GCC Code Coverage Report
Directory: ./ Exec Total Coverage
File: sbin/iked/pfkey.c Lines: 0 1017 0.0 %
Date: 2017-11-13 Branches: 0 384 0.0 %

Line Branch Exec Source
1
/*	$OpenBSD: pfkey.c,v 1.58 2017/04/18 02:29:56 deraadt Exp $	*/
2
3
/*
4
 * Copyright (c) 2010-2013 Reyk Floeter <reyk@openbsd.org>
5
 * Copyright (c) 2004, 2005 Hans-Joerg Hoexer <hshoexer@openbsd.org>
6
 * Copyright (c) 2003, 2004 Henning Brauer <henning@openbsd.org>
7
 * Copyright (c) 2003, 2004 Markus Friedl <markus@openbsd.org>
8
 *
9
 * Permission to use, copy, modify, and distribute this software for any
10
 * purpose with or without fee is hereby granted, provided that the above
11
 * copyright notice and this permission notice appear in all copies.
12
 *
13
 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
14
 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
15
 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
16
 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
17
 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
18
 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
19
 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
20
 */
21
22
#include <sys/queue.h>
23
#include <sys/uio.h>
24
#include <sys/socket.h>
25
26
#include <netinet/in.h>
27
#include <netinet/ip_ipsp.h>
28
#include <net/pfkeyv2.h>
29
30
#include <err.h>
31
#include <errno.h>
32
#include <stdio.h>
33
#include <poll.h>
34
#include <string.h>
35
#include <stdlib.h>
36
#include <unistd.h>
37
#include <event.h>
38
39
#include "iked.h"
40
#include "ikev2.h"
41
42
#define ROUNDUP(x) (((x) + (PFKEYV2_CHUNK - 1)) & ~(PFKEYV2_CHUNK - 1))
43
#define IOV_CNT 20
44
45
#define PFKEYV2_CHUNK sizeof(uint64_t)
46
#define PFKEY_REPLY_TIMEOUT 1000
47
48
static uint32_t sadb_msg_seq = 0;
49
static unsigned int sadb_decoupled = 0;
50
static unsigned int sadb_ipv6refcnt = 0;
51
52
static int pfkey_blockipv6 = 0;
53
static struct event pfkey_timer_ev;
54
static struct timeval pfkey_timer_tv;
55
56
struct pfkey_message {
57
	SIMPLEQ_ENTRY(pfkey_message)
58
			 pm_entry;
59
	uint8_t		*pm_data;
60
	ssize_t		 pm_length;
61
};
62
SIMPLEQ_HEAD(, pfkey_message) pfkey_retry, pfkey_postponed =
63
    SIMPLEQ_HEAD_INITIALIZER(pfkey_postponed);
64
65
struct pfkey_constmap {
66
	uint8_t		 pfkey_id;
67
	unsigned int	 pfkey_ikeid;
68
	unsigned int	 pfkey_fixedkey;
69
};
70
71
static const struct pfkey_constmap pfkey_encr[] = {
72
	{ SADB_EALG_3DESCBC,	IKEV2_XFORMENCR_3DES },
73
	{ SADB_X_EALG_CAST,	IKEV2_XFORMENCR_CAST },
74
	{ SADB_X_EALG_BLF,	IKEV2_XFORMENCR_BLOWFISH },
75
	{ SADB_EALG_NULL,	IKEV2_XFORMENCR_NULL },
76
	{ SADB_X_EALG_AES,	IKEV2_XFORMENCR_AES_CBC },
77
	{ SADB_X_EALG_AESCTR,	IKEV2_XFORMENCR_AES_CTR },
78
	{ SADB_X_EALG_AESGCM16,	IKEV2_XFORMENCR_AES_GCM_16 },
79
	{ SADB_X_EALG_AESGMAC,	IKEV2_XFORMENCR_NULL_AES_GMAC },
80
	{ SADB_X_EALG_CHACHA20POLY1305, IKEV2_XFORMENCR_CHACHA20_POLY1305 },
81
	{ 0 }
82
};
83
84
static const struct pfkey_constmap pfkey_integr[] = {
85
	{ SADB_AALG_MD5HMAC,	IKEV2_XFORMAUTH_HMAC_MD5_96 },
86
	{ SADB_AALG_SHA1HMAC,	IKEV2_XFORMAUTH_HMAC_SHA1_96 },
87
	{ SADB_X_AALG_SHA2_256,	IKEV2_XFORMAUTH_HMAC_SHA2_256_128 },
88
	{ SADB_X_AALG_SHA2_384,	IKEV2_XFORMAUTH_HMAC_SHA2_384_192 },
89
	{ SADB_X_AALG_SHA2_512,	IKEV2_XFORMAUTH_HMAC_SHA2_512_256 },
90
	{ 0 }
91
};
92
93
static const struct pfkey_constmap pfkey_satype[] = {
94
	{ SADB_SATYPE_AH,	IKEV2_SAPROTO_AH },
95
	{ SADB_SATYPE_ESP,	IKEV2_SAPROTO_ESP },
96
	{ SADB_X_SATYPE_IPCOMP,	IKEV2_SAPROTO_IPCOMP },
97
	{ 0 }
98
};
99
100
int	pfkey_map(const struct pfkey_constmap *, uint16_t, uint8_t *);
101
int	pfkey_flow(int, uint8_t, uint8_t, struct iked_flow *);
102
int	pfkey_sa(int, uint8_t, uint8_t, struct iked_childsa *);
103
int	pfkey_sa_getspi(int, uint8_t, struct iked_childsa *, uint32_t *);
104
int	pfkey_sagroup(int, uint8_t, uint8_t,
105
	    struct iked_childsa *, struct iked_childsa *);
106
int	pfkey_write(int, struct sadb_msg *, struct iovec *, int,
107
	    uint8_t **, ssize_t *);
108
int	pfkey_reply(int, uint8_t **, ssize_t *);
109
void	pfkey_dispatch(int, short, void *);
110
111
struct sadb_ident *
112
	pfkey_id2ident(struct iked_id *, unsigned int);
113
void	*pfkey_find_ext(uint8_t *, ssize_t, int);
114
115
void	pfkey_timer_cb(int, short, void *);
116
int	pfkey_process(struct iked *, struct pfkey_message *);
117
118
int
119
pfkey_couple(int sd, struct iked_sas *sas, int couple)
120
{
121
	struct iked_sa		*sa;
122
	struct iked_flow	*flow;
123
	struct iked_childsa	*csa;
124
	const char		*mode[] = { "coupled", "decoupled" };
125
126
	/* Socket is not ready */
127
	if (sd == -1)
128
		return (-1);
129
130
	if (sadb_decoupled == !couple)
131
		return (0);
132
133
	log_debug("%s: kernel %s -> %s", __func__,
134
	    mode[sadb_decoupled], mode[!sadb_decoupled]);
135
136
	/* Allow writes to the PF_KEY socket */
137
	sadb_decoupled = 0;
138
139
	RB_FOREACH(sa, iked_sas, sas) {
140
		TAILQ_FOREACH(csa, &sa->sa_childsas, csa_entry) {
141
			if (!csa->csa_loaded && couple)
142
				(void)pfkey_sa_add(sd, csa, NULL);
143
			else if (csa->csa_loaded && !couple)
144
				(void)pfkey_sa_delete(sd, csa);
145
		}
146
		TAILQ_FOREACH(flow, &sa->sa_flows, flow_entry) {
147
			if (!flow->flow_loaded && couple)
148
				(void)pfkey_flow_add(sd, flow);
149
			else if (flow->flow_loaded && !couple)
150
				(void)pfkey_flow_delete(sd, flow);
151
		}
152
	}
153
154
	sadb_decoupled = !couple;
155
156
	return (0);
157
}
158
159
int
160
pfkey_map(const struct pfkey_constmap *map, uint16_t alg, uint8_t *pfkalg)
161
{
162
	int	 i;
163
164
	for (i = 0; map[i].pfkey_id != 0; i++)
165
		if (map[i].pfkey_ikeid == alg) {
166
			*pfkalg = map[i].pfkey_id;
167
			return (0);
168
		}
169
	return (-1);
170
}
171
172
int
173
pfkey_flow(int sd, uint8_t satype, uint8_t action, struct iked_flow *flow)
174
{
175
	struct sadb_msg		 smsg;
176
	struct iked_addr	*flow_src, *flow_dst;
177
	struct sadb_address	 sa_src, sa_dst, sa_local, sa_peer, sa_smask,
178
				 sa_dmask;
179
	struct sadb_protocol	 sa_flowtype, sa_protocol;
180
	struct sadb_ident	*sa_srcid, *sa_dstid;
181
	struct sockaddr_storage	 ssrc, sdst, slocal, speer, smask, dmask;
182
	struct iovec		 iov[IOV_CNT];
183
	int			 iov_cnt, ret = -1;
184
185
	sa_srcid = sa_dstid = NULL;
186
187
	flow_src = &flow->flow_src;
188
	flow_dst = &flow->flow_dst;
189
190
	if (flow->flow_prenat.addr_af == flow_src->addr_af) {
191
		switch (flow->flow_type) {
192
		case SADB_X_FLOW_TYPE_USE:
193
			flow_dst = &flow->flow_prenat;
194
			break;
195
		case SADB_X_FLOW_TYPE_REQUIRE:
196
			flow_src = &flow->flow_prenat;
197
			break;
198
		case 0:
199
			if (flow->flow_dir == IPSP_DIRECTION_IN)
200
				flow_dst = &flow->flow_prenat;
201
			else
202
				flow_src = &flow->flow_prenat;
203
		}
204
	}
205
206
	bzero(&ssrc, sizeof(ssrc));
207
	bzero(&smask, sizeof(smask));
208
	memcpy(&ssrc, &flow_src->addr, sizeof(ssrc));
209
	memcpy(&smask, &flow_src->addr, sizeof(smask));
210
	socket_af((struct sockaddr *)&ssrc, flow_src->addr_port);
211
	socket_af((struct sockaddr *)&smask, flow_src->addr_port ?
212
	    0xffff : 0);
213
214
	switch (flow_src->addr_af) {
215
	case AF_INET:
216
		((struct sockaddr_in *)&smask)->sin_addr.s_addr =
217
		    prefixlen2mask(flow_src->addr_net ?
218
		    flow_src->addr_mask : 32);
219
		break;
220
	case AF_INET6:
221
		prefixlen2mask6(flow_src->addr_net ?
222
		    flow_src->addr_mask : 128,
223
		    (uint32_t *)((struct sockaddr_in6 *)
224
		    &smask)->sin6_addr.s6_addr);
225
		break;
226
	default:
227
		log_warnx("%s: unsupported address family %d",
228
		    __func__, flow_src->addr_af);
229
		return (-1);
230
	}
231
	smask.ss_len = ssrc.ss_len;
232
233
	bzero(&sdst, sizeof(sdst));
234
	bzero(&dmask, sizeof(dmask));
235
	memcpy(&sdst, &flow_dst->addr, sizeof(sdst));
236
	memcpy(&dmask, &flow_dst->addr, sizeof(dmask));
237
	socket_af((struct sockaddr *)&sdst, flow_dst->addr_port);
238
	socket_af((struct sockaddr *)&dmask, flow_dst->addr_port ?
239
	    0xffff : 0);
240
241
	switch (flow_dst->addr_af) {
242
	case AF_INET:
243
		((struct sockaddr_in *)&dmask)->sin_addr.s_addr =
244
		    prefixlen2mask(flow_dst->addr_net ?
245
		    flow_dst->addr_mask : 32);
246
		break;
247
	case AF_INET6:
248
		prefixlen2mask6(flow_dst->addr_net ?
249
		    flow_dst->addr_mask : 128,
250
		    (uint32_t *)((struct sockaddr_in6 *)
251
		    &dmask)->sin6_addr.s6_addr);
252
		break;
253
	default:
254
		log_warnx("%s: unsupported address family %d",
255
		    __func__, flow_dst->addr_af);
256
		return (-1);
257
	}
258
	dmask.ss_len = sdst.ss_len;
259
260
	bzero(&slocal, sizeof(slocal));
261
	bzero(&speer, sizeof(speer));
262
	if (action != SADB_X_DELFLOW && flow->flow_local != NULL) {
263
		memcpy(&slocal, &flow->flow_local->addr, sizeof(slocal));
264
		socket_af((struct sockaddr *)&slocal, 0);
265
266
		memcpy(&speer, &flow->flow_peer->addr, sizeof(speer));
267
		socket_af((struct sockaddr *)&speer, 0);
268
	}
269
270
	bzero(&smsg, sizeof(smsg));
271
	smsg.sadb_msg_version = PF_KEY_V2;
272
	smsg.sadb_msg_seq = ++sadb_msg_seq;
273
	smsg.sadb_msg_pid = getpid();
274
	smsg.sadb_msg_len = sizeof(smsg) / 8;
275
	smsg.sadb_msg_type = action;
276
	smsg.sadb_msg_satype = satype;
277
278
	bzero(&sa_flowtype, sizeof(sa_flowtype));
279
	sa_flowtype.sadb_protocol_exttype = SADB_X_EXT_FLOW_TYPE;
280
	sa_flowtype.sadb_protocol_len = sizeof(sa_flowtype) / 8;
281
	sa_flowtype.sadb_protocol_direction = flow->flow_dir;
282
	sa_flowtype.sadb_protocol_proto =
283
	    flow->flow_type ? flow->flow_type :
284
	    (flow->flow_dir == IPSP_DIRECTION_IN ?
285
	    SADB_X_FLOW_TYPE_USE : SADB_X_FLOW_TYPE_REQUIRE);
286
287
	bzero(&sa_protocol, sizeof(sa_protocol));
288
	sa_protocol.sadb_protocol_exttype = SADB_X_EXT_PROTOCOL;
289
	sa_protocol.sadb_protocol_len = sizeof(sa_protocol) / 8;
290
	sa_protocol.sadb_protocol_direction = 0;
291
	sa_protocol.sadb_protocol_proto = flow->flow_ipproto;
292
293
	bzero(&sa_src, sizeof(sa_src));
294
	sa_src.sadb_address_exttype = SADB_X_EXT_SRC_FLOW;
295
	sa_src.sadb_address_len = (sizeof(sa_src) + ROUNDUP(ssrc.ss_len)) / 8;
296
297
	bzero(&sa_smask, sizeof(sa_smask));
298
	sa_smask.sadb_address_exttype = SADB_X_EXT_SRC_MASK;
299
	sa_smask.sadb_address_len =
300
	    (sizeof(sa_smask) + ROUNDUP(smask.ss_len)) / 8;
301
302
	bzero(&sa_dst, sizeof(sa_dst));
303
	sa_dst.sadb_address_exttype = SADB_X_EXT_DST_FLOW;
304
	sa_dst.sadb_address_len = (sizeof(sa_dst) + ROUNDUP(sdst.ss_len)) / 8;
305
306
	bzero(&sa_dmask, sizeof(sa_dmask));
307
	sa_dmask.sadb_address_exttype = SADB_X_EXT_DST_MASK;
308
	sa_dmask.sadb_address_len =
309
	    (sizeof(sa_dmask) + ROUNDUP(dmask.ss_len)) / 8;
310
311
	if (action != SADB_X_DELFLOW && flow->flow_local != NULL) {
312
		/* local address */
313
		bzero(&sa_local, sizeof(sa_local));
314
		sa_local.sadb_address_exttype = SADB_EXT_ADDRESS_SRC;
315
		sa_local.sadb_address_len =
316
		    (sizeof(sa_local) + ROUNDUP(slocal.ss_len)) / 8;
317
318
		/* peer address */
319
		bzero(&sa_peer, sizeof(sa_peer));
320
		sa_peer.sadb_address_exttype = SADB_EXT_ADDRESS_DST;
321
		sa_peer.sadb_address_len =
322
		    (sizeof(sa_peer) + ROUNDUP(speer.ss_len)) / 8;
323
324
		/* local id */
325
		sa_srcid = pfkey_id2ident(IKESA_SRCID(flow->flow_ikesa),
326
		    SADB_EXT_IDENTITY_SRC);
327
328
		/* peer id */
329
		sa_dstid = pfkey_id2ident(IKESA_DSTID(flow->flow_ikesa),
330
		    SADB_EXT_IDENTITY_DST);
331
	}
332
333
	iov_cnt = 0;
334
335
	/* header */
336
	iov[iov_cnt].iov_base = &smsg;
337
	iov[iov_cnt].iov_len = sizeof(smsg);
338
	iov_cnt++;
339
340
	/* add flow type */
341
	iov[iov_cnt].iov_base = &sa_flowtype;
342
	iov[iov_cnt].iov_len = sizeof(sa_flowtype);
343
	smsg.sadb_msg_len += sa_flowtype.sadb_protocol_len;
344
	iov_cnt++;
345
346
	if (action != SADB_X_DELFLOW && flow->flow_local != NULL) {
347
#if 0
348
		/* local ip */
349
		iov[iov_cnt].iov_base = &sa_local;
350
		iov[iov_cnt].iov_len = sizeof(sa_local);
351
		iov_cnt++;
352
		iov[iov_cnt].iov_base = &slocal;
353
		iov[iov_cnt].iov_len = ROUNDUP(slocal.ss_len);
354
		smsg.sadb_msg_len += sa_local.sadb_address_len;
355
		iov_cnt++;
356
#endif
357
358
		/* remote peer */
359
		iov[iov_cnt].iov_base = &sa_peer;
360
		iov[iov_cnt].iov_len = sizeof(sa_peer);
361
		iov_cnt++;
362
		iov[iov_cnt].iov_base = &speer;
363
		iov[iov_cnt].iov_len = ROUNDUP(speer.ss_len);
364
		smsg.sadb_msg_len += sa_peer.sadb_address_len;
365
		iov_cnt++;
366
	}
367
368
	/* src addr */
369
	iov[iov_cnt].iov_base = &sa_src;
370
	iov[iov_cnt].iov_len = sizeof(sa_src);
371
	iov_cnt++;
372
	iov[iov_cnt].iov_base = &ssrc;
373
	iov[iov_cnt].iov_len = ROUNDUP(ssrc.ss_len);
374
	smsg.sadb_msg_len += sa_src.sadb_address_len;
375
	iov_cnt++;
376
377
	/* src mask */
378
	iov[iov_cnt].iov_base = &sa_smask;
379
	iov[iov_cnt].iov_len = sizeof(sa_smask);
380
	iov_cnt++;
381
	iov[iov_cnt].iov_base = &smask;
382
	iov[iov_cnt].iov_len = ROUNDUP(smask.ss_len);
383
	smsg.sadb_msg_len += sa_smask.sadb_address_len;
384
	iov_cnt++;
385
386
	/* dest addr */
387
	iov[iov_cnt].iov_base = &sa_dst;
388
	iov[iov_cnt].iov_len = sizeof(sa_dst);
389
	iov_cnt++;
390
	iov[iov_cnt].iov_base = &sdst;
391
	iov[iov_cnt].iov_len = ROUNDUP(sdst.ss_len);
392
	smsg.sadb_msg_len += sa_dst.sadb_address_len;
393
	iov_cnt++;
394
395
	/* dst mask */
396
	iov[iov_cnt].iov_base = &sa_dmask;
397
	iov[iov_cnt].iov_len = sizeof(sa_dmask);
398
	iov_cnt++;
399
	iov[iov_cnt].iov_base = &dmask;
400
	iov[iov_cnt].iov_len = ROUNDUP(dmask.ss_len);
401
	smsg.sadb_msg_len += sa_dmask.sadb_address_len;
402
	iov_cnt++;
403
404
	/* add protocol */
405
	iov[iov_cnt].iov_base = &sa_protocol;
406
	iov[iov_cnt].iov_len = sizeof(sa_protocol);
407
	smsg.sadb_msg_len += sa_protocol.sadb_protocol_len;
408
	iov_cnt++;
409
410
	if (sa_srcid) {
411
		/* src identity */
412
		iov[iov_cnt].iov_base = sa_srcid;
413
		iov[iov_cnt].iov_len = sa_srcid->sadb_ident_len * 8;
414
		smsg.sadb_msg_len += sa_srcid->sadb_ident_len;
415
		iov_cnt++;
416
	}
417
	if (sa_dstid) {
418
		/* dst identity */
419
		iov[iov_cnt].iov_base = sa_dstid;
420
		iov[iov_cnt].iov_len = sa_dstid->sadb_ident_len * 8;
421
		smsg.sadb_msg_len += sa_dstid->sadb_ident_len;
422
		iov_cnt++;
423
	}
424
425
	ret = pfkey_write(sd, &smsg, iov, iov_cnt, NULL, NULL);
426
427
	free(sa_srcid);
428
	free(sa_dstid);
429
430
	return (ret);
431
}
432
433
int
434
pfkey_sa(int sd, uint8_t satype, uint8_t action, struct iked_childsa *sa)
435
{
436
	struct sadb_msg		 smsg;
437
	struct sadb_sa		 sadb;
438
	struct sadb_address	 sa_src, sa_dst;
439
	struct sadb_key		 sa_authkey, sa_enckey;
440
	struct sadb_lifetime	 sa_ltime_hard, sa_ltime_soft;
441
	struct sadb_x_udpencap	 udpencap;
442
	struct sadb_x_tag	 sa_tag;
443
	char			*tag = NULL;
444
	struct sadb_x_tap	 sa_tap;
445
	struct sockaddr_storage	 ssrc, sdst;
446
	struct sadb_ident	*sa_srcid, *sa_dstid;
447
	struct iked_lifetime	*lt;
448
	struct iked_policy	*pol;
449
	struct iovec		 iov[IOV_CNT];
450
	uint32_t		 jitter;
451
	int			 iov_cnt;
452
	int			 ret;
453
454
	sa_srcid = sa_dstid = NULL;
455
456
	if (sa->csa_ikesa == NULL || sa->csa_ikesa->sa_policy == NULL) {
457
		log_warn("%s: invalid SA and policy", __func__);
458
		return (-1);
459
	}
460
	pol = sa->csa_ikesa->sa_policy;
461
	lt = &pol->pol_lifetime;
462
463
	bzero(&ssrc, sizeof(ssrc));
464
	memcpy(&ssrc, &sa->csa_local->addr, sizeof(ssrc));
465
	if (socket_af((struct sockaddr *)&ssrc, 0) == -1) {
466
		log_warn("%s: invalid address", __func__);
467
		return (-1);
468
	}
469
470
	bzero(&sdst, sizeof(sdst));
471
	memcpy(&sdst, &sa->csa_peer->addr, sizeof(sdst));
472
	if (socket_af((struct sockaddr *)&sdst, 0) == -1) {
473
		log_warn("%s: invalid address", __func__);
474
		return (-1);
475
	}
476
477
	bzero(&smsg, sizeof(smsg));
478
	smsg.sadb_msg_version = PF_KEY_V2;
479
	smsg.sadb_msg_seq = ++sadb_msg_seq;
480
	smsg.sadb_msg_pid = getpid();
481
	smsg.sadb_msg_len = sizeof(smsg) / 8;
482
	smsg.sadb_msg_type = action;
483
	smsg.sadb_msg_satype = satype;
484
485
	bzero(&sadb, sizeof(sadb));
486
	sadb.sadb_sa_len = sizeof(sadb) / 8;
487
	sadb.sadb_sa_exttype = SADB_EXT_SA;
488
	sadb.sadb_sa_spi = htonl(sa->csa_spi.spi);
489
	sadb.sadb_sa_state = SADB_SASTATE_MATURE;
490
	sadb.sadb_sa_replay = 64;
491
492
	if (!sa->csa_transport)
493
		sadb.sadb_sa_flags |= SADB_X_SAFLAGS_TUNNEL;
494
495
	if (sa->csa_esn)
496
		sadb.sadb_sa_flags |= SADB_X_SAFLAGS_ESN;
497
498
	bzero(&sa_src, sizeof(sa_src));
499
	sa_src.sadb_address_len = (sizeof(sa_src) + ROUNDUP(ssrc.ss_len)) / 8;
500
	sa_src.sadb_address_exttype = SADB_EXT_ADDRESS_SRC;
501
502
	bzero(&sa_dst, sizeof(sa_dst));
503
	sa_dst.sadb_address_len = (sizeof(sa_dst) + ROUNDUP(sdst.ss_len)) / 8;
504
	sa_dst.sadb_address_exttype = SADB_EXT_ADDRESS_DST;
505
506
	bzero(&sa_authkey, sizeof(sa_authkey));
507
	bzero(&sa_enckey, sizeof(sa_enckey));
508
	bzero(&udpencap, sizeof udpencap);
509
	bzero(&sa_ltime_hard, sizeof(sa_ltime_hard));
510
	bzero(&sa_ltime_soft, sizeof(sa_ltime_soft));
511
512
	if (action == SADB_DELETE)
513
		goto send;
514
515
	if (satype == SADB_SATYPE_ESP &&
516
	    sa->csa_ikesa->sa_udpencap && sa->csa_ikesa->sa_natt) {
517
		sadb.sadb_sa_flags |= SADB_X_SAFLAGS_UDPENCAP;
518
		udpencap.sadb_x_udpencap_exttype = SADB_X_EXT_UDPENCAP;
519
		udpencap.sadb_x_udpencap_len = sizeof(udpencap) / 8;
520
		udpencap.sadb_x_udpencap_port =
521
		    sa->csa_ikesa->sa_peer.addr_port;
522
523
		log_debug("%s: udpencap port %d", __func__,
524
		    ntohs(udpencap.sadb_x_udpencap_port));
525
	}
526
527
	if ((action == SADB_ADD || action == SADB_UPDATE) &&
528
	    !sa->csa_persistent && (lt->lt_bytes || lt->lt_seconds)) {
529
		sa_ltime_hard.sadb_lifetime_exttype = SADB_EXT_LIFETIME_HARD;
530
		sa_ltime_hard.sadb_lifetime_len = sizeof(sa_ltime_hard) / 8;
531
		sa_ltime_hard.sadb_lifetime_bytes = lt->lt_bytes;
532
		sa_ltime_hard.sadb_lifetime_addtime = lt->lt_seconds;
533
534
		/* double the lifetime for ipcomp; disable byte lifetime */
535
		if (satype == SADB_X_SATYPE_IPCOMP) {
536
			sa_ltime_hard.sadb_lifetime_addtime *= 2;
537
			sa_ltime_hard.sadb_lifetime_bytes = 0;
538
		}
539
540
		sa_ltime_soft.sadb_lifetime_exttype = SADB_EXT_LIFETIME_SOFT;
541
		sa_ltime_soft.sadb_lifetime_len = sizeof(sa_ltime_soft) / 8;
542
		/* set randomly to 85-95% */
543
		jitter = 850 + arc4random_uniform(100);
544
		sa_ltime_soft.sadb_lifetime_bytes =
545
		    (sa_ltime_hard.sadb_lifetime_bytes * jitter) / 1000;
546
		sa_ltime_soft.sadb_lifetime_addtime =
547
		    (sa_ltime_hard.sadb_lifetime_addtime * jitter) / 1000;
548
	}
549
550
	/* XXX handle NULL encryption or NULL auth or combined encr/auth */
551
	if (action == SADB_ADD &&
552
	    !ibuf_length(sa->csa_integrkey) && !ibuf_length(sa->csa_encrkey) &&
553
	    satype != SADB_X_SATYPE_IPCOMP && satype != SADB_X_SATYPE_IPIP) {
554
		log_warnx("%s: no key specified", __func__);
555
		return (-1);
556
	}
557
558
	if (sa->csa_integrid)
559
		if (pfkey_map(pfkey_integr,
560
		    sa->csa_integrid, &sadb.sadb_sa_auth) == -1) {
561
			log_warnx("%s: unsupported integrity algorithm %s",
562
			    __func__, print_map(sa->csa_integrid,
563
			    ikev2_xformauth_map));
564
			return (-1);
565
		}
566
567
	if (sa->csa_encrid)
568
		if (pfkey_map(pfkey_encr,
569
		    sa->csa_encrid, &sadb.sadb_sa_encrypt) == -1) {
570
			log_warnx("%s: unsupported encryption algorithm %s",
571
			    __func__, print_map(sa->csa_encrid,
572
			    ikev2_xformencr_map));
573
			return (-1);
574
		}
575
576
	if (ibuf_length(sa->csa_integrkey)) {
577
		sa_authkey.sadb_key_len = (sizeof(sa_authkey) +
578
		    ((ibuf_size(sa->csa_integrkey) + 7) / 8) * 8) / 8;
579
		sa_authkey.sadb_key_exttype = SADB_EXT_KEY_AUTH;
580
		sa_authkey.sadb_key_bits =
581
		    8 * ibuf_size(sa->csa_integrkey);
582
	}
583
584
	if (ibuf_length(sa->csa_encrkey)) {
585
		sa_enckey.sadb_key_len = (sizeof(sa_enckey) +
586
		    ((ibuf_size(sa->csa_encrkey) + 7) / 8) * 8) / 8;
587
		sa_enckey.sadb_key_exttype = SADB_EXT_KEY_ENCRYPT;
588
		sa_enckey.sadb_key_bits =
589
		    8 * ibuf_size(sa->csa_encrkey);
590
	}
591
592
	/* we only support deflate */
593
	if (satype == SADB_X_SATYPE_IPCOMP)
594
		sadb.sadb_sa_encrypt = SADB_X_CALG_DEFLATE;
595
596
	/* Note that we need to swap the IDs for incoming SAs (SADB_UPDATE) */
597
	if (action != SADB_UPDATE) {
598
		sa_srcid = pfkey_id2ident(
599
		    IKESA_SRCID(sa->csa_ikesa), SADB_EXT_IDENTITY_SRC);
600
		sa_dstid = pfkey_id2ident(
601
		    IKESA_DSTID(sa->csa_ikesa), SADB_EXT_IDENTITY_DST);
602
	} else {
603
		sa_srcid = pfkey_id2ident(
604
		    IKESA_DSTID(sa->csa_ikesa), SADB_EXT_IDENTITY_SRC);
605
		sa_dstid = pfkey_id2ident(
606
		    IKESA_SRCID(sa->csa_ikesa), SADB_EXT_IDENTITY_DST);
607
	}
608
609
	tag = sa->csa_ikesa->sa_tag;
610
	if (tag != NULL && *tag != '\0') {
611
		bzero(&sa_tag, sizeof(sa_tag));
612
		sa_tag.sadb_x_tag_exttype = SADB_X_EXT_TAG;
613
		sa_tag.sadb_x_tag_len =
614
		    (ROUNDUP(strlen(tag) + 1) + sizeof(sa_tag)) / 8;
615
		sa_tag.sadb_x_tag_taglen = strlen(tag) + 1;
616
	} else
617
		tag = NULL;
618
619
	if (pol->pol_tap != 0) {
620
		bzero(&sa_tap, sizeof(sa_tap));
621
		sa_tap.sadb_x_tap_exttype = SADB_X_EXT_TAP;
622
		sa_tap.sadb_x_tap_len = sizeof(sa_tap) / 8;
623
		sa_tap.sadb_x_tap_unit = pol->pol_tap;
624
	}
625
626
 send:
627
	iov_cnt = 0;
628
629
	/* header */
630
	iov[iov_cnt].iov_base = &smsg;
631
	iov[iov_cnt].iov_len = sizeof(smsg);
632
	iov_cnt++;
633
634
	/* sa */
635
	iov[iov_cnt].iov_base = &sadb;
636
	iov[iov_cnt].iov_len = sizeof(sadb);
637
	smsg.sadb_msg_len += sadb.sadb_sa_len;
638
	iov_cnt++;
639
640
	/* src addr */
641
	iov[iov_cnt].iov_base = &sa_src;
642
	iov[iov_cnt].iov_len = sizeof(sa_src);
643
	iov_cnt++;
644
	iov[iov_cnt].iov_base = &ssrc;
645
	iov[iov_cnt].iov_len = ROUNDUP(ssrc.ss_len);
646
	smsg.sadb_msg_len += sa_src.sadb_address_len;
647
	iov_cnt++;
648
649
	/* dst addr */
650
	iov[iov_cnt].iov_base = &sa_dst;
651
	iov[iov_cnt].iov_len = sizeof(sa_dst);
652
	iov_cnt++;
653
	iov[iov_cnt].iov_base = &sdst;
654
	iov[iov_cnt].iov_len = ROUNDUP(sdst.ss_len);
655
	smsg.sadb_msg_len += sa_dst.sadb_address_len;
656
	iov_cnt++;
657
658
	if (sa_ltime_soft.sadb_lifetime_len) {
659
		/* soft lifetime */
660
		iov[iov_cnt].iov_base = &sa_ltime_soft;
661
		iov[iov_cnt].iov_len = sizeof(sa_ltime_soft);
662
		smsg.sadb_msg_len += sa_ltime_soft.sadb_lifetime_len;
663
		iov_cnt++;
664
	}
665
666
	if (sa_ltime_hard.sadb_lifetime_len) {
667
		/* hard lifetime */
668
		iov[iov_cnt].iov_base = &sa_ltime_hard;
669
		iov[iov_cnt].iov_len = sizeof(sa_ltime_hard);
670
		smsg.sadb_msg_len += sa_ltime_hard.sadb_lifetime_len;
671
		iov_cnt++;
672
	}
673
674
	if (udpencap.sadb_x_udpencap_len) {
675
		iov[iov_cnt].iov_base = &udpencap;
676
		iov[iov_cnt].iov_len = sizeof(udpencap);
677
		smsg.sadb_msg_len += udpencap.sadb_x_udpencap_len;
678
		iov_cnt++;
679
	}
680
681
	if (sa_enckey.sadb_key_len) {
682
		/* encryption key */
683
		iov[iov_cnt].iov_base = &sa_enckey;
684
		iov[iov_cnt].iov_len = sizeof(sa_enckey);
685
		iov_cnt++;
686
		iov[iov_cnt].iov_base = ibuf_data(sa->csa_encrkey);
687
		iov[iov_cnt].iov_len =
688
		    ((ibuf_size(sa->csa_encrkey) + 7) / 8) * 8;
689
		smsg.sadb_msg_len += sa_enckey.sadb_key_len;
690
		iov_cnt++;
691
	}
692
	if (sa_authkey.sadb_key_len) {
693
		/* authentication key */
694
		iov[iov_cnt].iov_base = &sa_authkey;
695
		iov[iov_cnt].iov_len = sizeof(sa_authkey);
696
		iov_cnt++;
697
		iov[iov_cnt].iov_base = ibuf_data(sa->csa_integrkey);
698
		iov[iov_cnt].iov_len =
699
		    ((ibuf_size(sa->csa_integrkey) + 7) / 8) * 8;
700
		smsg.sadb_msg_len += sa_authkey.sadb_key_len;
701
		iov_cnt++;
702
	}
703
704
	if (sa_srcid) {
705
		/* src identity */
706
		iov[iov_cnt].iov_base = sa_srcid;
707
		iov[iov_cnt].iov_len = sa_srcid->sadb_ident_len * 8;
708
		smsg.sadb_msg_len += sa_srcid->sadb_ident_len;
709
		iov_cnt++;
710
	}
711
	if (sa_dstid) {
712
		/* dst identity */
713
		iov[iov_cnt].iov_base = sa_dstid;
714
		iov[iov_cnt].iov_len = sa_dstid->sadb_ident_len * 8;
715
		smsg.sadb_msg_len += sa_dstid->sadb_ident_len;
716
		iov_cnt++;
717
	}
718
719
	if (tag != NULL) {
720
		/* tag identity */
721
		iov[iov_cnt].iov_base = &sa_tag;
722
		iov[iov_cnt].iov_len = sizeof(sa_tag);
723
		iov_cnt++;
724
		iov[iov_cnt].iov_base = tag;
725
		iov[iov_cnt].iov_len = ROUNDUP(strlen(tag) + 1);
726
		smsg.sadb_msg_len += sa_tag.sadb_x_tag_len;
727
		iov_cnt++;
728
	}
729
730
	if (pol->pol_tap != 0) {
731
		/* enc(4) device tap unit */
732
		iov[iov_cnt].iov_base = &sa_tap;
733
		iov[iov_cnt].iov_len = sizeof(sa_tap);
734
		smsg.sadb_msg_len += sa_tap.sadb_x_tap_len;
735
		iov_cnt++;
736
	}
737
738
	ret = pfkey_write(sd, &smsg, iov, iov_cnt, NULL, NULL);
739
740
	free(sa_srcid);
741
	free(sa_dstid);
742
743
	return ret;
744
}
745
746
int
747
pfkey_sa_last_used(int sd, struct iked_childsa *sa, uint64_t *last_used)
748
{
749
	struct sadb_msg		*msg, smsg;
750
	struct sadb_address	 sa_src, sa_dst;
751
	struct sadb_sa		 sadb;
752
	struct sadb_lifetime	*sa_life;
753
	struct sockaddr_storage	 ssrc, sdst;
754
	struct iovec		 iov[IOV_CNT];
755
	uint8_t			*data;
756
	ssize_t			 n;
757
	int			 iov_cnt, ret = -1;
758
	uint8_t			 satype;
759
760
	*last_used = 0;
761
762
	if (pfkey_map(pfkey_satype, sa->csa_saproto, &satype) == -1)
763
		return (-1);
764
765
	bzero(&ssrc, sizeof(ssrc));
766
	memcpy(&ssrc, &sa->csa_local->addr, sizeof(ssrc));
767
	if (socket_af((struct sockaddr *)&ssrc, 0) == -1) {
768
		log_warn("%s: invalid address", __func__);
769
		return (-1);
770
	}
771
772
	bzero(&sdst, sizeof(sdst));
773
	memcpy(&sdst, &sa->csa_peer->addr, sizeof(sdst));
774
	if (socket_af((struct sockaddr *)&sdst, 0) == -1) {
775
		log_warn("%s: invalid address", __func__);
776
		return (-1);
777
	}
778
779
	bzero(&smsg, sizeof(smsg));
780
	smsg.sadb_msg_version = PF_KEY_V2;
781
	smsg.sadb_msg_seq = ++sadb_msg_seq;
782
	smsg.sadb_msg_pid = getpid();
783
	smsg.sadb_msg_len = sizeof(smsg) / 8;
784
	smsg.sadb_msg_type = SADB_GET;
785
	smsg.sadb_msg_satype = satype;
786
787
	bzero(&sadb, sizeof(sadb));
788
	sadb.sadb_sa_len = sizeof(sadb) / 8;
789
	sadb.sadb_sa_exttype = SADB_EXT_SA;
790
	sadb.sadb_sa_spi = htonl(sa->csa_spi.spi);
791
	sadb.sadb_sa_state = SADB_SASTATE_MATURE;
792
	sadb.sadb_sa_replay = 64;
793
794
	bzero(&sa_src, sizeof(sa_src));
795
	sa_src.sadb_address_len = (sizeof(sa_src) + ROUNDUP(ssrc.ss_len)) / 8;
796
	sa_src.sadb_address_exttype = SADB_EXT_ADDRESS_SRC;
797
798
	bzero(&sa_dst, sizeof(sa_dst));
799
	sa_dst.sadb_address_len = (sizeof(sa_dst) + ROUNDUP(sdst.ss_len)) / 8;
800
	sa_dst.sadb_address_exttype = SADB_EXT_ADDRESS_DST;
801
802
	iov_cnt = 0;
803
804
	/* header */
805
	iov[iov_cnt].iov_base = &smsg;
806
	iov[iov_cnt].iov_len = sizeof(smsg);
807
	iov_cnt++;
808
809
	/* sa */
810
	iov[iov_cnt].iov_base = &sadb;
811
	iov[iov_cnt].iov_len = sizeof(sadb);
812
	smsg.sadb_msg_len += sadb.sadb_sa_len;
813
	iov_cnt++;
814
815
	/* src addr */
816
	iov[iov_cnt].iov_base = &sa_src;
817
	iov[iov_cnt].iov_len = sizeof(sa_src);
818
	iov_cnt++;
819
	iov[iov_cnt].iov_base = &ssrc;
820
	iov[iov_cnt].iov_len = ROUNDUP(ssrc.ss_len);
821
	smsg.sadb_msg_len += sa_src.sadb_address_len;
822
	iov_cnt++;
823
824
	/* dst addr */
825
	iov[iov_cnt].iov_base = &sa_dst;
826
	iov[iov_cnt].iov_len = sizeof(sa_dst);
827
	iov_cnt++;
828
	iov[iov_cnt].iov_base = &sdst;
829
	iov[iov_cnt].iov_len = ROUNDUP(sdst.ss_len);
830
	smsg.sadb_msg_len += sa_dst.sadb_address_len;
831
	iov_cnt++;
832
833
	if ((ret = pfkey_write(sd, &smsg, iov, iov_cnt, &data, &n)) != 0)
834
		return (-1);
835
836
	msg = (struct sadb_msg *)data;
837
	if (msg->sadb_msg_errno != 0) {
838
		errno = msg->sadb_msg_errno;
839
		ret = -1;
840
		log_warn("%s: message", __func__);
841
		goto done;
842
	}
843
	if ((sa_life = pfkey_find_ext(data, n, SADB_X_EXT_LIFETIME_LASTUSE))
844
	    == NULL) {
845
		/* has never been used */
846
		ret = -1;
847
		goto done;
848
	}
849
	*last_used = sa_life->sadb_lifetime_usetime;
850
	log_debug("%s: last_used %llu", __func__, *last_used);
851
852
done:
853
	freezero(data, n);
854
	return (ret);
855
}
856
857
int
858
pfkey_sa_getspi(int sd, uint8_t satype, struct iked_childsa *sa,
859
    uint32_t *spip)
860
{
861
	struct sadb_msg		*msg, smsg;
862
	struct sadb_address	 sa_src, sa_dst;
863
	struct sadb_sa		*sa_ext;
864
	struct sadb_spirange	 sa_spirange;
865
	struct sockaddr_storage	 ssrc, sdst;
866
	struct iovec		 iov[IOV_CNT];
867
	uint8_t			*data;
868
	ssize_t			 n;
869
	int			 iov_cnt, ret = -1;
870
871
	bzero(&ssrc, sizeof(ssrc));
872
	memcpy(&ssrc, &sa->csa_local->addr, sizeof(ssrc));
873
	if (socket_af((struct sockaddr *)&ssrc, 0) == -1) {
874
		log_warn("%s: invalid address", __func__);
875
		return (-1);
876
	}
877
878
	bzero(&sdst, sizeof(sdst));
879
	memcpy(&sdst, &sa->csa_peer->addr, sizeof(sdst));
880
	if (socket_af((struct sockaddr *)&sdst, 0) == -1) {
881
		log_warn("%s: invalid address", __func__);
882
		return (-1);
883
	}
884
885
	bzero(&smsg, sizeof(smsg));
886
	smsg.sadb_msg_version = PF_KEY_V2;
887
	smsg.sadb_msg_seq = ++sadb_msg_seq;
888
	smsg.sadb_msg_pid = getpid();
889
	smsg.sadb_msg_len = sizeof(smsg) / 8;
890
	smsg.sadb_msg_type = SADB_GETSPI;
891
	smsg.sadb_msg_satype = satype;
892
893
	bzero(&sa_spirange, sizeof(sa_spirange));
894
	sa_spirange.sadb_spirange_exttype = SADB_EXT_SPIRANGE;
895
	sa_spirange.sadb_spirange_len = sizeof(sa_spirange) / 8;
896
	sa_spirange.sadb_spirange_min = 0x100;
897
	sa_spirange.sadb_spirange_max = (satype == SADB_X_SATYPE_IPCOMP) ?
898
	    (CPI_PRIVATE_MIN - 1) : 0xffffffff;
899
	sa_spirange.sadb_spirange_reserved = 0;
900
901
	bzero(&sa_src, sizeof(sa_src));
902
	sa_src.sadb_address_len = (sizeof(sa_src) + ROUNDUP(ssrc.ss_len)) / 8;
903
	sa_src.sadb_address_exttype = SADB_EXT_ADDRESS_SRC;
904
905
	bzero(&sa_dst, sizeof(sa_dst));
906
	sa_dst.sadb_address_len = (sizeof(sa_dst) + ROUNDUP(sdst.ss_len)) / 8;
907
	sa_dst.sadb_address_exttype = SADB_EXT_ADDRESS_DST;
908
909
	iov_cnt = 0;
910
911
	/* header */
912
	iov[iov_cnt].iov_base = &smsg;
913
	iov[iov_cnt].iov_len = sizeof(smsg);
914
	iov_cnt++;
915
916
	/* SPI range */
917
	iov[iov_cnt].iov_base = &sa_spirange;
918
	iov[iov_cnt].iov_len = sizeof(sa_spirange);
919
	smsg.sadb_msg_len += sa_spirange.sadb_spirange_len;
920
	iov_cnt++;
921
922
	/* src addr */
923
	iov[iov_cnt].iov_base = &sa_src;
924
	iov[iov_cnt].iov_len = sizeof(sa_src);
925
	iov_cnt++;
926
	iov[iov_cnt].iov_base = &ssrc;
927
	iov[iov_cnt].iov_len = ROUNDUP(ssrc.ss_len);
928
	smsg.sadb_msg_len += sa_src.sadb_address_len;
929
	iov_cnt++;
930
931
	/* dst addr */
932
	iov[iov_cnt].iov_base = &sa_dst;
933
	iov[iov_cnt].iov_len = sizeof(sa_dst);
934
	iov_cnt++;
935
	iov[iov_cnt].iov_base = &sdst;
936
	iov[iov_cnt].iov_len = ROUNDUP(sdst.ss_len);
937
	smsg.sadb_msg_len += sa_dst.sadb_address_len;
938
	iov_cnt++;
939
940
	*spip = 0;
941
942
	if ((ret = pfkey_write(sd, &smsg, iov, iov_cnt, &data, &n)) != 0)
943
		return (-1);
944
945
	msg = (struct sadb_msg *)data;
946
	if (msg->sadb_msg_errno != 0) {
947
		errno = msg->sadb_msg_errno;
948
		log_warn("%s: message", __func__);
949
		goto done;
950
	}
951
	if ((sa_ext = pfkey_find_ext(data, n, SADB_EXT_SA)) == NULL) {
952
		log_debug("%s: erronous reply", __func__);
953
		goto done;
954
	}
955
956
	*spip = ntohl(sa_ext->sadb_sa_spi);
957
	log_debug("%s: spi 0x%08x", __func__, *spip);
958
959
done:
960
	freezero(data, n);
961
	return (ret);
962
}
963
964
int
965
pfkey_sagroup(int sd, uint8_t satype1, uint8_t action,
966
    struct iked_childsa *sa1, struct iked_childsa *sa2)
967
{
968
	struct sadb_msg		smsg;
969
	struct sadb_sa		sadb1, sadb2;
970
	struct sadb_address	sa_dst1, sa_dst2;
971
	struct sockaddr_storage	sdst1, sdst2;
972
	struct sadb_protocol	sa_proto;
973
	struct iovec		iov[IOV_CNT];
974
	int			iov_cnt;
975
	uint8_t			satype2;
976
977
	if (pfkey_map(pfkey_satype, sa2->csa_saproto, &satype2) == -1)
978
		return (-1);
979
980
	bzero(&sdst1, sizeof(sdst1));
981
	memcpy(&sdst1, &sa1->csa_peer->addr, sizeof(sdst1));
982
	if (socket_af((struct sockaddr *)&sdst1, 0) == -1) {
983
		log_warnx("%s: unsupported address family %d",
984
		    __func__, sdst1.ss_family);
985
		return (-1);
986
	}
987
988
	bzero(&sdst2, sizeof(sdst2));
989
	memcpy(&sdst2, &sa2->csa_peer->addr, sizeof(sdst2));
990
	if (socket_af((struct sockaddr *)&sdst2, 0) == -1) {
991
		log_warnx("%s: unsupported address family %d",
992
		    __func__, sdst2.ss_family);
993
		return (-1);
994
	}
995
996
	bzero(&smsg, sizeof(smsg));
997
	smsg.sadb_msg_version = PF_KEY_V2;
998
	smsg.sadb_msg_seq = ++sadb_msg_seq;
999
	smsg.sadb_msg_pid = getpid();
1000
	smsg.sadb_msg_len = sizeof(smsg) / 8;
1001
	smsg.sadb_msg_type = action;
1002
	smsg.sadb_msg_satype = satype1;
1003
1004
	bzero(&sadb1, sizeof(sadb1));
1005
	sadb1.sadb_sa_len = sizeof(sadb1) / 8;
1006
	sadb1.sadb_sa_exttype = SADB_EXT_SA;
1007
	sadb1.sadb_sa_spi = htonl(sa1->csa_spi.spi);
1008
	sadb1.sadb_sa_state = SADB_SASTATE_MATURE;
1009
1010
	bzero(&sadb2, sizeof(sadb2));
1011
	sadb2.sadb_sa_len = sizeof(sadb2) / 8;
1012
	sadb2.sadb_sa_exttype = SADB_X_EXT_SA2;
1013
	sadb2.sadb_sa_spi = htonl(sa2->csa_spi.spi);
1014
	sadb2.sadb_sa_state = SADB_SASTATE_MATURE;
1015
	iov_cnt = 0;
1016
1017
	bzero(&sa_dst1, sizeof(sa_dst1));
1018
	sa_dst1.sadb_address_exttype = SADB_EXT_ADDRESS_DST;
1019
	sa_dst1.sadb_address_len =
1020
	    (sizeof(sa_dst1) + ROUNDUP(sdst1.ss_len)) / 8;
1021
1022
	bzero(&sa_dst2, sizeof(sa_dst2));
1023
	sa_dst2.sadb_address_exttype = SADB_X_EXT_DST2;
1024
	sa_dst2.sadb_address_len =
1025
	    (sizeof(sa_dst2) + ROUNDUP(sdst2.ss_len)) / 8;
1026
1027
	bzero(&sa_proto, sizeof(sa_proto));
1028
	sa_proto.sadb_protocol_exttype = SADB_X_EXT_SATYPE2;
1029
	sa_proto.sadb_protocol_len = sizeof(sa_proto) / 8;
1030
	sa_proto.sadb_protocol_direction = 0;
1031
	sa_proto.sadb_protocol_proto = satype2;
1032
1033
	/* header */
1034
	iov[iov_cnt].iov_base = &smsg;
1035
	iov[iov_cnt].iov_len = sizeof(smsg);
1036
	iov_cnt++;
1037
1038
	/* sa */
1039
	iov[iov_cnt].iov_base = &sadb1;
1040
	iov[iov_cnt].iov_len = sizeof(sadb1);
1041
	smsg.sadb_msg_len += sadb1.sadb_sa_len;
1042
	iov_cnt++;
1043
1044
	/* dst addr */
1045
	iov[iov_cnt].iov_base = &sa_dst1;
1046
	iov[iov_cnt].iov_len = sizeof(sa_dst1);
1047
	iov_cnt++;
1048
	iov[iov_cnt].iov_base = &sdst1;
1049
	iov[iov_cnt].iov_len = ROUNDUP(sdst1.ss_len);
1050
	smsg.sadb_msg_len += sa_dst1.sadb_address_len;
1051
	iov_cnt++;
1052
1053
	/* second sa */
1054
	iov[iov_cnt].iov_base = &sadb2;
1055
	iov[iov_cnt].iov_len = sizeof(sadb2);
1056
	smsg.sadb_msg_len += sadb2.sadb_sa_len;
1057
	iov_cnt++;
1058
1059
	/* second dst addr */
1060
	iov[iov_cnt].iov_base = &sa_dst2;
1061
	iov[iov_cnt].iov_len = sizeof(sa_dst2);
1062
	iov_cnt++;
1063
	iov[iov_cnt].iov_base = &sdst2;
1064
	iov[iov_cnt].iov_len = ROUNDUP(sdst2.ss_len);
1065
	smsg.sadb_msg_len += sa_dst2.sadb_address_len;
1066
	iov_cnt++;
1067
1068
	/* SA type */
1069
	iov[iov_cnt].iov_base = &sa_proto;
1070
	iov[iov_cnt].iov_len = sizeof(sa_proto);
1071
	smsg.sadb_msg_len += sa_proto.sadb_protocol_len;
1072
	iov_cnt++;
1073
1074
	return (pfkey_write(sd, &smsg, iov, iov_cnt, NULL, NULL));
1075
}
1076
1077
int
1078
pfkey_write(int sd, struct sadb_msg *smsg, struct iovec *iov, int iov_cnt,
1079
    uint8_t **datap, ssize_t *lenp)
1080
{
1081
	ssize_t n, len = smsg->sadb_msg_len * 8;
1082
1083
	if (sadb_decoupled) {
1084
		switch (smsg->sadb_msg_type) {
1085
		case SADB_GETSPI:
1086
			/* we need to get a new SPI from the kernel */
1087
			break;
1088
		default:
1089
			if (datap || lenp) {
1090
				log_warnx("%s: pfkey not coupled", __func__);
1091
				return (-1);
1092
			}
1093
			/* ignore request */
1094
			return (0);
1095
		}
1096
	}
1097
1098
	if ((n = writev(sd, iov, iov_cnt)) == -1) {
1099
		log_warn("%s: writev failed", __func__);
1100
		return (-1);
1101
	} else if (n != len) {
1102
		log_warn("%s: short write", __func__);
1103
		return (-1);
1104
	}
1105
1106
	return (pfkey_reply(sd, datap, lenp));
1107
}
1108
1109
int
1110
pfkey_reply(int sd, uint8_t **datap, ssize_t *lenp)
1111
{
1112
	struct pfkey_message	*pm;
1113
	struct sadb_msg		 hdr;
1114
	ssize_t			 len;
1115
	uint8_t			*data;
1116
	struct pollfd		pfd[1];
1117
	int			 n;
1118
1119
	pfd[0].fd = sd;
1120
	pfd[0].events = POLLIN;
1121
1122
	for (;;) {
1123
		/*
1124
		 * We should actually expect the reply to get lost
1125
		 * as PF_KEY is an unreliable service per the specs.
1126
		 * Currently we do this by setting a short timeout,
1127
		 * and if it is not readable in that time, we fail
1128
		 * the read.
1129
		 */
1130
		n = poll(pfd, 1, PFKEY_REPLY_TIMEOUT / 1000);
1131
		if (n == -1) {
1132
			log_warn("%s: poll() failed", __func__);
1133
			return (-1);
1134
		}
1135
		if (n == 0) {
1136
			log_warnx("%s: no reply from PF_KEY", __func__);
1137
			return (-1);
1138
		}
1139
1140
		if (recv(sd, &hdr, sizeof(hdr), MSG_PEEK) != sizeof(hdr)) {
1141
			log_warn("%s: short recv", __func__);
1142
			return (-1);
1143
		}
1144
1145
		if (hdr.sadb_msg_version != PF_KEY_V2) {
1146
			log_warnx("%s: wrong pfkey version", __func__);
1147
			return (-1);
1148
		}
1149
1150
		if ((data = reallocarray(NULL, hdr.sadb_msg_len,
1151
		    PFKEYV2_CHUNK)) == NULL) {
1152
			log_warn("%s: malloc", __func__);
1153
			return (-1);
1154
		}
1155
		len = hdr.sadb_msg_len * PFKEYV2_CHUNK;
1156
1157
		if (read(sd, data, len) != len) {
1158
			log_warnx("%s: short read", __func__);
1159
			free(data);
1160
			return (-1);
1161
		}
1162
1163
		/* XXX: Only one message can be outstanding. */
1164
		if (hdr.sadb_msg_seq == sadb_msg_seq &&
1165
		    hdr.sadb_msg_pid == (uint32_t)getpid())
1166
			break;
1167
1168
		/* ignore messages for other processes */
1169
		if (hdr.sadb_msg_pid != 0 &&
1170
		    hdr.sadb_msg_pid != (uint32_t)getpid()) {
1171
			free(data);
1172
			continue;
1173
		}
1174
1175
		/* not the reply, enqueue */
1176
		if ((pm = malloc(sizeof(*pm))) == NULL) {
1177
			log_warn("%s: malloc", __func__);
1178
			free(data);
1179
			return (-1);
1180
		}
1181
		pm->pm_data = data;
1182
		pm->pm_length = len;
1183
		SIMPLEQ_INSERT_TAIL(&pfkey_postponed, pm, pm_entry);
1184
		evtimer_add(&pfkey_timer_ev, &pfkey_timer_tv);
1185
	}
1186
1187
	if (datap) {
1188
		*datap = data;
1189
		if (lenp)
1190
			*lenp = len;
1191
	} else
1192
		free(data);
1193
1194
	if (datap == NULL && hdr.sadb_msg_errno != 0) {
1195
		errno = hdr.sadb_msg_errno;
1196
		if (errno != EEXIST) {
1197
			log_warn("%s: message", __func__);
1198
			return (-1);
1199
		}
1200
	}
1201
	return (0);
1202
}
1203
1204
int
1205
pfkey_flow_add(int fd, struct iked_flow *flow)
1206
{
1207
	uint8_t		 satype;
1208
1209
	if (flow->flow_loaded)
1210
		return (0);
1211
1212
	if (pfkey_map(pfkey_satype, flow->flow_saproto, &satype) == -1)
1213
		return (-1);
1214
1215
	if (pfkey_flow(fd, satype, SADB_X_ADDFLOW, flow) == -1)
1216
		return (-1);
1217
1218
	flow->flow_loaded = 1;
1219
1220
	if (flow->flow_dst.addr_af == AF_INET6) {
1221
		sadb_ipv6refcnt++;
1222
		if (sadb_ipv6refcnt == 1)
1223
			return (pfkey_block(fd, AF_INET6, SADB_X_DELFLOW));
1224
	}
1225
1226
	return (0);
1227
}
1228
1229
int
1230
pfkey_flow_delete(int fd, struct iked_flow *flow)
1231
{
1232
	uint8_t		satype;
1233
1234
	if (!flow->flow_loaded)
1235
		return (0);
1236
1237
	if (pfkey_map(pfkey_satype, flow->flow_saproto, &satype) == -1)
1238
		return (-1);
1239
1240
	if (pfkey_flow(fd, satype, SADB_X_DELFLOW, flow) == -1)
1241
		return (-1);
1242
1243
	flow->flow_loaded = 0;
1244
1245
	if (flow->flow_dst.addr_af == AF_INET6) {
1246
		sadb_ipv6refcnt--;
1247
		if (sadb_ipv6refcnt == 0)
1248
			return (pfkey_block(fd, AF_INET6, SADB_X_ADDFLOW));
1249
	}
1250
1251
	return (0);
1252
}
1253
1254
int
1255
pfkey_block(int fd, int af, unsigned int action)
1256
{
1257
	struct iked_flow	 flow;
1258
1259
	if (!pfkey_blockipv6)
1260
		return (0);
1261
1262
	/*
1263
	 * Prevent VPN traffic leakages in dual-stack hosts/networks.
1264
	 * https://tools.ietf.org/html/draft-gont-opsec-vpn-leakages.
1265
	 * We forcibly block IPv6 traffic unless it is used in any of
1266
	 * the flows by tracking a sadb_ipv6refcnt reference counter.
1267
	 */
1268
	bzero(&flow, sizeof(flow));
1269
	flow.flow_src.addr_af = flow.flow_src.addr.ss_family = af;
1270
	flow.flow_src.addr_net = 1;
1271
	socket_af((struct sockaddr *)&flow.flow_src.addr, 0);
1272
	flow.flow_dst.addr_af = flow.flow_dst.addr.ss_family = af;
1273
	flow.flow_dst.addr_net = 1;
1274
	socket_af((struct sockaddr *)&flow.flow_dst.addr, 0);
1275
	flow.flow_type = SADB_X_FLOW_TYPE_DENY;
1276
	flow.flow_dir = IPSP_DIRECTION_OUT;
1277
1278
	if (pfkey_flow(fd, 0, action, &flow) == -1)
1279
		return (-1);
1280
1281
	return (0);
1282
}
1283
1284
int
1285
pfkey_sa_init(int fd, struct iked_childsa *sa, uint32_t *spi)
1286
{
1287
	uint8_t		 satype;
1288
1289
	if (pfkey_map(pfkey_satype, sa->csa_saproto, &satype) == -1)
1290
		return (-1);
1291
1292
	if (pfkey_sa_getspi(fd, satype, sa, spi) == -1)
1293
		return (-1);
1294
1295
	log_debug("%s: new spi 0x%08x", __func__, *spi);
1296
1297
	return (0);
1298
}
1299
1300
int
1301
pfkey_sa_add(int fd, struct iked_childsa *sa, struct iked_childsa *last)
1302
{
1303
	uint8_t		 satype;
1304
	unsigned int	 cmd;
1305
1306
	if (pfkey_map(pfkey_satype, sa->csa_saproto, &satype) == -1)
1307
		return (-1);
1308
1309
	if (sa->csa_allocated || sa->csa_loaded)
1310
		cmd = SADB_UPDATE;
1311
	else
1312
		cmd = SADB_ADD;
1313
1314
	log_debug("%s: %s spi %s", __func__, cmd == SADB_ADD ? "add": "update",
1315
	    print_spi(sa->csa_spi.spi, 4));
1316
1317
	if (pfkey_sa(fd, satype, cmd, sa) == -1) {
1318
		if (cmd == SADB_ADD) {
1319
			(void)pfkey_sa_delete(fd, sa);
1320
			return (-1);
1321
		}
1322
		if (sa->csa_allocated && !sa->csa_loaded && errno == ESRCH) {
1323
			/* Needed for recoupling local SAs */
1324
			log_debug("%s: SADB_UPDATE on local SA returned ESRCH,"
1325
			    " trying SADB_ADD", __func__);
1326
			if (pfkey_sa(fd, satype, SADB_ADD, sa) == -1)
1327
				return (-1);
1328
		} else {
1329
			return (-1);
1330
		}
1331
	}
1332
1333
	if (last && cmd == SADB_ADD) {
1334
		if (pfkey_sagroup(fd, satype,
1335
		    SADB_X_GRPSPIS, sa, last) == -1) {
1336
			(void)pfkey_sa_delete(fd, sa);
1337
			return (-1);
1338
		}
1339
	}
1340
1341
	sa->csa_loaded = 1;
1342
	return (0);
1343
}
1344
1345
int
1346
pfkey_sa_delete(int fd, struct iked_childsa *sa)
1347
{
1348
	uint8_t		satype;
1349
1350
	if (!sa->csa_loaded || sa->csa_spi.spi == 0)
1351
		return (0);
1352
1353
	if (pfkey_map(pfkey_satype, sa->csa_saproto, &satype) == -1)
1354
		return (-1);
1355
1356
	if (pfkey_sa(fd, satype, SADB_DELETE, sa) == -1)
1357
		return (-1);
1358
1359
	sa->csa_loaded = 0;
1360
	return (0);
1361
}
1362
1363
int
1364
pfkey_flush(int sd)
1365
{
1366
	struct sadb_msg smsg;
1367
	struct iovec	iov[IOV_CNT];
1368
	int		iov_cnt;
1369
1370
	bzero(&smsg, sizeof(smsg));
1371
	smsg.sadb_msg_version = PF_KEY_V2;
1372
	smsg.sadb_msg_seq = ++sadb_msg_seq;
1373
	smsg.sadb_msg_pid = getpid();
1374
	smsg.sadb_msg_len = sizeof(smsg) / 8;
1375
	smsg.sadb_msg_type = SADB_FLUSH;
1376
	smsg.sadb_msg_satype = SADB_SATYPE_UNSPEC;
1377
1378
	iov_cnt = 0;
1379
1380
	iov[iov_cnt].iov_base = &smsg;
1381
	iov[iov_cnt].iov_len = sizeof(smsg);
1382
	iov_cnt++;
1383
1384
	return (pfkey_write(sd, &smsg, iov, iov_cnt, NULL, NULL));
1385
}
1386
1387
struct sadb_ident *
1388
pfkey_id2ident(struct iked_id *id, unsigned int exttype)
1389
{
1390
	char			 idstr[IKED_ID_SIZE];
1391
	unsigned int		 type;
1392
	size_t			 len;
1393
	struct sadb_ident	*sa_id;
1394
1395
	switch (id->id_type) {
1396
	case IKEV2_ID_FQDN:
1397
		type = SADB_IDENTTYPE_FQDN;
1398
		break;
1399
	case IKEV2_ID_UFQDN:
1400
		type = SADB_IDENTTYPE_USERFQDN;
1401
		break;
1402
	case IKEV2_ID_IPV4:
1403
	case IKEV2_ID_IPV6:
1404
		type = SADB_IDENTTYPE_PREFIX;
1405
		break;
1406
	case IKEV2_ID_ASN1_DN:
1407
	case IKEV2_ID_ASN1_GN:
1408
	case IKEV2_ID_KEY_ID:
1409
	case IKEV2_ID_NONE:
1410
	default:
1411
		/* XXX not implemented/supported by PFKEY */
1412
		return (NULL);
1413
	}
1414
1415
	bzero(&idstr, sizeof(idstr));
1416
1417
	if (ikev2_print_id(id, idstr, sizeof(idstr)) == -1)
1418
		return (NULL);
1419
1420
	len = ROUNDUP(strlen(idstr) + 1) + sizeof(*sa_id);
1421
	if ((sa_id = calloc(1, len)) == NULL)
1422
		return (NULL);
1423
1424
	strlcpy((char *)(sa_id + 1), idstr, ROUNDUP(strlen(idstr) + 1));
1425
	sa_id->sadb_ident_type = type;
1426
	sa_id->sadb_ident_len = len / 8;
1427
	sa_id->sadb_ident_exttype = exttype;
1428
1429
	return (sa_id);
1430
}
1431
1432
int
1433
pfkey_socket(void)
1434
{
1435
	int	 fd;
1436
1437
	if (privsep_process != PROC_PARENT)
1438
		fatal("pfkey_socket: called from unprivileged process");
1439
1440
	if ((fd = socket(PF_KEY, SOCK_RAW, PF_KEY_V2)) == -1)
1441
		fatal("pfkey_socket: failed to open PF_KEY socket");
1442
1443
	pfkey_flush(fd);
1444
1445
	return (fd);
1446
}
1447
1448
void
1449
pfkey_init(struct iked *env, int fd)
1450
{
1451
	struct sadb_msg		smsg;
1452
	struct iovec		iov;
1453
1454
	/* Set up a timer to process messages deferred by the pfkey_reply */
1455
	pfkey_timer_tv.tv_sec = 1;
1456
	pfkey_timer_tv.tv_usec = 0;
1457
	evtimer_set(&pfkey_timer_ev, pfkey_timer_cb, env);
1458
1459
	/* Register the pfkey socket event handler */
1460
	env->sc_pfkey = fd;
1461
	event_set(&env->sc_pfkeyev, env->sc_pfkey,
1462
	    EV_READ|EV_PERSIST, pfkey_dispatch, env);
1463
	event_add(&env->sc_pfkeyev, NULL);
1464
1465
	/* Register it to get ESP and AH acquires from the kernel */
1466
	bzero(&smsg, sizeof(smsg));
1467
	smsg.sadb_msg_version = PF_KEY_V2;
1468
	smsg.sadb_msg_seq = ++sadb_msg_seq;
1469
	smsg.sadb_msg_pid = getpid();
1470
	smsg.sadb_msg_len = sizeof(smsg) / 8;
1471
	smsg.sadb_msg_type = SADB_REGISTER;
1472
	smsg.sadb_msg_satype = SADB_SATYPE_ESP;
1473
1474
	iov.iov_base = &smsg;
1475
	iov.iov_len = sizeof(smsg);
1476
1477
	if (pfkey_write(fd, &smsg, &iov, 1, NULL, NULL))
1478
		fatal("pfkey_init: failed to set up ESP acquires");
1479
1480
	bzero(&smsg, sizeof(smsg));
1481
	smsg.sadb_msg_version = PF_KEY_V2;
1482
	smsg.sadb_msg_seq = ++sadb_msg_seq;
1483
	smsg.sadb_msg_pid = getpid();
1484
	smsg.sadb_msg_len = sizeof(smsg) / 8;
1485
	smsg.sadb_msg_type = SADB_REGISTER;
1486
	smsg.sadb_msg_satype = SADB_SATYPE_AH;
1487
1488
	iov.iov_base = &smsg;
1489
	iov.iov_len = sizeof(smsg);
1490
1491
	if (pfkey_write(fd, &smsg, &iov, 1, NULL, NULL))
1492
		fatal("pfkey_init: failed to set up AH acquires");
1493
1494
	if (env->sc_opts & IKED_OPT_NOIPV6BLOCKING)
1495
		return;
1496
1497
	/* Block all IPv6 traffic by default */
1498
	pfkey_blockipv6 = 1;
1499
	if (pfkey_block(fd, AF_INET6, SADB_X_ADDFLOW))
1500
		fatal("pfkey_init: failed to block IPv6 traffic");
1501
}
1502
1503
void *
1504
pfkey_find_ext(uint8_t *data, ssize_t len, int type)
1505
{
1506
	struct sadb_ext	*ext = (struct sadb_ext *)(data +
1507
	    sizeof(struct sadb_msg));
1508
1509
	while (ext && ((uint8_t *)ext - data < len)) {
1510
		if (ext->sadb_ext_type == type)
1511
			return (ext);
1512
		ext = (struct sadb_ext *)((uint8_t *)ext +
1513
		    ext->sadb_ext_len * PFKEYV2_CHUNK);
1514
	}
1515
1516
	return (NULL);
1517
}
1518
1519
void
1520
pfkey_dispatch(int sd, short event, void *arg)
1521
{
1522
	struct iked		*env = (struct iked *)arg;
1523
	struct pfkey_message	 pm, *pmp;
1524
	struct sadb_msg		 hdr;
1525
	ssize_t			 len;
1526
	uint8_t			*data;
1527
1528
	if (recv(sd, &hdr, sizeof(hdr), MSG_PEEK) != sizeof(hdr)) {
1529
		log_warn("%s: short recv", __func__);
1530
		return;
1531
	}
1532
1533
	if (hdr.sadb_msg_version != PF_KEY_V2) {
1534
		log_warnx("%s: wrong pfkey version", __func__);
1535
		return;
1536
	}
1537
1538
	if ((data = reallocarray(NULL, hdr.sadb_msg_len, PFKEYV2_CHUNK))
1539
	    == NULL) {
1540
		log_warn("%s: malloc", __func__);
1541
		return;
1542
	}
1543
	len = hdr.sadb_msg_len * PFKEYV2_CHUNK;
1544
1545
	if (read(sd, data, len) != len) {
1546
		log_warn("%s: short read", __func__);
1547
		free(data);
1548
		return;
1549
	}
1550
1551
	/* Try postponed requests first, so we do in-order processing */
1552
	if (!SIMPLEQ_EMPTY(&pfkey_postponed))
1553
		pfkey_timer_cb(0, 0, env);
1554
1555
	pm.pm_data = data;
1556
	pm.pm_length = len;
1557
1558
	if (pfkey_process(env, &pm) == -1 &&
1559
	    (pmp = calloc(1, sizeof(*pmp))) != NULL) {
1560
		pmp->pm_data = data;
1561
		pmp->pm_length = len;
1562
		log_debug("%s: pfkey_process is busy, retry later", __func__);
1563
		SIMPLEQ_INSERT_TAIL(&pfkey_postponed, pmp, pm_entry);
1564
		evtimer_add(&pfkey_timer_ev, &pfkey_timer_tv);
1565
	} else {
1566
		free(data);
1567
	}
1568
}
1569
1570
void
1571
pfkey_timer_cb(int unused, short event, void *arg)
1572
{
1573
	struct iked		*env = arg;
1574
	struct pfkey_message	*pm;
1575
1576
	SIMPLEQ_INIT(&pfkey_retry);
1577
	while (!SIMPLEQ_EMPTY(&pfkey_postponed)) {
1578
		pm = SIMPLEQ_FIRST(&pfkey_postponed);
1579
		SIMPLEQ_REMOVE_HEAD(&pfkey_postponed, pm_entry);
1580
		if (pfkey_process(env, pm) == -1) {
1581
			log_debug("%s: pfkey_process is busy, retry later",
1582
			    __func__);
1583
			SIMPLEQ_INSERT_TAIL(&pfkey_retry, pm, pm_entry);
1584
		} else {
1585
			free(pm->pm_data);
1586
			free(pm);
1587
		}
1588
	}
1589
	/* move from retry to postponed */
1590
	while ((pm = SIMPLEQ_FIRST(&pfkey_retry)) != NULL) {
1591
		SIMPLEQ_REMOVE_HEAD(&pfkey_retry, pm_entry);
1592
		SIMPLEQ_INSERT_TAIL(&pfkey_postponed, pm, pm_entry);
1593
	}
1594
	if (!SIMPLEQ_EMPTY(&pfkey_postponed))
1595
		evtimer_add(&pfkey_timer_ev, &pfkey_timer_tv);
1596
}
1597
1598
/*
1599
 * pfkey_process returns 0 if the message has been processed and -1 if
1600
 * the system is busy and the message should be passed again, later.
1601
 */
1602
int
1603
pfkey_process(struct iked *env, struct pfkey_message *pm)
1604
{
1605
	struct iked_spi		 spi;
1606
	struct sadb_sa		*sa;
1607
	struct sadb_lifetime	*sa_ltime;
1608
	struct sadb_msg		*hdr;
1609
	struct sadb_msg		 smsg;
1610
	struct iked_addr	 peer;
1611
	struct iked_flow	 flow;
1612
	struct sadb_address	*sa_addr;
1613
	struct sadb_protocol	*sa_proto;
1614
	struct sadb_x_policy	 sa_pol;
1615
	struct sockaddr		*ssrc, *sdst, *smask, *dmask, *speer;
1616
	struct iovec		 iov[IOV_CNT];
1617
	int			 ret = 0, iov_cnt, sd;
1618
	uint8_t			*reply;
1619
	ssize_t			 rlen;
1620
	const char		*errmsg = NULL;
1621
	uint8_t			*data = pm->pm_data;
1622
	ssize_t			 len = pm->pm_length;
1623
	size_t			 slen;
1624
1625
	if (!env || !data || !len)
1626
		return (0);
1627
1628
	sd = env->sc_pfkey;
1629
	hdr = (struct sadb_msg *)data;
1630
1631
	switch (hdr->sadb_msg_type) {
1632
	case SADB_ACQUIRE:
1633
		bzero(&flow, sizeof(flow));
1634
		bzero(&peer, sizeof(peer));
1635
1636
		if ((sa_addr = pfkey_find_ext(data, len,
1637
		    SADB_EXT_ADDRESS_DST)) == NULL) {
1638
			log_debug("%s: no peer address", __func__);
1639
			return (0);
1640
		}
1641
		speer = (struct sockaddr *)(sa_addr + 1);
1642
		peer.addr_af = speer->sa_family;
1643
		peer.addr_port = htons(socket_getport(speer));
1644
		if ((slen = speer->sa_len) > sizeof(peer.addr)) {
1645
			log_debug("%s: invalid peer address len", __func__);
1646
			return (0);
1647
		}
1648
		memcpy(&peer.addr, speer, slen);
1649
		if (socket_af((struct sockaddr *)&peer.addr,
1650
		    peer.addr_port) == -1) {
1651
			log_debug("%s: invalid address", __func__);
1652
			return (0);
1653
		}
1654
		flow.flow_peer = &peer;
1655
1656
		log_debug("%s: acquire request (peer %s)", __func__,
1657
		    print_host(speer, NULL, 0));
1658
1659
		/* get the matching flow */
1660
		bzero(&smsg, sizeof(smsg));
1661
		smsg.sadb_msg_version = PF_KEY_V2;
1662
		smsg.sadb_msg_seq = ++sadb_msg_seq;
1663
		smsg.sadb_msg_pid = getpid();
1664
		smsg.sadb_msg_len = sizeof(smsg) / 8;
1665
		smsg.sadb_msg_type = SADB_X_ASKPOLICY;
1666
1667
		iov_cnt = 0;
1668
1669
		iov[iov_cnt].iov_base = &smsg;
1670
		iov[iov_cnt].iov_len = sizeof(smsg);
1671
		iov_cnt++;
1672
1673
		bzero(&sa_pol, sizeof(sa_pol));
1674
		sa_pol.sadb_x_policy_exttype = SADB_X_EXT_POLICY;
1675
		sa_pol.sadb_x_policy_len = sizeof(sa_pol) / 8;
1676
		sa_pol.sadb_x_policy_seq = hdr->sadb_msg_seq;
1677
1678
		iov[iov_cnt].iov_base = &sa_pol;
1679
		iov[iov_cnt].iov_len = sizeof(sa_pol);
1680
		smsg.sadb_msg_len += sizeof(sa_pol) / 8;
1681
		iov_cnt++;
1682
1683
		if (pfkey_write(sd, &smsg, iov, iov_cnt, &reply, &rlen)) {
1684
			log_warnx("%s: failed to get a policy", __func__);
1685
			return (0);
1686
		}
1687
1688
		if ((sa_addr = pfkey_find_ext(reply, rlen,
1689
		    SADB_X_EXT_SRC_FLOW)) == NULL) {
1690
			errmsg = "flow source address";
1691
			goto out;
1692
		}
1693
		ssrc = (struct sockaddr *)(sa_addr + 1);
1694
		flow.flow_src.addr_af = ssrc->sa_family;
1695
		flow.flow_src.addr_port = htons(socket_getport(ssrc));
1696
		if ((slen = ssrc->sa_len) > sizeof(flow.flow_src.addr)) {
1697
			log_debug("%s: invalid src address len", __func__);
1698
			return (0);
1699
		}
1700
		memcpy(&flow.flow_src.addr, ssrc, slen);
1701
		if (socket_af((struct sockaddr *)&flow.flow_src.addr,
1702
		    flow.flow_src.addr_port) == -1) {
1703
			log_debug("%s: invalid address", __func__);
1704
			return (0);
1705
		}
1706
1707
		if ((sa_addr = pfkey_find_ext(reply, rlen,
1708
		    SADB_X_EXT_DST_FLOW)) == NULL) {
1709
			errmsg = "flow destination address";
1710
			goto out;
1711
		}
1712
		sdst = (struct sockaddr *)(sa_addr + 1);
1713
		flow.flow_dst.addr_af = sdst->sa_family;
1714
		flow.flow_dst.addr_port = htons(socket_getport(sdst));
1715
		if ((slen = sdst->sa_len) > sizeof(flow.flow_dst.addr)) {
1716
			log_debug("%s: invalid dst address len", __func__);
1717
			return (0);
1718
		}
1719
		memcpy(&flow.flow_dst.addr, sdst, slen);
1720
		if (socket_af((struct sockaddr *)&flow.flow_dst.addr,
1721
		    flow.flow_dst.addr_port) == -1) {
1722
			log_debug("%s: invalid address", __func__);
1723
			return (0);
1724
		}
1725
1726
		if ((sa_addr = pfkey_find_ext(reply, rlen,
1727
		    SADB_X_EXT_SRC_MASK)) == NULL) {
1728
			errmsg = "flow source mask";
1729
			goto out;
1730
		}
1731
		smask = (struct sockaddr *)(sa_addr + 1);
1732
		switch (smask->sa_family) {
1733
		case AF_INET:
1734
			flow.flow_src.addr_mask =
1735
			    mask2prefixlen((struct sockaddr *)smask);
1736
			if (flow.flow_src.addr_mask != 32)
1737
				flow.flow_src.addr_net = 1;
1738
			break;
1739
		case AF_INET6:
1740
			flow.flow_src.addr_mask =
1741
			    mask2prefixlen6((struct sockaddr *)smask);
1742
			if (flow.flow_src.addr_mask != 128)
1743
				flow.flow_src.addr_net = 1;
1744
			break;
1745
		default:
1746
			log_debug("%s: bad address family", __func__);
1747
			free(reply);
1748
			return (0);
1749
		}
1750
1751
		if ((sa_addr = pfkey_find_ext(reply, rlen,
1752
		    SADB_X_EXT_DST_MASK)) == NULL) {
1753
			errmsg = "flow destination mask";
1754
			goto out;
1755
		}
1756
		dmask = (struct sockaddr *)(sa_addr + 1);
1757
		switch (dmask->sa_family) {
1758
		case AF_INET:
1759
			flow.flow_dst.addr_mask =
1760
			    mask2prefixlen((struct sockaddr *)dmask);
1761
			if (flow.flow_src.addr_mask != 32)
1762
				flow.flow_src.addr_net = 1;
1763
			break;
1764
		case AF_INET6:
1765
			flow.flow_dst.addr_mask =
1766
			    mask2prefixlen6((struct sockaddr *)dmask);
1767
			if (flow.flow_src.addr_mask != 128)
1768
				flow.flow_src.addr_net = 1;
1769
			break;
1770
		default:
1771
			log_debug("%s: bad address family", __func__);
1772
			free(reply);
1773
			return (0);
1774
		}
1775
1776
		if ((sa_proto = pfkey_find_ext(reply, rlen,
1777
		    SADB_X_EXT_FLOW_TYPE)) == NULL) {
1778
			errmsg = "flow protocol";
1779
			goto out;
1780
		}
1781
		flow.flow_dir = sa_proto->sadb_protocol_direction;
1782
1783
		log_debug("%s: flow %s from %s/%s to %s/%s via %s", __func__,
1784
		    flow.flow_dir == IPSP_DIRECTION_IN ? "in" : "out",
1785
		    print_host(ssrc, NULL, 0), print_host(smask, NULL, 0),
1786
		    print_host(sdst, NULL, 0), print_host(dmask, NULL, 0),
1787
		    print_host(speer, NULL, 0));
1788
1789
		ret = ikev2_acquire_sa(env, &flow);
1790
1791
out:
1792
		if (errmsg)
1793
			log_warnx("%s: %s wasn't found", __func__, errmsg);
1794
		free(reply);
1795
		break;
1796
1797
	case SADB_EXPIRE:
1798
		if ((sa = pfkey_find_ext(data, len, SADB_EXT_SA)) == NULL) {
1799
			log_warnx("%s: SA extension wasn't found", __func__);
1800
			return (0);
1801
		}
1802
		if ((sa_ltime = pfkey_find_ext(data, len,
1803
			SADB_EXT_LIFETIME_SOFT)) == NULL &&
1804
		    (sa_ltime = pfkey_find_ext(data, len,
1805
			SADB_EXT_LIFETIME_HARD)) == NULL) {
1806
			log_warnx("%s: lifetime extension wasn't found",
1807
			    __func__);
1808
			return (0);
1809
		}
1810
		spi.spi = ntohl(sa->sadb_sa_spi);
1811
		spi.spi_size = 4;
1812
		switch (hdr->sadb_msg_satype) {
1813
		case SADB_SATYPE_AH:
1814
			spi.spi_protoid = IKEV2_SAPROTO_AH;
1815
			break;
1816
		case SADB_SATYPE_ESP:
1817
			spi.spi_protoid = IKEV2_SAPROTO_ESP;
1818
			break;
1819
		case SADB_X_SATYPE_IPCOMP:
1820
			spi.spi_size = 2;
1821
			spi.spi_protoid = IKEV2_SAPROTO_IPCOMP;
1822
			break;
1823
		default:
1824
			log_warnx("%s: unsupported SA type %d spi %s",
1825
			    __func__, hdr->sadb_msg_satype,
1826
			    print_spi(spi.spi, spi.spi_size));
1827
			return (0);
1828
		}
1829
1830
		log_debug("%s: SA %s is expired, pending %s", __func__,
1831
		    print_spi(spi.spi, spi.spi_size),
1832
		    sa_ltime->sadb_lifetime_exttype == SADB_EXT_LIFETIME_SOFT ?
1833
		    "rekeying" : "deletion");
1834
1835
		if (sa_ltime->sadb_lifetime_exttype == SADB_EXT_LIFETIME_SOFT)
1836
			ret = ikev2_rekey_sa(env, &spi);
1837
		else
1838
			ret = ikev2_drop_sa(env, &spi);
1839
		break;
1840
	}
1841
	return (ret);
1842
}