IKEv2 allows road warrior servers to announce internal name servers in a
configuration payload. iked responders can be configured to send such
payloads with the 'config name-server' option.
This diff adds support for receiving DNS server configuration payloads as a
road warrior client and proposing them to resolvd(8) via route messages.
It is enabled by default for clients using the 'iface' option for automatic
address configuration.
ok?
Index: config.c
===================================================================
RCS file: /cvs/src/sbin/iked/config.c,v
retrieving revision 1.79
diff -u -p -r1.79 config.c
--- config.c 13 May 2021 15:20:48 -0000 1.79
+++ config.c 30 Aug 2021 12:15:10 -0000
@@ -174,6 +174,7 @@ config_free_sa(struct iked *env, struct
free(sa->sa_cp_addr);
free(sa->sa_cp_addr6);
+ free(sa->sa_cp_dns);
free(sa->sa_tag);
free(sa);
Index: iked.c
===================================================================
RCS file: /cvs/src/sbin/iked/iked.c,v
retrieving revision 1.57
diff -u -p -r1.57 iked.c
--- iked.c 13 May 2021 15:20:48 -0000 1.57
+++ iked.c 30 Aug 2021 12:15:10 -0000
@@ -459,6 +459,9 @@ parent_dispatch_ikev2(int fd, struct pri
case IMSG_IF_ADDADDR:
case IMSG_IF_DELADDR:
return (vroute_getaddr(env, imsg));
+ case IMSG_VDNS_ADD:
+ case IMSG_VDNS_DEL:
+ return (vroute_getdns(env, imsg));
case IMSG_VROUTE_ADD:
case IMSG_VROUTE_DEL:
return (vroute_getroute(env, imsg));
Index: iked.h
===================================================================
RCS file: /cvs/src/sbin/iked/iked.h,v
retrieving revision 1.192
diff -u -p -r1.192 iked.h
--- iked.h 23 Jun 2021 12:11:40 -0000 1.192
+++ iked.h 30 Aug 2021 12:15:10 -0000
@@ -429,6 +429,7 @@ struct iked_sa {
int sa_cp; /* XXX */
struct iked_addr *sa_cp_addr; /* requested address */
struct iked_addr *sa_cp_addr6; /* requested address */
+ struct iked_addr *sa_cp_dns; /* requested dns */
struct iked_policy *sa_policy;
struct timeval sa_timecreated;
@@ -611,6 +612,7 @@ struct iked_message {
int msg_cp;
struct iked_addr *msg_cp_addr; /* requested address */
struct iked_addr *msg_cp_addr6; /* requested address */
+ struct iked_addr *msg_cp_dns; /* requested dns */
/* MOBIKE */
int msg_update_sa_addresses;
@@ -975,6 +977,8 @@ void vroute_init(struct iked *);
int vroute_setaddr(struct iked *, int, struct sockaddr *, int, unsigned int);
void vroute_cleanup(struct iked *);
int vroute_getaddr(struct iked *, struct imsg *);
+int vroute_setdns(struct iked *, int, struct sockaddr *);
+int vroute_getdns(struct iked *, struct imsg *);
int vroute_setaddroute(struct iked *, uint8_t, struct sockaddr *,
uint8_t, struct sockaddr *);
int vroute_setcloneroute(struct iked *, uint8_t, struct sockaddr *,
Index: ikev2.c
===================================================================
RCS file: /cvs/src/sbin/iked/ikev2.c,v
retrieving revision 1.325
diff -u -p -r1.325 ikev2.c
--- ikev2.c 29 Jun 2021 15:39:20 -0000 1.325
+++ ikev2.c 30 Aug 2021 12:15:10 -0000
@@ -998,6 +998,13 @@ ikev2_ike_auth_recv(struct iked *env, st
log_info("%s: obtained lease: %s", SPI_SA(sa, __func__),
print_host((struct sockaddr
*)&sa->sa_cp_addr6->addr, NULL, 0));
}
+ if (msg->msg_cp_dns) {
+ sa->sa_cp_dns = msg->msg_cp_dns;
+ msg->msg_cp_dns = NULL;
+ log_debug("%s: DNS: %s", __func__,
+ print_host((struct sockaddr *)&sa->sa_cp_dns->addr,
+ NULL, 0));
+ }
sa->sa_cp = msg->msg_cp;
}
@@ -4508,6 +4515,8 @@ ikev2_ikesa_enable(struct iked *env, str
sa->sa_cp_addr = NULL;
nsa->sa_cp_addr6 = sa->sa_cp_addr6;
sa->sa_cp_addr6 = NULL;
+ nsa->sa_cp_dns = sa->sa_cp_dns;
+ sa->sa_cp_dns = NULL;
/* Transfer other attributes */
if (sa->sa_dstid_entry_valid) {
sa_dstid_remove(env, sa);
Index: ikev2_msg.c
===================================================================
RCS file: /cvs/src/sbin/iked/ikev2_msg.c,v
retrieving revision 1.77
diff -u -p -r1.77 ikev2_msg.c
--- ikev2_msg.c 29 Oct 2020 21:49:58 -0000 1.77
+++ ikev2_msg.c 30 Aug 2021 12:15:10 -0000
@@ -197,6 +197,7 @@ ikev2_msg_cleanup(struct iked *env, stru
free(msg->msg_eap.eam_user);
free(msg->msg_cp_addr);
free(msg->msg_cp_addr6);
+ free(msg->msg_cp_dns);
msg->msg_nonce = NULL;
msg->msg_ke = NULL;
@@ -209,6 +210,7 @@ ikev2_msg_cleanup(struct iked *env, stru
msg->msg_eap.eam_user = NULL;
msg->msg_cp_addr = NULL;
msg->msg_cp_addr6 = NULL;
+ msg->msg_cp_dns = NULL;
config_free_proposals(&msg->msg_proposals, 0);
while ((cr = SIMPLEQ_FIRST(&msg->msg_certreqs))) {
Index: ikev2_pld.c
===================================================================
RCS file: /cvs/src/sbin/iked/ikev2_pld.c,v
retrieving revision 1.117
diff -u -p -r1.117 ikev2_pld.c
--- ikev2_pld.c 19 Feb 2021 21:52:53 -0000 1.117
+++ ikev2_pld.c 30 Aug 2021 12:15:10 -0000
@@ -1842,6 +1842,7 @@ ikev2_pld_cp(struct iked *env, struct ik
uint8_t *ptr;
size_t len;
uint8_t buf[128];
+ int cfg_type;
if (ikev2_validate_cp(msg, offset, left, &cp))
return (-1);
@@ -1878,8 +1879,10 @@ ikev2_pld_cp(struct iked *env, struct ik
print_hex(ptr, sizeof(*cfg), betoh16(cfg->cfg_length));
- switch (betoh16(cfg->cfg_type)) {
+ cfg_type = betoh16(cfg->cfg_type);
+ switch (cfg_type) {
case IKEV2_CFG_INTERNAL_IP4_ADDRESS:
+ case IKEV2_CFG_INTERNAL_IP4_DNS:
if (!ikev2_msg_frompeer(msg))
break;
if (betoh16(cfg->cfg_length) == 0)
@@ -1891,8 +1894,20 @@ ikev2_pld_cp(struct iked *env, struct ik
__func__, betoh16(cfg->cfg_length), 4);
return (-1);
}
- if (msg->msg_parent->msg_cp_addr != NULL) {
- log_debug("%s: address already set", __func__);
+ switch(cfg_type) {
+ case IKEV2_CFG_INTERNAL_IP4_ADDRESS:
+ if (msg->msg_parent->msg_cp_addr != NULL) {
+ log_debug("%s: address already set",
__func__);
+ goto skip;
+ }
+ break;
+ case IKEV2_CFG_INTERNAL_IP4_DNS:
+ if (msg->msg_parent->msg_cp_dns != NULL) {
+ log_debug("%s: dns already set",
__func__);
+ goto skip;
+ }
+ break;
+ default:
break;
}
if ((addr = calloc(1, sizeof(*addr))) == NULL) {
@@ -1907,22 +1922,42 @@ ikev2_pld_cp(struct iked *env, struct ik
print_host((struct sockaddr *)in4, (char *)buf,
sizeof(buf));
log_debug("%s: cfg %s", __func__, buf);
- msg->msg_parent->msg_cp_addr = addr;
+ switch(cfg_type) {
+ case IKEV2_CFG_INTERNAL_IP4_ADDRESS:
+ msg->msg_parent->msg_cp_addr = addr;
+ log_debug("%s: IP4_ADDRESS %s", __func__, buf);
+ break;
+ case IKEV2_CFG_INTERNAL_IP4_DNS:
+ msg->msg_parent->msg_cp_dns = addr;
+ log_debug("%s: IP4_DNS %s", __func__, buf);
+ break;
+ }
break;
case IKEV2_CFG_INTERNAL_IP6_ADDRESS:
+ case IKEV2_CFG_INTERNAL_IP6_DNS:
if (!ikev2_msg_frompeer(msg))
break;
if (betoh16(cfg->cfg_length) == 0)
break;
/* XXX multiple-valued */
- if (betoh16(cfg->cfg_length) < 16 + 1) {
+ if (betoh16(cfg->cfg_length) < 16) {
log_debug("%s: malformed payload: too short "
"for ipv6 addr w/prefixlen (%u < %u)",
- __func__, betoh16(cfg->cfg_length), 16 + 1);
+ __func__, betoh16(cfg->cfg_length), 16);
return (-1);
}
- if (msg->msg_parent->msg_cp_addr6 != NULL) {
- log_debug("%s: address already set", __func__);
+ switch(cfg_type) {
+ case IKEV2_CFG_INTERNAL_IP6_ADDRESS:
+ if (msg->msg_parent->msg_cp_addr6 != NULL) {
+ log_debug("%s: address6 already set",
__func__);
+ goto skip;
+ }
+ break;
+ case IKEV2_CFG_INTERNAL_IP6_DNS:
+ if (msg->msg_parent->msg_cp_dns != NULL) {
+ log_debug("%s: dns already set",
__func__);
+ goto skip;
+ }
break;
}
if ((addr = calloc(1, sizeof(*addr))) == NULL) {
@@ -1937,10 +1972,20 @@ ikev2_pld_cp(struct iked *env, struct ik
print_host((struct sockaddr *)in6, (char *)buf,
sizeof(buf));
log_debug("%s: cfg %s/%d", __func__, buf, ptr[16]);
- msg->msg_parent->msg_cp_addr6 = addr;
+ switch(cfg_type) {
+ case IKEV2_CFG_INTERNAL_IP6_ADDRESS:
+ msg->msg_parent->msg_cp_addr6 = addr;
+ log_debug("%s: IP6_ADDRESS %s", __func__, buf);
+ break;
+ case IKEV2_CFG_INTERNAL_IP6_DNS:
+ msg->msg_parent->msg_cp_dns = addr;
+ log_debug("%s: IP6_DNS %s", __func__, buf);
+ break;
+ }
break;
}
+ skip:
ptr += betoh16(cfg->cfg_length);
len -= betoh16(cfg->cfg_length);
}
Index: policy.c
===================================================================
RCS file: /cvs/src/sbin/iked/policy.c,v
retrieving revision 1.82
diff -u -p -r1.82 policy.c
--- policy.c 23 Jun 2021 12:11:40 -0000 1.82
+++ policy.c 30 Aug 2021 12:15:10 -0000
@@ -680,6 +680,12 @@ sa_configure_iface(struct iked *env, str
if (sa->sa_policy == NULL || sa->sa_policy->pol_iface == 0)
return (0);
+ if (sa->sa_cp_dns) {
+ if (vroute_setdns(env, add,
+ (struct sockaddr *)&sa->sa_cp_dns->addr) != 0)
+ return (-1);
+ }
+
if (!sa->sa_cp_addr && !sa->sa_cp_addr6)
return (0);
Index: types.h
===================================================================
RCS file: /cvs/src/sbin/iked/types.h,v
retrieving revision 1.44
diff -u -p -r1.44 types.h
--- types.h 3 Aug 2021 12:46:30 -0000 1.44
+++ types.h 30 Aug 2021 12:15:10 -0000
@@ -119,6 +119,8 @@ enum imsg_type {
IMSG_VROUTE_ADD,
IMSG_VROUTE_DEL,
IMSG_VROUTE_CLONE,
+ IMSG_VDNS_ADD,
+ IMSG_VDNS_DEL,
IMSG_OCSP_FD,
IMSG_OCSP_CFG,
IMSG_AUTH,
Index: vroute.c
===================================================================
RCS file: /cvs/src/sbin/iked/vroute.c,v
retrieving revision 1.12
diff -u -p -r1.12 vroute.c
--- vroute.c 23 Jun 2021 12:21:23 -0000 1.12
+++ vroute.c 30 Aug 2021 12:15:10 -0000
@@ -44,6 +44,7 @@ int vroute_setroute(struct iked *, uint8
int vroute_doroute(struct iked *, int, int, int, uint8_t, struct sockaddr *,
struct sockaddr *, struct sockaddr *, int *);
int vroute_doaddr(struct iked *, char *, struct sockaddr *, struct sockaddr *,
int);
+int vroute_dodns(struct iked *, struct sockaddr *, int, int);
void vroute_cleanup(struct iked *);
void vroute_insertaddr(struct iked *, int, struct sockaddr *, struct sockaddr
*);
@@ -138,6 +139,9 @@ vroute_cleanup(struct iked *env)
TAILQ_REMOVE(&ivr->ivr_routes, route, vr_entry);
free(route);
}
+
+ vroute_dodns(env, NULL, AF_INET, 0);
+ vroute_dodns(env, NULL, AF_INET6, 0);
}
int
@@ -239,6 +243,41 @@ vroute_getaddr(struct iked *env, struct
return (vroute_doaddr(env, ifname, addr, mask, add));
}
+int
+vroute_setdns(struct iked *env, int add, struct sockaddr *addr)
+{
+ struct iovec iov = {0};
+
+ iov.iov_base = addr;
+ iov.iov_len = addr->sa_len;
+
+ return (proc_composev(&env->sc_ps, PROC_PARENT,
+ add ? IMSG_VDNS_ADD: IMSG_VDNS_DEL, &iov, 1));
+}
+
+int
+vroute_getdns(struct iked *env, struct imsg *imsg)
+{
+ struct sockaddr *dns;
+ uint8_t *ptr;
+ size_t left;
+ int add;
+
+ ptr = imsg->data;
+ left = IMSG_DATA_SIZE(imsg);
+
+ if (left < sizeof(*dns))
+ fatalx("bad length imsg received");
+
+ dns = (struct sockaddr *) ptr;
+ if (left < dns->sa_len)
+ fatalx("bad length imsg received");
+
+ add = (imsg->hdr.type == IMSG_VDNS_ADD);
+
+ return (vroute_dodns(env, dns, dns->sa_family, add));
+}
+
void
vroute_insertroute(struct iked *env, int rdomain, struct sockaddr *dest,
struct sockaddr *mask)
@@ -525,6 +564,74 @@ vroute_getcloneroute(struct iked *env, s
return (vroute_doroute(env, flags, addrs, rdomain, RTM_ADD,
(struct sockaddr *)&dest, (struct sockaddr *)&mask,
(struct sockaddr *)&addr, NULL));
+}
+
+int
+vroute_dodns(struct iked *env, struct sockaddr *dns, int af, int add)
+{
+ struct vroute_msg m_rtmsg;
+ struct sockaddr_in *in;
+ struct sockaddr_in6 *in6;
+ struct sockaddr_rtdns rtdns;
+ struct iked_vroute_sc *ivr = env->sc_vroute;
+ struct iovec iov[3];
+ int i;
+ long pad = 0;
+ int iovcnt = 0, padlen;
+
+ if (dns && dns->sa_family != af)
+ return (-1);
+
+ bzero(&m_rtmsg, sizeof(m_rtmsg));
+#define rtm m_rtmsg.vm_rtm
+ rtm.rtm_version = RTM_VERSION;
+ rtm.rtm_type = RTM_PROPOSAL;
+ rtm.rtm_seq = ++ivr->ivr_rtseq;
+ rtm.rtm_priority = RTP_PROPOSAL_STATIC;
+ rtm.rtm_flags = RTF_UP;
+ rtm.rtm_addrs = RTA_DNS;
+
+ iov[iovcnt].iov_base = &rtm;
+ iov[iovcnt].iov_len = sizeof(rtm);
+ iovcnt++;
+
+ bzero(&rtdns, sizeof(rtdns));
+ rtdns.sr_family = af;
+ rtdns.sr_len = 2;
+ if (add) {
+ switch(dns->sa_family) {
+ case AF_INET:
+ rtdns.sr_family = AF_INET;
+ rtdns.sr_len += sizeof(struct in_addr);
+ in = (struct sockaddr_in *)dns;
+ memcpy(rtdns.sr_dns, &in->sin_addr, sizeof(struct
in_addr));
+ break;
+ case AF_INET6:
+ rtdns.sr_family = AF_INET6;
+ rtdns.sr_len += sizeof(struct in6_addr);
+ in6 = (struct sockaddr_in6 *)dns;
+ memcpy(rtdns.sr_dns, &in6->sin6_addr, sizeof(struct
in6_addr));
+ break;
+ default:
+ return (-1);
+ }
+ }
+ iov[iovcnt].iov_base = &rtdns;
+ iov[iovcnt++].iov_len = sizeof(rtdns);
+ padlen = ROUNDUP(sizeof(rtdns)) - sizeof(rtdns);
+ if (padlen > 0) {
+ iov[iovcnt].iov_base = &pad;
+ iov[iovcnt++].iov_len = padlen;
+ }
+
+ for (i = 0; i < iovcnt; i++)
+ rtm.rtm_msglen += iov[i].iov_len;
+#undef rtm
+
+ if (writev(ivr->ivr_rtsock, iov, iovcnt) == -1)
+ log_warn("failed to send route message");
+
+ return (0);
}
int
