212 return error; 213} 214 215#ifdef INET 216/* 217 * Common input handler for IPv4 AH, ESP, and IPCOMP. 218 */ 219int 220ipsec4_common_input(struct mbuf *m, ...) 221{ 222 va_list ap; 223 int off, nxt; 224 225 va_start(ap, m); 226 off = va_arg(ap, int); 227 nxt = va_arg(ap, int); 228 va_end(ap); 229 230 return ipsec_common_input(m, off, offsetof(struct ip, ip_p), 231 AF_INET, nxt); 232} 233 234void 235ah4_input(struct mbuf *m, int off) 236{ 237 ipsec4_common_input(m, off, IPPROTO_AH); 238} 239 240void 241esp4_input(struct mbuf *m, int off) 242{ 243 ipsec4_common_input(m, off, IPPROTO_ESP); 244} 245 246void 247ipcomp4_input(struct mbuf *m, int off) 248{ 249 ipsec4_common_input(m, off, IPPROTO_IPCOMP); 250} 251 252/* 253 * IPsec input callback for INET protocols. 254 * This routine is called as the transform callback. 255 * Takes care of filtering and other sanity checks on 256 * the processed packet. 257 */ 258int 259ipsec4_common_input_cb(struct mbuf *m, struct secasvar *sav, 260 int skip, int protoff, struct m_tag *mt) 261{ 262 int prot, af, sproto; 263 struct ip *ip; 264 struct m_tag *mtag; 265 struct tdb_ident *tdbi; 266 struct secasindex *saidx; 267 int error; 268 269#if 0 270 SPLASSERT(net, "ipsec4_common_input_cb"); 271#endif 272 273 KASSERT(m != NULL, ("ipsec4_common_input_cb: null mbuf")); 274 KASSERT(sav != NULL, ("ipsec4_common_input_cb: null SA")); 275 KASSERT(sav->sah != NULL, ("ipsec4_common_input_cb: null SAH")); 276 saidx = &sav->sah->saidx; 277 af = saidx->dst.sa.sa_family; 278 KASSERT(af == AF_INET, ("ipsec4_common_input_cb: unexpected af %u",af)); 279 sproto = saidx->proto; 280 KASSERT(sproto == IPPROTO_ESP || sproto == IPPROTO_AH || 281 sproto == IPPROTO_IPCOMP, 282 ("ipsec4_common_input_cb: unexpected security protocol %u", 283 sproto)); 284 285 /* Sanity check */ 286 if (m == NULL) { 287 DPRINTF(("ipsec4_common_input_cb: null mbuf")); 288 IPSEC_ISTAT(sproto, espstat.esps_badkcr, ahstat.ahs_badkcr, 289 ipcompstat.ipcomps_badkcr); 290 KEY_FREESAV(&sav); 291 return EINVAL; 292 } 293 294 if (skip != 0) { 295 /* Fix IPv4 header */ 296 if (m->m_len < skip && (m = m_pullup(m, skip)) == NULL) { 297 DPRINTF(("ipsec4_common_input_cb: processing failed " 298 "for SA %s/%08lx\n", 299 ipsec_address(&sav->sah->saidx.dst), 300 (u_long) ntohl(sav->spi))); 301 IPSEC_ISTAT(sproto, espstat.esps_hdrops, ahstat.ahs_hdrops, 302 ipcompstat.ipcomps_hdrops); 303 error = ENOBUFS; 304 goto bad; 305 } 306 307 ip = mtod(m, struct ip *); 308 ip->ip_len = htons(m->m_pkthdr.len); 309 ip->ip_off = htons(ip->ip_off); 310 ip->ip_sum = 0; 311 ip->ip_sum = in_cksum(m, ip->ip_hl << 2); 312 } else { 313 ip = mtod(m, struct ip *); 314 } 315 prot = ip->ip_p; 316 317 /* IP-in-IP encapsulation */ 318 if (prot == IPPROTO_IPIP) { 319 struct ip ipn; 320 321 if (m->m_pkthdr.len - skip < sizeof(struct ip)) { 322 IPSEC_ISTAT(sproto, espstat.esps_hdrops, 323 ahstat.ahs_hdrops, 324 ipcompstat.ipcomps_hdrops); 325 error = EINVAL; 326 goto bad; 327 } 328 /* ipn will now contain the inner IPv4 header */ 329 m_copydata(m, ip->ip_hl << 2, sizeof(struct ip), 330 (caddr_t) &ipn); 331 332#ifdef notyet 333 /* XXX PROXY address isn't recorded in SAH */ 334 /* 335 * Check that the inner source address is the same as 336 * the proxy address, if available. 337 */ 338 if ((saidx->proxy.sa.sa_family == AF_INET && 339 saidx->proxy.sin.sin_addr.s_addr != 340 INADDR_ANY && 341 ipn.ip_src.s_addr != 342 saidx->proxy.sin.sin_addr.s_addr) || 343 (saidx->proxy.sa.sa_family != AF_INET && 344 saidx->proxy.sa.sa_family != 0)) { 345 346 DPRINTF(("ipsec4_common_input_cb: inner " 347 "source address %s doesn't correspond to " 348 "expected proxy source %s, SA %s/%08lx\n", 349 inet_ntoa4(ipn.ip_src), 350 ipsp_address(saidx->proxy), 351 ipsp_address(saidx->dst), 352 (u_long) ntohl(sav->spi))); 353 354 IPSEC_ISTAT(sproto, espstat.esps_pdrops, 355 ahstat.ahs_pdrops, 356 ipcompstat.ipcomps_pdrops); 357 error = EACCES; 358 goto bad; 359 } 360#endif /*XXX*/ 361 } 362#if INET6 363 /* IPv6-in-IP encapsulation. */ 364 if (prot == IPPROTO_IPV6) { 365 struct ip6_hdr ip6n; 366 367 if (m->m_pkthdr.len - skip < sizeof(struct ip6_hdr)) { 368 IPSEC_ISTAT(sproto, espstat.esps_hdrops, 369 ahstat.ahs_hdrops, 370 ipcompstat.ipcomps_hdrops); 371 error = EINVAL; 372 goto bad; 373 } 374 /* ip6n will now contain the inner IPv6 header. */ 375 m_copydata(m, ip->ip_hl << 2, sizeof(struct ip6_hdr), 376 (caddr_t) &ip6n); 377 378#ifdef notyet 379 /* 380 * Check that the inner source address is the same as 381 * the proxy address, if available. 382 */ 383 if ((saidx->proxy.sa.sa_family == AF_INET6 && 384 !IN6_IS_ADDR_UNSPECIFIED(&saidx->proxy.sin6.sin6_addr) && 385 !IN6_ARE_ADDR_EQUAL(&ip6n.ip6_src, 386 &saidx->proxy.sin6.sin6_addr)) || 387 (saidx->proxy.sa.sa_family != AF_INET6 && 388 saidx->proxy.sa.sa_family != 0)) { 389 390 DPRINTF(("ipsec4_common_input_cb: inner " 391 "source address %s doesn't correspond to " 392 "expected proxy source %s, SA %s/%08lx\n", 393 ip6_sprintf(&ip6n.ip6_src), 394 ipsec_address(&saidx->proxy), 395 ipsec_address(&saidx->dst), 396 (u_long) ntohl(sav->spi))); 397 398 IPSEC_ISTAT(sproto, espstat.esps_pdrops, 399 ahstat.ahs_pdrops, 400 ipcompstat.ipcomps_pdrops); 401 error = EACCES; 402 goto bad; 403 } 404#endif /*XXX*/ 405 } 406#endif /* INET6 */ 407 408 /* 409 * Record what we've done to the packet (under what SA it was 410 * processed). If we've been passed an mtag, it means the packet 411 * was already processed by an ethernet/crypto combo card and 412 * thus has a tag attached with all the right information, but 413 * with a PACKET_TAG_IPSEC_IN_CRYPTO_DONE as opposed to 414 * PACKET_TAG_IPSEC_IN_DONE type; in that case, just change the type. 415 */ 416 if (mt == NULL && sproto != IPPROTO_IPCOMP) { 417 mtag = m_tag_get(PACKET_TAG_IPSEC_IN_DONE, 418 sizeof(struct tdb_ident), M_NOWAIT); 419 if (mtag == NULL) { 420 DPRINTF(("ipsec4_common_input_cb: failed to get tag\n")); 421 IPSEC_ISTAT(sproto, espstat.esps_hdrops, 422 ahstat.ahs_hdrops, ipcompstat.ipcomps_hdrops); 423 error = ENOMEM; 424 goto bad; 425 } 426 427 tdbi = (struct tdb_ident *)(mtag + 1); 428 bcopy(&saidx->dst, &tdbi->dst, saidx->dst.sa.sa_len); 429 tdbi->proto = sproto; 430 tdbi->spi = sav->spi; 431 432 m_tag_prepend(m, mtag); 433 } else { 434 mt->m_tag_id = PACKET_TAG_IPSEC_IN_DONE; 435 /* XXX do we need to mark m_flags??? */ 436 } 437 438 key_sa_recordxfer(sav, m); /* record data transfer */ 439 440 /* 441 * Re-dispatch via software interrupt. 442 */ 443 if (!netisr_queue(NETISR_IP, m)) { 444 IPSEC_ISTAT(sproto, espstat.esps_qfull, ahstat.ahs_qfull, 445 ipcompstat.ipcomps_qfull); 446 447 DPRINTF(("ipsec4_common_input_cb: queue full; " 448 "proto %u packet dropped\n", sproto)); 449 return ENOBUFS; 450 } 451 return 0; 452bad: 453 m_freem(m); 454 return error; 455} 456#endif /* INET */ 457 458#ifdef INET6 459/* IPv6 AH wrapper. */ 460int 461ipsec6_common_input(struct mbuf **mp, int *offp, int proto) 462{ 463 int l = 0; 464 int protoff; 465 struct ip6_ext ip6e; 466 467 if (*offp < sizeof(struct ip6_hdr)) { 468 DPRINTF(("ipsec6_common_input: bad offset %u\n", *offp)); 469 return IPPROTO_DONE; 470 } else if (*offp == sizeof(struct ip6_hdr)) { 471 protoff = offsetof(struct ip6_hdr, ip6_nxt); 472 } else { 473 /* Chase down the header chain... */ 474 protoff = sizeof(struct ip6_hdr); 475 476 do { 477 protoff += l; 478 m_copydata(*mp, protoff, sizeof(ip6e), 479 (caddr_t) &ip6e); 480 481 if (ip6e.ip6e_nxt == IPPROTO_AH) 482 l = (ip6e.ip6e_len + 2) << 2; 483 else 484 l = (ip6e.ip6e_len + 1) << 3; 485 KASSERT(l > 0, ("ah6_input: l went zero or negative")); 486 } while (protoff + l < *offp); 487 488 /* Malformed packet check */ 489 if (protoff + l != *offp) { 490 DPRINTF(("ipsec6_common_input: bad packet header chain, " 491 "protoff %u, l %u, off %u\n", protoff, l, *offp)); 492 IPSEC_ISTAT(proto, espstat.esps_hdrops, 493 ahstat.ahs_hdrops, 494 ipcompstat.ipcomps_hdrops); 495 m_freem(*mp); 496 *mp = NULL; 497 return IPPROTO_DONE; 498 } 499 protoff += offsetof(struct ip6_ext, ip6e_nxt); 500 } 501 (void) ipsec_common_input(*mp, *offp, protoff, AF_INET6, proto); 502 return IPPROTO_DONE; 503} 504 505void 506esp6_ctlinput(int cmd, struct sockaddr *sa, void *d) 507{ 508 if (sa->sa_family != AF_INET6 || 509 sa->sa_len != sizeof(struct sockaddr_in6)) 510 return; 511 if ((unsigned)cmd >= PRC_NCMDS) 512 return; 513 514 /* if the parameter is from icmp6, decode it. */ 515 if (d != NULL) { 516 struct ip6ctlparam *ip6cp = (struct ip6ctlparam *)d; 517 struct mbuf *m = ip6cp->ip6c_m; 518 int off = ip6cp->ip6c_off; 519 520 struct ip6ctlparam ip6cp1; 521 522 /* 523 * Notify the error to all possible sockets via pfctlinput2. 524 * Since the upper layer information (such as protocol type, 525 * source and destination ports) is embedded in the encrypted 526 * data and might have been cut, we can't directly call 527 * an upper layer ctlinput function. However, the pcbnotify 528 * function will consider source and destination addresses 529 * as well as the flow info value, and may be able to find 530 * some PCB that should be notified. 531 * Although pfctlinput2 will call esp6_ctlinput(), there is 532 * no possibility of an infinite loop of function calls, 533 * because we don't pass the inner IPv6 header. 534 */ 535 bzero(&ip6cp1, sizeof(ip6cp1)); 536 ip6cp1.ip6c_src = ip6cp->ip6c_src; 537 pfctlinput2(cmd, sa, (void *)&ip6cp1); 538 539 /* 540 * Then go to special cases that need ESP header information. 541 * XXX: We assume that when ip6 is non NULL, 542 * M and OFF are valid. 543 */ 544 545 if (cmd == PRC_MSGSIZE) { 546 struct secasvar *sav; 547 u_int32_t spi; 548 int valid; 549 550 /* check header length before using m_copydata */ 551 if (m->m_pkthdr.len < off + sizeof (struct esp)) 552 return; 553 m_copydata(m, off + offsetof(struct esp, esp_spi), 554 sizeof(u_int32_t), (caddr_t) &spi); 555 /* 556 * Check to see if we have a valid SA corresponding to 557 * the address in the ICMP message payload. 558 */ 559 sav = KEY_ALLOCSA((union sockaddr_union *)sa, 560 IPPROTO_ESP, spi); 561 valid = (sav != NULL); 562 if (sav) 563 KEY_FREESAV(&sav); 564 565 /* XXX Further validation? */ 566 567 /* 568 * Depending on whether the SA is "valid" and 569 * routing table size (mtudisc_{hi,lo}wat), we will: 570 * - recalcurate the new MTU and create the 571 * corresponding routing entry, or 572 * - ignore the MTU change notification. 573 */ 574 icmp6_mtudisc_update(ip6cp, valid); 575 } 576 } else { 577 /* we normally notify any pcb here */ 578 } 579} 580 581/* 582 * IPsec input callback, called by the transform callback. Takes care of 583 * filtering and other sanity checks on the processed packet. 584 */ 585int 586ipsec6_common_input_cb(struct mbuf *m, struct secasvar *sav, int skip, int protoff, 587 struct m_tag *mt) 588{ 589 int prot, af, sproto; 590 struct ip6_hdr *ip6; 591 struct m_tag *mtag; 592 struct tdb_ident *tdbi; 593 struct secasindex *saidx; 594 int nxt; 595 u_int8_t nxt8; 596 int error, nest; 597 598 KASSERT(m != NULL, ("ipsec6_common_input_cb: null mbuf")); 599 KASSERT(sav != NULL, ("ipsec6_common_input_cb: null SA")); 600 KASSERT(sav->sah != NULL, ("ipsec6_common_input_cb: null SAH")); 601 saidx = &sav->sah->saidx; 602 af = saidx->dst.sa.sa_family; 603 KASSERT(af == AF_INET6, 604 ("ipsec6_common_input_cb: unexpected af %u", af)); 605 sproto = saidx->proto; 606 KASSERT(sproto == IPPROTO_ESP || sproto == IPPROTO_AH || 607 sproto == IPPROTO_IPCOMP, 608 ("ipsec6_common_input_cb: unexpected security protocol %u", 609 sproto)); 610 611 /* Sanity check */ 612 if (m == NULL) { 613 DPRINTF(("ipsec4_common_input_cb: null mbuf")); 614 IPSEC_ISTAT(sproto, espstat.esps_badkcr, ahstat.ahs_badkcr, 615 ipcompstat.ipcomps_badkcr); 616 error = EINVAL; 617 goto bad; 618 } 619 620 /* Fix IPv6 header */ 621 if (m->m_len < sizeof(struct ip6_hdr) && 622 (m = m_pullup(m, sizeof(struct ip6_hdr))) == NULL) { 623 624 DPRINTF(("ipsec_common_input_cb: processing failed " 625 "for SA %s/%08lx\n", ipsec_address(&sav->sah->saidx.dst), 626 (u_long) ntohl(sav->spi))); 627 628 IPSEC_ISTAT(sproto, espstat.esps_hdrops, ahstat.ahs_hdrops, 629 ipcompstat.ipcomps_hdrops); 630 error = EACCES; 631 goto bad; 632 } 633 634 ip6 = mtod(m, struct ip6_hdr *); 635 ip6->ip6_plen = htons(m->m_pkthdr.len - sizeof(struct ip6_hdr)); 636 637 /* Save protocol */ 638 m_copydata(m, protoff, 1, (unsigned char *) &prot); 639 640#ifdef INET 641 /* IP-in-IP encapsulation */ 642 if (prot == IPPROTO_IPIP) { 643 struct ip ipn; 644 645 if (m->m_pkthdr.len - skip < sizeof(struct ip)) { 646 IPSEC_ISTAT(sproto, espstat.esps_hdrops, 647 ahstat.ahs_hdrops, 648 ipcompstat.ipcomps_hdrops); 649 error = EINVAL; 650 goto bad; 651 } 652 /* ipn will now contain the inner IPv4 header */ 653 m_copydata(m, skip, sizeof(struct ip), (caddr_t) &ipn); 654 655#ifdef notyet 656 /* 657 * Check that the inner source address is the same as 658 * the proxy address, if available. 659 */ 660 if ((saidx->proxy.sa.sa_family == AF_INET && 661 saidx->proxy.sin.sin_addr.s_addr != INADDR_ANY && 662 ipn.ip_src.s_addr != saidx->proxy.sin.sin_addr.s_addr) || 663 (saidx->proxy.sa.sa_family != AF_INET && 664 saidx->proxy.sa.sa_family != 0)) { 665 666 DPRINTF(("ipsec_common_input_cb: inner " 667 "source address %s doesn't correspond to " 668 "expected proxy source %s, SA %s/%08lx\n", 669 inet_ntoa4(ipn.ip_src), 670 ipsec_address(&saidx->proxy), 671 ipsec_address(&saidx->dst), 672 (u_long) ntohl(sav->spi))); 673 674 IPSEC_ISTATsproto, (espstat.esps_pdrops, 675 ahstat.ahs_pdrops, ipcompstat.ipcomps_pdrops); 676 error = EACCES; 677 goto bad; 678 } 679#endif /*XXX*/ 680 } 681#endif /* INET */ 682 683 /* IPv6-in-IP encapsulation */ 684 if (prot == IPPROTO_IPV6) { 685 struct ip6_hdr ip6n; 686 687 if (m->m_pkthdr.len - skip < sizeof(struct ip6_hdr)) { 688 IPSEC_ISTAT(sproto, espstat.esps_hdrops, 689 ahstat.ahs_hdrops, 690 ipcompstat.ipcomps_hdrops); 691 error = EINVAL; 692 goto bad; 693 } 694 /* ip6n will now contain the inner IPv6 header. */ 695 m_copydata(m, skip, sizeof(struct ip6_hdr), 696 (caddr_t) &ip6n); 697 698#ifdef notyet 699 /* 700 * Check that the inner source address is the same as 701 * the proxy address, if available. 702 */ 703 if ((saidx->proxy.sa.sa_family == AF_INET6 && 704 !IN6_IS_ADDR_UNSPECIFIED(&saidx->proxy.sin6.sin6_addr) && 705 !IN6_ARE_ADDR_EQUAL(&ip6n.ip6_src, 706 &saidx->proxy.sin6.sin6_addr)) || 707 (saidx->proxy.sa.sa_family != AF_INET6 && 708 saidx->proxy.sa.sa_family != 0)) { 709 710 DPRINTF(("ipsec_common_input_cb: inner " 711 "source address %s doesn't correspond to " 712 "expected proxy source %s, SA %s/%08lx\n", 713 ip6_sprintf(&ip6n.ip6_src), 714 ipsec_address(&saidx->proxy), 715 ipsec_address(&saidx->dst), 716 (u_long) ntohl(sav->spi))); 717 718 IPSEC_ISTAT(sproto, espstat.esps_pdrops, 719 ahstat.ahs_pdrops, ipcompstat.ipcomps_pdrops); 720 error = EACCES; 721 goto bad; 722 } 723#endif /*XXX*/ 724 } 725 726 /* 727 * Record what we've done to the packet (under what SA it was 728 * processed). If we've been passed an mtag, it means the packet 729 * was already processed by an ethernet/crypto combo card and 730 * thus has a tag attached with all the right information, but 731 * with a PACKET_TAG_IPSEC_IN_CRYPTO_DONE as opposed to 732 * PACKET_TAG_IPSEC_IN_DONE type; in that case, just change the type. 733 */ 734 if (mt == NULL && sproto != IPPROTO_IPCOMP) { 735 mtag = m_tag_get(PACKET_TAG_IPSEC_IN_DONE, 736 sizeof(struct tdb_ident), M_NOWAIT); 737 if (mtag == NULL) { 738 DPRINTF(("ipsec_common_input_cb: failed to " 739 "get tag\n")); 740 IPSEC_ISTAT(sproto, espstat.esps_hdrops, 741 ahstat.ahs_hdrops, ipcompstat.ipcomps_hdrops); 742 error = ENOMEM; 743 goto bad; 744 } 745 746 tdbi = (struct tdb_ident *)(mtag + 1); 747 bcopy(&saidx->dst, &tdbi->dst, sizeof(union sockaddr_union)); 748 tdbi->proto = sproto; 749 tdbi->spi = sav->spi; 750 751 m_tag_prepend(m, mtag); 752 } else { 753 mt->m_tag_id = PACKET_TAG_IPSEC_IN_DONE; 754 /* XXX do we need to mark m_flags??? */ 755 } 756 757 key_sa_recordxfer(sav, m); 758 759 /* Retrieve new protocol */ 760 m_copydata(m, protoff, sizeof(u_int8_t), (caddr_t) &nxt8); 761 762 /* 763 * See the end of ip6_input for this logic. 764 * IPPROTO_IPV[46] case will be processed just like other ones 765 */ 766 nest = 0; 767 nxt = nxt8; 768 while (nxt != IPPROTO_DONE) { 769 if (ip6_hdrnestlimit && (++nest > ip6_hdrnestlimit)) { 770 ip6stat.ip6s_toomanyhdr++; 771 error = EINVAL; 772 goto bad; 773 } 774 775 /* 776 * Protection against faulty packet - there should be 777 * more sanity checks in header chain processing. 778 */ 779 if (m->m_pkthdr.len < skip) { 780 ip6stat.ip6s_tooshort++; 781 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_truncated); 782 error = EINVAL; 783 goto bad; 784 } 785 /* 786 * Enforce IPsec policy checking if we are seeing last header. 787 * note that we do not visit this with protocols with pcb layer 788 * code - like udp/tcp/raw ip. 789 */ 790 if ((inet6sw[ip6_protox[nxt]].pr_flags & PR_LASTHDR) != 0 && 791 ipsec6_in_reject(m, NULL)) { 792 error = EINVAL; 793 goto bad; 794 } 795 nxt = (*inet6sw[ip6_protox[nxt]].pr_input)(&m, &skip, nxt); 796 } 797 return 0; 798bad: 799 if (m) 800 m_freem(m); 801 return error; 802} 803#endif /* INET6 */
|