struct sadb_comb)); 6616 6617 m = NULL; 6618 for (i = 1; i <= SADB_EALG_MAX; i++) { 6619 algo = enc_algorithm_lookup(i); 6620 if (algo == NULL) 6621 continue; 6622 6623 /* discard algorithms with key size smaller than system min */ 6624 if (_BITS(algo->maxkey) < V_ipsec_esp_keymin) 6625 continue; 6626 if (_BITS(algo->minkey) < V_ipsec_esp_keymin) 6627 encmin = V_ipsec_esp_keymin; 6628 else 6629 encmin = _BITS(algo->minkey); 6630 6631 if (V_ipsec_esp_auth) 6632 m = key_getcomb_ah(); 6633 else { 6634 IPSEC_ASSERT(l <= MLEN, 6635 ("l=%u > MLEN=%lu", l, (u_long) MLEN)); 6636 MGET(m, M_NOWAIT, MT_DATA); 6637 if (m) { 6638 M_ALIGN(m, l); 6639 m->m_len = l; 6640 m->m_next = NULL; 6641 bzero(mtod(m, caddr_t), m->m_len); 6642 } 6643 } 6644 if (!m) 6645 goto fail; 6646 6647 totlen = 0; 6648 for (n = m; n; n = n->m_next) 6649 totlen += n->m_len; 6650 IPSEC_ASSERT((totlen % l) == 0, ("totlen=%u, l=%u", totlen, l)); 6651 6652 for (off = 0; off < totlen; off += l) { 6653 n = m_pulldown(m, off, l, &o); 6654 if (!n) { 6655 /* m is already freed */ 6656 goto fail; 6657 } 6658 comb = (struct sadb_comb *)(mtod(n, caddr_t) + o); 6659 bzero(comb, sizeof(*comb)); 6660 key_getcomb_setlifetime(comb); 6661 comb->sadb_comb_encrypt = i; 6662 comb->sadb_comb_encrypt_minbits = encmin; 6663 comb->sadb_comb_encrypt_maxbits = _BITS(algo->maxkey); 6664 } 6665 6666 if (!result) 6667 result = m; 6668 else 6669 m_cat(result, m); 6670 } 6671 6672 return result; 6673 6674 fail: 6675 if (result) 6676 m_freem(result); 6677 return NULL; 6678 } 6679 6680 static void 6681 key_getsizes_ah(const struct auth_hash *ah, int alg, u_int16_t* min, 6682 u_int16_t* max) 6683 { 6684 6685 *min = *max = ah->hashsize; 6686 if (ah->keysize == 0) { 6687 /* 6688 * Transform takes arbitrary key size but algorithm 6689 * key size is restricted. Enforce this here. 6690 */ 6691 switch (alg) { 6692 case SADB_X_AALG_NULL: *min = 1; *max = 256; break; 6693 case SADB_X_AALG_SHA2_256: *min = *max = 32; break; 6694 case SADB_X_AALG_SHA2_384: *min = *max = 48; break; 6695 case SADB_X_AALG_SHA2_512: *min = *max = 64; break; 6696 default: 6697 DPRINTF(("%s: unknown AH algorithm %u\n", 6698 __func__, alg)); 6699 break; 6700 } 6701 } 6702 } 6703 6704 /* 6705 * XXX reorder combinations by preference 6706 */ 6707 static struct mbuf * 6708 key_getcomb_ah(void) 6709 { 6710 const struct auth_hash *algo; 6711 struct sadb_comb *comb; 6712 struct mbuf *m; 6713 u_int16_t minkeysize, maxkeysize; 6714 int i; 6715 const int l = PFKEY_ALIGN8(sizeof(struct sadb_comb)); 6716 6717 m = NULL; 6718 for (i = 1; i <= SADB_AALG_MAX; i++) { 6719 #if 1 6720 /* we prefer HMAC algorithms, not old algorithms */ 6721 if (i != SADB_AALG_SHA1HMAC && 6722 i != SADB_X_AALG_SHA2_256 && 6723 i != SADB_X_AALG_SHA2_384 && 6724 i != SADB_X_AALG_SHA2_512) 6725 continue; 6726 #endif 6727 algo = auth_algorithm_lookup(i); 6728 if (!algo) 6729 continue; 6730 key_getsizes_ah(algo, i, &minkeysize, &maxkeysize); 6731 /* discard algorithms with key size smaller than system min */ 6732 if (_BITS(minkeysize) < V_ipsec_ah_keymin) 6733 continue; 6734 6735 if (!m) { 6736 IPSEC_ASSERT(l <= MLEN, 6737 ("l=%u > MLEN=%lu", l, (u_long) MLEN)); 6738 MGET(m, M_NOWAIT, MT_DATA); 6739 if (m) { 6740 M_ALIGN(m, l); 6741 m->m_len = l; 6742 m->m_next = NULL; 6743 } 6744 } else 6745 M_PREPEND(m, l, M_NOWAIT); 6746 if (!m) 6747 return NULL; 6748 6749 comb = mtod(m, struct sadb_comb *); 6750 bzero(comb, sizeof(*comb)); 6751 key_getcomb_setlifetime(comb); 6752 comb->sadb_comb_auth = i; 6753 comb->sadb_comb_auth_minbits = _BITS(minkeysize); 6754 comb->sadb_comb_auth_maxbits = _BITS(maxkeysize); 6755 } 6756 6757 return m; 6758 } 6759 6760 /* 6761 * not really an official behavior. discussed in pf_key@inner.net in Sep2000. 6762 * XXX reorder combinations by preference 6763 */ 6764 static struct mbuf * 6765 key_getcomb_ipcomp(void) 6766 { 6767 const struct comp_algo *algo; 6768 struct sadb_comb *comb; 6769 struct mbuf *m; 6770 int i; 6771 const int l = PFKEY_ALIGN8(sizeof(struct sadb_comb)); 6772 6773 m = NULL; 6774 for (i = 1; i <= SADB_X_CALG_MAX; i++) { 6775 algo = comp_algorithm_lookup(i); 6776 if (!algo) 6777 continue; 6778 6779 if (!m) { 6780 IPSEC_ASSERT(l <= MLEN, 6781 ("l=%u > MLEN=%lu", l, (u_long) MLEN)); 6782 MGET(m, M_NOWAIT, MT_DATA); 6783 if (m) { 6784 M_ALIGN(m, l); 6785 m->m_len = l; 6786 m->m_next = NULL; 6787 } 6788 } else 6789 M_PREPEND(m, l, M_NOWAIT); 6790 if (!m) 6791 return NULL; 6792 6793 comb = mtod(m, struct sadb_comb *); 6794 bzero(comb, sizeof(*comb)); 6795 key_getcomb_setlifetime(comb); 6796 comb->sadb_comb_encrypt = i; 6797 /* what should we set into sadb_comb_*_{min,max}bits? */ 6798 } 6799 6800 return m; 6801 } 6802 6803 /* 6804 * XXX no way to pass mode (transport/tunnel) to userland 6805 * XXX replay checking? 6806 * XXX sysctl interface to ipsec_{ah,esp}_keymin 6807 */ 6808 static struct mbuf * 6809 key_getprop(const struct secasindex *saidx) 6810 { 6811 struct sadb_prop *prop; 6812 struct mbuf *m, *n; 6813 const int l = PFKEY_ALIGN8(sizeof(struct sadb_prop)); 6814 int totlen; 6815 6816 switch (saidx->proto) { 6817 case IPPROTO_ESP: 6818 m = key_getcomb_ealg(); 6819 break; 6820 case IPPROTO_AH: 6821 m = key_getcomb_ah(); 6822 break; 6823 case IPPROTO_IPCOMP: 6824 m = key_getcomb_ipcomp(); 6825 break; 6826 default: 6827 return NULL; 6828 } 6829 6830 if (!m) 6831 return NULL; 6832 M_PREPEND(m, l, M_NOWAIT); 6833 if (!m) 6834 return NULL; 6835 6836 totlen = 0; 6837 for (n = m; n; n = n->m_next) 6838 totlen += n->m_len; 6839 6840 prop = mtod(m, struct sadb_prop *); 6841 bzero(prop, sizeof(*prop)); 6842 prop->sadb_prop_len = PFKEY_UNIT64(totlen); 6843 prop->sadb_prop_exttype = SADB_EXT_PROPOSAL; 6844 prop->sadb_prop_replay = 32; /* XXX */ 6845 6846 return m; 6847 } 6848 6849 /* 6850 * SADB_ACQUIRE processing called by key_checkrequest() and key_acquire2(). 6851 * send 6852 * <base, SA, address(SD), (address(P)), x_policy, 6853 * (identity(SD),) (sensitivity,) proposal> 6854 * to KMD, and expect to receive 6855 * <base> with SADB_ACQUIRE if error occurred, 6856 * or 6857 * <base, src address, dst address, (SPI range)> with SADB_GETSPI 6858 * from KMD by PF_KEY. 6859 * 6860 * XXX x_policy is outside of RFC2367 (KAME extension). 6861 * XXX sensitivity is not supported. 6862 * XXX for ipcomp, RFC2367 does not define how to fill in proposal. 6863 * see comment for key_getcomb_ipcomp(). 6864 * 6865 * OUT: 6866 * 0 : succeed 6867 * others: error number 6868 */ 6869 static int 6870 key_acquire(const struct secasindex *saidx, struct secpolicy *sp) 6871 { 6872 union sockaddr_union addr; 6873 struct mbuf *result, *m; 6874 uint32_t seq; 6875 int error; 6876 uint16_t ul_proto; 6877 uint8_t mask, satype; 6878 6879 IPSEC_ASSERT(saidx != NULL, ("null saidx")); 6880 satype = key_proto2satype(saidx->proto); 6881 IPSEC_ASSERT(satype != 0, ("null satype, protocol %u", saidx->proto)); 6882 6883 error = -1; 6884 result = NULL; 6885 ul_proto = IPSEC_ULPROTO_ANY; 6886 6887 /* Get seq number to check whether sending message or not. */ 6888 seq = key_getacq(saidx, &error); 6889 if (seq == 0) 6890 return (error); 6891 6892 m = key_setsadbmsg(SADB_ACQUIRE, 0, satype, seq, 0, 0); 6893 if (!m) { 6894 error = ENOBUFS; 6895 goto fail; 6896 } 6897 result = m; 6898 6899 /* 6900 * set sadb_address for saidx's. 6901 * 6902 * Note that if sp is supplied, then we're being called from 6903 * key_allocsa_policy() and should supply port and protocol 6904 * information. 6905 * XXXAE: why only TCP and UDP? ICMP and SCTP looks applicable too. 6906 * XXXAE: probably we can handle this in the ipsec[46]_allocsa(). 6907 * XXXAE: it looks like we should save this info in the ACQ entry. 6908 */ 6909 if (sp != NULL && (sp->spidx.ul_proto == IPPROTO_TCP || 6910 sp->spidx.ul_proto == IPPROTO_UDP)) 6911 ul_proto = sp->spidx.ul_proto; 6912 6913 addr = saidx->src; 6914 mask = FULLMASK; 6915 if (ul_proto != IPSEC_ULPROTO_ANY) { 6916 switch (sp->spidx.src.sa.sa_family) { 6917 case AF_INET: 6918 if (sp->spidx.src.sin.sin_port != IPSEC_PORT_ANY) { 6919 addr.sin.sin_port = sp->spidx.src.sin.sin_port; 6920 mask = sp->spidx.prefs; 6921 } 6922 break; 6923 case AF_INET6: 6924 if (sp->spidx.src.sin6.sin6_port != IPSEC_PORT_ANY) { 6925 addr.sin6.sin6_port = 6926 sp->spidx.src.sin6.sin6_port; 6927 mask = sp->spidx.prefs; 6928 } 6929 break; 6930 default: 6931 break; 6932 } 6933 } 6934 m = key_setsadbaddr(SADB_EXT_ADDRESS_SRC, &addr.sa, mask, ul_proto); 6935 if (!m) { 6936 error = ENOBUFS; 6937 goto fail; 6938 } 6939 m_cat(result, m); 6940 6941 addr = saidx->dst; 6942 mask = FULLMASK; 6943 if (ul_proto != IPSEC_ULPROTO_ANY) { 6944 switch (sp->spidx.dst.sa.sa_family) { 6945 case AF_INET: 6946 if (sp->spidx.dst.sin.sin_port != IPSEC_PORT_ANY) { 6947 addr.sin.sin_port = sp->spidx.dst.sin.sin_port; 6948 mask = sp->spidx.prefd; 6949 } 6950 break; 6951 case AF_INET6: 6952 if (sp->spidx.dst.sin6.sin6_port != IPSEC_PORT_ANY) { 6953 addr.sin6.sin6_port = 6954 sp->spidx.dst.sin6.sin6_port; 6955 mask = sp->spidx.prefd; 6956 } 6957 break; 6958 default: 6959 break; 6960 } 6961 } 6962 m = key_setsadbaddr(SADB_EXT_ADDRESS_DST, &addr.sa, mask, ul_proto); 6963 if (!m) { 6964 error = ENOBUFS; 6965 goto fail; 6966 } 6967 m_cat(result, m); 6968 6969 /* XXX proxy address (optional) */ 6970 6971 /* 6972 * Set sadb_x_policy. This is KAME extension to RFC2367. 6973 */ 6974 if (sp != NULL) { 6975 m = key_setsadbxpolicy(sp->policy, sp->spidx.dir, sp->id, 6976 sp->priority); 6977 if (!m) { 6978 error = ENOBUFS; 6979 goto fail; 6980 } 6981 m_cat(result, m); 6982 } 6983 6984 /* 6985 * Set sadb_x_sa2 extension if saidx->reqid is not zero. 6986 * This is FreeBSD extension to RFC2367. 6987 */ 6988 if (saidx->reqid != 0) { 6989 m = key_setsadbxsa2(saidx->mode, 0, saidx->reqid); 6990 if (m == NULL) { 6991 error = ENOBUFS; 6992 goto fail; 6993 } 6994 m_cat(result, m); 6995 } 6996 /* XXX identity (optional) */ 6997 #if 0 6998 if (idexttype && fqdn) { 6999 /* create identity extension (FQDN) */ 7000 struct sadb_ident *id; 7001 int fqdnlen; 7002 7003 fqdnlen = strlen(fqdn) + 1; /* +1 for terminating-NUL */ 7004 id = (struct sadb_ident *)p; 7005 bzero(id, sizeof(*id) + PFKEY_ALIGN8(fqdnlen)); 7006 id->sadb_ident_len = PFKEY_UNIT64(sizeof(*id) + PFKEY_ALIGN8(fqdnlen)); 7007 id->sadb_ident_exttype = idexttype; 7008 id->sadb_ident_type = SADB_IDENTTYPE_FQDN; 7009 bcopy(fqdn, id + 1, fqdnlen); 7010 p += sizeof(struct sadb_ident) + PFKEY_ALIGN8(fqdnlen); 7011 } 7012 7013 if (idexttype) { 7014 /* create identity extension (USERFQDN) */ 7015 struct sadb_ident *id; 7016 int userfqdnlen; 7017 7018 if (userfqdn) { 7019 /* +1 for terminating-NUL */ 7020 userfqdnlen = strlen(userfqdn) + 1; 7021 } else 7022 userfqdnlen = 0; 7023 id = (struct sadb_ident *)p; 7024 bzero(id, sizeof(*id) + PFKEY_ALIGN8(userfqdnlen)); 7025 id->sadb_ident_len = PFKEY_UNIT64(sizeof(*id) + PFKEY_ALIGN8(userfqdnlen)); 7026 id->sadb_ident_exttype = idexttype; 7027 id->sadb_ident_type = SADB_IDENTTYPE_USERFQDN; 7028 /* XXX is it correct? */ 7029 if (curproc && curproc->p_cred) 7030 id->sadb_ident_id = curproc->p_cred->p_ruid; 7031 if (userfqdn && userfqdnlen) 7032 bcopy(userfqdn, id + 1, userfqdnlen); 7033 p += sizeof(struct sadb_ident) + PFKEY_ALIGN8(userfqdnlen); 7034 } 7035 #endif 7036 7037 /* XXX sensitivity (optional) */ 7038 7039 /* create proposal/combination extension */ 7040 m = key_getprop(saidx); 7041 #if 0 7042 /* 7043 * spec conformant: always attach proposal/combination extension, 7044 * the problem is that we have no way to attach it for ipcomp, 7045 * due to the way sadb_comb is declared in RFC2367. 7046 */ 7047 if (!m) { 7048 error = ENOBUFS; 7049 goto fail; 7050 } 7051 m_cat(result, m); 7052 #else 7053 /* 7054 * outside of spec; make proposal/combination extension optional. 7055 */ 7056 if (m) 7057 m_cat(result, m); 7058 #endif 7059 7060 if ((result->m_flags & M_PKTHDR) == 0) { 7061 error = EINVAL; 7062 goto fail; 7063 } 7064 7065 if (result->m_len < sizeof(struct sadb_msg)) { 7066 result = m_pullup(result, sizeof(struct sadb_msg)); 7067 if (result == NULL) { 7068 error = ENOBUFS; 7069 goto fail; 7070 } 7071 } 7072 7073 result->m_pkthdr.len = 0; 7074 for (m = result; m; m = m->m_next) 7075 result->m_pkthdr.len += m->m_len; 7076 7077 mtod(result, struct sadb_msg *)->sadb_msg_len = 7078 PFKEY_UNIT64(result->m_pkthdr.len); 7079 7080 KEYDBG(KEY_STAMP, 7081 printf("%s: SP(%p)\n", __func__, sp)); 7082 KEYDBG(KEY_DATA, kdebug_secasindex(saidx, NULL)); 7083 7084 return key_sendup_mbuf(NULL, result, KEY_SENDUP_REGISTERED); 7085 7086 fail: 7087 if (result) 7088 m_freem(result); 7089 return error; 7090 } 7091 7092 static uint32_t 7093 key_newacq(const struct secasindex *saidx, int *perror) 7094 { 7095 struct secacq *acq; 7096 uint32_t seq; 7097 7098 acq = malloc(sizeof(*acq), M_IPSEC_SAQ, M_NOWAIT | M_ZERO); 7099 if (acq == NULL) { 7100 ipseclog((LOG_DEBUG, "%s: No more memory.\n", __func__)); 7101 *perror = ENOBUFS; 7102 return (0); 7103 } 7104 7105 /* copy secindex */ 7106 bcopy(saidx, &acq->saidx, sizeof(acq->saidx)); 7107 acq->created = time_second; 7108 acq->count = 0; 7109 7110 /* add to acqtree */ 7111 ACQ_LOCK(); 7112 seq = acq->seq = (V_acq_seq == ~0 ? 1 : ++V_acq_seq); 7113 LIST_INSERT_HEAD(&V_acqtree, acq, chain); 7114 LIST_INSERT_HEAD(ACQADDRHASH_HASH(saidx), acq, addrhash); 7115 LIST_INSERT_HEAD(ACQSEQHASH_HASH(seq), acq, seqhash); 7116 ACQ_UNLOCK(); 7117 *perror = 0; 7118 return (seq); 7119 } 7120 7121 static uint32_t 7122 key_getacq(const struct secasindex *saidx, int *perror) 7123 { 7124 struct secacq *acq; 7125 uint32_t seq; 7126 7127 ACQ_LOCK(); 7128 LIST_FOREACH(acq, ACQADDRHASH_HASH(saidx), addrhash) { 7129 if (key_cmpsaidx(&acq->saidx, saidx, CMP_EXACTLY)) { 7130 if (acq->count > V_key_blockacq_count) { 7131 /* 7132 * Reset counter and send message. 7133 * Also reset created time to keep ACQ for 7134 * this saidx. 7135 */ 7136 acq->created = time_second; 7137 acq->count = 0; 7138 seq = acq->seq; 7139 } else { 7140 /* 7141 * Increment counter and do nothing. 7142 * We send SADB_ACQUIRE message only 7143 * for each V_key_blockacq_count packet. 7144 */ 7145 acq->count++; 7146 seq = 0; 7147 } 7148 break; 7149 } 7150 } 7151 ACQ_UNLOCK(); 7152 if (acq != NULL) { 7153 *perror = 0; 7154 return (seq); 7155 } 7156 /* allocate new entry */ 7157 return (key_newacq(saidx, perror)); 7158 } 7159 7160 static int 7161 key_acqreset(uint32_t seq) 7162 { 7163 struct secacq *acq; 7164 7165 ACQ_LOCK(); 7166 LIST_FOREACH(acq, ACQSEQHASH_HASH(seq), seqhash) { 7167 if (acq->seq == seq) { 7168 acq->count = 0; 7169 acq->created = time_second; 7170 break; 7171 } 7172 } 7173 ACQ_UNLOCK(); 7174 if (acq == NULL) 7175 return (ESRCH); 7176 return (0); 7177 } 7178 /* 7179 * Mark ACQ entry as stale to remove it in key_flush_acq(). 7180 * Called after successful SADB_GETSPI message. 7181 */ 7182 static int 7183 key_acqdone(const struct secasindex *saidx, uint32_t seq) 7184 { 7185 struct secacq *acq; 7186 7187 ACQ_LOCK(); 7188 LIST_FOREACH(acq, ACQSEQHASH_HASH(seq), seqhash) { 7189 if (acq->seq == seq) 7190 break; 7191 } 7192 if (acq != NULL) { 7193 if (key_cmpsaidx(&acq->saidx, saidx, CMP_EXACTLY) == 0) { 7194 ipseclog((LOG_DEBUG, 7195 "%s: Mismatched saidx for ACQ %u\n", __func__, seq)); 7196 acq = NULL; 7197 } else { 7198 acq->created = 0; 7199 } 7200 } else { 7201 ipseclog((LOG_DEBUG, 7202 "%s: ACQ %u is not found.\n", __func__, seq)); 7203 } 7204 ACQ_UNLOCK(); 7205 if (acq == NULL) 7206 return (ESRCH); 7207 return (0); 7208 } 7209 7210 static struct secspacq * 7211 key_newspacq(struct secpolicyindex *spidx) 7212 { 7213 struct secspacq *acq; 7214 7215 /* get new entry */ 7216 acq = malloc(sizeof(struct secspacq), M_IPSEC_SAQ, M_NOWAIT|M_ZERO); 7217 if (acq == NULL) { 7218 ipseclog((LOG_DEBUG, "%s: No more memory.\n", __func__)); 7219 return NULL; 7220 } 7221 7222 /* copy secindex */ 7223 bcopy(spidx, &acq->spidx, sizeof(acq->spidx)); 7224 acq->created = time_second; 7225 acq->count = 0; 7226 7227 /* add to spacqtree */ 7228 SPACQ_LOCK(); 7229 LIST_INSERT_HEAD(&V_spacqtree, acq, chain); 7230 SPACQ_UNLOCK(); 7231 7232 return acq; 7233 } 7234 7235 static struct secspacq * 7236 key_getspacq(struct secpolicyindex *spidx) 7237 { 7238 struct secspacq *acq; 7239 7240 SPACQ_LOCK(); 7241 LIST_FOREACH(acq, &V_spacqtree, chain) { 7242 if (key_cmpspidx_exactly(spidx, &acq->spidx)) { 7243 /* NB: return holding spacq_lock */ 7244 return acq; 7245 } 7246 } 7247 SPACQ_UNLOCK(); 7248 7249 return NULL; 7250 } 7251 7252 /* 7253 * SADB_ACQUIRE processing, 7254 * in first situation, is receiving 7255 * <base> 7256 * from the ikmpd, and clear sequence of its secasvar entry. 7257 * 7258 * In second situation, is receiving 7259 * <base, address(SD), (address(P),) (identity(SD),) (sensitivity,) proposal> 7260 * from a user land process, and return 7261 * <base, address(SD), (address(P),) (identity(SD),) (sensitivity,) proposal> 7262 * to the socket. 7263 * 7264 * m will always be freed. 7265 */ 7266 static int 7267 key_acquire2(struct socket *so, struct mbuf *m, const struct sadb_msghdr *mhp) 7268 { 7269 SAHTREE_RLOCK_TRACKER; 7270 struct sadb_address *src0, *dst0; 7271 struct secasindex saidx; 7272 struct secashead *sah; 7273 uint32_t reqid; 7274 int error; 7275 uint8_t mode, proto; 7276 7277 IPSEC_ASSERT(so != NULL, ("null socket")); 7278 IPSEC_ASSERT(m != NULL, ("null mbuf")); 7279 IPSEC_ASSERT(mhp != NULL, ("null msghdr")); 7280 IPSEC_ASSERT(mhp->msg != NULL, ("null msg")); 7281 7282 /* 7283 * Error message from KMd. 7284 * We assume that if error was occurred in IKEd, the length of PFKEY 7285 * message is equal to the size of sadb_msg structure. 7286 * We do not raise error even if error occurred in this function. 7287 */ 7288 if (mhp->msg->sadb_msg_len == PFKEY_UNIT64(sizeof(struct sadb_msg))) { 7289 /* check sequence number */ 7290 if (mhp->msg->sadb_msg_seq == 0 || 7291 mhp->msg->sadb_msg_errno == 0) { 7292 ipseclog((LOG_DEBUG, "%s: must specify sequence " 7293 "number and errno.\n", __func__)); 7294 } else { 7295 /* 7296 * IKEd reported that error occurred. 7297 * XXXAE: what it expects from the kernel? 7298 * Probably we should send SADB_ACQUIRE again? 7299 * If so, reset ACQ's state. 7300 * XXXAE: it looks useless. 7301 */ 7302 key_acqreset(mhp->msg->sadb_msg_seq); 7303 } 7304 m_freem(m); 7305 return (0); 7306 } 7307 7308 /* 7309 * This message is from user land. 7310 */ 7311 7312 /* map satype to proto */ 7313 if ((proto = key_satype2proto(mhp->msg->sadb_msg_satype)) == 0) { 7314 ipseclog((LOG_DEBUG, "%s: invalid satype is passed.\n", 7315 __func__)); 7316 return key_senderror(so, m, EINVAL); 7317 } 7318 7319 if (SADB_CHECKHDR(mhp, SADB_EXT_ADDRESS_SRC) || 7320 SADB_CHECKHDR(mhp, SADB_EXT_ADDRESS_DST) || 7321 SADB_CHECKHDR(mhp, SADB_EXT_PROPOSAL)) { 7322 ipseclog((LOG_DEBUG, 7323 "%s: invalid message: missing required header.\n", 7324 __func__)); 7325 return key_senderror(so, m, EINVAL); 7326 } 7327 if (SADB_CHECKLEN(mhp, SADB_EXT_ADDRESS_SRC) || 7328 SADB_CHECKLEN(mhp, SADB_EXT_ADDRESS_DST) || 7329 SADB_CHECKLEN(mhp, SADB_EXT_PROPOSAL)) { 7330 ipseclog((LOG_DEBUG, 7331 "%s: invalid message: wrong header size.\n", __func__)); 7332 return key_senderror(so, m, EINVAL); 7333 } 7334 7335 if (SADB_CHECKHDR(mhp, SADB_X_EXT_SA2)) { 7336 mode = IPSEC_MODE_ANY; 7337 reqid = 0; 7338 } else { 7339 if (SADB_CHECKLEN(mhp, SADB_X_EXT_SA2)) { 7340 ipseclog((LOG_DEBUG, 7341 "%s: invalid message: wrong header size.\n", 7342 __func__)); 7343 return key_senderror(so, m, EINVAL); 7344 } 7345 mode = ((struct sadb_x_sa2 *) 7346 mhp->ext[SADB_X_EXT_SA2])->sadb_x_sa2_mode; 7347 reqid = ((struct sadb_x_sa2 *) 7348 mhp->ext[SADB_X_EXT_SA2])->sadb_x_sa2_reqid; 7349 } 7350 7351 src0 = (struct sadb_address *)mhp->ext[SADB_EXT_ADDRESS_SRC]; 7352 dst0 = (struct sadb_address *)mhp->ext[SADB_EXT_ADDRESS_DST]; 7353 7354 error = key_checksockaddrs((struct sockaddr *)(src0 + 1), 7355 (struct sockaddr *)(dst0 + 1)); 7356 if (error != 0) { 7357 ipseclog((LOG_DEBUG, "%s: invalid sockaddr.\n", __func__)); 7358 return key_senderror(so, m, EINVAL); 7359 } 7360 KEY_SETSECASIDX(proto, mode, reqid, src0 + 1, dst0 + 1, &saidx); 7361 7362 /* get a SA index */ 7363 SAHTREE_RLOCK(); 7364 LIST_FOREACH(sah, SAHADDRHASH_HASH(&saidx), addrhash) { 7365 if (key_cmpsaidx(&sah->saidx, &saidx, CMP_MODE_REQID)) 7366 break; 7367 } 7368 SAHTREE_RUNLOCK(); 7369 if (sah != NULL) { 7370 ipseclog((LOG_DEBUG, "%s: a SA exists already.\n", __func__)); 7371 return key_senderror(so, m, EEXIST); 7372 } 7373 7374 error = key_acquire(&saidx, NULL); 7375 if (error != 0) { 7376 ipseclog((LOG_DEBUG, 7377 "%s: error %d returned from key_acquire()\n", 7378 __func__, error)); 7379 return key_senderror(so, m, error); 7380 } 7381 m_freem(m); 7382 return (0); 7383 } 7384 7385 /* 7386 * SADB_REGISTER processing. 7387 * If SATYPE_UNSPEC has been passed as satype, only return sabd_supported. 7388 * receive 7389 * <base> 7390 * from the ikmpd, and register a socket to send PF_KEY messages, 7391 * and send 7392 * <base, supported> 7393 * to KMD by PF_KEY. 7394 * If socket is detached, must free from regnode. 7395 * 7396 * m will always be freed. 7397 */ 7398 static int 7399 key_register(struct socket *so, struct mbuf *m, const struct sadb_msghdr *mhp) 7400 { 7401 struct secreg *reg, *newreg = NULL; 7402 7403 IPSEC_ASSERT(so != NULL, ("null socket")); 7404 IPSEC_ASSERT(m != NULL, ("null mbuf")); 7405 IPSEC_ASSERT(mhp != NULL, ("null msghdr")); 7406 IPSEC_ASSERT(mhp->msg != NULL, ("null msg")); 7407 7408 /* check for invalid register message */ 7409 if (mhp->msg->sadb_msg_satype >= sizeof(V_regtree)/sizeof(V_regtree[0])) 7410 return key_senderror(so, m, EINVAL); 7411 7412 /* When SATYPE_UNSPEC is specified, only return sabd_supported. */ 7413 if (mhp->msg->sadb_msg_satype == SADB_SATYPE_UNSPEC) 7414 goto setmsg; 7415 7416 /* check whether existing or not */ 7417 REGTREE_LOCK(); 7418 LIST_FOREACH(reg, &V_regtree[mhp->msg->sadb_msg_satype], chain) { 7419 if (reg->so == so) { 7420 REGTREE_UNLOCK(); 7421 ipseclog((LOG_DEBUG, "%s: socket exists already.\n", 7422 __func__)); 7423 return key_senderror(so, m, EEXIST); 7424 } 7425 } 7426 7427 /* create regnode */ 7428 newreg = malloc(sizeof(struct secreg), M_IPSEC_SAR, M_NOWAIT|M_ZERO); 7429 if (newreg == NULL) { 7430 REGTREE_UNLOCK(); 7431 ipseclog((LOG_DEBUG, "%s: No more memory.\n", __func__)); 7432 return key_senderror(so, m, ENOBUFS); 7433 } 7434 7435 newreg->so = so; 7436 ((struct keycb *)(so->so_pcb))->kp_registered++; 7437 7438 /* add regnode to regtree. */ 7439 LIST_INSERT_HEAD(&V_regtree[mhp->msg->sadb_msg_satype], newreg, chain); 7440 REGTREE_UNLOCK(); 7441 7442 setmsg: 7443 { 7444 struct mbuf *n; 7445 struct sadb_msg *newmsg; 7446 struct sadb_supported *sup; 7447 u_int len, alen, elen; 7448 int off; 7449 int i; 7450 struct sadb_alg *alg; 7451 7452 /* create new sadb_msg to reply. */ 7453 alen = 0; 7454 for (i = 1; i <= SADB_AALG_MAX; i++) { 7455 if (auth_algorithm_lookup(i)) 7456 alen += sizeof(struct sadb_alg); 7457 } 7458 if (alen) 7459 alen += sizeof(struct sadb_supported); 7460 elen = 0; 7461 for (i = 1; i <= SADB_EALG_MAX; i++) { 7462 if (enc_algorithm_lookup(i)) 7463 elen += sizeof(struct sadb_alg); 7464 } 7465 if (elen) 7466 elen += sizeof(struct sadb_supported); 7467 7468 len = sizeof(struct sadb_msg) + alen + elen; 7469 7470 if (len > MCLBYTES) 7471 return key_senderror(so, m, ENOBUFS); 7472 7473 n = key_mget(len); 7474 if (n == NULL) 7475 return key_senderror(so, m, ENOBUFS); 7476 7477 n->m_pkthdr.len = n->m_len = len; 7478 n->m_next = NULL; 7479 off = 0; 7480 7481 m_copydata(m, 0, sizeof(struct sadb_msg), mtod(n, caddr_t) + off); 7482 newmsg = mtod(n, struct sadb_msg *); 7483 newmsg->sadb_msg_errno = 0; 7484 newmsg->sadb_msg_len = PFKEY_UNIT64(len); 7485 off += PFKEY_ALIGN8(sizeof(struct sadb_msg)); 7486 7487 /* for authentication algorithm */ 7488 if (alen) { 7489 sup = (struct sadb_supported *)(mtod(n, caddr_t) + off); 7490 sup->sadb_supported_len = PFKEY_UNIT64(alen); 7491 sup->sadb_supported_exttype = SADB_EXT_SUPPORTED_AUTH; 7492 off += PFKEY_ALIGN8(sizeof(*sup)); 7493 7494 for (i = 1; i <= SADB_AALG_MAX; i++) { 7495 const struct auth_hash *aalgo; 7496 u_int16_t minkeysize, maxkeysize; 7497 7498 aalgo = auth_algorithm_lookup(i); 7499 if (!aalgo) 7500 continue; 7501 alg = (struct sadb_alg *)(mtod(n, caddr_t) + off); 7502 alg->sadb_alg_id = i; 7503 alg->sadb_alg_ivlen = 0; 7504 key_getsizes_ah(aalgo, i, &minkeysize, &maxkeysize); 7505 alg->sadb_alg_minbits = _BITS(minkeysize); 7506 alg->sadb_alg_maxbits = _BITS(maxkeysize); 7507 off += PFKEY_ALIGN8(sizeof(*alg)); 7508 } 7509 } 7510 7511 /* for encryption algorithm */ 7512 if (elen) { 7513 sup = (struct sadb_supported *)(mtod(n, caddr_t) + off); 7514 sup->sadb_supported_len = PFKEY_UNIT64(elen); 7515 sup->sadb_supported_exttype = SADB_EXT_SUPPORTED_ENCRYPT; 7516 off += PFKEY_ALIGN8(sizeof(*sup)); 7517 7518 for (i = 1; i <= SADB_EALG_MAX; i++) { 7519 const struct enc_xform *ealgo; 7520 7521 ealgo = enc_algorithm_lookup(i); 7522 if (!ealgo) 7523 continue; 7524 alg = (struct sadb_alg *)(mtod(n, caddr_t) + off); 7525 alg->sadb_alg_id = i; 7526 alg->sadb_alg_ivlen = ealgo->ivsize; 7527 alg->sadb_alg_minbits = _BITS(ealgo->minkey); 7528 alg->sadb_alg_maxbits = _BITS(ealgo->maxkey); 7529 off += PFKEY_ALIGN8(sizeof(struct sadb_alg)); 7530 } 7531 } 7532 7533 IPSEC_ASSERT(off == len, 7534 ("length assumption failed (off %u len %u)", off, len)); 7535 7536 m_freem(m); 7537 return key_sendup_mbuf(so, n, KEY_SENDUP_REGISTERED); 7538 } 7539 } 7540 7541 /* 7542 * free secreg entry registered. 7543 * XXX: I want to do free a socket marked done SADB_RESIGER to socket. 7544 */ 7545 void 7546 key_freereg(struct socket *so) 7547 { 7548 struct secreg *reg; 7549 int i; 7550 7551 IPSEC_ASSERT(so != NULL, ("NULL so")); 7552 7553 /* 7554 * check whether existing or not. 7555 * check all type of SA, because there is a potential that 7556 * one socket is registered to multiple type of SA. 7557 */ 7558 REGTREE_LOCK(); 7559 for (i = 0; i <= SADB_SATYPE_MAX; i++) { 7560 LIST_FOREACH(reg, &V_regtree[i], chain) { 7561 if (reg->so == so && __LIST_CHAINED(reg)) { 7562 LIST_REMOVE(reg, chain); 7563 free(reg, M_IPSEC_SAR); 7564 break; 7565 } 7566 } 7567 } 7568 REGTREE_UNLOCK(); 7569 } 7570 7571 /* 7572 * SADB_EXPIRE processing 7573 * send 7574 * <base, SA, SA2, lifetime(C and one of HS), address(SD)> 7575 * to KMD by PF_KEY. 7576 * NOTE: We send only soft lifetime extension. 7577 * 7578 * OUT: 0 : succeed 7579 * others : error number 7580 */ 7581 static int 7582 key_expire(struct secasvar *sav, int hard) 7583 { 7584 struct mbuf *result = NULL, *m; 7585 struct sadb_lifetime *lt; 7586 uint32_t replay_count; 7587 int error, len; 7588 uint8_t satype; 7589 7590 SECASVAR_RLOCK_TRACKER; 7591 7592 IPSEC_ASSERT (sav != NULL, ("null sav")); 7593 IPSEC_ASSERT (sav->sah != NULL, ("null sa header")); 7594 7595 KEYDBG(KEY_STAMP, 7596 printf("%s: SA(%p) expired %s lifetime\n", __func__, 7597 sav, hard ? "hard": "soft")); 7598 KEYDBG(KEY_DATA, kdebug_secasv(sav)); 7599 /* set msg header */ 7600 satype = key_proto2satype(sav->sah->saidx.proto); 7601 IPSEC_ASSERT(satype != 0, ("invalid proto, satype %u", satype)); 7602 m = key_setsadbmsg(SADB_EXPIRE, 0, satype, sav->seq, 0, sav->refcnt); 7603 if (!m) { 7604 error = ENOBUFS; 7605 goto fail; 7606 } 7607 result = m; 7608 7609 /* create SA extension */ 7610 m = key_setsadbsa(sav); 7611 if (!m) { 7612 error = ENOBUFS; 7613 goto fail; 7614 } 7615 m_cat(result, m); 7616 7617 /* create SA extension */ 7618 SECASVAR_RLOCK(sav); 7619 replay_count = sav->replay ? sav->replay->count : 0; 7620 SECASVAR_RUNLOCK(sav); 7621 7622 m = key_setsadbxsa2(sav->sah->saidx.mode, replay_count, 7623 sav->sah->saidx.reqid); 7624 if (!m) { 7625 error = ENOBUFS; 7626 goto fail; 7627 } 7628 m_cat(result, m); 7629 7630 if (sav->replay && sav->replay->wsize > UINT8_MAX) { 7631 m = key_setsadbxsareplay(sav->replay->wsize); 7632 if (!m) { 7633 error = ENOBUFS; 7634 goto fail; 7635 } 7636 m_cat(result, m); 7637 } 7638 7639 /* create lifetime extension (current and soft) */ 7640 len = PFKEY_ALIGN8(sizeof(*lt)) * 2; 7641 m = m_get2(len, M_NOWAIT, MT_DATA, 0); 7642 if (m == NULL) { 7643 error = ENOBUFS; 7644 goto fail; 7645 } 7646 m_align(m, len); 7647 m->m_len = len; 7648 bzero(mtod(m, caddr_t), len); 7649 lt = mtod(m, struct sadb_lifetime *); 7650 lt->sadb_lifetime_len = PFKEY_UNIT64(sizeof(struct sadb_lifetime)); 7651 lt->sadb_lifetime_exttype = SADB_EXT_LIFETIME_CURRENT; 7652 lt->sadb_lifetime_allocations = 7653 (uint32_t)counter_u64_fetch(sav->lft_c_allocations); 7654 lt->sadb_lifetime_bytes = 7655 counter_u64_fetch(sav->lft_c_bytes); 7656 lt->sadb_lifetime_addtime = sav->created; 7657 lt->sadb_lifetime_usetime = sav->firstused; 7658 lt = (struct sadb_lifetime *)(mtod(m, caddr_t) + len / 2); 7659 lt->sadb_lifetime_len = PFKEY_UNIT64(sizeof(struct sadb_lifetime)); 7660 if (hard) { 7661 lt->sadb_lifetime_exttype = SADB_EXT_LIFETIME_HARD; 7662 lt->sadb_lifetime_allocations = sav->lft_h->allocations; 7663 lt->sadb_lifetime_bytes = sav->lft_h->bytes; 7664 lt->sadb_lifetime_addtime = sav->lft_h->addtime; 7665 lt->sadb_lifetime_usetime = sav->lft_h->usetime; 7666 } else { 7667 lt->sadb_lifetime_exttype = SADB_EXT_LIFETIME_SOFT; 7668 lt->sadb_lifetime_allocations = sav->lft_s->allocations; 7669 lt->sadb_lifetime_bytes = sav->lft_s->bytes; 7670 lt->sadb_lifetime_addtime = sav->lft_s->addtime; 7671 lt->sadb_lifetime_usetime = sav->lft_s->usetime; 7672 } 7673 m_cat(result, m); 7674 7675 /* set sadb_address for source */ 7676 m = key_setsadbaddr(SADB_EXT_ADDRESS_SRC, 7677 &sav->sah->saidx.src.sa, 7678 FULLMASK, IPSEC_ULPROTO_ANY); 7679 if (!m) { 7680 error = ENOBUFS; 7681 goto fail; 7682 } 7683 m_cat(result, m); 7684 7685 /* set sadb_address for destination */ 7686 m = key_setsadbaddr(SADB_EXT_ADDRESS_DST, 7687 &sav->sah->saidx.dst.sa, 7688 FULLMASK, IPSEC_ULPROTO_ANY); 7689 if (!m) { 7690 error = ENOBUFS; 7691 goto fail; 7692 } 7693 m_cat(result, m); 7694 7695 /* 7696 * XXX-BZ Handle NAT-T extensions here. 7697 * XXXAE: it doesn't seem quite useful. IKEs should not depend on 7698 * this information, we report only significant SA fields. 7699 */ 7700 7701 if ((result->m_flags & M_PKTHDR) == 0) { 7702 error = EINVAL; 7703 goto fail; 7704 } 7705 7706 if (result->m_len < sizeof(struct sadb_msg)) { 7707 result = m_pullup(result, sizeof(struct sadb_msg)); 7708 if (result == NULL) { 7709 error = ENOBUFS; 7710 goto fail; 7711 } 7712 } 7713 7714 result->m_pkthdr.len = 0; 7715 for (m = result; m; m = m->m_next) 7716 result->m_pkthdr.len += m->m_len; 7717 7718 mtod(result, struct sadb_msg *)->sadb_msg_len = 7719 PFKEY_UNIT64(result->m_pkthdr.len); 7720 7721 return key_sendup_mbuf(NULL, result, KEY_SENDUP_REGISTERED); 7722 7723 fail: 7724 if (result) 7725 m_freem(result); 7726 return error; 7727 } 7728 7729 static void 7730 key_freesah_flushed(struct secashead_queue *flushq) 7731 { 7732 struct secashead *sah, *nextsah; 7733 struct secasvar *sav, *nextsav; 7734 7735 sah = TAILQ_FIRST(flushq); 7736 while (sah != NULL) { 7737 sav = TAILQ_FIRST(&sah->savtree_larval); 7738 while (sav != NULL) { 7739 nextsav = TAILQ_NEXT(sav, chain); 7740 TAILQ_REMOVE(&sah->savtree_larval, sav, chain); 7741 key_freesav(&sav); /* release last reference */ 7742 key_freesah(&sah); /* release reference from SAV */ 7743 sav = nextsav; 7744 } 7745 sav = TAILQ_FIRST(&sah->savtree_alive); 7746 while (sav != NULL) { 7747 nextsav = TAILQ_NEXT(sav, chain); 7748 TAILQ_REMOVE(&sah->savtree_alive, sav, chain); 7749 key_freesav(&sav); /* release last reference */ 7750 key_freesah(&sah); /* release reference from SAV */ 7751 sav = nextsav; 7752 } 7753 nextsah = TAILQ_NEXT(sah, chain); 7754 key_freesah(&sah); /* release last reference */ 7755 sah = nextsah; 7756 } 7757 } 7758 7759 /* 7760 * SADB_FLUSH processing 7761 * receive 7762 * <base> 7763 * from the ikmpd, and free all entries in secastree. 7764 * and send, 7765 * <base> 7766 * to the ikmpd. 7767 * NOTE: to do is only marking SADB_SASTATE_DEAD. 7768 * 7769 * m will always be freed. 7770 */ 7771 static int 7772 key_flush(struct socket *so, struct mbuf *m, const struct sadb_msghdr *mhp) 7773 { 7774 struct secashead_queue flushq; 7775 struct sadb_msg *newmsg; 7776 struct secashead *sah, *nextsah; 7777 struct secasvar *sav; 7778 uint8_t proto; 7779 int i; 7780 7781 IPSEC_ASSERT(so != NULL, ("null socket")); 7782 IPSEC_ASSERT(mhp != NULL, ("null msghdr")); 7783 IPSEC_ASSERT(mhp->msg != NULL, ("null msg")); 7784 7785 /* map satype to proto */ 7786 if ((proto = key_satype2proto(mhp->msg->sadb_msg_satype)) == 0) { 7787 ipseclog((LOG_DEBUG, "%s: invalid satype is passed.\n", 7788 __func__)); 7789 return key_senderror(so, m, EINVAL); 7790 } 7791 KEYDBG(KEY_STAMP, 7792 printf("%s: proto %u\n", __func__, proto)); 7793 7794 TAILQ_INIT(&flushq); 7795 if (proto == IPSEC_PROTO_ANY) { 7796 /* no SATYPE specified, i.e. flushing all SA. */ 7797 SAHTREE_WLOCK(); 7798 /* Move all SAHs into flushq */ 7799 TAILQ_CONCAT(&flushq, &V_sahtree, chain); 7800 /* Flush all buckets in SPI hash */ 7801 for (i = 0; i < V_savhash_mask + 1; i++) 7802 LIST_INIT(&V_savhashtbl[i]); 7803 /* Flush all buckets in SAHADDRHASH */ 7804 for (i = 0; i < V_sahaddrhash_mask + 1; i++) 7805 LIST_INIT(&V_sahaddrhashtbl[i]); 7806 /* Mark all SAHs as unlinked */ 7807 TAILQ_FOREACH(sah, &flushq, chain) { 7808 sah->state = SADB_SASTATE_DEAD; 7809 /* 7810 * Callout handler makes its job using 7811 * RLOCK and drain queues. In case, when this 7812 * function will be called just before it 7813 * acquires WLOCK, we need to mark SAs as 7814 * unlinked to prevent second unlink. 7815 */ 7816 TAILQ_FOREACH(sav, &sah->savtree_larval, chain) { 7817 sav->state = SADB_SASTATE_DEAD; 7818 ipsec_accel_forget_sav(sav); 7819 } 7820 TAILQ_FOREACH(sav, &sah->savtree_alive, chain) { 7821 sav->state = SADB_SASTATE_DEAD; 7822 ipsec_accel_forget_sav(sav); 7823 } 7824 } 7825 SAHTREE_WUNLOCK(); 7826 } else { 7827 SAHTREE_WLOCK(); 7828 sah = TAILQ_FIRST(&V_sahtree); 7829 while (sah != NULL) { 7830 IPSEC_ASSERT(sah->state != SADB_SASTATE_DEAD, 7831 ("DEAD SAH %p in SADB_FLUSH", sah)); 7832 nextsah = TAILQ_NEXT(sah, chain); 7833 if (sah->saidx.proto != proto) { 7834 sah = nextsah; 7835 continue; 7836 } 7837 sah->state = SADB_SASTATE_DEAD; 7838 TAILQ_REMOVE(&V_sahtree, sah, chain); 7839 LIST_REMOVE(sah, addrhash); 7840 /* Unlink all SAs from SPI hash */ 7841 TAILQ_FOREACH(sav, &sah->savtree_larval, chain) { 7842 LIST_REMOVE(sav, spihash); 7843 sav->state = SADB_SASTATE_DEAD; 7844 ipsec_accel_forget_sav(sav); 7845 } 7846 TAILQ_FOREACH(sav, &sah->savtree_alive, chain) { 7847 LIST_REMOVE(sav, spihash); 7848 sav->state = SADB_SASTATE_DEAD; 7849 ipsec_accel_forget_sav(sav); 7850 } 7851 /* Add SAH into flushq */ 7852 TAILQ_INSERT_HEAD(&flushq, sah, chain); 7853 sah = nextsah; 7854 } 7855 SAHTREE_WUNLOCK(); 7856 } 7857 7858 key_freesah_flushed(&flushq); 7859 /* Free all queued SAs and SAHs */ 7860 if (m->m_len < sizeof(struct sadb_msg) || 7861 sizeof(struct sadb_msg) > m->m_len + M_TRAILINGSPACE(m)) { 7862 ipseclog((LOG_DEBUG, "%s: No more memory.\n", __func__)); 7863 return key_senderror(so, m, ENOBUFS); 7864 } 7865 7866 if (m->m_next) 7867 m_freem(m->m_next); 7868 m->m_next = NULL; 7869 m->m_pkthdr.len = m->m_len = sizeof(struct sadb_msg); 7870 newmsg = mtod(m, struct sadb_msg *); 7871 newmsg->sadb_msg_errno = 0; 7872 newmsg->sadb_msg_len = PFKEY_UNIT64(m->m_pkthdr.len); 7873 7874 return key_sendup_mbuf(so, m, KEY_SENDUP_ALL); 7875 } 7876 7877 /* 7878 * SADB_DUMP processing 7879 * dump all entries including status of DEAD in SAD. 7880 * receive 7881 * <base> 7882 * from the ikmpd, and dump all secasvar leaves 7883 * and send, 7884 * <base> ..... 7885 * to the ikmpd. 7886 * 7887 * m will always be freed. 7888 */ 7889 static int 7890 key_dump(struct socket *so, struct mbuf *m, const struct sadb_msghdr *mhp) 7891 { 7892 SAHTREE_RLOCK_TRACKER; 7893 struct secashead *sah; 7894 struct secasvar *sav; 7895 struct mbuf *n; 7896 uint32_t cnt; 7897 uint8_t proto, satype; 7898 7899 IPSEC_ASSERT(so != NULL, ("null socket")); 7900 IPSEC_ASSERT(m != NULL, ("null mbuf")); 7901 IPSEC_ASSERT(mhp != NULL, ("null msghdr")); 7902 IPSEC_ASSERT(mhp->msg != NULL, ("null msg")); 7903 7904 /* map satype to proto */ 7905 if ((proto = key_satype2proto(mhp->msg->sadb_msg_satype)) == 0) { 7906 ipseclog((LOG_DEBUG, "%s: invalid satype is passed.\n", 7907 __func__)); 7908 return key_senderror(so, m, EINVAL); 7909 } 7910 7911 /* count sav entries to be sent to the userland. */ 7912 cnt = 0; 7913 IFNET_RLOCK(); 7914 SAHTREE_RLOCK(); 7915 TAILQ_FOREACH(sah, &V_sahtree, chain) { 7916 if (mhp->msg->sadb_msg_satype != SADB_SATYPE_UNSPEC && 7917 proto != sah->saidx.proto) 7918 continue; 7919 7920 TAILQ_FOREACH(sav, &sah->savtree_larval, chain) 7921 cnt++; 7922 TAILQ_FOREACH(sav, &sah->savtree_alive, chain) 7923 cnt++; 7924 } 7925 7926 if (cnt == 0) { 7927 SAHTREE_RUNLOCK(); 7928 IFNET_RUNLOCK(); 7929 return key_senderror(so, m, ENOENT); 7930 } 7931 7932 /* send this to the userland, one at a time. */ 7933 TAILQ_FOREACH(sah, &V_sahtree, chain) { 7934 if (mhp->msg->sadb_msg_satype != SADB_SATYPE_UNSPEC && 7935 proto != sah->saidx.proto) 7936 continue; 7937 7938 /* map proto to satype */ 7939 if ((satype = key_proto2satype(sah->saidx.proto)) == 0) { 7940 SAHTREE_RUNLOCK(); 7941 IFNET_RUNLOCK(); 7942 ipseclog((LOG_DEBUG, "%s: there was invalid proto in " 7943 "SAD.\n", __func__)); 7944 return key_senderror(so, m, EINVAL); 7945 } 7946 TAILQ_FOREACH(sav, &sah->savtree_larval, chain) { 7947 n = key_setdumpsa(sav, SADB_DUMP, satype, 7948 --cnt, mhp->msg->sadb_msg_pid, &sahtree_tracker); 7949 if (n == NULL) { 7950 SAHTREE_RUNLOCK(); 7951 IFNET_RUNLOCK(); 7952 return key_senderror(so, m, ENOBUFS); 7953 } 7954 key_sendup_mbuf(so, n, KEY_SENDUP_ONE); 7955 } 7956 TAILQ_FOREACH(sav, &sah->savtree_alive, chain) { 7957 n = key_setdumpsa(sav, SADB_DUMP, satype, 7958 --cnt, mhp->msg->sadb_msg_pid, &sahtree_tracker); 7959 if (n == NULL) { 7960 SAHTREE_RUNLOCK(); 7961 IFNET_RUNLOCK(); 7962 return key_senderror(so, m, ENOBUFS); 7963 } 7964 key_sendup_mbuf(so, n, KEY_SENDUP_ONE); 7965 } 7966 } 7967 SAHTREE_RUNLOCK(); 7968 IFNET_RUNLOCK(); 7969 m_freem(m); 7970 return (0); 7971 } 7972 /* 7973 * SADB_X_PROMISC processing 7974 * 7975 * m will always be freed. 7976 */ 7977 static int 7978 key_promisc(struct socket *so, struct mbuf *m, const struct sadb_msghdr *mhp) 7979 { 7980 int olen; 7981 7982 IPSEC_ASSERT(so != NULL, ("null socket")); 7983 IPSEC_ASSERT(m != NULL, ("null mbuf")); 7984 IPSEC_ASSERT(mhp != NULL, ("null msghdr")); 7985 IPSEC_ASSERT(mhp->msg != NULL, ("null msg")); 7986 7987 olen = PFKEY_UNUNIT64(mhp->msg->sadb_msg_len); 7988 7989 if (olen < sizeof(struct sadb_msg)) { 7990 #if 1 7991 return key_senderror(so, m, EINVAL); 7992 #else 7993 m_freem(m); 7994 return 0; 7995 #endif 7996 } else if (olen == sizeof(struct sadb_msg)) { 7997 /* enable/disable promisc mode */ 7998 struct keycb *kp; 7999 8000 if ((kp = so->so_pcb) == NULL) 8001 return key_senderror(so, m, EINVAL); 8002 mhp->msg->sadb_msg_errno = 0; 8003 switch (mhp->msg->sadb_msg_satype) { 8004 case 0: 8005 case 1: 8006 kp->kp_promisc = mhp->msg->sadb_msg_satype; 8007 break; 8008 default: 8009 return key_senderror(so, m, EINVAL); 8010 } 8011 8012 /* send the original message back to everyone */ 8013 mhp->msg->sadb_msg_errno = 0; 8014 return key_sendup_mbuf(so, m, KEY_SENDUP_ALL); 8015 } else { 8016 /* send packet as is */ 8017 8018 m_adj(m, PFKEY_ALIGN8(sizeof(struct sadb_msg))); 8019 8020 /* TODO: if sadb_msg_seq is specified, send to specific pid */ 8021 return key_sendup_mbuf(so, m, KEY_SENDUP_ALL); 8022 } 8023 } 8024 8025 static int (*key_typesw[])(struct socket *, struct mbuf *, 8026 const struct sadb_msghdr *) = { 8027 [SADB_RESERVED] = NULL, 8028 [SADB_GETSPI] = key_getspi, 8029 [SADB_UPDATE] = key_update, 8030 [SADB_ADD] = key_add, 8031 [SADB_DELETE] = key_delete, 8032 [SADB_GET] = key_get, 8033 [SADB_ACQUIRE] = key_acquire2, 8034 [SADB_REGISTER] = key_register, 8035 [SADB_EXPIRE] = NULL, 8036 [SADB_FLUSH] = key_flush, 8037 [SADB_DUMP] = key_dump, 8038 [SADB_X_PROMISC] = key_promisc, 8039 [SADB_X_PCHANGE] = NULL, 8040 [SADB_X_SPDUPDATE] = key_spdadd, 8041 [SADB_X_SPDADD] = key_spdadd, 8042 [SADB_X_SPDDELETE] = key_spddelete, 8043 [SADB_X_SPDGET] = key_spdget, 8044 [SADB_X_SPDACQUIRE] = NULL, 8045 [SADB_X_SPDDUMP] = key_spddump, 8046 [SADB_X_SPDFLUSH] = key_spdflush, 8047 [SADB_X_SPDSETIDX] = key_spdadd, 8048 [SADB_X_SPDEXPIRE] = NULL, 8049 [SADB_X_SPDDELETE2] = key_spddelete2, 8050 }; 8051 8052 /* 8053 * parse sadb_msg buffer to process PFKEYv2, 8054 * and create a data to response if needed. 8055 * I think to be dealed with mbuf directly. 8056 * IN: 8057 * msgp : pointer to pointer to a received buffer pulluped. 8058 * This is rewrited to response. 8059 * so : pointer to socket. 8060 * OUT: 8061 * length for buffer to send to user process. 8062 */ 8063 int 8064 key_parse(struct mbuf *m, struct socket *so) 8065 { 8066 struct sadb_msg *msg; 8067 struct sadb_msghdr mh; 8068 u_int orglen; 8069 int error; 8070 int target; 8071 8072 IPSEC_ASSERT(so != NULL, ("null socket")); 8073 IPSEC_ASSERT(m != NULL, ("null mbuf")); 8074 8075 if (m->m_len < sizeof(struct sadb_msg)) { 8076 m = m_pullup(m, sizeof(struct sadb_msg)); 8077 if (!m) 8078 return ENOBUFS; 8079 } 8080 msg = mtod(m, struct sadb_msg *); 8081 orglen = PFKEY_UNUNIT64(msg->sadb_msg_len); 8082 target = KEY_SENDUP_ONE; 8083 8084 if ((m->m_flags & M_PKTHDR) == 0 || m->m_pkthdr.len != orglen) { 8085 ipseclog((LOG_DEBUG, "%s: invalid message length.\n",__func__)); 8086 PFKEYSTAT_INC(out_invlen); 8087 error = EINVAL; 8088 goto senderror; 8089 } 8090 8091 if (msg->sadb_msg_version != PF_KEY_V2) { 8092 ipseclog((LOG_DEBUG, "%s: PF_KEY version %u is mismatched.\n", 8093 __func__, msg->sadb_msg_version)); 8094 PFKEYSTAT_INC(out_invver); 8095 error = EINVAL; 8096 goto senderror; 8097 } 8098 8099 if (msg->sadb_msg_type > SADB_MAX) { 8100 ipseclog((LOG_DEBUG, "%s: invalid type %u is passed.\n", 8101 __func__, msg->sadb_msg_type)); 8102 PFKEYSTAT_INC(out_invmsgtype); 8103 error = EINVAL; 8104 goto senderror; 8105 } 8106 8107 /* for old-fashioned code - should be nuked */ 8108 if (m->m_pkthdr.len > MCLBYTES) { 8109 m_freem(m); 8110 return ENOBUFS; 8111 } 8112 if (m->m_next) { 8113 struct mbuf *n; 8114 8115 n = key_mget(m->m_pkthdr.len); 8116 if (n == NULL) { 8117 m_freem(m); 8118 return ENOBUFS; 8119 } 8120 m_copydata(m, 0, m->m_pkthdr.len, mtod(n, caddr_t)); 8121 n->m_pkthdr.len = n->m_len = m->m_pkthdr.len; 8122 n->m_next = NULL; 8123 m_freem(m); 8124 m = n; 8125 } 8126 8127 /* align the mbuf chain so that extensions are in contiguous region. */ 8128 error = key_align(m, &mh); 8129 if (error) 8130 return error; 8131 8132 msg = mh.msg; 8133 8134 /* We use satype as scope mask for spddump */ 8135 if (msg->sadb_msg_type == SADB_X_SPDDUMP) { 8136 switch (msg->sadb_msg_satype) { 8137 case IPSEC_POLICYSCOPE_ANY: 8138 case IPSEC_POLICYSCOPE_GLOBAL: 8139 case IPSEC_POLICYSCOPE_IFNET: 8140 case IPSEC_POLICYSCOPE_PCB: 8141 break; 8142 default: 8143 ipseclog((LOG_DEBUG, "%s: illegal satype=%u\n", 8144 __func__, msg->sadb_msg_type)); 8145 PFKEYSTAT_INC(out_invsatype); 8146 error = EINVAL; 8147 goto senderror; 8148 } 8149 } else { 8150 switch (msg->sadb_msg_satype) { /* check SA type */ 8151 case SADB_SATYPE_UNSPEC: 8152 switch (msg->sadb_msg_type) { 8153 case SADB_GETSPI: 8154 case SADB_UPDATE: 8155 case SADB_ADD: 8156 case SADB_DELETE: 8157 case SADB_GET: 8158 case SADB_ACQUIRE: 8159 case SADB_EXPIRE: 8160 ipseclog((LOG_DEBUG, "%s: must specify satype " 8161 "when msg type=%u.\n", __func__, 8162 msg->sadb_msg_type)); 8163 PFKEYSTAT_INC(out_invsatype); 8164 error = EINVAL; 8165 goto senderror; 8166 } 8167 break; 8168 case SADB_SATYPE_AH: 8169 case SADB_SATYPE_ESP: 8170 case SADB_X_SATYPE_IPCOMP: 8171 case SADB_X_SATYPE_TCPSIGNATURE: 8172 switch (msg->sadb_msg_type) { 8173 case SADB_X_SPDADD: 8174 case SADB_X_SPDDELETE: 8175 case SADB_X_SPDGET: 8176 case SADB_X_SPDFLUSH: 8177 case SADB_X_SPDSETIDX: 8178 case SADB_X_SPDUPDATE: 8179 case SADB_X_SPDDELETE2: 8180 ipseclog((LOG_DEBUG, "%s: illegal satype=%u\n", 8181 __func__, msg->sadb_msg_type)); 8182 PFKEYSTAT_INC(out_invsatype); 8183 error = EINVAL; 8184 goto senderror; 8185 } 8186 break; 8187 case SADB_SATYPE_RSVP: 8188 case SADB_SATYPE_OSPFV2: 8189 case SADB_SATYPE_RIPV2: 8190 case SADB_SATYPE_MIP: 8191 ipseclog((LOG_DEBUG, "%s: type %u isn't supported.\n", 8192 __func__, msg->sadb_msg_satype)); 8193 PFKEYSTAT_INC(out_invsatype); 8194 error = EOPNOTSUPP; 8195 goto senderror; 8196 case 1: /* XXX: What does it do? */ 8197 if (msg->sadb_msg_type == SADB_X_PROMISC) 8198 break; 8199 /*FALLTHROUGH*/ 8200 default: 8201 ipseclog((LOG_DEBUG, "%s: invalid type %u is passed.\n", 8202 __func__, msg->sadb_msg_satype)); 8203 PFKEYSTAT_INC(out_invsatype); 8204 error = EINVAL; 8205 goto senderror; 8206 } 8207 } 8208 8209 /* check field of upper layer protocol and address family */ 8210 if (mh.ext[SADB_EXT_ADDRESS_SRC] != NULL 8211 && mh.ext[SADB_EXT_ADDRESS_DST] != NULL) { 8212 struct sadb_address *src0, *dst0; 8213 u_int plen; 8214 8215 src0 = (struct sadb_address *)(mh.ext[SADB_EXT_ADDRESS_SRC]); 8216 dst0 = (struct sadb_address *)(mh.ext[SADB_EXT_ADDRESS_DST]); 8217 8218 /* check upper layer protocol */ 8219 if (src0->sadb_address_proto != dst0->sadb_address_proto) { 8220 ipseclog((LOG_DEBUG, "%s: upper layer protocol " 8221 "mismatched.\n", __func__)); 8222 PFKEYSTAT_INC(out_invaddr); 8223 error = EINVAL; 8224 goto senderror; 8225 } 8226 8227 /* check family */ 8228 if (PFKEY_ADDR_SADDR(src0)->sa_family != 8229 PFKEY_ADDR_SADDR(dst0)->sa_family) { 8230 ipseclog((LOG_DEBUG, "%s: address family mismatched.\n", 8231 __func__)); 8232 PFKEYSTAT_INC(out_invaddr); 8233 error = EINVAL; 8234 goto senderror; 8235 } 8236 if (PFKEY_ADDR_SADDR(src0)->sa_len != 8237 PFKEY_ADDR_SADDR(dst0)->sa_len) { 8238 ipseclog((LOG_DEBUG, "%s: address struct size " 8239 "mismatched.\n", __func__)); 8240 PFKEYSTAT_INC(out_invaddr); 8241 error = EINVAL; 8242 goto senderror; 8243 } 8244 8245 switch (PFKEY_ADDR_SADDR(src0)->sa_family) { 8246 case AF_INET: 8247 if (PFKEY_ADDR_SADDR(src0)->sa_len != 8248 sizeof(struct sockaddr_in)) { 8249 PFKEYSTAT_INC(out_invaddr); 8250 error = EINVAL; 8251 goto senderror; 8252 } 8253 break; 8254 case AF_INET6: 8255 if (PFKEY_ADDR_SADDR(src0)->sa_len != 8256 sizeof(struct sockaddr_in6)) { 8257 PFKEYSTAT_INC(out_invaddr); 8258 error = EINVAL; 8259 goto senderror; 8260 } 8261 break; 8262 default: 8263 ipseclog((LOG_DEBUG, "%s: unsupported address family\n", 8264 __func__)); 8265 PFKEYSTAT_INC(out_invaddr); 8266 error = EAFNOSUPPORT; 8267 goto senderror; 8268 } 8269 8270 switch (PFKEY_ADDR_SADDR(src0)->sa_family) { 8271 case AF_INET: 8272 plen = sizeof(struct in_addr) << 3; 8273 break; 8274 case AF_INET6: 8275 plen = sizeof(struct in6_addr) << 3; 8276 break; 8277 default: 8278 plen = 0; /*fool gcc*/ 8279 break; 8280 } 8281 8282 /* check max prefix length */ 8283 if (src0->sadb_address_prefixlen > plen || 8284 dst0->sadb_address_prefixlen > plen) { 8285 ipseclog((LOG_DEBUG, "%s: illegal prefixlen.\n", 8286 __func__)); 8287 PFKEYSTAT_INC(out_invaddr); 8288 error = EINVAL; 8289 goto senderror; 8290 } 8291 8292 /* 8293 * prefixlen == 0 is valid because there can be a case when 8294 * all addresses are matched. 8295 */ 8296 } 8297 8298 if (msg->sadb_msg_type >= nitems(key_typesw) || 8299 key_typesw[msg->sadb_msg_type] == NULL) { 8300 PFKEYSTAT_INC(out_invmsgtype); 8301 error = EINVAL; 8302 goto senderror; 8303 } 8304 8305 return (*key_typesw[msg->sadb_msg_type])(so, m, &mh); 8306 8307 senderror: 8308 msg->sadb_msg_errno = error; 8309 return key_sendup_mbuf(so, m, target); 8310 } 8311 8312 static int 8313 key_senderror(struct socket *so, struct mbuf *m, int code) 8314 { 8315 struct sadb_msg *msg; 8316 8317 IPSEC_ASSERT(m->m_len >= sizeof(struct sadb_msg), 8318 ("mbuf too small, len %u", m->m_len)); 8319 8320 msg = mtod(m, struct sadb_msg *); 8321 msg->sadb_msg_errno = code; 8322 return key_sendup_mbuf(so, m, KEY_SENDUP_ONE); 8323 } 8324 8325 /* 8326 * set the pointer to each header into message buffer. 8327 * m will be freed on error. 8328 * XXX larger-than-MCLBYTES extension? 8329 */ 8330 static int 8331 key_align(struct mbuf *m, struct sadb_msghdr *mhp) 8332 { 8333 struct mbuf *n; 8334 struct sadb_ext *ext; 8335 size_t off, end; 8336 int extlen; 8337 int toff; 8338 8339 IPSEC_ASSERT(m != NULL, ("null mbuf")); 8340 IPSEC_ASSERT(mhp != NULL, ("null msghdr")); 8341 IPSEC_ASSERT(m->m_len >= sizeof(struct sadb_msg), 8342 ("mbuf too small, len %u", m->m_len)); 8343 8344 /* initialize */ 8345 bzero(mhp, sizeof(*mhp)); 8346 8347 mhp->msg = mtod(m, struct sadb_msg *); 8348 mhp->ext[0] = (struct sadb_ext *)mhp->msg; /*XXX backward compat */ 8349 8350 end = PFKEY_UNUNIT64(mhp->msg->sadb_msg_len); 8351 extlen = end; /*just in case extlen is not updated*/ 8352 for (off = sizeof(struct sadb_msg); off < end; off += extlen) { 8353 n = m_pulldown(m, off, sizeof(struct sadb_ext), &toff); 8354 if (!n) { 8355 /* m is already freed */ 8356 return ENOBUFS; 8357 } 8358 ext = (struct sadb_ext *)(mtod(n, caddr_t) + toff); 8359 8360 /* set pointer */ 8361 switch (ext->sadb_ext_type) { 8362 case SADB_EXT_SA: 8363 case SADB_EXT_ADDRESS_SRC: 8364 case SADB_EXT_ADDRESS_DST: 8365 case SADB_EXT_ADDRESS_PROXY: 8366 case SADB_EXT_LIFETIME_CURRENT: 8367 case SADB_EXT_LIFETIME_HARD: 8368 case SADB_EXT_LIFETIME_SOFT: 8369 case SADB_EXT_KEY_AUTH: 8370 case SADB_EXT_KEY_ENCRYPT: 8371 case SADB_EXT_IDENTITY_SRC: 8372 case SADB_EXT_IDENTITY_DST: 8373 case SADB_EXT_SENSITIVITY: 8374 case SADB_EXT_PROPOSAL: 8375 case SADB_EXT_SUPPORTED_AUTH: 8376 case SADB_EXT_SUPPORTED_ENCRYPT: 8377 case SADB_EXT_SPIRANGE: 8378 case SADB_X_EXT_POLICY: 8379 case SADB_X_EXT_SA2: 8380 case SADB_X_EXT_NAT_T_TYPE: 8381 case SADB_X_EXT_NAT_T_SPORT: 8382 case SADB_X_EXT_NAT_T_DPORT: 8383 case SADB_X_EXT_NAT_T_OAI: 8384 case SADB_X_EXT_NAT_T_OAR: 8385 case SADB_X_EXT_NAT_T_FRAG: 8386 case SADB_X_EXT_SA_REPLAY: 8387 case SADB_X_EXT_NEW_ADDRESS_SRC: 8388 case SADB_X_EXT_NEW_ADDRESS_DST: 8389 #ifdef IPSEC_OFFLOAD 8390 case SADB_X_EXT_LFT_CUR_SW_OFFL: 8391 case SADB_X_EXT_LFT_CUR_HW_OFFL: 8392 case SADB_X_EXT_IF_HW_OFFL: 8393 #endif 8394 /* duplicate check */ 8395 /* 8396 * XXX Are there duplication payloads of either 8397 * KEY_AUTH or KEY_ENCRYPT ? 8398 */ 8399 if (mhp->ext[ext->sadb_ext_type] != NULL) { 8400 ipseclog((LOG_DEBUG, "%s: duplicate ext_type " 8401 "%u\n", __func__, ext->sadb_ext_type)); 8402 m_freem(m); 8403 PFKEYSTAT_INC(out_dupext); 8404 return EINVAL; 8405 } 8406 break; 8407 default: 8408 ipseclog((LOG_DEBUG, "%s: invalid ext_type %u\n", 8409 __func__, ext->sadb_ext_type)); 8410 m_freem(m); 8411 PFKEYSTAT_INC(out_invexttype); 8412 return EINVAL; 8413 } 8414 8415 extlen = PFKEY_UNUNIT64(ext->sadb_ext_len); 8416 8417 if (key_validate_ext(ext, extlen)) { 8418 m_freem(m); 8419 PFKEYSTAT_INC(out_invlen); 8420 return EINVAL; 8421 } 8422 8423 n = m_pulldown(m, off, extlen, &toff); 8424 if (!n) { 8425 /* m is already freed */ 8426 return ENOBUFS; 8427 } 8428 ext = (struct sadb_ext *)(mtod(n, caddr_t) + toff); 8429 8430 mhp->ext[ext->sadb_ext_type] = ext; 8431 mhp->extoff[ext->sadb_ext_type] = off; 8432 mhp->extlen[ext->sadb_ext_type] = extlen; 8433 } 8434 8435 if (off != end) { 8436 m_freem(m); 8437 PFKEYSTAT_INC(out_invlen); 8438 return EINVAL; 8439 } 8440 8441 return 0; 8442 } 8443 8444 static int 8445 key_validate_ext(const struct sadb_ext *ext, int len) 8446 { 8447 const struct sockaddr *sa; 8448 enum { NONE, ADDR } checktype = NONE; 8449 int baselen = 0; 8450 const int sal = offsetof(struct sockaddr, sa_len) + sizeof(sa->sa_len); 8451 8452 if (len != PFKEY_UNUNIT64(ext->sadb_ext_len)) 8453 return EINVAL; 8454 8455 /* if it does not match minimum/maximum length, bail */ 8456 if (ext->sadb_ext_type >= nitems(minsize) || 8457 ext->sadb_ext_type >= nitems(maxsize)) 8458 return EINVAL; 8459 if (!minsize[ext->sadb_ext_type] || len < minsize[ext->sadb_ext_type]) 8460 return EINVAL; 8461 if (maxsize[ext->sadb_ext_type] && len > maxsize[ext->sadb_ext_type]) 8462 return EINVAL; 8463 8464 /* more checks based on sadb_ext_type XXX need more */ 8465 switch (ext->sadb_ext_type) { 8466 case SADB_EXT_ADDRESS_SRC: 8467 case SADB_EXT_ADDRESS_DST: 8468 case SADB_EXT_ADDRESS_PROXY: 8469 case SADB_X_EXT_NAT_T_OAI: 8470 case SADB_X_EXT_NAT_T_OAR: 8471 case SADB_X_EXT_NEW_ADDRESS_SRC: 8472 case SADB_X_EXT_NEW_ADDRESS_DST: 8473 baselen = PFKEY_ALIGN8(sizeof(struct sadb_address)); 8474 checktype = ADDR; 8475 break; 8476 case SADB_EXT_IDENTITY_SRC: 8477 case SADB_EXT_IDENTITY_DST: 8478 if (((const struct sadb_ident *)ext)->sadb_ident_type == 8479 SADB_X_IDENTTYPE_ADDR) { 8480 baselen = PFKEY_ALIGN8(sizeof(struct sadb_ident)); 8481 checktype = ADDR; 8482 } else 8483 checktype = NONE; 8484 break; 8485 default: 8486 checktype = NONE; 8487 break; 8488 } 8489 8490 switch (checktype) { 8491 case NONE: 8492 break; 8493 case ADDR: 8494 sa = (const struct sockaddr *)(((const u_int8_t*)ext)+baselen); 8495 if (len < baselen + sal) 8496 return EINVAL; 8497 if (baselen + PFKEY_ALIGN8(sa->sa_len) != len) 8498 return EINVAL; 8499 break; 8500 } 8501 8502 return 0; 8503 } 8504 8505 void 8506 spdcache_init(void) 8507 { 8508 int i; 8509 8510 TUNABLE_INT_FETCH("net.key.spdcache.maxentries", 8511 &V_key_spdcache_maxentries); 8512 TUNABLE_INT_FETCH("net.key.spdcache.threshold", 8513 &V_key_spdcache_threshold); 8514 8515 if (V_key_spdcache_maxentries) { 8516 V_key_spdcache_maxentries = MAX(V_key_spdcache_maxentries, 8517 SPDCACHE_MAX_ENTRIES_PER_HASH); 8518 V_spdcachehashtbl = hashinit(V_key_spdcache_maxentries / 8519 SPDCACHE_MAX_ENTRIES_PER_HASH, 8520 M_IPSEC_SPDCACHE, &V_spdcachehash_mask); 8521 V_key_spdcache_maxentries = (V_spdcachehash_mask + 1) 8522 * SPDCACHE_MAX_ENTRIES_PER_HASH; 8523 8524 V_spdcache_lock = malloc(sizeof(struct mtx) * 8525 (V_spdcachehash_mask + 1), 8526 M_IPSEC_SPDCACHE, M_WAITOK | M_ZERO); 8527 8528 for (i = 0; i < V_spdcachehash_mask + 1; ++i) 8529 SPDCACHE_LOCK_INIT(i); 8530 } 8531 } 8532 8533 struct spdcache_entry * 8534 spdcache_entry_alloc(const struct secpolicyindex *spidx, struct secpolicy *sp) 8535 { 8536 struct spdcache_entry *entry; 8537 8538 entry = malloc(sizeof(struct spdcache_entry), M_IPSEC_SPDCACHE, 8539 M_NOWAIT | M_ZERO); 8540 if (entry == NULL) 8541 return (NULL); 8542 8543 if (sp != NULL) 8544 SP_ADDREF(sp); 8545 8546 entry->spidx = *spidx; 8547 entry->sp = sp; 8548 8549 return (entry); 8550 } 8551 8552 void 8553 spdcache_entry_free(struct spdcache_entry *entry) 8554 { 8555 8556 if (entry->sp != NULL) 8557 key_freesp(&entry->sp); 8558 free(entry, M_IPSEC_SPDCACHE); 8559 } 8560 8561 void 8562 spdcache_clear(void) 8563 { 8564 struct spdcache_entry *entry; 8565 int i; 8566 8567 for (i = 0; i < V_spdcachehash_mask + 1; ++i) { 8568 SPDCACHE_LOCK(i); 8569 while (!LIST_EMPTY(&V_spdcachehashtbl[i])) { 8570 entry = LIST_FIRST(&V_spdcachehashtbl[i]); 8571 LIST_REMOVE(entry, chain); 8572 spdcache_entry_free(entry); 8573 } 8574 SPDCACHE_UNLOCK(i); 8575 } 8576 } 8577 8578 #ifdef VIMAGE 8579 void 8580 spdcache_destroy(void) 8581 { 8582 int i; 8583 8584 if (SPDCACHE_ENABLED()) { 8585 spdcache_clear(); 8586 hashdestroy(V_spdcachehashtbl, M_IPSEC_SPDCACHE, V_spdcachehash_mask); 8587 8588 for (i = 0; i < V_spdcachehash_mask + 1; ++i) 8589 SPDCACHE_LOCK_DESTROY(i); 8590 8591 free(V_spdcache_lock, M_IPSEC_SPDCACHE); 8592 } 8593 } 8594 #endif 8595 8596 static void 8597 key_vnet_init(void *arg __unused) 8598 { 8599 int i; 8600 8601 for (i = 0; i < IPSEC_DIR_MAX; i++) { 8602 TAILQ_INIT(&V_sptree[i]); 8603 TAILQ_INIT(&V_sptree_ifnet[i]); 8604 } 8605 8606 TAILQ_INIT(&V_sahtree); 8607 V_sphashtbl = hashinit(SPHASH_NHASH, M_IPSEC_SP, &V_sphash_mask); 8608 V_savhashtbl = hashinit(SAVHASH_NHASH, M_IPSEC_SA, &V_savhash_mask); 8609 V_sahaddrhashtbl = hashinit(SAHHASH_NHASH, M_IPSEC_SAH, 8610 &V_sahaddrhash_mask); 8611 V_acqaddrhashtbl = hashinit(ACQHASH_NHASH, M_IPSEC_SAQ, 8612 &V_acqaddrhash_mask); 8613 V_acqseqhashtbl = hashinit(ACQHASH_NHASH, M_IPSEC_SAQ, 8614 &V_acqseqhash_mask); 8615 8616 spdcache_init(); 8617 8618 for (i = 0; i <= SADB_SATYPE_MAX; i++) 8619 LIST_INIT(&V_regtree[i]); 8620 8621 LIST_INIT(&V_acqtree); 8622 LIST_INIT(&V_spacqtree); 8623 } 8624 VNET_SYSINIT(key_vnet_init, SI_SUB_PROTO_DOMAIN, SI_ORDER_SECOND, 8625 key_vnet_init, NULL); 8626 8627 static void 8628 key_init(void *arg __unused) 8629 { 8630 8631 ipsec_key_lft_zone = uma_zcreate("IPsec SA lft_c", 8632 sizeof(uint64_t) * 2, NULL, NULL, NULL, NULL, 8633 UMA_ALIGN_PTR, UMA_ZONE_PCPU); 8634 8635 SPTREE_LOCK_INIT(); 8636 REGTREE_LOCK_INIT(); 8637 SAHTREE_LOCK_INIT(); 8638 ACQ_LOCK_INIT(); 8639 SPACQ_LOCK_INIT(); 8640 SPI_ALLOC_LOCK_INIT(); 8641 8642 #ifndef IPSEC_DEBUG2 8643 callout_init(&key_timer, 1); 8644 callout_reset(&key_timer, hz, key_timehandler, NULL); 8645 #endif /*IPSEC_DEBUG2*/ 8646 8647 /* initialize key statistics */ 8648 keystat.getspi_count = 1; 8649 8650 if (bootverbose) 8651 printf("IPsec: Initialized Security Association Processing.\n"); 8652 } 8653 SYSINIT(key_init, SI_SUB_PROTO_DOMAIN, SI_ORDER_FIRST, key_init, NULL); 8654 8655 #ifdef VIMAGE 8656 static void 8657 key_vnet_destroy(void *arg __unused) 8658 { 8659 struct secashead_queue sahdrainq; 8660 struct secpolicy_queue drainq; 8661 struct secpolicy *sp, *nextsp; 8662 struct secacq *acq, *nextacq; 8663 struct secspacq *spacq, *nextspacq; 8664 struct secashead *sah; 8665 struct secasvar *sav; 8666 struct secreg *reg; 8667 int i; 8668 8669 /* 8670 * XXX: can we just call free() for each object without 8671 * walking through safe way with releasing references? 8672 */ 8673 TAILQ_INIT(&drainq); 8674 SPTREE_WLOCK(); 8675 for (i = 0; i < IPSEC_DIR_MAX; i++) { 8676 TAILQ_CONCAT(&drainq, &V_sptree[i], chain); 8677 TAILQ_CONCAT(&drainq, &V_sptree_ifnet[i], chain); 8678 } 8679 for (i = 0; i < V_sphash_mask + 1; i++) 8680 LIST_INIT(&V_sphashtbl[i]); 8681 SPTREE_WUNLOCK(); 8682 spdcache_destroy(); 8683 8684 sp = TAILQ_FIRST(&drainq); 8685 while (sp != NULL) { 8686 nextsp = TAILQ_NEXT(sp, chain); 8687 key_freesp(&sp); 8688 sp = nextsp; 8689 } 8690 8691 TAILQ_INIT(&sahdrainq); 8692 SAHTREE_WLOCK(); 8693 TAILQ_CONCAT(&sahdrainq, &V_sahtree, chain); 8694 for (i = 0; i < V_savhash_mask + 1; i++) 8695 LIST_INIT(&V_savhashtbl[i]); 8696 for (i = 0; i < V_sahaddrhash_mask + 1; i++) 8697 LIST_INIT(&V_sahaddrhashtbl[i]); 8698 TAILQ_FOREACH(sah, &sahdrainq, chain) { 8699 sah->state = SADB_SASTATE_DEAD; 8700 TAILQ_FOREACH(sav, &sah->savtree_larval, chain) { 8701 sav->state = SADB_SASTATE_DEAD; 8702 ipsec_accel_forget_sav(sav); 8703 } 8704 TAILQ_FOREACH(sav, &sah->savtree_alive, chain) { 8705 sav->state = SADB_SASTATE_DEAD; 8706 ipsec_accel_forget_sav(sav); 8707 } 8708 } 8709 SAHTREE_WUNLOCK(); 8710 8711 key_freesah_flushed(&sahdrainq); 8712 hashdestroy(V_sphashtbl, M_IPSEC_SP, V_sphash_mask); 8713 hashdestroy(V_savhashtbl, M_IPSEC_SA, V_savhash_mask); 8714 hashdestroy(V_sahaddrhashtbl, M_IPSEC_SAH, V_sahaddrhash_mask); 8715 8716 REGTREE_LOCK(); 8717 for (i = 0; i <= SADB_SATYPE_MAX; i++) { 8718 LIST_FOREACH(reg, &V_regtree[i], chain) { 8719 if (__LIST_CHAINED(reg)) { 8720 LIST_REMOVE(reg, chain); 8721 free(reg, M_IPSEC_SAR); 8722 break; 8723 } 8724 } 8725 } 8726 REGTREE_UNLOCK(); 8727 8728 ACQ_LOCK(); 8729 acq = LIST_FIRST(&V_acqtree); 8730 while (acq != NULL) { 8731 nextacq = LIST_NEXT(acq, chain); 8732 LIST_REMOVE(acq, chain); 8733 free(acq, M_IPSEC_SAQ); 8734 acq = nextacq; 8735 } 8736 for (i = 0; i < V_acqaddrhash_mask + 1; i++) 8737 LIST_INIT(&V_acqaddrhashtbl[i]); 8738 for (i = 0; i < V_acqseqhash_mask + 1; i++) 8739 LIST_INIT(&V_acqseqhashtbl[i]); 8740 ACQ_UNLOCK(); 8741 8742 SPACQ_LOCK(); 8743 for (spacq = LIST_FIRST(&V_spacqtree); spacq != NULL; 8744 spacq = nextspacq) { 8745 nextspacq = LIST_NEXT(spacq, chain); 8746 if (__LIST_CHAINED(spacq)) { 8747 LIST_REMOVE(spacq, chain); 8748 free(spacq, M_IPSEC_SAQ); 8749 } 8750 } 8751 SPACQ_UNLOCK(); 8752 hashdestroy(V_acqaddrhashtbl, M_IPSEC_SAQ, V_acqaddrhash_mask); 8753 hashdestroy(V_acqseqhashtbl, M_IPSEC_SAQ, V_acqseqhash_mask); 8754 } 8755 VNET_SYSUNINIT(key_vnet_destroy, SI_SUB_PROTO_DOMAIN, SI_ORDER_SECOND, 8756 key_vnet_destroy, NULL); 8757 #endif 8758 8759 /* 8760 * XXX: as long as domains are not unloadable, this function is never called, 8761 * provided for consistensy and future unload support. 8762 */ 8763 static void 8764 key_destroy(void *arg __unused) 8765 { 8766 uma_zdestroy(ipsec_key_lft_zone); 8767 8768 #ifndef IPSEC_DEBUG2 8769 callout_drain(&key_timer); 8770 #endif 8771 SPTREE_LOCK_DESTROY(); 8772 REGTREE_LOCK_DESTROY(); 8773 SAHTREE_LOCK_DESTROY(); 8774 ACQ_LOCK_DESTROY(); 8775 SPACQ_LOCK_DESTROY(); 8776 SPI_ALLOC_LOCK_DESTROY(); 8777 } 8778 SYSUNINIT(key_destroy, SI_SUB_PROTO_DOMAIN, SI_ORDER_FIRST, key_destroy, NULL); 8779 8780 /* record data transfer on SA, and update timestamps */ 8781 void 8782 key_sa_recordxfer(struct secasvar *sav, struct mbuf *m) 8783 { 8784 IPSEC_ASSERT(sav != NULL, ("Null secasvar")); 8785 IPSEC_ASSERT(m != NULL, ("Null mbuf")); 8786 8787 /* 8788 * XXX Currently, there is a difference of bytes size 8789 * between inbound and outbound processing. 8790 */ 8791 counter_u64_add(sav->lft_c_bytes, m->m_pkthdr.len); 8792 8793 /* 8794 * We use the number of packets as the unit of 8795 * allocations. We increment the variable 8796 * whenever {esp,ah}_{in,out}put is called. 8797 */ 8798 counter_u64_add(sav->lft_c_allocations, 1); 8799 8800 /* 8801 * NOTE: We record CURRENT usetime by using wall clock, 8802 * in seconds. HARD and SOFT lifetime are measured by the time 8803 * difference (again in seconds) from usetime. 8804 * 8805 * usetime 8806 * v expire expire 8807 * -----+-----+--------+---> t 8808 * <--------------> HARD 8809 * <-----> SOFT 8810 */ 8811 if (sav->firstused == 0) 8812 sav->firstused = time_second; 8813 } 8814 8815 /* 8816 * Take one of the kernel's security keys and convert it into a PF_KEY 8817 * structure within an mbuf, suitable for sending up to a waiting 8818 * application in user land. 8819 * 8820 * IN: 8821 * src: A pointer to a kernel security key. 8822 * exttype: Which type of key this is. Refer to the PF_KEY data structures. 8823 * OUT: 8824 * a valid mbuf or NULL indicating an error 8825 * 8826 */ 8827 8828 static struct mbuf * 8829 key_setkey(struct seckey *src, uint16_t exttype) 8830 { 8831 struct mbuf *m; 8832 struct sadb_key *p; 8833 int len; 8834 8835 if (src == NULL) 8836 return NULL; 8837 8838 len = PFKEY_ALIGN8(sizeof(struct sadb_key) + _KEYLEN(src)); 8839 m = m_get2(len, M_NOWAIT, MT_DATA, 0); 8840 if (m == NULL) 8841 return NULL; 8842 m_align(m, len); 8843 m->m_len = len; 8844 p = mtod(m, struct sadb_key *); 8845 bzero(p, len); 8846 p->sadb_key_len = PFKEY_UNIT64(len); 8847 p->sadb_key_exttype = exttype; 8848 p->sadb_key_bits = src->bits; 8849 bcopy(src->key_data, _KEYBUF(p), _KEYLEN(src)); 8850 8851 return m; 8852 } 8853 8854 #ifdef IPSEC_OFFLOAD 8855 struct mbuf * 8856 key_setaccelif(const char *ifname) 8857 { 8858 struct mbuf *m = NULL; 8859 struct sadb_x_if_hw_offl *p; 8860 int len = PFKEY_ALIGN8(sizeof(*p)); 8861 8862 m = m_get2(len, M_NOWAIT, MT_DATA, 0); 8863 if (m == NULL) 8864 return (m); 8865 m_align(m, len); 8866 m->m_len = len; 8867 p = mtod(m, struct sadb_x_if_hw_offl *); 8868 8869 bzero(p, len); 8870 p->sadb_x_if_hw_offl_len = PFKEY_UNIT64(len); 8871 p->sadb_x_if_hw_offl_exttype = SADB_X_EXT_IF_HW_OFFL; 8872 p->sadb_x_if_hw_offl_flags = 0; 8873 strncpy(p->sadb_x_if_hw_offl_if, ifname, 8874 sizeof(p->sadb_x_if_hw_offl_if)); 8875 8876 return (m); 8877 } 8878 #endif 8879 8880 /* 8881 * Take one of the kernel's lifetime data structures and convert it 8882 * into a PF_KEY structure within an mbuf, suitable for sending up to 8883 * a waiting application in user land. 8884 * 8885 * IN: 8886 * src: A pointer to a kernel lifetime structure. 8887 * exttype: Which type of lifetime this is. Refer to the PF_KEY 8888 * data structures for more information. 8889 * OUT: 8890 * a valid mbuf or NULL indicating an error 8891 * 8892 */ 8893 8894 static struct mbuf * 8895 key_setlifetime(struct seclifetime *src, uint16_t exttype) 8896 { 8897 struct mbuf *m = NULL; 8898 struct sadb_lifetime *p; 8899 int len = PFKEY_ALIGN8(sizeof(struct sadb_lifetime)); 8900 8901 if (src == NULL) 8902 return NULL; 8903 8904 m = m_get2(len, M_NOWAIT, MT_DATA, 0); 8905 if (m == NULL) 8906 return m; 8907 m_align(m, len); 8908 m->m_len = len; 8909 p = mtod(m, struct sadb_lifetime *); 8910 8911 bzero(p, len); 8912 p->sadb_lifetime_len = PFKEY_UNIT64(len); 8913 p->sadb_lifetime_exttype = exttype; 8914 p->sadb_lifetime_allocations = src->allocations; 8915 p->sadb_lifetime_bytes = src->bytes; 8916 p->sadb_lifetime_addtime = src->addtime; 8917 p->sadb_lifetime_usetime = src->usetime; 8918 8919 return m; 8920 8921 } 8922 8923 const struct enc_xform * 8924 enc_algorithm_lookup(int alg) 8925 { 8926 int i; 8927 8928 for (i = 0; i < nitems(supported_ealgs); i++) 8929 if (alg == supported_ealgs[i].sadb_alg) 8930 return (supported_ealgs[i].xform); 8931 return (NULL); 8932 } 8933 8934 const struct auth_hash * 8935 auth_algorithm_lookup(int alg) 8936 { 8937 int i; 8938 8939 for (i = 0; i < nitems(supported_aalgs); i++) 8940 if (alg == supported_aalgs[i].sadb_alg) 8941 return (supported_aalgs[i].xform); 8942 return (NULL); 8943 } 8944 8945 const struct comp_algo * 8946 comp_algorithm_lookup(int alg) 8947 { 8948 int i; 8949 8950 for (i = 0; i < nitems(supported_calgs); i++) 8951 if (alg == supported_calgs[i].sadb_alg) 8952 return (supported_calgs[i].xform); 8953 return (NULL); 8954 } 8955 8956 void 8957 ipsec_sahtree_runlock(struct rm_priotracker *sahtree_trackerp) 8958 { 8959 rm_runlock(&sahtree_lock, sahtree_trackerp); 8960 } 8961 8962 void 8963 ipsec_sahtree_rlock(struct rm_priotracker *sahtree_trackerp) 8964 { 8965 rm_rlock(&sahtree_lock, sahtree_trackerp); 8966 } 8967