xref: /freebsd/sys/netipsec/keysock.c (revision 271c3a9060f2ee55607ebe146523f888e1db2654)
1 /*	$FreeBSD$	*/
2 /*	$KAME: keysock.c,v 1.25 2001/08/13 20:07:41 itojun Exp $	*/
3 
4 /*-
5  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
6  * All rights reserved.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  * 3. Neither the name of the project nor the names of its contributors
17  *    may be used to endorse or promote products derived from this software
18  *    without specific prior written permission.
19  *
20  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
21  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
24  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30  * SUCH DAMAGE.
31  */
32 
33 #include "opt_ipsec.h"
34 
35 /* This code has derived from sys/net/rtsock.c on FreeBSD2.2.5 */
36 
37 #include <sys/types.h>
38 #include <sys/param.h>
39 #include <sys/domain.h>
40 #include <sys/errno.h>
41 #include <sys/kernel.h>
42 #include <sys/lock.h>
43 #include <sys/malloc.h>
44 #include <sys/mbuf.h>
45 #include <sys/mutex.h>
46 #include <sys/priv.h>
47 #include <sys/protosw.h>
48 #include <sys/signalvar.h>
49 #include <sys/socket.h>
50 #include <sys/socketvar.h>
51 #include <sys/sysctl.h>
52 #include <sys/systm.h>
53 #include <sys/vimage.h>
54 
55 #include <net/raw_cb.h>
56 #include <net/route.h>
57 
58 #include <net/pfkeyv2.h>
59 #include <netipsec/key.h>
60 #include <netipsec/keysock.h>
61 #include <netipsec/key_debug.h>
62 
63 #include <machine/stdarg.h>
64 
65 struct key_cb {
66 	int key_count;
67 	int any_count;
68 };
69 static struct key_cb key_cb;
70 
71 static struct sockaddr key_src = { 2, PF_KEY, };
72 
73 static int key_sendup0 __P((struct rawcb *, struct mbuf *, int));
74 
75 struct pfkeystat pfkeystat;
76 
77 /*
78  * key_output()
79  */
80 int
81 key_output(struct mbuf *m, struct socket *so)
82 {
83 	struct sadb_msg *msg;
84 	int len, error = 0;
85 
86 	if (m == 0)
87 		panic("%s: NULL pointer was passed.\n", __func__);
88 
89 	V_pfkeystat.out_total++;
90 	V_pfkeystat.out_bytes += m->m_pkthdr.len;
91 
92 	len = m->m_pkthdr.len;
93 	if (len < sizeof(struct sadb_msg)) {
94 		V_pfkeystat.out_tooshort++;
95 		error = EINVAL;
96 		goto end;
97 	}
98 
99 	if (m->m_len < sizeof(struct sadb_msg)) {
100 		if ((m = m_pullup(m, sizeof(struct sadb_msg))) == 0) {
101 			V_pfkeystat.out_nomem++;
102 			error = ENOBUFS;
103 			goto end;
104 		}
105 	}
106 
107 	M_ASSERTPKTHDR(m);
108 
109 	KEYDEBUG(KEYDEBUG_KEY_DUMP, kdebug_mbuf(m));
110 
111 	msg = mtod(m, struct sadb_msg *);
112 	V_pfkeystat.out_msgtype[msg->sadb_msg_type]++;
113 	if (len != PFKEY_UNUNIT64(msg->sadb_msg_len)) {
114 		V_pfkeystat.out_invlen++;
115 		error = EINVAL;
116 		goto end;
117 	}
118 
119 	error = key_parse(m, so);
120 	m = NULL;
121 end:
122 	if (m)
123 		m_freem(m);
124 	return error;
125 }
126 
127 /*
128  * send message to the socket.
129  */
130 static int
131 key_sendup0(rp, m, promisc)
132 	struct rawcb *rp;
133 	struct mbuf *m;
134 	int promisc;
135 {
136 	int error;
137 
138 	if (promisc) {
139 		struct sadb_msg *pmsg;
140 
141 		M_PREPEND(m, sizeof(struct sadb_msg), M_DONTWAIT);
142 		if (m && m->m_len < sizeof(struct sadb_msg))
143 			m = m_pullup(m, sizeof(struct sadb_msg));
144 		if (!m) {
145 			V_pfkeystat.in_nomem++;
146 			m_freem(m);
147 			return ENOBUFS;
148 		}
149 		m->m_pkthdr.len += sizeof(*pmsg);
150 
151 		pmsg = mtod(m, struct sadb_msg *);
152 		bzero(pmsg, sizeof(*pmsg));
153 		pmsg->sadb_msg_version = PF_KEY_V2;
154 		pmsg->sadb_msg_type = SADB_X_PROMISC;
155 		pmsg->sadb_msg_len = PFKEY_UNIT64(m->m_pkthdr.len);
156 		/* pid and seq? */
157 
158 		V_pfkeystat.in_msgtype[pmsg->sadb_msg_type]++;
159 	}
160 
161 	if (!sbappendaddr(&rp->rcb_socket->so_rcv, (struct sockaddr *)&V_key_src,
162 	    m, NULL)) {
163 		V_pfkeystat.in_nomem++;
164 		m_freem(m);
165 		error = ENOBUFS;
166 	} else
167 		error = 0;
168 	sorwakeup(rp->rcb_socket);
169 	return error;
170 }
171 
172 /* XXX this interface should be obsoleted. */
173 int
174 key_sendup(so, msg, len, target)
175 	struct socket *so;
176 	struct sadb_msg *msg;
177 	u_int len;
178 	int target;	/*target of the resulting message*/
179 {
180 	struct mbuf *m, *n, *mprev;
181 	int tlen;
182 
183 	/* sanity check */
184 	if (so == 0 || msg == 0)
185 		panic("%s: NULL pointer was passed.\n", __func__);
186 
187 	KEYDEBUG(KEYDEBUG_KEY_DUMP,
188 		printf("%s: \n", __func__);
189 		kdebug_sadb(msg));
190 
191 	/*
192 	 * we increment statistics here, just in case we have ENOBUFS
193 	 * in this function.
194 	 */
195 	V_pfkeystat.in_total++;
196 	V_pfkeystat.in_bytes += len;
197 	V_pfkeystat.in_msgtype[msg->sadb_msg_type]++;
198 
199 	/*
200 	 * Get mbuf chain whenever possible (not clusters),
201 	 * to save socket buffer.  We'll be generating many SADB_ACQUIRE
202 	 * messages to listening key sockets.  If we simply allocate clusters,
203 	 * sbappendaddr() will raise ENOBUFS due to too little sbspace().
204 	 * sbspace() computes # of actual data bytes AND mbuf region.
205 	 *
206 	 * TODO: SADB_ACQUIRE filters should be implemented.
207 	 */
208 	tlen = len;
209 	m = mprev = NULL;
210 	while (tlen > 0) {
211 		if (tlen == len) {
212 			MGETHDR(n, M_DONTWAIT, MT_DATA);
213 			if (n == NULL) {
214 				V_pfkeystat.in_nomem++;
215 				return ENOBUFS;
216 			}
217 			n->m_len = MHLEN;
218 		} else {
219 			MGET(n, M_DONTWAIT, MT_DATA);
220 			if (n == NULL) {
221 				V_pfkeystat.in_nomem++;
222 				return ENOBUFS;
223 			}
224 			n->m_len = MLEN;
225 		}
226 		if (tlen >= MCLBYTES) {	/*XXX better threshold? */
227 			MCLGET(n, M_DONTWAIT);
228 			if ((n->m_flags & M_EXT) == 0) {
229 				m_free(n);
230 				m_freem(m);
231 				V_pfkeystat.in_nomem++;
232 				return ENOBUFS;
233 			}
234 			n->m_len = MCLBYTES;
235 		}
236 
237 		if (tlen < n->m_len)
238 			n->m_len = tlen;
239 		n->m_next = NULL;
240 		if (m == NULL)
241 			m = mprev = n;
242 		else {
243 			mprev->m_next = n;
244 			mprev = n;
245 		}
246 		tlen -= n->m_len;
247 		n = NULL;
248 	}
249 	m->m_pkthdr.len = len;
250 	m->m_pkthdr.rcvif = NULL;
251 	m_copyback(m, 0, len, (caddr_t)msg);
252 
253 	/* avoid duplicated statistics */
254 	V_pfkeystat.in_total--;
255 	V_pfkeystat.in_bytes -= len;
256 	V_pfkeystat.in_msgtype[msg->sadb_msg_type]--;
257 
258 	return key_sendup_mbuf(so, m, target);
259 }
260 
261 /* so can be NULL if target != KEY_SENDUP_ONE */
262 int
263 key_sendup_mbuf(so, m, target)
264 	struct socket *so;
265 	struct mbuf *m;
266 	int target;
267 {
268 	struct mbuf *n;
269 	struct keycb *kp;
270 	int sendup;
271 	struct rawcb *rp;
272 	int error = 0;
273 
274 	if (m == NULL)
275 		panic("key_sendup_mbuf: NULL pointer was passed.\n");
276 	if (so == NULL && target == KEY_SENDUP_ONE)
277 		panic("%s: NULL pointer was passed.\n", __func__);
278 
279 	V_pfkeystat.in_total++;
280 	V_pfkeystat.in_bytes += m->m_pkthdr.len;
281 	if (m->m_len < sizeof(struct sadb_msg)) {
282 		m = m_pullup(m, sizeof(struct sadb_msg));
283 		if (m == NULL) {
284 			V_pfkeystat.in_nomem++;
285 			return ENOBUFS;
286 		}
287 	}
288 	if (m->m_len >= sizeof(struct sadb_msg)) {
289 		struct sadb_msg *msg;
290 		msg = mtod(m, struct sadb_msg *);
291 		V_pfkeystat.in_msgtype[msg->sadb_msg_type]++;
292 	}
293 	mtx_lock(&rawcb_mtx);
294 	LIST_FOREACH(rp, &V_rawcb_list, list)
295 	{
296 		if (rp->rcb_proto.sp_family != PF_KEY)
297 			continue;
298 		if (rp->rcb_proto.sp_protocol
299 		 && rp->rcb_proto.sp_protocol != PF_KEY_V2) {
300 			continue;
301 		}
302 
303 		kp = (struct keycb *)rp;
304 
305 		/*
306 		 * If you are in promiscuous mode, and when you get broadcasted
307 		 * reply, you'll get two PF_KEY messages.
308 		 * (based on pf_key@inner.net message on 14 Oct 1998)
309 		 */
310 		if (((struct keycb *)rp)->kp_promisc) {
311 			if ((n = m_copy(m, 0, (int)M_COPYALL)) != NULL) {
312 				(void)key_sendup0(rp, n, 1);
313 				n = NULL;
314 			}
315 		}
316 
317 		/* the exact target will be processed later */
318 		if (so && sotorawcb(so) == rp)
319 			continue;
320 
321 		sendup = 0;
322 		switch (target) {
323 		case KEY_SENDUP_ONE:
324 			/* the statement has no effect */
325 			if (so && sotorawcb(so) == rp)
326 				sendup++;
327 			break;
328 		case KEY_SENDUP_ALL:
329 			sendup++;
330 			break;
331 		case KEY_SENDUP_REGISTERED:
332 			if (kp->kp_registered)
333 				sendup++;
334 			break;
335 		}
336 		V_pfkeystat.in_msgtarget[target]++;
337 
338 		if (!sendup)
339 			continue;
340 
341 		if ((n = m_copy(m, 0, (int)M_COPYALL)) == NULL) {
342 			m_freem(m);
343 			V_pfkeystat.in_nomem++;
344 			mtx_unlock(&rawcb_mtx);
345 			return ENOBUFS;
346 		}
347 
348 		if ((error = key_sendup0(rp, n, 0)) != 0) {
349 			m_freem(m);
350 			mtx_unlock(&rawcb_mtx);
351 			return error;
352 		}
353 
354 		n = NULL;
355 	}
356 
357 	if (so) {
358 		error = key_sendup0(sotorawcb(so), m, 0);
359 		m = NULL;
360 	} else {
361 		error = 0;
362 		m_freem(m);
363 	}
364 	mtx_unlock(&rawcb_mtx);
365 	return error;
366 }
367 
368 /*
369  * key_abort()
370  * derived from net/rtsock.c:rts_abort()
371  */
372 static void
373 key_abort(struct socket *so)
374 {
375 	raw_usrreqs.pru_abort(so);
376 }
377 
378 /*
379  * key_attach()
380  * derived from net/rtsock.c:rts_attach()
381  */
382 static int
383 key_attach(struct socket *so, int proto, struct thread *td)
384 {
385 	struct keycb *kp;
386 	int error;
387 
388 	KASSERT(so->so_pcb == NULL, ("key_attach: so_pcb != NULL"));
389 
390 	if (td != NULL) {
391 		error = priv_check(td, PRIV_NET_RAW);
392 		if (error)
393 			return error;
394 	}
395 
396 	/* XXX */
397 	MALLOC(kp, struct keycb *, sizeof *kp, M_PCB, M_WAITOK | M_ZERO);
398 	if (kp == 0)
399 		return ENOBUFS;
400 
401 	so->so_pcb = (caddr_t)kp;
402 	error = raw_attach(so, proto);
403 	kp = (struct keycb *)sotorawcb(so);
404 	if (error) {
405 		free(kp, M_PCB);
406 		so->so_pcb = (caddr_t) 0;
407 		return error;
408 	}
409 
410 	kp->kp_promisc = kp->kp_registered = 0;
411 
412 	if (kp->kp_raw.rcb_proto.sp_protocol == PF_KEY) /* XXX: AF_KEY */
413 		V_key_cb.key_count++;
414 	V_key_cb.any_count++;
415 	soisconnected(so);
416 	so->so_options |= SO_USELOOPBACK;
417 
418 	return 0;
419 }
420 
421 /*
422  * key_bind()
423  * derived from net/rtsock.c:rts_bind()
424  */
425 static int
426 key_bind(struct socket *so, struct sockaddr *nam, struct thread *td)
427 {
428   return EINVAL;
429 }
430 
431 /*
432  * key_close()
433  * derived from net/rtsock.c:rts_close().
434  */
435 static void
436 key_close(struct socket *so)
437 {
438 
439 	raw_usrreqs.pru_close(so);
440 }
441 
442 /*
443  * key_connect()
444  * derived from net/rtsock.c:rts_connect()
445  */
446 static int
447 key_connect(struct socket *so, struct sockaddr *nam, struct thread *td)
448 {
449 	return EINVAL;
450 }
451 
452 /*
453  * key_detach()
454  * derived from net/rtsock.c:rts_detach()
455  */
456 static void
457 key_detach(struct socket *so)
458 {
459 	struct keycb *kp = (struct keycb *)sotorawcb(so);
460 
461 	KASSERT(kp != NULL, ("key_detach: kp == NULL"));
462 	if (kp->kp_raw.rcb_proto.sp_protocol
463 	    == PF_KEY) /* XXX: AF_KEY */
464 		V_key_cb.key_count--;
465 	V_key_cb.any_count--;
466 
467 	key_freereg(so);
468 	raw_usrreqs.pru_detach(so);
469 }
470 
471 /*
472  * key_disconnect()
473  * derived from net/rtsock.c:key_disconnect()
474  */
475 static int
476 key_disconnect(struct socket *so)
477 {
478 	return(raw_usrreqs.pru_disconnect(so));
479 }
480 
481 /*
482  * key_peeraddr()
483  * derived from net/rtsock.c:rts_peeraddr()
484  */
485 static int
486 key_peeraddr(struct socket *so, struct sockaddr **nam)
487 {
488 	return(raw_usrreqs.pru_peeraddr(so, nam));
489 }
490 
491 /*
492  * key_send()
493  * derived from net/rtsock.c:rts_send()
494  */
495 static int
496 key_send(struct socket *so, int flags, struct mbuf *m, struct sockaddr *nam,
497 	 struct mbuf *control, struct thread *td)
498 {
499 	return(raw_usrreqs.pru_send(so, flags, m, nam, control, td));
500 }
501 
502 /*
503  * key_shutdown()
504  * derived from net/rtsock.c:rts_shutdown()
505  */
506 static int
507 key_shutdown(struct socket *so)
508 {
509 	return(raw_usrreqs.pru_shutdown(so));
510 }
511 
512 /*
513  * key_sockaddr()
514  * derived from net/rtsock.c:rts_sockaddr()
515  */
516 static int
517 key_sockaddr(struct socket *so, struct sockaddr **nam)
518 {
519 	return(raw_usrreqs.pru_sockaddr(so, nam));
520 }
521 
522 struct pr_usrreqs key_usrreqs = {
523 	.pru_abort =		key_abort,
524 	.pru_attach =		key_attach,
525 	.pru_bind =		key_bind,
526 	.pru_connect =		key_connect,
527 	.pru_detach =		key_detach,
528 	.pru_disconnect =	key_disconnect,
529 	.pru_peeraddr =		key_peeraddr,
530 	.pru_send =		key_send,
531 	.pru_shutdown =		key_shutdown,
532 	.pru_sockaddr =		key_sockaddr,
533 	.pru_close =		key_close,
534 };
535 
536 /* sysctl */
537 SYSCTL_NODE(_net, PF_KEY, key, CTLFLAG_RW, 0, "Key Family");
538 
539 /*
540  * Definitions of protocols supported in the KEY domain.
541  */
542 
543 extern struct domain keydomain;
544 
545 struct protosw keysw[] = {
546 {
547 	.pr_type =		SOCK_RAW,
548 	.pr_domain =		&keydomain,
549 	.pr_protocol =		PF_KEY_V2,
550 	.pr_flags =		PR_ATOMIC|PR_ADDR,
551 	.pr_output =		key_output,
552 	.pr_ctlinput =		raw_ctlinput,
553 	.pr_init =		raw_init,
554 	.pr_usrreqs =		&key_usrreqs
555 }
556 };
557 
558 static void
559 key_init0(void)
560 {
561 	bzero((caddr_t)&V_key_cb, sizeof(V_key_cb));
562 	key_init();
563 }
564 
565 struct domain keydomain = {
566 	.dom_family =		PF_KEY,
567 	.dom_name =		"key",
568 	.dom_init =		key_init0,
569 	.dom_protosw =		keysw,
570 	.dom_protoswNPROTOSW =	&keysw[sizeof(keysw)/sizeof(keysw[0])]
571 };
572 
573 DOMAIN_SET(key);
574