diff options
| author | itojun <itojun@NetBSD.org> | 2000-07-18 14:56:42 +0000 |
|---|---|---|
| committer | itojun <itojun@NetBSD.org> | 2000-07-18 14:56:42 +0000 |
| commit | 65d37eff7f56dfddf765f2e596abc63e19942497 (patch) | |
| tree | 1e90c1940e3edede9d55420d026734ce50d41273 /sys/netinet6/esp_core.c | |
| parent | 905b4e497fca3cce743c477ac5479de9970ca8e0 (diff) | |
correct RFC2367 PF_KEY conformance (SADB_[AE]ALG_xx values and namespaces).
sync from kame.
WARNING: need recompilation of setkey(8) and pkgsrc/security/racoon.
(no ipsec-ready netbsd was released as official release)
Diffstat (limited to 'sys/netinet6/esp_core.c')
| -rw-r--r-- | sys/netinet6/esp_core.c | 159 |
1 files changed, 100 insertions, 59 deletions
diff --git a/sys/netinet6/esp_core.c b/sys/netinet6/esp_core.c index 0b1050675b4..a1bb880f8d2 100644 --- a/sys/netinet6/esp_core.c +++ b/sys/netinet6/esp_core.c @@ -1,5 +1,5 @@ -/* $NetBSD: esp_core.c,v 1.1.1.1 2000/06/14 19:39:43 thorpej Exp $ */ -/* $KAME: esp_core.c,v 1.15 2000/06/14 10:41:18 itojun Exp $ */ +/* $NetBSD: esp_core.c,v 1.2 2000/07/18 14:56:42 itojun Exp $ */ +/* $KAME: esp_core.c,v 1.18 2000/07/16 08:44:24 itojun Exp $ */ /* * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. @@ -63,7 +63,7 @@ #include <crypto/des/des.h> #include <crypto/blowfish/blowfish.h> #include <crypto/cast128/cast128.h> -#ifdef SADB_EALG_RC5CBC +#ifdef SADB_X_EALG_RC5CBC #include <crypto/rc5/rc5.h> #endif @@ -72,61 +72,88 @@ static int esp_null_mature __P((struct secasvar *)); static int esp_null_ivlen __P((struct secasvar *)); static int esp_null_decrypt __P((struct mbuf *, size_t, - struct secasvar *, struct esp_algorithm *, int)); + struct secasvar *, const struct esp_algorithm *, int)); static int esp_null_encrypt __P((struct mbuf *, size_t, size_t, - struct secasvar *, struct esp_algorithm *, int)); + struct secasvar *, const struct esp_algorithm *, int)); static int esp_descbc_mature __P((struct secasvar *)); static int esp_descbc_ivlen __P((struct secasvar *)); static int esp_descbc_decrypt __P((struct mbuf *, size_t, - struct secasvar *, struct esp_algorithm *, int)); + struct secasvar *, const struct esp_algorithm *, int)); static int esp_descbc_encrypt __P((struct mbuf *, size_t, size_t, - struct secasvar *, struct esp_algorithm *, int)); + struct secasvar *, const struct esp_algorithm *, int)); static int esp_cbc_mature __P((struct secasvar *)); static int esp_blowfish_cbc_decrypt __P((struct mbuf *, size_t, - struct secasvar *, struct esp_algorithm *, int)); + struct secasvar *, const struct esp_algorithm *, int)); static int esp_blowfish_cbc_encrypt __P((struct mbuf *, size_t, - size_t, struct secasvar *, struct esp_algorithm *, int)); + size_t, struct secasvar *, const struct esp_algorithm *, int)); static int esp_blowfish_cbc_ivlen __P((struct secasvar *)); static int esp_cast128cbc_ivlen __P((struct secasvar *)); static int esp_cast128cbc_decrypt __P((struct mbuf *, size_t, - struct secasvar *, struct esp_algorithm *, int)); + struct secasvar *, const struct esp_algorithm *, int)); static int esp_cast128cbc_encrypt __P((struct mbuf *, size_t, size_t, - struct secasvar *, struct esp_algorithm *, int)); + struct secasvar *, const struct esp_algorithm *, int)); static int esp_3descbc_ivlen __P((struct secasvar *)); static int esp_3descbc_decrypt __P((struct mbuf *, size_t, - struct secasvar *, struct esp_algorithm *, int)); + struct secasvar *, const struct esp_algorithm *, int)); static int esp_3descbc_encrypt __P((struct mbuf *, size_t, size_t, - struct secasvar *, struct esp_algorithm *, int)); -#ifdef SADB_EALG_RC5CBC + struct secasvar *, const struct esp_algorithm *, int)); +#ifdef SADB_X_EALG_RC5CBC static int esp_rc5cbc_ivlen __P((struct secasvar *)); static int esp_rc5cbc_decrypt __P((struct mbuf *, size_t, - struct secasvar *, struct esp_algorithm *, int)); + struct secasvar *, const struct esp_algorithm *, int)); static int esp_rc5cbc_encrypt __P((struct mbuf *, size_t, size_t, - struct secasvar *, struct esp_algorithm *, int)); + struct secasvar *, const struct esp_algorithm *, int)); #endif static void esp_increment_iv __P((struct secasvar *)); static caddr_t mbuf_find_offset __P((struct mbuf *, size_t, size_t)); -/* NOTE: The order depends on SADB_EALG_x in netkey/keyv2.h */ -struct esp_algorithm esp_algorithms[] = { - { 0, 0, 0, 0, 0, 0, 0, }, - { 8, esp_descbc_mature, 64, 64, "des-cbc", - esp_descbc_ivlen, esp_descbc_decrypt, esp_descbc_encrypt, }, - { 8, esp_cbc_mature, 192, 192, "3des-cbc", - esp_3descbc_ivlen, esp_3descbc_decrypt, esp_3descbc_encrypt, }, - { 1, esp_null_mature, 0, 2048, "null", - esp_null_ivlen, esp_null_decrypt, esp_null_encrypt, }, - { 8, esp_cbc_mature, 40, 448, "blowfish-cbc", - esp_blowfish_cbc_ivlen, esp_blowfish_cbc_decrypt, - esp_blowfish_cbc_encrypt, }, - { 8, esp_cbc_mature, 40, 128, "cast128-cbc", - esp_cast128cbc_ivlen, esp_cast128cbc_decrypt, - esp_cast128cbc_encrypt, }, -#ifdef SADB_EALG_RC5CBC - { 8, esp_cbc_mature, 40, 2040, "rc5-cbc", - esp_rc5cbc_ivlen, esp_rc5cbc_decrypt, esp_rc5cbc_encrypt, }, +const struct esp_algorithm * +esp_algorithm_lookup(idx) + int idx; +{ + static struct esp_algorithm esp_algorithms[] = { + { 8, esp_descbc_mature, 64, 64, "des-cbc", + esp_descbc_ivlen, esp_descbc_decrypt, + esp_descbc_encrypt, }, + { 8, esp_cbc_mature, 192, 192, "3des-cbc", + esp_3descbc_ivlen, esp_3descbc_decrypt, + esp_3descbc_encrypt, }, + { 1, esp_null_mature, 0, 2048, "null", + esp_null_ivlen, esp_null_decrypt, esp_null_encrypt, }, + { 8, esp_cbc_mature, 40, 448, "blowfish-cbc", + esp_blowfish_cbc_ivlen, esp_blowfish_cbc_decrypt, + esp_blowfish_cbc_encrypt, }, + { 8, esp_cbc_mature, 40, 128, "cast128-cbc", + esp_cast128cbc_ivlen, esp_cast128cbc_decrypt, + esp_cast128cbc_encrypt, }, +#ifdef SADB_X_EALG_RC5CBC + { 8, esp_cbc_mature, 40, 2040, "rc5-cbc", + esp_rc5cbc_ivlen, esp_rc5cbc_decrypt, + esp_rc5cbc_encrypt, }, +#else + { 8, NULL, 40, 2040, "rc5-cbc dummy", NULL, NULL, NULL, }, +#endif + }; + + switch (idx) { + case SADB_EALG_DESCBC: + return &esp_algorithms[0]; + case SADB_EALG_3DESCBC: + return &esp_algorithms[1]; + case SADB_EALG_NULL: + return &esp_algorithms[2]; + case SADB_X_EALG_BLOWFISHCBC: + return &esp_algorithms[3]; + case SADB_X_EALG_CAST128CBC: + return &esp_algorithms[4]; +#ifdef SADB_X_EALG_RC5CBC + case SADB_X_EALG_RC5CBC: + return &esp_algorithms[5]; #endif -}; + default: + return NULL; + } +} /* * mbuf assumption: foo_encrypt() assumes that IV part is placed in a single @@ -153,7 +180,7 @@ esp_null_decrypt(m, off, sav, algo, ivlen) struct mbuf *m; size_t off; /* offset to ESP header */ struct secasvar *sav; - struct esp_algorithm *algo; + const struct esp_algorithm *algo; int ivlen; { return 0; /* do nothing */ @@ -165,7 +192,7 @@ esp_null_encrypt(m, off, plen, sav, algo, ivlen) size_t off; /* offset to ESP header */ size_t plen; /* payload length (to be encrypted) */ struct secasvar *sav; - struct esp_algorithm *algo; + const struct esp_algorithm *algo; int ivlen; { return 0; /* do nothing */ @@ -175,7 +202,7 @@ static int esp_descbc_mature(sav) struct secasvar *sav; { - struct esp_algorithm *algo; + const struct esp_algorithm *algo; if (!(sav->flags & SADB_X_EXT_OLD) && (sav->flags & SADB_X_EXT_IV4B)) { ipseclog((LOG_ERR, "esp_cbc_mature: " @@ -187,7 +214,14 @@ esp_descbc_mature(sav) ipseclog((LOG_ERR, "esp_descbc_mature: no key is given.\n")); return 1; } - algo = &esp_algorithms[sav->alg_enc]; + + algo = esp_algorithm_lookup(sav->alg_enc); + if (!algo) { + ipseclog((LOG_ERR, + "esp_descbc_mature: unsupported algorithm.\n")); + return 1; + } + if (_KEYBITS(sav->key_enc) < algo->keymin || algo->keymax < _KEYBITS(sav->key_enc)) { ipseclog((LOG_ERR, @@ -224,7 +258,7 @@ esp_descbc_decrypt(m, off, sav, algo, ivlen) struct mbuf *m; size_t off; /* offset to ESP header */ struct secasvar *sav; - struct esp_algorithm *algo; + const struct esp_algorithm *algo; int ivlen; { size_t ivoff = 0; @@ -332,7 +366,7 @@ esp_descbc_encrypt(m, off, plen, sav, algo, ivlen) size_t off; /* offset to ESP header */ size_t plen; /* payload length (to be decrypted) */ struct secasvar *sav; - struct esp_algorithm *algo; + const struct esp_algorithm *algo; int ivlen; { size_t ivoff = 0; @@ -454,7 +488,7 @@ esp_cbc_mature(sav) struct secasvar *sav; { int keylen; - struct esp_algorithm *algo; + const struct esp_algorithm *algo; if (sav->flags & SADB_X_EXT_OLD) { ipseclog((LOG_ERR, @@ -472,7 +506,14 @@ esp_cbc_mature(sav) "esp_cbc_mature: no key is given.\n")); return 1; } - algo = &esp_algorithms[sav->alg_enc]; + + algo = esp_algorithm_lookup(sav->alg_enc); + if (!algo) { + ipseclog((LOG_ERR, + "esp_cbc_mature: unsupported algorithm.\n")); + return 1; + } + keylen = sav->key_enc->sadb_key_bits; if (keylen < algo->keymin || algo->keymax < keylen) { ipseclog((LOG_ERR, "esp_cbc_mature: invalid key length %d.\n", @@ -490,10 +531,10 @@ esp_cbc_mature(sav) return 1; } break; - case SADB_EALG_BLOWFISHCBC: - case SADB_EALG_CAST128CBC: -#ifdef SADB_EALG_RC5CBC - case SADB_EALG_RC5CBC: + case SADB_X_EALG_BLOWFISHCBC: + case SADB_X_EALG_CAST128CBC: +#ifdef SADB_X_EALG_RC5CBC + case SADB_X_EALG_RC5CBC: #endif break; } @@ -506,7 +547,7 @@ esp_blowfish_cbc_decrypt(m, off, sav, algo, ivlen) struct mbuf *m; size_t off; /* offset to ESP header */ struct secasvar *sav; - struct esp_algorithm *algo; + const struct esp_algorithm *algo; int ivlen; { size_t ivoff; @@ -583,7 +624,7 @@ esp_blowfish_cbc_encrypt(m, off, plen, sav, algo, ivlen) size_t off; /* offset to ESP header */ size_t plen; /* payload length (to be decrypted) */ struct secasvar *sav; - struct esp_algorithm *algo; + const struct esp_algorithm *algo; int ivlen; { size_t ivoff; @@ -669,7 +710,7 @@ esp_cast128cbc_decrypt(m, off, sav, algo, ivlen) struct mbuf *m; size_t off; struct secasvar *sav; - struct esp_algorithm *algo; + const struct esp_algorithm *algo; int ivlen; { size_t ivoff; @@ -748,7 +789,7 @@ esp_cast128cbc_encrypt(m, off, plen, sav, algo, ivlen) size_t off; size_t plen; struct secasvar *sav; - struct esp_algorithm *algo; + const struct esp_algorithm *algo; int ivlen; { size_t ivoff; @@ -831,7 +872,7 @@ esp_3descbc_decrypt(m, off, sav, algo, ivlen) struct mbuf *m; size_t off; struct secasvar *sav; - struct esp_algorithm *algo; + const struct esp_algorithm *algo; int ivlen; { size_t ivoff; @@ -913,7 +954,7 @@ esp_3descbc_encrypt(m, off, plen, sav, algo, ivlen) size_t off; size_t plen; struct secasvar *sav; - struct esp_algorithm *algo; + const struct esp_algorithm *algo; int ivlen; { size_t ivoff; @@ -984,7 +1025,7 @@ esp_3descbc_encrypt(m, off, plen, sav, algo, ivlen) return 0; } -#ifdef SADB_EALG_RC5CBC +#ifdef SADB_X_EALG_RC5CBC static int esp_rc5cbc_ivlen(sav) struct secasvar *sav; @@ -997,7 +1038,7 @@ esp_rc5cbc_decrypt(m, off, sav, algo, ivlen) struct mbuf *m; size_t off; struct secasvar *sav; - struct esp_algorithm *algo; + const struct esp_algorithm *algo; int ivlen; { size_t ivoff; @@ -1069,7 +1110,7 @@ esp_rc5cbc_encrypt(m, off, plen, sav, algo, ivlen) size_t off; size_t plen; struct secasvar *sav; - struct esp_algorithm *algo; + const struct esp_algorithm *algo; int ivlen; { size_t ivoff; @@ -1197,7 +1238,7 @@ esp_auth(m0, skip, length, sav, sum) size_t off; struct ah_algorithm_state s; u_char sumbuf[AH_MAXSUMSIZE]; - struct ah_algorithm *algo; + const struct ah_algorithm *algo; size_t siz; int error; @@ -1223,7 +1264,8 @@ esp_auth(m0, skip, length, sav, sum) ipseclog((LOG_DEBUG, "esp_auth: NULL SA passed\n")); return EINVAL; } - if (!sav->alg_auth) { + algo = ah_algorithm_lookup(sav->alg_auth); + if (!algo) { ipseclog((LOG_ERR, "esp_auth: bad ESP auth algorithm passed: %d\n", sav->alg_auth)); @@ -1233,7 +1275,6 @@ esp_auth(m0, skip, length, sav, sum) m = m0; off = 0; - algo = &ah_algorithms[sav->alg_auth]; siz = (((*algo->sumsiz)(sav) + 3) & ~(4 - 1)); if (sizeof(sumbuf) < siz) { ipseclog((LOG_DEBUG, |
