| 5110 | } |
| 5111 | |
| 5112 | static int |
| 5113 | key_updateaddresses(struct socket *so, struct mbuf *m, |
| 5114 | const struct sadb_msghdr *mhp, struct secasvar *sav, |
| 5115 | struct secasindex *saidx) |
| 5116 | { |
| 5117 | struct sockaddr *newaddr; |
| 5118 | struct secashead *sah; |
| 5119 | struct secasvar *newsav, *tmp; |
| 5120 | struct mbuf *n; |
| 5121 | int error, isnew; |
| 5122 | |
| 5123 | /* Check that we need to change SAH */ |
| 5124 | if (!SADB_CHECKHDR(mhp, SADB_X_EXT_NEW_ADDRESS_SRC)) { |
| 5125 | newaddr = (struct sockaddr *)( |
| 5126 | ((struct sadb_address *) |
| 5127 | mhp->ext[SADB_X_EXT_NEW_ADDRESS_SRC]) + 1); |
| 5128 | bcopy(newaddr, &saidx->src, newaddr->sa_len); |
| 5129 | key_porttosaddr(&saidx->src.sa, 0); |
| 5130 | } |
| 5131 | if (!SADB_CHECKHDR(mhp, SADB_X_EXT_NEW_ADDRESS_DST)) { |
| 5132 | newaddr = (struct sockaddr *)( |
| 5133 | ((struct sadb_address *) |
| 5134 | mhp->ext[SADB_X_EXT_NEW_ADDRESS_DST]) + 1); |
| 5135 | bcopy(newaddr, &saidx->dst, newaddr->sa_len); |
| 5136 | key_porttosaddr(&saidx->dst.sa, 0); |
| 5137 | } |
| 5138 | if (!SADB_CHECKHDR(mhp, SADB_X_EXT_NEW_ADDRESS_SRC) || |
| 5139 | !SADB_CHECKHDR(mhp, SADB_X_EXT_NEW_ADDRESS_DST)) { |
| 5140 | error = key_checksockaddrs(&saidx->src.sa, &saidx->dst.sa); |
| 5141 | if (error != 0) { |
| 5142 | ipseclog((LOG_DEBUG, "%s: invalid new sockaddr.\n", |
| 5143 | __func__)); |
| 5144 | return (error); |
| 5145 | } |
| 5146 | |
| 5147 | sah = key_getsah(saidx); |
| 5148 | if (sah == NULL) { |
| 5149 | /* create a new SA index */ |
| 5150 | sah = key_newsah(saidx); |
| 5151 | if (sah == NULL) { |
| 5152 | ipseclog((LOG_DEBUG, |
| 5153 | "%s: No more memory.\n", __func__)); |
| 5154 | return (ENOBUFS); |
| 5155 | } |
| 5156 | isnew = 2; /* SAH is new */ |
| 5157 | } else |
| 5158 | isnew = 1; /* existing SAH is referenced */ |
| 5159 | } else { |
| 5160 | /* |
| 5161 | * src and dst addresses are still the same. |
| 5162 | * Do we want to change NAT-T config? |
| 5163 | */ |
| 5164 | if (sav->sah->saidx.proto != IPPROTO_ESP || |
| 5165 | SADB_CHECKHDR(mhp, SADB_X_EXT_NAT_T_TYPE) || |
| 5166 | SADB_CHECKHDR(mhp, SADB_X_EXT_NAT_T_SPORT) || |
| 5167 | SADB_CHECKHDR(mhp, SADB_X_EXT_NAT_T_DPORT)) { |
| 5168 | ipseclog((LOG_DEBUG, |
| 5169 | "%s: invalid message: missing required header.\n", |
no test coverage detected