mDNSMacOSX/pfkey.c

   1 /*
   2  * Copyright (c) 2003-2007 Apple Computer, Inc. All rights reserved.
   3  *
   4  * Licensed under the Apache License, Version 2.0 (the "License");
   5  * you may not use this file except in compliance with the License.
   6  * You may obtain a copy of the License at
   7  *
   8  *     http://www.apache.org/licenses/LICENSE-2.0
   9  *
  10  * Unless required by applicable law or agreed to in writing, software
  11  * distributed under the License is distributed on an "AS IS" BASIS,
  12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13  * See the License for the specific language governing permissions and
  14  * limitations under the License.
  15  */
  16 /*      $FreeBSD: src/lib/libipsec/pfkey.c,v 1.1.2.2 2001/07/03 11:01:14 ume Exp $      */
  17 /*      $KAME: pfkey.c,v 1.39 2001/03/05 18:22:17 thorpej Exp $ */
  18
  19 /*
  20  * Copyright (C) 1995, 1996, 1997, 1998, and 1999 WIDE Project.
  21  * All rights reserved.
  22  *
  23  * Redistribution and use in source and binary forms, with or without
  24  * modification, are permitted provided that the following conditions
  25  * are met:
  26  * 1. Redistributions of source code must retain the above copyright
  27  *    notice, this list of conditions and the following disclaimer.
  28  * 2. Redistributions in binary form must reproduce the above copyright
  29  *    notice, this list of conditions and the following disclaimer in the
  30  *    documentation and/or other materials provided with the distribution.
  31  * 3. Neither the name of the project nor the names of its contributors
  32  *    may be used to endorse or promote products derived from this software
  33  *    without specific prior written permission.
  34  *
  35  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
  36  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  37  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  38  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
  39  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  40  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  41  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  42  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  43  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  44  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  45  * SUCH DAMAGE.
  46  */
  47
  48 #include <sys/types.h>
  49 #include <sys/param.h>
  50 #include <sys/socket.h>
  51 #include <net/pfkeyv2.h>
  52 #include <netinet/in.h>
  53 #include <netinet6/ipsec.h>
  54
  55 #include <stdlib.h>
  56 #include <unistd.h>
  57 #include <string.h>
  58 #include <errno.h>
  59 #include <stdio.h>
  60
  61 #include "ipsec_strerror.h"
  62 #include "libpfkey.h"
  63 #include "ipsec_options.h"
  64
  65 #ifndef MDNS_NO_IPSEC
  66
  67 #define CALLOC(size, cast) (cast)calloc(1, (size))
  68
  69 static int findsupportedmap __P((int));
  70 static int setsupportedmap __P((struct sadb_supported *));
  71 static struct sadb_alg *findsupportedalg __P((u_int, u_int));
  72 static int pfkey_send_x1 __P((int, u_int, u_int, u_int, struct sockaddr *,
  73         struct sockaddr *, u_int32_t, u_int32_t, u_int, caddr_t,
  74         u_int, u_int, u_int, u_int, u_int, u_int32_t, u_int32_t,
  75         u_int32_t, u_int32_t, u_int32_t));
  76 static int pfkey_send_x2 __P((int, u_int, u_int, u_int,
  77         struct sockaddr *, struct sockaddr *, u_int32_t));
  78 static int pfkey_send_x3 __P((int, u_int, u_int));
  79 static int pfkey_send_x4 __P((int, u_int, struct sockaddr *, u_int,
  80         struct sockaddr *, u_int, u_int, u_int64_t, u_int64_t,
  81         char *, int, u_int32_t));
  82 static int pfkey_send_x5 __P((int, u_int, u_int32_t));
  83
  84 static caddr_t pfkey_setsadbmsg __P((caddr_t, caddr_t, u_int, u_int,
  85         u_int, u_int32_t, pid_t));
  86 static caddr_t pfkey_setsadbsa __P((caddr_t, caddr_t, u_int32_t, u_int,
  87         u_int, u_int, u_int32_t));
  88 static caddr_t pfkey_setsadbaddr __P((caddr_t, caddr_t, u_int,
  89         struct sockaddr *, u_int, u_int));
  90 static caddr_t pfkey_setsadbkey __P((caddr_t, caddr_t, u_int, caddr_t, u_int));
  91 static caddr_t pfkey_setsadblifetime __P((caddr_t, caddr_t, u_int, u_int32_t,
  92         u_int32_t, u_int32_t, u_int32_t));
  93 static caddr_t pfkey_setsadbxsa2 __P((caddr_t, caddr_t, u_int32_t, u_int32_t));
  94
  95 /*
  96  * make and search supported algorithm structure.
  97  */
  98 static struct sadb_supported *ipsec_supported[] = { NULL, NULL, NULL, };
  99
 100 static int supported_map[] = {
 101         SADB_SATYPE_AH,
 102         SADB_SATYPE_ESP,
 103         SADB_X_SATYPE_IPCOMP,
 104 };
 105
 106 static int
 107 findsupportedmap(satype)
 108         int satype;
 109 {
 110         int i;
 111
 112         for (i = 0; (unsigned int)i < sizeof(supported_map)/sizeof(supported_map[0]); i++)
 113                 if (supported_map[i] == satype)
 114                         return i;
 115         return -1;
 116 }
 117
 118 static struct sadb_alg *
 119 findsupportedalg(satype, alg_id)
 120         u_int satype, alg_id;
 121 {
 122         int algno;
 123         int tlen;
 124         caddr_t p;
 125
 126         /* validity check */
 127         algno = findsupportedmap(satype);
 128         if (algno == -1) {
 129                 __ipsec_errcode = EIPSEC_INVAL_ARGUMENT;
 130                 return NULL;
 131         }
 132         if (ipsec_supported[algno] == NULL) {
 133                 __ipsec_errcode = EIPSEC_DO_GET_SUPP_LIST;
 134                 return NULL;
 135         }
 136
 137         tlen = ipsec_supported[algno]->sadb_supported_len
 138                 - sizeof(struct sadb_supported);
 139         p = (caddr_t)(ipsec_supported[algno] + 1);
 140         while (tlen > 0) {
 141                 if ((unsigned int)tlen < sizeof(struct sadb_alg)) {
 142                         /* invalid format */
 143                         break;
 144                 }
 145                 if (((struct sadb_alg *)p)->sadb_alg_id == alg_id)
 146                         return (struct sadb_alg *)p;
 147
 148                 tlen -= sizeof(struct sadb_alg);
 149                 p += sizeof(struct sadb_alg);
 150         }
 151
 152         __ipsec_errcode = EIPSEC_NOT_SUPPORTED;
 153         return NULL;
 154 }
 155
 156 static int
 157 setsupportedmap(sup)
 158         struct sadb_supported *sup;
 159 {
 160         struct sadb_supported **ipsup;
 161
 162         switch (sup->sadb_supported_exttype) {
 163         case SADB_EXT_SUPPORTED_AUTH:
 164                 ipsup = &ipsec_supported[findsupportedmap(SADB_SATYPE_AH)];
 165                 break;
 166         case SADB_EXT_SUPPORTED_ENCRYPT:
 167                 ipsup = &ipsec_supported[findsupportedmap(SADB_SATYPE_ESP)];
 168                 break;
 169         default:
 170                 __ipsec_errcode = EIPSEC_INVAL_SATYPE;
 171                 return -1;
 172         }
 173
 174         if (*ipsup)
 175                 free(*ipsup);
 176
 177         *ipsup = malloc(sup->sadb_supported_len);
 178         if (!*ipsup) {
 179                 __ipsec_set_strerror(strerror(errno));
 180                 return -1;
 181         }
 182         memcpy(*ipsup, sup, sup->sadb_supported_len);
 183
 184         return 0;
 185 }
 186
 187 /*
 188  * check key length against algorithm specified.
 189  * This function is called with SADB_EXT_SUPPORTED_{AUTH,ENCRYPT} as the
 190  * augument, and only calls to ipsec_check_keylen2();
 191  * keylen is the unit of bit.
 192  * OUT:
 193  *      -1: invalid.
 194  *       0: valid.
 195  */
 196 int
 197 ipsec_check_keylen(supported, alg_id, keylen)
 198         u_int supported;
 199         u_int alg_id;
 200         u_int keylen;
 201 {
 202         int satype;
 203
 204         /* validity check */
 205         switch (supported) {
 206         case SADB_EXT_SUPPORTED_AUTH:
 207                 satype = SADB_SATYPE_AH;
 208                 break;
 209         case SADB_EXT_SUPPORTED_ENCRYPT:
 210                 satype = SADB_SATYPE_ESP;
 211                 break;
 212         default:
 213                 __ipsec_errcode = EIPSEC_INVAL_ARGUMENT;
 214                 return -1;
 215         }
 216
 217         return ipsec_check_keylen2(satype, alg_id, keylen);
 218 }
 219
 220 /*
 221  * check key length against algorithm specified.
 222  * satype is one of satype defined at pfkeyv2.h.
 223  * keylen is the unit of bit.
 224  * OUT:
 225  *      -1: invalid.
 226  *       0: valid.
 227  */
 228 int
 229 ipsec_check_keylen2(satype, alg_id, keylen)
 230         u_int satype;
 231         u_int alg_id;
 232         u_int keylen;
 233 {
 234         struct sadb_alg *alg;
 235
 236         alg = findsupportedalg(satype, alg_id);
 237         if (!alg)
 238                 return -1;
 239
 240         if (keylen < alg->sadb_alg_minbits || keylen > alg->sadb_alg_maxbits) {
 241                 __ipsec_errcode = EIPSEC_INVAL_KEYLEN;
 242                 return -1;
 243         }
 244
 245         __ipsec_errcode = EIPSEC_NO_ERROR;
 246         return 0;
 247 }
 248
 249 /*
 250  * get max/min key length against algorithm specified.
 251  * satype is one of satype defined at pfkeyv2.h.
 252  * keylen is the unit of bit.
 253  * OUT:
 254  *      -1: invalid.
 255  *       0: valid.
 256  */
 257 int
 258 ipsec_get_keylen(supported, alg_id, alg0)
 259         u_int supported, alg_id;
 260         struct sadb_alg *alg0;
 261 {
 262         struct sadb_alg *alg;
 263         u_int satype;
 264
 265         /* validity check */
 266         if (!alg0) {
 267                 __ipsec_errcode = EIPSEC_INVAL_ARGUMENT;
 268                 return -1;
 269         }
 270
 271         switch (supported) {
 272         case SADB_EXT_SUPPORTED_AUTH:
 273                 satype = SADB_SATYPE_AH;
 274                 break;
 275         case SADB_EXT_SUPPORTED_ENCRYPT:
 276                 satype = SADB_SATYPE_ESP;
 277                 break;
 278         default:
 279                 __ipsec_errcode = EIPSEC_INVAL_ARGUMENT;
 280                 return -1;
 281         }
 282
 283         alg = findsupportedalg(satype, alg_id);
 284         if (!alg)
 285                 return -1;
 286
 287         memcpy(alg0, alg, sizeof(*alg0));
 288
 289         __ipsec_errcode = EIPSEC_NO_ERROR;
 290         return 0;
 291 }
 292
 293 /*
 294  * set the rate for SOFT lifetime against HARD one.
 295  * If rate is more than 100 or equal to zero, then set to 100.
 296  */
 297 static u_int soft_lifetime_allocations_rate = PFKEY_SOFT_LIFETIME_RATE;
 298 static u_int soft_lifetime_bytes_rate = PFKEY_SOFT_LIFETIME_RATE;
 299 static u_int soft_lifetime_addtime_rate = PFKEY_SOFT_LIFETIME_RATE;
 300 static u_int soft_lifetime_usetime_rate = PFKEY_SOFT_LIFETIME_RATE;
 301
 302 u_int
 303 pfkey_set_softrate(type, rate)
 304         u_int type, rate;
 305 {
 306         __ipsec_errcode = EIPSEC_NO_ERROR;
 307
 308         if (rate > 100 || rate == 0)
 309                 rate = 100;
 310
 311         switch (type) {
 312         case SADB_X_LIFETIME_ALLOCATIONS:
 313                 soft_lifetime_allocations_rate = rate;
 314                 return 0;
 315         case SADB_X_LIFETIME_BYTES:
 316                 soft_lifetime_bytes_rate = rate;
 317                 return 0;
 318         case SADB_X_LIFETIME_ADDTIME:
 319                 soft_lifetime_addtime_rate = rate;
 320                 return 0;
 321         case SADB_X_LIFETIME_USETIME:
 322                 soft_lifetime_usetime_rate = rate;
 323                 return 0;
 324         }
 325
 326         __ipsec_errcode = EIPSEC_INVAL_ARGUMENT;
 327         return 1;
 328 }
 329
 330 /*
 331  * get current rate for SOFT lifetime against HARD one.
 332  * ATTENTION: ~0 is returned if invalid type was passed.
 333  */
 334 u_int
 335 pfkey_get_softrate(type)
 336         u_int type;
 337 {
 338         switch (type) {
 339         case SADB_X_LIFETIME_ALLOCATIONS:
 340                 return soft_lifetime_allocations_rate;
 341         case SADB_X_LIFETIME_BYTES:
 342                 return soft_lifetime_bytes_rate;
 343         case SADB_X_LIFETIME_ADDTIME:
 344                 return soft_lifetime_addtime_rate;
 345         case SADB_X_LIFETIME_USETIME:
 346                 return soft_lifetime_usetime_rate;
 347         }
 348
 349         return ~0;
 350 }
 351
 352 /*
 353  * sending SADB_GETSPI message to the kernel.
 354  * OUT:
 355  *      positive: success and return length sent.
 356  *      -1      : error occured, and set errno.
 357  */
 358 int
 359 pfkey_send_getspi(so, satype, mode, src, dst, min, max, reqid, seq)
 360         int so;
 361         u_int satype, mode;
 362         struct sockaddr *src, *dst;
 363         u_int32_t min, max, reqid, seq;
 364 {
 365         struct sadb_msg *newmsg;
 366         caddr_t ep;
 367         int len;
 368         int need_spirange = 0;
 369         caddr_t p;
 370         int plen;
 371
 372         /* validity check */
 373         if (src == NULL || dst == NULL) {
 374                 __ipsec_errcode = EIPSEC_INVAL_ARGUMENT;
 375                 return -1;
 376         }
 377         if (src->sa_family != dst->sa_family) {
 378                 __ipsec_errcode = EIPSEC_FAMILY_MISMATCH;
 379                 return -1;
 380         }
 381         if (min > max || (min > 0 && min <= 255)) {
 382                 __ipsec_errcode = EIPSEC_INVAL_SPI;
 383                 return -1;
 384         }
 385         switch (src->sa_family) {
 386         case AF_INET:
 387                 plen = sizeof(struct in_addr) << 3;
 388                 break;
 389         case AF_INET6:
 390                 plen = sizeof(struct in6_addr) << 3;
 391                 break;
 392         default:
 393                 __ipsec_errcode = EIPSEC_INVAL_FAMILY;
 394                 return -1;
 395         }
 396
 397         /* create new sadb_msg to send. */
 398         len = sizeof(struct sadb_msg)
 399                 + sizeof(struct sadb_x_sa2)
 400                 + sizeof(struct sadb_address)
 401                 + PFKEY_ALIGN8(src->sa_len)
 402                 + sizeof(struct sadb_address)
 403                 + PFKEY_ALIGN8(dst->sa_len);
 404
 405         if (min > (u_int32_t)255 && max < (u_int32_t)~0) {
 406                 need_spirange++;
 407                 len += sizeof(struct sadb_spirange);
 408         }
 409
 410         if ((newmsg = CALLOC(len, struct sadb_msg *)) == NULL) {
 411                 __ipsec_set_strerror(strerror(errno));
 412                 return -1;
 413         }
 414         ep = ((caddr_t)newmsg) + len;
 415
 416         p = pfkey_setsadbmsg((caddr_t)newmsg, ep, SADB_GETSPI,
 417             len, satype, seq, getpid());
 418         if (!p) {
 419                 free(newmsg);
 420                 return -1;
 421         }
 422
 423         p = pfkey_setsadbxsa2(p, ep, mode, reqid);
 424         if (!p) {
 425                 free(newmsg);
 426                 return -1;
 427         }
 428
 429         /* set sadb_address for source */
 430         p = pfkey_setsadbaddr(p, ep, SADB_EXT_ADDRESS_SRC, src, plen,
 431             IPSEC_ULPROTO_ANY);
 432         if (!p) {
 433                 free(newmsg);
 434                 return -1;
 435         }
 436
 437         /* set sadb_address for destination */
 438         p = pfkey_setsadbaddr(p, ep, SADB_EXT_ADDRESS_DST, dst, plen,
 439             IPSEC_ULPROTO_ANY);
 440         if (!p) {
 441                 free(newmsg);
 442                 return -1;
 443         }
 444
 445         /* proccessing spi range */
 446         if (need_spirange) {
 447                 struct sadb_spirange spirange;
 448
 449                 if (p + sizeof(spirange) > ep) {
 450                         free(newmsg);
 451                         return -1;
 452                 }
 453
 454                 memset(&spirange, 0, sizeof(spirange));
 455                 spirange.sadb_spirange_len = PFKEY_UNIT64(sizeof(spirange));
 456                 spirange.sadb_spirange_exttype = SADB_EXT_SPIRANGE;
 457                 spirange.sadb_spirange_min = min;
 458                 spirange.sadb_spirange_max = max;
 459
 460                 memcpy(p, &spirange, sizeof(spirange));
 461
 462                 p += sizeof(spirange);
 463         }
 464         if (p != ep) {
 465                 free(newmsg);
 466                 return -1;
 467         }
 468
 469         /* send message */
 470         len = pfkey_send(so, newmsg, len);
 471         free(newmsg);
 472
 473         if (len < 0)
 474                 return -1;
 475
 476         __ipsec_errcode = EIPSEC_NO_ERROR;
 477         return len;
 478 }
 479
 480 /*
 481  * sending SADB_UPDATE message to the kernel.
 482  * The length of key material is a_keylen + e_keylen.
 483  * OUT:
 484  *      positive: success and return length sent.
 485  *      -1      : error occured, and set errno.
 486  */
 487 int
 488 pfkey_send_update(so, satype, mode, src, dst, spi, reqid, wsize,
 489                 keymat, e_type, e_keylen, a_type, a_keylen, flags,
 490                 l_alloc, l_bytes, l_addtime, l_usetime, seq)
 491         int so;
 492         u_int satype, mode, wsize;
 493         struct sockaddr *src, *dst;
 494         u_int32_t spi, reqid;
 495         caddr_t keymat;
 496         u_int e_type, e_keylen, a_type, a_keylen, flags;
 497         u_int32_t l_alloc;
 498         u_int64_t l_bytes, l_addtime, l_usetime;
 499         u_int32_t seq;
 500 {
 501         int len;
 502         if ((len = pfkey_send_x1(so, SADB_UPDATE, satype, mode, src, dst, spi,
 503                         reqid, wsize,
 504                         keymat, e_type, e_keylen, a_type, a_keylen, flags,
 505                         l_alloc, l_bytes, l_addtime, l_usetime, seq)) < 0)
 506                 return -1;
 507
 508         return len;
 509 }
 510
 511 /*
 512  * sending SADB_ADD message to the kernel.
 513  * The length of key material is a_keylen + e_keylen.
 514  * OUT:
 515  *      positive: success and return length sent.
 516  *      -1      : error occured, and set errno.
 517  */
 518 int
 519 pfkey_send_add(so, satype, mode, src, dst, spi, reqid, wsize,
 520                 keymat, e_type, e_keylen, a_type, a_keylen, flags,
 521                 l_alloc, l_bytes, l_addtime, l_usetime, seq)
 522         int so;
 523         u_int satype, mode, wsize;
 524         struct sockaddr *src, *dst;
 525         u_int32_t spi, reqid;
 526         caddr_t keymat;
 527         u_int e_type, e_keylen, a_type, a_keylen, flags;
 528         u_int32_t l_alloc;
 529         u_int64_t l_bytes, l_addtime, l_usetime;
 530         u_int32_t seq;
 531 {
 532         int len;
 533         if ((len = pfkey_send_x1(so, SADB_ADD, satype, mode, src, dst, spi,
 534                         reqid, wsize,
 535                         keymat, e_type, e_keylen, a_type, a_keylen, flags,
 536                         l_alloc, l_bytes, l_addtime, l_usetime, seq)) < 0)
 537                 return -1;
 538
 539         return len;
 540 }
 541
 542 /*
 543  * sending SADB_DELETE message to the kernel.
 544  * OUT:
 545  *      positive: success and return length sent.
 546  *      -1      : error occured, and set errno.
 547  */
 548 int
 549 pfkey_send_delete(so, satype, mode, src, dst, spi)
 550         int so;
 551         u_int satype, mode;
 552         struct sockaddr *src, *dst;
 553         u_int32_t spi;
 554 {
 555         int len;
 556         if ((len = pfkey_send_x2(so, SADB_DELETE, satype, mode, src, dst, spi)) < 0)
 557                 return -1;
 558
 559         return len;
 560 }
 561
 562 /*
 563  * sending SADB_DELETE without spi to the kernel.  This is
 564  * the "delete all" request (an extension also present in
 565  * Solaris).
 566  *
 567  * OUT:
 568  *      positive: success and return length sent
 569  *      -1      : error occured, and set errno
 570  */
 571 int
 572 pfkey_send_delete_all(so, satype, mode, src, dst)
 573         int so;
 574         u_int satype, mode;
 575         struct sockaddr *src, *dst;
 576 {
 577         struct sadb_msg *newmsg;
 578         int len;
 579         caddr_t p;
 580         int plen;
 581         caddr_t ep;
 582
 583         (void)mode;
 584
 585         /* validity check */
 586         if (src == NULL || dst == NULL) {
 587                 __ipsec_errcode = EIPSEC_INVAL_ARGUMENT;
 588                 return -1;
 589         }
 590         if (src->sa_family != dst->sa_family) {
 591                 __ipsec_errcode = EIPSEC_FAMILY_MISMATCH;
 592                 return -1;
 593         }
 594         switch (src->sa_family) {
 595         case AF_INET:
 596                 plen = sizeof(struct in_addr) << 3;
 597                 break;
 598         case AF_INET6:
 599                 plen = sizeof(struct in6_addr) << 3;
 600                 break;
 601         default:
 602                 __ipsec_errcode = EIPSEC_INVAL_FAMILY;
 603                 return -1;
 604         }
 605
 606         /* create new sadb_msg to reply. */
 607         len = sizeof(struct sadb_msg)
 608                 + sizeof(struct sadb_address)
 609                 + PFKEY_ALIGN8(src->sa_len)
 610                 + sizeof(struct sadb_address)
 611                 + PFKEY_ALIGN8(dst->sa_len);
 612
 613         if ((newmsg = CALLOC(len, struct sadb_msg *)) == NULL) {
 614                 __ipsec_set_strerror(strerror(errno));
 615                 return -1;
 616         }
 617         ep = ((caddr_t)newmsg) + len;
 618
 619         p = pfkey_setsadbmsg((caddr_t)newmsg, ep, SADB_DELETE, len, satype, 0,
 620             getpid());
 621         if (!p) {
 622                 free(newmsg);
 623                 return -1;
 624         }
 625         p = pfkey_setsadbaddr(p, ep, SADB_EXT_ADDRESS_SRC, src, plen,
 626             IPSEC_ULPROTO_ANY);
 627         if (!p) {
 628                 free(newmsg);
 629                 return -1;
 630         }
 631         p = pfkey_setsadbaddr(p, ep, SADB_EXT_ADDRESS_DST, dst, plen,
 632             IPSEC_ULPROTO_ANY);
 633         if (!p || p != ep) {
 634                 free(newmsg);
 635                 return -1;
 636         }
 637
 638         /* send message */
 639         len = pfkey_send(so, newmsg, len);
 640         free(newmsg);
 641
 642         if (len < 0)
 643                 return -1;
 644
 645         __ipsec_errcode = EIPSEC_NO_ERROR;
 646         return len;
 647 }
 648
 649 /*
 650  * sending SADB_GET message to the kernel.
 651  * OUT:
 652  *      positive: success and return length sent.
 653  *      -1      : error occured, and set errno.
 654  */
 655 int
 656 pfkey_send_get(so, satype, mode, src, dst, spi)
 657         int so;
 658         u_int satype, mode;
 659         struct sockaddr *src, *dst;
 660         u_int32_t spi;
 661 {
 662         int len;
 663         if ((len = pfkey_send_x2(so, SADB_GET, satype, mode, src, dst, spi)) < 0)
 664                 return -1;
 665
 666         return len;
 667 }
 668
 669 /*
 670  * sending SADB_REGISTER message to the kernel.
 671  * OUT:
 672  *      positive: success and return length sent.
 673  *      -1      : error occured, and set errno.
 674  */
 675 int
 676 pfkey_send_register(so, satype)
 677         int so;
 678         u_int satype;
 679 {
 680         int len, algno;
 681
 682         if (satype == PF_UNSPEC) {
 683                 for (algno = 0;
 684                      (unsigned int)algno < sizeof(supported_map)/sizeof(supported_map[0]);
 685                      algno++) {
 686                         if (ipsec_supported[algno]) {
 687                                 free(ipsec_supported[algno]);
 688                                 ipsec_supported[algno] = NULL;
 689                         }
 690                 }
 691         } else {
 692                 algno = findsupportedmap(satype);
 693                 if (algno == -1) {
 694                         __ipsec_errcode = EIPSEC_INVAL_ARGUMENT;
 695                         return -1;
 696                 }
 697
 698                 if (ipsec_supported[algno]) {
 699                         free(ipsec_supported[algno]);
 700                         ipsec_supported[algno] = NULL;
 701                 }
 702         }
 703
 704         if ((len = pfkey_send_x3(so, SADB_REGISTER, satype)) < 0)
 705                 return -1;
 706
 707         return len;
 708 }
 709
 710 /*
 711  * receiving SADB_REGISTER message from the kernel, and copy buffer for
 712  * sadb_supported returned into ipsec_supported.
 713  * OUT:
 714  *       0: success and return length sent.
 715  *      -1: error occured, and set errno.
 716  */
 717 int
 718 pfkey_recv_register(so)
 719         int so;
 720 {
 721         pid_t pid = getpid();
 722         struct sadb_msg *newmsg;
 723         int error = -1;
 724
 725         /* receive message */
 726         do {
 727                 if ((newmsg = pfkey_recv(so)) == NULL)
 728                         return -1;
 729         } while (newmsg->sadb_msg_type != SADB_REGISTER
 730             || (pid_t)newmsg->sadb_msg_pid != pid);
 731
 732         /* check and fix */
 733         newmsg->sadb_msg_len = PFKEY_UNUNIT64(newmsg->sadb_msg_len);
 734
 735         error = pfkey_set_supported(newmsg, newmsg->sadb_msg_len);
 736         free(newmsg);
 737
 738         if (error == 0)
 739                 __ipsec_errcode = EIPSEC_NO_ERROR;
 740
 741         return error;
 742 }
 743
 744 /*
 745  * receiving SADB_REGISTER message from the kernel, and copy buffer for
 746  * sadb_supported returned into ipsec_supported.
 747  * NOTE: sadb_msg_len must be host order.
 748  * IN:
 749  *      tlen: msg length, it's to makeing sure.
 750  * OUT:
 751  *       0: success and return length sent.
 752  *      -1: error occured, and set errno.
 753  */
 754 int
 755 pfkey_set_supported(msg, tlen)
 756         struct sadb_msg *msg;
 757         int tlen;
 758 {
 759         struct sadb_supported *sup;
 760         caddr_t p;
 761         caddr_t ep;
 762
 763         /* validity */
 764         if (msg->sadb_msg_len != tlen) {
 765                 __ipsec_errcode = EIPSEC_INVAL_ARGUMENT;
 766                 return -1;
 767         }
 768
 769         p = (caddr_t)msg;
 770         ep = p + tlen;
 771
 772         p += sizeof(struct sadb_msg);
 773
 774         while (p < ep) {
 775                 sup = (struct sadb_supported *)p;
 776                 if (ep < p + sizeof(*sup) ||
 777                     (size_t)PFKEY_EXTLEN(sup) < sizeof(*sup) ||
 778                     ep < p + sup->sadb_supported_len) {
 779                         /* invalid format */
 780                         break;
 781                 }
 782
 783                 switch (sup->sadb_supported_exttype) {
 784                 case SADB_EXT_SUPPORTED_AUTH:
 785                 case SADB_EXT_SUPPORTED_ENCRYPT:
 786                         break;
 787                 default:
 788                         __ipsec_errcode = EIPSEC_INVAL_SATYPE;
 789                         return -1;
 790                 }
 791
 792                 /* fixed length */
 793                 sup->sadb_supported_len = PFKEY_EXTLEN(sup);
 794
 795                 /* set supported map */
 796                 if (setsupportedmap(sup) != 0)
 797                         return -1;
 798
 799                 p += sup->sadb_supported_len;
 800         }
 801
 802         if (p != ep) {
 803                 __ipsec_errcode = EIPSEC_INVAL_SATYPE;
 804                 return -1;
 805         }
 806
 807         __ipsec_errcode = EIPSEC_NO_ERROR;
 808
 809         return 0;
 810 }
 811
 812 /*
 813  * sending SADB_FLUSH message to the kernel.
 814  * OUT:
 815  *      positive: success and return length sent.
 816  *      -1      : error occured, and set errno.
 817  */
 818 int
 819 pfkey_send_flush(so, satype)
 820         int so;
 821         u_int satype;
 822 {
 823         int len;
 824
 825         if ((len = pfkey_send_x3(so, SADB_FLUSH, satype)) < 0)
 826                 return -1;
 827
 828         return len;
 829 }
 830
 831 /*
 832  * sending SADB_DUMP message to the kernel.
 833  * OUT:
 834  *      positive: success and return length sent.
 835  *      -1      : error occured, and set errno.
 836  */
 837 int
 838 pfkey_send_dump(so, satype)
 839         int so;
 840         u_int satype;
 841 {
 842         int len;
 843
 844         if ((len = pfkey_send_x3(so, SADB_DUMP, satype)) < 0)
 845                 return -1;
 846
 847         return len;
 848 }
 849
 850 /*
 851  * sending SADB_X_PROMISC message to the kernel.
 852  * NOTE that this function handles promisc mode toggle only.
 853  * IN:
 854  *      flag:   set promisc off if zero, set promisc on if non-zero.
 855  * OUT:
 856  *      positive: success and return length sent.
 857  *      -1      : error occured, and set errno.
 858  *      0     : error occured, and set errno.
 859  *      others: a pointer to new allocated buffer in which supported
 860  *              algorithms is.
 861  */
 862 int
 863 pfkey_send_promisc_toggle(so, flag)
 864         int so;
 865         int flag;
 866 {
 867         int len;
 868
 869         if ((len = pfkey_send_x3(so, SADB_X_PROMISC, (flag ? 1 : 0))) < 0)
 870                 return -1;
 871
 872         return len;
 873 }
 874
 875 /*
 876  * sending SADB_X_SPDADD message to the kernel.
 877  * OUT:
 878  *      positive: success and return length sent.
 879  *      -1      : error occured, and set errno.
 880  */
 881 int
 882 pfkey_send_spdadd(so, src, prefs, dst, prefd, proto, policy, policylen, seq)
 883         int so;
 884         struct sockaddr *src, *dst;
 885         u_int prefs, prefd, proto;
 886         caddr_t policy;
 887         int policylen;
 888         u_int32_t seq;
 889 {
 890         int len;
 891
 892         if ((len = pfkey_send_x4(so, SADB_X_SPDADD,
 893                                 src, prefs, dst, prefd, proto,
 894                                 0, 0,
 895                                 policy, policylen, seq)) < 0)
 896                 return -1;
 897
 898         return len;
 899 }
 900
 901 /*
 902  * sending SADB_X_SPDADD message to the kernel.
 903  * OUT:
 904  *      positive: success and return length sent.
 905  *      -1      : error occured, and set errno.
 906  */
 907 int
 908 pfkey_send_spdadd2(so, src, prefs, dst, prefd, proto, ltime, vtime,
 909                 policy, policylen, seq)
 910         int so;
 911         struct sockaddr *src, *dst;
 912         u_int prefs, prefd, proto;
 913         u_int64_t ltime, vtime;
 914         caddr_t policy;
 915         int policylen;
 916         u_int32_t seq;
 917 {
 918         int len;
 919
 920         if ((len = pfkey_send_x4(so, SADB_X_SPDADD,
 921                                 src, prefs, dst, prefd, proto,
 922                                 ltime, vtime,
 923                                 policy, policylen, seq)) < 0)
 924                 return -1;
 925
 926         return len;
 927 }
 928
 929 /*
 930  * sending SADB_X_SPDUPDATE message to the kernel.
 931  * OUT:
 932  *      positive: success and return length sent.
 933  *      -1      : error occured, and set errno.
 934  */
 935 int
 936 pfkey_send_spdupdate(so, src, prefs, dst, prefd, proto, policy, policylen, seq)
 937         int so;
 938         struct sockaddr *src, *dst;
 939         u_int prefs, prefd, proto;
 940         caddr_t policy;
 941         int policylen;
 942         u_int32_t seq;
 943 {
 944         int len;
 945
 946         if ((len = pfkey_send_x4(so, SADB_X_SPDUPDATE,
 947                                 src, prefs, dst, prefd, proto,
 948                                 0, 0,
 949                                 policy, policylen, seq)) < 0)
 950                 return -1;
 951
 952         return len;
 953 }
 954
 955 /*
 956  * sending SADB_X_SPDUPDATE message to the kernel.
 957  * OUT:
 958  *      positive: success and return length sent.
 959  *      -1      : error occured, and set errno.
 960  */
 961 int
 962 pfkey_send_spdupdate2(so, src, prefs, dst, prefd, proto, ltime, vtime,
 963                 policy, policylen, seq)
 964         int so;
 965         struct sockaddr *src, *dst;
 966         u_int prefs, prefd, proto;
 967         u_int64_t ltime, vtime;
 968         caddr_t policy;
 969         int policylen;
 970         u_int32_t seq;
 971 {
 972         int len;
 973
 974         if ((len = pfkey_send_x4(so, SADB_X_SPDUPDATE,
 975                                 src, prefs, dst, prefd, proto,
 976                                 ltime, vtime,
 977                                 policy, policylen, seq)) < 0)
 978                 return -1;
 979
 980         return len;
 981 }
 982
 983 /*
 984  * sending SADB_X_SPDDELETE message to the kernel.
 985  * OUT:
 986  *      positive: success and return length sent.
 987  *      -1      : error occured, and set errno.
 988  */
 989 int
 990 pfkey_send_spddelete(so, src, prefs, dst, prefd, proto, policy, policylen, seq)
 991         int so;
 992         struct sockaddr *src, *dst;
 993         u_int prefs, prefd, proto;
 994         caddr_t policy;
 995         int policylen;
 996         u_int32_t seq;
 997 {
 998         int len;
 999
1000         if (policylen != sizeof(struct sadb_x_policy)) {
1001                 __ipsec_errcode = EIPSEC_INVAL_ARGUMENT;
1002                 return -1;
1003         }
1004
1005         if ((len = pfkey_send_x4(so, SADB_X_SPDDELETE,
1006                                 src, prefs, dst, prefd, proto,
1007                                 0, 0,
1008                                 policy, policylen, seq)) < 0)
1009                 return -1;
1010
1011         return len;
1012 }
1013
1014 /*
1015  * sending SADB_X_SPDDELETE message to the kernel.
1016  * OUT:
1017  *      positive: success and return length sent.
1018  *      -1      : error occured, and set errno.
1019  */
1020 int
1021 pfkey_send_spddelete2(so, spid)
1022         int so;
1023         u_int32_t spid;
1024 {
1025         int len;
1026
1027         if ((len = pfkey_send_x5(so, SADB_X_SPDDELETE2, spid)) < 0)
1028                 return -1;
1029
1030         return len;
1031 }
1032
1033 /*
1034  * sending SADB_X_SPDGET message to the kernel.
1035  * OUT:
1036  *      positive: success and return length sent.
1037  *      -1      : error occured, and set errno.
1038  */
1039 int
1040 pfkey_send_spdget(so, spid)
1041         int so;
1042         u_int32_t spid;
1043 {
1044         int len;
1045
1046         if ((len = pfkey_send_x5(so, SADB_X_SPDGET, spid)) < 0)
1047                 return -1;
1048
1049         return len;
1050 }
1051
1052 /*
1053  * sending SADB_X_SPDSETIDX message to the kernel.
1054  * OUT:
1055  *      positive: success and return length sent.
1056  *      -1      : error occured, and set errno.
1057  */
1058 int
1059 pfkey_send_spdsetidx(so, src, prefs, dst, prefd, proto, policy, policylen, seq)
1060         int so;
1061         struct sockaddr *src, *dst;
1062         u_int prefs, prefd, proto;
1063         caddr_t policy;
1064         int policylen;
1065         u_int32_t seq;
1066 {
1067         int len;
1068
1069         if (policylen != sizeof(struct sadb_x_policy)) {
1070                 __ipsec_errcode = EIPSEC_INVAL_ARGUMENT;
1071                 return -1;
1072         }
1073
1074         if ((len = pfkey_send_x4(so, SADB_X_SPDSETIDX,
1075                                 src, prefs, dst, prefd, proto,
1076                                 0, 0,
1077                                 policy, policylen, seq)) < 0)
1078                 return -1;
1079
1080         return len;
1081 }
1082
1083 /*
1084  * sending SADB_SPDFLUSH message to the kernel.
1085  * OUT:
1086  *      positive: success and return length sent.
1087  *      -1      : error occured, and set errno.
1088  */
1089 int
1090 pfkey_send_spdflush(so)
1091         int so;
1092 {
1093         int len;
1094
1095         if ((len = pfkey_send_x3(so, SADB_X_SPDFLUSH, SADB_SATYPE_UNSPEC)) < 0)
1096                 return -1;
1097
1098         return len;
1099 }
1100
1101 /*
1102  * sending SADB_SPDDUMP message to the kernel.
1103  * OUT:
1104  *      positive: success and return length sent.
1105  *      -1      : error occured, and set errno.
1106  */
1107 int
1108 pfkey_send_spddump(so)
1109         int so;
1110 {
1111         int len;
1112
1113         if ((len = pfkey_send_x3(so, SADB_X_SPDDUMP, SADB_SATYPE_UNSPEC)) < 0)
1114                 return -1;
1115
1116         return len;
1117 }
1118
1119 /* sending SADB_ADD or SADB_UPDATE message to the kernel */
1120 static int
1121 pfkey_send_x1(so, type, satype, mode, src, dst, spi, reqid, wsize,
1122                 keymat, e_type, e_keylen, a_type, a_keylen, flags,
1123                 l_alloc, l_bytes, l_addtime, l_usetime, seq)
1124         int so;
1125         u_int type, satype, mode;
1126         struct sockaddr *src, *dst;
1127         u_int32_t spi, reqid;
1128         u_int wsize;
1129         caddr_t keymat;
1130         u_int e_type, e_keylen, a_type, a_keylen, flags;
1131         u_int32_t l_alloc, l_bytes, l_addtime, l_usetime, seq;
1132 {
1133         struct sadb_msg *newmsg;
1134         int len;
1135         caddr_t p;
1136         int plen;
1137         caddr_t ep;
1138
1139         /* validity check */
1140         if (src == NULL || dst == NULL) {
1141                 __ipsec_errcode = EIPSEC_INVAL_ARGUMENT;
1142                 return -1;
1143         }
1144         if (src->sa_family != dst->sa_family) {
1145                 __ipsec_errcode = EIPSEC_FAMILY_MISMATCH;
1146                 return -1;
1147         }
1148         switch (src->sa_family) {
1149         case AF_INET:
1150                 plen = sizeof(struct in_addr) << 3;
1151                 break;
1152         case AF_INET6:
1153                 plen = sizeof(struct in6_addr) << 3;
1154                 break;
1155         default:
1156                 __ipsec_errcode = EIPSEC_INVAL_FAMILY;
1157                 return -1;
1158         }
1159
1160         switch (satype) {
1161         case SADB_SATYPE_ESP:
1162                 if (e_type == SADB_EALG_NONE) {
1163                         __ipsec_errcode = EIPSEC_NO_ALGS;
1164                         return -1;
1165                 }
1166                 break;
1167         case SADB_SATYPE_AH:
1168                 if (e_type != SADB_EALG_NONE) {
1169                         __ipsec_errcode = EIPSEC_INVAL_ALGS;
1170                         return -1;
1171                 }
1172                 if (a_type == SADB_AALG_NONE) {
1173                         __ipsec_errcode = EIPSEC_NO_ALGS;
1174                         return -1;
1175                 }
1176                 break;
1177         case SADB_X_SATYPE_IPCOMP:
1178                 if (e_type == SADB_X_CALG_NONE) {
1179                         __ipsec_errcode = EIPSEC_INVAL_ALGS;
1180                         return -1;
1181                 }
1182                 if (a_type != SADB_AALG_NONE) {
1183                         __ipsec_errcode = EIPSEC_NO_ALGS;
1184                         return -1;
1185                 }
1186                 break;
1187         default:
1188                 __ipsec_errcode = EIPSEC_INVAL_SATYPE;
1189                 return -1;
1190         }
1191
1192         /* create new sadb_msg to reply. */
1193         len = sizeof(struct sadb_msg)
1194                 + sizeof(struct sadb_sa)
1195                 + sizeof(struct sadb_x_sa2)
1196                 + sizeof(struct sadb_address)
1197                 + PFKEY_ALIGN8(src->sa_len)
1198                 + sizeof(struct sadb_address)
1199                 + PFKEY_ALIGN8(dst->sa_len)
1200                 + sizeof(struct sadb_lifetime)
1201                 + sizeof(struct sadb_lifetime);
1202
1203         if (e_type != SADB_EALG_NONE)
1204                 len += (sizeof(struct sadb_key) + PFKEY_ALIGN8(e_keylen));
1205         if (a_type != SADB_AALG_NONE)
1206                 len += (sizeof(struct sadb_key) + PFKEY_ALIGN8(a_keylen));
1207
1208         if ((newmsg = CALLOC(len, struct sadb_msg *)) == NULL) {
1209                 __ipsec_set_strerror(strerror(errno));
1210                 return -1;
1211         }
1212         ep = ((caddr_t)newmsg) + len;
1213
1214         p = pfkey_setsadbmsg((caddr_t)newmsg, ep, type, len,
1215                              satype, seq, getpid());
1216         if (!p) {
1217                 free(newmsg);
1218                 return -1;
1219         }
1220         p = pfkey_setsadbsa(p, ep, spi, wsize, a_type, e_type, flags);
1221         if (!p) {
1222                 free(newmsg);
1223                 return -1;
1224         }
1225         p = pfkey_setsadbxsa2(p, ep, mode, reqid);
1226         if (!p) {
1227                 free(newmsg);
1228                 return -1;
1229         }
1230         p = pfkey_setsadbaddr(p, ep, SADB_EXT_ADDRESS_SRC, src, plen,
1231             IPSEC_ULPROTO_ANY);
1232         if (!p) {
1233                 free(newmsg);
1234                 return -1;
1235         }
1236         p = pfkey_setsadbaddr(p, ep, SADB_EXT_ADDRESS_DST, dst, plen,
1237             IPSEC_ULPROTO_ANY);
1238         if (!p) {
1239                 free(newmsg);
1240                 return -1;
1241         }
1242
1243         if (e_type != SADB_EALG_NONE) {
1244                 p = pfkey_setsadbkey(p, ep, SADB_EXT_KEY_ENCRYPT,
1245                                    keymat, e_keylen);
1246                 if (!p) {
1247                         free(newmsg);
1248                         return -1;
1249                 }
1250         }
1251         if (a_type != SADB_AALG_NONE) {
1252                 p = pfkey_setsadbkey(p, ep, SADB_EXT_KEY_AUTH,
1253                                    keymat + e_keylen, a_keylen);
1254                 if (!p) {
1255                         free(newmsg);
1256                         return -1;
1257                 }
1258         }
1259
1260         /* set sadb_lifetime for destination */
1261         p = pfkey_setsadblifetime(p, ep, SADB_EXT_LIFETIME_HARD,
1262                         l_alloc, l_bytes, l_addtime, l_usetime);
1263         if (!p) {
1264                 free(newmsg);
1265                 return -1;
1266         }
1267         p = pfkey_setsadblifetime(p, ep, SADB_EXT_LIFETIME_SOFT,
1268                         l_alloc, l_bytes, l_addtime, l_usetime);
1269         if (!p || p != ep) {
1270                 free(newmsg);
1271                 return -1;
1272         }
1273
1274         /* send message */
1275         len = pfkey_send(so, newmsg, len);
1276         free(newmsg);
1277
1278         if (len < 0)
1279                 return -1;
1280
1281         __ipsec_errcode = EIPSEC_NO_ERROR;
1282         return len;
1283 }
1284
1285 /* sending SADB_DELETE or SADB_GET message to the kernel */
1286 static int
1287 pfkey_send_x2(so, type, satype, mode, src, dst, spi)
1288         int so;
1289         u_int type, satype, mode;
1290         struct sockaddr *src, *dst;
1291         u_int32_t spi;
1292 {
1293         struct sadb_msg *newmsg;
1294         int len;
1295         caddr_t p;
1296         int plen;
1297         caddr_t ep;
1298
1299         (void)mode;
1300
1301         /* validity check */
1302         if (src == NULL || dst == NULL) {
1303                 __ipsec_errcode = EIPSEC_INVAL_ARGUMENT;
1304                 return -1;
1305         }
1306         if (src->sa_family != dst->sa_family) {
1307                 __ipsec_errcode = EIPSEC_FAMILY_MISMATCH;
1308                 return -1;
1309         }
1310         switch (src->sa_family) {
1311         case AF_INET:
1312                 plen = sizeof(struct in_addr) << 3;
1313                 break;
1314         case AF_INET6:
1315                 plen = sizeof(struct in6_addr) << 3;
1316                 break;
1317         default:
1318                 __ipsec_errcode = EIPSEC_INVAL_FAMILY;
1319                 return -1;
1320         }
1321
1322         /* create new sadb_msg to reply. */
1323         len = sizeof(struct sadb_msg)
1324                 + sizeof(struct sadb_sa)
1325                 + sizeof(struct sadb_address)
1326                 + PFKEY_ALIGN8(src->sa_len)
1327                 + sizeof(struct sadb_address)
1328                 + PFKEY_ALIGN8(dst->sa_len);
1329
1330         if ((newmsg = CALLOC(len, struct sadb_msg *)) == NULL) {
1331                 __ipsec_set_strerror(strerror(errno));
1332                 return -1;
1333         }
1334         ep = ((caddr_t)newmsg) + len;
1335
1336         p = pfkey_setsadbmsg((caddr_t)newmsg, ep, type, len, satype, 0,
1337             getpid());
1338         if (!p) {
1339                 free(newmsg);
1340                 return -1;
1341         }
1342         p = pfkey_setsadbsa(p, ep, spi, 0, 0, 0, 0);
1343         if (!p) {
1344                 free(newmsg);
1345                 return -1;
1346         }
1347         p = pfkey_setsadbaddr(p, ep, SADB_EXT_ADDRESS_SRC, src, plen,
1348             IPSEC_ULPROTO_ANY);
1349         if (!p) {
1350                 free(newmsg);
1351                 return -1;
1352         }
1353         p = pfkey_setsadbaddr(p, ep, SADB_EXT_ADDRESS_DST, dst, plen,
1354             IPSEC_ULPROTO_ANY);
1355         if (!p || p != ep) {
1356                 free(newmsg);
1357                 return -1;
1358         }
1359
1360         /* send message */
1361         len = pfkey_send(so, newmsg, len);
1362         free(newmsg);
1363
1364         if (len < 0)
1365                 return -1;
1366
1367         __ipsec_errcode = EIPSEC_NO_ERROR;
1368         return len;
1369 }
1370
1371 /*
1372  * sending SADB_REGISTER, SADB_FLUSH, SADB_DUMP or SADB_X_PROMISC message
1373  * to the kernel
1374  */
1375 static int
1376 pfkey_send_x3(so, type, satype)
1377         int so;
1378         u_int type, satype;
1379 {
1380         struct sadb_msg *newmsg;
1381         int len;
1382         caddr_t p;
1383         caddr_t ep;
1384
1385         /* validity check */
1386         switch (type) {
1387         case SADB_X_PROMISC:
1388                 if (satype != 0 && satype != 1) {
1389                         __ipsec_errcode = EIPSEC_INVAL_SATYPE;
1390                         return -1;
1391                 }
1392                 break;
1393         default:
1394                 switch (satype) {
1395                 case SADB_SATYPE_UNSPEC:
1396                 case SADB_SATYPE_AH:
1397                 case SADB_SATYPE_ESP:
1398                 case SADB_X_SATYPE_IPCOMP:
1399                         break;
1400                 default:
1401                         __ipsec_errcode = EIPSEC_INVAL_SATYPE;
1402                         return -1;
1403                 }
1404         }
1405
1406         /* create new sadb_msg to send. */
1407         len = sizeof(struct sadb_msg);
1408
1409         if ((newmsg = CALLOC(len, struct sadb_msg *)) == NULL) {
1410                 __ipsec_set_strerror(strerror(errno));
1411                 return -1;
1412         }
1413         ep = ((caddr_t)newmsg) + len;
1414
1415         p = pfkey_setsadbmsg((caddr_t)newmsg, ep, type, len, satype, 0,
1416             getpid());
1417         if (!p || p != ep) {
1418                 free(newmsg);
1419                 return -1;
1420         }
1421
1422         /* send message */
1423         len = pfkey_send(so, newmsg, len);
1424         free(newmsg);
1425
1426         if (len < 0)
1427                 return -1;
1428
1429         __ipsec_errcode = EIPSEC_NO_ERROR;
1430         return len;
1431 }
1432
1433 /* sending SADB_X_SPDADD message to the kernel */
1434 static int
1435 pfkey_send_x4(so, type, src, prefs, dst, prefd, proto,
1436                 ltime, vtime, policy, policylen, seq)
1437         int so;
1438         struct sockaddr *src, *dst;
1439         u_int type, prefs, prefd, proto;
1440         u_int64_t ltime, vtime;
1441         char *policy;
1442         int policylen;
1443         u_int32_t seq;
1444 {
1445         struct sadb_msg *newmsg;
1446         int len;
1447         caddr_t p;
1448         int plen;
1449         caddr_t ep;
1450
1451         /* validity check */
1452         if (src == NULL || dst == NULL) {
1453                 __ipsec_errcode = EIPSEC_INVAL_ARGUMENT;
1454                 return -1;
1455         }
1456         if (src->sa_family != dst->sa_family) {
1457                 __ipsec_errcode = EIPSEC_FAMILY_MISMATCH;
1458                 return -1;
1459         }
1460
1461         switch (src->sa_family) {
1462         case AF_INET:
1463                 plen = sizeof(struct in_addr) << 3;
1464                 break;
1465         case AF_INET6:
1466                 plen = sizeof(struct in6_addr) << 3;
1467                 break;
1468         default:
1469                 __ipsec_errcode = EIPSEC_INVAL_FAMILY;
1470                 return -1;
1471         }
1472         if (prefs > (u_int)plen || prefd > (u_int)plen) {
1473                 __ipsec_errcode = EIPSEC_INVAL_PREFIXLEN;
1474                 return -1;
1475         }
1476
1477         /* create new sadb_msg to reply. */
1478         len = sizeof(struct sadb_msg)
1479                 + sizeof(struct sadb_address)
1480                 + PFKEY_ALIGN8(src->sa_len)
1481                 + sizeof(struct sadb_address)
1482                 + PFKEY_ALIGN8(src->sa_len)
1483                 + sizeof(struct sadb_lifetime)
1484                 + policylen;
1485
1486         if ((newmsg = CALLOC(len, struct sadb_msg *)) == NULL) {
1487                 __ipsec_set_strerror(strerror(errno));
1488                 return -1;
1489         }
1490         ep = ((caddr_t)newmsg) + len;
1491
1492         p = pfkey_setsadbmsg((caddr_t)newmsg, ep, type, len,
1493             SADB_SATYPE_UNSPEC, seq, getpid());
1494         if (!p) {
1495                 free(newmsg);
1496                 return -1;
1497         }
1498         p = pfkey_setsadbaddr(p, ep, SADB_EXT_ADDRESS_SRC, src, prefs, proto);
1499         if (!p) {
1500                 free(newmsg);
1501                 return -1;
1502         }
1503         p = pfkey_setsadbaddr(p, ep, SADB_EXT_ADDRESS_DST, dst, prefd, proto);
1504         if (!p) {
1505                 free(newmsg);
1506                 return -1;
1507         }
1508         p = pfkey_setsadblifetime(p, ep, SADB_EXT_LIFETIME_HARD,
1509                         0, 0, ltime, vtime);
1510         if (!p || p + policylen != ep) {
1511                 free(newmsg);
1512                 return -1;
1513         }
1514         memcpy(p, policy, policylen);
1515
1516         /* send message */
1517         len = pfkey_send(so, newmsg, len);
1518         free(newmsg);
1519
1520         if (len < 0)
1521                 return -1;
1522
1523         __ipsec_errcode = EIPSEC_NO_ERROR;
1524         return len;
1525 }
1526
1527 /* sending SADB_X_SPDGET or SADB_X_SPDDELETE message to the kernel */
1528 static int
1529 pfkey_send_x5(so, type, spid)
1530         int so;
1531         u_int type;
1532         u_int32_t spid;
1533 {
1534         struct sadb_msg *newmsg;
1535         struct sadb_x_policy xpl;
1536         int len;
1537         caddr_t p;
1538         caddr_t ep;
1539
1540         /* create new sadb_msg to reply. */
1541         len = sizeof(struct sadb_msg)
1542                 + sizeof(xpl);
1543
1544         if ((newmsg = CALLOC(len, struct sadb_msg *)) == NULL) {
1545                 __ipsec_set_strerror(strerror(errno));
1546                 return -1;
1547         }
1548         ep = ((caddr_t)newmsg) + len;
1549
1550         p = pfkey_setsadbmsg((caddr_t)newmsg, ep, type, len,
1551             SADB_SATYPE_UNSPEC, 0, getpid());
1552         if (!p) {
1553                 free(newmsg);
1554                 return -1;
1555         }
1556
1557         if (p + sizeof(xpl) != ep) {
1558                 free(newmsg);
1559                 return -1;
1560         }
1561         memset(&xpl, 0, sizeof(xpl));
1562         xpl.sadb_x_policy_len = PFKEY_UNUNIT64(sizeof(xpl));
1563         xpl.sadb_x_policy_exttype = SADB_X_EXT_POLICY;
1564         xpl.sadb_x_policy_id = spid;
1565         memcpy(p, &xpl, sizeof(xpl));
1566
1567         /* send message */
1568         len = pfkey_send(so, newmsg, len);
1569         free(newmsg);
1570
1571         if (len < 0)
1572                 return -1;
1573
1574         __ipsec_errcode = EIPSEC_NO_ERROR;
1575         return len;
1576 }
1577
1578 /*
1579  * open a socket.
1580  * OUT:
1581  *      -1: fail.
1582  *      others : success and return value of socket.
1583  */
1584 int
1585 pfkey_open()
1586 {
1587         int so;
1588         const int bufsiz = 128 * 1024;  /*is 128K enough?*/
1589
1590         if ((so = socket(PF_KEY, SOCK_RAW, PF_KEY_V2)) < 0) {
1591                 __ipsec_set_strerror(strerror(errno));
1592                 return -1;
1593         }
1594
1595         /*
1596          * This is a temporary workaround for KAME PR 154.
1597          * Don't really care even if it fails.
1598          */
1599         (void)setsockopt(so, SOL_SOCKET, SO_SNDBUF, &bufsiz, sizeof(bufsiz));
1600         (void)setsockopt(so, SOL_SOCKET, SO_RCVBUF, &bufsiz, sizeof(bufsiz));
1601
1602         __ipsec_errcode = EIPSEC_NO_ERROR;
1603         return so;
1604 }
1605
1606 /*
1607  * close a socket.
1608  * OUT:
1609  *       0: success.
1610  *      -1: fail.
1611  */
1612 void
1613 pfkey_close(so)
1614         int so;
1615 {
1616         (void)close(so);
1617
1618         __ipsec_errcode = EIPSEC_NO_ERROR;
1619         return;
1620 }
1621
1622 /*
1623  * receive sadb_msg data, and return pointer to new buffer allocated.
1624  * Must free this buffer later.
1625  * OUT:
1626  *      NULL    : error occured.
1627  *      others  : a pointer to sadb_msg structure.
1628  *
1629  * XXX should be rewritten to pass length explicitly
1630  */
1631 struct sadb_msg *
1632 pfkey_recv(so)
1633         int so;
1634 {
1635         struct sadb_msg buf, *newmsg;
1636         int len, reallen;
1637
1638         while ((len = recv(so, (caddr_t)&buf, sizeof(buf), MSG_PEEK)) < 0) {
1639                 if (errno == EINTR)
1640                         continue;
1641                 __ipsec_set_strerror(strerror(errno));
1642                 return NULL;
1643         }
1644
1645         if ((size_t)len < sizeof(buf)) {
1646                 recv(so, (caddr_t)&buf, sizeof(buf), 0);
1647                 __ipsec_errcode = EIPSEC_MAX;
1648                 return NULL;
1649         }
1650
1651         /* read real message */
1652         reallen = PFKEY_UNUNIT64(buf.sadb_msg_len);
1653         if ((newmsg = CALLOC(reallen, struct sadb_msg *)) == 0) {
1654                 __ipsec_set_strerror(strerror(errno));
1655                 return NULL;
1656         }
1657
1658         while ((len = recv(so, (caddr_t)newmsg, reallen, 0)) < 0) {
1659                 if (errno == EINTR)
1660                         continue;
1661                 __ipsec_set_strerror(strerror(errno));
1662                 free(newmsg);
1663                 return NULL;
1664         }
1665
1666         if (len != reallen) {
1667                 __ipsec_errcode = EIPSEC_SYSTEM_ERROR;
1668                 free(newmsg);
1669                 return NULL;
1670         }
1671
1672         /* don't trust what the kernel says, validate! */
1673         if (PFKEY_UNUNIT64(newmsg->sadb_msg_len) != len) {
1674                 __ipsec_errcode = EIPSEC_SYSTEM_ERROR;
1675                 free(newmsg);
1676                 return NULL;
1677         }
1678
1679         __ipsec_errcode = EIPSEC_NO_ERROR;
1680         return newmsg;
1681 }
1682
1683 /*
1684  * send message to a socket.
1685  * OUT:
1686  *       others: success and return length sent.
1687  *      -1     : fail.
1688  */
1689 int
1690 pfkey_send(so, msg, len)
1691         int so;
1692         struct sadb_msg *msg;
1693         int len;
1694 {
1695         if ((len = send(so, (caddr_t)msg, len, 0)) < 0) {
1696                 __ipsec_set_strerror(strerror(errno));
1697                 return -1;
1698         }
1699
1700         __ipsec_errcode = EIPSEC_NO_ERROR;
1701         return len;
1702 }
1703
1704 /*
1705  * %%% Utilities
1706  * NOTE: These functions are derived from netkey/key.c in KAME.
1707  */
1708 /*
1709  * set the pointer to each header in this message buffer.
1710  * IN:  msg: pointer to message buffer.
1711  *      mhp: pointer to the buffer initialized like below:
1712  *              caddr_t mhp[SADB_EXT_MAX + 1];
1713  * OUT: -1: invalid.
1714  *       0: valid.
1715  *
1716  * XXX should be rewritten to obtain length explicitly
1717  */
1718 int
1719 pfkey_align(msg, mhp)
1720         struct sadb_msg *msg;
1721         caddr_t *mhp;
1722 {
1723         struct sadb_ext *ext;
1724         int i;
1725         caddr_t p;
1726         caddr_t ep;     /* XXX should be passed from upper layer */
1727
1728         /* validity check */
1729         if (msg == NULL || mhp == NULL) {
1730                 __ipsec_errcode = EIPSEC_INVAL_ARGUMENT;
1731                 return -1;
1732         }
1733
1734         /* initialize */
1735         for (i = 0; i < SADB_EXT_MAX + 1; i++)
1736                 mhp[i] = NULL;
1737
1738         mhp[0] = (caddr_t)msg;
1739
1740         /* initialize */
1741         p = (caddr_t) msg;
1742         ep = p + PFKEY_UNUNIT64(msg->sadb_msg_len);
1743
1744         /* skip base header */
1745         p += sizeof(struct sadb_msg);
1746
1747         while (p < ep) {
1748                 ext = (struct sadb_ext *)p;
1749                 if (ep < p + sizeof(*ext) || (size_t)PFKEY_EXTLEN(ext) < sizeof(*ext) ||
1750                     ep < p + PFKEY_EXTLEN(ext)) {
1751                         /* invalid format */
1752                         break;
1753                 }
1754
1755                 /* duplicate check */
1756                 /* XXX Are there duplication either KEY_AUTH or KEY_ENCRYPT ?*/
1757                 if (mhp[ext->sadb_ext_type] != NULL) {
1758                         __ipsec_errcode = EIPSEC_INVAL_EXTTYPE;
1759                         return -1;
1760                 }
1761
1762                 /* set pointer */
1763                 switch (ext->sadb_ext_type) {
1764                 case SADB_EXT_SA:
1765                 case SADB_EXT_LIFETIME_CURRENT:
1766                 case SADB_EXT_LIFETIME_HARD:
1767                 case SADB_EXT_LIFETIME_SOFT:
1768                 case SADB_EXT_ADDRESS_SRC:
1769                 case SADB_EXT_ADDRESS_DST:
1770                 case SADB_EXT_ADDRESS_PROXY:
1771                 case SADB_EXT_KEY_AUTH:
1772                         /* XXX should to be check weak keys. */
1773                 case SADB_EXT_KEY_ENCRYPT:
1774                         /* XXX should to be check weak keys. */
1775                 case SADB_EXT_IDENTITY_SRC:
1776                 case SADB_EXT_IDENTITY_DST:
1777                 case SADB_EXT_SENSITIVITY:
1778                 case SADB_EXT_PROPOSAL:
1779                 case SADB_EXT_SUPPORTED_AUTH:
1780                 case SADB_EXT_SUPPORTED_ENCRYPT:
1781                 case SADB_EXT_SPIRANGE:
1782                 case SADB_X_EXT_POLICY:
1783                 case SADB_X_EXT_SA2:
1784                         mhp[ext->sadb_ext_type] = (caddr_t)ext;
1785                         break;
1786                 default:
1787                         __ipsec_errcode = EIPSEC_INVAL_EXTTYPE;
1788                         return -1;
1789                 }
1790
1791                 p += PFKEY_EXTLEN(ext);
1792         }
1793
1794         if (p != ep) {
1795                 __ipsec_errcode = EIPSEC_INVAL_SADBMSG;
1796                 return -1;
1797         }
1798
1799         __ipsec_errcode = EIPSEC_NO_ERROR;
1800         return 0;
1801 }
1802
1803 /*
1804  * check basic usage for sadb_msg,
1805  * NOTE: This routine is derived from netkey/key.c in KAME.
1806  * IN:  msg: pointer to message buffer.
1807  *      mhp: pointer to the buffer initialized like below:
1808  *
1809  *              caddr_t mhp[SADB_EXT_MAX + 1];
1810  *
1811  * OUT: -1: invalid.
1812  *       0: valid.
1813  */
1814 int
1815 pfkey_check(mhp)
1816         caddr_t *mhp;
1817 {
1818         struct sadb_msg *msg;
1819
1820         /* validity check */
1821         if (mhp == NULL || mhp[0] == NULL) {
1822                 __ipsec_errcode = EIPSEC_INVAL_ARGUMENT;
1823                 return -1;
1824         }
1825
1826         msg = (struct sadb_msg *)mhp[0];
1827
1828         /* check version */
1829         if (msg->sadb_msg_version != PF_KEY_V2) {
1830                 __ipsec_errcode = EIPSEC_INVAL_VERSION;
1831                 return -1;
1832         }
1833
1834         /* check type */
1835         if (msg->sadb_msg_type > SADB_MAX) {
1836                 __ipsec_errcode = EIPSEC_INVAL_MSGTYPE;
1837                 return -1;
1838         }
1839
1840         /* check SA type */
1841         switch (msg->sadb_msg_satype) {
1842         case SADB_SATYPE_UNSPEC:
1843                 switch (msg->sadb_msg_type) {
1844                 case SADB_GETSPI:
1845                 case SADB_UPDATE:
1846                 case SADB_ADD:
1847                 case SADB_DELETE:
1848                 case SADB_GET:
1849                 case SADB_ACQUIRE:
1850                 case SADB_EXPIRE:
1851                         __ipsec_errcode = EIPSEC_INVAL_SATYPE;
1852                         return -1;
1853                 }
1854                 break;
1855         case SADB_SATYPE_ESP:
1856         case SADB_SATYPE_AH:
1857         case SADB_X_SATYPE_IPCOMP:
1858                 switch (msg->sadb_msg_type) {
1859                 case SADB_X_SPDADD:
1860                 case SADB_X_SPDDELETE:
1861                 case SADB_X_SPDGET:
1862                 case SADB_X_SPDDUMP:
1863                 case SADB_X_SPDFLUSH:
1864                         __ipsec_errcode = EIPSEC_INVAL_SATYPE;
1865                         return -1;
1866                 }
1867                 break;
1868         case SADB_SATYPE_RSVP:
1869         case SADB_SATYPE_OSPFV2:
1870         case SADB_SATYPE_RIPV2:
1871         case SADB_SATYPE_MIP:
1872                 __ipsec_errcode = EIPSEC_NOT_SUPPORTED;
1873                 return -1;
1874         case 1: /* XXX: What does it do ? */
1875                 if (msg->sadb_msg_type == SADB_X_PROMISC)
1876                         break;
1877                 /*FALLTHROUGH*/
1878         default:
1879                 __ipsec_errcode = EIPSEC_INVAL_SATYPE;
1880                 return -1;
1881         }
1882
1883         /* check field of upper layer protocol and address family */
1884         if (mhp[SADB_EXT_ADDRESS_SRC] != NULL
1885          && mhp[SADB_EXT_ADDRESS_DST] != NULL) {
1886                 struct sadb_address *src0, *dst0;
1887
1888                 src0 = (struct sadb_address *)(mhp[SADB_EXT_ADDRESS_SRC]);
1889                 dst0 = (struct sadb_address *)(mhp[SADB_EXT_ADDRESS_DST]);
1890
1891                 if (src0->sadb_address_proto != dst0->sadb_address_proto) {
1892                         __ipsec_errcode = EIPSEC_PROTO_MISMATCH;
1893                         return -1;
1894                 }
1895
1896                 if (PFKEY_ADDR_SADDR(src0)->sa_family
1897                  != PFKEY_ADDR_SADDR(dst0)->sa_family) {
1898                         __ipsec_errcode = EIPSEC_FAMILY_MISMATCH;
1899                         return -1;
1900                 }
1901
1902                 switch (PFKEY_ADDR_SADDR(src0)->sa_family) {
1903                 case AF_INET:
1904                 case AF_INET6:
1905                         break;
1906                 default:
1907                         __ipsec_errcode = EIPSEC_INVAL_FAMILY;
1908                         return -1;
1909                 }
1910
1911                 /*
1912                  * prefixlen == 0 is valid because there must be the case
1913                  * all addresses are matched.
1914                  */
1915         }
1916
1917         __ipsec_errcode = EIPSEC_NO_ERROR;
1918         return 0;
1919 }
1920
1921 /*
1922  * set data into sadb_msg.
1923  * `buf' must has been allocated sufficiently.
1924  */
1925 static caddr_t
1926 pfkey_setsadbmsg(buf, lim, type, tlen, satype, seq, pid)
1927         caddr_t buf;
1928         caddr_t lim;
1929         u_int type, satype;
1930         u_int tlen;
1931         u_int32_t seq;
1932         pid_t pid;
1933 {
1934         struct sadb_msg *p;
1935         u_int len;
1936
1937         p = (struct sadb_msg *)buf;
1938         len = sizeof(struct sadb_msg);
1939
1940         if (buf + len > lim)
1941                 return NULL;
1942
1943         memset(p, 0, len);
1944         p->sadb_msg_version = PF_KEY_V2;
1945         p->sadb_msg_type = type;
1946         p->sadb_msg_errno = 0;
1947         p->sadb_msg_satype = satype;
1948         p->sadb_msg_len = PFKEY_UNIT64(tlen);
1949         p->sadb_msg_reserved = 0;
1950         p->sadb_msg_seq = seq;
1951         p->sadb_msg_pid = (u_int32_t)pid;
1952
1953         return(buf + len);
1954 }
1955
1956 /*
1957  * copy secasvar data into sadb_address.
1958  * `buf' must has been allocated sufficiently.
1959  */
1960 static caddr_t
1961 pfkey_setsadbsa(buf, lim, spi, wsize, auth, enc, flags)
1962         caddr_t buf;
1963         caddr_t lim;
1964         u_int32_t spi, flags;
1965         u_int wsize, auth, enc;
1966 {
1967         struct sadb_sa *p;
1968         u_int len;
1969
1970         p = (struct sadb_sa *)buf;
1971         len = sizeof(struct sadb_sa);
1972
1973         if (buf + len > lim)
1974                 return NULL;
1975
1976         memset(p, 0, len);
1977         p->sadb_sa_len = PFKEY_UNIT64(len);
1978         p->sadb_sa_exttype = SADB_EXT_SA;
1979         p->sadb_sa_spi = spi;
1980         p->sadb_sa_replay = wsize;
1981         p->sadb_sa_state = SADB_SASTATE_LARVAL;
1982         p->sadb_sa_auth = auth;
1983         p->sadb_sa_encrypt = enc;
1984         p->sadb_sa_flags = flags;
1985
1986         return(buf + len);
1987 }
1988
1989 /*
1990  * set data into sadb_address.
1991  * `buf' must has been allocated sufficiently.
1992  * prefixlen is in bits.
1993  */
1994 static caddr_t
1995 pfkey_setsadbaddr(buf, lim, exttype, saddr, prefixlen, ul_proto)
1996         caddr_t buf;
1997         caddr_t lim;
1998         u_int exttype;
1999         struct sockaddr *saddr;
2000         u_int prefixlen;
2001         u_int ul_proto;
2002 {
2003         struct sadb_address *p;
2004         u_int len;
2005
2006         p = (struct sadb_address *)buf;
2007         len = sizeof(struct sadb_address) + PFKEY_ALIGN8(saddr->sa_len);
2008
2009         if (buf + len > lim)
2010                 return NULL;
2011
2012         memset(p, 0, len);
2013         p->sadb_address_len = PFKEY_UNIT64(len);
2014         p->sadb_address_exttype = exttype & 0xffff;
2015         p->sadb_address_proto = ul_proto & 0xff;
2016         p->sadb_address_prefixlen = prefixlen;
2017         p->sadb_address_reserved = 0;
2018
2019         memcpy(p + 1, saddr, saddr->sa_len);
2020
2021         return(buf + len);
2022 }
2023
2024 /*
2025  * set sadb_key structure after clearing buffer with zero.
2026  * OUT: the pointer of buf + len.
2027  */
2028 static caddr_t
2029 pfkey_setsadbkey(buf, lim, type, key, keylen)
2030         caddr_t buf;
2031         caddr_t lim;
2032         caddr_t key;
2033         u_int type, keylen;
2034 {
2035         struct sadb_key *p;
2036         u_int len;
2037
2038         p = (struct sadb_key *)buf;
2039         len = sizeof(struct sadb_key) + PFKEY_ALIGN8(keylen);
2040
2041         if (buf + len > lim)
2042                 return NULL;
2043
2044         memset(p, 0, len);
2045         p->sadb_key_len = PFKEY_UNIT64(len);
2046         p->sadb_key_exttype = type;
2047         p->sadb_key_bits = keylen << 3;
2048         p->sadb_key_reserved = 0;
2049
2050         memcpy(p + 1, key, keylen);
2051
2052         return buf + len;
2053 }
2054
2055 /*
2056  * set sadb_lifetime structure after clearing buffer with zero.
2057  * OUT: the pointer of buf + len.
2058  */
2059 static caddr_t
2060 pfkey_setsadblifetime(buf, lim, type, l_alloc, l_bytes, l_addtime, l_usetime)
2061         caddr_t buf;
2062         caddr_t lim;
2063         u_int type;
2064         u_int32_t l_alloc, l_bytes, l_addtime, l_usetime;
2065 {
2066         struct sadb_lifetime *p;
2067         u_int len;
2068
2069         p = (struct sadb_lifetime *)buf;
2070         len = sizeof(struct sadb_lifetime);
2071
2072         if (buf + len > lim)
2073                 return NULL;
2074
2075         memset(p, 0, len);
2076         p->sadb_lifetime_len = PFKEY_UNIT64(len);
2077         p->sadb_lifetime_exttype = type;
2078
2079         switch (type) {
2080         case SADB_EXT_LIFETIME_SOFT:
2081                 p->sadb_lifetime_allocations
2082                         = (l_alloc * soft_lifetime_allocations_rate) /100;
2083                 p->sadb_lifetime_bytes
2084                         = (l_bytes * soft_lifetime_bytes_rate) /100;
2085                 p->sadb_lifetime_addtime
2086                         = (l_addtime * soft_lifetime_addtime_rate) /100;
2087                 p->sadb_lifetime_usetime
2088                         = (l_usetime * soft_lifetime_usetime_rate) /100;
2089                 break;
2090         case SADB_EXT_LIFETIME_HARD:
2091                 p->sadb_lifetime_allocations = l_alloc;
2092                 p->sadb_lifetime_bytes = l_bytes;
2093                 p->sadb_lifetime_addtime = l_addtime;
2094                 p->sadb_lifetime_usetime = l_usetime;
2095                 break;
2096         }
2097
2098         return buf + len;
2099 }
2100
2101 /*
2102  * copy secasvar data into sadb_address.
2103  * `buf' must has been allocated sufficiently.
2104  */
2105 static caddr_t
2106 pfkey_setsadbxsa2(buf, lim, mode0, reqid)
2107         caddr_t buf;
2108         caddr_t lim;
2109         u_int32_t mode0;
2110         u_int32_t reqid;
2111 {
2112         struct sadb_x_sa2 *p;
2113         u_int8_t mode = mode0 & 0xff;
2114         u_int len;
2115
2116         p = (struct sadb_x_sa2 *)buf;
2117         len = sizeof(struct sadb_x_sa2);
2118
2119         if (buf + len > lim)
2120                 return NULL;
2121
2122         memset(p, 0, len);
2123         p->sadb_x_sa2_len = PFKEY_UNIT64(len);
2124         p->sadb_x_sa2_exttype = SADB_X_EXT_SA2;
2125         p->sadb_x_sa2_mode = mode;
2126         p->sadb_x_sa2_reqid = reqid;
2127
2128         return(buf + len);
2129 }
2130
2131 #endif /* ndef MDNS_NO_IPSEC */