* SADB_GET processing * receive * * from the ikmpd, and get a SP and a SA to respond, * and send, * * to the ikmpd. * * m will always be freed. */
| 6169 | * m will always be freed. |
| 6170 | */ |
| 6171 | static int |
| 6172 | key_get(struct socket *so, struct mbuf *m, const struct sadb_msghdr *mhp) |
| 6173 | { |
| 6174 | struct secasindex saidx; |
| 6175 | struct sadb_address *src0, *dst0; |
| 6176 | struct sadb_sa *sa0; |
| 6177 | struct secasvar *sav; |
| 6178 | uint8_t proto; |
| 6179 | |
| 6180 | IPSEC_ASSERT(so != NULL, ("null socket")); |
| 6181 | IPSEC_ASSERT(m != NULL, ("null mbuf")); |
| 6182 | IPSEC_ASSERT(mhp != NULL, ("null msghdr")); |
| 6183 | IPSEC_ASSERT(mhp->msg != NULL, ("null msg")); |
| 6184 | |
| 6185 | /* map satype to proto */ |
| 6186 | if ((proto = key_satype2proto(mhp->msg->sadb_msg_satype)) == 0) { |
| 6187 | ipseclog((LOG_DEBUG, "%s: invalid satype is passed.\n", |
| 6188 | __func__)); |
| 6189 | return key_senderror(so, m, EINVAL); |
| 6190 | } |
| 6191 | |
| 6192 | if (SADB_CHECKHDR(mhp, SADB_EXT_SA) || |
| 6193 | SADB_CHECKHDR(mhp, SADB_EXT_ADDRESS_SRC) || |
| 6194 | SADB_CHECKHDR(mhp, SADB_EXT_ADDRESS_DST)) { |
| 6195 | ipseclog((LOG_DEBUG, |
| 6196 | "%s: invalid message: missing required header.\n", |
| 6197 | __func__)); |
| 6198 | return key_senderror(so, m, EINVAL); |
| 6199 | } |
| 6200 | if (SADB_CHECKLEN(mhp, SADB_EXT_SA) || |
| 6201 | SADB_CHECKLEN(mhp, SADB_EXT_ADDRESS_SRC) || |
| 6202 | SADB_CHECKLEN(mhp, SADB_EXT_ADDRESS_DST)) { |
| 6203 | ipseclog((LOG_DEBUG, |
| 6204 | "%s: invalid message: wrong header size.\n", __func__)); |
| 6205 | return key_senderror(so, m, EINVAL); |
| 6206 | } |
| 6207 | |
| 6208 | sa0 = (struct sadb_sa *)mhp->ext[SADB_EXT_SA]; |
| 6209 | src0 = (struct sadb_address *)mhp->ext[SADB_EXT_ADDRESS_SRC]; |
| 6210 | dst0 = (struct sadb_address *)mhp->ext[SADB_EXT_ADDRESS_DST]; |
| 6211 | |
| 6212 | if (key_checksockaddrs((struct sockaddr *)(src0 + 1), |
| 6213 | (struct sockaddr *)(dst0 + 1)) != 0) { |
| 6214 | ipseclog((LOG_DEBUG, "%s: invalid sockaddr.\n", __func__)); |
| 6215 | return key_senderror(so, m, EINVAL); |
| 6216 | } |
| 6217 | KEY_SETSECASIDX(proto, IPSEC_MODE_ANY, 0, src0 + 1, dst0 + 1, &saidx); |
| 6218 | |
| 6219 | if (proto == IPPROTO_TCP) |
| 6220 | sav = key_getsav_tcpmd5(&saidx, NULL); |
| 6221 | else |
| 6222 | sav = key_getsavbyspi(sa0->sadb_sa_spi); |
| 6223 | if (sav == NULL) { |
| 6224 | ipseclog((LOG_DEBUG, "%s: no SA found.\n", __func__)); |
| 6225 | return key_senderror(so, m, ESRCH); |
| 6226 | } |
| 6227 | if (key_cmpsaidx(&sav->sah->saidx, &saidx, CMP_HEAD) == 0) { |
| 6228 | ipseclog((LOG_DEBUG, "%s: saidx mismatched for SPI %u.\n", |
nothing calls this directly
no test coverage detected