summaryrefslogtreecommitdiff
path: root/sys
diff options
context:
space:
mode:
Diffstat (limited to 'sys')
-rw-r--r--sys/net/pfkeyv2.h45
-rw-r--r--sys/netinet6/ah.h17
-rw-r--r--sys/netinet6/ah_core.c102
-rw-r--r--sys/netinet6/ah_input.c24
-rw-r--r--sys/netinet6/ah_output.c36
-rw-r--r--sys/netinet6/esp.h13
-rw-r--r--sys/netinet6/esp_core.c159
-rw-r--r--sys/netinet6/esp_input.c46
-rw-r--r--sys/netinet6/esp_output.c48
-rw-r--r--sys/netkey/key.c109
10 files changed, 354 insertions, 245 deletions
diff --git a/sys/net/pfkeyv2.h b/sys/net/pfkeyv2.h
index 2fa6d086feb..50832447e5c 100644
--- a/sys/net/pfkeyv2.h
+++ b/sys/net/pfkeyv2.h
@@ -1,5 +1,5 @@
-/* $NetBSD: pfkeyv2.h,v 1.6 2000/07/01 01:01:34 itojun Exp $ */
-/* $KAME: pfkeyv2.h,v 1.17 2000/06/22 08:38:33 sakane Exp $ */
+/* $NetBSD: pfkeyv2.h,v 1.7 2000/07/18 14:56:42 itojun Exp $ */
+/* $KAME: pfkeyv2.h,v 1.18 2000/07/15 16:07:47 itojun Exp $ */
/*
* Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
@@ -298,26 +298,29 @@ struct sadb_x_ipsecrequest {
#define SADB_SAFLAGS_PFS 1
-#define SADB_AALG_NONE 0
-#define SADB_AALG_MD5HMAC 1 /* 2 */
-#define SADB_AALG_SHA1HMAC 2 /* 3 */
-#define SADB_AALG_MD5 3 /* Keyed MD5 */
-#define SADB_AALG_SHA 4 /* Keyed SHA */
-#define SADB_AALG_NULL 5 /* null authentication */
-#define SADB_AALG_MAX 6
-
-#define SADB_EALG_NONE 0
-#define SADB_EALG_DESCBC 1 /* 2 */
-#define SADB_EALG_3DESCBC 2 /* 3 */
-#define SADB_EALG_NULL 3 /* 11 */
-#define SADB_EALG_BLOWFISHCBC 4
-#define SADB_EALG_CAST128CBC 5
-#if 0
-#define SADB_EALG_RC5CBC 6
-#define SADB_EALG_MAX 7
-#else
-#define SADB_EALG_MAX 6
+/* RFC2367 numbers - meets RFC2407 */
+#define SADB_AALG_NONE 0
+#define SADB_AALG_MD5HMAC 2
+#define SADB_AALG_SHA1HMAC 3
+#define SADB_AALG_MAX 251
+/* private allocations should use 249-255 (RFC2407) */
+#define SADB_X_AALG_MD5 249 /* Keyed MD5 */
+#define SADB_X_AALG_SHA 250 /* Keyed SHA */
+#define SADB_X_AALG_NULL 251 /* null authentication */
+
+/* RFC2367 numbers - meets RFC2407 */
+#define SADB_EALG_NONE 0
+#define SADB_EALG_DESCBC 2
+#define SADB_EALG_3DESCBC 3
+#define SADB_EALG_NULL 11
+#define SADB_EALG_MAX 11
+/* private allocations - based on RFC2407 */
+#if 0 /*disabled due to possible patent issue*/
+#define SADB_X_EALG_RC5CBC 4
#endif
+#define SADB_X_EALG_CAST128CBC 6
+#define SADB_X_EALG_BLOWFISHCBC 7
+/* private allocations should use 249-255 (RFC2407) */
#if 1 /*nonstandard */
#define SADB_X_CALG_NONE 0
diff --git a/sys/netinet6/ah.h b/sys/netinet6/ah.h
index 5a92ff092a9..c6880474922 100644
--- a/sys/netinet6/ah.h
+++ b/sys/netinet6/ah.h
@@ -1,5 +1,5 @@
-/* $NetBSD: ah.h,v 1.10 2000/06/14 11:27:35 itojun Exp $ */
-/* $KAME: ah.h,v 1.9 2000/06/14 11:14:03 itojun Exp $ */
+/* $NetBSD: ah.h,v 1.11 2000/07/18 14:56:42 itojun Exp $ */
+/* $KAME: ah.h,v 1.11 2000/07/15 16:07:47 itojun Exp $ */
/*
* Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
@@ -41,7 +41,7 @@
#include "opt_inet.h"
#endif
-#include <netkey/keydb.h> /* for struct secasvar */
+struct secasvar;
struct ah {
u_int8_t ah_nxt; /* Next Header */
@@ -79,12 +79,7 @@ struct ah_algorithm {
#define AH_MAXSUMSIZE 16
#ifdef _KERNEL
-extern struct ah_algorithm ah_algorithms[];
-
-struct inpcb;
-#ifdef INET6
-struct in6pcb;
-#endif
+extern const struct ah_algorithm *ah_algorithm_lookup __P((int));
/* cksum routines */
extern int ah_hdrlen __P((struct secasvar *));
@@ -93,14 +88,14 @@ extern size_t ah_hdrsiz __P((struct ipsecrequest *));
extern void ah4_input __P((struct mbuf *, ...));
extern int ah4_output __P((struct mbuf *, struct ipsecrequest *));
extern int ah4_calccksum __P((struct mbuf *, caddr_t, size_t,
- struct ah_algorithm *, struct secasvar *));
+ const struct ah_algorithm *, struct secasvar *));
#ifdef INET6
extern int ah6_input __P((struct mbuf **, int *, int));
extern int ah6_output __P((struct mbuf *, u_char *, struct mbuf *,
struct ipsecrequest *));
extern int ah6_calccksum __P((struct mbuf *, caddr_t, size_t,
- struct ah_algorithm *, struct secasvar *));
+ const struct ah_algorithm *, struct secasvar *));
#endif /* INET6 */
#endif /*_KERNEL*/
diff --git a/sys/netinet6/ah_core.c b/sys/netinet6/ah_core.c
index 9a597e5607f..db7f2072b64 100644
--- a/sys/netinet6/ah_core.c
+++ b/sys/netinet6/ah_core.c
@@ -1,5 +1,5 @@
-/* $NetBSD: ah_core.c,v 1.19 2000/06/14 11:27:35 itojun Exp $ */
-/* $KAME: ah_core.c,v 1.35 2000/06/14 11:14:03 itojun Exp $ */
+/* $NetBSD: ah_core.c,v 1.20 2000/07/18 14:56:42 itojun Exp $ */
+/* $KAME: ah_core.c,v 1.36 2000/07/15 16:07:48 itojun Exp $ */
/*
* Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
@@ -96,8 +96,7 @@
static int ah_sumsiz_1216 __P((struct secasvar *));
static int ah_sumsiz_zero __P((struct secasvar *));
static int ah_none_mature __P((struct secasvar *));
-static int ah_none_init __P((struct ah_algorithm_state *,
- struct secasvar *));
+static int ah_none_init __P((struct ah_algorithm_state *, struct secasvar *));
static void ah_none_loop __P((struct ah_algorithm_state *, caddr_t, size_t));
static void ah_none_result __P((struct ah_algorithm_state *, caddr_t));
static int ah_keyed_md5_mature __P((struct secasvar *));
@@ -125,24 +124,47 @@ static void ah_hmac_sha1_loop __P((struct ah_algorithm_state *, caddr_t,
size_t));
static void ah_hmac_sha1_result __P((struct ah_algorithm_state *, caddr_t));
-static void ah_update_mbuf __P((struct mbuf *, int, int, struct ah_algorithm *,
- struct ah_algorithm_state *));
-
-/* checksum algorithms */
-/* NOTE: The order depends on SADB_AALG_x in net/pfkeyv2.h */
-struct ah_algorithm ah_algorithms[] = {
- { 0, 0, 0, 0, 0, 0, },
- { ah_sumsiz_1216, ah_hmac_md5_mature, 128, 128, "hmac-md5",
- ah_hmac_md5_init, ah_hmac_md5_loop, ah_hmac_md5_result, },
- { ah_sumsiz_1216, ah_hmac_sha1_mature, 160, 160, "hmac-sha1",
- ah_hmac_sha1_init, ah_hmac_sha1_loop, ah_hmac_sha1_result, },
- { ah_sumsiz_1216, ah_keyed_md5_mature, 128, 128, "keyed-md5",
- ah_keyed_md5_init, ah_keyed_md5_loop, ah_keyed_md5_result, },
- { ah_sumsiz_1216, ah_keyed_sha1_mature, 160, 160, "keyed-sha1",
- ah_keyed_sha1_init, ah_keyed_sha1_loop, ah_keyed_sha1_result, },
- { ah_sumsiz_zero, ah_none_mature, 0, 2048, "none",
- ah_none_init, ah_none_loop, ah_none_result, },
-};
+static void ah_update_mbuf __P((struct mbuf *, int, int,
+ const struct ah_algorithm *, struct ah_algorithm_state *));
+
+const struct ah_algorithm *
+ah_algorithm_lookup(idx)
+ int idx;
+{
+ /* checksum algorithms */
+ static struct ah_algorithm ah_algorithms[] = {
+ { ah_sumsiz_1216, ah_hmac_md5_mature, 128, 128, "hmac-md5",
+ ah_hmac_md5_init, ah_hmac_md5_loop,
+ ah_hmac_md5_result, },
+ { ah_sumsiz_1216, ah_hmac_sha1_mature, 160, 160, "hmac-sha1",
+ ah_hmac_sha1_init, ah_hmac_sha1_loop,
+ ah_hmac_sha1_result, },
+ { ah_sumsiz_1216, ah_keyed_md5_mature, 128, 128, "keyed-md5",
+ ah_keyed_md5_init, ah_keyed_md5_loop,
+ ah_keyed_md5_result, },
+ { ah_sumsiz_1216, ah_keyed_sha1_mature, 160, 160, "keyed-sha1",
+ ah_keyed_sha1_init, ah_keyed_sha1_loop,
+ ah_keyed_sha1_result, },
+ { ah_sumsiz_zero, ah_none_mature, 0, 2048, "none",
+ ah_none_init, ah_none_loop, ah_none_result, },
+ };
+
+ switch (idx) {
+ case SADB_AALG_MD5HMAC:
+ return &ah_algorithms[0];
+ case SADB_AALG_SHA1HMAC:
+ return &ah_algorithms[1];
+ case SADB_X_AALG_MD5:
+ return &ah_algorithms[2];
+ case SADB_X_AALG_SHA:
+ return &ah_algorithms[3];
+ case SADB_X_AALG_NULL:
+ return &ah_algorithms[4];
+ default:
+ return NULL;
+ }
+}
+
static int
ah_sumsiz_1216(sav)
@@ -303,13 +325,19 @@ static int
ah_keyed_sha1_mature(sav)
struct secasvar *sav;
{
- struct ah_algorithm *algo;
+ const struct ah_algorithm *algo;
if (!sav->key_auth) {
ipseclog((LOG_ERR, "ah_keyed_sha1_mature: no key is given.\n"));
return 1;
}
- algo = &ah_algorithms[sav->alg_auth];
+
+ algo = ah_algorithm_lookup(sav->alg_auth);
+ if (!algo) {
+ ipseclog((LOG_ERR, "ah_keyed_sha1_mature: unsupported algorithm.\n"));
+ return 1;
+ }
+
if (sav->key_auth->sadb_key_bits < algo->keymin
|| algo->keymax < sav->key_auth->sadb_key_bits) {
ipseclog((LOG_ERR,
@@ -420,13 +448,19 @@ static int
ah_hmac_md5_mature(sav)
struct secasvar *sav;
{
- struct ah_algorithm *algo;
+ const struct ah_algorithm *algo;
if (!sav->key_auth) {
ipseclog((LOG_ERR, "ah_hmac_md5_mature: no key is given.\n"));
return 1;
}
- algo = &ah_algorithms[sav->alg_auth];
+
+ algo = ah_algorithm_lookup(sav->alg_auth);
+ if (!algo) {
+ ipseclog((LOG_ERR, "ah_hmac_md5_mature: unsupported algorithm.\n"));
+ return 1;
+ }
+
if (sav->key_auth->sadb_key_bits < algo->keymin
|| algo->keymax < sav->key_auth->sadb_key_bits) {
ipseclog((LOG_ERR,
@@ -538,13 +572,19 @@ static int
ah_hmac_sha1_mature(sav)
struct secasvar *sav;
{
- struct ah_algorithm *algo;
+ const struct ah_algorithm *algo;
if (!sav->key_auth) {
ipseclog((LOG_ERR, "ah_hmac_sha1_mature: no key is given.\n"));
return 1;
}
- algo = &ah_algorithms[sav->alg_auth];
+
+ algo = ah_algorithm_lookup(sav->alg_auth);
+ if (!algo) {
+ ipseclog((LOG_ERR, "ah_hmac_sha1_mature: unsupported algorithm.\n"));
+ return 1;
+ }
+
if (sav->key_auth->sadb_key_bits < algo->keymin
|| algo->keymax < sav->key_auth->sadb_key_bits) {
ipseclog((LOG_ERR,
@@ -664,7 +704,7 @@ ah_update_mbuf(m, off, len, algo, algos)
struct mbuf *m;
int off;
int len;
- struct ah_algorithm *algo;
+ const struct ah_algorithm *algo;
struct ah_algorithm_state *algos;
{
struct mbuf *n;
@@ -713,7 +753,7 @@ ah4_calccksum(m, ahdat, len, algo, sav)
struct mbuf *m;
caddr_t ahdat;
size_t len;
- struct ah_algorithm *algo;
+ const struct ah_algorithm *algo;
struct secasvar *sav;
{
int off;
@@ -933,7 +973,7 @@ ah6_calccksum(m, ahdat, len, algo, sav)
struct mbuf *m;
caddr_t ahdat;
size_t len;
- struct ah_algorithm *algo;
+ const struct ah_algorithm *algo;
struct secasvar *sav;
{
int newoff, off;
diff --git a/sys/netinet6/ah_input.c b/sys/netinet6/ah_input.c
index 14ab5fad4bb..1b5285d737d 100644
--- a/sys/netinet6/ah_input.c
+++ b/sys/netinet6/ah_input.c
@@ -1,5 +1,5 @@
-/* $NetBSD: ah_input.c,v 1.15 2000/06/02 18:20:16 itojun Exp $ */
-/* $KAME: ah_input.c,v 1.29 2000/05/29 08:33:53 itojun Exp $ */
+/* $NetBSD: ah_input.c,v 1.16 2000/07/18 14:56:42 itojun Exp $ */
+/* $KAME: ah_input.c,v 1.30 2000/07/15 16:07:48 itojun Exp $ */
/*
* Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
@@ -91,7 +91,7 @@ ah4_input(m, va_alist)
struct ip *ip;
struct ah *ah;
u_int32_t spi;
- struct ah_algorithm *algo;
+ const struct ah_algorithm *algo;
size_t siz;
size_t siz1;
u_char *cksum;
@@ -159,16 +159,16 @@ ah4_input(m, va_alist)
ipsecstat.in_badspi++;
goto fail;
}
- if (sav->alg_auth == SADB_AALG_NONE) {
+
+ algo = ah_algorithm_lookup(sav->alg_auth);
+ if (!algo) {
ipseclog((LOG_DEBUG, "IPv4 AH input: "
- "unspecified authentication algorithm for spi %u\n",
+ "unsupported authentication algorithm for spi %u\n",
(u_int32_t)ntohl(spi)));
ipsecstat.in_badspi++;
goto fail;
}
- algo = &ah_algorithms[sav->alg_auth];
-
siz = (*algo->sumsiz)(sav);
siz1 = ((siz + 3) & ~(4 - 1));
@@ -573,7 +573,7 @@ ah6_input(mp, offp, proto)
struct ip6_hdr *ip6;
struct ah *ah;
u_int32_t spi;
- struct ah_algorithm *algo;
+ const struct ah_algorithm *algo;
size_t siz;
size_t siz1;
u_char *cksum;
@@ -624,16 +624,16 @@ ah6_input(mp, offp, proto)
ipsec6stat.in_badspi++;
goto fail;
}
- if (sav->alg_auth == SADB_AALG_NONE) {
+
+ algo = ah_algorithm_lookup(sav->alg_auth);
+ if (!algo) {
ipseclog((LOG_DEBUG, "IPv6 AH input: "
- "unspecified authentication algorithm for spi %u\n",
+ "unsupported authentication algorithm for spi %u\n",
(u_int32_t)ntohl(spi)));
ipsec6stat.in_badspi++;
goto fail;
}
- algo = &ah_algorithms[sav->alg_auth];
-
siz = (*algo->sumsiz)(sav);
siz1 = ((siz + 3) & ~(4 - 1));
diff --git a/sys/netinet6/ah_output.c b/sys/netinet6/ah_output.c
index dcbf183853e..995d4231c71 100644
--- a/sys/netinet6/ah_output.c
+++ b/sys/netinet6/ah_output.c
@@ -1,5 +1,5 @@
-/* $NetBSD: ah_output.c,v 1.10 2000/07/06 12:51:40 itojun Exp $ */
-/* $KAME: ah_output.c,v 1.22 2000/07/03 13:23:28 itojun Exp $ */
+/* $NetBSD: ah_output.c,v 1.11 2000/07/18 14:56:42 itojun Exp $ */
+/* $KAME: ah_output.c,v 1.23 2000/07/15 16:07:48 itojun Exp $ */
/*
* Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
@@ -82,7 +82,7 @@ size_t
ah_hdrsiz(isr)
struct ipsecrequest *isr;
{
- struct ah_algorithm *algo;
+ const struct ah_algorithm *algo;
size_t hdrsiz;
/* sanity check */
@@ -99,7 +99,7 @@ ah_hdrsiz(isr)
goto estimate;
/* we need transport mode AH. */
- algo = &ah_algorithms[isr->sav->alg_auth];
+ algo = ah_algorithm_lookup(isr->sav->alg_auth);
if (!algo)
goto estimate;
@@ -139,7 +139,7 @@ ah4_output(m, isr)
struct ipsecrequest *isr;
{
struct secasvar *sav = isr->sav;
- struct ah_algorithm *algo;
+ const struct ah_algorithm *algo;
u_int32_t spi;
u_char *ahdrpos;
u_char *ahsumpos = NULL;
@@ -166,7 +166,14 @@ ah4_output(m, isr)
return EINVAL;
}
- algo = &ah_algorithms[sav->alg_auth];
+ algo = ah_algorithm_lookup(sav->alg_auth);
+ if (!algo) {
+ ipseclog((LOG_ERR, "ah4_output: unsupported algorithm: "
+ "SPI=%u\n", (u_int32_t)ntohl(sav->spi)));
+ ipsecstat.out_inval++;
+ m_freem(m);
+ return EINVAL;
+ }
spi = sav->spi;
/*
@@ -315,10 +322,12 @@ int
ah_hdrlen(sav)
struct secasvar *sav;
{
- struct ah_algorithm *algo;
+ const struct ah_algorithm *algo;
int plen, ahlen;
- algo = &ah_algorithms[sav->alg_auth];
+ algo = ah_algorithm_lookup(sav->alg_auth);
+ if (!algo)
+ return 0;
if (sav->flags & SADB_X_EXT_OLD) {
/* RFC 1826 */
plen = ((*algo->sumsiz)(sav) + 3) & ~(4 - 1); /*XXX pad to 8byte?*/
@@ -346,7 +355,7 @@ ah6_output(m, nexthdrp, md, isr)
struct mbuf *mprev;
struct mbuf *mah;
struct secasvar *sav = isr->sav;
- struct ah_algorithm *algo;
+ const struct ah_algorithm *algo;
u_int32_t spi;
u_char *ahsumpos = NULL;
size_t plen; /*AH payload size in bytes*/
@@ -409,7 +418,14 @@ ah6_output(m, nexthdrp, md, isr)
return EINVAL;
}
- algo = &ah_algorithms[sav->alg_auth];
+ algo = ah_algorithm_lookup(sav->alg_auth);
+ if (!algo) {
+ ipseclog((LOG_ERR, "ah6_output: unsupported algorithm: "
+ "SPI=%u\n", (u_int32_t)ntohl(sav->spi)));
+ ipsec6stat.out_inval++;
+ m_freem(m);
+ return EINVAL;
+ }
spi = sav->spi;
/*
diff --git a/sys/netinet6/esp.h b/sys/netinet6/esp.h
index 1addc357238..17931833a60 100644
--- a/sys/netinet6/esp.h
+++ b/sys/netinet6/esp.h
@@ -1,5 +1,5 @@
-/* $NetBSD: esp.h,v 1.8 2000/06/14 11:27:36 itojun Exp $ */
-/* $KAME: esp.h,v 1.7 2000/06/14 10:41:17 itojun Exp $ */
+/* $NetBSD: esp.h,v 1.9 2000/07/18 14:56:42 itojun Exp $ */
+/* $KAME: esp.h,v 1.9 2000/07/15 16:07:48 itojun Exp $ */
/*
* Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
@@ -41,7 +41,7 @@
#include "opt_inet.h"
#endif
-#include <netkey/keydb.h> /* for struct secas */
+struct secasvar;
struct esp {
u_int32_t esp_spi; /* ESP */
@@ -85,13 +85,13 @@ struct esp_algorithm {
const char *name;
int (*ivlen) __P((struct secasvar *));
int (*decrypt) __P((struct mbuf *, size_t,
- struct secasvar *, struct esp_algorithm *, int));
+ struct secasvar *, const struct esp_algorithm *, int));
int (*encrypt) __P((struct mbuf *, size_t, size_t,
- struct secasvar *, struct esp_algorithm *, int));
+ struct secasvar *, const struct esp_algorithm *, int));
};
#ifdef _KERNEL
-extern struct esp_algorithm esp_algorithms[];
+extern const struct esp_algorithm *esp_algorithm_lookup __P((int));
/* crypt routines */
extern int esp4_output __P((struct mbuf *, struct ipsecrequest *));
@@ -105,7 +105,6 @@ extern int esp6_input __P((struct mbuf **, int *, int));
#endif /* INET6 */
#endif /*_KERNEL*/
-struct secasvar;
extern int esp_auth __P((struct mbuf *, size_t, size_t,
struct secasvar *, u_char *));
diff --git a/sys/netinet6/esp_core.c b/sys/netinet6/esp_core.c
index 0b1050675b4..a1bb880f8d2 100644
--- a/sys/netinet6/esp_core.c
+++ b/sys/netinet6/esp_core.c
@@ -1,5 +1,5 @@
-/* $NetBSD: esp_core.c,v 1.1.1.1 2000/06/14 19:39:43 thorpej Exp $ */
-/* $KAME: esp_core.c,v 1.15 2000/06/14 10:41:18 itojun Exp $ */
+/* $NetBSD: esp_core.c,v 1.2 2000/07/18 14:56:42 itojun Exp $ */
+/* $KAME: esp_core.c,v 1.18 2000/07/16 08:44:24 itojun Exp $ */
/*
* Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
@@ -63,7 +63,7 @@
#include <crypto/des/des.h>
#include <crypto/blowfish/blowfish.h>
#include <crypto/cast128/cast128.h>
-#ifdef SADB_EALG_RC5CBC
+#ifdef SADB_X_EALG_RC5CBC
#include <crypto/rc5/rc5.h>
#endif
@@ -72,61 +72,88 @@
static int esp_null_mature __P((struct secasvar *));
static int esp_null_ivlen __P((struct secasvar *));
static int esp_null_decrypt __P((struct mbuf *, size_t,
- struct secasvar *, struct esp_algorithm *, int));
+ struct secasvar *, const struct esp_algorithm *, int));
static int esp_null_encrypt __P((struct mbuf *, size_t, size_t,
- struct secasvar *, struct esp_algorithm *, int));
+ struct secasvar *, const struct esp_algorithm *, int));
static int esp_descbc_mature __P((struct secasvar *));
static int esp_descbc_ivlen __P((struct secasvar *));
static int esp_descbc_decrypt __P((struct mbuf *, size_t,
- struct secasvar *, struct esp_algorithm *, int));
+ struct secasvar *, const struct esp_algorithm *, int));
static int esp_descbc_encrypt __P((struct mbuf *, size_t, size_t,
- struct secasvar *, struct esp_algorithm *, int));
+ struct secasvar *, const struct esp_algorithm *, int));
static int esp_cbc_mature __P((struct secasvar *));
static int esp_blowfish_cbc_decrypt __P((struct mbuf *, size_t,
- struct secasvar *, struct esp_algorithm *, int));
+ struct secasvar *, const struct esp_algorithm *, int));
static int esp_blowfish_cbc_encrypt __P((struct mbuf *, size_t,
- size_t, struct secasvar *, struct esp_algorithm *, int));
+ size_t, struct secasvar *, const struct esp_algorithm *, int));
static int esp_blowfish_cbc_ivlen __P((struct secasvar *));
static int esp_cast128cbc_ivlen __P((struct secasvar *));
static int esp_cast128cbc_decrypt __P((struct mbuf *, size_t,
- struct secasvar *, struct esp_algorithm *, int));
+ struct secasvar *, const struct esp_algorithm *, int));
static int esp_cast128cbc_encrypt __P((struct mbuf *, size_t, size_t,
- struct secasvar *, struct esp_algorithm *, int));
+ struct secasvar *, const struct esp_algorithm *, int));
static int esp_3descbc_ivlen __P((struct secasvar *));
static int esp_3descbc_decrypt __P((struct mbuf *, size_t,
- struct secasvar *, struct esp_algorithm *, int));
+ struct secasvar *, const struct esp_algorithm *, int));
static int esp_3descbc_encrypt __P((struct mbuf *, size_t, size_t,
- struct secasvar *, struct esp_algorithm *, int));
-#ifdef SADB_EALG_RC5CBC
+ struct secasvar *, const struct esp_algorithm *, int));
+#ifdef SADB_X_EALG_RC5CBC
static int esp_rc5cbc_ivlen __P((struct secasvar *));
static int esp_rc5cbc_decrypt __P((struct mbuf *, size_t,
- struct secasvar *, struct esp_algorithm *, int));
+ struct secasvar *, const struct esp_algorithm *, int));
static int esp_rc5cbc_encrypt __P((struct mbuf *, size_t, size_t,
- struct secasvar *, struct esp_algorithm *, int));
+ struct secasvar *, const struct esp_algorithm *, int));
#endif
static void esp_increment_iv __P((struct secasvar *));
static caddr_t mbuf_find_offset __P((struct mbuf *, size_t, size_t));
-/* NOTE: The order depends on SADB_EALG_x in netkey/keyv2.h */
-struct esp_algorithm esp_algorithms[] = {
- { 0, 0, 0, 0, 0, 0, 0, },
- { 8, esp_descbc_mature, 64, 64, "des-cbc",
- esp_descbc_ivlen, esp_descbc_decrypt, esp_descbc_encrypt, },
- { 8, esp_cbc_mature, 192, 192, "3des-cbc",
- esp_3descbc_ivlen, esp_3descbc_decrypt, esp_3descbc_encrypt, },
- { 1, esp_null_mature, 0, 2048, "null",
- esp_null_ivlen, esp_null_decrypt, esp_null_encrypt, },
- { 8, esp_cbc_mature, 40, 448, "blowfish-cbc",
- esp_blowfish_cbc_ivlen, esp_blowfish_cbc_decrypt,
- esp_blowfish_cbc_encrypt, },
- { 8, esp_cbc_mature, 40, 128, "cast128-cbc",
- esp_cast128cbc_ivlen, esp_cast128cbc_decrypt,
- esp_cast128cbc_encrypt, },
-#ifdef SADB_EALG_RC5CBC
- { 8, esp_cbc_mature, 40, 2040, "rc5-cbc",
- esp_rc5cbc_ivlen, esp_rc5cbc_decrypt, esp_rc5cbc_encrypt, },
+const struct esp_algorithm *
+esp_algorithm_lookup(idx)
+ int idx;
+{
+ static struct esp_algorithm esp_algorithms[] = {
+ { 8, esp_descbc_mature, 64, 64, "des-cbc",
+ esp_descbc_ivlen, esp_descbc_decrypt,
+ esp_descbc_encrypt, },
+ { 8, esp_cbc_mature, 192, 192, "3des-cbc",
+ esp_3descbc_ivlen, esp_3descbc_decrypt,
+ esp_3descbc_encrypt, },
+ { 1, esp_null_mature, 0, 2048, "null",
+ esp_null_ivlen, esp_null_decrypt, esp_null_encrypt, },
+ { 8, esp_cbc_mature, 40, 448, "blowfish-cbc",
+ esp_blowfish_cbc_ivlen, esp_blowfish_cbc_decrypt,
+ esp_blowfish_cbc_encrypt, },
+ { 8, esp_cbc_mature, 40, 128, "cast128-cbc",
+ esp_cast128cbc_ivlen, esp_cast128cbc_decrypt,
+ esp_cast128cbc_encrypt, },
+#ifdef SADB_X_EALG_RC5CBC
+ { 8, esp_cbc_mature, 40, 2040, "rc5-cbc",
+ esp_rc5cbc_ivlen, esp_rc5cbc_decrypt,
+ esp_rc5cbc_encrypt, },
+#else
+ { 8, NULL, 40, 2040, "rc5-cbc dummy", NULL, NULL, NULL, },
+#endif
+ };
+
+ switch (idx) {
+ case SADB_EALG_DESCBC:
+ return &esp_algorithms[0];
+ case SADB_EALG_3DESCBC:
+ return &esp_algorithms[1];
+ case SADB_EALG_NULL:
+ return &esp_algorithms[2];
+ case SADB_X_EALG_BLOWFISHCBC:
+ return &esp_algorithms[3];
+ case SADB_X_EALG_CAST128CBC:
+ return &esp_algorithms[4];
+#ifdef SADB_X_EALG_RC5CBC
+ case SADB_X_EALG_RC5CBC:
+ return &esp_algorithms[5];
#endif
-};
+ default:
+ return NULL;
+ }
+}
/*
* mbuf assumption: foo_encrypt() assumes that IV part is placed in a single
@@ -153,7 +180,7 @@ esp_null_decrypt(m, off, sav, algo, ivlen)
struct mbuf *m;
size_t off; /* offset to ESP header */
struct secasvar *sav;
- struct esp_algorithm *algo;
+ const struct esp_algorithm *algo;
int ivlen;
{
return 0; /* do nothing */
@@ -165,7 +192,7 @@ esp_null_encrypt(m, off, plen, sav, algo, ivlen)
size_t off; /* offset to ESP header */
size_t plen; /* payload length (to be encrypted) */
struct secasvar *sav;
- struct esp_algorithm *algo;
+ const struct esp_algorithm *algo;
int ivlen;
{
return 0; /* do nothing */
@@ -175,7 +202,7 @@ static int
esp_descbc_mature(sav)
struct secasvar *sav;
{
- struct esp_algorithm *algo;
+ const struct esp_algorithm *algo;
if (!(sav->flags & SADB_X_EXT_OLD) && (sav->flags & SADB_X_EXT_IV4B)) {
ipseclog((LOG_ERR, "esp_cbc_mature: "
@@ -187,7 +214,14 @@ esp_descbc_mature(sav)
ipseclog((LOG_ERR, "esp_descbc_mature: no key is given.\n"));
return 1;
}
- algo = &esp_algorithms[sav->alg_enc];
+
+ algo = esp_algorithm_lookup(sav->alg_enc);
+ if (!algo) {
+ ipseclog((LOG_ERR,
+ "esp_descbc_mature: unsupported algorithm.\n"));
+ return 1;
+ }
+
if (_KEYBITS(sav->key_enc) < algo->keymin
|| algo->keymax < _KEYBITS(sav->key_enc)) {
ipseclog((LOG_ERR,
@@ -224,7 +258,7 @@ esp_descbc_decrypt(m, off, sav, algo, ivlen)
struct mbuf *m;
size_t off; /* offset to ESP header */
struct secasvar *sav;
- struct esp_algorithm *algo;
+ const struct esp_algorithm *algo;
int ivlen;
{
size_t ivoff = 0;
@@ -332,7 +366,7 @@ esp_descbc_encrypt(m, off, plen, sav, algo, ivlen)
size_t off; /* offset to ESP header */
size_t plen; /* payload length (to be decrypted) */
struct secasvar *sav;
- struct esp_algorithm *algo;
+ const struct esp_algorithm *algo;
int ivlen;
{
size_t ivoff = 0;
@@ -454,7 +488,7 @@ esp_cbc_mature(sav)
struct secasvar *sav;
{
int keylen;
- struct esp_algorithm *algo;
+ const struct esp_algorithm *algo;
if (sav->flags & SADB_X_EXT_OLD) {
ipseclog((LOG_ERR,
@@ -472,7 +506,14 @@ esp_cbc_mature(sav)
"esp_cbc_mature: no key is given.\n"));
return 1;
}
- algo = &esp_algorithms[sav->alg_enc];
+
+ algo = esp_algorithm_lookup(sav->alg_enc);
+ if (!algo) {
+ ipseclog((LOG_ERR,
+ "esp_cbc_mature: unsupported algorithm.\n"));
+ return 1;
+ }
+
keylen = sav->key_enc->sadb_key_bits;
if (keylen < algo->keymin || algo->keymax < keylen) {
ipseclog((LOG_ERR, "esp_cbc_mature: invalid key length %d.\n",
@@ -490,10 +531,10 @@ esp_cbc_mature(sav)
return 1;
}
break;
- case SADB_EALG_BLOWFISHCBC:
- case SADB_EALG_CAST128CBC:
-#ifdef SADB_EALG_RC5CBC
- case SADB_EALG_RC5CBC:
+ case SADB_X_EALG_BLOWFISHCBC:
+ case SADB_X_EALG_CAST128CBC:
+#ifdef SADB_X_EALG_RC5CBC
+ case SADB_X_EALG_RC5CBC:
#endif
break;
}
@@ -506,7 +547,7 @@ esp_blowfish_cbc_decrypt(m, off, sav, algo, ivlen)
struct mbuf *m;
size_t off; /* offset to ESP header */
struct secasvar *sav;
- struct esp_algorithm *algo;
+ const struct esp_algorithm *algo;
int ivlen;
{
size_t ivoff;
@@ -583,7 +624,7 @@ esp_blowfish_cbc_encrypt(m, off, plen, sav, algo, ivlen)
size_t off; /* offset to ESP header */
size_t plen; /* payload length (to be decrypted) */
struct secasvar *sav;
- struct esp_algorithm *algo;
+ const struct esp_algorithm *algo;
int ivlen;
{
size_t ivoff;
@@ -669,7 +710,7 @@ esp_cast128cbc_decrypt(m, off, sav, algo, ivlen)
struct mbuf *m;
size_t off;
struct secasvar *sav;
- struct esp_algorithm *algo;
+ const struct esp_algorithm *algo;
int ivlen;
{
size_t ivoff;
@@ -748,7 +789,7 @@ esp_cast128cbc_encrypt(m, off, plen, sav, algo, ivlen)
size_t off;
size_t plen;
struct secasvar *sav;
- struct esp_algorithm *algo;
+ const struct esp_algorithm *algo;
int ivlen;
{
size_t ivoff;
@@ -831,7 +872,7 @@ esp_3descbc_decrypt(m, off, sav, algo, ivlen)
struct mbuf *m;
size_t off;
struct secasvar *sav;
- struct esp_algorithm *algo;
+ const struct esp_algorithm *algo;
int ivlen;
{
size_t ivoff;
@@ -913,7 +954,7 @@ esp_3descbc_encrypt(m, off, plen, sav, algo, ivlen)
size_t off;
size_t plen;
struct secasvar *sav;
- struct esp_algorithm *algo;
+ const struct esp_algorithm *algo;
int ivlen;
{
size_t ivoff;
@@ -984,7 +1025,7 @@ esp_3descbc_encrypt(m, off, plen, sav, algo, ivlen)
return 0;
}
-#ifdef SADB_EALG_RC5CBC
+#ifdef SADB_X_EALG_RC5CBC
static int
esp_rc5cbc_ivlen(sav)
struct secasvar *sav;
@@ -997,7 +1038,7 @@ esp_rc5cbc_decrypt(m, off, sav, algo, ivlen)
struct mbuf *m;
size_t off;
struct secasvar *sav;
- struct esp_algorithm *algo;
+ const struct esp_algorithm *algo;
int ivlen;
{
size_t ivoff;
@@ -1069,7 +1110,7 @@ esp_rc5cbc_encrypt(m, off, plen, sav, algo, ivlen)
size_t off;
size_t plen;
struct secasvar *sav;
- struct esp_algorithm *algo;
+ const struct esp_algorithm *algo;
int ivlen;
{
size_t ivoff;
@@ -1197,7 +1238,7 @@ esp_auth(m0, skip, length, sav, sum)
size_t off;
struct ah_algorithm_state s;
u_char sumbuf[AH_MAXSUMSIZE];
- struct ah_algorithm *algo;
+ const struct ah_algorithm *algo;
size_t siz;
int error;
@@ -1223,7 +1264,8 @@ esp_auth(m0, skip, length, sav, sum)
ipseclog((LOG_DEBUG, "esp_auth: NULL SA passed\n"));
return EINVAL;
}
- if (!sav->alg_auth) {
+ algo = ah_algorithm_lookup(sav->alg_auth);
+ if (!algo) {
ipseclog((LOG_ERR,
"esp_auth: bad ESP auth algorithm passed: %d\n",
sav->alg_auth));
@@ -1233,7 +1275,6 @@ esp_auth(m0, skip, length, sav, sum)
m = m0;
off = 0;
- algo = &ah_algorithms[sav->alg_auth];
siz = (((*algo->sumsiz)(sav) + 3) & ~(4 - 1));
if (sizeof(sumbuf) < siz) {
ipseclog((LOG_DEBUG,
diff --git a/sys/netinet6/esp_input.c b/sys/netinet6/esp_input.c
index 678e96b9a82..5667d543a8b 100644
--- a/sys/netinet6/esp_input.c
+++ b/sys/netinet6/esp_input.c
@@ -1,10 +1,10 @@
-/* $NetBSD: esp_input.c,v 1.1.1.1 2000/06/14 19:39:43 thorpej Exp $ */
-/* $KAME: esp_input.c,v 1.22 2000/03/21 05:14:49 itojun Exp $ */
+/* $NetBSD: esp_input.c,v 1.2 2000/07/18 14:56:43 itojun Exp $ */
+/* $KAME: esp_input.c,v 1.26 2000/07/15 16:07:48 itojun Exp $ */
/*
* Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
* All rights reserved.
- *
+ *
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
@@ -16,7 +16,7 @@
* 3. Neither the name of the project nor the names of its contributors
* may be used to endorse or promote products derived from this software
* without specific prior written permission.
- *
+ *
* THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
@@ -103,7 +103,7 @@ esp4_input(m, va_alist)
struct secasvar *sav = NULL;
size_t taillen;
u_int16_t nxt;
- struct esp_algorithm *algo;
+ const struct esp_algorithm *algo;
int ivlen;
size_t hlen;
size_t esplen;
@@ -164,16 +164,15 @@ esp4_input(m, va_alist)
ipsecstat.in_badspi++;
goto bad;
}
- if (sav->alg_enc == SADB_EALG_NONE) {
+ algo = esp_algorithm_lookup(sav->alg_enc);
+ if (!algo) {
ipseclog((LOG_DEBUG, "IPv4 ESP input: "
- "unspecified encryption algorithm for spi %u\n",
+ "unsupported encryption algorithm for spi %u\n",
(u_int32_t)ntohl(spi)));
ipsecstat.in_badspi++;
goto bad;
}
- algo = &esp_algorithms[sav->alg_enc]; /*XXX*/
-
/* check if we have proper ivlen information */
ivlen = sav->ivlen;
if (ivlen < 0) {
@@ -187,7 +186,8 @@ esp4_input(m, va_alist)
&& (sav->alg_auth && sav->key_auth)))
goto noreplaycheck;
- if (sav->alg_auth == SADB_AALG_NULL)
+ if (sav->alg_auth == SADB_X_AALG_NULL ||
+ sav->alg_auth == SADB_AALG_NONE)
goto noreplaycheck;
/*
@@ -207,10 +207,12 @@ esp4_input(m, va_alist)
{
u_char sum0[AH_MAXSUMSIZE];
u_char sum[AH_MAXSUMSIZE];
- struct ah_algorithm *sumalgo;
+ const struct ah_algorithm *sumalgo;
size_t siz;
- sumalgo = &ah_algorithms[sav->alg_auth];
+ sumalgo = ah_algorithm_lookup(sav->alg_auth);
+ if (!sumalgo)
+ goto noreplaycheck;
siz = (((*sumalgo->sumsiz)(sav) + 3) & ~(4 - 1));
if (AH_MAXSUMSIZE < siz) {
ipseclog((LOG_DEBUG,
@@ -452,7 +454,7 @@ esp6_input(mp, offp, proto)
struct secasvar *sav = NULL;
size_t taillen;
u_int16_t nxt;
- struct esp_algorithm *algo;
+ const struct esp_algorithm *algo;
int ivlen;
size_t esplen;
int s;
@@ -506,16 +508,15 @@ esp6_input(mp, offp, proto)
ipsec6stat.in_badspi++;
goto bad;
}
- if (sav->alg_enc == SADB_EALG_NONE) {
+ algo = esp_algorithm_lookup(sav->alg_enc);
+ if (!algo) {
ipseclog((LOG_DEBUG, "IPv6 ESP input: "
- "unspecified encryption algorithm for spi %u\n",
+ "unsupported encryption algorithm for spi %u\n",
(u_int32_t)ntohl(spi)));
ipsec6stat.in_badspi++;
goto bad;
}
- algo = &esp_algorithms[sav->alg_enc]; /*XXX*/
-
/* check if we have proper ivlen information */
ivlen = sav->ivlen;
if (ivlen < 0) {
@@ -529,7 +530,8 @@ esp6_input(mp, offp, proto)
&& (sav->alg_auth && sav->key_auth)))
goto noreplaycheck;
- if (sav->alg_auth == SADB_AALG_NULL)
+ if (sav->alg_auth == SADB_X_AALG_NULL ||
+ sav->alg_auth == SADB_AALG_NONE)
goto noreplaycheck;
/*
@@ -549,10 +551,12 @@ esp6_input(mp, offp, proto)
{
u_char sum0[AH_MAXSUMSIZE];
u_char sum[AH_MAXSUMSIZE];
- struct ah_algorithm *sumalgo;
+ const struct ah_algorithm *sumalgo;
size_t siz;
- sumalgo = &ah_algorithms[sav->alg_auth];
+ sumalgo = ah_algorithm_lookup(sav->alg_auth);
+ if (!sumalgo)
+ goto noreplaycheck;
siz = (((*sumalgo->sumsiz)(sav) + 3) & ~(4 - 1));
if (AH_MAXSUMSIZE < siz) {
ipseclog((LOG_DEBUG,
@@ -751,7 +755,7 @@ noreplaycheck:
m->m_len -= stripsiz;
m->m_pkthdr.len -= stripsiz;
} else {
- /*
+ /*
* this comes with no copy if the boundary is on
* cluster
*/
diff --git a/sys/netinet6/esp_output.c b/sys/netinet6/esp_output.c
index cea543890e3..6fff8404349 100644
--- a/sys/netinet6/esp_output.c
+++ b/sys/netinet6/esp_output.c
@@ -1,5 +1,5 @@
-/* $NetBSD: esp_output.c,v 1.2 2000/07/06 12:51:40 itojun Exp $ */
-/* $KAME: esp_output.c,v 1.22 2000/07/03 13:23:28 itojun Exp $ */
+/* $NetBSD: esp_output.c,v 1.3 2000/07/18 14:56:43 itojun Exp $ */
+/* $KAME: esp_output.c,v 1.23 2000/07/15 16:07:48 itojun Exp $ */
/*
* Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
@@ -82,7 +82,8 @@ esp_hdrsiz(isr)
struct ipsecrequest *isr;
{
struct secasvar *sav;
- struct esp_algorithm *algo;
+ const struct esp_algorithm *algo;
+ const struct ah_algorithm *aalgo;
size_t ivlen;
size_t authlen;
size_t hdrsiz;
@@ -103,7 +104,7 @@ esp_hdrsiz(isr)
goto estimate;
/* we need transport mode ESP. */
- algo = &esp_algorithms[sav->alg_enc];
+ algo = esp_algorithm_lookup(sav->alg_enc);
if (!algo)
goto estimate;
ivlen = sav->ivlen;
@@ -122,8 +123,9 @@ esp_hdrsiz(isr)
hdrsiz = sizeof(struct esp) + ivlen + 9;
} else {
/* RFC 2406 */
- if (sav->replay && sav->alg_auth && sav->key_auth)
- authlen = (*ah_algorithms[sav->alg_auth].sumsiz)(sav);
+ aalgo = ah_algorithm_lookup(sav->alg_auth);
+ if (aalgo && sav->replay && sav->key_auth)
+ authlen = (aalgo->sumsiz)(sav);
else
authlen = 0;
hdrsiz = sizeof(struct newesp) + ivlen + 9 + authlen;
@@ -176,7 +178,7 @@ esp_output(m, nexthdrp, md, isr, af)
struct esp *esp;
struct esptail *esptail;
struct secasvar *sav = isr->sav;
- struct esp_algorithm *algo;
+ const struct esp_algorithm *algo;
u_int32_t spi;
u_int8_t nxt = 0;
size_t plen; /*payload length to be encrypted*/
@@ -217,28 +219,31 @@ esp_output(m, nexthdrp, md, isr, af)
(u_int32_t)ntohl(ip->ip_dst.s_addr),
(u_int32_t)ntohl(sav->spi)));
ipsecstat.out_inval++;
- m_freem(m);
- return EINVAL;
+ break;
}
#endif /*INET*/
#ifdef INET6
case AF_INET6:
- {
- struct ip6_hdr *ip6;
-
- ip6 = mtod(m, struct ip6_hdr *);
ipseclog((LOG_DEBUG, "esp6_output: internal error: "
"sav->replay is null: SPI=%u\n",
(u_int32_t)ntohl(sav->spi)));
ipsec6stat.out_inval++;
- m_freem(m);
- return EINVAL;
- }
+ break;
#endif /*INET6*/
+ default:
+ panic("esp_output: should not reach here");
}
+ m_freem(m);
+ return EINVAL;
}
- algo = &esp_algorithms[sav->alg_enc]; /*XXX*/
+ algo = esp_algorithm_lookup(sav->alg_enc);
+ if (!algo) {
+ ipseclog((LOG_ERR, "esp_output: unsupported algorithm: "
+ "SPI=%u\n", (u_int32_t)ntohl(sav->spi)));
+ m_freem(m);
+ return EINVAL;
+ }
spi = sav->spi;
ivlen = sav->ivlen;
/* should be okey */
@@ -522,16 +527,21 @@ esp_output(m, nexthdrp, md, isr, af)
goto noantireplay;
if (!sav->key_auth)
goto noantireplay;
- if (!sav->alg_auth)
+ if (sav->key_auth == SADB_AALG_NONE)
goto noantireplay;
+
{
+ const struct ah_algorithm *aalgo;
u_char authbuf[AH_MAXSUMSIZE];
struct mbuf *n;
u_char *p;
size_t siz;
struct ip *ip;
- siz = (((*ah_algorithms[sav->alg_auth].sumsiz)(sav) + 3) & ~(4 - 1));
+ aalgo = ah_algorithm_lookup(sav->alg_auth);
+ if (!aalgo)
+ goto noantireplay;
+ siz = ((aalgo->sumsiz)(sav) + 3) & ~(4 - 1);
if (AH_MAXSUMSIZE < siz)
panic("assertion failed for AH_MAXSUMSIZE");
diff --git a/sys/netkey/key.c b/sys/netkey/key.c
index 25c6f8e87b6..936742cdedf 100644
--- a/sys/netkey/key.c
+++ b/sys/netkey/key.c
@@ -1,5 +1,5 @@
-/* $NetBSD: key.c,v 1.26 2000/07/01 01:01:35 itojun Exp $ */
-/* $KAME: key.c,v 1.137 2000/06/24 00:47:07 itojun Exp $ */
+/* $NetBSD: key.c,v 1.27 2000/07/18 14:56:43 itojun Exp $ */
+/* $KAME: key.c,v 1.142 2000/07/17 01:42:39 itojun Exp $ */
/*
* Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
@@ -2678,7 +2678,7 @@ key_setsaval(sav, m, mhp)
case SADB_SATYPE_AH:
case SADB_SATYPE_ESP:
if (len == PFKEY_ALIGN8(sizeof(struct sadb_key)) &&
- sav->alg_auth != SADB_AALG_NULL)
+ sav->alg_auth != SADB_X_AALG_NULL)
error = EINVAL;
break;
case SADB_X_SATYPE_IPCOMP:
@@ -2750,7 +2750,7 @@ key_setsaval(sav, m, mhp)
switch (mhp->msg->sadb_msg_satype) {
case SADB_SATYPE_ESP:
#ifdef IPSEC_ESP
- algo = &esp_algorithms[sav->alg_enc];
+ algo = esp_algorithm_lookup(sav->alg_enc);
if (algo && algo->ivlen)
sav->ivlen = (*algo->ivlen)(sav);
if (sav->ivlen == 0)
@@ -2946,7 +2946,10 @@ key_mature(sav)
#endif
return EINVAL;
}
- checkmask = 3;
+ if (sav->alg_auth == SADB_AALG_NONE)
+ checkmask = 1;
+ else
+ checkmask = 3;
mustmask = 1;
break;
case IPPROTO_AH:
@@ -2997,19 +3000,11 @@ key_mature(sav)
/* check authentication algorithm */
if ((checkmask & 2) != 0) {
- struct ah_algorithm *algo;
+ const struct ah_algorithm *algo;
int keylen;
- /* XXX: should use algorithm map to check. */
- switch (sav->alg_auth) {
- case SADB_AALG_NONE:
- case SADB_AALG_MD5HMAC:
- case SADB_AALG_SHA1HMAC:
- case SADB_AALG_MD5:
- case SADB_AALG_SHA:
- case SADB_AALG_NULL:
- break;
- default:
+ algo = ah_algorithm_lookup(sav->alg_auth);
+ if (!algo) {
#ifdef IPSEC_DEBUG
printf("key_mature: "
"unknown authentication algorithm.\n");
@@ -3018,8 +3013,6 @@ key_mature(sav)
}
/* algorithm-dependent check */
- algo = &ah_algorithms[sav->alg_auth];
-
if (sav->key_auth)
keylen = sav->key_auth->sadb_key_bits;
else
@@ -3052,21 +3045,11 @@ key_mature(sav)
/* check encryption algorithm */
if ((checkmask & 1) != 0) {
#ifdef IPSEC_ESP
- struct esp_algorithm *algo;
+ const struct esp_algorithm *algo;
int keylen;
- switch (sav->alg_enc) {
- case SADB_EALG_NONE:
- case SADB_EALG_DESCBC:
- case SADB_EALG_3DESCBC:
- case SADB_EALG_NULL:
- case SADB_EALG_BLOWFISHCBC:
- case SADB_EALG_CAST128CBC:
-#ifdef SADB_EALG_RC5CBC
- case SADB_EALG_RC5CBC:
-#endif
- break;
- default:
+ algo = esp_algorithm_lookup(sav->alg_enc);
+ if (!algo) {
#ifdef IPSEC_DEBUG
printf("key_mature: unknown encryption algorithm.\n");
#endif
@@ -3074,8 +3057,6 @@ key_mature(sav)
}
/* algorithm-dependent check */
- algo = &esp_algorithms[sav->alg_enc];
-
if (sav->key_enc)
keylen = sav->key_enc->sadb_key_bits;
else
@@ -5293,7 +5274,7 @@ static struct mbuf *
key_getcomb_esp()
{
struct sadb_comb *comb;
- struct esp_algorithm *algo;
+ const struct esp_algorithm *algo;
struct mbuf *result = NULL, *m, *n;
int encmin;
int i, off, o;
@@ -5301,8 +5282,10 @@ key_getcomb_esp()
const int l = PFKEY_ALIGN8(sizeof(struct sadb_comb));
m = NULL;
- for (i = 1; i < SADB_EALG_MAX; i++) {
- algo = &esp_algorithms[i];
+ for (i = 1; i <= SADB_EALG_MAX; i++) {
+ algo = esp_algorithm_lookup(i);
+ if (!algo)
+ continue;
if (algo->keymax < ipsec_esp_keymin)
continue;
@@ -5372,20 +5355,22 @@ static struct mbuf *
key_getcomb_ah()
{
struct sadb_comb *comb;
- struct ah_algorithm *algo;
+ const struct ah_algorithm *algo;
struct mbuf *m;
int min;
int i;
const int l = PFKEY_ALIGN8(sizeof(struct sadb_comb));
m = NULL;
- for (i = 1; i < SADB_AALG_MAX; i++) {
+ for (i = 1; i <= SADB_AALG_MAX; i++) {
#if 1
/* we prefer HMAC algorithms, not old algorithms */
if (i != SADB_AALG_SHA1HMAC && i != SADB_AALG_MD5HMAC)
continue;
#endif
- algo = &ah_algorithms[i];
+ algo = ah_algorithm_lookup(i);
+ if (!algo)
+ continue;
if (algo->keymax < ipsec_ah_keymin)
continue;
@@ -5758,7 +5743,7 @@ key_getspacq(spidx)
* <base, address(SD), (address(P),) (identity(SD),) (sensitivity,) proposal>
* to the socket.
*
- * m will always e freed.
+ * m will always be freed.
*/
static int
key_acquire2(so, m, mhp)
@@ -5945,13 +5930,21 @@ key_register(so, m, mhp)
struct sadb_alg *alg;
/* create new sadb_msg to reply. */
- alen = sizeof(struct sadb_supported)
- + ((SADB_AALG_MAX - 1) * sizeof(struct sadb_alg));
-#ifdef IPSEC_ESP
- elen = sizeof(struct sadb_supported)
- + ((SADB_EALG_MAX - 1) * sizeof(struct sadb_alg));
-#else
+ alen = 0;
+ for (i = 1; i <= SADB_AALG_MAX; i++) {
+ if (ah_algorithm_lookup(i))
+ alen += sizeof(struct sadb_alg);
+ }
+ if (alen)
+ alen += sizeof(struct sadb_supported);
elen = 0;
+#ifdef IPSEC_ESP
+ for (i = 1; i <= SADB_EALG_MAX; i++) {
+ if (esp_algorithm_lookup(i))
+ elen += sizeof(struct sadb_alg);
+ }
+ if (elen)
+ elen += sizeof(struct sadb_supported);
#endif
len = sizeof(struct sadb_msg) + alen + elen;
@@ -5987,10 +5980,12 @@ key_register(so, m, mhp)
sup->sadb_supported_exttype = SADB_EXT_SUPPORTED_AUTH;
off += PFKEY_ALIGN8(sizeof(*sup));
- for (i = 1; i < SADB_AALG_MAX; i++) {
- struct ah_algorithm *aalgo;
+ for (i = 1; i <= SADB_AALG_MAX; i++) {
+ const struct ah_algorithm *aalgo;
- aalgo = &ah_algorithms[i];
+ aalgo = ah_algorithm_lookup(i);
+ if (!aalgo)
+ continue;
alg = (struct sadb_alg *)(mtod(n, caddr_t) + off);
alg->sadb_alg_id = i;
alg->sadb_alg_ivlen = 0;
@@ -6008,10 +6003,12 @@ key_register(so, m, mhp)
sup->sadb_supported_exttype = SADB_EXT_SUPPORTED_ENCRYPT;
off += PFKEY_ALIGN8(sizeof(*sup));
- for (i = 1; i < SADB_EALG_MAX; i++) {
- struct esp_algorithm *ealgo;
+ for (i = 1; i <= SADB_EALG_MAX; i++) {
+ const struct esp_algorithm *ealgo;
- ealgo = &esp_algorithms[i];
+ ealgo = esp_algorithm_lookup(i);
+ if (!ealgo)
+ continue;
alg = (struct sadb_alg *)(mtod(n, caddr_t) + off);
alg->sadb_alg_id = i;
if (ealgo && ealgo->ivlen) {
@@ -6170,13 +6167,17 @@ key_expire(sav)
}
m_cat(result, m);
- if ((result->m_flags & M_PKTHDR) == 0)
+ if ((result->m_flags & M_PKTHDR) == 0) {
+ error = EINVAL;
goto fail;
+ }
if (result->m_len < sizeof(struct sadb_msg)) {
result = m_pullup(result, sizeof(struct sadb_msg));
- if (result == NULL)
+ if (result == NULL) {
+ error = ENOBUFS;
goto fail;
+ }
}
result->m_pkthdr.len = 0;