Use a reference-counted structure for IPsec IDs and credentials, so we

can cheaply keep copies of them at the PCB. ok deraadt@

4 files changed, 81 insertions, 57 deletions

diff --git a/sys/netinet/in_pcb.c b/sys/netinet/in_pcb.c
index ef54a590596..88b6d935cb5 100644
--- a/sys/netinet/in_pcb.c
+++ b/sys/netinet/in_pcb.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: in_pcb.c,v 1.50 2001/03/28 20:03:02 angelos Exp $	*/
+/*	$OpenBSD: in_pcb.c,v 1.51 2001/05/21 03:02:18 angelos Exp $	*/
 /*	$NetBSD: in_pcb.c,v 1.25 1996/02/13 23:41:53 christos Exp $	*/
 
 /*
@@ -560,6 +560,14 @@ in_pcbdetach(v)
 	if (inp->inp_tdb_out)
 	        TAILQ_REMOVE(&inp->inp_tdb_out->tdb_inp_out, inp,
 			     inp_tdb_out_next);
+	if (inp->inp_ipsec_localid)
+		ipsp_reffree(inp->inp_ipsec_localid);
+	if (inp->inp_ipsec_remoteid)
+		ipsp_reffree(inp->inp_ipsec_remoteid);
+	if (inp->inp_ipsec_localcred)
+		ipsp_reffree(inp->inp_ipsec_localcred);
+	if (inp->inp_ipsec_remotecred)
+		ipsp_reffree(inp->inp_ipsec_remotecred);
 	splx(s);
 #endif
 	s = splnet();
diff --git a/sys/netinet/in_pcb.h b/sys/netinet/in_pcb.h
index cdce9721bb9..88722c0e453 100644
--- a/sys/netinet/in_pcb.h
+++ b/sys/netinet/in_pcb.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: in_pcb.h,v 1.33 2001/03/28 20:03:02 angelos Exp $	*/
+/*	$OpenBSD: in_pcb.h,v 1.34 2001/05/21 03:02:18 angelos Exp $	*/
 /*	$NetBSD: in_pcb.h,v 1.14 1996/02/13 23:42:00 christos Exp $	*/
 
 /*
@@ -133,6 +133,10 @@ struct inpcb {
 #define SR_WAIT           3             /* Waiting for SA */
 	TAILQ_ENTRY(inpcb) inp_tdb_in_next, inp_tdb_out_next;
 	struct tdb     *inp_tdb_in, *inp_tdb_out;
+	struct ipsec_ref *inp_ipsec_localid;
+	struct ipsec_ref *inp_ipsec_remoteid;
+	struct ipsec_ref *inp_ipsec_localcred;
+	struct ipsec_ref *inp_ipsec_remotecred;
 #define	inp_flowinfo	inp_hu.hu_ipv6.ip6_flow
 
 	int	in6p_cksum;
diff --git a/sys/netinet/ip_ipsp.c b/sys/netinet/ip_ipsp.c
index 008bd04ff4e..38633950e1f 100644
--- a/sys/netinet/ip_ipsp.c
+++ b/sys/netinet/ip_ipsp.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ip_ipsp.c,v 1.114 2001/05/05 00:31:19 angelos Exp $	*/
+/*	$OpenBSD: ip_ipsp.c,v 1.115 2001/05/21 03:02:19 angelos Exp $	*/
 
 /*
  * The authors of this code are John Ioannidis (ji@tla.org),
@@ -317,10 +317,11 @@ gettdbbyaddr(union sockaddr_union *dst, struct ipsec_policy *ipo,
 	  {
 	      if (ipo->ipo_srcid != NULL)
 	      {
-		  if ((tdbp->tdb_srcid_type != ipo->ipo_srcid_type) ||
-		      (tdbp->tdb_srcid_len != ipo->ipo_srcid_len) ||
-		      (bcmp(tdbp->tdb_srcid, ipo->ipo_srcid,
-			    ipo->ipo_srcid_len)))
+		  if ((tdbp->tdb_srcid->ref_type !=
+		       ipo->ipo_srcid->ref_type) ||
+		      (tdbp->tdb_srcid->ref_len != ipo->ipo_srcid->ref_len) ||
+		      (bcmp(tdbp->tdb_srcid + 1, ipo->ipo_srcid + 1,
+			    ipo->ipo_srcid->ref_len)))
 		    continue;
 	      }
 
@@ -334,10 +335,11 @@ gettdbbyaddr(union sockaddr_union *dst, struct ipsec_policy *ipo,
 	  {
 	      if (ipo->ipo_dstid != NULL)
 	      {
-		  if ((tdbp->tdb_dstid_type != ipo->ipo_dstid_type) ||
-		      (tdbp->tdb_dstid_len != ipo->ipo_dstid_len) ||
-		      (bcmp(tdbp->tdb_dstid, ipo->ipo_dstid,
-			    ipo->ipo_dstid_len)))
+		  if ((tdbp->tdb_dstid->ref_type !=
+		       ipo->ipo_dstid->ref_type) ||
+		      (tdbp->tdb_dstid->ref_len != ipo->ipo_dstid->ref_len) ||
+		      (bcmp(tdbp->tdb_dstid + 1, ipo->ipo_dstid + 1,
+			    ipo->ipo_dstid->ref_len)))
 		    continue;
 	      }
 
@@ -352,11 +354,12 @@ gettdbbyaddr(union sockaddr_union *dst, struct ipsec_policy *ipo,
 	  {
 	      if (ipo->ipo_local_cred != NULL)
 	      {
-		  if ((tdbp->tdb_local_cred_type !=
-		       ipo->ipo_local_cred_type) ||
-		      (tdbp->tdb_local_cred_len != ipo->ipo_local_cred_len) ||
-		      (bcmp(tdbp->tdb_local_cred, ipo->ipo_local_cred,
-			    ipo->ipo_local_cred_len)))
+		  if ((tdbp->tdb_local_cred->ref_type !=
+		       ipo->ipo_local_cred->ref_type) ||
+		      (tdbp->tdb_local_cred->ref_len !=
+		       ipo->ipo_local_cred->ref_len) ||
+		      (bcmp(tdbp->tdb_local_cred + 1, ipo->ipo_local_cred + 1,
+			    ipo->ipo_local_cred->ref_len)))
 		    continue;
 	      }
 	      else
@@ -407,10 +410,11 @@ gettdbbysrc(union sockaddr_union *src, struct ipsec_policy *ipo,
 	  {
 	      if (ipo->ipo_srcid != NULL)
 	      {
-		  if ((tdbp->tdb_srcid_type != ipo->ipo_srcid_type) ||
-		      (tdbp->tdb_srcid_len != ipo->ipo_srcid_len) ||
-		      (bcmp(tdbp->tdb_srcid, ipo->ipo_srcid,
-			    ipo->ipo_srcid_len)))
+		  if ((tdbp->tdb_srcid->ref_type !=
+		       ipo->ipo_srcid->ref_type) ||
+		      (tdbp->tdb_srcid->ref_len != ipo->ipo_srcid->ref_len) ||
+		      (bcmp(tdbp->tdb_srcid + 1, ipo->ipo_srcid + 1,
+			    ipo->ipo_srcid->ref_len)))
 		    continue;
 	      }
 
@@ -424,10 +428,11 @@ gettdbbysrc(union sockaddr_union *src, struct ipsec_policy *ipo,
 	  {
 	      if (ipo->ipo_dstid != NULL)
 	      {
-		  if ((tdbp->tdb_dstid_type != ipo->ipo_dstid_type) ||
-		      (tdbp->tdb_dstid_len != ipo->ipo_dstid_len) ||
-		      (bcmp(tdbp->tdb_dstid, ipo->ipo_dstid,
-			    ipo->ipo_dstid_len)))
+		  if ((tdbp->tdb_dstid->ref_type !=
+		       ipo->ipo_dstid->ref_type) ||
+		      (tdbp->tdb_dstid->ref_len != ipo->ipo_dstid->ref_len) ||
+		      (bcmp(tdbp->tdb_dstid + 1, ipo->ipo_dstid + 1,
+			    ipo->ipo_dstid->ref_len)))
 		    continue;
 	      }
 
@@ -442,11 +447,12 @@ gettdbbysrc(union sockaddr_union *src, struct ipsec_policy *ipo,
 	  {
 	      if (ipo->ipo_local_cred != NULL)
 	      {
-		  if ((tdbp->tdb_local_cred_type !=
-		       ipo->ipo_local_cred_type) ||
-		      (tdbp->tdb_local_cred_len != ipo->ipo_local_cred_len) ||
-		      (bcmp(tdbp->tdb_local_cred, ipo->ipo_local_cred,
-			    ipo->ipo_local_cred_len)))
+		  if ((tdbp->tdb_local_cred->ref_type !=
+		       ipo->ipo_local_cred->ref_type) ||
+		      (tdbp->tdb_local_cred->ref_len !=
+		       ipo->ipo_local_cred->ref_len) ||
+		      (bcmp(tdbp->tdb_local_cred, ipo->ipo_local_cred + 1,
+			    ipo->ipo_local_cred->ref_len)))
 		    continue;
 	      }
 	      else
@@ -808,25 +814,25 @@ tdb_delete(struct tdb *tdbp)
 
     if (tdbp->tdb_srcid)
     {
-      	FREE(tdbp->tdb_srcid, M_CREDENTIALS);
+	ipsp_reffree(tdbp->tdb_srcid);
 	tdbp->tdb_srcid = NULL;
     }
 
     if (tdbp->tdb_dstid)
     {
-      	FREE(tdbp->tdb_dstid, M_CREDENTIALS);
+	ipsp_reffree(tdbp->tdb_dstid);
 	tdbp->tdb_dstid = NULL;
     }
 
     if (tdbp->tdb_local_cred)
     {
-	FREE(tdbp->tdb_local_cred, M_CREDENTIALS);
+	ipsp_reffree(tdbp->tdb_local_cred);
 	tdbp->tdb_local_cred = NULL;
     }
 
     if (tdbp->tdb_remote_cred)
     {
-	FREE(tdbp->tdb_remote_cred, M_CREDENTIALS);
+	ipsp_reffree(tdbp->tdb_remote_cred);
 	tdbp->tdb_local_cred = NULL;
     }
 
@@ -1274,7 +1280,7 @@ ipsp_copy_ident(void *arg)
     return (void *) tdbii;
 }
 
-/* Check whether an IP{4,6} address is unspecified */
+/* Check whether an IP{4,6} address is unspecified. */
 int
 ipsp_is_unspecified(union sockaddr_union addr)
 {
@@ -1301,3 +1307,15 @@ ipsp_is_unspecified(union sockaddr_union addr)
 	    return 1;
     }
 }
+
+/* Free reference-counted structure. */
+void
+ipsp_reffree(struct ipsec_ref *ipr)
+{
+#ifdef DIAGNOSTIC
+    if (ipr->ref_count <= 0)
+      printf("ipsp_reffree: illegal reference count %d for object %p (len = %d, malloctype = %d)\n", ipr->ref_count, ipr, ipr->ref_len, ipr->ref_malloctype);
+#endif
+    if (--ipr->ref_count <= 0)
+      FREE(ipr, ipr->ref_malloctype);
+}
diff --git a/sys/netinet/ip_ipsp.h b/sys/netinet/ip_ipsp.h
index 3fe118cd345..b407516cefc 100644
--- a/sys/netinet/ip_ipsp.h
+++ b/sys/netinet/ip_ipsp.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ip_ipsp.h,v 1.85 2001/05/05 00:31:20 angelos Exp $	*/
+/*	$OpenBSD: ip_ipsp.h,v 1.86 2001/05/21 03:02:19 angelos Exp $	*/
 
 /*
  * The authors of this code are John Ioannidis (ji@tla.org),
@@ -154,6 +154,14 @@ struct sockaddr_encap
 
 #define SENT_LEN        sizeof(struct sockaddr_encap)
 
+struct ipsec_ref
+{
+    int ref_type;		/* Subtype of data */
+    int ref_len;		/* Length of data following */
+    int ref_count;		/* Reference count */
+    int ref_malloctype;		/* malloc(9) type, for free'ing purposes */
+};
+
 struct ipsec_acquire
 {
     union sockaddr_union       ipa_addr;
@@ -188,16 +196,9 @@ struct ipsec_policy
 
     struct tdb          *ipo_tdb;   /* Cached entry */
 
-    u_int16_t            ipo_srcid_len;
-    u_int16_t            ipo_dstid_len;
-    u_int16_t            ipo_local_cred_len;
-    u_int16_t            ipo_srcid_type;
-    u_int16_t            ipo_dstid_type;
-    u_int16_t            ipo_local_cred_type;
-
-    u_int8_t            *ipo_srcid;
-    u_int8_t            *ipo_dstid;
-    u_int8_t            *ipo_local_cred;
+    struct ipsec_ref    *ipo_srcid;
+    struct ipsec_ref    *ipo_dstid;
+    struct ipsec_ref    *ipo_local_cred;
 
     TAILQ_ENTRY(ipsec_policy) ipo_tdb_next; /* List of policies on TDB */
     TAILQ_ENTRY(ipsec_policy) ipo_list; /* List of all policy entries */
@@ -298,20 +299,14 @@ struct tdb				/* tunnel descriptor block */
     u_int16_t         tdb_amxkeylen;    /* Raw authentication key length */
     u_int16_t         tdb_emxkeylen;    /* Raw encryption key length */
     u_int16_t         tdb_ivlen;        /* IV length */
-    u_int16_t         tdb_local_cred_len; /* size of tdb_local_cred */
-    u_int16_t         tdb_remote_cred_len; /* size of tdb_remote_cred */
     u_int8_t	      tdb_sproto;	/* IPsec protocol */
     u_int8_t          tdb_wnd;          /* Replay window */
     u_int8_t          tdb_satype;       /* SA type (RFC2367, PF_KEY) */
-    u_int8_t          tdb_local_cred_type;/* type of tdb_local_cred */
-    u_int8_t          tdb_remote_cred_type;/* type of tdb_remote_cred */
 
     union sockaddr_union tdb_dst;	/* Destination address for this SA */
     union sockaddr_union tdb_src;	/* Source address for this SA */
     union sockaddr_union tdb_proxy;
 
-    u_int8_t         *tdb_srcid;        /* Source ID for this SA */
-    u_int8_t         *tdb_dstid;        /* Destination ID for this SA */
     u_int8_t         *tdb_amxkey;       /* Raw authentication key */
     u_int8_t         *tdb_emxkey;       /* Raw encryption key */
 
@@ -320,15 +315,13 @@ struct tdb				/* tunnel descriptor block */
     u_int32_t         tdb_initial;	/* Initial replay value */
 
     u_int32_t         tdb_epoch;	/* Used by the kernfs interface */
-    u_int16_t         tdb_srcid_len;
-    u_int16_t         tdb_dstid_len;
-    u_int16_t         tdb_srcid_type;
-    u_int16_t         tdb_dstid_type;
 
     u_int8_t          tdb_iv[4];        /* Used for HALF-IV ESP */
 
-    caddr_t           tdb_local_cred;
-    caddr_t           tdb_remote_cred;
+    struct ipsec_ref *tdb_local_cred;
+    struct ipsec_ref *tdb_remote_cred;
+    struct ipsec_ref *tdb_srcid;        /* Source ID for this SA */
+    struct ipsec_ref *tdb_dstid;        /* Destination ID for this SA */
 
     TAILQ_HEAD(tdb_inp_head_in, inpcb) tdb_inp_in;
     TAILQ_HEAD(tdb_inp_head_out, inpcb) tdb_inp_out;
@@ -601,5 +594,6 @@ extern void ipsp_delete_acquire(struct ipsec_acquire *);
 extern void ipsp_clear_acquire(struct tdb *);
 extern void *ipsp_copy_ident(void *);
 extern int ipsp_is_unspecified(union sockaddr_union);
+extern void ipsp_reffree(struct ipsec_ref *);
 #endif /* _KERNEL */
 #endif /* _NETINET_IPSP_H_ */