1 |
|
|
/* $OpenBSD: pfkey.c,v 1.58 2017/04/18 02:29:56 deraadt Exp $ */ |
2 |
|
|
|
3 |
|
|
/* |
4 |
|
|
* Copyright (c) 2010-2013 Reyk Floeter <reyk@openbsd.org> |
5 |
|
|
* Copyright (c) 2004, 2005 Hans-Joerg Hoexer <hshoexer@openbsd.org> |
6 |
|
|
* Copyright (c) 2003, 2004 Henning Brauer <henning@openbsd.org> |
7 |
|
|
* Copyright (c) 2003, 2004 Markus Friedl <markus@openbsd.org> |
8 |
|
|
* |
9 |
|
|
* Permission to use, copy, modify, and distribute this software for any |
10 |
|
|
* purpose with or without fee is hereby granted, provided that the above |
11 |
|
|
* copyright notice and this permission notice appear in all copies. |
12 |
|
|
* |
13 |
|
|
* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES |
14 |
|
|
* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF |
15 |
|
|
* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR |
16 |
|
|
* ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES |
17 |
|
|
* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN |
18 |
|
|
* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF |
19 |
|
|
* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. |
20 |
|
|
*/ |
21 |
|
|
|
22 |
|
|
#include <sys/queue.h> |
23 |
|
|
#include <sys/uio.h> |
24 |
|
|
#include <sys/socket.h> |
25 |
|
|
|
26 |
|
|
#include <netinet/in.h> |
27 |
|
|
#include <netinet/ip_ipsp.h> |
28 |
|
|
#include <net/pfkeyv2.h> |
29 |
|
|
|
30 |
|
|
#include <err.h> |
31 |
|
|
#include <errno.h> |
32 |
|
|
#include <stdio.h> |
33 |
|
|
#include <poll.h> |
34 |
|
|
#include <string.h> |
35 |
|
|
#include <stdlib.h> |
36 |
|
|
#include <unistd.h> |
37 |
|
|
#include <event.h> |
38 |
|
|
|
39 |
|
|
#include "iked.h" |
40 |
|
|
#include "ikev2.h" |
41 |
|
|
|
42 |
|
|
#define ROUNDUP(x) (((x) + (PFKEYV2_CHUNK - 1)) & ~(PFKEYV2_CHUNK - 1)) |
43 |
|
|
#define IOV_CNT 20 |
44 |
|
|
|
45 |
|
|
#define PFKEYV2_CHUNK sizeof(uint64_t) |
46 |
|
|
#define PFKEY_REPLY_TIMEOUT 1000 |
47 |
|
|
|
48 |
|
|
static uint32_t sadb_msg_seq = 0; |
49 |
|
|
static unsigned int sadb_decoupled = 0; |
50 |
|
|
static unsigned int sadb_ipv6refcnt = 0; |
51 |
|
|
|
52 |
|
|
static int pfkey_blockipv6 = 0; |
53 |
|
|
static struct event pfkey_timer_ev; |
54 |
|
|
static struct timeval pfkey_timer_tv; |
55 |
|
|
|
56 |
|
|
struct pfkey_message { |
57 |
|
|
SIMPLEQ_ENTRY(pfkey_message) |
58 |
|
|
pm_entry; |
59 |
|
|
uint8_t *pm_data; |
60 |
|
|
ssize_t pm_length; |
61 |
|
|
}; |
62 |
|
|
SIMPLEQ_HEAD(, pfkey_message) pfkey_retry, pfkey_postponed = |
63 |
|
|
SIMPLEQ_HEAD_INITIALIZER(pfkey_postponed); |
64 |
|
|
|
65 |
|
|
struct pfkey_constmap { |
66 |
|
|
uint8_t pfkey_id; |
67 |
|
|
unsigned int pfkey_ikeid; |
68 |
|
|
unsigned int pfkey_fixedkey; |
69 |
|
|
}; |
70 |
|
|
|
71 |
|
|
static const struct pfkey_constmap pfkey_encr[] = { |
72 |
|
|
{ SADB_EALG_3DESCBC, IKEV2_XFORMENCR_3DES }, |
73 |
|
|
{ SADB_X_EALG_CAST, IKEV2_XFORMENCR_CAST }, |
74 |
|
|
{ SADB_X_EALG_BLF, IKEV2_XFORMENCR_BLOWFISH }, |
75 |
|
|
{ SADB_EALG_NULL, IKEV2_XFORMENCR_NULL }, |
76 |
|
|
{ SADB_X_EALG_AES, IKEV2_XFORMENCR_AES_CBC }, |
77 |
|
|
{ SADB_X_EALG_AESCTR, IKEV2_XFORMENCR_AES_CTR }, |
78 |
|
|
{ SADB_X_EALG_AESGCM16, IKEV2_XFORMENCR_AES_GCM_16 }, |
79 |
|
|
{ SADB_X_EALG_AESGMAC, IKEV2_XFORMENCR_NULL_AES_GMAC }, |
80 |
|
|
{ SADB_X_EALG_CHACHA20POLY1305, IKEV2_XFORMENCR_CHACHA20_POLY1305 }, |
81 |
|
|
{ 0 } |
82 |
|
|
}; |
83 |
|
|
|
84 |
|
|
static const struct pfkey_constmap pfkey_integr[] = { |
85 |
|
|
{ SADB_AALG_MD5HMAC, IKEV2_XFORMAUTH_HMAC_MD5_96 }, |
86 |
|
|
{ SADB_AALG_SHA1HMAC, IKEV2_XFORMAUTH_HMAC_SHA1_96 }, |
87 |
|
|
{ SADB_X_AALG_SHA2_256, IKEV2_XFORMAUTH_HMAC_SHA2_256_128 }, |
88 |
|
|
{ SADB_X_AALG_SHA2_384, IKEV2_XFORMAUTH_HMAC_SHA2_384_192 }, |
89 |
|
|
{ SADB_X_AALG_SHA2_512, IKEV2_XFORMAUTH_HMAC_SHA2_512_256 }, |
90 |
|
|
{ 0 } |
91 |
|
|
}; |
92 |
|
|
|
93 |
|
|
static const struct pfkey_constmap pfkey_satype[] = { |
94 |
|
|
{ SADB_SATYPE_AH, IKEV2_SAPROTO_AH }, |
95 |
|
|
{ SADB_SATYPE_ESP, IKEV2_SAPROTO_ESP }, |
96 |
|
|
{ SADB_X_SATYPE_IPCOMP, IKEV2_SAPROTO_IPCOMP }, |
97 |
|
|
{ 0 } |
98 |
|
|
}; |
99 |
|
|
|
100 |
|
|
int pfkey_map(const struct pfkey_constmap *, uint16_t, uint8_t *); |
101 |
|
|
int pfkey_flow(int, uint8_t, uint8_t, struct iked_flow *); |
102 |
|
|
int pfkey_sa(int, uint8_t, uint8_t, struct iked_childsa *); |
103 |
|
|
int pfkey_sa_getspi(int, uint8_t, struct iked_childsa *, uint32_t *); |
104 |
|
|
int pfkey_sagroup(int, uint8_t, uint8_t, |
105 |
|
|
struct iked_childsa *, struct iked_childsa *); |
106 |
|
|
int pfkey_write(int, struct sadb_msg *, struct iovec *, int, |
107 |
|
|
uint8_t **, ssize_t *); |
108 |
|
|
int pfkey_reply(int, uint8_t **, ssize_t *); |
109 |
|
|
void pfkey_dispatch(int, short, void *); |
110 |
|
|
|
111 |
|
|
struct sadb_ident * |
112 |
|
|
pfkey_id2ident(struct iked_id *, unsigned int); |
113 |
|
|
void *pfkey_find_ext(uint8_t *, ssize_t, int); |
114 |
|
|
|
115 |
|
|
void pfkey_timer_cb(int, short, void *); |
116 |
|
|
int pfkey_process(struct iked *, struct pfkey_message *); |
117 |
|
|
|
118 |
|
|
int |
119 |
|
|
pfkey_couple(int sd, struct iked_sas *sas, int couple) |
120 |
|
|
{ |
121 |
|
|
struct iked_sa *sa; |
122 |
|
|
struct iked_flow *flow; |
123 |
|
|
struct iked_childsa *csa; |
124 |
|
|
const char *mode[] = { "coupled", "decoupled" }; |
125 |
|
|
|
126 |
|
|
/* Socket is not ready */ |
127 |
|
|
if (sd == -1) |
128 |
|
|
return (-1); |
129 |
|
|
|
130 |
|
|
if (sadb_decoupled == !couple) |
131 |
|
|
return (0); |
132 |
|
|
|
133 |
|
|
log_debug("%s: kernel %s -> %s", __func__, |
134 |
|
|
mode[sadb_decoupled], mode[!sadb_decoupled]); |
135 |
|
|
|
136 |
|
|
/* Allow writes to the PF_KEY socket */ |
137 |
|
|
sadb_decoupled = 0; |
138 |
|
|
|
139 |
|
|
RB_FOREACH(sa, iked_sas, sas) { |
140 |
|
|
TAILQ_FOREACH(csa, &sa->sa_childsas, csa_entry) { |
141 |
|
|
if (!csa->csa_loaded && couple) |
142 |
|
|
(void)pfkey_sa_add(sd, csa, NULL); |
143 |
|
|
else if (csa->csa_loaded && !couple) |
144 |
|
|
(void)pfkey_sa_delete(sd, csa); |
145 |
|
|
} |
146 |
|
|
TAILQ_FOREACH(flow, &sa->sa_flows, flow_entry) { |
147 |
|
|
if (!flow->flow_loaded && couple) |
148 |
|
|
(void)pfkey_flow_add(sd, flow); |
149 |
|
|
else if (flow->flow_loaded && !couple) |
150 |
|
|
(void)pfkey_flow_delete(sd, flow); |
151 |
|
|
} |
152 |
|
|
} |
153 |
|
|
|
154 |
|
|
sadb_decoupled = !couple; |
155 |
|
|
|
156 |
|
|
return (0); |
157 |
|
|
} |
158 |
|
|
|
159 |
|
|
int |
160 |
|
|
pfkey_map(const struct pfkey_constmap *map, uint16_t alg, uint8_t *pfkalg) |
161 |
|
|
{ |
162 |
|
|
int i; |
163 |
|
|
|
164 |
|
|
for (i = 0; map[i].pfkey_id != 0; i++) |
165 |
|
|
if (map[i].pfkey_ikeid == alg) { |
166 |
|
|
*pfkalg = map[i].pfkey_id; |
167 |
|
|
return (0); |
168 |
|
|
} |
169 |
|
|
return (-1); |
170 |
|
|
} |
171 |
|
|
|
172 |
|
|
int |
173 |
|
|
pfkey_flow(int sd, uint8_t satype, uint8_t action, struct iked_flow *flow) |
174 |
|
|
{ |
175 |
|
|
struct sadb_msg smsg; |
176 |
|
|
struct iked_addr *flow_src, *flow_dst; |
177 |
|
|
struct sadb_address sa_src, sa_dst, sa_local, sa_peer, sa_smask, |
178 |
|
|
sa_dmask; |
179 |
|
|
struct sadb_protocol sa_flowtype, sa_protocol; |
180 |
|
|
struct sadb_ident *sa_srcid, *sa_dstid; |
181 |
|
|
struct sockaddr_storage ssrc, sdst, slocal, speer, smask, dmask; |
182 |
|
|
struct iovec iov[IOV_CNT]; |
183 |
|
|
int iov_cnt, ret = -1; |
184 |
|
|
|
185 |
|
|
sa_srcid = sa_dstid = NULL; |
186 |
|
|
|
187 |
|
|
flow_src = &flow->flow_src; |
188 |
|
|
flow_dst = &flow->flow_dst; |
189 |
|
|
|
190 |
|
|
if (flow->flow_prenat.addr_af == flow_src->addr_af) { |
191 |
|
|
switch (flow->flow_type) { |
192 |
|
|
case SADB_X_FLOW_TYPE_USE: |
193 |
|
|
flow_dst = &flow->flow_prenat; |
194 |
|
|
break; |
195 |
|
|
case SADB_X_FLOW_TYPE_REQUIRE: |
196 |
|
|
flow_src = &flow->flow_prenat; |
197 |
|
|
break; |
198 |
|
|
case 0: |
199 |
|
|
if (flow->flow_dir == IPSP_DIRECTION_IN) |
200 |
|
|
flow_dst = &flow->flow_prenat; |
201 |
|
|
else |
202 |
|
|
flow_src = &flow->flow_prenat; |
203 |
|
|
} |
204 |
|
|
} |
205 |
|
|
|
206 |
|
|
bzero(&ssrc, sizeof(ssrc)); |
207 |
|
|
bzero(&smask, sizeof(smask)); |
208 |
|
|
memcpy(&ssrc, &flow_src->addr, sizeof(ssrc)); |
209 |
|
|
memcpy(&smask, &flow_src->addr, sizeof(smask)); |
210 |
|
|
socket_af((struct sockaddr *)&ssrc, flow_src->addr_port); |
211 |
|
|
socket_af((struct sockaddr *)&smask, flow_src->addr_port ? |
212 |
|
|
0xffff : 0); |
213 |
|
|
|
214 |
|
|
switch (flow_src->addr_af) { |
215 |
|
|
case AF_INET: |
216 |
|
|
((struct sockaddr_in *)&smask)->sin_addr.s_addr = |
217 |
|
|
prefixlen2mask(flow_src->addr_net ? |
218 |
|
|
flow_src->addr_mask : 32); |
219 |
|
|
break; |
220 |
|
|
case AF_INET6: |
221 |
|
|
prefixlen2mask6(flow_src->addr_net ? |
222 |
|
|
flow_src->addr_mask : 128, |
223 |
|
|
(uint32_t *)((struct sockaddr_in6 *) |
224 |
|
|
&smask)->sin6_addr.s6_addr); |
225 |
|
|
break; |
226 |
|
|
default: |
227 |
|
|
log_warnx("%s: unsupported address family %d", |
228 |
|
|
__func__, flow_src->addr_af); |
229 |
|
|
return (-1); |
230 |
|
|
} |
231 |
|
|
smask.ss_len = ssrc.ss_len; |
232 |
|
|
|
233 |
|
|
bzero(&sdst, sizeof(sdst)); |
234 |
|
|
bzero(&dmask, sizeof(dmask)); |
235 |
|
|
memcpy(&sdst, &flow_dst->addr, sizeof(sdst)); |
236 |
|
|
memcpy(&dmask, &flow_dst->addr, sizeof(dmask)); |
237 |
|
|
socket_af((struct sockaddr *)&sdst, flow_dst->addr_port); |
238 |
|
|
socket_af((struct sockaddr *)&dmask, flow_dst->addr_port ? |
239 |
|
|
0xffff : 0); |
240 |
|
|
|
241 |
|
|
switch (flow_dst->addr_af) { |
242 |
|
|
case AF_INET: |
243 |
|
|
((struct sockaddr_in *)&dmask)->sin_addr.s_addr = |
244 |
|
|
prefixlen2mask(flow_dst->addr_net ? |
245 |
|
|
flow_dst->addr_mask : 32); |
246 |
|
|
break; |
247 |
|
|
case AF_INET6: |
248 |
|
|
prefixlen2mask6(flow_dst->addr_net ? |
249 |
|
|
flow_dst->addr_mask : 128, |
250 |
|
|
(uint32_t *)((struct sockaddr_in6 *) |
251 |
|
|
&dmask)->sin6_addr.s6_addr); |
252 |
|
|
break; |
253 |
|
|
default: |
254 |
|
|
log_warnx("%s: unsupported address family %d", |
255 |
|
|
__func__, flow_dst->addr_af); |
256 |
|
|
return (-1); |
257 |
|
|
} |
258 |
|
|
dmask.ss_len = sdst.ss_len; |
259 |
|
|
|
260 |
|
|
bzero(&slocal, sizeof(slocal)); |
261 |
|
|
bzero(&speer, sizeof(speer)); |
262 |
|
|
if (action != SADB_X_DELFLOW && flow->flow_local != NULL) { |
263 |
|
|
memcpy(&slocal, &flow->flow_local->addr, sizeof(slocal)); |
264 |
|
|
socket_af((struct sockaddr *)&slocal, 0); |
265 |
|
|
|
266 |
|
|
memcpy(&speer, &flow->flow_peer->addr, sizeof(speer)); |
267 |
|
|
socket_af((struct sockaddr *)&speer, 0); |
268 |
|
|
} |
269 |
|
|
|
270 |
|
|
bzero(&smsg, sizeof(smsg)); |
271 |
|
|
smsg.sadb_msg_version = PF_KEY_V2; |
272 |
|
|
smsg.sadb_msg_seq = ++sadb_msg_seq; |
273 |
|
|
smsg.sadb_msg_pid = getpid(); |
274 |
|
|
smsg.sadb_msg_len = sizeof(smsg) / 8; |
275 |
|
|
smsg.sadb_msg_type = action; |
276 |
|
|
smsg.sadb_msg_satype = satype; |
277 |
|
|
|
278 |
|
|
bzero(&sa_flowtype, sizeof(sa_flowtype)); |
279 |
|
|
sa_flowtype.sadb_protocol_exttype = SADB_X_EXT_FLOW_TYPE; |
280 |
|
|
sa_flowtype.sadb_protocol_len = sizeof(sa_flowtype) / 8; |
281 |
|
|
sa_flowtype.sadb_protocol_direction = flow->flow_dir; |
282 |
|
|
sa_flowtype.sadb_protocol_proto = |
283 |
|
|
flow->flow_type ? flow->flow_type : |
284 |
|
|
(flow->flow_dir == IPSP_DIRECTION_IN ? |
285 |
|
|
SADB_X_FLOW_TYPE_USE : SADB_X_FLOW_TYPE_REQUIRE); |
286 |
|
|
|
287 |
|
|
bzero(&sa_protocol, sizeof(sa_protocol)); |
288 |
|
|
sa_protocol.sadb_protocol_exttype = SADB_X_EXT_PROTOCOL; |
289 |
|
|
sa_protocol.sadb_protocol_len = sizeof(sa_protocol) / 8; |
290 |
|
|
sa_protocol.sadb_protocol_direction = 0; |
291 |
|
|
sa_protocol.sadb_protocol_proto = flow->flow_ipproto; |
292 |
|
|
|
293 |
|
|
bzero(&sa_src, sizeof(sa_src)); |
294 |
|
|
sa_src.sadb_address_exttype = SADB_X_EXT_SRC_FLOW; |
295 |
|
|
sa_src.sadb_address_len = (sizeof(sa_src) + ROUNDUP(ssrc.ss_len)) / 8; |
296 |
|
|
|
297 |
|
|
bzero(&sa_smask, sizeof(sa_smask)); |
298 |
|
|
sa_smask.sadb_address_exttype = SADB_X_EXT_SRC_MASK; |
299 |
|
|
sa_smask.sadb_address_len = |
300 |
|
|
(sizeof(sa_smask) + ROUNDUP(smask.ss_len)) / 8; |
301 |
|
|
|
302 |
|
|
bzero(&sa_dst, sizeof(sa_dst)); |
303 |
|
|
sa_dst.sadb_address_exttype = SADB_X_EXT_DST_FLOW; |
304 |
|
|
sa_dst.sadb_address_len = (sizeof(sa_dst) + ROUNDUP(sdst.ss_len)) / 8; |
305 |
|
|
|
306 |
|
|
bzero(&sa_dmask, sizeof(sa_dmask)); |
307 |
|
|
sa_dmask.sadb_address_exttype = SADB_X_EXT_DST_MASK; |
308 |
|
|
sa_dmask.sadb_address_len = |
309 |
|
|
(sizeof(sa_dmask) + ROUNDUP(dmask.ss_len)) / 8; |
310 |
|
|
|
311 |
|
|
if (action != SADB_X_DELFLOW && flow->flow_local != NULL) { |
312 |
|
|
/* local address */ |
313 |
|
|
bzero(&sa_local, sizeof(sa_local)); |
314 |
|
|
sa_local.sadb_address_exttype = SADB_EXT_ADDRESS_SRC; |
315 |
|
|
sa_local.sadb_address_len = |
316 |
|
|
(sizeof(sa_local) + ROUNDUP(slocal.ss_len)) / 8; |
317 |
|
|
|
318 |
|
|
/* peer address */ |
319 |
|
|
bzero(&sa_peer, sizeof(sa_peer)); |
320 |
|
|
sa_peer.sadb_address_exttype = SADB_EXT_ADDRESS_DST; |
321 |
|
|
sa_peer.sadb_address_len = |
322 |
|
|
(sizeof(sa_peer) + ROUNDUP(speer.ss_len)) / 8; |
323 |
|
|
|
324 |
|
|
/* local id */ |
325 |
|
|
sa_srcid = pfkey_id2ident(IKESA_SRCID(flow->flow_ikesa), |
326 |
|
|
SADB_EXT_IDENTITY_SRC); |
327 |
|
|
|
328 |
|
|
/* peer id */ |
329 |
|
|
sa_dstid = pfkey_id2ident(IKESA_DSTID(flow->flow_ikesa), |
330 |
|
|
SADB_EXT_IDENTITY_DST); |
331 |
|
|
} |
332 |
|
|
|
333 |
|
|
iov_cnt = 0; |
334 |
|
|
|
335 |
|
|
/* header */ |
336 |
|
|
iov[iov_cnt].iov_base = &smsg; |
337 |
|
|
iov[iov_cnt].iov_len = sizeof(smsg); |
338 |
|
|
iov_cnt++; |
339 |
|
|
|
340 |
|
|
/* add flow type */ |
341 |
|
|
iov[iov_cnt].iov_base = &sa_flowtype; |
342 |
|
|
iov[iov_cnt].iov_len = sizeof(sa_flowtype); |
343 |
|
|
smsg.sadb_msg_len += sa_flowtype.sadb_protocol_len; |
344 |
|
|
iov_cnt++; |
345 |
|
|
|
346 |
|
|
if (action != SADB_X_DELFLOW && flow->flow_local != NULL) { |
347 |
|
|
#if 0 |
348 |
|
|
/* local ip */ |
349 |
|
|
iov[iov_cnt].iov_base = &sa_local; |
350 |
|
|
iov[iov_cnt].iov_len = sizeof(sa_local); |
351 |
|
|
iov_cnt++; |
352 |
|
|
iov[iov_cnt].iov_base = &slocal; |
353 |
|
|
iov[iov_cnt].iov_len = ROUNDUP(slocal.ss_len); |
354 |
|
|
smsg.sadb_msg_len += sa_local.sadb_address_len; |
355 |
|
|
iov_cnt++; |
356 |
|
|
#endif |
357 |
|
|
|
358 |
|
|
/* remote peer */ |
359 |
|
|
iov[iov_cnt].iov_base = &sa_peer; |
360 |
|
|
iov[iov_cnt].iov_len = sizeof(sa_peer); |
361 |
|
|
iov_cnt++; |
362 |
|
|
iov[iov_cnt].iov_base = &speer; |
363 |
|
|
iov[iov_cnt].iov_len = ROUNDUP(speer.ss_len); |
364 |
|
|
smsg.sadb_msg_len += sa_peer.sadb_address_len; |
365 |
|
|
iov_cnt++; |
366 |
|
|
} |
367 |
|
|
|
368 |
|
|
/* src addr */ |
369 |
|
|
iov[iov_cnt].iov_base = &sa_src; |
370 |
|
|
iov[iov_cnt].iov_len = sizeof(sa_src); |
371 |
|
|
iov_cnt++; |
372 |
|
|
iov[iov_cnt].iov_base = &ssrc; |
373 |
|
|
iov[iov_cnt].iov_len = ROUNDUP(ssrc.ss_len); |
374 |
|
|
smsg.sadb_msg_len += sa_src.sadb_address_len; |
375 |
|
|
iov_cnt++; |
376 |
|
|
|
377 |
|
|
/* src mask */ |
378 |
|
|
iov[iov_cnt].iov_base = &sa_smask; |
379 |
|
|
iov[iov_cnt].iov_len = sizeof(sa_smask); |
380 |
|
|
iov_cnt++; |
381 |
|
|
iov[iov_cnt].iov_base = &smask; |
382 |
|
|
iov[iov_cnt].iov_len = ROUNDUP(smask.ss_len); |
383 |
|
|
smsg.sadb_msg_len += sa_smask.sadb_address_len; |
384 |
|
|
iov_cnt++; |
385 |
|
|
|
386 |
|
|
/* dest addr */ |
387 |
|
|
iov[iov_cnt].iov_base = &sa_dst; |
388 |
|
|
iov[iov_cnt].iov_len = sizeof(sa_dst); |
389 |
|
|
iov_cnt++; |
390 |
|
|
iov[iov_cnt].iov_base = &sdst; |
391 |
|
|
iov[iov_cnt].iov_len = ROUNDUP(sdst.ss_len); |
392 |
|
|
smsg.sadb_msg_len += sa_dst.sadb_address_len; |
393 |
|
|
iov_cnt++; |
394 |
|
|
|
395 |
|
|
/* dst mask */ |
396 |
|
|
iov[iov_cnt].iov_base = &sa_dmask; |
397 |
|
|
iov[iov_cnt].iov_len = sizeof(sa_dmask); |
398 |
|
|
iov_cnt++; |
399 |
|
|
iov[iov_cnt].iov_base = &dmask; |
400 |
|
|
iov[iov_cnt].iov_len = ROUNDUP(dmask.ss_len); |
401 |
|
|
smsg.sadb_msg_len += sa_dmask.sadb_address_len; |
402 |
|
|
iov_cnt++; |
403 |
|
|
|
404 |
|
|
/* add protocol */ |
405 |
|
|
iov[iov_cnt].iov_base = &sa_protocol; |
406 |
|
|
iov[iov_cnt].iov_len = sizeof(sa_protocol); |
407 |
|
|
smsg.sadb_msg_len += sa_protocol.sadb_protocol_len; |
408 |
|
|
iov_cnt++; |
409 |
|
|
|
410 |
|
|
if (sa_srcid) { |
411 |
|
|
/* src identity */ |
412 |
|
|
iov[iov_cnt].iov_base = sa_srcid; |
413 |
|
|
iov[iov_cnt].iov_len = sa_srcid->sadb_ident_len * 8; |
414 |
|
|
smsg.sadb_msg_len += sa_srcid->sadb_ident_len; |
415 |
|
|
iov_cnt++; |
416 |
|
|
} |
417 |
|
|
if (sa_dstid) { |
418 |
|
|
/* dst identity */ |
419 |
|
|
iov[iov_cnt].iov_base = sa_dstid; |
420 |
|
|
iov[iov_cnt].iov_len = sa_dstid->sadb_ident_len * 8; |
421 |
|
|
smsg.sadb_msg_len += sa_dstid->sadb_ident_len; |
422 |
|
|
iov_cnt++; |
423 |
|
|
} |
424 |
|
|
|
425 |
|
|
ret = pfkey_write(sd, &smsg, iov, iov_cnt, NULL, NULL); |
426 |
|
|
|
427 |
|
|
free(sa_srcid); |
428 |
|
|
free(sa_dstid); |
429 |
|
|
|
430 |
|
|
return (ret); |
431 |
|
|
} |
432 |
|
|
|
433 |
|
|
int |
434 |
|
|
pfkey_sa(int sd, uint8_t satype, uint8_t action, struct iked_childsa *sa) |
435 |
|
|
{ |
436 |
|
|
struct sadb_msg smsg; |
437 |
|
|
struct sadb_sa sadb; |
438 |
|
|
struct sadb_address sa_src, sa_dst; |
439 |
|
|
struct sadb_key sa_authkey, sa_enckey; |
440 |
|
|
struct sadb_lifetime sa_ltime_hard, sa_ltime_soft; |
441 |
|
|
struct sadb_x_udpencap udpencap; |
442 |
|
|
struct sadb_x_tag sa_tag; |
443 |
|
|
char *tag = NULL; |
444 |
|
|
struct sadb_x_tap sa_tap; |
445 |
|
|
struct sockaddr_storage ssrc, sdst; |
446 |
|
|
struct sadb_ident *sa_srcid, *sa_dstid; |
447 |
|
|
struct iked_lifetime *lt; |
448 |
|
|
struct iked_policy *pol; |
449 |
|
|
struct iovec iov[IOV_CNT]; |
450 |
|
|
uint32_t jitter; |
451 |
|
|
int iov_cnt; |
452 |
|
|
int ret; |
453 |
|
|
|
454 |
|
|
sa_srcid = sa_dstid = NULL; |
455 |
|
|
|
456 |
|
|
if (sa->csa_ikesa == NULL || sa->csa_ikesa->sa_policy == NULL) { |
457 |
|
|
log_warn("%s: invalid SA and policy", __func__); |
458 |
|
|
return (-1); |
459 |
|
|
} |
460 |
|
|
pol = sa->csa_ikesa->sa_policy; |
461 |
|
|
lt = &pol->pol_lifetime; |
462 |
|
|
|
463 |
|
|
bzero(&ssrc, sizeof(ssrc)); |
464 |
|
|
memcpy(&ssrc, &sa->csa_local->addr, sizeof(ssrc)); |
465 |
|
|
if (socket_af((struct sockaddr *)&ssrc, 0) == -1) { |
466 |
|
|
log_warn("%s: invalid address", __func__); |
467 |
|
|
return (-1); |
468 |
|
|
} |
469 |
|
|
|
470 |
|
|
bzero(&sdst, sizeof(sdst)); |
471 |
|
|
memcpy(&sdst, &sa->csa_peer->addr, sizeof(sdst)); |
472 |
|
|
if (socket_af((struct sockaddr *)&sdst, 0) == -1) { |
473 |
|
|
log_warn("%s: invalid address", __func__); |
474 |
|
|
return (-1); |
475 |
|
|
} |
476 |
|
|
|
477 |
|
|
bzero(&smsg, sizeof(smsg)); |
478 |
|
|
smsg.sadb_msg_version = PF_KEY_V2; |
479 |
|
|
smsg.sadb_msg_seq = ++sadb_msg_seq; |
480 |
|
|
smsg.sadb_msg_pid = getpid(); |
481 |
|
|
smsg.sadb_msg_len = sizeof(smsg) / 8; |
482 |
|
|
smsg.sadb_msg_type = action; |
483 |
|
|
smsg.sadb_msg_satype = satype; |
484 |
|
|
|
485 |
|
|
bzero(&sadb, sizeof(sadb)); |
486 |
|
|
sadb.sadb_sa_len = sizeof(sadb) / 8; |
487 |
|
|
sadb.sadb_sa_exttype = SADB_EXT_SA; |
488 |
|
|
sadb.sadb_sa_spi = htonl(sa->csa_spi.spi); |
489 |
|
|
sadb.sadb_sa_state = SADB_SASTATE_MATURE; |
490 |
|
|
sadb.sadb_sa_replay = 64; |
491 |
|
|
|
492 |
|
|
if (!sa->csa_transport) |
493 |
|
|
sadb.sadb_sa_flags |= SADB_X_SAFLAGS_TUNNEL; |
494 |
|
|
|
495 |
|
|
if (sa->csa_esn) |
496 |
|
|
sadb.sadb_sa_flags |= SADB_X_SAFLAGS_ESN; |
497 |
|
|
|
498 |
|
|
bzero(&sa_src, sizeof(sa_src)); |
499 |
|
|
sa_src.sadb_address_len = (sizeof(sa_src) + ROUNDUP(ssrc.ss_len)) / 8; |
500 |
|
|
sa_src.sadb_address_exttype = SADB_EXT_ADDRESS_SRC; |
501 |
|
|
|
502 |
|
|
bzero(&sa_dst, sizeof(sa_dst)); |
503 |
|
|
sa_dst.sadb_address_len = (sizeof(sa_dst) + ROUNDUP(sdst.ss_len)) / 8; |
504 |
|
|
sa_dst.sadb_address_exttype = SADB_EXT_ADDRESS_DST; |
505 |
|
|
|
506 |
|
|
bzero(&sa_authkey, sizeof(sa_authkey)); |
507 |
|
|
bzero(&sa_enckey, sizeof(sa_enckey)); |
508 |
|
|
bzero(&udpencap, sizeof udpencap); |
509 |
|
|
bzero(&sa_ltime_hard, sizeof(sa_ltime_hard)); |
510 |
|
|
bzero(&sa_ltime_soft, sizeof(sa_ltime_soft)); |
511 |
|
|
|
512 |
|
|
if (action == SADB_DELETE) |
513 |
|
|
goto send; |
514 |
|
|
|
515 |
|
|
if (satype == SADB_SATYPE_ESP && |
516 |
|
|
sa->csa_ikesa->sa_udpencap && sa->csa_ikesa->sa_natt) { |
517 |
|
|
sadb.sadb_sa_flags |= SADB_X_SAFLAGS_UDPENCAP; |
518 |
|
|
udpencap.sadb_x_udpencap_exttype = SADB_X_EXT_UDPENCAP; |
519 |
|
|
udpencap.sadb_x_udpencap_len = sizeof(udpencap) / 8; |
520 |
|
|
udpencap.sadb_x_udpencap_port = |
521 |
|
|
sa->csa_ikesa->sa_peer.addr_port; |
522 |
|
|
|
523 |
|
|
log_debug("%s: udpencap port %d", __func__, |
524 |
|
|
ntohs(udpencap.sadb_x_udpencap_port)); |
525 |
|
|
} |
526 |
|
|
|
527 |
|
|
if ((action == SADB_ADD || action == SADB_UPDATE) && |
528 |
|
|
!sa->csa_persistent && (lt->lt_bytes || lt->lt_seconds)) { |
529 |
|
|
sa_ltime_hard.sadb_lifetime_exttype = SADB_EXT_LIFETIME_HARD; |
530 |
|
|
sa_ltime_hard.sadb_lifetime_len = sizeof(sa_ltime_hard) / 8; |
531 |
|
|
sa_ltime_hard.sadb_lifetime_bytes = lt->lt_bytes; |
532 |
|
|
sa_ltime_hard.sadb_lifetime_addtime = lt->lt_seconds; |
533 |
|
|
|
534 |
|
|
/* double the lifetime for ipcomp; disable byte lifetime */ |
535 |
|
|
if (satype == SADB_X_SATYPE_IPCOMP) { |
536 |
|
|
sa_ltime_hard.sadb_lifetime_addtime *= 2; |
537 |
|
|
sa_ltime_hard.sadb_lifetime_bytes = 0; |
538 |
|
|
} |
539 |
|
|
|
540 |
|
|
sa_ltime_soft.sadb_lifetime_exttype = SADB_EXT_LIFETIME_SOFT; |
541 |
|
|
sa_ltime_soft.sadb_lifetime_len = sizeof(sa_ltime_soft) / 8; |
542 |
|
|
/* set randomly to 85-95% */ |
543 |
|
|
jitter = 850 + arc4random_uniform(100); |
544 |
|
|
sa_ltime_soft.sadb_lifetime_bytes = |
545 |
|
|
(sa_ltime_hard.sadb_lifetime_bytes * jitter) / 1000; |
546 |
|
|
sa_ltime_soft.sadb_lifetime_addtime = |
547 |
|
|
(sa_ltime_hard.sadb_lifetime_addtime * jitter) / 1000; |
548 |
|
|
} |
549 |
|
|
|
550 |
|
|
/* XXX handle NULL encryption or NULL auth or combined encr/auth */ |
551 |
|
|
if (action == SADB_ADD && |
552 |
|
|
!ibuf_length(sa->csa_integrkey) && !ibuf_length(sa->csa_encrkey) && |
553 |
|
|
satype != SADB_X_SATYPE_IPCOMP && satype != SADB_X_SATYPE_IPIP) { |
554 |
|
|
log_warnx("%s: no key specified", __func__); |
555 |
|
|
return (-1); |
556 |
|
|
} |
557 |
|
|
|
558 |
|
|
if (sa->csa_integrid) |
559 |
|
|
if (pfkey_map(pfkey_integr, |
560 |
|
|
sa->csa_integrid, &sadb.sadb_sa_auth) == -1) { |
561 |
|
|
log_warnx("%s: unsupported integrity algorithm %s", |
562 |
|
|
__func__, print_map(sa->csa_integrid, |
563 |
|
|
ikev2_xformauth_map)); |
564 |
|
|
return (-1); |
565 |
|
|
} |
566 |
|
|
|
567 |
|
|
if (sa->csa_encrid) |
568 |
|
|
if (pfkey_map(pfkey_encr, |
569 |
|
|
sa->csa_encrid, &sadb.sadb_sa_encrypt) == -1) { |
570 |
|
|
log_warnx("%s: unsupported encryption algorithm %s", |
571 |
|
|
__func__, print_map(sa->csa_encrid, |
572 |
|
|
ikev2_xformencr_map)); |
573 |
|
|
return (-1); |
574 |
|
|
} |
575 |
|
|
|
576 |
|
|
if (ibuf_length(sa->csa_integrkey)) { |
577 |
|
|
sa_authkey.sadb_key_len = (sizeof(sa_authkey) + |
578 |
|
|
((ibuf_size(sa->csa_integrkey) + 7) / 8) * 8) / 8; |
579 |
|
|
sa_authkey.sadb_key_exttype = SADB_EXT_KEY_AUTH; |
580 |
|
|
sa_authkey.sadb_key_bits = |
581 |
|
|
8 * ibuf_size(sa->csa_integrkey); |
582 |
|
|
} |
583 |
|
|
|
584 |
|
|
if (ibuf_length(sa->csa_encrkey)) { |
585 |
|
|
sa_enckey.sadb_key_len = (sizeof(sa_enckey) + |
586 |
|
|
((ibuf_size(sa->csa_encrkey) + 7) / 8) * 8) / 8; |
587 |
|
|
sa_enckey.sadb_key_exttype = SADB_EXT_KEY_ENCRYPT; |
588 |
|
|
sa_enckey.sadb_key_bits = |
589 |
|
|
8 * ibuf_size(sa->csa_encrkey); |
590 |
|
|
} |
591 |
|
|
|
592 |
|
|
/* we only support deflate */ |
593 |
|
|
if (satype == SADB_X_SATYPE_IPCOMP) |
594 |
|
|
sadb.sadb_sa_encrypt = SADB_X_CALG_DEFLATE; |
595 |
|
|
|
596 |
|
|
/* Note that we need to swap the IDs for incoming SAs (SADB_UPDATE) */ |
597 |
|
|
if (action != SADB_UPDATE) { |
598 |
|
|
sa_srcid = pfkey_id2ident( |
599 |
|
|
IKESA_SRCID(sa->csa_ikesa), SADB_EXT_IDENTITY_SRC); |
600 |
|
|
sa_dstid = pfkey_id2ident( |
601 |
|
|
IKESA_DSTID(sa->csa_ikesa), SADB_EXT_IDENTITY_DST); |
602 |
|
|
} else { |
603 |
|
|
sa_srcid = pfkey_id2ident( |
604 |
|
|
IKESA_DSTID(sa->csa_ikesa), SADB_EXT_IDENTITY_SRC); |
605 |
|
|
sa_dstid = pfkey_id2ident( |
606 |
|
|
IKESA_SRCID(sa->csa_ikesa), SADB_EXT_IDENTITY_DST); |
607 |
|
|
} |
608 |
|
|
|
609 |
|
|
tag = sa->csa_ikesa->sa_tag; |
610 |
|
|
if (tag != NULL && *tag != '\0') { |
611 |
|
|
bzero(&sa_tag, sizeof(sa_tag)); |
612 |
|
|
sa_tag.sadb_x_tag_exttype = SADB_X_EXT_TAG; |
613 |
|
|
sa_tag.sadb_x_tag_len = |
614 |
|
|
(ROUNDUP(strlen(tag) + 1) + sizeof(sa_tag)) / 8; |
615 |
|
|
sa_tag.sadb_x_tag_taglen = strlen(tag) + 1; |
616 |
|
|
} else |
617 |
|
|
tag = NULL; |
618 |
|
|
|
619 |
|
|
if (pol->pol_tap != 0) { |
620 |
|
|
bzero(&sa_tap, sizeof(sa_tap)); |
621 |
|
|
sa_tap.sadb_x_tap_exttype = SADB_X_EXT_TAP; |
622 |
|
|
sa_tap.sadb_x_tap_len = sizeof(sa_tap) / 8; |
623 |
|
|
sa_tap.sadb_x_tap_unit = pol->pol_tap; |
624 |
|
|
} |
625 |
|
|
|
626 |
|
|
send: |
627 |
|
|
iov_cnt = 0; |
628 |
|
|
|
629 |
|
|
/* header */ |
630 |
|
|
iov[iov_cnt].iov_base = &smsg; |
631 |
|
|
iov[iov_cnt].iov_len = sizeof(smsg); |
632 |
|
|
iov_cnt++; |
633 |
|
|
|
634 |
|
|
/* sa */ |
635 |
|
|
iov[iov_cnt].iov_base = &sadb; |
636 |
|
|
iov[iov_cnt].iov_len = sizeof(sadb); |
637 |
|
|
smsg.sadb_msg_len += sadb.sadb_sa_len; |
638 |
|
|
iov_cnt++; |
639 |
|
|
|
640 |
|
|
/* src addr */ |
641 |
|
|
iov[iov_cnt].iov_base = &sa_src; |
642 |
|
|
iov[iov_cnt].iov_len = sizeof(sa_src); |
643 |
|
|
iov_cnt++; |
644 |
|
|
iov[iov_cnt].iov_base = &ssrc; |
645 |
|
|
iov[iov_cnt].iov_len = ROUNDUP(ssrc.ss_len); |
646 |
|
|
smsg.sadb_msg_len += sa_src.sadb_address_len; |
647 |
|
|
iov_cnt++; |
648 |
|
|
|
649 |
|
|
/* dst addr */ |
650 |
|
|
iov[iov_cnt].iov_base = &sa_dst; |
651 |
|
|
iov[iov_cnt].iov_len = sizeof(sa_dst); |
652 |
|
|
iov_cnt++; |
653 |
|
|
iov[iov_cnt].iov_base = &sdst; |
654 |
|
|
iov[iov_cnt].iov_len = ROUNDUP(sdst.ss_len); |
655 |
|
|
smsg.sadb_msg_len += sa_dst.sadb_address_len; |
656 |
|
|
iov_cnt++; |
657 |
|
|
|
658 |
|
|
if (sa_ltime_soft.sadb_lifetime_len) { |
659 |
|
|
/* soft lifetime */ |
660 |
|
|
iov[iov_cnt].iov_base = &sa_ltime_soft; |
661 |
|
|
iov[iov_cnt].iov_len = sizeof(sa_ltime_soft); |
662 |
|
|
smsg.sadb_msg_len += sa_ltime_soft.sadb_lifetime_len; |
663 |
|
|
iov_cnt++; |
664 |
|
|
} |
665 |
|
|
|
666 |
|
|
if (sa_ltime_hard.sadb_lifetime_len) { |
667 |
|
|
/* hard lifetime */ |
668 |
|
|
iov[iov_cnt].iov_base = &sa_ltime_hard; |
669 |
|
|
iov[iov_cnt].iov_len = sizeof(sa_ltime_hard); |
670 |
|
|
smsg.sadb_msg_len += sa_ltime_hard.sadb_lifetime_len; |
671 |
|
|
iov_cnt++; |
672 |
|
|
} |
673 |
|
|
|
674 |
|
|
if (udpencap.sadb_x_udpencap_len) { |
675 |
|
|
iov[iov_cnt].iov_base = &udpencap; |
676 |
|
|
iov[iov_cnt].iov_len = sizeof(udpencap); |
677 |
|
|
smsg.sadb_msg_len += udpencap.sadb_x_udpencap_len; |
678 |
|
|
iov_cnt++; |
679 |
|
|
} |
680 |
|
|
|
681 |
|
|
if (sa_enckey.sadb_key_len) { |
682 |
|
|
/* encryption key */ |
683 |
|
|
iov[iov_cnt].iov_base = &sa_enckey; |
684 |
|
|
iov[iov_cnt].iov_len = sizeof(sa_enckey); |
685 |
|
|
iov_cnt++; |
686 |
|
|
iov[iov_cnt].iov_base = ibuf_data(sa->csa_encrkey); |
687 |
|
|
iov[iov_cnt].iov_len = |
688 |
|
|
((ibuf_size(sa->csa_encrkey) + 7) / 8) * 8; |
689 |
|
|
smsg.sadb_msg_len += sa_enckey.sadb_key_len; |
690 |
|
|
iov_cnt++; |
691 |
|
|
} |
692 |
|
|
if (sa_authkey.sadb_key_len) { |
693 |
|
|
/* authentication key */ |
694 |
|
|
iov[iov_cnt].iov_base = &sa_authkey; |
695 |
|
|
iov[iov_cnt].iov_len = sizeof(sa_authkey); |
696 |
|
|
iov_cnt++; |
697 |
|
|
iov[iov_cnt].iov_base = ibuf_data(sa->csa_integrkey); |
698 |
|
|
iov[iov_cnt].iov_len = |
699 |
|
|
((ibuf_size(sa->csa_integrkey) + 7) / 8) * 8; |
700 |
|
|
smsg.sadb_msg_len += sa_authkey.sadb_key_len; |
701 |
|
|
iov_cnt++; |
702 |
|
|
} |
703 |
|
|
|
704 |
|
|
if (sa_srcid) { |
705 |
|
|
/* src identity */ |
706 |
|
|
iov[iov_cnt].iov_base = sa_srcid; |
707 |
|
|
iov[iov_cnt].iov_len = sa_srcid->sadb_ident_len * 8; |
708 |
|
|
smsg.sadb_msg_len += sa_srcid->sadb_ident_len; |
709 |
|
|
iov_cnt++; |
710 |
|
|
} |
711 |
|
|
if (sa_dstid) { |
712 |
|
|
/* dst identity */ |
713 |
|
|
iov[iov_cnt].iov_base = sa_dstid; |
714 |
|
|
iov[iov_cnt].iov_len = sa_dstid->sadb_ident_len * 8; |
715 |
|
|
smsg.sadb_msg_len += sa_dstid->sadb_ident_len; |
716 |
|
|
iov_cnt++; |
717 |
|
|
} |
718 |
|
|
|
719 |
|
|
if (tag != NULL) { |
720 |
|
|
/* tag identity */ |
721 |
|
|
iov[iov_cnt].iov_base = &sa_tag; |
722 |
|
|
iov[iov_cnt].iov_len = sizeof(sa_tag); |
723 |
|
|
iov_cnt++; |
724 |
|
|
iov[iov_cnt].iov_base = tag; |
725 |
|
|
iov[iov_cnt].iov_len = ROUNDUP(strlen(tag) + 1); |
726 |
|
|
smsg.sadb_msg_len += sa_tag.sadb_x_tag_len; |
727 |
|
|
iov_cnt++; |
728 |
|
|
} |
729 |
|
|
|
730 |
|
|
if (pol->pol_tap != 0) { |
731 |
|
|
/* enc(4) device tap unit */ |
732 |
|
|
iov[iov_cnt].iov_base = &sa_tap; |
733 |
|
|
iov[iov_cnt].iov_len = sizeof(sa_tap); |
734 |
|
|
smsg.sadb_msg_len += sa_tap.sadb_x_tap_len; |
735 |
|
|
iov_cnt++; |
736 |
|
|
} |
737 |
|
|
|
738 |
|
|
ret = pfkey_write(sd, &smsg, iov, iov_cnt, NULL, NULL); |
739 |
|
|
|
740 |
|
|
free(sa_srcid); |
741 |
|
|
free(sa_dstid); |
742 |
|
|
|
743 |
|
|
return ret; |
744 |
|
|
} |
745 |
|
|
|
746 |
|
|
int |
747 |
|
|
pfkey_sa_last_used(int sd, struct iked_childsa *sa, uint64_t *last_used) |
748 |
|
|
{ |
749 |
|
|
struct sadb_msg *msg, smsg; |
750 |
|
|
struct sadb_address sa_src, sa_dst; |
751 |
|
|
struct sadb_sa sadb; |
752 |
|
|
struct sadb_lifetime *sa_life; |
753 |
|
|
struct sockaddr_storage ssrc, sdst; |
754 |
|
|
struct iovec iov[IOV_CNT]; |
755 |
|
|
uint8_t *data; |
756 |
|
|
ssize_t n; |
757 |
|
|
int iov_cnt, ret = -1; |
758 |
|
|
uint8_t satype; |
759 |
|
|
|
760 |
|
|
*last_used = 0; |
761 |
|
|
|
762 |
|
|
if (pfkey_map(pfkey_satype, sa->csa_saproto, &satype) == -1) |
763 |
|
|
return (-1); |
764 |
|
|
|
765 |
|
|
bzero(&ssrc, sizeof(ssrc)); |
766 |
|
|
memcpy(&ssrc, &sa->csa_local->addr, sizeof(ssrc)); |
767 |
|
|
if (socket_af((struct sockaddr *)&ssrc, 0) == -1) { |
768 |
|
|
log_warn("%s: invalid address", __func__); |
769 |
|
|
return (-1); |
770 |
|
|
} |
771 |
|
|
|
772 |
|
|
bzero(&sdst, sizeof(sdst)); |
773 |
|
|
memcpy(&sdst, &sa->csa_peer->addr, sizeof(sdst)); |
774 |
|
|
if (socket_af((struct sockaddr *)&sdst, 0) == -1) { |
775 |
|
|
log_warn("%s: invalid address", __func__); |
776 |
|
|
return (-1); |
777 |
|
|
} |
778 |
|
|
|
779 |
|
|
bzero(&smsg, sizeof(smsg)); |
780 |
|
|
smsg.sadb_msg_version = PF_KEY_V2; |
781 |
|
|
smsg.sadb_msg_seq = ++sadb_msg_seq; |
782 |
|
|
smsg.sadb_msg_pid = getpid(); |
783 |
|
|
smsg.sadb_msg_len = sizeof(smsg) / 8; |
784 |
|
|
smsg.sadb_msg_type = SADB_GET; |
785 |
|
|
smsg.sadb_msg_satype = satype; |
786 |
|
|
|
787 |
|
|
bzero(&sadb, sizeof(sadb)); |
788 |
|
|
sadb.sadb_sa_len = sizeof(sadb) / 8; |
789 |
|
|
sadb.sadb_sa_exttype = SADB_EXT_SA; |
790 |
|
|
sadb.sadb_sa_spi = htonl(sa->csa_spi.spi); |
791 |
|
|
sadb.sadb_sa_state = SADB_SASTATE_MATURE; |
792 |
|
|
sadb.sadb_sa_replay = 64; |
793 |
|
|
|
794 |
|
|
bzero(&sa_src, sizeof(sa_src)); |
795 |
|
|
sa_src.sadb_address_len = (sizeof(sa_src) + ROUNDUP(ssrc.ss_len)) / 8; |
796 |
|
|
sa_src.sadb_address_exttype = SADB_EXT_ADDRESS_SRC; |
797 |
|
|
|
798 |
|
|
bzero(&sa_dst, sizeof(sa_dst)); |
799 |
|
|
sa_dst.sadb_address_len = (sizeof(sa_dst) + ROUNDUP(sdst.ss_len)) / 8; |
800 |
|
|
sa_dst.sadb_address_exttype = SADB_EXT_ADDRESS_DST; |
801 |
|
|
|
802 |
|
|
iov_cnt = 0; |
803 |
|
|
|
804 |
|
|
/* header */ |
805 |
|
|
iov[iov_cnt].iov_base = &smsg; |
806 |
|
|
iov[iov_cnt].iov_len = sizeof(smsg); |
807 |
|
|
iov_cnt++; |
808 |
|
|
|
809 |
|
|
/* sa */ |
810 |
|
|
iov[iov_cnt].iov_base = &sadb; |
811 |
|
|
iov[iov_cnt].iov_len = sizeof(sadb); |
812 |
|
|
smsg.sadb_msg_len += sadb.sadb_sa_len; |
813 |
|
|
iov_cnt++; |
814 |
|
|
|
815 |
|
|
/* src addr */ |
816 |
|
|
iov[iov_cnt].iov_base = &sa_src; |
817 |
|
|
iov[iov_cnt].iov_len = sizeof(sa_src); |
818 |
|
|
iov_cnt++; |
819 |
|
|
iov[iov_cnt].iov_base = &ssrc; |
820 |
|
|
iov[iov_cnt].iov_len = ROUNDUP(ssrc.ss_len); |
821 |
|
|
smsg.sadb_msg_len += sa_src.sadb_address_len; |
822 |
|
|
iov_cnt++; |
823 |
|
|
|
824 |
|
|
/* dst addr */ |
825 |
|
|
iov[iov_cnt].iov_base = &sa_dst; |
826 |
|
|
iov[iov_cnt].iov_len = sizeof(sa_dst); |
827 |
|
|
iov_cnt++; |
828 |
|
|
iov[iov_cnt].iov_base = &sdst; |
829 |
|
|
iov[iov_cnt].iov_len = ROUNDUP(sdst.ss_len); |
830 |
|
|
smsg.sadb_msg_len += sa_dst.sadb_address_len; |
831 |
|
|
iov_cnt++; |
832 |
|
|
|
833 |
|
|
if ((ret = pfkey_write(sd, &smsg, iov, iov_cnt, &data, &n)) != 0) |
834 |
|
|
return (-1); |
835 |
|
|
|
836 |
|
|
msg = (struct sadb_msg *)data; |
837 |
|
|
if (msg->sadb_msg_errno != 0) { |
838 |
|
|
errno = msg->sadb_msg_errno; |
839 |
|
|
ret = -1; |
840 |
|
|
log_warn("%s: message", __func__); |
841 |
|
|
goto done; |
842 |
|
|
} |
843 |
|
|
if ((sa_life = pfkey_find_ext(data, n, SADB_X_EXT_LIFETIME_LASTUSE)) |
844 |
|
|
== NULL) { |
845 |
|
|
/* has never been used */ |
846 |
|
|
ret = -1; |
847 |
|
|
goto done; |
848 |
|
|
} |
849 |
|
|
*last_used = sa_life->sadb_lifetime_usetime; |
850 |
|
|
log_debug("%s: last_used %llu", __func__, *last_used); |
851 |
|
|
|
852 |
|
|
done: |
853 |
|
|
freezero(data, n); |
854 |
|
|
return (ret); |
855 |
|
|
} |
856 |
|
|
|
857 |
|
|
int |
858 |
|
|
pfkey_sa_getspi(int sd, uint8_t satype, struct iked_childsa *sa, |
859 |
|
|
uint32_t *spip) |
860 |
|
|
{ |
861 |
|
|
struct sadb_msg *msg, smsg; |
862 |
|
|
struct sadb_address sa_src, sa_dst; |
863 |
|
|
struct sadb_sa *sa_ext; |
864 |
|
|
struct sadb_spirange sa_spirange; |
865 |
|
|
struct sockaddr_storage ssrc, sdst; |
866 |
|
|
struct iovec iov[IOV_CNT]; |
867 |
|
|
uint8_t *data; |
868 |
|
|
ssize_t n; |
869 |
|
|
int iov_cnt, ret = -1; |
870 |
|
|
|
871 |
|
|
bzero(&ssrc, sizeof(ssrc)); |
872 |
|
|
memcpy(&ssrc, &sa->csa_local->addr, sizeof(ssrc)); |
873 |
|
|
if (socket_af((struct sockaddr *)&ssrc, 0) == -1) { |
874 |
|
|
log_warn("%s: invalid address", __func__); |
875 |
|
|
return (-1); |
876 |
|
|
} |
877 |
|
|
|
878 |
|
|
bzero(&sdst, sizeof(sdst)); |
879 |
|
|
memcpy(&sdst, &sa->csa_peer->addr, sizeof(sdst)); |
880 |
|
|
if (socket_af((struct sockaddr *)&sdst, 0) == -1) { |
881 |
|
|
log_warn("%s: invalid address", __func__); |
882 |
|
|
return (-1); |
883 |
|
|
} |
884 |
|
|
|
885 |
|
|
bzero(&smsg, sizeof(smsg)); |
886 |
|
|
smsg.sadb_msg_version = PF_KEY_V2; |
887 |
|
|
smsg.sadb_msg_seq = ++sadb_msg_seq; |
888 |
|
|
smsg.sadb_msg_pid = getpid(); |
889 |
|
|
smsg.sadb_msg_len = sizeof(smsg) / 8; |
890 |
|
|
smsg.sadb_msg_type = SADB_GETSPI; |
891 |
|
|
smsg.sadb_msg_satype = satype; |
892 |
|
|
|
893 |
|
|
bzero(&sa_spirange, sizeof(sa_spirange)); |
894 |
|
|
sa_spirange.sadb_spirange_exttype = SADB_EXT_SPIRANGE; |
895 |
|
|
sa_spirange.sadb_spirange_len = sizeof(sa_spirange) / 8; |
896 |
|
|
sa_spirange.sadb_spirange_min = 0x100; |
897 |
|
|
sa_spirange.sadb_spirange_max = (satype == SADB_X_SATYPE_IPCOMP) ? |
898 |
|
|
(CPI_PRIVATE_MIN - 1) : 0xffffffff; |
899 |
|
|
sa_spirange.sadb_spirange_reserved = 0; |
900 |
|
|
|
901 |
|
|
bzero(&sa_src, sizeof(sa_src)); |
902 |
|
|
sa_src.sadb_address_len = (sizeof(sa_src) + ROUNDUP(ssrc.ss_len)) / 8; |
903 |
|
|
sa_src.sadb_address_exttype = SADB_EXT_ADDRESS_SRC; |
904 |
|
|
|
905 |
|
|
bzero(&sa_dst, sizeof(sa_dst)); |
906 |
|
|
sa_dst.sadb_address_len = (sizeof(sa_dst) + ROUNDUP(sdst.ss_len)) / 8; |
907 |
|
|
sa_dst.sadb_address_exttype = SADB_EXT_ADDRESS_DST; |
908 |
|
|
|
909 |
|
|
iov_cnt = 0; |
910 |
|
|
|
911 |
|
|
/* header */ |
912 |
|
|
iov[iov_cnt].iov_base = &smsg; |
913 |
|
|
iov[iov_cnt].iov_len = sizeof(smsg); |
914 |
|
|
iov_cnt++; |
915 |
|
|
|
916 |
|
|
/* SPI range */ |
917 |
|
|
iov[iov_cnt].iov_base = &sa_spirange; |
918 |
|
|
iov[iov_cnt].iov_len = sizeof(sa_spirange); |
919 |
|
|
smsg.sadb_msg_len += sa_spirange.sadb_spirange_len; |
920 |
|
|
iov_cnt++; |
921 |
|
|
|
922 |
|
|
/* src addr */ |
923 |
|
|
iov[iov_cnt].iov_base = &sa_src; |
924 |
|
|
iov[iov_cnt].iov_len = sizeof(sa_src); |
925 |
|
|
iov_cnt++; |
926 |
|
|
iov[iov_cnt].iov_base = &ssrc; |
927 |
|
|
iov[iov_cnt].iov_len = ROUNDUP(ssrc.ss_len); |
928 |
|
|
smsg.sadb_msg_len += sa_src.sadb_address_len; |
929 |
|
|
iov_cnt++; |
930 |
|
|
|
931 |
|
|
/* dst addr */ |
932 |
|
|
iov[iov_cnt].iov_base = &sa_dst; |
933 |
|
|
iov[iov_cnt].iov_len = sizeof(sa_dst); |
934 |
|
|
iov_cnt++; |
935 |
|
|
iov[iov_cnt].iov_base = &sdst; |
936 |
|
|
iov[iov_cnt].iov_len = ROUNDUP(sdst.ss_len); |
937 |
|
|
smsg.sadb_msg_len += sa_dst.sadb_address_len; |
938 |
|
|
iov_cnt++; |
939 |
|
|
|
940 |
|
|
*spip = 0; |
941 |
|
|
|
942 |
|
|
if ((ret = pfkey_write(sd, &smsg, iov, iov_cnt, &data, &n)) != 0) |
943 |
|
|
return (-1); |
944 |
|
|
|
945 |
|
|
msg = (struct sadb_msg *)data; |
946 |
|
|
if (msg->sadb_msg_errno != 0) { |
947 |
|
|
errno = msg->sadb_msg_errno; |
948 |
|
|
log_warn("%s: message", __func__); |
949 |
|
|
goto done; |
950 |
|
|
} |
951 |
|
|
if ((sa_ext = pfkey_find_ext(data, n, SADB_EXT_SA)) == NULL) { |
952 |
|
|
log_debug("%s: erronous reply", __func__); |
953 |
|
|
goto done; |
954 |
|
|
} |
955 |
|
|
|
956 |
|
|
*spip = ntohl(sa_ext->sadb_sa_spi); |
957 |
|
|
log_debug("%s: spi 0x%08x", __func__, *spip); |
958 |
|
|
|
959 |
|
|
done: |
960 |
|
|
freezero(data, n); |
961 |
|
|
return (ret); |
962 |
|
|
} |
963 |
|
|
|
964 |
|
|
int |
965 |
|
|
pfkey_sagroup(int sd, uint8_t satype1, uint8_t action, |
966 |
|
|
struct iked_childsa *sa1, struct iked_childsa *sa2) |
967 |
|
|
{ |
968 |
|
|
struct sadb_msg smsg; |
969 |
|
|
struct sadb_sa sadb1, sadb2; |
970 |
|
|
struct sadb_address sa_dst1, sa_dst2; |
971 |
|
|
struct sockaddr_storage sdst1, sdst2; |
972 |
|
|
struct sadb_protocol sa_proto; |
973 |
|
|
struct iovec iov[IOV_CNT]; |
974 |
|
|
int iov_cnt; |
975 |
|
|
uint8_t satype2; |
976 |
|
|
|
977 |
|
|
if (pfkey_map(pfkey_satype, sa2->csa_saproto, &satype2) == -1) |
978 |
|
|
return (-1); |
979 |
|
|
|
980 |
|
|
bzero(&sdst1, sizeof(sdst1)); |
981 |
|
|
memcpy(&sdst1, &sa1->csa_peer->addr, sizeof(sdst1)); |
982 |
|
|
if (socket_af((struct sockaddr *)&sdst1, 0) == -1) { |
983 |
|
|
log_warnx("%s: unsupported address family %d", |
984 |
|
|
__func__, sdst1.ss_family); |
985 |
|
|
return (-1); |
986 |
|
|
} |
987 |
|
|
|
988 |
|
|
bzero(&sdst2, sizeof(sdst2)); |
989 |
|
|
memcpy(&sdst2, &sa2->csa_peer->addr, sizeof(sdst2)); |
990 |
|
|
if (socket_af((struct sockaddr *)&sdst2, 0) == -1) { |
991 |
|
|
log_warnx("%s: unsupported address family %d", |
992 |
|
|
__func__, sdst2.ss_family); |
993 |
|
|
return (-1); |
994 |
|
|
} |
995 |
|
|
|
996 |
|
|
bzero(&smsg, sizeof(smsg)); |
997 |
|
|
smsg.sadb_msg_version = PF_KEY_V2; |
998 |
|
|
smsg.sadb_msg_seq = ++sadb_msg_seq; |
999 |
|
|
smsg.sadb_msg_pid = getpid(); |
1000 |
|
|
smsg.sadb_msg_len = sizeof(smsg) / 8; |
1001 |
|
|
smsg.sadb_msg_type = action; |
1002 |
|
|
smsg.sadb_msg_satype = satype1; |
1003 |
|
|
|
1004 |
|
|
bzero(&sadb1, sizeof(sadb1)); |
1005 |
|
|
sadb1.sadb_sa_len = sizeof(sadb1) / 8; |
1006 |
|
|
sadb1.sadb_sa_exttype = SADB_EXT_SA; |
1007 |
|
|
sadb1.sadb_sa_spi = htonl(sa1->csa_spi.spi); |
1008 |
|
|
sadb1.sadb_sa_state = SADB_SASTATE_MATURE; |
1009 |
|
|
|
1010 |
|
|
bzero(&sadb2, sizeof(sadb2)); |
1011 |
|
|
sadb2.sadb_sa_len = sizeof(sadb2) / 8; |
1012 |
|
|
sadb2.sadb_sa_exttype = SADB_X_EXT_SA2; |
1013 |
|
|
sadb2.sadb_sa_spi = htonl(sa2->csa_spi.spi); |
1014 |
|
|
sadb2.sadb_sa_state = SADB_SASTATE_MATURE; |
1015 |
|
|
iov_cnt = 0; |
1016 |
|
|
|
1017 |
|
|
bzero(&sa_dst1, sizeof(sa_dst1)); |
1018 |
|
|
sa_dst1.sadb_address_exttype = SADB_EXT_ADDRESS_DST; |
1019 |
|
|
sa_dst1.sadb_address_len = |
1020 |
|
|
(sizeof(sa_dst1) + ROUNDUP(sdst1.ss_len)) / 8; |
1021 |
|
|
|
1022 |
|
|
bzero(&sa_dst2, sizeof(sa_dst2)); |
1023 |
|
|
sa_dst2.sadb_address_exttype = SADB_X_EXT_DST2; |
1024 |
|
|
sa_dst2.sadb_address_len = |
1025 |
|
|
(sizeof(sa_dst2) + ROUNDUP(sdst2.ss_len)) / 8; |
1026 |
|
|
|
1027 |
|
|
bzero(&sa_proto, sizeof(sa_proto)); |
1028 |
|
|
sa_proto.sadb_protocol_exttype = SADB_X_EXT_SATYPE2; |
1029 |
|
|
sa_proto.sadb_protocol_len = sizeof(sa_proto) / 8; |
1030 |
|
|
sa_proto.sadb_protocol_direction = 0; |
1031 |
|
|
sa_proto.sadb_protocol_proto = satype2; |
1032 |
|
|
|
1033 |
|
|
/* header */ |
1034 |
|
|
iov[iov_cnt].iov_base = &smsg; |
1035 |
|
|
iov[iov_cnt].iov_len = sizeof(smsg); |
1036 |
|
|
iov_cnt++; |
1037 |
|
|
|
1038 |
|
|
/* sa */ |
1039 |
|
|
iov[iov_cnt].iov_base = &sadb1; |
1040 |
|
|
iov[iov_cnt].iov_len = sizeof(sadb1); |
1041 |
|
|
smsg.sadb_msg_len += sadb1.sadb_sa_len; |
1042 |
|
|
iov_cnt++; |
1043 |
|
|
|
1044 |
|
|
/* dst addr */ |
1045 |
|
|
iov[iov_cnt].iov_base = &sa_dst1; |
1046 |
|
|
iov[iov_cnt].iov_len = sizeof(sa_dst1); |
1047 |
|
|
iov_cnt++; |
1048 |
|
|
iov[iov_cnt].iov_base = &sdst1; |
1049 |
|
|
iov[iov_cnt].iov_len = ROUNDUP(sdst1.ss_len); |
1050 |
|
|
smsg.sadb_msg_len += sa_dst1.sadb_address_len; |
1051 |
|
|
iov_cnt++; |
1052 |
|
|
|
1053 |
|
|
/* second sa */ |
1054 |
|
|
iov[iov_cnt].iov_base = &sadb2; |
1055 |
|
|
iov[iov_cnt].iov_len = sizeof(sadb2); |
1056 |
|
|
smsg.sadb_msg_len += sadb2.sadb_sa_len; |
1057 |
|
|
iov_cnt++; |
1058 |
|
|
|
1059 |
|
|
/* second dst addr */ |
1060 |
|
|
iov[iov_cnt].iov_base = &sa_dst2; |
1061 |
|
|
iov[iov_cnt].iov_len = sizeof(sa_dst2); |
1062 |
|
|
iov_cnt++; |
1063 |
|
|
iov[iov_cnt].iov_base = &sdst2; |
1064 |
|
|
iov[iov_cnt].iov_len = ROUNDUP(sdst2.ss_len); |
1065 |
|
|
smsg.sadb_msg_len += sa_dst2.sadb_address_len; |
1066 |
|
|
iov_cnt++; |
1067 |
|
|
|
1068 |
|
|
/* SA type */ |
1069 |
|
|
iov[iov_cnt].iov_base = &sa_proto; |
1070 |
|
|
iov[iov_cnt].iov_len = sizeof(sa_proto); |
1071 |
|
|
smsg.sadb_msg_len += sa_proto.sadb_protocol_len; |
1072 |
|
|
iov_cnt++; |
1073 |
|
|
|
1074 |
|
|
return (pfkey_write(sd, &smsg, iov, iov_cnt, NULL, NULL)); |
1075 |
|
|
} |
1076 |
|
|
|
1077 |
|
|
int |
1078 |
|
|
pfkey_write(int sd, struct sadb_msg *smsg, struct iovec *iov, int iov_cnt, |
1079 |
|
|
uint8_t **datap, ssize_t *lenp) |
1080 |
|
|
{ |
1081 |
|
|
ssize_t n, len = smsg->sadb_msg_len * 8; |
1082 |
|
|
|
1083 |
|
|
if (sadb_decoupled) { |
1084 |
|
|
switch (smsg->sadb_msg_type) { |
1085 |
|
|
case SADB_GETSPI: |
1086 |
|
|
/* we need to get a new SPI from the kernel */ |
1087 |
|
|
break; |
1088 |
|
|
default: |
1089 |
|
|
if (datap || lenp) { |
1090 |
|
|
log_warnx("%s: pfkey not coupled", __func__); |
1091 |
|
|
return (-1); |
1092 |
|
|
} |
1093 |
|
|
/* ignore request */ |
1094 |
|
|
return (0); |
1095 |
|
|
} |
1096 |
|
|
} |
1097 |
|
|
|
1098 |
|
|
if ((n = writev(sd, iov, iov_cnt)) == -1) { |
1099 |
|
|
log_warn("%s: writev failed", __func__); |
1100 |
|
|
return (-1); |
1101 |
|
|
} else if (n != len) { |
1102 |
|
|
log_warn("%s: short write", __func__); |
1103 |
|
|
return (-1); |
1104 |
|
|
} |
1105 |
|
|
|
1106 |
|
|
return (pfkey_reply(sd, datap, lenp)); |
1107 |
|
|
} |
1108 |
|
|
|
1109 |
|
|
int |
1110 |
|
|
pfkey_reply(int sd, uint8_t **datap, ssize_t *lenp) |
1111 |
|
|
{ |
1112 |
|
|
struct pfkey_message *pm; |
1113 |
|
|
struct sadb_msg hdr; |
1114 |
|
|
ssize_t len; |
1115 |
|
|
uint8_t *data; |
1116 |
|
|
struct pollfd pfd[1]; |
1117 |
|
|
int n; |
1118 |
|
|
|
1119 |
|
|
pfd[0].fd = sd; |
1120 |
|
|
pfd[0].events = POLLIN; |
1121 |
|
|
|
1122 |
|
|
for (;;) { |
1123 |
|
|
/* |
1124 |
|
|
* We should actually expect the reply to get lost |
1125 |
|
|
* as PF_KEY is an unreliable service per the specs. |
1126 |
|
|
* Currently we do this by setting a short timeout, |
1127 |
|
|
* and if it is not readable in that time, we fail |
1128 |
|
|
* the read. |
1129 |
|
|
*/ |
1130 |
|
|
n = poll(pfd, 1, PFKEY_REPLY_TIMEOUT / 1000); |
1131 |
|
|
if (n == -1) { |
1132 |
|
|
log_warn("%s: poll() failed", __func__); |
1133 |
|
|
return (-1); |
1134 |
|
|
} |
1135 |
|
|
if (n == 0) { |
1136 |
|
|
log_warnx("%s: no reply from PF_KEY", __func__); |
1137 |
|
|
return (-1); |
1138 |
|
|
} |
1139 |
|
|
|
1140 |
|
|
if (recv(sd, &hdr, sizeof(hdr), MSG_PEEK) != sizeof(hdr)) { |
1141 |
|
|
log_warn("%s: short recv", __func__); |
1142 |
|
|
return (-1); |
1143 |
|
|
} |
1144 |
|
|
|
1145 |
|
|
if (hdr.sadb_msg_version != PF_KEY_V2) { |
1146 |
|
|
log_warnx("%s: wrong pfkey version", __func__); |
1147 |
|
|
return (-1); |
1148 |
|
|
} |
1149 |
|
|
|
1150 |
|
|
if ((data = reallocarray(NULL, hdr.sadb_msg_len, |
1151 |
|
|
PFKEYV2_CHUNK)) == NULL) { |
1152 |
|
|
log_warn("%s: malloc", __func__); |
1153 |
|
|
return (-1); |
1154 |
|
|
} |
1155 |
|
|
len = hdr.sadb_msg_len * PFKEYV2_CHUNK; |
1156 |
|
|
|
1157 |
|
|
if (read(sd, data, len) != len) { |
1158 |
|
|
log_warnx("%s: short read", __func__); |
1159 |
|
|
free(data); |
1160 |
|
|
return (-1); |
1161 |
|
|
} |
1162 |
|
|
|
1163 |
|
|
/* XXX: Only one message can be outstanding. */ |
1164 |
|
|
if (hdr.sadb_msg_seq == sadb_msg_seq && |
1165 |
|
|
hdr.sadb_msg_pid == (uint32_t)getpid()) |
1166 |
|
|
break; |
1167 |
|
|
|
1168 |
|
|
/* ignore messages for other processes */ |
1169 |
|
|
if (hdr.sadb_msg_pid != 0 && |
1170 |
|
|
hdr.sadb_msg_pid != (uint32_t)getpid()) { |
1171 |
|
|
free(data); |
1172 |
|
|
continue; |
1173 |
|
|
} |
1174 |
|
|
|
1175 |
|
|
/* not the reply, enqueue */ |
1176 |
|
|
if ((pm = malloc(sizeof(*pm))) == NULL) { |
1177 |
|
|
log_warn("%s: malloc", __func__); |
1178 |
|
|
free(data); |
1179 |
|
|
return (-1); |
1180 |
|
|
} |
1181 |
|
|
pm->pm_data = data; |
1182 |
|
|
pm->pm_length = len; |
1183 |
|
|
SIMPLEQ_INSERT_TAIL(&pfkey_postponed, pm, pm_entry); |
1184 |
|
|
evtimer_add(&pfkey_timer_ev, &pfkey_timer_tv); |
1185 |
|
|
} |
1186 |
|
|
|
1187 |
|
|
if (datap) { |
1188 |
|
|
*datap = data; |
1189 |
|
|
if (lenp) |
1190 |
|
|
*lenp = len; |
1191 |
|
|
} else |
1192 |
|
|
free(data); |
1193 |
|
|
|
1194 |
|
|
if (datap == NULL && hdr.sadb_msg_errno != 0) { |
1195 |
|
|
errno = hdr.sadb_msg_errno; |
1196 |
|
|
if (errno != EEXIST) { |
1197 |
|
|
log_warn("%s: message", __func__); |
1198 |
|
|
return (-1); |
1199 |
|
|
} |
1200 |
|
|
} |
1201 |
|
|
return (0); |
1202 |
|
|
} |
1203 |
|
|
|
1204 |
|
|
int |
1205 |
|
|
pfkey_flow_add(int fd, struct iked_flow *flow) |
1206 |
|
|
{ |
1207 |
|
|
uint8_t satype; |
1208 |
|
|
|
1209 |
|
|
if (flow->flow_loaded) |
1210 |
|
|
return (0); |
1211 |
|
|
|
1212 |
|
|
if (pfkey_map(pfkey_satype, flow->flow_saproto, &satype) == -1) |
1213 |
|
|
return (-1); |
1214 |
|
|
|
1215 |
|
|
if (pfkey_flow(fd, satype, SADB_X_ADDFLOW, flow) == -1) |
1216 |
|
|
return (-1); |
1217 |
|
|
|
1218 |
|
|
flow->flow_loaded = 1; |
1219 |
|
|
|
1220 |
|
|
if (flow->flow_dst.addr_af == AF_INET6) { |
1221 |
|
|
sadb_ipv6refcnt++; |
1222 |
|
|
if (sadb_ipv6refcnt == 1) |
1223 |
|
|
return (pfkey_block(fd, AF_INET6, SADB_X_DELFLOW)); |
1224 |
|
|
} |
1225 |
|
|
|
1226 |
|
|
return (0); |
1227 |
|
|
} |
1228 |
|
|
|
1229 |
|
|
int |
1230 |
|
|
pfkey_flow_delete(int fd, struct iked_flow *flow) |
1231 |
|
|
{ |
1232 |
|
|
uint8_t satype; |
1233 |
|
|
|
1234 |
|
|
if (!flow->flow_loaded) |
1235 |
|
|
return (0); |
1236 |
|
|
|
1237 |
|
|
if (pfkey_map(pfkey_satype, flow->flow_saproto, &satype) == -1) |
1238 |
|
|
return (-1); |
1239 |
|
|
|
1240 |
|
|
if (pfkey_flow(fd, satype, SADB_X_DELFLOW, flow) == -1) |
1241 |
|
|
return (-1); |
1242 |
|
|
|
1243 |
|
|
flow->flow_loaded = 0; |
1244 |
|
|
|
1245 |
|
|
if (flow->flow_dst.addr_af == AF_INET6) { |
1246 |
|
|
sadb_ipv6refcnt--; |
1247 |
|
|
if (sadb_ipv6refcnt == 0) |
1248 |
|
|
return (pfkey_block(fd, AF_INET6, SADB_X_ADDFLOW)); |
1249 |
|
|
} |
1250 |
|
|
|
1251 |
|
|
return (0); |
1252 |
|
|
} |
1253 |
|
|
|
1254 |
|
|
int |
1255 |
|
|
pfkey_block(int fd, int af, unsigned int action) |
1256 |
|
|
{ |
1257 |
|
|
struct iked_flow flow; |
1258 |
|
|
|
1259 |
|
|
if (!pfkey_blockipv6) |
1260 |
|
|
return (0); |
1261 |
|
|
|
1262 |
|
|
/* |
1263 |
|
|
* Prevent VPN traffic leakages in dual-stack hosts/networks. |
1264 |
|
|
* https://tools.ietf.org/html/draft-gont-opsec-vpn-leakages. |
1265 |
|
|
* We forcibly block IPv6 traffic unless it is used in any of |
1266 |
|
|
* the flows by tracking a sadb_ipv6refcnt reference counter. |
1267 |
|
|
*/ |
1268 |
|
|
bzero(&flow, sizeof(flow)); |
1269 |
|
|
flow.flow_src.addr_af = flow.flow_src.addr.ss_family = af; |
1270 |
|
|
flow.flow_src.addr_net = 1; |
1271 |
|
|
socket_af((struct sockaddr *)&flow.flow_src.addr, 0); |
1272 |
|
|
flow.flow_dst.addr_af = flow.flow_dst.addr.ss_family = af; |
1273 |
|
|
flow.flow_dst.addr_net = 1; |
1274 |
|
|
socket_af((struct sockaddr *)&flow.flow_dst.addr, 0); |
1275 |
|
|
flow.flow_type = SADB_X_FLOW_TYPE_DENY; |
1276 |
|
|
flow.flow_dir = IPSP_DIRECTION_OUT; |
1277 |
|
|
|
1278 |
|
|
if (pfkey_flow(fd, 0, action, &flow) == -1) |
1279 |
|
|
return (-1); |
1280 |
|
|
|
1281 |
|
|
return (0); |
1282 |
|
|
} |
1283 |
|
|
|
1284 |
|
|
int |
1285 |
|
|
pfkey_sa_init(int fd, struct iked_childsa *sa, uint32_t *spi) |
1286 |
|
|
{ |
1287 |
|
|
uint8_t satype; |
1288 |
|
|
|
1289 |
|
|
if (pfkey_map(pfkey_satype, sa->csa_saproto, &satype) == -1) |
1290 |
|
|
return (-1); |
1291 |
|
|
|
1292 |
|
|
if (pfkey_sa_getspi(fd, satype, sa, spi) == -1) |
1293 |
|
|
return (-1); |
1294 |
|
|
|
1295 |
|
|
log_debug("%s: new spi 0x%08x", __func__, *spi); |
1296 |
|
|
|
1297 |
|
|
return (0); |
1298 |
|
|
} |
1299 |
|
|
|
1300 |
|
|
int |
1301 |
|
|
pfkey_sa_add(int fd, struct iked_childsa *sa, struct iked_childsa *last) |
1302 |
|
|
{ |
1303 |
|
|
uint8_t satype; |
1304 |
|
|
unsigned int cmd; |
1305 |
|
|
|
1306 |
|
|
if (pfkey_map(pfkey_satype, sa->csa_saproto, &satype) == -1) |
1307 |
|
|
return (-1); |
1308 |
|
|
|
1309 |
|
|
if (sa->csa_allocated || sa->csa_loaded) |
1310 |
|
|
cmd = SADB_UPDATE; |
1311 |
|
|
else |
1312 |
|
|
cmd = SADB_ADD; |
1313 |
|
|
|
1314 |
|
|
log_debug("%s: %s spi %s", __func__, cmd == SADB_ADD ? "add": "update", |
1315 |
|
|
print_spi(sa->csa_spi.spi, 4)); |
1316 |
|
|
|
1317 |
|
|
if (pfkey_sa(fd, satype, cmd, sa) == -1) { |
1318 |
|
|
if (cmd == SADB_ADD) { |
1319 |
|
|
(void)pfkey_sa_delete(fd, sa); |
1320 |
|
|
return (-1); |
1321 |
|
|
} |
1322 |
|
|
if (sa->csa_allocated && !sa->csa_loaded && errno == ESRCH) { |
1323 |
|
|
/* Needed for recoupling local SAs */ |
1324 |
|
|
log_debug("%s: SADB_UPDATE on local SA returned ESRCH," |
1325 |
|
|
" trying SADB_ADD", __func__); |
1326 |
|
|
if (pfkey_sa(fd, satype, SADB_ADD, sa) == -1) |
1327 |
|
|
return (-1); |
1328 |
|
|
} else { |
1329 |
|
|
return (-1); |
1330 |
|
|
} |
1331 |
|
|
} |
1332 |
|
|
|
1333 |
|
|
if (last && cmd == SADB_ADD) { |
1334 |
|
|
if (pfkey_sagroup(fd, satype, |
1335 |
|
|
SADB_X_GRPSPIS, sa, last) == -1) { |
1336 |
|
|
(void)pfkey_sa_delete(fd, sa); |
1337 |
|
|
return (-1); |
1338 |
|
|
} |
1339 |
|
|
} |
1340 |
|
|
|
1341 |
|
|
sa->csa_loaded = 1; |
1342 |
|
|
return (0); |
1343 |
|
|
} |
1344 |
|
|
|
1345 |
|
|
int |
1346 |
|
|
pfkey_sa_delete(int fd, struct iked_childsa *sa) |
1347 |
|
|
{ |
1348 |
|
|
uint8_t satype; |
1349 |
|
|
|
1350 |
|
|
if (!sa->csa_loaded || sa->csa_spi.spi == 0) |
1351 |
|
|
return (0); |
1352 |
|
|
|
1353 |
|
|
if (pfkey_map(pfkey_satype, sa->csa_saproto, &satype) == -1) |
1354 |
|
|
return (-1); |
1355 |
|
|
|
1356 |
|
|
if (pfkey_sa(fd, satype, SADB_DELETE, sa) == -1) |
1357 |
|
|
return (-1); |
1358 |
|
|
|
1359 |
|
|
sa->csa_loaded = 0; |
1360 |
|
|
return (0); |
1361 |
|
|
} |
1362 |
|
|
|
1363 |
|
|
int |
1364 |
|
|
pfkey_flush(int sd) |
1365 |
|
|
{ |
1366 |
|
|
struct sadb_msg smsg; |
1367 |
|
|
struct iovec iov[IOV_CNT]; |
1368 |
|
|
int iov_cnt; |
1369 |
|
|
|
1370 |
|
|
bzero(&smsg, sizeof(smsg)); |
1371 |
|
|
smsg.sadb_msg_version = PF_KEY_V2; |
1372 |
|
|
smsg.sadb_msg_seq = ++sadb_msg_seq; |
1373 |
|
|
smsg.sadb_msg_pid = getpid(); |
1374 |
|
|
smsg.sadb_msg_len = sizeof(smsg) / 8; |
1375 |
|
|
smsg.sadb_msg_type = SADB_FLUSH; |
1376 |
|
|
smsg.sadb_msg_satype = SADB_SATYPE_UNSPEC; |
1377 |
|
|
|
1378 |
|
|
iov_cnt = 0; |
1379 |
|
|
|
1380 |
|
|
iov[iov_cnt].iov_base = &smsg; |
1381 |
|
|
iov[iov_cnt].iov_len = sizeof(smsg); |
1382 |
|
|
iov_cnt++; |
1383 |
|
|
|
1384 |
|
|
return (pfkey_write(sd, &smsg, iov, iov_cnt, NULL, NULL)); |
1385 |
|
|
} |
1386 |
|
|
|
1387 |
|
|
struct sadb_ident * |
1388 |
|
|
pfkey_id2ident(struct iked_id *id, unsigned int exttype) |
1389 |
|
|
{ |
1390 |
|
|
char idstr[IKED_ID_SIZE]; |
1391 |
|
|
unsigned int type; |
1392 |
|
|
size_t len; |
1393 |
|
|
struct sadb_ident *sa_id; |
1394 |
|
|
|
1395 |
|
|
switch (id->id_type) { |
1396 |
|
|
case IKEV2_ID_FQDN: |
1397 |
|
|
type = SADB_IDENTTYPE_FQDN; |
1398 |
|
|
break; |
1399 |
|
|
case IKEV2_ID_UFQDN: |
1400 |
|
|
type = SADB_IDENTTYPE_USERFQDN; |
1401 |
|
|
break; |
1402 |
|
|
case IKEV2_ID_IPV4: |
1403 |
|
|
case IKEV2_ID_IPV6: |
1404 |
|
|
type = SADB_IDENTTYPE_PREFIX; |
1405 |
|
|
break; |
1406 |
|
|
case IKEV2_ID_ASN1_DN: |
1407 |
|
|
case IKEV2_ID_ASN1_GN: |
1408 |
|
|
case IKEV2_ID_KEY_ID: |
1409 |
|
|
case IKEV2_ID_NONE: |
1410 |
|
|
default: |
1411 |
|
|
/* XXX not implemented/supported by PFKEY */ |
1412 |
|
|
return (NULL); |
1413 |
|
|
} |
1414 |
|
|
|
1415 |
|
|
bzero(&idstr, sizeof(idstr)); |
1416 |
|
|
|
1417 |
|
|
if (ikev2_print_id(id, idstr, sizeof(idstr)) == -1) |
1418 |
|
|
return (NULL); |
1419 |
|
|
|
1420 |
|
|
len = ROUNDUP(strlen(idstr) + 1) + sizeof(*sa_id); |
1421 |
|
|
if ((sa_id = calloc(1, len)) == NULL) |
1422 |
|
|
return (NULL); |
1423 |
|
|
|
1424 |
|
|
strlcpy((char *)(sa_id + 1), idstr, ROUNDUP(strlen(idstr) + 1)); |
1425 |
|
|
sa_id->sadb_ident_type = type; |
1426 |
|
|
sa_id->sadb_ident_len = len / 8; |
1427 |
|
|
sa_id->sadb_ident_exttype = exttype; |
1428 |
|
|
|
1429 |
|
|
return (sa_id); |
1430 |
|
|
} |
1431 |
|
|
|
1432 |
|
|
int |
1433 |
|
|
pfkey_socket(void) |
1434 |
|
|
{ |
1435 |
|
|
int fd; |
1436 |
|
|
|
1437 |
|
|
if (privsep_process != PROC_PARENT) |
1438 |
|
|
fatal("pfkey_socket: called from unprivileged process"); |
1439 |
|
|
|
1440 |
|
|
if ((fd = socket(PF_KEY, SOCK_RAW, PF_KEY_V2)) == -1) |
1441 |
|
|
fatal("pfkey_socket: failed to open PF_KEY socket"); |
1442 |
|
|
|
1443 |
|
|
pfkey_flush(fd); |
1444 |
|
|
|
1445 |
|
|
return (fd); |
1446 |
|
|
} |
1447 |
|
|
|
1448 |
|
|
void |
1449 |
|
|
pfkey_init(struct iked *env, int fd) |
1450 |
|
|
{ |
1451 |
|
|
struct sadb_msg smsg; |
1452 |
|
|
struct iovec iov; |
1453 |
|
|
|
1454 |
|
|
/* Set up a timer to process messages deferred by the pfkey_reply */ |
1455 |
|
|
pfkey_timer_tv.tv_sec = 1; |
1456 |
|
|
pfkey_timer_tv.tv_usec = 0; |
1457 |
|
|
evtimer_set(&pfkey_timer_ev, pfkey_timer_cb, env); |
1458 |
|
|
|
1459 |
|
|
/* Register the pfkey socket event handler */ |
1460 |
|
|
env->sc_pfkey = fd; |
1461 |
|
|
event_set(&env->sc_pfkeyev, env->sc_pfkey, |
1462 |
|
|
EV_READ|EV_PERSIST, pfkey_dispatch, env); |
1463 |
|
|
event_add(&env->sc_pfkeyev, NULL); |
1464 |
|
|
|
1465 |
|
|
/* Register it to get ESP and AH acquires from the kernel */ |
1466 |
|
|
bzero(&smsg, sizeof(smsg)); |
1467 |
|
|
smsg.sadb_msg_version = PF_KEY_V2; |
1468 |
|
|
smsg.sadb_msg_seq = ++sadb_msg_seq; |
1469 |
|
|
smsg.sadb_msg_pid = getpid(); |
1470 |
|
|
smsg.sadb_msg_len = sizeof(smsg) / 8; |
1471 |
|
|
smsg.sadb_msg_type = SADB_REGISTER; |
1472 |
|
|
smsg.sadb_msg_satype = SADB_SATYPE_ESP; |
1473 |
|
|
|
1474 |
|
|
iov.iov_base = &smsg; |
1475 |
|
|
iov.iov_len = sizeof(smsg); |
1476 |
|
|
|
1477 |
|
|
if (pfkey_write(fd, &smsg, &iov, 1, NULL, NULL)) |
1478 |
|
|
fatal("pfkey_init: failed to set up ESP acquires"); |
1479 |
|
|
|
1480 |
|
|
bzero(&smsg, sizeof(smsg)); |
1481 |
|
|
smsg.sadb_msg_version = PF_KEY_V2; |
1482 |
|
|
smsg.sadb_msg_seq = ++sadb_msg_seq; |
1483 |
|
|
smsg.sadb_msg_pid = getpid(); |
1484 |
|
|
smsg.sadb_msg_len = sizeof(smsg) / 8; |
1485 |
|
|
smsg.sadb_msg_type = SADB_REGISTER; |
1486 |
|
|
smsg.sadb_msg_satype = SADB_SATYPE_AH; |
1487 |
|
|
|
1488 |
|
|
iov.iov_base = &smsg; |
1489 |
|
|
iov.iov_len = sizeof(smsg); |
1490 |
|
|
|
1491 |
|
|
if (pfkey_write(fd, &smsg, &iov, 1, NULL, NULL)) |
1492 |
|
|
fatal("pfkey_init: failed to set up AH acquires"); |
1493 |
|
|
|
1494 |
|
|
if (env->sc_opts & IKED_OPT_NOIPV6BLOCKING) |
1495 |
|
|
return; |
1496 |
|
|
|
1497 |
|
|
/* Block all IPv6 traffic by default */ |
1498 |
|
|
pfkey_blockipv6 = 1; |
1499 |
|
|
if (pfkey_block(fd, AF_INET6, SADB_X_ADDFLOW)) |
1500 |
|
|
fatal("pfkey_init: failed to block IPv6 traffic"); |
1501 |
|
|
} |
1502 |
|
|
|
1503 |
|
|
void * |
1504 |
|
|
pfkey_find_ext(uint8_t *data, ssize_t len, int type) |
1505 |
|
|
{ |
1506 |
|
|
struct sadb_ext *ext = (struct sadb_ext *)(data + |
1507 |
|
|
sizeof(struct sadb_msg)); |
1508 |
|
|
|
1509 |
|
|
while (ext && ((uint8_t *)ext - data < len)) { |
1510 |
|
|
if (ext->sadb_ext_type == type) |
1511 |
|
|
return (ext); |
1512 |
|
|
ext = (struct sadb_ext *)((uint8_t *)ext + |
1513 |
|
|
ext->sadb_ext_len * PFKEYV2_CHUNK); |
1514 |
|
|
} |
1515 |
|
|
|
1516 |
|
|
return (NULL); |
1517 |
|
|
} |
1518 |
|
|
|
1519 |
|
|
void |
1520 |
|
|
pfkey_dispatch(int sd, short event, void *arg) |
1521 |
|
|
{ |
1522 |
|
|
struct iked *env = (struct iked *)arg; |
1523 |
|
|
struct pfkey_message pm, *pmp; |
1524 |
|
|
struct sadb_msg hdr; |
1525 |
|
|
ssize_t len; |
1526 |
|
|
uint8_t *data; |
1527 |
|
|
|
1528 |
|
|
if (recv(sd, &hdr, sizeof(hdr), MSG_PEEK) != sizeof(hdr)) { |
1529 |
|
|
log_warn("%s: short recv", __func__); |
1530 |
|
|
return; |
1531 |
|
|
} |
1532 |
|
|
|
1533 |
|
|
if (hdr.sadb_msg_version != PF_KEY_V2) { |
1534 |
|
|
log_warnx("%s: wrong pfkey version", __func__); |
1535 |
|
|
return; |
1536 |
|
|
} |
1537 |
|
|
|
1538 |
|
|
if ((data = reallocarray(NULL, hdr.sadb_msg_len, PFKEYV2_CHUNK)) |
1539 |
|
|
== NULL) { |
1540 |
|
|
log_warn("%s: malloc", __func__); |
1541 |
|
|
return; |
1542 |
|
|
} |
1543 |
|
|
len = hdr.sadb_msg_len * PFKEYV2_CHUNK; |
1544 |
|
|
|
1545 |
|
|
if (read(sd, data, len) != len) { |
1546 |
|
|
log_warn("%s: short read", __func__); |
1547 |
|
|
free(data); |
1548 |
|
|
return; |
1549 |
|
|
} |
1550 |
|
|
|
1551 |
|
|
/* Try postponed requests first, so we do in-order processing */ |
1552 |
|
|
if (!SIMPLEQ_EMPTY(&pfkey_postponed)) |
1553 |
|
|
pfkey_timer_cb(0, 0, env); |
1554 |
|
|
|
1555 |
|
|
pm.pm_data = data; |
1556 |
|
|
pm.pm_length = len; |
1557 |
|
|
|
1558 |
|
|
if (pfkey_process(env, &pm) == -1 && |
1559 |
|
|
(pmp = calloc(1, sizeof(*pmp))) != NULL) { |
1560 |
|
|
pmp->pm_data = data; |
1561 |
|
|
pmp->pm_length = len; |
1562 |
|
|
log_debug("%s: pfkey_process is busy, retry later", __func__); |
1563 |
|
|
SIMPLEQ_INSERT_TAIL(&pfkey_postponed, pmp, pm_entry); |
1564 |
|
|
evtimer_add(&pfkey_timer_ev, &pfkey_timer_tv); |
1565 |
|
|
} else { |
1566 |
|
|
free(data); |
1567 |
|
|
} |
1568 |
|
|
} |
1569 |
|
|
|
1570 |
|
|
void |
1571 |
|
|
pfkey_timer_cb(int unused, short event, void *arg) |
1572 |
|
|
{ |
1573 |
|
|
struct iked *env = arg; |
1574 |
|
|
struct pfkey_message *pm; |
1575 |
|
|
|
1576 |
|
|
SIMPLEQ_INIT(&pfkey_retry); |
1577 |
|
|
while (!SIMPLEQ_EMPTY(&pfkey_postponed)) { |
1578 |
|
|
pm = SIMPLEQ_FIRST(&pfkey_postponed); |
1579 |
|
|
SIMPLEQ_REMOVE_HEAD(&pfkey_postponed, pm_entry); |
1580 |
|
|
if (pfkey_process(env, pm) == -1) { |
1581 |
|
|
log_debug("%s: pfkey_process is busy, retry later", |
1582 |
|
|
__func__); |
1583 |
|
|
SIMPLEQ_INSERT_TAIL(&pfkey_retry, pm, pm_entry); |
1584 |
|
|
} else { |
1585 |
|
|
free(pm->pm_data); |
1586 |
|
|
free(pm); |
1587 |
|
|
} |
1588 |
|
|
} |
1589 |
|
|
/* move from retry to postponed */ |
1590 |
|
|
while ((pm = SIMPLEQ_FIRST(&pfkey_retry)) != NULL) { |
1591 |
|
|
SIMPLEQ_REMOVE_HEAD(&pfkey_retry, pm_entry); |
1592 |
|
|
SIMPLEQ_INSERT_TAIL(&pfkey_postponed, pm, pm_entry); |
1593 |
|
|
} |
1594 |
|
|
if (!SIMPLEQ_EMPTY(&pfkey_postponed)) |
1595 |
|
|
evtimer_add(&pfkey_timer_ev, &pfkey_timer_tv); |
1596 |
|
|
} |
1597 |
|
|
|
1598 |
|
|
/* |
1599 |
|
|
* pfkey_process returns 0 if the message has been processed and -1 if |
1600 |
|
|
* the system is busy and the message should be passed again, later. |
1601 |
|
|
*/ |
1602 |
|
|
int |
1603 |
|
|
pfkey_process(struct iked *env, struct pfkey_message *pm) |
1604 |
|
|
{ |
1605 |
|
|
struct iked_spi spi; |
1606 |
|
|
struct sadb_sa *sa; |
1607 |
|
|
struct sadb_lifetime *sa_ltime; |
1608 |
|
|
struct sadb_msg *hdr; |
1609 |
|
|
struct sadb_msg smsg; |
1610 |
|
|
struct iked_addr peer; |
1611 |
|
|
struct iked_flow flow; |
1612 |
|
|
struct sadb_address *sa_addr; |
1613 |
|
|
struct sadb_protocol *sa_proto; |
1614 |
|
|
struct sadb_x_policy sa_pol; |
1615 |
|
|
struct sockaddr *ssrc, *sdst, *smask, *dmask, *speer; |
1616 |
|
|
struct iovec iov[IOV_CNT]; |
1617 |
|
|
int ret = 0, iov_cnt, sd; |
1618 |
|
|
uint8_t *reply; |
1619 |
|
|
ssize_t rlen; |
1620 |
|
|
const char *errmsg = NULL; |
1621 |
|
|
uint8_t *data = pm->pm_data; |
1622 |
|
|
ssize_t len = pm->pm_length; |
1623 |
|
|
size_t slen; |
1624 |
|
|
|
1625 |
|
|
if (!env || !data || !len) |
1626 |
|
|
return (0); |
1627 |
|
|
|
1628 |
|
|
sd = env->sc_pfkey; |
1629 |
|
|
hdr = (struct sadb_msg *)data; |
1630 |
|
|
|
1631 |
|
|
switch (hdr->sadb_msg_type) { |
1632 |
|
|
case SADB_ACQUIRE: |
1633 |
|
|
bzero(&flow, sizeof(flow)); |
1634 |
|
|
bzero(&peer, sizeof(peer)); |
1635 |
|
|
|
1636 |
|
|
if ((sa_addr = pfkey_find_ext(data, len, |
1637 |
|
|
SADB_EXT_ADDRESS_DST)) == NULL) { |
1638 |
|
|
log_debug("%s: no peer address", __func__); |
1639 |
|
|
return (0); |
1640 |
|
|
} |
1641 |
|
|
speer = (struct sockaddr *)(sa_addr + 1); |
1642 |
|
|
peer.addr_af = speer->sa_family; |
1643 |
|
|
peer.addr_port = htons(socket_getport(speer)); |
1644 |
|
|
if ((slen = speer->sa_len) > sizeof(peer.addr)) { |
1645 |
|
|
log_debug("%s: invalid peer address len", __func__); |
1646 |
|
|
return (0); |
1647 |
|
|
} |
1648 |
|
|
memcpy(&peer.addr, speer, slen); |
1649 |
|
|
if (socket_af((struct sockaddr *)&peer.addr, |
1650 |
|
|
peer.addr_port) == -1) { |
1651 |
|
|
log_debug("%s: invalid address", __func__); |
1652 |
|
|
return (0); |
1653 |
|
|
} |
1654 |
|
|
flow.flow_peer = &peer; |
1655 |
|
|
|
1656 |
|
|
log_debug("%s: acquire request (peer %s)", __func__, |
1657 |
|
|
print_host(speer, NULL, 0)); |
1658 |
|
|
|
1659 |
|
|
/* get the matching flow */ |
1660 |
|
|
bzero(&smsg, sizeof(smsg)); |
1661 |
|
|
smsg.sadb_msg_version = PF_KEY_V2; |
1662 |
|
|
smsg.sadb_msg_seq = ++sadb_msg_seq; |
1663 |
|
|
smsg.sadb_msg_pid = getpid(); |
1664 |
|
|
smsg.sadb_msg_len = sizeof(smsg) / 8; |
1665 |
|
|
smsg.sadb_msg_type = SADB_X_ASKPOLICY; |
1666 |
|
|
|
1667 |
|
|
iov_cnt = 0; |
1668 |
|
|
|
1669 |
|
|
iov[iov_cnt].iov_base = &smsg; |
1670 |
|
|
iov[iov_cnt].iov_len = sizeof(smsg); |
1671 |
|
|
iov_cnt++; |
1672 |
|
|
|
1673 |
|
|
bzero(&sa_pol, sizeof(sa_pol)); |
1674 |
|
|
sa_pol.sadb_x_policy_exttype = SADB_X_EXT_POLICY; |
1675 |
|
|
sa_pol.sadb_x_policy_len = sizeof(sa_pol) / 8; |
1676 |
|
|
sa_pol.sadb_x_policy_seq = hdr->sadb_msg_seq; |
1677 |
|
|
|
1678 |
|
|
iov[iov_cnt].iov_base = &sa_pol; |
1679 |
|
|
iov[iov_cnt].iov_len = sizeof(sa_pol); |
1680 |
|
|
smsg.sadb_msg_len += sizeof(sa_pol) / 8; |
1681 |
|
|
iov_cnt++; |
1682 |
|
|
|
1683 |
|
|
if (pfkey_write(sd, &smsg, iov, iov_cnt, &reply, &rlen)) { |
1684 |
|
|
log_warnx("%s: failed to get a policy", __func__); |
1685 |
|
|
return (0); |
1686 |
|
|
} |
1687 |
|
|
|
1688 |
|
|
if ((sa_addr = pfkey_find_ext(reply, rlen, |
1689 |
|
|
SADB_X_EXT_SRC_FLOW)) == NULL) { |
1690 |
|
|
errmsg = "flow source address"; |
1691 |
|
|
goto out; |
1692 |
|
|
} |
1693 |
|
|
ssrc = (struct sockaddr *)(sa_addr + 1); |
1694 |
|
|
flow.flow_src.addr_af = ssrc->sa_family; |
1695 |
|
|
flow.flow_src.addr_port = htons(socket_getport(ssrc)); |
1696 |
|
|
if ((slen = ssrc->sa_len) > sizeof(flow.flow_src.addr)) { |
1697 |
|
|
log_debug("%s: invalid src address len", __func__); |
1698 |
|
|
return (0); |
1699 |
|
|
} |
1700 |
|
|
memcpy(&flow.flow_src.addr, ssrc, slen); |
1701 |
|
|
if (socket_af((struct sockaddr *)&flow.flow_src.addr, |
1702 |
|
|
flow.flow_src.addr_port) == -1) { |
1703 |
|
|
log_debug("%s: invalid address", __func__); |
1704 |
|
|
return (0); |
1705 |
|
|
} |
1706 |
|
|
|
1707 |
|
|
if ((sa_addr = pfkey_find_ext(reply, rlen, |
1708 |
|
|
SADB_X_EXT_DST_FLOW)) == NULL) { |
1709 |
|
|
errmsg = "flow destination address"; |
1710 |
|
|
goto out; |
1711 |
|
|
} |
1712 |
|
|
sdst = (struct sockaddr *)(sa_addr + 1); |
1713 |
|
|
flow.flow_dst.addr_af = sdst->sa_family; |
1714 |
|
|
flow.flow_dst.addr_port = htons(socket_getport(sdst)); |
1715 |
|
|
if ((slen = sdst->sa_len) > sizeof(flow.flow_dst.addr)) { |
1716 |
|
|
log_debug("%s: invalid dst address len", __func__); |
1717 |
|
|
return (0); |
1718 |
|
|
} |
1719 |
|
|
memcpy(&flow.flow_dst.addr, sdst, slen); |
1720 |
|
|
if (socket_af((struct sockaddr *)&flow.flow_dst.addr, |
1721 |
|
|
flow.flow_dst.addr_port) == -1) { |
1722 |
|
|
log_debug("%s: invalid address", __func__); |
1723 |
|
|
return (0); |
1724 |
|
|
} |
1725 |
|
|
|
1726 |
|
|
if ((sa_addr = pfkey_find_ext(reply, rlen, |
1727 |
|
|
SADB_X_EXT_SRC_MASK)) == NULL) { |
1728 |
|
|
errmsg = "flow source mask"; |
1729 |
|
|
goto out; |
1730 |
|
|
} |
1731 |
|
|
smask = (struct sockaddr *)(sa_addr + 1); |
1732 |
|
|
switch (smask->sa_family) { |
1733 |
|
|
case AF_INET: |
1734 |
|
|
flow.flow_src.addr_mask = |
1735 |
|
|
mask2prefixlen((struct sockaddr *)smask); |
1736 |
|
|
if (flow.flow_src.addr_mask != 32) |
1737 |
|
|
flow.flow_src.addr_net = 1; |
1738 |
|
|
break; |
1739 |
|
|
case AF_INET6: |
1740 |
|
|
flow.flow_src.addr_mask = |
1741 |
|
|
mask2prefixlen6((struct sockaddr *)smask); |
1742 |
|
|
if (flow.flow_src.addr_mask != 128) |
1743 |
|
|
flow.flow_src.addr_net = 1; |
1744 |
|
|
break; |
1745 |
|
|
default: |
1746 |
|
|
log_debug("%s: bad address family", __func__); |
1747 |
|
|
free(reply); |
1748 |
|
|
return (0); |
1749 |
|
|
} |
1750 |
|
|
|
1751 |
|
|
if ((sa_addr = pfkey_find_ext(reply, rlen, |
1752 |
|
|
SADB_X_EXT_DST_MASK)) == NULL) { |
1753 |
|
|
errmsg = "flow destination mask"; |
1754 |
|
|
goto out; |
1755 |
|
|
} |
1756 |
|
|
dmask = (struct sockaddr *)(sa_addr + 1); |
1757 |
|
|
switch (dmask->sa_family) { |
1758 |
|
|
case AF_INET: |
1759 |
|
|
flow.flow_dst.addr_mask = |
1760 |
|
|
mask2prefixlen((struct sockaddr *)dmask); |
1761 |
|
|
if (flow.flow_src.addr_mask != 32) |
1762 |
|
|
flow.flow_src.addr_net = 1; |
1763 |
|
|
break; |
1764 |
|
|
case AF_INET6: |
1765 |
|
|
flow.flow_dst.addr_mask = |
1766 |
|
|
mask2prefixlen6((struct sockaddr *)dmask); |
1767 |
|
|
if (flow.flow_src.addr_mask != 128) |
1768 |
|
|
flow.flow_src.addr_net = 1; |
1769 |
|
|
break; |
1770 |
|
|
default: |
1771 |
|
|
log_debug("%s: bad address family", __func__); |
1772 |
|
|
free(reply); |
1773 |
|
|
return (0); |
1774 |
|
|
} |
1775 |
|
|
|
1776 |
|
|
if ((sa_proto = pfkey_find_ext(reply, rlen, |
1777 |
|
|
SADB_X_EXT_FLOW_TYPE)) == NULL) { |
1778 |
|
|
errmsg = "flow protocol"; |
1779 |
|
|
goto out; |
1780 |
|
|
} |
1781 |
|
|
flow.flow_dir = sa_proto->sadb_protocol_direction; |
1782 |
|
|
|
1783 |
|
|
log_debug("%s: flow %s from %s/%s to %s/%s via %s", __func__, |
1784 |
|
|
flow.flow_dir == IPSP_DIRECTION_IN ? "in" : "out", |
1785 |
|
|
print_host(ssrc, NULL, 0), print_host(smask, NULL, 0), |
1786 |
|
|
print_host(sdst, NULL, 0), print_host(dmask, NULL, 0), |
1787 |
|
|
print_host(speer, NULL, 0)); |
1788 |
|
|
|
1789 |
|
|
ret = ikev2_acquire_sa(env, &flow); |
1790 |
|
|
|
1791 |
|
|
out: |
1792 |
|
|
if (errmsg) |
1793 |
|
|
log_warnx("%s: %s wasn't found", __func__, errmsg); |
1794 |
|
|
free(reply); |
1795 |
|
|
break; |
1796 |
|
|
|
1797 |
|
|
case SADB_EXPIRE: |
1798 |
|
|
if ((sa = pfkey_find_ext(data, len, SADB_EXT_SA)) == NULL) { |
1799 |
|
|
log_warnx("%s: SA extension wasn't found", __func__); |
1800 |
|
|
return (0); |
1801 |
|
|
} |
1802 |
|
|
if ((sa_ltime = pfkey_find_ext(data, len, |
1803 |
|
|
SADB_EXT_LIFETIME_SOFT)) == NULL && |
1804 |
|
|
(sa_ltime = pfkey_find_ext(data, len, |
1805 |
|
|
SADB_EXT_LIFETIME_HARD)) == NULL) { |
1806 |
|
|
log_warnx("%s: lifetime extension wasn't found", |
1807 |
|
|
__func__); |
1808 |
|
|
return (0); |
1809 |
|
|
} |
1810 |
|
|
spi.spi = ntohl(sa->sadb_sa_spi); |
1811 |
|
|
spi.spi_size = 4; |
1812 |
|
|
switch (hdr->sadb_msg_satype) { |
1813 |
|
|
case SADB_SATYPE_AH: |
1814 |
|
|
spi.spi_protoid = IKEV2_SAPROTO_AH; |
1815 |
|
|
break; |
1816 |
|
|
case SADB_SATYPE_ESP: |
1817 |
|
|
spi.spi_protoid = IKEV2_SAPROTO_ESP; |
1818 |
|
|
break; |
1819 |
|
|
case SADB_X_SATYPE_IPCOMP: |
1820 |
|
|
spi.spi_size = 2; |
1821 |
|
|
spi.spi_protoid = IKEV2_SAPROTO_IPCOMP; |
1822 |
|
|
break; |
1823 |
|
|
default: |
1824 |
|
|
log_warnx("%s: unsupported SA type %d spi %s", |
1825 |
|
|
__func__, hdr->sadb_msg_satype, |
1826 |
|
|
print_spi(spi.spi, spi.spi_size)); |
1827 |
|
|
return (0); |
1828 |
|
|
} |
1829 |
|
|
|
1830 |
|
|
log_debug("%s: SA %s is expired, pending %s", __func__, |
1831 |
|
|
print_spi(spi.spi, spi.spi_size), |
1832 |
|
|
sa_ltime->sadb_lifetime_exttype == SADB_EXT_LIFETIME_SOFT ? |
1833 |
|
|
"rekeying" : "deletion"); |
1834 |
|
|
|
1835 |
|
|
if (sa_ltime->sadb_lifetime_exttype == SADB_EXT_LIFETIME_SOFT) |
1836 |
|
|
ret = ikev2_rekey_sa(env, &spi); |
1837 |
|
|
else |
1838 |
|
|
ret = ikev2_drop_sa(env, &spi); |
1839 |
|
|
break; |
1840 |
|
|
} |
1841 |
|
|
return (ret); |
1842 |
|
|
} |