1/* $FreeBSD: head/sys/netipsec/ipsec_input.c 185571 2008-12-02 21:37:28Z bz $ */
2/* $OpenBSD: ipsec_input.c,v 1.63 2003/02/20 18:35:43 deraadt Exp $ */
3/*-
4 * The authors of this code are John Ioannidis (ji@tla.org),
5 * Angelos D. Keromytis (kermit@csd.uch.gr) and
6 * Niels Provos (provos@physnet.uni-hamburg.de).
7 *
8 * This code was written by John Ioannidis for BSD/OS in Athens, Greece,
9 * in November 1995.
10 *
11 * Ported to OpenBSD and NetBSD, with additional transforms, in December 1996,
12 * by Angelos D. Keromytis.
13 *
14 * Additional transforms and features in 1997 and 1998 by Angelos D. Keromytis
15 * and Niels Provos.
16 *
17 * Additional features in 1999 by Angelos D. Keromytis.
18 *
19 * Copyright (C) 1995, 1996, 1997, 1998, 1999 by John Ioannidis,
20 * Angelos D. Keromytis and Niels Provos.
21 * Copyright (c) 2001, Angelos D. Keromytis.
22 *
23 * Permission to use, copy, and modify this software with or without fee
24 * is hereby granted, provided that this entire notice is included in
25 * all copies of any software which is or includes a copy or
26 * modification of this software.
27 * You may use this code under the GNU public license if you so wish. Please
28 * contribute changes back to the authors under this freer than GPL license
29 * so that we may further the use of strong encryption without limitations to
30 * all.
31 *
32 * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR
33 * IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY
34 * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE
35 * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR
36 * PURPOSE.
37 */
38
39/*
40 * IPsec input processing.
41 */
42
43#include "opt_inet.h"
44#include "opt_inet6.h"
45#include "opt_ipsec.h"
46#include "opt_enc.h"
47
48#include <sys/param.h>
49#include <sys/systm.h>
50#include <sys/malloc.h>
51#include <sys/mbuf.h>
52#include <sys/domain.h>
53#include <sys/protosw.h>
54#include <sys/socket.h>
55#include <sys/errno.h>
56#include <sys/syslog.h>
57#include <sys/vimage.h>
58
59#include <net/if.h>
60#include <net/pfil.h>
61#include <net/route.h>
62#include <net/netisr.h>
63
64#include <netinet/in.h>
65#include <netinet/in_systm.h>
66#include <netinet/ip.h>
67#include <netinet/ip_var.h>
68#include <netinet/in_var.h>
69
70#include <netinet/ip6.h>
71#ifdef INET6
72#include <netinet6/ip6_var.h>
73#endif
74#include <netinet/in_pcb.h>
75#ifdef INET6
76#include <netinet/icmp6.h>
77#include <netinet6/vinet6.h>
78#endif
79
80#include <netipsec/ipsec.h>
81#ifdef INET6
82#include <netipsec/ipsec6.h>
83#endif
84#include <netipsec/ah_var.h>
85#include <netipsec/esp.h>
86#include <netipsec/esp_var.h>
87#include <netipsec/ipcomp_var.h>
88
89#include <netipsec/key.h>
90#include <netipsec/keydb.h>
91
92#include <netipsec/xform.h>
93#include <netinet6/ip6protosw.h>
94
95#include <machine/in_cksum.h>
96#include <machine/stdarg.h>
97
98#ifdef DEV_ENC
99#include <net/if_enc.h>
100#endif
101
102
103#define IPSEC_ISTAT(p,x,y,z) ((p) == IPPROTO_ESP ? (x)++ : \
104 (p) == IPPROTO_AH ? (y)++ : (z)++)
105
106static void ipsec4_common_ctlinput(int, struct sockaddr *, void *, int);
107
108/*
109 * ipsec_common_input gets called when an IPsec-protected packet
110 * is received by IPv4 or IPv6. It's job is to find the right SA
111 * and call the appropriate transform. The transform callback
112 * takes care of further processing (like ingress filtering).
113 */
114static int
115ipsec_common_input(struct mbuf *m, int skip, int protoff, int af, int sproto)
116{
117 INIT_VNET_IPSEC(curvnet);
118 union sockaddr_union dst_address;
119 struct secasvar *sav;
120 u_int32_t spi;
121 int error;
122
123 IPSEC_ISTAT(sproto, V_espstat.esps_input, V_ahstat.ahs_input,
124 V_ipcompstat.ipcomps_input);
125
126 IPSEC_ASSERT(m != NULL, ("null packet"));
127
128 IPSEC_ASSERT(sproto == IPPROTO_ESP || sproto == IPPROTO_AH ||
129 sproto == IPPROTO_IPCOMP,
130 ("unexpected security protocol %u", sproto));
131
132 if ((sproto == IPPROTO_ESP && !V_esp_enable) ||
133 (sproto == IPPROTO_AH && !V_ah_enable) ||
134 (sproto == IPPROTO_IPCOMP && !V_ipcomp_enable)) {
135 m_freem(m);
136 IPSEC_ISTAT(sproto, V_espstat.esps_pdrops, V_ahstat.ahs_pdrops,
137 V_ipcompstat.ipcomps_pdrops);
138 return EOPNOTSUPP;
139 }
140
141 if (m->m_pkthdr.len - skip < 2 * sizeof (u_int32_t)) {
142 m_freem(m);
143 IPSEC_ISTAT(sproto, V_espstat.esps_hdrops, V_ahstat.ahs_hdrops,
144 V_ipcompstat.ipcomps_hdrops);
145 DPRINTF(("%s: packet too small\n", __func__));
146 return EINVAL;
147 }
148
149 /* Retrieve the SPI from the relevant IPsec header */
150 if (sproto == IPPROTO_ESP)
151 m_copydata(m, skip, sizeof(u_int32_t), (caddr_t) &spi);
152 else if (sproto == IPPROTO_AH)
153 m_copydata(m, skip + sizeof(u_int32_t), sizeof(u_int32_t),
154 (caddr_t) &spi);
155 else if (sproto == IPPROTO_IPCOMP) {
156 u_int16_t cpi;
157 m_copydata(m, skip + sizeof(u_int16_t), sizeof(u_int16_t),
158 (caddr_t) &cpi);
159 spi = ntohl(htons(cpi));
160 }
161
162 /*
163 * Find the SA and (indirectly) call the appropriate
164 * kernel crypto routine. The resulting mbuf chain is a valid
165 * IP packet ready to go through input processing.
166 */
167 bzero(&dst_address, sizeof (dst_address));
168 dst_address.sa.sa_family = af;
169 switch (af) {
170#ifdef INET
171 case AF_INET:
172 dst_address.sin.sin_len = sizeof(struct sockaddr_in);
173 m_copydata(m, offsetof(struct ip, ip_dst),
174 sizeof(struct in_addr),
175 (caddr_t) &dst_address.sin.sin_addr);
176 break;
177#endif /* INET */
178#ifdef INET6
179 case AF_INET6:
180 dst_address.sin6.sin6_len = sizeof(struct sockaddr_in6);
181 m_copydata(m, offsetof(struct ip6_hdr, ip6_dst),
182 sizeof(struct in6_addr),
183 (caddr_t) &dst_address.sin6.sin6_addr);
184 break;
185#endif /* INET6 */
186 default:
187 DPRINTF(("%s: unsupported protocol family %u\n", __func__, af));
188 m_freem(m);
189 IPSEC_ISTAT(sproto, V_espstat.esps_nopf, V_ahstat.ahs_nopf,
190 V_ipcompstat.ipcomps_nopf);
191 return EPFNOSUPPORT;
192 }
193
194 /* NB: only pass dst since key_allocsa follows RFC2401 */
195 sav = KEY_ALLOCSA(&dst_address, sproto, spi);
196 if (sav == NULL) {
197 DPRINTF(("%s: no key association found for SA %s/%08lx/%u\n",
198 __func__, ipsec_address(&dst_address),
199 (u_long) ntohl(spi), sproto));
200 IPSEC_ISTAT(sproto, V_espstat.esps_notdb, V_ahstat.ahs_notdb,
201 V_ipcompstat.ipcomps_notdb);
202 m_freem(m);
203 return ENOENT;
204 }
205
206 if (sav->tdb_xform == NULL) {
207 DPRINTF(("%s: attempted to use uninitialized SA %s/%08lx/%u\n",
208 __func__, ipsec_address(&dst_address),
209 (u_long) ntohl(spi), sproto));
210 IPSEC_ISTAT(sproto, V_espstat.esps_noxform, V_ahstat.ahs_noxform,
211 V_ipcompstat.ipcomps_noxform);
212 KEY_FREESAV(&sav);
213 m_freem(m);
214 return ENXIO;
215 }
216
217 /*
218 * Call appropriate transform and return -- callback takes care of
219 * everything else.
220 */
221 error = (*sav->tdb_xform->xf_input)(m, sav, skip, protoff);
222 KEY_FREESAV(&sav);
223 return error;
224}
225
226#ifdef INET
227/*
228 * Common input handler for IPv4 AH, ESP, and IPCOMP.
229 */
230int
231ipsec4_common_input(struct mbuf *m, ...)
232{
233 va_list ap;
234 int off, nxt;
235
236 va_start(ap, m);
237 off = va_arg(ap, int);
238 nxt = va_arg(ap, int);
239 va_end(ap);
240
241 return ipsec_common_input(m, off, offsetof(struct ip, ip_p),
242 AF_INET, nxt);
243}
244
245void
246ah4_input(struct mbuf *m, int off)
247{
248 ipsec4_common_input(m, off, IPPROTO_AH);
249}
250void
251ah4_ctlinput(int cmd, struct sockaddr *sa, void *v)
252{
253 if (sa->sa_family == AF_INET &&
254 sa->sa_len == sizeof(struct sockaddr_in))
255 ipsec4_common_ctlinput(cmd, sa, v, IPPROTO_AH);
256}
257
258void
259esp4_input(struct mbuf *m, int off)
260{
261 ipsec4_common_input(m, off, IPPROTO_ESP);
262}
263void
264esp4_ctlinput(int cmd, struct sockaddr *sa, void *v)
265{
266 if (sa->sa_family == AF_INET &&
267 sa->sa_len == sizeof(struct sockaddr_in))
268 ipsec4_common_ctlinput(cmd, sa, v, IPPROTO_ESP);
269}
270
271void
272ipcomp4_input(struct mbuf *m, int off)
273{
274 ipsec4_common_input(m, off, IPPROTO_IPCOMP);
275}
276
277/*
278 * IPsec input callback for INET protocols.
279 * This routine is called as the transform callback.
280 * Takes care of filtering and other sanity checks on
281 * the processed packet.
282 */
283int
284ipsec4_common_input_cb(struct mbuf *m, struct secasvar *sav,
285 int skip, int protoff, struct m_tag *mt)
286{
287 INIT_VNET_IPSEC(curvnet);
288 int prot, af, sproto;
289 struct ip *ip;
290 struct m_tag *mtag;
291 struct tdb_ident *tdbi;
292 struct secasindex *saidx;
293 int error;
294#ifdef INET6
295#ifdef notyet
296 char ip6buf[INET6_ADDRSTRLEN];
297#endif
298#endif
299
300 IPSEC_ASSERT(m != NULL, ("null mbuf"));
301 IPSEC_ASSERT(sav != NULL, ("null SA"));
302 IPSEC_ASSERT(sav->sah != NULL, ("null SAH"));
303 saidx = &sav->sah->saidx;
304 af = saidx->dst.sa.sa_family;
305 IPSEC_ASSERT(af == AF_INET, ("unexpected af %u", af));
306 sproto = saidx->proto;
307 IPSEC_ASSERT(sproto == IPPROTO_ESP || sproto == IPPROTO_AH ||
308 sproto == IPPROTO_IPCOMP,
309 ("unexpected security protocol %u", sproto));
310
311 /* Sanity check */
312 if (m == NULL) {
313 DPRINTF(("%s: null mbuf", __func__));
314 IPSEC_ISTAT(sproto, V_espstat.esps_badkcr, V_ahstat.ahs_badkcr,
315 V_ipcompstat.ipcomps_badkcr);
316 KEY_FREESAV(&sav);
317 return EINVAL;
318 }
319
320 if (skip != 0) {
321 /* Fix IPv4 header */
322 if (m->m_len < skip && (m = m_pullup(m, skip)) == NULL) {
323 DPRINTF(("%s: processing failed for SA %s/%08lx\n",
324 __func__, ipsec_address(&sav->sah->saidx.dst),
325 (u_long) ntohl(sav->spi)));
326 IPSEC_ISTAT(sproto, V_espstat.esps_hdrops, V_ahstat.ahs_hdrops,
327 V_ipcompstat.ipcomps_hdrops);
328 error = ENOBUFS;
329 goto bad;
330 }
331
332 ip = mtod(m, struct ip *);
333 ip->ip_len = htons(m->m_pkthdr.len);
334 ip->ip_off = htons(ip->ip_off);
335 ip->ip_sum = 0;
336 ip->ip_sum = in_cksum(m, ip->ip_hl << 2);
337 } else {
338 ip = mtod(m, struct ip *);
339 }
340 prot = ip->ip_p;
341
342#ifdef notyet
343 /* IP-in-IP encapsulation */
344 if (prot == IPPROTO_IPIP) {
345 struct ip ipn;
346
347 if (m->m_pkthdr.len - skip < sizeof(struct ip)) {
348 IPSEC_ISTAT(sproto, V_espstat.esps_hdrops,
349 V_ahstat.ahs_hdrops,
350 V_ipcompstat.ipcomps_hdrops);
351 error = EINVAL;
352 goto bad;
353 }
354 /* ipn will now contain the inner IPv4 header */
355 m_copydata(m, ip->ip_hl << 2, sizeof(struct ip),
356 (caddr_t) &ipn);
357
358 /* XXX PROXY address isn't recorded in SAH */
359 /*
360 * Check that the inner source address is the same as
361 * the proxy address, if available.
362 */
363 if ((saidx->proxy.sa.sa_family == AF_INET &&
364 saidx->proxy.sin.sin_addr.s_addr !=
365 INADDR_ANY &&
366 ipn.ip_src.s_addr !=
367 saidx->proxy.sin.sin_addr.s_addr) ||
368 (saidx->proxy.sa.sa_family != AF_INET &&
369 saidx->proxy.sa.sa_family != 0)) {
370
371 DPRINTF(("%s: inner source address %s doesn't "
372 "correspond to expected proxy source %s, "
373 "SA %s/%08lx\n", __func__,
374 inet_ntoa4(ipn.ip_src),
375 ipsp_address(saidx->proxy),
376 ipsp_address(saidx->dst),
377 (u_long) ntohl(sav->spi)));
378
379 IPSEC_ISTAT(sproto, V_espstat.esps_pdrops,
380 V_ahstat.ahs_pdrops,
381 V_ipcompstat.ipcomps_pdrops);
382 error = EACCES;
383 goto bad;
384 }
385 }
386#ifdef INET6
387 /* IPv6-in-IP encapsulation. */
388 if (prot == IPPROTO_IPV6) {
389 struct ip6_hdr ip6n;
390
391 if (m->m_pkthdr.len - skip < sizeof(struct ip6_hdr)) {
392 IPSEC_ISTAT(sproto, V_espstat.esps_hdrops,
393 V_ahstat.ahs_hdrops,
394 V_ipcompstat.ipcomps_hdrops);
395 error = EINVAL;
396 goto bad;
397 }
398 /* ip6n will now contain the inner IPv6 header. */
399 m_copydata(m, ip->ip_hl << 2, sizeof(struct ip6_hdr),
400 (caddr_t) &ip6n);
401
402 /*
403 * Check that the inner source address is the same as
404 * the proxy address, if available.
405 */
406 if ((saidx->proxy.sa.sa_family == AF_INET6 &&
407 !IN6_IS_ADDR_UNSPECIFIED(&saidx->proxy.sin6.sin6_addr) &&
408 !IN6_ARE_ADDR_EQUAL(&ip6n.ip6_src,
409 &saidx->proxy.sin6.sin6_addr)) ||
410 (saidx->proxy.sa.sa_family != AF_INET6 &&
411 saidx->proxy.sa.sa_family != 0)) {
412
413 DPRINTF(("%s: inner source address %s doesn't "
414 "correspond to expected proxy source %s, "
415 "SA %s/%08lx\n", __func__,
416 ip6_sprintf(ip6buf, &ip6n.ip6_src),
417 ipsec_address(&saidx->proxy),
418 ipsec_address(&saidx->dst),
419 (u_long) ntohl(sav->spi)));
420
421 IPSEC_ISTAT(sproto, V_espstat.esps_pdrops,
422 V_ahstat.ahs_pdrops,
423 V_ipcompstat.ipcomps_pdrops);
424 error = EACCES;
425 goto bad;
426 }
427 }
428#endif /* INET6 */
429#endif /*XXX*/
430
431 /*
432 * Record what we've done to the packet (under what SA it was
433 * processed). If we've been passed an mtag, it means the packet
434 * was already processed by an ethernet/crypto combo card and
435 * thus has a tag attached with all the right information, but
436 * with a PACKET_TAG_IPSEC_IN_CRYPTO_DONE as opposed to
437 * PACKET_TAG_IPSEC_IN_DONE type; in that case, just change the type.
438 */
439 if (mt == NULL && sproto != IPPROTO_IPCOMP) {
440 mtag = m_tag_get(PACKET_TAG_IPSEC_IN_DONE,
441 sizeof(struct tdb_ident), M_NOWAIT);
442 if (mtag == NULL) {
443 DPRINTF(("%s: failed to get tag\n", __func__));
444 IPSEC_ISTAT(sproto, V_espstat.esps_hdrops,
445 V_ahstat.ahs_hdrops, V_ipcompstat.ipcomps_hdrops);
446 error = ENOMEM;
447 goto bad;
448 }
449
450 tdbi = (struct tdb_ident *)(mtag + 1);
451 bcopy(&saidx->dst, &tdbi->dst, saidx->dst.sa.sa_len);
452 tdbi->proto = sproto;
453 tdbi->spi = sav->spi;
454 /* Cache those two for enc(4) in xform_ipip. */
455 tdbi->alg_auth = sav->alg_auth;
456 tdbi->alg_enc = sav->alg_enc;
457
458 m_tag_prepend(m, mtag);
459 } else if (mt != NULL) {
460 mt->m_tag_id = PACKET_TAG_IPSEC_IN_DONE;
461 /* XXX do we need to mark m_flags??? */
462 }
463
464 key_sa_recordxfer(sav, m); /* record data transfer */
465
466#ifdef DEV_ENC
467 encif->if_ipackets++;
468 encif->if_ibytes += m->m_pkthdr.len;
469
470 /*
471 * Pass the mbuf to enc0 for bpf and pfil. We will filter the IPIP
472 * packet later after it has been decapsulated.
473 */
474 ipsec_bpf(m, sav, AF_INET, ENC_IN|ENC_BEFORE);
475
476 if (prot != IPPROTO_IPIP)
477 if ((error = ipsec_filter(&m, PFIL_IN, ENC_IN|ENC_BEFORE)) != 0)
478 return (error);
479#endif
480
481 /*
482 * Re-dispatch via software interrupt.
483 */
484 if ((error = netisr_queue(NETISR_IP, m))) {
485 IPSEC_ISTAT(sproto, V_espstat.esps_qfull, V_ahstat.ahs_qfull,
486 V_ipcompstat.ipcomps_qfull);
487
488 DPRINTF(("%s: queue full; proto %u packet dropped\n",
489 __func__, sproto));
490 return error;
491 }
492 return 0;
493bad:
494 m_freem(m);
495 return error;
496}
497
498void
499ipsec4_common_ctlinput(int cmd, struct sockaddr *sa, void *v, int proto)
500{
501 /* XXX nothing just yet */
502}
503#endif /* INET */
504
505#ifdef INET6
506/* IPv6 AH wrapper. */
507int
508ipsec6_common_input(struct mbuf **mp, int *offp, int proto)
509{
510 INIT_VNET_IPSEC(curvnet);
511 int l = 0;
512 int protoff;
513 struct ip6_ext ip6e;
514
515 if (*offp < sizeof(struct ip6_hdr)) {
516 DPRINTF(("%s: bad offset %u\n", __func__, *offp));
517 return IPPROTO_DONE;
518 } else if (*offp == sizeof(struct ip6_hdr)) {
519 protoff = offsetof(struct ip6_hdr, ip6_nxt);
520 } else {
521 /* Chase down the header chain... */
522 protoff = sizeof(struct ip6_hdr);
523
524 do {
525 protoff += l;
526 m_copydata(*mp, protoff, sizeof(ip6e),
527 (caddr_t) &ip6e);
528
529 if (ip6e.ip6e_nxt == IPPROTO_AH)
530 l = (ip6e.ip6e_len + 2) << 2;
531 else
532 l = (ip6e.ip6e_len + 1) << 3;
533 IPSEC_ASSERT(l > 0, ("l went zero or negative"));
534 } while (protoff + l < *offp);
535
536 /* Malformed packet check */
537 if (protoff + l != *offp) {
538 DPRINTF(("%s: bad packet header chain, protoff %u, "
539 "l %u, off %u\n", __func__, protoff, l, *offp));
540 IPSEC_ISTAT(proto, V_espstat.esps_hdrops,
541 V_ahstat.ahs_hdrops,
542 V_ipcompstat.ipcomps_hdrops);
543 m_freem(*mp);
544 *mp = NULL;
545 return IPPROTO_DONE;
546 }
547 protoff += offsetof(struct ip6_ext, ip6e_nxt);
548 }
549 (void) ipsec_common_input(*mp, *offp, protoff, AF_INET6, proto);
550 return IPPROTO_DONE;
551}
552
553/*
554 * IPsec input callback, called by the transform callback. Takes care of
555 * filtering and other sanity checks on the processed packet.
556 */
557int
558ipsec6_common_input_cb(struct mbuf *m, struct secasvar *sav, int skip, int protoff,
559 struct m_tag *mt)
560{
561 INIT_VNET_INET6(curvnet);
562 INIT_VNET_IPSEC(curvnet);
563 int prot, af, sproto;
564 struct ip6_hdr *ip6;
565 struct m_tag *mtag;
566 struct tdb_ident *tdbi;
567 struct secasindex *saidx;
568 int nxt;
569 u_int8_t nxt8;
570 int error, nest;
571#ifdef notyet
572 char ip6buf[INET6_ADDRSTRLEN];
573#endif
574
575 IPSEC_ASSERT(m != NULL, ("null mbuf"));
576 IPSEC_ASSERT(sav != NULL, ("null SA"));
577 IPSEC_ASSERT(sav->sah != NULL, ("null SAH"));
578 saidx = &sav->sah->saidx;
579 af = saidx->dst.sa.sa_family;
580 IPSEC_ASSERT(af == AF_INET6, ("unexpected af %u", af));
581 sproto = saidx->proto;
582 IPSEC_ASSERT(sproto == IPPROTO_ESP || sproto == IPPROTO_AH ||
583 sproto == IPPROTO_IPCOMP,
584 ("unexpected security protocol %u", sproto));
585
586 /* Sanity check */
587 if (m == NULL) {
588 DPRINTF(("%s: null mbuf", __func__));
589 IPSEC_ISTAT(sproto, V_espstat.esps_badkcr, V_ahstat.ahs_badkcr,
590 V_ipcompstat.ipcomps_badkcr);
591 error = EINVAL;
592 goto bad;
593 }
594
595 /* Fix IPv6 header */
596 if (m->m_len < sizeof(struct ip6_hdr) &&
597 (m = m_pullup(m, sizeof(struct ip6_hdr))) == NULL) {
598
599 DPRINTF(("%s: processing failed for SA %s/%08lx\n",
600 __func__, ipsec_address(&sav->sah->saidx.dst),
601 (u_long) ntohl(sav->spi)));
602
603 IPSEC_ISTAT(sproto, V_espstat.esps_hdrops, V_ahstat.ahs_hdrops,
604 V_ipcompstat.ipcomps_hdrops);
605 error = EACCES;
606 goto bad;
607 }
608
609 ip6 = mtod(m, struct ip6_hdr *);
610 ip6->ip6_plen = htons(m->m_pkthdr.len - sizeof(struct ip6_hdr));
611
612 /* Save protocol */
613 m_copydata(m, protoff, 1, (unsigned char *) &prot);
614
615#ifdef notyet
616#ifdef INET
617 /* IP-in-IP encapsulation */
618 if (prot == IPPROTO_IPIP) {
619 struct ip ipn;
620
621 if (m->m_pkthdr.len - skip < sizeof(struct ip)) {
622 IPSEC_ISTAT(sproto, V_espstat.esps_hdrops,
623 V_ahstat.ahs_hdrops,
624 V_ipcompstat.ipcomps_hdrops);
625 error = EINVAL;
626 goto bad;
627 }
628 /* ipn will now contain the inner IPv4 header */
629 m_copydata(m, skip, sizeof(struct ip), (caddr_t) &ipn);
630
631 /*
632 * Check that the inner source address is the same as
633 * the proxy address, if available.
634 */
635 if ((saidx->proxy.sa.sa_family == AF_INET &&
636 saidx->proxy.sin.sin_addr.s_addr != INADDR_ANY &&
637 ipn.ip_src.s_addr != saidx->proxy.sin.sin_addr.s_addr) ||
638 (saidx->proxy.sa.sa_family != AF_INET &&
639 saidx->proxy.sa.sa_family != 0)) {
640
641 DPRINTF(("%s: inner source address %s doesn't "
642 "correspond to expected proxy source %s, "
643 "SA %s/%08lx\n", __func__,
644 inet_ntoa4(ipn.ip_src),
645 ipsec_address(&saidx->proxy),
646 ipsec_address(&saidx->dst),
647 (u_long) ntohl(sav->spi)));
648
649 IPSEC_ISTATsproto, (V_espstat.esps_pdrops,
650 V_ahstat.ahs_pdrops, V_ipcompstat.ipcomps_pdrops);
651 error = EACCES;
652 goto bad;
653 }
654 }
655#endif /* INET */
656
657 /* IPv6-in-IP encapsulation */
658 if (prot == IPPROTO_IPV6) {
659 struct ip6_hdr ip6n;
660
661 if (m->m_pkthdr.len - skip < sizeof(struct ip6_hdr)) {
662 IPSEC_ISTAT(sproto, V_espstat.esps_hdrops,
663 V_ahstat.ahs_hdrops,
664 V_ipcompstat.ipcomps_hdrops);
665 error = EINVAL;
666 goto bad;
667 }
668 /* ip6n will now contain the inner IPv6 header. */
669 m_copydata(m, skip, sizeof(struct ip6_hdr),
670 (caddr_t) &ip6n);
671
672 /*
673 * Check that the inner source address is the same as
674 * the proxy address, if available.
675 */
676 if ((saidx->proxy.sa.sa_family == AF_INET6 &&
677 !IN6_IS_ADDR_UNSPECIFIED(&saidx->proxy.sin6.sin6_addr) &&
678 !IN6_ARE_ADDR_EQUAL(&ip6n.ip6_src,
679 &saidx->proxy.sin6.sin6_addr)) ||
680 (saidx->proxy.sa.sa_family != AF_INET6 &&
681 saidx->proxy.sa.sa_family != 0)) {
682
683 DPRINTF(("%s: inner source address %s doesn't "
684 "correspond to expected proxy source %s, "
685 "SA %s/%08lx\n", __func__,
686 ip6_sprintf(ip6buf, &ip6n.ip6_src),
687 ipsec_address(&saidx->proxy),
688 ipsec_address(&saidx->dst),
689 (u_long) ntohl(sav->spi)));
690
691 IPSEC_ISTAT(sproto, V_espstat.esps_pdrops,
692 V_ahstat.ahs_pdrops, V_ipcompstat.ipcomps_pdrops);
693 error = EACCES;
694 goto bad;
695 }
696 }
697#endif /*XXX*/
698
699 /*
700 * Record what we've done to the packet (under what SA it was
701 * processed). If we've been passed an mtag, it means the packet
702 * was already processed by an ethernet/crypto combo card and
703 * thus has a tag attached with all the right information, but
704 * with a PACKET_TAG_IPSEC_IN_CRYPTO_DONE as opposed to
705 * PACKET_TAG_IPSEC_IN_DONE type; in that case, just change the type.
706 */
707 if (mt == NULL && sproto != IPPROTO_IPCOMP) {
708 mtag = m_tag_get(PACKET_TAG_IPSEC_IN_DONE,
709 sizeof(struct tdb_ident), M_NOWAIT);
710 if (mtag == NULL) {
711 DPRINTF(("%s: failed to get tag\n", __func__));
712 IPSEC_ISTAT(sproto, V_espstat.esps_hdrops,
713 V_ahstat.ahs_hdrops, V_ipcompstat.ipcomps_hdrops);
714 error = ENOMEM;
715 goto bad;
716 }
717
718 tdbi = (struct tdb_ident *)(mtag + 1);
719 bcopy(&saidx->dst, &tdbi->dst, sizeof(union sockaddr_union));
720 tdbi->proto = sproto;
721 tdbi->spi = sav->spi;
722 /* Cache those two for enc(4) in xform_ipip. */
723 tdbi->alg_auth = sav->alg_auth;
724 tdbi->alg_enc = sav->alg_enc;
725
726 m_tag_prepend(m, mtag);
727 } else {
728 if (mt != NULL)
729 mt->m_tag_id = PACKET_TAG_IPSEC_IN_DONE;
730 /* XXX do we need to mark m_flags??? */
731 }
732
733 key_sa_recordxfer(sav, m);
734
735#ifdef DEV_ENC
736 encif->if_ipackets++;
737 encif->if_ibytes += m->m_pkthdr.len;
738
739 /*
740 * Pass the mbuf to enc0 for bpf and pfil. We will filter the IPIP
741 * packet later after it has been decapsulated.
742 */
743 ipsec_bpf(m, sav, AF_INET6, ENC_IN|ENC_BEFORE);
744
745 /* XXX-BZ does not make sense. */
746 if (prot != IPPROTO_IPIP)
747 if ((error = ipsec_filter(&m, PFIL_IN, ENC_IN|ENC_BEFORE)) != 0)
748 return (error);
749#endif
750
751 /* Retrieve new protocol */
752 m_copydata(m, protoff, sizeof(u_int8_t), (caddr_t) &nxt8);
753
754 /*
755 * See the end of ip6_input for this logic.
756 * IPPROTO_IPV[46] case will be processed just like other ones
757 */
758 nest = 0;
759 nxt = nxt8;
760 while (nxt != IPPROTO_DONE) {
761 if (V_ip6_hdrnestlimit && (++nest > V_ip6_hdrnestlimit)) {
762 V_ip6stat.ip6s_toomanyhdr++;
763 error = EINVAL;
764 goto bad;
765 }
766
767 /*
768 * Protection against faulty packet - there should be
769 * more sanity checks in header chain processing.
770 */
771 if (m->m_pkthdr.len < skip) {
772 V_ip6stat.ip6s_tooshort++;
773 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_truncated);
774 error = EINVAL;
775 goto bad;
776 }
777 /*
778 * Enforce IPsec policy checking if we are seeing last header.
779 * note that we do not visit this with protocols with pcb layer
780 * code - like udp/tcp/raw ip.
781 */
782 if ((inet6sw[ip6_protox[nxt]].pr_flags & PR_LASTHDR) != 0 &&
783 ipsec6_in_reject(m, NULL)) {
784 error = EINVAL;
785 goto bad;
786 }
787 nxt = (*inet6sw[ip6_protox[nxt]].pr_input)(&m, &skip, nxt);
788 }
789 return 0;
790bad:
791 if (m)
792 m_freem(m);
793 return error;
794}
795
796void
797esp6_ctlinput(int cmd, struct sockaddr *sa, void *d)
798{
799 struct ip6ctlparam *ip6cp = NULL;
800 struct mbuf *m = NULL;
801 struct ip6_hdr *ip6;
802 int off;
803
804 if (sa->sa_family != AF_INET6 ||
805 sa->sa_len != sizeof(struct sockaddr_in6))
806 return;
807 if ((unsigned)cmd >= PRC_NCMDS)
808 return;
809
810 /* if the parameter is from icmp6, decode it. */
811 if (d != NULL) {
812 ip6cp = (struct ip6ctlparam *)d;
813 m = ip6cp->ip6c_m;
814 ip6 = ip6cp->ip6c_ip6;
815 off = ip6cp->ip6c_off;
816 } else {
817 m = NULL;
818 ip6 = NULL;
819 off = 0; /* calm gcc */
820 }
821
822 if (ip6 != NULL) {
823
824 struct ip6ctlparam ip6cp1;
825
826 /*
827 * Notify the error to all possible sockets via pfctlinput2.
828 * Since the upper layer information (such as protocol type,
829 * source and destination ports) is embedded in the encrypted
830 * data and might have been cut, we can't directly call
831 * an upper layer ctlinput function. However, the pcbnotify
832 * function will consider source and destination addresses
833 * as well as the flow info value, and may be able to find
834 * some PCB that should be notified.
835 * Although pfctlinput2 will call esp6_ctlinput(), there is
836 * no possibility of an infinite loop of function calls,
837 * because we don't pass the inner IPv6 header.
838 */
839 bzero(&ip6cp1, sizeof(ip6cp1));
840 ip6cp1.ip6c_src = ip6cp->ip6c_src;
841 pfctlinput2(cmd, sa, (void *)&ip6cp1);
842
843 /*
844 * Then go to special cases that need ESP header information.
845 * XXX: We assume that when ip6 is non NULL,
846 * M and OFF are valid.
847 */
848
849 if (cmd == PRC_MSGSIZE) {
850 struct secasvar *sav;
851 u_int32_t spi;
852 int valid;
853
854 /* check header length before using m_copydata */
855 if (m->m_pkthdr.len < off + sizeof (struct esp))
856 return;
857 m_copydata(m, off + offsetof(struct esp, esp_spi),
858 sizeof(u_int32_t), (caddr_t) &spi);
859 /*
860 * Check to see if we have a valid SA corresponding to
861 * the address in the ICMP message payload.
862 */
863 sav = KEY_ALLOCSA((union sockaddr_union *)sa,
864 IPPROTO_ESP, spi);
865 valid = (sav != NULL);
866 if (sav)
867 KEY_FREESAV(&sav);
868
869 /* XXX Further validation? */
870
871 /*
872 * Depending on whether the SA is "valid" and
873 * routing table size (mtudisc_{hi,lo}wat), we will:
874 * - recalcurate the new MTU and create the
875 * corresponding routing entry, or
876 * - ignore the MTU change notification.
877 */
878 icmp6_mtudisc_update(ip6cp, valid);
879 }
880 } else {
881 /* we normally notify any pcb here */
882 }
883}
884#endif /* INET6 */
2/* $OpenBSD: ipsec_input.c,v 1.63 2003/02/20 18:35:43 deraadt Exp $ */
3/*-
4 * The authors of this code are John Ioannidis (ji@tla.org),
5 * Angelos D. Keromytis (kermit@csd.uch.gr) and
6 * Niels Provos (provos@physnet.uni-hamburg.de).
7 *
8 * This code was written by John Ioannidis for BSD/OS in Athens, Greece,
9 * in November 1995.
10 *
11 * Ported to OpenBSD and NetBSD, with additional transforms, in December 1996,
12 * by Angelos D. Keromytis.
13 *
14 * Additional transforms and features in 1997 and 1998 by Angelos D. Keromytis
15 * and Niels Provos.
16 *
17 * Additional features in 1999 by Angelos D. Keromytis.
18 *
19 * Copyright (C) 1995, 1996, 1997, 1998, 1999 by John Ioannidis,
20 * Angelos D. Keromytis and Niels Provos.
21 * Copyright (c) 2001, Angelos D. Keromytis.
22 *
23 * Permission to use, copy, and modify this software with or without fee
24 * is hereby granted, provided that this entire notice is included in
25 * all copies of any software which is or includes a copy or
26 * modification of this software.
27 * You may use this code under the GNU public license if you so wish. Please
28 * contribute changes back to the authors under this freer than GPL license
29 * so that we may further the use of strong encryption without limitations to
30 * all.
31 *
32 * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR
33 * IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY
34 * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE
35 * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR
36 * PURPOSE.
37 */
38
39/*
40 * IPsec input processing.
41 */
42
43#include "opt_inet.h"
44#include "opt_inet6.h"
45#include "opt_ipsec.h"
46#include "opt_enc.h"
47
48#include <sys/param.h>
49#include <sys/systm.h>
50#include <sys/malloc.h>
51#include <sys/mbuf.h>
52#include <sys/domain.h>
53#include <sys/protosw.h>
54#include <sys/socket.h>
55#include <sys/errno.h>
56#include <sys/syslog.h>
57#include <sys/vimage.h>
58
59#include <net/if.h>
60#include <net/pfil.h>
61#include <net/route.h>
62#include <net/netisr.h>
63
64#include <netinet/in.h>
65#include <netinet/in_systm.h>
66#include <netinet/ip.h>
67#include <netinet/ip_var.h>
68#include <netinet/in_var.h>
69
70#include <netinet/ip6.h>
71#ifdef INET6
72#include <netinet6/ip6_var.h>
73#endif
74#include <netinet/in_pcb.h>
75#ifdef INET6
76#include <netinet/icmp6.h>
77#include <netinet6/vinet6.h>
78#endif
79
80#include <netipsec/ipsec.h>
81#ifdef INET6
82#include <netipsec/ipsec6.h>
83#endif
84#include <netipsec/ah_var.h>
85#include <netipsec/esp.h>
86#include <netipsec/esp_var.h>
87#include <netipsec/ipcomp_var.h>
88
89#include <netipsec/key.h>
90#include <netipsec/keydb.h>
91
92#include <netipsec/xform.h>
93#include <netinet6/ip6protosw.h>
94
95#include <machine/in_cksum.h>
96#include <machine/stdarg.h>
97
98#ifdef DEV_ENC
99#include <net/if_enc.h>
100#endif
101
102
103#define IPSEC_ISTAT(p,x,y,z) ((p) == IPPROTO_ESP ? (x)++ : \
104 (p) == IPPROTO_AH ? (y)++ : (z)++)
105
106static void ipsec4_common_ctlinput(int, struct sockaddr *, void *, int);
107
108/*
109 * ipsec_common_input gets called when an IPsec-protected packet
110 * is received by IPv4 or IPv6. It's job is to find the right SA
111 * and call the appropriate transform. The transform callback
112 * takes care of further processing (like ingress filtering).
113 */
114static int
115ipsec_common_input(struct mbuf *m, int skip, int protoff, int af, int sproto)
116{
117 INIT_VNET_IPSEC(curvnet);
118 union sockaddr_union dst_address;
119 struct secasvar *sav;
120 u_int32_t spi;
121 int error;
122
123 IPSEC_ISTAT(sproto, V_espstat.esps_input, V_ahstat.ahs_input,
124 V_ipcompstat.ipcomps_input);
125
126 IPSEC_ASSERT(m != NULL, ("null packet"));
127
128 IPSEC_ASSERT(sproto == IPPROTO_ESP || sproto == IPPROTO_AH ||
129 sproto == IPPROTO_IPCOMP,
130 ("unexpected security protocol %u", sproto));
131
132 if ((sproto == IPPROTO_ESP && !V_esp_enable) ||
133 (sproto == IPPROTO_AH && !V_ah_enable) ||
134 (sproto == IPPROTO_IPCOMP && !V_ipcomp_enable)) {
135 m_freem(m);
136 IPSEC_ISTAT(sproto, V_espstat.esps_pdrops, V_ahstat.ahs_pdrops,
137 V_ipcompstat.ipcomps_pdrops);
138 return EOPNOTSUPP;
139 }
140
141 if (m->m_pkthdr.len - skip < 2 * sizeof (u_int32_t)) {
142 m_freem(m);
143 IPSEC_ISTAT(sproto, V_espstat.esps_hdrops, V_ahstat.ahs_hdrops,
144 V_ipcompstat.ipcomps_hdrops);
145 DPRINTF(("%s: packet too small\n", __func__));
146 return EINVAL;
147 }
148
149 /* Retrieve the SPI from the relevant IPsec header */
150 if (sproto == IPPROTO_ESP)
151 m_copydata(m, skip, sizeof(u_int32_t), (caddr_t) &spi);
152 else if (sproto == IPPROTO_AH)
153 m_copydata(m, skip + sizeof(u_int32_t), sizeof(u_int32_t),
154 (caddr_t) &spi);
155 else if (sproto == IPPROTO_IPCOMP) {
156 u_int16_t cpi;
157 m_copydata(m, skip + sizeof(u_int16_t), sizeof(u_int16_t),
158 (caddr_t) &cpi);
159 spi = ntohl(htons(cpi));
160 }
161
162 /*
163 * Find the SA and (indirectly) call the appropriate
164 * kernel crypto routine. The resulting mbuf chain is a valid
165 * IP packet ready to go through input processing.
166 */
167 bzero(&dst_address, sizeof (dst_address));
168 dst_address.sa.sa_family = af;
169 switch (af) {
170#ifdef INET
171 case AF_INET:
172 dst_address.sin.sin_len = sizeof(struct sockaddr_in);
173 m_copydata(m, offsetof(struct ip, ip_dst),
174 sizeof(struct in_addr),
175 (caddr_t) &dst_address.sin.sin_addr);
176 break;
177#endif /* INET */
178#ifdef INET6
179 case AF_INET6:
180 dst_address.sin6.sin6_len = sizeof(struct sockaddr_in6);
181 m_copydata(m, offsetof(struct ip6_hdr, ip6_dst),
182 sizeof(struct in6_addr),
183 (caddr_t) &dst_address.sin6.sin6_addr);
184 break;
185#endif /* INET6 */
186 default:
187 DPRINTF(("%s: unsupported protocol family %u\n", __func__, af));
188 m_freem(m);
189 IPSEC_ISTAT(sproto, V_espstat.esps_nopf, V_ahstat.ahs_nopf,
190 V_ipcompstat.ipcomps_nopf);
191 return EPFNOSUPPORT;
192 }
193
194 /* NB: only pass dst since key_allocsa follows RFC2401 */
195 sav = KEY_ALLOCSA(&dst_address, sproto, spi);
196 if (sav == NULL) {
197 DPRINTF(("%s: no key association found for SA %s/%08lx/%u\n",
198 __func__, ipsec_address(&dst_address),
199 (u_long) ntohl(spi), sproto));
200 IPSEC_ISTAT(sproto, V_espstat.esps_notdb, V_ahstat.ahs_notdb,
201 V_ipcompstat.ipcomps_notdb);
202 m_freem(m);
203 return ENOENT;
204 }
205
206 if (sav->tdb_xform == NULL) {
207 DPRINTF(("%s: attempted to use uninitialized SA %s/%08lx/%u\n",
208 __func__, ipsec_address(&dst_address),
209 (u_long) ntohl(spi), sproto));
210 IPSEC_ISTAT(sproto, V_espstat.esps_noxform, V_ahstat.ahs_noxform,
211 V_ipcompstat.ipcomps_noxform);
212 KEY_FREESAV(&sav);
213 m_freem(m);
214 return ENXIO;
215 }
216
217 /*
218 * Call appropriate transform and return -- callback takes care of
219 * everything else.
220 */
221 error = (*sav->tdb_xform->xf_input)(m, sav, skip, protoff);
222 KEY_FREESAV(&sav);
223 return error;
224}
225
226#ifdef INET
227/*
228 * Common input handler for IPv4 AH, ESP, and IPCOMP.
229 */
230int
231ipsec4_common_input(struct mbuf *m, ...)
232{
233 va_list ap;
234 int off, nxt;
235
236 va_start(ap, m);
237 off = va_arg(ap, int);
238 nxt = va_arg(ap, int);
239 va_end(ap);
240
241 return ipsec_common_input(m, off, offsetof(struct ip, ip_p),
242 AF_INET, nxt);
243}
244
245void
246ah4_input(struct mbuf *m, int off)
247{
248 ipsec4_common_input(m, off, IPPROTO_AH);
249}
250void
251ah4_ctlinput(int cmd, struct sockaddr *sa, void *v)
252{
253 if (sa->sa_family == AF_INET &&
254 sa->sa_len == sizeof(struct sockaddr_in))
255 ipsec4_common_ctlinput(cmd, sa, v, IPPROTO_AH);
256}
257
258void
259esp4_input(struct mbuf *m, int off)
260{
261 ipsec4_common_input(m, off, IPPROTO_ESP);
262}
263void
264esp4_ctlinput(int cmd, struct sockaddr *sa, void *v)
265{
266 if (sa->sa_family == AF_INET &&
267 sa->sa_len == sizeof(struct sockaddr_in))
268 ipsec4_common_ctlinput(cmd, sa, v, IPPROTO_ESP);
269}
270
271void
272ipcomp4_input(struct mbuf *m, int off)
273{
274 ipsec4_common_input(m, off, IPPROTO_IPCOMP);
275}
276
277/*
278 * IPsec input callback for INET protocols.
279 * This routine is called as the transform callback.
280 * Takes care of filtering and other sanity checks on
281 * the processed packet.
282 */
283int
284ipsec4_common_input_cb(struct mbuf *m, struct secasvar *sav,
285 int skip, int protoff, struct m_tag *mt)
286{
287 INIT_VNET_IPSEC(curvnet);
288 int prot, af, sproto;
289 struct ip *ip;
290 struct m_tag *mtag;
291 struct tdb_ident *tdbi;
292 struct secasindex *saidx;
293 int error;
294#ifdef INET6
295#ifdef notyet
296 char ip6buf[INET6_ADDRSTRLEN];
297#endif
298#endif
299
300 IPSEC_ASSERT(m != NULL, ("null mbuf"));
301 IPSEC_ASSERT(sav != NULL, ("null SA"));
302 IPSEC_ASSERT(sav->sah != NULL, ("null SAH"));
303 saidx = &sav->sah->saidx;
304 af = saidx->dst.sa.sa_family;
305 IPSEC_ASSERT(af == AF_INET, ("unexpected af %u", af));
306 sproto = saidx->proto;
307 IPSEC_ASSERT(sproto == IPPROTO_ESP || sproto == IPPROTO_AH ||
308 sproto == IPPROTO_IPCOMP,
309 ("unexpected security protocol %u", sproto));
310
311 /* Sanity check */
312 if (m == NULL) {
313 DPRINTF(("%s: null mbuf", __func__));
314 IPSEC_ISTAT(sproto, V_espstat.esps_badkcr, V_ahstat.ahs_badkcr,
315 V_ipcompstat.ipcomps_badkcr);
316 KEY_FREESAV(&sav);
317 return EINVAL;
318 }
319
320 if (skip != 0) {
321 /* Fix IPv4 header */
322 if (m->m_len < skip && (m = m_pullup(m, skip)) == NULL) {
323 DPRINTF(("%s: processing failed for SA %s/%08lx\n",
324 __func__, ipsec_address(&sav->sah->saidx.dst),
325 (u_long) ntohl(sav->spi)));
326 IPSEC_ISTAT(sproto, V_espstat.esps_hdrops, V_ahstat.ahs_hdrops,
327 V_ipcompstat.ipcomps_hdrops);
328 error = ENOBUFS;
329 goto bad;
330 }
331
332 ip = mtod(m, struct ip *);
333 ip->ip_len = htons(m->m_pkthdr.len);
334 ip->ip_off = htons(ip->ip_off);
335 ip->ip_sum = 0;
336 ip->ip_sum = in_cksum(m, ip->ip_hl << 2);
337 } else {
338 ip = mtod(m, struct ip *);
339 }
340 prot = ip->ip_p;
341
342#ifdef notyet
343 /* IP-in-IP encapsulation */
344 if (prot == IPPROTO_IPIP) {
345 struct ip ipn;
346
347 if (m->m_pkthdr.len - skip < sizeof(struct ip)) {
348 IPSEC_ISTAT(sproto, V_espstat.esps_hdrops,
349 V_ahstat.ahs_hdrops,
350 V_ipcompstat.ipcomps_hdrops);
351 error = EINVAL;
352 goto bad;
353 }
354 /* ipn will now contain the inner IPv4 header */
355 m_copydata(m, ip->ip_hl << 2, sizeof(struct ip),
356 (caddr_t) &ipn);
357
358 /* XXX PROXY address isn't recorded in SAH */
359 /*
360 * Check that the inner source address is the same as
361 * the proxy address, if available.
362 */
363 if ((saidx->proxy.sa.sa_family == AF_INET &&
364 saidx->proxy.sin.sin_addr.s_addr !=
365 INADDR_ANY &&
366 ipn.ip_src.s_addr !=
367 saidx->proxy.sin.sin_addr.s_addr) ||
368 (saidx->proxy.sa.sa_family != AF_INET &&
369 saidx->proxy.sa.sa_family != 0)) {
370
371 DPRINTF(("%s: inner source address %s doesn't "
372 "correspond to expected proxy source %s, "
373 "SA %s/%08lx\n", __func__,
374 inet_ntoa4(ipn.ip_src),
375 ipsp_address(saidx->proxy),
376 ipsp_address(saidx->dst),
377 (u_long) ntohl(sav->spi)));
378
379 IPSEC_ISTAT(sproto, V_espstat.esps_pdrops,
380 V_ahstat.ahs_pdrops,
381 V_ipcompstat.ipcomps_pdrops);
382 error = EACCES;
383 goto bad;
384 }
385 }
386#ifdef INET6
387 /* IPv6-in-IP encapsulation. */
388 if (prot == IPPROTO_IPV6) {
389 struct ip6_hdr ip6n;
390
391 if (m->m_pkthdr.len - skip < sizeof(struct ip6_hdr)) {
392 IPSEC_ISTAT(sproto, V_espstat.esps_hdrops,
393 V_ahstat.ahs_hdrops,
394 V_ipcompstat.ipcomps_hdrops);
395 error = EINVAL;
396 goto bad;
397 }
398 /* ip6n will now contain the inner IPv6 header. */
399 m_copydata(m, ip->ip_hl << 2, sizeof(struct ip6_hdr),
400 (caddr_t) &ip6n);
401
402 /*
403 * Check that the inner source address is the same as
404 * the proxy address, if available.
405 */
406 if ((saidx->proxy.sa.sa_family == AF_INET6 &&
407 !IN6_IS_ADDR_UNSPECIFIED(&saidx->proxy.sin6.sin6_addr) &&
408 !IN6_ARE_ADDR_EQUAL(&ip6n.ip6_src,
409 &saidx->proxy.sin6.sin6_addr)) ||
410 (saidx->proxy.sa.sa_family != AF_INET6 &&
411 saidx->proxy.sa.sa_family != 0)) {
412
413 DPRINTF(("%s: inner source address %s doesn't "
414 "correspond to expected proxy source %s, "
415 "SA %s/%08lx\n", __func__,
416 ip6_sprintf(ip6buf, &ip6n.ip6_src),
417 ipsec_address(&saidx->proxy),
418 ipsec_address(&saidx->dst),
419 (u_long) ntohl(sav->spi)));
420
421 IPSEC_ISTAT(sproto, V_espstat.esps_pdrops,
422 V_ahstat.ahs_pdrops,
423 V_ipcompstat.ipcomps_pdrops);
424 error = EACCES;
425 goto bad;
426 }
427 }
428#endif /* INET6 */
429#endif /*XXX*/
430
431 /*
432 * Record what we've done to the packet (under what SA it was
433 * processed). If we've been passed an mtag, it means the packet
434 * was already processed by an ethernet/crypto combo card and
435 * thus has a tag attached with all the right information, but
436 * with a PACKET_TAG_IPSEC_IN_CRYPTO_DONE as opposed to
437 * PACKET_TAG_IPSEC_IN_DONE type; in that case, just change the type.
438 */
439 if (mt == NULL && sproto != IPPROTO_IPCOMP) {
440 mtag = m_tag_get(PACKET_TAG_IPSEC_IN_DONE,
441 sizeof(struct tdb_ident), M_NOWAIT);
442 if (mtag == NULL) {
443 DPRINTF(("%s: failed to get tag\n", __func__));
444 IPSEC_ISTAT(sproto, V_espstat.esps_hdrops,
445 V_ahstat.ahs_hdrops, V_ipcompstat.ipcomps_hdrops);
446 error = ENOMEM;
447 goto bad;
448 }
449
450 tdbi = (struct tdb_ident *)(mtag + 1);
451 bcopy(&saidx->dst, &tdbi->dst, saidx->dst.sa.sa_len);
452 tdbi->proto = sproto;
453 tdbi->spi = sav->spi;
454 /* Cache those two for enc(4) in xform_ipip. */
455 tdbi->alg_auth = sav->alg_auth;
456 tdbi->alg_enc = sav->alg_enc;
457
458 m_tag_prepend(m, mtag);
459 } else if (mt != NULL) {
460 mt->m_tag_id = PACKET_TAG_IPSEC_IN_DONE;
461 /* XXX do we need to mark m_flags??? */
462 }
463
464 key_sa_recordxfer(sav, m); /* record data transfer */
465
466#ifdef DEV_ENC
467 encif->if_ipackets++;
468 encif->if_ibytes += m->m_pkthdr.len;
469
470 /*
471 * Pass the mbuf to enc0 for bpf and pfil. We will filter the IPIP
472 * packet later after it has been decapsulated.
473 */
474 ipsec_bpf(m, sav, AF_INET, ENC_IN|ENC_BEFORE);
475
476 if (prot != IPPROTO_IPIP)
477 if ((error = ipsec_filter(&m, PFIL_IN, ENC_IN|ENC_BEFORE)) != 0)
478 return (error);
479#endif
480
481 /*
482 * Re-dispatch via software interrupt.
483 */
484 if ((error = netisr_queue(NETISR_IP, m))) {
485 IPSEC_ISTAT(sproto, V_espstat.esps_qfull, V_ahstat.ahs_qfull,
486 V_ipcompstat.ipcomps_qfull);
487
488 DPRINTF(("%s: queue full; proto %u packet dropped\n",
489 __func__, sproto));
490 return error;
491 }
492 return 0;
493bad:
494 m_freem(m);
495 return error;
496}
497
498void
499ipsec4_common_ctlinput(int cmd, struct sockaddr *sa, void *v, int proto)
500{
501 /* XXX nothing just yet */
502}
503#endif /* INET */
504
505#ifdef INET6
506/* IPv6 AH wrapper. */
507int
508ipsec6_common_input(struct mbuf **mp, int *offp, int proto)
509{
510 INIT_VNET_IPSEC(curvnet);
511 int l = 0;
512 int protoff;
513 struct ip6_ext ip6e;
514
515 if (*offp < sizeof(struct ip6_hdr)) {
516 DPRINTF(("%s: bad offset %u\n", __func__, *offp));
517 return IPPROTO_DONE;
518 } else if (*offp == sizeof(struct ip6_hdr)) {
519 protoff = offsetof(struct ip6_hdr, ip6_nxt);
520 } else {
521 /* Chase down the header chain... */
522 protoff = sizeof(struct ip6_hdr);
523
524 do {
525 protoff += l;
526 m_copydata(*mp, protoff, sizeof(ip6e),
527 (caddr_t) &ip6e);
528
529 if (ip6e.ip6e_nxt == IPPROTO_AH)
530 l = (ip6e.ip6e_len + 2) << 2;
531 else
532 l = (ip6e.ip6e_len + 1) << 3;
533 IPSEC_ASSERT(l > 0, ("l went zero or negative"));
534 } while (protoff + l < *offp);
535
536 /* Malformed packet check */
537 if (protoff + l != *offp) {
538 DPRINTF(("%s: bad packet header chain, protoff %u, "
539 "l %u, off %u\n", __func__, protoff, l, *offp));
540 IPSEC_ISTAT(proto, V_espstat.esps_hdrops,
541 V_ahstat.ahs_hdrops,
542 V_ipcompstat.ipcomps_hdrops);
543 m_freem(*mp);
544 *mp = NULL;
545 return IPPROTO_DONE;
546 }
547 protoff += offsetof(struct ip6_ext, ip6e_nxt);
548 }
549 (void) ipsec_common_input(*mp, *offp, protoff, AF_INET6, proto);
550 return IPPROTO_DONE;
551}
552
553/*
554 * IPsec input callback, called by the transform callback. Takes care of
555 * filtering and other sanity checks on the processed packet.
556 */
557int
558ipsec6_common_input_cb(struct mbuf *m, struct secasvar *sav, int skip, int protoff,
559 struct m_tag *mt)
560{
561 INIT_VNET_INET6(curvnet);
562 INIT_VNET_IPSEC(curvnet);
563 int prot, af, sproto;
564 struct ip6_hdr *ip6;
565 struct m_tag *mtag;
566 struct tdb_ident *tdbi;
567 struct secasindex *saidx;
568 int nxt;
569 u_int8_t nxt8;
570 int error, nest;
571#ifdef notyet
572 char ip6buf[INET6_ADDRSTRLEN];
573#endif
574
575 IPSEC_ASSERT(m != NULL, ("null mbuf"));
576 IPSEC_ASSERT(sav != NULL, ("null SA"));
577 IPSEC_ASSERT(sav->sah != NULL, ("null SAH"));
578 saidx = &sav->sah->saidx;
579 af = saidx->dst.sa.sa_family;
580 IPSEC_ASSERT(af == AF_INET6, ("unexpected af %u", af));
581 sproto = saidx->proto;
582 IPSEC_ASSERT(sproto == IPPROTO_ESP || sproto == IPPROTO_AH ||
583 sproto == IPPROTO_IPCOMP,
584 ("unexpected security protocol %u", sproto));
585
586 /* Sanity check */
587 if (m == NULL) {
588 DPRINTF(("%s: null mbuf", __func__));
589 IPSEC_ISTAT(sproto, V_espstat.esps_badkcr, V_ahstat.ahs_badkcr,
590 V_ipcompstat.ipcomps_badkcr);
591 error = EINVAL;
592 goto bad;
593 }
594
595 /* Fix IPv6 header */
596 if (m->m_len < sizeof(struct ip6_hdr) &&
597 (m = m_pullup(m, sizeof(struct ip6_hdr))) == NULL) {
598
599 DPRINTF(("%s: processing failed for SA %s/%08lx\n",
600 __func__, ipsec_address(&sav->sah->saidx.dst),
601 (u_long) ntohl(sav->spi)));
602
603 IPSEC_ISTAT(sproto, V_espstat.esps_hdrops, V_ahstat.ahs_hdrops,
604 V_ipcompstat.ipcomps_hdrops);
605 error = EACCES;
606 goto bad;
607 }
608
609 ip6 = mtod(m, struct ip6_hdr *);
610 ip6->ip6_plen = htons(m->m_pkthdr.len - sizeof(struct ip6_hdr));
611
612 /* Save protocol */
613 m_copydata(m, protoff, 1, (unsigned char *) &prot);
614
615#ifdef notyet
616#ifdef INET
617 /* IP-in-IP encapsulation */
618 if (prot == IPPROTO_IPIP) {
619 struct ip ipn;
620
621 if (m->m_pkthdr.len - skip < sizeof(struct ip)) {
622 IPSEC_ISTAT(sproto, V_espstat.esps_hdrops,
623 V_ahstat.ahs_hdrops,
624 V_ipcompstat.ipcomps_hdrops);
625 error = EINVAL;
626 goto bad;
627 }
628 /* ipn will now contain the inner IPv4 header */
629 m_copydata(m, skip, sizeof(struct ip), (caddr_t) &ipn);
630
631 /*
632 * Check that the inner source address is the same as
633 * the proxy address, if available.
634 */
635 if ((saidx->proxy.sa.sa_family == AF_INET &&
636 saidx->proxy.sin.sin_addr.s_addr != INADDR_ANY &&
637 ipn.ip_src.s_addr != saidx->proxy.sin.sin_addr.s_addr) ||
638 (saidx->proxy.sa.sa_family != AF_INET &&
639 saidx->proxy.sa.sa_family != 0)) {
640
641 DPRINTF(("%s: inner source address %s doesn't "
642 "correspond to expected proxy source %s, "
643 "SA %s/%08lx\n", __func__,
644 inet_ntoa4(ipn.ip_src),
645 ipsec_address(&saidx->proxy),
646 ipsec_address(&saidx->dst),
647 (u_long) ntohl(sav->spi)));
648
649 IPSEC_ISTATsproto, (V_espstat.esps_pdrops,
650 V_ahstat.ahs_pdrops, V_ipcompstat.ipcomps_pdrops);
651 error = EACCES;
652 goto bad;
653 }
654 }
655#endif /* INET */
656
657 /* IPv6-in-IP encapsulation */
658 if (prot == IPPROTO_IPV6) {
659 struct ip6_hdr ip6n;
660
661 if (m->m_pkthdr.len - skip < sizeof(struct ip6_hdr)) {
662 IPSEC_ISTAT(sproto, V_espstat.esps_hdrops,
663 V_ahstat.ahs_hdrops,
664 V_ipcompstat.ipcomps_hdrops);
665 error = EINVAL;
666 goto bad;
667 }
668 /* ip6n will now contain the inner IPv6 header. */
669 m_copydata(m, skip, sizeof(struct ip6_hdr),
670 (caddr_t) &ip6n);
671
672 /*
673 * Check that the inner source address is the same as
674 * the proxy address, if available.
675 */
676 if ((saidx->proxy.sa.sa_family == AF_INET6 &&
677 !IN6_IS_ADDR_UNSPECIFIED(&saidx->proxy.sin6.sin6_addr) &&
678 !IN6_ARE_ADDR_EQUAL(&ip6n.ip6_src,
679 &saidx->proxy.sin6.sin6_addr)) ||
680 (saidx->proxy.sa.sa_family != AF_INET6 &&
681 saidx->proxy.sa.sa_family != 0)) {
682
683 DPRINTF(("%s: inner source address %s doesn't "
684 "correspond to expected proxy source %s, "
685 "SA %s/%08lx\n", __func__,
686 ip6_sprintf(ip6buf, &ip6n.ip6_src),
687 ipsec_address(&saidx->proxy),
688 ipsec_address(&saidx->dst),
689 (u_long) ntohl(sav->spi)));
690
691 IPSEC_ISTAT(sproto, V_espstat.esps_pdrops,
692 V_ahstat.ahs_pdrops, V_ipcompstat.ipcomps_pdrops);
693 error = EACCES;
694 goto bad;
695 }
696 }
697#endif /*XXX*/
698
699 /*
700 * Record what we've done to the packet (under what SA it was
701 * processed). If we've been passed an mtag, it means the packet
702 * was already processed by an ethernet/crypto combo card and
703 * thus has a tag attached with all the right information, but
704 * with a PACKET_TAG_IPSEC_IN_CRYPTO_DONE as opposed to
705 * PACKET_TAG_IPSEC_IN_DONE type; in that case, just change the type.
706 */
707 if (mt == NULL && sproto != IPPROTO_IPCOMP) {
708 mtag = m_tag_get(PACKET_TAG_IPSEC_IN_DONE,
709 sizeof(struct tdb_ident), M_NOWAIT);
710 if (mtag == NULL) {
711 DPRINTF(("%s: failed to get tag\n", __func__));
712 IPSEC_ISTAT(sproto, V_espstat.esps_hdrops,
713 V_ahstat.ahs_hdrops, V_ipcompstat.ipcomps_hdrops);
714 error = ENOMEM;
715 goto bad;
716 }
717
718 tdbi = (struct tdb_ident *)(mtag + 1);
719 bcopy(&saidx->dst, &tdbi->dst, sizeof(union sockaddr_union));
720 tdbi->proto = sproto;
721 tdbi->spi = sav->spi;
722 /* Cache those two for enc(4) in xform_ipip. */
723 tdbi->alg_auth = sav->alg_auth;
724 tdbi->alg_enc = sav->alg_enc;
725
726 m_tag_prepend(m, mtag);
727 } else {
728 if (mt != NULL)
729 mt->m_tag_id = PACKET_TAG_IPSEC_IN_DONE;
730 /* XXX do we need to mark m_flags??? */
731 }
732
733 key_sa_recordxfer(sav, m);
734
735#ifdef DEV_ENC
736 encif->if_ipackets++;
737 encif->if_ibytes += m->m_pkthdr.len;
738
739 /*
740 * Pass the mbuf to enc0 for bpf and pfil. We will filter the IPIP
741 * packet later after it has been decapsulated.
742 */
743 ipsec_bpf(m, sav, AF_INET6, ENC_IN|ENC_BEFORE);
744
745 /* XXX-BZ does not make sense. */
746 if (prot != IPPROTO_IPIP)
747 if ((error = ipsec_filter(&m, PFIL_IN, ENC_IN|ENC_BEFORE)) != 0)
748 return (error);
749#endif
750
751 /* Retrieve new protocol */
752 m_copydata(m, protoff, sizeof(u_int8_t), (caddr_t) &nxt8);
753
754 /*
755 * See the end of ip6_input for this logic.
756 * IPPROTO_IPV[46] case will be processed just like other ones
757 */
758 nest = 0;
759 nxt = nxt8;
760 while (nxt != IPPROTO_DONE) {
761 if (V_ip6_hdrnestlimit && (++nest > V_ip6_hdrnestlimit)) {
762 V_ip6stat.ip6s_toomanyhdr++;
763 error = EINVAL;
764 goto bad;
765 }
766
767 /*
768 * Protection against faulty packet - there should be
769 * more sanity checks in header chain processing.
770 */
771 if (m->m_pkthdr.len < skip) {
772 V_ip6stat.ip6s_tooshort++;
773 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_truncated);
774 error = EINVAL;
775 goto bad;
776 }
777 /*
778 * Enforce IPsec policy checking if we are seeing last header.
779 * note that we do not visit this with protocols with pcb layer
780 * code - like udp/tcp/raw ip.
781 */
782 if ((inet6sw[ip6_protox[nxt]].pr_flags & PR_LASTHDR) != 0 &&
783 ipsec6_in_reject(m, NULL)) {
784 error = EINVAL;
785 goto bad;
786 }
787 nxt = (*inet6sw[ip6_protox[nxt]].pr_input)(&m, &skip, nxt);
788 }
789 return 0;
790bad:
791 if (m)
792 m_freem(m);
793 return error;
794}
795
796void
797esp6_ctlinput(int cmd, struct sockaddr *sa, void *d)
798{
799 struct ip6ctlparam *ip6cp = NULL;
800 struct mbuf *m = NULL;
801 struct ip6_hdr *ip6;
802 int off;
803
804 if (sa->sa_family != AF_INET6 ||
805 sa->sa_len != sizeof(struct sockaddr_in6))
806 return;
807 if ((unsigned)cmd >= PRC_NCMDS)
808 return;
809
810 /* if the parameter is from icmp6, decode it. */
811 if (d != NULL) {
812 ip6cp = (struct ip6ctlparam *)d;
813 m = ip6cp->ip6c_m;
814 ip6 = ip6cp->ip6c_ip6;
815 off = ip6cp->ip6c_off;
816 } else {
817 m = NULL;
818 ip6 = NULL;
819 off = 0; /* calm gcc */
820 }
821
822 if (ip6 != NULL) {
823
824 struct ip6ctlparam ip6cp1;
825
826 /*
827 * Notify the error to all possible sockets via pfctlinput2.
828 * Since the upper layer information (such as protocol type,
829 * source and destination ports) is embedded in the encrypted
830 * data and might have been cut, we can't directly call
831 * an upper layer ctlinput function. However, the pcbnotify
832 * function will consider source and destination addresses
833 * as well as the flow info value, and may be able to find
834 * some PCB that should be notified.
835 * Although pfctlinput2 will call esp6_ctlinput(), there is
836 * no possibility of an infinite loop of function calls,
837 * because we don't pass the inner IPv6 header.
838 */
839 bzero(&ip6cp1, sizeof(ip6cp1));
840 ip6cp1.ip6c_src = ip6cp->ip6c_src;
841 pfctlinput2(cmd, sa, (void *)&ip6cp1);
842
843 /*
844 * Then go to special cases that need ESP header information.
845 * XXX: We assume that when ip6 is non NULL,
846 * M and OFF are valid.
847 */
848
849 if (cmd == PRC_MSGSIZE) {
850 struct secasvar *sav;
851 u_int32_t spi;
852 int valid;
853
854 /* check header length before using m_copydata */
855 if (m->m_pkthdr.len < off + sizeof (struct esp))
856 return;
857 m_copydata(m, off + offsetof(struct esp, esp_spi),
858 sizeof(u_int32_t), (caddr_t) &spi);
859 /*
860 * Check to see if we have a valid SA corresponding to
861 * the address in the ICMP message payload.
862 */
863 sav = KEY_ALLOCSA((union sockaddr_union *)sa,
864 IPPROTO_ESP, spi);
865 valid = (sav != NULL);
866 if (sav)
867 KEY_FREESAV(&sav);
868
869 /* XXX Further validation? */
870
871 /*
872 * Depending on whether the SA is "valid" and
873 * routing table size (mtudisc_{hi,lo}wat), we will:
874 * - recalcurate the new MTU and create the
875 * corresponding routing entry, or
876 * - ignore the MTU change notification.
877 */
878 icmp6_mtudisc_update(ip6cp, valid);
879 }
880 } else {
881 /* we normally notify any pcb here */
882 }
883}
884#endif /* INET6 */