root/netinet/ip_spd.c

DEFINITIONS

1. ipsp_spd_lookup
2. ipsec_delete_policy
3. ipsec_add_policy
4. ipsec_update_policy
5. ipsp_delete_acquire
6. ipsp_pending_acquire
7. ipsp_acquire_sa
8. ipsp_spd_inp
9. ipsec_get_acquire

    1 /* $OpenBSD: ip_spd.c,v 1.53 2007/02/14 00:53:48 jsg Exp $ */
    2 /*
    3  * The author of this code is Angelos D. Keromytis (angelos@cis.upenn.edu)
    4  *
    5  * Copyright (c) 2000-2001 Angelos D. Keromytis.
    6  *
    7  * Permission to use, copy, and modify this software with or without fee
    8  * is hereby granted, provided that this entire notice is included in
    9  * all copies of any software which is or includes a copy or
   10  * modification of this software.
   11  * You may use this code under the GNU public license if you so wish. Please
   12  * contribute changes back to the authors under this freer than GPL license
   13  * so that we may further the use of strong encryption without limitations to
   14  * all.
   15  *
   16  * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR
   17  * IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY
   18  * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE
   19  * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR
   20  * PURPOSE.
   21  */
   23 #include <sys/param.h>
   24 #include <sys/systm.h>
   25 #include <sys/mbuf.h>
   26 #include <sys/socket.h>
   27 #include <sys/kernel.h>
   28 #include <sys/socketvar.h>
   29 #include <sys/protosw.h>
   31 #include <net/if.h>
   32 #include <net/route.h>
   33 #include <net/netisr.h>
   35 #ifdef INET
   36 #include <netinet/in.h>
   37 #include <netinet/in_systm.h>
   38 #include <netinet/ip.h>
   39 #include <netinet/in_pcb.h>
   40 #include <netinet/in_var.h>
   41 #endif /* INET */
   43 #ifdef INET6
   44 #ifndef INET
   45 #include <netinet/in.h>
   46 #endif
   47 #include <netinet6/in6_var.h>
   48 #endif /* INET6 */
   50 #include <netinet/ip_ipsp.h>
   51 #include <net/pfkeyv2.h>
   53 #ifdef ENCDEBUG
   54 #define DPRINTF(x)      if (encdebug) printf x
   55 #else
   56 #define DPRINTF(x)
   57 #endif
   59 struct pool ipsec_policy_pool;
   60 struct pool ipsec_acquire_pool;
   61 int ipsec_policy_pool_initialized = 0;
   62 int ipsec_acquire_pool_initialized = 0;
   64 /*
   65  * Lookup at the SPD based on the headers contained on the mbuf. The second
   66  * argument indicates what protocol family the header at the beginning of
   67  * the mbuf is. hlen is the offset of the transport protocol header
   68  * in the mbuf.
   69  *
   70  * Return combinations (of return value and in *error):
   71  * - NULL/0 -> no IPsec required on packet
   72  * - NULL/-EINVAL -> silently drop the packet
   73  * - NULL/errno -> drop packet and return error
   74  * or a pointer to a TDB (and 0 in *error).
   75  *
   76  * In the case of incoming flows, only the first three combinations are
   77  * returned.
   78  */
   79 struct tdb *
ipsp_spd_lookup(struct mbuf *m, int af, int hlen, int *error, int direction,
   81     struct tdb *tdbp, struct inpcb *inp)
   82 {
   83         struct route_enc re0, *re = &re0;
   84         union sockaddr_union sdst, ssrc;
   85         struct sockaddr_encap *ddst;
   86         struct ipsec_policy *ipo;
   87         int signore = 0, dignore = 0;
   89         /*
   90          * If there are no flows in place, there's no point
   91          * continuing with the SPD lookup.
   92          */
   93         if (!ipsec_in_use && inp == NULL) {
   94                 *error = 0;
   95                 return NULL;
   96         }
   98         /*
   99          * If an input packet is destined to a BYPASS socket, just accept it.
  100          */
  101         if ((inp != NULL) && (direction == IPSP_DIRECTION_IN) &&
  102             (inp->inp_seclevel[SL_ESP_TRANS] == IPSEC_LEVEL_BYPASS) &&
  103             (inp->inp_seclevel[SL_ESP_NETWORK] == IPSEC_LEVEL_BYPASS) &&
  104             (inp->inp_seclevel[SL_AUTH] == IPSEC_LEVEL_BYPASS)) {
  105                 *error = 0;
  106                 return NULL;
  107         }
bzero((caddr_t) re, sizeof(struct route_enc));
bzero((caddr_t) &sdst, sizeof(union sockaddr_union));
bzero((caddr_t) &ssrc, sizeof(union sockaddr_union));
ddst = (struct sockaddr_encap *) &re->re_dst;
ddst->sen_family = PF_KEY;
ddst->sen_len = SENT_LEN;
  116         switch (af) {
  117 #ifdef INET
  118         case AF_INET:
  119                 if (hlen < sizeof (struct ip) || m->m_pkthdr.len < hlen) {
  120                         *error = EINVAL;
  121                         return NULL;
  122                 }
ddst->sen_direction = direction;
ddst->sen_type = SENT_IP4;
m_copydata(m, offsetof(struct ip, ip_src),
  127                     sizeof(struct in_addr), (caddr_t) &(ddst->sen_ip_src));
m_copydata(m, offsetof(struct ip, ip_dst),
  129                     sizeof(struct in_addr), (caddr_t) &(ddst->sen_ip_dst));
m_copydata(m, offsetof(struct ip, ip_p), sizeof(u_int8_t),
  131                     (caddr_t) &(ddst->sen_proto));
sdst.sin.sin_family = ssrc.sin.sin_family = AF_INET;
sdst.sin.sin_len = ssrc.sin.sin_len =
  135                     sizeof(struct sockaddr_in);
ssrc.sin.sin_addr = ddst->sen_ip_src;
sdst.sin.sin_addr = ddst->sen_ip_dst;
  139                 /*
  140                  * If TCP/UDP, extract the port numbers to use in the lookup.
  141                  */
  142                 switch (ddst->sen_proto) {
  143                 case IPPROTO_UDP:
  144                 case IPPROTO_TCP:
  145                         /* Make sure there's enough data in the packet. */
  146                         if (m->m_pkthdr.len < hlen + 2 * sizeof(u_int16_t)) {
  147                                 *error = EINVAL;
  148                                 return NULL;
  149                         }
  151                         /*
  152                          * Luckily, the offset of the src/dst ports in
  153                          * both the UDP and TCP headers is the same (first
  154                          * two 16-bit values in the respective headers),
  155                          * so we can just copy them.
  156                          */
m_copydata(m, hlen, sizeof(u_int16_t),
  158                             (caddr_t) &(ddst->sen_sport));
m_copydata(m, hlen + sizeof(u_int16_t), sizeof(u_int16_t),
  160                             (caddr_t) &(ddst->sen_dport));
  161                         break;
  163                 default:
ddst->sen_sport = 0;
ddst->sen_dport = 0;
  166                 }
  168                 break;
  169 #endif /* INET */
  171 #ifdef INET6
  172         case AF_INET6:
  173                 if (hlen < sizeof (struct ip6_hdr) || m->m_pkthdr.len < hlen) {
  174                         *error = EINVAL;
  175                         return NULL;
  176                 }
ddst->sen_type = SENT_IP6;
ddst->sen_ip6_direction = direction;
m_copydata(m, offsetof(struct ip6_hdr, ip6_src),
  181                     sizeof(struct in6_addr),
  182                     (caddr_t) &(ddst->sen_ip6_src));
m_copydata(m, offsetof(struct ip6_hdr, ip6_dst),
  184                     sizeof(struct in6_addr),
  185                     (caddr_t) &(ddst->sen_ip6_dst));
m_copydata(m, offsetof(struct ip6_hdr, ip6_nxt),
  187                     sizeof(u_int8_t),
  188                     (caddr_t) &(ddst->sen_ip6_proto));
sdst.sin6.sin6_family = ssrc.sin6.sin6_family = AF_INET6;
sdst.sin6.sin6_len = ssrc.sin6.sin6_family =
  192                     sizeof(struct sockaddr_in6);
in6_recoverscope(&ssrc.sin6, &ddst->sen_ip6_src, NULL);
in6_recoverscope(&sdst.sin6, &ddst->sen_ip6_dst, NULL);
  196                 /*
  197                  * If TCP/UDP, extract the port numbers to use in the lookup.
  198                  */
  199                 switch (ddst->sen_ip6_proto) {
  200                 case IPPROTO_UDP:
  201                 case IPPROTO_TCP:
  202                         /* Make sure there's enough data in the packet. */
  203                         if (m->m_pkthdr.len < hlen + 2 * sizeof(u_int16_t)) {
  204                                 *error = EINVAL;
  205                                 return NULL;
  206                         }
  208                         /*
  209                          * Luckily, the offset of the src/dst ports in
  210                          * both the UDP and TCP headers is the same
  211                          * (first two 16-bit values in the respective
  212                          * headers), so we can just copy them.
  213                          */
m_copydata(m, hlen, sizeof(u_int16_t),
  215                             (caddr_t) &(ddst->sen_ip6_sport));
m_copydata(m, hlen + sizeof(u_int16_t), sizeof(u_int16_t),
  217                             (caddr_t) &(ddst->sen_ip6_dport));
  218                         break;
  220                 default:
ddst->sen_ip6_sport = 0;
ddst->sen_ip6_dport = 0;
  223                 }
  225                 break;
  226 #endif /* INET6 */
  228         default:
  229                 *error = EAFNOSUPPORT;
  230                 return NULL;
  231         }
  233         /* Actual SPD lookup. */
rtalloc((struct route *) re);
  235         if (re->re_rt == NULL) {
  236                 /*
  237                  * Return whatever the socket requirements are, there are no
  238                  * system-wide policies.
  239                  */
  240                 *error = 0;
  241                 return ipsp_spd_inp(m, af, hlen, error, direction,
tdbp, inp, NULL);
  243         }
  245         /* Sanity check. */
  246         if ((re->re_rt->rt_gateway == NULL) ||
  247             (((struct sockaddr_encap *) re->re_rt->rt_gateway)->sen_type !=
SENT_IPSP)) {
RTFREE(re->re_rt);
  250                 *error = EHOSTUNREACH;
DPRINTF(("ip_spd_lookup: no gateway in SPD entry!"));
  252                 return NULL;
  253         }
ipo = ((struct sockaddr_encap *) (re->re_rt->rt_gateway))->sen_ipsp;
RTFREE(re->re_rt);
  257         if (ipo == NULL) {
  258                 *error = EHOSTUNREACH;
DPRINTF(("ip_spd_lookup: no policy attached to SPD entry!"));
  260                 return NULL;
  261         }
  263         switch (ipo->ipo_type) {
  264         case IPSP_PERMIT:
  265                 *error = 0;
  266                 return ipsp_spd_inp(m, af, hlen, error, direction, tdbp,
inp, ipo);
  269         case IPSP_DENY:
  270                 *error = EHOSTUNREACH;
  271                 return NULL;
  273         case IPSP_IPSEC_USE:
  274         case IPSP_IPSEC_ACQUIRE:
  275         case IPSP_IPSEC_REQUIRE:
  276         case IPSP_IPSEC_DONTACQ:
  277                 /* Nothing more needed here. */
  278                 break;
  280         default:
  281                 *error = EINVAL;
  282                 return NULL;
  283         }
  285         /* Check for non-specific destination in the policy. */
  286         switch (ipo->ipo_dst.sa.sa_family) {
  287 #ifdef INET
  288         case AF_INET:
  289                 if ((ipo->ipo_dst.sin.sin_addr.s_addr == INADDR_ANY) ||
  290                     (ipo->ipo_dst.sin.sin_addr.s_addr == INADDR_BROADCAST))
dignore = 1;
  292                 break;
  293 #endif /* INET */
  295 #ifdef INET6
  296         case AF_INET6:
  297                 if ((IN6_IS_ADDR_UNSPECIFIED(&ipo->ipo_dst.sin6.sin6_addr)) ||
  298                     (bcmp(&ipo->ipo_dst.sin6.sin6_addr, &in6mask128,
  299                         sizeof(in6mask128)) == 0))
dignore = 1;
  301                 break;
  302 #endif /* INET6 */
  303         }
  305         /* Likewise for source. */
  306         switch (ipo->ipo_src.sa.sa_family) {
  307 #ifdef INET
  308         case AF_INET:
  309                 if (ipo->ipo_src.sin.sin_addr.s_addr == INADDR_ANY)
signore = 1;
  311                 break;
  312 #endif /* INET */
  314 #ifdef INET6
  315         case AF_INET6:
  316                 if (IN6_IS_ADDR_UNSPECIFIED(&ipo->ipo_src.sin6.sin6_addr))
signore = 1;
  318                 break;
  319 #endif /* INET6 */
  320         }
  322         /* Do we have a cached entry ? If so, check if it's still valid. */
  323         if ((ipo->ipo_tdb) && (ipo->ipo_tdb->tdb_flags & TDBF_INVALID)) {
TAILQ_REMOVE(&ipo->ipo_tdb->tdb_policy_head, ipo,
ipo_tdb_next);
ipo->ipo_tdb = NULL;
  327         }
  329         /* Outgoing packet policy check. */
  330         if (direction == IPSP_DIRECTION_OUT) {
  331                 /*
  332                  * If the packet is destined for the policy-specified
  333                  * gateway/endhost, and the socket has the BYPASS
  334                  * option set, skip IPsec processing.
  335                  */
  336                 if ((inp != NULL) &&
  337                     (inp->inp_seclevel[SL_ESP_TRANS] == IPSEC_LEVEL_BYPASS) &&
  338                     (inp->inp_seclevel[SL_ESP_NETWORK] ==
IPSEC_LEVEL_BYPASS) &&
  340                     (inp->inp_seclevel[SL_AUTH] == IPSEC_LEVEL_BYPASS)) {
  341                         /* Direct match. */
  342                         if (dignore ||
  343                             !bcmp(&sdst, &ipo->ipo_dst, sdst.sa.sa_len)) {
  344                                 *error = 0;
  345                                 return NULL;
  346                         }
  347                 }
  349                 /* Check that the cached TDB (if present), is appropriate. */
  350                 if (ipo->ipo_tdb) {
  351                         if ((ipo->ipo_last_searched <= ipsec_last_added) ||
  352                             (ipo->ipo_sproto != ipo->ipo_tdb->tdb_sproto) ||
bcmp(dignore ? &sdst : &ipo->ipo_dst,
  354                                 &ipo->ipo_tdb->tdb_dst,
ipo->ipo_tdb->tdb_dst.sa.sa_len))
  356                                 goto nomatchout;
  358                         if (!ipsp_aux_match(ipo->ipo_tdb,
ipo->ipo_srcid, ipo->ipo_dstid,
ipo->ipo_local_cred, NULL,
  361                             &ipo->ipo_addr, &ipo->ipo_mask))
  362                                 goto nomatchout;
  364                         /* Cached entry is good. */
  365                         *error = 0;
  366                         return ipsp_spd_inp(m, af, hlen, error, direction,
tdbp, inp, ipo);
nomatchout:
  370                         /* Cached TDB was not good. */
TAILQ_REMOVE(&ipo->ipo_tdb->tdb_policy_head, ipo,
ipo_tdb_next);
ipo->ipo_tdb = NULL;
ipo->ipo_last_searched = 0;
  375                 }
  377                 /*
  378                  * If no SA has been added since the last time we did a
  379                  * lookup, there's no point searching for one. However, if the
  380                  * destination gateway is left unspecified (or is all-1's),
  381                  * always lookup since this is a generic-match rule
  382                  * (otherwise, we can have situations where SAs to some
  383                  * destinations exist but are not used, possibly leading to an
  384                  * explosion in the number of acquired SAs).
  385                  */
  386                 if (ipo->ipo_last_searched <= ipsec_last_added) {
  387                         /* "Touch" the entry. */
  388                         if (dignore == 0)
ipo->ipo_last_searched = time_second;
  391                         /* Find an appropriate SA from the existing ones. */
ipo->ipo_tdb =
gettdbbyaddr(dignore ? &sdst : &ipo->ipo_dst,
ipo->ipo_sproto, ipo->ipo_srcid,
ipo->ipo_dstid, ipo->ipo_local_cred, m, af,
  396                                 &ipo->ipo_addr, &ipo->ipo_mask);
  397                         if (ipo->ipo_tdb) {
TAILQ_INSERT_TAIL(&ipo->ipo_tdb->tdb_policy_head,
ipo, ipo_tdb_next);
  400                                 *error = 0;
  401                                 return ipsp_spd_inp(m, af, hlen, error,
direction, tdbp, inp, ipo);
  403                         }
  404                 }
  406                 /* So, we don't have an SA -- just a policy. */
  407                 switch (ipo->ipo_type) {
  408                 case IPSP_IPSEC_REQUIRE:
  409                         /* Acquire SA through key management. */
  410                         if (ipsp_acquire_sa(ipo,
dignore ? &sdst : &ipo->ipo_dst,
signore ? NULL : &ipo->ipo_src, ddst, m) != 0) {
  413                                 *error = EACCES;
  414                                 return NULL;
  415                         }
  417                         /* FALLTHROUGH */
  418                 case IPSP_IPSEC_DONTACQ:
  419                         *error = -EINVAL; /* Silently drop packet. */
  420                         return NULL;
  422                 case IPSP_IPSEC_ACQUIRE:
  423                         /* Acquire SA through key management. */
ipsp_acquire_sa(ipo, dignore ? &sdst : &ipo->ipo_dst,
signore ? NULL : &ipo->ipo_src, ddst, NULL);
  427                         /* FALLTHROUGH */
  428                 case IPSP_IPSEC_USE:
  429                         *error = 0;
  430                         return ipsp_spd_inp(m, af, hlen, error, direction,
tdbp, inp, ipo);
  432                 }
  433         } else { /* IPSP_DIRECTION_IN */
  434                 if (tdbp != NULL) {
  435                         /* Direct match in the cache. */
  436                         if (ipo->ipo_tdb == tdbp) {
  437                                 *error = 0;
  438                                 return ipsp_spd_inp(m, af, hlen, error,
direction, tdbp, inp, ipo);
  440                         }
  442                         if (bcmp(dignore ? &ssrc : &ipo->ipo_dst,
  443                             &tdbp->tdb_src, tdbp->tdb_src.sa.sa_len) ||
  444                             (ipo->ipo_sproto != tdbp->tdb_sproto))
  445                                 goto nomatchin;
  447                         /* Match source ID. */
  448                         if (ipo->ipo_srcid) {
  449                                 if (tdbp->tdb_dstid == NULL ||
  450                                     !ipsp_ref_match(ipo->ipo_srcid,
tdbp->tdb_dstid))
  452                                         goto nomatchin;
  453                         }
  455                         /* Match destination ID. */
  456                         if (ipo->ipo_dstid) {
  457                                 if (tdbp->tdb_srcid == NULL ||
  458                                     !ipsp_ref_match(ipo->ipo_dstid,
tdbp->tdb_srcid))
  460                                         goto nomatchin;
  461                         }
  463                         /* Add it to the cache. */
  464                         if (ipo->ipo_tdb)
TAILQ_REMOVE(&ipo->ipo_tdb->tdb_policy_head,
ipo, ipo_tdb_next);
ipo->ipo_tdb = tdbp;
TAILQ_INSERT_TAIL(&tdbp->tdb_policy_head, ipo,
ipo_tdb_next);
  470                         *error = 0;
  471                         return ipsp_spd_inp(m, af, hlen, error, direction,
tdbp, inp, ipo);
nomatchin: /* Nothing needed here, falling through */
  475         ;
  476                 }
  478                 /* Check whether cached entry applies. */
  479                 if (ipo->ipo_tdb) {
  480                         /*
  481                          * We only need to check that the correct
  482                          * security protocol and security gateway are
  483                          * set; credentials/IDs will be the same,
  484                          * since the cached entry is linked on this
  485                          * policy.
  486                          */
  487                         if (ipo->ipo_sproto == ipo->ipo_tdb->tdb_sproto &&
  488                             !bcmp(&ipo->ipo_tdb->tdb_src,
dignore ? &ssrc : &ipo->ipo_dst,
ipo->ipo_tdb->tdb_src.sa.sa_len))
  491                                 goto skipinputsearch;
  493                         /* Not applicable, unlink. */
TAILQ_REMOVE(&ipo->ipo_tdb->tdb_policy_head, ipo,
ipo_tdb_next);
ipo->ipo_last_searched = 0;
ipo->ipo_tdb = NULL;
  498                 }
  500                 /* Find whether there exists an appropriate SA. */
  501                 if (ipo->ipo_last_searched <= ipsec_last_added) {
  502                         if (dignore == 0)
ipo->ipo_last_searched = time_second;
ipo->ipo_tdb =
gettdbbysrc(dignore ? &ssrc : &ipo->ipo_dst,
ipo->ipo_sproto, ipo->ipo_srcid,
ipo->ipo_dstid, m, af, &ipo->ipo_addr,
  509                                 &ipo->ipo_mask);
  510                         if (ipo->ipo_tdb)
TAILQ_INSERT_TAIL(&ipo->ipo_tdb->tdb_policy_head,
ipo, ipo_tdb_next);
  513                 }
skipinputsearch:
  516                 switch (ipo->ipo_type) {
  517                 case IPSP_IPSEC_REQUIRE:
  518                         /* If appropriate SA exists, don't acquire another. */
  519                         if (ipo->ipo_tdb) {
  520                                 *error = -EINVAL;
  521                                 return NULL;
  522                         }
  524                         /* Acquire SA through key management. */
  525                         if ((*error = ipsp_acquire_sa(ipo,
dignore ? &ssrc : &ipo->ipo_dst,
signore ? NULL : &ipo->ipo_src, ddst, m)) != 0)
  528                                 return NULL;
  530                         /* FALLTHROUGH */
  531                 case IPSP_IPSEC_DONTACQ:
  532                         /* Drop packet. */
  533                         *error = -EINVAL;
  534                         return NULL;
  536                 case IPSP_IPSEC_ACQUIRE:
  537                         /* If appropriate SA exists, don't acquire another. */
  538                         if (ipo->ipo_tdb) {
  539                                 *error = 0;
  540                                 return ipsp_spd_inp(m, af, hlen, error,
direction, tdbp, inp, ipo);
  542                         }
  544                         /* Acquire SA through key management. */
ipsp_acquire_sa(ipo, dignore ? &ssrc : &ipo->ipo_dst,
signore ? NULL : &ipo->ipo_src, ddst, NULL);
  548                         /* FALLTHROUGH */
  549                 case IPSP_IPSEC_USE:
  550                         *error = 0;
  551                         return ipsp_spd_inp(m, af, hlen, error, direction,
tdbp, inp, ipo);
  553                 }
  554         }
  556         /* Shouldn't ever get this far. */
  557         *error = EINVAL;
  558         return NULL;
  559 }
  561 /*
  562  * Delete a policy from the SPD.
  563  */
  564 int
ipsec_delete_policy(struct ipsec_policy *ipo)
  566 {
  567         struct ipsec_acquire *ipa;
  568         int err = 0;
  570         if (--ipo->ipo_ref_count > 0)
  571                 return 0;
  573         /* Delete from SPD. */
  574         if (!(ipo->ipo_flags & IPSP_POLICY_SOCKET))
err = rtrequest(RTM_DELETE, (struct sockaddr *) &ipo->ipo_addr,
  576                     (struct sockaddr *) 0,
  577                     (struct sockaddr *) &ipo->ipo_mask,
  578                     0, (struct rtentry **) 0, 0);       /* XXX other tables? */
  580         if (ipo->ipo_tdb != NULL)
TAILQ_REMOVE(&ipo->ipo_tdb->tdb_policy_head, ipo,
ipo_tdb_next);
  584         while ((ipa = TAILQ_FIRST(&ipo->ipo_acquires)) != NULL)
ipsp_delete_acquire(ipa);
TAILQ_REMOVE(&ipsec_policy_head, ipo, ipo_list);
  589         if (ipo->ipo_srcid)
ipsp_reffree(ipo->ipo_srcid);
  591         if (ipo->ipo_dstid)
ipsp_reffree(ipo->ipo_dstid);
  593         if (ipo->ipo_local_cred)
ipsp_reffree(ipo->ipo_local_cred);
  595         if (ipo->ipo_local_auth)
ipsp_reffree(ipo->ipo_local_auth);
pool_put(&ipsec_policy_pool, ipo);
  600         if (!(ipo->ipo_flags & IPSP_POLICY_SOCKET))
ipsec_in_use--;
  603         return err;
  604 }
  606 /*
  607  * Add a policy to the SPD.
  608  */
  609 struct ipsec_policy *
ipsec_add_policy(struct inpcb *inp, int af, int direction)
  611 {
  612         struct ipsec_policy *ipon;
  614         if (ipsec_policy_pool_initialized == 0) {
ipsec_policy_pool_initialized = 1;
pool_init(&ipsec_policy_pool, sizeof(struct ipsec_policy),
  617                     0, 0, 0, "ipsec policy", NULL);
  618         }
ipon = pool_get(&ipsec_policy_pool, 0);
  621         if (ipon == NULL)
  622                 return NULL;
bzero(ipon, sizeof(struct ipsec_policy));
ipon->ipo_ref_count = 1;
ipon->ipo_flags |= IPSP_POLICY_SOCKET;
ipon->ipo_type = IPSP_IPSEC_REQUIRE; /* XXX */
  631         /* XXX
  632          * We should actually be creating a linked list of
  633          * policies (for tunnel/transport and ESP/AH), as needed.
  634          */
ipon->ipo_sproto = IPPROTO_ESP;
TAILQ_INIT(&ipon->ipo_acquires);
TAILQ_INSERT_HEAD(&ipsec_policy_head, ipon, ipo_list);
ipsec_update_policy(inp, ipon, af, direction);
  642         return ipon;
  643 }
  645 /*
  646  * Update a PCB-attached policy.
  647  */
  648 void
ipsec_update_policy(struct inpcb *inp, struct ipsec_policy *ipon, int af,
  650     int direction)
  651 {
ipon->ipo_addr.sen_len = ipon->ipo_mask.sen_len = SENT_LEN;
ipon->ipo_addr.sen_family = ipon->ipo_mask.sen_family = PF_KEY;
ipon->ipo_src.sa.sa_family = ipon->ipo_dst.sa.sa_family = af;
  656         switch (af) {
  657         case AF_INET:
  658 #ifdef INET
ipon->ipo_addr.sen_type = ipon->ipo_mask.sen_type = SENT_IP4;
ipon->ipo_addr.sen_ip_src = inp->inp_laddr;
ipon->ipo_addr.sen_ip_dst = inp->inp_faddr;
ipon->ipo_addr.sen_sport = inp->inp_lport;
ipon->ipo_addr.sen_dport = inp->inp_fport;
ipon->ipo_addr.sen_proto =
inp->inp_socket->so_proto->pr_protocol;
ipon->ipo_addr.sen_direction = direction;
ipon->ipo_mask.sen_ip_src.s_addr = 0xffffffff;
ipon->ipo_mask.sen_ip_dst.s_addr = 0xffffffff;
ipon->ipo_mask.sen_sport = ipon->ipo_mask.sen_dport = 0xffff;
ipon->ipo_mask.sen_proto = 0xff;
ipon->ipo_mask.sen_direction = direction;
ipon->ipo_src.sa.sa_len = sizeof(struct sockaddr_in);
ipon->ipo_dst.sa.sa_len = sizeof(struct sockaddr_in);
ipon->ipo_src.sin.sin_addr = inp->inp_laddr;
ipon->ipo_dst.sin.sin_addr = inp->inp_faddr;
  678 #endif /* INET */
  679                 break;
  681         case AF_INET6:
  682 #ifdef INET6
ipon->ipo_addr.sen_type = ipon->ipo_mask.sen_type = SENT_IP6;
ipon->ipo_addr.sen_ip6_src = inp->inp_laddr6;
ipon->ipo_addr.sen_ip6_dst = inp->inp_faddr6;
ipon->ipo_addr.sen_ip6_sport = inp->inp_lport;
ipon->ipo_addr.sen_ip6_dport = inp->inp_fport;
ipon->ipo_addr.sen_ip6_proto =
inp->inp_socket->so_proto->pr_protocol;
ipon->ipo_addr.sen_ip6_direction = direction;
ipon->ipo_mask.sen_ip6_src = in6mask128;
ipon->ipo_mask.sen_ip6_dst = in6mask128;
ipon->ipo_mask.sen_ip6_sport = 0xffff;
ipon->ipo_mask.sen_ip6_dport = 0xffff;
ipon->ipo_mask.sen_ip6_proto = 0xff;
ipon->ipo_mask.sen_ip6_direction = direction;
ipon->ipo_src.sa.sa_len = sizeof(struct sockaddr_in6);
ipon->ipo_dst.sa.sa_len = sizeof(struct sockaddr_in6);
ipon->ipo_src.sin6.sin6_addr = inp->inp_laddr6;
ipon->ipo_dst.sin6.sin6_addr = inp->inp_faddr6;
  703 #endif /* INET6 */
  704                 break;
  705         }
  706 }
  708 /*
  709  * Delete a pending IPsec acquire record.
  710  */
  711 void
ipsp_delete_acquire(void *v)
  713 {
  714         struct ipsec_acquire *ipa = v;
timeout_del(&ipa->ipa_timeout);
TAILQ_REMOVE(&ipsec_acquire_head, ipa, ipa_next);
  718         if (ipa->ipa_policy != NULL)
TAILQ_REMOVE(&ipa->ipa_policy->ipo_acquires, ipa,
ipa_ipo_next);
pool_put(&ipsec_acquire_pool, ipa);
  722 }
  724 /*
  725  * Find out if there's an ACQUIRE pending.
  726  * XXX Need a better structure.
  727  */
  728 struct ipsec_acquire *
ipsp_pending_acquire(struct ipsec_policy *ipo, union sockaddr_union *gw)
  730 {
  731         struct ipsec_acquire *ipa;
TAILQ_FOREACH (ipa, &ipo->ipo_acquires, ipa_ipo_next) {
  734                 if (!bcmp(gw, &ipa->ipa_addr, gw->sa.sa_len))
  735                         return ipa;
  736         }
  738         return NULL;
  739 }
  741 /*
  742  * Signal key management that we need an SA.
  743  * XXX For outgoing policies, we could try to hold on to the mbuf.
  744  */
  745 int
ipsp_acquire_sa(struct ipsec_policy *ipo, union sockaddr_union *gw,
  747     union sockaddr_union *laddr, struct sockaddr_encap *ddst, struct mbuf *m)
  748 {
  749         struct ipsec_acquire *ipa;
  751         /*
  752          * If this is a socket policy, it has to have authentication
  753          * information accompanying it --- can't tell key mgmt. to
  754          * "find" it for us. This avoids abusing key mgmt. to authenticate
  755          * on an application's behalf, even if the application doesn't
  756          * have/know (and shouldn't) the appropriate authentication
  757          * material (passphrase, private key, etc.)
  758          */
  759         if (ipo->ipo_flags & IPSP_POLICY_SOCKET &&
ipo->ipo_local_auth == NULL)
  761                 return EINVAL;
  763         /* Check whether request has been made already. */
  764         if ((ipa = ipsp_pending_acquire(ipo, gw)) != NULL)
  765                 return 0;
  767         /* Add request in cache and proceed. */
  768         if (ipsec_acquire_pool_initialized == 0) {
ipsec_acquire_pool_initialized = 1;
pool_init(&ipsec_acquire_pool, sizeof(struct ipsec_acquire),
  771                     0, 0, 0, "ipsec acquire", NULL);
  772         }
ipa = pool_get(&ipsec_acquire_pool, 0);
  775         if (ipa == NULL)
  776                 return ENOMEM;
bzero(ipa, sizeof(struct ipsec_acquire));
bcopy(gw, &ipa->ipa_addr, sizeof(union sockaddr_union));
timeout_set(&ipa->ipa_timeout, ipsp_delete_acquire, ipa);
ipa->ipa_info.sen_len = ipa->ipa_mask.sen_len = SENT_LEN;
ipa->ipa_info.sen_family = ipa->ipa_mask.sen_family = PF_KEY;
  786         /* Just copy the right information. */
  787         switch (ipo->ipo_addr.sen_type) {
  788 #ifdef INET
  789         case SENT_IP4:
ipa->ipa_info.sen_type = ipa->ipa_mask.sen_type = SENT_IP4;
ipa->ipa_info.sen_direction = ipo->ipo_addr.sen_direction;
ipa->ipa_mask.sen_direction = ipo->ipo_mask.sen_direction;
  794                 if (ipo->ipo_mask.sen_ip_src.s_addr == INADDR_ANY ||
ipo->ipo_addr.sen_ip_src.s_addr == INADDR_ANY ||
ipsp_is_unspecified(ipo->ipo_dst)) {
ipa->ipa_info.sen_ip_src = ddst->sen_ip_src;
ipa->ipa_mask.sen_ip_src.s_addr = INADDR_BROADCAST;
  799                 } else {
ipa->ipa_info.sen_ip_src = ipo->ipo_addr.sen_ip_src;
ipa->ipa_mask.sen_ip_src = ipo->ipo_mask.sen_ip_src;
  802                 }
  804                 if (ipo->ipo_mask.sen_ip_dst.s_addr == INADDR_ANY ||
ipo->ipo_addr.sen_ip_dst.s_addr == INADDR_ANY ||
ipsp_is_unspecified(ipo->ipo_dst)) {
ipa->ipa_info.sen_ip_dst = ddst->sen_ip_dst;
ipa->ipa_mask.sen_ip_dst.s_addr = INADDR_BROADCAST;
  809                 } else {
ipa->ipa_info.sen_ip_dst = ipo->ipo_addr.sen_ip_dst;
ipa->ipa_mask.sen_ip_dst = ipo->ipo_mask.sen_ip_dst;
  812                 }
ipa->ipa_info.sen_proto = ipo->ipo_addr.sen_proto;
ipa->ipa_mask.sen_proto = ipo->ipo_mask.sen_proto;
  817                 if (ipo->ipo_addr.sen_proto) {
ipa->ipa_info.sen_sport = ipo->ipo_addr.sen_sport;
ipa->ipa_mask.sen_sport = ipo->ipo_mask.sen_sport;
ipa->ipa_info.sen_dport = ipo->ipo_addr.sen_dport;
ipa->ipa_mask.sen_dport = ipo->ipo_mask.sen_dport;
  823                 }
  824                 break;
  825 #endif /* INET */
  827 #ifdef INET6
  828         case SENT_IP6:
ipa->ipa_info.sen_type = ipa->ipa_mask.sen_type = SENT_IP6;
ipa->ipa_info.sen_ip6_direction =
ipo->ipo_addr.sen_ip6_direction;
ipa->ipa_mask.sen_ip6_direction =
ipo->ipo_mask.sen_ip6_direction;
  835                 if (IN6_IS_ADDR_UNSPECIFIED(&ipo->ipo_mask.sen_ip6_src) ||
IN6_IS_ADDR_UNSPECIFIED(&ipo->ipo_addr.sen_ip6_src) ||
ipsp_is_unspecified(ipo->ipo_dst)) {
ipa->ipa_info.sen_ip6_src = ddst->sen_ip6_src;
ipa->ipa_mask.sen_ip6_src = in6mask128;
  840                 } else {
ipa->ipa_info.sen_ip6_src = ipo->ipo_addr.sen_ip6_src;
ipa->ipa_mask.sen_ip6_src = ipo->ipo_mask.sen_ip6_src;
  843                 }
  845                 if (IN6_IS_ADDR_UNSPECIFIED(&ipo->ipo_mask.sen_ip6_dst) ||
IN6_IS_ADDR_UNSPECIFIED(&ipo->ipo_addr.sen_ip6_dst) ||
ipsp_is_unspecified(ipo->ipo_dst)) {
ipa->ipa_info.sen_ip6_dst = ddst->sen_ip6_dst;
ipa->ipa_mask.sen_ip6_dst = in6mask128;
  850                 } else {
ipa->ipa_info.sen_ip6_dst = ipo->ipo_addr.sen_ip6_dst;
ipa->ipa_mask.sen_ip6_dst = ipo->ipo_mask.sen_ip6_dst;
  853                 }
ipa->ipa_info.sen_ip6_proto = ipo->ipo_addr.sen_ip6_proto;
ipa->ipa_mask.sen_ip6_proto = ipo->ipo_mask.sen_ip6_proto;
  858                 if (ipo->ipo_mask.sen_ip6_proto) {
ipa->ipa_info.sen_ip6_sport =
ipo->ipo_addr.sen_ip6_sport;
ipa->ipa_mask.sen_ip6_sport =
ipo->ipo_mask.sen_ip6_sport;
ipa->ipa_info.sen_ip6_dport =
ipo->ipo_addr.sen_ip6_dport;
ipa->ipa_mask.sen_ip6_dport =
ipo->ipo_mask.sen_ip6_dport;
  867                 }
  868                 break;
  869 #endif /* INET6 */
  871         default:
pool_put(&ipsec_acquire_pool, ipa);
  873                 return 0;
  874         }
timeout_add(&ipa->ipa_timeout, ipsec_expire_acquire * hz);
TAILQ_INSERT_TAIL(&ipsec_acquire_head, ipa, ipa_next);
TAILQ_INSERT_TAIL(&ipo->ipo_acquires, ipa, ipa_ipo_next);
ipa->ipa_policy = ipo;
  882         /* PF_KEYv2 notification message. */
  883         return pfkeyv2_acquire(ipo, gw, laddr, &ipa->ipa_seq, ddst);
  884 }
  886 /*
  887  * Deal with PCB security requirements.
  888  */
  889 struct tdb *
ipsp_spd_inp(struct mbuf *m, int af, int hlen, int *error, int direction,
  891     struct tdb *tdbp, struct inpcb *inp, struct ipsec_policy *ipo)
  892 {
  893         struct ipsec_policy sipon;
  894         struct tdb_ident *tdbi;
  895         struct m_tag *mtag;
  896         struct tdb *tdb = NULL;
  898         /* Sanity check. */
  899         if (inp == NULL)
  900                 goto justreturn;
  902         /* Verify that we need to check for socket policy. */
  903         if ((inp->inp_seclevel[SL_ESP_TRANS] == IPSEC_LEVEL_BYPASS ||
inp->inp_seclevel[SL_ESP_TRANS] == IPSEC_LEVEL_NONE) &&
  905             (inp->inp_seclevel[SL_ESP_NETWORK] == IPSEC_LEVEL_BYPASS ||
inp->inp_seclevel[SL_ESP_NETWORK] == IPSEC_LEVEL_NONE) &&
  907             (inp->inp_seclevel[SL_AUTH] == IPSEC_LEVEL_BYPASS ||
inp->inp_seclevel[SL_AUTH] == IPSEC_LEVEL_NONE))
  909                 goto justreturn;
  911         switch (direction) {
  912         case IPSP_DIRECTION_IN:
  913                 /*
  914                  * Some further checking: if the socket has specified
  915                  * that it will accept unencrypted traffic, don't
  916                  * bother checking any further -- just accept the packet.
  917                  */
  918                 if ((inp->inp_seclevel[SL_ESP_TRANS] == IPSEC_LEVEL_AVAIL ||
inp->inp_seclevel[SL_ESP_TRANS] == IPSEC_LEVEL_USE) &&
  920                     (inp->inp_seclevel[SL_ESP_NETWORK] == IPSEC_LEVEL_AVAIL ||
inp->inp_seclevel[SL_ESP_NETWORK] == IPSEC_LEVEL_USE) &&
  922                     (inp->inp_seclevel[SL_AUTH] == IPSEC_LEVEL_AVAIL ||
inp->inp_seclevel[SL_AUTH] == IPSEC_LEVEL_USE))
  924                         goto justreturn;
  926                 /* Initialize socket policy if unset. */
  927                 if (inp->inp_ipo == NULL) {
inp->inp_ipo = ipsec_add_policy(inp, af,
IPSP_DIRECTION_OUT);
  930                         if (inp->inp_ipo == NULL) {
  931                                 *error = ENOBUFS;
  932                                 return NULL;
  933                         }
  934                 }
  936                 /*
  937                  * So we *must* have protected traffic. Let's see what
  938                  * we have received then.
  939                  */
  940                 if (inp->inp_tdb_in != NULL) {
  941                         if (inp->inp_tdb_in == tdbp)
  942                                 goto justreturn; /* We received packet under a
  943                                                   * previously-accepted TDB. */
  945                         /*
  946                          * We should be receiving protected traffic, and
  947                          * have an SA in place, but packet was received
  948                          * unprotected. Simply discard.
  949                          */
  950                         if (tdbp == NULL) {
  951                                 *error = -EINVAL;
  952                                 return NULL;
  953                         }
  955                         /* Update, since we may need all the relevant info. */
ipsec_update_policy(inp, inp->inp_ipo, af,
IPSP_DIRECTION_OUT);
  959                         /*
  960                          * Check that the TDB the packet was received under
  961                          * is acceptable under the socket policy. If so,
  962                          * accept the packet; otherwise, discard.
  963                          */
  964                         if (tdbp->tdb_sproto == inp->inp_ipo->ipo_sproto &&
  965                             !bcmp(&tdbp->tdb_src, &inp->inp_ipo->ipo_dst,
SA_LEN(&tdbp->tdb_src.sa)) &&
ipsp_aux_match(tdbp,
inp->inp_ipo->ipo_srcid, 
inp->inp_ipo->ipo_dstid,
NULL, NULL,
  971                                 &inp->inp_ipo->ipo_addr,
  972                                 &inp->inp_ipo->ipo_mask))
  973                                 goto justreturn;
  974                         else {
  975                                 *error = -EINVAL;
  976                                 return NULL;
  977                         }
  978                 } else {
  979                         /* Update, since we may need all the relevant info. */
ipsec_update_policy(inp, inp->inp_ipo, af,
IPSP_DIRECTION_OUT);
  983                         /*
  984                          * If the packet was received under an SA, see if
  985                          * it's acceptable under socket policy. If it is,
  986                          * accept the packet.
  987                          */
  988                         if (tdbp != NULL &&
tdbp->tdb_sproto == inp->inp_ipo->ipo_sproto &&
  990                             !bcmp(&tdbp->tdb_src, &inp->inp_ipo->ipo_dst,
SA_LEN(&tdbp->tdb_src.sa)) &&
ipsp_aux_match(tdbp,
inp->inp_ipo->ipo_srcid,
inp->inp_ipo->ipo_dstid,
NULL, NULL,
  996                                 &inp->inp_ipo->ipo_addr,
  997                                 &inp->inp_ipo->ipo_mask))
  998                                 goto justreturn;
 1000                         /*
 1001                          * If the packet was not received under an SA, or
 1002                          * if the SA it was received under is not acceptable,
 1003                          * see if we already have an acceptable SA
 1004                          * established. If we do, discard packet.
 1005                          */
 1006                         if (inp->inp_ipo->ipo_last_searched <=
ipsec_last_added) {
inp->inp_ipo->ipo_last_searched = time_second;
 1010                                 /* Do we have an SA already established ? */
 1011                                 if (gettdbbysrc(&inp->inp_ipo->ipo_dst,
inp->inp_ipo->ipo_sproto,
inp->inp_ipo->ipo_srcid,
inp->inp_ipo->ipo_dstid, m, af,
 1015                                     &inp->inp_ipo->ipo_addr,
 1016                                     &inp->inp_ipo->ipo_mask) != NULL) {
 1017                                         *error = -EINVAL;
 1018                                         return NULL;
 1019                                 }
 1020                                 /* Fall through */
 1021                         }
 1023                         /*
 1024                          * If we don't have an appropriate SA, acquire one
 1025                          * and discard the packet.
 1026                          */
ipsp_acquire_sa(inp->inp_ipo, &inp->inp_ipo->ipo_dst,
 1028                             &inp->inp_ipo->ipo_src, &inp->inp_ipo->ipo_addr, m);
 1029                         *error = -EINVAL;
 1030                         return NULL;
 1031                 }
 1033                 break;
 1035         case IPSP_DIRECTION_OUT:
 1036                 /* Do we have a cached entry ? */
 1037                 if (inp->inp_tdb_out != NULL) {
 1038                         /*
 1039                          * If we also have to apply a different TDB as
 1040                          * a result of a system-wide policy, add a tag
 1041                          * to the packet.
 1042                          */
 1043                         if (ipo != NULL && m != NULL &&
ipo->ipo_tdb != NULL &&
ipo->ipo_tdb != inp->inp_tdb_out) {
tdb = inp->inp_tdb_out;
 1047                                 goto tagandreturn;
 1048                         } else
 1049                                 return inp->inp_tdb_out;
 1050                 }
 1052                 /*
 1053                  * We need to either find an SA with the appropriate
 1054                  * characteristics and link it to the PCB, or acquire
 1055                  * one.
 1056                  */
 1057                 /* XXX Only support one policy/protocol for now. */
 1058                 if (inp->inp_ipo != NULL) {
 1059                         if (inp->inp_ipo->ipo_last_searched <=
ipsec_last_added) {
inp->inp_ipo->ipo_last_searched = time_second;
 1063                                 /* Update, just in case. */
ipsec_update_policy(inp, inp->inp_ipo, af,
IPSP_DIRECTION_OUT);
tdb = gettdbbyaddr(&inp->inp_ipo->ipo_dst,
inp->inp_ipo->ipo_sproto,
inp->inp_ipo->ipo_srcid,
inp->inp_ipo->ipo_dstid,
inp->inp_ipo->ipo_local_cred, m, af,
 1072                                     &inp->inp_ipo->ipo_addr,
 1073                                     &inp->inp_ipo->ipo_mask);
 1074                         }
 1075                 } else {
 1076                         /*
 1077                          * Construct a pseudo-policy, with just the necessary
 1078                          * fields.
 1079                          */
ipsec_update_policy(inp, &sipon, af,
IPSP_DIRECTION_OUT);
tdb = gettdbbyaddr(&sipon.ipo_dst, IPPROTO_ESP, NULL,
NULL, NULL, m, af, &sipon.ipo_addr,
 1085                             &sipon.ipo_mask);
 1086                 }
 1088                 /* If we found an appropriate SA... */
 1089                 if (tdb != NULL) {
tdb_add_inp(tdb, inp, 0); /* Latch onto PCB. */
 1092                         if (ipo != NULL && ipo->ipo_tdb != NULL &&
ipo->ipo_tdb != inp->inp_tdb_out && m != NULL)
 1094                                 goto tagandreturn;
 1095                         else
 1096                                 return tdb;
 1097                 } else {
 1098                         /* Do we need to acquire one ? */
 1099                         switch (inp->inp_seclevel[SL_ESP_TRANS]) {
 1100                         case IPSEC_LEVEL_BYPASS:
 1101                         case IPSEC_LEVEL_AVAIL:
 1102                                 /* No need to do anything. */
 1103                                 goto justreturn;
 1104                         case IPSEC_LEVEL_USE:
 1105                         case IPSEC_LEVEL_REQUIRE:
 1106                         case IPSEC_LEVEL_UNIQUE:
 1107                                 /* Initialize socket policy if unset. */
 1108                                 if (inp->inp_ipo == NULL) {
inp->inp_ipo = ipsec_add_policy(inp, af, IPSP_DIRECTION_OUT);
 1110                                         if (inp->inp_ipo == NULL) {
 1111                                                 *error = ENOBUFS;
 1112                                                 return NULL;
 1113                                         }
 1114                                 }
 1116                                 /* Acquire a new SA. */
 1117                                 if ((*error = ipsp_acquire_sa(inp->inp_ipo,
 1118                                     &inp->inp_ipo->ipo_dst,
 1119                                     &inp->inp_ipo->ipo_src,
 1120                                     &inp->inp_ipo->ipo_addr, m)) == 0)
 1121                                         *error = -EINVAL;
 1123                                 return NULL;
 1124                         default:
DPRINTF(("ipsp_spd_inp: unknown sock security"
 1126                                     " level %d",
inp->inp_seclevel[SL_ESP_TRANS]));
 1128                                 *error = -EINVAL;
 1129                                 return NULL;
 1130                         }
 1131                 }
 1132                 break;
 1134         default:  /* Should never happen. */
 1135                 *error = -EINVAL;
 1136                 return NULL;
 1137         }
tagandreturn:
 1140         if (tdb == NULL)
 1141                 goto justreturn;
mtag = m_tag_get(PACKET_TAG_IPSEC_PENDING_TDB,
 1144             sizeof (struct tdb_ident), M_NOWAIT);
 1145         if (mtag == NULL) {
 1146                 *error = ENOMEM;
 1147                 return NULL;
 1148         }
tdbi = (struct tdb_ident *)(mtag + 1);
tdbi->spi = ipo->ipo_tdb->tdb_spi;
tdbi->proto = ipo->ipo_tdb->tdb_sproto;
bcopy(&ipo->ipo_tdb->tdb_dst, &tdbi->dst,
ipo->ipo_tdb->tdb_dst.sa.sa_len);
m_tag_prepend(m, mtag);
 1156         return tdb;
justreturn:
 1159         if (ipo != NULL)
 1160                 return ipo->ipo_tdb;
 1161         else
 1162                 return NULL;
 1163 }
 1165 /*
 1166  * Find a pending ACQUIRE record based on its sequence number.
 1167  * XXX Need to use a better data structure.
 1168  */
 1169 struct ipsec_acquire *
ipsec_get_acquire(u_int32_t seq)
 1171 {
 1172         struct ipsec_acquire *ipa;
TAILQ_FOREACH (ipa, &ipsec_acquire_head, ipa_next)
 1175                 if (ipa->ipa_seq == seq)
 1176                         return ipa;
 1178         return NULL;
 1179 }