77#endif
78
79#include <netipsec/ipsec.h>
80#ifdef INET6
81#include <netipsec/ipsec6.h>
82#endif
83#include <netipsec/ah_var.h>
84#include <netipsec/esp.h>
85#include <netipsec/esp_var.h>
86#include <netipsec/ipcomp_var.h>
87
88#include <netipsec/key.h>
89#include <netipsec/keydb.h>
90
91#include <netipsec/xform.h>
92#include <netinet6/ip6protosw.h>
93
94#include <machine/in_cksum.h>
95#include <machine/stdarg.h>
96
97#ifdef DEV_ENC
98#include <net/if_enc.h>
99#endif
100
101
102#define IPSEC_ISTAT(p,x,y,z) ((p) == IPPROTO_ESP ? (x)++ : \
103 (p) == IPPROTO_AH ? (y)++ : (z)++)
104
105static void ipsec4_common_ctlinput(int, struct sockaddr *, void *, int);
106
107/*
108 * ipsec_common_input gets called when an IPsec-protected packet
109 * is received by IPv4 or IPv6. It's job is to find the right SA
110 * and call the appropriate transform. The transform callback
111 * takes care of further processing (like ingress filtering).
112 */
113static int
114ipsec_common_input(struct mbuf *m, int skip, int protoff, int af, int sproto)
115{
116 INIT_VNET_IPSEC(curvnet);
117 union sockaddr_union dst_address;
118 struct secasvar *sav;
119 u_int32_t spi;
120 int error;
121
122 IPSEC_ISTAT(sproto, V_espstat.esps_input, V_ahstat.ahs_input,
123 V_ipcompstat.ipcomps_input);
124
125 IPSEC_ASSERT(m != NULL, ("null packet"));
126
127 IPSEC_ASSERT(sproto == IPPROTO_ESP || sproto == IPPROTO_AH ||
128 sproto == IPPROTO_IPCOMP,
129 ("unexpected security protocol %u", sproto));
130
131 if ((sproto == IPPROTO_ESP && !V_esp_enable) ||
132 (sproto == IPPROTO_AH && !V_ah_enable) ||
133 (sproto == IPPROTO_IPCOMP && !V_ipcomp_enable)) {
134 m_freem(m);
135 IPSEC_ISTAT(sproto, V_espstat.esps_pdrops, V_ahstat.ahs_pdrops,
136 V_ipcompstat.ipcomps_pdrops);
137 return EOPNOTSUPP;
138 }
139
140 if (m->m_pkthdr.len - skip < 2 * sizeof (u_int32_t)) {
141 m_freem(m);
142 IPSEC_ISTAT(sproto, V_espstat.esps_hdrops, V_ahstat.ahs_hdrops,
143 V_ipcompstat.ipcomps_hdrops);
144 DPRINTF(("%s: packet too small\n", __func__));
145 return EINVAL;
146 }
147
148 /* Retrieve the SPI from the relevant IPsec header */
149 if (sproto == IPPROTO_ESP)
150 m_copydata(m, skip, sizeof(u_int32_t), (caddr_t) &spi);
151 else if (sproto == IPPROTO_AH)
152 m_copydata(m, skip + sizeof(u_int32_t), sizeof(u_int32_t),
153 (caddr_t) &spi);
154 else if (sproto == IPPROTO_IPCOMP) {
155 u_int16_t cpi;
156 m_copydata(m, skip + sizeof(u_int16_t), sizeof(u_int16_t),
157 (caddr_t) &cpi);
158 spi = ntohl(htons(cpi));
159 }
160
161 /*
162 * Find the SA and (indirectly) call the appropriate
163 * kernel crypto routine. The resulting mbuf chain is a valid
164 * IP packet ready to go through input processing.
165 */
166 bzero(&dst_address, sizeof (dst_address));
167 dst_address.sa.sa_family = af;
168 switch (af) {
169#ifdef INET
170 case AF_INET:
171 dst_address.sin.sin_len = sizeof(struct sockaddr_in);
172 m_copydata(m, offsetof(struct ip, ip_dst),
173 sizeof(struct in_addr),
174 (caddr_t) &dst_address.sin.sin_addr);
175 break;
176#endif /* INET */
177#ifdef INET6
178 case AF_INET6:
179 dst_address.sin6.sin6_len = sizeof(struct sockaddr_in6);
180 m_copydata(m, offsetof(struct ip6_hdr, ip6_dst),
181 sizeof(struct in6_addr),
182 (caddr_t) &dst_address.sin6.sin6_addr);
183 break;
184#endif /* INET6 */
185 default:
186 DPRINTF(("%s: unsupported protocol family %u\n", __func__, af));
187 m_freem(m);
188 IPSEC_ISTAT(sproto, V_espstat.esps_nopf, V_ahstat.ahs_nopf,
189 V_ipcompstat.ipcomps_nopf);
190 return EPFNOSUPPORT;
191 }
192
193 /* NB: only pass dst since key_allocsa follows RFC2401 */
194 sav = KEY_ALLOCSA(&dst_address, sproto, spi);
195 if (sav == NULL) {
196 DPRINTF(("%s: no key association found for SA %s/%08lx/%u\n",
197 __func__, ipsec_address(&dst_address),
198 (u_long) ntohl(spi), sproto));
199 IPSEC_ISTAT(sproto, V_espstat.esps_notdb, V_ahstat.ahs_notdb,
200 V_ipcompstat.ipcomps_notdb);
201 m_freem(m);
202 return ENOENT;
203 }
204
205 if (sav->tdb_xform == NULL) {
206 DPRINTF(("%s: attempted to use uninitialized SA %s/%08lx/%u\n",
207 __func__, ipsec_address(&dst_address),
208 (u_long) ntohl(spi), sproto));
209 IPSEC_ISTAT(sproto, V_espstat.esps_noxform, V_ahstat.ahs_noxform,
210 V_ipcompstat.ipcomps_noxform);
211 KEY_FREESAV(&sav);
212 m_freem(m);
213 return ENXIO;
214 }
215
216 /*
217 * Call appropriate transform and return -- callback takes care of
218 * everything else.
219 */
220 error = (*sav->tdb_xform->xf_input)(m, sav, skip, protoff);
221 KEY_FREESAV(&sav);
222 return error;
223}
224
225#ifdef INET
226/*
227 * Common input handler for IPv4 AH, ESP, and IPCOMP.
228 */
229int
230ipsec4_common_input(struct mbuf *m, ...)
231{
232 va_list ap;
233 int off, nxt;
234
235 va_start(ap, m);
236 off = va_arg(ap, int);
237 nxt = va_arg(ap, int);
238 va_end(ap);
239
240 return ipsec_common_input(m, off, offsetof(struct ip, ip_p),
241 AF_INET, nxt);
242}
243
244void
245ah4_input(struct mbuf *m, int off)
246{
247 ipsec4_common_input(m, off, IPPROTO_AH);
248}
249void
250ah4_ctlinput(int cmd, struct sockaddr *sa, void *v)
251{
252 if (sa->sa_family == AF_INET &&
253 sa->sa_len == sizeof(struct sockaddr_in))
254 ipsec4_common_ctlinput(cmd, sa, v, IPPROTO_AH);
255}
256
257void
258esp4_input(struct mbuf *m, int off)
259{
260 ipsec4_common_input(m, off, IPPROTO_ESP);
261}
262void
263esp4_ctlinput(int cmd, struct sockaddr *sa, void *v)
264{
265 if (sa->sa_family == AF_INET &&
266 sa->sa_len == sizeof(struct sockaddr_in))
267 ipsec4_common_ctlinput(cmd, sa, v, IPPROTO_ESP);
268}
269
270void
271ipcomp4_input(struct mbuf *m, int off)
272{
273 ipsec4_common_input(m, off, IPPROTO_IPCOMP);
274}
275
276/*
277 * IPsec input callback for INET protocols.
278 * This routine is called as the transform callback.
279 * Takes care of filtering and other sanity checks on
280 * the processed packet.
281 */
282int
283ipsec4_common_input_cb(struct mbuf *m, struct secasvar *sav,
284 int skip, int protoff, struct m_tag *mt)
285{
286 INIT_VNET_IPSEC(curvnet);
287 int prot, af, sproto;
288 struct ip *ip;
289 struct m_tag *mtag;
290 struct tdb_ident *tdbi;
291 struct secasindex *saidx;
292 int error;
293#ifdef INET6
294#ifdef notyet
295 char ip6buf[INET6_ADDRSTRLEN];
296#endif
297#endif
298
299 IPSEC_ASSERT(m != NULL, ("null mbuf"));
300 IPSEC_ASSERT(sav != NULL, ("null SA"));
301 IPSEC_ASSERT(sav->sah != NULL, ("null SAH"));
302 saidx = &sav->sah->saidx;
303 af = saidx->dst.sa.sa_family;
304 IPSEC_ASSERT(af == AF_INET, ("unexpected af %u", af));
305 sproto = saidx->proto;
306 IPSEC_ASSERT(sproto == IPPROTO_ESP || sproto == IPPROTO_AH ||
307 sproto == IPPROTO_IPCOMP,
308 ("unexpected security protocol %u", sproto));
309
310 /* Sanity check */
311 if (m == NULL) {
312 DPRINTF(("%s: null mbuf", __func__));
313 IPSEC_ISTAT(sproto, V_espstat.esps_badkcr, V_ahstat.ahs_badkcr,
314 V_ipcompstat.ipcomps_badkcr);
315 KEY_FREESAV(&sav);
316 return EINVAL;
317 }
318
319 if (skip != 0) {
320 /* Fix IPv4 header */
321 if (m->m_len < skip && (m = m_pullup(m, skip)) == NULL) {
322 DPRINTF(("%s: processing failed for SA %s/%08lx\n",
323 __func__, ipsec_address(&sav->sah->saidx.dst),
324 (u_long) ntohl(sav->spi)));
325 IPSEC_ISTAT(sproto, V_espstat.esps_hdrops, V_ahstat.ahs_hdrops,
326 V_ipcompstat.ipcomps_hdrops);
327 error = ENOBUFS;
328 goto bad;
329 }
330
331 ip = mtod(m, struct ip *);
332 ip->ip_len = htons(m->m_pkthdr.len);
333 ip->ip_off = htons(ip->ip_off);
334 ip->ip_sum = 0;
335 ip->ip_sum = in_cksum(m, ip->ip_hl << 2);
336 } else {
337 ip = mtod(m, struct ip *);
338 }
339 prot = ip->ip_p;
340
341#ifdef notyet
342 /* IP-in-IP encapsulation */
343 if (prot == IPPROTO_IPIP) {
344 struct ip ipn;
345
346 if (m->m_pkthdr.len - skip < sizeof(struct ip)) {
347 IPSEC_ISTAT(sproto, V_espstat.esps_hdrops,
348 V_ahstat.ahs_hdrops,
349 V_ipcompstat.ipcomps_hdrops);
350 error = EINVAL;
351 goto bad;
352 }
353 /* ipn will now contain the inner IPv4 header */
354 m_copydata(m, ip->ip_hl << 2, sizeof(struct ip),
355 (caddr_t) &ipn);
356
357 /* XXX PROXY address isn't recorded in SAH */
358 /*
359 * Check that the inner source address is the same as
360 * the proxy address, if available.
361 */
362 if ((saidx->proxy.sa.sa_family == AF_INET &&
363 saidx->proxy.sin.sin_addr.s_addr !=
364 INADDR_ANY &&
365 ipn.ip_src.s_addr !=
366 saidx->proxy.sin.sin_addr.s_addr) ||
367 (saidx->proxy.sa.sa_family != AF_INET &&
368 saidx->proxy.sa.sa_family != 0)) {
369
370 DPRINTF(("%s: inner source address %s doesn't "
371 "correspond to expected proxy source %s, "
372 "SA %s/%08lx\n", __func__,
373 inet_ntoa4(ipn.ip_src),
374 ipsp_address(saidx->proxy),
375 ipsp_address(saidx->dst),
376 (u_long) ntohl(sav->spi)));
377
378 IPSEC_ISTAT(sproto, V_espstat.esps_pdrops,
379 V_ahstat.ahs_pdrops,
380 V_ipcompstat.ipcomps_pdrops);
381 error = EACCES;
382 goto bad;
383 }
384 }
385#ifdef INET6
386 /* IPv6-in-IP encapsulation. */
387 if (prot == IPPROTO_IPV6) {
388 struct ip6_hdr ip6n;
389
390 if (m->m_pkthdr.len - skip < sizeof(struct ip6_hdr)) {
391 IPSEC_ISTAT(sproto, V_espstat.esps_hdrops,
392 V_ahstat.ahs_hdrops,
393 V_ipcompstat.ipcomps_hdrops);
394 error = EINVAL;
395 goto bad;
396 }
397 /* ip6n will now contain the inner IPv6 header. */
398 m_copydata(m, ip->ip_hl << 2, sizeof(struct ip6_hdr),
399 (caddr_t) &ip6n);
400
401 /*
402 * Check that the inner source address is the same as
403 * the proxy address, if available.
404 */
405 if ((saidx->proxy.sa.sa_family == AF_INET6 &&
406 !IN6_IS_ADDR_UNSPECIFIED(&saidx->proxy.sin6.sin6_addr) &&
407 !IN6_ARE_ADDR_EQUAL(&ip6n.ip6_src,
408 &saidx->proxy.sin6.sin6_addr)) ||
409 (saidx->proxy.sa.sa_family != AF_INET6 &&
410 saidx->proxy.sa.sa_family != 0)) {
411
412 DPRINTF(("%s: inner source address %s doesn't "
413 "correspond to expected proxy source %s, "
414 "SA %s/%08lx\n", __func__,
415 ip6_sprintf(ip6buf, &ip6n.ip6_src),
416 ipsec_address(&saidx->proxy),
417 ipsec_address(&saidx->dst),
418 (u_long) ntohl(sav->spi)));
419
420 IPSEC_ISTAT(sproto, V_espstat.esps_pdrops,
421 V_ahstat.ahs_pdrops,
422 V_ipcompstat.ipcomps_pdrops);
423 error = EACCES;
424 goto bad;
425 }
426 }
427#endif /* INET6 */
428#endif /*XXX*/
429
430 /*
431 * Record what we've done to the packet (under what SA it was
432 * processed). If we've been passed an mtag, it means the packet
433 * was already processed by an ethernet/crypto combo card and
434 * thus has a tag attached with all the right information, but
435 * with a PACKET_TAG_IPSEC_IN_CRYPTO_DONE as opposed to
436 * PACKET_TAG_IPSEC_IN_DONE type; in that case, just change the type.
437 */
438 if (mt == NULL && sproto != IPPROTO_IPCOMP) {
439 mtag = m_tag_get(PACKET_TAG_IPSEC_IN_DONE,
440 sizeof(struct tdb_ident), M_NOWAIT);
441 if (mtag == NULL) {
442 DPRINTF(("%s: failed to get tag\n", __func__));
443 IPSEC_ISTAT(sproto, V_espstat.esps_hdrops,
444 V_ahstat.ahs_hdrops, V_ipcompstat.ipcomps_hdrops);
445 error = ENOMEM;
446 goto bad;
447 }
448
449 tdbi = (struct tdb_ident *)(mtag + 1);
450 bcopy(&saidx->dst, &tdbi->dst, saidx->dst.sa.sa_len);
451 tdbi->proto = sproto;
452 tdbi->spi = sav->spi;
453 /* Cache those two for enc(4) in xform_ipip. */
454 tdbi->alg_auth = sav->alg_auth;
455 tdbi->alg_enc = sav->alg_enc;
456
457 m_tag_prepend(m, mtag);
458 } else if (mt != NULL) {
459 mt->m_tag_id = PACKET_TAG_IPSEC_IN_DONE;
460 /* XXX do we need to mark m_flags??? */
461 }
462
463 key_sa_recordxfer(sav, m); /* record data transfer */
464
465#ifdef DEV_ENC
466 encif->if_ipackets++;
467 encif->if_ibytes += m->m_pkthdr.len;
468
469 /*
470 * Pass the mbuf to enc0 for bpf and pfil. We will filter the IPIP
471 * packet later after it has been decapsulated.
472 */
473 ipsec_bpf(m, sav, AF_INET, ENC_IN|ENC_BEFORE);
474
475 if (prot != IPPROTO_IPIP)
476 if ((error = ipsec_filter(&m, PFIL_IN, ENC_IN|ENC_BEFORE)) != 0)
477 return (error);
478#endif
479
480 /*
481 * Re-dispatch via software interrupt.
482 */
483 if ((error = netisr_queue(NETISR_IP, m))) {
484 IPSEC_ISTAT(sproto, V_espstat.esps_qfull, V_ahstat.ahs_qfull,
485 V_ipcompstat.ipcomps_qfull);
486
487 DPRINTF(("%s: queue full; proto %u packet dropped\n",
488 __func__, sproto));
489 return error;
490 }
491 return 0;
492bad:
493 m_freem(m);
494 return error;
495}
496
497void
498ipsec4_common_ctlinput(int cmd, struct sockaddr *sa, void *v, int proto)
499{
500 /* XXX nothing just yet */
501}
502#endif /* INET */
503
504#ifdef INET6
505/* IPv6 AH wrapper. */
506int
507ipsec6_common_input(struct mbuf **mp, int *offp, int proto)
508{
509 INIT_VNET_IPSEC(curvnet);
510 int l = 0;
511 int protoff;
512 struct ip6_ext ip6e;
513
514 if (*offp < sizeof(struct ip6_hdr)) {
515 DPRINTF(("%s: bad offset %u\n", __func__, *offp));
516 return IPPROTO_DONE;
517 } else if (*offp == sizeof(struct ip6_hdr)) {
518 protoff = offsetof(struct ip6_hdr, ip6_nxt);
519 } else {
520 /* Chase down the header chain... */
521 protoff = sizeof(struct ip6_hdr);
522
523 do {
524 protoff += l;
525 m_copydata(*mp, protoff, sizeof(ip6e),
526 (caddr_t) &ip6e);
527
528 if (ip6e.ip6e_nxt == IPPROTO_AH)
529 l = (ip6e.ip6e_len + 2) << 2;
530 else
531 l = (ip6e.ip6e_len + 1) << 3;
532 IPSEC_ASSERT(l > 0, ("l went zero or negative"));
533 } while (protoff + l < *offp);
534
535 /* Malformed packet check */
536 if (protoff + l != *offp) {
537 DPRINTF(("%s: bad packet header chain, protoff %u, "
538 "l %u, off %u\n", __func__, protoff, l, *offp));
539 IPSEC_ISTAT(proto, V_espstat.esps_hdrops,
540 V_ahstat.ahs_hdrops,
541 V_ipcompstat.ipcomps_hdrops);
542 m_freem(*mp);
543 *mp = NULL;
544 return IPPROTO_DONE;
545 }
546 protoff += offsetof(struct ip6_ext, ip6e_nxt);
547 }
548 (void) ipsec_common_input(*mp, *offp, protoff, AF_INET6, proto);
549 return IPPROTO_DONE;
550}
551
552/*
553 * IPsec input callback, called by the transform callback. Takes care of
554 * filtering and other sanity checks on the processed packet.
555 */
556int
557ipsec6_common_input_cb(struct mbuf *m, struct secasvar *sav, int skip, int protoff,
558 struct m_tag *mt)
559{
560 INIT_VNET_INET6(curvnet);
561 INIT_VNET_IPSEC(curvnet);
562 int prot, af, sproto;
563 struct ip6_hdr *ip6;
564 struct m_tag *mtag;
565 struct tdb_ident *tdbi;
566 struct secasindex *saidx;
567 int nxt;
568 u_int8_t nxt8;
569 int error, nest;
570#ifdef notyet
571 char ip6buf[INET6_ADDRSTRLEN];
572#endif
573
574 IPSEC_ASSERT(m != NULL, ("null mbuf"));
575 IPSEC_ASSERT(sav != NULL, ("null SA"));
576 IPSEC_ASSERT(sav->sah != NULL, ("null SAH"));
577 saidx = &sav->sah->saidx;
578 af = saidx->dst.sa.sa_family;
579 IPSEC_ASSERT(af == AF_INET6, ("unexpected af %u", af));
580 sproto = saidx->proto;
581 IPSEC_ASSERT(sproto == IPPROTO_ESP || sproto == IPPROTO_AH ||
582 sproto == IPPROTO_IPCOMP,
583 ("unexpected security protocol %u", sproto));
584
585 /* Sanity check */
586 if (m == NULL) {
587 DPRINTF(("%s: null mbuf", __func__));
588 IPSEC_ISTAT(sproto, V_espstat.esps_badkcr, V_ahstat.ahs_badkcr,
589 V_ipcompstat.ipcomps_badkcr);
590 error = EINVAL;
591 goto bad;
592 }
593
594 /* Fix IPv6 header */
595 if (m->m_len < sizeof(struct ip6_hdr) &&
596 (m = m_pullup(m, sizeof(struct ip6_hdr))) == NULL) {
597
598 DPRINTF(("%s: processing failed for SA %s/%08lx\n",
599 __func__, ipsec_address(&sav->sah->saidx.dst),
600 (u_long) ntohl(sav->spi)));
601
602 IPSEC_ISTAT(sproto, V_espstat.esps_hdrops, V_ahstat.ahs_hdrops,
603 V_ipcompstat.ipcomps_hdrops);
604 error = EACCES;
605 goto bad;
606 }
607
608 ip6 = mtod(m, struct ip6_hdr *);
609 ip6->ip6_plen = htons(m->m_pkthdr.len - sizeof(struct ip6_hdr));
610
611 /* Save protocol */
612 m_copydata(m, protoff, 1, (unsigned char *) &prot);
613
614#ifdef notyet
615#ifdef INET
616 /* IP-in-IP encapsulation */
617 if (prot == IPPROTO_IPIP) {
618 struct ip ipn;
619
620 if (m->m_pkthdr.len - skip < sizeof(struct ip)) {
621 IPSEC_ISTAT(sproto, V_espstat.esps_hdrops,
622 V_ahstat.ahs_hdrops,
623 V_ipcompstat.ipcomps_hdrops);
624 error = EINVAL;
625 goto bad;
626 }
627 /* ipn will now contain the inner IPv4 header */
628 m_copydata(m, skip, sizeof(struct ip), (caddr_t) &ipn);
629
630 /*
631 * Check that the inner source address is the same as
632 * the proxy address, if available.
633 */
634 if ((saidx->proxy.sa.sa_family == AF_INET &&
635 saidx->proxy.sin.sin_addr.s_addr != INADDR_ANY &&
636 ipn.ip_src.s_addr != saidx->proxy.sin.sin_addr.s_addr) ||
637 (saidx->proxy.sa.sa_family != AF_INET &&
638 saidx->proxy.sa.sa_family != 0)) {
639
640 DPRINTF(("%s: inner source address %s doesn't "
641 "correspond to expected proxy source %s, "
642 "SA %s/%08lx\n", __func__,
643 inet_ntoa4(ipn.ip_src),
644 ipsec_address(&saidx->proxy),
645 ipsec_address(&saidx->dst),
646 (u_long) ntohl(sav->spi)));
647
648 IPSEC_ISTATsproto, (V_espstat.esps_pdrops,
649 V_ahstat.ahs_pdrops, V_ipcompstat.ipcomps_pdrops);
650 error = EACCES;
651 goto bad;
652 }
653 }
654#endif /* INET */
655
656 /* IPv6-in-IP encapsulation */
657 if (prot == IPPROTO_IPV6) {
658 struct ip6_hdr ip6n;
659
660 if (m->m_pkthdr.len - skip < sizeof(struct ip6_hdr)) {
661 IPSEC_ISTAT(sproto, V_espstat.esps_hdrops,
662 V_ahstat.ahs_hdrops,
663 V_ipcompstat.ipcomps_hdrops);
664 error = EINVAL;
665 goto bad;
666 }
667 /* ip6n will now contain the inner IPv6 header. */
668 m_copydata(m, skip, sizeof(struct ip6_hdr),
669 (caddr_t) &ip6n);
670
671 /*
672 * Check that the inner source address is the same as
673 * the proxy address, if available.
674 */
675 if ((saidx->proxy.sa.sa_family == AF_INET6 &&
676 !IN6_IS_ADDR_UNSPECIFIED(&saidx->proxy.sin6.sin6_addr) &&
677 !IN6_ARE_ADDR_EQUAL(&ip6n.ip6_src,
678 &saidx->proxy.sin6.sin6_addr)) ||
679 (saidx->proxy.sa.sa_family != AF_INET6 &&
680 saidx->proxy.sa.sa_family != 0)) {
681
682 DPRINTF(("%s: inner source address %s doesn't "
683 "correspond to expected proxy source %s, "
684 "SA %s/%08lx\n", __func__,
685 ip6_sprintf(ip6buf, &ip6n.ip6_src),
686 ipsec_address(&saidx->proxy),
687 ipsec_address(&saidx->dst),
688 (u_long) ntohl(sav->spi)));
689
690 IPSEC_ISTAT(sproto, V_espstat.esps_pdrops,
691 V_ahstat.ahs_pdrops, V_ipcompstat.ipcomps_pdrops);
692 error = EACCES;
693 goto bad;
694 }
695 }
696#endif /*XXX*/
697
698 /*
699 * Record what we've done to the packet (under what SA it was
700 * processed). If we've been passed an mtag, it means the packet
701 * was already processed by an ethernet/crypto combo card and
702 * thus has a tag attached with all the right information, but
703 * with a PACKET_TAG_IPSEC_IN_CRYPTO_DONE as opposed to
704 * PACKET_TAG_IPSEC_IN_DONE type; in that case, just change the type.
705 */
706 if (mt == NULL && sproto != IPPROTO_IPCOMP) {
707 mtag = m_tag_get(PACKET_TAG_IPSEC_IN_DONE,
708 sizeof(struct tdb_ident), M_NOWAIT);
709 if (mtag == NULL) {
710 DPRINTF(("%s: failed to get tag\n", __func__));
711 IPSEC_ISTAT(sproto, V_espstat.esps_hdrops,
712 V_ahstat.ahs_hdrops, V_ipcompstat.ipcomps_hdrops);
713 error = ENOMEM;
714 goto bad;
715 }
716
717 tdbi = (struct tdb_ident *)(mtag + 1);
718 bcopy(&saidx->dst, &tdbi->dst, sizeof(union sockaddr_union));
719 tdbi->proto = sproto;
720 tdbi->spi = sav->spi;
721 /* Cache those two for enc(4) in xform_ipip. */
722 tdbi->alg_auth = sav->alg_auth;
723 tdbi->alg_enc = sav->alg_enc;
724
725 m_tag_prepend(m, mtag);
726 } else {
727 if (mt != NULL)
728 mt->m_tag_id = PACKET_TAG_IPSEC_IN_DONE;
729 /* XXX do we need to mark m_flags??? */
730 }
731
732 key_sa_recordxfer(sav, m);
733
734#ifdef DEV_ENC
735 encif->if_ipackets++;
736 encif->if_ibytes += m->m_pkthdr.len;
737
738 /*
739 * Pass the mbuf to enc0 for bpf and pfil. We will filter the IPIP
740 * packet later after it has been decapsulated.
741 */
742 ipsec_bpf(m, sav, AF_INET6, ENC_IN|ENC_BEFORE);
743
744 /* XXX-BZ does not make sense. */
745 if (prot != IPPROTO_IPIP)
746 if ((error = ipsec_filter(&m, PFIL_IN, ENC_IN|ENC_BEFORE)) != 0)
747 return (error);
748#endif
749
750 /* Retrieve new protocol */
751 m_copydata(m, protoff, sizeof(u_int8_t), (caddr_t) &nxt8);
752
753 /*
754 * See the end of ip6_input for this logic.
755 * IPPROTO_IPV[46] case will be processed just like other ones
756 */
757 nest = 0;
758 nxt = nxt8;
759 while (nxt != IPPROTO_DONE) {
760 if (V_ip6_hdrnestlimit && (++nest > V_ip6_hdrnestlimit)) {
761 V_ip6stat.ip6s_toomanyhdr++;
762 error = EINVAL;
763 goto bad;
764 }
765
766 /*
767 * Protection against faulty packet - there should be
768 * more sanity checks in header chain processing.
769 */
770 if (m->m_pkthdr.len < skip) {
771 V_ip6stat.ip6s_tooshort++;
772 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_truncated);
773 error = EINVAL;
774 goto bad;
775 }
776 /*
777 * Enforce IPsec policy checking if we are seeing last header.
778 * note that we do not visit this with protocols with pcb layer
779 * code - like udp/tcp/raw ip.
780 */
781 if ((inet6sw[ip6_protox[nxt]].pr_flags & PR_LASTHDR) != 0 &&
782 ipsec6_in_reject(m, NULL)) {
783 error = EINVAL;
784 goto bad;
785 }
786 nxt = (*inet6sw[ip6_protox[nxt]].pr_input)(&m, &skip, nxt);
787 }
788 return 0;
789bad:
790 if (m)
791 m_freem(m);
792 return error;
793}
794
795void
796esp6_ctlinput(int cmd, struct sockaddr *sa, void *d)
797{
798 struct ip6ctlparam *ip6cp = NULL;
799 struct mbuf *m = NULL;
800 struct ip6_hdr *ip6;
801 int off;
802
803 if (sa->sa_family != AF_INET6 ||
804 sa->sa_len != sizeof(struct sockaddr_in6))
805 return;
806 if ((unsigned)cmd >= PRC_NCMDS)
807 return;
808
809 /* if the parameter is from icmp6, decode it. */
810 if (d != NULL) {
811 ip6cp = (struct ip6ctlparam *)d;
812 m = ip6cp->ip6c_m;
813 ip6 = ip6cp->ip6c_ip6;
814 off = ip6cp->ip6c_off;
815 } else {
816 m = NULL;
817 ip6 = NULL;
818 off = 0; /* calm gcc */
819 }
820
821 if (ip6 != NULL) {
822
823 struct ip6ctlparam ip6cp1;
824
825 /*
826 * Notify the error to all possible sockets via pfctlinput2.
827 * Since the upper layer information (such as protocol type,
828 * source and destination ports) is embedded in the encrypted
829 * data and might have been cut, we can't directly call
830 * an upper layer ctlinput function. However, the pcbnotify
831 * function will consider source and destination addresses
832 * as well as the flow info value, and may be able to find
833 * some PCB that should be notified.
834 * Although pfctlinput2 will call esp6_ctlinput(), there is
835 * no possibility of an infinite loop of function calls,
836 * because we don't pass the inner IPv6 header.
837 */
838 bzero(&ip6cp1, sizeof(ip6cp1));
839 ip6cp1.ip6c_src = ip6cp->ip6c_src;
840 pfctlinput2(cmd, sa, (void *)&ip6cp1);
841
842 /*
843 * Then go to special cases that need ESP header information.
844 * XXX: We assume that when ip6 is non NULL,
845 * M and OFF are valid.
846 */
847
848 if (cmd == PRC_MSGSIZE) {
849 struct secasvar *sav;
850 u_int32_t spi;
851 int valid;
852
853 /* check header length before using m_copydata */
854 if (m->m_pkthdr.len < off + sizeof (struct esp))
855 return;
856 m_copydata(m, off + offsetof(struct esp, esp_spi),
857 sizeof(u_int32_t), (caddr_t) &spi);
858 /*
859 * Check to see if we have a valid SA corresponding to
860 * the address in the ICMP message payload.
861 */
862 sav = KEY_ALLOCSA((union sockaddr_union *)sa,
863 IPPROTO_ESP, spi);
864 valid = (sav != NULL);
865 if (sav)
866 KEY_FREESAV(&sav);
867
868 /* XXX Further validation? */
869
870 /*
871 * Depending on whether the SA is "valid" and
872 * routing table size (mtudisc_{hi,lo}wat), we will:
873 * - recalcurate the new MTU and create the
874 * corresponding routing entry, or
875 * - ignore the MTU change notification.
876 */
877 icmp6_mtudisc_update(ip6cp, valid);
878 }
879 } else {
880 /* we normally notify any pcb here */
881 }
882}
883#endif /* INET6 */
| 78#endif
79
80#include <netipsec/ipsec.h>
81#ifdef INET6
82#include <netipsec/ipsec6.h>
83#endif
84#include <netipsec/ah_var.h>
85#include <netipsec/esp.h>
86#include <netipsec/esp_var.h>
87#include <netipsec/ipcomp_var.h>
88
89#include <netipsec/key.h>
90#include <netipsec/keydb.h>
91
92#include <netipsec/xform.h>
93#include <netinet6/ip6protosw.h>
94
95#include <machine/in_cksum.h>
96#include <machine/stdarg.h>
97
98#ifdef DEV_ENC
99#include <net/if_enc.h>
100#endif
101
102
103#define IPSEC_ISTAT(p,x,y,z) ((p) == IPPROTO_ESP ? (x)++ : \
104 (p) == IPPROTO_AH ? (y)++ : (z)++)
105
106static void ipsec4_common_ctlinput(int, struct sockaddr *, void *, int);
107
108/*
109 * ipsec_common_input gets called when an IPsec-protected packet
110 * is received by IPv4 or IPv6. It's job is to find the right SA
111 * and call the appropriate transform. The transform callback
112 * takes care of further processing (like ingress filtering).
113 */
114static int
115ipsec_common_input(struct mbuf *m, int skip, int protoff, int af, int sproto)
116{
117 INIT_VNET_IPSEC(curvnet);
118 union sockaddr_union dst_address;
119 struct secasvar *sav;
120 u_int32_t spi;
121 int error;
122
123 IPSEC_ISTAT(sproto, V_espstat.esps_input, V_ahstat.ahs_input,
124 V_ipcompstat.ipcomps_input);
125
126 IPSEC_ASSERT(m != NULL, ("null packet"));
127
128 IPSEC_ASSERT(sproto == IPPROTO_ESP || sproto == IPPROTO_AH ||
129 sproto == IPPROTO_IPCOMP,
130 ("unexpected security protocol %u", sproto));
131
132 if ((sproto == IPPROTO_ESP && !V_esp_enable) ||
133 (sproto == IPPROTO_AH && !V_ah_enable) ||
134 (sproto == IPPROTO_IPCOMP && !V_ipcomp_enable)) {
135 m_freem(m);
136 IPSEC_ISTAT(sproto, V_espstat.esps_pdrops, V_ahstat.ahs_pdrops,
137 V_ipcompstat.ipcomps_pdrops);
138 return EOPNOTSUPP;
139 }
140
141 if (m->m_pkthdr.len - skip < 2 * sizeof (u_int32_t)) {
142 m_freem(m);
143 IPSEC_ISTAT(sproto, V_espstat.esps_hdrops, V_ahstat.ahs_hdrops,
144 V_ipcompstat.ipcomps_hdrops);
145 DPRINTF(("%s: packet too small\n", __func__));
146 return EINVAL;
147 }
148
149 /* Retrieve the SPI from the relevant IPsec header */
150 if (sproto == IPPROTO_ESP)
151 m_copydata(m, skip, sizeof(u_int32_t), (caddr_t) &spi);
152 else if (sproto == IPPROTO_AH)
153 m_copydata(m, skip + sizeof(u_int32_t), sizeof(u_int32_t),
154 (caddr_t) &spi);
155 else if (sproto == IPPROTO_IPCOMP) {
156 u_int16_t cpi;
157 m_copydata(m, skip + sizeof(u_int16_t), sizeof(u_int16_t),
158 (caddr_t) &cpi);
159 spi = ntohl(htons(cpi));
160 }
161
162 /*
163 * Find the SA and (indirectly) call the appropriate
164 * kernel crypto routine. The resulting mbuf chain is a valid
165 * IP packet ready to go through input processing.
166 */
167 bzero(&dst_address, sizeof (dst_address));
168 dst_address.sa.sa_family = af;
169 switch (af) {
170#ifdef INET
171 case AF_INET:
172 dst_address.sin.sin_len = sizeof(struct sockaddr_in);
173 m_copydata(m, offsetof(struct ip, ip_dst),
174 sizeof(struct in_addr),
175 (caddr_t) &dst_address.sin.sin_addr);
176 break;
177#endif /* INET */
178#ifdef INET6
179 case AF_INET6:
180 dst_address.sin6.sin6_len = sizeof(struct sockaddr_in6);
181 m_copydata(m, offsetof(struct ip6_hdr, ip6_dst),
182 sizeof(struct in6_addr),
183 (caddr_t) &dst_address.sin6.sin6_addr);
184 break;
185#endif /* INET6 */
186 default:
187 DPRINTF(("%s: unsupported protocol family %u\n", __func__, af));
188 m_freem(m);
189 IPSEC_ISTAT(sproto, V_espstat.esps_nopf, V_ahstat.ahs_nopf,
190 V_ipcompstat.ipcomps_nopf);
191 return EPFNOSUPPORT;
192 }
193
194 /* NB: only pass dst since key_allocsa follows RFC2401 */
195 sav = KEY_ALLOCSA(&dst_address, sproto, spi);
196 if (sav == NULL) {
197 DPRINTF(("%s: no key association found for SA %s/%08lx/%u\n",
198 __func__, ipsec_address(&dst_address),
199 (u_long) ntohl(spi), sproto));
200 IPSEC_ISTAT(sproto, V_espstat.esps_notdb, V_ahstat.ahs_notdb,
201 V_ipcompstat.ipcomps_notdb);
202 m_freem(m);
203 return ENOENT;
204 }
205
206 if (sav->tdb_xform == NULL) {
207 DPRINTF(("%s: attempted to use uninitialized SA %s/%08lx/%u\n",
208 __func__, ipsec_address(&dst_address),
209 (u_long) ntohl(spi), sproto));
210 IPSEC_ISTAT(sproto, V_espstat.esps_noxform, V_ahstat.ahs_noxform,
211 V_ipcompstat.ipcomps_noxform);
212 KEY_FREESAV(&sav);
213 m_freem(m);
214 return ENXIO;
215 }
216
217 /*
218 * Call appropriate transform and return -- callback takes care of
219 * everything else.
220 */
221 error = (*sav->tdb_xform->xf_input)(m, sav, skip, protoff);
222 KEY_FREESAV(&sav);
223 return error;
224}
225
226#ifdef INET
227/*
228 * Common input handler for IPv4 AH, ESP, and IPCOMP.
229 */
230int
231ipsec4_common_input(struct mbuf *m, ...)
232{
233 va_list ap;
234 int off, nxt;
235
236 va_start(ap, m);
237 off = va_arg(ap, int);
238 nxt = va_arg(ap, int);
239 va_end(ap);
240
241 return ipsec_common_input(m, off, offsetof(struct ip, ip_p),
242 AF_INET, nxt);
243}
244
245void
246ah4_input(struct mbuf *m, int off)
247{
248 ipsec4_common_input(m, off, IPPROTO_AH);
249}
250void
251ah4_ctlinput(int cmd, struct sockaddr *sa, void *v)
252{
253 if (sa->sa_family == AF_INET &&
254 sa->sa_len == sizeof(struct sockaddr_in))
255 ipsec4_common_ctlinput(cmd, sa, v, IPPROTO_AH);
256}
257
258void
259esp4_input(struct mbuf *m, int off)
260{
261 ipsec4_common_input(m, off, IPPROTO_ESP);
262}
263void
264esp4_ctlinput(int cmd, struct sockaddr *sa, void *v)
265{
266 if (sa->sa_family == AF_INET &&
267 sa->sa_len == sizeof(struct sockaddr_in))
268 ipsec4_common_ctlinput(cmd, sa, v, IPPROTO_ESP);
269}
270
271void
272ipcomp4_input(struct mbuf *m, int off)
273{
274 ipsec4_common_input(m, off, IPPROTO_IPCOMP);
275}
276
277/*
278 * IPsec input callback for INET protocols.
279 * This routine is called as the transform callback.
280 * Takes care of filtering and other sanity checks on
281 * the processed packet.
282 */
283int
284ipsec4_common_input_cb(struct mbuf *m, struct secasvar *sav,
285 int skip, int protoff, struct m_tag *mt)
286{
287 INIT_VNET_IPSEC(curvnet);
288 int prot, af, sproto;
289 struct ip *ip;
290 struct m_tag *mtag;
291 struct tdb_ident *tdbi;
292 struct secasindex *saidx;
293 int error;
294#ifdef INET6
295#ifdef notyet
296 char ip6buf[INET6_ADDRSTRLEN];
297#endif
298#endif
299
300 IPSEC_ASSERT(m != NULL, ("null mbuf"));
301 IPSEC_ASSERT(sav != NULL, ("null SA"));
302 IPSEC_ASSERT(sav->sah != NULL, ("null SAH"));
303 saidx = &sav->sah->saidx;
304 af = saidx->dst.sa.sa_family;
305 IPSEC_ASSERT(af == AF_INET, ("unexpected af %u", af));
306 sproto = saidx->proto;
307 IPSEC_ASSERT(sproto == IPPROTO_ESP || sproto == IPPROTO_AH ||
308 sproto == IPPROTO_IPCOMP,
309 ("unexpected security protocol %u", sproto));
310
311 /* Sanity check */
312 if (m == NULL) {
313 DPRINTF(("%s: null mbuf", __func__));
314 IPSEC_ISTAT(sproto, V_espstat.esps_badkcr, V_ahstat.ahs_badkcr,
315 V_ipcompstat.ipcomps_badkcr);
316 KEY_FREESAV(&sav);
317 return EINVAL;
318 }
319
320 if (skip != 0) {
321 /* Fix IPv4 header */
322 if (m->m_len < skip && (m = m_pullup(m, skip)) == NULL) {
323 DPRINTF(("%s: processing failed for SA %s/%08lx\n",
324 __func__, ipsec_address(&sav->sah->saidx.dst),
325 (u_long) ntohl(sav->spi)));
326 IPSEC_ISTAT(sproto, V_espstat.esps_hdrops, V_ahstat.ahs_hdrops,
327 V_ipcompstat.ipcomps_hdrops);
328 error = ENOBUFS;
329 goto bad;
330 }
331
332 ip = mtod(m, struct ip *);
333 ip->ip_len = htons(m->m_pkthdr.len);
334 ip->ip_off = htons(ip->ip_off);
335 ip->ip_sum = 0;
336 ip->ip_sum = in_cksum(m, ip->ip_hl << 2);
337 } else {
338 ip = mtod(m, struct ip *);
339 }
340 prot = ip->ip_p;
341
342#ifdef notyet
343 /* IP-in-IP encapsulation */
344 if (prot == IPPROTO_IPIP) {
345 struct ip ipn;
346
347 if (m->m_pkthdr.len - skip < sizeof(struct ip)) {
348 IPSEC_ISTAT(sproto, V_espstat.esps_hdrops,
349 V_ahstat.ahs_hdrops,
350 V_ipcompstat.ipcomps_hdrops);
351 error = EINVAL;
352 goto bad;
353 }
354 /* ipn will now contain the inner IPv4 header */
355 m_copydata(m, ip->ip_hl << 2, sizeof(struct ip),
356 (caddr_t) &ipn);
357
358 /* XXX PROXY address isn't recorded in SAH */
359 /*
360 * Check that the inner source address is the same as
361 * the proxy address, if available.
362 */
363 if ((saidx->proxy.sa.sa_family == AF_INET &&
364 saidx->proxy.sin.sin_addr.s_addr !=
365 INADDR_ANY &&
366 ipn.ip_src.s_addr !=
367 saidx->proxy.sin.sin_addr.s_addr) ||
368 (saidx->proxy.sa.sa_family != AF_INET &&
369 saidx->proxy.sa.sa_family != 0)) {
370
371 DPRINTF(("%s: inner source address %s doesn't "
372 "correspond to expected proxy source %s, "
373 "SA %s/%08lx\n", __func__,
374 inet_ntoa4(ipn.ip_src),
375 ipsp_address(saidx->proxy),
376 ipsp_address(saidx->dst),
377 (u_long) ntohl(sav->spi)));
378
379 IPSEC_ISTAT(sproto, V_espstat.esps_pdrops,
380 V_ahstat.ahs_pdrops,
381 V_ipcompstat.ipcomps_pdrops);
382 error = EACCES;
383 goto bad;
384 }
385 }
386#ifdef INET6
387 /* IPv6-in-IP encapsulation. */
388 if (prot == IPPROTO_IPV6) {
389 struct ip6_hdr ip6n;
390
391 if (m->m_pkthdr.len - skip < sizeof(struct ip6_hdr)) {
392 IPSEC_ISTAT(sproto, V_espstat.esps_hdrops,
393 V_ahstat.ahs_hdrops,
394 V_ipcompstat.ipcomps_hdrops);
395 error = EINVAL;
396 goto bad;
397 }
398 /* ip6n will now contain the inner IPv6 header. */
399 m_copydata(m, ip->ip_hl << 2, sizeof(struct ip6_hdr),
400 (caddr_t) &ip6n);
401
402 /*
403 * Check that the inner source address is the same as
404 * the proxy address, if available.
405 */
406 if ((saidx->proxy.sa.sa_family == AF_INET6 &&
407 !IN6_IS_ADDR_UNSPECIFIED(&saidx->proxy.sin6.sin6_addr) &&
408 !IN6_ARE_ADDR_EQUAL(&ip6n.ip6_src,
409 &saidx->proxy.sin6.sin6_addr)) ||
410 (saidx->proxy.sa.sa_family != AF_INET6 &&
411 saidx->proxy.sa.sa_family != 0)) {
412
413 DPRINTF(("%s: inner source address %s doesn't "
414 "correspond to expected proxy source %s, "
415 "SA %s/%08lx\n", __func__,
416 ip6_sprintf(ip6buf, &ip6n.ip6_src),
417 ipsec_address(&saidx->proxy),
418 ipsec_address(&saidx->dst),
419 (u_long) ntohl(sav->spi)));
420
421 IPSEC_ISTAT(sproto, V_espstat.esps_pdrops,
422 V_ahstat.ahs_pdrops,
423 V_ipcompstat.ipcomps_pdrops);
424 error = EACCES;
425 goto bad;
426 }
427 }
428#endif /* INET6 */
429#endif /*XXX*/
430
431 /*
432 * Record what we've done to the packet (under what SA it was
433 * processed). If we've been passed an mtag, it means the packet
434 * was already processed by an ethernet/crypto combo card and
435 * thus has a tag attached with all the right information, but
436 * with a PACKET_TAG_IPSEC_IN_CRYPTO_DONE as opposed to
437 * PACKET_TAG_IPSEC_IN_DONE type; in that case, just change the type.
438 */
439 if (mt == NULL && sproto != IPPROTO_IPCOMP) {
440 mtag = m_tag_get(PACKET_TAG_IPSEC_IN_DONE,
441 sizeof(struct tdb_ident), M_NOWAIT);
442 if (mtag == NULL) {
443 DPRINTF(("%s: failed to get tag\n", __func__));
444 IPSEC_ISTAT(sproto, V_espstat.esps_hdrops,
445 V_ahstat.ahs_hdrops, V_ipcompstat.ipcomps_hdrops);
446 error = ENOMEM;
447 goto bad;
448 }
449
450 tdbi = (struct tdb_ident *)(mtag + 1);
451 bcopy(&saidx->dst, &tdbi->dst, saidx->dst.sa.sa_len);
452 tdbi->proto = sproto;
453 tdbi->spi = sav->spi;
454 /* Cache those two for enc(4) in xform_ipip. */
455 tdbi->alg_auth = sav->alg_auth;
456 tdbi->alg_enc = sav->alg_enc;
457
458 m_tag_prepend(m, mtag);
459 } else if (mt != NULL) {
460 mt->m_tag_id = PACKET_TAG_IPSEC_IN_DONE;
461 /* XXX do we need to mark m_flags??? */
462 }
463
464 key_sa_recordxfer(sav, m); /* record data transfer */
465
466#ifdef DEV_ENC
467 encif->if_ipackets++;
468 encif->if_ibytes += m->m_pkthdr.len;
469
470 /*
471 * Pass the mbuf to enc0 for bpf and pfil. We will filter the IPIP
472 * packet later after it has been decapsulated.
473 */
474 ipsec_bpf(m, sav, AF_INET, ENC_IN|ENC_BEFORE);
475
476 if (prot != IPPROTO_IPIP)
477 if ((error = ipsec_filter(&m, PFIL_IN, ENC_IN|ENC_BEFORE)) != 0)
478 return (error);
479#endif
480
481 /*
482 * Re-dispatch via software interrupt.
483 */
484 if ((error = netisr_queue(NETISR_IP, m))) {
485 IPSEC_ISTAT(sproto, V_espstat.esps_qfull, V_ahstat.ahs_qfull,
486 V_ipcompstat.ipcomps_qfull);
487
488 DPRINTF(("%s: queue full; proto %u packet dropped\n",
489 __func__, sproto));
490 return error;
491 }
492 return 0;
493bad:
494 m_freem(m);
495 return error;
496}
497
498void
499ipsec4_common_ctlinput(int cmd, struct sockaddr *sa, void *v, int proto)
500{
501 /* XXX nothing just yet */
502}
503#endif /* INET */
504
505#ifdef INET6
506/* IPv6 AH wrapper. */
507int
508ipsec6_common_input(struct mbuf **mp, int *offp, int proto)
509{
510 INIT_VNET_IPSEC(curvnet);
511 int l = 0;
512 int protoff;
513 struct ip6_ext ip6e;
514
515 if (*offp < sizeof(struct ip6_hdr)) {
516 DPRINTF(("%s: bad offset %u\n", __func__, *offp));
517 return IPPROTO_DONE;
518 } else if (*offp == sizeof(struct ip6_hdr)) {
519 protoff = offsetof(struct ip6_hdr, ip6_nxt);
520 } else {
521 /* Chase down the header chain... */
522 protoff = sizeof(struct ip6_hdr);
523
524 do {
525 protoff += l;
526 m_copydata(*mp, protoff, sizeof(ip6e),
527 (caddr_t) &ip6e);
528
529 if (ip6e.ip6e_nxt == IPPROTO_AH)
530 l = (ip6e.ip6e_len + 2) << 2;
531 else
532 l = (ip6e.ip6e_len + 1) << 3;
533 IPSEC_ASSERT(l > 0, ("l went zero or negative"));
534 } while (protoff + l < *offp);
535
536 /* Malformed packet check */
537 if (protoff + l != *offp) {
538 DPRINTF(("%s: bad packet header chain, protoff %u, "
539 "l %u, off %u\n", __func__, protoff, l, *offp));
540 IPSEC_ISTAT(proto, V_espstat.esps_hdrops,
541 V_ahstat.ahs_hdrops,
542 V_ipcompstat.ipcomps_hdrops);
543 m_freem(*mp);
544 *mp = NULL;
545 return IPPROTO_DONE;
546 }
547 protoff += offsetof(struct ip6_ext, ip6e_nxt);
548 }
549 (void) ipsec_common_input(*mp, *offp, protoff, AF_INET6, proto);
550 return IPPROTO_DONE;
551}
552
553/*
554 * IPsec input callback, called by the transform callback. Takes care of
555 * filtering and other sanity checks on the processed packet.
556 */
557int
558ipsec6_common_input_cb(struct mbuf *m, struct secasvar *sav, int skip, int protoff,
559 struct m_tag *mt)
560{
561 INIT_VNET_INET6(curvnet);
562 INIT_VNET_IPSEC(curvnet);
563 int prot, af, sproto;
564 struct ip6_hdr *ip6;
565 struct m_tag *mtag;
566 struct tdb_ident *tdbi;
567 struct secasindex *saidx;
568 int nxt;
569 u_int8_t nxt8;
570 int error, nest;
571#ifdef notyet
572 char ip6buf[INET6_ADDRSTRLEN];
573#endif
574
575 IPSEC_ASSERT(m != NULL, ("null mbuf"));
576 IPSEC_ASSERT(sav != NULL, ("null SA"));
577 IPSEC_ASSERT(sav->sah != NULL, ("null SAH"));
578 saidx = &sav->sah->saidx;
579 af = saidx->dst.sa.sa_family;
580 IPSEC_ASSERT(af == AF_INET6, ("unexpected af %u", af));
581 sproto = saidx->proto;
582 IPSEC_ASSERT(sproto == IPPROTO_ESP || sproto == IPPROTO_AH ||
583 sproto == IPPROTO_IPCOMP,
584 ("unexpected security protocol %u", sproto));
585
586 /* Sanity check */
587 if (m == NULL) {
588 DPRINTF(("%s: null mbuf", __func__));
589 IPSEC_ISTAT(sproto, V_espstat.esps_badkcr, V_ahstat.ahs_badkcr,
590 V_ipcompstat.ipcomps_badkcr);
591 error = EINVAL;
592 goto bad;
593 }
594
595 /* Fix IPv6 header */
596 if (m->m_len < sizeof(struct ip6_hdr) &&
597 (m = m_pullup(m, sizeof(struct ip6_hdr))) == NULL) {
598
599 DPRINTF(("%s: processing failed for SA %s/%08lx\n",
600 __func__, ipsec_address(&sav->sah->saidx.dst),
601 (u_long) ntohl(sav->spi)));
602
603 IPSEC_ISTAT(sproto, V_espstat.esps_hdrops, V_ahstat.ahs_hdrops,
604 V_ipcompstat.ipcomps_hdrops);
605 error = EACCES;
606 goto bad;
607 }
608
609 ip6 = mtod(m, struct ip6_hdr *);
610 ip6->ip6_plen = htons(m->m_pkthdr.len - sizeof(struct ip6_hdr));
611
612 /* Save protocol */
613 m_copydata(m, protoff, 1, (unsigned char *) &prot);
614
615#ifdef notyet
616#ifdef INET
617 /* IP-in-IP encapsulation */
618 if (prot == IPPROTO_IPIP) {
619 struct ip ipn;
620
621 if (m->m_pkthdr.len - skip < sizeof(struct ip)) {
622 IPSEC_ISTAT(sproto, V_espstat.esps_hdrops,
623 V_ahstat.ahs_hdrops,
624 V_ipcompstat.ipcomps_hdrops);
625 error = EINVAL;
626 goto bad;
627 }
628 /* ipn will now contain the inner IPv4 header */
629 m_copydata(m, skip, sizeof(struct ip), (caddr_t) &ipn);
630
631 /*
632 * Check that the inner source address is the same as
633 * the proxy address, if available.
634 */
635 if ((saidx->proxy.sa.sa_family == AF_INET &&
636 saidx->proxy.sin.sin_addr.s_addr != INADDR_ANY &&
637 ipn.ip_src.s_addr != saidx->proxy.sin.sin_addr.s_addr) ||
638 (saidx->proxy.sa.sa_family != AF_INET &&
639 saidx->proxy.sa.sa_family != 0)) {
640
641 DPRINTF(("%s: inner source address %s doesn't "
642 "correspond to expected proxy source %s, "
643 "SA %s/%08lx\n", __func__,
644 inet_ntoa4(ipn.ip_src),
645 ipsec_address(&saidx->proxy),
646 ipsec_address(&saidx->dst),
647 (u_long) ntohl(sav->spi)));
648
649 IPSEC_ISTATsproto, (V_espstat.esps_pdrops,
650 V_ahstat.ahs_pdrops, V_ipcompstat.ipcomps_pdrops);
651 error = EACCES;
652 goto bad;
653 }
654 }
655#endif /* INET */
656
657 /* IPv6-in-IP encapsulation */
658 if (prot == IPPROTO_IPV6) {
659 struct ip6_hdr ip6n;
660
661 if (m->m_pkthdr.len - skip < sizeof(struct ip6_hdr)) {
662 IPSEC_ISTAT(sproto, V_espstat.esps_hdrops,
663 V_ahstat.ahs_hdrops,
664 V_ipcompstat.ipcomps_hdrops);
665 error = EINVAL;
666 goto bad;
667 }
668 /* ip6n will now contain the inner IPv6 header. */
669 m_copydata(m, skip, sizeof(struct ip6_hdr),
670 (caddr_t) &ip6n);
671
672 /*
673 * Check that the inner source address is the same as
674 * the proxy address, if available.
675 */
676 if ((saidx->proxy.sa.sa_family == AF_INET6 &&
677 !IN6_IS_ADDR_UNSPECIFIED(&saidx->proxy.sin6.sin6_addr) &&
678 !IN6_ARE_ADDR_EQUAL(&ip6n.ip6_src,
679 &saidx->proxy.sin6.sin6_addr)) ||
680 (saidx->proxy.sa.sa_family != AF_INET6 &&
681 saidx->proxy.sa.sa_family != 0)) {
682
683 DPRINTF(("%s: inner source address %s doesn't "
684 "correspond to expected proxy source %s, "
685 "SA %s/%08lx\n", __func__,
686 ip6_sprintf(ip6buf, &ip6n.ip6_src),
687 ipsec_address(&saidx->proxy),
688 ipsec_address(&saidx->dst),
689 (u_long) ntohl(sav->spi)));
690
691 IPSEC_ISTAT(sproto, V_espstat.esps_pdrops,
692 V_ahstat.ahs_pdrops, V_ipcompstat.ipcomps_pdrops);
693 error = EACCES;
694 goto bad;
695 }
696 }
697#endif /*XXX*/
698
699 /*
700 * Record what we've done to the packet (under what SA it was
701 * processed). If we've been passed an mtag, it means the packet
702 * was already processed by an ethernet/crypto combo card and
703 * thus has a tag attached with all the right information, but
704 * with a PACKET_TAG_IPSEC_IN_CRYPTO_DONE as opposed to
705 * PACKET_TAG_IPSEC_IN_DONE type; in that case, just change the type.
706 */
707 if (mt == NULL && sproto != IPPROTO_IPCOMP) {
708 mtag = m_tag_get(PACKET_TAG_IPSEC_IN_DONE,
709 sizeof(struct tdb_ident), M_NOWAIT);
710 if (mtag == NULL) {
711 DPRINTF(("%s: failed to get tag\n", __func__));
712 IPSEC_ISTAT(sproto, V_espstat.esps_hdrops,
713 V_ahstat.ahs_hdrops, V_ipcompstat.ipcomps_hdrops);
714 error = ENOMEM;
715 goto bad;
716 }
717
718 tdbi = (struct tdb_ident *)(mtag + 1);
719 bcopy(&saidx->dst, &tdbi->dst, sizeof(union sockaddr_union));
720 tdbi->proto = sproto;
721 tdbi->spi = sav->spi;
722 /* Cache those two for enc(4) in xform_ipip. */
723 tdbi->alg_auth = sav->alg_auth;
724 tdbi->alg_enc = sav->alg_enc;
725
726 m_tag_prepend(m, mtag);
727 } else {
728 if (mt != NULL)
729 mt->m_tag_id = PACKET_TAG_IPSEC_IN_DONE;
730 /* XXX do we need to mark m_flags??? */
731 }
732
733 key_sa_recordxfer(sav, m);
734
735#ifdef DEV_ENC
736 encif->if_ipackets++;
737 encif->if_ibytes += m->m_pkthdr.len;
738
739 /*
740 * Pass the mbuf to enc0 for bpf and pfil. We will filter the IPIP
741 * packet later after it has been decapsulated.
742 */
743 ipsec_bpf(m, sav, AF_INET6, ENC_IN|ENC_BEFORE);
744
745 /* XXX-BZ does not make sense. */
746 if (prot != IPPROTO_IPIP)
747 if ((error = ipsec_filter(&m, PFIL_IN, ENC_IN|ENC_BEFORE)) != 0)
748 return (error);
749#endif
750
751 /* Retrieve new protocol */
752 m_copydata(m, protoff, sizeof(u_int8_t), (caddr_t) &nxt8);
753
754 /*
755 * See the end of ip6_input for this logic.
756 * IPPROTO_IPV[46] case will be processed just like other ones
757 */
758 nest = 0;
759 nxt = nxt8;
760 while (nxt != IPPROTO_DONE) {
761 if (V_ip6_hdrnestlimit && (++nest > V_ip6_hdrnestlimit)) {
762 V_ip6stat.ip6s_toomanyhdr++;
763 error = EINVAL;
764 goto bad;
765 }
766
767 /*
768 * Protection against faulty packet - there should be
769 * more sanity checks in header chain processing.
770 */
771 if (m->m_pkthdr.len < skip) {
772 V_ip6stat.ip6s_tooshort++;
773 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_truncated);
774 error = EINVAL;
775 goto bad;
776 }
777 /*
778 * Enforce IPsec policy checking if we are seeing last header.
779 * note that we do not visit this with protocols with pcb layer
780 * code - like udp/tcp/raw ip.
781 */
782 if ((inet6sw[ip6_protox[nxt]].pr_flags & PR_LASTHDR) != 0 &&
783 ipsec6_in_reject(m, NULL)) {
784 error = EINVAL;
785 goto bad;
786 }
787 nxt = (*inet6sw[ip6_protox[nxt]].pr_input)(&m, &skip, nxt);
788 }
789 return 0;
790bad:
791 if (m)
792 m_freem(m);
793 return error;
794}
795
796void
797esp6_ctlinput(int cmd, struct sockaddr *sa, void *d)
798{
799 struct ip6ctlparam *ip6cp = NULL;
800 struct mbuf *m = NULL;
801 struct ip6_hdr *ip6;
802 int off;
803
804 if (sa->sa_family != AF_INET6 ||
805 sa->sa_len != sizeof(struct sockaddr_in6))
806 return;
807 if ((unsigned)cmd >= PRC_NCMDS)
808 return;
809
810 /* if the parameter is from icmp6, decode it. */
811 if (d != NULL) {
812 ip6cp = (struct ip6ctlparam *)d;
813 m = ip6cp->ip6c_m;
814 ip6 = ip6cp->ip6c_ip6;
815 off = ip6cp->ip6c_off;
816 } else {
817 m = NULL;
818 ip6 = NULL;
819 off = 0; /* calm gcc */
820 }
821
822 if (ip6 != NULL) {
823
824 struct ip6ctlparam ip6cp1;
825
826 /*
827 * Notify the error to all possible sockets via pfctlinput2.
828 * Since the upper layer information (such as protocol type,
829 * source and destination ports) is embedded in the encrypted
830 * data and might have been cut, we can't directly call
831 * an upper layer ctlinput function. However, the pcbnotify
832 * function will consider source and destination addresses
833 * as well as the flow info value, and may be able to find
834 * some PCB that should be notified.
835 * Although pfctlinput2 will call esp6_ctlinput(), there is
836 * no possibility of an infinite loop of function calls,
837 * because we don't pass the inner IPv6 header.
838 */
839 bzero(&ip6cp1, sizeof(ip6cp1));
840 ip6cp1.ip6c_src = ip6cp->ip6c_src;
841 pfctlinput2(cmd, sa, (void *)&ip6cp1);
842
843 /*
844 * Then go to special cases that need ESP header information.
845 * XXX: We assume that when ip6 is non NULL,
846 * M and OFF are valid.
847 */
848
849 if (cmd == PRC_MSGSIZE) {
850 struct secasvar *sav;
851 u_int32_t spi;
852 int valid;
853
854 /* check header length before using m_copydata */
855 if (m->m_pkthdr.len < off + sizeof (struct esp))
856 return;
857 m_copydata(m, off + offsetof(struct esp, esp_spi),
858 sizeof(u_int32_t), (caddr_t) &spi);
859 /*
860 * Check to see if we have a valid SA corresponding to
861 * the address in the ICMP message payload.
862 */
863 sav = KEY_ALLOCSA((union sockaddr_union *)sa,
864 IPPROTO_ESP, spi);
865 valid = (sav != NULL);
866 if (sav)
867 KEY_FREESAV(&sav);
868
869 /* XXX Further validation? */
870
871 /*
872 * Depending on whether the SA is "valid" and
873 * routing table size (mtudisc_{hi,lo}wat), we will:
874 * - recalcurate the new MTU and create the
875 * corresponding routing entry, or
876 * - ignore the MTU change notification.
877 */
878 icmp6_mtudisc_update(ip6cp, valid);
879 }
880 } else {
881 /* we normally notify any pcb here */
882 }
883}
884#endif /* INET6 */
|