1/*-
2 * Copyright (c) 2006 The FreeBSD Project.
3 * Copyright (c) 2015 Andrey V. Elsukov <ae@FreeBSD.org>
4 * All rights reserved.
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 *
10 * 1. Redistributions of source code must retain the above copyright
11 *    notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 *    notice, this list of conditions and the following disclaimer in the
14 *    documentation and/or other materials provided with the distribution.
15 *
16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
17 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
18 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
19 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
20 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
21 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
22 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
24 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
25 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26 * SUCH DAMAGE.
27 *
28 * $FreeBSD: stable/11/sys/net/if_enc.c 365277 2020-09-02 20:36:33Z jhb $
29 */
30
31#include "opt_inet.h"
32#include "opt_inet6.h"
33#include "opt_ipsec.h"
34
35#include <sys/param.h>
36#include <sys/systm.h>
37#include <sys/hhook.h>
38#include <sys/kernel.h>
39#include <sys/malloc.h>
40#include <sys/mbuf.h>
41#include <sys/module.h>
42#include <machine/bus.h>
43#include <sys/rman.h>
44#include <sys/socket.h>
45#include <sys/sockio.h>
46#include <sys/sysctl.h>
47
48#include <net/if.h>
49#include <net/if_enc.h>
50#include <net/if_var.h>
51#include <net/if_clone.h>
52#include <net/if_types.h>
53#include <net/pfil.h>
54#include <net/route.h>
55#include <net/netisr.h>
56#include <net/bpf.h>
57#include <net/vnet.h>
58
59#include <netinet/in.h>
60#include <netinet/in_systm.h>
61#include <netinet/ip.h>
62#include <netinet/ip_var.h>
63#include <netinet/in_var.h>
64
65#ifdef INET6
66#include <netinet/ip6.h>
67#include <netinet6/ip6_var.h>
68#endif
69
70#include <netipsec/ipsec.h>
71#include <netipsec/xform.h>
72
73#define ENCMTU		(1024+512)
74
75/* XXX this define must have the same value as in OpenBSD */
76#define M_CONF		0x0400	/* payload was encrypted (ESP-transport) */
77#define M_AUTH		0x0800	/* payload was authenticated (AH or ESP auth) */
78#define M_AUTH_AH	0x2000	/* header was authenticated (AH) */
79
80struct enchdr {
81	u_int32_t af;
82	u_int32_t spi;
83	u_int32_t flags;
84};
85struct enc_softc {
86	struct	ifnet *sc_ifp;
87};
88static VNET_DEFINE(struct enc_softc *, enc_sc);
89#define	V_enc_sc	VNET(enc_sc)
90static VNET_DEFINE(struct if_clone *, enc_cloner);
91#define	V_enc_cloner	VNET(enc_cloner)
92
93static int	enc_ioctl(struct ifnet *, u_long, caddr_t);
94static int	enc_output(struct ifnet *, struct mbuf *,
95    const struct sockaddr *, struct route *);
96static int	enc_clone_create(struct if_clone *, int, caddr_t);
97static void	enc_clone_destroy(struct ifnet *);
98static int	enc_add_hhooks(struct enc_softc *);
99static void	enc_remove_hhooks(struct enc_softc *);
100
101static const char encname[] = "enc";
102
103#define	IPSEC_ENC_AFTER_PFIL	0x04
104/*
105 * Before and after are relative to when we are stripping the
106 * outer IP header.
107 *
108 * AFTER_PFIL flag used only for bpf_mask_*. It enables BPF capturing
109 * after PFIL hook execution. It might be useful when PFIL hook does
110 * some changes to the packet, e.g. address translation. If PFIL hook
111 * consumes mbuf, nothing will be captured.
112 */
113static VNET_DEFINE(int, filter_mask_in) = IPSEC_ENC_BEFORE;
114static VNET_DEFINE(int, bpf_mask_in) = IPSEC_ENC_BEFORE;
115static VNET_DEFINE(int, filter_mask_out) = IPSEC_ENC_BEFORE;
116static VNET_DEFINE(int, bpf_mask_out) = IPSEC_ENC_BEFORE | IPSEC_ENC_AFTER;
117#define	V_filter_mask_in	VNET(filter_mask_in)
118#define	V_bpf_mask_in		VNET(bpf_mask_in)
119#define	V_filter_mask_out	VNET(filter_mask_out)
120#define	V_bpf_mask_out		VNET(bpf_mask_out)
121
122static SYSCTL_NODE(_net, OID_AUTO, enc, CTLFLAG_RW, 0, "enc sysctl");
123static SYSCTL_NODE(_net_enc, OID_AUTO, in, CTLFLAG_RW, 0, "enc input sysctl");
124static SYSCTL_NODE(_net_enc, OID_AUTO, out, CTLFLAG_RW, 0, "enc output sysctl");
125SYSCTL_INT(_net_enc_in, OID_AUTO, ipsec_filter_mask,
126    CTLFLAG_RW | CTLFLAG_VNET, &VNET_NAME(filter_mask_in), 0,
127    "IPsec input firewall filter mask");
128SYSCTL_INT(_net_enc_in, OID_AUTO, ipsec_bpf_mask,
129    CTLFLAG_RW | CTLFLAG_VNET, &VNET_NAME(bpf_mask_in), 0,
130    "IPsec input bpf mask");
131SYSCTL_INT(_net_enc_out, OID_AUTO, ipsec_filter_mask,
132    CTLFLAG_RW | CTLFLAG_VNET, &VNET_NAME(filter_mask_out), 0,
133    "IPsec output firewall filter mask");
134SYSCTL_INT(_net_enc_out, OID_AUTO, ipsec_bpf_mask,
135    CTLFLAG_RW | CTLFLAG_VNET, &VNET_NAME(bpf_mask_out), 0,
136    "IPsec output bpf mask");
137
138static void
139enc_clone_destroy(struct ifnet *ifp)
140{
141	struct enc_softc *sc;
142
143	sc = ifp->if_softc;
144	KASSERT(sc == V_enc_sc, ("sc != ifp->if_softc"));
145
146	bpfdetach(ifp);
147	if_detach(ifp);
148	if_free(ifp);
149	free(sc, M_DEVBUF);
150	V_enc_sc = NULL;
151}
152
153static int
154enc_clone_create(struct if_clone *ifc, int unit, caddr_t params)
155{
156	struct ifnet *ifp;
157	struct enc_softc *sc;
158
159	sc = malloc(sizeof(struct enc_softc), M_DEVBUF,
160	    M_WAITOK | M_ZERO);
161	ifp = sc->sc_ifp = if_alloc(IFT_ENC);
162	if (ifp == NULL) {
163		free(sc, M_DEVBUF);
164		return (ENOSPC);
165	}
166	if (V_enc_sc != NULL) {
167		if_free(ifp);
168		free(sc, M_DEVBUF);
169		return (EEXIST);
170	}
171	V_enc_sc = sc;
172	if_initname(ifp, encname, unit);
173	ifp->if_mtu = ENCMTU;
174	ifp->if_ioctl = enc_ioctl;
175	ifp->if_output = enc_output;
176	ifp->if_softc = sc;
177	if_attach(ifp);
178	bpfattach(ifp, DLT_ENC, sizeof(struct enchdr));
179	return (0);
180}
181
182static int
183enc_output(struct ifnet *ifp, struct mbuf *m, const struct sockaddr *dst,
184    struct route *ro)
185{
186
187	m_freem(m);
188	return (0);
189}
190
191static int
192enc_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
193{
194
195	if (cmd != SIOCSIFFLAGS)
196		return (EINVAL);
197	if (ifp->if_flags & IFF_UP)
198		ifp->if_drv_flags |= IFF_DRV_RUNNING;
199	else
200		ifp->if_drv_flags &= ~IFF_DRV_RUNNING;
201	return (0);
202}
203
204static void
205enc_bpftap(struct ifnet *ifp, struct mbuf *m, const struct secasvar *sav,
206    int32_t hhook_type, uint8_t enc, uint8_t af)
207{
208	struct enchdr hdr;
209
210	if (hhook_type == HHOOK_TYPE_IPSEC_IN &&
211	    (enc & V_bpf_mask_in) == 0)
212		return;
213	else if (hhook_type == HHOOK_TYPE_IPSEC_OUT &&
214	    (enc & V_bpf_mask_out) == 0)
215		return;
216	if (bpf_peers_present(ifp->if_bpf) == 0)
217		return;
218	hdr.af = af;
219	hdr.spi = sav->spi;
220	hdr.flags = 0;
221	if (sav->alg_enc != SADB_EALG_NONE)
222		hdr.flags |= M_CONF;
223	if (sav->alg_auth != SADB_AALG_NONE)
224		hdr.flags |= M_AUTH;
225	bpf_mtap2(ifp->if_bpf, &hdr, sizeof(hdr), m);
226}
227
228/*
229 * One helper hook function is used by any hook points.
230 * + from hhook_type we can determine the packet direction:
231 *   HHOOK_TYPE_IPSEC_IN or HHOOK_TYPE_IPSEC_OUT;
232 * + from hhook_id we can determine address family: AF_INET or AF_INET6;
233 * + udata contains pointer to enc_softc;
234 * + ctx_data contains pointer to struct ipsec_ctx_data.
235 */
236static int
237enc_hhook(int32_t hhook_type, int32_t hhook_id, void *udata, void *ctx_data,
238    void *hdata, struct osd *hosd)
239{
240	struct ipsec_ctx_data *ctx;
241	struct enc_softc *sc;
242	struct ifnet *ifp, *rcvif;
243	struct pfil_head *ph;
244	int pdir;
245
246	sc = (struct enc_softc *)udata;
247	ifp = sc->sc_ifp;
248	if ((ifp->if_flags & IFF_UP) == 0)
249		return (0);
250
251	ctx = (struct ipsec_ctx_data *)ctx_data;
252	/* XXX: wrong hook point was used by caller? */
253	if (ctx->af != hhook_id)
254		return (EPFNOSUPPORT);
255
256	enc_bpftap(ifp, *ctx->mp, ctx->sav, hhook_type, ctx->enc, ctx->af);
257	switch (hhook_type) {
258	case HHOOK_TYPE_IPSEC_IN:
259		if (ctx->enc == IPSEC_ENC_BEFORE) {
260			/* Do accounting only once */
261			if_inc_counter(ifp, IFCOUNTER_IPACKETS, 1);
262			if_inc_counter(ifp, IFCOUNTER_IBYTES,
263			    (*ctx->mp)->m_pkthdr.len);
264		}
265		if ((ctx->enc & V_filter_mask_in) == 0)
266			return (0); /* skip pfil processing */
267		pdir = PFIL_IN;
268		break;
269	case HHOOK_TYPE_IPSEC_OUT:
270		if (ctx->enc == IPSEC_ENC_BEFORE) {
271			/* Do accounting only once */
272			if_inc_counter(ifp, IFCOUNTER_OPACKETS, 1);
273			if_inc_counter(ifp, IFCOUNTER_OBYTES,
274			    (*ctx->mp)->m_pkthdr.len);
275		}
276		if ((ctx->enc & V_filter_mask_out) == 0)
277			return (0); /* skip pfil processing */
278		pdir = PFIL_OUT;
279		break;
280	default:
281		return (EINVAL);
282	}
283
284	switch (hhook_id) {
285#ifdef INET
286	case AF_INET:
287		ph = &V_inet_pfil_hook;
288		break;
289#endif
290#ifdef INET6
291	case AF_INET6:
292		ph = &V_inet6_pfil_hook;
293		break;
294#endif
295	default:
296		ph = NULL;
297	}
298	if (ph == NULL || !PFIL_HOOKED(ph))
299		return (0);
300	/* Make a packet looks like it was received on enc(4) */
301	rcvif = (*ctx->mp)->m_pkthdr.rcvif;
302	(*ctx->mp)->m_pkthdr.rcvif = ifp;
303	if (pfil_run_hooks(ph, ctx->mp, ifp, pdir, 0, ctx->inp) != 0 ||
304	    *ctx->mp == NULL) {
305		*ctx->mp = NULL; /* consumed by filter */
306		return (EACCES);
307	}
308	(*ctx->mp)->m_pkthdr.rcvif = rcvif;
309	enc_bpftap(ifp, *ctx->mp, ctx->sav, hhook_type,
310	    IPSEC_ENC_AFTER_PFIL, ctx->af);
311	return (0);
312}
313
314static int
315enc_add_hhooks(struct enc_softc *sc)
316{
317	struct hookinfo hki;
318	int error;
319
320	error = EPFNOSUPPORT;
321	hki.hook_func = enc_hhook;
322	hki.hook_helper = NULL;
323	hki.hook_udata = sc;
324#ifdef INET
325	hki.hook_id = AF_INET;
326	hki.hook_type = HHOOK_TYPE_IPSEC_IN;
327	error = hhook_add_hook(V_ipsec_hhh_in[HHOOK_IPSEC_INET],
328	    &hki, HHOOK_WAITOK);
329	if (error != 0)
330		return (error);
331	hki.hook_type = HHOOK_TYPE_IPSEC_OUT;
332	error = hhook_add_hook(V_ipsec_hhh_out[HHOOK_IPSEC_INET],
333	    &hki, HHOOK_WAITOK);
334	if (error != 0)
335		return (error);
336#endif
337#ifdef INET6
338	hki.hook_id = AF_INET6;
339	hki.hook_type = HHOOK_TYPE_IPSEC_IN;
340	error = hhook_add_hook(V_ipsec_hhh_in[HHOOK_IPSEC_INET6],
341	    &hki, HHOOK_WAITOK);
342	if (error != 0)
343		return (error);
344	hki.hook_type = HHOOK_TYPE_IPSEC_OUT;
345	error = hhook_add_hook(V_ipsec_hhh_out[HHOOK_IPSEC_INET6],
346	    &hki, HHOOK_WAITOK);
347	if (error != 0)
348		return (error);
349#endif
350	return (error);
351}
352
353static void
354enc_remove_hhooks(struct enc_softc *sc)
355{
356	struct hookinfo hki;
357
358	hki.hook_func = enc_hhook;
359	hki.hook_helper = NULL;
360	hki.hook_udata = sc;
361#ifdef INET
362	hki.hook_id = AF_INET;
363	hki.hook_type = HHOOK_TYPE_IPSEC_IN;
364	hhook_remove_hook(V_ipsec_hhh_in[HHOOK_IPSEC_INET], &hki);
365	hki.hook_type = HHOOK_TYPE_IPSEC_OUT;
366	hhook_remove_hook(V_ipsec_hhh_out[HHOOK_IPSEC_INET], &hki);
367#endif
368#ifdef INET6
369	hki.hook_id = AF_INET6;
370	hki.hook_type = HHOOK_TYPE_IPSEC_IN;
371	hhook_remove_hook(V_ipsec_hhh_in[HHOOK_IPSEC_INET6], &hki);
372	hki.hook_type = HHOOK_TYPE_IPSEC_OUT;
373	hhook_remove_hook(V_ipsec_hhh_out[HHOOK_IPSEC_INET6], &hki);
374#endif
375}
376
377static void
378vnet_enc_init(const void *unused __unused)
379{
380
381	V_enc_sc = NULL;
382	V_enc_cloner = if_clone_simple(encname, enc_clone_create,
383	    enc_clone_destroy, 1);
384}
385VNET_SYSINIT(vnet_enc_init, SI_SUB_PSEUDO, SI_ORDER_ANY,
386    vnet_enc_init, NULL);
387
388static void
389vnet_enc_init_proto(void *unused __unused)
390{
391	KASSERT(V_enc_sc != NULL, ("%s: V_enc_sc is %p\n", __func__, V_enc_sc));
392
393	if (enc_add_hhooks(V_enc_sc) != 0)
394		enc_clone_destroy(V_enc_sc->sc_ifp);
395}
396VNET_SYSINIT(vnet_enc_init_proto, SI_SUB_PROTO_IFATTACHDOMAIN, SI_ORDER_ANY,
397    vnet_enc_init_proto, NULL);
398
399static void
400vnet_enc_uninit(const void *unused __unused)
401{
402	KASSERT(V_enc_sc != NULL, ("%s: V_enc_sc is %p\n", __func__, V_enc_sc));
403
404	if_clone_detach(V_enc_cloner);
405}
406VNET_SYSUNINIT(vnet_enc_uninit, SI_SUB_INIT_IF, SI_ORDER_ANY,
407    vnet_enc_uninit, NULL);
408
409/*
410 * The hhook consumer needs to go before ip[6]_destroy are called on
411 * SI_ORDER_THIRD.
412 */
413static void
414vnet_enc_uninit_hhook(const void *unused __unused)
415{
416	KASSERT(V_enc_sc != NULL, ("%s: V_enc_sc is %p\n", __func__, V_enc_sc));
417
418	enc_remove_hhooks(V_enc_sc);
419}
420VNET_SYSUNINIT(vnet_enc_uninit_hhook, SI_SUB_PROTO_DOMAIN, SI_ORDER_FOURTH,
421    vnet_enc_uninit_hhook, NULL);
422
423static int
424enc_modevent(module_t mod, int type, void *data)
425{
426
427	switch (type) {
428	case MOD_LOAD:
429	case MOD_UNLOAD:
430		break;
431	default:
432		return (EOPNOTSUPP);
433	}
434	return (0);
435}
436
437static moduledata_t enc_mod = {
438	"if_enc",
439	enc_modevent,
440	0
441};
442
443DECLARE_MODULE(if_enc, enc_mod, SI_SUB_PSEUDO, SI_ORDER_ANY);
444MODULE_VERSION(if_enc, 1);
445