1 /* $NetBSD: key.c,v 1.285 2024/09/02 18:56:20 andvar Exp $ */
2 /* $FreeBSD: key.c,v 1.3.2.3 2004/02/14 22:23:23 bms Exp $ */
3 /* $KAME: key.c,v 1.191 2001/06/27 10:46:49 sakane Exp $ */
4
5 /*
6 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
7 * All rights reserved.
8 *
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted provided that the following conditions
11 * are met:
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 * 2. Redistributions in binary form must reproduce the above copyright
15 * notice, this list of conditions and the following disclaimer in the
16 * documentation and/or other materials provided with the distribution.
17 * 3. Neither the name of the project nor the names of its contributors
18 * may be used to endorse or promote products derived from this software
19 * without specific prior written permission.
20 *
21 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31 * SUCH DAMAGE.
32 */
33
34 #include <sys/cdefs.h>
35 __KERNEL_RCSID(0, "$NetBSD: key.c,v 1.285 2024/09/02 18:56:20 andvar Exp $");
36
37 /*
38 * This code is referred to RFC 2367
39 */
40
41 #if defined(_KERNEL_OPT)
42 #include "opt_inet.h"
43 #include "opt_ipsec.h"
44 #include "opt_gateway.h"
45 #include "opt_net_mpsafe.h"
46 #endif
47
48 #include <sys/types.h>
49 #include <sys/param.h>
50 #include <sys/systm.h>
51 #include <sys/callout.h>
52 #include <sys/kernel.h>
53 #include <sys/mbuf.h>
54 #include <sys/domain.h>
55 #include <sys/socket.h>
56 #include <sys/socketvar.h>
57 #include <sys/sysctl.h>
58 #include <sys/errno.h>
59 #include <sys/proc.h>
60 #include <sys/queue.h>
61 #include <sys/syslog.h>
62 #include <sys/once.h>
63 #include <sys/cprng.h>
64 #include <sys/psref.h>
65 #include <sys/lwp.h>
66 #include <sys/workqueue.h>
67 #include <sys/kmem.h>
68 #include <sys/cpu.h>
69 #include <sys/atomic.h>
70 #include <sys/pslist.h>
71 #include <sys/mutex.h>
72 #include <sys/condvar.h>
73 #include <sys/localcount.h>
74 #include <sys/pserialize.h>
75 #include <sys/hash.h>
76 #include <sys/xcall.h>
77
78 #include <net/if.h>
79 #include <net/route.h>
80
81 #include <netinet/in.h>
82 #include <netinet/in_systm.h>
83 #include <netinet/ip.h>
84 #include <netinet/in_var.h>
85 #ifdef INET
86 #include <netinet/ip_var.h>
87 #endif
88
89 #ifdef INET6
90 #include <netinet/ip6.h>
91 #include <netinet6/in6_var.h>
92 #include <netinet6/ip6_var.h>
93 #endif /* INET6 */
94
95 #ifdef INET
96 #include <netinet/in_pcb.h>
97 #endif
98 #ifdef INET6
99 #include <netinet6/in6_pcb.h>
100 #endif /* INET6 */
101
102 #include <net/pfkeyv2.h>
103 #include <netipsec/keydb.h>
104 #include <netipsec/key.h>
105 #include <netipsec/keysock.h>
106 #include <netipsec/key_debug.h>
107
108 #include <netipsec/ipsec.h>
109 #ifdef INET6
110 #include <netipsec/ipsec6.h>
111 #endif
112 #include <netipsec/ipsec_private.h>
113
114 #include <netipsec/xform.h>
115 #include <netipsec/ipcomp.h>
116
117 #define FULLMASK 0xffu
118 #define _BITS(bytes) ((bytes) << 3)
119
120 #define PORT_NONE 0
121 #define PORT_LOOSE 1
122 #define PORT_STRICT 2
123
124 #ifndef SAHHASH_NHASH
125 #define SAHHASH_NHASH 128
126 #endif
127
128 #ifndef SAVLUT_NHASH
129 #define SAVLUT_NHASH 128
130 #endif
131
132 percpu_t *pfkeystat_percpu;
133
134 /*
135 * Note on SA reference counting:
136 * - SAs that are not in DEAD state will have (total external reference + 1)
137 * following value in reference count field. they cannot be freed and are
138 * referenced from SA header.
139 * - SAs that are in DEAD state will have (total external reference)
140 * in reference count field. they are ready to be freed. reference from
141 * SA header will be removed in key_delsav(), when the reference count
142 * field hits 0 (= no external reference other than from SA header.
143 */
144
145 u_int32_t key_debug_level = 0;
146 static u_int key_spi_trycnt = 1000;
147 static u_int32_t key_spi_minval = 0x100;
148 static u_int32_t key_spi_maxval = 0x0fffffff; /* XXX */
149 static u_int32_t policy_id = 0;
150 static u_int key_int_random = 60; /*interval to initialize randseed,1(m)*/
151 static u_int key_larval_lifetime = 30; /* interval to expire acquiring, 30(s)*/
152 static int key_blockacq_count = 10; /* counter for blocking SADB_ACQUIRE.*/
153 static int key_blockacq_lifetime = 20; /* lifetime for blocking SADB_ACQUIRE.*/
154 static int key_prefered_oldsa = 0; /* prefered old sa rather than new sa.*/
155
156 static u_int32_t acq_seq = 0;
157
158 /*
159 * Locking order: there is no order for now; it means that any locks aren't
160 * overlapped.
161 */
162 /*
163 * Locking notes on SPD:
164 * - Modifications to the key_spd.splist must be done with holding key_spd.lock
165 * which is a adaptive mutex
166 * - Read accesses to the key_spd.splist must be in pserialize(9) read sections
167 * - SP's lifetime is managed by localcount(9)
168 * - An SP that has been inserted to the key_spd.splist is initially referenced
169 * by none, i.e., a reference from the key_spd.splist isn't counted
170 * - When an SP is being destroyed, we change its state as DEAD, wait for
171 * references to the SP to be released, and then deallocate the SP
172 * (see key_unlink_sp)
173 * - Getting an SP
174 * - Normally we get an SP from the key_spd.splist (see key_lookup_sp_byspidx)
175 * - Must iterate the list and increment the reference count of a found SP
176 * (by key_sp_ref) in a pserialize read section
177 * - We can gain another reference from a held SP only if we check its state
178 * and take its reference in a pserialize read section
179 * (see esp_output for example)
180 * - We may get an SP from an SP cache. See below
181 * - A gotten SP must be released after use by KEY_SP_UNREF (key_sp_unref)
182 * - Updating member variables of an SP
183 * - Most member variables of an SP are immutable
184 * - Only sp->state and sp->lastused can be changed
185 * - sp->state of an SP is updated only when destroying it under key_spd.lock
186 * - SP caches
187 * - SPs can be cached in PCBs
188 * - The lifetime of the caches is controlled by the global generation counter
189 * (ipsec_spdgen)
190 * - The global counter value is stored when an SP is cached
191 * - If the stored value is different from the global counter then the cache
192 * is considered invalidated
193 * - The counter is incremented when an SP is being destroyed
194 * - So checking the generation and taking a reference to an SP should be
195 * in a pserialize read section
196 * - Note that caching doesn't increment the reference counter of an SP
197 * - SPs in sockets
198 * - Userland programs can set a policy to a socket by
199 * setsockopt(IP_IPSEC_POLICY)
200 * - Such policies (SPs) are set to a socket (PCB) and also inserted to
201 * the key_spd.socksplist list (not the key_spd.splist)
202 * - Such a policy is destroyed when a corresponding socket is destroed,
203 * however, a socket can be destroyed in softint so we cannot destroy
204 * it directly instead we just mark it DEAD and delay the destruction
205 * until GC by the timer
206 * - SP origin
207 * - SPs can be created by both userland programs and kernel components.
208 * The SPs created in kernel must not be removed by userland programs,
209 * although the SPs can be read by userland programs.
210 */
211 /*
212 * Locking notes on SAD:
213 * - Data structures
214 * - SAs are managed by the list called key_sad.sahlists and sav lists of
215 * sah entries
216 * - An sav is supposed to be an SA from a viewpoint of users
217 * - A sah has sav lists for each SA state
218 * - Multiple saves with the same saidx can exist
219 * - Only one entry has MATURE state and others should be DEAD
220 * - DEAD entries are just ignored from searching
221 * - All sav whose state is MATURE or DYING are registered to the lookup
222 * table called key_sad.savlut in addition to the savlists.
223 * - The table is used to search an sav without use of saidx.
224 * - Modifications to the key_sad.sahlists, sah.savlist and key_sad.savlut
225 * must be done with holding key_sad.lock which is a adaptive mutex
226 * - Read accesses to the key_sad.sahlists, sah.savlist and key_sad.savlut
227 * must be in pserialize(9) read sections
228 * - sah's lifetime is managed by localcount(9)
229 * - Getting an sah entry
230 * - We get an sah from the key_sad.sahlists
231 * - Must iterate the list and increment the reference count of a found sah
232 * (by key_sah_ref) in a pserialize read section
233 * - A gotten sah must be released after use by key_sah_unref
234 * - An sah is destroyed when its state become DEAD and no sav is
235 * listed to the sah
236 * - The destruction is done only in the timer (see key_timehandler_sad)
237 * - sav's lifetime is managed by localcount(9)
238 * - Getting an sav entry
239 * - First get an sah by saidx and get an sav from either of sah's savlists
240 * - Must iterate the list and increment the reference count of a found sav
241 * (by key_sa_ref) in a pserialize read section
242 * - We can gain another reference from a held SA only if we check its state
243 * and take its reference in a pserialize read section
244 * (see esp_output for example)
245 * - A gotten sav must be released after use by key_sa_unref
246 * - An sav is destroyed when its state become DEAD
247 */
248 /*
249 * Locking notes on misc data:
250 * - All lists of key_misc are protected by key_misc.lock
251 * - key_misc.lock must be held even for read accesses
252 */
253
254 /* SPD */
255 static struct {
256 kmutex_t lock;
257 kcondvar_t cv_lc;
258 struct pslist_head splist[IPSEC_DIR_MAX];
259 /*
260 * The list has SPs that are set to a socket via
261 * setsockopt(IP_IPSEC_POLICY) from userland. See ipsec_set_policy.
262 */
263 struct pslist_head socksplist;
264
265 pserialize_t psz;
266 kcondvar_t cv_psz;
267 bool psz_performing;
268 } key_spd __cacheline_aligned;
269
270 /* SAD */
271 static struct {
272 kmutex_t lock;
273 kcondvar_t cv_lc;
274 struct pslist_head *sahlists;
275 u_long sahlistmask;
276 struct pslist_head *savlut;
277 u_long savlutmask;
278
279 pserialize_t psz;
280 kcondvar_t cv_psz;
281 bool psz_performing;
282 } key_sad __cacheline_aligned;
283
284 /* Misc data */
285 static struct {
286 kmutex_t lock;
287 /* registed list */
288 LIST_HEAD(_reglist, secreg) reglist[SADB_SATYPE_MAX + 1];
289 #ifndef IPSEC_NONBLOCK_ACQUIRE
290 /* acquiring list */
291 LIST_HEAD(_acqlist, secacq) acqlist;
292 #endif
293 #ifdef notyet
294 /* SP acquiring list */
295 LIST_HEAD(_spacqlist, secspacq) spacqlist;
296 #endif
297 } key_misc __cacheline_aligned;
298
299 /* Macros for key_spd.splist */
300 #define SPLIST_ENTRY_INIT(sp) \
301 PSLIST_ENTRY_INIT((sp), pslist_entry)
302 #define SPLIST_ENTRY_DESTROY(sp) \
303 PSLIST_ENTRY_DESTROY((sp), pslist_entry)
304 #define SPLIST_WRITER_REMOVE(sp) \
305 PSLIST_WRITER_REMOVE((sp), pslist_entry)
306 #define SPLIST_READER_EMPTY(dir) \
307 (PSLIST_READER_FIRST(&key_spd.splist[(dir)], struct secpolicy, \
308 pslist_entry) == NULL)
309 #define SPLIST_READER_FOREACH(sp, dir) \
310 PSLIST_READER_FOREACH((sp), &key_spd.splist[(dir)], \
311 struct secpolicy, pslist_entry)
312 #define SPLIST_WRITER_FOREACH(sp, dir) \
313 PSLIST_WRITER_FOREACH((sp), &key_spd.splist[(dir)], \
314 struct secpolicy, pslist_entry)
315 #define SPLIST_WRITER_INSERT_AFTER(sp, new) \
316 PSLIST_WRITER_INSERT_AFTER((sp), (new), pslist_entry)
317 #define SPLIST_WRITER_EMPTY(dir) \
318 (PSLIST_WRITER_FIRST(&key_spd.splist[(dir)], struct secpolicy, \
319 pslist_entry) == NULL)
320 #define SPLIST_WRITER_INSERT_HEAD(dir, sp) \
321 PSLIST_WRITER_INSERT_HEAD(&key_spd.splist[(dir)], (sp), \
322 pslist_entry)
323 #define SPLIST_WRITER_NEXT(sp) \
324 PSLIST_WRITER_NEXT((sp), struct secpolicy, pslist_entry)
325 #define SPLIST_WRITER_INSERT_TAIL(dir, new) \
326 do { \
327 if (SPLIST_WRITER_EMPTY((dir))) { \
328 SPLIST_WRITER_INSERT_HEAD((dir), (new)); \
329 } else { \
330 struct secpolicy *__sp; \
331 SPLIST_WRITER_FOREACH(__sp, (dir)) { \
332 if (SPLIST_WRITER_NEXT(__sp) == NULL) { \
333 SPLIST_WRITER_INSERT_AFTER(__sp,\
334 (new)); \
335 break; \
336 } \
337 } \
338 } \
339 } while (0)
340
341 /* Macros for key_spd.socksplist */
342 #define SOCKSPLIST_WRITER_FOREACH(sp) \
343 PSLIST_WRITER_FOREACH((sp), &key_spd.socksplist, \
344 struct secpolicy, pslist_entry)
345 #define SOCKSPLIST_READER_EMPTY() \
346 (PSLIST_READER_FIRST(&key_spd.socksplist, struct secpolicy, \
347 pslist_entry) == NULL)
348
349 /* Macros for key_sad.sahlist */
350 #define SAHLIST_ENTRY_INIT(sah) \
351 PSLIST_ENTRY_INIT((sah), pslist_entry)
352 #define SAHLIST_ENTRY_DESTROY(sah) \
353 PSLIST_ENTRY_DESTROY((sah), pslist_entry)
354 #define SAHLIST_WRITER_REMOVE(sah) \
355 PSLIST_WRITER_REMOVE((sah), pslist_entry)
356 #define SAHLIST_READER_FOREACH(sah) \
357 for(int _i_sah = 0; _i_sah <= key_sad.sahlistmask; _i_sah++) \
358 PSLIST_READER_FOREACH((sah), &key_sad.sahlists[_i_sah], \
359 struct secashead, pslist_entry)
360 #define SAHLIST_READER_FOREACH_SAIDX(sah, saidx) \
361 PSLIST_READER_FOREACH((sah), \
362 &key_sad.sahlists[key_saidxhash((saidx), \
363 key_sad.sahlistmask)], \
364 struct secashead, pslist_entry)
365 #define SAHLIST_WRITER_FOREACH(sah) \
366 for(int _i_sah = 0; _i_sah <= key_sad.sahlistmask; _i_sah++) \
367 PSLIST_WRITER_FOREACH((sah), &key_sad.sahlists[_i_sah], \
368 struct secashead, pslist_entry)
369 #define SAHLIST_WRITER_INSERT_HEAD(sah) \
370 PSLIST_WRITER_INSERT_HEAD( \
371 &key_sad.sahlists[key_saidxhash(&(sah)->saidx, \
372 key_sad.sahlistmask)], \
373 (sah), pslist_entry)
374
375 /* Macros for key_sad.sahlist#savlist */
376 #define SAVLIST_ENTRY_INIT(sav) \
377 PSLIST_ENTRY_INIT((sav), pslist_entry)
378 #define SAVLIST_ENTRY_DESTROY(sav) \
379 PSLIST_ENTRY_DESTROY((sav), pslist_entry)
380 #define SAVLIST_READER_FIRST(sah, state) \
381 PSLIST_READER_FIRST(&(sah)->savlist[(state)], struct secasvar, \
382 pslist_entry)
383 #define SAVLIST_WRITER_REMOVE(sav) \
384 PSLIST_WRITER_REMOVE((sav), pslist_entry)
385 #define SAVLIST_READER_FOREACH(sav, sah, state) \
386 PSLIST_READER_FOREACH((sav), &(sah)->savlist[(state)], \
387 struct secasvar, pslist_entry)
388 #define SAVLIST_WRITER_FOREACH(sav, sah, state) \
389 PSLIST_WRITER_FOREACH((sav), &(sah)->savlist[(state)], \
390 struct secasvar, pslist_entry)
391 #define SAVLIST_WRITER_INSERT_BEFORE(sav, new) \
392 PSLIST_WRITER_INSERT_BEFORE((sav), (new), pslist_entry)
393 #define SAVLIST_WRITER_INSERT_AFTER(sav, new) \
394 PSLIST_WRITER_INSERT_AFTER((sav), (new), pslist_entry)
395 #define SAVLIST_WRITER_EMPTY(sah, state) \
396 (PSLIST_WRITER_FIRST(&(sah)->savlist[(state)], struct secasvar, \
397 pslist_entry) == NULL)
398 #define SAVLIST_WRITER_INSERT_HEAD(sah, state, sav) \
399 PSLIST_WRITER_INSERT_HEAD(&(sah)->savlist[(state)], (sav), \
400 pslist_entry)
401 #define SAVLIST_WRITER_NEXT(sav) \
402 PSLIST_WRITER_NEXT((sav), struct secasvar, pslist_entry)
403 #define SAVLIST_WRITER_INSERT_TAIL(sah, state, new) \
404 do { \
405 if (SAVLIST_WRITER_EMPTY((sah), (state))) { \
406 SAVLIST_WRITER_INSERT_HEAD((sah), (state), (new));\
407 } else { \
408 struct secasvar *__sav; \
409 SAVLIST_WRITER_FOREACH(__sav, (sah), (state)) { \
410 if (SAVLIST_WRITER_NEXT(__sav) == NULL) {\
411 SAVLIST_WRITER_INSERT_AFTER(__sav,\
412 (new)); \
413 break; \
414 } \
415 } \
416 } \
417 } while (0)
418 #define SAVLIST_READER_NEXT(sav) \
419 PSLIST_READER_NEXT((sav), struct secasvar, pslist_entry)
420
421 /* Macros for key_sad.savlut */
422 #define SAVLUT_ENTRY_INIT(sav) \
423 PSLIST_ENTRY_INIT((sav), pslist_entry_savlut)
424 #define SAVLUT_READER_FOREACH(sav, dst, proto, hash_key) \
425 PSLIST_READER_FOREACH((sav), \
426 &key_sad.savlut[key_savluthash(dst, proto, hash_key, \
427 key_sad.savlutmask)], \
428 struct secasvar, pslist_entry_savlut)
429 #define SAVLUT_WRITER_INSERT_HEAD(sav) \
430 key_savlut_writer_insert_head((sav))
431 #define SAVLUT_WRITER_REMOVE(sav) \
432 do { \
433 if (!(sav)->savlut_added) \
434 break; \
435 PSLIST_WRITER_REMOVE((sav), pslist_entry_savlut); \
436 (sav)->savlut_added = false; \
437 } while(0)
438
439 /* search order for SAs */
440 /*
441 * This order is important because we must select the oldest SA
442 * for outbound processing. For inbound, This is not important.
443 */
444 static const u_int saorder_state_valid_prefer_old[] = {
445 SADB_SASTATE_DYING, SADB_SASTATE_MATURE,
446 };
447 static const u_int saorder_state_valid_prefer_new[] = {
448 SADB_SASTATE_MATURE, SADB_SASTATE_DYING,
449 };
450
451 static const u_int saorder_state_alive[] = {
452 /* except DEAD */
453 SADB_SASTATE_MATURE, SADB_SASTATE_DYING, SADB_SASTATE_LARVAL
454 };
455 static const u_int saorder_state_any[] = {
456 SADB_SASTATE_MATURE, SADB_SASTATE_DYING,
457 SADB_SASTATE_LARVAL, SADB_SASTATE_DEAD
458 };
459
460 #define SASTATE_ALIVE_FOREACH(s) \
461 for (int _i = 0; \
462 _i < __arraycount(saorder_state_alive) ? \
463 (s) = saorder_state_alive[_i], true : false; \
464 _i++)
465 #define SASTATE_ANY_FOREACH(s) \
466 for (int _i = 0; \
467 _i < __arraycount(saorder_state_any) ? \
468 (s) = saorder_state_any[_i], true : false; \
469 _i++)
470 #define SASTATE_USABLE_FOREACH(s) \
471 for (int _i = 0; \
472 _i < __arraycount(saorder_state_valid_prefer_new) ? \
473 (s) = saorder_state_valid_prefer_new[_i], \
474 true : false; \
475 _i++)
476
477 static const int minsize[] = {
478 sizeof(struct sadb_msg), /* SADB_EXT_RESERVED */
479 sizeof(struct sadb_sa), /* SADB_EXT_SA */
480 sizeof(struct sadb_lifetime), /* SADB_EXT_LIFETIME_CURRENT */
481 sizeof(struct sadb_lifetime), /* SADB_EXT_LIFETIME_HARD */
482 sizeof(struct sadb_lifetime), /* SADB_EXT_LIFETIME_SOFT */
483 sizeof(struct sadb_address), /* SADB_EXT_ADDRESS_SRC */
484 sizeof(struct sadb_address), /* SADB_EXT_ADDRESS_DST */
485 sizeof(struct sadb_address), /* SADB_EXT_ADDRESS_PROXY */
486 sizeof(struct sadb_key), /* SADB_EXT_KEY_AUTH */
487 sizeof(struct sadb_key), /* SADB_EXT_KEY_ENCRYPT */
488 sizeof(struct sadb_ident), /* SADB_EXT_IDENTITY_SRC */
489 sizeof(struct sadb_ident), /* SADB_EXT_IDENTITY_DST */
490 sizeof(struct sadb_sens), /* SADB_EXT_SENSITIVITY */
491 sizeof(struct sadb_prop), /* SADB_EXT_PROPOSAL */
492 sizeof(struct sadb_supported), /* SADB_EXT_SUPPORTED_AUTH */
493 sizeof(struct sadb_supported), /* SADB_EXT_SUPPORTED_ENCRYPT */
494 sizeof(struct sadb_spirange), /* SADB_EXT_SPIRANGE */
495 0, /* SADB_X_EXT_KMPRIVATE */
496 sizeof(struct sadb_x_policy), /* SADB_X_EXT_POLICY */
497 sizeof(struct sadb_x_sa2), /* SADB_X_SA2 */
498 sizeof(struct sadb_x_nat_t_type), /* SADB_X_EXT_NAT_T_TYPE */
499 sizeof(struct sadb_x_nat_t_port), /* SADB_X_EXT_NAT_T_SPORT */
500 sizeof(struct sadb_x_nat_t_port), /* SADB_X_EXT_NAT_T_DPORT */
501 sizeof(struct sadb_address), /* SADB_X_EXT_NAT_T_OAI */
502 sizeof(struct sadb_address), /* SADB_X_EXT_NAT_T_OAR */
503 sizeof(struct sadb_x_nat_t_frag), /* SADB_X_EXT_NAT_T_FRAG */
504 };
505 static const int maxsize[] = {
506 sizeof(struct sadb_msg), /* SADB_EXT_RESERVED */
507 sizeof(struct sadb_sa), /* SADB_EXT_SA */
508 sizeof(struct sadb_lifetime), /* SADB_EXT_LIFETIME_CURRENT */
509 sizeof(struct sadb_lifetime), /* SADB_EXT_LIFETIME_HARD */
510 sizeof(struct sadb_lifetime), /* SADB_EXT_LIFETIME_SOFT */
511 0, /* SADB_EXT_ADDRESS_SRC */
512 0, /* SADB_EXT_ADDRESS_DST */
513 0, /* SADB_EXT_ADDRESS_PROXY */
514 0, /* SADB_EXT_KEY_AUTH */
515 0, /* SADB_EXT_KEY_ENCRYPT */
516 0, /* SADB_EXT_IDENTITY_SRC */
517 0, /* SADB_EXT_IDENTITY_DST */
518 0, /* SADB_EXT_SENSITIVITY */
519 0, /* SADB_EXT_PROPOSAL */
520 0, /* SADB_EXT_SUPPORTED_AUTH */
521 0, /* SADB_EXT_SUPPORTED_ENCRYPT */
522 sizeof(struct sadb_spirange), /* SADB_EXT_SPIRANGE */
523 0, /* SADB_X_EXT_KMPRIVATE */
524 0, /* SADB_X_EXT_POLICY */
525 sizeof(struct sadb_x_sa2), /* SADB_X_SA2 */
526 sizeof(struct sadb_x_nat_t_type), /* SADB_X_EXT_NAT_T_TYPE */
527 sizeof(struct sadb_x_nat_t_port), /* SADB_X_EXT_NAT_T_SPORT */
528 sizeof(struct sadb_x_nat_t_port), /* SADB_X_EXT_NAT_T_DPORT */
529 0, /* SADB_X_EXT_NAT_T_OAI */
530 0, /* SADB_X_EXT_NAT_T_OAR */
531 sizeof(struct sadb_x_nat_t_frag), /* SADB_X_EXT_NAT_T_FRAG */
532 };
533
534 static int ipsec_esp_keymin = 256;
535 static int ipsec_esp_auth = 0;
536 static int ipsec_ah_keymin = 128;
537 static bool ipsec_allow_different_idtype = false;
538
539 #ifdef SYSCTL_DECL
540 SYSCTL_DECL(_net_key);
541 #endif
542
543 #ifdef SYSCTL_INT
544 SYSCTL_INT(_net_key, KEYCTL_DEBUG_LEVEL, debug, CTLFLAG_RW, \
545 &key_debug_level, 0, "");
546
547 /* max count of trial for the decision of spi value */
548 SYSCTL_INT(_net_key, KEYCTL_SPI_TRY, spi_trycnt, CTLFLAG_RW, \
549 &key_spi_trycnt, 0, "");
550
551 /* minimum spi value to allocate automatically. */
552 SYSCTL_INT(_net_key, KEYCTL_SPI_MIN_VALUE, spi_minval, CTLFLAG_RW, \
553 &key_spi_minval, 0, "");
554
555 /* maximun spi value to allocate automatically. */
556 SYSCTL_INT(_net_key, KEYCTL_SPI_MAX_VALUE, spi_maxval, CTLFLAG_RW, \
557 &key_spi_maxval, 0, "");
558
559 /* interval to initialize randseed */
560 SYSCTL_INT(_net_key, KEYCTL_RANDOM_INT, int_random, CTLFLAG_RW, \
561 &key_int_random, 0, "");
562
563 /* lifetime for larval SA */
564 SYSCTL_INT(_net_key, KEYCTL_LARVAL_LIFETIME, larval_lifetime, CTLFLAG_RW, \
565 &key_larval_lifetime, 0, "");
566
567 /* counter for blocking to send SADB_ACQUIRE to IKEd */
568 SYSCTL_INT(_net_key, KEYCTL_BLOCKACQ_COUNT, blockacq_count, CTLFLAG_RW, \
569 &key_blockacq_count, 0, "");
570
571 /* lifetime for blocking to send SADB_ACQUIRE to IKEd */
572 SYSCTL_INT(_net_key, KEYCTL_BLOCKACQ_LIFETIME, blockacq_lifetime, CTLFLAG_RW, \
573 &key_blockacq_lifetime, 0, "");
574
575 /* ESP auth */
576 SYSCTL_INT(_net_key, KEYCTL_ESP_AUTH, esp_auth, CTLFLAG_RW, \
577 &ipsec_esp_auth, 0, "");
578
579 /* minimum ESP key length */
580 SYSCTL_INT(_net_key, KEYCTL_ESP_KEYMIN, esp_keymin, CTLFLAG_RW, \
581 &ipsec_esp_keymin, 0, "");
582
583 /* minimum AH key length */
584 SYSCTL_INT(_net_key, KEYCTL_AH_KEYMIN, ah_keymin, CTLFLAG_RW, \
585 &ipsec_ah_keymin, 0, "");
586
587 /* perfered old SA rather than new SA */
588 SYSCTL_INT(_net_key, KEYCTL_PREFERED_OLDSA, prefered_oldsa, CTLFLAG_RW,\
589 &key_prefered_oldsa, 0, "");
590 #endif /* SYSCTL_INT */
591
592 #define __LIST_CHAINED(elm) \
593 (!((elm)->chain.le_next == NULL && (elm)->chain.le_prev == NULL))
594 #define LIST_INSERT_TAIL(head, elm, type, field) \
595 do {\
596 struct type *curelm = LIST_FIRST(head); \
597 if (curelm == NULL) {\
598 LIST_INSERT_HEAD(head, elm, field); \
599 } else { \
600 while (LIST_NEXT(curelm, field)) \
601 curelm = LIST_NEXT(curelm, field);\
602 LIST_INSERT_AFTER(curelm, elm, field);\
603 }\
604 } while (0)
605
606 #define KEY_CHKSASTATE(head, sav) \
607 /* do */ { \
608 if ((head) != (sav)) { \
609 IPSECLOG(LOG_DEBUG, \
610 "state mismatched (TREE=%d SA=%d)\n", \
611 (head), (sav)); \
612 continue; \
613 } \
614 } /* while (0) */
615
616 #define KEY_CHKSPDIR(head, sp) \
617 do { \
618 if ((head) != (sp)) { \
619 IPSECLOG(LOG_DEBUG, \
620 "direction mismatched (TREE=%d SP=%d), anyway continue.\n",\
621 (head), (sp)); \
622 } \
623 } while (0)
624
625 /*
626 * set parameters into secasindex buffer.
627 * Must allocate secasindex buffer before calling this function.
628 */
629 static int
630 key_setsecasidx(int, int, int, const struct sockaddr *,
631 const struct sockaddr *, struct secasindex *);
632
633 /* key statistics */
634 struct _keystat {
635 u_long getspi_count; /* the avarage of count to try to get new SPI */
636 } keystat;
637
638 static void
639 key_init_spidx_bymsghdr(struct secpolicyindex *, const struct sadb_msghdr *);
640
641 static const struct sockaddr *
key_msghdr_get_sockaddr(const struct sadb_msghdr * mhp,int idx)642 key_msghdr_get_sockaddr(const struct sadb_msghdr *mhp, int idx)
643 {
644
645 return PFKEY_ADDR_SADDR(mhp->ext[idx]);
646 }
647
648 static void
key_fill_replymsg(struct mbuf * m,int seq)649 key_fill_replymsg(struct mbuf *m, int seq)
650 {
651 struct sadb_msg *msg;
652
653 KASSERT(m->m_len >= sizeof(*msg));
654
655 msg = mtod(m, struct sadb_msg *);
656 msg->sadb_msg_errno = 0;
657 msg->sadb_msg_len = PFKEY_UNIT64(m->m_pkthdr.len);
658 if (seq != 0)
659 msg->sadb_msg_seq = seq;
660 }
661
662 #if 0
663 static void key_freeso(struct socket *);
664 static void key_freesp_so(struct secpolicy **);
665 #endif
666 static struct secpolicy *key_getsp (const struct secpolicyindex *);
667 static struct secpolicy *key_getspbyid (u_int32_t);
668 static struct secpolicy *key_lookup_and_remove_sp(const struct secpolicyindex *, bool);
669 static struct secpolicy *key_lookupbyid_and_remove_sp(u_int32_t, bool);
670 static void key_destroy_sp(struct secpolicy *);
671 static struct mbuf *key_gather_mbuf (struct mbuf *,
672 const struct sadb_msghdr *, int, int, ...);
673 static int key_api_spdadd(struct socket *, struct mbuf *,
674 const struct sadb_msghdr *);
675 static u_int32_t key_getnewspid (void);
676 static int key_api_spddelete(struct socket *, struct mbuf *,
677 const struct sadb_msghdr *);
678 static int key_api_spddelete2(struct socket *, struct mbuf *,
679 const struct sadb_msghdr *);
680 static int key_api_spdget(struct socket *, struct mbuf *,
681 const struct sadb_msghdr *);
682 static int key_api_spdflush(struct socket *, struct mbuf *,
683 const struct sadb_msghdr *);
684 static int key_api_spddump(struct socket *, struct mbuf *,
685 const struct sadb_msghdr *);
686 static struct mbuf * key_setspddump (int *errorp, pid_t);
687 static struct mbuf * key_setspddump_chain (int *errorp, int *lenp, pid_t pid);
688 static int key_api_nat_map(struct socket *, struct mbuf *,
689 const struct sadb_msghdr *);
690 static struct mbuf *key_setdumpsp (struct secpolicy *,
691 u_int8_t, u_int32_t, pid_t);
692 static u_int key_getspreqmsglen (const struct secpolicy *);
693 static int key_spdexpire (struct secpolicy *);
694 static struct secashead *key_newsah (const struct secasindex *);
695 static void key_unlink_sah(struct secashead *);
696 static void key_destroy_sah(struct secashead *);
697 static bool key_sah_has_sav(struct secashead *);
698 static void key_sah_ref(struct secashead *);
699 static void key_sah_unref(struct secashead *);
700 static void key_init_sav(struct secasvar *);
701 static void key_wait_sav(struct secasvar *);
702 static void key_destroy_sav(struct secasvar *);
703 static struct secasvar *key_newsav(struct mbuf *,
704 const struct sadb_msghdr *, int *, int, const char*, int);
705 #define KEY_NEWSAV(m, sadb, e, proto) \
706 key_newsav(m, sadb, e, proto, __func__, __LINE__)
707 static void key_delsav (struct secasvar *);
708 static struct secashead *key_getsah(const struct secasindex *, int);
709 static struct secashead *key_getsah_ref(const struct secasindex *, int);
710 static bool key_checkspidup(const struct secasindex *, u_int32_t);
711 static struct secasvar *key_getsavbyspi (struct secashead *, u_int32_t);
712 static int key_setsaval (struct secasvar *, struct mbuf *,
713 const struct sadb_msghdr *);
714 static void key_freesaval(struct secasvar *);
715 static int key_init_xform(struct secasvar *);
716 static void key_clear_xform(struct secasvar *);
717 static struct mbuf *key_setdumpsa (struct secasvar *, u_int8_t,
718 u_int8_t, u_int32_t, u_int32_t);
719 static struct mbuf *key_setsadbxport (u_int16_t, u_int16_t);
720 static struct mbuf *key_setsadbxtype (u_int16_t);
721 static struct mbuf *key_setsadbxfrag (u_int16_t);
722 static void key_porttosaddr (union sockaddr_union *, u_int16_t);
723 static int key_checksalen (const union sockaddr_union *);
724 static struct mbuf *key_setsadbmsg (u_int8_t, u_int16_t, u_int8_t,
725 u_int32_t, pid_t, u_int16_t, int);
726 static struct mbuf *key_setsadbsa (struct secasvar *);
727 static struct mbuf *key_setsadbaddr(u_int16_t,
728 const struct sockaddr *, u_int8_t, u_int16_t, int);
729 #if 0
730 static struct mbuf *key_setsadbident (u_int16_t, u_int16_t, void *,
731 int, u_int64_t);
732 #endif
733 static struct mbuf *key_setsadbxsa2 (u_int8_t, u_int32_t, u_int16_t);
734 static struct mbuf *key_setsadbxpolicy (u_int16_t, u_int8_t,
735 u_int32_t, int);
736 static void *key_newbuf (const void *, u_int);
737 #ifdef INET6
738 static int key_ismyaddr6 (const struct sockaddr_in6 *);
739 #endif
740
741 static void sysctl_net_keyv2_setup(struct sysctllog **);
742 static void sysctl_net_key_compat_setup(struct sysctllog **);
743
744 /* flags for key_saidx_match() */
745 #define CMP_HEAD 1 /* protocol, addresses. */
746 #define CMP_MODE_REQID 2 /* additionally HEAD, reqid, mode. */
747 #define CMP_REQID 3 /* additionally HEAD, reaid. */
748 #define CMP_EXACTLY 4 /* all elements. */
749 static int key_saidx_match(const struct secasindex *,
750 const struct secasindex *, int);
751
752 static int key_sockaddr_match(const struct sockaddr *,
753 const struct sockaddr *, int);
754 static int key_bb_match_withmask(const void *, const void *, u_int);
755 static u_int16_t key_satype2proto (u_int8_t);
756 static u_int8_t key_proto2satype (u_int16_t);
757
758 static int key_spidx_match_exactly(const struct secpolicyindex *,
759 const struct secpolicyindex *);
760 static int key_spidx_match_withmask(const struct secpolicyindex *,
761 const struct secpolicyindex *);
762
763 static int key_api_getspi(struct socket *, struct mbuf *,
764 const struct sadb_msghdr *);
765 static u_int32_t key_do_getnewspi (const struct sadb_spirange *,
766 const struct secasindex *);
767 static int key_handle_natt_info (struct secasvar *,
768 const struct sadb_msghdr *);
769 static int key_set_natt_ports (union sockaddr_union *,
770 union sockaddr_union *,
771 const struct sadb_msghdr *);
772 static int key_api_update(struct socket *, struct mbuf *,
773 const struct sadb_msghdr *);
774 #ifdef IPSEC_DOSEQCHECK
775 static struct secasvar *key_getsavbyseq (struct secashead *, u_int32_t);
776 #endif
777 static int key_api_add(struct socket *, struct mbuf *,
778 const struct sadb_msghdr *);
779 static int key_setident (struct secashead *, struct mbuf *,
780 const struct sadb_msghdr *);
781 static struct mbuf *key_getmsgbuf_x1 (struct mbuf *,
782 const struct sadb_msghdr *);
783 static int key_api_delete(struct socket *, struct mbuf *,
784 const struct sadb_msghdr *);
785 static int key_api_get(struct socket *, struct mbuf *,
786 const struct sadb_msghdr *);
787
788 static void key_getcomb_setlifetime (struct sadb_comb *);
789 static struct mbuf *key_getcomb_esp(int);
790 static struct mbuf *key_getcomb_ah(int);
791 static struct mbuf *key_getcomb_ipcomp(int);
792 static struct mbuf *key_getprop(const struct secasindex *, int);
793
794 static int key_acquire(const struct secasindex *, const struct secpolicy *,
795 int);
796 static int key_acquire_sendup_mbuf_later(struct mbuf *);
797 static void key_acquire_sendup_pending_mbuf(void);
798 #ifndef IPSEC_NONBLOCK_ACQUIRE
799 static struct secacq *key_newacq (const struct secasindex *);
800 static struct secacq *key_getacq (const struct secasindex *);
801 static struct secacq *key_getacqbyseq (u_int32_t);
802 #endif
803 #ifdef notyet
804 static struct secspacq *key_newspacq (const struct secpolicyindex *);
805 static struct secspacq *key_getspacq (const struct secpolicyindex *);
806 #endif
807 static int key_api_acquire(struct socket *, struct mbuf *,
808 const struct sadb_msghdr *);
809 static int key_api_register(struct socket *, struct mbuf *,
810 const struct sadb_msghdr *);
811 static int key_expire (struct secasvar *);
812 static int key_api_flush(struct socket *, struct mbuf *,
813 const struct sadb_msghdr *);
814 static struct mbuf *key_setdump_chain (u_int8_t req_satype, int *errorp,
815 int *lenp, pid_t pid);
816 static int key_api_dump(struct socket *, struct mbuf *,
817 const struct sadb_msghdr *);
818 static int key_api_promisc(struct socket *, struct mbuf *,
819 const struct sadb_msghdr *);
820 static int key_senderror (struct socket *, struct mbuf *, int);
821 static int key_validate_ext (const struct sadb_ext *, int);
822 static int key_align (struct mbuf *, struct sadb_msghdr *);
823 #if 0
824 static const char *key_getfqdn (void);
825 static const char *key_getuserfqdn (void);
826 #endif
827 static void key_sa_chgstate (struct secasvar *, u_int8_t);
828
829 static struct mbuf *key_alloc_mbuf(int, int);
830 static struct mbuf *key_alloc_mbuf_simple(int, int);
831
832 static void key_timehandler(void *);
833 static void key_timehandler_work(struct work *, void *);
834 static struct callout key_timehandler_ch;
835 static struct workqueue *key_timehandler_wq;
836 static struct work key_timehandler_wk;
837
838 static inline void
839 key_savlut_writer_insert_head(struct secasvar *sav);
840 static inline uint32_t
841 key_saidxhash(const struct secasindex *, u_long);
842 static inline uint32_t
843 key_savluthash(const struct sockaddr *,
844 uint32_t, uint32_t, u_long);
845
846 /*
847 * Utilities for percpu counters for sadb_lifetime_allocations and
848 * sadb_lifetime_bytes.
849 */
850 #define LIFETIME_COUNTER_ALLOCATIONS 0
851 #define LIFETIME_COUNTER_BYTES 1
852 #define LIFETIME_COUNTER_SIZE 2
853
854 typedef uint64_t lifetime_counters_t[LIFETIME_COUNTER_SIZE];
855
856 static void
key_sum_lifetime_counters(void * p,void * arg,struct cpu_info * ci __unused)857 key_sum_lifetime_counters(void *p, void *arg, struct cpu_info *ci __unused)
858 {
859 lifetime_counters_t *one = p;
860 lifetime_counters_t *sum = arg;
861
862 (*sum)[LIFETIME_COUNTER_ALLOCATIONS] += (*one)[LIFETIME_COUNTER_ALLOCATIONS];
863 (*sum)[LIFETIME_COUNTER_BYTES] += (*one)[LIFETIME_COUNTER_BYTES];
864 }
865
866 u_int
key_sp_refcnt(const struct secpolicy * sp)867 key_sp_refcnt(const struct secpolicy *sp)
868 {
869
870 /* FIXME */
871 return 0;
872 }
873
874 void
key_sp_touch(struct secpolicy * sp)875 key_sp_touch(struct secpolicy *sp)
876 {
877
878 sp->lastused = time_uptime;
879 }
880
881 static void
key_spd_pserialize_perform(void)882 key_spd_pserialize_perform(void)
883 {
884
885 KASSERT(mutex_owned(&key_spd.lock));
886
887 while (key_spd.psz_performing)
888 cv_wait(&key_spd.cv_psz, &key_spd.lock);
889 key_spd.psz_performing = true;
890 mutex_exit(&key_spd.lock);
891
892 pserialize_perform(key_spd.psz);
893
894 mutex_enter(&key_spd.lock);
895 key_spd.psz_performing = false;
896 cv_broadcast(&key_spd.cv_psz);
897 }
898
899 /*
900 * Remove the sp from the key_spd.splist and wait for references to the sp
901 * to be released. key_spd.lock must be held.
902 */
903 static void
key_unlink_sp(struct secpolicy * sp)904 key_unlink_sp(struct secpolicy *sp)
905 {
906
907 KASSERT(mutex_owned(&key_spd.lock));
908
909 sp->state = IPSEC_SPSTATE_DEAD;
910 SPLIST_WRITER_REMOVE(sp);
911
912 /* Invalidate all cached SPD pointers in the PCBs. */
913 ipsec_invalpcbcacheall();
914
915 KDASSERT(mutex_ownable(softnet_lock));
916 key_spd_pserialize_perform();
917
918 localcount_drain(&sp->localcount, &key_spd.cv_lc, &key_spd.lock);
919 }
920
921 /*
922 * Return 0 when there are known to be no SP's for the specified
923 * direction. Otherwise return 1. This is used by IPsec code
924 * to optimize performance.
925 */
926 int
key_havesp(u_int dir)927 key_havesp(u_int dir)
928 {
929 return (dir == IPSEC_DIR_INBOUND || dir == IPSEC_DIR_OUTBOUND ?
930 !SPLIST_READER_EMPTY(dir) : 1);
931 }
932
933 /* %%% IPsec policy management */
934 /*
935 * allocating a SP for OUTBOUND or INBOUND packet.
936 * Must call key_freesp() later.
937 * OUT: NULL: not found
938 * others: found and return the pointer.
939 */
940 struct secpolicy *
key_lookup_sp_byspidx(const struct secpolicyindex * spidx,u_int dir,const char * where,int tag)941 key_lookup_sp_byspidx(const struct secpolicyindex *spidx,
942 u_int dir, const char* where, int tag)
943 {
944 struct secpolicy *sp;
945 int s;
946
947 KASSERT(spidx != NULL);
948 KASSERTMSG(IPSEC_DIR_IS_INOROUT(dir), "invalid direction %u", dir);
949
950 KEYDEBUG_PRINTF(KEYDEBUG_IPSEC_STAMP, "DP from %s:%u\n", where, tag);
951
952 /* get a SP entry */
953 if (KEYDEBUG_ON(KEYDEBUG_IPSEC_DATA)) {
954 kdebug_secpolicyindex("objects", spidx);
955 }
956
957 s = pserialize_read_enter();
958 SPLIST_READER_FOREACH(sp, dir) {
959 if (KEYDEBUG_ON(KEYDEBUG_IPSEC_DATA)) {
960 kdebug_secpolicyindex("in SPD", &sp->spidx);
961 }
962
963 if (sp->state == IPSEC_SPSTATE_DEAD)
964 continue;
965 if (key_spidx_match_withmask(&sp->spidx, spidx))
966 goto found;
967 }
968 sp = NULL;
969 found:
970 if (sp) {
971 /* sanity check */
972 KEY_CHKSPDIR(sp->spidx.dir, dir);
973
974 /* found a SPD entry */
975 key_sp_touch(sp);
976 key_sp_ref(sp, where, tag);
977 }
978 pserialize_read_exit(s);
979
980 KEYDEBUG_PRINTF(KEYDEBUG_IPSEC_STAMP,
981 "DP return SP:%p (ID=%u) refcnt %u\n",
982 sp, sp ? sp->id : 0, key_sp_refcnt(sp));
983 return sp;
984 }
985
986 /*
987 * return a policy that matches this particular inbound packet.
988 * XXX slow
989 */
990 struct secpolicy *
key_gettunnel(const struct sockaddr * osrc,const struct sockaddr * odst,const struct sockaddr * isrc,const struct sockaddr * idst,const char * where,int tag)991 key_gettunnel(const struct sockaddr *osrc,
992 const struct sockaddr *odst,
993 const struct sockaddr *isrc,
994 const struct sockaddr *idst,
995 const char* where, int tag)
996 {
997 struct secpolicy *sp;
998 const int dir = IPSEC_DIR_INBOUND;
999 int s;
1000 struct ipsecrequest *r1, *r2, *p;
1001 struct secpolicyindex spidx;
1002
1003 KEYDEBUG_PRINTF(KEYDEBUG_IPSEC_STAMP, "DP from %s:%u\n", where, tag);
1004
1005 if (isrc->sa_family != idst->sa_family) {
1006 IPSECLOG(LOG_ERR,
1007 "address family mismatched src %u, dst %u.\n",
1008 isrc->sa_family, idst->sa_family);
1009 sp = NULL;
1010 goto done;
1011 }
1012
1013 s = pserialize_read_enter();
1014 SPLIST_READER_FOREACH(sp, dir) {
1015 if (sp->state == IPSEC_SPSTATE_DEAD)
1016 continue;
1017
1018 r1 = r2 = NULL;
1019 for (p = sp->req; p; p = p->next) {
1020 if (p->saidx.mode != IPSEC_MODE_TUNNEL)
1021 continue;
1022
1023 r1 = r2;
1024 r2 = p;
1025
1026 if (!r1) {
1027 /* here we look at address matches only */
1028 spidx = sp->spidx;
1029 if (isrc->sa_len > sizeof(spidx.src) ||
1030 idst->sa_len > sizeof(spidx.dst))
1031 continue;
1032 memcpy(&spidx.src, isrc, isrc->sa_len);
1033 memcpy(&spidx.dst, idst, idst->sa_len);
1034 if (!key_spidx_match_withmask(&sp->spidx, &spidx))
1035 continue;
1036 } else {
1037 if (!key_sockaddr_match(&r1->saidx.src.sa, isrc, PORT_NONE) ||
1038 !key_sockaddr_match(&r1->saidx.dst.sa, idst, PORT_NONE))
1039 continue;
1040 }
1041
1042 if (!key_sockaddr_match(&r2->saidx.src.sa, osrc, PORT_NONE) ||
1043 !key_sockaddr_match(&r2->saidx.dst.sa, odst, PORT_NONE))
1044 continue;
1045
1046 goto found;
1047 }
1048 }
1049 sp = NULL;
1050 found:
1051 if (sp) {
1052 key_sp_touch(sp);
1053 key_sp_ref(sp, where, tag);
1054 }
1055 pserialize_read_exit(s);
1056 done:
1057 KEYDEBUG_PRINTF(KEYDEBUG_IPSEC_STAMP,
1058 "DP return SP:%p (ID=%u) refcnt %u\n",
1059 sp, sp ? sp->id : 0, key_sp_refcnt(sp));
1060 return sp;
1061 }
1062
1063 /*
1064 * allocating an SA entry for an *OUTBOUND* packet.
1065 * checking each request entries in SP, and acquire an SA if need.
1066 * OUT: 0: there are valid requests.
1067 * ENOENT: policy may be valid, but SA with REQUIRE is on acquiring.
1068 */
1069 int
key_checkrequest(const struct ipsecrequest * isr,const struct secasindex * saidx,struct secasvar ** ret)1070 key_checkrequest(const struct ipsecrequest *isr, const struct secasindex *saidx,
1071 struct secasvar **ret)
1072 {
1073 u_int level;
1074 int error;
1075 struct secasvar *sav;
1076
1077 KASSERT(isr != NULL);
1078 KASSERTMSG(saidx->mode == IPSEC_MODE_TRANSPORT ||
1079 saidx->mode == IPSEC_MODE_TUNNEL,
1080 "unexpected policy %u", saidx->mode);
1081
1082 /* get current level */
1083 level = ipsec_get_reqlevel(isr);
1084
1085 /*
1086 * XXX guard against protocol callbacks from the crypto
1087 * thread as they reference ipsecrequest.sav which we
1088 * temporarily null out below. Need to rethink how we
1089 * handle bundled SA's in the callback thread.
1090 */
1091
1092 sav = key_lookup_sa_bysaidx(saidx);
1093 if (sav != NULL) {
1094 *ret = sav;
1095 return 0;
1096 }
1097
1098 /* there is no SA */
1099 error = key_acquire(saidx, isr->sp, M_NOWAIT);
1100 if (error != 0) {
1101 /* XXX What should I do ? */
1102 IPSECLOG(LOG_DEBUG, "error %d returned from key_acquire.\n",
1103 error);
1104 return error;
1105 }
1106
1107 if (level != IPSEC_LEVEL_REQUIRE) {
1108 /* XXX sigh, the interface to this routine is botched */
1109 *ret = NULL;
1110 return 0;
1111 } else {
1112 return ENOENT;
1113 }
1114 }
1115
1116 /*
1117 * looking up a SA for policy entry from SAD.
1118 * NOTE: searching SAD of aliving state.
1119 * OUT: NULL: not found.
1120 * others: found and return the pointer.
1121 */
1122 struct secasvar *
key_lookup_sa_bysaidx(const struct secasindex * saidx)1123 key_lookup_sa_bysaidx(const struct secasindex *saidx)
1124 {
1125 struct secashead *sah;
1126 struct secasvar *sav = NULL;
1127 u_int stateidx, state;
1128 const u_int *saorder_state_valid;
1129 int arraysize;
1130 int s;
1131
1132 s = pserialize_read_enter();
1133 sah = key_getsah(saidx, CMP_MODE_REQID);
1134 if (sah == NULL)
1135 goto out;
1136
1137 /*
1138 * search a valid state list for outbound packet.
1139 * This search order is important.
1140 */
1141 if (key_prefered_oldsa) {
1142 saorder_state_valid = saorder_state_valid_prefer_old;
1143 arraysize = _ARRAYLEN(saorder_state_valid_prefer_old);
1144 } else {
1145 saorder_state_valid = saorder_state_valid_prefer_new;
1146 arraysize = _ARRAYLEN(saorder_state_valid_prefer_new);
1147 }
1148
1149 /* search valid state */
1150 for (stateidx = 0;
1151 stateidx < arraysize;
1152 stateidx++) {
1153
1154 state = saorder_state_valid[stateidx];
1155
1156 if (key_prefered_oldsa)
1157 sav = SAVLIST_READER_FIRST(sah, state);
1158 else {
1159 /* XXX need O(1) lookup */
1160 struct secasvar *last = NULL;
1161
1162 SAVLIST_READER_FOREACH(sav, sah, state)
1163 last = sav;
1164 sav = last;
1165 }
1166 if (sav != NULL) {
1167 KEY_SA_REF(sav);
1168 KEYDEBUG_PRINTF(KEYDEBUG_IPSEC_STAMP,
1169 "DP cause refcnt++:%d SA:%p\n",
1170 key_sa_refcnt(sav), sav);
1171 break;
1172 }
1173 }
1174 out:
1175 pserialize_read_exit(s);
1176
1177 return sav;
1178 }
1179
1180 #if 0
1181 static void
1182 key_sendup_message_delete(struct secasvar *sav)
1183 {
1184 struct mbuf *m, *result = 0;
1185 uint8_t satype;
1186
1187 satype = key_proto2satype(sav->sah->saidx.proto);
1188 if (satype == 0)
1189 goto msgfail;
1190
1191 m = key_setsadbmsg(SADB_DELETE, 0, satype, 0, 0, key_sa_refcnt(sav) - 1);
1192 if (m == NULL)
1193 goto msgfail;
1194 result = m;
1195
1196 /* set sadb_address for saidx's. */
1197 m = key_setsadbaddr(SADB_EXT_ADDRESS_SRC, &sav->sah->saidx.src.sa,
1198 _BITS(sav->sah->saidx.src.sa.sa_len), IPSEC_ULPROTO_ANY);
1199 if (m == NULL)
1200 goto msgfail;
1201 m_cat(result, m);
1202
1203 /* set sadb_address for saidx's. */
1204 m = key_setsadbaddr(SADB_EXT_ADDRESS_DST, &sav->sah->saidx.src.sa,
1205 _BITS(sav->sah->saidx.src.sa.sa_len), IPSEC_ULPROTO_ANY);
1206 if (m == NULL)
1207 goto msgfail;
1208 m_cat(result, m);
1209
1210 /* create SA extension */
1211 m = key_setsadbsa(sav);
1212 if (m == NULL)
1213 goto msgfail;
1214 m_cat(result, m);
1215
1216 if (result->m_len < sizeof(struct sadb_msg)) {
1217 result = m_pullup(result, sizeof(struct sadb_msg));
1218 if (result == NULL)
1219 goto msgfail;
1220 }
1221
1222 result->m_pkthdr.len = 0;
1223 for (m = result; m; m = m->m_next)
1224 result->m_pkthdr.len += m->m_len;
1225 mtod(result, struct sadb_msg *)->sadb_msg_len =
1226 PFKEY_UNIT64(result->m_pkthdr.len);
1227
1228 key_sendup_mbuf(NULL, result, KEY_SENDUP_REGISTERED);
1229 result = NULL;
1230 msgfail:
1231 m_freem(result);
1232 }
1233 #endif
1234
1235 /*
1236 * allocating a usable SA entry for a *INBOUND* packet.
1237 * Must call key_freesav() later.
1238 * OUT: positive: pointer to a usable sav (i.e. MATURE or DYING state).
1239 * NULL: not found, or error occurred.
1240 *
1241 * In the comparison, no source address is used--for RFC2401 conformance.
1242 * To quote, from section 4.1:
1243 * A security association is uniquely identified by a triple consisting
1244 * of a Security Parameter Index (SPI), an IP Destination Address, and a
1245 * security protocol (AH or ESP) identifier.
1246 * Note that, however, we do need to keep source address in IPsec SA.
1247 * IKE specification and PF_KEY specification do assume that we
1248 * keep source address in IPsec SA. We see a tricky situation here.
1249 *
1250 * sport and dport are used for NAT-T. network order is always used.
1251 */
1252 struct secasvar *
key_lookup_sa(const union sockaddr_union * dst,u_int proto,u_int32_t spi,u_int16_t sport,u_int16_t dport,const char * where,int tag)1253 key_lookup_sa(
1254 const union sockaddr_union *dst,
1255 u_int proto,
1256 u_int32_t spi,
1257 u_int16_t sport,
1258 u_int16_t dport,
1259 const char* where, int tag)
1260 {
1261 struct secasvar *sav;
1262 int chkport;
1263 int s;
1264
1265 int must_check_spi = 1;
1266 int must_check_alg = 0;
1267 u_int16_t cpi = 0;
1268 u_int8_t algo = 0;
1269 uint32_t hash_key = spi;
1270
1271 if ((sport != 0) && (dport != 0))
1272 chkport = PORT_STRICT;
1273 else
1274 chkport = PORT_NONE;
1275
1276 KASSERT(dst != NULL);
1277
1278 /*
1279 * XXX IPCOMP case
1280 * We use cpi to define spi here. In the case where cpi <=
1281 * IPCOMP_CPI_NEGOTIATE_MIN, cpi just define the algorithm used, not
1282 * the real spi. In this case, don't check the spi but check the
1283 * algorithm
1284 */
1285
1286 if (proto == IPPROTO_IPCOMP) {
1287 u_int32_t tmp;
1288 tmp = ntohl(spi);
1289 cpi = (u_int16_t) tmp;
1290 if (cpi < IPCOMP_CPI_NEGOTIATE_MIN) {
1291 algo = (u_int8_t) cpi;
1292 hash_key = algo;
1293 must_check_spi = 0;
1294 must_check_alg = 1;
1295 }
1296 }
1297 KEYDEBUG_PRINTF(KEYDEBUG_IPSEC_STAMP,
1298 "DP from %s:%u check_spi=%d(%#x), check_alg=%d(%d), proto=%d\n",
1299 where, tag,
1300 must_check_spi, ntohl(spi),
1301 must_check_alg, algo,
1302 proto);
1303
1304
1305 /*
1306 * searching SAD.
1307 * XXX: to be checked internal IP header somewhere. Also when
1308 * IPsec tunnel packet is received. But ESP tunnel mode is
1309 * encrypted so we can't check internal IP header.
1310 */
1311 s = pserialize_read_enter();
1312 SAVLUT_READER_FOREACH(sav, &dst->sa, proto, hash_key) {
1313 KEYDEBUG_PRINTF(KEYDEBUG_MATCH,
1314 "try match spi %#x, %#x\n",
1315 ntohl(spi), ntohl(sav->spi));
1316
1317 /* do not return entries w/ unusable state */
1318 if (!SADB_SASTATE_USABLE_P(sav)) {
1319 KEYDEBUG_PRINTF(KEYDEBUG_MATCH,
1320 "bad state %d\n", sav->state);
1321 continue;
1322 }
1323 if (proto != sav->sah->saidx.proto) {
1324 KEYDEBUG_PRINTF(KEYDEBUG_MATCH,
1325 "proto fail %d != %d\n",
1326 proto, sav->sah->saidx.proto);
1327 continue;
1328 }
1329 if (must_check_spi && spi != sav->spi) {
1330 KEYDEBUG_PRINTF(KEYDEBUG_MATCH,
1331 "spi fail %#x != %#x\n",
1332 ntohl(spi), ntohl(sav->spi));
1333 continue;
1334 }
1335 /* XXX only on the ipcomp case */
1336 if (must_check_alg && algo != sav->alg_comp) {
1337 KEYDEBUG_PRINTF(KEYDEBUG_MATCH,
1338 "algo fail %d != %d\n",
1339 algo, sav->alg_comp);
1340 continue;
1341 }
1342
1343 #if 0 /* don't check src */
1344 /* Fix port in src->sa */
1345
1346 /* check src address */
1347 if (!key_sockaddr_match(&src->sa, &sav->sah->saidx.src.sa, PORT_NONE))
1348 continue;
1349 #endif
1350 /* fix port of dst address XXX*/
1351 key_porttosaddr(__UNCONST(dst), dport);
1352 /* check dst address */
1353 if (!key_sockaddr_match(&dst->sa, &sav->sah->saidx.dst.sa, chkport))
1354 continue;
1355 key_sa_ref(sav, where, tag);
1356 goto done;
1357 }
1358 sav = NULL;
1359 done:
1360 pserialize_read_exit(s);
1361
1362 KEYDEBUG_PRINTF(KEYDEBUG_IPSEC_STAMP,
1363 "DP return SA:%p; refcnt %u\n", sav, key_sa_refcnt(sav));
1364 return sav;
1365 }
1366
1367 static void
key_validate_savlist(const struct secashead * sah,const u_int state)1368 key_validate_savlist(const struct secashead *sah, const u_int state)
1369 {
1370 #ifdef DEBUG
1371 struct secasvar *sav, *next;
1372 int s;
1373
1374 /*
1375 * The list should be sorted by lft_c->sadb_lifetime_addtime
1376 * in ascending order.
1377 */
1378 s = pserialize_read_enter();
1379 SAVLIST_READER_FOREACH(sav, sah, state) {
1380 next = SAVLIST_READER_NEXT(sav);
1381 if (next != NULL &&
1382 sav->lft_c != NULL && next->lft_c != NULL) {
1383 KDASSERTMSG(sav->lft_c->sadb_lifetime_addtime <=
1384 next->lft_c->sadb_lifetime_addtime,
1385 "savlist is not sorted: sah=%p, state=%d, "
1386 "sav=%" PRIu64 ", next=%" PRIu64, sah, state,
1387 sav->lft_c->sadb_lifetime_addtime,
1388 next->lft_c->sadb_lifetime_addtime);
1389 }
1390 }
1391 pserialize_read_exit(s);
1392 #endif
1393 }
1394
1395 void
key_init_sp(struct secpolicy * sp)1396 key_init_sp(struct secpolicy *sp)
1397 {
1398
1399 ASSERT_SLEEPABLE();
1400
1401 sp->state = IPSEC_SPSTATE_ALIVE;
1402 if (sp->policy == IPSEC_POLICY_IPSEC)
1403 KASSERT(sp->req != NULL);
1404 localcount_init(&sp->localcount);
1405 SPLIST_ENTRY_INIT(sp);
1406 }
1407
1408 /*
1409 * Must be called in a pserialize read section. A held SP
1410 * must be released by key_sp_unref after use.
1411 */
1412 void
key_sp_ref(struct secpolicy * sp,const char * where,int tag)1413 key_sp_ref(struct secpolicy *sp, const char* where, int tag)
1414 {
1415
1416 localcount_acquire(&sp->localcount);
1417
1418 KEYDEBUG_PRINTF(KEYDEBUG_IPSEC_STAMP,
1419 "DP SP:%p (ID=%u) from %s:%u; refcnt++ now %u\n",
1420 sp, sp->id, where, tag, key_sp_refcnt(sp));
1421 }
1422
1423 /*
1424 * Must be called without holding key_spd.lock because the lock
1425 * would be held in localcount_release.
1426 */
1427 void
key_sp_unref(struct secpolicy * sp,const char * where,int tag)1428 key_sp_unref(struct secpolicy *sp, const char* where, int tag)
1429 {
1430
1431 KDASSERT(mutex_ownable(&key_spd.lock));
1432
1433 KEYDEBUG_PRINTF(KEYDEBUG_IPSEC_STAMP,
1434 "DP SP:%p (ID=%u) from %s:%u; refcnt-- now %u\n",
1435 sp, sp->id, where, tag, key_sp_refcnt(sp));
1436
1437 localcount_release(&sp->localcount, &key_spd.cv_lc, &key_spd.lock);
1438 }
1439
1440 static void
key_init_sav(struct secasvar * sav)1441 key_init_sav(struct secasvar *sav)
1442 {
1443
1444 ASSERT_SLEEPABLE();
1445
1446 localcount_init(&sav->localcount);
1447 SAVLIST_ENTRY_INIT(sav);
1448 SAVLUT_ENTRY_INIT(sav);
1449 }
1450
1451 u_int
key_sa_refcnt(const struct secasvar * sav)1452 key_sa_refcnt(const struct secasvar *sav)
1453 {
1454
1455 /* FIXME */
1456 return 0;
1457 }
1458
1459 void
key_sa_ref(struct secasvar * sav,const char * where,int tag)1460 key_sa_ref(struct secasvar *sav, const char* where, int tag)
1461 {
1462
1463 localcount_acquire(&sav->localcount);
1464
1465 KEYDEBUG_PRINTF(KEYDEBUG_IPSEC_STAMP,
1466 "DP cause refcnt++: SA:%p from %s:%u\n",
1467 sav, where, tag);
1468 }
1469
1470 void
key_sa_unref(struct secasvar * sav,const char * where,int tag)1471 key_sa_unref(struct secasvar *sav, const char* where, int tag)
1472 {
1473
1474 KDASSERT(mutex_ownable(&key_sad.lock));
1475
1476 KEYDEBUG_PRINTF(KEYDEBUG_IPSEC_STAMP,
1477 "DP cause refcnt--: SA:%p from %s:%u\n",
1478 sav, where, tag);
1479
1480 localcount_release(&sav->localcount, &key_sad.cv_lc, &key_sad.lock);
1481 }
1482
1483 #if 0
1484 /*
1485 * Must be called after calling key_lookup_sp*().
1486 * For the packet with socket.
1487 */
1488 static void
1489 key_freeso(struct socket *so)
1490 {
1491 /* sanity check */
1492 KASSERT(so != NULL);
1493
1494 switch (so->so_proto->pr_domain->dom_family) {
1495 #ifdef INET
1496 case PF_INET:
1497 {
1498 struct inpcb *pcb = sotoinpcb(so);
1499
1500 /* Does it have a PCB ? */
1501 if (pcb == NULL)
1502 return;
1503
1504 struct inpcbpolicy *sp = pcb->inp_sp;
1505 key_freesp_so(&sp->sp_in);
1506 key_freesp_so(&sp->sp_out);
1507 }
1508 break;
1509 #endif
1510 #ifdef INET6
1511 case PF_INET6:
1512 {
1513 #ifdef HAVE_NRL_INPCB
1514 struct inpcb *pcb = sotoinpcb(so);
1515 struct inpcbpolicy *sp = pcb->inp_sp;
1516
1517 /* Does it have a PCB ? */
1518 if (pcb == NULL)
1519 return;
1520 key_freesp_so(&sp->sp_in);
1521 key_freesp_so(&sp->sp_out);
1522 #else
1523 struct in6pcb *pcb = sotoin6pcb(so);
1524
1525 /* Does it have a PCB ? */
1526 if (pcb == NULL)
1527 return;
1528 key_freesp_so(&pcb->in6p_sp->sp_in);
1529 key_freesp_so(&pcb->in6p_sp->sp_out);
1530 #endif
1531 }
1532 break;
1533 #endif /* INET6 */
1534 default:
1535 IPSECLOG(LOG_DEBUG, "unknown address family=%d.\n",
1536 so->so_proto->pr_domain->dom_family);
1537 return;
1538 }
1539 }
1540
1541 static void
1542 key_freesp_so(struct secpolicy **sp)
1543 {
1544
1545 KASSERT(sp != NULL);
1546 KASSERT(*sp != NULL);
1547
1548 if ((*sp)->policy == IPSEC_POLICY_ENTRUST ||
1549 (*sp)->policy == IPSEC_POLICY_BYPASS)
1550 return;
1551
1552 KASSERTMSG((*sp)->policy == IPSEC_POLICY_IPSEC,
1553 "invalid policy %u", (*sp)->policy);
1554 KEY_SP_UNREF(&sp);
1555 }
1556 #endif
1557
1558 static void
key_sad_pserialize_perform(void)1559 key_sad_pserialize_perform(void)
1560 {
1561
1562 KASSERT(mutex_owned(&key_sad.lock));
1563
1564 while (key_sad.psz_performing)
1565 cv_wait(&key_sad.cv_psz, &key_sad.lock);
1566 key_sad.psz_performing = true;
1567 mutex_exit(&key_sad.lock);
1568
1569 pserialize_perform(key_sad.psz);
1570
1571 mutex_enter(&key_sad.lock);
1572 key_sad.psz_performing = false;
1573 cv_broadcast(&key_sad.cv_psz);
1574 }
1575
1576 /*
1577 * Remove the sav from the savlist of its sah and wait for references to the sav
1578 * to be released. key_sad.lock must be held.
1579 */
1580 static void
key_unlink_sav(struct secasvar * sav)1581 key_unlink_sav(struct secasvar *sav)
1582 {
1583
1584 KASSERT(mutex_owned(&key_sad.lock));
1585
1586 SAVLIST_WRITER_REMOVE(sav);
1587 SAVLUT_WRITER_REMOVE(sav);
1588
1589 KDASSERT(mutex_ownable(softnet_lock));
1590 key_sad_pserialize_perform();
1591
1592 localcount_drain(&sav->localcount, &key_sad.cv_lc, &key_sad.lock);
1593 }
1594
1595 /*
1596 * Destroy an sav where the sav must be unlinked from an sah
1597 * by say key_unlink_sav.
1598 */
1599 static void
key_destroy_sav(struct secasvar * sav)1600 key_destroy_sav(struct secasvar *sav)
1601 {
1602
1603 ASSERT_SLEEPABLE();
1604
1605 localcount_fini(&sav->localcount);
1606 SAVLIST_ENTRY_DESTROY(sav);
1607
1608 key_delsav(sav);
1609 }
1610
1611 /*
1612 * Wait for references of a passed sav to go away.
1613 */
1614 static void
key_wait_sav(struct secasvar * sav)1615 key_wait_sav(struct secasvar *sav)
1616 {
1617
1618 ASSERT_SLEEPABLE();
1619
1620 mutex_enter(&key_sad.lock);
1621 KASSERT(sav->state == SADB_SASTATE_DEAD);
1622 KDASSERT(mutex_ownable(softnet_lock));
1623 key_sad_pserialize_perform();
1624 localcount_drain(&sav->localcount, &key_sad.cv_lc, &key_sad.lock);
1625 mutex_exit(&key_sad.lock);
1626 }
1627
1628 /* %%% SPD management */
1629 /*
1630 * free security policy entry.
1631 */
1632 static void
key_destroy_sp(struct secpolicy * sp)1633 key_destroy_sp(struct secpolicy *sp)
1634 {
1635
1636 SPLIST_ENTRY_DESTROY(sp);
1637 localcount_fini(&sp->localcount);
1638
1639 key_free_sp(sp);
1640
1641 key_update_used();
1642 }
1643
1644 void
key_free_sp(struct secpolicy * sp)1645 key_free_sp(struct secpolicy *sp)
1646 {
1647 struct ipsecrequest *isr = sp->req, *nextisr;
1648
1649 while (isr != NULL) {
1650 nextisr = isr->next;
1651 kmem_free(isr, sizeof(*isr));
1652 isr = nextisr;
1653 }
1654
1655 kmem_free(sp, sizeof(*sp));
1656 }
1657
1658 void
key_socksplist_add(struct secpolicy * sp)1659 key_socksplist_add(struct secpolicy *sp)
1660 {
1661
1662 mutex_enter(&key_spd.lock);
1663 PSLIST_WRITER_INSERT_HEAD(&key_spd.socksplist, sp, pslist_entry);
1664 mutex_exit(&key_spd.lock);
1665
1666 key_update_used();
1667 }
1668
1669 /*
1670 * search SPD
1671 * OUT: NULL : not found
1672 * others : found, pointer to a SP.
1673 */
1674 static struct secpolicy *
key_getsp(const struct secpolicyindex * spidx)1675 key_getsp(const struct secpolicyindex *spidx)
1676 {
1677 struct secpolicy *sp;
1678 int s;
1679
1680 KASSERT(spidx != NULL);
1681
1682 s = pserialize_read_enter();
1683 SPLIST_READER_FOREACH(sp, spidx->dir) {
1684 if (sp->state == IPSEC_SPSTATE_DEAD)
1685 continue;
1686 if (key_spidx_match_exactly(spidx, &sp->spidx)) {
1687 KEY_SP_REF(sp);
1688 pserialize_read_exit(s);
1689 return sp;
1690 }
1691 }
1692 pserialize_read_exit(s);
1693
1694 return NULL;
1695 }
1696
1697 /*
1698 * search SPD and remove found SP
1699 * OUT: NULL : not found
1700 * others : found, pointer to a SP.
1701 */
1702 static struct secpolicy *
key_lookup_and_remove_sp(const struct secpolicyindex * spidx,bool from_kernel)1703 key_lookup_and_remove_sp(const struct secpolicyindex *spidx, bool from_kernel)
1704 {
1705 struct secpolicy *sp = NULL;
1706
1707 mutex_enter(&key_spd.lock);
1708 SPLIST_WRITER_FOREACH(sp, spidx->dir) {
1709 KASSERTMSG(sp->state != IPSEC_SPSTATE_DEAD, "sp->state=%u",
1710 sp->state);
1711 /*
1712 * SPs created in kernel(e.g. ipsec(4) I/F) must not be
1713 * removed by userland programs.
1714 */
1715 if (!from_kernel && sp->origin == IPSEC_SPORIGIN_KERNEL)
1716 continue;
1717 if (key_spidx_match_exactly(spidx, &sp->spidx)) {
1718 key_unlink_sp(sp);
1719 goto out;
1720 }
1721 }
1722 sp = NULL;
1723 out:
1724 mutex_exit(&key_spd.lock);
1725
1726 return sp;
1727 }
1728
1729 /*
1730 * get SP by index.
1731 * OUT: NULL : not found
1732 * others : found, pointer to a SP.
1733 */
1734 static struct secpolicy *
key_getspbyid(u_int32_t id)1735 key_getspbyid(u_int32_t id)
1736 {
1737 struct secpolicy *sp;
1738 int s;
1739
1740 s = pserialize_read_enter();
1741 SPLIST_READER_FOREACH(sp, IPSEC_DIR_INBOUND) {
1742 if (sp->state == IPSEC_SPSTATE_DEAD)
1743 continue;
1744 if (sp->id == id) {
1745 KEY_SP_REF(sp);
1746 goto out;
1747 }
1748 }
1749
1750 SPLIST_READER_FOREACH(sp, IPSEC_DIR_OUTBOUND) {
1751 if (sp->state == IPSEC_SPSTATE_DEAD)
1752 continue;
1753 if (sp->id == id) {
1754 KEY_SP_REF(sp);
1755 goto out;
1756 }
1757 }
1758 out:
1759 pserialize_read_exit(s);
1760 return sp;
1761 }
1762
1763 /*
1764 * get SP by index, remove and return it.
1765 * OUT: NULL : not found
1766 * others : found, pointer to a SP.
1767 */
1768 static struct secpolicy *
key_lookupbyid_and_remove_sp(u_int32_t id,bool from_kernel)1769 key_lookupbyid_and_remove_sp(u_int32_t id, bool from_kernel)
1770 {
1771 struct secpolicy *sp;
1772
1773 mutex_enter(&key_spd.lock);
1774 SPLIST_READER_FOREACH(sp, IPSEC_DIR_INBOUND) {
1775 KASSERTMSG(sp->state != IPSEC_SPSTATE_DEAD, "sp->state=%u",
1776 sp->state);
1777 /*
1778 * SPs created in kernel(e.g. ipsec(4) I/F) must not be
1779 * removed by userland programs.
1780 */
1781 if (!from_kernel && sp->origin == IPSEC_SPORIGIN_KERNEL)
1782 continue;
1783 if (sp->id == id)
1784 goto out;
1785 }
1786
1787 SPLIST_READER_FOREACH(sp, IPSEC_DIR_OUTBOUND) {
1788 KASSERTMSG(sp->state != IPSEC_SPSTATE_DEAD, "sp->state=%u",
1789 sp->state);
1790 /*
1791 * SPs created in kernel(e.g. ipsec(4) I/F) must not be
1792 * removed by userland programs.
1793 */
1794 if (!from_kernel && sp->origin == IPSEC_SPORIGIN_KERNEL)
1795 continue;
1796 if (sp->id == id)
1797 goto out;
1798 }
1799 out:
1800 if (sp != NULL)
1801 key_unlink_sp(sp);
1802 mutex_exit(&key_spd.lock);
1803 return sp;
1804 }
1805
1806 struct secpolicy *
key_newsp(const char * where,int tag)1807 key_newsp(const char* where, int tag)
1808 {
1809 struct secpolicy *newsp = NULL;
1810
1811 newsp = kmem_zalloc(sizeof(struct secpolicy), KM_SLEEP);
1812
1813 KEYDEBUG_PRINTF(KEYDEBUG_IPSEC_STAMP,
1814 "DP from %s:%u return SP:%p\n", where, tag, newsp);
1815 return newsp;
1816 }
1817
1818 /*
1819 * create secpolicy structure from sadb_x_policy structure.
1820 * NOTE: `state', `secpolicyindex' in secpolicy structure are not set,
1821 * so must be set properly later.
1822 */
1823 static struct secpolicy *
_key_msg2sp(const struct sadb_x_policy * xpl0,size_t len,int * error,bool from_kernel)1824 _key_msg2sp(const struct sadb_x_policy *xpl0, size_t len, int *error,
1825 bool from_kernel)
1826 {
1827 struct secpolicy *newsp;
1828
1829 KASSERT(!cpu_softintr_p());
1830 KASSERT(xpl0 != NULL);
1831 KASSERT(len >= sizeof(*xpl0));
1832
1833 if (len != PFKEY_EXTLEN(xpl0)) {
1834 IPSECLOG(LOG_DEBUG, "Invalid msg length.\n");
1835 *error = EINVAL;
1836 return NULL;
1837 }
1838
1839 newsp = KEY_NEWSP();
1840 if (newsp == NULL) {
1841 *error = ENOBUFS;
1842 return NULL;
1843 }
1844
1845 newsp->spidx.dir = xpl0->sadb_x_policy_dir;
1846 newsp->policy = xpl0->sadb_x_policy_type;
1847
1848 /* check policy */
1849 switch (xpl0->sadb_x_policy_type) {
1850 case IPSEC_POLICY_DISCARD:
1851 case IPSEC_POLICY_NONE:
1852 case IPSEC_POLICY_ENTRUST:
1853 case IPSEC_POLICY_BYPASS:
1854 newsp->req = NULL;
1855 *error = 0;
1856 return newsp;
1857
1858 case IPSEC_POLICY_IPSEC:
1859 /* Continued */
1860 break;
1861 default:
1862 IPSECLOG(LOG_DEBUG, "invalid policy type.\n");
1863 key_free_sp(newsp);
1864 *error = EINVAL;
1865 return NULL;
1866 }
1867
1868 /* IPSEC_POLICY_IPSEC */
1869 {
1870 int tlen;
1871 const struct sadb_x_ipsecrequest *xisr;
1872 uint16_t xisr_reqid;
1873 struct ipsecrequest **p_isr = &newsp->req;
1874
1875 /* validity check */
1876 if (PFKEY_EXTLEN(xpl0) < sizeof(*xpl0)) {
1877 IPSECLOG(LOG_DEBUG, "Invalid msg length.\n");
1878 *error = EINVAL;
1879 goto free_exit;
1880 }
1881
1882 tlen = PFKEY_EXTLEN(xpl0) - sizeof(*xpl0);
1883 xisr = (const struct sadb_x_ipsecrequest *)(xpl0 + 1);
1884
1885 while (tlen > 0) {
1886 /* length check */
1887 if (xisr->sadb_x_ipsecrequest_len < sizeof(*xisr)) {
1888 IPSECLOG(LOG_DEBUG, "invalid ipsecrequest length.\n");
1889 *error = EINVAL;
1890 goto free_exit;
1891 }
1892
1893 /* allocate request buffer */
1894 *p_isr = kmem_zalloc(sizeof(**p_isr), KM_SLEEP);
1895
1896 /* set values */
1897 (*p_isr)->next = NULL;
1898
1899 switch (xisr->sadb_x_ipsecrequest_proto) {
1900 case IPPROTO_ESP:
1901 case IPPROTO_AH:
1902 case IPPROTO_IPCOMP:
1903 break;
1904 default:
1905 IPSECLOG(LOG_DEBUG, "invalid proto type=%u\n",
1906 xisr->sadb_x_ipsecrequest_proto);
1907 *error = EPROTONOSUPPORT;
1908 goto free_exit;
1909 }
1910 (*p_isr)->saidx.proto = xisr->sadb_x_ipsecrequest_proto;
1911
1912 switch (xisr->sadb_x_ipsecrequest_mode) {
1913 case IPSEC_MODE_TRANSPORT:
1914 case IPSEC_MODE_TUNNEL:
1915 break;
1916 case IPSEC_MODE_ANY:
1917 default:
1918 IPSECLOG(LOG_DEBUG, "invalid mode=%u\n",
1919 xisr->sadb_x_ipsecrequest_mode);
1920 *error = EINVAL;
1921 goto free_exit;
1922 }
1923 (*p_isr)->saidx.mode = xisr->sadb_x_ipsecrequest_mode;
1924
1925 switch (xisr->sadb_x_ipsecrequest_level) {
1926 case IPSEC_LEVEL_DEFAULT:
1927 case IPSEC_LEVEL_USE:
1928 case IPSEC_LEVEL_REQUIRE:
1929 break;
1930 case IPSEC_LEVEL_UNIQUE:
1931 xisr_reqid = xisr->sadb_x_ipsecrequest_reqid;
1932 /* validity check */
1933 /*
1934 * case 1) from_kernel == false
1935 * That means the request comes from userland.
1936 * If range violation of reqid, kernel will
1937 * update it, don't refuse it.
1938 *
1939 * case 2) from_kernel == true
1940 * That means the request comes from kernel
1941 * (e.g. ipsec(4) I/F).
1942 * Use thre requested reqid to avoid inconsistency
1943 * between kernel's reqid and the reqid in pf_key
1944 * message sent to userland. The pf_key message is
1945 * built by diverting request mbuf.
1946 */
1947 if (!from_kernel &&
1948 xisr_reqid > IPSEC_MANUAL_REQID_MAX) {
1949 IPSECLOG(LOG_DEBUG,
1950 "reqid=%d range "
1951 "violation, updated by kernel.\n",
1952 xisr_reqid);
1953 xisr_reqid = 0;
1954 }
1955
1956 /* allocate new reqid id if reqid is zero. */
1957 if (xisr_reqid == 0) {
1958 u_int16_t reqid = key_newreqid();
1959 if (reqid == 0) {
1960 *error = ENOBUFS;
1961 goto free_exit;
1962 }
1963 (*p_isr)->saidx.reqid = reqid;
1964 } else {
1965 /* set it for manual keying. */
1966 (*p_isr)->saidx.reqid = xisr_reqid;
1967 }
1968 break;
1969
1970 default:
1971 IPSECLOG(LOG_DEBUG, "invalid level=%u\n",
1972 xisr->sadb_x_ipsecrequest_level);
1973 *error = EINVAL;
1974 goto free_exit;
1975 }
1976 (*p_isr)->level = xisr->sadb_x_ipsecrequest_level;
1977
1978 /* set IP addresses if there */
1979 /*
1980 * NOTE:
1981 * MOBIKE Extensions for PF_KEY draft says:
1982 * If tunnel mode is specified, the sadb_x_ipsecrequest
1983 * structure is followed by two sockaddr structures that
1984 * define the tunnel endpoint addresses. In the case that
1985 * transport mode is used, no additional addresses are
1986 * specified.
1987 * see: https://tools.ietf.org/html/draft-schilcher-mobike-pfkey-extension-01
1988 *
1989 * And then, the IP addresses will be set by
1990 * ipsec_fill_saidx_bymbuf() from packet in transport mode.
1991 * This behavior is used by NAT-T enabled ipsecif(4).
1992 */
1993 if (xisr->sadb_x_ipsecrequest_len > sizeof(*xisr)) {
1994 const struct sockaddr *paddr;
1995
1996 paddr = (const struct sockaddr *)(xisr + 1);
1997
1998 /* validity check */
1999 if (paddr->sa_len > sizeof((*p_isr)->saidx.src)) {
2000 IPSECLOG(LOG_DEBUG, "invalid request "
2001 "address length.\n");
2002 *error = EINVAL;
2003 goto free_exit;
2004 }
2005 memcpy(&(*p_isr)->saidx.src, paddr, paddr->sa_len);
2006
2007 paddr = (const struct sockaddr *)((const char *)paddr
2008 + paddr->sa_len);
2009
2010 /* validity check */
2011 if (paddr->sa_len > sizeof((*p_isr)->saidx.dst)) {
2012 IPSECLOG(LOG_DEBUG, "invalid request "
2013 "address length.\n");
2014 *error = EINVAL;
2015 goto free_exit;
2016 }
2017 memcpy(&(*p_isr)->saidx.dst, paddr, paddr->sa_len);
2018 }
2019
2020 (*p_isr)->sp = newsp;
2021
2022 /* initialization for the next. */
2023 p_isr = &(*p_isr)->next;
2024 tlen -= xisr->sadb_x_ipsecrequest_len;
2025
2026 /* validity check */
2027 if (tlen < 0) {
2028 IPSECLOG(LOG_DEBUG, "becoming tlen < 0.\n");
2029 *error = EINVAL;
2030 goto free_exit;
2031 }
2032
2033 xisr = (const struct sadb_x_ipsecrequest *)((const char *)xisr +
2034 xisr->sadb_x_ipsecrequest_len);
2035 }
2036 }
2037
2038 *error = 0;
2039 return newsp;
2040
2041 free_exit:
2042 key_free_sp(newsp);
2043 return NULL;
2044 }
2045
2046 struct secpolicy *
key_msg2sp(const struct sadb_x_policy * xpl0,size_t len,int * error)2047 key_msg2sp(const struct sadb_x_policy *xpl0, size_t len, int *error)
2048 {
2049
2050 return _key_msg2sp(xpl0, len, error, false);
2051 }
2052
2053 u_int16_t
key_newreqid(void)2054 key_newreqid(void)
2055 {
2056 static u_int16_t auto_reqid = IPSEC_MANUAL_REQID_MAX + 1;
2057
2058 auto_reqid = (auto_reqid == 0xffff ?
2059 IPSEC_MANUAL_REQID_MAX + 1 : auto_reqid + 1);
2060
2061 /* XXX should be unique check */
2062
2063 return auto_reqid;
2064 }
2065
2066 /*
2067 * copy secpolicy struct to sadb_x_policy structure indicated.
2068 */
2069 struct mbuf *
key_sp2msg(const struct secpolicy * sp,int mflag)2070 key_sp2msg(const struct secpolicy *sp, int mflag)
2071 {
2072 struct sadb_x_policy *xpl;
2073 int tlen;
2074 char *p;
2075 struct mbuf *m;
2076
2077 KASSERT(sp != NULL);
2078
2079 tlen = key_getspreqmsglen(sp);
2080
2081 m = key_alloc_mbuf(tlen, mflag);
2082 if (!m || m->m_next) { /*XXX*/
2083 m_freem(m);
2084 return NULL;
2085 }
2086
2087 m->m_len = tlen;
2088 m->m_next = NULL;
2089 xpl = mtod(m, struct sadb_x_policy *);
2090 memset(xpl, 0, tlen);
2091
2092 xpl->sadb_x_policy_len = PFKEY_UNIT64(tlen);
2093 xpl->sadb_x_policy_exttype = SADB_X_EXT_POLICY;
2094 xpl->sadb_x_policy_type = sp->policy;
2095 xpl->sadb_x_policy_dir = sp->spidx.dir;
2096 xpl->sadb_x_policy_id = sp->id;
2097 if (sp->origin == IPSEC_SPORIGIN_KERNEL)
2098 xpl->sadb_x_policy_flags |= IPSEC_POLICY_FLAG_ORIGIN_KERNEL;
2099 p = (char *)xpl + sizeof(*xpl);
2100
2101 /* if is the policy for ipsec ? */
2102 if (sp->policy == IPSEC_POLICY_IPSEC) {
2103 struct sadb_x_ipsecrequest *xisr;
2104 struct ipsecrequest *isr;
2105
2106 for (isr = sp->req; isr != NULL; isr = isr->next) {
2107
2108 xisr = (struct sadb_x_ipsecrequest *)p;
2109
2110 xisr->sadb_x_ipsecrequest_proto = isr->saidx.proto;
2111 xisr->sadb_x_ipsecrequest_mode = isr->saidx.mode;
2112 xisr->sadb_x_ipsecrequest_level = isr->level;
2113 xisr->sadb_x_ipsecrequest_reqid = isr->saidx.reqid;
2114
2115 p += sizeof(*xisr);
2116 memcpy(p, &isr->saidx.src, isr->saidx.src.sa.sa_len);
2117 p += isr->saidx.src.sa.sa_len;
2118 memcpy(p, &isr->saidx.dst, isr->saidx.dst.sa.sa_len);
2119 p += isr->saidx.src.sa.sa_len;
2120
2121 xisr->sadb_x_ipsecrequest_len =
2122 PFKEY_ALIGN8(sizeof(*xisr)
2123 + isr->saidx.src.sa.sa_len
2124 + isr->saidx.dst.sa.sa_len);
2125 }
2126 }
2127
2128 return m;
2129 }
2130
2131 /*
2132 * m will not be freed nor modified. It never return NULL.
2133 * If it returns a mbuf of M_PKTHDR, the mbuf ensures to have
2134 * contiguous length at least sizeof(struct sadb_msg).
2135 */
2136 static struct mbuf *
key_gather_mbuf(struct mbuf * m,const struct sadb_msghdr * mhp,int ndeep,int nitem,...)2137 key_gather_mbuf(struct mbuf *m, const struct sadb_msghdr *mhp,
2138 int ndeep, int nitem, ...)
2139 {
2140 va_list ap;
2141 int idx;
2142 int i;
2143 struct mbuf *result = NULL, *n;
2144 int len;
2145
2146 KASSERT(m != NULL);
2147 KASSERT(mhp != NULL);
2148 KASSERT(!cpu_softintr_p());
2149
2150 va_start(ap, nitem);
2151 for (i = 0; i < nitem; i++) {
2152 idx = va_arg(ap, int);
2153 KASSERT(idx >= 0);
2154 KASSERT(idx <= SADB_EXT_MAX);
2155 /* don't attempt to pull empty extension */
2156 if (idx == SADB_EXT_RESERVED && mhp->msg == NULL)
2157 continue;
2158 if (idx != SADB_EXT_RESERVED &&
2159 (mhp->ext[idx] == NULL || mhp->extlen[idx] == 0))
2160 continue;
2161
2162 if (idx == SADB_EXT_RESERVED) {
2163 CTASSERT(PFKEY_ALIGN8(sizeof(struct sadb_msg)) <= MHLEN);
2164 len = PFKEY_ALIGN8(sizeof(struct sadb_msg));
2165 MGETHDR(n, M_WAITOK, MT_DATA);
2166 n->m_len = len;
2167 n->m_next = NULL;
2168 m_copydata(m, 0, sizeof(struct sadb_msg),
2169 mtod(n, void *));
2170 } else if (i < ndeep) {
2171 len = mhp->extlen[idx];
2172 n = key_alloc_mbuf(len, M_WAITOK);
2173 KASSERT(n->m_next == NULL);
2174 m_copydata(m, mhp->extoff[idx], mhp->extlen[idx],
2175 mtod(n, void *));
2176 } else {
2177 n = m_copym(m, mhp->extoff[idx], mhp->extlen[idx],
2178 M_WAITOK);
2179 }
2180 KASSERT(n != NULL);
2181
2182 if (result)
2183 m_cat(result, n);
2184 else
2185 result = n;
2186 }
2187 va_end(ap);
2188
2189 KASSERT(result != NULL);
2190 if ((result->m_flags & M_PKTHDR) != 0) {
2191 result->m_pkthdr.len = 0;
2192 for (n = result; n; n = n->m_next)
2193 result->m_pkthdr.len += n->m_len;
2194 KASSERT(result->m_len >= sizeof(struct sadb_msg));
2195 }
2196
2197 return result;
2198 }
2199
2200 /*
2201 * The argument _sp must not overwrite until SP is created and registered
2202 * successfully.
2203 */
2204 static int
key_spdadd(struct socket * so,struct mbuf * m,const struct sadb_msghdr * mhp,struct secpolicy ** _sp,bool from_kernel)2205 key_spdadd(struct socket *so, struct mbuf *m,
2206 const struct sadb_msghdr *mhp, struct secpolicy **_sp,
2207 bool from_kernel)
2208 {
2209 const struct sockaddr *src, *dst;
2210 const struct sadb_x_policy *xpl0;
2211 struct sadb_x_policy *xpl;
2212 const struct sadb_lifetime *lft = NULL;
2213 struct secpolicyindex spidx;
2214 struct secpolicy *newsp;
2215 int error;
2216 uint32_t sadb_x_policy_id;
2217
2218 if (mhp->ext[SADB_EXT_ADDRESS_SRC] == NULL ||
2219 mhp->ext[SADB_EXT_ADDRESS_DST] == NULL ||
2220 mhp->ext[SADB_X_EXT_POLICY] == NULL) {
2221 IPSECLOG(LOG_DEBUG, "invalid message is passed.\n");
2222 return key_senderror(so, m, EINVAL);
2223 }
2224 if (mhp->extlen[SADB_EXT_ADDRESS_SRC] < sizeof(struct sadb_address) ||
2225 mhp->extlen[SADB_EXT_ADDRESS_DST] < sizeof(struct sadb_address) ||
2226 mhp->extlen[SADB_X_EXT_POLICY] < sizeof(struct sadb_x_policy)) {
2227 IPSECLOG(LOG_DEBUG, "invalid message is passed.\n");
2228 return key_senderror(so, m, EINVAL);
2229 }
2230 if (mhp->ext[SADB_EXT_LIFETIME_HARD] != NULL) {
2231 if (mhp->extlen[SADB_EXT_LIFETIME_HARD] <
2232 sizeof(struct sadb_lifetime)) {
2233 IPSECLOG(LOG_DEBUG, "invalid message is passed.\n");
2234 return key_senderror(so, m, EINVAL);
2235 }
2236 lft = mhp->ext[SADB_EXT_LIFETIME_HARD];
2237 }
2238
2239 xpl0 = mhp->ext[SADB_X_EXT_POLICY];
2240
2241 /* checking the direction. */
2242 switch (xpl0->sadb_x_policy_dir) {
2243 case IPSEC_DIR_INBOUND:
2244 case IPSEC_DIR_OUTBOUND:
2245 break;
2246 default:
2247 IPSECLOG(LOG_DEBUG, "Invalid SP direction.\n");
2248 return key_senderror(so, m, EINVAL);
2249 }
2250
2251 /* check policy */
2252 /* key_api_spdadd() accepts DISCARD, NONE and IPSEC. */
2253 if (xpl0->sadb_x_policy_type == IPSEC_POLICY_ENTRUST ||
2254 xpl0->sadb_x_policy_type == IPSEC_POLICY_BYPASS) {
2255 IPSECLOG(LOG_DEBUG, "Invalid policy type.\n");
2256 return key_senderror(so, m, EINVAL);
2257 }
2258
2259 /* policy requests are mandatory when action is ipsec. */
2260 if (mhp->msg->sadb_msg_type != SADB_X_SPDSETIDX &&
2261 xpl0->sadb_x_policy_type == IPSEC_POLICY_IPSEC &&
2262 mhp->extlen[SADB_X_EXT_POLICY] <= sizeof(*xpl0)) {
2263 IPSECLOG(LOG_DEBUG, "some policy requests part required.\n");
2264 return key_senderror(so, m, EINVAL);
2265 }
2266
2267 src = key_msghdr_get_sockaddr(mhp, SADB_EXT_ADDRESS_SRC);
2268 dst = key_msghdr_get_sockaddr(mhp, SADB_EXT_ADDRESS_DST);
2269
2270 /* sanity check on addr pair */
2271 if (src->sa_family != dst->sa_family)
2272 return key_senderror(so, m, EINVAL);
2273 if (src->sa_len != dst->sa_len)
2274 return key_senderror(so, m, EINVAL);
2275
2276 key_init_spidx_bymsghdr(&spidx, mhp);
2277
2278 /*
2279 * checking there is SP already or not.
2280 * SPDUPDATE doesn't depend on whether there is a SP or not.
2281 * If the type is either SPDADD or SPDSETIDX AND a SP is found,
2282 * then error.
2283 */
2284 {
2285 struct secpolicy *sp;
2286
2287 if (mhp->msg->sadb_msg_type == SADB_X_SPDUPDATE) {
2288 sp = key_lookup_and_remove_sp(&spidx, from_kernel);
2289 if (sp != NULL)
2290 key_destroy_sp(sp);
2291 } else {
2292 sp = key_getsp(&spidx);
2293 if (sp != NULL) {
2294 KEY_SP_UNREF(&sp);
2295 IPSECLOG(LOG_DEBUG, "a SP entry exists already.\n");
2296 return key_senderror(so, m, EEXIST);
2297 }
2298 }
2299 }
2300
2301 /* allocation new SP entry */
2302 newsp = _key_msg2sp(xpl0, PFKEY_EXTLEN(xpl0), &error, from_kernel);
2303 if (newsp == NULL) {
2304 return key_senderror(so, m, error);
2305 }
2306
2307 newsp->id = key_getnewspid();
2308 if (newsp->id == 0) {
2309 kmem_free(newsp, sizeof(*newsp));
2310 return key_senderror(so, m, ENOBUFS);
2311 }
2312
2313 newsp->spidx = spidx;
2314 newsp->created = time_uptime;
2315 newsp->lastused = newsp->created;
2316 newsp->lifetime = lft ? lft->sadb_lifetime_addtime : 0;
2317 newsp->validtime = lft ? lft->sadb_lifetime_usetime : 0;
2318 if (from_kernel)
2319 newsp->origin = IPSEC_SPORIGIN_KERNEL;
2320 else
2321 newsp->origin = IPSEC_SPORIGIN_USER;
2322
2323 key_init_sp(newsp);
2324 if (from_kernel)
2325 KEY_SP_REF(newsp);
2326
2327 sadb_x_policy_id = newsp->id;
2328
2329 if (_sp != NULL)
2330 *_sp = newsp;
2331
2332 mutex_enter(&key_spd.lock);
2333 SPLIST_WRITER_INSERT_TAIL(newsp->spidx.dir, newsp);
2334 mutex_exit(&key_spd.lock);
2335 /*
2336 * We don't have a reference to newsp, so we must not touch newsp from
2337 * now on. If you want to do, you must take a reference beforehand.
2338 */
2339 newsp = NULL;
2340
2341 #ifdef notyet
2342 /* delete the entry in key_misc.spacqlist */
2343 if (mhp->msg->sadb_msg_type == SADB_X_SPDUPDATE) {
2344 struct secspacq *spacq = key_getspacq(&spidx);
2345 if (spacq != NULL) {
2346 /* reset counter in order to deletion by timehandler. */
2347 spacq->created = time_uptime;
2348 spacq->count = 0;
2349 }
2350 }
2351 #endif
2352
2353 /* Invalidate all cached SPD pointers in the PCBs. */
2354 ipsec_invalpcbcacheall();
2355
2356 #if defined(GATEWAY)
2357 /* Invalidate the ipflow cache, as well. */
2358 ipflow_invalidate_all(0);
2359 #ifdef INET6
2360 if (in6_present)
2361 ip6flow_invalidate_all(0);
2362 #endif /* INET6 */
2363 #endif /* GATEWAY */
2364
2365 key_update_used();
2366
2367 {
2368 struct mbuf *n, *mpolicy;
2369 int off;
2370
2371 /* create new sadb_msg to reply. */
2372 if (lft) {
2373 n = key_gather_mbuf(m, mhp, 2, 5, SADB_EXT_RESERVED,
2374 SADB_X_EXT_POLICY, SADB_EXT_LIFETIME_HARD,
2375 SADB_EXT_ADDRESS_SRC, SADB_EXT_ADDRESS_DST);
2376 } else {
2377 n = key_gather_mbuf(m, mhp, 2, 4, SADB_EXT_RESERVED,
2378 SADB_X_EXT_POLICY,
2379 SADB_EXT_ADDRESS_SRC, SADB_EXT_ADDRESS_DST);
2380 }
2381
2382 key_fill_replymsg(n, 0);
2383 off = 0;
2384 mpolicy = m_pulldown(n, PFKEY_ALIGN8(sizeof(struct sadb_msg)),
2385 sizeof(*xpl), &off);
2386 if (mpolicy == NULL) {
2387 /* n is already freed */
2388 /*
2389 * valid sp has been created, so we does not overwrite _sp
2390 * NULL here. let caller decide to use the sp or not.
2391 */
2392 return key_senderror(so, m, ENOBUFS);
2393 }
2394 xpl = (struct sadb_x_policy *)(mtod(mpolicy, char *) + off);
2395 if (xpl->sadb_x_policy_exttype != SADB_X_EXT_POLICY) {
2396 m_freem(n);
2397 /* ditto */
2398 return key_senderror(so, m, EINVAL);
2399 }
2400
2401 xpl->sadb_x_policy_id = sadb_x_policy_id;
2402
2403 m_freem(m);
2404 return key_sendup_mbuf(so, n, KEY_SENDUP_ALL);
2405 }
2406 }
2407
2408 /*
2409 * SADB_X_SPDADD, SADB_X_SPDSETIDX or SADB_X_SPDUPDATE processing
2410 * add an entry to SP database, when received
2411 * <base, address(SD), (lifetime(H),) policy>
2412 * from the user(?).
2413 * Adding to SP database,
2414 * and send
2415 * <base, address(SD), (lifetime(H),) policy>
2416 * to the socket which was send.
2417 *
2418 * SPDADD set a unique policy entry.
2419 * SPDSETIDX like SPDADD without a part of policy requests.
2420 * SPDUPDATE replace a unique policy entry.
2421 *
2422 * m will always be freed.
2423 */
2424 static int
key_api_spdadd(struct socket * so,struct mbuf * m,const struct sadb_msghdr * mhp)2425 key_api_spdadd(struct socket *so, struct mbuf *m,
2426 const struct sadb_msghdr *mhp)
2427 {
2428
2429 return key_spdadd(so, m, mhp, NULL, false);
2430 }
2431
2432 struct secpolicy *
key_kpi_spdadd(struct mbuf * m)2433 key_kpi_spdadd(struct mbuf *m)
2434 {
2435 struct sadb_msghdr mh;
2436 int error;
2437 struct secpolicy *sp = NULL;
2438
2439 error = key_align(m, &mh);
2440 if (error)
2441 return NULL;
2442
2443 error = key_spdadd(NULL, m, &mh, &sp, true);
2444 if (error) {
2445 /*
2446 * Currently, when key_spdadd() cannot send a PFKEY message
2447 * which means SP has been created, key_spdadd() returns error
2448 * although SP is created successfully.
2449 * Kernel components would not care PFKEY messages, so return
2450 * the "sp" regardless of error code. key_spdadd() overwrites
2451 * the argument only if SP is created successfully.
2452 */
2453 }
2454 return sp;
2455 }
2456
2457 /*
2458 * get new policy id.
2459 * OUT:
2460 * 0: failure.
2461 * others: success.
2462 */
2463 static u_int32_t
key_getnewspid(void)2464 key_getnewspid(void)
2465 {
2466 u_int32_t newid = 0;
2467 int count = key_spi_trycnt; /* XXX */
2468 struct secpolicy *sp;
2469
2470 /* when requesting to allocate spi ranged */
2471 while (count--) {
2472 newid = (policy_id = (policy_id == ~0 ? 1 : policy_id + 1));
2473
2474 sp = key_getspbyid(newid);
2475 if (sp == NULL)
2476 break;
2477
2478 KEY_SP_UNREF(&sp);
2479 }
2480
2481 if (count == 0 || newid == 0) {
2482 IPSECLOG(LOG_DEBUG, "to allocate policy id is failed.\n");
2483 return 0;
2484 }
2485
2486 return newid;
2487 }
2488
2489 /*
2490 * SADB_SPDDELETE processing
2491 * receive
2492 * <base, address(SD), policy(*)>
2493 * from the user(?), and set SADB_SASTATE_DEAD,
2494 * and send,
2495 * <base, address(SD), policy(*)>
2496 * to the ikmpd.
2497 * policy(*) including direction of policy.
2498 *
2499 * m will always be freed.
2500 */
2501 static int
key_api_spddelete(struct socket * so,struct mbuf * m,const struct sadb_msghdr * mhp)2502 key_api_spddelete(struct socket *so, struct mbuf *m,
2503 const struct sadb_msghdr *mhp)
2504 {
2505 struct sadb_x_policy *xpl0;
2506 struct secpolicyindex spidx;
2507 struct secpolicy *sp;
2508
2509 if (mhp->ext[SADB_EXT_ADDRESS_SRC] == NULL ||
2510 mhp->ext[SADB_EXT_ADDRESS_DST] == NULL ||
2511 mhp->ext[SADB_X_EXT_POLICY] == NULL) {
2512 IPSECLOG(LOG_DEBUG, "invalid message is passed.\n");
2513 return key_senderror(so, m, EINVAL);
2514 }
2515 if (mhp->extlen[SADB_EXT_ADDRESS_SRC] < sizeof(struct sadb_address) ||
2516 mhp->extlen[SADB_EXT_ADDRESS_DST] < sizeof(struct sadb_address) ||
2517 mhp->extlen[SADB_X_EXT_POLICY] < sizeof(struct sadb_x_policy)) {
2518 IPSECLOG(LOG_DEBUG, "invalid message is passed.\n");
2519 return key_senderror(so, m, EINVAL);
2520 }
2521
2522 xpl0 = mhp->ext[SADB_X_EXT_POLICY];
2523
2524 /* checking the direction. */
2525 switch (xpl0->sadb_x_policy_dir) {
2526 case IPSEC_DIR_INBOUND:
2527 case IPSEC_DIR_OUTBOUND:
2528 break;
2529 default:
2530 IPSECLOG(LOG_DEBUG, "Invalid SP direction.\n");
2531 return key_senderror(so, m, EINVAL);
2532 }
2533
2534 /* make secindex */
2535 key_init_spidx_bymsghdr(&spidx, mhp);
2536
2537 /* Is there SP in SPD ? */
2538 sp = key_lookup_and_remove_sp(&spidx, false);
2539 if (sp == NULL) {
2540 IPSECLOG(LOG_DEBUG, "no SP found.\n");
2541 return key_senderror(so, m, EINVAL);
2542 }
2543
2544 /* save policy id to buffer to be returned. */
2545 xpl0->sadb_x_policy_id = sp->id;
2546
2547 key_destroy_sp(sp);
2548
2549 /* We're deleting policy; no need to invalidate the ipflow cache. */
2550
2551 {
2552 struct mbuf *n;
2553
2554 /* create new sadb_msg to reply. */
2555 n = key_gather_mbuf(m, mhp, 1, 4, SADB_EXT_RESERVED,
2556 SADB_X_EXT_POLICY, SADB_EXT_ADDRESS_SRC, SADB_EXT_ADDRESS_DST);
2557 key_fill_replymsg(n, 0);
2558 m_freem(m);
2559 return key_sendup_mbuf(so, n, KEY_SENDUP_ALL);
2560 }
2561 }
2562
2563 static struct mbuf *
key_alloc_mbuf_simple(int len,int mflag)2564 key_alloc_mbuf_simple(int len, int mflag)
2565 {
2566 struct mbuf *n;
2567
2568 KASSERT(mflag == M_NOWAIT || (mflag == M_WAITOK && !cpu_softintr_p()));
2569
2570 MGETHDR(n, mflag, MT_DATA);
2571 if (n && len > MHLEN) {
2572 MCLGET(n, mflag);
2573 if ((n->m_flags & M_EXT) == 0) {
2574 m_freem(n);
2575 n = NULL;
2576 }
2577 }
2578 return n;
2579 }
2580
2581 /*
2582 * SADB_SPDDELETE2 processing
2583 * receive
2584 * <base, policy(*)>
2585 * from the user(?), and set SADB_SASTATE_DEAD,
2586 * and send,
2587 * <base, policy(*)>
2588 * to the ikmpd.
2589 * policy(*) including direction of policy.
2590 *
2591 * m will always be freed.
2592 */
2593 static int
key_spddelete2(struct socket * so,struct mbuf * m,const struct sadb_msghdr * mhp,bool from_kernel)2594 key_spddelete2(struct socket *so, struct mbuf *m,
2595 const struct sadb_msghdr *mhp, bool from_kernel)
2596 {
2597 u_int32_t id;
2598 struct secpolicy *sp;
2599 const struct sadb_x_policy *xpl;
2600
2601 if (mhp->ext[SADB_X_EXT_POLICY] == NULL ||
2602 mhp->extlen[SADB_X_EXT_POLICY] < sizeof(struct sadb_x_policy)) {
2603 IPSECLOG(LOG_DEBUG, "invalid message is passed.\n");
2604 return key_senderror(so, m, EINVAL);
2605 }
2606
2607 xpl = mhp->ext[SADB_X_EXT_POLICY];
2608 id = xpl->sadb_x_policy_id;
2609
2610 /* Is there SP in SPD ? */
2611 sp = key_lookupbyid_and_remove_sp(id, from_kernel);
2612 if (sp == NULL) {
2613 IPSECLOG(LOG_DEBUG, "no SP found id:%u.\n", id);
2614 return key_senderror(so, m, EINVAL);
2615 }
2616
2617 key_destroy_sp(sp);
2618
2619 /* We're deleting policy; no need to invalidate the ipflow cache. */
2620
2621 {
2622 struct mbuf *n, *nn;
2623 int off, len;
2624
2625 CTASSERT(PFKEY_ALIGN8(sizeof(struct sadb_msg)) <= MCLBYTES);
2626
2627 /* create new sadb_msg to reply. */
2628 len = PFKEY_ALIGN8(sizeof(struct sadb_msg));
2629
2630 n = key_alloc_mbuf_simple(len, M_WAITOK);
2631 n->m_len = len;
2632 n->m_next = NULL;
2633 off = 0;
2634
2635 m_copydata(m, 0, sizeof(struct sadb_msg), mtod(n, char *) + off);
2636 off += PFKEY_ALIGN8(sizeof(struct sadb_msg));
2637
2638 KASSERTMSG(off == len, "length inconsistency");
2639
2640 n->m_next = m_copym(m, mhp->extoff[SADB_X_EXT_POLICY],
2641 mhp->extlen[SADB_X_EXT_POLICY], M_WAITOK);
2642
2643 n->m_pkthdr.len = 0;
2644 for (nn = n; nn; nn = nn->m_next)
2645 n->m_pkthdr.len += nn->m_len;
2646
2647 key_fill_replymsg(n, 0);
2648 m_freem(m);
2649 return key_sendup_mbuf(so, n, KEY_SENDUP_ALL);
2650 }
2651 }
2652
2653 /*
2654 * SADB_SPDDELETE2 processing
2655 * receive
2656 * <base, policy(*)>
2657 * from the user(?), and set SADB_SASTATE_DEAD,
2658 * and send,
2659 * <base, policy(*)>
2660 * to the ikmpd.
2661 * policy(*) including direction of policy.
2662 *
2663 * m will always be freed.
2664 */
2665 static int
key_api_spddelete2(struct socket * so,struct mbuf * m,const struct sadb_msghdr * mhp)2666 key_api_spddelete2(struct socket *so, struct mbuf *m,
2667 const struct sadb_msghdr *mhp)
2668 {
2669
2670 return key_spddelete2(so, m, mhp, false);
2671 }
2672
2673 int
key_kpi_spddelete2(struct mbuf * m)2674 key_kpi_spddelete2(struct mbuf *m)
2675 {
2676 struct sadb_msghdr mh;
2677 int error;
2678
2679 error = key_align(m, &mh);
2680 if (error)
2681 return EINVAL;
2682
2683 return key_spddelete2(NULL, m, &mh, true);
2684 }
2685
2686 /*
2687 * SADB_X_GET processing
2688 * receive
2689 * <base, policy(*)>
2690 * from the user(?),
2691 * and send,
2692 * <base, address(SD), policy>
2693 * to the ikmpd.
2694 * policy(*) including direction of policy.
2695 *
2696 * m will always be freed.
2697 */
2698 static int
key_api_spdget(struct socket * so,struct mbuf * m,const struct sadb_msghdr * mhp)2699 key_api_spdget(struct socket *so, struct mbuf *m,
2700 const struct sadb_msghdr *mhp)
2701 {
2702 u_int32_t id;
2703 struct secpolicy *sp;
2704 struct mbuf *n;
2705 const struct sadb_x_policy *xpl;
2706
2707 if (mhp->ext[SADB_X_EXT_POLICY] == NULL ||
2708 mhp->extlen[SADB_X_EXT_POLICY] < sizeof(struct sadb_x_policy)) {
2709 IPSECLOG(LOG_DEBUG, "invalid message is passed.\n");
2710 return key_senderror(so, m, EINVAL);
2711 }
2712
2713 xpl = mhp->ext[SADB_X_EXT_POLICY];
2714 id = xpl->sadb_x_policy_id;
2715
2716 /* Is there SP in SPD ? */
2717 sp = key_getspbyid(id);
2718 if (sp == NULL) {
2719 IPSECLOG(LOG_DEBUG, "no SP found id:%u.\n", id);
2720 return key_senderror(so, m, ENOENT);
2721 }
2722
2723 n = key_setdumpsp(sp, SADB_X_SPDGET, mhp->msg->sadb_msg_seq,
2724 mhp->msg->sadb_msg_pid);
2725 KEY_SP_UNREF(&sp); /* ref gained by key_getspbyid */
2726 m_freem(m);
2727 return key_sendup_mbuf(so, n, KEY_SENDUP_ONE);
2728 }
2729
2730 #ifdef notyet
2731 /*
2732 * SADB_X_SPDACQUIRE processing.
2733 * Acquire policy and SA(s) for a *OUTBOUND* packet.
2734 * send
2735 * <base, policy(*)>
2736 * to KMD, and expect to receive
2737 * <base> with SADB_X_SPDACQUIRE if error occurred,
2738 * or
2739 * <base, policy>
2740 * with SADB_X_SPDUPDATE from KMD by PF_KEY.
2741 * policy(*) is without policy requests.
2742 *
2743 * 0 : succeed
2744 * others: error number
2745 */
2746 int
key_spdacquire(const struct secpolicy * sp)2747 key_spdacquire(const struct secpolicy *sp)
2748 {
2749 struct mbuf *result = NULL, *m;
2750 struct secspacq *newspacq;
2751 int error;
2752
2753 KASSERT(sp != NULL);
2754 KASSERTMSG(sp->req == NULL, "called but there is request");
2755 KASSERTMSG(sp->policy == IPSEC_POLICY_IPSEC,
2756 "policy mismathed. IPsec is expected");
2757
2758 /* Get an entry to check whether sent message or not. */
2759 newspacq = key_getspacq(&sp->spidx);
2760 if (newspacq != NULL) {
2761 if (key_blockacq_count < newspacq->count) {
2762 /* reset counter and do send message. */
2763 newspacq->count = 0;
2764 } else {
2765 /* increment counter and do nothing. */
2766 newspacq->count++;
2767 return 0;
2768 }
2769 } else {
2770 /* make new entry for blocking to send SADB_ACQUIRE. */
2771 newspacq = key_newspacq(&sp->spidx);
2772 if (newspacq == NULL)
2773 return ENOBUFS;
2774
2775 /* add to key_misc.acqlist */
2776 LIST_INSERT_HEAD(&key_misc.spacqlist, newspacq, chain);
2777 }
2778
2779 /* create new sadb_msg to reply. */
2780 m = key_setsadbmsg(SADB_X_SPDACQUIRE, 0, 0, 0, 0, 0);
2781 if (!m) {
2782 error = ENOBUFS;
2783 goto fail;
2784 }
2785 result = m;
2786
2787 result->m_pkthdr.len = 0;
2788 for (m = result; m; m = m->m_next)
2789 result->m_pkthdr.len += m->m_len;
2790
2791 mtod(result, struct sadb_msg *)->sadb_msg_len =
2792 PFKEY_UNIT64(result->m_pkthdr.len);
2793
2794 return key_sendup_mbuf(NULL, m, KEY_SENDUP_REGISTERED);
2795
2796 fail:
2797 m_freem(result);
2798 return error;
2799 }
2800 #endif /* notyet */
2801
2802 /*
2803 * SADB_SPDFLUSH processing
2804 * receive
2805 * <base>
2806 * from the user, and free all entries in secpctree.
2807 * and send,
2808 * <base>
2809 * to the user.
2810 * NOTE: what to do is only marking SADB_SASTATE_DEAD.
2811 *
2812 * m will always be freed.
2813 */
2814 static int
key_api_spdflush(struct socket * so,struct mbuf * m,const struct sadb_msghdr * mhp)2815 key_api_spdflush(struct socket *so, struct mbuf *m,
2816 const struct sadb_msghdr *mhp)
2817 {
2818 struct sadb_msg *newmsg;
2819 struct secpolicy *sp;
2820 u_int dir;
2821
2822 if (m->m_len != PFKEY_ALIGN8(sizeof(struct sadb_msg)))
2823 return key_senderror(so, m, EINVAL);
2824
2825 for (dir = 0; dir < IPSEC_DIR_MAX; dir++) {
2826 retry:
2827 mutex_enter(&key_spd.lock);
2828 SPLIST_WRITER_FOREACH(sp, dir) {
2829 KASSERTMSG(sp->state != IPSEC_SPSTATE_DEAD,
2830 "sp->state=%u", sp->state);
2831 /*
2832 * Userlang programs can remove SPs created by userland
2833 * probrams only, that is, they cannot remove SPs
2834 * created in kernel(e.g. ipsec(4) I/F).
2835 */
2836 if (sp->origin == IPSEC_SPORIGIN_USER) {
2837 key_unlink_sp(sp);
2838 mutex_exit(&key_spd.lock);
2839 key_destroy_sp(sp);
2840 goto retry;
2841 }
2842 }
2843 mutex_exit(&key_spd.lock);
2844 }
2845
2846 /* We're deleting policy; no need to invalidate the ipflow cache. */
2847
2848 if (sizeof(struct sadb_msg) > m->m_len + M_TRAILINGSPACE(m)) {
2849 IPSECLOG(LOG_DEBUG, "No more memory.\n");
2850 return key_senderror(so, m, ENOBUFS);
2851 }
2852
2853 m_freem(m->m_next);
2854 m->m_next = NULL;
2855 m->m_pkthdr.len = m->m_len = PFKEY_ALIGN8(sizeof(struct sadb_msg));
2856 newmsg = mtod(m, struct sadb_msg *);
2857 newmsg->sadb_msg_errno = 0;
2858 newmsg->sadb_msg_len = PFKEY_UNIT64(m->m_pkthdr.len);
2859
2860 return key_sendup_mbuf(so, m, KEY_SENDUP_ALL);
2861 }
2862
2863 static struct sockaddr key_src = {
2864 .sa_len = 2,
2865 .sa_family = PF_KEY,
2866 };
2867
2868 static struct mbuf *
key_setspddump_chain(int * errorp,int * lenp,pid_t pid)2869 key_setspddump_chain(int *errorp, int *lenp, pid_t pid)
2870 {
2871 struct secpolicy *sp;
2872 int cnt;
2873 u_int dir;
2874 struct mbuf *m, *n, *prev;
2875 int totlen;
2876
2877 KASSERT(mutex_owned(&key_spd.lock));
2878
2879 *lenp = 0;
2880
2881 /* search SPD entry and get buffer size. */
2882 cnt = 0;
2883 for (dir = 0; dir < IPSEC_DIR_MAX; dir++) {
2884 SPLIST_WRITER_FOREACH(sp, dir) {
2885 cnt++;
2886 }
2887 }
2888
2889 if (cnt == 0) {
2890 *errorp = ENOENT;
2891 return (NULL);
2892 }
2893
2894 m = NULL;
2895 prev = m;
2896 totlen = 0;
2897 for (dir = 0; dir < IPSEC_DIR_MAX; dir++) {
2898 SPLIST_WRITER_FOREACH(sp, dir) {
2899 --cnt;
2900 n = key_setdumpsp(sp, SADB_X_SPDDUMP, cnt, pid);
2901
2902 totlen += n->m_pkthdr.len;
2903 if (!m) {
2904 m = n;
2905 } else {
2906 prev->m_nextpkt = n;
2907 }
2908 prev = n;
2909 }
2910 }
2911
2912 *lenp = totlen;
2913 *errorp = 0;
2914 return (m);
2915 }
2916
2917 /*
2918 * SADB_SPDDUMP processing
2919 * receive
2920 * <base>
2921 * from the user, and dump all SP leaves
2922 * and send,
2923 * <base> .....
2924 * to the ikmpd.
2925 *
2926 * m will always be freed.
2927 */
2928 static int
key_api_spddump(struct socket * so,struct mbuf * m0,const struct sadb_msghdr * mhp)2929 key_api_spddump(struct socket *so, struct mbuf *m0,
2930 const struct sadb_msghdr *mhp)
2931 {
2932 struct mbuf *n;
2933 int error, len;
2934 int ok;
2935 pid_t pid;
2936
2937 pid = mhp->msg->sadb_msg_pid;
2938 /*
2939 * If the requestor has insufficient socket-buffer space
2940 * for the entire chain, nobody gets any response to the DUMP.
2941 * XXX For now, only the requestor ever gets anything.
2942 * Moreover, if the requestor has any space at all, they receive
2943 * the entire chain, otherwise the request is refused with ENOBUFS.
2944 */
2945 if (sbspace(&so->so_rcv) <= 0) {
2946 return key_senderror(so, m0, ENOBUFS);
2947 }
2948
2949 mutex_enter(&key_spd.lock);
2950 n = key_setspddump_chain(&error, &len, pid);
2951 mutex_exit(&key_spd.lock);
2952
2953 if (n == NULL) {
2954 return key_senderror(so, m0, ENOENT);
2955 }
2956 {
2957 net_stat_ref_t ps = PFKEY_STAT_GETREF();
2958 _NET_STATINC_REF(ps, PFKEY_STAT_IN_TOTAL);
2959 _NET_STATADD_REF(ps, PFKEY_STAT_IN_BYTES, len);
2960 PFKEY_STAT_PUTREF();
2961 }
2962
2963 /*
2964 * PF_KEY DUMP responses are no longer broadcast to all PF_KEY sockets.
2965 * The requestor receives either the entire chain, or an
2966 * error message with ENOBUFS.
2967 */
2968
2969 /*
2970 * sbappendchainwith record takes the chain of entries, one
2971 * packet-record per SPD entry, prepends the key_src sockaddr
2972 * to each packet-record, links the sockaddr mbufs into a new
2973 * list of records, then appends the entire resulting
2974 * list to the requesting socket.
2975 */
2976 ok = sbappendaddrchain(&so->so_rcv, (struct sockaddr *)&key_src, n,
2977 SB_PRIO_ONESHOT_OVERFLOW);
2978
2979 if (!ok) {
2980 PFKEY_STATINC(PFKEY_STAT_IN_NOMEM);
2981 m_freem(n);
2982 return key_senderror(so, m0, ENOBUFS);
2983 }
2984
2985 m_freem(m0);
2986 return error;
2987 }
2988
2989 /*
2990 * SADB_X_NAT_T_NEW_MAPPING. Unused by racoon as of 2005/04/23
2991 */
2992 static int
key_api_nat_map(struct socket * so,struct mbuf * m,const struct sadb_msghdr * mhp)2993 key_api_nat_map(struct socket *so, struct mbuf *m,
2994 const struct sadb_msghdr *mhp)
2995 {
2996 struct sadb_x_nat_t_type *type;
2997 struct sadb_x_nat_t_port *sport;
2998 struct sadb_x_nat_t_port *dport;
2999 struct sadb_address *iaddr, *raddr;
3000 struct sadb_x_nat_t_frag *frag;
3001
3002 if (mhp->ext[SADB_X_EXT_NAT_T_TYPE] == NULL ||
3003 mhp->ext[SADB_X_EXT_NAT_T_SPORT] == NULL ||
3004 mhp->ext[SADB_X_EXT_NAT_T_DPORT] == NULL) {
3005 IPSECLOG(LOG_DEBUG, "invalid message.\n");
3006 return key_senderror(so, m, EINVAL);
3007 }
3008 if ((mhp->extlen[SADB_X_EXT_NAT_T_TYPE] < sizeof(*type)) ||
3009 (mhp->extlen[SADB_X_EXT_NAT_T_SPORT] < sizeof(*sport)) ||
3010 (mhp->extlen[SADB_X_EXT_NAT_T_DPORT] < sizeof(*dport))) {
3011 IPSECLOG(LOG_DEBUG, "invalid message.\n");
3012 return key_senderror(so, m, EINVAL);
3013 }
3014
3015 if ((mhp->ext[SADB_X_EXT_NAT_T_OAI] != NULL) &&
3016 (mhp->extlen[SADB_X_EXT_NAT_T_OAI] < sizeof(*iaddr))) {
3017 IPSECLOG(LOG_DEBUG, "invalid message\n");
3018 return key_senderror(so, m, EINVAL);
3019 }
3020
3021 if ((mhp->ext[SADB_X_EXT_NAT_T_OAR] != NULL) &&
3022 (mhp->extlen[SADB_X_EXT_NAT_T_OAR] < sizeof(*raddr))) {
3023 IPSECLOG(LOG_DEBUG, "invalid message\n");
3024 return key_senderror(so, m, EINVAL);
3025 }
3026
3027 if ((mhp->ext[SADB_X_EXT_NAT_T_FRAG] != NULL) &&
3028 (mhp->extlen[SADB_X_EXT_NAT_T_FRAG] < sizeof(*frag))) {
3029 IPSECLOG(LOG_DEBUG, "invalid message\n");
3030 return key_senderror(so, m, EINVAL);
3031 }
3032
3033 type = mhp->ext[SADB_X_EXT_NAT_T_TYPE];
3034 sport = mhp->ext[SADB_X_EXT_NAT_T_SPORT];
3035 dport = mhp->ext[SADB_X_EXT_NAT_T_DPORT];
3036 iaddr = mhp->ext[SADB_X_EXT_NAT_T_OAI];
3037 raddr = mhp->ext[SADB_X_EXT_NAT_T_OAR];
3038 frag = mhp->ext[SADB_X_EXT_NAT_T_FRAG];
3039
3040 /*
3041 * XXX handle that, it should also contain a SA, or anything
3042 * that enable to update the SA information.
3043 */
3044
3045 return 0;
3046 }
3047
3048 /*
3049 * Never return NULL.
3050 */
3051 static struct mbuf *
key_setdumpsp(struct secpolicy * sp,u_int8_t type,u_int32_t seq,pid_t pid)3052 key_setdumpsp(struct secpolicy *sp, u_int8_t type, u_int32_t seq, pid_t pid)
3053 {
3054 struct mbuf *result = NULL, *m;
3055
3056 KASSERT(!cpu_softintr_p());
3057
3058 m = key_setsadbmsg(type, 0, SADB_SATYPE_UNSPEC, seq, pid,
3059 key_sp_refcnt(sp), M_WAITOK);
3060 result = m;
3061
3062 m = key_setsadbaddr(SADB_EXT_ADDRESS_SRC,
3063 &sp->spidx.src.sa, sp->spidx.prefs, sp->spidx.ul_proto, M_WAITOK);
3064 m_cat(result, m);
3065
3066 m = key_setsadbaddr(SADB_EXT_ADDRESS_DST,
3067 &sp->spidx.dst.sa, sp->spidx.prefd, sp->spidx.ul_proto, M_WAITOK);
3068 m_cat(result, m);
3069
3070 m = key_sp2msg(sp, M_WAITOK);
3071 m_cat(result, m);
3072
3073 KASSERT(result->m_flags & M_PKTHDR);
3074 KASSERT(result->m_len >= sizeof(struct sadb_msg));
3075
3076 result->m_pkthdr.len = 0;
3077 for (m = result; m; m = m->m_next)
3078 result->m_pkthdr.len += m->m_len;
3079
3080 mtod(result, struct sadb_msg *)->sadb_msg_len =
3081 PFKEY_UNIT64(result->m_pkthdr.len);
3082
3083 return result;
3084 }
3085
3086 /*
3087 * get PFKEY message length for security policy and request.
3088 */
3089 static u_int
key_getspreqmsglen(const struct secpolicy * sp)3090 key_getspreqmsglen(const struct secpolicy *sp)
3091 {
3092 u_int tlen;
3093
3094 tlen = sizeof(struct sadb_x_policy);
3095
3096 /* if is the policy for ipsec ? */
3097 if (sp->policy != IPSEC_POLICY_IPSEC)
3098 return tlen;
3099
3100 /* get length of ipsec requests */
3101 {
3102 const struct ipsecrequest *isr;
3103 int len;
3104
3105 for (isr = sp->req; isr != NULL; isr = isr->next) {
3106 len = sizeof(struct sadb_x_ipsecrequest)
3107 + isr->saidx.src.sa.sa_len + isr->saidx.dst.sa.sa_len;
3108
3109 tlen += PFKEY_ALIGN8(len);
3110 }
3111 }
3112
3113 return tlen;
3114 }
3115
3116 /*
3117 * SADB_SPDEXPIRE processing
3118 * send
3119 * <base, address(SD), lifetime(CH), policy>
3120 * to KMD by PF_KEY.
3121 *
3122 * OUT: 0 : succeed
3123 * others : error number
3124 */
3125 static int
key_spdexpire(struct secpolicy * sp)3126 key_spdexpire(struct secpolicy *sp)
3127 {
3128 int s;
3129 struct mbuf *result = NULL, *m;
3130 int len;
3131 int error = -1;
3132 struct sadb_lifetime *lt;
3133
3134 /* XXX: Why do we lock ? */
3135 s = splsoftnet(); /*called from softclock()*/
3136
3137 KASSERT(sp != NULL);
3138
3139 /* set msg header */
3140 m = key_setsadbmsg(SADB_X_SPDEXPIRE, 0, 0, 0, 0, 0, M_WAITOK);
3141 result = m;
3142
3143 /* create lifetime extension (current and hard) */
3144 len = PFKEY_ALIGN8(sizeof(*lt)) * 2;
3145 m = key_alloc_mbuf(len, M_WAITOK);
3146 KASSERT(m->m_next == NULL);
3147
3148 memset(mtod(m, void *), 0, len);
3149 lt = mtod(m, struct sadb_lifetime *);
3150 lt->sadb_lifetime_len = PFKEY_UNIT64(sizeof(struct sadb_lifetime));
3151 lt->sadb_lifetime_exttype = SADB_EXT_LIFETIME_CURRENT;
3152 lt->sadb_lifetime_allocations = 0;
3153 lt->sadb_lifetime_bytes = 0;
3154 lt->sadb_lifetime_addtime = time_mono_to_wall(sp->created);
3155 lt->sadb_lifetime_usetime = time_mono_to_wall(sp->lastused);
3156 lt = (struct sadb_lifetime *)(mtod(m, char *) + len / 2);
3157 lt->sadb_lifetime_len = PFKEY_UNIT64(sizeof(struct sadb_lifetime));
3158 lt->sadb_lifetime_exttype = SADB_EXT_LIFETIME_HARD;
3159 lt->sadb_lifetime_allocations = 0;
3160 lt->sadb_lifetime_bytes = 0;
3161 lt->sadb_lifetime_addtime = sp->lifetime;
3162 lt->sadb_lifetime_usetime = sp->validtime;
3163 m_cat(result, m);
3164
3165 /* set sadb_address for source */
3166 m = key_setsadbaddr(SADB_EXT_ADDRESS_SRC, &sp->spidx.src.sa,
3167 sp->spidx.prefs, sp->spidx.ul_proto, M_WAITOK);
3168 m_cat(result, m);
3169
3170 /* set sadb_address for destination */
3171 m = key_setsadbaddr(SADB_EXT_ADDRESS_DST, &sp->spidx.dst.sa,
3172 sp->spidx.prefd, sp->spidx.ul_proto, M_WAITOK);
3173 m_cat(result, m);
3174
3175 /* set secpolicy */
3176 m = key_sp2msg(sp, M_WAITOK);
3177 m_cat(result, m);
3178
3179 KASSERT(result->m_flags & M_PKTHDR);
3180 KASSERT(result->m_len >= sizeof(struct sadb_msg));
3181
3182 result->m_pkthdr.len = 0;
3183 for (m = result; m; m = m->m_next)
3184 result->m_pkthdr.len += m->m_len;
3185
3186 mtod(result, struct sadb_msg *)->sadb_msg_len =
3187 PFKEY_UNIT64(result->m_pkthdr.len);
3188
3189 error = key_sendup_mbuf(NULL, result, KEY_SENDUP_REGISTERED);
3190 splx(s);
3191 return error;
3192 }
3193
3194 /* %%% SAD management */
3195 /*
3196 * allocating a memory for new SA head, and copy from the values of mhp.
3197 * OUT: NULL : failure due to the lack of memory.
3198 * others : pointer to new SA head.
3199 */
3200 static struct secashead *
key_newsah(const struct secasindex * saidx)3201 key_newsah(const struct secasindex *saidx)
3202 {
3203 struct secashead *newsah;
3204 int i;
3205
3206 KASSERT(saidx != NULL);
3207
3208 newsah = kmem_zalloc(sizeof(struct secashead), KM_SLEEP);
3209 for (i = 0; i < __arraycount(newsah->savlist); i++)
3210 PSLIST_INIT(&newsah->savlist[i]);
3211 newsah->saidx = *saidx;
3212
3213 localcount_init(&newsah->localcount);
3214 /* Take a reference for the caller */
3215 localcount_acquire(&newsah->localcount);
3216
3217 /* Add to the sah list */
3218 SAHLIST_ENTRY_INIT(newsah);
3219 newsah->state = SADB_SASTATE_MATURE;
3220 mutex_enter(&key_sad.lock);
3221 SAHLIST_WRITER_INSERT_HEAD(newsah);
3222 mutex_exit(&key_sad.lock);
3223
3224 return newsah;
3225 }
3226
3227 static bool
key_sah_has_sav(struct secashead * sah)3228 key_sah_has_sav(struct secashead *sah)
3229 {
3230 u_int state;
3231
3232 KASSERT(mutex_owned(&key_sad.lock));
3233
3234 SASTATE_ANY_FOREACH(state) {
3235 if (!SAVLIST_WRITER_EMPTY(sah, state))
3236 return true;
3237 }
3238
3239 return false;
3240 }
3241
3242 static void
key_unlink_sah(struct secashead * sah)3243 key_unlink_sah(struct secashead *sah)
3244 {
3245
3246 KASSERT(!cpu_softintr_p());
3247 KASSERT(mutex_owned(&key_sad.lock));
3248 KASSERTMSG(sah->state == SADB_SASTATE_DEAD, "sah->state=%u", sah->state);
3249
3250 /* Remove from the sah list */
3251 SAHLIST_WRITER_REMOVE(sah);
3252
3253 KDASSERT(mutex_ownable(softnet_lock));
3254 key_sad_pserialize_perform();
3255
3256 localcount_drain(&sah->localcount, &key_sad.cv_lc, &key_sad.lock);
3257 }
3258
3259 static void
key_destroy_sah(struct secashead * sah)3260 key_destroy_sah(struct secashead *sah)
3261 {
3262
3263 rtcache_free(&sah->sa_route);
3264
3265 SAHLIST_ENTRY_DESTROY(sah);
3266 localcount_fini(&sah->localcount);
3267
3268 if (sah->idents != NULL)
3269 kmem_free(sah->idents, sah->idents_len);
3270 if (sah->identd != NULL)
3271 kmem_free(sah->identd, sah->identd_len);
3272
3273 kmem_free(sah, sizeof(*sah));
3274 }
3275
3276 /*
3277 * allocating a new SA with LARVAL state.
3278 * key_api_add() and key_api_getspi() call,
3279 * and copy the values of mhp into new buffer.
3280 * When SAD message type is GETSPI:
3281 * to set sequence number from acq_seq++,
3282 * to set zero to SPI.
3283 * not to call key_setsaval().
3284 * OUT: NULL : fail
3285 * others : pointer to new secasvar.
3286 *
3287 * does not modify mbuf. does not free mbuf on error.
3288 */
3289 static struct secasvar *
key_newsav(struct mbuf * m,const struct sadb_msghdr * mhp,int * errp,int proto,const char * where,int tag)3290 key_newsav(struct mbuf *m, const struct sadb_msghdr *mhp,
3291 int *errp, int proto, const char* where, int tag)
3292 {
3293 struct secasvar *newsav;
3294 const struct sadb_sa *xsa;
3295
3296 KASSERT(!cpu_softintr_p());
3297 KASSERT(m != NULL);
3298 KASSERT(mhp != NULL);
3299 KASSERT(mhp->msg != NULL);
3300
3301 newsav = kmem_zalloc(sizeof(struct secasvar), KM_SLEEP);
3302
3303 switch (mhp->msg->sadb_msg_type) {
3304 case SADB_GETSPI:
3305 newsav->spi = 0;
3306
3307 #ifdef IPSEC_DOSEQCHECK
3308 /* sync sequence number */
3309 if (mhp->msg->sadb_msg_seq == 0)
3310 newsav->seq =
3311 (acq_seq = (acq_seq == ~0 ? 1 : ++acq_seq));
3312 else
3313 #endif
3314 newsav->seq = mhp->msg->sadb_msg_seq;
3315 break;
3316
3317 case SADB_ADD:
3318 /* sanity check */
3319 if (mhp->ext[SADB_EXT_SA] == NULL) {
3320 IPSECLOG(LOG_DEBUG, "invalid message is passed.\n");
3321 *errp = EINVAL;
3322 goto error;
3323 }
3324 xsa = mhp->ext[SADB_EXT_SA];
3325 newsav->spi = xsa->sadb_sa_spi;
3326 newsav->seq = mhp->msg->sadb_msg_seq;
3327 break;
3328 default:
3329 *errp = EINVAL;
3330 goto error;
3331 }
3332
3333 /* copy sav values */
3334 if (mhp->msg->sadb_msg_type != SADB_GETSPI) {
3335 *errp = key_setsaval(newsav, m, mhp);
3336 if (*errp)
3337 goto error;
3338 } else {
3339 /* We don't allow lft_c to be NULL */
3340 newsav->lft_c = kmem_zalloc(sizeof(struct sadb_lifetime),
3341 KM_SLEEP);
3342 newsav->lft_c_counters_percpu =
3343 percpu_alloc(sizeof(lifetime_counters_t));
3344 }
3345
3346 /* reset created */
3347 newsav->created = time_uptime;
3348 newsav->pid = mhp->msg->sadb_msg_pid;
3349
3350 KEYDEBUG_PRINTF(KEYDEBUG_IPSEC_STAMP,
3351 "DP from %s:%u return SA:%p spi=%#x proto=%d\n",
3352 where, tag, newsav, ntohl(newsav->spi), proto);
3353 return newsav;
3354
3355 error:
3356 KASSERT(*errp != 0);
3357 kmem_free(newsav, sizeof(*newsav));
3358 KEYDEBUG_PRINTF(KEYDEBUG_IPSEC_STAMP,
3359 "DP from %s:%u return SA:NULL\n", where, tag);
3360 return NULL;
3361 }
3362
3363
3364 static void
key_clear_xform(struct secasvar * sav)3365 key_clear_xform(struct secasvar *sav)
3366 {
3367
3368 /*
3369 * Cleanup xform state. Note that zeroize'ing causes the
3370 * keys to be cleared; otherwise we must do it ourself.
3371 */
3372 if (sav->tdb_xform != NULL) {
3373 sav->tdb_xform->xf_zeroize(sav);
3374 sav->tdb_xform = NULL;
3375 } else {
3376 if (sav->key_auth != NULL)
3377 explicit_memset(_KEYBUF(sav->key_auth), 0,
3378 _KEYLEN(sav->key_auth));
3379 if (sav->key_enc != NULL)
3380 explicit_memset(_KEYBUF(sav->key_enc), 0,
3381 _KEYLEN(sav->key_enc));
3382 }
3383 }
3384
3385 /*
3386 * free() SA variable entry.
3387 */
3388 static void
key_delsav(struct secasvar * sav)3389 key_delsav(struct secasvar *sav)
3390 {
3391
3392 key_clear_xform(sav);
3393 key_freesaval(sav);
3394 kmem_free(sav, sizeof(*sav));
3395 }
3396
3397 /*
3398 * Must be called in a pserialize read section. A held sah
3399 * must be released by key_sah_unref after use.
3400 */
3401 static void
key_sah_ref(struct secashead * sah)3402 key_sah_ref(struct secashead *sah)
3403 {
3404
3405 localcount_acquire(&sah->localcount);
3406 }
3407
3408 /*
3409 * Must be called without holding key_sad.lock because the lock
3410 * would be held in localcount_release.
3411 */
3412 static void
key_sah_unref(struct secashead * sah)3413 key_sah_unref(struct secashead *sah)
3414 {
3415
3416 KDASSERT(mutex_ownable(&key_sad.lock));
3417
3418 localcount_release(&sah->localcount, &key_sad.cv_lc, &key_sad.lock);
3419 }
3420
3421 /*
3422 * Search SAD and return sah. Must be called in a pserialize
3423 * read section.
3424 * OUT:
3425 * NULL : not found
3426 * others : found, pointer to a SA.
3427 */
3428 static struct secashead *
key_getsah(const struct secasindex * saidx,int flag)3429 key_getsah(const struct secasindex *saidx, int flag)
3430 {
3431 struct secashead *sah;
3432
3433 SAHLIST_READER_FOREACH_SAIDX(sah, saidx) {
3434 if (sah->state == SADB_SASTATE_DEAD)
3435 continue;
3436 if (key_saidx_match(&sah->saidx, saidx, flag))
3437 return sah;
3438 }
3439
3440 return NULL;
3441 }
3442
3443 /*
3444 * Search SAD and return sah. If sah is returned, the caller must call
3445 * key_sah_unref to releaset a reference.
3446 * OUT:
3447 * NULL : not found
3448 * others : found, pointer to a SA.
3449 */
3450 static struct secashead *
key_getsah_ref(const struct secasindex * saidx,int flag)3451 key_getsah_ref(const struct secasindex *saidx, int flag)
3452 {
3453 struct secashead *sah;
3454 int s;
3455
3456 s = pserialize_read_enter();
3457 sah = key_getsah(saidx, flag);
3458 if (sah != NULL)
3459 key_sah_ref(sah);
3460 pserialize_read_exit(s);
3461
3462 return sah;
3463 }
3464
3465 /*
3466 * check not to be duplicated SPI.
3467 * NOTE: this function is too slow due to searching all SAD.
3468 * OUT:
3469 * NULL : not found
3470 * others : found, pointer to a SA.
3471 */
3472 static bool
key_checkspidup(const struct secasindex * saidx,u_int32_t spi)3473 key_checkspidup(const struct secasindex *saidx, u_int32_t spi)
3474 {
3475 struct secashead *sah;
3476 struct secasvar *sav;
3477
3478 /* check address family */
3479 if (saidx->src.sa.sa_family != saidx->dst.sa.sa_family) {
3480 IPSECLOG(LOG_DEBUG,
3481 "address family mismatched src %u, dst %u.\n",
3482 saidx->src.sa.sa_family, saidx->dst.sa.sa_family);
3483 return false;
3484 }
3485
3486 /* check all SAD */
3487 /* key_ismyaddr may sleep, so use mutex, not pserialize, here. */
3488 mutex_enter(&key_sad.lock);
3489 SAHLIST_WRITER_FOREACH(sah) {
3490 if (!key_ismyaddr((struct sockaddr *)&sah->saidx.dst))
3491 continue;
3492 sav = key_getsavbyspi(sah, spi);
3493 if (sav != NULL) {
3494 KEY_SA_UNREF(&sav);
3495 mutex_exit(&key_sad.lock);
3496 return true;
3497 }
3498 }
3499 mutex_exit(&key_sad.lock);
3500
3501 return false;
3502 }
3503
3504 /*
3505 * search SAD litmited alive SA, protocol, SPI.
3506 * OUT:
3507 * NULL : not found
3508 * others : found, pointer to a SA.
3509 */
3510 static struct secasvar *
key_getsavbyspi(struct secashead * sah,u_int32_t spi)3511 key_getsavbyspi(struct secashead *sah, u_int32_t spi)
3512 {
3513 struct secasvar *sav = NULL;
3514 u_int state;
3515 int s;
3516
3517 /* search all status */
3518 s = pserialize_read_enter();
3519 SASTATE_ALIVE_FOREACH(state) {
3520 SAVLIST_READER_FOREACH(sav, sah, state) {
3521 /* sanity check */
3522 if (sav->state != state) {
3523 IPSECLOG(LOG_DEBUG,
3524 "invalid sav->state (queue: %d SA: %d)\n",
3525 state, sav->state);
3526 continue;
3527 }
3528
3529 if (sav->spi == spi) {
3530 KEY_SA_REF(sav);
3531 goto out;
3532 }
3533 }
3534 }
3535 out:
3536 pserialize_read_exit(s);
3537
3538 return sav;
3539 }
3540
3541 /*
3542 * Search SAD litmited alive SA by an SPI and remove it from a list.
3543 * OUT:
3544 * NULL : not found
3545 * others : found, pointer to a SA.
3546 */
3547 static struct secasvar *
key_lookup_and_remove_sav(struct secashead * sah,u_int32_t spi,const struct secasvar * hint)3548 key_lookup_and_remove_sav(struct secashead *sah, u_int32_t spi,
3549 const struct secasvar *hint)
3550 {
3551 struct secasvar *sav = NULL;
3552 u_int state;
3553
3554 /* search all status */
3555 mutex_enter(&key_sad.lock);
3556 SASTATE_ALIVE_FOREACH(state) {
3557 SAVLIST_WRITER_FOREACH(sav, sah, state) {
3558 KASSERT(sav->state == state);
3559
3560 if (sav->spi == spi) {
3561 if (hint != NULL && hint != sav)
3562 continue;
3563 sav->state = SADB_SASTATE_DEAD;
3564 SAVLIST_WRITER_REMOVE(sav);
3565 SAVLUT_WRITER_REMOVE(sav);
3566 goto out;
3567 }
3568 }
3569 }
3570 out:
3571 mutex_exit(&key_sad.lock);
3572
3573 return sav;
3574 }
3575
3576 /*
3577 * Free allocated data to member variables of sav:
3578 * sav->replay, sav->key_* and sav->lft_*.
3579 */
3580 static void
key_freesaval(struct secasvar * sav)3581 key_freesaval(struct secasvar *sav)
3582 {
3583
3584 KASSERTMSG(key_sa_refcnt(sav) == 0, "key_sa_refcnt(sav)=%u",
3585 key_sa_refcnt(sav));
3586
3587 if (sav->replay != NULL)
3588 kmem_free(sav->replay, sav->replay_len);
3589 if (sav->key_auth != NULL)
3590 kmem_free(sav->key_auth, sav->key_auth_len);
3591 if (sav->key_enc != NULL)
3592 kmem_free(sav->key_enc, sav->key_enc_len);
3593 if (sav->lft_c_counters_percpu != NULL) {
3594 percpu_free(sav->lft_c_counters_percpu,
3595 sizeof(lifetime_counters_t));
3596 }
3597 if (sav->lft_c != NULL)
3598 kmem_free(sav->lft_c, sizeof(*(sav->lft_c)));
3599 if (sav->lft_h != NULL)
3600 kmem_free(sav->lft_h, sizeof(*(sav->lft_h)));
3601 if (sav->lft_s != NULL)
3602 kmem_free(sav->lft_s, sizeof(*(sav->lft_s)));
3603 }
3604
3605 /*
3606 * copy SA values from PF_KEY message except *SPI, SEQ, PID, STATE and TYPE*.
3607 * You must update these if need.
3608 * OUT: 0: success.
3609 * !0: failure.
3610 *
3611 * does not modify mbuf. does not free mbuf on error.
3612 */
3613 static int
key_setsaval(struct secasvar * sav,struct mbuf * m,const struct sadb_msghdr * mhp)3614 key_setsaval(struct secasvar *sav, struct mbuf *m,
3615 const struct sadb_msghdr *mhp)
3616 {
3617 int error = 0;
3618
3619 KASSERT(!cpu_softintr_p());
3620 KASSERT(m != NULL);
3621 KASSERT(mhp != NULL);
3622 KASSERT(mhp->msg != NULL);
3623
3624 /* We shouldn't initialize sav variables while someone uses it. */
3625 KASSERTMSG(key_sa_refcnt(sav) == 0, "key_sa_refcnt(sav)=%u",
3626 key_sa_refcnt(sav));
3627
3628 /* SA */
3629 if (mhp->ext[SADB_EXT_SA] != NULL) {
3630 const struct sadb_sa *sa0;
3631
3632 sa0 = mhp->ext[SADB_EXT_SA];
3633 if (mhp->extlen[SADB_EXT_SA] < sizeof(*sa0)) {
3634 error = EINVAL;
3635 goto fail;
3636 }
3637
3638 sav->alg_auth = sa0->sadb_sa_auth;
3639 sav->alg_enc = sa0->sadb_sa_encrypt;
3640 sav->flags = sa0->sadb_sa_flags;
3641
3642 /* replay window */
3643 if ((sa0->sadb_sa_flags & SADB_X_EXT_OLD) == 0) {
3644 size_t len = sizeof(struct secreplay) +
3645 sa0->sadb_sa_replay;
3646 sav->replay = kmem_zalloc(len, KM_SLEEP);
3647 sav->replay_len = len;
3648 if (sa0->sadb_sa_replay != 0)
3649 sav->replay->bitmap = (char*)(sav->replay+1);
3650 sav->replay->wsize = sa0->sadb_sa_replay;
3651 }
3652 }
3653
3654 /* Authentication keys */
3655 if (mhp->ext[SADB_EXT_KEY_AUTH] != NULL) {
3656 const struct sadb_key *key0;
3657 int len;
3658
3659 key0 = mhp->ext[SADB_EXT_KEY_AUTH];
3660 len = mhp->extlen[SADB_EXT_KEY_AUTH];
3661
3662 error = 0;
3663 if (len < sizeof(*key0)) {
3664 error = EINVAL;
3665 goto fail;
3666 }
3667 switch (mhp->msg->sadb_msg_satype) {
3668 case SADB_SATYPE_AH:
3669 case SADB_SATYPE_ESP:
3670 case SADB_X_SATYPE_TCPSIGNATURE:
3671 if (len == PFKEY_ALIGN8(sizeof(struct sadb_key)) &&
3672 sav->alg_auth != SADB_X_AALG_NULL)
3673 error = EINVAL;
3674 break;
3675 case SADB_X_SATYPE_IPCOMP:
3676 default:
3677 error = EINVAL;
3678 break;
3679 }
3680 if (error) {
3681 IPSECLOG(LOG_DEBUG, "invalid key_auth values.\n");
3682 goto fail;
3683 }
3684
3685 sav->key_auth = key_newbuf(key0, len);
3686 sav->key_auth_len = len;
3687 }
3688
3689 /* Encryption key */
3690 if (mhp->ext[SADB_EXT_KEY_ENCRYPT] != NULL) {
3691 const struct sadb_key *key0;
3692 int len;
3693
3694 key0 = mhp->ext[SADB_EXT_KEY_ENCRYPT];
3695 len = mhp->extlen[SADB_EXT_KEY_ENCRYPT];
3696
3697 error = 0;
3698 if (len < sizeof(*key0)) {
3699 error = EINVAL;
3700 goto fail;
3701 }
3702 switch (mhp->msg->sadb_msg_satype) {
3703 case SADB_SATYPE_ESP:
3704 if (len == PFKEY_ALIGN8(sizeof(struct sadb_key)) &&
3705 sav->alg_enc != SADB_EALG_NULL) {
3706 error = EINVAL;
3707 break;
3708 }
3709 sav->key_enc = key_newbuf(key0, len);
3710 sav->key_enc_len = len;
3711 break;
3712 case SADB_X_SATYPE_IPCOMP:
3713 if (len != PFKEY_ALIGN8(sizeof(struct sadb_key)))
3714 error = EINVAL;
3715 sav->key_enc = NULL; /*just in case*/
3716 break;
3717 case SADB_SATYPE_AH:
3718 case SADB_X_SATYPE_TCPSIGNATURE:
3719 default:
3720 error = EINVAL;
3721 break;
3722 }
3723 if (error) {
3724 IPSECLOG(LOG_DEBUG, "invalid key_enc value.\n");
3725 goto fail;
3726 }
3727 }
3728
3729 /* set iv */
3730 sav->ivlen = 0;
3731
3732 switch (mhp->msg->sadb_msg_satype) {
3733 case SADB_SATYPE_AH:
3734 error = xform_init(sav, XF_AH);
3735 break;
3736 case SADB_SATYPE_ESP:
3737 error = xform_init(sav, XF_ESP);
3738 break;
3739 case SADB_X_SATYPE_IPCOMP:
3740 error = xform_init(sav, XF_IPCOMP);
3741 break;
3742 case SADB_X_SATYPE_TCPSIGNATURE:
3743 error = xform_init(sav, XF_TCPSIGNATURE);
3744 break;
3745 default:
3746 error = EOPNOTSUPP;
3747 break;
3748 }
3749 if (error) {
3750 IPSECLOG(LOG_DEBUG, "unable to initialize SA type %u (%d)\n",
3751 mhp->msg->sadb_msg_satype, error);
3752 goto fail;
3753 }
3754
3755 /* reset created */
3756 sav->created = time_uptime;
3757
3758 /* make lifetime for CURRENT */
3759 sav->lft_c = kmem_alloc(sizeof(struct sadb_lifetime), KM_SLEEP);
3760
3761 sav->lft_c->sadb_lifetime_len =
3762 PFKEY_UNIT64(sizeof(struct sadb_lifetime));
3763 sav->lft_c->sadb_lifetime_exttype = SADB_EXT_LIFETIME_CURRENT;
3764 sav->lft_c->sadb_lifetime_allocations = 0;
3765 sav->lft_c->sadb_lifetime_bytes = 0;
3766 sav->lft_c->sadb_lifetime_addtime = time_uptime;
3767 sav->lft_c->sadb_lifetime_usetime = 0;
3768
3769 sav->lft_c_counters_percpu = percpu_alloc(sizeof(lifetime_counters_t));
3770
3771 /* lifetimes for HARD and SOFT */
3772 {
3773 const struct sadb_lifetime *lft0;
3774
3775 lft0 = mhp->ext[SADB_EXT_LIFETIME_HARD];
3776 if (lft0 != NULL) {
3777 if (mhp->extlen[SADB_EXT_LIFETIME_HARD] < sizeof(*lft0)) {
3778 error = EINVAL;
3779 goto fail;
3780 }
3781 sav->lft_h = key_newbuf(lft0, sizeof(*lft0));
3782 }
3783
3784 lft0 = mhp->ext[SADB_EXT_LIFETIME_SOFT];
3785 if (lft0 != NULL) {
3786 if (mhp->extlen[SADB_EXT_LIFETIME_SOFT] < sizeof(*lft0)) {
3787 error = EINVAL;
3788 goto fail;
3789 }
3790 sav->lft_s = key_newbuf(lft0, sizeof(*lft0));
3791 /* to be initialize ? */
3792 }
3793 }
3794
3795 return 0;
3796
3797 fail:
3798 key_clear_xform(sav);
3799 key_freesaval(sav);
3800
3801 return error;
3802 }
3803
3804 /*
3805 * validation with a secasvar entry, and set SADB_SATYPE_MATURE.
3806 * OUT: 0: valid
3807 * other: errno
3808 */
3809 static int
key_init_xform(struct secasvar * sav)3810 key_init_xform(struct secasvar *sav)
3811 {
3812 int error;
3813
3814 /* We shouldn't initialize sav variables while someone uses it. */
3815 KASSERTMSG(key_sa_refcnt(sav) == 0, "key_sa_refcnt(sav)=%u",
3816 key_sa_refcnt(sav));
3817
3818 /* check SPI value */
3819 switch (sav->sah->saidx.proto) {
3820 case IPPROTO_ESP:
3821 case IPPROTO_AH:
3822 if (ntohl(sav->spi) <= 255) {
3823 IPSECLOG(LOG_DEBUG, "illegal range of SPI %u.\n",
3824 (u_int32_t)ntohl(sav->spi));
3825 return EINVAL;
3826 }
3827 break;
3828 }
3829
3830 /* check algo */
3831 switch (sav->sah->saidx.proto) {
3832 case IPPROTO_AH:
3833 case IPPROTO_TCP:
3834 if (sav->alg_enc != SADB_EALG_NONE) {
3835 IPSECLOG(LOG_DEBUG,
3836 "protocol %u and algorithm mismatched %u != %u.\n",
3837 sav->sah->saidx.proto,
3838 sav->alg_enc, SADB_EALG_NONE);
3839 return EINVAL;
3840 }
3841 break;
3842 case IPPROTO_IPCOMP:
3843 if (sav->alg_auth != SADB_AALG_NONE) {
3844 IPSECLOG(LOG_DEBUG,
3845 "protocol %u and algorithm mismatched %d != %d.\n",
3846 sav->sah->saidx.proto,
3847 sav->alg_auth, SADB_AALG_NONE);
3848 return(EINVAL);
3849 }
3850 break;
3851 default:
3852 break;
3853 }
3854
3855 /* check satype */
3856 switch (sav->sah->saidx.proto) {
3857 case IPPROTO_ESP:
3858 /* check flags */
3859 if ((sav->flags & (SADB_X_EXT_OLD|SADB_X_EXT_DERIV)) ==
3860 (SADB_X_EXT_OLD|SADB_X_EXT_DERIV)) {
3861 IPSECLOG(LOG_DEBUG,
3862 "invalid flag (derived) given to old-esp.\n");
3863 return EINVAL;
3864 }
3865 error = xform_init(sav, XF_ESP);
3866 break;
3867 case IPPROTO_AH:
3868 /* check flags */
3869 if (sav->flags & SADB_X_EXT_DERIV) {
3870 IPSECLOG(LOG_DEBUG,
3871 "invalid flag (derived) given to AH SA.\n");
3872 return EINVAL;
3873 }
3874 error = xform_init(sav, XF_AH);
3875 break;
3876 case IPPROTO_IPCOMP:
3877 if ((sav->flags & SADB_X_EXT_RAWCPI) == 0
3878 && ntohl(sav->spi) >= 0x10000) {
3879 IPSECLOG(LOG_DEBUG, "invalid cpi for IPComp.\n");
3880 return(EINVAL);
3881 }
3882 error = xform_init(sav, XF_IPCOMP);
3883 break;
3884 case IPPROTO_TCP:
3885 error = xform_init(sav, XF_TCPSIGNATURE);
3886 break;
3887 default:
3888 IPSECLOG(LOG_DEBUG, "Invalid satype.\n");
3889 error = EPROTONOSUPPORT;
3890 break;
3891 }
3892
3893 return error;
3894 }
3895
3896 /*
3897 * subroutine for SADB_GET and SADB_DUMP. It never return NULL.
3898 */
3899 static struct mbuf *
key_setdumpsa(struct secasvar * sav,u_int8_t type,u_int8_t satype,u_int32_t seq,u_int32_t pid)3900 key_setdumpsa(struct secasvar *sav, u_int8_t type, u_int8_t satype,
3901 u_int32_t seq, u_int32_t pid)
3902 {
3903 struct mbuf *result = NULL, *tres = NULL, *m;
3904 int l = 0;
3905 int i;
3906 void *p;
3907 struct sadb_lifetime lt;
3908 int dumporder[] = {
3909 SADB_EXT_SA, SADB_X_EXT_SA2,
3910 SADB_EXT_LIFETIME_HARD, SADB_EXT_LIFETIME_SOFT,
3911 SADB_EXT_LIFETIME_CURRENT, SADB_EXT_ADDRESS_SRC,
3912 SADB_EXT_ADDRESS_DST, SADB_EXT_ADDRESS_PROXY, SADB_EXT_KEY_AUTH,
3913 SADB_EXT_KEY_ENCRYPT, SADB_EXT_IDENTITY_SRC,
3914 SADB_EXT_IDENTITY_DST, SADB_EXT_SENSITIVITY,
3915 SADB_X_EXT_NAT_T_TYPE,
3916 SADB_X_EXT_NAT_T_SPORT, SADB_X_EXT_NAT_T_DPORT,
3917 SADB_X_EXT_NAT_T_OAI, SADB_X_EXT_NAT_T_OAR,
3918 SADB_X_EXT_NAT_T_FRAG,
3919
3920 };
3921
3922 m = key_setsadbmsg(type, 0, satype, seq, pid, key_sa_refcnt(sav), M_WAITOK);
3923 result = m;
3924
3925 for (i = __arraycount(dumporder) - 1; i >= 0; i--) {
3926 m = NULL;
3927 p = NULL;
3928 switch (dumporder[i]) {
3929 case SADB_EXT_SA:
3930 m = key_setsadbsa(sav);
3931 break;
3932
3933 case SADB_X_EXT_SA2:
3934 m = key_setsadbxsa2(sav->sah->saidx.mode,
3935 sav->replay ? sav->replay->count : 0,
3936 sav->sah->saidx.reqid);
3937 break;
3938
3939 case SADB_EXT_ADDRESS_SRC:
3940 m = key_setsadbaddr(SADB_EXT_ADDRESS_SRC,
3941 &sav->sah->saidx.src.sa,
3942 FULLMASK, IPSEC_ULPROTO_ANY, M_WAITOK);
3943 break;
3944
3945 case SADB_EXT_ADDRESS_DST:
3946 m = key_setsadbaddr(SADB_EXT_ADDRESS_DST,
3947 &sav->sah->saidx.dst.sa,
3948 FULLMASK, IPSEC_ULPROTO_ANY, M_WAITOK);
3949 break;
3950
3951 case SADB_EXT_KEY_AUTH:
3952 if (!sav->key_auth)
3953 continue;
3954 l = PFKEY_UNUNIT64(sav->key_auth->sadb_key_len);
3955 p = sav->key_auth;
3956 break;
3957
3958 case SADB_EXT_KEY_ENCRYPT:
3959 if (!sav->key_enc)
3960 continue;
3961 l = PFKEY_UNUNIT64(sav->key_enc->sadb_key_len);
3962 p = sav->key_enc;
3963 break;
3964
3965 case SADB_EXT_LIFETIME_CURRENT: {
3966 lifetime_counters_t sum = {0};
3967
3968 KASSERT(sav->lft_c != NULL);
3969 l = PFKEY_UNUNIT64(((struct sadb_ext *)sav->lft_c)->sadb_ext_len);
3970 memcpy(<, sav->lft_c, sizeof(struct sadb_lifetime));
3971 lt.sadb_lifetime_addtime =
3972 time_mono_to_wall(lt.sadb_lifetime_addtime);
3973 lt.sadb_lifetime_usetime =
3974 time_mono_to_wall(lt.sadb_lifetime_usetime);
3975 percpu_foreach_xcall(sav->lft_c_counters_percpu,
3976 XC_HIGHPRI_IPL(IPL_SOFTNET),
3977 key_sum_lifetime_counters, sum);
3978 lt.sadb_lifetime_allocations =
3979 sum[LIFETIME_COUNTER_ALLOCATIONS];
3980 lt.sadb_lifetime_bytes =
3981 sum[LIFETIME_COUNTER_BYTES];
3982 p = <
3983 break;
3984 }
3985
3986 case SADB_EXT_LIFETIME_HARD:
3987 if (!sav->lft_h)
3988 continue;
3989 l = PFKEY_UNUNIT64(((struct sadb_ext *)sav->lft_h)->sadb_ext_len);
3990 p = sav->lft_h;
3991 break;
3992
3993 case SADB_EXT_LIFETIME_SOFT:
3994 if (!sav->lft_s)
3995 continue;
3996 l = PFKEY_UNUNIT64(((struct sadb_ext *)sav->lft_s)->sadb_ext_len);
3997 p = sav->lft_s;
3998 break;
3999
4000 case SADB_X_EXT_NAT_T_TYPE:
4001 m = key_setsadbxtype(sav->natt_type);
4002 break;
4003
4004 case SADB_X_EXT_NAT_T_DPORT:
4005 if (sav->natt_type == 0)
4006 continue;
4007 m = key_setsadbxport(
4008 key_portfromsaddr(&sav->sah->saidx.dst),
4009 SADB_X_EXT_NAT_T_DPORT);
4010 break;
4011
4012 case SADB_X_EXT_NAT_T_SPORT:
4013 if (sav->natt_type == 0)
4014 continue;
4015 m = key_setsadbxport(
4016 key_portfromsaddr(&sav->sah->saidx.src),
4017 SADB_X_EXT_NAT_T_SPORT);
4018 break;
4019
4020 case SADB_X_EXT_NAT_T_FRAG:
4021 /* don't send frag info if not set */
4022 if (sav->natt_type == 0 || sav->esp_frag == IP_MAXPACKET)
4023 continue;
4024 m = key_setsadbxfrag(sav->esp_frag);
4025 break;
4026
4027 case SADB_X_EXT_NAT_T_OAI:
4028 case SADB_X_EXT_NAT_T_OAR:
4029 continue;
4030
4031 case SADB_EXT_ADDRESS_PROXY:
4032 case SADB_EXT_IDENTITY_SRC:
4033 case SADB_EXT_IDENTITY_DST:
4034 /* XXX: should we brought from SPD ? */
4035 case SADB_EXT_SENSITIVITY:
4036 default:
4037 continue;
4038 }
4039
4040 KASSERT(!(m && p));
4041 KASSERT(m != NULL || p != NULL);
4042 if (p && tres) {
4043 M_PREPEND(tres, l, M_WAITOK);
4044 memcpy(mtod(tres, void *), p, l);
4045 continue;
4046 }
4047 if (p) {
4048 m = key_alloc_mbuf(l, M_WAITOK);
4049 m_copyback(m, 0, l, p);
4050 }
4051
4052 if (tres)
4053 m_cat(m, tres);
4054 tres = m;
4055 }
4056
4057 m_cat(result, tres);
4058 tres = NULL; /* avoid free on error below */
4059
4060 KASSERT(result->m_len >= sizeof(struct sadb_msg));
4061
4062 result->m_pkthdr.len = 0;
4063 for (m = result; m; m = m->m_next)
4064 result->m_pkthdr.len += m->m_len;
4065
4066 mtod(result, struct sadb_msg *)->sadb_msg_len =
4067 PFKEY_UNIT64(result->m_pkthdr.len);
4068
4069 return result;
4070 }
4071
4072
4073 /*
4074 * set a type in sadb_x_nat_t_type
4075 */
4076 static struct mbuf *
key_setsadbxtype(u_int16_t type)4077 key_setsadbxtype(u_int16_t type)
4078 {
4079 struct mbuf *m;
4080 size_t len;
4081 struct sadb_x_nat_t_type *p;
4082
4083 len = PFKEY_ALIGN8(sizeof(struct sadb_x_nat_t_type));
4084
4085 m = key_alloc_mbuf(len, M_WAITOK);
4086 KASSERT(m->m_next == NULL);
4087
4088 p = mtod(m, struct sadb_x_nat_t_type *);
4089
4090 memset(p, 0, len);
4091 p->sadb_x_nat_t_type_len = PFKEY_UNIT64(len);
4092 p->sadb_x_nat_t_type_exttype = SADB_X_EXT_NAT_T_TYPE;
4093 p->sadb_x_nat_t_type_type = type;
4094
4095 return m;
4096 }
4097 /*
4098 * set a port in sadb_x_nat_t_port. port is in network order
4099 */
4100 static struct mbuf *
key_setsadbxport(u_int16_t port,u_int16_t type)4101 key_setsadbxport(u_int16_t port, u_int16_t type)
4102 {
4103 struct mbuf *m;
4104 size_t len;
4105 struct sadb_x_nat_t_port *p;
4106
4107 len = PFKEY_ALIGN8(sizeof(struct sadb_x_nat_t_port));
4108
4109 m = key_alloc_mbuf(len, M_WAITOK);
4110 KASSERT(m->m_next == NULL);
4111
4112 p = mtod(m, struct sadb_x_nat_t_port *);
4113
4114 memset(p, 0, len);
4115 p->sadb_x_nat_t_port_len = PFKEY_UNIT64(len);
4116 p->sadb_x_nat_t_port_exttype = type;
4117 p->sadb_x_nat_t_port_port = port;
4118
4119 return m;
4120 }
4121
4122 /*
4123 * set fragmentation info in sadb_x_nat_t_frag
4124 */
4125 static struct mbuf *
key_setsadbxfrag(u_int16_t flen)4126 key_setsadbxfrag(u_int16_t flen)
4127 {
4128 struct mbuf *m;
4129 size_t len;
4130 struct sadb_x_nat_t_frag *p;
4131
4132 len = PFKEY_ALIGN8(sizeof(struct sadb_x_nat_t_frag));
4133
4134 m = key_alloc_mbuf(len, M_WAITOK);
4135 KASSERT(m->m_next == NULL);
4136
4137 p = mtod(m, struct sadb_x_nat_t_frag *);
4138
4139 memset(p, 0, len);
4140 p->sadb_x_nat_t_frag_len = PFKEY_UNIT64(len);
4141 p->sadb_x_nat_t_frag_exttype = SADB_X_EXT_NAT_T_FRAG;
4142 p->sadb_x_nat_t_frag_fraglen = flen;
4143
4144 return m;
4145 }
4146
4147 /*
4148 * Get port from sockaddr, port is in network order
4149 */
4150 u_int16_t
key_portfromsaddr(const union sockaddr_union * saddr)4151 key_portfromsaddr(const union sockaddr_union *saddr)
4152 {
4153 u_int16_t port;
4154
4155 switch (saddr->sa.sa_family) {
4156 case AF_INET: {
4157 port = saddr->sin.sin_port;
4158 break;
4159 }
4160 #ifdef INET6
4161 case AF_INET6: {
4162 port = saddr->sin6.sin6_port;
4163 break;
4164 }
4165 #endif
4166 default:
4167 printf("%s: unexpected address family\n", __func__);
4168 port = 0;
4169 break;
4170 }
4171
4172 return port;
4173 }
4174
4175
4176 /*
4177 * Set port is struct sockaddr. port is in network order
4178 */
4179 static void
key_porttosaddr(union sockaddr_union * saddr,u_int16_t port)4180 key_porttosaddr(union sockaddr_union *saddr, u_int16_t port)
4181 {
4182 switch (saddr->sa.sa_family) {
4183 case AF_INET: {
4184 saddr->sin.sin_port = port;
4185 break;
4186 }
4187 #ifdef INET6
4188 case AF_INET6: {
4189 saddr->sin6.sin6_port = port;
4190 break;
4191 }
4192 #endif
4193 default:
4194 printf("%s: unexpected address family %d\n", __func__,
4195 saddr->sa.sa_family);
4196 break;
4197 }
4198
4199 return;
4200 }
4201
4202 /*
4203 * Safety check sa_len
4204 */
4205 static int
key_checksalen(const union sockaddr_union * saddr)4206 key_checksalen(const union sockaddr_union *saddr)
4207 {
4208 switch (saddr->sa.sa_family) {
4209 case AF_INET:
4210 if (saddr->sa.sa_len != sizeof(struct sockaddr_in))
4211 return -1;
4212 break;
4213 #ifdef INET6
4214 case AF_INET6:
4215 if (saddr->sa.sa_len != sizeof(struct sockaddr_in6))
4216 return -1;
4217 break;
4218 #endif
4219 default:
4220 printf("%s: unexpected sa_family %d\n", __func__,
4221 saddr->sa.sa_family);
4222 return -1;
4223 break;
4224 }
4225 return 0;
4226 }
4227
4228
4229 /*
4230 * set data into sadb_msg.
4231 */
4232 static struct mbuf *
key_setsadbmsg(u_int8_t type,u_int16_t tlen,u_int8_t satype,u_int32_t seq,pid_t pid,u_int16_t reserved,int mflag)4233 key_setsadbmsg(u_int8_t type, u_int16_t tlen, u_int8_t satype,
4234 u_int32_t seq, pid_t pid, u_int16_t reserved, int mflag)
4235 {
4236 struct mbuf *m;
4237 struct sadb_msg *p;
4238 int len;
4239
4240 CTASSERT(PFKEY_ALIGN8(sizeof(struct sadb_msg)) <= MCLBYTES);
4241
4242 len = PFKEY_ALIGN8(sizeof(struct sadb_msg));
4243
4244 m = key_alloc_mbuf_simple(len, mflag);
4245 if (!m)
4246 return NULL;
4247 m->m_pkthdr.len = m->m_len = len;
4248 m->m_next = NULL;
4249
4250 p = mtod(m, struct sadb_msg *);
4251
4252 memset(p, 0, len);
4253 p->sadb_msg_version = PF_KEY_V2;
4254 p->sadb_msg_type = type;
4255 p->sadb_msg_errno = 0;
4256 p->sadb_msg_satype = satype;
4257 p->sadb_msg_len = PFKEY_UNIT64(tlen);
4258 p->sadb_msg_reserved = reserved;
4259 p->sadb_msg_seq = seq;
4260 p->sadb_msg_pid = (u_int32_t)pid;
4261
4262 return m;
4263 }
4264
4265 /*
4266 * copy secasvar data into sadb_address.
4267 */
4268 static struct mbuf *
key_setsadbsa(struct secasvar * sav)4269 key_setsadbsa(struct secasvar *sav)
4270 {
4271 struct mbuf *m;
4272 struct sadb_sa *p;
4273 int len;
4274
4275 len = PFKEY_ALIGN8(sizeof(struct sadb_sa));
4276 m = key_alloc_mbuf(len, M_WAITOK);
4277 KASSERT(m->m_next == NULL);
4278
4279 p = mtod(m, struct sadb_sa *);
4280
4281 memset(p, 0, len);
4282 p->sadb_sa_len = PFKEY_UNIT64(len);
4283 p->sadb_sa_exttype = SADB_EXT_SA;
4284 p->sadb_sa_spi = sav->spi;
4285 p->sadb_sa_replay = (sav->replay != NULL ? sav->replay->wsize : 0);
4286 p->sadb_sa_state = sav->state;
4287 p->sadb_sa_auth = sav->alg_auth;
4288 p->sadb_sa_encrypt = sav->alg_enc;
4289 p->sadb_sa_flags = sav->flags;
4290
4291 return m;
4292 }
4293
4294 static uint8_t
key_sabits(const struct sockaddr * saddr)4295 key_sabits(const struct sockaddr *saddr)
4296 {
4297 switch (saddr->sa_family) {
4298 case AF_INET:
4299 return _BITS(sizeof(struct in_addr));
4300 case AF_INET6:
4301 return _BITS(sizeof(struct in6_addr));
4302 default:
4303 return FULLMASK;
4304 }
4305 }
4306
4307 /*
4308 * set data into sadb_address.
4309 */
4310 static struct mbuf *
key_setsadbaddr(u_int16_t exttype,const struct sockaddr * saddr,u_int8_t prefixlen,u_int16_t ul_proto,int mflag)4311 key_setsadbaddr(u_int16_t exttype, const struct sockaddr *saddr,
4312 u_int8_t prefixlen, u_int16_t ul_proto, int mflag)
4313 {
4314 struct mbuf *m;
4315 struct sadb_address *p;
4316 size_t len;
4317
4318 len = PFKEY_ALIGN8(sizeof(struct sadb_address)) +
4319 PFKEY_ALIGN8(saddr->sa_len);
4320 m = key_alloc_mbuf(len, mflag);
4321 if (!m || m->m_next) { /*XXX*/
4322 m_freem(m);
4323 return NULL;
4324 }
4325
4326 p = mtod(m, struct sadb_address *);
4327
4328 memset(p, 0, len);
4329 p->sadb_address_len = PFKEY_UNIT64(len);
4330 p->sadb_address_exttype = exttype;
4331 p->sadb_address_proto = ul_proto;
4332 if (prefixlen == FULLMASK) {
4333 prefixlen = key_sabits(saddr);
4334 }
4335 p->sadb_address_prefixlen = prefixlen;
4336 p->sadb_address_reserved = 0;
4337
4338 memcpy(mtod(m, char *) + PFKEY_ALIGN8(sizeof(struct sadb_address)),
4339 saddr, saddr->sa_len);
4340
4341 return m;
4342 }
4343
4344 #if 0
4345 /*
4346 * set data into sadb_ident.
4347 */
4348 static struct mbuf *
4349 key_setsadbident(u_int16_t exttype, u_int16_t idtype,
4350 void *string, int stringlen, u_int64_t id)
4351 {
4352 struct mbuf *m;
4353 struct sadb_ident *p;
4354 size_t len;
4355
4356 len = PFKEY_ALIGN8(sizeof(struct sadb_ident)) + PFKEY_ALIGN8(stringlen);
4357 m = key_alloc_mbuf(len);
4358 if (!m || m->m_next) { /*XXX*/
4359 m_freem(m);
4360 return NULL;
4361 }
4362
4363 p = mtod(m, struct sadb_ident *);
4364
4365 memset(p, 0, len);
4366 p->sadb_ident_len = PFKEY_UNIT64(len);
4367 p->sadb_ident_exttype = exttype;
4368 p->sadb_ident_type = idtype;
4369 p->sadb_ident_reserved = 0;
4370 p->sadb_ident_id = id;
4371
4372 memcpy(mtod(m, void *) + PFKEY_ALIGN8(sizeof(struct sadb_ident)),
4373 string, stringlen);
4374
4375 return m;
4376 }
4377 #endif
4378
4379 /*
4380 * set data into sadb_x_sa2.
4381 */
4382 static struct mbuf *
key_setsadbxsa2(u_int8_t mode,u_int32_t seq,u_int16_t reqid)4383 key_setsadbxsa2(u_int8_t mode, u_int32_t seq, u_int16_t reqid)
4384 {
4385 struct mbuf *m;
4386 struct sadb_x_sa2 *p;
4387 size_t len;
4388
4389 len = PFKEY_ALIGN8(sizeof(struct sadb_x_sa2));
4390 m = key_alloc_mbuf(len, M_WAITOK);
4391 KASSERT(m->m_next == NULL);
4392
4393 p = mtod(m, struct sadb_x_sa2 *);
4394
4395 memset(p, 0, len);
4396 p->sadb_x_sa2_len = PFKEY_UNIT64(len);
4397 p->sadb_x_sa2_exttype = SADB_X_EXT_SA2;
4398 p->sadb_x_sa2_mode = mode;
4399 p->sadb_x_sa2_reserved1 = 0;
4400 p->sadb_x_sa2_reserved2 = 0;
4401 p->sadb_x_sa2_sequence = seq;
4402 p->sadb_x_sa2_reqid = reqid;
4403
4404 return m;
4405 }
4406
4407 /*
4408 * set data into sadb_x_policy
4409 */
4410 static struct mbuf *
key_setsadbxpolicy(const u_int16_t type,const u_int8_t dir,const u_int32_t id,int mflag)4411 key_setsadbxpolicy(const u_int16_t type, const u_int8_t dir, const u_int32_t id,
4412 int mflag)
4413 {
4414 struct mbuf *m;
4415 struct sadb_x_policy *p;
4416 size_t len;
4417
4418 len = PFKEY_ALIGN8(sizeof(struct sadb_x_policy));
4419 m = key_alloc_mbuf(len, mflag);
4420 if (!m || m->m_next) { /*XXX*/
4421 m_freem(m);
4422 return NULL;
4423 }
4424
4425 p = mtod(m, struct sadb_x_policy *);
4426
4427 memset(p, 0, len);
4428 p->sadb_x_policy_len = PFKEY_UNIT64(len);
4429 p->sadb_x_policy_exttype = SADB_X_EXT_POLICY;
4430 p->sadb_x_policy_type = type;
4431 p->sadb_x_policy_dir = dir;
4432 p->sadb_x_policy_id = id;
4433
4434 return m;
4435 }
4436
4437 /* %%% utilities */
4438 /*
4439 * copy a buffer into the new buffer allocated.
4440 */
4441 static void *
key_newbuf(const void * src,u_int len)4442 key_newbuf(const void *src, u_int len)
4443 {
4444 void *new;
4445
4446 new = kmem_alloc(len, KM_SLEEP);
4447 memcpy(new, src, len);
4448
4449 return new;
4450 }
4451
4452 /* compare my own address
4453 * OUT: 1: true, i.e. my address.
4454 * 0: false
4455 */
4456 int
key_ismyaddr(const struct sockaddr * sa)4457 key_ismyaddr(const struct sockaddr *sa)
4458 {
4459 #ifdef INET
4460 const struct sockaddr_in *sin;
4461 const struct in_ifaddr *ia;
4462 int s;
4463 #endif
4464
4465 KASSERT(sa != NULL);
4466
4467 switch (sa->sa_family) {
4468 #ifdef INET
4469 case AF_INET:
4470 sin = (const struct sockaddr_in *)sa;
4471 s = pserialize_read_enter();
4472 IN_ADDRLIST_READER_FOREACH(ia) {
4473 if (sin->sin_family == ia->ia_addr.sin_family &&
4474 sin->sin_len == ia->ia_addr.sin_len &&
4475 sin->sin_addr.s_addr == ia->ia_addr.sin_addr.s_addr)
4476 {
4477 pserialize_read_exit(s);
4478 return 1;
4479 }
4480 }
4481 pserialize_read_exit(s);
4482 break;
4483 #endif
4484 #ifdef INET6
4485 case AF_INET6:
4486 return key_ismyaddr6((const struct sockaddr_in6 *)sa);
4487 #endif
4488 }
4489
4490 return 0;
4491 }
4492
4493 #ifdef INET6
4494 /*
4495 * compare my own address for IPv6.
4496 * 1: ours
4497 * 0: other
4498 * NOTE: derived ip6_input() in KAME. This is necessary to modify more.
4499 */
4500 #include <netinet6/in6_var.h>
4501
4502 static int
key_ismyaddr6(const struct sockaddr_in6 * sin6)4503 key_ismyaddr6(const struct sockaddr_in6 *sin6)
4504 {
4505 struct in6_ifaddr *ia;
4506 int s;
4507 struct psref psref;
4508 int bound;
4509 int ours = 1;
4510
4511 bound = curlwp_bind();
4512 s = pserialize_read_enter();
4513 IN6_ADDRLIST_READER_FOREACH(ia) {
4514 if (key_sockaddr_match((const struct sockaddr *)&sin6,
4515 (const struct sockaddr *)&ia->ia_addr, 0)) {
4516 pserialize_read_exit(s);
4517 goto ours;
4518 }
4519
4520 if (IN6_IS_ADDR_MULTICAST(&sin6->sin6_addr)) {
4521 bool ingroup;
4522
4523 ia6_acquire(ia, &psref);
4524 pserialize_read_exit(s);
4525
4526 /*
4527 * XXX Multicast
4528 * XXX why do we care about multlicast here while we don't care
4529 * about IPv4 multicast??
4530 * XXX scope
4531 */
4532 ingroup = in6_multi_group(&sin6->sin6_addr, ia->ia_ifp);
4533 if (ingroup) {
4534 ia6_release(ia, &psref);
4535 goto ours;
4536 }
4537
4538 s = pserialize_read_enter();
4539 ia6_release(ia, &psref);
4540 }
4541
4542 }
4543 pserialize_read_exit(s);
4544
4545 /* loopback, just for safety */
4546 if (IN6_IS_ADDR_LOOPBACK(&sin6->sin6_addr))
4547 goto ours;
4548
4549 ours = 0;
4550 ours:
4551 curlwp_bindx(bound);
4552
4553 return ours;
4554 }
4555 #endif /*INET6*/
4556
4557 /*
4558 * compare two secasindex structure.
4559 * flag can specify to compare 2 saidxes.
4560 * compare two secasindex structure without both mode and reqid.
4561 * don't compare port.
4562 * IN:
4563 * saidx0: source, it can be in SAD.
4564 * saidx1: object.
4565 * OUT:
4566 * 1 : equal
4567 * 0 : not equal
4568 */
4569 static int
key_saidx_match(const struct secasindex * saidx0,const struct secasindex * saidx1,int flag)4570 key_saidx_match(
4571 const struct secasindex *saidx0,
4572 const struct secasindex *saidx1,
4573 int flag)
4574 {
4575 int chkport;
4576 const struct sockaddr *sa0src, *sa0dst, *sa1src, *sa1dst;
4577
4578 KASSERT(saidx0 != NULL);
4579 KASSERT(saidx1 != NULL);
4580
4581 /* sanity */
4582 if (saidx0->proto != saidx1->proto)
4583 return 0;
4584
4585 if (flag == CMP_EXACTLY) {
4586 if (saidx0->mode != saidx1->mode)
4587 return 0;
4588 if (saidx0->reqid != saidx1->reqid)
4589 return 0;
4590 if (memcmp(&saidx0->src, &saidx1->src, saidx0->src.sa.sa_len) != 0 ||
4591 memcmp(&saidx0->dst, &saidx1->dst, saidx0->dst.sa.sa_len) != 0)
4592 return 0;
4593 } else {
4594
4595 /* CMP_MODE_REQID, CMP_REQID, CMP_HEAD */
4596 if (flag == CMP_MODE_REQID ||flag == CMP_REQID) {
4597 /*
4598 * If reqid of SPD is non-zero, unique SA is required.
4599 * The result must be of same reqid in this case.
4600 */
4601 if (saidx1->reqid != 0 && saidx0->reqid != saidx1->reqid)
4602 return 0;
4603 }
4604
4605 if (flag == CMP_MODE_REQID) {
4606 if (saidx0->mode != IPSEC_MODE_ANY &&
4607 saidx0->mode != saidx1->mode)
4608 return 0;
4609 }
4610
4611
4612 sa0src = &saidx0->src.sa;
4613 sa0dst = &saidx0->dst.sa;
4614 sa1src = &saidx1->src.sa;
4615 sa1dst = &saidx1->dst.sa;
4616 /*
4617 * If NAT-T is enabled, check ports for tunnel mode.
4618 * For ipsecif(4), check ports for transport mode, too.
4619 * Don't check ports if they are set to zero
4620 * in the SPD: This means we have a non-generated
4621 * SPD which can't know UDP ports.
4622 */
4623 if (saidx1->mode == IPSEC_MODE_TUNNEL ||
4624 saidx1->mode == IPSEC_MODE_TRANSPORT)
4625 chkport = PORT_LOOSE;
4626 else
4627 chkport = PORT_NONE;
4628
4629 if (!key_sockaddr_match(sa0src, sa1src, chkport)) {
4630 return 0;
4631 }
4632 if (!key_sockaddr_match(sa0dst, sa1dst, chkport)) {
4633 return 0;
4634 }
4635 }
4636
4637 return 1;
4638 }
4639
4640 /*
4641 * compare two secindex structure exactly.
4642 * IN:
4643 * spidx0: source, it is often in SPD.
4644 * spidx1: object, it is often from PFKEY message.
4645 * OUT:
4646 * 1 : equal
4647 * 0 : not equal
4648 */
4649 static int
key_spidx_match_exactly(const struct secpolicyindex * spidx0,const struct secpolicyindex * spidx1)4650 key_spidx_match_exactly(
4651 const struct secpolicyindex *spidx0,
4652 const struct secpolicyindex *spidx1)
4653 {
4654
4655 KASSERT(spidx0 != NULL);
4656 KASSERT(spidx1 != NULL);
4657
4658 /* sanity */
4659 if (spidx0->prefs != spidx1->prefs ||
4660 spidx0->prefd != spidx1->prefd ||
4661 spidx0->ul_proto != spidx1->ul_proto)
4662 return 0;
4663
4664 return key_sockaddr_match(&spidx0->src.sa, &spidx1->src.sa, PORT_STRICT) &&
4665 key_sockaddr_match(&spidx0->dst.sa, &spidx1->dst.sa, PORT_STRICT);
4666 }
4667
4668 /*
4669 * compare two secindex structure with mask.
4670 * IN:
4671 * spidx0: source, it is often in SPD.
4672 * spidx1: object, it is often from IP header.
4673 * OUT:
4674 * 1 : equal
4675 * 0 : not equal
4676 */
4677 static int
key_spidx_match_withmask(const struct secpolicyindex * spidx0,const struct secpolicyindex * spidx1)4678 key_spidx_match_withmask(
4679 const struct secpolicyindex *spidx0,
4680 const struct secpolicyindex *spidx1)
4681 {
4682
4683 KASSERT(spidx0 != NULL);
4684 KASSERT(spidx1 != NULL);
4685
4686 if (spidx0->src.sa.sa_family != spidx1->src.sa.sa_family ||
4687 spidx0->dst.sa.sa_family != spidx1->dst.sa.sa_family ||
4688 spidx0->src.sa.sa_len != spidx1->src.sa.sa_len ||
4689 spidx0->dst.sa.sa_len != spidx1->dst.sa.sa_len) {
4690 KEYDEBUG_PRINTF(KEYDEBUG_MATCH, ".sa wrong\n");
4691 return 0;
4692 }
4693
4694 /* if spidx.ul_proto == IPSEC_ULPROTO_ANY, ignore. */
4695 if (spidx0->ul_proto != (u_int16_t)IPSEC_ULPROTO_ANY &&
4696 spidx0->ul_proto != spidx1->ul_proto) {
4697 KEYDEBUG_PRINTF(KEYDEBUG_MATCH, "proto wrong\n");
4698 return 0;
4699 }
4700
4701 switch (spidx0->src.sa.sa_family) {
4702 case AF_INET:
4703 if (spidx0->src.sin.sin_port != IPSEC_PORT_ANY &&
4704 spidx0->src.sin.sin_port != spidx1->src.sin.sin_port) {
4705 KEYDEBUG_PRINTF(KEYDEBUG_MATCH, "v4 src port wrong\n");
4706 return 0;
4707 }
4708 if (!key_bb_match_withmask(&spidx0->src.sin.sin_addr,
4709 &spidx1->src.sin.sin_addr, spidx0->prefs)) {
4710 KEYDEBUG_PRINTF(KEYDEBUG_MATCH, "v4 src addr wrong\n");
4711 return 0;
4712 }
4713 break;
4714 case AF_INET6:
4715 if (spidx0->src.sin6.sin6_port != IPSEC_PORT_ANY &&
4716 spidx0->src.sin6.sin6_port != spidx1->src.sin6.sin6_port) {
4717 KEYDEBUG_PRINTF(KEYDEBUG_MATCH, "v6 src port wrong\n");
4718 return 0;
4719 }
4720 /*
4721 * scope_id check. if sin6_scope_id is 0, we regard it
4722 * as a wildcard scope, which matches any scope zone ID.
4723 */
4724 if (spidx0->src.sin6.sin6_scope_id &&
4725 spidx1->src.sin6.sin6_scope_id &&
4726 spidx0->src.sin6.sin6_scope_id != spidx1->src.sin6.sin6_scope_id) {
4727 KEYDEBUG_PRINTF(KEYDEBUG_MATCH, "v6 src scope wrong\n");
4728 return 0;
4729 }
4730 if (!key_bb_match_withmask(&spidx0->src.sin6.sin6_addr,
4731 &spidx1->src.sin6.sin6_addr, spidx0->prefs)) {
4732 KEYDEBUG_PRINTF(KEYDEBUG_MATCH, "v6 src addr wrong\n");
4733 return 0;
4734 }
4735 break;
4736 default:
4737 /* XXX */
4738 if (memcmp(&spidx0->src, &spidx1->src, spidx0->src.sa.sa_len) != 0) {
4739 KEYDEBUG_PRINTF(KEYDEBUG_MATCH, "src memcmp wrong\n");
4740 return 0;
4741 }
4742 break;
4743 }
4744
4745 switch (spidx0->dst.sa.sa_family) {
4746 case AF_INET:
4747 if (spidx0->dst.sin.sin_port != IPSEC_PORT_ANY &&
4748 spidx0->dst.sin.sin_port != spidx1->dst.sin.sin_port) {
4749 KEYDEBUG_PRINTF(KEYDEBUG_MATCH, "v4 dst port wrong\n");
4750 return 0;
4751 }
4752 if (!key_bb_match_withmask(&spidx0->dst.sin.sin_addr,
4753 &spidx1->dst.sin.sin_addr, spidx0->prefd)) {
4754 KEYDEBUG_PRINTF(KEYDEBUG_MATCH, "v4 dst addr wrong\n");
4755 return 0;
4756 }
4757 break;
4758 case AF_INET6:
4759 if (spidx0->dst.sin6.sin6_port != IPSEC_PORT_ANY &&
4760 spidx0->dst.sin6.sin6_port != spidx1->dst.sin6.sin6_port) {
4761 KEYDEBUG_PRINTF(KEYDEBUG_MATCH, "v6 dst port wrong\n");
4762 return 0;
4763 }
4764 /*
4765 * scope_id check. if sin6_scope_id is 0, we regard it
4766 * as a wildcard scope, which matches any scope zone ID.
4767 */
4768 if (spidx0->src.sin6.sin6_scope_id &&
4769 spidx1->src.sin6.sin6_scope_id &&
4770 spidx0->dst.sin6.sin6_scope_id != spidx1->dst.sin6.sin6_scope_id) {
4771 KEYDEBUG_PRINTF(KEYDEBUG_MATCH, "DP v6 dst scope wrong\n");
4772 return 0;
4773 }
4774 if (!key_bb_match_withmask(&spidx0->dst.sin6.sin6_addr,
4775 &spidx1->dst.sin6.sin6_addr, spidx0->prefd)) {
4776 KEYDEBUG_PRINTF(KEYDEBUG_MATCH, "v6 dst addr wrong\n");
4777 return 0;
4778 }
4779 break;
4780 default:
4781 /* XXX */
4782 if (memcmp(&spidx0->dst, &spidx1->dst, spidx0->dst.sa.sa_len) != 0) {
4783 KEYDEBUG_PRINTF(KEYDEBUG_MATCH, "dst memcmp wrong\n");
4784 return 0;
4785 }
4786 break;
4787 }
4788
4789 /* XXX Do we check other field ? e.g. flowinfo */
4790
4791 return 1;
4792 }
4793
4794 /* returns 0 on match */
4795 static int
key_portcomp(in_port_t port1,in_port_t port2,int howport)4796 key_portcomp(in_port_t port1, in_port_t port2, int howport)
4797 {
4798 switch (howport) {
4799 case PORT_NONE:
4800 return 0;
4801 case PORT_LOOSE:
4802 if (port1 == 0 || port2 == 0)
4803 return 0;
4804 /*FALLTHROUGH*/
4805 case PORT_STRICT:
4806 if (port1 != port2) {
4807 KEYDEBUG_PRINTF(KEYDEBUG_MATCH,
4808 "port fail %d != %d\n", ntohs(port1), ntohs(port2));
4809 return 1;
4810 }
4811 return 0;
4812 default:
4813 KASSERT(0);
4814 return 1;
4815 }
4816 }
4817
4818 /* returns 1 on match */
4819 static int
key_sockaddr_match(const struct sockaddr * sa1,const struct sockaddr * sa2,int howport)4820 key_sockaddr_match(
4821 const struct sockaddr *sa1,
4822 const struct sockaddr *sa2,
4823 int howport)
4824 {
4825 const struct sockaddr_in *sin1, *sin2;
4826 const struct sockaddr_in6 *sin61, *sin62;
4827 char s1[IPSEC_ADDRSTRLEN], s2[IPSEC_ADDRSTRLEN];
4828
4829 if (sa1->sa_family != sa2->sa_family || sa1->sa_len != sa2->sa_len) {
4830 KEYDEBUG_PRINTF(KEYDEBUG_MATCH,
4831 "fam/len fail %d != %d || %d != %d\n",
4832 sa1->sa_family, sa2->sa_family, sa1->sa_len,
4833 sa2->sa_len);
4834 return 0;
4835 }
4836
4837 switch (sa1->sa_family) {
4838 case AF_INET:
4839 if (sa1->sa_len != sizeof(struct sockaddr_in)) {
4840 KEYDEBUG_PRINTF(KEYDEBUG_MATCH,
4841 "len fail %d != %zu\n",
4842 sa1->sa_len, sizeof(struct sockaddr_in));
4843 return 0;
4844 }
4845 sin1 = (const struct sockaddr_in *)sa1;
4846 sin2 = (const struct sockaddr_in *)sa2;
4847 if (sin1->sin_addr.s_addr != sin2->sin_addr.s_addr) {
4848 KEYDEBUG_PRINTF(KEYDEBUG_MATCH,
4849 "addr fail %s != %s\n",
4850 (in_print(s1, sizeof(s1), &sin1->sin_addr), s1),
4851 (in_print(s2, sizeof(s2), &sin2->sin_addr), s2));
4852 return 0;
4853 }
4854 if (key_portcomp(sin1->sin_port, sin2->sin_port, howport)) {
4855 return 0;
4856 }
4857 KEYDEBUG_PRINTF(KEYDEBUG_MATCH,
4858 "addr success %s[%d] == %s[%d]\n",
4859 (in_print(s1, sizeof(s1), &sin1->sin_addr), s1),
4860 ntohs(sin1->sin_port),
4861 (in_print(s2, sizeof(s2), &sin2->sin_addr), s2),
4862 ntohs(sin2->sin_port));
4863 break;
4864 case AF_INET6:
4865 sin61 = (const struct sockaddr_in6 *)sa1;
4866 sin62 = (const struct sockaddr_in6 *)sa2;
4867 if (sa1->sa_len != sizeof(struct sockaddr_in6))
4868 return 0; /*EINVAL*/
4869
4870 if (sin61->sin6_scope_id != sin62->sin6_scope_id) {
4871 return 0;
4872 }
4873 if (!IN6_ARE_ADDR_EQUAL(&sin61->sin6_addr, &sin62->sin6_addr)) {
4874 return 0;
4875 }
4876 if (key_portcomp(sin61->sin6_port, sin62->sin6_port, howport)) {
4877 return 0;
4878 }
4879 break;
4880 default:
4881 if (memcmp(sa1, sa2, sa1->sa_len) != 0)
4882 return 0;
4883 break;
4884 }
4885
4886 return 1;
4887 }
4888
4889 /*
4890 * compare two buffers with mask.
4891 * IN:
4892 * addr1: source
4893 * addr2: object
4894 * bits: Number of bits to compare
4895 * OUT:
4896 * 1 : equal
4897 * 0 : not equal
4898 */
4899 static int
key_bb_match_withmask(const void * a1,const void * a2,u_int bits)4900 key_bb_match_withmask(const void *a1, const void *a2, u_int bits)
4901 {
4902 const unsigned char *p1 = a1;
4903 const unsigned char *p2 = a2;
4904
4905 /* XXX: This could be considerably faster if we compare a word
4906 * at a time, but it is complicated on LSB Endian machines */
4907
4908 /* Handle null pointers */
4909 if (p1 == NULL || p2 == NULL)
4910 return (p1 == p2);
4911
4912 while (bits >= 8) {
4913 if (*p1++ != *p2++)
4914 return 0;
4915 bits -= 8;
4916 }
4917
4918 if (bits > 0) {
4919 u_int8_t mask = ~((1<<(8-bits))-1);
4920 if ((*p1 & mask) != (*p2 & mask))
4921 return 0;
4922 }
4923 return 1; /* Match! */
4924 }
4925
4926 static void
key_timehandler_spd(void)4927 key_timehandler_spd(void)
4928 {
4929 u_int dir;
4930 struct secpolicy *sp;
4931 volatile time_t now;
4932
4933 for (dir = 0; dir < IPSEC_DIR_MAX; dir++) {
4934 retry:
4935 mutex_enter(&key_spd.lock);
4936 /*
4937 * To avoid for sp->created to overtake "now" because of
4938 * waiting mutex, set time_uptime here.
4939 */
4940 now = time_uptime;
4941 SPLIST_WRITER_FOREACH(sp, dir) {
4942 KASSERTMSG(sp->state != IPSEC_SPSTATE_DEAD,
4943 "sp->state=%u", sp->state);
4944
4945 if (sp->lifetime == 0 && sp->validtime == 0)
4946 continue;
4947
4948 if ((sp->lifetime && now - sp->created > sp->lifetime) ||
4949 (sp->validtime && now - sp->lastused > sp->validtime)) {
4950 key_unlink_sp(sp);
4951 mutex_exit(&key_spd.lock);
4952 key_spdexpire(sp);
4953 key_destroy_sp(sp);
4954 goto retry;
4955 }
4956 }
4957 mutex_exit(&key_spd.lock);
4958 }
4959
4960 retry_socksplist:
4961 mutex_enter(&key_spd.lock);
4962 SOCKSPLIST_WRITER_FOREACH(sp) {
4963 if (sp->state != IPSEC_SPSTATE_DEAD)
4964 continue;
4965
4966 key_unlink_sp(sp);
4967 mutex_exit(&key_spd.lock);
4968 key_destroy_sp(sp);
4969 goto retry_socksplist;
4970 }
4971 mutex_exit(&key_spd.lock);
4972 }
4973
4974 static void
key_timehandler_sad(void)4975 key_timehandler_sad(void)
4976 {
4977 struct secashead *sah;
4978 int s;
4979 volatile time_t now;
4980
4981 restart:
4982 mutex_enter(&key_sad.lock);
4983 SAHLIST_WRITER_FOREACH(sah) {
4984 /* If sah has been dead and has no sav, then delete it */
4985 if (sah->state == SADB_SASTATE_DEAD &&
4986 !key_sah_has_sav(sah)) {
4987 key_unlink_sah(sah);
4988 mutex_exit(&key_sad.lock);
4989 key_destroy_sah(sah);
4990 goto restart;
4991 }
4992 }
4993 mutex_exit(&key_sad.lock);
4994
4995 s = pserialize_read_enter();
4996 SAHLIST_READER_FOREACH(sah) {
4997 struct secasvar *sav;
4998
4999 key_sah_ref(sah);
5000 pserialize_read_exit(s);
5001
5002 /* if LARVAL entry doesn't become MATURE, delete it. */
5003 mutex_enter(&key_sad.lock);
5004 restart_sav_LARVAL:
5005 /*
5006 * Same as key_timehandler_spd(), set time_uptime here.
5007 */
5008 now = time_uptime;
5009 SAVLIST_WRITER_FOREACH(sav, sah, SADB_SASTATE_LARVAL) {
5010 if (now - sav->created > key_larval_lifetime) {
5011 key_sa_chgstate(sav, SADB_SASTATE_DEAD);
5012 goto restart_sav_LARVAL;
5013 }
5014 }
5015 mutex_exit(&key_sad.lock);
5016
5017 /*
5018 * check MATURE entry to start to send expire message
5019 * whether or not.
5020 */
5021 restart_sav_MATURE:
5022 mutex_enter(&key_sad.lock);
5023 /*
5024 * ditto
5025 */
5026 now = time_uptime;
5027 SAVLIST_WRITER_FOREACH(sav, sah, SADB_SASTATE_MATURE) {
5028 /* we don't need to check. */
5029 if (sav->lft_s == NULL)
5030 continue;
5031
5032 /* sanity check */
5033 KASSERT(sav->lft_c != NULL);
5034
5035 /* check SOFT lifetime */
5036 if (sav->lft_s->sadb_lifetime_addtime != 0 &&
5037 now - sav->created > sav->lft_s->sadb_lifetime_addtime) {
5038 /*
5039 * check SA to be used whether or not.
5040 * when SA hasn't been used, delete it.
5041 */
5042 if (sav->lft_c->sadb_lifetime_usetime == 0) {
5043 key_sa_chgstate(sav, SADB_SASTATE_DEAD);
5044 mutex_exit(&key_sad.lock);
5045 } else {
5046 key_sa_chgstate(sav, SADB_SASTATE_DYING);
5047 mutex_exit(&key_sad.lock);
5048 /*
5049 * XXX If we keep to send expire
5050 * message in the status of
5051 * DYING. Do remove below code.
5052 */
5053 key_expire(sav);
5054 }
5055 goto restart_sav_MATURE;
5056 }
5057 /* check SOFT lifetime by bytes */
5058 /*
5059 * XXX I don't know the way to delete this SA
5060 * when new SA is installed. Caution when it's
5061 * installed too big lifetime by time.
5062 */
5063 else {
5064 uint64_t lft_c_bytes = 0;
5065 lifetime_counters_t sum = {0};
5066
5067 percpu_foreach_xcall(sav->lft_c_counters_percpu,
5068 XC_HIGHPRI_IPL(IPL_SOFTNET),
5069 key_sum_lifetime_counters, sum);
5070 lft_c_bytes = sum[LIFETIME_COUNTER_BYTES];
5071
5072 if (sav->lft_s->sadb_lifetime_bytes == 0 ||
5073 sav->lft_s->sadb_lifetime_bytes >= lft_c_bytes)
5074 continue;
5075
5076 key_sa_chgstate(sav, SADB_SASTATE_DYING);
5077 mutex_exit(&key_sad.lock);
5078 /*
5079 * XXX If we keep to send expire
5080 * message in the status of
5081 * DYING. Do remove below code.
5082 */
5083 key_expire(sav);
5084 goto restart_sav_MATURE;
5085 }
5086 }
5087 mutex_exit(&key_sad.lock);
5088
5089 /* check DYING entry to change status to DEAD. */
5090 mutex_enter(&key_sad.lock);
5091 restart_sav_DYING:
5092 /*
5093 * ditto
5094 */
5095 now = time_uptime;
5096 SAVLIST_WRITER_FOREACH(sav, sah, SADB_SASTATE_DYING) {
5097 /* we don't need to check. */
5098 if (sav->lft_h == NULL)
5099 continue;
5100
5101 /* sanity check */
5102 KASSERT(sav->lft_c != NULL);
5103
5104 if (sav->lft_h->sadb_lifetime_addtime != 0 &&
5105 now - sav->created > sav->lft_h->sadb_lifetime_addtime) {
5106 key_sa_chgstate(sav, SADB_SASTATE_DEAD);
5107 goto restart_sav_DYING;
5108 }
5109 #if 0 /* XXX Should we keep to send expire message until HARD lifetime ? */
5110 else if (sav->lft_s != NULL
5111 && sav->lft_s->sadb_lifetime_addtime != 0
5112 && now - sav->created > sav->lft_s->sadb_lifetime_addtime) {
5113 /*
5114 * XXX: should be checked to be
5115 * installed the valid SA.
5116 */
5117
5118 /*
5119 * If there is no SA then sending
5120 * expire message.
5121 */
5122 key_expire(sav);
5123 }
5124 #endif
5125 /* check HARD lifetime by bytes */
5126 else {
5127 uint64_t lft_c_bytes = 0;
5128 lifetime_counters_t sum = {0};
5129
5130 percpu_foreach_xcall(sav->lft_c_counters_percpu,
5131 XC_HIGHPRI_IPL(IPL_SOFTNET),
5132 key_sum_lifetime_counters, sum);
5133 lft_c_bytes = sum[LIFETIME_COUNTER_BYTES];
5134
5135 if (sav->lft_h->sadb_lifetime_bytes == 0 ||
5136 sav->lft_h->sadb_lifetime_bytes >= lft_c_bytes)
5137 continue;
5138
5139 key_sa_chgstate(sav, SADB_SASTATE_DEAD);
5140 goto restart_sav_DYING;
5141 }
5142 }
5143 mutex_exit(&key_sad.lock);
5144
5145 /* delete entry in DEAD */
5146 restart_sav_DEAD:
5147 mutex_enter(&key_sad.lock);
5148 SAVLIST_WRITER_FOREACH(sav, sah, SADB_SASTATE_DEAD) {
5149 key_unlink_sav(sav);
5150 mutex_exit(&key_sad.lock);
5151 key_destroy_sav(sav);
5152 goto restart_sav_DEAD;
5153 }
5154 mutex_exit(&key_sad.lock);
5155
5156 s = pserialize_read_enter();
5157 key_sah_unref(sah);
5158 }
5159 pserialize_read_exit(s);
5160 }
5161
5162 static void
key_timehandler_acq(void)5163 key_timehandler_acq(void)
5164 {
5165 #ifndef IPSEC_NONBLOCK_ACQUIRE
5166 struct secacq *acq, *nextacq;
5167 volatile time_t now;
5168
5169 restart:
5170 mutex_enter(&key_misc.lock);
5171 /*
5172 * Same as key_timehandler_spd(), set time_uptime here.
5173 */
5174 now = time_uptime;
5175 LIST_FOREACH_SAFE(acq, &key_misc.acqlist, chain, nextacq) {
5176 if (now - acq->created > key_blockacq_lifetime) {
5177 LIST_REMOVE(acq, chain);
5178 mutex_exit(&key_misc.lock);
5179 kmem_free(acq, sizeof(*acq));
5180 goto restart;
5181 }
5182 }
5183 mutex_exit(&key_misc.lock);
5184 #endif
5185 }
5186
5187 static void
key_timehandler_spacq(void)5188 key_timehandler_spacq(void)
5189 {
5190 #ifdef notyet
5191 struct secspacq *acq, *nextacq;
5192 time_t now = time_uptime;
5193
5194 LIST_FOREACH_SAFE(acq, &key_misc.spacqlist, chain, nextacq) {
5195 if (now - acq->created > key_blockacq_lifetime) {
5196 KASSERT(__LIST_CHAINED(acq));
5197 LIST_REMOVE(acq, chain);
5198 kmem_free(acq, sizeof(*acq));
5199 }
5200 }
5201 #endif
5202 }
5203
5204 static unsigned int key_timehandler_work_enqueued = 0;
5205
5206 /*
5207 * time handler.
5208 * scanning SPD and SAD to check status for each entries,
5209 * and do to remove or to expire.
5210 */
5211 static void
key_timehandler_work(struct work * wk,void * arg)5212 key_timehandler_work(struct work *wk, void *arg)
5213 {
5214
5215 /* We can allow enqueuing another work at this point */
5216 atomic_swap_uint(&key_timehandler_work_enqueued, 0);
5217
5218 key_timehandler_spd();
5219 key_timehandler_sad();
5220 key_timehandler_acq();
5221 key_timehandler_spacq();
5222
5223 key_acquire_sendup_pending_mbuf();
5224
5225 /* do exchange to tick time !! */
5226 callout_reset(&key_timehandler_ch, hz, key_timehandler, NULL);
5227
5228 return;
5229 }
5230
5231 static void
key_timehandler(void * arg)5232 key_timehandler(void *arg)
5233 {
5234
5235 /* Avoid enqueuing another work when one is already enqueued */
5236 if (atomic_swap_uint(&key_timehandler_work_enqueued, 1) == 1)
5237 return;
5238
5239 workqueue_enqueue(key_timehandler_wq, &key_timehandler_wk, NULL);
5240 }
5241
5242 u_long
key_random(void)5243 key_random(void)
5244 {
5245 u_long value;
5246
5247 key_randomfill(&value, sizeof(value));
5248 return value;
5249 }
5250
5251 void
key_randomfill(void * p,size_t l)5252 key_randomfill(void *p, size_t l)
5253 {
5254
5255 cprng_fast(p, l);
5256 }
5257
5258 /*
5259 * map SADB_SATYPE_* to IPPROTO_*.
5260 * if satype == SADB_SATYPE then satype is mapped to ~0.
5261 * OUT:
5262 * 0: invalid satype.
5263 */
5264 static u_int16_t
key_satype2proto(u_int8_t satype)5265 key_satype2proto(u_int8_t satype)
5266 {
5267 switch (satype) {
5268 case SADB_SATYPE_UNSPEC:
5269 return IPSEC_PROTO_ANY;
5270 case SADB_SATYPE_AH:
5271 return IPPROTO_AH;
5272 case SADB_SATYPE_ESP:
5273 return IPPROTO_ESP;
5274 case SADB_X_SATYPE_IPCOMP:
5275 return IPPROTO_IPCOMP;
5276 case SADB_X_SATYPE_TCPSIGNATURE:
5277 return IPPROTO_TCP;
5278 default:
5279 return 0;
5280 }
5281 /* NOTREACHED */
5282 }
5283
5284 /*
5285 * map IPPROTO_* to SADB_SATYPE_*
5286 * OUT:
5287 * 0: invalid protocol type.
5288 */
5289 static u_int8_t
key_proto2satype(u_int16_t proto)5290 key_proto2satype(u_int16_t proto)
5291 {
5292 switch (proto) {
5293 case IPPROTO_AH:
5294 return SADB_SATYPE_AH;
5295 case IPPROTO_ESP:
5296 return SADB_SATYPE_ESP;
5297 case IPPROTO_IPCOMP:
5298 return SADB_X_SATYPE_IPCOMP;
5299 case IPPROTO_TCP:
5300 return SADB_X_SATYPE_TCPSIGNATURE;
5301 default:
5302 return 0;
5303 }
5304 /* NOTREACHED */
5305 }
5306
5307 static int
key_setsecasidx(int proto,int mode,int reqid,const struct sockaddr * src,const struct sockaddr * dst,struct secasindex * saidx)5308 key_setsecasidx(int proto, int mode, int reqid,
5309 const struct sockaddr *src, const struct sockaddr *dst,
5310 struct secasindex * saidx)
5311 {
5312 const union sockaddr_union *src_u = (const union sockaddr_union *)src;
5313 const union sockaddr_union *dst_u = (const union sockaddr_union *)dst;
5314
5315 /* sa len safety check */
5316 if (key_checksalen(src_u) != 0)
5317 return -1;
5318 if (key_checksalen(dst_u) != 0)
5319 return -1;
5320
5321 memset(saidx, 0, sizeof(*saidx));
5322 saidx->proto = proto;
5323 saidx->mode = mode;
5324 saidx->reqid = reqid;
5325 memcpy(&saidx->src, src_u, src_u->sa.sa_len);
5326 memcpy(&saidx->dst, dst_u, dst_u->sa.sa_len);
5327
5328 key_porttosaddr(&((saidx)->src), 0);
5329 key_porttosaddr(&((saidx)->dst), 0);
5330 return 0;
5331 }
5332
5333 static void
key_init_spidx_bymsghdr(struct secpolicyindex * spidx,const struct sadb_msghdr * mhp)5334 key_init_spidx_bymsghdr(struct secpolicyindex *spidx,
5335 const struct sadb_msghdr *mhp)
5336 {
5337 const struct sadb_address *src0, *dst0;
5338 const struct sockaddr *src, *dst;
5339 const struct sadb_x_policy *xpl0;
5340
5341 src0 = mhp->ext[SADB_EXT_ADDRESS_SRC];
5342 dst0 = mhp->ext[SADB_EXT_ADDRESS_DST];
5343 src = key_msghdr_get_sockaddr(mhp, SADB_EXT_ADDRESS_SRC);
5344 dst = key_msghdr_get_sockaddr(mhp, SADB_EXT_ADDRESS_DST);
5345 xpl0 = mhp->ext[SADB_X_EXT_POLICY];
5346
5347 memset(spidx, 0, sizeof(*spidx));
5348 spidx->dir = xpl0->sadb_x_policy_dir;
5349 spidx->prefs = src0->sadb_address_prefixlen;
5350 spidx->prefd = dst0->sadb_address_prefixlen;
5351 spidx->ul_proto = src0->sadb_address_proto;
5352 /* XXX boundary check against sa_len */
5353 memcpy(&spidx->src, src, src->sa_len);
5354 memcpy(&spidx->dst, dst, dst->sa_len);
5355 }
5356
5357 /* %%% PF_KEY */
5358 /*
5359 * SADB_GETSPI processing is to receive
5360 * <base, (SA2), src address, dst address, (SPI range)>
5361 * from the IKMPd, to assign a unique spi value, to hang on the INBOUND
5362 * tree with the status of LARVAL, and send
5363 * <base, SA(*), address(SD)>
5364 * to the IKMPd.
5365 *
5366 * IN: mhp: pointer to the pointer to each header.
5367 * OUT: NULL if fail.
5368 * other if success, return pointer to the message to send.
5369 */
5370 static int
key_api_getspi(struct socket * so,struct mbuf * m,const struct sadb_msghdr * mhp)5371 key_api_getspi(struct socket *so, struct mbuf *m,
5372 const struct sadb_msghdr *mhp)
5373 {
5374 const struct sockaddr *src, *dst;
5375 struct secasindex saidx;
5376 struct secashead *sah;
5377 struct secasvar *newsav;
5378 u_int8_t proto;
5379 u_int32_t spi;
5380 u_int8_t mode;
5381 u_int16_t reqid;
5382 int error;
5383
5384 if (mhp->ext[SADB_EXT_ADDRESS_SRC] == NULL ||
5385 mhp->ext[SADB_EXT_ADDRESS_DST] == NULL) {
5386 IPSECLOG(LOG_DEBUG, "invalid message is passed.\n");
5387 return key_senderror(so, m, EINVAL);
5388 }
5389 if (mhp->extlen[SADB_EXT_ADDRESS_SRC] < sizeof(struct sadb_address) ||
5390 mhp->extlen[SADB_EXT_ADDRESS_DST] < sizeof(struct sadb_address)) {
5391 IPSECLOG(LOG_DEBUG, "invalid message is passed.\n");
5392 return key_senderror(so, m, EINVAL);
5393 }
5394 if (mhp->ext[SADB_X_EXT_SA2] != NULL) {
5395 const struct sadb_x_sa2 *sa2 = mhp->ext[SADB_X_EXT_SA2];
5396 mode = sa2->sadb_x_sa2_mode;
5397 reqid = sa2->sadb_x_sa2_reqid;
5398 } else {
5399 mode = IPSEC_MODE_ANY;
5400 reqid = 0;
5401 }
5402
5403 src = key_msghdr_get_sockaddr(mhp, SADB_EXT_ADDRESS_SRC);
5404 dst = key_msghdr_get_sockaddr(mhp, SADB_EXT_ADDRESS_DST);
5405
5406 /* map satype to proto */
5407 proto = key_satype2proto(mhp->msg->sadb_msg_satype);
5408 if (proto == 0) {
5409 IPSECLOG(LOG_DEBUG, "invalid satype is passed.\n");
5410 return key_senderror(so, m, EINVAL);
5411 }
5412
5413
5414 error = key_setsecasidx(proto, mode, reqid, src, dst, &saidx);
5415 if (error != 0)
5416 return key_senderror(so, m, EINVAL);
5417
5418 error = key_set_natt_ports(&saidx.src, &saidx.dst, mhp);
5419 if (error != 0)
5420 return key_senderror(so, m, EINVAL);
5421
5422 /* SPI allocation */
5423 spi = key_do_getnewspi(mhp->ext[SADB_EXT_SPIRANGE], &saidx);
5424 if (spi == 0)
5425 return key_senderror(so, m, EINVAL);
5426
5427 /* get a SA index */
5428 sah = key_getsah_ref(&saidx, CMP_REQID);
5429 if (sah == NULL) {
5430 /* create a new SA index */
5431 sah = key_newsah(&saidx);
5432 if (sah == NULL) {
5433 IPSECLOG(LOG_DEBUG, "No more memory.\n");
5434 return key_senderror(so, m, ENOBUFS);
5435 }
5436 }
5437
5438 /* get a new SA */
5439 /* XXX rewrite */
5440 newsav = KEY_NEWSAV(m, mhp, &error, proto);
5441 if (newsav == NULL) {
5442 key_sah_unref(sah);
5443 /* XXX don't free new SA index allocated in above. */
5444 return key_senderror(so, m, error);
5445 }
5446
5447 /* set spi */
5448 newsav->spi = htonl(spi);
5449
5450 /* Add to sah#savlist */
5451 key_init_sav(newsav);
5452 newsav->sah = sah;
5453 newsav->state = SADB_SASTATE_LARVAL;
5454 mutex_enter(&key_sad.lock);
5455 SAVLIST_WRITER_INSERT_TAIL(sah, SADB_SASTATE_LARVAL, newsav);
5456 mutex_exit(&key_sad.lock);
5457 key_validate_savlist(sah, SADB_SASTATE_LARVAL);
5458
5459 key_sah_unref(sah);
5460
5461 #ifndef IPSEC_NONBLOCK_ACQUIRE
5462 /* delete the entry in key_misc.acqlist */
5463 if (mhp->msg->sadb_msg_seq != 0) {
5464 struct secacq *acq;
5465 mutex_enter(&key_misc.lock);
5466 acq = key_getacqbyseq(mhp->msg->sadb_msg_seq);
5467 if (acq != NULL) {
5468 /* reset counter in order to deletion by timehandler. */
5469 acq->created = time_uptime;
5470 acq->count = 0;
5471 }
5472 mutex_exit(&key_misc.lock);
5473 }
5474 #endif
5475
5476 {
5477 struct mbuf *n, *nn;
5478 struct sadb_sa *m_sa;
5479 int off, len;
5480
5481 CTASSERT(PFKEY_ALIGN8(sizeof(struct sadb_msg)) +
5482 PFKEY_ALIGN8(sizeof(struct sadb_sa)) <= MCLBYTES);
5483
5484 /* create new sadb_msg to reply. */
5485 len = PFKEY_ALIGN8(sizeof(struct sadb_msg)) +
5486 PFKEY_ALIGN8(sizeof(struct sadb_sa));
5487
5488 n = key_alloc_mbuf_simple(len, M_WAITOK);
5489 n->m_len = len;
5490 n->m_next = NULL;
5491 off = 0;
5492
5493 m_copydata(m, 0, sizeof(struct sadb_msg), mtod(n, char *) + off);
5494 off += PFKEY_ALIGN8(sizeof(struct sadb_msg));
5495
5496 m_sa = (struct sadb_sa *)(mtod(n, char *) + off);
5497 m_sa->sadb_sa_len = PFKEY_UNIT64(sizeof(struct sadb_sa));
5498 m_sa->sadb_sa_exttype = SADB_EXT_SA;
5499 m_sa->sadb_sa_spi = htonl(spi);
5500 off += PFKEY_ALIGN8(sizeof(struct sadb_sa));
5501
5502 KASSERTMSG(off == len, "length inconsistency");
5503
5504 n->m_next = key_gather_mbuf(m, mhp, 0, 2, SADB_EXT_ADDRESS_SRC,
5505 SADB_EXT_ADDRESS_DST);
5506
5507 KASSERT(n->m_len >= sizeof(struct sadb_msg));
5508
5509 n->m_pkthdr.len = 0;
5510 for (nn = n; nn; nn = nn->m_next)
5511 n->m_pkthdr.len += nn->m_len;
5512
5513 key_fill_replymsg(n, newsav->seq);
5514 m_freem(m);
5515 return key_sendup_mbuf(so, n, KEY_SENDUP_ONE);
5516 }
5517 }
5518
5519 /*
5520 * allocating new SPI
5521 * called by key_api_getspi().
5522 * OUT:
5523 * 0: failure.
5524 * others: success.
5525 */
5526 static u_int32_t
key_do_getnewspi(const struct sadb_spirange * spirange,const struct secasindex * saidx)5527 key_do_getnewspi(const struct sadb_spirange *spirange,
5528 const struct secasindex *saidx)
5529 {
5530 u_int32_t newspi;
5531 u_int32_t spmin, spmax;
5532 int count = key_spi_trycnt;
5533
5534 /* set spi range to allocate */
5535 if (spirange != NULL) {
5536 spmin = spirange->sadb_spirange_min;
5537 spmax = spirange->sadb_spirange_max;
5538 } else {
5539 spmin = key_spi_minval;
5540 spmax = key_spi_maxval;
5541 }
5542 /* IPCOMP needs 2-byte SPI */
5543 if (saidx->proto == IPPROTO_IPCOMP) {
5544 u_int32_t t;
5545 if (spmin >= 0x10000)
5546 spmin = 0xffff;
5547 if (spmax >= 0x10000)
5548 spmax = 0xffff;
5549 if (spmin > spmax) {
5550 t = spmin; spmin = spmax; spmax = t;
5551 }
5552 }
5553
5554 if (spmin == spmax) {
5555 if (key_checkspidup(saidx, htonl(spmin))) {
5556 IPSECLOG(LOG_DEBUG, "SPI %u exists already.\n", spmin);
5557 return 0;
5558 }
5559
5560 count--; /* taking one cost. */
5561 newspi = spmin;
5562
5563 } else {
5564
5565 /* init SPI */
5566 newspi = 0;
5567
5568 /* when requesting to allocate spi ranged */
5569 while (count--) {
5570 /* generate pseudo-random SPI value ranged. */
5571 newspi = spmin + (key_random() % (spmax - spmin + 1));
5572
5573 if (!key_checkspidup(saidx, htonl(newspi)))
5574 break;
5575 }
5576
5577 if (count == 0 || newspi == 0) {
5578 IPSECLOG(LOG_DEBUG, "to allocate spi is failed.\n");
5579 return 0;
5580 }
5581 }
5582
5583 /* statistics */
5584 keystat.getspi_count =
5585 (keystat.getspi_count + key_spi_trycnt - count) / 2;
5586
5587 return newspi;
5588 }
5589
5590 static int
key_handle_natt_info(struct secasvar * sav,const struct sadb_msghdr * mhp)5591 key_handle_natt_info(struct secasvar *sav,
5592 const struct sadb_msghdr *mhp)
5593 {
5594 const char *msg = "?" ;
5595 struct sadb_x_nat_t_type *type;
5596 struct sadb_x_nat_t_port *sport, *dport;
5597 struct sadb_address *iaddr, *raddr;
5598 struct sadb_x_nat_t_frag *frag;
5599
5600 if (mhp->ext[SADB_X_EXT_NAT_T_TYPE] == NULL ||
5601 mhp->ext[SADB_X_EXT_NAT_T_SPORT] == NULL ||
5602 mhp->ext[SADB_X_EXT_NAT_T_DPORT] == NULL)
5603 return 0;
5604
5605 if (mhp->extlen[SADB_X_EXT_NAT_T_TYPE] < sizeof(*type)) {
5606 msg = "TYPE";
5607 goto bad;
5608 }
5609
5610 if (mhp->extlen[SADB_X_EXT_NAT_T_SPORT] < sizeof(*sport)) {
5611 msg = "SPORT";
5612 goto bad;
5613 }
5614
5615 if (mhp->extlen[SADB_X_EXT_NAT_T_DPORT] < sizeof(*dport)) {
5616 msg = "DPORT";
5617 goto bad;
5618 }
5619
5620 if (mhp->ext[SADB_X_EXT_NAT_T_OAI] != NULL) {
5621 IPSECLOG(LOG_DEBUG, "NAT-T OAi present\n");
5622 if (mhp->extlen[SADB_X_EXT_NAT_T_OAI] < sizeof(*iaddr)) {
5623 msg = "OAI";
5624 goto bad;
5625 }
5626 }
5627
5628 if (mhp->ext[SADB_X_EXT_NAT_T_OAR] != NULL) {
5629 IPSECLOG(LOG_DEBUG, "NAT-T OAr present\n");
5630 if (mhp->extlen[SADB_X_EXT_NAT_T_OAR] < sizeof(*raddr)) {
5631 msg = "OAR";
5632 goto bad;
5633 }
5634 }
5635
5636 if (mhp->ext[SADB_X_EXT_NAT_T_FRAG] != NULL) {
5637 if (mhp->extlen[SADB_X_EXT_NAT_T_FRAG] < sizeof(*frag)) {
5638 msg = "FRAG";
5639 goto bad;
5640 }
5641 }
5642
5643 type = mhp->ext[SADB_X_EXT_NAT_T_TYPE];
5644 sport = mhp->ext[SADB_X_EXT_NAT_T_SPORT];
5645 dport = mhp->ext[SADB_X_EXT_NAT_T_DPORT];
5646 iaddr = mhp->ext[SADB_X_EXT_NAT_T_OAI];
5647 raddr = mhp->ext[SADB_X_EXT_NAT_T_OAR];
5648 frag = mhp->ext[SADB_X_EXT_NAT_T_FRAG];
5649
5650 IPSECLOG(LOG_DEBUG, "type %d, sport = %d, dport = %d\n",
5651 type->sadb_x_nat_t_type_type,
5652 ntohs(sport->sadb_x_nat_t_port_port),
5653 ntohs(dport->sadb_x_nat_t_port_port));
5654
5655 sav->natt_type = type->sadb_x_nat_t_type_type;
5656 key_porttosaddr(&sav->sah->saidx.src, sport->sadb_x_nat_t_port_port);
5657 key_porttosaddr(&sav->sah->saidx.dst, dport->sadb_x_nat_t_port_port);
5658 if (frag)
5659 sav->esp_frag = frag->sadb_x_nat_t_frag_fraglen;
5660 else
5661 sav->esp_frag = IP_MAXPACKET;
5662
5663 return 0;
5664 bad:
5665 IPSECLOG(LOG_DEBUG, "invalid message %s\n", msg);
5666 __USE(msg);
5667 return -1;
5668 }
5669
5670 /* Just update the IPSEC_NAT_T ports if present */
5671 static int
key_set_natt_ports(union sockaddr_union * src,union sockaddr_union * dst,const struct sadb_msghdr * mhp)5672 key_set_natt_ports(union sockaddr_union *src, union sockaddr_union *dst,
5673 const struct sadb_msghdr *mhp)
5674 {
5675 if (mhp->ext[SADB_X_EXT_NAT_T_OAI] != NULL)
5676 IPSECLOG(LOG_DEBUG, "NAT-T OAi present\n");
5677 if (mhp->ext[SADB_X_EXT_NAT_T_OAR] != NULL)
5678 IPSECLOG(LOG_DEBUG, "NAT-T OAr present\n");
5679
5680 if ((mhp->ext[SADB_X_EXT_NAT_T_TYPE] != NULL) &&
5681 (mhp->ext[SADB_X_EXT_NAT_T_SPORT] != NULL) &&
5682 (mhp->ext[SADB_X_EXT_NAT_T_DPORT] != NULL)) {
5683 struct sadb_x_nat_t_type *type;
5684 struct sadb_x_nat_t_port *sport;
5685 struct sadb_x_nat_t_port *dport;
5686
5687 if ((mhp->extlen[SADB_X_EXT_NAT_T_TYPE] < sizeof(*type)) ||
5688 (mhp->extlen[SADB_X_EXT_NAT_T_SPORT] < sizeof(*sport)) ||
5689 (mhp->extlen[SADB_X_EXT_NAT_T_DPORT] < sizeof(*dport))) {
5690 IPSECLOG(LOG_DEBUG, "invalid message\n");
5691 return -1;
5692 }
5693
5694 type = mhp->ext[SADB_X_EXT_NAT_T_TYPE];
5695 sport = mhp->ext[SADB_X_EXT_NAT_T_SPORT];
5696 dport = mhp->ext[SADB_X_EXT_NAT_T_DPORT];
5697
5698 key_porttosaddr(src, sport->sadb_x_nat_t_port_port);
5699 key_porttosaddr(dst, dport->sadb_x_nat_t_port_port);
5700
5701 IPSECLOG(LOG_DEBUG, "type %d, sport = %d, dport = %d\n",
5702 type->sadb_x_nat_t_type_type,
5703 ntohs(sport->sadb_x_nat_t_port_port),
5704 ntohs(dport->sadb_x_nat_t_port_port));
5705 }
5706
5707 return 0;
5708 }
5709
5710
5711 /*
5712 * SADB_UPDATE processing
5713 * receive
5714 * <base, SA, (SA2), (lifetime(HSC),) address(SD), (address(P),)
5715 * key(AE), (identity(SD),) (sensitivity)>
5716 * from the ikmpd, and update a secasvar entry whose status is SADB_SASTATE_LARVAL.
5717 * and send
5718 * <base, SA, (SA2), (lifetime(HSC),) address(SD), (address(P),)
5719 * (identity(SD),) (sensitivity)>
5720 * to the ikmpd.
5721 *
5722 * m will always be freed.
5723 */
5724 static int
key_api_update(struct socket * so,struct mbuf * m,const struct sadb_msghdr * mhp)5725 key_api_update(struct socket *so, struct mbuf *m, const struct sadb_msghdr *mhp)
5726 {
5727 struct sadb_sa *sa0;
5728 const struct sockaddr *src, *dst;
5729 struct secasindex saidx;
5730 struct secashead *sah;
5731 struct secasvar *sav, *newsav, *oldsav;
5732 u_int16_t proto;
5733 u_int8_t mode;
5734 u_int16_t reqid;
5735 int error;
5736
5737 /* map satype to proto */
5738 proto = key_satype2proto(mhp->msg->sadb_msg_satype);
5739 if (proto == 0) {
5740 IPSECLOG(LOG_DEBUG, "invalid satype is passed.\n");
5741 return key_senderror(so, m, EINVAL);
5742 }
5743
5744 if (mhp->ext[SADB_EXT_SA] == NULL ||
5745 mhp->ext[SADB_EXT_ADDRESS_SRC] == NULL ||
5746 mhp->ext[SADB_EXT_ADDRESS_DST] == NULL ||
5747 (mhp->msg->sadb_msg_satype == SADB_SATYPE_ESP &&
5748 mhp->ext[SADB_EXT_KEY_ENCRYPT] == NULL) ||
5749 (mhp->msg->sadb_msg_satype == SADB_SATYPE_AH &&
5750 mhp->ext[SADB_EXT_KEY_AUTH] == NULL) ||
5751 (mhp->ext[SADB_EXT_LIFETIME_HARD] != NULL &&
5752 mhp->ext[SADB_EXT_LIFETIME_SOFT] == NULL) ||
5753 (mhp->ext[SADB_EXT_LIFETIME_HARD] == NULL &&
5754 mhp->ext[SADB_EXT_LIFETIME_SOFT] != NULL)) {
5755 IPSECLOG(LOG_DEBUG, "invalid message is passed.\n");
5756 return key_senderror(so, m, EINVAL);
5757 }
5758 if (mhp->extlen[SADB_EXT_SA] < sizeof(struct sadb_sa) ||
5759 mhp->extlen[SADB_EXT_ADDRESS_SRC] < sizeof(struct sadb_address) ||
5760 mhp->extlen[SADB_EXT_ADDRESS_DST] < sizeof(struct sadb_address)) {
5761 IPSECLOG(LOG_DEBUG, "invalid message is passed.\n");
5762 return key_senderror(so, m, EINVAL);
5763 }
5764 if (mhp->ext[SADB_X_EXT_SA2] != NULL) {
5765 const struct sadb_x_sa2 *sa2 = mhp->ext[SADB_X_EXT_SA2];
5766 mode = sa2->sadb_x_sa2_mode;
5767 reqid = sa2->sadb_x_sa2_reqid;
5768 } else {
5769 mode = IPSEC_MODE_ANY;
5770 reqid = 0;
5771 }
5772 /* XXX boundary checking for other extensions */
5773
5774 sa0 = mhp->ext[SADB_EXT_SA];
5775 src = key_msghdr_get_sockaddr(mhp, SADB_EXT_ADDRESS_SRC);
5776 dst = key_msghdr_get_sockaddr(mhp, SADB_EXT_ADDRESS_DST);
5777
5778 error = key_setsecasidx(proto, mode, reqid, src, dst, &saidx);
5779 if (error != 0)
5780 return key_senderror(so, m, EINVAL);
5781
5782 error = key_set_natt_ports(&saidx.src, &saidx.dst, mhp);
5783 if (error != 0)
5784 return key_senderror(so, m, EINVAL);
5785
5786 /* get a SA header */
5787 sah = key_getsah_ref(&saidx, CMP_REQID);
5788 if (sah == NULL) {
5789 IPSECLOG(LOG_DEBUG, "no SA index found.\n");
5790 return key_senderror(so, m, ENOENT);
5791 }
5792
5793 /* set spidx if there */
5794 /* XXX rewrite */
5795 error = key_setident(sah, m, mhp);
5796 if (error)
5797 goto error_sah;
5798
5799 /* find a SA with sequence number. */
5800 #ifdef IPSEC_DOSEQCHECK
5801 if (mhp->msg->sadb_msg_seq != 0) {
5802 sav = key_getsavbyseq(sah, mhp->msg->sadb_msg_seq);
5803 if (sav == NULL) {
5804 IPSECLOG(LOG_DEBUG,
5805 "no larval SA with sequence %u exists.\n",
5806 mhp->msg->sadb_msg_seq);
5807 error = ENOENT;
5808 goto error_sah;
5809 }
5810 }
5811 #else
5812 sav = key_getsavbyspi(sah, sa0->sadb_sa_spi);
5813 if (sav == NULL) {
5814 IPSECLOG(LOG_DEBUG, "no such a SA found (spi:%u)\n",
5815 (u_int32_t)ntohl(sa0->sadb_sa_spi));
5816 error = EINVAL;
5817 goto error_sah;
5818 }
5819 #endif
5820
5821 /* validity check */
5822 if (sav->sah->saidx.proto != proto) {
5823 IPSECLOG(LOG_DEBUG, "protocol mismatched (DB=%u param=%u)\n",
5824 sav->sah->saidx.proto, proto);
5825 error = EINVAL;
5826 goto error;
5827 }
5828 #ifdef IPSEC_DOSEQCHECK
5829 if (sav->spi != sa0->sadb_sa_spi) {
5830 IPSECLOG(LOG_DEBUG, "SPI mismatched (DB:%u param:%u)\n",
5831 (u_int32_t)ntohl(sav->spi),
5832 (u_int32_t)ntohl(sa0->sadb_sa_spi));
5833 error = EINVAL;
5834 goto error;
5835 }
5836 #endif
5837 if (sav->pid != mhp->msg->sadb_msg_pid) {
5838 IPSECLOG(LOG_DEBUG, "pid mismatched (DB:%u param:%u)\n",
5839 sav->pid, mhp->msg->sadb_msg_pid);
5840 error = EINVAL;
5841 goto error;
5842 }
5843
5844 /*
5845 * Allocate a new SA instead of modifying the existing SA directly
5846 * to avoid race conditions.
5847 */
5848 newsav = kmem_zalloc(sizeof(struct secasvar), KM_SLEEP);
5849
5850 /* copy sav values */
5851 newsav->spi = sav->spi;
5852 newsav->seq = sav->seq;
5853 newsav->created = sav->created;
5854 newsav->pid = sav->pid;
5855 newsav->sah = sav->sah;
5856 KEYDEBUG_PRINTF(KEYDEBUG_IPSEC_STAMP,
5857 "DP from %s:%u update SA:%p to SA:%p spi=%#x proto=%d\n",
5858 __func__, __LINE__, sav, newsav,
5859 ntohl(newsav->spi), proto);
5860
5861 error = key_setsaval(newsav, m, mhp);
5862 if (error) {
5863 kmem_free(newsav, sizeof(*newsav));
5864 goto error;
5865 }
5866
5867 error = key_handle_natt_info(newsav, mhp);
5868 if (error != 0) {
5869 key_delsav(newsav);
5870 goto error;
5871 }
5872
5873 error = key_init_xform(newsav);
5874 if (error != 0) {
5875 key_delsav(newsav);
5876 goto error;
5877 }
5878
5879 /* Add to sah#savlist */
5880 key_init_sav(newsav);
5881 newsav->state = SADB_SASTATE_MATURE;
5882 mutex_enter(&key_sad.lock);
5883 SAVLIST_WRITER_INSERT_TAIL(sah, SADB_SASTATE_MATURE, newsav);
5884 SAVLUT_WRITER_INSERT_HEAD(newsav);
5885 mutex_exit(&key_sad.lock);
5886 key_validate_savlist(sah, SADB_SASTATE_MATURE);
5887
5888 /*
5889 * We need to lookup and remove the sav atomically, so get it again
5890 * here by a special API while we have a reference to it.
5891 */
5892 oldsav = key_lookup_and_remove_sav(sah, sa0->sadb_sa_spi, sav);
5893 KASSERT(oldsav == NULL || oldsav == sav);
5894 /* We can release the reference because of oldsav */
5895 KEY_SA_UNREF(&sav);
5896 if (oldsav == NULL) {
5897 /* Someone has already removed the sav. Nothing to do. */
5898 } else {
5899 key_wait_sav(oldsav);
5900 key_destroy_sav(oldsav);
5901 oldsav = NULL;
5902 }
5903 sav = NULL;
5904
5905 key_sah_unref(sah);
5906 sah = NULL;
5907
5908 {
5909 struct mbuf *n;
5910
5911 /* set msg buf from mhp */
5912 n = key_getmsgbuf_x1(m, mhp);
5913 if (n == NULL) {
5914 IPSECLOG(LOG_DEBUG, "No more memory.\n");
5915 return key_senderror(so, m, ENOBUFS);
5916 }
5917
5918 m_freem(m);
5919 return key_sendup_mbuf(so, n, KEY_SENDUP_ALL);
5920 }
5921 error:
5922 KEY_SA_UNREF(&sav);
5923 error_sah:
5924 key_sah_unref(sah);
5925 return key_senderror(so, m, error);
5926 }
5927
5928 /*
5929 * search SAD with sequence for a SA which state is SADB_SASTATE_LARVAL.
5930 * only called by key_api_update().
5931 * OUT:
5932 * NULL : not found
5933 * others : found, pointer to a SA.
5934 */
5935 #ifdef IPSEC_DOSEQCHECK
5936 static struct secasvar *
key_getsavbyseq(struct secashead * sah,u_int32_t seq)5937 key_getsavbyseq(struct secashead *sah, u_int32_t seq)
5938 {
5939 struct secasvar *sav;
5940 u_int state;
5941 int s;
5942
5943 state = SADB_SASTATE_LARVAL;
5944
5945 /* search SAD with sequence number ? */
5946 s = pserialize_read_enter();
5947 SAVLIST_READER_FOREACH(sav, sah, state) {
5948 KEY_CHKSASTATE(state, sav->state);
5949
5950 if (sav->seq == seq) {
5951 SA_ADDREF(sav);
5952 KEYDEBUG_PRINTF(KEYDEBUG_IPSEC_STAMP,
5953 "DP cause refcnt++:%d SA:%p\n",
5954 key_sa_refcnt(sav), sav);
5955 break;
5956 }
5957 }
5958 pserialize_read_exit(s);
5959
5960 return sav;
5961 }
5962 #endif
5963
5964 /*
5965 * SADB_ADD processing
5966 * add an entry to SA database, when received
5967 * <base, SA, (SA2), (lifetime(HSC),) address(SD), (address(P),)
5968 * key(AE), (identity(SD),) (sensitivity)>
5969 * from the ikmpd,
5970 * and send
5971 * <base, SA, (SA2), (lifetime(HSC),) address(SD), (address(P),)
5972 * (identity(SD),) (sensitivity)>
5973 * to the ikmpd.
5974 *
5975 * IGNORE identity and sensitivity messages.
5976 *
5977 * m will always be freed.
5978 */
5979 static int
key_api_add(struct socket * so,struct mbuf * m,const struct sadb_msghdr * mhp)5980 key_api_add(struct socket *so, struct mbuf *m,
5981 const struct sadb_msghdr *mhp)
5982 {
5983 struct sadb_sa *sa0;
5984 const struct sockaddr *src, *dst;
5985 struct secasindex saidx;
5986 struct secashead *sah;
5987 struct secasvar *newsav;
5988 u_int16_t proto;
5989 u_int8_t mode;
5990 u_int16_t reqid;
5991 int error;
5992
5993 /* map satype to proto */
5994 proto = key_satype2proto(mhp->msg->sadb_msg_satype);
5995 if (proto == 0) {
5996 IPSECLOG(LOG_DEBUG, "invalid satype is passed.\n");
5997 return key_senderror(so, m, EINVAL);
5998 }
5999
6000 if (mhp->ext[SADB_EXT_SA] == NULL ||
6001 mhp->ext[SADB_EXT_ADDRESS_SRC] == NULL ||
6002 mhp->ext[SADB_EXT_ADDRESS_DST] == NULL ||
6003 (mhp->msg->sadb_msg_satype == SADB_SATYPE_ESP &&
6004 mhp->ext[SADB_EXT_KEY_ENCRYPT] == NULL) ||
6005 (mhp->msg->sadb_msg_satype == SADB_SATYPE_AH &&
6006 mhp->ext[SADB_EXT_KEY_AUTH] == NULL) ||
6007 (mhp->ext[SADB_EXT_LIFETIME_HARD] != NULL &&
6008 mhp->ext[SADB_EXT_LIFETIME_SOFT] == NULL) ||
6009 (mhp->ext[SADB_EXT_LIFETIME_HARD] == NULL &&
6010 mhp->ext[SADB_EXT_LIFETIME_SOFT] != NULL)) {
6011 IPSECLOG(LOG_DEBUG, "invalid message is passed.\n");
6012 return key_senderror(so, m, EINVAL);
6013 }
6014 if (mhp->extlen[SADB_EXT_SA] < sizeof(struct sadb_sa) ||
6015 mhp->extlen[SADB_EXT_ADDRESS_SRC] < sizeof(struct sadb_address) ||
6016 mhp->extlen[SADB_EXT_ADDRESS_DST] < sizeof(struct sadb_address)) {
6017 /* XXX need more */
6018 IPSECLOG(LOG_DEBUG, "invalid message is passed.\n");
6019 return key_senderror(so, m, EINVAL);
6020 }
6021 if (mhp->ext[SADB_X_EXT_SA2] != NULL) {
6022 const struct sadb_x_sa2 *sa2 = mhp->ext[SADB_X_EXT_SA2];
6023 mode = sa2->sadb_x_sa2_mode;
6024 reqid = sa2->sadb_x_sa2_reqid;
6025 } else {
6026 mode = IPSEC_MODE_ANY;
6027 reqid = 0;
6028 }
6029
6030 sa0 = mhp->ext[SADB_EXT_SA];
6031 src = key_msghdr_get_sockaddr(mhp, SADB_EXT_ADDRESS_SRC);
6032 dst = key_msghdr_get_sockaddr(mhp, SADB_EXT_ADDRESS_DST);
6033
6034 error = key_setsecasidx(proto, mode, reqid, src, dst, &saidx);
6035 if (error != 0)
6036 return key_senderror(so, m, EINVAL);
6037
6038 error = key_set_natt_ports(&saidx.src, &saidx.dst, mhp);
6039 if (error != 0)
6040 return key_senderror(so, m, EINVAL);
6041
6042 /* get a SA header */
6043 sah = key_getsah_ref(&saidx, CMP_REQID);
6044 if (sah == NULL) {
6045 /* create a new SA header */
6046 sah = key_newsah(&saidx);
6047 if (sah == NULL) {
6048 IPSECLOG(LOG_DEBUG, "No more memory.\n");
6049 return key_senderror(so, m, ENOBUFS);
6050 }
6051 }
6052
6053 /* set spidx if there */
6054 /* XXX rewrite */
6055 error = key_setident(sah, m, mhp);
6056 if (error)
6057 goto error;
6058
6059 {
6060 struct secasvar *sav;
6061
6062 /* We can create new SA only if SPI is differenct. */
6063 sav = key_getsavbyspi(sah, sa0->sadb_sa_spi);
6064 if (sav != NULL) {
6065 KEY_SA_UNREF(&sav);
6066 IPSECLOG(LOG_DEBUG, "SA already exists.\n");
6067 error = EEXIST;
6068 goto error;
6069 }
6070 }
6071
6072 /* create new SA entry. */
6073 newsav = KEY_NEWSAV(m, mhp, &error, proto);
6074 if (newsav == NULL)
6075 goto error;
6076 newsav->sah = sah;
6077
6078 error = key_handle_natt_info(newsav, mhp);
6079 if (error != 0) {
6080 key_delsav(newsav);
6081 error = EINVAL;
6082 goto error;
6083 }
6084
6085 error = key_init_xform(newsav);
6086 if (error != 0) {
6087 key_delsav(newsav);
6088 goto error;
6089 }
6090
6091 /* Add to sah#savlist */
6092 key_init_sav(newsav);
6093 newsav->state = SADB_SASTATE_MATURE;
6094 mutex_enter(&key_sad.lock);
6095 SAVLIST_WRITER_INSERT_TAIL(sah, SADB_SASTATE_MATURE, newsav);
6096 SAVLUT_WRITER_INSERT_HEAD(newsav);
6097 mutex_exit(&key_sad.lock);
6098 key_validate_savlist(sah, SADB_SASTATE_MATURE);
6099
6100 key_sah_unref(sah);
6101 sah = NULL;
6102
6103 /*
6104 * don't call key_freesav() here, as we would like to keep the SA
6105 * in the database on success.
6106 */
6107
6108 {
6109 struct mbuf *n;
6110
6111 /* set msg buf from mhp */
6112 n = key_getmsgbuf_x1(m, mhp);
6113 if (n == NULL) {
6114 IPSECLOG(LOG_DEBUG, "No more memory.\n");
6115 return key_senderror(so, m, ENOBUFS);
6116 }
6117
6118 m_freem(m);
6119 return key_sendup_mbuf(so, n, KEY_SENDUP_ALL);
6120 }
6121 error:
6122 key_sah_unref(sah);
6123 return key_senderror(so, m, error);
6124 }
6125
6126 /* m is retained */
6127 static int
key_setident(struct secashead * sah,struct mbuf * m,const struct sadb_msghdr * mhp)6128 key_setident(struct secashead *sah, struct mbuf *m,
6129 const struct sadb_msghdr *mhp)
6130 {
6131 const struct sadb_ident *idsrc, *iddst;
6132 int idsrclen, iddstlen;
6133
6134 KASSERT(!cpu_softintr_p());
6135 KASSERT(sah != NULL);
6136 KASSERT(m != NULL);
6137 KASSERT(mhp != NULL);
6138 KASSERT(mhp->msg != NULL);
6139
6140 /*
6141 * Can be called with an existing sah from key_api_update().
6142 */
6143 if (sah->idents != NULL) {
6144 kmem_free(sah->idents, sah->idents_len);
6145 sah->idents = NULL;
6146 sah->idents_len = 0;
6147 }
6148 if (sah->identd != NULL) {
6149 kmem_free(sah->identd, sah->identd_len);
6150 sah->identd = NULL;
6151 sah->identd_len = 0;
6152 }
6153
6154 /* don't make buffer if not there */
6155 if (mhp->ext[SADB_EXT_IDENTITY_SRC] == NULL &&
6156 mhp->ext[SADB_EXT_IDENTITY_DST] == NULL) {
6157 sah->idents = NULL;
6158 sah->identd = NULL;
6159 return 0;
6160 }
6161
6162 if (mhp->ext[SADB_EXT_IDENTITY_SRC] == NULL ||
6163 mhp->ext[SADB_EXT_IDENTITY_DST] == NULL) {
6164 IPSECLOG(LOG_DEBUG, "invalid identity.\n");
6165 return EINVAL;
6166 }
6167
6168 idsrc = mhp->ext[SADB_EXT_IDENTITY_SRC];
6169 iddst = mhp->ext[SADB_EXT_IDENTITY_DST];
6170 idsrclen = mhp->extlen[SADB_EXT_IDENTITY_SRC];
6171 iddstlen = mhp->extlen[SADB_EXT_IDENTITY_DST];
6172
6173 /* validity check */
6174 if (idsrc->sadb_ident_type != iddst->sadb_ident_type) {
6175 IPSECLOG(LOG_DEBUG, "ident type mismatched src %u, dst %u.\n",
6176 idsrc->sadb_ident_type, iddst->sadb_ident_type);
6177 /*
6178 * Some VPN appliances(e.g. NetScreen) can send different
6179 * identifier types on IDii and IDir, so be able to allow
6180 * such message.
6181 */
6182 if (!ipsec_allow_different_idtype) {
6183 return EINVAL;
6184 }
6185 }
6186
6187 switch (idsrc->sadb_ident_type) {
6188 case SADB_IDENTTYPE_PREFIX:
6189 case SADB_IDENTTYPE_FQDN:
6190 case SADB_IDENTTYPE_USERFQDN:
6191 default:
6192 /* XXX do nothing */
6193 sah->idents = NULL;
6194 sah->identd = NULL;
6195 return 0;
6196 }
6197
6198 /* make structure */
6199 sah->idents = kmem_alloc(idsrclen, KM_SLEEP);
6200 sah->idents_len = idsrclen;
6201 sah->identd = kmem_alloc(iddstlen, KM_SLEEP);
6202 sah->identd_len = iddstlen;
6203 memcpy(sah->idents, idsrc, idsrclen);
6204 memcpy(sah->identd, iddst, iddstlen);
6205
6206 return 0;
6207 }
6208
6209 /*
6210 * m will not be freed on return. It never return NULL.
6211 * it is caller's responsibility to free the result.
6212 */
6213 static struct mbuf *
key_getmsgbuf_x1(struct mbuf * m,const struct sadb_msghdr * mhp)6214 key_getmsgbuf_x1(struct mbuf *m, const struct sadb_msghdr *mhp)
6215 {
6216 struct mbuf *n;
6217
6218 KASSERT(m != NULL);
6219 KASSERT(mhp != NULL);
6220 KASSERT(mhp->msg != NULL);
6221
6222 /* create new sadb_msg to reply. */
6223 n = key_gather_mbuf(m, mhp, 1, 15, SADB_EXT_RESERVED,
6224 SADB_EXT_SA, SADB_X_EXT_SA2,
6225 SADB_EXT_ADDRESS_SRC, SADB_EXT_ADDRESS_DST,
6226 SADB_EXT_LIFETIME_HARD, SADB_EXT_LIFETIME_SOFT,
6227 SADB_EXT_IDENTITY_SRC, SADB_EXT_IDENTITY_DST,
6228 SADB_X_EXT_NAT_T_TYPE, SADB_X_EXT_NAT_T_SPORT,
6229 SADB_X_EXT_NAT_T_DPORT, SADB_X_EXT_NAT_T_OAI,
6230 SADB_X_EXT_NAT_T_OAR, SADB_X_EXT_NAT_T_FRAG);
6231
6232 KASSERT(n->m_len >= sizeof(struct sadb_msg));
6233
6234 mtod(n, struct sadb_msg *)->sadb_msg_errno = 0;
6235 mtod(n, struct sadb_msg *)->sadb_msg_len =
6236 PFKEY_UNIT64(n->m_pkthdr.len);
6237
6238 return n;
6239 }
6240
6241 static int key_delete_all (struct socket *, struct mbuf *,
6242 const struct sadb_msghdr *, u_int16_t);
6243
6244 /*
6245 * SADB_DELETE processing
6246 * receive
6247 * <base, SA(*), address(SD)>
6248 * from the ikmpd, and set SADB_SASTATE_DEAD,
6249 * and send,
6250 * <base, SA(*), address(SD)>
6251 * to the ikmpd.
6252 *
6253 * m will always be freed.
6254 */
6255 static int
key_api_delete(struct socket * so,struct mbuf * m,const struct sadb_msghdr * mhp)6256 key_api_delete(struct socket *so, struct mbuf *m,
6257 const struct sadb_msghdr *mhp)
6258 {
6259 struct sadb_sa *sa0;
6260 const struct sockaddr *src, *dst;
6261 struct secasindex saidx;
6262 struct secashead *sah;
6263 struct secasvar *sav = NULL;
6264 u_int16_t proto;
6265 int error;
6266
6267 /* map satype to proto */
6268 proto = key_satype2proto(mhp->msg->sadb_msg_satype);
6269 if (proto == 0) {
6270 IPSECLOG(LOG_DEBUG, "invalid satype is passed.\n");
6271 return key_senderror(so, m, EINVAL);
6272 }
6273
6274 if (mhp->ext[SADB_EXT_ADDRESS_SRC] == NULL ||
6275 mhp->ext[SADB_EXT_ADDRESS_DST] == NULL) {
6276 IPSECLOG(LOG_DEBUG, "invalid message is passed.\n");
6277 return key_senderror(so, m, EINVAL);
6278 }
6279
6280 if (mhp->extlen[SADB_EXT_ADDRESS_SRC] < sizeof(struct sadb_address) ||
6281 mhp->extlen[SADB_EXT_ADDRESS_DST] < sizeof(struct sadb_address)) {
6282 IPSECLOG(LOG_DEBUG, "invalid message is passed.\n");
6283 return key_senderror(so, m, EINVAL);
6284 }
6285
6286 if (mhp->ext[SADB_EXT_SA] == NULL) {
6287 /*
6288 * Caller wants us to delete all non-LARVAL SAs
6289 * that match the src/dst. This is used during
6290 * IKE INITIAL-CONTACT.
6291 */
6292 IPSECLOG(LOG_DEBUG, "doing delete all.\n");
6293 return key_delete_all(so, m, mhp, proto);
6294 } else if (mhp->extlen[SADB_EXT_SA] < sizeof(struct sadb_sa)) {
6295 IPSECLOG(LOG_DEBUG, "invalid message is passed.\n");
6296 return key_senderror(so, m, EINVAL);
6297 }
6298
6299 sa0 = mhp->ext[SADB_EXT_SA];
6300 src = key_msghdr_get_sockaddr(mhp, SADB_EXT_ADDRESS_SRC);
6301 dst = key_msghdr_get_sockaddr(mhp, SADB_EXT_ADDRESS_DST);
6302
6303 error = key_setsecasidx(proto, IPSEC_MODE_ANY, 0, src, dst, &saidx);
6304 if (error != 0)
6305 return key_senderror(so, m, EINVAL);
6306
6307 error = key_set_natt_ports(&saidx.src, &saidx.dst, mhp);
6308 if (error != 0)
6309 return key_senderror(so, m, EINVAL);
6310
6311 /* get a SA header */
6312 sah = key_getsah_ref(&saidx, CMP_HEAD);
6313 if (sah != NULL) {
6314 /* get a SA with SPI. */
6315 sav = key_lookup_and_remove_sav(sah, sa0->sadb_sa_spi, NULL);
6316 key_sah_unref(sah);
6317 }
6318
6319 if (sav == NULL) {
6320 IPSECLOG(LOG_DEBUG, "no SA found.\n");
6321 return key_senderror(so, m, ENOENT);
6322 }
6323
6324 key_wait_sav(sav);
6325 key_destroy_sav(sav);
6326 sav = NULL;
6327
6328 {
6329 struct mbuf *n;
6330
6331 /* create new sadb_msg to reply. */
6332 n = key_gather_mbuf(m, mhp, 1, 4, SADB_EXT_RESERVED,
6333 SADB_EXT_SA, SADB_EXT_ADDRESS_SRC, SADB_EXT_ADDRESS_DST);
6334
6335 key_fill_replymsg(n, 0);
6336 m_freem(m);
6337 return key_sendup_mbuf(so, n, KEY_SENDUP_ALL);
6338 }
6339 }
6340
6341 /*
6342 * delete all SAs for src/dst. Called from key_api_delete().
6343 */
6344 static int
key_delete_all(struct socket * so,struct mbuf * m,const struct sadb_msghdr * mhp,u_int16_t proto)6345 key_delete_all(struct socket *so, struct mbuf *m,
6346 const struct sadb_msghdr *mhp, u_int16_t proto)
6347 {
6348 const struct sockaddr *src, *dst;
6349 struct secasindex saidx;
6350 struct secashead *sah;
6351 struct secasvar *sav;
6352 u_int state;
6353 int error;
6354
6355 src = key_msghdr_get_sockaddr(mhp, SADB_EXT_ADDRESS_SRC);
6356 dst = key_msghdr_get_sockaddr(mhp, SADB_EXT_ADDRESS_DST);
6357
6358 error = key_setsecasidx(proto, IPSEC_MODE_ANY, 0, src, dst, &saidx);
6359 if (error != 0)
6360 return key_senderror(so, m, EINVAL);
6361
6362 error = key_set_natt_ports(&saidx.src, &saidx.dst, mhp);
6363 if (error != 0)
6364 return key_senderror(so, m, EINVAL);
6365
6366 sah = key_getsah_ref(&saidx, CMP_HEAD);
6367 if (sah != NULL) {
6368 /* Delete all non-LARVAL SAs. */
6369 SASTATE_ALIVE_FOREACH(state) {
6370 if (state == SADB_SASTATE_LARVAL)
6371 continue;
6372 restart:
6373 mutex_enter(&key_sad.lock);
6374 SAVLIST_WRITER_FOREACH(sav, sah, state) {
6375 sav->state = SADB_SASTATE_DEAD;
6376 key_unlink_sav(sav);
6377 mutex_exit(&key_sad.lock);
6378 key_destroy_sav(sav);
6379 goto restart;
6380 }
6381 mutex_exit(&key_sad.lock);
6382 }
6383 key_sah_unref(sah);
6384 }
6385 {
6386 struct mbuf *n;
6387
6388 /* create new sadb_msg to reply. */
6389 n = key_gather_mbuf(m, mhp, 1, 3, SADB_EXT_RESERVED,
6390 SADB_EXT_ADDRESS_SRC, SADB_EXT_ADDRESS_DST);
6391
6392 key_fill_replymsg(n, 0);
6393 m_freem(m);
6394 return key_sendup_mbuf(so, n, KEY_SENDUP_ALL);
6395 }
6396 }
6397
6398 /*
6399 * SADB_GET processing
6400 * receive
6401 * <base, SA(*), address(SD)>
6402 * from the ikmpd, and get a SP and a SA to respond,
6403 * and send,
6404 * <base, SA, (lifetime(HSC),) address(SD), (address(P),) key(AE),
6405 * (identity(SD),) (sensitivity)>
6406 * to the ikmpd.
6407 *
6408 * m will always be freed.
6409 */
6410 static int
key_api_get(struct socket * so,struct mbuf * m,const struct sadb_msghdr * mhp)6411 key_api_get(struct socket *so, struct mbuf *m,
6412 const struct sadb_msghdr *mhp)
6413 {
6414 struct sadb_sa *sa0;
6415 const struct sockaddr *src, *dst;
6416 struct secasindex saidx;
6417 struct secasvar *sav = NULL;
6418 u_int16_t proto;
6419 int error;
6420
6421 /* map satype to proto */
6422 if ((proto = key_satype2proto(mhp->msg->sadb_msg_satype)) == 0) {
6423 IPSECLOG(LOG_DEBUG, "invalid satype is passed.\n");
6424 return key_senderror(so, m, EINVAL);
6425 }
6426
6427 if (mhp->ext[SADB_EXT_SA] == NULL ||
6428 mhp->ext[SADB_EXT_ADDRESS_SRC] == NULL ||
6429 mhp->ext[SADB_EXT_ADDRESS_DST] == NULL) {
6430 IPSECLOG(LOG_DEBUG, "invalid message is passed.\n");
6431 return key_senderror(so, m, EINVAL);
6432 }
6433 if (mhp->extlen[SADB_EXT_SA] < sizeof(struct sadb_sa) ||
6434 mhp->extlen[SADB_EXT_ADDRESS_SRC] < sizeof(struct sadb_address) ||
6435 mhp->extlen[SADB_EXT_ADDRESS_DST] < sizeof(struct sadb_address)) {
6436 IPSECLOG(LOG_DEBUG, "invalid message is passed.\n");
6437 return key_senderror(so, m, EINVAL);
6438 }
6439
6440 sa0 = mhp->ext[SADB_EXT_SA];
6441 src = key_msghdr_get_sockaddr(mhp, SADB_EXT_ADDRESS_SRC);
6442 dst = key_msghdr_get_sockaddr(mhp, SADB_EXT_ADDRESS_DST);
6443
6444 error = key_setsecasidx(proto, IPSEC_MODE_ANY, 0, src, dst, &saidx);
6445 if (error != 0)
6446 return key_senderror(so, m, EINVAL);
6447
6448 error = key_set_natt_ports(&saidx.src, &saidx.dst, mhp);
6449 if (error != 0)
6450 return key_senderror(so, m, EINVAL);
6451
6452 /* get a SA header */
6453 {
6454 struct secashead *sah;
6455 int s = pserialize_read_enter();
6456
6457 sah = key_getsah(&saidx, CMP_HEAD);
6458 if (sah != NULL) {
6459 /* get a SA with SPI. */
6460 sav = key_getsavbyspi(sah, sa0->sadb_sa_spi);
6461 }
6462 pserialize_read_exit(s);
6463 }
6464 if (sav == NULL) {
6465 IPSECLOG(LOG_DEBUG, "no SA found.\n");
6466 return key_senderror(so, m, ENOENT);
6467 }
6468
6469 {
6470 struct mbuf *n;
6471 u_int8_t satype;
6472
6473 /* map proto to satype */
6474 satype = key_proto2satype(sav->sah->saidx.proto);
6475 if (satype == 0) {
6476 KEY_SA_UNREF(&sav);
6477 IPSECLOG(LOG_DEBUG, "there was invalid proto in SAD.\n");
6478 return key_senderror(so, m, EINVAL);
6479 }
6480
6481 /* create new sadb_msg to reply. */
6482 n = key_setdumpsa(sav, SADB_GET, satype, mhp->msg->sadb_msg_seq,
6483 mhp->msg->sadb_msg_pid);
6484 KEY_SA_UNREF(&sav);
6485 m_freem(m);
6486 return key_sendup_mbuf(so, n, KEY_SENDUP_ONE);
6487 }
6488 }
6489
6490 /* XXX make it sysctl-configurable? */
6491 static void
key_getcomb_setlifetime(struct sadb_comb * comb)6492 key_getcomb_setlifetime(struct sadb_comb *comb)
6493 {
6494
6495 comb->sadb_comb_soft_allocations = 1;
6496 comb->sadb_comb_hard_allocations = 1;
6497 comb->sadb_comb_soft_bytes = 0;
6498 comb->sadb_comb_hard_bytes = 0;
6499 comb->sadb_comb_hard_addtime = 86400; /* 1 day */
6500 comb->sadb_comb_soft_addtime = comb->sadb_comb_hard_addtime * 80 / 100;
6501 comb->sadb_comb_hard_usetime = 28800; /* 8 hours */
6502 comb->sadb_comb_soft_usetime = comb->sadb_comb_hard_usetime * 80 / 100;
6503 }
6504
6505 /*
6506 * XXX reorder combinations by preference
6507 * XXX no idea if the user wants ESP authentication or not
6508 */
6509 static struct mbuf *
key_getcomb_esp(int mflag)6510 key_getcomb_esp(int mflag)
6511 {
6512 struct sadb_comb *comb;
6513 const struct enc_xform *algo;
6514 struct mbuf *result = NULL, *m, *n;
6515 int encmin;
6516 int i, off, o;
6517 int totlen;
6518 const int l = PFKEY_ALIGN8(sizeof(struct sadb_comb));
6519
6520 m = NULL;
6521 for (i = 1; i <= SADB_EALG_MAX; i++) {
6522 algo = esp_algorithm_lookup(i);
6523 if (algo == NULL)
6524 continue;
6525
6526 /* discard algorithms with key size smaller than system min */
6527 if (_BITS(algo->maxkey) < ipsec_esp_keymin)
6528 continue;
6529 if (_BITS(algo->minkey) < ipsec_esp_keymin)
6530 encmin = ipsec_esp_keymin;
6531 else
6532 encmin = _BITS(algo->minkey);
6533
6534 if (ipsec_esp_auth)
6535 m = key_getcomb_ah(mflag);
6536 else {
6537 KASSERTMSG(l <= MLEN,
6538 "l=%u > MLEN=%lu", l, (u_long) MLEN);
6539 MGET(m, mflag, MT_DATA);
6540 if (m) {
6541 m_align(m, l);
6542 m->m_len = l;
6543 m->m_next = NULL;
6544 memset(mtod(m, void *), 0, m->m_len);
6545 }
6546 }
6547 if (!m)
6548 goto fail;
6549
6550 totlen = 0;
6551 for (n = m; n; n = n->m_next)
6552 totlen += n->m_len;
6553 KASSERTMSG((totlen % l) == 0, "totlen=%u, l=%u", totlen, l);
6554
6555 for (off = 0; off < totlen; off += l) {
6556 n = m_pulldown(m, off, l, &o);
6557 if (!n) {
6558 /* m is already freed */
6559 goto fail;
6560 }
6561 comb = (struct sadb_comb *)(mtod(n, char *) + o);
6562 memset(comb, 0, sizeof(*comb));
6563 key_getcomb_setlifetime(comb);
6564 comb->sadb_comb_encrypt = i;
6565 comb->sadb_comb_encrypt_minbits = encmin;
6566 comb->sadb_comb_encrypt_maxbits = _BITS(algo->maxkey);
6567 }
6568
6569 if (!result)
6570 result = m;
6571 else
6572 m_cat(result, m);
6573 }
6574
6575 return result;
6576
6577 fail:
6578 m_freem(result);
6579 return NULL;
6580 }
6581
6582 static void
key_getsizes_ah(const struct auth_hash * ah,int alg,u_int16_t * ksmin,u_int16_t * ksmax)6583 key_getsizes_ah(const struct auth_hash *ah, int alg,
6584 u_int16_t* ksmin, u_int16_t* ksmax)
6585 {
6586 *ksmin = *ksmax = ah->keysize;
6587 if (ah->keysize == 0) {
6588 /*
6589 * Transform takes arbitrary key size but algorithm
6590 * key size is restricted. Enforce this here.
6591 */
6592 switch (alg) {
6593 case SADB_X_AALG_MD5: *ksmin = *ksmax = 16; break;
6594 case SADB_X_AALG_SHA: *ksmin = *ksmax = 20; break;
6595 case SADB_X_AALG_NULL: *ksmin = 0; *ksmax = 256; break;
6596 default:
6597 IPSECLOG(LOG_DEBUG, "unknown AH algorithm %u\n", alg);
6598 break;
6599 }
6600 }
6601 }
6602
6603 /*
6604 * XXX reorder combinations by preference
6605 */
6606 static struct mbuf *
key_getcomb_ah(int mflag)6607 key_getcomb_ah(int mflag)
6608 {
6609 struct sadb_comb *comb;
6610 const struct auth_hash *algo;
6611 struct mbuf *m;
6612 u_int16_t minkeysize, maxkeysize;
6613 int i;
6614 const int l = PFKEY_ALIGN8(sizeof(struct sadb_comb));
6615
6616 m = NULL;
6617 for (i = 1; i <= SADB_AALG_MAX; i++) {
6618 #if 1
6619 /* we prefer HMAC algorithms, not old algorithms */
6620 if (i != SADB_AALG_SHA1HMAC &&
6621 i != SADB_AALG_MD5HMAC &&
6622 i != SADB_X_AALG_SHA2_256 &&
6623 i != SADB_X_AALG_SHA2_384 &&
6624 i != SADB_X_AALG_SHA2_512)
6625 continue;
6626 #endif
6627 algo = ah_algorithm_lookup(i);
6628 if (!algo)
6629 continue;
6630 key_getsizes_ah(algo, i, &minkeysize, &maxkeysize);
6631 /* discard algorithms with key size smaller than system min */
6632 if (_BITS(minkeysize) < ipsec_ah_keymin)
6633 continue;
6634
6635 if (!m) {
6636 KASSERTMSG(l <= MLEN,
6637 "l=%u > MLEN=%lu", l, (u_long) MLEN);
6638 MGET(m, mflag, MT_DATA);
6639 if (m) {
6640 m_align(m, l);
6641 m->m_len = l;
6642 m->m_next = NULL;
6643 }
6644 } else
6645 M_PREPEND(m, l, mflag);
6646 if (!m)
6647 return NULL;
6648
6649 if (m->m_len < sizeof(struct sadb_comb)) {
6650 m = m_pullup(m, sizeof(struct sadb_comb));
6651 if (m == NULL)
6652 return NULL;
6653 }
6654
6655 comb = mtod(m, struct sadb_comb *);
6656 memset(comb, 0, sizeof(*comb));
6657 key_getcomb_setlifetime(comb);
6658 comb->sadb_comb_auth = i;
6659 comb->sadb_comb_auth_minbits = _BITS(minkeysize);
6660 comb->sadb_comb_auth_maxbits = _BITS(maxkeysize);
6661 }
6662
6663 return m;
6664 }
6665
6666 /*
6667 * not really an official behavior. discussed in pf_key@inner.net in Sep2000.
6668 * XXX reorder combinations by preference
6669 */
6670 static struct mbuf *
key_getcomb_ipcomp(int mflag)6671 key_getcomb_ipcomp(int mflag)
6672 {
6673 struct sadb_comb *comb;
6674 const struct comp_algo *algo;
6675 struct mbuf *m;
6676 int i;
6677 const int l = PFKEY_ALIGN8(sizeof(struct sadb_comb));
6678
6679 m = NULL;
6680 for (i = 1; i <= SADB_X_CALG_MAX; i++) {
6681 algo = ipcomp_algorithm_lookup(i);
6682 if (!algo)
6683 continue;
6684
6685 if (!m) {
6686 KASSERTMSG(l <= MLEN,
6687 "l=%u > MLEN=%lu", l, (u_long) MLEN);
6688 MGET(m, mflag, MT_DATA);
6689 if (m) {
6690 m_align(m, l);
6691 m->m_len = l;
6692 m->m_next = NULL;
6693 }
6694 } else
6695 M_PREPEND(m, l, mflag);
6696 if (!m)
6697 return NULL;
6698
6699 if (m->m_len < sizeof(struct sadb_comb)) {
6700 m = m_pullup(m, sizeof(struct sadb_comb));
6701 if (m == NULL)
6702 return NULL;
6703 }
6704
6705 comb = mtod(m, struct sadb_comb *);
6706 memset(comb, 0, sizeof(*comb));
6707 key_getcomb_setlifetime(comb);
6708 comb->sadb_comb_encrypt = i;
6709 /* what should we set into sadb_comb_*_{min,max}bits? */
6710 }
6711
6712 return m;
6713 }
6714
6715 /*
6716 * XXX no way to pass mode (transport/tunnel) to userland
6717 * XXX replay checking?
6718 * XXX sysctl interface to ipsec_{ah,esp}_keymin
6719 */
6720 static struct mbuf *
key_getprop(const struct secasindex * saidx,int mflag)6721 key_getprop(const struct secasindex *saidx, int mflag)
6722 {
6723 struct sadb_prop *prop;
6724 struct mbuf *m, *n;
6725 const int l = PFKEY_ALIGN8(sizeof(struct sadb_prop));
6726 int totlen;
6727
6728 switch (saidx->proto) {
6729 case IPPROTO_ESP:
6730 m = key_getcomb_esp(mflag);
6731 break;
6732 case IPPROTO_AH:
6733 m = key_getcomb_ah(mflag);
6734 break;
6735 case IPPROTO_IPCOMP:
6736 m = key_getcomb_ipcomp(mflag);
6737 break;
6738 default:
6739 return NULL;
6740 }
6741
6742 if (!m)
6743 return NULL;
6744 M_PREPEND(m, l, mflag);
6745 if (!m)
6746 return NULL;
6747
6748 totlen = 0;
6749 for (n = m; n; n = n->m_next)
6750 totlen += n->m_len;
6751
6752 prop = mtod(m, struct sadb_prop *);
6753 memset(prop, 0, sizeof(*prop));
6754 prop->sadb_prop_len = PFKEY_UNIT64(totlen);
6755 prop->sadb_prop_exttype = SADB_EXT_PROPOSAL;
6756 prop->sadb_prop_replay = 32; /* XXX */
6757
6758 return m;
6759 }
6760
6761 /*
6762 * SADB_ACQUIRE processing called by key_checkrequest() and key_api_acquire().
6763 * send
6764 * <base, SA, address(SD), (address(P)), x_policy,
6765 * (identity(SD),) (sensitivity,) proposal>
6766 * to KMD, and expect to receive
6767 * <base> with SADB_ACQUIRE if error occurred,
6768 * or
6769 * <base, src address, dst address, (SPI range)> with SADB_GETSPI
6770 * from KMD by PF_KEY.
6771 *
6772 * XXX x_policy is outside of RFC2367 (KAME extension).
6773 * XXX sensitivity is not supported.
6774 * XXX for ipcomp, RFC2367 does not define how to fill in proposal.
6775 * see comment for key_getcomb_ipcomp().
6776 *
6777 * OUT:
6778 * 0 : succeed
6779 * others: error number
6780 */
6781 static int
key_acquire(const struct secasindex * saidx,const struct secpolicy * sp,int mflag)6782 key_acquire(const struct secasindex *saidx, const struct secpolicy *sp, int mflag)
6783 {
6784 struct mbuf *result = NULL, *m;
6785 #ifndef IPSEC_NONBLOCK_ACQUIRE
6786 struct secacq *newacq;
6787 #endif
6788 u_int8_t satype;
6789 int error = -1;
6790 u_int32_t seq;
6791
6792 /* sanity check */
6793 KASSERT(saidx != NULL);
6794 satype = key_proto2satype(saidx->proto);
6795 KASSERTMSG(satype != 0, "null satype, protocol %u", saidx->proto);
6796
6797 #ifndef IPSEC_NONBLOCK_ACQUIRE
6798 /*
6799 * We never do anything about acquiring SA. There is another
6800 * solution that kernel blocks to send SADB_ACQUIRE message until
6801 * getting something message from IKEd. In later case, to be
6802 * managed with ACQUIRING list.
6803 */
6804 /* Get an entry to check whether sending message or not. */
6805 mutex_enter(&key_misc.lock);
6806 newacq = key_getacq(saidx);
6807 if (newacq != NULL) {
6808 if (key_blockacq_count < newacq->count) {
6809 /* reset counter and do send message. */
6810 newacq->count = 0;
6811 } else {
6812 /* increment counter and do nothing. */
6813 newacq->count++;
6814 mutex_exit(&key_misc.lock);
6815 return 0;
6816 }
6817 } else {
6818 /* make new entry for blocking to send SADB_ACQUIRE. */
6819 newacq = key_newacq(saidx);
6820 if (newacq == NULL) {
6821 mutex_exit(&key_misc.lock);
6822 return ENOBUFS;
6823 }
6824
6825 /* add to key_misc.acqlist */
6826 LIST_INSERT_HEAD(&key_misc.acqlist, newacq, chain);
6827 }
6828
6829 seq = newacq->seq;
6830 mutex_exit(&key_misc.lock);
6831 #else
6832 seq = (acq_seq = (acq_seq == ~0 ? 1 : ++acq_seq));
6833 #endif
6834 m = key_setsadbmsg(SADB_ACQUIRE, 0, satype, seq, 0, 0, mflag);
6835 if (!m) {
6836 error = ENOBUFS;
6837 goto fail;
6838 }
6839 result = m;
6840
6841 /* set sadb_address for saidx's. */
6842 m = key_setsadbaddr(SADB_EXT_ADDRESS_SRC, &saidx->src.sa, FULLMASK,
6843 IPSEC_ULPROTO_ANY, mflag);
6844 if (!m) {
6845 error = ENOBUFS;
6846 goto fail;
6847 }
6848 m_cat(result, m);
6849
6850 m = key_setsadbaddr(SADB_EXT_ADDRESS_DST, &saidx->dst.sa, FULLMASK,
6851 IPSEC_ULPROTO_ANY, mflag);
6852 if (!m) {
6853 error = ENOBUFS;
6854 goto fail;
6855 }
6856 m_cat(result, m);
6857
6858 /* XXX proxy address (optional) */
6859
6860 /* set sadb_x_policy */
6861 if (sp) {
6862 m = key_setsadbxpolicy(sp->policy, sp->spidx.dir, sp->id,
6863 mflag);
6864 if (!m) {
6865 error = ENOBUFS;
6866 goto fail;
6867 }
6868 m_cat(result, m);
6869 }
6870
6871 /* XXX identity (optional) */
6872 #if 0
6873 if (idexttype && fqdn) {
6874 /* create identity extension (FQDN) */
6875 struct sadb_ident *id;
6876 int fqdnlen;
6877
6878 fqdnlen = strlen(fqdn) + 1; /* +1 for terminating-NUL */
6879 id = (struct sadb_ident *)p;
6880 memset(id, 0, sizeof(*id) + PFKEY_ALIGN8(fqdnlen));
6881 id->sadb_ident_len = PFKEY_UNIT64(sizeof(*id) + PFKEY_ALIGN8(fqdnlen));
6882 id->sadb_ident_exttype = idexttype;
6883 id->sadb_ident_type = SADB_IDENTTYPE_FQDN;
6884 memcpy(id + 1, fqdn, fqdnlen);
6885 p += sizeof(struct sadb_ident) + PFKEY_ALIGN8(fqdnlen);
6886 }
6887
6888 if (idexttype) {
6889 /* create identity extension (USERFQDN) */
6890 struct sadb_ident *id;
6891 int userfqdnlen;
6892
6893 if (userfqdn) {
6894 /* +1 for terminating-NUL */
6895 userfqdnlen = strlen(userfqdn) + 1;
6896 } else
6897 userfqdnlen = 0;
6898 id = (struct sadb_ident *)p;
6899 memset(id, 0, sizeof(*id) + PFKEY_ALIGN8(userfqdnlen));
6900 id->sadb_ident_len = PFKEY_UNIT64(sizeof(*id) + PFKEY_ALIGN8(userfqdnlen));
6901 id->sadb_ident_exttype = idexttype;
6902 id->sadb_ident_type = SADB_IDENTTYPE_USERFQDN;
6903 /* XXX is it correct? */
6904 if (curlwp)
6905 id->sadb_ident_id = kauth_cred_getuid(curlwp->l_cred);
6906 if (userfqdn && userfqdnlen)
6907 memcpy(id + 1, userfqdn, userfqdnlen);
6908 p += sizeof(struct sadb_ident) + PFKEY_ALIGN8(userfqdnlen);
6909 }
6910 #endif
6911
6912 /* XXX sensitivity (optional) */
6913
6914 /* create proposal/combination extension */
6915 m = key_getprop(saidx, mflag);
6916 #if 0
6917 /*
6918 * spec conformant: always attach proposal/combination extension,
6919 * the problem is that we have no way to attach it for ipcomp,
6920 * due to the way sadb_comb is declared in RFC2367.
6921 */
6922 if (!m) {
6923 error = ENOBUFS;
6924 goto fail;
6925 }
6926 m_cat(result, m);
6927 #else
6928 /*
6929 * outside of spec; make proposal/combination extension optional.
6930 */
6931 if (m)
6932 m_cat(result, m);
6933 #endif
6934
6935 KASSERT(result->m_flags & M_PKTHDR);
6936 KASSERT(result->m_len >= sizeof(struct sadb_msg));
6937
6938 result->m_pkthdr.len = 0;
6939 for (m = result; m; m = m->m_next)
6940 result->m_pkthdr.len += m->m_len;
6941
6942 mtod(result, struct sadb_msg *)->sadb_msg_len =
6943 PFKEY_UNIT64(result->m_pkthdr.len);
6944
6945 /*
6946 * Called from key_api_acquire that must come from userland, so
6947 * we can call key_sendup_mbuf immediately.
6948 */
6949 if (mflag == M_WAITOK)
6950 return key_sendup_mbuf(NULL, result, KEY_SENDUP_REGISTERED);
6951 /*
6952 * XXX we cannot call key_sendup_mbuf directly here because
6953 * it can cause a deadlock:
6954 * - We have a reference to an SP (and an SA) here
6955 * - key_sendup_mbuf will try to take key_so_mtx
6956 * - Some other thread may try to localcount_drain to the SP with
6957 * holding key_so_mtx in say key_api_spdflush
6958 * - In this case localcount_drain never return because key_sendup_mbuf
6959 * that has stuck on key_so_mtx never release a reference to the SP
6960 *
6961 * So defer key_sendup_mbuf to the timer.
6962 */
6963 return key_acquire_sendup_mbuf_later(result);
6964
6965 fail:
6966 m_freem(result);
6967 return error;
6968 }
6969
6970 static struct mbuf *key_acquire_mbuf_head = NULL;
6971 static unsigned key_acquire_mbuf_count = 0;
6972 #define KEY_ACQUIRE_MBUF_MAX 10
6973
6974 static void
key_acquire_sendup_pending_mbuf(void)6975 key_acquire_sendup_pending_mbuf(void)
6976 {
6977 struct mbuf *m, *prev;
6978 int error;
6979
6980 again:
6981 prev = NULL;
6982 mutex_enter(&key_misc.lock);
6983 m = key_acquire_mbuf_head;
6984 /* Get an earliest mbuf (one at the tail of the list) */
6985 while (m != NULL) {
6986 if (m->m_nextpkt == NULL) {
6987 if (prev != NULL)
6988 prev->m_nextpkt = NULL;
6989 if (m == key_acquire_mbuf_head)
6990 key_acquire_mbuf_head = NULL;
6991 key_acquire_mbuf_count--;
6992 break;
6993 }
6994 prev = m;
6995 m = m->m_nextpkt;
6996 }
6997 mutex_exit(&key_misc.lock);
6998
6999 if (m == NULL)
7000 return;
7001
7002 m->m_nextpkt = NULL;
7003 error = key_sendup_mbuf(NULL, m, KEY_SENDUP_REGISTERED);
7004 if (error != 0)
7005 IPSECLOG(LOG_WARNING, "key_sendup_mbuf failed (error=%d)\n",
7006 error);
7007
7008 if (prev != NULL)
7009 goto again;
7010 }
7011
7012 static int
key_acquire_sendup_mbuf_later(struct mbuf * m)7013 key_acquire_sendup_mbuf_later(struct mbuf *m)
7014 {
7015
7016 mutex_enter(&key_misc.lock);
7017 /* Avoid queuing too much mbufs */
7018 if (key_acquire_mbuf_count >= KEY_ACQUIRE_MBUF_MAX) {
7019 mutex_exit(&key_misc.lock);
7020 m_freem(m);
7021 return ENOBUFS; /* XXX */
7022 }
7023 /* Enqueue mbuf at the head of the list */
7024 m->m_nextpkt = key_acquire_mbuf_head;
7025 key_acquire_mbuf_head = m;
7026 key_acquire_mbuf_count++;
7027 mutex_exit(&key_misc.lock);
7028
7029 /* Kick the timer */
7030 key_timehandler(NULL);
7031
7032 return 0;
7033 }
7034
7035 #ifndef IPSEC_NONBLOCK_ACQUIRE
7036 static struct secacq *
key_newacq(const struct secasindex * saidx)7037 key_newacq(const struct secasindex *saidx)
7038 {
7039 struct secacq *newacq;
7040
7041 /* get new entry */
7042 newacq = kmem_intr_zalloc(sizeof(struct secacq), KM_NOSLEEP);
7043 if (newacq == NULL) {
7044 IPSECLOG(LOG_DEBUG, "No more memory.\n");
7045 return NULL;
7046 }
7047
7048 /* copy secindex */
7049 memcpy(&newacq->saidx, saidx, sizeof(newacq->saidx));
7050 newacq->seq = (acq_seq == ~0 ? 1 : ++acq_seq);
7051 newacq->created = time_uptime;
7052 newacq->count = 0;
7053
7054 return newacq;
7055 }
7056
7057 static struct secacq *
key_getacq(const struct secasindex * saidx)7058 key_getacq(const struct secasindex *saidx)
7059 {
7060 struct secacq *acq;
7061
7062 KASSERT(mutex_owned(&key_misc.lock));
7063
7064 LIST_FOREACH(acq, &key_misc.acqlist, chain) {
7065 if (key_saidx_match(saidx, &acq->saidx, CMP_EXACTLY))
7066 return acq;
7067 }
7068
7069 return NULL;
7070 }
7071
7072 static struct secacq *
key_getacqbyseq(u_int32_t seq)7073 key_getacqbyseq(u_int32_t seq)
7074 {
7075 struct secacq *acq;
7076
7077 KASSERT(mutex_owned(&key_misc.lock));
7078
7079 LIST_FOREACH(acq, &key_misc.acqlist, chain) {
7080 if (acq->seq == seq)
7081 return acq;
7082 }
7083
7084 return NULL;
7085 }
7086 #endif
7087
7088 #ifdef notyet
7089 static struct secspacq *
key_newspacq(const struct secpolicyindex * spidx)7090 key_newspacq(const struct secpolicyindex *spidx)
7091 {
7092 struct secspacq *acq;
7093
7094 /* get new entry */
7095 acq = kmem_intr_zalloc(sizeof(struct secspacq), KM_NOSLEEP);
7096 if (acq == NULL) {
7097 IPSECLOG(LOG_DEBUG, "No more memory.\n");
7098 return NULL;
7099 }
7100
7101 /* copy secindex */
7102 memcpy(&acq->spidx, spidx, sizeof(acq->spidx));
7103 acq->created = time_uptime;
7104 acq->count = 0;
7105
7106 return acq;
7107 }
7108
7109 static struct secspacq *
key_getspacq(const struct secpolicyindex * spidx)7110 key_getspacq(const struct secpolicyindex *spidx)
7111 {
7112 struct secspacq *acq;
7113
7114 LIST_FOREACH(acq, &key_misc.spacqlist, chain) {
7115 if (key_spidx_match_exactly(spidx, &acq->spidx))
7116 return acq;
7117 }
7118
7119 return NULL;
7120 }
7121 #endif /* notyet */
7122
7123 /*
7124 * SADB_ACQUIRE processing,
7125 * in first situation, is receiving
7126 * <base>
7127 * from the ikmpd, and clear sequence of its secasvar entry.
7128 *
7129 * In second situation, is receiving
7130 * <base, address(SD), (address(P),) (identity(SD),) (sensitivity,) proposal>
7131 * from a user land process, and return
7132 * <base, address(SD), (address(P),) (identity(SD),) (sensitivity,) proposal>
7133 * to the socket.
7134 *
7135 * m will always be freed.
7136 */
7137 static int
key_api_acquire(struct socket * so,struct mbuf * m,const struct sadb_msghdr * mhp)7138 key_api_acquire(struct socket *so, struct mbuf *m,
7139 const struct sadb_msghdr *mhp)
7140 {
7141 const struct sockaddr *src, *dst;
7142 struct secasindex saidx;
7143 u_int16_t proto;
7144 int error;
7145
7146 /*
7147 * Error message from KMd.
7148 * We assume that if error was occurred in IKEd, the length of PFKEY
7149 * message is equal to the size of sadb_msg structure.
7150 * We do not raise error even if error occurred in this function.
7151 */
7152 if (mhp->msg->sadb_msg_len == PFKEY_UNIT64(sizeof(struct sadb_msg))) {
7153 #ifndef IPSEC_NONBLOCK_ACQUIRE
7154 struct secacq *acq;
7155
7156 /* check sequence number */
7157 if (mhp->msg->sadb_msg_seq == 0) {
7158 IPSECLOG(LOG_DEBUG, "must specify sequence number.\n");
7159 m_freem(m);
7160 return 0;
7161 }
7162
7163 mutex_enter(&key_misc.lock);
7164 acq = key_getacqbyseq(mhp->msg->sadb_msg_seq);
7165 if (acq == NULL) {
7166 mutex_exit(&key_misc.lock);
7167 /*
7168 * the specified larval SA is already gone, or we got
7169 * a bogus sequence number. we can silently ignore it.
7170 */
7171 m_freem(m);
7172 return 0;
7173 }
7174
7175 /* reset acq counter in order to deletion by timehandler. */
7176 acq->created = time_uptime;
7177 acq->count = 0;
7178 mutex_exit(&key_misc.lock);
7179 #endif
7180 m_freem(m);
7181 return 0;
7182 }
7183
7184 /*
7185 * This message is from user land.
7186 */
7187
7188 /* map satype to proto */
7189 proto = key_satype2proto(mhp->msg->sadb_msg_satype);
7190 if (proto == 0) {
7191 IPSECLOG(LOG_DEBUG, "invalid satype is passed.\n");
7192 return key_senderror(so, m, EINVAL);
7193 }
7194
7195 if (mhp->ext[SADB_EXT_ADDRESS_SRC] == NULL ||
7196 mhp->ext[SADB_EXT_ADDRESS_DST] == NULL ||
7197 mhp->ext[SADB_EXT_PROPOSAL] == NULL) {
7198 /* error */
7199 IPSECLOG(LOG_DEBUG, "invalid message is passed.\n");
7200 return key_senderror(so, m, EINVAL);
7201 }
7202 if (mhp->extlen[SADB_EXT_ADDRESS_SRC] < sizeof(struct sadb_address) ||
7203 mhp->extlen[SADB_EXT_ADDRESS_DST] < sizeof(struct sadb_address) ||
7204 mhp->extlen[SADB_EXT_PROPOSAL] < sizeof(struct sadb_prop)) {
7205 /* error */
7206 IPSECLOG(LOG_DEBUG, "invalid message is passed.\n");
7207 return key_senderror(so, m, EINVAL);
7208 }
7209
7210 src = key_msghdr_get_sockaddr(mhp, SADB_EXT_ADDRESS_SRC);
7211 dst = key_msghdr_get_sockaddr(mhp, SADB_EXT_ADDRESS_DST);
7212
7213 error = key_setsecasidx(proto, IPSEC_MODE_ANY, 0, src, dst, &saidx);
7214 if (error != 0)
7215 return key_senderror(so, m, EINVAL);
7216
7217 error = key_set_natt_ports(&saidx.src, &saidx.dst, mhp);
7218 if (error != 0)
7219 return key_senderror(so, m, EINVAL);
7220
7221 /* get a SA index */
7222 {
7223 struct secashead *sah;
7224 int s = pserialize_read_enter();
7225
7226 sah = key_getsah(&saidx, CMP_MODE_REQID);
7227 if (sah != NULL) {
7228 pserialize_read_exit(s);
7229 IPSECLOG(LOG_DEBUG, "a SA exists already.\n");
7230 return key_senderror(so, m, EEXIST);
7231 }
7232 pserialize_read_exit(s);
7233 }
7234
7235 error = key_acquire(&saidx, NULL, M_WAITOK);
7236 if (error != 0) {
7237 IPSECLOG(LOG_DEBUG, "error %d returned from key_acquire.\n",
7238 error);
7239 return key_senderror(so, m, error);
7240 }
7241
7242 return key_sendup_mbuf(so, m, KEY_SENDUP_REGISTERED);
7243 }
7244
7245 /*
7246 * SADB_REGISTER processing.
7247 * If SATYPE_UNSPEC has been passed as satype, only return sabd_supported.
7248 * receive
7249 * <base>
7250 * from the ikmpd, and register a socket to send PF_KEY messages,
7251 * and send
7252 * <base, supported>
7253 * to KMD by PF_KEY.
7254 * If socket is detached, must free from regnode.
7255 *
7256 * m will always be freed.
7257 */
7258 static int
key_api_register(struct socket * so,struct mbuf * m,const struct sadb_msghdr * mhp)7259 key_api_register(struct socket *so, struct mbuf *m,
7260 const struct sadb_msghdr *mhp)
7261 {
7262 struct secreg *reg, *newreg = 0;
7263
7264 /* check for invalid register message */
7265 if (mhp->msg->sadb_msg_satype >= __arraycount(key_misc.reglist))
7266 return key_senderror(so, m, EINVAL);
7267
7268 /* When SATYPE_UNSPEC is specified, only return sabd_supported. */
7269 if (mhp->msg->sadb_msg_satype == SADB_SATYPE_UNSPEC)
7270 goto setmsg;
7271
7272 /* Allocate regnode in advance, out of mutex */
7273 newreg = kmem_zalloc(sizeof(*newreg), KM_SLEEP);
7274
7275 /* check whether existing or not */
7276 mutex_enter(&key_misc.lock);
7277 LIST_FOREACH(reg, &key_misc.reglist[mhp->msg->sadb_msg_satype], chain) {
7278 if (reg->so == so) {
7279 IPSECLOG(LOG_DEBUG, "socket exists already.\n");
7280 mutex_exit(&key_misc.lock);
7281 kmem_free(newreg, sizeof(*newreg));
7282 return key_senderror(so, m, EEXIST);
7283 }
7284 }
7285
7286 newreg->so = so;
7287 ((struct keycb *)sotorawcb(so))->kp_registered++;
7288
7289 /* add regnode to key_misc.reglist. */
7290 LIST_INSERT_HEAD(&key_misc.reglist[mhp->msg->sadb_msg_satype], newreg, chain);
7291 mutex_exit(&key_misc.lock);
7292
7293 setmsg:
7294 {
7295 struct mbuf *n;
7296 struct sadb_supported *sup;
7297 u_int len, alen, elen;
7298 int off;
7299 int i;
7300 struct sadb_alg *alg;
7301
7302 /* create new sadb_msg to reply. */
7303 alen = 0;
7304 for (i = 1; i <= SADB_AALG_MAX; i++) {
7305 if (ah_algorithm_lookup(i))
7306 alen += sizeof(struct sadb_alg);
7307 }
7308 if (alen)
7309 alen += sizeof(struct sadb_supported);
7310 elen = 0;
7311 for (i = 1; i <= SADB_EALG_MAX; i++) {
7312 if (esp_algorithm_lookup(i))
7313 elen += sizeof(struct sadb_alg);
7314 }
7315 if (elen)
7316 elen += sizeof(struct sadb_supported);
7317
7318 len = sizeof(struct sadb_msg) + alen + elen;
7319
7320 if (len > MCLBYTES)
7321 return key_senderror(so, m, ENOBUFS);
7322
7323 n = key_alloc_mbuf_simple(len, M_WAITOK);
7324 n->m_pkthdr.len = n->m_len = len;
7325 n->m_next = NULL;
7326 off = 0;
7327
7328 m_copydata(m, 0, sizeof(struct sadb_msg), mtod(n, char *) + off);
7329 key_fill_replymsg(n, 0);
7330
7331 off += PFKEY_ALIGN8(sizeof(struct sadb_msg));
7332
7333 /* for authentication algorithm */
7334 if (alen) {
7335 sup = (struct sadb_supported *)(mtod(n, char *) + off);
7336 sup->sadb_supported_len = PFKEY_UNIT64(alen);
7337 sup->sadb_supported_exttype = SADB_EXT_SUPPORTED_AUTH;
7338 sup->sadb_supported_reserved = 0;
7339 off += PFKEY_ALIGN8(sizeof(*sup));
7340
7341 for (i = 1; i <= SADB_AALG_MAX; i++) {
7342 const struct auth_hash *aalgo;
7343 u_int16_t minkeysize, maxkeysize;
7344
7345 aalgo = ah_algorithm_lookup(i);
7346 if (!aalgo)
7347 continue;
7348 alg = (struct sadb_alg *)(mtod(n, char *) + off);
7349 alg->sadb_alg_id = i;
7350 alg->sadb_alg_ivlen = 0;
7351 key_getsizes_ah(aalgo, i, &minkeysize, &maxkeysize);
7352 alg->sadb_alg_minbits = _BITS(minkeysize);
7353 alg->sadb_alg_maxbits = _BITS(maxkeysize);
7354 alg->sadb_alg_reserved = 0;
7355 off += PFKEY_ALIGN8(sizeof(*alg));
7356 }
7357 }
7358
7359 /* for encryption algorithm */
7360 if (elen) {
7361 sup = (struct sadb_supported *)(mtod(n, char *) + off);
7362 sup->sadb_supported_len = PFKEY_UNIT64(elen);
7363 sup->sadb_supported_exttype = SADB_EXT_SUPPORTED_ENCRYPT;
7364 sup->sadb_supported_reserved = 0;
7365 off += PFKEY_ALIGN8(sizeof(*sup));
7366
7367 for (i = 1; i <= SADB_EALG_MAX; i++) {
7368 const struct enc_xform *ealgo;
7369
7370 ealgo = esp_algorithm_lookup(i);
7371 if (!ealgo)
7372 continue;
7373 alg = (struct sadb_alg *)(mtod(n, char *) + off);
7374 alg->sadb_alg_id = i;
7375 alg->sadb_alg_ivlen = ealgo->blocksize;
7376 alg->sadb_alg_minbits = _BITS(ealgo->minkey);
7377 alg->sadb_alg_maxbits = _BITS(ealgo->maxkey);
7378 alg->sadb_alg_reserved = 0;
7379 off += PFKEY_ALIGN8(sizeof(struct sadb_alg));
7380 }
7381 }
7382
7383 KASSERTMSG(off == len, "length inconsistency");
7384
7385 m_freem(m);
7386 return key_sendup_mbuf(so, n, KEY_SENDUP_REGISTERED);
7387 }
7388 }
7389
7390 /*
7391 * free secreg entry registered.
7392 * XXX: I want to do free a socket marked done SADB_RESIGER to socket.
7393 */
7394 void
key_freereg(struct socket * so)7395 key_freereg(struct socket *so)
7396 {
7397 struct secreg *reg;
7398 int i;
7399
7400 KASSERT(!cpu_softintr_p());
7401 KASSERT(so != NULL);
7402
7403 /*
7404 * check whether existing or not.
7405 * check all type of SA, because there is a potential that
7406 * one socket is registered to multiple type of SA.
7407 */
7408 for (i = 0; i <= SADB_SATYPE_MAX; i++) {
7409 mutex_enter(&key_misc.lock);
7410 LIST_FOREACH(reg, &key_misc.reglist[i], chain) {
7411 if (reg->so == so) {
7412 LIST_REMOVE(reg, chain);
7413 break;
7414 }
7415 }
7416 mutex_exit(&key_misc.lock);
7417 if (reg != NULL)
7418 kmem_free(reg, sizeof(*reg));
7419 }
7420
7421 return;
7422 }
7423
7424 /*
7425 * SADB_EXPIRE processing
7426 * send
7427 * <base, SA, SA2, lifetime(C and one of HS), address(SD)>
7428 * to KMD by PF_KEY.
7429 * NOTE: We send only soft lifetime extension.
7430 *
7431 * OUT: 0 : succeed
7432 * others : error number
7433 */
7434 static int
key_expire(struct secasvar * sav)7435 key_expire(struct secasvar *sav)
7436 {
7437 int s;
7438 int satype;
7439 struct mbuf *result = NULL, *m;
7440 int len;
7441 int error = -1;
7442 struct sadb_lifetime *lt;
7443 lifetime_counters_t sum = {0};
7444
7445 /* XXX: Why do we lock ? */
7446 s = splsoftnet(); /*called from softclock()*/
7447
7448 KASSERT(sav != NULL);
7449
7450 satype = key_proto2satype(sav->sah->saidx.proto);
7451 KASSERTMSG(satype != 0, "invalid proto is passed");
7452
7453 /* set msg header */
7454 m = key_setsadbmsg(SADB_EXPIRE, 0, satype, sav->seq, 0, key_sa_refcnt(sav),
7455 M_WAITOK);
7456 result = m;
7457
7458 /* create SA extension */
7459 m = key_setsadbsa(sav);
7460 m_cat(result, m);
7461
7462 /* create SA extension */
7463 m = key_setsadbxsa2(sav->sah->saidx.mode,
7464 sav->replay ? sav->replay->count : 0, sav->sah->saidx.reqid);
7465 m_cat(result, m);
7466
7467 /* create lifetime extension (current and soft) */
7468 len = PFKEY_ALIGN8(sizeof(*lt)) * 2;
7469 m = key_alloc_mbuf(len, M_WAITOK);
7470 KASSERT(m->m_next == NULL);
7471
7472 memset(mtod(m, void *), 0, len);
7473 lt = mtod(m, struct sadb_lifetime *);
7474 lt->sadb_lifetime_len = PFKEY_UNIT64(sizeof(struct sadb_lifetime));
7475 lt->sadb_lifetime_exttype = SADB_EXT_LIFETIME_CURRENT;
7476 percpu_foreach_xcall(sav->lft_c_counters_percpu,
7477 XC_HIGHPRI_IPL(IPL_SOFTNET), key_sum_lifetime_counters, sum);
7478 lt->sadb_lifetime_allocations = sum[LIFETIME_COUNTER_ALLOCATIONS];
7479 lt->sadb_lifetime_bytes = sum[LIFETIME_COUNTER_BYTES];
7480 lt->sadb_lifetime_addtime =
7481 time_mono_to_wall(sav->lft_c->sadb_lifetime_addtime);
7482 lt->sadb_lifetime_usetime =
7483 time_mono_to_wall(sav->lft_c->sadb_lifetime_usetime);
7484 lt = (struct sadb_lifetime *)(mtod(m, char *) + len / 2);
7485 memcpy(lt, sav->lft_s, sizeof(*lt));
7486 m_cat(result, m);
7487
7488 /* set sadb_address for source */
7489 m = key_setsadbaddr(SADB_EXT_ADDRESS_SRC, &sav->sah->saidx.src.sa,
7490 FULLMASK, IPSEC_ULPROTO_ANY, M_WAITOK);
7491 m_cat(result, m);
7492
7493 /* set sadb_address for destination */
7494 m = key_setsadbaddr(SADB_EXT_ADDRESS_DST, &sav->sah->saidx.dst.sa,
7495 FULLMASK, IPSEC_ULPROTO_ANY, M_WAITOK);
7496 m_cat(result, m);
7497
7498 if ((result->m_flags & M_PKTHDR) == 0) {
7499 error = EINVAL;
7500 goto fail;
7501 }
7502
7503 if (result->m_len < sizeof(struct sadb_msg)) {
7504 result = m_pullup(result, sizeof(struct sadb_msg));
7505 if (result == NULL) {
7506 error = ENOBUFS;
7507 goto fail;
7508 }
7509 }
7510
7511 result->m_pkthdr.len = 0;
7512 for (m = result; m; m = m->m_next)
7513 result->m_pkthdr.len += m->m_len;
7514
7515 mtod(result, struct sadb_msg *)->sadb_msg_len =
7516 PFKEY_UNIT64(result->m_pkthdr.len);
7517
7518 splx(s);
7519 return key_sendup_mbuf(NULL, result, KEY_SENDUP_REGISTERED);
7520
7521 fail:
7522 m_freem(result);
7523 splx(s);
7524 return error;
7525 }
7526
7527 /*
7528 * SADB_FLUSH processing
7529 * receive
7530 * <base>
7531 * from the ikmpd, and free all entries in secastree.
7532 * and send,
7533 * <base>
7534 * to the ikmpd.
7535 * NOTE: to do is only marking SADB_SASTATE_DEAD.
7536 *
7537 * m will always be freed.
7538 */
7539 static int
key_api_flush(struct socket * so,struct mbuf * m,const struct sadb_msghdr * mhp)7540 key_api_flush(struct socket *so, struct mbuf *m,
7541 const struct sadb_msghdr *mhp)
7542 {
7543 struct sadb_msg *newmsg;
7544 struct secashead *sah;
7545 struct secasvar *sav;
7546 u_int16_t proto;
7547 u_int8_t state;
7548 int s;
7549
7550 /* map satype to proto */
7551 proto = key_satype2proto(mhp->msg->sadb_msg_satype);
7552 if (proto == 0) {
7553 IPSECLOG(LOG_DEBUG, "invalid satype is passed.\n");
7554 return key_senderror(so, m, EINVAL);
7555 }
7556
7557 /* no SATYPE specified, i.e. flushing all SA. */
7558 s = pserialize_read_enter();
7559 SAHLIST_READER_FOREACH(sah) {
7560 if (mhp->msg->sadb_msg_satype != SADB_SATYPE_UNSPEC &&
7561 proto != sah->saidx.proto)
7562 continue;
7563
7564 key_sah_ref(sah);
7565 pserialize_read_exit(s);
7566
7567 SASTATE_ALIVE_FOREACH(state) {
7568 restart:
7569 mutex_enter(&key_sad.lock);
7570 SAVLIST_WRITER_FOREACH(sav, sah, state) {
7571 sav->state = SADB_SASTATE_DEAD;
7572 key_unlink_sav(sav);
7573 mutex_exit(&key_sad.lock);
7574 key_destroy_sav(sav);
7575 goto restart;
7576 }
7577 mutex_exit(&key_sad.lock);
7578 }
7579
7580 s = pserialize_read_enter();
7581 sah->state = SADB_SASTATE_DEAD;
7582 key_sah_unref(sah);
7583 }
7584 pserialize_read_exit(s);
7585
7586 if (m->m_len < sizeof(struct sadb_msg) ||
7587 sizeof(struct sadb_msg) > m->m_len + M_TRAILINGSPACE(m)) {
7588 IPSECLOG(LOG_DEBUG, "No more memory.\n");
7589 return key_senderror(so, m, ENOBUFS);
7590 }
7591
7592 m_freem(m->m_next);
7593 m->m_next = NULL;
7594 m->m_pkthdr.len = m->m_len = sizeof(struct sadb_msg);
7595 newmsg = mtod(m, struct sadb_msg *);
7596 newmsg->sadb_msg_errno = 0;
7597 newmsg->sadb_msg_len = PFKEY_UNIT64(m->m_pkthdr.len);
7598
7599 return key_sendup_mbuf(so, m, KEY_SENDUP_ALL);
7600 }
7601
7602
7603 static struct mbuf *
key_setdump_chain(u_int8_t req_satype,int * errorp,int * lenp,pid_t pid)7604 key_setdump_chain(u_int8_t req_satype, int *errorp, int *lenp, pid_t pid)
7605 {
7606 struct secashead *sah;
7607 struct secasvar *sav;
7608 u_int16_t proto;
7609 u_int8_t satype;
7610 u_int8_t state;
7611 int cnt;
7612 struct mbuf *m, *n, *prev;
7613
7614 KASSERT(mutex_owned(&key_sad.lock));
7615
7616 *lenp = 0;
7617
7618 /* map satype to proto */
7619 proto = key_satype2proto(req_satype);
7620 if (proto == 0) {
7621 *errorp = EINVAL;
7622 return (NULL);
7623 }
7624
7625 /* count sav entries to be sent to userland. */
7626 cnt = 0;
7627 SAHLIST_WRITER_FOREACH(sah) {
7628 if (req_satype != SADB_SATYPE_UNSPEC &&
7629 proto != sah->saidx.proto)
7630 continue;
7631
7632 SASTATE_ANY_FOREACH(state) {
7633 SAVLIST_WRITER_FOREACH(sav, sah, state) {
7634 cnt++;
7635 }
7636 }
7637 }
7638
7639 if (cnt == 0) {
7640 *errorp = ENOENT;
7641 return (NULL);
7642 }
7643
7644 /* send this to the userland, one at a time. */
7645 m = NULL;
7646 prev = m;
7647 SAHLIST_WRITER_FOREACH(sah) {
7648 if (req_satype != SADB_SATYPE_UNSPEC &&
7649 proto != sah->saidx.proto)
7650 continue;
7651
7652 /* map proto to satype */
7653 satype = key_proto2satype(sah->saidx.proto);
7654 if (satype == 0) {
7655 m_freem(m);
7656 *errorp = EINVAL;
7657 return (NULL);
7658 }
7659
7660 SASTATE_ANY_FOREACH(state) {
7661 SAVLIST_WRITER_FOREACH(sav, sah, state) {
7662 n = key_setdumpsa(sav, SADB_DUMP, satype,
7663 --cnt, pid);
7664 if (!m)
7665 m = n;
7666 else
7667 prev->m_nextpkt = n;
7668 prev = n;
7669 }
7670 }
7671 }
7672
7673 if (!m) {
7674 *errorp = EINVAL;
7675 return (NULL);
7676 }
7677
7678 if ((m->m_flags & M_PKTHDR) != 0) {
7679 m->m_pkthdr.len = 0;
7680 for (n = m; n; n = n->m_next)
7681 m->m_pkthdr.len += n->m_len;
7682 }
7683
7684 *errorp = 0;
7685 return (m);
7686 }
7687
7688 /*
7689 * SADB_DUMP processing
7690 * dump all entries including status of DEAD in SAD.
7691 * receive
7692 * <base>
7693 * from the ikmpd, and dump all secasvar leaves
7694 * and send,
7695 * <base> .....
7696 * to the ikmpd.
7697 *
7698 * m will always be freed.
7699 */
7700 static int
key_api_dump(struct socket * so,struct mbuf * m0,const struct sadb_msghdr * mhp)7701 key_api_dump(struct socket *so, struct mbuf *m0,
7702 const struct sadb_msghdr *mhp)
7703 {
7704 u_int16_t proto;
7705 u_int8_t satype;
7706 struct mbuf *n;
7707 int error, len, ok;
7708
7709 /* map satype to proto */
7710 satype = mhp->msg->sadb_msg_satype;
7711 proto = key_satype2proto(satype);
7712 if (proto == 0) {
7713 IPSECLOG(LOG_DEBUG, "invalid satype is passed.\n");
7714 return key_senderror(so, m0, EINVAL);
7715 }
7716
7717 /*
7718 * If the requestor has insufficient socket-buffer space
7719 * for the entire chain, nobody gets any response to the DUMP.
7720 * XXX For now, only the requestor ever gets anything.
7721 * Moreover, if the requestor has any space at all, they receive
7722 * the entire chain, otherwise the request is refused with ENOBUFS.
7723 */
7724 if (sbspace(&so->so_rcv) <= 0) {
7725 return key_senderror(so, m0, ENOBUFS);
7726 }
7727
7728 mutex_enter(&key_sad.lock);
7729 n = key_setdump_chain(satype, &error, &len, mhp->msg->sadb_msg_pid);
7730 mutex_exit(&key_sad.lock);
7731
7732 if (n == NULL) {
7733 return key_senderror(so, m0, ENOENT);
7734 }
7735 {
7736 net_stat_ref_t ps = PFKEY_STAT_GETREF();
7737 _NET_STATINC_REF(ps, PFKEY_STAT_IN_TOTAL);
7738 _NET_STATADD_REF(ps, PFKEY_STAT_IN_BYTES, len);
7739 PFKEY_STAT_PUTREF();
7740 }
7741
7742 /*
7743 * PF_KEY DUMP responses are no longer broadcast to all PF_KEY sockets.
7744 * The requestor receives either the entire chain, or an
7745 * error message with ENOBUFS.
7746 *
7747 * sbappendaddrchain() takes the chain of entries, one
7748 * packet-record per SPD entry, prepends the key_src sockaddr
7749 * to each packet-record, links the sockaddr mbufs into a new
7750 * list of records, then appends the entire resulting
7751 * list to the requesting socket.
7752 */
7753 ok = sbappendaddrchain(&so->so_rcv, (struct sockaddr *)&key_src, n,
7754 SB_PRIO_ONESHOT_OVERFLOW);
7755
7756 if (!ok) {
7757 PFKEY_STATINC(PFKEY_STAT_IN_NOMEM);
7758 m_freem(n);
7759 return key_senderror(so, m0, ENOBUFS);
7760 }
7761
7762 m_freem(m0);
7763 return 0;
7764 }
7765
7766 /*
7767 * SADB_X_PROMISC processing
7768 *
7769 * m will always be freed.
7770 */
7771 static int
key_api_promisc(struct socket * so,struct mbuf * m,const struct sadb_msghdr * mhp)7772 key_api_promisc(struct socket *so, struct mbuf *m,
7773 const struct sadb_msghdr *mhp)
7774 {
7775 int olen;
7776
7777 olen = PFKEY_UNUNIT64(mhp->msg->sadb_msg_len);
7778
7779 if (olen < sizeof(struct sadb_msg)) {
7780 #if 1
7781 return key_senderror(so, m, EINVAL);
7782 #else
7783 m_freem(m);
7784 return 0;
7785 #endif
7786 } else if (olen == sizeof(struct sadb_msg)) {
7787 /* enable/disable promisc mode */
7788 struct keycb *kp = (struct keycb *)sotorawcb(so);
7789 if (kp == NULL)
7790 return key_senderror(so, m, EINVAL);
7791 mhp->msg->sadb_msg_errno = 0;
7792 switch (mhp->msg->sadb_msg_satype) {
7793 case 0:
7794 case 1:
7795 kp->kp_promisc = mhp->msg->sadb_msg_satype;
7796 break;
7797 default:
7798 return key_senderror(so, m, EINVAL);
7799 }
7800
7801 /* send the original message back to everyone */
7802 mhp->msg->sadb_msg_errno = 0;
7803 return key_sendup_mbuf(so, m, KEY_SENDUP_ALL);
7804 } else {
7805 /* send packet as is */
7806
7807 m_adj(m, PFKEY_ALIGN8(sizeof(struct sadb_msg)));
7808
7809 /* TODO: if sadb_msg_seq is specified, send to specific pid */
7810 return key_sendup_mbuf(so, m, KEY_SENDUP_ALL);
7811 }
7812 }
7813
7814 static int (*key_api_typesw[]) (struct socket *, struct mbuf *,
7815 const struct sadb_msghdr *) = {
7816 NULL, /* SADB_RESERVED */
7817 key_api_getspi, /* SADB_GETSPI */
7818 key_api_update, /* SADB_UPDATE */
7819 key_api_add, /* SADB_ADD */
7820 key_api_delete, /* SADB_DELETE */
7821 key_api_get, /* SADB_GET */
7822 key_api_acquire, /* SADB_ACQUIRE */
7823 key_api_register, /* SADB_REGISTER */
7824 NULL, /* SADB_EXPIRE */
7825 key_api_flush, /* SADB_FLUSH */
7826 key_api_dump, /* SADB_DUMP */
7827 key_api_promisc, /* SADB_X_PROMISC */
7828 NULL, /* SADB_X_PCHANGE */
7829 key_api_spdadd, /* SADB_X_SPDUPDATE */
7830 key_api_spdadd, /* SADB_X_SPDADD */
7831 key_api_spddelete, /* SADB_X_SPDDELETE */
7832 key_api_spdget, /* SADB_X_SPDGET */
7833 NULL, /* SADB_X_SPDACQUIRE */
7834 key_api_spddump, /* SADB_X_SPDDUMP */
7835 key_api_spdflush, /* SADB_X_SPDFLUSH */
7836 key_api_spdadd, /* SADB_X_SPDSETIDX */
7837 NULL, /* SADB_X_SPDEXPIRE */
7838 key_api_spddelete2, /* SADB_X_SPDDELETE2 */
7839 key_api_nat_map, /* SADB_X_NAT_T_NEW_MAPPING */
7840 };
7841
7842 /*
7843 * parse sadb_msg buffer to process PFKEYv2,
7844 * and create a data to response if needed.
7845 * I think to be dealed with mbuf directly.
7846 * IN:
7847 * msgp : pointer to pointer to a received buffer pulluped.
7848 * This is rewrited to response.
7849 * so : pointer to socket.
7850 * OUT:
7851 * length for buffer to send to user process.
7852 */
7853 int
key_parse(struct mbuf * m,struct socket * so)7854 key_parse(struct mbuf *m, struct socket *so)
7855 {
7856 struct sadb_msg *msg;
7857 struct sadb_msghdr mh;
7858 u_int orglen;
7859 int error;
7860
7861 KASSERT(m != NULL);
7862 KASSERT(so != NULL);
7863
7864 #if 0 /*kdebug_sadb assumes msg in linear buffer*/
7865 if (KEYDEBUG_ON(KEYDEBUG_KEY_DUMP)) {
7866 kdebug_sadb("passed sadb_msg", msg);
7867 }
7868 #endif
7869
7870 if (m->m_len < sizeof(struct sadb_msg)) {
7871 m = m_pullup(m, sizeof(struct sadb_msg));
7872 if (!m)
7873 return ENOBUFS;
7874 }
7875 msg = mtod(m, struct sadb_msg *);
7876 orglen = PFKEY_UNUNIT64(msg->sadb_msg_len);
7877
7878 if ((m->m_flags & M_PKTHDR) == 0 ||
7879 m->m_pkthdr.len != orglen) {
7880 IPSECLOG(LOG_DEBUG, "invalid message length.\n");
7881 PFKEY_STATINC(PFKEY_STAT_OUT_INVLEN);
7882 error = EINVAL;
7883 goto senderror;
7884 }
7885
7886 if (msg->sadb_msg_version != PF_KEY_V2) {
7887 IPSECLOG(LOG_DEBUG, "PF_KEY version %u is mismatched.\n",
7888 msg->sadb_msg_version);
7889 PFKEY_STATINC(PFKEY_STAT_OUT_INVVER);
7890 error = EINVAL;
7891 goto senderror;
7892 }
7893
7894 if (msg->sadb_msg_type > SADB_MAX) {
7895 IPSECLOG(LOG_DEBUG, "invalid type %u is passed.\n",
7896 msg->sadb_msg_type);
7897 PFKEY_STATINC(PFKEY_STAT_OUT_INVMSGTYPE);
7898 error = EINVAL;
7899 goto senderror;
7900 }
7901
7902 /* for old-fashioned code - should be nuked */
7903 if (m->m_pkthdr.len > MCLBYTES) {
7904 m_freem(m);
7905 return ENOBUFS;
7906 }
7907 if (m->m_next) {
7908 struct mbuf *n;
7909
7910 n = key_alloc_mbuf_simple(m->m_pkthdr.len, M_WAITOK);
7911
7912 m_copydata(m, 0, m->m_pkthdr.len, mtod(n, void *));
7913 n->m_pkthdr.len = n->m_len = m->m_pkthdr.len;
7914 n->m_next = NULL;
7915 m_freem(m);
7916 m = n;
7917 }
7918
7919 /* align the mbuf chain so that extensions are in contiguous region. */
7920 error = key_align(m, &mh);
7921 if (error)
7922 return error;
7923
7924 if (m->m_next) { /*XXX*/
7925 m_freem(m);
7926 return ENOBUFS;
7927 }
7928
7929 msg = mh.msg;
7930
7931 /* check SA type */
7932 switch (msg->sadb_msg_satype) {
7933 case SADB_SATYPE_UNSPEC:
7934 switch (msg->sadb_msg_type) {
7935 case SADB_GETSPI:
7936 case SADB_UPDATE:
7937 case SADB_ADD:
7938 case SADB_DELETE:
7939 case SADB_GET:
7940 case SADB_ACQUIRE:
7941 case SADB_EXPIRE:
7942 IPSECLOG(LOG_DEBUG,
7943 "must specify satype when msg type=%u.\n",
7944 msg->sadb_msg_type);
7945 PFKEY_STATINC(PFKEY_STAT_OUT_INVSATYPE);
7946 error = EINVAL;
7947 goto senderror;
7948 }
7949 break;
7950 case SADB_SATYPE_AH:
7951 case SADB_SATYPE_ESP:
7952 case SADB_X_SATYPE_IPCOMP:
7953 case SADB_X_SATYPE_TCPSIGNATURE:
7954 switch (msg->sadb_msg_type) {
7955 case SADB_X_SPDADD:
7956 case SADB_X_SPDDELETE:
7957 case SADB_X_SPDGET:
7958 case SADB_X_SPDDUMP:
7959 case SADB_X_SPDFLUSH:
7960 case SADB_X_SPDSETIDX:
7961 case SADB_X_SPDUPDATE:
7962 case SADB_X_SPDDELETE2:
7963 IPSECLOG(LOG_DEBUG, "illegal satype=%u\n",
7964 msg->sadb_msg_type);
7965 PFKEY_STATINC(PFKEY_STAT_OUT_INVSATYPE);
7966 error = EINVAL;
7967 goto senderror;
7968 }
7969 break;
7970 case SADB_SATYPE_RSVP:
7971 case SADB_SATYPE_OSPFV2:
7972 case SADB_SATYPE_RIPV2:
7973 case SADB_SATYPE_MIP:
7974 IPSECLOG(LOG_DEBUG, "type %u isn't supported.\n",
7975 msg->sadb_msg_satype);
7976 PFKEY_STATINC(PFKEY_STAT_OUT_INVSATYPE);
7977 error = EOPNOTSUPP;
7978 goto senderror;
7979 case 1: /* XXX: What does it do? */
7980 if (msg->sadb_msg_type == SADB_X_PROMISC)
7981 break;
7982 /*FALLTHROUGH*/
7983 default:
7984 IPSECLOG(LOG_DEBUG, "invalid type %u is passed.\n",
7985 msg->sadb_msg_satype);
7986 PFKEY_STATINC(PFKEY_STAT_OUT_INVSATYPE);
7987 error = EINVAL;
7988 goto senderror;
7989 }
7990
7991 /* check field of upper layer protocol and address family */
7992 if (mh.ext[SADB_EXT_ADDRESS_SRC] != NULL &&
7993 mh.ext[SADB_EXT_ADDRESS_DST] != NULL) {
7994 const struct sadb_address *src0, *dst0;
7995 const struct sockaddr *sa0, *da0;
7996 u_int plen;
7997
7998 src0 = mh.ext[SADB_EXT_ADDRESS_SRC];
7999 dst0 = mh.ext[SADB_EXT_ADDRESS_DST];
8000 sa0 = key_msghdr_get_sockaddr(&mh, SADB_EXT_ADDRESS_SRC);
8001 da0 = key_msghdr_get_sockaddr(&mh, SADB_EXT_ADDRESS_DST);
8002
8003 /* check upper layer protocol */
8004 if (src0->sadb_address_proto != dst0->sadb_address_proto) {
8005 IPSECLOG(LOG_DEBUG,
8006 "upper layer protocol mismatched src %u, dst %u.\n",
8007 src0->sadb_address_proto, dst0->sadb_address_proto);
8008
8009 goto invaddr;
8010 }
8011
8012 /* check family */
8013 if (sa0->sa_family != da0->sa_family) {
8014 IPSECLOG(LOG_DEBUG,
8015 "address family mismatched src %u, dst %u.\n",
8016 sa0->sa_family, da0->sa_family);
8017 goto invaddr;
8018 }
8019 if (sa0->sa_len != da0->sa_len) {
8020 IPSECLOG(LOG_DEBUG,
8021 "address size mismatched src %u, dst %u.\n",
8022 sa0->sa_len, da0->sa_len);
8023 goto invaddr;
8024 }
8025
8026 switch (sa0->sa_family) {
8027 case AF_INET:
8028 if (sa0->sa_len != sizeof(struct sockaddr_in)) {
8029 IPSECLOG(LOG_DEBUG,
8030 "address size mismatched %u != %zu.\n",
8031 sa0->sa_len, sizeof(struct sockaddr_in));
8032 goto invaddr;
8033 }
8034 break;
8035 case AF_INET6:
8036 if (sa0->sa_len != sizeof(struct sockaddr_in6)) {
8037 IPSECLOG(LOG_DEBUG,
8038 "address size mismatched %u != %zu.\n",
8039 sa0->sa_len, sizeof(struct sockaddr_in6));
8040 goto invaddr;
8041 }
8042 break;
8043 default:
8044 IPSECLOG(LOG_DEBUG, "unsupported address family %u.\n",
8045 sa0->sa_family);
8046 error = EAFNOSUPPORT;
8047 goto senderror;
8048 }
8049 plen = key_sabits(sa0);
8050
8051 /* check max prefix length */
8052 if (src0->sadb_address_prefixlen > plen ||
8053 dst0->sadb_address_prefixlen > plen) {
8054 IPSECLOG(LOG_DEBUG, "illegal prefixlen.\n");
8055 goto invaddr;
8056 }
8057
8058 /*
8059 * prefixlen == 0 is valid because there can be a case when
8060 * all addresses are matched.
8061 */
8062 }
8063
8064 if (msg->sadb_msg_type >= __arraycount(key_api_typesw) ||
8065 key_api_typesw[msg->sadb_msg_type] == NULL) {
8066 PFKEY_STATINC(PFKEY_STAT_OUT_INVMSGTYPE);
8067 error = EINVAL;
8068 goto senderror;
8069 }
8070
8071 return (*key_api_typesw[msg->sadb_msg_type])(so, m, &mh);
8072
8073 invaddr:
8074 error = EINVAL;
8075 senderror:
8076 PFKEY_STATINC(PFKEY_STAT_OUT_INVADDR);
8077 return key_senderror(so, m, error);
8078 }
8079
8080 static int
key_senderror(struct socket * so,struct mbuf * m,int code)8081 key_senderror(struct socket *so, struct mbuf *m, int code)
8082 {
8083 struct sadb_msg *msg;
8084
8085 KASSERT(m->m_len >= sizeof(struct sadb_msg));
8086
8087 if (so == NULL) {
8088 /*
8089 * This means the request comes from kernel.
8090 * As the request comes from kernel, it is unnecessary to
8091 * send message to userland. Just return errcode directly.
8092 */
8093 m_freem(m);
8094 return code;
8095 }
8096
8097 msg = mtod(m, struct sadb_msg *);
8098 msg->sadb_msg_errno = code;
8099 return key_sendup_mbuf(so, m, KEY_SENDUP_ONE);
8100 }
8101
8102 /*
8103 * set the pointer to each header into message buffer.
8104 * m will be freed on error.
8105 * XXX larger-than-MCLBYTES extension?
8106 */
8107 static int
key_align(struct mbuf * m,struct sadb_msghdr * mhp)8108 key_align(struct mbuf *m, struct sadb_msghdr *mhp)
8109 {
8110 struct mbuf *n;
8111 struct sadb_ext *ext;
8112 size_t off, end;
8113 int extlen;
8114 int toff;
8115
8116 KASSERT(m != NULL);
8117 KASSERT(mhp != NULL);
8118 KASSERT(m->m_len >= sizeof(struct sadb_msg));
8119
8120 /* initialize */
8121 memset(mhp, 0, sizeof(*mhp));
8122
8123 mhp->msg = mtod(m, struct sadb_msg *);
8124 mhp->ext[0] = mhp->msg; /*XXX backward compat */
8125
8126 end = PFKEY_UNUNIT64(mhp->msg->sadb_msg_len);
8127 extlen = end; /*just in case extlen is not updated*/
8128 for (off = sizeof(struct sadb_msg); off < end; off += extlen) {
8129 n = m_pulldown(m, off, sizeof(struct sadb_ext), &toff);
8130 if (!n) {
8131 /* m is already freed */
8132 return ENOBUFS;
8133 }
8134 ext = (struct sadb_ext *)(mtod(n, char *) + toff);
8135
8136 /* set pointer */
8137 switch (ext->sadb_ext_type) {
8138 case SADB_EXT_SA:
8139 case SADB_EXT_ADDRESS_SRC:
8140 case SADB_EXT_ADDRESS_DST:
8141 case SADB_EXT_ADDRESS_PROXY:
8142 case SADB_EXT_LIFETIME_CURRENT:
8143 case SADB_EXT_LIFETIME_HARD:
8144 case SADB_EXT_LIFETIME_SOFT:
8145 case SADB_EXT_KEY_AUTH:
8146 case SADB_EXT_KEY_ENCRYPT:
8147 case SADB_EXT_IDENTITY_SRC:
8148 case SADB_EXT_IDENTITY_DST:
8149 case SADB_EXT_SENSITIVITY:
8150 case SADB_EXT_PROPOSAL:
8151 case SADB_EXT_SUPPORTED_AUTH:
8152 case SADB_EXT_SUPPORTED_ENCRYPT:
8153 case SADB_EXT_SPIRANGE:
8154 case SADB_X_EXT_POLICY:
8155 case SADB_X_EXT_SA2:
8156 case SADB_X_EXT_NAT_T_TYPE:
8157 case SADB_X_EXT_NAT_T_SPORT:
8158 case SADB_X_EXT_NAT_T_DPORT:
8159 case SADB_X_EXT_NAT_T_OAI:
8160 case SADB_X_EXT_NAT_T_OAR:
8161 case SADB_X_EXT_NAT_T_FRAG:
8162 /* duplicate check */
8163 /*
8164 * XXX Are there duplication payloads of either
8165 * KEY_AUTH or KEY_ENCRYPT ?
8166 */
8167 if (mhp->ext[ext->sadb_ext_type] != NULL) {
8168 IPSECLOG(LOG_DEBUG,
8169 "duplicate ext_type %u is passed.\n",
8170 ext->sadb_ext_type);
8171 m_freem(m);
8172 PFKEY_STATINC(PFKEY_STAT_OUT_DUPEXT);
8173 return EINVAL;
8174 }
8175 break;
8176 default:
8177 IPSECLOG(LOG_DEBUG, "invalid ext_type %u is passed.\n",
8178 ext->sadb_ext_type);
8179 m_freem(m);
8180 PFKEY_STATINC(PFKEY_STAT_OUT_INVEXTTYPE);
8181 return EINVAL;
8182 }
8183
8184 extlen = PFKEY_UNUNIT64(ext->sadb_ext_len);
8185
8186 if (key_validate_ext(ext, extlen)) {
8187 m_freem(m);
8188 PFKEY_STATINC(PFKEY_STAT_OUT_INVLEN);
8189 return EINVAL;
8190 }
8191
8192 n = m_pulldown(m, off, extlen, &toff);
8193 if (!n) {
8194 /* m is already freed */
8195 return ENOBUFS;
8196 }
8197 ext = (struct sadb_ext *)(mtod(n, char *) + toff);
8198
8199 mhp->ext[ext->sadb_ext_type] = ext;
8200 mhp->extoff[ext->sadb_ext_type] = off;
8201 mhp->extlen[ext->sadb_ext_type] = extlen;
8202 }
8203
8204 if (off != end) {
8205 m_freem(m);
8206 PFKEY_STATINC(PFKEY_STAT_OUT_INVLEN);
8207 return EINVAL;
8208 }
8209
8210 return 0;
8211 }
8212
8213 static int
key_validate_ext(const struct sadb_ext * ext,int len)8214 key_validate_ext(const struct sadb_ext *ext, int len)
8215 {
8216 const struct sockaddr *sa;
8217 enum { NONE, ADDR } checktype = NONE;
8218 int baselen = 0;
8219 const int sal = offsetof(struct sockaddr, sa_len) + sizeof(sa->sa_len);
8220
8221 if (len != PFKEY_UNUNIT64(ext->sadb_ext_len))
8222 return EINVAL;
8223
8224 /* if it does not match minimum/maximum length, bail */
8225 if (ext->sadb_ext_type >= __arraycount(minsize) ||
8226 ext->sadb_ext_type >= __arraycount(maxsize))
8227 return EINVAL;
8228 if (!minsize[ext->sadb_ext_type] || len < minsize[ext->sadb_ext_type])
8229 return EINVAL;
8230 if (maxsize[ext->sadb_ext_type] && len > maxsize[ext->sadb_ext_type])
8231 return EINVAL;
8232
8233 /* more checks based on sadb_ext_type XXX need more */
8234 switch (ext->sadb_ext_type) {
8235 case SADB_EXT_ADDRESS_SRC:
8236 case SADB_EXT_ADDRESS_DST:
8237 case SADB_EXT_ADDRESS_PROXY:
8238 baselen = PFKEY_ALIGN8(sizeof(struct sadb_address));
8239 checktype = ADDR;
8240 break;
8241 case SADB_EXT_IDENTITY_SRC:
8242 case SADB_EXT_IDENTITY_DST:
8243 if (((const struct sadb_ident *)ext)->sadb_ident_type ==
8244 SADB_X_IDENTTYPE_ADDR) {
8245 baselen = PFKEY_ALIGN8(sizeof(struct sadb_ident));
8246 checktype = ADDR;
8247 } else
8248 checktype = NONE;
8249 break;
8250 default:
8251 checktype = NONE;
8252 break;
8253 }
8254
8255 switch (checktype) {
8256 case NONE:
8257 break;
8258 case ADDR:
8259 sa = (const struct sockaddr *)(((const u_int8_t*)ext)+baselen);
8260 if (len < baselen + sal)
8261 return EINVAL;
8262 if (baselen + PFKEY_ALIGN8(sa->sa_len) != len)
8263 return EINVAL;
8264 break;
8265 }
8266
8267 return 0;
8268 }
8269
8270 static int
key_do_init(void)8271 key_do_init(void)
8272 {
8273 int i, error;
8274
8275 mutex_init(&key_misc.lock, MUTEX_DEFAULT, IPL_NONE);
8276
8277 mutex_init(&key_spd.lock, MUTEX_DEFAULT, IPL_NONE);
8278 cv_init(&key_spd.cv_lc, "key_sp_lc");
8279 key_spd.psz = pserialize_create();
8280 cv_init(&key_spd.cv_psz, "key_sp_psz");
8281 key_spd.psz_performing = false;
8282
8283 mutex_init(&key_sad.lock, MUTEX_DEFAULT, IPL_NONE);
8284 cv_init(&key_sad.cv_lc, "key_sa_lc");
8285 key_sad.psz = pserialize_create();
8286 cv_init(&key_sad.cv_psz, "key_sa_psz");
8287 key_sad.psz_performing = false;
8288
8289 pfkeystat_percpu = percpu_alloc(sizeof(uint64_t) * PFKEY_NSTATS);
8290
8291 callout_init(&key_timehandler_ch, CALLOUT_MPSAFE);
8292 error = workqueue_create(&key_timehandler_wq, "key_timehandler",
8293 key_timehandler_work, NULL, PRI_SOFTNET, IPL_SOFTNET, WQ_MPSAFE);
8294 if (error != 0)
8295 panic("%s: workqueue_create failed (%d)\n", __func__, error);
8296
8297 for (i = 0; i < IPSEC_DIR_MAX; i++) {
8298 PSLIST_INIT(&key_spd.splist[i]);
8299 }
8300
8301 PSLIST_INIT(&key_spd.socksplist);
8302
8303 key_sad.sahlists = hashinit(SAHHASH_NHASH, HASH_PSLIST, true,
8304 &key_sad.sahlistmask);
8305 key_sad.savlut = hashinit(SAVLUT_NHASH, HASH_PSLIST, true,
8306 &key_sad.savlutmask);
8307
8308 for (i = 0; i <= SADB_SATYPE_MAX; i++) {
8309 LIST_INIT(&key_misc.reglist[i]);
8310 }
8311
8312 #ifndef IPSEC_NONBLOCK_ACQUIRE
8313 LIST_INIT(&key_misc.acqlist);
8314 #endif
8315 #ifdef notyet
8316 LIST_INIT(&key_misc.spacqlist);
8317 #endif
8318
8319 /* system default */
8320 ip4_def_policy.policy = IPSEC_POLICY_NONE;
8321 ip4_def_policy.state = IPSEC_SPSTATE_ALIVE;
8322 localcount_init(&ip4_def_policy.localcount);
8323
8324 #ifdef INET6
8325 ip6_def_policy.policy = IPSEC_POLICY_NONE;
8326 ip6_def_policy.state = IPSEC_SPSTATE_ALIVE;
8327 localcount_init(&ip6_def_policy.localcount);
8328 #endif
8329
8330 callout_reset(&key_timehandler_ch, hz, key_timehandler, NULL);
8331
8332 /* initialize key statistics */
8333 keystat.getspi_count = 1;
8334
8335 aprint_verbose("IPsec: Initialized Security Association Processing.\n");
8336
8337 return (0);
8338 }
8339
8340 void
key_init(void)8341 key_init(void)
8342 {
8343 static ONCE_DECL(key_init_once);
8344
8345 sysctl_net_keyv2_setup(NULL);
8346 sysctl_net_key_compat_setup(NULL);
8347
8348 RUN_ONCE(&key_init_once, key_do_init);
8349
8350 key_init_so();
8351 }
8352
8353 /*
8354 * XXX: maybe This function is called after INBOUND IPsec processing.
8355 *
8356 * Special check for tunnel-mode packets.
8357 * We must make some checks for consistency between inner and outer IP header.
8358 *
8359 * xxx more checks to be provided
8360 */
8361 int
key_checktunnelsanity(struct secasvar * sav,u_int family,void * src,void * dst)8362 key_checktunnelsanity(
8363 struct secasvar *sav,
8364 u_int family,
8365 void *src,
8366 void *dst
8367 )
8368 {
8369
8370 /* XXX: check inner IP header */
8371
8372 return 1;
8373 }
8374
8375 #if 0
8376 #define hostnamelen strlen(hostname)
8377
8378 /*
8379 * Get FQDN for the host.
8380 * If the administrator configured hostname (by hostname(1)) without
8381 * domain name, returns nothing.
8382 */
8383 static const char *
8384 key_getfqdn(void)
8385 {
8386 int i;
8387 int hasdot;
8388 static char fqdn[MAXHOSTNAMELEN + 1];
8389
8390 if (!hostnamelen)
8391 return NULL;
8392
8393 /* check if it comes with domain name. */
8394 hasdot = 0;
8395 for (i = 0; i < hostnamelen; i++) {
8396 if (hostname[i] == '.')
8397 hasdot++;
8398 }
8399 if (!hasdot)
8400 return NULL;
8401
8402 /* NOTE: hostname may not be NUL-terminated. */
8403 memset(fqdn, 0, sizeof(fqdn));
8404 memcpy(fqdn, hostname, hostnamelen);
8405 fqdn[hostnamelen] = '\0';
8406 return fqdn;
8407 }
8408
8409 /*
8410 * get username@FQDN for the host/user.
8411 */
8412 static const char *
8413 key_getuserfqdn(void)
8414 {
8415 const char *host;
8416 static char userfqdn[MAXHOSTNAMELEN + MAXLOGNAME + 2];
8417 struct proc *p = curproc;
8418 char *q;
8419
8420 if (!p || !p->p_pgrp || !p->p_pgrp->pg_session)
8421 return NULL;
8422 if (!(host = key_getfqdn()))
8423 return NULL;
8424
8425 /* NOTE: s_login may not be-NUL terminated. */
8426 memset(userfqdn, 0, sizeof(userfqdn));
8427 memcpy(userfqdn, Mp->p_pgrp->pg_session->s_login, AXLOGNAME);
8428 userfqdn[MAXLOGNAME] = '\0'; /* safeguard */
8429 q = userfqdn + strlen(userfqdn);
8430 *q++ = '@';
8431 memcpy(q, host, strlen(host));
8432 q += strlen(host);
8433 *q++ = '\0';
8434
8435 return userfqdn;
8436 }
8437 #endif
8438
8439 /* record data transfer on SA, and update timestamps */
8440 void
key_sa_recordxfer(struct secasvar * sav,struct mbuf * m)8441 key_sa_recordxfer(struct secasvar *sav, struct mbuf *m)
8442 {
8443 lifetime_counters_t *counters;
8444
8445 KASSERT(sav != NULL);
8446 KASSERT(sav->lft_c != NULL);
8447 KASSERT(m != NULL);
8448
8449 counters = percpu_getref(sav->lft_c_counters_percpu);
8450
8451 /*
8452 * XXX Currently, there is a difference of bytes size
8453 * between inbound and outbound processing.
8454 */
8455 (*counters)[LIFETIME_COUNTER_BYTES] += m->m_pkthdr.len;
8456 /* to check bytes lifetime is done in key_timehandler(). */
8457
8458 /*
8459 * We use the number of packets as the unit of
8460 * sadb_lifetime_allocations. We increment the variable
8461 * whenever {esp,ah}_{in,out}put is called.
8462 */
8463 (*counters)[LIFETIME_COUNTER_ALLOCATIONS]++;
8464 /* XXX check for expires? */
8465
8466 percpu_putref(sav->lft_c_counters_percpu);
8467
8468 /*
8469 * NOTE: We record CURRENT sadb_lifetime_usetime by using wall clock,
8470 * in seconds. HARD and SOFT lifetime are measured by the time
8471 * difference (again in seconds) from sadb_lifetime_usetime.
8472 *
8473 * usetime
8474 * v expire expire
8475 * -----+-----+--------+---> t
8476 * <--------------> HARD
8477 * <-----> SOFT
8478 */
8479 sav->lft_c->sadb_lifetime_usetime = time_uptime;
8480 /* XXX check for expires? */
8481
8482 return;
8483 }
8484
8485 /* dumb version */
8486 void
key_sa_routechange(struct sockaddr * dst)8487 key_sa_routechange(struct sockaddr *dst)
8488 {
8489 struct secashead *sah;
8490 int s;
8491
8492 s = pserialize_read_enter();
8493 SAHLIST_READER_FOREACH(sah) {
8494 struct route *ro;
8495 const struct sockaddr *sa;
8496
8497 key_sah_ref(sah);
8498 pserialize_read_exit(s);
8499
8500 ro = &sah->sa_route;
8501 sa = rtcache_getdst(ro);
8502 if (sa != NULL && dst->sa_len == sa->sa_len &&
8503 memcmp(dst, sa, dst->sa_len) == 0)
8504 rtcache_free(ro);
8505
8506 s = pserialize_read_enter();
8507 key_sah_unref(sah);
8508 }
8509 pserialize_read_exit(s);
8510
8511 return;
8512 }
8513
8514 static void
key_sa_chgstate(struct secasvar * sav,u_int8_t state)8515 key_sa_chgstate(struct secasvar *sav, u_int8_t state)
8516 {
8517 struct secasvar *_sav;
8518
8519 ASSERT_SLEEPABLE();
8520 KASSERT(mutex_owned(&key_sad.lock));
8521
8522 if (sav->state == state)
8523 return;
8524
8525 key_unlink_sav(sav);
8526 localcount_fini(&sav->localcount);
8527 SAVLIST_ENTRY_DESTROY(sav);
8528 key_init_sav(sav);
8529
8530 sav->state = state;
8531 if (!SADB_SASTATE_USABLE_P(sav)) {
8532 /* We don't need to care about the order */
8533 SAVLIST_WRITER_INSERT_HEAD(sav->sah, state, sav);
8534 return;
8535 }
8536 /*
8537 * Sort the list by lft_c->sadb_lifetime_addtime
8538 * in ascending order.
8539 */
8540 SAVLIST_WRITER_FOREACH(_sav, sav->sah, state) {
8541 if (_sav->lft_c->sadb_lifetime_addtime >
8542 sav->lft_c->sadb_lifetime_addtime) {
8543 SAVLIST_WRITER_INSERT_BEFORE(_sav, sav);
8544 break;
8545 }
8546 }
8547 if (_sav == NULL) {
8548 SAVLIST_WRITER_INSERT_TAIL(sav->sah, state, sav);
8549 }
8550
8551 SAVLUT_WRITER_INSERT_HEAD(sav);
8552
8553 key_validate_savlist(sav->sah, state);
8554 }
8555
8556 /* XXX too much? */
8557 static struct mbuf *
key_alloc_mbuf(int l,int mflag)8558 key_alloc_mbuf(int l, int mflag)
8559 {
8560 struct mbuf *m = NULL, *n;
8561 int len, t;
8562
8563 KASSERT(mflag == M_NOWAIT || (mflag == M_WAITOK && !cpu_softintr_p()));
8564
8565 len = l;
8566 while (len > 0) {
8567 MGET(n, mflag, MT_DATA);
8568 if (n && len > MLEN) {
8569 MCLGET(n, mflag);
8570 if ((n->m_flags & M_EXT) == 0) {
8571 m_freem(n);
8572 n = NULL;
8573 }
8574 }
8575 if (!n) {
8576 m_freem(m);
8577 return NULL;
8578 }
8579
8580 n->m_next = NULL;
8581 n->m_len = 0;
8582 n->m_len = M_TRAILINGSPACE(n);
8583 /* use the bottom of mbuf, hoping we can prepend afterwards */
8584 if (n->m_len > len) {
8585 t = (n->m_len - len) & ~(sizeof(long) - 1);
8586 n->m_data += t;
8587 n->m_len = len;
8588 }
8589
8590 len -= n->m_len;
8591
8592 if (m)
8593 m_cat(m, n);
8594 else
8595 m = n;
8596 }
8597
8598 return m;
8599 }
8600
8601 static struct mbuf *
key_setdump(u_int8_t req_satype,int * errorp,uint32_t pid)8602 key_setdump(u_int8_t req_satype, int *errorp, uint32_t pid)
8603 {
8604 struct secashead *sah;
8605 struct secasvar *sav;
8606 u_int16_t proto;
8607 u_int8_t satype;
8608 u_int8_t state;
8609 int cnt;
8610 struct mbuf *m, *n;
8611
8612 KASSERT(mutex_owned(&key_sad.lock));
8613
8614 /* map satype to proto */
8615 proto = key_satype2proto(req_satype);
8616 if (proto == 0) {
8617 *errorp = EINVAL;
8618 return (NULL);
8619 }
8620
8621 /* count sav entries to be sent to the userland. */
8622 cnt = 0;
8623 SAHLIST_WRITER_FOREACH(sah) {
8624 if (req_satype != SADB_SATYPE_UNSPEC &&
8625 proto != sah->saidx.proto)
8626 continue;
8627
8628 SASTATE_ANY_FOREACH(state) {
8629 SAVLIST_WRITER_FOREACH(sav, sah, state) {
8630 cnt++;
8631 }
8632 }
8633 }
8634
8635 if (cnt == 0) {
8636 *errorp = ENOENT;
8637 return (NULL);
8638 }
8639
8640 /* send this to the userland, one at a time. */
8641 m = NULL;
8642 SAHLIST_WRITER_FOREACH(sah) {
8643 if (req_satype != SADB_SATYPE_UNSPEC &&
8644 proto != sah->saidx.proto)
8645 continue;
8646
8647 /* map proto to satype */
8648 satype = key_proto2satype(sah->saidx.proto);
8649 if (satype == 0) {
8650 m_freem(m);
8651 *errorp = EINVAL;
8652 return (NULL);
8653 }
8654
8655 SASTATE_ANY_FOREACH(state) {
8656 SAVLIST_WRITER_FOREACH(sav, sah, state) {
8657 n = key_setdumpsa(sav, SADB_DUMP, satype,
8658 --cnt, pid);
8659 if (!m)
8660 m = n;
8661 else
8662 m_cat(m, n);
8663 }
8664 }
8665 }
8666
8667 if (!m) {
8668 *errorp = EINVAL;
8669 return (NULL);
8670 }
8671
8672 if ((m->m_flags & M_PKTHDR) != 0) {
8673 m->m_pkthdr.len = 0;
8674 for (n = m; n; n = n->m_next)
8675 m->m_pkthdr.len += n->m_len;
8676 }
8677
8678 *errorp = 0;
8679 return (m);
8680 }
8681
8682 static struct mbuf *
key_setspddump(int * errorp,pid_t pid)8683 key_setspddump(int *errorp, pid_t pid)
8684 {
8685 struct secpolicy *sp;
8686 int cnt;
8687 u_int dir;
8688 struct mbuf *m, *n;
8689
8690 KASSERT(mutex_owned(&key_spd.lock));
8691
8692 /* search SPD entry and get buffer size. */
8693 cnt = 0;
8694 for (dir = 0; dir < IPSEC_DIR_MAX; dir++) {
8695 SPLIST_WRITER_FOREACH(sp, dir) {
8696 cnt++;
8697 }
8698 }
8699
8700 if (cnt == 0) {
8701 *errorp = ENOENT;
8702 return (NULL);
8703 }
8704
8705 m = NULL;
8706 for (dir = 0; dir < IPSEC_DIR_MAX; dir++) {
8707 SPLIST_WRITER_FOREACH(sp, dir) {
8708 --cnt;
8709 n = key_setdumpsp(sp, SADB_X_SPDDUMP, cnt, pid);
8710
8711 if (!m)
8712 m = n;
8713 else {
8714 m->m_pkthdr.len += n->m_pkthdr.len;
8715 m_cat(m, n);
8716 }
8717 }
8718 }
8719
8720 *errorp = 0;
8721 return (m);
8722 }
8723
8724 int
key_get_used(void)8725 key_get_used(void) {
8726 return !SPLIST_READER_EMPTY(IPSEC_DIR_INBOUND) ||
8727 !SPLIST_READER_EMPTY(IPSEC_DIR_OUTBOUND) ||
8728 !SOCKSPLIST_READER_EMPTY();
8729 }
8730
8731 void
key_update_used(void)8732 key_update_used(void)
8733 {
8734 switch (ipsec_enabled) {
8735 default:
8736 case 0:
8737 #ifdef notyet
8738 /* XXX: racy */
8739 ipsec_used = 0;
8740 #endif
8741 break;
8742 case 1:
8743 #ifndef notyet
8744 /* XXX: racy */
8745 if (!ipsec_used)
8746 #endif
8747 ipsec_used = key_get_used();
8748 break;
8749 case 2:
8750 ipsec_used = 1;
8751 break;
8752 }
8753 }
8754
8755 static inline void
key_savlut_writer_insert_head(struct secasvar * sav)8756 key_savlut_writer_insert_head(struct secasvar *sav)
8757 {
8758 uint32_t hash_key;
8759 uint32_t hash;
8760
8761 KASSERT(mutex_owned(&key_sad.lock));
8762 KASSERT(!sav->savlut_added);
8763
8764 hash_key = sav->spi;
8765
8766 hash = key_savluthash(&sav->sah->saidx.dst.sa,
8767 sav->sah->saidx.proto, hash_key, key_sad.savlutmask);
8768
8769 PSLIST_WRITER_INSERT_HEAD(&key_sad.savlut[hash], sav,
8770 pslist_entry_savlut);
8771 sav->savlut_added = true;
8772 }
8773
8774 /*
8775 * Calculate hash using protocol, source address,
8776 * and destination address included in saidx.
8777 */
8778 static inline uint32_t
key_saidxhash(const struct secasindex * saidx,u_long mask)8779 key_saidxhash(const struct secasindex *saidx, u_long mask)
8780 {
8781 uint32_t hash32;
8782 const struct sockaddr_in *sin;
8783 const struct sockaddr_in6 *sin6;
8784
8785 hash32 = saidx->proto;
8786
8787 switch (saidx->src.sa.sa_family) {
8788 case AF_INET:
8789 sin = &saidx->src.sin;
8790 hash32 = hash32_buf(&sin->sin_addr,
8791 sizeof(sin->sin_addr), hash32);
8792 sin = &saidx->dst.sin;
8793 hash32 = hash32_buf(&sin->sin_addr,
8794 sizeof(sin->sin_addr), hash32 << 1);
8795 break;
8796 case AF_INET6:
8797 sin6 = &saidx->src.sin6;
8798 hash32 = hash32_buf(&sin6->sin6_addr,
8799 sizeof(sin6->sin6_addr), hash32);
8800 sin6 = &saidx->dst.sin6;
8801 hash32 = hash32_buf(&sin6->sin6_addr,
8802 sizeof(sin6->sin6_addr), hash32 << 1);
8803 break;
8804 default:
8805 hash32 = 0;
8806 break;
8807 }
8808
8809 return hash32 & mask;
8810 }
8811
8812 /*
8813 * Calculate hash using destination address, protocol,
8814 * and spi. Those parameter depend on the search of
8815 * key_lookup_sa().
8816 */
8817 static uint32_t
key_savluthash(const struct sockaddr * dst,uint32_t proto,uint32_t spi,u_long mask)8818 key_savluthash(const struct sockaddr *dst, uint32_t proto,
8819 uint32_t spi, u_long mask)
8820 {
8821 uint32_t hash32;
8822 const struct sockaddr_in *sin;
8823 const struct sockaddr_in6 *sin6;
8824
8825 hash32 = hash32_buf(&proto, sizeof(proto), spi);
8826
8827 switch(dst->sa_family) {
8828 case AF_INET:
8829 sin = satocsin(dst);
8830 hash32 = hash32_buf(&sin->sin_addr,
8831 sizeof(sin->sin_addr), hash32);
8832 break;
8833 case AF_INET6:
8834 sin6 = satocsin6(dst);
8835 hash32 = hash32_buf(&sin6->sin6_addr,
8836 sizeof(sin6->sin6_addr), hash32);
8837 break;
8838 default:
8839 hash32 = 0;
8840 }
8841
8842 return hash32 & mask;
8843 }
8844
8845 static int
sysctl_net_key_dumpsa(SYSCTLFN_ARGS)8846 sysctl_net_key_dumpsa(SYSCTLFN_ARGS)
8847 {
8848 struct mbuf *m, *n;
8849 int err2 = 0;
8850 char *p, *ep;
8851 size_t len;
8852 int error;
8853
8854 if (newp)
8855 return (EPERM);
8856 if (namelen != 1)
8857 return (EINVAL);
8858
8859 mutex_enter(&key_sad.lock);
8860 m = key_setdump(name[0], &error, l->l_proc->p_pid);
8861 mutex_exit(&key_sad.lock);
8862 if (!m)
8863 return (error);
8864 if (!oldp)
8865 *oldlenp = m->m_pkthdr.len;
8866 else {
8867 p = oldp;
8868 if (*oldlenp < m->m_pkthdr.len) {
8869 err2 = ENOMEM;
8870 ep = p + *oldlenp;
8871 } else {
8872 *oldlenp = m->m_pkthdr.len;
8873 ep = p + m->m_pkthdr.len;
8874 }
8875 for (n = m; n; n = n->m_next) {
8876 len = (ep - p < n->m_len) ?
8877 ep - p : n->m_len;
8878 error = copyout(mtod(n, const void *), p, len);
8879 p += len;
8880 if (error)
8881 break;
8882 }
8883 if (error == 0)
8884 error = err2;
8885 }
8886 m_freem(m);
8887
8888 return (error);
8889 }
8890
8891 static int
sysctl_net_key_dumpsp(SYSCTLFN_ARGS)8892 sysctl_net_key_dumpsp(SYSCTLFN_ARGS)
8893 {
8894 struct mbuf *m, *n;
8895 int err2 = 0;
8896 char *p, *ep;
8897 size_t len;
8898 int error;
8899
8900 if (newp)
8901 return (EPERM);
8902 if (namelen != 0)
8903 return (EINVAL);
8904
8905 mutex_enter(&key_spd.lock);
8906 m = key_setspddump(&error, l->l_proc->p_pid);
8907 mutex_exit(&key_spd.lock);
8908 if (!m)
8909 return (error);
8910 if (!oldp)
8911 *oldlenp = m->m_pkthdr.len;
8912 else {
8913 p = oldp;
8914 if (*oldlenp < m->m_pkthdr.len) {
8915 err2 = ENOMEM;
8916 ep = p + *oldlenp;
8917 } else {
8918 *oldlenp = m->m_pkthdr.len;
8919 ep = p + m->m_pkthdr.len;
8920 }
8921 for (n = m; n; n = n->m_next) {
8922 len = (ep - p < n->m_len) ? ep - p : n->m_len;
8923 error = copyout(mtod(n, const void *), p, len);
8924 p += len;
8925 if (error)
8926 break;
8927 }
8928 if (error == 0)
8929 error = err2;
8930 }
8931 m_freem(m);
8932
8933 return (error);
8934 }
8935
8936 /*
8937 * Create sysctl tree for native IPSEC key knobs, originally
8938 * under name "net.keyv2" * with MIB number { CTL_NET, PF_KEY_V2. }.
8939 * However, sysctl(8) never checked for nodes under { CTL_NET, PF_KEY_V2 };
8940 * and in any case the part of our sysctl namespace used for dumping the
8941 * SPD and SA database *HAS* to be compatible with the KAME sysctl
8942 * namespace, for API reasons.
8943 *
8944 * Pending a consensus on the right way to fix this, add a level of
8945 * indirection in how we number the `native' IPSEC key nodes;
8946 * and (as requested by Andrew Brown) move registration of the
8947 * KAME-compatible names to a separate function.
8948 */
8949 #if 0
8950 # define IPSEC_PFKEY PF_KEY_V2
8951 # define IPSEC_PFKEY_NAME "keyv2"
8952 #else
8953 # define IPSEC_PFKEY PF_KEY
8954 # define IPSEC_PFKEY_NAME "key"
8955 #endif
8956
8957 static int
sysctl_net_key_stats(SYSCTLFN_ARGS)8958 sysctl_net_key_stats(SYSCTLFN_ARGS)
8959 {
8960
8961 return (NETSTAT_SYSCTL(pfkeystat_percpu, PFKEY_NSTATS));
8962 }
8963
8964 static void
sysctl_net_keyv2_setup(struct sysctllog ** clog)8965 sysctl_net_keyv2_setup(struct sysctllog **clog)
8966 {
8967
8968 sysctl_createv(clog, 0, NULL, NULL,
8969 CTLFLAG_PERMANENT,
8970 CTLTYPE_NODE, IPSEC_PFKEY_NAME, NULL,
8971 NULL, 0, NULL, 0,
8972 CTL_NET, IPSEC_PFKEY, CTL_EOL);
8973
8974 sysctl_createv(clog, 0, NULL, NULL,
8975 CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
8976 CTLTYPE_INT, "debug", NULL,
8977 NULL, 0, &key_debug_level, 0,
8978 CTL_NET, IPSEC_PFKEY, KEYCTL_DEBUG_LEVEL, CTL_EOL);
8979 sysctl_createv(clog, 0, NULL, NULL,
8980 CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
8981 CTLTYPE_INT, "spi_try", NULL,
8982 NULL, 0, &key_spi_trycnt, 0,
8983 CTL_NET, IPSEC_PFKEY, KEYCTL_SPI_TRY, CTL_EOL);
8984 sysctl_createv(clog, 0, NULL, NULL,
8985 CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
8986 CTLTYPE_INT, "spi_min_value", NULL,
8987 NULL, 0, &key_spi_minval, 0,
8988 CTL_NET, IPSEC_PFKEY, KEYCTL_SPI_MIN_VALUE, CTL_EOL);
8989 sysctl_createv(clog, 0, NULL, NULL,
8990 CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
8991 CTLTYPE_INT, "spi_max_value", NULL,
8992 NULL, 0, &key_spi_maxval, 0,
8993 CTL_NET, IPSEC_PFKEY, KEYCTL_SPI_MAX_VALUE, CTL_EOL);
8994 sysctl_createv(clog, 0, NULL, NULL,
8995 CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
8996 CTLTYPE_INT, "random_int", NULL,
8997 NULL, 0, &key_int_random, 0,
8998 CTL_NET, IPSEC_PFKEY, KEYCTL_RANDOM_INT, CTL_EOL);
8999 sysctl_createv(clog, 0, NULL, NULL,
9000 CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
9001 CTLTYPE_INT, "larval_lifetime", NULL,
9002 NULL, 0, &key_larval_lifetime, 0,
9003 CTL_NET, IPSEC_PFKEY, KEYCTL_LARVAL_LIFETIME, CTL_EOL);
9004 sysctl_createv(clog, 0, NULL, NULL,
9005 CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
9006 CTLTYPE_INT, "blockacq_count", NULL,
9007 NULL, 0, &key_blockacq_count, 0,
9008 CTL_NET, IPSEC_PFKEY, KEYCTL_BLOCKACQ_COUNT, CTL_EOL);
9009 sysctl_createv(clog, 0, NULL, NULL,
9010 CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
9011 CTLTYPE_INT, "blockacq_lifetime", NULL,
9012 NULL, 0, &key_blockacq_lifetime, 0,
9013 CTL_NET, IPSEC_PFKEY, KEYCTL_BLOCKACQ_LIFETIME, CTL_EOL);
9014 sysctl_createv(clog, 0, NULL, NULL,
9015 CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
9016 CTLTYPE_INT, "esp_keymin", NULL,
9017 NULL, 0, &ipsec_esp_keymin, 0,
9018 CTL_NET, IPSEC_PFKEY, KEYCTL_ESP_KEYMIN, CTL_EOL);
9019 sysctl_createv(clog, 0, NULL, NULL,
9020 CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
9021 CTLTYPE_INT, "prefered_oldsa", NULL,
9022 NULL, 0, &key_prefered_oldsa, 0,
9023 CTL_NET, PF_KEY, KEYCTL_PREFERED_OLDSA, CTL_EOL);
9024 sysctl_createv(clog, 0, NULL, NULL,
9025 CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
9026 CTLTYPE_INT, "esp_auth", NULL,
9027 NULL, 0, &ipsec_esp_auth, 0,
9028 CTL_NET, IPSEC_PFKEY, KEYCTL_ESP_AUTH, CTL_EOL);
9029 sysctl_createv(clog, 0, NULL, NULL,
9030 CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
9031 CTLTYPE_INT, "ah_keymin", NULL,
9032 NULL, 0, &ipsec_ah_keymin, 0,
9033 CTL_NET, IPSEC_PFKEY, KEYCTL_AH_KEYMIN, CTL_EOL);
9034 sysctl_createv(clog, 0, NULL, NULL,
9035 CTLFLAG_PERMANENT,
9036 CTLTYPE_STRUCT, "stats",
9037 SYSCTL_DESCR("PF_KEY statistics"),
9038 sysctl_net_key_stats, 0, NULL, 0,
9039 CTL_NET, IPSEC_PFKEY, CTL_CREATE, CTL_EOL);
9040 sysctl_createv(clog, 0, NULL, NULL,
9041 CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
9042 CTLTYPE_BOOL, "allow_different_idtype", NULL,
9043 NULL, 0, &ipsec_allow_different_idtype, 0,
9044 CTL_NET, IPSEC_PFKEY, KEYCTL_ALLOW_DIFFERENT_IDTYPE, CTL_EOL);
9045 }
9046
9047 /*
9048 * Register sysctl names used by setkey(8). For historical reasons,
9049 * and to share a single API, these names appear under { CTL_NET, PF_KEY }
9050 * for both IPSEC and KAME IPSEC.
9051 */
9052 static void
sysctl_net_key_compat_setup(struct sysctllog ** clog)9053 sysctl_net_key_compat_setup(struct sysctllog **clog)
9054 {
9055
9056 sysctl_createv(clog, 0, NULL, NULL,
9057 CTLFLAG_PERMANENT,
9058 CTLTYPE_NODE, "key", NULL,
9059 NULL, 0, NULL, 0,
9060 CTL_NET, PF_KEY, CTL_EOL);
9061
9062 /* Register the net.key.dump{sa,sp} nodes used by setkey(8). */
9063 sysctl_createv(clog, 0, NULL, NULL,
9064 CTLFLAG_PERMANENT,
9065 CTLTYPE_STRUCT, "dumpsa", NULL,
9066 sysctl_net_key_dumpsa, 0, NULL, 0,
9067 CTL_NET, PF_KEY, KEYCTL_DUMPSA, CTL_EOL);
9068 sysctl_createv(clog, 0, NULL, NULL,
9069 CTLFLAG_PERMANENT,
9070 CTLTYPE_STRUCT, "dumpsp", NULL,
9071 sysctl_net_key_dumpsp, 0, NULL, 0,
9072 CTL_NET, PF_KEY, KEYCTL_DUMPSP, CTL_EOL);
9073 }
9074