![[BACK]](/icons/back.gif){kind=icon}
Return to ip_spd.c CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [local] / sys / netinet|
Return to ip_spd.c CVS log | Up to [local] / sys / netinet |
1.1 nbrk 1: /* $OpenBSD: ip_spd.c,v 1.53 2007/02/14 00:53:48 jsg Exp $ */
2: /*
3: * The author of this code is Angelos D. Keromytis (angelos@cis.upenn.edu)
4: *
5: * Copyright (c) 2000-2001 Angelos D. Keromytis.
6: *
7: * Permission to use, copy, and modify this software with or without fee
8: * is hereby granted, provided that this entire notice is included in
9: * all copies of any software which is or includes a copy or
10: * modification of this software.
11: * You may use this code under the GNU public license if you so wish. Please
12: * contribute changes back to the authors under this freer than GPL license
13: * so that we may further the use of strong encryption without limitations to
14: * all.
15: *
16: * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR
17: * IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY
18: * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE
19: * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR
20: * PURPOSE.
21: */
22:
23: #include <sys/param.h>
24: #include <sys/systm.h>
25: #include <sys/mbuf.h>
26: #include <sys/socket.h>
27: #include <sys/kernel.h>
28: #include <sys/socketvar.h>
29: #include <sys/protosw.h>
30:
31: #include <net/if.h>
32: #include <net/route.h>
33: #include <net/netisr.h>
34:
35: #ifdef INET
36: #include <netinet/in.h>
37: #include <netinet/in_systm.h>
38: #include <netinet/ip.h>
39: #include <netinet/in_pcb.h>
40: #include <netinet/in_var.h>
41: #endif /* INET */
42:
43: #ifdef INET6
44: #ifndef INET
45: #include <netinet/in.h>
46: #endif
47: #include <netinet6/in6_var.h>
48: #endif /* INET6 */
49:
50: #include <netinet/ip_ipsp.h>
51: #include <net/pfkeyv2.h>
52:
53: #ifdef ENCDEBUG
54: #define DPRINTF(x) if (encdebug) printf x
55: #else
56: #define DPRINTF(x)
57: #endif
58:
59: struct pool ipsec_policy_pool;
60: struct pool ipsec_acquire_pool;
61: int ipsec_policy_pool_initialized = 0;
62: int ipsec_acquire_pool_initialized = 0;
63:
64: /*
65: * Lookup at the SPD based on the headers contained on the mbuf. The second
66: * argument indicates what protocol family the header at the beginning of
67: * the mbuf is. hlen is the offset of the transport protocol header
68: * in the mbuf.
69: *
70: * Return combinations (of return value and in *error):
71: * - NULL/0 -> no IPsec required on packet
72: * - NULL/-EINVAL -> silently drop the packet
73: * - NULL/errno -> drop packet and return error
74: * or a pointer to a TDB (and 0 in *error).
75: *
76: * In the case of incoming flows, only the first three combinations are
77: * returned.
78: */
79: struct tdb *
80: ipsp_spd_lookup(struct mbuf *m, int af, int hlen, int *error, int direction,
81: struct tdb *tdbp, struct inpcb *inp)
82: {
83: struct route_enc re0, *re = &re0;
84: union sockaddr_union sdst, ssrc;
85: struct sockaddr_encap *ddst;
86: struct ipsec_policy *ipo;
87: int signore = 0, dignore = 0;
88:
89: /*
90: * If there are no flows in place, there's no point
91: * continuing with the SPD lookup.
92: */
93: if (!ipsec_in_use && inp == NULL) {
94: *error = 0;
95: return NULL;
96: }
97:
98: /*
99: * If an input packet is destined to a BYPASS socket, just accept it.
100: */
101: if ((inp != NULL) && (direction == IPSP_DIRECTION_IN) &&
102: (inp->inp_seclevel[SL_ESP_TRANS] == IPSEC_LEVEL_BYPASS) &&
103: (inp->inp_seclevel[SL_ESP_NETWORK] == IPSEC_LEVEL_BYPASS) &&
104: (inp->inp_seclevel[SL_AUTH] == IPSEC_LEVEL_BYPASS)) {
105: *error = 0;
106: return NULL;
107: }
108:
109: bzero((caddr_t) re, sizeof(struct route_enc));
110: bzero((caddr_t) &sdst, sizeof(union sockaddr_union));
111: bzero((caddr_t) &ssrc, sizeof(union sockaddr_union));
112: ddst = (struct sockaddr_encap *) &re->re_dst;
113: ddst->sen_family = PF_KEY;
114: ddst->sen_len = SENT_LEN;
115:
116: switch (af) {
117: #ifdef INET
118: case AF_INET:
119: if (hlen < sizeof (struct ip) || m->m_pkthdr.len < hlen) {
120: *error = EINVAL;
121: return NULL;
122: }
123: ddst->sen_direction = direction;
124: ddst->sen_type = SENT_IP4;
125:
126: m_copydata(m, offsetof(struct ip, ip_src),
127: sizeof(struct in_addr), (caddr_t) &(ddst->sen_ip_src));
128: m_copydata(m, offsetof(struct ip, ip_dst),
129: sizeof(struct in_addr), (caddr_t) &(ddst->sen_ip_dst));
130: m_copydata(m, offsetof(struct ip, ip_p), sizeof(u_int8_t),
131: (caddr_t) &(ddst->sen_proto));
132:
133: sdst.sin.sin_family = ssrc.sin.sin_family = AF_INET;
134: sdst.sin.sin_len = ssrc.sin.sin_len =
135: sizeof(struct sockaddr_in);
136: ssrc.sin.sin_addr = ddst->sen_ip_src;
137: sdst.sin.sin_addr = ddst->sen_ip_dst;
138:
139: /*
140: * If TCP/UDP, extract the port numbers to use in the lookup.
141: */
142: switch (ddst->sen_proto) {
143: case IPPROTO_UDP:
144: case IPPROTO_TCP:
145: /* Make sure there's enough data in the packet. */
146: if (m->m_pkthdr.len < hlen + 2 * sizeof(u_int16_t)) {
147: *error = EINVAL;
148: return NULL;
149: }
150:
151: /*
152: * Luckily, the offset of the src/dst ports in
153: * both the UDP and TCP headers is the same (first
154: * two 16-bit values in the respective headers),
155: * so we can just copy them.
156: */
157: m_copydata(m, hlen, sizeof(u_int16_t),
158: (caddr_t) &(ddst->sen_sport));
159: m_copydata(m, hlen + sizeof(u_int16_t), sizeof(u_int16_t),
160: (caddr_t) &(ddst->sen_dport));
161: break;
162:
163: default:
164: ddst->sen_sport = 0;
165: ddst->sen_dport = 0;
166: }
167:
168: break;
169: #endif /* INET */
170:
171: #ifdef INET6
172: case AF_INET6:
173: if (hlen < sizeof (struct ip6_hdr) || m->m_pkthdr.len < hlen) {
174: *error = EINVAL;
175: return NULL;
176: }
177: ddst->sen_type = SENT_IP6;
178: ddst->sen_ip6_direction = direction;
179:
180: m_copydata(m, offsetof(struct ip6_hdr, ip6_src),
181: sizeof(struct in6_addr),
182: (caddr_t) &(ddst->sen_ip6_src));
183: m_copydata(m, offsetof(struct ip6_hdr, ip6_dst),
184: sizeof(struct in6_addr),
185: (caddr_t) &(ddst->sen_ip6_dst));
186: m_copydata(m, offsetof(struct ip6_hdr, ip6_nxt),
187: sizeof(u_int8_t),
188: (caddr_t) &(ddst->sen_ip6_proto));
189:
190: sdst.sin6.sin6_family = ssrc.sin6.sin6_family = AF_INET6;
191: sdst.sin6.sin6_len = ssrc.sin6.sin6_family =
192: sizeof(struct sockaddr_in6);
193: in6_recoverscope(&ssrc.sin6, &ddst->sen_ip6_src, NULL);
194: in6_recoverscope(&sdst.sin6, &ddst->sen_ip6_dst, NULL);
195:
196: /*
197: * If TCP/UDP, extract the port numbers to use in the lookup.
198: */
199: switch (ddst->sen_ip6_proto) {
200: case IPPROTO_UDP:
201: case IPPROTO_TCP:
202: /* Make sure there's enough data in the packet. */
203: if (m->m_pkthdr.len < hlen + 2 * sizeof(u_int16_t)) {
204: *error = EINVAL;
205: return NULL;
206: }
207:
208: /*
209: * Luckily, the offset of the src/dst ports in
210: * both the UDP and TCP headers is the same
211: * (first two 16-bit values in the respective
212: * headers), so we can just copy them.
213: */
214: m_copydata(m, hlen, sizeof(u_int16_t),
215: (caddr_t) &(ddst->sen_ip6_sport));
216: m_copydata(m, hlen + sizeof(u_int16_t), sizeof(u_int16_t),
217: (caddr_t) &(ddst->sen_ip6_dport));
218: break;
219:
220: default:
221: ddst->sen_ip6_sport = 0;
222: ddst->sen_ip6_dport = 0;
223: }
224:
225: break;
226: #endif /* INET6 */
227:
228: default:
229: *error = EAFNOSUPPORT;
230: return NULL;
231: }
232:
233: /* Actual SPD lookup. */
234: rtalloc((struct route *) re);
235: if (re->re_rt == NULL) {
236: /*
237: * Return whatever the socket requirements are, there are no
238: * system-wide policies.
239: */
240: *error = 0;
241: return ipsp_spd_inp(m, af, hlen, error, direction,
242: tdbp, inp, NULL);
243: }
244:
245: /* Sanity check. */
246: if ((re->re_rt->rt_gateway == NULL) ||
247: (((struct sockaddr_encap *) re->re_rt->rt_gateway)->sen_type !=
248: SENT_IPSP)) {
249: RTFREE(re->re_rt);
250: *error = EHOSTUNREACH;
251: DPRINTF(("ip_spd_lookup: no gateway in SPD entry!"));
252: return NULL;
253: }
254:
255: ipo = ((struct sockaddr_encap *) (re->re_rt->rt_gateway))->sen_ipsp;
256: RTFREE(re->re_rt);
257: if (ipo == NULL) {
258: *error = EHOSTUNREACH;
259: DPRINTF(("ip_spd_lookup: no policy attached to SPD entry!"));
260: return NULL;
261: }
262:
263: switch (ipo->ipo_type) {
264: case IPSP_PERMIT:
265: *error = 0;
266: return ipsp_spd_inp(m, af, hlen, error, direction, tdbp,
267: inp, ipo);
268:
269: case IPSP_DENY:
270: *error = EHOSTUNREACH;
271: return NULL;
272:
273: case IPSP_IPSEC_USE:
274: case IPSP_IPSEC_ACQUIRE:
275: case IPSP_IPSEC_REQUIRE:
276: case IPSP_IPSEC_DONTACQ:
277: /* Nothing more needed here. */
278: break;
279:
280: default:
281: *error = EINVAL;
282: return NULL;
283: }
284:
285: /* Check for non-specific destination in the policy. */
286: switch (ipo->ipo_dst.sa.sa_family) {
287: #ifdef INET
288: case AF_INET:
289: if ((ipo->ipo_dst.sin.sin_addr.s_addr == INADDR_ANY) ||
290: (ipo->ipo_dst.sin.sin_addr.s_addr == INADDR_BROADCAST))
291: dignore = 1;
292: break;
293: #endif /* INET */
294:
295: #ifdef INET6
296: case AF_INET6:
297: if ((IN6_IS_ADDR_UNSPECIFIED(&ipo->ipo_dst.sin6.sin6_addr)) ||
298: (bcmp(&ipo->ipo_dst.sin6.sin6_addr, &in6mask128,
299: sizeof(in6mask128)) == 0))
300: dignore = 1;
301: break;
302: #endif /* INET6 */
303: }
304:
305: /* Likewise for source. */
306: switch (ipo->ipo_src.sa.sa_family) {
307: #ifdef INET
308: case AF_INET:
309: if (ipo->ipo_src.sin.sin_addr.s_addr == INADDR_ANY)
310: signore = 1;
311: break;
312: #endif /* INET */
313:
314: #ifdef INET6
315: case AF_INET6:
316: if (IN6_IS_ADDR_UNSPECIFIED(&ipo->ipo_src.sin6.sin6_addr))
317: signore = 1;
318: break;
319: #endif /* INET6 */
320: }
321:
322: /* Do we have a cached entry ? If so, check if it's still valid. */
323: if ((ipo->ipo_tdb) && (ipo->ipo_tdb->tdb_flags & TDBF_INVALID)) {
324: TAILQ_REMOVE(&ipo->ipo_tdb->tdb_policy_head, ipo,
325: ipo_tdb_next);
326: ipo->ipo_tdb = NULL;
327: }
328:
329: /* Outgoing packet policy check. */
330: if (direction == IPSP_DIRECTION_OUT) {
331: /*
332: * If the packet is destined for the policy-specified
333: * gateway/endhost, and the socket has the BYPASS
334: * option set, skip IPsec processing.
335: */
336: if ((inp != NULL) &&
337: (inp->inp_seclevel[SL_ESP_TRANS] == IPSEC_LEVEL_BYPASS) &&
338: (inp->inp_seclevel[SL_ESP_NETWORK] ==
339: IPSEC_LEVEL_BYPASS) &&
340: (inp->inp_seclevel[SL_AUTH] == IPSEC_LEVEL_BYPASS)) {
341: /* Direct match. */
342: if (dignore ||
343: !bcmp(&sdst, &ipo->ipo_dst, sdst.sa.sa_len)) {
344: *error = 0;
345: return NULL;
346: }
347: }
348:
349: /* Check that the cached TDB (if present), is appropriate. */
350: if (ipo->ipo_tdb) {
351: if ((ipo->ipo_last_searched <= ipsec_last_added) ||
352: (ipo->ipo_sproto != ipo->ipo_tdb->tdb_sproto) ||
353: bcmp(dignore ? &sdst : &ipo->ipo_dst,
354: &ipo->ipo_tdb->tdb_dst,
355: ipo->ipo_tdb->tdb_dst.sa.sa_len))
356: goto nomatchout;
357:
358: if (!ipsp_aux_match(ipo->ipo_tdb,
359: ipo->ipo_srcid, ipo->ipo_dstid,
360: ipo->ipo_local_cred, NULL,
361: &ipo->ipo_addr, &ipo->ipo_mask))
362: goto nomatchout;
363:
364: /* Cached entry is good. */
365: *error = 0;
366: return ipsp_spd_inp(m, af, hlen, error, direction,
367: tdbp, inp, ipo);
368:
369: nomatchout:
370: /* Cached TDB was not good. */
371: TAILQ_REMOVE(&ipo->ipo_tdb->tdb_policy_head, ipo,
372: ipo_tdb_next);
373: ipo->ipo_tdb = NULL;
374: ipo->ipo_last_searched = 0;
375: }
376:
377: /*
378: * If no SA has been added since the last time we did a
379: * lookup, there's no point searching for one. However, if the
380: * destination gateway is left unspecified (or is all-1's),
381: * always lookup since this is a generic-match rule
382: * (otherwise, we can have situations where SAs to some
383: * destinations exist but are not used, possibly leading to an
384: * explosion in the number of acquired SAs).
385: */
386: if (ipo->ipo_last_searched <= ipsec_last_added) {
387: /* "Touch" the entry. */
388: if (dignore == 0)
389: ipo->ipo_last_searched = time_second;
390:
391: /* Find an appropriate SA from the existing ones. */
392: ipo->ipo_tdb =
393: gettdbbyaddr(dignore ? &sdst : &ipo->ipo_dst,
394: ipo->ipo_sproto, ipo->ipo_srcid,
395: ipo->ipo_dstid, ipo->ipo_local_cred, m, af,
396: &ipo->ipo_addr, &ipo->ipo_mask);
397: if (ipo->ipo_tdb) {
398: TAILQ_INSERT_TAIL(&ipo->ipo_tdb->tdb_policy_head,
399: ipo, ipo_tdb_next);
400: *error = 0;
401: return ipsp_spd_inp(m, af, hlen, error,
402: direction, tdbp, inp, ipo);
403: }
404: }
405:
406: /* So, we don't have an SA -- just a policy. */
407: switch (ipo->ipo_type) {
408: case IPSP_IPSEC_REQUIRE:
409: /* Acquire SA through key management. */
410: if (ipsp_acquire_sa(ipo,
411: dignore ? &sdst : &ipo->ipo_dst,
412: signore ? NULL : &ipo->ipo_src, ddst, m) != 0) {
413: *error = EACCES;
414: return NULL;
415: }
416:
417: /* FALLTHROUGH */
418: case IPSP_IPSEC_DONTACQ:
419: *error = -EINVAL; /* Silently drop packet. */
420: return NULL;
421:
422: case IPSP_IPSEC_ACQUIRE:
423: /* Acquire SA through key management. */
424: ipsp_acquire_sa(ipo, dignore ? &sdst : &ipo->ipo_dst,
425: signore ? NULL : &ipo->ipo_src, ddst, NULL);
426:
427: /* FALLTHROUGH */
428: case IPSP_IPSEC_USE:
429: *error = 0;
430: return ipsp_spd_inp(m, af, hlen, error, direction,
431: tdbp, inp, ipo);
432: }
433: } else { /* IPSP_DIRECTION_IN */
434: if (tdbp != NULL) {
435: /* Direct match in the cache. */
436: if (ipo->ipo_tdb == tdbp) {
437: *error = 0;
438: return ipsp_spd_inp(m, af, hlen, error,
439: direction, tdbp, inp, ipo);
440: }
441:
442: if (bcmp(dignore ? &ssrc : &ipo->ipo_dst,
443: &tdbp->tdb_src, tdbp->tdb_src.sa.sa_len) ||
444: (ipo->ipo_sproto != tdbp->tdb_sproto))
445: goto nomatchin;
446:
447: /* Match source ID. */
448: if (ipo->ipo_srcid) {
449: if (tdbp->tdb_dstid == NULL ||
450: !ipsp_ref_match(ipo->ipo_srcid,
451: tdbp->tdb_dstid))
452: goto nomatchin;
453: }
454:
455: /* Match destination ID. */
456: if (ipo->ipo_dstid) {
457: if (tdbp->tdb_srcid == NULL ||
458: !ipsp_ref_match(ipo->ipo_dstid,
459: tdbp->tdb_srcid))
460: goto nomatchin;
461: }
462:
463: /* Add it to the cache. */
464: if (ipo->ipo_tdb)
465: TAILQ_REMOVE(&ipo->ipo_tdb->tdb_policy_head,
466: ipo, ipo_tdb_next);
467: ipo->ipo_tdb = tdbp;
468: TAILQ_INSERT_TAIL(&tdbp->tdb_policy_head, ipo,
469: ipo_tdb_next);
470: *error = 0;
471: return ipsp_spd_inp(m, af, hlen, error, direction,
472: tdbp, inp, ipo);
473:
474: nomatchin: /* Nothing needed here, falling through */
475: ;
476: }
477:
478: /* Check whether cached entry applies. */
479: if (ipo->ipo_tdb) {
480: /*
481: * We only need to check that the correct
482: * security protocol and security gateway are
483: * set; credentials/IDs will be the same,
484: * since the cached entry is linked on this
485: * policy.
486: */
487: if (ipo->ipo_sproto == ipo->ipo_tdb->tdb_sproto &&
488: !bcmp(&ipo->ipo_tdb->tdb_src,
489: dignore ? &ssrc : &ipo->ipo_dst,
490: ipo->ipo_tdb->tdb_src.sa.sa_len))
491: goto skipinputsearch;
492:
493: /* Not applicable, unlink. */
494: TAILQ_REMOVE(&ipo->ipo_tdb->tdb_policy_head, ipo,
495: ipo_tdb_next);
496: ipo->ipo_last_searched = 0;
497: ipo->ipo_tdb = NULL;
498: }
499:
500: /* Find whether there exists an appropriate SA. */
501: if (ipo->ipo_last_searched <= ipsec_last_added) {
502: if (dignore == 0)
503: ipo->ipo_last_searched = time_second;
504:
505: ipo->ipo_tdb =
506: gettdbbysrc(dignore ? &ssrc : &ipo->ipo_dst,
507: ipo->ipo_sproto, ipo->ipo_srcid,
508: ipo->ipo_dstid, m, af, &ipo->ipo_addr,
509: &ipo->ipo_mask);
510: if (ipo->ipo_tdb)
511: TAILQ_INSERT_TAIL(&ipo->ipo_tdb->tdb_policy_head,
512: ipo, ipo_tdb_next);
513: }
514: skipinputsearch:
515:
516: switch (ipo->ipo_type) {
517: case IPSP_IPSEC_REQUIRE:
518: /* If appropriate SA exists, don't acquire another. */
519: if (ipo->ipo_tdb) {
520: *error = -EINVAL;
521: return NULL;
522: }
523:
524: /* Acquire SA through key management. */
525: if ((*error = ipsp_acquire_sa(ipo,
526: dignore ? &ssrc : &ipo->ipo_dst,
527: signore ? NULL : &ipo->ipo_src, ddst, m)) != 0)
528: return NULL;
529:
530: /* FALLTHROUGH */
531: case IPSP_IPSEC_DONTACQ:
532: /* Drop packet. */
533: *error = -EINVAL;
534: return NULL;
535:
536: case IPSP_IPSEC_ACQUIRE:
537: /* If appropriate SA exists, don't acquire another. */
538: if (ipo->ipo_tdb) {
539: *error = 0;
540: return ipsp_spd_inp(m, af, hlen, error,
541: direction, tdbp, inp, ipo);
542: }
543:
544: /* Acquire SA through key management. */
545: ipsp_acquire_sa(ipo, dignore ? &ssrc : &ipo->ipo_dst,
546: signore ? NULL : &ipo->ipo_src, ddst, NULL);
547:
548: /* FALLTHROUGH */
549: case IPSP_IPSEC_USE:
550: *error = 0;
551: return ipsp_spd_inp(m, af, hlen, error, direction,
552: tdbp, inp, ipo);
553: }
554: }
555:
556: /* Shouldn't ever get this far. */
557: *error = EINVAL;
558: return NULL;
559: }
560:
561: /*
562: * Delete a policy from the SPD.
563: */
564: int
565: ipsec_delete_policy(struct ipsec_policy *ipo)
566: {
567: struct ipsec_acquire *ipa;
568: int err = 0;
569:
570: if (--ipo->ipo_ref_count > 0)
571: return 0;
572:
573: /* Delete from SPD. */
574: if (!(ipo->ipo_flags & IPSP_POLICY_SOCKET))
575: err = rtrequest(RTM_DELETE, (struct sockaddr *) &ipo->ipo_addr,
576: (struct sockaddr *) 0,
577: (struct sockaddr *) &ipo->ipo_mask,
578: 0, (struct rtentry **) 0, 0); /* XXX other tables? */
579:
580: if (ipo->ipo_tdb != NULL)
581: TAILQ_REMOVE(&ipo->ipo_tdb->tdb_policy_head, ipo,
582: ipo_tdb_next);
583:
584: while ((ipa = TAILQ_FIRST(&ipo->ipo_acquires)) != NULL)
585: ipsp_delete_acquire(ipa);
586:
587: TAILQ_REMOVE(&ipsec_policy_head, ipo, ipo_list);
588:
589: if (ipo->ipo_srcid)
590: ipsp_reffree(ipo->ipo_srcid);
591: if (ipo->ipo_dstid)
592: ipsp_reffree(ipo->ipo_dstid);
593: if (ipo->ipo_local_cred)
594: ipsp_reffree(ipo->ipo_local_cred);
595: if (ipo->ipo_local_auth)
596: ipsp_reffree(ipo->ipo_local_auth);
597:
598: pool_put(&ipsec_policy_pool, ipo);
599:
600: if (!(ipo->ipo_flags & IPSP_POLICY_SOCKET))
601: ipsec_in_use--;
602:
603: return err;
604: }
605:
606: /*
607: * Add a policy to the SPD.
608: */
609: struct ipsec_policy *
610: ipsec_add_policy(struct inpcb *inp, int af, int direction)
611: {
612: struct ipsec_policy *ipon;
613:
614: if (ipsec_policy_pool_initialized == 0) {
615: ipsec_policy_pool_initialized = 1;
616: pool_init(&ipsec_policy_pool, sizeof(struct ipsec_policy),
617: 0, 0, 0, "ipsec policy", NULL);
618: }
619:
620: ipon = pool_get(&ipsec_policy_pool, 0);
621: if (ipon == NULL)
622: return NULL;
623:
624: bzero(ipon, sizeof(struct ipsec_policy));
625:
626: ipon->ipo_ref_count = 1;
627: ipon->ipo_flags |= IPSP_POLICY_SOCKET;
628:
629: ipon->ipo_type = IPSP_IPSEC_REQUIRE; /* XXX */
630:
631: /* XXX
632: * We should actually be creating a linked list of
633: * policies (for tunnel/transport and ESP/AH), as needed.
634: */
635: ipon->ipo_sproto = IPPROTO_ESP;
636:
637: TAILQ_INIT(&ipon->ipo_acquires);
638: TAILQ_INSERT_HEAD(&ipsec_policy_head, ipon, ipo_list);
639:
640: ipsec_update_policy(inp, ipon, af, direction);
641:
642: return ipon;
643: }
644:
645: /*
646: * Update a PCB-attached policy.
647: */
648: void
649: ipsec_update_policy(struct inpcb *inp, struct ipsec_policy *ipon, int af,
650: int direction)
651: {
652: ipon->ipo_addr.sen_len = ipon->ipo_mask.sen_len = SENT_LEN;
653: ipon->ipo_addr.sen_family = ipon->ipo_mask.sen_family = PF_KEY;
654: ipon->ipo_src.sa.sa_family = ipon->ipo_dst.sa.sa_family = af;
655:
656: switch (af) {
657: case AF_INET:
658: #ifdef INET
659: ipon->ipo_addr.sen_type = ipon->ipo_mask.sen_type = SENT_IP4;
660: ipon->ipo_addr.sen_ip_src = inp->inp_laddr;
661: ipon->ipo_addr.sen_ip_dst = inp->inp_faddr;
662: ipon->ipo_addr.sen_sport = inp->inp_lport;
663: ipon->ipo_addr.sen_dport = inp->inp_fport;
664: ipon->ipo_addr.sen_proto =
665: inp->inp_socket->so_proto->pr_protocol;
666: ipon->ipo_addr.sen_direction = direction;
667:
668: ipon->ipo_mask.sen_ip_src.s_addr = 0xffffffff;
669: ipon->ipo_mask.sen_ip_dst.s_addr = 0xffffffff;
670: ipon->ipo_mask.sen_sport = ipon->ipo_mask.sen_dport = 0xffff;
671: ipon->ipo_mask.sen_proto = 0xff;
672: ipon->ipo_mask.sen_direction = direction;
673:
674: ipon->ipo_src.sa.sa_len = sizeof(struct sockaddr_in);
675: ipon->ipo_dst.sa.sa_len = sizeof(struct sockaddr_in);
676: ipon->ipo_src.sin.sin_addr = inp->inp_laddr;
677: ipon->ipo_dst.sin.sin_addr = inp->inp_faddr;
678: #endif /* INET */
679: break;
680:
681: case AF_INET6:
682: #ifdef INET6
683: ipon->ipo_addr.sen_type = ipon->ipo_mask.sen_type = SENT_IP6;
684: ipon->ipo_addr.sen_ip6_src = inp->inp_laddr6;
685: ipon->ipo_addr.sen_ip6_dst = inp->inp_faddr6;
686: ipon->ipo_addr.sen_ip6_sport = inp->inp_lport;
687: ipon->ipo_addr.sen_ip6_dport = inp->inp_fport;
688: ipon->ipo_addr.sen_ip6_proto =
689: inp->inp_socket->so_proto->pr_protocol;
690: ipon->ipo_addr.sen_ip6_direction = direction;
691:
692: ipon->ipo_mask.sen_ip6_src = in6mask128;
693: ipon->ipo_mask.sen_ip6_dst = in6mask128;
694: ipon->ipo_mask.sen_ip6_sport = 0xffff;
695: ipon->ipo_mask.sen_ip6_dport = 0xffff;
696: ipon->ipo_mask.sen_ip6_proto = 0xff;
697: ipon->ipo_mask.sen_ip6_direction = direction;
698:
699: ipon->ipo_src.sa.sa_len = sizeof(struct sockaddr_in6);
700: ipon->ipo_dst.sa.sa_len = sizeof(struct sockaddr_in6);
701: ipon->ipo_src.sin6.sin6_addr = inp->inp_laddr6;
702: ipon->ipo_dst.sin6.sin6_addr = inp->inp_faddr6;
703: #endif /* INET6 */
704: break;
705: }
706: }
707:
708: /*
709: * Delete a pending IPsec acquire record.
710: */
711: void
712: ipsp_delete_acquire(void *v)
713: {
714: struct ipsec_acquire *ipa = v;
715:
716: timeout_del(&ipa->ipa_timeout);
717: TAILQ_REMOVE(&ipsec_acquire_head, ipa, ipa_next);
718: if (ipa->ipa_policy != NULL)
719: TAILQ_REMOVE(&ipa->ipa_policy->ipo_acquires, ipa,
720: ipa_ipo_next);
721: pool_put(&ipsec_acquire_pool, ipa);
722: }
723:
724: /*
725: * Find out if there's an ACQUIRE pending.
726: * XXX Need a better structure.
727: */
728: struct ipsec_acquire *
729: ipsp_pending_acquire(struct ipsec_policy *ipo, union sockaddr_union *gw)
730: {
731: struct ipsec_acquire *ipa;
732:
733: TAILQ_FOREACH (ipa, &ipo->ipo_acquires, ipa_ipo_next) {
734: if (!bcmp(gw, &ipa->ipa_addr, gw->sa.sa_len))
735: return ipa;
736: }
737:
738: return NULL;
739: }
740:
741: /*
742: * Signal key management that we need an SA.
743: * XXX For outgoing policies, we could try to hold on to the mbuf.
744: */
745: int
746: ipsp_acquire_sa(struct ipsec_policy *ipo, union sockaddr_union *gw,
747: union sockaddr_union *laddr, struct sockaddr_encap *ddst, struct mbuf *m)
748: {
749: struct ipsec_acquire *ipa;
750:
751: /*
752: * If this is a socket policy, it has to have authentication
753: * information accompanying it --- can't tell key mgmt. to
754: * "find" it for us. This avoids abusing key mgmt. to authenticate
755: * on an application's behalf, even if the application doesn't
756: * have/know (and shouldn't) the appropriate authentication
757: * material (passphrase, private key, etc.)
758: */
759: if (ipo->ipo_flags & IPSP_POLICY_SOCKET &&
760: ipo->ipo_local_auth == NULL)
761: return EINVAL;
762:
763: /* Check whether request has been made already. */
764: if ((ipa = ipsp_pending_acquire(ipo, gw)) != NULL)
765: return 0;
766:
767: /* Add request in cache and proceed. */
768: if (ipsec_acquire_pool_initialized == 0) {
769: ipsec_acquire_pool_initialized = 1;
770: pool_init(&ipsec_acquire_pool, sizeof(struct ipsec_acquire),
771: 0, 0, 0, "ipsec acquire", NULL);
772: }
773:
774: ipa = pool_get(&ipsec_acquire_pool, 0);
775: if (ipa == NULL)
776: return ENOMEM;
777:
778: bzero(ipa, sizeof(struct ipsec_acquire));
779: bcopy(gw, &ipa->ipa_addr, sizeof(union sockaddr_union));
780:
781: timeout_set(&ipa->ipa_timeout, ipsp_delete_acquire, ipa);
782:
783: ipa->ipa_info.sen_len = ipa->ipa_mask.sen_len = SENT_LEN;
784: ipa->ipa_info.sen_family = ipa->ipa_mask.sen_family = PF_KEY;
785:
786: /* Just copy the right information. */
787: switch (ipo->ipo_addr.sen_type) {
788: #ifdef INET
789: case SENT_IP4:
790: ipa->ipa_info.sen_type = ipa->ipa_mask.sen_type = SENT_IP4;
791: ipa->ipa_info.sen_direction = ipo->ipo_addr.sen_direction;
792: ipa->ipa_mask.sen_direction = ipo->ipo_mask.sen_direction;
793:
794: if (ipo->ipo_mask.sen_ip_src.s_addr == INADDR_ANY ||
795: ipo->ipo_addr.sen_ip_src.s_addr == INADDR_ANY ||
796: ipsp_is_unspecified(ipo->ipo_dst)) {
797: ipa->ipa_info.sen_ip_src = ddst->sen_ip_src;
798: ipa->ipa_mask.sen_ip_src.s_addr = INADDR_BROADCAST;
799: } else {
800: ipa->ipa_info.sen_ip_src = ipo->ipo_addr.sen_ip_src;
801: ipa->ipa_mask.sen_ip_src = ipo->ipo_mask.sen_ip_src;
802: }
803:
804: if (ipo->ipo_mask.sen_ip_dst.s_addr == INADDR_ANY ||
805: ipo->ipo_addr.sen_ip_dst.s_addr == INADDR_ANY ||
806: ipsp_is_unspecified(ipo->ipo_dst)) {
807: ipa->ipa_info.sen_ip_dst = ddst->sen_ip_dst;
808: ipa->ipa_mask.sen_ip_dst.s_addr = INADDR_BROADCAST;
809: } else {
810: ipa->ipa_info.sen_ip_dst = ipo->ipo_addr.sen_ip_dst;
811: ipa->ipa_mask.sen_ip_dst = ipo->ipo_mask.sen_ip_dst;
812: }
813:
814: ipa->ipa_info.sen_proto = ipo->ipo_addr.sen_proto;
815: ipa->ipa_mask.sen_proto = ipo->ipo_mask.sen_proto;
816:
817: if (ipo->ipo_addr.sen_proto) {
818: ipa->ipa_info.sen_sport = ipo->ipo_addr.sen_sport;
819: ipa->ipa_mask.sen_sport = ipo->ipo_mask.sen_sport;
820:
821: ipa->ipa_info.sen_dport = ipo->ipo_addr.sen_dport;
822: ipa->ipa_mask.sen_dport = ipo->ipo_mask.sen_dport;
823: }
824: break;
825: #endif /* INET */
826:
827: #ifdef INET6
828: case SENT_IP6:
829: ipa->ipa_info.sen_type = ipa->ipa_mask.sen_type = SENT_IP6;
830: ipa->ipa_info.sen_ip6_direction =
831: ipo->ipo_addr.sen_ip6_direction;
832: ipa->ipa_mask.sen_ip6_direction =
833: ipo->ipo_mask.sen_ip6_direction;
834:
835: if (IN6_IS_ADDR_UNSPECIFIED(&ipo->ipo_mask.sen_ip6_src) ||
836: IN6_IS_ADDR_UNSPECIFIED(&ipo->ipo_addr.sen_ip6_src) ||
837: ipsp_is_unspecified(ipo->ipo_dst)) {
838: ipa->ipa_info.sen_ip6_src = ddst->sen_ip6_src;
839: ipa->ipa_mask.sen_ip6_src = in6mask128;
840: } else {
841: ipa->ipa_info.sen_ip6_src = ipo->ipo_addr.sen_ip6_src;
842: ipa->ipa_mask.sen_ip6_src = ipo->ipo_mask.sen_ip6_src;
843: }
844:
845: if (IN6_IS_ADDR_UNSPECIFIED(&ipo->ipo_mask.sen_ip6_dst) ||
846: IN6_IS_ADDR_UNSPECIFIED(&ipo->ipo_addr.sen_ip6_dst) ||
847: ipsp_is_unspecified(ipo->ipo_dst)) {
848: ipa->ipa_info.sen_ip6_dst = ddst->sen_ip6_dst;
849: ipa->ipa_mask.sen_ip6_dst = in6mask128;
850: } else {
851: ipa->ipa_info.sen_ip6_dst = ipo->ipo_addr.sen_ip6_dst;
852: ipa->ipa_mask.sen_ip6_dst = ipo->ipo_mask.sen_ip6_dst;
853: }
854:
855: ipa->ipa_info.sen_ip6_proto = ipo->ipo_addr.sen_ip6_proto;
856: ipa->ipa_mask.sen_ip6_proto = ipo->ipo_mask.sen_ip6_proto;
857:
858: if (ipo->ipo_mask.sen_ip6_proto) {
859: ipa->ipa_info.sen_ip6_sport =
860: ipo->ipo_addr.sen_ip6_sport;
861: ipa->ipa_mask.sen_ip6_sport =
862: ipo->ipo_mask.sen_ip6_sport;
863: ipa->ipa_info.sen_ip6_dport =
864: ipo->ipo_addr.sen_ip6_dport;
865: ipa->ipa_mask.sen_ip6_dport =
866: ipo->ipo_mask.sen_ip6_dport;
867: }
868: break;
869: #endif /* INET6 */
870:
871: default:
872: pool_put(&ipsec_acquire_pool, ipa);
873: return 0;
874: }
875:
876: timeout_add(&ipa->ipa_timeout, ipsec_expire_acquire * hz);
877:
878: TAILQ_INSERT_TAIL(&ipsec_acquire_head, ipa, ipa_next);
879: TAILQ_INSERT_TAIL(&ipo->ipo_acquires, ipa, ipa_ipo_next);
880: ipa->ipa_policy = ipo;
881:
882: /* PF_KEYv2 notification message. */
883: return pfkeyv2_acquire(ipo, gw, laddr, &ipa->ipa_seq, ddst);
884: }
885:
886: /*
887: * Deal with PCB security requirements.
888: */
889: struct tdb *
890: ipsp_spd_inp(struct mbuf *m, int af, int hlen, int *error, int direction,
891: struct tdb *tdbp, struct inpcb *inp, struct ipsec_policy *ipo)
892: {
893: struct ipsec_policy sipon;
894: struct tdb_ident *tdbi;
895: struct m_tag *mtag;
896: struct tdb *tdb = NULL;
897:
898: /* Sanity check. */
899: if (inp == NULL)
900: goto justreturn;
901:
902: /* Verify that we need to check for socket policy. */
903: if ((inp->inp_seclevel[SL_ESP_TRANS] == IPSEC_LEVEL_BYPASS ||
904: inp->inp_seclevel[SL_ESP_TRANS] == IPSEC_LEVEL_NONE) &&
905: (inp->inp_seclevel[SL_ESP_NETWORK] == IPSEC_LEVEL_BYPASS ||
906: inp->inp_seclevel[SL_ESP_NETWORK] == IPSEC_LEVEL_NONE) &&
907: (inp->inp_seclevel[SL_AUTH] == IPSEC_LEVEL_BYPASS ||
908: inp->inp_seclevel[SL_AUTH] == IPSEC_LEVEL_NONE))
909: goto justreturn;
910:
911: switch (direction) {
912: case IPSP_DIRECTION_IN:
913: /*
914: * Some further checking: if the socket has specified
915: * that it will accept unencrypted traffic, don't
916: * bother checking any further -- just accept the packet.
917: */
918: if ((inp->inp_seclevel[SL_ESP_TRANS] == IPSEC_LEVEL_AVAIL ||
919: inp->inp_seclevel[SL_ESP_TRANS] == IPSEC_LEVEL_USE) &&
920: (inp->inp_seclevel[SL_ESP_NETWORK] == IPSEC_LEVEL_AVAIL ||
921: inp->inp_seclevel[SL_ESP_NETWORK] == IPSEC_LEVEL_USE) &&
922: (inp->inp_seclevel[SL_AUTH] == IPSEC_LEVEL_AVAIL ||
923: inp->inp_seclevel[SL_AUTH] == IPSEC_LEVEL_USE))
924: goto justreturn;
925:
926: /* Initialize socket policy if unset. */
927: if (inp->inp_ipo == NULL) {
928: inp->inp_ipo = ipsec_add_policy(inp, af,
929: IPSP_DIRECTION_OUT);
930: if (inp->inp_ipo == NULL) {
931: *error = ENOBUFS;
932: return NULL;
933: }
934: }
935:
936: /*
937: * So we *must* have protected traffic. Let's see what
938: * we have received then.
939: */
940: if (inp->inp_tdb_in != NULL) {
941: if (inp->inp_tdb_in == tdbp)
942: goto justreturn; /* We received packet under a
943: * previously-accepted TDB. */
944:
945: /*
946: * We should be receiving protected traffic, and
947: * have an SA in place, but packet was received
948: * unprotected. Simply discard.
949: */
950: if (tdbp == NULL) {
951: *error = -EINVAL;
952: return NULL;
953: }
954:
955: /* Update, since we may need all the relevant info. */
956: ipsec_update_policy(inp, inp->inp_ipo, af,
957: IPSP_DIRECTION_OUT);
958:
959: /*
960: * Check that the TDB the packet was received under
961: * is acceptable under the socket policy. If so,
962: * accept the packet; otherwise, discard.
963: */
964: if (tdbp->tdb_sproto == inp->inp_ipo->ipo_sproto &&
965: !bcmp(&tdbp->tdb_src, &inp->inp_ipo->ipo_dst,
966: SA_LEN(&tdbp->tdb_src.sa)) &&
967: ipsp_aux_match(tdbp,
968: inp->inp_ipo->ipo_srcid,
969: inp->inp_ipo->ipo_dstid,
970: NULL, NULL,
971: &inp->inp_ipo->ipo_addr,
972: &inp->inp_ipo->ipo_mask))
973: goto justreturn;
974: else {
975: *error = -EINVAL;
976: return NULL;
977: }
978: } else {
979: /* Update, since we may need all the relevant info. */
980: ipsec_update_policy(inp, inp->inp_ipo, af,
981: IPSP_DIRECTION_OUT);
982:
983: /*
984: * If the packet was received under an SA, see if
985: * it's acceptable under socket policy. If it is,
986: * accept the packet.
987: */
988: if (tdbp != NULL &&
989: tdbp->tdb_sproto == inp->inp_ipo->ipo_sproto &&
990: !bcmp(&tdbp->tdb_src, &inp->inp_ipo->ipo_dst,
991: SA_LEN(&tdbp->tdb_src.sa)) &&
992: ipsp_aux_match(tdbp,
993: inp->inp_ipo->ipo_srcid,
994: inp->inp_ipo->ipo_dstid,
995: NULL, NULL,
996: &inp->inp_ipo->ipo_addr,
997: &inp->inp_ipo->ipo_mask))
998: goto justreturn;
999:
1000: /*
1001: * If the packet was not received under an SA, or
1002: * if the SA it was received under is not acceptable,
1003: * see if we already have an acceptable SA
1004: * established. If we do, discard packet.
1005: */
1006: if (inp->inp_ipo->ipo_last_searched <=
1007: ipsec_last_added) {
1008: inp->inp_ipo->ipo_last_searched = time_second;
1009:
1010: /* Do we have an SA already established ? */
1011: if (gettdbbysrc(&inp->inp_ipo->ipo_dst,
1012: inp->inp_ipo->ipo_sproto,
1013: inp->inp_ipo->ipo_srcid,
1014: inp->inp_ipo->ipo_dstid, m, af,
1015: &inp->inp_ipo->ipo_addr,
1016: &inp->inp_ipo->ipo_mask) != NULL) {
1017: *error = -EINVAL;
1018: return NULL;
1019: }
1020: /* Fall through */
1021: }
1022:
1023: /*
1024: * If we don't have an appropriate SA, acquire one
1025: * and discard the packet.
1026: */
1027: ipsp_acquire_sa(inp->inp_ipo, &inp->inp_ipo->ipo_dst,
1028: &inp->inp_ipo->ipo_src, &inp->inp_ipo->ipo_addr, m);
1029: *error = -EINVAL;
1030: return NULL;
1031: }
1032:
1033: break;
1034:
1035: case IPSP_DIRECTION_OUT:
1036: /* Do we have a cached entry ? */
1037: if (inp->inp_tdb_out != NULL) {
1038: /*
1039: * If we also have to apply a different TDB as
1040: * a result of a system-wide policy, add a tag
1041: * to the packet.
1042: */
1043: if (ipo != NULL && m != NULL &&
1044: ipo->ipo_tdb != NULL &&
1045: ipo->ipo_tdb != inp->inp_tdb_out) {
1046: tdb = inp->inp_tdb_out;
1047: goto tagandreturn;
1048: } else
1049: return inp->inp_tdb_out;
1050: }
1051:
1052: /*
1053: * We need to either find an SA with the appropriate
1054: * characteristics and link it to the PCB, or acquire
1055: * one.
1056: */
1057: /* XXX Only support one policy/protocol for now. */
1058: if (inp->inp_ipo != NULL) {
1059: if (inp->inp_ipo->ipo_last_searched <=
1060: ipsec_last_added) {
1061: inp->inp_ipo->ipo_last_searched = time_second;
1062:
1063: /* Update, just in case. */
1064: ipsec_update_policy(inp, inp->inp_ipo, af,
1065: IPSP_DIRECTION_OUT);
1066:
1067: tdb = gettdbbyaddr(&inp->inp_ipo->ipo_dst,
1068: inp->inp_ipo->ipo_sproto,
1069: inp->inp_ipo->ipo_srcid,
1070: inp->inp_ipo->ipo_dstid,
1071: inp->inp_ipo->ipo_local_cred, m, af,
1072: &inp->inp_ipo->ipo_addr,
1073: &inp->inp_ipo->ipo_mask);
1074: }
1075: } else {
1076: /*
1077: * Construct a pseudo-policy, with just the necessary
1078: * fields.
1079: */
1080: ipsec_update_policy(inp, &sipon, af,
1081: IPSP_DIRECTION_OUT);
1082:
1083: tdb = gettdbbyaddr(&sipon.ipo_dst, IPPROTO_ESP, NULL,
1084: NULL, NULL, m, af, &sipon.ipo_addr,
1085: &sipon.ipo_mask);
1086: }
1087:
1088: /* If we found an appropriate SA... */
1089: if (tdb != NULL) {
1090: tdb_add_inp(tdb, inp, 0); /* Latch onto PCB. */
1091:
1092: if (ipo != NULL && ipo->ipo_tdb != NULL &&
1093: ipo->ipo_tdb != inp->inp_tdb_out && m != NULL)
1094: goto tagandreturn;
1095: else
1096: return tdb;
1097: } else {
1098: /* Do we need to acquire one ? */
1099: switch (inp->inp_seclevel[SL_ESP_TRANS]) {
1100: case IPSEC_LEVEL_BYPASS:
1101: case IPSEC_LEVEL_AVAIL:
1102: /* No need to do anything. */
1103: goto justreturn;
1104: case IPSEC_LEVEL_USE:
1105: case IPSEC_LEVEL_REQUIRE:
1106: case IPSEC_LEVEL_UNIQUE:
1107: /* Initialize socket policy if unset. */
1108: if (inp->inp_ipo == NULL) {
1109: inp->inp_ipo = ipsec_add_policy(inp, af, IPSP_DIRECTION_OUT);
1110: if (inp->inp_ipo == NULL) {
1111: *error = ENOBUFS;
1112: return NULL;
1113: }
1114: }
1115:
1116: /* Acquire a new SA. */
1117: if ((*error = ipsp_acquire_sa(inp->inp_ipo,
1118: &inp->inp_ipo->ipo_dst,
1119: &inp->inp_ipo->ipo_src,
1120: &inp->inp_ipo->ipo_addr, m)) == 0)
1121: *error = -EINVAL;
1122:
1123: return NULL;
1124: default:
1125: DPRINTF(("ipsp_spd_inp: unknown sock security"
1126: " level %d",
1127: inp->inp_seclevel[SL_ESP_TRANS]));
1128: *error = -EINVAL;
1129: return NULL;
1130: }
1131: }
1132: break;
1133:
1134: default: /* Should never happen. */
1135: *error = -EINVAL;
1136: return NULL;
1137: }
1138:
1139: tagandreturn:
1140: if (tdb == NULL)
1141: goto justreturn;
1142:
1143: mtag = m_tag_get(PACKET_TAG_IPSEC_PENDING_TDB,
1144: sizeof (struct tdb_ident), M_NOWAIT);
1145: if (mtag == NULL) {
1146: *error = ENOMEM;
1147: return NULL;
1148: }
1149:
1150: tdbi = (struct tdb_ident *)(mtag + 1);
1151: tdbi->spi = ipo->ipo_tdb->tdb_spi;
1152: tdbi->proto = ipo->ipo_tdb->tdb_sproto;
1153: bcopy(&ipo->ipo_tdb->tdb_dst, &tdbi->dst,
1154: ipo->ipo_tdb->tdb_dst.sa.sa_len);
1155: m_tag_prepend(m, mtag);
1156: return tdb;
1157:
1158: justreturn:
1159: if (ipo != NULL)
1160: return ipo->ipo_tdb;
1161: else
1162: return NULL;
1163: }
1164:
1165: /*
1166: * Find a pending ACQUIRE record based on its sequence number.
1167: * XXX Need to use a better data structure.
1168: */
1169: struct ipsec_acquire *
1170: ipsec_get_acquire(u_int32_t seq)
1171: {
1172: struct ipsec_acquire *ipa;
1173:
1174: TAILQ_FOREACH (ipa, &ipsec_acquire_head, ipa_next)
1175: if (ipa->ipa_seq == seq)
1176: return ipa;
1177:
1178: return NULL;
1179: }