DEBUG_NO_STATIC int
pfkey_spirange_parse(struct sadb_ext *pfkey_ext)
{
int error = 0;
struct sadb_spirange *pfkey_spirange = (struct sadb_spirange *)pfkey_ext;
/* sanity checks... */
if(pfkey_spirange->sadb_spirange_len !=
sizeof(struct sadb_spirange) / IPSEC_PFKEYv2_ALIGN) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_spirange_parse: "
"size wrong ext_len=%d, key_ext_len=%d.\n",
pfkey_spirange->sadb_spirange_len,
(int)sizeof(struct sadb_spirange));
SENDERR(EINVAL);
}
if(pfkey_spirange->sadb_spirange_reserved) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_spirange_parse: "
"reserved=%d must be set to zero.\n",
pfkey_spirange->sadb_spirange_reserved);
SENDERR(EINVAL);
}
if(ntohl(pfkey_spirange->sadb_spirange_max) < ntohl(pfkey_spirange->sadb_spirange_min)) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_spirange_parse: "
"minspi=%08x must be < maxspi=%08x.\n",
ntohl(pfkey_spirange->sadb_spirange_min),
ntohl(pfkey_spirange->sadb_spirange_max));
SENDERR(EINVAL);
}
if(ntohl(pfkey_spirange->sadb_spirange_min) <= 255) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_spirange_parse: "
"minspi=%08x must be > 255.\n",
ntohl(pfkey_spirange->sadb_spirange_min));
SENDERR(EEXIST);
}
DEBUGGING(PF_KEY_DEBUG_PARSE_STRUCT,
"pfkey_spirange_parse: "
"ext_len=%u ext_type=%u(%s) min=%u max=%u res=%u.\n",
pfkey_spirange->sadb_spirange_len,
pfkey_spirange->sadb_spirange_exttype,
pfkey_v2_sadb_ext_string(pfkey_spirange->sadb_spirange_exttype),
pfkey_spirange->sadb_spirange_min,
pfkey_spirange->sadb_spirange_max,
pfkey_spirange->sadb_spirange_reserved);
errlab:
return error;
}
DEBUG_NO_STATIC int
pfkey_lifetime_parse(struct sadb_ext *pfkey_ext)
{
int error = 0;
struct sadb_lifetime *pfkey_lifetime = (struct sadb_lifetime *)pfkey_ext;
DEBUGGING(PF_KEY_DEBUG_PARSE_FLOW,
"pfkey_lifetime_parse:enter\n");
/* sanity checks... */
if(!pfkey_lifetime) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_lifetime_parse: "
"NULL pointer passed in.\n");
SENDERR(EINVAL);
}
if(pfkey_lifetime->sadb_lifetime_len !=
sizeof(struct sadb_lifetime) / IPSEC_PFKEYv2_ALIGN) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_lifetime_parse: "
"length wrong pfkey_lifetime->sadb_lifetime_len=%d sizeof(struct sadb_lifetime)=%d.\n",
pfkey_lifetime->sadb_lifetime_len,
(int)sizeof(struct sadb_lifetime));
SENDERR(EINVAL);
}
if((pfkey_lifetime->sadb_lifetime_exttype != K_SADB_EXT_LIFETIME_HARD) &&
(pfkey_lifetime->sadb_lifetime_exttype != K_SADB_EXT_LIFETIME_SOFT) &&
(pfkey_lifetime->sadb_lifetime_exttype != K_SADB_EXT_LIFETIME_CURRENT)) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_lifetime_parse: "
"unexpected ext_type=%d.\n",
pfkey_lifetime->sadb_lifetime_exttype);
SENDERR(EINVAL);
}
DEBUGGING(PF_KEY_DEBUG_PARSE_STRUCT,
"pfkey_lifetime_parse: "
"life_type=%d(%s) alloc=%u bytes=%u add=%u use=%u.\n",
pfkey_lifetime->sadb_lifetime_exttype,
pfkey_v2_sadb_ext_string(pfkey_lifetime->sadb_lifetime_exttype),
pfkey_lifetime->sadb_lifetime_allocations,
(unsigned)pfkey_lifetime->sadb_lifetime_bytes,
(unsigned)pfkey_lifetime->sadb_lifetime_addtime,
(unsigned)pfkey_lifetime->sadb_lifetime_usetime);
errlab:
return error;
}
DEBUG_NO_STATIC int
pfkey_sa_parse(struct sadb_ext *pfkey_ext)
{
int error = 0;
struct sadb_sa *pfkey_sa = (struct sadb_sa *)pfkey_ext;
DEBUGGING(PF_KEY_DEBUG_PARSE_FLOW,
"pfkey_sa_parse: entry\n");
/* sanity checks... */
if(!pfkey_sa) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_sa_parse: "
"NULL pointer passed in.\n");
SENDERR(EINVAL);
}
if(pfkey_sa->sadb_sa_len != sizeof(struct sadb_sa) / IPSEC_PFKEYv2_ALIGN) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_sa_parse: "
"length wrong pfkey_sa->sadb_sa_len=%d sizeof(struct sadb_sa)=%ld.\n",
pfkey_sa->sadb_sa_len,
sizeof(struct sadb_sa));
SENDERR(EINVAL);
}
if(pfkey_sa->sadb_sa_encrypt > SADB_EALG_MAX) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_sa_parse: "
"pfkey_sa->sadb_sa_encrypt=%d > SADB_EALG_MAX=%d.\n",
pfkey_sa->sadb_sa_encrypt,
SADB_EALG_MAX);
SENDERR(EINVAL);
}
if(pfkey_sa->sadb_sa_auth > SADB_AALG_MAX) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_sa_parse: "
"pfkey_sa->sadb_sa_auth=%d > SADB_AALG_MAX=%d.\n",
pfkey_sa->sadb_sa_auth,
SADB_AALG_MAX);
SENDERR(EINVAL);
}
if(pfkey_sa->sadb_sa_state > SADB_SASTATE_MAX) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_sa_parse: "
"state=%d exceeds MAX=%d.\n",
pfkey_sa->sadb_sa_state,
SADB_SASTATE_MAX);
SENDERR(EINVAL);
}
if(pfkey_sa->sadb_sa_state == SADB_SASTATE_DEAD) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_sa_parse: "
"state=%d is DEAD=%d.\n",
pfkey_sa->sadb_sa_state,
SADB_SASTATE_DEAD);
SENDERR(EINVAL);
}
if(pfkey_sa->sadb_sa_replay > 64) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_sa_parse: "
"replay window size: %d -- must be 0 <= size <= 64\n",
pfkey_sa->sadb_sa_replay);
SENDERR(EINVAL);
}
if(! ((pfkey_sa->sadb_sa_exttype == SADB_EXT_SA) ||
(pfkey_sa->sadb_sa_exttype == SADB_X_EXT_SA2)))
{
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_sa_parse: "
"unknown exttype=%d, expecting SADB_EXT_SA=%d or SADB_X_EXT_SA2=%d.\n",
pfkey_sa->sadb_sa_exttype,
SADB_EXT_SA,
SADB_X_EXT_SA2);
SENDERR(EINVAL);
}
DEBUGGING(PF_KEY_DEBUG_PARSE_STRUCT,
"pfkey_sa_parse: "
"successfully found len=%d exttype=%d(%s) spi=%08lx replay=%d state=%d auth=%d encrypt=%d flags=%d.\n",
pfkey_sa->sadb_sa_len,
pfkey_sa->sadb_sa_exttype, pfkey_v2_sadb_ext_string(pfkey_sa->sadb_sa_exttype),
(long unsigned int)ntohl(pfkey_sa->sadb_sa_spi),
pfkey_sa->sadb_sa_replay,
pfkey_sa->sadb_sa_state,
pfkey_sa->sadb_sa_auth,
pfkey_sa->sadb_sa_encrypt,
pfkey_sa->sadb_sa_flags);
errlab:
return error;
}
int
pfkey_msg_parse(struct sadb_msg *pfkey_msg,
struct pf_key_ext_parsers_def *ext_parsers[],
struct sadb_ext *extensions[],
int dir)
{
int error = 0;
int remain;
struct sadb_ext *pfkey_ext;
int extensions_seen = 0;
DEBUGGING(PF_KEY_DEBUG_PARSE_STRUCT,
"pfkey_msg_parse: "
"parsing message ver=%d, type=%d(%s), errno=%d, satype=%d(%s), len=%d, res=%d, seq=%d, pid=%d.\n",
pfkey_msg->sadb_msg_version,
pfkey_msg->sadb_msg_type,
pfkey_v2_sadb_type_string(pfkey_msg->sadb_msg_type),
pfkey_msg->sadb_msg_errno,
pfkey_msg->sadb_msg_satype,
satype2name(pfkey_msg->sadb_msg_satype),
pfkey_msg->sadb_msg_len,
pfkey_msg->sadb_msg_reserved,
pfkey_msg->sadb_msg_seq,
pfkey_msg->sadb_msg_pid);
if(ext_parsers == NULL) ext_parsers = ext_default_parsers;
pfkey_extensions_init(extensions);
remain = pfkey_msg->sadb_msg_len;
remain -= sizeof(struct sadb_msg) / IPSEC_PFKEYv2_ALIGN;
pfkey_ext = (struct sadb_ext*)((char*)pfkey_msg +
sizeof(struct sadb_msg));
extensions[0] = (struct sadb_ext *) pfkey_msg;
if(pfkey_msg->sadb_msg_version != PF_KEY_V2) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_msg_parse: "
"not PF_KEY_V2 msg, found %d, should be %d.\n",
pfkey_msg->sadb_msg_version,
PF_KEY_V2);
SENDERR(EINVAL);
}
if(!pfkey_msg->sadb_msg_type) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_msg_parse: "
"msg type not set, must be non-zero..\n");
SENDERR(EINVAL);
}
if(pfkey_msg->sadb_msg_type > SADB_MAX) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_msg_parse: "
"msg type=%d > max=%d.\n",
pfkey_msg->sadb_msg_type,
SADB_MAX);
SENDERR(EINVAL);
}
switch(pfkey_msg->sadb_msg_type) {
case SADB_GETSPI:
case SADB_UPDATE:
case SADB_ADD:
case SADB_DELETE:
case SADB_GET:
case SADB_X_GRPSA:
case SADB_X_ADDFLOW:
if(!satype2proto(pfkey_msg->sadb_msg_satype)) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_msg_parse: "
"satype %d conversion to proto failed for msg_type %d (%s).\n",
pfkey_msg->sadb_msg_satype,
pfkey_msg->sadb_msg_type,
pfkey_v2_sadb_type_string(pfkey_msg->sadb_msg_type));
SENDERR(EINVAL);
} else {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_msg_parse: "
"satype %d(%s) conversion to proto gives %d for msg_type %d(%s).\n",
pfkey_msg->sadb_msg_satype,
satype2name(pfkey_msg->sadb_msg_satype),
satype2proto(pfkey_msg->sadb_msg_satype),
pfkey_msg->sadb_msg_type,
pfkey_v2_sadb_type_string(pfkey_msg->sadb_msg_type));
}
case SADB_ACQUIRE:
case SADB_REGISTER:
case SADB_EXPIRE:
if(!pfkey_msg->sadb_msg_satype) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_msg_parse: "
"satype is zero, must be non-zero for msg_type %d(%s).\n",
pfkey_msg->sadb_msg_type,
pfkey_v2_sadb_type_string(pfkey_msg->sadb_msg_type));
SENDERR(EINVAL);
}
default:
}
/* errno must not be set in downward messages */
/* this is not entirely true... a response to an ACQUIRE could return an error */
if((dir == EXT_BITS_IN) && (pfkey_msg->sadb_msg_type != SADB_ACQUIRE) && pfkey_msg->sadb_msg_errno) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_msg_parse: "
"errno set to %d.\n",
pfkey_msg->sadb_msg_errno);
SENDERR(EINVAL);
}
DEBUGGING(PF_KEY_DEBUG_PARSE_STRUCT,
"pfkey_msg_parse: "
"remain=%d, ext_type=%d(%s), ext_len=%d.\n",
remain,
pfkey_ext->sadb_ext_type,
pfkey_v2_sadb_ext_string(pfkey_ext->sadb_ext_type),
pfkey_ext->sadb_ext_len);
DEBUGGING(PF_KEY_DEBUG_PARSE_STRUCT,
"pfkey_msg_parse: "
"extensions permitted=%08x, required=%08x.\n",
extensions_bitmaps[dir][EXT_BITS_PERM][pfkey_msg->sadb_msg_type],
extensions_bitmaps[dir][EXT_BITS_REQ][pfkey_msg->sadb_msg_type]);
extensions_seen = 1;
while( (remain * IPSEC_PFKEYv2_ALIGN) >= sizeof(struct sadb_ext) ) {
/* Is there enough message left to support another extension header? */
if(remain < pfkey_ext->sadb_ext_len) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_msg_parse: "
"remain %d less than ext len %d.\n",
remain, pfkey_ext->sadb_ext_len);
SENDERR(EINVAL);
}
DEBUGGING(PF_KEY_DEBUG_PARSE_STRUCT,
"pfkey_msg_parse: "
"parsing ext type=%d remain=%d.\n",
pfkey_ext->sadb_ext_type,
remain);
/* Is the extension header type valid? */
if((pfkey_ext->sadb_ext_type > SADB_EXT_MAX) || (!pfkey_ext->sadb_ext_type)) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_msg_parse: "
"ext type %d invalid, SADB_EXT_MAX=%d.\n",
pfkey_ext->sadb_ext_type, SADB_EXT_MAX);
SENDERR(EINVAL);
}
/* Have we already seen this type of extension? */
if((extensions_seen & ( 1 << pfkey_ext->sadb_ext_type )) != 0)
{
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_msg_parse: "
"ext type %d already seen.\n",
pfkey_ext->sadb_ext_type);
SENDERR(EINVAL);
}
/* Do I even know about this type of extension? */
if(ext_parsers[pfkey_ext->sadb_ext_type]==NULL) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_msg_parse: "
"ext type %d unknown, ignoring.\n",
pfkey_ext->sadb_ext_type);
goto next_ext;
}
/* Is this type of extension permitted for this type of message? */
if(!(extensions_bitmaps[dir][EXT_BITS_PERM][pfkey_msg->sadb_msg_type] &
1<<pfkey_ext->sadb_ext_type)) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_msg_parse: "
"ext type %d not permitted, exts_perm_in=%08x, 1<<type=%08x\n",
pfkey_ext->sadb_ext_type,
extensions_bitmaps[dir][EXT_BITS_PERM][pfkey_msg->sadb_msg_type],
1<<pfkey_ext->sadb_ext_type);
SENDERR(EINVAL);
}
DEBUGGING(PF_KEY_DEBUG_PARSE_STRUCT,
"pfkey_msg_parse: "
"About to parse extension %d %p with parser %s.\n",
pfkey_ext->sadb_ext_type,
pfkey_ext,
ext_parsers[pfkey_ext->sadb_ext_type]->parser_name);
/* Parse the extension */
if((error =
(*ext_parsers[pfkey_ext->sadb_ext_type]->parser)(pfkey_ext))) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_msg_parse: "
"extension parsing for type %d failed with error %d.\n",
pfkey_ext->sadb_ext_type, error);
SENDERR(-error);
}
DEBUGGING(PF_KEY_DEBUG_PARSE_STRUCT,
"pfkey_msg_parse: "
"Extension %d parsed.\n",
pfkey_ext->sadb_ext_type);
/* Mark that we have seen this extension and remember the header location */
extensions_seen |= ( 1 << pfkey_ext->sadb_ext_type );
extensions[pfkey_ext->sadb_ext_type] = pfkey_ext;
next_ext:
/* Calculate how much message remains */
remain -= pfkey_ext->sadb_ext_len;
if(!remain) {
break;
}
/* Find the next extension header */
pfkey_ext = (struct sadb_ext*)((char*)pfkey_ext +
pfkey_ext->sadb_ext_len * IPSEC_PFKEYv2_ALIGN);
}
if(remain) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_msg_parse: "
"unexpected remainder of %d.\n",
remain);
/* why is there still something remaining? */
SENDERR(EINVAL);
}
/* check required extensions */
DEBUGGING(PF_KEY_DEBUG_PARSE_STRUCT,
"pfkey_msg_parse: "
"extensions permitted=%08x, seen=%08x, required=%08x.\n",
extensions_bitmaps[dir][EXT_BITS_PERM][pfkey_msg->sadb_msg_type],
extensions_seen,
extensions_bitmaps[dir][EXT_BITS_REQ][pfkey_msg->sadb_msg_type]);
/* don't check further if it is an error return message since it
may not have a body */
if(pfkey_msg->sadb_msg_errno) {
SENDERR(-error);
}
if((extensions_seen &
extensions_bitmaps[dir][EXT_BITS_REQ][pfkey_msg->sadb_msg_type]) !=
extensions_bitmaps[dir][EXT_BITS_REQ][pfkey_msg->sadb_msg_type]) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_msg_parse: "
"required extensions missing:%08x.\n",
extensions_bitmaps[dir][EXT_BITS_REQ][pfkey_msg->sadb_msg_type] -
(extensions_seen &
extensions_bitmaps[dir][EXT_BITS_REQ][pfkey_msg->sadb_msg_type]));
SENDERR(EINVAL);
}
if((dir == EXT_BITS_IN) && (pfkey_msg->sadb_msg_type == SADB_X_DELFLOW)
&& ((extensions_seen & SADB_X_EXT_ADDRESS_DELFLOW)
!= SADB_X_EXT_ADDRESS_DELFLOW)
&& (((extensions_seen & (1<<SADB_EXT_SA)) != (1<<SADB_EXT_SA))
|| ((((struct sadb_sa*)extensions[SADB_EXT_SA])->sadb_sa_flags
& SADB_X_SAFLAGS_CLEARFLOW)
!= SADB_X_SAFLAGS_CLEARFLOW))) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_msg_parse: "
"required SADB_X_DELFLOW extensions missing: either %08x must be present or %08x must be present with SADB_X_SAFLAGS_CLEARFLOW set.\n",
SADB_X_EXT_ADDRESS_DELFLOW
- (extensions_seen & SADB_X_EXT_ADDRESS_DELFLOW),
(1<<SADB_EXT_SA) - (extensions_seen & (1<<SADB_EXT_SA)));
SENDERR(EINVAL);
}
switch(pfkey_msg->sadb_msg_type) {
case SADB_ADD:
case SADB_UPDATE:
/* check maturity */
if(((struct sadb_sa*)extensions[SADB_EXT_SA])->sadb_sa_state !=
SADB_SASTATE_MATURE) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_msg_parse: "
"state=%d for add or update should be MATURE=%d.\n",
((struct sadb_sa*)extensions[SADB_EXT_SA])->sadb_sa_state,
SADB_SASTATE_MATURE);
SENDERR(EINVAL);
}
/* check AH and ESP */
switch(((struct sadb_msg*)extensions[SADB_EXT_RESERVED])->sadb_msg_satype) {
case SADB_SATYPE_AH:
if(!(((struct sadb_sa*)extensions[SADB_EXT_SA]) &&
((struct sadb_sa*)extensions[SADB_EXT_SA])->sadb_sa_auth !=
SADB_AALG_NONE)) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_msg_parse: "
"auth alg is zero, must be non-zero for AH SAs.\n");
SENDERR(EINVAL);
}
if(((struct sadb_sa*)(extensions[SADB_EXT_SA]))->sadb_sa_encrypt !=
SADB_EALG_NONE) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_msg_parse: "
"AH handed encalg=%d, must be zero.\n",
((struct sadb_sa*)(extensions[SADB_EXT_SA]))->sadb_sa_encrypt);
SENDERR(EINVAL);
}
break;
case SADB_SATYPE_ESP:
if(!(((struct sadb_sa*)extensions[SADB_EXT_SA]) &&
((struct sadb_sa*)extensions[SADB_EXT_SA])->sadb_sa_encrypt !=
SADB_EALG_NONE)) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_msg_parse: "
"encrypt alg=%d is zero, must be non-zero for ESP=%d SAs.\n",
((struct sadb_sa*)extensions[SADB_EXT_SA])->sadb_sa_encrypt,
((struct sadb_msg*)extensions[SADB_EXT_RESERVED])->sadb_msg_satype);
SENDERR(EINVAL);
}
if((((struct sadb_sa*)(extensions[SADB_EXT_SA]))->sadb_sa_encrypt ==
SADB_EALG_NULL) &&
(((struct sadb_sa*)(extensions[SADB_EXT_SA]))->sadb_sa_auth ==
SADB_AALG_NONE) ) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_msg_parse: "
"ESP handed encNULL+authNONE, illegal combination.\n");
SENDERR(EINVAL);
}
break;
case SADB_X_SATYPE_COMP:
if(!(((struct sadb_sa*)extensions[SADB_EXT_SA]) &&
((struct sadb_sa*)extensions[SADB_EXT_SA])->sadb_sa_encrypt !=
SADB_EALG_NONE)) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_msg_parse: "
"encrypt alg=%d is zero, must be non-zero for COMP=%d SAs.\n",
((struct sadb_sa*)extensions[SADB_EXT_SA])->sadb_sa_encrypt,
((struct sadb_msg*)extensions[SADB_EXT_RESERVED])->sadb_msg_satype);
SENDERR(EINVAL);
}
if(((struct sadb_sa*)(extensions[SADB_EXT_SA]))->sadb_sa_auth !=
SADB_AALG_NONE) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_msg_parse: "
"COMP handed auth=%d, must be zero.\n",
((struct sadb_sa*)(extensions[SADB_EXT_SA]))->sadb_sa_auth);
SENDERR(EINVAL);
}
break;
default:
}
if(ntohl(((struct sadb_sa*)(extensions[SADB_EXT_SA]))->sadb_sa_spi) <= 255) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_msg_parse: "
"spi=%08lx must be > 255.\n",
ntohl(((struct sadb_sa*)(extensions[SADB_EXT_SA]))->sadb_sa_spi));
SENDERR(EINVAL);
}
default:
}
errlab:
return error;
}
DEBUG_NO_STATIC int
pfkey_key_parse(struct sadb_ext *pfkey_ext)
{
int error = 0;
struct sadb_key *pfkey_key = (struct sadb_key *)pfkey_ext;
/* sanity checks... */
if(!pfkey_key) {
ERROR(
"pfkey_key_parse: "
"NULL pointer passed in.\n");
SENDERR(EINVAL);
}
if(pfkey_key->sadb_key_len < sizeof(struct sadb_key) / IPSEC_PFKEYv2_ALIGN) {
ERROR(
"pfkey_key_parse: "
"size wrong ext_len=%d, key_ext_len=%d.\n",
pfkey_key->sadb_key_len,
(int)sizeof(struct sadb_key));
SENDERR(EINVAL);
}
if(!pfkey_key->sadb_key_bits) {
ERROR(
"pfkey_key_parse: "
"key length set to zero, must be non-zero.\n");
SENDERR(EINVAL);
}
if(pfkey_key->sadb_key_len !=
DIVUP(sizeof(struct sadb_key) * OCTETBITS + pfkey_key->sadb_key_bits,
PFKEYBITS)) {
ERROR(
"pfkey_key_parse: "
"key length=%d does not agree with extension length=%d.\n",
pfkey_key->sadb_key_bits,
pfkey_key->sadb_key_len);
SENDERR(EINVAL);
}
if(pfkey_key->sadb_key_reserved) {
ERROR(
"pfkey_key_parse: "
"res=%d, must be zero.\n",
pfkey_key->sadb_key_reserved);
SENDERR(EINVAL);
}
if(! ( (pfkey_key->sadb_key_exttype == K_SADB_EXT_KEY_AUTH) ||
(pfkey_key->sadb_key_exttype == K_SADB_EXT_KEY_ENCRYPT))) {
ERROR(
"pfkey_key_parse: "
"expecting extension type AUTH or ENCRYPT, got %d.\n",
pfkey_key->sadb_key_exttype);
SENDERR(EINVAL);
}
DEBUGGING(PF_KEY_DEBUG_PARSE_STRUCT,
"pfkey_key_parse: "
"success, found len=%d exttype=%d(%s) bits=%d reserved=%d.\n",
pfkey_key->sadb_key_len,
pfkey_key->sadb_key_exttype,
pfkey_v2_sadb_ext_string(pfkey_key->sadb_key_exttype),
pfkey_key->sadb_key_bits,
pfkey_key->sadb_key_reserved);
errlab:
return error;
}
DEBUG_NO_STATIC int
pfkey_address_parse(struct sadb_ext *pfkey_ext)
{
int error = 0;
int saddr_len = 0;
struct sadb_address *pfkey_address = (struct sadb_address *)pfkey_ext;
struct sockaddr* s = (struct sockaddr*)((char*)pfkey_address + sizeof(*pfkey_address));
char ipaddr_txt[ADDRTOT_BUF];
/* sanity checks... */
if(!pfkey_address) {
ERROR(
"pfkey_address_parse: "
"NULL pointer passed in.\n");
SENDERR(EINVAL);
}
if(pfkey_address->sadb_address_len <
(sizeof(struct sadb_address) + sizeof(struct sockaddr))/
IPSEC_PFKEYv2_ALIGN) {
ERROR("pfkey_address_parse: "
"size wrong 1 ext_len=%d, adr_ext_len=%d, saddr_len=%d.\n",
pfkey_address->sadb_address_len,
(int)sizeof(struct sadb_address),
(int)sizeof(struct sockaddr));
SENDERR(EINVAL);
}
if(pfkey_address->sadb_address_reserved) {
ERROR("pfkey_address_parse: "
"res=%d, must be zero.\n",
pfkey_address->sadb_address_reserved);
SENDERR(EINVAL);
}
switch(pfkey_address->sadb_address_exttype) {
case K_SADB_EXT_ADDRESS_SRC:
case K_SADB_EXT_ADDRESS_DST:
case K_SADB_EXT_ADDRESS_PROXY:
case K_SADB_X_EXT_ADDRESS_DST2:
case K_SADB_X_EXT_ADDRESS_SRC_FLOW:
case K_SADB_X_EXT_ADDRESS_DST_FLOW:
case K_SADB_X_EXT_ADDRESS_SRC_MASK:
case K_SADB_X_EXT_ADDRESS_DST_MASK:
#ifdef NAT_TRAVERSAL
case K_SADB_X_EXT_NAT_T_OA:
#endif
break;
default:
ERROR(
"pfkey_address_parse: "
"unexpected ext_type=%d.\n",
pfkey_address->sadb_address_exttype);
SENDERR(ENODEV);
}
switch(s->sa_family) {
case AF_INET:
saddr_len = sizeof(struct sockaddr_in);
addrtoa(((struct sockaddr_in*)s)->sin_addr, 0,
ipaddr_txt, sizeof(ipaddr_txt));
DEBUGGING(PF_KEY_DEBUG_PARSE_STRUCT,
"pfkey_address_parse: "
"found exttype=%u(%s) family=%d(AF_INET) address=%s proto=%u port=%u.\n",
pfkey_address->sadb_address_exttype,
pfkey_v2_sadb_ext_string(pfkey_address->sadb_address_exttype),
s->sa_family,
ipaddr_txt,
pfkey_address->sadb_address_proto,
ntohs(((struct sockaddr_in*)s)->sin_port));
break;
case AF_INET6:
saddr_len = sizeof(struct sockaddr_in6);
sprintf(ipaddr_txt, "%x:%x:%x:%x:%x:%x:%x:%x"
, ntohs(((struct sockaddr_in6*)s)->sin6_addr.s6_addr16[0])
, ntohs(((struct sockaddr_in6*)s)->sin6_addr.s6_addr16[1])
, ntohs(((struct sockaddr_in6*)s)->sin6_addr.s6_addr16[2])
, ntohs(((struct sockaddr_in6*)s)->sin6_addr.s6_addr16[3])
, ntohs(((struct sockaddr_in6*)s)->sin6_addr.s6_addr16[4])
, ntohs(((struct sockaddr_in6*)s)->sin6_addr.s6_addr16[5])
, ntohs(((struct sockaddr_in6*)s)->sin6_addr.s6_addr16[6])
, ntohs(((struct sockaddr_in6*)s)->sin6_addr.s6_addr16[7]));
DEBUGGING(PF_KEY_DEBUG_PARSE_STRUCT,
"pfkey_address_parse: "
"found exttype=%u(%s) family=%d(AF_INET6) address=%s proto=%u port=%u.\n",
pfkey_address->sadb_address_exttype,
pfkey_v2_sadb_ext_string(pfkey_address->sadb_address_exttype),
s->sa_family,
ipaddr_txt,
pfkey_address->sadb_address_proto,
((struct sockaddr_in6*)s)->sin6_port);
break;
default:
ERROR(
"pfkey_address_parse: "
"s->sa_family=%d not supported.\n",
s->sa_family);
SENDERR(EPFNOSUPPORT);
}
if(pfkey_address->sadb_address_len !=
DIVUP(sizeof(struct sadb_address) + saddr_len, IPSEC_PFKEYv2_ALIGN)) {
ERROR(
"pfkey_address_parse: "
"size wrong 2 ext_len=%d, adr_ext_len=%d, saddr_len=%d.\n",
pfkey_address->sadb_address_len,
(int)sizeof(struct sadb_address),
saddr_len);
SENDERR(EINVAL);
}
if(pfkey_address->sadb_address_prefixlen != 0) {
ERROR(
"pfkey_address_parse: "
"address prefixes not supported yet.\n");
SENDERR(EAFNOSUPPORT); /* not supported yet */
}
/* XXX check if port!=0 */
DEBUGGING(PF_KEY_DEBUG_PARSE_FLOW,
"pfkey_address_parse: successful.\n");
errlab:
return error;
}
DEBUG_NO_STATIC int
pfkey_sa_parse(struct sadb_ext *pfkey_ext)
{
int error = 0;
struct k_sadb_sa *pfkey_sa = (struct k_sadb_sa *)pfkey_ext;
/* sanity checks... */
if(!pfkey_sa) {
ERROR("pfkey_sa_parse: "
"NULL pointer passed in.\n");
SENDERR(EINVAL);
}
if(pfkey_sa->sadb_sa_len !=sizeof(struct k_sadb_sa)/IPSEC_PFKEYv2_ALIGN
&& pfkey_sa->sadb_sa_len!=sizeof(struct sadb_sa)/IPSEC_PFKEYv2_ALIGN) {
ERROR(
"pfkey_sa_parse: "
"length wrong pfkey_sa->sadb_sa_len=%d sizeof(struct sadb_sa)=%d.\n",
pfkey_sa->sadb_sa_len,
(int)sizeof(struct k_sadb_sa));
SENDERR(EINVAL);
}
#if K_SADB_EALG_MAX < 255
if(pfkey_sa->sadb_sa_encrypt > K_SADB_EALG_MAX) {
ERROR(
"pfkey_sa_parse: "
"pfkey_sa->sadb_sa_encrypt=%d > K_SADB_EALG_MAX=%d.\n",
pfkey_sa->sadb_sa_encrypt,
K_SADB_EALG_MAX);
SENDERR(EINVAL);
}
#endif
#if K_SADB_AALG_MAX < 255
if(pfkey_sa->sadb_sa_auth > K_SADB_AALG_MAX) {
ERROR(
"pfkey_sa_parse: "
"pfkey_sa->sadb_sa_auth=%d > K_SADB_AALG_MAX=%d.\n",
pfkey_sa->sadb_sa_auth,
K_SADB_AALG_MAX);
SENDERR(EINVAL);
}
#endif
#if K_SADB_SASTATE_MAX < 255
if(pfkey_sa->sadb_sa_state > K_SADB_SASTATE_MAX) {
ERROR(
"pfkey_sa_parse: "
"state=%d exceeds MAX=%d.\n",
pfkey_sa->sadb_sa_state,
K_SADB_SASTATE_MAX);
SENDERR(EINVAL);
}
#endif
if(pfkey_sa->sadb_sa_state == K_SADB_SASTATE_DEAD) {
ERROR(
"pfkey_sa_parse: "
"state=%d is DEAD=%d.\n",
pfkey_sa->sadb_sa_state,
K_SADB_SASTATE_DEAD);
SENDERR(EINVAL);
}
if(pfkey_sa->sadb_sa_replay > 64) {
ERROR(
"pfkey_sa_parse: "
"replay window size: %d -- must be 0 <= size <= 64\n",
pfkey_sa->sadb_sa_replay);
SENDERR(EINVAL);
}
if(! ((pfkey_sa->sadb_sa_exttype == K_SADB_EXT_SA) ||
(pfkey_sa->sadb_sa_exttype == K_SADB_X_EXT_SA2)))
{
ERROR(
"pfkey_sa_parse: "
"unknown exttype=%d, expecting K_SADB_EXT_SA=%d or K_SADB_X_EXT_SA2=%d.\n",
pfkey_sa->sadb_sa_exttype,
K_SADB_EXT_SA,
K_SADB_X_EXT_SA2);
SENDERR(EINVAL);
}
if(pfkey_sa->sadb_sa_len > sizeof(struct sadb_sa)/IPSEC_PFKEYv2_ALIGN) {
if(pfkey_sa->sadb_x_sa_ref == IPSEC_SAREF_NULL ||
pfkey_sa->sadb_x_sa_ref == ~(IPSEC_SAREF_NULL))
{
pfkey_sa->sadb_x_sa_ref = IPSEC_SAREF_NULL;
}
}
if((IPSEC_SAREF_NULL != pfkey_sa->sadb_x_sa_ref)
&& (pfkey_sa->sadb_x_sa_ref >= (1 << IPSEC_SA_REF_TABLE_IDX_WIDTH)))
{
ERROR(
"pfkey_sa_parse: "
"SAref=%d must be (SAref == IPSEC_SAREF_NULL(%d) || SAref < IPSEC_SA_REF_TABLE_NUM_ENTRIES(%d)).\n",
pfkey_sa->sadb_x_sa_ref,
IPSEC_SAREF_NULL,
IPSEC_SA_REF_TABLE_NUM_ENTRIES);
SENDERR(EINVAL);
}
DEBUGGING(PF_KEY_DEBUG_PARSE_STRUCT,
"pfkey_sa_parse: "
"successfully found len=%d exttype=%d(%s) spi=%08lx replay=%d state=%d auth=%d encrypt=%d flags=%d ref=%d.\n",
pfkey_sa->sadb_sa_len,
pfkey_sa->sadb_sa_exttype,
pfkey_v2_sadb_ext_string(pfkey_sa->sadb_sa_exttype),
(long unsigned int)ntohl(pfkey_sa->sadb_sa_spi),
pfkey_sa->sadb_sa_replay,
pfkey_sa->sadb_sa_state,
pfkey_sa->sadb_sa_auth,
pfkey_sa->sadb_sa_encrypt,
pfkey_sa->sadb_sa_flags,
pfkey_sa->sadb_x_sa_ref);
errlab:
return error;
}
DEBUG_NO_STATIC int
pfkey_x_satype_parse(struct sadb_ext *pfkey_ext)
{
int error = 0;
int i;
struct sadb_x_satype *pfkey_x_satype = (struct sadb_x_satype *)pfkey_ext;
DEBUGGING(PF_KEY_DEBUG_PARSE_FLOW,
"pfkey_x_satype_parse: enter\n");
/* sanity checks... */
if(pfkey_x_satype->sadb_x_satype_len !=
sizeof(struct sadb_x_satype) / IPSEC_PFKEYv2_ALIGN) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_x_satype_parse: "
"size wrong ext_len=%d, key_ext_len=%d.\n",
pfkey_x_satype->sadb_x_satype_len,
(int)sizeof(struct sadb_x_satype));
SENDERR(EINVAL);
}
if(!pfkey_x_satype->sadb_x_satype_satype) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_x_satype_parse: "
"satype is zero, must be non-zero.\n");
SENDERR(EINVAL);
}
if(pfkey_x_satype->sadb_x_satype_satype > K_SADB_SATYPE_MAX) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_x_satype_parse: "
"satype %d > max %d, invalid.\n",
pfkey_x_satype->sadb_x_satype_satype, K_SADB_SATYPE_MAX);
SENDERR(EINVAL);
}
if(!(satype2proto(pfkey_x_satype->sadb_x_satype_satype))) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_x_satype_parse: "
"proto lookup from satype=%d failed.\n",
pfkey_x_satype->sadb_x_satype_satype);
SENDERR(EINVAL);
}
for(i = 0; i < 3; i++) {
if(pfkey_x_satype->sadb_x_satype_reserved[i]) {
DEBUGGING(PF_KEY_DEBUG_PARSE_PROBLEM,
"pfkey_x_satype_parse: "
"reserved[%d]=%d must be set to zero.\n",
i, pfkey_x_satype->sadb_x_satype_reserved[i]);
SENDERR(EINVAL);
}
}
DEBUGGING(PF_KEY_DEBUG_PARSE_STRUCT,
"pfkey_x_satype_parse: "
"len=%u ext=%u(%s) satype=%u(%s) res=%u,%u,%u.\n",
pfkey_x_satype->sadb_x_satype_len,
pfkey_x_satype->sadb_x_satype_exttype,
pfkey_v2_sadb_ext_string(pfkey_x_satype->sadb_x_satype_exttype),
pfkey_x_satype->sadb_x_satype_satype,
satype2name(pfkey_x_satype->sadb_x_satype_satype),
pfkey_x_satype->sadb_x_satype_reserved[0],
pfkey_x_satype->sadb_x_satype_reserved[1],
pfkey_x_satype->sadb_x_satype_reserved[2]);
errlab:
return error;
}
