1 /* $FreeBSD$ */ 2 /* $KAME: key.c,v 1.191 2001/06/27 10:46:49 sakane Exp $ */ 3 4 /*- 5 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. 6 * All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 3. Neither the name of the project nor the names of its contributors 17 * may be used to endorse or promote products derived from this software 18 * without specific prior written permission. 19 * 20 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND 21 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 22 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 23 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE 24 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 25 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 26 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 27 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 29 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 30 * SUCH DAMAGE. 31 */ 32 33 /* 34 * This code is referd to RFC 2367 35 */ 36 37 #include "opt_inet.h" 38 #include "opt_inet6.h" 39 #include "opt_ipsec.h" 40 41 #include <sys/types.h> 42 #include <sys/param.h> 43 #include <sys/systm.h> 44 #include <sys/kernel.h> 45 #include <sys/lock.h> 46 #include <sys/mutex.h> 47 #include <sys/mbuf.h> 48 #include <sys/domain.h> 49 #include <sys/protosw.h> 50 #include <sys/malloc.h> 51 #include <sys/rmlock.h> 52 #include <sys/socket.h> 53 #include <sys/socketvar.h> 54 #include <sys/sysctl.h> 55 #include <sys/errno.h> 56 #include <sys/proc.h> 57 #include <sys/queue.h> 58 #include <sys/refcount.h> 59 #include <sys/syslog.h> 60 61 #include <net/if.h> 62 #include <net/if_var.h> 63 #include <net/vnet.h> 64 #include <net/raw_cb.h> 65 66 #include <netinet/in.h> 67 #include <netinet/in_systm.h> 68 #include <netinet/ip.h> 69 #include <netinet/in_var.h> 70 71 #ifdef INET6 72 #include <netinet/ip6.h> 73 #include <netinet6/in6_var.h> 74 #include <netinet6/ip6_var.h> 75 #endif /* INET6 */ 76 77 #if defined(INET) || defined(INET6) 78 #include <netinet/in_pcb.h> 79 #endif 80 #ifdef INET6 81 #include <netinet6/in6_pcb.h> 82 #endif /* INET6 */ 83 84 #include <net/pfkeyv2.h> 85 #include <netipsec/keydb.h> 86 #include <netipsec/key.h> 87 #include <netipsec/keysock.h> 88 #include <netipsec/key_debug.h> 89 90 #include <netipsec/ipsec.h> 91 #ifdef INET6 92 #include <netipsec/ipsec6.h> 93 #endif 94 95 #include <netipsec/xform.h> 96 97 #include <machine/stdarg.h> 98 99 /* randomness */ 100 #include <sys/random.h> 101 102 #define FULLMASK 0xff 103 #define _BITS(bytes) ((bytes) << 3) 104 105 /* 106 * Note on SA reference counting: 107 * - SAs that are not in DEAD state will have (total external reference + 1) 108 * following value in reference count field. they cannot be freed and are 109 * referenced from SA header. 110 * - SAs that are in DEAD state will have (total external reference) 111 * in reference count field. they are ready to be freed. reference from 112 * SA header will be removed in key_delsav(), when the reference count 113 * field hits 0 (= no external reference other than from SA header. 114 */ 115 116 VNET_DEFINE(u_int32_t, key_debug_level) = 0; 117 static VNET_DEFINE(u_int, key_spi_trycnt) = 1000; 118 static VNET_DEFINE(u_int32_t, key_spi_minval) = 0x100; 119 static VNET_DEFINE(u_int32_t, key_spi_maxval) = 0x0fffffff; /* XXX */ 120 static VNET_DEFINE(u_int32_t, policy_id) = 0; 121 /*interval to initialize randseed,1(m)*/ 122 static VNET_DEFINE(u_int, key_int_random) = 60; 123 /* interval to expire acquiring, 30(s)*/ 124 static VNET_DEFINE(u_int, key_larval_lifetime) = 30; 125 /* counter for blocking SADB_ACQUIRE.*/ 126 static VNET_DEFINE(int, key_blockacq_count) = 10; 127 /* lifetime for blocking SADB_ACQUIRE.*/ 128 static VNET_DEFINE(int, key_blockacq_lifetime) = 20; 129 /* preferred old sa rather than new sa.*/ 130 static VNET_DEFINE(int, key_preferred_oldsa) = 1; 131 #define V_key_spi_trycnt VNET(key_spi_trycnt) 132 #define V_key_spi_minval VNET(key_spi_minval) 133 #define V_key_spi_maxval VNET(key_spi_maxval) 134 #define V_policy_id VNET(policy_id) 135 #define V_key_int_random VNET(key_int_random) 136 #define V_key_larval_lifetime VNET(key_larval_lifetime) 137 #define V_key_blockacq_count VNET(key_blockacq_count) 138 #define V_key_blockacq_lifetime VNET(key_blockacq_lifetime) 139 #define V_key_preferred_oldsa VNET(key_preferred_oldsa) 140 141 static VNET_DEFINE(u_int32_t, acq_seq) = 0; 142 #define V_acq_seq VNET(acq_seq) 143 144 /* SPD */ 145 static VNET_DEFINE(TAILQ_HEAD(_sptree, secpolicy), sptree[IPSEC_DIR_MAX]); 146 static struct rmlock sptree_lock; 147 #define V_sptree VNET(sptree) 148 #define SPTREE_LOCK_INIT() rm_init(&sptree_lock, "sptree") 149 #define SPTREE_LOCK_DESTROY() rm_destroy(&sptree_lock) 150 #define SPTREE_RLOCK_TRACKER struct rm_priotracker sptree_tracker 151 #define SPTREE_RLOCK() rm_rlock(&sptree_lock, &sptree_tracker) 152 #define SPTREE_RUNLOCK() rm_runlock(&sptree_lock, &sptree_tracker) 153 #define SPTREE_RLOCK_ASSERT() rm_assert(&sptree_lock, RA_RLOCKED) 154 #define SPTREE_WLOCK() rm_wlock(&sptree_lock) 155 #define SPTREE_WUNLOCK() rm_wunlock(&sptree_lock) 156 #define SPTREE_WLOCK_ASSERT() rm_assert(&sptree_lock, RA_WLOCKED) 157 #define SPTREE_UNLOCK_ASSERT() rm_assert(&sptree_lock, RA_UNLOCKED) 158 159 static VNET_DEFINE(LIST_HEAD(_sahtree, secashead), sahtree); /* SAD */ 160 #define V_sahtree VNET(sahtree) 161 static struct mtx sahtree_lock; 162 #define SAHTREE_LOCK_INIT() \ 163 mtx_init(&sahtree_lock, "sahtree", \ 164 "fast ipsec security association database", MTX_DEF) 165 #define SAHTREE_LOCK_DESTROY() mtx_destroy(&sahtree_lock) 166 #define SAHTREE_LOCK() mtx_lock(&sahtree_lock) 167 #define SAHTREE_UNLOCK() mtx_unlock(&sahtree_lock) 168 #define SAHTREE_LOCK_ASSERT() mtx_assert(&sahtree_lock, MA_OWNED) 169 170 /* registed list */ 171 static VNET_DEFINE(LIST_HEAD(_regtree, secreg), regtree[SADB_SATYPE_MAX + 1]); 172 #define V_regtree VNET(regtree) 173 static struct mtx regtree_lock; 174 #define REGTREE_LOCK_INIT() \ 175 mtx_init(®tree_lock, "regtree", "fast ipsec regtree", MTX_DEF) 176 #define REGTREE_LOCK_DESTROY() mtx_destroy(®tree_lock) 177 #define REGTREE_LOCK() mtx_lock(®tree_lock) 178 #define REGTREE_UNLOCK() mtx_unlock(®tree_lock) 179 #define REGTREE_LOCK_ASSERT() mtx_assert(®tree_lock, MA_OWNED) 180 181 static VNET_DEFINE(LIST_HEAD(_acqtree, secacq), acqtree); /* acquiring list */ 182 #define V_acqtree VNET(acqtree) 183 static struct mtx acq_lock; 184 #define ACQ_LOCK_INIT() \ 185 mtx_init(&acq_lock, "acqtree", "fast ipsec acquire list", MTX_DEF) 186 #define ACQ_LOCK_DESTROY() mtx_destroy(&acq_lock) 187 #define ACQ_LOCK() mtx_lock(&acq_lock) 188 #define ACQ_UNLOCK() mtx_unlock(&acq_lock) 189 #define ACQ_LOCK_ASSERT() mtx_assert(&acq_lock, MA_OWNED) 190 191 /* SP acquiring list */ 192 static VNET_DEFINE(LIST_HEAD(_spacqtree, secspacq), spacqtree); 193 #define V_spacqtree VNET(spacqtree) 194 static struct mtx spacq_lock; 195 #define SPACQ_LOCK_INIT() \ 196 mtx_init(&spacq_lock, "spacqtree", \ 197 "fast ipsec security policy acquire list", MTX_DEF) 198 #define SPACQ_LOCK_DESTROY() mtx_destroy(&spacq_lock) 199 #define SPACQ_LOCK() mtx_lock(&spacq_lock) 200 #define SPACQ_UNLOCK() mtx_unlock(&spacq_lock) 201 #define SPACQ_LOCK_ASSERT() mtx_assert(&spacq_lock, MA_OWNED) 202 203 /* search order for SAs */ 204 static const u_int saorder_state_valid_prefer_old[] = { 205 SADB_SASTATE_DYING, SADB_SASTATE_MATURE, 206 }; 207 static const u_int saorder_state_valid_prefer_new[] = { 208 SADB_SASTATE_MATURE, SADB_SASTATE_DYING, 209 }; 210 static const u_int saorder_state_alive[] = { 211 /* except DEAD */ 212 SADB_SASTATE_MATURE, SADB_SASTATE_DYING, SADB_SASTATE_LARVAL 213 }; 214 static const u_int saorder_state_any[] = { 215 SADB_SASTATE_MATURE, SADB_SASTATE_DYING, 216 SADB_SASTATE_LARVAL, SADB_SASTATE_DEAD 217 }; 218 219 static const int minsize[] = { 220 sizeof(struct sadb_msg), /* SADB_EXT_RESERVED */ 221 sizeof(struct sadb_sa), /* SADB_EXT_SA */ 222 sizeof(struct sadb_lifetime), /* SADB_EXT_LIFETIME_CURRENT */ 223 sizeof(struct sadb_lifetime), /* SADB_EXT_LIFETIME_HARD */ 224 sizeof(struct sadb_lifetime), /* SADB_EXT_LIFETIME_SOFT */ 225 sizeof(struct sadb_address), /* SADB_EXT_ADDRESS_SRC */ 226 sizeof(struct sadb_address), /* SADB_EXT_ADDRESS_DST */ 227 sizeof(struct sadb_address), /* SADB_EXT_ADDRESS_PROXY */ 228 sizeof(struct sadb_key), /* SADB_EXT_KEY_AUTH */ 229 sizeof(struct sadb_key), /* SADB_EXT_KEY_ENCRYPT */ 230 sizeof(struct sadb_ident), /* SADB_EXT_IDENTITY_SRC */ 231 sizeof(struct sadb_ident), /* SADB_EXT_IDENTITY_DST */ 232 sizeof(struct sadb_sens), /* SADB_EXT_SENSITIVITY */ 233 sizeof(struct sadb_prop), /* SADB_EXT_PROPOSAL */ 234 sizeof(struct sadb_supported), /* SADB_EXT_SUPPORTED_AUTH */ 235 sizeof(struct sadb_supported), /* SADB_EXT_SUPPORTED_ENCRYPT */ 236 sizeof(struct sadb_spirange), /* SADB_EXT_SPIRANGE */ 237 0, /* SADB_X_EXT_KMPRIVATE */ 238 sizeof(struct sadb_x_policy), /* SADB_X_EXT_POLICY */ 239 sizeof(struct sadb_x_sa2), /* SADB_X_SA2 */ 240 sizeof(struct sadb_x_nat_t_type),/* SADB_X_EXT_NAT_T_TYPE */ 241 sizeof(struct sadb_x_nat_t_port),/* SADB_X_EXT_NAT_T_SPORT */ 242 sizeof(struct sadb_x_nat_t_port),/* SADB_X_EXT_NAT_T_DPORT */ 243 sizeof(struct sadb_address), /* SADB_X_EXT_NAT_T_OAI */ 244 sizeof(struct sadb_address), /* SADB_X_EXT_NAT_T_OAR */ 245 sizeof(struct sadb_x_nat_t_frag),/* SADB_X_EXT_NAT_T_FRAG */ 246 sizeof(struct sadb_x_sa_replay), /* SADB_X_EXT_SA_REPLAY */ 247 }; 248 _Static_assert(sizeof(minsize)/sizeof(int) == SADB_EXT_MAX + 1, "minsize size mismatch"); 249 250 static const int maxsize[] = { 251 sizeof(struct sadb_msg), /* SADB_EXT_RESERVED */ 252 sizeof(struct sadb_sa), /* SADB_EXT_SA */ 253 sizeof(struct sadb_lifetime), /* SADB_EXT_LIFETIME_CURRENT */ 254 sizeof(struct sadb_lifetime), /* SADB_EXT_LIFETIME_HARD */ 255 sizeof(struct sadb_lifetime), /* SADB_EXT_LIFETIME_SOFT */ 256 0, /* SADB_EXT_ADDRESS_SRC */ 257 0, /* SADB_EXT_ADDRESS_DST */ 258 0, /* SADB_EXT_ADDRESS_PROXY */ 259 0, /* SADB_EXT_KEY_AUTH */ 260 0, /* SADB_EXT_KEY_ENCRYPT */ 261 0, /* SADB_EXT_IDENTITY_SRC */ 262 0, /* SADB_EXT_IDENTITY_DST */ 263 0, /* SADB_EXT_SENSITIVITY */ 264 0, /* SADB_EXT_PROPOSAL */ 265 0, /* SADB_EXT_SUPPORTED_AUTH */ 266 0, /* SADB_EXT_SUPPORTED_ENCRYPT */ 267 sizeof(struct sadb_spirange), /* SADB_EXT_SPIRANGE */ 268 0, /* SADB_X_EXT_KMPRIVATE */ 269 0, /* SADB_X_EXT_POLICY */ 270 sizeof(struct sadb_x_sa2), /* SADB_X_SA2 */ 271 sizeof(struct sadb_x_nat_t_type),/* SADB_X_EXT_NAT_T_TYPE */ 272 sizeof(struct sadb_x_nat_t_port),/* SADB_X_EXT_NAT_T_SPORT */ 273 sizeof(struct sadb_x_nat_t_port),/* SADB_X_EXT_NAT_T_DPORT */ 274 0, /* SADB_X_EXT_NAT_T_OAI */ 275 0, /* SADB_X_EXT_NAT_T_OAR */ 276 sizeof(struct sadb_x_nat_t_frag),/* SADB_X_EXT_NAT_T_FRAG */ 277 sizeof(struct sadb_x_sa_replay), /* SADB_X_EXT_SA_REPLAY */ 278 }; 279 _Static_assert(sizeof(maxsize)/sizeof(int) == SADB_EXT_MAX + 1, "minsize size mismatch"); 280 281 static VNET_DEFINE(int, ipsec_esp_keymin) = 256; 282 static VNET_DEFINE(int, ipsec_esp_auth) = 0; 283 static VNET_DEFINE(int, ipsec_ah_keymin) = 128; 284 285 #define V_ipsec_esp_keymin VNET(ipsec_esp_keymin) 286 #define V_ipsec_esp_auth VNET(ipsec_esp_auth) 287 #define V_ipsec_ah_keymin VNET(ipsec_ah_keymin) 288 289 #ifdef SYSCTL_DECL 290 SYSCTL_DECL(_net_key); 291 #endif 292 293 SYSCTL_INT(_net_key, KEYCTL_DEBUG_LEVEL, debug, 294 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(key_debug_level), 0, ""); 295 296 /* max count of trial for the decision of spi value */ 297 SYSCTL_INT(_net_key, KEYCTL_SPI_TRY, spi_trycnt, 298 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(key_spi_trycnt), 0, ""); 299 300 /* minimum spi value to allocate automatically. */ 301 SYSCTL_INT(_net_key, KEYCTL_SPI_MIN_VALUE, spi_minval, 302 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(key_spi_minval), 0, ""); 303 304 /* maximun spi value to allocate automatically. */ 305 SYSCTL_INT(_net_key, KEYCTL_SPI_MAX_VALUE, spi_maxval, 306 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(key_spi_maxval), 0, ""); 307 308 /* interval to initialize randseed */ 309 SYSCTL_INT(_net_key, KEYCTL_RANDOM_INT, int_random, 310 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(key_int_random), 0, ""); 311 312 /* lifetime for larval SA */ 313 SYSCTL_INT(_net_key, KEYCTL_LARVAL_LIFETIME, larval_lifetime, 314 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(key_larval_lifetime), 0, ""); 315 316 /* counter for blocking to send SADB_ACQUIRE to IKEd */ 317 SYSCTL_INT(_net_key, KEYCTL_BLOCKACQ_COUNT, blockacq_count, 318 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(key_blockacq_count), 0, ""); 319 320 /* lifetime for blocking to send SADB_ACQUIRE to IKEd */ 321 SYSCTL_INT(_net_key, KEYCTL_BLOCKACQ_LIFETIME, blockacq_lifetime, 322 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(key_blockacq_lifetime), 0, ""); 323 324 /* ESP auth */ 325 SYSCTL_INT(_net_key, KEYCTL_ESP_AUTH, esp_auth, 326 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ipsec_esp_auth), 0, ""); 327 328 /* minimum ESP key length */ 329 SYSCTL_INT(_net_key, KEYCTL_ESP_KEYMIN, esp_keymin, 330 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ipsec_esp_keymin), 0, ""); 331 332 /* minimum AH key length */ 333 SYSCTL_INT(_net_key, KEYCTL_AH_KEYMIN, ah_keymin, 334 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ipsec_ah_keymin), 0, ""); 335 336 /* perfered old SA rather than new SA */ 337 SYSCTL_INT(_net_key, KEYCTL_PREFERED_OLDSA, preferred_oldsa, 338 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(key_preferred_oldsa), 0, ""); 339 340 #define __LIST_CHAINED(elm) \ 341 (!((elm)->chain.le_next == NULL && (elm)->chain.le_prev == NULL)) 342 #define LIST_INSERT_TAIL(head, elm, type, field) \ 343 do {\ 344 struct type *curelm = LIST_FIRST(head); \ 345 if (curelm == NULL) {\ 346 LIST_INSERT_HEAD(head, elm, field); \ 347 } else { \ 348 while (LIST_NEXT(curelm, field)) \ 349 curelm = LIST_NEXT(curelm, field);\ 350 LIST_INSERT_AFTER(curelm, elm, field);\ 351 }\ 352 } while (0) 353 354 #define KEY_CHKSASTATE(head, sav, name) \ 355 do { \ 356 if ((head) != (sav)) { \ 357 ipseclog((LOG_DEBUG, "%s: state mismatched (TREE=%d SA=%d)\n", \ 358 (name), (head), (sav))); \ 359 break; \ 360 } \ 361 } while (0) 362 363 #define KEY_CHKSPDIR(head, sp, name) \ 364 do { \ 365 if ((head) != (sp)) { \ 366 ipseclog((LOG_DEBUG, "%s: direction mismatched (TREE=%d SP=%d), " \ 367 "anyway continue.\n", \ 368 (name), (head), (sp))); \ 369 } \ 370 } while (0) 371 372 MALLOC_DEFINE(M_IPSEC_SA, "secasvar", "ipsec security association"); 373 MALLOC_DEFINE(M_IPSEC_SAH, "sahead", "ipsec sa head"); 374 MALLOC_DEFINE(M_IPSEC_SP, "ipsecpolicy", "ipsec security policy"); 375 MALLOC_DEFINE(M_IPSEC_SR, "ipsecrequest", "ipsec security request"); 376 MALLOC_DEFINE(M_IPSEC_MISC, "ipsec-misc", "ipsec miscellaneous"); 377 MALLOC_DEFINE(M_IPSEC_SAQ, "ipsec-saq", "ipsec sa acquire"); 378 MALLOC_DEFINE(M_IPSEC_SAR, "ipsec-reg", "ipsec sa acquire"); 379 380 /* 381 * set parameters into secpolicyindex buffer. 382 * Must allocate secpolicyindex buffer passed to this function. 383 */ 384 #define KEY_SETSECSPIDX(_dir, s, d, ps, pd, ulp, idx) \ 385 do { \ 386 bzero((idx), sizeof(struct secpolicyindex)); \ 387 (idx)->dir = (_dir); \ 388 (idx)->prefs = (ps); \ 389 (idx)->prefd = (pd); \ 390 (idx)->ul_proto = (ulp); \ 391 bcopy((s), &(idx)->src, ((const struct sockaddr *)(s))->sa_len); \ 392 bcopy((d), &(idx)->dst, ((const struct sockaddr *)(d))->sa_len); \ 393 } while (0) 394 395 /* 396 * set parameters into secasindex buffer. 397 * Must allocate secasindex buffer before calling this function. 398 */ 399 #define KEY_SETSECASIDX(p, m, r, s, d, idx) \ 400 do { \ 401 bzero((idx), sizeof(struct secasindex)); \ 402 (idx)->proto = (p); \ 403 (idx)->mode = (m); \ 404 (idx)->reqid = (r); \ 405 bcopy((s), &(idx)->src, ((const struct sockaddr *)(s))->sa_len); \ 406 bcopy((d), &(idx)->dst, ((const struct sockaddr *)(d))->sa_len); \ 407 } while (0) 408 409 /* key statistics */ 410 struct _keystat { 411 u_long getspi_count; /* the avarage of count to try to get new SPI */ 412 } keystat; 413 414 struct sadb_msghdr { 415 struct sadb_msg *msg; 416 struct sadb_ext *ext[SADB_EXT_MAX + 1]; 417 int extoff[SADB_EXT_MAX + 1]; 418 int extlen[SADB_EXT_MAX + 1]; 419 }; 420 421 #ifndef IPSEC_DEBUG2 422 static struct callout key_timer; 423 #endif 424 425 static struct secasvar *key_allocsa_policy(const struct secasindex *); 426 static void key_freesp_so(struct secpolicy **); 427 static struct secasvar *key_do_allocsa_policy(struct secashead *, u_int); 428 static void key_unlink(struct secpolicy *); 429 static struct secpolicy *key_getsp(struct secpolicyindex *); 430 static struct secpolicy *key_getspbyid(u_int32_t); 431 static u_int32_t key_newreqid(void); 432 static struct mbuf *key_gather_mbuf(struct mbuf *, 433 const struct sadb_msghdr *, int, int, ...); 434 static int key_spdadd(struct socket *, struct mbuf *, 435 const struct sadb_msghdr *); 436 static u_int32_t key_getnewspid(void); 437 static int key_spddelete(struct socket *, struct mbuf *, 438 const struct sadb_msghdr *); 439 static int key_spddelete2(struct socket *, struct mbuf *, 440 const struct sadb_msghdr *); 441 static int key_spdget(struct socket *, struct mbuf *, 442 const struct sadb_msghdr *); 443 static int key_spdflush(struct socket *, struct mbuf *, 444 const struct sadb_msghdr *); 445 static int key_spddump(struct socket *, struct mbuf *, 446 const struct sadb_msghdr *); 447 static struct mbuf *key_setdumpsp(struct secpolicy *, 448 u_int8_t, u_int32_t, u_int32_t); 449 static u_int key_getspreqmsglen(struct secpolicy *); 450 static int key_spdexpire(struct secpolicy *); 451 static struct secashead *key_newsah(struct secasindex *); 452 static void key_delsah(struct secashead *); 453 static struct secasvar *key_newsav(struct mbuf *, 454 const struct sadb_msghdr *, struct secashead *, int *, 455 const char*, int); 456 #define KEY_NEWSAV(m, sadb, sah, e) \ 457 key_newsav(m, sadb, sah, e, __FILE__, __LINE__) 458 static void key_delsav(struct secasvar *); 459 static struct secashead *key_getsah(struct secasindex *); 460 static struct secasvar *key_checkspidup(struct secasindex *, u_int32_t); 461 static struct secasvar *key_getsavbyspi(struct secashead *, u_int32_t); 462 static int key_setsaval(struct secasvar *, struct mbuf *, 463 const struct sadb_msghdr *); 464 static int key_mature(struct secasvar *); 465 static struct mbuf *key_setdumpsa(struct secasvar *, u_int8_t, 466 u_int8_t, u_int32_t, u_int32_t); 467 static struct mbuf *key_setsadbmsg(u_int8_t, u_int16_t, u_int8_t, 468 u_int32_t, pid_t, u_int16_t); 469 static struct mbuf *key_setsadbsa(struct secasvar *); 470 static struct mbuf *key_setsadbaddr(u_int16_t, 471 const struct sockaddr *, u_int8_t, u_int16_t); 472 #ifdef IPSEC_NAT_T 473 static struct mbuf *key_setsadbxport(u_int16_t, u_int16_t); 474 static struct mbuf *key_setsadbxtype(u_int16_t); 475 #endif 476 static void key_porttosaddr(struct sockaddr *, u_int16_t); 477 #define KEY_PORTTOSADDR(saddr, port) \ 478 key_porttosaddr((struct sockaddr *)(saddr), (port)) 479 static struct mbuf *key_setsadbxsa2(u_int8_t, u_int32_t, u_int32_t); 480 static struct mbuf *key_setsadbxsareplay(u_int32_t); 481 static struct mbuf *key_setsadbxpolicy(u_int16_t, u_int8_t, 482 u_int32_t, u_int32_t); 483 static struct seckey *key_dup_keymsg(const struct sadb_key *, u_int, 484 struct malloc_type *); 485 static struct seclifetime *key_dup_lifemsg(const struct sadb_lifetime *src, 486 struct malloc_type *type); 487 #ifdef INET6 488 static int key_ismyaddr6(struct sockaddr_in6 *); 489 #endif 490 491 /* flags for key_cmpsaidx() */ 492 #define CMP_HEAD 1 /* protocol, addresses. */ 493 #define CMP_MODE_REQID 2 /* additionally HEAD, reqid, mode. */ 494 #define CMP_REQID 3 /* additionally HEAD, reaid. */ 495 #define CMP_EXACTLY 4 /* all elements. */ 496 static int key_cmpsaidx(const struct secasindex *, 497 const struct secasindex *, int); 498 static int key_cmpspidx_exactly(struct secpolicyindex *, 499 struct secpolicyindex *); 500 static int key_cmpspidx_withmask(struct secpolicyindex *, 501 struct secpolicyindex *); 502 static int key_sockaddrcmp(const struct sockaddr *, 503 const struct sockaddr *, int); 504 static int key_bbcmp(const void *, const void *, u_int); 505 static u_int16_t key_satype2proto(u_int8_t); 506 static u_int8_t key_proto2satype(u_int16_t); 507 508 static int key_getspi(struct socket *, struct mbuf *, 509 const struct sadb_msghdr *); 510 static u_int32_t key_do_getnewspi(struct sadb_spirange *, 511 struct secasindex *); 512 static int key_update(struct socket *, struct mbuf *, 513 const struct sadb_msghdr *); 514 #ifdef IPSEC_DOSEQCHECK 515 static struct secasvar *key_getsavbyseq(struct secashead *, u_int32_t); 516 #endif 517 static int key_add(struct socket *, struct mbuf *, 518 const struct sadb_msghdr *); 519 static int key_setident(struct secashead *, struct mbuf *, 520 const struct sadb_msghdr *); 521 static struct mbuf *key_getmsgbuf_x1(struct mbuf *, 522 const struct sadb_msghdr *); 523 static int key_delete(struct socket *, struct mbuf *, 524 const struct sadb_msghdr *); 525 static int key_delete_all(struct socket *, struct mbuf *, 526 const struct sadb_msghdr *, u_int16_t); 527 static int key_get(struct socket *, struct mbuf *, 528 const struct sadb_msghdr *); 529 530 static void key_getcomb_setlifetime(struct sadb_comb *); 531 static struct mbuf *key_getcomb_esp(void); 532 static struct mbuf *key_getcomb_ah(void); 533 static struct mbuf *key_getcomb_ipcomp(void); 534 static struct mbuf *key_getprop(const struct secasindex *); 535 536 static int key_acquire(const struct secasindex *, struct secpolicy *); 537 static struct secacq *key_newacq(const struct secasindex *); 538 static struct secacq *key_getacq(const struct secasindex *); 539 static struct secacq *key_getacqbyseq(u_int32_t); 540 static struct secspacq *key_newspacq(struct secpolicyindex *); 541 static struct secspacq *key_getspacq(struct secpolicyindex *); 542 static int key_acquire2(struct socket *, struct mbuf *, 543 const struct sadb_msghdr *); 544 static int key_register(struct socket *, struct mbuf *, 545 const struct sadb_msghdr *); 546 static int key_expire(struct secasvar *, int); 547 static int key_flush(struct socket *, struct mbuf *, 548 const struct sadb_msghdr *); 549 static int key_dump(struct socket *, struct mbuf *, 550 const struct sadb_msghdr *); 551 static int key_promisc(struct socket *, struct mbuf *, 552 const struct sadb_msghdr *); 553 static int key_senderror(struct socket *, struct mbuf *, int); 554 static int key_validate_ext(const struct sadb_ext *, int); 555 static int key_align(struct mbuf *, struct sadb_msghdr *); 556 static struct mbuf *key_setlifetime(struct seclifetime *src, 557 u_int16_t exttype); 558 static struct mbuf *key_setkey(struct seckey *src, u_int16_t exttype); 559 560 #if 0 561 static const char *key_getfqdn(void); 562 static const char *key_getuserfqdn(void); 563 #endif 564 static void key_sa_chgstate(struct secasvar *, u_int8_t); 565 566 static __inline void 567 sa_initref(struct secasvar *sav) 568 { 569 570 refcount_init(&sav->refcnt, 1); 571 } 572 static __inline void 573 sa_addref(struct secasvar *sav) 574 { 575 576 refcount_acquire(&sav->refcnt); 577 IPSEC_ASSERT(sav->refcnt != 0, ("SA refcnt overflow")); 578 } 579 static __inline int 580 sa_delref(struct secasvar *sav) 581 { 582 583 IPSEC_ASSERT(sav->refcnt > 0, ("SA refcnt underflow")); 584 return (refcount_release(&sav->refcnt)); 585 } 586 587 #define SP_ADDREF(p) refcount_acquire(&(p)->refcnt) 588 #define SP_DELREF(p) refcount_release(&(p)->refcnt) 589 590 /* 591 * Update the refcnt while holding the SPTREE lock. 592 */ 593 void 594 key_addref(struct secpolicy *sp) 595 { 596 597 SP_ADDREF(sp); 598 } 599 600 /* 601 * Return 0 when there are known to be no SP's for the specified 602 * direction. Otherwise return 1. This is used by IPsec code 603 * to optimize performance. 604 */ 605 int 606 key_havesp(u_int dir) 607 { 608 609 return (dir == IPSEC_DIR_INBOUND || dir == IPSEC_DIR_OUTBOUND ? 610 TAILQ_FIRST(&V_sptree[dir]) != NULL : 1); 611 } 612 613 /* %%% IPsec policy management */ 614 /* 615 * allocating a SP for OUTBOUND or INBOUND packet. 616 * Must call key_freesp() later. 617 * OUT: NULL: not found 618 * others: found and return the pointer. 619 */ 620 struct secpolicy * 621 key_allocsp(struct secpolicyindex *spidx, u_int dir, const char* where, 622 int tag) 623 { 624 SPTREE_RLOCK_TRACKER; 625 struct secpolicy *sp; 626 627 IPSEC_ASSERT(spidx != NULL, ("null spidx")); 628 IPSEC_ASSERT(dir == IPSEC_DIR_INBOUND || dir == IPSEC_DIR_OUTBOUND, 629 ("invalid direction %u", dir)); 630 631 KEYDEBUG(KEYDEBUG_IPSEC_STAMP, 632 printf("DP %s from %s:%u\n", __func__, where, tag)); 633 634 /* get a SP entry */ 635 KEYDEBUG(KEYDEBUG_IPSEC_DATA, 636 printf("*** objects\n"); 637 kdebug_secpolicyindex(spidx)); 638 639 SPTREE_RLOCK(); 640 TAILQ_FOREACH(sp, &V_sptree[dir], chain) { 641 KEYDEBUG(KEYDEBUG_IPSEC_DATA, 642 printf("*** in SPD\n"); 643 kdebug_secpolicyindex(&sp->spidx)); 644 if (key_cmpspidx_withmask(&sp->spidx, spidx)) 645 goto found; 646 } 647 sp = NULL; 648 found: 649 if (sp) { 650 /* sanity check */ 651 KEY_CHKSPDIR(sp->spidx.dir, dir, __func__); 652 653 /* found a SPD entry */ 654 sp->lastused = time_second; 655 SP_ADDREF(sp); 656 } 657 SPTREE_RUNLOCK(); 658 659 KEYDEBUG(KEYDEBUG_IPSEC_STAMP, 660 printf("DP %s return SP:%p (ID=%u) refcnt %u\n", __func__, 661 sp, sp ? sp->id : 0, sp ? sp->refcnt : 0)); 662 return sp; 663 } 664 665 /* 666 * allocating a SP for OUTBOUND or INBOUND packet. 667 * Must call key_freesp() later. 668 * OUT: NULL: not found 669 * others: found and return the pointer. 670 */ 671 struct secpolicy * 672 key_allocsp2(u_int32_t spi, union sockaddr_union *dst, u_int8_t proto, 673 u_int dir, const char* where, int tag) 674 { 675 SPTREE_RLOCK_TRACKER; 676 struct secpolicy *sp; 677 678 IPSEC_ASSERT(dst != NULL, ("null dst")); 679 IPSEC_ASSERT(dir == IPSEC_DIR_INBOUND || dir == IPSEC_DIR_OUTBOUND, 680 ("invalid direction %u", dir)); 681 682 KEYDEBUG(KEYDEBUG_IPSEC_STAMP, 683 printf("DP %s from %s:%u\n", __func__, where, tag)); 684 685 /* get a SP entry */ 686 KEYDEBUG(KEYDEBUG_IPSEC_DATA, 687 printf("*** objects\n"); 688 printf("spi %u proto %u dir %u\n", spi, proto, dir); 689 kdebug_sockaddr(&dst->sa)); 690 691 SPTREE_RLOCK(); 692 TAILQ_FOREACH(sp, &V_sptree[dir], chain) { 693 KEYDEBUG(KEYDEBUG_IPSEC_DATA, 694 printf("*** in SPD\n"); 695 kdebug_secpolicyindex(&sp->spidx)); 696 /* compare simple values, then dst address */ 697 if (sp->spidx.ul_proto != proto) 698 continue; 699 /* NB: spi's must exist and match */ 700 if (!sp->req || !sp->req->sav || sp->req->sav->spi != spi) 701 continue; 702 if (key_sockaddrcmp(&sp->spidx.dst.sa, &dst->sa, 1) == 0) 703 goto found; 704 } 705 sp = NULL; 706 found: 707 if (sp) { 708 /* sanity check */ 709 KEY_CHKSPDIR(sp->spidx.dir, dir, __func__); 710 711 /* found a SPD entry */ 712 sp->lastused = time_second; 713 SP_ADDREF(sp); 714 } 715 SPTREE_RUNLOCK(); 716 717 KEYDEBUG(KEYDEBUG_IPSEC_STAMP, 718 printf("DP %s return SP:%p (ID=%u) refcnt %u\n", __func__, 719 sp, sp ? sp->id : 0, sp ? sp->refcnt : 0)); 720 return sp; 721 } 722 723 #if 0 724 /* 725 * return a policy that matches this particular inbound packet. 726 * XXX slow 727 */ 728 struct secpolicy * 729 key_gettunnel(const struct sockaddr *osrc, 730 const struct sockaddr *odst, 731 const struct sockaddr *isrc, 732 const struct sockaddr *idst, 733 const char* where, int tag) 734 { 735 struct secpolicy *sp; 736 const int dir = IPSEC_DIR_INBOUND; 737 struct ipsecrequest *r1, *r2, *p; 738 struct secpolicyindex spidx; 739 740 KEYDEBUG(KEYDEBUG_IPSEC_STAMP, 741 printf("DP %s from %s:%u\n", __func__, where, tag)); 742 743 if (isrc->sa_family != idst->sa_family) { 744 ipseclog((LOG_ERR, "%s: protocol family mismatched %d != %d\n.", 745 __func__, isrc->sa_family, idst->sa_family)); 746 sp = NULL; 747 goto done; 748 } 749 750 SPTREE_LOCK(); 751 LIST_FOREACH(sp, &V_sptree[dir], chain) { 752 if (sp->state == IPSEC_SPSTATE_DEAD) 753 continue; 754 755 r1 = r2 = NULL; 756 for (p = sp->req; p; p = p->next) { 757 if (p->saidx.mode != IPSEC_MODE_TUNNEL) 758 continue; 759 760 r1 = r2; 761 r2 = p; 762 763 if (!r1) { 764 /* here we look at address matches only */ 765 spidx = sp->spidx; 766 if (isrc->sa_len > sizeof(spidx.src) || 767 idst->sa_len > sizeof(spidx.dst)) 768 continue; 769 bcopy(isrc, &spidx.src, isrc->sa_len); 770 bcopy(idst, &spidx.dst, idst->sa_len); 771 if (!key_cmpspidx_withmask(&sp->spidx, &spidx)) 772 continue; 773 } else { 774 if (key_sockaddrcmp(&r1->saidx.src.sa, isrc, 0) || 775 key_sockaddrcmp(&r1->saidx.dst.sa, idst, 0)) 776 continue; 777 } 778 779 if (key_sockaddrcmp(&r2->saidx.src.sa, osrc, 0) || 780 key_sockaddrcmp(&r2->saidx.dst.sa, odst, 0)) 781 continue; 782 783 goto found; 784 } 785 } 786 sp = NULL; 787 found: 788 if (sp) { 789 sp->lastused = time_second; 790 SP_ADDREF(sp); 791 } 792 SPTREE_UNLOCK(); 793 done: 794 KEYDEBUG(KEYDEBUG_IPSEC_STAMP, 795 printf("DP %s return SP:%p (ID=%u) refcnt %u\n", __func__, 796 sp, sp ? sp->id : 0, sp ? sp->refcnt : 0)); 797 return sp; 798 } 799 #endif 800 801 /* 802 * allocating an SA entry for an *OUTBOUND* packet. 803 * checking each request entries in SP, and acquire an SA if need. 804 * OUT: 0: there are valid requests. 805 * ENOENT: policy may be valid, but SA with REQUIRE is on acquiring. 806 */ 807 int 808 key_checkrequest(struct ipsecrequest *isr, const struct secasindex *saidx) 809 { 810 u_int level; 811 int error; 812 struct secasvar *sav; 813 814 IPSEC_ASSERT(isr != NULL, ("null isr")); 815 IPSEC_ASSERT(saidx != NULL, ("null saidx")); 816 IPSEC_ASSERT(saidx->mode == IPSEC_MODE_TRANSPORT || 817 saidx->mode == IPSEC_MODE_TUNNEL, 818 ("unexpected policy %u", saidx->mode)); 819 820 /* 821 * XXX guard against protocol callbacks from the crypto 822 * thread as they reference ipsecrequest.sav which we 823 * temporarily null out below. Need to rethink how we 824 * handle bundled SA's in the callback thread. 825 */ 826 IPSECREQUEST_LOCK_ASSERT(isr); 827 828 /* get current level */ 829 level = ipsec_get_reqlevel(isr); 830 831 /* 832 * We check new SA in the IPsec request because a different 833 * SA may be involved each time this request is checked, either 834 * because new SAs are being configured, or this request is 835 * associated with an unconnected datagram socket, or this request 836 * is associated with a system default policy. 837 * 838 * key_allocsa_policy should allocate the oldest SA available. 839 * See key_do_allocsa_policy(), and draft-jenkins-ipsec-rekeying-03.txt. 840 */ 841 sav = key_allocsa_policy(saidx); 842 if (sav != isr->sav) { 843 /* SA need to be updated. */ 844 if (!IPSECREQUEST_UPGRADE(isr)) { 845 /* Kick everyone off. */ 846 IPSECREQUEST_UNLOCK(isr); 847 IPSECREQUEST_WLOCK(isr); 848 } 849 if (isr->sav != NULL) 850 KEY_FREESAV(&isr->sav); 851 isr->sav = sav; 852 IPSECREQUEST_DOWNGRADE(isr); 853 } else if (sav != NULL) 854 KEY_FREESAV(&sav); 855 856 /* When there is SA. */ 857 if (isr->sav != NULL) { 858 if (isr->sav->state != SADB_SASTATE_MATURE && 859 isr->sav->state != SADB_SASTATE_DYING) 860 return EINVAL; 861 return 0; 862 } 863 864 /* there is no SA */ 865 error = key_acquire(saidx, isr->sp); 866 if (error != 0) { 867 /* XXX What should I do ? */ 868 ipseclog((LOG_DEBUG, "%s: error %d returned from key_acquire\n", 869 __func__, error)); 870 return error; 871 } 872 873 if (level != IPSEC_LEVEL_REQUIRE) { 874 /* XXX sigh, the interface to this routine is botched */ 875 IPSEC_ASSERT(isr->sav == NULL, ("unexpected SA")); 876 return 0; 877 } else { 878 return ENOENT; 879 } 880 } 881 882 /* 883 * allocating a SA for policy entry from SAD. 884 * NOTE: searching SAD of aliving state. 885 * OUT: NULL: not found. 886 * others: found and return the pointer. 887 */ 888 static struct secasvar * 889 key_allocsa_policy(const struct secasindex *saidx) 890 { 891 #define N(a) _ARRAYLEN(a) 892 struct secashead *sah; 893 struct secasvar *sav; 894 u_int stateidx, arraysize; 895 const u_int *state_valid; 896 897 state_valid = NULL; /* silence gcc */ 898 arraysize = 0; /* silence gcc */ 899 900 SAHTREE_LOCK(); 901 LIST_FOREACH(sah, &V_sahtree, chain) { 902 if (sah->state == SADB_SASTATE_DEAD) 903 continue; 904 if (key_cmpsaidx(&sah->saidx, saidx, CMP_MODE_REQID)) { 905 if (V_key_preferred_oldsa) { 906 state_valid = saorder_state_valid_prefer_old; 907 arraysize = N(saorder_state_valid_prefer_old); 908 } else { 909 state_valid = saorder_state_valid_prefer_new; 910 arraysize = N(saorder_state_valid_prefer_new); 911 } 912 break; 913 } 914 } 915 SAHTREE_UNLOCK(); 916 if (sah == NULL) 917 return NULL; 918 919 /* search valid state */ 920 for (stateidx = 0; stateidx < arraysize; stateidx++) { 921 sav = key_do_allocsa_policy(sah, state_valid[stateidx]); 922 if (sav != NULL) 923 return sav; 924 } 925 926 return NULL; 927 #undef N 928 } 929 930 /* 931 * searching SAD with direction, protocol, mode and state. 932 * called by key_allocsa_policy(). 933 * OUT: 934 * NULL : not found 935 * others : found, pointer to a SA. 936 */ 937 static struct secasvar * 938 key_do_allocsa_policy(struct secashead *sah, u_int state) 939 { 940 struct secasvar *sav, *nextsav, *candidate, *d; 941 942 /* initialize */ 943 candidate = NULL; 944 945 SAHTREE_LOCK(); 946 for (sav = LIST_FIRST(&sah->savtree[state]); 947 sav != NULL; 948 sav = nextsav) { 949 950 nextsav = LIST_NEXT(sav, chain); 951 952 /* sanity check */ 953 KEY_CHKSASTATE(sav->state, state, __func__); 954 955 /* initialize */ 956 if (candidate == NULL) { 957 candidate = sav; 958 continue; 959 } 960 961 /* Which SA is the better ? */ 962 963 IPSEC_ASSERT(candidate->lft_c != NULL, 964 ("null candidate lifetime")); 965 IPSEC_ASSERT(sav->lft_c != NULL, ("null sav lifetime")); 966 967 /* What the best method is to compare ? */ 968 if (V_key_preferred_oldsa) { 969 if (candidate->lft_c->addtime > 970 sav->lft_c->addtime) { 971 candidate = sav; 972 } 973 continue; 974 /*NOTREACHED*/ 975 } 976 977 /* preferred new sa rather than old sa */ 978 if (candidate->lft_c->addtime < 979 sav->lft_c->addtime) { 980 d = candidate; 981 candidate = sav; 982 } else 983 d = sav; 984 985 /* 986 * prepared to delete the SA when there is more 987 * suitable candidate and the lifetime of the SA is not 988 * permanent. 989 */ 990 if (d->lft_h->addtime != 0) { 991 struct mbuf *m, *result; 992 u_int8_t satype; 993 994 key_sa_chgstate(d, SADB_SASTATE_DEAD); 995 996 IPSEC_ASSERT(d->refcnt > 0, ("bogus ref count")); 997 998 satype = key_proto2satype(d->sah->saidx.proto); 999 if (satype == 0) 1000 goto msgfail; 1001 1002 m = key_setsadbmsg(SADB_DELETE, 0, 1003 satype, 0, 0, d->refcnt - 1); 1004 if (!m) 1005 goto msgfail; 1006 result = m; 1007 1008 /* set sadb_address for saidx's. */ 1009 m = key_setsadbaddr(SADB_EXT_ADDRESS_SRC, 1010 &d->sah->saidx.src.sa, 1011 d->sah->saidx.src.sa.sa_len << 3, 1012 IPSEC_ULPROTO_ANY); 1013 if (!m) 1014 goto msgfail; 1015 m_cat(result, m); 1016 1017 /* set sadb_address for saidx's. */ 1018 m = key_setsadbaddr(SADB_EXT_ADDRESS_DST, 1019 &d->sah->saidx.dst.sa, 1020 d->sah->saidx.dst.sa.sa_len << 3, 1021 IPSEC_ULPROTO_ANY); 1022 if (!m) 1023 goto msgfail; 1024 m_cat(result, m); 1025 1026 /* create SA extension */ 1027 m = key_setsadbsa(d); 1028 if (!m) 1029 goto msgfail; 1030 m_cat(result, m); 1031 1032 if (result->m_len < sizeof(struct sadb_msg)) { 1033 result = m_pullup(result, 1034 sizeof(struct sadb_msg)); 1035 if (result == NULL) 1036 goto msgfail; 1037 } 1038 1039 result->m_pkthdr.len = 0; 1040 for (m = result; m; m = m->m_next) 1041 result->m_pkthdr.len += m->m_len; 1042 mtod(result, struct sadb_msg *)->sadb_msg_len = 1043 PFKEY_UNIT64(result->m_pkthdr.len); 1044 1045 if (key_sendup_mbuf(NULL, result, 1046 KEY_SENDUP_REGISTERED)) 1047 goto msgfail; 1048 msgfail: 1049 KEY_FREESAV(&d); 1050 } 1051 } 1052 if (candidate) { 1053 sa_addref(candidate); 1054 KEYDEBUG(KEYDEBUG_IPSEC_STAMP, 1055 printf("DP %s cause refcnt++:%d SA:%p\n", 1056 __func__, candidate->refcnt, candidate)); 1057 } 1058 SAHTREE_UNLOCK(); 1059 1060 return candidate; 1061 } 1062 1063 /* 1064 * allocating a usable SA entry for a *INBOUND* packet. 1065 * Must call key_freesav() later. 1066 * OUT: positive: pointer to a usable sav (i.e. MATURE or DYING state). 1067 * NULL: not found, or error occurred. 1068 * 1069 * In the comparison, no source address is used--for RFC2401 conformance. 1070 * To quote, from section 4.1: 1071 * A security association is uniquely identified by a triple consisting 1072 * of a Security Parameter Index (SPI), an IP Destination Address, and a 1073 * security protocol (AH or ESP) identifier. 1074 * Note that, however, we do need to keep source address in IPsec SA. 1075 * IKE specification and PF_KEY specification do assume that we 1076 * keep source address in IPsec SA. We see a tricky situation here. 1077 */ 1078 struct secasvar * 1079 key_allocsa(union sockaddr_union *dst, u_int proto, u_int32_t spi, 1080 const char* where, int tag) 1081 { 1082 struct secashead *sah; 1083 struct secasvar *sav; 1084 u_int stateidx, arraysize, state; 1085 const u_int *saorder_state_valid; 1086 #ifdef IPSEC_NAT_T 1087 int natt_chkport; 1088 #endif 1089 1090 IPSEC_ASSERT(dst != NULL, ("null dst address")); 1091 1092 KEYDEBUG(KEYDEBUG_IPSEC_STAMP, 1093 printf("DP %s from %s:%u\n", __func__, where, tag)); 1094 1095 #ifdef IPSEC_NAT_T 1096 natt_chkport = (dst->sa.sa_family == AF_INET && 1097 dst->sa.sa_len == sizeof(struct sockaddr_in) && 1098 dst->sin.sin_port != 0); 1099 #endif 1100 1101 /* 1102 * searching SAD. 1103 * XXX: to be checked internal IP header somewhere. Also when 1104 * IPsec tunnel packet is received. But ESP tunnel mode is 1105 * encrypted so we can't check internal IP header. 1106 */ 1107 SAHTREE_LOCK(); 1108 if (V_key_preferred_oldsa) { 1109 saorder_state_valid = saorder_state_valid_prefer_old; 1110 arraysize = _ARRAYLEN(saorder_state_valid_prefer_old); 1111 } else { 1112 saorder_state_valid = saorder_state_valid_prefer_new; 1113 arraysize = _ARRAYLEN(saorder_state_valid_prefer_new); 1114 } 1115 LIST_FOREACH(sah, &V_sahtree, chain) { 1116 int checkport; 1117 1118 /* search valid state */ 1119 for (stateidx = 0; stateidx < arraysize; stateidx++) { 1120 state = saorder_state_valid[stateidx]; 1121 LIST_FOREACH(sav, &sah->savtree[state], chain) { 1122 /* sanity check */ 1123 KEY_CHKSASTATE(sav->state, state, __func__); 1124 /* do not return entries w/ unusable state */ 1125 if (sav->state != SADB_SASTATE_MATURE && 1126 sav->state != SADB_SASTATE_DYING) 1127 continue; 1128 if (proto != sav->sah->saidx.proto) 1129 continue; 1130 if (spi != sav->spi) 1131 continue; 1132 checkport = 0; 1133 #ifdef IPSEC_NAT_T 1134 /* 1135 * Really only check ports when this is a NAT-T 1136 * SA. Otherwise other lookups providing ports 1137 * might suffer. 1138 */ 1139 if (sav->natt_type && natt_chkport) 1140 checkport = 1; 1141 #endif 1142 #if 0 /* don't check src */ 1143 /* check src address */ 1144 if (key_sockaddrcmp(&src->sa, 1145 &sav->sah->saidx.src.sa, checkport) != 0) 1146 continue; 1147 #endif 1148 /* check dst address */ 1149 if (key_sockaddrcmp(&dst->sa, 1150 &sav->sah->saidx.dst.sa, checkport) != 0) 1151 continue; 1152 sa_addref(sav); 1153 goto done; 1154 } 1155 } 1156 } 1157 sav = NULL; 1158 done: 1159 SAHTREE_UNLOCK(); 1160 1161 KEYDEBUG(KEYDEBUG_IPSEC_STAMP, 1162 printf("DP %s return SA:%p; refcnt %u\n", __func__, 1163 sav, sav ? sav->refcnt : 0)); 1164 return sav; 1165 } 1166 1167 struct secasvar * 1168 key_allocsa_tunnel(union sockaddr_union *src, union sockaddr_union *dst, 1169 u_int proto, const char* where, int tag) 1170 { 1171 struct secashead *sah; 1172 struct secasvar *sav; 1173 u_int stateidx, arraysize, state; 1174 const u_int *saorder_state_valid; 1175 1176 IPSEC_ASSERT(src != NULL, ("null src address")); 1177 IPSEC_ASSERT(dst != NULL, ("null dst address")); 1178 KEYDEBUG(KEYDEBUG_IPSEC_STAMP, 1179 printf("DP %s from %s:%u\n", __func__, where, tag)); 1180 1181 SAHTREE_LOCK(); 1182 if (V_key_preferred_oldsa) { 1183 saorder_state_valid = saorder_state_valid_prefer_old; 1184 arraysize = _ARRAYLEN(saorder_state_valid_prefer_old); 1185 } else { 1186 saorder_state_valid = saorder_state_valid_prefer_new; 1187 arraysize = _ARRAYLEN(saorder_state_valid_prefer_new); 1188 } 1189 LIST_FOREACH(sah, &V_sahtree, chain) { 1190 /* search valid state */ 1191 for (stateidx = 0; stateidx < arraysize; stateidx++) { 1192 state = saorder_state_valid[stateidx]; 1193 LIST_FOREACH(sav, &sah->savtree[state], chain) { 1194 /* sanity check */ 1195 KEY_CHKSASTATE(sav->state, state, __func__); 1196 /* do not return entries w/ unusable state */ 1197 if (sav->state != SADB_SASTATE_MATURE && 1198 sav->state != SADB_SASTATE_DYING) 1199 continue; 1200 if (IPSEC_MODE_TUNNEL != sav->sah->saidx.mode) 1201 continue; 1202 if (proto != sav->sah->saidx.proto) 1203 continue; 1204 /* check src address */ 1205 if (key_sockaddrcmp(&src->sa, 1206 &sav->sah->saidx.src.sa, 0) != 0) 1207 continue; 1208 /* check dst address */ 1209 if (key_sockaddrcmp(&dst->sa, 1210 &sav->sah->saidx.dst.sa, 0) != 0) 1211 continue; 1212 sa_addref(sav); 1213 goto done; 1214 } 1215 } 1216 } 1217 sav = NULL; 1218 done: 1219 SAHTREE_UNLOCK(); 1220 1221 KEYDEBUG(KEYDEBUG_IPSEC_STAMP, 1222 printf("DP %s return SA:%p; refcnt %u\n", __func__, 1223 sav, sav ? sav->refcnt : 0)); 1224 return (sav); 1225 } 1226 1227 /* 1228 * Must be called after calling key_allocsp(). 1229 * For both the packet without socket and key_freeso(). 1230 */ 1231 void 1232 _key_freesp(struct secpolicy **spp, const char* where, int tag) 1233 { 1234 struct ipsecrequest *isr, *nextisr; 1235 struct secpolicy *sp = *spp; 1236 1237 IPSEC_ASSERT(sp != NULL, ("null sp")); 1238 KEYDEBUG(KEYDEBUG_IPSEC_STAMP, 1239 printf("DP %s SP:%p (ID=%u) from %s:%u; refcnt now %u\n", 1240 __func__, sp, sp->id, where, tag, sp->refcnt)); 1241 1242 if (SP_DELREF(sp) == 0) 1243 return; 1244 *spp = NULL; 1245 for (isr = sp->req; isr != NULL; isr = nextisr) { 1246 if (isr->sav != NULL) { 1247 KEY_FREESAV(&isr->sav); 1248 isr->sav = NULL; 1249 } 1250 nextisr = isr->next; 1251 ipsec_delisr(isr); 1252 } 1253 free(sp, M_IPSEC_SP); 1254 } 1255 1256 static void 1257 key_unlink(struct secpolicy *sp) 1258 { 1259 1260 IPSEC_ASSERT(sp != NULL, ("null sp")); 1261 IPSEC_ASSERT(sp->spidx.dir == IPSEC_DIR_INBOUND || 1262 sp->spidx.dir == IPSEC_DIR_OUTBOUND, 1263 ("invalid direction %u", sp->spidx.dir)); 1264 SPTREE_UNLOCK_ASSERT(); 1265 1266 SPTREE_WLOCK(); 1267 if (sp->state == IPSEC_SPSTATE_DEAD) { 1268 SPTREE_WUNLOCK(); 1269 return; 1270 } 1271 sp->state = IPSEC_SPSTATE_DEAD; 1272 TAILQ_REMOVE(&V_sptree[sp->spidx.dir], sp, chain); 1273 SPTREE_WUNLOCK(); 1274 KEY_FREESP(&sp); 1275 } 1276 1277 /* 1278 * insert a secpolicy into the SP database. Lower priorities first 1279 */ 1280 static void 1281 key_insertsp(struct secpolicy *newsp) 1282 { 1283 struct secpolicy *sp; 1284 1285 SPTREE_WLOCK(); 1286 TAILQ_FOREACH(sp, &V_sptree[newsp->spidx.dir], chain) { 1287 if (newsp->priority < sp->priority) { 1288 TAILQ_INSERT_BEFORE(sp, newsp, chain); 1289 goto done; 1290 } 1291 } 1292 1293 TAILQ_INSERT_TAIL(&V_sptree[newsp->spidx.dir], newsp, chain); 1294 1295 done: 1296 newsp->state = IPSEC_SPSTATE_ALIVE; 1297 SPTREE_WUNLOCK(); 1298 } 1299 1300 /* 1301 * Must be called after calling key_allocsp(). 1302 * For the packet with socket. 1303 */ 1304 void 1305 key_freeso(struct socket *so) 1306 { 1307 IPSEC_ASSERT(so != NULL, ("null so")); 1308 1309 switch (so->so_proto->pr_domain->dom_family) { 1310 #if defined(INET) || defined(INET6) 1311 #ifdef INET 1312 case PF_INET: 1313 #endif 1314 #ifdef INET6 1315 case PF_INET6: 1316 #endif 1317 { 1318 struct inpcb *pcb = sotoinpcb(so); 1319 1320 /* Does it have a PCB ? */ 1321 if (pcb == NULL) 1322 return; 1323 key_freesp_so(&pcb->inp_sp->sp_in); 1324 key_freesp_so(&pcb->inp_sp->sp_out); 1325 } 1326 break; 1327 #endif /* INET || INET6 */ 1328 default: 1329 ipseclog((LOG_DEBUG, "%s: unknown address family=%d.\n", 1330 __func__, so->so_proto->pr_domain->dom_family)); 1331 return; 1332 } 1333 } 1334 1335 static void 1336 key_freesp_so(struct secpolicy **sp) 1337 { 1338 IPSEC_ASSERT(sp != NULL && *sp != NULL, ("null sp")); 1339 1340 if ((*sp)->policy == IPSEC_POLICY_ENTRUST || 1341 (*sp)->policy == IPSEC_POLICY_BYPASS) 1342 return; 1343 1344 IPSEC_ASSERT((*sp)->policy == IPSEC_POLICY_IPSEC, 1345 ("invalid policy %u", (*sp)->policy)); 1346 KEY_FREESP(sp); 1347 } 1348 1349 void 1350 key_addrefsa(struct secasvar *sav, const char* where, int tag) 1351 { 1352 1353 IPSEC_ASSERT(sav != NULL, ("null sav")); 1354 IPSEC_ASSERT(sav->refcnt > 0, ("refcount must exist")); 1355 1356 sa_addref(sav); 1357 } 1358 1359 /* 1360 * Must be called after calling key_allocsa(). 1361 * This function is called by key_freesp() to free some SA allocated 1362 * for a policy. 1363 */ 1364 void 1365 key_freesav(struct secasvar **psav, const char* where, int tag) 1366 { 1367 struct secasvar *sav = *psav; 1368 1369 IPSEC_ASSERT(sav != NULL, ("null sav")); 1370 1371 if (sa_delref(sav)) { 1372 KEYDEBUG(KEYDEBUG_IPSEC_STAMP, 1373 printf("DP %s SA:%p (SPI %u) from %s:%u; refcnt now %u\n", 1374 __func__, sav, ntohl(sav->spi), where, tag, sav->refcnt)); 1375 *psav = NULL; 1376 key_delsav(sav); 1377 } else { 1378 KEYDEBUG(KEYDEBUG_IPSEC_STAMP, 1379 printf("DP %s SA:%p (SPI %u) from %s:%u; refcnt now %u\n", 1380 __func__, sav, ntohl(sav->spi), where, tag, sav->refcnt)); 1381 } 1382 } 1383 1384 /* %%% SPD management */ 1385 /* 1386 * search SPD 1387 * OUT: NULL : not found 1388 * others : found, pointer to a SP. 1389 */ 1390 static struct secpolicy * 1391 key_getsp(struct secpolicyindex *spidx) 1392 { 1393 SPTREE_RLOCK_TRACKER; 1394 struct secpolicy *sp; 1395 1396 IPSEC_ASSERT(spidx != NULL, ("null spidx")); 1397 1398 SPTREE_RLOCK(); 1399 TAILQ_FOREACH(sp, &V_sptree[spidx->dir], chain) { 1400 if (key_cmpspidx_exactly(spidx, &sp->spidx)) { 1401 SP_ADDREF(sp); 1402 break; 1403 } 1404 } 1405 SPTREE_RUNLOCK(); 1406 1407 return sp; 1408 } 1409 1410 /* 1411 * get SP by index. 1412 * OUT: NULL : not found 1413 * others : found, pointer to a SP. 1414 */ 1415 static struct secpolicy * 1416 key_getspbyid(u_int32_t id) 1417 { 1418 SPTREE_RLOCK_TRACKER; 1419 struct secpolicy *sp; 1420 1421 SPTREE_RLOCK(); 1422 TAILQ_FOREACH(sp, &V_sptree[IPSEC_DIR_INBOUND], chain) { 1423 if (sp->id == id) { 1424 SP_ADDREF(sp); 1425 goto done; 1426 } 1427 } 1428 1429 TAILQ_FOREACH(sp, &V_sptree[IPSEC_DIR_OUTBOUND], chain) { 1430 if (sp->id == id) { 1431 SP_ADDREF(sp); 1432 goto done; 1433 } 1434 } 1435 done: 1436 SPTREE_RUNLOCK(); 1437 1438 return sp; 1439 } 1440 1441 struct secpolicy * 1442 key_newsp(const char* where, int tag) 1443 { 1444 struct secpolicy *newsp = NULL; 1445 1446 newsp = (struct secpolicy *) 1447 malloc(sizeof(struct secpolicy), M_IPSEC_SP, M_NOWAIT|M_ZERO); 1448 if (newsp) 1449 refcount_init(&newsp->refcnt, 1); 1450 1451 KEYDEBUG(KEYDEBUG_IPSEC_STAMP, 1452 printf("DP %s from %s:%u return SP:%p\n", __func__, 1453 where, tag, newsp)); 1454 return newsp; 1455 } 1456 1457 /* 1458 * create secpolicy structure from sadb_x_policy structure. 1459 * NOTE: `state', `secpolicyindex' in secpolicy structure are not set, 1460 * so must be set properly later. 1461 */ 1462 struct secpolicy * 1463 key_msg2sp(struct sadb_x_policy *xpl0, size_t len, int *error) 1464 { 1465 struct secpolicy *newsp; 1466 1467 IPSEC_ASSERT(xpl0 != NULL, ("null xpl0")); 1468 IPSEC_ASSERT(len >= sizeof(*xpl0), ("policy too short: %zu", len)); 1469 1470 if (len != PFKEY_EXTLEN(xpl0)) { 1471 ipseclog((LOG_DEBUG, "%s: Invalid msg length.\n", __func__)); 1472 *error = EINVAL; 1473 return NULL; 1474 } 1475 1476 if ((newsp = KEY_NEWSP()) == NULL) { 1477 *error = ENOBUFS; 1478 return NULL; 1479 } 1480 1481 newsp->spidx.dir = xpl0->sadb_x_policy_dir; 1482 newsp->policy = xpl0->sadb_x_policy_type; 1483 newsp->priority = xpl0->sadb_x_policy_priority; 1484 1485 /* check policy */ 1486 switch (xpl0->sadb_x_policy_type) { 1487 case IPSEC_POLICY_DISCARD: 1488 case IPSEC_POLICY_NONE: 1489 case IPSEC_POLICY_ENTRUST: 1490 case IPSEC_POLICY_BYPASS: 1491 newsp->req = NULL; 1492 break; 1493 1494 case IPSEC_POLICY_IPSEC: 1495 { 1496 int tlen; 1497 struct sadb_x_ipsecrequest *xisr; 1498 struct ipsecrequest **p_isr = &newsp->req; 1499 1500 /* validity check */ 1501 if (PFKEY_EXTLEN(xpl0) < sizeof(*xpl0)) { 1502 ipseclog((LOG_DEBUG, "%s: Invalid msg length.\n", 1503 __func__)); 1504 KEY_FREESP(&newsp); 1505 *error = EINVAL; 1506 return NULL; 1507 } 1508 1509 tlen = PFKEY_EXTLEN(xpl0) - sizeof(*xpl0); 1510 xisr = (struct sadb_x_ipsecrequest *)(xpl0 + 1); 1511 1512 while (tlen > 0) { 1513 /* length check */ 1514 if (xisr->sadb_x_ipsecrequest_len < sizeof(*xisr)) { 1515 ipseclog((LOG_DEBUG, "%s: invalid ipsecrequest " 1516 "length.\n", __func__)); 1517 KEY_FREESP(&newsp); 1518 *error = EINVAL; 1519 return NULL; 1520 } 1521 1522 /* allocate request buffer */ 1523 /* NB: data structure is zero'd */ 1524 *p_isr = ipsec_newisr(); 1525 if ((*p_isr) == NULL) { 1526 ipseclog((LOG_DEBUG, 1527 "%s: No more memory.\n", __func__)); 1528 KEY_FREESP(&newsp); 1529 *error = ENOBUFS; 1530 return NULL; 1531 } 1532 1533 /* set values */ 1534 switch (xisr->sadb_x_ipsecrequest_proto) { 1535 case IPPROTO_ESP: 1536 case IPPROTO_AH: 1537 case IPPROTO_IPCOMP: 1538 break; 1539 default: 1540 ipseclog((LOG_DEBUG, 1541 "%s: invalid proto type=%u\n", __func__, 1542 xisr->sadb_x_ipsecrequest_proto)); 1543 KEY_FREESP(&newsp); 1544 *error = EPROTONOSUPPORT; 1545 return NULL; 1546 } 1547 (*p_isr)->saidx.proto = xisr->sadb_x_ipsecrequest_proto; 1548 1549 switch (xisr->sadb_x_ipsecrequest_mode) { 1550 case IPSEC_MODE_TRANSPORT: 1551 case IPSEC_MODE_TUNNEL: 1552 break; 1553 case IPSEC_MODE_ANY: 1554 default: 1555 ipseclog((LOG_DEBUG, 1556 "%s: invalid mode=%u\n", __func__, 1557 xisr->sadb_x_ipsecrequest_mode)); 1558 KEY_FREESP(&newsp); 1559 *error = EINVAL; 1560 return NULL; 1561 } 1562 (*p_isr)->saidx.mode = xisr->sadb_x_ipsecrequest_mode; 1563 1564 switch (xisr->sadb_x_ipsecrequest_level) { 1565 case IPSEC_LEVEL_DEFAULT: 1566 case IPSEC_LEVEL_USE: 1567 case IPSEC_LEVEL_REQUIRE: 1568 break; 1569 case IPSEC_LEVEL_UNIQUE: 1570 /* validity check */ 1571 /* 1572 * If range violation of reqid, kernel will 1573 * update it, don't refuse it. 1574 */ 1575 if (xisr->sadb_x_ipsecrequest_reqid 1576 > IPSEC_MANUAL_REQID_MAX) { 1577 ipseclog((LOG_DEBUG, 1578 "%s: reqid=%d range " 1579 "violation, updated by kernel.\n", 1580 __func__, 1581 xisr->sadb_x_ipsecrequest_reqid)); 1582 xisr->sadb_x_ipsecrequest_reqid = 0; 1583 } 1584 1585 /* allocate new reqid id if reqid is zero. */ 1586 if (xisr->sadb_x_ipsecrequest_reqid == 0) { 1587 u_int32_t reqid; 1588 if ((reqid = key_newreqid()) == 0) { 1589 KEY_FREESP(&newsp); 1590 *error = ENOBUFS; 1591 return NULL; 1592 } 1593 (*p_isr)->saidx.reqid = reqid; 1594 xisr->sadb_x_ipsecrequest_reqid = reqid; 1595 } else { 1596 /* set it for manual keying. */ 1597 (*p_isr)->saidx.reqid = 1598 xisr->sadb_x_ipsecrequest_reqid; 1599 } 1600 break; 1601 1602 default: 1603 ipseclog((LOG_DEBUG, "%s: invalid level=%u\n", 1604 __func__, 1605 xisr->sadb_x_ipsecrequest_level)); 1606 KEY_FREESP(&newsp); 1607 *error = EINVAL; 1608 return NULL; 1609 } 1610 (*p_isr)->level = xisr->sadb_x_ipsecrequest_level; 1611 1612 /* set IP addresses if there */ 1613 if (xisr->sadb_x_ipsecrequest_len > sizeof(*xisr)) { 1614 struct sockaddr *paddr; 1615 1616 paddr = (struct sockaddr *)(xisr + 1); 1617 1618 /* validity check */ 1619 if (paddr->sa_len 1620 > sizeof((*p_isr)->saidx.src)) { 1621 ipseclog((LOG_DEBUG, "%s: invalid " 1622 "request address length.\n", 1623 __func__)); 1624 KEY_FREESP(&newsp); 1625 *error = EINVAL; 1626 return NULL; 1627 } 1628 bcopy(paddr, &(*p_isr)->saidx.src, 1629 paddr->sa_len); 1630 1631 paddr = (struct sockaddr *)((caddr_t)paddr 1632 + paddr->sa_len); 1633 1634 /* validity check */ 1635 if (paddr->sa_len 1636 > sizeof((*p_isr)->saidx.dst)) { 1637 ipseclog((LOG_DEBUG, "%s: invalid " 1638 "request address length.\n", 1639 __func__)); 1640 KEY_FREESP(&newsp); 1641 *error = EINVAL; 1642 return NULL; 1643 } 1644 bcopy(paddr, &(*p_isr)->saidx.dst, 1645 paddr->sa_len); 1646 } 1647 1648 (*p_isr)->sp = newsp; 1649 1650 /* initialization for the next. */ 1651 p_isr = &(*p_isr)->next; 1652 tlen -= xisr->sadb_x_ipsecrequest_len; 1653 1654 /* validity check */ 1655 if (tlen < 0) { 1656 ipseclog((LOG_DEBUG, "%s: becoming tlen < 0.\n", 1657 __func__)); 1658 KEY_FREESP(&newsp); 1659 *error = EINVAL; 1660 return NULL; 1661 } 1662 1663 xisr = (struct sadb_x_ipsecrequest *)((caddr_t)xisr 1664 + xisr->sadb_x_ipsecrequest_len); 1665 } 1666 } 1667 break; 1668 default: 1669 ipseclog((LOG_DEBUG, "%s: invalid policy type.\n", __func__)); 1670 KEY_FREESP(&newsp); 1671 *error = EINVAL; 1672 return NULL; 1673 } 1674 1675 *error = 0; 1676 return newsp; 1677 } 1678 1679 static u_int32_t 1680 key_newreqid() 1681 { 1682 static u_int32_t auto_reqid = IPSEC_MANUAL_REQID_MAX + 1; 1683 1684 auto_reqid = (auto_reqid == ~0 1685 ? IPSEC_MANUAL_REQID_MAX + 1 : auto_reqid + 1); 1686 1687 /* XXX should be unique check */ 1688 1689 return auto_reqid; 1690 } 1691 1692 /* 1693 * copy secpolicy struct to sadb_x_policy structure indicated. 1694 */ 1695 struct mbuf * 1696 key_sp2msg(struct secpolicy *sp) 1697 { 1698 struct sadb_x_policy *xpl; 1699 int tlen; 1700 caddr_t p; 1701 struct mbuf *m; 1702 1703 IPSEC_ASSERT(sp != NULL, ("null policy")); 1704 1705 tlen = key_getspreqmsglen(sp); 1706 1707 m = m_get2(tlen, M_NOWAIT, MT_DATA, 0); 1708 if (m == NULL) 1709 return (NULL); 1710 m_align(m, tlen); 1711 m->m_len = tlen; 1712 xpl = mtod(m, struct sadb_x_policy *); 1713 bzero(xpl, tlen); 1714 1715 xpl->sadb_x_policy_len = PFKEY_UNIT64(tlen); 1716 xpl->sadb_x_policy_exttype = SADB_X_EXT_POLICY; 1717 xpl->sadb_x_policy_type = sp->policy; 1718 xpl->sadb_x_policy_dir = sp->spidx.dir; 1719 xpl->sadb_x_policy_id = sp->id; 1720 xpl->sadb_x_policy_priority = sp->priority; 1721 p = (caddr_t)xpl + sizeof(*xpl); 1722 1723 /* if is the policy for ipsec ? */ 1724 if (sp->policy == IPSEC_POLICY_IPSEC) { 1725 struct sadb_x_ipsecrequest *xisr; 1726 struct ipsecrequest *isr; 1727 1728 for (isr = sp->req; isr != NULL; isr = isr->next) { 1729 1730 xisr = (struct sadb_x_ipsecrequest *)p; 1731 1732 xisr->sadb_x_ipsecrequest_proto = isr->saidx.proto; 1733 xisr->sadb_x_ipsecrequest_mode = isr->saidx.mode; 1734 xisr->sadb_x_ipsecrequest_level = isr->level; 1735 xisr->sadb_x_ipsecrequest_reqid = isr->saidx.reqid; 1736 1737 p += sizeof(*xisr); 1738 bcopy(&isr->saidx.src, p, isr->saidx.src.sa.sa_len); 1739 p += isr->saidx.src.sa.sa_len; 1740 bcopy(&isr->saidx.dst, p, isr->saidx.dst.sa.sa_len); 1741 p += isr->saidx.src.sa.sa_len; 1742 1743 xisr->sadb_x_ipsecrequest_len = 1744 PFKEY_ALIGN8(sizeof(*xisr) 1745 + isr->saidx.src.sa.sa_len 1746 + isr->saidx.dst.sa.sa_len); 1747 } 1748 } 1749 1750 return m; 1751 } 1752 1753 /* m will not be freed nor modified */ 1754 static struct mbuf * 1755 key_gather_mbuf(struct mbuf *m, const struct sadb_msghdr *mhp, 1756 int ndeep, int nitem, ...) 1757 { 1758 va_list ap; 1759 int idx; 1760 int i; 1761 struct mbuf *result = NULL, *n; 1762 int len; 1763 1764 IPSEC_ASSERT(m != NULL, ("null mbuf")); 1765 IPSEC_ASSERT(mhp != NULL, ("null msghdr")); 1766 1767 va_start(ap, nitem); 1768 for (i = 0; i < nitem; i++) { 1769 idx = va_arg(ap, int); 1770 if (idx < 0 || idx > SADB_EXT_MAX) 1771 goto fail; 1772 /* don't attempt to pull empty extension */ 1773 if (idx == SADB_EXT_RESERVED && mhp->msg == NULL) 1774 continue; 1775 if (idx != SADB_EXT_RESERVED && 1776 (mhp->ext[idx] == NULL || mhp->extlen[idx] == 0)) 1777 continue; 1778 1779 if (idx == SADB_EXT_RESERVED) { 1780 len = PFKEY_ALIGN8(sizeof(struct sadb_msg)); 1781 1782 IPSEC_ASSERT(len <= MHLEN, ("header too big %u", len)); 1783 1784 MGETHDR(n, M_NOWAIT, MT_DATA); 1785 if (!n) 1786 goto fail; 1787 n->m_len = len; 1788 n->m_next = NULL; 1789 m_copydata(m, 0, sizeof(struct sadb_msg), 1790 mtod(n, caddr_t)); 1791 } else if (i < ndeep) { 1792 len = mhp->extlen[idx]; 1793 n = m_get2(len, M_NOWAIT, MT_DATA, 0); 1794 if (n == NULL) 1795 goto fail; 1796 m_align(n, len); 1797 n->m_len = len; 1798 m_copydata(m, mhp->extoff[idx], mhp->extlen[idx], 1799 mtod(n, caddr_t)); 1800 } else { 1801 n = m_copym(m, mhp->extoff[idx], mhp->extlen[idx], 1802 M_NOWAIT); 1803 } 1804 if (n == NULL) 1805 goto fail; 1806 1807 if (result) 1808 m_cat(result, n); 1809 else 1810 result = n; 1811 } 1812 va_end(ap); 1813 1814 if ((result->m_flags & M_PKTHDR) != 0) { 1815 result->m_pkthdr.len = 0; 1816 for (n = result; n; n = n->m_next) 1817 result->m_pkthdr.len += n->m_len; 1818 } 1819 1820 return result; 1821 1822 fail: 1823 m_freem(result); 1824 va_end(ap); 1825 return NULL; 1826 } 1827 1828 /* 1829 * SADB_X_SPDADD, SADB_X_SPDSETIDX or SADB_X_SPDUPDATE processing 1830 * add an entry to SP database, when received 1831 * <base, address(SD), (lifetime(H),) policy> 1832 * from the user(?). 1833 * Adding to SP database, 1834 * and send 1835 * <base, address(SD), (lifetime(H),) policy> 1836 * to the socket which was send. 1837 * 1838 * SPDADD set a unique policy entry. 1839 * SPDSETIDX like SPDADD without a part of policy requests. 1840 * SPDUPDATE replace a unique policy entry. 1841 * 1842 * m will always be freed. 1843 */ 1844 static int 1845 key_spdadd(struct socket *so, struct mbuf *m, const struct sadb_msghdr *mhp) 1846 { 1847 struct sadb_address *src0, *dst0; 1848 struct sadb_x_policy *xpl0, *xpl; 1849 struct sadb_lifetime *lft = NULL; 1850 struct secpolicyindex spidx; 1851 struct secpolicy *newsp; 1852 int error; 1853 1854 IPSEC_ASSERT(so != NULL, ("null socket")); 1855 IPSEC_ASSERT(m != NULL, ("null mbuf")); 1856 IPSEC_ASSERT(mhp != NULL, ("null msghdr")); 1857 IPSEC_ASSERT(mhp->msg != NULL, ("null msg")); 1858 1859 if (mhp->ext[SADB_EXT_ADDRESS_SRC] == NULL || 1860 mhp->ext[SADB_EXT_ADDRESS_DST] == NULL || 1861 mhp->ext[SADB_X_EXT_POLICY] == NULL) { 1862 ipseclog((LOG_DEBUG, "key_spdadd: invalid message is passed.\n")); 1863 return key_senderror(so, m, EINVAL); 1864 } 1865 if (mhp->extlen[SADB_EXT_ADDRESS_SRC] < sizeof(struct sadb_address) || 1866 mhp->extlen[SADB_EXT_ADDRESS_DST] < sizeof(struct sadb_address) || 1867 mhp->extlen[SADB_X_EXT_POLICY] < sizeof(struct sadb_x_policy)) { 1868 ipseclog((LOG_DEBUG, "%s: invalid message is passed.\n", 1869 __func__)); 1870 return key_senderror(so, m, EINVAL); 1871 } 1872 if (mhp->ext[SADB_EXT_LIFETIME_HARD] != NULL) { 1873 if (mhp->extlen[SADB_EXT_LIFETIME_HARD] 1874 < sizeof(struct sadb_lifetime)) { 1875 ipseclog((LOG_DEBUG, "%s: invalid message is passed.\n", 1876 __func__)); 1877 return key_senderror(so, m, EINVAL); 1878 } 1879 lft = (struct sadb_lifetime *)mhp->ext[SADB_EXT_LIFETIME_HARD]; 1880 } 1881 1882 src0 = (struct sadb_address *)mhp->ext[SADB_EXT_ADDRESS_SRC]; 1883 dst0 = (struct sadb_address *)mhp->ext[SADB_EXT_ADDRESS_DST]; 1884 xpl0 = (struct sadb_x_policy *)mhp->ext[SADB_X_EXT_POLICY]; 1885 1886 /* 1887 * Note: do not parse SADB_X_EXT_NAT_T_* here: 1888 * we are processing traffic endpoints. 1889 */ 1890 1891 /* make secindex */ 1892 /* XXX boundary check against sa_len */ 1893 KEY_SETSECSPIDX(xpl0->sadb_x_policy_dir, 1894 src0 + 1, 1895 dst0 + 1, 1896 src0->sadb_address_prefixlen, 1897 dst0->sadb_address_prefixlen, 1898 src0->sadb_address_proto, 1899 &spidx); 1900 1901 /* checking the direciton. */ 1902 switch (xpl0->sadb_x_policy_dir) { 1903 case IPSEC_DIR_INBOUND: 1904 case IPSEC_DIR_OUTBOUND: 1905 break; 1906 default: 1907 ipseclog((LOG_DEBUG, "%s: Invalid SP direction.\n", __func__)); 1908 mhp->msg->sadb_msg_errno = EINVAL; 1909 return 0; 1910 } 1911 1912 /* check policy */ 1913 /* key_spdadd() accepts DISCARD, NONE and IPSEC. */ 1914 if (xpl0->sadb_x_policy_type == IPSEC_POLICY_ENTRUST 1915 || xpl0->sadb_x_policy_type == IPSEC_POLICY_BYPASS) { 1916 ipseclog((LOG_DEBUG, "%s: Invalid policy type.\n", __func__)); 1917 return key_senderror(so, m, EINVAL); 1918 } 1919 1920 /* policy requests are mandatory when action is ipsec. */ 1921 if (mhp->msg->sadb_msg_type != SADB_X_SPDSETIDX 1922 && xpl0->sadb_x_policy_type == IPSEC_POLICY_IPSEC 1923 && mhp->extlen[SADB_X_EXT_POLICY] <= sizeof(*xpl0)) { 1924 ipseclog((LOG_DEBUG, "%s: some policy requests part required\n", 1925 __func__)); 1926 return key_senderror(so, m, EINVAL); 1927 } 1928 1929 /* 1930 * checking there is SP already or not. 1931 * SPDUPDATE doesn't depend on whether there is a SP or not. 1932 * If the type is either SPDADD or SPDSETIDX AND a SP is found, 1933 * then error. 1934 */ 1935 newsp = key_getsp(&spidx); 1936 if (mhp->msg->sadb_msg_type == SADB_X_SPDUPDATE) { 1937 if (newsp) { 1938 key_unlink(newsp); 1939 KEY_FREESP(&newsp); 1940 } 1941 } else { 1942 if (newsp != NULL) { 1943 KEY_FREESP(&newsp); 1944 ipseclog((LOG_DEBUG, "%s: a SP entry exists already.\n", 1945 __func__)); 1946 return key_senderror(so, m, EEXIST); 1947 } 1948 } 1949 1950 /* XXX: there is race between key_getsp and key_msg2sp. */ 1951 1952 /* allocation new SP entry */ 1953 if ((newsp = key_msg2sp(xpl0, PFKEY_EXTLEN(xpl0), &error)) == NULL) { 1954 return key_senderror(so, m, error); 1955 } 1956 1957 if ((newsp->id = key_getnewspid()) == 0) { 1958 KEY_FREESP(&newsp); 1959 return key_senderror(so, m, ENOBUFS); 1960 } 1961 1962 /* XXX boundary check against sa_len */ 1963 KEY_SETSECSPIDX(xpl0->sadb_x_policy_dir, 1964 src0 + 1, 1965 dst0 + 1, 1966 src0->sadb_address_prefixlen, 1967 dst0->sadb_address_prefixlen, 1968 src0->sadb_address_proto, 1969 &newsp->spidx); 1970 1971 /* sanity check on addr pair */ 1972 if (((struct sockaddr *)(src0 + 1))->sa_family != 1973 ((struct sockaddr *)(dst0+ 1))->sa_family) { 1974 KEY_FREESP(&newsp); 1975 return key_senderror(so, m, EINVAL); 1976 } 1977 if (((struct sockaddr *)(src0 + 1))->sa_len != 1978 ((struct sockaddr *)(dst0+ 1))->sa_len) { 1979 KEY_FREESP(&newsp); 1980 return key_senderror(so, m, EINVAL); 1981 } 1982 #if 1 1983 if (newsp->req && newsp->req->saidx.src.sa.sa_family && 1984 newsp->req->saidx.dst.sa.sa_family) { 1985 if (newsp->req->saidx.src.sa.sa_family != 1986 newsp->req->saidx.dst.sa.sa_family) { 1987 KEY_FREESP(&newsp); 1988 return key_senderror(so, m, EINVAL); 1989 } 1990 } 1991 #endif 1992 1993 newsp->created = time_second; 1994 newsp->lastused = newsp->created; 1995 newsp->lifetime = lft ? lft->sadb_lifetime_addtime : 0; 1996 newsp->validtime = lft ? lft->sadb_lifetime_usetime : 0; 1997 1998 key_insertsp(newsp); 1999 2000 /* delete the entry in spacqtree */ 2001 if (mhp->msg->sadb_msg_type == SADB_X_SPDUPDATE) { 2002 struct secspacq *spacq = key_getspacq(&spidx); 2003 if (spacq != NULL) { 2004 /* reset counter in order to deletion by timehandler. */ 2005 spacq->created = time_second; 2006 spacq->count = 0; 2007 SPACQ_UNLOCK(); 2008 } 2009 } 2010 2011 { 2012 struct mbuf *n, *mpolicy; 2013 struct sadb_msg *newmsg; 2014 int off; 2015 2016 /* 2017 * Note: do not send SADB_X_EXT_NAT_T_* here: 2018 * we are sending traffic endpoints. 2019 */ 2020 2021 /* create new sadb_msg to reply. */ 2022 if (lft) { 2023 n = key_gather_mbuf(m, mhp, 2, 5, SADB_EXT_RESERVED, 2024 SADB_X_EXT_POLICY, SADB_EXT_LIFETIME_HARD, 2025 SADB_EXT_ADDRESS_SRC, SADB_EXT_ADDRESS_DST); 2026 } else { 2027 n = key_gather_mbuf(m, mhp, 2, 4, SADB_EXT_RESERVED, 2028 SADB_X_EXT_POLICY, 2029 SADB_EXT_ADDRESS_SRC, SADB_EXT_ADDRESS_DST); 2030 } 2031 if (!n) 2032 return key_senderror(so, m, ENOBUFS); 2033 2034 if (n->m_len < sizeof(*newmsg)) { 2035 n = m_pullup(n, sizeof(*newmsg)); 2036 if (!n) 2037 return key_senderror(so, m, ENOBUFS); 2038 } 2039 newmsg = mtod(n, struct sadb_msg *); 2040 newmsg->sadb_msg_errno = 0; 2041 newmsg->sadb_msg_len = PFKEY_UNIT64(n->m_pkthdr.len); 2042 2043 off = 0; 2044 mpolicy = m_pulldown(n, PFKEY_ALIGN8(sizeof(struct sadb_msg)), 2045 sizeof(*xpl), &off); 2046 if (mpolicy == NULL) { 2047 /* n is already freed */ 2048 return key_senderror(so, m, ENOBUFS); 2049 } 2050 xpl = (struct sadb_x_policy *)(mtod(mpolicy, caddr_t) + off); 2051 if (xpl->sadb_x_policy_exttype != SADB_X_EXT_POLICY) { 2052 m_freem(n); 2053 return key_senderror(so, m, EINVAL); 2054 } 2055 xpl->sadb_x_policy_id = newsp->id; 2056 2057 m_freem(m); 2058 return key_sendup_mbuf(so, n, KEY_SENDUP_ALL); 2059 } 2060 } 2061 2062 /* 2063 * get new policy id. 2064 * OUT: 2065 * 0: failure. 2066 * others: success. 2067 */ 2068 static u_int32_t 2069 key_getnewspid() 2070 { 2071 u_int32_t newid = 0; 2072 int count = V_key_spi_trycnt; /* XXX */ 2073 struct secpolicy *sp; 2074 2075 /* when requesting to allocate spi ranged */ 2076 while (count--) { 2077 newid = (V_policy_id = (V_policy_id == ~0 ? 1 : V_policy_id + 1)); 2078 2079 if ((sp = key_getspbyid(newid)) == NULL) 2080 break; 2081 2082 KEY_FREESP(&sp); 2083 } 2084 2085 if (count == 0 || newid == 0) { 2086 ipseclog((LOG_DEBUG, "%s: to allocate policy id is failed.\n", 2087 __func__)); 2088 return 0; 2089 } 2090 2091 return newid; 2092 } 2093 2094 /* 2095 * SADB_SPDDELETE processing 2096 * receive 2097 * <base, address(SD), policy(*)> 2098 * from the user(?), and set SADB_SASTATE_DEAD, 2099 * and send, 2100 * <base, address(SD), policy(*)> 2101 * to the ikmpd. 2102 * policy(*) including direction of policy. 2103 * 2104 * m will always be freed. 2105 */ 2106 static int 2107 key_spddelete(struct socket *so, struct mbuf *m, 2108 const struct sadb_msghdr *mhp) 2109 { 2110 struct sadb_address *src0, *dst0; 2111 struct sadb_x_policy *xpl0; 2112 struct secpolicyindex spidx; 2113 struct secpolicy *sp; 2114 2115 IPSEC_ASSERT(so != NULL, ("null so")); 2116 IPSEC_ASSERT(m != NULL, ("null mbuf")); 2117 IPSEC_ASSERT(mhp != NULL, ("null msghdr")); 2118 IPSEC_ASSERT(mhp->msg != NULL, ("null msg")); 2119 2120 if (mhp->ext[SADB_EXT_ADDRESS_SRC] == NULL || 2121 mhp->ext[SADB_EXT_ADDRESS_DST] == NULL || 2122 mhp->ext[SADB_X_EXT_POLICY] == NULL) { 2123 ipseclog((LOG_DEBUG, "%s: invalid message is passed.\n", 2124 __func__)); 2125 return key_senderror(so, m, EINVAL); 2126 } 2127 if (mhp->extlen[SADB_EXT_ADDRESS_SRC] < sizeof(struct sadb_address) || 2128 mhp->extlen[SADB_EXT_ADDRESS_DST] < sizeof(struct sadb_address) || 2129 mhp->extlen[SADB_X_EXT_POLICY] < sizeof(struct sadb_x_policy)) { 2130 ipseclog((LOG_DEBUG, "%s: invalid message is passed.\n", 2131 __func__)); 2132 return key_senderror(so, m, EINVAL); 2133 } 2134 2135 src0 = (struct sadb_address *)mhp->ext[SADB_EXT_ADDRESS_SRC]; 2136 dst0 = (struct sadb_address *)mhp->ext[SADB_EXT_ADDRESS_DST]; 2137 xpl0 = (struct sadb_x_policy *)mhp->ext[SADB_X_EXT_POLICY]; 2138 2139 /* 2140 * Note: do not parse SADB_X_EXT_NAT_T_* here: 2141 * we are processing traffic endpoints. 2142 */ 2143 2144 /* make secindex */ 2145 /* XXX boundary check against sa_len */ 2146 KEY_SETSECSPIDX(xpl0->sadb_x_policy_dir, 2147 src0 + 1, 2148 dst0 + 1, 2149 src0->sadb_address_prefixlen, 2150 dst0->sadb_address_prefixlen, 2151 src0->sadb_address_proto, 2152 &spidx); 2153 2154 /* checking the direciton. */ 2155 switch (xpl0->sadb_x_policy_dir) { 2156 case IPSEC_DIR_INBOUND: 2157 case IPSEC_DIR_OUTBOUND: 2158 break; 2159 default: 2160 ipseclog((LOG_DEBUG, "%s: Invalid SP direction.\n", __func__)); 2161 return key_senderror(so, m, EINVAL); 2162 } 2163 2164 /* Is there SP in SPD ? */ 2165 if ((sp = key_getsp(&spidx)) == NULL) { 2166 ipseclog((LOG_DEBUG, "%s: no SP found.\n", __func__)); 2167 return key_senderror(so, m, EINVAL); 2168 } 2169 2170 /* save policy id to buffer to be returned. */ 2171 xpl0->sadb_x_policy_id = sp->id; 2172 2173 key_unlink(sp); 2174 KEY_FREESP(&sp); 2175 2176 { 2177 struct mbuf *n; 2178 struct sadb_msg *newmsg; 2179 2180 /* 2181 * Note: do not send SADB_X_EXT_NAT_T_* here: 2182 * we are sending traffic endpoints. 2183 */ 2184 2185 /* create new sadb_msg to reply. */ 2186 n = key_gather_mbuf(m, mhp, 1, 4, SADB_EXT_RESERVED, 2187 SADB_X_EXT_POLICY, SADB_EXT_ADDRESS_SRC, SADB_EXT_ADDRESS_DST); 2188 if (!n) 2189 return key_senderror(so, m, ENOBUFS); 2190 2191 newmsg = mtod(n, struct sadb_msg *); 2192 newmsg->sadb_msg_errno = 0; 2193 newmsg->sadb_msg_len = PFKEY_UNIT64(n->m_pkthdr.len); 2194 2195 m_freem(m); 2196 return key_sendup_mbuf(so, n, KEY_SENDUP_ALL); 2197 } 2198 } 2199 2200 /* 2201 * SADB_SPDDELETE2 processing 2202 * receive 2203 * <base, policy(*)> 2204 * from the user(?), and set SADB_SASTATE_DEAD, 2205 * and send, 2206 * <base, policy(*)> 2207 * to the ikmpd. 2208 * policy(*) including direction of policy. 2209 * 2210 * m will always be freed. 2211 */ 2212 static int 2213 key_spddelete2(struct socket *so, struct mbuf *m, 2214 const struct sadb_msghdr *mhp) 2215 { 2216 u_int32_t id; 2217 struct secpolicy *sp; 2218 2219 IPSEC_ASSERT(so != NULL, ("null socket")); 2220 IPSEC_ASSERT(m != NULL, ("null mbuf")); 2221 IPSEC_ASSERT(mhp != NULL, ("null msghdr")); 2222 IPSEC_ASSERT(mhp->msg != NULL, ("null msg")); 2223 2224 if (mhp->ext[SADB_X_EXT_POLICY] == NULL || 2225 mhp->extlen[SADB_X_EXT_POLICY] < sizeof(struct sadb_x_policy)) { 2226 ipseclog((LOG_DEBUG, "%s: invalid message is passed.\n", __func__)); 2227 return key_senderror(so, m, EINVAL); 2228 } 2229 2230 id = ((struct sadb_x_policy *)mhp->ext[SADB_X_EXT_POLICY])->sadb_x_policy_id; 2231 2232 /* Is there SP in SPD ? */ 2233 if ((sp = key_getspbyid(id)) == NULL) { 2234 ipseclog((LOG_DEBUG, "%s: no SP found id:%u.\n", __func__, id)); 2235 return key_senderror(so, m, EINVAL); 2236 } 2237 2238 key_unlink(sp); 2239 KEY_FREESP(&sp); 2240 2241 { 2242 struct mbuf *n, *nn; 2243 struct sadb_msg *newmsg; 2244 int off, len; 2245 2246 /* create new sadb_msg to reply. */ 2247 len = PFKEY_ALIGN8(sizeof(struct sadb_msg)); 2248 2249 MGETHDR(n, M_NOWAIT, MT_DATA); 2250 if (n && len > MHLEN) { 2251 if (!(MCLGET(n, M_NOWAIT))) { 2252 m_freem(n); 2253 n = NULL; 2254 } 2255 } 2256 if (!n) 2257 return key_senderror(so, m, ENOBUFS); 2258 2259 n->m_len = len; 2260 n->m_next = NULL; 2261 off = 0; 2262 2263 m_copydata(m, 0, sizeof(struct sadb_msg), mtod(n, caddr_t) + off); 2264 off += PFKEY_ALIGN8(sizeof(struct sadb_msg)); 2265 2266 IPSEC_ASSERT(off == len, ("length inconsistency (off %u len %u)", 2267 off, len)); 2268 2269 n->m_next = m_copym(m, mhp->extoff[SADB_X_EXT_POLICY], 2270 mhp->extlen[SADB_X_EXT_POLICY], M_NOWAIT); 2271 if (!n->m_next) { 2272 m_freem(n); 2273 return key_senderror(so, m, ENOBUFS); 2274 } 2275 2276 n->m_pkthdr.len = 0; 2277 for (nn = n; nn; nn = nn->m_next) 2278 n->m_pkthdr.len += nn->m_len; 2279 2280 newmsg = mtod(n, struct sadb_msg *); 2281 newmsg->sadb_msg_errno = 0; 2282 newmsg->sadb_msg_len = PFKEY_UNIT64(n->m_pkthdr.len); 2283 2284 m_freem(m); 2285 return key_sendup_mbuf(so, n, KEY_SENDUP_ALL); 2286 } 2287 } 2288 2289 /* 2290 * SADB_X_SPDGET processing 2291 * receive 2292 * <base, policy(*)> 2293 * from the user(?), 2294 * and send, 2295 * <base, address(SD), policy> 2296 * to the ikmpd. 2297 * policy(*) including direction of policy. 2298 * 2299 * m will always be freed. 2300 */ 2301 static int 2302 key_spdget(struct socket *so, struct mbuf *m, const struct sadb_msghdr *mhp) 2303 { 2304 u_int32_t id; 2305 struct secpolicy *sp; 2306 struct mbuf *n; 2307 2308 IPSEC_ASSERT(so != NULL, ("null socket")); 2309 IPSEC_ASSERT(m != NULL, ("null mbuf")); 2310 IPSEC_ASSERT(mhp != NULL, ("null msghdr")); 2311 IPSEC_ASSERT(mhp->msg != NULL, ("null msg")); 2312 2313 if (mhp->ext[SADB_X_EXT_POLICY] == NULL || 2314 mhp->extlen[SADB_X_EXT_POLICY] < sizeof(struct sadb_x_policy)) { 2315 ipseclog((LOG_DEBUG, "%s: invalid message is passed.\n", 2316 __func__)); 2317 return key_senderror(so, m, EINVAL); 2318 } 2319 2320 id = ((struct sadb_x_policy *)mhp->ext[SADB_X_EXT_POLICY])->sadb_x_policy_id; 2321 2322 /* Is there SP in SPD ? */ 2323 if ((sp = key_getspbyid(id)) == NULL) { 2324 ipseclog((LOG_DEBUG, "%s: no SP found id:%u.\n", __func__, id)); 2325 return key_senderror(so, m, ENOENT); 2326 } 2327 2328 n = key_setdumpsp(sp, SADB_X_SPDGET, mhp->msg->sadb_msg_seq, 2329 mhp->msg->sadb_msg_pid); 2330 KEY_FREESP(&sp); 2331 if (n != NULL) { 2332 m_freem(m); 2333 return key_sendup_mbuf(so, n, KEY_SENDUP_ONE); 2334 } else 2335 return key_senderror(so, m, ENOBUFS); 2336 } 2337 2338 /* 2339 * SADB_X_SPDACQUIRE processing. 2340 * Acquire policy and SA(s) for a *OUTBOUND* packet. 2341 * send 2342 * <base, policy(*)> 2343 * to KMD, and expect to receive 2344 * <base> with SADB_X_SPDACQUIRE if error occurred, 2345 * or 2346 * <base, policy> 2347 * with SADB_X_SPDUPDATE from KMD by PF_KEY. 2348 * policy(*) is without policy requests. 2349 * 2350 * 0 : succeed 2351 * others: error number 2352 */ 2353 int 2354 key_spdacquire(struct secpolicy *sp) 2355 { 2356 struct mbuf *result = NULL, *m; 2357 struct secspacq *newspacq; 2358 2359 IPSEC_ASSERT(sp != NULL, ("null secpolicy")); 2360 IPSEC_ASSERT(sp->req == NULL, ("policy exists")); 2361 IPSEC_ASSERT(sp->policy == IPSEC_POLICY_IPSEC, 2362 ("policy not IPSEC %u", sp->policy)); 2363 2364 /* Get an entry to check whether sent message or not. */ 2365 newspacq = key_getspacq(&sp->spidx); 2366 if (newspacq != NULL) { 2367 if (V_key_blockacq_count < newspacq->count) { 2368 /* reset counter and do send message. */ 2369 newspacq->count = 0; 2370 } else { 2371 /* increment counter and do nothing. */ 2372 newspacq->count++; 2373 SPACQ_UNLOCK(); 2374 return (0); 2375 } 2376 SPACQ_UNLOCK(); 2377 } else { 2378 /* make new entry for blocking to send SADB_ACQUIRE. */ 2379 newspacq = key_newspacq(&sp->spidx); 2380 if (newspacq == NULL) 2381 return ENOBUFS; 2382 } 2383 2384 /* create new sadb_msg to reply. */ 2385 m = key_setsadbmsg(SADB_X_SPDACQUIRE, 0, 0, 0, 0, 0); 2386 if (!m) 2387 return ENOBUFS; 2388 2389 result = m; 2390 2391 result->m_pkthdr.len = 0; 2392 for (m = result; m; m = m->m_next) 2393 result->m_pkthdr.len += m->m_len; 2394 2395 mtod(result, struct sadb_msg *)->sadb_msg_len = 2396 PFKEY_UNIT64(result->m_pkthdr.len); 2397 2398 return key_sendup_mbuf(NULL, m, KEY_SENDUP_REGISTERED); 2399 } 2400 2401 /* 2402 * SADB_SPDFLUSH processing 2403 * receive 2404 * <base> 2405 * from the user, and free all entries in secpctree. 2406 * and send, 2407 * <base> 2408 * to the user. 2409 * NOTE: what to do is only marking SADB_SASTATE_DEAD. 2410 * 2411 * m will always be freed. 2412 */ 2413 static int 2414 key_spdflush(struct socket *so, struct mbuf *m, const struct sadb_msghdr *mhp) 2415 { 2416 TAILQ_HEAD(, secpolicy) drainq; 2417 struct sadb_msg *newmsg; 2418 struct secpolicy *sp, *nextsp; 2419 u_int dir; 2420 2421 IPSEC_ASSERT(so != NULL, ("null socket")); 2422 IPSEC_ASSERT(m != NULL, ("null mbuf")); 2423 IPSEC_ASSERT(mhp != NULL, ("null msghdr")); 2424 IPSEC_ASSERT(mhp->msg != NULL, ("null msg")); 2425 2426 if (m->m_len != PFKEY_ALIGN8(sizeof(struct sadb_msg))) 2427 return key_senderror(so, m, EINVAL); 2428 2429 TAILQ_INIT(&drainq); 2430 SPTREE_WLOCK(); 2431 for (dir = 0; dir < IPSEC_DIR_MAX; dir++) { 2432 TAILQ_CONCAT(&drainq, &V_sptree[dir], chain); 2433 } 2434 /* 2435 * We need to set state to DEAD for each policy to be sure, 2436 * that another thread won't try to unlink it. 2437 */ 2438 TAILQ_FOREACH(sp, &drainq, chain) 2439 sp->state = IPSEC_SPSTATE_DEAD; 2440 SPTREE_WUNLOCK(); 2441 sp = TAILQ_FIRST(&drainq); 2442 while (sp != NULL) { 2443 nextsp = TAILQ_NEXT(sp, chain); 2444 KEY_FREESP(&sp); 2445 sp = nextsp; 2446 } 2447 2448 if (sizeof(struct sadb_msg) > m->m_len + M_TRAILINGSPACE(m)) { 2449 ipseclog((LOG_DEBUG, "%s: No more memory.\n", __func__)); 2450 return key_senderror(so, m, ENOBUFS); 2451 } 2452 2453 if (m->m_next) 2454 m_freem(m->m_next); 2455 m->m_next = NULL; 2456 m->m_pkthdr.len = m->m_len = PFKEY_ALIGN8(sizeof(struct sadb_msg)); 2457 newmsg = mtod(m, struct sadb_msg *); 2458 newmsg->sadb_msg_errno = 0; 2459 newmsg->sadb_msg_len = PFKEY_UNIT64(m->m_pkthdr.len); 2460 2461 return key_sendup_mbuf(so, m, KEY_SENDUP_ALL); 2462 } 2463 2464 /* 2465 * SADB_SPDDUMP processing 2466 * receive 2467 * <base> 2468 * from the user, and dump all SP leaves 2469 * and send, 2470 * <base> ..... 2471 * to the ikmpd. 2472 * 2473 * m will always be freed. 2474 */ 2475 static int 2476 key_spddump(struct socket *so, struct mbuf *m, const struct sadb_msghdr *mhp) 2477 { 2478 SPTREE_RLOCK_TRACKER; 2479 struct secpolicy *sp; 2480 int cnt; 2481 u_int dir; 2482 struct mbuf *n; 2483 2484 IPSEC_ASSERT(so != NULL, ("null socket")); 2485 IPSEC_ASSERT(m != NULL, ("null mbuf")); 2486 IPSEC_ASSERT(mhp != NULL, ("null msghdr")); 2487 IPSEC_ASSERT(mhp->msg != NULL, ("null msg")); 2488 2489 /* search SPD entry and get buffer size. */ 2490 cnt = 0; 2491 SPTREE_RLOCK(); 2492 for (dir = 0; dir < IPSEC_DIR_MAX; dir++) { 2493 TAILQ_FOREACH(sp, &V_sptree[dir], chain) { 2494 cnt++; 2495 } 2496 } 2497 2498 if (cnt == 0) { 2499 SPTREE_RUNLOCK(); 2500 return key_senderror(so, m, ENOENT); 2501 } 2502 2503 for (dir = 0; dir < IPSEC_DIR_MAX; dir++) { 2504 TAILQ_FOREACH(sp, &V_sptree[dir], chain) { 2505 --cnt; 2506 n = key_setdumpsp(sp, SADB_X_SPDDUMP, cnt, 2507 mhp->msg->sadb_msg_pid); 2508 2509 if (n) 2510 key_sendup_mbuf(so, n, KEY_SENDUP_ONE); 2511 } 2512 } 2513 2514 SPTREE_RUNLOCK(); 2515 m_freem(m); 2516 return 0; 2517 } 2518 2519 static struct mbuf * 2520 key_setdumpsp(struct secpolicy *sp, u_int8_t type, u_int32_t seq, 2521 u_int32_t pid) 2522 { 2523 struct mbuf *result = NULL, *m; 2524 struct seclifetime lt; 2525 2526 m = key_setsadbmsg(type, 0, SADB_SATYPE_UNSPEC, seq, pid, sp->refcnt); 2527 if (!m) 2528 goto fail; 2529 result = m; 2530 2531 /* 2532 * Note: do not send SADB_X_EXT_NAT_T_* here: 2533 * we are sending traffic endpoints. 2534 */ 2535 m = key_setsadbaddr(SADB_EXT_ADDRESS_SRC, 2536 &sp->spidx.src.sa, sp->spidx.prefs, 2537 sp->spidx.ul_proto); 2538 if (!m) 2539 goto fail; 2540 m_cat(result, m); 2541 2542 m = key_setsadbaddr(SADB_EXT_ADDRESS_DST, 2543 &sp->spidx.dst.sa, sp->spidx.prefd, 2544 sp->spidx.ul_proto); 2545 if (!m) 2546 goto fail; 2547 m_cat(result, m); 2548 2549 m = key_sp2msg(sp); 2550 if (!m) 2551 goto fail; 2552 m_cat(result, m); 2553 2554 if(sp->lifetime){ 2555 lt.addtime=sp->created; 2556 lt.usetime= sp->lastused; 2557 m = key_setlifetime(<, SADB_EXT_LIFETIME_CURRENT); 2558 if (!m) 2559 goto fail; 2560 m_cat(result, m); 2561 2562 lt.addtime=sp->lifetime; 2563 lt.usetime= sp->validtime; 2564 m = key_setlifetime(<, SADB_EXT_LIFETIME_HARD); 2565 if (!m) 2566 goto fail; 2567 m_cat(result, m); 2568 } 2569 2570 if ((result->m_flags & M_PKTHDR) == 0) 2571 goto fail; 2572 2573 if (result->m_len < sizeof(struct sadb_msg)) { 2574 result = m_pullup(result, sizeof(struct sadb_msg)); 2575 if (result == NULL) 2576 goto fail; 2577 } 2578 2579 result->m_pkthdr.len = 0; 2580 for (m = result; m; m = m->m_next) 2581 result->m_pkthdr.len += m->m_len; 2582 2583 mtod(result, struct sadb_msg *)->sadb_msg_len = 2584 PFKEY_UNIT64(result->m_pkthdr.len); 2585 2586 return result; 2587 2588 fail: 2589 m_freem(result); 2590 return NULL; 2591 } 2592 2593 /* 2594 * get PFKEY message length for security policy and request. 2595 */ 2596 static u_int 2597 key_getspreqmsglen(struct secpolicy *sp) 2598 { 2599 u_int tlen; 2600 2601 tlen = sizeof(struct sadb_x_policy); 2602 2603 /* if is the policy for ipsec ? */ 2604 if (sp->policy != IPSEC_POLICY_IPSEC) 2605 return tlen; 2606 2607 /* get length of ipsec requests */ 2608 { 2609 struct ipsecrequest *isr; 2610 int len; 2611 2612 for (isr = sp->req; isr != NULL; isr = isr->next) { 2613 len = sizeof(struct sadb_x_ipsecrequest) 2614 + isr->saidx.src.sa.sa_len 2615 + isr->saidx.dst.sa.sa_len; 2616 2617 tlen += PFKEY_ALIGN8(len); 2618 } 2619 } 2620 2621 return tlen; 2622 } 2623 2624 /* 2625 * SADB_SPDEXPIRE processing 2626 * send 2627 * <base, address(SD), lifetime(CH), policy> 2628 * to KMD by PF_KEY. 2629 * 2630 * OUT: 0 : succeed 2631 * others : error number 2632 */ 2633 static int 2634 key_spdexpire(struct secpolicy *sp) 2635 { 2636 struct mbuf *result = NULL, *m; 2637 int len; 2638 int error = -1; 2639 struct sadb_lifetime *lt; 2640 2641 /* XXX: Why do we lock ? */ 2642 2643 IPSEC_ASSERT(sp != NULL, ("null secpolicy")); 2644 2645 /* set msg header */ 2646 m = key_setsadbmsg(SADB_X_SPDEXPIRE, 0, 0, 0, 0, 0); 2647 if (!m) { 2648 error = ENOBUFS; 2649 goto fail; 2650 } 2651 result = m; 2652 2653 /* create lifetime extension (current and hard) */ 2654 len = PFKEY_ALIGN8(sizeof(*lt)) * 2; 2655 m = m_get2(len, M_NOWAIT, MT_DATA, 0); 2656 if (m == NULL) { 2657 error = ENOBUFS; 2658 goto fail; 2659 } 2660 m_align(m, len); 2661 m->m_len = len; 2662 bzero(mtod(m, caddr_t), len); 2663 lt = mtod(m, struct sadb_lifetime *); 2664 lt->sadb_lifetime_len = PFKEY_UNIT64(sizeof(struct sadb_lifetime)); 2665 lt->sadb_lifetime_exttype = SADB_EXT_LIFETIME_CURRENT; 2666 lt->sadb_lifetime_allocations = 0; 2667 lt->sadb_lifetime_bytes = 0; 2668 lt->sadb_lifetime_addtime = sp->created; 2669 lt->sadb_lifetime_usetime = sp->lastused; 2670 lt = (struct sadb_lifetime *)(mtod(m, caddr_t) + len / 2); 2671 lt->sadb_lifetime_len = PFKEY_UNIT64(sizeof(struct sadb_lifetime)); 2672 lt->sadb_lifetime_exttype = SADB_EXT_LIFETIME_HARD; 2673 lt->sadb_lifetime_allocations = 0; 2674 lt->sadb_lifetime_bytes = 0; 2675 lt->sadb_lifetime_addtime = sp->lifetime; 2676 lt->sadb_lifetime_usetime = sp->validtime; 2677 m_cat(result, m); 2678 2679 /* 2680 * Note: do not send SADB_X_EXT_NAT_T_* here: 2681 * we are sending traffic endpoints. 2682 */ 2683 2684 /* set sadb_address for source */ 2685 m = key_setsadbaddr(SADB_EXT_ADDRESS_SRC, 2686 &sp->spidx.src.sa, 2687 sp->spidx.prefs, sp->spidx.ul_proto); 2688 if (!m) { 2689 error = ENOBUFS; 2690 goto fail; 2691 } 2692 m_cat(result, m); 2693 2694 /* set sadb_address for destination */ 2695 m = key_setsadbaddr(SADB_EXT_ADDRESS_DST, 2696 &sp->spidx.dst.sa, 2697 sp->spidx.prefd, sp->spidx.ul_proto); 2698 if (!m) { 2699 error = ENOBUFS; 2700 goto fail; 2701 } 2702 m_cat(result, m); 2703 2704 /* set secpolicy */ 2705 m = key_sp2msg(sp); 2706 if (!m) { 2707 error = ENOBUFS; 2708 goto fail; 2709 } 2710 m_cat(result, m); 2711 2712 if ((result->m_flags & M_PKTHDR) == 0) { 2713 error = EINVAL; 2714 goto fail; 2715 } 2716 2717 if (result->m_len < sizeof(struct sadb_msg)) { 2718 result = m_pullup(result, sizeof(struct sadb_msg)); 2719 if (result == NULL) { 2720 error = ENOBUFS; 2721 goto fail; 2722 } 2723 } 2724 2725 result->m_pkthdr.len = 0; 2726 for (m = result; m; m = m->m_next) 2727 result->m_pkthdr.len += m->m_len; 2728 2729 mtod(result, struct sadb_msg *)->sadb_msg_len = 2730 PFKEY_UNIT64(result->m_pkthdr.len); 2731 2732 return key_sendup_mbuf(NULL, result, KEY_SENDUP_REGISTERED); 2733 2734 fail: 2735 if (result) 2736 m_freem(result); 2737 return error; 2738 } 2739 2740 /* %%% SAD management */ 2741 /* 2742 * allocating a memory for new SA head, and copy from the values of mhp. 2743 * OUT: NULL : failure due to the lack of memory. 2744 * others : pointer to new SA head. 2745 */ 2746 static struct secashead * 2747 key_newsah(struct secasindex *saidx) 2748 { 2749 struct secashead *newsah; 2750 2751 IPSEC_ASSERT(saidx != NULL, ("null saidx")); 2752 2753 newsah = malloc(sizeof(struct secashead), M_IPSEC_SAH, M_NOWAIT|M_ZERO); 2754 if (newsah != NULL) { 2755 int i; 2756 for (i = 0; i < sizeof(newsah->savtree)/sizeof(newsah->savtree[0]); i++) 2757 LIST_INIT(&newsah->savtree[i]); 2758 newsah->saidx = *saidx; 2759 2760 /* add to saidxtree */ 2761 newsah->state = SADB_SASTATE_MATURE; 2762 2763 SAHTREE_LOCK(); 2764 LIST_INSERT_HEAD(&V_sahtree, newsah, chain); 2765 SAHTREE_UNLOCK(); 2766 } 2767 return(newsah); 2768 } 2769 2770 /* 2771 * delete SA index and all SA registerd. 2772 */ 2773 static void 2774 key_delsah(struct secashead *sah) 2775 { 2776 struct secasvar *sav, *nextsav; 2777 u_int stateidx; 2778 int zombie = 0; 2779 2780 IPSEC_ASSERT(sah != NULL, ("NULL sah")); 2781 SAHTREE_LOCK_ASSERT(); 2782 2783 /* searching all SA registerd in the secindex. */ 2784 for (stateidx = 0; 2785 stateidx < _ARRAYLEN(saorder_state_any); 2786 stateidx++) { 2787 u_int state = saorder_state_any[stateidx]; 2788 LIST_FOREACH_SAFE(sav, &sah->savtree[state], chain, nextsav) { 2789 if (sav->refcnt == 0) { 2790 /* sanity check */ 2791 KEY_CHKSASTATE(state, sav->state, __func__); 2792 /* 2793 * do NOT call KEY_FREESAV here: 2794 * it will only delete the sav if refcnt == 1, 2795 * where we already know that refcnt == 0 2796 */ 2797 key_delsav(sav); 2798 } else { 2799 /* give up to delete this sa */ 2800 zombie++; 2801 } 2802 } 2803 } 2804 if (!zombie) { /* delete only if there are savs */ 2805 /* remove from tree of SA index */ 2806 if (__LIST_CHAINED(sah)) 2807 LIST_REMOVE(sah, chain); 2808 free(sah, M_IPSEC_SAH); 2809 } 2810 } 2811 2812 /* 2813 * allocating a new SA with LARVAL state. key_add() and key_getspi() call, 2814 * and copy the values of mhp into new buffer. 2815 * When SAD message type is GETSPI: 2816 * to set sequence number from acq_seq++, 2817 * to set zero to SPI. 2818 * not to call key_setsava(). 2819 * OUT: NULL : fail 2820 * others : pointer to new secasvar. 2821 * 2822 * does not modify mbuf. does not free mbuf on error. 2823 */ 2824 static struct secasvar * 2825 key_newsav(struct mbuf *m, const struct sadb_msghdr *mhp, 2826 struct secashead *sah, int *errp, const char *where, int tag) 2827 { 2828 struct secasvar *newsav; 2829 const struct sadb_sa *xsa; 2830 2831 IPSEC_ASSERT(m != NULL, ("null mbuf")); 2832 IPSEC_ASSERT(mhp != NULL, ("null msghdr")); 2833 IPSEC_ASSERT(mhp->msg != NULL, ("null msg")); 2834 IPSEC_ASSERT(sah != NULL, ("null secashead")); 2835 2836 newsav = malloc(sizeof(struct secasvar), M_IPSEC_SA, M_NOWAIT|M_ZERO); 2837 if (newsav == NULL) { 2838 ipseclog((LOG_DEBUG, "%s: No more memory.\n", __func__)); 2839 *errp = ENOBUFS; 2840 goto done; 2841 } 2842 2843 switch (mhp->msg->sadb_msg_type) { 2844 case SADB_GETSPI: 2845 newsav->spi = 0; 2846 2847 #ifdef IPSEC_DOSEQCHECK 2848 /* sync sequence number */ 2849 if (mhp->msg->sadb_msg_seq == 0) 2850 newsav->seq = 2851 (V_acq_seq = (V_acq_seq == ~0 ? 1 : ++V_acq_seq)); 2852 else 2853 #endif 2854 newsav->seq = mhp->msg->sadb_msg_seq; 2855 break; 2856 2857 case SADB_ADD: 2858 /* sanity check */ 2859 if (mhp->ext[SADB_EXT_SA] == NULL) { 2860 free(newsav, M_IPSEC_SA); 2861 newsav = NULL; 2862 ipseclog((LOG_DEBUG, "%s: invalid message is passed.\n", 2863 __func__)); 2864 *errp = EINVAL; 2865 goto done; 2866 } 2867 xsa = (const struct sadb_sa *)mhp->ext[SADB_EXT_SA]; 2868 newsav->spi = xsa->sadb_sa_spi; 2869 newsav->seq = mhp->msg->sadb_msg_seq; 2870 break; 2871 default: 2872 free(newsav, M_IPSEC_SA); 2873 newsav = NULL; 2874 *errp = EINVAL; 2875 goto done; 2876 } 2877 2878 2879 /* copy sav values */ 2880 if (mhp->msg->sadb_msg_type != SADB_GETSPI) { 2881 *errp = key_setsaval(newsav, m, mhp); 2882 if (*errp) { 2883 free(newsav, M_IPSEC_SA); 2884 newsav = NULL; 2885 goto done; 2886 } 2887 } 2888 2889 SECASVAR_LOCK_INIT(newsav); 2890 2891 /* reset created */ 2892 newsav->created = time_second; 2893 newsav->pid = mhp->msg->sadb_msg_pid; 2894 2895 /* add to satree */ 2896 newsav->sah = sah; 2897 sa_initref(newsav); 2898 newsav->state = SADB_SASTATE_LARVAL; 2899 2900 SAHTREE_LOCK(); 2901 LIST_INSERT_TAIL(&sah->savtree[SADB_SASTATE_LARVAL], newsav, 2902 secasvar, chain); 2903 SAHTREE_UNLOCK(); 2904 done: 2905 KEYDEBUG(KEYDEBUG_IPSEC_STAMP, 2906 printf("DP %s from %s:%u return SP:%p\n", __func__, 2907 where, tag, newsav)); 2908 2909 return newsav; 2910 } 2911 2912 /* 2913 * free() SA variable entry. 2914 */ 2915 static void 2916 key_cleansav(struct secasvar *sav) 2917 { 2918 /* 2919 * Cleanup xform state. Note that zeroize'ing causes the 2920 * keys to be cleared; otherwise we must do it ourself. 2921 */ 2922 if (sav->tdb_xform != NULL) { 2923 sav->tdb_xform->xf_zeroize(sav); 2924 sav->tdb_xform = NULL; 2925 } else { 2926 if (sav->key_auth != NULL) 2927 bzero(sav->key_auth->key_data, _KEYLEN(sav->key_auth)); 2928 if (sav->key_enc != NULL) 2929 bzero(sav->key_enc->key_data, _KEYLEN(sav->key_enc)); 2930 } 2931 if (sav->key_auth != NULL) { 2932 if (sav->key_auth->key_data != NULL) 2933 free(sav->key_auth->key_data, M_IPSEC_MISC); 2934 free(sav->key_auth, M_IPSEC_MISC); 2935 sav->key_auth = NULL; 2936 } 2937 if (sav->key_enc != NULL) { 2938 if (sav->key_enc->key_data != NULL) 2939 free(sav->key_enc->key_data, M_IPSEC_MISC); 2940 free(sav->key_enc, M_IPSEC_MISC); 2941 sav->key_enc = NULL; 2942 } 2943 if (sav->sched) { 2944 bzero(sav->sched, sav->schedlen); 2945 free(sav->sched, M_IPSEC_MISC); 2946 sav->sched = NULL; 2947 } 2948 if (sav->replay != NULL) { 2949 if (sav->replay->bitmap != NULL) 2950 free(sav->replay->bitmap, M_IPSEC_MISC); 2951 free(sav->replay, M_IPSEC_MISC); 2952 sav->replay = NULL; 2953 } 2954 if (sav->lft_c != NULL) { 2955 free(sav->lft_c, M_IPSEC_MISC); 2956 sav->lft_c = NULL; 2957 } 2958 if (sav->lft_h != NULL) { 2959 free(sav->lft_h, M_IPSEC_MISC); 2960 sav->lft_h = NULL; 2961 } 2962 if (sav->lft_s != NULL) { 2963 free(sav->lft_s, M_IPSEC_MISC); 2964 sav->lft_s = NULL; 2965 } 2966 } 2967 2968 /* 2969 * free() SA variable entry. 2970 */ 2971 static void 2972 key_delsav(struct secasvar *sav) 2973 { 2974 IPSEC_ASSERT(sav != NULL, ("null sav")); 2975 IPSEC_ASSERT(sav->refcnt == 0, ("reference count %u > 0", sav->refcnt)); 2976 2977 /* remove from SA header */ 2978 if (__LIST_CHAINED(sav)) 2979 LIST_REMOVE(sav, chain); 2980 key_cleansav(sav); 2981 SECASVAR_LOCK_DESTROY(sav); 2982 free(sav, M_IPSEC_SA); 2983 } 2984 2985 /* 2986 * search SAD. 2987 * OUT: 2988 * NULL : not found 2989 * others : found, pointer to a SA. 2990 */ 2991 static struct secashead * 2992 key_getsah(struct secasindex *saidx) 2993 { 2994 struct secashead *sah; 2995 2996 SAHTREE_LOCK(); 2997 LIST_FOREACH(sah, &V_sahtree, chain) { 2998 if (sah->state == SADB_SASTATE_DEAD) 2999 continue; 3000 if (key_cmpsaidx(&sah->saidx, saidx, CMP_REQID)) 3001 break; 3002 } 3003 SAHTREE_UNLOCK(); 3004 3005 return sah; 3006 } 3007 3008 /* 3009 * check not to be duplicated SPI. 3010 * NOTE: this function is too slow due to searching all SAD. 3011 * OUT: 3012 * NULL : not found 3013 * others : found, pointer to a SA. 3014 */ 3015 static struct secasvar * 3016 key_checkspidup(struct secasindex *saidx, u_int32_t spi) 3017 { 3018 struct secashead *sah; 3019 struct secasvar *sav; 3020 3021 /* check address family */ 3022 if (saidx->src.sa.sa_family != saidx->dst.sa.sa_family) { 3023 ipseclog((LOG_DEBUG, "%s: address family mismatched.\n", 3024 __func__)); 3025 return NULL; 3026 } 3027 3028 sav = NULL; 3029 /* check all SAD */ 3030 SAHTREE_LOCK(); 3031 LIST_FOREACH(sah, &V_sahtree, chain) { 3032 if (!key_ismyaddr((struct sockaddr *)&sah->saidx.dst)) 3033 continue; 3034 sav = key_getsavbyspi(sah, spi); 3035 if (sav != NULL) 3036 break; 3037 } 3038 SAHTREE_UNLOCK(); 3039 3040 return sav; 3041 } 3042 3043 /* 3044 * search SAD litmited alive SA, protocol, SPI. 3045 * OUT: 3046 * NULL : not found 3047 * others : found, pointer to a SA. 3048 */ 3049 static struct secasvar * 3050 key_getsavbyspi(struct secashead *sah, u_int32_t spi) 3051 { 3052 struct secasvar *sav; 3053 u_int stateidx, state; 3054 3055 sav = NULL; 3056 SAHTREE_LOCK_ASSERT(); 3057 /* search all status */ 3058 for (stateidx = 0; 3059 stateidx < _ARRAYLEN(saorder_state_alive); 3060 stateidx++) { 3061 3062 state = saorder_state_alive[stateidx]; 3063 LIST_FOREACH(sav, &sah->savtree[state], chain) { 3064 3065 /* sanity check */ 3066 if (sav->state != state) { 3067 ipseclog((LOG_DEBUG, "%s: " 3068 "invalid sav->state (queue: %d SA: %d)\n", 3069 __func__, state, sav->state)); 3070 continue; 3071 } 3072 3073 if (sav->spi == spi) 3074 return sav; 3075 } 3076 } 3077 3078 return NULL; 3079 } 3080 3081 /* 3082 * copy SA values from PF_KEY message except *SPI, SEQ, PID, STATE and TYPE*. 3083 * You must update these if need. 3084 * OUT: 0: success. 3085 * !0: failure. 3086 * 3087 * does not modify mbuf. does not free mbuf on error. 3088 */ 3089 static int 3090 key_setsaval(struct secasvar *sav, struct mbuf *m, 3091 const struct sadb_msghdr *mhp) 3092 { 3093 int error = 0; 3094 3095 IPSEC_ASSERT(m != NULL, ("null mbuf")); 3096 IPSEC_ASSERT(mhp != NULL, ("null msghdr")); 3097 IPSEC_ASSERT(mhp->msg != NULL, ("null msg")); 3098 3099 /* initialization */ 3100 sav->replay = NULL; 3101 sav->key_auth = NULL; 3102 sav->key_enc = NULL; 3103 sav->sched = NULL; 3104 sav->schedlen = 0; 3105 sav->lft_c = NULL; 3106 sav->lft_h = NULL; 3107 sav->lft_s = NULL; 3108 sav->tdb_xform = NULL; /* transform */ 3109 sav->tdb_encalgxform = NULL; /* encoding algorithm */ 3110 sav->tdb_authalgxform = NULL; /* authentication algorithm */ 3111 sav->tdb_compalgxform = NULL; /* compression algorithm */ 3112 /* Initialize even if NAT-T not compiled in: */ 3113 sav->natt_type = 0; 3114 sav->natt_esp_frag_len = 0; 3115 3116 /* SA */ 3117 if (mhp->ext[SADB_EXT_SA] != NULL) { 3118 const struct sadb_sa *sa0; 3119 u_int32_t replay; 3120 3121 sa0 = (const struct sadb_sa *)mhp->ext[SADB_EXT_SA]; 3122 if (mhp->extlen[SADB_EXT_SA] < sizeof(*sa0)) { 3123 error = EINVAL; 3124 goto fail; 3125 } 3126 3127 sav->alg_auth = sa0->sadb_sa_auth; 3128 sav->alg_enc = sa0->sadb_sa_encrypt; 3129 sav->flags = sa0->sadb_sa_flags; 3130 3131 /* Optional replay window */ 3132 replay = 0; 3133 if ((sa0->sadb_sa_flags & SADB_X_EXT_OLD) == 0) 3134 replay = sa0->sadb_sa_replay; 3135 if ((mhp->ext[SADB_X_EXT_SA_REPLAY]) != NULL) { 3136 replay = ((const struct sadb_x_sa_replay *) 3137 mhp->ext[SADB_X_EXT_SA_REPLAY])->sadb_x_sa_replay_replay; 3138 3139 if (replay > UINT32_MAX - 32) { 3140 ipseclog((LOG_DEBUG, "%s: replay window too big.\n", 3141 __func__)); 3142 error = EINVAL; 3143 goto fail; 3144 } 3145 3146 replay = (replay + 7) >> 3; 3147 } 3148 3149 sav->replay = (struct secreplay *) 3150 malloc(sizeof(struct secreplay), 3151 M_IPSEC_MISC, M_NOWAIT|M_ZERO); 3152 if (sav->replay == NULL) { 3153 ipseclog((LOG_DEBUG, "%s: No more memory.\n", 3154 __func__)); 3155 error = ENOBUFS; 3156 goto fail; 3157 } 3158 3159 if (replay != 0) { 3160 /* number of 32b blocks to be allocated */ 3161 u_int32_t bitmap_size; 3162 3163 /* RFC 6479: 3164 * - the allocated replay window size must be a power of two 3165 * - use an extra 32b block as a redundant window 3166 */ 3167 bitmap_size = 1; 3168 while (replay + 4 > bitmap_size) 3169 bitmap_size <<= 1; 3170 bitmap_size = bitmap_size / 4; 3171 3172 sav->replay->bitmap = malloc(bitmap_size*sizeof(u_int32_t), 3173 M_IPSEC_MISC, M_NOWAIT|M_ZERO); 3174 if (sav->replay->bitmap == NULL) { 3175 ipseclog((LOG_DEBUG, "%s: No more memory.\n", 3176 __func__)); 3177 error = ENOBUFS; 3178 goto fail; 3179 } 3180 sav->replay->bitmap_size = bitmap_size; 3181 sav->replay->wsize = replay; 3182 } 3183 } 3184 3185 /* Authentication keys */ 3186 if (mhp->ext[SADB_EXT_KEY_AUTH] != NULL) { 3187 const struct sadb_key *key0; 3188 int len; 3189 3190 key0 = (const struct sadb_key *)mhp->ext[SADB_EXT_KEY_AUTH]; 3191 len = mhp->extlen[SADB_EXT_KEY_AUTH]; 3192 3193 error = 0; 3194 if (len < sizeof(*key0)) { 3195 error = EINVAL; 3196 goto fail; 3197 } 3198 switch (mhp->msg->sadb_msg_satype) { 3199 case SADB_SATYPE_AH: 3200 case SADB_SATYPE_ESP: 3201 case SADB_X_SATYPE_TCPSIGNATURE: 3202 if (len == PFKEY_ALIGN8(sizeof(struct sadb_key)) && 3203 sav->alg_auth != SADB_X_AALG_NULL) 3204 error = EINVAL; 3205 break; 3206 case SADB_X_SATYPE_IPCOMP: 3207 default: 3208 error = EINVAL; 3209 break; 3210 } 3211 if (error) { 3212 ipseclog((LOG_DEBUG, "%s: invalid key_auth values.\n", 3213 __func__)); 3214 goto fail; 3215 } 3216 3217 sav->key_auth = (struct seckey *)key_dup_keymsg(key0, len, 3218 M_IPSEC_MISC); 3219 if (sav->key_auth == NULL ) { 3220 ipseclog((LOG_DEBUG, "%s: No more memory.\n", 3221 __func__)); 3222 error = ENOBUFS; 3223 goto fail; 3224 } 3225 } 3226 3227 /* Encryption key */ 3228 if (mhp->ext[SADB_EXT_KEY_ENCRYPT] != NULL) { 3229 const struct sadb_key *key0; 3230 int len; 3231 3232 key0 = (const struct sadb_key *)mhp->ext[SADB_EXT_KEY_ENCRYPT]; 3233 len = mhp->extlen[SADB_EXT_KEY_ENCRYPT]; 3234 3235 error = 0; 3236 if (len < sizeof(*key0)) { 3237 error = EINVAL; 3238 goto fail; 3239 } 3240 switch (mhp->msg->sadb_msg_satype) { 3241 case SADB_SATYPE_ESP: 3242 if (len == PFKEY_ALIGN8(sizeof(struct sadb_key)) && 3243 sav->alg_enc != SADB_EALG_NULL) { 3244 error = EINVAL; 3245 break; 3246 } 3247 sav->key_enc = (struct seckey *)key_dup_keymsg(key0, 3248 len, 3249 M_IPSEC_MISC); 3250 if (sav->key_enc == NULL) { 3251 ipseclog((LOG_DEBUG, "%s: No more memory.\n", 3252 __func__)); 3253 error = ENOBUFS; 3254 goto fail; 3255 } 3256 break; 3257 case SADB_X_SATYPE_IPCOMP: 3258 if (len != PFKEY_ALIGN8(sizeof(struct sadb_key))) 3259 error = EINVAL; 3260 sav->key_enc = NULL; /*just in case*/ 3261 break; 3262 case SADB_SATYPE_AH: 3263 case SADB_X_SATYPE_TCPSIGNATURE: 3264 default: 3265 error = EINVAL; 3266 break; 3267 } 3268 if (error) { 3269 ipseclog((LOG_DEBUG, "%s: invalid key_enc value.\n", 3270 __func__)); 3271 goto fail; 3272 } 3273 } 3274 3275 /* set iv */ 3276 sav->ivlen = 0; 3277 3278 switch (mhp->msg->sadb_msg_satype) { 3279 case SADB_SATYPE_AH: 3280 error = xform_init(sav, XF_AH); 3281 break; 3282 case SADB_SATYPE_ESP: 3283 error = xform_init(sav, XF_ESP); 3284 break; 3285 case SADB_X_SATYPE_IPCOMP: 3286 error = xform_init(sav, XF_IPCOMP); 3287 break; 3288 case SADB_X_SATYPE_TCPSIGNATURE: 3289 error = xform_init(sav, XF_TCPSIGNATURE); 3290 break; 3291 } 3292 if (error) { 3293 ipseclog((LOG_DEBUG, "%s: unable to initialize SA type %u.\n", 3294 __func__, mhp->msg->sadb_msg_satype)); 3295 goto fail; 3296 } 3297 3298 /* reset created */ 3299 sav->created = time_second; 3300 3301 /* make lifetime for CURRENT */ 3302 sav->lft_c = malloc(sizeof(struct seclifetime), M_IPSEC_MISC, M_NOWAIT); 3303 if (sav->lft_c == NULL) { 3304 ipseclog((LOG_DEBUG, "%s: No more memory.\n", __func__)); 3305 error = ENOBUFS; 3306 goto fail; 3307 } 3308 3309 sav->lft_c->allocations = 0; 3310 sav->lft_c->bytes = 0; 3311 sav->lft_c->addtime = time_second; 3312 sav->lft_c->usetime = 0; 3313 3314 /* lifetimes for HARD and SOFT */ 3315 { 3316 const struct sadb_lifetime *lft0; 3317 3318 lft0 = (struct sadb_lifetime *)mhp->ext[SADB_EXT_LIFETIME_HARD]; 3319 if (lft0 != NULL) { 3320 if (mhp->extlen[SADB_EXT_LIFETIME_HARD] < sizeof(*lft0)) { 3321 error = EINVAL; 3322 goto fail; 3323 } 3324 sav->lft_h = key_dup_lifemsg(lft0, M_IPSEC_MISC); 3325 if (sav->lft_h == NULL) { 3326 ipseclog((LOG_DEBUG, "%s: No more memory.\n",__func__)); 3327 error = ENOBUFS; 3328 goto fail; 3329 } 3330 /* to be initialize ? */ 3331 } 3332 3333 lft0 = (struct sadb_lifetime *)mhp->ext[SADB_EXT_LIFETIME_SOFT]; 3334 if (lft0 != NULL) { 3335 if (mhp->extlen[SADB_EXT_LIFETIME_SOFT] < sizeof(*lft0)) { 3336 error = EINVAL; 3337 goto fail; 3338 } 3339 sav->lft_s = key_dup_lifemsg(lft0, M_IPSEC_MISC); 3340 if (sav->lft_s == NULL) { 3341 ipseclog((LOG_DEBUG, "%s: No more memory.\n",__func__)); 3342 error = ENOBUFS; 3343 goto fail; 3344 } 3345 /* to be initialize ? */ 3346 } 3347 } 3348 3349 return 0; 3350 3351 fail: 3352 /* initialization */ 3353 key_cleansav(sav); 3354 3355 return error; 3356 } 3357 3358 /* 3359 * validation with a secasvar entry, and set SADB_SATYPE_MATURE. 3360 * OUT: 0: valid 3361 * other: errno 3362 */ 3363 static int 3364 key_mature(struct secasvar *sav) 3365 { 3366 int error; 3367 3368 /* check SPI value */ 3369 switch (sav->sah->saidx.proto) { 3370 case IPPROTO_ESP: 3371 case IPPROTO_AH: 3372 /* 3373 * RFC 4302, 2.4. Security Parameters Index (SPI), SPI values 3374 * 1-255 reserved by IANA for future use, 3375 * 0 for implementation specific, local use. 3376 */ 3377 if (ntohl(sav->spi) <= 255) { 3378 ipseclog((LOG_DEBUG, "%s: illegal range of SPI %u.\n", 3379 __func__, (u_int32_t)ntohl(sav->spi))); 3380 return EINVAL; 3381 } 3382 break; 3383 } 3384 3385 /* check satype */ 3386 switch (sav->sah->saidx.proto) { 3387 case IPPROTO_ESP: 3388 /* check flags */ 3389 if ((sav->flags & (SADB_X_EXT_OLD|SADB_X_EXT_DERIV)) == 3390 (SADB_X_EXT_OLD|SADB_X_EXT_DERIV)) { 3391 ipseclog((LOG_DEBUG, "%s: invalid flag (derived) " 3392 "given to old-esp.\n", __func__)); 3393 return EINVAL; 3394 } 3395 error = xform_init(sav, XF_ESP); 3396 break; 3397 case IPPROTO_AH: 3398 /* check flags */ 3399 if (sav->flags & SADB_X_EXT_DERIV) { 3400 ipseclog((LOG_DEBUG, "%s: invalid flag (derived) " 3401 "given to AH SA.\n", __func__)); 3402 return EINVAL; 3403 } 3404 if (sav->alg_enc != SADB_EALG_NONE) { 3405 ipseclog((LOG_DEBUG, "%s: protocol and algorithm " 3406 "mismated.\n", __func__)); 3407 return(EINVAL); 3408 } 3409 error = xform_init(sav, XF_AH); 3410 break; 3411 case IPPROTO_IPCOMP: 3412 if (sav->alg_auth != SADB_AALG_NONE) { 3413 ipseclog((LOG_DEBUG, "%s: protocol and algorithm " 3414 "mismated.\n", __func__)); 3415 return(EINVAL); 3416 } 3417 if ((sav->flags & SADB_X_EXT_RAWCPI) == 0 3418 && ntohl(sav->spi) >= 0x10000) { 3419 ipseclog((LOG_DEBUG, "%s: invalid cpi for IPComp.\n", 3420 __func__)); 3421 return(EINVAL); 3422 } 3423 error = xform_init(sav, XF_IPCOMP); 3424 break; 3425 case IPPROTO_TCP: 3426 if (sav->alg_enc != SADB_EALG_NONE) { 3427 ipseclog((LOG_DEBUG, "%s: protocol and algorithm " 3428 "mismated.\n", __func__)); 3429 return(EINVAL); 3430 } 3431 error = xform_init(sav, XF_TCPSIGNATURE); 3432 break; 3433 default: 3434 ipseclog((LOG_DEBUG, "%s: Invalid satype.\n", __func__)); 3435 error = EPROTONOSUPPORT; 3436 break; 3437 } 3438 if (error == 0) { 3439 SAHTREE_LOCK(); 3440 key_sa_chgstate(sav, SADB_SASTATE_MATURE); 3441 SAHTREE_UNLOCK(); 3442 } 3443 return (error); 3444 } 3445 3446 /* 3447 * subroutine for SADB_GET and SADB_DUMP. 3448 */ 3449 static struct mbuf * 3450 key_setdumpsa(struct secasvar *sav, u_int8_t type, u_int8_t satype, 3451 u_int32_t seq, u_int32_t pid) 3452 { 3453 struct mbuf *result = NULL, *tres = NULL, *m; 3454 int i; 3455 int dumporder[] = { 3456 SADB_EXT_SA, SADB_X_EXT_SA2, SADB_X_EXT_SA_REPLAY, 3457 SADB_EXT_LIFETIME_HARD, SADB_EXT_LIFETIME_SOFT, 3458 SADB_EXT_LIFETIME_CURRENT, SADB_EXT_ADDRESS_SRC, 3459 SADB_EXT_ADDRESS_DST, SADB_EXT_ADDRESS_PROXY, SADB_EXT_KEY_AUTH, 3460 SADB_EXT_KEY_ENCRYPT, SADB_EXT_IDENTITY_SRC, 3461 SADB_EXT_IDENTITY_DST, SADB_EXT_SENSITIVITY, 3462 #ifdef IPSEC_NAT_T 3463 SADB_X_EXT_NAT_T_TYPE, 3464 SADB_X_EXT_NAT_T_SPORT, SADB_X_EXT_NAT_T_DPORT, 3465 SADB_X_EXT_NAT_T_OAI, SADB_X_EXT_NAT_T_OAR, 3466 SADB_X_EXT_NAT_T_FRAG, 3467 #endif 3468 }; 3469 u_int32_t replay_count; 3470 3471 m = key_setsadbmsg(type, 0, satype, seq, pid, sav->refcnt); 3472 if (m == NULL) 3473 goto fail; 3474 result = m; 3475 3476 for (i = nitems(dumporder) - 1; i >= 0; i--) { 3477 m = NULL; 3478 switch (dumporder[i]) { 3479 case SADB_EXT_SA: 3480 m = key_setsadbsa(sav); 3481 if (!m) 3482 goto fail; 3483 break; 3484 3485 case SADB_X_EXT_SA2: 3486 SECASVAR_LOCK(sav); 3487 replay_count = sav->replay ? sav->replay->count : 0; 3488 SECASVAR_UNLOCK(sav); 3489 m = key_setsadbxsa2(sav->sah->saidx.mode, replay_count, 3490 sav->sah->saidx.reqid); 3491 if (!m) 3492 goto fail; 3493 break; 3494 3495 case SADB_X_EXT_SA_REPLAY: 3496 if (sav->replay == NULL || 3497 sav->replay->wsize <= UINT8_MAX) 3498 continue; 3499 3500 m = key_setsadbxsareplay(sav->replay->wsize); 3501 if (!m) 3502 goto fail; 3503 break; 3504 3505 case SADB_EXT_ADDRESS_SRC: 3506 m = key_setsadbaddr(SADB_EXT_ADDRESS_SRC, 3507 &sav->sah->saidx.src.sa, 3508 FULLMASK, IPSEC_ULPROTO_ANY); 3509 if (!m) 3510 goto fail; 3511 break; 3512 3513 case SADB_EXT_ADDRESS_DST: 3514 m = key_setsadbaddr(SADB_EXT_ADDRESS_DST, 3515 &sav->sah->saidx.dst.sa, 3516 FULLMASK, IPSEC_ULPROTO_ANY); 3517 if (!m) 3518 goto fail; 3519 break; 3520 3521 case SADB_EXT_KEY_AUTH: 3522 if (!sav->key_auth) 3523 continue; 3524 m = key_setkey(sav->key_auth, SADB_EXT_KEY_AUTH); 3525 if (!m) 3526 goto fail; 3527 break; 3528 3529 case SADB_EXT_KEY_ENCRYPT: 3530 if (!sav->key_enc) 3531 continue; 3532 m = key_setkey(sav->key_enc, SADB_EXT_KEY_ENCRYPT); 3533 if (!m) 3534 goto fail; 3535 break; 3536 3537 case SADB_EXT_LIFETIME_CURRENT: 3538 if (!sav->lft_c) 3539 continue; 3540 m = key_setlifetime(sav->lft_c, 3541 SADB_EXT_LIFETIME_CURRENT); 3542 if (!m) 3543 goto fail; 3544 break; 3545 3546 case SADB_EXT_LIFETIME_HARD: 3547 if (!sav->lft_h) 3548 continue; 3549 m = key_setlifetime(sav->lft_h, 3550 SADB_EXT_LIFETIME_HARD); 3551 if (!m) 3552 goto fail; 3553 break; 3554 3555 case SADB_EXT_LIFETIME_SOFT: 3556 if (!sav->lft_s) 3557 continue; 3558 m = key_setlifetime(sav->lft_s, 3559 SADB_EXT_LIFETIME_SOFT); 3560 3561 if (!m) 3562 goto fail; 3563 break; 3564 3565 #ifdef IPSEC_NAT_T 3566 case SADB_X_EXT_NAT_T_TYPE: 3567 m = key_setsadbxtype(sav->natt_type); 3568 if (!m) 3569 goto fail; 3570 break; 3571 3572 case SADB_X_EXT_NAT_T_DPORT: 3573 m = key_setsadbxport( 3574 KEY_PORTFROMSADDR(&sav->sah->saidx.dst), 3575 SADB_X_EXT_NAT_T_DPORT); 3576 if (!m) 3577 goto fail; 3578 break; 3579 3580 case SADB_X_EXT_NAT_T_SPORT: 3581 m = key_setsadbxport( 3582 KEY_PORTFROMSADDR(&sav->sah->saidx.src), 3583 SADB_X_EXT_NAT_T_SPORT); 3584 if (!m) 3585 goto fail; 3586 break; 3587 3588 case SADB_X_EXT_NAT_T_OAI: 3589 case SADB_X_EXT_NAT_T_OAR: 3590 case SADB_X_EXT_NAT_T_FRAG: 3591 /* We do not (yet) support those. */ 3592 continue; 3593 #endif 3594 3595 case SADB_EXT_ADDRESS_PROXY: 3596 case SADB_EXT_IDENTITY_SRC: 3597 case SADB_EXT_IDENTITY_DST: 3598 /* XXX: should we brought from SPD ? */ 3599 case SADB_EXT_SENSITIVITY: 3600 default: 3601 continue; 3602 } 3603 3604 if (!m) 3605 goto fail; 3606 if (tres) 3607 m_cat(m, tres); 3608 tres = m; 3609 3610 } 3611 3612 m_cat(result, tres); 3613 tres = NULL; 3614 if (result->m_len < sizeof(struct sadb_msg)) { 3615 result = m_pullup(result, sizeof(struct sadb_msg)); 3616 if (result == NULL) 3617 goto fail; 3618 } 3619 3620 result->m_pkthdr.len = 0; 3621 for (m = result; m; m = m->m_next) 3622 result->m_pkthdr.len += m->m_len; 3623 3624 mtod(result, struct sadb_msg *)->sadb_msg_len = 3625 PFKEY_UNIT64(result->m_pkthdr.len); 3626 3627 return result; 3628 3629 fail: 3630 m_freem(result); 3631 m_freem(tres); 3632 return NULL; 3633 } 3634 3635 /* 3636 * set data into sadb_msg. 3637 */ 3638 static struct mbuf * 3639 key_setsadbmsg(u_int8_t type, u_int16_t tlen, u_int8_t satype, u_int32_t seq, 3640 pid_t pid, u_int16_t reserved) 3641 { 3642 struct mbuf *m; 3643 struct sadb_msg *p; 3644 int len; 3645 3646 len = PFKEY_ALIGN8(sizeof(struct sadb_msg)); 3647 if (len > MCLBYTES) 3648 return NULL; 3649 MGETHDR(m, M_NOWAIT, MT_DATA); 3650 if (m && len > MHLEN) { 3651 if (!(MCLGET(m, M_NOWAIT))) { 3652 m_freem(m); 3653 m = NULL; 3654 } 3655 } 3656 if (!m) 3657 return NULL; 3658 m->m_pkthdr.len = m->m_len = len; 3659 m->m_next = NULL; 3660 3661 p = mtod(m, struct sadb_msg *); 3662 3663 bzero(p, len); 3664 p->sadb_msg_version = PF_KEY_V2; 3665 p->sadb_msg_type = type; 3666 p->sadb_msg_errno = 0; 3667 p->sadb_msg_satype = satype; 3668 p->sadb_msg_len = PFKEY_UNIT64(tlen); 3669 p->sadb_msg_reserved = reserved; 3670 p->sadb_msg_seq = seq; 3671 p->sadb_msg_pid = (u_int32_t)pid; 3672 3673 return m; 3674 } 3675 3676 /* 3677 * copy secasvar data into sadb_address. 3678 */ 3679 static struct mbuf * 3680 key_setsadbsa(struct secasvar *sav) 3681 { 3682 struct mbuf *m; 3683 struct sadb_sa *p; 3684 int len; 3685 3686 len = PFKEY_ALIGN8(sizeof(struct sadb_sa)); 3687 m = m_get2(len, M_NOWAIT, MT_DATA, 0); 3688 if (m == NULL) 3689 return (NULL); 3690 m_align(m, len); 3691 m->m_len = len; 3692 p = mtod(m, struct sadb_sa *); 3693 bzero(p, len); 3694 p->sadb_sa_len = PFKEY_UNIT64(len); 3695 p->sadb_sa_exttype = SADB_EXT_SA; 3696 p->sadb_sa_spi = sav->spi; 3697 p->sadb_sa_replay = sav->replay ? 3698 (sav->replay->wsize > UINT8_MAX ? 3699 UINT8_MAX : sav->replay->wsize) : 0; 3700 p->sadb_sa_state = sav->state; 3701 p->sadb_sa_auth = sav->alg_auth; 3702 p->sadb_sa_encrypt = sav->alg_enc; 3703 p->sadb_sa_flags = sav->flags; 3704 3705 return m; 3706 } 3707 3708 /* 3709 * set data into sadb_address. 3710 */ 3711 static struct mbuf * 3712 key_setsadbaddr(u_int16_t exttype, const struct sockaddr *saddr, 3713 u_int8_t prefixlen, u_int16_t ul_proto) 3714 { 3715 struct mbuf *m; 3716 struct sadb_address *p; 3717 size_t len; 3718 3719 len = PFKEY_ALIGN8(sizeof(struct sadb_address)) + 3720 PFKEY_ALIGN8(saddr->sa_len); 3721 m = m_get2(len, M_NOWAIT, MT_DATA, 0); 3722 if (m == NULL) 3723 return (NULL); 3724 m_align(m, len); 3725 m->m_len = len; 3726 p = mtod(m, struct sadb_address *); 3727 3728 bzero(p, len); 3729 p->sadb_address_len = PFKEY_UNIT64(len); 3730 p->sadb_address_exttype = exttype; 3731 p->sadb_address_proto = ul_proto; 3732 if (prefixlen == FULLMASK) { 3733 switch (saddr->sa_family) { 3734 case AF_INET: 3735 prefixlen = sizeof(struct in_addr) << 3; 3736 break; 3737 case AF_INET6: 3738 prefixlen = sizeof(struct in6_addr) << 3; 3739 break; 3740 default: 3741 ; /*XXX*/ 3742 } 3743 } 3744 p->sadb_address_prefixlen = prefixlen; 3745 p->sadb_address_reserved = 0; 3746 3747 bcopy(saddr, 3748 mtod(m, caddr_t) + PFKEY_ALIGN8(sizeof(struct sadb_address)), 3749 saddr->sa_len); 3750 3751 return m; 3752 } 3753 3754 /* 3755 * set data into sadb_x_sa2. 3756 */ 3757 static struct mbuf * 3758 key_setsadbxsa2(u_int8_t mode, u_int32_t seq, u_int32_t reqid) 3759 { 3760 struct mbuf *m; 3761 struct sadb_x_sa2 *p; 3762 size_t len; 3763 3764 len = PFKEY_ALIGN8(sizeof(struct sadb_x_sa2)); 3765 m = m_get2(len, M_NOWAIT, MT_DATA, 0); 3766 if (m == NULL) 3767 return (NULL); 3768 m_align(m, len); 3769 m->m_len = len; 3770 p = mtod(m, struct sadb_x_sa2 *); 3771 3772 bzero(p, len); 3773 p->sadb_x_sa2_len = PFKEY_UNIT64(len); 3774 p->sadb_x_sa2_exttype = SADB_X_EXT_SA2; 3775 p->sadb_x_sa2_mode = mode; 3776 p->sadb_x_sa2_reserved1 = 0; 3777 p->sadb_x_sa2_reserved2 = 0; 3778 p->sadb_x_sa2_sequence = seq; 3779 p->sadb_x_sa2_reqid = reqid; 3780 3781 return m; 3782 } 3783 3784 /* 3785 * Set data into sadb_x_sa_replay. 3786 */ 3787 static struct mbuf * 3788 key_setsadbxsareplay(u_int32_t replay) 3789 { 3790 struct mbuf *m; 3791 struct sadb_x_sa_replay *p; 3792 size_t len; 3793 3794 len = PFKEY_ALIGN8(sizeof(struct sadb_x_sa_replay)); 3795 m = m_get2(len, M_NOWAIT, MT_DATA, 0); 3796 if (m == NULL) 3797 return (NULL); 3798 m_align(m, len); 3799 m->m_len = len; 3800 p = mtod(m, struct sadb_x_sa_replay *); 3801 3802 bzero(p, len); 3803 p->sadb_x_sa_replay_len = PFKEY_UNIT64(len); 3804 p->sadb_x_sa_replay_exttype = SADB_X_EXT_SA_REPLAY; 3805 p->sadb_x_sa_replay_replay = (replay << 3); 3806 3807 return m; 3808 } 3809 3810 #ifdef IPSEC_NAT_T 3811 /* 3812 * Set a type in sadb_x_nat_t_type. 3813 */ 3814 static struct mbuf * 3815 key_setsadbxtype(u_int16_t type) 3816 { 3817 struct mbuf *m; 3818 size_t len; 3819 struct sadb_x_nat_t_type *p; 3820 3821 len = PFKEY_ALIGN8(sizeof(struct sadb_x_nat_t_type)); 3822 3823 m = m_get2(len, M_NOWAIT, MT_DATA, 0); 3824 if (m == NULL) 3825 return (NULL); 3826 m_align(m, len); 3827 m->m_len = len; 3828 p = mtod(m, struct sadb_x_nat_t_type *); 3829 3830 bzero(p, len); 3831 p->sadb_x_nat_t_type_len = PFKEY_UNIT64(len); 3832 p->sadb_x_nat_t_type_exttype = SADB_X_EXT_NAT_T_TYPE; 3833 p->sadb_x_nat_t_type_type = type; 3834 3835 return (m); 3836 } 3837 /* 3838 * Set a port in sadb_x_nat_t_port. 3839 * In contrast to default RFC 2367 behaviour, port is in network byte order. 3840 */ 3841 static struct mbuf * 3842 key_setsadbxport(u_int16_t port, u_int16_t type) 3843 { 3844 struct mbuf *m; 3845 size_t len; 3846 struct sadb_x_nat_t_port *p; 3847 3848 len = PFKEY_ALIGN8(sizeof(struct sadb_x_nat_t_port)); 3849 3850 m = m_get2(len, M_NOWAIT, MT_DATA, 0); 3851 if (m == NULL) 3852 return (NULL); 3853 m_align(m, len); 3854 m->m_len = len; 3855 p = mtod(m, struct sadb_x_nat_t_port *); 3856 3857 bzero(p, len); 3858 p->sadb_x_nat_t_port_len = PFKEY_UNIT64(len); 3859 p->sadb_x_nat_t_port_exttype = type; 3860 p->sadb_x_nat_t_port_port = port; 3861 3862 return (m); 3863 } 3864 3865 /* 3866 * Get port from sockaddr. Port is in network byte order. 3867 */ 3868 u_int16_t 3869 key_portfromsaddr(struct sockaddr *sa) 3870 { 3871 3872 switch (sa->sa_family) { 3873 #ifdef INET 3874 case AF_INET: 3875 return ((struct sockaddr_in *)sa)->sin_port; 3876 #endif 3877 #ifdef INET6 3878 case AF_INET6: 3879 return ((struct sockaddr_in6 *)sa)->sin6_port; 3880 #endif 3881 } 3882 KEYDEBUG(KEYDEBUG_IPSEC_STAMP, 3883 printf("DP %s unexpected address family %d\n", 3884 __func__, sa->sa_family)); 3885 return (0); 3886 } 3887 #endif /* IPSEC_NAT_T */ 3888 3889 /* 3890 * Set port in struct sockaddr. Port is in network byte order. 3891 */ 3892 static void 3893 key_porttosaddr(struct sockaddr *sa, u_int16_t port) 3894 { 3895 3896 switch (sa->sa_family) { 3897 #ifdef INET 3898 case AF_INET: 3899 ((struct sockaddr_in *)sa)->sin_port = port; 3900 break; 3901 #endif 3902 #ifdef INET6 3903 case AF_INET6: 3904 ((struct sockaddr_in6 *)sa)->sin6_port = port; 3905 break; 3906 #endif 3907 default: 3908 ipseclog((LOG_DEBUG, "%s: unexpected address family %d.\n", 3909 __func__, sa->sa_family)); 3910 break; 3911 } 3912 } 3913 3914 /* 3915 * set data into sadb_x_policy 3916 */ 3917 static struct mbuf * 3918 key_setsadbxpolicy(u_int16_t type, u_int8_t dir, u_int32_t id, u_int32_t priority) 3919 { 3920 struct mbuf *m; 3921 struct sadb_x_policy *p; 3922 size_t len; 3923 3924 len = PFKEY_ALIGN8(sizeof(struct sadb_x_policy)); 3925 m = m_get2(len, M_NOWAIT, MT_DATA, 0); 3926 if (m == NULL) 3927 return (NULL); 3928 m_align(m, len); 3929 m->m_len = len; 3930 p = mtod(m, struct sadb_x_policy *); 3931 3932 bzero(p, len); 3933 p->sadb_x_policy_len = PFKEY_UNIT64(len); 3934 p->sadb_x_policy_exttype = SADB_X_EXT_POLICY; 3935 p->sadb_x_policy_type = type; 3936 p->sadb_x_policy_dir = dir; 3937 p->sadb_x_policy_id = id; 3938 p->sadb_x_policy_priority = priority; 3939 3940 return m; 3941 } 3942 3943 /* %%% utilities */ 3944 /* Take a key message (sadb_key) from the socket and turn it into one 3945 * of the kernel's key structures (seckey). 3946 * 3947 * IN: pointer to the src 3948 * OUT: NULL no more memory 3949 */ 3950 struct seckey * 3951 key_dup_keymsg(const struct sadb_key *src, u_int len, 3952 struct malloc_type *type) 3953 { 3954 struct seckey *dst; 3955 dst = (struct seckey *)malloc(sizeof(struct seckey), type, M_NOWAIT); 3956 if (dst != NULL) { 3957 dst->bits = src->sadb_key_bits; 3958 dst->key_data = (char *)malloc(len, type, M_NOWAIT); 3959 if (dst->key_data != NULL) { 3960 bcopy((const char *)src + sizeof(struct sadb_key), 3961 dst->key_data, len); 3962 } else { 3963 ipseclog((LOG_DEBUG, "%s: No more memory.\n", 3964 __func__)); 3965 free(dst, type); 3966 dst = NULL; 3967 } 3968 } else { 3969 ipseclog((LOG_DEBUG, "%s: No more memory.\n", 3970 __func__)); 3971 3972 } 3973 return dst; 3974 } 3975 3976 /* Take a lifetime message (sadb_lifetime) passed in on a socket and 3977 * turn it into one of the kernel's lifetime structures (seclifetime). 3978 * 3979 * IN: pointer to the destination, source and malloc type 3980 * OUT: NULL, no more memory 3981 */ 3982 3983 static struct seclifetime * 3984 key_dup_lifemsg(const struct sadb_lifetime *src, struct malloc_type *type) 3985 { 3986 struct seclifetime *dst = NULL; 3987 3988 dst = (struct seclifetime *)malloc(sizeof(struct seclifetime), 3989 type, M_NOWAIT); 3990 if (dst == NULL) { 3991 /* XXX counter */ 3992 ipseclog((LOG_DEBUG, "%s: No more memory.\n", __func__)); 3993 } else { 3994 dst->allocations = src->sadb_lifetime_allocations; 3995 dst->bytes = src->sadb_lifetime_bytes; 3996 dst->addtime = src->sadb_lifetime_addtime; 3997 dst->usetime = src->sadb_lifetime_usetime; 3998 } 3999 return dst; 4000 } 4001 4002 /* compare my own address 4003 * OUT: 1: true, i.e. my address. 4004 * 0: false 4005 */ 4006 int 4007 key_ismyaddr(struct sockaddr *sa) 4008 { 4009 4010 IPSEC_ASSERT(sa != NULL, ("null sockaddr")); 4011 switch (sa->sa_family) { 4012 #ifdef INET 4013 case AF_INET: 4014 return (in_localip(satosin(sa)->sin_addr)); 4015 #endif 4016 #ifdef INET6 4017 case AF_INET6: 4018 return key_ismyaddr6((struct sockaddr_in6 *)sa); 4019 #endif 4020 } 4021 4022 return 0; 4023 } 4024 4025 #ifdef INET6 4026 /* 4027 * compare my own address for IPv6. 4028 * 1: ours 4029 * 0: other 4030 */ 4031 static int 4032 key_ismyaddr6(struct sockaddr_in6 *sin6) 4033 { 4034 struct in6_addr in6; 4035 4036 if (!IN6_IS_SCOPE_LINKLOCAL(&sin6->sin6_addr)) 4037 return (in6_localip(&sin6->sin6_addr)); 4038 4039 /* Convert address into kernel-internal form */ 4040 in6 = sin6->sin6_addr; 4041 in6.s6_addr16[1] = htons(sin6->sin6_scope_id & 0xffff); 4042 return (in6_localip(&in6)); 4043 } 4044 #endif /*INET6*/ 4045 4046 /* 4047 * compare two secasindex structure. 4048 * flag can specify to compare 2 saidxes. 4049 * compare two secasindex structure without both mode and reqid. 4050 * don't compare port. 4051 * IN: 4052 * saidx0: source, it can be in SAD. 4053 * saidx1: object. 4054 * OUT: 4055 * 1 : equal 4056 * 0 : not equal 4057 */ 4058 static int 4059 key_cmpsaidx(const struct secasindex *saidx0, const struct secasindex *saidx1, 4060 int flag) 4061 { 4062 int chkport = 0; 4063 4064 /* sanity */ 4065 if (saidx0 == NULL && saidx1 == NULL) 4066 return 1; 4067 4068 if (saidx0 == NULL || saidx1 == NULL) 4069 return 0; 4070 4071 if (saidx0->proto != saidx1->proto) 4072 return 0; 4073 4074 if (flag == CMP_EXACTLY) { 4075 if (saidx0->mode != saidx1->mode) 4076 return 0; 4077 if (saidx0->reqid != saidx1->reqid) 4078 return 0; 4079 if (bcmp(&saidx0->src, &saidx1->src, saidx0->src.sa.sa_len) != 0 || 4080 bcmp(&saidx0->dst, &saidx1->dst, saidx0->dst.sa.sa_len) != 0) 4081 return 0; 4082 } else { 4083 4084 /* CMP_MODE_REQID, CMP_REQID, CMP_HEAD */ 4085 if (flag == CMP_MODE_REQID 4086 ||flag == CMP_REQID) { 4087 /* 4088 * If reqid of SPD is non-zero, unique SA is required. 4089 * The result must be of same reqid in this case. 4090 */ 4091 if (saidx1->reqid != 0 && saidx0->reqid != saidx1->reqid) 4092 return 0; 4093 } 4094 4095 if (flag == CMP_MODE_REQID) { 4096 if (saidx0->mode != IPSEC_MODE_ANY 4097 && saidx0->mode != saidx1->mode) 4098 return 0; 4099 } 4100 4101 #ifdef IPSEC_NAT_T 4102 /* 4103 * If NAT-T is enabled, check ports for tunnel mode. 4104 * Do not check ports if they are set to zero in the SPD. 4105 * Also do not do it for native transport mode, as there 4106 * is no port information available in the SP. 4107 */ 4108 if ((saidx1->mode == IPSEC_MODE_TUNNEL || 4109 (saidx1->mode == IPSEC_MODE_TRANSPORT && 4110 saidx1->proto == IPPROTO_ESP)) && 4111 saidx1->src.sa.sa_family == AF_INET && 4112 saidx1->dst.sa.sa_family == AF_INET && 4113 ((const struct sockaddr_in *)(&saidx1->src))->sin_port && 4114 ((const struct sockaddr_in *)(&saidx1->dst))->sin_port) 4115 chkport = 1; 4116 #endif /* IPSEC_NAT_T */ 4117 4118 if (key_sockaddrcmp(&saidx0->src.sa, &saidx1->src.sa, chkport) != 0) { 4119 return 0; 4120 } 4121 if (key_sockaddrcmp(&saidx0->dst.sa, &saidx1->dst.sa, chkport) != 0) { 4122 return 0; 4123 } 4124 } 4125 4126 return 1; 4127 } 4128 4129 /* 4130 * compare two secindex structure exactly. 4131 * IN: 4132 * spidx0: source, it is often in SPD. 4133 * spidx1: object, it is often from PFKEY message. 4134 * OUT: 4135 * 1 : equal 4136 * 0 : not equal 4137 */ 4138 static int 4139 key_cmpspidx_exactly(struct secpolicyindex *spidx0, 4140 struct secpolicyindex *spidx1) 4141 { 4142 /* sanity */ 4143 if (spidx0 == NULL && spidx1 == NULL) 4144 return 1; 4145 4146 if (spidx0 == NULL || spidx1 == NULL) 4147 return 0; 4148 4149 if (spidx0->prefs != spidx1->prefs 4150 || spidx0->prefd != spidx1->prefd 4151 || spidx0->ul_proto != spidx1->ul_proto) 4152 return 0; 4153 4154 return key_sockaddrcmp(&spidx0->src.sa, &spidx1->src.sa, 1) == 0 && 4155 key_sockaddrcmp(&spidx0->dst.sa, &spidx1->dst.sa, 1) == 0; 4156 } 4157 4158 /* 4159 * compare two secindex structure with mask. 4160 * IN: 4161 * spidx0: source, it is often in SPD. 4162 * spidx1: object, it is often from IP header. 4163 * OUT: 4164 * 1 : equal 4165 * 0 : not equal 4166 */ 4167 static int 4168 key_cmpspidx_withmask(struct secpolicyindex *spidx0, 4169 struct secpolicyindex *spidx1) 4170 { 4171 /* sanity */ 4172 if (spidx0 == NULL && spidx1 == NULL) 4173 return 1; 4174 4175 if (spidx0 == NULL || spidx1 == NULL) 4176 return 0; 4177 4178 if (spidx0->src.sa.sa_family != spidx1->src.sa.sa_family || 4179 spidx0->dst.sa.sa_family != spidx1->dst.sa.sa_family || 4180 spidx0->src.sa.sa_len != spidx1->src.sa.sa_len || 4181 spidx0->dst.sa.sa_len != spidx1->dst.sa.sa_len) 4182 return 0; 4183 4184 /* if spidx.ul_proto == IPSEC_ULPROTO_ANY, ignore. */ 4185 if (spidx0->ul_proto != (u_int16_t)IPSEC_ULPROTO_ANY 4186 && spidx0->ul_proto != spidx1->ul_proto) 4187 return 0; 4188 4189 switch (spidx0->src.sa.sa_family) { 4190 case AF_INET: 4191 if (spidx0->src.sin.sin_port != IPSEC_PORT_ANY 4192 && spidx0->src.sin.sin_port != spidx1->src.sin.sin_port) 4193 return 0; 4194 if (!key_bbcmp(&spidx0->src.sin.sin_addr, 4195 &spidx1->src.sin.sin_addr, spidx0->prefs)) 4196 return 0; 4197 break; 4198 case AF_INET6: 4199 if (spidx0->src.sin6.sin6_port != IPSEC_PORT_ANY 4200 && spidx0->src.sin6.sin6_port != spidx1->src.sin6.sin6_port) 4201 return 0; 4202 /* 4203 * scope_id check. if sin6_scope_id is 0, we regard it 4204 * as a wildcard scope, which matches any scope zone ID. 4205 */ 4206 if (spidx0->src.sin6.sin6_scope_id && 4207 spidx1->src.sin6.sin6_scope_id && 4208 spidx0->src.sin6.sin6_scope_id != spidx1->src.sin6.sin6_scope_id) 4209 return 0; 4210 if (!key_bbcmp(&spidx0->src.sin6.sin6_addr, 4211 &spidx1->src.sin6.sin6_addr, spidx0->prefs)) 4212 return 0; 4213 break; 4214 default: 4215 /* XXX */ 4216 if (bcmp(&spidx0->src, &spidx1->src, spidx0->src.sa.sa_len) != 0) 4217 return 0; 4218 break; 4219 } 4220 4221 switch (spidx0->dst.sa.sa_family) { 4222 case AF_INET: 4223 if (spidx0->dst.sin.sin_port != IPSEC_PORT_ANY 4224 && spidx0->dst.sin.sin_port != spidx1->dst.sin.sin_port) 4225 return 0; 4226 if (!key_bbcmp(&spidx0->dst.sin.sin_addr, 4227 &spidx1->dst.sin.sin_addr, spidx0->prefd)) 4228 return 0; 4229 break; 4230 case AF_INET6: 4231 if (spidx0->dst.sin6.sin6_port != IPSEC_PORT_ANY 4232 && spidx0->dst.sin6.sin6_port != spidx1->dst.sin6.sin6_port) 4233 return 0; 4234 /* 4235 * scope_id check. if sin6_scope_id is 0, we regard it 4236 * as a wildcard scope, which matches any scope zone ID. 4237 */ 4238 if (spidx0->dst.sin6.sin6_scope_id && 4239 spidx1->dst.sin6.sin6_scope_id && 4240 spidx0->dst.sin6.sin6_scope_id != spidx1->dst.sin6.sin6_scope_id) 4241 return 0; 4242 if (!key_bbcmp(&spidx0->dst.sin6.sin6_addr, 4243 &spidx1->dst.sin6.sin6_addr, spidx0->prefd)) 4244 return 0; 4245 break; 4246 default: 4247 /* XXX */ 4248 if (bcmp(&spidx0->dst, &spidx1->dst, spidx0->dst.sa.sa_len) != 0) 4249 return 0; 4250 break; 4251 } 4252 4253 /* XXX Do we check other field ? e.g. flowinfo */ 4254 4255 return 1; 4256 } 4257 4258 /* returns 0 on match */ 4259 static int 4260 key_sockaddrcmp(const struct sockaddr *sa1, const struct sockaddr *sa2, 4261 int port) 4262 { 4263 #ifdef satosin 4264 #undef satosin 4265 #endif 4266 #define satosin(s) ((const struct sockaddr_in *)s) 4267 #ifdef satosin6 4268 #undef satosin6 4269 #endif 4270 #define satosin6(s) ((const struct sockaddr_in6 *)s) 4271 if (sa1->sa_family != sa2->sa_family || sa1->sa_len != sa2->sa_len) 4272 return 1; 4273 4274 switch (sa1->sa_family) { 4275 case AF_INET: 4276 if (sa1->sa_len != sizeof(struct sockaddr_in)) 4277 return 1; 4278 if (satosin(sa1)->sin_addr.s_addr != 4279 satosin(sa2)->sin_addr.s_addr) { 4280 return 1; 4281 } 4282 if (port && satosin(sa1)->sin_port != satosin(sa2)->sin_port) 4283 return 1; 4284 break; 4285 case AF_INET6: 4286 if (sa1->sa_len != sizeof(struct sockaddr_in6)) 4287 return 1; /*EINVAL*/ 4288 if (satosin6(sa1)->sin6_scope_id != 4289 satosin6(sa2)->sin6_scope_id) { 4290 return 1; 4291 } 4292 if (!IN6_ARE_ADDR_EQUAL(&satosin6(sa1)->sin6_addr, 4293 &satosin6(sa2)->sin6_addr)) { 4294 return 1; 4295 } 4296 if (port && 4297 satosin6(sa1)->sin6_port != satosin6(sa2)->sin6_port) { 4298 return 1; 4299 } 4300 break; 4301 default: 4302 if (bcmp(sa1, sa2, sa1->sa_len) != 0) 4303 return 1; 4304 break; 4305 } 4306 4307 return 0; 4308 #undef satosin 4309 #undef satosin6 4310 } 4311 4312 /* 4313 * compare two buffers with mask. 4314 * IN: 4315 * addr1: source 4316 * addr2: object 4317 * bits: Number of bits to compare 4318 * OUT: 4319 * 1 : equal 4320 * 0 : not equal 4321 */ 4322 static int 4323 key_bbcmp(const void *a1, const void *a2, u_int bits) 4324 { 4325 const unsigned char *p1 = a1; 4326 const unsigned char *p2 = a2; 4327 4328 /* XXX: This could be considerably faster if we compare a word 4329 * at a time, but it is complicated on LSB Endian machines */ 4330 4331 /* Handle null pointers */ 4332 if (p1 == NULL || p2 == NULL) 4333 return (p1 == p2); 4334 4335 while (bits >= 8) { 4336 if (*p1++ != *p2++) 4337 return 0; 4338 bits -= 8; 4339 } 4340 4341 if (bits > 0) { 4342 u_int8_t mask = ~((1<<(8-bits))-1); 4343 if ((*p1 & mask) != (*p2 & mask)) 4344 return 0; 4345 } 4346 return 1; /* Match! */ 4347 } 4348 4349 static void 4350 key_flush_spd(time_t now) 4351 { 4352 SPTREE_RLOCK_TRACKER; 4353 struct secpolicy *sp; 4354 u_int dir; 4355 4356 /* SPD */ 4357 for (dir = 0; dir < IPSEC_DIR_MAX; dir++) { 4358 restart: 4359 SPTREE_RLOCK(); 4360 TAILQ_FOREACH(sp, &V_sptree[dir], chain) { 4361 if (sp->lifetime == 0 && sp->validtime == 0) 4362 continue; 4363 if ((sp->lifetime && 4364 now - sp->created > sp->lifetime) || 4365 (sp->validtime && 4366 now - sp->lastused > sp->validtime)) { 4367 SP_ADDREF(sp); 4368 SPTREE_RUNLOCK(); 4369 key_spdexpire(sp); 4370 key_unlink(sp); 4371 KEY_FREESP(&sp); 4372 goto restart; 4373 } 4374 } 4375 SPTREE_RUNLOCK(); 4376 } 4377 } 4378 4379 static void 4380 key_flush_sad(time_t now) 4381 { 4382 struct secashead *sah, *nextsah; 4383 struct secasvar *sav, *nextsav; 4384 4385 /* SAD */ 4386 SAHTREE_LOCK(); 4387 LIST_FOREACH_SAFE(sah, &V_sahtree, chain, nextsah) { 4388 /* if sah has been dead, then delete it and process next sah. */ 4389 if (sah->state == SADB_SASTATE_DEAD) { 4390 key_delsah(sah); 4391 continue; 4392 } 4393 4394 /* if LARVAL entry doesn't become MATURE, delete it. */ 4395 LIST_FOREACH_SAFE(sav, &sah->savtree[SADB_SASTATE_LARVAL], chain, nextsav) { 4396 /* Need to also check refcnt for a larval SA ??? */ 4397 if (now - sav->created > V_key_larval_lifetime) 4398 KEY_FREESAV(&sav); 4399 } 4400 4401 /* 4402 * check MATURE entry to start to send expire message 4403 * whether or not. 4404 */ 4405 LIST_FOREACH_SAFE(sav, &sah->savtree[SADB_SASTATE_MATURE], chain, nextsav) { 4406 /* we don't need to check. */ 4407 if (sav->lft_s == NULL) 4408 continue; 4409 4410 /* sanity check */ 4411 if (sav->lft_c == NULL) { 4412 ipseclog((LOG_DEBUG,"%s: there is no CURRENT " 4413 "time, why?\n", __func__)); 4414 continue; 4415 } 4416 /* 4417 * RFC 2367: 4418 * HARD lifetimes MUST take precedence over SOFT 4419 * lifetimes, meaning if the HARD and SOFT lifetimes 4420 * are the same, the HARD lifetime will appear on the 4421 * EXPIRE message. 4422 */ 4423 /* check HARD lifetime */ 4424 if ((sav->lft_h->addtime != 0 && 4425 now - sav->created > sav->lft_h->addtime) || 4426 (sav->lft_h->bytes != 0 && 4427 sav->lft_h->bytes < sav->lft_c->bytes)) { 4428 key_sa_chgstate(sav, SADB_SASTATE_DEAD); 4429 key_expire(sav, 1); 4430 KEY_FREESAV(&sav); 4431 } 4432 /* check SOFT lifetime */ 4433 else if ((sav->lft_s->addtime != 0 && 4434 now - sav->created > sav->lft_s->addtime) || 4435 (sav->lft_s->bytes != 0 && 4436 sav->lft_s->bytes < sav->lft_c->bytes)) { 4437 key_sa_chgstate(sav, SADB_SASTATE_DYING); 4438 key_expire(sav, 0); 4439 } 4440 } 4441 4442 /* check DYING entry to change status to DEAD. */ 4443 LIST_FOREACH_SAFE(sav, &sah->savtree[SADB_SASTATE_DYING], chain, nextsav) { 4444 /* we don't need to check. */ 4445 if (sav->lft_h == NULL) 4446 continue; 4447 4448 /* sanity check */ 4449 if (sav->lft_c == NULL) { 4450 ipseclog((LOG_DEBUG, "%s: there is no CURRENT " 4451 "time, why?\n", __func__)); 4452 continue; 4453 } 4454 4455 if (sav->lft_h->addtime != 0 && 4456 now - sav->created > sav->lft_h->addtime) { 4457 key_sa_chgstate(sav, SADB_SASTATE_DEAD); 4458 key_expire(sav, 1); 4459 KEY_FREESAV(&sav); 4460 } 4461 #if 0 /* XXX Should we keep to send expire message until HARD lifetime ? */ 4462 else if (sav->lft_s != NULL 4463 && sav->lft_s->addtime != 0 4464 && now - sav->created > sav->lft_s->addtime) { 4465 /* 4466 * XXX: should be checked to be 4467 * installed the valid SA. 4468 */ 4469 4470 /* 4471 * If there is no SA then sending 4472 * expire message. 4473 */ 4474 key_expire(sav, 0); 4475 } 4476 #endif 4477 /* check HARD lifetime by bytes */ 4478 else if (sav->lft_h->bytes != 0 && 4479 sav->lft_h->bytes < sav->lft_c->bytes) { 4480 key_sa_chgstate(sav, SADB_SASTATE_DEAD); 4481 key_expire(sav, 1); 4482 KEY_FREESAV(&sav); 4483 } 4484 } 4485 4486 /* delete entry in DEAD */ 4487 LIST_FOREACH_SAFE(sav, &sah->savtree[SADB_SASTATE_DEAD], chain, nextsav) { 4488 /* sanity check */ 4489 if (sav->state != SADB_SASTATE_DEAD) { 4490 ipseclog((LOG_DEBUG, "%s: invalid sav->state " 4491 "(queue: %d SA: %d): kill it anyway\n", 4492 __func__, 4493 SADB_SASTATE_DEAD, sav->state)); 4494 } 4495 /* 4496 * do not call key_freesav() here. 4497 * sav should already be freed, and sav->refcnt 4498 * shows other references to sav 4499 * (such as from SPD). 4500 */ 4501 } 4502 } 4503 SAHTREE_UNLOCK(); 4504 } 4505 4506 static void 4507 key_flush_acq(time_t now) 4508 { 4509 struct secacq *acq, *nextacq; 4510 4511 /* ACQ tree */ 4512 ACQ_LOCK(); 4513 for (acq = LIST_FIRST(&V_acqtree); acq != NULL; acq = nextacq) { 4514 nextacq = LIST_NEXT(acq, chain); 4515 if (now - acq->created > V_key_blockacq_lifetime 4516 && __LIST_CHAINED(acq)) { 4517 LIST_REMOVE(acq, chain); 4518 free(acq, M_IPSEC_SAQ); 4519 } 4520 } 4521 ACQ_UNLOCK(); 4522 } 4523 4524 static void 4525 key_flush_spacq(time_t now) 4526 { 4527 struct secspacq *acq, *nextacq; 4528 4529 /* SP ACQ tree */ 4530 SPACQ_LOCK(); 4531 for (acq = LIST_FIRST(&V_spacqtree); acq != NULL; acq = nextacq) { 4532 nextacq = LIST_NEXT(acq, chain); 4533 if (now - acq->created > V_key_blockacq_lifetime 4534 && __LIST_CHAINED(acq)) { 4535 LIST_REMOVE(acq, chain); 4536 free(acq, M_IPSEC_SAQ); 4537 } 4538 } 4539 SPACQ_UNLOCK(); 4540 } 4541 4542 /* 4543 * time handler. 4544 * scanning SPD and SAD to check status for each entries, 4545 * and do to remove or to expire. 4546 * XXX: year 2038 problem may remain. 4547 */ 4548 static void 4549 key_timehandler(void *arg) 4550 { 4551 VNET_ITERATOR_DECL(vnet_iter); 4552 time_t now = time_second; 4553 4554 VNET_LIST_RLOCK_NOSLEEP(); 4555 VNET_FOREACH(vnet_iter) { 4556 CURVNET_SET(vnet_iter); 4557 key_flush_spd(now); 4558 key_flush_sad(now); 4559 key_flush_acq(now); 4560 key_flush_spacq(now); 4561 CURVNET_RESTORE(); 4562 } 4563 VNET_LIST_RUNLOCK_NOSLEEP(); 4564 4565 #ifndef IPSEC_DEBUG2 4566 /* do exchange to tick time !! */ 4567 callout_schedule(&key_timer, hz); 4568 #endif /* IPSEC_DEBUG2 */ 4569 } 4570 4571 u_long 4572 key_random() 4573 { 4574 u_long value; 4575 4576 key_randomfill(&value, sizeof(value)); 4577 return value; 4578 } 4579 4580 void 4581 key_randomfill(void *p, size_t l) 4582 { 4583 size_t n; 4584 u_long v; 4585 static int warn = 1; 4586 4587 n = 0; 4588 n = (size_t)read_random(p, (u_int)l); 4589 /* last resort */ 4590 while (n < l) { 4591 v = random(); 4592 bcopy(&v, (u_int8_t *)p + n, 4593 l - n < sizeof(v) ? l - n : sizeof(v)); 4594 n += sizeof(v); 4595 4596 if (warn) { 4597 printf("WARNING: pseudo-random number generator " 4598 "used for IPsec processing\n"); 4599 warn = 0; 4600 } 4601 } 4602 } 4603 4604 /* 4605 * map SADB_SATYPE_* to IPPROTO_*. 4606 * if satype == SADB_SATYPE then satype is mapped to ~0. 4607 * OUT: 4608 * 0: invalid satype. 4609 */ 4610 static u_int16_t 4611 key_satype2proto(u_int8_t satype) 4612 { 4613 switch (satype) { 4614 case SADB_SATYPE_UNSPEC: 4615 return IPSEC_PROTO_ANY; 4616 case SADB_SATYPE_AH: 4617 return IPPROTO_AH; 4618 case SADB_SATYPE_ESP: 4619 return IPPROTO_ESP; 4620 case SADB_X_SATYPE_IPCOMP: 4621 return IPPROTO_IPCOMP; 4622 case SADB_X_SATYPE_TCPSIGNATURE: 4623 return IPPROTO_TCP; 4624 default: 4625 return 0; 4626 } 4627 /* NOTREACHED */ 4628 } 4629 4630 /* 4631 * map IPPROTO_* to SADB_SATYPE_* 4632 * OUT: 4633 * 0: invalid protocol type. 4634 */ 4635 static u_int8_t 4636 key_proto2satype(u_int16_t proto) 4637 { 4638 switch (proto) { 4639 case IPPROTO_AH: 4640 return SADB_SATYPE_AH; 4641 case IPPROTO_ESP: 4642 return SADB_SATYPE_ESP; 4643 case IPPROTO_IPCOMP: 4644 return SADB_X_SATYPE_IPCOMP; 4645 case IPPROTO_TCP: 4646 return SADB_X_SATYPE_TCPSIGNATURE; 4647 default: 4648 return 0; 4649 } 4650 /* NOTREACHED */ 4651 } 4652 4653 /* %%% PF_KEY */ 4654 /* 4655 * SADB_GETSPI processing is to receive 4656 * <base, (SA2), src address, dst address, (SPI range)> 4657 * from the IKMPd, to assign a unique spi value, to hang on the INBOUND 4658 * tree with the status of LARVAL, and send 4659 * <base, SA(*), address(SD)> 4660 * to the IKMPd. 4661 * 4662 * IN: mhp: pointer to the pointer to each header. 4663 * OUT: NULL if fail. 4664 * other if success, return pointer to the message to send. 4665 */ 4666 static int 4667 key_getspi(struct socket *so, struct mbuf *m, const struct sadb_msghdr *mhp) 4668 { 4669 struct sadb_address *src0, *dst0; 4670 struct secasindex saidx; 4671 struct secashead *newsah; 4672 struct secasvar *newsav; 4673 u_int8_t proto; 4674 u_int32_t spi; 4675 u_int8_t mode; 4676 u_int32_t reqid; 4677 int error; 4678 4679 IPSEC_ASSERT(so != NULL, ("null socket")); 4680 IPSEC_ASSERT(m != NULL, ("null mbuf")); 4681 IPSEC_ASSERT(mhp != NULL, ("null msghdr")); 4682 IPSEC_ASSERT(mhp->msg != NULL, ("null msg")); 4683 4684 if (mhp->ext[SADB_EXT_ADDRESS_SRC] == NULL || 4685 mhp->ext[SADB_EXT_ADDRESS_DST] == NULL) { 4686 ipseclog((LOG_DEBUG, "%s: invalid message is passed.\n", 4687 __func__)); 4688 return key_senderror(so, m, EINVAL); 4689 } 4690 if (mhp->extlen[SADB_EXT_ADDRESS_SRC] < sizeof(struct sadb_address) || 4691 mhp->extlen[SADB_EXT_ADDRESS_DST] < sizeof(struct sadb_address)) { 4692 ipseclog((LOG_DEBUG, "%s: invalid message is passed.\n", 4693 __func__)); 4694 return key_senderror(so, m, EINVAL); 4695 } 4696 if (mhp->ext[SADB_X_EXT_SA2] != NULL) { 4697 mode = ((struct sadb_x_sa2 *)mhp->ext[SADB_X_EXT_SA2])->sadb_x_sa2_mode; 4698 reqid = ((struct sadb_x_sa2 *)mhp->ext[SADB_X_EXT_SA2])->sadb_x_sa2_reqid; 4699 } else { 4700 mode = IPSEC_MODE_ANY; 4701 reqid = 0; 4702 } 4703 4704 src0 = (struct sadb_address *)(mhp->ext[SADB_EXT_ADDRESS_SRC]); 4705 dst0 = (struct sadb_address *)(mhp->ext[SADB_EXT_ADDRESS_DST]); 4706 4707 /* map satype to proto */ 4708 if ((proto = key_satype2proto(mhp->msg->sadb_msg_satype)) == 0) { 4709 ipseclog((LOG_DEBUG, "%s: invalid satype is passed.\n", 4710 __func__)); 4711 return key_senderror(so, m, EINVAL); 4712 } 4713 4714 /* 4715 * Make sure the port numbers are zero. 4716 * In case of NAT-T we will update them later if needed. 4717 */ 4718 switch (((struct sockaddr *)(src0 + 1))->sa_family) { 4719 case AF_INET: 4720 if (((struct sockaddr *)(src0 + 1))->sa_len != 4721 sizeof(struct sockaddr_in)) 4722 return key_senderror(so, m, EINVAL); 4723 ((struct sockaddr_in *)(src0 + 1))->sin_port = 0; 4724 break; 4725 case AF_INET6: 4726 if (((struct sockaddr *)(src0 + 1))->sa_len != 4727 sizeof(struct sockaddr_in6)) 4728 return key_senderror(so, m, EINVAL); 4729 ((struct sockaddr_in6 *)(src0 + 1))->sin6_port = 0; 4730 break; 4731 default: 4732 ; /*???*/ 4733 } 4734 switch (((struct sockaddr *)(dst0 + 1))->sa_family) { 4735 case AF_INET: 4736 if (((struct sockaddr *)(dst0 + 1))->sa_len != 4737 sizeof(struct sockaddr_in)) 4738 return key_senderror(so, m, EINVAL); 4739 ((struct sockaddr_in *)(dst0 + 1))->sin_port = 0; 4740 break; 4741 case AF_INET6: 4742 if (((struct sockaddr *)(dst0 + 1))->sa_len != 4743 sizeof(struct sockaddr_in6)) 4744 return key_senderror(so, m, EINVAL); 4745 ((struct sockaddr_in6 *)(dst0 + 1))->sin6_port = 0; 4746 break; 4747 default: 4748 ; /*???*/ 4749 } 4750 4751 /* XXX boundary check against sa_len */ 4752 KEY_SETSECASIDX(proto, mode, reqid, src0 + 1, dst0 + 1, &saidx); 4753 4754 #ifdef IPSEC_NAT_T 4755 /* 4756 * Handle NAT-T info if present. 4757 * We made sure the port numbers are zero above, so we do 4758 * not have to worry in case we do not update them. 4759 */ 4760 if (mhp->ext[SADB_X_EXT_NAT_T_OAI] != NULL) 4761 ipseclog((LOG_DEBUG, "%s: NAT-T OAi present\n", __func__)); 4762 if (mhp->ext[SADB_X_EXT_NAT_T_OAR] != NULL) 4763 ipseclog((LOG_DEBUG, "%s: NAT-T OAr present\n", __func__)); 4764 4765 if (mhp->ext[SADB_X_EXT_NAT_T_TYPE] != NULL && 4766 mhp->ext[SADB_X_EXT_NAT_T_SPORT] != NULL && 4767 mhp->ext[SADB_X_EXT_NAT_T_DPORT] != NULL) { 4768 struct sadb_x_nat_t_type *type; 4769 struct sadb_x_nat_t_port *sport, *dport; 4770 4771 if (mhp->extlen[SADB_X_EXT_NAT_T_TYPE] < sizeof(*type) || 4772 mhp->extlen[SADB_X_EXT_NAT_T_SPORT] < sizeof(*sport) || 4773 mhp->extlen[SADB_X_EXT_NAT_T_DPORT] < sizeof(*dport)) { 4774 ipseclog((LOG_DEBUG, "%s: invalid nat-t message " 4775 "passed.\n", __func__)); 4776 return key_senderror(so, m, EINVAL); 4777 } 4778 4779 sport = (struct sadb_x_nat_t_port *) 4780 mhp->ext[SADB_X_EXT_NAT_T_SPORT]; 4781 dport = (struct sadb_x_nat_t_port *) 4782 mhp->ext[SADB_X_EXT_NAT_T_DPORT]; 4783 4784 if (sport) 4785 KEY_PORTTOSADDR(&saidx.src, sport->sadb_x_nat_t_port_port); 4786 if (dport) 4787 KEY_PORTTOSADDR(&saidx.dst, dport->sadb_x_nat_t_port_port); 4788 } 4789 #endif 4790 4791 /* SPI allocation */ 4792 spi = key_do_getnewspi((struct sadb_spirange *)mhp->ext[SADB_EXT_SPIRANGE], 4793 &saidx); 4794 if (spi == 0) 4795 return key_senderror(so, m, EINVAL); 4796 4797 /* get a SA index */ 4798 if ((newsah = key_getsah(&saidx)) == NULL) { 4799 /* create a new SA index */ 4800 if ((newsah = key_newsah(&saidx)) == NULL) { 4801 ipseclog((LOG_DEBUG, "%s: No more memory.\n",__func__)); 4802 return key_senderror(so, m, ENOBUFS); 4803 } 4804 } 4805 4806 /* get a new SA */ 4807 /* XXX rewrite */ 4808 newsav = KEY_NEWSAV(m, mhp, newsah, &error); 4809 if (newsav == NULL) { 4810 /* XXX don't free new SA index allocated in above. */ 4811 return key_senderror(so, m, error); 4812 } 4813 4814 /* set spi */ 4815 newsav->spi = htonl(spi); 4816 4817 /* delete the entry in acqtree */ 4818 if (mhp->msg->sadb_msg_seq != 0) { 4819 struct secacq *acq; 4820 if ((acq = key_getacqbyseq(mhp->msg->sadb_msg_seq)) != NULL) { 4821 /* reset counter in order to deletion by timehandler. */ 4822 acq->created = time_second; 4823 acq->count = 0; 4824 } 4825 } 4826 4827 { 4828 struct mbuf *n, *nn; 4829 struct sadb_sa *m_sa; 4830 struct sadb_msg *newmsg; 4831 int off, len; 4832 4833 /* create new sadb_msg to reply. */ 4834 len = PFKEY_ALIGN8(sizeof(struct sadb_msg)) + 4835 PFKEY_ALIGN8(sizeof(struct sadb_sa)); 4836 4837 MGETHDR(n, M_NOWAIT, MT_DATA); 4838 if (len > MHLEN) { 4839 if (!(MCLGET(n, M_NOWAIT))) { 4840 m_freem(n); 4841 n = NULL; 4842 } 4843 } 4844 if (!n) 4845 return key_senderror(so, m, ENOBUFS); 4846 4847 n->m_len = len; 4848 n->m_next = NULL; 4849 off = 0; 4850 4851 m_copydata(m, 0, sizeof(struct sadb_msg), mtod(n, caddr_t) + off); 4852 off += PFKEY_ALIGN8(sizeof(struct sadb_msg)); 4853 4854 m_sa = (struct sadb_sa *)(mtod(n, caddr_t) + off); 4855 m_sa->sadb_sa_len = PFKEY_UNIT64(sizeof(struct sadb_sa)); 4856 m_sa->sadb_sa_exttype = SADB_EXT_SA; 4857 m_sa->sadb_sa_spi = htonl(spi); 4858 off += PFKEY_ALIGN8(sizeof(struct sadb_sa)); 4859 4860 IPSEC_ASSERT(off == len, 4861 ("length inconsistency (off %u len %u)", off, len)); 4862 4863 n->m_next = key_gather_mbuf(m, mhp, 0, 2, SADB_EXT_ADDRESS_SRC, 4864 SADB_EXT_ADDRESS_DST); 4865 if (!n->m_next) { 4866 m_freem(n); 4867 return key_senderror(so, m, ENOBUFS); 4868 } 4869 4870 if (n->m_len < sizeof(struct sadb_msg)) { 4871 n = m_pullup(n, sizeof(struct sadb_msg)); 4872 if (n == NULL) 4873 return key_sendup_mbuf(so, m, KEY_SENDUP_ONE); 4874 } 4875 4876 n->m_pkthdr.len = 0; 4877 for (nn = n; nn; nn = nn->m_next) 4878 n->m_pkthdr.len += nn->m_len; 4879 4880 newmsg = mtod(n, struct sadb_msg *); 4881 newmsg->sadb_msg_seq = newsav->seq; 4882 newmsg->sadb_msg_errno = 0; 4883 newmsg->sadb_msg_len = PFKEY_UNIT64(n->m_pkthdr.len); 4884 4885 m_freem(m); 4886 return key_sendup_mbuf(so, n, KEY_SENDUP_ONE); 4887 } 4888 } 4889 4890 /* 4891 * allocating new SPI 4892 * called by key_getspi(). 4893 * OUT: 4894 * 0: failure. 4895 * others: success. 4896 */ 4897 static u_int32_t 4898 key_do_getnewspi(struct sadb_spirange *spirange, struct secasindex *saidx) 4899 { 4900 u_int32_t newspi; 4901 u_int32_t min, max; 4902 int count = V_key_spi_trycnt; 4903 4904 /* set spi range to allocate */ 4905 if (spirange != NULL) { 4906 min = spirange->sadb_spirange_min; 4907 max = spirange->sadb_spirange_max; 4908 } else { 4909 min = V_key_spi_minval; 4910 max = V_key_spi_maxval; 4911 } 4912 /* IPCOMP needs 2-byte SPI */ 4913 if (saidx->proto == IPPROTO_IPCOMP) { 4914 u_int32_t t; 4915 if (min >= 0x10000) 4916 min = 0xffff; 4917 if (max >= 0x10000) 4918 max = 0xffff; 4919 if (min > max) { 4920 t = min; min = max; max = t; 4921 } 4922 } 4923 4924 if (min == max) { 4925 if (key_checkspidup(saidx, min) != NULL) { 4926 ipseclog((LOG_DEBUG, "%s: SPI %u exists already.\n", 4927 __func__, min)); 4928 return 0; 4929 } 4930 4931 count--; /* taking one cost. */ 4932 newspi = min; 4933 4934 } else { 4935 4936 /* init SPI */ 4937 newspi = 0; 4938 4939 /* when requesting to allocate spi ranged */ 4940 while (count--) { 4941 /* generate pseudo-random SPI value ranged. */ 4942 newspi = min + (key_random() % (max - min + 1)); 4943 4944 if (key_checkspidup(saidx, newspi) == NULL) 4945 break; 4946 } 4947 4948 if (count == 0 || newspi == 0) { 4949 ipseclog((LOG_DEBUG, "%s: to allocate spi is failed.\n", 4950 __func__)); 4951 return 0; 4952 } 4953 } 4954 4955 /* statistics */ 4956 keystat.getspi_count = 4957 (keystat.getspi_count + V_key_spi_trycnt - count) / 2; 4958 4959 return newspi; 4960 } 4961 4962 /* 4963 * SADB_UPDATE processing 4964 * receive 4965 * <base, SA, (SA2), (lifetime(HSC),) address(SD), (address(P),) 4966 * key(AE), (identity(SD),) (sensitivity)> 4967 * from the ikmpd, and update a secasvar entry whose status is SADB_SASTATE_LARVAL. 4968 * and send 4969 * <base, SA, (SA2), (lifetime(HSC),) address(SD), (address(P),) 4970 * (identity(SD),) (sensitivity)> 4971 * to the ikmpd. 4972 * 4973 * m will always be freed. 4974 */ 4975 static int 4976 key_update(struct socket *so, struct mbuf *m, const struct sadb_msghdr *mhp) 4977 { 4978 struct sadb_sa *sa0; 4979 struct sadb_address *src0, *dst0; 4980 #ifdef IPSEC_NAT_T 4981 struct sadb_x_nat_t_type *type; 4982 struct sadb_x_nat_t_port *sport, *dport; 4983 struct sadb_address *iaddr, *raddr; 4984 struct sadb_x_nat_t_frag *frag; 4985 #endif 4986 struct secasindex saidx; 4987 struct secashead *sah; 4988 struct secasvar *sav; 4989 u_int16_t proto; 4990 u_int8_t mode; 4991 u_int32_t reqid; 4992 int error; 4993 4994 IPSEC_ASSERT(so != NULL, ("null socket")); 4995 IPSEC_ASSERT(m != NULL, ("null mbuf")); 4996 IPSEC_ASSERT(mhp != NULL, ("null msghdr")); 4997 IPSEC_ASSERT(mhp->msg != NULL, ("null msg")); 4998 4999 /* map satype to proto */ 5000 if ((proto = key_satype2proto(mhp->msg->sadb_msg_satype)) == 0) { 5001 ipseclog((LOG_DEBUG, "%s: invalid satype is passed.\n", 5002 __func__)); 5003 return key_senderror(so, m, EINVAL); 5004 } 5005 5006 if (mhp->ext[SADB_EXT_SA] == NULL || 5007 mhp->ext[SADB_EXT_ADDRESS_SRC] == NULL || 5008 mhp->ext[SADB_EXT_ADDRESS_DST] == NULL || 5009 (mhp->msg->sadb_msg_satype == SADB_SATYPE_ESP && 5010 mhp->ext[SADB_EXT_KEY_ENCRYPT] == NULL) || 5011 (mhp->msg->sadb_msg_satype == SADB_SATYPE_AH && 5012 mhp->ext[SADB_EXT_KEY_AUTH] == NULL) || 5013 (mhp->ext[SADB_EXT_LIFETIME_HARD] != NULL && 5014 mhp->ext[SADB_EXT_LIFETIME_SOFT] == NULL) || 5015 (mhp->ext[SADB_EXT_LIFETIME_HARD] == NULL && 5016 mhp->ext[SADB_EXT_LIFETIME_SOFT] != NULL)) { 5017 ipseclog((LOG_DEBUG, "%s: invalid message is passed.\n", 5018 __func__)); 5019 return key_senderror(so, m, EINVAL); 5020 } 5021 if (mhp->extlen[SADB_EXT_SA] < sizeof(struct sadb_sa) || 5022 mhp->extlen[SADB_EXT_ADDRESS_SRC] < sizeof(struct sadb_address) || 5023 mhp->extlen[SADB_EXT_ADDRESS_DST] < sizeof(struct sadb_address)) { 5024 ipseclog((LOG_DEBUG, "%s: invalid message is passed.\n", 5025 __func__)); 5026 return key_senderror(so, m, EINVAL); 5027 } 5028 if (mhp->ext[SADB_X_EXT_SA2] != NULL) { 5029 mode = ((struct sadb_x_sa2 *)mhp->ext[SADB_X_EXT_SA2])->sadb_x_sa2_mode; 5030 reqid = ((struct sadb_x_sa2 *)mhp->ext[SADB_X_EXT_SA2])->sadb_x_sa2_reqid; 5031 } else { 5032 mode = IPSEC_MODE_ANY; 5033 reqid = 0; 5034 } 5035 /* XXX boundary checking for other extensions */ 5036 5037 sa0 = (struct sadb_sa *)mhp->ext[SADB_EXT_SA]; 5038 src0 = (struct sadb_address *)(mhp->ext[SADB_EXT_ADDRESS_SRC]); 5039 dst0 = (struct sadb_address *)(mhp->ext[SADB_EXT_ADDRESS_DST]); 5040 5041 /* XXX boundary check against sa_len */ 5042 KEY_SETSECASIDX(proto, mode, reqid, src0 + 1, dst0 + 1, &saidx); 5043 5044 /* 5045 * Make sure the port numbers are zero. 5046 * In case of NAT-T we will update them later if needed. 5047 */ 5048 KEY_PORTTOSADDR(&saidx.src, 0); 5049 KEY_PORTTOSADDR(&saidx.dst, 0); 5050 5051 #ifdef IPSEC_NAT_T 5052 /* 5053 * Handle NAT-T info if present. 5054 */ 5055 if (mhp->ext[SADB_X_EXT_NAT_T_TYPE] != NULL && 5056 mhp->ext[SADB_X_EXT_NAT_T_SPORT] != NULL && 5057 mhp->ext[SADB_X_EXT_NAT_T_DPORT] != NULL) { 5058 5059 if (mhp->extlen[SADB_X_EXT_NAT_T_TYPE] < sizeof(*type) || 5060 mhp->extlen[SADB_X_EXT_NAT_T_SPORT] < sizeof(*sport) || 5061 mhp->extlen[SADB_X_EXT_NAT_T_DPORT] < sizeof(*dport)) { 5062 ipseclog((LOG_DEBUG, "%s: invalid message.\n", 5063 __func__)); 5064 return key_senderror(so, m, EINVAL); 5065 } 5066 5067 type = (struct sadb_x_nat_t_type *) 5068 mhp->ext[SADB_X_EXT_NAT_T_TYPE]; 5069 sport = (struct sadb_x_nat_t_port *) 5070 mhp->ext[SADB_X_EXT_NAT_T_SPORT]; 5071 dport = (struct sadb_x_nat_t_port *) 5072 mhp->ext[SADB_X_EXT_NAT_T_DPORT]; 5073 } else { 5074 type = NULL; 5075 sport = dport = NULL; 5076 } 5077 if (mhp->ext[SADB_X_EXT_NAT_T_OAI] != NULL && 5078 mhp->ext[SADB_X_EXT_NAT_T_OAR] != NULL) { 5079 if (mhp->extlen[SADB_X_EXT_NAT_T_OAI] < sizeof(*iaddr) || 5080 mhp->extlen[SADB_X_EXT_NAT_T_OAR] < sizeof(*raddr)) { 5081 ipseclog((LOG_DEBUG, "%s: invalid message\n", 5082 __func__)); 5083 return key_senderror(so, m, EINVAL); 5084 } 5085 iaddr = (struct sadb_address *)mhp->ext[SADB_X_EXT_NAT_T_OAI]; 5086 raddr = (struct sadb_address *)mhp->ext[SADB_X_EXT_NAT_T_OAR]; 5087 ipseclog((LOG_DEBUG, "%s: NAT-T OAi/r present\n", __func__)); 5088 } else { 5089 iaddr = raddr = NULL; 5090 } 5091 if (mhp->ext[SADB_X_EXT_NAT_T_FRAG] != NULL) { 5092 if (mhp->extlen[SADB_X_EXT_NAT_T_FRAG] < sizeof(*frag)) { 5093 ipseclog((LOG_DEBUG, "%s: invalid message\n", 5094 __func__)); 5095 return key_senderror(so, m, EINVAL); 5096 } 5097 frag = (struct sadb_x_nat_t_frag *) 5098 mhp->ext[SADB_X_EXT_NAT_T_FRAG]; 5099 } else { 5100 frag = NULL; 5101 } 5102 #endif 5103 5104 /* get a SA header */ 5105 if ((sah = key_getsah(&saidx)) == NULL) { 5106 ipseclog((LOG_DEBUG, "%s: no SA index found.\n", __func__)); 5107 return key_senderror(so, m, ENOENT); 5108 } 5109 5110 /* set spidx if there */ 5111 /* XXX rewrite */ 5112 error = key_setident(sah, m, mhp); 5113 if (error) 5114 return key_senderror(so, m, error); 5115 5116 /* find a SA with sequence number. */ 5117 #ifdef IPSEC_DOSEQCHECK 5118 if (mhp->msg->sadb_msg_seq != 0 5119 && (sav = key_getsavbyseq(sah, mhp->msg->sadb_msg_seq)) == NULL) { 5120 ipseclog((LOG_DEBUG, "%s: no larval SA with sequence %u " 5121 "exists.\n", __func__, mhp->msg->sadb_msg_seq)); 5122 return key_senderror(so, m, ENOENT); 5123 } 5124 #else 5125 SAHTREE_LOCK(); 5126 sav = key_getsavbyspi(sah, sa0->sadb_sa_spi); 5127 SAHTREE_UNLOCK(); 5128 if (sav == NULL) { 5129 ipseclog((LOG_DEBUG, "%s: no such a SA found (spi:%u)\n", 5130 __func__, (u_int32_t)ntohl(sa0->sadb_sa_spi))); 5131 return key_senderror(so, m, EINVAL); 5132 } 5133 #endif 5134 5135 /* validity check */ 5136 if (sav->sah->saidx.proto != proto) { 5137 ipseclog((LOG_DEBUG, "%s: protocol mismatched " 5138 "(DB=%u param=%u)\n", __func__, 5139 sav->sah->saidx.proto, proto)); 5140 return key_senderror(so, m, EINVAL); 5141 } 5142 #ifdef IPSEC_DOSEQCHECK 5143 if (sav->spi != sa0->sadb_sa_spi) { 5144 ipseclog((LOG_DEBUG, "%s: SPI mismatched (DB:%u param:%u)\n", 5145 __func__, 5146 (u_int32_t)ntohl(sav->spi), 5147 (u_int32_t)ntohl(sa0->sadb_sa_spi))); 5148 return key_senderror(so, m, EINVAL); 5149 } 5150 #endif 5151 if (sav->pid != mhp->msg->sadb_msg_pid) { 5152 ipseclog((LOG_DEBUG, "%s: pid mismatched (DB:%u param:%u)\n", 5153 __func__, sav->pid, mhp->msg->sadb_msg_pid)); 5154 return key_senderror(so, m, EINVAL); 5155 } 5156 5157 /* copy sav values */ 5158 error = key_setsaval(sav, m, mhp); 5159 if (error) { 5160 KEY_FREESAV(&sav); 5161 return key_senderror(so, m, error); 5162 } 5163 5164 #ifdef IPSEC_NAT_T 5165 /* 5166 * Handle more NAT-T info if present, 5167 * now that we have a sav to fill. 5168 */ 5169 if (type) 5170 sav->natt_type = type->sadb_x_nat_t_type_type; 5171 5172 if (sport) 5173 KEY_PORTTOSADDR(&sav->sah->saidx.src, 5174 sport->sadb_x_nat_t_port_port); 5175 if (dport) 5176 KEY_PORTTOSADDR(&sav->sah->saidx.dst, 5177 dport->sadb_x_nat_t_port_port); 5178 5179 #if 0 5180 /* 5181 * In case SADB_X_EXT_NAT_T_FRAG was not given, leave it at 0. 5182 * We should actually check for a minimum MTU here, if we 5183 * want to support it in ip_output. 5184 */ 5185 if (frag) 5186 sav->natt_esp_frag_len = frag->sadb_x_nat_t_frag_fraglen; 5187 #endif 5188 #endif 5189 5190 /* check SA values to be mature. */ 5191 if ((mhp->msg->sadb_msg_errno = key_mature(sav)) != 0) { 5192 KEY_FREESAV(&sav); 5193 return key_senderror(so, m, 0); 5194 } 5195 5196 { 5197 struct mbuf *n; 5198 5199 /* set msg buf from mhp */ 5200 n = key_getmsgbuf_x1(m, mhp); 5201 if (n == NULL) { 5202 ipseclog((LOG_DEBUG, "%s: No more memory.\n", __func__)); 5203 return key_senderror(so, m, ENOBUFS); 5204 } 5205 5206 m_freem(m); 5207 return key_sendup_mbuf(so, n, KEY_SENDUP_ALL); 5208 } 5209 } 5210 5211 /* 5212 * search SAD with sequence for a SA which state is SADB_SASTATE_LARVAL. 5213 * only called by key_update(). 5214 * OUT: 5215 * NULL : not found 5216 * others : found, pointer to a SA. 5217 */ 5218 #ifdef IPSEC_DOSEQCHECK 5219 static struct secasvar * 5220 key_getsavbyseq(struct secashead *sah, u_int32_t seq) 5221 { 5222 struct secasvar *sav; 5223 u_int state; 5224 5225 state = SADB_SASTATE_LARVAL; 5226 5227 /* search SAD with sequence number ? */ 5228 LIST_FOREACH(sav, &sah->savtree[state], chain) { 5229 5230 KEY_CHKSASTATE(state, sav->state, __func__); 5231 5232 if (sav->seq == seq) { 5233 sa_addref(sav); 5234 KEYDEBUG(KEYDEBUG_IPSEC_STAMP, 5235 printf("DP %s cause refcnt++:%d SA:%p\n", 5236 __func__, sav->refcnt, sav)); 5237 return sav; 5238 } 5239 } 5240 5241 return NULL; 5242 } 5243 #endif 5244 5245 /* 5246 * SADB_ADD processing 5247 * add an entry to SA database, when received 5248 * <base, SA, (SA2), (lifetime(HSC),) address(SD), (address(P),) 5249 * key(AE), (identity(SD),) (sensitivity)> 5250 * from the ikmpd, 5251 * and send 5252 * <base, SA, (SA2), (lifetime(HSC),) address(SD), (address(P),) 5253 * (identity(SD),) (sensitivity)> 5254 * to the ikmpd. 5255 * 5256 * IGNORE identity and sensitivity messages. 5257 * 5258 * m will always be freed. 5259 */ 5260 static int 5261 key_add(struct socket *so, struct mbuf *m, const struct sadb_msghdr *mhp) 5262 { 5263 struct sadb_sa *sa0; 5264 struct sadb_address *src0, *dst0; 5265 #ifdef IPSEC_NAT_T 5266 struct sadb_x_nat_t_type *type; 5267 struct sadb_address *iaddr, *raddr; 5268 struct sadb_x_nat_t_frag *frag; 5269 #endif 5270 struct secasindex saidx; 5271 struct secashead *newsah; 5272 struct secasvar *newsav; 5273 u_int16_t proto; 5274 u_int8_t mode; 5275 u_int32_t reqid; 5276 int error; 5277 5278 IPSEC_ASSERT(so != NULL, ("null socket")); 5279 IPSEC_ASSERT(m != NULL, ("null mbuf")); 5280 IPSEC_ASSERT(mhp != NULL, ("null msghdr")); 5281 IPSEC_ASSERT(mhp->msg != NULL, ("null msg")); 5282 5283 /* map satype to proto */ 5284 if ((proto = key_satype2proto(mhp->msg->sadb_msg_satype)) == 0) { 5285 ipseclog((LOG_DEBUG, "%s: invalid satype is passed.\n", 5286 __func__)); 5287 return key_senderror(so, m, EINVAL); 5288 } 5289 5290 if (mhp->ext[SADB_EXT_SA] == NULL || 5291 mhp->ext[SADB_EXT_ADDRESS_SRC] == NULL || 5292 mhp->ext[SADB_EXT_ADDRESS_DST] == NULL || 5293 (mhp->msg->sadb_msg_satype == SADB_SATYPE_ESP && 5294 mhp->ext[SADB_EXT_KEY_ENCRYPT] == NULL) || 5295 (mhp->msg->sadb_msg_satype == SADB_SATYPE_AH && 5296 mhp->ext[SADB_EXT_KEY_AUTH] == NULL) || 5297 (mhp->ext[SADB_EXT_LIFETIME_HARD] != NULL && 5298 mhp->ext[SADB_EXT_LIFETIME_SOFT] == NULL) || 5299 (mhp->ext[SADB_EXT_LIFETIME_HARD] == NULL && 5300 mhp->ext[SADB_EXT_LIFETIME_SOFT] != NULL)) { 5301 ipseclog((LOG_DEBUG, "%s: invalid message is passed.\n", 5302 __func__)); 5303 return key_senderror(so, m, EINVAL); 5304 } 5305 if (mhp->extlen[SADB_EXT_SA] < sizeof(struct sadb_sa) || 5306 mhp->extlen[SADB_EXT_ADDRESS_SRC] < sizeof(struct sadb_address) || 5307 mhp->extlen[SADB_EXT_ADDRESS_DST] < sizeof(struct sadb_address)) { 5308 /* XXX need more */ 5309 ipseclog((LOG_DEBUG, "%s: invalid message is passed.\n", 5310 __func__)); 5311 return key_senderror(so, m, EINVAL); 5312 } 5313 if (mhp->ext[SADB_X_EXT_SA2] != NULL) { 5314 mode = ((struct sadb_x_sa2 *)mhp->ext[SADB_X_EXT_SA2])->sadb_x_sa2_mode; 5315 reqid = ((struct sadb_x_sa2 *)mhp->ext[SADB_X_EXT_SA2])->sadb_x_sa2_reqid; 5316 } else { 5317 mode = IPSEC_MODE_ANY; 5318 reqid = 0; 5319 } 5320 5321 sa0 = (struct sadb_sa *)mhp->ext[SADB_EXT_SA]; 5322 src0 = (struct sadb_address *)mhp->ext[SADB_EXT_ADDRESS_SRC]; 5323 dst0 = (struct sadb_address *)mhp->ext[SADB_EXT_ADDRESS_DST]; 5324 5325 /* XXX boundary check against sa_len */ 5326 KEY_SETSECASIDX(proto, mode, reqid, src0 + 1, dst0 + 1, &saidx); 5327 5328 /* 5329 * Make sure the port numbers are zero. 5330 * In case of NAT-T we will update them later if needed. 5331 */ 5332 KEY_PORTTOSADDR(&saidx.src, 0); 5333 KEY_PORTTOSADDR(&saidx.dst, 0); 5334 5335 #ifdef IPSEC_NAT_T 5336 /* 5337 * Handle NAT-T info if present. 5338 */ 5339 if (mhp->ext[SADB_X_EXT_NAT_T_TYPE] != NULL && 5340 mhp->ext[SADB_X_EXT_NAT_T_SPORT] != NULL && 5341 mhp->ext[SADB_X_EXT_NAT_T_DPORT] != NULL) { 5342 struct sadb_x_nat_t_port *sport, *dport; 5343 5344 if (mhp->extlen[SADB_X_EXT_NAT_T_TYPE] < sizeof(*type) || 5345 mhp->extlen[SADB_X_EXT_NAT_T_SPORT] < sizeof(*sport) || 5346 mhp->extlen[SADB_X_EXT_NAT_T_DPORT] < sizeof(*dport)) { 5347 ipseclog((LOG_DEBUG, "%s: invalid message.\n", 5348 __func__)); 5349 return key_senderror(so, m, EINVAL); 5350 } 5351 5352 type = (struct sadb_x_nat_t_type *) 5353 mhp->ext[SADB_X_EXT_NAT_T_TYPE]; 5354 sport = (struct sadb_x_nat_t_port *) 5355 mhp->ext[SADB_X_EXT_NAT_T_SPORT]; 5356 dport = (struct sadb_x_nat_t_port *) 5357 mhp->ext[SADB_X_EXT_NAT_T_DPORT]; 5358 5359 if (sport) 5360 KEY_PORTTOSADDR(&saidx.src, 5361 sport->sadb_x_nat_t_port_port); 5362 if (dport) 5363 KEY_PORTTOSADDR(&saidx.dst, 5364 dport->sadb_x_nat_t_port_port); 5365 } else { 5366 type = NULL; 5367 } 5368 if (mhp->ext[SADB_X_EXT_NAT_T_OAI] != NULL && 5369 mhp->ext[SADB_X_EXT_NAT_T_OAR] != NULL) { 5370 if (mhp->extlen[SADB_X_EXT_NAT_T_OAI] < sizeof(*iaddr) || 5371 mhp->extlen[SADB_X_EXT_NAT_T_OAR] < sizeof(*raddr)) { 5372 ipseclog((LOG_DEBUG, "%s: invalid message\n", 5373 __func__)); 5374 return key_senderror(so, m, EINVAL); 5375 } 5376 iaddr = (struct sadb_address *)mhp->ext[SADB_X_EXT_NAT_T_OAI]; 5377 raddr = (struct sadb_address *)mhp->ext[SADB_X_EXT_NAT_T_OAR]; 5378 ipseclog((LOG_DEBUG, "%s: NAT-T OAi/r present\n", __func__)); 5379 } else { 5380 iaddr = raddr = NULL; 5381 } 5382 if (mhp->ext[SADB_X_EXT_NAT_T_FRAG] != NULL) { 5383 if (mhp->extlen[SADB_X_EXT_NAT_T_FRAG] < sizeof(*frag)) { 5384 ipseclog((LOG_DEBUG, "%s: invalid message\n", 5385 __func__)); 5386 return key_senderror(so, m, EINVAL); 5387 } 5388 frag = (struct sadb_x_nat_t_frag *) 5389 mhp->ext[SADB_X_EXT_NAT_T_FRAG]; 5390 } else { 5391 frag = NULL; 5392 } 5393 #endif 5394 5395 /* get a SA header */ 5396 if ((newsah = key_getsah(&saidx)) == NULL) { 5397 /* create a new SA header */ 5398 if ((newsah = key_newsah(&saidx)) == NULL) { 5399 ipseclog((LOG_DEBUG, "%s: No more memory.\n",__func__)); 5400 return key_senderror(so, m, ENOBUFS); 5401 } 5402 } 5403 5404 /* set spidx if there */ 5405 /* XXX rewrite */ 5406 error = key_setident(newsah, m, mhp); 5407 if (error) { 5408 return key_senderror(so, m, error); 5409 } 5410 5411 /* create new SA entry. */ 5412 /* We can create new SA only if SPI is differenct. */ 5413 SAHTREE_LOCK(); 5414 newsav = key_getsavbyspi(newsah, sa0->sadb_sa_spi); 5415 SAHTREE_UNLOCK(); 5416 if (newsav != NULL) { 5417 ipseclog((LOG_DEBUG, "%s: SA already exists.\n", __func__)); 5418 return key_senderror(so, m, EEXIST); 5419 } 5420 newsav = KEY_NEWSAV(m, mhp, newsah, &error); 5421 if (newsav == NULL) { 5422 return key_senderror(so, m, error); 5423 } 5424 5425 #ifdef IPSEC_NAT_T 5426 /* 5427 * Handle more NAT-T info if present, 5428 * now that we have a sav to fill. 5429 */ 5430 if (type) 5431 newsav->natt_type = type->sadb_x_nat_t_type_type; 5432 5433 #if 0 5434 /* 5435 * In case SADB_X_EXT_NAT_T_FRAG was not given, leave it at 0. 5436 * We should actually check for a minimum MTU here, if we 5437 * want to support it in ip_output. 5438 */ 5439 if (frag) 5440 newsav->natt_esp_frag_len = frag->sadb_x_nat_t_frag_fraglen; 5441 #endif 5442 #endif 5443 5444 /* check SA values to be mature. */ 5445 if ((error = key_mature(newsav)) != 0) { 5446 KEY_FREESAV(&newsav); 5447 return key_senderror(so, m, error); 5448 } 5449 5450 /* 5451 * don't call key_freesav() here, as we would like to keep the SA 5452 * in the database on success. 5453 */ 5454 5455 { 5456 struct mbuf *n; 5457 5458 /* set msg buf from mhp */ 5459 n = key_getmsgbuf_x1(m, mhp); 5460 if (n == NULL) { 5461 ipseclog((LOG_DEBUG, "%s: No more memory.\n", __func__)); 5462 return key_senderror(so, m, ENOBUFS); 5463 } 5464 5465 m_freem(m); 5466 return key_sendup_mbuf(so, n, KEY_SENDUP_ALL); 5467 } 5468 } 5469 5470 /* m is retained */ 5471 static int 5472 key_setident(struct secashead *sah, struct mbuf *m, 5473 const struct sadb_msghdr *mhp) 5474 { 5475 const struct sadb_ident *idsrc, *iddst; 5476 int idsrclen, iddstlen; 5477 5478 IPSEC_ASSERT(sah != NULL, ("null secashead")); 5479 IPSEC_ASSERT(m != NULL, ("null mbuf")); 5480 IPSEC_ASSERT(mhp != NULL, ("null msghdr")); 5481 IPSEC_ASSERT(mhp->msg != NULL, ("null msg")); 5482 5483 /* don't make buffer if not there */ 5484 if (mhp->ext[SADB_EXT_IDENTITY_SRC] == NULL && 5485 mhp->ext[SADB_EXT_IDENTITY_DST] == NULL) { 5486 sah->idents = NULL; 5487 sah->identd = NULL; 5488 return 0; 5489 } 5490 5491 if (mhp->ext[SADB_EXT_IDENTITY_SRC] == NULL || 5492 mhp->ext[SADB_EXT_IDENTITY_DST] == NULL) { 5493 ipseclog((LOG_DEBUG, "%s: invalid identity.\n", __func__)); 5494 return EINVAL; 5495 } 5496 5497 idsrc = (const struct sadb_ident *)mhp->ext[SADB_EXT_IDENTITY_SRC]; 5498 iddst = (const struct sadb_ident *)mhp->ext[SADB_EXT_IDENTITY_DST]; 5499 idsrclen = mhp->extlen[SADB_EXT_IDENTITY_SRC]; 5500 iddstlen = mhp->extlen[SADB_EXT_IDENTITY_DST]; 5501 5502 /* validity check */ 5503 if (idsrc->sadb_ident_type != iddst->sadb_ident_type) { 5504 ipseclog((LOG_DEBUG, "%s: ident type mismatch.\n", __func__)); 5505 return EINVAL; 5506 } 5507 5508 switch (idsrc->sadb_ident_type) { 5509 case SADB_IDENTTYPE_PREFIX: 5510 case SADB_IDENTTYPE_FQDN: 5511 case SADB_IDENTTYPE_USERFQDN: 5512 default: 5513 /* XXX do nothing */ 5514 sah->idents = NULL; 5515 sah->identd = NULL; 5516 return 0; 5517 } 5518 5519 /* make structure */ 5520 sah->idents = malloc(sizeof(struct secident), M_IPSEC_MISC, M_NOWAIT); 5521 if (sah->idents == NULL) { 5522 ipseclog((LOG_DEBUG, "%s: No more memory.\n", __func__)); 5523 return ENOBUFS; 5524 } 5525 sah->identd = malloc(sizeof(struct secident), M_IPSEC_MISC, M_NOWAIT); 5526 if (sah->identd == NULL) { 5527 free(sah->idents, M_IPSEC_MISC); 5528 sah->idents = NULL; 5529 ipseclog((LOG_DEBUG, "%s: No more memory.\n", __func__)); 5530 return ENOBUFS; 5531 } 5532 sah->idents->type = idsrc->sadb_ident_type; 5533 sah->idents->id = idsrc->sadb_ident_id; 5534 5535 sah->identd->type = iddst->sadb_ident_type; 5536 sah->identd->id = iddst->sadb_ident_id; 5537 5538 return 0; 5539 } 5540 5541 /* 5542 * m will not be freed on return. 5543 * it is caller's responsibility to free the result. 5544 */ 5545 static struct mbuf * 5546 key_getmsgbuf_x1(struct mbuf *m, const struct sadb_msghdr *mhp) 5547 { 5548 struct mbuf *n; 5549 5550 IPSEC_ASSERT(m != NULL, ("null mbuf")); 5551 IPSEC_ASSERT(mhp != NULL, ("null msghdr")); 5552 IPSEC_ASSERT(mhp->msg != NULL, ("null msg")); 5553 5554 /* create new sadb_msg to reply. */ 5555 n = key_gather_mbuf(m, mhp, 1, 9, SADB_EXT_RESERVED, 5556 SADB_EXT_SA, SADB_X_EXT_SA2, 5557 SADB_EXT_ADDRESS_SRC, SADB_EXT_ADDRESS_DST, 5558 SADB_EXT_LIFETIME_HARD, SADB_EXT_LIFETIME_SOFT, 5559 SADB_EXT_IDENTITY_SRC, SADB_EXT_IDENTITY_DST); 5560 if (!n) 5561 return NULL; 5562 5563 if (n->m_len < sizeof(struct sadb_msg)) { 5564 n = m_pullup(n, sizeof(struct sadb_msg)); 5565 if (n == NULL) 5566 return NULL; 5567 } 5568 mtod(n, struct sadb_msg *)->sadb_msg_errno = 0; 5569 mtod(n, struct sadb_msg *)->sadb_msg_len = 5570 PFKEY_UNIT64(n->m_pkthdr.len); 5571 5572 return n; 5573 } 5574 5575 /* 5576 * SADB_DELETE processing 5577 * receive 5578 * <base, SA(*), address(SD)> 5579 * from the ikmpd, and set SADB_SASTATE_DEAD, 5580 * and send, 5581 * <base, SA(*), address(SD)> 5582 * to the ikmpd. 5583 * 5584 * m will always be freed. 5585 */ 5586 static int 5587 key_delete(struct socket *so, struct mbuf *m, const struct sadb_msghdr *mhp) 5588 { 5589 struct sadb_sa *sa0; 5590 struct sadb_address *src0, *dst0; 5591 struct secasindex saidx; 5592 struct secashead *sah; 5593 struct secasvar *sav = NULL; 5594 u_int16_t proto; 5595 5596 IPSEC_ASSERT(so != NULL, ("null socket")); 5597 IPSEC_ASSERT(m != NULL, ("null mbuf")); 5598 IPSEC_ASSERT(mhp != NULL, ("null msghdr")); 5599 IPSEC_ASSERT(mhp->msg != NULL, ("null msg")); 5600 5601 /* map satype to proto */ 5602 if ((proto = key_satype2proto(mhp->msg->sadb_msg_satype)) == 0) { 5603 ipseclog((LOG_DEBUG, "%s: invalid satype is passed.\n", 5604 __func__)); 5605 return key_senderror(so, m, EINVAL); 5606 } 5607 5608 if (mhp->ext[SADB_EXT_ADDRESS_SRC] == NULL || 5609 mhp->ext[SADB_EXT_ADDRESS_DST] == NULL) { 5610 ipseclog((LOG_DEBUG, "%s: invalid message is passed.\n", 5611 __func__)); 5612 return key_senderror(so, m, EINVAL); 5613 } 5614 5615 if (mhp->extlen[SADB_EXT_ADDRESS_SRC] < sizeof(struct sadb_address) || 5616 mhp->extlen[SADB_EXT_ADDRESS_DST] < sizeof(struct sadb_address)) { 5617 ipseclog((LOG_DEBUG, "%s: invalid message is passed.\n", 5618 __func__)); 5619 return key_senderror(so, m, EINVAL); 5620 } 5621 5622 if (mhp->ext[SADB_EXT_SA] == NULL) { 5623 /* 5624 * Caller wants us to delete all non-LARVAL SAs 5625 * that match the src/dst. This is used during 5626 * IKE INITIAL-CONTACT. 5627 */ 5628 ipseclog((LOG_DEBUG, "%s: doing delete all.\n", __func__)); 5629 return key_delete_all(so, m, mhp, proto); 5630 } else if (mhp->extlen[SADB_EXT_SA] < sizeof(struct sadb_sa)) { 5631 ipseclog((LOG_DEBUG, "%s: invalid message is passed.\n", 5632 __func__)); 5633 return key_senderror(so, m, EINVAL); 5634 } 5635 5636 sa0 = (struct sadb_sa *)mhp->ext[SADB_EXT_SA]; 5637 src0 = (struct sadb_address *)(mhp->ext[SADB_EXT_ADDRESS_SRC]); 5638 dst0 = (struct sadb_address *)(mhp->ext[SADB_EXT_ADDRESS_DST]); 5639 5640 /* XXX boundary check against sa_len */ 5641 KEY_SETSECASIDX(proto, IPSEC_MODE_ANY, 0, src0 + 1, dst0 + 1, &saidx); 5642 5643 /* 5644 * Make sure the port numbers are zero. 5645 * In case of NAT-T we will update them later if needed. 5646 */ 5647 KEY_PORTTOSADDR(&saidx.src, 0); 5648 KEY_PORTTOSADDR(&saidx.dst, 0); 5649 5650 #ifdef IPSEC_NAT_T 5651 /* 5652 * Handle NAT-T info if present. 5653 */ 5654 if (mhp->ext[SADB_X_EXT_NAT_T_SPORT] != NULL && 5655 mhp->ext[SADB_X_EXT_NAT_T_DPORT] != NULL) { 5656 struct sadb_x_nat_t_port *sport, *dport; 5657 5658 if (mhp->extlen[SADB_X_EXT_NAT_T_SPORT] < sizeof(*sport) || 5659 mhp->extlen[SADB_X_EXT_NAT_T_DPORT] < sizeof(*dport)) { 5660 ipseclog((LOG_DEBUG, "%s: invalid message.\n", 5661 __func__)); 5662 return key_senderror(so, m, EINVAL); 5663 } 5664 5665 sport = (struct sadb_x_nat_t_port *) 5666 mhp->ext[SADB_X_EXT_NAT_T_SPORT]; 5667 dport = (struct sadb_x_nat_t_port *) 5668 mhp->ext[SADB_X_EXT_NAT_T_DPORT]; 5669 5670 if (sport) 5671 KEY_PORTTOSADDR(&saidx.src, 5672 sport->sadb_x_nat_t_port_port); 5673 if (dport) 5674 KEY_PORTTOSADDR(&saidx.dst, 5675 dport->sadb_x_nat_t_port_port); 5676 } 5677 #endif 5678 5679 /* get a SA header */ 5680 SAHTREE_LOCK(); 5681 LIST_FOREACH(sah, &V_sahtree, chain) { 5682 if (sah->state == SADB_SASTATE_DEAD) 5683 continue; 5684 if (key_cmpsaidx(&sah->saidx, &saidx, CMP_HEAD) == 0) 5685 continue; 5686 5687 /* get a SA with SPI. */ 5688 sav = key_getsavbyspi(sah, sa0->sadb_sa_spi); 5689 if (sav) 5690 break; 5691 } 5692 if (sah == NULL) { 5693 SAHTREE_UNLOCK(); 5694 ipseclog((LOG_DEBUG, "%s: no SA found.\n", __func__)); 5695 return key_senderror(so, m, ENOENT); 5696 } 5697 5698 key_sa_chgstate(sav, SADB_SASTATE_DEAD); 5699 KEY_FREESAV(&sav); 5700 SAHTREE_UNLOCK(); 5701 5702 { 5703 struct mbuf *n; 5704 struct sadb_msg *newmsg; 5705 5706 /* create new sadb_msg to reply. */ 5707 /* XXX-BZ NAT-T extensions? */ 5708 n = key_gather_mbuf(m, mhp, 1, 4, SADB_EXT_RESERVED, 5709 SADB_EXT_SA, SADB_EXT_ADDRESS_SRC, SADB_EXT_ADDRESS_DST); 5710 if (!n) 5711 return key_senderror(so, m, ENOBUFS); 5712 5713 if (n->m_len < sizeof(struct sadb_msg)) { 5714 n = m_pullup(n, sizeof(struct sadb_msg)); 5715 if (n == NULL) 5716 return key_senderror(so, m, ENOBUFS); 5717 } 5718 newmsg = mtod(n, struct sadb_msg *); 5719 newmsg->sadb_msg_errno = 0; 5720 newmsg->sadb_msg_len = PFKEY_UNIT64(n->m_pkthdr.len); 5721 5722 m_freem(m); 5723 return key_sendup_mbuf(so, n, KEY_SENDUP_ALL); 5724 } 5725 } 5726 5727 /* 5728 * delete all SAs for src/dst. Called from key_delete(). 5729 */ 5730 static int 5731 key_delete_all(struct socket *so, struct mbuf *m, 5732 const struct sadb_msghdr *mhp, u_int16_t proto) 5733 { 5734 struct sadb_address *src0, *dst0; 5735 struct secasindex saidx; 5736 struct secashead *sah; 5737 struct secasvar *sav, *nextsav; 5738 u_int stateidx, state; 5739 5740 src0 = (struct sadb_address *)(mhp->ext[SADB_EXT_ADDRESS_SRC]); 5741 dst0 = (struct sadb_address *)(mhp->ext[SADB_EXT_ADDRESS_DST]); 5742 5743 /* XXX boundary check against sa_len */ 5744 KEY_SETSECASIDX(proto, IPSEC_MODE_ANY, 0, src0 + 1, dst0 + 1, &saidx); 5745 5746 /* 5747 * Make sure the port numbers are zero. 5748 * In case of NAT-T we will update them later if needed. 5749 */ 5750 KEY_PORTTOSADDR(&saidx.src, 0); 5751 KEY_PORTTOSADDR(&saidx.dst, 0); 5752 5753 #ifdef IPSEC_NAT_T 5754 /* 5755 * Handle NAT-T info if present. 5756 */ 5757 5758 if (mhp->ext[SADB_X_EXT_NAT_T_SPORT] != NULL && 5759 mhp->ext[SADB_X_EXT_NAT_T_DPORT] != NULL) { 5760 struct sadb_x_nat_t_port *sport, *dport; 5761 5762 if (mhp->extlen[SADB_X_EXT_NAT_T_SPORT] < sizeof(*sport) || 5763 mhp->extlen[SADB_X_EXT_NAT_T_DPORT] < sizeof(*dport)) { 5764 ipseclog((LOG_DEBUG, "%s: invalid message.\n", 5765 __func__)); 5766 return key_senderror(so, m, EINVAL); 5767 } 5768 5769 sport = (struct sadb_x_nat_t_port *) 5770 mhp->ext[SADB_X_EXT_NAT_T_SPORT]; 5771 dport = (struct sadb_x_nat_t_port *) 5772 mhp->ext[SADB_X_EXT_NAT_T_DPORT]; 5773 5774 if (sport) 5775 KEY_PORTTOSADDR(&saidx.src, 5776 sport->sadb_x_nat_t_port_port); 5777 if (dport) 5778 KEY_PORTTOSADDR(&saidx.dst, 5779 dport->sadb_x_nat_t_port_port); 5780 } 5781 #endif 5782 5783 SAHTREE_LOCK(); 5784 LIST_FOREACH(sah, &V_sahtree, chain) { 5785 if (sah->state == SADB_SASTATE_DEAD) 5786 continue; 5787 if (key_cmpsaidx(&sah->saidx, &saidx, CMP_HEAD) == 0) 5788 continue; 5789 5790 /* Delete all non-LARVAL SAs. */ 5791 for (stateidx = 0; 5792 stateidx < _ARRAYLEN(saorder_state_alive); 5793 stateidx++) { 5794 state = saorder_state_alive[stateidx]; 5795 if (state == SADB_SASTATE_LARVAL) 5796 continue; 5797 for (sav = LIST_FIRST(&sah->savtree[state]); 5798 sav != NULL; sav = nextsav) { 5799 nextsav = LIST_NEXT(sav, chain); 5800 /* sanity check */ 5801 if (sav->state != state) { 5802 ipseclog((LOG_DEBUG, "%s: invalid " 5803 "sav->state (queue %d SA %d)\n", 5804 __func__, state, sav->state)); 5805 continue; 5806 } 5807 5808 key_sa_chgstate(sav, SADB_SASTATE_DEAD); 5809 KEY_FREESAV(&sav); 5810 } 5811 } 5812 } 5813 SAHTREE_UNLOCK(); 5814 { 5815 struct mbuf *n; 5816 struct sadb_msg *newmsg; 5817 5818 /* create new sadb_msg to reply. */ 5819 /* XXX-BZ NAT-T extensions? */ 5820 n = key_gather_mbuf(m, mhp, 1, 3, SADB_EXT_RESERVED, 5821 SADB_EXT_ADDRESS_SRC, SADB_EXT_ADDRESS_DST); 5822 if (!n) 5823 return key_senderror(so, m, ENOBUFS); 5824 5825 if (n->m_len < sizeof(struct sadb_msg)) { 5826 n = m_pullup(n, sizeof(struct sadb_msg)); 5827 if (n == NULL) 5828 return key_senderror(so, m, ENOBUFS); 5829 } 5830 newmsg = mtod(n, struct sadb_msg *); 5831 newmsg->sadb_msg_errno = 0; 5832 newmsg->sadb_msg_len = PFKEY_UNIT64(n->m_pkthdr.len); 5833 5834 m_freem(m); 5835 return key_sendup_mbuf(so, n, KEY_SENDUP_ALL); 5836 } 5837 } 5838 5839 /* 5840 * SADB_GET processing 5841 * receive 5842 * <base, SA(*), address(SD)> 5843 * from the ikmpd, and get a SP and a SA to respond, 5844 * and send, 5845 * <base, SA, (lifetime(HSC),) address(SD), (address(P),) key(AE), 5846 * (identity(SD),) (sensitivity)> 5847 * to the ikmpd. 5848 * 5849 * m will always be freed. 5850 */ 5851 static int 5852 key_get(struct socket *so, struct mbuf *m, const struct sadb_msghdr *mhp) 5853 { 5854 struct sadb_sa *sa0; 5855 struct sadb_address *src0, *dst0; 5856 struct secasindex saidx; 5857 struct secashead *sah; 5858 struct secasvar *sav = NULL; 5859 u_int16_t proto; 5860 5861 IPSEC_ASSERT(so != NULL, ("null socket")); 5862 IPSEC_ASSERT(m != NULL, ("null mbuf")); 5863 IPSEC_ASSERT(mhp != NULL, ("null msghdr")); 5864 IPSEC_ASSERT(mhp->msg != NULL, ("null msg")); 5865 5866 /* map satype to proto */ 5867 if ((proto = key_satype2proto(mhp->msg->sadb_msg_satype)) == 0) { 5868 ipseclog((LOG_DEBUG, "%s: invalid satype is passed.\n", 5869 __func__)); 5870 return key_senderror(so, m, EINVAL); 5871 } 5872 5873 if (mhp->ext[SADB_EXT_SA] == NULL || 5874 mhp->ext[SADB_EXT_ADDRESS_SRC] == NULL || 5875 mhp->ext[SADB_EXT_ADDRESS_DST] == NULL) { 5876 ipseclog((LOG_DEBUG, "%s: invalid message is passed.\n", 5877 __func__)); 5878 return key_senderror(so, m, EINVAL); 5879 } 5880 if (mhp->extlen[SADB_EXT_SA] < sizeof(struct sadb_sa) || 5881 mhp->extlen[SADB_EXT_ADDRESS_SRC] < sizeof(struct sadb_address) || 5882 mhp->extlen[SADB_EXT_ADDRESS_DST] < sizeof(struct sadb_address)) { 5883 ipseclog((LOG_DEBUG, "%s: invalid message is passed.\n", 5884 __func__)); 5885 return key_senderror(so, m, EINVAL); 5886 } 5887 5888 sa0 = (struct sadb_sa *)mhp->ext[SADB_EXT_SA]; 5889 src0 = (struct sadb_address *)mhp->ext[SADB_EXT_ADDRESS_SRC]; 5890 dst0 = (struct sadb_address *)mhp->ext[SADB_EXT_ADDRESS_DST]; 5891 5892 /* XXX boundary check against sa_len */ 5893 KEY_SETSECASIDX(proto, IPSEC_MODE_ANY, 0, src0 + 1, dst0 + 1, &saidx); 5894 5895 /* 5896 * Make sure the port numbers are zero. 5897 * In case of NAT-T we will update them later if needed. 5898 */ 5899 KEY_PORTTOSADDR(&saidx.src, 0); 5900 KEY_PORTTOSADDR(&saidx.dst, 0); 5901 5902 #ifdef IPSEC_NAT_T 5903 /* 5904 * Handle NAT-T info if present. 5905 */ 5906 5907 if (mhp->ext[SADB_X_EXT_NAT_T_SPORT] != NULL && 5908 mhp->ext[SADB_X_EXT_NAT_T_DPORT] != NULL) { 5909 struct sadb_x_nat_t_port *sport, *dport; 5910 5911 if (mhp->extlen[SADB_X_EXT_NAT_T_SPORT] < sizeof(*sport) || 5912 mhp->extlen[SADB_X_EXT_NAT_T_DPORT] < sizeof(*dport)) { 5913 ipseclog((LOG_DEBUG, "%s: invalid message.\n", 5914 __func__)); 5915 return key_senderror(so, m, EINVAL); 5916 } 5917 5918 sport = (struct sadb_x_nat_t_port *) 5919 mhp->ext[SADB_X_EXT_NAT_T_SPORT]; 5920 dport = (struct sadb_x_nat_t_port *) 5921 mhp->ext[SADB_X_EXT_NAT_T_DPORT]; 5922 5923 if (sport) 5924 KEY_PORTTOSADDR(&saidx.src, 5925 sport->sadb_x_nat_t_port_port); 5926 if (dport) 5927 KEY_PORTTOSADDR(&saidx.dst, 5928 dport->sadb_x_nat_t_port_port); 5929 } 5930 #endif 5931 5932 /* get a SA header */ 5933 SAHTREE_LOCK(); 5934 LIST_FOREACH(sah, &V_sahtree, chain) { 5935 if (sah->state == SADB_SASTATE_DEAD) 5936 continue; 5937 if (key_cmpsaidx(&sah->saidx, &saidx, CMP_HEAD) == 0) 5938 continue; 5939 5940 /* get a SA with SPI. */ 5941 sav = key_getsavbyspi(sah, sa0->sadb_sa_spi); 5942 if (sav) 5943 break; 5944 } 5945 SAHTREE_UNLOCK(); 5946 if (sah == NULL) { 5947 ipseclog((LOG_DEBUG, "%s: no SA found.\n", __func__)); 5948 return key_senderror(so, m, ENOENT); 5949 } 5950 5951 { 5952 struct mbuf *n; 5953 u_int8_t satype; 5954 5955 /* map proto to satype */ 5956 if ((satype = key_proto2satype(sah->saidx.proto)) == 0) { 5957 ipseclog((LOG_DEBUG, "%s: there was invalid proto in SAD.\n", 5958 __func__)); 5959 return key_senderror(so, m, EINVAL); 5960 } 5961 5962 /* create new sadb_msg to reply. */ 5963 n = key_setdumpsa(sav, SADB_GET, satype, mhp->msg->sadb_msg_seq, 5964 mhp->msg->sadb_msg_pid); 5965 if (!n) 5966 return key_senderror(so, m, ENOBUFS); 5967 5968 m_freem(m); 5969 return key_sendup_mbuf(so, n, KEY_SENDUP_ONE); 5970 } 5971 } 5972 5973 /* XXX make it sysctl-configurable? */ 5974 static void 5975 key_getcomb_setlifetime(struct sadb_comb *comb) 5976 { 5977 5978 comb->sadb_comb_soft_allocations = 1; 5979 comb->sadb_comb_hard_allocations = 1; 5980 comb->sadb_comb_soft_bytes = 0; 5981 comb->sadb_comb_hard_bytes = 0; 5982 comb->sadb_comb_hard_addtime = 86400; /* 1 day */ 5983 comb->sadb_comb_soft_addtime = comb->sadb_comb_soft_addtime * 80 / 100; 5984 comb->sadb_comb_soft_usetime = 28800; /* 8 hours */ 5985 comb->sadb_comb_hard_usetime = comb->sadb_comb_hard_usetime * 80 / 100; 5986 } 5987 5988 /* 5989 * XXX reorder combinations by preference 5990 * XXX no idea if the user wants ESP authentication or not 5991 */ 5992 static struct mbuf * 5993 key_getcomb_esp() 5994 { 5995 struct sadb_comb *comb; 5996 struct enc_xform *algo; 5997 struct mbuf *result = NULL, *m, *n; 5998 int encmin; 5999 int i, off, o; 6000 int totlen; 6001 const int l = PFKEY_ALIGN8(sizeof(struct sadb_comb)); 6002 6003 m = NULL; 6004 for (i = 1; i <= SADB_EALG_MAX; i++) { 6005 algo = esp_algorithm_lookup(i); 6006 if (algo == NULL) 6007 continue; 6008 6009 /* discard algorithms with key size smaller than system min */ 6010 if (_BITS(algo->maxkey) < V_ipsec_esp_keymin) 6011 continue; 6012 if (_BITS(algo->minkey) < V_ipsec_esp_keymin) 6013 encmin = V_ipsec_esp_keymin; 6014 else 6015 encmin = _BITS(algo->minkey); 6016 6017 if (V_ipsec_esp_auth) 6018 m = key_getcomb_ah(); 6019 else { 6020 IPSEC_ASSERT(l <= MLEN, 6021 ("l=%u > MLEN=%lu", l, (u_long) MLEN)); 6022 MGET(m, M_NOWAIT, MT_DATA); 6023 if (m) { 6024 M_ALIGN(m, l); 6025 m->m_len = l; 6026 m->m_next = NULL; 6027 bzero(mtod(m, caddr_t), m->m_len); 6028 } 6029 } 6030 if (!m) 6031 goto fail; 6032 6033 totlen = 0; 6034 for (n = m; n; n = n->m_next) 6035 totlen += n->m_len; 6036 IPSEC_ASSERT((totlen % l) == 0, ("totlen=%u, l=%u", totlen, l)); 6037 6038 for (off = 0; off < totlen; off += l) { 6039 n = m_pulldown(m, off, l, &o); 6040 if (!n) { 6041 /* m is already freed */ 6042 goto fail; 6043 } 6044 comb = (struct sadb_comb *)(mtod(n, caddr_t) + o); 6045 bzero(comb, sizeof(*comb)); 6046 key_getcomb_setlifetime(comb); 6047 comb->sadb_comb_encrypt = i; 6048 comb->sadb_comb_encrypt_minbits = encmin; 6049 comb->sadb_comb_encrypt_maxbits = _BITS(algo->maxkey); 6050 } 6051 6052 if (!result) 6053 result = m; 6054 else 6055 m_cat(result, m); 6056 } 6057 6058 return result; 6059 6060 fail: 6061 if (result) 6062 m_freem(result); 6063 return NULL; 6064 } 6065 6066 static void 6067 key_getsizes_ah(const struct auth_hash *ah, int alg, u_int16_t* min, 6068 u_int16_t* max) 6069 { 6070 6071 *min = *max = ah->keysize; 6072 if (ah->keysize == 0) { 6073 /* 6074 * Transform takes arbitrary key size but algorithm 6075 * key size is restricted. Enforce this here. 6076 */ 6077 switch (alg) { 6078 case SADB_X_AALG_MD5: *min = *max = 16; break; 6079 case SADB_X_AALG_SHA: *min = *max = 20; break; 6080 case SADB_X_AALG_NULL: *min = 1; *max = 256; break; 6081 case SADB_X_AALG_SHA2_256: *min = *max = 32; break; 6082 case SADB_X_AALG_SHA2_384: *min = *max = 48; break; 6083 case SADB_X_AALG_SHA2_512: *min = *max = 64; break; 6084 default: 6085 DPRINTF(("%s: unknown AH algorithm %u\n", 6086 __func__, alg)); 6087 break; 6088 } 6089 } 6090 } 6091 6092 /* 6093 * XXX reorder combinations by preference 6094 */ 6095 static struct mbuf * 6096 key_getcomb_ah() 6097 { 6098 struct sadb_comb *comb; 6099 struct auth_hash *algo; 6100 struct mbuf *m; 6101 u_int16_t minkeysize, maxkeysize; 6102 int i; 6103 const int l = PFKEY_ALIGN8(sizeof(struct sadb_comb)); 6104 6105 m = NULL; 6106 for (i = 1; i <= SADB_AALG_MAX; i++) { 6107 #if 1 6108 /* we prefer HMAC algorithms, not old algorithms */ 6109 if (i != SADB_AALG_SHA1HMAC && 6110 i != SADB_AALG_MD5HMAC && 6111 i != SADB_X_AALG_SHA2_256 && 6112 i != SADB_X_AALG_SHA2_384 && 6113 i != SADB_X_AALG_SHA2_512) 6114 continue; 6115 #endif 6116 algo = ah_algorithm_lookup(i); 6117 if (!algo) 6118 continue; 6119 key_getsizes_ah(algo, i, &minkeysize, &maxkeysize); 6120 /* discard algorithms with key size smaller than system min */ 6121 if (_BITS(minkeysize) < V_ipsec_ah_keymin) 6122 continue; 6123 6124 if (!m) { 6125 IPSEC_ASSERT(l <= MLEN, 6126 ("l=%u > MLEN=%lu", l, (u_long) MLEN)); 6127 MGET(m, M_NOWAIT, MT_DATA); 6128 if (m) { 6129 M_ALIGN(m, l); 6130 m->m_len = l; 6131 m->m_next = NULL; 6132 } 6133 } else 6134 M_PREPEND(m, l, M_NOWAIT); 6135 if (!m) 6136 return NULL; 6137 6138 comb = mtod(m, struct sadb_comb *); 6139 bzero(comb, sizeof(*comb)); 6140 key_getcomb_setlifetime(comb); 6141 comb->sadb_comb_auth = i; 6142 comb->sadb_comb_auth_minbits = _BITS(minkeysize); 6143 comb->sadb_comb_auth_maxbits = _BITS(maxkeysize); 6144 } 6145 6146 return m; 6147 } 6148 6149 /* 6150 * not really an official behavior. discussed in pf_key@inner.net in Sep2000. 6151 * XXX reorder combinations by preference 6152 */ 6153 static struct mbuf * 6154 key_getcomb_ipcomp() 6155 { 6156 struct sadb_comb *comb; 6157 struct comp_algo *algo; 6158 struct mbuf *m; 6159 int i; 6160 const int l = PFKEY_ALIGN8(sizeof(struct sadb_comb)); 6161 6162 m = NULL; 6163 for (i = 1; i <= SADB_X_CALG_MAX; i++) { 6164 algo = ipcomp_algorithm_lookup(i); 6165 if (!algo) 6166 continue; 6167 6168 if (!m) { 6169 IPSEC_ASSERT(l <= MLEN, 6170 ("l=%u > MLEN=%lu", l, (u_long) MLEN)); 6171 MGET(m, M_NOWAIT, MT_DATA); 6172 if (m) { 6173 M_ALIGN(m, l); 6174 m->m_len = l; 6175 m->m_next = NULL; 6176 } 6177 } else 6178 M_PREPEND(m, l, M_NOWAIT); 6179 if (!m) 6180 return NULL; 6181 6182 comb = mtod(m, struct sadb_comb *); 6183 bzero(comb, sizeof(*comb)); 6184 key_getcomb_setlifetime(comb); 6185 comb->sadb_comb_encrypt = i; 6186 /* what should we set into sadb_comb_*_{min,max}bits? */ 6187 } 6188 6189 return m; 6190 } 6191 6192 /* 6193 * XXX no way to pass mode (transport/tunnel) to userland 6194 * XXX replay checking? 6195 * XXX sysctl interface to ipsec_{ah,esp}_keymin 6196 */ 6197 static struct mbuf * 6198 key_getprop(const struct secasindex *saidx) 6199 { 6200 struct sadb_prop *prop; 6201 struct mbuf *m, *n; 6202 const int l = PFKEY_ALIGN8(sizeof(struct sadb_prop)); 6203 int totlen; 6204 6205 switch (saidx->proto) { 6206 case IPPROTO_ESP: 6207 m = key_getcomb_esp(); 6208 break; 6209 case IPPROTO_AH: 6210 m = key_getcomb_ah(); 6211 break; 6212 case IPPROTO_IPCOMP: 6213 m = key_getcomb_ipcomp(); 6214 break; 6215 default: 6216 return NULL; 6217 } 6218 6219 if (!m) 6220 return NULL; 6221 M_PREPEND(m, l, M_NOWAIT); 6222 if (!m) 6223 return NULL; 6224 6225 totlen = 0; 6226 for (n = m; n; n = n->m_next) 6227 totlen += n->m_len; 6228 6229 prop = mtod(m, struct sadb_prop *); 6230 bzero(prop, sizeof(*prop)); 6231 prop->sadb_prop_len = PFKEY_UNIT64(totlen); 6232 prop->sadb_prop_exttype = SADB_EXT_PROPOSAL; 6233 prop->sadb_prop_replay = 32; /* XXX */ 6234 6235 return m; 6236 } 6237 6238 /* 6239 * SADB_ACQUIRE processing called by key_checkrequest() and key_acquire2(). 6240 * send 6241 * <base, SA, address(SD), (address(P)), x_policy, 6242 * (identity(SD),) (sensitivity,) proposal> 6243 * to KMD, and expect to receive 6244 * <base> with SADB_ACQUIRE if error occurred, 6245 * or 6246 * <base, src address, dst address, (SPI range)> with SADB_GETSPI 6247 * from KMD by PF_KEY. 6248 * 6249 * XXX x_policy is outside of RFC2367 (KAME extension). 6250 * XXX sensitivity is not supported. 6251 * XXX for ipcomp, RFC2367 does not define how to fill in proposal. 6252 * see comment for key_getcomb_ipcomp(). 6253 * 6254 * OUT: 6255 * 0 : succeed 6256 * others: error number 6257 */ 6258 static int 6259 key_acquire(const struct secasindex *saidx, struct secpolicy *sp) 6260 { 6261 union sockaddr_union addr; 6262 struct mbuf *result, *m; 6263 struct secacq *newacq; 6264 u_int32_t seq; 6265 int error; 6266 u_int16_t ul_proto; 6267 u_int8_t mask, satype; 6268 6269 IPSEC_ASSERT(saidx != NULL, ("null saidx")); 6270 satype = key_proto2satype(saidx->proto); 6271 IPSEC_ASSERT(satype != 0, ("null satype, protocol %u", saidx->proto)); 6272 6273 error = -1; 6274 result = NULL; 6275 ul_proto = IPSEC_ULPROTO_ANY; 6276 /* 6277 * We never do anything about acquirng SA. There is anather 6278 * solution that kernel blocks to send SADB_ACQUIRE message until 6279 * getting something message from IKEd. In later case, to be 6280 * managed with ACQUIRING list. 6281 */ 6282 /* Get an entry to check whether sending message or not. */ 6283 if ((newacq = key_getacq(saidx)) != NULL) { 6284 if (V_key_blockacq_count < newacq->count) { 6285 /* reset counter and do send message. */ 6286 newacq->count = 0; 6287 } else { 6288 /* increment counter and do nothing. */ 6289 newacq->count++; 6290 return 0; 6291 } 6292 } else { 6293 /* make new entry for blocking to send SADB_ACQUIRE. */ 6294 if ((newacq = key_newacq(saidx)) == NULL) 6295 return ENOBUFS; 6296 } 6297 6298 6299 seq = newacq->seq; 6300 m = key_setsadbmsg(SADB_ACQUIRE, 0, satype, seq, 0, 0); 6301 if (!m) { 6302 error = ENOBUFS; 6303 goto fail; 6304 } 6305 result = m; 6306 6307 /* 6308 * No SADB_X_EXT_NAT_T_* here: we do not know 6309 * anything related to NAT-T at this time. 6310 */ 6311 6312 /* 6313 * set sadb_address for saidx's. 6314 * 6315 * Note that if sp is supplied, then we're being called from 6316 * key_checkrequest and should supply port and protocol information. 6317 */ 6318 if (sp != NULL && (sp->spidx.ul_proto == IPPROTO_TCP || 6319 sp->spidx.ul_proto == IPPROTO_UDP)) 6320 ul_proto = sp->spidx.ul_proto; 6321 6322 addr = saidx->src; 6323 mask = FULLMASK; 6324 if (ul_proto != IPSEC_ULPROTO_ANY) { 6325 switch (sp->spidx.src.sa.sa_family) { 6326 case AF_INET: 6327 if (sp->spidx.src.sin.sin_port != IPSEC_PORT_ANY) { 6328 addr.sin.sin_port = sp->spidx.src.sin.sin_port; 6329 mask = sp->spidx.prefs; 6330 } 6331 break; 6332 case AF_INET6: 6333 if (sp->spidx.src.sin6.sin6_port != IPSEC_PORT_ANY) { 6334 addr.sin6.sin6_port = sp->spidx.src.sin6.sin6_port; 6335 mask = sp->spidx.prefs; 6336 } 6337 break; 6338 default: 6339 break; 6340 } 6341 } 6342 m = key_setsadbaddr(SADB_EXT_ADDRESS_SRC, &addr.sa, mask, ul_proto); 6343 if (!m) { 6344 error = ENOBUFS; 6345 goto fail; 6346 } 6347 m_cat(result, m); 6348 6349 addr = saidx->dst; 6350 mask = FULLMASK; 6351 if (ul_proto != IPSEC_ULPROTO_ANY) { 6352 switch (sp->spidx.dst.sa.sa_family) { 6353 case AF_INET: 6354 if (sp->spidx.dst.sin.sin_port != IPSEC_PORT_ANY) { 6355 addr.sin.sin_port = sp->spidx.dst.sin.sin_port; 6356 mask = sp->spidx.prefd; 6357 } 6358 break; 6359 case AF_INET6: 6360 if (sp->spidx.dst.sin6.sin6_port != IPSEC_PORT_ANY) { 6361 addr.sin6.sin6_port = sp->spidx.dst.sin6.sin6_port; 6362 mask = sp->spidx.prefd; 6363 } 6364 break; 6365 default: 6366 break; 6367 } 6368 } 6369 m = key_setsadbaddr(SADB_EXT_ADDRESS_DST, &addr.sa, mask, ul_proto); 6370 if (!m) { 6371 error = ENOBUFS; 6372 goto fail; 6373 } 6374 m_cat(result, m); 6375 6376 /* XXX proxy address (optional) */ 6377 6378 /* set sadb_x_policy */ 6379 if (sp) { 6380 m = key_setsadbxpolicy(sp->policy, sp->spidx.dir, sp->id, sp->priority); 6381 if (!m) { 6382 error = ENOBUFS; 6383 goto fail; 6384 } 6385 m_cat(result, m); 6386 } 6387 6388 /* XXX identity (optional) */ 6389 #if 0 6390 if (idexttype && fqdn) { 6391 /* create identity extension (FQDN) */ 6392 struct sadb_ident *id; 6393 int fqdnlen; 6394 6395 fqdnlen = strlen(fqdn) + 1; /* +1 for terminating-NUL */ 6396 id = (struct sadb_ident *)p; 6397 bzero(id, sizeof(*id) + PFKEY_ALIGN8(fqdnlen)); 6398 id->sadb_ident_len = PFKEY_UNIT64(sizeof(*id) + PFKEY_ALIGN8(fqdnlen)); 6399 id->sadb_ident_exttype = idexttype; 6400 id->sadb_ident_type = SADB_IDENTTYPE_FQDN; 6401 bcopy(fqdn, id + 1, fqdnlen); 6402 p += sizeof(struct sadb_ident) + PFKEY_ALIGN8(fqdnlen); 6403 } 6404 6405 if (idexttype) { 6406 /* create identity extension (USERFQDN) */ 6407 struct sadb_ident *id; 6408 int userfqdnlen; 6409 6410 if (userfqdn) { 6411 /* +1 for terminating-NUL */ 6412 userfqdnlen = strlen(userfqdn) + 1; 6413 } else 6414 userfqdnlen = 0; 6415 id = (struct sadb_ident *)p; 6416 bzero(id, sizeof(*id) + PFKEY_ALIGN8(userfqdnlen)); 6417 id->sadb_ident_len = PFKEY_UNIT64(sizeof(*id) + PFKEY_ALIGN8(userfqdnlen)); 6418 id->sadb_ident_exttype = idexttype; 6419 id->sadb_ident_type = SADB_IDENTTYPE_USERFQDN; 6420 /* XXX is it correct? */ 6421 if (curproc && curproc->p_cred) 6422 id->sadb_ident_id = curproc->p_cred->p_ruid; 6423 if (userfqdn && userfqdnlen) 6424 bcopy(userfqdn, id + 1, userfqdnlen); 6425 p += sizeof(struct sadb_ident) + PFKEY_ALIGN8(userfqdnlen); 6426 } 6427 #endif 6428 6429 /* XXX sensitivity (optional) */ 6430 6431 /* create proposal/combination extension */ 6432 m = key_getprop(saidx); 6433 #if 0 6434 /* 6435 * spec conformant: always attach proposal/combination extension, 6436 * the problem is that we have no way to attach it for ipcomp, 6437 * due to the way sadb_comb is declared in RFC2367. 6438 */ 6439 if (!m) { 6440 error = ENOBUFS; 6441 goto fail; 6442 } 6443 m_cat(result, m); 6444 #else 6445 /* 6446 * outside of spec; make proposal/combination extension optional. 6447 */ 6448 if (m) 6449 m_cat(result, m); 6450 #endif 6451 6452 if ((result->m_flags & M_PKTHDR) == 0) { 6453 error = EINVAL; 6454 goto fail; 6455 } 6456 6457 if (result->m_len < sizeof(struct sadb_msg)) { 6458 result = m_pullup(result, sizeof(struct sadb_msg)); 6459 if (result == NULL) { 6460 error = ENOBUFS; 6461 goto fail; 6462 } 6463 } 6464 6465 result->m_pkthdr.len = 0; 6466 for (m = result; m; m = m->m_next) 6467 result->m_pkthdr.len += m->m_len; 6468 6469 mtod(result, struct sadb_msg *)->sadb_msg_len = 6470 PFKEY_UNIT64(result->m_pkthdr.len); 6471 6472 return key_sendup_mbuf(NULL, result, KEY_SENDUP_REGISTERED); 6473 6474 fail: 6475 if (result) 6476 m_freem(result); 6477 return error; 6478 } 6479 6480 static struct secacq * 6481 key_newacq(const struct secasindex *saidx) 6482 { 6483 struct secacq *newacq; 6484 6485 /* get new entry */ 6486 newacq = malloc(sizeof(struct secacq), M_IPSEC_SAQ, M_NOWAIT|M_ZERO); 6487 if (newacq == NULL) { 6488 ipseclog((LOG_DEBUG, "%s: No more memory.\n", __func__)); 6489 return NULL; 6490 } 6491 6492 /* copy secindex */ 6493 bcopy(saidx, &newacq->saidx, sizeof(newacq->saidx)); 6494 newacq->seq = (V_acq_seq == ~0 ? 1 : ++V_acq_seq); 6495 newacq->created = time_second; 6496 newacq->count = 0; 6497 6498 /* add to acqtree */ 6499 ACQ_LOCK(); 6500 LIST_INSERT_HEAD(&V_acqtree, newacq, chain); 6501 ACQ_UNLOCK(); 6502 6503 return newacq; 6504 } 6505 6506 static struct secacq * 6507 key_getacq(const struct secasindex *saidx) 6508 { 6509 struct secacq *acq; 6510 6511 ACQ_LOCK(); 6512 LIST_FOREACH(acq, &V_acqtree, chain) { 6513 if (key_cmpsaidx(saidx, &acq->saidx, CMP_EXACTLY)) 6514 break; 6515 } 6516 ACQ_UNLOCK(); 6517 6518 return acq; 6519 } 6520 6521 static struct secacq * 6522 key_getacqbyseq(u_int32_t seq) 6523 { 6524 struct secacq *acq; 6525 6526 ACQ_LOCK(); 6527 LIST_FOREACH(acq, &V_acqtree, chain) { 6528 if (acq->seq == seq) 6529 break; 6530 } 6531 ACQ_UNLOCK(); 6532 6533 return acq; 6534 } 6535 6536 static struct secspacq * 6537 key_newspacq(struct secpolicyindex *spidx) 6538 { 6539 struct secspacq *acq; 6540 6541 /* get new entry */ 6542 acq = malloc(sizeof(struct secspacq), M_IPSEC_SAQ, M_NOWAIT|M_ZERO); 6543 if (acq == NULL) { 6544 ipseclog((LOG_DEBUG, "%s: No more memory.\n", __func__)); 6545 return NULL; 6546 } 6547 6548 /* copy secindex */ 6549 bcopy(spidx, &acq->spidx, sizeof(acq->spidx)); 6550 acq->created = time_second; 6551 acq->count = 0; 6552 6553 /* add to spacqtree */ 6554 SPACQ_LOCK(); 6555 LIST_INSERT_HEAD(&V_spacqtree, acq, chain); 6556 SPACQ_UNLOCK(); 6557 6558 return acq; 6559 } 6560 6561 static struct secspacq * 6562 key_getspacq(struct secpolicyindex *spidx) 6563 { 6564 struct secspacq *acq; 6565 6566 SPACQ_LOCK(); 6567 LIST_FOREACH(acq, &V_spacqtree, chain) { 6568 if (key_cmpspidx_exactly(spidx, &acq->spidx)) { 6569 /* NB: return holding spacq_lock */ 6570 return acq; 6571 } 6572 } 6573 SPACQ_UNLOCK(); 6574 6575 return NULL; 6576 } 6577 6578 /* 6579 * SADB_ACQUIRE processing, 6580 * in first situation, is receiving 6581 * <base> 6582 * from the ikmpd, and clear sequence of its secasvar entry. 6583 * 6584 * In second situation, is receiving 6585 * <base, address(SD), (address(P),) (identity(SD),) (sensitivity,) proposal> 6586 * from a user land process, and return 6587 * <base, address(SD), (address(P),) (identity(SD),) (sensitivity,) proposal> 6588 * to the socket. 6589 * 6590 * m will always be freed. 6591 */ 6592 static int 6593 key_acquire2(struct socket *so, struct mbuf *m, const struct sadb_msghdr *mhp) 6594 { 6595 const struct sadb_address *src0, *dst0; 6596 struct secasindex saidx; 6597 struct secashead *sah; 6598 u_int16_t proto; 6599 int error; 6600 6601 IPSEC_ASSERT(so != NULL, ("null socket")); 6602 IPSEC_ASSERT(m != NULL, ("null mbuf")); 6603 IPSEC_ASSERT(mhp != NULL, ("null msghdr")); 6604 IPSEC_ASSERT(mhp->msg != NULL, ("null msg")); 6605 6606 /* 6607 * Error message from KMd. 6608 * We assume that if error was occurred in IKEd, the length of PFKEY 6609 * message is equal to the size of sadb_msg structure. 6610 * We do not raise error even if error occurred in this function. 6611 */ 6612 if (mhp->msg->sadb_msg_len == PFKEY_UNIT64(sizeof(struct sadb_msg))) { 6613 struct secacq *acq; 6614 6615 /* check sequence number */ 6616 if (mhp->msg->sadb_msg_seq == 0) { 6617 ipseclog((LOG_DEBUG, "%s: must specify sequence " 6618 "number.\n", __func__)); 6619 m_freem(m); 6620 return 0; 6621 } 6622 6623 if ((acq = key_getacqbyseq(mhp->msg->sadb_msg_seq)) == NULL) { 6624 /* 6625 * the specified larval SA is already gone, or we got 6626 * a bogus sequence number. we can silently ignore it. 6627 */ 6628 m_freem(m); 6629 return 0; 6630 } 6631 6632 /* reset acq counter in order to deletion by timehander. */ 6633 acq->created = time_second; 6634 acq->count = 0; 6635 m_freem(m); 6636 return 0; 6637 } 6638 6639 /* 6640 * This message is from user land. 6641 */ 6642 6643 /* map satype to proto */ 6644 if ((proto = key_satype2proto(mhp->msg->sadb_msg_satype)) == 0) { 6645 ipseclog((LOG_DEBUG, "%s: invalid satype is passed.\n", 6646 __func__)); 6647 return key_senderror(so, m, EINVAL); 6648 } 6649 6650 if (mhp->ext[SADB_EXT_ADDRESS_SRC] == NULL || 6651 mhp->ext[SADB_EXT_ADDRESS_DST] == NULL || 6652 mhp->ext[SADB_EXT_PROPOSAL] == NULL) { 6653 /* error */ 6654 ipseclog((LOG_DEBUG, "%s: invalid message is passed.\n", 6655 __func__)); 6656 return key_senderror(so, m, EINVAL); 6657 } 6658 if (mhp->extlen[SADB_EXT_ADDRESS_SRC] < sizeof(struct sadb_address) || 6659 mhp->extlen[SADB_EXT_ADDRESS_DST] < sizeof(struct sadb_address) || 6660 mhp->extlen[SADB_EXT_PROPOSAL] < sizeof(struct sadb_prop)) { 6661 /* error */ 6662 ipseclog((LOG_DEBUG, "%s: invalid message is passed.\n", 6663 __func__)); 6664 return key_senderror(so, m, EINVAL); 6665 } 6666 6667 src0 = (struct sadb_address *)mhp->ext[SADB_EXT_ADDRESS_SRC]; 6668 dst0 = (struct sadb_address *)mhp->ext[SADB_EXT_ADDRESS_DST]; 6669 6670 /* XXX boundary check against sa_len */ 6671 KEY_SETSECASIDX(proto, IPSEC_MODE_ANY, 0, src0 + 1, dst0 + 1, &saidx); 6672 6673 /* 6674 * Make sure the port numbers are zero. 6675 * In case of NAT-T we will update them later if needed. 6676 */ 6677 KEY_PORTTOSADDR(&saidx.src, 0); 6678 KEY_PORTTOSADDR(&saidx.dst, 0); 6679 6680 #ifndef IPSEC_NAT_T 6681 /* 6682 * Handle NAT-T info if present. 6683 */ 6684 6685 if (mhp->ext[SADB_X_EXT_NAT_T_SPORT] != NULL && 6686 mhp->ext[SADB_X_EXT_NAT_T_DPORT] != NULL) { 6687 struct sadb_x_nat_t_port *sport, *dport; 6688 6689 if (mhp->extlen[SADB_X_EXT_NAT_T_SPORT] < sizeof(*sport) || 6690 mhp->extlen[SADB_X_EXT_NAT_T_DPORT] < sizeof(*dport)) { 6691 ipseclog((LOG_DEBUG, "%s: invalid message.\n", 6692 __func__)); 6693 return key_senderror(so, m, EINVAL); 6694 } 6695 6696 sport = (struct sadb_x_nat_t_port *) 6697 mhp->ext[SADB_X_EXT_NAT_T_SPORT]; 6698 dport = (struct sadb_x_nat_t_port *) 6699 mhp->ext[SADB_X_EXT_NAT_T_DPORT]; 6700 6701 if (sport) 6702 KEY_PORTTOSADDR(&saidx.src, 6703 sport->sadb_x_nat_t_port_port); 6704 if (dport) 6705 KEY_PORTTOSADDR(&saidx.dst, 6706 dport->sadb_x_nat_t_port_port); 6707 } 6708 #endif 6709 6710 /* get a SA index */ 6711 SAHTREE_LOCK(); 6712 LIST_FOREACH(sah, &V_sahtree, chain) { 6713 if (sah->state == SADB_SASTATE_DEAD) 6714 continue; 6715 if (key_cmpsaidx(&sah->saidx, &saidx, CMP_MODE_REQID)) 6716 break; 6717 } 6718 SAHTREE_UNLOCK(); 6719 if (sah != NULL) { 6720 ipseclog((LOG_DEBUG, "%s: a SA exists already.\n", __func__)); 6721 return key_senderror(so, m, EEXIST); 6722 } 6723 6724 error = key_acquire(&saidx, NULL); 6725 if (error != 0) { 6726 ipseclog((LOG_DEBUG, "%s: error %d returned from key_acquire\n", 6727 __func__, mhp->msg->sadb_msg_errno)); 6728 return key_senderror(so, m, error); 6729 } 6730 6731 return key_sendup_mbuf(so, m, KEY_SENDUP_REGISTERED); 6732 } 6733 6734 /* 6735 * SADB_REGISTER processing. 6736 * If SATYPE_UNSPEC has been passed as satype, only return sabd_supported. 6737 * receive 6738 * <base> 6739 * from the ikmpd, and register a socket to send PF_KEY messages, 6740 * and send 6741 * <base, supported> 6742 * to KMD by PF_KEY. 6743 * If socket is detached, must free from regnode. 6744 * 6745 * m will always be freed. 6746 */ 6747 static int 6748 key_register(struct socket *so, struct mbuf *m, const struct sadb_msghdr *mhp) 6749 { 6750 struct secreg *reg, *newreg = NULL; 6751 6752 IPSEC_ASSERT(so != NULL, ("null socket")); 6753 IPSEC_ASSERT(m != NULL, ("null mbuf")); 6754 IPSEC_ASSERT(mhp != NULL, ("null msghdr")); 6755 IPSEC_ASSERT(mhp->msg != NULL, ("null msg")); 6756 6757 /* check for invalid register message */ 6758 if (mhp->msg->sadb_msg_satype >= sizeof(V_regtree)/sizeof(V_regtree[0])) 6759 return key_senderror(so, m, EINVAL); 6760 6761 /* When SATYPE_UNSPEC is specified, only return sabd_supported. */ 6762 if (mhp->msg->sadb_msg_satype == SADB_SATYPE_UNSPEC) 6763 goto setmsg; 6764 6765 /* check whether existing or not */ 6766 REGTREE_LOCK(); 6767 LIST_FOREACH(reg, &V_regtree[mhp->msg->sadb_msg_satype], chain) { 6768 if (reg->so == so) { 6769 REGTREE_UNLOCK(); 6770 ipseclog((LOG_DEBUG, "%s: socket exists already.\n", 6771 __func__)); 6772 return key_senderror(so, m, EEXIST); 6773 } 6774 } 6775 6776 /* create regnode */ 6777 newreg = malloc(sizeof(struct secreg), M_IPSEC_SAR, M_NOWAIT|M_ZERO); 6778 if (newreg == NULL) { 6779 REGTREE_UNLOCK(); 6780 ipseclog((LOG_DEBUG, "%s: No more memory.\n", __func__)); 6781 return key_senderror(so, m, ENOBUFS); 6782 } 6783 6784 newreg->so = so; 6785 ((struct keycb *)sotorawcb(so))->kp_registered++; 6786 6787 /* add regnode to regtree. */ 6788 LIST_INSERT_HEAD(&V_regtree[mhp->msg->sadb_msg_satype], newreg, chain); 6789 REGTREE_UNLOCK(); 6790 6791 setmsg: 6792 { 6793 struct mbuf *n; 6794 struct sadb_msg *newmsg; 6795 struct sadb_supported *sup; 6796 u_int len, alen, elen; 6797 int off; 6798 int i; 6799 struct sadb_alg *alg; 6800 6801 /* create new sadb_msg to reply. */ 6802 alen = 0; 6803 for (i = 1; i <= SADB_AALG_MAX; i++) { 6804 if (ah_algorithm_lookup(i)) 6805 alen += sizeof(struct sadb_alg); 6806 } 6807 if (alen) 6808 alen += sizeof(struct sadb_supported); 6809 elen = 0; 6810 for (i = 1; i <= SADB_EALG_MAX; i++) { 6811 if (esp_algorithm_lookup(i)) 6812 elen += sizeof(struct sadb_alg); 6813 } 6814 if (elen) 6815 elen += sizeof(struct sadb_supported); 6816 6817 len = sizeof(struct sadb_msg) + alen + elen; 6818 6819 if (len > MCLBYTES) 6820 return key_senderror(so, m, ENOBUFS); 6821 6822 MGETHDR(n, M_NOWAIT, MT_DATA); 6823 if (len > MHLEN) { 6824 if (!(MCLGET(n, M_NOWAIT))) { 6825 m_freem(n); 6826 n = NULL; 6827 } 6828 } 6829 if (!n) 6830 return key_senderror(so, m, ENOBUFS); 6831 6832 n->m_pkthdr.len = n->m_len = len; 6833 n->m_next = NULL; 6834 off = 0; 6835 6836 m_copydata(m, 0, sizeof(struct sadb_msg), mtod(n, caddr_t) + off); 6837 newmsg = mtod(n, struct sadb_msg *); 6838 newmsg->sadb_msg_errno = 0; 6839 newmsg->sadb_msg_len = PFKEY_UNIT64(len); 6840 off += PFKEY_ALIGN8(sizeof(struct sadb_msg)); 6841 6842 /* for authentication algorithm */ 6843 if (alen) { 6844 sup = (struct sadb_supported *)(mtod(n, caddr_t) + off); 6845 sup->sadb_supported_len = PFKEY_UNIT64(alen); 6846 sup->sadb_supported_exttype = SADB_EXT_SUPPORTED_AUTH; 6847 off += PFKEY_ALIGN8(sizeof(*sup)); 6848 6849 for (i = 1; i <= SADB_AALG_MAX; i++) { 6850 struct auth_hash *aalgo; 6851 u_int16_t minkeysize, maxkeysize; 6852 6853 aalgo = ah_algorithm_lookup(i); 6854 if (!aalgo) 6855 continue; 6856 alg = (struct sadb_alg *)(mtod(n, caddr_t) + off); 6857 alg->sadb_alg_id = i; 6858 alg->sadb_alg_ivlen = 0; 6859 key_getsizes_ah(aalgo, i, &minkeysize, &maxkeysize); 6860 alg->sadb_alg_minbits = _BITS(minkeysize); 6861 alg->sadb_alg_maxbits = _BITS(maxkeysize); 6862 off += PFKEY_ALIGN8(sizeof(*alg)); 6863 } 6864 } 6865 6866 /* for encryption algorithm */ 6867 if (elen) { 6868 sup = (struct sadb_supported *)(mtod(n, caddr_t) + off); 6869 sup->sadb_supported_len = PFKEY_UNIT64(elen); 6870 sup->sadb_supported_exttype = SADB_EXT_SUPPORTED_ENCRYPT; 6871 off += PFKEY_ALIGN8(sizeof(*sup)); 6872 6873 for (i = 1; i <= SADB_EALG_MAX; i++) { 6874 struct enc_xform *ealgo; 6875 6876 ealgo = esp_algorithm_lookup(i); 6877 if (!ealgo) 6878 continue; 6879 alg = (struct sadb_alg *)(mtod(n, caddr_t) + off); 6880 alg->sadb_alg_id = i; 6881 alg->sadb_alg_ivlen = ealgo->ivsize; 6882 alg->sadb_alg_minbits = _BITS(ealgo->minkey); 6883 alg->sadb_alg_maxbits = _BITS(ealgo->maxkey); 6884 off += PFKEY_ALIGN8(sizeof(struct sadb_alg)); 6885 } 6886 } 6887 6888 IPSEC_ASSERT(off == len, 6889 ("length assumption failed (off %u len %u)", off, len)); 6890 6891 m_freem(m); 6892 return key_sendup_mbuf(so, n, KEY_SENDUP_REGISTERED); 6893 } 6894 } 6895 6896 /* 6897 * free secreg entry registered. 6898 * XXX: I want to do free a socket marked done SADB_RESIGER to socket. 6899 */ 6900 void 6901 key_freereg(struct socket *so) 6902 { 6903 struct secreg *reg; 6904 int i; 6905 6906 IPSEC_ASSERT(so != NULL, ("NULL so")); 6907 6908 /* 6909 * check whether existing or not. 6910 * check all type of SA, because there is a potential that 6911 * one socket is registered to multiple type of SA. 6912 */ 6913 REGTREE_LOCK(); 6914 for (i = 0; i <= SADB_SATYPE_MAX; i++) { 6915 LIST_FOREACH(reg, &V_regtree[i], chain) { 6916 if (reg->so == so && __LIST_CHAINED(reg)) { 6917 LIST_REMOVE(reg, chain); 6918 free(reg, M_IPSEC_SAR); 6919 break; 6920 } 6921 } 6922 } 6923 REGTREE_UNLOCK(); 6924 } 6925 6926 /* 6927 * SADB_EXPIRE processing 6928 * send 6929 * <base, SA, SA2, lifetime(C and one of HS), address(SD)> 6930 * to KMD by PF_KEY. 6931 * NOTE: We send only soft lifetime extension. 6932 * 6933 * OUT: 0 : succeed 6934 * others : error number 6935 */ 6936 static int 6937 key_expire(struct secasvar *sav, int hard) 6938 { 6939 int satype; 6940 struct mbuf *result = NULL, *m; 6941 int len; 6942 int error = -1; 6943 struct sadb_lifetime *lt; 6944 u_int32_t replay_count; 6945 6946 IPSEC_ASSERT (sav != NULL, ("null sav")); 6947 IPSEC_ASSERT (sav->sah != NULL, ("null sa header")); 6948 6949 /* set msg header */ 6950 satype = key_proto2satype(sav->sah->saidx.proto); 6951 IPSEC_ASSERT(satype != 0, ("invalid proto, satype %u", satype)); 6952 m = key_setsadbmsg(SADB_EXPIRE, 0, satype, sav->seq, 0, sav->refcnt); 6953 if (!m) { 6954 error = ENOBUFS; 6955 goto fail; 6956 } 6957 result = m; 6958 6959 /* create SA extension */ 6960 m = key_setsadbsa(sav); 6961 if (!m) { 6962 error = ENOBUFS; 6963 goto fail; 6964 } 6965 m_cat(result, m); 6966 6967 /* create SA extension */ 6968 SECASVAR_LOCK(sav); 6969 replay_count = sav->replay ? sav->replay->count : 0; 6970 SECASVAR_UNLOCK(sav); 6971 6972 m = key_setsadbxsa2(sav->sah->saidx.mode, replay_count, 6973 sav->sah->saidx.reqid); 6974 if (!m) { 6975 error = ENOBUFS; 6976 goto fail; 6977 } 6978 m_cat(result, m); 6979 6980 if (sav->replay && sav->replay->wsize > UINT8_MAX) { 6981 m = key_setsadbxsareplay(sav->replay->wsize); 6982 if (!m) { 6983 error = ENOBUFS; 6984 goto fail; 6985 } 6986 m_cat(result, m); 6987 } 6988 6989 /* create lifetime extension (current and soft) */ 6990 len = PFKEY_ALIGN8(sizeof(*lt)) * 2; 6991 m = m_get2(len, M_NOWAIT, MT_DATA, 0); 6992 if (m == NULL) { 6993 error = ENOBUFS; 6994 goto fail; 6995 } 6996 m_align(m, len); 6997 m->m_len = len; 6998 bzero(mtod(m, caddr_t), len); 6999 lt = mtod(m, struct sadb_lifetime *); 7000 lt->sadb_lifetime_len = PFKEY_UNIT64(sizeof(struct sadb_lifetime)); 7001 lt->sadb_lifetime_exttype = SADB_EXT_LIFETIME_CURRENT; 7002 lt->sadb_lifetime_allocations = sav->lft_c->allocations; 7003 lt->sadb_lifetime_bytes = sav->lft_c->bytes; 7004 lt->sadb_lifetime_addtime = sav->lft_c->addtime; 7005 lt->sadb_lifetime_usetime = sav->lft_c->usetime; 7006 lt = (struct sadb_lifetime *)(mtod(m, caddr_t) + len / 2); 7007 lt->sadb_lifetime_len = PFKEY_UNIT64(sizeof(struct sadb_lifetime)); 7008 if (hard) { 7009 lt->sadb_lifetime_exttype = SADB_EXT_LIFETIME_HARD; 7010 lt->sadb_lifetime_allocations = sav->lft_h->allocations; 7011 lt->sadb_lifetime_bytes = sav->lft_h->bytes; 7012 lt->sadb_lifetime_addtime = sav->lft_h->addtime; 7013 lt->sadb_lifetime_usetime = sav->lft_h->usetime; 7014 } else { 7015 lt->sadb_lifetime_exttype = SADB_EXT_LIFETIME_SOFT; 7016 lt->sadb_lifetime_allocations = sav->lft_s->allocations; 7017 lt->sadb_lifetime_bytes = sav->lft_s->bytes; 7018 lt->sadb_lifetime_addtime = sav->lft_s->addtime; 7019 lt->sadb_lifetime_usetime = sav->lft_s->usetime; 7020 } 7021 m_cat(result, m); 7022 7023 /* set sadb_address for source */ 7024 m = key_setsadbaddr(SADB_EXT_ADDRESS_SRC, 7025 &sav->sah->saidx.src.sa, 7026 FULLMASK, IPSEC_ULPROTO_ANY); 7027 if (!m) { 7028 error = ENOBUFS; 7029 goto fail; 7030 } 7031 m_cat(result, m); 7032 7033 /* set sadb_address for destination */ 7034 m = key_setsadbaddr(SADB_EXT_ADDRESS_DST, 7035 &sav->sah->saidx.dst.sa, 7036 FULLMASK, IPSEC_ULPROTO_ANY); 7037 if (!m) { 7038 error = ENOBUFS; 7039 goto fail; 7040 } 7041 m_cat(result, m); 7042 7043 /* 7044 * XXX-BZ Handle NAT-T extensions here. 7045 */ 7046 7047 if ((result->m_flags & M_PKTHDR) == 0) { 7048 error = EINVAL; 7049 goto fail; 7050 } 7051 7052 if (result->m_len < sizeof(struct sadb_msg)) { 7053 result = m_pullup(result, sizeof(struct sadb_msg)); 7054 if (result == NULL) { 7055 error = ENOBUFS; 7056 goto fail; 7057 } 7058 } 7059 7060 result->m_pkthdr.len = 0; 7061 for (m = result; m; m = m->m_next) 7062 result->m_pkthdr.len += m->m_len; 7063 7064 mtod(result, struct sadb_msg *)->sadb_msg_len = 7065 PFKEY_UNIT64(result->m_pkthdr.len); 7066 7067 return key_sendup_mbuf(NULL, result, KEY_SENDUP_REGISTERED); 7068 7069 fail: 7070 if (result) 7071 m_freem(result); 7072 return error; 7073 } 7074 7075 /* 7076 * SADB_FLUSH processing 7077 * receive 7078 * <base> 7079 * from the ikmpd, and free all entries in secastree. 7080 * and send, 7081 * <base> 7082 * to the ikmpd. 7083 * NOTE: to do is only marking SADB_SASTATE_DEAD. 7084 * 7085 * m will always be freed. 7086 */ 7087 static int 7088 key_flush(struct socket *so, struct mbuf *m, const struct sadb_msghdr *mhp) 7089 { 7090 struct sadb_msg *newmsg; 7091 struct secashead *sah, *nextsah; 7092 struct secasvar *sav, *nextsav; 7093 u_int16_t proto; 7094 u_int8_t state; 7095 u_int stateidx; 7096 7097 IPSEC_ASSERT(so != NULL, ("null socket")); 7098 IPSEC_ASSERT(mhp != NULL, ("null msghdr")); 7099 IPSEC_ASSERT(mhp->msg != NULL, ("null msg")); 7100 7101 /* map satype to proto */ 7102 if ((proto = key_satype2proto(mhp->msg->sadb_msg_satype)) == 0) { 7103 ipseclog((LOG_DEBUG, "%s: invalid satype is passed.\n", 7104 __func__)); 7105 return key_senderror(so, m, EINVAL); 7106 } 7107 7108 /* no SATYPE specified, i.e. flushing all SA. */ 7109 SAHTREE_LOCK(); 7110 for (sah = LIST_FIRST(&V_sahtree); 7111 sah != NULL; 7112 sah = nextsah) { 7113 nextsah = LIST_NEXT(sah, chain); 7114 7115 if (mhp->msg->sadb_msg_satype != SADB_SATYPE_UNSPEC 7116 && proto != sah->saidx.proto) 7117 continue; 7118 7119 for (stateidx = 0; 7120 stateidx < _ARRAYLEN(saorder_state_alive); 7121 stateidx++) { 7122 state = saorder_state_any[stateidx]; 7123 for (sav = LIST_FIRST(&sah->savtree[state]); 7124 sav != NULL; 7125 sav = nextsav) { 7126 7127 nextsav = LIST_NEXT(sav, chain); 7128 7129 key_sa_chgstate(sav, SADB_SASTATE_DEAD); 7130 KEY_FREESAV(&sav); 7131 } 7132 } 7133 7134 sah->state = SADB_SASTATE_DEAD; 7135 } 7136 SAHTREE_UNLOCK(); 7137 7138 if (m->m_len < sizeof(struct sadb_msg) || 7139 sizeof(struct sadb_msg) > m->m_len + M_TRAILINGSPACE(m)) { 7140 ipseclog((LOG_DEBUG, "%s: No more memory.\n", __func__)); 7141 return key_senderror(so, m, ENOBUFS); 7142 } 7143 7144 if (m->m_next) 7145 m_freem(m->m_next); 7146 m->m_next = NULL; 7147 m->m_pkthdr.len = m->m_len = sizeof(struct sadb_msg); 7148 newmsg = mtod(m, struct sadb_msg *); 7149 newmsg->sadb_msg_errno = 0; 7150 newmsg->sadb_msg_len = PFKEY_UNIT64(m->m_pkthdr.len); 7151 7152 return key_sendup_mbuf(so, m, KEY_SENDUP_ALL); 7153 } 7154 7155 /* 7156 * SADB_DUMP processing 7157 * dump all entries including status of DEAD in SAD. 7158 * receive 7159 * <base> 7160 * from the ikmpd, and dump all secasvar leaves 7161 * and send, 7162 * <base> ..... 7163 * to the ikmpd. 7164 * 7165 * m will always be freed. 7166 */ 7167 static int 7168 key_dump(struct socket *so, struct mbuf *m, const struct sadb_msghdr *mhp) 7169 { 7170 struct secashead *sah; 7171 struct secasvar *sav; 7172 u_int16_t proto; 7173 u_int stateidx; 7174 u_int8_t satype; 7175 u_int8_t state; 7176 int cnt; 7177 struct sadb_msg *newmsg; 7178 struct mbuf *n; 7179 7180 IPSEC_ASSERT(so != NULL, ("null socket")); 7181 IPSEC_ASSERT(m != NULL, ("null mbuf")); 7182 IPSEC_ASSERT(mhp != NULL, ("null msghdr")); 7183 IPSEC_ASSERT(mhp->msg != NULL, ("null msg")); 7184 7185 /* map satype to proto */ 7186 if ((proto = key_satype2proto(mhp->msg->sadb_msg_satype)) == 0) { 7187 ipseclog((LOG_DEBUG, "%s: invalid satype is passed.\n", 7188 __func__)); 7189 return key_senderror(so, m, EINVAL); 7190 } 7191 7192 /* count sav entries to be sent to the userland. */ 7193 cnt = 0; 7194 SAHTREE_LOCK(); 7195 LIST_FOREACH(sah, &V_sahtree, chain) { 7196 if (mhp->msg->sadb_msg_satype != SADB_SATYPE_UNSPEC 7197 && proto != sah->saidx.proto) 7198 continue; 7199 7200 for (stateidx = 0; 7201 stateidx < _ARRAYLEN(saorder_state_any); 7202 stateidx++) { 7203 state = saorder_state_any[stateidx]; 7204 LIST_FOREACH(sav, &sah->savtree[state], chain) { 7205 cnt++; 7206 } 7207 } 7208 } 7209 7210 if (cnt == 0) { 7211 SAHTREE_UNLOCK(); 7212 return key_senderror(so, m, ENOENT); 7213 } 7214 7215 /* send this to the userland, one at a time. */ 7216 newmsg = NULL; 7217 LIST_FOREACH(sah, &V_sahtree, chain) { 7218 if (mhp->msg->sadb_msg_satype != SADB_SATYPE_UNSPEC 7219 && proto != sah->saidx.proto) 7220 continue; 7221 7222 /* map proto to satype */ 7223 if ((satype = key_proto2satype(sah->saidx.proto)) == 0) { 7224 SAHTREE_UNLOCK(); 7225 ipseclog((LOG_DEBUG, "%s: there was invalid proto in " 7226 "SAD.\n", __func__)); 7227 return key_senderror(so, m, EINVAL); 7228 } 7229 7230 for (stateidx = 0; 7231 stateidx < _ARRAYLEN(saorder_state_any); 7232 stateidx++) { 7233 state = saorder_state_any[stateidx]; 7234 LIST_FOREACH(sav, &sah->savtree[state], chain) { 7235 n = key_setdumpsa(sav, SADB_DUMP, satype, 7236 --cnt, mhp->msg->sadb_msg_pid); 7237 if (!n) { 7238 SAHTREE_UNLOCK(); 7239 return key_senderror(so, m, ENOBUFS); 7240 } 7241 key_sendup_mbuf(so, n, KEY_SENDUP_ONE); 7242 } 7243 } 7244 } 7245 SAHTREE_UNLOCK(); 7246 7247 m_freem(m); 7248 return 0; 7249 } 7250 7251 /* 7252 * SADB_X_PROMISC processing 7253 * 7254 * m will always be freed. 7255 */ 7256 static int 7257 key_promisc(struct socket *so, struct mbuf *m, const struct sadb_msghdr *mhp) 7258 { 7259 int olen; 7260 7261 IPSEC_ASSERT(so != NULL, ("null socket")); 7262 IPSEC_ASSERT(m != NULL, ("null mbuf")); 7263 IPSEC_ASSERT(mhp != NULL, ("null msghdr")); 7264 IPSEC_ASSERT(mhp->msg != NULL, ("null msg")); 7265 7266 olen = PFKEY_UNUNIT64(mhp->msg->sadb_msg_len); 7267 7268 if (olen < sizeof(struct sadb_msg)) { 7269 #if 1 7270 return key_senderror(so, m, EINVAL); 7271 #else 7272 m_freem(m); 7273 return 0; 7274 #endif 7275 } else if (olen == sizeof(struct sadb_msg)) { 7276 /* enable/disable promisc mode */ 7277 struct keycb *kp; 7278 7279 if ((kp = (struct keycb *)sotorawcb(so)) == NULL) 7280 return key_senderror(so, m, EINVAL); 7281 mhp->msg->sadb_msg_errno = 0; 7282 switch (mhp->msg->sadb_msg_satype) { 7283 case 0: 7284 case 1: 7285 kp->kp_promisc = mhp->msg->sadb_msg_satype; 7286 break; 7287 default: 7288 return key_senderror(so, m, EINVAL); 7289 } 7290 7291 /* send the original message back to everyone */ 7292 mhp->msg->sadb_msg_errno = 0; 7293 return key_sendup_mbuf(so, m, KEY_SENDUP_ALL); 7294 } else { 7295 /* send packet as is */ 7296 7297 m_adj(m, PFKEY_ALIGN8(sizeof(struct sadb_msg))); 7298 7299 /* TODO: if sadb_msg_seq is specified, send to specific pid */ 7300 return key_sendup_mbuf(so, m, KEY_SENDUP_ALL); 7301 } 7302 } 7303 7304 static int (*key_typesw[])(struct socket *, struct mbuf *, 7305 const struct sadb_msghdr *) = { 7306 NULL, /* SADB_RESERVED */ 7307 key_getspi, /* SADB_GETSPI */ 7308 key_update, /* SADB_UPDATE */ 7309 key_add, /* SADB_ADD */ 7310 key_delete, /* SADB_DELETE */ 7311 key_get, /* SADB_GET */ 7312 key_acquire2, /* SADB_ACQUIRE */ 7313 key_register, /* SADB_REGISTER */ 7314 NULL, /* SADB_EXPIRE */ 7315 key_flush, /* SADB_FLUSH */ 7316 key_dump, /* SADB_DUMP */ 7317 key_promisc, /* SADB_X_PROMISC */ 7318 NULL, /* SADB_X_PCHANGE */ 7319 key_spdadd, /* SADB_X_SPDUPDATE */ 7320 key_spdadd, /* SADB_X_SPDADD */ 7321 key_spddelete, /* SADB_X_SPDDELETE */ 7322 key_spdget, /* SADB_X_SPDGET */ 7323 NULL, /* SADB_X_SPDACQUIRE */ 7324 key_spddump, /* SADB_X_SPDDUMP */ 7325 key_spdflush, /* SADB_X_SPDFLUSH */ 7326 key_spdadd, /* SADB_X_SPDSETIDX */ 7327 NULL, /* SADB_X_SPDEXPIRE */ 7328 key_spddelete2, /* SADB_X_SPDDELETE2 */ 7329 }; 7330 7331 /* 7332 * parse sadb_msg buffer to process PFKEYv2, 7333 * and create a data to response if needed. 7334 * I think to be dealed with mbuf directly. 7335 * IN: 7336 * msgp : pointer to pointer to a received buffer pulluped. 7337 * This is rewrited to response. 7338 * so : pointer to socket. 7339 * OUT: 7340 * length for buffer to send to user process. 7341 */ 7342 int 7343 key_parse(struct mbuf *m, struct socket *so) 7344 { 7345 struct sadb_msg *msg; 7346 struct sadb_msghdr mh; 7347 u_int orglen; 7348 int error; 7349 int target; 7350 7351 IPSEC_ASSERT(so != NULL, ("null socket")); 7352 IPSEC_ASSERT(m != NULL, ("null mbuf")); 7353 7354 #if 0 /*kdebug_sadb assumes msg in linear buffer*/ 7355 KEYDEBUG(KEYDEBUG_KEY_DUMP, 7356 ipseclog((LOG_DEBUG, "%s: passed sadb_msg\n", __func__)); 7357 kdebug_sadb(msg)); 7358 #endif 7359 7360 if (m->m_len < sizeof(struct sadb_msg)) { 7361 m = m_pullup(m, sizeof(struct sadb_msg)); 7362 if (!m) 7363 return ENOBUFS; 7364 } 7365 msg = mtod(m, struct sadb_msg *); 7366 orglen = PFKEY_UNUNIT64(msg->sadb_msg_len); 7367 target = KEY_SENDUP_ONE; 7368 7369 if ((m->m_flags & M_PKTHDR) == 0 || m->m_pkthdr.len != orglen) { 7370 ipseclog((LOG_DEBUG, "%s: invalid message length.\n",__func__)); 7371 PFKEYSTAT_INC(out_invlen); 7372 error = EINVAL; 7373 goto senderror; 7374 } 7375 7376 if (msg->sadb_msg_version != PF_KEY_V2) { 7377 ipseclog((LOG_DEBUG, "%s: PF_KEY version %u is mismatched.\n", 7378 __func__, msg->sadb_msg_version)); 7379 PFKEYSTAT_INC(out_invver); 7380 error = EINVAL; 7381 goto senderror; 7382 } 7383 7384 if (msg->sadb_msg_type > SADB_MAX) { 7385 ipseclog((LOG_DEBUG, "%s: invalid type %u is passed.\n", 7386 __func__, msg->sadb_msg_type)); 7387 PFKEYSTAT_INC(out_invmsgtype); 7388 error = EINVAL; 7389 goto senderror; 7390 } 7391 7392 /* for old-fashioned code - should be nuked */ 7393 if (m->m_pkthdr.len > MCLBYTES) { 7394 m_freem(m); 7395 return ENOBUFS; 7396 } 7397 if (m->m_next) { 7398 struct mbuf *n; 7399 7400 MGETHDR(n, M_NOWAIT, MT_DATA); 7401 if (n && m->m_pkthdr.len > MHLEN) { 7402 if (!(MCLGET(n, M_NOWAIT))) { 7403 m_free(n); 7404 n = NULL; 7405 } 7406 } 7407 if (!n) { 7408 m_freem(m); 7409 return ENOBUFS; 7410 } 7411 m_copydata(m, 0, m->m_pkthdr.len, mtod(n, caddr_t)); 7412 n->m_pkthdr.len = n->m_len = m->m_pkthdr.len; 7413 n->m_next = NULL; 7414 m_freem(m); 7415 m = n; 7416 } 7417 7418 /* align the mbuf chain so that extensions are in contiguous region. */ 7419 error = key_align(m, &mh); 7420 if (error) 7421 return error; 7422 7423 msg = mh.msg; 7424 7425 /* check SA type */ 7426 switch (msg->sadb_msg_satype) { 7427 case SADB_SATYPE_UNSPEC: 7428 switch (msg->sadb_msg_type) { 7429 case SADB_GETSPI: 7430 case SADB_UPDATE: 7431 case SADB_ADD: 7432 case SADB_DELETE: 7433 case SADB_GET: 7434 case SADB_ACQUIRE: 7435 case SADB_EXPIRE: 7436 ipseclog((LOG_DEBUG, "%s: must specify satype " 7437 "when msg type=%u.\n", __func__, 7438 msg->sadb_msg_type)); 7439 PFKEYSTAT_INC(out_invsatype); 7440 error = EINVAL; 7441 goto senderror; 7442 } 7443 break; 7444 case SADB_SATYPE_AH: 7445 case SADB_SATYPE_ESP: 7446 case SADB_X_SATYPE_IPCOMP: 7447 case SADB_X_SATYPE_TCPSIGNATURE: 7448 switch (msg->sadb_msg_type) { 7449 case SADB_X_SPDADD: 7450 case SADB_X_SPDDELETE: 7451 case SADB_X_SPDGET: 7452 case SADB_X_SPDDUMP: 7453 case SADB_X_SPDFLUSH: 7454 case SADB_X_SPDSETIDX: 7455 case SADB_X_SPDUPDATE: 7456 case SADB_X_SPDDELETE2: 7457 ipseclog((LOG_DEBUG, "%s: illegal satype=%u\n", 7458 __func__, msg->sadb_msg_type)); 7459 PFKEYSTAT_INC(out_invsatype); 7460 error = EINVAL; 7461 goto senderror; 7462 } 7463 break; 7464 case SADB_SATYPE_RSVP: 7465 case SADB_SATYPE_OSPFV2: 7466 case SADB_SATYPE_RIPV2: 7467 case SADB_SATYPE_MIP: 7468 ipseclog((LOG_DEBUG, "%s: type %u isn't supported.\n", 7469 __func__, msg->sadb_msg_satype)); 7470 PFKEYSTAT_INC(out_invsatype); 7471 error = EOPNOTSUPP; 7472 goto senderror; 7473 case 1: /* XXX: What does it do? */ 7474 if (msg->sadb_msg_type == SADB_X_PROMISC) 7475 break; 7476 /*FALLTHROUGH*/ 7477 default: 7478 ipseclog((LOG_DEBUG, "%s: invalid type %u is passed.\n", 7479 __func__, msg->sadb_msg_satype)); 7480 PFKEYSTAT_INC(out_invsatype); 7481 error = EINVAL; 7482 goto senderror; 7483 } 7484 7485 /* check field of upper layer protocol and address family */ 7486 if (mh.ext[SADB_EXT_ADDRESS_SRC] != NULL 7487 && mh.ext[SADB_EXT_ADDRESS_DST] != NULL) { 7488 struct sadb_address *src0, *dst0; 7489 u_int plen; 7490 7491 src0 = (struct sadb_address *)(mh.ext[SADB_EXT_ADDRESS_SRC]); 7492 dst0 = (struct sadb_address *)(mh.ext[SADB_EXT_ADDRESS_DST]); 7493 7494 /* check upper layer protocol */ 7495 if (src0->sadb_address_proto != dst0->sadb_address_proto) { 7496 ipseclog((LOG_DEBUG, "%s: upper layer protocol " 7497 "mismatched.\n", __func__)); 7498 PFKEYSTAT_INC(out_invaddr); 7499 error = EINVAL; 7500 goto senderror; 7501 } 7502 7503 /* check family */ 7504 if (PFKEY_ADDR_SADDR(src0)->sa_family != 7505 PFKEY_ADDR_SADDR(dst0)->sa_family) { 7506 ipseclog((LOG_DEBUG, "%s: address family mismatched.\n", 7507 __func__)); 7508 PFKEYSTAT_INC(out_invaddr); 7509 error = EINVAL; 7510 goto senderror; 7511 } 7512 if (PFKEY_ADDR_SADDR(src0)->sa_len != 7513 PFKEY_ADDR_SADDR(dst0)->sa_len) { 7514 ipseclog((LOG_DEBUG, "%s: address struct size " 7515 "mismatched.\n", __func__)); 7516 PFKEYSTAT_INC(out_invaddr); 7517 error = EINVAL; 7518 goto senderror; 7519 } 7520 7521 switch (PFKEY_ADDR_SADDR(src0)->sa_family) { 7522 case AF_INET: 7523 if (PFKEY_ADDR_SADDR(src0)->sa_len != 7524 sizeof(struct sockaddr_in)) { 7525 PFKEYSTAT_INC(out_invaddr); 7526 error = EINVAL; 7527 goto senderror; 7528 } 7529 break; 7530 case AF_INET6: 7531 if (PFKEY_ADDR_SADDR(src0)->sa_len != 7532 sizeof(struct sockaddr_in6)) { 7533 PFKEYSTAT_INC(out_invaddr); 7534 error = EINVAL; 7535 goto senderror; 7536 } 7537 break; 7538 default: 7539 ipseclog((LOG_DEBUG, "%s: unsupported address family\n", 7540 __func__)); 7541 PFKEYSTAT_INC(out_invaddr); 7542 error = EAFNOSUPPORT; 7543 goto senderror; 7544 } 7545 7546 switch (PFKEY_ADDR_SADDR(src0)->sa_family) { 7547 case AF_INET: 7548 plen = sizeof(struct in_addr) << 3; 7549 break; 7550 case AF_INET6: 7551 plen = sizeof(struct in6_addr) << 3; 7552 break; 7553 default: 7554 plen = 0; /*fool gcc*/ 7555 break; 7556 } 7557 7558 /* check max prefix length */ 7559 if (src0->sadb_address_prefixlen > plen || 7560 dst0->sadb_address_prefixlen > plen) { 7561 ipseclog((LOG_DEBUG, "%s: illegal prefixlen.\n", 7562 __func__)); 7563 PFKEYSTAT_INC(out_invaddr); 7564 error = EINVAL; 7565 goto senderror; 7566 } 7567 7568 /* 7569 * prefixlen == 0 is valid because there can be a case when 7570 * all addresses are matched. 7571 */ 7572 } 7573 7574 if (msg->sadb_msg_type >= nitems(key_typesw) || 7575 key_typesw[msg->sadb_msg_type] == NULL) { 7576 PFKEYSTAT_INC(out_invmsgtype); 7577 error = EINVAL; 7578 goto senderror; 7579 } 7580 7581 return (*key_typesw[msg->sadb_msg_type])(so, m, &mh); 7582 7583 senderror: 7584 msg->sadb_msg_errno = error; 7585 return key_sendup_mbuf(so, m, target); 7586 } 7587 7588 static int 7589 key_senderror(struct socket *so, struct mbuf *m, int code) 7590 { 7591 struct sadb_msg *msg; 7592 7593 IPSEC_ASSERT(m->m_len >= sizeof(struct sadb_msg), 7594 ("mbuf too small, len %u", m->m_len)); 7595 7596 msg = mtod(m, struct sadb_msg *); 7597 msg->sadb_msg_errno = code; 7598 return key_sendup_mbuf(so, m, KEY_SENDUP_ONE); 7599 } 7600 7601 /* 7602 * set the pointer to each header into message buffer. 7603 * m will be freed on error. 7604 * XXX larger-than-MCLBYTES extension? 7605 */ 7606 static int 7607 key_align(struct mbuf *m, struct sadb_msghdr *mhp) 7608 { 7609 struct mbuf *n; 7610 struct sadb_ext *ext; 7611 size_t off, end; 7612 int extlen; 7613 int toff; 7614 7615 IPSEC_ASSERT(m != NULL, ("null mbuf")); 7616 IPSEC_ASSERT(mhp != NULL, ("null msghdr")); 7617 IPSEC_ASSERT(m->m_len >= sizeof(struct sadb_msg), 7618 ("mbuf too small, len %u", m->m_len)); 7619 7620 /* initialize */ 7621 bzero(mhp, sizeof(*mhp)); 7622 7623 mhp->msg = mtod(m, struct sadb_msg *); 7624 mhp->ext[0] = (struct sadb_ext *)mhp->msg; /*XXX backward compat */ 7625 7626 end = PFKEY_UNUNIT64(mhp->msg->sadb_msg_len); 7627 extlen = end; /*just in case extlen is not updated*/ 7628 for (off = sizeof(struct sadb_msg); off < end; off += extlen) { 7629 n = m_pulldown(m, off, sizeof(struct sadb_ext), &toff); 7630 if (!n) { 7631 /* m is already freed */ 7632 return ENOBUFS; 7633 } 7634 ext = (struct sadb_ext *)(mtod(n, caddr_t) + toff); 7635 7636 /* set pointer */ 7637 switch (ext->sadb_ext_type) { 7638 case SADB_EXT_SA: 7639 case SADB_EXT_ADDRESS_SRC: 7640 case SADB_EXT_ADDRESS_DST: 7641 case SADB_EXT_ADDRESS_PROXY: 7642 case SADB_EXT_LIFETIME_CURRENT: 7643 case SADB_EXT_LIFETIME_HARD: 7644 case SADB_EXT_LIFETIME_SOFT: 7645 case SADB_EXT_KEY_AUTH: 7646 case SADB_EXT_KEY_ENCRYPT: 7647 case SADB_EXT_IDENTITY_SRC: 7648 case SADB_EXT_IDENTITY_DST: 7649 case SADB_EXT_SENSITIVITY: 7650 case SADB_EXT_PROPOSAL: 7651 case SADB_EXT_SUPPORTED_AUTH: 7652 case SADB_EXT_SUPPORTED_ENCRYPT: 7653 case SADB_EXT_SPIRANGE: 7654 case SADB_X_EXT_POLICY: 7655 case SADB_X_EXT_SA2: 7656 #ifdef IPSEC_NAT_T 7657 case SADB_X_EXT_NAT_T_TYPE: 7658 case SADB_X_EXT_NAT_T_SPORT: 7659 case SADB_X_EXT_NAT_T_DPORT: 7660 case SADB_X_EXT_NAT_T_OAI: 7661 case SADB_X_EXT_NAT_T_OAR: 7662 case SADB_X_EXT_NAT_T_FRAG: 7663 #endif 7664 case SADB_X_EXT_SA_REPLAY: 7665 /* duplicate check */ 7666 /* 7667 * XXX Are there duplication payloads of either 7668 * KEY_AUTH or KEY_ENCRYPT ? 7669 */ 7670 if (mhp->ext[ext->sadb_ext_type] != NULL) { 7671 ipseclog((LOG_DEBUG, "%s: duplicate ext_type " 7672 "%u\n", __func__, ext->sadb_ext_type)); 7673 m_freem(m); 7674 PFKEYSTAT_INC(out_dupext); 7675 return EINVAL; 7676 } 7677 break; 7678 default: 7679 ipseclog((LOG_DEBUG, "%s: invalid ext_type %u\n", 7680 __func__, ext->sadb_ext_type)); 7681 m_freem(m); 7682 PFKEYSTAT_INC(out_invexttype); 7683 return EINVAL; 7684 } 7685 7686 extlen = PFKEY_UNUNIT64(ext->sadb_ext_len); 7687 7688 if (key_validate_ext(ext, extlen)) { 7689 m_freem(m); 7690 PFKEYSTAT_INC(out_invlen); 7691 return EINVAL; 7692 } 7693 7694 n = m_pulldown(m, off, extlen, &toff); 7695 if (!n) { 7696 /* m is already freed */ 7697 return ENOBUFS; 7698 } 7699 ext = (struct sadb_ext *)(mtod(n, caddr_t) + toff); 7700 7701 mhp->ext[ext->sadb_ext_type] = ext; 7702 mhp->extoff[ext->sadb_ext_type] = off; 7703 mhp->extlen[ext->sadb_ext_type] = extlen; 7704 } 7705 7706 if (off != end) { 7707 m_freem(m); 7708 PFKEYSTAT_INC(out_invlen); 7709 return EINVAL; 7710 } 7711 7712 return 0; 7713 } 7714 7715 static int 7716 key_validate_ext(const struct sadb_ext *ext, int len) 7717 { 7718 const struct sockaddr *sa; 7719 enum { NONE, ADDR } checktype = NONE; 7720 int baselen = 0; 7721 const int sal = offsetof(struct sockaddr, sa_len) + sizeof(sa->sa_len); 7722 7723 if (len != PFKEY_UNUNIT64(ext->sadb_ext_len)) 7724 return EINVAL; 7725 7726 /* if it does not match minimum/maximum length, bail */ 7727 if (ext->sadb_ext_type >= nitems(minsize) || 7728 ext->sadb_ext_type >= nitems(maxsize)) 7729 return EINVAL; 7730 if (!minsize[ext->sadb_ext_type] || len < minsize[ext->sadb_ext_type]) 7731 return EINVAL; 7732 if (maxsize[ext->sadb_ext_type] && len > maxsize[ext->sadb_ext_type]) 7733 return EINVAL; 7734 7735 /* more checks based on sadb_ext_type XXX need more */ 7736 switch (ext->sadb_ext_type) { 7737 case SADB_EXT_ADDRESS_SRC: 7738 case SADB_EXT_ADDRESS_DST: 7739 case SADB_EXT_ADDRESS_PROXY: 7740 baselen = PFKEY_ALIGN8(sizeof(struct sadb_address)); 7741 checktype = ADDR; 7742 break; 7743 case SADB_EXT_IDENTITY_SRC: 7744 case SADB_EXT_IDENTITY_DST: 7745 if (((const struct sadb_ident *)ext)->sadb_ident_type == 7746 SADB_X_IDENTTYPE_ADDR) { 7747 baselen = PFKEY_ALIGN8(sizeof(struct sadb_ident)); 7748 checktype = ADDR; 7749 } else 7750 checktype = NONE; 7751 break; 7752 default: 7753 checktype = NONE; 7754 break; 7755 } 7756 7757 switch (checktype) { 7758 case NONE: 7759 break; 7760 case ADDR: 7761 sa = (const struct sockaddr *)(((const u_int8_t*)ext)+baselen); 7762 if (len < baselen + sal) 7763 return EINVAL; 7764 if (baselen + PFKEY_ALIGN8(sa->sa_len) != len) 7765 return EINVAL; 7766 break; 7767 } 7768 7769 return 0; 7770 } 7771 7772 void 7773 key_init(void) 7774 { 7775 int i; 7776 7777 for (i = 0; i < IPSEC_DIR_MAX; i++) 7778 TAILQ_INIT(&V_sptree[i]); 7779 7780 LIST_INIT(&V_sahtree); 7781 7782 for (i = 0; i <= SADB_SATYPE_MAX; i++) 7783 LIST_INIT(&V_regtree[i]); 7784 7785 LIST_INIT(&V_acqtree); 7786 LIST_INIT(&V_spacqtree); 7787 7788 if (!IS_DEFAULT_VNET(curvnet)) 7789 return; 7790 7791 SPTREE_LOCK_INIT(); 7792 REGTREE_LOCK_INIT(); 7793 SAHTREE_LOCK_INIT(); 7794 ACQ_LOCK_INIT(); 7795 SPACQ_LOCK_INIT(); 7796 7797 #ifndef IPSEC_DEBUG2 7798 callout_init(&key_timer, 1); 7799 callout_reset(&key_timer, hz, key_timehandler, NULL); 7800 #endif /*IPSEC_DEBUG2*/ 7801 7802 /* initialize key statistics */ 7803 keystat.getspi_count = 1; 7804 7805 if (bootverbose) 7806 printf("IPsec: Initialized Security Association Processing.\n"); 7807 } 7808 7809 #ifdef VIMAGE 7810 void 7811 key_destroy(void) 7812 { 7813 TAILQ_HEAD(, secpolicy) drainq; 7814 struct secpolicy *sp, *nextsp; 7815 struct secacq *acq, *nextacq; 7816 struct secspacq *spacq, *nextspacq; 7817 struct secashead *sah, *nextsah; 7818 struct secreg *reg; 7819 int i; 7820 7821 TAILQ_INIT(&drainq); 7822 SPTREE_WLOCK(); 7823 for (i = 0; i < IPSEC_DIR_MAX; i++) { 7824 TAILQ_CONCAT(&drainq, &V_sptree[i], chain); 7825 } 7826 SPTREE_WUNLOCK(); 7827 sp = TAILQ_FIRST(&drainq); 7828 while (sp != NULL) { 7829 nextsp = TAILQ_NEXT(sp, chain); 7830 KEY_FREESP(&sp); 7831 sp = nextsp; 7832 } 7833 7834 SAHTREE_LOCK(); 7835 for (sah = LIST_FIRST(&V_sahtree); sah != NULL; sah = nextsah) { 7836 nextsah = LIST_NEXT(sah, chain); 7837 if (__LIST_CHAINED(sah)) { 7838 LIST_REMOVE(sah, chain); 7839 free(sah, M_IPSEC_SAH); 7840 } 7841 } 7842 SAHTREE_UNLOCK(); 7843 7844 REGTREE_LOCK(); 7845 for (i = 0; i <= SADB_SATYPE_MAX; i++) { 7846 LIST_FOREACH(reg, &V_regtree[i], chain) { 7847 if (__LIST_CHAINED(reg)) { 7848 LIST_REMOVE(reg, chain); 7849 free(reg, M_IPSEC_SAR); 7850 break; 7851 } 7852 } 7853 } 7854 REGTREE_UNLOCK(); 7855 7856 ACQ_LOCK(); 7857 for (acq = LIST_FIRST(&V_acqtree); acq != NULL; acq = nextacq) { 7858 nextacq = LIST_NEXT(acq, chain); 7859 if (__LIST_CHAINED(acq)) { 7860 LIST_REMOVE(acq, chain); 7861 free(acq, M_IPSEC_SAQ); 7862 } 7863 } 7864 ACQ_UNLOCK(); 7865 7866 SPACQ_LOCK(); 7867 for (spacq = LIST_FIRST(&V_spacqtree); spacq != NULL; 7868 spacq = nextspacq) { 7869 nextspacq = LIST_NEXT(spacq, chain); 7870 if (__LIST_CHAINED(spacq)) { 7871 LIST_REMOVE(spacq, chain); 7872 free(spacq, M_IPSEC_SAQ); 7873 } 7874 } 7875 SPACQ_UNLOCK(); 7876 } 7877 #endif 7878 7879 /* 7880 * XXX: maybe This function is called after INBOUND IPsec processing. 7881 * 7882 * Special check for tunnel-mode packets. 7883 * We must make some checks for consistency between inner and outer IP header. 7884 * 7885 * xxx more checks to be provided 7886 */ 7887 int 7888 key_checktunnelsanity(struct secasvar *sav, u_int family, caddr_t src, 7889 caddr_t dst) 7890 { 7891 IPSEC_ASSERT(sav->sah != NULL, ("null SA header")); 7892 7893 /* XXX: check inner IP header */ 7894 7895 return 1; 7896 } 7897 7898 /* record data transfer on SA, and update timestamps */ 7899 void 7900 key_sa_recordxfer(struct secasvar *sav, struct mbuf *m) 7901 { 7902 IPSEC_ASSERT(sav != NULL, ("Null secasvar")); 7903 IPSEC_ASSERT(m != NULL, ("Null mbuf")); 7904 if (!sav->lft_c) 7905 return; 7906 7907 /* 7908 * XXX Currently, there is a difference of bytes size 7909 * between inbound and outbound processing. 7910 */ 7911 sav->lft_c->bytes += m->m_pkthdr.len; 7912 /* to check bytes lifetime is done in key_timehandler(). */ 7913 7914 /* 7915 * We use the number of packets as the unit of 7916 * allocations. We increment the variable 7917 * whenever {esp,ah}_{in,out}put is called. 7918 */ 7919 sav->lft_c->allocations++; 7920 /* XXX check for expires? */ 7921 7922 /* 7923 * NOTE: We record CURRENT usetime by using wall clock, 7924 * in seconds. HARD and SOFT lifetime are measured by the time 7925 * difference (again in seconds) from usetime. 7926 * 7927 * usetime 7928 * v expire expire 7929 * -----+-----+--------+---> t 7930 * <--------------> HARD 7931 * <-----> SOFT 7932 */ 7933 sav->lft_c->usetime = time_second; 7934 /* XXX check for expires? */ 7935 7936 return; 7937 } 7938 7939 static void 7940 key_sa_chgstate(struct secasvar *sav, u_int8_t state) 7941 { 7942 IPSEC_ASSERT(sav != NULL, ("NULL sav")); 7943 SAHTREE_LOCK_ASSERT(); 7944 7945 if (sav->state != state) { 7946 if (__LIST_CHAINED(sav)) 7947 LIST_REMOVE(sav, chain); 7948 sav->state = state; 7949 LIST_INSERT_HEAD(&sav->sah->savtree[state], sav, chain); 7950 } 7951 } 7952 7953 /* 7954 * Take one of the kernel's security keys and convert it into a PF_KEY 7955 * structure within an mbuf, suitable for sending up to a waiting 7956 * application in user land. 7957 * 7958 * IN: 7959 * src: A pointer to a kernel security key. 7960 * exttype: Which type of key this is. Refer to the PF_KEY data structures. 7961 * OUT: 7962 * a valid mbuf or NULL indicating an error 7963 * 7964 */ 7965 7966 static struct mbuf * 7967 key_setkey(struct seckey *src, u_int16_t exttype) 7968 { 7969 struct mbuf *m; 7970 struct sadb_key *p; 7971 int len; 7972 7973 if (src == NULL) 7974 return NULL; 7975 7976 len = PFKEY_ALIGN8(sizeof(struct sadb_key) + _KEYLEN(src)); 7977 m = m_get2(len, M_NOWAIT, MT_DATA, 0); 7978 if (m == NULL) 7979 return NULL; 7980 m_align(m, len); 7981 m->m_len = len; 7982 p = mtod(m, struct sadb_key *); 7983 bzero(p, len); 7984 p->sadb_key_len = PFKEY_UNIT64(len); 7985 p->sadb_key_exttype = exttype; 7986 p->sadb_key_bits = src->bits; 7987 bcopy(src->key_data, _KEYBUF(p), _KEYLEN(src)); 7988 7989 return m; 7990 } 7991 7992 /* 7993 * Take one of the kernel's lifetime data structures and convert it 7994 * into a PF_KEY structure within an mbuf, suitable for sending up to 7995 * a waiting application in user land. 7996 * 7997 * IN: 7998 * src: A pointer to a kernel lifetime structure. 7999 * exttype: Which type of lifetime this is. Refer to the PF_KEY 8000 * data structures for more information. 8001 * OUT: 8002 * a valid mbuf or NULL indicating an error 8003 * 8004 */ 8005 8006 static struct mbuf * 8007 key_setlifetime(struct seclifetime *src, u_int16_t exttype) 8008 { 8009 struct mbuf *m = NULL; 8010 struct sadb_lifetime *p; 8011 int len = PFKEY_ALIGN8(sizeof(struct sadb_lifetime)); 8012 8013 if (src == NULL) 8014 return NULL; 8015 8016 m = m_get2(len, M_NOWAIT, MT_DATA, 0); 8017 if (m == NULL) 8018 return m; 8019 m_align(m, len); 8020 m->m_len = len; 8021 p = mtod(m, struct sadb_lifetime *); 8022 8023 bzero(p, len); 8024 p->sadb_lifetime_len = PFKEY_UNIT64(len); 8025 p->sadb_lifetime_exttype = exttype; 8026 p->sadb_lifetime_allocations = src->allocations; 8027 p->sadb_lifetime_bytes = src->bytes; 8028 p->sadb_lifetime_addtime = src->addtime; 8029 p->sadb_lifetime_usetime = src->usetime; 8030 8031 return m; 8032 8033 } 8034