From owner-svn-src-stable-10@freebsd.org Wed Jul 15 21:09:39 2015 Return-Path: Delivered-To: svn-src-stable-10@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 50C7E9A2B7C; Wed, 15 Jul 2015 21:09:39 +0000 (UTC) (envelope-from ae@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2001:1900:2254:2068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 408591A3C; Wed, 15 Jul 2015 21:09:39 +0000 (UTC) (envelope-from ae@FreeBSD.org) Received: from svnmir.geo.freebsd.org ([127.0.1.70]) by repo.freebsd.org (8.14.9/8.14.9) with ESMTP id t6FL9dOR081921; Wed, 15 Jul 2015 21:09:39 GMT (envelope-from ae@FreeBSD.org) Received: (from ae@localhost) by svnmir.geo.freebsd.org (8.14.9/8.14.9/Submit) id t6FL9dAl081920; Wed, 15 Jul 2015 21:09:39 GMT (envelope-from ae@FreeBSD.org) Message-Id: <201507152109.t6FL9dAl081920@svnmir.geo.freebsd.org> X-Authentication-Warning: svnmir.geo.freebsd.org: ae set sender to ae@FreeBSD.org using -f From: "Andrey V. Elsukov" Date: Wed, 15 Jul 2015 21:09:39 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-10@freebsd.org Subject: svn commit: r285614 - stable/10/sys/netipsec X-SVN-Group: stable-10 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-stable-10@freebsd.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: SVN commit messages for only the 10-stable src tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 15 Jul 2015 21:09:39 -0000 Author: ae Date: Wed Jul 15 21:09:38 2015 New Revision: 285614 URL: https://svnweb.freebsd.org/changeset/base/285614 Log: MFC r285204: Fill the port and protocol information in the SADB_ACQUIRE message in case when security policy has it as required by RFC 2367. PR: 192774 Approved by: re (delphij) Modified: stable/10/sys/netipsec/key.c Directory Properties: stable/10/ (props changed) Modified: stable/10/sys/netipsec/key.c ============================================================================== --- stable/10/sys/netipsec/key.c Wed Jul 15 19:38:14 2015 (r285613) +++ stable/10/sys/netipsec/key.c Wed Jul 15 21:09:38 2015 (r285614) @@ -6149,16 +6149,21 @@ key_getprop(const struct secasindex *sai static int key_acquire(const struct secasindex *saidx, struct secpolicy *sp) { - struct mbuf *result = NULL, *m; + union sockaddr_union addr; + struct mbuf *result, *m; struct secacq *newacq; - u_int8_t satype; - int error = -1; u_int32_t seq; + int error; + u_int16_t ul_proto; + u_int8_t mask, satype; IPSEC_ASSERT(saidx != NULL, ("null saidx")); satype = key_proto2satype(saidx->proto); IPSEC_ASSERT(satype != 0, ("null satype, protocol %u", saidx->proto)); + error = -1; + result = NULL; + ul_proto = IPSEC_ULPROTO_ANY; /* * We never do anything about acquirng SA. There is anather * solution that kernel blocks to send SADB_ACQUIRE message until @@ -6195,17 +6200,64 @@ key_acquire(const struct secasindex *sai * anything related to NAT-T at this time. */ - /* set sadb_address for saidx's. */ - m = key_setsadbaddr(SADB_EXT_ADDRESS_SRC, - &saidx->src.sa, FULLMASK, IPSEC_ULPROTO_ANY); + /* + * set sadb_address for saidx's. + * + * Note that if sp is supplied, then we're being called from + * key_checkrequest and should supply port and protocol information. + */ + if (sp != NULL && (sp->spidx.ul_proto == IPPROTO_TCP || + sp->spidx.ul_proto == IPPROTO_UDP)) + ul_proto = sp->spidx.ul_proto; + + addr = saidx->src; + mask = FULLMASK; + if (ul_proto != IPSEC_ULPROTO_ANY) { + switch (sp->spidx.src.sa.sa_family) { + case AF_INET: + if (sp->spidx.src.sin.sin_port != IPSEC_PORT_ANY) { + addr.sin.sin_port = sp->spidx.src.sin.sin_port; + mask = sp->spidx.prefs; + } + break; + case AF_INET6: + if (sp->spidx.src.sin6.sin6_port != IPSEC_PORT_ANY) { + addr.sin6.sin6_port = sp->spidx.src.sin6.sin6_port; + mask = sp->spidx.prefs; + } + break; + default: + break; + } + } + m = key_setsadbaddr(SADB_EXT_ADDRESS_SRC, &addr.sa, mask, ul_proto); if (!m) { error = ENOBUFS; goto fail; } m_cat(result, m); - m = key_setsadbaddr(SADB_EXT_ADDRESS_DST, - &saidx->dst.sa, FULLMASK, IPSEC_ULPROTO_ANY); + addr = saidx->dst; + mask = FULLMASK; + if (ul_proto != IPSEC_ULPROTO_ANY) { + switch (sp->spidx.dst.sa.sa_family) { + case AF_INET: + if (sp->spidx.dst.sin.sin_port != IPSEC_PORT_ANY) { + addr.sin.sin_port = sp->spidx.dst.sin.sin_port; + mask = sp->spidx.prefd; + } + break; + case AF_INET6: + if (sp->spidx.dst.sin6.sin6_port != IPSEC_PORT_ANY) { + addr.sin6.sin6_port = sp->spidx.dst.sin6.sin6_port; + mask = sp->spidx.prefd; + } + break; + default: + break; + } + } + m = key_setsadbaddr(SADB_EXT_ADDRESS_DST, &addr.sa, mask, ul_proto); if (!m) { error = ENOBUFS; goto fail;