xref: /freebsd/sys/netipsec/keysock.c (revision d8a0fe102c0cfdfcd5b818f850eff09d8536c9bc)
1 /*	$FreeBSD$	*/
2 /*	$KAME: keysock.c,v 1.25 2001/08/13 20:07:41 itojun Exp $	*/
3 
4 /*-
5  * SPDX-License-Identifier: BSD-3-Clause
6  *
7  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
8  * All rights reserved.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  * 1. Redistributions of source code must retain the above copyright
14  *    notice, this list of conditions and the following disclaimer.
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in the
17  *    documentation and/or other materials provided with the distribution.
18  * 3. Neither the name of the project nor the names of its contributors
19  *    may be used to endorse or promote products derived from this software
20  *    without specific prior written permission.
21  *
22  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
23  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
24  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
25  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
26  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
27  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
28  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
29  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
30  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
31  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
32  * SUCH DAMAGE.
33  */
34 
35 #include "opt_ipsec.h"
36 
37 /* This code has derived from sys/net/rtsock.c on FreeBSD2.2.5 */
38 
39 #include <sys/types.h>
40 #include <sys/param.h>
41 #include <sys/domain.h>
42 #include <sys/errno.h>
43 #include <sys/kernel.h>
44 #include <sys/lock.h>
45 #include <sys/malloc.h>
46 #include <sys/mbuf.h>
47 #include <sys/mutex.h>
48 #include <sys/priv.h>
49 #include <sys/protosw.h>
50 #include <sys/signalvar.h>
51 #include <sys/socket.h>
52 #include <sys/socketvar.h>
53 #include <sys/sysctl.h>
54 #include <sys/systm.h>
55 
56 #include <net/if.h>
57 #include <net/vnet.h>
58 #include <net/raw_cb.h>
59 
60 #include <netinet/in.h>
61 
62 #include <net/pfkeyv2.h>
63 #include <netipsec/key.h>
64 #include <netipsec/keysock.h>
65 #include <netipsec/key_debug.h>
66 #include <netipsec/ipsec.h>
67 
68 #include <machine/stdarg.h>
69 
70 struct key_cb {
71 	int key_count;
72 	int any_count;
73 };
74 static VNET_DEFINE(struct key_cb, key_cb);
75 #define	V_key_cb		VNET(key_cb)
76 
77 static struct sockaddr key_src = { 2, PF_KEY, };
78 
79 static int key_sendup0(struct rawcb *, struct mbuf *, int);
80 
81 VNET_PCPUSTAT_DEFINE(struct pfkeystat, pfkeystat);
82 VNET_PCPUSTAT_SYSINIT(pfkeystat);
83 
84 #ifdef VIMAGE
85 VNET_PCPUSTAT_SYSUNINIT(pfkeystat);
86 #endif /* VIMAGE */
87 
88 /*
89  * key_output()
90  */
91 int
92 key_output(struct mbuf *m, struct socket *so, ...)
93 {
94 	struct sadb_msg *msg;
95 	int len, error = 0;
96 
97 	if (m == NULL)
98 		panic("%s: NULL pointer was passed.\n", __func__);
99 
100 	PFKEYSTAT_INC(out_total);
101 	PFKEYSTAT_ADD(out_bytes, m->m_pkthdr.len);
102 
103 	len = m->m_pkthdr.len;
104 	if (len < sizeof(struct sadb_msg)) {
105 		PFKEYSTAT_INC(out_tooshort);
106 		error = EINVAL;
107 		goto end;
108 	}
109 
110 	if (m->m_len < sizeof(struct sadb_msg)) {
111 		if ((m = m_pullup(m, sizeof(struct sadb_msg))) == NULL) {
112 			PFKEYSTAT_INC(out_nomem);
113 			error = ENOBUFS;
114 			goto end;
115 		}
116 	}
117 
118 	M_ASSERTPKTHDR(m);
119 
120 	KEYDBG(KEY_DUMP, kdebug_mbuf(m));
121 
122 	msg = mtod(m, struct sadb_msg *);
123 	PFKEYSTAT_INC(out_msgtype[msg->sadb_msg_type]);
124 	if (len != PFKEY_UNUNIT64(msg->sadb_msg_len)) {
125 		PFKEYSTAT_INC(out_invlen);
126 		error = EINVAL;
127 		goto end;
128 	}
129 
130 	error = key_parse(m, so);
131 	m = NULL;
132 end:
133 	if (m)
134 		m_freem(m);
135 	return error;
136 }
137 
138 /*
139  * send message to the socket.
140  */
141 static int
142 key_sendup0(struct rawcb *rp, struct mbuf *m, int promisc)
143 {
144 	int error;
145 
146 	if (promisc) {
147 		struct sadb_msg *pmsg;
148 
149 		M_PREPEND(m, sizeof(struct sadb_msg), M_NOWAIT);
150 		if (m == NULL) {
151 			PFKEYSTAT_INC(in_nomem);
152 			return (ENOBUFS);
153 		}
154 		pmsg = mtod(m, struct sadb_msg *);
155 		bzero(pmsg, sizeof(*pmsg));
156 		pmsg->sadb_msg_version = PF_KEY_V2;
157 		pmsg->sadb_msg_type = SADB_X_PROMISC;
158 		pmsg->sadb_msg_len = PFKEY_UNIT64(m->m_pkthdr.len);
159 		/* pid and seq? */
160 
161 		PFKEYSTAT_INC(in_msgtype[pmsg->sadb_msg_type]);
162 	}
163 
164 	if (!sbappendaddr(&rp->rcb_socket->so_rcv, (struct sockaddr *)&key_src,
165 	    m, NULL)) {
166 		PFKEYSTAT_INC(in_nomem);
167 		m_freem(m);
168 		error = ENOBUFS;
169 	} else
170 		error = 0;
171 	sorwakeup(rp->rcb_socket);
172 	return error;
173 }
174 
175 /* XXX this interface should be obsoleted. */
176 int
177 key_sendup(struct socket *so, struct sadb_msg *msg, u_int len, int target)
178 {
179 	struct mbuf *m, *n, *mprev;
180 	int tlen;
181 
182 	/* sanity check */
183 	if (so == NULL || msg == NULL)
184 		panic("%s: NULL pointer was passed.\n", __func__);
185 
186 	KEYDBG(KEY_DUMP,
187 	    printf("%s: \n", __func__);
188 	    kdebug_sadb(msg));
189 
190 	/*
191 	 * we increment statistics here, just in case we have ENOBUFS
192 	 * in this function.
193 	 */
194 	PFKEYSTAT_INC(in_total);
195 	PFKEYSTAT_ADD(in_bytes, len);
196 	PFKEYSTAT_INC(in_msgtype[msg->sadb_msg_type]);
197 
198 	/*
199 	 * Get mbuf chain whenever possible (not clusters),
200 	 * to save socket buffer.  We'll be generating many SADB_ACQUIRE
201 	 * messages to listening key sockets.  If we simply allocate clusters,
202 	 * sbappendaddr() will raise ENOBUFS due to too little sbspace().
203 	 * sbspace() computes # of actual data bytes AND mbuf region.
204 	 *
205 	 * TODO: SADB_ACQUIRE filters should be implemented.
206 	 */
207 	tlen = len;
208 	m = mprev = NULL;
209 	while (tlen > 0) {
210 		if (tlen == len) {
211 			MGETHDR(n, M_NOWAIT, MT_DATA);
212 			if (n == NULL) {
213 				PFKEYSTAT_INC(in_nomem);
214 				return ENOBUFS;
215 			}
216 			n->m_len = MHLEN;
217 		} else {
218 			MGET(n, M_NOWAIT, MT_DATA);
219 			if (n == NULL) {
220 				PFKEYSTAT_INC(in_nomem);
221 				return ENOBUFS;
222 			}
223 			n->m_len = MLEN;
224 		}
225 		if (tlen >= MCLBYTES) {	/*XXX better threshold? */
226 			if (!(MCLGET(n, M_NOWAIT))) {
227 				m_free(n);
228 				m_freem(m);
229 				PFKEYSTAT_INC(in_nomem);
230 				return ENOBUFS;
231 			}
232 			n->m_len = MCLBYTES;
233 		}
234 
235 		if (tlen < n->m_len)
236 			n->m_len = tlen;
237 		n->m_next = NULL;
238 		if (m == NULL)
239 			m = mprev = n;
240 		else {
241 			mprev->m_next = n;
242 			mprev = n;
243 		}
244 		tlen -= n->m_len;
245 		n = NULL;
246 	}
247 	m->m_pkthdr.len = len;
248 	m->m_pkthdr.rcvif = NULL;
249 	m_copyback(m, 0, len, (caddr_t)msg);
250 
251 	/* avoid duplicated statistics */
252 	PFKEYSTAT_ADD(in_total, -1);
253 	PFKEYSTAT_ADD(in_bytes, -len);
254 	PFKEYSTAT_ADD(in_msgtype[msg->sadb_msg_type], -1);
255 
256 	return key_sendup_mbuf(so, m, target);
257 }
258 
259 /* so can be NULL if target != KEY_SENDUP_ONE */
260 int
261 key_sendup_mbuf(struct socket *so, struct mbuf *m, int target)
262 {
263 	struct mbuf *n;
264 	struct keycb *kp;
265 	int sendup;
266 	struct rawcb *rp;
267 	int error = 0;
268 
269 	if (m == NULL)
270 		panic("key_sendup_mbuf: NULL pointer was passed.\n");
271 	if (so == NULL && target == KEY_SENDUP_ONE)
272 		panic("%s: NULL pointer was passed.\n", __func__);
273 
274 	PFKEYSTAT_INC(in_total);
275 	PFKEYSTAT_ADD(in_bytes, m->m_pkthdr.len);
276 	if (m->m_len < sizeof(struct sadb_msg)) {
277 		m = m_pullup(m, sizeof(struct sadb_msg));
278 		if (m == NULL) {
279 			PFKEYSTAT_INC(in_nomem);
280 			return ENOBUFS;
281 		}
282 	}
283 	if (m->m_len >= sizeof(struct sadb_msg)) {
284 		struct sadb_msg *msg;
285 		msg = mtod(m, struct sadb_msg *);
286 		PFKEYSTAT_INC(in_msgtype[msg->sadb_msg_type]);
287 	}
288 	mtx_lock(&rawcb_mtx);
289 	LIST_FOREACH(rp, &V_rawcb_list, list)
290 	{
291 		if (rp->rcb_proto.sp_family != PF_KEY)
292 			continue;
293 		if (rp->rcb_proto.sp_protocol
294 		 && rp->rcb_proto.sp_protocol != PF_KEY_V2) {
295 			continue;
296 		}
297 
298 		kp = (struct keycb *)rp;
299 
300 		/*
301 		 * If you are in promiscuous mode, and when you get broadcasted
302 		 * reply, you'll get two PF_KEY messages.
303 		 * (based on pf_key@inner.net message on 14 Oct 1998)
304 		 */
305 		if (((struct keycb *)rp)->kp_promisc) {
306 			if ((n = m_copym(m, 0, M_COPYALL, M_NOWAIT)) != NULL) {
307 				(void)key_sendup0(rp, n, 1);
308 				n = NULL;
309 			}
310 		}
311 
312 		/* the exact target will be processed later */
313 		if (so && sotorawcb(so) == rp)
314 			continue;
315 
316 		sendup = 0;
317 		switch (target) {
318 		case KEY_SENDUP_ONE:
319 			/* the statement has no effect */
320 			if (so && sotorawcb(so) == rp)
321 				sendup++;
322 			break;
323 		case KEY_SENDUP_ALL:
324 			sendup++;
325 			break;
326 		case KEY_SENDUP_REGISTERED:
327 			if (kp->kp_registered)
328 				sendup++;
329 			break;
330 		}
331 		PFKEYSTAT_INC(in_msgtarget[target]);
332 
333 		if (!sendup)
334 			continue;
335 
336 		if ((n = m_copym(m, 0, M_COPYALL, M_NOWAIT)) == NULL) {
337 			m_freem(m);
338 			PFKEYSTAT_INC(in_nomem);
339 			mtx_unlock(&rawcb_mtx);
340 			return ENOBUFS;
341 		}
342 
343 		if ((error = key_sendup0(rp, n, 0)) != 0) {
344 			m_freem(m);
345 			mtx_unlock(&rawcb_mtx);
346 			return error;
347 		}
348 
349 		n = NULL;
350 	}
351 
352 	if (so) {
353 		error = key_sendup0(sotorawcb(so), m, 0);
354 		m = NULL;
355 	} else {
356 		error = 0;
357 		m_freem(m);
358 	}
359 	mtx_unlock(&rawcb_mtx);
360 	return error;
361 }
362 
363 /*
364  * key_abort()
365  * derived from net/rtsock.c:rts_abort()
366  */
367 static void
368 key_abort(struct socket *so)
369 {
370 	raw_usrreqs.pru_abort(so);
371 }
372 
373 /*
374  * key_attach()
375  * derived from net/rtsock.c:rts_attach()
376  */
377 static int
378 key_attach(struct socket *so, int proto, struct thread *td)
379 {
380 	struct keycb *kp;
381 	int error;
382 
383 	KASSERT(so->so_pcb == NULL, ("key_attach: so_pcb != NULL"));
384 
385 	if (td != NULL) {
386 		error = priv_check(td, PRIV_NET_RAW);
387 		if (error)
388 			return error;
389 	}
390 
391 	/* XXX */
392 	kp = malloc(sizeof *kp, M_PCB, M_WAITOK | M_ZERO);
393 	if (kp == NULL)
394 		return ENOBUFS;
395 
396 	so->so_pcb = (caddr_t)kp;
397 	error = raw_attach(so, proto);
398 	kp = (struct keycb *)sotorawcb(so);
399 	if (error) {
400 		free(kp, M_PCB);
401 		so->so_pcb = (caddr_t) 0;
402 		return error;
403 	}
404 
405 	kp->kp_promisc = kp->kp_registered = 0;
406 
407 	if (kp->kp_raw.rcb_proto.sp_protocol == PF_KEY) /* XXX: AF_KEY */
408 		V_key_cb.key_count++;
409 	V_key_cb.any_count++;
410 	soisconnected(so);
411 	so->so_options |= SO_USELOOPBACK;
412 
413 	return 0;
414 }
415 
416 /*
417  * key_bind()
418  * derived from net/rtsock.c:rts_bind()
419  */
420 static int
421 key_bind(struct socket *so, struct sockaddr *nam, struct thread *td)
422 {
423   return EINVAL;
424 }
425 
426 /*
427  * key_close()
428  * derived from net/rtsock.c:rts_close().
429  */
430 static void
431 key_close(struct socket *so)
432 {
433 
434 	raw_usrreqs.pru_close(so);
435 }
436 
437 /*
438  * key_connect()
439  * derived from net/rtsock.c:rts_connect()
440  */
441 static int
442 key_connect(struct socket *so, struct sockaddr *nam, struct thread *td)
443 {
444 	return EINVAL;
445 }
446 
447 /*
448  * key_detach()
449  * derived from net/rtsock.c:rts_detach()
450  */
451 static void
452 key_detach(struct socket *so)
453 {
454 	struct keycb *kp = (struct keycb *)sotorawcb(so);
455 
456 	KASSERT(kp != NULL, ("key_detach: kp == NULL"));
457 	if (kp->kp_raw.rcb_proto.sp_protocol
458 	    == PF_KEY) /* XXX: AF_KEY */
459 		V_key_cb.key_count--;
460 	V_key_cb.any_count--;
461 
462 	key_freereg(so);
463 	raw_usrreqs.pru_detach(so);
464 }
465 
466 /*
467  * key_disconnect()
468  * derived from net/rtsock.c:key_disconnect()
469  */
470 static int
471 key_disconnect(struct socket *so)
472 {
473 	return(raw_usrreqs.pru_disconnect(so));
474 }
475 
476 /*
477  * key_peeraddr()
478  * derived from net/rtsock.c:rts_peeraddr()
479  */
480 static int
481 key_peeraddr(struct socket *so, struct sockaddr **nam)
482 {
483 	return(raw_usrreqs.pru_peeraddr(so, nam));
484 }
485 
486 /*
487  * key_send()
488  * derived from net/rtsock.c:rts_send()
489  */
490 static int
491 key_send(struct socket *so, int flags, struct mbuf *m, struct sockaddr *nam,
492 	 struct mbuf *control, struct thread *td)
493 {
494 	return(raw_usrreqs.pru_send(so, flags, m, nam, control, td));
495 }
496 
497 /*
498  * key_shutdown()
499  * derived from net/rtsock.c:rts_shutdown()
500  */
501 static int
502 key_shutdown(struct socket *so)
503 {
504 	return(raw_usrreqs.pru_shutdown(so));
505 }
506 
507 /*
508  * key_sockaddr()
509  * derived from net/rtsock.c:rts_sockaddr()
510  */
511 static int
512 key_sockaddr(struct socket *so, struct sockaddr **nam)
513 {
514 	return(raw_usrreqs.pru_sockaddr(so, nam));
515 }
516 
517 struct pr_usrreqs key_usrreqs = {
518 	.pru_abort =		key_abort,
519 	.pru_attach =		key_attach,
520 	.pru_bind =		key_bind,
521 	.pru_connect =		key_connect,
522 	.pru_detach =		key_detach,
523 	.pru_disconnect =	key_disconnect,
524 	.pru_peeraddr =		key_peeraddr,
525 	.pru_send =		key_send,
526 	.pru_shutdown =		key_shutdown,
527 	.pru_sockaddr =		key_sockaddr,
528 	.pru_close =		key_close,
529 };
530 
531 /* sysctl */
532 SYSCTL_NODE(_net, PF_KEY, key, CTLFLAG_RW, 0, "Key Family");
533 
534 /*
535  * Definitions of protocols supported in the KEY domain.
536  */
537 
538 extern struct domain keydomain;
539 
540 struct protosw keysw[] = {
541 {
542 	.pr_type =		SOCK_RAW,
543 	.pr_domain =		&keydomain,
544 	.pr_protocol =		PF_KEY_V2,
545 	.pr_flags =		PR_ATOMIC|PR_ADDR,
546 	.pr_output =		key_output,
547 	.pr_ctlinput =		raw_ctlinput,
548 	.pr_init =		raw_init,
549 	.pr_usrreqs =		&key_usrreqs
550 }
551 };
552 
553 static void
554 key_init0(void)
555 {
556 
557 	bzero((caddr_t)&V_key_cb, sizeof(V_key_cb));
558 	key_init();
559 }
560 
561 struct domain keydomain = {
562 	.dom_family =		PF_KEY,
563 	.dom_name =		"key",
564 	.dom_init =		key_init0,
565 #ifdef VIMAGE
566 	.dom_destroy =		key_destroy,
567 #endif
568 	.dom_protosw =		keysw,
569 	.dom_protoswNPROTOSW =	&keysw[nitems(keysw)]
570 };
571 
572 VNET_DOMAIN_SET(key);
573