[apple/xnu.git] / bsd / netinet6 / in6_cga.c

/*
 * Copyright (c) 2013-2016 Apple Inc. All rights reserved.
 *
 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
 *
 * This file contains Original Code and/or Modifications of Original Code
 * as defined in and that are subject to the Apple Public Source License
 * Version 2.0 (the 'License'). You may not use this file except in
 * compliance with the License. The rights granted to you under the License
 * may not be used to create, or enable the creation or redistribution of,
 * unlawful or unlicensed copies of an Apple operating system, or to
 * circumvent, violate, or enable the circumvention or violation of, any
 * terms of an Apple operating system software license agreement.
 *
 * Please obtain a copy of the License at
 * http://www.opensource.apple.com/apsl/ and read it before using this file.
 *
 * The Original Code and all software distributed under the License are
 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
 * Please see the License for the specific language governing rights and
 * limitations under the License.
 *
 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
 */

#include <sys/types.h>
#include <sys/malloc.h>

#include <kern/locks.h>

#include <libkern/crypto/sha1.h>

#include <net/if.h>

#include <netinet/in.h>
#include <netinet6/in6_var.h>
#include <netinet/ip6.h>
#include <netinet6/ip6_var.h>
#include <netinet6/nd6.h>

#define IN6_CGA_HASH1_LENGTH    8
#define IN6_CGA_HASH2_LENGTH    14
#define IN6_CGA_PREPARE_ZEROES  9

struct in6_cga_hash1 {
	u_int8_t octets[IN6_CGA_HASH1_LENGTH];
};

struct in6_cga_hash2 {
	u_int8_t octets[IN6_CGA_HASH2_LENGTH];
};

struct in6_cga_singleton {
	boolean_t cga_initialized;
	decl_lck_mtx_data(, cga_mutex);
	struct in6_cga_prepare cga_prepare;
	struct iovec cga_pubkey;
	struct iovec cga_privkey;
};

static struct in6_cga_singleton in6_cga = {
	.cga_initialized = FALSE,
	.cga_mutex = {},
	.cga_prepare = {
		.cga_modifier = {},
		.cga_security_level = 0,
	},
	.cga_pubkey = {
		.iov_base = NULL,
		.iov_len = 0,
	},
	.cga_privkey = {
		.iov_base = NULL,
		.iov_len = 0,
	},
};

static void
in6_cga_node_lock_assert(int owned)
{
#if !MACH_ASSERT
#pragma unused(owned)
#endif
	VERIFY(in6_cga.cga_initialized);
	LCK_MTX_ASSERT(&in6_cga.cga_mutex, owned);
}

static boolean_t
in6_cga_is_prepare_valid(const struct in6_cga_prepare *prepare,
    const struct iovec *pubkey)
{
	static const u_int8_t zeroes[IN6_CGA_PREPARE_ZEROES] = { };
	SHA1_CTX ctx;
	u_int8_t sha1[SHA1_RESULTLEN];
	u_int i, n;

	VERIFY(prepare != NULL);
	VERIFY(pubkey != NULL && pubkey->iov_base != NULL);

	if (prepare->cga_security_level == 0) {
		return TRUE;
	}

	if (prepare->cga_security_level > 7) {
		return FALSE;
	}

	SHA1Init(&ctx);
	SHA1Update(&ctx, &prepare->cga_modifier.octets,
	    IN6_CGA_MODIFIER_LENGTH);
	SHA1Update(&ctx, &zeroes, IN6_CGA_PREPARE_ZEROES);
	SHA1Update(&ctx, pubkey->iov_base, pubkey->iov_len);
	/* FUTURE: extension fields */
	SHA1Final(sha1, &ctx);

	n = 2 * (u_int) prepare->cga_security_level;
	VERIFY(n < SHA1_RESULTLEN);
	for (i = 0; i < n; ++i) {
		if (sha1[i] != 0) {
			return FALSE;
		}
	}

	return TRUE;
}

/*
 * @brief Generate interface identifier for CGA
 *      XXX You may notice that following does not really
 *      mirror what is decribed in:
 *      https://tools.ietf.org/html/rfc3972#section-4
 *      By design kernel here will assume that that
 *      modifier has been converged on by userspace
 *      for first part of the algorithm for the given
 *      security level.
 *      We are not doing that yet but that's how the code
 *      below is written. So really we are starting
 *      from bullet 4 of the algorithm.
 *
 * @param prepare Pointer to object containing modifier,
 *      security level & extension to be used.
 * @param pubkey Public key used for IID generation
 * @param collisions Collission count on DAD failure
 *      XXX We are not really re-generating IID on DAD
 *      failures for now.
 * @param in6 Pointer to the address containing
 *      the prefix.
 *
 * @return void
 */
static void
in6_cga_generate_iid(const struct in6_cga_prepare *prepare,
    const struct iovec *pubkey, u_int8_t collisions,
    struct in6_addr *in6, struct ifnet *ifp)
{
	SHA1_CTX ctx;
	u_int8_t sha1[SHA1_RESULTLEN];

	VERIFY(prepare != NULL);
	VERIFY(prepare->cga_security_level < 8);
	VERIFY(pubkey != NULL && pubkey->iov_base != NULL);
	VERIFY(in6 != NULL);

	SHA1Init(&ctx);
	SHA1Update(&ctx, &prepare->cga_modifier.octets, 16);
	SHA1Update(&ctx, in6->s6_addr, 8);
	SHA1Update(&ctx, &collisions, 1);
	SHA1Update(&ctx, pubkey->iov_base, pubkey->iov_len);
	if (ifp->network_id_len) {
		SHA1Update(&ctx, &ifp->network_id, ifp->network_id_len);
	}
	/* FUTURE: extension fields */
	SHA1Final(sha1, &ctx);

	in6->s6_addr8[8] =
	    (u_int8_t)((prepare->cga_security_level << 5) | (sha1[0] & 0x1c));
	in6->s6_addr8[9] = sha1[1];
	in6->s6_addr8[10] = sha1[2];
	in6->s6_addr8[11] = sha1[3];
	in6->s6_addr8[12] = sha1[4];
	in6->s6_addr8[13] = sha1[5];
	in6->s6_addr8[14] = sha1[6];
	in6->s6_addr8[15] = sha1[7];
}

void
in6_cga_init(void)
{
	lck_mtx_init(&in6_cga.cga_mutex, ifa_mtx_grp, ifa_mtx_attr);
	in6_cga.cga_initialized = TRUE;
}

void
in6_cga_node_lock(void)
{
	VERIFY(in6_cga.cga_initialized);
	lck_mtx_lock(&in6_cga.cga_mutex);
}

void
in6_cga_node_unlock(void)
{
	VERIFY(in6_cga.cga_initialized);
	lck_mtx_unlock(&in6_cga.cga_mutex);
}

void
in6_cga_query(struct in6_cga_nodecfg *cfg)
{
	VERIFY(cfg != NULL);
	in6_cga_node_lock_assert(LCK_MTX_ASSERT_OWNED);

	cfg->cga_pubkey = in6_cga.cga_pubkey;
	cfg->cga_prepare = in6_cga.cga_prepare;
}

int
in6_cga_start(const struct in6_cga_nodecfg *cfg)
{
	struct iovec privkey, pubkey;
	const struct in6_cga_prepare *prepare;
	caddr_t pubkeycopy, privkeycopy;

	VERIFY(cfg != NULL);
	in6_cga_node_lock_assert(LCK_MTX_ASSERT_OWNED);

	privkey = cfg->cga_privkey;
	if (privkey.iov_base == NULL || privkey.iov_len == 0 ||
	    privkey.iov_len >= IN6_CGA_KEY_MAXSIZE) {
		return EINVAL;
	}
	pubkey = cfg->cga_pubkey;
	if (pubkey.iov_base == NULL || pubkey.iov_len == 0 ||
	    pubkey.iov_len >= IN6_CGA_KEY_MAXSIZE) {
		return EINVAL;
	}
	prepare = &cfg->cga_prepare;

	if (!in6_cga_is_prepare_valid(prepare, &pubkey)) {
		return EINVAL;
	}

	in6_cga.cga_prepare = *prepare;

	MALLOC(privkeycopy, caddr_t, privkey.iov_len, M_IP6CGA, M_WAITOK);
	if (privkeycopy == NULL) {
		return ENOMEM;
	}

	MALLOC(pubkeycopy, caddr_t, pubkey.iov_len, M_IP6CGA, M_WAITOK);
	if (pubkeycopy == NULL) {
		if (privkeycopy != NULL) {
			FREE(privkeycopy, M_IP6CGA);
		}
		return ENOMEM;
	}

	bcopy(privkey.iov_base, privkeycopy, privkey.iov_len);
	privkey.iov_base = privkeycopy;
	if (in6_cga.cga_privkey.iov_base != NULL) {
		FREE(in6_cga.cga_privkey.iov_base, M_IP6CGA);
	}
	in6_cga.cga_privkey = privkey;

	bcopy(pubkey.iov_base, pubkeycopy, pubkey.iov_len);
	pubkey.iov_base = pubkeycopy;
	if (in6_cga.cga_pubkey.iov_base != NULL) {
		FREE(in6_cga.cga_pubkey.iov_base, M_IP6CGA);
	}
	in6_cga.cga_pubkey = pubkey;

	return 0;
}

int
in6_cga_stop(void)
{
	in6_cga_node_lock_assert(LCK_MTX_ASSERT_OWNED);

	if (in6_cga.cga_privkey.iov_base != NULL) {
		FREE(in6_cga.cga_privkey.iov_base, M_IP6CGA);
		in6_cga.cga_privkey.iov_base = NULL;
		in6_cga.cga_privkey.iov_len = 0;
	}

	if (in6_cga.cga_pubkey.iov_base != NULL) {
		FREE(in6_cga.cga_pubkey.iov_base, M_IP6CGA);
		in6_cga.cga_pubkey.iov_base = NULL;
		in6_cga.cga_pubkey.iov_len = 0;
	}

	return 0;
}

ssize_t
in6_cga_parameters_prepare(void *output, size_t max,
    const struct in6_addr *prefix, u_int8_t collisions,
    const struct in6_cga_modifier *modifier)
{
	caddr_t cursor;

	in6_cga_node_lock_assert(LCK_MTX_ASSERT_OWNED);

	if (in6_cga.cga_pubkey.iov_len == 0) {
		/* No public key */
		return EINVAL;
	}

	if (output == NULL ||
	    max < in6_cga.cga_pubkey.iov_len + sizeof(modifier->octets) + 9) {
		/* Output buffer error */
		return EINVAL;
	}

	cursor = output;
	if (modifier == NULL) {
		modifier = &in6_cga.cga_prepare.cga_modifier;
	}
	if (prefix == NULL) {
		static const struct in6_addr llprefix = {{{ 0xfe, 0x80 }}};
		prefix = &llprefix;
	}

	bcopy(&modifier->octets, cursor, sizeof(modifier->octets));
	cursor += sizeof(modifier->octets);

	*cursor++ = (char) collisions;

	bcopy(&prefix->s6_addr[0], cursor, 8);
	cursor += 8;

	bcopy(in6_cga.cga_pubkey.iov_base, cursor, in6_cga.cga_pubkey.iov_len);
	cursor += in6_cga.cga_pubkey.iov_len;

	/* FUTURE: Extension fields */

	return (ssize_t)(cursor - (caddr_t)output);
}

int
in6_cga_generate(struct in6_cga_prepare *prepare, u_int8_t collisions,
    struct in6_addr *in6, struct ifnet *ifp)
{
	int error;
	const struct iovec *pubkey;

	in6_cga_node_lock_assert(LCK_MTX_ASSERT_OWNED);
	VERIFY(in6 != NULL);

	if (prepare == NULL) {
		prepare = &in6_cga.cga_prepare;
	} else {
		prepare->cga_security_level =
		    in6_cga.cga_prepare.cga_security_level;
	}

	pubkey = &in6_cga.cga_pubkey;

	if (pubkey->iov_base != NULL) {
		in6_cga_generate_iid(prepare, pubkey, collisions, in6, ifp);
		error = 0;
	} else {
		error = EADDRNOTAVAIL;
	}

	return error;
}

/* End of file */
Commit	Line	Data
39236c6e	1	/*
39037602	2	* Copyright (c) 2013-2016 Apple Inc. All rights reserved.
39236c6e A	3	*
	4	* @APPLE_OSREFERENCE_LICENSE_HEADER_START@
	5	*
	6	* This file contains Original Code and/or Modifications of Original Code
	7	* as defined in and that are subject to the Apple Public Source License
	8	* Version 2.0 (the 'License'). You may not use this file except in
	9	* compliance with the License. The rights granted to you under the License
	10	* may not be used to create, or enable the creation or redistribution of,
	11	* unlawful or unlicensed copies of an Apple operating system, or to
	12	* circumvent, violate, or enable the circumvention or violation of, any
	13	* terms of an Apple operating system software license agreement.
	14	*
	15	* Please obtain a copy of the License at
	16	* http://www.opensource.apple.com/apsl/ and read it before using this file.
	17	*
	18	* The Original Code and all software distributed under the License are
	19	* distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
	20	* EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
	21	* INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
	22	* FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
	23	* Please see the License for the specific language governing rights and
	24	* limitations under the License.
	25	*
	26	* @APPLE_OSREFERENCE_LICENSE_HEADER_END@
	27	*/
	28
	29	#include <sys/types.h>
	30	#include <sys/malloc.h>
	31
	32	#include <kern/locks.h>
	33
	34	#include <libkern/crypto/sha1.h>
	35
	36	#include <net/if.h>
	37
	38	#include <netinet/in.h>
	39	#include <netinet6/in6_var.h>
	40	#include <netinet/ip6.h>
	41	#include <netinet6/ip6_var.h>
	42	#include <netinet6/nd6.h>
	43
0a7de745 A	44	#define IN6_CGA_HASH1_LENGTH 8
	45	#define IN6_CGA_HASH2_LENGTH 14
	46	#define IN6_CGA_PREPARE_ZEROES 9
39236c6e A	47
	48	struct in6_cga_hash1 {
	49	u_int8_t octets[IN6_CGA_HASH1_LENGTH];
	50	};
	51
	52	struct in6_cga_hash2 {
	53	u_int8_t octets[IN6_CGA_HASH2_LENGTH];
	54	};
	55
	56	struct in6_cga_singleton {
	57	boolean_t cga_initialized;
	58	decl_lck_mtx_data(, cga_mutex);
	59	struct in6_cga_prepare cga_prepare;
	60	struct iovec cga_pubkey;
	61	struct iovec cga_privkey;
	62	};
	63
	64	static struct in6_cga_singleton in6_cga = {
	65	.cga_initialized = FALSE,
	66	.cga_mutex = {},
	67	.cga_prepare = {
	68	.cga_modifier = {},
	69	.cga_security_level = 0,
	70	},
	71	.cga_pubkey = {
	72	.iov_base = NULL,
	73	.iov_len = 0,
	74	},
	75	.cga_privkey = {
	76	.iov_base = NULL,
	77	.iov_len = 0,
	78	},
	79	};
	80
	81	static void
	82	in6_cga_node_lock_assert(int owned)
	83	{
5ba3f43e A	84	#if !MACH_ASSERT
	85	#pragma unused(owned)
	86	#endif
39236c6e	87	VERIFY(in6_cga.cga_initialized);
5ba3f43e	88	LCK_MTX_ASSERT(&in6_cga.cga_mutex, owned);
39236c6e A	89	}
	90
	91	static boolean_t
	92	in6_cga_is_prepare_valid(const struct in6_cga_prepare *prepare,
	93	const struct iovec *pubkey)
	94	{
	95	static const u_int8_t zeroes[IN6_CGA_PREPARE_ZEROES] = { };
	96	SHA1_CTX ctx;
	97	u_int8_t sha1[SHA1_RESULTLEN];
	98	u_int i, n;
	99
	100	VERIFY(prepare != NULL);
	101	VERIFY(pubkey != NULL && pubkey->iov_base != NULL);
	102
0a7de745 A	103	if (prepare->cga_security_level == 0) {
	104	return TRUE;
	105	}
39236c6e	106
0a7de745 A	107	if (prepare->cga_security_level > 7) {
	108	return FALSE;
	109	}
39236c6e A	110
	111	SHA1Init(&ctx);
	112	SHA1Update(&ctx, &prepare->cga_modifier.octets,
	113	IN6_CGA_MODIFIER_LENGTH);
	114	SHA1Update(&ctx, &zeroes, IN6_CGA_PREPARE_ZEROES);
	115	SHA1Update(&ctx, pubkey->iov_base, pubkey->iov_len);
	116	/* FUTURE: extension fields */
	117	SHA1Final(sha1, &ctx);
	118
	119	n = 2 * (u_int) prepare->cga_security_level;
	120	VERIFY(n < SHA1_RESULTLEN);
0a7de745 A	121	for (i = 0; i < n; ++i) {
	122	if (sha1[i] != 0) {
	123	return FALSE;
	124	}
	125	}
39236c6e	126
0a7de745	127	return TRUE;
39236c6e A	128	}
39236c6e A	129
39037602 A	130	/*
39037602 A	131	* @brief Generate interface identifier for CGA
0a7de745 A	132	* XXX You may notice that following does not really
	133	* mirror what is decribed in:
	134	* https://tools.ietf.org/html/rfc3972#section-4
	135	* By design kernel here will assume that that
	136	* modifier has been converged on by userspace
	137	* for first part of the algorithm for the given
	138	* security level.
	139	* We are not doing that yet but that's how the code
	140	* below is written. So really we are starting
	141	* from bullet 4 of the algorithm.
39037602 A	142	*
39037602 A	143	* @param prepare Pointer to object containing modifier,
f427ee49	144	* security level & extension to be used.
39037602 A	145	* @param pubkey Public key used for IID generation
39037602 A	146	* @param collisions Collission count on DAD failure
0a7de745 A	147	* XXX We are not really re-generating IID on DAD
0a7de745 A	148	* failures for now.
39037602	149	* @param in6 Pointer to the address containing
0a7de745	150	* the prefix.
39037602 A	151	*
	152	* @return void
	153	*/
39236c6e A	154	static void
39236c6e A	155	in6_cga_generate_iid(const struct in6_cga_prepare *prepare,
f427ee49 A	156	const struct iovec *pubkey, u_int8_t collisions,
f427ee49 A	157	struct in6_addr in6, struct ifnet ifp)
39236c6e A	158	{
	159	SHA1_CTX ctx;
	160	u_int8_t sha1[SHA1_RESULTLEN];
	161
	162	VERIFY(prepare != NULL);
	163	VERIFY(prepare->cga_security_level < 8);
	164	VERIFY(pubkey != NULL && pubkey->iov_base != NULL);
	165	VERIFY(in6 != NULL);
	166
	167	SHA1Init(&ctx);
	168	SHA1Update(&ctx, &prepare->cga_modifier.octets, 16);
	169	SHA1Update(&ctx, in6->s6_addr, 8);
	170	SHA1Update(&ctx, &collisions, 1);
	171	SHA1Update(&ctx, pubkey->iov_base, pubkey->iov_len);
f427ee49 A	172	if (ifp->network_id_len) {
	173	SHA1Update(&ctx, &ifp->network_id, ifp->network_id_len);
	174	}
39236c6e A	175	/* FUTURE: extension fields */
	176	SHA1Final(sha1, &ctx);
	177
	178	in6->s6_addr8[8] =
f427ee49	179	(u_int8_t)((prepare->cga_security_level << 5) \| (sha1[0] & 0x1c));
39236c6e A	180	in6->s6_addr8[9] = sha1[1];
	181	in6->s6_addr8[10] = sha1[2];
	182	in6->s6_addr8[11] = sha1[3];
	183	in6->s6_addr8[12] = sha1[4];
	184	in6->s6_addr8[13] = sha1[5];
	185	in6->s6_addr8[14] = sha1[6];
	186	in6->s6_addr8[15] = sha1[7];
	187	}
	188
	189	void
	190	in6_cga_init(void)
	191	{
	192	lck_mtx_init(&in6_cga.cga_mutex, ifa_mtx_grp, ifa_mtx_attr);
	193	in6_cga.cga_initialized = TRUE;
	194	}
	195
	196	void
	197	in6_cga_node_lock(void)
	198	{
	199	VERIFY(in6_cga.cga_initialized);
	200	lck_mtx_lock(&in6_cga.cga_mutex);
	201	}
	202
	203	void
	204	in6_cga_node_unlock(void)
	205	{
	206	VERIFY(in6_cga.cga_initialized);
	207	lck_mtx_unlock(&in6_cga.cga_mutex);
	208	}
	209
	210	void
	211	in6_cga_query(struct in6_cga_nodecfg *cfg)
	212	{
	213	VERIFY(cfg != NULL);
	214	in6_cga_node_lock_assert(LCK_MTX_ASSERT_OWNED);
	215
	216	cfg->cga_pubkey = in6_cga.cga_pubkey;
	217	cfg->cga_prepare = in6_cga.cga_prepare;
	218	}
	219
	220	int
	221	in6_cga_start(const struct in6_cga_nodecfg *cfg)
	222	{
	223	struct iovec privkey, pubkey;
	224	const struct in6_cga_prepare *prepare;
	225	caddr_t pubkeycopy, privkeycopy;
	226
	227	VERIFY(cfg != NULL);
	228	in6_cga_node_lock_assert(LCK_MTX_ASSERT_OWNED);
	229
	230	privkey = cfg->cga_privkey;
	231	if (privkey.iov_base == NULL \|\| privkey.iov_len == 0 \|\|
0a7de745 A	232	privkey.iov_len >= IN6_CGA_KEY_MAXSIZE) {
	233	return EINVAL;
	234	}
39236c6e A	235	pubkey = cfg->cga_pubkey;
39236c6e A	236	if (pubkey.iov_base == NULL \|\| pubkey.iov_len == 0 \|\|
0a7de745 A	237	pubkey.iov_len >= IN6_CGA_KEY_MAXSIZE) {
	238	return EINVAL;
	239	}
39236c6e A	240	prepare = &cfg->cga_prepare;
39236c6e A	241
0a7de745 A	242	if (!in6_cga_is_prepare_valid(prepare, &pubkey)) {
	243	return EINVAL;
	244	}
39236c6e A	245
	246	in6_cga.cga_prepare = *prepare;
	247
	248	MALLOC(privkeycopy, caddr_t, privkey.iov_len, M_IP6CGA, M_WAITOK);
0a7de745 A	249	if (privkeycopy == NULL) {
	250	return ENOMEM;
	251	}
39236c6e A	252
	253	MALLOC(pubkeycopy, caddr_t, pubkey.iov_len, M_IP6CGA, M_WAITOK);
	254	if (pubkeycopy == NULL) {
0a7de745	255	if (privkeycopy != NULL) {
39236c6e	256	FREE(privkeycopy, M_IP6CGA);
0a7de745 A	257	}
0a7de745 A	258	return ENOMEM;
39236c6e A	259	}
	260
	261	bcopy(privkey.iov_base, privkeycopy, privkey.iov_len);
	262	privkey.iov_base = privkeycopy;
0a7de745	263	if (in6_cga.cga_privkey.iov_base != NULL) {
39236c6e	264	FREE(in6_cga.cga_privkey.iov_base, M_IP6CGA);
0a7de745	265	}
39236c6e A	266	in6_cga.cga_privkey = privkey;
	267
	268	bcopy(pubkey.iov_base, pubkeycopy, pubkey.iov_len);
	269	pubkey.iov_base = pubkeycopy;
0a7de745	270	if (in6_cga.cga_pubkey.iov_base != NULL) {
39236c6e	271	FREE(in6_cga.cga_pubkey.iov_base, M_IP6CGA);
0a7de745	272	}
39236c6e A	273	in6_cga.cga_pubkey = pubkey;
39236c6e A	274
0a7de745	275	return 0;
39236c6e A	276	}
	277
	278	int
	279	in6_cga_stop(void)
	280	{
	281	in6_cga_node_lock_assert(LCK_MTX_ASSERT_OWNED);
	282
	283	if (in6_cga.cga_privkey.iov_base != NULL) {
	284	FREE(in6_cga.cga_privkey.iov_base, M_IP6CGA);
	285	in6_cga.cga_privkey.iov_base = NULL;
	286	in6_cga.cga_privkey.iov_len = 0;
	287	}
	288
	289	if (in6_cga.cga_pubkey.iov_base != NULL) {
	290	FREE(in6_cga.cga_pubkey.iov_base, M_IP6CGA);
	291	in6_cga.cga_pubkey.iov_base = NULL;
	292	in6_cga.cga_pubkey.iov_len = 0;
	293	}
	294
0a7de745	295	return 0;
39236c6e A	296	}
	297
	298	ssize_t
	299	in6_cga_parameters_prepare(void *output, size_t max,
	300	const struct in6_addr *prefix, u_int8_t collisions,
	301	const struct in6_cga_modifier *modifier)
	302	{
	303	caddr_t cursor;
	304
	305	in6_cga_node_lock_assert(LCK_MTX_ASSERT_OWNED);
	306
	307	if (in6_cga.cga_pubkey.iov_len == 0) {
	308	/* No public key */
0a7de745	309	return EINVAL;
39236c6e A	310	}
	311
	312	if (output == NULL \|\|
0a7de745	313	max < in6_cga.cga_pubkey.iov_len + sizeof(modifier->octets) + 9) {
39236c6e	314	/* Output buffer error */
0a7de745	315	return EINVAL;
39236c6e A	316	}
	317
	318	cursor = output;
0a7de745 A	319	if (modifier == NULL) {
	320	modifier = &in6_cga.cga_prepare.cga_modifier;
	321	}
39236c6e A	322	if (prefix == NULL) {
	323	static const struct in6_addr llprefix = {{{ 0xfe, 0x80 }}};
	324	prefix = &llprefix;
	325	}
	326
0a7de745 A	327	bcopy(&modifier->octets, cursor, sizeof(modifier->octets));
0a7de745 A	328	cursor += sizeof(modifier->octets);
39236c6e A	329
	330	*cursor++ = (char) collisions;
	331
	332	bcopy(&prefix->s6_addr[0], cursor, 8);
	333	cursor += 8;
	334
	335	bcopy(in6_cga.cga_pubkey.iov_base, cursor, in6_cga.cga_pubkey.iov_len);
	336	cursor += in6_cga.cga_pubkey.iov_len;
	337
	338	/* FUTURE: Extension fields */
	339
0a7de745	340	return (ssize_t)(cursor - (caddr_t)output);
39236c6e A	341	}
	342
	343	int
39037602	344	in6_cga_generate(struct in6_cga_prepare *prepare, u_int8_t collisions,
f427ee49	345	struct in6_addr in6, struct ifnet ifp)
39236c6e A	346	{
	347	int error;
	348	const struct iovec *pubkey;
	349
	350	in6_cga_node_lock_assert(LCK_MTX_ASSERT_OWNED);
	351	VERIFY(in6 != NULL);
	352
0a7de745	353	if (prepare == NULL) {
39236c6e	354	prepare = &in6_cga.cga_prepare;
0a7de745	355	} else {
39037602 A	356	prepare->cga_security_level =
39037602 A	357	in6_cga.cga_prepare.cga_security_level;
0a7de745	358	}
39236c6e A	359
	360	pubkey = &in6_cga.cga_pubkey;
	361
	362	if (pubkey->iov_base != NULL) {
f427ee49	363	in6_cga_generate_iid(prepare, pubkey, collisions, in6, ifp);
39236c6e	364	error = 0;
0a7de745	365	} else {
39236c6e	366	error = EADDRNOTAVAIL;
0a7de745	367	}
39236c6e	368
0a7de745	369	return error;
39236c6e A	370	}
	371
	372	/* End of file */