From e2445bb257244fdfe609927f10d85037dd1953a5 Mon Sep 17 00:00:00 2001 From: bms Date: Sat, 3 Apr 2004 05:31:38 +0000 Subject: This file was erroneously removed from HEAD when TCP-MD5 support was MFC'd; correct this lameness. --- sys/netipsec/xform_tcp.c | 169 +++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 169 insertions(+) create mode 100644 sys/netipsec/xform_tcp.c (limited to 'sys/netipsec') diff --git a/sys/netipsec/xform_tcp.c b/sys/netipsec/xform_tcp.c new file mode 100644 index 0000000..e505596 --- /dev/null +++ b/sys/netipsec/xform_tcp.c @@ -0,0 +1,169 @@ +/* $FreeBSD$ */ + +/* + * Copyright (c) 2003 Bruce M. Simpson + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * 3. The name of the author may not be used to endorse or promote products + * derived from this software without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR + * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES + * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. + * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, + * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT + * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, + * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY + * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT + * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF + * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + */ + +/* TCP MD5 Signature Option (RFC2385) */ +#include "opt_inet.h" +#include "opt_inet6.h" + +#include +#include +#include +#include +#include +#include +#include +#include + +#include +#include +#include +#include +#include +#include + +#include +#include +#include + +#ifdef INET6 +#include +#include +#endif + +#include +#include + +/* + * Initialize a TCP-MD5 SA. Called when the SA is being set up. + * + * We don't need to set up the tdb prefixed fields, as we don't use the + * opencrypto code; we just perform a key length check. + * + * XXX: Currently we only allow a single 'magic' SPI to be used. + * + * This allows per-host granularity without affecting the userland + * interface, which is a simple socket option toggle switch, + * TCP_SIGNATURE_ENABLE. + * + * To allow per-service granularity requires that we have a means + * of mapping port to SPI. The mandated way of doing this is to + * use SPD entries to specify packet flows which get the TCP-MD5 + * treatment, however the code to do this is currently unstable + * and unsuitable for production use. + * + * Therefore we use this compromise in the meantime. + */ +static int +tcpsignature_init(struct secasvar *sav, struct xformsw *xsp) +{ + int keylen; + + if (sav->spi != htonl(TCP_SIG_SPI)) { + DPRINTF(("%s: SPI must be TCP_SIG_SPI (0x1000)\n", + __func__, sav->alg_auth)); + return (EINVAL); + } + if (sav->alg_auth != SADB_X_AALG_TCP_MD5) { + DPRINTF(("%s: unsupported authentication algorithm %u\n", + __func__, sav->alg_auth)); + return (EINVAL); + } + if (sav->key_auth == NULL) { + DPRINTF(("%s: no authentication key present\n", __func__)); + return (EINVAL); + } + keylen = _KEYLEN(sav->key_auth); + if ((keylen < TCP_KEYLEN_MIN) || (keylen > TCP_KEYLEN_MAX)) { + DPRINTF(("%s: invalid key length %u\n", __func__, keylen)); + return (EINVAL); + } + + return (0); +} + +/* + * Paranoia. + * + * Called when the SA is deleted. + */ +static int +tcpsignature_zeroize(struct secasvar *sav) +{ + + if (sav->key_auth) + bzero(_KEYBUF(sav->key_auth), _KEYLEN(sav->key_auth)); + + sav->tdb_cryptoid = 0; + sav->tdb_authalgxform = NULL; + sav->tdb_xform = NULL; + + return (0); +} + +/* + * Verify that an input packet passes authentication. + * Called from the ipsec layer. + * We do this from within tcp itself, so this routine is just a stub. + */ +static int +tcpsignature_input(struct mbuf *m, struct secasvar *sav, int skip, + int protoff) +{ + + return (0); +} + +/* + * Prepend the authentication header. + * Called from the ipsec layer. + * We do this from within tcp itself, so this routine is just a stub. + */ +static int +tcpsignature_output(struct mbuf *m, struct ipsecrequest *isr, + struct mbuf **mp, int skip, int protoff) +{ + + return (EINVAL); +} + +static struct xformsw tcpsignature_xformsw = { + XF_TCPSIGNATURE, XFT_AUTH, "TCPMD5", + tcpsignature_init, tcpsignature_zeroize, + tcpsignature_input, tcpsignature_output +}; + +static void +tcpsignature_attach(void) +{ + + xform_register(&tcpsignature_xformsw); +} + +SYSINIT(tcpsignature_xform_init, SI_SUB_DRIVERS, SI_ORDER_FIRST, + tcpsignature_attach, NULL) -- cgit v1.1