DEBUG_NO_STATIC int
pfkey_x_ext_debug_parse(struct sadb_ext *pfkey_ext)
{
int error = 0;
int i;
struct sadb_x_debug *pfkey_x_debug = (struct sadb_x_debug *)pfkey_ext;
DEBUGGING(PF_KEY_DEBUG_PARSE_FLOW,
"pfkey_x_debug_parse: enter\n");
/* sanity checks... */
if(pfkey_x_debug->sadb_x_debug_len !=
sizeof(struct sadb_x_debug) / IPSEC_PFKEYv2_ALIGN) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_x_debug_parse: "
"size wrong ext_len=%d, key_ext_len=%ld.\n",
pfkey_x_debug->sadb_x_debug_len,
sizeof(struct sadb_x_debug));
SENDERR(EINVAL);
}
for(i = 0; i < 4; i++) {
if(pfkey_x_debug->sadb_x_debug_reserved[i]) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_x_debug_parse: "
"reserved[%d]=%d must be set to zero.\n",
i, pfkey_x_debug->sadb_x_debug_reserved[i]);
SENDERR(EINVAL);
}
}
errlab:
return error;
}
DEBUG_NO_STATIC int
pfkey_sens_parse(struct sadb_ext *pfkey_ext)
{
int error = 0;
struct sadb_sens *pfkey_sens = (struct sadb_sens *)pfkey_ext;
/* sanity checks... */
if(pfkey_sens->sadb_sens_len < sizeof(struct sadb_sens) / IPSEC_PFKEYv2_ALIGN) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_sens_parse: "
"size wrong ext_len=%d, key_ext_len=%ld.\n",
pfkey_sens->sadb_sens_len,
sizeof(struct sadb_sens));
SENDERR(EINVAL);
}
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_sens_parse: "
"Sorry, I can't parse exttype=%d yet.\n",
pfkey_ext->sadb_ext_type);
#if 0
SENDERR(EINVAL); /* don't process these yet */
#endif
errlab:
return error;
}
DEBUG_NO_STATIC int
pfkey_x_ext_protocol_parse(struct sadb_ext *pfkey_ext)
{
int error = 0;
struct sadb_protocol *p = (struct sadb_protocol *)pfkey_ext;
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM, "pfkey_x_protocol_parse:\n");
/* sanity checks... */
if (p->sadb_protocol_len != sizeof(*p)/IPSEC_PFKEYv2_ALIGN) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_x_protocol_parse: size wrong ext_len=%d, key_ext_len=%d.\n",
p->sadb_protocol_len, (int)sizeof(*p));
SENDERR(EINVAL);
}
if (p->sadb_protocol_reserved2 != 0) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_protocol_parse: res=%d, must be zero.\n",
p->sadb_protocol_reserved2);
SENDERR(EINVAL);
}
errlab:
return error;
}
DEBUG_NO_STATIC int
pfkey_x_kmprivate_parse(struct sadb_ext *pfkey_ext)
{
int error = 0;
struct sadb_x_kmprivate *pfkey_x_kmprivate = (struct sadb_x_kmprivate *)pfkey_ext;
/* sanity checks... */
if(pfkey_x_kmprivate->sadb_x_kmprivate_len <
sizeof(struct sadb_x_kmprivate) / IPSEC_PFKEYv2_ALIGN) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_x_kmprivate_parse: "
"size wrong ext_len=%d, key_ext_len=%ld.\n",
pfkey_x_kmprivate->sadb_x_kmprivate_len,
sizeof(struct sadb_x_kmprivate));
SENDERR(EINVAL);
}
if(pfkey_x_kmprivate->sadb_x_kmprivate_reserved) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_x_kmprivate_parse: "
"reserved=%d must be set to zero.\n",
pfkey_x_kmprivate->sadb_x_kmprivate_reserved);
SENDERR(EINVAL);
}
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_x_kmprivate_parse: "
"Sorry, I can't parse exttype=%d yet.\n",
pfkey_ext->sadb_ext_type);
SENDERR(EINVAL); /* don't process these yet */
errlab:
return error;
}
DEBUG_NO_STATIC int
pfkey_ident_parse(struct sadb_ext *pfkey_ext)
{
int error = 0;
struct sadb_ident *pfkey_ident = (struct sadb_ident *)pfkey_ext;
/* sanity checks... */
if(pfkey_ident->sadb_ident_len < sizeof(struct sadb_ident) / IPSEC_PFKEYv2_ALIGN) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_ident_parse: "
"size wrong ext_len=%d, key_ext_len=%ld.\n",
pfkey_ident->sadb_ident_len,
sizeof(struct sadb_ident));
SENDERR(EINVAL);
}
if(pfkey_ident->sadb_ident_type > SADB_IDENTTYPE_MAX) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_ident_parse: "
"ident_type=%d out of range, must be less than %d.\n",
pfkey_ident->sadb_ident_type,
SADB_IDENTTYPE_MAX);
SENDERR(EINVAL);
}
if(pfkey_ident->sadb_ident_reserved) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_ident_parse: "
"res=%d, must be zero.\n",
pfkey_ident->sadb_ident_reserved);
SENDERR(EINVAL);
}
/* string terminator/padding must be zero */
if(pfkey_ident->sadb_ident_len > sizeof(struct sadb_ident) / IPSEC_PFKEYv2_ALIGN) {
if(*((char*)pfkey_ident + pfkey_ident->sadb_ident_len * IPSEC_PFKEYv2_ALIGN - 1)) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_ident_parse: "
"string padding must be zero, last is 0x%02x.\n",
*((char*)pfkey_ident +
pfkey_ident->sadb_ident_len * IPSEC_PFKEYv2_ALIGN - 1));
SENDERR(EINVAL);
}
}
if( ! ((pfkey_ident->sadb_ident_exttype == SADB_EXT_IDENTITY_SRC) ||
(pfkey_ident->sadb_ident_exttype == SADB_EXT_IDENTITY_DST))) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_key_parse: "
"expecting extension type IDENTITY_SRC or IDENTITY_DST, got %d.\n",
pfkey_ident->sadb_ident_exttype);
SENDERR(EINVAL);
}
errlab:
return error;
}
DEBUG_NO_STATIC int
pfkey_x_satype_parse(struct sadb_ext *pfkey_ext)
{
int error = 0;
int i;
struct sadb_x_satype *pfkey_x_satype = (struct sadb_x_satype *)pfkey_ext;
DEBUGGING(PF_KEY_DEBUG_PARSE_FLOW,
"pfkey_x_satype_parse: enter\n");
/* sanity checks... */
if(pfkey_x_satype->sadb_x_satype_len !=
sizeof(struct sadb_x_satype) / IPSEC_PFKEYv2_ALIGN) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_x_satype_parse: "
"size wrong ext_len=%d, key_ext_len=%ld.\n",
pfkey_x_satype->sadb_x_satype_len,
sizeof(struct sadb_x_satype));
SENDERR(EINVAL);
}
if(!pfkey_x_satype->sadb_x_satype_satype) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_x_satype_parse: "
"satype is zero, must be non-zero.\n");
SENDERR(EINVAL);
}
if(pfkey_x_satype->sadb_x_satype_satype > SADB_SATYPE_MAX) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_x_satype_parse: "
"satype %d > max %d, invalid.\n",
pfkey_x_satype->sadb_x_satype_satype, SADB_SATYPE_MAX);
SENDERR(EINVAL);
}
if(!(satype2proto(pfkey_x_satype->sadb_x_satype_satype))) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_x_satype_parse: "
"proto lookup from satype=%d failed.\n",
pfkey_x_satype->sadb_x_satype_satype);
SENDERR(EINVAL);
}
for(i = 0; i < 3; i++) {
if(pfkey_x_satype->sadb_x_satype_reserved[i]) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_x_satype_parse: "
"reserved[%d]=%d must be set to zero.\n",
i, pfkey_x_satype->sadb_x_satype_reserved[i]);
SENDERR(EINVAL);
}
}
errlab:
return error;
}
DEBUG_NO_STATIC int
pfkey_spirange_parse(struct sadb_ext *pfkey_ext)
{
int error = 0;
struct sadb_spirange *pfkey_spirange = (struct sadb_spirange *)pfkey_ext;
/* sanity checks... */
if(pfkey_spirange->sadb_spirange_len !=
sizeof(struct sadb_spirange) / IPSEC_PFKEYv2_ALIGN) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_spirange_parse: "
"size wrong ext_len=%d, key_ext_len=%d.\n",
pfkey_spirange->sadb_spirange_len,
(int)sizeof(struct sadb_spirange));
SENDERR(EINVAL);
}
if(pfkey_spirange->sadb_spirange_reserved) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_spirange_parse: "
"reserved=%d must be set to zero.\n",
pfkey_spirange->sadb_spirange_reserved);
SENDERR(EINVAL);
}
if(ntohl(pfkey_spirange->sadb_spirange_max) < ntohl(pfkey_spirange->sadb_spirange_min)) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_spirange_parse: "
"minspi=%08x must be < maxspi=%08x.\n",
ntohl(pfkey_spirange->sadb_spirange_min),
ntohl(pfkey_spirange->sadb_spirange_max));
SENDERR(EINVAL);
}
if(ntohl(pfkey_spirange->sadb_spirange_min) <= 255) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_spirange_parse: "
"minspi=%08x must be > 255.\n",
ntohl(pfkey_spirange->sadb_spirange_min));
SENDERR(EEXIST);
}
DEBUGGING(PF_KEY_DEBUG_PARSE_STRUCT,
"pfkey_spirange_parse: "
"ext_len=%u ext_type=%u(%s) min=%u max=%u res=%u.\n",
pfkey_spirange->sadb_spirange_len,
pfkey_spirange->sadb_spirange_exttype,
pfkey_v2_sadb_ext_string(pfkey_spirange->sadb_spirange_exttype),
pfkey_spirange->sadb_spirange_min,
pfkey_spirange->sadb_spirange_max,
pfkey_spirange->sadb_spirange_reserved);
errlab:
return error;
}
DEBUG_NO_STATIC int
pfkey_lifetime_parse(struct sadb_ext *pfkey_ext)
{
int error = 0;
struct sadb_lifetime *pfkey_lifetime = (struct sadb_lifetime *)pfkey_ext;
DEBUGGING(PF_KEY_DEBUG_PARSE_FLOW,
"pfkey_lifetime_parse:enter\n");
/* sanity checks... */
if(!pfkey_lifetime) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_lifetime_parse: "
"NULL pointer passed in.\n");
SENDERR(EINVAL);
}
if(pfkey_lifetime->sadb_lifetime_len !=
sizeof(struct sadb_lifetime) / IPSEC_PFKEYv2_ALIGN) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_lifetime_parse: "
"length wrong pfkey_lifetime->sadb_lifetime_len=%d sizeof(struct sadb_lifetime)=%d.\n",
pfkey_lifetime->sadb_lifetime_len,
(int)sizeof(struct sadb_lifetime));
SENDERR(EINVAL);
}
if((pfkey_lifetime->sadb_lifetime_exttype != K_SADB_EXT_LIFETIME_HARD) &&
(pfkey_lifetime->sadb_lifetime_exttype != K_SADB_EXT_LIFETIME_SOFT) &&
(pfkey_lifetime->sadb_lifetime_exttype != K_SADB_EXT_LIFETIME_CURRENT)) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_lifetime_parse: "
"unexpected ext_type=%d.\n",
pfkey_lifetime->sadb_lifetime_exttype);
SENDERR(EINVAL);
}
DEBUGGING(PF_KEY_DEBUG_PARSE_STRUCT,
"pfkey_lifetime_parse: "
"life_type=%d(%s) alloc=%u bytes=%u add=%u use=%u.\n",
pfkey_lifetime->sadb_lifetime_exttype,
pfkey_v2_sadb_ext_string(pfkey_lifetime->sadb_lifetime_exttype),
pfkey_lifetime->sadb_lifetime_allocations,
(unsigned)pfkey_lifetime->sadb_lifetime_bytes,
(unsigned)pfkey_lifetime->sadb_lifetime_addtime,
(unsigned)pfkey_lifetime->sadb_lifetime_usetime);
errlab:
return error;
}
DEBUG_NO_STATIC int
pfkey_spirange_parse(struct sadb_ext *pfkey_ext)
{
int error = 0;
struct sadb_spirange *pfkey_spirange = (struct sadb_spirange *)pfkey_ext;
/* sanity checks... */
if(pfkey_spirange->sadb_spirange_len !=
sizeof(struct sadb_spirange) / IPSEC_PFKEYv2_ALIGN) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_spirange_parse: "
"size wrong ext_len=%d, key_ext_len=%ld.\n",
pfkey_spirange->sadb_spirange_len,
sizeof(struct sadb_spirange));
SENDERR(EINVAL);
}
if(pfkey_spirange->sadb_spirange_reserved) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_spirange_parse: "
"reserved=%d must be set to zero.\n",
pfkey_spirange->sadb_spirange_reserved);
SENDERR(EINVAL);
}
if(ntohl(pfkey_spirange->sadb_spirange_max) < ntohl(pfkey_spirange->sadb_spirange_min)) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_spirange_parse: "
"minspi=%08lx must be < maxspi=%08lx.\n",
ntohl(pfkey_spirange->sadb_spirange_min),
ntohl(pfkey_spirange->sadb_spirange_max));
SENDERR(EINVAL);
}
if(ntohl(pfkey_spirange->sadb_spirange_min) <= 255) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_spirange_parse: "
"minspi=%08lx must be > 255.\n",
ntohl(pfkey_spirange->sadb_spirange_min));
SENDERR(EEXIST);
}
errlab:
return error;
}
int
pfkey_x_nat_t_port_process(struct sadb_ext *pfkey_ext, struct pfkey_extracted_data* extr)
{
int error = 0;
struct sadb_x_nat_t_port *pfkey_x_nat_t_port = (struct sadb_x_nat_t_port *)pfkey_ext;
if(!pfkey_x_nat_t_port) {
printk("klips_debug:pfkey_x_nat_t_port_process: "
"null pointer passed in\n");
SENDERR(EINVAL);
}
KLIPS_PRINT(debug_pfkey,
"klips_debug:pfkey_x_nat_t_port_process: %d/%d.\n",
pfkey_x_nat_t_port->sadb_x_nat_t_port_exttype,
pfkey_x_nat_t_port->sadb_x_nat_t_port_port);
if(!extr || !extr->ips) {
KLIPS_PRINT(debug_pfkey,
"klips_debug:pfkey_nat_t_type_process: "
"extr or extr->ips is NULL, fatal\n");
SENDERR(EINVAL);
}
switch(pfkey_x_nat_t_port->sadb_x_nat_t_port_exttype) {
case SADB_X_EXT_NAT_T_SPORT:
extr->ips->ips_natt_sport = pfkey_x_nat_t_port->sadb_x_nat_t_port_port;
break;
case SADB_X_EXT_NAT_T_DPORT:
extr->ips->ips_natt_dport = pfkey_x_nat_t_port->sadb_x_nat_t_port_port;
break;
default:
KLIPS_PRINT(debug_pfkey,
"klips_debug:pfkey_x_nat_t_port_process: "
"unknown exttype %d.\n",
pfkey_x_nat_t_port->sadb_x_nat_t_port_exttype);
SENDERR(EINVAL);
break;
}
errlab:
return error;
}
int
pfkey_x_nat_t_type_process(struct sadb_ext *pfkey_ext, struct pfkey_extracted_data* extr)
{
int error = 0;
struct sadb_x_nat_t_type *pfkey_x_nat_t_type = (struct sadb_x_nat_t_type *)pfkey_ext;
if(!pfkey_x_nat_t_type) {
printk("klips_debug:pfkey_x_nat_t_type_process: "
"null pointer passed in\n");
SENDERR(EINVAL);
}
KLIPS_PRINT(debug_pfkey,
"klips_debug:pfkey_x_nat_t_type_process: %d.\n",
pfkey_x_nat_t_type->sadb_x_nat_t_type_type);
if(!extr || !extr->ips) {
KLIPS_PRINT(debug_pfkey,
"klips_debug:pfkey_nat_t_type_process: "
"extr or extr->ips is NULL, fatal\n");
SENDERR(EINVAL);
}
switch(pfkey_x_nat_t_type->sadb_x_nat_t_type_type) {
case ESPINUDP_WITH_NON_IKE: /* with Non-IKE (older version) */
case ESPINUDP_WITH_NON_ESP: /* with Non-ESP */
extr->ips->ips_natt_type = pfkey_x_nat_t_type->sadb_x_nat_t_type_type;
break;
default:
KLIPS_PRINT(debug_pfkey,
"klips_debug:pfkey_x_nat_t_type_process: "
"unknown type %d.\n",
pfkey_x_nat_t_type->sadb_x_nat_t_type_type);
SENDERR(EINVAL);
break;
}
errlab:
return error;
}
int
pfkey_x_satype_process(struct sadb_ext *pfkey_ext, struct pfkey_extracted_data* extr)
{
int error = 0;
struct sadb_x_satype *pfkey_x_satype = (struct sadb_x_satype *)pfkey_ext;
KLIPS_PRINT(debug_pfkey,
"klips_debug:pfkey_x_satype_process: .\n");
if(!extr || !extr->ips) {
KLIPS_PRINT(debug_pfkey,
"klips_debug:pfkey_x_satype_process: "
"extr or extr->ips is NULL, fatal\n");
SENDERR(EINVAL);
}
if(extr->ips2 == NULL) {
extr->ips2 = ipsec_sa_alloc(&error); /* pass error var by pointer */
}
if(extr->ips2 == NULL) {
SENDERR(-error);
}
if(!(extr->ips2->ips_said.proto = satype2proto(pfkey_x_satype->sadb_x_satype_satype))) {
KLIPS_PRINT(debug_pfkey,
"klips_debug:pfkey_x_satype_process: "
"proto lookup from satype=%d failed.\n",
pfkey_x_satype->sadb_x_satype_satype);
SENDERR(EINVAL);
}
KLIPS_PRINT(debug_pfkey,
"klips_debug:pfkey_x_satype_process: "
"protocol==%d decoded from satype==%d(%s).\n",
extr->ips2->ips_said.proto,
pfkey_x_satype->sadb_x_satype_satype,
satype2name(pfkey_x_satype->sadb_x_satype_satype));
errlab:
return error;
}
int
pfkey_sens_process(struct sadb_ext *pfkey_ext, struct pfkey_extracted_data* extr)
{
int error = 0;
KLIPS_PRINT(debug_pfkey,
"klips_debug:pfkey_sens_process: "
"Sorry, I can't process exttype=%d yet.\n",
pfkey_ext->sadb_ext_type);
SENDERR(EINVAL); /* don't process these yet */
errlab:
return error;
}
DEBUG_NO_STATIC int
pfkey_lifetime_parse(struct sadb_ext *pfkey_ext)
{
int error = 0;
struct sadb_lifetime *pfkey_lifetime = (struct sadb_lifetime *)pfkey_ext;
DEBUGGING(PF_KEY_DEBUG_PARSE_FLOW,
"pfkey_lifetime_parse:enter\n");
/* sanity checks... */
if(!pfkey_lifetime) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_lifetime_parse: "
"NULL pointer passed in.\n");
SENDERR(EINVAL);
}
if(pfkey_lifetime->sadb_lifetime_len !=
sizeof(struct sadb_lifetime) / IPSEC_PFKEYv2_ALIGN) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_lifetime_parse: "
"length wrong pfkey_lifetime->sadb_lifetime_len=%d sizeof(struct sadb_lifetime)=%ld.\n",
pfkey_lifetime->sadb_lifetime_len,
sizeof(struct sadb_lifetime));
SENDERR(EINVAL);
}
if((pfkey_lifetime->sadb_lifetime_exttype != SADB_EXT_LIFETIME_HARD) &&
(pfkey_lifetime->sadb_lifetime_exttype != SADB_EXT_LIFETIME_SOFT) &&
(pfkey_lifetime->sadb_lifetime_exttype != SADB_EXT_LIFETIME_CURRENT)) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_lifetime_parse: "
"unexpected ext_type=%d.\n",
pfkey_lifetime->sadb_lifetime_exttype);
SENDERR(EINVAL);
}
errlab:
return error;
}
DEBUG_NO_STATIC int
pfkey_x_ext_saref_parse(struct sadb_ext *pfkey_ext)
{
int error = 0;
struct sadb_x_saref *p = (struct sadb_x_saref *)pfkey_ext;
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM, "pfkey_x_saref_parse:\n");
/* sanity checks... */
if (p->sadb_x_saref_len != IPSEC_PFKEYv2_WORDS(sizeof(*p))) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_x_saref_parse: size wrong ext_len=%d, key_ext_len=%d.\n",
p->sadb_x_saref_len, (int)sizeof(*p));
SENDERR(EINVAL);
}
errlab:
return error;
}
int
pfkey_x_debug_process(struct sadb_ext *pfkey_ext, struct pfkey_extracted_data* extr)
{
int error = 0;
struct sadb_x_debug *pfkey_x_debug = (struct sadb_x_debug *)pfkey_ext;
if(!pfkey_x_debug) {
printk("klips_debug:pfkey_x_debug_process: "
"null pointer passed in\n");
SENDERR(EINVAL);
}
KLIPS_PRINT(debug_pfkey,
"klips_debug:pfkey_x_debug_process: .\n");
#ifdef CONFIG_KLIPS_DEBUG
if(pfkey_x_debug->sadb_x_debug_netlink >>
(sizeof(pfkey_x_debug->sadb_x_debug_netlink) * 8 - 1)) {
pfkey_x_debug->sadb_x_debug_netlink &=
~(1 << (sizeof(pfkey_x_debug->sadb_x_debug_netlink) * 8 -1));
debug_tunnel |= pfkey_x_debug->sadb_x_debug_tunnel;
debug_netlink |= pfkey_x_debug->sadb_x_debug_netlink;
debug_xform |= pfkey_x_debug->sadb_x_debug_xform;
debug_eroute |= pfkey_x_debug->sadb_x_debug_eroute;
debug_spi |= pfkey_x_debug->sadb_x_debug_spi;
debug_radij |= pfkey_x_debug->sadb_x_debug_radij;
debug_esp |= pfkey_x_debug->sadb_x_debug_esp;
debug_ah |= pfkey_x_debug->sadb_x_debug_ah;
debug_rcv |= pfkey_x_debug->sadb_x_debug_rcv;
debug_pfkey |= pfkey_x_debug->sadb_x_debug_pfkey;
#ifdef CONFIG_KLIPS_IPCOMP
sysctl_ipsec_debug_ipcomp |= pfkey_x_debug->sadb_x_debug_ipcomp;
#endif /* CONFIG_KLIPS_IPCOMP */
sysctl_ipsec_debug_verbose |= pfkey_x_debug->sadb_x_debug_verbose;
KLIPS_PRINT(debug_pfkey,
"klips_debug:pfkey_x_debug_process: "
"set\n");
} else {
DEBUG_NO_STATIC int
pfkey_supported_parse(struct sadb_ext *pfkey_ext)
{
int error = 0;
unsigned int i, num_alg;
struct sadb_supported *pfkey_supported = (struct sadb_supported *)pfkey_ext;
struct sadb_alg *pfkey_alg = (struct sadb_alg*)((char*)pfkey_ext + sizeof(struct sadb_supported));
/* sanity checks... */
if((pfkey_supported->sadb_supported_len <
sizeof(struct sadb_supported) / IPSEC_PFKEYv2_ALIGN) ||
(((pfkey_supported->sadb_supported_len * IPSEC_PFKEYv2_ALIGN) -
sizeof(struct sadb_supported)) % sizeof(struct sadb_alg))) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_supported_parse: "
"size wrong ext_len=%d, supported_ext_len=%ld alg_ext_len=%ld.\n",
pfkey_supported->sadb_supported_len,
sizeof(struct sadb_supported),
sizeof(struct sadb_alg));
SENDERR(EINVAL);
}
if(pfkey_supported->sadb_supported_reserved) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_supported_parse: "
"res=%d, must be zero.\n",
pfkey_supported->sadb_supported_reserved);
SENDERR(EINVAL);
}
num_alg = ((pfkey_supported->sadb_supported_len * IPSEC_PFKEYv2_ALIGN) - sizeof(struct sadb_supported)) / sizeof(struct sadb_alg);
for(i = 0; i < num_alg; i++) {
/* process algo description */
if(pfkey_alg->sadb_alg_reserved) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_supported_parse: "
"alg[%d], id=%d, ivlen=%d, minbits=%d, maxbits=%d, res=%d, must be zero.\n",
i,
pfkey_alg->sadb_alg_id,
pfkey_alg->sadb_alg_ivlen,
pfkey_alg->sadb_alg_minbits,
pfkey_alg->sadb_alg_maxbits,
pfkey_alg->sadb_alg_reserved);
SENDERR(EINVAL);
}
/* XXX can alg_id auth/enc be determined from info given?
Yes, but OpenBSD's method does not iteroperate with rfc2367.
rgb, 2000-04-06 */
switch(pfkey_supported->sadb_supported_exttype) {
case SADB_EXT_SUPPORTED_AUTH:
if(pfkey_alg->sadb_alg_id > SADB_AALG_MAX) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_supported_parse: "
"alg[%d], alg_id=%d > SADB_AALG_MAX=%d, fatal.\n",
i,
pfkey_alg->sadb_alg_id,
SADB_AALG_MAX);
SENDERR(EINVAL);
}
break;
case SADB_EXT_SUPPORTED_ENCRYPT:
if(pfkey_alg->sadb_alg_id > SADB_EALG_MAX) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_supported_parse: "
"alg[%d], alg_id=%d > SADB_EALG_MAX=%d, fatal.\n",
i,
pfkey_alg->sadb_alg_id,
SADB_EALG_MAX);
SENDERR(EINVAL);
}
break;
default:
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_supported_parse: "
"alg[%d], alg_id=%d > SADB_EALG_MAX=%d, fatal.\n",
i,
pfkey_alg->sadb_alg_id,
SADB_EALG_MAX);
SENDERR(EINVAL);
}
pfkey_alg++;
}
errlab:
return error;
}
DEBUG_NO_STATIC int
pfkey_prop_parse(struct sadb_ext *pfkey_ext)
{
int error = 0;
int i, num_comb;
struct sadb_prop *pfkey_prop = (struct sadb_prop *)pfkey_ext;
struct sadb_comb *pfkey_comb = (struct sadb_comb *)((char*)pfkey_ext + sizeof(struct sadb_prop));
/* sanity checks... */
if((pfkey_prop->sadb_prop_len < sizeof(struct sadb_prop) / IPSEC_PFKEYv2_ALIGN) ||
(((pfkey_prop->sadb_prop_len * IPSEC_PFKEYv2_ALIGN) - sizeof(struct sadb_prop)) % sizeof(struct sadb_comb))) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_prop_parse: "
"size wrong ext_len=%d, prop_ext_len=%ld comb_ext_len=%ld.\n",
pfkey_prop->sadb_prop_len,
sizeof(struct sadb_prop),
sizeof(struct sadb_comb));
SENDERR(EINVAL);
}
if(pfkey_prop->sadb_prop_replay > 64) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_prop_parse: "
"replay window size: %d -- must be 0 <= size <= 64\n",
pfkey_prop->sadb_prop_replay);
SENDERR(EINVAL);
}
for(i=0; i<3; i++) {
if(pfkey_prop->sadb_prop_reserved[i]) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_prop_parse: "
"res[%d]=%d, must be zero.\n",
i, pfkey_prop->sadb_prop_reserved[i]);
SENDERR(EINVAL);
}
}
num_comb = ((pfkey_prop->sadb_prop_len * IPSEC_PFKEYv2_ALIGN) - sizeof(struct sadb_prop)) / sizeof(struct sadb_comb);
for(i = 0; i < num_comb; i++) {
if(pfkey_comb->sadb_comb_auth > SADB_AALG_MAX) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_prop_parse: "
"pfkey_comb[%d]->sadb_comb_auth=%d > SADB_AALG_MAX=%d.\n",
i,
pfkey_comb->sadb_comb_auth,
SADB_AALG_MAX);
SENDERR(EINVAL);
}
if(pfkey_comb->sadb_comb_auth) {
if(!pfkey_comb->sadb_comb_auth_minbits) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_prop_parse: "
"pfkey_comb[%d]->sadb_comb_auth_minbits=0, fatal.\n",
i);
SENDERR(EINVAL);
}
if(!pfkey_comb->sadb_comb_auth_maxbits) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_prop_parse: "
"pfkey_comb[%d]->sadb_comb_auth_maxbits=0, fatal.\n",
i);
SENDERR(EINVAL);
}
if(pfkey_comb->sadb_comb_auth_minbits > pfkey_comb->sadb_comb_auth_maxbits) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_prop_parse: "
"pfkey_comb[%d]->sadb_comb_auth_minbits=%d > maxbits=%d, fatal.\n",
i,
pfkey_comb->sadb_comb_auth_minbits,
pfkey_comb->sadb_comb_auth_maxbits);
SENDERR(EINVAL);
}
} else {
if(pfkey_comb->sadb_comb_auth_minbits) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_prop_parse: "
"pfkey_comb[%d]->sadb_comb_auth_minbits=%d != 0, fatal.\n",
i,
pfkey_comb->sadb_comb_auth_minbits);
SENDERR(EINVAL);
}
if(pfkey_comb->sadb_comb_auth_maxbits) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_prop_parse: "
"pfkey_comb[%d]->sadb_comb_auth_maxbits=%d != 0, fatal.\n",
i,
pfkey_comb->sadb_comb_auth_maxbits);
SENDERR(EINVAL);
}
}
if(pfkey_comb->sadb_comb_encrypt > SADB_EALG_MAX) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_comb_parse: "
"pfkey_comb[%d]->sadb_comb_encrypt=%d > SADB_EALG_MAX=%d.\n",
i,
pfkey_comb->sadb_comb_encrypt,
SADB_EALG_MAX);
SENDERR(EINVAL);
}
if(pfkey_comb->sadb_comb_encrypt) {
if(!pfkey_comb->sadb_comb_encrypt_minbits) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_prop_parse: "
"pfkey_comb[%d]->sadb_comb_encrypt_minbits=0, fatal.\n",
i);
SENDERR(EINVAL);
}
if(!pfkey_comb->sadb_comb_encrypt_maxbits) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_prop_parse: "
"pfkey_comb[%d]->sadb_comb_encrypt_maxbits=0, fatal.\n",
i);
SENDERR(EINVAL);
}
if(pfkey_comb->sadb_comb_encrypt_minbits > pfkey_comb->sadb_comb_encrypt_maxbits) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_prop_parse: "
"pfkey_comb[%d]->sadb_comb_encrypt_minbits=%d > maxbits=%d, fatal.\n",
i,
pfkey_comb->sadb_comb_encrypt_minbits,
pfkey_comb->sadb_comb_encrypt_maxbits);
SENDERR(EINVAL);
}
} else {
if(pfkey_comb->sadb_comb_encrypt_minbits) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_prop_parse: "
"pfkey_comb[%d]->sadb_comb_encrypt_minbits=%d != 0, fatal.\n",
i,
pfkey_comb->sadb_comb_encrypt_minbits);
SENDERR(EINVAL);
}
if(pfkey_comb->sadb_comb_encrypt_maxbits) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_prop_parse: "
"pfkey_comb[%d]->sadb_comb_encrypt_maxbits=%d != 0, fatal.\n",
i,
pfkey_comb->sadb_comb_encrypt_maxbits);
SENDERR(EINVAL);
}
}
/* XXX do sanity check on flags */
if(pfkey_comb->sadb_comb_hard_allocations && pfkey_comb->sadb_comb_soft_allocations > pfkey_comb->sadb_comb_hard_allocations) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_prop_parse: "
"pfkey_comb[%d]->sadb_comb_soft_allocations=%d > hard_allocations=%d, fatal.\n",
i,
pfkey_comb->sadb_comb_soft_allocations,
pfkey_comb->sadb_comb_hard_allocations);
SENDERR(EINVAL);
}
if(pfkey_comb->sadb_comb_hard_bytes && pfkey_comb->sadb_comb_soft_bytes > pfkey_comb->sadb_comb_hard_bytes) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_prop_parse: "
"pfkey_comb[%d]->sadb_comb_soft_bytes=%Ld > hard_bytes=%Ld, fatal.\n",
i,
pfkey_comb->sadb_comb_soft_bytes,
pfkey_comb->sadb_comb_hard_bytes);
SENDERR(EINVAL);
}
if(pfkey_comb->sadb_comb_hard_addtime && pfkey_comb->sadb_comb_soft_addtime > pfkey_comb->sadb_comb_hard_addtime) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_prop_parse: "
"pfkey_comb[%d]->sadb_comb_soft_addtime=%Ld > hard_addtime=%Ld, fatal.\n",
i,
pfkey_comb->sadb_comb_soft_addtime,
pfkey_comb->sadb_comb_hard_addtime);
SENDERR(EINVAL);
}
if(pfkey_comb->sadb_comb_hard_usetime && pfkey_comb->sadb_comb_soft_usetime > pfkey_comb->sadb_comb_hard_usetime) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_prop_parse: "
"pfkey_comb[%d]->sadb_comb_soft_usetime=%Ld > hard_usetime=%Ld, fatal.\n",
i,
pfkey_comb->sadb_comb_soft_usetime,
pfkey_comb->sadb_comb_hard_usetime);
SENDERR(EINVAL);
}
if(pfkey_comb->sadb_x_comb_hard_packets && pfkey_comb->sadb_x_comb_soft_packets > pfkey_comb->sadb_x_comb_hard_packets) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_prop_parse: "
"pfkey_comb[%d]->sadb_x_comb_soft_packets=%d > hard_packets=%d, fatal.\n",
i,
pfkey_comb->sadb_x_comb_soft_packets,
pfkey_comb->sadb_x_comb_hard_packets);
SENDERR(EINVAL);
}
if(pfkey_comb->sadb_comb_reserved) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_prop_parse: "
"comb[%d].res=%d, must be zero.\n",
i,
pfkey_comb->sadb_comb_reserved);
SENDERR(EINVAL);
}
pfkey_comb++;
}
errlab:
return error;
}
int
pfkey_key_process(struct sadb_ext *pfkey_ext, struct pfkey_extracted_data* extr)
{
int error = 0;
struct sadb_key *pfkey_key = (struct sadb_key *)pfkey_ext;
KLIPS_PRINT(debug_pfkey,
"klips_debug:pfkey_key_process: .\n");
if(!extr || !extr->ips) {
KLIPS_PRINT(debug_pfkey,
"klips_debug:pfkey_key_process: "
"extr or extr->ips is NULL, fatal\n");
SENDERR(EINVAL);
}
switch(pfkey_key->sadb_key_exttype) {
case SADB_EXT_KEY_AUTH:
KLIPS_PRINT(debug_pfkey,
"klips_debug:pfkey_key_process: "
"allocating %d bytes for authkey.\n",
DIVUP(pfkey_key->sadb_key_bits, 8));
if(!(extr->ips->ips_key_a = kmalloc(DIVUP(pfkey_key->sadb_key_bits, 8), GFP_KERNEL))) {
KLIPS_PRINT(debug_pfkey,
"klips_debug:pfkey_key_process: "
"memory allocation error.\n");
SENDERR(ENOMEM);
}
extr->ips->ips_key_bits_a = pfkey_key->sadb_key_bits;
extr->ips->ips_key_a_size = DIVUP(pfkey_key->sadb_key_bits, 8);
memcpy(extr->ips->ips_key_a,
(char*)pfkey_key + sizeof(struct sadb_key),
extr->ips->ips_key_a_size);
break;
case SADB_EXT_KEY_ENCRYPT: /* Key(s) */
KLIPS_PRINT(debug_pfkey,
"klips_debug:pfkey_key_process: "
"allocating %d bytes for enckey.\n",
DIVUP(pfkey_key->sadb_key_bits, 8));
if(!(extr->ips->ips_key_e = kmalloc(DIVUP(pfkey_key->sadb_key_bits, 8), GFP_KERNEL))) {
KLIPS_PRINT(debug_pfkey,
"klips_debug:pfkey_key_process: "
"memory allocation error.\n");
SENDERR(ENOMEM);
}
extr->ips->ips_key_bits_e = pfkey_key->sadb_key_bits;
extr->ips->ips_key_e_size = DIVUP(pfkey_key->sadb_key_bits, 8);
memcpy(extr->ips->ips_key_e,
(char*)pfkey_key + sizeof(struct sadb_key),
extr->ips->ips_key_e_size);
break;
default:
SENDERR(EINVAL);
}
KLIPS_PRINT(debug_pfkey,
"klips_debug:pfkey_key_process: "
"success.\n");
errlab:
return error;
}
int
pfkey_ident_process(struct sadb_ext *pfkey_ext, struct pfkey_extracted_data* extr)
{
int error = 0;
struct sadb_ident *pfkey_ident = (struct sadb_ident *)pfkey_ext;
int data_len;
KLIPS_PRINT(debug_pfkey,
"klips_debug:pfkey_ident_process: .\n");
if(!extr || !extr->ips) {
KLIPS_PRINT(debug_pfkey,
"klips_debug:pfkey_ident_process: "
"extr or extr->ips is NULL, fatal\n");
SENDERR(EINVAL);
}
switch(pfkey_ident->sadb_ident_exttype) {
case SADB_EXT_IDENTITY_SRC:
data_len = pfkey_ident->sadb_ident_len * IPSEC_PFKEYv2_ALIGN - sizeof(struct sadb_ident);
extr->ips->ips_ident_s.type = pfkey_ident->sadb_ident_type;
extr->ips->ips_ident_s.id = pfkey_ident->sadb_ident_id;
extr->ips->ips_ident_s.len = pfkey_ident->sadb_ident_len;
if(data_len) {
KLIPS_PRINT(debug_pfkey,
"klips_debug:pfkey_ident_process: "
"allocating %d bytes for ident_s.\n",
data_len);
if(!(extr->ips->ips_ident_s.data
= kmalloc(data_len, GFP_KERNEL))) {
SENDERR(ENOMEM);
}
memcpy(extr->ips->ips_ident_s.data,
(char*)pfkey_ident + sizeof(struct sadb_ident),
data_len);
} else {
extr->ips->ips_ident_s.data = NULL;
}
break;
case SADB_EXT_IDENTITY_DST: /* Identity(ies) */
data_len = pfkey_ident->sadb_ident_len * IPSEC_PFKEYv2_ALIGN - sizeof(struct sadb_ident);
extr->ips->ips_ident_d.type = pfkey_ident->sadb_ident_type;
extr->ips->ips_ident_d.id = pfkey_ident->sadb_ident_id;
extr->ips->ips_ident_d.len = pfkey_ident->sadb_ident_len;
if(data_len) {
KLIPS_PRINT(debug_pfkey,
"klips_debug:pfkey_ident_process: "
"allocating %d bytes for ident_d.\n",
data_len);
if(!(extr->ips->ips_ident_d.data
= kmalloc(data_len, GFP_KERNEL))) {
SENDERR(ENOMEM);
}
memcpy(extr->ips->ips_ident_d.data,
(char*)pfkey_ident + sizeof(struct sadb_ident),
data_len);
} else {
extr->ips->ips_ident_d.data = NULL;
}
break;
default:
SENDERR(EINVAL);
}
errlab:
return error;
}
DEBUG_NO_STATIC int
pfkey_key_parse(struct sadb_ext *pfkey_ext)
{
int error = 0;
struct sadb_key *pfkey_key = (struct sadb_key *)pfkey_ext;
DEBUGGING(PF_KEY_DEBUG_PARSE_FLOW,
"pfkey_key_parse:enter\n");
/* sanity checks... */
if(!pfkey_key) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_key_parse: "
"NULL pointer passed in.\n");
SENDERR(EINVAL);
}
if(pfkey_key->sadb_key_len < sizeof(struct sadb_key) / IPSEC_PFKEYv2_ALIGN) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_key_parse: "
"size wrong ext_len=%d, key_ext_len=%ld.\n",
pfkey_key->sadb_key_len,
sizeof(struct sadb_key));
SENDERR(EINVAL);
}
if(!pfkey_key->sadb_key_bits) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_key_parse: "
"key length set to zero, must be non-zero.\n");
SENDERR(EINVAL);
}
if(pfkey_key->sadb_key_len !=
DIVUP(sizeof(struct sadb_key) * OCTETBITS + pfkey_key->sadb_key_bits,
PFKEYBITS)) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_key_parse: "
"key length=%d does not agree with extension length=%d.\n",
pfkey_key->sadb_key_bits,
pfkey_key->sadb_key_len);
SENDERR(EINVAL);
}
if(pfkey_key->sadb_key_reserved) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_key_parse: "
"res=%d, must be zero.\n",
pfkey_key->sadb_key_reserved);
SENDERR(EINVAL);
}
if(! ( (pfkey_key->sadb_key_exttype == SADB_EXT_KEY_AUTH) ||
(pfkey_key->sadb_key_exttype == SADB_EXT_KEY_ENCRYPT))) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_key_parse: "
"expecting extension type AUTH or ENCRYPT, got %d.\n",
pfkey_key->sadb_key_exttype);
SENDERR(EINVAL);
}
DEBUGGING(PF_KEY_DEBUG_PARSE_STRUCT,
"pfkey_key_parse: "
"success, found len=%d exttype=%d bits=%d reserved=%d.\n",
pfkey_key->sadb_key_len,
pfkey_key->sadb_key_exttype,
pfkey_key->sadb_key_bits,
pfkey_key->sadb_key_reserved);
errlab:
return error;
}
DEBUG_NO_STATIC int
pfkey_address_parse(struct sadb_ext *pfkey_ext)
{
int error = 0;
int saddr_len = 0;
struct sadb_address *pfkey_address = (struct sadb_address *)pfkey_ext;
struct sockaddr* s = (struct sockaddr*)((char*)pfkey_address + sizeof(*pfkey_address));
char ipaddr_txt[ADDRTOT_BUF];
DEBUGGING(PF_KEY_DEBUG_PARSE_FLOW,
"pfkey_address_parse:enter\n");
/* sanity checks... */
if(!pfkey_address) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_address_parse: "
"NULL pointer passed in.\n");
SENDERR(EINVAL);
}
if(pfkey_address->sadb_address_len <
(sizeof(struct sadb_address) + sizeof(struct sockaddr))/
IPSEC_PFKEYv2_ALIGN) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_address_parse: "
"size wrong 1 ext_len=%d, adr_ext_len=%ld, saddr_len=%ld.\n",
pfkey_address->sadb_address_len,
sizeof(struct sadb_address),
sizeof(struct sockaddr));
SENDERR(EINVAL);
}
if(pfkey_address->sadb_address_reserved) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_address_parse: "
"res=%d, must be zero.\n",
pfkey_address->sadb_address_reserved);
SENDERR(EINVAL);
}
switch(pfkey_address->sadb_address_exttype) {
case SADB_EXT_ADDRESS_SRC:
case SADB_EXT_ADDRESS_DST:
case SADB_EXT_ADDRESS_PROXY:
case SADB_X_EXT_ADDRESS_DST2:
case SADB_X_EXT_ADDRESS_SRC_FLOW:
case SADB_X_EXT_ADDRESS_DST_FLOW:
case SADB_X_EXT_ADDRESS_SRC_MASK:
case SADB_X_EXT_ADDRESS_DST_MASK:
#ifdef NAT_TRAVERSAL
case SADB_X_EXT_NAT_T_OA:
#endif
break;
default:
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_address_parse: "
"unexpected ext_type=%d.\n",
pfkey_address->sadb_address_exttype);
SENDERR(EINVAL);
}
switch(s->sa_family) {
case AF_INET:
DEBUGGING(PF_KEY_DEBUG_PARSE_STRUCT,
"pfkey_address_parse: "
"found address family=%d, AF_INET.\n",
s->sa_family);
saddr_len = sizeof(struct sockaddr_in);
sprintf(ipaddr_txt, "%d.%d.%d.%d"
, (((struct sockaddr_in*)s)->sin_addr.s_addr >> 0) & 0xFF
, (((struct sockaddr_in*)s)->sin_addr.s_addr >> 8) & 0xFF
, (((struct sockaddr_in*)s)->sin_addr.s_addr >> 16) & 0xFF
, (((struct sockaddr_in*)s)->sin_addr.s_addr >> 24) & 0xFF);
DEBUGGING(PF_KEY_DEBUG_PARSE_STRUCT,
"pfkey_address_parse: "
"found address=%s.\n",
ipaddr_txt);
break;
case AF_INET6:
DEBUGGING(PF_KEY_DEBUG_PARSE_STRUCT,
"pfkey_address_parse: "
"found address family=%d, AF_INET6.\n",
s->sa_family);
saddr_len = sizeof(struct sockaddr_in6);
sprintf(ipaddr_txt, "%x:%x:%x:%x:%x:%x:%x:%x"
, ntohs(((struct sockaddr_in6*)s)->sin6_addr.s6_addr16[0])
, ntohs(((struct sockaddr_in6*)s)->sin6_addr.s6_addr16[1])
, ntohs(((struct sockaddr_in6*)s)->sin6_addr.s6_addr16[2])
, ntohs(((struct sockaddr_in6*)s)->sin6_addr.s6_addr16[3])
, ntohs(((struct sockaddr_in6*)s)->sin6_addr.s6_addr16[4])
, ntohs(((struct sockaddr_in6*)s)->sin6_addr.s6_addr16[5])
, ntohs(((struct sockaddr_in6*)s)->sin6_addr.s6_addr16[6])
, ntohs(((struct sockaddr_in6*)s)->sin6_addr.s6_addr16[7]));
DEBUGGING(PF_KEY_DEBUG_PARSE_STRUCT,
"pfkey_address_parse: "
"found address=%s.\n",
ipaddr_txt);
break;
default:
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_address_parse: "
"s->sa_family=%d not supported.\n",
s->sa_family);
SENDERR(EPFNOSUPPORT);
}
if(pfkey_address->sadb_address_len !=
DIVUP(sizeof(struct sadb_address) + saddr_len, IPSEC_PFKEYv2_ALIGN)) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_address_parse: "
"size wrong 2 ext_len=%d, adr_ext_len=%ld, saddr_len=%d.\n",
pfkey_address->sadb_address_len,
sizeof(struct sadb_address),
saddr_len);
SENDERR(EINVAL);
}
if(pfkey_address->sadb_address_prefixlen != 0) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_address_parse: "
"address prefixes not supported yet.\n");
SENDERR(EAFNOSUPPORT); /* not supported yet */
}
/* XXX check if port!=0 */
DEBUGGING(PF_KEY_DEBUG_PARSE_FLOW,
"pfkey_address_parse: successful.\n");
errlab:
return error;
}
DEBUG_NO_STATIC int
pfkey_sa_parse(struct sadb_ext *pfkey_ext)
{
int error = 0;
struct sadb_sa *pfkey_sa = (struct sadb_sa *)pfkey_ext;
DEBUGGING(PF_KEY_DEBUG_PARSE_FLOW,
"pfkey_sa_parse: entry\n");
/* sanity checks... */
if(!pfkey_sa) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_sa_parse: "
"NULL pointer passed in.\n");
SENDERR(EINVAL);
}
if(pfkey_sa->sadb_sa_len != sizeof(struct sadb_sa) / IPSEC_PFKEYv2_ALIGN) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_sa_parse: "
"length wrong pfkey_sa->sadb_sa_len=%d sizeof(struct sadb_sa)=%ld.\n",
pfkey_sa->sadb_sa_len,
sizeof(struct sadb_sa));
SENDERR(EINVAL);
}
if(pfkey_sa->sadb_sa_encrypt > SADB_EALG_MAX) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_sa_parse: "
"pfkey_sa->sadb_sa_encrypt=%d > SADB_EALG_MAX=%d.\n",
pfkey_sa->sadb_sa_encrypt,
SADB_EALG_MAX);
SENDERR(EINVAL);
}
if(pfkey_sa->sadb_sa_auth > SADB_AALG_MAX) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_sa_parse: "
"pfkey_sa->sadb_sa_auth=%d > SADB_AALG_MAX=%d.\n",
pfkey_sa->sadb_sa_auth,
SADB_AALG_MAX);
SENDERR(EINVAL);
}
if(pfkey_sa->sadb_sa_state > SADB_SASTATE_MAX) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_sa_parse: "
"state=%d exceeds MAX=%d.\n",
pfkey_sa->sadb_sa_state,
SADB_SASTATE_MAX);
SENDERR(EINVAL);
}
if(pfkey_sa->sadb_sa_state == SADB_SASTATE_DEAD) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_sa_parse: "
"state=%d is DEAD=%d.\n",
pfkey_sa->sadb_sa_state,
SADB_SASTATE_DEAD);
SENDERR(EINVAL);
}
if(pfkey_sa->sadb_sa_replay > 64) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_sa_parse: "
"replay window size: %d -- must be 0 <= size <= 64\n",
pfkey_sa->sadb_sa_replay);
SENDERR(EINVAL);
}
if(! ((pfkey_sa->sadb_sa_exttype == SADB_EXT_SA) ||
(pfkey_sa->sadb_sa_exttype == SADB_X_EXT_SA2)))
{
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_sa_parse: "
"unknown exttype=%d, expecting SADB_EXT_SA=%d or SADB_X_EXT_SA2=%d.\n",
pfkey_sa->sadb_sa_exttype,
SADB_EXT_SA,
SADB_X_EXT_SA2);
SENDERR(EINVAL);
}
DEBUGGING(PF_KEY_DEBUG_PARSE_STRUCT,
"pfkey_sa_parse: "
"successfully found len=%d exttype=%d(%s) spi=%08lx replay=%d state=%d auth=%d encrypt=%d flags=%d.\n",
pfkey_sa->sadb_sa_len,
pfkey_sa->sadb_sa_exttype, pfkey_v2_sadb_ext_string(pfkey_sa->sadb_sa_exttype),
(long unsigned int)ntohl(pfkey_sa->sadb_sa_spi),
pfkey_sa->sadb_sa_replay,
pfkey_sa->sadb_sa_state,
pfkey_sa->sadb_sa_auth,
pfkey_sa->sadb_sa_encrypt,
pfkey_sa->sadb_sa_flags);
errlab:
return error;
}
int
pfkey_address_process(struct sadb_ext *pfkey_ext, struct pfkey_extracted_data* extr)
{
int error = 0;
int saddr_len = 0;
char ipaddr_txt[ADDRTOA_BUF];
unsigned char **sap;
unsigned short * portp = 0;
struct sadb_address *pfkey_address = (struct sadb_address *)pfkey_ext;
struct sockaddr* s = (struct sockaddr*)((char*)pfkey_address + sizeof(*pfkey_address));
struct ipsec_sa* ipsp;
KLIPS_PRINT(debug_pfkey,
"klips_debug:pfkey_address_process:\n");
if(!extr || !extr->ips) {
KLIPS_PRINT(debug_pfkey,
"klips_debug:pfkey_address_process: "
"extr or extr->ips is NULL, fatal\n");
SENDERR(EINVAL);
}
switch(s->sa_family) {
case AF_INET:
saddr_len = sizeof(struct sockaddr_in);
addrtoa(((struct sockaddr_in*)s)->sin_addr, 0, ipaddr_txt, sizeof(ipaddr_txt));
KLIPS_PRINT(debug_pfkey,
"klips_debug:pfkey_address_process: "
"found address family=%d, AF_INET, %s.\n",
s->sa_family,
ipaddr_txt);
break;
#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
case AF_INET6:
saddr_len = sizeof(struct sockaddr_in6);
break;
#endif /* defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) */
default:
KLIPS_PRINT(debug_pfkey,
"klips_debug:pfkey_address_process: "
"s->sa_family=%d not supported.\n",
s->sa_family);
SENDERR(EPFNOSUPPORT);
}
switch(pfkey_address->sadb_address_exttype) {
case SADB_EXT_ADDRESS_SRC:
KLIPS_PRINT(debug_pfkey,
"klips_debug:pfkey_address_process: "
"found src address.\n");
sap = (unsigned char **)&(extr->ips->ips_addr_s);
extr->ips->ips_addr_s_size = saddr_len;
break;
case SADB_EXT_ADDRESS_DST:
KLIPS_PRINT(debug_pfkey,
"klips_debug:pfkey_address_process: "
"found dst address.\n");
sap = (unsigned char **)&(extr->ips->ips_addr_d);
extr->ips->ips_addr_d_size = saddr_len;
break;
case SADB_EXT_ADDRESS_PROXY:
KLIPS_PRINT(debug_pfkey,
"klips_debug:pfkey_address_process: "
"found proxy address.\n");
sap = (unsigned char **)&(extr->ips->ips_addr_p);
extr->ips->ips_addr_p_size = saddr_len;
break;
case SADB_X_EXT_ADDRESS_DST2:
KLIPS_PRINT(debug_pfkey,
"klips_debug:pfkey_address_process: "
"found 2nd dst address.\n");
if(extr->ips2 == NULL) {
extr->ips2 = ipsec_sa_alloc(&error); /* pass error var by pointer */
}
if(extr->ips2 == NULL) {
SENDERR(-error);
}
sap = (unsigned char **)&(extr->ips2->ips_addr_d);
extr->ips2->ips_addr_d_size = saddr_len;
break;
case SADB_X_EXT_ADDRESS_SRC_FLOW:
KLIPS_PRINT(debug_pfkey,
"klips_debug:pfkey_address_process: "
"found src flow address.\n");
if(pfkey_alloc_eroute(&(extr->eroute)) == ENOMEM) {
SENDERR(ENOMEM);
}
sap = (unsigned char **)&(extr->eroute->er_eaddr.sen_ip_src);
portp = &(extr->eroute->er_eaddr.sen_sport);
break;
case SADB_X_EXT_ADDRESS_DST_FLOW:
KLIPS_PRINT(debug_pfkey,
"klips_debug:pfkey_address_process: "
"found dst flow address.\n");
if(pfkey_alloc_eroute(&(extr->eroute)) == ENOMEM) {
SENDERR(ENOMEM);
}
sap = (unsigned char **)&(extr->eroute->er_eaddr.sen_ip_dst);
portp = &(extr->eroute->er_eaddr.sen_dport);
break;
case SADB_X_EXT_ADDRESS_SRC_MASK:
KLIPS_PRINT(debug_pfkey,
"klips_debug:pfkey_address_process: "
"found src mask address.\n");
if(pfkey_alloc_eroute(&(extr->eroute)) == ENOMEM) {
SENDERR(ENOMEM);
}
sap = (unsigned char **)&(extr->eroute->er_emask.sen_ip_src);
portp = &(extr->eroute->er_emask.sen_sport);
break;
case SADB_X_EXT_ADDRESS_DST_MASK:
KLIPS_PRINT(debug_pfkey,
"klips_debug:pfkey_address_process: "
"found dst mask address.\n");
if(pfkey_alloc_eroute(&(extr->eroute)) == ENOMEM) {
SENDERR(ENOMEM);
}
sap = (unsigned char **)&(extr->eroute->er_emask.sen_ip_dst);
portp = &(extr->eroute->er_emask.sen_dport);
break;
#ifdef NAT_TRAVERSAL
case SADB_X_EXT_NAT_T_OA:
KLIPS_PRINT(debug_pfkey,
"klips_debug:pfkey_address_process: "
"found NAT-OA address.\n");
sap = (unsigned char **)&(extr->ips->ips_natt_oa);
extr->ips->ips_natt_oa_size = saddr_len;
break;
#endif
default:
KLIPS_PRINT(debug_pfkey,
"klips_debug:pfkey_address_process: "
"unrecognised ext_type=%d.\n",
pfkey_address->sadb_address_exttype);
SENDERR(EINVAL);
}
switch(pfkey_address->sadb_address_exttype) {
case SADB_EXT_ADDRESS_SRC:
case SADB_EXT_ADDRESS_DST:
case SADB_EXT_ADDRESS_PROXY:
case SADB_X_EXT_ADDRESS_DST2:
#ifdef NAT_TRAVERSAL
case SADB_X_EXT_NAT_T_OA:
#endif
KLIPS_PRINT(debug_pfkey,
"klips_debug:pfkey_address_process: "
"allocating %d bytes for saddr.\n",
saddr_len);
if(!(*sap = kmalloc(saddr_len, GFP_KERNEL))) {
SENDERR(ENOMEM);
}
memcpy(*sap, s, saddr_len);
break;
default:
if(s->sa_family != AF_INET) {
KLIPS_PRINT(debug_pfkey,
"klips_debug:pfkey_address_process: "
"s->sa_family=%d not supported.\n",
s->sa_family);
SENDERR(EPFNOSUPPORT);
}
{
unsigned long *ulsap = (unsigned long *)sap;
*ulsap = ((struct sockaddr_in*)s)->sin_addr.s_addr;
}
if (portp != 0)
*portp = ((struct sockaddr_in*)s)->sin_port;
#ifdef CONFIG_KLIPS_DEBUG
if(extr->eroute) {
char buf1[64], buf2[64];
if (debug_pfkey) {
subnettoa(extr->eroute->er_eaddr.sen_ip_src,
extr->eroute->er_emask.sen_ip_src, 0, buf1, sizeof(buf1));
subnettoa(extr->eroute->er_eaddr.sen_ip_dst,
extr->eroute->er_emask.sen_ip_dst, 0, buf2, sizeof(buf2));
KLIPS_PRINT(debug_pfkey,
"klips_debug:pfkey_address_parse: "
"extr->eroute set to %s:%d->%s:%d\n",
buf1,
ntohs(extr->eroute->er_eaddr.sen_sport),
buf2,
ntohs(extr->eroute->er_eaddr.sen_dport));
}
}
#endif /* CONFIG_KLIPS_DEBUG */
}
ipsp = extr->ips;
switch(pfkey_address->sadb_address_exttype) {
case SADB_X_EXT_ADDRESS_DST2:
ipsp = extr->ips2;
case SADB_EXT_ADDRESS_DST:
if(s->sa_family == AF_INET) {
ipsp->ips_said.dst.u.v4.sin_addr.s_addr = ((struct sockaddr_in*)(ipsp->ips_addr_d))->sin_addr.s_addr;
ipsp->ips_said.dst.u.v4.sin_family = AF_INET;
addrtoa(((struct sockaddr_in*)(ipsp->ips_addr_d))->sin_addr,
0,
ipaddr_txt,
sizeof(ipaddr_txt));
KLIPS_PRINT(debug_pfkey,
"klips_debug:pfkey_address_process: "
"ips_said.dst set to %s.\n",
ipaddr_txt);
} else {
KLIPS_PRINT(debug_pfkey,
"klips_debug:pfkey_address_process: "
"uh, ips_said.dst doesn't do address family=%d yet, said will be invalid.\n",
s->sa_family);
}
default:
break;
}
/* XXX check if port!=0 */
KLIPS_PRINT(debug_pfkey,
"klips_debug:pfkey_address_process: successful.\n");
errlab:
return error;
}
DEBUG_NO_STATIC int
pfkey_sa_parse(struct sadb_ext *pfkey_ext)
{
int error = 0;
struct k_sadb_sa *pfkey_sa = (struct k_sadb_sa *)pfkey_ext;
/* sanity checks... */
if(!pfkey_sa) {
ERROR("pfkey_sa_parse: "
"NULL pointer passed in.\n");
SENDERR(EINVAL);
}
if(pfkey_sa->sadb_sa_len !=sizeof(struct k_sadb_sa)/IPSEC_PFKEYv2_ALIGN
&& pfkey_sa->sadb_sa_len!=sizeof(struct sadb_sa)/IPSEC_PFKEYv2_ALIGN) {
ERROR(
"pfkey_sa_parse: "
"length wrong pfkey_sa->sadb_sa_len=%d sizeof(struct sadb_sa)=%d.\n",
pfkey_sa->sadb_sa_len,
(int)sizeof(struct k_sadb_sa));
SENDERR(EINVAL);
}
#if K_SADB_EALG_MAX < 255
if(pfkey_sa->sadb_sa_encrypt > K_SADB_EALG_MAX) {
ERROR(
"pfkey_sa_parse: "
"pfkey_sa->sadb_sa_encrypt=%d > K_SADB_EALG_MAX=%d.\n",
pfkey_sa->sadb_sa_encrypt,
K_SADB_EALG_MAX);
SENDERR(EINVAL);
}
#endif
#if K_SADB_AALG_MAX < 255
if(pfkey_sa->sadb_sa_auth > K_SADB_AALG_MAX) {
ERROR(
"pfkey_sa_parse: "
"pfkey_sa->sadb_sa_auth=%d > K_SADB_AALG_MAX=%d.\n",
pfkey_sa->sadb_sa_auth,
K_SADB_AALG_MAX);
SENDERR(EINVAL);
}
#endif
#if K_SADB_SASTATE_MAX < 255
if(pfkey_sa->sadb_sa_state > K_SADB_SASTATE_MAX) {
ERROR(
"pfkey_sa_parse: "
"state=%d exceeds MAX=%d.\n",
pfkey_sa->sadb_sa_state,
K_SADB_SASTATE_MAX);
SENDERR(EINVAL);
}
#endif
if(pfkey_sa->sadb_sa_state == K_SADB_SASTATE_DEAD) {
ERROR(
"pfkey_sa_parse: "
"state=%d is DEAD=%d.\n",
pfkey_sa->sadb_sa_state,
K_SADB_SASTATE_DEAD);
SENDERR(EINVAL);
}
if(pfkey_sa->sadb_sa_replay > 64) {
ERROR(
"pfkey_sa_parse: "
"replay window size: %d -- must be 0 <= size <= 64\n",
pfkey_sa->sadb_sa_replay);
SENDERR(EINVAL);
}
if(! ((pfkey_sa->sadb_sa_exttype == K_SADB_EXT_SA) ||
(pfkey_sa->sadb_sa_exttype == K_SADB_X_EXT_SA2)))
{
ERROR(
"pfkey_sa_parse: "
"unknown exttype=%d, expecting K_SADB_EXT_SA=%d or K_SADB_X_EXT_SA2=%d.\n",
pfkey_sa->sadb_sa_exttype,
K_SADB_EXT_SA,
K_SADB_X_EXT_SA2);
SENDERR(EINVAL);
}
if(pfkey_sa->sadb_sa_len > sizeof(struct sadb_sa)/IPSEC_PFKEYv2_ALIGN) {
if(pfkey_sa->sadb_x_sa_ref == IPSEC_SAREF_NULL ||
pfkey_sa->sadb_x_sa_ref == ~(IPSEC_SAREF_NULL))
{
pfkey_sa->sadb_x_sa_ref = IPSEC_SAREF_NULL;
}
}
if((IPSEC_SAREF_NULL != pfkey_sa->sadb_x_sa_ref)
&& (pfkey_sa->sadb_x_sa_ref >= (1 << IPSEC_SA_REF_TABLE_IDX_WIDTH)))
{
ERROR(
"pfkey_sa_parse: "
"SAref=%d must be (SAref == IPSEC_SAREF_NULL(%d) || SAref < IPSEC_SA_REF_TABLE_NUM_ENTRIES(%d)).\n",
pfkey_sa->sadb_x_sa_ref,
IPSEC_SAREF_NULL,
IPSEC_SA_REF_TABLE_NUM_ENTRIES);
SENDERR(EINVAL);
}
DEBUGGING(PF_KEY_DEBUG_PARSE_STRUCT,
"pfkey_sa_parse: "
"successfully found len=%d exttype=%d(%s) spi=%08lx replay=%d state=%d auth=%d encrypt=%d flags=%d ref=%d.\n",
pfkey_sa->sadb_sa_len,
pfkey_sa->sadb_sa_exttype,
pfkey_v2_sadb_ext_string(pfkey_sa->sadb_sa_exttype),
(long unsigned int)ntohl(pfkey_sa->sadb_sa_spi),
pfkey_sa->sadb_sa_replay,
pfkey_sa->sadb_sa_state,
pfkey_sa->sadb_sa_auth,
pfkey_sa->sadb_sa_encrypt,
pfkey_sa->sadb_sa_flags,
pfkey_sa->sadb_x_sa_ref);
errlab:
return error;
}
int
pfkey_sa_process(struct sadb_ext *pfkey_ext, struct pfkey_extracted_data* extr)
{
struct sadb_sa *pfkey_sa = (struct sadb_sa *)pfkey_ext;
int error = 0;
struct ipsec_sa* ipsp;
KLIPS_PRINT(debug_pfkey,
"klips_debug:pfkey_sa_process: .\n");
if(!extr || !extr->ips) {
KLIPS_PRINT(debug_pfkey,
"klips_debug:pfkey_sa_process: "
"extr or extr->ips is NULL, fatal\n");
SENDERR(EINVAL);
}
switch(pfkey_ext->sadb_ext_type) {
case SADB_EXT_SA:
ipsp = extr->ips;
break;
case SADB_X_EXT_SA2:
if(extr->ips2 == NULL) {
extr->ips2 = ipsec_sa_alloc(&error); /* pass error var by pointer */
}
if(extr->ips2 == NULL) {
SENDERR(-error);
}
ipsp = extr->ips2;
break;
default:
KLIPS_PRINT(debug_pfkey,
"klips_debug:pfkey_sa_process: "
"invalid exttype=%d.\n",
pfkey_ext->sadb_ext_type);
SENDERR(EINVAL);
}
ipsp->ips_said.spi = pfkey_sa->sadb_sa_spi;
ipsp->ips_replaywin = pfkey_sa->sadb_sa_replay;
ipsp->ips_state = pfkey_sa->sadb_sa_state;
ipsp->ips_flags = pfkey_sa->sadb_sa_flags;
ipsp->ips_replaywin_lastseq = ipsp->ips_replaywin_bitmap = 0;
ipsp->ips_ref_rel = pfkey_sa->sadb_x_sa_ref;
switch(ipsp->ips_said.proto) {
case IPPROTO_AH:
ipsp->ips_authalg = pfkey_sa->sadb_sa_auth;
ipsp->ips_encalg = SADB_EALG_NONE;
break;
case IPPROTO_ESP:
ipsp->ips_authalg = pfkey_sa->sadb_sa_auth;
ipsp->ips_encalg = pfkey_sa->sadb_sa_encrypt;
#ifdef CONFIG_KLIPS_ALG
ipsec_alg_sa_init(ipsp);
#endif /* CONFIG_KLIPS_ALG */
break;
case IPPROTO_IPIP:
ipsp->ips_authalg = AH_NONE;
ipsp->ips_encalg = ESP_NONE;
break;
#ifdef CONFIG_KLIPS_IPCOMP
case IPPROTO_COMP:
ipsp->ips_authalg = AH_NONE;
ipsp->ips_encalg = pfkey_sa->sadb_sa_encrypt;
break;
#endif /* CONFIG_KLIPS_IPCOMP */
case IPPROTO_INT:
ipsp->ips_authalg = AH_NONE;
ipsp->ips_encalg = ESP_NONE;
break;
case 0:
break;
default:
KLIPS_PRINT(debug_pfkey,
"klips_debug:pfkey_sa_process: "
"unknown proto=%d.\n",
ipsp->ips_said.proto);
SENDERR(EINVAL);
}
errlab:
return error;
}
int
pfkey_msg_parse(struct sadb_msg *pfkey_msg,
struct pf_key_ext_parsers_def *ext_parsers[],
struct sadb_ext *extensions[],
int dir)
{
int error = 0;
int remain;
struct sadb_ext *pfkey_ext;
int extensions_seen = 0;
DEBUGGING(PF_KEY_DEBUG_PARSE_STRUCT,
"pfkey_msg_parse: "
"parsing message ver=%d, type=%d(%s), errno=%d, satype=%d(%s), len=%d, res=%d, seq=%d, pid=%d.\n",
pfkey_msg->sadb_msg_version,
pfkey_msg->sadb_msg_type,
pfkey_v2_sadb_type_string(pfkey_msg->sadb_msg_type),
pfkey_msg->sadb_msg_errno,
pfkey_msg->sadb_msg_satype,
satype2name(pfkey_msg->sadb_msg_satype),
pfkey_msg->sadb_msg_len,
pfkey_msg->sadb_msg_reserved,
pfkey_msg->sadb_msg_seq,
pfkey_msg->sadb_msg_pid);
if(ext_parsers == NULL) ext_parsers = ext_default_parsers;
pfkey_extensions_init(extensions);
remain = pfkey_msg->sadb_msg_len;
remain -= sizeof(struct sadb_msg) / IPSEC_PFKEYv2_ALIGN;
pfkey_ext = (struct sadb_ext*)((char*)pfkey_msg +
sizeof(struct sadb_msg));
extensions[0] = (struct sadb_ext *) pfkey_msg;
if(pfkey_msg->sadb_msg_version != PF_KEY_V2) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_msg_parse: "
"not PF_KEY_V2 msg, found %d, should be %d.\n",
pfkey_msg->sadb_msg_version,
PF_KEY_V2);
SENDERR(EINVAL);
}
if(!pfkey_msg->sadb_msg_type) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_msg_parse: "
"msg type not set, must be non-zero..\n");
SENDERR(EINVAL);
}
if(pfkey_msg->sadb_msg_type > SADB_MAX) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_msg_parse: "
"msg type=%d > max=%d.\n",
pfkey_msg->sadb_msg_type,
SADB_MAX);
SENDERR(EINVAL);
}
switch(pfkey_msg->sadb_msg_type) {
case SADB_GETSPI:
case SADB_UPDATE:
case SADB_ADD:
case SADB_DELETE:
case SADB_GET:
case SADB_X_GRPSA:
case SADB_X_ADDFLOW:
if(!satype2proto(pfkey_msg->sadb_msg_satype)) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_msg_parse: "
"satype %d conversion to proto failed for msg_type %d (%s).\n",
pfkey_msg->sadb_msg_satype,
pfkey_msg->sadb_msg_type,
pfkey_v2_sadb_type_string(pfkey_msg->sadb_msg_type));
SENDERR(EINVAL);
} else {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_msg_parse: "
"satype %d(%s) conversion to proto gives %d for msg_type %d(%s).\n",
pfkey_msg->sadb_msg_satype,
satype2name(pfkey_msg->sadb_msg_satype),
satype2proto(pfkey_msg->sadb_msg_satype),
pfkey_msg->sadb_msg_type,
pfkey_v2_sadb_type_string(pfkey_msg->sadb_msg_type));
}
case SADB_ACQUIRE:
case SADB_REGISTER:
case SADB_EXPIRE:
if(!pfkey_msg->sadb_msg_satype) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_msg_parse: "
"satype is zero, must be non-zero for msg_type %d(%s).\n",
pfkey_msg->sadb_msg_type,
pfkey_v2_sadb_type_string(pfkey_msg->sadb_msg_type));
SENDERR(EINVAL);
}
default:
}
/* errno must not be set in downward messages */
/* this is not entirely true... a response to an ACQUIRE could return an error */
if((dir == EXT_BITS_IN) && (pfkey_msg->sadb_msg_type != SADB_ACQUIRE) && pfkey_msg->sadb_msg_errno) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_msg_parse: "
"errno set to %d.\n",
pfkey_msg->sadb_msg_errno);
SENDERR(EINVAL);
}
DEBUGGING(PF_KEY_DEBUG_PARSE_STRUCT,
"pfkey_msg_parse: "
"remain=%d, ext_type=%d(%s), ext_len=%d.\n",
remain,
pfkey_ext->sadb_ext_type,
pfkey_v2_sadb_ext_string(pfkey_ext->sadb_ext_type),
pfkey_ext->sadb_ext_len);
DEBUGGING(PF_KEY_DEBUG_PARSE_STRUCT,
"pfkey_msg_parse: "
"extensions permitted=%08x, required=%08x.\n",
extensions_bitmaps[dir][EXT_BITS_PERM][pfkey_msg->sadb_msg_type],
extensions_bitmaps[dir][EXT_BITS_REQ][pfkey_msg->sadb_msg_type]);
extensions_seen = 1;
while( (remain * IPSEC_PFKEYv2_ALIGN) >= sizeof(struct sadb_ext) ) {
/* Is there enough message left to support another extension header? */
if(remain < pfkey_ext->sadb_ext_len) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_msg_parse: "
"remain %d less than ext len %d.\n",
remain, pfkey_ext->sadb_ext_len);
SENDERR(EINVAL);
}
DEBUGGING(PF_KEY_DEBUG_PARSE_STRUCT,
"pfkey_msg_parse: "
"parsing ext type=%d remain=%d.\n",
pfkey_ext->sadb_ext_type,
remain);
/* Is the extension header type valid? */
if((pfkey_ext->sadb_ext_type > SADB_EXT_MAX) || (!pfkey_ext->sadb_ext_type)) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_msg_parse: "
"ext type %d invalid, SADB_EXT_MAX=%d.\n",
pfkey_ext->sadb_ext_type, SADB_EXT_MAX);
SENDERR(EINVAL);
}
/* Have we already seen this type of extension? */
if((extensions_seen & ( 1 << pfkey_ext->sadb_ext_type )) != 0)
{
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_msg_parse: "
"ext type %d already seen.\n",
pfkey_ext->sadb_ext_type);
SENDERR(EINVAL);
}
/* Do I even know about this type of extension? */
if(ext_parsers[pfkey_ext->sadb_ext_type]==NULL) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_msg_parse: "
"ext type %d unknown, ignoring.\n",
pfkey_ext->sadb_ext_type);
goto next_ext;
}
/* Is this type of extension permitted for this type of message? */
if(!(extensions_bitmaps[dir][EXT_BITS_PERM][pfkey_msg->sadb_msg_type] &
1<<pfkey_ext->sadb_ext_type)) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_msg_parse: "
"ext type %d not permitted, exts_perm_in=%08x, 1<<type=%08x\n",
pfkey_ext->sadb_ext_type,
extensions_bitmaps[dir][EXT_BITS_PERM][pfkey_msg->sadb_msg_type],
1<<pfkey_ext->sadb_ext_type);
SENDERR(EINVAL);
}
DEBUGGING(PF_KEY_DEBUG_PARSE_STRUCT,
"pfkey_msg_parse: "
"About to parse extension %d %p with parser %s.\n",
pfkey_ext->sadb_ext_type,
pfkey_ext,
ext_parsers[pfkey_ext->sadb_ext_type]->parser_name);
/* Parse the extension */
if((error =
(*ext_parsers[pfkey_ext->sadb_ext_type]->parser)(pfkey_ext))) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_msg_parse: "
"extension parsing for type %d failed with error %d.\n",
pfkey_ext->sadb_ext_type, error);
SENDERR(-error);
}
DEBUGGING(PF_KEY_DEBUG_PARSE_STRUCT,
"pfkey_msg_parse: "
"Extension %d parsed.\n",
pfkey_ext->sadb_ext_type);
/* Mark that we have seen this extension and remember the header location */
extensions_seen |= ( 1 << pfkey_ext->sadb_ext_type );
extensions[pfkey_ext->sadb_ext_type] = pfkey_ext;
next_ext:
/* Calculate how much message remains */
remain -= pfkey_ext->sadb_ext_len;
if(!remain) {
break;
}
/* Find the next extension header */
pfkey_ext = (struct sadb_ext*)((char*)pfkey_ext +
pfkey_ext->sadb_ext_len * IPSEC_PFKEYv2_ALIGN);
}
if(remain) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_msg_parse: "
"unexpected remainder of %d.\n",
remain);
/* why is there still something remaining? */
SENDERR(EINVAL);
}
/* check required extensions */
DEBUGGING(PF_KEY_DEBUG_PARSE_STRUCT,
"pfkey_msg_parse: "
"extensions permitted=%08x, seen=%08x, required=%08x.\n",
extensions_bitmaps[dir][EXT_BITS_PERM][pfkey_msg->sadb_msg_type],
extensions_seen,
extensions_bitmaps[dir][EXT_BITS_REQ][pfkey_msg->sadb_msg_type]);
/* don't check further if it is an error return message since it
may not have a body */
if(pfkey_msg->sadb_msg_errno) {
SENDERR(-error);
}
if((extensions_seen &
extensions_bitmaps[dir][EXT_BITS_REQ][pfkey_msg->sadb_msg_type]) !=
extensions_bitmaps[dir][EXT_BITS_REQ][pfkey_msg->sadb_msg_type]) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_msg_parse: "
"required extensions missing:%08x.\n",
extensions_bitmaps[dir][EXT_BITS_REQ][pfkey_msg->sadb_msg_type] -
(extensions_seen &
extensions_bitmaps[dir][EXT_BITS_REQ][pfkey_msg->sadb_msg_type]));
SENDERR(EINVAL);
}
if((dir == EXT_BITS_IN) && (pfkey_msg->sadb_msg_type == SADB_X_DELFLOW)
&& ((extensions_seen & SADB_X_EXT_ADDRESS_DELFLOW)
!= SADB_X_EXT_ADDRESS_DELFLOW)
&& (((extensions_seen & (1<<SADB_EXT_SA)) != (1<<SADB_EXT_SA))
|| ((((struct sadb_sa*)extensions[SADB_EXT_SA])->sadb_sa_flags
& SADB_X_SAFLAGS_CLEARFLOW)
!= SADB_X_SAFLAGS_CLEARFLOW))) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_msg_parse: "
"required SADB_X_DELFLOW extensions missing: either %08x must be present or %08x must be present with SADB_X_SAFLAGS_CLEARFLOW set.\n",
SADB_X_EXT_ADDRESS_DELFLOW
- (extensions_seen & SADB_X_EXT_ADDRESS_DELFLOW),
(1<<SADB_EXT_SA) - (extensions_seen & (1<<SADB_EXT_SA)));
SENDERR(EINVAL);
}
switch(pfkey_msg->sadb_msg_type) {
case SADB_ADD:
case SADB_UPDATE:
/* check maturity */
if(((struct sadb_sa*)extensions[SADB_EXT_SA])->sadb_sa_state !=
SADB_SASTATE_MATURE) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_msg_parse: "
"state=%d for add or update should be MATURE=%d.\n",
((struct sadb_sa*)extensions[SADB_EXT_SA])->sadb_sa_state,
SADB_SASTATE_MATURE);
SENDERR(EINVAL);
}
/* check AH and ESP */
switch(((struct sadb_msg*)extensions[SADB_EXT_RESERVED])->sadb_msg_satype) {
case SADB_SATYPE_AH:
if(!(((struct sadb_sa*)extensions[SADB_EXT_SA]) &&
((struct sadb_sa*)extensions[SADB_EXT_SA])->sadb_sa_auth !=
SADB_AALG_NONE)) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_msg_parse: "
"auth alg is zero, must be non-zero for AH SAs.\n");
SENDERR(EINVAL);
}
if(((struct sadb_sa*)(extensions[SADB_EXT_SA]))->sadb_sa_encrypt !=
SADB_EALG_NONE) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_msg_parse: "
"AH handed encalg=%d, must be zero.\n",
((struct sadb_sa*)(extensions[SADB_EXT_SA]))->sadb_sa_encrypt);
SENDERR(EINVAL);
}
break;
case SADB_SATYPE_ESP:
if(!(((struct sadb_sa*)extensions[SADB_EXT_SA]) &&
((struct sadb_sa*)extensions[SADB_EXT_SA])->sadb_sa_encrypt !=
SADB_EALG_NONE)) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_msg_parse: "
"encrypt alg=%d is zero, must be non-zero for ESP=%d SAs.\n",
((struct sadb_sa*)extensions[SADB_EXT_SA])->sadb_sa_encrypt,
((struct sadb_msg*)extensions[SADB_EXT_RESERVED])->sadb_msg_satype);
SENDERR(EINVAL);
}
if((((struct sadb_sa*)(extensions[SADB_EXT_SA]))->sadb_sa_encrypt ==
SADB_EALG_NULL) &&
(((struct sadb_sa*)(extensions[SADB_EXT_SA]))->sadb_sa_auth ==
SADB_AALG_NONE) ) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_msg_parse: "
"ESP handed encNULL+authNONE, illegal combination.\n");
SENDERR(EINVAL);
}
break;
case SADB_X_SATYPE_COMP:
if(!(((struct sadb_sa*)extensions[SADB_EXT_SA]) &&
((struct sadb_sa*)extensions[SADB_EXT_SA])->sadb_sa_encrypt !=
SADB_EALG_NONE)) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_msg_parse: "
"encrypt alg=%d is zero, must be non-zero for COMP=%d SAs.\n",
((struct sadb_sa*)extensions[SADB_EXT_SA])->sadb_sa_encrypt,
((struct sadb_msg*)extensions[SADB_EXT_RESERVED])->sadb_msg_satype);
SENDERR(EINVAL);
}
if(((struct sadb_sa*)(extensions[SADB_EXT_SA]))->sadb_sa_auth !=
SADB_AALG_NONE) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_msg_parse: "
"COMP handed auth=%d, must be zero.\n",
((struct sadb_sa*)(extensions[SADB_EXT_SA]))->sadb_sa_auth);
SENDERR(EINVAL);
}
break;
default:
}
if(ntohl(((struct sadb_sa*)(extensions[SADB_EXT_SA]))->sadb_sa_spi) <= 255) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_msg_parse: "
"spi=%08lx must be > 255.\n",
ntohl(((struct sadb_sa*)(extensions[SADB_EXT_SA]))->sadb_sa_spi));
SENDERR(EINVAL);
}
default:
}
errlab:
return error;
}
/*
* IPSEC <> netlink interface
* Copyright (C) 1996, 1997 John Ioannidis.
* Copyright (C) 1998, 1999, 2000, 2001 Richard Guy Briggs.
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
char ipsec_netlink_c_version[] = "RCSID $Id: ipsec_netlink.c,v 1.56 2002/01/29 17:17:55 mcr Exp $";
#include <linux/config.h>
#include <linux/version.h>
#include <linux/kernel.h> /* printk() */
#include "ipsec_param.h"
#ifdef MALLOC_SLAB
# include <linux/slab.h> /* kmalloc() */
#else /* MALLOC_SLAB */
# include <linux/malloc.h> /* kmalloc() */
#endif /* MALLOC_SLAB */
#include <linux/errno.h> /* error codes */
#include <linux/types.h> /* size_t */
#include <linux/interrupt.h> /* mark_bh */
#include <linux/netdevice.h> /* struct device, and other headers */
#include <linux/etherdevice.h> /* eth_type_trans */
#include <linux/ip.h> /* struct iphdr */
#include <linux/skbuff.h>
#include <freeswan.h>
#ifdef SPINLOCK
# ifdef SPINLOCK_23
# include <linux/spinlock.h> /* *lock* */
# else /* 23_SPINLOCK */
# include <asm/spinlock.h> /* *lock* */
# endif /* 23_SPINLOCK */
#endif /* SPINLOCK */
#ifdef NET_21
# include <asm/uaccess.h>
# include <linux/in6.h>
# define ip_chk_addr inet_addr_type
# define IS_MYADDR RTN_LOCAL
#endif
#include <asm/checksum.h>
#include <net/ip.h>
#ifdef NETLINK_SOCK
# include <linux/netlink.h>
#else
# include <net/netlink.h>
#endif
#include "radij.h"
#include "ipsec_encap.h"
#include "ipsec_radij.h"
#include "ipsec_netlink.h"
#include "ipsec_xform.h"
#include "ipsec_rcv.h"
#include "ipsec_ah.h"
#include "ipsec_esp.h"
#ifdef CONFIG_IPSEC_DEBUG
# include "ipsec_tunnel.h"
#endif /* CONFIG_IPSEC_DEBUG */
#include <pfkeyv2.h>
#include <pfkey.h>
#ifdef CONFIG_IPSEC_DEBUG
int debug_netlink = 0;
#endif /* CONFIG_IPSEC_DEBUG */
#define SENDERR(_x) do { len = -(_x); goto errlab; } while (0)
#if 0
int
#ifdef NETLINK_SOCK
ipsec_callback(int proto, struct sk_buff *skb)
#else /* NETLINK_SOCK */
ipsec_callback(struct sk_buff *skb)
#endif /* NETLINK_SOCK */
{
/*
* this happens when we write to /dev/ipsec (c 36 10)
*/
int len = skb->len;
u_char *dat = (u_char *)skb->data;
struct encap_msghdr *em = (struct encap_msghdr *)dat;
struct tdb *tdbp, *tprev;
int i, nspis, error = 0;
#ifdef CONFIG_IPSEC_DEBUG
struct eroute *eret;
char sa[SATOA_BUF];
size_t sa_len;
struct sk_buff *first, *last;
sa_len = satoa(em->em_said, 0, sa, SATOA_BUF);
if(debug_netlink) {
printk("klips_debug:ipsec_callback: "
"skb=0x%p skblen=%ld em_magic=%d em_type=%d\n",
skb,
(unsigned long int)skb->len,
em->em_magic,
em->em_type);
switch(em->em_type) {
case EMT_SETDEBUG:
printk("klips_debug:ipsec_callback: "
"set ipsec_debug level\n");
break;
case EMT_DELEROUTE:
case EMT_CLREROUTE:
case EMT_CLRSPIS:
break;
default:
printk("klips_debug:ipsec_callback: "
"called for SA:%s\n",
sa_len ? sa : " (error)");
}
}
#endif /* CONFIG_IPSEC_DEBUG */
/* XXXX Temporarily disable netlink I/F code until it gets permanantly
ripped out in favour of PF_KEYv2 I/F. */
SENDERR(EPROTONOSUPPORT);
/* em = (struct encap_msghdr *)dat; */
if (em->em_magic != EM_MAGIC) {
printk("klips_debug:ipsec_callback: "
"bad magic=%d failed, should be %d\n",
em->em_magic,
EM_MAGIC);
SENDERR(EINVAL);
}
switch (em->em_type) {
case EMT_SETDEBUG:
#ifdef CONFIG_IPSEC_DEBUG
if(em->em_db_nl >> (sizeof(em->em_db_nl) * 8 - 1)) {
em->em_db_nl &= ~(1 << (sizeof(em->em_db_nl) * 8 -1));
debug_tunnel |= em->em_db_tn;
debug_netlink |= em->em_db_nl;
debug_xform |= em->em_db_xf;
debug_eroute |= em->em_db_er;
debug_spi |= em->em_db_sp;
debug_radij |= em->em_db_rj;
debug_esp |= em->em_db_es;
debug_ah |= em->em_db_ah;
debug_rcv |= em->em_db_rx;
debug_pfkey |= em->em_db_ky;
if(debug_netlink)
printk("klips_debug:ipsec_callback: set\n");
} else {
if(debug_netlink)
printk("klips_debug:ipsec_callback: unset\n");
debug_tunnel &= em->em_db_tn;
debug_netlink &= em->em_db_nl;
debug_xform &= em->em_db_xf;
debug_eroute &= em->em_db_er;
debug_spi &= em->em_db_sp;
debug_radij &= em->em_db_rj;
debug_esp &= em->em_db_es;
debug_ah &= em->em_db_ah;
debug_rcv &= em->em_db_rx;
debug_pfkey &= em->em_db_ky;
}
#else /* CONFIG_IPSEC_DEBUG */
printk("klips_debug:ipsec_callback: "
"debugging not enabled\n");
SENDERR(EINVAL);
#endif /* CONFIG_IPSEC_DEBUG */
break;
case EMT_SETEROUTE:
if ((error = ipsec_makeroute(&(em->em_eaddr), &(em->em_emask), em->em_ersaid, 0, NULL, NULL, NULL)))
SENDERR(-error);
break;
case EMT_REPLACEROUTE:
if ((error = ipsec_breakroute(&(em->em_eaddr), &(em->em_emask), &first, &last)) == EINVAL) {
kfree_skb(first);
kfree_skb(last);
SENDERR(-error);
}
if ((error = ipsec_makeroute(&(em->em_eaddr), &(em->em_emask), em->em_ersaid, NULL, NULL)))
SENDERR(-error);
break;
case EMT_DELEROUTE:
if ((error = ipsec_breakroute(&(em->em_eaddr), &(em->em_emask), &first, &last)))
kfree_skb(first);
kfree_skb(last);
SENDERR(-error);
break;
case EMT_CLREROUTE:
if ((error = ipsec_cleareroutes()))
SENDERR(-error);
break;
case EMT_SETSPI:
if (em->em_if >= 5) /* XXX -- why 5? */
SENDERR(ENODEV);
tdbp = gettdb(&(em->em_said));
if (tdbp == NULL) {
tdbp = (struct tdb *)kmalloc(sizeof (*tdbp), GFP_ATOMIC);
if (tdbp == NULL)
SENDERR(ENOBUFS);
memset((caddr_t)tdbp, 0, sizeof(*tdbp));
tdbp->tdb_said = em->em_said;
tdbp->tdb_flags = em->em_flags;
if(ip_chk_addr((unsigned long)em->em_said.dst.s_addr) == IS_MYADDR) {
tdbp->tdb_flags |= EMT_INBOUND;
}
KLIPS_PRINT(debug_netlink & DB_NL_TDBCB,
"klips_debug:ipsec_callback: "
"existing Tunnel Descriptor Block not found (this is good) for SA: %s, %s-bound, allocating.\n",
sa_len ? sa : " (error)",
(tdbp->tdb_flags & EMT_INBOUND) ? "in" : "out");
/* XXX tdbp->tdb_rcvif = &(enc_softc[em->em_if].enc_if);*/
tdbp->tdb_rcvif = NULL;
} else {
KLIPS_PRINT(debug_netlink & DB_NL_TDBCB,
"klips_debug:ipsec_callback: "
"EMT_SETSPI found an old Tunnel Descriptor Block for SA: %s, delete it first.\n",
sa_len ? sa : " (error)");
SENDERR(EEXIST);
}
if ((error = tdb_init(tdbp, em))) {
KLIPS_PRINT(debug_netlink & DB_NL_TDBCB,
"klips_debug:ipsec_callback: "
"EMT_SETSPI not successful for SA: %s, deleting.\n",
sa_len ? sa : " (error)");
ipsec_tdbwipe(tdbp);
SENDERR(-error);
}
tdbp->tdb_lifetime_addtime_c = jiffies/HZ;
tdbp->tdb_state = 1;
if(!tdbp->tdb_lifetime_allocations_c) {
tdbp->tdb_lifetime_allocations_c += 1;
}
puttdb(tdbp);
KLIPS_PRINT(debug_netlink & DB_NL_TDBCB,
"klips_debug:ipsec_callback: "
"EMT_SETSPI successful for SA: %s\n",
sa_len ? sa : " (error)");
break;
case EMT_DELSPI:
if (em->em_if >= 5) /* XXX -- why 5? */
SENDERR(ENODEV);
spin_lock_bh(&tdb_lock);
tdbp = gettdb(&(em->em_said));
if (tdbp == NULL) {
KLIPS_PRINT(debug_netlink & DB_NL_TDBCB,
"klips_debug:ipsec_callback: "
"EMT_DELSPI Tunnel Descriptor Block not found for SA%s, could not delete.\n",
sa_len ? sa : " (error)");
spin_unlock_bh(&tdb_lock);
SENDERR(ENXIO); /* XXX -- wrong error message... */
} else {
if((error = deltdbchain(tdbp))) {
spin_unlock_bh(&tdb_lock);
SENDERR(-error);
}
}
spin_unlock_bh(&tdb_lock);
break;
case EMT_GRPSPIS:
nspis = (len - EMT_GRPSPIS_FLEN) / sizeof(em->em_rel[0]);
if ((nspis * (sizeof(em->em_rel[0]))) != (len - EMT_GRPSPIS_FLEN)) {
printk("klips_debug:ipsec_callback: "
"EMT_GRPSPI message size incorrect, expected nspis(%d)*%d, got %d.\n",
nspis,
sizeof(em->em_rel[0]),
(len - EMT_GRPSPIS_FLEN));
SENDERR(EINVAL);
break;
}
spin_lock_bh(&tdb_lock);
for (i = 0; i < nspis; i++) {
KLIPS_PRINT(debug_netlink,
"klips_debug:ipsec_callback: "
"EMT_GRPSPI for SA(%d) %s,\n",
i,
sa_len ? sa : " (error)");
if ((tdbp = gettdb(&(em->em_rel[i].emr_said))) == NULL) {
KLIPS_PRINT(debug_netlink,
"klips_debug:ipsec_callback: "
"EMT_GRPSPI Tunnel Descriptor Block not found for SA%s, could not group.\n",
sa_len ? sa : " (error)");
spin_unlock_bh(&tdb_lock);
SENDERR(ENXIO);
} else {
if(tdbp->tdb_inext || tdbp->tdb_onext) {
KLIPS_PRINT(debug_netlink,
"klips_debug:ipsec_callback: "
"EMT_GRPSPI Tunnel Descriptor Block already grouped for SA: %s, can't regroup.\n",
sa_len ? sa : " (error)");
spin_unlock_bh(&tdb_lock);
SENDERR(EBUSY);
}
em->em_rel[i].emr_tdb = tdbp;
}
}
tprev = em->em_rel[0].emr_tdb;
tprev->tdb_inext = NULL;
for (i = 1; i < nspis; i++) {
tdbp = em->em_rel[i].emr_tdb;
tprev->tdb_onext = tdbp;
tdbp->tdb_inext = tprev;
tprev = tdbp;
}
tprev->tdb_onext = NULL;
spin_unlock_bh(&tdb_lock);
error = 0;
break;
case EMT_UNGRPSPIS:
if (len != (8 + (sizeof(struct sa_id) + sizeof(struct tdb *)) /* 12 */) ) {
printk("klips_debug:ipsec_callback: "
"EMT_UNGRPSPIS message size incorrect, expected %d, got %d.\n",
8 + (sizeof(struct sa_id) + sizeof(struct tdb *)),
len);
SENDERR(EINVAL);
break;
}
spin_lock_bh(&tdb_lock);
if ((tdbp = gettdb(&(em->em_rel[0].emr_said))) == NULL) {
KLIPS_PRINT(debug_netlink,
"klips_debug:ipsec_callback: "
"EMT_UGRPSPI Tunnel Descriptor Block not found for SA%s, could not ungroup.\n",
sa_len ? sa : " (error)");
spin_unlock_bh(&tdb_lock);
SENDERR(ENXIO);
}
while(tdbp->tdb_onext) {
tdbp = tdbp->tdb_onext;
}
while(tdbp->tdb_inext) {
tprev = tdbp;
tdbp = tdbp->tdb_inext;
tprev->tdb_inext = NULL;
tdbp->tdb_onext = NULL;
}
spin_unlock_bh(&tdb_lock);
break;
case EMT_CLRSPIS:
KLIPS_PRINT(debug_netlink,
"klips_debug:ipsec_callback: "
"spi clear called.\n");
if (em->em_if >= 5) /* XXX -- why 5? */
SENDERR(ENODEV);
ipsec_tdbcleanup(0);
break;
default:
KLIPS_PRINT(debug_netlink,
"klips_debug:ipsec_callback: "
"unknown message type\n");
SENDERR(EINVAL);
}
int ipsec_sa_init(struct ipsec_sa *ipsp)
{
int error = 0;
char sa[SATOT_BUF];
size_t sa_len;
#ifdef CONFIG_KLIPS_DEBUG
char ipaddr_txt[ADDRTOA_BUF];
char ipaddr2_txt[ADDRTOA_BUF];
#endif
#if defined (CONFIG_KLIPS_AUTH_HMAC_MD5) || \
defined (CONFIG_KLIPS_AUTH_HMAC_SHA1)
unsigned char kb[AHMD596_BLKLEN];
int i;
#endif
if (ipsp == NULL) {
KLIPS_PRINT(debug_pfkey,
"ipsec_sa_init: "
"ipsp is NULL, fatal\n");
SENDERR(EINVAL);
}
sa_len = KLIPS_SATOT(debug_pfkey, &ipsp->ips_said, 0, sa, sizeof(sa));
KLIPS_PRINT(debug_pfkey,
"ipsec_sa_init: "
"(pfkey defined) called for SA:%s\n",
sa_len ? sa : " (error)");
KLIPS_PRINT(debug_pfkey,
"ipsec_sa_init: "
"calling init routine of %s%s%s\n",
IPS_XFORM_NAME(ipsp));
switch (ipsp->ips_said.proto) {
#ifdef CONFIG_KLIPS_IPIP
case IPPROTO_IPIP: {
ipsp->ips_xformfuncs = ipip_xform_funcs;
#ifdef CONFIG_KLIPS_DEBUG
sin_addrtot(ipsp->ips_addr_s, 0, ipaddr_txt,
sizeof(ipaddr_txt));
sin_addrtot(ipsp->ips_addr_d, 0, ipaddr2_txt,
sizeof(ipaddr2_txt));
KLIPS_PRINT(debug_pfkey,
"ipsec_sa_init: "
"(pfkey defined) IPIP ipsec_sa set for %s->%s.\n",
ipaddr_txt,
ipaddr2_txt);
#endif
}
break;
#endif /* !CONFIG_KLIPS_IPIP */
#ifdef CONFIG_KLIPS_AH
case IPPROTO_AH:
ipsp->ips_xformfuncs = ah_xform_funcs;
#ifdef CONFIG_KLIPS_OCF
if (ipsec_ocf_sa_init(ipsp, ipsp->ips_authalg, 0))
break;
#endif
#ifdef CONFIG_KLIPS_ALG
error = ipsec_alg_auth_key_create(ipsp);
if ((error < 0) && (error != -EPROTO))
SENDERR(-error);
if (error == -EPROTO) {
/* perform manual key generation,
ignore this particular error */
error = 0;
#endif /* CONFIG_KLIPS_ALG */
switch (ipsp->ips_authalg) {
# ifdef CONFIG_KLIPS_AUTH_HMAC_MD5
case AH_MD5: {
unsigned char *akp;
unsigned int aks;
MD5_CTX *ictx;
MD5_CTX *octx;
if (ipsp->ips_key_bits_a != (AHMD596_KLEN * 8)) {
KLIPS_PRINT(debug_pfkey,
"ipsec_sa_init: "
"incorrect key size: %d bits -- must be %d bits\n" /*octets (bytes)\n"*/,
ipsp->ips_key_bits_a, AHMD596_KLEN *
8);
SENDERR(EINVAL);
}
# if KLIPS_DIVULGE_HMAC_KEY
KLIPS_PRINT(debug_pfkey && sysctl_ipsec_debug_verbose,
"ipsec_sa_init: "
"hmac md5-96 key is 0x%08x %08x %08x %08x\n",
ntohl(*(((__u32 *)ipsp->ips_key_a) + 0)),
ntohl(*(((__u32 *)ipsp->ips_key_a) + 1)),
ntohl(*(((__u32 *)ipsp->ips_key_a) + 2)),
ntohl(*(((__u32 *)ipsp->ips_key_a) + 3)));
# endif /* KLIPS_DIVULGE_HMAC_KEY */
ipsp->ips_auth_bits = AHMD596_ALEN * 8;
/* save the pointer to the key material */
akp = ipsp->ips_key_a;
aks = ipsp->ips_key_a_size;
KLIPS_PRINT(debug_pfkey && sysctl_ipsec_debug_verbose,
"ipsec_sa_init: "
"allocating %lu bytes for md5_ctx.\n",
(unsigned long) sizeof(struct md5_ctx));
if ((ipsp->ips_key_a = (caddr_t)
kmalloc(sizeof(struct md5_ctx),
GFP_ATOMIC)) == NULL) {
ipsp->ips_key_a = akp;
SENDERR(ENOMEM);
}
ipsp->ips_key_a_size = sizeof(struct md5_ctx);
for (i = 0; i < DIVUP(ipsp->ips_key_bits_a, 8); i++)
kb[i] = akp[i] ^ HMAC_IPAD;
for (; i < AHMD596_BLKLEN; i++)
kb[i] = HMAC_IPAD;
ictx = &(((struct md5_ctx*)(ipsp->ips_key_a))->ictx);
osMD5Init(ictx);
osMD5Update(ictx, kb, AHMD596_BLKLEN);
for (i = 0; i < AHMD596_BLKLEN; i++)
kb[i] ^= (HMAC_IPAD ^ HMAC_OPAD);
octx = &(((struct md5_ctx*)(ipsp->ips_key_a))->octx);
osMD5Init(octx);
osMD5Update(octx, kb, AHMD596_BLKLEN);
# if KLIPS_DIVULGE_HMAC_KEY
KLIPS_PRINT(debug_pfkey && sysctl_ipsec_debug_verbose,
"ipsec_sa_init: "
"MD5 ictx=0x%08x %08x %08x %08x octx=0x%08x %08x %08x %08x\n",
((__u32*)ictx)[0],
((__u32*)ictx)[1],
((__u32*)ictx)[2],
((__u32*)ictx)[3],
((__u32*)octx)[0],
((__u32*)octx)[1],
((__u32*)octx)[2],
((__u32*)octx)[3] );
# endif /* KLIPS_DIVULGE_HMAC_KEY */
/* zero key buffer -- paranoid */
memset(akp, 0, aks);
kfree(akp);
}
break;
# endif /* CONFIG_KLIPS_AUTH_HMAC_MD5 */
# ifdef CONFIG_KLIPS_AUTH_HMAC_SHA1
case AH_SHA: {
unsigned char *akp;
unsigned int aks;
SHA1_CTX *ictx;
SHA1_CTX *octx;
if (ipsp->ips_key_bits_a != (AHSHA196_KLEN * 8)) {
KLIPS_PRINT(debug_pfkey,
"ipsec_sa_init: "
"incorrect key size: %d bits -- must be %d bits\n" /*octets (bytes)\n"*/,
ipsp->ips_key_bits_a, AHSHA196_KLEN *
8);
SENDERR(EINVAL);
}
# if KLIPS_DIVULGE_HMAC_KEY
KLIPS_PRINT(debug_pfkey && sysctl_ipsec_debug_verbose,
"ipsec_sa_init: "
"hmac sha1-96 key is 0x%08x %08x %08x %08x\n",
ntohl(*(((__u32 *)ipsp->ips_key_a) + 0)),
ntohl(*(((__u32 *)ipsp->ips_key_a) + 1)),
ntohl(*(((__u32 *)ipsp->ips_key_a) + 2)),
ntohl(*(((__u32 *)ipsp->ips_key_a) + 3)));
# endif /* KLIPS_DIVULGE_HMAC_KEY */
ipsp->ips_auth_bits = AHSHA196_ALEN * 8;
/* save the pointer to the key material */
akp = ipsp->ips_key_a;
aks = ipsp->ips_key_a_size;
KLIPS_PRINT(debug_pfkey && sysctl_ipsec_debug_verbose,
"ipsec_sa_init: "
"allocating %lu bytes for sha1_ctx.\n",
(unsigned long) sizeof(struct sha1_ctx));
if ((ipsp->ips_key_a = (caddr_t)
kmalloc(sizeof(struct sha1_ctx),
GFP_ATOMIC)) == NULL) {
ipsp->ips_key_a = akp;
SENDERR(ENOMEM);
}
ipsp->ips_key_a_size = sizeof(struct sha1_ctx);
for (i = 0; i < DIVUP(ipsp->ips_key_bits_a, 8); i++)
kb[i] = akp[i] ^ HMAC_IPAD;
for (; i < AHMD596_BLKLEN; i++)
kb[i] = HMAC_IPAD;
ictx = &(((struct sha1_ctx*)(ipsp->ips_key_a))->ictx);
SHA1Init(ictx);
SHA1Update(ictx, kb, AHSHA196_BLKLEN);
for (i = 0; i < AHSHA196_BLKLEN; i++)
kb[i] ^= (HMAC_IPAD ^ HMAC_OPAD);
octx = &(((struct sha1_ctx*)(ipsp->ips_key_a))->octx);
SHA1Init(octx);
SHA1Update(octx, kb, AHSHA196_BLKLEN);
# if KLIPS_DIVULGE_HMAC_KEY
KLIPS_PRINT(debug_pfkey && sysctl_ipsec_debug_verbose,
"ipsec_sa_init: "
"SHA1 ictx=0x%08x %08x %08x %08x octx=0x%08x %08x %08x %08x\n",
((__u32*)ictx)[0],
((__u32*)ictx)[1],
((__u32*)ictx)[2],
((__u32*)ictx)[3],
((__u32*)octx)[0],
((__u32*)octx)[1],
((__u32*)octx)[2],
((__u32*)octx)[3] );
# endif /* KLIPS_DIVULGE_HMAC_KEY */
/* zero key buffer -- paranoid */
memset(akp, 0, aks);
kfree(akp);
}
break;
# endif /* CONFIG_KLIPS_AUTH_HMAC_SHA1 */
default:
KLIPS_PRINT(debug_pfkey,
"ipsec_sa_init: "
"authalg=%d support not available in the kernel",
ipsp->ips_authalg);
SENDERR(EINVAL);
}
#ifdef CONFIG_KLIPS_ALG
/* closure of the -EPROTO condition above */
}
#endif
break;
#endif /* CONFIG_KLIPS_AH */
#ifdef CONFIG_KLIPS_ESP
case IPPROTO_ESP:
ipsp->ips_xformfuncs = esp_xform_funcs;
{
#ifdef CONFIG_KLIPS_OCF
if (ipsec_ocf_sa_init(ipsp, ipsp->ips_authalg,
ipsp->ips_encalg))
break;
#endif
#ifdef CONFIG_KLIPS_ALG
error = ipsec_alg_enc_key_create(ipsp);
if (error < 0)
SENDERR(-error);
error = ipsec_alg_auth_key_create(ipsp);
if ((error < 0) && (error != -EPROTO))
SENDERR(-error);
if (error == -EPROTO) {
/* perform manual key generation,
ignore this particular error */
error = 0;
#endif /* CONFIG_KLIPS_ALG */
switch (ipsp->ips_authalg) {
#if defined (CONFIG_KLIPS_AUTH_HMAC_MD5) || \
defined (CONFIG_KLIPS_AUTH_HMAC_SHA1)
unsigned char *akp;
unsigned int aks;
#endif
# ifdef CONFIG_KLIPS_AUTH_HMAC_MD5
case AH_MD5: {
MD5_CTX *ictx;
MD5_CTX *octx;
if (ipsp->ips_key_bits_a !=
(AHMD596_KLEN * 8)) {
KLIPS_PRINT(debug_pfkey,
"ipsec_sa_init: "
"incorrect authorisation key size: %d bits -- must be %d bits\n" /*octets (bytes)\n"*/,
ipsp->ips_key_bits_a,
AHMD596_KLEN * 8);
SENDERR(EINVAL);
}
# if KLIPS_DIVULGE_HMAC_KEY
KLIPS_PRINT(
debug_pfkey && sysctl_ipsec_debug_verbose,
"ipsec_sa_init: "
"hmac md5-96 key is 0x%08x %08x %08x %08x\n",
ntohl(*(((__u32 *)(ipsp->ips_key_a)) +
0)),
ntohl(*(((__u32 *)(ipsp->ips_key_a)) +
1)),
ntohl(*(((__u32 *)(ipsp->ips_key_a)) +
2)),
ntohl(*(((__u32 *)(ipsp->ips_key_a)) +
3)));
# endif /* KLIPS_DIVULGE_HMAC_KEY */
ipsp->ips_auth_bits = AHMD596_ALEN * 8;
/* save the pointer to the key material */
akp = ipsp->ips_key_a;
aks = ipsp->ips_key_a_size;
KLIPS_PRINT(
debug_pfkey && sysctl_ipsec_debug_verbose,
"ipsec_sa_init: "
"allocating %lu bytes for md5_ctx.\n",
(unsigned long) sizeof(struct
md5_ctx));
if ((ipsp->ips_key_a = (caddr_t)
kmalloc(sizeof(struct md5_ctx),
GFP_ATOMIC)) == NULL) {
ipsp->ips_key_a = akp;
SENDERR(ENOMEM);
}
ipsp->ips_key_a_size = sizeof(struct md5_ctx);
for (i = 0; i < DIVUP(ipsp->ips_key_bits_a, 8);
i++)
kb[i] = akp[i] ^ HMAC_IPAD;
for (; i < AHMD596_BLKLEN; i++)
kb[i] = HMAC_IPAD;
ictx = &(((struct md5_ctx*)(ipsp->ips_key_a))
->ictx);
osMD5Init(ictx);
osMD5Update(ictx, kb, AHMD596_BLKLEN);
for (i = 0; i < AHMD596_BLKLEN; i++)
kb[i] ^= (HMAC_IPAD ^ HMAC_OPAD);
octx = &(((struct md5_ctx*)(ipsp->ips_key_a))
->octx);
osMD5Init(octx);
osMD5Update(octx, kb, AHMD596_BLKLEN);
# if KLIPS_DIVULGE_HMAC_KEY
KLIPS_PRINT(
debug_pfkey && sysctl_ipsec_debug_verbose,
"ipsec_sa_init: "
"MD5 ictx=0x%08x %08x %08x %08x octx=0x%08x %08x %08x %08x\n",
((__u32*)ictx)[0],
((__u32*)ictx)[1],
((__u32*)ictx)[2],
((__u32*)ictx)[3],
((__u32*)octx)[0],
((__u32*)octx)[1],
((__u32*)octx)[2],
((__u32*)octx)[3] );
# endif /* KLIPS_DIVULGE_HMAC_KEY */
/* paranoid */
memset(akp, 0, aks);
kfree(akp);
break;
}
# endif /* CONFIG_KLIPS_AUTH_HMAC_MD5 */
# ifdef CONFIG_KLIPS_AUTH_HMAC_SHA1
case AH_SHA: {
SHA1_CTX *ictx;
SHA1_CTX *octx;
if (ipsp->ips_key_bits_a !=
(AHSHA196_KLEN * 8)) {
KLIPS_PRINT(debug_pfkey,
"ipsec_sa_init: "
"incorrect authorisation key size: %d bits -- must be %d bits\n" /*octets (bytes)\n"*/,
ipsp->ips_key_bits_a,
AHSHA196_KLEN * 8);
SENDERR(EINVAL);
}
# if KLIPS_DIVULGE_HMAC_KEY
KLIPS_PRINT(
debug_pfkey && sysctl_ipsec_debug_verbose,
"ipsec_sa_init: "
"hmac sha1-96 key is 0x%08x %08x %08x %08x\n",
ntohl(*(((__u32 *)ipsp->ips_key_a) +
0)),
ntohl(*(((__u32 *)ipsp->ips_key_a) +
1)),
ntohl(*(((__u32 *)ipsp->ips_key_a) +
2)),
ntohl(*(((__u32 *)ipsp->ips_key_a) +
3)));
# endif /* KLIPS_DIVULGE_HMAC_KEY */
ipsp->ips_auth_bits = AHSHA196_ALEN * 8;
/* save the pointer to the key material */
akp = ipsp->ips_key_a;
aks = ipsp->ips_key_a_size;
KLIPS_PRINT(
debug_pfkey && sysctl_ipsec_debug_verbose,
"ipsec_sa_init: "
"allocating %lu bytes for sha1_ctx.\n",
(unsigned long) sizeof(struct
sha1_ctx));
if ((ipsp->ips_key_a = (caddr_t)
kmalloc(sizeof(struct sha1_ctx),
GFP_ATOMIC)) == NULL) {
ipsp->ips_key_a = akp;
SENDERR(ENOMEM);
}
ipsp->ips_key_a_size = sizeof(struct sha1_ctx);
for (i = 0; i < DIVUP(ipsp->ips_key_bits_a, 8);
i++)
kb[i] = akp[i] ^ HMAC_IPAD;
for (; i < AHMD596_BLKLEN; i++)
kb[i] = HMAC_IPAD;
ictx = &(((struct sha1_ctx*)(ipsp->ips_key_a))
->ictx);
SHA1Init(ictx);
SHA1Update(ictx, kb, AHSHA196_BLKLEN);
for (i = 0; i < AHSHA196_BLKLEN; i++)
kb[i] ^= (HMAC_IPAD ^ HMAC_OPAD);
octx = &((struct sha1_ctx*)(ipsp->ips_key_a))
->octx;
SHA1Init(octx);
SHA1Update(octx, kb, AHSHA196_BLKLEN);
# if KLIPS_DIVULGE_HMAC_KEY
KLIPS_PRINT(
debug_pfkey && sysctl_ipsec_debug_verbose,
"ipsec_sa_init: "
"SHA1 ictx=0x%08x %08x %08x %08x octx=0x%08x %08x %08x %08x\n",
((__u32*)ictx)[0],
((__u32*)ictx)[1],
((__u32*)ictx)[2],
((__u32*)ictx)[3],
((__u32*)octx)[0],
((__u32*)octx)[1],
((__u32*)octx)[2],
((__u32*)octx)[3] );
# endif /* KLIPS_DIVULGE_HMAC_KEY */
memset(akp, 0, aks);
kfree(akp);
break;
}
# endif /* CONFIG_KLIPS_AUTH_HMAC_SHA1 */
case AH_NONE:
break;
default:
KLIPS_PRINT(debug_pfkey,
"ipsec_sa_init: "
"authalg=%d support not available in the kernel.\n",
ipsp->ips_authalg);
SENDERR(EINVAL);
}
#ifdef CONFIG_KLIPS_ALG
/* closure of the -EPROTO condition above */
}
#endif
ipsp->ips_iv_size =
ipsp->ips_alg_enc->ixt_common.ixt_support.
ias_ivlen / 8;
/* Create IV */
if (ipsp->ips_iv_size) {
if ((ipsp->ips_iv = (caddr_t)
kmalloc(ipsp->ips_iv_size,
GFP_ATOMIC)) == NULL)
SENDERR(ENOMEM);
prng_bytes(&ipsec_prng, (char *)ipsp->ips_iv,
ipsp->ips_iv_size);
ipsp->ips_iv_bits = ipsp->ips_iv_size * 8;
}
}
break;
#endif /* !CONFIG_KLIPS_ESP */
#ifdef CONFIG_KLIPS_IPCOMP
case IPPROTO_COMP:
ipsp->ips_xformfuncs = ipcomp_xform_funcs;
ipsp->ips_comp_adapt_tries = 0;
ipsp->ips_comp_adapt_skip = 0;
ipsp->ips_comp_ratio_cbytes = 0;
ipsp->ips_comp_ratio_dbytes = 0;
#ifdef CONFIG_KLIPS_OCF
if (ipsec_ocf_comp_sa_init(ipsp, ipsp->ips_encalg))
break;
#endif
ipsp->ips_comp_adapt_tries = 0;
ipsp->ips_comp_adapt_skip = 0;
ipsp->ips_comp_ratio_cbytes = 0;
ipsp->ips_comp_ratio_dbytes = 0;
break;
#endif /* CONFIG_KLIPS_IPCOMP */
default:
printk(KERN_ERR "KLIPS sa initialization: "
"proto=%d unknown.\n",
ipsp->ips_said.proto);
SENDERR(EINVAL);
}
errlab:
return error;
}
int
pfkey_lifetime_process(struct sadb_ext *pfkey_ext, struct pfkey_extracted_data* extr)
{
int error = 0;
struct sadb_lifetime *pfkey_lifetime = (struct sadb_lifetime *)pfkey_ext;
KLIPS_PRINT(debug_pfkey,
"klips_debug:pfkey_lifetime_process: .\n");
if(!extr || !extr->ips) {
KLIPS_PRINT(debug_pfkey,
"klips_debug:pfkey_lifetime_process: "
"extr or extr->ips is NULL, fatal\n");
SENDERR(EINVAL);
}
switch(pfkey_lifetime->sadb_lifetime_exttype) {
case SADB_EXT_LIFETIME_CURRENT:
KLIPS_PRINT(debug_pfkey,
"klips_debug:pfkey_lifetime_process: "
"lifetime_current not supported yet.\n");
SENDERR(EINVAL);
break;
case SADB_EXT_LIFETIME_HARD:
ipsec_lifetime_update_hard(&extr->ips->ips_life.ipl_allocations,
pfkey_lifetime->sadb_lifetime_allocations);
ipsec_lifetime_update_hard(&extr->ips->ips_life.ipl_bytes,
pfkey_lifetime->sadb_lifetime_bytes);
ipsec_lifetime_update_hard(&extr->ips->ips_life.ipl_addtime,
pfkey_lifetime->sadb_lifetime_addtime);
ipsec_lifetime_update_hard(&extr->ips->ips_life.ipl_usetime,
pfkey_lifetime->sadb_lifetime_usetime);
break;
case SADB_EXT_LIFETIME_SOFT:
ipsec_lifetime_update_soft(&extr->ips->ips_life.ipl_allocations,
pfkey_lifetime->sadb_lifetime_allocations);
ipsec_lifetime_update_soft(&extr->ips->ips_life.ipl_bytes,
pfkey_lifetime->sadb_lifetime_bytes);
ipsec_lifetime_update_soft(&extr->ips->ips_life.ipl_addtime,
pfkey_lifetime->sadb_lifetime_addtime);
ipsec_lifetime_update_soft(&extr->ips->ips_life.ipl_usetime,
pfkey_lifetime->sadb_lifetime_usetime);
break;
default:
KLIPS_PRINT(debug_pfkey,
"klips_debug:pfkey_lifetime_process: "
"invalid exttype=%d.\n",
pfkey_ext->sadb_ext_type);
SENDERR(EINVAL);
}
errlab:
return error;
}
