summaryrefslogtreecommitdiff
path: root/sys/netinet6/esp_core.c
diff options
context:
space:
mode:
authoritojun <itojun@NetBSD.org>2000-07-18 14:56:42 +0000
committeritojun <itojun@NetBSD.org>2000-07-18 14:56:42 +0000
commit65d37eff7f56dfddf765f2e596abc63e19942497 (patch)
tree1e90c1940e3edede9d55420d026734ce50d41273 /sys/netinet6/esp_core.c
parent905b4e497fca3cce743c477ac5479de9970ca8e0 (diff)
correct RFC2367 PF_KEY conformance (SADB_[AE]ALG_xx values and namespaces).
sync from kame. WARNING: need recompilation of setkey(8) and pkgsrc/security/racoon. (no ipsec-ready netbsd was released as official release)
Diffstat (limited to 'sys/netinet6/esp_core.c')
-rw-r--r--sys/netinet6/esp_core.c159
1 files changed, 100 insertions, 59 deletions
diff --git a/sys/netinet6/esp_core.c b/sys/netinet6/esp_core.c
index 0b1050675b4..a1bb880f8d2 100644
--- a/sys/netinet6/esp_core.c
+++ b/sys/netinet6/esp_core.c
@@ -1,5 +1,5 @@
-/* $NetBSD: esp_core.c,v 1.1.1.1 2000/06/14 19:39:43 thorpej Exp $ */
-/* $KAME: esp_core.c,v 1.15 2000/06/14 10:41:18 itojun Exp $ */
+/* $NetBSD: esp_core.c,v 1.2 2000/07/18 14:56:42 itojun Exp $ */
+/* $KAME: esp_core.c,v 1.18 2000/07/16 08:44:24 itojun Exp $ */
/*
* Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
@@ -63,7 +63,7 @@
#include <crypto/des/des.h>
#include <crypto/blowfish/blowfish.h>
#include <crypto/cast128/cast128.h>
-#ifdef SADB_EALG_RC5CBC
+#ifdef SADB_X_EALG_RC5CBC
#include <crypto/rc5/rc5.h>
#endif
@@ -72,61 +72,88 @@
static int esp_null_mature __P((struct secasvar *));
static int esp_null_ivlen __P((struct secasvar *));
static int esp_null_decrypt __P((struct mbuf *, size_t,
- struct secasvar *, struct esp_algorithm *, int));
+ struct secasvar *, const struct esp_algorithm *, int));
static int esp_null_encrypt __P((struct mbuf *, size_t, size_t,
- struct secasvar *, struct esp_algorithm *, int));
+ struct secasvar *, const struct esp_algorithm *, int));
static int esp_descbc_mature __P((struct secasvar *));
static int esp_descbc_ivlen __P((struct secasvar *));
static int esp_descbc_decrypt __P((struct mbuf *, size_t,
- struct secasvar *, struct esp_algorithm *, int));
+ struct secasvar *, const struct esp_algorithm *, int));
static int esp_descbc_encrypt __P((struct mbuf *, size_t, size_t,
- struct secasvar *, struct esp_algorithm *, int));
+ struct secasvar *, const struct esp_algorithm *, int));
static int esp_cbc_mature __P((struct secasvar *));
static int esp_blowfish_cbc_decrypt __P((struct mbuf *, size_t,
- struct secasvar *, struct esp_algorithm *, int));
+ struct secasvar *, const struct esp_algorithm *, int));
static int esp_blowfish_cbc_encrypt __P((struct mbuf *, size_t,
- size_t, struct secasvar *, struct esp_algorithm *, int));
+ size_t, struct secasvar *, const struct esp_algorithm *, int));
static int esp_blowfish_cbc_ivlen __P((struct secasvar *));
static int esp_cast128cbc_ivlen __P((struct secasvar *));
static int esp_cast128cbc_decrypt __P((struct mbuf *, size_t,
- struct secasvar *, struct esp_algorithm *, int));
+ struct secasvar *, const struct esp_algorithm *, int));
static int esp_cast128cbc_encrypt __P((struct mbuf *, size_t, size_t,
- struct secasvar *, struct esp_algorithm *, int));
+ struct secasvar *, const struct esp_algorithm *, int));
static int esp_3descbc_ivlen __P((struct secasvar *));
static int esp_3descbc_decrypt __P((struct mbuf *, size_t,
- struct secasvar *, struct esp_algorithm *, int));
+ struct secasvar *, const struct esp_algorithm *, int));
static int esp_3descbc_encrypt __P((struct mbuf *, size_t, size_t,
- struct secasvar *, struct esp_algorithm *, int));
-#ifdef SADB_EALG_RC5CBC
+ struct secasvar *, const struct esp_algorithm *, int));
+#ifdef SADB_X_EALG_RC5CBC
static int esp_rc5cbc_ivlen __P((struct secasvar *));
static int esp_rc5cbc_decrypt __P((struct mbuf *, size_t,
- struct secasvar *, struct esp_algorithm *, int));
+ struct secasvar *, const struct esp_algorithm *, int));
static int esp_rc5cbc_encrypt __P((struct mbuf *, size_t, size_t,
- struct secasvar *, struct esp_algorithm *, int));
+ struct secasvar *, const struct esp_algorithm *, int));
#endif
static void esp_increment_iv __P((struct secasvar *));
static caddr_t mbuf_find_offset __P((struct mbuf *, size_t, size_t));
-/* NOTE: The order depends on SADB_EALG_x in netkey/keyv2.h */
-struct esp_algorithm esp_algorithms[] = {
- { 0, 0, 0, 0, 0, 0, 0, },
- { 8, esp_descbc_mature, 64, 64, "des-cbc",
- esp_descbc_ivlen, esp_descbc_decrypt, esp_descbc_encrypt, },
- { 8, esp_cbc_mature, 192, 192, "3des-cbc",
- esp_3descbc_ivlen, esp_3descbc_decrypt, esp_3descbc_encrypt, },
- { 1, esp_null_mature, 0, 2048, "null",
- esp_null_ivlen, esp_null_decrypt, esp_null_encrypt, },
- { 8, esp_cbc_mature, 40, 448, "blowfish-cbc",
- esp_blowfish_cbc_ivlen, esp_blowfish_cbc_decrypt,
- esp_blowfish_cbc_encrypt, },
- { 8, esp_cbc_mature, 40, 128, "cast128-cbc",
- esp_cast128cbc_ivlen, esp_cast128cbc_decrypt,
- esp_cast128cbc_encrypt, },
-#ifdef SADB_EALG_RC5CBC
- { 8, esp_cbc_mature, 40, 2040, "rc5-cbc",
- esp_rc5cbc_ivlen, esp_rc5cbc_decrypt, esp_rc5cbc_encrypt, },
+const struct esp_algorithm *
+esp_algorithm_lookup(idx)
+ int idx;
+{
+ static struct esp_algorithm esp_algorithms[] = {
+ { 8, esp_descbc_mature, 64, 64, "des-cbc",
+ esp_descbc_ivlen, esp_descbc_decrypt,
+ esp_descbc_encrypt, },
+ { 8, esp_cbc_mature, 192, 192, "3des-cbc",
+ esp_3descbc_ivlen, esp_3descbc_decrypt,
+ esp_3descbc_encrypt, },
+ { 1, esp_null_mature, 0, 2048, "null",
+ esp_null_ivlen, esp_null_decrypt, esp_null_encrypt, },
+ { 8, esp_cbc_mature, 40, 448, "blowfish-cbc",
+ esp_blowfish_cbc_ivlen, esp_blowfish_cbc_decrypt,
+ esp_blowfish_cbc_encrypt, },
+ { 8, esp_cbc_mature, 40, 128, "cast128-cbc",
+ esp_cast128cbc_ivlen, esp_cast128cbc_decrypt,
+ esp_cast128cbc_encrypt, },
+#ifdef SADB_X_EALG_RC5CBC
+ { 8, esp_cbc_mature, 40, 2040, "rc5-cbc",
+ esp_rc5cbc_ivlen, esp_rc5cbc_decrypt,
+ esp_rc5cbc_encrypt, },
+#else
+ { 8, NULL, 40, 2040, "rc5-cbc dummy", NULL, NULL, NULL, },
+#endif
+ };
+
+ switch (idx) {
+ case SADB_EALG_DESCBC:
+ return &esp_algorithms[0];
+ case SADB_EALG_3DESCBC:
+ return &esp_algorithms[1];
+ case SADB_EALG_NULL:
+ return &esp_algorithms[2];
+ case SADB_X_EALG_BLOWFISHCBC:
+ return &esp_algorithms[3];
+ case SADB_X_EALG_CAST128CBC:
+ return &esp_algorithms[4];
+#ifdef SADB_X_EALG_RC5CBC
+ case SADB_X_EALG_RC5CBC:
+ return &esp_algorithms[5];
#endif
-};
+ default:
+ return NULL;
+ }
+}
/*
* mbuf assumption: foo_encrypt() assumes that IV part is placed in a single
@@ -153,7 +180,7 @@ esp_null_decrypt(m, off, sav, algo, ivlen)
struct mbuf *m;
size_t off; /* offset to ESP header */
struct secasvar *sav;
- struct esp_algorithm *algo;
+ const struct esp_algorithm *algo;
int ivlen;
{
return 0; /* do nothing */
@@ -165,7 +192,7 @@ esp_null_encrypt(m, off, plen, sav, algo, ivlen)
size_t off; /* offset to ESP header */
size_t plen; /* payload length (to be encrypted) */
struct secasvar *sav;
- struct esp_algorithm *algo;
+ const struct esp_algorithm *algo;
int ivlen;
{
return 0; /* do nothing */
@@ -175,7 +202,7 @@ static int
esp_descbc_mature(sav)
struct secasvar *sav;
{
- struct esp_algorithm *algo;
+ const struct esp_algorithm *algo;
if (!(sav->flags & SADB_X_EXT_OLD) && (sav->flags & SADB_X_EXT_IV4B)) {
ipseclog((LOG_ERR, "esp_cbc_mature: "
@@ -187,7 +214,14 @@ esp_descbc_mature(sav)
ipseclog((LOG_ERR, "esp_descbc_mature: no key is given.\n"));
return 1;
}
- algo = &esp_algorithms[sav->alg_enc];
+
+ algo = esp_algorithm_lookup(sav->alg_enc);
+ if (!algo) {
+ ipseclog((LOG_ERR,
+ "esp_descbc_mature: unsupported algorithm.\n"));
+ return 1;
+ }
+
if (_KEYBITS(sav->key_enc) < algo->keymin
|| algo->keymax < _KEYBITS(sav->key_enc)) {
ipseclog((LOG_ERR,
@@ -224,7 +258,7 @@ esp_descbc_decrypt(m, off, sav, algo, ivlen)
struct mbuf *m;
size_t off; /* offset to ESP header */
struct secasvar *sav;
- struct esp_algorithm *algo;
+ const struct esp_algorithm *algo;
int ivlen;
{
size_t ivoff = 0;
@@ -332,7 +366,7 @@ esp_descbc_encrypt(m, off, plen, sav, algo, ivlen)
size_t off; /* offset to ESP header */
size_t plen; /* payload length (to be decrypted) */
struct secasvar *sav;
- struct esp_algorithm *algo;
+ const struct esp_algorithm *algo;
int ivlen;
{
size_t ivoff = 0;
@@ -454,7 +488,7 @@ esp_cbc_mature(sav)
struct secasvar *sav;
{
int keylen;
- struct esp_algorithm *algo;
+ const struct esp_algorithm *algo;
if (sav->flags & SADB_X_EXT_OLD) {
ipseclog((LOG_ERR,
@@ -472,7 +506,14 @@ esp_cbc_mature(sav)
"esp_cbc_mature: no key is given.\n"));
return 1;
}
- algo = &esp_algorithms[sav->alg_enc];
+
+ algo = esp_algorithm_lookup(sav->alg_enc);
+ if (!algo) {
+ ipseclog((LOG_ERR,
+ "esp_cbc_mature: unsupported algorithm.\n"));
+ return 1;
+ }
+
keylen = sav->key_enc->sadb_key_bits;
if (keylen < algo->keymin || algo->keymax < keylen) {
ipseclog((LOG_ERR, "esp_cbc_mature: invalid key length %d.\n",
@@ -490,10 +531,10 @@ esp_cbc_mature(sav)
return 1;
}
break;
- case SADB_EALG_BLOWFISHCBC:
- case SADB_EALG_CAST128CBC:
-#ifdef SADB_EALG_RC5CBC
- case SADB_EALG_RC5CBC:
+ case SADB_X_EALG_BLOWFISHCBC:
+ case SADB_X_EALG_CAST128CBC:
+#ifdef SADB_X_EALG_RC5CBC
+ case SADB_X_EALG_RC5CBC:
#endif
break;
}
@@ -506,7 +547,7 @@ esp_blowfish_cbc_decrypt(m, off, sav, algo, ivlen)
struct mbuf *m;
size_t off; /* offset to ESP header */
struct secasvar *sav;
- struct esp_algorithm *algo;
+ const struct esp_algorithm *algo;
int ivlen;
{
size_t ivoff;
@@ -583,7 +624,7 @@ esp_blowfish_cbc_encrypt(m, off, plen, sav, algo, ivlen)
size_t off; /* offset to ESP header */
size_t plen; /* payload length (to be decrypted) */
struct secasvar *sav;
- struct esp_algorithm *algo;
+ const struct esp_algorithm *algo;
int ivlen;
{
size_t ivoff;
@@ -669,7 +710,7 @@ esp_cast128cbc_decrypt(m, off, sav, algo, ivlen)
struct mbuf *m;
size_t off;
struct secasvar *sav;
- struct esp_algorithm *algo;
+ const struct esp_algorithm *algo;
int ivlen;
{
size_t ivoff;
@@ -748,7 +789,7 @@ esp_cast128cbc_encrypt(m, off, plen, sav, algo, ivlen)
size_t off;
size_t plen;
struct secasvar *sav;
- struct esp_algorithm *algo;
+ const struct esp_algorithm *algo;
int ivlen;
{
size_t ivoff;
@@ -831,7 +872,7 @@ esp_3descbc_decrypt(m, off, sav, algo, ivlen)
struct mbuf *m;
size_t off;
struct secasvar *sav;
- struct esp_algorithm *algo;
+ const struct esp_algorithm *algo;
int ivlen;
{
size_t ivoff;
@@ -913,7 +954,7 @@ esp_3descbc_encrypt(m, off, plen, sav, algo, ivlen)
size_t off;
size_t plen;
struct secasvar *sav;
- struct esp_algorithm *algo;
+ const struct esp_algorithm *algo;
int ivlen;
{
size_t ivoff;
@@ -984,7 +1025,7 @@ esp_3descbc_encrypt(m, off, plen, sav, algo, ivlen)
return 0;
}
-#ifdef SADB_EALG_RC5CBC
+#ifdef SADB_X_EALG_RC5CBC
static int
esp_rc5cbc_ivlen(sav)
struct secasvar *sav;
@@ -997,7 +1038,7 @@ esp_rc5cbc_decrypt(m, off, sav, algo, ivlen)
struct mbuf *m;
size_t off;
struct secasvar *sav;
- struct esp_algorithm *algo;
+ const struct esp_algorithm *algo;
int ivlen;
{
size_t ivoff;
@@ -1069,7 +1110,7 @@ esp_rc5cbc_encrypt(m, off, plen, sav, algo, ivlen)
size_t off;
size_t plen;
struct secasvar *sav;
- struct esp_algorithm *algo;
+ const struct esp_algorithm *algo;
int ivlen;
{
size_t ivoff;
@@ -1197,7 +1238,7 @@ esp_auth(m0, skip, length, sav, sum)
size_t off;
struct ah_algorithm_state s;
u_char sumbuf[AH_MAXSUMSIZE];
- struct ah_algorithm *algo;
+ const struct ah_algorithm *algo;
size_t siz;
int error;
@@ -1223,7 +1264,8 @@ esp_auth(m0, skip, length, sav, sum)
ipseclog((LOG_DEBUG, "esp_auth: NULL SA passed\n"));
return EINVAL;
}
- if (!sav->alg_auth) {
+ algo = ah_algorithm_lookup(sav->alg_auth);
+ if (!algo) {
ipseclog((LOG_ERR,
"esp_auth: bad ESP auth algorithm passed: %d\n",
sav->alg_auth));
@@ -1233,7 +1275,6 @@ esp_auth(m0, skip, length, sav, sum)
m = m0;
off = 0;
- algo = &ah_algorithms[sav->alg_auth];
siz = (((*algo->sumsiz)(sav) + 3) & ~(4 - 1));
if (sizeof(sumbuf) < siz) {
ipseclog((LOG_DEBUG,