This source file includes following definitions.
- pfdatatopacket
- pfkeyv2_create
- pfkeyv2_release
- pfkeyv2_sendmessage
- pfkeyv2_policy
- pfkeyv2_get
- pfkeyv2_dump_walker
- pfkeyv2_flush_walker
- pfkeyv2_get_proto_alg
- pfkeyv2_send
- pfkeyv2_acquire
- pfkeyv2_expire
- pfkeyv2_sysctl_walker
- pfkeyv2_dump_policy
- pfkeyv2_ipo_walk
- pfkeyv2_sysctl_policydumper
- pfkeyv2_sysctl
- pfkeyv2_init
- pfkeyv2_cleanup
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71 #include "pf.h"
72
73 #include <sys/types.h>
74 #include <sys/param.h>
75 #include <sys/socket.h>
76 #include <sys/systm.h>
77 #include <sys/mbuf.h>
78 #include <sys/kernel.h>
79 #include <sys/proc.h>
80 #include <net/route.h>
81 #include <netinet/ip_ipsp.h>
82 #include <net/pfkeyv2.h>
83 #include <netinet/ip_ah.h>
84 #include <netinet/ip_esp.h>
85 #include <netinet/ip_ipcomp.h>
86 #include <crypto/blf.h>
87
88 #if NPF > 0
89 #include <net/if.h>
90 #include <net/pfvar.h>
91 #endif
92
93 #define PFKEYV2_PROTOCOL 2
94 #define GETSPI_TRIES 10
95
96
97 static struct pfkeyv2_socket *pfkeyv2_sockets = NULL;
98 static struct pfkey_version pfkeyv2_version;
99 static uint32_t pfkeyv2_seq = 1;
100 static int nregistered = 0;
101 static int npromisc = 0;
102
103 static const struct sadb_alg ealgs[] = {
104 { SADB_EALG_NULL, 0, 0, 0 },
105 { SADB_EALG_DESCBC, 64, 64, 64 },
106 { SADB_EALG_3DESCBC, 64, 192, 192 },
107 { SADB_X_EALG_BLF, 64, 40, BLF_MAXKEYLEN * 8},
108 { SADB_X_EALG_CAST, 64, 40, 128},
109 { SADB_X_EALG_SKIPJACK, 64, 80, 80},
110 { SADB_X_EALG_AES, 128, 128, 256},
111 { SADB_X_EALG_AESCTR, 128, 128 + 32, 256 + 32}
112 };
113
114 static const struct sadb_alg aalgs[] = {
115 { SADB_AALG_SHA1HMAC, 0, 160, 160 },
116 { SADB_AALG_MD5HMAC, 0, 128, 128 },
117 { SADB_X_AALG_RIPEMD160HMAC, 0, 160, 160 },
118 { SADB_X_AALG_SHA2_256, 0, 256, 256 },
119 { SADB_X_AALG_SHA2_384, 0, 384, 384 },
120 { SADB_X_AALG_SHA2_512, 0, 512, 512 }
121 };
122
123 static const struct sadb_alg calgs[] = {
124 { SADB_X_CALG_DEFLATE, 0, 0, 0},
125 { SADB_X_CALG_LZS, 0, 0, 0}
126 };
127
128 extern uint64_t sadb_exts_allowed_out[SADB_MAX+1];
129 extern uint64_t sadb_exts_required_out[SADB_MAX+1];
130
131 extern struct pool ipsec_policy_pool;
132
133
134
135
136
137 int
138 pfdatatopacket(void *data, int len, struct mbuf **packet)
139 {
140 if (!(*packet = m_devget(data, len, 0, NULL, NULL)))
141 return (ENOMEM);
142 return (0);
143 }
144
145
146
147
148 int
149 pfkeyv2_create(struct socket *socket)
150 {
151 struct pfkeyv2_socket *pfkeyv2_socket;
152
153 if (!(pfkeyv2_socket = malloc(sizeof(struct pfkeyv2_socket),
154 M_PFKEY, M_DONTWAIT)))
155 return (ENOMEM);
156
157 bzero(pfkeyv2_socket, sizeof(struct pfkeyv2_socket));
158 pfkeyv2_socket->next = pfkeyv2_sockets;
159 pfkeyv2_socket->socket = socket;
160 pfkeyv2_socket->pid = curproc->p_pid;
161
162 pfkeyv2_sockets = pfkeyv2_socket;
163
164 return (0);
165 }
166
167
168
169
170 int
171 pfkeyv2_release(struct socket *socket)
172 {
173 struct pfkeyv2_socket **pp;
174
175 for (pp = &pfkeyv2_sockets; *pp && ((*pp)->socket != socket);
176 pp = &((*pp)->next))
177 ;
178
179 if (*pp) {
180 struct pfkeyv2_socket *pfkeyv2_socket;
181
182 pfkeyv2_socket = *pp;
183 *pp = (*pp)->next;
184
185 if (pfkeyv2_socket->flags & PFKEYV2_SOCKETFLAGS_REGISTERED)
186 nregistered--;
187
188 if (pfkeyv2_socket->flags & PFKEYV2_SOCKETFLAGS_PROMISC)
189 npromisc--;
190
191 free(pfkeyv2_socket, M_PFKEY);
192 }
193
194 return (0);
195 }
196
197
198
199
200
201
202 int
203 pfkeyv2_sendmessage(void **headers, int mode, struct socket *socket,
204 u_int8_t satype, int count)
205 {
206 int i, j, rval;
207 void *p, *buffer = NULL;
208 struct mbuf *packet;
209 struct pfkeyv2_socket *s;
210 struct sadb_msg *smsg;
211
212
213 j = sizeof(struct sadb_msg);
214
215 for (i = 1; i <= SADB_EXT_MAX; i++)
216 if (headers[i])
217 j += ((struct sadb_ext *)headers[i])->sadb_ext_len *
218 sizeof(uint64_t);
219
220
221 if (!(buffer = malloc(j + sizeof(struct sadb_msg), M_PFKEY,
222 M_DONTWAIT))) {
223 rval = ENOMEM;
224 goto ret;
225 }
226
227 p = buffer + sizeof(struct sadb_msg);
228 bcopy(headers[0], p, sizeof(struct sadb_msg));
229 ((struct sadb_msg *) p)->sadb_msg_len = j / sizeof(uint64_t);
230 p += sizeof(struct sadb_msg);
231
232
233 for (i = 1; i <= SADB_EXT_MAX; i++)
234 if (headers[i]) {
235 ((struct sadb_ext *) headers[i])->sadb_ext_type = i;
236 bcopy(headers[i], p, EXTLEN(headers[i]));
237 p += EXTLEN(headers[i]);
238 }
239
240 if ((rval = pfdatatopacket(buffer + sizeof(struct sadb_msg),
241 j, &packet)) != 0)
242 goto ret;
243
244 switch (mode) {
245 case PFKEYV2_SENDMESSAGE_UNICAST:
246
247
248
249
250 pfkey_sendup(socket, packet, 0);
251
252
253
254
255
256 bzero(buffer, sizeof(struct sadb_msg));
257 smsg = (struct sadb_msg *) buffer;
258 smsg->sadb_msg_version = PF_KEY_V2;
259 smsg->sadb_msg_type = SADB_X_PROMISC;
260 smsg->sadb_msg_len = (sizeof(struct sadb_msg) + j) /
261 sizeof(uint64_t);
262 smsg->sadb_msg_seq = 0;
263
264
265 if ((rval = pfdatatopacket(buffer, sizeof(struct sadb_msg) + j,
266 &packet)) != 0)
267 goto ret;
268
269
270
271
272
273 for (s = pfkeyv2_sockets; s; s = s->next)
274 if ((s->flags & PFKEYV2_SOCKETFLAGS_PROMISC) &&
275 (s->socket != socket))
276 pfkey_sendup(s->socket, packet, 1);
277
278
279 m_zero(packet);
280 m_freem(packet);
281 break;
282
283 case PFKEYV2_SENDMESSAGE_REGISTERED:
284
285
286
287
288 for (s = pfkeyv2_sockets; s; s = s->next)
289 if (s->flags & PFKEYV2_SOCKETFLAGS_REGISTERED) {
290 if (!satype)
291 pfkey_sendup(s->socket, packet, 1);
292 else {
293
294 if ((1 << satype) & s->registration)
295 pfkey_sendup(s->socket, packet, 1);
296 }
297 }
298
299
300 m_freem(packet);
301
302
303 bzero(buffer, sizeof(struct sadb_msg));
304 smsg = (struct sadb_msg *) buffer;
305 smsg->sadb_msg_version = PF_KEY_V2;
306 smsg->sadb_msg_type = SADB_X_PROMISC;
307 smsg->sadb_msg_len = (sizeof(struct sadb_msg) + j) /
308 sizeof(uint64_t);
309 smsg->sadb_msg_seq = 0;
310
311
312 if ((rval = pfdatatopacket(buffer, sizeof(struct sadb_msg) + j,
313 &packet)) != 0)
314 goto ret;
315
316
317 for (s = pfkeyv2_sockets; s; s = s->next)
318 if ((s->flags & PFKEYV2_SOCKETFLAGS_PROMISC) &&
319 !(s->flags & PFKEYV2_SOCKETFLAGS_REGISTERED))
320 pfkey_sendup(s->socket, packet, 1);
321
322 m_freem(packet);
323 break;
324
325 case PFKEYV2_SENDMESSAGE_BROADCAST:
326
327 for (s = pfkeyv2_sockets; s; s = s->next)
328 pfkey_sendup(s->socket, packet, 1);
329
330 m_freem(packet);
331 break;
332 }
333
334 ret:
335 if (buffer != NULL) {
336 bzero(buffer, j + sizeof(struct sadb_msg));
337 free(buffer, M_PFKEY);
338 }
339
340 return (rval);
341 }
342
343
344
345
346
347
348 int
349 pfkeyv2_policy(struct ipsec_acquire *ipa, void **headers, void **buffer)
350 {
351 union sockaddr_union sunion;
352 struct sadb_protocol *sp;
353 int rval, i, dir;
354 void *p;
355
356
357 i = 4 * sizeof(struct sadb_address) + sizeof(struct sadb_protocol);
358 bzero(&sunion, sizeof(union sockaddr_union));
359
360 switch (ipa->ipa_info.sen_type) {
361 #ifdef INET
362 case SENT_IP4:
363 i += 4 * PADUP(sizeof(struct sockaddr_in));
364 sunion.sa.sa_family = AF_INET;
365 sunion.sa.sa_len = sizeof(struct sockaddr_in);
366 dir = ipa->ipa_info.sen_direction;
367 break;
368 #endif
369
370 #ifdef INET6
371 case SENT_IP6:
372 i += 4 * PADUP(sizeof(struct sockaddr_in6));
373 sunion.sa.sa_family = AF_INET6;
374 sunion.sa.sa_len = sizeof(struct sockaddr_in6);
375 dir = ipa->ipa_info.sen_ip6_direction;
376 break;
377 #endif
378
379 default:
380 return (EINVAL);
381 }
382
383 if (!(p = malloc(i, M_PFKEY, M_DONTWAIT))) {
384 rval = ENOMEM;
385 goto ret;
386 } else {
387 *buffer = p;
388 bzero(p, i);
389 }
390
391 if (dir == IPSP_DIRECTION_OUT)
392 headers[SADB_X_EXT_SRC_FLOW] = p;
393 else
394 headers[SADB_X_EXT_DST_FLOW] = p;
395 switch (sunion.sa.sa_family) {
396 #ifdef INET
397 case AF_INET:
398 sunion.sin.sin_addr = ipa->ipa_info.sen_ip_src;
399 sunion.sin.sin_port = ipa->ipa_info.sen_sport;
400 break;
401 #endif
402
403 #ifdef INET6
404 case AF_INET6:
405 sunion.sin6.sin6_addr = ipa->ipa_info.sen_ip6_src;
406 sunion.sin6.sin6_port = ipa->ipa_info.sen_ip6_sport;
407 break;
408 #endif
409 }
410 export_address(&p, (struct sockaddr *) &sunion);
411
412 if (dir == IPSP_DIRECTION_OUT)
413 headers[SADB_X_EXT_SRC_MASK] = p;
414 else
415 headers[SADB_X_EXT_DST_MASK] = p;
416 switch (sunion.sa.sa_family) {
417 #ifdef INET
418 case AF_INET:
419 sunion.sin.sin_addr = ipa->ipa_mask.sen_ip_src;
420 sunion.sin.sin_port = ipa->ipa_mask.sen_sport;
421 break;
422 #endif
423
424 #ifdef INET6
425 case AF_INET6:
426 sunion.sin6.sin6_addr = ipa->ipa_mask.sen_ip6_src;
427 sunion.sin6.sin6_port = ipa->ipa_mask.sen_ip6_sport;
428 break;
429 #endif
430 }
431 export_address(&p, (struct sockaddr *) &sunion);
432
433 if (dir == IPSP_DIRECTION_OUT)
434 headers[SADB_X_EXT_DST_FLOW] = p;
435 else
436 headers[SADB_X_EXT_SRC_FLOW] = p;
437 switch (sunion.sa.sa_family) {
438 #ifdef INET
439 case AF_INET:
440 sunion.sin.sin_addr = ipa->ipa_info.sen_ip_dst;
441 sunion.sin.sin_port = ipa->ipa_info.sen_dport;
442 break;
443 #endif
444
445 #ifdef INET6
446 case AF_INET6:
447 sunion.sin6.sin6_addr = ipa->ipa_info.sen_ip6_dst;
448 sunion.sin6.sin6_port = ipa->ipa_info.sen_ip6_dport;
449 break;
450 #endif
451 }
452 export_address(&p, (struct sockaddr *) &sunion);
453
454 if (dir == IPSP_DIRECTION_OUT)
455 headers[SADB_X_EXT_DST_MASK] = p;
456 else
457 headers[SADB_X_EXT_SRC_MASK] = p;
458 switch (sunion.sa.sa_family) {
459 #ifdef INET
460 case AF_INET:
461 sunion.sin.sin_addr = ipa->ipa_mask.sen_ip_dst;
462 sunion.sin.sin_port = ipa->ipa_mask.sen_dport;
463 break;
464 #endif
465
466 #ifdef INET6
467 case AF_INET6:
468 sunion.sin6.sin6_addr = ipa->ipa_mask.sen_ip6_dst;
469 sunion.sin6.sin6_port = ipa->ipa_mask.sen_ip6_dport;
470 break;
471 #endif
472 }
473 export_address(&p, (struct sockaddr *) &sunion);
474
475 headers[SADB_X_EXT_FLOW_TYPE] = p;
476 sp = p;
477 sp->sadb_protocol_len = sizeof(struct sadb_protocol) /
478 sizeof(u_int64_t);
479 switch (sunion.sa.sa_family) {
480 #ifdef INET
481 case AF_INET:
482 if (ipa->ipa_mask.sen_proto)
483 sp->sadb_protocol_proto = ipa->ipa_info.sen_proto;
484 sp->sadb_protocol_direction = ipa->ipa_info.sen_direction;
485 break;
486 #endif
487
488 #ifdef INET6
489 case AF_INET6:
490 if (ipa->ipa_mask.sen_ip6_proto)
491 sp->sadb_protocol_proto = ipa->ipa_info.sen_ip6_proto;
492 sp->sadb_protocol_direction = ipa->ipa_info.sen_ip6_direction;
493 break;
494 #endif
495 }
496
497 rval = 0;
498
499 ret:
500 return (rval);
501 }
502
503
504
505
506 int
507 pfkeyv2_get(struct tdb *sa, void **headers, void **buffer, int *lenp)
508 {
509 int rval, i;
510 void *p;
511
512
513 i = sizeof(struct sadb_sa) + sizeof(struct sadb_lifetime);
514
515 if (sa->tdb_soft_allocations || sa->tdb_soft_bytes ||
516 sa->tdb_soft_timeout || sa->tdb_soft_first_use)
517 i += sizeof(struct sadb_lifetime);
518
519 if (sa->tdb_exp_allocations || sa->tdb_exp_bytes ||
520 sa->tdb_exp_timeout || sa->tdb_exp_first_use)
521 i += sizeof(struct sadb_lifetime);
522
523 if (sa->tdb_last_used)
524 i += sizeof(struct sadb_lifetime);
525
526 if (sa->tdb_src.sa.sa_family)
527 i += sizeof(struct sadb_address) + PADUP(SA_LEN(&sa->tdb_src.sa));
528
529 if (sa->tdb_dst.sa.sa_family)
530 i += sizeof(struct sadb_address) + PADUP(SA_LEN(&sa->tdb_dst.sa));
531
532 if (sa->tdb_proxy.sa.sa_family)
533 i += sizeof(struct sadb_address) + PADUP(SA_LEN(&sa->tdb_proxy.sa));
534
535 if (sa->tdb_srcid)
536 i += PADUP(sa->tdb_srcid->ref_len) + sizeof(struct sadb_ident);
537
538 if (sa->tdb_dstid)
539 i += PADUP(sa->tdb_dstid->ref_len) + sizeof(struct sadb_ident);
540
541 if (sa->tdb_local_cred)
542 i += PADUP(sa->tdb_local_cred->ref_len) + sizeof(struct sadb_x_cred);
543
544 if (sa->tdb_remote_cred)
545 i += PADUP(sa->tdb_remote_cred->ref_len) + sizeof(struct sadb_x_cred);
546
547 if (sa->tdb_local_auth)
548 i += PADUP(sa->tdb_local_auth->ref_len) + sizeof(struct sadb_x_cred);
549
550 if (sa->tdb_remote_auth)
551 i += PADUP(sa->tdb_remote_auth->ref_len) + sizeof(struct sadb_x_cred);
552
553 if (sa->tdb_amxkey)
554 i+= PADUP(sa->tdb_amxkeylen) + sizeof(struct sadb_key);
555
556 if (sa->tdb_emxkey)
557 i+= PADUP(sa->tdb_emxkeylen) + sizeof(struct sadb_key);
558
559 if (sa->tdb_filter.sen_type) {
560 i += 2 * sizeof(struct sadb_protocol);
561
562
563 switch (sa->tdb_filter.sen_type) {
564 #ifdef INET
565 case SENT_IP4:
566 i += 4 * PADUP(sizeof(struct sockaddr_in));
567 i += 4 * sizeof(struct sadb_address);
568 break;
569 #endif
570 #ifdef INET6
571 case SENT_IP6:
572 i += 4 * PADUP(sizeof(struct sockaddr_in6));
573 i += 4 * sizeof(struct sadb_address);
574 break;
575 #endif
576 default:
577 rval = EINVAL;
578 goto ret;
579 }
580 }
581
582 if (sa->tdb_udpencap_port)
583 i+= sizeof(struct sadb_x_udpencap);
584
585 #if NPF > 0
586 if (sa->tdb_tag)
587 i+= PADUP(PF_TAG_NAME_SIZE) + sizeof(struct sadb_x_tag);
588 #endif
589
590 if (lenp)
591 *lenp = i;
592
593 if (buffer == NULL) {
594 rval = 0;
595 goto ret;
596 }
597
598 if (!(p = malloc(i, M_PFKEY, M_DONTWAIT))) {
599 rval = ENOMEM;
600 goto ret;
601 } else {
602 *buffer = p;
603 bzero(p, i);
604 }
605
606 headers[SADB_EXT_SA] = p;
607
608 export_sa(&p, sa);
609
610
611 headers[SADB_EXT_LIFETIME_CURRENT] = p;
612 export_lifetime(&p, sa, PFKEYV2_LIFETIME_CURRENT);
613
614 if (sa->tdb_soft_allocations || sa->tdb_soft_bytes ||
615 sa->tdb_soft_first_use || sa->tdb_soft_timeout) {
616 headers[SADB_EXT_LIFETIME_SOFT] = p;
617 export_lifetime(&p, sa, PFKEYV2_LIFETIME_SOFT);
618 }
619
620 if (sa->tdb_exp_allocations || sa->tdb_exp_bytes ||
621 sa->tdb_exp_first_use || sa->tdb_exp_timeout) {
622 headers[SADB_EXT_LIFETIME_HARD] = p;
623 export_lifetime(&p, sa, PFKEYV2_LIFETIME_HARD);
624 }
625
626 if (sa->tdb_last_used) {
627 headers[SADB_X_EXT_LIFETIME_LASTUSE] = p;
628 export_lifetime(&p, sa, PFKEYV2_LIFETIME_LASTUSE);
629 }
630
631
632 headers[SADB_EXT_ADDRESS_SRC] = p;
633 export_address(&p, (struct sockaddr *) &sa->tdb_src);
634
635
636 headers[SADB_EXT_ADDRESS_DST] = p;
637 export_address(&p, (struct sockaddr *) &sa->tdb_dst);
638
639
640 if (SA_LEN(&sa->tdb_proxy.sa)) {
641 headers[SADB_EXT_ADDRESS_PROXY] = p;
642 export_address(&p, (struct sockaddr *) &sa->tdb_proxy);
643 }
644
645
646 if (sa->tdb_srcid) {
647 headers[SADB_EXT_IDENTITY_SRC] = p;
648 export_identity(&p, sa, PFKEYV2_IDENTITY_SRC);
649 }
650
651
652 if (sa->tdb_dstid) {
653 headers[SADB_EXT_IDENTITY_DST] = p;
654 export_identity(&p, sa, PFKEYV2_IDENTITY_DST);
655 }
656
657
658 if (sa->tdb_local_cred) {
659 headers[SADB_X_EXT_LOCAL_CREDENTIALS] = p;
660 export_credentials(&p, sa, PFKEYV2_CRED_LOCAL);
661 }
662
663 if (sa->tdb_remote_cred) {
664 headers[SADB_X_EXT_REMOTE_CREDENTIALS] = p;
665 export_credentials(&p, sa, PFKEYV2_CRED_REMOTE);
666 }
667
668
669 if (sa->tdb_local_auth) {
670 headers[SADB_X_EXT_LOCAL_AUTH] = p;
671 export_auth(&p, sa, PFKEYV2_AUTH_LOCAL);
672 }
673
674 if (sa->tdb_remote_auth) {
675 headers[SADB_X_EXT_REMOTE_AUTH] = p;
676 export_auth(&p, sa, PFKEYV2_AUTH_REMOTE);
677 }
678
679
680 if (sa->tdb_amxkey) {
681 headers[SADB_EXT_KEY_AUTH] = p;
682 export_key(&p, sa, PFKEYV2_AUTHENTICATION_KEY);
683 }
684
685
686 if (sa->tdb_emxkey) {
687 headers[SADB_EXT_KEY_ENCRYPT] = p;
688 export_key(&p, sa, PFKEYV2_ENCRYPTION_KEY);
689 }
690
691
692 if (sa->tdb_filter.sen_type)
693 export_flow(&p, IPSP_IPSEC_USE, &sa->tdb_filter,
694 &sa->tdb_filtermask, headers);
695
696
697 if (sa->tdb_udpencap_port) {
698 headers[SADB_X_EXT_UDPENCAP] = p;
699 export_udpencap(&p, sa);
700 }
701
702 #if NPF > 0
703
704 if (sa->tdb_tag) {
705 headers[SADB_X_EXT_TAG] = p;
706 export_tag(&p, sa);
707 }
708 #endif
709
710 rval = 0;
711
712 ret:
713 return (rval);
714 }
715
716
717
718
719 int
720 pfkeyv2_dump_walker(struct tdb *sa, void *state, int last)
721 {
722 struct dump_state *dump_state = (struct dump_state *) state;
723 void *headers[SADB_EXT_MAX+1], *buffer;
724 int rval;
725
726
727 if (!dump_state->sadb_msg->sadb_msg_satype ||
728 (sa->tdb_satype == dump_state->sadb_msg->sadb_msg_satype)) {
729 bzero(headers, sizeof(headers));
730 headers[0] = (void *) dump_state->sadb_msg;
731
732
733 if ((rval = pfkeyv2_get(sa, headers, &buffer, NULL)) != 0)
734 return (rval);
735
736 if (last)
737 ((struct sadb_msg *)headers[0])->sadb_msg_seq = 0;
738
739
740 rval = pfkeyv2_sendmessage(headers,
741 PFKEYV2_SENDMESSAGE_UNICAST, dump_state->socket, 0, 0);
742
743 free(buffer, M_PFKEY);
744 if (rval)
745 return (rval);
746 }
747
748 return (0);
749 }
750
751
752
753
754 int
755 pfkeyv2_flush_walker(struct tdb *sa, void *satype_vp, int last)
756 {
757 if (!(*((u_int8_t *) satype_vp)) ||
758 sa->tdb_satype == *((u_int8_t *) satype_vp))
759 tdb_delete(sa);
760 return (0);
761 }
762
763
764
765
766
767
768 int
769 pfkeyv2_get_proto_alg(u_int8_t satype, u_int8_t *sproto, int *alg)
770 {
771 switch (satype) {
772 #ifdef IPSEC
773 case SADB_SATYPE_AH:
774 if (!ah_enable)
775 return (EOPNOTSUPP);
776
777 *sproto = IPPROTO_AH;
778
779 if(alg != NULL)
780 *alg = satype = XF_AH;
781
782 break;
783
784 case SADB_SATYPE_ESP:
785 if (!esp_enable)
786 return (EOPNOTSUPP);
787
788 *sproto = IPPROTO_ESP;
789
790 if(alg != NULL)
791 *alg = satype = XF_ESP;
792
793 break;
794
795 case SADB_X_SATYPE_IPIP:
796 *sproto = IPPROTO_IPIP;
797
798 if (alg != NULL)
799 *alg = XF_IP4;
800
801 break;
802
803 case SADB_X_SATYPE_IPCOMP:
804 if (!ipcomp_enable)
805 return (EOPNOTSUPP);
806
807 *sproto = IPPROTO_IPCOMP;
808
809 if(alg != NULL)
810 *alg = satype = XF_IPCOMP;
811
812 break;
813 #endif
814 #ifdef TCP_SIGNATURE
815 case SADB_X_SATYPE_TCPSIGNATURE:
816 *sproto = IPPROTO_TCP;
817
818 if (alg != NULL)
819 *alg = XF_TCPSIGNATURE;
820
821 break;
822 #endif
823
824 default:
825 return (EOPNOTSUPP);
826 }
827
828 return (0);
829 }
830
831
832
833
834 int
835 pfkeyv2_send(struct socket *socket, void *message, int len)
836 {
837 int i, j, rval = 0, mode = PFKEYV2_SENDMESSAGE_BROADCAST;
838 int delflag = 0, s;
839 struct sockaddr_encap encapdst, encapnetmask, encapgw;
840 struct ipsec_policy *ipo, *tmpipo;
841 struct ipsec_acquire *ipa;
842
843 struct pfkeyv2_socket *pfkeyv2_socket, *so = NULL;
844
845 void *freeme = NULL, *bckptr = NULL;
846 void *headers[SADB_EXT_MAX + 1];
847
848 union sockaddr_union *sunionp;
849
850 struct tdb sa, *sa2 = NULL;
851
852 struct sadb_msg *smsg;
853 struct sadb_spirange *sprng;
854 struct sadb_sa *ssa;
855 struct sadb_supported *ssup;
856 struct sadb_ident *sid;
857
858
859 bzero(headers, sizeof(headers));
860
861 for (pfkeyv2_socket = pfkeyv2_sockets; pfkeyv2_socket;
862 pfkeyv2_socket = pfkeyv2_socket->next)
863 if (pfkeyv2_socket->socket == socket)
864 break;
865
866 if (!pfkeyv2_socket) {
867 rval = EINVAL;
868 goto ret;
869 }
870
871
872 if (npromisc) {
873 struct mbuf *packet;
874
875 if (!(freeme = malloc(sizeof(struct sadb_msg) + len, M_PFKEY,
876 M_DONTWAIT))) {
877 rval = ENOMEM;
878 goto ret;
879 }
880
881
882 bzero(freeme, sizeof(struct sadb_msg));
883 smsg = (struct sadb_msg *) freeme;
884 smsg->sadb_msg_version = PF_KEY_V2;
885 smsg->sadb_msg_type = SADB_X_PROMISC;
886 smsg->sadb_msg_len = (sizeof(struct sadb_msg) + len) /
887 sizeof(uint64_t);
888 smsg->sadb_msg_seq = curproc->p_pid;
889
890 bcopy(message, freeme + sizeof(struct sadb_msg), len);
891
892
893 if ((rval = pfdatatopacket(freeme,
894 sizeof(struct sadb_msg) + len, &packet)) != 0)
895 goto ret;
896
897
898 for (so = pfkeyv2_sockets; so; so = so->next)
899 if (so->flags & PFKEYV2_SOCKETFLAGS_PROMISC)
900 pfkey_sendup(so->socket, packet, 1);
901
902
903 m_zero(packet);
904 m_freem(packet);
905
906
907 bzero(freeme, sizeof(struct sadb_msg) + len);
908 free(freeme, M_PFKEY);
909 freeme = NULL;
910 }
911
912
913 if ((rval = pfkeyv2_parsemessage(message, len, headers)) != 0)
914 goto ret;
915
916 smsg = (struct sadb_msg *) headers[0];
917 switch (smsg->sadb_msg_type) {
918 case SADB_GETSPI:
919 bzero(&sa, sizeof(struct tdb));
920
921 sa.tdb_satype = smsg->sadb_msg_satype;
922 if ((rval = pfkeyv2_get_proto_alg(sa.tdb_satype,
923 &sa.tdb_sproto, 0)))
924 goto ret;
925
926 import_address((struct sockaddr *) &sa.tdb_src,
927 headers[SADB_EXT_ADDRESS_SRC]);
928 import_address((struct sockaddr *) &sa.tdb_dst,
929 headers[SADB_EXT_ADDRESS_DST]);
930
931
932 sprng = (struct sadb_spirange *) headers[SADB_EXT_SPIRANGE];
933 sa.tdb_spi = reserve_spi(sprng->sadb_spirange_min,
934 sprng->sadb_spirange_max, &sa.tdb_src, &sa.tdb_dst,
935 sa.tdb_sproto, &rval);
936 if (sa.tdb_spi == 0)
937 goto ret;
938
939
940 if (!(freeme = malloc(sizeof(struct sadb_sa), M_PFKEY,
941 M_DONTWAIT))) {
942 rval = ENOMEM;
943 goto ret;
944 }
945
946 bzero(freeme, sizeof(struct sadb_sa));
947 headers[SADB_EXT_SPIRANGE] = NULL;
948 headers[SADB_EXT_SA] = freeme;
949 bckptr = freeme;
950
951
952 export_sa((void **) &bckptr, &sa);
953 break;
954
955 case SADB_UPDATE:
956 ssa = (struct sadb_sa *) headers[SADB_EXT_SA];
957 sunionp = (union sockaddr_union *) (headers[SADB_EXT_ADDRESS_DST] +
958 sizeof(struct sadb_address));
959
960
961 if ((headers[SADB_X_EXT_SRC_FLOW] ||
962 headers[SADB_X_EXT_PROTOCOL] ||
963 headers[SADB_X_EXT_FLOW_TYPE] ||
964 headers[SADB_X_EXT_DST_FLOW] ||
965 headers[SADB_X_EXT_SRC_MASK] ||
966 headers[SADB_X_EXT_DST_MASK]) &&
967 !(headers[SADB_X_EXT_SRC_FLOW] &&
968 headers[SADB_X_EXT_PROTOCOL] &&
969 headers[SADB_X_EXT_FLOW_TYPE] &&
970 headers[SADB_X_EXT_DST_FLOW] &&
971 headers[SADB_X_EXT_SRC_MASK] &&
972 headers[SADB_X_EXT_DST_MASK])) {
973 rval = EINVAL;
974 goto ret;
975 }
976 #ifdef IPSEC
977
978 if (headers[SADB_X_EXT_UDPENCAP] &&
979 (!udpencap_enable ||
980 smsg->sadb_msg_satype != SADB_SATYPE_ESP)) {
981 rval = EINVAL;
982 goto ret;
983 }
984 #endif
985
986 s = spltdb();
987
988
989 sa2 = gettdb(ssa->sadb_sa_spi, sunionp,
990 SADB_X_GETSPROTO(smsg->sadb_msg_satype));
991
992
993 if (sa2 == NULL) {
994 rval = ESRCH;
995 goto splxret;
996 }
997
998
999 if (sa2->tdb_flags & TDBF_INVALID) {
1000 struct tdb *newsa;
1001 struct ipsecinit ii;
1002 int alg;
1003
1004
1005 freeme = tdb_alloc();
1006 bzero(&ii, sizeof(struct ipsecinit));
1007
1008 newsa = (struct tdb *) freeme;
1009 newsa->tdb_satype = smsg->sadb_msg_satype;
1010
1011 if ((rval = pfkeyv2_get_proto_alg(newsa->tdb_satype,
1012 &newsa->tdb_sproto, &alg))) {
1013 tdb_free(freeme);
1014 freeme = NULL;
1015 goto splxret;
1016 }
1017
1018
1019 import_sa(newsa, headers[SADB_EXT_SA], &ii);
1020 import_address((struct sockaddr *) &newsa->tdb_src,
1021 headers[SADB_EXT_ADDRESS_SRC]);
1022 import_address((struct sockaddr *) &newsa->tdb_dst,
1023 headers[SADB_EXT_ADDRESS_DST]);
1024 import_address((struct sockaddr *) &newsa->tdb_proxy,
1025 headers[SADB_EXT_ADDRESS_PROXY]);
1026 import_lifetime(newsa,
1027 headers[SADB_EXT_LIFETIME_CURRENT],
1028 PFKEYV2_LIFETIME_CURRENT);
1029 import_lifetime(newsa, headers[SADB_EXT_LIFETIME_SOFT],
1030 PFKEYV2_LIFETIME_SOFT);
1031 import_lifetime(newsa, headers[SADB_EXT_LIFETIME_HARD],
1032 PFKEYV2_LIFETIME_HARD);
1033 import_key(&ii, headers[SADB_EXT_KEY_AUTH],
1034 PFKEYV2_AUTHENTICATION_KEY);
1035 import_key(&ii, headers[SADB_EXT_KEY_ENCRYPT],
1036 PFKEYV2_ENCRYPTION_KEY);
1037 import_identity(newsa, headers[SADB_EXT_IDENTITY_SRC],
1038 PFKEYV2_IDENTITY_SRC);
1039 import_identity(newsa, headers[SADB_EXT_IDENTITY_DST],
1040 PFKEYV2_IDENTITY_DST);
1041 import_credentials(newsa,
1042 headers[SADB_X_EXT_LOCAL_CREDENTIALS],
1043 PFKEYV2_CRED_LOCAL);
1044 import_credentials(newsa,
1045 headers[SADB_X_EXT_REMOTE_CREDENTIALS],
1046 PFKEYV2_CRED_REMOTE);
1047 import_auth(newsa, headers[SADB_X_EXT_LOCAL_AUTH],
1048 PFKEYV2_AUTH_LOCAL);
1049 import_auth(newsa, headers[SADB_X_EXT_REMOTE_AUTH],
1050 PFKEYV2_AUTH_REMOTE);
1051 import_flow(&newsa->tdb_filter, &newsa->tdb_filtermask,
1052 headers[SADB_X_EXT_SRC_FLOW],
1053 headers[SADB_X_EXT_SRC_MASK],
1054 headers[SADB_X_EXT_DST_FLOW],
1055 headers[SADB_X_EXT_DST_MASK],
1056 headers[SADB_X_EXT_PROTOCOL],
1057 headers[SADB_X_EXT_FLOW_TYPE]);
1058 import_udpencap(newsa, headers[SADB_X_EXT_UDPENCAP]);
1059 #if NPF > 0
1060 import_tag(newsa, headers[SADB_X_EXT_TAG]);
1061 #endif
1062
1063 headers[SADB_EXT_KEY_AUTH] = NULL;
1064 headers[SADB_EXT_KEY_ENCRYPT] = NULL;
1065 headers[SADB_X_EXT_LOCAL_AUTH] = NULL;
1066
1067 newsa->tdb_seq = smsg->sadb_msg_seq;
1068
1069 rval = tdb_init(newsa, alg, &ii);
1070 if (rval) {
1071 rval = EINVAL;
1072 tdb_free(freeme);
1073 freeme = NULL;
1074 goto splxret;
1075 }
1076
1077 newsa->tdb_cur_allocations = sa2->tdb_cur_allocations;
1078
1079
1080 tdb_delete(sa2);
1081 puttdb((struct tdb *) freeme);
1082 sa2 = freeme = NULL;
1083 } else {
1084
1085
1086
1087
1088
1089 if (headers[SADB_EXT_ADDRESS_PROXY] ||
1090 headers[SADB_EXT_KEY_AUTH] ||
1091 headers[SADB_EXT_KEY_ENCRYPT] ||
1092 headers[SADB_EXT_IDENTITY_SRC] ||
1093 headers[SADB_EXT_IDENTITY_DST] ||
1094 headers[SADB_EXT_SENSITIVITY]) {
1095 rval = EINVAL;
1096 goto splxret;
1097 }
1098
1099 import_sa(sa2, headers[SADB_EXT_SA], NULL);
1100 import_lifetime(sa2,
1101 headers[SADB_EXT_LIFETIME_CURRENT],
1102 PFKEYV2_LIFETIME_CURRENT);
1103 import_lifetime(sa2, headers[SADB_EXT_LIFETIME_SOFT],
1104 PFKEYV2_LIFETIME_SOFT);
1105 import_lifetime(sa2, headers[SADB_EXT_LIFETIME_HARD],
1106 PFKEYV2_LIFETIME_HARD);
1107 import_udpencap(sa2, headers[SADB_X_EXT_UDPENCAP]);
1108 #if NPF > 0
1109 import_tag(sa2, headers[SADB_X_EXT_TAG]);
1110 #endif
1111 }
1112
1113 splx(s);
1114 break;
1115 case SADB_ADD:
1116 ssa = (struct sadb_sa *) headers[SADB_EXT_SA];
1117 sunionp = (union sockaddr_union *) (headers[SADB_EXT_ADDRESS_DST] +
1118 sizeof(struct sadb_address));
1119
1120
1121 if ((headers[SADB_X_EXT_SRC_FLOW] ||
1122 headers[SADB_X_EXT_PROTOCOL] ||
1123 headers[SADB_X_EXT_FLOW_TYPE] ||
1124 headers[SADB_X_EXT_DST_FLOW] ||
1125 headers[SADB_X_EXT_SRC_MASK] ||
1126 headers[SADB_X_EXT_DST_MASK]) &&
1127 !(headers[SADB_X_EXT_SRC_FLOW] &&
1128 headers[SADB_X_EXT_PROTOCOL] &&
1129 headers[SADB_X_EXT_FLOW_TYPE] &&
1130 headers[SADB_X_EXT_DST_FLOW] &&
1131 headers[SADB_X_EXT_SRC_MASK] &&
1132 headers[SADB_X_EXT_DST_MASK])) {
1133 rval = EINVAL;
1134 goto ret;
1135 }
1136 #ifdef IPSEC
1137
1138 if (headers[SADB_X_EXT_UDPENCAP] &&
1139 (!udpencap_enable ||
1140 smsg->sadb_msg_satype != SADB_SATYPE_ESP)) {
1141 rval = EINVAL;
1142 goto ret;
1143 }
1144 #endif
1145
1146 s = spltdb();
1147
1148 sa2 = gettdb(ssa->sadb_sa_spi, sunionp,
1149 SADB_X_GETSPROTO(smsg->sadb_msg_satype));
1150
1151
1152 if (sa2 != NULL) {
1153 rval = EEXIST;
1154 goto splxret;
1155 }
1156
1157
1158 if (ssa->sadb_sa_state != SADB_SASTATE_MATURE) {
1159 rval = EINVAL;
1160 goto splxret;
1161 }
1162
1163
1164 freeme = tdb_alloc();
1165
1166 {
1167 struct tdb *newsa = (struct tdb *) freeme;
1168 struct ipsecinit ii;
1169 int alg;
1170
1171 bzero(&ii, sizeof(struct ipsecinit));
1172
1173 newsa->tdb_satype = smsg->sadb_msg_satype;
1174 if ((rval = pfkeyv2_get_proto_alg(newsa->tdb_satype,
1175 &newsa->tdb_sproto, &alg))) {
1176 tdb_free(freeme);
1177 freeme = NULL;
1178 goto splxret;
1179 }
1180
1181 import_sa(newsa, headers[SADB_EXT_SA], &ii);
1182 import_address((struct sockaddr *) &newsa->tdb_src,
1183 headers[SADB_EXT_ADDRESS_SRC]);
1184 import_address((struct sockaddr *) &newsa->tdb_dst,
1185 headers[SADB_EXT_ADDRESS_DST]);
1186 import_address((struct sockaddr *) &newsa->tdb_proxy,
1187 headers[SADB_EXT_ADDRESS_PROXY]);
1188
1189 import_lifetime(newsa,
1190 headers[SADB_EXT_LIFETIME_CURRENT],
1191 PFKEYV2_LIFETIME_CURRENT);
1192 import_lifetime(newsa, headers[SADB_EXT_LIFETIME_SOFT],
1193 PFKEYV2_LIFETIME_SOFT);
1194 import_lifetime(newsa, headers[SADB_EXT_LIFETIME_HARD],
1195 PFKEYV2_LIFETIME_HARD);
1196
1197 import_key(&ii, headers[SADB_EXT_KEY_AUTH],
1198 PFKEYV2_AUTHENTICATION_KEY);
1199 import_key(&ii, headers[SADB_EXT_KEY_ENCRYPT],
1200 PFKEYV2_ENCRYPTION_KEY);
1201
1202 import_identity(newsa, headers[SADB_EXT_IDENTITY_SRC],
1203 PFKEYV2_IDENTITY_SRC);
1204 import_identity(newsa, headers[SADB_EXT_IDENTITY_DST],
1205 PFKEYV2_IDENTITY_DST);
1206
1207 import_credentials(newsa,
1208 headers[SADB_X_EXT_LOCAL_CREDENTIALS],
1209 PFKEYV2_CRED_LOCAL);
1210 import_credentials(newsa,
1211 headers[SADB_X_EXT_REMOTE_CREDENTIALS],
1212 PFKEYV2_CRED_REMOTE);
1213 import_auth(newsa, headers[SADB_X_EXT_LOCAL_AUTH],
1214 PFKEYV2_AUTH_LOCAL);
1215 import_auth(newsa, headers[SADB_X_EXT_REMOTE_AUTH],
1216 PFKEYV2_AUTH_REMOTE);
1217 import_flow(&newsa->tdb_filter, &newsa->tdb_filtermask,
1218 headers[SADB_X_EXT_SRC_FLOW],
1219 headers[SADB_X_EXT_SRC_MASK],
1220 headers[SADB_X_EXT_DST_FLOW],
1221 headers[SADB_X_EXT_DST_MASK],
1222 headers[SADB_X_EXT_PROTOCOL],
1223 headers[SADB_X_EXT_FLOW_TYPE]);
1224 import_udpencap(newsa, headers[SADB_X_EXT_UDPENCAP]);
1225 #if NPF > 0
1226 import_tag(newsa, headers[SADB_X_EXT_TAG]);
1227 #endif
1228
1229 headers[SADB_EXT_KEY_AUTH] = NULL;
1230 headers[SADB_EXT_KEY_ENCRYPT] = NULL;
1231 headers[SADB_X_EXT_LOCAL_AUTH] = NULL;
1232
1233 newsa->tdb_seq = smsg->sadb_msg_seq;
1234
1235 rval = tdb_init(newsa, alg, &ii);
1236 if (rval) {
1237 rval = EINVAL;
1238 tdb_free(freeme);
1239 freeme = NULL;
1240 goto splxret;
1241 }
1242 }
1243
1244
1245 puttdb((struct tdb *) freeme);
1246
1247 splx(s);
1248
1249 freeme = NULL;
1250 break;
1251
1252 case SADB_DELETE:
1253 ssa = (struct sadb_sa *) headers[SADB_EXT_SA];
1254 sunionp =
1255 (union sockaddr_union *)(headers[SADB_EXT_ADDRESS_DST] +
1256 sizeof(struct sadb_address));
1257 s = spltdb();
1258
1259 sa2 = gettdb(ssa->sadb_sa_spi, sunionp,
1260 SADB_X_GETSPROTO(smsg->sadb_msg_satype));
1261 if (sa2 == NULL) {
1262 rval = ESRCH;
1263 goto splxret;
1264 }
1265
1266 tdb_delete(sa2);
1267
1268 splx(s);
1269
1270 sa2 = NULL;
1271 break;
1272
1273 case SADB_X_ASKPOLICY:
1274
1275 ipa = ipsec_get_acquire(((struct sadb_x_policy *) headers[SADB_X_EXT_POLICY])->sadb_x_policy_seq);
1276 if (ipa == NULL) {
1277 rval = ESRCH;
1278 goto ret;
1279 }
1280
1281 rval = pfkeyv2_policy(ipa, headers, &freeme);
1282 if (rval)
1283 mode = PFKEYV2_SENDMESSAGE_UNICAST;
1284
1285 break;
1286
1287 case SADB_GET:
1288 ssa = (struct sadb_sa *) headers[SADB_EXT_SA];
1289 sunionp =
1290 (union sockaddr_union *)(headers[SADB_EXT_ADDRESS_DST] +
1291 sizeof(struct sadb_address));
1292
1293 s = spltdb();
1294
1295 sa2 = gettdb(ssa->sadb_sa_spi, sunionp,
1296 SADB_X_GETSPROTO(smsg->sadb_msg_satype));
1297 if (sa2 == NULL) {
1298 rval = ESRCH;
1299 goto splxret;
1300 }
1301
1302 rval = pfkeyv2_get(sa2, headers, &freeme, NULL);
1303 if (rval)
1304 mode = PFKEYV2_SENDMESSAGE_UNICAST;
1305
1306 splx(s);
1307
1308 break;
1309
1310 case SADB_REGISTER:
1311 if (!(pfkeyv2_socket->flags & PFKEYV2_SOCKETFLAGS_REGISTERED)) {
1312 pfkeyv2_socket->flags |= PFKEYV2_SOCKETFLAGS_REGISTERED;
1313 nregistered++;
1314 }
1315
1316 i = sizeof(struct sadb_supported) + sizeof(ealgs);
1317
1318 if (!(freeme = malloc(i, M_PFKEY, M_DONTWAIT))) {
1319 rval = ENOMEM;
1320 goto ret;
1321 }
1322
1323 bzero(freeme, i);
1324
1325 ssup = (struct sadb_supported *) freeme;
1326 ssup->sadb_supported_len = i / sizeof(uint64_t);
1327
1328 {
1329 void *p = freeme + sizeof(struct sadb_supported);
1330
1331 bcopy(&ealgs[0], p, sizeof(ealgs));
1332 }
1333
1334 headers[SADB_EXT_SUPPORTED_ENCRYPT] = freeme;
1335
1336 i = sizeof(struct sadb_supported) + sizeof(aalgs);
1337
1338 if (!(freeme = malloc(i, M_PFKEY, M_DONTWAIT))) {
1339 rval = ENOMEM;
1340 goto ret;
1341 }
1342
1343
1344 pfkeyv2_socket->registration |= (1 << ((struct sadb_msg *)message)->sadb_msg_satype);
1345
1346 bzero(freeme, i);
1347
1348 ssup = (struct sadb_supported *) freeme;
1349 ssup->sadb_supported_len = i / sizeof(uint64_t);
1350
1351 {
1352 void *p = freeme + sizeof(struct sadb_supported);
1353
1354 bcopy(&aalgs[0], p, sizeof(aalgs));
1355 }
1356
1357 headers[SADB_EXT_SUPPORTED_AUTH] = freeme;
1358
1359 i = sizeof(struct sadb_supported) + sizeof(calgs);
1360
1361 if (!(freeme = malloc(i, M_PFKEY, M_DONTWAIT))) {
1362 rval = ENOMEM;
1363 goto ret;
1364 }
1365
1366 bzero(freeme, i);
1367
1368 ssup = (struct sadb_supported *) freeme;
1369 ssup->sadb_supported_len = i / sizeof(uint64_t);
1370
1371 {
1372 void *p = freeme + sizeof(struct sadb_supported);
1373
1374 bcopy(&calgs[0], p, sizeof(calgs));
1375 }
1376
1377 headers[SADB_X_EXT_SUPPORTED_COMP] = freeme;
1378
1379 break;
1380
1381 case SADB_ACQUIRE:
1382 case SADB_EXPIRE:
1383
1384 rval = 0;
1385 break;
1386
1387 case SADB_FLUSH:
1388 rval = 0;
1389
1390 switch (smsg->sadb_msg_satype) {
1391 case SADB_SATYPE_UNSPEC:
1392 s = spltdb();
1393
1394
1395
1396
1397
1398 for (ipo = TAILQ_FIRST(&ipsec_policy_head);
1399 ipo != NULL; ipo = tmpipo) {
1400 tmpipo = TAILQ_NEXT(ipo, ipo_list);
1401 if (!(ipo->ipo_flags & IPSP_POLICY_SOCKET))
1402 ipsec_delete_policy(ipo);
1403 }
1404 splx(s);
1405
1406 case SADB_SATYPE_AH:
1407 case SADB_SATYPE_ESP:
1408 case SADB_X_SATYPE_IPIP:
1409 case SADB_X_SATYPE_IPCOMP:
1410 #ifdef TCP_SIGNATURE
1411 case SADB_X_SATYPE_TCPSIGNATURE:
1412 #endif
1413 s = spltdb();
1414
1415 tdb_walk(pfkeyv2_flush_walker,
1416 (u_int8_t *) &(smsg->sadb_msg_satype));
1417
1418 splx(s);
1419 break;
1420
1421 default:
1422 rval = EINVAL;
1423 }
1424
1425 break;
1426
1427 case SADB_DUMP:
1428 {
1429 struct dump_state dump_state;
1430 dump_state.sadb_msg = (struct sadb_msg *) headers[0];
1431 dump_state.socket = socket;
1432
1433 s = spltdb();
1434 rval = tdb_walk(pfkeyv2_dump_walker, &dump_state);
1435 splx(s);
1436
1437 if (!rval)
1438 goto realret;
1439
1440 if ((rval == ENOMEM) || (rval == ENOBUFS))
1441 rval = 0;
1442 }
1443 break;
1444
1445 case SADB_X_GRPSPIS:
1446 {
1447 struct tdb *tdb1, *tdb2, *tdb3;
1448 struct sadb_protocol *sa_proto;
1449
1450 ssa = (struct sadb_sa *) headers[SADB_EXT_SA];
1451 sunionp = (union sockaddr_union *) (headers[SADB_EXT_ADDRESS_DST] +
1452 sizeof(struct sadb_address));
1453
1454 s = spltdb();
1455
1456 tdb1 = gettdb(ssa->sadb_sa_spi, sunionp,
1457 SADB_X_GETSPROTO(smsg->sadb_msg_satype));
1458 if (tdb1 == NULL) {
1459 rval = ESRCH;
1460 goto splxret;
1461 }
1462
1463 ssa = (struct sadb_sa *) headers[SADB_X_EXT_SA2];
1464 sunionp = (union sockaddr_union *) (headers[SADB_X_EXT_DST2] +
1465 sizeof(struct sadb_address));
1466 sa_proto = ((struct sadb_protocol *) headers[SADB_X_EXT_PROTOCOL]);
1467
1468 tdb2 = gettdb(ssa->sadb_sa_spi, sunionp,
1469 SADB_X_GETSPROTO(sa_proto->sadb_protocol_proto));
1470 if (tdb2 == NULL) {
1471 rval = ESRCH;
1472 goto splxret;
1473 }
1474
1475
1476 for (tdb3 = tdb2; tdb3; tdb3 = tdb3->tdb_onext)
1477 if (tdb3 == tdb1) {
1478 rval = ESRCH;
1479 goto splxret;
1480 }
1481
1482
1483 if ((tdb1->tdb_onext) &&
1484 (tdb1->tdb_onext->tdb_inext == tdb1))
1485 tdb1->tdb_onext->tdb_inext = NULL;
1486
1487 if ((tdb2->tdb_inext) &&
1488 (tdb2->tdb_inext->tdb_onext == tdb2))
1489 tdb2->tdb_inext->tdb_onext = NULL;
1490
1491
1492 tdb1->tdb_onext = tdb2;
1493 tdb2->tdb_inext = tdb1;
1494
1495 splx(s);
1496 }
1497 break;
1498
1499 case SADB_X_DELFLOW:
1500 delflag = 1;
1501
1502 case SADB_X_ADDFLOW:
1503 {
1504 struct sadb_protocol *sab;
1505 union sockaddr_union *ssrc;
1506 struct route_enc re;
1507 int exists = 0;
1508
1509 sab = (struct sadb_protocol *) headers[SADB_X_EXT_FLOW_TYPE];
1510
1511 if ((sab->sadb_protocol_direction != IPSP_DIRECTION_IN) &&
1512 (sab->sadb_protocol_direction != IPSP_DIRECTION_OUT)) {
1513 rval = EINVAL;
1514 goto ret;
1515 }
1516
1517
1518 if (smsg->sadb_msg_satype == 0)
1519 smsg->sadb_msg_satype = SADB_SATYPE_ESP;
1520
1521 if (headers[SADB_EXT_ADDRESS_DST])
1522 sunionp = (union sockaddr_union *)
1523 (headers[SADB_EXT_ADDRESS_DST] +
1524 sizeof(struct sadb_address));
1525 else
1526 sunionp = NULL;
1527
1528 if (headers[SADB_EXT_ADDRESS_SRC])
1529 ssrc = (union sockaddr_union *)
1530 (headers[SADB_EXT_ADDRESS_SRC] +
1531 sizeof(struct sadb_address));
1532 else
1533 ssrc = NULL;
1534
1535 import_flow(&encapdst, &encapnetmask,
1536 headers[SADB_X_EXT_SRC_FLOW], headers[SADB_X_EXT_SRC_MASK],
1537 headers[SADB_X_EXT_DST_FLOW], headers[SADB_X_EXT_DST_MASK],
1538 headers[SADB_X_EXT_PROTOCOL], headers[SADB_X_EXT_FLOW_TYPE]);
1539
1540
1541 bzero(&encapgw, sizeof(struct sockaddr_encap));
1542 bzero(&re, sizeof(struct route_enc));
1543 bcopy(&encapdst, &re.re_dst, sizeof(struct sockaddr_encap));
1544
1545 s = spltdb();
1546
1547 rtalloc((struct route *) &re);
1548 if (re.re_rt != NULL) {
1549 ipo = ((struct sockaddr_encap *) re.re_rt->rt_gateway)->sen_ipsp;
1550 RTFREE(re.re_rt);
1551
1552
1553 if (bcmp(&ipo->ipo_addr, &encapdst,
1554 sizeof(struct sockaddr_encap)) ||
1555 bcmp(&ipo->ipo_mask, &encapnetmask,
1556 sizeof(struct sockaddr_encap)))
1557 ipo = NULL;
1558 else
1559 exists = 1;
1560 } else
1561 ipo = NULL;
1562
1563
1564
1565
1566
1567 if (exists && (ipo->ipo_flags & IPSP_POLICY_STATIC)) {
1568 if (!(sab->sadb_protocol_flags &
1569 SADB_X_POLICYFLAGS_POLICY)) {
1570 splx(s);
1571 goto ret;
1572 }
1573 }
1574
1575
1576 if (delflag) {
1577 if (exists) {
1578 rval = ipsec_delete_policy(ipo);
1579 splx(s);
1580 goto ret;
1581 }
1582
1583
1584 splx(s);
1585 rval = ESRCH;
1586 break;
1587 }
1588
1589 if (!exists) {
1590 if (ipsec_policy_pool_initialized == 0) {
1591 ipsec_policy_pool_initialized = 1;
1592 pool_init(&ipsec_policy_pool,
1593 sizeof(struct ipsec_policy), 0, 0, 0,
1594 "ipsec policy", NULL);
1595 }
1596
1597
1598 ipo = pool_get(&ipsec_policy_pool, 0);
1599 if (ipo == NULL) {
1600 splx(s);
1601 rval = ENOMEM;
1602 goto ret;
1603 }
1604
1605 bzero(ipo, sizeof(struct ipsec_policy));
1606 ipo->ipo_ref_count = 1;
1607 TAILQ_INIT(&ipo->ipo_acquires);
1608
1609
1610 encapgw.sen_len = SENT_LEN;
1611 encapgw.sen_family = PF_KEY;
1612 encapgw.sen_type = SENT_IPSP;
1613 encapgw.sen_ipsp = ipo;
1614
1615
1616 bcopy(&encapdst, &ipo->ipo_addr,
1617 sizeof(struct sockaddr_encap));
1618 bcopy(&encapnetmask, &ipo->ipo_mask,
1619 sizeof(struct sockaddr_encap));
1620 }
1621
1622 switch (((struct sadb_protocol *) headers[SADB_X_EXT_FLOW_TYPE])->sadb_protocol_proto) {
1623 case SADB_X_FLOW_TYPE_USE:
1624 ipo->ipo_type = IPSP_IPSEC_USE;
1625 break;
1626
1627 case SADB_X_FLOW_TYPE_ACQUIRE:
1628 ipo->ipo_type = IPSP_IPSEC_ACQUIRE;
1629 break;
1630
1631 case SADB_X_FLOW_TYPE_REQUIRE:
1632 ipo->ipo_type = IPSP_IPSEC_REQUIRE;
1633 break;
1634
1635 case SADB_X_FLOW_TYPE_DENY:
1636 ipo->ipo_type = IPSP_DENY;
1637 break;
1638
1639 case SADB_X_FLOW_TYPE_BYPASS:
1640 ipo->ipo_type = IPSP_PERMIT;
1641 break;
1642
1643 case SADB_X_FLOW_TYPE_DONTACQ:
1644 ipo->ipo_type = IPSP_IPSEC_DONTACQ;
1645 break;
1646
1647 default:
1648 if (!exists)
1649 pool_put(&ipsec_policy_pool, ipo);
1650 else
1651 ipsec_delete_policy(ipo);
1652
1653 splx(s);
1654 rval = EINVAL;
1655 goto ret;
1656 }
1657
1658 if (sab->sadb_protocol_flags & SADB_X_POLICYFLAGS_POLICY)
1659 ipo->ipo_flags |= IPSP_POLICY_STATIC;
1660
1661 if (sunionp)
1662 bcopy(sunionp, &ipo->ipo_dst,
1663 sizeof(union sockaddr_union));
1664 else
1665 bzero(&ipo->ipo_dst, sizeof(union sockaddr_union));
1666
1667 if (ssrc)
1668 bcopy(ssrc, &ipo->ipo_src,
1669 sizeof(union sockaddr_union));
1670 else
1671 bzero(&ipo->ipo_src, sizeof(union sockaddr_union));
1672
1673 ipo->ipo_sproto = SADB_X_GETSPROTO(smsg->sadb_msg_satype);
1674
1675 if (ipo->ipo_srcid) {
1676 ipsp_reffree(ipo->ipo_srcid);
1677 ipo->ipo_srcid = NULL;
1678 }
1679
1680 if (ipo->ipo_dstid) {
1681 ipsp_reffree(ipo->ipo_dstid);
1682 ipo->ipo_dstid = NULL;
1683 }
1684
1685 if ((sid = headers[SADB_EXT_IDENTITY_SRC]) != NULL) {
1686 int clen = (sid->sadb_ident_len * sizeof(u_int64_t)) -
1687 sizeof(struct sadb_ident);
1688
1689 MALLOC(ipo->ipo_srcid, struct ipsec_ref *, clen +
1690 sizeof(struct ipsec_ref), M_CREDENTIALS, M_DONTWAIT);
1691 if (ipo->ipo_srcid == NULL) {
1692 if (exists)
1693 ipsec_delete_policy(ipo);
1694 else
1695 pool_put(&ipsec_policy_pool, ipo);
1696 splx(s);
1697 rval = ENOBUFS;
1698 goto ret;
1699 }
1700 ipo->ipo_srcid->ref_type = sid->sadb_ident_type;
1701 ipo->ipo_srcid->ref_len = clen;
1702 ipo->ipo_srcid->ref_count = 1;
1703 ipo->ipo_srcid->ref_malloctype = M_CREDENTIALS;
1704 bcopy(sid + 1, ipo->ipo_srcid + 1, ipo->ipo_srcid->ref_len);
1705 }
1706
1707 if ((sid = headers[SADB_EXT_IDENTITY_DST]) != NULL) {
1708 int clen = (sid->sadb_ident_len * sizeof(u_int64_t)) -
1709 sizeof(struct sadb_ident);
1710
1711 MALLOC(ipo->ipo_dstid, struct ipsec_ref *,
1712 clen + sizeof(struct ipsec_ref),
1713 M_CREDENTIALS, M_DONTWAIT);
1714 if (ipo->ipo_dstid == NULL) {
1715 if (exists)
1716 ipsec_delete_policy(ipo);
1717 else {
1718 if (ipo->ipo_dstid)
1719 ipsp_reffree(ipo->ipo_dstid);
1720 pool_put(&ipsec_policy_pool, ipo);
1721 }
1722
1723 splx(s);
1724 rval = ENOBUFS;
1725 goto ret;
1726 }
1727 ipo->ipo_dstid->ref_type = sid->sadb_ident_type;
1728 ipo->ipo_dstid->ref_len = clen;
1729 ipo->ipo_dstid->ref_count = 1;
1730 ipo->ipo_dstid->ref_malloctype = M_CREDENTIALS;
1731 bcopy(sid + 1, ipo->ipo_dstid + 1,
1732 ipo->ipo_dstid->ref_len);
1733 }
1734
1735
1736 if (!exists) {
1737
1738 if ((rval = rtrequest(RTM_ADD,
1739 (struct sockaddr *) &encapdst,
1740 (struct sockaddr *) &encapgw,
1741 (struct sockaddr *) &encapnetmask,
1742 RTF_UP | RTF_GATEWAY | RTF_STATIC,
1743 (struct rtentry **) 0, 0)) != 0) {
1744
1745 if (ipo->ipo_tdb)
1746 TAILQ_REMOVE(&ipo->ipo_tdb->tdb_policy_head,
1747 ipo, ipo_tdb_next);
1748
1749 if (ipo->ipo_srcid)
1750 ipsp_reffree(ipo->ipo_srcid);
1751 if (ipo->ipo_dstid)
1752 ipsp_reffree(ipo->ipo_dstid);
1753 pool_put(&ipsec_policy_pool, ipo);
1754
1755 splx(s);
1756 goto ret;
1757 }
1758
1759 TAILQ_INSERT_HEAD(&ipsec_policy_head, ipo, ipo_list);
1760 ipsec_in_use++;
1761 } else {
1762 ipo->ipo_last_searched = ipo->ipo_flags = 0;
1763 }
1764
1765 splx(s);
1766 }
1767 break;
1768
1769 case SADB_X_PROMISC:
1770 if (len >= 2 * sizeof(struct sadb_msg)) {
1771 struct mbuf *packet;
1772
1773 if ((rval = pfdatatopacket(message, len, &packet)) != 0)
1774 goto ret;
1775
1776 for (so = pfkeyv2_sockets; so; so = so->next)
1777 if ((so != pfkeyv2_socket) &&
1778 (!smsg->sadb_msg_seq ||
1779 (smsg->sadb_msg_seq == pfkeyv2_socket->pid)))
1780 pfkey_sendup(so->socket, packet, 1);
1781
1782 m_freem(packet);
1783 } else {
1784 if (len != sizeof(struct sadb_msg)) {
1785 rval = EINVAL;
1786 goto ret;
1787 }
1788
1789 i = (pfkeyv2_socket->flags &
1790 PFKEYV2_SOCKETFLAGS_PROMISC) ? 1 : 0;
1791 j = smsg->sadb_msg_satype ? 1 : 0;
1792
1793 if (i ^ j) {
1794 if (j) {
1795 pfkeyv2_socket->flags |=
1796 PFKEYV2_SOCKETFLAGS_PROMISC;
1797 npromisc++;
1798 } else {
1799 pfkeyv2_socket->flags &=
1800 ~PFKEYV2_SOCKETFLAGS_PROMISC;
1801 npromisc--;
1802 }
1803 }
1804 }
1805
1806
1807 break;
1808
1809 default:
1810 rval = EINVAL;
1811 goto ret;
1812 }
1813
1814 ret:
1815 if (rval) {
1816 if ((rval == EINVAL) || (rval == ENOMEM) || (rval == ENOBUFS))
1817 goto realret;
1818
1819 for (i = 1; i <= SADB_EXT_MAX; i++)
1820 headers[i] = NULL;
1821
1822 smsg->sadb_msg_errno = abs(rval);
1823 } else {
1824 uint64_t seen = 0LL;
1825
1826 for (i = 1; i <= SADB_EXT_MAX; i++)
1827 if (headers[i])
1828 seen |= (1LL << i);
1829
1830 if ((seen & sadb_exts_allowed_out[smsg->sadb_msg_type])
1831 != seen)
1832 goto realret;
1833
1834 if ((seen & sadb_exts_required_out[smsg->sadb_msg_type]) !=
1835 sadb_exts_required_out[smsg->sadb_msg_type])
1836 goto realret;
1837 }
1838
1839 rval = pfkeyv2_sendmessage(headers, mode, socket, 0, 0);
1840
1841 realret:
1842 if (freeme)
1843 free(freeme, M_PFKEY);
1844
1845 free(message, M_PFKEY);
1846
1847 return (rval);
1848
1849 splxret:
1850 splx(s);
1851 goto ret;
1852 }
1853
1854
1855
1856
1857 int
1858 pfkeyv2_acquire(struct ipsec_policy *ipo, union sockaddr_union *gw,
1859 union sockaddr_union *laddr, u_int32_t *seq, struct sockaddr_encap *ddst)
1860 {
1861 void *p, *headers[SADB_EXT_MAX + 1], *buffer = NULL;
1862 struct sadb_ident *srcid, *dstid;
1863 struct sadb_x_cred *lcred, *lauth;
1864 struct sadb_comb *sadb_comb;
1865 struct sadb_address *sadd;
1866 struct sadb_prop *sa_prop;
1867 struct sadb_msg *smsg;
1868 int rval = 0;
1869 int i, j;
1870
1871 *seq = pfkeyv2_seq++;
1872
1873 if (!nregistered) {
1874 rval = ESRCH;
1875 goto ret;
1876 }
1877
1878
1879 i = sizeof(struct sadb_msg) +
1880 (laddr == NULL ? 0 : sizeof(struct sadb_address) +
1881 PADUP(SA_LEN(&ipo->ipo_src.sa))) +
1882 sizeof(struct sadb_address) + PADUP(SA_LEN(&gw->sa)) +
1883 sizeof(struct sadb_prop) + 1 * sizeof(struct sadb_comb);
1884
1885 if (ipo->ipo_srcid)
1886 i += sizeof(struct sadb_ident) + PADUP(ipo->ipo_srcid->ref_len);
1887
1888 if (ipo->ipo_dstid)
1889 i += sizeof(struct sadb_ident) + PADUP(ipo->ipo_dstid->ref_len);
1890
1891 if (ipo->ipo_local_cred)
1892 i += sizeof(struct sadb_x_cred) + PADUP(ipo->ipo_local_cred->ref_len);
1893
1894 if (ipo->ipo_local_auth)
1895 i += sizeof(struct sadb_x_cred) + PADUP(ipo->ipo_local_auth->ref_len);
1896
1897
1898 if (!(p = malloc(i, M_PFKEY, M_DONTWAIT))) {
1899 rval = ENOMEM;
1900 goto ret;
1901 }
1902
1903 bzero(headers, sizeof(headers));
1904
1905 buffer = p;
1906 bzero(p, i);
1907
1908 headers[0] = p;
1909 p += sizeof(struct sadb_msg);
1910
1911 smsg = (struct sadb_msg *) headers[0];
1912 smsg->sadb_msg_version = PF_KEY_V2;
1913 smsg->sadb_msg_type = SADB_ACQUIRE;
1914 smsg->sadb_msg_len = i / sizeof(uint64_t);
1915 smsg->sadb_msg_seq = *seq;
1916
1917 if (ipo->ipo_sproto == IPPROTO_ESP)
1918 smsg->sadb_msg_satype = SADB_SATYPE_ESP;
1919 else if (ipo->ipo_sproto == IPPROTO_AH)
1920 smsg->sadb_msg_satype = SADB_SATYPE_AH;
1921 else if (ipo->ipo_sproto == IPPROTO_IPCOMP)
1922 smsg->sadb_msg_satype = SADB_X_SATYPE_IPCOMP;
1923
1924 if (laddr) {
1925 headers[SADB_EXT_ADDRESS_SRC] = p;
1926 p += sizeof(struct sadb_address) + PADUP(SA_LEN(&laddr->sa));
1927 sadd = (struct sadb_address *) headers[SADB_EXT_ADDRESS_SRC];
1928 sadd->sadb_address_len = (sizeof(struct sadb_address) +
1929 SA_LEN(&laddr->sa) + sizeof(uint64_t) - 1) /
1930 sizeof(uint64_t);
1931 bcopy(laddr, headers[SADB_EXT_ADDRESS_SRC] +
1932 sizeof(struct sadb_address), SA_LEN(&laddr->sa));
1933 }
1934
1935 headers[SADB_EXT_ADDRESS_DST] = p;
1936 p += sizeof(struct sadb_address) + PADUP(SA_LEN(&gw->sa));
1937 sadd = (struct sadb_address *) headers[SADB_EXT_ADDRESS_DST];
1938 sadd->sadb_address_len = (sizeof(struct sadb_address) +
1939 SA_LEN(&gw->sa) + sizeof(uint64_t) - 1) / sizeof(uint64_t);
1940 bcopy(gw, headers[SADB_EXT_ADDRESS_DST] + sizeof(struct sadb_address),
1941 SA_LEN(&gw->sa));
1942
1943 if (ipo->ipo_srcid) {
1944 headers[SADB_EXT_IDENTITY_SRC] = p;
1945 p += sizeof(struct sadb_ident) + PADUP(ipo->ipo_srcid->ref_len);
1946 srcid = (struct sadb_ident *) headers[SADB_EXT_IDENTITY_SRC];
1947 srcid->sadb_ident_len = (sizeof(struct sadb_ident) +
1948 PADUP(ipo->ipo_srcid->ref_len)) / sizeof(u_int64_t);
1949 srcid->sadb_ident_type = ipo->ipo_srcid->ref_type;
1950 bcopy(ipo->ipo_srcid + 1, headers[SADB_EXT_IDENTITY_SRC] +
1951 sizeof(struct sadb_ident), ipo->ipo_srcid->ref_len);
1952 }
1953
1954 if (ipo->ipo_dstid) {
1955 headers[SADB_EXT_IDENTITY_DST] = p;
1956 p += sizeof(struct sadb_ident) + PADUP(ipo->ipo_dstid->ref_len);
1957 dstid = (struct sadb_ident *) headers[SADB_EXT_IDENTITY_DST];
1958 dstid->sadb_ident_len = (sizeof(struct sadb_ident) +
1959 PADUP(ipo->ipo_dstid->ref_len)) / sizeof(u_int64_t);
1960 dstid->sadb_ident_type = ipo->ipo_dstid->ref_type;
1961 bcopy(ipo->ipo_dstid + 1, headers[SADB_EXT_IDENTITY_DST] +
1962 sizeof(struct sadb_ident), ipo->ipo_dstid->ref_len);
1963 }
1964
1965 if (ipo->ipo_local_cred) {
1966 headers[SADB_X_EXT_LOCAL_CREDENTIALS] = p;
1967 p += sizeof(struct sadb_x_cred) + PADUP(ipo->ipo_local_cred->ref_len);
1968 lcred = (struct sadb_x_cred *) headers[SADB_X_EXT_LOCAL_CREDENTIALS];
1969 lcred->sadb_x_cred_len = (sizeof(struct sadb_x_cred) +
1970 PADUP(ipo->ipo_local_cred->ref_len)) / sizeof(u_int64_t);
1971 switch (ipo->ipo_local_cred->ref_type) {
1972 case IPSP_CRED_KEYNOTE:
1973 lcred->sadb_x_cred_type = SADB_X_CREDTYPE_KEYNOTE;
1974 break;
1975 case IPSP_CRED_X509:
1976 lcred->sadb_x_cred_type = SADB_X_CREDTYPE_X509;
1977 break;
1978 }
1979 bcopy(ipo->ipo_local_cred + 1, headers[SADB_X_EXT_LOCAL_CREDENTIALS] +
1980 sizeof(struct sadb_x_cred), ipo->ipo_local_cred->ref_len);
1981 }
1982
1983 if (ipo->ipo_local_auth) {
1984 headers[SADB_X_EXT_LOCAL_AUTH] = p;
1985 p += sizeof(struct sadb_x_cred) + PADUP(ipo->ipo_local_auth->ref_len);
1986 lauth = (struct sadb_x_cred *) headers[SADB_X_EXT_LOCAL_AUTH];
1987 lauth->sadb_x_cred_len = (sizeof(struct sadb_x_cred) +
1988 PADUP(ipo->ipo_local_auth->ref_len)) / sizeof(u_int64_t);
1989 switch (ipo->ipo_local_auth->ref_type) {
1990 case IPSP_AUTH_PASSPHRASE:
1991 lauth->sadb_x_cred_type = SADB_X_AUTHTYPE_PASSPHRASE;
1992 break;
1993 case IPSP_AUTH_RSA:
1994 lauth->sadb_x_cred_type = SADB_X_AUTHTYPE_RSA;
1995 break;
1996 }
1997
1998 bcopy(ipo->ipo_local_auth + 1, headers[SADB_X_EXT_LOCAL_AUTH] +
1999 sizeof(struct sadb_x_cred), ipo->ipo_local_auth->ref_len);
2000 }
2001
2002 headers[SADB_EXT_PROPOSAL] = p;
2003 p += sizeof(struct sadb_prop);
2004 sa_prop = (struct sadb_prop *) headers[SADB_EXT_PROPOSAL];
2005 sa_prop->sadb_prop_num = 1;
2006 sa_prop->sadb_prop_len = (sizeof(struct sadb_prop) +
2007 (sizeof(struct sadb_comb) * sa_prop->sadb_prop_num)) /
2008 sizeof(uint64_t);
2009
2010 sadb_comb = p;
2011
2012
2013 for (j = 0; j < sa_prop->sadb_prop_num; j++) {
2014 sadb_comb->sadb_comb_flags = 0;
2015
2016 if (ipsec_require_pfs)
2017 sadb_comb->sadb_comb_flags |= SADB_SAFLAGS_PFS;
2018
2019
2020 if (ipo->ipo_sproto == IPPROTO_ESP) {
2021 if (!strncasecmp(ipsec_def_enc, "aes",
2022 sizeof("aes"))) {
2023 sadb_comb->sadb_comb_encrypt = SADB_X_EALG_AES;
2024 sadb_comb->sadb_comb_encrypt_minbits = 128;
2025 sadb_comb->sadb_comb_encrypt_maxbits = 256;
2026 } else if (!strncasecmp(ipsec_def_enc, "aesctr",
2027 sizeof("aesctr"))) {
2028 sadb_comb->sadb_comb_encrypt = SADB_X_EALG_AESCTR;
2029 sadb_comb->sadb_comb_encrypt_minbits = 128+32;
2030 sadb_comb->sadb_comb_encrypt_maxbits = 256+32;
2031 } else if (!strncasecmp(ipsec_def_enc, "3des",
2032 sizeof("3des"))) {
2033 sadb_comb->sadb_comb_encrypt = SADB_EALG_3DESCBC;
2034 sadb_comb->sadb_comb_encrypt_minbits = 192;
2035 sadb_comb->sadb_comb_encrypt_maxbits = 192;
2036 } else if (!strncasecmp(ipsec_def_enc, "des",
2037 sizeof("des"))) {
2038 sadb_comb->sadb_comb_encrypt = SADB_EALG_DESCBC;
2039 sadb_comb->sadb_comb_encrypt_minbits = 64;
2040 sadb_comb->sadb_comb_encrypt_maxbits = 64;
2041 } else if (!strncasecmp(ipsec_def_enc, "blowfish",
2042 sizeof("blowfish"))) {
2043 sadb_comb->sadb_comb_encrypt = SADB_X_EALG_BLF;
2044 sadb_comb->sadb_comb_encrypt_minbits = 40;
2045 sadb_comb->sadb_comb_encrypt_maxbits = BLF_MAXKEYLEN * 8;
2046 } else if (!strncasecmp(ipsec_def_enc, "skipjack",
2047 sizeof("skipjack"))) {
2048 sadb_comb->sadb_comb_encrypt = SADB_X_EALG_SKIPJACK;
2049 sadb_comb->sadb_comb_encrypt_minbits = 80;
2050 sadb_comb->sadb_comb_encrypt_maxbits = 80;
2051 } else if (!strncasecmp(ipsec_def_enc, "cast128",
2052 sizeof("cast128"))) {
2053 sadb_comb->sadb_comb_encrypt = SADB_X_EALG_CAST;
2054 sadb_comb->sadb_comb_encrypt_minbits = 40;
2055 sadb_comb->sadb_comb_encrypt_maxbits = 128;
2056 }
2057 } else if (ipo->ipo_sproto == IPPROTO_IPCOMP) {
2058
2059 if (!strncasecmp(ipsec_def_comp, "deflate",
2060 sizeof("deflate"))) {
2061 sadb_comb->sadb_comb_encrypt = SADB_X_CALG_DEFLATE;
2062 sadb_comb->sadb_comb_encrypt_minbits = 0;
2063 sadb_comb->sadb_comb_encrypt_maxbits = 0;
2064 } else if (!strncasecmp(ipsec_def_comp, "lzs",
2065 sizeof("lzs"))) {
2066 sadb_comb->sadb_comb_encrypt = SADB_X_CALG_LZS;
2067 sadb_comb->sadb_comb_encrypt_minbits = 0;
2068 sadb_comb->sadb_comb_encrypt_maxbits = 0;
2069 }
2070 }
2071
2072
2073 if (!strncasecmp(ipsec_def_auth, "hmac-sha1",
2074 sizeof("hmac-sha1"))) {
2075 sadb_comb->sadb_comb_auth = SADB_AALG_SHA1HMAC;
2076 sadb_comb->sadb_comb_auth_minbits = 160;
2077 sadb_comb->sadb_comb_auth_maxbits = 160;
2078 } else if (!strncasecmp(ipsec_def_auth, "hmac-ripemd160",
2079 sizeof("hmac_ripemd160"))) {
2080 sadb_comb->sadb_comb_auth = SADB_X_AALG_RIPEMD160HMAC;
2081 sadb_comb->sadb_comb_auth_minbits = 160;
2082 sadb_comb->sadb_comb_auth_maxbits = 160;
2083 } else if (!strncasecmp(ipsec_def_auth, "hmac-md5",
2084 sizeof("hmac-md5"))) {
2085 sadb_comb->sadb_comb_auth = SADB_AALG_MD5HMAC;
2086 sadb_comb->sadb_comb_auth_minbits = 128;
2087 sadb_comb->sadb_comb_auth_maxbits = 128;
2088 } else if (!strncasecmp(ipsec_def_auth, "hmac-sha2-256",
2089 sizeof("hmac-sha2-256"))) {
2090 sadb_comb->sadb_comb_auth = SADB_X_AALG_SHA2_256;
2091 sadb_comb->sadb_comb_auth_minbits = 256;
2092 sadb_comb->sadb_comb_auth_maxbits = 256;
2093 } else if (!strncasecmp(ipsec_def_auth, "hmac-sha2-384",
2094 sizeof("hmac-sha2-384"))) {
2095 sadb_comb->sadb_comb_auth = SADB_X_AALG_SHA2_384;
2096 sadb_comb->sadb_comb_auth_minbits = 384;
2097 sadb_comb->sadb_comb_auth_maxbits = 384;
2098 } else if (!strncasecmp(ipsec_def_auth, "hmac-sha2-512",
2099 sizeof("hmac-sha2-512"))) {
2100 sadb_comb->sadb_comb_auth = SADB_X_AALG_SHA2_512;
2101 sadb_comb->sadb_comb_auth_minbits = 512;
2102 sadb_comb->sadb_comb_auth_maxbits = 512;
2103 }
2104
2105 sadb_comb->sadb_comb_soft_allocations = ipsec_soft_allocations;
2106 sadb_comb->sadb_comb_hard_allocations = ipsec_exp_allocations;
2107
2108 sadb_comb->sadb_comb_soft_bytes = ipsec_soft_bytes;
2109 sadb_comb->sadb_comb_hard_bytes = ipsec_exp_bytes;
2110
2111 sadb_comb->sadb_comb_soft_addtime = ipsec_soft_timeout;
2112 sadb_comb->sadb_comb_hard_addtime = ipsec_exp_timeout;
2113
2114 sadb_comb->sadb_comb_soft_usetime = ipsec_soft_first_use;
2115 sadb_comb->sadb_comb_hard_usetime = ipsec_exp_first_use;
2116 sadb_comb++;
2117 }
2118
2119
2120 if ((rval = pfkeyv2_sendmessage(headers,
2121 PFKEYV2_SENDMESSAGE_REGISTERED, NULL, smsg->sadb_msg_satype, 0))
2122 != 0)
2123 goto ret;
2124
2125 rval = 0;
2126 ret:
2127 if (buffer != NULL) {
2128 bzero(buffer, i);
2129 free(buffer, M_PFKEY);
2130 }
2131
2132 return (rval);
2133 }
2134
2135
2136
2137
2138
2139 int
2140 pfkeyv2_expire(struct tdb *sa, u_int16_t type)
2141 {
2142 void *p, *headers[SADB_EXT_MAX+1], *buffer = NULL;
2143 struct sadb_msg *smsg;
2144 int rval = 0;
2145 int i;
2146
2147 switch (sa->tdb_sproto) {
2148 case IPPROTO_AH:
2149 case IPPROTO_ESP:
2150 case IPPROTO_IPIP:
2151 case IPPROTO_IPCOMP:
2152 #ifdef TCP_SIGNATURE
2153 case IPPROTO_TCP:
2154 #endif
2155 break;
2156
2157 default:
2158 rval = EOPNOTSUPP;
2159 goto ret;
2160 }
2161
2162 i = sizeof(struct sadb_msg) + sizeof(struct sadb_sa) +
2163 2 * sizeof(struct sadb_lifetime) +
2164 sizeof(struct sadb_address) + PADUP(SA_LEN(&sa->tdb_src.sa)) +
2165 sizeof(struct sadb_address) + PADUP(SA_LEN(&sa->tdb_dst.sa));
2166
2167 if (!(p = malloc(i, M_PFKEY, M_DONTWAIT))) {
2168 rval = ENOMEM;
2169 goto ret;
2170 }
2171
2172 bzero(headers, sizeof(headers));
2173
2174 buffer = p;
2175 bzero(p, i);
2176
2177 headers[0] = p;
2178 p += sizeof(struct sadb_msg);
2179
2180 smsg = (struct sadb_msg *) headers[0];
2181 smsg->sadb_msg_version = PF_KEY_V2;
2182 smsg->sadb_msg_type = SADB_EXPIRE;
2183 smsg->sadb_msg_satype = sa->tdb_satype;
2184 smsg->sadb_msg_len = i / sizeof(uint64_t);
2185 smsg->sadb_msg_seq = pfkeyv2_seq++;
2186
2187 headers[SADB_EXT_SA] = p;
2188 export_sa(&p, sa);
2189
2190 headers[SADB_EXT_LIFETIME_CURRENT] = p;
2191 export_lifetime(&p, sa, 2);
2192
2193 headers[type] = p;
2194 export_lifetime(&p, sa, type == SADB_EXT_LIFETIME_SOFT ?
2195 PFKEYV2_LIFETIME_SOFT : PFKEYV2_LIFETIME_HARD);
2196
2197 headers[SADB_EXT_ADDRESS_SRC] = p;
2198 export_address(&p, (struct sockaddr *) &sa->tdb_src);
2199
2200 headers[SADB_EXT_ADDRESS_DST] = p;
2201 export_address(&p, (struct sockaddr *) &sa->tdb_dst);
2202
2203 if ((rval = pfkeyv2_sendmessage(headers, PFKEYV2_SENDMESSAGE_BROADCAST,
2204 NULL, 0, 0)) != 0)
2205 goto ret;
2206
2207 rval = 0;
2208
2209 ret:
2210 if (buffer != NULL) {
2211 bzero(buffer, i);
2212 free(buffer, M_PFKEY);
2213 }
2214
2215 return (rval);
2216 }
2217
2218 struct pfkeyv2_sysctl_walk {
2219 void *w_where;
2220 size_t w_len;
2221 int w_op;
2222 u_int8_t w_satype;
2223 };
2224
2225 int
2226 pfkeyv2_sysctl_walker(struct tdb *sa, void *arg, int last)
2227 {
2228 struct pfkeyv2_sysctl_walk *w = (struct pfkeyv2_sysctl_walk *)arg;
2229 void *buffer = NULL;
2230 int error = 0;
2231 int buflen, i;
2232
2233 if (w->w_satype != SADB_SATYPE_UNSPEC &&
2234 w->w_satype != sa->tdb_satype)
2235 return (0);
2236
2237 if (w->w_where) {
2238 void *headers[SADB_EXT_MAX+1];
2239 struct sadb_msg msg;
2240
2241 bzero(headers, sizeof(headers));
2242 if ((error = pfkeyv2_get(sa, headers, &buffer, &buflen)) != 0)
2243 goto done;
2244 if (w->w_len < sizeof(msg) + buflen) {
2245 error = ENOMEM;
2246 goto done;
2247 }
2248
2249 bzero(&msg, sizeof(msg));
2250 msg.sadb_msg_version = PF_KEY_V2;
2251 msg.sadb_msg_satype = sa->tdb_satype;
2252 msg.sadb_msg_type = SADB_DUMP;
2253 msg.sadb_msg_len = (sizeof(msg) + buflen) / sizeof(uint64_t);
2254 if ((error = copyout(&msg, w->w_where, sizeof(msg))) != 0)
2255 goto done;
2256 w->w_where += sizeof(msg);
2257 w->w_len -= sizeof(msg);
2258
2259 for (i = 1; i <= SADB_EXT_MAX; i++)
2260 if (headers[i])
2261 ((struct sadb_ext *)
2262 headers[i])->sadb_ext_type = i;
2263 if ((error = copyout(buffer, w->w_where, buflen)) != 0)
2264 goto done;
2265 w->w_where += buflen;
2266 w->w_len -= buflen;
2267 } else {
2268 if ((error = pfkeyv2_get(sa, NULL, NULL, &buflen)) != 0)
2269 return (error);
2270 w->w_len += buflen;
2271 w->w_len += sizeof(struct sadb_msg);
2272 }
2273
2274 done:
2275 if (buffer)
2276 free(buffer, M_PFKEY);
2277 return (error);
2278 }
2279
2280 int
2281 pfkeyv2_dump_policy(struct ipsec_policy *ipo, void **headers, void **buffer,
2282 int *lenp)
2283 {
2284 struct sadb_ident *ident;
2285 int i, rval, perm;
2286 void *p;
2287
2288
2289 i = 2 * sizeof(struct sadb_protocol);
2290
2291
2292 switch (ipo->ipo_addr.sen_type) {
2293 #ifdef INET
2294 case SENT_IP4:
2295 i += 4 * PADUP(sizeof(struct sockaddr_in));
2296 i += 4 * sizeof(struct sadb_address);
2297 break;
2298 #endif
2299 #ifdef INET6
2300 case SENT_IP6:
2301 i += 4 * PADUP(sizeof(struct sockaddr_in6));
2302 i += 4 * sizeof(struct sadb_address);
2303 break;
2304 #endif
2305 default:
2306 return (EINVAL);
2307 }
2308
2309
2310 switch (ipo->ipo_src.sa.sa_family) {
2311 case 0:
2312 break;
2313 #ifdef INET
2314 case AF_INET:
2315 i += PADUP(sizeof(struct sockaddr_in));
2316 i += sizeof(struct sadb_address);
2317 break;
2318 #endif
2319 #ifdef INET6
2320 case AF_INET6:
2321 i += PADUP(sizeof(struct sockaddr_in6));
2322 i += sizeof(struct sadb_address);
2323 break;
2324 #endif
2325 default:
2326 return (EINVAL);
2327 }
2328
2329
2330 switch (ipo->ipo_dst.sa.sa_family) {
2331 case 0:
2332 break;
2333 #ifdef INET
2334 case AF_INET:
2335 i += PADUP(sizeof(struct sockaddr_in));
2336 i += sizeof(struct sadb_address);
2337 break;
2338 #endif
2339 #ifdef INET6
2340 case AF_INET6:
2341 i += PADUP(sizeof(struct sockaddr_in6));
2342 i += sizeof(struct sadb_address);
2343 break;
2344 #endif
2345 default:
2346 return (EINVAL);
2347 }
2348
2349 if (ipo->ipo_srcid)
2350 i += sizeof(struct sadb_ident) + PADUP(ipo->ipo_srcid->ref_len);
2351 if (ipo->ipo_dstid)
2352 i += sizeof(struct sadb_ident) + PADUP(ipo->ipo_dstid->ref_len);
2353
2354 if (lenp)
2355 *lenp = i;
2356
2357 if (buffer == NULL) {
2358 rval = 0;
2359 goto ret;
2360 }
2361
2362 if (!(p = malloc(i, M_PFKEY, M_DONTWAIT))) {
2363 rval = ENOMEM;
2364 goto ret;
2365 } else {
2366 *buffer = p;
2367 bzero(p, i);
2368 }
2369
2370
2371 if (ipo->ipo_src.sa.sa_family) {
2372 headers[SADB_EXT_ADDRESS_SRC] = p;
2373 export_address(&p, (struct sockaddr *)&ipo->ipo_src);
2374 }
2375
2376
2377 if (ipo->ipo_dst.sa.sa_family) {
2378 headers[SADB_EXT_ADDRESS_DST] = p;
2379 export_address(&p, (struct sockaddr *)&ipo->ipo_dst);
2380 }
2381
2382
2383 export_flow(&p, ipo->ipo_type, &ipo->ipo_addr, &ipo->ipo_mask,
2384 headers);
2385
2386
2387 perm = suser(curproc, 0);
2388 if (perm == 0 && ipo->ipo_srcid) {
2389 headers[SADB_EXT_IDENTITY_SRC] = p;
2390 p += sizeof(struct sadb_ident) + PADUP(ipo->ipo_srcid->ref_len);
2391 ident = (struct sadb_ident *)headers[SADB_EXT_IDENTITY_SRC];
2392 ident->sadb_ident_len = (sizeof(struct sadb_ident) +
2393 PADUP(ipo->ipo_srcid->ref_len)) / sizeof(uint64_t);
2394 ident->sadb_ident_type = ipo->ipo_srcid->ref_type;
2395 bcopy(ipo->ipo_srcid + 1, headers[SADB_EXT_IDENTITY_SRC] +
2396 sizeof(struct sadb_ident), ipo->ipo_srcid->ref_len);
2397 }
2398 if (perm == 0 && ipo->ipo_dstid) {
2399 headers[SADB_EXT_IDENTITY_DST] = p;
2400 p += sizeof(struct sadb_ident) + PADUP(ipo->ipo_dstid->ref_len);
2401 ident = (struct sadb_ident *)headers[SADB_EXT_IDENTITY_DST];
2402 ident->sadb_ident_len = (sizeof(struct sadb_ident) +
2403 PADUP(ipo->ipo_dstid->ref_len)) / sizeof(uint64_t);
2404 ident->sadb_ident_type = ipo->ipo_dstid->ref_type;
2405 bcopy(ipo->ipo_dstid + 1, headers[SADB_EXT_IDENTITY_DST] +
2406 sizeof(struct sadb_ident), ipo->ipo_dstid->ref_len);
2407 }
2408
2409 rval = 0;
2410 ret:
2411 return (rval);
2412 }
2413
2414
2415
2416
2417 int
2418 pfkeyv2_ipo_walk(int (*walker)(struct ipsec_policy *, void *), void *arg)
2419 {
2420 int rval = 0;
2421 struct ipsec_policy *ipo;
2422
2423 TAILQ_FOREACH(ipo, &ipsec_policy_head, ipo_list)
2424 rval = walker(ipo, (void *)arg);
2425 return (rval);
2426 }
2427
2428 int
2429 pfkeyv2_sysctl_policydumper(struct ipsec_policy *ipo, void *arg)
2430 {
2431 struct pfkeyv2_sysctl_walk *w = (struct pfkeyv2_sysctl_walk *)arg;
2432 void *buffer = 0;
2433 int i, buflen, error = 0;
2434
2435
2436 if (ipo->ipo_flags & IPSP_POLICY_SOCKET)
2437 return (0);
2438
2439 if (w->w_where) {
2440 void *headers[SADB_EXT_MAX + 1];
2441 struct sadb_msg msg;
2442
2443 bzero(headers, sizeof(headers));
2444 if ((error = pfkeyv2_dump_policy(ipo, headers, &buffer,
2445 &buflen)) != 0)
2446 goto done;
2447 if (w->w_len < buflen) {
2448 error = ENOMEM;
2449 goto done;
2450 }
2451
2452 bzero(&msg, sizeof(msg));
2453 msg.sadb_msg_version = PF_KEY_V2;
2454 if (ipo->ipo_sproto == IPPROTO_ESP)
2455 msg.sadb_msg_satype = SADB_SATYPE_ESP;
2456 else if (ipo->ipo_sproto == IPPROTO_AH)
2457 msg.sadb_msg_satype = SADB_SATYPE_AH;
2458 else if (ipo->ipo_sproto == IPPROTO_IPCOMP)
2459 msg.sadb_msg_satype = SADB_X_SATYPE_IPCOMP;
2460 else if (ipo->ipo_sproto == IPPROTO_IPIP)
2461 msg.sadb_msg_satype = SADB_X_SATYPE_IPIP;
2462 msg.sadb_msg_type = SADB_X_SPDDUMP;
2463 msg.sadb_msg_len = (sizeof(msg) + buflen) / sizeof(uint64_t);
2464 if ((error = copyout(&msg, w->w_where, sizeof(msg))) != 0)
2465 goto done;
2466 w->w_where += sizeof(msg);
2467 w->w_len -= sizeof(msg);
2468
2469 for (i = 1; i < SADB_EXT_MAX; i++)
2470 if (headers[i])
2471 ((struct sadb_ext *)
2472 headers[i])->sadb_ext_type = i;
2473 if ((error = copyout(buffer, w->w_where, buflen)) != 0)
2474 goto done;
2475 w->w_where += buflen;
2476 w->w_len -= buflen;
2477 } else {
2478 if ((error = pfkeyv2_dump_policy(ipo, NULL, NULL,
2479 &buflen)) != 0)
2480 goto done;
2481 w->w_len += buflen;
2482 w->w_len += sizeof(struct sadb_msg);
2483 }
2484
2485 done:
2486 if (buffer)
2487 free(buffer, M_PFKEY);
2488 return (error);
2489 }
2490
2491 int
2492 pfkeyv2_sysctl(int *name, u_int namelen, void *oldp, size_t *oldlenp,
2493 void *new, size_t newlen)
2494 {
2495 struct pfkeyv2_sysctl_walk w;
2496 int s, error = EINVAL;
2497
2498 if (new)
2499 return (EPERM);
2500 if (namelen < 1)
2501 return (EINVAL);
2502 w.w_op = name[0];
2503 w.w_satype = name[1];
2504 w.w_where = oldp;
2505 w.w_len = oldp ? *oldlenp : 0;
2506
2507 switch(w.w_op) {
2508 case NET_KEY_SADB_DUMP:
2509 if ((error = suser(curproc, 0)) != 0)
2510 return (error);
2511 s = spltdb();
2512 error = tdb_walk(pfkeyv2_sysctl_walker, &w);
2513 splx(s);
2514 if (oldp)
2515 *oldlenp = w.w_where - oldp;
2516 else
2517 *oldlenp = w.w_len;
2518 break;
2519
2520 case NET_KEY_SPD_DUMP:
2521 s = spltdb();
2522 error = pfkeyv2_ipo_walk(pfkeyv2_sysctl_policydumper, &w);
2523 splx(s);
2524 if (oldp)
2525 *oldlenp = w.w_where - oldp;
2526 else
2527 *oldlenp = w.w_len;
2528 break;
2529 }
2530
2531 return (error);
2532 }
2533
2534 int
2535 pfkeyv2_init(void)
2536 {
2537 int rval;
2538
2539 bzero(&pfkeyv2_version, sizeof(struct pfkey_version));
2540 pfkeyv2_version.protocol = PFKEYV2_PROTOCOL;
2541 pfkeyv2_version.create = &pfkeyv2_create;
2542 pfkeyv2_version.release = &pfkeyv2_release;
2543 pfkeyv2_version.send = &pfkeyv2_send;
2544 pfkeyv2_version.sysctl = &pfkeyv2_sysctl;
2545
2546 rval = pfkey_register(&pfkeyv2_version);
2547 return (rval);
2548 }
2549
2550 int
2551 pfkeyv2_cleanup(void)
2552 {
2553 pfkey_unregister(&pfkeyv2_version);
2554 return (0);
2555 }