1 /* $FreeBSD$ */ 2 /* $KAME: key.c,v 1.191 2001/06/27 10:46:49 sakane Exp $ */ 3 4 /*- 5 * SPDX-License-Identifier: BSD-3-Clause 6 * 7 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. 8 * All rights reserved. 9 * 10 * Redistribution and use in source and binary forms, with or without 11 * modification, are permitted provided that the following conditions 12 * are met: 13 * 1. Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 3. Neither the name of the project nor the names of its contributors 19 * may be used to endorse or promote products derived from this software 20 * without specific prior written permission. 21 * 22 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND 23 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 24 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 25 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE 26 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 27 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 28 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 29 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 30 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 31 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 32 * SUCH DAMAGE. 33 */ 34 35 /* 36 * This code is referd to RFC 2367 37 */ 38 39 #include "opt_inet.h" 40 #include "opt_inet6.h" 41 #include "opt_ipsec.h" 42 43 #include <sys/types.h> 44 #include <sys/param.h> 45 #include <sys/systm.h> 46 #include <sys/kernel.h> 47 #include <sys/fnv_hash.h> 48 #include <sys/lock.h> 49 #include <sys/mutex.h> 50 #include <sys/mbuf.h> 51 #include <sys/domain.h> 52 #include <sys/protosw.h> 53 #include <sys/malloc.h> 54 #include <sys/rmlock.h> 55 #include <sys/socket.h> 56 #include <sys/socketvar.h> 57 #include <sys/sysctl.h> 58 #include <sys/errno.h> 59 #include <sys/proc.h> 60 #include <sys/queue.h> 61 #include <sys/refcount.h> 62 #include <sys/syslog.h> 63 64 #include <vm/uma.h> 65 66 #include <net/if.h> 67 #include <net/if_var.h> 68 #include <net/vnet.h> 69 #include <net/raw_cb.h> 70 71 #include <netinet/in.h> 72 #include <netinet/in_systm.h> 73 #include <netinet/ip.h> 74 #include <netinet/in_var.h> 75 #include <netinet/udp.h> 76 77 #ifdef INET6 78 #include <netinet/ip6.h> 79 #include <netinet6/in6_var.h> 80 #include <netinet6/ip6_var.h> 81 #endif /* INET6 */ 82 83 #include <net/pfkeyv2.h> 84 #include <netipsec/keydb.h> 85 #include <netipsec/key.h> 86 #include <netipsec/keysock.h> 87 #include <netipsec/key_debug.h> 88 89 #include <netipsec/ipsec.h> 90 #ifdef INET6 91 #include <netipsec/ipsec6.h> 92 #endif 93 94 #include <netipsec/xform.h> 95 #include <machine/in_cksum.h> 96 #include <machine/stdarg.h> 97 98 /* randomness */ 99 #include <sys/random.h> 100 101 #define FULLMASK 0xff 102 #define _BITS(bytes) ((bytes) << 3) 103 104 /* 105 * Note on SA reference counting: 106 * - SAs that are not in DEAD state will have (total external reference + 1) 107 * following value in reference count field. they cannot be freed and are 108 * referenced from SA header. 109 * - SAs that are in DEAD state will have (total external reference) 110 * in reference count field. they are ready to be freed. reference from 111 * SA header will be removed in key_delsav(), when the reference count 112 * field hits 0 (= no external reference other than from SA header. 113 */ 114 115 VNET_DEFINE(u_int32_t, key_debug_level) = 0; 116 VNET_DEFINE_STATIC(u_int, key_spi_trycnt) = 1000; 117 VNET_DEFINE_STATIC(u_int32_t, key_spi_minval) = 0x100; 118 VNET_DEFINE_STATIC(u_int32_t, key_spi_maxval) = 0x0fffffff; /* XXX */ 119 VNET_DEFINE_STATIC(u_int32_t, policy_id) = 0; 120 /*interval to initialize randseed,1(m)*/ 121 VNET_DEFINE_STATIC(u_int, key_int_random) = 60; 122 /* interval to expire acquiring, 30(s)*/ 123 VNET_DEFINE_STATIC(u_int, key_larval_lifetime) = 30; 124 /* counter for blocking SADB_ACQUIRE.*/ 125 VNET_DEFINE_STATIC(int, key_blockacq_count) = 10; 126 /* lifetime for blocking SADB_ACQUIRE.*/ 127 VNET_DEFINE_STATIC(int, key_blockacq_lifetime) = 20; 128 /* preferred old sa rather than new sa.*/ 129 VNET_DEFINE_STATIC(int, key_preferred_oldsa) = 1; 130 #define V_key_spi_trycnt VNET(key_spi_trycnt) 131 #define V_key_spi_minval VNET(key_spi_minval) 132 #define V_key_spi_maxval VNET(key_spi_maxval) 133 #define V_policy_id VNET(policy_id) 134 #define V_key_int_random VNET(key_int_random) 135 #define V_key_larval_lifetime VNET(key_larval_lifetime) 136 #define V_key_blockacq_count VNET(key_blockacq_count) 137 #define V_key_blockacq_lifetime VNET(key_blockacq_lifetime) 138 #define V_key_preferred_oldsa VNET(key_preferred_oldsa) 139 140 VNET_DEFINE_STATIC(u_int32_t, acq_seq) = 0; 141 #define V_acq_seq VNET(acq_seq) 142 143 VNET_DEFINE_STATIC(uint32_t, sp_genid) = 0; 144 #define V_sp_genid VNET(sp_genid) 145 146 /* SPD */ 147 TAILQ_HEAD(secpolicy_queue, secpolicy); 148 LIST_HEAD(secpolicy_list, secpolicy); 149 VNET_DEFINE_STATIC(struct secpolicy_queue, sptree[IPSEC_DIR_MAX]); 150 VNET_DEFINE_STATIC(struct secpolicy_queue, sptree_ifnet[IPSEC_DIR_MAX]); 151 static struct rmlock sptree_lock; 152 #define V_sptree VNET(sptree) 153 #define V_sptree_ifnet VNET(sptree_ifnet) 154 #define SPTREE_LOCK_INIT() rm_init(&sptree_lock, "sptree") 155 #define SPTREE_LOCK_DESTROY() rm_destroy(&sptree_lock) 156 #define SPTREE_RLOCK_TRACKER struct rm_priotracker sptree_tracker 157 #define SPTREE_RLOCK() rm_rlock(&sptree_lock, &sptree_tracker) 158 #define SPTREE_RUNLOCK() rm_runlock(&sptree_lock, &sptree_tracker) 159 #define SPTREE_RLOCK_ASSERT() rm_assert(&sptree_lock, RA_RLOCKED) 160 #define SPTREE_WLOCK() rm_wlock(&sptree_lock) 161 #define SPTREE_WUNLOCK() rm_wunlock(&sptree_lock) 162 #define SPTREE_WLOCK_ASSERT() rm_assert(&sptree_lock, RA_WLOCKED) 163 #define SPTREE_UNLOCK_ASSERT() rm_assert(&sptree_lock, RA_UNLOCKED) 164 165 /* Hash table for lookup SP using unique id */ 166 VNET_DEFINE_STATIC(struct secpolicy_list *, sphashtbl); 167 VNET_DEFINE_STATIC(u_long, sphash_mask); 168 #define V_sphashtbl VNET(sphashtbl) 169 #define V_sphash_mask VNET(sphash_mask) 170 171 #define SPHASH_NHASH_LOG2 7 172 #define SPHASH_NHASH (1 << SPHASH_NHASH_LOG2) 173 #define SPHASH_HASHVAL(id) (key_u32hash(id) & V_sphash_mask) 174 #define SPHASH_HASH(id) &V_sphashtbl[SPHASH_HASHVAL(id)] 175 176 /* SPD cache */ 177 struct spdcache_entry { 178 struct secpolicyindex spidx; /* secpolicyindex */ 179 struct secpolicy *sp; /* cached policy to be used */ 180 181 LIST_ENTRY(spdcache_entry) chain; 182 }; 183 LIST_HEAD(spdcache_entry_list, spdcache_entry); 184 185 #define SPDCACHE_MAX_ENTRIES_PER_HASH 8 186 187 VNET_DEFINE_STATIC(u_int, key_spdcache_maxentries) = 0; 188 #define V_key_spdcache_maxentries VNET(key_spdcache_maxentries) 189 VNET_DEFINE_STATIC(u_int, key_spdcache_threshold) = 32; 190 #define V_key_spdcache_threshold VNET(key_spdcache_threshold) 191 VNET_DEFINE_STATIC(unsigned long, spd_size) = 0; 192 #define V_spd_size VNET(spd_size) 193 194 #define SPDCACHE_ENABLED() (V_key_spdcache_maxentries != 0) 195 #define SPDCACHE_ACTIVE() \ 196 (SPDCACHE_ENABLED() && V_spd_size >= V_key_spdcache_threshold) 197 198 VNET_DEFINE_STATIC(struct spdcache_entry_list *, spdcachehashtbl); 199 VNET_DEFINE_STATIC(u_long, spdcachehash_mask); 200 #define V_spdcachehashtbl VNET(spdcachehashtbl) 201 #define V_spdcachehash_mask VNET(spdcachehash_mask) 202 203 #define SPDCACHE_HASHVAL(idx) \ 204 (key_addrprotohash(&(idx)->src, &(idx)->dst, &(idx)->ul_proto) & \ 205 V_spdcachehash_mask) 206 207 /* Each cache line is protected by a mutex */ 208 VNET_DEFINE_STATIC(struct mtx *, spdcache_lock); 209 #define V_spdcache_lock VNET(spdcache_lock) 210 211 #define SPDCACHE_LOCK_INIT(a) \ 212 mtx_init(&V_spdcache_lock[a], "spdcache", \ 213 "fast ipsec SPD cache", MTX_DEF|MTX_DUPOK) 214 #define SPDCACHE_LOCK_DESTROY(a) mtx_destroy(&V_spdcache_lock[a]) 215 #define SPDCACHE_LOCK(a) mtx_lock(&V_spdcache_lock[a]); 216 #define SPDCACHE_UNLOCK(a) mtx_unlock(&V_spdcache_lock[a]); 217 218 /* SAD */ 219 TAILQ_HEAD(secashead_queue, secashead); 220 LIST_HEAD(secashead_list, secashead); 221 VNET_DEFINE_STATIC(struct secashead_queue, sahtree); 222 static struct rmlock sahtree_lock; 223 #define V_sahtree VNET(sahtree) 224 #define SAHTREE_LOCK_INIT() rm_init(&sahtree_lock, "sahtree") 225 #define SAHTREE_LOCK_DESTROY() rm_destroy(&sahtree_lock) 226 #define SAHTREE_RLOCK_TRACKER struct rm_priotracker sahtree_tracker 227 #define SAHTREE_RLOCK() rm_rlock(&sahtree_lock, &sahtree_tracker) 228 #define SAHTREE_RUNLOCK() rm_runlock(&sahtree_lock, &sahtree_tracker) 229 #define SAHTREE_RLOCK_ASSERT() rm_assert(&sahtree_lock, RA_RLOCKED) 230 #define SAHTREE_WLOCK() rm_wlock(&sahtree_lock) 231 #define SAHTREE_WUNLOCK() rm_wunlock(&sahtree_lock) 232 #define SAHTREE_WLOCK_ASSERT() rm_assert(&sahtree_lock, RA_WLOCKED) 233 #define SAHTREE_UNLOCK_ASSERT() rm_assert(&sahtree_lock, RA_UNLOCKED) 234 235 /* Hash table for lookup in SAD using SA addresses */ 236 VNET_DEFINE_STATIC(struct secashead_list *, sahaddrhashtbl); 237 VNET_DEFINE_STATIC(u_long, sahaddrhash_mask); 238 #define V_sahaddrhashtbl VNET(sahaddrhashtbl) 239 #define V_sahaddrhash_mask VNET(sahaddrhash_mask) 240 241 #define SAHHASH_NHASH_LOG2 7 242 #define SAHHASH_NHASH (1 << SAHHASH_NHASH_LOG2) 243 #define SAHADDRHASH_HASHVAL(idx) \ 244 (key_addrprotohash(&(idx)->src, &(idx)->dst, &(idx)->proto) & \ 245 V_sahaddrhash_mask) 246 #define SAHADDRHASH_HASH(saidx) \ 247 &V_sahaddrhashtbl[SAHADDRHASH_HASHVAL(saidx)] 248 249 /* Hash table for lookup in SAD using SPI */ 250 LIST_HEAD(secasvar_list, secasvar); 251 VNET_DEFINE_STATIC(struct secasvar_list *, savhashtbl); 252 VNET_DEFINE_STATIC(u_long, savhash_mask); 253 #define V_savhashtbl VNET(savhashtbl) 254 #define V_savhash_mask VNET(savhash_mask) 255 #define SAVHASH_NHASH_LOG2 7 256 #define SAVHASH_NHASH (1 << SAVHASH_NHASH_LOG2) 257 #define SAVHASH_HASHVAL(spi) (key_u32hash(spi) & V_savhash_mask) 258 #define SAVHASH_HASH(spi) &V_savhashtbl[SAVHASH_HASHVAL(spi)] 259 260 static uint32_t 261 key_addrprotohash(const union sockaddr_union *src, 262 const union sockaddr_union *dst, const uint8_t *proto) 263 { 264 uint32_t hval; 265 266 hval = fnv_32_buf(proto, sizeof(*proto), 267 FNV1_32_INIT); 268 switch (dst->sa.sa_family) { 269 #ifdef INET 270 case AF_INET: 271 hval = fnv_32_buf(&src->sin.sin_addr, 272 sizeof(in_addr_t), hval); 273 hval = fnv_32_buf(&dst->sin.sin_addr, 274 sizeof(in_addr_t), hval); 275 break; 276 #endif 277 #ifdef INET6 278 case AF_INET6: 279 hval = fnv_32_buf(&src->sin6.sin6_addr, 280 sizeof(struct in6_addr), hval); 281 hval = fnv_32_buf(&dst->sin6.sin6_addr, 282 sizeof(struct in6_addr), hval); 283 break; 284 #endif 285 default: 286 hval = 0; 287 ipseclog((LOG_DEBUG, "%s: unknown address family %d\n", 288 __func__, dst->sa.sa_family)); 289 } 290 return (hval); 291 } 292 293 static uint32_t 294 key_u32hash(uint32_t val) 295 { 296 297 return (fnv_32_buf(&val, sizeof(val), FNV1_32_INIT)); 298 } 299 300 /* registed list */ 301 VNET_DEFINE_STATIC(LIST_HEAD(_regtree, secreg), regtree[SADB_SATYPE_MAX + 1]); 302 #define V_regtree VNET(regtree) 303 static struct mtx regtree_lock; 304 #define REGTREE_LOCK_INIT() \ 305 mtx_init(®tree_lock, "regtree", "fast ipsec regtree", MTX_DEF) 306 #define REGTREE_LOCK_DESTROY() mtx_destroy(®tree_lock) 307 #define REGTREE_LOCK() mtx_lock(®tree_lock) 308 #define REGTREE_UNLOCK() mtx_unlock(®tree_lock) 309 #define REGTREE_LOCK_ASSERT() mtx_assert(®tree_lock, MA_OWNED) 310 311 /* Acquiring list */ 312 LIST_HEAD(secacq_list, secacq); 313 VNET_DEFINE_STATIC(struct secacq_list, acqtree); 314 #define V_acqtree VNET(acqtree) 315 static struct mtx acq_lock; 316 #define ACQ_LOCK_INIT() \ 317 mtx_init(&acq_lock, "acqtree", "ipsec SA acquiring list", MTX_DEF) 318 #define ACQ_LOCK_DESTROY() mtx_destroy(&acq_lock) 319 #define ACQ_LOCK() mtx_lock(&acq_lock) 320 #define ACQ_UNLOCK() mtx_unlock(&acq_lock) 321 #define ACQ_LOCK_ASSERT() mtx_assert(&acq_lock, MA_OWNED) 322 323 /* Hash table for lookup in ACQ list using SA addresses */ 324 VNET_DEFINE_STATIC(struct secacq_list *, acqaddrhashtbl); 325 VNET_DEFINE_STATIC(u_long, acqaddrhash_mask); 326 #define V_acqaddrhashtbl VNET(acqaddrhashtbl) 327 #define V_acqaddrhash_mask VNET(acqaddrhash_mask) 328 329 /* Hash table for lookup in ACQ list using SEQ number */ 330 VNET_DEFINE_STATIC(struct secacq_list *, acqseqhashtbl); 331 VNET_DEFINE_STATIC(u_long, acqseqhash_mask); 332 #define V_acqseqhashtbl VNET(acqseqhashtbl) 333 #define V_acqseqhash_mask VNET(acqseqhash_mask) 334 335 #define ACQHASH_NHASH_LOG2 7 336 #define ACQHASH_NHASH (1 << ACQHASH_NHASH_LOG2) 337 #define ACQADDRHASH_HASHVAL(idx) \ 338 (key_addrprotohash(&(idx)->src, &(idx)->dst, &(idx)->proto) & \ 339 V_acqaddrhash_mask) 340 #define ACQSEQHASH_HASHVAL(seq) \ 341 (key_u32hash(seq) & V_acqseqhash_mask) 342 #define ACQADDRHASH_HASH(saidx) \ 343 &V_acqaddrhashtbl[ACQADDRHASH_HASHVAL(saidx)] 344 #define ACQSEQHASH_HASH(seq) \ 345 &V_acqseqhashtbl[ACQSEQHASH_HASHVAL(seq)] 346 /* SP acquiring list */ 347 VNET_DEFINE_STATIC(LIST_HEAD(_spacqtree, secspacq), spacqtree); 348 #define V_spacqtree VNET(spacqtree) 349 static struct mtx spacq_lock; 350 #define SPACQ_LOCK_INIT() \ 351 mtx_init(&spacq_lock, "spacqtree", \ 352 "fast ipsec security policy acquire list", MTX_DEF) 353 #define SPACQ_LOCK_DESTROY() mtx_destroy(&spacq_lock) 354 #define SPACQ_LOCK() mtx_lock(&spacq_lock) 355 #define SPACQ_UNLOCK() mtx_unlock(&spacq_lock) 356 #define SPACQ_LOCK_ASSERT() mtx_assert(&spacq_lock, MA_OWNED) 357 358 static const int minsize[] = { 359 sizeof(struct sadb_msg), /* SADB_EXT_RESERVED */ 360 sizeof(struct sadb_sa), /* SADB_EXT_SA */ 361 sizeof(struct sadb_lifetime), /* SADB_EXT_LIFETIME_CURRENT */ 362 sizeof(struct sadb_lifetime), /* SADB_EXT_LIFETIME_HARD */ 363 sizeof(struct sadb_lifetime), /* SADB_EXT_LIFETIME_SOFT */ 364 sizeof(struct sadb_address), /* SADB_EXT_ADDRESS_SRC */ 365 sizeof(struct sadb_address), /* SADB_EXT_ADDRESS_DST */ 366 sizeof(struct sadb_address), /* SADB_EXT_ADDRESS_PROXY */ 367 sizeof(struct sadb_key), /* SADB_EXT_KEY_AUTH */ 368 sizeof(struct sadb_key), /* SADB_EXT_KEY_ENCRYPT */ 369 sizeof(struct sadb_ident), /* SADB_EXT_IDENTITY_SRC */ 370 sizeof(struct sadb_ident), /* SADB_EXT_IDENTITY_DST */ 371 sizeof(struct sadb_sens), /* SADB_EXT_SENSITIVITY */ 372 sizeof(struct sadb_prop), /* SADB_EXT_PROPOSAL */ 373 sizeof(struct sadb_supported), /* SADB_EXT_SUPPORTED_AUTH */ 374 sizeof(struct sadb_supported), /* SADB_EXT_SUPPORTED_ENCRYPT */ 375 sizeof(struct sadb_spirange), /* SADB_EXT_SPIRANGE */ 376 0, /* SADB_X_EXT_KMPRIVATE */ 377 sizeof(struct sadb_x_policy), /* SADB_X_EXT_POLICY */ 378 sizeof(struct sadb_x_sa2), /* SADB_X_SA2 */ 379 sizeof(struct sadb_x_nat_t_type),/* SADB_X_EXT_NAT_T_TYPE */ 380 sizeof(struct sadb_x_nat_t_port),/* SADB_X_EXT_NAT_T_SPORT */ 381 sizeof(struct sadb_x_nat_t_port),/* SADB_X_EXT_NAT_T_DPORT */ 382 sizeof(struct sadb_address), /* SADB_X_EXT_NAT_T_OAI */ 383 sizeof(struct sadb_address), /* SADB_X_EXT_NAT_T_OAR */ 384 sizeof(struct sadb_x_nat_t_frag),/* SADB_X_EXT_NAT_T_FRAG */ 385 sizeof(struct sadb_x_sa_replay), /* SADB_X_EXT_SA_REPLAY */ 386 sizeof(struct sadb_address), /* SADB_X_EXT_NEW_ADDRESS_SRC */ 387 sizeof(struct sadb_address), /* SADB_X_EXT_NEW_ADDRESS_DST */ 388 }; 389 _Static_assert(sizeof(minsize)/sizeof(int) == SADB_EXT_MAX + 1, "minsize size mismatch"); 390 391 static const int maxsize[] = { 392 sizeof(struct sadb_msg), /* SADB_EXT_RESERVED */ 393 sizeof(struct sadb_sa), /* SADB_EXT_SA */ 394 sizeof(struct sadb_lifetime), /* SADB_EXT_LIFETIME_CURRENT */ 395 sizeof(struct sadb_lifetime), /* SADB_EXT_LIFETIME_HARD */ 396 sizeof(struct sadb_lifetime), /* SADB_EXT_LIFETIME_SOFT */ 397 0, /* SADB_EXT_ADDRESS_SRC */ 398 0, /* SADB_EXT_ADDRESS_DST */ 399 0, /* SADB_EXT_ADDRESS_PROXY */ 400 0, /* SADB_EXT_KEY_AUTH */ 401 0, /* SADB_EXT_KEY_ENCRYPT */ 402 0, /* SADB_EXT_IDENTITY_SRC */ 403 0, /* SADB_EXT_IDENTITY_DST */ 404 0, /* SADB_EXT_SENSITIVITY */ 405 0, /* SADB_EXT_PROPOSAL */ 406 0, /* SADB_EXT_SUPPORTED_AUTH */ 407 0, /* SADB_EXT_SUPPORTED_ENCRYPT */ 408 sizeof(struct sadb_spirange), /* SADB_EXT_SPIRANGE */ 409 0, /* SADB_X_EXT_KMPRIVATE */ 410 0, /* SADB_X_EXT_POLICY */ 411 sizeof(struct sadb_x_sa2), /* SADB_X_SA2 */ 412 sizeof(struct sadb_x_nat_t_type),/* SADB_X_EXT_NAT_T_TYPE */ 413 sizeof(struct sadb_x_nat_t_port),/* SADB_X_EXT_NAT_T_SPORT */ 414 sizeof(struct sadb_x_nat_t_port),/* SADB_X_EXT_NAT_T_DPORT */ 415 0, /* SADB_X_EXT_NAT_T_OAI */ 416 0, /* SADB_X_EXT_NAT_T_OAR */ 417 sizeof(struct sadb_x_nat_t_frag),/* SADB_X_EXT_NAT_T_FRAG */ 418 sizeof(struct sadb_x_sa_replay), /* SADB_X_EXT_SA_REPLAY */ 419 0, /* SADB_X_EXT_NEW_ADDRESS_SRC */ 420 0, /* SADB_X_EXT_NEW_ADDRESS_DST */ 421 }; 422 _Static_assert(sizeof(maxsize)/sizeof(int) == SADB_EXT_MAX + 1, "minsize size mismatch"); 423 424 /* 425 * Internal values for SA flags: 426 * SADB_X_EXT_F_CLONED means that SA was cloned by key_updateaddresses, 427 * thus we will not free the most of SA content in key_delsav(). 428 */ 429 #define SADB_X_EXT_F_CLONED 0x80000000 430 431 #define SADB_CHECKLEN(_mhp, _ext) \ 432 ((_mhp)->extlen[(_ext)] < minsize[(_ext)] || (maxsize[(_ext)] != 0 && \ 433 ((_mhp)->extlen[(_ext)] > maxsize[(_ext)]))) 434 #define SADB_CHECKHDR(_mhp, _ext) ((_mhp)->ext[(_ext)] == NULL) 435 436 VNET_DEFINE_STATIC(int, ipsec_esp_keymin) = 256; 437 VNET_DEFINE_STATIC(int, ipsec_esp_auth) = 0; 438 VNET_DEFINE_STATIC(int, ipsec_ah_keymin) = 128; 439 440 #define V_ipsec_esp_keymin VNET(ipsec_esp_keymin) 441 #define V_ipsec_esp_auth VNET(ipsec_esp_auth) 442 #define V_ipsec_ah_keymin VNET(ipsec_ah_keymin) 443 444 #ifdef IPSEC_DEBUG 445 VNET_DEFINE(int, ipsec_debug) = 1; 446 #else 447 VNET_DEFINE(int, ipsec_debug) = 0; 448 #endif 449 450 #ifdef INET 451 SYSCTL_DECL(_net_inet_ipsec); 452 SYSCTL_INT(_net_inet_ipsec, IPSECCTL_DEBUG, debug, 453 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ipsec_debug), 0, 454 "Enable IPsec debugging output when set."); 455 #endif 456 #ifdef INET6 457 SYSCTL_DECL(_net_inet6_ipsec6); 458 SYSCTL_INT(_net_inet6_ipsec6, IPSECCTL_DEBUG, debug, 459 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ipsec_debug), 0, 460 "Enable IPsec debugging output when set."); 461 #endif 462 463 SYSCTL_DECL(_net_key); 464 SYSCTL_INT(_net_key, KEYCTL_DEBUG_LEVEL, debug, 465 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(key_debug_level), 0, ""); 466 467 /* max count of trial for the decision of spi value */ 468 SYSCTL_INT(_net_key, KEYCTL_SPI_TRY, spi_trycnt, 469 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(key_spi_trycnt), 0, ""); 470 471 /* minimum spi value to allocate automatically. */ 472 SYSCTL_INT(_net_key, KEYCTL_SPI_MIN_VALUE, spi_minval, 473 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(key_spi_minval), 0, ""); 474 475 /* maximun spi value to allocate automatically. */ 476 SYSCTL_INT(_net_key, KEYCTL_SPI_MAX_VALUE, spi_maxval, 477 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(key_spi_maxval), 0, ""); 478 479 /* interval to initialize randseed */ 480 SYSCTL_INT(_net_key, KEYCTL_RANDOM_INT, int_random, 481 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(key_int_random), 0, ""); 482 483 /* lifetime for larval SA */ 484 SYSCTL_INT(_net_key, KEYCTL_LARVAL_LIFETIME, larval_lifetime, 485 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(key_larval_lifetime), 0, ""); 486 487 /* counter for blocking to send SADB_ACQUIRE to IKEd */ 488 SYSCTL_INT(_net_key, KEYCTL_BLOCKACQ_COUNT, blockacq_count, 489 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(key_blockacq_count), 0, ""); 490 491 /* lifetime for blocking to send SADB_ACQUIRE to IKEd */ 492 SYSCTL_INT(_net_key, KEYCTL_BLOCKACQ_LIFETIME, blockacq_lifetime, 493 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(key_blockacq_lifetime), 0, ""); 494 495 /* ESP auth */ 496 SYSCTL_INT(_net_key, KEYCTL_ESP_AUTH, esp_auth, 497 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ipsec_esp_auth), 0, ""); 498 499 /* minimum ESP key length */ 500 SYSCTL_INT(_net_key, KEYCTL_ESP_KEYMIN, esp_keymin, 501 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ipsec_esp_keymin), 0, ""); 502 503 /* minimum AH key length */ 504 SYSCTL_INT(_net_key, KEYCTL_AH_KEYMIN, ah_keymin, 505 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ipsec_ah_keymin), 0, ""); 506 507 /* perfered old SA rather than new SA */ 508 SYSCTL_INT(_net_key, KEYCTL_PREFERED_OLDSA, preferred_oldsa, 509 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(key_preferred_oldsa), 0, ""); 510 511 static SYSCTL_NODE(_net_key, OID_AUTO, spdcache, 512 CTLFLAG_RW | CTLFLAG_MPSAFE, 0, 513 "SPD cache"); 514 515 SYSCTL_UINT(_net_key_spdcache, OID_AUTO, maxentries, 516 CTLFLAG_VNET | CTLFLAG_RDTUN, &VNET_NAME(key_spdcache_maxentries), 0, 517 "Maximum number of entries in the SPD cache" 518 " (power of 2, 0 to disable)"); 519 520 SYSCTL_UINT(_net_key_spdcache, OID_AUTO, threshold, 521 CTLFLAG_VNET | CTLFLAG_RDTUN, &VNET_NAME(key_spdcache_threshold), 0, 522 "Number of SPs that make the SPD cache active"); 523 524 #define __LIST_CHAINED(elm) \ 525 (!((elm)->chain.le_next == NULL && (elm)->chain.le_prev == NULL)) 526 527 MALLOC_DEFINE(M_IPSEC_SA, "secasvar", "ipsec security association"); 528 MALLOC_DEFINE(M_IPSEC_SAH, "sahead", "ipsec sa head"); 529 MALLOC_DEFINE(M_IPSEC_SP, "ipsecpolicy", "ipsec security policy"); 530 MALLOC_DEFINE(M_IPSEC_SR, "ipsecrequest", "ipsec security request"); 531 MALLOC_DEFINE(M_IPSEC_MISC, "ipsec-misc", "ipsec miscellaneous"); 532 MALLOC_DEFINE(M_IPSEC_SAQ, "ipsec-saq", "ipsec sa acquire"); 533 MALLOC_DEFINE(M_IPSEC_SAR, "ipsec-reg", "ipsec sa acquire"); 534 MALLOC_DEFINE(M_IPSEC_SPDCACHE, "ipsec-spdcache", "ipsec SPD cache"); 535 536 VNET_DEFINE_STATIC(uma_zone_t, key_lft_zone); 537 #define V_key_lft_zone VNET(key_lft_zone) 538 539 /* 540 * set parameters into secpolicyindex buffer. 541 * Must allocate secpolicyindex buffer passed to this function. 542 */ 543 #define KEY_SETSECSPIDX(_dir, s, d, ps, pd, ulp, idx) \ 544 do { \ 545 bzero((idx), sizeof(struct secpolicyindex)); \ 546 (idx)->dir = (_dir); \ 547 (idx)->prefs = (ps); \ 548 (idx)->prefd = (pd); \ 549 (idx)->ul_proto = (ulp); \ 550 bcopy((s), &(idx)->src, ((const struct sockaddr *)(s))->sa_len); \ 551 bcopy((d), &(idx)->dst, ((const struct sockaddr *)(d))->sa_len); \ 552 } while (0) 553 554 /* 555 * set parameters into secasindex buffer. 556 * Must allocate secasindex buffer before calling this function. 557 */ 558 #define KEY_SETSECASIDX(p, m, r, s, d, idx) \ 559 do { \ 560 bzero((idx), sizeof(struct secasindex)); \ 561 (idx)->proto = (p); \ 562 (idx)->mode = (m); \ 563 (idx)->reqid = (r); \ 564 bcopy((s), &(idx)->src, ((const struct sockaddr *)(s))->sa_len); \ 565 bcopy((d), &(idx)->dst, ((const struct sockaddr *)(d))->sa_len); \ 566 key_porttosaddr(&(idx)->src.sa, 0); \ 567 key_porttosaddr(&(idx)->dst.sa, 0); \ 568 } while (0) 569 570 /* key statistics */ 571 struct _keystat { 572 u_long getspi_count; /* the avarage of count to try to get new SPI */ 573 } keystat; 574 575 struct sadb_msghdr { 576 struct sadb_msg *msg; 577 struct sadb_ext *ext[SADB_EXT_MAX + 1]; 578 int extoff[SADB_EXT_MAX + 1]; 579 int extlen[SADB_EXT_MAX + 1]; 580 }; 581 582 static struct supported_ealgs { 583 int sadb_alg; 584 const struct enc_xform *xform; 585 } supported_ealgs[] = { 586 { SADB_EALG_DESCBC, &enc_xform_des }, 587 { SADB_EALG_3DESCBC, &enc_xform_3des }, 588 { SADB_X_EALG_AES, &enc_xform_rijndael128 }, 589 { SADB_X_EALG_BLOWFISHCBC, &enc_xform_blf }, 590 { SADB_X_EALG_CAST128CBC, &enc_xform_cast5 }, 591 { SADB_EALG_NULL, &enc_xform_null }, 592 { SADB_X_EALG_CAMELLIACBC, &enc_xform_camellia }, 593 { SADB_X_EALG_AESCTR, &enc_xform_aes_icm }, 594 { SADB_X_EALG_AESGCM16, &enc_xform_aes_nist_gcm }, 595 { SADB_X_EALG_AESGMAC, &enc_xform_aes_nist_gmac }, 596 }; 597 598 static struct supported_aalgs { 599 int sadb_alg; 600 const struct auth_hash *xform; 601 } supported_aalgs[] = { 602 { SADB_X_AALG_NULL, &auth_hash_null }, 603 { SADB_AALG_MD5HMAC, &auth_hash_hmac_md5 }, 604 { SADB_AALG_SHA1HMAC, &auth_hash_hmac_sha1 }, 605 { SADB_X_AALG_RIPEMD160HMAC, &auth_hash_hmac_ripemd_160 }, 606 { SADB_X_AALG_MD5, &auth_hash_key_md5 }, 607 { SADB_X_AALG_SHA, &auth_hash_key_sha1 }, 608 { SADB_X_AALG_SHA2_256, &auth_hash_hmac_sha2_256 }, 609 { SADB_X_AALG_SHA2_384, &auth_hash_hmac_sha2_384 }, 610 { SADB_X_AALG_SHA2_512, &auth_hash_hmac_sha2_512 }, 611 { SADB_X_AALG_AES128GMAC, &auth_hash_nist_gmac_aes_128 }, 612 { SADB_X_AALG_AES192GMAC, &auth_hash_nist_gmac_aes_192 }, 613 { SADB_X_AALG_AES256GMAC, &auth_hash_nist_gmac_aes_256 }, 614 }; 615 616 static struct supported_calgs { 617 int sadb_alg; 618 const struct comp_algo *xform; 619 } supported_calgs[] = { 620 { SADB_X_CALG_DEFLATE, &comp_algo_deflate }, 621 }; 622 623 #ifndef IPSEC_DEBUG2 624 static struct callout key_timer; 625 #endif 626 627 static void key_unlink(struct secpolicy *); 628 static struct secpolicy *key_do_allocsp(struct secpolicyindex *spidx, u_int dir); 629 static struct secpolicy *key_getsp(struct secpolicyindex *); 630 static struct secpolicy *key_getspbyid(u_int32_t); 631 static struct mbuf *key_gather_mbuf(struct mbuf *, 632 const struct sadb_msghdr *, int, int, ...); 633 static int key_spdadd(struct socket *, struct mbuf *, 634 const struct sadb_msghdr *); 635 static uint32_t key_getnewspid(void); 636 static int key_spddelete(struct socket *, struct mbuf *, 637 const struct sadb_msghdr *); 638 static int key_spddelete2(struct socket *, struct mbuf *, 639 const struct sadb_msghdr *); 640 static int key_spdget(struct socket *, struct mbuf *, 641 const struct sadb_msghdr *); 642 static int key_spdflush(struct socket *, struct mbuf *, 643 const struct sadb_msghdr *); 644 static int key_spddump(struct socket *, struct mbuf *, 645 const struct sadb_msghdr *); 646 static struct mbuf *key_setdumpsp(struct secpolicy *, 647 u_int8_t, u_int32_t, u_int32_t); 648 static struct mbuf *key_sp2mbuf(struct secpolicy *); 649 static size_t key_getspreqmsglen(struct secpolicy *); 650 static int key_spdexpire(struct secpolicy *); 651 static struct secashead *key_newsah(struct secasindex *); 652 static void key_freesah(struct secashead **); 653 static void key_delsah(struct secashead *); 654 static struct secasvar *key_newsav(const struct sadb_msghdr *, 655 struct secasindex *, uint32_t, int *); 656 static void key_delsav(struct secasvar *); 657 static void key_unlinksav(struct secasvar *); 658 static struct secashead *key_getsah(struct secasindex *); 659 static int key_checkspidup(uint32_t); 660 static struct secasvar *key_getsavbyspi(uint32_t); 661 static int key_setnatt(struct secasvar *, const struct sadb_msghdr *); 662 static int key_setsaval(struct secasvar *, const struct sadb_msghdr *); 663 static int key_updatelifetimes(struct secasvar *, const struct sadb_msghdr *); 664 static int key_updateaddresses(struct socket *, struct mbuf *, 665 const struct sadb_msghdr *, struct secasvar *, struct secasindex *); 666 667 static struct mbuf *key_setdumpsa(struct secasvar *, u_int8_t, 668 u_int8_t, u_int32_t, u_int32_t); 669 static struct mbuf *key_setsadbmsg(u_int8_t, u_int16_t, u_int8_t, 670 u_int32_t, pid_t, u_int16_t); 671 static struct mbuf *key_setsadbsa(struct secasvar *); 672 static struct mbuf *key_setsadbaddr(u_int16_t, 673 const struct sockaddr *, u_int8_t, u_int16_t); 674 static struct mbuf *key_setsadbxport(u_int16_t, u_int16_t); 675 static struct mbuf *key_setsadbxtype(u_int16_t); 676 static struct mbuf *key_setsadbxsa2(u_int8_t, u_int32_t, u_int32_t); 677 static struct mbuf *key_setsadbxsareplay(u_int32_t); 678 static struct mbuf *key_setsadbxpolicy(u_int16_t, u_int8_t, 679 u_int32_t, u_int32_t); 680 static struct seckey *key_dup_keymsg(const struct sadb_key *, size_t, 681 struct malloc_type *); 682 static struct seclifetime *key_dup_lifemsg(const struct sadb_lifetime *src, 683 struct malloc_type *); 684 685 /* flags for key_cmpsaidx() */ 686 #define CMP_HEAD 1 /* protocol, addresses. */ 687 #define CMP_MODE_REQID 2 /* additionally HEAD, reqid, mode. */ 688 #define CMP_REQID 3 /* additionally HEAD, reaid. */ 689 #define CMP_EXACTLY 4 /* all elements. */ 690 static int key_cmpsaidx(const struct secasindex *, 691 const struct secasindex *, int); 692 static int key_cmpspidx_exactly(struct secpolicyindex *, 693 struct secpolicyindex *); 694 static int key_cmpspidx_withmask(struct secpolicyindex *, 695 struct secpolicyindex *); 696 static int key_bbcmp(const void *, const void *, u_int); 697 static uint8_t key_satype2proto(uint8_t); 698 static uint8_t key_proto2satype(uint8_t); 699 700 static int key_getspi(struct socket *, struct mbuf *, 701 const struct sadb_msghdr *); 702 static uint32_t key_do_getnewspi(struct sadb_spirange *, struct secasindex *); 703 static int key_update(struct socket *, struct mbuf *, 704 const struct sadb_msghdr *); 705 static int key_add(struct socket *, struct mbuf *, 706 const struct sadb_msghdr *); 707 static int key_setident(struct secashead *, const struct sadb_msghdr *); 708 static struct mbuf *key_getmsgbuf_x1(struct mbuf *, 709 const struct sadb_msghdr *); 710 static int key_delete(struct socket *, struct mbuf *, 711 const struct sadb_msghdr *); 712 static int key_delete_all(struct socket *, struct mbuf *, 713 const struct sadb_msghdr *, struct secasindex *); 714 static int key_get(struct socket *, struct mbuf *, 715 const struct sadb_msghdr *); 716 717 static void key_getcomb_setlifetime(struct sadb_comb *); 718 static struct mbuf *key_getcomb_ealg(void); 719 static struct mbuf *key_getcomb_ah(void); 720 static struct mbuf *key_getcomb_ipcomp(void); 721 static struct mbuf *key_getprop(const struct secasindex *); 722 723 static int key_acquire(const struct secasindex *, struct secpolicy *); 724 static uint32_t key_newacq(const struct secasindex *, int *); 725 static uint32_t key_getacq(const struct secasindex *, int *); 726 static int key_acqdone(const struct secasindex *, uint32_t); 727 static int key_acqreset(uint32_t); 728 static struct secspacq *key_newspacq(struct secpolicyindex *); 729 static struct secspacq *key_getspacq(struct secpolicyindex *); 730 static int key_acquire2(struct socket *, struct mbuf *, 731 const struct sadb_msghdr *); 732 static int key_register(struct socket *, struct mbuf *, 733 const struct sadb_msghdr *); 734 static int key_expire(struct secasvar *, int); 735 static int key_flush(struct socket *, struct mbuf *, 736 const struct sadb_msghdr *); 737 static int key_dump(struct socket *, struct mbuf *, 738 const struct sadb_msghdr *); 739 static int key_promisc(struct socket *, struct mbuf *, 740 const struct sadb_msghdr *); 741 static int key_senderror(struct socket *, struct mbuf *, int); 742 static int key_validate_ext(const struct sadb_ext *, int); 743 static int key_align(struct mbuf *, struct sadb_msghdr *); 744 static struct mbuf *key_setlifetime(struct seclifetime *, uint16_t); 745 static struct mbuf *key_setkey(struct seckey *, uint16_t); 746 747 static void spdcache_init(void); 748 static void spdcache_clear(void); 749 static struct spdcache_entry *spdcache_entry_alloc( 750 const struct secpolicyindex *spidx, 751 struct secpolicy *policy); 752 static void spdcache_entry_free(struct spdcache_entry *entry); 753 #ifdef VIMAGE 754 static void spdcache_destroy(void); 755 #endif 756 757 #define DBG_IPSEC_INITREF(t, p) do { \ 758 refcount_init(&(p)->refcnt, 1); \ 759 KEYDBG(KEY_STAMP, \ 760 printf("%s: Initialize refcnt %s(%p) = %u\n", \ 761 __func__, #t, (p), (p)->refcnt)); \ 762 } while (0) 763 #define DBG_IPSEC_ADDREF(t, p) do { \ 764 refcount_acquire(&(p)->refcnt); \ 765 KEYDBG(KEY_STAMP, \ 766 printf("%s: Acquire refcnt %s(%p) -> %u\n", \ 767 __func__, #t, (p), (p)->refcnt)); \ 768 } while (0) 769 #define DBG_IPSEC_DELREF(t, p) do { \ 770 KEYDBG(KEY_STAMP, \ 771 printf("%s: Release refcnt %s(%p) -> %u\n", \ 772 __func__, #t, (p), (p)->refcnt - 1)); \ 773 refcount_release(&(p)->refcnt); \ 774 } while (0) 775 776 #define IPSEC_INITREF(t, p) refcount_init(&(p)->refcnt, 1) 777 #define IPSEC_ADDREF(t, p) refcount_acquire(&(p)->refcnt) 778 #define IPSEC_DELREF(t, p) refcount_release(&(p)->refcnt) 779 780 #define SP_INITREF(p) IPSEC_INITREF(SP, p) 781 #define SP_ADDREF(p) IPSEC_ADDREF(SP, p) 782 #define SP_DELREF(p) IPSEC_DELREF(SP, p) 783 784 #define SAH_INITREF(p) IPSEC_INITREF(SAH, p) 785 #define SAH_ADDREF(p) IPSEC_ADDREF(SAH, p) 786 #define SAH_DELREF(p) IPSEC_DELREF(SAH, p) 787 788 #define SAV_INITREF(p) IPSEC_INITREF(SAV, p) 789 #define SAV_ADDREF(p) IPSEC_ADDREF(SAV, p) 790 #define SAV_DELREF(p) IPSEC_DELREF(SAV, p) 791 792 /* 793 * Update the refcnt while holding the SPTREE lock. 794 */ 795 void 796 key_addref(struct secpolicy *sp) 797 { 798 799 SP_ADDREF(sp); 800 } 801 802 /* 803 * Return 0 when there are known to be no SP's for the specified 804 * direction. Otherwise return 1. This is used by IPsec code 805 * to optimize performance. 806 */ 807 int 808 key_havesp(u_int dir) 809 { 810 811 return (dir == IPSEC_DIR_INBOUND || dir == IPSEC_DIR_OUTBOUND ? 812 TAILQ_FIRST(&V_sptree[dir]) != NULL : 1); 813 } 814 815 /* %%% IPsec policy management */ 816 /* 817 * Return current SPDB generation. 818 */ 819 uint32_t 820 key_getspgen(void) 821 { 822 823 return (V_sp_genid); 824 } 825 826 void 827 key_bumpspgen(void) 828 { 829 830 V_sp_genid++; 831 } 832 833 static int 834 key_checksockaddrs(struct sockaddr *src, struct sockaddr *dst) 835 { 836 837 /* family match */ 838 if (src->sa_family != dst->sa_family) 839 return (EINVAL); 840 /* sa_len match */ 841 if (src->sa_len != dst->sa_len) 842 return (EINVAL); 843 switch (src->sa_family) { 844 #ifdef INET 845 case AF_INET: 846 if (src->sa_len != sizeof(struct sockaddr_in)) 847 return (EINVAL); 848 break; 849 #endif 850 #ifdef INET6 851 case AF_INET6: 852 if (src->sa_len != sizeof(struct sockaddr_in6)) 853 return (EINVAL); 854 break; 855 #endif 856 default: 857 return (EAFNOSUPPORT); 858 } 859 return (0); 860 } 861 862 struct secpolicy * 863 key_do_allocsp(struct secpolicyindex *spidx, u_int dir) 864 { 865 SPTREE_RLOCK_TRACKER; 866 struct secpolicy *sp; 867 868 IPSEC_ASSERT(spidx != NULL, ("null spidx")); 869 IPSEC_ASSERT(dir == IPSEC_DIR_INBOUND || dir == IPSEC_DIR_OUTBOUND, 870 ("invalid direction %u", dir)); 871 872 SPTREE_RLOCK(); 873 TAILQ_FOREACH(sp, &V_sptree[dir], chain) { 874 if (key_cmpspidx_withmask(&sp->spidx, spidx)) { 875 SP_ADDREF(sp); 876 break; 877 } 878 } 879 SPTREE_RUNLOCK(); 880 return (sp); 881 } 882 883 884 /* 885 * allocating a SP for OUTBOUND or INBOUND packet. 886 * Must call key_freesp() later. 887 * OUT: NULL: not found 888 * others: found and return the pointer. 889 */ 890 struct secpolicy * 891 key_allocsp(struct secpolicyindex *spidx, u_int dir) 892 { 893 struct spdcache_entry *entry, *lastentry, *tmpentry; 894 struct secpolicy *sp; 895 uint32_t hashv; 896 int nb_entries; 897 898 if (!SPDCACHE_ACTIVE()) { 899 sp = key_do_allocsp(spidx, dir); 900 goto out; 901 } 902 903 hashv = SPDCACHE_HASHVAL(spidx); 904 SPDCACHE_LOCK(hashv); 905 nb_entries = 0; 906 LIST_FOREACH_SAFE(entry, &V_spdcachehashtbl[hashv], chain, tmpentry) { 907 /* Removed outdated entries */ 908 if (entry->sp != NULL && 909 entry->sp->state == IPSEC_SPSTATE_DEAD) { 910 LIST_REMOVE(entry, chain); 911 spdcache_entry_free(entry); 912 continue; 913 } 914 915 nb_entries++; 916 if (!key_cmpspidx_exactly(&entry->spidx, spidx)) { 917 lastentry = entry; 918 continue; 919 } 920 921 sp = entry->sp; 922 if (entry->sp != NULL) 923 SP_ADDREF(sp); 924 925 /* IPSECSTAT_INC(ips_spdcache_hits); */ 926 927 SPDCACHE_UNLOCK(hashv); 928 goto out; 929 } 930 931 /* IPSECSTAT_INC(ips_spdcache_misses); */ 932 933 sp = key_do_allocsp(spidx, dir); 934 entry = spdcache_entry_alloc(spidx, sp); 935 if (entry != NULL) { 936 if (nb_entries >= SPDCACHE_MAX_ENTRIES_PER_HASH) { 937 LIST_REMOVE(lastentry, chain); 938 spdcache_entry_free(lastentry); 939 } 940 941 LIST_INSERT_HEAD(&V_spdcachehashtbl[hashv], entry, chain); 942 } 943 944 SPDCACHE_UNLOCK(hashv); 945 946 out: 947 if (sp != NULL) { /* found a SPD entry */ 948 sp->lastused = time_second; 949 KEYDBG(IPSEC_STAMP, 950 printf("%s: return SP(%p)\n", __func__, sp)); 951 KEYDBG(IPSEC_DATA, kdebug_secpolicy(sp)); 952 } else { 953 KEYDBG(IPSEC_DATA, 954 printf("%s: lookup failed for ", __func__); 955 kdebug_secpolicyindex(spidx, NULL)); 956 } 957 return (sp); 958 } 959 960 /* 961 * Allocating an SA entry for an *INBOUND* or *OUTBOUND* TCP packet, signed 962 * or should be signed by MD5 signature. 963 * We don't use key_allocsa() for such lookups, because we don't know SPI. 964 * Unlike ESP and AH protocols, SPI isn't transmitted in the TCP header with 965 * signed packet. We use SADB only as storage for password. 966 * OUT: positive: corresponding SA for given saidx found. 967 * NULL: SA not found 968 */ 969 struct secasvar * 970 key_allocsa_tcpmd5(struct secasindex *saidx) 971 { 972 SAHTREE_RLOCK_TRACKER; 973 struct secashead *sah; 974 struct secasvar *sav; 975 976 IPSEC_ASSERT(saidx->proto == IPPROTO_TCP, 977 ("unexpected security protocol %u", saidx->proto)); 978 IPSEC_ASSERT(saidx->mode == IPSEC_MODE_TCPMD5, 979 ("unexpected mode %u", saidx->mode)); 980 981 SAHTREE_RLOCK(); 982 LIST_FOREACH(sah, SAHADDRHASH_HASH(saidx), addrhash) { 983 KEYDBG(IPSEC_DUMP, 984 printf("%s: checking SAH\n", __func__); 985 kdebug_secash(sah, " ")); 986 if (sah->saidx.proto != IPPROTO_TCP) 987 continue; 988 if (!key_sockaddrcmp(&saidx->dst.sa, &sah->saidx.dst.sa, 0) && 989 !key_sockaddrcmp(&saidx->src.sa, &sah->saidx.src.sa, 0)) 990 break; 991 } 992 if (sah != NULL) { 993 if (V_key_preferred_oldsa) 994 sav = TAILQ_LAST(&sah->savtree_alive, secasvar_queue); 995 else 996 sav = TAILQ_FIRST(&sah->savtree_alive); 997 if (sav != NULL) 998 SAV_ADDREF(sav); 999 } else 1000 sav = NULL; 1001 SAHTREE_RUNLOCK(); 1002 1003 if (sav != NULL) { 1004 KEYDBG(IPSEC_STAMP, 1005 printf("%s: return SA(%p)\n", __func__, sav)); 1006 KEYDBG(IPSEC_DATA, kdebug_secasv(sav)); 1007 } else { 1008 KEYDBG(IPSEC_STAMP, 1009 printf("%s: SA not found\n", __func__)); 1010 KEYDBG(IPSEC_DATA, kdebug_secasindex(saidx, NULL)); 1011 } 1012 return (sav); 1013 } 1014 1015 /* 1016 * Allocating an SA entry for an *OUTBOUND* packet. 1017 * OUT: positive: corresponding SA for given saidx found. 1018 * NULL: SA not found, but will be acquired, check *error 1019 * for acquiring status. 1020 */ 1021 struct secasvar * 1022 key_allocsa_policy(struct secpolicy *sp, const struct secasindex *saidx, 1023 int *error) 1024 { 1025 SAHTREE_RLOCK_TRACKER; 1026 struct secashead *sah; 1027 struct secasvar *sav; 1028 1029 IPSEC_ASSERT(saidx != NULL, ("null saidx")); 1030 IPSEC_ASSERT(saidx->mode == IPSEC_MODE_TRANSPORT || 1031 saidx->mode == IPSEC_MODE_TUNNEL, 1032 ("unexpected policy %u", saidx->mode)); 1033 1034 /* 1035 * We check new SA in the IPsec request because a different 1036 * SA may be involved each time this request is checked, either 1037 * because new SAs are being configured, or this request is 1038 * associated with an unconnected datagram socket, or this request 1039 * is associated with a system default policy. 1040 */ 1041 SAHTREE_RLOCK(); 1042 LIST_FOREACH(sah, SAHADDRHASH_HASH(saidx), addrhash) { 1043 KEYDBG(IPSEC_DUMP, 1044 printf("%s: checking SAH\n", __func__); 1045 kdebug_secash(sah, " ")); 1046 if (key_cmpsaidx(&sah->saidx, saidx, CMP_MODE_REQID)) 1047 break; 1048 1049 } 1050 if (sah != NULL) { 1051 /* 1052 * Allocate the oldest SA available according to 1053 * draft-jenkins-ipsec-rekeying-03. 1054 */ 1055 if (V_key_preferred_oldsa) 1056 sav = TAILQ_LAST(&sah->savtree_alive, secasvar_queue); 1057 else 1058 sav = TAILQ_FIRST(&sah->savtree_alive); 1059 if (sav != NULL) 1060 SAV_ADDREF(sav); 1061 } else 1062 sav = NULL; 1063 SAHTREE_RUNLOCK(); 1064 1065 if (sav != NULL) { 1066 *error = 0; 1067 KEYDBG(IPSEC_STAMP, 1068 printf("%s: chosen SA(%p) for SP(%p)\n", __func__, 1069 sav, sp)); 1070 KEYDBG(IPSEC_DATA, kdebug_secasv(sav)); 1071 return (sav); /* return referenced SA */ 1072 } 1073 1074 /* there is no SA */ 1075 *error = key_acquire(saidx, sp); 1076 if ((*error) != 0) 1077 ipseclog((LOG_DEBUG, 1078 "%s: error %d returned from key_acquire()\n", 1079 __func__, *error)); 1080 KEYDBG(IPSEC_STAMP, 1081 printf("%s: acquire SA for SP(%p), error %d\n", 1082 __func__, sp, *error)); 1083 KEYDBG(IPSEC_DATA, kdebug_secasindex(saidx, NULL)); 1084 return (NULL); 1085 } 1086 1087 /* 1088 * allocating a usable SA entry for a *INBOUND* packet. 1089 * Must call key_freesav() later. 1090 * OUT: positive: pointer to a usable sav (i.e. MATURE or DYING state). 1091 * NULL: not found, or error occurred. 1092 * 1093 * According to RFC 2401 SA is uniquely identified by a triple SPI, 1094 * destination address, and security protocol. But according to RFC 4301, 1095 * SPI by itself suffices to specify an SA. 1096 * 1097 * Note that, however, we do need to keep source address in IPsec SA. 1098 * IKE specification and PF_KEY specification do assume that we 1099 * keep source address in IPsec SA. We see a tricky situation here. 1100 */ 1101 struct secasvar * 1102 key_allocsa(union sockaddr_union *dst, uint8_t proto, uint32_t spi) 1103 { 1104 SAHTREE_RLOCK_TRACKER; 1105 struct secasvar *sav; 1106 1107 IPSEC_ASSERT(proto == IPPROTO_ESP || proto == IPPROTO_AH || 1108 proto == IPPROTO_IPCOMP, ("unexpected security protocol %u", 1109 proto)); 1110 1111 SAHTREE_RLOCK(); 1112 LIST_FOREACH(sav, SAVHASH_HASH(spi), spihash) { 1113 if (sav->spi == spi) 1114 break; 1115 } 1116 /* 1117 * We use single SPI namespace for all protocols, so it is 1118 * impossible to have SPI duplicates in the SAVHASH. 1119 */ 1120 if (sav != NULL) { 1121 if (sav->state != SADB_SASTATE_LARVAL && 1122 sav->sah->saidx.proto == proto && 1123 key_sockaddrcmp(&dst->sa, 1124 &sav->sah->saidx.dst.sa, 0) == 0) 1125 SAV_ADDREF(sav); 1126 else 1127 sav = NULL; 1128 } 1129 SAHTREE_RUNLOCK(); 1130 1131 if (sav == NULL) { 1132 KEYDBG(IPSEC_STAMP, 1133 char buf[IPSEC_ADDRSTRLEN]; 1134 printf("%s: SA not found for spi %u proto %u dst %s\n", 1135 __func__, ntohl(spi), proto, ipsec_address(dst, buf, 1136 sizeof(buf)))); 1137 } else { 1138 KEYDBG(IPSEC_STAMP, 1139 printf("%s: return SA(%p)\n", __func__, sav)); 1140 KEYDBG(IPSEC_DATA, kdebug_secasv(sav)); 1141 } 1142 return (sav); 1143 } 1144 1145 struct secasvar * 1146 key_allocsa_tunnel(union sockaddr_union *src, union sockaddr_union *dst, 1147 uint8_t proto) 1148 { 1149 SAHTREE_RLOCK_TRACKER; 1150 struct secasindex saidx; 1151 struct secashead *sah; 1152 struct secasvar *sav; 1153 1154 IPSEC_ASSERT(src != NULL, ("null src address")); 1155 IPSEC_ASSERT(dst != NULL, ("null dst address")); 1156 1157 KEY_SETSECASIDX(proto, IPSEC_MODE_TUNNEL, 0, &src->sa, 1158 &dst->sa, &saidx); 1159 1160 sav = NULL; 1161 SAHTREE_RLOCK(); 1162 LIST_FOREACH(sah, SAHADDRHASH_HASH(&saidx), addrhash) { 1163 if (IPSEC_MODE_TUNNEL != sah->saidx.mode) 1164 continue; 1165 if (proto != sah->saidx.proto) 1166 continue; 1167 if (key_sockaddrcmp(&src->sa, &sah->saidx.src.sa, 0) != 0) 1168 continue; 1169 if (key_sockaddrcmp(&dst->sa, &sah->saidx.dst.sa, 0) != 0) 1170 continue; 1171 /* XXXAE: is key_preferred_oldsa reasonably?*/ 1172 if (V_key_preferred_oldsa) 1173 sav = TAILQ_LAST(&sah->savtree_alive, secasvar_queue); 1174 else 1175 sav = TAILQ_FIRST(&sah->savtree_alive); 1176 if (sav != NULL) { 1177 SAV_ADDREF(sav); 1178 break; 1179 } 1180 } 1181 SAHTREE_RUNLOCK(); 1182 KEYDBG(IPSEC_STAMP, 1183 printf("%s: return SA(%p)\n", __func__, sav)); 1184 if (sav != NULL) 1185 KEYDBG(IPSEC_DATA, kdebug_secasv(sav)); 1186 return (sav); 1187 } 1188 1189 /* 1190 * Must be called after calling key_allocsp(). 1191 */ 1192 void 1193 key_freesp(struct secpolicy **spp) 1194 { 1195 struct secpolicy *sp = *spp; 1196 1197 IPSEC_ASSERT(sp != NULL, ("null sp")); 1198 if (SP_DELREF(sp) == 0) 1199 return; 1200 1201 KEYDBG(IPSEC_STAMP, 1202 printf("%s: last reference to SP(%p)\n", __func__, sp)); 1203 KEYDBG(IPSEC_DATA, kdebug_secpolicy(sp)); 1204 1205 *spp = NULL; 1206 while (sp->tcount > 0) 1207 ipsec_delisr(sp->req[--sp->tcount]); 1208 free(sp, M_IPSEC_SP); 1209 } 1210 1211 static void 1212 key_unlink(struct secpolicy *sp) 1213 { 1214 1215 IPSEC_ASSERT(sp->spidx.dir == IPSEC_DIR_INBOUND || 1216 sp->spidx.dir == IPSEC_DIR_OUTBOUND, 1217 ("invalid direction %u", sp->spidx.dir)); 1218 SPTREE_UNLOCK_ASSERT(); 1219 1220 KEYDBG(KEY_STAMP, 1221 printf("%s: SP(%p)\n", __func__, sp)); 1222 SPTREE_WLOCK(); 1223 if (sp->state != IPSEC_SPSTATE_ALIVE) { 1224 /* SP is already unlinked */ 1225 SPTREE_WUNLOCK(); 1226 return; 1227 } 1228 sp->state = IPSEC_SPSTATE_DEAD; 1229 TAILQ_REMOVE(&V_sptree[sp->spidx.dir], sp, chain); 1230 V_spd_size--; 1231 LIST_REMOVE(sp, idhash); 1232 V_sp_genid++; 1233 SPTREE_WUNLOCK(); 1234 if (SPDCACHE_ENABLED()) 1235 spdcache_clear(); 1236 key_freesp(&sp); 1237 } 1238 1239 /* 1240 * insert a secpolicy into the SP database. Lower priorities first 1241 */ 1242 static void 1243 key_insertsp(struct secpolicy *newsp) 1244 { 1245 struct secpolicy *sp; 1246 1247 SPTREE_WLOCK_ASSERT(); 1248 TAILQ_FOREACH(sp, &V_sptree[newsp->spidx.dir], chain) { 1249 if (newsp->priority < sp->priority) { 1250 TAILQ_INSERT_BEFORE(sp, newsp, chain); 1251 goto done; 1252 } 1253 } 1254 TAILQ_INSERT_TAIL(&V_sptree[newsp->spidx.dir], newsp, chain); 1255 done: 1256 LIST_INSERT_HEAD(SPHASH_HASH(newsp->id), newsp, idhash); 1257 newsp->state = IPSEC_SPSTATE_ALIVE; 1258 V_spd_size++; 1259 V_sp_genid++; 1260 } 1261 1262 /* 1263 * Insert a bunch of VTI secpolicies into the SPDB. 1264 * We keep VTI policies in the separate list due to following reasons: 1265 * 1) they should be immutable to user's or some deamon's attempts to 1266 * delete. The only way delete such policies - destroy or unconfigure 1267 * corresponding virtual inteface. 1268 * 2) such policies have traffic selector that matches all traffic per 1269 * address family. 1270 * Since all VTI policies have the same priority, we don't care about 1271 * policies order. 1272 */ 1273 int 1274 key_register_ifnet(struct secpolicy **spp, u_int count) 1275 { 1276 struct mbuf *m; 1277 u_int i; 1278 1279 SPTREE_WLOCK(); 1280 /* 1281 * First of try to acquire id for each SP. 1282 */ 1283 for (i = 0; i < count; i++) { 1284 IPSEC_ASSERT(spp[i]->spidx.dir == IPSEC_DIR_INBOUND || 1285 spp[i]->spidx.dir == IPSEC_DIR_OUTBOUND, 1286 ("invalid direction %u", spp[i]->spidx.dir)); 1287 1288 if ((spp[i]->id = key_getnewspid()) == 0) { 1289 SPTREE_WUNLOCK(); 1290 return (EAGAIN); 1291 } 1292 } 1293 for (i = 0; i < count; i++) { 1294 TAILQ_INSERT_TAIL(&V_sptree_ifnet[spp[i]->spidx.dir], 1295 spp[i], chain); 1296 /* 1297 * NOTE: despite the fact that we keep VTI SP in the 1298 * separate list, SPHASH contains policies from both 1299 * sources. Thus SADB_X_SPDGET will correctly return 1300 * SP by id, because it uses SPHASH for lookups. 1301 */ 1302 LIST_INSERT_HEAD(SPHASH_HASH(spp[i]->id), spp[i], idhash); 1303 spp[i]->state = IPSEC_SPSTATE_IFNET; 1304 } 1305 SPTREE_WUNLOCK(); 1306 /* 1307 * Notify user processes about new SP. 1308 */ 1309 for (i = 0; i < count; i++) { 1310 m = key_setdumpsp(spp[i], SADB_X_SPDADD, 0, 0); 1311 if (m != NULL) 1312 key_sendup_mbuf(NULL, m, KEY_SENDUP_ALL); 1313 } 1314 return (0); 1315 } 1316 1317 void 1318 key_unregister_ifnet(struct secpolicy **spp, u_int count) 1319 { 1320 struct mbuf *m; 1321 u_int i; 1322 1323 SPTREE_WLOCK(); 1324 for (i = 0; i < count; i++) { 1325 IPSEC_ASSERT(spp[i]->spidx.dir == IPSEC_DIR_INBOUND || 1326 spp[i]->spidx.dir == IPSEC_DIR_OUTBOUND, 1327 ("invalid direction %u", spp[i]->spidx.dir)); 1328 1329 if (spp[i]->state != IPSEC_SPSTATE_IFNET) 1330 continue; 1331 spp[i]->state = IPSEC_SPSTATE_DEAD; 1332 TAILQ_REMOVE(&V_sptree_ifnet[spp[i]->spidx.dir], 1333 spp[i], chain); 1334 V_spd_size--; 1335 LIST_REMOVE(spp[i], idhash); 1336 } 1337 SPTREE_WUNLOCK(); 1338 if (SPDCACHE_ENABLED()) 1339 spdcache_clear(); 1340 1341 for (i = 0; i < count; i++) { 1342 m = key_setdumpsp(spp[i], SADB_X_SPDDELETE, 0, 0); 1343 if (m != NULL) 1344 key_sendup_mbuf(NULL, m, KEY_SENDUP_ALL); 1345 } 1346 } 1347 1348 /* 1349 * Must be called after calling key_allocsa(). 1350 * This function is called by key_freesp() to free some SA allocated 1351 * for a policy. 1352 */ 1353 void 1354 key_freesav(struct secasvar **psav) 1355 { 1356 struct secasvar *sav = *psav; 1357 1358 IPSEC_ASSERT(sav != NULL, ("null sav")); 1359 if (SAV_DELREF(sav) == 0) 1360 return; 1361 1362 KEYDBG(IPSEC_STAMP, 1363 printf("%s: last reference to SA(%p)\n", __func__, sav)); 1364 1365 *psav = NULL; 1366 key_delsav(sav); 1367 } 1368 1369 /* 1370 * Unlink SA from SAH and SPI hash under SAHTREE_WLOCK. 1371 * Expect that SA has extra reference due to lookup. 1372 * Release this references, also release SAH reference after unlink. 1373 */ 1374 static void 1375 key_unlinksav(struct secasvar *sav) 1376 { 1377 struct secashead *sah; 1378 1379 KEYDBG(KEY_STAMP, 1380 printf("%s: SA(%p)\n", __func__, sav)); 1381 1382 SAHTREE_UNLOCK_ASSERT(); 1383 SAHTREE_WLOCK(); 1384 if (sav->state == SADB_SASTATE_DEAD) { 1385 /* SA is already unlinked */ 1386 SAHTREE_WUNLOCK(); 1387 return; 1388 } 1389 /* Unlink from SAH */ 1390 if (sav->state == SADB_SASTATE_LARVAL) 1391 TAILQ_REMOVE(&sav->sah->savtree_larval, sav, chain); 1392 else 1393 TAILQ_REMOVE(&sav->sah->savtree_alive, sav, chain); 1394 /* Unlink from SPI hash */ 1395 LIST_REMOVE(sav, spihash); 1396 sav->state = SADB_SASTATE_DEAD; 1397 sah = sav->sah; 1398 SAHTREE_WUNLOCK(); 1399 key_freesav(&sav); 1400 /* Since we are unlinked, release reference to SAH */ 1401 key_freesah(&sah); 1402 } 1403 1404 /* %%% SPD management */ 1405 /* 1406 * search SPD 1407 * OUT: NULL : not found 1408 * others : found, pointer to a SP. 1409 */ 1410 static struct secpolicy * 1411 key_getsp(struct secpolicyindex *spidx) 1412 { 1413 SPTREE_RLOCK_TRACKER; 1414 struct secpolicy *sp; 1415 1416 IPSEC_ASSERT(spidx != NULL, ("null spidx")); 1417 1418 SPTREE_RLOCK(); 1419 TAILQ_FOREACH(sp, &V_sptree[spidx->dir], chain) { 1420 if (key_cmpspidx_exactly(spidx, &sp->spidx)) { 1421 SP_ADDREF(sp); 1422 break; 1423 } 1424 } 1425 SPTREE_RUNLOCK(); 1426 1427 return sp; 1428 } 1429 1430 /* 1431 * get SP by index. 1432 * OUT: NULL : not found 1433 * others : found, pointer to referenced SP. 1434 */ 1435 static struct secpolicy * 1436 key_getspbyid(uint32_t id) 1437 { 1438 SPTREE_RLOCK_TRACKER; 1439 struct secpolicy *sp; 1440 1441 SPTREE_RLOCK(); 1442 LIST_FOREACH(sp, SPHASH_HASH(id), idhash) { 1443 if (sp->id == id) { 1444 SP_ADDREF(sp); 1445 break; 1446 } 1447 } 1448 SPTREE_RUNLOCK(); 1449 return (sp); 1450 } 1451 1452 struct secpolicy * 1453 key_newsp(void) 1454 { 1455 struct secpolicy *sp; 1456 1457 sp = malloc(sizeof(*sp), M_IPSEC_SP, M_NOWAIT | M_ZERO); 1458 if (sp != NULL) 1459 SP_INITREF(sp); 1460 return (sp); 1461 } 1462 1463 struct ipsecrequest * 1464 ipsec_newisr(void) 1465 { 1466 1467 return (malloc(sizeof(struct ipsecrequest), M_IPSEC_SR, 1468 M_NOWAIT | M_ZERO)); 1469 } 1470 1471 void 1472 ipsec_delisr(struct ipsecrequest *p) 1473 { 1474 1475 free(p, M_IPSEC_SR); 1476 } 1477 1478 /* 1479 * create secpolicy structure from sadb_x_policy structure. 1480 * NOTE: `state', `secpolicyindex' and 'id' in secpolicy structure 1481 * are not set, so must be set properly later. 1482 */ 1483 struct secpolicy * 1484 key_msg2sp(struct sadb_x_policy *xpl0, size_t len, int *error) 1485 { 1486 struct secpolicy *newsp; 1487 1488 IPSEC_ASSERT(xpl0 != NULL, ("null xpl0")); 1489 IPSEC_ASSERT(len >= sizeof(*xpl0), ("policy too short: %zu", len)); 1490 1491 if (len != PFKEY_EXTLEN(xpl0)) { 1492 ipseclog((LOG_DEBUG, "%s: Invalid msg length.\n", __func__)); 1493 *error = EINVAL; 1494 return NULL; 1495 } 1496 1497 if ((newsp = key_newsp()) == NULL) { 1498 *error = ENOBUFS; 1499 return NULL; 1500 } 1501 1502 newsp->spidx.dir = xpl0->sadb_x_policy_dir; 1503 newsp->policy = xpl0->sadb_x_policy_type; 1504 newsp->priority = xpl0->sadb_x_policy_priority; 1505 newsp->tcount = 0; 1506 1507 /* check policy */ 1508 switch (xpl0->sadb_x_policy_type) { 1509 case IPSEC_POLICY_DISCARD: 1510 case IPSEC_POLICY_NONE: 1511 case IPSEC_POLICY_ENTRUST: 1512 case IPSEC_POLICY_BYPASS: 1513 break; 1514 1515 case IPSEC_POLICY_IPSEC: 1516 { 1517 struct sadb_x_ipsecrequest *xisr; 1518 struct ipsecrequest *isr; 1519 int tlen; 1520 1521 /* validity check */ 1522 if (PFKEY_EXTLEN(xpl0) < sizeof(*xpl0)) { 1523 ipseclog((LOG_DEBUG, "%s: Invalid msg length.\n", 1524 __func__)); 1525 key_freesp(&newsp); 1526 *error = EINVAL; 1527 return NULL; 1528 } 1529 1530 tlen = PFKEY_EXTLEN(xpl0) - sizeof(*xpl0); 1531 xisr = (struct sadb_x_ipsecrequest *)(xpl0 + 1); 1532 1533 while (tlen > 0) { 1534 /* length check */ 1535 if (xisr->sadb_x_ipsecrequest_len < sizeof(*xisr) || 1536 xisr->sadb_x_ipsecrequest_len > tlen) { 1537 ipseclog((LOG_DEBUG, "%s: invalid ipsecrequest " 1538 "length.\n", __func__)); 1539 key_freesp(&newsp); 1540 *error = EINVAL; 1541 return NULL; 1542 } 1543 1544 if (newsp->tcount >= IPSEC_MAXREQ) { 1545 ipseclog((LOG_DEBUG, 1546 "%s: too many ipsecrequests.\n", 1547 __func__)); 1548 key_freesp(&newsp); 1549 *error = EINVAL; 1550 return (NULL); 1551 } 1552 1553 /* allocate request buffer */ 1554 /* NB: data structure is zero'd */ 1555 isr = ipsec_newisr(); 1556 if (isr == NULL) { 1557 ipseclog((LOG_DEBUG, 1558 "%s: No more memory.\n", __func__)); 1559 key_freesp(&newsp); 1560 *error = ENOBUFS; 1561 return NULL; 1562 } 1563 1564 newsp->req[newsp->tcount++] = isr; 1565 1566 /* set values */ 1567 switch (xisr->sadb_x_ipsecrequest_proto) { 1568 case IPPROTO_ESP: 1569 case IPPROTO_AH: 1570 case IPPROTO_IPCOMP: 1571 break; 1572 default: 1573 ipseclog((LOG_DEBUG, 1574 "%s: invalid proto type=%u\n", __func__, 1575 xisr->sadb_x_ipsecrequest_proto)); 1576 key_freesp(&newsp); 1577 *error = EPROTONOSUPPORT; 1578 return NULL; 1579 } 1580 isr->saidx.proto = 1581 (uint8_t)xisr->sadb_x_ipsecrequest_proto; 1582 1583 switch (xisr->sadb_x_ipsecrequest_mode) { 1584 case IPSEC_MODE_TRANSPORT: 1585 case IPSEC_MODE_TUNNEL: 1586 break; 1587 case IPSEC_MODE_ANY: 1588 default: 1589 ipseclog((LOG_DEBUG, 1590 "%s: invalid mode=%u\n", __func__, 1591 xisr->sadb_x_ipsecrequest_mode)); 1592 key_freesp(&newsp); 1593 *error = EINVAL; 1594 return NULL; 1595 } 1596 isr->saidx.mode = xisr->sadb_x_ipsecrequest_mode; 1597 1598 switch (xisr->sadb_x_ipsecrequest_level) { 1599 case IPSEC_LEVEL_DEFAULT: 1600 case IPSEC_LEVEL_USE: 1601 case IPSEC_LEVEL_REQUIRE: 1602 break; 1603 case IPSEC_LEVEL_UNIQUE: 1604 /* validity check */ 1605 /* 1606 * If range violation of reqid, kernel will 1607 * update it, don't refuse it. 1608 */ 1609 if (xisr->sadb_x_ipsecrequest_reqid 1610 > IPSEC_MANUAL_REQID_MAX) { 1611 ipseclog((LOG_DEBUG, 1612 "%s: reqid=%d range " 1613 "violation, updated by kernel.\n", 1614 __func__, 1615 xisr->sadb_x_ipsecrequest_reqid)); 1616 xisr->sadb_x_ipsecrequest_reqid = 0; 1617 } 1618 1619 /* allocate new reqid id if reqid is zero. */ 1620 if (xisr->sadb_x_ipsecrequest_reqid == 0) { 1621 u_int32_t reqid; 1622 if ((reqid = key_newreqid()) == 0) { 1623 key_freesp(&newsp); 1624 *error = ENOBUFS; 1625 return NULL; 1626 } 1627 isr->saidx.reqid = reqid; 1628 xisr->sadb_x_ipsecrequest_reqid = reqid; 1629 } else { 1630 /* set it for manual keying. */ 1631 isr->saidx.reqid = 1632 xisr->sadb_x_ipsecrequest_reqid; 1633 } 1634 break; 1635 1636 default: 1637 ipseclog((LOG_DEBUG, "%s: invalid level=%u\n", 1638 __func__, 1639 xisr->sadb_x_ipsecrequest_level)); 1640 key_freesp(&newsp); 1641 *error = EINVAL; 1642 return NULL; 1643 } 1644 isr->level = xisr->sadb_x_ipsecrequest_level; 1645 1646 /* set IP addresses if there */ 1647 if (xisr->sadb_x_ipsecrequest_len > sizeof(*xisr)) { 1648 struct sockaddr *paddr; 1649 1650 len = tlen - sizeof(*xisr); 1651 paddr = (struct sockaddr *)(xisr + 1); 1652 /* validity check */ 1653 if (len < sizeof(struct sockaddr) || 1654 len < 2 * paddr->sa_len || 1655 paddr->sa_len > sizeof(isr->saidx.src)) { 1656 ipseclog((LOG_DEBUG, "%s: invalid " 1657 "request address length.\n", 1658 __func__)); 1659 key_freesp(&newsp); 1660 *error = EINVAL; 1661 return NULL; 1662 } 1663 /* 1664 * Request length should be enough to keep 1665 * source and destination addresses. 1666 */ 1667 if (xisr->sadb_x_ipsecrequest_len < 1668 sizeof(*xisr) + 2 * paddr->sa_len) { 1669 ipseclog((LOG_DEBUG, "%s: invalid " 1670 "ipsecrequest length.\n", 1671 __func__)); 1672 key_freesp(&newsp); 1673 *error = EINVAL; 1674 return (NULL); 1675 } 1676 bcopy(paddr, &isr->saidx.src, paddr->sa_len); 1677 paddr = (struct sockaddr *)((caddr_t)paddr + 1678 paddr->sa_len); 1679 1680 /* validity check */ 1681 if (paddr->sa_len != 1682 isr->saidx.src.sa.sa_len) { 1683 ipseclog((LOG_DEBUG, "%s: invalid " 1684 "request address length.\n", 1685 __func__)); 1686 key_freesp(&newsp); 1687 *error = EINVAL; 1688 return NULL; 1689 } 1690 /* AF family should match */ 1691 if (paddr->sa_family != 1692 isr->saidx.src.sa.sa_family) { 1693 ipseclog((LOG_DEBUG, "%s: address " 1694 "family doesn't match.\n", 1695 __func__)); 1696 key_freesp(&newsp); 1697 *error = EINVAL; 1698 return (NULL); 1699 } 1700 bcopy(paddr, &isr->saidx.dst, paddr->sa_len); 1701 } else { 1702 /* 1703 * Addresses for TUNNEL mode requests are 1704 * mandatory. 1705 */ 1706 if (isr->saidx.mode == IPSEC_MODE_TUNNEL) { 1707 ipseclog((LOG_DEBUG, "%s: missing " 1708 "request addresses.\n", __func__)); 1709 key_freesp(&newsp); 1710 *error = EINVAL; 1711 return (NULL); 1712 } 1713 } 1714 tlen -= xisr->sadb_x_ipsecrequest_len; 1715 1716 /* validity check */ 1717 if (tlen < 0) { 1718 ipseclog((LOG_DEBUG, "%s: becoming tlen < 0.\n", 1719 __func__)); 1720 key_freesp(&newsp); 1721 *error = EINVAL; 1722 return NULL; 1723 } 1724 1725 xisr = (struct sadb_x_ipsecrequest *)((caddr_t)xisr 1726 + xisr->sadb_x_ipsecrequest_len); 1727 } 1728 /* XXXAE: LARVAL SP */ 1729 if (newsp->tcount < 1) { 1730 ipseclog((LOG_DEBUG, "%s: valid IPSEC transforms " 1731 "not found.\n", __func__)); 1732 key_freesp(&newsp); 1733 *error = EINVAL; 1734 return (NULL); 1735 } 1736 } 1737 break; 1738 default: 1739 ipseclog((LOG_DEBUG, "%s: invalid policy type.\n", __func__)); 1740 key_freesp(&newsp); 1741 *error = EINVAL; 1742 return NULL; 1743 } 1744 1745 *error = 0; 1746 return (newsp); 1747 } 1748 1749 uint32_t 1750 key_newreqid(void) 1751 { 1752 static uint32_t auto_reqid = IPSEC_MANUAL_REQID_MAX + 1; 1753 1754 if (auto_reqid == ~0) 1755 auto_reqid = IPSEC_MANUAL_REQID_MAX + 1; 1756 else 1757 auto_reqid++; 1758 1759 /* XXX should be unique check */ 1760 return (auto_reqid); 1761 } 1762 1763 /* 1764 * copy secpolicy struct to sadb_x_policy structure indicated. 1765 */ 1766 static struct mbuf * 1767 key_sp2mbuf(struct secpolicy *sp) 1768 { 1769 struct mbuf *m; 1770 size_t tlen; 1771 1772 tlen = key_getspreqmsglen(sp); 1773 m = m_get2(tlen, M_NOWAIT, MT_DATA, 0); 1774 if (m == NULL) 1775 return (NULL); 1776 m_align(m, tlen); 1777 m->m_len = tlen; 1778 if (key_sp2msg(sp, m->m_data, &tlen) != 0) { 1779 m_freem(m); 1780 return (NULL); 1781 } 1782 return (m); 1783 } 1784 1785 int 1786 key_sp2msg(struct secpolicy *sp, void *request, size_t *len) 1787 { 1788 struct sadb_x_ipsecrequest *xisr; 1789 struct sadb_x_policy *xpl; 1790 struct ipsecrequest *isr; 1791 size_t xlen, ilen; 1792 caddr_t p; 1793 int error, i; 1794 1795 IPSEC_ASSERT(sp != NULL, ("null policy")); 1796 1797 xlen = sizeof(*xpl); 1798 if (*len < xlen) 1799 return (EINVAL); 1800 1801 error = 0; 1802 bzero(request, *len); 1803 xpl = (struct sadb_x_policy *)request; 1804 xpl->sadb_x_policy_exttype = SADB_X_EXT_POLICY; 1805 xpl->sadb_x_policy_type = sp->policy; 1806 xpl->sadb_x_policy_dir = sp->spidx.dir; 1807 xpl->sadb_x_policy_id = sp->id; 1808 xpl->sadb_x_policy_priority = sp->priority; 1809 switch (sp->state) { 1810 case IPSEC_SPSTATE_IFNET: 1811 xpl->sadb_x_policy_scope = IPSEC_POLICYSCOPE_IFNET; 1812 break; 1813 case IPSEC_SPSTATE_PCB: 1814 xpl->sadb_x_policy_scope = IPSEC_POLICYSCOPE_PCB; 1815 break; 1816 default: 1817 xpl->sadb_x_policy_scope = IPSEC_POLICYSCOPE_GLOBAL; 1818 } 1819 1820 /* if is the policy for ipsec ? */ 1821 if (sp->policy == IPSEC_POLICY_IPSEC) { 1822 p = (caddr_t)xpl + sizeof(*xpl); 1823 for (i = 0; i < sp->tcount; i++) { 1824 isr = sp->req[i]; 1825 ilen = PFKEY_ALIGN8(sizeof(*xisr) + 1826 isr->saidx.src.sa.sa_len + 1827 isr->saidx.dst.sa.sa_len); 1828 xlen += ilen; 1829 if (xlen > *len) { 1830 error = ENOBUFS; 1831 /* Calculate needed size */ 1832 continue; 1833 } 1834 xisr = (struct sadb_x_ipsecrequest *)p; 1835 xisr->sadb_x_ipsecrequest_len = ilen; 1836 xisr->sadb_x_ipsecrequest_proto = isr->saidx.proto; 1837 xisr->sadb_x_ipsecrequest_mode = isr->saidx.mode; 1838 xisr->sadb_x_ipsecrequest_level = isr->level; 1839 xisr->sadb_x_ipsecrequest_reqid = isr->saidx.reqid; 1840 1841 p += sizeof(*xisr); 1842 bcopy(&isr->saidx.src, p, isr->saidx.src.sa.sa_len); 1843 p += isr->saidx.src.sa.sa_len; 1844 bcopy(&isr->saidx.dst, p, isr->saidx.dst.sa.sa_len); 1845 p += isr->saidx.dst.sa.sa_len; 1846 } 1847 } 1848 xpl->sadb_x_policy_len = PFKEY_UNIT64(xlen); 1849 if (error == 0) 1850 *len = xlen; 1851 else 1852 *len = sizeof(*xpl); 1853 return (error); 1854 } 1855 1856 /* m will not be freed nor modified */ 1857 static struct mbuf * 1858 key_gather_mbuf(struct mbuf *m, const struct sadb_msghdr *mhp, 1859 int ndeep, int nitem, ...) 1860 { 1861 va_list ap; 1862 int idx; 1863 int i; 1864 struct mbuf *result = NULL, *n; 1865 int len; 1866 1867 IPSEC_ASSERT(m != NULL, ("null mbuf")); 1868 IPSEC_ASSERT(mhp != NULL, ("null msghdr")); 1869 1870 va_start(ap, nitem); 1871 for (i = 0; i < nitem; i++) { 1872 idx = va_arg(ap, int); 1873 if (idx < 0 || idx > SADB_EXT_MAX) 1874 goto fail; 1875 /* don't attempt to pull empty extension */ 1876 if (idx == SADB_EXT_RESERVED && mhp->msg == NULL) 1877 continue; 1878 if (idx != SADB_EXT_RESERVED && 1879 (mhp->ext[idx] == NULL || mhp->extlen[idx] == 0)) 1880 continue; 1881 1882 if (idx == SADB_EXT_RESERVED) { 1883 len = PFKEY_ALIGN8(sizeof(struct sadb_msg)); 1884 1885 IPSEC_ASSERT(len <= MHLEN, ("header too big %u", len)); 1886 1887 MGETHDR(n, M_NOWAIT, MT_DATA); 1888 if (!n) 1889 goto fail; 1890 n->m_len = len; 1891 n->m_next = NULL; 1892 m_copydata(m, 0, sizeof(struct sadb_msg), 1893 mtod(n, caddr_t)); 1894 } else if (i < ndeep) { 1895 len = mhp->extlen[idx]; 1896 n = m_get2(len, M_NOWAIT, MT_DATA, 0); 1897 if (n == NULL) 1898 goto fail; 1899 m_align(n, len); 1900 n->m_len = len; 1901 m_copydata(m, mhp->extoff[idx], mhp->extlen[idx], 1902 mtod(n, caddr_t)); 1903 } else { 1904 n = m_copym(m, mhp->extoff[idx], mhp->extlen[idx], 1905 M_NOWAIT); 1906 } 1907 if (n == NULL) 1908 goto fail; 1909 1910 if (result) 1911 m_cat(result, n); 1912 else 1913 result = n; 1914 } 1915 va_end(ap); 1916 1917 if ((result->m_flags & M_PKTHDR) != 0) { 1918 result->m_pkthdr.len = 0; 1919 for (n = result; n; n = n->m_next) 1920 result->m_pkthdr.len += n->m_len; 1921 } 1922 1923 return result; 1924 1925 fail: 1926 m_freem(result); 1927 va_end(ap); 1928 return NULL; 1929 } 1930 1931 /* 1932 * SADB_X_SPDADD, SADB_X_SPDSETIDX or SADB_X_SPDUPDATE processing 1933 * add an entry to SP database, when received 1934 * <base, address(SD), (lifetime(H),) policy> 1935 * from the user(?). 1936 * Adding to SP database, 1937 * and send 1938 * <base, address(SD), (lifetime(H),) policy> 1939 * to the socket which was send. 1940 * 1941 * SPDADD set a unique policy entry. 1942 * SPDSETIDX like SPDADD without a part of policy requests. 1943 * SPDUPDATE replace a unique policy entry. 1944 * 1945 * XXXAE: serialize this in PF_KEY to avoid races. 1946 * m will always be freed. 1947 */ 1948 static int 1949 key_spdadd(struct socket *so, struct mbuf *m, const struct sadb_msghdr *mhp) 1950 { 1951 struct secpolicyindex spidx; 1952 struct sadb_address *src0, *dst0; 1953 struct sadb_x_policy *xpl0, *xpl; 1954 struct sadb_lifetime *lft = NULL; 1955 struct secpolicy *newsp; 1956 int error; 1957 1958 IPSEC_ASSERT(so != NULL, ("null socket")); 1959 IPSEC_ASSERT(m != NULL, ("null mbuf")); 1960 IPSEC_ASSERT(mhp != NULL, ("null msghdr")); 1961 IPSEC_ASSERT(mhp->msg != NULL, ("null msg")); 1962 1963 if (SADB_CHECKHDR(mhp, SADB_EXT_ADDRESS_SRC) || 1964 SADB_CHECKHDR(mhp, SADB_EXT_ADDRESS_DST) || 1965 SADB_CHECKHDR(mhp, SADB_X_EXT_POLICY)) { 1966 ipseclog((LOG_DEBUG, 1967 "%s: invalid message: missing required header.\n", 1968 __func__)); 1969 return key_senderror(so, m, EINVAL); 1970 } 1971 if (SADB_CHECKLEN(mhp, SADB_EXT_ADDRESS_SRC) || 1972 SADB_CHECKLEN(mhp, SADB_EXT_ADDRESS_DST) || 1973 SADB_CHECKLEN(mhp, SADB_X_EXT_POLICY)) { 1974 ipseclog((LOG_DEBUG, 1975 "%s: invalid message: wrong header size.\n", __func__)); 1976 return key_senderror(so, m, EINVAL); 1977 } 1978 if (!SADB_CHECKHDR(mhp, SADB_EXT_LIFETIME_HARD)) { 1979 if (SADB_CHECKLEN(mhp, SADB_EXT_LIFETIME_HARD)) { 1980 ipseclog((LOG_DEBUG, 1981 "%s: invalid message: wrong header size.\n", 1982 __func__)); 1983 return key_senderror(so, m, EINVAL); 1984 } 1985 lft = (struct sadb_lifetime *)mhp->ext[SADB_EXT_LIFETIME_HARD]; 1986 } 1987 1988 src0 = (struct sadb_address *)mhp->ext[SADB_EXT_ADDRESS_SRC]; 1989 dst0 = (struct sadb_address *)mhp->ext[SADB_EXT_ADDRESS_DST]; 1990 xpl0 = (struct sadb_x_policy *)mhp->ext[SADB_X_EXT_POLICY]; 1991 1992 /* check the direciton */ 1993 switch (xpl0->sadb_x_policy_dir) { 1994 case IPSEC_DIR_INBOUND: 1995 case IPSEC_DIR_OUTBOUND: 1996 break; 1997 default: 1998 ipseclog((LOG_DEBUG, "%s: invalid SP direction.\n", __func__)); 1999 return key_senderror(so, m, EINVAL); 2000 } 2001 /* key_spdadd() accepts DISCARD, NONE and IPSEC. */ 2002 if (xpl0->sadb_x_policy_type != IPSEC_POLICY_DISCARD && 2003 xpl0->sadb_x_policy_type != IPSEC_POLICY_NONE && 2004 xpl0->sadb_x_policy_type != IPSEC_POLICY_IPSEC) { 2005 ipseclog((LOG_DEBUG, "%s: invalid policy type.\n", __func__)); 2006 return key_senderror(so, m, EINVAL); 2007 } 2008 2009 /* policy requests are mandatory when action is ipsec. */ 2010 if (xpl0->sadb_x_policy_type == IPSEC_POLICY_IPSEC && 2011 mhp->extlen[SADB_X_EXT_POLICY] <= sizeof(*xpl0)) { 2012 ipseclog((LOG_DEBUG, 2013 "%s: policy requests required.\n", __func__)); 2014 return key_senderror(so, m, EINVAL); 2015 } 2016 2017 error = key_checksockaddrs((struct sockaddr *)(src0 + 1), 2018 (struct sockaddr *)(dst0 + 1)); 2019 if (error != 0 || 2020 src0->sadb_address_proto != dst0->sadb_address_proto) { 2021 ipseclog((LOG_DEBUG, "%s: invalid sockaddr.\n", __func__)); 2022 return key_senderror(so, m, error); 2023 } 2024 /* make secindex */ 2025 KEY_SETSECSPIDX(xpl0->sadb_x_policy_dir, 2026 src0 + 1, 2027 dst0 + 1, 2028 src0->sadb_address_prefixlen, 2029 dst0->sadb_address_prefixlen, 2030 src0->sadb_address_proto, 2031 &spidx); 2032 /* Checking there is SP already or not. */ 2033 newsp = key_getsp(&spidx); 2034 if (newsp != NULL) { 2035 if (mhp->msg->sadb_msg_type == SADB_X_SPDUPDATE) { 2036 KEYDBG(KEY_STAMP, 2037 printf("%s: unlink SP(%p) for SPDUPDATE\n", 2038 __func__, newsp)); 2039 KEYDBG(KEY_DATA, kdebug_secpolicy(newsp)); 2040 key_unlink(newsp); 2041 key_freesp(&newsp); 2042 } else { 2043 key_freesp(&newsp); 2044 ipseclog((LOG_DEBUG, 2045 "%s: a SP entry exists already.\n", __func__)); 2046 return (key_senderror(so, m, EEXIST)); 2047 } 2048 } 2049 2050 /* allocate new SP entry */ 2051 if ((newsp = key_msg2sp(xpl0, PFKEY_EXTLEN(xpl0), &error)) == NULL) { 2052 return key_senderror(so, m, error); 2053 } 2054 2055 newsp->lastused = newsp->created = time_second; 2056 newsp->lifetime = lft ? lft->sadb_lifetime_addtime : 0; 2057 newsp->validtime = lft ? lft->sadb_lifetime_usetime : 0; 2058 bcopy(&spidx, &newsp->spidx, sizeof(spidx)); 2059 2060 /* XXXAE: there is race between key_getsp() and key_insertsp() */ 2061 SPTREE_WLOCK(); 2062 if ((newsp->id = key_getnewspid()) == 0) { 2063 SPTREE_WUNLOCK(); 2064 key_freesp(&newsp); 2065 return key_senderror(so, m, ENOBUFS); 2066 } 2067 key_insertsp(newsp); 2068 SPTREE_WUNLOCK(); 2069 if (SPDCACHE_ENABLED()) 2070 spdcache_clear(); 2071 2072 KEYDBG(KEY_STAMP, 2073 printf("%s: SP(%p)\n", __func__, newsp)); 2074 KEYDBG(KEY_DATA, kdebug_secpolicy(newsp)); 2075 2076 { 2077 struct mbuf *n, *mpolicy; 2078 struct sadb_msg *newmsg; 2079 int off; 2080 2081 /* create new sadb_msg to reply. */ 2082 if (lft) { 2083 n = key_gather_mbuf(m, mhp, 2, 5, SADB_EXT_RESERVED, 2084 SADB_X_EXT_POLICY, SADB_EXT_LIFETIME_HARD, 2085 SADB_EXT_ADDRESS_SRC, SADB_EXT_ADDRESS_DST); 2086 } else { 2087 n = key_gather_mbuf(m, mhp, 2, 4, SADB_EXT_RESERVED, 2088 SADB_X_EXT_POLICY, 2089 SADB_EXT_ADDRESS_SRC, SADB_EXT_ADDRESS_DST); 2090 } 2091 if (!n) 2092 return key_senderror(so, m, ENOBUFS); 2093 2094 if (n->m_len < sizeof(*newmsg)) { 2095 n = m_pullup(n, sizeof(*newmsg)); 2096 if (!n) 2097 return key_senderror(so, m, ENOBUFS); 2098 } 2099 newmsg = mtod(n, struct sadb_msg *); 2100 newmsg->sadb_msg_errno = 0; 2101 newmsg->sadb_msg_len = PFKEY_UNIT64(n->m_pkthdr.len); 2102 2103 off = 0; 2104 mpolicy = m_pulldown(n, PFKEY_ALIGN8(sizeof(struct sadb_msg)), 2105 sizeof(*xpl), &off); 2106 if (mpolicy == NULL) { 2107 /* n is already freed */ 2108 return key_senderror(so, m, ENOBUFS); 2109 } 2110 xpl = (struct sadb_x_policy *)(mtod(mpolicy, caddr_t) + off); 2111 if (xpl->sadb_x_policy_exttype != SADB_X_EXT_POLICY) { 2112 m_freem(n); 2113 return key_senderror(so, m, EINVAL); 2114 } 2115 xpl->sadb_x_policy_id = newsp->id; 2116 2117 m_freem(m); 2118 return key_sendup_mbuf(so, n, KEY_SENDUP_ALL); 2119 } 2120 } 2121 2122 /* 2123 * get new policy id. 2124 * OUT: 2125 * 0: failure. 2126 * others: success. 2127 */ 2128 static uint32_t 2129 key_getnewspid(void) 2130 { 2131 struct secpolicy *sp; 2132 uint32_t newid = 0; 2133 int count = V_key_spi_trycnt; /* XXX */ 2134 2135 SPTREE_WLOCK_ASSERT(); 2136 while (count--) { 2137 if (V_policy_id == ~0) /* overflowed */ 2138 newid = V_policy_id = 1; 2139 else 2140 newid = ++V_policy_id; 2141 LIST_FOREACH(sp, SPHASH_HASH(newid), idhash) { 2142 if (sp->id == newid) 2143 break; 2144 } 2145 if (sp == NULL) 2146 break; 2147 } 2148 if (count == 0 || newid == 0) { 2149 ipseclog((LOG_DEBUG, "%s: failed to allocate policy id.\n", 2150 __func__)); 2151 return (0); 2152 } 2153 return (newid); 2154 } 2155 2156 /* 2157 * SADB_SPDDELETE processing 2158 * receive 2159 * <base, address(SD), policy(*)> 2160 * from the user(?), and set SADB_SASTATE_DEAD, 2161 * and send, 2162 * <base, address(SD), policy(*)> 2163 * to the ikmpd. 2164 * policy(*) including direction of policy. 2165 * 2166 * m will always be freed. 2167 */ 2168 static int 2169 key_spddelete(struct socket *so, struct mbuf *m, 2170 const struct sadb_msghdr *mhp) 2171 { 2172 struct secpolicyindex spidx; 2173 struct sadb_address *src0, *dst0; 2174 struct sadb_x_policy *xpl0; 2175 struct secpolicy *sp; 2176 2177 IPSEC_ASSERT(so != NULL, ("null so")); 2178 IPSEC_ASSERT(m != NULL, ("null mbuf")); 2179 IPSEC_ASSERT(mhp != NULL, ("null msghdr")); 2180 IPSEC_ASSERT(mhp->msg != NULL, ("null msg")); 2181 2182 if (SADB_CHECKHDR(mhp, SADB_EXT_ADDRESS_SRC) || 2183 SADB_CHECKHDR(mhp, SADB_EXT_ADDRESS_DST) || 2184 SADB_CHECKHDR(mhp, SADB_X_EXT_POLICY)) { 2185 ipseclog((LOG_DEBUG, 2186 "%s: invalid message: missing required header.\n", 2187 __func__)); 2188 return key_senderror(so, m, EINVAL); 2189 } 2190 if (SADB_CHECKLEN(mhp, SADB_EXT_ADDRESS_SRC) || 2191 SADB_CHECKLEN(mhp, SADB_EXT_ADDRESS_DST) || 2192 SADB_CHECKLEN(mhp, SADB_X_EXT_POLICY)) { 2193 ipseclog((LOG_DEBUG, 2194 "%s: invalid message: wrong header size.\n", __func__)); 2195 return key_senderror(so, m, EINVAL); 2196 } 2197 2198 src0 = (struct sadb_address *)mhp->ext[SADB_EXT_ADDRESS_SRC]; 2199 dst0 = (struct sadb_address *)mhp->ext[SADB_EXT_ADDRESS_DST]; 2200 xpl0 = (struct sadb_x_policy *)mhp->ext[SADB_X_EXT_POLICY]; 2201 2202 /* check the direciton */ 2203 switch (xpl0->sadb_x_policy_dir) { 2204 case IPSEC_DIR_INBOUND: 2205 case IPSEC_DIR_OUTBOUND: 2206 break; 2207 default: 2208 ipseclog((LOG_DEBUG, "%s: invalid SP direction.\n", __func__)); 2209 return key_senderror(so, m, EINVAL); 2210 } 2211 /* Only DISCARD, NONE and IPSEC are allowed */ 2212 if (xpl0->sadb_x_policy_type != IPSEC_POLICY_DISCARD && 2213 xpl0->sadb_x_policy_type != IPSEC_POLICY_NONE && 2214 xpl0->sadb_x_policy_type != IPSEC_POLICY_IPSEC) { 2215 ipseclog((LOG_DEBUG, "%s: invalid policy type.\n", __func__)); 2216 return key_senderror(so, m, EINVAL); 2217 } 2218 if (key_checksockaddrs((struct sockaddr *)(src0 + 1), 2219 (struct sockaddr *)(dst0 + 1)) != 0 || 2220 src0->sadb_address_proto != dst0->sadb_address_proto) { 2221 ipseclog((LOG_DEBUG, "%s: invalid sockaddr.\n", __func__)); 2222 return key_senderror(so, m, EINVAL); 2223 } 2224 /* make secindex */ 2225 KEY_SETSECSPIDX(xpl0->sadb_x_policy_dir, 2226 src0 + 1, 2227 dst0 + 1, 2228 src0->sadb_address_prefixlen, 2229 dst0->sadb_address_prefixlen, 2230 src0->sadb_address_proto, 2231 &spidx); 2232 2233 /* Is there SP in SPD ? */ 2234 if ((sp = key_getsp(&spidx)) == NULL) { 2235 ipseclog((LOG_DEBUG, "%s: no SP found.\n", __func__)); 2236 return key_senderror(so, m, EINVAL); 2237 } 2238 2239 /* save policy id to buffer to be returned. */ 2240 xpl0->sadb_x_policy_id = sp->id; 2241 2242 KEYDBG(KEY_STAMP, 2243 printf("%s: SP(%p)\n", __func__, sp)); 2244 KEYDBG(KEY_DATA, kdebug_secpolicy(sp)); 2245 key_unlink(sp); 2246 key_freesp(&sp); 2247 2248 { 2249 struct mbuf *n; 2250 struct sadb_msg *newmsg; 2251 2252 /* create new sadb_msg to reply. */ 2253 n = key_gather_mbuf(m, mhp, 1, 4, SADB_EXT_RESERVED, 2254 SADB_X_EXT_POLICY, SADB_EXT_ADDRESS_SRC, SADB_EXT_ADDRESS_DST); 2255 if (!n) 2256 return key_senderror(so, m, ENOBUFS); 2257 2258 newmsg = mtod(n, struct sadb_msg *); 2259 newmsg->sadb_msg_errno = 0; 2260 newmsg->sadb_msg_len = PFKEY_UNIT64(n->m_pkthdr.len); 2261 2262 m_freem(m); 2263 return key_sendup_mbuf(so, n, KEY_SENDUP_ALL); 2264 } 2265 } 2266 2267 /* 2268 * SADB_SPDDELETE2 processing 2269 * receive 2270 * <base, policy(*)> 2271 * from the user(?), and set SADB_SASTATE_DEAD, 2272 * and send, 2273 * <base, policy(*)> 2274 * to the ikmpd. 2275 * policy(*) including direction of policy. 2276 * 2277 * m will always be freed. 2278 */ 2279 static int 2280 key_spddelete2(struct socket *so, struct mbuf *m, 2281 const struct sadb_msghdr *mhp) 2282 { 2283 struct secpolicy *sp; 2284 uint32_t id; 2285 2286 IPSEC_ASSERT(so != NULL, ("null socket")); 2287 IPSEC_ASSERT(m != NULL, ("null mbuf")); 2288 IPSEC_ASSERT(mhp != NULL, ("null msghdr")); 2289 IPSEC_ASSERT(mhp->msg != NULL, ("null msg")); 2290 2291 if (SADB_CHECKHDR(mhp, SADB_X_EXT_POLICY) || 2292 SADB_CHECKLEN(mhp, SADB_X_EXT_POLICY)) { 2293 ipseclog((LOG_DEBUG, "%s: invalid message is passed.\n", 2294 __func__)); 2295 return key_senderror(so, m, EINVAL); 2296 } 2297 2298 id = ((struct sadb_x_policy *) 2299 mhp->ext[SADB_X_EXT_POLICY])->sadb_x_policy_id; 2300 2301 /* Is there SP in SPD ? */ 2302 if ((sp = key_getspbyid(id)) == NULL) { 2303 ipseclog((LOG_DEBUG, "%s: no SP found for id %u.\n", 2304 __func__, id)); 2305 return key_senderror(so, m, EINVAL); 2306 } 2307 2308 KEYDBG(KEY_STAMP, 2309 printf("%s: SP(%p)\n", __func__, sp)); 2310 KEYDBG(KEY_DATA, kdebug_secpolicy(sp)); 2311 key_unlink(sp); 2312 if (sp->state != IPSEC_SPSTATE_DEAD) { 2313 ipseclog((LOG_DEBUG, "%s: failed to delete SP with id %u.\n", 2314 __func__, id)); 2315 key_freesp(&sp); 2316 return (key_senderror(so, m, EACCES)); 2317 } 2318 key_freesp(&sp); 2319 2320 { 2321 struct mbuf *n, *nn; 2322 struct sadb_msg *newmsg; 2323 int off, len; 2324 2325 /* create new sadb_msg to reply. */ 2326 len = PFKEY_ALIGN8(sizeof(struct sadb_msg)); 2327 2328 MGETHDR(n, M_NOWAIT, MT_DATA); 2329 if (n && len > MHLEN) { 2330 if (!(MCLGET(n, M_NOWAIT))) { 2331 m_freem(n); 2332 n = NULL; 2333 } 2334 } 2335 if (!n) 2336 return key_senderror(so, m, ENOBUFS); 2337 2338 n->m_len = len; 2339 n->m_next = NULL; 2340 off = 0; 2341 2342 m_copydata(m, 0, sizeof(struct sadb_msg), mtod(n, caddr_t) + off); 2343 off += PFKEY_ALIGN8(sizeof(struct sadb_msg)); 2344 2345 IPSEC_ASSERT(off == len, ("length inconsistency (off %u len %u)", 2346 off, len)); 2347 2348 n->m_next = m_copym(m, mhp->extoff[SADB_X_EXT_POLICY], 2349 mhp->extlen[SADB_X_EXT_POLICY], M_NOWAIT); 2350 if (!n->m_next) { 2351 m_freem(n); 2352 return key_senderror(so, m, ENOBUFS); 2353 } 2354 2355 n->m_pkthdr.len = 0; 2356 for (nn = n; nn; nn = nn->m_next) 2357 n->m_pkthdr.len += nn->m_len; 2358 2359 newmsg = mtod(n, struct sadb_msg *); 2360 newmsg->sadb_msg_errno = 0; 2361 newmsg->sadb_msg_len = PFKEY_UNIT64(n->m_pkthdr.len); 2362 2363 m_freem(m); 2364 return key_sendup_mbuf(so, n, KEY_SENDUP_ALL); 2365 } 2366 } 2367 2368 /* 2369 * SADB_X_SPDGET processing 2370 * receive 2371 * <base, policy(*)> 2372 * from the user(?), 2373 * and send, 2374 * <base, address(SD), policy> 2375 * to the ikmpd. 2376 * policy(*) including direction of policy. 2377 * 2378 * m will always be freed. 2379 */ 2380 static int 2381 key_spdget(struct socket *so, struct mbuf *m, const struct sadb_msghdr *mhp) 2382 { 2383 struct secpolicy *sp; 2384 struct mbuf *n; 2385 uint32_t id; 2386 2387 IPSEC_ASSERT(so != NULL, ("null socket")); 2388 IPSEC_ASSERT(m != NULL, ("null mbuf")); 2389 IPSEC_ASSERT(mhp != NULL, ("null msghdr")); 2390 IPSEC_ASSERT(mhp->msg != NULL, ("null msg")); 2391 2392 if (SADB_CHECKHDR(mhp, SADB_X_EXT_POLICY) || 2393 SADB_CHECKLEN(mhp, SADB_X_EXT_POLICY)) { 2394 ipseclog((LOG_DEBUG, "%s: invalid message is passed.\n", 2395 __func__)); 2396 return key_senderror(so, m, EINVAL); 2397 } 2398 2399 id = ((struct sadb_x_policy *) 2400 mhp->ext[SADB_X_EXT_POLICY])->sadb_x_policy_id; 2401 2402 /* Is there SP in SPD ? */ 2403 if ((sp = key_getspbyid(id)) == NULL) { 2404 ipseclog((LOG_DEBUG, "%s: no SP found for id %u.\n", 2405 __func__, id)); 2406 return key_senderror(so, m, ENOENT); 2407 } 2408 2409 n = key_setdumpsp(sp, SADB_X_SPDGET, mhp->msg->sadb_msg_seq, 2410 mhp->msg->sadb_msg_pid); 2411 key_freesp(&sp); 2412 if (n != NULL) { 2413 m_freem(m); 2414 return key_sendup_mbuf(so, n, KEY_SENDUP_ONE); 2415 } else 2416 return key_senderror(so, m, ENOBUFS); 2417 } 2418 2419 /* 2420 * SADB_X_SPDACQUIRE processing. 2421 * Acquire policy and SA(s) for a *OUTBOUND* packet. 2422 * send 2423 * <base, policy(*)> 2424 * to KMD, and expect to receive 2425 * <base> with SADB_X_SPDACQUIRE if error occurred, 2426 * or 2427 * <base, policy> 2428 * with SADB_X_SPDUPDATE from KMD by PF_KEY. 2429 * policy(*) is without policy requests. 2430 * 2431 * 0 : succeed 2432 * others: error number 2433 */ 2434 int 2435 key_spdacquire(struct secpolicy *sp) 2436 { 2437 struct mbuf *result = NULL, *m; 2438 struct secspacq *newspacq; 2439 2440 IPSEC_ASSERT(sp != NULL, ("null secpolicy")); 2441 IPSEC_ASSERT(sp->req == NULL, ("policy exists")); 2442 IPSEC_ASSERT(sp->policy == IPSEC_POLICY_IPSEC, 2443 ("policy not IPSEC %u", sp->policy)); 2444 2445 /* Get an entry to check whether sent message or not. */ 2446 newspacq = key_getspacq(&sp->spidx); 2447 if (newspacq != NULL) { 2448 if (V_key_blockacq_count < newspacq->count) { 2449 /* reset counter and do send message. */ 2450 newspacq->count = 0; 2451 } else { 2452 /* increment counter and do nothing. */ 2453 newspacq->count++; 2454 SPACQ_UNLOCK(); 2455 return (0); 2456 } 2457 SPACQ_UNLOCK(); 2458 } else { 2459 /* make new entry for blocking to send SADB_ACQUIRE. */ 2460 newspacq = key_newspacq(&sp->spidx); 2461 if (newspacq == NULL) 2462 return ENOBUFS; 2463 } 2464 2465 /* create new sadb_msg to reply. */ 2466 m = key_setsadbmsg(SADB_X_SPDACQUIRE, 0, 0, 0, 0, 0); 2467 if (!m) 2468 return ENOBUFS; 2469 2470 result = m; 2471 2472 result->m_pkthdr.len = 0; 2473 for (m = result; m; m = m->m_next) 2474 result->m_pkthdr.len += m->m_len; 2475 2476 mtod(result, struct sadb_msg *)->sadb_msg_len = 2477 PFKEY_UNIT64(result->m_pkthdr.len); 2478 2479 return key_sendup_mbuf(NULL, m, KEY_SENDUP_REGISTERED); 2480 } 2481 2482 /* 2483 * SADB_SPDFLUSH processing 2484 * receive 2485 * <base> 2486 * from the user, and free all entries in secpctree. 2487 * and send, 2488 * <base> 2489 * to the user. 2490 * NOTE: what to do is only marking SADB_SASTATE_DEAD. 2491 * 2492 * m will always be freed. 2493 */ 2494 static int 2495 key_spdflush(struct socket *so, struct mbuf *m, const struct sadb_msghdr *mhp) 2496 { 2497 struct secpolicy_queue drainq; 2498 struct sadb_msg *newmsg; 2499 struct secpolicy *sp, *nextsp; 2500 u_int dir; 2501 2502 IPSEC_ASSERT(so != NULL, ("null socket")); 2503 IPSEC_ASSERT(m != NULL, ("null mbuf")); 2504 IPSEC_ASSERT(mhp != NULL, ("null msghdr")); 2505 IPSEC_ASSERT(mhp->msg != NULL, ("null msg")); 2506 2507 if (m->m_len != PFKEY_ALIGN8(sizeof(struct sadb_msg))) 2508 return key_senderror(so, m, EINVAL); 2509 2510 TAILQ_INIT(&drainq); 2511 SPTREE_WLOCK(); 2512 for (dir = 0; dir < IPSEC_DIR_MAX; dir++) { 2513 TAILQ_CONCAT(&drainq, &V_sptree[dir], chain); 2514 } 2515 /* 2516 * We need to set state to DEAD for each policy to be sure, 2517 * that another thread won't try to unlink it. 2518 * Also remove SP from sphash. 2519 */ 2520 TAILQ_FOREACH(sp, &drainq, chain) { 2521 sp->state = IPSEC_SPSTATE_DEAD; 2522 LIST_REMOVE(sp, idhash); 2523 } 2524 V_sp_genid++; 2525 V_spd_size = 0; 2526 SPTREE_WUNLOCK(); 2527 if (SPDCACHE_ENABLED()) 2528 spdcache_clear(); 2529 sp = TAILQ_FIRST(&drainq); 2530 while (sp != NULL) { 2531 nextsp = TAILQ_NEXT(sp, chain); 2532 key_freesp(&sp); 2533 sp = nextsp; 2534 } 2535 2536 if (sizeof(struct sadb_msg) > m->m_len + M_TRAILINGSPACE(m)) { 2537 ipseclog((LOG_DEBUG, "%s: No more memory.\n", __func__)); 2538 return key_senderror(so, m, ENOBUFS); 2539 } 2540 2541 if (m->m_next) 2542 m_freem(m->m_next); 2543 m->m_next = NULL; 2544 m->m_pkthdr.len = m->m_len = PFKEY_ALIGN8(sizeof(struct sadb_msg)); 2545 newmsg = mtod(m, struct sadb_msg *); 2546 newmsg->sadb_msg_errno = 0; 2547 newmsg->sadb_msg_len = PFKEY_UNIT64(m->m_pkthdr.len); 2548 2549 return key_sendup_mbuf(so, m, KEY_SENDUP_ALL); 2550 } 2551 2552 static uint8_t 2553 key_satype2scopemask(uint8_t satype) 2554 { 2555 2556 if (satype == IPSEC_POLICYSCOPE_ANY) 2557 return (0xff); 2558 return (satype); 2559 } 2560 /* 2561 * SADB_SPDDUMP processing 2562 * receive 2563 * <base> 2564 * from the user, and dump all SP leaves and send, 2565 * <base> ..... 2566 * to the ikmpd. 2567 * 2568 * NOTE: 2569 * sadb_msg_satype is considered as mask of policy scopes. 2570 * m will always be freed. 2571 */ 2572 static int 2573 key_spddump(struct socket *so, struct mbuf *m, const struct sadb_msghdr *mhp) 2574 { 2575 SPTREE_RLOCK_TRACKER; 2576 struct secpolicy *sp; 2577 struct mbuf *n; 2578 int cnt; 2579 u_int dir, scope; 2580 2581 IPSEC_ASSERT(so != NULL, ("null socket")); 2582 IPSEC_ASSERT(m != NULL, ("null mbuf")); 2583 IPSEC_ASSERT(mhp != NULL, ("null msghdr")); 2584 IPSEC_ASSERT(mhp->msg != NULL, ("null msg")); 2585 2586 /* search SPD entry and get buffer size. */ 2587 cnt = 0; 2588 scope = key_satype2scopemask(mhp->msg->sadb_msg_satype); 2589 SPTREE_RLOCK(); 2590 for (dir = 0; dir < IPSEC_DIR_MAX; dir++) { 2591 if (scope & IPSEC_POLICYSCOPE_GLOBAL) { 2592 TAILQ_FOREACH(sp, &V_sptree[dir], chain) 2593 cnt++; 2594 } 2595 if (scope & IPSEC_POLICYSCOPE_IFNET) { 2596 TAILQ_FOREACH(sp, &V_sptree_ifnet[dir], chain) 2597 cnt++; 2598 } 2599 } 2600 2601 if (cnt == 0) { 2602 SPTREE_RUNLOCK(); 2603 return key_senderror(so, m, ENOENT); 2604 } 2605 2606 for (dir = 0; dir < IPSEC_DIR_MAX; dir++) { 2607 if (scope & IPSEC_POLICYSCOPE_GLOBAL) { 2608 TAILQ_FOREACH(sp, &V_sptree[dir], chain) { 2609 --cnt; 2610 n = key_setdumpsp(sp, SADB_X_SPDDUMP, cnt, 2611 mhp->msg->sadb_msg_pid); 2612 2613 if (n != NULL) 2614 key_sendup_mbuf(so, n, KEY_SENDUP_ONE); 2615 } 2616 } 2617 if (scope & IPSEC_POLICYSCOPE_IFNET) { 2618 TAILQ_FOREACH(sp, &V_sptree_ifnet[dir], chain) { 2619 --cnt; 2620 n = key_setdumpsp(sp, SADB_X_SPDDUMP, cnt, 2621 mhp->msg->sadb_msg_pid); 2622 2623 if (n != NULL) 2624 key_sendup_mbuf(so, n, KEY_SENDUP_ONE); 2625 } 2626 } 2627 } 2628 2629 SPTREE_RUNLOCK(); 2630 m_freem(m); 2631 return (0); 2632 } 2633 2634 static struct mbuf * 2635 key_setdumpsp(struct secpolicy *sp, u_int8_t type, u_int32_t seq, 2636 u_int32_t pid) 2637 { 2638 struct mbuf *result = NULL, *m; 2639 struct seclifetime lt; 2640 2641 m = key_setsadbmsg(type, 0, SADB_SATYPE_UNSPEC, seq, pid, sp->refcnt); 2642 if (!m) 2643 goto fail; 2644 result = m; 2645 2646 m = key_setsadbaddr(SADB_EXT_ADDRESS_SRC, 2647 &sp->spidx.src.sa, sp->spidx.prefs, 2648 sp->spidx.ul_proto); 2649 if (!m) 2650 goto fail; 2651 m_cat(result, m); 2652 2653 m = key_setsadbaddr(SADB_EXT_ADDRESS_DST, 2654 &sp->spidx.dst.sa, sp->spidx.prefd, 2655 sp->spidx.ul_proto); 2656 if (!m) 2657 goto fail; 2658 m_cat(result, m); 2659 2660 m = key_sp2mbuf(sp); 2661 if (!m) 2662 goto fail; 2663 m_cat(result, m); 2664 2665 if(sp->lifetime){ 2666 lt.addtime=sp->created; 2667 lt.usetime= sp->lastused; 2668 m = key_setlifetime(<, SADB_EXT_LIFETIME_CURRENT); 2669 if (!m) 2670 goto fail; 2671 m_cat(result, m); 2672 2673 lt.addtime=sp->lifetime; 2674 lt.usetime= sp->validtime; 2675 m = key_setlifetime(<, SADB_EXT_LIFETIME_HARD); 2676 if (!m) 2677 goto fail; 2678 m_cat(result, m); 2679 } 2680 2681 if ((result->m_flags & M_PKTHDR) == 0) 2682 goto fail; 2683 2684 if (result->m_len < sizeof(struct sadb_msg)) { 2685 result = m_pullup(result, sizeof(struct sadb_msg)); 2686 if (result == NULL) 2687 goto fail; 2688 } 2689 2690 result->m_pkthdr.len = 0; 2691 for (m = result; m; m = m->m_next) 2692 result->m_pkthdr.len += m->m_len; 2693 2694 mtod(result, struct sadb_msg *)->sadb_msg_len = 2695 PFKEY_UNIT64(result->m_pkthdr.len); 2696 2697 return result; 2698 2699 fail: 2700 m_freem(result); 2701 return NULL; 2702 } 2703 /* 2704 * get PFKEY message length for security policy and request. 2705 */ 2706 static size_t 2707 key_getspreqmsglen(struct secpolicy *sp) 2708 { 2709 size_t tlen, len; 2710 int i; 2711 2712 tlen = sizeof(struct sadb_x_policy); 2713 /* if is the policy for ipsec ? */ 2714 if (sp->policy != IPSEC_POLICY_IPSEC) 2715 return (tlen); 2716 2717 /* get length of ipsec requests */ 2718 for (i = 0; i < sp->tcount; i++) { 2719 len = sizeof(struct sadb_x_ipsecrequest) 2720 + sp->req[i]->saidx.src.sa.sa_len 2721 + sp->req[i]->saidx.dst.sa.sa_len; 2722 2723 tlen += PFKEY_ALIGN8(len); 2724 } 2725 return (tlen); 2726 } 2727 2728 /* 2729 * SADB_SPDEXPIRE processing 2730 * send 2731 * <base, address(SD), lifetime(CH), policy> 2732 * to KMD by PF_KEY. 2733 * 2734 * OUT: 0 : succeed 2735 * others : error number 2736 */ 2737 static int 2738 key_spdexpire(struct secpolicy *sp) 2739 { 2740 struct sadb_lifetime *lt; 2741 struct mbuf *result = NULL, *m; 2742 int len, error = -1; 2743 2744 IPSEC_ASSERT(sp != NULL, ("null secpolicy")); 2745 2746 KEYDBG(KEY_STAMP, 2747 printf("%s: SP(%p)\n", __func__, sp)); 2748 KEYDBG(KEY_DATA, kdebug_secpolicy(sp)); 2749 2750 /* set msg header */ 2751 m = key_setsadbmsg(SADB_X_SPDEXPIRE, 0, 0, 0, 0, 0); 2752 if (!m) { 2753 error = ENOBUFS; 2754 goto fail; 2755 } 2756 result = m; 2757 2758 /* create lifetime extension (current and hard) */ 2759 len = PFKEY_ALIGN8(sizeof(*lt)) * 2; 2760 m = m_get2(len, M_NOWAIT, MT_DATA, 0); 2761 if (m == NULL) { 2762 error = ENOBUFS; 2763 goto fail; 2764 } 2765 m_align(m, len); 2766 m->m_len = len; 2767 bzero(mtod(m, caddr_t), len); 2768 lt = mtod(m, struct sadb_lifetime *); 2769 lt->sadb_lifetime_len = PFKEY_UNIT64(sizeof(struct sadb_lifetime)); 2770 lt->sadb_lifetime_exttype = SADB_EXT_LIFETIME_CURRENT; 2771 lt->sadb_lifetime_allocations = 0; 2772 lt->sadb_lifetime_bytes = 0; 2773 lt->sadb_lifetime_addtime = sp->created; 2774 lt->sadb_lifetime_usetime = sp->lastused; 2775 lt = (struct sadb_lifetime *)(mtod(m, caddr_t) + len / 2); 2776 lt->sadb_lifetime_len = PFKEY_UNIT64(sizeof(struct sadb_lifetime)); 2777 lt->sadb_lifetime_exttype = SADB_EXT_LIFETIME_HARD; 2778 lt->sadb_lifetime_allocations = 0; 2779 lt->sadb_lifetime_bytes = 0; 2780 lt->sadb_lifetime_addtime = sp->lifetime; 2781 lt->sadb_lifetime_usetime = sp->validtime; 2782 m_cat(result, m); 2783 2784 /* set sadb_address for source */ 2785 m = key_setsadbaddr(SADB_EXT_ADDRESS_SRC, 2786 &sp->spidx.src.sa, 2787 sp->spidx.prefs, sp->spidx.ul_proto); 2788 if (!m) { 2789 error = ENOBUFS; 2790 goto fail; 2791 } 2792 m_cat(result, m); 2793 2794 /* set sadb_address for destination */ 2795 m = key_setsadbaddr(SADB_EXT_ADDRESS_DST, 2796 &sp->spidx.dst.sa, 2797 sp->spidx.prefd, sp->spidx.ul_proto); 2798 if (!m) { 2799 error = ENOBUFS; 2800 goto fail; 2801 } 2802 m_cat(result, m); 2803 2804 /* set secpolicy */ 2805 m = key_sp2mbuf(sp); 2806 if (!m) { 2807 error = ENOBUFS; 2808 goto fail; 2809 } 2810 m_cat(result, m); 2811 2812 if ((result->m_flags & M_PKTHDR) == 0) { 2813 error = EINVAL; 2814 goto fail; 2815 } 2816 2817 if (result->m_len < sizeof(struct sadb_msg)) { 2818 result = m_pullup(result, sizeof(struct sadb_msg)); 2819 if (result == NULL) { 2820 error = ENOBUFS; 2821 goto fail; 2822 } 2823 } 2824 2825 result->m_pkthdr.len = 0; 2826 for (m = result; m; m = m->m_next) 2827 result->m_pkthdr.len += m->m_len; 2828 2829 mtod(result, struct sadb_msg *)->sadb_msg_len = 2830 PFKEY_UNIT64(result->m_pkthdr.len); 2831 2832 return key_sendup_mbuf(NULL, result, KEY_SENDUP_REGISTERED); 2833 2834 fail: 2835 if (result) 2836 m_freem(result); 2837 return error; 2838 } 2839 2840 /* %%% SAD management */ 2841 /* 2842 * allocating and initialize new SA head. 2843 * OUT: NULL : failure due to the lack of memory. 2844 * others : pointer to new SA head. 2845 */ 2846 static struct secashead * 2847 key_newsah(struct secasindex *saidx) 2848 { 2849 struct secashead *sah; 2850 2851 sah = malloc(sizeof(struct secashead), M_IPSEC_SAH, 2852 M_NOWAIT | M_ZERO); 2853 if (sah == NULL) { 2854 PFKEYSTAT_INC(in_nomem); 2855 return (NULL); 2856 } 2857 TAILQ_INIT(&sah->savtree_larval); 2858 TAILQ_INIT(&sah->savtree_alive); 2859 sah->saidx = *saidx; 2860 sah->state = SADB_SASTATE_DEAD; 2861 SAH_INITREF(sah); 2862 2863 KEYDBG(KEY_STAMP, 2864 printf("%s: SAH(%p)\n", __func__, sah)); 2865 KEYDBG(KEY_DATA, kdebug_secash(sah, NULL)); 2866 return (sah); 2867 } 2868 2869 static void 2870 key_freesah(struct secashead **psah) 2871 { 2872 struct secashead *sah = *psah; 2873 2874 if (SAH_DELREF(sah) == 0) 2875 return; 2876 2877 KEYDBG(KEY_STAMP, 2878 printf("%s: last reference to SAH(%p)\n", __func__, sah)); 2879 KEYDBG(KEY_DATA, kdebug_secash(sah, NULL)); 2880 2881 *psah = NULL; 2882 key_delsah(sah); 2883 } 2884 2885 static void 2886 key_delsah(struct secashead *sah) 2887 { 2888 IPSEC_ASSERT(sah != NULL, ("NULL sah")); 2889 IPSEC_ASSERT(sah->state == SADB_SASTATE_DEAD, 2890 ("Attempt to free non DEAD SAH %p", sah)); 2891 IPSEC_ASSERT(TAILQ_EMPTY(&sah->savtree_larval), 2892 ("Attempt to free SAH %p with LARVAL SA", sah)); 2893 IPSEC_ASSERT(TAILQ_EMPTY(&sah->savtree_alive), 2894 ("Attempt to free SAH %p with ALIVE SA", sah)); 2895 2896 free(sah, M_IPSEC_SAH); 2897 } 2898 2899 /* 2900 * allocating a new SA for key_add() and key_getspi() call, 2901 * and copy the values of mhp into new buffer. 2902 * When SAD message type is SADB_GETSPI set SA state to LARVAL. 2903 * For SADB_ADD create and initialize SA with MATURE state. 2904 * OUT: NULL : fail 2905 * others : pointer to new secasvar. 2906 */ 2907 static struct secasvar * 2908 key_newsav(const struct sadb_msghdr *mhp, struct secasindex *saidx, 2909 uint32_t spi, int *errp) 2910 { 2911 struct secashead *sah; 2912 struct secasvar *sav; 2913 int isnew; 2914 2915 IPSEC_ASSERT(mhp != NULL, ("null msghdr")); 2916 IPSEC_ASSERT(mhp->msg != NULL, ("null msg")); 2917 IPSEC_ASSERT(mhp->msg->sadb_msg_type == SADB_GETSPI || 2918 mhp->msg->sadb_msg_type == SADB_ADD, ("wrong message type")); 2919 2920 sav = NULL; 2921 sah = NULL; 2922 /* check SPI value */ 2923 switch (saidx->proto) { 2924 case IPPROTO_ESP: 2925 case IPPROTO_AH: 2926 /* 2927 * RFC 4302, 2.4. Security Parameters Index (SPI), SPI values 2928 * 1-255 reserved by IANA for future use, 2929 * 0 for implementation specific, local use. 2930 */ 2931 if (ntohl(spi) <= 255) { 2932 ipseclog((LOG_DEBUG, "%s: illegal range of SPI %u.\n", 2933 __func__, ntohl(spi))); 2934 *errp = EINVAL; 2935 goto done; 2936 } 2937 break; 2938 } 2939 2940 sav = malloc(sizeof(struct secasvar), M_IPSEC_SA, M_NOWAIT | M_ZERO); 2941 if (sav == NULL) { 2942 *errp = ENOBUFS; 2943 goto done; 2944 } 2945 sav->lock = malloc(sizeof(struct mtx), M_IPSEC_MISC, 2946 M_NOWAIT | M_ZERO); 2947 if (sav->lock == NULL) { 2948 *errp = ENOBUFS; 2949 goto done; 2950 } 2951 mtx_init(sav->lock, "ipsec association", NULL, MTX_DEF); 2952 sav->lft_c = uma_zalloc_pcpu(V_key_lft_zone, M_NOWAIT); 2953 if (sav->lft_c == NULL) { 2954 *errp = ENOBUFS; 2955 goto done; 2956 } 2957 counter_u64_zero(sav->lft_c_allocations); 2958 counter_u64_zero(sav->lft_c_bytes); 2959 2960 sav->spi = spi; 2961 sav->seq = mhp->msg->sadb_msg_seq; 2962 sav->state = SADB_SASTATE_LARVAL; 2963 sav->pid = (pid_t)mhp->msg->sadb_msg_pid; 2964 SAV_INITREF(sav); 2965 again: 2966 sah = key_getsah(saidx); 2967 if (sah == NULL) { 2968 /* create a new SA index */ 2969 sah = key_newsah(saidx); 2970 if (sah == NULL) { 2971 ipseclog((LOG_DEBUG, 2972 "%s: No more memory.\n", __func__)); 2973 *errp = ENOBUFS; 2974 goto done; 2975 } 2976 isnew = 1; 2977 } else 2978 isnew = 0; 2979 2980 sav->sah = sah; 2981 if (mhp->msg->sadb_msg_type == SADB_GETSPI) { 2982 sav->created = time_second; 2983 } else if (sav->state == SADB_SASTATE_LARVAL) { 2984 /* 2985 * Do not call key_setsaval() second time in case 2986 * of `goto again`. We will have MATURE state. 2987 */ 2988 *errp = key_setsaval(sav, mhp); 2989 if (*errp != 0) 2990 goto done; 2991 sav->state = SADB_SASTATE_MATURE; 2992 } 2993 2994 SAHTREE_WLOCK(); 2995 /* 2996 * Check that existing SAH wasn't unlinked. 2997 * Since we didn't hold the SAHTREE lock, it is possible, 2998 * that callout handler or key_flush() or key_delete() could 2999 * unlink this SAH. 3000 */ 3001 if (isnew == 0 && sah->state == SADB_SASTATE_DEAD) { 3002 SAHTREE_WUNLOCK(); 3003 key_freesah(&sah); /* reference from key_getsah() */ 3004 goto again; 3005 } 3006 if (isnew != 0) { 3007 /* 3008 * Add new SAH into SADB. 3009 * 3010 * XXXAE: we can serialize key_add and key_getspi calls, so 3011 * several threads will not fight in the race. 3012 * Otherwise we should check under SAHTREE lock, that this 3013 * SAH would not added twice. 3014 */ 3015 TAILQ_INSERT_HEAD(&V_sahtree, sah, chain); 3016 /* Add new SAH into hash by addresses */ 3017 LIST_INSERT_HEAD(SAHADDRHASH_HASH(saidx), sah, addrhash); 3018 /* Now we are linked in the chain */ 3019 sah->state = SADB_SASTATE_MATURE; 3020 /* 3021 * SAV references this new SAH. 3022 * In case of existing SAH we reuse reference 3023 * from key_getsah(). 3024 */ 3025 SAH_ADDREF(sah); 3026 } 3027 /* Link SAV with SAH */ 3028 if (sav->state == SADB_SASTATE_MATURE) 3029 TAILQ_INSERT_HEAD(&sah->savtree_alive, sav, chain); 3030 else 3031 TAILQ_INSERT_HEAD(&sah->savtree_larval, sav, chain); 3032 /* Add SAV into SPI hash */ 3033 LIST_INSERT_HEAD(SAVHASH_HASH(sav->spi), sav, spihash); 3034 SAHTREE_WUNLOCK(); 3035 *errp = 0; /* success */ 3036 done: 3037 if (*errp != 0) { 3038 if (sav != NULL) { 3039 if (sav->lock != NULL) { 3040 mtx_destroy(sav->lock); 3041 free(sav->lock, M_IPSEC_MISC); 3042 } 3043 if (sav->lft_c != NULL) 3044 uma_zfree_pcpu(V_key_lft_zone, sav->lft_c); 3045 free(sav, M_IPSEC_SA), sav = NULL; 3046 } 3047 if (sah != NULL) 3048 key_freesah(&sah); 3049 if (*errp == ENOBUFS) { 3050 ipseclog((LOG_DEBUG, "%s: No more memory.\n", 3051 __func__)); 3052 PFKEYSTAT_INC(in_nomem); 3053 } 3054 } 3055 return (sav); 3056 } 3057 3058 /* 3059 * free() SA variable entry. 3060 */ 3061 static void 3062 key_cleansav(struct secasvar *sav) 3063 { 3064 3065 if (sav->natt != NULL) { 3066 free(sav->natt, M_IPSEC_MISC); 3067 sav->natt = NULL; 3068 } 3069 if (sav->flags & SADB_X_EXT_F_CLONED) 3070 return; 3071 /* 3072 * Cleanup xform state. Note that zeroize'ing causes the 3073 * keys to be cleared; otherwise we must do it ourself. 3074 */ 3075 if (sav->tdb_xform != NULL) { 3076 sav->tdb_xform->xf_zeroize(sav); 3077 sav->tdb_xform = NULL; 3078 } else { 3079 if (sav->key_auth != NULL) 3080 bzero(sav->key_auth->key_data, _KEYLEN(sav->key_auth)); 3081 if (sav->key_enc != NULL) 3082 bzero(sav->key_enc->key_data, _KEYLEN(sav->key_enc)); 3083 } 3084 if (sav->key_auth != NULL) { 3085 if (sav->key_auth->key_data != NULL) 3086 free(sav->key_auth->key_data, M_IPSEC_MISC); 3087 free(sav->key_auth, M_IPSEC_MISC); 3088 sav->key_auth = NULL; 3089 } 3090 if (sav->key_enc != NULL) { 3091 if (sav->key_enc->key_data != NULL) 3092 free(sav->key_enc->key_data, M_IPSEC_MISC); 3093 free(sav->key_enc, M_IPSEC_MISC); 3094 sav->key_enc = NULL; 3095 } 3096 if (sav->replay != NULL) { 3097 if (sav->replay->bitmap != NULL) 3098 free(sav->replay->bitmap, M_IPSEC_MISC); 3099 free(sav->replay, M_IPSEC_MISC); 3100 sav->replay = NULL; 3101 } 3102 if (sav->lft_h != NULL) { 3103 free(sav->lft_h, M_IPSEC_MISC); 3104 sav->lft_h = NULL; 3105 } 3106 if (sav->lft_s != NULL) { 3107 free(sav->lft_s, M_IPSEC_MISC); 3108 sav->lft_s = NULL; 3109 } 3110 } 3111 3112 /* 3113 * free() SA variable entry. 3114 */ 3115 static void 3116 key_delsav(struct secasvar *sav) 3117 { 3118 IPSEC_ASSERT(sav != NULL, ("null sav")); 3119 IPSEC_ASSERT(sav->state == SADB_SASTATE_DEAD, 3120 ("attempt to free non DEAD SA %p", sav)); 3121 IPSEC_ASSERT(sav->refcnt == 0, ("reference count %u > 0", 3122 sav->refcnt)); 3123 3124 /* 3125 * SA must be unlinked from the chain and hashtbl. 3126 * If SA was cloned, we leave all fields untouched, 3127 * except NAT-T config. 3128 */ 3129 key_cleansav(sav); 3130 if ((sav->flags & SADB_X_EXT_F_CLONED) == 0) { 3131 mtx_destroy(sav->lock); 3132 free(sav->lock, M_IPSEC_MISC); 3133 uma_zfree_pcpu(V_key_lft_zone, sav->lft_c); 3134 } 3135 free(sav, M_IPSEC_SA); 3136 } 3137 3138 /* 3139 * search SAH. 3140 * OUT: 3141 * NULL : not found 3142 * others : found, referenced pointer to a SAH. 3143 */ 3144 static struct secashead * 3145 key_getsah(struct secasindex *saidx) 3146 { 3147 SAHTREE_RLOCK_TRACKER; 3148 struct secashead *sah; 3149 3150 SAHTREE_RLOCK(); 3151 LIST_FOREACH(sah, SAHADDRHASH_HASH(saidx), addrhash) { 3152 if (key_cmpsaidx(&sah->saidx, saidx, CMP_MODE_REQID) != 0) { 3153 SAH_ADDREF(sah); 3154 break; 3155 } 3156 } 3157 SAHTREE_RUNLOCK(); 3158 return (sah); 3159 } 3160 3161 /* 3162 * Check not to be duplicated SPI. 3163 * OUT: 3164 * 0 : not found 3165 * 1 : found SA with given SPI. 3166 */ 3167 static int 3168 key_checkspidup(uint32_t spi) 3169 { 3170 SAHTREE_RLOCK_TRACKER; 3171 struct secasvar *sav; 3172 3173 /* Assume SPI is in network byte order */ 3174 SAHTREE_RLOCK(); 3175 LIST_FOREACH(sav, SAVHASH_HASH(spi), spihash) { 3176 if (sav->spi == spi) 3177 break; 3178 } 3179 SAHTREE_RUNLOCK(); 3180 return (sav != NULL); 3181 } 3182 3183 /* 3184 * Search SA by SPI. 3185 * OUT: 3186 * NULL : not found 3187 * others : found, referenced pointer to a SA. 3188 */ 3189 static struct secasvar * 3190 key_getsavbyspi(uint32_t spi) 3191 { 3192 SAHTREE_RLOCK_TRACKER; 3193 struct secasvar *sav; 3194 3195 /* Assume SPI is in network byte order */ 3196 SAHTREE_RLOCK(); 3197 LIST_FOREACH(sav, SAVHASH_HASH(spi), spihash) { 3198 if (sav->spi != spi) 3199 continue; 3200 SAV_ADDREF(sav); 3201 break; 3202 } 3203 SAHTREE_RUNLOCK(); 3204 return (sav); 3205 } 3206 3207 static int 3208 key_updatelifetimes(struct secasvar *sav, const struct sadb_msghdr *mhp) 3209 { 3210 struct seclifetime *lft_h, *lft_s, *tmp; 3211 3212 /* Lifetime extension is optional, check that it is present. */ 3213 if (SADB_CHECKHDR(mhp, SADB_EXT_LIFETIME_HARD) && 3214 SADB_CHECKHDR(mhp, SADB_EXT_LIFETIME_SOFT)) { 3215 /* 3216 * In case of SADB_UPDATE we may need to change 3217 * existing lifetimes. 3218 */ 3219 if (sav->state == SADB_SASTATE_MATURE) { 3220 lft_h = lft_s = NULL; 3221 goto reset; 3222 } 3223 return (0); 3224 } 3225 /* Both HARD and SOFT extensions must present */ 3226 if ((SADB_CHECKHDR(mhp, SADB_EXT_LIFETIME_HARD) && 3227 !SADB_CHECKHDR(mhp, SADB_EXT_LIFETIME_SOFT)) || 3228 (SADB_CHECKHDR(mhp, SADB_EXT_LIFETIME_SOFT) && 3229 !SADB_CHECKHDR(mhp, SADB_EXT_LIFETIME_HARD))) { 3230 ipseclog((LOG_DEBUG, 3231 "%s: invalid message: missing required header.\n", 3232 __func__)); 3233 return (EINVAL); 3234 } 3235 if (SADB_CHECKLEN(mhp, SADB_EXT_LIFETIME_HARD) || 3236 SADB_CHECKLEN(mhp, SADB_EXT_LIFETIME_SOFT)) { 3237 ipseclog((LOG_DEBUG, 3238 "%s: invalid message: wrong header size.\n", __func__)); 3239 return (EINVAL); 3240 } 3241 lft_h = key_dup_lifemsg((const struct sadb_lifetime *) 3242 mhp->ext[SADB_EXT_LIFETIME_HARD], M_IPSEC_MISC); 3243 if (lft_h == NULL) { 3244 PFKEYSTAT_INC(in_nomem); 3245 ipseclog((LOG_DEBUG, "%s: No more memory.\n", __func__)); 3246 return (ENOBUFS); 3247 } 3248 lft_s = key_dup_lifemsg((const struct sadb_lifetime *) 3249 mhp->ext[SADB_EXT_LIFETIME_SOFT], M_IPSEC_MISC); 3250 if (lft_s == NULL) { 3251 PFKEYSTAT_INC(in_nomem); 3252 free(lft_h, M_IPSEC_MISC); 3253 ipseclog((LOG_DEBUG, "%s: No more memory.\n", __func__)); 3254 return (ENOBUFS); 3255 } 3256 reset: 3257 if (sav->state != SADB_SASTATE_LARVAL) { 3258 /* 3259 * key_update() holds reference to this SA, 3260 * so it won't be deleted in meanwhile. 3261 */ 3262 SECASVAR_LOCK(sav); 3263 tmp = sav->lft_h; 3264 sav->lft_h = lft_h; 3265 lft_h = tmp; 3266 3267 tmp = sav->lft_s; 3268 sav->lft_s = lft_s; 3269 lft_s = tmp; 3270 SECASVAR_UNLOCK(sav); 3271 if (lft_h != NULL) 3272 free(lft_h, M_IPSEC_MISC); 3273 if (lft_s != NULL) 3274 free(lft_s, M_IPSEC_MISC); 3275 return (0); 3276 } 3277 /* We can update lifetime without holding a lock */ 3278 IPSEC_ASSERT(sav->lft_h == NULL, ("lft_h is already initialized\n")); 3279 IPSEC_ASSERT(sav->lft_s == NULL, ("lft_s is already initialized\n")); 3280 sav->lft_h = lft_h; 3281 sav->lft_s = lft_s; 3282 return (0); 3283 } 3284 3285 /* 3286 * copy SA values from PF_KEY message except *SPI, SEQ, PID and TYPE*. 3287 * You must update these if need. Expects only LARVAL SAs. 3288 * OUT: 0: success. 3289 * !0: failure. 3290 */ 3291 static int 3292 key_setsaval(struct secasvar *sav, const struct sadb_msghdr *mhp) 3293 { 3294 const struct sadb_sa *sa0; 3295 const struct sadb_key *key0; 3296 uint32_t replay; 3297 size_t len; 3298 int error; 3299 3300 IPSEC_ASSERT(mhp != NULL, ("null msghdr")); 3301 IPSEC_ASSERT(mhp->msg != NULL, ("null msg")); 3302 IPSEC_ASSERT(sav->state == SADB_SASTATE_LARVAL, 3303 ("Attempt to update non LARVAL SA")); 3304 3305 /* XXX rewrite */ 3306 error = key_setident(sav->sah, mhp); 3307 if (error != 0) 3308 goto fail; 3309 3310 /* SA */ 3311 if (!SADB_CHECKHDR(mhp, SADB_EXT_SA)) { 3312 if (SADB_CHECKLEN(mhp, SADB_EXT_SA)) { 3313 error = EINVAL; 3314 goto fail; 3315 } 3316 sa0 = (const struct sadb_sa *)mhp->ext[SADB_EXT_SA]; 3317 sav->alg_auth = sa0->sadb_sa_auth; 3318 sav->alg_enc = sa0->sadb_sa_encrypt; 3319 sav->flags = sa0->sadb_sa_flags; 3320 if ((sav->flags & SADB_KEY_FLAGS_MAX) != sav->flags) { 3321 ipseclog((LOG_DEBUG, 3322 "%s: invalid sa_flags 0x%08x.\n", __func__, 3323 sav->flags)); 3324 error = EINVAL; 3325 goto fail; 3326 } 3327 3328 /* Optional replay window */ 3329 replay = 0; 3330 if ((sa0->sadb_sa_flags & SADB_X_EXT_OLD) == 0) 3331 replay = sa0->sadb_sa_replay; 3332 if (!SADB_CHECKHDR(mhp, SADB_X_EXT_SA_REPLAY)) { 3333 if (SADB_CHECKLEN(mhp, SADB_X_EXT_SA_REPLAY)) { 3334 error = EINVAL; 3335 goto fail; 3336 } 3337 replay = ((const struct sadb_x_sa_replay *) 3338 mhp->ext[SADB_X_EXT_SA_REPLAY])->sadb_x_sa_replay_replay; 3339 3340 if (replay > UINT32_MAX - 32) { 3341 ipseclog((LOG_DEBUG, 3342 "%s: replay window too big.\n", __func__)); 3343 error = EINVAL; 3344 goto fail; 3345 } 3346 3347 replay = (replay + 7) >> 3; 3348 } 3349 3350 sav->replay = malloc(sizeof(struct secreplay), M_IPSEC_MISC, 3351 M_NOWAIT | M_ZERO); 3352 if (sav->replay == NULL) { 3353 PFKEYSTAT_INC(in_nomem); 3354 ipseclog((LOG_DEBUG, "%s: No more memory.\n", 3355 __func__)); 3356 error = ENOBUFS; 3357 goto fail; 3358 } 3359 3360 if (replay != 0) { 3361 /* number of 32b blocks to be allocated */ 3362 uint32_t bitmap_size; 3363 3364 /* RFC 6479: 3365 * - the allocated replay window size must be 3366 * a power of two. 3367 * - use an extra 32b block as a redundant window. 3368 */ 3369 bitmap_size = 1; 3370 while (replay + 4 > bitmap_size) 3371 bitmap_size <<= 1; 3372 bitmap_size = bitmap_size / 4; 3373 3374 sav->replay->bitmap = malloc( 3375 bitmap_size * sizeof(uint32_t), M_IPSEC_MISC, 3376 M_NOWAIT | M_ZERO); 3377 if (sav->replay->bitmap == NULL) { 3378 PFKEYSTAT_INC(in_nomem); 3379 ipseclog((LOG_DEBUG, "%s: No more memory.\n", 3380 __func__)); 3381 error = ENOBUFS; 3382 goto fail; 3383 } 3384 sav->replay->bitmap_size = bitmap_size; 3385 sav->replay->wsize = replay; 3386 } 3387 } 3388 3389 /* Authentication keys */ 3390 if (!SADB_CHECKHDR(mhp, SADB_EXT_KEY_AUTH)) { 3391 if (SADB_CHECKLEN(mhp, SADB_EXT_KEY_AUTH)) { 3392 error = EINVAL; 3393 goto fail; 3394 } 3395 error = 0; 3396 key0 = (const struct sadb_key *)mhp->ext[SADB_EXT_KEY_AUTH]; 3397 len = mhp->extlen[SADB_EXT_KEY_AUTH]; 3398 switch (mhp->msg->sadb_msg_satype) { 3399 case SADB_SATYPE_AH: 3400 case SADB_SATYPE_ESP: 3401 case SADB_X_SATYPE_TCPSIGNATURE: 3402 if (len == PFKEY_ALIGN8(sizeof(struct sadb_key)) && 3403 sav->alg_auth != SADB_X_AALG_NULL) 3404 error = EINVAL; 3405 break; 3406 case SADB_X_SATYPE_IPCOMP: 3407 default: 3408 error = EINVAL; 3409 break; 3410 } 3411 if (error) { 3412 ipseclog((LOG_DEBUG, "%s: invalid key_auth values.\n", 3413 __func__)); 3414 goto fail; 3415 } 3416 3417 sav->key_auth = key_dup_keymsg(key0, len, M_IPSEC_MISC); 3418 if (sav->key_auth == NULL ) { 3419 ipseclog((LOG_DEBUG, "%s: No more memory.\n", 3420 __func__)); 3421 PFKEYSTAT_INC(in_nomem); 3422 error = ENOBUFS; 3423 goto fail; 3424 } 3425 } 3426 3427 /* Encryption key */ 3428 if (!SADB_CHECKHDR(mhp, SADB_EXT_KEY_ENCRYPT)) { 3429 if (SADB_CHECKLEN(mhp, SADB_EXT_KEY_ENCRYPT)) { 3430 error = EINVAL; 3431 goto fail; 3432 } 3433 error = 0; 3434 key0 = (const struct sadb_key *)mhp->ext[SADB_EXT_KEY_ENCRYPT]; 3435 len = mhp->extlen[SADB_EXT_KEY_ENCRYPT]; 3436 switch (mhp->msg->sadb_msg_satype) { 3437 case SADB_SATYPE_ESP: 3438 if (len == PFKEY_ALIGN8(sizeof(struct sadb_key)) && 3439 sav->alg_enc != SADB_EALG_NULL) { 3440 error = EINVAL; 3441 break; 3442 } 3443 sav->key_enc = key_dup_keymsg(key0, len, M_IPSEC_MISC); 3444 if (sav->key_enc == NULL) { 3445 ipseclog((LOG_DEBUG, "%s: No more memory.\n", 3446 __func__)); 3447 PFKEYSTAT_INC(in_nomem); 3448 error = ENOBUFS; 3449 goto fail; 3450 } 3451 break; 3452 case SADB_X_SATYPE_IPCOMP: 3453 if (len != PFKEY_ALIGN8(sizeof(struct sadb_key))) 3454 error = EINVAL; 3455 sav->key_enc = NULL; /*just in case*/ 3456 break; 3457 case SADB_SATYPE_AH: 3458 case SADB_X_SATYPE_TCPSIGNATURE: 3459 default: 3460 error = EINVAL; 3461 break; 3462 } 3463 if (error) { 3464 ipseclog((LOG_DEBUG, "%s: invalid key_enc value.\n", 3465 __func__)); 3466 goto fail; 3467 } 3468 } 3469 3470 /* set iv */ 3471 sav->ivlen = 0; 3472 switch (mhp->msg->sadb_msg_satype) { 3473 case SADB_SATYPE_AH: 3474 if (sav->flags & SADB_X_EXT_DERIV) { 3475 ipseclog((LOG_DEBUG, "%s: invalid flag (derived) " 3476 "given to AH SA.\n", __func__)); 3477 error = EINVAL; 3478 goto fail; 3479 } 3480 if (sav->alg_enc != SADB_EALG_NONE) { 3481 ipseclog((LOG_DEBUG, "%s: protocol and algorithm " 3482 "mismated.\n", __func__)); 3483 error = EINVAL; 3484 goto fail; 3485 } 3486 error = xform_init(sav, XF_AH); 3487 break; 3488 case SADB_SATYPE_ESP: 3489 if ((sav->flags & (SADB_X_EXT_OLD | SADB_X_EXT_DERIV)) == 3490 (SADB_X_EXT_OLD | SADB_X_EXT_DERIV)) { 3491 ipseclog((LOG_DEBUG, "%s: invalid flag (derived) " 3492 "given to old-esp.\n", __func__)); 3493 error = EINVAL; 3494 goto fail; 3495 } 3496 error = xform_init(sav, XF_ESP); 3497 break; 3498 case SADB_X_SATYPE_IPCOMP: 3499 if (sav->alg_auth != SADB_AALG_NONE) { 3500 ipseclog((LOG_DEBUG, "%s: protocol and algorithm " 3501 "mismated.\n", __func__)); 3502 error = EINVAL; 3503 goto fail; 3504 } 3505 if ((sav->flags & SADB_X_EXT_RAWCPI) == 0 && 3506 ntohl(sav->spi) >= 0x10000) { 3507 ipseclog((LOG_DEBUG, "%s: invalid cpi for IPComp.\n", 3508 __func__)); 3509 error = EINVAL; 3510 goto fail; 3511 } 3512 error = xform_init(sav, XF_IPCOMP); 3513 break; 3514 case SADB_X_SATYPE_TCPSIGNATURE: 3515 if (sav->alg_enc != SADB_EALG_NONE) { 3516 ipseclog((LOG_DEBUG, "%s: protocol and algorithm " 3517 "mismated.\n", __func__)); 3518 error = EINVAL; 3519 goto fail; 3520 } 3521 error = xform_init(sav, XF_TCPSIGNATURE); 3522 break; 3523 default: 3524 ipseclog((LOG_DEBUG, "%s: Invalid satype.\n", __func__)); 3525 error = EPROTONOSUPPORT; 3526 goto fail; 3527 } 3528 if (error) { 3529 ipseclog((LOG_DEBUG, "%s: unable to initialize SA type %u.\n", 3530 __func__, mhp->msg->sadb_msg_satype)); 3531 goto fail; 3532 } 3533 3534 /* Handle NAT-T headers */ 3535 error = key_setnatt(sav, mhp); 3536 if (error != 0) 3537 goto fail; 3538 3539 /* Initialize lifetime for CURRENT */ 3540 sav->firstused = 0; 3541 sav->created = time_second; 3542 3543 /* lifetimes for HARD and SOFT */ 3544 error = key_updatelifetimes(sav, mhp); 3545 if (error == 0) 3546 return (0); 3547 fail: 3548 key_cleansav(sav); 3549 return (error); 3550 } 3551 3552 /* 3553 * subroutine for SADB_GET and SADB_DUMP. 3554 */ 3555 static struct mbuf * 3556 key_setdumpsa(struct secasvar *sav, uint8_t type, uint8_t satype, 3557 uint32_t seq, uint32_t pid) 3558 { 3559 struct seclifetime lft_c; 3560 struct mbuf *result = NULL, *tres = NULL, *m; 3561 int i, dumporder[] = { 3562 SADB_EXT_SA, SADB_X_EXT_SA2, SADB_X_EXT_SA_REPLAY, 3563 SADB_EXT_LIFETIME_HARD, SADB_EXT_LIFETIME_SOFT, 3564 SADB_EXT_LIFETIME_CURRENT, SADB_EXT_ADDRESS_SRC, 3565 SADB_EXT_ADDRESS_DST, SADB_EXT_ADDRESS_PROXY, 3566 SADB_EXT_KEY_AUTH, SADB_EXT_KEY_ENCRYPT, 3567 SADB_EXT_IDENTITY_SRC, SADB_EXT_IDENTITY_DST, 3568 SADB_EXT_SENSITIVITY, 3569 SADB_X_EXT_NAT_T_TYPE, 3570 SADB_X_EXT_NAT_T_SPORT, SADB_X_EXT_NAT_T_DPORT, 3571 SADB_X_EXT_NAT_T_OAI, SADB_X_EXT_NAT_T_OAR, 3572 SADB_X_EXT_NAT_T_FRAG, 3573 }; 3574 uint32_t replay_count; 3575 3576 m = key_setsadbmsg(type, 0, satype, seq, pid, sav->refcnt); 3577 if (m == NULL) 3578 goto fail; 3579 result = m; 3580 3581 for (i = nitems(dumporder) - 1; i >= 0; i--) { 3582 m = NULL; 3583 switch (dumporder[i]) { 3584 case SADB_EXT_SA: 3585 m = key_setsadbsa(sav); 3586 if (!m) 3587 goto fail; 3588 break; 3589 3590 case SADB_X_EXT_SA2: 3591 SECASVAR_LOCK(sav); 3592 replay_count = sav->replay ? sav->replay->count : 0; 3593 SECASVAR_UNLOCK(sav); 3594 m = key_setsadbxsa2(sav->sah->saidx.mode, replay_count, 3595 sav->sah->saidx.reqid); 3596 if (!m) 3597 goto fail; 3598 break; 3599 3600 case SADB_X_EXT_SA_REPLAY: 3601 if (sav->replay == NULL || 3602 sav->replay->wsize <= UINT8_MAX) 3603 continue; 3604 3605 m = key_setsadbxsareplay(sav->replay->wsize); 3606 if (!m) 3607 goto fail; 3608 break; 3609 3610 case SADB_EXT_ADDRESS_SRC: 3611 m = key_setsadbaddr(SADB_EXT_ADDRESS_SRC, 3612 &sav->sah->saidx.src.sa, 3613 FULLMASK, IPSEC_ULPROTO_ANY); 3614 if (!m) 3615 goto fail; 3616 break; 3617 3618 case SADB_EXT_ADDRESS_DST: 3619 m = key_setsadbaddr(SADB_EXT_ADDRESS_DST, 3620 &sav->sah->saidx.dst.sa, 3621 FULLMASK, IPSEC_ULPROTO_ANY); 3622 if (!m) 3623 goto fail; 3624 break; 3625 3626 case SADB_EXT_KEY_AUTH: 3627 if (!sav->key_auth) 3628 continue; 3629 m = key_setkey(sav->key_auth, SADB_EXT_KEY_AUTH); 3630 if (!m) 3631 goto fail; 3632 break; 3633 3634 case SADB_EXT_KEY_ENCRYPT: 3635 if (!sav->key_enc) 3636 continue; 3637 m = key_setkey(sav->key_enc, SADB_EXT_KEY_ENCRYPT); 3638 if (!m) 3639 goto fail; 3640 break; 3641 3642 case SADB_EXT_LIFETIME_CURRENT: 3643 lft_c.addtime = sav->created; 3644 lft_c.allocations = (uint32_t)counter_u64_fetch( 3645 sav->lft_c_allocations); 3646 lft_c.bytes = counter_u64_fetch(sav->lft_c_bytes); 3647 lft_c.usetime = sav->firstused; 3648 m = key_setlifetime(&lft_c, SADB_EXT_LIFETIME_CURRENT); 3649 if (!m) 3650 goto fail; 3651 break; 3652 3653 case SADB_EXT_LIFETIME_HARD: 3654 if (!sav->lft_h) 3655 continue; 3656 m = key_setlifetime(sav->lft_h, 3657 SADB_EXT_LIFETIME_HARD); 3658 if (!m) 3659 goto fail; 3660 break; 3661 3662 case SADB_EXT_LIFETIME_SOFT: 3663 if (!sav->lft_s) 3664 continue; 3665 m = key_setlifetime(sav->lft_s, 3666 SADB_EXT_LIFETIME_SOFT); 3667 3668 if (!m) 3669 goto fail; 3670 break; 3671 3672 case SADB_X_EXT_NAT_T_TYPE: 3673 if (sav->natt == NULL) 3674 continue; 3675 m = key_setsadbxtype(UDP_ENCAP_ESPINUDP); 3676 if (!m) 3677 goto fail; 3678 break; 3679 3680 case SADB_X_EXT_NAT_T_DPORT: 3681 if (sav->natt == NULL) 3682 continue; 3683 m = key_setsadbxport(sav->natt->dport, 3684 SADB_X_EXT_NAT_T_DPORT); 3685 if (!m) 3686 goto fail; 3687 break; 3688 3689 case SADB_X_EXT_NAT_T_SPORT: 3690 if (sav->natt == NULL) 3691 continue; 3692 m = key_setsadbxport(sav->natt->sport, 3693 SADB_X_EXT_NAT_T_SPORT); 3694 if (!m) 3695 goto fail; 3696 break; 3697 3698 case SADB_X_EXT_NAT_T_OAI: 3699 if (sav->natt == NULL || 3700 (sav->natt->flags & IPSEC_NATT_F_OAI) == 0) 3701 continue; 3702 m = key_setsadbaddr(SADB_X_EXT_NAT_T_OAI, 3703 &sav->natt->oai.sa, FULLMASK, IPSEC_ULPROTO_ANY); 3704 if (!m) 3705 goto fail; 3706 break; 3707 case SADB_X_EXT_NAT_T_OAR: 3708 if (sav->natt == NULL || 3709 (sav->natt->flags & IPSEC_NATT_F_OAR) == 0) 3710 continue; 3711 m = key_setsadbaddr(SADB_X_EXT_NAT_T_OAR, 3712 &sav->natt->oar.sa, FULLMASK, IPSEC_ULPROTO_ANY); 3713 if (!m) 3714 goto fail; 3715 break; 3716 case SADB_X_EXT_NAT_T_FRAG: 3717 /* We do not (yet) support those. */ 3718 continue; 3719 3720 case SADB_EXT_ADDRESS_PROXY: 3721 case SADB_EXT_IDENTITY_SRC: 3722 case SADB_EXT_IDENTITY_DST: 3723 /* XXX: should we brought from SPD ? */ 3724 case SADB_EXT_SENSITIVITY: 3725 default: 3726 continue; 3727 } 3728 3729 if (!m) 3730 goto fail; 3731 if (tres) 3732 m_cat(m, tres); 3733 tres = m; 3734 } 3735 3736 m_cat(result, tres); 3737 tres = NULL; 3738 if (result->m_len < sizeof(struct sadb_msg)) { 3739 result = m_pullup(result, sizeof(struct sadb_msg)); 3740 if (result == NULL) 3741 goto fail; 3742 } 3743 3744 result->m_pkthdr.len = 0; 3745 for (m = result; m; m = m->m_next) 3746 result->m_pkthdr.len += m->m_len; 3747 3748 mtod(result, struct sadb_msg *)->sadb_msg_len = 3749 PFKEY_UNIT64(result->m_pkthdr.len); 3750 3751 return result; 3752 3753 fail: 3754 m_freem(result); 3755 m_freem(tres); 3756 return NULL; 3757 } 3758 3759 /* 3760 * set data into sadb_msg. 3761 */ 3762 static struct mbuf * 3763 key_setsadbmsg(u_int8_t type, u_int16_t tlen, u_int8_t satype, u_int32_t seq, 3764 pid_t pid, u_int16_t reserved) 3765 { 3766 struct mbuf *m; 3767 struct sadb_msg *p; 3768 int len; 3769 3770 len = PFKEY_ALIGN8(sizeof(struct sadb_msg)); 3771 if (len > MCLBYTES) 3772 return NULL; 3773 MGETHDR(m, M_NOWAIT, MT_DATA); 3774 if (m && len > MHLEN) { 3775 if (!(MCLGET(m, M_NOWAIT))) { 3776 m_freem(m); 3777 m = NULL; 3778 } 3779 } 3780 if (!m) 3781 return NULL; 3782 m->m_pkthdr.len = m->m_len = len; 3783 m->m_next = NULL; 3784 3785 p = mtod(m, struct sadb_msg *); 3786 3787 bzero(p, len); 3788 p->sadb_msg_version = PF_KEY_V2; 3789 p->sadb_msg_type = type; 3790 p->sadb_msg_errno = 0; 3791 p->sadb_msg_satype = satype; 3792 p->sadb_msg_len = PFKEY_UNIT64(tlen); 3793 p->sadb_msg_reserved = reserved; 3794 p->sadb_msg_seq = seq; 3795 p->sadb_msg_pid = (u_int32_t)pid; 3796 3797 return m; 3798 } 3799 3800 /* 3801 * copy secasvar data into sadb_address. 3802 */ 3803 static struct mbuf * 3804 key_setsadbsa(struct secasvar *sav) 3805 { 3806 struct mbuf *m; 3807 struct sadb_sa *p; 3808 int len; 3809 3810 len = PFKEY_ALIGN8(sizeof(struct sadb_sa)); 3811 m = m_get2(len, M_NOWAIT, MT_DATA, 0); 3812 if (m == NULL) 3813 return (NULL); 3814 m_align(m, len); 3815 m->m_len = len; 3816 p = mtod(m, struct sadb_sa *); 3817 bzero(p, len); 3818 p->sadb_sa_len = PFKEY_UNIT64(len); 3819 p->sadb_sa_exttype = SADB_EXT_SA; 3820 p->sadb_sa_spi = sav->spi; 3821 p->sadb_sa_replay = sav->replay ? 3822 (sav->replay->wsize > UINT8_MAX ? UINT8_MAX : 3823 sav->replay->wsize): 0; 3824 p->sadb_sa_state = sav->state; 3825 p->sadb_sa_auth = sav->alg_auth; 3826 p->sadb_sa_encrypt = sav->alg_enc; 3827 p->sadb_sa_flags = sav->flags & SADB_KEY_FLAGS_MAX; 3828 return (m); 3829 } 3830 3831 /* 3832 * set data into sadb_address. 3833 */ 3834 static struct mbuf * 3835 key_setsadbaddr(u_int16_t exttype, const struct sockaddr *saddr, 3836 u_int8_t prefixlen, u_int16_t ul_proto) 3837 { 3838 struct mbuf *m; 3839 struct sadb_address *p; 3840 size_t len; 3841 3842 len = PFKEY_ALIGN8(sizeof(struct sadb_address)) + 3843 PFKEY_ALIGN8(saddr->sa_len); 3844 m = m_get2(len, M_NOWAIT, MT_DATA, 0); 3845 if (m == NULL) 3846 return (NULL); 3847 m_align(m, len); 3848 m->m_len = len; 3849 p = mtod(m, struct sadb_address *); 3850 3851 bzero(p, len); 3852 p->sadb_address_len = PFKEY_UNIT64(len); 3853 p->sadb_address_exttype = exttype; 3854 p->sadb_address_proto = ul_proto; 3855 if (prefixlen == FULLMASK) { 3856 switch (saddr->sa_family) { 3857 case AF_INET: 3858 prefixlen = sizeof(struct in_addr) << 3; 3859 break; 3860 case AF_INET6: 3861 prefixlen = sizeof(struct in6_addr) << 3; 3862 break; 3863 default: 3864 ; /*XXX*/ 3865 } 3866 } 3867 p->sadb_address_prefixlen = prefixlen; 3868 p->sadb_address_reserved = 0; 3869 3870 bcopy(saddr, 3871 mtod(m, caddr_t) + PFKEY_ALIGN8(sizeof(struct sadb_address)), 3872 saddr->sa_len); 3873 3874 return m; 3875 } 3876 3877 /* 3878 * set data into sadb_x_sa2. 3879 */ 3880 static struct mbuf * 3881 key_setsadbxsa2(u_int8_t mode, u_int32_t seq, u_int32_t reqid) 3882 { 3883 struct mbuf *m; 3884 struct sadb_x_sa2 *p; 3885 size_t len; 3886 3887 len = PFKEY_ALIGN8(sizeof(struct sadb_x_sa2)); 3888 m = m_get2(len, M_NOWAIT, MT_DATA, 0); 3889 if (m == NULL) 3890 return (NULL); 3891 m_align(m, len); 3892 m->m_len = len; 3893 p = mtod(m, struct sadb_x_sa2 *); 3894 3895 bzero(p, len); 3896 p->sadb_x_sa2_len = PFKEY_UNIT64(len); 3897 p->sadb_x_sa2_exttype = SADB_X_EXT_SA2; 3898 p->sadb_x_sa2_mode = mode; 3899 p->sadb_x_sa2_reserved1 = 0; 3900 p->sadb_x_sa2_reserved2 = 0; 3901 p->sadb_x_sa2_sequence = seq; 3902 p->sadb_x_sa2_reqid = reqid; 3903 3904 return m; 3905 } 3906 3907 /* 3908 * Set data into sadb_x_sa_replay. 3909 */ 3910 static struct mbuf * 3911 key_setsadbxsareplay(u_int32_t replay) 3912 { 3913 struct mbuf *m; 3914 struct sadb_x_sa_replay *p; 3915 size_t len; 3916 3917 len = PFKEY_ALIGN8(sizeof(struct sadb_x_sa_replay)); 3918 m = m_get2(len, M_NOWAIT, MT_DATA, 0); 3919 if (m == NULL) 3920 return (NULL); 3921 m_align(m, len); 3922 m->m_len = len; 3923 p = mtod(m, struct sadb_x_sa_replay *); 3924 3925 bzero(p, len); 3926 p->sadb_x_sa_replay_len = PFKEY_UNIT64(len); 3927 p->sadb_x_sa_replay_exttype = SADB_X_EXT_SA_REPLAY; 3928 p->sadb_x_sa_replay_replay = (replay << 3); 3929 3930 return m; 3931 } 3932 3933 /* 3934 * Set a type in sadb_x_nat_t_type. 3935 */ 3936 static struct mbuf * 3937 key_setsadbxtype(u_int16_t type) 3938 { 3939 struct mbuf *m; 3940 size_t len; 3941 struct sadb_x_nat_t_type *p; 3942 3943 len = PFKEY_ALIGN8(sizeof(struct sadb_x_nat_t_type)); 3944 3945 m = m_get2(len, M_NOWAIT, MT_DATA, 0); 3946 if (m == NULL) 3947 return (NULL); 3948 m_align(m, len); 3949 m->m_len = len; 3950 p = mtod(m, struct sadb_x_nat_t_type *); 3951 3952 bzero(p, len); 3953 p->sadb_x_nat_t_type_len = PFKEY_UNIT64(len); 3954 p->sadb_x_nat_t_type_exttype = SADB_X_EXT_NAT_T_TYPE; 3955 p->sadb_x_nat_t_type_type = type; 3956 3957 return (m); 3958 } 3959 /* 3960 * Set a port in sadb_x_nat_t_port. 3961 * In contrast to default RFC 2367 behaviour, port is in network byte order. 3962 */ 3963 static struct mbuf * 3964 key_setsadbxport(u_int16_t port, u_int16_t type) 3965 { 3966 struct mbuf *m; 3967 size_t len; 3968 struct sadb_x_nat_t_port *p; 3969 3970 len = PFKEY_ALIGN8(sizeof(struct sadb_x_nat_t_port)); 3971 3972 m = m_get2(len, M_NOWAIT, MT_DATA, 0); 3973 if (m == NULL) 3974 return (NULL); 3975 m_align(m, len); 3976 m->m_len = len; 3977 p = mtod(m, struct sadb_x_nat_t_port *); 3978 3979 bzero(p, len); 3980 p->sadb_x_nat_t_port_len = PFKEY_UNIT64(len); 3981 p->sadb_x_nat_t_port_exttype = type; 3982 p->sadb_x_nat_t_port_port = port; 3983 3984 return (m); 3985 } 3986 3987 /* 3988 * Get port from sockaddr. Port is in network byte order. 3989 */ 3990 uint16_t 3991 key_portfromsaddr(struct sockaddr *sa) 3992 { 3993 3994 switch (sa->sa_family) { 3995 #ifdef INET 3996 case AF_INET: 3997 return ((struct sockaddr_in *)sa)->sin_port; 3998 #endif 3999 #ifdef INET6 4000 case AF_INET6: 4001 return ((struct sockaddr_in6 *)sa)->sin6_port; 4002 #endif 4003 } 4004 return (0); 4005 } 4006 4007 /* 4008 * Set port in struct sockaddr. Port is in network byte order. 4009 */ 4010 void 4011 key_porttosaddr(struct sockaddr *sa, uint16_t port) 4012 { 4013 4014 switch (sa->sa_family) { 4015 #ifdef INET 4016 case AF_INET: 4017 ((struct sockaddr_in *)sa)->sin_port = port; 4018 break; 4019 #endif 4020 #ifdef INET6 4021 case AF_INET6: 4022 ((struct sockaddr_in6 *)sa)->sin6_port = port; 4023 break; 4024 #endif 4025 default: 4026 ipseclog((LOG_DEBUG, "%s: unexpected address family %d.\n", 4027 __func__, sa->sa_family)); 4028 break; 4029 } 4030 } 4031 4032 /* 4033 * set data into sadb_x_policy 4034 */ 4035 static struct mbuf * 4036 key_setsadbxpolicy(u_int16_t type, u_int8_t dir, u_int32_t id, u_int32_t priority) 4037 { 4038 struct mbuf *m; 4039 struct sadb_x_policy *p; 4040 size_t len; 4041 4042 len = PFKEY_ALIGN8(sizeof(struct sadb_x_policy)); 4043 m = m_get2(len, M_NOWAIT, MT_DATA, 0); 4044 if (m == NULL) 4045 return (NULL); 4046 m_align(m, len); 4047 m->m_len = len; 4048 p = mtod(m, struct sadb_x_policy *); 4049 4050 bzero(p, len); 4051 p->sadb_x_policy_len = PFKEY_UNIT64(len); 4052 p->sadb_x_policy_exttype = SADB_X_EXT_POLICY; 4053 p->sadb_x_policy_type = type; 4054 p->sadb_x_policy_dir = dir; 4055 p->sadb_x_policy_id = id; 4056 p->sadb_x_policy_priority = priority; 4057 4058 return m; 4059 } 4060 4061 /* %%% utilities */ 4062 /* Take a key message (sadb_key) from the socket and turn it into one 4063 * of the kernel's key structures (seckey). 4064 * 4065 * IN: pointer to the src 4066 * OUT: NULL no more memory 4067 */ 4068 struct seckey * 4069 key_dup_keymsg(const struct sadb_key *src, size_t len, 4070 struct malloc_type *type) 4071 { 4072 struct seckey *dst; 4073 4074 dst = malloc(sizeof(*dst), type, M_NOWAIT); 4075 if (dst != NULL) { 4076 dst->bits = src->sadb_key_bits; 4077 dst->key_data = malloc(len, type, M_NOWAIT); 4078 if (dst->key_data != NULL) { 4079 bcopy((const char *)(src + 1), dst->key_data, len); 4080 } else { 4081 ipseclog((LOG_DEBUG, "%s: No more memory.\n", 4082 __func__)); 4083 free(dst, type); 4084 dst = NULL; 4085 } 4086 } else { 4087 ipseclog((LOG_DEBUG, "%s: No more memory.\n", 4088 __func__)); 4089 4090 } 4091 return (dst); 4092 } 4093 4094 /* Take a lifetime message (sadb_lifetime) passed in on a socket and 4095 * turn it into one of the kernel's lifetime structures (seclifetime). 4096 * 4097 * IN: pointer to the destination, source and malloc type 4098 * OUT: NULL, no more memory 4099 */ 4100 4101 static struct seclifetime * 4102 key_dup_lifemsg(const struct sadb_lifetime *src, struct malloc_type *type) 4103 { 4104 struct seclifetime *dst; 4105 4106 dst = malloc(sizeof(*dst), type, M_NOWAIT); 4107 if (dst == NULL) { 4108 ipseclog((LOG_DEBUG, "%s: No more memory.\n", __func__)); 4109 return (NULL); 4110 } 4111 dst->allocations = src->sadb_lifetime_allocations; 4112 dst->bytes = src->sadb_lifetime_bytes; 4113 dst->addtime = src->sadb_lifetime_addtime; 4114 dst->usetime = src->sadb_lifetime_usetime; 4115 return (dst); 4116 } 4117 4118 /* 4119 * compare two secasindex structure. 4120 * flag can specify to compare 2 saidxes. 4121 * compare two secasindex structure without both mode and reqid. 4122 * don't compare port. 4123 * IN: 4124 * saidx0: source, it can be in SAD. 4125 * saidx1: object. 4126 * OUT: 4127 * 1 : equal 4128 * 0 : not equal 4129 */ 4130 static int 4131 key_cmpsaidx(const struct secasindex *saidx0, const struct secasindex *saidx1, 4132 int flag) 4133 { 4134 4135 /* sanity */ 4136 if (saidx0 == NULL && saidx1 == NULL) 4137 return 1; 4138 4139 if (saidx0 == NULL || saidx1 == NULL) 4140 return 0; 4141 4142 if (saidx0->proto != saidx1->proto) 4143 return 0; 4144 4145 if (flag == CMP_EXACTLY) { 4146 if (saidx0->mode != saidx1->mode) 4147 return 0; 4148 if (saidx0->reqid != saidx1->reqid) 4149 return 0; 4150 if (bcmp(&saidx0->src, &saidx1->src, 4151 saidx0->src.sa.sa_len) != 0 || 4152 bcmp(&saidx0->dst, &saidx1->dst, 4153 saidx0->dst.sa.sa_len) != 0) 4154 return 0; 4155 } else { 4156 4157 /* CMP_MODE_REQID, CMP_REQID, CMP_HEAD */ 4158 if (flag == CMP_MODE_REQID || flag == CMP_REQID) { 4159 /* 4160 * If reqid of SPD is non-zero, unique SA is required. 4161 * The result must be of same reqid in this case. 4162 */ 4163 if (saidx1->reqid != 0 && 4164 saidx0->reqid != saidx1->reqid) 4165 return 0; 4166 } 4167 4168 if (flag == CMP_MODE_REQID) { 4169 if (saidx0->mode != IPSEC_MODE_ANY 4170 && saidx0->mode != saidx1->mode) 4171 return 0; 4172 } 4173 4174 if (key_sockaddrcmp(&saidx0->src.sa, &saidx1->src.sa, 0) != 0) 4175 return 0; 4176 if (key_sockaddrcmp(&saidx0->dst.sa, &saidx1->dst.sa, 0) != 0) 4177 return 0; 4178 } 4179 4180 return 1; 4181 } 4182 4183 /* 4184 * compare two secindex structure exactly. 4185 * IN: 4186 * spidx0: source, it is often in SPD. 4187 * spidx1: object, it is often from PFKEY message. 4188 * OUT: 4189 * 1 : equal 4190 * 0 : not equal 4191 */ 4192 static int 4193 key_cmpspidx_exactly(struct secpolicyindex *spidx0, 4194 struct secpolicyindex *spidx1) 4195 { 4196 /* sanity */ 4197 if (spidx0 == NULL && spidx1 == NULL) 4198 return 1; 4199 4200 if (spidx0 == NULL || spidx1 == NULL) 4201 return 0; 4202 4203 if (spidx0->prefs != spidx1->prefs 4204 || spidx0->prefd != spidx1->prefd 4205 || spidx0->ul_proto != spidx1->ul_proto 4206 || spidx0->dir != spidx1->dir) 4207 return 0; 4208 4209 return key_sockaddrcmp(&spidx0->src.sa, &spidx1->src.sa, 1) == 0 && 4210 key_sockaddrcmp(&spidx0->dst.sa, &spidx1->dst.sa, 1) == 0; 4211 } 4212 4213 /* 4214 * compare two secindex structure with mask. 4215 * IN: 4216 * spidx0: source, it is often in SPD. 4217 * spidx1: object, it is often from IP header. 4218 * OUT: 4219 * 1 : equal 4220 * 0 : not equal 4221 */ 4222 static int 4223 key_cmpspidx_withmask(struct secpolicyindex *spidx0, 4224 struct secpolicyindex *spidx1) 4225 { 4226 /* sanity */ 4227 if (spidx0 == NULL && spidx1 == NULL) 4228 return 1; 4229 4230 if (spidx0 == NULL || spidx1 == NULL) 4231 return 0; 4232 4233 if (spidx0->src.sa.sa_family != spidx1->src.sa.sa_family || 4234 spidx0->dst.sa.sa_family != spidx1->dst.sa.sa_family || 4235 spidx0->src.sa.sa_len != spidx1->src.sa.sa_len || 4236 spidx0->dst.sa.sa_len != spidx1->dst.sa.sa_len) 4237 return 0; 4238 4239 /* if spidx.ul_proto == IPSEC_ULPROTO_ANY, ignore. */ 4240 if (spidx0->ul_proto != (u_int16_t)IPSEC_ULPROTO_ANY 4241 && spidx0->ul_proto != spidx1->ul_proto) 4242 return 0; 4243 4244 switch (spidx0->src.sa.sa_family) { 4245 case AF_INET: 4246 if (spidx0->src.sin.sin_port != IPSEC_PORT_ANY 4247 && spidx0->src.sin.sin_port != spidx1->src.sin.sin_port) 4248 return 0; 4249 if (!key_bbcmp(&spidx0->src.sin.sin_addr, 4250 &spidx1->src.sin.sin_addr, spidx0->prefs)) 4251 return 0; 4252 break; 4253 case AF_INET6: 4254 if (spidx0->src.sin6.sin6_port != IPSEC_PORT_ANY 4255 && spidx0->src.sin6.sin6_port != spidx1->src.sin6.sin6_port) 4256 return 0; 4257 /* 4258 * scope_id check. if sin6_scope_id is 0, we regard it 4259 * as a wildcard scope, which matches any scope zone ID. 4260 */ 4261 if (spidx0->src.sin6.sin6_scope_id && 4262 spidx1->src.sin6.sin6_scope_id && 4263 spidx0->src.sin6.sin6_scope_id != spidx1->src.sin6.sin6_scope_id) 4264 return 0; 4265 if (!key_bbcmp(&spidx0->src.sin6.sin6_addr, 4266 &spidx1->src.sin6.sin6_addr, spidx0->prefs)) 4267 return 0; 4268 break; 4269 default: 4270 /* XXX */ 4271 if (bcmp(&spidx0->src, &spidx1->src, spidx0->src.sa.sa_len) != 0) 4272 return 0; 4273 break; 4274 } 4275 4276 switch (spidx0->dst.sa.sa_family) { 4277 case AF_INET: 4278 if (spidx0->dst.sin.sin_port != IPSEC_PORT_ANY 4279 && spidx0->dst.sin.sin_port != spidx1->dst.sin.sin_port) 4280 return 0; 4281 if (!key_bbcmp(&spidx0->dst.sin.sin_addr, 4282 &spidx1->dst.sin.sin_addr, spidx0->prefd)) 4283 return 0; 4284 break; 4285 case AF_INET6: 4286 if (spidx0->dst.sin6.sin6_port != IPSEC_PORT_ANY 4287 && spidx0->dst.sin6.sin6_port != spidx1->dst.sin6.sin6_port) 4288 return 0; 4289 /* 4290 * scope_id check. if sin6_scope_id is 0, we regard it 4291 * as a wildcard scope, which matches any scope zone ID. 4292 */ 4293 if (spidx0->dst.sin6.sin6_scope_id && 4294 spidx1->dst.sin6.sin6_scope_id && 4295 spidx0->dst.sin6.sin6_scope_id != spidx1->dst.sin6.sin6_scope_id) 4296 return 0; 4297 if (!key_bbcmp(&spidx0->dst.sin6.sin6_addr, 4298 &spidx1->dst.sin6.sin6_addr, spidx0->prefd)) 4299 return 0; 4300 break; 4301 default: 4302 /* XXX */ 4303 if (bcmp(&spidx0->dst, &spidx1->dst, spidx0->dst.sa.sa_len) != 0) 4304 return 0; 4305 break; 4306 } 4307 4308 /* XXX Do we check other field ? e.g. flowinfo */ 4309 4310 return 1; 4311 } 4312 4313 #ifdef satosin 4314 #undef satosin 4315 #endif 4316 #define satosin(s) ((const struct sockaddr_in *)s) 4317 #ifdef satosin6 4318 #undef satosin6 4319 #endif 4320 #define satosin6(s) ((const struct sockaddr_in6 *)s) 4321 /* returns 0 on match */ 4322 int 4323 key_sockaddrcmp(const struct sockaddr *sa1, const struct sockaddr *sa2, 4324 int port) 4325 { 4326 if (sa1->sa_family != sa2->sa_family || sa1->sa_len != sa2->sa_len) 4327 return 1; 4328 4329 switch (sa1->sa_family) { 4330 #ifdef INET 4331 case AF_INET: 4332 if (sa1->sa_len != sizeof(struct sockaddr_in)) 4333 return 1; 4334 if (satosin(sa1)->sin_addr.s_addr != 4335 satosin(sa2)->sin_addr.s_addr) { 4336 return 1; 4337 } 4338 if (port && satosin(sa1)->sin_port != satosin(sa2)->sin_port) 4339 return 1; 4340 break; 4341 #endif 4342 #ifdef INET6 4343 case AF_INET6: 4344 if (sa1->sa_len != sizeof(struct sockaddr_in6)) 4345 return 1; /*EINVAL*/ 4346 if (satosin6(sa1)->sin6_scope_id != 4347 satosin6(sa2)->sin6_scope_id) { 4348 return 1; 4349 } 4350 if (!IN6_ARE_ADDR_EQUAL(&satosin6(sa1)->sin6_addr, 4351 &satosin6(sa2)->sin6_addr)) { 4352 return 1; 4353 } 4354 if (port && 4355 satosin6(sa1)->sin6_port != satosin6(sa2)->sin6_port) { 4356 return 1; 4357 } 4358 break; 4359 #endif 4360 default: 4361 if (bcmp(sa1, sa2, sa1->sa_len) != 0) 4362 return 1; 4363 break; 4364 } 4365 4366 return 0; 4367 } 4368 4369 /* returns 0 on match */ 4370 int 4371 key_sockaddrcmp_withmask(const struct sockaddr *sa1, 4372 const struct sockaddr *sa2, size_t mask) 4373 { 4374 if (sa1->sa_family != sa2->sa_family || sa1->sa_len != sa2->sa_len) 4375 return (1); 4376 4377 switch (sa1->sa_family) { 4378 #ifdef INET 4379 case AF_INET: 4380 return (!key_bbcmp(&satosin(sa1)->sin_addr, 4381 &satosin(sa2)->sin_addr, mask)); 4382 #endif 4383 #ifdef INET6 4384 case AF_INET6: 4385 if (satosin6(sa1)->sin6_scope_id != 4386 satosin6(sa2)->sin6_scope_id) 4387 return (1); 4388 return (!key_bbcmp(&satosin6(sa1)->sin6_addr, 4389 &satosin6(sa2)->sin6_addr, mask)); 4390 #endif 4391 } 4392 return (1); 4393 } 4394 #undef satosin 4395 #undef satosin6 4396 4397 /* 4398 * compare two buffers with mask. 4399 * IN: 4400 * addr1: source 4401 * addr2: object 4402 * bits: Number of bits to compare 4403 * OUT: 4404 * 1 : equal 4405 * 0 : not equal 4406 */ 4407 static int 4408 key_bbcmp(const void *a1, const void *a2, u_int bits) 4409 { 4410 const unsigned char *p1 = a1; 4411 const unsigned char *p2 = a2; 4412 4413 /* XXX: This could be considerably faster if we compare a word 4414 * at a time, but it is complicated on LSB Endian machines */ 4415 4416 /* Handle null pointers */ 4417 if (p1 == NULL || p2 == NULL) 4418 return (p1 == p2); 4419 4420 while (bits >= 8) { 4421 if (*p1++ != *p2++) 4422 return 0; 4423 bits -= 8; 4424 } 4425 4426 if (bits > 0) { 4427 u_int8_t mask = ~((1<<(8-bits))-1); 4428 if ((*p1 & mask) != (*p2 & mask)) 4429 return 0; 4430 } 4431 return 1; /* Match! */ 4432 } 4433 4434 static void 4435 key_flush_spd(time_t now) 4436 { 4437 SPTREE_RLOCK_TRACKER; 4438 struct secpolicy_list drainq; 4439 struct secpolicy *sp, *nextsp; 4440 u_int dir; 4441 4442 LIST_INIT(&drainq); 4443 SPTREE_RLOCK(); 4444 for (dir = 0; dir < IPSEC_DIR_MAX; dir++) { 4445 TAILQ_FOREACH(sp, &V_sptree[dir], chain) { 4446 if (sp->lifetime == 0 && sp->validtime == 0) 4447 continue; 4448 if ((sp->lifetime && 4449 now - sp->created > sp->lifetime) || 4450 (sp->validtime && 4451 now - sp->lastused > sp->validtime)) { 4452 /* Hold extra reference to send SPDEXPIRE */ 4453 SP_ADDREF(sp); 4454 LIST_INSERT_HEAD(&drainq, sp, drainq); 4455 } 4456 } 4457 } 4458 SPTREE_RUNLOCK(); 4459 if (LIST_EMPTY(&drainq)) 4460 return; 4461 4462 SPTREE_WLOCK(); 4463 sp = LIST_FIRST(&drainq); 4464 while (sp != NULL) { 4465 nextsp = LIST_NEXT(sp, drainq); 4466 /* Check that SP is still linked */ 4467 if (sp->state != IPSEC_SPSTATE_ALIVE) { 4468 LIST_REMOVE(sp, drainq); 4469 key_freesp(&sp); /* release extra reference */ 4470 sp = nextsp; 4471 continue; 4472 } 4473 TAILQ_REMOVE(&V_sptree[sp->spidx.dir], sp, chain); 4474 V_spd_size--; 4475 LIST_REMOVE(sp, idhash); 4476 sp->state = IPSEC_SPSTATE_DEAD; 4477 sp = nextsp; 4478 } 4479 V_sp_genid++; 4480 SPTREE_WUNLOCK(); 4481 if (SPDCACHE_ENABLED()) 4482 spdcache_clear(); 4483 4484 sp = LIST_FIRST(&drainq); 4485 while (sp != NULL) { 4486 nextsp = LIST_NEXT(sp, drainq); 4487 key_spdexpire(sp); 4488 key_freesp(&sp); /* release extra reference */ 4489 key_freesp(&sp); /* release last reference */ 4490 sp = nextsp; 4491 } 4492 } 4493 4494 static void 4495 key_flush_sad(time_t now) 4496 { 4497 SAHTREE_RLOCK_TRACKER; 4498 struct secashead_list emptyq; 4499 struct secasvar_list drainq, hexpireq, sexpireq, freeq; 4500 struct secashead *sah, *nextsah; 4501 struct secasvar *sav, *nextsav; 4502 4503 LIST_INIT(&drainq); 4504 LIST_INIT(&hexpireq); 4505 LIST_INIT(&sexpireq); 4506 LIST_INIT(&emptyq); 4507 4508 SAHTREE_RLOCK(); 4509 TAILQ_FOREACH(sah, &V_sahtree, chain) { 4510 /* Check for empty SAH */ 4511 if (TAILQ_EMPTY(&sah->savtree_larval) && 4512 TAILQ_EMPTY(&sah->savtree_alive)) { 4513 SAH_ADDREF(sah); 4514 LIST_INSERT_HEAD(&emptyq, sah, drainq); 4515 continue; 4516 } 4517 /* Add all stale LARVAL SAs into drainq */ 4518 TAILQ_FOREACH(sav, &sah->savtree_larval, chain) { 4519 if (now - sav->created < V_key_larval_lifetime) 4520 continue; 4521 SAV_ADDREF(sav); 4522 LIST_INSERT_HEAD(&drainq, sav, drainq); 4523 } 4524 TAILQ_FOREACH(sav, &sah->savtree_alive, chain) { 4525 /* lifetimes aren't specified */ 4526 if (sav->lft_h == NULL) 4527 continue; 4528 SECASVAR_LOCK(sav); 4529 /* 4530 * Check again with lock held, because it may 4531 * be updated by SADB_UPDATE. 4532 */ 4533 if (sav->lft_h == NULL) { 4534 SECASVAR_UNLOCK(sav); 4535 continue; 4536 } 4537 /* 4538 * RFC 2367: 4539 * HARD lifetimes MUST take precedence over SOFT 4540 * lifetimes, meaning if the HARD and SOFT lifetimes 4541 * are the same, the HARD lifetime will appear on the 4542 * EXPIRE message. 4543 */ 4544 /* check HARD lifetime */ 4545 if ((sav->lft_h->addtime != 0 && 4546 now - sav->created > sav->lft_h->addtime) || 4547 (sav->lft_h->usetime != 0 && sav->firstused && 4548 now - sav->firstused > sav->lft_h->usetime) || 4549 (sav->lft_h->bytes != 0 && counter_u64_fetch( 4550 sav->lft_c_bytes) > sav->lft_h->bytes)) { 4551 SECASVAR_UNLOCK(sav); 4552 SAV_ADDREF(sav); 4553 LIST_INSERT_HEAD(&hexpireq, sav, drainq); 4554 continue; 4555 } 4556 /* check SOFT lifetime (only for MATURE SAs) */ 4557 if (sav->state == SADB_SASTATE_MATURE && ( 4558 (sav->lft_s->addtime != 0 && 4559 now - sav->created > sav->lft_s->addtime) || 4560 (sav->lft_s->usetime != 0 && sav->firstused && 4561 now - sav->firstused > sav->lft_s->usetime) || 4562 (sav->lft_s->bytes != 0 && counter_u64_fetch( 4563 sav->lft_c_bytes) > sav->lft_s->bytes))) { 4564 SECASVAR_UNLOCK(sav); 4565 SAV_ADDREF(sav); 4566 LIST_INSERT_HEAD(&sexpireq, sav, drainq); 4567 continue; 4568 } 4569 SECASVAR_UNLOCK(sav); 4570 } 4571 } 4572 SAHTREE_RUNLOCK(); 4573 4574 if (LIST_EMPTY(&emptyq) && LIST_EMPTY(&drainq) && 4575 LIST_EMPTY(&hexpireq) && LIST_EMPTY(&sexpireq)) 4576 return; 4577 4578 LIST_INIT(&freeq); 4579 SAHTREE_WLOCK(); 4580 /* Unlink stale LARVAL SAs */ 4581 sav = LIST_FIRST(&drainq); 4582 while (sav != NULL) { 4583 nextsav = LIST_NEXT(sav, drainq); 4584 /* Check that SA is still LARVAL */ 4585 if (sav->state != SADB_SASTATE_LARVAL) { 4586 LIST_REMOVE(sav, drainq); 4587 LIST_INSERT_HEAD(&freeq, sav, drainq); 4588 sav = nextsav; 4589 continue; 4590 } 4591 TAILQ_REMOVE(&sav->sah->savtree_larval, sav, chain); 4592 LIST_REMOVE(sav, spihash); 4593 sav->state = SADB_SASTATE_DEAD; 4594 sav = nextsav; 4595 } 4596 /* Unlink all SAs with expired HARD lifetime */ 4597 sav = LIST_FIRST(&hexpireq); 4598 while (sav != NULL) { 4599 nextsav = LIST_NEXT(sav, drainq); 4600 /* Check that SA is not unlinked */ 4601 if (sav->state == SADB_SASTATE_DEAD) { 4602 LIST_REMOVE(sav, drainq); 4603 LIST_INSERT_HEAD(&freeq, sav, drainq); 4604 sav = nextsav; 4605 continue; 4606 } 4607 TAILQ_REMOVE(&sav->sah->savtree_alive, sav, chain); 4608 LIST_REMOVE(sav, spihash); 4609 sav->state = SADB_SASTATE_DEAD; 4610 sav = nextsav; 4611 } 4612 /* Mark all SAs with expired SOFT lifetime as DYING */ 4613 sav = LIST_FIRST(&sexpireq); 4614 while (sav != NULL) { 4615 nextsav = LIST_NEXT(sav, drainq); 4616 /* Check that SA is not unlinked */ 4617 if (sav->state == SADB_SASTATE_DEAD) { 4618 LIST_REMOVE(sav, drainq); 4619 LIST_INSERT_HEAD(&freeq, sav, drainq); 4620 sav = nextsav; 4621 continue; 4622 } 4623 /* 4624 * NOTE: this doesn't change SA order in the chain. 4625 */ 4626 sav->state = SADB_SASTATE_DYING; 4627 sav = nextsav; 4628 } 4629 /* Unlink empty SAHs */ 4630 sah = LIST_FIRST(&emptyq); 4631 while (sah != NULL) { 4632 nextsah = LIST_NEXT(sah, drainq); 4633 /* Check that SAH is still empty and not unlinked */ 4634 if (sah->state == SADB_SASTATE_DEAD || 4635 !TAILQ_EMPTY(&sah->savtree_larval) || 4636 !TAILQ_EMPTY(&sah->savtree_alive)) { 4637 LIST_REMOVE(sah, drainq); 4638 key_freesah(&sah); /* release extra reference */ 4639 sah = nextsah; 4640 continue; 4641 } 4642 TAILQ_REMOVE(&V_sahtree, sah, chain); 4643 LIST_REMOVE(sah, addrhash); 4644 sah->state = SADB_SASTATE_DEAD; 4645 sah = nextsah; 4646 } 4647 SAHTREE_WUNLOCK(); 4648 4649 /* Send SPDEXPIRE messages */ 4650 sav = LIST_FIRST(&hexpireq); 4651 while (sav != NULL) { 4652 nextsav = LIST_NEXT(sav, drainq); 4653 key_expire(sav, 1); 4654 key_freesah(&sav->sah); /* release reference from SAV */ 4655 key_freesav(&sav); /* release extra reference */ 4656 key_freesav(&sav); /* release last reference */ 4657 sav = nextsav; 4658 } 4659 sav = LIST_FIRST(&sexpireq); 4660 while (sav != NULL) { 4661 nextsav = LIST_NEXT(sav, drainq); 4662 key_expire(sav, 0); 4663 key_freesav(&sav); /* release extra reference */ 4664 sav = nextsav; 4665 } 4666 /* Free stale LARVAL SAs */ 4667 sav = LIST_FIRST(&drainq); 4668 while (sav != NULL) { 4669 nextsav = LIST_NEXT(sav, drainq); 4670 key_freesah(&sav->sah); /* release reference from SAV */ 4671 key_freesav(&sav); /* release extra reference */ 4672 key_freesav(&sav); /* release last reference */ 4673 sav = nextsav; 4674 } 4675 /* Free SAs that were unlinked/changed by someone else */ 4676 sav = LIST_FIRST(&freeq); 4677 while (sav != NULL) { 4678 nextsav = LIST_NEXT(sav, drainq); 4679 key_freesav(&sav); /* release extra reference */ 4680 sav = nextsav; 4681 } 4682 /* Free empty SAH */ 4683 sah = LIST_FIRST(&emptyq); 4684 while (sah != NULL) { 4685 nextsah = LIST_NEXT(sah, drainq); 4686 key_freesah(&sah); /* release extra reference */ 4687 key_freesah(&sah); /* release last reference */ 4688 sah = nextsah; 4689 } 4690 } 4691 4692 static void 4693 key_flush_acq(time_t now) 4694 { 4695 struct secacq *acq, *nextacq; 4696 4697 /* ACQ tree */ 4698 ACQ_LOCK(); 4699 acq = LIST_FIRST(&V_acqtree); 4700 while (acq != NULL) { 4701 nextacq = LIST_NEXT(acq, chain); 4702 if (now - acq->created > V_key_blockacq_lifetime) { 4703 LIST_REMOVE(acq, chain); 4704 LIST_REMOVE(acq, addrhash); 4705 LIST_REMOVE(acq, seqhash); 4706 free(acq, M_IPSEC_SAQ); 4707 } 4708 acq = nextacq; 4709 } 4710 ACQ_UNLOCK(); 4711 } 4712 4713 static void 4714 key_flush_spacq(time_t now) 4715 { 4716 struct secspacq *acq, *nextacq; 4717 4718 /* SP ACQ tree */ 4719 SPACQ_LOCK(); 4720 for (acq = LIST_FIRST(&V_spacqtree); acq != NULL; acq = nextacq) { 4721 nextacq = LIST_NEXT(acq, chain); 4722 if (now - acq->created > V_key_blockacq_lifetime 4723 && __LIST_CHAINED(acq)) { 4724 LIST_REMOVE(acq, chain); 4725 free(acq, M_IPSEC_SAQ); 4726 } 4727 } 4728 SPACQ_UNLOCK(); 4729 } 4730 4731 /* 4732 * time handler. 4733 * scanning SPD and SAD to check status for each entries, 4734 * and do to remove or to expire. 4735 * XXX: year 2038 problem may remain. 4736 */ 4737 static void 4738 key_timehandler(void *arg) 4739 { 4740 VNET_ITERATOR_DECL(vnet_iter); 4741 time_t now = time_second; 4742 4743 VNET_LIST_RLOCK_NOSLEEP(); 4744 VNET_FOREACH(vnet_iter) { 4745 CURVNET_SET(vnet_iter); 4746 key_flush_spd(now); 4747 key_flush_sad(now); 4748 key_flush_acq(now); 4749 key_flush_spacq(now); 4750 CURVNET_RESTORE(); 4751 } 4752 VNET_LIST_RUNLOCK_NOSLEEP(); 4753 4754 #ifndef IPSEC_DEBUG2 4755 /* do exchange to tick time !! */ 4756 callout_schedule(&key_timer, hz); 4757 #endif /* IPSEC_DEBUG2 */ 4758 } 4759 4760 u_long 4761 key_random() 4762 { 4763 u_long value; 4764 4765 arc4random_buf(&value, sizeof(value)); 4766 return value; 4767 } 4768 4769 /* 4770 * map SADB_SATYPE_* to IPPROTO_*. 4771 * if satype == SADB_SATYPE then satype is mapped to ~0. 4772 * OUT: 4773 * 0: invalid satype. 4774 */ 4775 static uint8_t 4776 key_satype2proto(uint8_t satype) 4777 { 4778 switch (satype) { 4779 case SADB_SATYPE_UNSPEC: 4780 return IPSEC_PROTO_ANY; 4781 case SADB_SATYPE_AH: 4782 return IPPROTO_AH; 4783 case SADB_SATYPE_ESP: 4784 return IPPROTO_ESP; 4785 case SADB_X_SATYPE_IPCOMP: 4786 return IPPROTO_IPCOMP; 4787 case SADB_X_SATYPE_TCPSIGNATURE: 4788 return IPPROTO_TCP; 4789 default: 4790 return 0; 4791 } 4792 /* NOTREACHED */ 4793 } 4794 4795 /* 4796 * map IPPROTO_* to SADB_SATYPE_* 4797 * OUT: 4798 * 0: invalid protocol type. 4799 */ 4800 static uint8_t 4801 key_proto2satype(uint8_t proto) 4802 { 4803 switch (proto) { 4804 case IPPROTO_AH: 4805 return SADB_SATYPE_AH; 4806 case IPPROTO_ESP: 4807 return SADB_SATYPE_ESP; 4808 case IPPROTO_IPCOMP: 4809 return SADB_X_SATYPE_IPCOMP; 4810 case IPPROTO_TCP: 4811 return SADB_X_SATYPE_TCPSIGNATURE; 4812 default: 4813 return 0; 4814 } 4815 /* NOTREACHED */ 4816 } 4817 4818 /* %%% PF_KEY */ 4819 /* 4820 * SADB_GETSPI processing is to receive 4821 * <base, (SA2), src address, dst address, (SPI range)> 4822 * from the IKMPd, to assign a unique spi value, to hang on the INBOUND 4823 * tree with the status of LARVAL, and send 4824 * <base, SA(*), address(SD)> 4825 * to the IKMPd. 4826 * 4827 * IN: mhp: pointer to the pointer to each header. 4828 * OUT: NULL if fail. 4829 * other if success, return pointer to the message to send. 4830 */ 4831 static int 4832 key_getspi(struct socket *so, struct mbuf *m, const struct sadb_msghdr *mhp) 4833 { 4834 struct secasindex saidx; 4835 struct sadb_address *src0, *dst0; 4836 struct secasvar *sav; 4837 uint32_t reqid, spi; 4838 int error; 4839 uint8_t mode, proto; 4840 4841 IPSEC_ASSERT(so != NULL, ("null socket")); 4842 IPSEC_ASSERT(m != NULL, ("null mbuf")); 4843 IPSEC_ASSERT(mhp != NULL, ("null msghdr")); 4844 IPSEC_ASSERT(mhp->msg != NULL, ("null msg")); 4845 4846 if (SADB_CHECKHDR(mhp, SADB_EXT_ADDRESS_SRC) || 4847 SADB_CHECKHDR(mhp, SADB_EXT_ADDRESS_DST) 4848 #ifdef PFKEY_STRICT_CHECKS 4849 || SADB_CHECKHDR(mhp, SADB_EXT_SPIRANGE) 4850 #endif 4851 ) { 4852 ipseclog((LOG_DEBUG, 4853 "%s: invalid message: missing required header.\n", 4854 __func__)); 4855 error = EINVAL; 4856 goto fail; 4857 } 4858 if (SADB_CHECKLEN(mhp, SADB_EXT_ADDRESS_SRC) || 4859 SADB_CHECKLEN(mhp, SADB_EXT_ADDRESS_DST) 4860 #ifdef PFKEY_STRICT_CHECKS 4861 || SADB_CHECKLEN(mhp, SADB_EXT_SPIRANGE) 4862 #endif 4863 ) { 4864 ipseclog((LOG_DEBUG, 4865 "%s: invalid message: wrong header size.\n", __func__)); 4866 error = EINVAL; 4867 goto fail; 4868 } 4869 if (SADB_CHECKHDR(mhp, SADB_X_EXT_SA2)) { 4870 mode = IPSEC_MODE_ANY; 4871 reqid = 0; 4872 } else { 4873 if (SADB_CHECKLEN(mhp, SADB_X_EXT_SA2)) { 4874 ipseclog((LOG_DEBUG, 4875 "%s: invalid message: wrong header size.\n", 4876 __func__)); 4877 error = EINVAL; 4878 goto fail; 4879 } 4880 mode = ((struct sadb_x_sa2 *) 4881 mhp->ext[SADB_X_EXT_SA2])->sadb_x_sa2_mode; 4882 reqid = ((struct sadb_x_sa2 *) 4883 mhp->ext[SADB_X_EXT_SA2])->sadb_x_sa2_reqid; 4884 } 4885 4886 src0 = (struct sadb_address *)(mhp->ext[SADB_EXT_ADDRESS_SRC]); 4887 dst0 = (struct sadb_address *)(mhp->ext[SADB_EXT_ADDRESS_DST]); 4888 4889 /* map satype to proto */ 4890 if ((proto = key_satype2proto(mhp->msg->sadb_msg_satype)) == 0) { 4891 ipseclog((LOG_DEBUG, "%s: invalid satype is passed.\n", 4892 __func__)); 4893 error = EINVAL; 4894 goto fail; 4895 } 4896 error = key_checksockaddrs((struct sockaddr *)(src0 + 1), 4897 (struct sockaddr *)(dst0 + 1)); 4898 if (error != 0) { 4899 ipseclog((LOG_DEBUG, "%s: invalid sockaddr.\n", __func__)); 4900 error = EINVAL; 4901 goto fail; 4902 } 4903 KEY_SETSECASIDX(proto, mode, reqid, src0 + 1, dst0 + 1, &saidx); 4904 4905 /* SPI allocation */ 4906 spi = key_do_getnewspi( 4907 (struct sadb_spirange *)mhp->ext[SADB_EXT_SPIRANGE], &saidx); 4908 if (spi == 0) { 4909 /* 4910 * Requested SPI or SPI range is not available or 4911 * already used. 4912 */ 4913 error = EEXIST; 4914 goto fail; 4915 } 4916 sav = key_newsav(mhp, &saidx, spi, &error); 4917 if (sav == NULL) 4918 goto fail; 4919 4920 if (sav->seq != 0) { 4921 /* 4922 * RFC2367: 4923 * If the SADB_GETSPI message is in response to a 4924 * kernel-generated SADB_ACQUIRE, the sadb_msg_seq 4925 * MUST be the same as the SADB_ACQUIRE message. 4926 * 4927 * XXXAE: However it doesn't definethe behaviour how to 4928 * check this and what to do if it doesn't match. 4929 * Also what we should do if it matches? 4930 * 4931 * We can compare saidx used in SADB_ACQUIRE with saidx 4932 * used in SADB_GETSPI, but this probably can break 4933 * existing software. For now just warn if it doesn't match. 4934 * 4935 * XXXAE: anyway it looks useless. 4936 */ 4937 key_acqdone(&saidx, sav->seq); 4938 } 4939 KEYDBG(KEY_STAMP, 4940 printf("%s: SA(%p)\n", __func__, sav)); 4941 KEYDBG(KEY_DATA, kdebug_secasv(sav)); 4942 4943 { 4944 struct mbuf *n, *nn; 4945 struct sadb_sa *m_sa; 4946 struct sadb_msg *newmsg; 4947 int off, len; 4948 4949 /* create new sadb_msg to reply. */ 4950 len = PFKEY_ALIGN8(sizeof(struct sadb_msg)) + 4951 PFKEY_ALIGN8(sizeof(struct sadb_sa)); 4952 4953 MGETHDR(n, M_NOWAIT, MT_DATA); 4954 if (len > MHLEN) { 4955 if (!(MCLGET(n, M_NOWAIT))) { 4956 m_freem(n); 4957 n = NULL; 4958 } 4959 } 4960 if (!n) { 4961 error = ENOBUFS; 4962 goto fail; 4963 } 4964 4965 n->m_len = len; 4966 n->m_next = NULL; 4967 off = 0; 4968 4969 m_copydata(m, 0, sizeof(struct sadb_msg), mtod(n, caddr_t) + off); 4970 off += PFKEY_ALIGN8(sizeof(struct sadb_msg)); 4971 4972 m_sa = (struct sadb_sa *)(mtod(n, caddr_t) + off); 4973 m_sa->sadb_sa_len = PFKEY_UNIT64(sizeof(struct sadb_sa)); 4974 m_sa->sadb_sa_exttype = SADB_EXT_SA; 4975 m_sa->sadb_sa_spi = spi; /* SPI is already in network byte order */ 4976 off += PFKEY_ALIGN8(sizeof(struct sadb_sa)); 4977 4978 IPSEC_ASSERT(off == len, 4979 ("length inconsistency (off %u len %u)", off, len)); 4980 4981 n->m_next = key_gather_mbuf(m, mhp, 0, 2, SADB_EXT_ADDRESS_SRC, 4982 SADB_EXT_ADDRESS_DST); 4983 if (!n->m_next) { 4984 m_freem(n); 4985 error = ENOBUFS; 4986 goto fail; 4987 } 4988 4989 if (n->m_len < sizeof(struct sadb_msg)) { 4990 n = m_pullup(n, sizeof(struct sadb_msg)); 4991 if (n == NULL) 4992 return key_sendup_mbuf(so, m, KEY_SENDUP_ONE); 4993 } 4994 4995 n->m_pkthdr.len = 0; 4996 for (nn = n; nn; nn = nn->m_next) 4997 n->m_pkthdr.len += nn->m_len; 4998 4999 newmsg = mtod(n, struct sadb_msg *); 5000 newmsg->sadb_msg_seq = sav->seq; 5001 newmsg->sadb_msg_errno = 0; 5002 newmsg->sadb_msg_len = PFKEY_UNIT64(n->m_pkthdr.len); 5003 5004 m_freem(m); 5005 return key_sendup_mbuf(so, n, KEY_SENDUP_ONE); 5006 } 5007 5008 fail: 5009 return (key_senderror(so, m, error)); 5010 } 5011 5012 /* 5013 * allocating new SPI 5014 * called by key_getspi(). 5015 * OUT: 5016 * 0: failure. 5017 * others: success, SPI in network byte order. 5018 */ 5019 static uint32_t 5020 key_do_getnewspi(struct sadb_spirange *spirange, struct secasindex *saidx) 5021 { 5022 uint32_t min, max, newspi, t; 5023 int count = V_key_spi_trycnt; 5024 5025 /* set spi range to allocate */ 5026 if (spirange != NULL) { 5027 min = spirange->sadb_spirange_min; 5028 max = spirange->sadb_spirange_max; 5029 } else { 5030 min = V_key_spi_minval; 5031 max = V_key_spi_maxval; 5032 } 5033 /* IPCOMP needs 2-byte SPI */ 5034 if (saidx->proto == IPPROTO_IPCOMP) { 5035 if (min >= 0x10000) 5036 min = 0xffff; 5037 if (max >= 0x10000) 5038 max = 0xffff; 5039 if (min > max) { 5040 t = min; min = max; max = t; 5041 } 5042 } 5043 5044 if (min == max) { 5045 if (!key_checkspidup(htonl(min))) { 5046 ipseclog((LOG_DEBUG, "%s: SPI %u exists already.\n", 5047 __func__, min)); 5048 return 0; 5049 } 5050 5051 count--; /* taking one cost. */ 5052 newspi = min; 5053 } else { 5054 5055 /* init SPI */ 5056 newspi = 0; 5057 5058 /* when requesting to allocate spi ranged */ 5059 while (count--) { 5060 /* generate pseudo-random SPI value ranged. */ 5061 newspi = min + (key_random() % (max - min + 1)); 5062 if (!key_checkspidup(htonl(newspi))) 5063 break; 5064 } 5065 5066 if (count == 0 || newspi == 0) { 5067 ipseclog((LOG_DEBUG, 5068 "%s: failed to allocate SPI.\n", __func__)); 5069 return 0; 5070 } 5071 } 5072 5073 /* statistics */ 5074 keystat.getspi_count = 5075 (keystat.getspi_count + V_key_spi_trycnt - count) / 2; 5076 5077 return (htonl(newspi)); 5078 } 5079 5080 /* 5081 * Find TCP-MD5 SA with corresponding secasindex. 5082 * If not found, return NULL and fill SPI with usable value if needed. 5083 */ 5084 static struct secasvar * 5085 key_getsav_tcpmd5(struct secasindex *saidx, uint32_t *spi) 5086 { 5087 SAHTREE_RLOCK_TRACKER; 5088 struct secashead *sah; 5089 struct secasvar *sav; 5090 5091 IPSEC_ASSERT(saidx->proto == IPPROTO_TCP, ("wrong proto")); 5092 SAHTREE_RLOCK(); 5093 LIST_FOREACH(sah, SAHADDRHASH_HASH(saidx), addrhash) { 5094 if (sah->saidx.proto != IPPROTO_TCP) 5095 continue; 5096 if (!key_sockaddrcmp(&saidx->dst.sa, &sah->saidx.dst.sa, 0) && 5097 !key_sockaddrcmp(&saidx->src.sa, &sah->saidx.src.sa, 0)) 5098 break; 5099 } 5100 if (sah != NULL) { 5101 if (V_key_preferred_oldsa) 5102 sav = TAILQ_LAST(&sah->savtree_alive, secasvar_queue); 5103 else 5104 sav = TAILQ_FIRST(&sah->savtree_alive); 5105 if (sav != NULL) { 5106 SAV_ADDREF(sav); 5107 SAHTREE_RUNLOCK(); 5108 return (sav); 5109 } 5110 } 5111 if (spi == NULL) { 5112 /* No SPI required */ 5113 SAHTREE_RUNLOCK(); 5114 return (NULL); 5115 } 5116 /* Check that SPI is unique */ 5117 LIST_FOREACH(sav, SAVHASH_HASH(*spi), spihash) { 5118 if (sav->spi == *spi) 5119 break; 5120 } 5121 if (sav == NULL) { 5122 SAHTREE_RUNLOCK(); 5123 /* SPI is already unique */ 5124 return (NULL); 5125 } 5126 SAHTREE_RUNLOCK(); 5127 /* XXX: not optimal */ 5128 *spi = key_do_getnewspi(NULL, saidx); 5129 return (NULL); 5130 } 5131 5132 static int 5133 key_updateaddresses(struct socket *so, struct mbuf *m, 5134 const struct sadb_msghdr *mhp, struct secasvar *sav, 5135 struct secasindex *saidx) 5136 { 5137 struct sockaddr *newaddr; 5138 struct secashead *sah; 5139 struct secasvar *newsav, *tmp; 5140 struct mbuf *n; 5141 int error, isnew; 5142 5143 /* Check that we need to change SAH */ 5144 if (!SADB_CHECKHDR(mhp, SADB_X_EXT_NEW_ADDRESS_SRC)) { 5145 newaddr = (struct sockaddr *)( 5146 ((struct sadb_address *) 5147 mhp->ext[SADB_X_EXT_NEW_ADDRESS_SRC]) + 1); 5148 bcopy(newaddr, &saidx->src, newaddr->sa_len); 5149 key_porttosaddr(&saidx->src.sa, 0); 5150 } 5151 if (!SADB_CHECKHDR(mhp, SADB_X_EXT_NEW_ADDRESS_DST)) { 5152 newaddr = (struct sockaddr *)( 5153 ((struct sadb_address *) 5154 mhp->ext[SADB_X_EXT_NEW_ADDRESS_DST]) + 1); 5155 bcopy(newaddr, &saidx->dst, newaddr->sa_len); 5156 key_porttosaddr(&saidx->dst.sa, 0); 5157 } 5158 if (!SADB_CHECKHDR(mhp, SADB_X_EXT_NEW_ADDRESS_SRC) || 5159 !SADB_CHECKHDR(mhp, SADB_X_EXT_NEW_ADDRESS_DST)) { 5160 error = key_checksockaddrs(&saidx->src.sa, &saidx->dst.sa); 5161 if (error != 0) { 5162 ipseclog((LOG_DEBUG, "%s: invalid new sockaddr.\n", 5163 __func__)); 5164 return (error); 5165 } 5166 5167 sah = key_getsah(saidx); 5168 if (sah == NULL) { 5169 /* create a new SA index */ 5170 sah = key_newsah(saidx); 5171 if (sah == NULL) { 5172 ipseclog((LOG_DEBUG, 5173 "%s: No more memory.\n", __func__)); 5174 return (ENOBUFS); 5175 } 5176 isnew = 2; /* SAH is new */ 5177 } else 5178 isnew = 1; /* existing SAH is referenced */ 5179 } else { 5180 /* 5181 * src and dst addresses are still the same. 5182 * Do we want to change NAT-T config? 5183 */ 5184 if (sav->sah->saidx.proto != IPPROTO_ESP || 5185 SADB_CHECKHDR(mhp, SADB_X_EXT_NAT_T_TYPE) || 5186 SADB_CHECKHDR(mhp, SADB_X_EXT_NAT_T_SPORT) || 5187 SADB_CHECKHDR(mhp, SADB_X_EXT_NAT_T_DPORT)) { 5188 ipseclog((LOG_DEBUG, 5189 "%s: invalid message: missing required header.\n", 5190 __func__)); 5191 return (EINVAL); 5192 } 5193 /* We hold reference to SA, thus SAH will be referenced too. */ 5194 sah = sav->sah; 5195 isnew = 0; 5196 } 5197 5198 newsav = malloc(sizeof(struct secasvar), M_IPSEC_SA, 5199 M_NOWAIT | M_ZERO); 5200 if (newsav == NULL) { 5201 ipseclog((LOG_DEBUG, "%s: No more memory.\n", __func__)); 5202 error = ENOBUFS; 5203 goto fail; 5204 } 5205 5206 /* Clone SA's content into newsav */ 5207 SAV_INITREF(newsav); 5208 bcopy(sav, newsav, offsetof(struct secasvar, chain)); 5209 /* 5210 * We create new NAT-T config if it is needed. 5211 * Old NAT-T config will be freed by key_cleansav() when 5212 * last reference to SA will be released. 5213 */ 5214 newsav->natt = NULL; 5215 newsav->sah = sah; 5216 newsav->state = SADB_SASTATE_MATURE; 5217 error = key_setnatt(newsav, mhp); 5218 if (error != 0) 5219 goto fail; 5220 5221 SAHTREE_WLOCK(); 5222 /* Check that SA is still alive */ 5223 if (sav->state == SADB_SASTATE_DEAD) { 5224 /* SA was unlinked */ 5225 SAHTREE_WUNLOCK(); 5226 error = ESRCH; 5227 goto fail; 5228 } 5229 5230 /* Unlink SA from SAH and SPI hash */ 5231 IPSEC_ASSERT((sav->flags & SADB_X_EXT_F_CLONED) == 0, 5232 ("SA is already cloned")); 5233 IPSEC_ASSERT(sav->state == SADB_SASTATE_MATURE || 5234 sav->state == SADB_SASTATE_DYING, 5235 ("Wrong SA state %u\n", sav->state)); 5236 TAILQ_REMOVE(&sav->sah->savtree_alive, sav, chain); 5237 LIST_REMOVE(sav, spihash); 5238 sav->state = SADB_SASTATE_DEAD; 5239 5240 /* 5241 * Link new SA with SAH. Keep SAs ordered by 5242 * create time (newer are first). 5243 */ 5244 TAILQ_FOREACH(tmp, &sah->savtree_alive, chain) { 5245 if (newsav->created > tmp->created) { 5246 TAILQ_INSERT_BEFORE(tmp, newsav, chain); 5247 break; 5248 } 5249 } 5250 if (tmp == NULL) 5251 TAILQ_INSERT_TAIL(&sah->savtree_alive, newsav, chain); 5252 5253 /* Add new SA into SPI hash. */ 5254 LIST_INSERT_HEAD(SAVHASH_HASH(newsav->spi), newsav, spihash); 5255 5256 /* Add new SAH into SADB. */ 5257 if (isnew == 2) { 5258 TAILQ_INSERT_HEAD(&V_sahtree, sah, chain); 5259 LIST_INSERT_HEAD(SAHADDRHASH_HASH(saidx), sah, addrhash); 5260 sah->state = SADB_SASTATE_MATURE; 5261 SAH_ADDREF(sah); /* newsav references new SAH */ 5262 } 5263 /* 5264 * isnew == 1 -> @sah was referenced by key_getsah(). 5265 * isnew == 0 -> we use the same @sah, that was used by @sav, 5266 * and we use its reference for @newsav. 5267 */ 5268 SECASVAR_LOCK(sav); 5269 /* XXX: replace cntr with pointer? */ 5270 newsav->cntr = sav->cntr; 5271 sav->flags |= SADB_X_EXT_F_CLONED; 5272 SECASVAR_UNLOCK(sav); 5273 5274 SAHTREE_WUNLOCK(); 5275 5276 KEYDBG(KEY_STAMP, 5277 printf("%s: SA(%p) cloned into SA(%p)\n", 5278 __func__, sav, newsav)); 5279 KEYDBG(KEY_DATA, kdebug_secasv(newsav)); 5280 5281 key_freesav(&sav); /* release last reference */ 5282 5283 /* set msg buf from mhp */ 5284 n = key_getmsgbuf_x1(m, mhp); 5285 if (n == NULL) { 5286 ipseclog((LOG_DEBUG, "%s: No more memory.\n", __func__)); 5287 return (ENOBUFS); 5288 } 5289 m_freem(m); 5290 key_sendup_mbuf(so, n, KEY_SENDUP_ALL); 5291 return (0); 5292 fail: 5293 if (isnew != 0) 5294 key_freesah(&sah); 5295 if (newsav != NULL) { 5296 if (newsav->natt != NULL) 5297 free(newsav->natt, M_IPSEC_MISC); 5298 free(newsav, M_IPSEC_SA); 5299 } 5300 return (error); 5301 } 5302 5303 /* 5304 * SADB_UPDATE processing 5305 * receive 5306 * <base, SA, (SA2), (lifetime(HSC),) address(SD), (address(P),) 5307 * key(AE), (identity(SD),) (sensitivity)> 5308 * from the ikmpd, and update a secasvar entry whose status is SADB_SASTATE_LARVAL. 5309 * and send 5310 * <base, SA, (SA2), (lifetime(HSC),) address(SD), (address(P),) 5311 * (identity(SD),) (sensitivity)> 5312 * to the ikmpd. 5313 * 5314 * m will always be freed. 5315 */ 5316 static int 5317 key_update(struct socket *so, struct mbuf *m, const struct sadb_msghdr *mhp) 5318 { 5319 struct secasindex saidx; 5320 struct sadb_address *src0, *dst0; 5321 struct sadb_sa *sa0; 5322 struct secasvar *sav; 5323 uint32_t reqid; 5324 int error; 5325 uint8_t mode, proto; 5326 5327 IPSEC_ASSERT(so != NULL, ("null socket")); 5328 IPSEC_ASSERT(m != NULL, ("null mbuf")); 5329 IPSEC_ASSERT(mhp != NULL, ("null msghdr")); 5330 IPSEC_ASSERT(mhp->msg != NULL, ("null msg")); 5331 5332 /* map satype to proto */ 5333 if ((proto = key_satype2proto(mhp->msg->sadb_msg_satype)) == 0) { 5334 ipseclog((LOG_DEBUG, "%s: invalid satype is passed.\n", 5335 __func__)); 5336 return key_senderror(so, m, EINVAL); 5337 } 5338 5339 if (SADB_CHECKHDR(mhp, SADB_EXT_SA) || 5340 SADB_CHECKHDR(mhp, SADB_EXT_ADDRESS_SRC) || 5341 SADB_CHECKHDR(mhp, SADB_EXT_ADDRESS_DST) || 5342 (SADB_CHECKHDR(mhp, SADB_EXT_LIFETIME_HARD) && 5343 !SADB_CHECKHDR(mhp, SADB_EXT_LIFETIME_SOFT)) || 5344 (SADB_CHECKHDR(mhp, SADB_EXT_LIFETIME_SOFT) && 5345 !SADB_CHECKHDR(mhp, SADB_EXT_LIFETIME_HARD))) { 5346 ipseclog((LOG_DEBUG, 5347 "%s: invalid message: missing required header.\n", 5348 __func__)); 5349 return key_senderror(so, m, EINVAL); 5350 } 5351 if (SADB_CHECKLEN(mhp, SADB_EXT_SA) || 5352 SADB_CHECKLEN(mhp, SADB_EXT_ADDRESS_SRC) || 5353 SADB_CHECKLEN(mhp, SADB_EXT_ADDRESS_DST)) { 5354 ipseclog((LOG_DEBUG, 5355 "%s: invalid message: wrong header size.\n", __func__)); 5356 return key_senderror(so, m, EINVAL); 5357 } 5358 if (SADB_CHECKHDR(mhp, SADB_X_EXT_SA2)) { 5359 mode = IPSEC_MODE_ANY; 5360 reqid = 0; 5361 } else { 5362 if (SADB_CHECKLEN(mhp, SADB_X_EXT_SA2)) { 5363 ipseclog((LOG_DEBUG, 5364 "%s: invalid message: wrong header size.\n", 5365 __func__)); 5366 return key_senderror(so, m, EINVAL); 5367 } 5368 mode = ((struct sadb_x_sa2 *) 5369 mhp->ext[SADB_X_EXT_SA2])->sadb_x_sa2_mode; 5370 reqid = ((struct sadb_x_sa2 *) 5371 mhp->ext[SADB_X_EXT_SA2])->sadb_x_sa2_reqid; 5372 } 5373 5374 sa0 = (struct sadb_sa *)mhp->ext[SADB_EXT_SA]; 5375 src0 = (struct sadb_address *)(mhp->ext[SADB_EXT_ADDRESS_SRC]); 5376 dst0 = (struct sadb_address *)(mhp->ext[SADB_EXT_ADDRESS_DST]); 5377 5378 /* 5379 * Only SADB_SASTATE_MATURE SAs may be submitted in an 5380 * SADB_UPDATE message. 5381 */ 5382 if (sa0->sadb_sa_state != SADB_SASTATE_MATURE) { 5383 ipseclog((LOG_DEBUG, "%s: invalid state.\n", __func__)); 5384 #ifdef PFKEY_STRICT_CHECKS 5385 return key_senderror(so, m, EINVAL); 5386 #endif 5387 } 5388 error = key_checksockaddrs((struct sockaddr *)(src0 + 1), 5389 (struct sockaddr *)(dst0 + 1)); 5390 if (error != 0) { 5391 ipseclog((LOG_DEBUG, "%s: invalid sockaddr.\n", __func__)); 5392 return key_senderror(so, m, error); 5393 } 5394 KEY_SETSECASIDX(proto, mode, reqid, src0 + 1, dst0 + 1, &saidx); 5395 sav = key_getsavbyspi(sa0->sadb_sa_spi); 5396 if (sav == NULL) { 5397 ipseclog((LOG_DEBUG, "%s: no SA found for SPI %u\n", 5398 __func__, ntohl(sa0->sadb_sa_spi))); 5399 return key_senderror(so, m, EINVAL); 5400 } 5401 /* 5402 * Check that SADB_UPDATE issued by the same process that did 5403 * SADB_GETSPI or SADB_ADD. 5404 */ 5405 if (sav->pid != mhp->msg->sadb_msg_pid) { 5406 ipseclog((LOG_DEBUG, 5407 "%s: pid mismatched (SPI %u, pid %u vs. %u)\n", __func__, 5408 ntohl(sav->spi), sav->pid, mhp->msg->sadb_msg_pid)); 5409 key_freesav(&sav); 5410 return key_senderror(so, m, EINVAL); 5411 } 5412 /* saidx should match with SA. */ 5413 if (key_cmpsaidx(&sav->sah->saidx, &saidx, CMP_MODE_REQID) == 0) { 5414 ipseclog((LOG_DEBUG, "%s: saidx mismatched for SPI %u\n", 5415 __func__, ntohl(sav->spi))); 5416 key_freesav(&sav); 5417 return key_senderror(so, m, ESRCH); 5418 } 5419 5420 if (sav->state == SADB_SASTATE_LARVAL) { 5421 if ((mhp->msg->sadb_msg_satype == SADB_SATYPE_ESP && 5422 SADB_CHECKHDR(mhp, SADB_EXT_KEY_ENCRYPT)) || 5423 (mhp->msg->sadb_msg_satype == SADB_SATYPE_AH && 5424 SADB_CHECKHDR(mhp, SADB_EXT_KEY_AUTH))) { 5425 ipseclog((LOG_DEBUG, 5426 "%s: invalid message: missing required header.\n", 5427 __func__)); 5428 key_freesav(&sav); 5429 return key_senderror(so, m, EINVAL); 5430 } 5431 /* 5432 * We can set any values except src, dst and SPI. 5433 */ 5434 error = key_setsaval(sav, mhp); 5435 if (error != 0) { 5436 key_freesav(&sav); 5437 return (key_senderror(so, m, error)); 5438 } 5439 /* Change SA state to MATURE */ 5440 SAHTREE_WLOCK(); 5441 if (sav->state != SADB_SASTATE_LARVAL) { 5442 /* SA was deleted or another thread made it MATURE. */ 5443 SAHTREE_WUNLOCK(); 5444 key_freesav(&sav); 5445 return (key_senderror(so, m, ESRCH)); 5446 } 5447 /* 5448 * NOTE: we keep SAs in savtree_alive ordered by created 5449 * time. When SA's state changed from LARVAL to MATURE, 5450 * we update its created time in key_setsaval() and move 5451 * it into head of savtree_alive. 5452 */ 5453 TAILQ_REMOVE(&sav->sah->savtree_larval, sav, chain); 5454 TAILQ_INSERT_HEAD(&sav->sah->savtree_alive, sav, chain); 5455 sav->state = SADB_SASTATE_MATURE; 5456 SAHTREE_WUNLOCK(); 5457 } else { 5458 /* 5459 * For DYING and MATURE SA we can change only state 5460 * and lifetimes. Report EINVAL if something else attempted 5461 * to change. 5462 */ 5463 if (!SADB_CHECKHDR(mhp, SADB_EXT_KEY_ENCRYPT) || 5464 !SADB_CHECKHDR(mhp, SADB_EXT_KEY_AUTH)) { 5465 key_freesav(&sav); 5466 return (key_senderror(so, m, EINVAL)); 5467 } 5468 error = key_updatelifetimes(sav, mhp); 5469 if (error != 0) { 5470 key_freesav(&sav); 5471 return (key_senderror(so, m, error)); 5472 } 5473 /* 5474 * This is FreeBSD extension to RFC2367. 5475 * IKEd can specify SADB_X_EXT_NEW_ADDRESS_SRC and/or 5476 * SADB_X_EXT_NEW_ADDRESS_DST when it wants to change 5477 * SA addresses (for example to implement MOBIKE protocol 5478 * as described in RFC4555). Also we allow to change 5479 * NAT-T config. 5480 */ 5481 if (!SADB_CHECKHDR(mhp, SADB_X_EXT_NEW_ADDRESS_SRC) || 5482 !SADB_CHECKHDR(mhp, SADB_X_EXT_NEW_ADDRESS_DST) || 5483 !SADB_CHECKHDR(mhp, SADB_X_EXT_NAT_T_TYPE) || 5484 sav->natt != NULL) { 5485 error = key_updateaddresses(so, m, mhp, sav, &saidx); 5486 key_freesav(&sav); 5487 if (error != 0) 5488 return (key_senderror(so, m, error)); 5489 return (0); 5490 } 5491 /* Check that SA is still alive */ 5492 SAHTREE_WLOCK(); 5493 if (sav->state == SADB_SASTATE_DEAD) { 5494 /* SA was unlinked */ 5495 SAHTREE_WUNLOCK(); 5496 key_freesav(&sav); 5497 return (key_senderror(so, m, ESRCH)); 5498 } 5499 /* 5500 * NOTE: there is possible state moving from DYING to MATURE, 5501 * but this doesn't change created time, so we won't reorder 5502 * this SA. 5503 */ 5504 sav->state = SADB_SASTATE_MATURE; 5505 SAHTREE_WUNLOCK(); 5506 } 5507 KEYDBG(KEY_STAMP, 5508 printf("%s: SA(%p)\n", __func__, sav)); 5509 KEYDBG(KEY_DATA, kdebug_secasv(sav)); 5510 key_freesav(&sav); 5511 5512 { 5513 struct mbuf *n; 5514 5515 /* set msg buf from mhp */ 5516 n = key_getmsgbuf_x1(m, mhp); 5517 if (n == NULL) { 5518 ipseclog((LOG_DEBUG, "%s: No more memory.\n", __func__)); 5519 return key_senderror(so, m, ENOBUFS); 5520 } 5521 5522 m_freem(m); 5523 return key_sendup_mbuf(so, n, KEY_SENDUP_ALL); 5524 } 5525 } 5526 5527 /* 5528 * SADB_ADD processing 5529 * add an entry to SA database, when received 5530 * <base, SA, (SA2), (lifetime(HSC),) address(SD), (address(P),) 5531 * key(AE), (identity(SD),) (sensitivity)> 5532 * from the ikmpd, 5533 * and send 5534 * <base, SA, (SA2), (lifetime(HSC),) address(SD), (address(P),) 5535 * (identity(SD),) (sensitivity)> 5536 * to the ikmpd. 5537 * 5538 * IGNORE identity and sensitivity messages. 5539 * 5540 * m will always be freed. 5541 */ 5542 static int 5543 key_add(struct socket *so, struct mbuf *m, const struct sadb_msghdr *mhp) 5544 { 5545 struct secasindex saidx; 5546 struct sadb_address *src0, *dst0; 5547 struct sadb_sa *sa0; 5548 struct secasvar *sav; 5549 uint32_t reqid, spi; 5550 uint8_t mode, proto; 5551 int error; 5552 5553 IPSEC_ASSERT(so != NULL, ("null socket")); 5554 IPSEC_ASSERT(m != NULL, ("null mbuf")); 5555 IPSEC_ASSERT(mhp != NULL, ("null msghdr")); 5556 IPSEC_ASSERT(mhp->msg != NULL, ("null msg")); 5557 5558 /* map satype to proto */ 5559 if ((proto = key_satype2proto(mhp->msg->sadb_msg_satype)) == 0) { 5560 ipseclog((LOG_DEBUG, "%s: invalid satype is passed.\n", 5561 __func__)); 5562 return key_senderror(so, m, EINVAL); 5563 } 5564 5565 if (SADB_CHECKHDR(mhp, SADB_EXT_SA) || 5566 SADB_CHECKHDR(mhp, SADB_EXT_ADDRESS_SRC) || 5567 SADB_CHECKHDR(mhp, SADB_EXT_ADDRESS_DST) || 5568 (mhp->msg->sadb_msg_satype == SADB_SATYPE_ESP && ( 5569 SADB_CHECKHDR(mhp, SADB_EXT_KEY_ENCRYPT) || 5570 SADB_CHECKLEN(mhp, SADB_EXT_KEY_ENCRYPT))) || 5571 (mhp->msg->sadb_msg_satype == SADB_SATYPE_AH && ( 5572 SADB_CHECKHDR(mhp, SADB_EXT_KEY_AUTH) || 5573 SADB_CHECKLEN(mhp, SADB_EXT_KEY_AUTH))) || 5574 (SADB_CHECKHDR(mhp, SADB_EXT_LIFETIME_HARD) && 5575 !SADB_CHECKHDR(mhp, SADB_EXT_LIFETIME_SOFT)) || 5576 (SADB_CHECKHDR(mhp, SADB_EXT_LIFETIME_SOFT) && 5577 !SADB_CHECKHDR(mhp, SADB_EXT_LIFETIME_HARD))) { 5578 ipseclog((LOG_DEBUG, 5579 "%s: invalid message: missing required header.\n", 5580 __func__)); 5581 return key_senderror(so, m, EINVAL); 5582 } 5583 if (SADB_CHECKLEN(mhp, SADB_EXT_SA) || 5584 SADB_CHECKLEN(mhp, SADB_EXT_ADDRESS_SRC) || 5585 SADB_CHECKLEN(mhp, SADB_EXT_ADDRESS_DST)) { 5586 ipseclog((LOG_DEBUG, 5587 "%s: invalid message: wrong header size.\n", __func__)); 5588 return key_senderror(so, m, EINVAL); 5589 } 5590 if (SADB_CHECKHDR(mhp, SADB_X_EXT_SA2)) { 5591 mode = IPSEC_MODE_ANY; 5592 reqid = 0; 5593 } else { 5594 if (SADB_CHECKLEN(mhp, SADB_X_EXT_SA2)) { 5595 ipseclog((LOG_DEBUG, 5596 "%s: invalid message: wrong header size.\n", 5597 __func__)); 5598 return key_senderror(so, m, EINVAL); 5599 } 5600 mode = ((struct sadb_x_sa2 *) 5601 mhp->ext[SADB_X_EXT_SA2])->sadb_x_sa2_mode; 5602 reqid = ((struct sadb_x_sa2 *) 5603 mhp->ext[SADB_X_EXT_SA2])->sadb_x_sa2_reqid; 5604 } 5605 5606 sa0 = (struct sadb_sa *)mhp->ext[SADB_EXT_SA]; 5607 src0 = (struct sadb_address *)mhp->ext[SADB_EXT_ADDRESS_SRC]; 5608 dst0 = (struct sadb_address *)mhp->ext[SADB_EXT_ADDRESS_DST]; 5609 5610 /* 5611 * Only SADB_SASTATE_MATURE SAs may be submitted in an 5612 * SADB_ADD message. 5613 */ 5614 if (sa0->sadb_sa_state != SADB_SASTATE_MATURE) { 5615 ipseclog((LOG_DEBUG, "%s: invalid state.\n", __func__)); 5616 #ifdef PFKEY_STRICT_CHECKS 5617 return key_senderror(so, m, EINVAL); 5618 #endif 5619 } 5620 error = key_checksockaddrs((struct sockaddr *)(src0 + 1), 5621 (struct sockaddr *)(dst0 + 1)); 5622 if (error != 0) { 5623 ipseclog((LOG_DEBUG, "%s: invalid sockaddr.\n", __func__)); 5624 return key_senderror(so, m, error); 5625 } 5626 KEY_SETSECASIDX(proto, mode, reqid, src0 + 1, dst0 + 1, &saidx); 5627 spi = sa0->sadb_sa_spi; 5628 /* 5629 * For TCP-MD5 SAs we don't use SPI. Check the uniqueness using 5630 * secasindex. 5631 * XXXAE: IPComp seems also doesn't use SPI. 5632 */ 5633 if (proto == IPPROTO_TCP) { 5634 sav = key_getsav_tcpmd5(&saidx, &spi); 5635 if (sav == NULL && spi == 0) { 5636 /* Failed to allocate SPI */ 5637 ipseclog((LOG_DEBUG, "%s: SA already exists.\n", 5638 __func__)); 5639 return key_senderror(so, m, EEXIST); 5640 } 5641 /* XXX: SPI that we report back can have another value */ 5642 } else { 5643 /* We can create new SA only if SPI is different. */ 5644 sav = key_getsavbyspi(spi); 5645 } 5646 if (sav != NULL) { 5647 key_freesav(&sav); 5648 ipseclog((LOG_DEBUG, "%s: SA already exists.\n", __func__)); 5649 return key_senderror(so, m, EEXIST); 5650 } 5651 5652 sav = key_newsav(mhp, &saidx, spi, &error); 5653 if (sav == NULL) 5654 return key_senderror(so, m, error); 5655 KEYDBG(KEY_STAMP, 5656 printf("%s: return SA(%p)\n", __func__, sav)); 5657 KEYDBG(KEY_DATA, kdebug_secasv(sav)); 5658 /* 5659 * If SADB_ADD was in response to SADB_ACQUIRE, we need to schedule 5660 * ACQ for deletion. 5661 */ 5662 if (sav->seq != 0) 5663 key_acqdone(&saidx, sav->seq); 5664 5665 { 5666 /* 5667 * Don't call key_freesav() on error here, as we would like to 5668 * keep the SA in the database. 5669 */ 5670 struct mbuf *n; 5671 5672 /* set msg buf from mhp */ 5673 n = key_getmsgbuf_x1(m, mhp); 5674 if (n == NULL) { 5675 ipseclog((LOG_DEBUG, "%s: No more memory.\n", __func__)); 5676 return key_senderror(so, m, ENOBUFS); 5677 } 5678 5679 m_freem(m); 5680 return key_sendup_mbuf(so, n, KEY_SENDUP_ALL); 5681 } 5682 } 5683 5684 /* 5685 * NAT-T support. 5686 * IKEd may request the use ESP in UDP encapsulation when it detects the 5687 * presence of NAT. It uses NAT-T extension headers for such SAs to specify 5688 * parameters needed for encapsulation and decapsulation. These PF_KEY 5689 * extension headers are not standardized, so this comment addresses our 5690 * implementation. 5691 * SADB_X_EXT_NAT_T_TYPE specifies type of encapsulation, we support only 5692 * UDP_ENCAP_ESPINUDP as described in RFC3948. 5693 * SADB_X_EXT_NAT_T_SPORT/DPORT specifies source and destination ports for 5694 * UDP header. We use these ports in UDP encapsulation procedure, also we 5695 * can check them in UDP decapsulation procedure. 5696 * SADB_X_EXT_NAT_T_OA[IR] specifies original address of initiator or 5697 * responder. These addresses can be used for transport mode to adjust 5698 * checksum after decapsulation and decryption. Since original IP addresses 5699 * used by peer usually different (we detected presence of NAT), TCP/UDP 5700 * pseudo header checksum and IP header checksum was calculated using original 5701 * addresses. After decapsulation and decryption we need to adjust checksum 5702 * to have correct datagram. 5703 * 5704 * We expect presence of NAT-T extension headers only in SADB_ADD and 5705 * SADB_UPDATE messages. We report NAT-T extension headers in replies 5706 * to SADB_ADD, SADB_UPDATE, SADB_GET, and SADB_DUMP messages. 5707 */ 5708 static int 5709 key_setnatt(struct secasvar *sav, const struct sadb_msghdr *mhp) 5710 { 5711 struct sadb_x_nat_t_port *port; 5712 struct sadb_x_nat_t_type *type; 5713 struct sadb_address *oai, *oar; 5714 struct sockaddr *sa; 5715 uint32_t addr; 5716 uint16_t cksum; 5717 5718 IPSEC_ASSERT(sav->natt == NULL, ("natt is already initialized")); 5719 /* 5720 * Ignore NAT-T headers if sproto isn't ESP. 5721 */ 5722 if (sav->sah->saidx.proto != IPPROTO_ESP) 5723 return (0); 5724 5725 if (!SADB_CHECKHDR(mhp, SADB_X_EXT_NAT_T_TYPE) && 5726 !SADB_CHECKHDR(mhp, SADB_X_EXT_NAT_T_SPORT) && 5727 !SADB_CHECKHDR(mhp, SADB_X_EXT_NAT_T_DPORT)) { 5728 if (SADB_CHECKLEN(mhp, SADB_X_EXT_NAT_T_TYPE) || 5729 SADB_CHECKLEN(mhp, SADB_X_EXT_NAT_T_SPORT) || 5730 SADB_CHECKLEN(mhp, SADB_X_EXT_NAT_T_DPORT)) { 5731 ipseclog((LOG_DEBUG, 5732 "%s: invalid message: wrong header size.\n", 5733 __func__)); 5734 return (EINVAL); 5735 } 5736 } else 5737 return (0); 5738 5739 type = (struct sadb_x_nat_t_type *)mhp->ext[SADB_X_EXT_NAT_T_TYPE]; 5740 if (type->sadb_x_nat_t_type_type != UDP_ENCAP_ESPINUDP) { 5741 ipseclog((LOG_DEBUG, "%s: unsupported NAT-T type %u.\n", 5742 __func__, type->sadb_x_nat_t_type_type)); 5743 return (EINVAL); 5744 } 5745 /* 5746 * Allocate storage for NAT-T config. 5747 * On error it will be released by key_cleansav(). 5748 */ 5749 sav->natt = malloc(sizeof(struct secnatt), M_IPSEC_MISC, 5750 M_NOWAIT | M_ZERO); 5751 if (sav->natt == NULL) { 5752 PFKEYSTAT_INC(in_nomem); 5753 ipseclog((LOG_DEBUG, "%s: No more memory.\n", __func__)); 5754 return (ENOBUFS); 5755 } 5756 port = (struct sadb_x_nat_t_port *)mhp->ext[SADB_X_EXT_NAT_T_SPORT]; 5757 if (port->sadb_x_nat_t_port_port == 0) { 5758 ipseclog((LOG_DEBUG, "%s: invalid NAT-T sport specified.\n", 5759 __func__)); 5760 return (EINVAL); 5761 } 5762 sav->natt->sport = port->sadb_x_nat_t_port_port; 5763 port = (struct sadb_x_nat_t_port *)mhp->ext[SADB_X_EXT_NAT_T_DPORT]; 5764 if (port->sadb_x_nat_t_port_port == 0) { 5765 ipseclog((LOG_DEBUG, "%s: invalid NAT-T dport specified.\n", 5766 __func__)); 5767 return (EINVAL); 5768 } 5769 sav->natt->dport = port->sadb_x_nat_t_port_port; 5770 5771 /* 5772 * SADB_X_EXT_NAT_T_OAI and SADB_X_EXT_NAT_T_OAR are optional 5773 * and needed only for transport mode IPsec. 5774 * Usually NAT translates only one address, but it is possible, 5775 * that both addresses could be translated. 5776 * NOTE: Value of SADB_X_EXT_NAT_T_OAI is equal to SADB_X_EXT_NAT_T_OA. 5777 */ 5778 if (!SADB_CHECKHDR(mhp, SADB_X_EXT_NAT_T_OAI)) { 5779 if (SADB_CHECKLEN(mhp, SADB_X_EXT_NAT_T_OAI)) { 5780 ipseclog((LOG_DEBUG, 5781 "%s: invalid message: wrong header size.\n", 5782 __func__)); 5783 return (EINVAL); 5784 } 5785 oai = (struct sadb_address *)mhp->ext[SADB_X_EXT_NAT_T_OAI]; 5786 } else 5787 oai = NULL; 5788 if (!SADB_CHECKHDR(mhp, SADB_X_EXT_NAT_T_OAR)) { 5789 if (SADB_CHECKLEN(mhp, SADB_X_EXT_NAT_T_OAR)) { 5790 ipseclog((LOG_DEBUG, 5791 "%s: invalid message: wrong header size.\n", 5792 __func__)); 5793 return (EINVAL); 5794 } 5795 oar = (struct sadb_address *)mhp->ext[SADB_X_EXT_NAT_T_OAR]; 5796 } else 5797 oar = NULL; 5798 5799 /* Initialize addresses only for transport mode */ 5800 if (sav->sah->saidx.mode != IPSEC_MODE_TUNNEL) { 5801 cksum = 0; 5802 if (oai != NULL) { 5803 /* Currently we support only AF_INET */ 5804 sa = (struct sockaddr *)(oai + 1); 5805 if (sa->sa_family != AF_INET || 5806 sa->sa_len != sizeof(struct sockaddr_in)) { 5807 ipseclog((LOG_DEBUG, 5808 "%s: wrong NAT-OAi header.\n", 5809 __func__)); 5810 return (EINVAL); 5811 } 5812 /* Ignore address if it the same */ 5813 if (((struct sockaddr_in *)sa)->sin_addr.s_addr != 5814 sav->sah->saidx.src.sin.sin_addr.s_addr) { 5815 bcopy(sa, &sav->natt->oai.sa, sa->sa_len); 5816 sav->natt->flags |= IPSEC_NATT_F_OAI; 5817 /* Calculate checksum delta */ 5818 addr = sav->sah->saidx.src.sin.sin_addr.s_addr; 5819 cksum = in_addword(cksum, ~addr >> 16); 5820 cksum = in_addword(cksum, ~addr & 0xffff); 5821 addr = sav->natt->oai.sin.sin_addr.s_addr; 5822 cksum = in_addword(cksum, addr >> 16); 5823 cksum = in_addword(cksum, addr & 0xffff); 5824 } 5825 } 5826 if (oar != NULL) { 5827 /* Currently we support only AF_INET */ 5828 sa = (struct sockaddr *)(oar + 1); 5829 if (sa->sa_family != AF_INET || 5830 sa->sa_len != sizeof(struct sockaddr_in)) { 5831 ipseclog((LOG_DEBUG, 5832 "%s: wrong NAT-OAr header.\n", 5833 __func__)); 5834 return (EINVAL); 5835 } 5836 /* Ignore address if it the same */ 5837 if (((struct sockaddr_in *)sa)->sin_addr.s_addr != 5838 sav->sah->saidx.dst.sin.sin_addr.s_addr) { 5839 bcopy(sa, &sav->natt->oar.sa, sa->sa_len); 5840 sav->natt->flags |= IPSEC_NATT_F_OAR; 5841 /* Calculate checksum delta */ 5842 addr = sav->sah->saidx.dst.sin.sin_addr.s_addr; 5843 cksum = in_addword(cksum, ~addr >> 16); 5844 cksum = in_addword(cksum, ~addr & 0xffff); 5845 addr = sav->natt->oar.sin.sin_addr.s_addr; 5846 cksum = in_addword(cksum, addr >> 16); 5847 cksum = in_addword(cksum, addr & 0xffff); 5848 } 5849 } 5850 sav->natt->cksum = cksum; 5851 } 5852 return (0); 5853 } 5854 5855 static int 5856 key_setident(struct secashead *sah, const struct sadb_msghdr *mhp) 5857 { 5858 const struct sadb_ident *idsrc, *iddst; 5859 5860 IPSEC_ASSERT(sah != NULL, ("null secashead")); 5861 IPSEC_ASSERT(mhp != NULL, ("null msghdr")); 5862 IPSEC_ASSERT(mhp->msg != NULL, ("null msg")); 5863 5864 /* don't make buffer if not there */ 5865 if (SADB_CHECKHDR(mhp, SADB_EXT_IDENTITY_SRC) && 5866 SADB_CHECKHDR(mhp, SADB_EXT_IDENTITY_DST)) { 5867 sah->idents = NULL; 5868 sah->identd = NULL; 5869 return (0); 5870 } 5871 5872 if (SADB_CHECKHDR(mhp, SADB_EXT_IDENTITY_SRC) || 5873 SADB_CHECKHDR(mhp, SADB_EXT_IDENTITY_DST)) { 5874 ipseclog((LOG_DEBUG, "%s: invalid identity.\n", __func__)); 5875 return (EINVAL); 5876 } 5877 5878 idsrc = (const struct sadb_ident *)mhp->ext[SADB_EXT_IDENTITY_SRC]; 5879 iddst = (const struct sadb_ident *)mhp->ext[SADB_EXT_IDENTITY_DST]; 5880 5881 /* validity check */ 5882 if (idsrc->sadb_ident_type != iddst->sadb_ident_type) { 5883 ipseclog((LOG_DEBUG, "%s: ident type mismatch.\n", __func__)); 5884 return EINVAL; 5885 } 5886 5887 switch (idsrc->sadb_ident_type) { 5888 case SADB_IDENTTYPE_PREFIX: 5889 case SADB_IDENTTYPE_FQDN: 5890 case SADB_IDENTTYPE_USERFQDN: 5891 default: 5892 /* XXX do nothing */ 5893 sah->idents = NULL; 5894 sah->identd = NULL; 5895 return 0; 5896 } 5897 5898 /* make structure */ 5899 sah->idents = malloc(sizeof(struct secident), M_IPSEC_MISC, M_NOWAIT); 5900 if (sah->idents == NULL) { 5901 ipseclog((LOG_DEBUG, "%s: No more memory.\n", __func__)); 5902 return ENOBUFS; 5903 } 5904 sah->identd = malloc(sizeof(struct secident), M_IPSEC_MISC, M_NOWAIT); 5905 if (sah->identd == NULL) { 5906 free(sah->idents, M_IPSEC_MISC); 5907 sah->idents = NULL; 5908 ipseclog((LOG_DEBUG, "%s: No more memory.\n", __func__)); 5909 return ENOBUFS; 5910 } 5911 sah->idents->type = idsrc->sadb_ident_type; 5912 sah->idents->id = idsrc->sadb_ident_id; 5913 5914 sah->identd->type = iddst->sadb_ident_type; 5915 sah->identd->id = iddst->sadb_ident_id; 5916 5917 return 0; 5918 } 5919 5920 /* 5921 * m will not be freed on return. 5922 * it is caller's responsibility to free the result. 5923 * 5924 * Called from SADB_ADD and SADB_UPDATE. Reply will contain headers 5925 * from the request in defined order. 5926 */ 5927 static struct mbuf * 5928 key_getmsgbuf_x1(struct mbuf *m, const struct sadb_msghdr *mhp) 5929 { 5930 struct mbuf *n; 5931 5932 IPSEC_ASSERT(m != NULL, ("null mbuf")); 5933 IPSEC_ASSERT(mhp != NULL, ("null msghdr")); 5934 IPSEC_ASSERT(mhp->msg != NULL, ("null msg")); 5935 5936 /* create new sadb_msg to reply. */ 5937 n = key_gather_mbuf(m, mhp, 1, 16, SADB_EXT_RESERVED, 5938 SADB_EXT_SA, SADB_X_EXT_SA2, 5939 SADB_EXT_ADDRESS_SRC, SADB_EXT_ADDRESS_DST, 5940 SADB_EXT_LIFETIME_HARD, SADB_EXT_LIFETIME_SOFT, 5941 SADB_EXT_IDENTITY_SRC, SADB_EXT_IDENTITY_DST, 5942 SADB_X_EXT_NAT_T_TYPE, SADB_X_EXT_NAT_T_SPORT, 5943 SADB_X_EXT_NAT_T_DPORT, SADB_X_EXT_NAT_T_OAI, 5944 SADB_X_EXT_NAT_T_OAR, SADB_X_EXT_NEW_ADDRESS_SRC, 5945 SADB_X_EXT_NEW_ADDRESS_DST); 5946 if (!n) 5947 return NULL; 5948 5949 if (n->m_len < sizeof(struct sadb_msg)) { 5950 n = m_pullup(n, sizeof(struct sadb_msg)); 5951 if (n == NULL) 5952 return NULL; 5953 } 5954 mtod(n, struct sadb_msg *)->sadb_msg_errno = 0; 5955 mtod(n, struct sadb_msg *)->sadb_msg_len = 5956 PFKEY_UNIT64(n->m_pkthdr.len); 5957 5958 return n; 5959 } 5960 5961 /* 5962 * SADB_DELETE processing 5963 * receive 5964 * <base, SA(*), address(SD)> 5965 * from the ikmpd, and set SADB_SASTATE_DEAD, 5966 * and send, 5967 * <base, SA(*), address(SD)> 5968 * to the ikmpd. 5969 * 5970 * m will always be freed. 5971 */ 5972 static int 5973 key_delete(struct socket *so, struct mbuf *m, const struct sadb_msghdr *mhp) 5974 { 5975 struct secasindex saidx; 5976 struct sadb_address *src0, *dst0; 5977 struct secasvar *sav; 5978 struct sadb_sa *sa0; 5979 uint8_t proto; 5980 5981 IPSEC_ASSERT(so != NULL, ("null socket")); 5982 IPSEC_ASSERT(m != NULL, ("null mbuf")); 5983 IPSEC_ASSERT(mhp != NULL, ("null msghdr")); 5984 IPSEC_ASSERT(mhp->msg != NULL, ("null msg")); 5985 5986 /* map satype to proto */ 5987 if ((proto = key_satype2proto(mhp->msg->sadb_msg_satype)) == 0) { 5988 ipseclog((LOG_DEBUG, "%s: invalid satype is passed.\n", 5989 __func__)); 5990 return key_senderror(so, m, EINVAL); 5991 } 5992 5993 if (SADB_CHECKHDR(mhp, SADB_EXT_ADDRESS_SRC) || 5994 SADB_CHECKHDR(mhp, SADB_EXT_ADDRESS_DST) || 5995 SADB_CHECKLEN(mhp, SADB_EXT_ADDRESS_SRC) || 5996 SADB_CHECKLEN(mhp, SADB_EXT_ADDRESS_DST)) { 5997 ipseclog((LOG_DEBUG, "%s: invalid message is passed.\n", 5998 __func__)); 5999 return key_senderror(so, m, EINVAL); 6000 } 6001 6002 src0 = (struct sadb_address *)(mhp->ext[SADB_EXT_ADDRESS_SRC]); 6003 dst0 = (struct sadb_address *)(mhp->ext[SADB_EXT_ADDRESS_DST]); 6004 6005 if (key_checksockaddrs((struct sockaddr *)(src0 + 1), 6006 (struct sockaddr *)(dst0 + 1)) != 0) { 6007 ipseclog((LOG_DEBUG, "%s: invalid sockaddr.\n", __func__)); 6008 return (key_senderror(so, m, EINVAL)); 6009 } 6010 KEY_SETSECASIDX(proto, IPSEC_MODE_ANY, 0, src0 + 1, dst0 + 1, &saidx); 6011 if (SADB_CHECKHDR(mhp, SADB_EXT_SA)) { 6012 /* 6013 * Caller wants us to delete all non-LARVAL SAs 6014 * that match the src/dst. This is used during 6015 * IKE INITIAL-CONTACT. 6016 * XXXAE: this looks like some extension to RFC2367. 6017 */ 6018 ipseclog((LOG_DEBUG, "%s: doing delete all.\n", __func__)); 6019 return (key_delete_all(so, m, mhp, &saidx)); 6020 } 6021 if (SADB_CHECKLEN(mhp, SADB_EXT_SA)) { 6022 ipseclog((LOG_DEBUG, 6023 "%s: invalid message: wrong header size.\n", __func__)); 6024 return (key_senderror(so, m, EINVAL)); 6025 } 6026 sa0 = (struct sadb_sa *)mhp->ext[SADB_EXT_SA]; 6027 if (proto == IPPROTO_TCP) 6028 sav = key_getsav_tcpmd5(&saidx, NULL); 6029 else 6030 sav = key_getsavbyspi(sa0->sadb_sa_spi); 6031 if (sav == NULL) { 6032 ipseclog((LOG_DEBUG, "%s: no SA found for SPI %u.\n", 6033 __func__, ntohl(sa0->sadb_sa_spi))); 6034 return (key_senderror(so, m, ESRCH)); 6035 } 6036 if (key_cmpsaidx(&sav->sah->saidx, &saidx, CMP_HEAD) == 0) { 6037 ipseclog((LOG_DEBUG, "%s: saidx mismatched for SPI %u.\n", 6038 __func__, ntohl(sav->spi))); 6039 key_freesav(&sav); 6040 return (key_senderror(so, m, ESRCH)); 6041 } 6042 KEYDBG(KEY_STAMP, 6043 printf("%s: SA(%p)\n", __func__, sav)); 6044 KEYDBG(KEY_DATA, kdebug_secasv(sav)); 6045 key_unlinksav(sav); 6046 key_freesav(&sav); 6047 6048 { 6049 struct mbuf *n; 6050 struct sadb_msg *newmsg; 6051 6052 /* create new sadb_msg to reply. */ 6053 n = key_gather_mbuf(m, mhp, 1, 4, SADB_EXT_RESERVED, 6054 SADB_EXT_SA, SADB_EXT_ADDRESS_SRC, SADB_EXT_ADDRESS_DST); 6055 if (!n) 6056 return key_senderror(so, m, ENOBUFS); 6057 6058 if (n->m_len < sizeof(struct sadb_msg)) { 6059 n = m_pullup(n, sizeof(struct sadb_msg)); 6060 if (n == NULL) 6061 return key_senderror(so, m, ENOBUFS); 6062 } 6063 newmsg = mtod(n, struct sadb_msg *); 6064 newmsg->sadb_msg_errno = 0; 6065 newmsg->sadb_msg_len = PFKEY_UNIT64(n->m_pkthdr.len); 6066 6067 m_freem(m); 6068 return key_sendup_mbuf(so, n, KEY_SENDUP_ALL); 6069 } 6070 } 6071 6072 /* 6073 * delete all SAs for src/dst. Called from key_delete(). 6074 */ 6075 static int 6076 key_delete_all(struct socket *so, struct mbuf *m, 6077 const struct sadb_msghdr *mhp, struct secasindex *saidx) 6078 { 6079 struct secasvar_queue drainq; 6080 struct secashead *sah; 6081 struct secasvar *sav, *nextsav; 6082 6083 TAILQ_INIT(&drainq); 6084 SAHTREE_WLOCK(); 6085 LIST_FOREACH(sah, SAHADDRHASH_HASH(saidx), addrhash) { 6086 if (key_cmpsaidx(&sah->saidx, saidx, CMP_HEAD) == 0) 6087 continue; 6088 /* Move all ALIVE SAs into drainq */ 6089 TAILQ_CONCAT(&drainq, &sah->savtree_alive, chain); 6090 } 6091 /* Unlink all queued SAs from SPI hash */ 6092 TAILQ_FOREACH(sav, &drainq, chain) { 6093 sav->state = SADB_SASTATE_DEAD; 6094 LIST_REMOVE(sav, spihash); 6095 } 6096 SAHTREE_WUNLOCK(); 6097 /* Now we can release reference for all SAs in drainq */ 6098 sav = TAILQ_FIRST(&drainq); 6099 while (sav != NULL) { 6100 KEYDBG(KEY_STAMP, 6101 printf("%s: SA(%p)\n", __func__, sav)); 6102 KEYDBG(KEY_DATA, kdebug_secasv(sav)); 6103 nextsav = TAILQ_NEXT(sav, chain); 6104 key_freesah(&sav->sah); /* release reference from SAV */ 6105 key_freesav(&sav); /* release last reference */ 6106 sav = nextsav; 6107 } 6108 6109 { 6110 struct mbuf *n; 6111 struct sadb_msg *newmsg; 6112 6113 /* create new sadb_msg to reply. */ 6114 n = key_gather_mbuf(m, mhp, 1, 3, SADB_EXT_RESERVED, 6115 SADB_EXT_ADDRESS_SRC, SADB_EXT_ADDRESS_DST); 6116 if (!n) 6117 return key_senderror(so, m, ENOBUFS); 6118 6119 if (n->m_len < sizeof(struct sadb_msg)) { 6120 n = m_pullup(n, sizeof(struct sadb_msg)); 6121 if (n == NULL) 6122 return key_senderror(so, m, ENOBUFS); 6123 } 6124 newmsg = mtod(n, struct sadb_msg *); 6125 newmsg->sadb_msg_errno = 0; 6126 newmsg->sadb_msg_len = PFKEY_UNIT64(n->m_pkthdr.len); 6127 6128 m_freem(m); 6129 return key_sendup_mbuf(so, n, KEY_SENDUP_ALL); 6130 } 6131 } 6132 6133 /* 6134 * Delete all alive SAs for corresponding xform. 6135 * Larval SAs have not initialized tdb_xform, so it is safe to leave them 6136 * here when xform disappears. 6137 */ 6138 void 6139 key_delete_xform(const struct xformsw *xsp) 6140 { 6141 struct secasvar_queue drainq; 6142 struct secashead *sah; 6143 struct secasvar *sav, *nextsav; 6144 6145 TAILQ_INIT(&drainq); 6146 SAHTREE_WLOCK(); 6147 TAILQ_FOREACH(sah, &V_sahtree, chain) { 6148 sav = TAILQ_FIRST(&sah->savtree_alive); 6149 if (sav == NULL) 6150 continue; 6151 if (sav->tdb_xform != xsp) 6152 continue; 6153 /* 6154 * It is supposed that all SAs in the chain are related to 6155 * one xform. 6156 */ 6157 TAILQ_CONCAT(&drainq, &sah->savtree_alive, chain); 6158 } 6159 /* Unlink all queued SAs from SPI hash */ 6160 TAILQ_FOREACH(sav, &drainq, chain) { 6161 sav->state = SADB_SASTATE_DEAD; 6162 LIST_REMOVE(sav, spihash); 6163 } 6164 SAHTREE_WUNLOCK(); 6165 6166 /* Now we can release reference for all SAs in drainq */ 6167 sav = TAILQ_FIRST(&drainq); 6168 while (sav != NULL) { 6169 KEYDBG(KEY_STAMP, 6170 printf("%s: SA(%p)\n", __func__, sav)); 6171 KEYDBG(KEY_DATA, kdebug_secasv(sav)); 6172 nextsav = TAILQ_NEXT(sav, chain); 6173 key_freesah(&sav->sah); /* release reference from SAV */ 6174 key_freesav(&sav); /* release last reference */ 6175 sav = nextsav; 6176 } 6177 } 6178 6179 /* 6180 * SADB_GET processing 6181 * receive 6182 * <base, SA(*), address(SD)> 6183 * from the ikmpd, and get a SP and a SA to respond, 6184 * and send, 6185 * <base, SA, (lifetime(HSC),) address(SD), (address(P),) key(AE), 6186 * (identity(SD),) (sensitivity)> 6187 * to the ikmpd. 6188 * 6189 * m will always be freed. 6190 */ 6191 static int 6192 key_get(struct socket *so, struct mbuf *m, const struct sadb_msghdr *mhp) 6193 { 6194 struct secasindex saidx; 6195 struct sadb_address *src0, *dst0; 6196 struct sadb_sa *sa0; 6197 struct secasvar *sav; 6198 uint8_t proto; 6199 6200 IPSEC_ASSERT(so != NULL, ("null socket")); 6201 IPSEC_ASSERT(m != NULL, ("null mbuf")); 6202 IPSEC_ASSERT(mhp != NULL, ("null msghdr")); 6203 IPSEC_ASSERT(mhp->msg != NULL, ("null msg")); 6204 6205 /* map satype to proto */ 6206 if ((proto = key_satype2proto(mhp->msg->sadb_msg_satype)) == 0) { 6207 ipseclog((LOG_DEBUG, "%s: invalid satype is passed.\n", 6208 __func__)); 6209 return key_senderror(so, m, EINVAL); 6210 } 6211 6212 if (SADB_CHECKHDR(mhp, SADB_EXT_SA) || 6213 SADB_CHECKHDR(mhp, SADB_EXT_ADDRESS_SRC) || 6214 SADB_CHECKHDR(mhp, SADB_EXT_ADDRESS_DST)) { 6215 ipseclog((LOG_DEBUG, 6216 "%s: invalid message: missing required header.\n", 6217 __func__)); 6218 return key_senderror(so, m, EINVAL); 6219 } 6220 if (SADB_CHECKLEN(mhp, SADB_EXT_SA) || 6221 SADB_CHECKLEN(mhp, SADB_EXT_ADDRESS_SRC) || 6222 SADB_CHECKLEN(mhp, SADB_EXT_ADDRESS_DST)) { 6223 ipseclog((LOG_DEBUG, 6224 "%s: invalid message: wrong header size.\n", __func__)); 6225 return key_senderror(so, m, EINVAL); 6226 } 6227 6228 sa0 = (struct sadb_sa *)mhp->ext[SADB_EXT_SA]; 6229 src0 = (struct sadb_address *)mhp->ext[SADB_EXT_ADDRESS_SRC]; 6230 dst0 = (struct sadb_address *)mhp->ext[SADB_EXT_ADDRESS_DST]; 6231 6232 if (key_checksockaddrs((struct sockaddr *)(src0 + 1), 6233 (struct sockaddr *)(dst0 + 1)) != 0) { 6234 ipseclog((LOG_DEBUG, "%s: invalid sockaddr.\n", __func__)); 6235 return key_senderror(so, m, EINVAL); 6236 } 6237 KEY_SETSECASIDX(proto, IPSEC_MODE_ANY, 0, src0 + 1, dst0 + 1, &saidx); 6238 6239 if (proto == IPPROTO_TCP) 6240 sav = key_getsav_tcpmd5(&saidx, NULL); 6241 else 6242 sav = key_getsavbyspi(sa0->sadb_sa_spi); 6243 if (sav == NULL) { 6244 ipseclog((LOG_DEBUG, "%s: no SA found.\n", __func__)); 6245 return key_senderror(so, m, ESRCH); 6246 } 6247 if (key_cmpsaidx(&sav->sah->saidx, &saidx, CMP_HEAD) == 0) { 6248 ipseclog((LOG_DEBUG, "%s: saidx mismatched for SPI %u.\n", 6249 __func__, ntohl(sa0->sadb_sa_spi))); 6250 key_freesav(&sav); 6251 return (key_senderror(so, m, ESRCH)); 6252 } 6253 6254 { 6255 struct mbuf *n; 6256 uint8_t satype; 6257 6258 /* map proto to satype */ 6259 if ((satype = key_proto2satype(sav->sah->saidx.proto)) == 0) { 6260 ipseclog((LOG_DEBUG, "%s: there was invalid proto in SAD.\n", 6261 __func__)); 6262 key_freesav(&sav); 6263 return key_senderror(so, m, EINVAL); 6264 } 6265 6266 /* create new sadb_msg to reply. */ 6267 n = key_setdumpsa(sav, SADB_GET, satype, mhp->msg->sadb_msg_seq, 6268 mhp->msg->sadb_msg_pid); 6269 6270 key_freesav(&sav); 6271 if (!n) 6272 return key_senderror(so, m, ENOBUFS); 6273 6274 m_freem(m); 6275 return key_sendup_mbuf(so, n, KEY_SENDUP_ONE); 6276 } 6277 } 6278 6279 /* XXX make it sysctl-configurable? */ 6280 static void 6281 key_getcomb_setlifetime(struct sadb_comb *comb) 6282 { 6283 6284 comb->sadb_comb_soft_allocations = 1; 6285 comb->sadb_comb_hard_allocations = 1; 6286 comb->sadb_comb_soft_bytes = 0; 6287 comb->sadb_comb_hard_bytes = 0; 6288 comb->sadb_comb_hard_addtime = 86400; /* 1 day */ 6289 comb->sadb_comb_soft_addtime = comb->sadb_comb_soft_addtime * 80 / 100; 6290 comb->sadb_comb_soft_usetime = 28800; /* 8 hours */ 6291 comb->sadb_comb_hard_usetime = comb->sadb_comb_hard_usetime * 80 / 100; 6292 } 6293 6294 /* 6295 * XXX reorder combinations by preference 6296 * XXX no idea if the user wants ESP authentication or not 6297 */ 6298 static struct mbuf * 6299 key_getcomb_ealg(void) 6300 { 6301 struct sadb_comb *comb; 6302 const struct enc_xform *algo; 6303 struct mbuf *result = NULL, *m, *n; 6304 int encmin; 6305 int i, off, o; 6306 int totlen; 6307 const int l = PFKEY_ALIGN8(sizeof(struct sadb_comb)); 6308 6309 m = NULL; 6310 for (i = 1; i <= SADB_EALG_MAX; i++) { 6311 algo = enc_algorithm_lookup(i); 6312 if (algo == NULL) 6313 continue; 6314 6315 /* discard algorithms with key size smaller than system min */ 6316 if (_BITS(algo->maxkey) < V_ipsec_esp_keymin) 6317 continue; 6318 if (_BITS(algo->minkey) < V_ipsec_esp_keymin) 6319 encmin = V_ipsec_esp_keymin; 6320 else 6321 encmin = _BITS(algo->minkey); 6322 6323 if (V_ipsec_esp_auth) 6324 m = key_getcomb_ah(); 6325 else { 6326 IPSEC_ASSERT(l <= MLEN, 6327 ("l=%u > MLEN=%lu", l, (u_long) MLEN)); 6328 MGET(m, M_NOWAIT, MT_DATA); 6329 if (m) { 6330 M_ALIGN(m, l); 6331 m->m_len = l; 6332 m->m_next = NULL; 6333 bzero(mtod(m, caddr_t), m->m_len); 6334 } 6335 } 6336 if (!m) 6337 goto fail; 6338 6339 totlen = 0; 6340 for (n = m; n; n = n->m_next) 6341 totlen += n->m_len; 6342 IPSEC_ASSERT((totlen % l) == 0, ("totlen=%u, l=%u", totlen, l)); 6343 6344 for (off = 0; off < totlen; off += l) { 6345 n = m_pulldown(m, off, l, &o); 6346 if (!n) { 6347 /* m is already freed */ 6348 goto fail; 6349 } 6350 comb = (struct sadb_comb *)(mtod(n, caddr_t) + o); 6351 bzero(comb, sizeof(*comb)); 6352 key_getcomb_setlifetime(comb); 6353 comb->sadb_comb_encrypt = i; 6354 comb->sadb_comb_encrypt_minbits = encmin; 6355 comb->sadb_comb_encrypt_maxbits = _BITS(algo->maxkey); 6356 } 6357 6358 if (!result) 6359 result = m; 6360 else 6361 m_cat(result, m); 6362 } 6363 6364 return result; 6365 6366 fail: 6367 if (result) 6368 m_freem(result); 6369 return NULL; 6370 } 6371 6372 static void 6373 key_getsizes_ah(const struct auth_hash *ah, int alg, u_int16_t* min, 6374 u_int16_t* max) 6375 { 6376 6377 *min = *max = ah->hashsize; 6378 if (ah->keysize == 0) { 6379 /* 6380 * Transform takes arbitrary key size but algorithm 6381 * key size is restricted. Enforce this here. 6382 */ 6383 switch (alg) { 6384 case SADB_X_AALG_MD5: *min = *max = 16; break; 6385 case SADB_X_AALG_SHA: *min = *max = 20; break; 6386 case SADB_X_AALG_NULL: *min = 1; *max = 256; break; 6387 case SADB_X_AALG_SHA2_256: *min = *max = 32; break; 6388 case SADB_X_AALG_SHA2_384: *min = *max = 48; break; 6389 case SADB_X_AALG_SHA2_512: *min = *max = 64; break; 6390 default: 6391 DPRINTF(("%s: unknown AH algorithm %u\n", 6392 __func__, alg)); 6393 break; 6394 } 6395 } 6396 } 6397 6398 /* 6399 * XXX reorder combinations by preference 6400 */ 6401 static struct mbuf * 6402 key_getcomb_ah() 6403 { 6404 const struct auth_hash *algo; 6405 struct sadb_comb *comb; 6406 struct mbuf *m; 6407 u_int16_t minkeysize, maxkeysize; 6408 int i; 6409 const int l = PFKEY_ALIGN8(sizeof(struct sadb_comb)); 6410 6411 m = NULL; 6412 for (i = 1; i <= SADB_AALG_MAX; i++) { 6413 #if 1 6414 /* we prefer HMAC algorithms, not old algorithms */ 6415 if (i != SADB_AALG_SHA1HMAC && 6416 i != SADB_AALG_MD5HMAC && 6417 i != SADB_X_AALG_SHA2_256 && 6418 i != SADB_X_AALG_SHA2_384 && 6419 i != SADB_X_AALG_SHA2_512) 6420 continue; 6421 #endif 6422 algo = auth_algorithm_lookup(i); 6423 if (!algo) 6424 continue; 6425 key_getsizes_ah(algo, i, &minkeysize, &maxkeysize); 6426 /* discard algorithms with key size smaller than system min */ 6427 if (_BITS(minkeysize) < V_ipsec_ah_keymin) 6428 continue; 6429 6430 if (!m) { 6431 IPSEC_ASSERT(l <= MLEN, 6432 ("l=%u > MLEN=%lu", l, (u_long) MLEN)); 6433 MGET(m, M_NOWAIT, MT_DATA); 6434 if (m) { 6435 M_ALIGN(m, l); 6436 m->m_len = l; 6437 m->m_next = NULL; 6438 } 6439 } else 6440 M_PREPEND(m, l, M_NOWAIT); 6441 if (!m) 6442 return NULL; 6443 6444 comb = mtod(m, struct sadb_comb *); 6445 bzero(comb, sizeof(*comb)); 6446 key_getcomb_setlifetime(comb); 6447 comb->sadb_comb_auth = i; 6448 comb->sadb_comb_auth_minbits = _BITS(minkeysize); 6449 comb->sadb_comb_auth_maxbits = _BITS(maxkeysize); 6450 } 6451 6452 return m; 6453 } 6454 6455 /* 6456 * not really an official behavior. discussed in pf_key@inner.net in Sep2000. 6457 * XXX reorder combinations by preference 6458 */ 6459 static struct mbuf * 6460 key_getcomb_ipcomp() 6461 { 6462 const struct comp_algo *algo; 6463 struct sadb_comb *comb; 6464 struct mbuf *m; 6465 int i; 6466 const int l = PFKEY_ALIGN8(sizeof(struct sadb_comb)); 6467 6468 m = NULL; 6469 for (i = 1; i <= SADB_X_CALG_MAX; i++) { 6470 algo = comp_algorithm_lookup(i); 6471 if (!algo) 6472 continue; 6473 6474 if (!m) { 6475 IPSEC_ASSERT(l <= MLEN, 6476 ("l=%u > MLEN=%lu", l, (u_long) MLEN)); 6477 MGET(m, M_NOWAIT, MT_DATA); 6478 if (m) { 6479 M_ALIGN(m, l); 6480 m->m_len = l; 6481 m->m_next = NULL; 6482 } 6483 } else 6484 M_PREPEND(m, l, M_NOWAIT); 6485 if (!m) 6486 return NULL; 6487 6488 comb = mtod(m, struct sadb_comb *); 6489 bzero(comb, sizeof(*comb)); 6490 key_getcomb_setlifetime(comb); 6491 comb->sadb_comb_encrypt = i; 6492 /* what should we set into sadb_comb_*_{min,max}bits? */ 6493 } 6494 6495 return m; 6496 } 6497 6498 /* 6499 * XXX no way to pass mode (transport/tunnel) to userland 6500 * XXX replay checking? 6501 * XXX sysctl interface to ipsec_{ah,esp}_keymin 6502 */ 6503 static struct mbuf * 6504 key_getprop(const struct secasindex *saidx) 6505 { 6506 struct sadb_prop *prop; 6507 struct mbuf *m, *n; 6508 const int l = PFKEY_ALIGN8(sizeof(struct sadb_prop)); 6509 int totlen; 6510 6511 switch (saidx->proto) { 6512 case IPPROTO_ESP: 6513 m = key_getcomb_ealg(); 6514 break; 6515 case IPPROTO_AH: 6516 m = key_getcomb_ah(); 6517 break; 6518 case IPPROTO_IPCOMP: 6519 m = key_getcomb_ipcomp(); 6520 break; 6521 default: 6522 return NULL; 6523 } 6524 6525 if (!m) 6526 return NULL; 6527 M_PREPEND(m, l, M_NOWAIT); 6528 if (!m) 6529 return NULL; 6530 6531 totlen = 0; 6532 for (n = m; n; n = n->m_next) 6533 totlen += n->m_len; 6534 6535 prop = mtod(m, struct sadb_prop *); 6536 bzero(prop, sizeof(*prop)); 6537 prop->sadb_prop_len = PFKEY_UNIT64(totlen); 6538 prop->sadb_prop_exttype = SADB_EXT_PROPOSAL; 6539 prop->sadb_prop_replay = 32; /* XXX */ 6540 6541 return m; 6542 } 6543 6544 /* 6545 * SADB_ACQUIRE processing called by key_checkrequest() and key_acquire2(). 6546 * send 6547 * <base, SA, address(SD), (address(P)), x_policy, 6548 * (identity(SD),) (sensitivity,) proposal> 6549 * to KMD, and expect to receive 6550 * <base> with SADB_ACQUIRE if error occurred, 6551 * or 6552 * <base, src address, dst address, (SPI range)> with SADB_GETSPI 6553 * from KMD by PF_KEY. 6554 * 6555 * XXX x_policy is outside of RFC2367 (KAME extension). 6556 * XXX sensitivity is not supported. 6557 * XXX for ipcomp, RFC2367 does not define how to fill in proposal. 6558 * see comment for key_getcomb_ipcomp(). 6559 * 6560 * OUT: 6561 * 0 : succeed 6562 * others: error number 6563 */ 6564 static int 6565 key_acquire(const struct secasindex *saidx, struct secpolicy *sp) 6566 { 6567 union sockaddr_union addr; 6568 struct mbuf *result, *m; 6569 uint32_t seq; 6570 int error; 6571 uint16_t ul_proto; 6572 uint8_t mask, satype; 6573 6574 IPSEC_ASSERT(saidx != NULL, ("null saidx")); 6575 satype = key_proto2satype(saidx->proto); 6576 IPSEC_ASSERT(satype != 0, ("null satype, protocol %u", saidx->proto)); 6577 6578 error = -1; 6579 result = NULL; 6580 ul_proto = IPSEC_ULPROTO_ANY; 6581 6582 /* Get seq number to check whether sending message or not. */ 6583 seq = key_getacq(saidx, &error); 6584 if (seq == 0) 6585 return (error); 6586 6587 m = key_setsadbmsg(SADB_ACQUIRE, 0, satype, seq, 0, 0); 6588 if (!m) { 6589 error = ENOBUFS; 6590 goto fail; 6591 } 6592 result = m; 6593 6594 /* 6595 * set sadb_address for saidx's. 6596 * 6597 * Note that if sp is supplied, then we're being called from 6598 * key_allocsa_policy() and should supply port and protocol 6599 * information. 6600 * XXXAE: why only TCP and UDP? ICMP and SCTP looks applicable too. 6601 * XXXAE: probably we can handle this in the ipsec[46]_allocsa(). 6602 * XXXAE: it looks like we should save this info in the ACQ entry. 6603 */ 6604 if (sp != NULL && (sp->spidx.ul_proto == IPPROTO_TCP || 6605 sp->spidx.ul_proto == IPPROTO_UDP)) 6606 ul_proto = sp->spidx.ul_proto; 6607 6608 addr = saidx->src; 6609 mask = FULLMASK; 6610 if (ul_proto != IPSEC_ULPROTO_ANY) { 6611 switch (sp->spidx.src.sa.sa_family) { 6612 case AF_INET: 6613 if (sp->spidx.src.sin.sin_port != IPSEC_PORT_ANY) { 6614 addr.sin.sin_port = sp->spidx.src.sin.sin_port; 6615 mask = sp->spidx.prefs; 6616 } 6617 break; 6618 case AF_INET6: 6619 if (sp->spidx.src.sin6.sin6_port != IPSEC_PORT_ANY) { 6620 addr.sin6.sin6_port = 6621 sp->spidx.src.sin6.sin6_port; 6622 mask = sp->spidx.prefs; 6623 } 6624 break; 6625 default: 6626 break; 6627 } 6628 } 6629 m = key_setsadbaddr(SADB_EXT_ADDRESS_SRC, &addr.sa, mask, ul_proto); 6630 if (!m) { 6631 error = ENOBUFS; 6632 goto fail; 6633 } 6634 m_cat(result, m); 6635 6636 addr = saidx->dst; 6637 mask = FULLMASK; 6638 if (ul_proto != IPSEC_ULPROTO_ANY) { 6639 switch (sp->spidx.dst.sa.sa_family) { 6640 case AF_INET: 6641 if (sp->spidx.dst.sin.sin_port != IPSEC_PORT_ANY) { 6642 addr.sin.sin_port = sp->spidx.dst.sin.sin_port; 6643 mask = sp->spidx.prefd; 6644 } 6645 break; 6646 case AF_INET6: 6647 if (sp->spidx.dst.sin6.sin6_port != IPSEC_PORT_ANY) { 6648 addr.sin6.sin6_port = 6649 sp->spidx.dst.sin6.sin6_port; 6650 mask = sp->spidx.prefd; 6651 } 6652 break; 6653 default: 6654 break; 6655 } 6656 } 6657 m = key_setsadbaddr(SADB_EXT_ADDRESS_DST, &addr.sa, mask, ul_proto); 6658 if (!m) { 6659 error = ENOBUFS; 6660 goto fail; 6661 } 6662 m_cat(result, m); 6663 6664 /* XXX proxy address (optional) */ 6665 6666 /* 6667 * Set sadb_x_policy. This is KAME extension to RFC2367. 6668 */ 6669 if (sp != NULL) { 6670 m = key_setsadbxpolicy(sp->policy, sp->spidx.dir, sp->id, 6671 sp->priority); 6672 if (!m) { 6673 error = ENOBUFS; 6674 goto fail; 6675 } 6676 m_cat(result, m); 6677 } 6678 6679 /* 6680 * Set sadb_x_sa2 extension if saidx->reqid is not zero. 6681 * This is FreeBSD extension to RFC2367. 6682 */ 6683 if (saidx->reqid != 0) { 6684 m = key_setsadbxsa2(saidx->mode, 0, saidx->reqid); 6685 if (m == NULL) { 6686 error = ENOBUFS; 6687 goto fail; 6688 } 6689 m_cat(result, m); 6690 } 6691 /* XXX identity (optional) */ 6692 #if 0 6693 if (idexttype && fqdn) { 6694 /* create identity extension (FQDN) */ 6695 struct sadb_ident *id; 6696 int fqdnlen; 6697 6698 fqdnlen = strlen(fqdn) + 1; /* +1 for terminating-NUL */ 6699 id = (struct sadb_ident *)p; 6700 bzero(id, sizeof(*id) + PFKEY_ALIGN8(fqdnlen)); 6701 id->sadb_ident_len = PFKEY_UNIT64(sizeof(*id) + PFKEY_ALIGN8(fqdnlen)); 6702 id->sadb_ident_exttype = idexttype; 6703 id->sadb_ident_type = SADB_IDENTTYPE_FQDN; 6704 bcopy(fqdn, id + 1, fqdnlen); 6705 p += sizeof(struct sadb_ident) + PFKEY_ALIGN8(fqdnlen); 6706 } 6707 6708 if (idexttype) { 6709 /* create identity extension (USERFQDN) */ 6710 struct sadb_ident *id; 6711 int userfqdnlen; 6712 6713 if (userfqdn) { 6714 /* +1 for terminating-NUL */ 6715 userfqdnlen = strlen(userfqdn) + 1; 6716 } else 6717 userfqdnlen = 0; 6718 id = (struct sadb_ident *)p; 6719 bzero(id, sizeof(*id) + PFKEY_ALIGN8(userfqdnlen)); 6720 id->sadb_ident_len = PFKEY_UNIT64(sizeof(*id) + PFKEY_ALIGN8(userfqdnlen)); 6721 id->sadb_ident_exttype = idexttype; 6722 id->sadb_ident_type = SADB_IDENTTYPE_USERFQDN; 6723 /* XXX is it correct? */ 6724 if (curproc && curproc->p_cred) 6725 id->sadb_ident_id = curproc->p_cred->p_ruid; 6726 if (userfqdn && userfqdnlen) 6727 bcopy(userfqdn, id + 1, userfqdnlen); 6728 p += sizeof(struct sadb_ident) + PFKEY_ALIGN8(userfqdnlen); 6729 } 6730 #endif 6731 6732 /* XXX sensitivity (optional) */ 6733 6734 /* create proposal/combination extension */ 6735 m = key_getprop(saidx); 6736 #if 0 6737 /* 6738 * spec conformant: always attach proposal/combination extension, 6739 * the problem is that we have no way to attach it for ipcomp, 6740 * due to the way sadb_comb is declared in RFC2367. 6741 */ 6742 if (!m) { 6743 error = ENOBUFS; 6744 goto fail; 6745 } 6746 m_cat(result, m); 6747 #else 6748 /* 6749 * outside of spec; make proposal/combination extension optional. 6750 */ 6751 if (m) 6752 m_cat(result, m); 6753 #endif 6754 6755 if ((result->m_flags & M_PKTHDR) == 0) { 6756 error = EINVAL; 6757 goto fail; 6758 } 6759 6760 if (result->m_len < sizeof(struct sadb_msg)) { 6761 result = m_pullup(result, sizeof(struct sadb_msg)); 6762 if (result == NULL) { 6763 error = ENOBUFS; 6764 goto fail; 6765 } 6766 } 6767 6768 result->m_pkthdr.len = 0; 6769 for (m = result; m; m = m->m_next) 6770 result->m_pkthdr.len += m->m_len; 6771 6772 mtod(result, struct sadb_msg *)->sadb_msg_len = 6773 PFKEY_UNIT64(result->m_pkthdr.len); 6774 6775 KEYDBG(KEY_STAMP, 6776 printf("%s: SP(%p)\n", __func__, sp)); 6777 KEYDBG(KEY_DATA, kdebug_secasindex(saidx, NULL)); 6778 6779 return key_sendup_mbuf(NULL, result, KEY_SENDUP_REGISTERED); 6780 6781 fail: 6782 if (result) 6783 m_freem(result); 6784 return error; 6785 } 6786 6787 static uint32_t 6788 key_newacq(const struct secasindex *saidx, int *perror) 6789 { 6790 struct secacq *acq; 6791 uint32_t seq; 6792 6793 acq = malloc(sizeof(*acq), M_IPSEC_SAQ, M_NOWAIT | M_ZERO); 6794 if (acq == NULL) { 6795 ipseclog((LOG_DEBUG, "%s: No more memory.\n", __func__)); 6796 *perror = ENOBUFS; 6797 return (0); 6798 } 6799 6800 /* copy secindex */ 6801 bcopy(saidx, &acq->saidx, sizeof(acq->saidx)); 6802 acq->created = time_second; 6803 acq->count = 0; 6804 6805 /* add to acqtree */ 6806 ACQ_LOCK(); 6807 seq = acq->seq = (V_acq_seq == ~0 ? 1 : ++V_acq_seq); 6808 LIST_INSERT_HEAD(&V_acqtree, acq, chain); 6809 LIST_INSERT_HEAD(ACQADDRHASH_HASH(saidx), acq, addrhash); 6810 LIST_INSERT_HEAD(ACQSEQHASH_HASH(seq), acq, seqhash); 6811 ACQ_UNLOCK(); 6812 *perror = 0; 6813 return (seq); 6814 } 6815 6816 static uint32_t 6817 key_getacq(const struct secasindex *saidx, int *perror) 6818 { 6819 struct secacq *acq; 6820 uint32_t seq; 6821 6822 ACQ_LOCK(); 6823 LIST_FOREACH(acq, ACQADDRHASH_HASH(saidx), addrhash) { 6824 if (key_cmpsaidx(&acq->saidx, saidx, CMP_EXACTLY)) { 6825 if (acq->count > V_key_blockacq_count) { 6826 /* 6827 * Reset counter and send message. 6828 * Also reset created time to keep ACQ for 6829 * this saidx. 6830 */ 6831 acq->created = time_second; 6832 acq->count = 0; 6833 seq = acq->seq; 6834 } else { 6835 /* 6836 * Increment counter and do nothing. 6837 * We send SADB_ACQUIRE message only 6838 * for each V_key_blockacq_count packet. 6839 */ 6840 acq->count++; 6841 seq = 0; 6842 } 6843 break; 6844 } 6845 } 6846 ACQ_UNLOCK(); 6847 if (acq != NULL) { 6848 *perror = 0; 6849 return (seq); 6850 } 6851 /* allocate new entry */ 6852 return (key_newacq(saidx, perror)); 6853 } 6854 6855 static int 6856 key_acqreset(uint32_t seq) 6857 { 6858 struct secacq *acq; 6859 6860 ACQ_LOCK(); 6861 LIST_FOREACH(acq, ACQSEQHASH_HASH(seq), seqhash) { 6862 if (acq->seq == seq) { 6863 acq->count = 0; 6864 acq->created = time_second; 6865 break; 6866 } 6867 } 6868 ACQ_UNLOCK(); 6869 if (acq == NULL) 6870 return (ESRCH); 6871 return (0); 6872 } 6873 /* 6874 * Mark ACQ entry as stale to remove it in key_flush_acq(). 6875 * Called after successful SADB_GETSPI message. 6876 */ 6877 static int 6878 key_acqdone(const struct secasindex *saidx, uint32_t seq) 6879 { 6880 struct secacq *acq; 6881 6882 ACQ_LOCK(); 6883 LIST_FOREACH(acq, ACQSEQHASH_HASH(seq), seqhash) { 6884 if (acq->seq == seq) 6885 break; 6886 } 6887 if (acq != NULL) { 6888 if (key_cmpsaidx(&acq->saidx, saidx, CMP_EXACTLY) == 0) { 6889 ipseclog((LOG_DEBUG, 6890 "%s: Mismatched saidx for ACQ %u\n", __func__, seq)); 6891 acq = NULL; 6892 } else { 6893 acq->created = 0; 6894 } 6895 } else { 6896 ipseclog((LOG_DEBUG, 6897 "%s: ACQ %u is not found.\n", __func__, seq)); 6898 } 6899 ACQ_UNLOCK(); 6900 if (acq == NULL) 6901 return (ESRCH); 6902 return (0); 6903 } 6904 6905 static struct secspacq * 6906 key_newspacq(struct secpolicyindex *spidx) 6907 { 6908 struct secspacq *acq; 6909 6910 /* get new entry */ 6911 acq = malloc(sizeof(struct secspacq), M_IPSEC_SAQ, M_NOWAIT|M_ZERO); 6912 if (acq == NULL) { 6913 ipseclog((LOG_DEBUG, "%s: No more memory.\n", __func__)); 6914 return NULL; 6915 } 6916 6917 /* copy secindex */ 6918 bcopy(spidx, &acq->spidx, sizeof(acq->spidx)); 6919 acq->created = time_second; 6920 acq->count = 0; 6921 6922 /* add to spacqtree */ 6923 SPACQ_LOCK(); 6924 LIST_INSERT_HEAD(&V_spacqtree, acq, chain); 6925 SPACQ_UNLOCK(); 6926 6927 return acq; 6928 } 6929 6930 static struct secspacq * 6931 key_getspacq(struct secpolicyindex *spidx) 6932 { 6933 struct secspacq *acq; 6934 6935 SPACQ_LOCK(); 6936 LIST_FOREACH(acq, &V_spacqtree, chain) { 6937 if (key_cmpspidx_exactly(spidx, &acq->spidx)) { 6938 /* NB: return holding spacq_lock */ 6939 return acq; 6940 } 6941 } 6942 SPACQ_UNLOCK(); 6943 6944 return NULL; 6945 } 6946 6947 /* 6948 * SADB_ACQUIRE processing, 6949 * in first situation, is receiving 6950 * <base> 6951 * from the ikmpd, and clear sequence of its secasvar entry. 6952 * 6953 * In second situation, is receiving 6954 * <base, address(SD), (address(P),) (identity(SD),) (sensitivity,) proposal> 6955 * from a user land process, and return 6956 * <base, address(SD), (address(P),) (identity(SD),) (sensitivity,) proposal> 6957 * to the socket. 6958 * 6959 * m will always be freed. 6960 */ 6961 static int 6962 key_acquire2(struct socket *so, struct mbuf *m, const struct sadb_msghdr *mhp) 6963 { 6964 SAHTREE_RLOCK_TRACKER; 6965 struct sadb_address *src0, *dst0; 6966 struct secasindex saidx; 6967 struct secashead *sah; 6968 uint32_t reqid; 6969 int error; 6970 uint8_t mode, proto; 6971 6972 IPSEC_ASSERT(so != NULL, ("null socket")); 6973 IPSEC_ASSERT(m != NULL, ("null mbuf")); 6974 IPSEC_ASSERT(mhp != NULL, ("null msghdr")); 6975 IPSEC_ASSERT(mhp->msg != NULL, ("null msg")); 6976 6977 /* 6978 * Error message from KMd. 6979 * We assume that if error was occurred in IKEd, the length of PFKEY 6980 * message is equal to the size of sadb_msg structure. 6981 * We do not raise error even if error occurred in this function. 6982 */ 6983 if (mhp->msg->sadb_msg_len == PFKEY_UNIT64(sizeof(struct sadb_msg))) { 6984 /* check sequence number */ 6985 if (mhp->msg->sadb_msg_seq == 0 || 6986 mhp->msg->sadb_msg_errno == 0) { 6987 ipseclog((LOG_DEBUG, "%s: must specify sequence " 6988 "number and errno.\n", __func__)); 6989 } else { 6990 /* 6991 * IKEd reported that error occurred. 6992 * XXXAE: what it expects from the kernel? 6993 * Probably we should send SADB_ACQUIRE again? 6994 * If so, reset ACQ's state. 6995 * XXXAE: it looks useless. 6996 */ 6997 key_acqreset(mhp->msg->sadb_msg_seq); 6998 } 6999 m_freem(m); 7000 return (0); 7001 } 7002 7003 /* 7004 * This message is from user land. 7005 */ 7006 7007 /* map satype to proto */ 7008 if ((proto = key_satype2proto(mhp->msg->sadb_msg_satype)) == 0) { 7009 ipseclog((LOG_DEBUG, "%s: invalid satype is passed.\n", 7010 __func__)); 7011 return key_senderror(so, m, EINVAL); 7012 } 7013 7014 if (SADB_CHECKHDR(mhp, SADB_EXT_ADDRESS_SRC) || 7015 SADB_CHECKHDR(mhp, SADB_EXT_ADDRESS_DST) || 7016 SADB_CHECKHDR(mhp, SADB_EXT_PROPOSAL)) { 7017 ipseclog((LOG_DEBUG, 7018 "%s: invalid message: missing required header.\n", 7019 __func__)); 7020 return key_senderror(so, m, EINVAL); 7021 } 7022 if (SADB_CHECKLEN(mhp, SADB_EXT_ADDRESS_SRC) || 7023 SADB_CHECKLEN(mhp, SADB_EXT_ADDRESS_DST) || 7024 SADB_CHECKLEN(mhp, SADB_EXT_PROPOSAL)) { 7025 ipseclog((LOG_DEBUG, 7026 "%s: invalid message: wrong header size.\n", __func__)); 7027 return key_senderror(so, m, EINVAL); 7028 } 7029 7030 if (SADB_CHECKHDR(mhp, SADB_X_EXT_SA2)) { 7031 mode = IPSEC_MODE_ANY; 7032 reqid = 0; 7033 } else { 7034 if (SADB_CHECKLEN(mhp, SADB_X_EXT_SA2)) { 7035 ipseclog((LOG_DEBUG, 7036 "%s: invalid message: wrong header size.\n", 7037 __func__)); 7038 return key_senderror(so, m, EINVAL); 7039 } 7040 mode = ((struct sadb_x_sa2 *) 7041 mhp->ext[SADB_X_EXT_SA2])->sadb_x_sa2_mode; 7042 reqid = ((struct sadb_x_sa2 *) 7043 mhp->ext[SADB_X_EXT_SA2])->sadb_x_sa2_reqid; 7044 } 7045 7046 src0 = (struct sadb_address *)mhp->ext[SADB_EXT_ADDRESS_SRC]; 7047 dst0 = (struct sadb_address *)mhp->ext[SADB_EXT_ADDRESS_DST]; 7048 7049 error = key_checksockaddrs((struct sockaddr *)(src0 + 1), 7050 (struct sockaddr *)(dst0 + 1)); 7051 if (error != 0) { 7052 ipseclog((LOG_DEBUG, "%s: invalid sockaddr.\n", __func__)); 7053 return key_senderror(so, m, EINVAL); 7054 } 7055 KEY_SETSECASIDX(proto, mode, reqid, src0 + 1, dst0 + 1, &saidx); 7056 7057 /* get a SA index */ 7058 SAHTREE_RLOCK(); 7059 LIST_FOREACH(sah, SAHADDRHASH_HASH(&saidx), addrhash) { 7060 if (key_cmpsaidx(&sah->saidx, &saidx, CMP_MODE_REQID)) 7061 break; 7062 } 7063 SAHTREE_RUNLOCK(); 7064 if (sah != NULL) { 7065 ipseclog((LOG_DEBUG, "%s: a SA exists already.\n", __func__)); 7066 return key_senderror(so, m, EEXIST); 7067 } 7068 7069 error = key_acquire(&saidx, NULL); 7070 if (error != 0) { 7071 ipseclog((LOG_DEBUG, 7072 "%s: error %d returned from key_acquire()\n", 7073 __func__, error)); 7074 return key_senderror(so, m, error); 7075 } 7076 m_freem(m); 7077 return (0); 7078 } 7079 7080 /* 7081 * SADB_REGISTER processing. 7082 * If SATYPE_UNSPEC has been passed as satype, only return sabd_supported. 7083 * receive 7084 * <base> 7085 * from the ikmpd, and register a socket to send PF_KEY messages, 7086 * and send 7087 * <base, supported> 7088 * to KMD by PF_KEY. 7089 * If socket is detached, must free from regnode. 7090 * 7091 * m will always be freed. 7092 */ 7093 static int 7094 key_register(struct socket *so, struct mbuf *m, const struct sadb_msghdr *mhp) 7095 { 7096 struct secreg *reg, *newreg = NULL; 7097 7098 IPSEC_ASSERT(so != NULL, ("null socket")); 7099 IPSEC_ASSERT(m != NULL, ("null mbuf")); 7100 IPSEC_ASSERT(mhp != NULL, ("null msghdr")); 7101 IPSEC_ASSERT(mhp->msg != NULL, ("null msg")); 7102 7103 /* check for invalid register message */ 7104 if (mhp->msg->sadb_msg_satype >= sizeof(V_regtree)/sizeof(V_regtree[0])) 7105 return key_senderror(so, m, EINVAL); 7106 7107 /* When SATYPE_UNSPEC is specified, only return sabd_supported. */ 7108 if (mhp->msg->sadb_msg_satype == SADB_SATYPE_UNSPEC) 7109 goto setmsg; 7110 7111 /* check whether existing or not */ 7112 REGTREE_LOCK(); 7113 LIST_FOREACH(reg, &V_regtree[mhp->msg->sadb_msg_satype], chain) { 7114 if (reg->so == so) { 7115 REGTREE_UNLOCK(); 7116 ipseclog((LOG_DEBUG, "%s: socket exists already.\n", 7117 __func__)); 7118 return key_senderror(so, m, EEXIST); 7119 } 7120 } 7121 7122 /* create regnode */ 7123 newreg = malloc(sizeof(struct secreg), M_IPSEC_SAR, M_NOWAIT|M_ZERO); 7124 if (newreg == NULL) { 7125 REGTREE_UNLOCK(); 7126 ipseclog((LOG_DEBUG, "%s: No more memory.\n", __func__)); 7127 return key_senderror(so, m, ENOBUFS); 7128 } 7129 7130 newreg->so = so; 7131 ((struct keycb *)sotorawcb(so))->kp_registered++; 7132 7133 /* add regnode to regtree. */ 7134 LIST_INSERT_HEAD(&V_regtree[mhp->msg->sadb_msg_satype], newreg, chain); 7135 REGTREE_UNLOCK(); 7136 7137 setmsg: 7138 { 7139 struct mbuf *n; 7140 struct sadb_msg *newmsg; 7141 struct sadb_supported *sup; 7142 u_int len, alen, elen; 7143 int off; 7144 int i; 7145 struct sadb_alg *alg; 7146 7147 /* create new sadb_msg to reply. */ 7148 alen = 0; 7149 for (i = 1; i <= SADB_AALG_MAX; i++) { 7150 if (auth_algorithm_lookup(i)) 7151 alen += sizeof(struct sadb_alg); 7152 } 7153 if (alen) 7154 alen += sizeof(struct sadb_supported); 7155 elen = 0; 7156 for (i = 1; i <= SADB_EALG_MAX; i++) { 7157 if (enc_algorithm_lookup(i)) 7158 elen += sizeof(struct sadb_alg); 7159 } 7160 if (elen) 7161 elen += sizeof(struct sadb_supported); 7162 7163 len = sizeof(struct sadb_msg) + alen + elen; 7164 7165 if (len > MCLBYTES) 7166 return key_senderror(so, m, ENOBUFS); 7167 7168 MGETHDR(n, M_NOWAIT, MT_DATA); 7169 if (n != NULL && len > MHLEN) { 7170 if (!(MCLGET(n, M_NOWAIT))) { 7171 m_freem(n); 7172 n = NULL; 7173 } 7174 } 7175 if (!n) 7176 return key_senderror(so, m, ENOBUFS); 7177 7178 n->m_pkthdr.len = n->m_len = len; 7179 n->m_next = NULL; 7180 off = 0; 7181 7182 m_copydata(m, 0, sizeof(struct sadb_msg), mtod(n, caddr_t) + off); 7183 newmsg = mtod(n, struct sadb_msg *); 7184 newmsg->sadb_msg_errno = 0; 7185 newmsg->sadb_msg_len = PFKEY_UNIT64(len); 7186 off += PFKEY_ALIGN8(sizeof(struct sadb_msg)); 7187 7188 /* for authentication algorithm */ 7189 if (alen) { 7190 sup = (struct sadb_supported *)(mtod(n, caddr_t) + off); 7191 sup->sadb_supported_len = PFKEY_UNIT64(alen); 7192 sup->sadb_supported_exttype = SADB_EXT_SUPPORTED_AUTH; 7193 off += PFKEY_ALIGN8(sizeof(*sup)); 7194 7195 for (i = 1; i <= SADB_AALG_MAX; i++) { 7196 const struct auth_hash *aalgo; 7197 u_int16_t minkeysize, maxkeysize; 7198 7199 aalgo = auth_algorithm_lookup(i); 7200 if (!aalgo) 7201 continue; 7202 alg = (struct sadb_alg *)(mtod(n, caddr_t) + off); 7203 alg->sadb_alg_id = i; 7204 alg->sadb_alg_ivlen = 0; 7205 key_getsizes_ah(aalgo, i, &minkeysize, &maxkeysize); 7206 alg->sadb_alg_minbits = _BITS(minkeysize); 7207 alg->sadb_alg_maxbits = _BITS(maxkeysize); 7208 off += PFKEY_ALIGN8(sizeof(*alg)); 7209 } 7210 } 7211 7212 /* for encryption algorithm */ 7213 if (elen) { 7214 sup = (struct sadb_supported *)(mtod(n, caddr_t) + off); 7215 sup->sadb_supported_len = PFKEY_UNIT64(elen); 7216 sup->sadb_supported_exttype = SADB_EXT_SUPPORTED_ENCRYPT; 7217 off += PFKEY_ALIGN8(sizeof(*sup)); 7218 7219 for (i = 1; i <= SADB_EALG_MAX; i++) { 7220 const struct enc_xform *ealgo; 7221 7222 ealgo = enc_algorithm_lookup(i); 7223 if (!ealgo) 7224 continue; 7225 alg = (struct sadb_alg *)(mtod(n, caddr_t) + off); 7226 alg->sadb_alg_id = i; 7227 alg->sadb_alg_ivlen = ealgo->ivsize; 7228 alg->sadb_alg_minbits = _BITS(ealgo->minkey); 7229 alg->sadb_alg_maxbits = _BITS(ealgo->maxkey); 7230 off += PFKEY_ALIGN8(sizeof(struct sadb_alg)); 7231 } 7232 } 7233 7234 IPSEC_ASSERT(off == len, 7235 ("length assumption failed (off %u len %u)", off, len)); 7236 7237 m_freem(m); 7238 return key_sendup_mbuf(so, n, KEY_SENDUP_REGISTERED); 7239 } 7240 } 7241 7242 /* 7243 * free secreg entry registered. 7244 * XXX: I want to do free a socket marked done SADB_RESIGER to socket. 7245 */ 7246 void 7247 key_freereg(struct socket *so) 7248 { 7249 struct secreg *reg; 7250 int i; 7251 7252 IPSEC_ASSERT(so != NULL, ("NULL so")); 7253 7254 /* 7255 * check whether existing or not. 7256 * check all type of SA, because there is a potential that 7257 * one socket is registered to multiple type of SA. 7258 */ 7259 REGTREE_LOCK(); 7260 for (i = 0; i <= SADB_SATYPE_MAX; i++) { 7261 LIST_FOREACH(reg, &V_regtree[i], chain) { 7262 if (reg->so == so && __LIST_CHAINED(reg)) { 7263 LIST_REMOVE(reg, chain); 7264 free(reg, M_IPSEC_SAR); 7265 break; 7266 } 7267 } 7268 } 7269 REGTREE_UNLOCK(); 7270 } 7271 7272 /* 7273 * SADB_EXPIRE processing 7274 * send 7275 * <base, SA, SA2, lifetime(C and one of HS), address(SD)> 7276 * to KMD by PF_KEY. 7277 * NOTE: We send only soft lifetime extension. 7278 * 7279 * OUT: 0 : succeed 7280 * others : error number 7281 */ 7282 static int 7283 key_expire(struct secasvar *sav, int hard) 7284 { 7285 struct mbuf *result = NULL, *m; 7286 struct sadb_lifetime *lt; 7287 uint32_t replay_count; 7288 int error, len; 7289 uint8_t satype; 7290 7291 IPSEC_ASSERT (sav != NULL, ("null sav")); 7292 IPSEC_ASSERT (sav->sah != NULL, ("null sa header")); 7293 7294 KEYDBG(KEY_STAMP, 7295 printf("%s: SA(%p) expired %s lifetime\n", __func__, 7296 sav, hard ? "hard": "soft")); 7297 KEYDBG(KEY_DATA, kdebug_secasv(sav)); 7298 /* set msg header */ 7299 satype = key_proto2satype(sav->sah->saidx.proto); 7300 IPSEC_ASSERT(satype != 0, ("invalid proto, satype %u", satype)); 7301 m = key_setsadbmsg(SADB_EXPIRE, 0, satype, sav->seq, 0, sav->refcnt); 7302 if (!m) { 7303 error = ENOBUFS; 7304 goto fail; 7305 } 7306 result = m; 7307 7308 /* create SA extension */ 7309 m = key_setsadbsa(sav); 7310 if (!m) { 7311 error = ENOBUFS; 7312 goto fail; 7313 } 7314 m_cat(result, m); 7315 7316 /* create SA extension */ 7317 SECASVAR_LOCK(sav); 7318 replay_count = sav->replay ? sav->replay->count : 0; 7319 SECASVAR_UNLOCK(sav); 7320 7321 m = key_setsadbxsa2(sav->sah->saidx.mode, replay_count, 7322 sav->sah->saidx.reqid); 7323 if (!m) { 7324 error = ENOBUFS; 7325 goto fail; 7326 } 7327 m_cat(result, m); 7328 7329 if (sav->replay && sav->replay->wsize > UINT8_MAX) { 7330 m = key_setsadbxsareplay(sav->replay->wsize); 7331 if (!m) { 7332 error = ENOBUFS; 7333 goto fail; 7334 } 7335 m_cat(result, m); 7336 } 7337 7338 /* create lifetime extension (current and soft) */ 7339 len = PFKEY_ALIGN8(sizeof(*lt)) * 2; 7340 m = m_get2(len, M_NOWAIT, MT_DATA, 0); 7341 if (m == NULL) { 7342 error = ENOBUFS; 7343 goto fail; 7344 } 7345 m_align(m, len); 7346 m->m_len = len; 7347 bzero(mtod(m, caddr_t), len); 7348 lt = mtod(m, struct sadb_lifetime *); 7349 lt->sadb_lifetime_len = PFKEY_UNIT64(sizeof(struct sadb_lifetime)); 7350 lt->sadb_lifetime_exttype = SADB_EXT_LIFETIME_CURRENT; 7351 lt->sadb_lifetime_allocations = 7352 (uint32_t)counter_u64_fetch(sav->lft_c_allocations); 7353 lt->sadb_lifetime_bytes = 7354 counter_u64_fetch(sav->lft_c_bytes); 7355 lt->sadb_lifetime_addtime = sav->created; 7356 lt->sadb_lifetime_usetime = sav->firstused; 7357 lt = (struct sadb_lifetime *)(mtod(m, caddr_t) + len / 2); 7358 lt->sadb_lifetime_len = PFKEY_UNIT64(sizeof(struct sadb_lifetime)); 7359 if (hard) { 7360 lt->sadb_lifetime_exttype = SADB_EXT_LIFETIME_HARD; 7361 lt->sadb_lifetime_allocations = sav->lft_h->allocations; 7362 lt->sadb_lifetime_bytes = sav->lft_h->bytes; 7363 lt->sadb_lifetime_addtime = sav->lft_h->addtime; 7364 lt->sadb_lifetime_usetime = sav->lft_h->usetime; 7365 } else { 7366 lt->sadb_lifetime_exttype = SADB_EXT_LIFETIME_SOFT; 7367 lt->sadb_lifetime_allocations = sav->lft_s->allocations; 7368 lt->sadb_lifetime_bytes = sav->lft_s->bytes; 7369 lt->sadb_lifetime_addtime = sav->lft_s->addtime; 7370 lt->sadb_lifetime_usetime = sav->lft_s->usetime; 7371 } 7372 m_cat(result, m); 7373 7374 /* set sadb_address for source */ 7375 m = key_setsadbaddr(SADB_EXT_ADDRESS_SRC, 7376 &sav->sah->saidx.src.sa, 7377 FULLMASK, IPSEC_ULPROTO_ANY); 7378 if (!m) { 7379 error = ENOBUFS; 7380 goto fail; 7381 } 7382 m_cat(result, m); 7383 7384 /* set sadb_address for destination */ 7385 m = key_setsadbaddr(SADB_EXT_ADDRESS_DST, 7386 &sav->sah->saidx.dst.sa, 7387 FULLMASK, IPSEC_ULPROTO_ANY); 7388 if (!m) { 7389 error = ENOBUFS; 7390 goto fail; 7391 } 7392 m_cat(result, m); 7393 7394 /* 7395 * XXX-BZ Handle NAT-T extensions here. 7396 * XXXAE: it doesn't seem quite useful. IKEs should not depend on 7397 * this information, we report only significant SA fields. 7398 */ 7399 7400 if ((result->m_flags & M_PKTHDR) == 0) { 7401 error = EINVAL; 7402 goto fail; 7403 } 7404 7405 if (result->m_len < sizeof(struct sadb_msg)) { 7406 result = m_pullup(result, sizeof(struct sadb_msg)); 7407 if (result == NULL) { 7408 error = ENOBUFS; 7409 goto fail; 7410 } 7411 } 7412 7413 result->m_pkthdr.len = 0; 7414 for (m = result; m; m = m->m_next) 7415 result->m_pkthdr.len += m->m_len; 7416 7417 mtod(result, struct sadb_msg *)->sadb_msg_len = 7418 PFKEY_UNIT64(result->m_pkthdr.len); 7419 7420 return key_sendup_mbuf(NULL, result, KEY_SENDUP_REGISTERED); 7421 7422 fail: 7423 if (result) 7424 m_freem(result); 7425 return error; 7426 } 7427 7428 static void 7429 key_freesah_flushed(struct secashead_queue *flushq) 7430 { 7431 struct secashead *sah, *nextsah; 7432 struct secasvar *sav, *nextsav; 7433 7434 sah = TAILQ_FIRST(flushq); 7435 while (sah != NULL) { 7436 sav = TAILQ_FIRST(&sah->savtree_larval); 7437 while (sav != NULL) { 7438 nextsav = TAILQ_NEXT(sav, chain); 7439 TAILQ_REMOVE(&sah->savtree_larval, sav, chain); 7440 key_freesav(&sav); /* release last reference */ 7441 key_freesah(&sah); /* release reference from SAV */ 7442 sav = nextsav; 7443 } 7444 sav = TAILQ_FIRST(&sah->savtree_alive); 7445 while (sav != NULL) { 7446 nextsav = TAILQ_NEXT(sav, chain); 7447 TAILQ_REMOVE(&sah->savtree_alive, sav, chain); 7448 key_freesav(&sav); /* release last reference */ 7449 key_freesah(&sah); /* release reference from SAV */ 7450 sav = nextsav; 7451 } 7452 nextsah = TAILQ_NEXT(sah, chain); 7453 key_freesah(&sah); /* release last reference */ 7454 sah = nextsah; 7455 } 7456 } 7457 7458 /* 7459 * SADB_FLUSH processing 7460 * receive 7461 * <base> 7462 * from the ikmpd, and free all entries in secastree. 7463 * and send, 7464 * <base> 7465 * to the ikmpd. 7466 * NOTE: to do is only marking SADB_SASTATE_DEAD. 7467 * 7468 * m will always be freed. 7469 */ 7470 static int 7471 key_flush(struct socket *so, struct mbuf *m, const struct sadb_msghdr *mhp) 7472 { 7473 struct secashead_queue flushq; 7474 struct sadb_msg *newmsg; 7475 struct secashead *sah, *nextsah; 7476 struct secasvar *sav; 7477 uint8_t proto; 7478 int i; 7479 7480 IPSEC_ASSERT(so != NULL, ("null socket")); 7481 IPSEC_ASSERT(mhp != NULL, ("null msghdr")); 7482 IPSEC_ASSERT(mhp->msg != NULL, ("null msg")); 7483 7484 /* map satype to proto */ 7485 if ((proto = key_satype2proto(mhp->msg->sadb_msg_satype)) == 0) { 7486 ipseclog((LOG_DEBUG, "%s: invalid satype is passed.\n", 7487 __func__)); 7488 return key_senderror(so, m, EINVAL); 7489 } 7490 KEYDBG(KEY_STAMP, 7491 printf("%s: proto %u\n", __func__, proto)); 7492 7493 TAILQ_INIT(&flushq); 7494 if (proto == IPSEC_PROTO_ANY) { 7495 /* no SATYPE specified, i.e. flushing all SA. */ 7496 SAHTREE_WLOCK(); 7497 /* Move all SAHs into flushq */ 7498 TAILQ_CONCAT(&flushq, &V_sahtree, chain); 7499 /* Flush all buckets in SPI hash */ 7500 for (i = 0; i < V_savhash_mask + 1; i++) 7501 LIST_INIT(&V_savhashtbl[i]); 7502 /* Flush all buckets in SAHADDRHASH */ 7503 for (i = 0; i < V_sahaddrhash_mask + 1; i++) 7504 LIST_INIT(&V_sahaddrhashtbl[i]); 7505 /* Mark all SAHs as unlinked */ 7506 TAILQ_FOREACH(sah, &flushq, chain) { 7507 sah->state = SADB_SASTATE_DEAD; 7508 /* 7509 * Callout handler makes its job using 7510 * RLOCK and drain queues. In case, when this 7511 * function will be called just before it 7512 * acquires WLOCK, we need to mark SAs as 7513 * unlinked to prevent second unlink. 7514 */ 7515 TAILQ_FOREACH(sav, &sah->savtree_larval, chain) { 7516 sav->state = SADB_SASTATE_DEAD; 7517 } 7518 TAILQ_FOREACH(sav, &sah->savtree_alive, chain) { 7519 sav->state = SADB_SASTATE_DEAD; 7520 } 7521 } 7522 SAHTREE_WUNLOCK(); 7523 } else { 7524 SAHTREE_WLOCK(); 7525 sah = TAILQ_FIRST(&V_sahtree); 7526 while (sah != NULL) { 7527 IPSEC_ASSERT(sah->state != SADB_SASTATE_DEAD, 7528 ("DEAD SAH %p in SADB_FLUSH", sah)); 7529 nextsah = TAILQ_NEXT(sah, chain); 7530 if (sah->saidx.proto != proto) { 7531 sah = nextsah; 7532 continue; 7533 } 7534 sah->state = SADB_SASTATE_DEAD; 7535 TAILQ_REMOVE(&V_sahtree, sah, chain); 7536 LIST_REMOVE(sah, addrhash); 7537 /* Unlink all SAs from SPI hash */ 7538 TAILQ_FOREACH(sav, &sah->savtree_larval, chain) { 7539 LIST_REMOVE(sav, spihash); 7540 sav->state = SADB_SASTATE_DEAD; 7541 } 7542 TAILQ_FOREACH(sav, &sah->savtree_alive, chain) { 7543 LIST_REMOVE(sav, spihash); 7544 sav->state = SADB_SASTATE_DEAD; 7545 } 7546 /* Add SAH into flushq */ 7547 TAILQ_INSERT_HEAD(&flushq, sah, chain); 7548 sah = nextsah; 7549 } 7550 SAHTREE_WUNLOCK(); 7551 } 7552 7553 key_freesah_flushed(&flushq); 7554 /* Free all queued SAs and SAHs */ 7555 if (m->m_len < sizeof(struct sadb_msg) || 7556 sizeof(struct sadb_msg) > m->m_len + M_TRAILINGSPACE(m)) { 7557 ipseclog((LOG_DEBUG, "%s: No more memory.\n", __func__)); 7558 return key_senderror(so, m, ENOBUFS); 7559 } 7560 7561 if (m->m_next) 7562 m_freem(m->m_next); 7563 m->m_next = NULL; 7564 m->m_pkthdr.len = m->m_len = sizeof(struct sadb_msg); 7565 newmsg = mtod(m, struct sadb_msg *); 7566 newmsg->sadb_msg_errno = 0; 7567 newmsg->sadb_msg_len = PFKEY_UNIT64(m->m_pkthdr.len); 7568 7569 return key_sendup_mbuf(so, m, KEY_SENDUP_ALL); 7570 } 7571 7572 /* 7573 * SADB_DUMP processing 7574 * dump all entries including status of DEAD in SAD. 7575 * receive 7576 * <base> 7577 * from the ikmpd, and dump all secasvar leaves 7578 * and send, 7579 * <base> ..... 7580 * to the ikmpd. 7581 * 7582 * m will always be freed. 7583 */ 7584 static int 7585 key_dump(struct socket *so, struct mbuf *m, const struct sadb_msghdr *mhp) 7586 { 7587 SAHTREE_RLOCK_TRACKER; 7588 struct secashead *sah; 7589 struct secasvar *sav; 7590 struct mbuf *n; 7591 uint32_t cnt; 7592 uint8_t proto, satype; 7593 7594 IPSEC_ASSERT(so != NULL, ("null socket")); 7595 IPSEC_ASSERT(m != NULL, ("null mbuf")); 7596 IPSEC_ASSERT(mhp != NULL, ("null msghdr")); 7597 IPSEC_ASSERT(mhp->msg != NULL, ("null msg")); 7598 7599 /* map satype to proto */ 7600 if ((proto = key_satype2proto(mhp->msg->sadb_msg_satype)) == 0) { 7601 ipseclog((LOG_DEBUG, "%s: invalid satype is passed.\n", 7602 __func__)); 7603 return key_senderror(so, m, EINVAL); 7604 } 7605 7606 /* count sav entries to be sent to the userland. */ 7607 cnt = 0; 7608 SAHTREE_RLOCK(); 7609 TAILQ_FOREACH(sah, &V_sahtree, chain) { 7610 if (mhp->msg->sadb_msg_satype != SADB_SATYPE_UNSPEC && 7611 proto != sah->saidx.proto) 7612 continue; 7613 7614 TAILQ_FOREACH(sav, &sah->savtree_larval, chain) 7615 cnt++; 7616 TAILQ_FOREACH(sav, &sah->savtree_alive, chain) 7617 cnt++; 7618 } 7619 7620 if (cnt == 0) { 7621 SAHTREE_RUNLOCK(); 7622 return key_senderror(so, m, ENOENT); 7623 } 7624 7625 /* send this to the userland, one at a time. */ 7626 TAILQ_FOREACH(sah, &V_sahtree, chain) { 7627 if (mhp->msg->sadb_msg_satype != SADB_SATYPE_UNSPEC && 7628 proto != sah->saidx.proto) 7629 continue; 7630 7631 /* map proto to satype */ 7632 if ((satype = key_proto2satype(sah->saidx.proto)) == 0) { 7633 SAHTREE_RUNLOCK(); 7634 ipseclog((LOG_DEBUG, "%s: there was invalid proto in " 7635 "SAD.\n", __func__)); 7636 return key_senderror(so, m, EINVAL); 7637 } 7638 TAILQ_FOREACH(sav, &sah->savtree_larval, chain) { 7639 n = key_setdumpsa(sav, SADB_DUMP, satype, 7640 --cnt, mhp->msg->sadb_msg_pid); 7641 if (n == NULL) { 7642 SAHTREE_RUNLOCK(); 7643 return key_senderror(so, m, ENOBUFS); 7644 } 7645 key_sendup_mbuf(so, n, KEY_SENDUP_ONE); 7646 } 7647 TAILQ_FOREACH(sav, &sah->savtree_alive, chain) { 7648 n = key_setdumpsa(sav, SADB_DUMP, satype, 7649 --cnt, mhp->msg->sadb_msg_pid); 7650 if (n == NULL) { 7651 SAHTREE_RUNLOCK(); 7652 return key_senderror(so, m, ENOBUFS); 7653 } 7654 key_sendup_mbuf(so, n, KEY_SENDUP_ONE); 7655 } 7656 } 7657 SAHTREE_RUNLOCK(); 7658 m_freem(m); 7659 return (0); 7660 } 7661 /* 7662 * SADB_X_PROMISC processing 7663 * 7664 * m will always be freed. 7665 */ 7666 static int 7667 key_promisc(struct socket *so, struct mbuf *m, const struct sadb_msghdr *mhp) 7668 { 7669 int olen; 7670 7671 IPSEC_ASSERT(so != NULL, ("null socket")); 7672 IPSEC_ASSERT(m != NULL, ("null mbuf")); 7673 IPSEC_ASSERT(mhp != NULL, ("null msghdr")); 7674 IPSEC_ASSERT(mhp->msg != NULL, ("null msg")); 7675 7676 olen = PFKEY_UNUNIT64(mhp->msg->sadb_msg_len); 7677 7678 if (olen < sizeof(struct sadb_msg)) { 7679 #if 1 7680 return key_senderror(so, m, EINVAL); 7681 #else 7682 m_freem(m); 7683 return 0; 7684 #endif 7685 } else if (olen == sizeof(struct sadb_msg)) { 7686 /* enable/disable promisc mode */ 7687 struct keycb *kp; 7688 7689 if ((kp = (struct keycb *)sotorawcb(so)) == NULL) 7690 return key_senderror(so, m, EINVAL); 7691 mhp->msg->sadb_msg_errno = 0; 7692 switch (mhp->msg->sadb_msg_satype) { 7693 case 0: 7694 case 1: 7695 kp->kp_promisc = mhp->msg->sadb_msg_satype; 7696 break; 7697 default: 7698 return key_senderror(so, m, EINVAL); 7699 } 7700 7701 /* send the original message back to everyone */ 7702 mhp->msg->sadb_msg_errno = 0; 7703 return key_sendup_mbuf(so, m, KEY_SENDUP_ALL); 7704 } else { 7705 /* send packet as is */ 7706 7707 m_adj(m, PFKEY_ALIGN8(sizeof(struct sadb_msg))); 7708 7709 /* TODO: if sadb_msg_seq is specified, send to specific pid */ 7710 return key_sendup_mbuf(so, m, KEY_SENDUP_ALL); 7711 } 7712 } 7713 7714 static int (*key_typesw[])(struct socket *, struct mbuf *, 7715 const struct sadb_msghdr *) = { 7716 NULL, /* SADB_RESERVED */ 7717 key_getspi, /* SADB_GETSPI */ 7718 key_update, /* SADB_UPDATE */ 7719 key_add, /* SADB_ADD */ 7720 key_delete, /* SADB_DELETE */ 7721 key_get, /* SADB_GET */ 7722 key_acquire2, /* SADB_ACQUIRE */ 7723 key_register, /* SADB_REGISTER */ 7724 NULL, /* SADB_EXPIRE */ 7725 key_flush, /* SADB_FLUSH */ 7726 key_dump, /* SADB_DUMP */ 7727 key_promisc, /* SADB_X_PROMISC */ 7728 NULL, /* SADB_X_PCHANGE */ 7729 key_spdadd, /* SADB_X_SPDUPDATE */ 7730 key_spdadd, /* SADB_X_SPDADD */ 7731 key_spddelete, /* SADB_X_SPDDELETE */ 7732 key_spdget, /* SADB_X_SPDGET */ 7733 NULL, /* SADB_X_SPDACQUIRE */ 7734 key_spddump, /* SADB_X_SPDDUMP */ 7735 key_spdflush, /* SADB_X_SPDFLUSH */ 7736 key_spdadd, /* SADB_X_SPDSETIDX */ 7737 NULL, /* SADB_X_SPDEXPIRE */ 7738 key_spddelete2, /* SADB_X_SPDDELETE2 */ 7739 }; 7740 7741 /* 7742 * parse sadb_msg buffer to process PFKEYv2, 7743 * and create a data to response if needed. 7744 * I think to be dealed with mbuf directly. 7745 * IN: 7746 * msgp : pointer to pointer to a received buffer pulluped. 7747 * This is rewrited to response. 7748 * so : pointer to socket. 7749 * OUT: 7750 * length for buffer to send to user process. 7751 */ 7752 int 7753 key_parse(struct mbuf *m, struct socket *so) 7754 { 7755 struct sadb_msg *msg; 7756 struct sadb_msghdr mh; 7757 u_int orglen; 7758 int error; 7759 int target; 7760 7761 IPSEC_ASSERT(so != NULL, ("null socket")); 7762 IPSEC_ASSERT(m != NULL, ("null mbuf")); 7763 7764 if (m->m_len < sizeof(struct sadb_msg)) { 7765 m = m_pullup(m, sizeof(struct sadb_msg)); 7766 if (!m) 7767 return ENOBUFS; 7768 } 7769 msg = mtod(m, struct sadb_msg *); 7770 orglen = PFKEY_UNUNIT64(msg->sadb_msg_len); 7771 target = KEY_SENDUP_ONE; 7772 7773 if ((m->m_flags & M_PKTHDR) == 0 || m->m_pkthdr.len != orglen) { 7774 ipseclog((LOG_DEBUG, "%s: invalid message length.\n",__func__)); 7775 PFKEYSTAT_INC(out_invlen); 7776 error = EINVAL; 7777 goto senderror; 7778 } 7779 7780 if (msg->sadb_msg_version != PF_KEY_V2) { 7781 ipseclog((LOG_DEBUG, "%s: PF_KEY version %u is mismatched.\n", 7782 __func__, msg->sadb_msg_version)); 7783 PFKEYSTAT_INC(out_invver); 7784 error = EINVAL; 7785 goto senderror; 7786 } 7787 7788 if (msg->sadb_msg_type > SADB_MAX) { 7789 ipseclog((LOG_DEBUG, "%s: invalid type %u is passed.\n", 7790 __func__, msg->sadb_msg_type)); 7791 PFKEYSTAT_INC(out_invmsgtype); 7792 error = EINVAL; 7793 goto senderror; 7794 } 7795 7796 /* for old-fashioned code - should be nuked */ 7797 if (m->m_pkthdr.len > MCLBYTES) { 7798 m_freem(m); 7799 return ENOBUFS; 7800 } 7801 if (m->m_next) { 7802 struct mbuf *n; 7803 7804 MGETHDR(n, M_NOWAIT, MT_DATA); 7805 if (n && m->m_pkthdr.len > MHLEN) { 7806 if (!(MCLGET(n, M_NOWAIT))) { 7807 m_free(n); 7808 n = NULL; 7809 } 7810 } 7811 if (!n) { 7812 m_freem(m); 7813 return ENOBUFS; 7814 } 7815 m_copydata(m, 0, m->m_pkthdr.len, mtod(n, caddr_t)); 7816 n->m_pkthdr.len = n->m_len = m->m_pkthdr.len; 7817 n->m_next = NULL; 7818 m_freem(m); 7819 m = n; 7820 } 7821 7822 /* align the mbuf chain so that extensions are in contiguous region. */ 7823 error = key_align(m, &mh); 7824 if (error) 7825 return error; 7826 7827 msg = mh.msg; 7828 7829 /* We use satype as scope mask for spddump */ 7830 if (msg->sadb_msg_type == SADB_X_SPDDUMP) { 7831 switch (msg->sadb_msg_satype) { 7832 case IPSEC_POLICYSCOPE_ANY: 7833 case IPSEC_POLICYSCOPE_GLOBAL: 7834 case IPSEC_POLICYSCOPE_IFNET: 7835 case IPSEC_POLICYSCOPE_PCB: 7836 break; 7837 default: 7838 ipseclog((LOG_DEBUG, "%s: illegal satype=%u\n", 7839 __func__, msg->sadb_msg_type)); 7840 PFKEYSTAT_INC(out_invsatype); 7841 error = EINVAL; 7842 goto senderror; 7843 } 7844 } else { 7845 switch (msg->sadb_msg_satype) { /* check SA type */ 7846 case SADB_SATYPE_UNSPEC: 7847 switch (msg->sadb_msg_type) { 7848 case SADB_GETSPI: 7849 case SADB_UPDATE: 7850 case SADB_ADD: 7851 case SADB_DELETE: 7852 case SADB_GET: 7853 case SADB_ACQUIRE: 7854 case SADB_EXPIRE: 7855 ipseclog((LOG_DEBUG, "%s: must specify satype " 7856 "when msg type=%u.\n", __func__, 7857 msg->sadb_msg_type)); 7858 PFKEYSTAT_INC(out_invsatype); 7859 error = EINVAL; 7860 goto senderror; 7861 } 7862 break; 7863 case SADB_SATYPE_AH: 7864 case SADB_SATYPE_ESP: 7865 case SADB_X_SATYPE_IPCOMP: 7866 case SADB_X_SATYPE_TCPSIGNATURE: 7867 switch (msg->sadb_msg_type) { 7868 case SADB_X_SPDADD: 7869 case SADB_X_SPDDELETE: 7870 case SADB_X_SPDGET: 7871 case SADB_X_SPDFLUSH: 7872 case SADB_X_SPDSETIDX: 7873 case SADB_X_SPDUPDATE: 7874 case SADB_X_SPDDELETE2: 7875 ipseclog((LOG_DEBUG, "%s: illegal satype=%u\n", 7876 __func__, msg->sadb_msg_type)); 7877 PFKEYSTAT_INC(out_invsatype); 7878 error = EINVAL; 7879 goto senderror; 7880 } 7881 break; 7882 case SADB_SATYPE_RSVP: 7883 case SADB_SATYPE_OSPFV2: 7884 case SADB_SATYPE_RIPV2: 7885 case SADB_SATYPE_MIP: 7886 ipseclog((LOG_DEBUG, "%s: type %u isn't supported.\n", 7887 __func__, msg->sadb_msg_satype)); 7888 PFKEYSTAT_INC(out_invsatype); 7889 error = EOPNOTSUPP; 7890 goto senderror; 7891 case 1: /* XXX: What does it do? */ 7892 if (msg->sadb_msg_type == SADB_X_PROMISC) 7893 break; 7894 /*FALLTHROUGH*/ 7895 default: 7896 ipseclog((LOG_DEBUG, "%s: invalid type %u is passed.\n", 7897 __func__, msg->sadb_msg_satype)); 7898 PFKEYSTAT_INC(out_invsatype); 7899 error = EINVAL; 7900 goto senderror; 7901 } 7902 } 7903 7904 /* check field of upper layer protocol and address family */ 7905 if (mh.ext[SADB_EXT_ADDRESS_SRC] != NULL 7906 && mh.ext[SADB_EXT_ADDRESS_DST] != NULL) { 7907 struct sadb_address *src0, *dst0; 7908 u_int plen; 7909 7910 src0 = (struct sadb_address *)(mh.ext[SADB_EXT_ADDRESS_SRC]); 7911 dst0 = (struct sadb_address *)(mh.ext[SADB_EXT_ADDRESS_DST]); 7912 7913 /* check upper layer protocol */ 7914 if (src0->sadb_address_proto != dst0->sadb_address_proto) { 7915 ipseclog((LOG_DEBUG, "%s: upper layer protocol " 7916 "mismatched.\n", __func__)); 7917 PFKEYSTAT_INC(out_invaddr); 7918 error = EINVAL; 7919 goto senderror; 7920 } 7921 7922 /* check family */ 7923 if (PFKEY_ADDR_SADDR(src0)->sa_family != 7924 PFKEY_ADDR_SADDR(dst0)->sa_family) { 7925 ipseclog((LOG_DEBUG, "%s: address family mismatched.\n", 7926 __func__)); 7927 PFKEYSTAT_INC(out_invaddr); 7928 error = EINVAL; 7929 goto senderror; 7930 } 7931 if (PFKEY_ADDR_SADDR(src0)->sa_len != 7932 PFKEY_ADDR_SADDR(dst0)->sa_len) { 7933 ipseclog((LOG_DEBUG, "%s: address struct size " 7934 "mismatched.\n", __func__)); 7935 PFKEYSTAT_INC(out_invaddr); 7936 error = EINVAL; 7937 goto senderror; 7938 } 7939 7940 switch (PFKEY_ADDR_SADDR(src0)->sa_family) { 7941 case AF_INET: 7942 if (PFKEY_ADDR_SADDR(src0)->sa_len != 7943 sizeof(struct sockaddr_in)) { 7944 PFKEYSTAT_INC(out_invaddr); 7945 error = EINVAL; 7946 goto senderror; 7947 } 7948 break; 7949 case AF_INET6: 7950 if (PFKEY_ADDR_SADDR(src0)->sa_len != 7951 sizeof(struct sockaddr_in6)) { 7952 PFKEYSTAT_INC(out_invaddr); 7953 error = EINVAL; 7954 goto senderror; 7955 } 7956 break; 7957 default: 7958 ipseclog((LOG_DEBUG, "%s: unsupported address family\n", 7959 __func__)); 7960 PFKEYSTAT_INC(out_invaddr); 7961 error = EAFNOSUPPORT; 7962 goto senderror; 7963 } 7964 7965 switch (PFKEY_ADDR_SADDR(src0)->sa_family) { 7966 case AF_INET: 7967 plen = sizeof(struct in_addr) << 3; 7968 break; 7969 case AF_INET6: 7970 plen = sizeof(struct in6_addr) << 3; 7971 break; 7972 default: 7973 plen = 0; /*fool gcc*/ 7974 break; 7975 } 7976 7977 /* check max prefix length */ 7978 if (src0->sadb_address_prefixlen > plen || 7979 dst0->sadb_address_prefixlen > plen) { 7980 ipseclog((LOG_DEBUG, "%s: illegal prefixlen.\n", 7981 __func__)); 7982 PFKEYSTAT_INC(out_invaddr); 7983 error = EINVAL; 7984 goto senderror; 7985 } 7986 7987 /* 7988 * prefixlen == 0 is valid because there can be a case when 7989 * all addresses are matched. 7990 */ 7991 } 7992 7993 if (msg->sadb_msg_type >= nitems(key_typesw) || 7994 key_typesw[msg->sadb_msg_type] == NULL) { 7995 PFKEYSTAT_INC(out_invmsgtype); 7996 error = EINVAL; 7997 goto senderror; 7998 } 7999 8000 return (*key_typesw[msg->sadb_msg_type])(so, m, &mh); 8001 8002 senderror: 8003 msg->sadb_msg_errno = error; 8004 return key_sendup_mbuf(so, m, target); 8005 } 8006 8007 static int 8008 key_senderror(struct socket *so, struct mbuf *m, int code) 8009 { 8010 struct sadb_msg *msg; 8011 8012 IPSEC_ASSERT(m->m_len >= sizeof(struct sadb_msg), 8013 ("mbuf too small, len %u", m->m_len)); 8014 8015 msg = mtod(m, struct sadb_msg *); 8016 msg->sadb_msg_errno = code; 8017 return key_sendup_mbuf(so, m, KEY_SENDUP_ONE); 8018 } 8019 8020 /* 8021 * set the pointer to each header into message buffer. 8022 * m will be freed on error. 8023 * XXX larger-than-MCLBYTES extension? 8024 */ 8025 static int 8026 key_align(struct mbuf *m, struct sadb_msghdr *mhp) 8027 { 8028 struct mbuf *n; 8029 struct sadb_ext *ext; 8030 size_t off, end; 8031 int extlen; 8032 int toff; 8033 8034 IPSEC_ASSERT(m != NULL, ("null mbuf")); 8035 IPSEC_ASSERT(mhp != NULL, ("null msghdr")); 8036 IPSEC_ASSERT(m->m_len >= sizeof(struct sadb_msg), 8037 ("mbuf too small, len %u", m->m_len)); 8038 8039 /* initialize */ 8040 bzero(mhp, sizeof(*mhp)); 8041 8042 mhp->msg = mtod(m, struct sadb_msg *); 8043 mhp->ext[0] = (struct sadb_ext *)mhp->msg; /*XXX backward compat */ 8044 8045 end = PFKEY_UNUNIT64(mhp->msg->sadb_msg_len); 8046 extlen = end; /*just in case extlen is not updated*/ 8047 for (off = sizeof(struct sadb_msg); off < end; off += extlen) { 8048 n = m_pulldown(m, off, sizeof(struct sadb_ext), &toff); 8049 if (!n) { 8050 /* m is already freed */ 8051 return ENOBUFS; 8052 } 8053 ext = (struct sadb_ext *)(mtod(n, caddr_t) + toff); 8054 8055 /* set pointer */ 8056 switch (ext->sadb_ext_type) { 8057 case SADB_EXT_SA: 8058 case SADB_EXT_ADDRESS_SRC: 8059 case SADB_EXT_ADDRESS_DST: 8060 case SADB_EXT_ADDRESS_PROXY: 8061 case SADB_EXT_LIFETIME_CURRENT: 8062 case SADB_EXT_LIFETIME_HARD: 8063 case SADB_EXT_LIFETIME_SOFT: 8064 case SADB_EXT_KEY_AUTH: 8065 case SADB_EXT_KEY_ENCRYPT: 8066 case SADB_EXT_IDENTITY_SRC: 8067 case SADB_EXT_IDENTITY_DST: 8068 case SADB_EXT_SENSITIVITY: 8069 case SADB_EXT_PROPOSAL: 8070 case SADB_EXT_SUPPORTED_AUTH: 8071 case SADB_EXT_SUPPORTED_ENCRYPT: 8072 case SADB_EXT_SPIRANGE: 8073 case SADB_X_EXT_POLICY: 8074 case SADB_X_EXT_SA2: 8075 case SADB_X_EXT_NAT_T_TYPE: 8076 case SADB_X_EXT_NAT_T_SPORT: 8077 case SADB_X_EXT_NAT_T_DPORT: 8078 case SADB_X_EXT_NAT_T_OAI: 8079 case SADB_X_EXT_NAT_T_OAR: 8080 case SADB_X_EXT_NAT_T_FRAG: 8081 case SADB_X_EXT_SA_REPLAY: 8082 case SADB_X_EXT_NEW_ADDRESS_SRC: 8083 case SADB_X_EXT_NEW_ADDRESS_DST: 8084 /* duplicate check */ 8085 /* 8086 * XXX Are there duplication payloads of either 8087 * KEY_AUTH or KEY_ENCRYPT ? 8088 */ 8089 if (mhp->ext[ext->sadb_ext_type] != NULL) { 8090 ipseclog((LOG_DEBUG, "%s: duplicate ext_type " 8091 "%u\n", __func__, ext->sadb_ext_type)); 8092 m_freem(m); 8093 PFKEYSTAT_INC(out_dupext); 8094 return EINVAL; 8095 } 8096 break; 8097 default: 8098 ipseclog((LOG_DEBUG, "%s: invalid ext_type %u\n", 8099 __func__, ext->sadb_ext_type)); 8100 m_freem(m); 8101 PFKEYSTAT_INC(out_invexttype); 8102 return EINVAL; 8103 } 8104 8105 extlen = PFKEY_UNUNIT64(ext->sadb_ext_len); 8106 8107 if (key_validate_ext(ext, extlen)) { 8108 m_freem(m); 8109 PFKEYSTAT_INC(out_invlen); 8110 return EINVAL; 8111 } 8112 8113 n = m_pulldown(m, off, extlen, &toff); 8114 if (!n) { 8115 /* m is already freed */ 8116 return ENOBUFS; 8117 } 8118 ext = (struct sadb_ext *)(mtod(n, caddr_t) + toff); 8119 8120 mhp->ext[ext->sadb_ext_type] = ext; 8121 mhp->extoff[ext->sadb_ext_type] = off; 8122 mhp->extlen[ext->sadb_ext_type] = extlen; 8123 } 8124 8125 if (off != end) { 8126 m_freem(m); 8127 PFKEYSTAT_INC(out_invlen); 8128 return EINVAL; 8129 } 8130 8131 return 0; 8132 } 8133 8134 static int 8135 key_validate_ext(const struct sadb_ext *ext, int len) 8136 { 8137 const struct sockaddr *sa; 8138 enum { NONE, ADDR } checktype = NONE; 8139 int baselen = 0; 8140 const int sal = offsetof(struct sockaddr, sa_len) + sizeof(sa->sa_len); 8141 8142 if (len != PFKEY_UNUNIT64(ext->sadb_ext_len)) 8143 return EINVAL; 8144 8145 /* if it does not match minimum/maximum length, bail */ 8146 if (ext->sadb_ext_type >= nitems(minsize) || 8147 ext->sadb_ext_type >= nitems(maxsize)) 8148 return EINVAL; 8149 if (!minsize[ext->sadb_ext_type] || len < minsize[ext->sadb_ext_type]) 8150 return EINVAL; 8151 if (maxsize[ext->sadb_ext_type] && len > maxsize[ext->sadb_ext_type]) 8152 return EINVAL; 8153 8154 /* more checks based on sadb_ext_type XXX need more */ 8155 switch (ext->sadb_ext_type) { 8156 case SADB_EXT_ADDRESS_SRC: 8157 case SADB_EXT_ADDRESS_DST: 8158 case SADB_EXT_ADDRESS_PROXY: 8159 case SADB_X_EXT_NAT_T_OAI: 8160 case SADB_X_EXT_NAT_T_OAR: 8161 case SADB_X_EXT_NEW_ADDRESS_SRC: 8162 case SADB_X_EXT_NEW_ADDRESS_DST: 8163 baselen = PFKEY_ALIGN8(sizeof(struct sadb_address)); 8164 checktype = ADDR; 8165 break; 8166 case SADB_EXT_IDENTITY_SRC: 8167 case SADB_EXT_IDENTITY_DST: 8168 if (((const struct sadb_ident *)ext)->sadb_ident_type == 8169 SADB_X_IDENTTYPE_ADDR) { 8170 baselen = PFKEY_ALIGN8(sizeof(struct sadb_ident)); 8171 checktype = ADDR; 8172 } else 8173 checktype = NONE; 8174 break; 8175 default: 8176 checktype = NONE; 8177 break; 8178 } 8179 8180 switch (checktype) { 8181 case NONE: 8182 break; 8183 case ADDR: 8184 sa = (const struct sockaddr *)(((const u_int8_t*)ext)+baselen); 8185 if (len < baselen + sal) 8186 return EINVAL; 8187 if (baselen + PFKEY_ALIGN8(sa->sa_len) != len) 8188 return EINVAL; 8189 break; 8190 } 8191 8192 return 0; 8193 } 8194 8195 void 8196 spdcache_init(void) 8197 { 8198 int i; 8199 8200 TUNABLE_INT_FETCH("net.key.spdcache.maxentries", 8201 &V_key_spdcache_maxentries); 8202 TUNABLE_INT_FETCH("net.key.spdcache.threshold", 8203 &V_key_spdcache_threshold); 8204 8205 if (V_key_spdcache_maxentries) { 8206 V_key_spdcache_maxentries = MAX(V_key_spdcache_maxentries, 8207 SPDCACHE_MAX_ENTRIES_PER_HASH); 8208 V_spdcachehashtbl = hashinit(V_key_spdcache_maxentries / 8209 SPDCACHE_MAX_ENTRIES_PER_HASH, 8210 M_IPSEC_SPDCACHE, &V_spdcachehash_mask); 8211 V_key_spdcache_maxentries = (V_spdcachehash_mask + 1) 8212 * SPDCACHE_MAX_ENTRIES_PER_HASH; 8213 8214 V_spdcache_lock = malloc(sizeof(struct mtx) * 8215 (V_spdcachehash_mask + 1), 8216 M_IPSEC_SPDCACHE, M_WAITOK|M_ZERO); 8217 8218 for (i = 0; i < V_spdcachehash_mask + 1; ++i) 8219 SPDCACHE_LOCK_INIT(i); 8220 } 8221 } 8222 8223 struct spdcache_entry * 8224 spdcache_entry_alloc(const struct secpolicyindex *spidx, struct secpolicy *sp) 8225 { 8226 struct spdcache_entry *entry; 8227 8228 entry = malloc(sizeof(struct spdcache_entry), 8229 M_IPSEC_SPDCACHE, M_NOWAIT|M_ZERO); 8230 if (entry == NULL) 8231 return NULL; 8232 8233 if (sp != NULL) 8234 SP_ADDREF(sp); 8235 8236 entry->spidx = *spidx; 8237 entry->sp = sp; 8238 8239 return (entry); 8240 } 8241 8242 void 8243 spdcache_entry_free(struct spdcache_entry *entry) 8244 { 8245 8246 if (entry->sp != NULL) 8247 key_freesp(&entry->sp); 8248 free(entry, M_IPSEC_SPDCACHE); 8249 } 8250 8251 void 8252 spdcache_clear(void) 8253 { 8254 struct spdcache_entry *entry; 8255 int i; 8256 8257 for (i = 0; i < V_spdcachehash_mask + 1; ++i) { 8258 SPDCACHE_LOCK(i); 8259 while (!LIST_EMPTY(&V_spdcachehashtbl[i])) { 8260 entry = LIST_FIRST(&V_spdcachehashtbl[i]); 8261 LIST_REMOVE(entry, chain); 8262 spdcache_entry_free(entry); 8263 } 8264 SPDCACHE_UNLOCK(i); 8265 } 8266 } 8267 8268 #ifdef VIMAGE 8269 void 8270 spdcache_destroy(void) 8271 { 8272 int i; 8273 8274 if (SPDCACHE_ENABLED()) { 8275 spdcache_clear(); 8276 hashdestroy(V_spdcachehashtbl, M_IPSEC_SPDCACHE, V_spdcachehash_mask); 8277 8278 for (i = 0; i < V_spdcachehash_mask + 1; ++i) 8279 SPDCACHE_LOCK_DESTROY(i); 8280 8281 free(V_spdcache_lock, M_IPSEC_SPDCACHE); 8282 } 8283 } 8284 #endif 8285 void 8286 key_init(void) 8287 { 8288 int i; 8289 8290 for (i = 0; i < IPSEC_DIR_MAX; i++) { 8291 TAILQ_INIT(&V_sptree[i]); 8292 TAILQ_INIT(&V_sptree_ifnet[i]); 8293 } 8294 8295 V_key_lft_zone = uma_zcreate("IPsec SA lft_c", 8296 sizeof(uint64_t) * 2, NULL, NULL, NULL, NULL, 8297 UMA_ALIGN_PTR, UMA_ZONE_PCPU); 8298 8299 TAILQ_INIT(&V_sahtree); 8300 V_sphashtbl = hashinit(SPHASH_NHASH, M_IPSEC_SP, &V_sphash_mask); 8301 V_savhashtbl = hashinit(SAVHASH_NHASH, M_IPSEC_SA, &V_savhash_mask); 8302 V_sahaddrhashtbl = hashinit(SAHHASH_NHASH, M_IPSEC_SAH, 8303 &V_sahaddrhash_mask); 8304 V_acqaddrhashtbl = hashinit(ACQHASH_NHASH, M_IPSEC_SAQ, 8305 &V_acqaddrhash_mask); 8306 V_acqseqhashtbl = hashinit(ACQHASH_NHASH, M_IPSEC_SAQ, 8307 &V_acqseqhash_mask); 8308 8309 spdcache_init(); 8310 8311 for (i = 0; i <= SADB_SATYPE_MAX; i++) 8312 LIST_INIT(&V_regtree[i]); 8313 8314 LIST_INIT(&V_acqtree); 8315 LIST_INIT(&V_spacqtree); 8316 8317 if (!IS_DEFAULT_VNET(curvnet)) 8318 return; 8319 8320 SPTREE_LOCK_INIT(); 8321 REGTREE_LOCK_INIT(); 8322 SAHTREE_LOCK_INIT(); 8323 ACQ_LOCK_INIT(); 8324 SPACQ_LOCK_INIT(); 8325 8326 #ifndef IPSEC_DEBUG2 8327 callout_init(&key_timer, 1); 8328 callout_reset(&key_timer, hz, key_timehandler, NULL); 8329 #endif /*IPSEC_DEBUG2*/ 8330 8331 /* initialize key statistics */ 8332 keystat.getspi_count = 1; 8333 8334 if (bootverbose) 8335 printf("IPsec: Initialized Security Association Processing.\n"); 8336 } 8337 8338 #ifdef VIMAGE 8339 void 8340 key_destroy(void) 8341 { 8342 struct secashead_queue sahdrainq; 8343 struct secpolicy_queue drainq; 8344 struct secpolicy *sp, *nextsp; 8345 struct secacq *acq, *nextacq; 8346 struct secspacq *spacq, *nextspacq; 8347 struct secashead *sah; 8348 struct secasvar *sav; 8349 struct secreg *reg; 8350 int i; 8351 8352 /* 8353 * XXX: can we just call free() for each object without 8354 * walking through safe way with releasing references? 8355 */ 8356 TAILQ_INIT(&drainq); 8357 SPTREE_WLOCK(); 8358 for (i = 0; i < IPSEC_DIR_MAX; i++) { 8359 TAILQ_CONCAT(&drainq, &V_sptree[i], chain); 8360 TAILQ_CONCAT(&drainq, &V_sptree_ifnet[i], chain); 8361 } 8362 for (i = 0; i < V_sphash_mask + 1; i++) 8363 LIST_INIT(&V_sphashtbl[i]); 8364 SPTREE_WUNLOCK(); 8365 spdcache_destroy(); 8366 8367 sp = TAILQ_FIRST(&drainq); 8368 while (sp != NULL) { 8369 nextsp = TAILQ_NEXT(sp, chain); 8370 key_freesp(&sp); 8371 sp = nextsp; 8372 } 8373 8374 TAILQ_INIT(&sahdrainq); 8375 SAHTREE_WLOCK(); 8376 TAILQ_CONCAT(&sahdrainq, &V_sahtree, chain); 8377 for (i = 0; i < V_savhash_mask + 1; i++) 8378 LIST_INIT(&V_savhashtbl[i]); 8379 for (i = 0; i < V_sahaddrhash_mask + 1; i++) 8380 LIST_INIT(&V_sahaddrhashtbl[i]); 8381 TAILQ_FOREACH(sah, &sahdrainq, chain) { 8382 sah->state = SADB_SASTATE_DEAD; 8383 TAILQ_FOREACH(sav, &sah->savtree_larval, chain) { 8384 sav->state = SADB_SASTATE_DEAD; 8385 } 8386 TAILQ_FOREACH(sav, &sah->savtree_alive, chain) { 8387 sav->state = SADB_SASTATE_DEAD; 8388 } 8389 } 8390 SAHTREE_WUNLOCK(); 8391 8392 key_freesah_flushed(&sahdrainq); 8393 hashdestroy(V_sphashtbl, M_IPSEC_SP, V_sphash_mask); 8394 hashdestroy(V_savhashtbl, M_IPSEC_SA, V_savhash_mask); 8395 hashdestroy(V_sahaddrhashtbl, M_IPSEC_SAH, V_sahaddrhash_mask); 8396 8397 REGTREE_LOCK(); 8398 for (i = 0; i <= SADB_SATYPE_MAX; i++) { 8399 LIST_FOREACH(reg, &V_regtree[i], chain) { 8400 if (__LIST_CHAINED(reg)) { 8401 LIST_REMOVE(reg, chain); 8402 free(reg, M_IPSEC_SAR); 8403 break; 8404 } 8405 } 8406 } 8407 REGTREE_UNLOCK(); 8408 8409 ACQ_LOCK(); 8410 acq = LIST_FIRST(&V_acqtree); 8411 while (acq != NULL) { 8412 nextacq = LIST_NEXT(acq, chain); 8413 LIST_REMOVE(acq, chain); 8414 free(acq, M_IPSEC_SAQ); 8415 acq = nextacq; 8416 } 8417 for (i = 0; i < V_acqaddrhash_mask + 1; i++) 8418 LIST_INIT(&V_acqaddrhashtbl[i]); 8419 for (i = 0; i < V_acqseqhash_mask + 1; i++) 8420 LIST_INIT(&V_acqseqhashtbl[i]); 8421 ACQ_UNLOCK(); 8422 8423 SPACQ_LOCK(); 8424 for (spacq = LIST_FIRST(&V_spacqtree); spacq != NULL; 8425 spacq = nextspacq) { 8426 nextspacq = LIST_NEXT(spacq, chain); 8427 if (__LIST_CHAINED(spacq)) { 8428 LIST_REMOVE(spacq, chain); 8429 free(spacq, M_IPSEC_SAQ); 8430 } 8431 } 8432 SPACQ_UNLOCK(); 8433 hashdestroy(V_acqaddrhashtbl, M_IPSEC_SAQ, V_acqaddrhash_mask); 8434 hashdestroy(V_acqseqhashtbl, M_IPSEC_SAQ, V_acqseqhash_mask); 8435 uma_zdestroy(V_key_lft_zone); 8436 8437 if (!IS_DEFAULT_VNET(curvnet)) 8438 return; 8439 #ifndef IPSEC_DEBUG2 8440 callout_drain(&key_timer); 8441 #endif 8442 SPTREE_LOCK_DESTROY(); 8443 REGTREE_LOCK_DESTROY(); 8444 SAHTREE_LOCK_DESTROY(); 8445 ACQ_LOCK_DESTROY(); 8446 SPACQ_LOCK_DESTROY(); 8447 } 8448 #endif 8449 8450 /* record data transfer on SA, and update timestamps */ 8451 void 8452 key_sa_recordxfer(struct secasvar *sav, struct mbuf *m) 8453 { 8454 IPSEC_ASSERT(sav != NULL, ("Null secasvar")); 8455 IPSEC_ASSERT(m != NULL, ("Null mbuf")); 8456 8457 /* 8458 * XXX Currently, there is a difference of bytes size 8459 * between inbound and outbound processing. 8460 */ 8461 counter_u64_add(sav->lft_c_bytes, m->m_pkthdr.len); 8462 8463 /* 8464 * We use the number of packets as the unit of 8465 * allocations. We increment the variable 8466 * whenever {esp,ah}_{in,out}put is called. 8467 */ 8468 counter_u64_add(sav->lft_c_allocations, 1); 8469 8470 /* 8471 * NOTE: We record CURRENT usetime by using wall clock, 8472 * in seconds. HARD and SOFT lifetime are measured by the time 8473 * difference (again in seconds) from usetime. 8474 * 8475 * usetime 8476 * v expire expire 8477 * -----+-----+--------+---> t 8478 * <--------------> HARD 8479 * <-----> SOFT 8480 */ 8481 if (sav->firstused == 0) 8482 sav->firstused = time_second; 8483 } 8484 8485 /* 8486 * Take one of the kernel's security keys and convert it into a PF_KEY 8487 * structure within an mbuf, suitable for sending up to a waiting 8488 * application in user land. 8489 * 8490 * IN: 8491 * src: A pointer to a kernel security key. 8492 * exttype: Which type of key this is. Refer to the PF_KEY data structures. 8493 * OUT: 8494 * a valid mbuf or NULL indicating an error 8495 * 8496 */ 8497 8498 static struct mbuf * 8499 key_setkey(struct seckey *src, uint16_t exttype) 8500 { 8501 struct mbuf *m; 8502 struct sadb_key *p; 8503 int len; 8504 8505 if (src == NULL) 8506 return NULL; 8507 8508 len = PFKEY_ALIGN8(sizeof(struct sadb_key) + _KEYLEN(src)); 8509 m = m_get2(len, M_NOWAIT, MT_DATA, 0); 8510 if (m == NULL) 8511 return NULL; 8512 m_align(m, len); 8513 m->m_len = len; 8514 p = mtod(m, struct sadb_key *); 8515 bzero(p, len); 8516 p->sadb_key_len = PFKEY_UNIT64(len); 8517 p->sadb_key_exttype = exttype; 8518 p->sadb_key_bits = src->bits; 8519 bcopy(src->key_data, _KEYBUF(p), _KEYLEN(src)); 8520 8521 return m; 8522 } 8523 8524 /* 8525 * Take one of the kernel's lifetime data structures and convert it 8526 * into a PF_KEY structure within an mbuf, suitable for sending up to 8527 * a waiting application in user land. 8528 * 8529 * IN: 8530 * src: A pointer to a kernel lifetime structure. 8531 * exttype: Which type of lifetime this is. Refer to the PF_KEY 8532 * data structures for more information. 8533 * OUT: 8534 * a valid mbuf or NULL indicating an error 8535 * 8536 */ 8537 8538 static struct mbuf * 8539 key_setlifetime(struct seclifetime *src, uint16_t exttype) 8540 { 8541 struct mbuf *m = NULL; 8542 struct sadb_lifetime *p; 8543 int len = PFKEY_ALIGN8(sizeof(struct sadb_lifetime)); 8544 8545 if (src == NULL) 8546 return NULL; 8547 8548 m = m_get2(len, M_NOWAIT, MT_DATA, 0); 8549 if (m == NULL) 8550 return m; 8551 m_align(m, len); 8552 m->m_len = len; 8553 p = mtod(m, struct sadb_lifetime *); 8554 8555 bzero(p, len); 8556 p->sadb_lifetime_len = PFKEY_UNIT64(len); 8557 p->sadb_lifetime_exttype = exttype; 8558 p->sadb_lifetime_allocations = src->allocations; 8559 p->sadb_lifetime_bytes = src->bytes; 8560 p->sadb_lifetime_addtime = src->addtime; 8561 p->sadb_lifetime_usetime = src->usetime; 8562 8563 return m; 8564 8565 } 8566 8567 const struct enc_xform * 8568 enc_algorithm_lookup(int alg) 8569 { 8570 int i; 8571 8572 for (i = 0; i < nitems(supported_ealgs); i++) 8573 if (alg == supported_ealgs[i].sadb_alg) 8574 return (supported_ealgs[i].xform); 8575 return (NULL); 8576 } 8577 8578 const struct auth_hash * 8579 auth_algorithm_lookup(int alg) 8580 { 8581 int i; 8582 8583 for (i = 0; i < nitems(supported_aalgs); i++) 8584 if (alg == supported_aalgs[i].sadb_alg) 8585 return (supported_aalgs[i].xform); 8586 return (NULL); 8587 } 8588 8589 const struct comp_algo * 8590 comp_algorithm_lookup(int alg) 8591 { 8592 int i; 8593 8594 for (i = 0; i < nitems(supported_calgs); i++) 8595 if (alg == supported_calgs[i].sadb_alg) 8596 return (supported_calgs[i].xform); 8597 return (NULL); 8598 } 8599 8600