1 /* $FreeBSD: src/lib/libipsec/pfkey.c,v 1.1.2.2 2001/07/03 11:01:14 ume Exp $ */
2 /* $KAME: pfkey.c,v 1.39 2001/03/05 18:22:17 thorpej Exp $ */
5 * Copyright (C) 1995, 1996, 1997, 1998, and 1999 WIDE Project.
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
11 * 1. Redistributions of source code must retain the above copyright
12 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
16 * 3. Neither the name of the project nor the names of its contributors
17 * may be used to endorse or promote products derived from this software
18 * without specific prior written permission.
20 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
21 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
24 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
33 #include <sys/types.h>
34 #include <sys/param.h>
35 #include <sys/socket.h>
36 #include <net/pfkeyv2.h>
37 #include <netkey/key_var.h>
38 #include <netinet/in.h>
39 #include <netinet6/ipsec.h>
47 #include "ipsec_strerror.h"
50 #define CALLOC(size, cast) (cast)calloc(1, (size))
52 static int findsupportedmap (int);
53 static int setsupportedmap (struct sadb_supported
*);
54 static struct sadb_alg
*findsupportedalg (u_int
, u_int
);
55 static int pfkey_send_x1 (int, u_int
, u_int
, u_int
, struct sockaddr
*,
56 struct sockaddr
*, u_int32_t
, u_int32_t
, u_int
, caddr_t
,
57 u_int
, u_int
, u_int
, u_int
, u_int
, u_int32_t
, u_int32_t
,
58 u_int32_t
, u_int32_t
, u_int32_t
);
59 static int pfkey_send_x2 (int, u_int
, u_int
, u_int
,
60 struct sockaddr
*, struct sockaddr
*, u_int32_t
);
61 static int pfkey_send_x3 (int, u_int
, u_int
);
62 static int pfkey_send_x4 (int, u_int
, struct sockaddr
*, u_int
,
63 struct sockaddr
*, u_int
, u_int
, u_int64_t
, u_int64_t
,
64 char *, int, u_int32_t
);
65 static int pfkey_send_x5 (int, u_int
, u_int32_t
);
67 static caddr_t
pfkey_setsadbmsg (caddr_t
, caddr_t
, u_int
, u_int
,
68 u_int
, u_int32_t
, pid_t
);
69 static caddr_t
pfkey_setsadbsa (caddr_t
, caddr_t
, u_int32_t
, u_int
,
70 u_int
, u_int
, u_int32_t
);
71 static caddr_t
pfkey_setsadbaddr (caddr_t
, caddr_t
, u_int
,
72 struct sockaddr
*, u_int
, u_int
);
73 static caddr_t
pfkey_setsadbkey (caddr_t
, caddr_t
, u_int
, caddr_t
, u_int
);
74 static caddr_t
pfkey_setsadblifetime (caddr_t
, caddr_t
, u_int
, u_int32_t
,
75 u_int32_t
, u_int32_t
, u_int32_t
);
76 static caddr_t
pfkey_setsadbxsa2 (caddr_t
, caddr_t
, u_int32_t
, u_int32_t
);
79 * make and search supported algorithm structure.
81 static struct sadb_supported
*ipsec_supported
[] = { NULL
, NULL
, NULL
, NULL
};
83 static int supported_map
[] = {
87 SADB_X_SATYPE_TCPSIGNATURE
,
91 findsupportedmap(int satype
)
95 for (i
= 0; i
< sizeof(supported_map
)/sizeof(supported_map
[0]); i
++)
96 if (supported_map
[i
] == satype
)
101 static struct sadb_alg
*
102 findsupportedalg(u_int satype
, u_int alg_id
)
109 algno
= findsupportedmap(satype
);
111 __ipsec_errcode
= EIPSEC_INVAL_ARGUMENT
;
114 if (ipsec_supported
[algno
] == NULL
) {
115 __ipsec_errcode
= EIPSEC_DO_GET_SUPP_LIST
;
119 tlen
= ipsec_supported
[algno
]->sadb_supported_len
120 - sizeof(struct sadb_supported
);
121 p
= (caddr_t
)(ipsec_supported
[algno
] + 1);
123 if (tlen
< sizeof(struct sadb_alg
)) {
127 if (((struct sadb_alg
*)p
)->sadb_alg_id
== alg_id
)
128 return (struct sadb_alg
*)p
;
130 tlen
-= sizeof(struct sadb_alg
);
131 p
+= sizeof(struct sadb_alg
);
134 __ipsec_errcode
= EIPSEC_NOT_SUPPORTED
;
139 setsupportedmap(struct sadb_supported
*sup
)
141 struct sadb_supported
**ipsup
;
143 switch (sup
->sadb_supported_exttype
) {
144 case SADB_EXT_SUPPORTED_AUTH
:
145 ipsup
= &ipsec_supported
[findsupportedmap(SADB_SATYPE_AH
)];
147 case SADB_EXT_SUPPORTED_ENCRYPT
:
148 ipsup
= &ipsec_supported
[findsupportedmap(SADB_SATYPE_ESP
)];
151 __ipsec_errcode
= EIPSEC_INVAL_SATYPE
;
158 *ipsup
= malloc(sup
->sadb_supported_len
);
160 __ipsec_set_strerror(strerror(errno
));
163 memcpy(*ipsup
, sup
, sup
->sadb_supported_len
);
169 * check key length against algorithm specified.
170 * This function is called with SADB_EXT_SUPPORTED_{AUTH,ENCRYPT} as the
171 * augument, and only calls to ipsec_check_keylen2();
172 * keylen is the unit of bit.
178 ipsec_check_keylen(u_int supported
, u_int alg_id
, u_int keylen
)
184 case SADB_EXT_SUPPORTED_AUTH
:
185 satype
= SADB_SATYPE_AH
;
187 case SADB_EXT_SUPPORTED_ENCRYPT
:
188 satype
= SADB_SATYPE_ESP
;
191 __ipsec_errcode
= EIPSEC_INVAL_ARGUMENT
;
195 return ipsec_check_keylen2(satype
, alg_id
, keylen
);
199 * check key length against algorithm specified.
200 * satype is one of satype defined at pfkeyv2.h.
201 * keylen is the unit of bit.
207 ipsec_check_keylen2(u_int satype
, u_int alg_id
, u_int keylen
)
209 struct sadb_alg
*alg
;
211 alg
= findsupportedalg(satype
, alg_id
);
215 if (keylen
< alg
->sadb_alg_minbits
|| keylen
> alg
->sadb_alg_maxbits
) {
216 __ipsec_errcode
= EIPSEC_INVAL_KEYLEN
;
220 __ipsec_errcode
= EIPSEC_NO_ERROR
;
225 * get max/min key length against algorithm specified.
226 * satype is one of satype defined at pfkeyv2.h.
227 * keylen is the unit of bit.
233 ipsec_get_keylen(u_int supported
, u_int alg_id
, struct sadb_alg
*alg0
)
235 struct sadb_alg
*alg
;
240 __ipsec_errcode
= EIPSEC_INVAL_ARGUMENT
;
245 case SADB_EXT_SUPPORTED_AUTH
:
246 satype
= SADB_SATYPE_AH
;
248 case SADB_EXT_SUPPORTED_ENCRYPT
:
249 satype
= SADB_SATYPE_ESP
;
252 __ipsec_errcode
= EIPSEC_INVAL_ARGUMENT
;
256 alg
= findsupportedalg(satype
, alg_id
);
260 memcpy(alg0
, alg
, sizeof(*alg0
));
262 __ipsec_errcode
= EIPSEC_NO_ERROR
;
267 * set the rate for SOFT lifetime against HARD one.
268 * If rate is more than 100 or equal to zero, then set to 100.
270 static u_int soft_lifetime_allocations_rate
= PFKEY_SOFT_LIFETIME_RATE
;
271 static u_int soft_lifetime_bytes_rate
= PFKEY_SOFT_LIFETIME_RATE
;
272 static u_int soft_lifetime_addtime_rate
= PFKEY_SOFT_LIFETIME_RATE
;
273 static u_int soft_lifetime_usetime_rate
= PFKEY_SOFT_LIFETIME_RATE
;
276 pfkey_set_softrate(u_int type
, u_int rate
)
278 __ipsec_errcode
= EIPSEC_NO_ERROR
;
280 if (rate
> 100 || rate
== 0)
284 case SADB_X_LIFETIME_ALLOCATIONS
:
285 soft_lifetime_allocations_rate
= rate
;
287 case SADB_X_LIFETIME_BYTES
:
288 soft_lifetime_bytes_rate
= rate
;
290 case SADB_X_LIFETIME_ADDTIME
:
291 soft_lifetime_addtime_rate
= rate
;
293 case SADB_X_LIFETIME_USETIME
:
294 soft_lifetime_usetime_rate
= rate
;
298 __ipsec_errcode
= EIPSEC_INVAL_ARGUMENT
;
303 * get current rate for SOFT lifetime against HARD one.
304 * ATTENTION: ~0 is returned if invalid type was passed.
307 pfkey_get_softrate(u_int type
)
310 case SADB_X_LIFETIME_ALLOCATIONS
:
311 return soft_lifetime_allocations_rate
;
312 case SADB_X_LIFETIME_BYTES
:
313 return soft_lifetime_bytes_rate
;
314 case SADB_X_LIFETIME_ADDTIME
:
315 return soft_lifetime_addtime_rate
;
316 case SADB_X_LIFETIME_USETIME
:
317 return soft_lifetime_usetime_rate
;
324 * sending SADB_GETSPI message to the kernel.
326 * positive: success and return length sent.
327 * -1 : error occured, and set errno.
330 pfkey_send_getspi(int so
, u_int satype
, u_int mode
, struct sockaddr
*src
,
331 struct sockaddr
*dst
, u_int32_t min
, u_int32_t max
, u_int32_t reqid
,
334 struct sadb_msg
*newmsg
;
337 int need_spirange
= 0;
342 if (src
== NULL
|| dst
== NULL
) {
343 __ipsec_errcode
= EIPSEC_INVAL_ARGUMENT
;
346 if (src
->sa_family
!= dst
->sa_family
) {
347 __ipsec_errcode
= EIPSEC_FAMILY_MISMATCH
;
350 if (min
> max
|| (min
> 0 && min
<= 255)) {
351 __ipsec_errcode
= EIPSEC_INVAL_SPI
;
354 switch (src
->sa_family
) {
356 plen
= sizeof(struct in_addr
) << 3;
359 plen
= sizeof(struct in6_addr
) << 3;
362 __ipsec_errcode
= EIPSEC_INVAL_FAMILY
;
366 /* create new sadb_msg to send. */
367 len
= sizeof(struct sadb_msg
)
368 + sizeof(struct sadb_x_sa2
)
369 + sizeof(struct sadb_address
)
370 + PFKEY_ALIGN8(src
->sa_len
)
371 + sizeof(struct sadb_address
)
372 + PFKEY_ALIGN8(dst
->sa_len
);
374 if (min
> 255 && max
< ~0) {
376 len
+= sizeof(struct sadb_spirange
);
379 if ((newmsg
= CALLOC(len
, struct sadb_msg
*)) == NULL
) {
380 __ipsec_set_strerror(strerror(errno
));
383 ep
= ((caddr_t
)newmsg
) + len
;
385 p
= pfkey_setsadbmsg((caddr_t
)newmsg
, ep
, SADB_GETSPI
,
386 len
, satype
, seq
, getpid());
392 p
= pfkey_setsadbxsa2(p
, ep
, mode
, reqid
);
398 /* set sadb_address for source */
399 p
= pfkey_setsadbaddr(p
, ep
, SADB_EXT_ADDRESS_SRC
, src
, plen
,
406 /* set sadb_address for destination */
407 p
= pfkey_setsadbaddr(p
, ep
, SADB_EXT_ADDRESS_DST
, dst
, plen
,
414 /* proccessing spi range */
416 struct sadb_spirange spirange
;
418 if (p
+ sizeof(spirange
) > ep
) {
423 memset(&spirange
, 0, sizeof(spirange
));
424 spirange
.sadb_spirange_len
= PFKEY_UNIT64(sizeof(spirange
));
425 spirange
.sadb_spirange_exttype
= SADB_EXT_SPIRANGE
;
426 spirange
.sadb_spirange_min
= min
;
427 spirange
.sadb_spirange_max
= max
;
429 memcpy(p
, &spirange
, sizeof(spirange
));
431 p
+= sizeof(spirange
);
439 len
= pfkey_send(so
, newmsg
, len
);
445 __ipsec_errcode
= EIPSEC_NO_ERROR
;
450 * sending SADB_UPDATE message to the kernel.
451 * The length of key material is a_keylen + e_keylen.
453 * positive: success and return length sent.
454 * -1 : error occured, and set errno.
457 pfkey_send_update(int so
, u_int satype
, u_int mode
, struct sockaddr
*src
,
458 struct sockaddr
*dst
, u_int32_t spi
, u_int32_t reqid
, u_int wsize
,
459 caddr_t keymat
, u_int e_type
, u_int e_keylen
, u_int a_type
, u_int a_keylen
,
460 u_int flags
,u_int32_t l_alloc
, u_int64_t l_bytes
, u_int64_t l_addtime
,
461 u_int64_t l_usetime
, u_int32_t seq
)
464 if ((len
= pfkey_send_x1(so
, SADB_UPDATE
, satype
, mode
, src
, dst
, spi
,
466 keymat
, e_type
, e_keylen
, a_type
, a_keylen
, flags
,
467 l_alloc
, l_bytes
, l_addtime
, l_usetime
, seq
)) < 0)
474 * sending SADB_ADD message to the kernel.
475 * The length of key material is a_keylen + e_keylen.
477 * positive: success and return length sent.
478 * -1 : error occured, and set errno.
481 pfkey_send_add(int so
, u_int satype
, u_int mode
, struct sockaddr
*src
,
482 struct sockaddr
*dst
, u_int32_t spi
, u_int32_t reqid
, u_int wsize
,
483 caddr_t keymat
, u_int e_type
, u_int e_keylen
, u_int a_type
, u_int a_keylen
,
484 u_int flags
, u_int32_t l_alloc
, u_int64_t l_bytes
, u_int64_t l_addtime
,
485 u_int64_t l_usetime
, u_int32_t seq
)
488 if ((len
= pfkey_send_x1(so
, SADB_ADD
, satype
, mode
, src
, dst
, spi
,
490 keymat
, e_type
, e_keylen
, a_type
, a_keylen
, flags
,
491 l_alloc
, l_bytes
, l_addtime
, l_usetime
, seq
)) < 0)
498 * sending SADB_DELETE message to the kernel.
500 * positive: success and return length sent.
501 * -1 : error occured, and set errno.
504 pfkey_send_delete(int so
, u_int satype
, u_int mode
, struct sockaddr
*src
,
505 struct sockaddr
*dst
, u_int32_t spi
)
508 if ((len
= pfkey_send_x2(so
, SADB_DELETE
, satype
, mode
, src
, dst
, spi
)) < 0)
515 * sending SADB_DELETE without spi to the kernel. This is
516 * the "delete all" request (an extension also present in
520 * positive: success and return length sent
521 * -1 : error occured, and set errno
524 pfkey_send_delete_all(int so
, u_int satype
, u_int mode
, struct sockaddr
*src
,
525 struct sockaddr
*dst
)
527 struct sadb_msg
*newmsg
;
534 if (src
== NULL
|| dst
== NULL
) {
535 __ipsec_errcode
= EIPSEC_INVAL_ARGUMENT
;
538 if (src
->sa_family
!= dst
->sa_family
) {
539 __ipsec_errcode
= EIPSEC_FAMILY_MISMATCH
;
542 switch (src
->sa_family
) {
544 plen
= sizeof(struct in_addr
) << 3;
547 plen
= sizeof(struct in6_addr
) << 3;
550 __ipsec_errcode
= EIPSEC_INVAL_FAMILY
;
554 /* create new sadb_msg to reply. */
555 len
= sizeof(struct sadb_msg
)
556 + sizeof(struct sadb_address
)
557 + PFKEY_ALIGN8(src
->sa_len
)
558 + sizeof(struct sadb_address
)
559 + PFKEY_ALIGN8(dst
->sa_len
);
561 if ((newmsg
= CALLOC(len
, struct sadb_msg
*)) == NULL
) {
562 __ipsec_set_strerror(strerror(errno
));
565 ep
= ((caddr_t
)newmsg
) + len
;
567 p
= pfkey_setsadbmsg((caddr_t
)newmsg
, ep
, SADB_DELETE
, len
, satype
, 0,
573 p
= pfkey_setsadbaddr(p
, ep
, SADB_EXT_ADDRESS_SRC
, src
, plen
,
579 p
= pfkey_setsadbaddr(p
, ep
, SADB_EXT_ADDRESS_DST
, dst
, plen
,
587 len
= pfkey_send(so
, newmsg
, len
);
593 __ipsec_errcode
= EIPSEC_NO_ERROR
;
598 * sending SADB_GET message to the kernel.
600 * positive: success and return length sent.
601 * -1 : error occured, and set errno.
604 pfkey_send_get(int so
, u_int satype
, u_int mode
, struct sockaddr
*src
,
605 struct sockaddr
*dst
, u_int32_t spi
)
608 if ((len
= pfkey_send_x2(so
, SADB_GET
, satype
, mode
, src
, dst
, spi
)) < 0)
615 * sending SADB_REGISTER message to the kernel.
617 * positive: success and return length sent.
618 * -1 : error occured, and set errno.
621 pfkey_send_register(int so
, u_int satype
)
625 if (satype
== PF_UNSPEC
) {
627 algno
< sizeof(supported_map
)/sizeof(supported_map
[0]);
629 if (ipsec_supported
[algno
]) {
630 free(ipsec_supported
[algno
]);
631 ipsec_supported
[algno
] = NULL
;
635 algno
= findsupportedmap(satype
);
637 __ipsec_errcode
= EIPSEC_INVAL_ARGUMENT
;
641 if (ipsec_supported
[algno
]) {
642 free(ipsec_supported
[algno
]);
643 ipsec_supported
[algno
] = NULL
;
647 if ((len
= pfkey_send_x3(so
, SADB_REGISTER
, satype
)) < 0)
654 * receiving SADB_REGISTER message from the kernel, and copy buffer for
655 * sadb_supported returned into ipsec_supported.
657 * 0: success and return length sent.
658 * -1: error occured, and set errno.
661 pfkey_recv_register(int so
)
663 pid_t pid
= getpid();
664 struct sadb_msg
*newmsg
;
667 /* receive message */
669 if ((newmsg
= pfkey_recv(so
)) == NULL
)
671 } while (newmsg
->sadb_msg_type
!= SADB_REGISTER
672 || newmsg
->sadb_msg_pid
!= pid
);
675 newmsg
->sadb_msg_len
= PFKEY_UNUNIT64(newmsg
->sadb_msg_len
);
677 error
= pfkey_set_supported(newmsg
, newmsg
->sadb_msg_len
);
681 __ipsec_errcode
= EIPSEC_NO_ERROR
;
687 * receiving SADB_REGISTER message from the kernel, and copy buffer for
688 * sadb_supported returned into ipsec_supported.
689 * NOTE: sadb_msg_len must be host order.
691 * tlen: msg length, it's to makeing sure.
693 * 0: success and return length sent.
694 * -1: error occured, and set errno.
697 pfkey_set_supported(struct sadb_msg
*msg
, int tlen
)
699 struct sadb_supported
*sup
;
704 if (msg
->sadb_msg_len
!= tlen
) {
705 __ipsec_errcode
= EIPSEC_INVAL_ARGUMENT
;
712 p
+= sizeof(struct sadb_msg
);
715 sup
= (struct sadb_supported
*)p
;
716 if (ep
< p
+ sizeof(*sup
) ||
717 PFKEY_EXTLEN(sup
) < sizeof(*sup
) ||
718 ep
< p
+ sup
->sadb_supported_len
) {
723 switch (sup
->sadb_supported_exttype
) {
724 case SADB_EXT_SUPPORTED_AUTH
:
725 case SADB_EXT_SUPPORTED_ENCRYPT
:
728 __ipsec_errcode
= EIPSEC_INVAL_SATYPE
;
733 sup
->sadb_supported_len
= PFKEY_EXTLEN(sup
);
735 /* set supported map */
736 if (setsupportedmap(sup
) != 0)
739 p
+= sup
->sadb_supported_len
;
743 __ipsec_errcode
= EIPSEC_INVAL_SATYPE
;
747 __ipsec_errcode
= EIPSEC_NO_ERROR
;
753 * sending SADB_FLUSH message to the kernel.
755 * positive: success and return length sent.
756 * -1 : error occured, and set errno.
759 pfkey_send_flush(int so
, u_int satype
)
763 if ((len
= pfkey_send_x3(so
, SADB_FLUSH
, satype
)) < 0)
770 * sending SADB_DUMP message to the kernel.
772 * positive: success and return length sent.
773 * -1 : error occured, and set errno.
776 pfkey_send_dump(int so
, u_int satype
)
780 if ((len
= pfkey_send_x3(so
, SADB_DUMP
, satype
)) < 0)
787 * sending SADB_X_PROMISC message to the kernel.
788 * NOTE that this function handles promisc mode toggle only.
790 * flag: set promisc off if zero, set promisc on if non-zero.
792 * positive: success and return length sent.
793 * -1 : error occured, and set errno.
794 * 0 : error occured, and set errno.
795 * others: a pointer to new allocated buffer in which supported
799 pfkey_send_promisc_toggle(int so
, int flag
)
803 if ((len
= pfkey_send_x3(so
, SADB_X_PROMISC
, (flag
? 1 : 0))) < 0)
810 * sending SADB_X_SPDADD message to the kernel.
812 * positive: success and return length sent.
813 * -1 : error occured, and set errno.
816 pfkey_send_spdadd(int so
, struct sockaddr
*src
, u_int prefs
,
817 struct sockaddr
*dst
, u_int prefd
, u_int proto
, caddr_t policy
,
818 int policylen
, u_int32_t seq
)
822 if ((len
= pfkey_send_x4(so
, SADB_X_SPDADD
,
823 src
, prefs
, dst
, prefd
, proto
,
825 policy
, policylen
, seq
)) < 0)
832 * sending SADB_X_SPDADD message to the kernel.
834 * positive: success and return length sent.
835 * -1 : error occured, and set errno.
838 pfkey_send_spdadd2(int so
, struct sockaddr
*src
, u_int prefs
,
839 struct sockaddr
*dst
, u_int prefd
, u_int proto
, u_int64_t ltime
,
840 u_int64_t vtime
, caddr_t policy
, int policylen
, u_int32_t seq
)
844 if ((len
= pfkey_send_x4(so
, SADB_X_SPDADD
,
845 src
, prefs
, dst
, prefd
, proto
,
847 policy
, policylen
, seq
)) < 0)
854 * sending SADB_X_SPDUPDATE message to the kernel.
856 * positive: success and return length sent.
857 * -1 : error occured, and set errno.
860 pfkey_send_spdupdate(int so
, struct sockaddr
*src
, u_int prefs
,
861 struct sockaddr
*dst
, u_int prefd
, u_int proto
, caddr_t policy
,
862 int policylen
, u_int32_t seq
)
866 if ((len
= pfkey_send_x4(so
, SADB_X_SPDUPDATE
,
867 src
, prefs
, dst
, prefd
, proto
,
869 policy
, policylen
, seq
)) < 0)
876 * sending SADB_X_SPDUPDATE message to the kernel.
878 * positive: success and return length sent.
879 * -1 : error occured, and set errno.
882 pfkey_send_spdupdate2(int so
, struct sockaddr
*src
, u_int prefs
,
883 struct sockaddr
*dst
, u_int prefd
, u_int proto
, u_int64_t ltime
,
884 u_int64_t vtime
, caddr_t policy
, int policylen
, u_int32_t seq
)
888 if ((len
= pfkey_send_x4(so
, SADB_X_SPDUPDATE
,
889 src
, prefs
, dst
, prefd
, proto
,
891 policy
, policylen
, seq
)) < 0)
898 * sending SADB_X_SPDDELETE message to the kernel.
900 * positive: success and return length sent.
901 * -1 : error occured, and set errno.
904 pfkey_send_spddelete(int so
, struct sockaddr
*src
, u_int prefs
,
905 struct sockaddr
*dst
, u_int prefd
, u_int proto
, caddr_t policy
,
906 int policylen
, u_int32_t seq
)
910 if (policylen
!= sizeof(struct sadb_x_policy
)) {
911 __ipsec_errcode
= EIPSEC_INVAL_ARGUMENT
;
915 if ((len
= pfkey_send_x4(so
, SADB_X_SPDDELETE
,
916 src
, prefs
, dst
, prefd
, proto
,
918 policy
, policylen
, seq
)) < 0)
925 * sending SADB_X_SPDDELETE message to the kernel.
927 * positive: success and return length sent.
928 * -1 : error occured, and set errno.
931 pfkey_send_spddelete2(int so
, u_int32_t spid
)
935 if ((len
= pfkey_send_x5(so
, SADB_X_SPDDELETE2
, spid
)) < 0)
942 * sending SADB_X_SPDGET message to the kernel.
944 * positive: success and return length sent.
945 * -1 : error occured, and set errno.
948 pfkey_send_spdget(int so
, u_int32_t spid
)
952 if ((len
= pfkey_send_x5(so
, SADB_X_SPDGET
, spid
)) < 0)
959 * sending SADB_X_SPDSETIDX message to the kernel.
961 * positive: success and return length sent.
962 * -1 : error occured, and set errno.
965 pfkey_send_spdsetidx(int so
, struct sockaddr
*src
, u_int prefs
,
966 struct sockaddr
*dst
, u_int prefd
, u_int proto
, caddr_t policy
,
967 int policylen
, u_int32_t seq
)
971 if (policylen
!= sizeof(struct sadb_x_policy
)) {
972 __ipsec_errcode
= EIPSEC_INVAL_ARGUMENT
;
976 if ((len
= pfkey_send_x4(so
, SADB_X_SPDSETIDX
,
977 src
, prefs
, dst
, prefd
, proto
,
979 policy
, policylen
, seq
)) < 0)
986 * sending SADB_SPDFLUSH message to the kernel.
988 * positive: success and return length sent.
989 * -1 : error occured, and set errno.
992 pfkey_send_spdflush(int so
)
996 if ((len
= pfkey_send_x3(so
, SADB_X_SPDFLUSH
, SADB_SATYPE_UNSPEC
)) < 0)
1003 * sending SADB_SPDDUMP message to the kernel.
1005 * positive: success and return length sent.
1006 * -1 : error occured, and set errno.
1009 pfkey_send_spddump(int so
)
1013 if ((len
= pfkey_send_x3(so
, SADB_X_SPDDUMP
, SADB_SATYPE_UNSPEC
)) < 0)
1019 /* sending SADB_ADD or SADB_UPDATE message to the kernel */
1021 pfkey_send_x1(int so
, u_int type
, u_int satype
, u_int mode
,
1022 struct sockaddr
*src
, struct sockaddr
*dst
, u_int32_t spi
, u_int32_t reqid
,
1023 u_int wsize
, caddr_t keymat
, u_int e_type
, u_int e_keylen
, u_int a_type
,
1024 u_int a_keylen
, u_int flags
,u_int32_t l_alloc
, u_int32_t l_bytes
,
1025 u_int32_t l_addtime
, u_int32_t l_usetime
, u_int32_t seq
)
1027 struct sadb_msg
*newmsg
;
1033 /* validity check */
1034 if (src
== NULL
|| dst
== NULL
) {
1035 __ipsec_errcode
= EIPSEC_INVAL_ARGUMENT
;
1038 if (src
->sa_family
!= dst
->sa_family
) {
1039 __ipsec_errcode
= EIPSEC_FAMILY_MISMATCH
;
1042 switch (src
->sa_family
) {
1044 plen
= sizeof(struct in_addr
) << 3;
1047 plen
= sizeof(struct in6_addr
) << 3;
1050 __ipsec_errcode
= EIPSEC_INVAL_FAMILY
;
1055 case SADB_SATYPE_ESP
:
1056 if (e_type
== SADB_EALG_NONE
) {
1057 __ipsec_errcode
= EIPSEC_NO_ALGS
;
1061 case SADB_SATYPE_AH
:
1062 if (e_type
!= SADB_EALG_NONE
) {
1063 __ipsec_errcode
= EIPSEC_INVAL_ALGS
;
1066 if (a_type
== SADB_AALG_NONE
) {
1067 __ipsec_errcode
= EIPSEC_NO_ALGS
;
1071 case SADB_X_SATYPE_IPCOMP
:
1072 if (e_type
== SADB_X_CALG_NONE
) {
1073 __ipsec_errcode
= EIPSEC_INVAL_ALGS
;
1076 if (a_type
!= SADB_AALG_NONE
) {
1077 __ipsec_errcode
= EIPSEC_NO_ALGS
;
1081 case SADB_X_SATYPE_TCPSIGNATURE
:
1082 if (e_type
!= SADB_EALG_NONE
) {
1083 __ipsec_errcode
= EIPSEC_INVAL_ALGS
;
1086 if (a_type
!= SADB_X_AALG_TCP_MD5
) {
1087 __ipsec_errcode
= EIPSEC_INVAL_ALGS
;
1092 __ipsec_errcode
= EIPSEC_INVAL_SATYPE
;
1096 /* create new sadb_msg to reply. */
1097 len
= sizeof(struct sadb_msg
)
1098 + sizeof(struct sadb_sa
)
1099 + sizeof(struct sadb_x_sa2
)
1100 + sizeof(struct sadb_address
)
1101 + PFKEY_ALIGN8(src
->sa_len
)
1102 + sizeof(struct sadb_address
)
1103 + PFKEY_ALIGN8(dst
->sa_len
)
1104 + sizeof(struct sadb_lifetime
)
1105 + sizeof(struct sadb_lifetime
);
1107 if (e_type
!= SADB_EALG_NONE
)
1108 len
+= (sizeof(struct sadb_key
) + PFKEY_ALIGN8(e_keylen
));
1109 if (a_type
!= SADB_AALG_NONE
)
1110 len
+= (sizeof(struct sadb_key
) + PFKEY_ALIGN8(a_keylen
));
1112 if ((newmsg
= CALLOC(len
, struct sadb_msg
*)) == NULL
) {
1113 __ipsec_set_strerror(strerror(errno
));
1116 ep
= ((caddr_t
)newmsg
) + len
;
1118 p
= pfkey_setsadbmsg((caddr_t
)newmsg
, ep
, type
, len
,
1119 satype
, seq
, getpid());
1124 p
= pfkey_setsadbsa(p
, ep
, spi
, wsize
, a_type
, e_type
, flags
);
1129 p
= pfkey_setsadbxsa2(p
, ep
, mode
, reqid
);
1134 p
= pfkey_setsadbaddr(p
, ep
, SADB_EXT_ADDRESS_SRC
, src
, plen
,
1140 p
= pfkey_setsadbaddr(p
, ep
, SADB_EXT_ADDRESS_DST
, dst
, plen
,
1147 if (e_type
!= SADB_EALG_NONE
) {
1148 p
= pfkey_setsadbkey(p
, ep
, SADB_EXT_KEY_ENCRYPT
,
1155 if (a_type
!= SADB_AALG_NONE
) {
1156 p
= pfkey_setsadbkey(p
, ep
, SADB_EXT_KEY_AUTH
,
1157 keymat
+ e_keylen
, a_keylen
);
1164 /* set sadb_lifetime for destination */
1165 p
= pfkey_setsadblifetime(p
, ep
, SADB_EXT_LIFETIME_HARD
,
1166 l_alloc
, l_bytes
, l_addtime
, l_usetime
);
1171 p
= pfkey_setsadblifetime(p
, ep
, SADB_EXT_LIFETIME_SOFT
,
1172 l_alloc
, l_bytes
, l_addtime
, l_usetime
);
1173 if (!p
|| p
!= ep
) {
1179 len
= pfkey_send(so
, newmsg
, len
);
1185 __ipsec_errcode
= EIPSEC_NO_ERROR
;
1189 /* sending SADB_DELETE or SADB_GET message to the kernel */
1191 pfkey_send_x2(int so
, u_int type
, u_int satype
, u_int mode
,
1192 struct sockaddr
*src
, struct sockaddr
*dst
, u_int32_t spi
)
1194 struct sadb_msg
*newmsg
;
1200 /* validity check */
1201 if (src
== NULL
|| dst
== NULL
) {
1202 __ipsec_errcode
= EIPSEC_INVAL_ARGUMENT
;
1205 if (src
->sa_family
!= dst
->sa_family
) {
1206 __ipsec_errcode
= EIPSEC_FAMILY_MISMATCH
;
1209 switch (src
->sa_family
) {
1211 plen
= sizeof(struct in_addr
) << 3;
1214 plen
= sizeof(struct in6_addr
) << 3;
1217 __ipsec_errcode
= EIPSEC_INVAL_FAMILY
;
1221 /* create new sadb_msg to reply. */
1222 len
= sizeof(struct sadb_msg
)
1223 + sizeof(struct sadb_sa
)
1224 + sizeof(struct sadb_address
)
1225 + PFKEY_ALIGN8(src
->sa_len
)
1226 + sizeof(struct sadb_address
)
1227 + PFKEY_ALIGN8(dst
->sa_len
);
1229 if ((newmsg
= CALLOC(len
, struct sadb_msg
*)) == NULL
) {
1230 __ipsec_set_strerror(strerror(errno
));
1233 ep
= ((caddr_t
)newmsg
) + len
;
1235 p
= pfkey_setsadbmsg((caddr_t
)newmsg
, ep
, type
, len
, satype
, 0,
1241 p
= pfkey_setsadbsa(p
, ep
, spi
, 0, 0, 0, 0);
1246 p
= pfkey_setsadbaddr(p
, ep
, SADB_EXT_ADDRESS_SRC
, src
, plen
,
1252 p
= pfkey_setsadbaddr(p
, ep
, SADB_EXT_ADDRESS_DST
, dst
, plen
,
1254 if (!p
|| p
!= ep
) {
1260 len
= pfkey_send(so
, newmsg
, len
);
1266 __ipsec_errcode
= EIPSEC_NO_ERROR
;
1271 * sending SADB_REGISTER, SADB_FLUSH, SADB_DUMP or SADB_X_PROMISC message
1275 pfkey_send_x3(int so
, u_int type
, u_int satype
)
1277 struct sadb_msg
*newmsg
;
1282 /* validity check */
1284 case SADB_X_PROMISC
:
1285 if (satype
!= 0 && satype
!= 1) {
1286 __ipsec_errcode
= EIPSEC_INVAL_SATYPE
;
1292 case SADB_SATYPE_UNSPEC
:
1293 case SADB_SATYPE_AH
:
1294 case SADB_SATYPE_ESP
:
1295 case SADB_X_SATYPE_IPCOMP
:
1296 case SADB_X_SATYPE_TCPSIGNATURE
:
1299 __ipsec_errcode
= EIPSEC_INVAL_SATYPE
;
1304 /* create new sadb_msg to send. */
1305 len
= sizeof(struct sadb_msg
);
1307 if ((newmsg
= CALLOC(len
, struct sadb_msg
*)) == NULL
) {
1308 __ipsec_set_strerror(strerror(errno
));
1311 ep
= ((caddr_t
)newmsg
) + len
;
1313 p
= pfkey_setsadbmsg((caddr_t
)newmsg
, ep
, type
, len
, satype
, 0,
1315 if (!p
|| p
!= ep
) {
1321 len
= pfkey_send(so
, newmsg
, len
);
1327 __ipsec_errcode
= EIPSEC_NO_ERROR
;
1331 /* sending SADB_X_SPDADD message to the kernel */
1333 pfkey_send_x4(int so
, u_int type
, struct sockaddr
*src
, u_int prefs
,
1334 struct sockaddr
*dst
, u_int prefd
, u_int proto
, u_int64_t ltime
,
1335 u_int64_t vtime
, char *policy
, int policylen
, u_int32_t seq
)
1337 struct sadb_msg
*newmsg
;
1343 /* validity check */
1344 if (src
== NULL
|| dst
== NULL
) {
1345 __ipsec_errcode
= EIPSEC_INVAL_ARGUMENT
;
1348 if (src
->sa_family
!= dst
->sa_family
) {
1349 __ipsec_errcode
= EIPSEC_FAMILY_MISMATCH
;
1353 switch (src
->sa_family
) {
1355 plen
= sizeof(struct in_addr
) << 3;
1358 plen
= sizeof(struct in6_addr
) << 3;
1361 __ipsec_errcode
= EIPSEC_INVAL_FAMILY
;
1364 if (prefs
> plen
|| prefd
> plen
) {
1365 __ipsec_errcode
= EIPSEC_INVAL_PREFIXLEN
;
1369 /* create new sadb_msg to reply. */
1370 len
= sizeof(struct sadb_msg
)
1371 + sizeof(struct sadb_address
)
1372 + PFKEY_ALIGN8(src
->sa_len
)
1373 + sizeof(struct sadb_address
)
1374 + PFKEY_ALIGN8(src
->sa_len
)
1375 + sizeof(struct sadb_lifetime
)
1378 if ((newmsg
= CALLOC(len
, struct sadb_msg
*)) == NULL
) {
1379 __ipsec_set_strerror(strerror(errno
));
1382 ep
= ((caddr_t
)newmsg
) + len
;
1384 p
= pfkey_setsadbmsg((caddr_t
)newmsg
, ep
, type
, len
,
1385 SADB_SATYPE_UNSPEC
, seq
, getpid());
1390 p
= pfkey_setsadbaddr(p
, ep
, SADB_EXT_ADDRESS_SRC
, src
, prefs
, proto
);
1395 p
= pfkey_setsadbaddr(p
, ep
, SADB_EXT_ADDRESS_DST
, dst
, prefd
, proto
);
1400 p
= pfkey_setsadblifetime(p
, ep
, SADB_EXT_LIFETIME_HARD
,
1401 0, 0, ltime
, vtime
);
1402 if (!p
|| p
+ policylen
!= ep
) {
1406 memcpy(p
, policy
, policylen
);
1409 len
= pfkey_send(so
, newmsg
, len
);
1415 __ipsec_errcode
= EIPSEC_NO_ERROR
;
1419 /* sending SADB_X_SPDGET or SADB_X_SPDDELETE message to the kernel */
1421 pfkey_send_x5(int so
, u_int type
, u_int32_t spid
)
1423 struct sadb_msg
*newmsg
;
1424 struct sadb_x_policy xpl
;
1429 /* create new sadb_msg to reply. */
1430 len
= sizeof(struct sadb_msg
)
1433 if ((newmsg
= CALLOC(len
, struct sadb_msg
*)) == NULL
) {
1434 __ipsec_set_strerror(strerror(errno
));
1437 ep
= ((caddr_t
)newmsg
) + len
;
1439 p
= pfkey_setsadbmsg((caddr_t
)newmsg
, ep
, type
, len
,
1440 SADB_SATYPE_UNSPEC
, 0, getpid());
1446 if (p
+ sizeof(xpl
) != ep
) {
1450 memset(&xpl
, 0, sizeof(xpl
));
1451 xpl
.sadb_x_policy_len
= PFKEY_UNUNIT64(sizeof(xpl
));
1452 xpl
.sadb_x_policy_exttype
= SADB_X_EXT_POLICY
;
1453 xpl
.sadb_x_policy_id
= spid
;
1454 memcpy(p
, &xpl
, sizeof(xpl
));
1457 len
= pfkey_send(so
, newmsg
, len
);
1463 __ipsec_errcode
= EIPSEC_NO_ERROR
;
1471 * others : success and return value of socket.
1477 const int bufsiz
= 128 * 1024; /*is 128K enough?*/
1479 if ((so
= socket(PF_KEY
, SOCK_RAW
, PF_KEY_V2
)) < 0) {
1480 __ipsec_set_strerror(strerror(errno
));
1485 * This is a temporary workaround for KAME PR 154.
1486 * Don't really care even if it fails.
1488 (void)setsockopt(so
, SOL_SOCKET
, SO_SNDBUF
, &bufsiz
, sizeof(bufsiz
));
1489 (void)setsockopt(so
, SOL_SOCKET
, SO_RCVBUF
, &bufsiz
, sizeof(bufsiz
));
1491 __ipsec_errcode
= EIPSEC_NO_ERROR
;
1506 __ipsec_errcode
= EIPSEC_NO_ERROR
;
1511 * receive sadb_msg data, and return pointer to new buffer allocated.
1512 * Must free this buffer later.
1514 * NULL : error occured.
1515 * others : a pointer to sadb_msg structure.
1517 * XXX should be rewritten to pass length explicitly
1522 struct sadb_msg buf
, *newmsg
;
1525 while ((len
= recv(so
, (caddr_t
)&buf
, sizeof(buf
), MSG_PEEK
)) < 0) {
1528 __ipsec_set_strerror(strerror(errno
));
1532 if (len
< sizeof(buf
)) {
1533 recv(so
, (caddr_t
)&buf
, sizeof(buf
), 0);
1534 __ipsec_errcode
= EIPSEC_MAX
;
1538 /* read real message */
1539 reallen
= PFKEY_UNUNIT64(buf
.sadb_msg_len
);
1540 if ((newmsg
= CALLOC(reallen
, struct sadb_msg
*)) == NULL
) {
1541 __ipsec_set_strerror(strerror(errno
));
1545 while ((len
= recv(so
, (caddr_t
)newmsg
, reallen
, 0)) < 0) {
1548 __ipsec_set_strerror(strerror(errno
));
1553 if (len
!= reallen
) {
1554 __ipsec_errcode
= EIPSEC_SYSTEM_ERROR
;
1559 /* don't trust what the kernel says, validate! */
1560 if (PFKEY_UNUNIT64(newmsg
->sadb_msg_len
) != len
) {
1561 __ipsec_errcode
= EIPSEC_SYSTEM_ERROR
;
1566 __ipsec_errcode
= EIPSEC_NO_ERROR
;
1571 * send message to a socket.
1573 * others: success and return length sent.
1577 pfkey_send(int so
, struct sadb_msg
*msg
, int len
)
1579 if ((len
= send(so
, (caddr_t
)msg
, len
, 0)) < 0) {
1580 __ipsec_set_strerror(strerror(errno
));
1584 __ipsec_errcode
= EIPSEC_NO_ERROR
;
1590 * NOTE: These functions are derived from netkey/key.c in KAME.
1593 * set the pointer to each header in this message buffer.
1594 * IN: msg: pointer to message buffer.
1595 * mhp: pointer to the buffer initialized like below:
1596 * caddr_t mhp[SADB_EXT_MAX + 1];
1600 * XXX should be rewritten to obtain length explicitly
1603 pfkey_align(struct sadb_msg
*msg
, caddr_t
*mhp
)
1605 struct sadb_ext
*ext
;
1608 caddr_t ep
; /* XXX should be passed from upper layer */
1610 /* validity check */
1611 if (msg
== NULL
|| mhp
== NULL
) {
1612 __ipsec_errcode
= EIPSEC_INVAL_ARGUMENT
;
1617 for (i
= 0; i
< SADB_EXT_MAX
+ 1; i
++)
1620 mhp
[0] = (caddr_t
)msg
;
1624 ep
= p
+ PFKEY_UNUNIT64(msg
->sadb_msg_len
);
1626 /* skip base header */
1627 p
+= sizeof(struct sadb_msg
);
1630 ext
= (struct sadb_ext
*)p
;
1631 if (ep
< p
+ sizeof(*ext
) || PFKEY_EXTLEN(ext
) < sizeof(*ext
) ||
1632 ep
< p
+ PFKEY_EXTLEN(ext
)) {
1633 /* invalid format */
1637 /* duplicate check */
1638 /* XXX Are there duplication either KEY_AUTH or KEY_ENCRYPT ?*/
1639 if (mhp
[ext
->sadb_ext_type
] != NULL
) {
1640 __ipsec_errcode
= EIPSEC_INVAL_EXTTYPE
;
1645 switch (ext
->sadb_ext_type
) {
1647 case SADB_EXT_LIFETIME_CURRENT
:
1648 case SADB_EXT_LIFETIME_HARD
:
1649 case SADB_EXT_LIFETIME_SOFT
:
1650 case SADB_EXT_ADDRESS_SRC
:
1651 case SADB_EXT_ADDRESS_DST
:
1652 case SADB_EXT_ADDRESS_PROXY
:
1653 case SADB_EXT_KEY_AUTH
:
1654 /* XXX should to be check weak keys. */
1655 case SADB_EXT_KEY_ENCRYPT
:
1656 /* XXX should to be check weak keys. */
1657 case SADB_EXT_IDENTITY_SRC
:
1658 case SADB_EXT_IDENTITY_DST
:
1659 case SADB_EXT_SENSITIVITY
:
1660 case SADB_EXT_PROPOSAL
:
1661 case SADB_EXT_SUPPORTED_AUTH
:
1662 case SADB_EXT_SUPPORTED_ENCRYPT
:
1663 case SADB_EXT_SPIRANGE
:
1664 case SADB_X_EXT_POLICY
:
1665 case SADB_X_EXT_SA2
:
1666 mhp
[ext
->sadb_ext_type
] = (caddr_t
)ext
;
1669 __ipsec_errcode
= EIPSEC_INVAL_EXTTYPE
;
1673 p
+= PFKEY_EXTLEN(ext
);
1677 __ipsec_errcode
= EIPSEC_INVAL_SADBMSG
;
1681 __ipsec_errcode
= EIPSEC_NO_ERROR
;
1686 * check basic usage for sadb_msg,
1687 * NOTE: This routine is derived from netkey/key.c in KAME.
1688 * IN: msg: pointer to message buffer.
1689 * mhp: pointer to the buffer initialized like below:
1691 * caddr_t mhp[SADB_EXT_MAX + 1];
1697 pfkey_check(caddr_t
*mhp
)
1699 struct sadb_msg
*msg
;
1701 /* validity check */
1702 if (mhp
== NULL
|| mhp
[0] == NULL
) {
1703 __ipsec_errcode
= EIPSEC_INVAL_ARGUMENT
;
1707 msg
= (struct sadb_msg
*)mhp
[0];
1710 if (msg
->sadb_msg_version
!= PF_KEY_V2
) {
1711 __ipsec_errcode
= EIPSEC_INVAL_VERSION
;
1716 if (msg
->sadb_msg_type
> SADB_MAX
) {
1717 __ipsec_errcode
= EIPSEC_INVAL_MSGTYPE
;
1722 switch (msg
->sadb_msg_satype
) {
1723 case SADB_SATYPE_UNSPEC
:
1724 switch (msg
->sadb_msg_type
) {
1732 __ipsec_errcode
= EIPSEC_INVAL_SATYPE
;
1736 case SADB_SATYPE_ESP
:
1737 case SADB_SATYPE_AH
:
1738 case SADB_X_SATYPE_IPCOMP
:
1739 case SADB_X_SATYPE_TCPSIGNATURE
:
1740 switch (msg
->sadb_msg_type
) {
1742 case SADB_X_SPDDELETE
:
1744 case SADB_X_SPDDUMP
:
1745 case SADB_X_SPDFLUSH
:
1746 __ipsec_errcode
= EIPSEC_INVAL_SATYPE
;
1750 case SADB_SATYPE_RSVP
:
1751 case SADB_SATYPE_OSPFV2
:
1752 case SADB_SATYPE_RIPV2
:
1753 case SADB_SATYPE_MIP
:
1754 __ipsec_errcode
= EIPSEC_NOT_SUPPORTED
;
1756 case 1: /* XXX: What does it do ? */
1757 if (msg
->sadb_msg_type
== SADB_X_PROMISC
)
1761 __ipsec_errcode
= EIPSEC_INVAL_SATYPE
;
1765 /* check field of upper layer protocol and address family */
1766 if (mhp
[SADB_EXT_ADDRESS_SRC
] != NULL
1767 && mhp
[SADB_EXT_ADDRESS_DST
] != NULL
) {
1768 struct sadb_address
*src0
, *dst0
;
1770 src0
= (struct sadb_address
*)(mhp
[SADB_EXT_ADDRESS_SRC
]);
1771 dst0
= (struct sadb_address
*)(mhp
[SADB_EXT_ADDRESS_DST
]);
1773 if (src0
->sadb_address_proto
!= dst0
->sadb_address_proto
) {
1774 __ipsec_errcode
= EIPSEC_PROTO_MISMATCH
;
1778 if (PFKEY_ADDR_SADDR(src0
)->sa_family
1779 != PFKEY_ADDR_SADDR(dst0
)->sa_family
) {
1780 __ipsec_errcode
= EIPSEC_FAMILY_MISMATCH
;
1784 switch (PFKEY_ADDR_SADDR(src0
)->sa_family
) {
1789 __ipsec_errcode
= EIPSEC_INVAL_FAMILY
;
1794 * prefixlen == 0 is valid because there must be the case
1795 * all addresses are matched.
1799 __ipsec_errcode
= EIPSEC_NO_ERROR
;
1804 * set data into sadb_msg.
1805 * `buf' must has been allocated sufficiently.
1808 pfkey_setsadbmsg(caddr_t buf
, caddr_t lim
, u_int type
, u_int tlen
,
1809 u_int satype
, u_int32_t seq
, pid_t pid
)
1814 p
= (struct sadb_msg
*)buf
;
1815 len
= sizeof(struct sadb_msg
);
1817 if (buf
+ len
> lim
)
1821 p
->sadb_msg_version
= PF_KEY_V2
;
1822 p
->sadb_msg_type
= type
;
1823 p
->sadb_msg_errno
= 0;
1824 p
->sadb_msg_satype
= satype
;
1825 p
->sadb_msg_len
= PFKEY_UNIT64(tlen
);
1826 p
->sadb_msg_reserved
= 0;
1827 p
->sadb_msg_seq
= seq
;
1828 p
->sadb_msg_pid
= (u_int32_t
)pid
;
1834 * copy secasvar data into sadb_address.
1835 * `buf' must has been allocated sufficiently.
1838 pfkey_setsadbsa(caddr_t buf
, caddr_t lim
, u_int32_t spi
, u_int wsize
,
1839 u_int auth
, u_int enc
, u_int32_t flags
)
1844 p
= (struct sadb_sa
*)buf
;
1845 len
= sizeof(struct sadb_sa
);
1847 if (buf
+ len
> lim
)
1851 p
->sadb_sa_len
= PFKEY_UNIT64(len
);
1852 p
->sadb_sa_exttype
= SADB_EXT_SA
;
1853 p
->sadb_sa_spi
= spi
;
1854 p
->sadb_sa_replay
= wsize
;
1855 p
->sadb_sa_state
= SADB_SASTATE_LARVAL
;
1856 p
->sadb_sa_auth
= auth
;
1857 p
->sadb_sa_encrypt
= enc
;
1858 p
->sadb_sa_flags
= flags
;
1864 * set data into sadb_address.
1865 * `buf' must has been allocated sufficiently.
1866 * prefixlen is in bits.
1869 pfkey_setsadbaddr(caddr_t buf
, caddr_t lim
, u_int exttype
,
1870 struct sockaddr
*saddr
, u_int prefixlen
, u_int ul_proto
)
1872 struct sadb_address
*p
;
1875 p
= (struct sadb_address
*)buf
;
1876 len
= sizeof(struct sadb_address
) + PFKEY_ALIGN8(saddr
->sa_len
);
1878 if (buf
+ len
> lim
)
1882 p
->sadb_address_len
= PFKEY_UNIT64(len
);
1883 p
->sadb_address_exttype
= exttype
& 0xffff;
1884 p
->sadb_address_proto
= ul_proto
& 0xff;
1885 p
->sadb_address_prefixlen
= prefixlen
;
1886 p
->sadb_address_reserved
= 0;
1888 memcpy(p
+ 1, saddr
, saddr
->sa_len
);
1894 * set sadb_key structure after clearing buffer with zero.
1895 * OUT: the pointer of buf + len.
1898 pfkey_setsadbkey(caddr_t buf
, caddr_t lim
, u_int type
, caddr_t key
,
1904 p
= (struct sadb_key
*)buf
;
1905 len
= sizeof(struct sadb_key
) + PFKEY_ALIGN8(keylen
);
1907 if (buf
+ len
> lim
)
1911 p
->sadb_key_len
= PFKEY_UNIT64(len
);
1912 p
->sadb_key_exttype
= type
;
1913 p
->sadb_key_bits
= keylen
<< 3;
1914 p
->sadb_key_reserved
= 0;
1916 memcpy(p
+ 1, key
, keylen
);
1922 * set sadb_lifetime structure after clearing buffer with zero.
1923 * OUT: the pointer of buf + len.
1926 pfkey_setsadblifetime(caddr_t buf
, caddr_t lim
, u_int type
, u_int32_t l_alloc
,
1927 u_int32_t l_bytes
, u_int32_t l_addtime
, u_int32_t l_usetime
)
1929 struct sadb_lifetime
*p
;
1932 p
= (struct sadb_lifetime
*)buf
;
1933 len
= sizeof(struct sadb_lifetime
);
1935 if (buf
+ len
> lim
)
1939 p
->sadb_lifetime_len
= PFKEY_UNIT64(len
);
1940 p
->sadb_lifetime_exttype
= type
;
1943 case SADB_EXT_LIFETIME_SOFT
:
1944 p
->sadb_lifetime_allocations
1945 = (l_alloc
* soft_lifetime_allocations_rate
) /100;
1946 p
->sadb_lifetime_bytes
1947 = (l_bytes
* soft_lifetime_bytes_rate
) /100;
1948 p
->sadb_lifetime_addtime
1949 = (l_addtime
* soft_lifetime_addtime_rate
) /100;
1950 p
->sadb_lifetime_usetime
1951 = (l_usetime
* soft_lifetime_usetime_rate
) /100;
1953 case SADB_EXT_LIFETIME_HARD
:
1954 p
->sadb_lifetime_allocations
= l_alloc
;
1955 p
->sadb_lifetime_bytes
= l_bytes
;
1956 p
->sadb_lifetime_addtime
= l_addtime
;
1957 p
->sadb_lifetime_usetime
= l_usetime
;
1965 * copy secasvar data into sadb_address.
1966 * `buf' must has been allocated sufficiently.
1969 pfkey_setsadbxsa2(caddr_t buf
, caddr_t lim
, u_int32_t mode0
, u_int32_t reqid
)
1971 struct sadb_x_sa2
*p
;
1972 u_int8_t mode
= mode0
& 0xff;
1975 p
= (struct sadb_x_sa2
*)buf
;
1976 len
= sizeof(struct sadb_x_sa2
);
1978 if (buf
+ len
> lim
)
1982 p
->sadb_x_sa2_len
= PFKEY_UNIT64(len
);
1983 p
->sadb_x_sa2_exttype
= SADB_X_EXT_SA2
;
1984 p
->sadb_x_sa2_mode
= mode
;
1985 p
->sadb_x_sa2_reqid
= reqid
;