1 /* $KAME: key.c,v 1.191 2001/06/27 10:46:49 sakane Exp $ */ 2 3 /*- 4 * SPDX-License-Identifier: BSD-3-Clause 5 * 6 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. 7 * All rights reserved. 8 * 9 * Redistribution and use in source and binary forms, with or without 10 * modification, are permitted provided that the following conditions 11 * are met: 12 * 1. Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * 2. Redistributions in binary form must reproduce the above copyright 15 * notice, this list of conditions and the following disclaimer in the 16 * documentation and/or other materials provided with the distribution. 17 * 3. Neither the name of the project nor the names of its contributors 18 * may be used to endorse or promote products derived from this software 19 * without specific prior written permission. 20 * 21 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND 22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 24 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE 25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 31 * SUCH DAMAGE. 32 */ 33 34 /* 35 * This code is referd to RFC 2367 36 */ 37 38 #include "opt_inet.h" 39 #include "opt_inet6.h" 40 #include "opt_ipsec.h" 41 42 #include <sys/types.h> 43 #include <sys/param.h> 44 #include <sys/systm.h> 45 #include <sys/kernel.h> 46 #include <sys/fnv_hash.h> 47 #include <sys/lock.h> 48 #include <sys/mutex.h> 49 #include <sys/mbuf.h> 50 #include <sys/domain.h> 51 #include <sys/protosw.h> 52 #include <sys/malloc.h> 53 #include <sys/rmlock.h> 54 #include <sys/socket.h> 55 #include <sys/socketvar.h> 56 #include <sys/sysctl.h> 57 #include <sys/errno.h> 58 #include <sys/proc.h> 59 #include <sys/queue.h> 60 #include <sys/refcount.h> 61 #include <sys/syslog.h> 62 63 #include <vm/uma.h> 64 65 #include <net/if.h> 66 #include <net/if_var.h> 67 #include <net/vnet.h> 68 69 #include <netinet/in.h> 70 #include <netinet/in_systm.h> 71 #include <netinet/ip.h> 72 #include <netinet/in_var.h> 73 #include <netinet/udp.h> 74 75 #ifdef INET6 76 #include <netinet/ip6.h> 77 #include <netinet6/in6_var.h> 78 #include <netinet6/ip6_var.h> 79 #endif /* INET6 */ 80 81 #include <net/pfkeyv2.h> 82 #include <netipsec/keydb.h> 83 #include <netipsec/key.h> 84 #include <netipsec/keysock.h> 85 #include <netipsec/key_debug.h> 86 #include <netipsec/ipsec_offload.h> 87 88 #include <netipsec/ipsec.h> 89 #ifdef INET6 90 #include <netipsec/ipsec6.h> 91 #endif 92 93 #include <netipsec/xform.h> 94 #include <netipsec/ipsec_offload.h> 95 #include <machine/in_cksum.h> 96 #include <machine/stdarg.h> 97 98 /* randomness */ 99 #include <sys/random.h> 100 101 #ifdef IPSEC_OFFLOAD 102 void (*ipsec_accel_sa_newkey_p)(struct secasvar *sav); 103 void (*ipsec_accel_forget_sav_p)(struct secasvar *sav); 104 void (*ipsec_accel_spdadd_p)(struct secpolicy *sp, struct inpcb *inp); 105 void (*ipsec_accel_spddel_p)(struct secpolicy *sp); 106 int (*ipsec_accel_sa_lifetime_op_p)(struct secasvar *sav, 107 struct seclifetime *lft_c, if_t ifp, enum IF_SA_CNT_WHICH op, 108 struct rm_priotracker *sahtree_trackerp); 109 void (*ipsec_accel_sync_p)(void); 110 bool (*ipsec_accel_is_accel_sav_p)(struct secasvar *sav); 111 struct mbuf *(*ipsec_accel_key_setaccelif_p)(struct secasvar *sav); 112 void (*ipsec_accel_on_ifdown_p)(struct ifnet *ifp); 113 void (*ipsec_accel_drv_sa_lifetime_update_p)(struct secasvar *sav, if_t ifp, 114 u_int drv_spi, uint64_t octets, uint64_t allocs); 115 #endif 116 117 #define FULLMASK 0xff 118 #define _BITS(bytes) ((bytes) << 3) 119 120 #define UINT32_80PCT 0xcccccccc 121 /* 122 * Note on SA reference counting: 123 * - SAs that are not in DEAD state will have (total external reference + 1) 124 * following value in reference count field. they cannot be freed and are 125 * referenced from SA header. 126 * - SAs that are in DEAD state will have (total external reference) 127 * in reference count field. they are ready to be freed. reference from 128 * SA header will be removed in key_delsav(), when the reference count 129 * field hits 0 (= no external reference other than from SA header. 130 */ 131 132 VNET_DEFINE(u_int32_t, key_debug_level) = 0; 133 VNET_DEFINE_STATIC(u_int, key_spi_trycnt) = 1000; 134 VNET_DEFINE_STATIC(u_int32_t, key_spi_minval) = 0x100; 135 VNET_DEFINE_STATIC(u_int32_t, key_spi_maxval) = 0x0fffffff; /* XXX */ 136 VNET_DEFINE_STATIC(u_int32_t, policy_id) = 0; 137 /*interval to initialize randseed,1(m)*/ 138 VNET_DEFINE_STATIC(u_int, key_int_random) = 60; 139 /* interval to expire acquiring, 30(s)*/ 140 VNET_DEFINE_STATIC(u_int, key_larval_lifetime) = 30; 141 /* counter for blocking SADB_ACQUIRE.*/ 142 VNET_DEFINE_STATIC(int, key_blockacq_count) = 10; 143 /* lifetime for blocking SADB_ACQUIRE.*/ 144 VNET_DEFINE_STATIC(int, key_blockacq_lifetime) = 20; 145 /* preferred old sa rather than new sa.*/ 146 VNET_DEFINE_STATIC(int, key_preferred_oldsa) = 1; 147 #define V_key_spi_trycnt VNET(key_spi_trycnt) 148 #define V_key_spi_minval VNET(key_spi_minval) 149 #define V_key_spi_maxval VNET(key_spi_maxval) 150 #define V_policy_id VNET(policy_id) 151 #define V_key_int_random VNET(key_int_random) 152 #define V_key_larval_lifetime VNET(key_larval_lifetime) 153 #define V_key_blockacq_count VNET(key_blockacq_count) 154 #define V_key_blockacq_lifetime VNET(key_blockacq_lifetime) 155 #define V_key_preferred_oldsa VNET(key_preferred_oldsa) 156 157 VNET_DEFINE_STATIC(u_int32_t, acq_seq) = 0; 158 #define V_acq_seq VNET(acq_seq) 159 160 VNET_DEFINE_STATIC(uint32_t, sp_genid) = 0; 161 #define V_sp_genid VNET(sp_genid) 162 163 /* SPD */ 164 TAILQ_HEAD(secpolicy_queue, secpolicy); 165 LIST_HEAD(secpolicy_list, secpolicy); 166 VNET_DEFINE_STATIC(struct secpolicy_queue, sptree[IPSEC_DIR_MAX]); 167 VNET_DEFINE_STATIC(struct secpolicy_queue, sptree_ifnet[IPSEC_DIR_MAX]); 168 static struct rmlock sptree_lock; 169 #define V_sptree VNET(sptree) 170 #define V_sptree_ifnet VNET(sptree_ifnet) 171 #define SPTREE_LOCK_INIT() rm_init(&sptree_lock, "sptree") 172 #define SPTREE_LOCK_DESTROY() rm_destroy(&sptree_lock) 173 #define SPTREE_RLOCK_TRACKER struct rm_priotracker sptree_tracker 174 #define SPTREE_RLOCK() rm_rlock(&sptree_lock, &sptree_tracker) 175 #define SPTREE_RUNLOCK() rm_runlock(&sptree_lock, &sptree_tracker) 176 #define SPTREE_RLOCK_ASSERT() rm_assert(&sptree_lock, RA_RLOCKED) 177 #define SPTREE_WLOCK() rm_wlock(&sptree_lock) 178 #define SPTREE_WUNLOCK() rm_wunlock(&sptree_lock) 179 #define SPTREE_WLOCK_ASSERT() rm_assert(&sptree_lock, RA_WLOCKED) 180 #define SPTREE_UNLOCK_ASSERT() rm_assert(&sptree_lock, RA_UNLOCKED) 181 182 /* Hash table for lookup SP using unique id */ 183 VNET_DEFINE_STATIC(struct secpolicy_list *, sphashtbl); 184 VNET_DEFINE_STATIC(u_long, sphash_mask); 185 #define V_sphashtbl VNET(sphashtbl) 186 #define V_sphash_mask VNET(sphash_mask) 187 188 #define SPHASH_NHASH_LOG2 7 189 #define SPHASH_NHASH (1 << SPHASH_NHASH_LOG2) 190 #define SPHASH_HASHVAL(id) (key_u32hash(id) & V_sphash_mask) 191 #define SPHASH_HASH(id) &V_sphashtbl[SPHASH_HASHVAL(id)] 192 193 /* SPD cache */ 194 struct spdcache_entry { 195 struct secpolicyindex spidx; /* secpolicyindex */ 196 struct secpolicy *sp; /* cached policy to be used */ 197 198 LIST_ENTRY(spdcache_entry) chain; 199 }; 200 LIST_HEAD(spdcache_entry_list, spdcache_entry); 201 202 #define SPDCACHE_MAX_ENTRIES_PER_HASH 8 203 204 VNET_DEFINE_STATIC(u_int, key_spdcache_maxentries) = 0; 205 #define V_key_spdcache_maxentries VNET(key_spdcache_maxentries) 206 VNET_DEFINE_STATIC(u_int, key_spdcache_threshold) = 32; 207 #define V_key_spdcache_threshold VNET(key_spdcache_threshold) 208 VNET_DEFINE_STATIC(unsigned long, spd_size) = 0; 209 #define V_spd_size VNET(spd_size) 210 211 #define SPDCACHE_ENABLED() (V_key_spdcache_maxentries != 0) 212 #define SPDCACHE_ACTIVE() \ 213 (SPDCACHE_ENABLED() && V_spd_size >= V_key_spdcache_threshold) 214 215 VNET_DEFINE_STATIC(struct spdcache_entry_list *, spdcachehashtbl); 216 VNET_DEFINE_STATIC(u_long, spdcachehash_mask); 217 #define V_spdcachehashtbl VNET(spdcachehashtbl) 218 #define V_spdcachehash_mask VNET(spdcachehash_mask) 219 220 #define SPDCACHE_HASHVAL(idx) \ 221 (key_addrprotohash(&(idx)->src, &(idx)->dst, &(idx)->ul_proto) & \ 222 V_spdcachehash_mask) 223 224 /* Each cache line is protected by a mutex */ 225 VNET_DEFINE_STATIC(struct mtx *, spdcache_lock); 226 #define V_spdcache_lock VNET(spdcache_lock) 227 228 #define SPDCACHE_LOCK_INIT(a) \ 229 mtx_init(&V_spdcache_lock[a], "spdcache", \ 230 "fast ipsec SPD cache", MTX_DEF|MTX_DUPOK) 231 #define SPDCACHE_LOCK_DESTROY(a) mtx_destroy(&V_spdcache_lock[a]) 232 #define SPDCACHE_LOCK(a) mtx_lock(&V_spdcache_lock[a]); 233 #define SPDCACHE_UNLOCK(a) mtx_unlock(&V_spdcache_lock[a]); 234 235 static struct sx spi_alloc_lock; 236 #define SPI_ALLOC_LOCK_INIT() sx_init(&spi_alloc_lock, "spialloc") 237 #define SPI_ALLOC_LOCK_DESTROY() sx_destroy(&spi_alloc_lock) 238 #define SPI_ALLOC_LOCK() sx_xlock(&spi_alloc_lock) 239 #define SPI_ALLOC_UNLOCK() sx_unlock(&spi_alloc_lock) 240 #define SPI_ALLOC_LOCK_ASSERT() sx_assert(&spi_alloc_lock, SA_XLOCKED) 241 242 /* SAD */ 243 TAILQ_HEAD(secashead_queue, secashead); 244 LIST_HEAD(secashead_list, secashead); 245 VNET_DEFINE_STATIC(struct secashead_queue, sahtree); 246 static struct rmlock sahtree_lock; 247 #define V_sahtree VNET(sahtree) 248 #define SAHTREE_LOCK_INIT() rm_init(&sahtree_lock, "sahtree") 249 #define SAHTREE_LOCK_DESTROY() rm_destroy(&sahtree_lock) 250 #define SAHTREE_RLOCK_TRACKER struct rm_priotracker sahtree_tracker 251 #define SAHTREE_RLOCK() rm_rlock(&sahtree_lock, &sahtree_tracker) 252 #define SAHTREE_RUNLOCK() rm_runlock(&sahtree_lock, &sahtree_tracker) 253 #define SAHTREE_RLOCK_ASSERT() rm_assert(&sahtree_lock, RA_RLOCKED) 254 #define SAHTREE_WLOCK() rm_wlock(&sahtree_lock) 255 #define SAHTREE_WUNLOCK() rm_wunlock(&sahtree_lock) 256 #define SAHTREE_WLOCK_ASSERT() rm_assert(&sahtree_lock, RA_WLOCKED) 257 #define SAHTREE_UNLOCK_ASSERT() rm_assert(&sahtree_lock, RA_UNLOCKED) 258 259 /* Hash table for lookup in SAD using SA addresses */ 260 VNET_DEFINE_STATIC(struct secashead_list *, sahaddrhashtbl); 261 VNET_DEFINE_STATIC(u_long, sahaddrhash_mask); 262 #define V_sahaddrhashtbl VNET(sahaddrhashtbl) 263 #define V_sahaddrhash_mask VNET(sahaddrhash_mask) 264 265 #define SAHHASH_NHASH_LOG2 7 266 #define SAHHASH_NHASH (1 << SAHHASH_NHASH_LOG2) 267 #define SAHADDRHASH_HASHVAL(idx) \ 268 (key_addrprotohash(&(idx)->src, &(idx)->dst, &(idx)->proto) & \ 269 V_sahaddrhash_mask) 270 #define SAHADDRHASH_HASH(saidx) \ 271 &V_sahaddrhashtbl[SAHADDRHASH_HASHVAL(saidx)] 272 273 /* Hash table for lookup in SAD using SPI */ 274 LIST_HEAD(secasvar_list, secasvar); 275 VNET_DEFINE_STATIC(struct secasvar_list *, savhashtbl); 276 VNET_DEFINE_STATIC(u_long, savhash_mask); 277 #define V_savhashtbl VNET(savhashtbl) 278 #define V_savhash_mask VNET(savhash_mask) 279 #define SAVHASH_NHASH_LOG2 7 280 #define SAVHASH_NHASH (1 << SAVHASH_NHASH_LOG2) 281 #define SAVHASH_HASHVAL(spi) (key_u32hash(spi) & V_savhash_mask) 282 #define SAVHASH_HASH(spi) &V_savhashtbl[SAVHASH_HASHVAL(spi)] 283 284 static uint32_t 285 key_addrprotohash(const union sockaddr_union *src, 286 const union sockaddr_union *dst, const uint8_t *proto) 287 { 288 uint32_t hval; 289 290 hval = fnv_32_buf(proto, sizeof(*proto), 291 FNV1_32_INIT); 292 switch (dst->sa.sa_family) { 293 #ifdef INET 294 case AF_INET: 295 hval = fnv_32_buf(&src->sin.sin_addr, 296 sizeof(in_addr_t), hval); 297 hval = fnv_32_buf(&dst->sin.sin_addr, 298 sizeof(in_addr_t), hval); 299 break; 300 #endif 301 #ifdef INET6 302 case AF_INET6: 303 hval = fnv_32_buf(&src->sin6.sin6_addr, 304 sizeof(struct in6_addr), hval); 305 hval = fnv_32_buf(&dst->sin6.sin6_addr, 306 sizeof(struct in6_addr), hval); 307 break; 308 #endif 309 default: 310 hval = 0; 311 ipseclog((LOG_DEBUG, "%s: unknown address family %d\n", 312 __func__, dst->sa.sa_family)); 313 } 314 return (hval); 315 } 316 317 static uint32_t 318 key_u32hash(uint32_t val) 319 { 320 321 return (fnv_32_buf(&val, sizeof(val), FNV1_32_INIT)); 322 } 323 324 /* registed list */ 325 VNET_DEFINE_STATIC(LIST_HEAD(_regtree, secreg), regtree[SADB_SATYPE_MAX + 1]); 326 #define V_regtree VNET(regtree) 327 static struct mtx regtree_lock; 328 #define REGTREE_LOCK_INIT() \ 329 mtx_init(®tree_lock, "regtree", "fast ipsec regtree", MTX_DEF) 330 #define REGTREE_LOCK_DESTROY() mtx_destroy(®tree_lock) 331 #define REGTREE_LOCK() mtx_lock(®tree_lock) 332 #define REGTREE_UNLOCK() mtx_unlock(®tree_lock) 333 #define REGTREE_LOCK_ASSERT() mtx_assert(®tree_lock, MA_OWNED) 334 335 /* Acquiring list */ 336 LIST_HEAD(secacq_list, secacq); 337 VNET_DEFINE_STATIC(struct secacq_list, acqtree); 338 #define V_acqtree VNET(acqtree) 339 static struct mtx acq_lock; 340 #define ACQ_LOCK_INIT() \ 341 mtx_init(&acq_lock, "acqtree", "ipsec SA acquiring list", MTX_DEF) 342 #define ACQ_LOCK_DESTROY() mtx_destroy(&acq_lock) 343 #define ACQ_LOCK() mtx_lock(&acq_lock) 344 #define ACQ_UNLOCK() mtx_unlock(&acq_lock) 345 #define ACQ_LOCK_ASSERT() mtx_assert(&acq_lock, MA_OWNED) 346 347 /* Hash table for lookup in ACQ list using SA addresses */ 348 VNET_DEFINE_STATIC(struct secacq_list *, acqaddrhashtbl); 349 VNET_DEFINE_STATIC(u_long, acqaddrhash_mask); 350 #define V_acqaddrhashtbl VNET(acqaddrhashtbl) 351 #define V_acqaddrhash_mask VNET(acqaddrhash_mask) 352 353 /* Hash table for lookup in ACQ list using SEQ number */ 354 VNET_DEFINE_STATIC(struct secacq_list *, acqseqhashtbl); 355 VNET_DEFINE_STATIC(u_long, acqseqhash_mask); 356 #define V_acqseqhashtbl VNET(acqseqhashtbl) 357 #define V_acqseqhash_mask VNET(acqseqhash_mask) 358 359 #define ACQHASH_NHASH_LOG2 7 360 #define ACQHASH_NHASH (1 << ACQHASH_NHASH_LOG2) 361 #define ACQADDRHASH_HASHVAL(idx) \ 362 (key_addrprotohash(&(idx)->src, &(idx)->dst, &(idx)->proto) & \ 363 V_acqaddrhash_mask) 364 #define ACQSEQHASH_HASHVAL(seq) \ 365 (key_u32hash(seq) & V_acqseqhash_mask) 366 #define ACQADDRHASH_HASH(saidx) \ 367 &V_acqaddrhashtbl[ACQADDRHASH_HASHVAL(saidx)] 368 #define ACQSEQHASH_HASH(seq) \ 369 &V_acqseqhashtbl[ACQSEQHASH_HASHVAL(seq)] 370 /* SP acquiring list */ 371 VNET_DEFINE_STATIC(LIST_HEAD(_spacqtree, secspacq), spacqtree); 372 #define V_spacqtree VNET(spacqtree) 373 static struct mtx spacq_lock; 374 #define SPACQ_LOCK_INIT() \ 375 mtx_init(&spacq_lock, "spacqtree", \ 376 "fast ipsec security policy acquire list", MTX_DEF) 377 #define SPACQ_LOCK_DESTROY() mtx_destroy(&spacq_lock) 378 #define SPACQ_LOCK() mtx_lock(&spacq_lock) 379 #define SPACQ_UNLOCK() mtx_unlock(&spacq_lock) 380 #define SPACQ_LOCK_ASSERT() mtx_assert(&spacq_lock, MA_OWNED) 381 382 static const int minsize[] = { 383 [SADB_EXT_RESERVED] = sizeof(struct sadb_msg), 384 [SADB_EXT_SA] = sizeof(struct sadb_sa), 385 [SADB_EXT_LIFETIME_CURRENT] = sizeof(struct sadb_lifetime), 386 [SADB_EXT_LIFETIME_HARD] = sizeof(struct sadb_lifetime), 387 [SADB_EXT_LIFETIME_SOFT] = sizeof(struct sadb_lifetime), 388 [SADB_EXT_ADDRESS_SRC] = sizeof(struct sadb_address), 389 [SADB_EXT_ADDRESS_DST] = sizeof(struct sadb_address), 390 [SADB_EXT_ADDRESS_PROXY] = sizeof(struct sadb_address), 391 [SADB_EXT_KEY_AUTH] = sizeof(struct sadb_key), 392 [SADB_EXT_KEY_ENCRYPT] = sizeof(struct sadb_key), 393 [SADB_EXT_IDENTITY_SRC] = sizeof(struct sadb_ident), 394 [SADB_EXT_IDENTITY_DST] = sizeof(struct sadb_ident), 395 [SADB_EXT_SENSITIVITY] = sizeof(struct sadb_sens), 396 [SADB_EXT_PROPOSAL] = sizeof(struct sadb_prop), 397 [SADB_EXT_SUPPORTED_AUTH] = sizeof(struct sadb_supported), 398 [SADB_EXT_SUPPORTED_ENCRYPT] = sizeof(struct sadb_supported), 399 [SADB_EXT_SPIRANGE] = sizeof(struct sadb_spirange), 400 [SADB_X_EXT_KMPRIVATE] = 0, 401 [SADB_X_EXT_POLICY] = sizeof(struct sadb_x_policy), 402 [SADB_X_EXT_SA2] = sizeof(struct sadb_x_sa2), 403 [SADB_X_EXT_NAT_T_TYPE] = sizeof(struct sadb_x_nat_t_type), 404 [SADB_X_EXT_NAT_T_SPORT] = sizeof(struct sadb_x_nat_t_port), 405 [SADB_X_EXT_NAT_T_DPORT] = sizeof(struct sadb_x_nat_t_port), 406 [SADB_X_EXT_NAT_T_OAI] = sizeof(struct sadb_address), 407 [SADB_X_EXT_NAT_T_OAR] = sizeof(struct sadb_address), 408 [SADB_X_EXT_NAT_T_FRAG] = sizeof(struct sadb_x_nat_t_frag), 409 [SADB_X_EXT_SA_REPLAY] = sizeof(struct sadb_x_sa_replay), 410 [SADB_X_EXT_NEW_ADDRESS_SRC] = sizeof(struct sadb_address), 411 [SADB_X_EXT_NEW_ADDRESS_DST] = sizeof(struct sadb_address), 412 [SADB_X_EXT_LFT_CUR_SW_OFFL] = sizeof(struct sadb_lifetime), 413 [SADB_X_EXT_LFT_CUR_HW_OFFL] = sizeof(struct sadb_lifetime), 414 [SADB_X_EXT_IF_HW_OFFL] = sizeof(struct sadb_x_if_hw_offl), 415 }; 416 _Static_assert(nitems(minsize) == SADB_EXT_MAX + 1, "minsize size mismatch"); 417 418 static const int maxsize[] = { 419 [SADB_EXT_RESERVED] = sizeof(struct sadb_msg), 420 [SADB_EXT_SA] = sizeof(struct sadb_sa), 421 [SADB_EXT_LIFETIME_CURRENT] = sizeof(struct sadb_lifetime), 422 [SADB_EXT_LIFETIME_HARD] = sizeof(struct sadb_lifetime), 423 [SADB_EXT_LIFETIME_SOFT] = sizeof(struct sadb_lifetime), 424 [SADB_EXT_ADDRESS_SRC] = 0, 425 [SADB_EXT_ADDRESS_DST] = 0, 426 [SADB_EXT_ADDRESS_PROXY] = 0, 427 [SADB_EXT_KEY_AUTH] = 0, 428 [SADB_EXT_KEY_ENCRYPT] = 0, 429 [SADB_EXT_IDENTITY_SRC] = 0, 430 [SADB_EXT_IDENTITY_DST] = 0, 431 [SADB_EXT_SENSITIVITY] = 0, 432 [SADB_EXT_PROPOSAL] = 0, 433 [SADB_EXT_SUPPORTED_AUTH] = 0, 434 [SADB_EXT_SUPPORTED_ENCRYPT] = 0, 435 [SADB_EXT_SPIRANGE] = sizeof(struct sadb_spirange), 436 [SADB_X_EXT_KMPRIVATE] = 0, 437 [SADB_X_EXT_POLICY] = 0, 438 [SADB_X_EXT_SA2] = sizeof(struct sadb_x_sa2), 439 [SADB_X_EXT_NAT_T_TYPE] = sizeof(struct sadb_x_nat_t_type), 440 [SADB_X_EXT_NAT_T_SPORT] = sizeof(struct sadb_x_nat_t_port), 441 [SADB_X_EXT_NAT_T_DPORT] = sizeof(struct sadb_x_nat_t_port), 442 [SADB_X_EXT_NAT_T_OAI] = 0, 443 [SADB_X_EXT_NAT_T_OAR] = 0, 444 [SADB_X_EXT_NAT_T_FRAG] = sizeof(struct sadb_x_nat_t_frag), 445 [SADB_X_EXT_SA_REPLAY] = sizeof(struct sadb_x_sa_replay), 446 [SADB_X_EXT_NEW_ADDRESS_SRC] = 0, 447 [SADB_X_EXT_NEW_ADDRESS_DST] = 0, 448 [SADB_X_EXT_LFT_CUR_SW_OFFL] = sizeof(struct sadb_lifetime), 449 [SADB_X_EXT_LFT_CUR_HW_OFFL] = sizeof(struct sadb_lifetime), 450 [SADB_X_EXT_IF_HW_OFFL] = sizeof(struct sadb_x_if_hw_offl), 451 }; 452 _Static_assert(nitems(maxsize) == SADB_EXT_MAX + 1, "maxsize size mismatch"); 453 454 /* 455 * Internal values for SA flags: 456 * SADB_X_EXT_F_CLONED means that SA was cloned by key_updateaddresses, 457 * thus we will not free the most of SA content in key_delsav(). 458 */ 459 #define SADB_X_EXT_F_CLONED 0x80000000 460 461 #define SADB_CHECKLEN(_mhp, _ext) \ 462 ((_mhp)->extlen[(_ext)] < minsize[(_ext)] || (maxsize[(_ext)] != 0 && \ 463 ((_mhp)->extlen[(_ext)] > maxsize[(_ext)]))) 464 #define SADB_CHECKHDR(_mhp, _ext) ((_mhp)->ext[(_ext)] == NULL) 465 466 VNET_DEFINE_STATIC(int, ipsec_esp_keymin) = 256; 467 VNET_DEFINE_STATIC(int, ipsec_esp_auth) = 0; 468 VNET_DEFINE_STATIC(int, ipsec_ah_keymin) = 128; 469 470 #define V_ipsec_esp_keymin VNET(ipsec_esp_keymin) 471 #define V_ipsec_esp_auth VNET(ipsec_esp_auth) 472 #define V_ipsec_ah_keymin VNET(ipsec_ah_keymin) 473 474 #ifdef IPSEC_DEBUG 475 VNET_DEFINE(int, ipsec_debug) = 1; 476 #else 477 VNET_DEFINE(int, ipsec_debug) = 0; 478 #endif 479 480 #ifdef INET 481 SYSCTL_DECL(_net_inet_ipsec); 482 SYSCTL_INT(_net_inet_ipsec, IPSECCTL_DEBUG, debug, 483 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ipsec_debug), 0, 484 "Enable IPsec debugging output when set."); 485 #endif 486 #ifdef INET6 487 SYSCTL_DECL(_net_inet6_ipsec6); 488 SYSCTL_INT(_net_inet6_ipsec6, IPSECCTL_DEBUG, debug, 489 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ipsec_debug), 0, 490 "Enable IPsec debugging output when set."); 491 #endif 492 493 SYSCTL_INT(_net_key, KEYCTL_DEBUG_LEVEL, debug, 494 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(key_debug_level), 0, ""); 495 496 /* max count of trial for the decision of spi value */ 497 SYSCTL_INT(_net_key, KEYCTL_SPI_TRY, spi_trycnt, 498 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(key_spi_trycnt), 0, ""); 499 500 /* minimum spi value to allocate automatically. */ 501 SYSCTL_INT(_net_key, KEYCTL_SPI_MIN_VALUE, spi_minval, 502 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(key_spi_minval), 0, ""); 503 504 /* maximun spi value to allocate automatically. */ 505 SYSCTL_INT(_net_key, KEYCTL_SPI_MAX_VALUE, spi_maxval, 506 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(key_spi_maxval), 0, ""); 507 508 /* interval to initialize randseed */ 509 SYSCTL_INT(_net_key, KEYCTL_RANDOM_INT, int_random, 510 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(key_int_random), 0, ""); 511 512 /* lifetime for larval SA */ 513 SYSCTL_INT(_net_key, KEYCTL_LARVAL_LIFETIME, larval_lifetime, 514 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(key_larval_lifetime), 0, ""); 515 516 /* counter for blocking to send SADB_ACQUIRE to IKEd */ 517 SYSCTL_INT(_net_key, KEYCTL_BLOCKACQ_COUNT, blockacq_count, 518 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(key_blockacq_count), 0, ""); 519 520 /* lifetime for blocking to send SADB_ACQUIRE to IKEd */ 521 SYSCTL_INT(_net_key, KEYCTL_BLOCKACQ_LIFETIME, blockacq_lifetime, 522 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(key_blockacq_lifetime), 0, ""); 523 524 /* ESP auth */ 525 SYSCTL_INT(_net_key, KEYCTL_ESP_AUTH, esp_auth, 526 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ipsec_esp_auth), 0, ""); 527 528 /* minimum ESP key length */ 529 SYSCTL_INT(_net_key, KEYCTL_ESP_KEYMIN, esp_keymin, 530 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ipsec_esp_keymin), 0, ""); 531 532 /* minimum AH key length */ 533 SYSCTL_INT(_net_key, KEYCTL_AH_KEYMIN, ah_keymin, 534 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ipsec_ah_keymin), 0, ""); 535 536 /* perfered old SA rather than new SA */ 537 SYSCTL_INT(_net_key, KEYCTL_PREFERED_OLDSA, preferred_oldsa, 538 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(key_preferred_oldsa), 0, ""); 539 540 SYSCTL_NODE(_net_key, OID_AUTO, spdcache, CTLFLAG_RW | CTLFLAG_MPSAFE, 0, 541 "SPD cache"); 542 543 SYSCTL_UINT(_net_key_spdcache, OID_AUTO, maxentries, 544 CTLFLAG_VNET | CTLFLAG_RDTUN, &VNET_NAME(key_spdcache_maxentries), 0, 545 "Maximum number of entries in the SPD cache" 546 " (power of 2, 0 to disable)"); 547 548 SYSCTL_UINT(_net_key_spdcache, OID_AUTO, threshold, 549 CTLFLAG_VNET | CTLFLAG_RDTUN, &VNET_NAME(key_spdcache_threshold), 0, 550 "Number of SPs that make the SPD cache active"); 551 552 #define __LIST_CHAINED(elm) \ 553 (!((elm)->chain.le_next == NULL && (elm)->chain.le_prev == NULL)) 554 555 MALLOC_DEFINE(M_IPSEC_SA, "secasvar", "ipsec security association"); 556 MALLOC_DEFINE(M_IPSEC_SAH, "sahead", "ipsec sa head"); 557 MALLOC_DEFINE(M_IPSEC_SP, "ipsecpolicy", "ipsec security policy"); 558 MALLOC_DEFINE(M_IPSEC_SR, "ipsecrequest", "ipsec security request"); 559 MALLOC_DEFINE(M_IPSEC_MISC, "ipsec-misc", "ipsec miscellaneous"); 560 MALLOC_DEFINE(M_IPSEC_SAQ, "ipsec-saq", "ipsec sa acquire"); 561 MALLOC_DEFINE(M_IPSEC_SAR, "ipsec-reg", "ipsec sa acquire"); 562 MALLOC_DEFINE(M_IPSEC_SPDCACHE, "ipsec-spdcache", "ipsec SPD cache"); 563 564 static uma_zone_t __read_mostly ipsec_key_lft_zone; 565 566 /* 567 * set parameters into secpolicyindex buffer. 568 * Must allocate secpolicyindex buffer passed to this function. 569 */ 570 #define KEY_SETSECSPIDX(_dir, s, d, ps, pd, ulp, idx) \ 571 do { \ 572 bzero((idx), sizeof(struct secpolicyindex)); \ 573 (idx)->dir = (_dir); \ 574 (idx)->prefs = (ps); \ 575 (idx)->prefd = (pd); \ 576 (idx)->ul_proto = (ulp); \ 577 bcopy((s), &(idx)->src, ((const struct sockaddr *)(s))->sa_len); \ 578 bcopy((d), &(idx)->dst, ((const struct sockaddr *)(d))->sa_len); \ 579 } while (0) 580 581 /* 582 * set parameters into secasindex buffer. 583 * Must allocate secasindex buffer before calling this function. 584 */ 585 #define KEY_SETSECASIDX(p, m, r, s, d, idx) \ 586 do { \ 587 bzero((idx), sizeof(struct secasindex)); \ 588 (idx)->proto = (p); \ 589 (idx)->mode = (m); \ 590 (idx)->reqid = (r); \ 591 bcopy((s), &(idx)->src, ((const struct sockaddr *)(s))->sa_len); \ 592 bcopy((d), &(idx)->dst, ((const struct sockaddr *)(d))->sa_len); \ 593 key_porttosaddr(&(idx)->src.sa, 0); \ 594 key_porttosaddr(&(idx)->dst.sa, 0); \ 595 } while (0) 596 597 /* key statistics */ 598 struct _keystat { 599 u_long getspi_count; /* the avarage of count to try to get new SPI */ 600 } keystat; 601 602 struct sadb_msghdr { 603 struct sadb_msg *msg; 604 struct sadb_ext *ext[SADB_EXT_MAX + 1]; 605 int extoff[SADB_EXT_MAX + 1]; 606 int extlen[SADB_EXT_MAX + 1]; 607 }; 608 609 static const struct supported_ealgs { 610 int sadb_alg; 611 const struct enc_xform *xform; 612 } supported_ealgs[] = { 613 { SADB_X_EALG_AES, &enc_xform_aes_cbc }, 614 { SADB_EALG_NULL, &enc_xform_null }, 615 { SADB_X_EALG_AESCTR, &enc_xform_aes_icm }, 616 { SADB_X_EALG_AESGCM16, &enc_xform_aes_nist_gcm }, 617 { SADB_X_EALG_AESGMAC, &enc_xform_aes_nist_gmac }, 618 { SADB_X_EALG_CHACHA20POLY1305, &enc_xform_chacha20_poly1305 }, 619 }; 620 621 static const struct supported_aalgs { 622 int sadb_alg; 623 const struct auth_hash *xform; 624 } supported_aalgs[] = { 625 { SADB_X_AALG_NULL, &auth_hash_null }, 626 { SADB_AALG_SHA1HMAC, &auth_hash_hmac_sha1 }, 627 { SADB_X_AALG_SHA2_256, &auth_hash_hmac_sha2_256 }, 628 { SADB_X_AALG_SHA2_384, &auth_hash_hmac_sha2_384 }, 629 { SADB_X_AALG_SHA2_512, &auth_hash_hmac_sha2_512 }, 630 { SADB_X_AALG_AES128GMAC, &auth_hash_nist_gmac_aes_128 }, 631 { SADB_X_AALG_AES192GMAC, &auth_hash_nist_gmac_aes_192 }, 632 { SADB_X_AALG_AES256GMAC, &auth_hash_nist_gmac_aes_256 }, 633 { SADB_X_AALG_CHACHA20POLY1305, &auth_hash_poly1305 }, 634 }; 635 636 static const struct supported_calgs { 637 int sadb_alg; 638 const struct comp_algo *xform; 639 } supported_calgs[] = { 640 { SADB_X_CALG_DEFLATE, &comp_algo_deflate }, 641 }; 642 643 #ifndef IPSEC_DEBUG2 644 static struct callout key_timer; 645 #endif 646 647 static void key_unlink(struct secpolicy *); 648 static void key_detach(struct secpolicy *); 649 static struct secpolicy *key_getsp(struct secpolicyindex *); 650 static struct secpolicy *key_getspbyid(u_int32_t); 651 static struct mbuf *key_gather_mbuf(struct mbuf *, 652 const struct sadb_msghdr *, int, int, ...); 653 static int key_spdadd(struct socket *, struct mbuf *, 654 const struct sadb_msghdr *); 655 static uint32_t key_getnewspid(void); 656 static int key_spddelete(struct socket *, struct mbuf *, 657 const struct sadb_msghdr *); 658 static int key_spddelete2(struct socket *, struct mbuf *, 659 const struct sadb_msghdr *); 660 static int key_spdget(struct socket *, struct mbuf *, 661 const struct sadb_msghdr *); 662 static int key_spdflush(struct socket *, struct mbuf *, 663 const struct sadb_msghdr *); 664 static int key_spddump(struct socket *, struct mbuf *, 665 const struct sadb_msghdr *); 666 static struct mbuf *key_setdumpsp(struct secpolicy *, 667 u_int8_t, u_int32_t, u_int32_t); 668 static struct mbuf *key_sp2mbuf(struct secpolicy *); 669 static size_t key_getspreqmsglen(struct secpolicy *); 670 static int key_spdexpire(struct secpolicy *); 671 static struct secashead *key_newsah(struct secasindex *); 672 static void key_freesah(struct secashead **); 673 static void key_delsah(struct secashead *); 674 static struct secasvar *key_newsav(const struct sadb_msghdr *, 675 struct secasindex *, uint32_t, int *); 676 static void key_delsav(struct secasvar *); 677 static void key_unlinksav(struct secasvar *); 678 static struct secashead *key_getsah(struct secasindex *); 679 static int key_checkspidup(uint32_t); 680 static struct secasvar *key_getsavbyspi(uint32_t); 681 static int key_setnatt(struct secasvar *, const struct sadb_msghdr *); 682 static int key_setsaval(struct secasvar *, const struct sadb_msghdr *); 683 static int key_updatelifetimes(struct secasvar *, const struct sadb_msghdr *); 684 static int key_updateaddresses(struct socket *, struct mbuf *, 685 const struct sadb_msghdr *, struct secasvar *, struct secasindex *); 686 687 static struct mbuf *key_setdumpsa(struct secasvar *, u_int8_t, 688 u_int8_t, u_int32_t, u_int32_t, struct rm_priotracker *); 689 static struct mbuf *key_setsadbmsg(u_int8_t, u_int16_t, u_int8_t, 690 u_int32_t, pid_t, u_int16_t); 691 static struct mbuf *key_setsadbsa(struct secasvar *); 692 static struct mbuf *key_setsadbaddr(u_int16_t, 693 const struct sockaddr *, u_int8_t, u_int16_t); 694 static struct mbuf *key_setsadbxport(u_int16_t, u_int16_t); 695 static struct mbuf *key_setsadbxtype(u_int16_t); 696 static struct mbuf *key_setsadbxsa2(u_int8_t, u_int32_t, u_int32_t); 697 static struct mbuf *key_setsadbxsareplay(u_int32_t); 698 static struct mbuf *key_setsadbxpolicy(u_int16_t, u_int8_t, 699 u_int32_t, u_int32_t); 700 static struct seckey *key_dup_keymsg(const struct sadb_key *, size_t, 701 struct malloc_type *); 702 static struct seclifetime *key_dup_lifemsg(const struct sadb_lifetime *src, 703 struct malloc_type *); 704 705 /* flags for key_cmpsaidx() */ 706 #define CMP_HEAD 1 /* protocol, addresses. */ 707 #define CMP_MODE_REQID 2 /* additionally HEAD, reqid, mode. */ 708 #define CMP_REQID 3 /* additionally HEAD, reaid. */ 709 #define CMP_EXACTLY 4 /* all elements. */ 710 static int key_cmpsaidx(const struct secasindex *, 711 const struct secasindex *, int); 712 static int key_cmpspidx_exactly(struct secpolicyindex *, 713 struct secpolicyindex *); 714 static int key_cmpspidx_withmask(struct secpolicyindex *, 715 struct secpolicyindex *); 716 static int key_bbcmp(const void *, const void *, u_int); 717 static uint8_t key_satype2proto(uint8_t); 718 static uint8_t key_proto2satype(uint8_t); 719 720 static int key_getspi(struct socket *, struct mbuf *, 721 const struct sadb_msghdr *); 722 static uint32_t key_do_getnewspi(struct sadb_spirange *, struct secasindex *); 723 static int key_update(struct socket *, struct mbuf *, 724 const struct sadb_msghdr *); 725 static int key_add(struct socket *, struct mbuf *, 726 const struct sadb_msghdr *); 727 static int key_setident(struct secashead *, const struct sadb_msghdr *); 728 static struct mbuf *key_getmsgbuf_x1(struct mbuf *, 729 const struct sadb_msghdr *); 730 static int key_delete(struct socket *, struct mbuf *, 731 const struct sadb_msghdr *); 732 static int key_delete_all(struct socket *, struct mbuf *, 733 const struct sadb_msghdr *, struct secasindex *); 734 static int key_get(struct socket *, struct mbuf *, 735 const struct sadb_msghdr *); 736 737 static void key_getcomb_setlifetime(struct sadb_comb *); 738 static struct mbuf *key_getcomb_ealg(void); 739 static struct mbuf *key_getcomb_ah(void); 740 static struct mbuf *key_getcomb_ipcomp(void); 741 static struct mbuf *key_getprop(const struct secasindex *); 742 743 static int key_acquire(const struct secasindex *, struct secpolicy *); 744 static uint32_t key_newacq(const struct secasindex *, int *); 745 static uint32_t key_getacq(const struct secasindex *, int *); 746 static int key_acqdone(const struct secasindex *, uint32_t); 747 static int key_acqreset(uint32_t); 748 static struct secspacq *key_newspacq(struct secpolicyindex *); 749 static struct secspacq *key_getspacq(struct secpolicyindex *); 750 static int key_acquire2(struct socket *, struct mbuf *, 751 const struct sadb_msghdr *); 752 static int key_register(struct socket *, struct mbuf *, 753 const struct sadb_msghdr *); 754 static int key_expire(struct secasvar *, int); 755 static int key_flush(struct socket *, struct mbuf *, 756 const struct sadb_msghdr *); 757 static int key_dump(struct socket *, struct mbuf *, 758 const struct sadb_msghdr *); 759 static int key_promisc(struct socket *, struct mbuf *, 760 const struct sadb_msghdr *); 761 static int key_senderror(struct socket *, struct mbuf *, int); 762 static int key_validate_ext(const struct sadb_ext *, int); 763 static int key_align(struct mbuf *, struct sadb_msghdr *); 764 static struct mbuf *key_setlifetime(struct seclifetime *, uint16_t); 765 static struct mbuf *key_setkey(struct seckey *, uint16_t); 766 767 static void spdcache_init(void); 768 static void spdcache_clear(void); 769 static struct spdcache_entry *spdcache_entry_alloc( 770 const struct secpolicyindex *spidx, 771 struct secpolicy *policy); 772 static void spdcache_entry_free(struct spdcache_entry *entry); 773 #ifdef VIMAGE 774 static void spdcache_destroy(void); 775 #endif 776 777 #define DBG_IPSEC_INITREF(t, p) do { \ 778 refcount_init(&(p)->refcnt, 1); \ 779 KEYDBG(KEY_STAMP, \ 780 printf("%s: Initialize refcnt %s(%p) = %u\n", \ 781 __func__, #t, (p), (p)->refcnt)); \ 782 } while (0) 783 #define DBG_IPSEC_ADDREF(t, p) do { \ 784 refcount_acquire(&(p)->refcnt); \ 785 KEYDBG(KEY_STAMP, \ 786 printf("%s: Acquire refcnt %s(%p) -> %u\n", \ 787 __func__, #t, (p), (p)->refcnt)); \ 788 } while (0) 789 #define DBG_IPSEC_DELREF(t, p) do { \ 790 KEYDBG(KEY_STAMP, \ 791 printf("%s: Release refcnt %s(%p) -> %u\n", \ 792 __func__, #t, (p), (p)->refcnt - 1)); \ 793 refcount_release(&(p)->refcnt); \ 794 } while (0) 795 796 #define IPSEC_INITREF(t, p) refcount_init(&(p)->refcnt, 1) 797 #define IPSEC_ADDREF(t, p) refcount_acquire(&(p)->refcnt) 798 #define IPSEC_DELREF(t, p) refcount_release(&(p)->refcnt) 799 800 #define SP_INITREF(p) IPSEC_INITREF(SP, p) 801 #define SP_ADDREF(p) IPSEC_ADDREF(SP, p) 802 #define SP_DELREF(p) IPSEC_DELREF(SP, p) 803 804 #define SAH_INITREF(p) IPSEC_INITREF(SAH, p) 805 #define SAH_ADDREF(p) IPSEC_ADDREF(SAH, p) 806 #define SAH_DELREF(p) IPSEC_DELREF(SAH, p) 807 808 #define SAV_INITREF(p) IPSEC_INITREF(SAV, p) 809 #define SAV_ADDREF(p) IPSEC_ADDREF(SAV, p) 810 #define SAV_DELREF(p) IPSEC_DELREF(SAV, p) 811 812 /* 813 * Update the refcnt while holding the SPTREE lock. 814 */ 815 void 816 key_addref(struct secpolicy *sp) 817 { 818 819 SP_ADDREF(sp); 820 } 821 822 /* 823 * Return 0 when there are known to be no SP's for the specified 824 * direction. Otherwise return 1. This is used by IPsec code 825 * to optimize performance. 826 */ 827 int 828 key_havesp(u_int dir) 829 { 830 831 IPSEC_ASSERT(dir == IPSEC_DIR_INBOUND || dir == IPSEC_DIR_OUTBOUND, 832 ("invalid direction %u", dir)); 833 return (TAILQ_FIRST(&V_sptree[dir]) != NULL); 834 } 835 836 int 837 key_havesp_any(void) 838 { 839 840 return (V_spd_size != 0); 841 } 842 843 /* 844 * Allocate a single mbuf with a buffer of the desired length. The buffer is 845 * pre-zeroed to help ensure that uninitialized pad bytes are not leaked. 846 */ 847 static struct mbuf * 848 key_mget(u_int len) 849 { 850 struct mbuf *m; 851 852 KASSERT(len <= MCLBYTES, 853 ("%s: invalid buffer length %u", __func__, len)); 854 855 m = m_get2(len, M_NOWAIT, MT_DATA, M_PKTHDR); 856 if (m == NULL) 857 return (NULL); 858 memset(mtod(m, void *), 0, len); 859 return (m); 860 } 861 862 /* %%% IPsec policy management */ 863 /* 864 * Return current SPDB generation. 865 */ 866 uint32_t 867 key_getspgen(void) 868 { 869 870 return (V_sp_genid); 871 } 872 873 void 874 key_bumpspgen(void) 875 { 876 877 V_sp_genid++; 878 } 879 880 static int 881 key_checksockaddrs(struct sockaddr *src, struct sockaddr *dst) 882 { 883 884 /* family match */ 885 if (src->sa_family != dst->sa_family) 886 return (EINVAL); 887 /* sa_len match */ 888 if (src->sa_len != dst->sa_len) 889 return (EINVAL); 890 switch (src->sa_family) { 891 #ifdef INET 892 case AF_INET: 893 if (src->sa_len != sizeof(struct sockaddr_in)) 894 return (EINVAL); 895 break; 896 #endif 897 #ifdef INET6 898 case AF_INET6: 899 if (src->sa_len != sizeof(struct sockaddr_in6)) 900 return (EINVAL); 901 break; 902 #endif 903 default: 904 return (EAFNOSUPPORT); 905 } 906 return (0); 907 } 908 909 struct secpolicy * 910 key_do_allocsp(struct secpolicyindex *spidx, u_int dir) 911 { 912 SPTREE_RLOCK_TRACKER; 913 struct secpolicy *sp; 914 915 IPSEC_ASSERT(spidx != NULL, ("null spidx")); 916 IPSEC_ASSERT(dir == IPSEC_DIR_INBOUND || dir == IPSEC_DIR_OUTBOUND, 917 ("invalid direction %u", dir)); 918 919 SPTREE_RLOCK(); 920 TAILQ_FOREACH(sp, &V_sptree[dir], chain) { 921 if (key_cmpspidx_withmask(&sp->spidx, spidx)) { 922 SP_ADDREF(sp); 923 break; 924 } 925 } 926 SPTREE_RUNLOCK(); 927 return (sp); 928 } 929 930 /* 931 * allocating a SP for OUTBOUND or INBOUND packet. 932 * Must call key_freesp() later. 933 * OUT: NULL: not found 934 * others: found and return the pointer. 935 */ 936 struct secpolicy * 937 key_allocsp(struct secpolicyindex *spidx, u_int dir) 938 { 939 struct spdcache_entry *entry, *lastentry, *tmpentry; 940 struct secpolicy *sp; 941 uint32_t hashv; 942 time_t ts; 943 int nb_entries; 944 945 if (!SPDCACHE_ACTIVE()) { 946 sp = key_do_allocsp(spidx, dir); 947 goto out; 948 } 949 950 hashv = SPDCACHE_HASHVAL(spidx); 951 SPDCACHE_LOCK(hashv); 952 nb_entries = 0; 953 LIST_FOREACH_SAFE(entry, &V_spdcachehashtbl[hashv], chain, tmpentry) { 954 /* Removed outdated entries */ 955 if (entry->sp != NULL && 956 entry->sp->state == IPSEC_SPSTATE_DEAD) { 957 LIST_REMOVE(entry, chain); 958 spdcache_entry_free(entry); 959 continue; 960 } 961 962 nb_entries++; 963 if (!key_cmpspidx_exactly(&entry->spidx, spidx)) { 964 lastentry = entry; 965 continue; 966 } 967 968 sp = entry->sp; 969 if (entry->sp != NULL) 970 SP_ADDREF(sp); 971 972 /* IPSECSTAT_INC(ips_spdcache_hits); */ 973 974 SPDCACHE_UNLOCK(hashv); 975 goto out; 976 } 977 978 /* IPSECSTAT_INC(ips_spdcache_misses); */ 979 980 sp = key_do_allocsp(spidx, dir); 981 entry = spdcache_entry_alloc(spidx, sp); 982 if (entry != NULL) { 983 if (nb_entries >= SPDCACHE_MAX_ENTRIES_PER_HASH) { 984 LIST_REMOVE(lastentry, chain); 985 spdcache_entry_free(lastentry); 986 } 987 988 LIST_INSERT_HEAD(&V_spdcachehashtbl[hashv], entry, chain); 989 } 990 991 SPDCACHE_UNLOCK(hashv); 992 993 out: 994 if (sp != NULL) { /* found a SPD entry */ 995 ts = time_second; 996 if (__predict_false(sp->lastused != ts)) 997 sp->lastused = ts; 998 KEYDBG(IPSEC_STAMP, 999 printf("%s: return SP(%p)\n", __func__, sp)); 1000 KEYDBG(IPSEC_DATA, kdebug_secpolicy(sp)); 1001 } else { 1002 KEYDBG(IPSEC_DATA, 1003 printf("%s: lookup failed for ", __func__); 1004 kdebug_secpolicyindex(spidx, NULL)); 1005 } 1006 return (sp); 1007 } 1008 1009 /* 1010 * Allocating an SA entry for an *INBOUND* or *OUTBOUND* TCP packet, signed 1011 * or should be signed by MD5 signature. 1012 * We don't use key_allocsa() for such lookups, because we don't know SPI. 1013 * Unlike ESP and AH protocols, SPI isn't transmitted in the TCP header with 1014 * signed packet. We use SADB only as storage for password. 1015 * OUT: positive: corresponding SA for given saidx found. 1016 * NULL: SA not found 1017 */ 1018 struct secasvar * 1019 key_allocsa_tcpmd5(struct secasindex *saidx) 1020 { 1021 SAHTREE_RLOCK_TRACKER; 1022 struct secashead *sah; 1023 struct secasvar *sav; 1024 1025 IPSEC_ASSERT(saidx->proto == IPPROTO_TCP, 1026 ("unexpected security protocol %u", saidx->proto)); 1027 IPSEC_ASSERT(saidx->mode == IPSEC_MODE_TCPMD5, 1028 ("unexpected mode %u", saidx->mode)); 1029 1030 SAHTREE_RLOCK(); 1031 LIST_FOREACH(sah, SAHADDRHASH_HASH(saidx), addrhash) { 1032 KEYDBG(IPSEC_DUMP, 1033 printf("%s: checking SAH\n", __func__); 1034 kdebug_secash(sah, " ")); 1035 if (sah->saidx.proto != IPPROTO_TCP) 1036 continue; 1037 if (!key_sockaddrcmp(&saidx->dst.sa, &sah->saidx.dst.sa, 0) && 1038 !key_sockaddrcmp(&saidx->src.sa, &sah->saidx.src.sa, 0)) 1039 break; 1040 } 1041 if (sah != NULL) { 1042 if (V_key_preferred_oldsa) 1043 sav = TAILQ_LAST(&sah->savtree_alive, secasvar_queue); 1044 else 1045 sav = TAILQ_FIRST(&sah->savtree_alive); 1046 if (sav != NULL) 1047 SAV_ADDREF(sav); 1048 } else 1049 sav = NULL; 1050 SAHTREE_RUNLOCK(); 1051 1052 if (sav != NULL) { 1053 KEYDBG(IPSEC_STAMP, 1054 printf("%s: return SA(%p)\n", __func__, sav)); 1055 KEYDBG(IPSEC_DATA, kdebug_secasv(sav)); 1056 } else { 1057 KEYDBG(IPSEC_STAMP, 1058 printf("%s: SA not found\n", __func__)); 1059 KEYDBG(IPSEC_DATA, kdebug_secasindex(saidx, NULL)); 1060 } 1061 return (sav); 1062 } 1063 1064 /* 1065 * Allocating an SA entry for an *OUTBOUND* packet. 1066 * OUT: positive: corresponding SA for given saidx found. 1067 * NULL: SA not found, but will be acquired, check *error 1068 * for acquiring status. 1069 */ 1070 struct secasvar * 1071 key_allocsa_policy(struct secpolicy *sp, const struct secasindex *saidx, 1072 int *error) 1073 { 1074 SAHTREE_RLOCK_TRACKER; 1075 struct secashead *sah; 1076 struct secasvar *sav; 1077 1078 IPSEC_ASSERT(saidx != NULL, ("null saidx")); 1079 IPSEC_ASSERT(saidx->mode == IPSEC_MODE_TRANSPORT || 1080 saidx->mode == IPSEC_MODE_TUNNEL, 1081 ("unexpected policy %u", saidx->mode)); 1082 1083 /* 1084 * We check new SA in the IPsec request because a different 1085 * SA may be involved each time this request is checked, either 1086 * because new SAs are being configured, or this request is 1087 * associated with an unconnected datagram socket, or this request 1088 * is associated with a system default policy. 1089 */ 1090 SAHTREE_RLOCK(); 1091 LIST_FOREACH(sah, SAHADDRHASH_HASH(saidx), addrhash) { 1092 KEYDBG(IPSEC_DUMP, 1093 printf("%s: checking SAH\n", __func__); 1094 kdebug_secash(sah, " ")); 1095 if (key_cmpsaidx(&sah->saidx, saidx, CMP_MODE_REQID)) 1096 break; 1097 } 1098 if (sah != NULL) { 1099 /* 1100 * Allocate the oldest SA available according to 1101 * draft-jenkins-ipsec-rekeying-03. 1102 */ 1103 if (V_key_preferred_oldsa) 1104 sav = TAILQ_LAST(&sah->savtree_alive, secasvar_queue); 1105 else 1106 sav = TAILQ_FIRST(&sah->savtree_alive); 1107 if (sav != NULL) 1108 SAV_ADDREF(sav); 1109 } else 1110 sav = NULL; 1111 SAHTREE_RUNLOCK(); 1112 1113 if (sav != NULL) { 1114 *error = 0; 1115 KEYDBG(IPSEC_STAMP, 1116 printf("%s: chosen SA(%p) for SP(%p)\n", __func__, 1117 sav, sp)); 1118 KEYDBG(IPSEC_DATA, kdebug_secasv(sav)); 1119 return (sav); /* return referenced SA */ 1120 } 1121 1122 /* there is no SA */ 1123 *error = key_acquire(saidx, sp); 1124 if ((*error) != 0) 1125 ipseclog((LOG_DEBUG, 1126 "%s: error %d returned from key_acquire()\n", 1127 __func__, *error)); 1128 KEYDBG(IPSEC_STAMP, 1129 printf("%s: acquire SA for SP(%p), error %d\n", 1130 __func__, sp, *error)); 1131 KEYDBG(IPSEC_DATA, kdebug_secasindex(saidx, NULL)); 1132 return (NULL); 1133 } 1134 1135 /* 1136 * allocating a usable SA entry for a *INBOUND* packet. 1137 * Must call key_freesav() later. 1138 * OUT: positive: pointer to a usable sav (i.e. MATURE or DYING state). 1139 * NULL: not found, or error occurred. 1140 * 1141 * According to RFC 2401 SA is uniquely identified by a triple SPI, 1142 * destination address, and security protocol. But according to RFC 4301, 1143 * SPI by itself suffices to specify an SA. 1144 * 1145 * Note that, however, we do need to keep source address in IPsec SA. 1146 * IKE specification and PF_KEY specification do assume that we 1147 * keep source address in IPsec SA. We see a tricky situation here. 1148 */ 1149 struct secasvar * 1150 key_allocsa(union sockaddr_union *dst, uint8_t proto, uint32_t spi) 1151 { 1152 SAHTREE_RLOCK_TRACKER; 1153 struct secasvar *sav; 1154 1155 IPSEC_ASSERT(proto == IPPROTO_ESP || proto == IPPROTO_AH || 1156 proto == IPPROTO_IPCOMP, ("unexpected security protocol %u", 1157 proto)); 1158 1159 SAHTREE_RLOCK(); 1160 LIST_FOREACH(sav, SAVHASH_HASH(spi), spihash) { 1161 if (sav->spi == spi) 1162 break; 1163 } 1164 /* 1165 * We use single SPI namespace for all protocols, so it is 1166 * impossible to have SPI duplicates in the SAVHASH. 1167 */ 1168 if (sav != NULL) { 1169 if (sav->state != SADB_SASTATE_LARVAL && 1170 sav->sah->saidx.proto == proto && 1171 key_sockaddrcmp(&dst->sa, 1172 &sav->sah->saidx.dst.sa, 0) == 0) 1173 SAV_ADDREF(sav); 1174 else 1175 sav = NULL; 1176 } 1177 SAHTREE_RUNLOCK(); 1178 1179 if (sav == NULL) { 1180 KEYDBG(IPSEC_STAMP, 1181 char buf[IPSEC_ADDRSTRLEN]; 1182 printf("%s: SA not found for spi %u proto %u dst %s\n", 1183 __func__, ntohl(spi), proto, ipsec_address(dst, buf, 1184 sizeof(buf)))); 1185 } else { 1186 KEYDBG(IPSEC_STAMP, 1187 printf("%s: return SA(%p)\n", __func__, sav)); 1188 KEYDBG(IPSEC_DATA, kdebug_secasv(sav)); 1189 } 1190 return (sav); 1191 } 1192 1193 struct secasvar * 1194 key_allocsa_tunnel(union sockaddr_union *src, union sockaddr_union *dst, 1195 uint8_t proto) 1196 { 1197 SAHTREE_RLOCK_TRACKER; 1198 struct secasindex saidx; 1199 struct secashead *sah; 1200 struct secasvar *sav; 1201 1202 IPSEC_ASSERT(src != NULL, ("null src address")); 1203 IPSEC_ASSERT(dst != NULL, ("null dst address")); 1204 1205 KEY_SETSECASIDX(proto, IPSEC_MODE_TUNNEL, 0, &src->sa, 1206 &dst->sa, &saidx); 1207 1208 sav = NULL; 1209 SAHTREE_RLOCK(); 1210 LIST_FOREACH(sah, SAHADDRHASH_HASH(&saidx), addrhash) { 1211 if (IPSEC_MODE_TUNNEL != sah->saidx.mode) 1212 continue; 1213 if (proto != sah->saidx.proto) 1214 continue; 1215 if (key_sockaddrcmp(&src->sa, &sah->saidx.src.sa, 0) != 0) 1216 continue; 1217 if (key_sockaddrcmp(&dst->sa, &sah->saidx.dst.sa, 0) != 0) 1218 continue; 1219 /* XXXAE: is key_preferred_oldsa reasonably?*/ 1220 if (V_key_preferred_oldsa) 1221 sav = TAILQ_LAST(&sah->savtree_alive, secasvar_queue); 1222 else 1223 sav = TAILQ_FIRST(&sah->savtree_alive); 1224 if (sav != NULL) { 1225 SAV_ADDREF(sav); 1226 break; 1227 } 1228 } 1229 SAHTREE_RUNLOCK(); 1230 KEYDBG(IPSEC_STAMP, 1231 printf("%s: return SA(%p)\n", __func__, sav)); 1232 if (sav != NULL) 1233 KEYDBG(IPSEC_DATA, kdebug_secasv(sav)); 1234 return (sav); 1235 } 1236 1237 /* 1238 * Must be called after calling key_allocsp(). 1239 */ 1240 void 1241 key_freesp(struct secpolicy **spp) 1242 { 1243 struct secpolicy *sp = *spp; 1244 1245 IPSEC_ASSERT(sp != NULL, ("null sp")); 1246 if (SP_DELREF(sp) == 0) 1247 return; 1248 1249 KEYDBG(IPSEC_STAMP, 1250 printf("%s: last reference to SP(%p)\n", __func__, sp)); 1251 KEYDBG(IPSEC_DATA, kdebug_secpolicy(sp)); 1252 1253 *spp = NULL; 1254 #ifdef IPSEC_OFFLOAD 1255 KASSERT(CK_LIST_EMPTY(&sp->accel_ifps), 1256 ("key_freesp: sp %p still offloaded", sp)); 1257 free(__DECONST(char *, sp->accel_ifname), M_IPSEC_MISC); 1258 #endif 1259 while (sp->tcount > 0) 1260 ipsec_delisr(sp->req[--sp->tcount]); 1261 free(sp, M_IPSEC_SP); 1262 } 1263 1264 static void 1265 key_unlink(struct secpolicy *sp) 1266 { 1267 SPTREE_WLOCK(); 1268 key_detach(sp); 1269 SPTREE_WUNLOCK(); 1270 if (SPDCACHE_ENABLED()) 1271 spdcache_clear(); 1272 ipsec_accel_sync(); 1273 key_freesp(&sp); 1274 } 1275 1276 static void 1277 key_detach(struct secpolicy *sp) 1278 { 1279 IPSEC_ASSERT(sp->spidx.dir == IPSEC_DIR_INBOUND || 1280 sp->spidx.dir == IPSEC_DIR_OUTBOUND, 1281 ("invalid direction %u", sp->spidx.dir)); 1282 SPTREE_WLOCK_ASSERT(); 1283 1284 KEYDBG(KEY_STAMP, 1285 printf("%s: SP(%p)\n", __func__, sp)); 1286 if (sp->state != IPSEC_SPSTATE_ALIVE) { 1287 /* SP is already unlinked */ 1288 return; 1289 } 1290 sp->state = IPSEC_SPSTATE_DEAD; 1291 ipsec_accel_spddel(sp); 1292 TAILQ_REMOVE(&V_sptree[sp->spidx.dir], sp, chain); 1293 V_spd_size--; 1294 LIST_REMOVE(sp, idhash); 1295 V_sp_genid++; 1296 } 1297 1298 /* 1299 * insert a secpolicy into the SP database. Lower priorities first 1300 */ 1301 static void 1302 key_insertsp(struct secpolicy *newsp) 1303 { 1304 struct secpolicy *sp; 1305 1306 SPTREE_WLOCK_ASSERT(); 1307 TAILQ_FOREACH(sp, &V_sptree[newsp->spidx.dir], chain) { 1308 if (newsp->priority < sp->priority) { 1309 TAILQ_INSERT_BEFORE(sp, newsp, chain); 1310 goto done; 1311 } 1312 } 1313 TAILQ_INSERT_TAIL(&V_sptree[newsp->spidx.dir], newsp, chain); 1314 done: 1315 LIST_INSERT_HEAD(SPHASH_HASH(newsp->id), newsp, idhash); 1316 newsp->state = IPSEC_SPSTATE_ALIVE; 1317 V_spd_size++; 1318 V_sp_genid++; 1319 ipsec_accel_spdadd(newsp, NULL); 1320 } 1321 1322 /* 1323 * Insert a bunch of VTI secpolicies into the SPDB. 1324 * We keep VTI policies in the separate list due to following reasons: 1325 * 1) they should be immutable to user's or some deamon's attempts to 1326 * delete. The only way delete such policies - destroy or unconfigure 1327 * corresponding virtual inteface. 1328 * 2) such policies have traffic selector that matches all traffic per 1329 * address family. 1330 * Since all VTI policies have the same priority, we don't care about 1331 * policies order. 1332 */ 1333 int 1334 key_register_ifnet(struct secpolicy **spp, u_int count) 1335 { 1336 struct mbuf *m; 1337 u_int i; 1338 1339 SPTREE_WLOCK(); 1340 /* 1341 * First of try to acquire id for each SP. 1342 */ 1343 for (i = 0; i < count; i++) { 1344 IPSEC_ASSERT(spp[i]->spidx.dir == IPSEC_DIR_INBOUND || 1345 spp[i]->spidx.dir == IPSEC_DIR_OUTBOUND, 1346 ("invalid direction %u", spp[i]->spidx.dir)); 1347 1348 if ((spp[i]->id = key_getnewspid()) == 0) { 1349 SPTREE_WUNLOCK(); 1350 return (EAGAIN); 1351 } 1352 } 1353 for (i = 0; i < count; i++) { 1354 TAILQ_INSERT_TAIL(&V_sptree_ifnet[spp[i]->spidx.dir], 1355 spp[i], chain); 1356 /* 1357 * NOTE: despite the fact that we keep VTI SP in the 1358 * separate list, SPHASH contains policies from both 1359 * sources. Thus SADB_X_SPDGET will correctly return 1360 * SP by id, because it uses SPHASH for lookups. 1361 */ 1362 LIST_INSERT_HEAD(SPHASH_HASH(spp[i]->id), spp[i], idhash); 1363 spp[i]->state = IPSEC_SPSTATE_IFNET; 1364 ipsec_accel_spdadd(spp[i], NULL); 1365 } 1366 SPTREE_WUNLOCK(); 1367 /* 1368 * Notify user processes about new SP. 1369 */ 1370 for (i = 0; i < count; i++) { 1371 m = key_setdumpsp(spp[i], SADB_X_SPDADD, 0, 0); 1372 if (m != NULL) 1373 key_sendup_mbuf(NULL, m, KEY_SENDUP_ALL); 1374 } 1375 return (0); 1376 } 1377 1378 void 1379 key_unregister_ifnet(struct secpolicy **spp, u_int count) 1380 { 1381 struct mbuf *m; 1382 u_int i; 1383 1384 SPTREE_WLOCK(); 1385 for (i = 0; i < count; i++) { 1386 IPSEC_ASSERT(spp[i]->spidx.dir == IPSEC_DIR_INBOUND || 1387 spp[i]->spidx.dir == IPSEC_DIR_OUTBOUND, 1388 ("invalid direction %u", spp[i]->spidx.dir)); 1389 1390 if (spp[i]->state != IPSEC_SPSTATE_IFNET) 1391 continue; 1392 spp[i]->state = IPSEC_SPSTATE_DEAD; 1393 ipsec_accel_spddel(spp[i]); 1394 TAILQ_REMOVE(&V_sptree_ifnet[spp[i]->spidx.dir], 1395 spp[i], chain); 1396 V_spd_size--; 1397 LIST_REMOVE(spp[i], idhash); 1398 } 1399 SPTREE_WUNLOCK(); 1400 if (SPDCACHE_ENABLED()) 1401 spdcache_clear(); 1402 ipsec_accel_sync(); 1403 1404 for (i = 0; i < count; i++) { 1405 m = key_setdumpsp(spp[i], SADB_X_SPDDELETE, 0, 0); 1406 if (m != NULL) 1407 key_sendup_mbuf(NULL, m, KEY_SENDUP_ALL); 1408 } 1409 } 1410 1411 /* 1412 * Must be called after calling key_allocsa(). 1413 * This function is called by key_freesp() to free some SA allocated 1414 * for a policy. 1415 */ 1416 void 1417 key_freesav(struct secasvar **psav) 1418 { 1419 struct secasvar *sav = *psav; 1420 1421 IPSEC_ASSERT(sav != NULL, ("null sav")); 1422 CURVNET_ASSERT_SET(); 1423 if (SAV_DELREF(sav) == 0) 1424 return; 1425 1426 KEYDBG(IPSEC_STAMP, 1427 printf("%s: last reference to SA(%p)\n", __func__, sav)); 1428 1429 *psav = NULL; 1430 key_delsav(sav); 1431 } 1432 1433 /* 1434 * Unlink SA from SAH and SPI hash under SAHTREE_WLOCK. 1435 * Expect that SA has extra reference due to lookup. 1436 * Release this references, also release SAH reference after unlink. 1437 */ 1438 static void 1439 key_unlinksav(struct secasvar *sav) 1440 { 1441 struct secashead *sah; 1442 1443 KEYDBG(KEY_STAMP, 1444 printf("%s: SA(%p)\n", __func__, sav)); 1445 1446 CURVNET_ASSERT_SET(); 1447 SAHTREE_UNLOCK_ASSERT(); 1448 SAHTREE_WLOCK(); 1449 if (sav->state == SADB_SASTATE_DEAD) { 1450 /* SA is already unlinked */ 1451 SAHTREE_WUNLOCK(); 1452 return; 1453 } 1454 /* Unlink from SAH */ 1455 if (sav->state == SADB_SASTATE_LARVAL) 1456 TAILQ_REMOVE(&sav->sah->savtree_larval, sav, chain); 1457 else 1458 TAILQ_REMOVE(&sav->sah->savtree_alive, sav, chain); 1459 /* Unlink from SPI hash */ 1460 LIST_REMOVE(sav, spihash); 1461 sav->state = SADB_SASTATE_DEAD; 1462 ipsec_accel_forget_sav(sav); 1463 sah = sav->sah; 1464 SAHTREE_WUNLOCK(); 1465 key_freesav(&sav); 1466 /* Since we are unlinked, release reference to SAH */ 1467 key_freesah(&sah); 1468 } 1469 1470 /* %%% SPD management */ 1471 /* 1472 * search SPD 1473 * OUT: NULL : not found 1474 * others : found, pointer to a SP. 1475 */ 1476 static struct secpolicy * 1477 key_getsp(struct secpolicyindex *spidx) 1478 { 1479 SPTREE_RLOCK_TRACKER; 1480 struct secpolicy *sp; 1481 1482 IPSEC_ASSERT(spidx != NULL, ("null spidx")); 1483 1484 SPTREE_RLOCK(); 1485 TAILQ_FOREACH(sp, &V_sptree[spidx->dir], chain) { 1486 if (key_cmpspidx_exactly(spidx, &sp->spidx)) { 1487 SP_ADDREF(sp); 1488 break; 1489 } 1490 } 1491 SPTREE_RUNLOCK(); 1492 1493 return sp; 1494 } 1495 1496 /* 1497 * get SP by index. 1498 * OUT: NULL : not found 1499 * others : found, pointer to referenced SP. 1500 */ 1501 static struct secpolicy * 1502 key_getspbyid(uint32_t id) 1503 { 1504 SPTREE_RLOCK_TRACKER; 1505 struct secpolicy *sp; 1506 1507 SPTREE_RLOCK(); 1508 LIST_FOREACH(sp, SPHASH_HASH(id), idhash) { 1509 if (sp->id == id) { 1510 SP_ADDREF(sp); 1511 break; 1512 } 1513 } 1514 SPTREE_RUNLOCK(); 1515 return (sp); 1516 } 1517 1518 struct secpolicy * 1519 key_newsp(void) 1520 { 1521 struct secpolicy *sp; 1522 1523 sp = malloc(sizeof(*sp), M_IPSEC_SP, M_NOWAIT | M_ZERO); 1524 if (sp != NULL) 1525 SP_INITREF(sp); 1526 return (sp); 1527 } 1528 1529 struct ipsecrequest * 1530 ipsec_newisr(void) 1531 { 1532 1533 return (malloc(sizeof(struct ipsecrequest), M_IPSEC_SR, 1534 M_NOWAIT | M_ZERO)); 1535 } 1536 1537 void 1538 ipsec_delisr(struct ipsecrequest *p) 1539 { 1540 1541 free(p, M_IPSEC_SR); 1542 } 1543 1544 /* 1545 * create secpolicy structure from sadb_x_policy structure. 1546 * NOTE: `state', `secpolicyindex' and 'id' in secpolicy structure 1547 * are not set, so must be set properly later. 1548 */ 1549 struct secpolicy * 1550 key_msg2sp(struct sadb_x_policy *xpl0, size_t len, int *error) 1551 { 1552 struct secpolicy *newsp; 1553 1554 IPSEC_ASSERT(xpl0 != NULL, ("null xpl0")); 1555 IPSEC_ASSERT(len >= sizeof(*xpl0), ("policy too short: %zu", len)); 1556 1557 if (len != PFKEY_EXTLEN(xpl0)) { 1558 ipseclog((LOG_DEBUG, "%s: Invalid msg length.\n", __func__)); 1559 *error = EINVAL; 1560 return NULL; 1561 } 1562 1563 if ((newsp = key_newsp()) == NULL) { 1564 *error = ENOBUFS; 1565 return NULL; 1566 } 1567 1568 newsp->spidx.dir = xpl0->sadb_x_policy_dir; 1569 newsp->policy = xpl0->sadb_x_policy_type; 1570 newsp->priority = xpl0->sadb_x_policy_priority; 1571 newsp->tcount = 0; 1572 1573 /* check policy */ 1574 switch (xpl0->sadb_x_policy_type) { 1575 case IPSEC_POLICY_DISCARD: 1576 case IPSEC_POLICY_NONE: 1577 case IPSEC_POLICY_ENTRUST: 1578 case IPSEC_POLICY_BYPASS: 1579 break; 1580 1581 case IPSEC_POLICY_IPSEC: 1582 { 1583 struct sadb_x_ipsecrequest *xisr; 1584 struct ipsecrequest *isr; 1585 int tlen; 1586 1587 /* validity check */ 1588 if (PFKEY_EXTLEN(xpl0) < sizeof(*xpl0)) { 1589 ipseclog((LOG_DEBUG, "%s: Invalid msg length.\n", 1590 __func__)); 1591 key_freesp(&newsp); 1592 *error = EINVAL; 1593 return NULL; 1594 } 1595 1596 tlen = PFKEY_EXTLEN(xpl0) - sizeof(*xpl0); 1597 xisr = (struct sadb_x_ipsecrequest *)(xpl0 + 1); 1598 1599 while (tlen > 0) { 1600 /* length check */ 1601 if (xisr->sadb_x_ipsecrequest_len < sizeof(*xisr) || 1602 xisr->sadb_x_ipsecrequest_len > tlen) { 1603 ipseclog((LOG_DEBUG, "%s: invalid ipsecrequest " 1604 "length.\n", __func__)); 1605 key_freesp(&newsp); 1606 *error = EINVAL; 1607 return NULL; 1608 } 1609 1610 if (newsp->tcount >= IPSEC_MAXREQ) { 1611 ipseclog((LOG_DEBUG, 1612 "%s: too many ipsecrequests.\n", 1613 __func__)); 1614 key_freesp(&newsp); 1615 *error = EINVAL; 1616 return (NULL); 1617 } 1618 1619 /* allocate request buffer */ 1620 /* NB: data structure is zero'd */ 1621 isr = ipsec_newisr(); 1622 if (isr == NULL) { 1623 ipseclog((LOG_DEBUG, 1624 "%s: No more memory.\n", __func__)); 1625 key_freesp(&newsp); 1626 *error = ENOBUFS; 1627 return NULL; 1628 } 1629 1630 newsp->req[newsp->tcount++] = isr; 1631 1632 /* set values */ 1633 switch (xisr->sadb_x_ipsecrequest_proto) { 1634 case IPPROTO_ESP: 1635 case IPPROTO_AH: 1636 case IPPROTO_IPCOMP: 1637 break; 1638 default: 1639 ipseclog((LOG_DEBUG, 1640 "%s: invalid proto type=%u\n", __func__, 1641 xisr->sadb_x_ipsecrequest_proto)); 1642 key_freesp(&newsp); 1643 *error = EPROTONOSUPPORT; 1644 return NULL; 1645 } 1646 isr->saidx.proto = 1647 (uint8_t)xisr->sadb_x_ipsecrequest_proto; 1648 1649 switch (xisr->sadb_x_ipsecrequest_mode) { 1650 case IPSEC_MODE_TRANSPORT: 1651 case IPSEC_MODE_TUNNEL: 1652 break; 1653 case IPSEC_MODE_ANY: 1654 default: 1655 ipseclog((LOG_DEBUG, 1656 "%s: invalid mode=%u\n", __func__, 1657 xisr->sadb_x_ipsecrequest_mode)); 1658 key_freesp(&newsp); 1659 *error = EINVAL; 1660 return NULL; 1661 } 1662 isr->saidx.mode = xisr->sadb_x_ipsecrequest_mode; 1663 1664 switch (xisr->sadb_x_ipsecrequest_level) { 1665 case IPSEC_LEVEL_DEFAULT: 1666 case IPSEC_LEVEL_USE: 1667 case IPSEC_LEVEL_REQUIRE: 1668 break; 1669 case IPSEC_LEVEL_UNIQUE: 1670 /* validity check */ 1671 /* 1672 * If range violation of reqid, kernel will 1673 * update it, don't refuse it. 1674 */ 1675 if (xisr->sadb_x_ipsecrequest_reqid 1676 > IPSEC_MANUAL_REQID_MAX) { 1677 ipseclog((LOG_DEBUG, 1678 "%s: reqid=%d range " 1679 "violation, updated by kernel.\n", 1680 __func__, 1681 xisr->sadb_x_ipsecrequest_reqid)); 1682 xisr->sadb_x_ipsecrequest_reqid = 0; 1683 } 1684 1685 /* allocate new reqid id if reqid is zero. */ 1686 if (xisr->sadb_x_ipsecrequest_reqid == 0) { 1687 u_int32_t reqid; 1688 if ((reqid = key_newreqid()) == 0) { 1689 key_freesp(&newsp); 1690 *error = ENOBUFS; 1691 return NULL; 1692 } 1693 isr->saidx.reqid = reqid; 1694 xisr->sadb_x_ipsecrequest_reqid = reqid; 1695 } else { 1696 /* set it for manual keying. */ 1697 isr->saidx.reqid = 1698 xisr->sadb_x_ipsecrequest_reqid; 1699 } 1700 break; 1701 1702 default: 1703 ipseclog((LOG_DEBUG, "%s: invalid level=%u\n", 1704 __func__, 1705 xisr->sadb_x_ipsecrequest_level)); 1706 key_freesp(&newsp); 1707 *error = EINVAL; 1708 return NULL; 1709 } 1710 isr->level = xisr->sadb_x_ipsecrequest_level; 1711 1712 /* set IP addresses if there */ 1713 if (xisr->sadb_x_ipsecrequest_len > sizeof(*xisr)) { 1714 struct sockaddr *paddr; 1715 1716 len = tlen - sizeof(*xisr); 1717 paddr = (struct sockaddr *)(xisr + 1); 1718 /* validity check */ 1719 if (len < sizeof(struct sockaddr) || 1720 len < 2 * paddr->sa_len || 1721 paddr->sa_len > sizeof(isr->saidx.src)) { 1722 ipseclog((LOG_DEBUG, "%s: invalid " 1723 "request address length.\n", 1724 __func__)); 1725 key_freesp(&newsp); 1726 *error = EINVAL; 1727 return NULL; 1728 } 1729 /* 1730 * Request length should be enough to keep 1731 * source and destination addresses. 1732 */ 1733 if (xisr->sadb_x_ipsecrequest_len < 1734 sizeof(*xisr) + 2 * paddr->sa_len) { 1735 ipseclog((LOG_DEBUG, "%s: invalid " 1736 "ipsecrequest length.\n", 1737 __func__)); 1738 key_freesp(&newsp); 1739 *error = EINVAL; 1740 return (NULL); 1741 } 1742 bcopy(paddr, &isr->saidx.src, paddr->sa_len); 1743 paddr = (struct sockaddr *)((caddr_t)paddr + 1744 paddr->sa_len); 1745 1746 /* validity check */ 1747 if (paddr->sa_len != 1748 isr->saidx.src.sa.sa_len) { 1749 ipseclog((LOG_DEBUG, "%s: invalid " 1750 "request address length.\n", 1751 __func__)); 1752 key_freesp(&newsp); 1753 *error = EINVAL; 1754 return NULL; 1755 } 1756 /* AF family should match */ 1757 if (paddr->sa_family != 1758 isr->saidx.src.sa.sa_family) { 1759 ipseclog((LOG_DEBUG, "%s: address " 1760 "family doesn't match.\n", 1761 __func__)); 1762 key_freesp(&newsp); 1763 *error = EINVAL; 1764 return (NULL); 1765 } 1766 bcopy(paddr, &isr->saidx.dst, paddr->sa_len); 1767 } else { 1768 /* 1769 * Addresses for TUNNEL mode requests are 1770 * mandatory. 1771 */ 1772 if (isr->saidx.mode == IPSEC_MODE_TUNNEL) { 1773 ipseclog((LOG_DEBUG, "%s: missing " 1774 "request addresses.\n", __func__)); 1775 key_freesp(&newsp); 1776 *error = EINVAL; 1777 return (NULL); 1778 } 1779 } 1780 tlen -= xisr->sadb_x_ipsecrequest_len; 1781 1782 /* validity check */ 1783 if (tlen < 0) { 1784 ipseclog((LOG_DEBUG, "%s: becoming tlen < 0.\n", 1785 __func__)); 1786 key_freesp(&newsp); 1787 *error = EINVAL; 1788 return NULL; 1789 } 1790 1791 xisr = (struct sadb_x_ipsecrequest *)((caddr_t)xisr 1792 + xisr->sadb_x_ipsecrequest_len); 1793 } 1794 /* XXXAE: LARVAL SP */ 1795 if (newsp->tcount < 1) { 1796 ipseclog((LOG_DEBUG, "%s: valid IPSEC transforms " 1797 "not found.\n", __func__)); 1798 key_freesp(&newsp); 1799 *error = EINVAL; 1800 return (NULL); 1801 } 1802 } 1803 break; 1804 default: 1805 ipseclog((LOG_DEBUG, "%s: invalid policy type.\n", __func__)); 1806 key_freesp(&newsp); 1807 *error = EINVAL; 1808 return NULL; 1809 } 1810 1811 *error = 0; 1812 return (newsp); 1813 } 1814 1815 uint32_t 1816 key_newreqid(void) 1817 { 1818 static uint32_t auto_reqid = IPSEC_MANUAL_REQID_MAX + 1; 1819 1820 if (auto_reqid == ~0) 1821 auto_reqid = IPSEC_MANUAL_REQID_MAX + 1; 1822 else 1823 auto_reqid++; 1824 1825 /* XXX should be unique check */ 1826 return (auto_reqid); 1827 } 1828 1829 /* 1830 * copy secpolicy struct to sadb_x_policy structure indicated. 1831 */ 1832 static struct mbuf * 1833 key_sp2mbuf(struct secpolicy *sp) 1834 { 1835 struct mbuf *m; 1836 size_t tlen; 1837 1838 tlen = key_getspreqmsglen(sp); 1839 m = m_get2(tlen, M_NOWAIT, MT_DATA, 0); 1840 if (m == NULL) 1841 return (NULL); 1842 m_align(m, tlen); 1843 m->m_len = tlen; 1844 if (key_sp2msg(sp, m->m_data, &tlen) != 0) { 1845 m_freem(m); 1846 return (NULL); 1847 } 1848 return (m); 1849 } 1850 1851 int 1852 key_sp2msg(struct secpolicy *sp, void *request, size_t *len) 1853 { 1854 struct sadb_x_ipsecrequest *xisr; 1855 struct sadb_x_policy *xpl; 1856 struct ipsecrequest *isr; 1857 size_t xlen, ilen; 1858 caddr_t p; 1859 int error, i; 1860 #ifdef IPSEC_OFFLOAD 1861 struct sadb_x_if_hw_offl *xif; 1862 #endif 1863 1864 IPSEC_ASSERT(sp != NULL, ("null policy")); 1865 1866 xlen = sizeof(*xpl); 1867 if (*len < xlen) 1868 return (EINVAL); 1869 1870 error = 0; 1871 bzero(request, *len); 1872 xpl = (struct sadb_x_policy *)request; 1873 xpl->sadb_x_policy_exttype = SADB_X_EXT_POLICY; 1874 xpl->sadb_x_policy_type = sp->policy; 1875 xpl->sadb_x_policy_dir = sp->spidx.dir; 1876 xpl->sadb_x_policy_id = sp->id; 1877 xpl->sadb_x_policy_priority = sp->priority; 1878 switch (sp->state) { 1879 case IPSEC_SPSTATE_IFNET: 1880 xpl->sadb_x_policy_scope = IPSEC_POLICYSCOPE_IFNET; 1881 break; 1882 case IPSEC_SPSTATE_PCB: 1883 xpl->sadb_x_policy_scope = IPSEC_POLICYSCOPE_PCB; 1884 break; 1885 default: 1886 xpl->sadb_x_policy_scope = IPSEC_POLICYSCOPE_GLOBAL; 1887 } 1888 1889 /* if is the policy for ipsec ? */ 1890 if (sp->policy == IPSEC_POLICY_IPSEC) { 1891 p = (caddr_t)xpl + sizeof(*xpl); 1892 for (i = 0; i < sp->tcount; i++) { 1893 isr = sp->req[i]; 1894 ilen = PFKEY_ALIGN8(sizeof(*xisr) + 1895 isr->saidx.src.sa.sa_len + 1896 isr->saidx.dst.sa.sa_len); 1897 xlen += ilen; 1898 if (xlen > *len) { 1899 error = ENOBUFS; 1900 /* Calculate needed size */ 1901 continue; 1902 } 1903 xisr = (struct sadb_x_ipsecrequest *)p; 1904 xisr->sadb_x_ipsecrequest_len = ilen; 1905 xisr->sadb_x_ipsecrequest_proto = isr->saidx.proto; 1906 xisr->sadb_x_ipsecrequest_mode = isr->saidx.mode; 1907 xisr->sadb_x_ipsecrequest_level = isr->level; 1908 xisr->sadb_x_ipsecrequest_reqid = isr->saidx.reqid; 1909 1910 p += sizeof(*xisr); 1911 bcopy(&isr->saidx.src, p, isr->saidx.src.sa.sa_len); 1912 p += isr->saidx.src.sa.sa_len; 1913 bcopy(&isr->saidx.dst, p, isr->saidx.dst.sa.sa_len); 1914 p += isr->saidx.dst.sa.sa_len; 1915 } 1916 } 1917 xpl->sadb_x_policy_len = PFKEY_UNIT64(xlen); 1918 #ifdef IPSEC_OFFLOAD 1919 if (error == 0 && sp->accel_ifname != NULL) { 1920 xif = (struct sadb_x_if_hw_offl *)(xpl + 1); 1921 bzero(xif, sizeof(*xif)); 1922 xif->sadb_x_if_hw_offl_len = PFKEY_UNIT64(sizeof(*xif)); 1923 xif->sadb_x_if_hw_offl_exttype = SADB_X_EXT_IF_HW_OFFL; 1924 xif->sadb_x_if_hw_offl_flags = 0; 1925 strncpy(xif->sadb_x_if_hw_offl_if, sp->accel_ifname, 1926 sizeof(xif->sadb_x_if_hw_offl_if)); 1927 xlen += sizeof(*xif); 1928 } 1929 #endif 1930 if (error == 0) 1931 *len = xlen; 1932 else 1933 *len = sizeof(*xpl); 1934 return (error); 1935 } 1936 1937 /* m will not be freed nor modified */ 1938 static struct mbuf * 1939 key_gather_mbuf(struct mbuf *m, const struct sadb_msghdr *mhp, 1940 int ndeep, int nitem, ...) 1941 { 1942 va_list ap; 1943 int idx; 1944 int i; 1945 struct mbuf *result = NULL, *n; 1946 int len; 1947 1948 IPSEC_ASSERT(m != NULL, ("null mbuf")); 1949 IPSEC_ASSERT(mhp != NULL, ("null msghdr")); 1950 1951 va_start(ap, nitem); 1952 for (i = 0; i < nitem; i++) { 1953 idx = va_arg(ap, int); 1954 if (idx < 0 || idx > SADB_EXT_MAX) 1955 goto fail; 1956 /* don't attempt to pull empty extension */ 1957 if (idx == SADB_EXT_RESERVED && mhp->msg == NULL) 1958 continue; 1959 if (idx != SADB_EXT_RESERVED && 1960 (mhp->ext[idx] == NULL || mhp->extlen[idx] == 0)) 1961 continue; 1962 1963 if (idx == SADB_EXT_RESERVED) { 1964 len = PFKEY_ALIGN8(sizeof(struct sadb_msg)); 1965 1966 IPSEC_ASSERT(len <= MHLEN, ("header too big %u", len)); 1967 1968 MGETHDR(n, M_NOWAIT, MT_DATA); 1969 if (!n) 1970 goto fail; 1971 n->m_len = len; 1972 n->m_next = NULL; 1973 m_copydata(m, 0, sizeof(struct sadb_msg), 1974 mtod(n, caddr_t)); 1975 } else if (i < ndeep) { 1976 len = mhp->extlen[idx]; 1977 n = m_get2(len, M_NOWAIT, MT_DATA, 0); 1978 if (n == NULL) 1979 goto fail; 1980 m_align(n, len); 1981 n->m_len = len; 1982 m_copydata(m, mhp->extoff[idx], mhp->extlen[idx], 1983 mtod(n, caddr_t)); 1984 } else { 1985 n = m_copym(m, mhp->extoff[idx], mhp->extlen[idx], 1986 M_NOWAIT); 1987 } 1988 if (n == NULL) 1989 goto fail; 1990 1991 if (result) 1992 m_cat(result, n); 1993 else 1994 result = n; 1995 } 1996 va_end(ap); 1997 1998 if ((result->m_flags & M_PKTHDR) != 0) { 1999 result->m_pkthdr.len = 0; 2000 for (n = result; n; n = n->m_next) 2001 result->m_pkthdr.len += n->m_len; 2002 } 2003 2004 return result; 2005 2006 fail: 2007 m_freem(result); 2008 va_end(ap); 2009 return NULL; 2010 } 2011 2012 /* 2013 * SADB_X_SPDADD, SADB_X_SPDSETIDX or SADB_X_SPDUPDATE processing 2014 * add an entry to SP database, when received 2015 * <base, address(SD), (lifetime(H),) policy> 2016 * from the user(?). 2017 * Adding to SP database, 2018 * and send 2019 * <base, address(SD), (lifetime(H),) policy> 2020 * to the socket which was send. 2021 * 2022 * SPDADD set a unique policy entry. 2023 * SPDSETIDX like SPDADD without a part of policy requests. 2024 * SPDUPDATE replace a unique policy entry. 2025 * 2026 * XXXAE: serialize this in PF_KEY to avoid races. 2027 * m will always be freed. 2028 */ 2029 static int 2030 key_spdadd(struct socket *so, struct mbuf *m, const struct sadb_msghdr *mhp) 2031 { 2032 struct secpolicyindex spidx; 2033 struct sadb_address *src0, *dst0; 2034 struct sadb_x_policy *xpl0, *xpl; 2035 struct sadb_lifetime *lft = NULL; 2036 struct secpolicy *newsp, *oldsp; 2037 int error; 2038 2039 IPSEC_ASSERT(so != NULL, ("null socket")); 2040 IPSEC_ASSERT(m != NULL, ("null mbuf")); 2041 IPSEC_ASSERT(mhp != NULL, ("null msghdr")); 2042 IPSEC_ASSERT(mhp->msg != NULL, ("null msg")); 2043 2044 if (SADB_CHECKHDR(mhp, SADB_EXT_ADDRESS_SRC) || 2045 SADB_CHECKHDR(mhp, SADB_EXT_ADDRESS_DST) || 2046 SADB_CHECKHDR(mhp, SADB_X_EXT_POLICY)) { 2047 ipseclog((LOG_DEBUG, 2048 "%s: invalid message: missing required header.\n", 2049 __func__)); 2050 return key_senderror(so, m, EINVAL); 2051 } 2052 if (SADB_CHECKLEN(mhp, SADB_EXT_ADDRESS_SRC) || 2053 SADB_CHECKLEN(mhp, SADB_EXT_ADDRESS_DST) || 2054 SADB_CHECKLEN(mhp, SADB_X_EXT_POLICY)) { 2055 ipseclog((LOG_DEBUG, 2056 "%s: invalid message: wrong header size.\n", __func__)); 2057 return key_senderror(so, m, EINVAL); 2058 } 2059 if (!SADB_CHECKHDR(mhp, SADB_EXT_LIFETIME_HARD)) { 2060 if (SADB_CHECKLEN(mhp, SADB_EXT_LIFETIME_HARD)) { 2061 ipseclog((LOG_DEBUG, 2062 "%s: invalid message: wrong header size.\n", 2063 __func__)); 2064 return key_senderror(so, m, EINVAL); 2065 } 2066 lft = (struct sadb_lifetime *)mhp->ext[SADB_EXT_LIFETIME_HARD]; 2067 } 2068 2069 src0 = (struct sadb_address *)mhp->ext[SADB_EXT_ADDRESS_SRC]; 2070 dst0 = (struct sadb_address *)mhp->ext[SADB_EXT_ADDRESS_DST]; 2071 xpl0 = (struct sadb_x_policy *)mhp->ext[SADB_X_EXT_POLICY]; 2072 2073 /* check the direciton */ 2074 switch (xpl0->sadb_x_policy_dir) { 2075 case IPSEC_DIR_INBOUND: 2076 case IPSEC_DIR_OUTBOUND: 2077 break; 2078 default: 2079 ipseclog((LOG_DEBUG, "%s: invalid SP direction.\n", __func__)); 2080 return key_senderror(so, m, EINVAL); 2081 } 2082 /* key_spdadd() accepts DISCARD, NONE and IPSEC. */ 2083 if (xpl0->sadb_x_policy_type != IPSEC_POLICY_DISCARD && 2084 xpl0->sadb_x_policy_type != IPSEC_POLICY_NONE && 2085 xpl0->sadb_x_policy_type != IPSEC_POLICY_IPSEC) { 2086 ipseclog((LOG_DEBUG, "%s: invalid policy type.\n", __func__)); 2087 return key_senderror(so, m, EINVAL); 2088 } 2089 2090 /* policy requests are mandatory when action is ipsec. */ 2091 if (xpl0->sadb_x_policy_type == IPSEC_POLICY_IPSEC && 2092 mhp->extlen[SADB_X_EXT_POLICY] <= sizeof(*xpl0)) { 2093 ipseclog((LOG_DEBUG, 2094 "%s: policy requests required.\n", __func__)); 2095 return key_senderror(so, m, EINVAL); 2096 } 2097 2098 error = key_checksockaddrs((struct sockaddr *)(src0 + 1), 2099 (struct sockaddr *)(dst0 + 1)); 2100 if (error != 0 || 2101 src0->sadb_address_proto != dst0->sadb_address_proto) { 2102 ipseclog((LOG_DEBUG, "%s: invalid sockaddr.\n", __func__)); 2103 return key_senderror(so, m, error); 2104 } 2105 /* make secindex */ 2106 KEY_SETSECSPIDX(xpl0->sadb_x_policy_dir, 2107 src0 + 1, 2108 dst0 + 1, 2109 src0->sadb_address_prefixlen, 2110 dst0->sadb_address_prefixlen, 2111 src0->sadb_address_proto, 2112 &spidx); 2113 /* Checking there is SP already or not. */ 2114 oldsp = key_getsp(&spidx); 2115 if (oldsp != NULL) { 2116 if (mhp->msg->sadb_msg_type == SADB_X_SPDUPDATE) { 2117 KEYDBG(KEY_STAMP, 2118 printf("%s: unlink SP(%p) for SPDUPDATE\n", 2119 __func__, oldsp)); 2120 KEYDBG(KEY_DATA, kdebug_secpolicy(oldsp)); 2121 } else { 2122 key_freesp(&oldsp); 2123 ipseclog((LOG_DEBUG, 2124 "%s: a SP entry exists already.\n", __func__)); 2125 return (key_senderror(so, m, EEXIST)); 2126 } 2127 } 2128 2129 /* allocate new SP entry */ 2130 if ((newsp = key_msg2sp(xpl0, PFKEY_EXTLEN(xpl0), &error)) == NULL) { 2131 if (oldsp != NULL) { 2132 key_unlink(oldsp); 2133 key_freesp(&oldsp); /* second for our reference */ 2134 } 2135 return key_senderror(so, m, error); 2136 } 2137 2138 newsp->lastused = newsp->created = time_second; 2139 newsp->lifetime = lft ? lft->sadb_lifetime_addtime : 0; 2140 newsp->validtime = lft ? lft->sadb_lifetime_usetime : 0; 2141 bcopy(&spidx, &newsp->spidx, sizeof(spidx)); 2142 #ifdef IPSEC_OFFLOAD 2143 if (!SADB_CHECKHDR(mhp, SADB_X_EXT_IF_HW_OFFL) && 2144 !SADB_CHECKLEN(mhp, SADB_X_EXT_IF_HW_OFFL)) { 2145 struct sadb_x_if_hw_offl *xof; 2146 2147 xof = (struct sadb_x_if_hw_offl *)mhp->ext[ 2148 SADB_X_EXT_IF_HW_OFFL]; 2149 newsp->accel_ifname = malloc(sizeof(xof->sadb_x_if_hw_offl_if), 2150 M_IPSEC_MISC, M_NOWAIT); 2151 if (newsp->accel_ifname == NULL) { 2152 ipseclog((LOG_DEBUG, "%s: cannot alloc accel_ifname.\n", 2153 __func__)); 2154 key_freesp(&newsp); 2155 return (key_senderror(so, m, error)); 2156 } 2157 strncpy(__DECONST(char *, newsp->accel_ifname), 2158 xof->sadb_x_if_hw_offl_if, 2159 sizeof(xof->sadb_x_if_hw_offl_if)); 2160 } 2161 2162 #endif 2163 2164 SPTREE_WLOCK(); 2165 if ((newsp->id = key_getnewspid()) == 0) { 2166 if (oldsp != NULL) 2167 key_detach(oldsp); 2168 SPTREE_WUNLOCK(); 2169 if (oldsp != NULL) { 2170 ipsec_accel_sync(); 2171 key_freesp(&oldsp); /* first for key_detach */ 2172 IPSEC_ASSERT(oldsp != NULL, ("null oldsp: refcount bug")); 2173 key_freesp(&oldsp); /* second for our reference */ 2174 if (SPDCACHE_ENABLED()) /* refresh cache because of key_detach */ 2175 spdcache_clear(); 2176 } 2177 key_freesp(&newsp); 2178 return key_senderror(so, m, ENOBUFS); 2179 } 2180 if (oldsp != NULL) 2181 key_detach(oldsp); 2182 key_insertsp(newsp); 2183 SPTREE_WUNLOCK(); 2184 if (oldsp != NULL) { 2185 ipsec_accel_sync(); 2186 key_freesp(&oldsp); /* first for key_detach */ 2187 IPSEC_ASSERT(oldsp != NULL, ("null oldsp: refcount bug")); 2188 key_freesp(&oldsp); /* second for our reference */ 2189 } 2190 if (SPDCACHE_ENABLED()) 2191 spdcache_clear(); 2192 KEYDBG(KEY_STAMP, 2193 printf("%s: SP(%p)\n", __func__, newsp)); 2194 KEYDBG(KEY_DATA, kdebug_secpolicy(newsp)); 2195 2196 { 2197 struct mbuf *n, *mpolicy; 2198 struct sadb_msg *newmsg; 2199 int off; 2200 2201 /* create new sadb_msg to reply. */ 2202 if (lft) { 2203 n = key_gather_mbuf(m, mhp, 2, 5, SADB_EXT_RESERVED, 2204 SADB_X_EXT_POLICY, SADB_EXT_LIFETIME_HARD, 2205 SADB_EXT_ADDRESS_SRC, SADB_EXT_ADDRESS_DST); 2206 } else { 2207 n = key_gather_mbuf(m, mhp, 2, 4, SADB_EXT_RESERVED, 2208 SADB_X_EXT_POLICY, 2209 SADB_EXT_ADDRESS_SRC, SADB_EXT_ADDRESS_DST); 2210 } 2211 if (!n) 2212 return key_senderror(so, m, ENOBUFS); 2213 2214 if (n->m_len < sizeof(*newmsg)) { 2215 n = m_pullup(n, sizeof(*newmsg)); 2216 if (!n) 2217 return key_senderror(so, m, ENOBUFS); 2218 } 2219 newmsg = mtod(n, struct sadb_msg *); 2220 newmsg->sadb_msg_errno = 0; 2221 newmsg->sadb_msg_len = PFKEY_UNIT64(n->m_pkthdr.len); 2222 2223 off = 0; 2224 mpolicy = m_pulldown(n, PFKEY_ALIGN8(sizeof(struct sadb_msg)), 2225 sizeof(*xpl), &off); 2226 if (mpolicy == NULL) { 2227 /* n is already freed */ 2228 return key_senderror(so, m, ENOBUFS); 2229 } 2230 xpl = (struct sadb_x_policy *)(mtod(mpolicy, caddr_t) + off); 2231 if (xpl->sadb_x_policy_exttype != SADB_X_EXT_POLICY) { 2232 m_freem(n); 2233 return key_senderror(so, m, EINVAL); 2234 } 2235 xpl->sadb_x_policy_id = newsp->id; 2236 2237 m_freem(m); 2238 return key_sendup_mbuf(so, n, KEY_SENDUP_ALL); 2239 } 2240 } 2241 2242 /* 2243 * get new policy id. 2244 * OUT: 2245 * 0: failure. 2246 * others: success. 2247 */ 2248 static uint32_t 2249 key_getnewspid(void) 2250 { 2251 struct secpolicy *sp; 2252 uint32_t newid = 0; 2253 int tries, limit; 2254 2255 SPTREE_WLOCK_ASSERT(); 2256 2257 limit = atomic_load_int(&V_key_spi_trycnt); 2258 for (tries = 0; tries < limit; tries++) { 2259 if (V_policy_id == ~0) /* overflowed */ 2260 newid = V_policy_id = 1; 2261 else 2262 newid = ++V_policy_id; 2263 LIST_FOREACH(sp, SPHASH_HASH(newid), idhash) { 2264 if (sp->id == newid) 2265 break; 2266 } 2267 if (sp == NULL) 2268 break; 2269 } 2270 if (tries == limit || newid == 0) { 2271 ipseclog((LOG_DEBUG, "%s: failed to allocate policy id.\n", 2272 __func__)); 2273 return (0); 2274 } 2275 return (newid); 2276 } 2277 2278 /* 2279 * SADB_SPDDELETE processing 2280 * receive 2281 * <base, address(SD), policy(*)> 2282 * from the user(?), and set SADB_SASTATE_DEAD, 2283 * and send, 2284 * <base, address(SD), policy(*)> 2285 * to the ikmpd. 2286 * policy(*) including direction of policy. 2287 * 2288 * m will always be freed. 2289 */ 2290 static int 2291 key_spddelete(struct socket *so, struct mbuf *m, 2292 const struct sadb_msghdr *mhp) 2293 { 2294 struct secpolicyindex spidx; 2295 struct sadb_address *src0, *dst0; 2296 struct sadb_x_policy *xpl0; 2297 struct secpolicy *sp; 2298 2299 IPSEC_ASSERT(so != NULL, ("null so")); 2300 IPSEC_ASSERT(m != NULL, ("null mbuf")); 2301 IPSEC_ASSERT(mhp != NULL, ("null msghdr")); 2302 IPSEC_ASSERT(mhp->msg != NULL, ("null msg")); 2303 2304 if (SADB_CHECKHDR(mhp, SADB_EXT_ADDRESS_SRC) || 2305 SADB_CHECKHDR(mhp, SADB_EXT_ADDRESS_DST) || 2306 SADB_CHECKHDR(mhp, SADB_X_EXT_POLICY)) { 2307 ipseclog((LOG_DEBUG, 2308 "%s: invalid message: missing required header.\n", 2309 __func__)); 2310 return key_senderror(so, m, EINVAL); 2311 } 2312 if (SADB_CHECKLEN(mhp, SADB_EXT_ADDRESS_SRC) || 2313 SADB_CHECKLEN(mhp, SADB_EXT_ADDRESS_DST) || 2314 SADB_CHECKLEN(mhp, SADB_X_EXT_POLICY)) { 2315 ipseclog((LOG_DEBUG, 2316 "%s: invalid message: wrong header size.\n", __func__)); 2317 return key_senderror(so, m, EINVAL); 2318 } 2319 2320 src0 = (struct sadb_address *)mhp->ext[SADB_EXT_ADDRESS_SRC]; 2321 dst0 = (struct sadb_address *)mhp->ext[SADB_EXT_ADDRESS_DST]; 2322 xpl0 = (struct sadb_x_policy *)mhp->ext[SADB_X_EXT_POLICY]; 2323 2324 /* check the direciton */ 2325 switch (xpl0->sadb_x_policy_dir) { 2326 case IPSEC_DIR_INBOUND: 2327 case IPSEC_DIR_OUTBOUND: 2328 break; 2329 default: 2330 ipseclog((LOG_DEBUG, "%s: invalid SP direction.\n", __func__)); 2331 return key_senderror(so, m, EINVAL); 2332 } 2333 /* Only DISCARD, NONE and IPSEC are allowed */ 2334 if (xpl0->sadb_x_policy_type != IPSEC_POLICY_DISCARD && 2335 xpl0->sadb_x_policy_type != IPSEC_POLICY_NONE && 2336 xpl0->sadb_x_policy_type != IPSEC_POLICY_IPSEC) { 2337 ipseclog((LOG_DEBUG, "%s: invalid policy type.\n", __func__)); 2338 return key_senderror(so, m, EINVAL); 2339 } 2340 if (key_checksockaddrs((struct sockaddr *)(src0 + 1), 2341 (struct sockaddr *)(dst0 + 1)) != 0 || 2342 src0->sadb_address_proto != dst0->sadb_address_proto) { 2343 ipseclog((LOG_DEBUG, "%s: invalid sockaddr.\n", __func__)); 2344 return key_senderror(so, m, EINVAL); 2345 } 2346 /* make secindex */ 2347 KEY_SETSECSPIDX(xpl0->sadb_x_policy_dir, 2348 src0 + 1, 2349 dst0 + 1, 2350 src0->sadb_address_prefixlen, 2351 dst0->sadb_address_prefixlen, 2352 src0->sadb_address_proto, 2353 &spidx); 2354 2355 /* Is there SP in SPD ? */ 2356 if ((sp = key_getsp(&spidx)) == NULL) { 2357 ipseclog((LOG_DEBUG, "%s: no SP found.\n", __func__)); 2358 return key_senderror(so, m, EINVAL); 2359 } 2360 2361 /* save policy id to buffer to be returned. */ 2362 xpl0->sadb_x_policy_id = sp->id; 2363 2364 KEYDBG(KEY_STAMP, 2365 printf("%s: SP(%p)\n", __func__, sp)); 2366 KEYDBG(KEY_DATA, kdebug_secpolicy(sp)); 2367 ipsec_accel_spddel(sp); 2368 key_unlink(sp); 2369 key_freesp(&sp); 2370 2371 { 2372 struct mbuf *n; 2373 struct sadb_msg *newmsg; 2374 2375 /* create new sadb_msg to reply. */ 2376 n = key_gather_mbuf(m, mhp, 1, 4, SADB_EXT_RESERVED, 2377 SADB_X_EXT_POLICY, SADB_EXT_ADDRESS_SRC, SADB_EXT_ADDRESS_DST); 2378 if (!n) 2379 return key_senderror(so, m, ENOBUFS); 2380 2381 newmsg = mtod(n, struct sadb_msg *); 2382 newmsg->sadb_msg_errno = 0; 2383 newmsg->sadb_msg_len = PFKEY_UNIT64(n->m_pkthdr.len); 2384 2385 m_freem(m); 2386 return key_sendup_mbuf(so, n, KEY_SENDUP_ALL); 2387 } 2388 } 2389 2390 /* 2391 * SADB_SPDDELETE2 processing 2392 * receive 2393 * <base, policy(*)> 2394 * from the user(?), and set SADB_SASTATE_DEAD, 2395 * and send, 2396 * <base, policy(*)> 2397 * to the ikmpd. 2398 * policy(*) including direction of policy. 2399 * 2400 * m will always be freed. 2401 */ 2402 static int 2403 key_spddelete2(struct socket *so, struct mbuf *m, 2404 const struct sadb_msghdr *mhp) 2405 { 2406 struct secpolicy *sp; 2407 uint32_t id; 2408 2409 IPSEC_ASSERT(so != NULL, ("null socket")); 2410 IPSEC_ASSERT(m != NULL, ("null mbuf")); 2411 IPSEC_ASSERT(mhp != NULL, ("null msghdr")); 2412 IPSEC_ASSERT(mhp->msg != NULL, ("null msg")); 2413 2414 if (SADB_CHECKHDR(mhp, SADB_X_EXT_POLICY) || 2415 SADB_CHECKLEN(mhp, SADB_X_EXT_POLICY)) { 2416 ipseclog((LOG_DEBUG, "%s: invalid message is passed.\n", 2417 __func__)); 2418 return key_senderror(so, m, EINVAL); 2419 } 2420 2421 id = ((struct sadb_x_policy *) 2422 mhp->ext[SADB_X_EXT_POLICY])->sadb_x_policy_id; 2423 2424 /* Is there SP in SPD ? */ 2425 if ((sp = key_getspbyid(id)) == NULL) { 2426 ipseclog((LOG_DEBUG, "%s: no SP found for id %u.\n", 2427 __func__, id)); 2428 return key_senderror(so, m, EINVAL); 2429 } 2430 2431 KEYDBG(KEY_STAMP, 2432 printf("%s: SP(%p)\n", __func__, sp)); 2433 KEYDBG(KEY_DATA, kdebug_secpolicy(sp)); 2434 key_unlink(sp); 2435 if (sp->state != IPSEC_SPSTATE_DEAD) { 2436 ipseclog((LOG_DEBUG, "%s: failed to delete SP with id %u.\n", 2437 __func__, id)); 2438 key_freesp(&sp); 2439 return (key_senderror(so, m, EACCES)); 2440 } 2441 key_freesp(&sp); 2442 2443 { 2444 struct mbuf *n, *nn; 2445 struct sadb_msg *newmsg; 2446 int off, len; 2447 2448 /* create new sadb_msg to reply. */ 2449 len = PFKEY_ALIGN8(sizeof(struct sadb_msg)); 2450 2451 n = key_mget(len); 2452 if (n == NULL) 2453 return key_senderror(so, m, ENOBUFS); 2454 2455 n->m_len = len; 2456 n->m_next = NULL; 2457 off = 0; 2458 2459 m_copydata(m, 0, sizeof(struct sadb_msg), mtod(n, caddr_t) + off); 2460 off += PFKEY_ALIGN8(sizeof(struct sadb_msg)); 2461 2462 IPSEC_ASSERT(off == len, ("length inconsistency (off %u len %u)", 2463 off, len)); 2464 2465 n->m_next = m_copym(m, mhp->extoff[SADB_X_EXT_POLICY], 2466 mhp->extlen[SADB_X_EXT_POLICY], M_NOWAIT); 2467 if (!n->m_next) { 2468 m_freem(n); 2469 return key_senderror(so, m, ENOBUFS); 2470 } 2471 2472 n->m_pkthdr.len = 0; 2473 for (nn = n; nn; nn = nn->m_next) 2474 n->m_pkthdr.len += nn->m_len; 2475 2476 newmsg = mtod(n, struct sadb_msg *); 2477 newmsg->sadb_msg_errno = 0; 2478 newmsg->sadb_msg_len = PFKEY_UNIT64(n->m_pkthdr.len); 2479 2480 m_freem(m); 2481 return key_sendup_mbuf(so, n, KEY_SENDUP_ALL); 2482 } 2483 } 2484 2485 /* 2486 * SADB_X_SPDGET processing 2487 * receive 2488 * <base, policy(*)> 2489 * from the user(?), 2490 * and send, 2491 * <base, address(SD), policy> 2492 * to the ikmpd. 2493 * policy(*) including direction of policy. 2494 * 2495 * m will always be freed. 2496 */ 2497 static int 2498 key_spdget(struct socket *so, struct mbuf *m, const struct sadb_msghdr *mhp) 2499 { 2500 struct secpolicy *sp; 2501 struct mbuf *n; 2502 uint32_t id; 2503 2504 IPSEC_ASSERT(so != NULL, ("null socket")); 2505 IPSEC_ASSERT(m != NULL, ("null mbuf")); 2506 IPSEC_ASSERT(mhp != NULL, ("null msghdr")); 2507 IPSEC_ASSERT(mhp->msg != NULL, ("null msg")); 2508 2509 if (SADB_CHECKHDR(mhp, SADB_X_EXT_POLICY) || 2510 SADB_CHECKLEN(mhp, SADB_X_EXT_POLICY)) { 2511 ipseclog((LOG_DEBUG, "%s: invalid message is passed.\n", 2512 __func__)); 2513 return key_senderror(so, m, EINVAL); 2514 } 2515 2516 id = ((struct sadb_x_policy *) 2517 mhp->ext[SADB_X_EXT_POLICY])->sadb_x_policy_id; 2518 2519 /* Is there SP in SPD ? */ 2520 if ((sp = key_getspbyid(id)) == NULL) { 2521 ipseclog((LOG_DEBUG, "%s: no SP found for id %u.\n", 2522 __func__, id)); 2523 return key_senderror(so, m, ENOENT); 2524 } 2525 2526 n = key_setdumpsp(sp, SADB_X_SPDGET, mhp->msg->sadb_msg_seq, 2527 mhp->msg->sadb_msg_pid); 2528 key_freesp(&sp); 2529 if (n != NULL) { 2530 m_freem(m); 2531 return key_sendup_mbuf(so, n, KEY_SENDUP_ONE); 2532 } else 2533 return key_senderror(so, m, ENOBUFS); 2534 } 2535 2536 /* 2537 * SADB_X_SPDACQUIRE processing. 2538 * Acquire policy and SA(s) for a *OUTBOUND* packet. 2539 * send 2540 * <base, policy(*)> 2541 * to KMD, and expect to receive 2542 * <base> with SADB_X_SPDACQUIRE if error occurred, 2543 * or 2544 * <base, policy> 2545 * with SADB_X_SPDUPDATE from KMD by PF_KEY. 2546 * policy(*) is without policy requests. 2547 * 2548 * 0 : succeed 2549 * others: error number 2550 */ 2551 int 2552 key_spdacquire(struct secpolicy *sp) 2553 { 2554 struct mbuf *result = NULL, *m; 2555 struct secspacq *newspacq; 2556 2557 IPSEC_ASSERT(sp != NULL, ("null secpolicy")); 2558 IPSEC_ASSERT(sp->req == NULL, ("policy exists")); 2559 IPSEC_ASSERT(sp->policy == IPSEC_POLICY_IPSEC, 2560 ("policy not IPSEC %u", sp->policy)); 2561 2562 /* Get an entry to check whether sent message or not. */ 2563 newspacq = key_getspacq(&sp->spidx); 2564 if (newspacq != NULL) { 2565 if (V_key_blockacq_count < newspacq->count) { 2566 /* reset counter and do send message. */ 2567 newspacq->count = 0; 2568 } else { 2569 /* increment counter and do nothing. */ 2570 newspacq->count++; 2571 SPACQ_UNLOCK(); 2572 return (0); 2573 } 2574 SPACQ_UNLOCK(); 2575 } else { 2576 /* make new entry for blocking to send SADB_ACQUIRE. */ 2577 newspacq = key_newspacq(&sp->spidx); 2578 if (newspacq == NULL) 2579 return ENOBUFS; 2580 } 2581 2582 /* create new sadb_msg to reply. */ 2583 m = key_setsadbmsg(SADB_X_SPDACQUIRE, 0, 0, 0, 0, 0); 2584 if (!m) 2585 return ENOBUFS; 2586 2587 result = m; 2588 2589 result->m_pkthdr.len = 0; 2590 for (m = result; m; m = m->m_next) 2591 result->m_pkthdr.len += m->m_len; 2592 2593 mtod(result, struct sadb_msg *)->sadb_msg_len = 2594 PFKEY_UNIT64(result->m_pkthdr.len); 2595 2596 return key_sendup_mbuf(NULL, m, KEY_SENDUP_REGISTERED); 2597 } 2598 2599 /* 2600 * SADB_SPDFLUSH processing 2601 * receive 2602 * <base> 2603 * from the user, and free all entries in secpctree. 2604 * and send, 2605 * <base> 2606 * to the user. 2607 * NOTE: what to do is only marking SADB_SASTATE_DEAD. 2608 * 2609 * m will always be freed. 2610 */ 2611 static int 2612 key_spdflush(struct socket *so, struct mbuf *m, const struct sadb_msghdr *mhp) 2613 { 2614 struct secpolicy_queue drainq; 2615 struct sadb_msg *newmsg; 2616 struct secpolicy *sp, *nextsp; 2617 u_int dir; 2618 2619 IPSEC_ASSERT(so != NULL, ("null socket")); 2620 IPSEC_ASSERT(m != NULL, ("null mbuf")); 2621 IPSEC_ASSERT(mhp != NULL, ("null msghdr")); 2622 IPSEC_ASSERT(mhp->msg != NULL, ("null msg")); 2623 2624 if (m->m_len != PFKEY_ALIGN8(sizeof(struct sadb_msg))) 2625 return key_senderror(so, m, EINVAL); 2626 2627 TAILQ_INIT(&drainq); 2628 SPTREE_WLOCK(); 2629 for (dir = 0; dir < IPSEC_DIR_MAX; dir++) { 2630 TAILQ_CONCAT(&drainq, &V_sptree[dir], chain); 2631 } 2632 /* 2633 * We need to set state to DEAD for each policy to be sure, 2634 * that another thread won't try to unlink it. 2635 * Also remove SP from sphash. 2636 */ 2637 TAILQ_FOREACH(sp, &drainq, chain) { 2638 sp->state = IPSEC_SPSTATE_DEAD; 2639 ipsec_accel_spddel(sp); 2640 LIST_REMOVE(sp, idhash); 2641 } 2642 V_sp_genid++; 2643 V_spd_size = 0; 2644 SPTREE_WUNLOCK(); 2645 if (SPDCACHE_ENABLED()) 2646 spdcache_clear(); 2647 sp = TAILQ_FIRST(&drainq); 2648 while (sp != NULL) { 2649 nextsp = TAILQ_NEXT(sp, chain); 2650 key_freesp(&sp); 2651 sp = nextsp; 2652 } 2653 2654 if (sizeof(struct sadb_msg) > m->m_len + M_TRAILINGSPACE(m)) { 2655 ipseclog((LOG_DEBUG, "%s: No more memory.\n", __func__)); 2656 return key_senderror(so, m, ENOBUFS); 2657 } 2658 2659 if (m->m_next) 2660 m_freem(m->m_next); 2661 m->m_next = NULL; 2662 m->m_pkthdr.len = m->m_len = PFKEY_ALIGN8(sizeof(struct sadb_msg)); 2663 newmsg = mtod(m, struct sadb_msg *); 2664 newmsg->sadb_msg_errno = 0; 2665 newmsg->sadb_msg_len = PFKEY_UNIT64(m->m_pkthdr.len); 2666 2667 return key_sendup_mbuf(so, m, KEY_SENDUP_ALL); 2668 } 2669 2670 static uint8_t 2671 key_satype2scopemask(uint8_t satype) 2672 { 2673 2674 if (satype == IPSEC_POLICYSCOPE_ANY) 2675 return (0xff); 2676 return (satype); 2677 } 2678 /* 2679 * SADB_SPDDUMP processing 2680 * receive 2681 * <base> 2682 * from the user, and dump all SP leaves and send, 2683 * <base> ..... 2684 * to the ikmpd. 2685 * 2686 * NOTE: 2687 * sadb_msg_satype is considered as mask of policy scopes. 2688 * m will always be freed. 2689 */ 2690 static int 2691 key_spddump(struct socket *so, struct mbuf *m, const struct sadb_msghdr *mhp) 2692 { 2693 SPTREE_RLOCK_TRACKER; 2694 struct secpolicy *sp; 2695 struct mbuf *n; 2696 int cnt; 2697 u_int dir, scope; 2698 2699 IPSEC_ASSERT(so != NULL, ("null socket")); 2700 IPSEC_ASSERT(m != NULL, ("null mbuf")); 2701 IPSEC_ASSERT(mhp != NULL, ("null msghdr")); 2702 IPSEC_ASSERT(mhp->msg != NULL, ("null msg")); 2703 2704 /* search SPD entry and get buffer size. */ 2705 cnt = 0; 2706 scope = key_satype2scopemask(mhp->msg->sadb_msg_satype); 2707 SPTREE_RLOCK(); 2708 for (dir = 0; dir < IPSEC_DIR_MAX; dir++) { 2709 if (scope & IPSEC_POLICYSCOPE_GLOBAL) { 2710 TAILQ_FOREACH(sp, &V_sptree[dir], chain) 2711 cnt++; 2712 } 2713 if (scope & IPSEC_POLICYSCOPE_IFNET) { 2714 TAILQ_FOREACH(sp, &V_sptree_ifnet[dir], chain) 2715 cnt++; 2716 } 2717 } 2718 2719 if (cnt == 0) { 2720 SPTREE_RUNLOCK(); 2721 return key_senderror(so, m, ENOENT); 2722 } 2723 2724 for (dir = 0; dir < IPSEC_DIR_MAX; dir++) { 2725 if (scope & IPSEC_POLICYSCOPE_GLOBAL) { 2726 TAILQ_FOREACH(sp, &V_sptree[dir], chain) { 2727 --cnt; 2728 n = key_setdumpsp(sp, SADB_X_SPDDUMP, cnt, 2729 mhp->msg->sadb_msg_pid); 2730 2731 if (n != NULL) 2732 key_sendup_mbuf(so, n, KEY_SENDUP_ONE); 2733 } 2734 } 2735 if (scope & IPSEC_POLICYSCOPE_IFNET) { 2736 TAILQ_FOREACH(sp, &V_sptree_ifnet[dir], chain) { 2737 --cnt; 2738 n = key_setdumpsp(sp, SADB_X_SPDDUMP, cnt, 2739 mhp->msg->sadb_msg_pid); 2740 2741 if (n != NULL) 2742 key_sendup_mbuf(so, n, KEY_SENDUP_ONE); 2743 } 2744 } 2745 } 2746 2747 SPTREE_RUNLOCK(); 2748 m_freem(m); 2749 return (0); 2750 } 2751 2752 static struct mbuf * 2753 key_setdumpsp(struct secpolicy *sp, u_int8_t type, u_int32_t seq, 2754 u_int32_t pid) 2755 { 2756 struct mbuf *result = NULL, *m; 2757 struct seclifetime lt; 2758 2759 m = key_setsadbmsg(type, 0, SADB_SATYPE_UNSPEC, seq, pid, sp->refcnt); 2760 if (!m) 2761 goto fail; 2762 result = m; 2763 2764 m = key_setsadbaddr(SADB_EXT_ADDRESS_SRC, 2765 &sp->spidx.src.sa, sp->spidx.prefs, 2766 sp->spidx.ul_proto); 2767 if (!m) 2768 goto fail; 2769 m_cat(result, m); 2770 2771 m = key_setsadbaddr(SADB_EXT_ADDRESS_DST, 2772 &sp->spidx.dst.sa, sp->spidx.prefd, 2773 sp->spidx.ul_proto); 2774 if (!m) 2775 goto fail; 2776 m_cat(result, m); 2777 2778 m = key_sp2mbuf(sp); 2779 if (!m) 2780 goto fail; 2781 m_cat(result, m); 2782 2783 if(sp->lifetime){ 2784 lt.addtime=sp->created; 2785 lt.usetime= sp->lastused; 2786 m = key_setlifetime(<, SADB_EXT_LIFETIME_CURRENT); 2787 if (!m) 2788 goto fail; 2789 m_cat(result, m); 2790 2791 lt.addtime=sp->lifetime; 2792 lt.usetime= sp->validtime; 2793 m = key_setlifetime(<, SADB_EXT_LIFETIME_HARD); 2794 if (!m) 2795 goto fail; 2796 m_cat(result, m); 2797 } 2798 2799 if ((result->m_flags & M_PKTHDR) == 0) 2800 goto fail; 2801 2802 if (result->m_len < sizeof(struct sadb_msg)) { 2803 result = m_pullup(result, sizeof(struct sadb_msg)); 2804 if (result == NULL) 2805 goto fail; 2806 } 2807 2808 result->m_pkthdr.len = 0; 2809 for (m = result; m; m = m->m_next) 2810 result->m_pkthdr.len += m->m_len; 2811 2812 mtod(result, struct sadb_msg *)->sadb_msg_len = 2813 PFKEY_UNIT64(result->m_pkthdr.len); 2814 2815 return result; 2816 2817 fail: 2818 m_freem(result); 2819 return NULL; 2820 } 2821 /* 2822 * get PFKEY message length for security policy and request. 2823 */ 2824 static size_t 2825 key_getspreqmsglen(struct secpolicy *sp) 2826 { 2827 size_t tlen, len; 2828 int i; 2829 2830 tlen = sizeof(struct sadb_x_policy); 2831 /* if is the policy for ipsec ? */ 2832 if (sp->policy != IPSEC_POLICY_IPSEC) 2833 return (tlen); 2834 2835 /* get length of ipsec requests */ 2836 for (i = 0; i < sp->tcount; i++) { 2837 len = sizeof(struct sadb_x_ipsecrequest) 2838 + sp->req[i]->saidx.src.sa.sa_len 2839 + sp->req[i]->saidx.dst.sa.sa_len; 2840 2841 tlen += PFKEY_ALIGN8(len); 2842 } 2843 #ifdef IPSEC_OFFLOAD 2844 if (sp->accel_ifname != NULL) 2845 tlen += sizeof(struct sadb_x_if_hw_offl); 2846 #endif 2847 return (tlen); 2848 } 2849 2850 /* 2851 * SADB_SPDEXPIRE processing 2852 * send 2853 * <base, address(SD), lifetime(CH), policy> 2854 * to KMD by PF_KEY. 2855 * 2856 * OUT: 0 : succeed 2857 * others : error number 2858 */ 2859 static int 2860 key_spdexpire(struct secpolicy *sp) 2861 { 2862 struct sadb_lifetime *lt; 2863 struct mbuf *result = NULL, *m; 2864 int len, error = -1; 2865 2866 IPSEC_ASSERT(sp != NULL, ("null secpolicy")); 2867 2868 KEYDBG(KEY_STAMP, 2869 printf("%s: SP(%p)\n", __func__, sp)); 2870 KEYDBG(KEY_DATA, kdebug_secpolicy(sp)); 2871 2872 /* set msg header */ 2873 m = key_setsadbmsg(SADB_X_SPDEXPIRE, 0, 0, 0, 0, 0); 2874 if (!m) { 2875 error = ENOBUFS; 2876 goto fail; 2877 } 2878 result = m; 2879 2880 /* create lifetime extension (current and hard) */ 2881 len = PFKEY_ALIGN8(sizeof(*lt)) * 2; 2882 m = m_get2(len, M_NOWAIT, MT_DATA, 0); 2883 if (m == NULL) { 2884 error = ENOBUFS; 2885 goto fail; 2886 } 2887 m_align(m, len); 2888 m->m_len = len; 2889 bzero(mtod(m, caddr_t), len); 2890 lt = mtod(m, struct sadb_lifetime *); 2891 lt->sadb_lifetime_len = PFKEY_UNIT64(sizeof(struct sadb_lifetime)); 2892 lt->sadb_lifetime_exttype = SADB_EXT_LIFETIME_CURRENT; 2893 lt->sadb_lifetime_allocations = 0; 2894 lt->sadb_lifetime_bytes = 0; 2895 lt->sadb_lifetime_addtime = sp->created; 2896 lt->sadb_lifetime_usetime = sp->lastused; 2897 lt = (struct sadb_lifetime *)(mtod(m, caddr_t) + len / 2); 2898 lt->sadb_lifetime_len = PFKEY_UNIT64(sizeof(struct sadb_lifetime)); 2899 lt->sadb_lifetime_exttype = SADB_EXT_LIFETIME_HARD; 2900 lt->sadb_lifetime_allocations = 0; 2901 lt->sadb_lifetime_bytes = 0; 2902 lt->sadb_lifetime_addtime = sp->lifetime; 2903 lt->sadb_lifetime_usetime = sp->validtime; 2904 m_cat(result, m); 2905 2906 /* set sadb_address for source */ 2907 m = key_setsadbaddr(SADB_EXT_ADDRESS_SRC, 2908 &sp->spidx.src.sa, 2909 sp->spidx.prefs, sp->spidx.ul_proto); 2910 if (!m) { 2911 error = ENOBUFS; 2912 goto fail; 2913 } 2914 m_cat(result, m); 2915 2916 /* set sadb_address for destination */ 2917 m = key_setsadbaddr(SADB_EXT_ADDRESS_DST, 2918 &sp->spidx.dst.sa, 2919 sp->spidx.prefd, sp->spidx.ul_proto); 2920 if (!m) { 2921 error = ENOBUFS; 2922 goto fail; 2923 } 2924 m_cat(result, m); 2925 2926 /* set secpolicy */ 2927 m = key_sp2mbuf(sp); 2928 if (!m) { 2929 error = ENOBUFS; 2930 goto fail; 2931 } 2932 m_cat(result, m); 2933 2934 if ((result->m_flags & M_PKTHDR) == 0) { 2935 error = EINVAL; 2936 goto fail; 2937 } 2938 2939 if (result->m_len < sizeof(struct sadb_msg)) { 2940 result = m_pullup(result, sizeof(struct sadb_msg)); 2941 if (result == NULL) { 2942 error = ENOBUFS; 2943 goto fail; 2944 } 2945 } 2946 2947 result->m_pkthdr.len = 0; 2948 for (m = result; m; m = m->m_next) 2949 result->m_pkthdr.len += m->m_len; 2950 2951 mtod(result, struct sadb_msg *)->sadb_msg_len = 2952 PFKEY_UNIT64(result->m_pkthdr.len); 2953 2954 return key_sendup_mbuf(NULL, result, KEY_SENDUP_REGISTERED); 2955 2956 fail: 2957 if (result) 2958 m_freem(result); 2959 return error; 2960 } 2961 2962 /* %%% SAD management */ 2963 /* 2964 * allocating and initialize new SA head. 2965 * OUT: NULL : failure due to the lack of memory. 2966 * others : pointer to new SA head. 2967 */ 2968 static struct secashead * 2969 key_newsah(struct secasindex *saidx) 2970 { 2971 struct secashead *sah; 2972 2973 sah = malloc(sizeof(struct secashead), M_IPSEC_SAH, 2974 M_NOWAIT | M_ZERO); 2975 if (sah == NULL) { 2976 PFKEYSTAT_INC(in_nomem); 2977 return (NULL); 2978 } 2979 TAILQ_INIT(&sah->savtree_larval); 2980 TAILQ_INIT(&sah->savtree_alive); 2981 sah->saidx = *saidx; 2982 sah->state = SADB_SASTATE_DEAD; 2983 SAH_INITREF(sah); 2984 2985 KEYDBG(KEY_STAMP, 2986 printf("%s: SAH(%p)\n", __func__, sah)); 2987 KEYDBG(KEY_DATA, kdebug_secash(sah, NULL)); 2988 return (sah); 2989 } 2990 2991 static void 2992 key_freesah(struct secashead **psah) 2993 { 2994 struct secashead *sah = *psah; 2995 2996 CURVNET_ASSERT_SET(); 2997 2998 if (SAH_DELREF(sah) == 0) 2999 return; 3000 3001 KEYDBG(KEY_STAMP, 3002 printf("%s: last reference to SAH(%p)\n", __func__, sah)); 3003 KEYDBG(KEY_DATA, kdebug_secash(sah, NULL)); 3004 3005 *psah = NULL; 3006 key_delsah(sah); 3007 } 3008 3009 static void 3010 key_delsah(struct secashead *sah) 3011 { 3012 IPSEC_ASSERT(sah != NULL, ("NULL sah")); 3013 IPSEC_ASSERT(sah->state == SADB_SASTATE_DEAD, 3014 ("Attempt to free non DEAD SAH %p", sah)); 3015 IPSEC_ASSERT(TAILQ_EMPTY(&sah->savtree_larval), 3016 ("Attempt to free SAH %p with LARVAL SA", sah)); 3017 IPSEC_ASSERT(TAILQ_EMPTY(&sah->savtree_alive), 3018 ("Attempt to free SAH %p with ALIVE SA", sah)); 3019 3020 free(sah, M_IPSEC_SAH); 3021 } 3022 3023 /* 3024 * allocating a new SA for key_add() and key_getspi() call, 3025 * and copy the values of mhp into new buffer. 3026 * When SAD message type is SADB_GETSPI set SA state to LARVAL. 3027 * For SADB_ADD create and initialize SA with MATURE state. 3028 * OUT: NULL : fail 3029 * others : pointer to new secasvar. 3030 */ 3031 static struct secasvar * 3032 key_newsav(const struct sadb_msghdr *mhp, struct secasindex *saidx, 3033 uint32_t spi, int *errp) 3034 { 3035 struct secashead *sah; 3036 struct secasvar *sav; 3037 int isnew; 3038 3039 IPSEC_ASSERT(mhp != NULL, ("null msghdr")); 3040 IPSEC_ASSERT(mhp->msg != NULL, ("null msg")); 3041 IPSEC_ASSERT(mhp->msg->sadb_msg_type == SADB_GETSPI || 3042 mhp->msg->sadb_msg_type == SADB_ADD, ("wrong message type")); 3043 3044 sav = NULL; 3045 sah = NULL; 3046 /* check SPI value */ 3047 switch (saidx->proto) { 3048 case IPPROTO_ESP: 3049 case IPPROTO_AH: 3050 /* 3051 * RFC 4302, 2.4. Security Parameters Index (SPI), SPI values 3052 * 1-255 reserved by IANA for future use, 3053 * 0 for implementation specific, local use. 3054 */ 3055 if (ntohl(spi) <= 255) { 3056 ipseclog((LOG_DEBUG, "%s: illegal range of SPI %u.\n", 3057 __func__, ntohl(spi))); 3058 *errp = EINVAL; 3059 goto done; 3060 } 3061 break; 3062 } 3063 3064 sav = malloc(sizeof(struct secasvar), M_IPSEC_SA, M_NOWAIT | M_ZERO); 3065 if (sav == NULL) { 3066 *errp = ENOBUFS; 3067 goto done; 3068 } 3069 sav->lock = malloc_aligned(max(sizeof(struct rmlock), 3070 CACHE_LINE_SIZE), CACHE_LINE_SIZE, M_IPSEC_MISC, 3071 M_NOWAIT | M_ZERO); 3072 if (sav->lock == NULL) { 3073 *errp = ENOBUFS; 3074 goto done; 3075 } 3076 rm_init(sav->lock, "ipsec association"); 3077 sav->lft_c = uma_zalloc_pcpu(ipsec_key_lft_zone, M_NOWAIT | M_ZERO); 3078 if (sav->lft_c == NULL) { 3079 *errp = ENOBUFS; 3080 goto done; 3081 } 3082 3083 sav->spi = spi; 3084 sav->seq = mhp->msg->sadb_msg_seq; 3085 sav->state = SADB_SASTATE_LARVAL; 3086 sav->pid = (pid_t)mhp->msg->sadb_msg_pid; 3087 SAV_INITREF(sav); 3088 #ifdef IPSEC_OFFLOAD 3089 CK_LIST_INIT(&sav->accel_ifps); 3090 sav->accel_forget_tq = 0; 3091 sav->accel_lft_sw = uma_zalloc_pcpu(ipsec_key_lft_zone, 3092 M_NOWAIT | M_ZERO); 3093 if (sav->accel_lft_sw == NULL) { 3094 *errp = ENOBUFS; 3095 goto done; 3096 } 3097 if (!SADB_CHECKHDR(mhp, SADB_X_EXT_IF_HW_OFFL) && 3098 !SADB_CHECKLEN(mhp, SADB_X_EXT_IF_HW_OFFL)) { 3099 struct sadb_x_if_hw_offl *xof; 3100 3101 xof = (struct sadb_x_if_hw_offl *)mhp->ext[ 3102 SADB_X_EXT_IF_HW_OFFL]; 3103 sav->accel_ifname = malloc(sizeof(xof->sadb_x_if_hw_offl_if), 3104 M_IPSEC_MISC, M_NOWAIT); 3105 if (sav->accel_ifname == NULL) { 3106 *errp = ENOBUFS; 3107 goto done; 3108 } 3109 strncpy(__DECONST(char *, sav->accel_ifname), 3110 xof->sadb_x_if_hw_offl_if, 3111 sizeof(xof->sadb_x_if_hw_offl_if)); 3112 } 3113 #endif 3114 again: 3115 sah = key_getsah(saidx); 3116 if (sah == NULL) { 3117 /* create a new SA index */ 3118 sah = key_newsah(saidx); 3119 if (sah == NULL) { 3120 ipseclog((LOG_DEBUG, 3121 "%s: No more memory.\n", __func__)); 3122 *errp = ENOBUFS; 3123 goto done; 3124 } 3125 isnew = 1; 3126 } else 3127 isnew = 0; 3128 3129 sav->sah = sah; 3130 if (mhp->msg->sadb_msg_type == SADB_GETSPI) { 3131 sav->created = time_second; 3132 } else if (sav->state == SADB_SASTATE_LARVAL) { 3133 /* 3134 * Do not call key_setsaval() second time in case 3135 * of `goto again`. We will have MATURE state. 3136 */ 3137 *errp = key_setsaval(sav, mhp); 3138 if (*errp != 0) 3139 goto done; 3140 sav->state = SADB_SASTATE_MATURE; 3141 } 3142 3143 SAHTREE_WLOCK(); 3144 /* 3145 * Check that existing SAH wasn't unlinked. 3146 * Since we didn't hold the SAHTREE lock, it is possible, 3147 * that callout handler or key_flush() or key_delete() could 3148 * unlink this SAH. 3149 */ 3150 if (isnew == 0 && sah->state == SADB_SASTATE_DEAD) { 3151 SAHTREE_WUNLOCK(); 3152 key_freesah(&sah); /* reference from key_getsah() */ 3153 goto again; 3154 } 3155 if (isnew != 0) { 3156 /* 3157 * Add new SAH into SADB. 3158 * 3159 * XXXAE: we can serialize key_add and key_getspi calls, so 3160 * several threads will not fight in the race. 3161 * Otherwise we should check under SAHTREE lock, that this 3162 * SAH would not added twice. 3163 */ 3164 TAILQ_INSERT_HEAD(&V_sahtree, sah, chain); 3165 /* Add new SAH into hash by addresses */ 3166 LIST_INSERT_HEAD(SAHADDRHASH_HASH(saidx), sah, addrhash); 3167 /* Now we are linked in the chain */ 3168 sah->state = SADB_SASTATE_MATURE; 3169 /* 3170 * SAV references this new SAH. 3171 * In case of existing SAH we reuse reference 3172 * from key_getsah(). 3173 */ 3174 SAH_ADDREF(sah); 3175 } 3176 /* Link SAV with SAH */ 3177 if (sav->state == SADB_SASTATE_MATURE) { 3178 TAILQ_INSERT_HEAD(&sah->savtree_alive, sav, chain); 3179 ipsec_accel_sa_newkey(sav); 3180 } else 3181 TAILQ_INSERT_HEAD(&sah->savtree_larval, sav, chain); 3182 /* Add SAV into SPI hash */ 3183 LIST_INSERT_HEAD(SAVHASH_HASH(sav->spi), sav, spihash); 3184 SAHTREE_WUNLOCK(); 3185 *errp = 0; /* success */ 3186 done: 3187 if (*errp != 0) { 3188 if (sav != NULL) { 3189 if (sav->lock != NULL) { 3190 rm_destroy(sav->lock); 3191 free(sav->lock, M_IPSEC_MISC); 3192 } 3193 if (sav->lft_c != NULL) 3194 uma_zfree_pcpu(ipsec_key_lft_zone, sav->lft_c); 3195 #ifdef IPSEC_OFFLOAD 3196 if (sav->accel_lft_sw != NULL) 3197 uma_zfree_pcpu(ipsec_key_lft_zone, 3198 sav->accel_lft_sw); 3199 free(__DECONST(char *, sav->accel_ifname), 3200 M_IPSEC_MISC); 3201 #endif 3202 free(sav, M_IPSEC_SA), sav = NULL; 3203 } 3204 if (sah != NULL) 3205 key_freesah(&sah); 3206 if (*errp == ENOBUFS) { 3207 ipseclog((LOG_DEBUG, "%s: No more memory.\n", 3208 __func__)); 3209 PFKEYSTAT_INC(in_nomem); 3210 } 3211 } 3212 return (sav); 3213 } 3214 3215 /* 3216 * free() SA variable entry. 3217 */ 3218 static void 3219 key_cleansav(struct secasvar *sav) 3220 { 3221 3222 if (sav->natt != NULL) { 3223 free(sav->natt, M_IPSEC_MISC); 3224 sav->natt = NULL; 3225 } 3226 if (sav->flags & SADB_X_EXT_F_CLONED) 3227 return; 3228 if (sav->tdb_xform != NULL) { 3229 sav->tdb_xform->xf_cleanup(sav); 3230 sav->tdb_xform = NULL; 3231 } 3232 if (sav->key_auth != NULL) { 3233 zfree(sav->key_auth->key_data, M_IPSEC_MISC); 3234 free(sav->key_auth, M_IPSEC_MISC); 3235 sav->key_auth = NULL; 3236 } 3237 if (sav->key_enc != NULL) { 3238 zfree(sav->key_enc->key_data, M_IPSEC_MISC); 3239 free(sav->key_enc, M_IPSEC_MISC); 3240 sav->key_enc = NULL; 3241 } 3242 if (sav->replay != NULL) { 3243 mtx_destroy(&sav->replay->lock); 3244 if (sav->replay->bitmap != NULL) 3245 free(sav->replay->bitmap, M_IPSEC_MISC); 3246 free(sav->replay, M_IPSEC_MISC); 3247 sav->replay = NULL; 3248 } 3249 if (sav->lft_h != NULL) { 3250 free(sav->lft_h, M_IPSEC_MISC); 3251 sav->lft_h = NULL; 3252 } 3253 if (sav->lft_s != NULL) { 3254 free(sav->lft_s, M_IPSEC_MISC); 3255 sav->lft_s = NULL; 3256 } 3257 } 3258 3259 /* 3260 * free() SA variable entry. 3261 */ 3262 static void 3263 key_delsav(struct secasvar *sav) 3264 { 3265 IPSEC_ASSERT(sav != NULL, ("null sav")); 3266 IPSEC_ASSERT(sav->state == SADB_SASTATE_DEAD, 3267 ("attempt to free non DEAD SA %p", sav)); 3268 IPSEC_ASSERT(sav->refcnt == 0, ("reference count %u > 0", 3269 sav->refcnt)); 3270 #ifdef IPSEC_OFFLOAD 3271 KASSERT(CK_LIST_EMPTY(&sav->accel_ifps), 3272 ("key_unlinksav: sav %p still offloaded", sav)); 3273 #endif 3274 3275 /* 3276 * SA must be unlinked from the chain and hashtbl. 3277 * If SA was cloned, we leave all fields untouched, 3278 * except NAT-T config. 3279 */ 3280 key_cleansav(sav); 3281 if ((sav->flags & SADB_X_EXT_F_CLONED) == 0) { 3282 rm_destroy(sav->lock); 3283 free(sav->lock, M_IPSEC_MISC); 3284 uma_zfree_pcpu(ipsec_key_lft_zone, sav->lft_c); 3285 } 3286 #ifdef IPSEC_OFFLOAD 3287 /* XXXKIB should this be moved to key_cleansav()? */ 3288 uma_zfree_pcpu(ipsec_key_lft_zone, sav->accel_lft_sw); 3289 free(__DECONST(char *, sav->accel_ifname), M_IPSEC_MISC); 3290 #endif 3291 free(sav, M_IPSEC_SA); 3292 } 3293 3294 /* 3295 * search SAH. 3296 * OUT: 3297 * NULL : not found 3298 * others : found, referenced pointer to a SAH. 3299 */ 3300 static struct secashead * 3301 key_getsah(struct secasindex *saidx) 3302 { 3303 SAHTREE_RLOCK_TRACKER; 3304 struct secashead *sah; 3305 3306 SAHTREE_RLOCK(); 3307 LIST_FOREACH(sah, SAHADDRHASH_HASH(saidx), addrhash) { 3308 if (key_cmpsaidx(&sah->saidx, saidx, CMP_MODE_REQID) != 0) { 3309 SAH_ADDREF(sah); 3310 break; 3311 } 3312 } 3313 SAHTREE_RUNLOCK(); 3314 return (sah); 3315 } 3316 3317 /* 3318 * Check not to be duplicated SPI. 3319 * OUT: 3320 * 0 : not found 3321 * 1 : found SA with given SPI. 3322 */ 3323 static int 3324 key_checkspidup(uint32_t spi) 3325 { 3326 SAHTREE_RLOCK_TRACKER; 3327 struct secasvar *sav; 3328 3329 /* Assume SPI is in network byte order */ 3330 SAHTREE_RLOCK(); 3331 LIST_FOREACH(sav, SAVHASH_HASH(spi), spihash) { 3332 if (sav->spi == spi) 3333 break; 3334 } 3335 SAHTREE_RUNLOCK(); 3336 return (sav != NULL); 3337 } 3338 3339 /* 3340 * Search SA by SPI. 3341 * OUT: 3342 * NULL : not found 3343 * others : found, referenced pointer to a SA. 3344 */ 3345 static struct secasvar * 3346 key_getsavbyspi(uint32_t spi) 3347 { 3348 SAHTREE_RLOCK_TRACKER; 3349 struct secasvar *sav; 3350 3351 /* Assume SPI is in network byte order */ 3352 SAHTREE_RLOCK(); 3353 LIST_FOREACH(sav, SAVHASH_HASH(spi), spihash) { 3354 if (sav->spi != spi) 3355 continue; 3356 SAV_ADDREF(sav); 3357 break; 3358 } 3359 SAHTREE_RUNLOCK(); 3360 return (sav); 3361 } 3362 3363 static int 3364 key_updatelifetimes(struct secasvar *sav, const struct sadb_msghdr *mhp) 3365 { 3366 struct seclifetime *lft_h, *lft_s, *tmp; 3367 3368 /* Lifetime extension is optional, check that it is present. */ 3369 if (SADB_CHECKHDR(mhp, SADB_EXT_LIFETIME_HARD) && 3370 SADB_CHECKHDR(mhp, SADB_EXT_LIFETIME_SOFT)) { 3371 /* 3372 * In case of SADB_UPDATE we may need to change 3373 * existing lifetimes. 3374 */ 3375 if (sav->state == SADB_SASTATE_MATURE) { 3376 lft_h = lft_s = NULL; 3377 goto reset; 3378 } 3379 return (0); 3380 } 3381 /* Both HARD and SOFT extensions must present */ 3382 if ((SADB_CHECKHDR(mhp, SADB_EXT_LIFETIME_HARD) && 3383 !SADB_CHECKHDR(mhp, SADB_EXT_LIFETIME_SOFT)) || 3384 (SADB_CHECKHDR(mhp, SADB_EXT_LIFETIME_SOFT) && 3385 !SADB_CHECKHDR(mhp, SADB_EXT_LIFETIME_HARD))) { 3386 ipseclog((LOG_DEBUG, 3387 "%s: invalid message: missing required header.\n", 3388 __func__)); 3389 return (EINVAL); 3390 } 3391 if (SADB_CHECKLEN(mhp, SADB_EXT_LIFETIME_HARD) || 3392 SADB_CHECKLEN(mhp, SADB_EXT_LIFETIME_SOFT)) { 3393 ipseclog((LOG_DEBUG, 3394 "%s: invalid message: wrong header size.\n", __func__)); 3395 return (EINVAL); 3396 } 3397 lft_h = key_dup_lifemsg((const struct sadb_lifetime *) 3398 mhp->ext[SADB_EXT_LIFETIME_HARD], M_IPSEC_MISC); 3399 if (lft_h == NULL) { 3400 PFKEYSTAT_INC(in_nomem); 3401 ipseclog((LOG_DEBUG, "%s: No more memory.\n", __func__)); 3402 return (ENOBUFS); 3403 } 3404 lft_s = key_dup_lifemsg((const struct sadb_lifetime *) 3405 mhp->ext[SADB_EXT_LIFETIME_SOFT], M_IPSEC_MISC); 3406 if (lft_s == NULL) { 3407 PFKEYSTAT_INC(in_nomem); 3408 free(lft_h, M_IPSEC_MISC); 3409 ipseclog((LOG_DEBUG, "%s: No more memory.\n", __func__)); 3410 return (ENOBUFS); 3411 } 3412 reset: 3413 if (sav->state != SADB_SASTATE_LARVAL) { 3414 /* 3415 * key_update() holds reference to this SA, 3416 * so it won't be deleted in meanwhile. 3417 */ 3418 SECASVAR_WLOCK(sav); 3419 tmp = sav->lft_h; 3420 sav->lft_h = lft_h; 3421 lft_h = tmp; 3422 3423 tmp = sav->lft_s; 3424 sav->lft_s = lft_s; 3425 lft_s = tmp; 3426 SECASVAR_WUNLOCK(sav); 3427 if (lft_h != NULL) 3428 free(lft_h, M_IPSEC_MISC); 3429 if (lft_s != NULL) 3430 free(lft_s, M_IPSEC_MISC); 3431 return (0); 3432 } 3433 /* We can update lifetime without holding a lock */ 3434 IPSEC_ASSERT(sav->lft_h == NULL, ("lft_h is already initialized\n")); 3435 IPSEC_ASSERT(sav->lft_s == NULL, ("lft_s is already initialized\n")); 3436 sav->lft_h = lft_h; 3437 sav->lft_s = lft_s; 3438 return (0); 3439 } 3440 3441 /* 3442 * copy SA values from PF_KEY message except *SPI, SEQ, PID and TYPE*. 3443 * You must update these if need. Expects only LARVAL SAs. 3444 * OUT: 0: success. 3445 * !0: failure. 3446 */ 3447 static int 3448 key_setsaval(struct secasvar *sav, const struct sadb_msghdr *mhp) 3449 { 3450 const struct sadb_sa *sa0; 3451 const struct sadb_key *key0; 3452 uint32_t replay; 3453 size_t len; 3454 int error; 3455 3456 IPSEC_ASSERT(mhp != NULL, ("null msghdr")); 3457 IPSEC_ASSERT(mhp->msg != NULL, ("null msg")); 3458 IPSEC_ASSERT(sav->state == SADB_SASTATE_LARVAL, 3459 ("Attempt to update non LARVAL SA")); 3460 3461 /* XXX rewrite */ 3462 error = key_setident(sav->sah, mhp); 3463 if (error != 0) 3464 goto fail; 3465 3466 /* SA */ 3467 if (!SADB_CHECKHDR(mhp, SADB_EXT_SA)) { 3468 if (SADB_CHECKLEN(mhp, SADB_EXT_SA)) { 3469 error = EINVAL; 3470 goto fail; 3471 } 3472 sa0 = (const struct sadb_sa *)mhp->ext[SADB_EXT_SA]; 3473 sav->alg_auth = sa0->sadb_sa_auth; 3474 sav->alg_enc = sa0->sadb_sa_encrypt; 3475 sav->flags = sa0->sadb_sa_flags; 3476 if ((sav->flags & SADB_KEY_FLAGS_MAX) != sav->flags) { 3477 ipseclog((LOG_DEBUG, 3478 "%s: invalid sa_flags 0x%08x.\n", __func__, 3479 sav->flags)); 3480 error = EINVAL; 3481 goto fail; 3482 } 3483 3484 /* Optional replay window */ 3485 replay = 0; 3486 if ((sa0->sadb_sa_flags & SADB_X_EXT_OLD) == 0) 3487 replay = sa0->sadb_sa_replay; 3488 if (!SADB_CHECKHDR(mhp, SADB_X_EXT_SA_REPLAY)) { 3489 if (SADB_CHECKLEN(mhp, SADB_X_EXT_SA_REPLAY)) { 3490 error = EINVAL; 3491 goto fail; 3492 } 3493 replay = ((const struct sadb_x_sa_replay *) 3494 mhp->ext[SADB_X_EXT_SA_REPLAY])->sadb_x_sa_replay_replay; 3495 3496 if (replay > UINT32_MAX - 32) { 3497 ipseclog((LOG_DEBUG, 3498 "%s: replay window too big.\n", __func__)); 3499 error = EINVAL; 3500 goto fail; 3501 } 3502 3503 replay = (replay + 7) >> 3; 3504 } 3505 3506 sav->replay = malloc(sizeof(struct secreplay), M_IPSEC_MISC, 3507 M_NOWAIT | M_ZERO); 3508 if (sav->replay == NULL) { 3509 PFKEYSTAT_INC(in_nomem); 3510 ipseclog((LOG_DEBUG, "%s: No more memory.\n", 3511 __func__)); 3512 error = ENOBUFS; 3513 goto fail; 3514 } 3515 mtx_init(&sav->replay->lock, "ipsec replay", NULL, MTX_DEF); 3516 3517 if (replay != 0) { 3518 /* number of 32b blocks to be allocated */ 3519 uint32_t bitmap_size; 3520 3521 /* RFC 6479: 3522 * - the allocated replay window size must be 3523 * a power of two. 3524 * - use an extra 32b block as a redundant window. 3525 */ 3526 bitmap_size = 1; 3527 while (replay + 4 > bitmap_size) 3528 bitmap_size <<= 1; 3529 bitmap_size = bitmap_size / 4; 3530 3531 sav->replay->bitmap = malloc( 3532 bitmap_size * sizeof(uint32_t), M_IPSEC_MISC, 3533 M_NOWAIT | M_ZERO); 3534 if (sav->replay->bitmap == NULL) { 3535 PFKEYSTAT_INC(in_nomem); 3536 ipseclog((LOG_DEBUG, "%s: No more memory.\n", 3537 __func__)); 3538 error = ENOBUFS; 3539 goto fail; 3540 } 3541 sav->replay->bitmap_size = bitmap_size; 3542 sav->replay->wsize = replay; 3543 } 3544 } 3545 3546 /* Authentication keys */ 3547 if (!SADB_CHECKHDR(mhp, SADB_EXT_KEY_AUTH)) { 3548 if (SADB_CHECKLEN(mhp, SADB_EXT_KEY_AUTH)) { 3549 error = EINVAL; 3550 goto fail; 3551 } 3552 error = 0; 3553 key0 = (const struct sadb_key *)mhp->ext[SADB_EXT_KEY_AUTH]; 3554 len = mhp->extlen[SADB_EXT_KEY_AUTH]; 3555 switch (mhp->msg->sadb_msg_satype) { 3556 case SADB_SATYPE_AH: 3557 case SADB_SATYPE_ESP: 3558 case SADB_X_SATYPE_TCPSIGNATURE: 3559 if (len == PFKEY_ALIGN8(sizeof(struct sadb_key)) && 3560 sav->alg_auth != SADB_X_AALG_NULL) 3561 error = EINVAL; 3562 break; 3563 case SADB_X_SATYPE_IPCOMP: 3564 default: 3565 error = EINVAL; 3566 break; 3567 } 3568 if (error) { 3569 ipseclog((LOG_DEBUG, "%s: invalid key_auth values.\n", 3570 __func__)); 3571 goto fail; 3572 } 3573 3574 sav->key_auth = key_dup_keymsg(key0, len, M_IPSEC_MISC); 3575 if (sav->key_auth == NULL ) { 3576 ipseclog((LOG_DEBUG, "%s: No more memory.\n", 3577 __func__)); 3578 PFKEYSTAT_INC(in_nomem); 3579 error = ENOBUFS; 3580 goto fail; 3581 } 3582 } 3583 3584 /* Encryption key */ 3585 if (!SADB_CHECKHDR(mhp, SADB_EXT_KEY_ENCRYPT)) { 3586 if (SADB_CHECKLEN(mhp, SADB_EXT_KEY_ENCRYPT)) { 3587 error = EINVAL; 3588 goto fail; 3589 } 3590 error = 0; 3591 key0 = (const struct sadb_key *)mhp->ext[SADB_EXT_KEY_ENCRYPT]; 3592 len = mhp->extlen[SADB_EXT_KEY_ENCRYPT]; 3593 switch (mhp->msg->sadb_msg_satype) { 3594 case SADB_SATYPE_ESP: 3595 if (len == PFKEY_ALIGN8(sizeof(struct sadb_key)) && 3596 sav->alg_enc != SADB_EALG_NULL) { 3597 error = EINVAL; 3598 break; 3599 } 3600 sav->key_enc = key_dup_keymsg(key0, len, M_IPSEC_MISC); 3601 if (sav->key_enc == NULL) { 3602 ipseclog((LOG_DEBUG, "%s: No more memory.\n", 3603 __func__)); 3604 PFKEYSTAT_INC(in_nomem); 3605 error = ENOBUFS; 3606 goto fail; 3607 } 3608 break; 3609 case SADB_X_SATYPE_IPCOMP: 3610 if (len != PFKEY_ALIGN8(sizeof(struct sadb_key))) 3611 error = EINVAL; 3612 sav->key_enc = NULL; /*just in case*/ 3613 break; 3614 case SADB_SATYPE_AH: 3615 case SADB_X_SATYPE_TCPSIGNATURE: 3616 default: 3617 error = EINVAL; 3618 break; 3619 } 3620 if (error) { 3621 ipseclog((LOG_DEBUG, "%s: invalid key_enc value.\n", 3622 __func__)); 3623 goto fail; 3624 } 3625 } 3626 3627 /* set iv */ 3628 sav->ivlen = 0; 3629 switch (mhp->msg->sadb_msg_satype) { 3630 case SADB_SATYPE_AH: 3631 if (sav->flags & SADB_X_EXT_DERIV) { 3632 ipseclog((LOG_DEBUG, "%s: invalid flag (derived) " 3633 "given to AH SA.\n", __func__)); 3634 error = EINVAL; 3635 goto fail; 3636 } 3637 if (sav->alg_enc != SADB_EALG_NONE) { 3638 ipseclog((LOG_DEBUG, "%s: protocol and algorithm " 3639 "mismated.\n", __func__)); 3640 error = EINVAL; 3641 goto fail; 3642 } 3643 error = xform_init(sav, XF_AH); 3644 break; 3645 case SADB_SATYPE_ESP: 3646 if ((sav->flags & (SADB_X_EXT_OLD | SADB_X_EXT_DERIV)) == 3647 (SADB_X_EXT_OLD | SADB_X_EXT_DERIV)) { 3648 ipseclog((LOG_DEBUG, "%s: invalid flag (derived) " 3649 "given to old-esp.\n", __func__)); 3650 error = EINVAL; 3651 goto fail; 3652 } 3653 error = xform_init(sav, XF_ESP); 3654 break; 3655 case SADB_X_SATYPE_IPCOMP: 3656 if (sav->alg_auth != SADB_AALG_NONE) { 3657 ipseclog((LOG_DEBUG, "%s: protocol and algorithm " 3658 "mismated.\n", __func__)); 3659 error = EINVAL; 3660 goto fail; 3661 } 3662 if ((sav->flags & SADB_X_EXT_RAWCPI) == 0 && 3663 ntohl(sav->spi) >= 0x10000) { 3664 ipseclog((LOG_DEBUG, "%s: invalid cpi for IPComp.\n", 3665 __func__)); 3666 error = EINVAL; 3667 goto fail; 3668 } 3669 error = xform_init(sav, XF_IPCOMP); 3670 break; 3671 case SADB_X_SATYPE_TCPSIGNATURE: 3672 if (sav->alg_enc != SADB_EALG_NONE) { 3673 ipseclog((LOG_DEBUG, "%s: protocol and algorithm " 3674 "mismated.\n", __func__)); 3675 error = EINVAL; 3676 goto fail; 3677 } 3678 error = xform_init(sav, XF_TCPSIGNATURE); 3679 break; 3680 default: 3681 ipseclog((LOG_DEBUG, "%s: Invalid satype.\n", __func__)); 3682 error = EPROTONOSUPPORT; 3683 goto fail; 3684 } 3685 if (error) { 3686 ipseclog((LOG_DEBUG, "%s: unable to initialize SA type %u.\n", 3687 __func__, mhp->msg->sadb_msg_satype)); 3688 goto fail; 3689 } 3690 3691 /* Handle NAT-T headers */ 3692 error = key_setnatt(sav, mhp); 3693 if (error != 0) 3694 goto fail; 3695 3696 /* Initialize lifetime for CURRENT */ 3697 sav->firstused = 0; 3698 sav->created = time_second; 3699 3700 /* lifetimes for HARD and SOFT */ 3701 error = key_updatelifetimes(sav, mhp); 3702 if (error == 0) 3703 return (0); 3704 fail: 3705 key_cleansav(sav); 3706 return (error); 3707 } 3708 3709 /* 3710 * subroutine for SADB_GET and SADB_DUMP. 3711 */ 3712 static struct mbuf * 3713 key_setdumpsa(struct secasvar *sav, uint8_t type, uint8_t satype, 3714 uint32_t seq, uint32_t pid, struct rm_priotracker *sahtree_trackerp) 3715 { 3716 struct seclifetime lft_c; 3717 struct mbuf *result = NULL, *tres = NULL, *m; 3718 int i, dumporder[] = { 3719 SADB_EXT_SA, SADB_X_EXT_SA2, SADB_X_EXT_SA_REPLAY, 3720 SADB_EXT_LIFETIME_HARD, SADB_EXT_LIFETIME_SOFT, 3721 SADB_EXT_LIFETIME_CURRENT, SADB_EXT_ADDRESS_SRC, 3722 SADB_EXT_ADDRESS_DST, SADB_EXT_ADDRESS_PROXY, 3723 SADB_EXT_KEY_AUTH, SADB_EXT_KEY_ENCRYPT, 3724 SADB_EXT_IDENTITY_SRC, SADB_EXT_IDENTITY_DST, 3725 SADB_EXT_SENSITIVITY, 3726 SADB_X_EXT_NAT_T_TYPE, 3727 SADB_X_EXT_NAT_T_SPORT, SADB_X_EXT_NAT_T_DPORT, 3728 SADB_X_EXT_NAT_T_OAI, SADB_X_EXT_NAT_T_OAR, 3729 SADB_X_EXT_NAT_T_FRAG, 3730 #ifdef IPSEC_OFFLOAD 3731 SADB_X_EXT_LFT_CUR_SW_OFFL, SADB_X_EXT_LFT_CUR_HW_OFFL, 3732 SADB_X_EXT_IF_HW_OFFL, 3733 #endif 3734 }; 3735 uint32_t replay_count; 3736 #ifdef IPSEC_OFFLOAD 3737 int error; 3738 #endif 3739 3740 SECASVAR_RLOCK_TRACKER; 3741 3742 m = key_setsadbmsg(type, 0, satype, seq, pid, sav->refcnt); 3743 if (m == NULL) 3744 goto fail; 3745 result = m; 3746 3747 for (i = nitems(dumporder) - 1; i >= 0; i--) { 3748 m = NULL; 3749 switch (dumporder[i]) { 3750 case SADB_EXT_SA: 3751 m = key_setsadbsa(sav); 3752 if (!m) 3753 goto fail; 3754 break; 3755 3756 case SADB_X_EXT_SA2: { 3757 SECASVAR_RLOCK(sav); 3758 replay_count = sav->replay ? sav->replay->count : 0; 3759 SECASVAR_RUNLOCK(sav); 3760 m = key_setsadbxsa2(sav->sah->saidx.mode, replay_count, 3761 sav->sah->saidx.reqid); 3762 if (!m) 3763 goto fail; 3764 break; 3765 } 3766 case SADB_X_EXT_SA_REPLAY: 3767 if (sav->replay == NULL || 3768 sav->replay->wsize <= UINT8_MAX) 3769 continue; 3770 3771 m = key_setsadbxsareplay(sav->replay->wsize); 3772 if (!m) 3773 goto fail; 3774 break; 3775 3776 case SADB_EXT_ADDRESS_SRC: 3777 m = key_setsadbaddr(SADB_EXT_ADDRESS_SRC, 3778 &sav->sah->saidx.src.sa, 3779 FULLMASK, IPSEC_ULPROTO_ANY); 3780 if (!m) 3781 goto fail; 3782 break; 3783 3784 case SADB_EXT_ADDRESS_DST: 3785 m = key_setsadbaddr(SADB_EXT_ADDRESS_DST, 3786 &sav->sah->saidx.dst.sa, 3787 FULLMASK, IPSEC_ULPROTO_ANY); 3788 if (!m) 3789 goto fail; 3790 break; 3791 3792 case SADB_EXT_KEY_AUTH: 3793 if (!sav->key_auth) 3794 continue; 3795 m = key_setkey(sav->key_auth, SADB_EXT_KEY_AUTH); 3796 if (!m) 3797 goto fail; 3798 break; 3799 3800 case SADB_EXT_KEY_ENCRYPT: 3801 if (!sav->key_enc) 3802 continue; 3803 m = key_setkey(sav->key_enc, SADB_EXT_KEY_ENCRYPT); 3804 if (!m) 3805 goto fail; 3806 break; 3807 3808 case SADB_EXT_LIFETIME_CURRENT: 3809 lft_c.addtime = sav->created; 3810 lft_c.allocations = (uint32_t)counter_u64_fetch( 3811 sav->lft_c_allocations); 3812 lft_c.bytes = counter_u64_fetch(sav->lft_c_bytes); 3813 lft_c.usetime = sav->firstused; 3814 m = key_setlifetime(&lft_c, SADB_EXT_LIFETIME_CURRENT); 3815 if (!m) 3816 goto fail; 3817 break; 3818 3819 case SADB_EXT_LIFETIME_HARD: 3820 if (!sav->lft_h) 3821 continue; 3822 m = key_setlifetime(sav->lft_h, 3823 SADB_EXT_LIFETIME_HARD); 3824 if (!m) 3825 goto fail; 3826 break; 3827 3828 case SADB_EXT_LIFETIME_SOFT: 3829 if (!sav->lft_s) 3830 continue; 3831 m = key_setlifetime(sav->lft_s, 3832 SADB_EXT_LIFETIME_SOFT); 3833 3834 if (!m) 3835 goto fail; 3836 break; 3837 3838 case SADB_X_EXT_NAT_T_TYPE: 3839 if (sav->natt == NULL) 3840 continue; 3841 m = key_setsadbxtype(UDP_ENCAP_ESPINUDP); 3842 if (!m) 3843 goto fail; 3844 break; 3845 3846 case SADB_X_EXT_NAT_T_DPORT: 3847 if (sav->natt == NULL) 3848 continue; 3849 m = key_setsadbxport(sav->natt->dport, 3850 SADB_X_EXT_NAT_T_DPORT); 3851 if (!m) 3852 goto fail; 3853 break; 3854 3855 case SADB_X_EXT_NAT_T_SPORT: 3856 if (sav->natt == NULL) 3857 continue; 3858 m = key_setsadbxport(sav->natt->sport, 3859 SADB_X_EXT_NAT_T_SPORT); 3860 if (!m) 3861 goto fail; 3862 break; 3863 3864 case SADB_X_EXT_NAT_T_OAI: 3865 if (sav->natt == NULL || 3866 (sav->natt->flags & IPSEC_NATT_F_OAI) == 0) 3867 continue; 3868 m = key_setsadbaddr(SADB_X_EXT_NAT_T_OAI, 3869 &sav->natt->oai.sa, FULLMASK, IPSEC_ULPROTO_ANY); 3870 if (!m) 3871 goto fail; 3872 break; 3873 case SADB_X_EXT_NAT_T_OAR: 3874 if (sav->natt == NULL || 3875 (sav->natt->flags & IPSEC_NATT_F_OAR) == 0) 3876 continue; 3877 m = key_setsadbaddr(SADB_X_EXT_NAT_T_OAR, 3878 &sav->natt->oar.sa, FULLMASK, IPSEC_ULPROTO_ANY); 3879 if (!m) 3880 goto fail; 3881 break; 3882 case SADB_X_EXT_NAT_T_FRAG: 3883 /* We do not (yet) support those. */ 3884 continue; 3885 #ifdef IPSEC_OFFLOAD 3886 case SADB_X_EXT_LFT_CUR_SW_OFFL: 3887 if (!ipsec_accel_is_accel_sav(sav)) 3888 continue; 3889 SAV_ADDREF(sav); 3890 error = ipsec_accel_sa_lifetime_op(sav, &lft_c, 3891 NULL, IF_SA_CNT_TOTAL_SW_VAL, sahtree_trackerp); 3892 if (error != 0) { 3893 m = NULL; 3894 goto fail; 3895 } 3896 m = key_setlifetime(&lft_c, dumporder[i]); 3897 if (m == NULL) 3898 goto fail; 3899 key_freesav(&sav); 3900 if (sav == NULL) { 3901 m_freem(m); 3902 goto fail; 3903 } 3904 break; 3905 case SADB_X_EXT_LFT_CUR_HW_OFFL: 3906 if (!ipsec_accel_is_accel_sav(sav)) 3907 continue; 3908 memset(&lft_c, 0, sizeof(lft_c)); 3909 lft_c.bytes = sav->accel_hw_octets; 3910 lft_c.allocations = sav->accel_hw_allocs; 3911 m = key_setlifetime(&lft_c, dumporder[i]); 3912 if (m == NULL) 3913 goto fail; 3914 break; 3915 case SADB_X_EXT_IF_HW_OFFL: 3916 if (!ipsec_accel_is_accel_sav(sav)) 3917 continue; 3918 m = ipsec_accel_key_setaccelif(sav); 3919 if (m == NULL) 3920 continue; /* benigh */ 3921 break; 3922 #endif 3923 3924 case SADB_EXT_ADDRESS_PROXY: 3925 case SADB_EXT_IDENTITY_SRC: 3926 case SADB_EXT_IDENTITY_DST: 3927 /* XXX: should we brought from SPD ? */ 3928 case SADB_EXT_SENSITIVITY: 3929 default: 3930 continue; 3931 } 3932 3933 if (!m) 3934 goto fail; 3935 if (tres) 3936 m_cat(m, tres); 3937 tres = m; 3938 } 3939 3940 m_cat(result, tres); 3941 tres = NULL; 3942 if (result->m_len < sizeof(struct sadb_msg)) { 3943 result = m_pullup(result, sizeof(struct sadb_msg)); 3944 if (result == NULL) 3945 goto fail; 3946 } 3947 3948 result->m_pkthdr.len = 0; 3949 for (m = result; m; m = m->m_next) 3950 result->m_pkthdr.len += m->m_len; 3951 3952 mtod(result, struct sadb_msg *)->sadb_msg_len = 3953 PFKEY_UNIT64(result->m_pkthdr.len); 3954 3955 return result; 3956 3957 fail: 3958 m_freem(result); 3959 m_freem(tres); 3960 return NULL; 3961 } 3962 3963 /* 3964 * set data into sadb_msg. 3965 */ 3966 static struct mbuf * 3967 key_setsadbmsg(u_int8_t type, u_int16_t tlen, u_int8_t satype, u_int32_t seq, 3968 pid_t pid, u_int16_t reserved) 3969 { 3970 struct mbuf *m; 3971 struct sadb_msg *p; 3972 int len; 3973 3974 len = PFKEY_ALIGN8(sizeof(struct sadb_msg)); 3975 if (len > MCLBYTES) 3976 return NULL; 3977 m = key_mget(len); 3978 if (m == NULL) 3979 return NULL; 3980 m->m_pkthdr.len = m->m_len = len; 3981 m->m_next = NULL; 3982 3983 p = mtod(m, struct sadb_msg *); 3984 3985 bzero(p, len); 3986 p->sadb_msg_version = PF_KEY_V2; 3987 p->sadb_msg_type = type; 3988 p->sadb_msg_errno = 0; 3989 p->sadb_msg_satype = satype; 3990 p->sadb_msg_len = PFKEY_UNIT64(tlen); 3991 p->sadb_msg_reserved = reserved; 3992 p->sadb_msg_seq = seq; 3993 p->sadb_msg_pid = (u_int32_t)pid; 3994 3995 return m; 3996 } 3997 3998 /* 3999 * copy secasvar data into sadb_address. 4000 */ 4001 static struct mbuf * 4002 key_setsadbsa(struct secasvar *sav) 4003 { 4004 struct mbuf *m; 4005 struct sadb_sa *p; 4006 int len; 4007 4008 len = PFKEY_ALIGN8(sizeof(struct sadb_sa)); 4009 m = m_get2(len, M_NOWAIT, MT_DATA, 0); 4010 if (m == NULL) 4011 return (NULL); 4012 m_align(m, len); 4013 m->m_len = len; 4014 p = mtod(m, struct sadb_sa *); 4015 bzero(p, len); 4016 p->sadb_sa_len = PFKEY_UNIT64(len); 4017 p->sadb_sa_exttype = SADB_EXT_SA; 4018 p->sadb_sa_spi = sav->spi; 4019 p->sadb_sa_replay = sav->replay ? 4020 (sav->replay->wsize > UINT8_MAX ? UINT8_MAX : 4021 sav->replay->wsize): 0; 4022 p->sadb_sa_state = sav->state; 4023 p->sadb_sa_auth = sav->alg_auth; 4024 p->sadb_sa_encrypt = sav->alg_enc; 4025 p->sadb_sa_flags = sav->flags & SADB_KEY_FLAGS_MAX; 4026 return (m); 4027 } 4028 4029 /* 4030 * set data into sadb_address. 4031 */ 4032 static struct mbuf * 4033 key_setsadbaddr(u_int16_t exttype, const struct sockaddr *saddr, 4034 u_int8_t prefixlen, u_int16_t ul_proto) 4035 { 4036 struct mbuf *m; 4037 struct sadb_address *p; 4038 size_t len; 4039 4040 len = PFKEY_ALIGN8(sizeof(struct sadb_address)) + 4041 PFKEY_ALIGN8(saddr->sa_len); 4042 m = m_get2(len, M_NOWAIT, MT_DATA, 0); 4043 if (m == NULL) 4044 return (NULL); 4045 m_align(m, len); 4046 m->m_len = len; 4047 p = mtod(m, struct sadb_address *); 4048 4049 bzero(p, len); 4050 p->sadb_address_len = PFKEY_UNIT64(len); 4051 p->sadb_address_exttype = exttype; 4052 p->sadb_address_proto = ul_proto; 4053 if (prefixlen == FULLMASK) { 4054 switch (saddr->sa_family) { 4055 case AF_INET: 4056 prefixlen = sizeof(struct in_addr) << 3; 4057 break; 4058 case AF_INET6: 4059 prefixlen = sizeof(struct in6_addr) << 3; 4060 break; 4061 default: 4062 ; /*XXX*/ 4063 } 4064 } 4065 p->sadb_address_prefixlen = prefixlen; 4066 p->sadb_address_reserved = 0; 4067 4068 bcopy(saddr, 4069 mtod(m, caddr_t) + PFKEY_ALIGN8(sizeof(struct sadb_address)), 4070 saddr->sa_len); 4071 4072 return m; 4073 } 4074 4075 /* 4076 * set data into sadb_x_sa2. 4077 */ 4078 static struct mbuf * 4079 key_setsadbxsa2(u_int8_t mode, u_int32_t seq, u_int32_t reqid) 4080 { 4081 struct mbuf *m; 4082 struct sadb_x_sa2 *p; 4083 size_t len; 4084 4085 len = PFKEY_ALIGN8(sizeof(struct sadb_x_sa2)); 4086 m = m_get2(len, M_NOWAIT, MT_DATA, 0); 4087 if (m == NULL) 4088 return (NULL); 4089 m_align(m, len); 4090 m->m_len = len; 4091 p = mtod(m, struct sadb_x_sa2 *); 4092 4093 bzero(p, len); 4094 p->sadb_x_sa2_len = PFKEY_UNIT64(len); 4095 p->sadb_x_sa2_exttype = SADB_X_EXT_SA2; 4096 p->sadb_x_sa2_mode = mode; 4097 p->sadb_x_sa2_reserved1 = 0; 4098 p->sadb_x_sa2_reserved2 = 0; 4099 p->sadb_x_sa2_sequence = seq; 4100 p->sadb_x_sa2_reqid = reqid; 4101 4102 return m; 4103 } 4104 4105 /* 4106 * Set data into sadb_x_sa_replay. 4107 */ 4108 static struct mbuf * 4109 key_setsadbxsareplay(u_int32_t replay) 4110 { 4111 struct mbuf *m; 4112 struct sadb_x_sa_replay *p; 4113 size_t len; 4114 4115 len = PFKEY_ALIGN8(sizeof(struct sadb_x_sa_replay)); 4116 m = m_get2(len, M_NOWAIT, MT_DATA, 0); 4117 if (m == NULL) 4118 return (NULL); 4119 m_align(m, len); 4120 m->m_len = len; 4121 p = mtod(m, struct sadb_x_sa_replay *); 4122 4123 bzero(p, len); 4124 p->sadb_x_sa_replay_len = PFKEY_UNIT64(len); 4125 p->sadb_x_sa_replay_exttype = SADB_X_EXT_SA_REPLAY; 4126 p->sadb_x_sa_replay_replay = (replay << 3); 4127 4128 return m; 4129 } 4130 4131 /* 4132 * Set a type in sadb_x_nat_t_type. 4133 */ 4134 static struct mbuf * 4135 key_setsadbxtype(u_int16_t type) 4136 { 4137 struct mbuf *m; 4138 size_t len; 4139 struct sadb_x_nat_t_type *p; 4140 4141 len = PFKEY_ALIGN8(sizeof(struct sadb_x_nat_t_type)); 4142 4143 m = m_get2(len, M_NOWAIT, MT_DATA, 0); 4144 if (m == NULL) 4145 return (NULL); 4146 m_align(m, len); 4147 m->m_len = len; 4148 p = mtod(m, struct sadb_x_nat_t_type *); 4149 4150 bzero(p, len); 4151 p->sadb_x_nat_t_type_len = PFKEY_UNIT64(len); 4152 p->sadb_x_nat_t_type_exttype = SADB_X_EXT_NAT_T_TYPE; 4153 p->sadb_x_nat_t_type_type = type; 4154 4155 return (m); 4156 } 4157 /* 4158 * Set a port in sadb_x_nat_t_port. 4159 * In contrast to default RFC 2367 behaviour, port is in network byte order. 4160 */ 4161 static struct mbuf * 4162 key_setsadbxport(u_int16_t port, u_int16_t type) 4163 { 4164 struct mbuf *m; 4165 size_t len; 4166 struct sadb_x_nat_t_port *p; 4167 4168 len = PFKEY_ALIGN8(sizeof(struct sadb_x_nat_t_port)); 4169 4170 m = m_get2(len, M_NOWAIT, MT_DATA, 0); 4171 if (m == NULL) 4172 return (NULL); 4173 m_align(m, len); 4174 m->m_len = len; 4175 p = mtod(m, struct sadb_x_nat_t_port *); 4176 4177 bzero(p, len); 4178 p->sadb_x_nat_t_port_len = PFKEY_UNIT64(len); 4179 p->sadb_x_nat_t_port_exttype = type; 4180 p->sadb_x_nat_t_port_port = port; 4181 4182 return (m); 4183 } 4184 4185 /* 4186 * Get port from sockaddr. Port is in network byte order. 4187 */ 4188 uint16_t 4189 key_portfromsaddr(struct sockaddr *sa) 4190 { 4191 4192 switch (sa->sa_family) { 4193 #ifdef INET 4194 case AF_INET: 4195 return ((struct sockaddr_in *)sa)->sin_port; 4196 #endif 4197 #ifdef INET6 4198 case AF_INET6: 4199 return ((struct sockaddr_in6 *)sa)->sin6_port; 4200 #endif 4201 } 4202 return (0); 4203 } 4204 4205 /* 4206 * Set port in struct sockaddr. Port is in network byte order. 4207 */ 4208 void 4209 key_porttosaddr(struct sockaddr *sa, uint16_t port) 4210 { 4211 4212 switch (sa->sa_family) { 4213 #ifdef INET 4214 case AF_INET: 4215 ((struct sockaddr_in *)sa)->sin_port = port; 4216 break; 4217 #endif 4218 #ifdef INET6 4219 case AF_INET6: 4220 ((struct sockaddr_in6 *)sa)->sin6_port = port; 4221 break; 4222 #endif 4223 default: 4224 ipseclog((LOG_DEBUG, "%s: unexpected address family %d.\n", 4225 __func__, sa->sa_family)); 4226 break; 4227 } 4228 } 4229 4230 /* 4231 * set data into sadb_x_policy 4232 */ 4233 static struct mbuf * 4234 key_setsadbxpolicy(u_int16_t type, u_int8_t dir, u_int32_t id, u_int32_t priority) 4235 { 4236 struct mbuf *m; 4237 struct sadb_x_policy *p; 4238 size_t len; 4239 4240 len = PFKEY_ALIGN8(sizeof(struct sadb_x_policy)); 4241 m = m_get2(len, M_NOWAIT, MT_DATA, 0); 4242 if (m == NULL) 4243 return (NULL); 4244 m_align(m, len); 4245 m->m_len = len; 4246 p = mtod(m, struct sadb_x_policy *); 4247 4248 bzero(p, len); 4249 p->sadb_x_policy_len = PFKEY_UNIT64(len); 4250 p->sadb_x_policy_exttype = SADB_X_EXT_POLICY; 4251 p->sadb_x_policy_type = type; 4252 p->sadb_x_policy_dir = dir; 4253 p->sadb_x_policy_id = id; 4254 p->sadb_x_policy_priority = priority; 4255 4256 return m; 4257 } 4258 4259 /* %%% utilities */ 4260 /* Take a key message (sadb_key) from the socket and turn it into one 4261 * of the kernel's key structures (seckey). 4262 * 4263 * IN: pointer to the src 4264 * OUT: NULL no more memory 4265 */ 4266 struct seckey * 4267 key_dup_keymsg(const struct sadb_key *src, size_t len, 4268 struct malloc_type *type) 4269 { 4270 struct seckey *dst; 4271 4272 dst = malloc(sizeof(*dst), type, M_NOWAIT); 4273 if (dst != NULL) { 4274 dst->bits = src->sadb_key_bits; 4275 dst->key_data = malloc(len, type, M_NOWAIT); 4276 if (dst->key_data != NULL) { 4277 bcopy((const char *)(src + 1), dst->key_data, len); 4278 } else { 4279 ipseclog((LOG_DEBUG, "%s: No more memory.\n", 4280 __func__)); 4281 free(dst, type); 4282 dst = NULL; 4283 } 4284 } else { 4285 ipseclog((LOG_DEBUG, "%s: No more memory.\n", 4286 __func__)); 4287 } 4288 return (dst); 4289 } 4290 4291 /* Take a lifetime message (sadb_lifetime) passed in on a socket and 4292 * turn it into one of the kernel's lifetime structures (seclifetime). 4293 * 4294 * IN: pointer to the destination, source and malloc type 4295 * OUT: NULL, no more memory 4296 */ 4297 4298 static struct seclifetime * 4299 key_dup_lifemsg(const struct sadb_lifetime *src, struct malloc_type *type) 4300 { 4301 struct seclifetime *dst; 4302 4303 dst = malloc(sizeof(*dst), type, M_NOWAIT); 4304 if (dst == NULL) { 4305 ipseclog((LOG_DEBUG, "%s: No more memory.\n", __func__)); 4306 return (NULL); 4307 } 4308 dst->allocations = src->sadb_lifetime_allocations; 4309 dst->bytes = src->sadb_lifetime_bytes; 4310 dst->addtime = src->sadb_lifetime_addtime; 4311 dst->usetime = src->sadb_lifetime_usetime; 4312 return (dst); 4313 } 4314 4315 /* 4316 * compare two secasindex structure. 4317 * flag can specify to compare 2 saidxes. 4318 * compare two secasindex structure without both mode and reqid. 4319 * don't compare port. 4320 * IN: 4321 * saidx0: source, it can be in SAD. 4322 * saidx1: object. 4323 * OUT: 4324 * 1 : equal 4325 * 0 : not equal 4326 */ 4327 static int 4328 key_cmpsaidx(const struct secasindex *saidx0, const struct secasindex *saidx1, 4329 int flag) 4330 { 4331 4332 /* sanity */ 4333 if (saidx0 == NULL && saidx1 == NULL) 4334 return 1; 4335 4336 if (saidx0 == NULL || saidx1 == NULL) 4337 return 0; 4338 4339 if (saidx0->proto != saidx1->proto) 4340 return 0; 4341 4342 if (flag == CMP_EXACTLY) { 4343 if (saidx0->mode != saidx1->mode) 4344 return 0; 4345 if (saidx0->reqid != saidx1->reqid) 4346 return 0; 4347 if (bcmp(&saidx0->src, &saidx1->src, 4348 saidx0->src.sa.sa_len) != 0 || 4349 bcmp(&saidx0->dst, &saidx1->dst, 4350 saidx0->dst.sa.sa_len) != 0) 4351 return 0; 4352 } else { 4353 /* CMP_MODE_REQID, CMP_REQID, CMP_HEAD */ 4354 if (flag == CMP_MODE_REQID || flag == CMP_REQID) { 4355 /* 4356 * If reqid of SPD is non-zero, unique SA is required. 4357 * The result must be of same reqid in this case. 4358 */ 4359 if (saidx1->reqid != 0 && 4360 saidx0->reqid != saidx1->reqid) 4361 return 0; 4362 } 4363 4364 if (flag == CMP_MODE_REQID) { 4365 if (saidx0->mode != IPSEC_MODE_ANY 4366 && saidx0->mode != saidx1->mode) 4367 return 0; 4368 } 4369 4370 if (key_sockaddrcmp(&saidx0->src.sa, &saidx1->src.sa, 0) != 0) 4371 return 0; 4372 if (key_sockaddrcmp(&saidx0->dst.sa, &saidx1->dst.sa, 0) != 0) 4373 return 0; 4374 } 4375 4376 return 1; 4377 } 4378 4379 /* 4380 * compare two secindex structure exactly. 4381 * IN: 4382 * spidx0: source, it is often in SPD. 4383 * spidx1: object, it is often from PFKEY message. 4384 * OUT: 4385 * 1 : equal 4386 * 0 : not equal 4387 */ 4388 static int 4389 key_cmpspidx_exactly(struct secpolicyindex *spidx0, 4390 struct secpolicyindex *spidx1) 4391 { 4392 /* sanity */ 4393 if (spidx0 == NULL && spidx1 == NULL) 4394 return 1; 4395 4396 if (spidx0 == NULL || spidx1 == NULL) 4397 return 0; 4398 4399 if (spidx0->prefs != spidx1->prefs 4400 || spidx0->prefd != spidx1->prefd 4401 || spidx0->ul_proto != spidx1->ul_proto 4402 || spidx0->dir != spidx1->dir) 4403 return 0; 4404 4405 return key_sockaddrcmp(&spidx0->src.sa, &spidx1->src.sa, 1) == 0 && 4406 key_sockaddrcmp(&spidx0->dst.sa, &spidx1->dst.sa, 1) == 0; 4407 } 4408 4409 /* 4410 * compare two secindex structure with mask. 4411 * IN: 4412 * spidx0: source, it is often in SPD. 4413 * spidx1: object, it is often from IP header. 4414 * OUT: 4415 * 1 : equal 4416 * 0 : not equal 4417 */ 4418 static int 4419 key_cmpspidx_withmask(struct secpolicyindex *spidx0, 4420 struct secpolicyindex *spidx1) 4421 { 4422 /* sanity */ 4423 if (spidx0 == NULL && spidx1 == NULL) 4424 return 1; 4425 4426 if (spidx0 == NULL || spidx1 == NULL) 4427 return 0; 4428 4429 if (spidx0->src.sa.sa_family != spidx1->src.sa.sa_family || 4430 spidx0->dst.sa.sa_family != spidx1->dst.sa.sa_family || 4431 spidx0->src.sa.sa_len != spidx1->src.sa.sa_len || 4432 spidx0->dst.sa.sa_len != spidx1->dst.sa.sa_len) 4433 return 0; 4434 4435 /* if spidx.ul_proto == IPSEC_ULPROTO_ANY, ignore. */ 4436 if (spidx0->ul_proto != (u_int16_t)IPSEC_ULPROTO_ANY 4437 && spidx0->ul_proto != spidx1->ul_proto) 4438 return 0; 4439 4440 switch (spidx0->src.sa.sa_family) { 4441 case AF_INET: 4442 if (spidx0->src.sin.sin_port != IPSEC_PORT_ANY 4443 && spidx0->src.sin.sin_port != spidx1->src.sin.sin_port) 4444 return 0; 4445 if (!key_bbcmp(&spidx0->src.sin.sin_addr, 4446 &spidx1->src.sin.sin_addr, spidx0->prefs)) 4447 return 0; 4448 break; 4449 case AF_INET6: 4450 if (spidx0->src.sin6.sin6_port != IPSEC_PORT_ANY 4451 && spidx0->src.sin6.sin6_port != spidx1->src.sin6.sin6_port) 4452 return 0; 4453 /* 4454 * scope_id check. if sin6_scope_id is 0, we regard it 4455 * as a wildcard scope, which matches any scope zone ID. 4456 */ 4457 if (spidx0->src.sin6.sin6_scope_id && 4458 spidx1->src.sin6.sin6_scope_id && 4459 spidx0->src.sin6.sin6_scope_id != spidx1->src.sin6.sin6_scope_id) 4460 return 0; 4461 if (!key_bbcmp(&spidx0->src.sin6.sin6_addr, 4462 &spidx1->src.sin6.sin6_addr, spidx0->prefs)) 4463 return 0; 4464 break; 4465 default: 4466 /* XXX */ 4467 if (bcmp(&spidx0->src, &spidx1->src, spidx0->src.sa.sa_len) != 0) 4468 return 0; 4469 break; 4470 } 4471 4472 switch (spidx0->dst.sa.sa_family) { 4473 case AF_INET: 4474 if (spidx0->dst.sin.sin_port != IPSEC_PORT_ANY 4475 && spidx0->dst.sin.sin_port != spidx1->dst.sin.sin_port) 4476 return 0; 4477 if (!key_bbcmp(&spidx0->dst.sin.sin_addr, 4478 &spidx1->dst.sin.sin_addr, spidx0->prefd)) 4479 return 0; 4480 break; 4481 case AF_INET6: 4482 if (spidx0->dst.sin6.sin6_port != IPSEC_PORT_ANY 4483 && spidx0->dst.sin6.sin6_port != spidx1->dst.sin6.sin6_port) 4484 return 0; 4485 /* 4486 * scope_id check. if sin6_scope_id is 0, we regard it 4487 * as a wildcard scope, which matches any scope zone ID. 4488 */ 4489 if (spidx0->dst.sin6.sin6_scope_id && 4490 spidx1->dst.sin6.sin6_scope_id && 4491 spidx0->dst.sin6.sin6_scope_id != spidx1->dst.sin6.sin6_scope_id) 4492 return 0; 4493 if (!key_bbcmp(&spidx0->dst.sin6.sin6_addr, 4494 &spidx1->dst.sin6.sin6_addr, spidx0->prefd)) 4495 return 0; 4496 break; 4497 default: 4498 /* XXX */ 4499 if (bcmp(&spidx0->dst, &spidx1->dst, spidx0->dst.sa.sa_len) != 0) 4500 return 0; 4501 break; 4502 } 4503 4504 /* XXX Do we check other field ? e.g. flowinfo */ 4505 4506 return 1; 4507 } 4508 4509 #ifdef satosin 4510 #undef satosin 4511 #endif 4512 #define satosin(s) ((const struct sockaddr_in *)s) 4513 #ifdef satosin6 4514 #undef satosin6 4515 #endif 4516 #define satosin6(s) ((const struct sockaddr_in6 *)s) 4517 /* returns 0 on match */ 4518 int 4519 key_sockaddrcmp(const struct sockaddr *sa1, const struct sockaddr *sa2, 4520 int port) 4521 { 4522 if (sa1->sa_family != sa2->sa_family || sa1->sa_len != sa2->sa_len) 4523 return 1; 4524 4525 switch (sa1->sa_family) { 4526 #ifdef INET 4527 case AF_INET: 4528 if (sa1->sa_len != sizeof(struct sockaddr_in)) 4529 return 1; 4530 if (satosin(sa1)->sin_addr.s_addr != 4531 satosin(sa2)->sin_addr.s_addr) { 4532 return 1; 4533 } 4534 if (port && satosin(sa1)->sin_port != satosin(sa2)->sin_port) 4535 return 1; 4536 break; 4537 #endif 4538 #ifdef INET6 4539 case AF_INET6: 4540 if (sa1->sa_len != sizeof(struct sockaddr_in6)) 4541 return 1; /*EINVAL*/ 4542 if (satosin6(sa1)->sin6_scope_id != 4543 satosin6(sa2)->sin6_scope_id) { 4544 return 1; 4545 } 4546 if (!IN6_ARE_ADDR_EQUAL(&satosin6(sa1)->sin6_addr, 4547 &satosin6(sa2)->sin6_addr)) { 4548 return 1; 4549 } 4550 if (port && 4551 satosin6(sa1)->sin6_port != satosin6(sa2)->sin6_port) { 4552 return 1; 4553 } 4554 break; 4555 #endif 4556 default: 4557 if (bcmp(sa1, sa2, sa1->sa_len) != 0) 4558 return 1; 4559 break; 4560 } 4561 4562 return 0; 4563 } 4564 4565 /* returns 0 on match */ 4566 int 4567 key_sockaddrcmp_withmask(const struct sockaddr *sa1, 4568 const struct sockaddr *sa2, size_t mask) 4569 { 4570 if (sa1->sa_family != sa2->sa_family || sa1->sa_len != sa2->sa_len) 4571 return (1); 4572 4573 switch (sa1->sa_family) { 4574 #ifdef INET 4575 case AF_INET: 4576 return (!key_bbcmp(&satosin(sa1)->sin_addr, 4577 &satosin(sa2)->sin_addr, mask)); 4578 #endif 4579 #ifdef INET6 4580 case AF_INET6: 4581 if (satosin6(sa1)->sin6_scope_id != 4582 satosin6(sa2)->sin6_scope_id) 4583 return (1); 4584 return (!key_bbcmp(&satosin6(sa1)->sin6_addr, 4585 &satosin6(sa2)->sin6_addr, mask)); 4586 #endif 4587 } 4588 return (1); 4589 } 4590 #undef satosin 4591 #undef satosin6 4592 4593 /* 4594 * compare two buffers with mask. 4595 * IN: 4596 * addr1: source 4597 * addr2: object 4598 * bits: Number of bits to compare 4599 * OUT: 4600 * 1 : equal 4601 * 0 : not equal 4602 */ 4603 static int 4604 key_bbcmp(const void *a1, const void *a2, u_int bits) 4605 { 4606 const unsigned char *p1 = a1; 4607 const unsigned char *p2 = a2; 4608 4609 /* XXX: This could be considerably faster if we compare a word 4610 * at a time, but it is complicated on LSB Endian machines */ 4611 4612 /* Handle null pointers */ 4613 if (p1 == NULL || p2 == NULL) 4614 return (p1 == p2); 4615 4616 while (bits >= 8) { 4617 if (*p1++ != *p2++) 4618 return 0; 4619 bits -= 8; 4620 } 4621 4622 if (bits > 0) { 4623 u_int8_t mask = ~((1<<(8-bits))-1); 4624 if ((*p1 & mask) != (*p2 & mask)) 4625 return 0; 4626 } 4627 return 1; /* Match! */ 4628 } 4629 4630 static void 4631 key_flush_spd(time_t now) 4632 { 4633 SPTREE_RLOCK_TRACKER; 4634 struct secpolicy_list drainq; 4635 struct secpolicy *sp, *nextsp; 4636 u_int dir; 4637 4638 LIST_INIT(&drainq); 4639 SPTREE_RLOCK(); 4640 for (dir = 0; dir < IPSEC_DIR_MAX; dir++) { 4641 TAILQ_FOREACH(sp, &V_sptree[dir], chain) { 4642 if (sp->lifetime == 0 && sp->validtime == 0) 4643 continue; 4644 if ((sp->lifetime && 4645 now - sp->created > sp->lifetime) || 4646 (sp->validtime && 4647 now - sp->lastused > sp->validtime)) { 4648 /* Hold extra reference to send SPDEXPIRE */ 4649 SP_ADDREF(sp); 4650 LIST_INSERT_HEAD(&drainq, sp, drainq); 4651 } 4652 } 4653 } 4654 SPTREE_RUNLOCK(); 4655 if (LIST_EMPTY(&drainq)) 4656 return; 4657 4658 SPTREE_WLOCK(); 4659 sp = LIST_FIRST(&drainq); 4660 while (sp != NULL) { 4661 nextsp = LIST_NEXT(sp, drainq); 4662 /* Check that SP is still linked */ 4663 if (sp->state != IPSEC_SPSTATE_ALIVE) { 4664 LIST_REMOVE(sp, drainq); 4665 key_freesp(&sp); /* release extra reference */ 4666 sp = nextsp; 4667 continue; 4668 } 4669 TAILQ_REMOVE(&V_sptree[sp->spidx.dir], sp, chain); 4670 V_spd_size--; 4671 LIST_REMOVE(sp, idhash); 4672 sp->state = IPSEC_SPSTATE_DEAD; 4673 ipsec_accel_spddel(sp); 4674 sp = nextsp; 4675 } 4676 V_sp_genid++; 4677 SPTREE_WUNLOCK(); 4678 if (SPDCACHE_ENABLED()) 4679 spdcache_clear(); 4680 4681 sp = LIST_FIRST(&drainq); 4682 while (sp != NULL) { 4683 nextsp = LIST_NEXT(sp, drainq); 4684 key_spdexpire(sp); 4685 key_freesp(&sp); /* release extra reference */ 4686 key_freesp(&sp); /* release last reference */ 4687 sp = nextsp; 4688 } 4689 } 4690 4691 static void 4692 key_flush_sad(time_t now) 4693 { 4694 SAHTREE_RLOCK_TRACKER; 4695 struct secashead_list emptyq; 4696 struct secasvar_list drainq, hexpireq, sexpireq, freeq; 4697 struct secashead *sah, *nextsah; 4698 struct secasvar *sav, *nextsav; 4699 4700 SECASVAR_RLOCK_TRACKER; 4701 4702 LIST_INIT(&drainq); 4703 LIST_INIT(&hexpireq); 4704 LIST_INIT(&sexpireq); 4705 LIST_INIT(&emptyq); 4706 4707 SAHTREE_RLOCK(); 4708 TAILQ_FOREACH(sah, &V_sahtree, chain) { 4709 /* Check for empty SAH */ 4710 if (TAILQ_EMPTY(&sah->savtree_larval) && 4711 TAILQ_EMPTY(&sah->savtree_alive)) { 4712 SAH_ADDREF(sah); 4713 LIST_INSERT_HEAD(&emptyq, sah, drainq); 4714 continue; 4715 } 4716 /* Add all stale LARVAL SAs into drainq */ 4717 TAILQ_FOREACH(sav, &sah->savtree_larval, chain) { 4718 if (now - sav->created < V_key_larval_lifetime) 4719 continue; 4720 SAV_ADDREF(sav); 4721 LIST_INSERT_HEAD(&drainq, sav, drainq); 4722 } 4723 TAILQ_FOREACH(sav, &sah->savtree_alive, chain) { 4724 /* lifetimes aren't specified */ 4725 if (sav->lft_h == NULL) 4726 continue; 4727 SECASVAR_RLOCK(sav); 4728 /* 4729 * Check again with lock held, because it may 4730 * be updated by SADB_UPDATE. 4731 */ 4732 if (sav->lft_h == NULL) { 4733 SECASVAR_RUNLOCK(sav); 4734 continue; 4735 } 4736 /* 4737 * RFC 2367: 4738 * HARD lifetimes MUST take precedence over SOFT 4739 * lifetimes, meaning if the HARD and SOFT lifetimes 4740 * are the same, the HARD lifetime will appear on the 4741 * EXPIRE message. 4742 */ 4743 /* check HARD lifetime */ 4744 if ((sav->lft_h->addtime != 0 && 4745 now - sav->created > sav->lft_h->addtime) || 4746 (sav->lft_h->usetime != 0 && sav->firstused && 4747 now - sav->firstused > sav->lft_h->usetime) || 4748 (sav->lft_h->bytes != 0 && counter_u64_fetch( 4749 sav->lft_c_bytes) > sav->lft_h->bytes)) { 4750 SECASVAR_RUNLOCK(sav); 4751 SAV_ADDREF(sav); 4752 LIST_INSERT_HEAD(&hexpireq, sav, drainq); 4753 continue; 4754 } 4755 /* check SOFT lifetime (only for MATURE SAs) */ 4756 if (sav->state == SADB_SASTATE_MATURE && ( 4757 (sav->lft_s->addtime != 0 && 4758 now - sav->created > sav->lft_s->addtime) || 4759 (sav->lft_s->usetime != 0 && sav->firstused && 4760 now - sav->firstused > sav->lft_s->usetime) || 4761 (sav->lft_s->bytes != 0 && counter_u64_fetch( 4762 sav->lft_c_bytes) > sav->lft_s->bytes) || 4763 (!(sav->flags & SADB_X_SAFLAGS_ESN) && 4764 (sav->replay != NULL) && ( 4765 (sav->replay->count > UINT32_80PCT) || 4766 (sav->replay->last > UINT32_80PCT))))) { 4767 SECASVAR_RUNLOCK(sav); 4768 SAV_ADDREF(sav); 4769 LIST_INSERT_HEAD(&sexpireq, sav, drainq); 4770 continue; 4771 } 4772 SECASVAR_RUNLOCK(sav); 4773 } 4774 } 4775 SAHTREE_RUNLOCK(); 4776 4777 if (LIST_EMPTY(&emptyq) && LIST_EMPTY(&drainq) && 4778 LIST_EMPTY(&hexpireq) && LIST_EMPTY(&sexpireq)) 4779 return; 4780 4781 LIST_INIT(&freeq); 4782 SAHTREE_WLOCK(); 4783 /* Unlink stale LARVAL SAs */ 4784 sav = LIST_FIRST(&drainq); 4785 while (sav != NULL) { 4786 nextsav = LIST_NEXT(sav, drainq); 4787 /* Check that SA is still LARVAL */ 4788 if (sav->state != SADB_SASTATE_LARVAL) { 4789 LIST_REMOVE(sav, drainq); 4790 LIST_INSERT_HEAD(&freeq, sav, drainq); 4791 sav = nextsav; 4792 continue; 4793 } 4794 TAILQ_REMOVE(&sav->sah->savtree_larval, sav, chain); 4795 LIST_REMOVE(sav, spihash); 4796 sav->state = SADB_SASTATE_DEAD; 4797 ipsec_accel_forget_sav(sav); 4798 sav = nextsav; 4799 } 4800 /* Unlink all SAs with expired HARD lifetime */ 4801 sav = LIST_FIRST(&hexpireq); 4802 while (sav != NULL) { 4803 nextsav = LIST_NEXT(sav, drainq); 4804 /* Check that SA is not unlinked */ 4805 if (sav->state == SADB_SASTATE_DEAD) { 4806 LIST_REMOVE(sav, drainq); 4807 LIST_INSERT_HEAD(&freeq, sav, drainq); 4808 sav = nextsav; 4809 continue; 4810 } 4811 TAILQ_REMOVE(&sav->sah->savtree_alive, sav, chain); 4812 LIST_REMOVE(sav, spihash); 4813 sav->state = SADB_SASTATE_DEAD; 4814 ipsec_accel_forget_sav(sav); 4815 sav = nextsav; 4816 } 4817 /* Mark all SAs with expired SOFT lifetime as DYING */ 4818 sav = LIST_FIRST(&sexpireq); 4819 while (sav != NULL) { 4820 nextsav = LIST_NEXT(sav, drainq); 4821 /* Check that SA is not unlinked */ 4822 if (sav->state == SADB_SASTATE_DEAD) { 4823 LIST_REMOVE(sav, drainq); 4824 LIST_INSERT_HEAD(&freeq, sav, drainq); 4825 sav = nextsav; 4826 continue; 4827 } 4828 /* 4829 * NOTE: this doesn't change SA order in the chain. 4830 */ 4831 sav->state = SADB_SASTATE_DYING; 4832 sav = nextsav; 4833 } 4834 /* Unlink empty SAHs */ 4835 sah = LIST_FIRST(&emptyq); 4836 while (sah != NULL) { 4837 nextsah = LIST_NEXT(sah, drainq); 4838 /* Check that SAH is still empty and not unlinked */ 4839 if (sah->state == SADB_SASTATE_DEAD || 4840 !TAILQ_EMPTY(&sah->savtree_larval) || 4841 !TAILQ_EMPTY(&sah->savtree_alive)) { 4842 LIST_REMOVE(sah, drainq); 4843 key_freesah(&sah); /* release extra reference */ 4844 sah = nextsah; 4845 continue; 4846 } 4847 TAILQ_REMOVE(&V_sahtree, sah, chain); 4848 LIST_REMOVE(sah, addrhash); 4849 sah->state = SADB_SASTATE_DEAD; 4850 sah = nextsah; 4851 } 4852 SAHTREE_WUNLOCK(); 4853 4854 /* Send SPDEXPIRE messages */ 4855 sav = LIST_FIRST(&hexpireq); 4856 while (sav != NULL) { 4857 nextsav = LIST_NEXT(sav, drainq); 4858 key_expire(sav, 1); 4859 key_freesah(&sav->sah); /* release reference from SAV */ 4860 key_freesav(&sav); /* release extra reference */ 4861 key_freesav(&sav); /* release last reference */ 4862 sav = nextsav; 4863 } 4864 sav = LIST_FIRST(&sexpireq); 4865 while (sav != NULL) { 4866 nextsav = LIST_NEXT(sav, drainq); 4867 key_expire(sav, 0); 4868 key_freesav(&sav); /* release extra reference */ 4869 sav = nextsav; 4870 } 4871 /* Free stale LARVAL SAs */ 4872 sav = LIST_FIRST(&drainq); 4873 while (sav != NULL) { 4874 nextsav = LIST_NEXT(sav, drainq); 4875 key_freesah(&sav->sah); /* release reference from SAV */ 4876 key_freesav(&sav); /* release extra reference */ 4877 key_freesav(&sav); /* release last reference */ 4878 sav = nextsav; 4879 } 4880 /* Free SAs that were unlinked/changed by someone else */ 4881 sav = LIST_FIRST(&freeq); 4882 while (sav != NULL) { 4883 nextsav = LIST_NEXT(sav, drainq); 4884 key_freesav(&sav); /* release extra reference */ 4885 sav = nextsav; 4886 } 4887 /* Free empty SAH */ 4888 sah = LIST_FIRST(&emptyq); 4889 while (sah != NULL) { 4890 nextsah = LIST_NEXT(sah, drainq); 4891 key_freesah(&sah); /* release extra reference */ 4892 key_freesah(&sah); /* release last reference */ 4893 sah = nextsah; 4894 } 4895 } 4896 4897 static void 4898 key_flush_acq(time_t now) 4899 { 4900 struct secacq *acq, *nextacq; 4901 4902 /* ACQ tree */ 4903 ACQ_LOCK(); 4904 acq = LIST_FIRST(&V_acqtree); 4905 while (acq != NULL) { 4906 nextacq = LIST_NEXT(acq, chain); 4907 if (now - acq->created > V_key_blockacq_lifetime) { 4908 LIST_REMOVE(acq, chain); 4909 LIST_REMOVE(acq, addrhash); 4910 LIST_REMOVE(acq, seqhash); 4911 free(acq, M_IPSEC_SAQ); 4912 } 4913 acq = nextacq; 4914 } 4915 ACQ_UNLOCK(); 4916 } 4917 4918 static void 4919 key_flush_spacq(time_t now) 4920 { 4921 struct secspacq *acq, *nextacq; 4922 4923 /* SP ACQ tree */ 4924 SPACQ_LOCK(); 4925 for (acq = LIST_FIRST(&V_spacqtree); acq != NULL; acq = nextacq) { 4926 nextacq = LIST_NEXT(acq, chain); 4927 if (now - acq->created > V_key_blockacq_lifetime 4928 && __LIST_CHAINED(acq)) { 4929 LIST_REMOVE(acq, chain); 4930 free(acq, M_IPSEC_SAQ); 4931 } 4932 } 4933 SPACQ_UNLOCK(); 4934 } 4935 4936 /* 4937 * time handler. 4938 * scanning SPD and SAD to check status for each entries, 4939 * and do to remove or to expire. 4940 * XXX: year 2038 problem may remain. 4941 */ 4942 static void 4943 key_timehandler(void *arg) 4944 { 4945 VNET_ITERATOR_DECL(vnet_iter); 4946 time_t now = time_second; 4947 4948 VNET_LIST_RLOCK_NOSLEEP(); 4949 VNET_FOREACH(vnet_iter) { 4950 CURVNET_SET(vnet_iter); 4951 key_flush_spd(now); 4952 key_flush_sad(now); 4953 key_flush_acq(now); 4954 key_flush_spacq(now); 4955 CURVNET_RESTORE(); 4956 } 4957 VNET_LIST_RUNLOCK_NOSLEEP(); 4958 4959 #ifndef IPSEC_DEBUG2 4960 /* do exchange to tick time !! */ 4961 callout_schedule(&key_timer, hz); 4962 #endif /* IPSEC_DEBUG2 */ 4963 } 4964 4965 u_long 4966 key_random(void) 4967 { 4968 u_long value; 4969 4970 arc4random_buf(&value, sizeof(value)); 4971 return value; 4972 } 4973 4974 /* 4975 * map SADB_SATYPE_* to IPPROTO_*. 4976 * if satype == SADB_SATYPE then satype is mapped to ~0. 4977 * OUT: 4978 * 0: invalid satype. 4979 */ 4980 static uint8_t 4981 key_satype2proto(uint8_t satype) 4982 { 4983 switch (satype) { 4984 case SADB_SATYPE_UNSPEC: 4985 return IPSEC_PROTO_ANY; 4986 case SADB_SATYPE_AH: 4987 return IPPROTO_AH; 4988 case SADB_SATYPE_ESP: 4989 return IPPROTO_ESP; 4990 case SADB_X_SATYPE_IPCOMP: 4991 return IPPROTO_IPCOMP; 4992 case SADB_X_SATYPE_TCPSIGNATURE: 4993 return IPPROTO_TCP; 4994 default: 4995 return 0; 4996 } 4997 /* NOTREACHED */ 4998 } 4999 5000 /* 5001 * map IPPROTO_* to SADB_SATYPE_* 5002 * OUT: 5003 * 0: invalid protocol type. 5004 */ 5005 static uint8_t 5006 key_proto2satype(uint8_t proto) 5007 { 5008 switch (proto) { 5009 case IPPROTO_AH: 5010 return SADB_SATYPE_AH; 5011 case IPPROTO_ESP: 5012 return SADB_SATYPE_ESP; 5013 case IPPROTO_IPCOMP: 5014 return SADB_X_SATYPE_IPCOMP; 5015 case IPPROTO_TCP: 5016 return SADB_X_SATYPE_TCPSIGNATURE; 5017 default: 5018 return 0; 5019 } 5020 /* NOTREACHED */ 5021 } 5022 5023 /* %%% PF_KEY */ 5024 /* 5025 * SADB_GETSPI processing is to receive 5026 * <base, (SA2), src address, dst address, (SPI range)> 5027 * from the IKMPd, to assign a unique spi value, to hang on the INBOUND 5028 * tree with the status of LARVAL, and send 5029 * <base, SA(*), address(SD)> 5030 * to the IKMPd. 5031 * 5032 * IN: mhp: pointer to the pointer to each header. 5033 * OUT: NULL if fail. 5034 * other if success, return pointer to the message to send. 5035 */ 5036 static int 5037 key_getspi(struct socket *so, struct mbuf *m, const struct sadb_msghdr *mhp) 5038 { 5039 struct secasindex saidx; 5040 struct sadb_address *src0, *dst0; 5041 struct secasvar *sav; 5042 uint32_t reqid, spi; 5043 int error; 5044 uint8_t mode, proto; 5045 5046 IPSEC_ASSERT(so != NULL, ("null socket")); 5047 IPSEC_ASSERT(m != NULL, ("null mbuf")); 5048 IPSEC_ASSERT(mhp != NULL, ("null msghdr")); 5049 IPSEC_ASSERT(mhp->msg != NULL, ("null msg")); 5050 5051 if (SADB_CHECKHDR(mhp, SADB_EXT_ADDRESS_SRC) || 5052 SADB_CHECKHDR(mhp, SADB_EXT_ADDRESS_DST) 5053 #ifdef PFKEY_STRICT_CHECKS 5054 || SADB_CHECKHDR(mhp, SADB_EXT_SPIRANGE) 5055 #endif 5056 ) { 5057 ipseclog((LOG_DEBUG, 5058 "%s: invalid message: missing required header.\n", 5059 __func__)); 5060 error = EINVAL; 5061 goto fail; 5062 } 5063 if (SADB_CHECKLEN(mhp, SADB_EXT_ADDRESS_SRC) || 5064 SADB_CHECKLEN(mhp, SADB_EXT_ADDRESS_DST) 5065 #ifdef PFKEY_STRICT_CHECKS 5066 || SADB_CHECKLEN(mhp, SADB_EXT_SPIRANGE) 5067 #endif 5068 ) { 5069 ipseclog((LOG_DEBUG, 5070 "%s: invalid message: wrong header size.\n", __func__)); 5071 error = EINVAL; 5072 goto fail; 5073 } 5074 if (SADB_CHECKHDR(mhp, SADB_X_EXT_SA2)) { 5075 mode = IPSEC_MODE_ANY; 5076 reqid = 0; 5077 } else { 5078 if (SADB_CHECKLEN(mhp, SADB_X_EXT_SA2)) { 5079 ipseclog((LOG_DEBUG, 5080 "%s: invalid message: wrong header size.\n", 5081 __func__)); 5082 error = EINVAL; 5083 goto fail; 5084 } 5085 mode = ((struct sadb_x_sa2 *) 5086 mhp->ext[SADB_X_EXT_SA2])->sadb_x_sa2_mode; 5087 reqid = ((struct sadb_x_sa2 *) 5088 mhp->ext[SADB_X_EXT_SA2])->sadb_x_sa2_reqid; 5089 } 5090 5091 src0 = (struct sadb_address *)(mhp->ext[SADB_EXT_ADDRESS_SRC]); 5092 dst0 = (struct sadb_address *)(mhp->ext[SADB_EXT_ADDRESS_DST]); 5093 5094 /* map satype to proto */ 5095 if ((proto = key_satype2proto(mhp->msg->sadb_msg_satype)) == 0) { 5096 ipseclog((LOG_DEBUG, "%s: invalid satype is passed.\n", 5097 __func__)); 5098 error = EINVAL; 5099 goto fail; 5100 } 5101 error = key_checksockaddrs((struct sockaddr *)(src0 + 1), 5102 (struct sockaddr *)(dst0 + 1)); 5103 if (error != 0) { 5104 ipseclog((LOG_DEBUG, "%s: invalid sockaddr.\n", __func__)); 5105 error = EINVAL; 5106 goto fail; 5107 } 5108 KEY_SETSECASIDX(proto, mode, reqid, src0 + 1, dst0 + 1, &saidx); 5109 5110 /* SPI allocation */ 5111 SPI_ALLOC_LOCK(); 5112 spi = key_do_getnewspi( 5113 (struct sadb_spirange *)mhp->ext[SADB_EXT_SPIRANGE], &saidx); 5114 if (spi == 0) { 5115 /* 5116 * Requested SPI or SPI range is not available or 5117 * already used. 5118 */ 5119 SPI_ALLOC_UNLOCK(); 5120 error = EEXIST; 5121 goto fail; 5122 } 5123 sav = key_newsav(mhp, &saidx, spi, &error); 5124 SPI_ALLOC_UNLOCK(); 5125 if (sav == NULL) 5126 goto fail; 5127 5128 if (sav->seq != 0) { 5129 /* 5130 * RFC2367: 5131 * If the SADB_GETSPI message is in response to a 5132 * kernel-generated SADB_ACQUIRE, the sadb_msg_seq 5133 * MUST be the same as the SADB_ACQUIRE message. 5134 * 5135 * XXXAE: However it doesn't definethe behaviour how to 5136 * check this and what to do if it doesn't match. 5137 * Also what we should do if it matches? 5138 * 5139 * We can compare saidx used in SADB_ACQUIRE with saidx 5140 * used in SADB_GETSPI, but this probably can break 5141 * existing software. For now just warn if it doesn't match. 5142 * 5143 * XXXAE: anyway it looks useless. 5144 */ 5145 key_acqdone(&saidx, sav->seq); 5146 } 5147 KEYDBG(KEY_STAMP, 5148 printf("%s: SA(%p)\n", __func__, sav)); 5149 KEYDBG(KEY_DATA, kdebug_secasv(sav)); 5150 5151 { 5152 struct mbuf *n, *nn; 5153 struct sadb_sa *m_sa; 5154 struct sadb_msg *newmsg; 5155 int off, len; 5156 5157 /* create new sadb_msg to reply. */ 5158 len = PFKEY_ALIGN8(sizeof(struct sadb_msg)) + 5159 PFKEY_ALIGN8(sizeof(struct sadb_sa)); 5160 5161 n = key_mget(len); 5162 if (n == NULL) { 5163 error = ENOBUFS; 5164 goto fail; 5165 } 5166 5167 n->m_len = len; 5168 n->m_next = NULL; 5169 off = 0; 5170 5171 m_copydata(m, 0, sizeof(struct sadb_msg), mtod(n, caddr_t) + off); 5172 off += PFKEY_ALIGN8(sizeof(struct sadb_msg)); 5173 5174 m_sa = (struct sadb_sa *)(mtod(n, caddr_t) + off); 5175 m_sa->sadb_sa_len = PFKEY_UNIT64(sizeof(struct sadb_sa)); 5176 m_sa->sadb_sa_exttype = SADB_EXT_SA; 5177 m_sa->sadb_sa_spi = spi; /* SPI is already in network byte order */ 5178 off += PFKEY_ALIGN8(sizeof(struct sadb_sa)); 5179 5180 IPSEC_ASSERT(off == len, 5181 ("length inconsistency (off %u len %u)", off, len)); 5182 5183 n->m_next = key_gather_mbuf(m, mhp, 0, 2, SADB_EXT_ADDRESS_SRC, 5184 SADB_EXT_ADDRESS_DST); 5185 if (!n->m_next) { 5186 m_freem(n); 5187 error = ENOBUFS; 5188 goto fail; 5189 } 5190 5191 if (n->m_len < sizeof(struct sadb_msg)) { 5192 n = m_pullup(n, sizeof(struct sadb_msg)); 5193 if (n == NULL) 5194 return key_sendup_mbuf(so, m, KEY_SENDUP_ONE); 5195 } 5196 5197 n->m_pkthdr.len = 0; 5198 for (nn = n; nn; nn = nn->m_next) 5199 n->m_pkthdr.len += nn->m_len; 5200 5201 newmsg = mtod(n, struct sadb_msg *); 5202 newmsg->sadb_msg_seq = sav->seq; 5203 newmsg->sadb_msg_errno = 0; 5204 newmsg->sadb_msg_len = PFKEY_UNIT64(n->m_pkthdr.len); 5205 5206 m_freem(m); 5207 return key_sendup_mbuf(so, n, KEY_SENDUP_ONE); 5208 } 5209 5210 fail: 5211 return (key_senderror(so, m, error)); 5212 } 5213 5214 /* 5215 * allocating new SPI 5216 * called by key_getspi(). 5217 * OUT: 5218 * 0: failure. 5219 * others: success, SPI in network byte order. 5220 */ 5221 static uint32_t 5222 key_do_getnewspi(struct sadb_spirange *spirange, struct secasindex *saidx) 5223 { 5224 uint32_t min, max, newspi, t; 5225 int tries, limit; 5226 5227 SPI_ALLOC_LOCK_ASSERT(); 5228 5229 /* set spi range to allocate */ 5230 if (spirange != NULL) { 5231 min = spirange->sadb_spirange_min; 5232 max = spirange->sadb_spirange_max; 5233 } else { 5234 min = V_key_spi_minval; 5235 max = V_key_spi_maxval; 5236 } 5237 /* IPCOMP needs 2-byte SPI */ 5238 if (saidx->proto == IPPROTO_IPCOMP) { 5239 if (min >= 0x10000) 5240 min = 0xffff; 5241 if (max >= 0x10000) 5242 max = 0xffff; 5243 if (min > max) { 5244 t = min; min = max; max = t; 5245 } 5246 } 5247 5248 if (min == max) { 5249 if (key_checkspidup(htonl(min))) { 5250 ipseclog((LOG_DEBUG, "%s: SPI %u exists already.\n", 5251 __func__, min)); 5252 return 0; 5253 } 5254 5255 tries = 1; 5256 newspi = min; 5257 } else { 5258 /* init SPI */ 5259 newspi = 0; 5260 5261 limit = atomic_load_int(&V_key_spi_trycnt); 5262 /* when requesting to allocate spi ranged */ 5263 for (tries = 0; tries < limit; tries++) { 5264 /* generate pseudo-random SPI value ranged. */ 5265 newspi = min + (key_random() % (max - min + 1)); 5266 if (!key_checkspidup(htonl(newspi))) 5267 break; 5268 } 5269 5270 if (tries == limit || newspi == 0) { 5271 ipseclog((LOG_DEBUG, 5272 "%s: failed to allocate SPI.\n", __func__)); 5273 return 0; 5274 } 5275 } 5276 5277 /* statistics */ 5278 keystat.getspi_count = 5279 (keystat.getspi_count + tries) / 2; 5280 5281 return (htonl(newspi)); 5282 } 5283 5284 /* 5285 * Find TCP-MD5 SA with corresponding secasindex. 5286 * If not found, return NULL and fill SPI with usable value if needed. 5287 */ 5288 static struct secasvar * 5289 key_getsav_tcpmd5(struct secasindex *saidx, uint32_t *spi) 5290 { 5291 SAHTREE_RLOCK_TRACKER; 5292 struct secashead *sah; 5293 struct secasvar *sav; 5294 5295 IPSEC_ASSERT(saidx->proto == IPPROTO_TCP, ("wrong proto")); 5296 SAHTREE_RLOCK(); 5297 LIST_FOREACH(sah, SAHADDRHASH_HASH(saidx), addrhash) { 5298 if (sah->saidx.proto != IPPROTO_TCP) 5299 continue; 5300 if (!key_sockaddrcmp(&saidx->dst.sa, &sah->saidx.dst.sa, 0) && 5301 !key_sockaddrcmp(&saidx->src.sa, &sah->saidx.src.sa, 0)) 5302 break; 5303 } 5304 if (sah != NULL) { 5305 if (V_key_preferred_oldsa) 5306 sav = TAILQ_LAST(&sah->savtree_alive, secasvar_queue); 5307 else 5308 sav = TAILQ_FIRST(&sah->savtree_alive); 5309 if (sav != NULL) { 5310 SAV_ADDREF(sav); 5311 SAHTREE_RUNLOCK(); 5312 return (sav); 5313 } 5314 } 5315 if (spi == NULL) { 5316 /* No SPI required */ 5317 SAHTREE_RUNLOCK(); 5318 return (NULL); 5319 } 5320 /* Check that SPI is unique */ 5321 LIST_FOREACH(sav, SAVHASH_HASH(*spi), spihash) { 5322 if (sav->spi == *spi) 5323 break; 5324 } 5325 if (sav == NULL) { 5326 SAHTREE_RUNLOCK(); 5327 /* SPI is already unique */ 5328 return (NULL); 5329 } 5330 SAHTREE_RUNLOCK(); 5331 /* XXX: not optimal */ 5332 *spi = key_do_getnewspi(NULL, saidx); 5333 return (NULL); 5334 } 5335 5336 static int 5337 key_updateaddresses(struct socket *so, struct mbuf *m, 5338 const struct sadb_msghdr *mhp, struct secasvar *sav, 5339 struct secasindex *saidx) 5340 { 5341 struct sockaddr *newaddr; 5342 struct secashead *sah; 5343 struct secasvar *newsav, *tmp; 5344 struct mbuf *n; 5345 int error, isnew; 5346 5347 /* Check that we need to change SAH */ 5348 if (!SADB_CHECKHDR(mhp, SADB_X_EXT_NEW_ADDRESS_SRC)) { 5349 newaddr = (struct sockaddr *)( 5350 ((struct sadb_address *) 5351 mhp->ext[SADB_X_EXT_NEW_ADDRESS_SRC]) + 1); 5352 bcopy(newaddr, &saidx->src, newaddr->sa_len); 5353 key_porttosaddr(&saidx->src.sa, 0); 5354 } 5355 if (!SADB_CHECKHDR(mhp, SADB_X_EXT_NEW_ADDRESS_DST)) { 5356 newaddr = (struct sockaddr *)( 5357 ((struct sadb_address *) 5358 mhp->ext[SADB_X_EXT_NEW_ADDRESS_DST]) + 1); 5359 bcopy(newaddr, &saidx->dst, newaddr->sa_len); 5360 key_porttosaddr(&saidx->dst.sa, 0); 5361 } 5362 if (!SADB_CHECKHDR(mhp, SADB_X_EXT_NEW_ADDRESS_SRC) || 5363 !SADB_CHECKHDR(mhp, SADB_X_EXT_NEW_ADDRESS_DST)) { 5364 error = key_checksockaddrs(&saidx->src.sa, &saidx->dst.sa); 5365 if (error != 0) { 5366 ipseclog((LOG_DEBUG, "%s: invalid new sockaddr.\n", 5367 __func__)); 5368 return (error); 5369 } 5370 5371 sah = key_getsah(saidx); 5372 if (sah == NULL) { 5373 /* create a new SA index */ 5374 sah = key_newsah(saidx); 5375 if (sah == NULL) { 5376 ipseclog((LOG_DEBUG, 5377 "%s: No more memory.\n", __func__)); 5378 return (ENOBUFS); 5379 } 5380 isnew = 2; /* SAH is new */ 5381 } else 5382 isnew = 1; /* existing SAH is referenced */ 5383 } else { 5384 /* 5385 * src and dst addresses are still the same. 5386 * Do we want to change NAT-T config? 5387 */ 5388 if (sav->sah->saidx.proto != IPPROTO_ESP || 5389 SADB_CHECKHDR(mhp, SADB_X_EXT_NAT_T_TYPE) || 5390 SADB_CHECKHDR(mhp, SADB_X_EXT_NAT_T_SPORT) || 5391 SADB_CHECKHDR(mhp, SADB_X_EXT_NAT_T_DPORT)) { 5392 ipseclog((LOG_DEBUG, 5393 "%s: invalid message: missing required header.\n", 5394 __func__)); 5395 return (EINVAL); 5396 } 5397 /* We hold reference to SA, thus SAH will be referenced too. */ 5398 sah = sav->sah; 5399 isnew = 0; 5400 } 5401 5402 newsav = malloc(sizeof(struct secasvar), M_IPSEC_SA, 5403 M_NOWAIT | M_ZERO); 5404 if (newsav == NULL) { 5405 ipseclog((LOG_DEBUG, "%s: No more memory.\n", __func__)); 5406 error = ENOBUFS; 5407 goto fail; 5408 } 5409 5410 /* Clone SA's content into newsav */ 5411 SAV_INITREF(newsav); 5412 bcopy(sav, newsav, offsetof(struct secasvar, chain)); 5413 #ifdef IPSEC_OFFLOAD 5414 CK_LIST_INIT(&newsav->accel_ifps); 5415 newsav->accel_forget_tq = 0; 5416 newsav->accel_lft_sw = uma_zalloc_pcpu(ipsec_key_lft_zone, 5417 M_NOWAIT | M_ZERO); 5418 if (newsav->accel_lft_sw == NULL) { 5419 error = ENOBUFS; 5420 goto fail; 5421 } 5422 if (sav->accel_ifname != NULL) { 5423 struct sadb_x_if_hw_offl xof; 5424 5425 newsav->accel_ifname = malloc(sizeof(xof.sadb_x_if_hw_offl_if), 5426 M_IPSEC_MISC, M_NOWAIT); 5427 if (newsav->accel_ifname == NULL) { 5428 error = ENOBUFS; 5429 goto fail; 5430 } 5431 strncpy(__DECONST(char *, sav->accel_ifname), 5432 newsav->accel_ifname, 5433 sizeof(xof.sadb_x_if_hw_offl_if)); 5434 } 5435 #endif 5436 5437 /* 5438 * We create new NAT-T config if it is needed. 5439 * Old NAT-T config will be freed by key_cleansav() when 5440 * last reference to SA will be released. 5441 */ 5442 newsav->natt = NULL; 5443 newsav->sah = sah; 5444 newsav->state = SADB_SASTATE_MATURE; 5445 error = key_setnatt(newsav, mhp); 5446 if (error != 0) 5447 goto fail; 5448 5449 SAHTREE_WLOCK(); 5450 /* Check that SA is still alive */ 5451 if (sav->state == SADB_SASTATE_DEAD) { 5452 /* SA was unlinked */ 5453 SAHTREE_WUNLOCK(); 5454 error = ESRCH; 5455 goto fail; 5456 } 5457 5458 /* Unlink SA from SAH and SPI hash */ 5459 IPSEC_ASSERT((sav->flags & SADB_X_EXT_F_CLONED) == 0, 5460 ("SA is already cloned")); 5461 IPSEC_ASSERT(sav->state == SADB_SASTATE_MATURE || 5462 sav->state == SADB_SASTATE_DYING, 5463 ("Wrong SA state %u\n", sav->state)); 5464 TAILQ_REMOVE(&sav->sah->savtree_alive, sav, chain); 5465 LIST_REMOVE(sav, spihash); 5466 sav->state = SADB_SASTATE_DEAD; 5467 ipsec_accel_forget_sav(sav); 5468 5469 /* 5470 * Link new SA with SAH. Keep SAs ordered by 5471 * create time (newer are first). 5472 */ 5473 TAILQ_FOREACH(tmp, &sah->savtree_alive, chain) { 5474 if (newsav->created > tmp->created) { 5475 TAILQ_INSERT_BEFORE(tmp, newsav, chain); 5476 break; 5477 } 5478 } 5479 if (tmp == NULL) 5480 TAILQ_INSERT_TAIL(&sah->savtree_alive, newsav, chain); 5481 5482 /* Add new SA into SPI hash. */ 5483 LIST_INSERT_HEAD(SAVHASH_HASH(newsav->spi), newsav, spihash); 5484 5485 /* Add new SAH into SADB. */ 5486 if (isnew == 2) { 5487 TAILQ_INSERT_HEAD(&V_sahtree, sah, chain); 5488 LIST_INSERT_HEAD(SAHADDRHASH_HASH(saidx), sah, addrhash); 5489 sah->state = SADB_SASTATE_MATURE; 5490 SAH_ADDREF(sah); /* newsav references new SAH */ 5491 } 5492 /* 5493 * isnew == 1 -> @sah was referenced by key_getsah(). 5494 * isnew == 0 -> we use the same @sah, that was used by @sav, 5495 * and we use its reference for @newsav. 5496 */ 5497 SECASVAR_WLOCK(sav); 5498 /* XXX: replace cntr with pointer? */ 5499 newsav->cntr = sav->cntr; 5500 sav->flags |= SADB_X_EXT_F_CLONED; 5501 SECASVAR_WUNLOCK(sav); 5502 5503 SAHTREE_WUNLOCK(); 5504 5505 KEYDBG(KEY_STAMP, 5506 printf("%s: SA(%p) cloned into SA(%p)\n", 5507 __func__, sav, newsav)); 5508 KEYDBG(KEY_DATA, kdebug_secasv(newsav)); 5509 5510 key_freesav(&sav); /* release last reference */ 5511 5512 /* set msg buf from mhp */ 5513 n = key_getmsgbuf_x1(m, mhp); 5514 if (n == NULL) { 5515 ipseclog((LOG_DEBUG, "%s: No more memory.\n", __func__)); 5516 return (ENOBUFS); 5517 } 5518 m_freem(m); 5519 key_sendup_mbuf(so, n, KEY_SENDUP_ALL); 5520 return (0); 5521 fail: 5522 if (isnew != 0) 5523 key_freesah(&sah); 5524 if (newsav != NULL) { 5525 #ifdef IPSEC_OFFLOAD 5526 uma_zfree_pcpu(ipsec_key_lft_zone, newsav->accel_lft_sw); 5527 free(__DECONST(char *, newsav->accel_ifname), M_IPSEC_MISC); 5528 #endif 5529 if (newsav->natt != NULL) 5530 free(newsav->natt, M_IPSEC_MISC); 5531 free(newsav, M_IPSEC_SA); 5532 } 5533 return (error); 5534 } 5535 5536 /* 5537 * SADB_UPDATE processing 5538 * receive 5539 * <base, SA, (SA2), (lifetime(HSC),) address(SD), (address(P),) 5540 * key(AE), (identity(SD),) (sensitivity)> 5541 * from the ikmpd, and update a secasvar entry whose status is SADB_SASTATE_LARVAL. 5542 * and send 5543 * <base, SA, (SA2), (lifetime(HSC),) address(SD), (address(P),) 5544 * (identity(SD),) (sensitivity)> 5545 * to the ikmpd. 5546 * 5547 * m will always be freed. 5548 */ 5549 static int 5550 key_update(struct socket *so, struct mbuf *m, const struct sadb_msghdr *mhp) 5551 { 5552 struct secasindex saidx; 5553 struct sadb_address *src0, *dst0; 5554 struct sadb_sa *sa0; 5555 struct secasvar *sav; 5556 uint32_t reqid; 5557 int error; 5558 uint8_t mode, proto; 5559 5560 IPSEC_ASSERT(so != NULL, ("null socket")); 5561 IPSEC_ASSERT(m != NULL, ("null mbuf")); 5562 IPSEC_ASSERT(mhp != NULL, ("null msghdr")); 5563 IPSEC_ASSERT(mhp->msg != NULL, ("null msg")); 5564 5565 /* map satype to proto */ 5566 if ((proto = key_satype2proto(mhp->msg->sadb_msg_satype)) == 0) { 5567 ipseclog((LOG_DEBUG, "%s: invalid satype is passed.\n", 5568 __func__)); 5569 return key_senderror(so, m, EINVAL); 5570 } 5571 5572 if (SADB_CHECKHDR(mhp, SADB_EXT_SA) || 5573 SADB_CHECKHDR(mhp, SADB_EXT_ADDRESS_SRC) || 5574 SADB_CHECKHDR(mhp, SADB_EXT_ADDRESS_DST) || 5575 (SADB_CHECKHDR(mhp, SADB_EXT_LIFETIME_HARD) && 5576 !SADB_CHECKHDR(mhp, SADB_EXT_LIFETIME_SOFT)) || 5577 (SADB_CHECKHDR(mhp, SADB_EXT_LIFETIME_SOFT) && 5578 !SADB_CHECKHDR(mhp, SADB_EXT_LIFETIME_HARD))) { 5579 ipseclog((LOG_DEBUG, 5580 "%s: invalid message: missing required header.\n", 5581 __func__)); 5582 return key_senderror(so, m, EINVAL); 5583 } 5584 if (SADB_CHECKLEN(mhp, SADB_EXT_SA) || 5585 SADB_CHECKLEN(mhp, SADB_EXT_ADDRESS_SRC) || 5586 SADB_CHECKLEN(mhp, SADB_EXT_ADDRESS_DST)) { 5587 ipseclog((LOG_DEBUG, 5588 "%s: invalid message: wrong header size.\n", __func__)); 5589 return key_senderror(so, m, EINVAL); 5590 } 5591 if (SADB_CHECKHDR(mhp, SADB_X_EXT_SA2)) { 5592 mode = IPSEC_MODE_ANY; 5593 reqid = 0; 5594 } else { 5595 if (SADB_CHECKLEN(mhp, SADB_X_EXT_SA2)) { 5596 ipseclog((LOG_DEBUG, 5597 "%s: invalid message: wrong header size.\n", 5598 __func__)); 5599 return key_senderror(so, m, EINVAL); 5600 } 5601 mode = ((struct sadb_x_sa2 *) 5602 mhp->ext[SADB_X_EXT_SA2])->sadb_x_sa2_mode; 5603 reqid = ((struct sadb_x_sa2 *) 5604 mhp->ext[SADB_X_EXT_SA2])->sadb_x_sa2_reqid; 5605 } 5606 5607 sa0 = (struct sadb_sa *)mhp->ext[SADB_EXT_SA]; 5608 src0 = (struct sadb_address *)(mhp->ext[SADB_EXT_ADDRESS_SRC]); 5609 dst0 = (struct sadb_address *)(mhp->ext[SADB_EXT_ADDRESS_DST]); 5610 5611 /* 5612 * Only SADB_SASTATE_MATURE SAs may be submitted in an 5613 * SADB_UPDATE message. 5614 */ 5615 if (sa0->sadb_sa_state != SADB_SASTATE_MATURE) { 5616 ipseclog((LOG_DEBUG, "%s: invalid state.\n", __func__)); 5617 #ifdef PFKEY_STRICT_CHECKS 5618 return key_senderror(so, m, EINVAL); 5619 #endif 5620 } 5621 error = key_checksockaddrs((struct sockaddr *)(src0 + 1), 5622 (struct sockaddr *)(dst0 + 1)); 5623 if (error != 0) { 5624 ipseclog((LOG_DEBUG, "%s: invalid sockaddr.\n", __func__)); 5625 return key_senderror(so, m, error); 5626 } 5627 KEY_SETSECASIDX(proto, mode, reqid, src0 + 1, dst0 + 1, &saidx); 5628 sav = key_getsavbyspi(sa0->sadb_sa_spi); 5629 if (sav == NULL) { 5630 ipseclog((LOG_DEBUG, "%s: no SA found for SPI %u\n", 5631 __func__, ntohl(sa0->sadb_sa_spi))); 5632 return key_senderror(so, m, EINVAL); 5633 } 5634 /* 5635 * Check that SADB_UPDATE issued by the same process that did 5636 * SADB_GETSPI or SADB_ADD. 5637 */ 5638 if (sav->pid != mhp->msg->sadb_msg_pid) { 5639 ipseclog((LOG_DEBUG, 5640 "%s: pid mismatched (SPI %u, pid %u vs. %u)\n", __func__, 5641 ntohl(sav->spi), sav->pid, mhp->msg->sadb_msg_pid)); 5642 key_freesav(&sav); 5643 return key_senderror(so, m, EINVAL); 5644 } 5645 /* saidx should match with SA. */ 5646 if (key_cmpsaidx(&sav->sah->saidx, &saidx, CMP_MODE_REQID) == 0) { 5647 ipseclog((LOG_DEBUG, "%s: saidx mismatched for SPI %u\n", 5648 __func__, ntohl(sav->spi))); 5649 key_freesav(&sav); 5650 return key_senderror(so, m, ESRCH); 5651 } 5652 5653 if (sav->state == SADB_SASTATE_LARVAL) { 5654 if ((mhp->msg->sadb_msg_satype == SADB_SATYPE_ESP && 5655 SADB_CHECKHDR(mhp, SADB_EXT_KEY_ENCRYPT)) || 5656 (mhp->msg->sadb_msg_satype == SADB_SATYPE_AH && 5657 SADB_CHECKHDR(mhp, SADB_EXT_KEY_AUTH))) { 5658 ipseclog((LOG_DEBUG, 5659 "%s: invalid message: missing required header.\n", 5660 __func__)); 5661 key_freesav(&sav); 5662 return key_senderror(so, m, EINVAL); 5663 } 5664 /* 5665 * We can set any values except src, dst and SPI. 5666 */ 5667 error = key_setsaval(sav, mhp); 5668 if (error != 0) { 5669 key_freesav(&sav); 5670 return (key_senderror(so, m, error)); 5671 } 5672 /* Change SA state to MATURE */ 5673 SAHTREE_WLOCK(); 5674 if (sav->state != SADB_SASTATE_LARVAL) { 5675 /* SA was deleted or another thread made it MATURE. */ 5676 SAHTREE_WUNLOCK(); 5677 key_freesav(&sav); 5678 return (key_senderror(so, m, ESRCH)); 5679 } 5680 /* 5681 * NOTE: we keep SAs in savtree_alive ordered by created 5682 * time. When SA's state changed from LARVAL to MATURE, 5683 * we update its created time in key_setsaval() and move 5684 * it into head of savtree_alive. 5685 */ 5686 TAILQ_REMOVE(&sav->sah->savtree_larval, sav, chain); 5687 TAILQ_INSERT_HEAD(&sav->sah->savtree_alive, sav, chain); 5688 sav->state = SADB_SASTATE_MATURE; 5689 SAHTREE_WUNLOCK(); 5690 } else { 5691 /* 5692 * For DYING and MATURE SA we can change only state 5693 * and lifetimes. Report EINVAL if something else attempted 5694 * to change. 5695 */ 5696 if (!SADB_CHECKHDR(mhp, SADB_EXT_KEY_ENCRYPT) || 5697 !SADB_CHECKHDR(mhp, SADB_EXT_KEY_AUTH)) { 5698 key_freesav(&sav); 5699 return (key_senderror(so, m, EINVAL)); 5700 } 5701 error = key_updatelifetimes(sav, mhp); 5702 if (error != 0) { 5703 key_freesav(&sav); 5704 return (key_senderror(so, m, error)); 5705 } 5706 /* 5707 * This is FreeBSD extension to RFC2367. 5708 * IKEd can specify SADB_X_EXT_NEW_ADDRESS_SRC and/or 5709 * SADB_X_EXT_NEW_ADDRESS_DST when it wants to change 5710 * SA addresses (for example to implement MOBIKE protocol 5711 * as described in RFC4555). Also we allow to change 5712 * NAT-T config. 5713 */ 5714 if (!SADB_CHECKHDR(mhp, SADB_X_EXT_NEW_ADDRESS_SRC) || 5715 !SADB_CHECKHDR(mhp, SADB_X_EXT_NEW_ADDRESS_DST) || 5716 !SADB_CHECKHDR(mhp, SADB_X_EXT_NAT_T_TYPE) || 5717 sav->natt != NULL) { 5718 error = key_updateaddresses(so, m, mhp, sav, &saidx); 5719 key_freesav(&sav); 5720 if (error != 0) 5721 return (key_senderror(so, m, error)); 5722 return (0); 5723 } 5724 /* Check that SA is still alive */ 5725 SAHTREE_WLOCK(); 5726 if (sav->state == SADB_SASTATE_DEAD) { 5727 /* SA was unlinked */ 5728 SAHTREE_WUNLOCK(); 5729 key_freesav(&sav); 5730 return (key_senderror(so, m, ESRCH)); 5731 } 5732 /* 5733 * NOTE: there is possible state moving from DYING to MATURE, 5734 * but this doesn't change created time, so we won't reorder 5735 * this SA. 5736 */ 5737 sav->state = SADB_SASTATE_MATURE; 5738 SAHTREE_WUNLOCK(); 5739 } 5740 KEYDBG(KEY_STAMP, 5741 printf("%s: SA(%p)\n", __func__, sav)); 5742 KEYDBG(KEY_DATA, kdebug_secasv(sav)); 5743 ipsec_accel_sa_newkey(sav); 5744 key_freesav(&sav); 5745 5746 { 5747 struct mbuf *n; 5748 5749 /* set msg buf from mhp */ 5750 n = key_getmsgbuf_x1(m, mhp); 5751 if (n == NULL) { 5752 ipseclog((LOG_DEBUG, "%s: No more memory.\n", __func__)); 5753 return key_senderror(so, m, ENOBUFS); 5754 } 5755 5756 m_freem(m); 5757 return key_sendup_mbuf(so, n, KEY_SENDUP_ALL); 5758 } 5759 } 5760 5761 /* 5762 * SADB_ADD processing 5763 * add an entry to SA database, when received 5764 * <base, SA, (SA2), (lifetime(HSC),) address(SD), (address(P),) 5765 * key(AE), (identity(SD),) (sensitivity)> 5766 * from the ikmpd, 5767 * and send 5768 * <base, SA, (SA2), (lifetime(HSC),) address(SD), (address(P),) 5769 * (identity(SD),) (sensitivity)> 5770 * to the ikmpd. 5771 * 5772 * IGNORE identity and sensitivity messages. 5773 * 5774 * m will always be freed. 5775 */ 5776 static int 5777 key_add(struct socket *so, struct mbuf *m, const struct sadb_msghdr *mhp) 5778 { 5779 struct secasindex saidx; 5780 struct sadb_address *src0, *dst0; 5781 struct sadb_sa *sa0; 5782 struct secasvar *sav; 5783 uint32_t reqid, spi; 5784 uint8_t mode, proto; 5785 int error; 5786 5787 IPSEC_ASSERT(so != NULL, ("null socket")); 5788 IPSEC_ASSERT(m != NULL, ("null mbuf")); 5789 IPSEC_ASSERT(mhp != NULL, ("null msghdr")); 5790 IPSEC_ASSERT(mhp->msg != NULL, ("null msg")); 5791 5792 /* map satype to proto */ 5793 if ((proto = key_satype2proto(mhp->msg->sadb_msg_satype)) == 0) { 5794 ipseclog((LOG_DEBUG, "%s: invalid satype is passed.\n", 5795 __func__)); 5796 return key_senderror(so, m, EINVAL); 5797 } 5798 5799 if (SADB_CHECKHDR(mhp, SADB_EXT_SA) || 5800 SADB_CHECKHDR(mhp, SADB_EXT_ADDRESS_SRC) || 5801 SADB_CHECKHDR(mhp, SADB_EXT_ADDRESS_DST) || 5802 (mhp->msg->sadb_msg_satype == SADB_SATYPE_ESP && ( 5803 SADB_CHECKHDR(mhp, SADB_EXT_KEY_ENCRYPT) || 5804 SADB_CHECKLEN(mhp, SADB_EXT_KEY_ENCRYPT))) || 5805 (mhp->msg->sadb_msg_satype == SADB_SATYPE_AH && ( 5806 SADB_CHECKHDR(mhp, SADB_EXT_KEY_AUTH) || 5807 SADB_CHECKLEN(mhp, SADB_EXT_KEY_AUTH))) || 5808 (SADB_CHECKHDR(mhp, SADB_EXT_LIFETIME_HARD) && 5809 !SADB_CHECKHDR(mhp, SADB_EXT_LIFETIME_SOFT)) || 5810 (SADB_CHECKHDR(mhp, SADB_EXT_LIFETIME_SOFT) && 5811 !SADB_CHECKHDR(mhp, SADB_EXT_LIFETIME_HARD))) { 5812 ipseclog((LOG_DEBUG, 5813 "%s: invalid message: missing required header.\n", 5814 __func__)); 5815 return key_senderror(so, m, EINVAL); 5816 } 5817 if (SADB_CHECKLEN(mhp, SADB_EXT_SA) || 5818 SADB_CHECKLEN(mhp, SADB_EXT_ADDRESS_SRC) || 5819 SADB_CHECKLEN(mhp, SADB_EXT_ADDRESS_DST)) { 5820 ipseclog((LOG_DEBUG, 5821 "%s: invalid message: wrong header size.\n", __func__)); 5822 return key_senderror(so, m, EINVAL); 5823 } 5824 if (SADB_CHECKHDR(mhp, SADB_X_EXT_SA2)) { 5825 mode = IPSEC_MODE_ANY; 5826 reqid = 0; 5827 } else { 5828 if (SADB_CHECKLEN(mhp, SADB_X_EXT_SA2)) { 5829 ipseclog((LOG_DEBUG, 5830 "%s: invalid message: wrong header size.\n", 5831 __func__)); 5832 return key_senderror(so, m, EINVAL); 5833 } 5834 mode = ((struct sadb_x_sa2 *) 5835 mhp->ext[SADB_X_EXT_SA2])->sadb_x_sa2_mode; 5836 reqid = ((struct sadb_x_sa2 *) 5837 mhp->ext[SADB_X_EXT_SA2])->sadb_x_sa2_reqid; 5838 } 5839 5840 sa0 = (struct sadb_sa *)mhp->ext[SADB_EXT_SA]; 5841 src0 = (struct sadb_address *)mhp->ext[SADB_EXT_ADDRESS_SRC]; 5842 dst0 = (struct sadb_address *)mhp->ext[SADB_EXT_ADDRESS_DST]; 5843 5844 /* 5845 * Only SADB_SASTATE_MATURE SAs may be submitted in an 5846 * SADB_ADD message. 5847 */ 5848 if (sa0->sadb_sa_state != SADB_SASTATE_MATURE) { 5849 ipseclog((LOG_DEBUG, "%s: invalid state.\n", __func__)); 5850 #ifdef PFKEY_STRICT_CHECKS 5851 return key_senderror(so, m, EINVAL); 5852 #endif 5853 } 5854 error = key_checksockaddrs((struct sockaddr *)(src0 + 1), 5855 (struct sockaddr *)(dst0 + 1)); 5856 if (error != 0) { 5857 ipseclog((LOG_DEBUG, "%s: invalid sockaddr.\n", __func__)); 5858 return key_senderror(so, m, error); 5859 } 5860 KEY_SETSECASIDX(proto, mode, reqid, src0 + 1, dst0 + 1, &saidx); 5861 spi = sa0->sadb_sa_spi; 5862 /* 5863 * For TCP-MD5 SAs we don't use SPI. Check the uniqueness using 5864 * secasindex. 5865 * XXXAE: IPComp seems also doesn't use SPI. 5866 */ 5867 SPI_ALLOC_LOCK(); 5868 if (proto == IPPROTO_TCP) { 5869 sav = key_getsav_tcpmd5(&saidx, &spi); 5870 if (sav == NULL && spi == 0) { 5871 SPI_ALLOC_UNLOCK(); 5872 /* Failed to allocate SPI */ 5873 ipseclog((LOG_DEBUG, "%s: SA already exists.\n", 5874 __func__)); 5875 return key_senderror(so, m, EEXIST); 5876 } 5877 /* XXX: SPI that we report back can have another value */ 5878 } else { 5879 /* We can create new SA only if SPI is different. */ 5880 sav = key_getsavbyspi(spi); 5881 } 5882 if (sav != NULL) { 5883 SPI_ALLOC_UNLOCK(); 5884 key_freesav(&sav); 5885 ipseclog((LOG_DEBUG, "%s: SA already exists.\n", __func__)); 5886 return key_senderror(so, m, EEXIST); 5887 } 5888 5889 sav = key_newsav(mhp, &saidx, spi, &error); 5890 SPI_ALLOC_UNLOCK(); 5891 if (sav == NULL) 5892 return key_senderror(so, m, error); 5893 KEYDBG(KEY_STAMP, 5894 printf("%s: return SA(%p)\n", __func__, sav)); 5895 KEYDBG(KEY_DATA, kdebug_secasv(sav)); 5896 ipsec_accel_sa_newkey(sav); 5897 /* 5898 * If SADB_ADD was in response to SADB_ACQUIRE, we need to schedule 5899 * ACQ for deletion. 5900 */ 5901 if (sav->seq != 0) 5902 key_acqdone(&saidx, sav->seq); 5903 5904 { 5905 /* 5906 * Don't call key_freesav() on error here, as we would like to 5907 * keep the SA in the database. 5908 */ 5909 struct mbuf *n; 5910 5911 /* set msg buf from mhp */ 5912 n = key_getmsgbuf_x1(m, mhp); 5913 if (n == NULL) { 5914 ipseclog((LOG_DEBUG, "%s: No more memory.\n", __func__)); 5915 return key_senderror(so, m, ENOBUFS); 5916 } 5917 5918 m_freem(m); 5919 return key_sendup_mbuf(so, n, KEY_SENDUP_ALL); 5920 } 5921 } 5922 5923 /* 5924 * NAT-T support. 5925 * IKEd may request the use ESP in UDP encapsulation when it detects the 5926 * presence of NAT. It uses NAT-T extension headers for such SAs to specify 5927 * parameters needed for encapsulation and decapsulation. These PF_KEY 5928 * extension headers are not standardized, so this comment addresses our 5929 * implementation. 5930 * SADB_X_EXT_NAT_T_TYPE specifies type of encapsulation, we support only 5931 * UDP_ENCAP_ESPINUDP as described in RFC3948. 5932 * SADB_X_EXT_NAT_T_SPORT/DPORT specifies source and destination ports for 5933 * UDP header. We use these ports in UDP encapsulation procedure, also we 5934 * can check them in UDP decapsulation procedure. 5935 * SADB_X_EXT_NAT_T_OA[IR] specifies original address of initiator or 5936 * responder. These addresses can be used for transport mode to adjust 5937 * checksum after decapsulation and decryption. Since original IP addresses 5938 * used by peer usually different (we detected presence of NAT), TCP/UDP 5939 * pseudo header checksum and IP header checksum was calculated using original 5940 * addresses. After decapsulation and decryption we need to adjust checksum 5941 * to have correct datagram. 5942 * 5943 * We expect presence of NAT-T extension headers only in SADB_ADD and 5944 * SADB_UPDATE messages. We report NAT-T extension headers in replies 5945 * to SADB_ADD, SADB_UPDATE, SADB_GET, and SADB_DUMP messages. 5946 */ 5947 static int 5948 key_setnatt(struct secasvar *sav, const struct sadb_msghdr *mhp) 5949 { 5950 struct sadb_x_nat_t_port *port; 5951 struct sadb_x_nat_t_type *type; 5952 struct sadb_address *oai, *oar; 5953 struct sockaddr *sa; 5954 uint32_t addr; 5955 uint16_t cksum; 5956 int i; 5957 5958 IPSEC_ASSERT(sav->natt == NULL, ("natt is already initialized")); 5959 /* 5960 * Ignore NAT-T headers if sproto isn't ESP. 5961 */ 5962 if (sav->sah->saidx.proto != IPPROTO_ESP) 5963 return (0); 5964 5965 if (!SADB_CHECKHDR(mhp, SADB_X_EXT_NAT_T_TYPE) && 5966 !SADB_CHECKHDR(mhp, SADB_X_EXT_NAT_T_SPORT) && 5967 !SADB_CHECKHDR(mhp, SADB_X_EXT_NAT_T_DPORT)) { 5968 if (SADB_CHECKLEN(mhp, SADB_X_EXT_NAT_T_TYPE) || 5969 SADB_CHECKLEN(mhp, SADB_X_EXT_NAT_T_SPORT) || 5970 SADB_CHECKLEN(mhp, SADB_X_EXT_NAT_T_DPORT)) { 5971 ipseclog((LOG_DEBUG, 5972 "%s: invalid message: wrong header size.\n", 5973 __func__)); 5974 return (EINVAL); 5975 } 5976 } else 5977 return (0); 5978 5979 type = (struct sadb_x_nat_t_type *)mhp->ext[SADB_X_EXT_NAT_T_TYPE]; 5980 if (type->sadb_x_nat_t_type_type != UDP_ENCAP_ESPINUDP) { 5981 ipseclog((LOG_DEBUG, "%s: unsupported NAT-T type %u.\n", 5982 __func__, type->sadb_x_nat_t_type_type)); 5983 return (EINVAL); 5984 } 5985 /* 5986 * Allocate storage for NAT-T config. 5987 * On error it will be released by key_cleansav(). 5988 */ 5989 sav->natt = malloc(sizeof(struct secnatt), M_IPSEC_MISC, 5990 M_NOWAIT | M_ZERO); 5991 if (sav->natt == NULL) { 5992 PFKEYSTAT_INC(in_nomem); 5993 ipseclog((LOG_DEBUG, "%s: No more memory.\n", __func__)); 5994 return (ENOBUFS); 5995 } 5996 port = (struct sadb_x_nat_t_port *)mhp->ext[SADB_X_EXT_NAT_T_SPORT]; 5997 if (port->sadb_x_nat_t_port_port == 0) { 5998 ipseclog((LOG_DEBUG, "%s: invalid NAT-T sport specified.\n", 5999 __func__)); 6000 return (EINVAL); 6001 } 6002 sav->natt->sport = port->sadb_x_nat_t_port_port; 6003 port = (struct sadb_x_nat_t_port *)mhp->ext[SADB_X_EXT_NAT_T_DPORT]; 6004 if (port->sadb_x_nat_t_port_port == 0) { 6005 ipseclog((LOG_DEBUG, "%s: invalid NAT-T dport specified.\n", 6006 __func__)); 6007 return (EINVAL); 6008 } 6009 sav->natt->dport = port->sadb_x_nat_t_port_port; 6010 6011 /* 6012 * SADB_X_EXT_NAT_T_OAI and SADB_X_EXT_NAT_T_OAR are optional 6013 * and needed only for transport mode IPsec. 6014 * Usually NAT translates only one address, but it is possible, 6015 * that both addresses could be translated. 6016 * NOTE: Value of SADB_X_EXT_NAT_T_OAI is equal to SADB_X_EXT_NAT_T_OA. 6017 */ 6018 if (!SADB_CHECKHDR(mhp, SADB_X_EXT_NAT_T_OAI)) { 6019 if (SADB_CHECKLEN(mhp, SADB_X_EXT_NAT_T_OAI)) { 6020 ipseclog((LOG_DEBUG, 6021 "%s: invalid message: wrong header size.\n", 6022 __func__)); 6023 return (EINVAL); 6024 } 6025 oai = (struct sadb_address *)mhp->ext[SADB_X_EXT_NAT_T_OAI]; 6026 } else 6027 oai = NULL; 6028 if (!SADB_CHECKHDR(mhp, SADB_X_EXT_NAT_T_OAR)) { 6029 if (SADB_CHECKLEN(mhp, SADB_X_EXT_NAT_T_OAR)) { 6030 ipseclog((LOG_DEBUG, 6031 "%s: invalid message: wrong header size.\n", 6032 __func__)); 6033 return (EINVAL); 6034 } 6035 oar = (struct sadb_address *)mhp->ext[SADB_X_EXT_NAT_T_OAR]; 6036 } else 6037 oar = NULL; 6038 6039 /* Initialize addresses only for transport mode */ 6040 if (sav->sah->saidx.mode != IPSEC_MODE_TUNNEL) { 6041 cksum = 0; 6042 if (oai != NULL) { 6043 sa = (struct sockaddr *)(oai + 1); 6044 switch (sa->sa_family) { 6045 #ifdef AF_INET 6046 case AF_INET: 6047 if (sa->sa_len != sizeof(struct sockaddr_in)) { 6048 ipseclog((LOG_DEBUG, 6049 "%s: wrong NAT-OAi header.\n", 6050 __func__)); 6051 return (EINVAL); 6052 } 6053 /* Ignore address if it the same */ 6054 if (((struct sockaddr_in *)sa)->sin_addr.s_addr != 6055 sav->sah->saidx.src.sin.sin_addr.s_addr) { 6056 bcopy(sa, &sav->natt->oai.sa, sa->sa_len); 6057 sav->natt->flags |= IPSEC_NATT_F_OAI; 6058 /* Calculate checksum delta */ 6059 addr = sav->sah->saidx.src.sin.sin_addr.s_addr; 6060 cksum = in_addword(cksum, ~addr >> 16); 6061 cksum = in_addword(cksum, ~addr & 0xffff); 6062 addr = sav->natt->oai.sin.sin_addr.s_addr; 6063 cksum = in_addword(cksum, addr >> 16); 6064 cksum = in_addword(cksum, addr & 0xffff); 6065 } 6066 break; 6067 #endif 6068 #ifdef AF_INET6 6069 case AF_INET6: 6070 if (sa->sa_len != sizeof(struct sockaddr_in6)) { 6071 ipseclog((LOG_DEBUG, 6072 "%s: wrong NAT-OAi header.\n", 6073 __func__)); 6074 return (EINVAL); 6075 } 6076 /* Ignore address if it the same */ 6077 if (memcmp(&((struct sockaddr_in6 *)sa)->sin6_addr.s6_addr, 6078 &sav->sah->saidx.src.sin6.sin6_addr.s6_addr, 6079 sizeof(struct in6_addr)) != 0) { 6080 bcopy(sa, &sav->natt->oai.sa, sa->sa_len); 6081 sav->natt->flags |= IPSEC_NATT_F_OAI; 6082 /* Calculate checksum delta */ 6083 for (i = 0; i < 8; i++) { 6084 cksum = in_addword(cksum, 6085 ~sav->sah->saidx.src.sin6.sin6_addr.s6_addr16[i]); 6086 cksum = in_addword(cksum, 6087 sav->natt->oai.sin6.sin6_addr.s6_addr16[i]); 6088 } 6089 } 6090 break; 6091 #endif 6092 default: 6093 ipseclog((LOG_DEBUG, 6094 "%s: wrong NAT-OAi header.\n", 6095 __func__)); 6096 return (EINVAL); 6097 } 6098 } 6099 if (oar != NULL) { 6100 sa = (struct sockaddr *)(oar + 1); 6101 switch (sa->sa_family) { 6102 #ifdef AF_INET 6103 case AF_INET: 6104 if (sa->sa_len != sizeof(struct sockaddr_in)) { 6105 ipseclog((LOG_DEBUG, 6106 "%s: wrong NAT-OAr header.\n", 6107 __func__)); 6108 return (EINVAL); 6109 } 6110 /* Ignore address if it the same */ 6111 if (((struct sockaddr_in *)sa)->sin_addr.s_addr != 6112 sav->sah->saidx.dst.sin.sin_addr.s_addr) { 6113 bcopy(sa, &sav->natt->oar.sa, sa->sa_len); 6114 sav->natt->flags |= IPSEC_NATT_F_OAR; 6115 /* Calculate checksum delta */ 6116 addr = sav->sah->saidx.dst.sin.sin_addr.s_addr; 6117 cksum = in_addword(cksum, ~addr >> 16); 6118 cksum = in_addword(cksum, ~addr & 0xffff); 6119 addr = sav->natt->oar.sin.sin_addr.s_addr; 6120 cksum = in_addword(cksum, addr >> 16); 6121 cksum = in_addword(cksum, addr & 0xffff); 6122 } 6123 break; 6124 #endif 6125 #ifdef AF_INET6 6126 case AF_INET6: 6127 if (sa->sa_len != sizeof(struct sockaddr_in6)) { 6128 ipseclog((LOG_DEBUG, 6129 "%s: wrong NAT-OAr header.\n", 6130 __func__)); 6131 return (EINVAL); 6132 } 6133 /* Ignore address if it the same */ 6134 if (memcmp(&((struct sockaddr_in6 *)sa)->sin6_addr.s6_addr, 6135 &sav->sah->saidx.dst.sin6.sin6_addr.s6_addr, 16) != 0) { 6136 bcopy(sa, &sav->natt->oar.sa, sa->sa_len); 6137 sav->natt->flags |= IPSEC_NATT_F_OAR; 6138 /* Calculate checksum delta */ 6139 for (i = 0; i < 8; i++) { 6140 cksum = in_addword(cksum, 6141 ~sav->sah->saidx.dst.sin6.sin6_addr.s6_addr16[i]); 6142 cksum = in_addword(cksum, 6143 sav->natt->oar.sin6.sin6_addr.s6_addr16[i]); 6144 } 6145 } 6146 break; 6147 #endif 6148 default: 6149 ipseclog((LOG_DEBUG, 6150 "%s: wrong NAT-OAr header.\n", 6151 __func__)); 6152 return (EINVAL); 6153 } 6154 } 6155 sav->natt->cksum = cksum; 6156 } 6157 return (0); 6158 } 6159 6160 static int 6161 key_setident(struct secashead *sah, const struct sadb_msghdr *mhp) 6162 { 6163 const struct sadb_ident *idsrc, *iddst; 6164 6165 IPSEC_ASSERT(sah != NULL, ("null secashead")); 6166 IPSEC_ASSERT(mhp != NULL, ("null msghdr")); 6167 IPSEC_ASSERT(mhp->msg != NULL, ("null msg")); 6168 6169 /* don't make buffer if not there */ 6170 if (SADB_CHECKHDR(mhp, SADB_EXT_IDENTITY_SRC) && 6171 SADB_CHECKHDR(mhp, SADB_EXT_IDENTITY_DST)) { 6172 sah->idents = NULL; 6173 sah->identd = NULL; 6174 return (0); 6175 } 6176 6177 if (SADB_CHECKHDR(mhp, SADB_EXT_IDENTITY_SRC) || 6178 SADB_CHECKHDR(mhp, SADB_EXT_IDENTITY_DST)) { 6179 ipseclog((LOG_DEBUG, "%s: invalid identity.\n", __func__)); 6180 return (EINVAL); 6181 } 6182 6183 idsrc = (const struct sadb_ident *)mhp->ext[SADB_EXT_IDENTITY_SRC]; 6184 iddst = (const struct sadb_ident *)mhp->ext[SADB_EXT_IDENTITY_DST]; 6185 6186 /* validity check */ 6187 if (idsrc->sadb_ident_type != iddst->sadb_ident_type) { 6188 ipseclog((LOG_DEBUG, "%s: ident type mismatch.\n", __func__)); 6189 return EINVAL; 6190 } 6191 6192 switch (idsrc->sadb_ident_type) { 6193 case SADB_IDENTTYPE_PREFIX: 6194 case SADB_IDENTTYPE_FQDN: 6195 case SADB_IDENTTYPE_USERFQDN: 6196 default: 6197 /* XXX do nothing */ 6198 sah->idents = NULL; 6199 sah->identd = NULL; 6200 return 0; 6201 } 6202 6203 /* make structure */ 6204 sah->idents = malloc(sizeof(struct secident), M_IPSEC_MISC, M_NOWAIT); 6205 if (sah->idents == NULL) { 6206 ipseclog((LOG_DEBUG, "%s: No more memory.\n", __func__)); 6207 return ENOBUFS; 6208 } 6209 sah->identd = malloc(sizeof(struct secident), M_IPSEC_MISC, M_NOWAIT); 6210 if (sah->identd == NULL) { 6211 free(sah->idents, M_IPSEC_MISC); 6212 sah->idents = NULL; 6213 ipseclog((LOG_DEBUG, "%s: No more memory.\n", __func__)); 6214 return ENOBUFS; 6215 } 6216 sah->idents->type = idsrc->sadb_ident_type; 6217 sah->idents->id = idsrc->sadb_ident_id; 6218 6219 sah->identd->type = iddst->sadb_ident_type; 6220 sah->identd->id = iddst->sadb_ident_id; 6221 6222 return 0; 6223 } 6224 6225 /* 6226 * m will not be freed on return. 6227 * it is caller's responsibility to free the result. 6228 * 6229 * Called from SADB_ADD and SADB_UPDATE. Reply will contain headers 6230 * from the request in defined order. 6231 */ 6232 static struct mbuf * 6233 key_getmsgbuf_x1(struct mbuf *m, const struct sadb_msghdr *mhp) 6234 { 6235 struct mbuf *n; 6236 6237 IPSEC_ASSERT(m != NULL, ("null mbuf")); 6238 IPSEC_ASSERT(mhp != NULL, ("null msghdr")); 6239 IPSEC_ASSERT(mhp->msg != NULL, ("null msg")); 6240 6241 /* create new sadb_msg to reply. */ 6242 n = key_gather_mbuf(m, mhp, 1, 16, SADB_EXT_RESERVED, 6243 SADB_EXT_SA, SADB_X_EXT_SA2, 6244 SADB_EXT_ADDRESS_SRC, SADB_EXT_ADDRESS_DST, 6245 SADB_EXT_LIFETIME_HARD, SADB_EXT_LIFETIME_SOFT, 6246 SADB_EXT_IDENTITY_SRC, SADB_EXT_IDENTITY_DST, 6247 SADB_X_EXT_NAT_T_TYPE, SADB_X_EXT_NAT_T_SPORT, 6248 SADB_X_EXT_NAT_T_DPORT, SADB_X_EXT_NAT_T_OAI, 6249 SADB_X_EXT_NAT_T_OAR, SADB_X_EXT_NEW_ADDRESS_SRC, 6250 SADB_X_EXT_NEW_ADDRESS_DST); 6251 if (!n) 6252 return NULL; 6253 6254 if (n->m_len < sizeof(struct sadb_msg)) { 6255 n = m_pullup(n, sizeof(struct sadb_msg)); 6256 if (n == NULL) 6257 return NULL; 6258 } 6259 mtod(n, struct sadb_msg *)->sadb_msg_errno = 0; 6260 mtod(n, struct sadb_msg *)->sadb_msg_len = 6261 PFKEY_UNIT64(n->m_pkthdr.len); 6262 6263 return n; 6264 } 6265 6266 /* 6267 * SADB_DELETE processing 6268 * receive 6269 * <base, SA(*), address(SD)> 6270 * from the ikmpd, and set SADB_SASTATE_DEAD, 6271 * and send, 6272 * <base, SA(*), address(SD)> 6273 * to the ikmpd. 6274 * 6275 * m will always be freed. 6276 */ 6277 static int 6278 key_delete(struct socket *so, struct mbuf *m, const struct sadb_msghdr *mhp) 6279 { 6280 struct secasindex saidx; 6281 struct sadb_address *src0, *dst0; 6282 struct secasvar *sav; 6283 struct sadb_sa *sa0; 6284 uint8_t proto; 6285 6286 IPSEC_ASSERT(so != NULL, ("null socket")); 6287 IPSEC_ASSERT(m != NULL, ("null mbuf")); 6288 IPSEC_ASSERT(mhp != NULL, ("null msghdr")); 6289 IPSEC_ASSERT(mhp->msg != NULL, ("null msg")); 6290 6291 /* map satype to proto */ 6292 if ((proto = key_satype2proto(mhp->msg->sadb_msg_satype)) == 0) { 6293 ipseclog((LOG_DEBUG, "%s: invalid satype is passed.\n", 6294 __func__)); 6295 return key_senderror(so, m, EINVAL); 6296 } 6297 6298 if (SADB_CHECKHDR(mhp, SADB_EXT_ADDRESS_SRC) || 6299 SADB_CHECKHDR(mhp, SADB_EXT_ADDRESS_DST) || 6300 SADB_CHECKLEN(mhp, SADB_EXT_ADDRESS_SRC) || 6301 SADB_CHECKLEN(mhp, SADB_EXT_ADDRESS_DST)) { 6302 ipseclog((LOG_DEBUG, "%s: invalid message is passed.\n", 6303 __func__)); 6304 return key_senderror(so, m, EINVAL); 6305 } 6306 6307 src0 = (struct sadb_address *)(mhp->ext[SADB_EXT_ADDRESS_SRC]); 6308 dst0 = (struct sadb_address *)(mhp->ext[SADB_EXT_ADDRESS_DST]); 6309 6310 if (key_checksockaddrs((struct sockaddr *)(src0 + 1), 6311 (struct sockaddr *)(dst0 + 1)) != 0) { 6312 ipseclog((LOG_DEBUG, "%s: invalid sockaddr.\n", __func__)); 6313 return (key_senderror(so, m, EINVAL)); 6314 } 6315 KEY_SETSECASIDX(proto, IPSEC_MODE_ANY, 0, src0 + 1, dst0 + 1, &saidx); 6316 if (SADB_CHECKHDR(mhp, SADB_EXT_SA)) { 6317 /* 6318 * Caller wants us to delete all non-LARVAL SAs 6319 * that match the src/dst. This is used during 6320 * IKE INITIAL-CONTACT. 6321 * XXXAE: this looks like some extension to RFC2367. 6322 */ 6323 ipseclog((LOG_DEBUG, "%s: doing delete all.\n", __func__)); 6324 return (key_delete_all(so, m, mhp, &saidx)); 6325 } 6326 if (SADB_CHECKLEN(mhp, SADB_EXT_SA)) { 6327 ipseclog((LOG_DEBUG, 6328 "%s: invalid message: wrong header size.\n", __func__)); 6329 return (key_senderror(so, m, EINVAL)); 6330 } 6331 sa0 = (struct sadb_sa *)mhp->ext[SADB_EXT_SA]; 6332 SPI_ALLOC_LOCK(); 6333 if (proto == IPPROTO_TCP) 6334 sav = key_getsav_tcpmd5(&saidx, NULL); 6335 else 6336 sav = key_getsavbyspi(sa0->sadb_sa_spi); 6337 SPI_ALLOC_UNLOCK(); 6338 if (sav == NULL) { 6339 ipseclog((LOG_DEBUG, "%s: no SA found for SPI %u.\n", 6340 __func__, ntohl(sa0->sadb_sa_spi))); 6341 return (key_senderror(so, m, ESRCH)); 6342 } 6343 if (key_cmpsaidx(&sav->sah->saidx, &saidx, CMP_HEAD) == 0) { 6344 ipseclog((LOG_DEBUG, "%s: saidx mismatched for SPI %u.\n", 6345 __func__, ntohl(sav->spi))); 6346 key_freesav(&sav); 6347 return (key_senderror(so, m, ESRCH)); 6348 } 6349 KEYDBG(KEY_STAMP, 6350 printf("%s: SA(%p)\n", __func__, sav)); 6351 KEYDBG(KEY_DATA, kdebug_secasv(sav)); 6352 key_unlinksav(sav); 6353 key_freesav(&sav); 6354 6355 { 6356 struct mbuf *n; 6357 struct sadb_msg *newmsg; 6358 6359 /* create new sadb_msg to reply. */ 6360 n = key_gather_mbuf(m, mhp, 1, 4, SADB_EXT_RESERVED, 6361 SADB_EXT_SA, SADB_EXT_ADDRESS_SRC, SADB_EXT_ADDRESS_DST); 6362 if (!n) 6363 return key_senderror(so, m, ENOBUFS); 6364 6365 if (n->m_len < sizeof(struct sadb_msg)) { 6366 n = m_pullup(n, sizeof(struct sadb_msg)); 6367 if (n == NULL) 6368 return key_senderror(so, m, ENOBUFS); 6369 } 6370 newmsg = mtod(n, struct sadb_msg *); 6371 newmsg->sadb_msg_errno = 0; 6372 newmsg->sadb_msg_len = PFKEY_UNIT64(n->m_pkthdr.len); 6373 6374 m_freem(m); 6375 return key_sendup_mbuf(so, n, KEY_SENDUP_ALL); 6376 } 6377 } 6378 6379 /* 6380 * delete all SAs for src/dst. Called from key_delete(). 6381 */ 6382 static int 6383 key_delete_all(struct socket *so, struct mbuf *m, 6384 const struct sadb_msghdr *mhp, struct secasindex *saidx) 6385 { 6386 struct secasvar_queue drainq; 6387 struct secashead *sah; 6388 struct secasvar *sav, *nextsav; 6389 6390 TAILQ_INIT(&drainq); 6391 SAHTREE_WLOCK(); 6392 LIST_FOREACH(sah, SAHADDRHASH_HASH(saidx), addrhash) { 6393 if (key_cmpsaidx(&sah->saidx, saidx, CMP_HEAD) == 0) 6394 continue; 6395 /* Move all ALIVE SAs into drainq */ 6396 TAILQ_CONCAT(&drainq, &sah->savtree_alive, chain); 6397 } 6398 /* Unlink all queued SAs from SPI hash */ 6399 TAILQ_FOREACH(sav, &drainq, chain) { 6400 sav->state = SADB_SASTATE_DEAD; 6401 ipsec_accel_forget_sav(sav); 6402 LIST_REMOVE(sav, spihash); 6403 } 6404 SAHTREE_WUNLOCK(); 6405 /* Now we can release reference for all SAs in drainq */ 6406 sav = TAILQ_FIRST(&drainq); 6407 while (sav != NULL) { 6408 KEYDBG(KEY_STAMP, 6409 printf("%s: SA(%p)\n", __func__, sav)); 6410 KEYDBG(KEY_DATA, kdebug_secasv(sav)); 6411 nextsav = TAILQ_NEXT(sav, chain); 6412 key_freesah(&sav->sah); /* release reference from SAV */ 6413 key_freesav(&sav); /* release last reference */ 6414 sav = nextsav; 6415 } 6416 6417 { 6418 struct mbuf *n; 6419 struct sadb_msg *newmsg; 6420 6421 /* create new sadb_msg to reply. */ 6422 n = key_gather_mbuf(m, mhp, 1, 3, SADB_EXT_RESERVED, 6423 SADB_EXT_ADDRESS_SRC, SADB_EXT_ADDRESS_DST); 6424 if (!n) 6425 return key_senderror(so, m, ENOBUFS); 6426 6427 if (n->m_len < sizeof(struct sadb_msg)) { 6428 n = m_pullup(n, sizeof(struct sadb_msg)); 6429 if (n == NULL) 6430 return key_senderror(so, m, ENOBUFS); 6431 } 6432 newmsg = mtod(n, struct sadb_msg *); 6433 newmsg->sadb_msg_errno = 0; 6434 newmsg->sadb_msg_len = PFKEY_UNIT64(n->m_pkthdr.len); 6435 6436 m_freem(m); 6437 return key_sendup_mbuf(so, n, KEY_SENDUP_ALL); 6438 } 6439 } 6440 6441 /* 6442 * Delete all alive SAs for corresponding xform. 6443 * Larval SAs have not initialized tdb_xform, so it is safe to leave them 6444 * here when xform disappears. 6445 */ 6446 void 6447 key_delete_xform(const struct xformsw *xsp) 6448 { 6449 struct secasvar_queue drainq; 6450 struct secashead *sah; 6451 struct secasvar *sav, *nextsav; 6452 6453 TAILQ_INIT(&drainq); 6454 SAHTREE_WLOCK(); 6455 TAILQ_FOREACH(sah, &V_sahtree, chain) { 6456 sav = TAILQ_FIRST(&sah->savtree_alive); 6457 if (sav == NULL) 6458 continue; 6459 if (sav->tdb_xform != xsp) 6460 continue; 6461 /* 6462 * It is supposed that all SAs in the chain are related to 6463 * one xform. 6464 */ 6465 TAILQ_CONCAT(&drainq, &sah->savtree_alive, chain); 6466 } 6467 /* Unlink all queued SAs from SPI hash */ 6468 TAILQ_FOREACH(sav, &drainq, chain) { 6469 sav->state = SADB_SASTATE_DEAD; 6470 ipsec_accel_forget_sav(sav); 6471 LIST_REMOVE(sav, spihash); 6472 } 6473 SAHTREE_WUNLOCK(); 6474 6475 /* Now we can release reference for all SAs in drainq */ 6476 sav = TAILQ_FIRST(&drainq); 6477 while (sav != NULL) { 6478 KEYDBG(KEY_STAMP, 6479 printf("%s: SA(%p)\n", __func__, sav)); 6480 KEYDBG(KEY_DATA, kdebug_secasv(sav)); 6481 nextsav = TAILQ_NEXT(sav, chain); 6482 key_freesah(&sav->sah); /* release reference from SAV */ 6483 key_freesav(&sav); /* release last reference */ 6484 sav = nextsav; 6485 } 6486 } 6487 6488 /* 6489 * SADB_GET processing 6490 * receive 6491 * <base, SA(*), address(SD)> 6492 * from the ikmpd, and get a SP and a SA to respond, 6493 * and send, 6494 * <base, SA, (lifetime(HSC),) address(SD), (address(P),) key(AE), 6495 * (identity(SD),) (sensitivity)> 6496 * to the ikmpd. 6497 * 6498 * m will always be freed. 6499 */ 6500 static int 6501 key_get(struct socket *so, struct mbuf *m, const struct sadb_msghdr *mhp) 6502 { 6503 struct secasindex saidx; 6504 struct sadb_address *src0, *dst0; 6505 struct sadb_sa *sa0; 6506 struct secasvar *sav; 6507 uint8_t proto; 6508 6509 IPSEC_ASSERT(so != NULL, ("null socket")); 6510 IPSEC_ASSERT(m != NULL, ("null mbuf")); 6511 IPSEC_ASSERT(mhp != NULL, ("null msghdr")); 6512 IPSEC_ASSERT(mhp->msg != NULL, ("null msg")); 6513 6514 /* map satype to proto */ 6515 if ((proto = key_satype2proto(mhp->msg->sadb_msg_satype)) == 0) { 6516 ipseclog((LOG_DEBUG, "%s: invalid satype is passed.\n", 6517 __func__)); 6518 return key_senderror(so, m, EINVAL); 6519 } 6520 6521 if (SADB_CHECKHDR(mhp, SADB_EXT_SA) || 6522 SADB_CHECKHDR(mhp, SADB_EXT_ADDRESS_SRC) || 6523 SADB_CHECKHDR(mhp, SADB_EXT_ADDRESS_DST)) { 6524 ipseclog((LOG_DEBUG, 6525 "%s: invalid message: missing required header.\n", 6526 __func__)); 6527 return key_senderror(so, m, EINVAL); 6528 } 6529 if (SADB_CHECKLEN(mhp, SADB_EXT_SA) || 6530 SADB_CHECKLEN(mhp, SADB_EXT_ADDRESS_SRC) || 6531 SADB_CHECKLEN(mhp, SADB_EXT_ADDRESS_DST)) { 6532 ipseclog((LOG_DEBUG, 6533 "%s: invalid message: wrong header size.\n", __func__)); 6534 return key_senderror(so, m, EINVAL); 6535 } 6536 6537 sa0 = (struct sadb_sa *)mhp->ext[SADB_EXT_SA]; 6538 src0 = (struct sadb_address *)mhp->ext[SADB_EXT_ADDRESS_SRC]; 6539 dst0 = (struct sadb_address *)mhp->ext[SADB_EXT_ADDRESS_DST]; 6540 6541 if (key_checksockaddrs((struct sockaddr *)(src0 + 1), 6542 (struct sockaddr *)(dst0 + 1)) != 0) { 6543 ipseclog((LOG_DEBUG, "%s: invalid sockaddr.\n", __func__)); 6544 return key_senderror(so, m, EINVAL); 6545 } 6546 KEY_SETSECASIDX(proto, IPSEC_MODE_ANY, 0, src0 + 1, dst0 + 1, &saidx); 6547 6548 SPI_ALLOC_LOCK(); 6549 if (proto == IPPROTO_TCP) 6550 sav = key_getsav_tcpmd5(&saidx, NULL); 6551 else 6552 sav = key_getsavbyspi(sa0->sadb_sa_spi); 6553 SPI_ALLOC_UNLOCK(); 6554 if (sav == NULL) { 6555 ipseclog((LOG_DEBUG, "%s: no SA found.\n", __func__)); 6556 return key_senderror(so, m, ESRCH); 6557 } 6558 if (key_cmpsaidx(&sav->sah->saidx, &saidx, CMP_HEAD) == 0) { 6559 ipseclog((LOG_DEBUG, "%s: saidx mismatched for SPI %u.\n", 6560 __func__, ntohl(sa0->sadb_sa_spi))); 6561 key_freesav(&sav); 6562 return (key_senderror(so, m, ESRCH)); 6563 } 6564 6565 { 6566 struct mbuf *n; 6567 uint8_t satype; 6568 6569 /* map proto to satype */ 6570 if ((satype = key_proto2satype(sav->sah->saidx.proto)) == 0) { 6571 ipseclog((LOG_DEBUG, "%s: there was invalid proto in SAD.\n", 6572 __func__)); 6573 key_freesav(&sav); 6574 return key_senderror(so, m, EINVAL); 6575 } 6576 6577 /* create new sadb_msg to reply. */ 6578 n = key_setdumpsa(sav, SADB_GET, satype, mhp->msg->sadb_msg_seq, 6579 mhp->msg->sadb_msg_pid, NULL); 6580 6581 key_freesav(&sav); 6582 if (!n) 6583 return key_senderror(so, m, ENOBUFS); 6584 6585 m_freem(m); 6586 return key_sendup_mbuf(so, n, KEY_SENDUP_ONE); 6587 } 6588 } 6589 6590 /* XXX make it sysctl-configurable? */ 6591 static void 6592 key_getcomb_setlifetime(struct sadb_comb *comb) 6593 { 6594 6595 comb->sadb_comb_soft_allocations = 1; 6596 comb->sadb_comb_hard_allocations = 1; 6597 comb->sadb_comb_soft_bytes = 0; 6598 comb->sadb_comb_hard_bytes = 0; 6599 comb->sadb_comb_hard_addtime = 86400; /* 1 day */ 6600 comb->sadb_comb_soft_addtime = comb->sadb_comb_soft_addtime * 80 / 100; 6601 comb->sadb_comb_soft_usetime = 28800; /* 8 hours */ 6602 comb->sadb_comb_hard_usetime = comb->sadb_comb_hard_usetime * 80 / 100; 6603 } 6604 6605 /* 6606 * XXX reorder combinations by preference 6607 * XXX no idea if the user wants ESP authentication or not 6608 */ 6609 static struct mbuf * 6610 key_getcomb_ealg(void) 6611 { 6612 struct sadb_comb *comb; 6613 const struct enc_xform *algo; 6614 struct mbuf *result = NULL, *m, *n; 6615 int encmin; 6616 int i, off, o; 6617 int totlen; 6618 const int l = PFKEY_ALIGN8(sizeof(struct sadb_comb)); 6619 6620 m = NULL; 6621 for (i = 1; i <= SADB_EALG_MAX; i++) { 6622 algo = enc_algorithm_lookup(i); 6623 if (algo == NULL) 6624 continue; 6625 6626 /* discard algorithms with key size smaller than system min */ 6627 if (_BITS(algo->maxkey) < V_ipsec_esp_keymin) 6628 continue; 6629 if (_BITS(algo->minkey) < V_ipsec_esp_keymin) 6630 encmin = V_ipsec_esp_keymin; 6631 else 6632 encmin = _BITS(algo->minkey); 6633 6634 if (V_ipsec_esp_auth) 6635 m = key_getcomb_ah(); 6636 else { 6637 IPSEC_ASSERT(l <= MLEN, 6638 ("l=%u > MLEN=%lu", l, (u_long) MLEN)); 6639 MGET(m, M_NOWAIT, MT_DATA); 6640 if (m) { 6641 M_ALIGN(m, l); 6642 m->m_len = l; 6643 m->m_next = NULL; 6644 bzero(mtod(m, caddr_t), m->m_len); 6645 } 6646 } 6647 if (!m) 6648 goto fail; 6649 6650 totlen = 0; 6651 for (n = m; n; n = n->m_next) 6652 totlen += n->m_len; 6653 IPSEC_ASSERT((totlen % l) == 0, ("totlen=%u, l=%u", totlen, l)); 6654 6655 for (off = 0; off < totlen; off += l) { 6656 n = m_pulldown(m, off, l, &o); 6657 if (!n) { 6658 /* m is already freed */ 6659 goto fail; 6660 } 6661 comb = (struct sadb_comb *)(mtod(n, caddr_t) + o); 6662 bzero(comb, sizeof(*comb)); 6663 key_getcomb_setlifetime(comb); 6664 comb->sadb_comb_encrypt = i; 6665 comb->sadb_comb_encrypt_minbits = encmin; 6666 comb->sadb_comb_encrypt_maxbits = _BITS(algo->maxkey); 6667 } 6668 6669 if (!result) 6670 result = m; 6671 else 6672 m_cat(result, m); 6673 } 6674 6675 return result; 6676 6677 fail: 6678 if (result) 6679 m_freem(result); 6680 return NULL; 6681 } 6682 6683 static void 6684 key_getsizes_ah(const struct auth_hash *ah, int alg, u_int16_t* min, 6685 u_int16_t* max) 6686 { 6687 6688 *min = *max = ah->hashsize; 6689 if (ah->keysize == 0) { 6690 /* 6691 * Transform takes arbitrary key size but algorithm 6692 * key size is restricted. Enforce this here. 6693 */ 6694 switch (alg) { 6695 case SADB_X_AALG_NULL: *min = 1; *max = 256; break; 6696 case SADB_X_AALG_SHA2_256: *min = *max = 32; break; 6697 case SADB_X_AALG_SHA2_384: *min = *max = 48; break; 6698 case SADB_X_AALG_SHA2_512: *min = *max = 64; break; 6699 default: 6700 DPRINTF(("%s: unknown AH algorithm %u\n", 6701 __func__, alg)); 6702 break; 6703 } 6704 } 6705 } 6706 6707 /* 6708 * XXX reorder combinations by preference 6709 */ 6710 static struct mbuf * 6711 key_getcomb_ah(void) 6712 { 6713 const struct auth_hash *algo; 6714 struct sadb_comb *comb; 6715 struct mbuf *m; 6716 u_int16_t minkeysize, maxkeysize; 6717 int i; 6718 const int l = PFKEY_ALIGN8(sizeof(struct sadb_comb)); 6719 6720 m = NULL; 6721 for (i = 1; i <= SADB_AALG_MAX; i++) { 6722 #if 1 6723 /* we prefer HMAC algorithms, not old algorithms */ 6724 if (i != SADB_AALG_SHA1HMAC && 6725 i != SADB_X_AALG_SHA2_256 && 6726 i != SADB_X_AALG_SHA2_384 && 6727 i != SADB_X_AALG_SHA2_512) 6728 continue; 6729 #endif 6730 algo = auth_algorithm_lookup(i); 6731 if (!algo) 6732 continue; 6733 key_getsizes_ah(algo, i, &minkeysize, &maxkeysize); 6734 /* discard algorithms with key size smaller than system min */ 6735 if (_BITS(minkeysize) < V_ipsec_ah_keymin) 6736 continue; 6737 6738 if (!m) { 6739 IPSEC_ASSERT(l <= MLEN, 6740 ("l=%u > MLEN=%lu", l, (u_long) MLEN)); 6741 MGET(m, M_NOWAIT, MT_DATA); 6742 if (m) { 6743 M_ALIGN(m, l); 6744 m->m_len = l; 6745 m->m_next = NULL; 6746 } 6747 } else 6748 M_PREPEND(m, l, M_NOWAIT); 6749 if (!m) 6750 return NULL; 6751 6752 comb = mtod(m, struct sadb_comb *); 6753 bzero(comb, sizeof(*comb)); 6754 key_getcomb_setlifetime(comb); 6755 comb->sadb_comb_auth = i; 6756 comb->sadb_comb_auth_minbits = _BITS(minkeysize); 6757 comb->sadb_comb_auth_maxbits = _BITS(maxkeysize); 6758 } 6759 6760 return m; 6761 } 6762 6763 /* 6764 * not really an official behavior. discussed in pf_key@inner.net in Sep2000. 6765 * XXX reorder combinations by preference 6766 */ 6767 static struct mbuf * 6768 key_getcomb_ipcomp(void) 6769 { 6770 const struct comp_algo *algo; 6771 struct sadb_comb *comb; 6772 struct mbuf *m; 6773 int i; 6774 const int l = PFKEY_ALIGN8(sizeof(struct sadb_comb)); 6775 6776 m = NULL; 6777 for (i = 1; i <= SADB_X_CALG_MAX; i++) { 6778 algo = comp_algorithm_lookup(i); 6779 if (!algo) 6780 continue; 6781 6782 if (!m) { 6783 IPSEC_ASSERT(l <= MLEN, 6784 ("l=%u > MLEN=%lu", l, (u_long) MLEN)); 6785 MGET(m, M_NOWAIT, MT_DATA); 6786 if (m) { 6787 M_ALIGN(m, l); 6788 m->m_len = l; 6789 m->m_next = NULL; 6790 } 6791 } else 6792 M_PREPEND(m, l, M_NOWAIT); 6793 if (!m) 6794 return NULL; 6795 6796 comb = mtod(m, struct sadb_comb *); 6797 bzero(comb, sizeof(*comb)); 6798 key_getcomb_setlifetime(comb); 6799 comb->sadb_comb_encrypt = i; 6800 /* what should we set into sadb_comb_*_{min,max}bits? */ 6801 } 6802 6803 return m; 6804 } 6805 6806 /* 6807 * XXX no way to pass mode (transport/tunnel) to userland 6808 * XXX replay checking? 6809 * XXX sysctl interface to ipsec_{ah,esp}_keymin 6810 */ 6811 static struct mbuf * 6812 key_getprop(const struct secasindex *saidx) 6813 { 6814 struct sadb_prop *prop; 6815 struct mbuf *m, *n; 6816 const int l = PFKEY_ALIGN8(sizeof(struct sadb_prop)); 6817 int totlen; 6818 6819 switch (saidx->proto) { 6820 case IPPROTO_ESP: 6821 m = key_getcomb_ealg(); 6822 break; 6823 case IPPROTO_AH: 6824 m = key_getcomb_ah(); 6825 break; 6826 case IPPROTO_IPCOMP: 6827 m = key_getcomb_ipcomp(); 6828 break; 6829 default: 6830 return NULL; 6831 } 6832 6833 if (!m) 6834 return NULL; 6835 M_PREPEND(m, l, M_NOWAIT); 6836 if (!m) 6837 return NULL; 6838 6839 totlen = 0; 6840 for (n = m; n; n = n->m_next) 6841 totlen += n->m_len; 6842 6843 prop = mtod(m, struct sadb_prop *); 6844 bzero(prop, sizeof(*prop)); 6845 prop->sadb_prop_len = PFKEY_UNIT64(totlen); 6846 prop->sadb_prop_exttype = SADB_EXT_PROPOSAL; 6847 prop->sadb_prop_replay = 32; /* XXX */ 6848 6849 return m; 6850 } 6851 6852 /* 6853 * SADB_ACQUIRE processing called by key_checkrequest() and key_acquire2(). 6854 * send 6855 * <base, SA, address(SD), (address(P)), x_policy, 6856 * (identity(SD),) (sensitivity,) proposal> 6857 * to KMD, and expect to receive 6858 * <base> with SADB_ACQUIRE if error occurred, 6859 * or 6860 * <base, src address, dst address, (SPI range)> with SADB_GETSPI 6861 * from KMD by PF_KEY. 6862 * 6863 * XXX x_policy is outside of RFC2367 (KAME extension). 6864 * XXX sensitivity is not supported. 6865 * XXX for ipcomp, RFC2367 does not define how to fill in proposal. 6866 * see comment for key_getcomb_ipcomp(). 6867 * 6868 * OUT: 6869 * 0 : succeed 6870 * others: error number 6871 */ 6872 static int 6873 key_acquire(const struct secasindex *saidx, struct secpolicy *sp) 6874 { 6875 union sockaddr_union addr; 6876 struct mbuf *result, *m; 6877 uint32_t seq; 6878 int error; 6879 uint16_t ul_proto; 6880 uint8_t mask, satype; 6881 6882 IPSEC_ASSERT(saidx != NULL, ("null saidx")); 6883 satype = key_proto2satype(saidx->proto); 6884 IPSEC_ASSERT(satype != 0, ("null satype, protocol %u", saidx->proto)); 6885 6886 error = -1; 6887 result = NULL; 6888 ul_proto = IPSEC_ULPROTO_ANY; 6889 6890 /* Get seq number to check whether sending message or not. */ 6891 seq = key_getacq(saidx, &error); 6892 if (seq == 0) 6893 return (error); 6894 6895 m = key_setsadbmsg(SADB_ACQUIRE, 0, satype, seq, 0, 0); 6896 if (!m) { 6897 error = ENOBUFS; 6898 goto fail; 6899 } 6900 result = m; 6901 6902 /* 6903 * set sadb_address for saidx's. 6904 * 6905 * Note that if sp is supplied, then we're being called from 6906 * key_allocsa_policy() and should supply port and protocol 6907 * information. 6908 * XXXAE: why only TCP and UDP? ICMP and SCTP looks applicable too. 6909 * XXXAE: probably we can handle this in the ipsec[46]_allocsa(). 6910 * XXXAE: it looks like we should save this info in the ACQ entry. 6911 */ 6912 if (sp != NULL && (sp->spidx.ul_proto == IPPROTO_TCP || 6913 sp->spidx.ul_proto == IPPROTO_UDP)) 6914 ul_proto = sp->spidx.ul_proto; 6915 6916 addr = saidx->src; 6917 mask = FULLMASK; 6918 if (ul_proto != IPSEC_ULPROTO_ANY) { 6919 switch (sp->spidx.src.sa.sa_family) { 6920 case AF_INET: 6921 if (sp->spidx.src.sin.sin_port != IPSEC_PORT_ANY) { 6922 addr.sin.sin_port = sp->spidx.src.sin.sin_port; 6923 mask = sp->spidx.prefs; 6924 } 6925 break; 6926 case AF_INET6: 6927 if (sp->spidx.src.sin6.sin6_port != IPSEC_PORT_ANY) { 6928 addr.sin6.sin6_port = 6929 sp->spidx.src.sin6.sin6_port; 6930 mask = sp->spidx.prefs; 6931 } 6932 break; 6933 default: 6934 break; 6935 } 6936 } 6937 m = key_setsadbaddr(SADB_EXT_ADDRESS_SRC, &addr.sa, mask, ul_proto); 6938 if (!m) { 6939 error = ENOBUFS; 6940 goto fail; 6941 } 6942 m_cat(result, m); 6943 6944 addr = saidx->dst; 6945 mask = FULLMASK; 6946 if (ul_proto != IPSEC_ULPROTO_ANY) { 6947 switch (sp->spidx.dst.sa.sa_family) { 6948 case AF_INET: 6949 if (sp->spidx.dst.sin.sin_port != IPSEC_PORT_ANY) { 6950 addr.sin.sin_port = sp->spidx.dst.sin.sin_port; 6951 mask = sp->spidx.prefd; 6952 } 6953 break; 6954 case AF_INET6: 6955 if (sp->spidx.dst.sin6.sin6_port != IPSEC_PORT_ANY) { 6956 addr.sin6.sin6_port = 6957 sp->spidx.dst.sin6.sin6_port; 6958 mask = sp->spidx.prefd; 6959 } 6960 break; 6961 default: 6962 break; 6963 } 6964 } 6965 m = key_setsadbaddr(SADB_EXT_ADDRESS_DST, &addr.sa, mask, ul_proto); 6966 if (!m) { 6967 error = ENOBUFS; 6968 goto fail; 6969 } 6970 m_cat(result, m); 6971 6972 /* XXX proxy address (optional) */ 6973 6974 /* 6975 * Set sadb_x_policy. This is KAME extension to RFC2367. 6976 */ 6977 if (sp != NULL) { 6978 m = key_setsadbxpolicy(sp->policy, sp->spidx.dir, sp->id, 6979 sp->priority); 6980 if (!m) { 6981 error = ENOBUFS; 6982 goto fail; 6983 } 6984 m_cat(result, m); 6985 } 6986 6987 /* 6988 * Set sadb_x_sa2 extension if saidx->reqid is not zero. 6989 * This is FreeBSD extension to RFC2367. 6990 */ 6991 if (saidx->reqid != 0) { 6992 m = key_setsadbxsa2(saidx->mode, 0, saidx->reqid); 6993 if (m == NULL) { 6994 error = ENOBUFS; 6995 goto fail; 6996 } 6997 m_cat(result, m); 6998 } 6999 /* XXX identity (optional) */ 7000 #if 0 7001 if (idexttype && fqdn) { 7002 /* create identity extension (FQDN) */ 7003 struct sadb_ident *id; 7004 int fqdnlen; 7005 7006 fqdnlen = strlen(fqdn) + 1; /* +1 for terminating-NUL */ 7007 id = (struct sadb_ident *)p; 7008 bzero(id, sizeof(*id) + PFKEY_ALIGN8(fqdnlen)); 7009 id->sadb_ident_len = PFKEY_UNIT64(sizeof(*id) + PFKEY_ALIGN8(fqdnlen)); 7010 id->sadb_ident_exttype = idexttype; 7011 id->sadb_ident_type = SADB_IDENTTYPE_FQDN; 7012 bcopy(fqdn, id + 1, fqdnlen); 7013 p += sizeof(struct sadb_ident) + PFKEY_ALIGN8(fqdnlen); 7014 } 7015 7016 if (idexttype) { 7017 /* create identity extension (USERFQDN) */ 7018 struct sadb_ident *id; 7019 int userfqdnlen; 7020 7021 if (userfqdn) { 7022 /* +1 for terminating-NUL */ 7023 userfqdnlen = strlen(userfqdn) + 1; 7024 } else 7025 userfqdnlen = 0; 7026 id = (struct sadb_ident *)p; 7027 bzero(id, sizeof(*id) + PFKEY_ALIGN8(userfqdnlen)); 7028 id->sadb_ident_len = PFKEY_UNIT64(sizeof(*id) + PFKEY_ALIGN8(userfqdnlen)); 7029 id->sadb_ident_exttype = idexttype; 7030 id->sadb_ident_type = SADB_IDENTTYPE_USERFQDN; 7031 /* XXX is it correct? */ 7032 if (curproc && curproc->p_cred) 7033 id->sadb_ident_id = curproc->p_cred->p_ruid; 7034 if (userfqdn && userfqdnlen) 7035 bcopy(userfqdn, id + 1, userfqdnlen); 7036 p += sizeof(struct sadb_ident) + PFKEY_ALIGN8(userfqdnlen); 7037 } 7038 #endif 7039 7040 /* XXX sensitivity (optional) */ 7041 7042 /* create proposal/combination extension */ 7043 m = key_getprop(saidx); 7044 #if 0 7045 /* 7046 * spec conformant: always attach proposal/combination extension, 7047 * the problem is that we have no way to attach it for ipcomp, 7048 * due to the way sadb_comb is declared in RFC2367. 7049 */ 7050 if (!m) { 7051 error = ENOBUFS; 7052 goto fail; 7053 } 7054 m_cat(result, m); 7055 #else 7056 /* 7057 * outside of spec; make proposal/combination extension optional. 7058 */ 7059 if (m) 7060 m_cat(result, m); 7061 #endif 7062 7063 if ((result->m_flags & M_PKTHDR) == 0) { 7064 error = EINVAL; 7065 goto fail; 7066 } 7067 7068 if (result->m_len < sizeof(struct sadb_msg)) { 7069 result = m_pullup(result, sizeof(struct sadb_msg)); 7070 if (result == NULL) { 7071 error = ENOBUFS; 7072 goto fail; 7073 } 7074 } 7075 7076 result->m_pkthdr.len = 0; 7077 for (m = result; m; m = m->m_next) 7078 result->m_pkthdr.len += m->m_len; 7079 7080 mtod(result, struct sadb_msg *)->sadb_msg_len = 7081 PFKEY_UNIT64(result->m_pkthdr.len); 7082 7083 KEYDBG(KEY_STAMP, 7084 printf("%s: SP(%p)\n", __func__, sp)); 7085 KEYDBG(KEY_DATA, kdebug_secasindex(saidx, NULL)); 7086 7087 return key_sendup_mbuf(NULL, result, KEY_SENDUP_REGISTERED); 7088 7089 fail: 7090 if (result) 7091 m_freem(result); 7092 return error; 7093 } 7094 7095 static uint32_t 7096 key_newacq(const struct secasindex *saidx, int *perror) 7097 { 7098 struct secacq *acq; 7099 uint32_t seq; 7100 7101 acq = malloc(sizeof(*acq), M_IPSEC_SAQ, M_NOWAIT | M_ZERO); 7102 if (acq == NULL) { 7103 ipseclog((LOG_DEBUG, "%s: No more memory.\n", __func__)); 7104 *perror = ENOBUFS; 7105 return (0); 7106 } 7107 7108 /* copy secindex */ 7109 bcopy(saidx, &acq->saidx, sizeof(acq->saidx)); 7110 acq->created = time_second; 7111 acq->count = 0; 7112 7113 /* add to acqtree */ 7114 ACQ_LOCK(); 7115 seq = acq->seq = (V_acq_seq == ~0 ? 1 : ++V_acq_seq); 7116 LIST_INSERT_HEAD(&V_acqtree, acq, chain); 7117 LIST_INSERT_HEAD(ACQADDRHASH_HASH(saidx), acq, addrhash); 7118 LIST_INSERT_HEAD(ACQSEQHASH_HASH(seq), acq, seqhash); 7119 ACQ_UNLOCK(); 7120 *perror = 0; 7121 return (seq); 7122 } 7123 7124 static uint32_t 7125 key_getacq(const struct secasindex *saidx, int *perror) 7126 { 7127 struct secacq *acq; 7128 uint32_t seq; 7129 7130 ACQ_LOCK(); 7131 LIST_FOREACH(acq, ACQADDRHASH_HASH(saidx), addrhash) { 7132 if (key_cmpsaidx(&acq->saidx, saidx, CMP_EXACTLY)) { 7133 if (acq->count > V_key_blockacq_count) { 7134 /* 7135 * Reset counter and send message. 7136 * Also reset created time to keep ACQ for 7137 * this saidx. 7138 */ 7139 acq->created = time_second; 7140 acq->count = 0; 7141 seq = acq->seq; 7142 } else { 7143 /* 7144 * Increment counter and do nothing. 7145 * We send SADB_ACQUIRE message only 7146 * for each V_key_blockacq_count packet. 7147 */ 7148 acq->count++; 7149 seq = 0; 7150 } 7151 break; 7152 } 7153 } 7154 ACQ_UNLOCK(); 7155 if (acq != NULL) { 7156 *perror = 0; 7157 return (seq); 7158 } 7159 /* allocate new entry */ 7160 return (key_newacq(saidx, perror)); 7161 } 7162 7163 static int 7164 key_acqreset(uint32_t seq) 7165 { 7166 struct secacq *acq; 7167 7168 ACQ_LOCK(); 7169 LIST_FOREACH(acq, ACQSEQHASH_HASH(seq), seqhash) { 7170 if (acq->seq == seq) { 7171 acq->count = 0; 7172 acq->created = time_second; 7173 break; 7174 } 7175 } 7176 ACQ_UNLOCK(); 7177 if (acq == NULL) 7178 return (ESRCH); 7179 return (0); 7180 } 7181 /* 7182 * Mark ACQ entry as stale to remove it in key_flush_acq(). 7183 * Called after successful SADB_GETSPI message. 7184 */ 7185 static int 7186 key_acqdone(const struct secasindex *saidx, uint32_t seq) 7187 { 7188 struct secacq *acq; 7189 7190 ACQ_LOCK(); 7191 LIST_FOREACH(acq, ACQSEQHASH_HASH(seq), seqhash) { 7192 if (acq->seq == seq) 7193 break; 7194 } 7195 if (acq != NULL) { 7196 if (key_cmpsaidx(&acq->saidx, saidx, CMP_EXACTLY) == 0) { 7197 ipseclog((LOG_DEBUG, 7198 "%s: Mismatched saidx for ACQ %u\n", __func__, seq)); 7199 acq = NULL; 7200 } else { 7201 acq->created = 0; 7202 } 7203 } else { 7204 ipseclog((LOG_DEBUG, 7205 "%s: ACQ %u is not found.\n", __func__, seq)); 7206 } 7207 ACQ_UNLOCK(); 7208 if (acq == NULL) 7209 return (ESRCH); 7210 return (0); 7211 } 7212 7213 static struct secspacq * 7214 key_newspacq(struct secpolicyindex *spidx) 7215 { 7216 struct secspacq *acq; 7217 7218 /* get new entry */ 7219 acq = malloc(sizeof(struct secspacq), M_IPSEC_SAQ, M_NOWAIT|M_ZERO); 7220 if (acq == NULL) { 7221 ipseclog((LOG_DEBUG, "%s: No more memory.\n", __func__)); 7222 return NULL; 7223 } 7224 7225 /* copy secindex */ 7226 bcopy(spidx, &acq->spidx, sizeof(acq->spidx)); 7227 acq->created = time_second; 7228 acq->count = 0; 7229 7230 /* add to spacqtree */ 7231 SPACQ_LOCK(); 7232 LIST_INSERT_HEAD(&V_spacqtree, acq, chain); 7233 SPACQ_UNLOCK(); 7234 7235 return acq; 7236 } 7237 7238 static struct secspacq * 7239 key_getspacq(struct secpolicyindex *spidx) 7240 { 7241 struct secspacq *acq; 7242 7243 SPACQ_LOCK(); 7244 LIST_FOREACH(acq, &V_spacqtree, chain) { 7245 if (key_cmpspidx_exactly(spidx, &acq->spidx)) { 7246 /* NB: return holding spacq_lock */ 7247 return acq; 7248 } 7249 } 7250 SPACQ_UNLOCK(); 7251 7252 return NULL; 7253 } 7254 7255 /* 7256 * SADB_ACQUIRE processing, 7257 * in first situation, is receiving 7258 * <base> 7259 * from the ikmpd, and clear sequence of its secasvar entry. 7260 * 7261 * In second situation, is receiving 7262 * <base, address(SD), (address(P),) (identity(SD),) (sensitivity,) proposal> 7263 * from a user land process, and return 7264 * <base, address(SD), (address(P),) (identity(SD),) (sensitivity,) proposal> 7265 * to the socket. 7266 * 7267 * m will always be freed. 7268 */ 7269 static int 7270 key_acquire2(struct socket *so, struct mbuf *m, const struct sadb_msghdr *mhp) 7271 { 7272 SAHTREE_RLOCK_TRACKER; 7273 struct sadb_address *src0, *dst0; 7274 struct secasindex saidx; 7275 struct secashead *sah; 7276 uint32_t reqid; 7277 int error; 7278 uint8_t mode, proto; 7279 7280 IPSEC_ASSERT(so != NULL, ("null socket")); 7281 IPSEC_ASSERT(m != NULL, ("null mbuf")); 7282 IPSEC_ASSERT(mhp != NULL, ("null msghdr")); 7283 IPSEC_ASSERT(mhp->msg != NULL, ("null msg")); 7284 7285 /* 7286 * Error message from KMd. 7287 * We assume that if error was occurred in IKEd, the length of PFKEY 7288 * message is equal to the size of sadb_msg structure. 7289 * We do not raise error even if error occurred in this function. 7290 */ 7291 if (mhp->msg->sadb_msg_len == PFKEY_UNIT64(sizeof(struct sadb_msg))) { 7292 /* check sequence number */ 7293 if (mhp->msg->sadb_msg_seq == 0 || 7294 mhp->msg->sadb_msg_errno == 0) { 7295 ipseclog((LOG_DEBUG, "%s: must specify sequence " 7296 "number and errno.\n", __func__)); 7297 } else { 7298 /* 7299 * IKEd reported that error occurred. 7300 * XXXAE: what it expects from the kernel? 7301 * Probably we should send SADB_ACQUIRE again? 7302 * If so, reset ACQ's state. 7303 * XXXAE: it looks useless. 7304 */ 7305 key_acqreset(mhp->msg->sadb_msg_seq); 7306 } 7307 m_freem(m); 7308 return (0); 7309 } 7310 7311 /* 7312 * This message is from user land. 7313 */ 7314 7315 /* map satype to proto */ 7316 if ((proto = key_satype2proto(mhp->msg->sadb_msg_satype)) == 0) { 7317 ipseclog((LOG_DEBUG, "%s: invalid satype is passed.\n", 7318 __func__)); 7319 return key_senderror(so, m, EINVAL); 7320 } 7321 7322 if (SADB_CHECKHDR(mhp, SADB_EXT_ADDRESS_SRC) || 7323 SADB_CHECKHDR(mhp, SADB_EXT_ADDRESS_DST) || 7324 SADB_CHECKHDR(mhp, SADB_EXT_PROPOSAL)) { 7325 ipseclog((LOG_DEBUG, 7326 "%s: invalid message: missing required header.\n", 7327 __func__)); 7328 return key_senderror(so, m, EINVAL); 7329 } 7330 if (SADB_CHECKLEN(mhp, SADB_EXT_ADDRESS_SRC) || 7331 SADB_CHECKLEN(mhp, SADB_EXT_ADDRESS_DST) || 7332 SADB_CHECKLEN(mhp, SADB_EXT_PROPOSAL)) { 7333 ipseclog((LOG_DEBUG, 7334 "%s: invalid message: wrong header size.\n", __func__)); 7335 return key_senderror(so, m, EINVAL); 7336 } 7337 7338 if (SADB_CHECKHDR(mhp, SADB_X_EXT_SA2)) { 7339 mode = IPSEC_MODE_ANY; 7340 reqid = 0; 7341 } else { 7342 if (SADB_CHECKLEN(mhp, SADB_X_EXT_SA2)) { 7343 ipseclog((LOG_DEBUG, 7344 "%s: invalid message: wrong header size.\n", 7345 __func__)); 7346 return key_senderror(so, m, EINVAL); 7347 } 7348 mode = ((struct sadb_x_sa2 *) 7349 mhp->ext[SADB_X_EXT_SA2])->sadb_x_sa2_mode; 7350 reqid = ((struct sadb_x_sa2 *) 7351 mhp->ext[SADB_X_EXT_SA2])->sadb_x_sa2_reqid; 7352 } 7353 7354 src0 = (struct sadb_address *)mhp->ext[SADB_EXT_ADDRESS_SRC]; 7355 dst0 = (struct sadb_address *)mhp->ext[SADB_EXT_ADDRESS_DST]; 7356 7357 error = key_checksockaddrs((struct sockaddr *)(src0 + 1), 7358 (struct sockaddr *)(dst0 + 1)); 7359 if (error != 0) { 7360 ipseclog((LOG_DEBUG, "%s: invalid sockaddr.\n", __func__)); 7361 return key_senderror(so, m, EINVAL); 7362 } 7363 KEY_SETSECASIDX(proto, mode, reqid, src0 + 1, dst0 + 1, &saidx); 7364 7365 /* get a SA index */ 7366 SAHTREE_RLOCK(); 7367 LIST_FOREACH(sah, SAHADDRHASH_HASH(&saidx), addrhash) { 7368 if (key_cmpsaidx(&sah->saidx, &saidx, CMP_MODE_REQID)) 7369 break; 7370 } 7371 SAHTREE_RUNLOCK(); 7372 if (sah != NULL) { 7373 ipseclog((LOG_DEBUG, "%s: a SA exists already.\n", __func__)); 7374 return key_senderror(so, m, EEXIST); 7375 } 7376 7377 error = key_acquire(&saidx, NULL); 7378 if (error != 0) { 7379 ipseclog((LOG_DEBUG, 7380 "%s: error %d returned from key_acquire()\n", 7381 __func__, error)); 7382 return key_senderror(so, m, error); 7383 } 7384 m_freem(m); 7385 return (0); 7386 } 7387 7388 /* 7389 * SADB_REGISTER processing. 7390 * If SATYPE_UNSPEC has been passed as satype, only return sabd_supported. 7391 * receive 7392 * <base> 7393 * from the ikmpd, and register a socket to send PF_KEY messages, 7394 * and send 7395 * <base, supported> 7396 * to KMD by PF_KEY. 7397 * If socket is detached, must free from regnode. 7398 * 7399 * m will always be freed. 7400 */ 7401 static int 7402 key_register(struct socket *so, struct mbuf *m, const struct sadb_msghdr *mhp) 7403 { 7404 struct secreg *reg, *newreg = NULL; 7405 7406 IPSEC_ASSERT(so != NULL, ("null socket")); 7407 IPSEC_ASSERT(m != NULL, ("null mbuf")); 7408 IPSEC_ASSERT(mhp != NULL, ("null msghdr")); 7409 IPSEC_ASSERT(mhp->msg != NULL, ("null msg")); 7410 7411 /* check for invalid register message */ 7412 if (mhp->msg->sadb_msg_satype >= sizeof(V_regtree)/sizeof(V_regtree[0])) 7413 return key_senderror(so, m, EINVAL); 7414 7415 /* When SATYPE_UNSPEC is specified, only return sabd_supported. */ 7416 if (mhp->msg->sadb_msg_satype == SADB_SATYPE_UNSPEC) 7417 goto setmsg; 7418 7419 /* check whether existing or not */ 7420 REGTREE_LOCK(); 7421 LIST_FOREACH(reg, &V_regtree[mhp->msg->sadb_msg_satype], chain) { 7422 if (reg->so == so) { 7423 REGTREE_UNLOCK(); 7424 ipseclog((LOG_DEBUG, "%s: socket exists already.\n", 7425 __func__)); 7426 return key_senderror(so, m, EEXIST); 7427 } 7428 } 7429 7430 /* create regnode */ 7431 newreg = malloc(sizeof(struct secreg), M_IPSEC_SAR, M_NOWAIT|M_ZERO); 7432 if (newreg == NULL) { 7433 REGTREE_UNLOCK(); 7434 ipseclog((LOG_DEBUG, "%s: No more memory.\n", __func__)); 7435 return key_senderror(so, m, ENOBUFS); 7436 } 7437 7438 newreg->so = so; 7439 ((struct keycb *)(so->so_pcb))->kp_registered++; 7440 7441 /* add regnode to regtree. */ 7442 LIST_INSERT_HEAD(&V_regtree[mhp->msg->sadb_msg_satype], newreg, chain); 7443 REGTREE_UNLOCK(); 7444 7445 setmsg: 7446 { 7447 struct mbuf *n; 7448 struct sadb_msg *newmsg; 7449 struct sadb_supported *sup; 7450 u_int len, alen, elen; 7451 int off; 7452 int i; 7453 struct sadb_alg *alg; 7454 7455 /* create new sadb_msg to reply. */ 7456 alen = 0; 7457 for (i = 1; i <= SADB_AALG_MAX; i++) { 7458 if (auth_algorithm_lookup(i)) 7459 alen += sizeof(struct sadb_alg); 7460 } 7461 if (alen) 7462 alen += sizeof(struct sadb_supported); 7463 elen = 0; 7464 for (i = 1; i <= SADB_EALG_MAX; i++) { 7465 if (enc_algorithm_lookup(i)) 7466 elen += sizeof(struct sadb_alg); 7467 } 7468 if (elen) 7469 elen += sizeof(struct sadb_supported); 7470 7471 len = sizeof(struct sadb_msg) + alen + elen; 7472 7473 if (len > MCLBYTES) 7474 return key_senderror(so, m, ENOBUFS); 7475 7476 n = key_mget(len); 7477 if (n == NULL) 7478 return key_senderror(so, m, ENOBUFS); 7479 7480 n->m_pkthdr.len = n->m_len = len; 7481 n->m_next = NULL; 7482 off = 0; 7483 7484 m_copydata(m, 0, sizeof(struct sadb_msg), mtod(n, caddr_t) + off); 7485 newmsg = mtod(n, struct sadb_msg *); 7486 newmsg->sadb_msg_errno = 0; 7487 newmsg->sadb_msg_len = PFKEY_UNIT64(len); 7488 off += PFKEY_ALIGN8(sizeof(struct sadb_msg)); 7489 7490 /* for authentication algorithm */ 7491 if (alen) { 7492 sup = (struct sadb_supported *)(mtod(n, caddr_t) + off); 7493 sup->sadb_supported_len = PFKEY_UNIT64(alen); 7494 sup->sadb_supported_exttype = SADB_EXT_SUPPORTED_AUTH; 7495 off += PFKEY_ALIGN8(sizeof(*sup)); 7496 7497 for (i = 1; i <= SADB_AALG_MAX; i++) { 7498 const struct auth_hash *aalgo; 7499 u_int16_t minkeysize, maxkeysize; 7500 7501 aalgo = auth_algorithm_lookup(i); 7502 if (!aalgo) 7503 continue; 7504 alg = (struct sadb_alg *)(mtod(n, caddr_t) + off); 7505 alg->sadb_alg_id = i; 7506 alg->sadb_alg_ivlen = 0; 7507 key_getsizes_ah(aalgo, i, &minkeysize, &maxkeysize); 7508 alg->sadb_alg_minbits = _BITS(minkeysize); 7509 alg->sadb_alg_maxbits = _BITS(maxkeysize); 7510 off += PFKEY_ALIGN8(sizeof(*alg)); 7511 } 7512 } 7513 7514 /* for encryption algorithm */ 7515 if (elen) { 7516 sup = (struct sadb_supported *)(mtod(n, caddr_t) + off); 7517 sup->sadb_supported_len = PFKEY_UNIT64(elen); 7518 sup->sadb_supported_exttype = SADB_EXT_SUPPORTED_ENCRYPT; 7519 off += PFKEY_ALIGN8(sizeof(*sup)); 7520 7521 for (i = 1; i <= SADB_EALG_MAX; i++) { 7522 const struct enc_xform *ealgo; 7523 7524 ealgo = enc_algorithm_lookup(i); 7525 if (!ealgo) 7526 continue; 7527 alg = (struct sadb_alg *)(mtod(n, caddr_t) + off); 7528 alg->sadb_alg_id = i; 7529 alg->sadb_alg_ivlen = ealgo->ivsize; 7530 alg->sadb_alg_minbits = _BITS(ealgo->minkey); 7531 alg->sadb_alg_maxbits = _BITS(ealgo->maxkey); 7532 off += PFKEY_ALIGN8(sizeof(struct sadb_alg)); 7533 } 7534 } 7535 7536 IPSEC_ASSERT(off == len, 7537 ("length assumption failed (off %u len %u)", off, len)); 7538 7539 m_freem(m); 7540 return key_sendup_mbuf(so, n, KEY_SENDUP_REGISTERED); 7541 } 7542 } 7543 7544 /* 7545 * free secreg entry registered. 7546 * XXX: I want to do free a socket marked done SADB_RESIGER to socket. 7547 */ 7548 void 7549 key_freereg(struct socket *so) 7550 { 7551 struct secreg *reg; 7552 int i; 7553 7554 IPSEC_ASSERT(so != NULL, ("NULL so")); 7555 7556 /* 7557 * check whether existing or not. 7558 * check all type of SA, because there is a potential that 7559 * one socket is registered to multiple type of SA. 7560 */ 7561 REGTREE_LOCK(); 7562 for (i = 0; i <= SADB_SATYPE_MAX; i++) { 7563 LIST_FOREACH(reg, &V_regtree[i], chain) { 7564 if (reg->so == so && __LIST_CHAINED(reg)) { 7565 LIST_REMOVE(reg, chain); 7566 free(reg, M_IPSEC_SAR); 7567 break; 7568 } 7569 } 7570 } 7571 REGTREE_UNLOCK(); 7572 } 7573 7574 /* 7575 * SADB_EXPIRE processing 7576 * send 7577 * <base, SA, SA2, lifetime(C and one of HS), address(SD)> 7578 * to KMD by PF_KEY. 7579 * NOTE: We send only soft lifetime extension. 7580 * 7581 * OUT: 0 : succeed 7582 * others : error number 7583 */ 7584 static int 7585 key_expire(struct secasvar *sav, int hard) 7586 { 7587 struct mbuf *result = NULL, *m; 7588 struct sadb_lifetime *lt; 7589 uint32_t replay_count; 7590 int error, len; 7591 uint8_t satype; 7592 7593 SECASVAR_RLOCK_TRACKER; 7594 7595 IPSEC_ASSERT (sav != NULL, ("null sav")); 7596 IPSEC_ASSERT (sav->sah != NULL, ("null sa header")); 7597 7598 KEYDBG(KEY_STAMP, 7599 printf("%s: SA(%p) expired %s lifetime\n", __func__, 7600 sav, hard ? "hard": "soft")); 7601 KEYDBG(KEY_DATA, kdebug_secasv(sav)); 7602 /* set msg header */ 7603 satype = key_proto2satype(sav->sah->saidx.proto); 7604 IPSEC_ASSERT(satype != 0, ("invalid proto, satype %u", satype)); 7605 m = key_setsadbmsg(SADB_EXPIRE, 0, satype, sav->seq, 0, sav->refcnt); 7606 if (!m) { 7607 error = ENOBUFS; 7608 goto fail; 7609 } 7610 result = m; 7611 7612 /* create SA extension */ 7613 m = key_setsadbsa(sav); 7614 if (!m) { 7615 error = ENOBUFS; 7616 goto fail; 7617 } 7618 m_cat(result, m); 7619 7620 /* create SA extension */ 7621 SECASVAR_RLOCK(sav); 7622 replay_count = sav->replay ? sav->replay->count : 0; 7623 SECASVAR_RUNLOCK(sav); 7624 7625 m = key_setsadbxsa2(sav->sah->saidx.mode, replay_count, 7626 sav->sah->saidx.reqid); 7627 if (!m) { 7628 error = ENOBUFS; 7629 goto fail; 7630 } 7631 m_cat(result, m); 7632 7633 if (sav->replay && sav->replay->wsize > UINT8_MAX) { 7634 m = key_setsadbxsareplay(sav->replay->wsize); 7635 if (!m) { 7636 error = ENOBUFS; 7637 goto fail; 7638 } 7639 m_cat(result, m); 7640 } 7641 7642 /* create lifetime extension (current and soft) */ 7643 len = PFKEY_ALIGN8(sizeof(*lt)) * 2; 7644 m = m_get2(len, M_NOWAIT, MT_DATA, 0); 7645 if (m == NULL) { 7646 error = ENOBUFS; 7647 goto fail; 7648 } 7649 m_align(m, len); 7650 m->m_len = len; 7651 bzero(mtod(m, caddr_t), len); 7652 lt = mtod(m, struct sadb_lifetime *); 7653 lt->sadb_lifetime_len = PFKEY_UNIT64(sizeof(struct sadb_lifetime)); 7654 lt->sadb_lifetime_exttype = SADB_EXT_LIFETIME_CURRENT; 7655 lt->sadb_lifetime_allocations = 7656 (uint32_t)counter_u64_fetch(sav->lft_c_allocations); 7657 lt->sadb_lifetime_bytes = 7658 counter_u64_fetch(sav->lft_c_bytes); 7659 lt->sadb_lifetime_addtime = sav->created; 7660 lt->sadb_lifetime_usetime = sav->firstused; 7661 lt = (struct sadb_lifetime *)(mtod(m, caddr_t) + len / 2); 7662 lt->sadb_lifetime_len = PFKEY_UNIT64(sizeof(struct sadb_lifetime)); 7663 if (hard) { 7664 lt->sadb_lifetime_exttype = SADB_EXT_LIFETIME_HARD; 7665 lt->sadb_lifetime_allocations = sav->lft_h->allocations; 7666 lt->sadb_lifetime_bytes = sav->lft_h->bytes; 7667 lt->sadb_lifetime_addtime = sav->lft_h->addtime; 7668 lt->sadb_lifetime_usetime = sav->lft_h->usetime; 7669 } else { 7670 lt->sadb_lifetime_exttype = SADB_EXT_LIFETIME_SOFT; 7671 lt->sadb_lifetime_allocations = sav->lft_s->allocations; 7672 lt->sadb_lifetime_bytes = sav->lft_s->bytes; 7673 lt->sadb_lifetime_addtime = sav->lft_s->addtime; 7674 lt->sadb_lifetime_usetime = sav->lft_s->usetime; 7675 } 7676 m_cat(result, m); 7677 7678 /* set sadb_address for source */ 7679 m = key_setsadbaddr(SADB_EXT_ADDRESS_SRC, 7680 &sav->sah->saidx.src.sa, 7681 FULLMASK, IPSEC_ULPROTO_ANY); 7682 if (!m) { 7683 error = ENOBUFS; 7684 goto fail; 7685 } 7686 m_cat(result, m); 7687 7688 /* set sadb_address for destination */ 7689 m = key_setsadbaddr(SADB_EXT_ADDRESS_DST, 7690 &sav->sah->saidx.dst.sa, 7691 FULLMASK, IPSEC_ULPROTO_ANY); 7692 if (!m) { 7693 error = ENOBUFS; 7694 goto fail; 7695 } 7696 m_cat(result, m); 7697 7698 /* 7699 * XXX-BZ Handle NAT-T extensions here. 7700 * XXXAE: it doesn't seem quite useful. IKEs should not depend on 7701 * this information, we report only significant SA fields. 7702 */ 7703 7704 if ((result->m_flags & M_PKTHDR) == 0) { 7705 error = EINVAL; 7706 goto fail; 7707 } 7708 7709 if (result->m_len < sizeof(struct sadb_msg)) { 7710 result = m_pullup(result, sizeof(struct sadb_msg)); 7711 if (result == NULL) { 7712 error = ENOBUFS; 7713 goto fail; 7714 } 7715 } 7716 7717 result->m_pkthdr.len = 0; 7718 for (m = result; m; m = m->m_next) 7719 result->m_pkthdr.len += m->m_len; 7720 7721 mtod(result, struct sadb_msg *)->sadb_msg_len = 7722 PFKEY_UNIT64(result->m_pkthdr.len); 7723 7724 return key_sendup_mbuf(NULL, result, KEY_SENDUP_REGISTERED); 7725 7726 fail: 7727 if (result) 7728 m_freem(result); 7729 return error; 7730 } 7731 7732 static void 7733 key_freesah_flushed(struct secashead_queue *flushq) 7734 { 7735 struct secashead *sah, *nextsah; 7736 struct secasvar *sav, *nextsav; 7737 7738 sah = TAILQ_FIRST(flushq); 7739 while (sah != NULL) { 7740 sav = TAILQ_FIRST(&sah->savtree_larval); 7741 while (sav != NULL) { 7742 nextsav = TAILQ_NEXT(sav, chain); 7743 TAILQ_REMOVE(&sah->savtree_larval, sav, chain); 7744 key_freesav(&sav); /* release last reference */ 7745 key_freesah(&sah); /* release reference from SAV */ 7746 sav = nextsav; 7747 } 7748 sav = TAILQ_FIRST(&sah->savtree_alive); 7749 while (sav != NULL) { 7750 nextsav = TAILQ_NEXT(sav, chain); 7751 TAILQ_REMOVE(&sah->savtree_alive, sav, chain); 7752 key_freesav(&sav); /* release last reference */ 7753 key_freesah(&sah); /* release reference from SAV */ 7754 sav = nextsav; 7755 } 7756 nextsah = TAILQ_NEXT(sah, chain); 7757 key_freesah(&sah); /* release last reference */ 7758 sah = nextsah; 7759 } 7760 } 7761 7762 /* 7763 * SADB_FLUSH processing 7764 * receive 7765 * <base> 7766 * from the ikmpd, and free all entries in secastree. 7767 * and send, 7768 * <base> 7769 * to the ikmpd. 7770 * NOTE: to do is only marking SADB_SASTATE_DEAD. 7771 * 7772 * m will always be freed. 7773 */ 7774 static int 7775 key_flush(struct socket *so, struct mbuf *m, const struct sadb_msghdr *mhp) 7776 { 7777 struct secashead_queue flushq; 7778 struct sadb_msg *newmsg; 7779 struct secashead *sah, *nextsah; 7780 struct secasvar *sav; 7781 uint8_t proto; 7782 int i; 7783 7784 IPSEC_ASSERT(so != NULL, ("null socket")); 7785 IPSEC_ASSERT(mhp != NULL, ("null msghdr")); 7786 IPSEC_ASSERT(mhp->msg != NULL, ("null msg")); 7787 7788 /* map satype to proto */ 7789 if ((proto = key_satype2proto(mhp->msg->sadb_msg_satype)) == 0) { 7790 ipseclog((LOG_DEBUG, "%s: invalid satype is passed.\n", 7791 __func__)); 7792 return key_senderror(so, m, EINVAL); 7793 } 7794 KEYDBG(KEY_STAMP, 7795 printf("%s: proto %u\n", __func__, proto)); 7796 7797 TAILQ_INIT(&flushq); 7798 if (proto == IPSEC_PROTO_ANY) { 7799 /* no SATYPE specified, i.e. flushing all SA. */ 7800 SAHTREE_WLOCK(); 7801 /* Move all SAHs into flushq */ 7802 TAILQ_CONCAT(&flushq, &V_sahtree, chain); 7803 /* Flush all buckets in SPI hash */ 7804 for (i = 0; i < V_savhash_mask + 1; i++) 7805 LIST_INIT(&V_savhashtbl[i]); 7806 /* Flush all buckets in SAHADDRHASH */ 7807 for (i = 0; i < V_sahaddrhash_mask + 1; i++) 7808 LIST_INIT(&V_sahaddrhashtbl[i]); 7809 /* Mark all SAHs as unlinked */ 7810 TAILQ_FOREACH(sah, &flushq, chain) { 7811 sah->state = SADB_SASTATE_DEAD; 7812 /* 7813 * Callout handler makes its job using 7814 * RLOCK and drain queues. In case, when this 7815 * function will be called just before it 7816 * acquires WLOCK, we need to mark SAs as 7817 * unlinked to prevent second unlink. 7818 */ 7819 TAILQ_FOREACH(sav, &sah->savtree_larval, chain) { 7820 sav->state = SADB_SASTATE_DEAD; 7821 ipsec_accel_forget_sav(sav); 7822 } 7823 TAILQ_FOREACH(sav, &sah->savtree_alive, chain) { 7824 sav->state = SADB_SASTATE_DEAD; 7825 ipsec_accel_forget_sav(sav); 7826 } 7827 } 7828 SAHTREE_WUNLOCK(); 7829 } else { 7830 SAHTREE_WLOCK(); 7831 sah = TAILQ_FIRST(&V_sahtree); 7832 while (sah != NULL) { 7833 IPSEC_ASSERT(sah->state != SADB_SASTATE_DEAD, 7834 ("DEAD SAH %p in SADB_FLUSH", sah)); 7835 nextsah = TAILQ_NEXT(sah, chain); 7836 if (sah->saidx.proto != proto) { 7837 sah = nextsah; 7838 continue; 7839 } 7840 sah->state = SADB_SASTATE_DEAD; 7841 TAILQ_REMOVE(&V_sahtree, sah, chain); 7842 LIST_REMOVE(sah, addrhash); 7843 /* Unlink all SAs from SPI hash */ 7844 TAILQ_FOREACH(sav, &sah->savtree_larval, chain) { 7845 LIST_REMOVE(sav, spihash); 7846 sav->state = SADB_SASTATE_DEAD; 7847 ipsec_accel_forget_sav(sav); 7848 } 7849 TAILQ_FOREACH(sav, &sah->savtree_alive, chain) { 7850 LIST_REMOVE(sav, spihash); 7851 sav->state = SADB_SASTATE_DEAD; 7852 ipsec_accel_forget_sav(sav); 7853 } 7854 /* Add SAH into flushq */ 7855 TAILQ_INSERT_HEAD(&flushq, sah, chain); 7856 sah = nextsah; 7857 } 7858 SAHTREE_WUNLOCK(); 7859 } 7860 7861 key_freesah_flushed(&flushq); 7862 /* Free all queued SAs and SAHs */ 7863 if (m->m_len < sizeof(struct sadb_msg) || 7864 sizeof(struct sadb_msg) > m->m_len + M_TRAILINGSPACE(m)) { 7865 ipseclog((LOG_DEBUG, "%s: No more memory.\n", __func__)); 7866 return key_senderror(so, m, ENOBUFS); 7867 } 7868 7869 if (m->m_next) 7870 m_freem(m->m_next); 7871 m->m_next = NULL; 7872 m->m_pkthdr.len = m->m_len = sizeof(struct sadb_msg); 7873 newmsg = mtod(m, struct sadb_msg *); 7874 newmsg->sadb_msg_errno = 0; 7875 newmsg->sadb_msg_len = PFKEY_UNIT64(m->m_pkthdr.len); 7876 7877 return key_sendup_mbuf(so, m, KEY_SENDUP_ALL); 7878 } 7879 7880 /* 7881 * SADB_DUMP processing 7882 * dump all entries including status of DEAD in SAD. 7883 * receive 7884 * <base> 7885 * from the ikmpd, and dump all secasvar leaves 7886 * and send, 7887 * <base> ..... 7888 * to the ikmpd. 7889 * 7890 * m will always be freed. 7891 */ 7892 static int 7893 key_dump(struct socket *so, struct mbuf *m, const struct sadb_msghdr *mhp) 7894 { 7895 SAHTREE_RLOCK_TRACKER; 7896 struct secashead *sah; 7897 struct secasvar *sav; 7898 struct mbuf *n; 7899 uint32_t cnt; 7900 uint8_t proto, satype; 7901 7902 IPSEC_ASSERT(so != NULL, ("null socket")); 7903 IPSEC_ASSERT(m != NULL, ("null mbuf")); 7904 IPSEC_ASSERT(mhp != NULL, ("null msghdr")); 7905 IPSEC_ASSERT(mhp->msg != NULL, ("null msg")); 7906 7907 /* map satype to proto */ 7908 if ((proto = key_satype2proto(mhp->msg->sadb_msg_satype)) == 0) { 7909 ipseclog((LOG_DEBUG, "%s: invalid satype is passed.\n", 7910 __func__)); 7911 return key_senderror(so, m, EINVAL); 7912 } 7913 7914 /* count sav entries to be sent to the userland. */ 7915 cnt = 0; 7916 IFNET_RLOCK(); 7917 SAHTREE_RLOCK(); 7918 TAILQ_FOREACH(sah, &V_sahtree, chain) { 7919 if (mhp->msg->sadb_msg_satype != SADB_SATYPE_UNSPEC && 7920 proto != sah->saidx.proto) 7921 continue; 7922 7923 TAILQ_FOREACH(sav, &sah->savtree_larval, chain) 7924 cnt++; 7925 TAILQ_FOREACH(sav, &sah->savtree_alive, chain) 7926 cnt++; 7927 } 7928 7929 if (cnt == 0) { 7930 SAHTREE_RUNLOCK(); 7931 IFNET_RUNLOCK(); 7932 return key_senderror(so, m, ENOENT); 7933 } 7934 7935 /* send this to the userland, one at a time. */ 7936 TAILQ_FOREACH(sah, &V_sahtree, chain) { 7937 if (mhp->msg->sadb_msg_satype != SADB_SATYPE_UNSPEC && 7938 proto != sah->saidx.proto) 7939 continue; 7940 7941 /* map proto to satype */ 7942 if ((satype = key_proto2satype(sah->saidx.proto)) == 0) { 7943 SAHTREE_RUNLOCK(); 7944 IFNET_RUNLOCK(); 7945 ipseclog((LOG_DEBUG, "%s: there was invalid proto in " 7946 "SAD.\n", __func__)); 7947 return key_senderror(so, m, EINVAL); 7948 } 7949 TAILQ_FOREACH(sav, &sah->savtree_larval, chain) { 7950 n = key_setdumpsa(sav, SADB_DUMP, satype, 7951 --cnt, mhp->msg->sadb_msg_pid, &sahtree_tracker); 7952 if (n == NULL) { 7953 SAHTREE_RUNLOCK(); 7954 IFNET_RUNLOCK(); 7955 return key_senderror(so, m, ENOBUFS); 7956 } 7957 key_sendup_mbuf(so, n, KEY_SENDUP_ONE); 7958 } 7959 TAILQ_FOREACH(sav, &sah->savtree_alive, chain) { 7960 n = key_setdumpsa(sav, SADB_DUMP, satype, 7961 --cnt, mhp->msg->sadb_msg_pid, &sahtree_tracker); 7962 if (n == NULL) { 7963 SAHTREE_RUNLOCK(); 7964 IFNET_RUNLOCK(); 7965 return key_senderror(so, m, ENOBUFS); 7966 } 7967 key_sendup_mbuf(so, n, KEY_SENDUP_ONE); 7968 } 7969 } 7970 SAHTREE_RUNLOCK(); 7971 IFNET_RUNLOCK(); 7972 m_freem(m); 7973 return (0); 7974 } 7975 /* 7976 * SADB_X_PROMISC processing 7977 * 7978 * m will always be freed. 7979 */ 7980 static int 7981 key_promisc(struct socket *so, struct mbuf *m, const struct sadb_msghdr *mhp) 7982 { 7983 int olen; 7984 7985 IPSEC_ASSERT(so != NULL, ("null socket")); 7986 IPSEC_ASSERT(m != NULL, ("null mbuf")); 7987 IPSEC_ASSERT(mhp != NULL, ("null msghdr")); 7988 IPSEC_ASSERT(mhp->msg != NULL, ("null msg")); 7989 7990 olen = PFKEY_UNUNIT64(mhp->msg->sadb_msg_len); 7991 7992 if (olen < sizeof(struct sadb_msg)) { 7993 #if 1 7994 return key_senderror(so, m, EINVAL); 7995 #else 7996 m_freem(m); 7997 return 0; 7998 #endif 7999 } else if (olen == sizeof(struct sadb_msg)) { 8000 /* enable/disable promisc mode */ 8001 struct keycb *kp; 8002 8003 if ((kp = so->so_pcb) == NULL) 8004 return key_senderror(so, m, EINVAL); 8005 mhp->msg->sadb_msg_errno = 0; 8006 switch (mhp->msg->sadb_msg_satype) { 8007 case 0: 8008 case 1: 8009 kp->kp_promisc = mhp->msg->sadb_msg_satype; 8010 break; 8011 default: 8012 return key_senderror(so, m, EINVAL); 8013 } 8014 8015 /* send the original message back to everyone */ 8016 mhp->msg->sadb_msg_errno = 0; 8017 return key_sendup_mbuf(so, m, KEY_SENDUP_ALL); 8018 } else { 8019 /* send packet as is */ 8020 8021 m_adj(m, PFKEY_ALIGN8(sizeof(struct sadb_msg))); 8022 8023 /* TODO: if sadb_msg_seq is specified, send to specific pid */ 8024 return key_sendup_mbuf(so, m, KEY_SENDUP_ALL); 8025 } 8026 } 8027 8028 static int (*key_typesw[])(struct socket *, struct mbuf *, 8029 const struct sadb_msghdr *) = { 8030 [SADB_RESERVED] = NULL, 8031 [SADB_GETSPI] = key_getspi, 8032 [SADB_UPDATE] = key_update, 8033 [SADB_ADD] = key_add, 8034 [SADB_DELETE] = key_delete, 8035 [SADB_GET] = key_get, 8036 [SADB_ACQUIRE] = key_acquire2, 8037 [SADB_REGISTER] = key_register, 8038 [SADB_EXPIRE] = NULL, 8039 [SADB_FLUSH] = key_flush, 8040 [SADB_DUMP] = key_dump, 8041 [SADB_X_PROMISC] = key_promisc, 8042 [SADB_X_PCHANGE] = NULL, 8043 [SADB_X_SPDUPDATE] = key_spdadd, 8044 [SADB_X_SPDADD] = key_spdadd, 8045 [SADB_X_SPDDELETE] = key_spddelete, 8046 [SADB_X_SPDGET] = key_spdget, 8047 [SADB_X_SPDACQUIRE] = NULL, 8048 [SADB_X_SPDDUMP] = key_spddump, 8049 [SADB_X_SPDFLUSH] = key_spdflush, 8050 [SADB_X_SPDSETIDX] = key_spdadd, 8051 [SADB_X_SPDEXPIRE] = NULL, 8052 [SADB_X_SPDDELETE2] = key_spddelete2, 8053 }; 8054 8055 /* 8056 * parse sadb_msg buffer to process PFKEYv2, 8057 * and create a data to response if needed. 8058 * I think to be dealed with mbuf directly. 8059 * IN: 8060 * msgp : pointer to pointer to a received buffer pulluped. 8061 * This is rewrited to response. 8062 * so : pointer to socket. 8063 * OUT: 8064 * length for buffer to send to user process. 8065 */ 8066 int 8067 key_parse(struct mbuf *m, struct socket *so) 8068 { 8069 struct sadb_msg *msg; 8070 struct sadb_msghdr mh; 8071 u_int orglen; 8072 int error; 8073 int target; 8074 8075 IPSEC_ASSERT(so != NULL, ("null socket")); 8076 IPSEC_ASSERT(m != NULL, ("null mbuf")); 8077 8078 if (m->m_len < sizeof(struct sadb_msg)) { 8079 m = m_pullup(m, sizeof(struct sadb_msg)); 8080 if (!m) 8081 return ENOBUFS; 8082 } 8083 msg = mtod(m, struct sadb_msg *); 8084 orglen = PFKEY_UNUNIT64(msg->sadb_msg_len); 8085 target = KEY_SENDUP_ONE; 8086 8087 if ((m->m_flags & M_PKTHDR) == 0 || m->m_pkthdr.len != orglen) { 8088 ipseclog((LOG_DEBUG, "%s: invalid message length.\n",__func__)); 8089 PFKEYSTAT_INC(out_invlen); 8090 error = EINVAL; 8091 goto senderror; 8092 } 8093 8094 if (msg->sadb_msg_version != PF_KEY_V2) { 8095 ipseclog((LOG_DEBUG, "%s: PF_KEY version %u is mismatched.\n", 8096 __func__, msg->sadb_msg_version)); 8097 PFKEYSTAT_INC(out_invver); 8098 error = EINVAL; 8099 goto senderror; 8100 } 8101 8102 if (msg->sadb_msg_type > SADB_MAX) { 8103 ipseclog((LOG_DEBUG, "%s: invalid type %u is passed.\n", 8104 __func__, msg->sadb_msg_type)); 8105 PFKEYSTAT_INC(out_invmsgtype); 8106 error = EINVAL; 8107 goto senderror; 8108 } 8109 8110 /* for old-fashioned code - should be nuked */ 8111 if (m->m_pkthdr.len > MCLBYTES) { 8112 m_freem(m); 8113 return ENOBUFS; 8114 } 8115 if (m->m_next) { 8116 struct mbuf *n; 8117 8118 n = key_mget(m->m_pkthdr.len); 8119 if (n == NULL) { 8120 m_freem(m); 8121 return ENOBUFS; 8122 } 8123 m_copydata(m, 0, m->m_pkthdr.len, mtod(n, caddr_t)); 8124 n->m_pkthdr.len = n->m_len = m->m_pkthdr.len; 8125 n->m_next = NULL; 8126 m_freem(m); 8127 m = n; 8128 } 8129 8130 /* align the mbuf chain so that extensions are in contiguous region. */ 8131 error = key_align(m, &mh); 8132 if (error) 8133 return error; 8134 8135 msg = mh.msg; 8136 8137 /* We use satype as scope mask for spddump */ 8138 if (msg->sadb_msg_type == SADB_X_SPDDUMP) { 8139 switch (msg->sadb_msg_satype) { 8140 case IPSEC_POLICYSCOPE_ANY: 8141 case IPSEC_POLICYSCOPE_GLOBAL: 8142 case IPSEC_POLICYSCOPE_IFNET: 8143 case IPSEC_POLICYSCOPE_PCB: 8144 break; 8145 default: 8146 ipseclog((LOG_DEBUG, "%s: illegal satype=%u\n", 8147 __func__, msg->sadb_msg_type)); 8148 PFKEYSTAT_INC(out_invsatype); 8149 error = EINVAL; 8150 goto senderror; 8151 } 8152 } else { 8153 switch (msg->sadb_msg_satype) { /* check SA type */ 8154 case SADB_SATYPE_UNSPEC: 8155 switch (msg->sadb_msg_type) { 8156 case SADB_GETSPI: 8157 case SADB_UPDATE: 8158 case SADB_ADD: 8159 case SADB_DELETE: 8160 case SADB_GET: 8161 case SADB_ACQUIRE: 8162 case SADB_EXPIRE: 8163 ipseclog((LOG_DEBUG, "%s: must specify satype " 8164 "when msg type=%u.\n", __func__, 8165 msg->sadb_msg_type)); 8166 PFKEYSTAT_INC(out_invsatype); 8167 error = EINVAL; 8168 goto senderror; 8169 } 8170 break; 8171 case SADB_SATYPE_AH: 8172 case SADB_SATYPE_ESP: 8173 case SADB_X_SATYPE_IPCOMP: 8174 case SADB_X_SATYPE_TCPSIGNATURE: 8175 switch (msg->sadb_msg_type) { 8176 case SADB_X_SPDADD: 8177 case SADB_X_SPDDELETE: 8178 case SADB_X_SPDGET: 8179 case SADB_X_SPDFLUSH: 8180 case SADB_X_SPDSETIDX: 8181 case SADB_X_SPDUPDATE: 8182 case SADB_X_SPDDELETE2: 8183 ipseclog((LOG_DEBUG, "%s: illegal satype=%u\n", 8184 __func__, msg->sadb_msg_type)); 8185 PFKEYSTAT_INC(out_invsatype); 8186 error = EINVAL; 8187 goto senderror; 8188 } 8189 break; 8190 case SADB_SATYPE_RSVP: 8191 case SADB_SATYPE_OSPFV2: 8192 case SADB_SATYPE_RIPV2: 8193 case SADB_SATYPE_MIP: 8194 ipseclog((LOG_DEBUG, "%s: type %u isn't supported.\n", 8195 __func__, msg->sadb_msg_satype)); 8196 PFKEYSTAT_INC(out_invsatype); 8197 error = EOPNOTSUPP; 8198 goto senderror; 8199 case 1: /* XXX: What does it do? */ 8200 if (msg->sadb_msg_type == SADB_X_PROMISC) 8201 break; 8202 /*FALLTHROUGH*/ 8203 default: 8204 ipseclog((LOG_DEBUG, "%s: invalid type %u is passed.\n", 8205 __func__, msg->sadb_msg_satype)); 8206 PFKEYSTAT_INC(out_invsatype); 8207 error = EINVAL; 8208 goto senderror; 8209 } 8210 } 8211 8212 /* check field of upper layer protocol and address family */ 8213 if (mh.ext[SADB_EXT_ADDRESS_SRC] != NULL 8214 && mh.ext[SADB_EXT_ADDRESS_DST] != NULL) { 8215 struct sadb_address *src0, *dst0; 8216 u_int plen; 8217 8218 src0 = (struct sadb_address *)(mh.ext[SADB_EXT_ADDRESS_SRC]); 8219 dst0 = (struct sadb_address *)(mh.ext[SADB_EXT_ADDRESS_DST]); 8220 8221 /* check upper layer protocol */ 8222 if (src0->sadb_address_proto != dst0->sadb_address_proto) { 8223 ipseclog((LOG_DEBUG, "%s: upper layer protocol " 8224 "mismatched.\n", __func__)); 8225 PFKEYSTAT_INC(out_invaddr); 8226 error = EINVAL; 8227 goto senderror; 8228 } 8229 8230 /* check family */ 8231 if (PFKEY_ADDR_SADDR(src0)->sa_family != 8232 PFKEY_ADDR_SADDR(dst0)->sa_family) { 8233 ipseclog((LOG_DEBUG, "%s: address family mismatched.\n", 8234 __func__)); 8235 PFKEYSTAT_INC(out_invaddr); 8236 error = EINVAL; 8237 goto senderror; 8238 } 8239 if (PFKEY_ADDR_SADDR(src0)->sa_len != 8240 PFKEY_ADDR_SADDR(dst0)->sa_len) { 8241 ipseclog((LOG_DEBUG, "%s: address struct size " 8242 "mismatched.\n", __func__)); 8243 PFKEYSTAT_INC(out_invaddr); 8244 error = EINVAL; 8245 goto senderror; 8246 } 8247 8248 switch (PFKEY_ADDR_SADDR(src0)->sa_family) { 8249 case AF_INET: 8250 if (PFKEY_ADDR_SADDR(src0)->sa_len != 8251 sizeof(struct sockaddr_in)) { 8252 PFKEYSTAT_INC(out_invaddr); 8253 error = EINVAL; 8254 goto senderror; 8255 } 8256 break; 8257 case AF_INET6: 8258 if (PFKEY_ADDR_SADDR(src0)->sa_len != 8259 sizeof(struct sockaddr_in6)) { 8260 PFKEYSTAT_INC(out_invaddr); 8261 error = EINVAL; 8262 goto senderror; 8263 } 8264 break; 8265 default: 8266 ipseclog((LOG_DEBUG, "%s: unsupported address family\n", 8267 __func__)); 8268 PFKEYSTAT_INC(out_invaddr); 8269 error = EAFNOSUPPORT; 8270 goto senderror; 8271 } 8272 8273 switch (PFKEY_ADDR_SADDR(src0)->sa_family) { 8274 case AF_INET: 8275 plen = sizeof(struct in_addr) << 3; 8276 break; 8277 case AF_INET6: 8278 plen = sizeof(struct in6_addr) << 3; 8279 break; 8280 default: 8281 plen = 0; /*fool gcc*/ 8282 break; 8283 } 8284 8285 /* check max prefix length */ 8286 if (src0->sadb_address_prefixlen > plen || 8287 dst0->sadb_address_prefixlen > plen) { 8288 ipseclog((LOG_DEBUG, "%s: illegal prefixlen.\n", 8289 __func__)); 8290 PFKEYSTAT_INC(out_invaddr); 8291 error = EINVAL; 8292 goto senderror; 8293 } 8294 8295 /* 8296 * prefixlen == 0 is valid because there can be a case when 8297 * all addresses are matched. 8298 */ 8299 } 8300 8301 if (msg->sadb_msg_type >= nitems(key_typesw) || 8302 key_typesw[msg->sadb_msg_type] == NULL) { 8303 PFKEYSTAT_INC(out_invmsgtype); 8304 error = EINVAL; 8305 goto senderror; 8306 } 8307 8308 return (*key_typesw[msg->sadb_msg_type])(so, m, &mh); 8309 8310 senderror: 8311 msg->sadb_msg_errno = error; 8312 return key_sendup_mbuf(so, m, target); 8313 } 8314 8315 static int 8316 key_senderror(struct socket *so, struct mbuf *m, int code) 8317 { 8318 struct sadb_msg *msg; 8319 8320 IPSEC_ASSERT(m->m_len >= sizeof(struct sadb_msg), 8321 ("mbuf too small, len %u", m->m_len)); 8322 8323 msg = mtod(m, struct sadb_msg *); 8324 msg->sadb_msg_errno = code; 8325 return key_sendup_mbuf(so, m, KEY_SENDUP_ONE); 8326 } 8327 8328 /* 8329 * set the pointer to each header into message buffer. 8330 * m will be freed on error. 8331 * XXX larger-than-MCLBYTES extension? 8332 */ 8333 static int 8334 key_align(struct mbuf *m, struct sadb_msghdr *mhp) 8335 { 8336 struct mbuf *n; 8337 struct sadb_ext *ext; 8338 size_t off, end; 8339 int extlen; 8340 int toff; 8341 8342 IPSEC_ASSERT(m != NULL, ("null mbuf")); 8343 IPSEC_ASSERT(mhp != NULL, ("null msghdr")); 8344 IPSEC_ASSERT(m->m_len >= sizeof(struct sadb_msg), 8345 ("mbuf too small, len %u", m->m_len)); 8346 8347 /* initialize */ 8348 bzero(mhp, sizeof(*mhp)); 8349 8350 mhp->msg = mtod(m, struct sadb_msg *); 8351 mhp->ext[0] = (struct sadb_ext *)mhp->msg; /*XXX backward compat */ 8352 8353 end = PFKEY_UNUNIT64(mhp->msg->sadb_msg_len); 8354 extlen = end; /*just in case extlen is not updated*/ 8355 for (off = sizeof(struct sadb_msg); off < end; off += extlen) { 8356 n = m_pulldown(m, off, sizeof(struct sadb_ext), &toff); 8357 if (!n) { 8358 /* m is already freed */ 8359 return ENOBUFS; 8360 } 8361 ext = (struct sadb_ext *)(mtod(n, caddr_t) + toff); 8362 8363 /* set pointer */ 8364 switch (ext->sadb_ext_type) { 8365 case SADB_EXT_SA: 8366 case SADB_EXT_ADDRESS_SRC: 8367 case SADB_EXT_ADDRESS_DST: 8368 case SADB_EXT_ADDRESS_PROXY: 8369 case SADB_EXT_LIFETIME_CURRENT: 8370 case SADB_EXT_LIFETIME_HARD: 8371 case SADB_EXT_LIFETIME_SOFT: 8372 case SADB_EXT_KEY_AUTH: 8373 case SADB_EXT_KEY_ENCRYPT: 8374 case SADB_EXT_IDENTITY_SRC: 8375 case SADB_EXT_IDENTITY_DST: 8376 case SADB_EXT_SENSITIVITY: 8377 case SADB_EXT_PROPOSAL: 8378 case SADB_EXT_SUPPORTED_AUTH: 8379 case SADB_EXT_SUPPORTED_ENCRYPT: 8380 case SADB_EXT_SPIRANGE: 8381 case SADB_X_EXT_POLICY: 8382 case SADB_X_EXT_SA2: 8383 case SADB_X_EXT_NAT_T_TYPE: 8384 case SADB_X_EXT_NAT_T_SPORT: 8385 case SADB_X_EXT_NAT_T_DPORT: 8386 case SADB_X_EXT_NAT_T_OAI: 8387 case SADB_X_EXT_NAT_T_OAR: 8388 case SADB_X_EXT_NAT_T_FRAG: 8389 case SADB_X_EXT_SA_REPLAY: 8390 case SADB_X_EXT_NEW_ADDRESS_SRC: 8391 case SADB_X_EXT_NEW_ADDRESS_DST: 8392 #ifdef IPSEC_OFFLOAD 8393 case SADB_X_EXT_LFT_CUR_SW_OFFL: 8394 case SADB_X_EXT_LFT_CUR_HW_OFFL: 8395 case SADB_X_EXT_IF_HW_OFFL: 8396 #endif 8397 /* duplicate check */ 8398 /* 8399 * XXX Are there duplication payloads of either 8400 * KEY_AUTH or KEY_ENCRYPT ? 8401 */ 8402 if (mhp->ext[ext->sadb_ext_type] != NULL) { 8403 ipseclog((LOG_DEBUG, "%s: duplicate ext_type " 8404 "%u\n", __func__, ext->sadb_ext_type)); 8405 m_freem(m); 8406 PFKEYSTAT_INC(out_dupext); 8407 return EINVAL; 8408 } 8409 break; 8410 default: 8411 ipseclog((LOG_DEBUG, "%s: invalid ext_type %u\n", 8412 __func__, ext->sadb_ext_type)); 8413 m_freem(m); 8414 PFKEYSTAT_INC(out_invexttype); 8415 return EINVAL; 8416 } 8417 8418 extlen = PFKEY_UNUNIT64(ext->sadb_ext_len); 8419 8420 if (key_validate_ext(ext, extlen)) { 8421 m_freem(m); 8422 PFKEYSTAT_INC(out_invlen); 8423 return EINVAL; 8424 } 8425 8426 n = m_pulldown(m, off, extlen, &toff); 8427 if (!n) { 8428 /* m is already freed */ 8429 return ENOBUFS; 8430 } 8431 ext = (struct sadb_ext *)(mtod(n, caddr_t) + toff); 8432 8433 mhp->ext[ext->sadb_ext_type] = ext; 8434 mhp->extoff[ext->sadb_ext_type] = off; 8435 mhp->extlen[ext->sadb_ext_type] = extlen; 8436 } 8437 8438 if (off != end) { 8439 m_freem(m); 8440 PFKEYSTAT_INC(out_invlen); 8441 return EINVAL; 8442 } 8443 8444 return 0; 8445 } 8446 8447 static int 8448 key_validate_ext(const struct sadb_ext *ext, int len) 8449 { 8450 const struct sockaddr *sa; 8451 enum { NONE, ADDR } checktype = NONE; 8452 int baselen = 0; 8453 const int sal = offsetof(struct sockaddr, sa_len) + sizeof(sa->sa_len); 8454 8455 if (len != PFKEY_UNUNIT64(ext->sadb_ext_len)) 8456 return EINVAL; 8457 8458 /* if it does not match minimum/maximum length, bail */ 8459 if (ext->sadb_ext_type >= nitems(minsize) || 8460 ext->sadb_ext_type >= nitems(maxsize)) 8461 return EINVAL; 8462 if (!minsize[ext->sadb_ext_type] || len < minsize[ext->sadb_ext_type]) 8463 return EINVAL; 8464 if (maxsize[ext->sadb_ext_type] && len > maxsize[ext->sadb_ext_type]) 8465 return EINVAL; 8466 8467 /* more checks based on sadb_ext_type XXX need more */ 8468 switch (ext->sadb_ext_type) { 8469 case SADB_EXT_ADDRESS_SRC: 8470 case SADB_EXT_ADDRESS_DST: 8471 case SADB_EXT_ADDRESS_PROXY: 8472 case SADB_X_EXT_NAT_T_OAI: 8473 case SADB_X_EXT_NAT_T_OAR: 8474 case SADB_X_EXT_NEW_ADDRESS_SRC: 8475 case SADB_X_EXT_NEW_ADDRESS_DST: 8476 baselen = PFKEY_ALIGN8(sizeof(struct sadb_address)); 8477 checktype = ADDR; 8478 break; 8479 case SADB_EXT_IDENTITY_SRC: 8480 case SADB_EXT_IDENTITY_DST: 8481 if (((const struct sadb_ident *)ext)->sadb_ident_type == 8482 SADB_X_IDENTTYPE_ADDR) { 8483 baselen = PFKEY_ALIGN8(sizeof(struct sadb_ident)); 8484 checktype = ADDR; 8485 } else 8486 checktype = NONE; 8487 break; 8488 default: 8489 checktype = NONE; 8490 break; 8491 } 8492 8493 switch (checktype) { 8494 case NONE: 8495 break; 8496 case ADDR: 8497 sa = (const struct sockaddr *)(((const u_int8_t*)ext)+baselen); 8498 if (len < baselen + sal) 8499 return EINVAL; 8500 if (baselen + PFKEY_ALIGN8(sa->sa_len) != len) 8501 return EINVAL; 8502 break; 8503 } 8504 8505 return 0; 8506 } 8507 8508 void 8509 spdcache_init(void) 8510 { 8511 int i; 8512 8513 TUNABLE_INT_FETCH("net.key.spdcache.maxentries", 8514 &V_key_spdcache_maxentries); 8515 TUNABLE_INT_FETCH("net.key.spdcache.threshold", 8516 &V_key_spdcache_threshold); 8517 8518 if (V_key_spdcache_maxentries) { 8519 V_key_spdcache_maxentries = MAX(V_key_spdcache_maxentries, 8520 SPDCACHE_MAX_ENTRIES_PER_HASH); 8521 V_spdcachehashtbl = hashinit(V_key_spdcache_maxentries / 8522 SPDCACHE_MAX_ENTRIES_PER_HASH, 8523 M_IPSEC_SPDCACHE, &V_spdcachehash_mask); 8524 V_key_spdcache_maxentries = (V_spdcachehash_mask + 1) 8525 * SPDCACHE_MAX_ENTRIES_PER_HASH; 8526 8527 V_spdcache_lock = malloc(sizeof(struct mtx) * 8528 (V_spdcachehash_mask + 1), 8529 M_IPSEC_SPDCACHE, M_WAITOK | M_ZERO); 8530 8531 for (i = 0; i < V_spdcachehash_mask + 1; ++i) 8532 SPDCACHE_LOCK_INIT(i); 8533 } 8534 } 8535 8536 struct spdcache_entry * 8537 spdcache_entry_alloc(const struct secpolicyindex *spidx, struct secpolicy *sp) 8538 { 8539 struct spdcache_entry *entry; 8540 8541 entry = malloc(sizeof(struct spdcache_entry), M_IPSEC_SPDCACHE, 8542 M_NOWAIT | M_ZERO); 8543 if (entry == NULL) 8544 return (NULL); 8545 8546 if (sp != NULL) 8547 SP_ADDREF(sp); 8548 8549 entry->spidx = *spidx; 8550 entry->sp = sp; 8551 8552 return (entry); 8553 } 8554 8555 void 8556 spdcache_entry_free(struct spdcache_entry *entry) 8557 { 8558 8559 if (entry->sp != NULL) 8560 key_freesp(&entry->sp); 8561 free(entry, M_IPSEC_SPDCACHE); 8562 } 8563 8564 void 8565 spdcache_clear(void) 8566 { 8567 struct spdcache_entry *entry; 8568 int i; 8569 8570 for (i = 0; i < V_spdcachehash_mask + 1; ++i) { 8571 SPDCACHE_LOCK(i); 8572 while (!LIST_EMPTY(&V_spdcachehashtbl[i])) { 8573 entry = LIST_FIRST(&V_spdcachehashtbl[i]); 8574 LIST_REMOVE(entry, chain); 8575 spdcache_entry_free(entry); 8576 } 8577 SPDCACHE_UNLOCK(i); 8578 } 8579 } 8580 8581 #ifdef VIMAGE 8582 void 8583 spdcache_destroy(void) 8584 { 8585 int i; 8586 8587 if (SPDCACHE_ENABLED()) { 8588 spdcache_clear(); 8589 hashdestroy(V_spdcachehashtbl, M_IPSEC_SPDCACHE, V_spdcachehash_mask); 8590 8591 for (i = 0; i < V_spdcachehash_mask + 1; ++i) 8592 SPDCACHE_LOCK_DESTROY(i); 8593 8594 free(V_spdcache_lock, M_IPSEC_SPDCACHE); 8595 } 8596 } 8597 #endif 8598 8599 static void 8600 key_vnet_init(void *arg __unused) 8601 { 8602 int i; 8603 8604 for (i = 0; i < IPSEC_DIR_MAX; i++) { 8605 TAILQ_INIT(&V_sptree[i]); 8606 TAILQ_INIT(&V_sptree_ifnet[i]); 8607 } 8608 8609 TAILQ_INIT(&V_sahtree); 8610 V_sphashtbl = hashinit(SPHASH_NHASH, M_IPSEC_SP, &V_sphash_mask); 8611 V_savhashtbl = hashinit(SAVHASH_NHASH, M_IPSEC_SA, &V_savhash_mask); 8612 V_sahaddrhashtbl = hashinit(SAHHASH_NHASH, M_IPSEC_SAH, 8613 &V_sahaddrhash_mask); 8614 V_acqaddrhashtbl = hashinit(ACQHASH_NHASH, M_IPSEC_SAQ, 8615 &V_acqaddrhash_mask); 8616 V_acqseqhashtbl = hashinit(ACQHASH_NHASH, M_IPSEC_SAQ, 8617 &V_acqseqhash_mask); 8618 8619 spdcache_init(); 8620 8621 for (i = 0; i <= SADB_SATYPE_MAX; i++) 8622 LIST_INIT(&V_regtree[i]); 8623 8624 LIST_INIT(&V_acqtree); 8625 LIST_INIT(&V_spacqtree); 8626 } 8627 VNET_SYSINIT(key_vnet_init, SI_SUB_PROTO_DOMAIN, SI_ORDER_SECOND, 8628 key_vnet_init, NULL); 8629 8630 static void 8631 key_init(void *arg __unused) 8632 { 8633 8634 ipsec_key_lft_zone = uma_zcreate("IPsec SA lft_c", 8635 sizeof(uint64_t) * 2, NULL, NULL, NULL, NULL, 8636 UMA_ALIGN_PTR, UMA_ZONE_PCPU); 8637 8638 SPTREE_LOCK_INIT(); 8639 REGTREE_LOCK_INIT(); 8640 SAHTREE_LOCK_INIT(); 8641 ACQ_LOCK_INIT(); 8642 SPACQ_LOCK_INIT(); 8643 SPI_ALLOC_LOCK_INIT(); 8644 8645 #ifndef IPSEC_DEBUG2 8646 callout_init(&key_timer, 1); 8647 callout_reset(&key_timer, hz, key_timehandler, NULL); 8648 #endif /*IPSEC_DEBUG2*/ 8649 8650 /* initialize key statistics */ 8651 keystat.getspi_count = 1; 8652 8653 if (bootverbose) 8654 printf("IPsec: Initialized Security Association Processing.\n"); 8655 } 8656 SYSINIT(key_init, SI_SUB_PROTO_DOMAIN, SI_ORDER_FIRST, key_init, NULL); 8657 8658 #ifdef VIMAGE 8659 static void 8660 key_vnet_destroy(void *arg __unused) 8661 { 8662 struct secashead_queue sahdrainq; 8663 struct secpolicy_queue drainq; 8664 struct secpolicy *sp, *nextsp; 8665 struct secacq *acq, *nextacq; 8666 struct secspacq *spacq, *nextspacq; 8667 struct secashead *sah; 8668 struct secasvar *sav; 8669 struct secreg *reg; 8670 int i; 8671 8672 /* 8673 * XXX: can we just call free() for each object without 8674 * walking through safe way with releasing references? 8675 */ 8676 TAILQ_INIT(&drainq); 8677 SPTREE_WLOCK(); 8678 for (i = 0; i < IPSEC_DIR_MAX; i++) { 8679 TAILQ_CONCAT(&drainq, &V_sptree[i], chain); 8680 TAILQ_CONCAT(&drainq, &V_sptree_ifnet[i], chain); 8681 } 8682 for (i = 0; i < V_sphash_mask + 1; i++) 8683 LIST_INIT(&V_sphashtbl[i]); 8684 SPTREE_WUNLOCK(); 8685 spdcache_destroy(); 8686 8687 sp = TAILQ_FIRST(&drainq); 8688 while (sp != NULL) { 8689 nextsp = TAILQ_NEXT(sp, chain); 8690 key_freesp(&sp); 8691 sp = nextsp; 8692 } 8693 8694 TAILQ_INIT(&sahdrainq); 8695 SAHTREE_WLOCK(); 8696 TAILQ_CONCAT(&sahdrainq, &V_sahtree, chain); 8697 for (i = 0; i < V_savhash_mask + 1; i++) 8698 LIST_INIT(&V_savhashtbl[i]); 8699 for (i = 0; i < V_sahaddrhash_mask + 1; i++) 8700 LIST_INIT(&V_sahaddrhashtbl[i]); 8701 TAILQ_FOREACH(sah, &sahdrainq, chain) { 8702 sah->state = SADB_SASTATE_DEAD; 8703 TAILQ_FOREACH(sav, &sah->savtree_larval, chain) { 8704 sav->state = SADB_SASTATE_DEAD; 8705 ipsec_accel_forget_sav(sav); 8706 } 8707 TAILQ_FOREACH(sav, &sah->savtree_alive, chain) { 8708 sav->state = SADB_SASTATE_DEAD; 8709 ipsec_accel_forget_sav(sav); 8710 } 8711 } 8712 SAHTREE_WUNLOCK(); 8713 8714 key_freesah_flushed(&sahdrainq); 8715 hashdestroy(V_sphashtbl, M_IPSEC_SP, V_sphash_mask); 8716 hashdestroy(V_savhashtbl, M_IPSEC_SA, V_savhash_mask); 8717 hashdestroy(V_sahaddrhashtbl, M_IPSEC_SAH, V_sahaddrhash_mask); 8718 8719 REGTREE_LOCK(); 8720 for (i = 0; i <= SADB_SATYPE_MAX; i++) { 8721 LIST_FOREACH(reg, &V_regtree[i], chain) { 8722 if (__LIST_CHAINED(reg)) { 8723 LIST_REMOVE(reg, chain); 8724 free(reg, M_IPSEC_SAR); 8725 break; 8726 } 8727 } 8728 } 8729 REGTREE_UNLOCK(); 8730 8731 ACQ_LOCK(); 8732 acq = LIST_FIRST(&V_acqtree); 8733 while (acq != NULL) { 8734 nextacq = LIST_NEXT(acq, chain); 8735 LIST_REMOVE(acq, chain); 8736 free(acq, M_IPSEC_SAQ); 8737 acq = nextacq; 8738 } 8739 for (i = 0; i < V_acqaddrhash_mask + 1; i++) 8740 LIST_INIT(&V_acqaddrhashtbl[i]); 8741 for (i = 0; i < V_acqseqhash_mask + 1; i++) 8742 LIST_INIT(&V_acqseqhashtbl[i]); 8743 ACQ_UNLOCK(); 8744 8745 SPACQ_LOCK(); 8746 for (spacq = LIST_FIRST(&V_spacqtree); spacq != NULL; 8747 spacq = nextspacq) { 8748 nextspacq = LIST_NEXT(spacq, chain); 8749 if (__LIST_CHAINED(spacq)) { 8750 LIST_REMOVE(spacq, chain); 8751 free(spacq, M_IPSEC_SAQ); 8752 } 8753 } 8754 SPACQ_UNLOCK(); 8755 hashdestroy(V_acqaddrhashtbl, M_IPSEC_SAQ, V_acqaddrhash_mask); 8756 hashdestroy(V_acqseqhashtbl, M_IPSEC_SAQ, V_acqseqhash_mask); 8757 } 8758 VNET_SYSUNINIT(key_vnet_destroy, SI_SUB_PROTO_DOMAIN, SI_ORDER_SECOND, 8759 key_vnet_destroy, NULL); 8760 #endif 8761 8762 /* 8763 * XXX: as long as domains are not unloadable, this function is never called, 8764 * provided for consistensy and future unload support. 8765 */ 8766 static void 8767 key_destroy(void *arg __unused) 8768 { 8769 uma_zdestroy(ipsec_key_lft_zone); 8770 8771 #ifndef IPSEC_DEBUG2 8772 callout_drain(&key_timer); 8773 #endif 8774 SPTREE_LOCK_DESTROY(); 8775 REGTREE_LOCK_DESTROY(); 8776 SAHTREE_LOCK_DESTROY(); 8777 ACQ_LOCK_DESTROY(); 8778 SPACQ_LOCK_DESTROY(); 8779 SPI_ALLOC_LOCK_DESTROY(); 8780 } 8781 SYSUNINIT(key_destroy, SI_SUB_PROTO_DOMAIN, SI_ORDER_FIRST, key_destroy, NULL); 8782 8783 /* record data transfer on SA, and update timestamps */ 8784 void 8785 key_sa_recordxfer(struct secasvar *sav, struct mbuf *m) 8786 { 8787 IPSEC_ASSERT(sav != NULL, ("Null secasvar")); 8788 IPSEC_ASSERT(m != NULL, ("Null mbuf")); 8789 8790 /* 8791 * XXX Currently, there is a difference of bytes size 8792 * between inbound and outbound processing. 8793 */ 8794 counter_u64_add(sav->lft_c_bytes, m->m_pkthdr.len); 8795 8796 /* 8797 * We use the number of packets as the unit of 8798 * allocations. We increment the variable 8799 * whenever {esp,ah}_{in,out}put is called. 8800 */ 8801 counter_u64_add(sav->lft_c_allocations, 1); 8802 8803 /* 8804 * NOTE: We record CURRENT usetime by using wall clock, 8805 * in seconds. HARD and SOFT lifetime are measured by the time 8806 * difference (again in seconds) from usetime. 8807 * 8808 * usetime 8809 * v expire expire 8810 * -----+-----+--------+---> t 8811 * <--------------> HARD 8812 * <-----> SOFT 8813 */ 8814 if (sav->firstused == 0) 8815 sav->firstused = time_second; 8816 } 8817 8818 /* 8819 * Take one of the kernel's security keys and convert it into a PF_KEY 8820 * structure within an mbuf, suitable for sending up to a waiting 8821 * application in user land. 8822 * 8823 * IN: 8824 * src: A pointer to a kernel security key. 8825 * exttype: Which type of key this is. Refer to the PF_KEY data structures. 8826 * OUT: 8827 * a valid mbuf or NULL indicating an error 8828 * 8829 */ 8830 8831 static struct mbuf * 8832 key_setkey(struct seckey *src, uint16_t exttype) 8833 { 8834 struct mbuf *m; 8835 struct sadb_key *p; 8836 int len; 8837 8838 if (src == NULL) 8839 return NULL; 8840 8841 len = PFKEY_ALIGN8(sizeof(struct sadb_key) + _KEYLEN(src)); 8842 m = m_get2(len, M_NOWAIT, MT_DATA, 0); 8843 if (m == NULL) 8844 return NULL; 8845 m_align(m, len); 8846 m->m_len = len; 8847 p = mtod(m, struct sadb_key *); 8848 bzero(p, len); 8849 p->sadb_key_len = PFKEY_UNIT64(len); 8850 p->sadb_key_exttype = exttype; 8851 p->sadb_key_bits = src->bits; 8852 bcopy(src->key_data, _KEYBUF(p), _KEYLEN(src)); 8853 8854 return m; 8855 } 8856 8857 #ifdef IPSEC_OFFLOAD 8858 struct mbuf * 8859 key_setaccelif(const char *ifname) 8860 { 8861 struct mbuf *m = NULL; 8862 struct sadb_x_if_hw_offl *p; 8863 int len = PFKEY_ALIGN8(sizeof(*p)); 8864 8865 m = m_get2(len, M_NOWAIT, MT_DATA, 0); 8866 if (m == NULL) 8867 return (m); 8868 m_align(m, len); 8869 m->m_len = len; 8870 p = mtod(m, struct sadb_x_if_hw_offl *); 8871 8872 bzero(p, len); 8873 p->sadb_x_if_hw_offl_len = PFKEY_UNIT64(len); 8874 p->sadb_x_if_hw_offl_exttype = SADB_X_EXT_IF_HW_OFFL; 8875 p->sadb_x_if_hw_offl_flags = 0; 8876 strncpy(p->sadb_x_if_hw_offl_if, ifname, 8877 sizeof(p->sadb_x_if_hw_offl_if)); 8878 8879 return (m); 8880 } 8881 #endif 8882 8883 /* 8884 * Take one of the kernel's lifetime data structures and convert it 8885 * into a PF_KEY structure within an mbuf, suitable for sending up to 8886 * a waiting application in user land. 8887 * 8888 * IN: 8889 * src: A pointer to a kernel lifetime structure. 8890 * exttype: Which type of lifetime this is. Refer to the PF_KEY 8891 * data structures for more information. 8892 * OUT: 8893 * a valid mbuf or NULL indicating an error 8894 * 8895 */ 8896 8897 static struct mbuf * 8898 key_setlifetime(struct seclifetime *src, uint16_t exttype) 8899 { 8900 struct mbuf *m = NULL; 8901 struct sadb_lifetime *p; 8902 int len = PFKEY_ALIGN8(sizeof(struct sadb_lifetime)); 8903 8904 if (src == NULL) 8905 return NULL; 8906 8907 m = m_get2(len, M_NOWAIT, MT_DATA, 0); 8908 if (m == NULL) 8909 return m; 8910 m_align(m, len); 8911 m->m_len = len; 8912 p = mtod(m, struct sadb_lifetime *); 8913 8914 bzero(p, len); 8915 p->sadb_lifetime_len = PFKEY_UNIT64(len); 8916 p->sadb_lifetime_exttype = exttype; 8917 p->sadb_lifetime_allocations = src->allocations; 8918 p->sadb_lifetime_bytes = src->bytes; 8919 p->sadb_lifetime_addtime = src->addtime; 8920 p->sadb_lifetime_usetime = src->usetime; 8921 8922 return m; 8923 8924 } 8925 8926 const struct enc_xform * 8927 enc_algorithm_lookup(int alg) 8928 { 8929 int i; 8930 8931 for (i = 0; i < nitems(supported_ealgs); i++) 8932 if (alg == supported_ealgs[i].sadb_alg) 8933 return (supported_ealgs[i].xform); 8934 return (NULL); 8935 } 8936 8937 const struct auth_hash * 8938 auth_algorithm_lookup(int alg) 8939 { 8940 int i; 8941 8942 for (i = 0; i < nitems(supported_aalgs); i++) 8943 if (alg == supported_aalgs[i].sadb_alg) 8944 return (supported_aalgs[i].xform); 8945 return (NULL); 8946 } 8947 8948 const struct comp_algo * 8949 comp_algorithm_lookup(int alg) 8950 { 8951 int i; 8952 8953 for (i = 0; i < nitems(supported_calgs); i++) 8954 if (alg == supported_calgs[i].sadb_alg) 8955 return (supported_calgs[i].xform); 8956 return (NULL); 8957 } 8958 8959 void 8960 ipsec_sahtree_runlock(struct rm_priotracker *sahtree_trackerp) 8961 { 8962 rm_runlock(&sahtree_lock, sahtree_trackerp); 8963 } 8964 8965 void 8966 ipsec_sahtree_rlock(struct rm_priotracker *sahtree_trackerp) 8967 { 8968 rm_rlock(&sahtree_lock, sahtree_trackerp); 8969 } 8970 8971 #ifdef IPSEC_OFFLOAD 8972 void 8973 ipsec_accel_on_ifdown(struct ifnet *ifp) 8974 { 8975 void (*p)(struct ifnet *ifp); 8976 8977 p = atomic_load_ptr(&ipsec_accel_on_ifdown_p); 8978 if (p != NULL) 8979 p(ifp); 8980 } 8981 8982 void 8983 ipsec_accel_drv_sa_lifetime_update(struct secasvar *sav, if_t ifp, 8984 u_int drv_spi, uint64_t octets, uint64_t allocs) 8985 { 8986 void (*p)(struct secasvar *sav, if_t ifp, u_int drv_spi, 8987 uint64_t octets, uint64_t allocs); 8988 8989 p = atomic_load_ptr(&ipsec_accel_drv_sa_lifetime_update_p); 8990 if (p != NULL) 8991 p(sav, ifp, drv_spi, octets, allocs); 8992 } 8993 #endif 8994