Function key_add

freebsd/netipsec/key.c:5522–5662

* SADB_ADD processing * add an entry to SA database, when received * * from the ikmpd, * and send * * to the ikmpd. * * IGNORE identity and sensitivity messages. * * m will

 * m will always be freed.
 */
static int
key_add(struct socket *so, struct mbuf *m, const struct sadb_msghdr *mhp)
{
	struct secasindex saidx;
	struct sadb_address *src0, *dst0;
	struct sadb_sa *sa0;
	struct secasvar *sav;
	uint32_t reqid, spi;
	uint8_t mode, proto;
	int error;

	IPSEC_ASSERT(so != NULL, ("null socket"));
	IPSEC_ASSERT(m != NULL, ("null mbuf"));
	IPSEC_ASSERT(mhp != NULL, ("null msghdr"));
	IPSEC_ASSERT(mhp->msg != NULL, ("null msg"));

	/* map satype to proto */
	if ((proto = key_satype2proto(mhp->msg->sadb_msg_satype)) == 0) {
		ipseclog((LOG_DEBUG, "%s: invalid satype is passed.\n",
		    __func__));
		return key_senderror(so, m, EINVAL);
	}

	if (SADB_CHECKHDR(mhp, SADB_EXT_SA) ||
	    SADB_CHECKHDR(mhp, SADB_EXT_ADDRESS_SRC) ||
	    SADB_CHECKHDR(mhp, SADB_EXT_ADDRESS_DST) ||
	    (mhp->msg->sadb_msg_satype == SADB_SATYPE_ESP && (
		SADB_CHECKHDR(mhp, SADB_EXT_KEY_ENCRYPT) ||
		SADB_CHECKLEN(mhp, SADB_EXT_KEY_ENCRYPT))) ||
	    (mhp->msg->sadb_msg_satype == SADB_SATYPE_AH && (
		SADB_CHECKHDR(mhp, SADB_EXT_KEY_AUTH) ||
		SADB_CHECKLEN(mhp, SADB_EXT_KEY_AUTH))) ||
	    (SADB_CHECKHDR(mhp, SADB_EXT_LIFETIME_HARD) &&
		!SADB_CHECKHDR(mhp, SADB_EXT_LIFETIME_SOFT)) ||
	    (SADB_CHECKHDR(mhp, SADB_EXT_LIFETIME_SOFT) &&
		!SADB_CHECKHDR(mhp, SADB_EXT_LIFETIME_HARD))) {
		ipseclog((LOG_DEBUG,
		    "%s: invalid message: missing required header.\n",
		    __func__));
		return key_senderror(so, m, EINVAL);
	}
	if (SADB_CHECKLEN(mhp, SADB_EXT_SA) ||
	    SADB_CHECKLEN(mhp, SADB_EXT_ADDRESS_SRC) ||
	    SADB_CHECKLEN(mhp, SADB_EXT_ADDRESS_DST)) {
		ipseclog((LOG_DEBUG,
		    "%s: invalid message: wrong header size.\n", __func__));
		return key_senderror(so, m, EINVAL);
	}
	if (SADB_CHECKHDR(mhp, SADB_X_EXT_SA2)) {
		mode = IPSEC_MODE_ANY;
		reqid = 0;
	} else {
		if (SADB_CHECKLEN(mhp, SADB_X_EXT_SA2)) {
			ipseclog((LOG_DEBUG,
			    "%s: invalid message: wrong header size.\n",
			    __func__));
			return key_senderror(so, m, EINVAL);
		}