2/* $OpenBSD: ipsec_input.c,v 1.63 2003/02/20 18:35:43 deraadt Exp $ */ 3/*- 4 * The authors of this code are John Ioannidis (ji@tla.org), 5 * Angelos D. Keromytis (kermit@csd.uch.gr) and 6 * Niels Provos (provos@physnet.uni-hamburg.de). 7 * 8 * This code was written by John Ioannidis for BSD/OS in Athens, Greece, 9 * in November 1995. 10 * 11 * Ported to OpenBSD and NetBSD, with additional transforms, in December 1996, 12 * by Angelos D. Keromytis. 13 * 14 * Additional transforms and features in 1997 and 1998 by Angelos D. Keromytis 15 * and Niels Provos. 16 * 17 * Additional features in 1999 by Angelos D. Keromytis. 18 * 19 * Copyright (C) 1995, 1996, 1997, 1998, 1999 by John Ioannidis, 20 * Angelos D. Keromytis and Niels Provos. 21 * Copyright (c) 2001, Angelos D. Keromytis. 22 * 23 * Permission to use, copy, and modify this software with or without fee 24 * is hereby granted, provided that this entire notice is included in 25 * all copies of any software which is or includes a copy or 26 * modification of this software. 27 * You may use this code under the GNU public license if you so wish. Please 28 * contribute changes back to the authors under this freer than GPL license 29 * so that we may further the use of strong encryption without limitations to 30 * all. 31 * 32 * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR 33 * IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY 34 * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE 35 * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR 36 * PURPOSE. 37 */ 38 39/* 40 * IPsec input processing. 41 */ 42 43#include "opt_inet.h" 44#include "opt_inet6.h" 45#include "opt_ipsec.h" 46#include "opt_enc.h" 47 48#include <sys/param.h> 49#include <sys/systm.h> 50#include <sys/malloc.h> 51#include <sys/mbuf.h> 52#include <sys/domain.h> 53#include <sys/protosw.h> 54#include <sys/socket.h> 55#include <sys/errno.h> 56#include <sys/syslog.h> 57 58#include <net/if.h> 59#include <net/if_var.h> 60#include <net/pfil.h> 61#include <net/route.h> 62#include <net/netisr.h> 63#include <net/vnet.h> 64 65#include <netinet/in.h> 66#include <netinet/in_systm.h> 67#include <netinet/ip.h> 68#include <netinet/ip_var.h> 69#include <netinet/in_var.h> 70 71#include <netinet/ip6.h> 72#ifdef INET6 73#include <netinet6/ip6_var.h> 74#endif 75#include <netinet/in_pcb.h> 76#ifdef INET6 77#include <netinet/icmp6.h> 78#endif 79 80#include <netipsec/ipsec.h> 81#ifdef INET6 82#include <netipsec/ipsec6.h> 83#endif 84#include <netipsec/ah_var.h> 85#include <netipsec/esp.h> 86#include <netipsec/esp_var.h> 87#include <netipsec/ipcomp_var.h> 88 89#include <netipsec/key.h> 90#include <netipsec/keydb.h> 91 92#include <netipsec/xform.h> 93#include <netinet6/ip6protosw.h> 94 95#include <machine/in_cksum.h> 96#include <machine/stdarg.h> 97 98#ifdef DEV_ENC 99#include <net/if_enc.h> 100#endif 101 102 103#define IPSEC_ISTAT(proto, name) do { \ 104 if ((proto) == IPPROTO_ESP) \ 105 ESPSTAT_INC(esps_##name); \ 106 else if ((proto) == IPPROTO_AH) \ 107 AHSTAT_INC(ahs_##name); \ 108 else \ 109 IPCOMPSTAT_INC(ipcomps_##name); \ 110} while (0) 111 112#ifdef INET 113static void ipsec4_common_ctlinput(int, struct sockaddr *, void *, int); 114#endif 115 116/* 117 * ipsec_common_input gets called when an IPsec-protected packet 118 * is received by IPv4 or IPv6. Its job is to find the right SA 119 * and call the appropriate transform. The transform callback 120 * takes care of further processing (like ingress filtering). 121 */ 122static int 123ipsec_common_input(struct mbuf *m, int skip, int protoff, int af, int sproto) 124{ 125 union sockaddr_union dst_address; 126 struct secasvar *sav; 127 u_int32_t spi; 128 int error; 129#ifdef INET 130#ifdef IPSEC_NAT_T 131 struct m_tag *tag; 132#endif 133#endif 134 135 IPSEC_ISTAT(sproto, input); 136 137 IPSEC_ASSERT(m != NULL, ("null packet")); 138 139 IPSEC_ASSERT(sproto == IPPROTO_ESP || sproto == IPPROTO_AH || 140 sproto == IPPROTO_IPCOMP, 141 ("unexpected security protocol %u", sproto)); 142 143 if ((sproto == IPPROTO_ESP && !V_esp_enable) || 144 (sproto == IPPROTO_AH && !V_ah_enable) || 145 (sproto == IPPROTO_IPCOMP && !V_ipcomp_enable)) { 146 m_freem(m); 147 IPSEC_ISTAT(sproto, pdrops); 148 return EOPNOTSUPP; 149 } 150 151 if (m->m_pkthdr.len - skip < 2 * sizeof (u_int32_t)) { 152 m_freem(m); 153 IPSEC_ISTAT(sproto, hdrops); 154 DPRINTF(("%s: packet too small\n", __func__)); 155 return EINVAL; 156 } 157 158 /* Retrieve the SPI from the relevant IPsec header */ 159 if (sproto == IPPROTO_ESP) 160 m_copydata(m, skip, sizeof(u_int32_t), (caddr_t) &spi); 161 else if (sproto == IPPROTO_AH) 162 m_copydata(m, skip + sizeof(u_int32_t), sizeof(u_int32_t), 163 (caddr_t) &spi); 164 else if (sproto == IPPROTO_IPCOMP) { 165 u_int16_t cpi; 166 m_copydata(m, skip + sizeof(u_int16_t), sizeof(u_int16_t), 167 (caddr_t) &cpi); 168 spi = ntohl(htons(cpi)); 169 } 170 171 /* 172 * Find the SA and (indirectly) call the appropriate 173 * kernel crypto routine. The resulting mbuf chain is a valid 174 * IP packet ready to go through input processing. 175 */ 176 bzero(&dst_address, sizeof (dst_address)); 177 dst_address.sa.sa_family = af; 178 switch (af) { 179#ifdef INET 180 case AF_INET: 181 dst_address.sin.sin_len = sizeof(struct sockaddr_in); 182 m_copydata(m, offsetof(struct ip, ip_dst), 183 sizeof(struct in_addr), 184 (caddr_t) &dst_address.sin.sin_addr); 185#ifdef IPSEC_NAT_T 186 /* Find the source port for NAT-T; see udp*_espdecap. */ 187 tag = m_tag_find(m, PACKET_TAG_IPSEC_NAT_T_PORTS, NULL); 188 if (tag != NULL) 189 dst_address.sin.sin_port = ((u_int16_t *)(tag + 1))[1]; 190#endif /* IPSEC_NAT_T */ 191 break; 192#endif /* INET */ 193#ifdef INET6 194 case AF_INET6: 195 dst_address.sin6.sin6_len = sizeof(struct sockaddr_in6); 196 m_copydata(m, offsetof(struct ip6_hdr, ip6_dst), 197 sizeof(struct in6_addr), 198 (caddr_t) &dst_address.sin6.sin6_addr); 199 break; 200#endif /* INET6 */ 201 default: 202 DPRINTF(("%s: unsupported protocol family %u\n", __func__, af)); 203 m_freem(m); 204 IPSEC_ISTAT(sproto, nopf); 205 return EPFNOSUPPORT; 206 } 207 208 /* NB: only pass dst since key_allocsa follows RFC2401 */ 209 sav = KEY_ALLOCSA(&dst_address, sproto, spi); 210 if (sav == NULL) { 211 DPRINTF(("%s: no key association found for SA %s/%08lx/%u\n", 212 __func__, ipsec_address(&dst_address), 213 (u_long) ntohl(spi), sproto)); 214 IPSEC_ISTAT(sproto, notdb); 215 m_freem(m); 216 return ENOENT; 217 } 218 219 if (sav->tdb_xform == NULL) { 220 DPRINTF(("%s: attempted to use uninitialized SA %s/%08lx/%u\n", 221 __func__, ipsec_address(&dst_address), 222 (u_long) ntohl(spi), sproto)); 223 IPSEC_ISTAT(sproto, noxform); 224 KEY_FREESAV(&sav); 225 m_freem(m); 226 return ENXIO; 227 } 228 229 /* 230 * Call appropriate transform and return -- callback takes care of 231 * everything else. 232 */ 233 error = (*sav->tdb_xform->xf_input)(m, sav, skip, protoff); 234 KEY_FREESAV(&sav); 235 return error; 236} 237 238#ifdef INET 239/* 240 * Common input handler for IPv4 AH, ESP, and IPCOMP. 241 */ 242int 243ipsec4_common_input(struct mbuf *m, ...) 244{ 245 va_list ap; 246 int off, nxt; 247 248 va_start(ap, m); 249 off = va_arg(ap, int); 250 nxt = va_arg(ap, int); 251 va_end(ap); 252 253 return ipsec_common_input(m, off, offsetof(struct ip, ip_p), 254 AF_INET, nxt); 255} 256
| 2/* $OpenBSD: ipsec_input.c,v 1.63 2003/02/20 18:35:43 deraadt Exp $ */ 3/*- 4 * The authors of this code are John Ioannidis (ji@tla.org), 5 * Angelos D. Keromytis (kermit@csd.uch.gr) and 6 * Niels Provos (provos@physnet.uni-hamburg.de). 7 * 8 * This code was written by John Ioannidis for BSD/OS in Athens, Greece, 9 * in November 1995. 10 * 11 * Ported to OpenBSD and NetBSD, with additional transforms, in December 1996, 12 * by Angelos D. Keromytis. 13 * 14 * Additional transforms and features in 1997 and 1998 by Angelos D. Keromytis 15 * and Niels Provos. 16 * 17 * Additional features in 1999 by Angelos D. Keromytis. 18 * 19 * Copyright (C) 1995, 1996, 1997, 1998, 1999 by John Ioannidis, 20 * Angelos D. Keromytis and Niels Provos. 21 * Copyright (c) 2001, Angelos D. Keromytis. 22 * 23 * Permission to use, copy, and modify this software with or without fee 24 * is hereby granted, provided that this entire notice is included in 25 * all copies of any software which is or includes a copy or 26 * modification of this software. 27 * You may use this code under the GNU public license if you so wish. Please 28 * contribute changes back to the authors under this freer than GPL license 29 * so that we may further the use of strong encryption without limitations to 30 * all. 31 * 32 * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR 33 * IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY 34 * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE 35 * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR 36 * PURPOSE. 37 */ 38 39/* 40 * IPsec input processing. 41 */ 42 43#include "opt_inet.h" 44#include "opt_inet6.h" 45#include "opt_ipsec.h" 46#include "opt_enc.h" 47 48#include <sys/param.h> 49#include <sys/systm.h> 50#include <sys/malloc.h> 51#include <sys/mbuf.h> 52#include <sys/domain.h> 53#include <sys/protosw.h> 54#include <sys/socket.h> 55#include <sys/errno.h> 56#include <sys/syslog.h> 57 58#include <net/if.h> 59#include <net/if_var.h> 60#include <net/pfil.h> 61#include <net/route.h> 62#include <net/netisr.h> 63#include <net/vnet.h> 64 65#include <netinet/in.h> 66#include <netinet/in_systm.h> 67#include <netinet/ip.h> 68#include <netinet/ip_var.h> 69#include <netinet/in_var.h> 70 71#include <netinet/ip6.h> 72#ifdef INET6 73#include <netinet6/ip6_var.h> 74#endif 75#include <netinet/in_pcb.h> 76#ifdef INET6 77#include <netinet/icmp6.h> 78#endif 79 80#include <netipsec/ipsec.h> 81#ifdef INET6 82#include <netipsec/ipsec6.h> 83#endif 84#include <netipsec/ah_var.h> 85#include <netipsec/esp.h> 86#include <netipsec/esp_var.h> 87#include <netipsec/ipcomp_var.h> 88 89#include <netipsec/key.h> 90#include <netipsec/keydb.h> 91 92#include <netipsec/xform.h> 93#include <netinet6/ip6protosw.h> 94 95#include <machine/in_cksum.h> 96#include <machine/stdarg.h> 97 98#ifdef DEV_ENC 99#include <net/if_enc.h> 100#endif 101 102 103#define IPSEC_ISTAT(proto, name) do { \ 104 if ((proto) == IPPROTO_ESP) \ 105 ESPSTAT_INC(esps_##name); \ 106 else if ((proto) == IPPROTO_AH) \ 107 AHSTAT_INC(ahs_##name); \ 108 else \ 109 IPCOMPSTAT_INC(ipcomps_##name); \ 110} while (0) 111 112#ifdef INET 113static void ipsec4_common_ctlinput(int, struct sockaddr *, void *, int); 114#endif 115 116/* 117 * ipsec_common_input gets called when an IPsec-protected packet 118 * is received by IPv4 or IPv6. Its job is to find the right SA 119 * and call the appropriate transform. The transform callback 120 * takes care of further processing (like ingress filtering). 121 */ 122static int 123ipsec_common_input(struct mbuf *m, int skip, int protoff, int af, int sproto) 124{ 125 union sockaddr_union dst_address; 126 struct secasvar *sav; 127 u_int32_t spi; 128 int error; 129#ifdef INET 130#ifdef IPSEC_NAT_T 131 struct m_tag *tag; 132#endif 133#endif 134 135 IPSEC_ISTAT(sproto, input); 136 137 IPSEC_ASSERT(m != NULL, ("null packet")); 138 139 IPSEC_ASSERT(sproto == IPPROTO_ESP || sproto == IPPROTO_AH || 140 sproto == IPPROTO_IPCOMP, 141 ("unexpected security protocol %u", sproto)); 142 143 if ((sproto == IPPROTO_ESP && !V_esp_enable) || 144 (sproto == IPPROTO_AH && !V_ah_enable) || 145 (sproto == IPPROTO_IPCOMP && !V_ipcomp_enable)) { 146 m_freem(m); 147 IPSEC_ISTAT(sproto, pdrops); 148 return EOPNOTSUPP; 149 } 150 151 if (m->m_pkthdr.len - skip < 2 * sizeof (u_int32_t)) { 152 m_freem(m); 153 IPSEC_ISTAT(sproto, hdrops); 154 DPRINTF(("%s: packet too small\n", __func__)); 155 return EINVAL; 156 } 157 158 /* Retrieve the SPI from the relevant IPsec header */ 159 if (sproto == IPPROTO_ESP) 160 m_copydata(m, skip, sizeof(u_int32_t), (caddr_t) &spi); 161 else if (sproto == IPPROTO_AH) 162 m_copydata(m, skip + sizeof(u_int32_t), sizeof(u_int32_t), 163 (caddr_t) &spi); 164 else if (sproto == IPPROTO_IPCOMP) { 165 u_int16_t cpi; 166 m_copydata(m, skip + sizeof(u_int16_t), sizeof(u_int16_t), 167 (caddr_t) &cpi); 168 spi = ntohl(htons(cpi)); 169 } 170 171 /* 172 * Find the SA and (indirectly) call the appropriate 173 * kernel crypto routine. The resulting mbuf chain is a valid 174 * IP packet ready to go through input processing. 175 */ 176 bzero(&dst_address, sizeof (dst_address)); 177 dst_address.sa.sa_family = af; 178 switch (af) { 179#ifdef INET 180 case AF_INET: 181 dst_address.sin.sin_len = sizeof(struct sockaddr_in); 182 m_copydata(m, offsetof(struct ip, ip_dst), 183 sizeof(struct in_addr), 184 (caddr_t) &dst_address.sin.sin_addr); 185#ifdef IPSEC_NAT_T 186 /* Find the source port for NAT-T; see udp*_espdecap. */ 187 tag = m_tag_find(m, PACKET_TAG_IPSEC_NAT_T_PORTS, NULL); 188 if (tag != NULL) 189 dst_address.sin.sin_port = ((u_int16_t *)(tag + 1))[1]; 190#endif /* IPSEC_NAT_T */ 191 break; 192#endif /* INET */ 193#ifdef INET6 194 case AF_INET6: 195 dst_address.sin6.sin6_len = sizeof(struct sockaddr_in6); 196 m_copydata(m, offsetof(struct ip6_hdr, ip6_dst), 197 sizeof(struct in6_addr), 198 (caddr_t) &dst_address.sin6.sin6_addr); 199 break; 200#endif /* INET6 */ 201 default: 202 DPRINTF(("%s: unsupported protocol family %u\n", __func__, af)); 203 m_freem(m); 204 IPSEC_ISTAT(sproto, nopf); 205 return EPFNOSUPPORT; 206 } 207 208 /* NB: only pass dst since key_allocsa follows RFC2401 */ 209 sav = KEY_ALLOCSA(&dst_address, sproto, spi); 210 if (sav == NULL) { 211 DPRINTF(("%s: no key association found for SA %s/%08lx/%u\n", 212 __func__, ipsec_address(&dst_address), 213 (u_long) ntohl(spi), sproto)); 214 IPSEC_ISTAT(sproto, notdb); 215 m_freem(m); 216 return ENOENT; 217 } 218 219 if (sav->tdb_xform == NULL) { 220 DPRINTF(("%s: attempted to use uninitialized SA %s/%08lx/%u\n", 221 __func__, ipsec_address(&dst_address), 222 (u_long) ntohl(spi), sproto)); 223 IPSEC_ISTAT(sproto, noxform); 224 KEY_FREESAV(&sav); 225 m_freem(m); 226 return ENXIO; 227 } 228 229 /* 230 * Call appropriate transform and return -- callback takes care of 231 * everything else. 232 */ 233 error = (*sav->tdb_xform->xf_input)(m, sav, skip, protoff); 234 KEY_FREESAV(&sav); 235 return error; 236} 237 238#ifdef INET 239/* 240 * Common input handler for IPv4 AH, ESP, and IPCOMP. 241 */ 242int 243ipsec4_common_input(struct mbuf *m, ...) 244{ 245 va_list ap; 246 int off, nxt; 247 248 va_start(ap, m); 249 off = va_arg(ap, int); 250 nxt = va_arg(ap, int); 251 va_end(ap); 252 253 return ipsec_common_input(m, off, offsetof(struct ip, ip_p), 254 AF_INET, nxt); 255} 256
|
287} 288 289/* 290 * IPsec input callback for INET protocols. 291 * This routine is called as the transform callback. 292 * Takes care of filtering and other sanity checks on 293 * the processed packet. 294 */ 295int 296ipsec4_common_input_cb(struct mbuf *m, struct secasvar *sav, 297 int skip, int protoff, struct m_tag *mt) 298{ 299 int prot, af, sproto, isr_prot; 300 struct ip *ip; 301 struct m_tag *mtag; 302 struct tdb_ident *tdbi; 303 struct secasindex *saidx; 304 int error; 305#ifdef INET6 306#ifdef notyet 307 char ip6buf[INET6_ADDRSTRLEN]; 308#endif 309#endif 310 311 IPSEC_ASSERT(m != NULL, ("null mbuf")); 312 IPSEC_ASSERT(sav != NULL, ("null SA")); 313 IPSEC_ASSERT(sav->sah != NULL, ("null SAH")); 314 saidx = &sav->sah->saidx; 315 af = saidx->dst.sa.sa_family; 316 IPSEC_ASSERT(af == AF_INET, ("unexpected af %u", af)); 317 sproto = saidx->proto; 318 IPSEC_ASSERT(sproto == IPPROTO_ESP || sproto == IPPROTO_AH || 319 sproto == IPPROTO_IPCOMP, 320 ("unexpected security protocol %u", sproto)); 321 322 /* Sanity check */ 323 if (m == NULL) { 324 DPRINTF(("%s: null mbuf", __func__)); 325 IPSEC_ISTAT(sproto, badkcr); 326 KEY_FREESAV(&sav); 327 return EINVAL; 328 } 329 330 if (skip != 0) { 331 /* 332 * Fix IPv4 header 333 * XXXGL: do we need this entire block? 334 */ 335 if (m->m_len < skip && (m = m_pullup(m, skip)) == NULL) { 336 DPRINTF(("%s: processing failed for SA %s/%08lx\n", 337 __func__, ipsec_address(&sav->sah->saidx.dst), 338 (u_long) ntohl(sav->spi))); 339 IPSEC_ISTAT(sproto, hdrops); 340 error = ENOBUFS; 341 goto bad; 342 } 343 344 ip = mtod(m, struct ip *); 345 ip->ip_len = htons(m->m_pkthdr.len); 346 ip->ip_sum = 0; 347 ip->ip_sum = in_cksum(m, ip->ip_hl << 2); 348 } else { 349 ip = mtod(m, struct ip *); 350 } 351 prot = ip->ip_p; 352 353#ifdef DEV_ENC 354 encif->if_ipackets++; 355 encif->if_ibytes += m->m_pkthdr.len; 356 357 /* 358 * Pass the mbuf to enc0 for bpf and pfil. We will filter the IPIP 359 * packet later after it has been decapsulated. 360 */ 361 ipsec_bpf(m, sav, AF_INET, ENC_IN|ENC_BEFORE); 362 363 if (prot != IPPROTO_IPIP) 364 if ((error = ipsec_filter(&m, PFIL_IN, ENC_IN|ENC_BEFORE)) != 0) 365 return (error); 366#endif /* DEV_ENC */ 367 368 /* IP-in-IP encapsulation */ 369 if (prot == IPPROTO_IPIP) { 370 371 if (m->m_pkthdr.len - skip < sizeof(struct ip)) { 372 IPSEC_ISTAT(sproto, hdrops); 373 error = EINVAL; 374 goto bad; 375 } 376 /* enc0: strip outer IPv4 header */ 377 m_striphdr(m, 0, ip->ip_hl << 2); 378 379#ifdef notyet 380 /* XXX PROXY address isn't recorded in SAH */ 381 /* 382 * Check that the inner source address is the same as 383 * the proxy address, if available. 384 */ 385 if ((saidx->proxy.sa.sa_family == AF_INET && 386 saidx->proxy.sin.sin_addr.s_addr != 387 INADDR_ANY && 388 ipn.ip_src.s_addr != 389 saidx->proxy.sin.sin_addr.s_addr) || 390 (saidx->proxy.sa.sa_family != AF_INET && 391 saidx->proxy.sa.sa_family != 0)) { 392 393 DPRINTF(("%s: inner source address %s doesn't " 394 "correspond to expected proxy source %s, " 395 "SA %s/%08lx\n", __func__, 396 inet_ntoa4(ipn.ip_src), 397 ipsp_address(saidx->proxy), 398 ipsp_address(saidx->dst), 399 (u_long) ntohl(sav->spi))); 400 401 IPSEC_ISTAT(sproto, pdrops); 402 error = EACCES; 403 goto bad; 404 } 405#endif /* notyet */ 406 } 407#ifdef INET6 408 /* IPv6-in-IP encapsulation. */ 409 if (prot == IPPROTO_IPV6) { 410 411 if (m->m_pkthdr.len - skip < sizeof(struct ip6_hdr)) { 412 IPSEC_ISTAT(sproto, hdrops); 413 error = EINVAL; 414 goto bad; 415 } 416 /* enc0: strip IPv4 header, keep IPv6 header only */ 417 m_striphdr(m, 0, ip->ip_hl << 2); 418#ifdef notyet 419 /* 420 * Check that the inner source address is the same as 421 * the proxy address, if available. 422 */ 423 if ((saidx->proxy.sa.sa_family == AF_INET6 && 424 !IN6_IS_ADDR_UNSPECIFIED(&saidx->proxy.sin6.sin6_addr) && 425 !IN6_ARE_ADDR_EQUAL(&ip6n.ip6_src, 426 &saidx->proxy.sin6.sin6_addr)) || 427 (saidx->proxy.sa.sa_family != AF_INET6 && 428 saidx->proxy.sa.sa_family != 0)) { 429 430 DPRINTF(("%s: inner source address %s doesn't " 431 "correspond to expected proxy source %s, " 432 "SA %s/%08lx\n", __func__, 433 ip6_sprintf(ip6buf, &ip6n.ip6_src), 434 ipsec_address(&saidx->proxy), 435 ipsec_address(&saidx->dst), 436 (u_long) ntohl(sav->spi))); 437 438 IPSEC_ISTAT(sproto, pdrops); 439 error = EACCES; 440 goto bad; 441 } 442#endif /* notyet */ 443 } 444#endif /* INET6 */ 445 446 /* 447 * Record what we've done to the packet (under what SA it was 448 * processed). If we've been passed an mtag, it means the packet 449 * was already processed by an ethernet/crypto combo card and 450 * thus has a tag attached with all the right information, but 451 * with a PACKET_TAG_IPSEC_IN_CRYPTO_DONE as opposed to 452 * PACKET_TAG_IPSEC_IN_DONE type; in that case, just change the type. 453 */ 454 if (mt == NULL && sproto != IPPROTO_IPCOMP) { 455 mtag = m_tag_get(PACKET_TAG_IPSEC_IN_DONE, 456 sizeof(struct tdb_ident), M_NOWAIT); 457 if (mtag == NULL) { 458 DPRINTF(("%s: failed to get tag\n", __func__)); 459 IPSEC_ISTAT(sproto, hdrops); 460 error = ENOMEM; 461 goto bad; 462 } 463 464 tdbi = (struct tdb_ident *)(mtag + 1); 465 bcopy(&saidx->dst, &tdbi->dst, saidx->dst.sa.sa_len); 466 tdbi->proto = sproto; 467 tdbi->spi = sav->spi; 468 /* Cache those two for enc(4) in xform_ipip. */ 469 tdbi->alg_auth = sav->alg_auth; 470 tdbi->alg_enc = sav->alg_enc; 471 472 m_tag_prepend(m, mtag); 473 } else if (mt != NULL) { 474 mt->m_tag_id = PACKET_TAG_IPSEC_IN_DONE; 475 /* XXX do we need to mark m_flags??? */ 476 } 477 478 key_sa_recordxfer(sav, m); /* record data transfer */ 479 480#ifdef DEV_ENC 481 /* 482 * Pass the mbuf to enc0 for bpf and pfil. 483 */ 484 if (prot == IPPROTO_IPIP) 485 ipsec_bpf(m, sav, AF_INET, ENC_IN|ENC_AFTER); 486#ifdef INET6 487 if (prot == IPPROTO_IPV6) 488 ipsec_bpf(m, sav, AF_INET6, ENC_IN|ENC_AFTER); 489#endif 490 491 if ((error = ipsec_filter(&m, PFIL_IN, ENC_IN|ENC_AFTER)) != 0) 492 return (error); 493#endif /* DEV_ENC */ 494 495 /* 496 * Re-dispatch via software interrupt. 497 */ 498 499 switch (prot) { 500 case IPPROTO_IPIP: 501 isr_prot = NETISR_IP; 502 break; 503#ifdef INET6 504 case IPPROTO_IPV6: 505 isr_prot = NETISR_IPV6; 506 break; 507#endif 508 default: 509 DPRINTF(("%s: cannot handle inner ip proto %d\n", 510 __func__, prot)); 511 IPSEC_ISTAT(sproto, nopf); 512 error = EPFNOSUPPORT; 513 goto bad; 514 } 515 516 error = netisr_queue_src(isr_prot, (uintptr_t)sav->spi, m); 517 if (error) { 518 IPSEC_ISTAT(sproto, qfull); 519 DPRINTF(("%s: queue full; proto %u packet dropped\n", 520 __func__, sproto)); 521 return error; 522 } 523 return 0; 524bad: 525 m_freem(m); 526 return error; 527} 528 529void 530ipsec4_common_ctlinput(int cmd, struct sockaddr *sa, void *v, int proto) 531{ 532 /* XXX nothing just yet */ 533} 534#endif /* INET */ 535 536#ifdef INET6 537/* IPv6 AH wrapper. */ 538int 539ipsec6_common_input(struct mbuf **mp, int *offp, int proto) 540{ 541 int l = 0; 542 int protoff; 543 struct ip6_ext ip6e; 544 545 if (*offp < sizeof(struct ip6_hdr)) { 546 DPRINTF(("%s: bad offset %u\n", __func__, *offp)); 547 return IPPROTO_DONE; 548 } else if (*offp == sizeof(struct ip6_hdr)) { 549 protoff = offsetof(struct ip6_hdr, ip6_nxt); 550 } else { 551 /* Chase down the header chain... */ 552 protoff = sizeof(struct ip6_hdr); 553 554 do { 555 protoff += l; 556 m_copydata(*mp, protoff, sizeof(ip6e), 557 (caddr_t) &ip6e); 558 559 if (ip6e.ip6e_nxt == IPPROTO_AH) 560 l = (ip6e.ip6e_len + 2) << 2; 561 else 562 l = (ip6e.ip6e_len + 1) << 3; 563 IPSEC_ASSERT(l > 0, ("l went zero or negative")); 564 } while (protoff + l < *offp); 565 566 /* Malformed packet check */ 567 if (protoff + l != *offp) { 568 DPRINTF(("%s: bad packet header chain, protoff %u, " 569 "l %u, off %u\n", __func__, protoff, l, *offp)); 570 IPSEC_ISTAT(proto, hdrops); 571 m_freem(*mp); 572 *mp = NULL; 573 return IPPROTO_DONE; 574 } 575 protoff += offsetof(struct ip6_ext, ip6e_nxt); 576 } 577 (void) ipsec_common_input(*mp, *offp, protoff, AF_INET6, proto); 578 return IPPROTO_DONE; 579} 580 581/* 582 * IPsec input callback, called by the transform callback. Takes care of 583 * filtering and other sanity checks on the processed packet. 584 */ 585int 586ipsec6_common_input_cb(struct mbuf *m, struct secasvar *sav, int skip, int protoff, 587 struct m_tag *mt) 588{ 589 int prot, af, sproto; 590 struct ip6_hdr *ip6; 591 struct m_tag *mtag; 592 struct tdb_ident *tdbi; 593 struct secasindex *saidx; 594 int nxt; 595 u_int8_t nxt8; 596 int error, nest; 597#ifdef notyet 598 char ip6buf[INET6_ADDRSTRLEN]; 599#endif 600 601 IPSEC_ASSERT(m != NULL, ("null mbuf")); 602 IPSEC_ASSERT(sav != NULL, ("null SA")); 603 IPSEC_ASSERT(sav->sah != NULL, ("null SAH")); 604 saidx = &sav->sah->saidx; 605 af = saidx->dst.sa.sa_family; 606 IPSEC_ASSERT(af == AF_INET6, ("unexpected af %u", af)); 607 sproto = saidx->proto; 608 IPSEC_ASSERT(sproto == IPPROTO_ESP || sproto == IPPROTO_AH || 609 sproto == IPPROTO_IPCOMP, 610 ("unexpected security protocol %u", sproto)); 611 612 /* Sanity check */ 613 if (m == NULL) { 614 DPRINTF(("%s: null mbuf", __func__)); 615 IPSEC_ISTAT(sproto, badkcr); 616 error = EINVAL; 617 goto bad; 618 } 619 620 /* Fix IPv6 header */ 621 if (m->m_len < sizeof(struct ip6_hdr) && 622 (m = m_pullup(m, sizeof(struct ip6_hdr))) == NULL) { 623 624 DPRINTF(("%s: processing failed for SA %s/%08lx\n", 625 __func__, ipsec_address(&sav->sah->saidx.dst), 626 (u_long) ntohl(sav->spi))); 627 628 IPSEC_ISTAT(sproto, hdrops); 629 error = EACCES; 630 goto bad; 631 } 632 633 ip6 = mtod(m, struct ip6_hdr *); 634 ip6->ip6_plen = htons(m->m_pkthdr.len - sizeof(struct ip6_hdr)); 635 636 /* Save protocol */ 637 prot = 0; 638 m_copydata(m, protoff, 1, (unsigned char *) &prot); 639 640#ifdef DEV_ENC 641 encif->if_ipackets++; 642 encif->if_ibytes += m->m_pkthdr.len; 643 644 /* 645 * Pass the mbuf to enc0 for bpf and pfil. We will filter the IPIP 646 * packet later after it has been decapsulated. 647 */ 648 ipsec_bpf(m, sav, AF_INET6, ENC_IN|ENC_BEFORE); 649 650 /* XXX-BZ does not make sense. */ 651 if (prot != IPPROTO_IPIP) 652 if ((error = ipsec_filter(&m, PFIL_IN, ENC_IN|ENC_BEFORE)) != 0) 653 return (error); 654#endif /* DEV_ENC */ 655 656#ifdef INET 657 /* IP-in-IP encapsulation */ 658 if (prot == IPPROTO_IPIP) { 659 if (m->m_pkthdr.len - skip < sizeof(struct ip)) { 660 IPSEC_ISTAT(sproto, hdrops); 661 error = EINVAL; 662 goto bad; 663 } 664 /* ipn will now contain the inner IPv4 header */ 665 m_striphdr(m, 0, skip); 666 skip = 0; 667#ifdef notyet 668 /* 669 * Check that the inner source address is the same as 670 * the proxy address, if available. 671 */ 672 if ((saidx->proxy.sa.sa_family == AF_INET && 673 saidx->proxy.sin.sin_addr.s_addr != INADDR_ANY && 674 ipn.ip_src.s_addr != saidx->proxy.sin.sin_addr.s_addr) || 675 (saidx->proxy.sa.sa_family != AF_INET && 676 saidx->proxy.sa.sa_family != 0)) { 677 678 DPRINTF(("%s: inner source address %s doesn't " 679 "correspond to expected proxy source %s, " 680 "SA %s/%08lx\n", __func__, 681 inet_ntoa4(ipn.ip_src), 682 ipsec_address(&saidx->proxy), 683 ipsec_address(&saidx->dst), 684 (u_long) ntohl(sav->spi))); 685 686 IPSEC_ISTAT(sproto, pdrops); 687 error = EACCES; 688 goto bad; 689 } 690#endif /* notyet */ 691 } 692#endif /* INET */ 693 /* IPv6-in-IP encapsulation */ 694 if (prot == IPPROTO_IPV6) { 695 if (m->m_pkthdr.len - skip < sizeof(struct ip6_hdr)) { 696 IPSEC_ISTAT(sproto, hdrops); 697 error = EINVAL; 698 goto bad; 699 } 700 /* ip6n will now contain the inner IPv6 header. */ 701 m_striphdr(m, 0, skip); 702 skip = 0; 703#ifdef notyet 704 /* 705 * Check that the inner source address is the same as 706 * the proxy address, if available. 707 */ 708 if ((saidx->proxy.sa.sa_family == AF_INET6 && 709 !IN6_IS_ADDR_UNSPECIFIED(&saidx->proxy.sin6.sin6_addr) && 710 !IN6_ARE_ADDR_EQUAL(&ip6n.ip6_src, 711 &saidx->proxy.sin6.sin6_addr)) || 712 (saidx->proxy.sa.sa_family != AF_INET6 && 713 saidx->proxy.sa.sa_family != 0)) { 714 715 DPRINTF(("%s: inner source address %s doesn't " 716 "correspond to expected proxy source %s, " 717 "SA %s/%08lx\n", __func__, 718 ip6_sprintf(ip6buf, &ip6n.ip6_src), 719 ipsec_address(&saidx->proxy), 720 ipsec_address(&saidx->dst), 721 (u_long) ntohl(sav->spi))); 722 723 IPSEC_ISTAT(sproto, pdrops); 724 error = EACCES; 725 goto bad; 726 } 727#endif /* notyet */ 728 } 729 730 /* 731 * Record what we've done to the packet (under what SA it was 732 * processed). If we've been passed an mtag, it means the packet 733 * was already processed by an ethernet/crypto combo card and 734 * thus has a tag attached with all the right information, but 735 * with a PACKET_TAG_IPSEC_IN_CRYPTO_DONE as opposed to 736 * PACKET_TAG_IPSEC_IN_DONE type; in that case, just change the type. 737 */ 738 if (mt == NULL && sproto != IPPROTO_IPCOMP) { 739 mtag = m_tag_get(PACKET_TAG_IPSEC_IN_DONE, 740 sizeof(struct tdb_ident), M_NOWAIT); 741 if (mtag == NULL) { 742 DPRINTF(("%s: failed to get tag\n", __func__)); 743 IPSEC_ISTAT(sproto, hdrops); 744 error = ENOMEM; 745 goto bad; 746 } 747 748 tdbi = (struct tdb_ident *)(mtag + 1); 749 bcopy(&saidx->dst, &tdbi->dst, sizeof(union sockaddr_union)); 750 tdbi->proto = sproto; 751 tdbi->spi = sav->spi; 752 /* Cache those two for enc(4) in xform_ipip. */ 753 tdbi->alg_auth = sav->alg_auth; 754 tdbi->alg_enc = sav->alg_enc; 755 756 m_tag_prepend(m, mtag); 757 } else { 758 if (mt != NULL) 759 mt->m_tag_id = PACKET_TAG_IPSEC_IN_DONE; 760 /* XXX do we need to mark m_flags??? */ 761 } 762 763 key_sa_recordxfer(sav, m); 764 765#ifdef DEV_ENC 766 /* 767 * Pass the mbuf to enc0 for bpf and pfil. 768 */ 769#ifdef INET 770 if (prot == IPPROTO_IPIP) 771 ipsec_bpf(m, sav, AF_INET, ENC_IN|ENC_AFTER); 772#endif 773 if (prot == IPPROTO_IPV6) 774 ipsec_bpf(m, sav, AF_INET6, ENC_IN|ENC_AFTER); 775 776 if ((error = ipsec_filter(&m, PFIL_IN, ENC_IN|ENC_AFTER)) != 0) 777 return (error); 778#endif /* DEV_ENC */ 779 /* Retrieve new protocol */ 780 /* We have stripped the IP6 header from the mbuf, we have to use the backuped proto value instead */ 781 nxt8 = prot; 782 783 /* 784 * See the end of ip6_input for this logic. 785 * IPPROTO_IPV[46] case will be processed just like other ones 786 */ 787 nest = 0; 788 nxt = nxt8; 789 while (nxt != IPPROTO_DONE) { 790 if (V_ip6_hdrnestlimit && (++nest > V_ip6_hdrnestlimit)) { 791 IP6STAT_INC(ip6s_toomanyhdr); 792 error = EINVAL; 793 goto bad; 794 } 795 796 /* 797 * Protection against faulty packet - there should be 798 * more sanity checks in header chain processing. 799 */ 800 if (m->m_pkthdr.len < skip) { 801 IP6STAT_INC(ip6s_tooshort); 802 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_truncated); 803 error = EINVAL; 804 goto bad; 805 } 806 /* 807 * Enforce IPsec policy checking if we are seeing last header. 808 * note that we do not visit this with protocols with pcb layer 809 * code - like udp/tcp/raw ip. 810 */ 811 if ((inet6sw[ip6_protox[nxt]].pr_flags & PR_LASTHDR) != 0 && 812 ipsec6_in_reject(m, NULL)) { 813 error = EINVAL; 814 goto bad; 815 } 816 nxt = (*inet6sw[ip6_protox[nxt]].pr_input)(&m, &skip, nxt); 817 } 818 return 0; 819bad: 820 if (m) 821 m_freem(m); 822 return error; 823} 824 825void 826esp6_ctlinput(int cmd, struct sockaddr *sa, void *d) 827{ 828 struct ip6ctlparam *ip6cp = NULL; 829 struct mbuf *m = NULL; 830 struct ip6_hdr *ip6; 831 int off; 832 833 if (sa->sa_family != AF_INET6 || 834 sa->sa_len != sizeof(struct sockaddr_in6)) 835 return; 836 if ((unsigned)cmd >= PRC_NCMDS) 837 return; 838 839 /* if the parameter is from icmp6, decode it. */ 840 if (d != NULL) { 841 ip6cp = (struct ip6ctlparam *)d; 842 m = ip6cp->ip6c_m; 843 ip6 = ip6cp->ip6c_ip6; 844 off = ip6cp->ip6c_off; 845 } else { 846 m = NULL; 847 ip6 = NULL; 848 off = 0; /* calm gcc */ 849 } 850 851 if (ip6 != NULL) { 852 853 struct ip6ctlparam ip6cp1; 854 855 /* 856 * Notify the error to all possible sockets via pfctlinput2. 857 * Since the upper layer information (such as protocol type, 858 * source and destination ports) is embedded in the encrypted 859 * data and might have been cut, we can't directly call 860 * an upper layer ctlinput function. However, the pcbnotify 861 * function will consider source and destination addresses 862 * as well as the flow info value, and may be able to find 863 * some PCB that should be notified. 864 * Although pfctlinput2 will call esp6_ctlinput(), there is 865 * no possibility of an infinite loop of function calls, 866 * because we don't pass the inner IPv6 header. 867 */ 868 bzero(&ip6cp1, sizeof(ip6cp1)); 869 ip6cp1.ip6c_src = ip6cp->ip6c_src; 870 pfctlinput2(cmd, sa, (void *)&ip6cp1); 871 872 /* 873 * Then go to special cases that need ESP header information. 874 * XXX: We assume that when ip6 is non NULL, 875 * M and OFF are valid. 876 */ 877 878 if (cmd == PRC_MSGSIZE) { 879 struct secasvar *sav; 880 u_int32_t spi; 881 int valid; 882 883 /* check header length before using m_copydata */ 884 if (m->m_pkthdr.len < off + sizeof (struct esp)) 885 return; 886 m_copydata(m, off + offsetof(struct esp, esp_spi), 887 sizeof(u_int32_t), (caddr_t) &spi); 888 /* 889 * Check to see if we have a valid SA corresponding to 890 * the address in the ICMP message payload. 891 */ 892 sav = KEY_ALLOCSA((union sockaddr_union *)sa, 893 IPPROTO_ESP, spi); 894 valid = (sav != NULL); 895 if (sav) 896 KEY_FREESAV(&sav); 897 898 /* XXX Further validation? */ 899 900 /* 901 * Depending on whether the SA is "valid" and 902 * routing table size (mtudisc_{hi,lo}wat), we will: 903 * - recalcurate the new MTU and create the 904 * corresponding routing entry, or 905 * - ignore the MTU change notification. 906 */ 907 icmp6_mtudisc_update(ip6cp, valid); 908 } 909 } else { 910 /* we normally notify any pcb here */ 911 } 912} 913#endif /* INET6 */
| 312} 313 314/* 315 * IPsec input callback for INET protocols. 316 * This routine is called as the transform callback. 317 * Takes care of filtering and other sanity checks on 318 * the processed packet. 319 */ 320int 321ipsec4_common_input_cb(struct mbuf *m, struct secasvar *sav, 322 int skip, int protoff, struct m_tag *mt) 323{ 324 int prot, af, sproto, isr_prot; 325 struct ip *ip; 326 struct m_tag *mtag; 327 struct tdb_ident *tdbi; 328 struct secasindex *saidx; 329 int error; 330#ifdef INET6 331#ifdef notyet 332 char ip6buf[INET6_ADDRSTRLEN]; 333#endif 334#endif 335 336 IPSEC_ASSERT(m != NULL, ("null mbuf")); 337 IPSEC_ASSERT(sav != NULL, ("null SA")); 338 IPSEC_ASSERT(sav->sah != NULL, ("null SAH")); 339 saidx = &sav->sah->saidx; 340 af = saidx->dst.sa.sa_family; 341 IPSEC_ASSERT(af == AF_INET, ("unexpected af %u", af)); 342 sproto = saidx->proto; 343 IPSEC_ASSERT(sproto == IPPROTO_ESP || sproto == IPPROTO_AH || 344 sproto == IPPROTO_IPCOMP, 345 ("unexpected security protocol %u", sproto)); 346 347 /* Sanity check */ 348 if (m == NULL) { 349 DPRINTF(("%s: null mbuf", __func__)); 350 IPSEC_ISTAT(sproto, badkcr); 351 KEY_FREESAV(&sav); 352 return EINVAL; 353 } 354 355 if (skip != 0) { 356 /* 357 * Fix IPv4 header 358 * XXXGL: do we need this entire block? 359 */ 360 if (m->m_len < skip && (m = m_pullup(m, skip)) == NULL) { 361 DPRINTF(("%s: processing failed for SA %s/%08lx\n", 362 __func__, ipsec_address(&sav->sah->saidx.dst), 363 (u_long) ntohl(sav->spi))); 364 IPSEC_ISTAT(sproto, hdrops); 365 error = ENOBUFS; 366 goto bad; 367 } 368 369 ip = mtod(m, struct ip *); 370 ip->ip_len = htons(m->m_pkthdr.len); 371 ip->ip_sum = 0; 372 ip->ip_sum = in_cksum(m, ip->ip_hl << 2); 373 } else { 374 ip = mtod(m, struct ip *); 375 } 376 prot = ip->ip_p; 377 378#ifdef DEV_ENC 379 encif->if_ipackets++; 380 encif->if_ibytes += m->m_pkthdr.len; 381 382 /* 383 * Pass the mbuf to enc0 for bpf and pfil. We will filter the IPIP 384 * packet later after it has been decapsulated. 385 */ 386 ipsec_bpf(m, sav, AF_INET, ENC_IN|ENC_BEFORE); 387 388 if (prot != IPPROTO_IPIP) 389 if ((error = ipsec_filter(&m, PFIL_IN, ENC_IN|ENC_BEFORE)) != 0) 390 return (error); 391#endif /* DEV_ENC */ 392 393 /* IP-in-IP encapsulation */ 394 if (prot == IPPROTO_IPIP) { 395 396 if (m->m_pkthdr.len - skip < sizeof(struct ip)) { 397 IPSEC_ISTAT(sproto, hdrops); 398 error = EINVAL; 399 goto bad; 400 } 401 /* enc0: strip outer IPv4 header */ 402 m_striphdr(m, 0, ip->ip_hl << 2); 403 404#ifdef notyet 405 /* XXX PROXY address isn't recorded in SAH */ 406 /* 407 * Check that the inner source address is the same as 408 * the proxy address, if available. 409 */ 410 if ((saidx->proxy.sa.sa_family == AF_INET && 411 saidx->proxy.sin.sin_addr.s_addr != 412 INADDR_ANY && 413 ipn.ip_src.s_addr != 414 saidx->proxy.sin.sin_addr.s_addr) || 415 (saidx->proxy.sa.sa_family != AF_INET && 416 saidx->proxy.sa.sa_family != 0)) { 417 418 DPRINTF(("%s: inner source address %s doesn't " 419 "correspond to expected proxy source %s, " 420 "SA %s/%08lx\n", __func__, 421 inet_ntoa4(ipn.ip_src), 422 ipsp_address(saidx->proxy), 423 ipsp_address(saidx->dst), 424 (u_long) ntohl(sav->spi))); 425 426 IPSEC_ISTAT(sproto, pdrops); 427 error = EACCES; 428 goto bad; 429 } 430#endif /* notyet */ 431 } 432#ifdef INET6 433 /* IPv6-in-IP encapsulation. */ 434 if (prot == IPPROTO_IPV6) { 435 436 if (m->m_pkthdr.len - skip < sizeof(struct ip6_hdr)) { 437 IPSEC_ISTAT(sproto, hdrops); 438 error = EINVAL; 439 goto bad; 440 } 441 /* enc0: strip IPv4 header, keep IPv6 header only */ 442 m_striphdr(m, 0, ip->ip_hl << 2); 443#ifdef notyet 444 /* 445 * Check that the inner source address is the same as 446 * the proxy address, if available. 447 */ 448 if ((saidx->proxy.sa.sa_family == AF_INET6 && 449 !IN6_IS_ADDR_UNSPECIFIED(&saidx->proxy.sin6.sin6_addr) && 450 !IN6_ARE_ADDR_EQUAL(&ip6n.ip6_src, 451 &saidx->proxy.sin6.sin6_addr)) || 452 (saidx->proxy.sa.sa_family != AF_INET6 && 453 saidx->proxy.sa.sa_family != 0)) { 454 455 DPRINTF(("%s: inner source address %s doesn't " 456 "correspond to expected proxy source %s, " 457 "SA %s/%08lx\n", __func__, 458 ip6_sprintf(ip6buf, &ip6n.ip6_src), 459 ipsec_address(&saidx->proxy), 460 ipsec_address(&saidx->dst), 461 (u_long) ntohl(sav->spi))); 462 463 IPSEC_ISTAT(sproto, pdrops); 464 error = EACCES; 465 goto bad; 466 } 467#endif /* notyet */ 468 } 469#endif /* INET6 */ 470 471 /* 472 * Record what we've done to the packet (under what SA it was 473 * processed). If we've been passed an mtag, it means the packet 474 * was already processed by an ethernet/crypto combo card and 475 * thus has a tag attached with all the right information, but 476 * with a PACKET_TAG_IPSEC_IN_CRYPTO_DONE as opposed to 477 * PACKET_TAG_IPSEC_IN_DONE type; in that case, just change the type. 478 */ 479 if (mt == NULL && sproto != IPPROTO_IPCOMP) { 480 mtag = m_tag_get(PACKET_TAG_IPSEC_IN_DONE, 481 sizeof(struct tdb_ident), M_NOWAIT); 482 if (mtag == NULL) { 483 DPRINTF(("%s: failed to get tag\n", __func__)); 484 IPSEC_ISTAT(sproto, hdrops); 485 error = ENOMEM; 486 goto bad; 487 } 488 489 tdbi = (struct tdb_ident *)(mtag + 1); 490 bcopy(&saidx->dst, &tdbi->dst, saidx->dst.sa.sa_len); 491 tdbi->proto = sproto; 492 tdbi->spi = sav->spi; 493 /* Cache those two for enc(4) in xform_ipip. */ 494 tdbi->alg_auth = sav->alg_auth; 495 tdbi->alg_enc = sav->alg_enc; 496 497 m_tag_prepend(m, mtag); 498 } else if (mt != NULL) { 499 mt->m_tag_id = PACKET_TAG_IPSEC_IN_DONE; 500 /* XXX do we need to mark m_flags??? */ 501 } 502 503 key_sa_recordxfer(sav, m); /* record data transfer */ 504 505#ifdef DEV_ENC 506 /* 507 * Pass the mbuf to enc0 for bpf and pfil. 508 */ 509 if (prot == IPPROTO_IPIP) 510 ipsec_bpf(m, sav, AF_INET, ENC_IN|ENC_AFTER); 511#ifdef INET6 512 if (prot == IPPROTO_IPV6) 513 ipsec_bpf(m, sav, AF_INET6, ENC_IN|ENC_AFTER); 514#endif 515 516 if ((error = ipsec_filter(&m, PFIL_IN, ENC_IN|ENC_AFTER)) != 0) 517 return (error); 518#endif /* DEV_ENC */ 519 520 /* 521 * Re-dispatch via software interrupt. 522 */ 523 524 switch (prot) { 525 case IPPROTO_IPIP: 526 isr_prot = NETISR_IP; 527 break; 528#ifdef INET6 529 case IPPROTO_IPV6: 530 isr_prot = NETISR_IPV6; 531 break; 532#endif 533 default: 534 DPRINTF(("%s: cannot handle inner ip proto %d\n", 535 __func__, prot)); 536 IPSEC_ISTAT(sproto, nopf); 537 error = EPFNOSUPPORT; 538 goto bad; 539 } 540 541 error = netisr_queue_src(isr_prot, (uintptr_t)sav->spi, m); 542 if (error) { 543 IPSEC_ISTAT(sproto, qfull); 544 DPRINTF(("%s: queue full; proto %u packet dropped\n", 545 __func__, sproto)); 546 return error; 547 } 548 return 0; 549bad: 550 m_freem(m); 551 return error; 552} 553 554void 555ipsec4_common_ctlinput(int cmd, struct sockaddr *sa, void *v, int proto) 556{ 557 /* XXX nothing just yet */ 558} 559#endif /* INET */ 560 561#ifdef INET6 562/* IPv6 AH wrapper. */ 563int 564ipsec6_common_input(struct mbuf **mp, int *offp, int proto) 565{ 566 int l = 0; 567 int protoff; 568 struct ip6_ext ip6e; 569 570 if (*offp < sizeof(struct ip6_hdr)) { 571 DPRINTF(("%s: bad offset %u\n", __func__, *offp)); 572 return IPPROTO_DONE; 573 } else if (*offp == sizeof(struct ip6_hdr)) { 574 protoff = offsetof(struct ip6_hdr, ip6_nxt); 575 } else { 576 /* Chase down the header chain... */ 577 protoff = sizeof(struct ip6_hdr); 578 579 do { 580 protoff += l; 581 m_copydata(*mp, protoff, sizeof(ip6e), 582 (caddr_t) &ip6e); 583 584 if (ip6e.ip6e_nxt == IPPROTO_AH) 585 l = (ip6e.ip6e_len + 2) << 2; 586 else 587 l = (ip6e.ip6e_len + 1) << 3; 588 IPSEC_ASSERT(l > 0, ("l went zero or negative")); 589 } while (protoff + l < *offp); 590 591 /* Malformed packet check */ 592 if (protoff + l != *offp) { 593 DPRINTF(("%s: bad packet header chain, protoff %u, " 594 "l %u, off %u\n", __func__, protoff, l, *offp)); 595 IPSEC_ISTAT(proto, hdrops); 596 m_freem(*mp); 597 *mp = NULL; 598 return IPPROTO_DONE; 599 } 600 protoff += offsetof(struct ip6_ext, ip6e_nxt); 601 } 602 (void) ipsec_common_input(*mp, *offp, protoff, AF_INET6, proto); 603 return IPPROTO_DONE; 604} 605 606/* 607 * IPsec input callback, called by the transform callback. Takes care of 608 * filtering and other sanity checks on the processed packet. 609 */ 610int 611ipsec6_common_input_cb(struct mbuf *m, struct secasvar *sav, int skip, int protoff, 612 struct m_tag *mt) 613{ 614 int prot, af, sproto; 615 struct ip6_hdr *ip6; 616 struct m_tag *mtag; 617 struct tdb_ident *tdbi; 618 struct secasindex *saidx; 619 int nxt; 620 u_int8_t nxt8; 621 int error, nest; 622#ifdef notyet 623 char ip6buf[INET6_ADDRSTRLEN]; 624#endif 625 626 IPSEC_ASSERT(m != NULL, ("null mbuf")); 627 IPSEC_ASSERT(sav != NULL, ("null SA")); 628 IPSEC_ASSERT(sav->sah != NULL, ("null SAH")); 629 saidx = &sav->sah->saidx; 630 af = saidx->dst.sa.sa_family; 631 IPSEC_ASSERT(af == AF_INET6, ("unexpected af %u", af)); 632 sproto = saidx->proto; 633 IPSEC_ASSERT(sproto == IPPROTO_ESP || sproto == IPPROTO_AH || 634 sproto == IPPROTO_IPCOMP, 635 ("unexpected security protocol %u", sproto)); 636 637 /* Sanity check */ 638 if (m == NULL) { 639 DPRINTF(("%s: null mbuf", __func__)); 640 IPSEC_ISTAT(sproto, badkcr); 641 error = EINVAL; 642 goto bad; 643 } 644 645 /* Fix IPv6 header */ 646 if (m->m_len < sizeof(struct ip6_hdr) && 647 (m = m_pullup(m, sizeof(struct ip6_hdr))) == NULL) { 648 649 DPRINTF(("%s: processing failed for SA %s/%08lx\n", 650 __func__, ipsec_address(&sav->sah->saidx.dst), 651 (u_long) ntohl(sav->spi))); 652 653 IPSEC_ISTAT(sproto, hdrops); 654 error = EACCES; 655 goto bad; 656 } 657 658 ip6 = mtod(m, struct ip6_hdr *); 659 ip6->ip6_plen = htons(m->m_pkthdr.len - sizeof(struct ip6_hdr)); 660 661 /* Save protocol */ 662 prot = 0; 663 m_copydata(m, protoff, 1, (unsigned char *) &prot); 664 665#ifdef DEV_ENC 666 encif->if_ipackets++; 667 encif->if_ibytes += m->m_pkthdr.len; 668 669 /* 670 * Pass the mbuf to enc0 for bpf and pfil. We will filter the IPIP 671 * packet later after it has been decapsulated. 672 */ 673 ipsec_bpf(m, sav, AF_INET6, ENC_IN|ENC_BEFORE); 674 675 /* XXX-BZ does not make sense. */ 676 if (prot != IPPROTO_IPIP) 677 if ((error = ipsec_filter(&m, PFIL_IN, ENC_IN|ENC_BEFORE)) != 0) 678 return (error); 679#endif /* DEV_ENC */ 680 681#ifdef INET 682 /* IP-in-IP encapsulation */ 683 if (prot == IPPROTO_IPIP) { 684 if (m->m_pkthdr.len - skip < sizeof(struct ip)) { 685 IPSEC_ISTAT(sproto, hdrops); 686 error = EINVAL; 687 goto bad; 688 } 689 /* ipn will now contain the inner IPv4 header */ 690 m_striphdr(m, 0, skip); 691 skip = 0; 692#ifdef notyet 693 /* 694 * Check that the inner source address is the same as 695 * the proxy address, if available. 696 */ 697 if ((saidx->proxy.sa.sa_family == AF_INET && 698 saidx->proxy.sin.sin_addr.s_addr != INADDR_ANY && 699 ipn.ip_src.s_addr != saidx->proxy.sin.sin_addr.s_addr) || 700 (saidx->proxy.sa.sa_family != AF_INET && 701 saidx->proxy.sa.sa_family != 0)) { 702 703 DPRINTF(("%s: inner source address %s doesn't " 704 "correspond to expected proxy source %s, " 705 "SA %s/%08lx\n", __func__, 706 inet_ntoa4(ipn.ip_src), 707 ipsec_address(&saidx->proxy), 708 ipsec_address(&saidx->dst), 709 (u_long) ntohl(sav->spi))); 710 711 IPSEC_ISTAT(sproto, pdrops); 712 error = EACCES; 713 goto bad; 714 } 715#endif /* notyet */ 716 } 717#endif /* INET */ 718 /* IPv6-in-IP encapsulation */ 719 if (prot == IPPROTO_IPV6) { 720 if (m->m_pkthdr.len - skip < sizeof(struct ip6_hdr)) { 721 IPSEC_ISTAT(sproto, hdrops); 722 error = EINVAL; 723 goto bad; 724 } 725 /* ip6n will now contain the inner IPv6 header. */ 726 m_striphdr(m, 0, skip); 727 skip = 0; 728#ifdef notyet 729 /* 730 * Check that the inner source address is the same as 731 * the proxy address, if available. 732 */ 733 if ((saidx->proxy.sa.sa_family == AF_INET6 && 734 !IN6_IS_ADDR_UNSPECIFIED(&saidx->proxy.sin6.sin6_addr) && 735 !IN6_ARE_ADDR_EQUAL(&ip6n.ip6_src, 736 &saidx->proxy.sin6.sin6_addr)) || 737 (saidx->proxy.sa.sa_family != AF_INET6 && 738 saidx->proxy.sa.sa_family != 0)) { 739 740 DPRINTF(("%s: inner source address %s doesn't " 741 "correspond to expected proxy source %s, " 742 "SA %s/%08lx\n", __func__, 743 ip6_sprintf(ip6buf, &ip6n.ip6_src), 744 ipsec_address(&saidx->proxy), 745 ipsec_address(&saidx->dst), 746 (u_long) ntohl(sav->spi))); 747 748 IPSEC_ISTAT(sproto, pdrops); 749 error = EACCES; 750 goto bad; 751 } 752#endif /* notyet */ 753 } 754 755 /* 756 * Record what we've done to the packet (under what SA it was 757 * processed). If we've been passed an mtag, it means the packet 758 * was already processed by an ethernet/crypto combo card and 759 * thus has a tag attached with all the right information, but 760 * with a PACKET_TAG_IPSEC_IN_CRYPTO_DONE as opposed to 761 * PACKET_TAG_IPSEC_IN_DONE type; in that case, just change the type. 762 */ 763 if (mt == NULL && sproto != IPPROTO_IPCOMP) { 764 mtag = m_tag_get(PACKET_TAG_IPSEC_IN_DONE, 765 sizeof(struct tdb_ident), M_NOWAIT); 766 if (mtag == NULL) { 767 DPRINTF(("%s: failed to get tag\n", __func__)); 768 IPSEC_ISTAT(sproto, hdrops); 769 error = ENOMEM; 770 goto bad; 771 } 772 773 tdbi = (struct tdb_ident *)(mtag + 1); 774 bcopy(&saidx->dst, &tdbi->dst, sizeof(union sockaddr_union)); 775 tdbi->proto = sproto; 776 tdbi->spi = sav->spi; 777 /* Cache those two for enc(4) in xform_ipip. */ 778 tdbi->alg_auth = sav->alg_auth; 779 tdbi->alg_enc = sav->alg_enc; 780 781 m_tag_prepend(m, mtag); 782 } else { 783 if (mt != NULL) 784 mt->m_tag_id = PACKET_TAG_IPSEC_IN_DONE; 785 /* XXX do we need to mark m_flags??? */ 786 } 787 788 key_sa_recordxfer(sav, m); 789 790#ifdef DEV_ENC 791 /* 792 * Pass the mbuf to enc0 for bpf and pfil. 793 */ 794#ifdef INET 795 if (prot == IPPROTO_IPIP) 796 ipsec_bpf(m, sav, AF_INET, ENC_IN|ENC_AFTER); 797#endif 798 if (prot == IPPROTO_IPV6) 799 ipsec_bpf(m, sav, AF_INET6, ENC_IN|ENC_AFTER); 800 801 if ((error = ipsec_filter(&m, PFIL_IN, ENC_IN|ENC_AFTER)) != 0) 802 return (error); 803#endif /* DEV_ENC */ 804 /* Retrieve new protocol */ 805 /* We have stripped the IP6 header from the mbuf, we have to use the backuped proto value instead */ 806 nxt8 = prot; 807 808 /* 809 * See the end of ip6_input for this logic. 810 * IPPROTO_IPV[46] case will be processed just like other ones 811 */ 812 nest = 0; 813 nxt = nxt8; 814 while (nxt != IPPROTO_DONE) { 815 if (V_ip6_hdrnestlimit && (++nest > V_ip6_hdrnestlimit)) { 816 IP6STAT_INC(ip6s_toomanyhdr); 817 error = EINVAL; 818 goto bad; 819 } 820 821 /* 822 * Protection against faulty packet - there should be 823 * more sanity checks in header chain processing. 824 */ 825 if (m->m_pkthdr.len < skip) { 826 IP6STAT_INC(ip6s_tooshort); 827 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_truncated); 828 error = EINVAL; 829 goto bad; 830 } 831 /* 832 * Enforce IPsec policy checking if we are seeing last header. 833 * note that we do not visit this with protocols with pcb layer 834 * code - like udp/tcp/raw ip. 835 */ 836 if ((inet6sw[ip6_protox[nxt]].pr_flags & PR_LASTHDR) != 0 && 837 ipsec6_in_reject(m, NULL)) { 838 error = EINVAL; 839 goto bad; 840 } 841 nxt = (*inet6sw[ip6_protox[nxt]].pr_input)(&m, &skip, nxt); 842 } 843 return 0; 844bad: 845 if (m) 846 m_freem(m); 847 return error; 848} 849 850void 851esp6_ctlinput(int cmd, struct sockaddr *sa, void *d) 852{ 853 struct ip6ctlparam *ip6cp = NULL; 854 struct mbuf *m = NULL; 855 struct ip6_hdr *ip6; 856 int off; 857 858 if (sa->sa_family != AF_INET6 || 859 sa->sa_len != sizeof(struct sockaddr_in6)) 860 return; 861 if ((unsigned)cmd >= PRC_NCMDS) 862 return; 863 864 /* if the parameter is from icmp6, decode it. */ 865 if (d != NULL) { 866 ip6cp = (struct ip6ctlparam *)d; 867 m = ip6cp->ip6c_m; 868 ip6 = ip6cp->ip6c_ip6; 869 off = ip6cp->ip6c_off; 870 } else { 871 m = NULL; 872 ip6 = NULL; 873 off = 0; /* calm gcc */ 874 } 875 876 if (ip6 != NULL) { 877 878 struct ip6ctlparam ip6cp1; 879 880 /* 881 * Notify the error to all possible sockets via pfctlinput2. 882 * Since the upper layer information (such as protocol type, 883 * source and destination ports) is embedded in the encrypted 884 * data and might have been cut, we can't directly call 885 * an upper layer ctlinput function. However, the pcbnotify 886 * function will consider source and destination addresses 887 * as well as the flow info value, and may be able to find 888 * some PCB that should be notified. 889 * Although pfctlinput2 will call esp6_ctlinput(), there is 890 * no possibility of an infinite loop of function calls, 891 * because we don't pass the inner IPv6 header. 892 */ 893 bzero(&ip6cp1, sizeof(ip6cp1)); 894 ip6cp1.ip6c_src = ip6cp->ip6c_src; 895 pfctlinput2(cmd, sa, (void *)&ip6cp1); 896 897 /* 898 * Then go to special cases that need ESP header information. 899 * XXX: We assume that when ip6 is non NULL, 900 * M and OFF are valid. 901 */ 902 903 if (cmd == PRC_MSGSIZE) { 904 struct secasvar *sav; 905 u_int32_t spi; 906 int valid; 907 908 /* check header length before using m_copydata */ 909 if (m->m_pkthdr.len < off + sizeof (struct esp)) 910 return; 911 m_copydata(m, off + offsetof(struct esp, esp_spi), 912 sizeof(u_int32_t), (caddr_t) &spi); 913 /* 914 * Check to see if we have a valid SA corresponding to 915 * the address in the ICMP message payload. 916 */ 917 sav = KEY_ALLOCSA((union sockaddr_union *)sa, 918 IPPROTO_ESP, spi); 919 valid = (sav != NULL); 920 if (sav) 921 KEY_FREESAV(&sav); 922 923 /* XXX Further validation? */ 924 925 /* 926 * Depending on whether the SA is "valid" and 927 * routing table size (mtudisc_{hi,lo}wat), we will: 928 * - recalcurate the new MTU and create the 929 * corresponding routing entry, or 930 * - ignore the MTU change notification. 931 */ 932 icmp6_mtudisc_update(ip6cp, valid); 933 } 934 } else { 935 /* we normally notify any pcb here */ 936 } 937} 938#endif /* INET6 */
|