/usr/src/usr.sbin/bgpd/pfkey.c

Bug Summary

File:	src/usr.sbin/bgpd/pfkey.c
Warning:	line 466, column 25 The left operand of '!=' is a garbage value

Annotated Source Code

Press '?' to see keyboard shortcuts

Show analyzer invocation

clang -cc1 -cc1 -triple amd64-unknown-openbsd7.0 -analyze -disable-free -disable-llvm-verifier -discard-value-names -main-file-name pfkey.c -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 1 -pic-is-pie -mframe-pointer=all -relaxed-aliasing -fno-rounding-math -mconstructor-aliases -munwind-tables -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/usr.sbin/bgpd/obj -resource-dir /usr/local/lib/clang/13.0.0 -I /usr/src/usr.sbin/bgpd -internal-isystem /usr/local/lib/clang/13.0.0/include -internal-externc-isystem /usr/include -O2 -fdebug-compilation-dir=/usr/src/usr.sbin/bgpd/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /home/ben/Projects/vmm/scan-build/2022-01-12-194120-40624-1 -x c /usr/src/usr.sbin/bgpd/pfkey.c

1/*	$OpenBSD: pfkey.c,v 1.61 2020/04/23 16:13:11 claudio Exp $ */

3/*
* Copyright (c) 2003, 2004 Henning Brauer <henning@openbsd.org>
* Copyright (c) 2003, 2004 Markus Friedl <markus@openbsd.org>
*
* Permission to use, copy, modify, and distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
* copyright notice and this permission notice appear in all copies.
*
* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
* ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/

20#include <sys/types.h>
21#include <sys/socket.h>
22#include <sys/uio.h>
23#include <net/pfkeyv2.h>
24#include <netinet/ip_ipsp.h>
25#include <netinet/in.h>
26#include <netinet/tcp.h>
27#include <ctype.h>
28#include <errno(*__errno()).h>
29#include <limits.h>
30#include <stdlib.h>
31#include <string.h>
32#include <unistd.h>

34#include "bgpd.h"
35#include "session.h"
36#include "log.h"

38extern struct bgpd_sysdep sysdep;

40#define	PFKEY2_CHUNKsizeof(u_int64_t) sizeof(u_int64_t)
41#define	ROUNDUP(x)(((x) + (sizeof(u_int64_t) - 1)) & ~(sizeof(u_int64_t) - 1
)) (((x) + (PFKEY2_CHUNKsizeof(u_int64_t) - 1)) & ~(PFKEY2_CHUNKsizeof(u_int64_t) - 1))
42#define	IOV_CNT20	20

44static u_int32_t	sadb_msg_seq = 0;
45static u_int32_t	pid = 0; /* should pid_t but pfkey needs u_int32_t */
46static int		pfkey_fd;

48int	pfkey_reply(int, u_int32_t *);
49int	pfkey_send(int, uint8_t, uint8_t, uint8_t,
   struct bgpd_addr *, struct bgpd_addr *,
   u_int32_t, uint8_t, int, char *, uint8_t, int, char *,
   uint16_t, uint16_t);

54#define pfkey_flow(fd, satype, cmd, dir, from, to, sport, dport)pfkey_send(fd, satype, cmd, dir, from, to, 0, 0, 0, ((void *)
0), 0, 0, ((void *)0), sport, dport) \
pfkey_send(fd, satype, cmd, dir, from, to, \
   0, 0, 0, NULL((void *)0), 0, 0, NULL((void *)0), sport, dport)

58static struct bgpd_addr *
59pfkey_localaddr(struct peer *p)
60{
switch (p->conf.remote_addr.aid) {
case AID_INET1:
return &p->conf.local_addr_v4;
case AID_INET62:
return &p->conf.local_addr_v6;
}
fatalx("Unknown AID in pfkey_localaddr");
68}

70int
71pfkey_send(int sd, uint8_t satype, uint8_t mtype, uint8_t dir,
  struct bgpd_addr *src, struct bgpd_addr *dst, u_int32_t spi,
  uint8_t aalg, int alen, char *akey, uint8_t ealg, int elen, char *ekey,
  uint16_t sport, uint16_t dport)
75{
struct sadb_msg		smsg;
struct sadb_sa		sa;
struct sadb_address	sa_src, sa_dst, sa_peer, sa_smask, sa_dmask;
struct sadb_key		sa_akey, sa_ekey;
struct sadb_spirange	sa_spirange;
struct sadb_protocol	sa_flowtype, sa_protocol;
struct iovec		iov[IOV_CNT20];
ssize_t			n;
int			len = 0;
int			iov_cnt;
struct sockaddr_storage	ssrc, sdst, speer, smask, dmask;
struct sockaddr		*saptr;
socklen_t		 salen;

if (!pid)
pid = getpid();

/* we need clean sockaddr... no ports set */
bzero(&ssrc, sizeof(ssrc));
bzero(&smask, sizeof(smask));
if ((saptr = addr2sa(src, 0, &salen))) {
memcpy(&ssrc, saptr, salen);
ssrc.ss_len = salen;
}
switch (src->aid) {
case AID_INET1:
memset(&((struct sockaddr_in *)&smask)->sin_addr, 0xff, 32/8);
break;
case AID_INET62:
memset(&((struct sockaddr_in6 *)&smask)->sin6_addr, 0xff,
    128/8);
break;
case AID_UNSPEC0:
ssrc.ss_len = sizeof(struct sockaddr);
break;
default:
return (-1);
}
smask.ss_family = ssrc.ss_family;
smask.ss_len = ssrc.ss_len;

bzero(&sdst, sizeof(sdst));
bzero(&dmask, sizeof(dmask));
if ((saptr = addr2sa(dst, 0, &salen))) {
memcpy(&sdst, saptr, salen);
sdst.ss_len = salen;
}
switch (dst->aid) {
case AID_INET1:
memset(&((struct sockaddr_in *)&dmask)->sin_addr, 0xff, 32/8);
break;
case AID_INET62:
memset(&((struct sockaddr_in6 *)&dmask)->sin6_addr, 0xff,
    128/8);
break;
case AID_UNSPEC0:
sdst.ss_len = sizeof(struct sockaddr);
break;
default:
return (-1);
}
dmask.ss_family = sdst.ss_family;
dmask.ss_len = sdst.ss_len;

bzero(&smsg, sizeof(smsg));
smsg.sadb_msg_version = PF_KEY_V22;
smsg.sadb_msg_seq = ++sadb_msg_seq;
smsg.sadb_msg_pid = pid;
smsg.sadb_msg_len = sizeof(smsg) / 8;
smsg.sadb_msg_type = mtype;
smsg.sadb_msg_satype = satype;

switch (mtype) {
case SADB_GETSPI1:
bzero(&sa_spirange, sizeof(sa_spirange));
sa_spirange.sadb_spirange_exttype = SADB_EXT_SPIRANGE16;
sa_spirange.sadb_spirange_len = sizeof(sa_spirange) / 8;
sa_spirange.sadb_spirange_min = 0x100;
sa_spirange.sadb_spirange_max = 0xffffffff;
sa_spirange.sadb_spirange_reserved = 0;
break;
case SADB_ADD3:
case SADB_UPDATE2:
case SADB_DELETE4:
bzero(&sa, sizeof(sa));
sa.sadb_sa_exttype = SADB_EXT_SA1;
sa.sadb_sa_len = sizeof(sa) / 8;
sa.sadb_sa_replay = 0;
sa.sadb_sa_spi = htonl(spi)(__uint32_t)(__builtin_constant_p(spi) ? (__uint32_t)(((__uint32_t
)(spi) & 0xff) << 24 | ((__uint32_t)(spi) & 0xff00
) << 8 | ((__uint32_t)(spi) & 0xff0000) >> 8 |
 ((__uint32_t)(spi) & 0xff000000) >> 24) : __swap32md
(spi));
sa.sadb_sa_state = SADB_SASTATE_MATURE1;
break;
case SADB_X_ADDFLOW12:
case SADB_X_DELFLOW13:
bzero(&sa_flowtype, sizeof(sa_flowtype));
sa_flowtype.sadb_protocol_exttype = SADB_X_EXT_FLOW_TYPE20;
sa_flowtype.sadb_protocol_len = sizeof(sa_flowtype) / 8;
sa_flowtype.sadb_protocol_direction = dir;
sa_flowtype.sadb_protocol_proto = SADB_X_FLOW_TYPE_REQUIRE3;

bzero(&sa_protocol, sizeof(sa_protocol));
sa_protocol.sadb_protocol_exttype = SADB_X_EXT_PROTOCOL19;
sa_protocol.sadb_protocol_len = sizeof(sa_protocol) / 8;
sa_protocol.sadb_protocol_direction = 0;
sa_protocol.sadb_protocol_proto = 6;
break;
}

bzero(&sa_src, sizeof(sa_src));
sa_src.sadb_address_exttype = SADB_EXT_ADDRESS_SRC5;
sa_src.sadb_address_len = (sizeof(sa_src) + ROUNDUP(ssrc.ss_len)(((ssrc.ss_len) + (sizeof(u_int64_t) - 1)) & ~(sizeof(u_int64_t
) - 1))) / 8;

bzero(&sa_dst, sizeof(sa_dst));
sa_dst.sadb_address_exttype = SADB_EXT_ADDRESS_DST6;
sa_dst.sadb_address_len = (sizeof(sa_dst) + ROUNDUP(sdst.ss_len)(((sdst.ss_len) + (sizeof(u_int64_t) - 1)) & ~(sizeof(u_int64_t
) - 1))) / 8;

sa.sadb_sa_auth = aalg;
sa.sadb_sa_encrypt = SADB_X_EALG_AES12; /* XXX */

switch (mtype) {
case SADB_ADD3:
case SADB_UPDATE2:
bzero(&sa_akey, sizeof(sa_akey));
sa_akey.sadb_key_exttype = SADB_EXT_KEY_AUTH8;
sa_akey.sadb_key_len = (sizeof(sa_akey) +
    ((alen + 7) / 8) * 8) / 8;
sa_akey.sadb_key_bits = 8 * alen;

bzero(&sa_ekey, sizeof(sa_ekey));
sa_ekey.sadb_key_exttype = SADB_EXT_KEY_ENCRYPT9;
sa_ekey.sadb_key_len = (sizeof(sa_ekey) +
    ((elen + 7) / 8) * 8) / 8;
sa_ekey.sadb_key_bits = 8 * elen;

break;
case SADB_X_ADDFLOW12:
case SADB_X_DELFLOW13:
/* sa_peer always points to the remote machine */
if (dir == IPSP_DIRECTION_IN0x1) {
	speer = ssrc;
	sa_peer = sa_src;
} else {
	speer = sdst;
	sa_peer = sa_dst;
}
sa_peer.sadb_address_exttype = SADB_EXT_ADDRESS_DST6;
sa_peer.sadb_address_len =
    (sizeof(sa_peer) + ROUNDUP(speer.ss_len)(((speer.ss_len) + (sizeof(u_int64_t) - 1)) & ~(sizeof(u_int64_t
) - 1))) / 8;

/* for addflow we also use src/dst as the flow destination */
sa_src.sadb_address_exttype = SADB_X_EXT_SRC_FLOW21;
sa_dst.sadb_address_exttype = SADB_X_EXT_DST_FLOW22;

bzero(&smask, sizeof(smask));
switch (src->aid) {
case AID_INET1:
	smask.ss_len = sizeof(struct sockaddr_in);
	smask.ss_family = AF_INET2;
	memset(&((struct sockaddr_in *)&smask)->sin_addr,
	    0xff, 32/8);
	if (sport) {
		((struct sockaddr_in *)&ssrc)->sin_port =
		    htons(sport)(__uint16_t)(__builtin_constant_p(sport) ? (__uint16_t)(((__uint16_t
)(sport) & 0xffU) << 8 | ((__uint16_t)(sport) &
 0xff00U) >> 8) : __swap16md(sport));
		((struct sockaddr_in *)&smask)->sin_port =
		    htons(0xffff)(__uint16_t)(__builtin_constant_p(0xffff) ? (__uint16_t)(((__uint16_t
)(0xffff) & 0xffU) << 8 | ((__uint16_t)(0xffff) &
 0xff00U) >> 8) : __swap16md(0xffff));
	}
	break;
case AID_INET62:
	smask.ss_len = sizeof(struct sockaddr_in6);
	smask.ss_family = AF_INET624;
	memset(&((struct sockaddr_in6 *)&smask)->sin6_addr,
	    0xff, 128/8);
	if (sport) {
		((struct sockaddr_in6 *)&ssrc)->sin6_port =
		    htons(sport)(__uint16_t)(__builtin_constant_p(sport) ? (__uint16_t)(((__uint16_t
)(sport) & 0xffU) << 8 | ((__uint16_t)(sport) &
 0xff00U) >> 8) : __swap16md(sport));
		((struct sockaddr_in6 *)&smask)->sin6_port =
		    htons(0xffff)(__uint16_t)(__builtin_constant_p(0xffff) ? (__uint16_t)(((__uint16_t
)(0xffff) & 0xffU) << 8 | ((__uint16_t)(0xffff) &
 0xff00U) >> 8) : __swap16md(0xffff));
	}
	break;
}
bzero(&dmask, sizeof(dmask));
switch (dst->aid) {
case AID_INET1:
	dmask.ss_len = sizeof(struct sockaddr_in);
	dmask.ss_family = AF_INET2;
	memset(&((struct sockaddr_in *)&dmask)->sin_addr,
	    0xff, 32/8);
	if (dport) {
		((struct sockaddr_in *)&sdst)->sin_port =
		    htons(dport)(__uint16_t)(__builtin_constant_p(dport) ? (__uint16_t)(((__uint16_t
)(dport) & 0xffU) << 8 | ((__uint16_t)(dport) &
 0xff00U) >> 8) : __swap16md(dport));
		((struct sockaddr_in *)&dmask)->sin_port =
		    htons(0xffff)(__uint16_t)(__builtin_constant_p(0xffff) ? (__uint16_t)(((__uint16_t
)(0xffff) & 0xffU) << 8 | ((__uint16_t)(0xffff) &
 0xff00U) >> 8) : __swap16md(0xffff));
	}
	break;
case AID_INET62:
	dmask.ss_len = sizeof(struct sockaddr_in6);
	dmask.ss_family = AF_INET624;
	memset(&((struct sockaddr_in6 *)&dmask)->sin6_addr,
	    0xff, 128/8);
	if (dport) {
		((struct sockaddr_in6 *)&sdst)->sin6_port =
		    htons(dport)(__uint16_t)(__builtin_constant_p(dport) ? (__uint16_t)(((__uint16_t
)(dport) & 0xffU) << 8 | ((__uint16_t)(dport) &
 0xff00U) >> 8) : __swap16md(dport));
		((struct sockaddr_in6 *)&dmask)->sin6_port =
		    htons(0xffff)(__uint16_t)(__builtin_constant_p(0xffff) ? (__uint16_t)(((__uint16_t
)(0xffff) & 0xffU) << 8 | ((__uint16_t)(0xffff) &
 0xff00U) >> 8) : __swap16md(0xffff));
	}
	break;
}

bzero(&sa_smask, sizeof(sa_smask));
sa_smask.sadb_address_exttype = SADB_X_EXT_SRC_MASK17;
sa_smask.sadb_address_len =
    (sizeof(sa_smask) + ROUNDUP(smask.ss_len)(((smask.ss_len) + (sizeof(u_int64_t) - 1)) & ~(sizeof(u_int64_t
) - 1))) / 8;

bzero(&sa_dmask, sizeof(sa_dmask));
sa_dmask.sadb_address_exttype = SADB_X_EXT_DST_MASK18;
sa_dmask.sadb_address_len =
    (sizeof(sa_dmask) + ROUNDUP(dmask.ss_len)(((dmask.ss_len) + (sizeof(u_int64_t) - 1)) & ~(sizeof(u_int64_t
) - 1))) / 8;
break;
}

iov_cnt = 0;

/* msghdr */
iov[iov_cnt].iov_base = &smsg;
iov[iov_cnt].iov_len = sizeof(smsg);
iov_cnt++;

switch (mtype) {
case SADB_ADD3:
case SADB_UPDATE2:
case SADB_DELETE4:
/* SA hdr */
iov[iov_cnt].iov_base = &sa;
iov[iov_cnt].iov_len = sizeof(sa);
smsg.sadb_msg_len += sa.sadb_sa_len;
iov_cnt++;
break;
case SADB_GETSPI1:
/* SPI range */
iov[iov_cnt].iov_base = &sa_spirange;
iov[iov_cnt].iov_len = sizeof(sa_spirange);
smsg.sadb_msg_len += sa_spirange.sadb_spirange_len;
iov_cnt++;
break;
case SADB_X_ADDFLOW12:
/* sa_peer always points to the remote machine */
iov[iov_cnt].iov_base = &sa_peer;
iov[iov_cnt].iov_len = sizeof(sa_peer);
iov_cnt++;
iov[iov_cnt].iov_base = &speer;
iov[iov_cnt].iov_len = ROUNDUP(speer.ss_len)(((speer.ss_len) + (sizeof(u_int64_t) - 1)) & ~(sizeof(u_int64_t
) - 1));
smsg.sadb_msg_len += sa_peer.sadb_address_len;
iov_cnt++;

/* FALLTHROUGH */
case SADB_X_DELFLOW13:
/* add flow type */
iov[iov_cnt].iov_base = &sa_flowtype;
iov[iov_cnt].iov_len = sizeof(sa_flowtype);
smsg.sadb_msg_len += sa_flowtype.sadb_protocol_len;
iov_cnt++;

/* add protocol */
iov[iov_cnt].iov_base = &sa_protocol;
iov[iov_cnt].iov_len = sizeof(sa_protocol);
smsg.sadb_msg_len += sa_protocol.sadb_protocol_len;
iov_cnt++;

/* add flow masks */
iov[iov_cnt].iov_base = &sa_smask;
iov[iov_cnt].iov_len = sizeof(sa_smask);
iov_cnt++;
iov[iov_cnt].iov_base = &smask;
iov[iov_cnt].iov_len = ROUNDUP(smask.ss_len)(((smask.ss_len) + (sizeof(u_int64_t) - 1)) & ~(sizeof(u_int64_t
) - 1));
smsg.sadb_msg_len += sa_smask.sadb_address_len;
iov_cnt++;

iov[iov_cnt].iov_base = &sa_dmask;
iov[iov_cnt].iov_len = sizeof(sa_dmask);
iov_cnt++;
iov[iov_cnt].iov_base = &dmask;
iov[iov_cnt].iov_len = ROUNDUP(dmask.ss_len)(((dmask.ss_len) + (sizeof(u_int64_t) - 1)) & ~(sizeof(u_int64_t
) - 1));
smsg.sadb_msg_len += sa_dmask.sadb_address_len;
iov_cnt++;
break;
}

/* dest addr */
iov[iov_cnt].iov_base = &sa_dst;
iov[iov_cnt].iov_len = sizeof(sa_dst);
iov_cnt++;
iov[iov_cnt].iov_base = &sdst;
iov[iov_cnt].iov_len = ROUNDUP(sdst.ss_len)(((sdst.ss_len) + (sizeof(u_int64_t) - 1)) & ~(sizeof(u_int64_t
) - 1));
smsg.sadb_msg_len += sa_dst.sadb_address_len;
iov_cnt++;

/* src addr */
iov[iov_cnt].iov_base = &sa_src;
iov[iov_cnt].iov_len = sizeof(sa_src);
iov_cnt++;
iov[iov_cnt].iov_base = &ssrc;
iov[iov_cnt].iov_len = ROUNDUP(ssrc.ss_len)(((ssrc.ss_len) + (sizeof(u_int64_t) - 1)) & ~(sizeof(u_int64_t
) - 1));
smsg.sadb_msg_len += sa_src.sadb_address_len;
iov_cnt++;

switch (mtype) {
case SADB_ADD3:
case SADB_UPDATE2:
if (alen) {
	/* auth key */
	iov[iov_cnt].iov_base = &sa_akey;
	iov[iov_cnt].iov_len = sizeof(sa_akey);
	iov_cnt++;
	iov[iov_cnt].iov_base = akey;
	iov[iov_cnt].iov_len = ((alen + 7) / 8) * 8;
	smsg.sadb_msg_len += sa_akey.sadb_key_len;
	iov_cnt++;
}
if (elen) {
	/* encryption key */
	iov[iov_cnt].iov_base = &sa_ekey;
	iov[iov_cnt].iov_len = sizeof(sa_ekey);
	iov_cnt++;
	iov[iov_cnt].iov_base = ekey;
	iov[iov_cnt].iov_len = ((elen + 7) / 8) * 8;
	smsg.sadb_msg_len += sa_ekey.sadb_key_len;
	iov_cnt++;
}
break;
}

len = smsg.sadb_msg_len * 8;
do {
n = writev(sd, iov, iov_cnt);
} while (n == -1 && (errno(*__errno()) == EAGAIN35 || errno(*__errno()) == EINTR4));

if (n == -1) {
log_warn("%s: writev (%d/%d)", __func__, iov_cnt, len);
return (-1);
}

return (0);
417}

419int
420pfkey_read(int sd, struct sadb_msg *h)
421{
struct sadb_msg hdr;

if (recv(sd, &hdr, sizeof(hdr), MSG_PEEK0x2) != sizeof(hdr)) {
7
←
Assuming the condition is true→
8
←
Taking true branch→
if (errno(*__errno()) == EAGAIN35 || errno(*__errno()) == EINTR4)
9
←
Assuming the condition is true→
	return (0);
10
←
Returning without writing to 'h->sadb_msg_errno'→
11
←
Returning zero, which participates in a condition later→
log_warn("pfkey peek");
return (-1);
}

/* XXX: Only one message can be outstanding. */
if (hdr.sadb_msg_seq == sadb_msg_seq &&
   hdr.sadb_msg_pid == pid) {
if (h)
	bcopy(&hdr, h, sizeof(hdr));
return (0);
}

/* not ours, discard */
if (read(sd, &hdr, sizeof(hdr)) == -1) {
if (errno(*__errno()) == EAGAIN35 || errno(*__errno()) == EINTR4)
	return (0);
log_warn("pfkey read");
return (-1);
}

return (1);
448}

450int
451pfkey_reply(int sd, u_int32_t *spi)
452{
struct sadb_msg hdr, *msg;
struct sadb_ext *ext;
struct sadb_sa *sa;
u_int8_t *data;
ssize_t len;
int rv;

do {
14
←
Loop condition is false.  Exiting loop→
rv = pfkey_read(sd, &hdr);
6
←
Calling 'pfkey_read'→
12
←
Returning from 'pfkey_read'→
if (rv == -1)
13
←
Taking false branch→
	return (-1);
} while (rv);

if (hdr.sadb_msg_errno != 0) {
15
←
The left operand of '!=' is a garbage value
errno(*__errno()) = hdr.sadb_msg_errno;
if (errno(*__errno()) == ESRCH3)
	return (0);
else {
	log_warn("pfkey");
	return (-1);
}
}
if ((data = reallocarray(NULL((void *)0), hdr.sadb_msg_len, PFKEY2_CHUNKsizeof(u_int64_t)))
   == NULL((void *)0)) {
log_warn("pfkey malloc");
return (-1);
}
len = hdr.sadb_msg_len * PFKEY2_CHUNKsizeof(u_int64_t);
if (read(sd, data, len) != len) {
log_warn("pfkey read");
freezero(data, len);
return (-1);
}

if (hdr.sadb_msg_type == SADB_GETSPI1) {
if (spi == NULL((void *)0)) {
	freezero(data, len);
	return (0);
}

msg = (struct sadb_msg *)data;
for (ext = (struct sadb_ext *)(msg + 1);
    (size_t)((u_int8_t *)ext - (u_int8_t *)msg) <
    msg->sadb_msg_len * PFKEY2_CHUNKsizeof(u_int64_t);
    ext = (struct sadb_ext *)((u_int8_t *)ext +
    ext->sadb_ext_len * PFKEY2_CHUNKsizeof(u_int64_t))) {
	if (ext->sadb_ext_type == SADB_EXT_SA1) {
		sa = (struct sadb_sa *) ext;
		*spi = ntohl(sa->sadb_sa_spi)(__uint32_t)(__builtin_constant_p(sa->sadb_sa_spi) ? (__uint32_t
)(((__uint32_t)(sa->sadb_sa_spi) & 0xff) << 24 |
 ((__uint32_t)(sa->sadb_sa_spi) & 0xff00) << 8 |
 ((__uint32_t)(sa->sadb_sa_spi) & 0xff0000) >> 8
 | ((__uint32_t)(sa->sadb_sa_spi) & 0xff000000) >>
 24) : __swap32md(sa->sadb_sa_spi));
		break;
	}
}
}
freezero(data, len);
return (0);
508}

510static int
511pfkey_sa_add(struct bgpd_addr *src, struct bgpd_addr *dst, u_int8_t keylen,
  char *key, u_int32_t *spi)
513{
if (pfkey_send(pfkey_fd, SADB_X_SATYPE_TCPSIGNATURE8, SADB_GETSPI1, 0,
4
←
Taking false branch→
   src, dst, 0, 0, 0, NULL((void *)0), 0, 0, NULL((void *)0), 0, 0) == -1)
return (-1);
if (pfkey_reply(pfkey_fd, spi) == -1)
5
←
Calling 'pfkey_reply'→
return (-1);
if (pfkey_send(pfkey_fd, SADB_X_SATYPE_TCPSIGNATURE8, SADB_UPDATE2, 0,
src, dst, *spi, 0, keylen, key, 0, 0, NULL((void *)0), 0, 0) == -1)
return (-1);
if (pfkey_reply(pfkey_fd, NULL((void *)0)) == -1)
return (-1);
return (0);
525}

527static int
528pfkey_sa_remove(struct bgpd_addr *src, struct bgpd_addr *dst, u_int32_t *spi)
529{
if (pfkey_send(pfkey_fd, SADB_X_SATYPE_TCPSIGNATURE8, SADB_DELETE4, 0,
   src, dst, *spi, 0, 0, NULL((void *)0), 0, 0, NULL((void *)0), 0, 0) == -1)
return (-1);
if (pfkey_reply(pfkey_fd, NULL((void *)0)) == -1)
return (-1);
*spi = 0;
return (0);
537}

539static int
540pfkey_md5sig_establish(struct peer *p)
541{
u_int32_t spi_out = 0;
u_int32_t spi_in = 0;

if (pfkey_sa_add(pfkey_localaddr(p), &p->conf.remote_addr,
3
←
Calling 'pfkey_sa_add'→
   p->conf.auth.md5key_len, p->conf.auth.md5key,
   &spi_out) == -1)
goto fail;

if (pfkey_sa_add(&p->conf.remote_addr, pfkey_localaddr(p),
   p->conf.auth.md5key_len, p->conf.auth.md5key,
   &spi_in) == -1)
goto fail;

/* cleanup old flow if one was present */
if (p->auth.established) {
if (pfkey_remove(p) == -1)
	return (-1);
}

p->auth.established = 1;
p->auth.spi_out = spi_out;
p->auth.spi_in = spi_in;
return (0);

566fail:
log_peer_warn(&p->conf, "%s: failed to insert md5sig", __func__);
return (-1);
569}

571static int
572pfkey_md5sig_remove(struct peer *p)
573{
if (p->auth.spi_out)
if (pfkey_sa_remove(&p->auth.local_addr, &p->conf.remote_addr,
    &p->auth.spi_out) == -1)
	goto fail;
if (p->auth.spi_in)
if (pfkey_sa_remove(&p->conf.remote_addr, &p->auth.local_addr,
    &p->auth.spi_in) == -1)
	goto fail;

p->auth.established = 0;
p->auth.spi_out = 0;
p->auth.spi_in = 0;
return (0);

588fail:
log_peer_warn(&p->conf, "%s: failed to remove md5sig", __func__);
return (-1);
591}

593static int
594pfkey_ipsec_establish(struct peer *p)
595{
uint8_t satype = SADB_SATYPE_ESP2;
struct bgpd_addr *local_addr = pfkey_localaddr(p);

/* cleanup first, unlike in the TCP MD5 case */
if (p->auth.established) {
if (pfkey_remove(p) == -1)
	return (-1);
}

switch (p->auth.method) {
case AUTH_IPSEC_IKE_ESP:
satype = SADB_SATYPE_ESP2;
break;
case AUTH_IPSEC_IKE_AH:
satype = SADB_SATYPE_AH1;
break;
case AUTH_IPSEC_MANUAL_ESP:
case AUTH_IPSEC_MANUAL_AH:
satype = p->auth.method == AUTH_IPSEC_MANUAL_ESP ?
    SADB_SATYPE_ESP2 : SADB_SATYPE_AH1;
if (pfkey_send(pfkey_fd, satype, SADB_ADD3, 0,
    local_addr, &p->conf.remote_addr,
    p->conf.auth.spi_out,
    p->conf.auth.auth_alg_out,
    p->conf.auth.auth_keylen_out,
    p->conf.auth.auth_key_out,
    p->conf.auth.enc_alg_out,
    p->conf.auth.enc_keylen_out,
    p->conf.auth.enc_key_out,
    0, 0) == -1)
	goto fail_key;
if (pfkey_reply(pfkey_fd, NULL((void *)0)) == -1)
	goto fail_key;
if (pfkey_send(pfkey_fd, satype, SADB_ADD3, 0,
    &p->conf.remote_addr, local_addr,
    p->conf.auth.spi_in,
    p->conf.auth.auth_alg_in,
    p->conf.auth.auth_keylen_in,
    p->conf.auth.auth_key_in,
    p->conf.auth.enc_alg_in,
    p->conf.auth.enc_keylen_in,
    p->conf.auth.enc_key_in,
    0, 0) == -1)
	goto fail_key;
if (pfkey_reply(pfkey_fd, NULL((void *)0)) == -1)
	goto fail_key;
break;
default:
return (-1);
}

if (pfkey_flow(pfkey_fd, satype, SADB_X_ADDFLOW, IPSP_DIRECTION_OUT,pfkey_send(pfkey_fd, satype, 12, 0x2, local_addr, &p->
conf.remote_addr, 0, 0, 0, ((void *)0), 0, 0, ((void *)0), 0,
 179)
   local_addr, &p->conf.remote_addr, 0, BGP_PORT)pfkey_send(pfkey_fd, satype, 12, 0x2, local_addr, &p->
conf.remote_addr, 0, 0, 0, ((void *)0), 0, 0, ((void *)0), 0,
 179) == -1)
goto fail_flow;
if (pfkey_reply(pfkey_fd, NULL((void *)0)) == -1)
goto fail_flow;

if (pfkey_flow(pfkey_fd, satype, SADB_X_ADDFLOW, IPSP_DIRECTION_OUT,pfkey_send(pfkey_fd, satype, 12, 0x2, local_addr, &p->
conf.remote_addr, 0, 0, 0, ((void *)0), 0, 0, ((void *)0), 179
, 0)
   local_addr, &p->conf.remote_addr, BGP_PORT, 0)pfkey_send(pfkey_fd, satype, 12, 0x2, local_addr, &p->
conf.remote_addr, 0, 0, 0, ((void *)0), 0, 0, ((void *)0), 179
, 0) == -1)
goto fail_flow;
if (pfkey_reply(pfkey_fd, NULL((void *)0)) == -1)
goto fail_flow;

if (pfkey_flow(pfkey_fd, satype, SADB_X_ADDFLOW, IPSP_DIRECTION_IN,pfkey_send(pfkey_fd, satype, 12, 0x1, &p->conf.remote_addr
, local_addr, 0, 0, 0, ((void *)0), 0, 0, ((void *)0), 0, 179
)
   &p->conf.remote_addr, local_addr, 0, BGP_PORT)pfkey_send(pfkey_fd, satype, 12, 0x1, &p->conf.remote_addr
, local_addr, 0, 0, 0, ((void *)0), 0, 0, ((void *)0), 0, 179
) == -1)
goto fail_flow;
if (pfkey_reply(pfkey_fd, NULL((void *)0)) == -1)
goto fail_flow;

if (pfkey_flow(pfkey_fd, satype, SADB_X_ADDFLOW, IPSP_DIRECTION_IN,pfkey_send(pfkey_fd, satype, 12, 0x1, &p->conf.remote_addr
, local_addr, 0, 0, 0, ((void *)0), 0, 0, ((void *)0), 179, 0
)
   &p->conf.remote_addr, local_addr, BGP_PORT, 0)pfkey_send(pfkey_fd, satype, 12, 0x1, &p->conf.remote_addr
, local_addr, 0, 0, 0, ((void *)0), 0, 0, ((void *)0), 179, 0
) == -1)
goto fail_flow;
if (pfkey_reply(pfkey_fd, NULL((void *)0)) == -1)
goto fail_flow;

/* save SPI so that they can be removed later on */
p->auth.spi_in = p->conf.auth.spi_in;
p->auth.spi_out = p->conf.auth.spi_out;
p->auth.established = 1;
return (0);

677fail_key:
log_peer_warn(&p->conf, "%s: failed to insert ipsec key", __func__);
return (-1);
680fail_flow:
log_peer_warn(&p->conf, "%s: failed to insert flow", __func__);
return (-1);
683}

685static int
686pfkey_ipsec_remove(struct peer *p)
687{
uint8_t satype;

switch (p->auth.method) {
case AUTH_IPSEC_IKE_ESP:
satype = SADB_SATYPE_ESP2;
break;
case AUTH_IPSEC_IKE_AH:
satype = SADB_SATYPE_AH1;
break;
case AUTH_IPSEC_MANUAL_ESP:
case AUTH_IPSEC_MANUAL_AH:
satype = p->auth.method == AUTH_IPSEC_MANUAL_ESP ?
    SADB_SATYPE_ESP2 : SADB_SATYPE_AH1;
if (pfkey_send(pfkey_fd, satype, SADB_DELETE4, 0,
    &p->auth.local_addr, &p->conf.remote_addr,
    p->auth.spi_out, 0, 0, NULL((void *)0), 0, 0, NULL((void *)0),
    0, 0) == -1)
	goto fail_key;
if (pfkey_reply(pfkey_fd, NULL((void *)0)) == -1)
	goto fail_key;

if (pfkey_send(pfkey_fd, satype, SADB_DELETE4, 0,
    &p->conf.remote_addr, &p->auth.local_addr,
    p->auth.spi_in, 0, 0, NULL((void *)0), 0, 0, NULL((void *)0),
    0, 0) == -1)
	goto fail_key;
if (pfkey_reply(pfkey_fd, NULL((void *)0)) == -1)
	goto fail_key;
break;
default:
return (-1);
}

if (pfkey_flow(pfkey_fd, satype, SADB_X_DELFLOW, IPSP_DIRECTION_OUT,pfkey_send(pfkey_fd, satype, 13, 0x2, &p->auth.local_addr
, &p->conf.remote_addr, 0, 0, 0, ((void *)0), 0, 0, ((
void *)0), 0, 179)
   &p->auth.local_addr, &p->conf.remote_addr, 0, BGP_PORT)pfkey_send(pfkey_fd, satype, 13, 0x2, &p->auth.local_addr
, &p->conf.remote_addr, 0, 0, 0, ((void *)0), 0, 0, ((
void *)0), 0, 179) == -1)
goto fail_flow;
if (pfkey_reply(pfkey_fd, NULL((void *)0)) == -1)
goto fail_flow;

if (pfkey_flow(pfkey_fd, satype, SADB_X_DELFLOW, IPSP_DIRECTION_OUT,pfkey_send(pfkey_fd, satype, 13, 0x2, &p->auth.local_addr
, &p->conf.remote_addr, 0, 0, 0, ((void *)0), 0, 0, ((
void *)0), 179, 0)
   &p->auth.local_addr, &p->conf.remote_addr, BGP_PORT, 0)pfkey_send(pfkey_fd, satype, 13, 0x2, &p->auth.local_addr
, &p->conf.remote_addr, 0, 0, 0, ((void *)0), 0, 0, ((
void *)0), 179, 0) == -1)
goto fail_flow;
if (pfkey_reply(pfkey_fd, NULL((void *)0)) == -1)
goto fail_flow;

if (pfkey_flow(pfkey_fd, satype, SADB_X_DELFLOW, IPSP_DIRECTION_IN,pfkey_send(pfkey_fd, satype, 13, 0x1, &p->conf.remote_addr
, &p->auth.local_addr, 0, 0, 0, ((void *)0), 0, 0, ((void
 *)0), 0, 179)
   &p->conf.remote_addr, &p->auth.local_addr, 0, BGP_PORT)pfkey_send(pfkey_fd, satype, 13, 0x1, &p->conf.remote_addr
, &p->auth.local_addr, 0, 0, 0, ((void *)0), 0, 0, ((void
 *)0), 0, 179) == -1)
goto fail_flow;
if (pfkey_reply(pfkey_fd, NULL((void *)0)) == -1)
goto fail_flow;

if (pfkey_flow(pfkey_fd, satype, SADB_X_DELFLOW, IPSP_DIRECTION_IN,pfkey_send(pfkey_fd, satype, 13, 0x1, &p->conf.remote_addr
, &p->auth.local_addr, 0, 0, 0, ((void *)0), 0, 0, ((void
 *)0), 179, 0)
   &p->conf.remote_addr, &p->auth.local_addr, BGP_PORT, 0)pfkey_send(pfkey_fd, satype, 13, 0x1, &p->conf.remote_addr
, &p->auth.local_addr, 0, 0, 0, ((void *)0), 0, 0, ((void
 *)0), 179, 0) == -1)
goto fail_flow;
if (pfkey_reply(pfkey_fd, NULL((void *)0)) == -1)
goto fail_flow;

p->auth.established = 0;
p->auth.spi_out = 0;
p->auth.spi_in = 0;
return (0);

750fail_key:
log_peer_warn(&p->conf, "%s: failed to remove ipsec key", __func__);
return (-1);
753fail_flow:
log_peer_warn(&p->conf, "%s: failed to remove flow", __func__);
return (-1);
756}

758int
759pfkey_establish(struct peer *p)
760{
int rv;

switch (p->conf.auth.method) {
1
Control jumps to 'case AUTH_MD5SIG:'  at line 769→
case AUTH_NONE:
rv = 0;
if (p->auth.established)
	rv = pfkey_remove(p);
break;
case AUTH_MD5SIG:
rv = pfkey_md5sig_establish(p);
2
←
Calling 'pfkey_md5sig_establish'→
break;
default:
rv = pfkey_ipsec_establish(p);
break;
}
/*
* make sure we keep copies of everything we need to
* remove SAs and flows later again, even if the
* info in p->conf changed due to reload.
* We need: SPIs, method, local_addr, remote_addr.
* remote_addr cannot change, so no copy, SPI are
* handled by the method specific functions.
*/
memcpy(&p->auth.local_addr, pfkey_localaddr(p),
   sizeof(p->auth.local_addr));
p->auth.method = p->conf.auth.method;

return (rv);
789}

791int
792pfkey_remove(struct peer *p)
793{
if (p->auth.established == 0)
return (0);

switch (p->auth.method) {
case AUTH_NONE:
return (0);
case AUTH_MD5SIG:
return (pfkey_md5sig_remove(p));
default:
return (pfkey_ipsec_remove(p));
}
805}

807int
808pfkey_init(void)
809{
if ((pfkey_fd = socket(PF_KEY30, SOCK_RAW3 | SOCK_CLOEXEC0x8000 | SOCK_NONBLOCK0x4000,
   PF_KEY_V22)) == -1) {
if (errno(*__errno()) == EPROTONOSUPPORT43) {
	log_warnx("PF_KEY not available, disabling ipsec");
	return (-1);
} else
	fatal("pfkey setup failed");
}
return (pfkey_fd);
819}

821/* verify that connection is using TCP MD5UM if required by config */
822int
823tcp_md5_check(int fd, struct peer *p)
824{
socklen_t len;
int opt;

if (p->conf.auth.method == AUTH_MD5SIG) {
if (sysdep.no_md5sig) {
	log_peer_warnx(&p->conf,
	    "md5sig configured but not available");
	return -1;
}
len = sizeof(opt);
if (getsockopt(fd, IPPROTO_TCP6, TCP_MD5SIG0x04,
    &opt, &len) == -1)
	fatal("getsockopt TCP_MD5SIG");
if (!opt) {     /* non-md5'd connection! */
	log_peer_warnx(&p->conf,
	    "connection attempt without md5 signature");
	return -1;
}
}
return 0;
845}

847/* enable or set TCP MD5SIG on a new client connection */
848int
849tcp_md5_set(int fd, struct peer *p)
850{
int opt = 1;

if (p->conf.auth.method == AUTH_MD5SIG) {
if (sysdep.no_md5sig) {
	log_peer_warnx(&p->conf,
	    "md5sig configured but not available");
	return -1;
}
if (setsockopt(fd, IPPROTO_TCP6, TCP_MD5SIG0x04,
    &opt, sizeof(opt)) == -1) {
	log_peer_warn(&p->conf, "setsockopt md5sig");
	return -1;
}
}
return 0;
866}

868/* enable or prepare a new listening socket for TCP MD5SIG usage */
869int
870tcp_md5_prep_listener(struct listen_addr *la, struct peer_head *p)
871{
int opt = 1;

if (setsockopt(la->fd, IPPROTO_TCP6, TCP_MD5SIG0x04,
   &opt, sizeof(opt)) == -1) {
if (errno(*__errno()) == ENOPROTOOPT42) {	/* system w/o md5sig */
	log_warnx("md5sig not available, disabling");
	sysdep.no_md5sig = 1;
	return 0;
}
return -1;
}
return 0;
884}

886/* add md5 key to all listening sockets, dummy function for portable */
887void
888tcp_md5_add_listener(struct bgpd_config *conf, struct peer *p)
889{
890}

892/* delete md5 key form all listening sockets, dummy function for portable */
893void
894tcp_md5_del_listener(struct bgpd_config *conf, struct peer *p)
895{
896}