1 /* $FreeBSD: src/lib/libipsec/pfkey.c,v 1.1.2.2 2001/07/03 11:01:14 ume Exp $ */
2 /* $KAME: pfkey.c,v 1.39 2001/03/05 18:22:17 thorpej Exp $ */
5 * Copyright (C) 1995, 1996, 1997, 1998, and 1999 WIDE Project.
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
11 * 1. Redistributions of source code must retain the above copyright
12 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
16 * 3. Neither the name of the project nor the names of its contributors
17 * may be used to endorse or promote products derived from this software
18 * without specific prior written permission.
20 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
21 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
24 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
33 #include <sys/types.h>
34 #include <sys/param.h>
35 #include <sys/socket.h>
36 #include <net/pfkeyv2.h>
37 #include <netkey/key_var.h>
38 #include <netinet/in.h>
39 #include <netinet6/ipsec.h>
47 #include "ipsec_strerror.h"
50 #define CALLOC(size, cast) (cast)calloc(1, (size))
52 static int findsupportedmap (int);
53 static int setsupportedmap (struct sadb_supported *);
54 static struct sadb_alg *findsupportedalg (u_int, u_int);
55 static int pfkey_send_x1 (int, u_int, u_int, u_int, struct sockaddr *,
56 struct sockaddr *, u_int32_t, u_int32_t, u_int, caddr_t,
57 u_int, u_int, u_int, u_int, u_int, u_int32_t, u_int32_t,
58 u_int32_t, u_int32_t, u_int32_t);
59 static int pfkey_send_x2 (int, u_int, u_int, u_int,
60 struct sockaddr *, struct sockaddr *, u_int32_t);
61 static int pfkey_send_x3 (int, u_int, u_int);
62 static int pfkey_send_x4 (int, u_int, struct sockaddr *, u_int,
63 struct sockaddr *, u_int, u_int, u_int64_t, u_int64_t,
64 char *, int, u_int32_t);
65 static int pfkey_send_x5 (int, u_int, u_int32_t);
67 static caddr_t pfkey_setsadbmsg (caddr_t, caddr_t, u_int, u_int,
68 u_int, u_int32_t, pid_t);
69 static caddr_t pfkey_setsadbsa (caddr_t, caddr_t, u_int32_t, u_int,
70 u_int, u_int, u_int32_t);
71 static caddr_t pfkey_setsadbaddr (caddr_t, caddr_t, u_int,
72 struct sockaddr *, u_int, u_int);
73 static caddr_t pfkey_setsadbkey (caddr_t, caddr_t, u_int, caddr_t, u_int);
74 static caddr_t pfkey_setsadblifetime (caddr_t, caddr_t, u_int, u_int32_t,
75 u_int32_t, u_int32_t, u_int32_t);
76 static caddr_t pfkey_setsadbxsa2 (caddr_t, caddr_t, u_int32_t, u_int32_t);
79 * make and search supported algorithm structure.
81 static struct sadb_supported *ipsec_supported[] = { NULL, NULL, NULL, NULL};
83 static int supported_map[] = {
87 SADB_X_SATYPE_TCPSIGNATURE,
91 findsupportedmap(int satype)
95 for (i = 0; i < NELEM(supported_map); i++)
96 if (supported_map[i] == satype)
101 static struct sadb_alg *
102 findsupportedalg(u_int satype, u_int alg_id)
109 algno = findsupportedmap(satype);
111 __ipsec_errcode = EIPSEC_INVAL_ARGUMENT;
114 if (ipsec_supported[algno] == NULL) {
115 __ipsec_errcode = EIPSEC_DO_GET_SUPP_LIST;
119 tlen = ipsec_supported[algno]->sadb_supported_len
120 - sizeof(struct sadb_supported);
121 p = (caddr_t)(ipsec_supported[algno] + 1);
123 if (tlen < sizeof(struct sadb_alg)) {
127 if (((struct sadb_alg *)p)->sadb_alg_id == alg_id)
128 return (struct sadb_alg *)p;
130 tlen -= sizeof(struct sadb_alg);
131 p += sizeof(struct sadb_alg);
134 __ipsec_errcode = EIPSEC_NOT_SUPPORTED;
139 setsupportedmap(struct sadb_supported *sup)
141 struct sadb_supported **ipsup;
143 switch (sup->sadb_supported_exttype) {
144 case SADB_EXT_SUPPORTED_AUTH:
145 ipsup = &ipsec_supported[findsupportedmap(SADB_SATYPE_AH)];
147 case SADB_EXT_SUPPORTED_ENCRYPT:
148 ipsup = &ipsec_supported[findsupportedmap(SADB_SATYPE_ESP)];
151 __ipsec_errcode = EIPSEC_INVAL_SATYPE;
158 *ipsup = malloc(sup->sadb_supported_len);
160 __ipsec_set_strerror(strerror(errno));
163 memcpy(*ipsup, sup, sup->sadb_supported_len);
169 * check key length against algorithm specified.
170 * This function is called with SADB_EXT_SUPPORTED_{AUTH,ENCRYPT} as the
171 * augument, and only calls to ipsec_check_keylen2();
172 * keylen is the unit of bit.
178 ipsec_check_keylen(u_int supported, u_int alg_id, u_int keylen)
184 case SADB_EXT_SUPPORTED_AUTH:
185 satype = SADB_SATYPE_AH;
187 case SADB_EXT_SUPPORTED_ENCRYPT:
188 satype = SADB_SATYPE_ESP;
191 __ipsec_errcode = EIPSEC_INVAL_ARGUMENT;
195 return ipsec_check_keylen2(satype, alg_id, keylen);
199 * check key length against algorithm specified.
200 * satype is one of satype defined at pfkeyv2.h.
201 * keylen is the unit of bit.
207 ipsec_check_keylen2(u_int satype, u_int alg_id, u_int keylen)
209 struct sadb_alg *alg;
211 alg = findsupportedalg(satype, alg_id);
215 if (keylen < alg->sadb_alg_minbits || keylen > alg->sadb_alg_maxbits) {
216 __ipsec_errcode = EIPSEC_INVAL_KEYLEN;
220 __ipsec_errcode = EIPSEC_NO_ERROR;
225 * get max/min key length against algorithm specified.
226 * satype is one of satype defined at pfkeyv2.h.
227 * keylen is the unit of bit.
233 ipsec_get_keylen(u_int supported, u_int alg_id, struct sadb_alg *alg0)
235 struct sadb_alg *alg;
240 __ipsec_errcode = EIPSEC_INVAL_ARGUMENT;
245 case SADB_EXT_SUPPORTED_AUTH:
246 satype = SADB_SATYPE_AH;
248 case SADB_EXT_SUPPORTED_ENCRYPT:
249 satype = SADB_SATYPE_ESP;
252 __ipsec_errcode = EIPSEC_INVAL_ARGUMENT;
256 alg = findsupportedalg(satype, alg_id);
260 memcpy(alg0, alg, sizeof(*alg0));
262 __ipsec_errcode = EIPSEC_NO_ERROR;
267 * set the rate for SOFT lifetime against HARD one.
268 * If rate is more than 100 or equal to zero, then set to 100.
270 static u_int soft_lifetime_allocations_rate = PFKEY_SOFT_LIFETIME_RATE;
271 static u_int soft_lifetime_bytes_rate = PFKEY_SOFT_LIFETIME_RATE;
272 static u_int soft_lifetime_addtime_rate = PFKEY_SOFT_LIFETIME_RATE;
273 static u_int soft_lifetime_usetime_rate = PFKEY_SOFT_LIFETIME_RATE;
276 pfkey_set_softrate(u_int type, u_int rate)
278 __ipsec_errcode = EIPSEC_NO_ERROR;
280 if (rate > 100 || rate == 0)
284 case SADB_X_LIFETIME_ALLOCATIONS:
285 soft_lifetime_allocations_rate = rate;
287 case SADB_X_LIFETIME_BYTES:
288 soft_lifetime_bytes_rate = rate;
290 case SADB_X_LIFETIME_ADDTIME:
291 soft_lifetime_addtime_rate = rate;
293 case SADB_X_LIFETIME_USETIME:
294 soft_lifetime_usetime_rate = rate;
298 __ipsec_errcode = EIPSEC_INVAL_ARGUMENT;
303 * get current rate for SOFT lifetime against HARD one.
304 * ATTENTION: ~0 is returned if invalid type was passed.
307 pfkey_get_softrate(u_int type)
310 case SADB_X_LIFETIME_ALLOCATIONS:
311 return soft_lifetime_allocations_rate;
312 case SADB_X_LIFETIME_BYTES:
313 return soft_lifetime_bytes_rate;
314 case SADB_X_LIFETIME_ADDTIME:
315 return soft_lifetime_addtime_rate;
316 case SADB_X_LIFETIME_USETIME:
317 return soft_lifetime_usetime_rate;
324 * sending SADB_GETSPI message to the kernel.
326 * positive: success and return length sent.
327 * -1 : error occured, and set errno.
330 pfkey_send_getspi(int so, u_int satype, u_int mode, struct sockaddr *src,
331 struct sockaddr *dst, u_int32_t min, u_int32_t max, u_int32_t reqid,
334 struct sadb_msg *newmsg;
337 int need_spirange = 0;
342 if (src == NULL || dst == NULL) {
343 __ipsec_errcode = EIPSEC_INVAL_ARGUMENT;
346 if (src->sa_family != dst->sa_family) {
347 __ipsec_errcode = EIPSEC_FAMILY_MISMATCH;
350 if (min > max || (min > 0 && min <= 255)) {
351 __ipsec_errcode = EIPSEC_INVAL_SPI;
354 switch (src->sa_family) {
356 plen = sizeof(struct in_addr) << 3;
359 plen = sizeof(struct in6_addr) << 3;
362 __ipsec_errcode = EIPSEC_INVAL_FAMILY;
366 /* create new sadb_msg to send. */
367 len = sizeof(struct sadb_msg)
368 + sizeof(struct sadb_x_sa2)
369 + sizeof(struct sadb_address)
370 + PFKEY_ALIGN8(src->sa_len)
371 + sizeof(struct sadb_address)
372 + PFKEY_ALIGN8(dst->sa_len);
374 if (min > 255 && max < ~0) {
376 len += sizeof(struct sadb_spirange);
379 if ((newmsg = CALLOC(len, struct sadb_msg *)) == NULL) {
380 __ipsec_set_strerror(strerror(errno));
383 ep = ((caddr_t)newmsg) + len;
385 p = pfkey_setsadbmsg((caddr_t)newmsg, ep, SADB_GETSPI,
386 len, satype, seq, getpid());
392 p = pfkey_setsadbxsa2(p, ep, mode, reqid);
398 /* set sadb_address for source */
399 p = pfkey_setsadbaddr(p, ep, SADB_EXT_ADDRESS_SRC, src, plen,
406 /* set sadb_address for destination */
407 p = pfkey_setsadbaddr(p, ep, SADB_EXT_ADDRESS_DST, dst, plen,
414 /* proccessing spi range */
416 struct sadb_spirange spirange;
418 if (p + sizeof(spirange) > ep) {
423 memset(&spirange, 0, sizeof(spirange));
424 spirange.sadb_spirange_len = PFKEY_UNIT64(sizeof(spirange));
425 spirange.sadb_spirange_exttype = SADB_EXT_SPIRANGE;
426 spirange.sadb_spirange_min = min;
427 spirange.sadb_spirange_max = max;
429 memcpy(p, &spirange, sizeof(spirange));
431 p += sizeof(spirange);
439 len = pfkey_send(so, newmsg, len);
445 __ipsec_errcode = EIPSEC_NO_ERROR;
450 * sending SADB_UPDATE message to the kernel.
451 * The length of key material is a_keylen + e_keylen.
453 * positive: success and return length sent.
454 * -1 : error occured, and set errno.
457 pfkey_send_update(int so, u_int satype, u_int mode, struct sockaddr *src,
458 struct sockaddr *dst, u_int32_t spi, u_int32_t reqid, u_int wsize,
459 caddr_t keymat, u_int e_type, u_int e_keylen, u_int a_type, u_int a_keylen,
460 u_int flags,u_int32_t l_alloc, u_int64_t l_bytes, u_int64_t l_addtime,
461 u_int64_t l_usetime, u_int32_t seq)
464 if ((len = pfkey_send_x1(so, SADB_UPDATE, satype, mode, src, dst, spi,
466 keymat, e_type, e_keylen, a_type, a_keylen, flags,
467 l_alloc, l_bytes, l_addtime, l_usetime, seq)) < 0)
474 * sending SADB_ADD message to the kernel.
475 * The length of key material is a_keylen + e_keylen.
477 * positive: success and return length sent.
478 * -1 : error occured, and set errno.
481 pfkey_send_add(int so, u_int satype, u_int mode, struct sockaddr *src,
482 struct sockaddr *dst, u_int32_t spi, u_int32_t reqid, u_int wsize,
483 caddr_t keymat, u_int e_type, u_int e_keylen, u_int a_type, u_int a_keylen,
484 u_int flags, u_int32_t l_alloc, u_int64_t l_bytes, u_int64_t l_addtime,
485 u_int64_t l_usetime, u_int32_t seq)
488 if ((len = pfkey_send_x1(so, SADB_ADD, satype, mode, src, dst, spi,
490 keymat, e_type, e_keylen, a_type, a_keylen, flags,
491 l_alloc, l_bytes, l_addtime, l_usetime, seq)) < 0)
498 * sending SADB_DELETE message to the kernel.
500 * positive: success and return length sent.
501 * -1 : error occured, and set errno.
504 pfkey_send_delete(int so, u_int satype, u_int mode, struct sockaddr *src,
505 struct sockaddr *dst, u_int32_t spi)
508 if ((len = pfkey_send_x2(so, SADB_DELETE, satype, mode, src, dst, spi)) < 0)
515 * sending SADB_DELETE without spi to the kernel. This is
516 * the "delete all" request (an extension also present in
520 * positive: success and return length sent
521 * -1 : error occured, and set errno
524 pfkey_send_delete_all(int so, u_int satype, u_int mode, struct sockaddr *src,
525 struct sockaddr *dst)
527 struct sadb_msg *newmsg;
534 if (src == NULL || dst == NULL) {
535 __ipsec_errcode = EIPSEC_INVAL_ARGUMENT;
538 if (src->sa_family != dst->sa_family) {
539 __ipsec_errcode = EIPSEC_FAMILY_MISMATCH;
542 switch (src->sa_family) {
544 plen = sizeof(struct in_addr) << 3;
547 plen = sizeof(struct in6_addr) << 3;
550 __ipsec_errcode = EIPSEC_INVAL_FAMILY;
554 /* create new sadb_msg to reply. */
555 len = sizeof(struct sadb_msg)
556 + sizeof(struct sadb_address)
557 + PFKEY_ALIGN8(src->sa_len)
558 + sizeof(struct sadb_address)
559 + PFKEY_ALIGN8(dst->sa_len);
561 if ((newmsg = CALLOC(len, struct sadb_msg *)) == NULL) {
562 __ipsec_set_strerror(strerror(errno));
565 ep = ((caddr_t)newmsg) + len;
567 p = pfkey_setsadbmsg((caddr_t)newmsg, ep, SADB_DELETE, len, satype, 0,
573 p = pfkey_setsadbaddr(p, ep, SADB_EXT_ADDRESS_SRC, src, plen,
579 p = pfkey_setsadbaddr(p, ep, SADB_EXT_ADDRESS_DST, dst, plen,
587 len = pfkey_send(so, newmsg, len);
593 __ipsec_errcode = EIPSEC_NO_ERROR;
598 * sending SADB_GET message to the kernel.
600 * positive: success and return length sent.
601 * -1 : error occured, and set errno.
604 pfkey_send_get(int so, u_int satype, u_int mode, struct sockaddr *src,
605 struct sockaddr *dst, u_int32_t spi)
608 if ((len = pfkey_send_x2(so, SADB_GET, satype, mode, src, dst, spi)) < 0)
615 * sending SADB_REGISTER message to the kernel.
617 * positive: success and return length sent.
618 * -1 : error occured, and set errno.
621 pfkey_send_register(int so, u_int satype)
625 if (satype == PF_UNSPEC) {
626 for (algno = 0; algno < NELEM(supported_map); algno++) {
627 if (ipsec_supported[algno]) {
628 free(ipsec_supported[algno]);
629 ipsec_supported[algno] = NULL;
633 algno = findsupportedmap(satype);
635 __ipsec_errcode = EIPSEC_INVAL_ARGUMENT;
639 if (ipsec_supported[algno]) {
640 free(ipsec_supported[algno]);
641 ipsec_supported[algno] = NULL;
645 if ((len = pfkey_send_x3(so, SADB_REGISTER, satype)) < 0)
652 * receiving SADB_REGISTER message from the kernel, and copy buffer for
653 * sadb_supported returned into ipsec_supported.
655 * 0: success and return length sent.
656 * -1: error occured, and set errno.
659 pfkey_recv_register(int so)
661 pid_t pid = getpid();
662 struct sadb_msg *newmsg;
665 /* receive message */
667 if ((newmsg = pfkey_recv(so)) == NULL)
669 } while (newmsg->sadb_msg_type != SADB_REGISTER
670 || newmsg->sadb_msg_pid != pid);
673 newmsg->sadb_msg_len = PFKEY_UNUNIT64(newmsg->sadb_msg_len);
675 error = pfkey_set_supported(newmsg, newmsg->sadb_msg_len);
679 __ipsec_errcode = EIPSEC_NO_ERROR;
685 * receiving SADB_REGISTER message from the kernel, and copy buffer for
686 * sadb_supported returned into ipsec_supported.
687 * NOTE: sadb_msg_len must be host order.
689 * tlen: msg length, it's to makeing sure.
691 * 0: success and return length sent.
692 * -1: error occured, and set errno.
695 pfkey_set_supported(struct sadb_msg *msg, int tlen)
697 struct sadb_supported *sup;
702 if (msg->sadb_msg_len != tlen) {
703 __ipsec_errcode = EIPSEC_INVAL_ARGUMENT;
710 p += sizeof(struct sadb_msg);
713 sup = (struct sadb_supported *)p;
714 if (ep < p + sizeof(*sup) ||
715 PFKEY_EXTLEN(sup) < sizeof(*sup) ||
716 ep < p + sup->sadb_supported_len) {
721 switch (sup->sadb_supported_exttype) {
722 case SADB_EXT_SUPPORTED_AUTH:
723 case SADB_EXT_SUPPORTED_ENCRYPT:
726 __ipsec_errcode = EIPSEC_INVAL_SATYPE;
731 sup->sadb_supported_len = PFKEY_EXTLEN(sup);
733 /* set supported map */
734 if (setsupportedmap(sup) != 0)
737 p += sup->sadb_supported_len;
741 __ipsec_errcode = EIPSEC_INVAL_SATYPE;
745 __ipsec_errcode = EIPSEC_NO_ERROR;
751 * sending SADB_FLUSH message to the kernel.
753 * positive: success and return length sent.
754 * -1 : error occured, and set errno.
757 pfkey_send_flush(int so, u_int satype)
761 if ((len = pfkey_send_x3(so, SADB_FLUSH, satype)) < 0)
768 * sending SADB_DUMP message to the kernel.
770 * positive: success and return length sent.
771 * -1 : error occured, and set errno.
774 pfkey_send_dump(int so, u_int satype)
778 if ((len = pfkey_send_x3(so, SADB_DUMP, satype)) < 0)
785 * sending SADB_X_PROMISC message to the kernel.
786 * NOTE that this function handles promisc mode toggle only.
788 * flag: set promisc off if zero, set promisc on if non-zero.
790 * positive: success and return length sent.
791 * -1 : error occured, and set errno.
792 * 0 : error occured, and set errno.
793 * others: a pointer to new allocated buffer in which supported
797 pfkey_send_promisc_toggle(int so, int flag)
801 if ((len = pfkey_send_x3(so, SADB_X_PROMISC, (flag ? 1 : 0))) < 0)
808 * sending SADB_X_SPDADD message to the kernel.
810 * positive: success and return length sent.
811 * -1 : error occured, and set errno.
814 pfkey_send_spdadd(int so, struct sockaddr *src, u_int prefs,
815 struct sockaddr *dst, u_int prefd, u_int proto, caddr_t policy,
816 int policylen, u_int32_t seq)
820 if ((len = pfkey_send_x4(so, SADB_X_SPDADD,
821 src, prefs, dst, prefd, proto,
823 policy, policylen, seq)) < 0)
830 * sending SADB_X_SPDADD message to the kernel.
832 * positive: success and return length sent.
833 * -1 : error occured, and set errno.
836 pfkey_send_spdadd2(int so, struct sockaddr *src, u_int prefs,
837 struct sockaddr *dst, u_int prefd, u_int proto, u_int64_t ltime,
838 u_int64_t vtime, caddr_t policy, int policylen, u_int32_t seq)
842 if ((len = pfkey_send_x4(so, SADB_X_SPDADD,
843 src, prefs, dst, prefd, proto,
845 policy, policylen, seq)) < 0)
852 * sending SADB_X_SPDUPDATE message to the kernel.
854 * positive: success and return length sent.
855 * -1 : error occured, and set errno.
858 pfkey_send_spdupdate(int so, struct sockaddr *src, u_int prefs,
859 struct sockaddr *dst, u_int prefd, u_int proto, caddr_t policy,
860 int policylen, u_int32_t seq)
864 if ((len = pfkey_send_x4(so, SADB_X_SPDUPDATE,
865 src, prefs, dst, prefd, proto,
867 policy, policylen, seq)) < 0)
874 * sending SADB_X_SPDUPDATE message to the kernel.
876 * positive: success and return length sent.
877 * -1 : error occured, and set errno.
880 pfkey_send_spdupdate2(int so, struct sockaddr *src, u_int prefs,
881 struct sockaddr *dst, u_int prefd, u_int proto, u_int64_t ltime,
882 u_int64_t vtime, caddr_t policy, int policylen, u_int32_t seq)
886 if ((len = pfkey_send_x4(so, SADB_X_SPDUPDATE,
887 src, prefs, dst, prefd, proto,
889 policy, policylen, seq)) < 0)
896 * sending SADB_X_SPDDELETE message to the kernel.
898 * positive: success and return length sent.
899 * -1 : error occured, and set errno.
902 pfkey_send_spddelete(int so, struct sockaddr *src, u_int prefs,
903 struct sockaddr *dst, u_int prefd, u_int proto, caddr_t policy,
904 int policylen, u_int32_t seq)
908 if (policylen != sizeof(struct sadb_x_policy)) {
909 __ipsec_errcode = EIPSEC_INVAL_ARGUMENT;
913 if ((len = pfkey_send_x4(so, SADB_X_SPDDELETE,
914 src, prefs, dst, prefd, proto,
916 policy, policylen, seq)) < 0)
923 * sending SADB_X_SPDDELETE message to the kernel.
925 * positive: success and return length sent.
926 * -1 : error occured, and set errno.
929 pfkey_send_spddelete2(int so, u_int32_t spid)
933 if ((len = pfkey_send_x5(so, SADB_X_SPDDELETE2, spid)) < 0)
940 * sending SADB_X_SPDGET message to the kernel.
942 * positive: success and return length sent.
943 * -1 : error occured, and set errno.
946 pfkey_send_spdget(int so, u_int32_t spid)
950 if ((len = pfkey_send_x5(so, SADB_X_SPDGET, spid)) < 0)
957 * sending SADB_X_SPDSETIDX message to the kernel.
959 * positive: success and return length sent.
960 * -1 : error occured, and set errno.
963 pfkey_send_spdsetidx(int so, struct sockaddr *src, u_int prefs,
964 struct sockaddr *dst, u_int prefd, u_int proto, caddr_t policy,
965 int policylen, u_int32_t seq)
969 if (policylen != sizeof(struct sadb_x_policy)) {
970 __ipsec_errcode = EIPSEC_INVAL_ARGUMENT;
974 if ((len = pfkey_send_x4(so, SADB_X_SPDSETIDX,
975 src, prefs, dst, prefd, proto,
977 policy, policylen, seq)) < 0)
984 * sending SADB_SPDFLUSH message to the kernel.
986 * positive: success and return length sent.
987 * -1 : error occured, and set errno.
990 pfkey_send_spdflush(int so)
994 if ((len = pfkey_send_x3(so, SADB_X_SPDFLUSH, SADB_SATYPE_UNSPEC)) < 0)
1001 * sending SADB_SPDDUMP message to the kernel.
1003 * positive: success and return length sent.
1004 * -1 : error occured, and set errno.
1007 pfkey_send_spddump(int so)
1011 if ((len = pfkey_send_x3(so, SADB_X_SPDDUMP, SADB_SATYPE_UNSPEC)) < 0)
1017 /* sending SADB_ADD or SADB_UPDATE message to the kernel */
1019 pfkey_send_x1(int so, u_int type, u_int satype, u_int mode,
1020 struct sockaddr *src, struct sockaddr *dst, u_int32_t spi, u_int32_t reqid,
1021 u_int wsize, caddr_t keymat, u_int e_type, u_int e_keylen, u_int a_type,
1022 u_int a_keylen, u_int flags,u_int32_t l_alloc, u_int32_t l_bytes,
1023 u_int32_t l_addtime, u_int32_t l_usetime, u_int32_t seq)
1025 struct sadb_msg *newmsg;
1031 /* validity check */
1032 if (src == NULL || dst == NULL) {
1033 __ipsec_errcode = EIPSEC_INVAL_ARGUMENT;
1036 if (src->sa_family != dst->sa_family) {
1037 __ipsec_errcode = EIPSEC_FAMILY_MISMATCH;
1040 switch (src->sa_family) {
1042 plen = sizeof(struct in_addr) << 3;
1045 plen = sizeof(struct in6_addr) << 3;
1048 __ipsec_errcode = EIPSEC_INVAL_FAMILY;
1053 case SADB_SATYPE_ESP:
1054 if (e_type == SADB_EALG_NONE) {
1055 __ipsec_errcode = EIPSEC_NO_ALGS;
1059 case SADB_SATYPE_AH:
1060 if (e_type != SADB_EALG_NONE) {
1061 __ipsec_errcode = EIPSEC_INVAL_ALGS;
1064 if (a_type == SADB_AALG_NONE) {
1065 __ipsec_errcode = EIPSEC_NO_ALGS;
1069 case SADB_X_SATYPE_IPCOMP:
1070 if (e_type == SADB_X_CALG_NONE) {
1071 __ipsec_errcode = EIPSEC_INVAL_ALGS;
1074 if (a_type != SADB_AALG_NONE) {
1075 __ipsec_errcode = EIPSEC_NO_ALGS;
1079 case SADB_X_SATYPE_TCPSIGNATURE:
1080 if (e_type != SADB_EALG_NONE) {
1081 __ipsec_errcode = EIPSEC_INVAL_ALGS;
1084 if (a_type != SADB_X_AALG_TCP_MD5) {
1085 __ipsec_errcode = EIPSEC_INVAL_ALGS;
1090 __ipsec_errcode = EIPSEC_INVAL_SATYPE;
1094 /* create new sadb_msg to reply. */
1095 len = sizeof(struct sadb_msg)
1096 + sizeof(struct sadb_sa)
1097 + sizeof(struct sadb_x_sa2)
1098 + sizeof(struct sadb_address)
1099 + PFKEY_ALIGN8(src->sa_len)
1100 + sizeof(struct sadb_address)
1101 + PFKEY_ALIGN8(dst->sa_len)
1102 + sizeof(struct sadb_lifetime)
1103 + sizeof(struct sadb_lifetime);
1105 if (e_type != SADB_EALG_NONE)
1106 len += (sizeof(struct sadb_key) + PFKEY_ALIGN8(e_keylen));
1107 if (a_type != SADB_AALG_NONE)
1108 len += (sizeof(struct sadb_key) + PFKEY_ALIGN8(a_keylen));
1110 if ((newmsg = CALLOC(len, struct sadb_msg *)) == NULL) {
1111 __ipsec_set_strerror(strerror(errno));
1114 ep = ((caddr_t)newmsg) + len;
1116 p = pfkey_setsadbmsg((caddr_t)newmsg, ep, type, len,
1117 satype, seq, getpid());
1122 p = pfkey_setsadbsa(p, ep, spi, wsize, a_type, e_type, flags);
1127 p = pfkey_setsadbxsa2(p, ep, mode, reqid);
1132 p = pfkey_setsadbaddr(p, ep, SADB_EXT_ADDRESS_SRC, src, plen,
1138 p = pfkey_setsadbaddr(p, ep, SADB_EXT_ADDRESS_DST, dst, plen,
1145 if (e_type != SADB_EALG_NONE) {
1146 p = pfkey_setsadbkey(p, ep, SADB_EXT_KEY_ENCRYPT,
1153 if (a_type != SADB_AALG_NONE) {
1154 p = pfkey_setsadbkey(p, ep, SADB_EXT_KEY_AUTH,
1155 keymat + e_keylen, a_keylen);
1162 /* set sadb_lifetime for destination */
1163 p = pfkey_setsadblifetime(p, ep, SADB_EXT_LIFETIME_HARD,
1164 l_alloc, l_bytes, l_addtime, l_usetime);
1169 p = pfkey_setsadblifetime(p, ep, SADB_EXT_LIFETIME_SOFT,
1170 l_alloc, l_bytes, l_addtime, l_usetime);
1171 if (!p || p != ep) {
1177 len = pfkey_send(so, newmsg, len);
1183 __ipsec_errcode = EIPSEC_NO_ERROR;
1187 /* sending SADB_DELETE or SADB_GET message to the kernel */
1189 pfkey_send_x2(int so, u_int type, u_int satype, u_int mode,
1190 struct sockaddr *src, struct sockaddr *dst, u_int32_t spi)
1192 struct sadb_msg *newmsg;
1198 /* validity check */
1199 if (src == NULL || dst == NULL) {
1200 __ipsec_errcode = EIPSEC_INVAL_ARGUMENT;
1203 if (src->sa_family != dst->sa_family) {
1204 __ipsec_errcode = EIPSEC_FAMILY_MISMATCH;
1207 switch (src->sa_family) {
1209 plen = sizeof(struct in_addr) << 3;
1212 plen = sizeof(struct in6_addr) << 3;
1215 __ipsec_errcode = EIPSEC_INVAL_FAMILY;
1219 /* create new sadb_msg to reply. */
1220 len = sizeof(struct sadb_msg)
1221 + sizeof(struct sadb_sa)
1222 + sizeof(struct sadb_address)
1223 + PFKEY_ALIGN8(src->sa_len)
1224 + sizeof(struct sadb_address)
1225 + PFKEY_ALIGN8(dst->sa_len);
1227 if ((newmsg = CALLOC(len, struct sadb_msg *)) == NULL) {
1228 __ipsec_set_strerror(strerror(errno));
1231 ep = ((caddr_t)newmsg) + len;
1233 p = pfkey_setsadbmsg((caddr_t)newmsg, ep, type, len, satype, 0,
1239 p = pfkey_setsadbsa(p, ep, spi, 0, 0, 0, 0);
1244 p = pfkey_setsadbaddr(p, ep, SADB_EXT_ADDRESS_SRC, src, plen,
1250 p = pfkey_setsadbaddr(p, ep, SADB_EXT_ADDRESS_DST, dst, plen,
1252 if (!p || p != ep) {
1258 len = pfkey_send(so, newmsg, len);
1264 __ipsec_errcode = EIPSEC_NO_ERROR;
1269 * sending SADB_REGISTER, SADB_FLUSH, SADB_DUMP or SADB_X_PROMISC message
1273 pfkey_send_x3(int so, u_int type, u_int satype)
1275 struct sadb_msg *newmsg;
1280 /* validity check */
1282 case SADB_X_PROMISC:
1283 if (satype != 0 && satype != 1) {
1284 __ipsec_errcode = EIPSEC_INVAL_SATYPE;
1290 case SADB_SATYPE_UNSPEC:
1291 case SADB_SATYPE_AH:
1292 case SADB_SATYPE_ESP:
1293 case SADB_X_SATYPE_IPCOMP:
1294 case SADB_X_SATYPE_TCPSIGNATURE:
1297 __ipsec_errcode = EIPSEC_INVAL_SATYPE;
1302 /* create new sadb_msg to send. */
1303 len = sizeof(struct sadb_msg);
1305 if ((newmsg = CALLOC(len, struct sadb_msg *)) == NULL) {
1306 __ipsec_set_strerror(strerror(errno));
1309 ep = ((caddr_t)newmsg) + len;
1311 p = pfkey_setsadbmsg((caddr_t)newmsg, ep, type, len, satype, 0,
1313 if (!p || p != ep) {
1319 len = pfkey_send(so, newmsg, len);
1325 __ipsec_errcode = EIPSEC_NO_ERROR;
1329 /* sending SADB_X_SPDADD message to the kernel */
1331 pfkey_send_x4(int so, u_int type, struct sockaddr *src, u_int prefs,
1332 struct sockaddr *dst, u_int prefd, u_int proto, u_int64_t ltime,
1333 u_int64_t vtime, char *policy, int policylen, u_int32_t seq)
1335 struct sadb_msg *newmsg;
1341 /* validity check */
1342 if (src == NULL || dst == NULL) {
1343 __ipsec_errcode = EIPSEC_INVAL_ARGUMENT;
1346 if (src->sa_family != dst->sa_family) {
1347 __ipsec_errcode = EIPSEC_FAMILY_MISMATCH;
1351 switch (src->sa_family) {
1353 plen = sizeof(struct in_addr) << 3;
1356 plen = sizeof(struct in6_addr) << 3;
1359 __ipsec_errcode = EIPSEC_INVAL_FAMILY;
1362 if (prefs > plen || prefd > plen) {
1363 __ipsec_errcode = EIPSEC_INVAL_PREFIXLEN;
1367 /* create new sadb_msg to reply. */
1368 len = sizeof(struct sadb_msg)
1369 + sizeof(struct sadb_address)
1370 + PFKEY_ALIGN8(src->sa_len)
1371 + sizeof(struct sadb_address)
1372 + PFKEY_ALIGN8(src->sa_len)
1373 + sizeof(struct sadb_lifetime)
1376 if ((newmsg = CALLOC(len, struct sadb_msg *)) == NULL) {
1377 __ipsec_set_strerror(strerror(errno));
1380 ep = ((caddr_t)newmsg) + len;
1382 p = pfkey_setsadbmsg((caddr_t)newmsg, ep, type, len,
1383 SADB_SATYPE_UNSPEC, seq, getpid());
1388 p = pfkey_setsadbaddr(p, ep, SADB_EXT_ADDRESS_SRC, src, prefs, proto);
1393 p = pfkey_setsadbaddr(p, ep, SADB_EXT_ADDRESS_DST, dst, prefd, proto);
1398 p = pfkey_setsadblifetime(p, ep, SADB_EXT_LIFETIME_HARD,
1399 0, 0, ltime, vtime);
1400 if (!p || p + policylen != ep) {
1404 memcpy(p, policy, policylen);
1407 len = pfkey_send(so, newmsg, len);
1413 __ipsec_errcode = EIPSEC_NO_ERROR;
1417 /* sending SADB_X_SPDGET or SADB_X_SPDDELETE message to the kernel */
1419 pfkey_send_x5(int so, u_int type, u_int32_t spid)
1421 struct sadb_msg *newmsg;
1422 struct sadb_x_policy xpl;
1427 /* create new sadb_msg to reply. */
1428 len = sizeof(struct sadb_msg)
1431 if ((newmsg = CALLOC(len, struct sadb_msg *)) == NULL) {
1432 __ipsec_set_strerror(strerror(errno));
1435 ep = ((caddr_t)newmsg) + len;
1437 p = pfkey_setsadbmsg((caddr_t)newmsg, ep, type, len,
1438 SADB_SATYPE_UNSPEC, 0, getpid());
1444 if (p + sizeof(xpl) != ep) {
1448 memset(&xpl, 0, sizeof(xpl));
1449 xpl.sadb_x_policy_len = PFKEY_UNUNIT64(sizeof(xpl));
1450 xpl.sadb_x_policy_exttype = SADB_X_EXT_POLICY;
1451 xpl.sadb_x_policy_id = spid;
1452 memcpy(p, &xpl, sizeof(xpl));
1455 len = pfkey_send(so, newmsg, len);
1461 __ipsec_errcode = EIPSEC_NO_ERROR;
1469 * others : success and return value of socket.
1475 const int bufsiz = 128 * 1024; /*is 128K enough?*/
1477 if ((so = socket(PF_KEY, SOCK_RAW, PF_KEY_V2)) < 0) {
1478 __ipsec_set_strerror(strerror(errno));
1483 * This is a temporary workaround for KAME PR 154.
1484 * Don't really care even if it fails.
1486 (void)setsockopt(so, SOL_SOCKET, SO_SNDBUF, &bufsiz, sizeof(bufsiz));
1487 (void)setsockopt(so, SOL_SOCKET, SO_RCVBUF, &bufsiz, sizeof(bufsiz));
1489 __ipsec_errcode = EIPSEC_NO_ERROR;
1504 __ipsec_errcode = EIPSEC_NO_ERROR;
1509 * receive sadb_msg data, and return pointer to new buffer allocated.
1510 * Must free this buffer later.
1512 * NULL : error occured.
1513 * others : a pointer to sadb_msg structure.
1515 * XXX should be rewritten to pass length explicitly
1520 struct sadb_msg buf, *newmsg;
1523 while ((len = recv(so, (caddr_t)&buf, sizeof(buf), MSG_PEEK)) < 0) {
1526 __ipsec_set_strerror(strerror(errno));
1530 if (len < sizeof(buf)) {
1531 recv(so, (caddr_t)&buf, sizeof(buf), 0);
1532 __ipsec_errcode = EIPSEC_MAX;
1536 /* read real message */
1537 reallen = PFKEY_UNUNIT64(buf.sadb_msg_len);
1538 if ((newmsg = CALLOC(reallen, struct sadb_msg *)) == NULL) {
1539 __ipsec_set_strerror(strerror(errno));
1543 while ((len = recv(so, (caddr_t)newmsg, reallen, 0)) < 0) {
1546 __ipsec_set_strerror(strerror(errno));
1551 if (len != reallen) {
1552 __ipsec_errcode = EIPSEC_SYSTEM_ERROR;
1557 /* don't trust what the kernel says, validate! */
1558 if (PFKEY_UNUNIT64(newmsg->sadb_msg_len) != len) {
1559 __ipsec_errcode = EIPSEC_SYSTEM_ERROR;
1564 __ipsec_errcode = EIPSEC_NO_ERROR;
1569 * send message to a socket.
1571 * others: success and return length sent.
1575 pfkey_send(int so, struct sadb_msg *msg, int len)
1577 if ((len = send(so, (caddr_t)msg, len, 0)) < 0) {
1578 __ipsec_set_strerror(strerror(errno));
1582 __ipsec_errcode = EIPSEC_NO_ERROR;
1588 * NOTE: These functions are derived from netkey/key.c in KAME.
1591 * set the pointer to each header in this message buffer.
1592 * IN: msg: pointer to message buffer.
1593 * mhp: pointer to the buffer initialized like below:
1594 * caddr_t mhp[SADB_EXT_MAX + 1];
1598 * XXX should be rewritten to obtain length explicitly
1601 pfkey_align(struct sadb_msg *msg, caddr_t *mhp)
1603 struct sadb_ext *ext;
1606 caddr_t ep; /* XXX should be passed from upper layer */
1608 /* validity check */
1609 if (msg == NULL || mhp == NULL) {
1610 __ipsec_errcode = EIPSEC_INVAL_ARGUMENT;
1615 for (i = 0; i < SADB_EXT_MAX + 1; i++)
1618 mhp[0] = (caddr_t)msg;
1622 ep = p + PFKEY_UNUNIT64(msg->sadb_msg_len);
1624 /* skip base header */
1625 p += sizeof(struct sadb_msg);
1628 ext = (struct sadb_ext *)p;
1629 if (ep < p + sizeof(*ext) || PFKEY_EXTLEN(ext) < sizeof(*ext) ||
1630 ep < p + PFKEY_EXTLEN(ext)) {
1631 /* invalid format */
1635 /* duplicate check */
1636 /* XXX Are there duplication either KEY_AUTH or KEY_ENCRYPT ?*/
1637 if (mhp[ext->sadb_ext_type] != NULL) {
1638 __ipsec_errcode = EIPSEC_INVAL_EXTTYPE;
1643 switch (ext->sadb_ext_type) {
1645 case SADB_EXT_LIFETIME_CURRENT:
1646 case SADB_EXT_LIFETIME_HARD:
1647 case SADB_EXT_LIFETIME_SOFT:
1648 case SADB_EXT_ADDRESS_SRC:
1649 case SADB_EXT_ADDRESS_DST:
1650 case SADB_EXT_ADDRESS_PROXY:
1651 case SADB_EXT_KEY_AUTH:
1652 /* XXX should to be check weak keys. */
1653 case SADB_EXT_KEY_ENCRYPT:
1654 /* XXX should to be check weak keys. */
1655 case SADB_EXT_IDENTITY_SRC:
1656 case SADB_EXT_IDENTITY_DST:
1657 case SADB_EXT_SENSITIVITY:
1658 case SADB_EXT_PROPOSAL:
1659 case SADB_EXT_SUPPORTED_AUTH:
1660 case SADB_EXT_SUPPORTED_ENCRYPT:
1661 case SADB_EXT_SPIRANGE:
1662 case SADB_X_EXT_POLICY:
1663 case SADB_X_EXT_SA2:
1664 mhp[ext->sadb_ext_type] = (caddr_t)ext;
1667 __ipsec_errcode = EIPSEC_INVAL_EXTTYPE;
1671 p += PFKEY_EXTLEN(ext);
1675 __ipsec_errcode = EIPSEC_INVAL_SADBMSG;
1679 __ipsec_errcode = EIPSEC_NO_ERROR;
1684 * check basic usage for sadb_msg,
1685 * NOTE: This routine is derived from netkey/key.c in KAME.
1686 * IN: msg: pointer to message buffer.
1687 * mhp: pointer to the buffer initialized like below:
1689 * caddr_t mhp[SADB_EXT_MAX + 1];
1695 pfkey_check(caddr_t *mhp)
1697 struct sadb_msg *msg;
1699 /* validity check */
1700 if (mhp == NULL || mhp[0] == NULL) {
1701 __ipsec_errcode = EIPSEC_INVAL_ARGUMENT;
1705 msg = (struct sadb_msg *)mhp[0];
1708 if (msg->sadb_msg_version != PF_KEY_V2) {
1709 __ipsec_errcode = EIPSEC_INVAL_VERSION;
1714 if (msg->sadb_msg_type > SADB_MAX) {
1715 __ipsec_errcode = EIPSEC_INVAL_MSGTYPE;
1720 switch (msg->sadb_msg_satype) {
1721 case SADB_SATYPE_UNSPEC:
1722 switch (msg->sadb_msg_type) {
1730 __ipsec_errcode = EIPSEC_INVAL_SATYPE;
1734 case SADB_SATYPE_ESP:
1735 case SADB_SATYPE_AH:
1736 case SADB_X_SATYPE_IPCOMP:
1737 case SADB_X_SATYPE_TCPSIGNATURE:
1738 switch (msg->sadb_msg_type) {
1740 case SADB_X_SPDDELETE:
1742 case SADB_X_SPDDUMP:
1743 case SADB_X_SPDFLUSH:
1744 __ipsec_errcode = EIPSEC_INVAL_SATYPE;
1748 case SADB_SATYPE_RSVP:
1749 case SADB_SATYPE_OSPFV2:
1750 case SADB_SATYPE_RIPV2:
1751 case SADB_SATYPE_MIP:
1752 __ipsec_errcode = EIPSEC_NOT_SUPPORTED;
1754 case 1: /* XXX: What does it do ? */
1755 if (msg->sadb_msg_type == SADB_X_PROMISC)
1759 __ipsec_errcode = EIPSEC_INVAL_SATYPE;
1763 /* check field of upper layer protocol and address family */
1764 if (mhp[SADB_EXT_ADDRESS_SRC] != NULL
1765 && mhp[SADB_EXT_ADDRESS_DST] != NULL) {
1766 struct sadb_address *src0, *dst0;
1768 src0 = (struct sadb_address *)(mhp[SADB_EXT_ADDRESS_SRC]);
1769 dst0 = (struct sadb_address *)(mhp[SADB_EXT_ADDRESS_DST]);
1771 if (src0->sadb_address_proto != dst0->sadb_address_proto) {
1772 __ipsec_errcode = EIPSEC_PROTO_MISMATCH;
1776 if (PFKEY_ADDR_SADDR(src0)->sa_family
1777 != PFKEY_ADDR_SADDR(dst0)->sa_family) {
1778 __ipsec_errcode = EIPSEC_FAMILY_MISMATCH;
1782 switch (PFKEY_ADDR_SADDR(src0)->sa_family) {
1787 __ipsec_errcode = EIPSEC_INVAL_FAMILY;
1792 * prefixlen == 0 is valid because there must be the case
1793 * all addresses are matched.
1797 __ipsec_errcode = EIPSEC_NO_ERROR;
1802 * set data into sadb_msg.
1803 * `buf' must has been allocated sufficiently.
1806 pfkey_setsadbmsg(caddr_t buf, caddr_t lim, u_int type, u_int tlen,
1807 u_int satype, u_int32_t seq, pid_t pid)
1812 p = (struct sadb_msg *)buf;
1813 len = sizeof(struct sadb_msg);
1815 if (buf + len > lim)
1819 p->sadb_msg_version = PF_KEY_V2;
1820 p->sadb_msg_type = type;
1821 p->sadb_msg_errno = 0;
1822 p->sadb_msg_satype = satype;
1823 p->sadb_msg_len = PFKEY_UNIT64(tlen);
1824 p->sadb_msg_reserved = 0;
1825 p->sadb_msg_seq = seq;
1826 p->sadb_msg_pid = (u_int32_t)pid;
1832 * copy secasvar data into sadb_address.
1833 * `buf' must has been allocated sufficiently.
1836 pfkey_setsadbsa(caddr_t buf, caddr_t lim, u_int32_t spi, u_int wsize,
1837 u_int auth, u_int enc, u_int32_t flags)
1842 p = (struct sadb_sa *)buf;
1843 len = sizeof(struct sadb_sa);
1845 if (buf + len > lim)
1849 p->sadb_sa_len = PFKEY_UNIT64(len);
1850 p->sadb_sa_exttype = SADB_EXT_SA;
1851 p->sadb_sa_spi = spi;
1852 p->sadb_sa_replay = wsize;
1853 p->sadb_sa_state = SADB_SASTATE_LARVAL;
1854 p->sadb_sa_auth = auth;
1855 p->sadb_sa_encrypt = enc;
1856 p->sadb_sa_flags = flags;
1862 * set data into sadb_address.
1863 * `buf' must has been allocated sufficiently.
1864 * prefixlen is in bits.
1867 pfkey_setsadbaddr(caddr_t buf, caddr_t lim, u_int exttype,
1868 struct sockaddr *saddr, u_int prefixlen, u_int ul_proto)
1870 struct sadb_address *p;
1873 p = (struct sadb_address *)buf;
1874 len = sizeof(struct sadb_address) + PFKEY_ALIGN8(saddr->sa_len);
1876 if (buf + len > lim)
1880 p->sadb_address_len = PFKEY_UNIT64(len);
1881 p->sadb_address_exttype = exttype & 0xffff;
1882 p->sadb_address_proto = ul_proto & 0xff;
1883 p->sadb_address_prefixlen = prefixlen;
1884 p->sadb_address_reserved = 0;
1886 memcpy(p + 1, saddr, saddr->sa_len);
1892 * set sadb_key structure after clearing buffer with zero.
1893 * OUT: the pointer of buf + len.
1896 pfkey_setsadbkey(caddr_t buf, caddr_t lim, u_int type, caddr_t key,
1902 p = (struct sadb_key *)buf;
1903 len = sizeof(struct sadb_key) + PFKEY_ALIGN8(keylen);
1905 if (buf + len > lim)
1909 p->sadb_key_len = PFKEY_UNIT64(len);
1910 p->sadb_key_exttype = type;
1911 p->sadb_key_bits = keylen << 3;
1912 p->sadb_key_reserved = 0;
1914 memcpy(p + 1, key, keylen);
1920 * set sadb_lifetime structure after clearing buffer with zero.
1921 * OUT: the pointer of buf + len.
1924 pfkey_setsadblifetime(caddr_t buf, caddr_t lim, u_int type, u_int32_t l_alloc,
1925 u_int32_t l_bytes, u_int32_t l_addtime, u_int32_t l_usetime)
1927 struct sadb_lifetime *p;
1930 p = (struct sadb_lifetime *)buf;
1931 len = sizeof(struct sadb_lifetime);
1933 if (buf + len > lim)
1937 p->sadb_lifetime_len = PFKEY_UNIT64(len);
1938 p->sadb_lifetime_exttype = type;
1941 case SADB_EXT_LIFETIME_SOFT:
1942 p->sadb_lifetime_allocations
1943 = (l_alloc * soft_lifetime_allocations_rate) /100;
1944 p->sadb_lifetime_bytes
1945 = (l_bytes * soft_lifetime_bytes_rate) /100;
1946 p->sadb_lifetime_addtime
1947 = (l_addtime * soft_lifetime_addtime_rate) /100;
1948 p->sadb_lifetime_usetime
1949 = (l_usetime * soft_lifetime_usetime_rate) /100;
1951 case SADB_EXT_LIFETIME_HARD:
1952 p->sadb_lifetime_allocations = l_alloc;
1953 p->sadb_lifetime_bytes = l_bytes;
1954 p->sadb_lifetime_addtime = l_addtime;
1955 p->sadb_lifetime_usetime = l_usetime;
1963 * copy secasvar data into sadb_address.
1964 * `buf' must has been allocated sufficiently.
1967 pfkey_setsadbxsa2(caddr_t buf, caddr_t lim, u_int32_t mode0, u_int32_t reqid)
1969 struct sadb_x_sa2 *p;
1970 u_int8_t mode = mode0 & 0xff;
1973 p = (struct sadb_x_sa2 *)buf;
1974 len = sizeof(struct sadb_x_sa2);
1976 if (buf + len > lim)
1980 p->sadb_x_sa2_len = PFKEY_UNIT64(len);
1981 p->sadb_x_sa2_exttype = SADB_X_EXT_SA2;
1982 p->sadb_x_sa2_mode = mode;
1983 p->sadb_x_sa2_reqid = reqid;