217 return error; 218} 219 220#ifdef INET 221/* 222 * Common input handler for IPv4 AH, ESP, and IPCOMP. 223 */ 224int 225ipsec4_common_input(struct mbuf *m, ...) 226{ 227 va_list ap; 228 int off, nxt; 229 230 va_start(ap, m); 231 off = va_arg(ap, int); 232 nxt = va_arg(ap, int); 233 va_end(ap); 234 235 return ipsec_common_input(m, off, offsetof(struct ip, ip_p), 236 AF_INET, nxt); 237} 238 239void 240ah4_input(struct mbuf *m, int off) 241{ 242 ipsec4_common_input(m, off, IPPROTO_AH); 243} 244 245void 246esp4_input(struct mbuf *m, int off) 247{ 248 ipsec4_common_input(m, off, IPPROTO_ESP); 249} 250 251void 252ipcomp4_input(struct mbuf *m, int off) 253{ 254 ipsec4_common_input(m, off, IPPROTO_IPCOMP); 255} 256 257/* 258 * IPsec input callback for INET protocols. 259 * This routine is called as the transform callback. 260 * Takes care of filtering and other sanity checks on 261 * the processed packet. 262 */ 263int 264ipsec4_common_input_cb(struct mbuf *m, struct secasvar *sav, 265 int skip, int protoff, struct m_tag *mt) 266{ 267 int prot, af, sproto; 268 struct ip *ip; 269 struct m_tag *mtag; 270 struct tdb_ident *tdbi; 271 struct secasindex *saidx; 272 int error; 273 274#if 0 275 SPLASSERT(net, "ipsec4_common_input_cb"); 276#endif 277 278 KASSERT(m != NULL, ("ipsec4_common_input_cb: null mbuf")); 279 KASSERT(sav != NULL, ("ipsec4_common_input_cb: null SA")); 280 KASSERT(sav->sah != NULL, ("ipsec4_common_input_cb: null SAH")); 281 saidx = &sav->sah->saidx; 282 af = saidx->dst.sa.sa_family; 283 KASSERT(af == AF_INET, ("ipsec4_common_input_cb: unexpected af %u",af)); 284 sproto = saidx->proto; 285 KASSERT(sproto == IPPROTO_ESP || sproto == IPPROTO_AH || 286 sproto == IPPROTO_IPCOMP, 287 ("ipsec4_common_input_cb: unexpected security protocol %u", 288 sproto)); 289 290 /* Sanity check */ 291 if (m == NULL) { 292 DPRINTF(("ipsec4_common_input_cb: null mbuf")); 293 IPSEC_ISTAT(sproto, espstat.esps_badkcr, ahstat.ahs_badkcr, 294 ipcompstat.ipcomps_badkcr); 295 KEY_FREESAV(&sav); 296 return EINVAL; 297 } 298 299 if (skip != 0) { 300 /* Fix IPv4 header */ 301 if (m->m_len < skip && (m = m_pullup(m, skip)) == NULL) { 302 DPRINTF(("ipsec4_common_input_cb: processing failed " 303 "for SA %s/%08lx\n", 304 ipsec_address(&sav->sah->saidx.dst), 305 (u_long) ntohl(sav->spi))); 306 IPSEC_ISTAT(sproto, espstat.esps_hdrops, ahstat.ahs_hdrops, 307 ipcompstat.ipcomps_hdrops); 308 error = ENOBUFS; 309 goto bad; 310 } 311 312 ip = mtod(m, struct ip *); 313 ip->ip_len = htons(m->m_pkthdr.len); 314 ip->ip_off = htons(ip->ip_off); 315 ip->ip_sum = 0; 316 ip->ip_sum = in_cksum(m, ip->ip_hl << 2); 317 } else { 318 ip = mtod(m, struct ip *); 319 } 320 prot = ip->ip_p; 321 322 /* IP-in-IP encapsulation */ 323 if (prot == IPPROTO_IPIP) { 324 struct ip ipn; 325 326 if (m->m_pkthdr.len - skip < sizeof(struct ip)) { 327 IPSEC_ISTAT(sproto, espstat.esps_hdrops, 328 ahstat.ahs_hdrops, 329 ipcompstat.ipcomps_hdrops); 330 error = EINVAL; 331 goto bad; 332 } 333 /* ipn will now contain the inner IPv4 header */ 334 m_copydata(m, ip->ip_hl << 2, sizeof(struct ip), 335 (caddr_t) &ipn); 336 337#ifdef notyet 338 /* XXX PROXY address isn't recorded in SAH */ 339 /* 340 * Check that the inner source address is the same as 341 * the proxy address, if available. 342 */ 343 if ((saidx->proxy.sa.sa_family == AF_INET && 344 saidx->proxy.sin.sin_addr.s_addr != 345 INADDR_ANY && 346 ipn.ip_src.s_addr != 347 saidx->proxy.sin.sin_addr.s_addr) || 348 (saidx->proxy.sa.sa_family != AF_INET && 349 saidx->proxy.sa.sa_family != 0)) { 350 351 DPRINTF(("ipsec4_common_input_cb: inner " 352 "source address %s doesn't correspond to " 353 "expected proxy source %s, SA %s/%08lx\n", 354 inet_ntoa4(ipn.ip_src), 355 ipsp_address(saidx->proxy), 356 ipsp_address(saidx->dst), 357 (u_long) ntohl(sav->spi))); 358 359 IPSEC_ISTAT(sproto, espstat.esps_pdrops, 360 ahstat.ahs_pdrops, 361 ipcompstat.ipcomps_pdrops); 362 error = EACCES; 363 goto bad; 364 } 365#endif /*XXX*/ 366 } 367#if INET6 368 /* IPv6-in-IP encapsulation. */ 369 if (prot == IPPROTO_IPV6) { 370 struct ip6_hdr ip6n; 371 372 if (m->m_pkthdr.len - skip < sizeof(struct ip6_hdr)) { 373 IPSEC_ISTAT(sproto, espstat.esps_hdrops, 374 ahstat.ahs_hdrops, 375 ipcompstat.ipcomps_hdrops); 376 error = EINVAL; 377 goto bad; 378 } 379 /* ip6n will now contain the inner IPv6 header. */ 380 m_copydata(m, ip->ip_hl << 2, sizeof(struct ip6_hdr), 381 (caddr_t) &ip6n); 382 383#ifdef notyet 384 /* 385 * Check that the inner source address is the same as 386 * the proxy address, if available. 387 */ 388 if ((saidx->proxy.sa.sa_family == AF_INET6 && 389 !IN6_IS_ADDR_UNSPECIFIED(&saidx->proxy.sin6.sin6_addr) && 390 !IN6_ARE_ADDR_EQUAL(&ip6n.ip6_src, 391 &saidx->proxy.sin6.sin6_addr)) || 392 (saidx->proxy.sa.sa_family != AF_INET6 && 393 saidx->proxy.sa.sa_family != 0)) { 394 395 DPRINTF(("ipsec4_common_input_cb: inner " 396 "source address %s doesn't correspond to " 397 "expected proxy source %s, SA %s/%08lx\n", 398 ip6_sprintf(&ip6n.ip6_src), 399 ipsec_address(&saidx->proxy), 400 ipsec_address(&saidx->dst), 401 (u_long) ntohl(sav->spi))); 402 403 IPSEC_ISTAT(sproto, espstat.esps_pdrops, 404 ahstat.ahs_pdrops, 405 ipcompstat.ipcomps_pdrops); 406 error = EACCES; 407 goto bad; 408 } 409#endif /*XXX*/ 410 } 411#endif /* INET6 */ 412 413 /* 414 * Record what we've done to the packet (under what SA it was 415 * processed). If we've been passed an mtag, it means the packet 416 * was already processed by an ethernet/crypto combo card and 417 * thus has a tag attached with all the right information, but 418 * with a PACKET_TAG_IPSEC_IN_CRYPTO_DONE as opposed to 419 * PACKET_TAG_IPSEC_IN_DONE type; in that case, just change the type. 420 */ 421 if (mt == NULL && sproto != IPPROTO_IPCOMP) { 422 mtag = m_tag_get(PACKET_TAG_IPSEC_IN_DONE, 423 sizeof(struct tdb_ident), M_NOWAIT); 424 if (mtag == NULL) { 425 DPRINTF(("ipsec4_common_input_cb: failed to get tag\n")); 426 IPSEC_ISTAT(sproto, espstat.esps_hdrops, 427 ahstat.ahs_hdrops, ipcompstat.ipcomps_hdrops); 428 error = ENOMEM; 429 goto bad; 430 } 431 432 tdbi = (struct tdb_ident *)(mtag + 1); 433 bcopy(&saidx->dst, &tdbi->dst, saidx->dst.sa.sa_len); 434 tdbi->proto = sproto; 435 tdbi->spi = sav->spi; 436 437 m_tag_prepend(m, mtag); 438 } else { 439 mt->m_tag_id = PACKET_TAG_IPSEC_IN_DONE; 440 /* XXX do we need to mark m_flags??? */ 441 } 442 443 key_sa_recordxfer(sav, m); /* record data transfer */ 444 445 /* 446 * Re-dispatch via software interrupt. 447 */ 448 if (!netisr_queue(NETISR_IP, m)) { 449 IPSEC_ISTAT(sproto, espstat.esps_qfull, ahstat.ahs_qfull, 450 ipcompstat.ipcomps_qfull); 451 452 DPRINTF(("ipsec4_common_input_cb: queue full; " 453 "proto %u packet dropped\n", sproto)); 454 return ENOBUFS; 455 } 456 return 0; 457bad: 458 m_freem(m); 459 return error; 460} 461#endif /* INET */ 462 463#ifdef INET6 464/* IPv6 AH wrapper. */ 465int 466ipsec6_common_input(struct mbuf **mp, int *offp, int proto) 467{ 468 int l = 0; 469 int protoff; 470 struct ip6_ext ip6e; 471 472 if (*offp < sizeof(struct ip6_hdr)) { 473 DPRINTF(("ipsec6_common_input: bad offset %u\n", *offp)); 474 return IPPROTO_DONE; 475 } else if (*offp == sizeof(struct ip6_hdr)) { 476 protoff = offsetof(struct ip6_hdr, ip6_nxt); 477 } else { 478 /* Chase down the header chain... */ 479 protoff = sizeof(struct ip6_hdr); 480 481 do { 482 protoff += l; 483 m_copydata(*mp, protoff, sizeof(ip6e), 484 (caddr_t) &ip6e); 485 486 if (ip6e.ip6e_nxt == IPPROTO_AH) 487 l = (ip6e.ip6e_len + 2) << 2; 488 else 489 l = (ip6e.ip6e_len + 1) << 3; 490 KASSERT(l > 0, ("ah6_input: l went zero or negative")); 491 } while (protoff + l < *offp); 492 493 /* Malformed packet check */ 494 if (protoff + l != *offp) { 495 DPRINTF(("ipsec6_common_input: bad packet header chain, " 496 "protoff %u, l %u, off %u\n", protoff, l, *offp)); 497 IPSEC_ISTAT(proto, espstat.esps_hdrops, 498 ahstat.ahs_hdrops, 499 ipcompstat.ipcomps_hdrops); 500 m_freem(*mp); 501 *mp = NULL; 502 return IPPROTO_DONE; 503 } 504 protoff += offsetof(struct ip6_ext, ip6e_nxt); 505 } 506 (void) ipsec_common_input(*mp, *offp, protoff, AF_INET6, proto); 507 return IPPROTO_DONE; 508} 509 510void 511esp6_ctlinput(int cmd, struct sockaddr *sa, void *d) 512{ 513 if (sa->sa_family != AF_INET6 || 514 sa->sa_len != sizeof(struct sockaddr_in6)) 515 return; 516 if ((unsigned)cmd >= PRC_NCMDS) 517 return; 518 519 /* if the parameter is from icmp6, decode it. */ 520 if (d != NULL) { 521 struct ip6ctlparam *ip6cp = (struct ip6ctlparam *)d; 522 struct mbuf *m = ip6cp->ip6c_m; 523 int off = ip6cp->ip6c_off; 524 525 struct ip6ctlparam ip6cp1; 526 527 /* 528 * Notify the error to all possible sockets via pfctlinput2. 529 * Since the upper layer information (such as protocol type, 530 * source and destination ports) is embedded in the encrypted 531 * data and might have been cut, we can't directly call 532 * an upper layer ctlinput function. However, the pcbnotify 533 * function will consider source and destination addresses 534 * as well as the flow info value, and may be able to find 535 * some PCB that should be notified. 536 * Although pfctlinput2 will call esp6_ctlinput(), there is 537 * no possibility of an infinite loop of function calls, 538 * because we don't pass the inner IPv6 header. 539 */ 540 bzero(&ip6cp1, sizeof(ip6cp1)); 541 ip6cp1.ip6c_src = ip6cp->ip6c_src; 542 pfctlinput2(cmd, sa, (void *)&ip6cp1); 543 544 /* 545 * Then go to special cases that need ESP header information. 546 * XXX: We assume that when ip6 is non NULL, 547 * M and OFF are valid. 548 */ 549 550 if (cmd == PRC_MSGSIZE) { 551 struct secasvar *sav; 552 u_int32_t spi; 553 int valid; 554 555 /* check header length before using m_copydata */ 556 if (m->m_pkthdr.len < off + sizeof (struct esp)) 557 return; 558 m_copydata(m, off + offsetof(struct esp, esp_spi), 559 sizeof(u_int32_t), (caddr_t) &spi); 560 /* 561 * Check to see if we have a valid SA corresponding to 562 * the address in the ICMP message payload. 563 */ 564 sav = KEY_ALLOCSA((union sockaddr_union *)sa, 565 IPPROTO_ESP, spi); 566 valid = (sav != NULL); 567 if (sav) 568 KEY_FREESAV(&sav); 569 570 /* XXX Further validation? */ 571 572 /* 573 * Depending on whether the SA is "valid" and 574 * routing table size (mtudisc_{hi,lo}wat), we will: 575 * - recalcurate the new MTU and create the 576 * corresponding routing entry, or 577 * - ignore the MTU change notification. 578 */ 579 icmp6_mtudisc_update(ip6cp, valid); 580 } 581 } else { 582 /* we normally notify any pcb here */ 583 } 584} 585 586/* 587 * IPsec input callback, called by the transform callback. Takes care of 588 * filtering and other sanity checks on the processed packet. 589 */ 590int 591ipsec6_common_input_cb(struct mbuf *m, struct secasvar *sav, int skip, int protoff, 592 struct m_tag *mt) 593{ 594 int prot, af, sproto; 595 struct ip6_hdr *ip6; 596 struct m_tag *mtag; 597 struct tdb_ident *tdbi; 598 struct secasindex *saidx; 599 int nxt; 600 u_int8_t nxt8; 601 int error, nest; 602 603 KASSERT(m != NULL, ("ipsec6_common_input_cb: null mbuf")); 604 KASSERT(sav != NULL, ("ipsec6_common_input_cb: null SA")); 605 KASSERT(sav->sah != NULL, ("ipsec6_common_input_cb: null SAH")); 606 saidx = &sav->sah->saidx; 607 af = saidx->dst.sa.sa_family; 608 KASSERT(af == AF_INET6, 609 ("ipsec6_common_input_cb: unexpected af %u", af)); 610 sproto = saidx->proto; 611 KASSERT(sproto == IPPROTO_ESP || sproto == IPPROTO_AH || 612 sproto == IPPROTO_IPCOMP, 613 ("ipsec6_common_input_cb: unexpected security protocol %u", 614 sproto)); 615 616 /* Sanity check */ 617 if (m == NULL) { 618 DPRINTF(("ipsec4_common_input_cb: null mbuf")); 619 IPSEC_ISTAT(sproto, espstat.esps_badkcr, ahstat.ahs_badkcr, 620 ipcompstat.ipcomps_badkcr); 621 error = EINVAL; 622 goto bad; 623 } 624 625 /* Fix IPv6 header */ 626 if (m->m_len < sizeof(struct ip6_hdr) && 627 (m = m_pullup(m, sizeof(struct ip6_hdr))) == NULL) { 628 629 DPRINTF(("ipsec_common_input_cb: processing failed " 630 "for SA %s/%08lx\n", ipsec_address(&sav->sah->saidx.dst), 631 (u_long) ntohl(sav->spi))); 632 633 IPSEC_ISTAT(sproto, espstat.esps_hdrops, ahstat.ahs_hdrops, 634 ipcompstat.ipcomps_hdrops); 635 error = EACCES; 636 goto bad; 637 } 638 639 ip6 = mtod(m, struct ip6_hdr *); 640 ip6->ip6_plen = htons(m->m_pkthdr.len - sizeof(struct ip6_hdr)); 641 642 /* Save protocol */ 643 m_copydata(m, protoff, 1, (unsigned char *) &prot); 644 645#ifdef INET 646 /* IP-in-IP encapsulation */ 647 if (prot == IPPROTO_IPIP) { 648 struct ip ipn; 649 650 if (m->m_pkthdr.len - skip < sizeof(struct ip)) { 651 IPSEC_ISTAT(sproto, espstat.esps_hdrops, 652 ahstat.ahs_hdrops, 653 ipcompstat.ipcomps_hdrops); 654 error = EINVAL; 655 goto bad; 656 } 657 /* ipn will now contain the inner IPv4 header */ 658 m_copydata(m, skip, sizeof(struct ip), (caddr_t) &ipn); 659 660#ifdef notyet 661 /* 662 * Check that the inner source address is the same as 663 * the proxy address, if available. 664 */ 665 if ((saidx->proxy.sa.sa_family == AF_INET && 666 saidx->proxy.sin.sin_addr.s_addr != INADDR_ANY && 667 ipn.ip_src.s_addr != saidx->proxy.sin.sin_addr.s_addr) || 668 (saidx->proxy.sa.sa_family != AF_INET && 669 saidx->proxy.sa.sa_family != 0)) { 670 671 DPRINTF(("ipsec_common_input_cb: inner " 672 "source address %s doesn't correspond to " 673 "expected proxy source %s, SA %s/%08lx\n", 674 inet_ntoa4(ipn.ip_src), 675 ipsec_address(&saidx->proxy), 676 ipsec_address(&saidx->dst), 677 (u_long) ntohl(sav->spi))); 678 679 IPSEC_ISTATsproto, (espstat.esps_pdrops, 680 ahstat.ahs_pdrops, ipcompstat.ipcomps_pdrops); 681 error = EACCES; 682 goto bad; 683 } 684#endif /*XXX*/ 685 } 686#endif /* INET */ 687 688 /* IPv6-in-IP encapsulation */ 689 if (prot == IPPROTO_IPV6) { 690 struct ip6_hdr ip6n; 691 692 if (m->m_pkthdr.len - skip < sizeof(struct ip6_hdr)) { 693 IPSEC_ISTAT(sproto, espstat.esps_hdrops, 694 ahstat.ahs_hdrops, 695 ipcompstat.ipcomps_hdrops); 696 error = EINVAL; 697 goto bad; 698 } 699 /* ip6n will now contain the inner IPv6 header. */ 700 m_copydata(m, skip, sizeof(struct ip6_hdr), 701 (caddr_t) &ip6n); 702 703#ifdef notyet 704 /* 705 * Check that the inner source address is the same as 706 * the proxy address, if available. 707 */ 708 if ((saidx->proxy.sa.sa_family == AF_INET6 && 709 !IN6_IS_ADDR_UNSPECIFIED(&saidx->proxy.sin6.sin6_addr) && 710 !IN6_ARE_ADDR_EQUAL(&ip6n.ip6_src, 711 &saidx->proxy.sin6.sin6_addr)) || 712 (saidx->proxy.sa.sa_family != AF_INET6 && 713 saidx->proxy.sa.sa_family != 0)) { 714 715 DPRINTF(("ipsec_common_input_cb: inner " 716 "source address %s doesn't correspond to " 717 "expected proxy source %s, SA %s/%08lx\n", 718 ip6_sprintf(&ip6n.ip6_src), 719 ipsec_address(&saidx->proxy), 720 ipsec_address(&saidx->dst), 721 (u_long) ntohl(sav->spi))); 722 723 IPSEC_ISTAT(sproto, espstat.esps_pdrops, 724 ahstat.ahs_pdrops, ipcompstat.ipcomps_pdrops); 725 error = EACCES; 726 goto bad; 727 } 728#endif /*XXX*/ 729 } 730 731 /* 732 * Record what we've done to the packet (under what SA it was 733 * processed). If we've been passed an mtag, it means the packet 734 * was already processed by an ethernet/crypto combo card and 735 * thus has a tag attached with all the right information, but 736 * with a PACKET_TAG_IPSEC_IN_CRYPTO_DONE as opposed to 737 * PACKET_TAG_IPSEC_IN_DONE type; in that case, just change the type. 738 */ 739 if (mt == NULL && sproto != IPPROTO_IPCOMP) { 740 mtag = m_tag_get(PACKET_TAG_IPSEC_IN_DONE, 741 sizeof(struct tdb_ident), M_NOWAIT); 742 if (mtag == NULL) { 743 DPRINTF(("ipsec_common_input_cb: failed to " 744 "get tag\n")); 745 IPSEC_ISTAT(sproto, espstat.esps_hdrops, 746 ahstat.ahs_hdrops, ipcompstat.ipcomps_hdrops); 747 error = ENOMEM; 748 goto bad; 749 } 750 751 tdbi = (struct tdb_ident *)(mtag + 1); 752 bcopy(&saidx->dst, &tdbi->dst, sizeof(union sockaddr_union)); 753 tdbi->proto = sproto; 754 tdbi->spi = sav->spi; 755 756 m_tag_prepend(m, mtag); 757 } else { 758 mt->m_tag_id = PACKET_TAG_IPSEC_IN_DONE; 759 /* XXX do we need to mark m_flags??? */ 760 } 761 762 key_sa_recordxfer(sav, m); 763 764 /* Retrieve new protocol */ 765 m_copydata(m, protoff, sizeof(u_int8_t), (caddr_t) &nxt8); 766 767 /* 768 * See the end of ip6_input for this logic. 769 * IPPROTO_IPV[46] case will be processed just like other ones 770 */ 771 nest = 0; 772 nxt = nxt8; 773 while (nxt != IPPROTO_DONE) { 774 if (ip6_hdrnestlimit && (++nest > ip6_hdrnestlimit)) { 775 ip6stat.ip6s_toomanyhdr++; 776 error = EINVAL; 777 goto bad; 778 } 779 780 /* 781 * Protection against faulty packet - there should be 782 * more sanity checks in header chain processing. 783 */ 784 if (m->m_pkthdr.len < skip) { 785 ip6stat.ip6s_tooshort++; 786 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_truncated); 787 error = EINVAL; 788 goto bad; 789 } 790 /* 791 * Enforce IPsec policy checking if we are seeing last header. 792 * note that we do not visit this with protocols with pcb layer 793 * code - like udp/tcp/raw ip. 794 */ 795 if ((inet6sw[ip6_protox[nxt]].pr_flags & PR_LASTHDR) != 0 && 796 ipsec6_in_reject(m, NULL)) { 797 error = EINVAL; 798 goto bad; 799 } 800 nxt = (*inet6sw[ip6_protox[nxt]].pr_input)(&m, &skip, nxt); 801 } 802 return 0; 803bad: 804 if (m) 805 m_freem(m); 806 return error; 807} 808#endif /* INET6 */
| 212 return error; 213} 214 215#ifdef INET 216/* 217 * Common input handler for IPv4 AH, ESP, and IPCOMP. 218 */ 219int 220ipsec4_common_input(struct mbuf *m, ...) 221{ 222 va_list ap; 223 int off, nxt; 224 225 va_start(ap, m); 226 off = va_arg(ap, int); 227 nxt = va_arg(ap, int); 228 va_end(ap); 229 230 return ipsec_common_input(m, off, offsetof(struct ip, ip_p), 231 AF_INET, nxt); 232} 233 234void 235ah4_input(struct mbuf *m, int off) 236{ 237 ipsec4_common_input(m, off, IPPROTO_AH); 238} 239 240void 241esp4_input(struct mbuf *m, int off) 242{ 243 ipsec4_common_input(m, off, IPPROTO_ESP); 244} 245 246void 247ipcomp4_input(struct mbuf *m, int off) 248{ 249 ipsec4_common_input(m, off, IPPROTO_IPCOMP); 250} 251 252/* 253 * IPsec input callback for INET protocols. 254 * This routine is called as the transform callback. 255 * Takes care of filtering and other sanity checks on 256 * the processed packet. 257 */ 258int 259ipsec4_common_input_cb(struct mbuf *m, struct secasvar *sav, 260 int skip, int protoff, struct m_tag *mt) 261{ 262 int prot, af, sproto; 263 struct ip *ip; 264 struct m_tag *mtag; 265 struct tdb_ident *tdbi; 266 struct secasindex *saidx; 267 int error; 268 269#if 0 270 SPLASSERT(net, "ipsec4_common_input_cb"); 271#endif 272 273 KASSERT(m != NULL, ("ipsec4_common_input_cb: null mbuf")); 274 KASSERT(sav != NULL, ("ipsec4_common_input_cb: null SA")); 275 KASSERT(sav->sah != NULL, ("ipsec4_common_input_cb: null SAH")); 276 saidx = &sav->sah->saidx; 277 af = saidx->dst.sa.sa_family; 278 KASSERT(af == AF_INET, ("ipsec4_common_input_cb: unexpected af %u",af)); 279 sproto = saidx->proto; 280 KASSERT(sproto == IPPROTO_ESP || sproto == IPPROTO_AH || 281 sproto == IPPROTO_IPCOMP, 282 ("ipsec4_common_input_cb: unexpected security protocol %u", 283 sproto)); 284 285 /* Sanity check */ 286 if (m == NULL) { 287 DPRINTF(("ipsec4_common_input_cb: null mbuf")); 288 IPSEC_ISTAT(sproto, espstat.esps_badkcr, ahstat.ahs_badkcr, 289 ipcompstat.ipcomps_badkcr); 290 KEY_FREESAV(&sav); 291 return EINVAL; 292 } 293 294 if (skip != 0) { 295 /* Fix IPv4 header */ 296 if (m->m_len < skip && (m = m_pullup(m, skip)) == NULL) { 297 DPRINTF(("ipsec4_common_input_cb: processing failed " 298 "for SA %s/%08lx\n", 299 ipsec_address(&sav->sah->saidx.dst), 300 (u_long) ntohl(sav->spi))); 301 IPSEC_ISTAT(sproto, espstat.esps_hdrops, ahstat.ahs_hdrops, 302 ipcompstat.ipcomps_hdrops); 303 error = ENOBUFS; 304 goto bad; 305 } 306 307 ip = mtod(m, struct ip *); 308 ip->ip_len = htons(m->m_pkthdr.len); 309 ip->ip_off = htons(ip->ip_off); 310 ip->ip_sum = 0; 311 ip->ip_sum = in_cksum(m, ip->ip_hl << 2); 312 } else { 313 ip = mtod(m, struct ip *); 314 } 315 prot = ip->ip_p; 316 317 /* IP-in-IP encapsulation */ 318 if (prot == IPPROTO_IPIP) { 319 struct ip ipn; 320 321 if (m->m_pkthdr.len - skip < sizeof(struct ip)) { 322 IPSEC_ISTAT(sproto, espstat.esps_hdrops, 323 ahstat.ahs_hdrops, 324 ipcompstat.ipcomps_hdrops); 325 error = EINVAL; 326 goto bad; 327 } 328 /* ipn will now contain the inner IPv4 header */ 329 m_copydata(m, ip->ip_hl << 2, sizeof(struct ip), 330 (caddr_t) &ipn); 331 332#ifdef notyet 333 /* XXX PROXY address isn't recorded in SAH */ 334 /* 335 * Check that the inner source address is the same as 336 * the proxy address, if available. 337 */ 338 if ((saidx->proxy.sa.sa_family == AF_INET && 339 saidx->proxy.sin.sin_addr.s_addr != 340 INADDR_ANY && 341 ipn.ip_src.s_addr != 342 saidx->proxy.sin.sin_addr.s_addr) || 343 (saidx->proxy.sa.sa_family != AF_INET && 344 saidx->proxy.sa.sa_family != 0)) { 345 346 DPRINTF(("ipsec4_common_input_cb: inner " 347 "source address %s doesn't correspond to " 348 "expected proxy source %s, SA %s/%08lx\n", 349 inet_ntoa4(ipn.ip_src), 350 ipsp_address(saidx->proxy), 351 ipsp_address(saidx->dst), 352 (u_long) ntohl(sav->spi))); 353 354 IPSEC_ISTAT(sproto, espstat.esps_pdrops, 355 ahstat.ahs_pdrops, 356 ipcompstat.ipcomps_pdrops); 357 error = EACCES; 358 goto bad; 359 } 360#endif /*XXX*/ 361 } 362#if INET6 363 /* IPv6-in-IP encapsulation. */ 364 if (prot == IPPROTO_IPV6) { 365 struct ip6_hdr ip6n; 366 367 if (m->m_pkthdr.len - skip < sizeof(struct ip6_hdr)) { 368 IPSEC_ISTAT(sproto, espstat.esps_hdrops, 369 ahstat.ahs_hdrops, 370 ipcompstat.ipcomps_hdrops); 371 error = EINVAL; 372 goto bad; 373 } 374 /* ip6n will now contain the inner IPv6 header. */ 375 m_copydata(m, ip->ip_hl << 2, sizeof(struct ip6_hdr), 376 (caddr_t) &ip6n); 377 378#ifdef notyet 379 /* 380 * Check that the inner source address is the same as 381 * the proxy address, if available. 382 */ 383 if ((saidx->proxy.sa.sa_family == AF_INET6 && 384 !IN6_IS_ADDR_UNSPECIFIED(&saidx->proxy.sin6.sin6_addr) && 385 !IN6_ARE_ADDR_EQUAL(&ip6n.ip6_src, 386 &saidx->proxy.sin6.sin6_addr)) || 387 (saidx->proxy.sa.sa_family != AF_INET6 && 388 saidx->proxy.sa.sa_family != 0)) { 389 390 DPRINTF(("ipsec4_common_input_cb: inner " 391 "source address %s doesn't correspond to " 392 "expected proxy source %s, SA %s/%08lx\n", 393 ip6_sprintf(&ip6n.ip6_src), 394 ipsec_address(&saidx->proxy), 395 ipsec_address(&saidx->dst), 396 (u_long) ntohl(sav->spi))); 397 398 IPSEC_ISTAT(sproto, espstat.esps_pdrops, 399 ahstat.ahs_pdrops, 400 ipcompstat.ipcomps_pdrops); 401 error = EACCES; 402 goto bad; 403 } 404#endif /*XXX*/ 405 } 406#endif /* INET6 */ 407 408 /* 409 * Record what we've done to the packet (under what SA it was 410 * processed). If we've been passed an mtag, it means the packet 411 * was already processed by an ethernet/crypto combo card and 412 * thus has a tag attached with all the right information, but 413 * with a PACKET_TAG_IPSEC_IN_CRYPTO_DONE as opposed to 414 * PACKET_TAG_IPSEC_IN_DONE type; in that case, just change the type. 415 */ 416 if (mt == NULL && sproto != IPPROTO_IPCOMP) { 417 mtag = m_tag_get(PACKET_TAG_IPSEC_IN_DONE, 418 sizeof(struct tdb_ident), M_NOWAIT); 419 if (mtag == NULL) { 420 DPRINTF(("ipsec4_common_input_cb: failed to get tag\n")); 421 IPSEC_ISTAT(sproto, espstat.esps_hdrops, 422 ahstat.ahs_hdrops, ipcompstat.ipcomps_hdrops); 423 error = ENOMEM; 424 goto bad; 425 } 426 427 tdbi = (struct tdb_ident *)(mtag + 1); 428 bcopy(&saidx->dst, &tdbi->dst, saidx->dst.sa.sa_len); 429 tdbi->proto = sproto; 430 tdbi->spi = sav->spi; 431 432 m_tag_prepend(m, mtag); 433 } else { 434 mt->m_tag_id = PACKET_TAG_IPSEC_IN_DONE; 435 /* XXX do we need to mark m_flags??? */ 436 } 437 438 key_sa_recordxfer(sav, m); /* record data transfer */ 439 440 /* 441 * Re-dispatch via software interrupt. 442 */ 443 if (!netisr_queue(NETISR_IP, m)) { 444 IPSEC_ISTAT(sproto, espstat.esps_qfull, ahstat.ahs_qfull, 445 ipcompstat.ipcomps_qfull); 446 447 DPRINTF(("ipsec4_common_input_cb: queue full; " 448 "proto %u packet dropped\n", sproto)); 449 return ENOBUFS; 450 } 451 return 0; 452bad: 453 m_freem(m); 454 return error; 455} 456#endif /* INET */ 457 458#ifdef INET6 459/* IPv6 AH wrapper. */ 460int 461ipsec6_common_input(struct mbuf **mp, int *offp, int proto) 462{ 463 int l = 0; 464 int protoff; 465 struct ip6_ext ip6e; 466 467 if (*offp < sizeof(struct ip6_hdr)) { 468 DPRINTF(("ipsec6_common_input: bad offset %u\n", *offp)); 469 return IPPROTO_DONE; 470 } else if (*offp == sizeof(struct ip6_hdr)) { 471 protoff = offsetof(struct ip6_hdr, ip6_nxt); 472 } else { 473 /* Chase down the header chain... */ 474 protoff = sizeof(struct ip6_hdr); 475 476 do { 477 protoff += l; 478 m_copydata(*mp, protoff, sizeof(ip6e), 479 (caddr_t) &ip6e); 480 481 if (ip6e.ip6e_nxt == IPPROTO_AH) 482 l = (ip6e.ip6e_len + 2) << 2; 483 else 484 l = (ip6e.ip6e_len + 1) << 3; 485 KASSERT(l > 0, ("ah6_input: l went zero or negative")); 486 } while (protoff + l < *offp); 487 488 /* Malformed packet check */ 489 if (protoff + l != *offp) { 490 DPRINTF(("ipsec6_common_input: bad packet header chain, " 491 "protoff %u, l %u, off %u\n", protoff, l, *offp)); 492 IPSEC_ISTAT(proto, espstat.esps_hdrops, 493 ahstat.ahs_hdrops, 494 ipcompstat.ipcomps_hdrops); 495 m_freem(*mp); 496 *mp = NULL; 497 return IPPROTO_DONE; 498 } 499 protoff += offsetof(struct ip6_ext, ip6e_nxt); 500 } 501 (void) ipsec_common_input(*mp, *offp, protoff, AF_INET6, proto); 502 return IPPROTO_DONE; 503} 504 505void 506esp6_ctlinput(int cmd, struct sockaddr *sa, void *d) 507{ 508 if (sa->sa_family != AF_INET6 || 509 sa->sa_len != sizeof(struct sockaddr_in6)) 510 return; 511 if ((unsigned)cmd >= PRC_NCMDS) 512 return; 513 514 /* if the parameter is from icmp6, decode it. */ 515 if (d != NULL) { 516 struct ip6ctlparam *ip6cp = (struct ip6ctlparam *)d; 517 struct mbuf *m = ip6cp->ip6c_m; 518 int off = ip6cp->ip6c_off; 519 520 struct ip6ctlparam ip6cp1; 521 522 /* 523 * Notify the error to all possible sockets via pfctlinput2. 524 * Since the upper layer information (such as protocol type, 525 * source and destination ports) is embedded in the encrypted 526 * data and might have been cut, we can't directly call 527 * an upper layer ctlinput function. However, the pcbnotify 528 * function will consider source and destination addresses 529 * as well as the flow info value, and may be able to find 530 * some PCB that should be notified. 531 * Although pfctlinput2 will call esp6_ctlinput(), there is 532 * no possibility of an infinite loop of function calls, 533 * because we don't pass the inner IPv6 header. 534 */ 535 bzero(&ip6cp1, sizeof(ip6cp1)); 536 ip6cp1.ip6c_src = ip6cp->ip6c_src; 537 pfctlinput2(cmd, sa, (void *)&ip6cp1); 538 539 /* 540 * Then go to special cases that need ESP header information. 541 * XXX: We assume that when ip6 is non NULL, 542 * M and OFF are valid. 543 */ 544 545 if (cmd == PRC_MSGSIZE) { 546 struct secasvar *sav; 547 u_int32_t spi; 548 int valid; 549 550 /* check header length before using m_copydata */ 551 if (m->m_pkthdr.len < off + sizeof (struct esp)) 552 return; 553 m_copydata(m, off + offsetof(struct esp, esp_spi), 554 sizeof(u_int32_t), (caddr_t) &spi); 555 /* 556 * Check to see if we have a valid SA corresponding to 557 * the address in the ICMP message payload. 558 */ 559 sav = KEY_ALLOCSA((union sockaddr_union *)sa, 560 IPPROTO_ESP, spi); 561 valid = (sav != NULL); 562 if (sav) 563 KEY_FREESAV(&sav); 564 565 /* XXX Further validation? */ 566 567 /* 568 * Depending on whether the SA is "valid" and 569 * routing table size (mtudisc_{hi,lo}wat), we will: 570 * - recalcurate the new MTU and create the 571 * corresponding routing entry, or 572 * - ignore the MTU change notification. 573 */ 574 icmp6_mtudisc_update(ip6cp, valid); 575 } 576 } else { 577 /* we normally notify any pcb here */ 578 } 579} 580 581/* 582 * IPsec input callback, called by the transform callback. Takes care of 583 * filtering and other sanity checks on the processed packet. 584 */ 585int 586ipsec6_common_input_cb(struct mbuf *m, struct secasvar *sav, int skip, int protoff, 587 struct m_tag *mt) 588{ 589 int prot, af, sproto; 590 struct ip6_hdr *ip6; 591 struct m_tag *mtag; 592 struct tdb_ident *tdbi; 593 struct secasindex *saidx; 594 int nxt; 595 u_int8_t nxt8; 596 int error, nest; 597 598 KASSERT(m != NULL, ("ipsec6_common_input_cb: null mbuf")); 599 KASSERT(sav != NULL, ("ipsec6_common_input_cb: null SA")); 600 KASSERT(sav->sah != NULL, ("ipsec6_common_input_cb: null SAH")); 601 saidx = &sav->sah->saidx; 602 af = saidx->dst.sa.sa_family; 603 KASSERT(af == AF_INET6, 604 ("ipsec6_common_input_cb: unexpected af %u", af)); 605 sproto = saidx->proto; 606 KASSERT(sproto == IPPROTO_ESP || sproto == IPPROTO_AH || 607 sproto == IPPROTO_IPCOMP, 608 ("ipsec6_common_input_cb: unexpected security protocol %u", 609 sproto)); 610 611 /* Sanity check */ 612 if (m == NULL) { 613 DPRINTF(("ipsec4_common_input_cb: null mbuf")); 614 IPSEC_ISTAT(sproto, espstat.esps_badkcr, ahstat.ahs_badkcr, 615 ipcompstat.ipcomps_badkcr); 616 error = EINVAL; 617 goto bad; 618 } 619 620 /* Fix IPv6 header */ 621 if (m->m_len < sizeof(struct ip6_hdr) && 622 (m = m_pullup(m, sizeof(struct ip6_hdr))) == NULL) { 623 624 DPRINTF(("ipsec_common_input_cb: processing failed " 625 "for SA %s/%08lx\n", ipsec_address(&sav->sah->saidx.dst), 626 (u_long) ntohl(sav->spi))); 627 628 IPSEC_ISTAT(sproto, espstat.esps_hdrops, ahstat.ahs_hdrops, 629 ipcompstat.ipcomps_hdrops); 630 error = EACCES; 631 goto bad; 632 } 633 634 ip6 = mtod(m, struct ip6_hdr *); 635 ip6->ip6_plen = htons(m->m_pkthdr.len - sizeof(struct ip6_hdr)); 636 637 /* Save protocol */ 638 m_copydata(m, protoff, 1, (unsigned char *) &prot); 639 640#ifdef INET 641 /* IP-in-IP encapsulation */ 642 if (prot == IPPROTO_IPIP) { 643 struct ip ipn; 644 645 if (m->m_pkthdr.len - skip < sizeof(struct ip)) { 646 IPSEC_ISTAT(sproto, espstat.esps_hdrops, 647 ahstat.ahs_hdrops, 648 ipcompstat.ipcomps_hdrops); 649 error = EINVAL; 650 goto bad; 651 } 652 /* ipn will now contain the inner IPv4 header */ 653 m_copydata(m, skip, sizeof(struct ip), (caddr_t) &ipn); 654 655#ifdef notyet 656 /* 657 * Check that the inner source address is the same as 658 * the proxy address, if available. 659 */ 660 if ((saidx->proxy.sa.sa_family == AF_INET && 661 saidx->proxy.sin.sin_addr.s_addr != INADDR_ANY && 662 ipn.ip_src.s_addr != saidx->proxy.sin.sin_addr.s_addr) || 663 (saidx->proxy.sa.sa_family != AF_INET && 664 saidx->proxy.sa.sa_family != 0)) { 665 666 DPRINTF(("ipsec_common_input_cb: inner " 667 "source address %s doesn't correspond to " 668 "expected proxy source %s, SA %s/%08lx\n", 669 inet_ntoa4(ipn.ip_src), 670 ipsec_address(&saidx->proxy), 671 ipsec_address(&saidx->dst), 672 (u_long) ntohl(sav->spi))); 673 674 IPSEC_ISTATsproto, (espstat.esps_pdrops, 675 ahstat.ahs_pdrops, ipcompstat.ipcomps_pdrops); 676 error = EACCES; 677 goto bad; 678 } 679#endif /*XXX*/ 680 } 681#endif /* INET */ 682 683 /* IPv6-in-IP encapsulation */ 684 if (prot == IPPROTO_IPV6) { 685 struct ip6_hdr ip6n; 686 687 if (m->m_pkthdr.len - skip < sizeof(struct ip6_hdr)) { 688 IPSEC_ISTAT(sproto, espstat.esps_hdrops, 689 ahstat.ahs_hdrops, 690 ipcompstat.ipcomps_hdrops); 691 error = EINVAL; 692 goto bad; 693 } 694 /* ip6n will now contain the inner IPv6 header. */ 695 m_copydata(m, skip, sizeof(struct ip6_hdr), 696 (caddr_t) &ip6n); 697 698#ifdef notyet 699 /* 700 * Check that the inner source address is the same as 701 * the proxy address, if available. 702 */ 703 if ((saidx->proxy.sa.sa_family == AF_INET6 && 704 !IN6_IS_ADDR_UNSPECIFIED(&saidx->proxy.sin6.sin6_addr) && 705 !IN6_ARE_ADDR_EQUAL(&ip6n.ip6_src, 706 &saidx->proxy.sin6.sin6_addr)) || 707 (saidx->proxy.sa.sa_family != AF_INET6 && 708 saidx->proxy.sa.sa_family != 0)) { 709 710 DPRINTF(("ipsec_common_input_cb: inner " 711 "source address %s doesn't correspond to " 712 "expected proxy source %s, SA %s/%08lx\n", 713 ip6_sprintf(&ip6n.ip6_src), 714 ipsec_address(&saidx->proxy), 715 ipsec_address(&saidx->dst), 716 (u_long) ntohl(sav->spi))); 717 718 IPSEC_ISTAT(sproto, espstat.esps_pdrops, 719 ahstat.ahs_pdrops, ipcompstat.ipcomps_pdrops); 720 error = EACCES; 721 goto bad; 722 } 723#endif /*XXX*/ 724 } 725 726 /* 727 * Record what we've done to the packet (under what SA it was 728 * processed). If we've been passed an mtag, it means the packet 729 * was already processed by an ethernet/crypto combo card and 730 * thus has a tag attached with all the right information, but 731 * with a PACKET_TAG_IPSEC_IN_CRYPTO_DONE as opposed to 732 * PACKET_TAG_IPSEC_IN_DONE type; in that case, just change the type. 733 */ 734 if (mt == NULL && sproto != IPPROTO_IPCOMP) { 735 mtag = m_tag_get(PACKET_TAG_IPSEC_IN_DONE, 736 sizeof(struct tdb_ident), M_NOWAIT); 737 if (mtag == NULL) { 738 DPRINTF(("ipsec_common_input_cb: failed to " 739 "get tag\n")); 740 IPSEC_ISTAT(sproto, espstat.esps_hdrops, 741 ahstat.ahs_hdrops, ipcompstat.ipcomps_hdrops); 742 error = ENOMEM; 743 goto bad; 744 } 745 746 tdbi = (struct tdb_ident *)(mtag + 1); 747 bcopy(&saidx->dst, &tdbi->dst, sizeof(union sockaddr_union)); 748 tdbi->proto = sproto; 749 tdbi->spi = sav->spi; 750 751 m_tag_prepend(m, mtag); 752 } else { 753 mt->m_tag_id = PACKET_TAG_IPSEC_IN_DONE; 754 /* XXX do we need to mark m_flags??? */ 755 } 756 757 key_sa_recordxfer(sav, m); 758 759 /* Retrieve new protocol */ 760 m_copydata(m, protoff, sizeof(u_int8_t), (caddr_t) &nxt8); 761 762 /* 763 * See the end of ip6_input for this logic. 764 * IPPROTO_IPV[46] case will be processed just like other ones 765 */ 766 nest = 0; 767 nxt = nxt8; 768 while (nxt != IPPROTO_DONE) { 769 if (ip6_hdrnestlimit && (++nest > ip6_hdrnestlimit)) { 770 ip6stat.ip6s_toomanyhdr++; 771 error = EINVAL; 772 goto bad; 773 } 774 775 /* 776 * Protection against faulty packet - there should be 777 * more sanity checks in header chain processing. 778 */ 779 if (m->m_pkthdr.len < skip) { 780 ip6stat.ip6s_tooshort++; 781 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_truncated); 782 error = EINVAL; 783 goto bad; 784 } 785 /* 786 * Enforce IPsec policy checking if we are seeing last header. 787 * note that we do not visit this with protocols with pcb layer 788 * code - like udp/tcp/raw ip. 789 */ 790 if ((inet6sw[ip6_protox[nxt]].pr_flags & PR_LASTHDR) != 0 && 791 ipsec6_in_reject(m, NULL)) { 792 error = EINVAL; 793 goto bad; 794 } 795 nxt = (*inet6sw[ip6_protox[nxt]].pr_input)(&m, &skip, nxt); 796 } 797 return 0; 798bad: 799 if (m) 800 m_freem(m); 801 return error; 802} 803#endif /* INET6 */
|