pfkey_v2_parser.c

网上下到的一个很详细介绍VPN基础知识的资料

/*
 * RFC2367 PF_KEYv2 Key management API message parser
 * Copyright (C) 1999, 2000, 2001  Richard Guy Briggs.
 * 
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the
 * Free Software Foundation; either version 2 of the License, or (at your
 * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
 * 
 * This program is distributed in the hope that it will be useful, but
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * for more details.
 *
 * RCSID $Id: pfkey_v2_parser.c,v 1.85 2001/06/15 04:57:02 rgb Exp $
 */

/*
 *		Template from klips/net/ipsec/ipsec/ipsec_netlink.c.
 */

char pfkey_v2_parser_c_version[] = "$Id: pfkey_v2_parser.c,v 1.85 2001/06/15 04:57:02 rgb Exp $";

#include <linux/config.h>
#include <linux/version.h>

#include <linux/kernel.h> /* printk() */
#include <linux/malloc.h> /* kmalloc() */
#include <linux/errno.h>  /* error codes */
#include <linux/types.h>  /* size_t */
#include <linux/interrupt.h> /* mark_bh */

#include <linux/netdevice.h>   /* struct device, and other headers */
#include <linux/etherdevice.h> /* eth_type_trans */
#include <linux/ip.h>          /* struct iphdr */
#include <linux/skbuff.h>
#include <freeswan.h>
#ifdef SPINLOCK
#ifdef SPINLOCK_23
#include <linux/spinlock.h> /* *lock* */
#else /* SPINLOCK_23 */
#include <asm/spinlock.h> /* *lock* */
#endif /* SPINLOCK_23 */
#endif /* SPINLOCK */
#ifdef NET_21
#include <asm/uaccess.h>
#include <linux/in6.h>
#define ip_chk_addr inet_addr_type
#define IS_MYADDR RTN_LOCAL
#endif
#include <asm/checksum.h>
#include <net/ip.h>
#ifdef NETLINK_SOCK
#include <linux/netlink.h>
#else
#include <net/netlink.h>
#endif

#include <linux/random.h>	/* get_random_bytes() */

#include "radij.h"
#include "ipsec_encap.h"
#include "ipsec_radij.h"
#include "ipsec_netlink.h"
#include "ipsec_xform.h"
#include "ipsec_ah.h"
#include "ipsec_esp.h"
#include "ipsec_tunnel.h"
#include "ipsec_rcv.h"
#include "ipcomp.h"

#include <pfkeyv2.h>
#include <pfkey.h>


#define SENDERR(_x) do { error = -(_x); goto errlab; } while (0)

#ifndef min
#define min(a,b)	(((a)<(b))?(a):(b))
#endif

extern int des_set_key(caddr_t, caddr_t);

struct sklist_t {
	struct socket *sk;
	struct sklist_t* next;
} pfkey_sklist_head, *pfkey_sklist, *pfkey_sklist_prev;

__u32 pfkey_msg_seq = 0;

DEBUG_NO_STATIC int
pfkey_alloc_tdb(struct tdb** tdb)
{
	int error = 0;
	if(*tdb) {
		KLIPS_PRINT(debug_pfkey,
			    "klips_debug:pfkey_alloc_tdb: "
			    "tdb struct already allocated\n");
		SENDERR(EEXIST);
	}

	if((*tdb = kmalloc(sizeof(**tdb), GFP_ATOMIC) ) == NULL) {
		KLIPS_PRINT(debug_pfkey,
			    "klips_debug:pfkey_alloc_tdb: "
			    "memory allocation error\n");
		SENDERR(ENOMEM);
	}
	KLIPS_PRINT(debug_pfkey,
		    "klips_debug:pfkey_alloc_tdb: "
		    "allocated tdb struct=%p.\n", tdb);

	memset((caddr_t)*tdb, 0, sizeof(**tdb));
 errlab:
	return(error);
}

DEBUG_NO_STATIC int
pfkey_alloc_eroute(struct eroute** eroute)
{
	int error = 0;
	if(*eroute) {
		KLIPS_PRINT(debug_pfkey,
			    "klips_debug:pfkey_alloc_eroute: "
			    "eroute struct already allocated\n");
		SENDERR(EEXIST);
	}

	if((*eroute = kmalloc(sizeof(**eroute), GFP_ATOMIC) ) == NULL) {
		KLIPS_PRINT(debug_pfkey,
			    "klips_debug:pfkey_alloc_eroute: "
			    "memory allocation error\n");
		SENDERR(ENOMEM);
	}
	KLIPS_PRINT(debug_pfkey,
		    "klips_debug:pfkey_alloc_eroute: "
		    "allocated eroute struct=%p.\n", eroute);
	memset((caddr_t)*eroute, 0, sizeof(**eroute));
	(*eroute)->er_eaddr.sen_len =
		(*eroute)->er_emask.sen_len = sizeof(struct sockaddr_encap);
	(*eroute)->er_eaddr.sen_family =
		(*eroute)->er_emask.sen_family = AF_ENCAP;
	(*eroute)->er_eaddr.sen_type = SENT_IP4;
	(*eroute)->er_emask.sen_type = 255;
	(*eroute)->er_pid = 0;
	(*eroute)->er_count = 0;
	(*eroute)->er_lasttime = jiffies/HZ;

 errlab:
	return(error);
}

DEBUG_NO_STATIC int
pfkey_sa_process(struct sadb_ext *pfkey_ext, struct pfkey_extracted_data* extr)
{
	struct sadb_sa *pfkey_sa = (struct sadb_sa *)pfkey_ext;
	int error = 0;
	struct tdb* tdbp;
	
	KLIPS_PRINT(debug_pfkey,
		    "klips_debug:pfkey_sa_process: .\n");

	if(!extr || !extr->tdb) {
		KLIPS_PRINT(debug_pfkey,
			    "klips_debug:pfkey_sa_process: "
			    "extr or extr->tdb is NULL, fatal\n");
		SENDERR(EINVAL);
	}

	switch(pfkey_ext->sadb_ext_type) {
	case SADB_EXT_SA:
		tdbp = extr->tdb;
		break;
	case SADB_X_EXT_SA2:
		if(pfkey_alloc_tdb(&(extr->tdb2)) == ENOMEM) {
			SENDERR(ENOMEM);
		}
		tdbp = extr->tdb2;
		break;
	default:
		KLIPS_PRINT(debug_pfkey,
			    "klips_debug:pfkey_sa_process: "
			    "invalid exttype=%d.\n",
			    pfkey_ext->sadb_ext_type);
		SENDERR(EINVAL);
	}

	tdbp->tdb_said.spi = pfkey_sa->sadb_sa_spi;
	tdbp->tdb_replaywin = pfkey_sa->sadb_sa_replay;
	tdbp->tdb_state = pfkey_sa->sadb_sa_state;
	tdbp->tdb_flags = pfkey_sa->sadb_sa_flags;
	tdbp->tdb_replaywin_lastseq = tdbp->tdb_replaywin_bitmap = 0;
	
	switch(tdbp->tdb_said.proto) {
	case IPPROTO_AH:
		tdbp->tdb_authalg = pfkey_sa->sadb_sa_auth;
		tdbp->tdb_encalg = SADB_EALG_NONE;
		break;
	case IPPROTO_ESP:
		tdbp->tdb_authalg = pfkey_sa->sadb_sa_auth;
		tdbp->tdb_encalg = pfkey_sa->sadb_sa_encrypt;
		break;
	case IPPROTO_IPIP:
		tdbp->tdb_authalg = AH_NONE;
		tdbp->tdb_encalg = ESP_NONE;
		break;
#ifdef CONFIG_IPSEC_IPCOMP
	case IPPROTO_COMP:
		tdbp->tdb_authalg = AH_NONE;
		tdbp->tdb_encalg = pfkey_sa->sadb_sa_encrypt;
		break;
#endif /* CONFIG_IPSEC_IPCOMP */
	case IPPROTO_INT:
		tdbp->tdb_authalg = AH_NONE;
		tdbp->tdb_encalg = ESP_NONE;
		break;
	case 0:
		break;
	default:
		KLIPS_PRINT(debug_pfkey,
			    "klips_debug:pfkey_sa_process: "
			    "unknown proto=%d.\n",
			    tdbp->tdb_said.proto);
		SENDERR(EINVAL);
	}

errlab:
	return error;
}

DEBUG_NO_STATIC int
pfkey_lifetime_process(struct sadb_ext *pfkey_ext, struct pfkey_extracted_data* extr)
{
	int error = 0;
	struct sadb_lifetime *pfkey_lifetime = (struct sadb_lifetime *)pfkey_ext;

	KLIPS_PRINT(debug_pfkey,
		    "klips_debug:pfkey_lifetime_process: .\n");

	if(!extr || !extr->tdb) {
		KLIPS_PRINT(debug_pfkey,
			    "klips_debug:pfkey_lifetime_process: "
			    "extr or extr->tdb is NULL, fatal\n");
		SENDERR(EINVAL);
	}

	switch(pfkey_lifetime->sadb_lifetime_exttype) {
	case SADB_EXT_LIFETIME_CURRENT:
		KLIPS_PRINT(debug_pfkey,
			    "klips_debug:pfkey_lifetime_process: "
			    "lifetime_current not supported yet.\n");
  		SENDERR(EINVAL);
  		break;
	case SADB_EXT_LIFETIME_HARD:
		if(pfkey_lifetime->sadb_lifetime_allocations &&
		   (!extr->tdb->tdb_lifetime_allocations_h ||
		    (pfkey_lifetime->sadb_lifetime_allocations < extr->tdb->tdb_lifetime_allocations_h))) {
			extr->tdb->tdb_lifetime_allocations_h =
				pfkey_lifetime->sadb_lifetime_allocations;
			if(!extr->tdb->tdb_lifetime_allocations_s &&
			   (extr->tdb->tdb_lifetime_allocations_h < extr->tdb->tdb_lifetime_allocations_s)) {
				extr->tdb->tdb_lifetime_allocations_s = extr->tdb->tdb_lifetime_allocations_h;
			}
		}
		if(pfkey_lifetime->sadb_lifetime_bytes &&
		   (!extr->tdb->tdb_lifetime_bytes_h ||
		    (pfkey_lifetime->sadb_lifetime_bytes < extr->tdb->tdb_lifetime_bytes_h))) {
			extr->tdb->tdb_lifetime_bytes_h =
				pfkey_lifetime->sadb_lifetime_bytes;
			if(!extr->tdb->tdb_lifetime_bytes_s &&
			   (extr->tdb->tdb_lifetime_bytes_h < extr->tdb->tdb_lifetime_bytes_s)) {
				extr->tdb->tdb_lifetime_bytes_s = extr->tdb->tdb_lifetime_bytes_h;
			}
		}
		if(pfkey_lifetime->sadb_lifetime_addtime &&
		   (!extr->tdb->tdb_lifetime_addtime_h ||
		    (pfkey_lifetime->sadb_lifetime_addtime < extr->tdb->tdb_lifetime_addtime_h))) {
			extr->tdb->tdb_lifetime_addtime_h =
				pfkey_lifetime->sadb_lifetime_addtime;
			if(extr->tdb->tdb_lifetime_addtime_s &&
			   (extr->tdb->tdb_lifetime_addtime_h < extr->tdb->tdb_lifetime_addtime_s)) {
				extr->tdb->tdb_lifetime_addtime_s = extr->tdb->tdb_lifetime_addtime_h;
			}
		}
		if(pfkey_lifetime->sadb_lifetime_usetime &&
		   (!extr->tdb->tdb_lifetime_usetime_h ||
		    (pfkey_lifetime->sadb_lifetime_usetime < extr->tdb->tdb_lifetime_usetime_h))) {
			extr->tdb->tdb_lifetime_usetime_h =
				pfkey_lifetime->sadb_lifetime_usetime;
			if(extr->tdb->tdb_lifetime_usetime_s &&
			   (extr->tdb->tdb_lifetime_usetime_h < extr->tdb->tdb_lifetime_usetime_s)) {
				extr->tdb->tdb_lifetime_usetime_s = extr->tdb->tdb_lifetime_usetime_h;
			}
		}
		break;
	case SADB_EXT_LIFETIME_SOFT:
		if(pfkey_lifetime->sadb_lifetime_allocations &&
		   (!extr->tdb->tdb_lifetime_allocations_s ||
		    (pfkey_lifetime->sadb_lifetime_allocations < extr->tdb->tdb_lifetime_allocations_s))) {
			extr->tdb->tdb_lifetime_allocations_s =
				pfkey_lifetime->sadb_lifetime_allocations;
			if(extr->tdb->tdb_lifetime_allocations_h &&
			   (extr->tdb->tdb_lifetime_allocations_h < extr->tdb->tdb_lifetime_allocations_s)) {
				extr->tdb->tdb_lifetime_allocations_s = extr->tdb->tdb_lifetime_allocations_h;
			}
		}
		if(pfkey_lifetime->sadb_lifetime_bytes &&
		   (!extr->tdb->tdb_lifetime_bytes_s ||
		    (pfkey_lifetime->sadb_lifetime_bytes < extr->tdb->tdb_lifetime_bytes_s))) {
			extr->tdb->tdb_lifetime_bytes_s =
				pfkey_lifetime->sadb_lifetime_bytes;
			if(extr->tdb->tdb_lifetime_bytes_h &&
			   (extr->tdb->tdb_lifetime_bytes_h < extr->tdb->tdb_lifetime_bytes_s)) {
				extr->tdb->tdb_lifetime_bytes_s = extr->tdb->tdb_lifetime_bytes_h;
			}
		}
		if(pfkey_lifetime->sadb_lifetime_addtime &&
		   (!extr->tdb->tdb_lifetime_addtime_s ||
		    (pfkey_lifetime->sadb_lifetime_addtime < extr->tdb->tdb_lifetime_addtime_s))) {
			extr->tdb->tdb_lifetime_addtime_s =
				pfkey_lifetime->sadb_lifetime_addtime;
			if(extr->tdb->tdb_lifetime_addtime_h &&
			   (extr->tdb->tdb_lifetime_addtime_h < extr->tdb->tdb_lifetime_addtime_s)) {
				extr->tdb->tdb_lifetime_addtime_s = extr->tdb->tdb_lifetime_addtime_h;
			}
		}
		if(pfkey_lifetime->sadb_lifetime_usetime &&
		   (!extr->tdb->tdb_lifetime_usetime_s ||
		    (pfkey_lifetime->sadb_lifetime_usetime < extr->tdb->tdb_lifetime_usetime_s))) {
			extr->tdb->tdb_lifetime_usetime_s =
				pfkey_lifetime->sadb_lifetime_usetime;
			if(extr->tdb->tdb_lifetime_usetime_h &&
			   (extr->tdb->tdb_lifetime_usetime_h < extr->tdb->tdb_lifetime_usetime_s)) {
				extr->tdb->tdb_lifetime_usetime_s = extr->tdb->tdb_lifetime_usetime_h;
			}
		}
		break;
	default:
		KLIPS_PRINT(debug_pfkey,
			    "klips_debug:pfkey_lifetime_process: "
			    "invalid exttype=%d.\n",
			    pfkey_ext->sadb_ext_type);
		SENDERR(EINVAL);
	}

errlab:
	return error;
}

DEBUG_NO_STATIC int
pfkey_address_process(struct sadb_ext *pfkey_ext, struct pfkey_extracted_data* extr)
{
	int error = 0;
	int saddr_len = 0;
	char ipaddr_txt[ADDRTOA_BUF];
	unsigned char **sap;
	struct sadb_address *pfkey_address = (struct sadb_address *)pfkey_ext;
	struct sockaddr* s = (struct sockaddr*)((char*)pfkey_address + sizeof(*pfkey_address));
	struct tdb* tdbp;
	
	KLIPS_PRINT(debug_pfkey,
		    "klips_debug:pfkey_address_process:\n");
	
	if(!extr || !extr->tdb) {
		KLIPS_PRINT(debug_pfkey,
			    "klips_debug:pfkey_address_process: "
			    "extr or extr->tdb is NULL, fatal\n");
		SENDERR(EINVAL);
	}

	switch(s->sa_family) {
	case AF_INET:
		saddr_len = sizeof(struct sockaddr_in);
		addrtoa(((struct sockaddr_in*)s)->sin_addr, 0, ipaddr_txt, sizeof(ipaddr_txt));
		KLIPS_PRINT(debug_pfkey,
			    "klips_debug:pfkey_address_process: "
			    "found address family=%d, AF_INET, %s.\n",
			    s->sa_family,
			    ipaddr_txt);
		break;
#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
	case AF_INET6:
		saddr_len = sizeof(struct sockaddr_in6);
		break;
#endif /* defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) */
	default:
		KLIPS_PRINT(debug_pfkey,
			    "klips_debug:pfkey_address_process: "
			    "s->sa_family=%d not supported.\n",
			    s->sa_family);
		SENDERR(EPFNOSUPPORT);
	}
	
	switch(pfkey_address->sadb_address_exttype) {
	case SADB_EXT_ADDRESS_SRC:
		KLIPS_PRINT(debug_pfkey,
			    "klips_debug:pfkey_address_process: "
			    "found src address.\n");
		sap = (unsigned char **)&(extr->tdb->tdb_addr_s);
		extr->tdb->tdb_addr_s_size = saddr_len;
		break;
	case SADB_EXT_ADDRESS_DST:
		KLIPS_PRINT(debug_pfkey,
			    "klips_debug:pfkey_address_process: "
			    "found dst address.\n");
		sap = (unsigned char **)&(extr->tdb->tdb_addr_d);
		extr->tdb->tdb_addr_d_size = saddr_len;
		break;
	case SADB_EXT_ADDRESS_PROXY:
		KLIPS_PRINT(debug_pfkey,
			    "klips_debug:pfkey_address_process: "
			    "found proxy address.\n");
		sap = (unsigned char **)&(extr->tdb->tdb_addr_p);
		extr->tdb->tdb_addr_p_size = saddr_len;
		break;
	case SADB_X_EXT_ADDRESS_DST2:
		KLIPS_PRINT(debug_pfkey,
			    "klips_debug:pfkey_address_process: "
			    "found 2nd dst address.\n");
		if(pfkey_alloc_tdb(&(extr->tdb2)) == ENOMEM) {
			SENDERR(ENOMEM);