if_enc.c revision 291292 
1/*-
2 * Copyright (c) 2006 The FreeBSD Project.
3 * Copyright (c) 2015 Andrey V. Elsukov <ae@FreeBSD.org>
4 * All rights reserved.
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 *
10 * 1. Redistributions of source code must retain the above copyright
11 *    notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 *    notice, this list of conditions and the following disclaimer in the
14 *    documentation and/or other materials provided with the distribution.
15 *
16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
17 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
18 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
19 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
20 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
21 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
22 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
24 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
25 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26 * SUCH DAMAGE.
27 *
28 * $FreeBSD: head/sys/net/if_enc.c 291292 2015-11-25 07:31:59Z ae $
29 */
30
31#include "opt_inet.h"
32#include "opt_inet6.h"
33#include "opt_enc.h"
34
35#include <sys/param.h>
36#include <sys/systm.h>
37#include <sys/kernel.h>
38#include <sys/malloc.h>
39#include <sys/mbuf.h>
40#include <sys/module.h>
41#include <machine/bus.h>
42#include <sys/rman.h>
43#include <sys/socket.h>
44#include <sys/sockio.h>
45#include <sys/sysctl.h>
46
47#include <net/if.h>
48#include <net/if_var.h>
49#include <net/if_clone.h>
50#include <net/if_types.h>
51#include <net/pfil.h>
52#include <net/route.h>
53#include <net/netisr.h>
54#include <net/bpf.h>
55#include <net/vnet.h>
56
57#include <netinet/in.h>
58#include <netinet/in_systm.h>
59#include <netinet/ip.h>
60#include <netinet/ip_var.h>
61#include <netinet/in_var.h>
62
63#ifdef INET6
64#include <netinet/ip6.h>
65#include <netinet6/ip6_var.h>
66#endif
67
68#include <netipsec/ipsec.h>
69#include <netipsec/xform.h>
70
71#define ENCMTU		(1024+512)
72
73/* XXX this define must have the same value as in OpenBSD */
74#define M_CONF		0x0400	/* payload was encrypted (ESP-transport) */
75#define M_AUTH		0x0800	/* payload was authenticated (AH or ESP auth) */
76#define M_AUTH_AH	0x2000	/* header was authenticated (AH) */
77
78struct enchdr {
79	u_int32_t af;
80	u_int32_t spi;
81	u_int32_t flags;
82};
83struct enc_softc {
84	struct	ifnet *sc_ifp;
85};
86static VNET_DEFINE(struct enc_softc *, enc_sc);
87#define	V_enc_sc	VNET(enc_sc)
88static VNET_DEFINE(struct if_clone *, enc_cloner);
89#define	V_enc_cloner	VNET(enc_cloner)
90
91static int	enc_ioctl(struct ifnet *, u_long, caddr_t);
92static int	enc_output(struct ifnet *, struct mbuf *,
93    const struct sockaddr *, struct route *);
94static int	enc_clone_create(struct if_clone *, int, caddr_t);
95static void	enc_clone_destroy(struct ifnet *);
96static int	enc_add_hhooks(struct enc_softc *);
97static void	enc_remove_hhooks(struct enc_softc *);
98
99static const char encname[] = "enc";
100
101/*
102 * Before and after are relative to when we are stripping the
103 * outer IP header.
104 */
105static VNET_DEFINE(int, filter_mask_in) = IPSEC_ENC_BEFORE;
106static VNET_DEFINE(int, bpf_mask_in) = IPSEC_ENC_BEFORE;
107static VNET_DEFINE(int, filter_mask_out) = IPSEC_ENC_BEFORE;
108static VNET_DEFINE(int, bpf_mask_out) = IPSEC_ENC_BEFORE | IPSEC_ENC_AFTER;
109#define	V_filter_mask_in	VNET(filter_mask_in)
110#define	V_bpf_mask_in		VNET(bpf_mask_in)
111#define	V_filter_mask_out	VNET(filter_mask_out)
112#define	V_bpf_mask_out		VNET(bpf_mask_out)
113
114static SYSCTL_NODE(_net, OID_AUTO, enc, CTLFLAG_RW, 0, "enc sysctl");
115static SYSCTL_NODE(_net_enc, OID_AUTO, in, CTLFLAG_RW, 0, "enc input sysctl");
116static SYSCTL_NODE(_net_enc, OID_AUTO, out, CTLFLAG_RW, 0, "enc output sysctl");
117SYSCTL_INT(_net_enc_in, OID_AUTO, ipsec_filter_mask,
118    CTLFLAG_RW | CTLFLAG_VNET, &VNET_NAME(filter_mask_in), 0,
119    "IPsec input firewall filter mask");
120SYSCTL_INT(_net_enc_in, OID_AUTO, ipsec_bpf_mask,
121    CTLFLAG_RW | CTLFLAG_VNET, &VNET_NAME(bpf_mask_in), 0,
122    "IPsec input bpf mask");
123SYSCTL_INT(_net_enc_out, OID_AUTO, ipsec_filter_mask,
124    CTLFLAG_RW | CTLFLAG_VNET, &VNET_NAME(filter_mask_out), 0,
125    "IPsec output firewall filter mask");
126SYSCTL_INT(_net_enc_out, OID_AUTO, ipsec_bpf_mask,
127    CTLFLAG_RW | CTLFLAG_VNET, &VNET_NAME(bpf_mask_out), 0,
128    "IPsec output bpf mask");
129
130static void
131enc_clone_destroy(struct ifnet *ifp)
132{
133	struct enc_softc *sc;
134
135	sc = ifp->if_softc;
136	KASSERT(sc == V_enc_sc, ("sc != ifp->if_softc"));
137
138	enc_remove_hhooks(sc);
139	bpfdetach(ifp);
140	if_detach(ifp);
141	if_free(ifp);
142	free(sc, M_DEVBUF);
143	V_enc_sc = NULL;
144}
145
146static int
147enc_clone_create(struct if_clone *ifc, int unit, caddr_t params)
148{
149	struct ifnet *ifp;
150	struct enc_softc *sc;
151
152	sc = malloc(sizeof(struct enc_softc), M_DEVBUF,
153	    M_WAITOK | M_ZERO);
154	ifp = sc->sc_ifp = if_alloc(IFT_ENC);
155	if (ifp == NULL) {
156		free(sc, M_DEVBUF);
157		return (ENOSPC);
158	}
159	if (V_enc_sc != NULL) {
160		if_free(ifp);
161		free(sc, M_DEVBUF);
162		return (EEXIST);
163	}
164	V_enc_sc = sc;
165	if_initname(ifp, encname, unit);
166	ifp->if_mtu = ENCMTU;
167	ifp->if_ioctl = enc_ioctl;
168	ifp->if_output = enc_output;
169	ifp->if_softc = sc;
170	if_attach(ifp);
171	bpfattach(ifp, DLT_ENC, sizeof(struct enchdr));
172	if (enc_add_hhooks(sc) != 0) {
173		enc_clone_destroy(ifp);
174		return (ENXIO);
175	}
176	return (0);
177}
178
179static int
180enc_output(struct ifnet *ifp, struct mbuf *m, const struct sockaddr *dst,
181    struct route *ro)
182{
183
184	m_freem(m);
185	return (0);
186}
187
188static int
189enc_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
190{
191
192	if (cmd != SIOCSIFFLAGS)
193		return (EINVAL);
194	if (ifp->if_flags & IFF_UP)
195		ifp->if_drv_flags |= IFF_DRV_RUNNING;
196	else
197		ifp->if_drv_flags &= ~IFF_DRV_RUNNING;
198	return (0);
199}
200
201/*
202 * One helper hook function is used by any hook points.
203 * + from hhook_type we can determine the packet direction:
204 *   HHOOK_TYPE_IPSEC_IN or HHOOK_TYPE_IPSEC_OUT;
205 * + from hhook_id we can determine address family: AF_INET or AF_INET6;
206 * + udata contains pointer to enc_softc;
207 * + ctx_data contains pointer to struct ipsec_ctx_data.
208 */
209static int
210enc_hhook(int32_t hhook_type, int32_t hhook_id, void *udata, void *ctx_data,
211    void *hdata, struct osd *hosd)
212{
213	struct enchdr hdr;
214	struct ipsec_ctx_data *ctx;
215	struct enc_softc *sc;
216	struct ifnet *ifp, *rcvif;
217	struct pfil_head *ph;
218	int pdir;
219
220	sc = (struct enc_softc *)udata;
221	ifp = sc->sc_ifp;
222	if ((ifp->if_flags & IFF_UP) == 0)
223		return (0);
224
225	ctx = (struct ipsec_ctx_data *)ctx_data;
226	/* XXX: wrong hook point was used by caller? */
227	if (ctx->af != hhook_id)
228		return (EPFNOSUPPORT);
229
230	if (((hhook_type == HHOOK_TYPE_IPSEC_IN &&
231	    (ctx->enc & V_bpf_mask_in) != 0) ||
232	    (hhook_type == HHOOK_TYPE_IPSEC_OUT &&
233	    (ctx->enc & V_bpf_mask_out) != 0)) &&
234	    bpf_peers_present(ifp->if_bpf) != 0) {
235		hdr.af = ctx->af;
236		hdr.spi = ctx->sav->spi;
237		hdr.flags = 0;
238		if (ctx->sav->alg_enc != SADB_EALG_NONE)
239			hdr.flags |= M_CONF;
240		if (ctx->sav->alg_auth != SADB_AALG_NONE)
241			hdr.flags |= M_AUTH;
242		bpf_mtap2(ifp->if_bpf, &hdr, sizeof(hdr), *ctx->mp);
243	}
244
245	switch (hhook_type) {
246	case HHOOK_TYPE_IPSEC_IN:
247		if (ctx->enc == IPSEC_ENC_BEFORE) {
248			/* Do accounting only once */
249			if_inc_counter(ifp, IFCOUNTER_IPACKETS, 1);
250			if_inc_counter(ifp, IFCOUNTER_IBYTES,
251			    (*ctx->mp)->m_pkthdr.len);
252		}
253		if ((ctx->enc & V_filter_mask_in) == 0)
254			return (0); /* skip pfil processing */
255		pdir = PFIL_IN;
256		break;
257	case HHOOK_TYPE_IPSEC_OUT:
258		if (ctx->enc == IPSEC_ENC_BEFORE) {
259			/* Do accounting only once */
260			if_inc_counter(ifp, IFCOUNTER_OPACKETS, 1);
261			if_inc_counter(ifp, IFCOUNTER_OBYTES,
262			    (*ctx->mp)->m_pkthdr.len);
263		}
264		if ((ctx->enc & V_filter_mask_out) == 0)
265			return (0); /* skip pfil processing */
266		pdir = PFIL_OUT;
267		break;
268	default:
269		return (EINVAL);
270	}
271
272	switch (hhook_id) {
273#ifdef INET
274	case AF_INET:
275		ph = &V_inet_pfil_hook;
276		break;
277#endif
278#ifdef INET6
279	case AF_INET6:
280		ph = &V_inet6_pfil_hook;
281		break;
282#endif
283	default:
284		ph = NULL;
285	}
286	if (ph == NULL || !PFIL_HOOKED(ph))
287		return (0);
288	/* Make a packet looks like it was received on enc(4) */
289	rcvif = (*ctx->mp)->m_pkthdr.rcvif;
290	(*ctx->mp)->m_pkthdr.rcvif = ifp;
291	if (pfil_run_hooks(ph, ctx->mp, ifp, pdir, NULL) != 0 ||
292	    *ctx->mp == NULL) {
293		*ctx->mp = NULL; /* consumed by filter */
294		return (EACCES);
295	}
296	(*ctx->mp)->m_pkthdr.rcvif = rcvif;
297	return (0);
298}
299
300static int
301enc_add_hhooks(struct enc_softc *sc)
302{
303	struct hookinfo hki;
304	int error;
305
306	error = EPFNOSUPPORT;
307	hki.hook_func = enc_hhook;
308	hki.hook_helper = NULL;
309	hki.hook_udata = sc;
310#ifdef INET
311	hki.hook_id = AF_INET;
312	hki.hook_type = HHOOK_TYPE_IPSEC_IN;
313	error = hhook_add_hook(V_ipsec_hhh_in[HHOOK_IPSEC_INET],
314	    &hki, HHOOK_WAITOK);
315	if (error != 0)
316		return (error);
317	hki.hook_type = HHOOK_TYPE_IPSEC_OUT;
318	error = hhook_add_hook(V_ipsec_hhh_out[HHOOK_IPSEC_INET],
319	    &hki, HHOOK_WAITOK);
320	if (error != 0)
321		return (error);
322#endif
323#ifdef INET6
324	hki.hook_id = AF_INET6;
325	hki.hook_type = HHOOK_TYPE_IPSEC_IN;
326	error = hhook_add_hook(V_ipsec_hhh_in[HHOOK_IPSEC_INET6],
327	    &hki, HHOOK_WAITOK);
328	if (error != 0)
329		return (error);
330	hki.hook_type = HHOOK_TYPE_IPSEC_OUT;
331	error = hhook_add_hook(V_ipsec_hhh_out[HHOOK_IPSEC_INET6],
332	    &hki, HHOOK_WAITOK);
333	if (error != 0)
334		return (error);
335#endif
336	return (error);
337}
338
339static void
340enc_remove_hhooks(struct enc_softc *sc)
341{
342	struct hookinfo hki;
343
344	hki.hook_func = enc_hhook;
345	hki.hook_helper = NULL;
346	hki.hook_udata = sc;
347#ifdef INET
348	hki.hook_id = AF_INET;
349	hki.hook_type = HHOOK_TYPE_IPSEC_IN;
350	hhook_remove_hook(V_ipsec_hhh_in[HHOOK_IPSEC_INET], &hki);
351	hki.hook_type = HHOOK_TYPE_IPSEC_OUT;
352	hhook_remove_hook(V_ipsec_hhh_out[HHOOK_IPSEC_INET], &hki);
353#endif
354#ifdef INET6
355	hki.hook_id = AF_INET6;
356	hki.hook_type = HHOOK_TYPE_IPSEC_IN;
357	hhook_remove_hook(V_ipsec_hhh_in[HHOOK_IPSEC_INET6], &hki);
358	hki.hook_type = HHOOK_TYPE_IPSEC_OUT;
359	hhook_remove_hook(V_ipsec_hhh_out[HHOOK_IPSEC_INET6], &hki);
360#endif
361}
362
363static void
364vnet_enc_init(const void *unused __unused)
365{
366
367	V_enc_sc = NULL;
368	V_enc_cloner = if_clone_simple(encname, enc_clone_create,
369	    enc_clone_destroy, 1);
370}
371VNET_SYSINIT(vnet_enc_init, SI_SUB_PROTO_IFATTACHDOMAIN, SI_ORDER_ANY,
372    vnet_enc_init, NULL);
373
374static void
375vnet_enc_uninit(const void *unused __unused)
376{
377
378	if_clone_detach(V_enc_cloner);
379}
380VNET_SYSUNINIT(vnet_enc_uninit, SI_SUB_PROTO_IFATTACHDOMAIN, SI_ORDER_ANY,
381    vnet_enc_uninit, NULL);
382
383static int
384enc_modevent(module_t mod, int type, void *data)
385{
386
387	switch (type) {
388	case MOD_LOAD:
389	case MOD_UNLOAD:
390		break;
391	default:
392		return (EOPNOTSUPP);
393	}
394	return (0);
395}
396
397static moduledata_t enc_mod = {
398	"if_enc",
399	enc_modevent,
400	0
401};
402
403DECLARE_MODULE(if_enc, enc_mod, SI_SUB_PROTO_IFATTACHDOMAIN, SI_ORDER_ANY);
404