Annotation of sys/net/pfkeyv2_convert.c, Revision 1.1.1.1
1.1 nbrk 1: /* $OpenBSD: pfkeyv2_convert.c,v 1.29 2006/11/24 13:52:14 reyk Exp $ */
2: /*
3: * The author of this code is Angelos D. Keromytis (angelos@keromytis.org)
4: *
5: * Part of this code is based on code written by Craig Metz (cmetz@inner.net)
6: * for NRL. Those licenses follow this one.
7: *
8: * Copyright (c) 2001 Angelos D. Keromytis.
9: *
10: * Permission to use, copy, and modify this software with or without fee
11: * is hereby granted, provided that this entire notice is included in
12: * all copies of any software which is or includes a copy or
13: * modification of this software.
14: * You may use this code under the GNU public license if you so wish. Please
15: * contribute changes back to the authors under this freer than GPL license
16: * so that we may further the use of strong encryption without limitations to
17: * all.
18: *
19: * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR
20: * IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY
21: * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE
22: * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR
23: * PURPOSE.
24: */
25:
26: /*
27: * @(#)COPYRIGHT 1.1 (NRL) 17 January 1995
28: *
29: * NRL grants permission for redistribution and use in source and binary
30: * forms, with or without modification, of the software and documentation
31: * created at NRL provided that the following conditions are met:
32: *
33: * 1. Redistributions of source code must retain the above copyright
34: * notice, this list of conditions and the following disclaimer.
35: * 2. Redistributions in binary form must reproduce the above copyright
36: * notice, this list of conditions and the following disclaimer in the
37: * documentation and/or other materials provided with the distribution.
38: * 3. All advertising materials mentioning features or use of this software
39: * must display the following acknowledgements:
40: * This product includes software developed by the University of
41: * California, Berkeley and its contributors.
42: * This product includes software developed at the Information
43: * Technology Division, US Naval Research Laboratory.
44: * 4. Neither the name of the NRL nor the names of its contributors
45: * may be used to endorse or promote products derived from this software
46: * without specific prior written permission.
47: *
48: * THE SOFTWARE PROVIDED BY NRL IS PROVIDED BY NRL AND CONTRIBUTORS ``AS
49: * IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
50: * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
51: * PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL NRL OR
52: * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
53: * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
54: * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
55: * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
56: * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
57: * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
58: * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
59: *
60: * The views and conclusions contained in the software and documentation
61: * are those of the authors and should not be interpreted as representing
62: * official policies, either expressed or implied, of the US Naval
63: * Research Laboratory (NRL).
64: */
65:
66: /*
67: * Copyright (c) 1995, 1996, 1997, 1998, 1999 Craig Metz. All rights reserved.
68: *
69: * Redistribution and use in source and binary forms, with or without
70: * modification, are permitted provided that the following conditions
71: * are met:
72: * 1. Redistributions of source code must retain the above copyright
73: * notice, this list of conditions and the following disclaimer.
74: * 2. Redistributions in binary form must reproduce the above copyright
75: * notice, this list of conditions and the following disclaimer in the
76: * documentation and/or other materials provided with the distribution.
77: * 3. Neither the name of the author nor the names of any contributors
78: * may be used to endorse or promote products derived from this software
79: * without specific prior written permission.
80: *
81: * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
82: * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
83: * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
84: * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
85: * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
86: * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
87: * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
88: * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
89: * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
90: * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
91: * SUCH DAMAGE.
92: */
93:
94: #include "pf.h"
95:
96: #include <sys/types.h>
97: #include <sys/param.h>
98: #include <sys/systm.h>
99: #include <sys/mbuf.h>
100: #include <sys/kernel.h>
101: #include <sys/socket.h>
102: #include <net/route.h>
103: #include <net/if.h>
104:
105: #if NPF > 0
106: #include <net/pfvar.h>
107: #endif
108:
109: #include <netinet/ip_ipsp.h>
110: #ifdef INET6
111: #include <netinet6/in6_var.h>
112: #endif
113: #include <net/pfkeyv2.h>
114: #include <crypto/cryptodev.h>
115: #include <crypto/xform.h>
116:
117: /*
118: * (Partly) Initialize a TDB based on an SADB_SA payload. Other parts
119: * of the TDB will be initialized by other import routines, and tdb_init().
120: */
121: void
122: import_sa(struct tdb *tdb, struct sadb_sa *sadb_sa, struct ipsecinit *ii)
123: {
124: if (!sadb_sa)
125: return;
126:
127: if (ii) {
128: ii->ii_encalg = sadb_sa->sadb_sa_encrypt;
129: ii->ii_authalg = sadb_sa->sadb_sa_auth;
130: ii->ii_compalg = sadb_sa->sadb_sa_encrypt; /* Yeurk! */
131:
132: tdb->tdb_spi = sadb_sa->sadb_sa_spi;
133: tdb->tdb_wnd = sadb_sa->sadb_sa_replay;
134:
135: if (sadb_sa->sadb_sa_flags & SADB_SAFLAGS_PFS)
136: tdb->tdb_flags |= TDBF_PFS;
137:
138: if (sadb_sa->sadb_sa_flags & SADB_X_SAFLAGS_HALFIV)
139: tdb->tdb_flags |= TDBF_HALFIV;
140:
141: if (sadb_sa->sadb_sa_flags & SADB_X_SAFLAGS_TUNNEL)
142: tdb->tdb_flags |= TDBF_TUNNELING;
143:
144: if (sadb_sa->sadb_sa_flags & SADB_X_SAFLAGS_RANDOMPADDING)
145: tdb->tdb_flags |= TDBF_RANDOMPADDING;
146:
147: if (sadb_sa->sadb_sa_flags & SADB_X_SAFLAGS_NOREPLAY)
148: tdb->tdb_flags |= TDBF_NOREPLAY;
149:
150: if (sadb_sa->sadb_sa_flags & SADB_X_SAFLAGS_UDPENCAP)
151: tdb->tdb_flags |= TDBF_UDPENCAP;
152: }
153:
154: if (sadb_sa->sadb_sa_state != SADB_SASTATE_MATURE)
155: tdb->tdb_flags |= TDBF_INVALID;
156: }
157:
158: /*
159: * Export some of the information on a TDB.
160: */
161: void
162: export_sa(void **p, struct tdb *tdb)
163: {
164: struct sadb_sa *sadb_sa = (struct sadb_sa *) *p;
165:
166: sadb_sa->sadb_sa_len = sizeof(struct sadb_sa) / sizeof(uint64_t);
167:
168: sadb_sa->sadb_sa_spi = tdb->tdb_spi;
169: sadb_sa->sadb_sa_replay = tdb->tdb_wnd;
170:
171: if (tdb->tdb_flags & TDBF_INVALID)
172: sadb_sa->sadb_sa_state = SADB_SASTATE_LARVAL;
173: else
174: sadb_sa->sadb_sa_state = SADB_SASTATE_MATURE;
175:
176: if (tdb->tdb_sproto == IPPROTO_IPCOMP &&
177: tdb->tdb_compalgxform != NULL) {
178: switch (tdb->tdb_compalgxform->type) {
179: case CRYPTO_DEFLATE_COMP:
180: sadb_sa->sadb_sa_encrypt = SADB_X_CALG_DEFLATE;
181: break;
182: case CRYPTO_LZS_COMP:
183: sadb_sa->sadb_sa_encrypt = SADB_X_CALG_LZS;
184: break;
185: }
186: }
187:
188: if (tdb->tdb_authalgxform) {
189: switch (tdb->tdb_authalgxform->type) {
190: case CRYPTO_MD5_HMAC:
191: sadb_sa->sadb_sa_auth = SADB_AALG_MD5HMAC;
192: break;
193:
194: case CRYPTO_SHA1_HMAC:
195: sadb_sa->sadb_sa_auth = SADB_AALG_SHA1HMAC;
196: break;
197:
198: case CRYPTO_RIPEMD160_HMAC:
199: sadb_sa->sadb_sa_auth = SADB_X_AALG_RIPEMD160HMAC;
200: break;
201:
202: case CRYPTO_SHA2_256_HMAC:
203: sadb_sa->sadb_sa_auth = SADB_X_AALG_SHA2_256;
204: break;
205:
206: case CRYPTO_SHA2_384_HMAC:
207: sadb_sa->sadb_sa_auth = SADB_X_AALG_SHA2_384;
208: break;
209:
210: case CRYPTO_SHA2_512_HMAC:
211: sadb_sa->sadb_sa_auth = SADB_X_AALG_SHA2_512;
212: break;
213:
214: case CRYPTO_MD5_KPDK:
215: sadb_sa->sadb_sa_auth = SADB_X_AALG_MD5;
216: break;
217:
218: case CRYPTO_SHA1_KPDK:
219: sadb_sa->sadb_sa_auth = SADB_X_AALG_SHA1;
220: break;
221: }
222: }
223:
224: if (tdb->tdb_encalgxform) {
225: switch (tdb->tdb_encalgxform->type) {
226: case CRYPTO_NULL:
227: sadb_sa->sadb_sa_encrypt = SADB_EALG_NULL;
228: break;
229:
230: case CRYPTO_DES_CBC:
231: sadb_sa->sadb_sa_encrypt = SADB_EALG_DESCBC;
232: break;
233:
234: case CRYPTO_3DES_CBC:
235: sadb_sa->sadb_sa_encrypt = SADB_EALG_3DESCBC;
236: break;
237:
238: case CRYPTO_AES_CBC:
239: sadb_sa->sadb_sa_encrypt = SADB_X_EALG_AES;
240: break;
241:
242: case CRYPTO_AES_CTR:
243: sadb_sa->sadb_sa_encrypt = SADB_X_EALG_AESCTR;
244: break;
245:
246: case CRYPTO_CAST_CBC:
247: sadb_sa->sadb_sa_encrypt = SADB_X_EALG_CAST;
248: break;
249:
250: case CRYPTO_BLF_CBC:
251: sadb_sa->sadb_sa_encrypt = SADB_X_EALG_BLF;
252: break;
253:
254: case CRYPTO_SKIPJACK_CBC:
255: sadb_sa->sadb_sa_encrypt = SADB_X_EALG_SKIPJACK;
256: break;
257: }
258: }
259:
260: if (tdb->tdb_flags & TDBF_PFS)
261: sadb_sa->sadb_sa_flags |= SADB_SAFLAGS_PFS;
262:
263: /* Only relevant for the "old" IPsec transforms. */
264: if (tdb->tdb_flags & TDBF_HALFIV)
265: sadb_sa->sadb_sa_flags |= SADB_X_SAFLAGS_HALFIV;
266:
267: if (tdb->tdb_flags & TDBF_TUNNELING)
268: sadb_sa->sadb_sa_flags |= SADB_X_SAFLAGS_TUNNEL;
269:
270: if (tdb->tdb_flags & TDBF_RANDOMPADDING)
271: sadb_sa->sadb_sa_flags |= SADB_X_SAFLAGS_RANDOMPADDING;
272:
273: if (tdb->tdb_flags & TDBF_NOREPLAY)
274: sadb_sa->sadb_sa_flags |= SADB_X_SAFLAGS_NOREPLAY;
275:
276: *p += sizeof(struct sadb_sa);
277: }
278:
279: /*
280: * Initialize expirations and counters based on lifetime payload.
281: */
282: void
283: import_lifetime(struct tdb *tdb, struct sadb_lifetime *sadb_lifetime, int type)
284: {
285: struct timeval tv;
286:
287: if (!sadb_lifetime)
288: return;
289:
290: getmicrotime(&tv);
291:
292: switch (type) {
293: case PFKEYV2_LIFETIME_HARD:
294: if ((tdb->tdb_exp_allocations =
295: sadb_lifetime->sadb_lifetime_allocations) != 0)
296: tdb->tdb_flags |= TDBF_ALLOCATIONS;
297: else
298: tdb->tdb_flags &= ~TDBF_ALLOCATIONS;
299:
300: if ((tdb->tdb_exp_bytes =
301: sadb_lifetime->sadb_lifetime_bytes) != 0)
302: tdb->tdb_flags |= TDBF_BYTES;
303: else
304: tdb->tdb_flags &= ~TDBF_BYTES;
305:
306: if ((tdb->tdb_exp_timeout =
307: sadb_lifetime->sadb_lifetime_addtime) != 0) {
308: tdb->tdb_flags |= TDBF_TIMER;
309: if (tv.tv_sec + tdb->tdb_exp_timeout < tv.tv_sec)
310: tv.tv_sec = ((unsigned long) -1) / 2; /* XXX */
311: else
312: tv.tv_sec += tdb->tdb_exp_timeout;
313: timeout_add(&tdb->tdb_timer_tmo, hzto(&tv));
314: } else
315: tdb->tdb_flags &= ~TDBF_TIMER;
316:
317: if ((tdb->tdb_exp_first_use =
318: sadb_lifetime->sadb_lifetime_usetime) != 0)
319: tdb->tdb_flags |= TDBF_FIRSTUSE;
320: else
321: tdb->tdb_flags &= ~TDBF_FIRSTUSE;
322: break;
323:
324: case PFKEYV2_LIFETIME_SOFT:
325: if ((tdb->tdb_soft_allocations =
326: sadb_lifetime->sadb_lifetime_allocations) != 0)
327: tdb->tdb_flags |= TDBF_SOFT_ALLOCATIONS;
328: else
329: tdb->tdb_flags &= ~TDBF_SOFT_ALLOCATIONS;
330:
331: if ((tdb->tdb_soft_bytes =
332: sadb_lifetime->sadb_lifetime_bytes) != 0)
333: tdb->tdb_flags |= TDBF_SOFT_BYTES;
334: else
335: tdb->tdb_flags &= ~TDBF_SOFT_BYTES;
336:
337: if ((tdb->tdb_soft_timeout =
338: sadb_lifetime->sadb_lifetime_addtime) != 0) {
339: tdb->tdb_flags |= TDBF_SOFT_TIMER;
340: if (tv.tv_sec + tdb->tdb_soft_timeout < tv.tv_sec)
341: tv.tv_sec = ((unsigned long) -1) / 2; /* XXX */
342: else
343: tv.tv_sec += tdb->tdb_soft_timeout;
344: timeout_add(&tdb->tdb_stimer_tmo, hzto(&tv));
345: } else
346: tdb->tdb_flags &= ~TDBF_SOFT_TIMER;
347:
348: if ((tdb->tdb_soft_first_use =
349: sadb_lifetime->sadb_lifetime_usetime) != 0)
350: tdb->tdb_flags |= TDBF_SOFT_FIRSTUSE;
351: else
352: tdb->tdb_flags &= ~TDBF_SOFT_FIRSTUSE;
353: break;
354:
355: case PFKEYV2_LIFETIME_CURRENT: /* Nothing fancy here. */
356: tdb->tdb_cur_allocations =
357: sadb_lifetime->sadb_lifetime_allocations;
358: tdb->tdb_cur_bytes = sadb_lifetime->sadb_lifetime_bytes;
359: tdb->tdb_established = sadb_lifetime->sadb_lifetime_addtime;
360: tdb->tdb_first_use = sadb_lifetime->sadb_lifetime_usetime;
361: }
362: }
363:
364: /*
365: * Export TDB expiration information.
366: */
367: void
368: export_lifetime(void **p, struct tdb *tdb, int type)
369: {
370: struct sadb_lifetime *sadb_lifetime = (struct sadb_lifetime *) *p;
371:
372: sadb_lifetime->sadb_lifetime_len = sizeof(struct sadb_lifetime) /
373: sizeof(uint64_t);
374:
375: switch (type) {
376: case PFKEYV2_LIFETIME_HARD:
377: if (tdb->tdb_flags & TDBF_ALLOCATIONS)
378: sadb_lifetime->sadb_lifetime_allocations =
379: tdb->tdb_exp_allocations;
380:
381: if (tdb->tdb_flags & TDBF_BYTES)
382: sadb_lifetime->sadb_lifetime_bytes =
383: tdb->tdb_exp_bytes;
384:
385: if (tdb->tdb_flags & TDBF_TIMER)
386: sadb_lifetime->sadb_lifetime_addtime =
387: tdb->tdb_exp_timeout;
388:
389: if (tdb->tdb_flags & TDBF_FIRSTUSE)
390: sadb_lifetime->sadb_lifetime_usetime =
391: tdb->tdb_exp_first_use;
392: break;
393:
394: case PFKEYV2_LIFETIME_SOFT:
395: if (tdb->tdb_flags & TDBF_SOFT_ALLOCATIONS)
396: sadb_lifetime->sadb_lifetime_allocations =
397: tdb->tdb_soft_allocations;
398:
399: if (tdb->tdb_flags & TDBF_SOFT_BYTES)
400: sadb_lifetime->sadb_lifetime_bytes =
401: tdb->tdb_soft_bytes;
402:
403: if (tdb->tdb_flags & TDBF_SOFT_TIMER)
404: sadb_lifetime->sadb_lifetime_addtime =
405: tdb->tdb_soft_timeout;
406:
407: if (tdb->tdb_flags & TDBF_SOFT_FIRSTUSE)
408: sadb_lifetime->sadb_lifetime_usetime =
409: tdb->tdb_soft_first_use;
410: break;
411:
412: case PFKEYV2_LIFETIME_CURRENT:
413: sadb_lifetime->sadb_lifetime_allocations =
414: tdb->tdb_cur_allocations;
415: sadb_lifetime->sadb_lifetime_bytes = tdb->tdb_cur_bytes;
416: sadb_lifetime->sadb_lifetime_addtime = tdb->tdb_established;
417: sadb_lifetime->sadb_lifetime_usetime = tdb->tdb_first_use;
418: break;
419:
420: case PFKEYV2_LIFETIME_LASTUSE:
421: sadb_lifetime->sadb_lifetime_allocations = 0;
422: sadb_lifetime->sadb_lifetime_bytes = 0;
423: sadb_lifetime->sadb_lifetime_addtime = 0;
424: sadb_lifetime->sadb_lifetime_usetime = tdb->tdb_last_used;
425: break;
426: }
427:
428: *p += sizeof(struct sadb_lifetime);
429: }
430:
431: /*
432: * Import flow information to two struct sockaddr_encap's. Either
433: * all or none of the address arguments are NULL.
434: */
435: void
436: import_flow(struct sockaddr_encap *flow, struct sockaddr_encap *flowmask,
437: struct sadb_address *ssrc, struct sadb_address *ssrcmask,
438: struct sadb_address *ddst, struct sadb_address *ddstmask,
439: struct sadb_protocol *sab, struct sadb_protocol *ftype)
440: {
441: u_int8_t transproto = 0;
442: union sockaddr_union *src = (union sockaddr_union *)(ssrc + 1);
443: union sockaddr_union *dst = (union sockaddr_union *)(ddst + 1);
444: union sockaddr_union *srcmask = (union sockaddr_union *)(ssrcmask + 1);
445: union sockaddr_union *dstmask = (union sockaddr_union *)(ddstmask + 1);
446:
447: if (ssrc == NULL)
448: return; /* There wasn't any information to begin with. */
449:
450: bzero(flow, sizeof(*flow));
451: bzero(flowmask, sizeof(*flowmask));
452:
453: if (sab != NULL)
454: transproto = sab->sadb_protocol_proto;
455:
456: /*
457: * Check that all the address families match. We know they are
458: * valid and supported because pfkeyv2_parsemessage() checked that.
459: */
460: if ((src->sa.sa_family != dst->sa.sa_family) ||
461: (src->sa.sa_family != srcmask->sa.sa_family) ||
462: (src->sa.sa_family != dstmask->sa.sa_family))
463: return;
464:
465: /*
466: * We set these as an indication that tdb_filter/tdb_filtermask are
467: * in fact initialized.
468: */
469: flow->sen_family = flowmask->sen_family = PF_KEY;
470: flow->sen_len = flowmask->sen_len = SENT_LEN;
471:
472: switch (src->sa.sa_family)
473: {
474: #ifdef INET
475: case AF_INET:
476: /* netmask handling */
477: rt_maskedcopy(&src->sa, &src->sa, &srcmask->sa);
478: rt_maskedcopy(&dst->sa, &dst->sa, &dstmask->sa);
479:
480: flow->sen_type = SENT_IP4;
481: flow->sen_direction = ftype->sadb_protocol_direction;
482: flow->sen_ip_src = src->sin.sin_addr;
483: flow->sen_ip_dst = dst->sin.sin_addr;
484: flow->sen_proto = transproto;
485: flow->sen_sport = src->sin.sin_port;
486: flow->sen_dport = dst->sin.sin_port;
487:
488: flowmask->sen_type = SENT_IP4;
489: flowmask->sen_direction = 0xff;
490: flowmask->sen_ip_src = srcmask->sin.sin_addr;
491: flowmask->sen_ip_dst = dstmask->sin.sin_addr;
492: flowmask->sen_sport = srcmask->sin.sin_port;
493: flowmask->sen_dport = dstmask->sin.sin_port;
494: if (transproto)
495: flowmask->sen_proto = 0xff;
496: break;
497: #endif /* INET */
498:
499: #ifdef INET6
500: case AF_INET6:
501: in6_embedscope(&src->sin6.sin6_addr, &src->sin6,
502: NULL, NULL);
503: in6_embedscope(&dst->sin6.sin6_addr, &dst->sin6,
504: NULL, NULL);
505:
506: /* netmask handling */
507: rt_maskedcopy(&src->sa, &src->sa, &srcmask->sa);
508: rt_maskedcopy(&dst->sa, &dst->sa, &dstmask->sa);
509:
510: flow->sen_type = SENT_IP6;
511: flow->sen_ip6_direction = ftype->sadb_protocol_direction;
512: flow->sen_ip6_src = src->sin6.sin6_addr;
513: flow->sen_ip6_dst = dst->sin6.sin6_addr;
514: flow->sen_ip6_proto = transproto;
515: flow->sen_ip6_sport = src->sin6.sin6_port;
516: flow->sen_ip6_dport = dst->sin6.sin6_port;
517:
518: flowmask->sen_type = SENT_IP6;
519: flowmask->sen_ip6_direction = 0xff;
520: flowmask->sen_ip6_src = srcmask->sin6.sin6_addr;
521: flowmask->sen_ip6_dst = dstmask->sin6.sin6_addr;
522: flowmask->sen_ip6_sport = srcmask->sin6.sin6_port;
523: flowmask->sen_ip6_dport = dstmask->sin6.sin6_port;
524: if (transproto)
525: flowmask->sen_ip6_proto = 0xff;
526: break;
527: #endif /* INET6 */
528: }
529: }
530:
531: /*
532: * Helper to export addresses from an struct sockaddr_encap.
533: */
534: static void
535: export_encap(void **p, struct sockaddr_encap *encap, int type)
536: {
537: struct sadb_address *saddr = (struct sadb_address *)*p;
538: union sockaddr_union *sunion;
539:
540: *p += sizeof(struct sadb_address);
541: sunion = (union sockaddr_union *)*p;
542:
543: switch (encap->sen_type) {
544: case SENT_IP4:
545: saddr->sadb_address_len = (sizeof(struct sadb_address) +
546: PADUP(sizeof(struct sockaddr_in))) / sizeof(uint64_t);
547: sunion->sa.sa_len = sizeof(struct sockaddr_in);
548: sunion->sa.sa_family = AF_INET;
549: if (type == SADB_X_EXT_SRC_FLOW ||
550: type == SADB_X_EXT_SRC_MASK) {
551: sunion->sin.sin_addr = encap->sen_ip_src;
552: sunion->sin.sin_port = encap->sen_sport;
553: } else {
554: sunion->sin.sin_addr = encap->sen_ip_dst;
555: sunion->sin.sin_port = encap->sen_dport;
556: }
557: *p += PADUP(sizeof(struct sockaddr_in));
558: break;
559: case SENT_IP6:
560: saddr->sadb_address_len = (sizeof(struct sadb_address)
561: + PADUP(sizeof(struct sockaddr_in6))) / sizeof(uint64_t);
562: sunion->sa.sa_len = sizeof(struct sockaddr_in6);
563: sunion->sa.sa_family = AF_INET6;
564: if (type == SADB_X_EXT_SRC_FLOW ||
565: type == SADB_X_EXT_SRC_MASK) {
566: sunion->sin6.sin6_addr = encap->sen_ip6_src;
567: sunion->sin6.sin6_port = encap->sen_ip6_sport;
568: } else {
569: sunion->sin6.sin6_addr = encap->sen_ip6_dst;
570: sunion->sin6.sin6_port = encap->sen_ip6_dport;
571: }
572: *p += PADUP(sizeof(struct sockaddr_in6));
573: break;
574: }
575: }
576:
577: /*
578: * Export flow information from two struct sockaddr_encap's.
579: */
580: void
581: export_flow(void **p, u_int8_t ftype, struct sockaddr_encap *flow,
582: struct sockaddr_encap *flowmask, void **headers)
583: {
584: struct sadb_protocol *sab;
585:
586: headers[SADB_X_EXT_FLOW_TYPE] = *p;
587: sab = (struct sadb_protocol *)*p;
588: sab->sadb_protocol_len = sizeof(struct sadb_protocol) /
589: sizeof(uint64_t);
590:
591: switch (ftype) {
592: case IPSP_IPSEC_USE:
593: sab->sadb_protocol_proto = SADB_X_FLOW_TYPE_USE;
594: break;
595: case IPSP_IPSEC_ACQUIRE:
596: sab->sadb_protocol_proto = SADB_X_FLOW_TYPE_ACQUIRE;
597: break;
598: case IPSP_IPSEC_REQUIRE:
599: sab->sadb_protocol_proto = SADB_X_FLOW_TYPE_REQUIRE;
600: break;
601: case IPSP_DENY:
602: sab->sadb_protocol_proto = SADB_X_FLOW_TYPE_DENY;
603: break;
604: case IPSP_PERMIT:
605: sab->sadb_protocol_proto = SADB_X_FLOW_TYPE_BYPASS;
606: break;
607: case IPSP_IPSEC_DONTACQ:
608: sab->sadb_protocol_proto = SADB_X_FLOW_TYPE_DONTACQ;
609: break;
610: default:
611: sab->sadb_protocol_proto = 0;
612: break;
613: }
614:
615: switch (flow->sen_type) {
616: #ifdef INET
617: case SENT_IP4:
618: sab->sadb_protocol_direction = flow->sen_direction;
619: break;
620: #endif /* INET */
621: #ifdef INET6
622: case SENT_IP6:
623: sab->sadb_protocol_direction = flow->sen_ip6_direction;
624: break;
625: #endif /* INET6 */
626: }
627: *p += sizeof(struct sadb_protocol);
628:
629: headers[SADB_X_EXT_PROTOCOL] = *p;
630: sab = (struct sadb_protocol *)*p;
631: sab->sadb_protocol_len = sizeof(struct sadb_protocol) /
632: sizeof(uint64_t);
633: switch (flow->sen_type) {
634: #ifdef INET
635: case SENT_IP4:
636: sab->sadb_protocol_proto = flow->sen_proto;
637: break;
638: #endif /* INET */
639: #ifdef INET6
640: case SENT_IP6:
641: sab->sadb_protocol_proto = flow->sen_ip6_proto;
642: break;
643: #endif /* INET6 */
644: }
645: *p += sizeof(struct sadb_protocol);
646:
647: headers[SADB_X_EXT_SRC_FLOW] = *p;
648: export_encap(p, flow, SADB_X_EXT_SRC_FLOW);
649:
650: headers[SADB_X_EXT_SRC_MASK] = *p;
651: export_encap(p, flowmask, SADB_X_EXT_SRC_MASK);
652:
653: headers[SADB_X_EXT_DST_FLOW] = *p;
654: export_encap(p, flow, SADB_X_EXT_DST_FLOW);
655:
656: headers[SADB_X_EXT_DST_MASK] = *p;
657: export_encap(p, flowmask, SADB_X_EXT_DST_MASK);
658: }
659:
660: /*
661: * Copy an SADB_ADDRESS payload to a struct sockaddr.
662: */
663: void
664: import_address(struct sockaddr *sa, struct sadb_address *sadb_address)
665: {
666: int salen;
667: struct sockaddr *ssa = (struct sockaddr *)((void *) sadb_address +
668: sizeof(struct sadb_address));
669:
670: if (!sadb_address)
671: return;
672:
673: if (ssa->sa_len)
674: salen = ssa->sa_len;
675: else
676: switch (ssa->sa_family) {
677: #ifdef INET
678: case AF_INET:
679: salen = sizeof(struct sockaddr_in);
680: break;
681: #endif /* INET */
682:
683: #if INET6
684: case AF_INET6:
685: salen = sizeof(struct sockaddr_in6);
686: break;
687: #endif /* INET6 */
688:
689: default:
690: return;
691: }
692:
693: bcopy(ssa, sa, salen);
694: sa->sa_len = salen;
695: }
696:
697: /*
698: * Export a struct sockaddr as an SADB_ADDRESS payload.
699: */
700: void
701: export_address(void **p, struct sockaddr *sa)
702: {
703: struct sadb_address *sadb_address = (struct sadb_address *) *p;
704:
705: sadb_address->sadb_address_len = (sizeof(struct sadb_address) +
706: PADUP(SA_LEN(sa))) / sizeof(uint64_t);
707:
708: *p += sizeof(struct sadb_address);
709: bcopy(sa, *p, SA_LEN(sa));
710: ((struct sockaddr *) *p)->sa_family = sa->sa_family;
711: *p += PADUP(SA_LEN(sa));
712: }
713:
714: /*
715: * Import authentication information into the TDB.
716: */
717: void
718: import_auth(struct tdb *tdb, struct sadb_x_cred *sadb_auth, int dstauth)
719: {
720: struct ipsec_ref **ipr;
721:
722: if (!sadb_auth)
723: return;
724:
725: if (dstauth == PFKEYV2_AUTH_REMOTE)
726: ipr = &tdb->tdb_remote_auth;
727: else
728: ipr = &tdb->tdb_local_auth;
729:
730: MALLOC(*ipr, struct ipsec_ref *, EXTLEN(sadb_auth) -
731: sizeof(struct sadb_x_cred) + sizeof(struct ipsec_ref),
732: M_CREDENTIALS, M_WAITOK);
733: (*ipr)->ref_len = EXTLEN(sadb_auth) - sizeof(struct sadb_x_cred);
734:
735: switch (sadb_auth->sadb_x_cred_type) {
736: case SADB_X_AUTHTYPE_PASSPHRASE:
737: (*ipr)->ref_type = IPSP_AUTH_PASSPHRASE;
738: break;
739: case SADB_X_AUTHTYPE_RSA:
740: (*ipr)->ref_type = IPSP_AUTH_RSA;
741: break;
742: default:
743: FREE(*ipr, M_CREDENTIALS);
744: *ipr = NULL;
745: return;
746: }
747: (*ipr)->ref_count = 1;
748: (*ipr)->ref_malloctype = M_CREDENTIALS;
749: bcopy((void *) sadb_auth + sizeof(struct sadb_x_cred),
750: (*ipr) + 1, (*ipr)->ref_len);
751: }
752:
753: /*
754: * Import a set of credentials into the TDB.
755: */
756: void
757: import_credentials(struct tdb *tdb, struct sadb_x_cred *sadb_cred, int dstcred)
758: {
759: struct ipsec_ref **ipr;
760:
761: if (!sadb_cred)
762: return;
763:
764: if (dstcred == PFKEYV2_CRED_REMOTE)
765: ipr = &tdb->tdb_remote_cred;
766: else
767: ipr = &tdb->tdb_local_cred;
768:
769: MALLOC(*ipr, struct ipsec_ref *, EXTLEN(sadb_cred) -
770: sizeof(struct sadb_x_cred) + sizeof(struct ipsec_ref),
771: M_CREDENTIALS, M_WAITOK);
772: (*ipr)->ref_len = EXTLEN(sadb_cred) - sizeof(struct sadb_x_cred);
773:
774: switch (sadb_cred->sadb_x_cred_type) {
775: case SADB_X_CREDTYPE_X509:
776: (*ipr)->ref_type = IPSP_CRED_X509;
777: break;
778: case SADB_X_CREDTYPE_KEYNOTE:
779: (*ipr)->ref_type = IPSP_CRED_KEYNOTE;
780: break;
781: default:
782: FREE(*ipr, M_CREDENTIALS);
783: *ipr = NULL;
784: return;
785: }
786: (*ipr)->ref_count = 1;
787: (*ipr)->ref_malloctype = M_CREDENTIALS;
788: bcopy((void *) sadb_cred + sizeof(struct sadb_x_cred),
789: (*ipr) + 1, (*ipr)->ref_len);
790: }
791:
792: /*
793: * Import an identity payload into the TDB.
794: */
795: void
796: import_identity(struct tdb *tdb, struct sadb_ident *sadb_ident, int type)
797: {
798: struct ipsec_ref **ipr;
799:
800: if (!sadb_ident)
801: return;
802:
803: if (type == PFKEYV2_IDENTITY_SRC)
804: ipr = &tdb->tdb_srcid;
805: else
806: ipr = &tdb->tdb_dstid;
807:
808: MALLOC(*ipr, struct ipsec_ref *, EXTLEN(sadb_ident) -
809: sizeof(struct sadb_ident) + sizeof(struct ipsec_ref),
810: M_CREDENTIALS, M_WAITOK);
811: (*ipr)->ref_len = EXTLEN(sadb_ident) - sizeof(struct sadb_ident);
812:
813: switch (sadb_ident->sadb_ident_type) {
814: case SADB_IDENTTYPE_PREFIX:
815: (*ipr)->ref_type = IPSP_IDENTITY_PREFIX;
816: break;
817: case SADB_IDENTTYPE_FQDN:
818: (*ipr)->ref_type = IPSP_IDENTITY_FQDN;
819: break;
820: case SADB_IDENTTYPE_USERFQDN:
821: (*ipr)->ref_type = IPSP_IDENTITY_USERFQDN;
822: break;
823: case SADB_X_IDENTTYPE_CONNECTION:
824: (*ipr)->ref_type = IPSP_IDENTITY_CONNECTION;
825: break;
826: default:
827: FREE(*ipr, M_CREDENTIALS);
828: *ipr = NULL;
829: return;
830: }
831: (*ipr)->ref_count = 1;
832: (*ipr)->ref_malloctype = M_CREDENTIALS;
833: bcopy((void *) sadb_ident + sizeof(struct sadb_ident), (*ipr) + 1,
834: (*ipr)->ref_len);
835: }
836:
837: void
838: export_credentials(void **p, struct tdb *tdb, int dstcred)
839: {
840: struct ipsec_ref **ipr;
841: struct sadb_x_cred *sadb_cred = (struct sadb_x_cred *) *p;
842:
843: if (dstcred == PFKEYV2_CRED_REMOTE)
844: ipr = &tdb->tdb_remote_cred;
845: else
846: ipr = &tdb->tdb_local_cred;
847:
848: sadb_cred->sadb_x_cred_len = (sizeof(struct sadb_x_cred) +
849: PADUP((*ipr)->ref_len)) / sizeof(uint64_t);
850:
851: switch ((*ipr)->ref_type) {
852: case IPSP_CRED_KEYNOTE:
853: sadb_cred->sadb_x_cred_type = SADB_X_CREDTYPE_KEYNOTE;
854: break;
855: case IPSP_CRED_X509:
856: sadb_cred->sadb_x_cred_type = SADB_X_CREDTYPE_X509;
857: break;
858: }
859: *p += sizeof(struct sadb_x_cred);
860: bcopy((*ipr) + 1, *p, (*ipr)->ref_len);
861: *p += PADUP((*ipr)->ref_len);
862: }
863:
864: void
865: export_auth(void **p, struct tdb *tdb, int dstauth)
866: {
867: struct ipsec_ref **ipr;
868: struct sadb_x_cred *sadb_auth = (struct sadb_x_cred *) *p;
869:
870: if (dstauth == PFKEYV2_AUTH_REMOTE)
871: ipr = &tdb->tdb_remote_auth;
872: else
873: ipr = &tdb->tdb_local_auth;
874:
875: sadb_auth->sadb_x_cred_len = (sizeof(struct sadb_x_cred) +
876: PADUP((*ipr)->ref_len)) / sizeof(uint64_t);
877:
878: switch ((*ipr)->ref_type) {
879: case IPSP_AUTH_PASSPHRASE:
880: sadb_auth->sadb_x_cred_type = SADB_X_AUTHTYPE_PASSPHRASE;
881: break;
882: case IPSP_AUTH_RSA:
883: sadb_auth->sadb_x_cred_type = SADB_X_AUTHTYPE_RSA;
884: break;
885: }
886: *p += sizeof(struct sadb_x_cred);
887: bcopy((*ipr) + 1, *p, (*ipr)->ref_len);
888: *p += PADUP((*ipr)->ref_len);
889: }
890:
891: void
892: export_identity(void **p, struct tdb *tdb, int type)
893: {
894: struct ipsec_ref **ipr;
895: struct sadb_ident *sadb_ident = (struct sadb_ident *) *p;
896:
897: if (type == PFKEYV2_IDENTITY_SRC)
898: ipr = &tdb->tdb_srcid;
899: else
900: ipr = &tdb->tdb_dstid;
901:
902: sadb_ident->sadb_ident_len = (sizeof(struct sadb_ident) +
903: PADUP((*ipr)->ref_len)) / sizeof(uint64_t);
904:
905: switch ((*ipr)->ref_type) {
906: case IPSP_IDENTITY_PREFIX:
907: sadb_ident->sadb_ident_type = SADB_IDENTTYPE_PREFIX;
908: break;
909: case IPSP_IDENTITY_FQDN:
910: sadb_ident->sadb_ident_type = SADB_IDENTTYPE_FQDN;
911: break;
912: case IPSP_IDENTITY_USERFQDN:
913: sadb_ident->sadb_ident_type = SADB_IDENTTYPE_USERFQDN;
914: break;
915: case IPSP_IDENTITY_CONNECTION:
916: sadb_ident->sadb_ident_type = SADB_X_IDENTTYPE_CONNECTION;
917: break;
918: }
919: *p += sizeof(struct sadb_ident);
920: bcopy((*ipr) + 1, *p, (*ipr)->ref_len);
921: *p += PADUP((*ipr)->ref_len);
922: }
923:
924: /* ... */
925: void
926: import_key(struct ipsecinit *ii, struct sadb_key *sadb_key, int type)
927: {
928: if (!sadb_key)
929: return;
930:
931: if (type == PFKEYV2_ENCRYPTION_KEY) { /* Encryption key */
932: ii->ii_enckeylen = sadb_key->sadb_key_bits / 8;
933: ii->ii_enckey = (void *)sadb_key + sizeof(struct sadb_key);
934: } else {
935: ii->ii_authkeylen = sadb_key->sadb_key_bits / 8;
936: ii->ii_authkey = (void *)sadb_key + sizeof(struct sadb_key);
937: }
938: }
939:
940: void
941: export_key(void **p, struct tdb *tdb, int type)
942: {
943: struct sadb_key *sadb_key = (struct sadb_key *) *p;
944:
945: if (type == PFKEYV2_ENCRYPTION_KEY) {
946: sadb_key->sadb_key_len = (sizeof(struct sadb_key) +
947: PADUP(tdb->tdb_emxkeylen)) /
948: sizeof(uint64_t);
949: sadb_key->sadb_key_bits = tdb->tdb_emxkeylen * 8;
950: *p += sizeof(struct sadb_key);
951: bcopy(tdb->tdb_emxkey, *p, tdb->tdb_emxkeylen);
952: *p += PADUP(tdb->tdb_emxkeylen);
953: } else {
954: sadb_key->sadb_key_len = (sizeof(struct sadb_key) +
955: PADUP(tdb->tdb_amxkeylen)) /
956: sizeof(uint64_t);
957: sadb_key->sadb_key_bits = tdb->tdb_amxkeylen * 8;
958: *p += sizeof(struct sadb_key);
959: bcopy(tdb->tdb_amxkey, *p, tdb->tdb_amxkeylen);
960: *p += PADUP(tdb->tdb_amxkeylen);
961: }
962: }
963:
964: /* Import/Export remote port for UDP Encapsulation */
965: void
966: import_udpencap(struct tdb *tdb, struct sadb_x_udpencap *sadb_udpencap)
967: {
968: if (sadb_udpencap)
969: tdb->tdb_udpencap_port = sadb_udpencap->sadb_x_udpencap_port;
970: }
971:
972: void
973: export_udpencap(void **p, struct tdb *tdb)
974: {
975: struct sadb_x_udpencap *sadb_udpencap = (struct sadb_x_udpencap *) *p;
976:
977: sadb_udpencap->sadb_x_udpencap_port = tdb->tdb_udpencap_port;
978: sadb_udpencap->sadb_x_udpencap_reserved = 0;
979: sadb_udpencap->sadb_x_udpencap_len =
980: sizeof(struct sadb_x_udpencap) / sizeof(uint64_t);
981: *p += sizeof(struct sadb_x_udpencap);
982: }
983:
984: #if NPF > 0
985: /* Import PF tag information for SA */
986: void
987: import_tag(struct tdb *tdb, struct sadb_x_tag *stag)
988: {
989: char *s;
990:
991: if (stag) {
992: s = (char *)(stag + 1);
993: tdb->tdb_tag = pf_tagname2tag(s);
994: }
995: }
996:
997: /* Export PF tag information for SA */
998: void
999: export_tag(void **p, struct tdb *tdb)
1000: {
1001: struct sadb_x_tag *stag = (struct sadb_x_tag *)*p;
1002: char *s = (char *)(stag + 1);
1003:
1004: pf_tag2tagname(tdb->tdb_tag, s);
1005: stag->sadb_x_tag_taglen = strlen(s) + 1;
1006: stag->sadb_x_tag_len = (sizeof(struct sadb_x_tag) +
1007: PADUP(stag->sadb_x_tag_taglen)) / sizeof(uint64_t);
1008: *p += PADUP(stag->sadb_x_tag_taglen) + sizeof(struct sadb_x_tag);
1009: }
1010: #endif
CVSweb
![[BACK]](/icons/back.gif){kind=icon}
Return to pfkeyv2_convert.c CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [local] / sys / net