File: | src/sbin/isakmpd/pf_key_v2.c |
Warning: | line 1231, column 9 Result of 'calloc' is converted to a pointer of type 'struct sadb_ident', which is incompatible with sizeof operand type 'u_int8_t' |
Press '?' to see keyboard shortcuts
Keyboard shortcuts:
1 | /* $OpenBSD: pf_key_v2.c,v 1.202 2021/10/22 12:30:54 bluhm Exp $ */ |
2 | /* $EOM: pf_key_v2.c,v 1.79 2000/12/12 00:33:19 niklas Exp $ */ |
3 | |
4 | /* |
5 | * Copyright (c) 1999, 2000, 2001 Niklas Hallqvist. All rights reserved. |
6 | * Copyright (c) 1999, 2000, 2001 Angelos D. Keromytis. All rights reserved. |
7 | * Copyright (c) 2001 Håkan Olsson. All rights reserved. |
8 | * |
9 | * Redistribution and use in source and binary forms, with or without |
10 | * modification, are permitted provided that the following conditions |
11 | * are met: |
12 | * 1. Redistributions of source code must retain the above copyright |
13 | * notice, this list of conditions and the following disclaimer. |
14 | * 2. Redistributions in binary form must reproduce the above copyright |
15 | * notice, this list of conditions and the following disclaimer in the |
16 | * documentation and/or other materials provided with the distribution. |
17 | * |
18 | * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR |
19 | * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES |
20 | * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. |
21 | * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, |
22 | * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT |
23 | * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, |
24 | * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY |
25 | * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT |
26 | * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF |
27 | * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. |
28 | */ |
29 | |
30 | /* |
31 | * This code was written under funding by Ericsson Radio Systems. |
32 | */ |
33 | |
34 | #include <sys/types.h> |
35 | #include <sys/ioctl.h> |
36 | #include <sys/queue.h> |
37 | #include <sys/socket.h> |
38 | #include <sys/uio.h> |
39 | |
40 | #include <net/pfkeyv2.h> |
41 | #include <netinet/in.h> |
42 | #include <netinet/ip_ipsp.h> |
43 | #include <arpa/inet.h> |
44 | #include <stdlib.h> |
45 | #include <poll.h> |
46 | #include <string.h> |
47 | #include <unistd.h> |
48 | #include <pwd.h> |
49 | #include <errno(*__errno()).h> |
50 | #include <bitstring.h> |
51 | |
52 | #include "cert.h" |
53 | #include "conf.h" |
54 | #include "connection.h" |
55 | #include "exchange.h" |
56 | #include "ipsec.h" |
57 | #include "ipsec_num.h" |
58 | #include "key.h" |
59 | #include "log.h" |
60 | #include "pf_key_v2.h" |
61 | #include "sa.h" |
62 | #include "timer.h" |
63 | #include "transport.h" |
64 | #include "ui.h" |
65 | #include "util.h" |
66 | |
67 | #include "policy.h" |
68 | |
69 | #include "udp_encap.h" |
70 | |
71 | #define IN6_IS_ADDR_FULL(a)((*(u_int32_t *)(void *)(&(a)->__u6_addr.__u6_addr8[0] ) == 0xffffffff) && (*(u_int32_t *)(void *)(&(a)-> __u6_addr.__u6_addr8[4]) == 0xffffffff) && (*(u_int32_t *)(void *)(&(a)->__u6_addr.__u6_addr8[8]) == 0xffffffff ) && (*(u_int32_t *)(void *)(&(a)->__u6_addr.__u6_addr8 [12]) == 0xffffffff)) \ |
72 | ((*(u_int32_t *)(void *)(&(a)->s6_addr__u6_addr.__u6_addr8[0]) == 0xffffffff) && \ |
73 | (*(u_int32_t *)(void *)(&(a)->s6_addr__u6_addr.__u6_addr8[4]) == 0xffffffff) && \ |
74 | (*(u_int32_t *)(void *)(&(a)->s6_addr__u6_addr.__u6_addr8[8]) == 0xffffffff) && \ |
75 | (*(u_int32_t *)(void *)(&(a)->s6_addr__u6_addr.__u6_addr8[12]) == 0xffffffff)) |
76 | |
77 | #define ADDRESS_MAXsizeof "ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255" sizeof "ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255" |
78 | |
79 | /* |
80 | * PF_KEY v2 always work with 64-bit entities and aligns on 64-bit boundaries. |
81 | */ |
82 | #define PF_KEY_V2_CHUNK8 8 |
83 | #define PF_KEY_V2_ROUND(x)(((x) + 8 - 1) & ~(8 - 1)) \ |
84 | (((x) + PF_KEY_V2_CHUNK8 - 1) & ~(PF_KEY_V2_CHUNK8 - 1)) |
85 | |
86 | /* How many microseconds we will wait for a reply from the PF_KEY socket. */ |
87 | #define PF_KEY_REPLY_TIMEOUT1000 1000 |
88 | |
89 | struct pf_key_v2_node { |
90 | TAILQ_ENTRY(pf_key_v2_node)struct { struct pf_key_v2_node *tqe_next; struct pf_key_v2_node **tqe_prev; } link; |
91 | void *seg; |
92 | size_t sz; |
93 | int cnt; |
94 | u_int16_t type; |
95 | u_int8_t flags; |
96 | }; |
97 | |
98 | TAILQ_HEAD(pf_key_v2_msg, pf_key_v2_node)struct pf_key_v2_msg { struct pf_key_v2_node *tqh_first; struct pf_key_v2_node **tqh_last; }; |
99 | |
100 | #define PF_KEY_V2_NODE_MALLOCED1 1 |
101 | #define PF_KEY_V2_NODE_MARK2 2 |
102 | |
103 | /* Used to derive "unique" connection identifiers. */ |
104 | int connection_seq = 0; |
105 | |
106 | static u_int8_t *pf_key_v2_convert_id(u_int8_t *, int, size_t *, int *); |
107 | static struct pf_key_v2_msg *pf_key_v2_call(struct pf_key_v2_msg *); |
108 | static struct pf_key_v2_node *pf_key_v2_find_ext(struct pf_key_v2_msg *, |
109 | u_int16_t); |
110 | static void pf_key_v2_notify(struct pf_key_v2_msg *); |
111 | static struct pf_key_v2_msg *pf_key_v2_read(u_int32_t); |
112 | static u_int32_t pf_key_v2_seq(void); |
113 | static u_int32_t pf_key_v2_write(struct pf_key_v2_msg *); |
114 | static int pf_key_v2_remove_conf(char *); |
115 | static int pf_key_v2_conf_refhandle(int, char *); |
116 | |
117 | static int pf_key_v2_conf_refinc(int, char *); |
118 | |
119 | /* The socket to use for PF_KEY interactions. */ |
120 | int pf_key_v2_socket; |
121 | |
122 | static struct pf_key_v2_msg * |
123 | pf_key_v2_msg_new(struct sadb_msg *msg, int flags) |
124 | { |
125 | struct pf_key_v2_node *node; |
126 | struct pf_key_v2_msg *ret; |
127 | |
128 | node = malloc(sizeof *node); |
129 | if (!node) |
130 | goto cleanup; |
131 | ret = malloc(sizeof *ret); |
132 | if (!ret) |
133 | goto cleanup; |
134 | TAILQ_INIT(ret)do { (ret)->tqh_first = ((void *)0); (ret)->tqh_last = & (ret)->tqh_first; } while (0); |
135 | node->seg = msg; |
136 | node->sz = sizeof *msg; |
137 | node->type = 0; |
138 | node->cnt = 1; |
139 | node->flags = flags; |
140 | TAILQ_INSERT_HEAD(ret, node, link)do { if (((node)->link.tqe_next = (ret)->tqh_first) != ( (void *)0)) (ret)->tqh_first->link.tqe_prev = &(node )->link.tqe_next; else (ret)->tqh_last = &(node)-> link.tqe_next; (ret)->tqh_first = (node); (node)->link. tqe_prev = &(ret)->tqh_first; } while (0); |
141 | return ret; |
142 | |
143 | cleanup: |
144 | free(node); |
145 | return 0; |
146 | } |
147 | |
148 | /* Add a SZ sized segment SEG to the PF_KEY message MSG. */ |
149 | static int |
150 | pf_key_v2_msg_add(struct pf_key_v2_msg *msg, struct sadb_ext *ext, int flags) |
151 | { |
152 | struct pf_key_v2_node *node; |
153 | |
154 | node = malloc(sizeof *node); |
155 | if (!node) |
156 | return -1; |
157 | node->seg = ext; |
158 | node->sz = ext->sadb_ext_len * PF_KEY_V2_CHUNK8; |
159 | node->type = ext->sadb_ext_type; |
160 | node->flags = flags; |
161 | TAILQ_FIRST(msg)((msg)->tqh_first)->cnt++; |
162 | TAILQ_INSERT_TAIL(msg, node, link)do { (node)->link.tqe_next = ((void *)0); (node)->link. tqe_prev = (msg)->tqh_last; *(msg)->tqh_last = (node); ( msg)->tqh_last = &(node)->link.tqe_next; } while (0 ); |
163 | return 0; |
164 | } |
165 | |
166 | /* Deallocate the PF_KEY message MSG. */ |
167 | static void |
168 | pf_key_v2_msg_free(struct pf_key_v2_msg *msg) |
169 | { |
170 | struct pf_key_v2_node *np; |
171 | |
172 | np = TAILQ_FIRST(msg)((msg)->tqh_first); |
173 | while (np) { |
174 | TAILQ_REMOVE(msg, np, link)do { if (((np)->link.tqe_next) != ((void *)0)) (np)->link .tqe_next->link.tqe_prev = (np)->link.tqe_prev; else (msg )->tqh_last = (np)->link.tqe_prev; *(np)->link.tqe_prev = (np)->link.tqe_next; ; ; } while (0); |
175 | if (np->flags & PF_KEY_V2_NODE_MALLOCED1) |
176 | free(np->seg); |
177 | free(np); |
178 | np = TAILQ_FIRST(msg)((msg)->tqh_first); |
179 | } |
180 | free(msg); |
181 | } |
182 | |
183 | /* Just return a new sequence number. */ |
184 | static u_int32_t |
185 | pf_key_v2_seq(void) |
186 | { |
187 | static u_int32_t seq = 0; |
188 | |
189 | return ++seq; |
190 | } |
191 | |
192 | /* |
193 | * Read a PF_KEY packet with SEQ as the sequence number, looping if necessary. |
194 | * If SEQ is zero just read the first message we see, otherwise we queue |
195 | * messages up until both the PID and the sequence number match. |
196 | */ |
197 | static struct pf_key_v2_msg * |
198 | pf_key_v2_read(u_int32_t seq) |
199 | { |
200 | ssize_t n; |
201 | u_int8_t *buf = 0; |
202 | struct pf_key_v2_msg *ret = 0; |
203 | struct sadb_msg *msg; |
204 | struct sadb_msg hdr; |
205 | struct sadb_ext *ext; |
206 | struct timespec ts; |
207 | struct pollfd pfd[1]; |
208 | |
209 | pfd[0].fd = pf_key_v2_socket; |
210 | pfd[0].events = POLLIN0x0001; |
211 | |
212 | while (1) { |
213 | /* |
214 | * If this is a read of a reply we should actually expect the |
215 | * reply to get lost as PF_KEY is an unreliable service per |
216 | * the specs. Currently we do this by setting a short timeout, |
217 | * and if it is not readable in that time, we fail the read. |
218 | */ |
219 | if (seq) { |
220 | n = poll(pfd, 1, PF_KEY_REPLY_TIMEOUT1000 / 1000); |
221 | if (n == -1) { |
222 | log_error("pf_key_v2_read: poll() failed"); |
223 | goto cleanup; |
224 | } |
225 | if (!n) { |
226 | log_print("pf_key_v2_read: " |
227 | "no reply from PF_KEY"); |
228 | goto cleanup; |
229 | } |
230 | } |
231 | n = recv(pf_key_v2_socket, &hdr, sizeof hdr, MSG_PEEK0x2); |
232 | if (n == -1) { |
233 | log_error("pf_key_v2_read: recv (%d, ...) failed", |
234 | pf_key_v2_socket); |
235 | goto cleanup; |
236 | } |
237 | if (n != sizeof hdr) { |
238 | log_error("pf_key_v2_read: recv (%d, ...) " |
239 | "returned short packet (%lu bytes)", |
240 | pf_key_v2_socket, (unsigned long) n); |
241 | goto cleanup; |
242 | } |
243 | buf = reallocarray(NULL((void *)0), hdr.sadb_msg_len, PF_KEY_V2_CHUNK8); |
244 | if (!buf) { |
245 | log_error("pf_key_v2_read: reallocarray (%d, %d) failed", |
246 | hdr.sadb_msg_len, PF_KEY_V2_CHUNK8); |
247 | goto cleanup; |
248 | } |
249 | n = hdr.sadb_msg_len * PF_KEY_V2_CHUNK8; |
250 | |
251 | n = read(pf_key_v2_socket, buf, n); |
252 | if (n == -1) { |
253 | log_error("pf_key_v2_read: read (%d, ...) failed", |
254 | pf_key_v2_socket); |
255 | goto cleanup; |
256 | } |
257 | if (n != hdr.sadb_msg_len * PF_KEY_V2_CHUNK8) { |
258 | log_print("pf_key_v2_read: read (%d, ...) " |
259 | "returned short packet (%lu bytes)", |
260 | pf_key_v2_socket, (unsigned long) n); |
261 | goto cleanup; |
262 | } |
263 | LOG_DBG_BUF((LOG_SYSDEP, 80, "pf_key_v2_read: msg", buf, n))log_debug_buf (LOG_SYSDEP, 80, "pf_key_v2_read: msg", buf, n); |
264 | |
265 | /* We drop all messages that is not what we expect. */ |
266 | msg = (struct sadb_msg *) buf; |
267 | if (msg->sadb_msg_version != PF_KEY_V22 || |
268 | (msg->sadb_msg_pid != 0 && |
269 | msg->sadb_msg_pid != (u_int32_t) getpid())) { |
270 | if (seq) { |
271 | free(buf); |
272 | buf = 0; |
273 | continue; |
274 | } else { |
275 | LOG_DBG((LOG_SYSDEP, 90, "pf_key_v2_read:"log_debug (LOG_SYSDEP, 90, "pf_key_v2_read:" "bad version (%d) or PID (%d, mine is " "%ld), ignored", msg->sadb_msg_version, msg->sadb_msg_pid , (long) getpid()) |
276 | "bad version (%d) or PID (%d, mine is "log_debug (LOG_SYSDEP, 90, "pf_key_v2_read:" "bad version (%d) or PID (%d, mine is " "%ld), ignored", msg->sadb_msg_version, msg->sadb_msg_pid , (long) getpid()) |
277 | "%ld), ignored", msg->sadb_msg_version,log_debug (LOG_SYSDEP, 90, "pf_key_v2_read:" "bad version (%d) or PID (%d, mine is " "%ld), ignored", msg->sadb_msg_version, msg->sadb_msg_pid , (long) getpid()) |
278 | msg->sadb_msg_pid, (long) getpid()))log_debug (LOG_SYSDEP, 90, "pf_key_v2_read:" "bad version (%d) or PID (%d, mine is " "%ld), ignored", msg->sadb_msg_version, msg->sadb_msg_pid , (long) getpid()); |
279 | goto cleanup; |
280 | } |
281 | } |
282 | /* Parse the message. */ |
283 | ret = pf_key_v2_msg_new(msg, PF_KEY_V2_NODE_MALLOCED1); |
284 | if (!ret) |
285 | goto cleanup; |
286 | buf = 0; |
287 | for (ext = (struct sadb_ext *) (msg + 1); |
288 | (u_int8_t *) ext - (u_int8_t *) msg < |
289 | msg->sadb_msg_len * PF_KEY_V2_CHUNK8; |
290 | ext = (struct sadb_ext *) ((u_int8_t *) ext + |
291 | ext->sadb_ext_len * PF_KEY_V2_CHUNK8)) |
292 | pf_key_v2_msg_add(ret, ext, 0); |
293 | |
294 | /* |
295 | * If the message is not the one we are waiting for, queue it |
296 | * up. |
297 | */ |
298 | if (seq && (msg->sadb_msg_pid != (u_int32_t) getpid() || |
299 | msg->sadb_msg_seq != seq)) { |
300 | clock_gettime(CLOCK_MONOTONIC3, &ts); |
301 | timer_add_event("pf_key_v2_notify", |
302 | (void (*) (void *)) pf_key_v2_notify, ret, &ts); |
303 | ret = 0; |
304 | continue; |
305 | } |
306 | return ret; |
307 | } |
308 | |
309 | cleanup: |
310 | free(buf); |
311 | if (ret) |
312 | pf_key_v2_msg_free(ret); |
313 | return 0; |
314 | } |
315 | |
316 | /* Write the message in PMSG to the PF_KEY socket. */ |
317 | u_int32_t |
318 | pf_key_v2_write(struct pf_key_v2_msg *pmsg) |
319 | { |
320 | struct iovec *iov = 0; |
321 | ssize_t n; |
322 | size_t len; |
323 | int i, cnt = TAILQ_FIRST(pmsg)((pmsg)->tqh_first)->cnt; |
324 | char header[80]; |
325 | struct sadb_msg *msg = TAILQ_FIRST(pmsg)((pmsg)->tqh_first)->seg; |
326 | struct pf_key_v2_node *np = TAILQ_FIRST(pmsg)((pmsg)->tqh_first); |
327 | |
328 | iov = calloc(cnt, sizeof *iov); |
329 | if (!iov) { |
330 | log_error("pf_key_v2_write: malloc (%lu) failed", |
331 | cnt * (unsigned long) sizeof *iov); |
332 | return 0; |
333 | } |
334 | msg->sadb_msg_version = PF_KEY_V22; |
335 | msg->sadb_msg_errno = 0; |
336 | msg->sadb_msg_reserved = 0; |
337 | msg->sadb_msg_pid = getpid(); |
338 | if (!msg->sadb_msg_seq) |
339 | msg->sadb_msg_seq = pf_key_v2_seq(); |
340 | |
341 | /* Compute the iovec segments as well as the message length. */ |
342 | len = 0; |
343 | for (i = 0; i < cnt; i++) { |
344 | iov[i].iov_base = np->seg; |
345 | len += iov[i].iov_len = np->sz; |
346 | |
347 | /* |
348 | * XXX One can envision setting specific extension fields, |
349 | * like *_reserved ones here. For now we require them to be |
350 | * set by the caller. |
351 | */ |
352 | |
353 | np = TAILQ_NEXT(np, link)((np)->link.tqe_next); |
354 | } |
355 | msg->sadb_msg_len = len / PF_KEY_V2_CHUNK8; |
356 | |
357 | for (i = 0; i < cnt; i++) { |
358 | snprintf(header, sizeof header, "pf_key_v2_write: iov[%d]", i); |
359 | LOG_DBG_BUF((LOG_SYSDEP, 80, header,log_debug_buf (LOG_SYSDEP, 80, header, (u_int8_t *) iov[i].iov_base , iov[i].iov_len) |
360 | (u_int8_t *) iov[i].iov_base, iov[i].iov_len))log_debug_buf (LOG_SYSDEP, 80, header, (u_int8_t *) iov[i].iov_base , iov[i].iov_len); |
361 | } |
362 | |
363 | do { |
364 | n = writev(pf_key_v2_socket, iov, cnt); |
365 | } while (n == -1 && (errno(*__errno()) == EAGAIN35 || errno(*__errno()) == EINTR4)); |
366 | if (n == -1) { |
367 | log_error("pf_key_v2_write: writev (%d, %p, %d) failed", |
368 | pf_key_v2_socket, iov, cnt); |
369 | goto cleanup; |
370 | } |
371 | if ((size_t) n != len) { |
372 | log_error("pf_key_v2_write: " |
373 | "writev (%d, ...) returned prematurely (%lu)", |
374 | pf_key_v2_socket, (unsigned long) n); |
375 | goto cleanup; |
376 | } |
377 | free(iov); |
378 | return msg->sadb_msg_seq; |
379 | |
380 | cleanup: |
381 | free(iov); |
382 | return 0; |
383 | } |
384 | |
385 | /* |
386 | * Do a PF_KEY "call", i.e. write a message MSG, read the reply and return |
387 | * it to the caller. |
388 | */ |
389 | static struct pf_key_v2_msg * |
390 | pf_key_v2_call(struct pf_key_v2_msg *msg) |
391 | { |
392 | u_int32_t seq; |
393 | |
394 | seq = pf_key_v2_write(msg); |
395 | if (!seq) |
396 | return 0; |
397 | return pf_key_v2_read(seq); |
398 | } |
399 | |
400 | /* Find the TYPE extension in MSG. Return zero if none found. */ |
401 | static struct pf_key_v2_node * |
402 | pf_key_v2_find_ext(struct pf_key_v2_msg *msg, u_int16_t type) |
403 | { |
404 | struct pf_key_v2_node *ext; |
405 | |
406 | for (ext = TAILQ_NEXT(TAILQ_FIRST(msg), link)((((msg)->tqh_first))->link.tqe_next); ext; |
407 | ext = TAILQ_NEXT(ext, link)((ext)->link.tqe_next)) |
408 | if (ext->type == type) |
409 | return ext; |
410 | return 0; |
411 | } |
412 | |
413 | /* |
414 | * Open the PF_KEYv2 sockets and return the descriptor used for notifies. |
415 | * Return -1 for failure and -2 if no notifies will show up. |
416 | */ |
417 | int |
418 | pf_key_v2_open(void) |
419 | { |
420 | int fd = -1, err; |
421 | struct sadb_msg msg; |
422 | struct pf_key_v2_msg *regmsg = 0, *ret = 0; |
423 | |
424 | /* Open the socket we use to speak to IPsec. */ |
425 | pf_key_v2_socket = -1; |
426 | fd = socket(PF_KEY30, SOCK_RAW3, PF_KEY_V22); |
427 | if (fd == -1) { |
428 | log_error("pf_key_v2_open: " |
429 | "socket (PF_KEY, SOCK_RAW, PF_KEY_V2) failed"); |
430 | goto cleanup; |
431 | } |
432 | pf_key_v2_socket = fd; |
433 | |
434 | /* Register it to get ESP and AH acquires from the kernel. */ |
435 | msg.sadb_msg_seq = 0; |
436 | msg.sadb_msg_type = SADB_REGISTER7; |
437 | msg.sadb_msg_satype = SADB_SATYPE_ESP2; |
438 | regmsg = pf_key_v2_msg_new(&msg, 0); |
439 | if (!regmsg) |
440 | goto cleanup; |
441 | ret = pf_key_v2_call(regmsg); |
442 | pf_key_v2_msg_free(regmsg); |
443 | if (!ret) |
444 | goto cleanup; |
445 | err = ((struct sadb_msg *)TAILQ_FIRST(ret)((ret)->tqh_first)->seg)->sadb_msg_errno; |
446 | if (err) { |
447 | log_print("pf_key_v2_open: REGISTER: %s", strerror(err)); |
448 | goto cleanup; |
449 | } |
450 | /* XXX Register the accepted transforms. */ |
451 | |
452 | pf_key_v2_msg_free(ret); |
453 | ret = 0; |
454 | |
455 | msg.sadb_msg_seq = 0; |
456 | msg.sadb_msg_type = SADB_REGISTER7; |
457 | msg.sadb_msg_satype = SADB_SATYPE_AH1; |
458 | regmsg = pf_key_v2_msg_new(&msg, 0); |
459 | if (!regmsg) |
460 | goto cleanup; |
461 | ret = pf_key_v2_call(regmsg); |
462 | pf_key_v2_msg_free(regmsg); |
463 | if (!ret) |
464 | goto cleanup; |
465 | err = ((struct sadb_msg *)TAILQ_FIRST(ret)((ret)->tqh_first)->seg)->sadb_msg_errno; |
466 | if (err) { |
467 | log_print("pf_key_v2_open: REGISTER: %s", strerror(err)); |
468 | goto cleanup; |
469 | } |
470 | /* XXX Register the accepted transforms. */ |
471 | |
472 | pf_key_v2_msg_free(ret); |
473 | ret = 0; |
474 | |
475 | msg.sadb_msg_seq = 0; |
476 | msg.sadb_msg_type = SADB_REGISTER7; |
477 | msg.sadb_msg_satype = SADB_X_SATYPE_IPCOMP9; |
478 | regmsg = pf_key_v2_msg_new(&msg, 0); |
479 | if (!regmsg) |
480 | goto cleanup; |
481 | ret = pf_key_v2_call(regmsg); |
482 | pf_key_v2_msg_free(regmsg); |
483 | if (!ret) |
484 | goto cleanup; |
485 | err = ((struct sadb_msg *)TAILQ_FIRST(ret)((ret)->tqh_first)->seg)->sadb_msg_errno; |
486 | if (err) { |
487 | log_print("pf_key_v2_open: REGISTER: %s", strerror(err)); |
488 | goto cleanup; |
489 | } |
490 | /* XXX Register the accepted transforms. */ |
491 | |
492 | pf_key_v2_msg_free(ret); |
493 | |
494 | return fd; |
495 | |
496 | cleanup: |
497 | if (pf_key_v2_socket != -1) { |
498 | close(pf_key_v2_socket); |
499 | pf_key_v2_socket = -1; |
500 | } |
501 | if (ret) |
502 | pf_key_v2_msg_free(ret); |
503 | return -1; |
504 | } |
505 | |
506 | /* |
507 | * Generate a SPI for protocol PROTO and the source/destination pair given by |
508 | * SRC, SRCLEN, DST & DSTLEN. Stash the SPI size in SZ. |
509 | */ |
510 | u_int8_t * |
511 | pf_key_v2_get_spi(size_t *sz, u_int8_t proto, struct sockaddr *src, |
512 | struct sockaddr *dst, u_int32_t seq) |
513 | { |
514 | struct sadb_msg msg; |
515 | struct sadb_sa *sa; |
516 | struct sadb_address *addr = 0; |
517 | struct sadb_spirange spirange; |
518 | struct pf_key_v2_msg *getspi = 0, *ret = 0; |
519 | struct pf_key_v2_node *ext; |
520 | u_int8_t *spi = 0; |
521 | int len, err; |
522 | |
523 | msg.sadb_msg_type = SADB_GETSPI1; |
524 | switch (proto) { |
525 | case IPSEC_PROTO_IPSEC_ESP3: |
526 | msg.sadb_msg_satype = SADB_SATYPE_ESP2; |
527 | break; |
528 | case IPSEC_PROTO_IPSEC_AH2: |
529 | msg.sadb_msg_satype = SADB_SATYPE_AH1; |
530 | break; |
531 | case IPSEC_PROTO_IPCOMP4: |
532 | msg.sadb_msg_satype = SADB_X_SATYPE_IPCOMP9; |
533 | break; |
534 | default: |
535 | log_print("pf_key_v2_get_spi: invalid proto %d", proto); |
536 | goto cleanup; |
537 | } |
538 | |
539 | /* Set the sequence number from the ACQUIRE message. */ |
540 | msg.sadb_msg_seq = seq; |
541 | getspi = pf_key_v2_msg_new(&msg, 0); |
542 | if (!getspi) |
543 | goto cleanup; |
544 | |
545 | /* Setup the ADDRESS extensions. */ |
546 | len = |
547 | sizeof(struct sadb_address) + PF_KEY_V2_ROUND(SA_LEN(src))(((((src)->sa_len)) + 8 - 1) & ~(8 - 1)); |
548 | addr = calloc(1, len); |
549 | if (!addr) |
550 | goto cleanup; |
551 | addr->sadb_address_exttype = SADB_EXT_ADDRESS_SRC5; |
552 | addr->sadb_address_len = len / PF_KEY_V2_CHUNK8; |
553 | addr->sadb_address_reserved = 0; |
554 | memcpy(addr + 1, src, SA_LEN(src)((src)->sa_len)); |
555 | switch (((struct sockaddr *) (addr + 1))->sa_family) { |
556 | case AF_INET2: |
557 | ((struct sockaddr_in *) (addr + 1))->sin_port = 0; |
558 | break; |
559 | case AF_INET624: |
560 | ((struct sockaddr_in6 *) (addr + 1))->sin6_port = 0; |
561 | break; |
562 | } |
563 | if (pf_key_v2_msg_add(getspi, (struct sadb_ext *) addr, |
564 | PF_KEY_V2_NODE_MALLOCED1) == -1) |
565 | goto cleanup; |
566 | addr = 0; |
567 | |
568 | len = sizeof(struct sadb_address) + PF_KEY_V2_ROUND(SA_LEN(dst))(((((dst)->sa_len)) + 8 - 1) & ~(8 - 1)); |
569 | addr = calloc(1, len); |
570 | if (!addr) |
571 | goto cleanup; |
572 | addr->sadb_address_exttype = SADB_EXT_ADDRESS_DST6; |
573 | addr->sadb_address_len = len / PF_KEY_V2_CHUNK8; |
574 | addr->sadb_address_reserved = 0; |
575 | memcpy(addr + 1, dst, SA_LEN(dst)((dst)->sa_len)); |
576 | switch (((struct sockaddr *) (addr + 1))->sa_family) { |
577 | case AF_INET2: |
578 | ((struct sockaddr_in *) (addr + 1))->sin_port = 0; |
579 | break; |
580 | case AF_INET624: |
581 | ((struct sockaddr_in6 *) (addr + 1))->sin6_port = 0; |
582 | break; |
583 | } |
584 | if (pf_key_v2_msg_add(getspi, (struct sadb_ext *) addr, |
585 | PF_KEY_V2_NODE_MALLOCED1) == -1) |
586 | goto cleanup; |
587 | addr = 0; |
588 | |
589 | /* Setup the SPIRANGE extension. */ |
590 | spirange.sadb_spirange_exttype = SADB_EXT_SPIRANGE16; |
591 | spirange.sadb_spirange_len = sizeof spirange / PF_KEY_V2_CHUNK8; |
592 | if (proto == IPSEC_PROTO_IPCOMP4) { |
593 | spirange.sadb_spirange_min = CPI_RESERVED_MAX255 + 1; |
594 | spirange.sadb_spirange_max = CPI_PRIVATE_MIN61440 - 1; |
595 | } else { |
596 | spirange.sadb_spirange_min = IPSEC_SPI_LOW0x100; |
597 | spirange.sadb_spirange_max = 0xffffffff; |
598 | } |
599 | spirange.sadb_spirange_reserved = 0; |
600 | if (pf_key_v2_msg_add(getspi, (struct sadb_ext *)&spirange, 0) == -1) |
601 | goto cleanup; |
602 | |
603 | ret = pf_key_v2_call(getspi); |
604 | pf_key_v2_msg_free(getspi); |
605 | getspi = 0; |
606 | if (!ret) |
607 | goto cleanup; |
608 | err = ((struct sadb_msg *)TAILQ_FIRST(ret)((ret)->tqh_first)->seg)->sadb_msg_errno; |
609 | if (err) { |
610 | log_print("pf_key_v2_get_spi: GETSPI: %s", strerror(err)); |
611 | goto cleanup; |
612 | } |
613 | ext = pf_key_v2_find_ext(ret, SADB_EXT_SA1); |
614 | if (!ext) { |
615 | log_print("pf_key_v2_get_spi: no SA extension found"); |
616 | goto cleanup; |
617 | } |
618 | sa = ext->seg; |
619 | |
620 | /* IPCOMP CPIs are only 16 bits long. */ |
621 | *sz = (proto == IPSEC_PROTO_IPCOMP4) ? sizeof(u_int16_t) |
622 | : sizeof sa->sadb_sa_spi; |
623 | spi = malloc(*sz); |
624 | if (!spi) |
625 | goto cleanup; |
626 | /* XXX This is ugly. */ |
627 | if (proto == IPSEC_PROTO_IPCOMP4) { |
628 | u_int32_t tspi = ntohl(sa->sadb_sa_spi)(__uint32_t)(__builtin_constant_p(sa->sadb_sa_spi) ? (__uint32_t )(((__uint32_t)(sa->sadb_sa_spi) & 0xff) << 24 | ((__uint32_t)(sa->sadb_sa_spi) & 0xff00) << 8 | ((__uint32_t)(sa->sadb_sa_spi) & 0xff0000) >> 8 | ((__uint32_t)(sa->sadb_sa_spi) & 0xff000000) >> 24) : __swap32md(sa->sadb_sa_spi)); |
629 | *(u_int16_t *) spi = htons((u_int16_t) tspi)(__uint16_t)(__builtin_constant_p((u_int16_t) tspi) ? (__uint16_t )(((__uint16_t)((u_int16_t) tspi) & 0xffU) << 8 | ( (__uint16_t)((u_int16_t) tspi) & 0xff00U) >> 8) : __swap16md ((u_int16_t) tspi)); |
630 | } else |
631 | memcpy(spi, &sa->sadb_sa_spi, *sz); |
632 | |
633 | pf_key_v2_msg_free(ret); |
634 | |
635 | LOG_DBG_BUF((LOG_SYSDEP, 50, "pf_key_v2_get_spi: spi", spi, *sz))log_debug_buf (LOG_SYSDEP, 50, "pf_key_v2_get_spi: spi", spi, *sz); |
636 | return spi; |
637 | |
638 | cleanup: |
639 | free(spi); |
640 | free(addr); |
641 | if (getspi) |
642 | pf_key_v2_msg_free(getspi); |
643 | if (ret) |
644 | pf_key_v2_msg_free(ret); |
645 | return 0; |
646 | } |
647 | |
648 | /* Fetch SA information from the kernel. XXX OpenBSD only? */ |
649 | struct sa_kinfo * |
650 | pf_key_v2_get_kernel_sa(u_int8_t *spi, size_t spi_sz, u_int8_t proto, |
651 | struct sockaddr *dst) |
652 | { |
653 | struct sadb_msg msg; |
654 | struct sadb_sa *ssa; |
655 | struct sadb_address *addr = 0; |
656 | struct sockaddr *sa; |
657 | struct sadb_lifetime *life; |
658 | struct pf_key_v2_msg *gettdb = 0, *ret = 0; |
659 | struct pf_key_v2_node *ext; |
660 | static struct sa_kinfo ksa; |
661 | struct sadb_x_udpencap *udpencap; |
662 | int len, err; |
663 | |
664 | if (spi_sz != sizeof (ssa->sadb_sa_spi)) |
665 | return 0; |
666 | |
667 | msg.sadb_msg_type = SADB_GET5; |
668 | switch (proto) { |
669 | case IPSEC_PROTO_IPSEC_ESP3: |
670 | msg.sadb_msg_satype = SADB_SATYPE_ESP2; |
671 | break; |
672 | case IPSEC_PROTO_IPSEC_AH2: |
673 | msg.sadb_msg_satype = SADB_SATYPE_AH1; |
674 | break; |
675 | case IPSEC_PROTO_IPCOMP4: |
676 | msg.sadb_msg_satype = SADB_X_SATYPE_IPCOMP9; |
677 | break; |
678 | default: |
679 | log_print("pf_key_v2_get_kernel_sa: invalid proto %d", proto); |
680 | goto cleanup; |
681 | } |
682 | |
683 | gettdb = pf_key_v2_msg_new(&msg, 0); |
684 | if (!gettdb) |
685 | goto cleanup; |
686 | |
687 | /* SPI */ |
688 | ssa = calloc(1, sizeof *ssa); |
689 | if (!ssa) { |
690 | log_print("pf_key_v2_get_kernel_sa: calloc(1, %lu) failed", |
691 | (unsigned long)sizeof *ssa); |
692 | goto cleanup; |
693 | } |
694 | |
695 | ssa->sadb_sa_exttype = SADB_EXT_SA1; |
696 | ssa->sadb_sa_len = sizeof *ssa / PF_KEY_V2_CHUNK8; |
697 | memcpy(&ssa->sadb_sa_spi, spi, sizeof ssa->sadb_sa_spi); |
698 | ssa->sadb_sa_state = SADB_SASTATE_MATURE1; |
699 | if (pf_key_v2_msg_add(gettdb, (struct sadb_ext *)ssa, |
700 | PF_KEY_V2_NODE_MALLOCED1) == -1) |
701 | goto cleanup; |
702 | ssa = 0; |
703 | |
704 | /* Address */ |
705 | len = |
706 | sizeof(struct sadb_address) + PF_KEY_V2_ROUND(SA_LEN(dst))(((((dst)->sa_len)) + 8 - 1) & ~(8 - 1)); |
707 | addr = calloc(1, len); |
708 | if (!addr) |
709 | goto cleanup; |
710 | addr->sadb_address_exttype = SADB_EXT_ADDRESS_DST6; |
711 | addr->sadb_address_len = len / PF_KEY_V2_CHUNK8; |
712 | addr->sadb_address_reserved = 0; |
713 | memcpy(addr + 1, dst, SA_LEN(dst)((dst)->sa_len)); |
714 | switch (((struct sockaddr *) (addr + 1))->sa_family) { |
715 | case AF_INET2: |
716 | ((struct sockaddr_in *) (addr + 1))->sin_port = 0; |
717 | break; |
718 | case AF_INET624: |
719 | ((struct sockaddr_in6 *) (addr + 1))->sin6_port = 0; |
720 | break; |
721 | } |
722 | if (pf_key_v2_msg_add(gettdb, (struct sadb_ext *)addr, |
723 | PF_KEY_V2_NODE_MALLOCED1) == -1) |
724 | goto cleanup; |
725 | addr = 0; |
726 | |
727 | ret = pf_key_v2_call(gettdb); |
728 | pf_key_v2_msg_free(gettdb); |
729 | gettdb = 0; |
730 | if (!ret) |
731 | goto cleanup; |
732 | err = ((struct sadb_msg *)TAILQ_FIRST(ret)((ret)->tqh_first)->seg)->sadb_msg_errno; |
733 | if (err) { |
734 | log_print("pf_key_v2_get_kernel_sa: SADB_GET: %s", |
735 | strerror(err)); |
736 | goto cleanup; |
737 | } |
738 | |
739 | /* Extract the data. */ |
740 | bzero(&ksa, sizeof ksa); |
741 | |
742 | ext = pf_key_v2_find_ext(ret, SADB_EXT_SA1); |
743 | if (!ext) |
744 | goto cleanup; |
745 | |
746 | ssa = (struct sadb_sa *)ext; |
747 | ksa.spi = ssa->sadb_sa_spi; |
748 | ksa.wnd = ssa->sadb_sa_replay; |
749 | ksa.flags = ssa->sadb_sa_flags; |
750 | |
751 | ext = pf_key_v2_find_ext(ret, SADB_EXT_LIFETIME_CURRENT2); |
752 | if (ext) { |
753 | life = (struct sadb_lifetime *)ext->seg; |
754 | ksa.cur_allocations = life->sadb_lifetime_allocations; |
755 | ksa.cur_bytes = life->sadb_lifetime_bytes; |
756 | ksa.first_use = life->sadb_lifetime_usetime; |
757 | ksa.established = life->sadb_lifetime_addtime; |
758 | } |
759 | |
760 | ext = pf_key_v2_find_ext(ret, SADB_EXT_LIFETIME_SOFT4); |
761 | if (ext) { |
762 | life = (struct sadb_lifetime *)ext->seg; |
763 | ksa.soft_allocations = life->sadb_lifetime_allocations; |
764 | ksa.soft_bytes = life->sadb_lifetime_bytes; |
765 | ksa.soft_timeout = life->sadb_lifetime_addtime; |
766 | ksa.soft_first_use = life->sadb_lifetime_usetime; |
767 | } |
768 | |
769 | ext = pf_key_v2_find_ext(ret, SADB_EXT_LIFETIME_HARD3); |
770 | if (ext) { |
771 | life = (struct sadb_lifetime *)ext->seg; |
772 | ksa.exp_allocations = life->sadb_lifetime_allocations; |
773 | ksa.exp_bytes = life->sadb_lifetime_bytes; |
774 | ksa.exp_timeout = life->sadb_lifetime_addtime; |
775 | ksa.exp_first_use = life->sadb_lifetime_usetime; |
776 | } |
777 | |
778 | ext = pf_key_v2_find_ext(ret, SADB_X_EXT_LIFETIME_LASTUSE32); |
779 | if (ext) { |
780 | life = (struct sadb_lifetime *)ext->seg; |
781 | ksa.last_used = life->sadb_lifetime_usetime; |
782 | } |
783 | |
784 | ext = pf_key_v2_find_ext(ret, SADB_EXT_ADDRESS_SRC5); |
785 | if (ext) { |
786 | sa = (struct sockaddr *)ext->seg; |
787 | memcpy(&ksa.src, sa, |
788 | sa->sa_family == AF_INET2 ? sizeof(struct sockaddr_in) : |
789 | sizeof(struct sockaddr_in6)); |
790 | } |
791 | |
792 | ext = pf_key_v2_find_ext(ret, SADB_EXT_ADDRESS_DST6); |
793 | if (ext) { |
794 | sa = (struct sockaddr *)ext->seg; |
795 | memcpy(&ksa.dst, sa, |
796 | sa->sa_family == AF_INET2 ? sizeof(struct sockaddr_in) : |
797 | sizeof(struct sockaddr_in6)); |
798 | } |
799 | |
800 | ext = pf_key_v2_find_ext(ret, SADB_X_EXT_UDPENCAP31); |
801 | if (ext) { |
802 | udpencap = (struct sadb_x_udpencap *)ext->seg; |
803 | ksa.udpencap_port = udpencap->sadb_x_udpencap_port; |
804 | } |
805 | |
806 | pf_key_v2_msg_free(ret); |
807 | |
808 | LOG_DBG_BUF((LOG_SYSDEP, 50, "pf_key_v2_get_kernel_sa: spi", spi,log_debug_buf (LOG_SYSDEP, 50, "pf_key_v2_get_kernel_sa: spi" , spi, spi_sz) |
809 | spi_sz))log_debug_buf (LOG_SYSDEP, 50, "pf_key_v2_get_kernel_sa: spi" , spi, spi_sz); |
810 | |
811 | return &ksa; |
812 | |
813 | cleanup: |
814 | free(addr); |
815 | if (gettdb) |
816 | pf_key_v2_msg_free(gettdb); |
817 | if (ret) |
818 | pf_key_v2_msg_free(ret); |
819 | return 0; |
820 | } |
821 | |
822 | static void |
823 | pf_key_v2_setup_sockaddr(void *res, struct sockaddr *src, |
824 | struct sockaddr *dst, in_port_t port, int ingress) |
825 | { |
826 | struct sockaddr_in *ip4_sa; |
827 | struct sockaddr_in6 *ip6_sa; |
828 | u_int8_t *p; |
829 | |
830 | switch (src->sa_family) { |
831 | case AF_INET2: |
832 | ip4_sa = (struct sockaddr_in *) res; |
833 | ip4_sa->sin_family = AF_INET2; |
834 | ip4_sa->sin_len = sizeof *ip4_sa; |
835 | ip4_sa->sin_port = port; |
836 | if (dst) |
837 | p = (u_int8_t *) (ingress ? |
838 | &((struct sockaddr_in *)src)->sin_addr.s_addr : |
839 | &((struct sockaddr_in *)dst)->sin_addr.s_addr); |
840 | else |
841 | p = (u_int8_t *)&((struct sockaddr_in *)src)->sin_addr.s_addr; |
842 | ip4_sa->sin_addr.s_addr = *((in_addr_t *) p); |
843 | break; |
844 | |
845 | case AF_INET624: |
846 | ip6_sa = (struct sockaddr_in6 *) res; |
847 | ip6_sa->sin6_family = AF_INET624; |
848 | ip6_sa->sin6_len = sizeof *ip6_sa; |
849 | ip6_sa->sin6_port = port; |
850 | if (dst) |
851 | p = (u_int8_t *) (ingress ? |
852 | &((struct sockaddr_in6 *)src)->sin6_addr.s6_addr__u6_addr.__u6_addr8 : |
853 | &((struct sockaddr_in6 *)dst)->sin6_addr.s6_addr__u6_addr.__u6_addr8); |
854 | else |
855 | p = (u_int8_t *)&((struct sockaddr_in6 *)src)->sin6_addr.s6_addr__u6_addr.__u6_addr8; |
856 | memcpy(ip6_sa->sin6_addr.s6_addr__u6_addr.__u6_addr8, p, sizeof(struct in6_addr)); |
857 | break; |
858 | |
859 | default: |
860 | log_print("pf_key_v2_setup_sockaddr: unknown family %d\n", |
861 | src->sa_family); |
862 | break; |
863 | } |
864 | } |
865 | |
866 | /* |
867 | * Store/update a PF_KEY_V2 security association with full information from the |
868 | * IKE SA and PROTO into the kernel. INCOMING is set if we are setting the |
869 | * parameters for the incoming SA, and cleared otherwise. |
870 | */ |
871 | int |
872 | pf_key_v2_set_spi(struct sa *sa, struct proto *proto, int incoming, |
873 | struct sa *isakmp_sa) |
874 | { |
875 | struct sadb_msg msg; |
876 | struct sadb_sa ssa; |
877 | struct sadb_x_tag *stag = NULL((void *)0); |
878 | struct sadb_lifetime *life = 0; |
879 | struct sadb_address *addr = 0; |
880 | struct sadb_key *key = 0; |
881 | struct sadb_ident *sid = 0; |
882 | struct sockaddr *src, *dst; |
883 | struct pf_key_v2_msg *update = 0, *ret = 0; |
884 | struct ipsec_proto *iproto = proto->data; |
885 | size_t len; |
886 | int keylen, hashlen, err; |
887 | u_int8_t *pp; |
888 | int idtype; |
889 | struct ipsec_sa *isa = sa->data; |
890 | struct sadb_protocol flowtype, tprotocol; |
891 | struct sadb_x_udpencap udpencap; |
892 | char *addr_str, *s; |
893 | |
894 | msg.sadb_msg_type = incoming ? SADB_UPDATE2 : SADB_ADD3; |
895 | switch (proto->proto) { |
896 | case IPSEC_PROTO_IPSEC_ESP3: |
897 | msg.sadb_msg_satype = SADB_SATYPE_ESP2; |
898 | keylen = ipsec_esp_enckeylength(proto); |
899 | hashlen = ipsec_esp_authkeylength(proto); |
900 | |
901 | switch (proto->id) { |
902 | case IPSEC_ESP_3DES3: |
903 | ssa.sadb_sa_encrypt = SADB_EALG_3DESCBC3; |
904 | break; |
905 | |
906 | case IPSEC_ESP_AES12: |
907 | ssa.sadb_sa_encrypt = SADB_X_EALG_AES12; |
908 | break; |
909 | |
910 | case IPSEC_ESP_AES_CTR13: |
911 | ssa.sadb_sa_encrypt = SADB_X_EALG_AESCTR13; |
912 | break; |
913 | |
914 | case IPSEC_ESP_AES_GCM_1620: |
915 | ssa.sadb_sa_encrypt = SADB_X_EALG_AESGCM1620; |
916 | break; |
917 | |
918 | case IPSEC_ESP_AES_GMAC23: |
919 | ssa.sadb_sa_encrypt = SADB_X_EALG_AESGMAC21; |
920 | break; |
921 | |
922 | case IPSEC_ESP_CAST6: |
923 | ssa.sadb_sa_encrypt = SADB_X_EALG_CAST6; |
924 | break; |
925 | |
926 | case IPSEC_ESP_BLOWFISH7: |
927 | ssa.sadb_sa_encrypt = SADB_X_EALG_BLF7; |
928 | break; |
929 | |
930 | case IPSEC_ESP_NULL11: |
931 | ssa.sadb_sa_encrypt = SADB_EALG_NULL11; |
932 | break; |
933 | |
934 | default: |
935 | LOG_DBG((LOG_SYSDEP, 50, "pf_key_v2_set_spi: "log_debug (LOG_SYSDEP, 50, "pf_key_v2_set_spi: " "unknown encryption algorithm %d" , proto->id) |
936 | "unknown encryption algorithm %d", proto->id))log_debug (LOG_SYSDEP, 50, "pf_key_v2_set_spi: " "unknown encryption algorithm %d" , proto->id); |
937 | return -1; |
938 | } |
939 | |
940 | switch (iproto->auth) { |
941 | case IPSEC_AUTH_HMAC_MD51: |
942 | ssa.sadb_sa_auth = SADB_AALG_MD5HMAC2; |
943 | break; |
944 | |
945 | case IPSEC_AUTH_HMAC_SHA2: |
946 | ssa.sadb_sa_auth = SADB_AALG_SHA1HMAC3; |
947 | break; |
948 | |
949 | case IPSEC_AUTH_HMAC_RIPEMD8: |
950 | ssa.sadb_sa_auth = SADB_X_AALG_RIPEMD160HMAC8; |
951 | break; |
952 | |
953 | case IPSEC_AUTH_HMAC_SHA2_2565: |
954 | ssa.sadb_sa_auth = SADB_X_AALG_SHA2_2565; |
955 | break; |
956 | |
957 | case IPSEC_AUTH_HMAC_SHA2_3846: |
958 | ssa.sadb_sa_auth = SADB_X_AALG_SHA2_3846; |
959 | break; |
960 | |
961 | case IPSEC_AUTH_HMAC_SHA2_5127: |
962 | ssa.sadb_sa_auth = SADB_X_AALG_SHA2_5127; |
963 | break; |
964 | |
965 | case IPSEC_AUTH_DES_MAC3: |
966 | case IPSEC_AUTH_KPDK4: |
967 | /* XXX We should be supporting KPDK */ |
968 | LOG_DBG((LOG_SYSDEP, 50, "pf_key_v2_set_spi: "log_debug (LOG_SYSDEP, 50, "pf_key_v2_set_spi: " "unknown authentication algorithm %d" , iproto->auth) |
969 | "unknown authentication algorithm %d",log_debug (LOG_SYSDEP, 50, "pf_key_v2_set_spi: " "unknown authentication algorithm %d" , iproto->auth) |
970 | iproto->auth))log_debug (LOG_SYSDEP, 50, "pf_key_v2_set_spi: " "unknown authentication algorithm %d" , iproto->auth); |
971 | return -1; |
972 | |
973 | default: |
974 | ssa.sadb_sa_auth = SADB_AALG_NONE0; |
975 | } |
976 | break; |
977 | |
978 | case IPSEC_PROTO_IPSEC_AH2: |
979 | msg.sadb_msg_satype = SADB_SATYPE_AH1; |
980 | hashlen = ipsec_ah_keylength(proto); |
981 | keylen = 0; |
982 | |
983 | ssa.sadb_sa_encrypt = SADB_EALG_NONE0; |
984 | switch (proto->id) { |
985 | case IPSEC_AH_MD52: |
986 | ssa.sadb_sa_auth = SADB_AALG_MD5HMAC2; |
987 | break; |
988 | |
989 | case IPSEC_AH_SHA3: |
990 | ssa.sadb_sa_auth = SADB_AALG_SHA1HMAC3; |
991 | break; |
992 | |
993 | case IPSEC_AH_RIPEMD8: |
994 | ssa.sadb_sa_auth = SADB_X_AALG_RIPEMD160HMAC8; |
995 | break; |
996 | |
997 | case IPSEC_AH_SHA2_2565: |
998 | ssa.sadb_sa_auth = SADB_X_AALG_SHA2_2565; |
999 | break; |
1000 | |
1001 | case IPSEC_AH_SHA2_3846: |
1002 | ssa.sadb_sa_auth = SADB_X_AALG_SHA2_3846; |
1003 | break; |
1004 | |
1005 | case IPSEC_AH_SHA2_5127: |
1006 | ssa.sadb_sa_auth = SADB_X_AALG_SHA2_5127; |
1007 | break; |
1008 | |
1009 | default: |
1010 | LOG_DBG((LOG_SYSDEP, 50, "pf_key_v2_set_spi: "log_debug (LOG_SYSDEP, 50, "pf_key_v2_set_spi: " "unknown authentication algorithm %d" , proto->id) |
1011 | "unknown authentication algorithm %d", proto->id))log_debug (LOG_SYSDEP, 50, "pf_key_v2_set_spi: " "unknown authentication algorithm %d" , proto->id); |
1012 | goto cleanup; |
1013 | } |
1014 | break; |
1015 | |
1016 | case IPSEC_PROTO_IPCOMP4: |
1017 | msg.sadb_msg_satype = SADB_X_SATYPE_IPCOMP9; |
1018 | ssa.sadb_sa_auth = SADB_AALG_NONE0; |
1019 | keylen = 0; |
1020 | hashlen = 0; |
1021 | |
1022 | /* |
1023 | * Put compression algorithm type in the sadb_sa_encrypt |
1024 | * field. |
1025 | */ |
1026 | switch (proto->id) { |
1027 | case IPSEC_IPCOMP_OUI1: |
1028 | ssa.sadb_sa_encrypt = SADB_X_CALG_OUI1; |
1029 | break; |
1030 | |
1031 | case IPSEC_IPCOMP_DEFLATE2: |
1032 | ssa.sadb_sa_encrypt = SADB_X_CALG_DEFLATE2; |
1033 | break; |
1034 | |
1035 | default: |
1036 | break; |
1037 | } |
1038 | break; |
1039 | |
1040 | default: |
1041 | log_print("pf_key_v2_set_spi: invalid proto %d", proto->proto); |
1042 | goto cleanup; |
1043 | } |
1044 | if (incoming) |
1045 | sa->transport->vtbl->get_src(sa->transport, &dst); |
1046 | else |
1047 | sa->transport->vtbl->get_dst(sa->transport, &dst); |
1048 | msg.sadb_msg_seq = sa->seq; |
1049 | update = pf_key_v2_msg_new(&msg, 0); |
1050 | if (!update) |
1051 | goto cleanup; |
1052 | |
1053 | /* Setup the rest of the SA extension. */ |
1054 | ssa.sadb_sa_exttype = SADB_EXT_SA1; |
1055 | ssa.sadb_sa_len = sizeof ssa / PF_KEY_V2_CHUNK8; |
1056 | if (proto->spi_sz[incoming] == 2) /* IPCOMP uses 16bit CPIs. */ |
1057 | ssa.sadb_sa_spi = htonl(proto->spi[incoming][0] << 8 |(__uint32_t)(__builtin_constant_p(proto->spi[incoming][0] << 8 | proto->spi[incoming][1]) ? (__uint32_t)(((__uint32_t) (proto->spi[incoming][0] << 8 | proto->spi[incoming ][1]) & 0xff) << 24 | ((__uint32_t)(proto->spi[incoming ][0] << 8 | proto->spi[incoming][1]) & 0xff00) << 8 | ((__uint32_t)(proto->spi[incoming][0] << 8 | proto ->spi[incoming][1]) & 0xff0000) >> 8 | ((__uint32_t )(proto->spi[incoming][0] << 8 | proto->spi[incoming ][1]) & 0xff000000) >> 24) : __swap32md(proto->spi [incoming][0] << 8 | proto->spi[incoming][1])) |
1058 | proto->spi[incoming][1])(__uint32_t)(__builtin_constant_p(proto->spi[incoming][0] << 8 | proto->spi[incoming][1]) ? (__uint32_t)(((__uint32_t) (proto->spi[incoming][0] << 8 | proto->spi[incoming ][1]) & 0xff) << 24 | ((__uint32_t)(proto->spi[incoming ][0] << 8 | proto->spi[incoming][1]) & 0xff00) << 8 | ((__uint32_t)(proto->spi[incoming][0] << 8 | proto ->spi[incoming][1]) & 0xff0000) >> 8 | ((__uint32_t )(proto->spi[incoming][0] << 8 | proto->spi[incoming ][1]) & 0xff000000) >> 24) : __swap32md(proto->spi [incoming][0] << 8 | proto->spi[incoming][1])); |
1059 | else |
1060 | memcpy(&ssa.sadb_sa_spi, proto->spi[incoming], |
1061 | sizeof ssa.sadb_sa_spi); |
1062 | ssa.sadb_sa_replay = conf_get_str("General", "Shared-SADB") ? 0 : |
1063 | iproto->replay_window; |
1064 | ssa.sadb_sa_state = SADB_SASTATE_MATURE1; |
1065 | ssa.sadb_sa_flags = 0; |
1066 | if (iproto->encap_mode == IPSEC_ENCAP_TUNNEL1 || |
1067 | iproto->encap_mode == IPSEC_ENCAP_UDP_ENCAP_TUNNEL3 || |
1068 | iproto->encap_mode == IPSEC_ENCAP_UDP_ENCAP_TUNNEL_DRAFT61443) |
1069 | ssa.sadb_sa_flags = SADB_X_SAFLAGS_TUNNEL0x004; |
1070 | |
1071 | if (isakmp_sa->flags & SA_FLAG_NAT_T_ENABLE0x100) { |
1072 | bzero(&udpencap, sizeof udpencap); |
1073 | ssa.sadb_sa_flags |= SADB_X_SAFLAGS_UDPENCAP0x200; |
1074 | udpencap.sadb_x_udpencap_exttype = SADB_X_EXT_UDPENCAP31; |
1075 | udpencap.sadb_x_udpencap_len = |
1076 | sizeof udpencap / PF_KEY_V2_CHUNK8; |
1077 | udpencap.sadb_x_udpencap_port = sockaddr_port(dst); |
1078 | if (pf_key_v2_msg_add(update, (struct sadb_ext *)&udpencap, 0) |
1079 | == -1) |
1080 | goto cleanup; |
1081 | } |
1082 | |
1083 | if (pf_key_v2_msg_add(update, (struct sadb_ext *)&ssa, 0) == -1) |
1084 | goto cleanup; |
1085 | |
1086 | if (sa->seconds || sa->kilobytes) { |
1087 | /* Setup the hard limits. */ |
1088 | life = malloc(sizeof *life); |
1089 | if (!life) |
1090 | goto cleanup; |
1091 | life->sadb_lifetime_len = sizeof *life / PF_KEY_V2_CHUNK8; |
1092 | life->sadb_lifetime_exttype = SADB_EXT_LIFETIME_HARD3; |
1093 | life->sadb_lifetime_allocations = 0; |
1094 | life->sadb_lifetime_bytes = sa->kilobytes * 1024; |
1095 | /* |
1096 | * XXX I am not sure which one is best in security respect. |
1097 | * Maybe the RFCs actually mandate what a lifetime really is. |
1098 | */ |
1099 | #if 0 |
1100 | life->sadb_lifetime_addtime = 0; |
1101 | life->sadb_lifetime_usetime = sa->seconds; |
1102 | #else |
1103 | life->sadb_lifetime_addtime = sa->seconds; |
1104 | life->sadb_lifetime_usetime = 0; |
1105 | #endif |
1106 | if (pf_key_v2_msg_add(update, (struct sadb_ext *) life, |
1107 | PF_KEY_V2_NODE_MALLOCED1) == -1) |
1108 | goto cleanup; |
1109 | life = 0; |
1110 | |
1111 | /* |
1112 | * Setup the soft limits, we use 90 % of the hard ones. |
1113 | * XXX A configurable ratio would be better. |
1114 | */ |
1115 | life = malloc(sizeof *life); |
1116 | if (!life) |
1117 | goto cleanup; |
1118 | life->sadb_lifetime_len = sizeof *life / PF_KEY_V2_CHUNK8; |
1119 | life->sadb_lifetime_exttype = SADB_EXT_LIFETIME_SOFT4; |
1120 | life->sadb_lifetime_allocations = 0; |
1121 | life->sadb_lifetime_bytes = sa->kilobytes * 1024 * 9 / 10; |
1122 | /* |
1123 | * XXX I am not sure which one is best in security respect. |
1124 | * Maybe the RFCs actually mandate what a lifetime really is. |
1125 | */ |
1126 | #if 0 |
1127 | life->sadb_lifetime_addtime = 0; |
1128 | life->sadb_lifetime_usetime = sa->seconds * 9 / 10; |
1129 | #else |
1130 | life->sadb_lifetime_addtime = sa->seconds * 9 / 10; |
1131 | life->sadb_lifetime_usetime = 0; |
1132 | #endif |
1133 | if (pf_key_v2_msg_add(update, (struct sadb_ext *) life, |
1134 | PF_KEY_V2_NODE_MALLOCED1) == -1) |
1135 | goto cleanup; |
1136 | life = 0; |
1137 | } |
1138 | /* |
1139 | * Setup the ADDRESS extensions. |
1140 | */ |
1141 | if (incoming) |
1142 | sa->transport->vtbl->get_dst(sa->transport, &src); |
1143 | else |
1144 | sa->transport->vtbl->get_src(sa->transport, &src); |
1145 | len = sizeof *addr + PF_KEY_V2_ROUND(SA_LEN(src))(((((src)->sa_len)) + 8 - 1) & ~(8 - 1)); |
1146 | addr = calloc(1, len); |
1147 | if (!addr) |
1148 | goto cleanup; |
1149 | addr->sadb_address_exttype = SADB_EXT_ADDRESS_SRC5; |
1150 | addr->sadb_address_len = len / PF_KEY_V2_CHUNK8; |
1151 | addr->sadb_address_reserved = 0; |
1152 | memcpy(addr + 1, src, SA_LEN(src)((src)->sa_len)); |
1153 | switch (((struct sockaddr *) (addr + 1))->sa_family) { |
1154 | case AF_INET2: |
1155 | ((struct sockaddr_in *) (addr + 1))->sin_port = 0; |
1156 | break; |
1157 | case AF_INET624: |
1158 | ((struct sockaddr_in6 *) (addr + 1))->sin6_port = 0; |
1159 | break; |
1160 | } |
1161 | if (pf_key_v2_msg_add(update, (struct sadb_ext *) addr, |
1162 | PF_KEY_V2_NODE_MALLOCED1) == -1) |
1163 | goto cleanup; |
1164 | addr = 0; |
1165 | |
1166 | len = sizeof *addr + PF_KEY_V2_ROUND(SA_LEN(dst))(((((dst)->sa_len)) + 8 - 1) & ~(8 - 1)); |
1167 | addr = calloc(1, len); |
1168 | if (!addr) |
1169 | goto cleanup; |
1170 | addr->sadb_address_exttype = SADB_EXT_ADDRESS_DST6; |
1171 | addr->sadb_address_len = len / PF_KEY_V2_CHUNK8; |
1172 | addr->sadb_address_reserved = 0; |
1173 | memcpy(addr + 1, dst, SA_LEN(dst)((dst)->sa_len)); |
1174 | switch (((struct sockaddr *) (addr + 1))->sa_family) { |
1175 | case AF_INET2: |
1176 | ((struct sockaddr_in *) (addr + 1))->sin_port = 0; |
1177 | break; |
1178 | case AF_INET624: |
1179 | ((struct sockaddr_in6 *) (addr + 1))->sin6_port = 0; |
1180 | break; |
1181 | } |
1182 | if (pf_key_v2_msg_add(update, (struct sadb_ext *) addr, |
1183 | PF_KEY_V2_NODE_MALLOCED1) == -1) |
1184 | goto cleanup; |
1185 | addr = 0; |
1186 | |
1187 | if (proto->proto != IPSEC_PROTO_IPCOMP4) { |
1188 | /* Setup the KEY extensions. */ |
1189 | if (hashlen) { |
1190 | len = sizeof *key + PF_KEY_V2_ROUND(hashlen)(((hashlen) + 8 - 1) & ~(8 - 1)); |
1191 | key = malloc(len); |
1192 | if (!key) |
1193 | goto cleanup; |
1194 | key->sadb_key_exttype = SADB_EXT_KEY_AUTH8; |
1195 | key->sadb_key_len = len / PF_KEY_V2_CHUNK8; |
1196 | key->sadb_key_bits = hashlen * 8; |
1197 | key->sadb_key_reserved = 0; |
1198 | memcpy(key + 1, |
1199 | iproto->keymat[incoming] + |
1200 | (proto->proto == |
1201 | IPSEC_PROTO_IPSEC_ESP3 ? keylen : 0), |
1202 | hashlen); |
1203 | if (pf_key_v2_msg_add(update, (struct sadb_ext *) key, |
1204 | PF_KEY_V2_NODE_MALLOCED1) == -1) |
1205 | goto cleanup; |
1206 | key = 0; |
1207 | } |
1208 | if (keylen) { |
1209 | len = sizeof *key + PF_KEY_V2_ROUND(keylen)(((keylen) + 8 - 1) & ~(8 - 1)); |
1210 | key = malloc(len); |
1211 | if (!key) |
1212 | goto cleanup; |
1213 | key->sadb_key_exttype = SADB_EXT_KEY_ENCRYPT9; |
1214 | key->sadb_key_len = len / PF_KEY_V2_CHUNK8; |
1215 | key->sadb_key_bits = keylen * 8; |
1216 | key->sadb_key_reserved = 0; |
1217 | memcpy(key + 1, iproto->keymat[incoming], keylen); |
1218 | if (pf_key_v2_msg_add(update, (struct sadb_ext *) key, |
1219 | PF_KEY_V2_NODE_MALLOCED1) == -1) |
1220 | goto cleanup; |
1221 | key = 0; |
1222 | } |
1223 | } |
1224 | /* Setup identity extensions. */ |
1225 | if (isakmp_sa->id_i) { |
1226 | pp = pf_key_v2_convert_id(isakmp_sa->id_i, isakmp_sa->id_i_len, |
1227 | &len, &idtype); |
1228 | if (!pp) |
1229 | goto nosid; |
1230 | |
1231 | sid = calloc(PF_KEY_V2_ROUND(len + 1)(((len + 1) + 8 - 1) & ~(8 - 1)) + sizeof *sid, |
Result of 'calloc' is converted to a pointer of type 'struct sadb_ident', which is incompatible with sizeof operand type 'u_int8_t' | |
1232 | sizeof(u_int8_t)); |
1233 | if (!sid) { |
1234 | free(pp); |
1235 | goto cleanup; |
1236 | } |
1237 | sid->sadb_ident_type = idtype; |
1238 | sid->sadb_ident_len = ((sizeof *sid) / PF_KEY_V2_CHUNK8) + |
1239 | PF_KEY_V2_ROUND(len + 1)(((len + 1) + 8 - 1) & ~(8 - 1)) / PF_KEY_V2_CHUNK8; |
1240 | if ((isakmp_sa->initiator && !incoming) || |
1241 | (!isakmp_sa->initiator && incoming)) |
1242 | sid->sadb_ident_exttype = SADB_EXT_IDENTITY_SRC10; |
1243 | else |
1244 | sid->sadb_ident_exttype = SADB_EXT_IDENTITY_DST11; |
1245 | |
1246 | memcpy(sid + 1, pp, len); |
1247 | free(pp); |
1248 | |
1249 | if (pf_key_v2_msg_add(update, (struct sadb_ext *) sid, |
1250 | PF_KEY_V2_NODE_MALLOCED1) == -1) |
1251 | goto cleanup; |
1252 | sid = 0; |
1253 | |
1254 | nosid: |
1255 | free(sid); |
1256 | sid = 0; |
1257 | } |
1258 | if (isakmp_sa->id_r) { |
1259 | pp = pf_key_v2_convert_id(isakmp_sa->id_r, isakmp_sa->id_r_len, |
1260 | &len, &idtype); |
1261 | if (!pp) |
1262 | goto nodid; |
1263 | |
1264 | sid = calloc(PF_KEY_V2_ROUND(len + 1)(((len + 1) + 8 - 1) & ~(8 - 1)) + sizeof *sid, |
1265 | sizeof(u_int8_t)); |
1266 | if (!sid) { |
1267 | free(pp); |
1268 | goto cleanup; |
1269 | } |
1270 | sid->sadb_ident_type = idtype; |
1271 | sid->sadb_ident_len = ((sizeof *sid) / PF_KEY_V2_CHUNK8) + |
1272 | PF_KEY_V2_ROUND(len + 1)(((len + 1) + 8 - 1) & ~(8 - 1)) / PF_KEY_V2_CHUNK8; |
1273 | if ((isakmp_sa->initiator && !incoming) || |
1274 | (!isakmp_sa->initiator && incoming)) |
1275 | sid->sadb_ident_exttype = SADB_EXT_IDENTITY_DST11; |
1276 | else |
1277 | sid->sadb_ident_exttype = SADB_EXT_IDENTITY_SRC10; |
1278 | |
1279 | memcpy(sid + 1, pp, len); |
1280 | free(pp); |
1281 | |
1282 | if (pf_key_v2_msg_add(update, (struct sadb_ext *) sid, |
1283 | PF_KEY_V2_NODE_MALLOCED1) == -1) |
1284 | goto cleanup; |
1285 | sid = 0; |
1286 | |
1287 | nodid: |
1288 | free(sid); |
1289 | sid = 0; |
1290 | } |
1291 | |
1292 | /* Setup the flow type extension. */ |
1293 | bzero(&flowtype, sizeof flowtype); |
1294 | flowtype.sadb_protocol_exttype = SADB_X_EXT_FLOW_TYPE20; |
1295 | flowtype.sadb_protocol_len = sizeof flowtype / PF_KEY_V2_CHUNK8; |
1296 | flowtype.sadb_protocol_direction = incoming ? |
1297 | IPSP_DIRECTION_IN0x1 : IPSP_DIRECTION_OUT0x2; |
1298 | |
1299 | if (pf_key_v2_msg_add(update, (struct sadb_ext *)&flowtype, 0) == -1) |
1300 | goto cleanup; |
1301 | |
1302 | bzero(&tprotocol, sizeof tprotocol); |
1303 | tprotocol.sadb_protocol_exttype = SADB_X_EXT_PROTOCOL19; |
1304 | tprotocol.sadb_protocol_len = sizeof tprotocol / PF_KEY_V2_CHUNK8; |
1305 | tprotocol.sadb_protocol_proto = isa->tproto; |
1306 | |
1307 | if (pf_key_v2_msg_add(update, (struct sadb_ext *)&tprotocol, |
1308 | 0) == -1) |
1309 | goto cleanup; |
1310 | |
1311 | len = sizeof *addr + PF_KEY_V2_ROUND(SA_LEN(isa->src_net))(((((isa->src_net)->sa_len)) + 8 - 1) & ~(8 - 1)); |
1312 | addr = calloc(1, len); |
1313 | if (!addr) |
1314 | goto cleanup; |
1315 | addr->sadb_address_exttype = incoming ? |
1316 | SADB_X_EXT_DST_FLOW22 : SADB_X_EXT_SRC_FLOW21; |
1317 | addr->sadb_address_len = len / PF_KEY_V2_CHUNK8; |
1318 | addr->sadb_address_reserved = 0; |
1319 | pf_key_v2_setup_sockaddr(addr + 1, isa->src_net, 0, isa->sport, 0); |
1320 | if (pf_key_v2_msg_add(update, (struct sadb_ext *) addr, |
1321 | PF_KEY_V2_NODE_MALLOCED1) == -1) |
1322 | goto cleanup; |
1323 | addr = 0; |
1324 | |
1325 | addr = calloc(1, len); |
1326 | if (!addr) |
1327 | goto cleanup; |
1328 | addr->sadb_address_exttype = |
1329 | incoming ? SADB_X_EXT_DST_MASK18 : SADB_X_EXT_SRC_MASK17; |
1330 | addr->sadb_address_len = len / PF_KEY_V2_CHUNK8; |
1331 | addr->sadb_address_reserved = 0; |
1332 | pf_key_v2_setup_sockaddr(addr + 1, isa->src_mask, 0, |
1333 | isa->sport ? 0xffff : 0, 0); |
1334 | if (pf_key_v2_msg_add(update, (struct sadb_ext *) addr, |
1335 | PF_KEY_V2_NODE_MALLOCED1) == -1) |
1336 | goto cleanup; |
1337 | addr = 0; |
1338 | |
1339 | addr = calloc(1, len); |
1340 | if (!addr) |
1341 | goto cleanup; |
1342 | addr->sadb_address_exttype = incoming ? |
1343 | SADB_X_EXT_SRC_FLOW21 : SADB_X_EXT_DST_FLOW22; |
1344 | addr->sadb_address_len = len / PF_KEY_V2_CHUNK8; |
1345 | addr->sadb_address_reserved = 0; |
1346 | pf_key_v2_setup_sockaddr(addr + 1, isa->dst_net, 0, isa->dport, 0); |
1347 | if (pf_key_v2_msg_add(update, (struct sadb_ext *) addr, |
1348 | PF_KEY_V2_NODE_MALLOCED1) == -1) |
1349 | goto cleanup; |
1350 | addr = 0; |
1351 | |
1352 | addr = calloc(1, len); |
1353 | if (!addr) |
1354 | goto cleanup; |
1355 | addr->sadb_address_exttype = |
1356 | incoming ? SADB_X_EXT_SRC_MASK17 : SADB_X_EXT_DST_MASK18; |
1357 | addr->sadb_address_len = len / PF_KEY_V2_CHUNK8; |
1358 | addr->sadb_address_reserved = 0; |
1359 | pf_key_v2_setup_sockaddr(addr + 1, isa->dst_mask, 0, |
1360 | isa->dport ? 0xffff : 0, 0); |
1361 | if (pf_key_v2_msg_add(update, (struct sadb_ext *) addr, |
1362 | PF_KEY_V2_NODE_MALLOCED1) == -1) |
1363 | goto cleanup; |
1364 | addr = 0; |
1365 | |
1366 | /* Add a pf tag to matching packets of this SA. */ |
1367 | if (sa->tag != NULL((void *)0)) { |
1368 | len = sizeof(*stag) + PF_KEY_V2_ROUND(strlen(sa->tag) + 1)(((strlen(sa->tag) + 1) + 8 - 1) & ~(8 - 1)); |
1369 | if ((stag = calloc(1, len)) == NULL((void *)0)) |
1370 | goto cleanup; |
1371 | stag->sadb_x_tag_exttype = SADB_X_EXT_TAG33; |
1372 | stag->sadb_x_tag_len = len / PF_KEY_V2_CHUNK8; |
1373 | stag->sadb_x_tag_taglen = strlen(sa->tag) + 1; |
1374 | s = (char *)(stag + 1); |
1375 | strlcpy(s, sa->tag, stag->sadb_x_tag_taglen); |
1376 | if (pf_key_v2_msg_add(update, (struct sadb_ext *)stag, |
1377 | PF_KEY_V2_NODE_MALLOCED1) == -1) |
1378 | goto cleanup; |
1379 | } |
1380 | |
1381 | /* XXX Here can sensitivity extensions be setup. */ |
1382 | |
1383 | if (sockaddr2text(dst, &addr_str, 0)) |
1384 | addr_str = 0; |
1385 | |
1386 | LOG_DBG((LOG_SYSDEP, 10, "pf_key_v2_set_spi: "log_debug (LOG_SYSDEP, 10, "pf_key_v2_set_spi: " "satype %d dst %s SPI 0x%x%s%s" , msg.sadb_msg_satype, addr_str ? addr_str : "unknown", (__uint32_t )(__builtin_constant_p(ssa.sadb_sa_spi) ? (__uint32_t)(((__uint32_t )(ssa.sadb_sa_spi) & 0xff) << 24 | ((__uint32_t)(ssa .sadb_sa_spi) & 0xff00) << 8 | ((__uint32_t)(ssa.sadb_sa_spi ) & 0xff0000) >> 8 | ((__uint32_t)(ssa.sadb_sa_spi) & 0xff000000) >> 24) : __swap32md(ssa.sadb_sa_spi) ), sa->tag ? " tag " : "", sa->tag ? sa->tag : "") |
1387 | "satype %d dst %s SPI 0x%x%s%s", msg.sadb_msg_satype,log_debug (LOG_SYSDEP, 10, "pf_key_v2_set_spi: " "satype %d dst %s SPI 0x%x%s%s" , msg.sadb_msg_satype, addr_str ? addr_str : "unknown", (__uint32_t )(__builtin_constant_p(ssa.sadb_sa_spi) ? (__uint32_t)(((__uint32_t )(ssa.sadb_sa_spi) & 0xff) << 24 | ((__uint32_t)(ssa .sadb_sa_spi) & 0xff00) << 8 | ((__uint32_t)(ssa.sadb_sa_spi ) & 0xff0000) >> 8 | ((__uint32_t)(ssa.sadb_sa_spi) & 0xff000000) >> 24) : __swap32md(ssa.sadb_sa_spi) ), sa->tag ? " tag " : "", sa->tag ? sa->tag : "") |
1388 | addr_str ? addr_str : "unknown",log_debug (LOG_SYSDEP, 10, "pf_key_v2_set_spi: " "satype %d dst %s SPI 0x%x%s%s" , msg.sadb_msg_satype, addr_str ? addr_str : "unknown", (__uint32_t )(__builtin_constant_p(ssa.sadb_sa_spi) ? (__uint32_t)(((__uint32_t )(ssa.sadb_sa_spi) & 0xff) << 24 | ((__uint32_t)(ssa .sadb_sa_spi) & 0xff00) << 8 | ((__uint32_t)(ssa.sadb_sa_spi ) & 0xff0000) >> 8 | ((__uint32_t)(ssa.sadb_sa_spi) & 0xff000000) >> 24) : __swap32md(ssa.sadb_sa_spi) ), sa->tag ? " tag " : "", sa->tag ? sa->tag : "") |
1389 | ntohl(ssa.sadb_sa_spi), sa->tag ? " tag " : "",log_debug (LOG_SYSDEP, 10, "pf_key_v2_set_spi: " "satype %d dst %s SPI 0x%x%s%s" , msg.sadb_msg_satype, addr_str ? addr_str : "unknown", (__uint32_t )(__builtin_constant_p(ssa.sadb_sa_spi) ? (__uint32_t)(((__uint32_t )(ssa.sadb_sa_spi) & 0xff) << 24 | ((__uint32_t)(ssa .sadb_sa_spi) & 0xff00) << 8 | ((__uint32_t)(ssa.sadb_sa_spi ) & 0xff0000) >> 8 | ((__uint32_t)(ssa.sadb_sa_spi) & 0xff000000) >> 24) : __swap32md(ssa.sadb_sa_spi) ), sa->tag ? " tag " : "", sa->tag ? sa->tag : "") |
1390 | sa->tag ? sa->tag : ""))log_debug (LOG_SYSDEP, 10, "pf_key_v2_set_spi: " "satype %d dst %s SPI 0x%x%s%s" , msg.sadb_msg_satype, addr_str ? addr_str : "unknown", (__uint32_t )(__builtin_constant_p(ssa.sadb_sa_spi) ? (__uint32_t)(((__uint32_t )(ssa.sadb_sa_spi) & 0xff) << 24 | ((__uint32_t)(ssa .sadb_sa_spi) & 0xff00) << 8 | ((__uint32_t)(ssa.sadb_sa_spi ) & 0xff0000) >> 8 | ((__uint32_t)(ssa.sadb_sa_spi) & 0xff000000) >> 24) : __swap32md(ssa.sadb_sa_spi) ), sa->tag ? " tag " : "", sa->tag ? sa->tag : ""); |
1391 | |
1392 | free(addr_str); |
1393 | |
1394 | /* |
1395 | * Although PF_KEY knows about expirations, it is unreliable per the |
1396 | * specs thus we need to do them inside isakmpd as well. |
1397 | */ |
1398 | if (sa->seconds) |
1399 | if (sa_setup_expirations(sa)) |
1400 | goto cleanup; |
1401 | |
1402 | ret = pf_key_v2_call(update); |
1403 | pf_key_v2_msg_free(update); |
1404 | update = 0; |
1405 | if (!ret) |
1406 | goto cleanup; |
1407 | err = ((struct sadb_msg *)TAILQ_FIRST(ret)((ret)->tqh_first)->seg)->sadb_msg_errno; |
1408 | pf_key_v2_msg_free(ret); |
1409 | ret = 0; |
1410 | |
1411 | /* |
1412 | * If we are doing an addition into an SADB shared with our peer, |
1413 | * errors here are to be expected as the peer will already have |
1414 | * created the SA, and can thus be ignored. |
1415 | */ |
1416 | if (err && !(msg.sadb_msg_type == SADB_ADD3 && |
1417 | conf_get_str("General", "Shared-SADB"))) { |
1418 | log_print("pf_key_v2_set_spi: %s: %s", |
1419 | msg.sadb_msg_type == SADB_ADD3 ? "ADD" : "UPDATE", |
1420 | strerror(err)); |
1421 | goto cleanup; |
1422 | } |
1423 | LOG_DBG((LOG_SYSDEP, 50, "pf_key_v2_set_spi: done"))log_debug (LOG_SYSDEP, 50, "pf_key_v2_set_spi: done"); |
1424 | |
1425 | return 0; |
1426 | |
1427 | cleanup: |
1428 | free(sid); |
1429 | free(addr); |
1430 | free(life); |
1431 | free(key); |
1432 | if (update) |
1433 | pf_key_v2_msg_free(update); |
1434 | if (ret) |
1435 | pf_key_v2_msg_free(ret); |
1436 | return -1; |
1437 | } |
1438 | |
1439 | static __inline__ int |
1440 | pf_key_v2_mask_to_bits(u_int32_t mask) |
1441 | { |
1442 | u_int32_t hmask = ntohl(mask)(__uint32_t)(__builtin_constant_p(mask) ? (__uint32_t)(((__uint32_t )(mask) & 0xff) << 24 | ((__uint32_t)(mask) & 0xff00 ) << 8 | ((__uint32_t)(mask) & 0xff0000) >> 8 | ((__uint32_t)(mask) & 0xff000000) >> 24) : __swap32md (mask)); |
1443 | |
1444 | return (33 - ffs(~hmask + 1)) % 33; |
1445 | } |
1446 | |
1447 | static int |
1448 | pf_key_v2_mask6_to_bits(u_int8_t *mask) |
1449 | { |
1450 | int n; |
1451 | |
1452 | bit_ffc(mask, 128, &n)do { register bitstr_t *__name = (mask); register int __bit, __nbits = (128), __value = -1; for (__bit = 0; __bit < __nbits; ++ __bit) if (!((__name)[((__bit) >> 3)] & (1 << ((__bit)&0x7)))) { __value = __bit; break; } *(&n) = __value; } while(0); |
1453 | return n == -1 ? 128 : n; |
1454 | } |
1455 | |
1456 | /* |
1457 | * Enable/disable a flow. |
1458 | * XXX Assumes OpenBSD {ADD,DEL}FLOW extensions. |
1459 | */ |
1460 | static int |
1461 | pf_key_v2_flow(struct sockaddr *laddr, struct sockaddr *lmask, |
1462 | struct sockaddr *raddr, struct sockaddr *rmask, |
1463 | u_int8_t tproto, u_int16_t sport, u_int16_t dport, |
1464 | u_int8_t *spi, u_int8_t proto, struct sockaddr *dst, |
1465 | struct sockaddr *src, int delete, int ingress, |
1466 | u_int8_t srcid_type, u_int8_t *srcid, int srcid_len, |
1467 | u_int8_t dstid_type, u_int8_t *dstid, int dstid_len, |
1468 | struct ipsec_proto *iproto) |
1469 | { |
1470 | char *laddr_str, *lmask_str, *raddr_str, *rmask_str; |
1471 | |
1472 | struct sadb_msg msg; |
1473 | struct sadb_protocol flowtype; |
1474 | struct sadb_ident *sid = 0; |
1475 | struct sadb_address *addr = 0; |
1476 | struct sadb_protocol tprotocol; |
1477 | struct pf_key_v2_msg *flow = 0, *ret = 0; |
1478 | size_t len; |
1479 | int err; |
1480 | |
1481 | msg.sadb_msg_type = delete ? SADB_X_DELFLOW13 : SADB_X_ADDFLOW12; |
1482 | switch (proto) { |
1483 | case IPSEC_PROTO_IPSEC_ESP3: |
1484 | msg.sadb_msg_satype = SADB_SATYPE_ESP2; |
1485 | break; |
1486 | case IPSEC_PROTO_IPSEC_AH2: |
1487 | msg.sadb_msg_satype = SADB_SATYPE_AH1; |
1488 | break; |
1489 | case IPSEC_PROTO_IPCOMP4: |
1490 | msg.sadb_msg_satype = SADB_X_SATYPE_IPCOMP9; |
1491 | break; |
1492 | default: |
1493 | log_print("pf_key_v2_flow: invalid proto %d", proto); |
1494 | goto cleanup; |
1495 | } |
1496 | msg.sadb_msg_seq = 0; |
1497 | flow = pf_key_v2_msg_new(&msg, 0); |
1498 | if (!flow) |
1499 | goto cleanup; |
1500 | |
1501 | if (!delete) { |
1502 | /* Setup the source ID, if provided. */ |
1503 | if (srcid) { |
1504 | sid = calloc( |
1505 | PF_KEY_V2_ROUND(srcid_len + 1)(((srcid_len + 1) + 8 - 1) & ~(8 - 1)) + sizeof *sid, |
1506 | sizeof(u_int8_t)); |
1507 | if (!sid) |
1508 | goto cleanup; |
1509 | |
1510 | sid->sadb_ident_len = ((sizeof *sid) / PF_KEY_V2_CHUNK8) |
1511 | + PF_KEY_V2_ROUND(srcid_len + 1)(((srcid_len + 1) + 8 - 1) & ~(8 - 1)) / PF_KEY_V2_CHUNK8; |
1512 | sid->sadb_ident_exttype = SADB_EXT_IDENTITY_SRC10; |
1513 | sid->sadb_ident_type = srcid_type; |
1514 | |
1515 | memcpy(sid + 1, srcid, srcid_len); |
1516 | |
1517 | if (pf_key_v2_msg_add(flow, (struct sadb_ext *) sid, |
1518 | PF_KEY_V2_NODE_MALLOCED1) == -1) |
1519 | goto cleanup; |
1520 | |
1521 | sid = 0; |
1522 | } |
1523 | /* Setup the destination ID, if provided. */ |
1524 | if (dstid) { |
1525 | sid = calloc( |
1526 | PF_KEY_V2_ROUND(dstid_len + 1)(((dstid_len + 1) + 8 - 1) & ~(8 - 1)) + sizeof *sid, |
1527 | sizeof(u_int8_t)); |
1528 | if (!sid) |
1529 | goto cleanup; |
1530 | |
1531 | sid->sadb_ident_len = ((sizeof *sid) / PF_KEY_V2_CHUNK8) |
1532 | + PF_KEY_V2_ROUND(dstid_len + 1)(((dstid_len + 1) + 8 - 1) & ~(8 - 1)) / PF_KEY_V2_CHUNK8; |
1533 | sid->sadb_ident_exttype = SADB_EXT_IDENTITY_DST11; |
1534 | sid->sadb_ident_type = dstid_type; |
1535 | |
1536 | memcpy(sid + 1, dstid, dstid_len); |
1537 | |
1538 | if (pf_key_v2_msg_add(flow, (struct sadb_ext *) sid, |
1539 | PF_KEY_V2_NODE_MALLOCED1) == -1) |
1540 | goto cleanup; |
1541 | |
1542 | sid = 0; |
1543 | } |
1544 | } |
1545 | /* Setup the flow type extension. */ |
1546 | bzero(&flowtype, sizeof flowtype); |
1547 | flowtype.sadb_protocol_exttype = SADB_X_EXT_FLOW_TYPE20; |
1548 | flowtype.sadb_protocol_len = sizeof flowtype / PF_KEY_V2_CHUNK8; |
1549 | flowtype.sadb_protocol_direction = |
1550 | ingress ? IPSP_DIRECTION_IN0x1 : IPSP_DIRECTION_OUT0x2; |
1551 | flowtype.sadb_protocol_proto = SADB_X_FLOW_TYPE_REQUIRE3; |
1552 | |
1553 | if (pf_key_v2_msg_add(flow, (struct sadb_ext *)&flowtype, 0) == -1) |
1554 | goto cleanup; |
1555 | |
1556 | /* |
1557 | * Setup the ADDRESS extensions. |
1558 | */ |
1559 | len = sizeof *addr + PF_KEY_V2_ROUND(SA_LEN(src))(((((src)->sa_len)) + 8 - 1) & ~(8 - 1)); |
1560 | if (!delete) |
1561 | { |
1562 | addr = calloc(1, len); |
1563 | if (!addr) |
1564 | goto cleanup; |
1565 | addr->sadb_address_exttype = SADB_EXT_ADDRESS_DST6; |
1566 | addr->sadb_address_len = len / PF_KEY_V2_CHUNK8; |
1567 | addr->sadb_address_reserved = 0; |
1568 | pf_key_v2_setup_sockaddr(addr + 1, src, dst, 0, ingress); |
1569 | if (pf_key_v2_msg_add(flow, (struct sadb_ext *) addr, |
1570 | PF_KEY_V2_NODE_MALLOCED1) == -1) |
1571 | goto cleanup; |
1572 | addr = 0; |
1573 | } |
1574 | len = sizeof *addr + PF_KEY_V2_ROUND(SA_LEN(laddr))(((((laddr)->sa_len)) + 8 - 1) & ~(8 - 1)); |
1575 | addr = calloc(1, len); |
1576 | if (!addr) |
1577 | goto cleanup; |
1578 | addr->sadb_address_exttype = SADB_X_EXT_SRC_FLOW21; |
1579 | addr->sadb_address_len = len / PF_KEY_V2_CHUNK8; |
1580 | addr->sadb_address_reserved = 0; |
1581 | pf_key_v2_setup_sockaddr(addr + 1, laddr, 0, sport, 0); |
1582 | if (pf_key_v2_msg_add(flow, (struct sadb_ext *) addr, |
1583 | PF_KEY_V2_NODE_MALLOCED1) == -1) |
1584 | goto cleanup; |
1585 | addr = 0; |
1586 | |
1587 | addr = calloc(1, len); |
1588 | if (!addr) |
1589 | goto cleanup; |
1590 | addr->sadb_address_exttype = SADB_X_EXT_SRC_MASK17; |
1591 | addr->sadb_address_len = len / PF_KEY_V2_CHUNK8; |
1592 | addr->sadb_address_reserved = 0; |
1593 | pf_key_v2_setup_sockaddr(addr + 1, lmask, 0, sport ? 0xffff : 0, 0); |
1594 | if (pf_key_v2_msg_add(flow, (struct sadb_ext *) addr, |
1595 | PF_KEY_V2_NODE_MALLOCED1) == -1) |
1596 | goto cleanup; |
1597 | addr = 0; |
1598 | |
1599 | addr = calloc(1, len); |
1600 | if (!addr) |
1601 | goto cleanup; |
1602 | addr->sadb_address_exttype = SADB_X_EXT_DST_FLOW22; |
1603 | addr->sadb_address_len = len / PF_KEY_V2_CHUNK8; |
1604 | addr->sadb_address_reserved = 0; |
1605 | pf_key_v2_setup_sockaddr(addr + 1, raddr, 0, dport, 0); |
1606 | if (pf_key_v2_msg_add(flow, (struct sadb_ext *) addr, |
1607 | PF_KEY_V2_NODE_MALLOCED1) == -1) |
1608 | goto cleanup; |
1609 | addr = 0; |
1610 | |
1611 | addr = calloc(1, len); |
1612 | if (!addr) |
1613 | goto cleanup; |
1614 | addr->sadb_address_exttype = SADB_X_EXT_DST_MASK18; |
1615 | addr->sadb_address_len = len / PF_KEY_V2_CHUNK8; |
1616 | addr->sadb_address_reserved = 0; |
1617 | pf_key_v2_setup_sockaddr(addr + 1, rmask, 0, dport ? 0xffff : 0, 0); |
1618 | if (pf_key_v2_msg_add(flow, (struct sadb_ext *) addr, |
1619 | PF_KEY_V2_NODE_MALLOCED1) == -1) |
1620 | goto cleanup; |
1621 | addr = 0; |
1622 | |
1623 | /* Setup the protocol extension. */ |
1624 | bzero(&tprotocol, sizeof tprotocol); |
1625 | tprotocol.sadb_protocol_exttype = SADB_X_EXT_PROTOCOL19; |
1626 | tprotocol.sadb_protocol_len = sizeof tprotocol / PF_KEY_V2_CHUNK8; |
1627 | tprotocol.sadb_protocol_proto = tproto; |
1628 | |
1629 | if (pf_key_v2_msg_add(flow, (struct sadb_ext *)&tprotocol, 0) == -1) |
1630 | goto cleanup; |
1631 | |
1632 | if (sockaddr2text(laddr, &laddr_str, 0)) |
1633 | laddr_str = 0; |
1634 | if (sockaddr2text(lmask, &lmask_str, 0)) |
1635 | lmask_str = 0; |
1636 | if (sockaddr2text(raddr, &raddr_str, 0)) |
1637 | raddr_str = 0; |
1638 | if (sockaddr2text(rmask, &rmask_str, 0)) |
1639 | rmask_str = 0; |
1640 | |
1641 | LOG_DBG((LOG_SYSDEP, 50,log_debug (LOG_SYSDEP, 50, "pf_key_v2_flow: src %s %s dst %s %s proto %u sport %u dport %u" , laddr_str ? laddr_str : "<??\?>", lmask_str ? lmask_str : "<??\?>", raddr_str ? raddr_str : "<??\?>", rmask_str ? rmask_str : "<??\?>", tproto, (__uint16_t)(__builtin_constant_p (sport) ? (__uint16_t)(((__uint16_t)(sport) & 0xffU) << 8 | ((__uint16_t)(sport) & 0xff00U) >> 8) : __swap16md (sport)), (__uint16_t)(__builtin_constant_p(dport) ? (__uint16_t )(((__uint16_t)(dport) & 0xffU) << 8 | ((__uint16_t )(dport) & 0xff00U) >> 8) : __swap16md(dport))) |
1642 | "pf_key_v2_flow: src %s %s dst %s %s proto %u sport %u dport %u",log_debug (LOG_SYSDEP, 50, "pf_key_v2_flow: src %s %s dst %s %s proto %u sport %u dport %u" , laddr_str ? laddr_str : "<??\?>", lmask_str ? lmask_str : "<??\?>", raddr_str ? raddr_str : "<??\?>", rmask_str ? rmask_str : "<??\?>", tproto, (__uint16_t)(__builtin_constant_p (sport) ? (__uint16_t)(((__uint16_t)(sport) & 0xffU) << 8 | ((__uint16_t)(sport) & 0xff00U) >> 8) : __swap16md (sport)), (__uint16_t)(__builtin_constant_p(dport) ? (__uint16_t )(((__uint16_t)(dport) & 0xffU) << 8 | ((__uint16_t )(dport) & 0xff00U) >> 8) : __swap16md(dport))) |
1643 | laddr_str ? laddr_str : "<??\?>", lmask_str ? lmask_str : "<??\?>",log_debug (LOG_SYSDEP, 50, "pf_key_v2_flow: src %s %s dst %s %s proto %u sport %u dport %u" , laddr_str ? laddr_str : "<??\?>", lmask_str ? lmask_str : "<??\?>", raddr_str ? raddr_str : "<??\?>", rmask_str ? rmask_str : "<??\?>", tproto, (__uint16_t)(__builtin_constant_p (sport) ? (__uint16_t)(((__uint16_t)(sport) & 0xffU) << 8 | ((__uint16_t)(sport) & 0xff00U) >> 8) : __swap16md (sport)), (__uint16_t)(__builtin_constant_p(dport) ? (__uint16_t )(((__uint16_t)(dport) & 0xffU) << 8 | ((__uint16_t )(dport) & 0xff00U) >> 8) : __swap16md(dport))) |
1644 | raddr_str ? raddr_str : "<??\?>", rmask_str ? rmask_str : "<??\?>",log_debug (LOG_SYSDEP, 50, "pf_key_v2_flow: src %s %s dst %s %s proto %u sport %u dport %u" , laddr_str ? laddr_str : "<??\?>", lmask_str ? lmask_str : "<??\?>", raddr_str ? raddr_str : "<??\?>", rmask_str ? rmask_str : "<??\?>", tproto, (__uint16_t)(__builtin_constant_p (sport) ? (__uint16_t)(((__uint16_t)(sport) & 0xffU) << 8 | ((__uint16_t)(sport) & 0xff00U) >> 8) : __swap16md (sport)), (__uint16_t)(__builtin_constant_p(dport) ? (__uint16_t )(((__uint16_t)(dport) & 0xffU) << 8 | ((__uint16_t )(dport) & 0xff00U) >> 8) : __swap16md(dport))) |
1645 | tproto, ntohs(sport), ntohs(dport)))log_debug (LOG_SYSDEP, 50, "pf_key_v2_flow: src %s %s dst %s %s proto %u sport %u dport %u" , laddr_str ? laddr_str : "<??\?>", lmask_str ? lmask_str : "<??\?>", raddr_str ? raddr_str : "<??\?>", rmask_str ? rmask_str : "<??\?>", tproto, (__uint16_t)(__builtin_constant_p (sport) ? (__uint16_t)(((__uint16_t)(sport) & 0xffU) << 8 | ((__uint16_t)(sport) & 0xff00U) >> 8) : __swap16md (sport)), (__uint16_t)(__builtin_constant_p(dport) ? (__uint16_t )(((__uint16_t)(dport) & 0xffU) << 8 | ((__uint16_t )(dport) & 0xff00U) >> 8) : __swap16md(dport))); |
1646 | |
1647 | free(laddr_str); |
1648 | free(lmask_str); |
1649 | free(raddr_str); |
1650 | free(rmask_str); |
1651 | |
1652 | ret = pf_key_v2_call(flow); |
1653 | pf_key_v2_msg_free(flow); |
1654 | flow = 0; |
1655 | if (!ret) |
1656 | goto cleanup; |
1657 | err = ((struct sadb_msg *)TAILQ_FIRST(ret)((ret)->tqh_first)->seg)->sadb_msg_errno; |
1658 | if (err) { |
1659 | if (err == ESRCH3) /* These are common and usually |
1660 | * harmless. */ |
1661 | LOG_DBG((LOG_SYSDEP, 10, "pf_key_v2_flow: %sFLOW: %s",log_debug (LOG_SYSDEP, 10, "pf_key_v2_flow: %sFLOW: %s", delete ? "DEL" : "ADD", strerror(err)) |
1662 | delete ? "DEL" : "ADD", strerror(err)))log_debug (LOG_SYSDEP, 10, "pf_key_v2_flow: %sFLOW: %s", delete ? "DEL" : "ADD", strerror(err)); |
1663 | else |
1664 | log_print("pf_key_v2_flow: %sFLOW: %s", |
1665 | delete ? "DEL" : "ADD", strerror(err)); |
1666 | goto cleanup; |
1667 | } |
1668 | pf_key_v2_msg_free(ret); |
1669 | |
1670 | LOG_DBG((LOG_MISC, 50, "pf_key_v2_flow: %sFLOW: done",log_debug (LOG_MISC, 50, "pf_key_v2_flow: %sFLOW: done", delete ? "DEL" : "ADD") |
1671 | delete ? "DEL" : "ADD"))log_debug (LOG_MISC, 50, "pf_key_v2_flow: %sFLOW: done", delete ? "DEL" : "ADD"); |
1672 | |
1673 | return 0; |
1674 | |
1675 | cleanup: |
1676 | free(sid); |
1677 | free(addr); |
1678 | if (flow) |
1679 | pf_key_v2_msg_free(flow); |
1680 | if (ret) |
1681 | pf_key_v2_msg_free(ret); |
1682 | return -1; |
1683 | } |
1684 | |
1685 | static u_int8_t * |
1686 | pf_key_v2_convert_id(u_int8_t *id, int idlen, size_t *reslen, int *idtype) |
1687 | { |
1688 | u_int8_t *addr, *res = 0; |
1689 | char addrbuf[ADDRESS_MAXsizeof "ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255" + 5]; |
1690 | |
1691 | switch (id[0]) { |
1692 | case IPSEC_ID_FQDN2: |
1693 | res = calloc(idlen - ISAKMP_ID_DATA_OFF8 + ISAKMP_GEN_SZ4, |
1694 | sizeof(u_int8_t)); |
1695 | if (!res) |
1696 | return 0; |
1697 | |
1698 | *reslen = idlen - ISAKMP_ID_DATA_OFF8 + ISAKMP_GEN_SZ4; |
1699 | memcpy(res, id + ISAKMP_ID_DATA_OFF8 - ISAKMP_GEN_SZ4, *reslen); |
1700 | *idtype = SADB_IDENTTYPE_FQDN2; |
1701 | LOG_DBG((LOG_SYSDEP, 40, "pf_key_v2_convert_id: FQDN %.*s",log_debug (LOG_SYSDEP, 40, "pf_key_v2_convert_id: FQDN %.*s", (int) *reslen, res) |
1702 | (int) *reslen, res))log_debug (LOG_SYSDEP, 40, "pf_key_v2_convert_id: FQDN %.*s", (int) *reslen, res); |
1703 | return res; |
1704 | |
1705 | case IPSEC_ID_USER_FQDN3: |
1706 | res = calloc(idlen - ISAKMP_ID_DATA_OFF8 + ISAKMP_GEN_SZ4, |
1707 | sizeof(u_int8_t)); |
1708 | if (!res) |
1709 | return 0; |
1710 | |
1711 | *reslen = idlen - ISAKMP_ID_DATA_OFF8 + ISAKMP_GEN_SZ4; |
1712 | memcpy(res, id + ISAKMP_ID_DATA_OFF8 - ISAKMP_GEN_SZ4, *reslen); |
1713 | *idtype = SADB_IDENTTYPE_USERFQDN3; |
1714 | LOG_DBG((LOG_SYSDEP, 40, "pf_key_v2_convert_id: UFQDN %.*s",log_debug (LOG_SYSDEP, 40, "pf_key_v2_convert_id: UFQDN %.*s" , (int) *reslen, res) |
1715 | (int) *reslen, res))log_debug (LOG_SYSDEP, 40, "pf_key_v2_convert_id: UFQDN %.*s" , (int) *reslen, res); |
1716 | return res; |
1717 | |
1718 | case IPSEC_ID_IPV4_ADDR1: |
1719 | if (inet_ntop(AF_INET2, id + ISAKMP_ID_DATA_OFF8 - ISAKMP_GEN_SZ4, |
1720 | addrbuf, ADDRESS_MAXsizeof "ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255") == NULL((void *)0)) |
1721 | return 0; |
1722 | *reslen = strlen(addrbuf) + 3; |
1723 | strlcat(addrbuf, "/32", ADDRESS_MAXsizeof "ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255" + 5); |
1724 | res = (u_int8_t *) strdup(addrbuf); |
1725 | if (!res) |
1726 | return 0; |
1727 | *idtype = SADB_IDENTTYPE_PREFIX1; |
1728 | LOG_DBG((LOG_SYSDEP, 40, "pf_key_v2_convert_id: "log_debug (LOG_SYSDEP, 40, "pf_key_v2_convert_id: " "IPv4 address %s" , res) |
1729 | "IPv4 address %s", res))log_debug (LOG_SYSDEP, 40, "pf_key_v2_convert_id: " "IPv4 address %s" , res); |
1730 | return res; |
1731 | |
1732 | case IPSEC_ID_IPV6_ADDR5: |
1733 | if (inet_ntop(AF_INET624, |
1734 | id + ISAKMP_ID_DATA_OFF8 - ISAKMP_GEN_SZ4, |
1735 | addrbuf, ADDRESS_MAXsizeof "ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255") == NULL((void *)0)) |
1736 | return 0; |
1737 | *reslen = strlen(addrbuf) + 4; |
1738 | strlcat(addrbuf, "/128", ADDRESS_MAXsizeof "ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255" + 5); |
1739 | res = (u_int8_t *) strdup(addrbuf); |
1740 | if (!res) |
1741 | return 0; |
1742 | LOG_DBG((LOG_SYSDEP, 40, "pf_key_v2_convert_id: "log_debug (LOG_SYSDEP, 40, "pf_key_v2_convert_id: " "IPv6 address %s" , res) |
1743 | "IPv6 address %s", res))log_debug (LOG_SYSDEP, 40, "pf_key_v2_convert_id: " "IPv6 address %s" , res); |
1744 | *idtype = SADB_IDENTTYPE_PREFIX1; |
1745 | return res; |
1746 | |
1747 | case IPSEC_ID_IPV4_ADDR_SUBNET4: /* XXX PREFIX */ |
1748 | addr = id + ISAKMP_ID_DATA_OFF8 - ISAKMP_GEN_SZ4; |
1749 | if (inet_ntop(AF_INET2, addr, addrbuf, ADDRESS_MAXsizeof "ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255") == NULL((void *)0)) |
1750 | return 0; |
1751 | snprintf(addrbuf + strlen(addrbuf), |
1752 | ADDRESS_MAXsizeof "ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255" - strlen(addrbuf), "/%d", |
1753 | pf_key_v2_mask_to_bits(*(u_int32_t *)(addr + |
1754 | sizeof(struct in_addr)))); |
1755 | *reslen = strlen(addrbuf); |
1756 | res = (u_int8_t *) strdup(addrbuf); |
1757 | if (!res) |
1758 | return 0; |
1759 | *idtype = SADB_IDENTTYPE_PREFIX1; |
1760 | LOG_DBG((LOG_SYSDEP, 40, "pf_key_v2_convert_id: "log_debug (LOG_SYSDEP, 40, "pf_key_v2_convert_id: " "IPv4 subnet %s" , res) |
1761 | "IPv4 subnet %s", res))log_debug (LOG_SYSDEP, 40, "pf_key_v2_convert_id: " "IPv4 subnet %s" , res); |
1762 | return res; |
1763 | |
1764 | case IPSEC_ID_IPV6_ADDR_SUBNET6: /* XXX PREFIX */ |
1765 | addr = id + ISAKMP_ID_DATA_OFF8 - ISAKMP_GEN_SZ4; |
1766 | if (inet_ntop(AF_INET624, addr, addrbuf, ADDRESS_MAXsizeof "ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255") == NULL((void *)0)) |
1767 | return 0; |
1768 | snprintf(addrbuf + strlen(addrbuf), |
1769 | ADDRESS_MAXsizeof "ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255" - strlen(addrbuf), "/%d", |
1770 | pf_key_v2_mask6_to_bits(addr + |
1771 | sizeof(struct in6_addr))); |
1772 | *reslen = strlen(addrbuf); |
1773 | res = (u_int8_t *) strdup(addrbuf); |
1774 | if (!res) |
1775 | return 0; |
1776 | LOG_DBG((LOG_SYSDEP, 40, "pf_key_v2_convert_id: "log_debug (LOG_SYSDEP, 40, "pf_key_v2_convert_id: " "IPv6 subnet %s" , res) |
1777 | "IPv6 subnet %s", res))log_debug (LOG_SYSDEP, 40, "pf_key_v2_convert_id: " "IPv6 subnet %s" , res); |
1778 | *idtype = SADB_IDENTTYPE_PREFIX1; |
1779 | return res; |
1780 | |
1781 | case IPSEC_ID_IPV4_RANGE7: |
1782 | case IPSEC_ID_IPV6_RANGE8: |
1783 | case IPSEC_ID_DER_ASN1_DN9: |
1784 | case IPSEC_ID_DER_ASN1_GN10: |
1785 | case IPSEC_ID_KEY_ID11: |
1786 | /* XXX Not implemented yet. */ |
1787 | return 0; |
1788 | } |
1789 | |
1790 | return 0; |
1791 | } |
1792 | |
1793 | /* Enable a flow given an SA. */ |
1794 | int |
1795 | pf_key_v2_enable_sa(struct sa *sa, struct sa *isakmp_sa) |
1796 | { |
1797 | struct ipsec_sa *isa = sa->data; |
1798 | struct sockaddr *dst, *src; |
1799 | int error; |
1800 | struct proto *proto = TAILQ_FIRST(&sa->protos)((&sa->protos)->tqh_first); |
1801 | int sidtype = 0, didtype = 0; |
1802 | size_t sidlen = 0, didlen = 0; |
1803 | u_int8_t *sid = 0, *did = 0; |
1804 | |
1805 | sa->transport->vtbl->get_dst(sa->transport, &dst); |
1806 | sa->transport->vtbl->get_src(sa->transport, &src); |
1807 | |
1808 | if (isakmp_sa->id_i) { |
1809 | if (isakmp_sa->initiator) |
1810 | sid = pf_key_v2_convert_id(isakmp_sa->id_i, |
1811 | isakmp_sa->id_i_len, &sidlen, &sidtype); |
1812 | else |
1813 | did = pf_key_v2_convert_id(isakmp_sa->id_i, |
1814 | isakmp_sa->id_i_len, &didlen, &didtype); |
1815 | } |
1816 | if (isakmp_sa->id_r) { |
1817 | if (isakmp_sa->initiator) |
1818 | did = pf_key_v2_convert_id(isakmp_sa->id_r, |
1819 | isakmp_sa->id_r_len, &didlen, &didtype); |
1820 | else |
1821 | sid = pf_key_v2_convert_id(isakmp_sa->id_r, |
1822 | isakmp_sa->id_r_len, &sidlen, &sidtype); |
1823 | } |
1824 | |
1825 | error = pf_key_v2_flow(isa->src_net, isa->src_mask, isa->dst_net, |
1826 | isa->dst_mask, isa->tproto, isa->sport, isa->dport, proto->spi[0], |
1827 | proto->proto, dst, src, 0, 0, sidtype, sid, sidlen, didtype, did, |
1828 | didlen, proto->data); |
1829 | if (error) |
1830 | goto cleanup; |
1831 | |
1832 | error = pf_key_v2_flow(isa->dst_net, isa->dst_mask, isa->src_net, |
1833 | isa->src_mask, isa->tproto, isa->dport, isa->sport, proto->spi[1], |
1834 | proto->proto, src, dst, 0, 1, sidtype, sid, sidlen, didtype, did, |
1835 | didlen, proto->data); |
1836 | |
1837 | cleanup: |
1838 | free(sid); |
1839 | free(did); |
1840 | |
1841 | return error; |
1842 | } |
1843 | |
1844 | /* Increase reference count of refcounted sections. */ |
1845 | static int |
1846 | pf_key_v2_conf_refinc(int af, char *section) |
1847 | { |
1848 | char conn[22]; |
1849 | int num; |
1850 | |
1851 | if (!section) |
1852 | return 0; |
1853 | |
1854 | num = conf_get_num(section, "Refcount", 0); |
1855 | if (num == 0) |
1856 | return 0; |
1857 | |
1858 | snprintf(conn, sizeof conn, "%d", num + 1); |
1859 | conf_set(af, section, "Refcount", conn, 1, 0); |
1860 | return 0; |
1861 | } |
1862 | |
1863 | /* |
1864 | * Return 0 if the section didn't exist or was removed, non-zero otherwise. |
1865 | * Don't touch non-refcounted (statically defined) sections. |
1866 | */ |
1867 | static int |
1868 | pf_key_v2_conf_refhandle(int af, char *section) |
1869 | { |
1870 | char conn[22]; |
1871 | int num; |
1872 | |
1873 | if (!section) |
1874 | return 0; |
1875 | |
1876 | num = conf_get_num(section, "Refcount", 0); |
1877 | if (num == 1) { |
1878 | conf_remove_section(af, section); |
1879 | num--; |
1880 | } else if (num != 0) { |
1881 | snprintf(conn, sizeof conn, "%d", num - 1); |
1882 | conf_set(af, section, "Refcount", conn, 1, 0); |
1883 | } |
1884 | return num; |
1885 | } |
1886 | |
1887 | /* Remove all dynamically-established configuration entries. */ |
1888 | static int |
1889 | pf_key_v2_remove_conf(char *section) |
1890 | { |
1891 | char *ikepeer, *localid, *remoteid, *configname; |
1892 | struct conf_list_node *attr; |
1893 | struct conf_list *attrs; |
1894 | int af; |
1895 | |
1896 | if (!section) |
1897 | return 0; |
1898 | |
1899 | if (!conf_get_str(section, "Phase")) |
1900 | return 0; |
1901 | |
1902 | /* Only remove dynamically-established entries. */ |
1903 | attrs = conf_get_list(section, "Flags"); |
1904 | if (attrs) { |
1905 | for (attr = TAILQ_FIRST(&attrs->fields)((&attrs->fields)->tqh_first); attr; |
1906 | attr = TAILQ_NEXT(attr, link)((attr)->link.tqe_next)) |
1907 | if (!strcasecmp(attr->field, "__ondemand")) |
1908 | goto passed; |
1909 | |
1910 | conf_free_list(attrs); |
1911 | } |
1912 | return 0; |
1913 | |
1914 | passed: |
1915 | conf_free_list(attrs); |
1916 | |
1917 | af = conf_begin(); |
1918 | |
1919 | configname = conf_get_str(section, "Configuration"); |
1920 | pf_key_v2_conf_refhandle(af, configname); |
1921 | |
1922 | /* These are the Phase 2 Local/Remote IDs. */ |
1923 | localid = conf_get_str(section, "Local-ID"); |
1924 | pf_key_v2_conf_refhandle(af, localid); |
1925 | |
1926 | remoteid = conf_get_str(section, "Remote-ID"); |
1927 | pf_key_v2_conf_refhandle(af, remoteid); |
1928 | |
1929 | ikepeer = conf_get_str(section, "ISAKMP-peer"); |
1930 | |
1931 | pf_key_v2_conf_refhandle(af, section); |
1932 | |
1933 | if (ikepeer) { |
1934 | remoteid = conf_get_str(ikepeer, "Remote-ID"); |
1935 | localid = conf_get_str(ikepeer, "ID"); |
1936 | configname = conf_get_str(ikepeer, "Configuration"); |
1937 | |
1938 | pf_key_v2_conf_refhandle(af, ikepeer); |
1939 | pf_key_v2_conf_refhandle(af, configname); |
1940 | |
1941 | /* Phase 1 IDs */ |
1942 | pf_key_v2_conf_refhandle(af, localid); |
1943 | pf_key_v2_conf_refhandle(af, remoteid); |
1944 | } |
1945 | conf_end(af, 1); |
1946 | return 0; |
1947 | } |
1948 | |
1949 | /* Disable a flow given a SA. */ |
1950 | int |
1951 | pf_key_v2_disable_sa(struct sa *sa, int incoming) |
1952 | { |
1953 | struct ipsec_sa *isa = sa->data; |
1954 | struct sockaddr *dst, *src; |
1955 | struct proto *proto = TAILQ_FIRST(&sa->protos)((&sa->protos)->tqh_first); |
1956 | |
1957 | sa->transport->vtbl->get_dst(sa->transport, &dst); |
1958 | sa->transport->vtbl->get_src(sa->transport, &src); |
1959 | |
1960 | if (!incoming) |
1961 | return pf_key_v2_flow(isa->src_net, isa->src_mask, |
1962 | isa->dst_net, isa->dst_mask, isa->tproto, isa->sport, |
1963 | isa->dport, proto->spi[0], proto->proto, src, dst, 1, 0, |
1964 | 0, 0, 0, 0, 0, 0, proto->data); |
1965 | else { |
1966 | return pf_key_v2_flow(isa->dst_net, isa->dst_mask, |
1967 | isa->src_net, isa->src_mask, isa->tproto, isa->dport, |
1968 | isa->sport, proto->spi[1], proto->proto, src, dst, 1, 1, |
1969 | 0, 0, 0, 0, 0, 0, proto->data); |
1970 | } |
1971 | } |
1972 | |
1973 | /* |
1974 | * Delete the IPsec SA represented by the INCOMING direction in protocol PROTO |
1975 | * of the IKE security association SA. Also delete potential flows tied to it. |
1976 | */ |
1977 | int |
1978 | pf_key_v2_delete_spi(struct sa *sa, struct proto *proto, int incoming) |
1979 | { |
1980 | struct sadb_msg msg; |
1981 | struct sadb_sa ssa; |
1982 | struct sadb_address *addr = 0; |
1983 | struct sockaddr *saddr; |
1984 | int len, err; |
1985 | struct pf_key_v2_msg *delete = 0, *ret = 0; |
1986 | |
1987 | /* If it's not an established SA, don't proceed. */ |
1988 | if (!(sa->flags & SA_FLAG_READY0x01)) |
1989 | return 0; |
1990 | |
1991 | if (sa->name && !(sa->flags & SA_FLAG_REPLACED0x08)) { |
1992 | LOG_DBG((LOG_SYSDEP, 50,log_debug (LOG_SYSDEP, 50, "pf_key_v2_delete_spi: removing configuration %s" , sa->name) |
1993 | "pf_key_v2_delete_spi: removing configuration %s",log_debug (LOG_SYSDEP, 50, "pf_key_v2_delete_spi: removing configuration %s" , sa->name) |
1994 | sa->name))log_debug (LOG_SYSDEP, 50, "pf_key_v2_delete_spi: removing configuration %s" , sa->name); |
1995 | pf_key_v2_remove_conf(sa->name); |
1996 | } |
1997 | msg.sadb_msg_type = SADB_DELETE4; |
1998 | switch (proto->proto) { |
1999 | case IPSEC_PROTO_IPSEC_ESP3: |
2000 | msg.sadb_msg_satype = SADB_SATYPE_ESP2; |
2001 | break; |
2002 | case IPSEC_PROTO_IPSEC_AH2: |
2003 | msg.sadb_msg_satype = SADB_SATYPE_AH1; |
2004 | break; |
2005 | case IPSEC_PROTO_IPCOMP4: |
2006 | msg.sadb_msg_satype = SADB_X_SATYPE_IPCOMP9; |
2007 | break; |
2008 | default: |
2009 | log_print("pf_key_v2_delete_spi: invalid proto %d", |
2010 | proto->proto); |
2011 | goto cleanup; |
2012 | } |
2013 | msg.sadb_msg_seq = 0; |
2014 | delete = pf_key_v2_msg_new(&msg, 0); |
2015 | if (!delete) |
2016 | goto cleanup; |
2017 | |
2018 | /* Setup the SA extension. */ |
2019 | ssa.sadb_sa_exttype = SADB_EXT_SA1; |
2020 | ssa.sadb_sa_len = sizeof ssa / PF_KEY_V2_CHUNK8; |
2021 | memcpy(&ssa.sadb_sa_spi, proto->spi[incoming], sizeof ssa.sadb_sa_spi); |
2022 | ssa.sadb_sa_replay = 0; |
2023 | ssa.sadb_sa_state = 0; |
2024 | ssa.sadb_sa_auth = 0; |
2025 | ssa.sadb_sa_encrypt = 0; |
2026 | ssa.sadb_sa_flags = 0; |
2027 | if (pf_key_v2_msg_add(delete, (struct sadb_ext *)&ssa, 0) == -1) |
2028 | goto cleanup; |
2029 | |
2030 | /* |
2031 | * Setup the ADDRESS extensions. |
2032 | */ |
2033 | if (incoming) |
2034 | sa->transport->vtbl->get_dst(sa->transport, &saddr); |
2035 | else |
2036 | sa->transport->vtbl->get_src(sa->transport, &saddr); |
2037 | len = sizeof *addr + PF_KEY_V2_ROUND(SA_LEN(saddr))(((((saddr)->sa_len)) + 8 - 1) & ~(8 - 1)); |
2038 | addr = calloc(1, len); |
2039 | if (!addr) |
2040 | goto cleanup; |
2041 | addr->sadb_address_exttype = SADB_EXT_ADDRESS_SRC5; |
2042 | addr->sadb_address_len = len / PF_KEY_V2_CHUNK8; |
2043 | addr->sadb_address_reserved = 0; |
2044 | memcpy(addr + 1, saddr, SA_LEN(saddr)((saddr)->sa_len)); |
2045 | switch (saddr->sa_family) { |
2046 | case AF_INET2: |
2047 | ((struct sockaddr_in *) (addr + 1))->sin_port = 0; |
2048 | break; |
2049 | case AF_INET624: |
2050 | ((struct sockaddr_in6 *) (addr + 1))->sin6_port = 0; |
2051 | break; |
2052 | } |
2053 | if (pf_key_v2_msg_add(delete, (struct sadb_ext *) addr, |
2054 | PF_KEY_V2_NODE_MALLOCED1) == -1) |
2055 | goto cleanup; |
2056 | addr = 0; |
2057 | |
2058 | if (incoming) |
2059 | sa->transport->vtbl->get_src(sa->transport, &saddr); |
2060 | else |
2061 | sa->transport->vtbl->get_dst(sa->transport, &saddr); |
2062 | len = sizeof *addr + PF_KEY_V2_ROUND(SA_LEN(saddr))(((((saddr)->sa_len)) + 8 - 1) & ~(8 - 1)); |
2063 | addr = calloc(1, len); |
2064 | if (!addr) |
2065 | goto cleanup; |
2066 | addr->sadb_address_exttype = SADB_EXT_ADDRESS_DST6; |
2067 | addr->sadb_address_len = len / PF_KEY_V2_CHUNK8; |
2068 | addr->sadb_address_reserved = 0; |
2069 | memcpy(addr + 1, saddr, SA_LEN(saddr)((saddr)->sa_len)); |
2070 | switch (saddr->sa_family) { |
2071 | case AF_INET2: |
2072 | ((struct sockaddr_in *) (addr + 1))->sin_port = 0; |
2073 | break; |
2074 | case AF_INET624: |
2075 | ((struct sockaddr_in6 *) (addr + 1))->sin6_port = 0; |
2076 | break; |
2077 | } |
2078 | if (pf_key_v2_msg_add(delete, (struct sadb_ext *) addr, |
2079 | PF_KEY_V2_NODE_MALLOCED1) == -1) |
2080 | goto cleanup; |
2081 | addr = 0; |
2082 | |
2083 | ret = pf_key_v2_call(delete); |
2084 | pf_key_v2_msg_free(delete); |
2085 | delete = 0; |
2086 | if (!ret) |
2087 | goto cleanup; |
2088 | err = ((struct sadb_msg *)TAILQ_FIRST(ret)((ret)->tqh_first)->seg)->sadb_msg_errno; |
2089 | if (err) { |
2090 | LOG_DBG((LOG_SYSDEP, 10, "pf_key_v2_delete_spi: DELETE: %s",log_debug (LOG_SYSDEP, 10, "pf_key_v2_delete_spi: DELETE: %s" , strerror(err)) |
2091 | strerror(err)))log_debug (LOG_SYSDEP, 10, "pf_key_v2_delete_spi: DELETE: %s" , strerror(err)); |
2092 | goto cleanup; |
2093 | } |
2094 | pf_key_v2_msg_free(ret); |
2095 | |
2096 | LOG_DBG((LOG_SYSDEP, 50, "pf_key_v2_delete_spi: done"))log_debug (LOG_SYSDEP, 50, "pf_key_v2_delete_spi: done"); |
2097 | |
2098 | return 0; |
2099 | |
2100 | cleanup: |
2101 | free(addr); |
2102 | if (delete) |
2103 | pf_key_v2_msg_free(delete); |
2104 | if (ret) |
2105 | pf_key_v2_msg_free(ret); |
2106 | return -1; |
2107 | } |
2108 | |
2109 | static void |
2110 | pf_key_v2_stayalive(struct exchange *exchange, void *vconn, int fail) |
2111 | { |
2112 | char *conn = vconn; |
2113 | struct sa *sa; |
2114 | |
2115 | /* XXX What if it is phase 1 ? */ |
2116 | sa = sa_lookup_by_name(conn, 2); |
2117 | if (sa) |
2118 | sa->flags |= SA_FLAG_STAYALIVE0x02; |
2119 | |
2120 | /* |
2121 | * Remove failed configuration entry -- call twice because it is |
2122 | * created with a Refcount of 2. |
2123 | */ |
2124 | if (fail && (!exchange || exchange->name)) { |
2125 | pf_key_v2_remove_conf(conn); |
2126 | pf_key_v2_remove_conf(conn); |
2127 | } |
2128 | free(conn); |
2129 | } |
2130 | |
2131 | /* Check if a connection CONN exists, otherwise establish it. */ |
2132 | void |
2133 | pf_key_v2_connection_check(char *conn) |
2134 | { |
2135 | if (!sa_lookup_by_name(conn, 2)) { |
2136 | LOG_DBG((LOG_SYSDEP, 70,log_debug (LOG_SYSDEP, 70, "pf_key_v2_connection_check: SA for %s missing" , conn) |
2137 | "pf_key_v2_connection_check: SA for %s missing", conn))log_debug (LOG_SYSDEP, 70, "pf_key_v2_connection_check: SA for %s missing" , conn); |
2138 | exchange_establish(conn, pf_key_v2_stayalive, conn, 0); |
2139 | } else { |
2140 | LOG_DBG((LOG_SYSDEP, 70, "pf_key_v2_connection_check: "log_debug (LOG_SYSDEP, 70, "pf_key_v2_connection_check: " "SA for %s exists" , conn) |
2141 | "SA for %s exists", conn))log_debug (LOG_SYSDEP, 70, "pf_key_v2_connection_check: " "SA for %s exists" , conn); |
2142 | free(conn); |
2143 | } |
2144 | } |
2145 | |
2146 | /* Handle a PF_KEY lifetime expiration message PMSG. */ |
2147 | static void |
2148 | pf_key_v2_expire(struct pf_key_v2_msg *pmsg) |
2149 | { |
2150 | struct sadb_msg *msg; |
2151 | struct sadb_sa *ssa; |
2152 | struct sadb_address *dst; |
2153 | struct sockaddr *dstaddr; |
2154 | struct sadb_lifetime *life, *lifecurrent; |
2155 | struct sa *sa; |
2156 | struct pf_key_v2_node *lifenode, *ext; |
2157 | char *dst_str; |
2158 | |
2159 | msg = (struct sadb_msg *)TAILQ_FIRST(pmsg)((pmsg)->tqh_first)->seg; |
2160 | ext = pf_key_v2_find_ext(pmsg, SADB_EXT_SA1); |
2161 | if (!ext) { |
2162 | log_print("pf_key_v2_expire: no SA extension found"); |
2163 | return; |
2164 | } |
2165 | ssa = ext->seg; |
2166 | ext = pf_key_v2_find_ext(pmsg, SADB_EXT_ADDRESS_DST6); |
2167 | if (!ext) { |
2168 | log_print("pf_key_v2_expire: " |
2169 | "no destination address extension found"); |
2170 | return; |
2171 | } |
2172 | dst = ext->seg; |
2173 | dstaddr = (struct sockaddr *) (dst + 1); |
2174 | lifenode = pf_key_v2_find_ext(pmsg, SADB_EXT_LIFETIME_HARD3); |
2175 | if (!lifenode) |
2176 | lifenode = pf_key_v2_find_ext(pmsg, SADB_EXT_LIFETIME_SOFT4); |
2177 | if (!lifenode) { |
2178 | log_print("pf_key_v2_expire: no lifetime extension found"); |
2179 | return; |
2180 | } |
2181 | life = lifenode->seg; |
2182 | |
2183 | lifenode = pf_key_v2_find_ext(pmsg, SADB_EXT_LIFETIME_CURRENT2); |
2184 | if (!lifenode) { |
2185 | log_print("pf_key_v2_expire: " |
2186 | "no current lifetime extension found"); |
2187 | return; |
2188 | } |
2189 | lifecurrent = lifenode->seg; |
2190 | |
2191 | if (sockaddr2text(dstaddr, &dst_str, 0)) |
2192 | dst_str = 0; |
2193 | |
2194 | LOG_DBG((LOG_SYSDEP, 20, "pf_key_v2_expire: "log_debug (LOG_SYSDEP, 20, "pf_key_v2_expire: " "%s dst %s SPI %x sproto %d" , life->sadb_lifetime_exttype == 4 ? "SOFT" : "HARD", dst_str ? dst_str : "<unknown>", (__uint32_t)(__builtin_constant_p (ssa->sadb_sa_spi) ? (__uint32_t)(((__uint32_t)(ssa->sadb_sa_spi ) & 0xff) << 24 | ((__uint32_t)(ssa->sadb_sa_spi ) & 0xff00) << 8 | ((__uint32_t)(ssa->sadb_sa_spi ) & 0xff0000) >> 8 | ((__uint32_t)(ssa->sadb_sa_spi ) & 0xff000000) >> 24) : __swap32md(ssa->sadb_sa_spi )), msg->sadb_msg_satype) |
2195 | "%s dst %s SPI %x sproto %d",log_debug (LOG_SYSDEP, 20, "pf_key_v2_expire: " "%s dst %s SPI %x sproto %d" , life->sadb_lifetime_exttype == 4 ? "SOFT" : "HARD", dst_str ? dst_str : "<unknown>", (__uint32_t)(__builtin_constant_p (ssa->sadb_sa_spi) ? (__uint32_t)(((__uint32_t)(ssa->sadb_sa_spi ) & 0xff) << 24 | ((__uint32_t)(ssa->sadb_sa_spi ) & 0xff00) << 8 | ((__uint32_t)(ssa->sadb_sa_spi ) & 0xff0000) >> 8 | ((__uint32_t)(ssa->sadb_sa_spi ) & 0xff000000) >> 24) : __swap32md(ssa->sadb_sa_spi )), msg->sadb_msg_satype) |
2196 | life->sadb_lifetime_exttype == SADB_EXT_LIFETIME_SOFT ? "SOFT"log_debug (LOG_SYSDEP, 20, "pf_key_v2_expire: " "%s dst %s SPI %x sproto %d" , life->sadb_lifetime_exttype == 4 ? "SOFT" : "HARD", dst_str ? dst_str : "<unknown>", (__uint32_t)(__builtin_constant_p (ssa->sadb_sa_spi) ? (__uint32_t)(((__uint32_t)(ssa->sadb_sa_spi ) & 0xff) << 24 | ((__uint32_t)(ssa->sadb_sa_spi ) & 0xff00) << 8 | ((__uint32_t)(ssa->sadb_sa_spi ) & 0xff0000) >> 8 | ((__uint32_t)(ssa->sadb_sa_spi ) & 0xff000000) >> 24) : __swap32md(ssa->sadb_sa_spi )), msg->sadb_msg_satype) |
2197 | : "HARD", dst_str ? dst_str : "<unknown>",log_debug (LOG_SYSDEP, 20, "pf_key_v2_expire: " "%s dst %s SPI %x sproto %d" , life->sadb_lifetime_exttype == 4 ? "SOFT" : "HARD", dst_str ? dst_str : "<unknown>", (__uint32_t)(__builtin_constant_p (ssa->sadb_sa_spi) ? (__uint32_t)(((__uint32_t)(ssa->sadb_sa_spi ) & 0xff) << 24 | ((__uint32_t)(ssa->sadb_sa_spi ) & 0xff00) << 8 | ((__uint32_t)(ssa->sadb_sa_spi ) & 0xff0000) >> 8 | ((__uint32_t)(ssa->sadb_sa_spi ) & 0xff000000) >> 24) : __swap32md(ssa->sadb_sa_spi )), msg->sadb_msg_satype) |
2198 | ntohl(ssa->sadb_sa_spi), msg->sadb_msg_satype))log_debug (LOG_SYSDEP, 20, "pf_key_v2_expire: " "%s dst %s SPI %x sproto %d" , life->sadb_lifetime_exttype == 4 ? "SOFT" : "HARD", dst_str ? dst_str : "<unknown>", (__uint32_t)(__builtin_constant_p (ssa->sadb_sa_spi) ? (__uint32_t)(((__uint32_t)(ssa->sadb_sa_spi ) & 0xff) << 24 | ((__uint32_t)(ssa->sadb_sa_spi ) & 0xff00) << 8 | ((__uint32_t)(ssa->sadb_sa_spi ) & 0xff0000) >> 8 | ((__uint32_t)(ssa->sadb_sa_spi ) & 0xff000000) >> 24) : __swap32md(ssa->sadb_sa_spi )), msg->sadb_msg_satype); |
2199 | |
2200 | free(dst_str); |
2201 | |
2202 | /* |
2203 | * Find the IPsec SA. The IPsec stack has two SAs for every IKE SA, |
2204 | * one outgoing and one incoming, we regard expirations for any of |
2205 | * them as an expiration of the full IKE SA. Likewise, in |
2206 | * protection suites consisting of more than one protocol, any |
2207 | * expired individual IPsec stack SA will be seen as an expiration |
2208 | * of the full suite. |
2209 | */ |
2210 | switch (msg->sadb_msg_satype) { |
2211 | case SADB_SATYPE_ESP2: |
2212 | sa = ipsec_sa_lookup(dstaddr, ssa->sadb_sa_spi, |
2213 | IPSEC_PROTO_IPSEC_ESP3); |
2214 | break; |
2215 | |
2216 | case SADB_SATYPE_AH1: |
2217 | sa = ipsec_sa_lookup(dstaddr, ssa->sadb_sa_spi, |
2218 | IPSEC_PROTO_IPSEC_AH2); |
2219 | break; |
2220 | |
2221 | case SADB_X_SATYPE_IPCOMP9: |
2222 | sa = ipsec_sa_lookup(dstaddr, ssa->sadb_sa_spi, |
2223 | IPSEC_PROTO_IPCOMP4); |
2224 | break; |
2225 | |
2226 | default: |
2227 | /* XXX Log? */ |
2228 | sa = 0; |
2229 | break; |
2230 | } |
2231 | |
2232 | /* If the SA is already gone, don't do anything. */ |
2233 | if (!sa) |
2234 | return; |
2235 | |
2236 | /* |
2237 | * If we got a notification, try to renegotiate the SA -- unless of |
2238 | * course it has already been replaced by another. |
2239 | * Also, ignore SAs that were not dynamically established, or that |
2240 | * did not see any use. |
2241 | */ |
2242 | if (!(sa->flags & SA_FLAG_REPLACED0x08) && |
2243 | (sa->flags & SA_FLAG_ONDEMAND0x04) && |
2244 | lifecurrent->sadb_lifetime_bytes) |
2245 | exchange_establish(sa->name, 0, 0, 0); |
2246 | |
2247 | if (life->sadb_lifetime_exttype == SADB_EXT_LIFETIME_HARD3) { |
2248 | /* Remove the old SA, it isn't useful anymore. */ |
2249 | sa_free(sa); |
2250 | } |
2251 | } |
2252 | |
2253 | static int |
2254 | mask4len(const struct sockaddr_in *mask) |
2255 | { |
2256 | int len; |
2257 | u_int32_t m; |
2258 | |
2259 | len = 0; |
2260 | for (m = 0x80000000; m & ntohl(mask->sin_addr.s_addr)(__uint32_t)(__builtin_constant_p(mask->sin_addr.s_addr) ? (__uint32_t)(((__uint32_t)(mask->sin_addr.s_addr) & 0xff ) << 24 | ((__uint32_t)(mask->sin_addr.s_addr) & 0xff00) << 8 | ((__uint32_t)(mask->sin_addr.s_addr) & 0xff0000) >> 8 | ((__uint32_t)(mask->sin_addr .s_addr) & 0xff000000) >> 24) : __swap32md(mask-> sin_addr.s_addr)); m >>= 1) |
2261 | len++; |
2262 | if (len == 32) |
2263 | len = -1; |
2264 | return len; |
2265 | } |
2266 | |
2267 | #ifndef s6_addr8__u6_addr.__u6_addr8 |
2268 | #define s6_addr8__u6_addr.__u6_addr8 __u6_addr.__u6_addr8 |
2269 | #endif |
2270 | |
2271 | static int |
2272 | mask6len(const struct sockaddr_in6 *mask) |
2273 | { |
2274 | int i, len; |
2275 | u_int8_t m; |
2276 | |
2277 | len = 0; |
2278 | for (i = 0, m = 0; i < 16 && !m; i++) |
2279 | for (m = 0x80; m & mask->sin6_addr.s6_addr8__u6_addr.__u6_addr8[i]; m >>= 1) |
2280 | len++; |
2281 | if (len == 128) |
2282 | len = -1; |
2283 | return len; |
2284 | } |
2285 | |
2286 | static int |
2287 | phase2id(char *str, size_t size, const char *side, const char *sflow, |
2288 | int masklen, u_int8_t proto, u_int16_t port) |
2289 | { |
2290 | char smasklen[10], sproto[10], sport[10]; |
2291 | |
2292 | smasklen[0] = sproto[0] = sport[0] = 0; |
2293 | if (masklen != -1) |
2294 | snprintf(smasklen, sizeof smasklen, "/%d", masklen); |
2295 | if (proto) |
2296 | snprintf(sproto, sizeof sproto, "=%u", proto); |
2297 | if (port) |
2298 | snprintf(sport, sizeof sport, ":%u", ntohs(port)(__uint16_t)(__builtin_constant_p(port) ? (__uint16_t)(((__uint16_t )(port) & 0xffU) << 8 | ((__uint16_t)(port) & 0xff00U ) >> 8) : __swap16md(port))); |
2299 | |
2300 | return snprintf(str, size, "%s-%s%s%s%s", side, sflow, smasklen, |
2301 | sproto, sport); |
2302 | } |
2303 | |
2304 | /* Handle a PF_KEY SA ACQUIRE message PMSG. */ |
2305 | static void |
2306 | pf_key_v2_acquire(struct pf_key_v2_msg *pmsg) |
2307 | { |
2308 | struct sadb_msg *msg, askpolicy_msg; |
2309 | struct pf_key_v2_msg *askpolicy = 0, *ret = 0; |
2310 | struct sadb_x_policy policy; |
2311 | struct sadb_address *dst = 0, *src = 0; |
2312 | struct sockaddr *dstaddr, *srcaddr = 0; |
2313 | struct sadb_comb *scmb = 0; |
2314 | struct sadb_prop *sprp = 0; |
2315 | struct sadb_ident *srcident = 0, *dstident = 0; |
2316 | char dstbuf[ADDRESS_MAXsizeof "ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255"], srcbuf[ADDRESS_MAXsizeof "ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255"], *peer = 0; |
2317 | char confname[120], *conn = 0; |
2318 | char *srcid = 0, *dstid = 0, *prefstring = 0; |
2319 | int slen, af, afamily, masklen; |
2320 | struct sockaddr *smask, *sflow, *dmask, *dflow; |
2321 | struct sadb_protocol *sproto; |
2322 | char ssflow[ADDRESS_MAXsizeof "ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255"], sdflow[ADDRESS_MAXsizeof "ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255"]; |
2323 | char sdmask[ADDRESS_MAXsizeof "ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255"], ssmask[ADDRESS_MAXsizeof "ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255"]; |
2324 | int dmasklen, smasklen; |
2325 | char *sidtype = 0, *didtype = 0; |
2326 | char lname[100], dname[100], configname[200]; |
2327 | int shostflag = 0, dhostflag = 0; |
2328 | struct pf_key_v2_node *ext; |
2329 | struct passwd *pwd = 0; |
2330 | u_int16_t sport = 0, dport = 0; |
2331 | u_int8_t tproto = 0; |
2332 | char tmbuf[sizeof sport * 3 + 1], *xform; |
2333 | int connlen; |
2334 | |
2335 | /* This needs to be dynamically allocated. */ |
2336 | connlen = 22; |
2337 | conn = malloc(connlen); |
2338 | if (!conn) { |
2339 | log_error("pf_key_v2_acquire: malloc (%d) failed", connlen); |
2340 | return; |
2341 | } |
2342 | msg = (struct sadb_msg *)TAILQ_FIRST(pmsg)((pmsg)->tqh_first)->seg; |
2343 | |
2344 | ext = pf_key_v2_find_ext(pmsg, SADB_EXT_ADDRESS_DST6); |
2345 | if (!ext) { |
2346 | log_print("pf_key_v2_acquire: " |
2347 | "no destination address specified"); |
2348 | free(conn); |
2349 | return; |
2350 | } |
2351 | dst = ext->seg; |
2352 | |
2353 | ext = pf_key_v2_find_ext(pmsg, SADB_EXT_ADDRESS_SRC5); |
2354 | if (ext) |
2355 | src = ext->seg; |
2356 | |
2357 | ext = pf_key_v2_find_ext(pmsg, SADB_EXT_PROPOSAL13); |
2358 | if (ext) { |
2359 | sprp = ext->seg; |
2360 | scmb = (struct sadb_comb *) (sprp + 1); |
2361 | } |
2362 | ext = pf_key_v2_find_ext(pmsg, SADB_EXT_IDENTITY_SRC10); |
2363 | if (ext) |
2364 | srcident = ext->seg; |
2365 | |
2366 | ext = pf_key_v2_find_ext(pmsg, SADB_EXT_IDENTITY_DST11); |
2367 | if (ext) |
2368 | dstident = ext->seg; |
2369 | |
2370 | /* Ask the kernel for the matching policy. */ |
2371 | bzero(&askpolicy_msg, sizeof askpolicy_msg); |
2372 | askpolicy_msg.sadb_msg_type = SADB_X_ASKPOLICY15; |
2373 | askpolicy = pf_key_v2_msg_new(&askpolicy_msg, 0); |
2374 | if (!askpolicy) |
2375 | goto fail; |
2376 | |
2377 | policy.sadb_x_policy_exttype = SADB_X_EXT_POLICY25; |
2378 | policy.sadb_x_policy_len = sizeof policy / PF_KEY_V2_CHUNK8; |
2379 | policy.sadb_x_policy_seq = msg->sadb_msg_seq; |
2380 | if (pf_key_v2_msg_add(askpolicy, (struct sadb_ext *)&policy, 0) == -1) |
2381 | goto fail; |
2382 | |
2383 | ret = pf_key_v2_call(askpolicy); |
2384 | if (!ret) |
2385 | goto fail; |
2386 | |
2387 | /* Now we have all the information needed. */ |
2388 | |
2389 | ext = pf_key_v2_find_ext(ret, SADB_X_EXT_SRC_FLOW21); |
2390 | if (!ext) { |
2391 | log_print("pf_key_v2_acquire: no source flow extension found"); |
2392 | goto fail; |
2393 | } |
2394 | sflow = (struct sockaddr *) (((struct sadb_address *) ext->seg) + 1); |
2395 | |
2396 | ext = pf_key_v2_find_ext(ret, SADB_X_EXT_DST_FLOW22); |
2397 | if (!ext) { |
2398 | log_print("pf_key_v2_acquire: " |
2399 | "no destination flow extension found"); |
2400 | goto fail; |
2401 | } |
2402 | dflow = (struct sockaddr *) (((struct sadb_address *) ext->seg) + 1); |
2403 | ext = pf_key_v2_find_ext(ret, SADB_X_EXT_SRC_MASK17); |
2404 | if (!ext) { |
2405 | log_print("pf_key_v2_acquire: no source mask extension found"); |
2406 | goto fail; |
2407 | } |
2408 | smask = (struct sockaddr *) (((struct sadb_address *) ext->seg) + 1); |
2409 | |
2410 | ext = pf_key_v2_find_ext(ret, SADB_X_EXT_DST_MASK18); |
2411 | if (!ext) { |
2412 | log_print("pf_key_v2_acquire: " |
2413 | "no destination mask extension found"); |
2414 | goto fail; |
2415 | } |
2416 | dmask = (struct sockaddr *) (((struct sadb_address *) ext->seg) + 1); |
2417 | |
2418 | ext = pf_key_v2_find_ext(ret, SADB_X_EXT_FLOW_TYPE20); |
2419 | if (!ext) { |
2420 | log_print("pf_key_v2_acquire: no flow type extension found"); |
2421 | goto fail; |
2422 | } |
2423 | sproto = ext->seg; |
2424 | tproto = sproto->sadb_protocol_proto; |
2425 | |
2426 | bzero(ssflow, sizeof ssflow); |
2427 | bzero(sdflow, sizeof sdflow); |
2428 | bzero(ssmask, sizeof ssmask); |
2429 | bzero(sdmask, sizeof sdmask); |
2430 | smasklen = dmasklen = -1; |
2431 | |
2432 | sidtype = didtype = "IPV4_ADDR_SUBNET"; /* default */ |
2433 | |
2434 | switch (sflow->sa_family) { |
2435 | case AF_INET2: |
2436 | if (inet_ntop(AF_INET2, |
2437 | &((struct sockaddr_in *) sflow)->sin_addr, ssflow, |
2438 | ADDRESS_MAXsizeof "ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255") == NULL((void *)0)) { |
2439 | log_print("pf_key_v2_acquire: inet_ntop failed"); |
2440 | goto fail; |
2441 | } |
2442 | sport = ((struct sockaddr_in *) sflow)->sin_port; |
2443 | if (inet_ntop(AF_INET2, |
2444 | &((struct sockaddr_in *) dflow)->sin_addr, sdflow, |
2445 | ADDRESS_MAXsizeof "ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255") == NULL((void *)0)) { |
2446 | log_print("pf_key_v2_acquire: inet_ntop failed"); |
2447 | goto fail; |
2448 | } |
2449 | dport = ((struct sockaddr_in *) dflow)->sin_port; |
2450 | if (inet_ntop(AF_INET2, |
2451 | &((struct sockaddr_in *) smask)->sin_addr, ssmask, |
2452 | ADDRESS_MAXsizeof "ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255") == NULL((void *)0)) { |
2453 | log_print("pf_key_v2_acquire: inet_ntop failed"); |
2454 | goto fail; |
2455 | } |
2456 | if (inet_ntop(AF_INET2, |
2457 | &((struct sockaddr_in *) dmask)->sin_addr, sdmask, |
2458 | ADDRESS_MAXsizeof "ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255") == NULL((void *)0)) { |
2459 | log_print("pf_key_v2_acquire: inet_ntop failed"); |
2460 | goto fail; |
2461 | } |
2462 | smasklen = mask4len((struct sockaddr_in *) smask); |
2463 | dmasklen = mask4len((struct sockaddr_in *) dmask); |
2464 | if (((struct sockaddr_in *) smask)->sin_addr.s_addr == |
2465 | INADDR_BROADCAST((u_int32_t)(0xffffffff))) { |
2466 | shostflag = 1; |
2467 | sidtype = "IPV4_ADDR"; |
2468 | } |
2469 | if (((struct sockaddr_in *) dmask)->sin_addr.s_addr == |
2470 | INADDR_BROADCAST((u_int32_t)(0xffffffff))) { |
2471 | dhostflag = 1; |
2472 | didtype = "IPV4_ADDR"; |
2473 | } |
2474 | break; |
2475 | |
2476 | case AF_INET624: |
2477 | if (inet_ntop(AF_INET624, |
2478 | &((struct sockaddr_in6 *) sflow)->sin6_addr, |
2479 | ssflow, ADDRESS_MAXsizeof "ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255") == NULL((void *)0)) { |
2480 | log_print("pf_key_v2_acquire: inet_ntop failed"); |
2481 | goto fail; |
2482 | } |
2483 | sport = ((struct sockaddr_in6 *) sflow)->sin6_port; |
2484 | if (inet_ntop(AF_INET624, |
2485 | &((struct sockaddr_in6 *) dflow)->sin6_addr, |
2486 | sdflow, ADDRESS_MAXsizeof "ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255") == NULL((void *)0)) { |
2487 | log_print("pf_key_v2_acquire: inet_ntop failed"); |
2488 | goto fail; |
2489 | } |
2490 | dport = ((struct sockaddr_in6 *) dflow)->sin6_port; |
2491 | if (inet_ntop(AF_INET624, |
2492 | &((struct sockaddr_in6 *) smask)->sin6_addr, |
2493 | ssmask, ADDRESS_MAXsizeof "ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255") == NULL((void *)0)) { |
2494 | log_print("pf_key_v2_acquire: inet_ntop failed"); |
2495 | goto fail; |
2496 | } |
2497 | if (inet_ntop(AF_INET624, |
2498 | &((struct sockaddr_in6 *) dmask)->sin6_addr, |
2499 | sdmask, ADDRESS_MAXsizeof "ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255") == NULL((void *)0)) { |
2500 | log_print("pf_key_v2_acquire: inet_ntop failed"); |
2501 | goto fail; |
2502 | } |
2503 | smasklen = mask6len((struct sockaddr_in6 *) smask); |
2504 | dmasklen = mask6len((struct sockaddr_in6 *) dmask); |
2505 | sidtype = didtype = "IPV6_ADDR_SUBNET"; |
2506 | if (IN6_IS_ADDR_FULL(&((struct sockaddr_in6 *)smask)->sin6_addr)((*(u_int32_t *)(void *)(&(&((struct sockaddr_in6 *)smask )->sin6_addr)->__u6_addr.__u6_addr8[0]) == 0xffffffff) && (*(u_int32_t *)(void *)(&(&((struct sockaddr_in6 *)smask )->sin6_addr)->__u6_addr.__u6_addr8[4]) == 0xffffffff) && (*(u_int32_t *)(void *)(&(&((struct sockaddr_in6 *)smask )->sin6_addr)->__u6_addr.__u6_addr8[8]) == 0xffffffff) && (*(u_int32_t *)(void *)(&(&((struct sockaddr_in6 *)smask )->sin6_addr)->__u6_addr.__u6_addr8[12]) == 0xffffffff) )) { |
2507 | shostflag = 1; |
2508 | sidtype = "IPV6_ADDR"; |
2509 | } |
2510 | if (IN6_IS_ADDR_FULL(&((struct sockaddr_in6 *)dmask)->sin6_addr)((*(u_int32_t *)(void *)(&(&((struct sockaddr_in6 *)dmask )->sin6_addr)->__u6_addr.__u6_addr8[0]) == 0xffffffff) && (*(u_int32_t *)(void *)(&(&((struct sockaddr_in6 *)dmask )->sin6_addr)->__u6_addr.__u6_addr8[4]) == 0xffffffff) && (*(u_int32_t *)(void *)(&(&((struct sockaddr_in6 *)dmask )->sin6_addr)->__u6_addr.__u6_addr8[8]) == 0xffffffff) && (*(u_int32_t *)(void *)(&(&((struct sockaddr_in6 *)dmask )->sin6_addr)->__u6_addr.__u6_addr8[12]) == 0xffffffff) )) { |
2511 | dhostflag = 1; |
2512 | didtype = "IPV6_ADDR"; |
2513 | } |
2514 | break; |
2515 | } |
2516 | |
2517 | dstaddr = (struct sockaddr *)(dst + 1); |
2518 | bzero(dstbuf, sizeof dstbuf); |
2519 | bzero(srcbuf, sizeof srcbuf); |
2520 | |
2521 | if (dstaddr->sa_family == 0) { |
2522 | /* |
2523 | * Destination was not specified in the flow -- can we derive |
2524 | * it? |
2525 | */ |
2526 | if (dhostflag == 0) { |
2527 | log_print("pf_key_v2_acquire: " |
2528 | "Cannot determine precise destination"); |
2529 | goto fail; |
2530 | } |
2531 | dstaddr = dflow; |
2532 | } |
2533 | switch (dstaddr->sa_family) { |
2534 | case AF_INET2: |
2535 | if (inet_ntop(AF_INET2, |
2536 | &((struct sockaddr_in *) dstaddr)->sin_addr, |
2537 | dstbuf, ADDRESS_MAXsizeof "ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255") == NULL((void *)0)) { |
2538 | log_print("pf_key_v2_acquire: inet_ntop failed"); |
2539 | goto fail; |
2540 | } |
2541 | LOG_DBG((LOG_SYSDEP, 20,log_debug (LOG_SYSDEP, 20, "pf_key_v2_acquire: dst=%s sproto %d" , dstbuf, msg->sadb_msg_satype) |
2542 | "pf_key_v2_acquire: dst=%s sproto %d", dstbuf,log_debug (LOG_SYSDEP, 20, "pf_key_v2_acquire: dst=%s sproto %d" , dstbuf, msg->sadb_msg_satype) |
2543 | msg->sadb_msg_satype))log_debug (LOG_SYSDEP, 20, "pf_key_v2_acquire: dst=%s sproto %d" , dstbuf, msg->sadb_msg_satype); |
2544 | break; |
2545 | |
2546 | case AF_INET624: |
2547 | if (inet_ntop(AF_INET624, |
2548 | &((struct sockaddr_in6 *) dstaddr)->sin6_addr, |
2549 | dstbuf, ADDRESS_MAXsizeof "ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255") == NULL((void *)0)) { |
2550 | log_print("pf_key_v2_acquire: inet_ntop failed"); |
2551 | goto fail; |
2552 | } |
2553 | LOG_DBG((LOG_SYSDEP, 20,log_debug (LOG_SYSDEP, 20, "pf_key_v2_acquire: dst=%s sproto %d" , dstbuf, msg->sadb_msg_satype) |
2554 | "pf_key_v2_acquire: dst=%s sproto %d", dstbuf,log_debug (LOG_SYSDEP, 20, "pf_key_v2_acquire: dst=%s sproto %d" , dstbuf, msg->sadb_msg_satype) |
2555 | msg->sadb_msg_satype))log_debug (LOG_SYSDEP, 20, "pf_key_v2_acquire: dst=%s sproto %d" , dstbuf, msg->sadb_msg_satype); |
2556 | break; |
2557 | } |
2558 | |
2559 | if (src) { |
2560 | srcaddr = (struct sockaddr *) (src + 1); |
2561 | |
2562 | switch (srcaddr->sa_family) { |
2563 | case AF_INET2: |
2564 | if (inet_ntop(AF_INET2, |
2565 | &((struct sockaddr_in *) srcaddr)->sin_addr, |
2566 | srcbuf, ADDRESS_MAXsizeof "ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255") == NULL((void *)0)) { |
2567 | log_print("pf_key_v2_acquire: " |
2568 | "inet_ntop failed"); |
2569 | goto fail; |
2570 | } |
2571 | break; |
2572 | |
2573 | case AF_INET624: |
2574 | if (inet_ntop(AF_INET624, |
2575 | &((struct sockaddr_in6 *)srcaddr)->sin6_addr, |
2576 | srcbuf, ADDRESS_MAXsizeof "ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255") == NULL((void *)0)) { |
2577 | log_print("pf_key_v2_acquire: " |
2578 | "inet_ntop failed"); |
2579 | goto fail; |
2580 | } |
2581 | break; |
2582 | |
2583 | default: |
2584 | /* |
2585 | * The kernel will pass an all '0' EXT_ADDRESS_SRC if |
2586 | * it wasn't specified for the flow. In that case, do |
2587 | * NOT specify the srcaddr in the Peer-name below |
2588 | */ |
2589 | srcbuf[0] = 0; |
2590 | srcaddr = NULL((void *)0); |
2591 | break; |
2592 | } |
2593 | } |
2594 | /* Insert source ID. */ |
2595 | if (srcident) { |
2596 | slen = (srcident->sadb_ident_len * sizeof(u_int64_t)) |
2597 | - sizeof(struct sadb_ident); |
2598 | if (((unsigned char *) (srcident + 1))[slen - 1] != '\0') { |
2599 | log_print("pf_key_v2_acquire: " |
2600 | "source identity not NUL-terminated"); |
2601 | goto fail; |
2602 | } |
2603 | /* Check for valid type. */ |
2604 | switch (srcident->sadb_ident_type) { |
2605 | case SADB_IDENTTYPE_PREFIX1: |
2606 | /* Determine what the address family is. */ |
2607 | srcid = memchr(srcident + 1, ':', slen); |
2608 | if (srcid) |
2609 | afamily = AF_INET624; |
2610 | else |
2611 | afamily = AF_INET2; |
2612 | |
2613 | srcid = memchr(srcident + 1, '/', slen); |
2614 | if (!srcid) { |
2615 | log_print("pf_key_v2_acquire: " |
2616 | "badly formatted PREFIX identity"); |
2617 | goto fail; |
2618 | } |
2619 | masklen = atoi(srcid + 1); |
2620 | |
2621 | /* XXX We only support host addresses. */ |
2622 | if ((afamily == AF_INET624 && masklen != 128) || |
2623 | (afamily == AF_INET2 && masklen != 32)) { |
2624 | log_print("pf_key_v2_acquire: " |
2625 | "non-host address specified in source " |
2626 | "identity (mask length %d), ignoring " |
2627 | "request", masklen); |
2628 | goto fail; |
2629 | } |
2630 | /* |
2631 | * NUL-terminate the PREFIX string at the separator, |
2632 | * then dup. |
2633 | */ |
2634 | *srcid = '\0'; |
2635 | if (asprintf(&srcid, "id-%s", |
2636 | (char *) (srcident + 1)) == -1) { |
2637 | log_error("pf_key_v2_acquire: asprintf() failed"); |
2638 | goto fail; |
2639 | } |
2640 | |
2641 | /* Set the section if it doesn't already exist. */ |
2642 | af = conf_begin(); |
2643 | if (!conf_get_str(srcid, "ID-type")) { |
2644 | if (conf_set(af, srcid, "ID-type", |
2645 | afamily == AF_INET2 ? "IPV4_ADDR" : |
2646 | "IPV6_ADDR", 1, 0) || |
2647 | conf_set(af, srcid, "Refcount", "1", 1, 0) || |
2648 | conf_set(af, srcid, "Address", |
2649 | (char *) (srcident + 1), 1, 0)) { |
2650 | conf_end(af, 0); |
2651 | goto fail; |
2652 | } |
2653 | } else |
2654 | pf_key_v2_conf_refinc(af, srcid); |
2655 | conf_end(af, 1); |
2656 | break; |
2657 | |
2658 | case SADB_IDENTTYPE_FQDN2: |
2659 | prefstring = "FQDN"; |
2660 | /*FALLTHROUGH*/ |
2661 | case SADB_IDENTTYPE_USERFQDN3: |
2662 | if (!prefstring) { |
2663 | prefstring = "USER_FQDN"; |
2664 | |
2665 | /* |
2666 | * Check whether there is a string following |
2667 | * the header; if no, that there is a user ID |
2668 | * (and acquire the login name). If there is |
2669 | * both a string and a user ID, check that |
2670 | * they match. |
2671 | */ |
2672 | if ((slen == 0) && |
2673 | (srcident->sadb_ident_id == 0)) { |
2674 | log_print("pf_key_v2_acquire: " |
2675 | "no user FQDN or ID provided"); |
2676 | goto fail; |
2677 | } |
2678 | if (srcident->sadb_ident_id) { |
2679 | pwd = |
2680 | getpwuid(srcident->sadb_ident_id); |
2681 | if (!pwd) { |
2682 | log_error("pf_key_v2_acquire: " |
2683 | "could not acquire " |
2684 | "username from provided " |
2685 | "ID %llu", |
2686 | srcident->sadb_ident_id); |
2687 | goto fail; |
2688 | } |
2689 | if (slen != 0) |
2690 | if (strcmp(pwd->pw_name, |
2691 | (char *) (srcident + 1)) |
2692 | != 0) { |
2693 | log_print("pf_key_v2_acquire: " |
2694 | "provided user " |
2695 | "name and ID do " |
2696 | "not match (%s != " |
2697 | "%s)", |
2698 | (char *) (srcident + 1), |
2699 | pwd->pw_name); |
2700 | /* |
2701 | * String has |
2702 | * precedence, per |
2703 | * RFC 2367. |
2704 | */ |
2705 | } |
2706 | } |
2707 | } |
2708 | if (asprintf(&srcid, "id-%s", |
2709 | slen ? (char *) (srcident + 1) : pwd->pw_name) == -1) { |
2710 | log_error("pf_key_v2_acquire: asprintf() failed"); |
2711 | goto fail; |
2712 | } |
2713 | pwd = 0; |
2714 | |
2715 | /* Set the section if it doesn't already exist. */ |
2716 | af = conf_begin(); |
2717 | if (!conf_get_str(srcid, "ID-type")) { |
2718 | if (conf_set(af, srcid, "ID-type", prefstring, |
2719 | 1, 0) || |
2720 | conf_set(af, srcid, "Refcount", "1", 1, 0) || |
2721 | conf_set(af, srcid, "Name", |
2722 | srcid + 3, 1, 0)) { |
2723 | conf_end(af, 0); |
2724 | goto fail; |
2725 | } |
2726 | } else |
2727 | pf_key_v2_conf_refinc(af, srcid); |
2728 | conf_end(af, 1); |
2729 | break; |
2730 | |
2731 | default: |
2732 | LOG_DBG((LOG_SYSDEP, 20,log_debug (LOG_SYSDEP, 20, "pf_key_v2_acquire: invalid source ID type %d" , srcident->sadb_ident_type) |
2733 | "pf_key_v2_acquire: invalid source ID type %d",log_debug (LOG_SYSDEP, 20, "pf_key_v2_acquire: invalid source ID type %d" , srcident->sadb_ident_type) |
2734 | srcident->sadb_ident_type))log_debug (LOG_SYSDEP, 20, "pf_key_v2_acquire: invalid source ID type %d" , srcident->sadb_ident_type); |
2735 | goto fail; |
2736 | } |
2737 | |
2738 | LOG_DBG((LOG_SYSDEP, 50,log_debug (LOG_SYSDEP, 50, "pf_key_v2_acquire: constructed source ID \"%s\"" , srcid) |
2739 | "pf_key_v2_acquire: constructed source ID \"%s\"", srcid))log_debug (LOG_SYSDEP, 50, "pf_key_v2_acquire: constructed source ID \"%s\"" , srcid); |
2740 | prefstring = 0; |
2741 | } |
2742 | /* Insert destination ID. */ |
2743 | if (dstident) { |
2744 | slen = (dstident->sadb_ident_len * sizeof(u_int64_t)) |
2745 | - sizeof(struct sadb_ident); |
2746 | |
2747 | /* Check for valid type. */ |
2748 | switch (dstident->sadb_ident_type) { |
2749 | case SADB_IDENTTYPE_PREFIX1: |
2750 | /* Determine what the address family is. */ |
2751 | dstid = memchr(dstident + 1, ':', slen); |
2752 | if (dstid) |
2753 | afamily = AF_INET624; |
2754 | else |
2755 | afamily = AF_INET2; |
2756 | |
2757 | dstid = memchr(dstident + 1, '/', slen); |
2758 | if (!dstid) { |
2759 | log_print("pf_key_v2_acquire: " |
2760 | "badly formatted PREFIX identity"); |
2761 | goto fail; |
2762 | } |
2763 | masklen = atoi(dstid + 1); |
2764 | |
2765 | /* XXX We only support host addresses. */ |
2766 | if ((afamily == AF_INET624 && masklen != 128) || |
2767 | (afamily == AF_INET2 && masklen != 32)) { |
2768 | log_print("pf_key_v2_acquire: " |
2769 | "non-host address specified in " |
2770 | "destination identity (mask length %d), " |
2771 | "ignoring request", masklen); |
2772 | goto fail; |
2773 | } |
2774 | /* |
2775 | * NUL-terminate the PREFIX string at the separator, |
2776 | * then dup. |
2777 | */ |
2778 | *dstid = '\0'; |
2779 | if (asprintf(&dstid, "id-%s", |
2780 | (char *) (dstident + 1)) == -1) { |
2781 | log_error("pf_key_v2_acquire: asprintf() failed"); |
2782 | goto fail; |
2783 | } |
2784 | |
2785 | /* Set the section if it doesn't already exist. */ |
2786 | af = conf_begin(); |
2787 | if (!conf_get_str(dstid, "ID-type")) { |
2788 | if (conf_set(af, dstid, "ID-type", |
2789 | afamily == AF_INET2 ? "IPV4_ADDR" : |
2790 | "IPV6_ADDR", 1, 0) || |
2791 | conf_set(af, dstid, "Refcount", "1", 1, 0) || |
2792 | conf_set(af, dstid, "Address", |
2793 | (char *) (dstident + 1), 1, 0)) { |
2794 | conf_end(af, 0); |
2795 | goto fail; |
2796 | } |
2797 | } else |
2798 | pf_key_v2_conf_refinc(af, dstid); |
2799 | conf_end(af, 1); |
2800 | break; |
2801 | |
2802 | case SADB_IDENTTYPE_FQDN2: |
2803 | prefstring = "FQDN"; |
2804 | /*FALLTHROUGH*/ |
2805 | case SADB_IDENTTYPE_USERFQDN3: |
2806 | if (!prefstring) { |
2807 | prefstring = "USER_FQDN"; |
2808 | |
2809 | /* |
2810 | * Check whether there is a string following |
2811 | * the header; if no, that there is a user ID |
2812 | * (and acquire the login name). If there is |
2813 | * both a string and a user ID, check that |
2814 | * they match. |
2815 | */ |
2816 | if (slen == 0 && |
2817 | dstident->sadb_ident_id == 0) { |
2818 | log_print("pf_key_v2_acquire: " |
2819 | "no user FQDN or ID provided"); |
2820 | goto fail; |
2821 | } |
2822 | if (dstident->sadb_ident_id) { |
2823 | pwd = getpwuid(dstident->sadb_ident_id); |
2824 | if (!pwd) { |
2825 | log_error("pf_key_v2_acquire: " |
2826 | "could not acquire " |
2827 | "username from provided " |
2828 | "ID %llu", |
2829 | dstident->sadb_ident_id); |
2830 | goto fail; |
2831 | } |
2832 | if (slen != 0) |
2833 | if (strcmp(pwd->pw_name, |
2834 | (char *) (dstident + 1)) |
2835 | != 0) { |
2836 | log_print("pf_key_v2_acquire: " |
2837 | "provided user " |
2838 | "name and ID do " |
2839 | "not match (%s != " |
2840 | "%s)", |
2841 | (char *) (dstident + 1), |
2842 | pwd->pw_name); |
2843 | /* |
2844 | * String has |
2845 | * precedence, per RF |
2846 | * 2367. |
2847 | */ |
2848 | } |
2849 | } |
2850 | } |
2851 | if (asprintf(&dstid, "id-%s", |
2852 | slen ? (char *) (dstident + 1) : pwd->pw_name) == -1) { |
2853 | log_error("pf_key_v2_acquire: asprintf() failed"); |
2854 | goto fail; |
2855 | } |
2856 | pwd = 0; |
2857 | |
2858 | /* Set the section if it doesn't already exist. */ |
2859 | af = conf_begin(); |
2860 | if (!conf_get_str(dstid, "ID-type")) { |
2861 | if (conf_set(af, dstid, "ID-type", prefstring, |
2862 | 1, 0) || |
2863 | conf_set(af, dstid, "Refcount", "1", 1, 0) || |
2864 | conf_set(af, dstid, "Name", |
2865 | dstid + 3, 1, 0)) { |
2866 | conf_end(af, 0); |
2867 | goto fail; |
2868 | } |
2869 | } else |
2870 | pf_key_v2_conf_refinc(af, dstid); |
2871 | conf_end(af, 1); |
2872 | break; |
2873 | |
2874 | default: |
2875 | LOG_DBG((LOG_SYSDEP, 20, "pf_key_v2_acquire: "log_debug (LOG_SYSDEP, 20, "pf_key_v2_acquire: " "invalid destination ID type %d" , dstident->sadb_ident_type) |
2876 | "invalid destination ID type %d",log_debug (LOG_SYSDEP, 20, "pf_key_v2_acquire: " "invalid destination ID type %d" , dstident->sadb_ident_type) |
2877 | dstident->sadb_ident_type))log_debug (LOG_SYSDEP, 20, "pf_key_v2_acquire: " "invalid destination ID type %d" , dstident->sadb_ident_type); |
2878 | goto fail; |
2879 | } |
2880 | |
2881 | LOG_DBG((LOG_SYSDEP, 50,log_debug (LOG_SYSDEP, 50, "pf_key_v2_acquire: constructed destination ID \"%s\"" , dstid) |
2882 | "pf_key_v2_acquire: constructed destination ID \"%s\"",log_debug (LOG_SYSDEP, 50, "pf_key_v2_acquire: constructed destination ID \"%s\"" , dstid) |
2883 | dstid))log_debug (LOG_SYSDEP, 50, "pf_key_v2_acquire: constructed destination ID \"%s\"" , dstid); |
2884 | } |
2885 | /* Now we've placed the necessary IDs in the configuration space. */ |
2886 | |
2887 | /* Get a new connection sequence number. */ |
2888 | for (;; connection_seq++) { |
2889 | snprintf(conn, connlen, "Connection-%u", connection_seq); |
2890 | |
2891 | /* Does it exist ? */ |
2892 | if (!conf_get_str(conn, "Phase")) |
2893 | break; |
2894 | } |
2895 | |
2896 | /* |
2897 | * Set the IPsec connection entry. In particular, the following fields: |
2898 | * - Phase |
2899 | * - ISAKMP-peer |
2900 | * - Local-ID/Remote-ID (if provided) |
2901 | * - Acquire-ID (sequence number of kernel message, e.g., PF_KEYv2) |
2902 | * - Configuration |
2903 | * |
2904 | * Also set the following section: |
2905 | * [peer-dstaddr(-local-srcaddr)] |
2906 | * with these fields: |
2907 | * - Phase |
2908 | * - ID (if provided) |
2909 | * - Remote-ID (if provided) |
2910 | * - Local-address (if provided) |
2911 | * - Address |
2912 | * - Configuration (if an entry phase1-dstaddr-srcadd) |
2913 | * exists -- otherwise use the defaults) |
2914 | */ |
2915 | |
2916 | /* |
2917 | * The various cases: |
2918 | * - peer-dstaddr |
2919 | * - peer-dstaddr-local-srcaddr |
2920 | */ |
2921 | if (asprintf(&peer, "peer-%s%s%s", dstbuf, srcaddr ? "-local-" : "", |
2922 | srcaddr ? srcbuf : "") == -1) |
2923 | goto fail; |
2924 | |
2925 | /* |
2926 | * Set the IPsec connection section. Refcount is set to 2, because |
2927 | * it will be linked both to the incoming and the outgoing SA. |
2928 | */ |
2929 | af = conf_begin(); |
2930 | if (conf_set(af, conn, "Phase", "2", 0, 0) || |
2931 | conf_set(af, conn, "Flags", "__ondemand", 0, 0) || |
2932 | conf_set(af, conn, "Refcount", "2", 0, 0) || |
2933 | conf_set(af, conn, "ISAKMP-peer", peer, 0, 0)) { |
2934 | conf_end(af, 0); |
2935 | goto fail; |
2936 | } |
2937 | /* Set the sequence number. */ |
2938 | snprintf(lname, sizeof lname, "%u", msg->sadb_msg_seq); |
2939 | if (conf_set(af, conn, "Acquire-ID", lname, 0, 0)) { |
2940 | conf_end(af, 0); |
2941 | goto fail; |
2942 | } |
2943 | /* |
2944 | * Set Phase 2 IDs -- this is the Local-ID section. |
2945 | * - from-address |
2946 | * - from-address=proto |
2947 | * - from-address=proto:port |
2948 | * - from-network/masklen |
2949 | * - from-network/masklen=proto |
2950 | * - from-network/masklen=proto:port |
2951 | */ |
2952 | phase2id(lname, sizeof lname, "from", ssflow, smasklen, tproto, sport); |
2953 | if (conf_set(af, conn, "Local-ID", lname, 0, 0)) { |
2954 | conf_end(af, 0); |
2955 | goto fail; |
2956 | } |
2957 | if (!conf_get_str(lname, "ID-type")) { |
2958 | if (conf_set(af, lname, "Refcount", "1", 0, 0)) { |
2959 | conf_end(af, 0); |
2960 | goto fail; |
2961 | } |
2962 | if (shostflag) { |
2963 | if (conf_set(af, lname, "ID-type", sidtype, 0, 0) || |
2964 | conf_set(af, lname, "Address", ssflow, 0, 0)) { |
2965 | conf_end(af, 0); |
2966 | goto fail; |
2967 | } |
2968 | } else { |
2969 | if (conf_set(af, lname, "ID-type", sidtype, 0, 0) || |
2970 | conf_set(af, lname, "Network", ssflow, 0, 0) || |
2971 | conf_set(af, lname, "Netmask", ssmask, 0, 0)) { |
2972 | conf_end(af, 0); |
2973 | goto fail; |
2974 | } |
2975 | } |
2976 | if (tproto) { |
2977 | snprintf(tmbuf, sizeof sport * 3 + 1, "%u", tproto); |
2978 | if (conf_set(af, lname, "Protocol", tmbuf, 0, 0)) { |
2979 | conf_end(af, 0); |
2980 | goto fail; |
2981 | } |
2982 | if (sport) { |
2983 | snprintf(tmbuf, sizeof sport * 3 + 1, "%u", |
2984 | ntohs(sport)(__uint16_t)(__builtin_constant_p(sport) ? (__uint16_t)(((__uint16_t )(sport) & 0xffU) << 8 | ((__uint16_t)(sport) & 0xff00U) >> 8) : __swap16md(sport))); |
2985 | if (conf_set(af, lname, "Port", tmbuf, 0, 0)) { |
2986 | conf_end(af, 0); |
2987 | goto fail; |
2988 | } |
2989 | } |
2990 | } |
2991 | } else |
2992 | pf_key_v2_conf_refinc(af, lname); |
2993 | |
2994 | /* |
2995 | * Set Remote-ID section. |
2996 | * to-address |
2997 | * to-address=proto |
2998 | * to-address=proto:port |
2999 | * to-network/masklen |
3000 | * to-network/masklen=proto |
3001 | * to-network/masklen=proto:port |
3002 | */ |
3003 | phase2id(dname, sizeof dname, "to", sdflow, dmasklen, tproto, dport); |
3004 | if (conf_set(af, conn, "Remote-ID", dname, 0, 0)) { |
3005 | conf_end(af, 0); |
3006 | goto fail; |
3007 | } |
3008 | if (!conf_get_str(dname, "ID-type")) { |
3009 | if (conf_set(af, dname, "Refcount", "1", 0, 0)) { |
3010 | conf_end(af, 0); |
3011 | goto fail; |
3012 | } |
3013 | if (dhostflag) { |
3014 | if (conf_set(af, dname, "ID-type", didtype, 0, 0) || |
3015 | conf_set(af, dname, "Address", sdflow, 0, 0)) { |
3016 | conf_end(af, 0); |
3017 | goto fail; |
3018 | } |
3019 | } else { |
3020 | if (conf_set(af, dname, "ID-type", didtype, 0, 0) || |
3021 | conf_set(af, dname, "Network", sdflow, 0, 0) || |
3022 | conf_set(af, dname, "Netmask", sdmask, 0, 0)) { |
3023 | conf_end(af, 0); |
3024 | goto fail; |
3025 | } |
3026 | } |
3027 | |
3028 | if (tproto) { |
3029 | snprintf(tmbuf, sizeof dport * 3 + 1, "%u", tproto); |
3030 | if (conf_set(af, dname, "Protocol", tmbuf, 0, 0)) { |
3031 | conf_end(af, 0); |
3032 | goto fail; |
3033 | } |
3034 | if (dport) { |
3035 | snprintf(tmbuf, sizeof dport * 3 + 1, "%u", |
3036 | ntohs(dport)(__uint16_t)(__builtin_constant_p(dport) ? (__uint16_t)(((__uint16_t )(dport) & 0xffU) << 8 | ((__uint16_t)(dport) & 0xff00U) >> 8) : __swap16md(dport))); |
3037 | if (conf_set(af, dname, "Port", tmbuf, 0, 0)) { |
3038 | conf_end(af, 0); |
3039 | goto fail; |
3040 | } |
3041 | } |
3042 | } |
3043 | } else |
3044 | pf_key_v2_conf_refinc(af, dname); |
3045 | |
3046 | /* |
3047 | * XXX |
3048 | * We should be using information from the proposal to set this up. |
3049 | * At least, we should make this selectable. |
3050 | */ |
3051 | |
3052 | /* |
3053 | * Phase 2 configuration. |
3054 | * - phase2-from-address-to-address |
3055 | * - ... |
3056 | * - phase2-from-net/len=proto:port-to-net/len=proto:port |
3057 | */ |
3058 | snprintf(configname, sizeof configname, "phase2-%s-%s", lname, dname); |
3059 | if (conf_set(af, conn, "Configuration", configname, 0, 0)) { |
3060 | conf_end(af, 0); |
3061 | goto fail; |
3062 | } |
3063 | if (!conf_get_str(configname, "Exchange_type")) { |
3064 | if (conf_set(af, configname, "Exchange_type", "Quick_mode", |
3065 | 0, 0) || |
3066 | conf_set(af, peer, "Refcount", "1", 0, 0) || |
3067 | conf_set(af, configname, "DOI", "IPSEC", 0, 0)) { |
3068 | conf_end(af, 0); |
3069 | goto fail; |
3070 | } |
3071 | if (conf_get_str("General", "Default-phase-2-suites")) { |
3072 | if (conf_set(af, configname, "Suites", |
3073 | conf_get_str("General", "Default-phase-2-suites"), |
3074 | 0, 0)) { |
3075 | conf_end(af, 0); |
3076 | goto fail; |
3077 | } |
3078 | } else { |
3079 | if (conf_set(af, configname, "Suites", |
3080 | "QM-ESP-3DES-SHA-PFS-SUITE", 0, 0)) { |
3081 | conf_end(af, 0); |
3082 | goto fail; |
3083 | } |
3084 | } |
3085 | } else |
3086 | pf_key_v2_conf_refinc(af, configname); |
3087 | |
3088 | /* Set the ISAKMP-peer section. */ |
3089 | if (!conf_get_str(peer, "Phase")) { |
3090 | if (conf_set(af, peer, "Phase", "1", 0, 0) || |
3091 | conf_set(af, peer, "Refcount", "1", 0, 0) || |
3092 | conf_set(af, peer, "Address", dstbuf, 0, 0)) { |
3093 | conf_end(af, 0); |
3094 | goto fail; |
3095 | } |
3096 | if (srcaddr && conf_set(af, peer, "Local-address", srcbuf, 0, |
3097 | 0)) { |
3098 | conf_end(af, 0); |
3099 | goto fail; |
3100 | } |
3101 | snprintf(confname, sizeof confname, "phase1-%s", peer); |
3102 | if (conf_set(af, peer, "Configuration", confname, 0, 0)) { |
3103 | conf_end(af, 0); |
3104 | goto fail; |
3105 | } |
3106 | |
3107 | /* Phase 1 configuration. */ |
3108 | if (!conf_get_str(confname, "exchange_type")) { |
3109 | xform = conf_get_str("Default-phase-1-configuration", |
3110 | "Transforms"); |
3111 | if (conf_set(af, confname, "Transforms", xform ? xform : |
3112 | "3DES-SHA-RSA_SIG", 0, 0)) { |
3113 | conf_end(af, 0); |
3114 | goto fail; |
3115 | } |
3116 | |
3117 | if (conf_set(af, confname, "Exchange_Type", "ID_PROT", |
3118 | 0, 0) || |
3119 | conf_set(af, confname, "DOI", "IPSEC", 0, 0) || |
3120 | conf_set(af, confname, "Refcount", "1", 0, 0)) { |
3121 | conf_end(af, 0); |
3122 | goto fail; |
3123 | } |
3124 | } else |
3125 | pf_key_v2_conf_refinc(af, confname); |
3126 | |
3127 | /* The ID we should use in Phase 1. */ |
3128 | if (srcid && conf_set(af, peer, "ID", srcid, 0, 0)) { |
3129 | conf_end(af, 0); |
3130 | goto fail; |
3131 | } |
3132 | /* The ID the other side should use in Phase 1. */ |
3133 | if (dstid && conf_set(af, peer, "Remote-ID", dstid, 0, 0)) { |
3134 | conf_end(af, 0); |
3135 | goto fail; |
3136 | } |
3137 | } else |
3138 | pf_key_v2_conf_refinc(af, peer); |
3139 | |
3140 | /* All done. */ |
3141 | conf_end(af, 1); |
3142 | |
3143 | /* Let's rock 'n roll. */ |
3144 | connection_record_passive(conn); |
3145 | pf_key_v2_connection_check(conn); |
3146 | conn = 0; |
3147 | |
3148 | /* Fall-through to cleanup. */ |
3149 | fail: |
3150 | if (ret) |
3151 | pf_key_v2_msg_free(ret); |
3152 | if (askpolicy) |
3153 | pf_key_v2_msg_free(askpolicy); |
3154 | free(srcid); |
3155 | free(dstid); |
3156 | free(peer); |
3157 | free(conn); |
3158 | return; |
3159 | } |
3160 | |
3161 | static void |
3162 | pf_key_v2_notify(struct pf_key_v2_msg *msg) |
3163 | { |
3164 | switch (((struct sadb_msg *)TAILQ_FIRST(msg)((msg)->tqh_first)->seg)->sadb_msg_type) { |
3165 | case SADB_EXPIRE8: |
3166 | pf_key_v2_expire(msg); |
3167 | break; |
3168 | |
3169 | case SADB_ACQUIRE6: |
3170 | if (!ui_daemon_passive) |
3171 | pf_key_v2_acquire(msg); |
3172 | break; |
3173 | |
3174 | default: |
3175 | log_print("pf_key_v2_notify: unexpected message type (%d)", |
3176 | ((struct sadb_msg *)TAILQ_FIRST(msg)((msg)->tqh_first)->seg)->sadb_msg_type); |
3177 | } |
3178 | pf_key_v2_msg_free(msg); |
3179 | } |
3180 | |
3181 | void |
3182 | pf_key_v2_handler(int fd) |
3183 | { |
3184 | struct pf_key_v2_msg *msg; |
3185 | int n; |
3186 | |
3187 | /* |
3188 | * As synchronous read/writes to the socket can have taken place |
3189 | * between the select(2) call of the main loop and this handler, we |
3190 | * need to recheck the readability. |
3191 | */ |
3192 | if (ioctl(pf_key_v2_socket, FIONREAD((unsigned long)0x40000000 | ((sizeof(int) & 0x1fff) << 16) | ((('f')) << 8) | ((127))), &n) == -1) { |
3193 | log_error("pf_key_v2_handler: ioctl (%d, FIONREAD, &n) failed", |
3194 | pf_key_v2_socket); |
3195 | return; |
3196 | } |
3197 | if (!n) |
3198 | return; |
3199 | |
3200 | msg = pf_key_v2_read(0); |
3201 | if (msg) |
3202 | pf_key_v2_notify(msg); |
3203 | } |
3204 | |
3205 | /* |
3206 | * Group 2 IPsec SAs given by the PROTO1 and PROTO2 protocols of the SA IKE |
3207 | * security association in a chain. |
3208 | * XXX Assumes OpenBSD GRPSPIS extension. |
3209 | */ |
3210 | int |
3211 | pf_key_v2_group_spis(struct sa *sa, struct proto *proto1, |
3212 | struct proto *proto2, int incoming) |
3213 | { |
3214 | struct sadb_msg msg; |
3215 | struct sadb_sa sa1, sa2; |
3216 | struct sadb_address *addr = 0; |
3217 | struct sadb_protocol protocol; |
3218 | struct pf_key_v2_msg *grpspis = 0, *ret = 0; |
3219 | struct sockaddr *saddr; |
3220 | int err; |
3221 | size_t len; |
3222 | |
3223 | msg.sadb_msg_type = SADB_X_GRPSPIS14; |
3224 | switch (proto1->proto) { |
3225 | case IPSEC_PROTO_IPSEC_ESP3: |
3226 | msg.sadb_msg_satype = SADB_SATYPE_ESP2; |
3227 | break; |
3228 | case IPSEC_PROTO_IPSEC_AH2: |
3229 | msg.sadb_msg_satype = SADB_SATYPE_AH1; |
3230 | break; |
3231 | case IPSEC_PROTO_IPCOMP4: |
3232 | msg.sadb_msg_satype = SADB_X_SATYPE_IPCOMP9; |
3233 | break; |
3234 | default: |
3235 | log_print("pf_key_v2_group_spis: invalid proto %d", |
3236 | proto1->proto); |
3237 | goto cleanup; |
3238 | } |
3239 | msg.sadb_msg_seq = 0; |
3240 | grpspis = pf_key_v2_msg_new(&msg, 0); |
3241 | if (!grpspis) |
3242 | goto cleanup; |
3243 | |
3244 | /* Setup the SA extensions. */ |
3245 | sa1.sadb_sa_exttype = SADB_EXT_SA1; |
3246 | sa1.sadb_sa_len = sizeof sa1 / PF_KEY_V2_CHUNK8; |
3247 | memcpy(&sa1.sadb_sa_spi, proto1->spi[incoming], |
3248 | sizeof sa1.sadb_sa_spi); |
3249 | sa1.sadb_sa_replay = 0; |
3250 | sa1.sadb_sa_state = 0; |
3251 | sa1.sadb_sa_auth = 0; |
3252 | sa1.sadb_sa_encrypt = 0; |
3253 | sa1.sadb_sa_flags = 0; |
3254 | if (pf_key_v2_msg_add(grpspis, (struct sadb_ext *)&sa1, 0) == -1) |
3255 | goto cleanup; |
3256 | |
3257 | sa2.sadb_sa_exttype = SADB_X_EXT_SA223; |
3258 | sa2.sadb_sa_len = sizeof sa2 / PF_KEY_V2_CHUNK8; |
3259 | memcpy(&sa2.sadb_sa_spi, proto2->spi[incoming], |
3260 | sizeof sa2.sadb_sa_spi); |
3261 | sa2.sadb_sa_replay = 0; |
3262 | sa2.sadb_sa_state = 0; |
3263 | sa2.sadb_sa_auth = 0; |
3264 | sa2.sadb_sa_encrypt = 0; |
3265 | sa2.sadb_sa_flags = 0; |
3266 | if (pf_key_v2_msg_add(grpspis, (struct sadb_ext *)&sa2, 0) == -1) |
3267 | goto cleanup; |
3268 | |
3269 | /* |
3270 | * Setup the ADDRESS extensions. |
3271 | */ |
3272 | if (incoming) |
3273 | sa->transport->vtbl->get_src(sa->transport, &saddr); |
3274 | else |
3275 | sa->transport->vtbl->get_dst(sa->transport, &saddr); |
3276 | len = sizeof *addr + PF_KEY_V2_ROUND(SA_LEN(saddr))(((((saddr)->sa_len)) + 8 - 1) & ~(8 - 1)); |
3277 | addr = calloc(1, len); |
3278 | if (!addr) |
3279 | goto cleanup; |
3280 | addr->sadb_address_exttype = SADB_EXT_ADDRESS_DST6; |
3281 | addr->sadb_address_len = len / PF_KEY_V2_CHUNK8; |
3282 | addr->sadb_address_reserved = 0; |
3283 | memcpy(addr + 1, saddr, SA_LEN(saddr)((saddr)->sa_len)); |
3284 | ((struct sockaddr_in *) (addr + 1))->sin_port = 0; |
3285 | if (pf_key_v2_msg_add(grpspis, (struct sadb_ext *) addr, |
3286 | PF_KEY_V2_NODE_MALLOCED1) == -1) |
3287 | goto cleanup; |
3288 | addr = 0; |
3289 | |
3290 | addr = calloc(1, len); |
3291 | if (!addr) |
3292 | goto cleanup; |
3293 | addr->sadb_address_exttype = SADB_X_EXT_DST224; |
3294 | addr->sadb_address_len = len / PF_KEY_V2_CHUNK8; |
3295 | addr->sadb_address_reserved = 0; |
3296 | memcpy(addr + 1, saddr, SA_LEN(saddr)((saddr)->sa_len)); |
3297 | ((struct sockaddr_in *) (addr + 1))->sin_port = 0; |
3298 | if (pf_key_v2_msg_add(grpspis, (struct sadb_ext *) addr, |
3299 | PF_KEY_V2_NODE_MALLOCED1) == -1) |
3300 | goto cleanup; |
3301 | addr = 0; |
3302 | |
3303 | /* Setup the sa type extension. */ |
3304 | protocol.sadb_protocol_exttype = SADB_X_EXT_SATYPE235; |
3305 | protocol.sadb_protocol_len = sizeof protocol / PF_KEY_V2_CHUNK8; |
3306 | switch (proto2->proto) { |
3307 | case IPSEC_PROTO_IPSEC_ESP3: |
3308 | protocol.sadb_protocol_proto = SADB_SATYPE_ESP2; |
3309 | break; |
3310 | case IPSEC_PROTO_IPSEC_AH2: |
3311 | protocol.sadb_protocol_proto = SADB_SATYPE_AH1; |
3312 | break; |
3313 | case IPSEC_PROTO_IPCOMP4: |
3314 | protocol.sadb_protocol_proto = SADB_X_SATYPE_IPCOMP9; |
3315 | break; |
3316 | default: |
3317 | log_print("pf_key_v2_group_spis: invalid proto %d", |
3318 | proto2->proto); |
3319 | goto cleanup; |
3320 | } |
3321 | protocol.sadb_protocol_reserved2 = 0; |
3322 | if (pf_key_v2_msg_add(grpspis, |
3323 | (struct sadb_ext *)&protocol, 0) == -1) |
3324 | goto cleanup; |
3325 | |
3326 | ret = pf_key_v2_call(grpspis); |
3327 | pf_key_v2_msg_free(grpspis); |
3328 | grpspis = 0; |
3329 | if (!ret) |
3330 | goto cleanup; |
3331 | err = ((struct sadb_msg *)TAILQ_FIRST(ret)((ret)->tqh_first)->seg)->sadb_msg_errno; |
3332 | if (err) { |
3333 | log_print("pf_key_v2_group_spis: GRPSPIS: %s", strerror(err)); |
3334 | goto cleanup; |
3335 | } |
3336 | pf_key_v2_msg_free(ret); |
3337 | |
3338 | LOG_DBG((LOG_SYSDEP, 50, "pf_key_v2_group_spis: done"))log_debug (LOG_SYSDEP, 50, "pf_key_v2_group_spis: done"); |
3339 | |
3340 | return 0; |
3341 | |
3342 | cleanup: |
3343 | free(addr); |
3344 | if (grpspis) |
3345 | pf_key_v2_msg_free(grpspis); |
3346 | if (ret) |
3347 | pf_key_v2_msg_free(ret); |
3348 | return -1; |
3349 | } |