* SADB_SPDDELETE processing * receive * * from the user(?), and set SADB_SASTATE_DEAD, * and send, * * to the ikmpd. * policy(*) including direction of policy. * * m will always be freed. */
| 2156 | * m will always be freed. |
| 2157 | */ |
| 2158 | static int |
| 2159 | key_spddelete(struct socket *so, struct mbuf *m, |
| 2160 | const struct sadb_msghdr *mhp) |
| 2161 | { |
| 2162 | struct secpolicyindex spidx; |
| 2163 | struct sadb_address *src0, *dst0; |
| 2164 | struct sadb_x_policy *xpl0; |
| 2165 | struct secpolicy *sp; |
| 2166 | |
| 2167 | IPSEC_ASSERT(so != NULL, ("null so")); |
| 2168 | IPSEC_ASSERT(m != NULL, ("null mbuf")); |
| 2169 | IPSEC_ASSERT(mhp != NULL, ("null msghdr")); |
| 2170 | IPSEC_ASSERT(mhp->msg != NULL, ("null msg")); |
| 2171 | |
| 2172 | if (SADB_CHECKHDR(mhp, SADB_EXT_ADDRESS_SRC) || |
| 2173 | SADB_CHECKHDR(mhp, SADB_EXT_ADDRESS_DST) || |
| 2174 | SADB_CHECKHDR(mhp, SADB_X_EXT_POLICY)) { |
| 2175 | ipseclog((LOG_DEBUG, |
| 2176 | "%s: invalid message: missing required header.\n", |
| 2177 | __func__)); |
| 2178 | return key_senderror(so, m, EINVAL); |
| 2179 | } |
| 2180 | if (SADB_CHECKLEN(mhp, SADB_EXT_ADDRESS_SRC) || |
| 2181 | SADB_CHECKLEN(mhp, SADB_EXT_ADDRESS_DST) || |
| 2182 | SADB_CHECKLEN(mhp, SADB_X_EXT_POLICY)) { |
| 2183 | ipseclog((LOG_DEBUG, |
| 2184 | "%s: invalid message: wrong header size.\n", __func__)); |
| 2185 | return key_senderror(so, m, EINVAL); |
| 2186 | } |
| 2187 | |
| 2188 | src0 = (struct sadb_address *)mhp->ext[SADB_EXT_ADDRESS_SRC]; |
| 2189 | dst0 = (struct sadb_address *)mhp->ext[SADB_EXT_ADDRESS_DST]; |
| 2190 | xpl0 = (struct sadb_x_policy *)mhp->ext[SADB_X_EXT_POLICY]; |
| 2191 | |
| 2192 | /* check the direciton */ |
| 2193 | switch (xpl0->sadb_x_policy_dir) { |
| 2194 | case IPSEC_DIR_INBOUND: |
| 2195 | case IPSEC_DIR_OUTBOUND: |
| 2196 | break; |
| 2197 | default: |
| 2198 | ipseclog((LOG_DEBUG, "%s: invalid SP direction.\n", __func__)); |
| 2199 | return key_senderror(so, m, EINVAL); |
| 2200 | } |
| 2201 | /* Only DISCARD, NONE and IPSEC are allowed */ |
| 2202 | if (xpl0->sadb_x_policy_type != IPSEC_POLICY_DISCARD && |
| 2203 | xpl0->sadb_x_policy_type != IPSEC_POLICY_NONE && |
| 2204 | xpl0->sadb_x_policy_type != IPSEC_POLICY_IPSEC) { |
| 2205 | ipseclog((LOG_DEBUG, "%s: invalid policy type.\n", __func__)); |
| 2206 | return key_senderror(so, m, EINVAL); |
| 2207 | } |
| 2208 | if (key_checksockaddrs((struct sockaddr *)(src0 + 1), |
| 2209 | (struct sockaddr *)(dst0 + 1)) != 0 || |
| 2210 | src0->sadb_address_proto != dst0->sadb_address_proto) { |
| 2211 | ipseclog((LOG_DEBUG, "%s: invalid sockaddr.\n", __func__)); |
| 2212 | return key_senderror(so, m, EINVAL); |
| 2213 | } |
| 2214 | /* make secindex */ |
| 2215 | KEY_SETSECSPIDX(xpl0->sadb_x_policy_dir, |
nothing calls this directly
no test coverage detected