1 /* $NetBSD: ipsec.c,v 1.69 2017/01/16 15:44:47 christos Exp $ */ 2 /* $FreeBSD: /usr/local/www/cvsroot/FreeBSD/src/sys/netipsec/ipsec.c,v 1.2.2.2 2003/07/01 01:38:13 sam Exp $ */ 3 /* $KAME: ipsec.c,v 1.103 2001/05/24 07:14:18 sakane Exp $ */ 4 5 /* 6 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. 7 * All rights reserved. 8 * 9 * Redistribution and use in source and binary forms, with or without 10 * modification, are permitted provided that the following conditions 11 * are met: 12 * 1. Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * 2. Redistributions in binary form must reproduce the above copyright 15 * notice, this list of conditions and the following disclaimer in the 16 * documentation and/or other materials provided with the distribution. 17 * 3. Neither the name of the project nor the names of its contributors 18 * may be used to endorse or promote products derived from this software 19 * without specific prior written permission. 20 * 21 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND 22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 24 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE 25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 31 * SUCH DAMAGE. 32 */ 33 34 #include <sys/cdefs.h> 35 __KERNEL_RCSID(0, "$NetBSD: ipsec.c,v 1.69 2017/01/16 15:44:47 christos Exp $"); 36 37 /* 38 * IPsec controller part. 39 */ 40 41 #include "opt_inet.h" 42 #ifdef __FreeBSD__ 43 #include "opt_inet6.h" 44 #endif 45 #include "opt_ipsec.h" 46 47 #include <sys/param.h> 48 #include <sys/systm.h> 49 #include <sys/malloc.h> 50 #include <sys/mbuf.h> 51 #include <sys/domain.h> 52 #include <sys/protosw.h> 53 #include <sys/socket.h> 54 #include <sys/socketvar.h> 55 #include <sys/errno.h> 56 #include <sys/time.h> 57 #include <sys/kernel.h> 58 #include <sys/syslog.h> 59 #include <sys/sysctl.h> 60 #include <sys/proc.h> 61 #include <sys/kauth.h> 62 63 #include <net/if.h> 64 #include <net/route.h> 65 66 #include <netinet/in.h> 67 #include <netinet/in_systm.h> 68 #include <netinet/ip.h> 69 #include <netinet/ip_var.h> 70 #include <netinet/in_var.h> 71 #include <netinet/udp.h> 72 #include <netinet/udp_var.h> 73 #include <netinet/tcp.h> 74 #include <netinet/udp.h> 75 #include <netinet/ip_icmp.h> 76 #include <netinet/ip_private.h> 77 78 #include <netinet/ip6.h> 79 #ifdef INET6 80 #include <netinet6/ip6_var.h> 81 #endif 82 #include <netinet/in_pcb.h> 83 #ifdef INET6 84 #include <netinet6/in6_pcb.h> 85 #include <netinet/icmp6.h> 86 #endif 87 88 #include <netipsec/ipsec.h> 89 #include <netipsec/ipsec_var.h> 90 #include <netipsec/ipsec_private.h> 91 #ifdef INET6 92 #include <netipsec/ipsec6.h> 93 #endif 94 #include <netipsec/ah_var.h> 95 #include <netipsec/esp_var.h> 96 #include <netipsec/ipcomp.h> /*XXX*/ 97 #include <netipsec/ipcomp_var.h> 98 99 #include <netipsec/key.h> 100 #include <netipsec/keydb.h> 101 #include <netipsec/key_debug.h> 102 103 #include <netipsec/xform.h> 104 105 #include <netipsec/ipsec_osdep.h> 106 107 #include <net/net_osdep.h> 108 109 int ipsec_used = 0; 110 int ipsec_enabled = 1; 111 112 #ifdef IPSEC_DEBUG 113 int ipsec_debug = 1; 114 115 /* 116 * When set to 1, IPsec will send packets with the same sequence number. 117 * This allows to verify if the other side has proper replay attacks detection. 118 */ 119 int ipsec_replay = 0; 120 121 /* 122 * When set 1, IPsec will send packets with corrupted HMAC. 123 * This allows to verify if the other side properly detects modified packets. 124 */ 125 int ipsec_integrity = 0; 126 #else 127 int ipsec_debug = 0; 128 #endif 129 130 percpu_t *ipsecstat_percpu; 131 int ip4_ah_offsetmask = 0; /* maybe IP_DF? */ 132 int ip4_ipsec_dfbit = 2; /* DF bit on encap. 0: clear 1: set 2: copy */ 133 int ip4_esp_trans_deflev = IPSEC_LEVEL_USE; 134 int ip4_esp_net_deflev = IPSEC_LEVEL_USE; 135 int ip4_ah_trans_deflev = IPSEC_LEVEL_USE; 136 int ip4_ah_net_deflev = IPSEC_LEVEL_USE; 137 struct secpolicy ip4_def_policy; 138 int ip4_ipsec_ecn = 0; /* ECN ignore(-1)/forbidden(0)/allowed(1) */ 139 int ip4_esp_randpad = -1; 140 141 #ifdef __NetBSD__ 142 u_int ipsec_spdgen = 1; /* SPD generation # */ 143 144 static struct secpolicy *ipsec_checkpcbcache (struct mbuf *, 145 struct inpcbpolicy *, int); 146 static int ipsec_fillpcbcache (struct inpcbpolicy *, struct mbuf *, 147 struct secpolicy *, int); 148 static int ipsec_invalpcbcache (struct inpcbpolicy *, int); 149 #endif /* __NetBSD__ */ 150 151 /* 152 * Crypto support requirements: 153 * 154 * 1 require hardware support 155 * -1 require software support 156 * 0 take anything 157 */ 158 int crypto_support = 0; 159 160 static struct secpolicy *ipsec_getpolicybysock(struct mbuf *, u_int, 161 PCB_T *, int *); 162 163 #ifdef __FreeBSD__ 164 SYSCTL_DECL(_net_inet_ipsec); 165 166 /* net.inet.ipsec */ 167 SYSCTL_INT(_net_inet_ipsec, IPSECCTL_DEF_POLICY, 168 def_policy, CTLFLAG_RW, &ip4_def_policy.policy, 0, ""); 169 SYSCTL_INT(_net_inet_ipsec, IPSECCTL_DEF_ESP_TRANSLEV, esp_trans_deflev, 170 CTLFLAG_RW, &ip4_esp_trans_deflev, 0, ""); 171 SYSCTL_INT(_net_inet_ipsec, IPSECCTL_DEF_ESP_NETLEV, esp_net_deflev, 172 CTLFLAG_RW, &ip4_esp_net_deflev, 0, ""); 173 SYSCTL_INT(_net_inet_ipsec, IPSECCTL_DEF_AH_TRANSLEV, ah_trans_deflev, 174 CTLFLAG_RW, &ip4_ah_trans_deflev, 0, ""); 175 SYSCTL_INT(_net_inet_ipsec, IPSECCTL_DEF_AH_NETLEV, ah_net_deflev, 176 CTLFLAG_RW, &ip4_ah_net_deflev, 0, ""); 177 SYSCTL_INT(_net_inet_ipsec, IPSECCTL_AH_CLEARTOS, 178 ah_cleartos, CTLFLAG_RW, &ip4_ah_cleartos, 0, ""); 179 SYSCTL_INT(_net_inet_ipsec, IPSECCTL_AH_OFFSETMASK, 180 ah_offsetmask, CTLFLAG_RW, &ip4_ah_offsetmask, 0, ""); 181 SYSCTL_INT(_net_inet_ipsec, IPSECCTL_DFBIT, 182 dfbit, CTLFLAG_RW, &ip4_ipsec_dfbit, 0, ""); 183 SYSCTL_INT(_net_inet_ipsec, IPSECCTL_ECN, 184 ecn, CTLFLAG_RW, &ip4_ipsec_ecn, 0, ""); 185 SYSCTL_INT(_net_inet_ipsec, IPSECCTL_DEBUG, 186 debug, CTLFLAG_RW, &ipsec_debug, 0, ""); 187 SYSCTL_INT(_net_inet_ipsec, IPSECCTL_ESP_RANDPAD, 188 esp_randpad, CTLFLAG_RW, &ip4_esp_randpad, 0, ""); 189 SYSCTL_INT(_net_inet_ipsec, OID_AUTO, 190 crypto_support, CTLFLAG_RW, &crypto_support,0, ""); 191 SYSCTL_STRUCT(_net_inet_ipsec, OID_AUTO, 192 ipsecstats, CTLFLAG_RD, &newipsecstat, newipsecstat, ""); 193 SYSCTL_INT(_net_inet_ipsec, OID_AUTO, test_replay, CTLFLAG_RW, &ipsec_replay, 0, 194 "Emulate replay attack"); 195 SYSCTL_INT(_net_inet_ipsec, OID_AUTO, test_integrity, CTLFLAG_RW, 196 &ipsec_integrity, 0, "Emulate man-in-the-middle attack"); 197 #endif /* __FreeBSD__ */ 198 199 #ifdef INET6 200 int ip6_esp_trans_deflev = IPSEC_LEVEL_USE; 201 int ip6_esp_net_deflev = IPSEC_LEVEL_USE; 202 int ip6_ah_trans_deflev = IPSEC_LEVEL_USE; 203 int ip6_ah_net_deflev = IPSEC_LEVEL_USE; 204 struct secpolicy ip6_def_policy; 205 int ip6_ipsec_ecn = 0; /* ECN ignore(-1)/forbidden(0)/allowed(1) */ 206 int ip6_esp_randpad = -1; 207 208 209 #ifdef __FreeBSD__ 210 SYSCTL_DECL(_net_inet6_ipsec6); 211 212 /* net.inet6.ipsec6 */ 213 #ifdef COMPAT_KAME 214 SYSCTL_OID(_net_inet6_ipsec6, IPSECCTL_STATS, stats, CTLFLAG_RD, 215 0,0, compat_ipsecstats_sysctl, "S", ""); 216 #endif /* COMPAT_KAME */ 217 SYSCTL_INT(_net_inet6_ipsec6, IPSECCTL_DEF_POLICY, 218 def_policy, CTLFLAG_RW, &ip4_def_policy.policy, 0, ""); 219 SYSCTL_INT(_net_inet6_ipsec6, IPSECCTL_DEF_ESP_TRANSLEV, esp_trans_deflev, 220 CTLFLAG_RW, &ip6_esp_trans_deflev, 0, ""); 221 SYSCTL_INT(_net_inet6_ipsec6, IPSECCTL_DEF_ESP_NETLEV, esp_net_deflev, 222 CTLFLAG_RW, &ip6_esp_net_deflev, 0, ""); 223 SYSCTL_INT(_net_inet6_ipsec6, IPSECCTL_DEF_AH_TRANSLEV, ah_trans_deflev, 224 CTLFLAG_RW, &ip6_ah_trans_deflev, 0, ""); 225 SYSCTL_INT(_net_inet6_ipsec6, IPSECCTL_DEF_AH_NETLEV, ah_net_deflev, 226 CTLFLAG_RW, &ip6_ah_net_deflev, 0, ""); 227 SYSCTL_INT(_net_inet6_ipsec6, IPSECCTL_ECN, 228 ecn, CTLFLAG_RW, &ip6_ipsec_ecn, 0, ""); 229 SYSCTL_INT(_net_inet6_ipsec6, IPSECCTL_DEBUG, 230 debug, CTLFLAG_RW, &ipsec_debug, 0, ""); 231 SYSCTL_INT(_net_inet6_ipsec6, IPSECCTL_ESP_RANDPAD, 232 esp_randpad, CTLFLAG_RW, &ip6_esp_randpad, 0, ""); 233 #endif /* __FreeBSD__ */ 234 #endif /* INET6 */ 235 236 static int ipsec4_setspidx_inpcb (struct mbuf *, struct inpcb *); 237 #ifdef INET6 238 static int ipsec6_setspidx_in6pcb (struct mbuf *, struct in6pcb *); 239 #endif 240 static int ipsec_setspidx (struct mbuf *, struct secpolicyindex *, int); 241 static void ipsec4_get_ulp (struct mbuf *m, struct secpolicyindex *, int); 242 static int ipsec4_setspidx_ipaddr (struct mbuf *, struct secpolicyindex *); 243 #ifdef INET6 244 static void ipsec6_get_ulp (struct mbuf *m, struct secpolicyindex *, int); 245 static int ipsec6_setspidx_ipaddr (struct mbuf *, struct secpolicyindex *); 246 #endif 247 static void ipsec_delpcbpolicy (struct inpcbpolicy *); 248 static struct secpolicy *ipsec_deepcopy_policy (const struct secpolicy *); 249 static int ipsec_set_policy (struct secpolicy **, int, const void *, size_t, 250 kauth_cred_t); 251 static int ipsec_get_policy (struct secpolicy *, struct mbuf **); 252 static void vshiftl (unsigned char *, int, int); 253 static size_t ipsec_hdrsiz (const struct secpolicy *); 254 255 #ifdef __NetBSD__ 256 /* 257 * Try to validate and use cached policy on a PCB. 258 */ 259 static struct secpolicy * 260 ipsec_checkpcbcache(struct mbuf *m, struct inpcbpolicy *pcbsp, int dir) 261 { 262 struct secpolicyindex spidx; 263 264 switch (dir) { 265 case IPSEC_DIR_INBOUND: 266 case IPSEC_DIR_OUTBOUND: 267 case IPSEC_DIR_ANY: 268 break; 269 default: 270 return NULL; 271 } 272 #ifdef DIAGNOSTIC 273 if (pcbsp == NULL) { 274 printf("%s: NULL pcbsp\n", __func__); 275 /* XXX panic? */ 276 return NULL; 277 } 278 #endif 279 280 #ifdef DIAGNOSTIC 281 if (dir >= sizeof(pcbsp->sp_cache)/sizeof(pcbsp->sp_cache[0])) 282 panic("dir too big in ipsec_checkpcbcache"); 283 #endif 284 /* SPD table change invalidate all the caches. */ 285 if (ipsec_spdgen != pcbsp->sp_cache[dir].cachegen) { 286 ipsec_invalpcbcache(pcbsp, dir); 287 return NULL; 288 } 289 if (!pcbsp->sp_cache[dir].cachesp) 290 return NULL; 291 if (pcbsp->sp_cache[dir].cachesp->state != IPSEC_SPSTATE_ALIVE) { 292 ipsec_invalpcbcache(pcbsp, dir); 293 return NULL; 294 } 295 if ((pcbsp->sp_cacheflags & IPSEC_PCBSP_CONNECTED) == 0) { 296 if (!pcbsp->sp_cache[dir].cachesp) 297 return NULL; 298 if (ipsec_setspidx(m, &spidx, 1) != 0) 299 return NULL; 300 301 /* 302 * We have to make an exact match here since the cached rule 303 * might have lower priority than a rule that would otherwise 304 * have matched the packet. 305 */ 306 307 if (memcmp(&pcbsp->sp_cache[dir].cacheidx, &spidx, sizeof(spidx))) 308 return NULL; 309 310 } else { 311 /* 312 * The pcb is connected, and the L4 code is sure that: 313 * - outgoing side uses inp_[lf]addr 314 * - incoming side looks up policy after inpcb lookup 315 * and address pair is know to be stable. We do not need 316 * to generate spidx again, nor check the address match again. 317 * 318 * For IPv4/v6 SOCK_STREAM sockets, this assumptions holds 319 * and there are calls to ipsec_pcbconn() from in_pcbconnect(). 320 */ 321 } 322 323 pcbsp->sp_cache[dir].cachesp->lastused = time_second; 324 pcbsp->sp_cache[dir].cachesp->refcnt++; 325 KEYDEBUG(KEYDEBUG_IPSEC_STAMP, 326 printf("DP %s cause refcnt++:%d SP:%p\n", __func__, 327 pcbsp->sp_cache[dir].cachesp->refcnt, 328 pcbsp->sp_cache[dir].cachesp)); 329 return pcbsp->sp_cache[dir].cachesp; 330 } 331 332 static int 333 ipsec_fillpcbcache(struct inpcbpolicy *pcbsp, struct mbuf *m, 334 struct secpolicy *sp, int dir) 335 { 336 337 switch (dir) { 338 case IPSEC_DIR_INBOUND: 339 case IPSEC_DIR_OUTBOUND: 340 break; 341 default: 342 return EINVAL; 343 } 344 #ifdef DIAGNOSTIC 345 if (dir >= sizeof(pcbsp->sp_cache)/sizeof(pcbsp->sp_cache[0])) 346 panic("dir too big in ipsec_fillpcbcache"); 347 #endif 348 349 if (pcbsp->sp_cache[dir].cachesp) 350 KEY_FREESP(&pcbsp->sp_cache[dir].cachesp); 351 pcbsp->sp_cache[dir].cachesp = NULL; 352 pcbsp->sp_cache[dir].cachehint = IPSEC_PCBHINT_MAYBE; 353 if (ipsec_setspidx(m, &pcbsp->sp_cache[dir].cacheidx, 1) != 0) { 354 return EINVAL; 355 } 356 pcbsp->sp_cache[dir].cachesp = sp; 357 if (pcbsp->sp_cache[dir].cachesp) { 358 pcbsp->sp_cache[dir].cachesp->refcnt++; 359 KEYDEBUG(KEYDEBUG_IPSEC_STAMP, 360 printf("DP %s cause refcnt++:%d SP:%p\n", __func__, 361 pcbsp->sp_cache[dir].cachesp->refcnt, 362 pcbsp->sp_cache[dir].cachesp)); 363 364 /* 365 * If the PCB is connected, we can remember a hint to 366 * possibly short-circuit IPsec processing in other places. 367 */ 368 if (pcbsp->sp_cacheflags & IPSEC_PCBSP_CONNECTED) { 369 switch (pcbsp->sp_cache[dir].cachesp->policy) { 370 case IPSEC_POLICY_NONE: 371 case IPSEC_POLICY_BYPASS: 372 pcbsp->sp_cache[dir].cachehint = 373 IPSEC_PCBHINT_NO; 374 break; 375 default: 376 pcbsp->sp_cache[dir].cachehint = 377 IPSEC_PCBHINT_YES; 378 } 379 } 380 } 381 pcbsp->sp_cache[dir].cachegen = ipsec_spdgen; 382 383 return 0; 384 } 385 386 static int 387 ipsec_invalpcbcache(struct inpcbpolicy *pcbsp, int dir) 388 { 389 int i; 390 391 for (i = IPSEC_DIR_INBOUND; i <= IPSEC_DIR_OUTBOUND; i++) { 392 if (dir != IPSEC_DIR_ANY && i != dir) 393 continue; 394 if (pcbsp->sp_cache[i].cachesp) 395 KEY_FREESP(&pcbsp->sp_cache[i].cachesp); 396 pcbsp->sp_cache[i].cachesp = NULL; 397 pcbsp->sp_cache[i].cachehint = IPSEC_PCBHINT_MAYBE; 398 pcbsp->sp_cache[i].cachegen = 0; 399 memset(&pcbsp->sp_cache[i].cacheidx, 0, 400 sizeof(pcbsp->sp_cache[i].cacheidx)); 401 } 402 return 0; 403 } 404 405 void 406 ipsec_pcbconn(struct inpcbpolicy *pcbsp) 407 { 408 409 pcbsp->sp_cacheflags |= IPSEC_PCBSP_CONNECTED; 410 ipsec_invalpcbcache(pcbsp, IPSEC_DIR_ANY); 411 } 412 413 void 414 ipsec_pcbdisconn(struct inpcbpolicy *pcbsp) 415 { 416 417 pcbsp->sp_cacheflags &= ~IPSEC_PCBSP_CONNECTED; 418 ipsec_invalpcbcache(pcbsp, IPSEC_DIR_ANY); 419 } 420 421 void 422 ipsec_invalpcbcacheall(void) 423 { 424 425 if (ipsec_spdgen == UINT_MAX) 426 ipsec_spdgen = 1; 427 else 428 ipsec_spdgen++; 429 } 430 #endif /* __NetBSD__ */ 431 432 /* 433 * Return a held reference to the default SP. 434 */ 435 static struct secpolicy * 436 key_allocsp_default(int af, const char *where, int tag) 437 { 438 struct secpolicy *sp; 439 440 KEYDEBUG(KEYDEBUG_IPSEC_STAMP, 441 printf("DP %s from %s:%u\n", __func__, where, tag)); 442 443 switch(af) { 444 case AF_INET: 445 sp = &ip4_def_policy; 446 break; 447 #ifdef INET6 448 case AF_INET6: 449 sp = &ip6_def_policy; 450 break; 451 #endif 452 default: 453 KEYDEBUG(KEYDEBUG_IPSEC_STAMP, 454 printf("%s: unexpected protocol family %u\n", __func__, 455 af)); 456 return NULL; 457 } 458 459 if (sp->policy != IPSEC_POLICY_DISCARD && 460 sp->policy != IPSEC_POLICY_NONE) { 461 ipseclog((LOG_INFO, "fixed system default policy: %d->%d\n", 462 sp->policy, IPSEC_POLICY_NONE)); 463 sp->policy = IPSEC_POLICY_NONE; 464 } 465 sp->refcnt++; 466 467 KEYDEBUG(KEYDEBUG_IPSEC_STAMP, printf("DP %s returns SP:%p (%u)\n", 468 __func__, sp, sp->refcnt)); 469 return sp; 470 } 471 #define KEY_ALLOCSP_DEFAULT(af) \ 472 key_allocsp_default((af),__FILE__, __LINE__) 473 474 /* 475 * For OUTBOUND packet having a socket. Searching SPD for packet, 476 * and return a pointer to SP. 477 * OUT: NULL: no apropreate SP found, the following value is set to error. 478 * 0 : bypass 479 * EACCES : discard packet. 480 * ENOENT : ipsec_acquire() in progress, maybe. 481 * others : error occurred. 482 * others: a pointer to SP 483 * 484 * NOTE: IPv6 mapped address concern is implemented here. 485 */ 486 struct secpolicy * 487 ipsec_getpolicy(const struct tdb_ident *tdbi, u_int dir) 488 { 489 struct secpolicy *sp; 490 491 IPSEC_ASSERT(tdbi != NULL, ("%s: null tdbi", __func__)); 492 IPSEC_ASSERT(dir == IPSEC_DIR_INBOUND || dir == IPSEC_DIR_OUTBOUND, 493 ("%s: invalid direction %u", __func__, dir)); 494 495 sp = KEY_ALLOCSP2(tdbi->spi, &tdbi->dst, tdbi->proto, dir); 496 if (sp == NULL) /*XXX????*/ 497 sp = KEY_ALLOCSP_DEFAULT(tdbi->dst.sa.sa_family); 498 IPSEC_ASSERT(sp != NULL, ("%s: null SP", __func__)); 499 return sp; 500 } 501 502 /* 503 * For OUTBOUND packet having a socket. Searching SPD for packet, 504 * and return a pointer to SP. 505 * OUT: NULL: no apropreate SP found, the following value is set to error. 506 * 0 : bypass 507 * EACCES : discard packet. 508 * ENOENT : ipsec_acquire() in progress, maybe. 509 * others : error occurred. 510 * others: a pointer to SP 511 * 512 * NOTE: IPv6 mapped address concern is implemented here. 513 */ 514 static struct secpolicy * 515 ipsec_getpolicybysock(struct mbuf *m, u_int dir, PCB_T *inp, int *error) 516 { 517 struct inpcbpolicy *pcbsp = NULL; 518 struct secpolicy *currsp = NULL; /* policy on socket */ 519 struct secpolicy *sp; 520 int af; 521 522 IPSEC_ASSERT(m != NULL, ("%s: null mbuf", __func__)); 523 IPSEC_ASSERT(inp != NULL, ("%s: null inpcb", __func__)); 524 IPSEC_ASSERT(error != NULL, ("%s: null error", __func__)); 525 IPSEC_ASSERT(dir == IPSEC_DIR_INBOUND || dir == IPSEC_DIR_OUTBOUND, 526 ("%s: invalid direction %u", __func__, dir)); 527 528 IPSEC_ASSERT(PCB_SOCKET(inp) != NULL, ("%s: null socket", __func__)); 529 530 /* XXX FIXME inpcb/in6pcb vs socket*/ 531 af = PCB_FAMILY(inp); 532 IPSEC_ASSERT(af == AF_INET || af == AF_INET6, 533 ("%s: unexpected protocol family %u", __func__, af)); 534 535 #ifdef __NetBSD__ 536 IPSEC_ASSERT(inp->inph_sp != NULL, ("null PCB policy cache")); 537 /* If we have a cached entry, and if it is still valid, use it. */ 538 IPSEC_STATINC(IPSEC_STAT_SPDCACHELOOKUP); 539 currsp = ipsec_checkpcbcache(m, /*inpcb_hdr*/inp->inph_sp, dir); 540 if (currsp) { 541 *error = 0; 542 return currsp; 543 } 544 IPSEC_STATINC(IPSEC_STAT_SPDCACHEMISS); 545 #endif /* __NetBSD__ */ 546 547 switch (af) { 548 case AF_INET: { 549 struct inpcb *in4p = PCB_TO_IN4PCB(inp); 550 /* set spidx in pcb */ 551 *error = ipsec4_setspidx_inpcb(m, in4p); 552 pcbsp = in4p->inp_sp; 553 break; 554 } 555 556 #if defined(INET6) 557 case AF_INET6: { 558 struct in6pcb *in6p = PCB_TO_IN6PCB(inp); 559 /* set spidx in pcb */ 560 *error = ipsec6_setspidx_in6pcb(m, in6p); 561 pcbsp = in6p->in6p_sp; 562 break; 563 } 564 #endif 565 default: 566 *error = EPFNOSUPPORT; 567 break; 568 } 569 if (*error) 570 return NULL; 571 572 IPSEC_ASSERT(pcbsp != NULL, ("%s: null pcbsp", __func__)); 573 switch (dir) { 574 case IPSEC_DIR_INBOUND: 575 currsp = pcbsp->sp_in; 576 break; 577 case IPSEC_DIR_OUTBOUND: 578 currsp = pcbsp->sp_out; 579 break; 580 } 581 IPSEC_ASSERT(currsp != NULL, ("%s: null currsp", __func__)); 582 583 if (pcbsp->priv) { /* when privilieged socket */ 584 switch (currsp->policy) { 585 case IPSEC_POLICY_BYPASS: 586 case IPSEC_POLICY_IPSEC: 587 currsp->refcnt++; 588 sp = currsp; 589 break; 590 591 case IPSEC_POLICY_ENTRUST: 592 /* look for a policy in SPD */ 593 sp = KEY_ALLOCSP(&currsp->spidx, dir); 594 if (sp == NULL) /* no SP found */ 595 sp = KEY_ALLOCSP_DEFAULT(af); 596 break; 597 598 default: 599 ipseclog((LOG_ERR, "%s: Invalid policy for PCB %d\n", 600 __func__, currsp->policy)); 601 *error = EINVAL; 602 return NULL; 603 } 604 } else { /* unpriv, SPD has policy */ 605 sp = KEY_ALLOCSP(&currsp->spidx, dir); 606 if (sp == NULL) { /* no SP found */ 607 switch (currsp->policy) { 608 case IPSEC_POLICY_BYPASS: 609 ipseclog((LOG_ERR, "%s: Illegal policy for " 610 "non-priviliged defined %d\n", __func__, 611 currsp->policy)); 612 *error = EINVAL; 613 return NULL; 614 615 case IPSEC_POLICY_ENTRUST: 616 sp = KEY_ALLOCSP_DEFAULT(af); 617 break; 618 619 case IPSEC_POLICY_IPSEC: 620 currsp->refcnt++; 621 sp = currsp; 622 break; 623 624 default: 625 ipseclog((LOG_ERR, "%s: Invalid policy for " 626 "PCB %d\n", __func__, currsp->policy)); 627 *error = EINVAL; 628 return NULL; 629 } 630 } 631 } 632 IPSEC_ASSERT(sp != NULL, 633 ("%s: null SP (priv %u policy %u", __func__, pcbsp->priv, 634 currsp->policy)); 635 KEYDEBUG(KEYDEBUG_IPSEC_STAMP, 636 printf("DP %s (priv %u policy %u) allocates SP:%p (refcnt %u)\n", 637 __func__, pcbsp->priv, currsp->policy, sp, sp->refcnt)); 638 #ifdef __NetBSD__ 639 ipsec_fillpcbcache(pcbsp, m, sp, dir); 640 #endif /* __NetBSD__ */ 641 return sp; 642 } 643 644 /* 645 * For FORWADING packet or OUTBOUND without a socket. Searching SPD for packet, 646 * and return a pointer to SP. 647 * OUT: positive: a pointer to the entry for security policy leaf matched. 648 * NULL: no apropreate SP found, the following value is set to error. 649 * 0 : bypass 650 * EACCES : discard packet. 651 * ENOENT : ipsec_acquire() in progress, maybe. 652 * others : error occurred. 653 */ 654 struct secpolicy * 655 ipsec_getpolicybyaddr(struct mbuf *m, u_int dir, int flag, int *error) 656 { 657 struct secpolicyindex spidx; 658 struct secpolicy *sp; 659 660 IPSEC_ASSERT(m != NULL, ("%s: null mbuf", __func__)); 661 IPSEC_ASSERT(error != NULL, ("%s: null error", __func__)); 662 IPSEC_ASSERT(dir == IPSEC_DIR_INBOUND || dir == IPSEC_DIR_OUTBOUND, 663 ("%s: invalid direction %u", __func__, dir)); 664 665 sp = NULL; 666 667 /* Make an index to look for a policy. */ 668 *error = ipsec_setspidx(m, &spidx, (flag & IP_FORWARDING) ? 0 : 1); 669 if (*error != 0) { 670 DPRINTF(("%s: setpidx failed, dir %u flag %u\n", __func__, 671 dir, flag)); 672 memset(&spidx, 0, sizeof (spidx)); 673 return NULL; 674 } 675 676 spidx.dir = dir; 677 678 if (key_havesp(dir)) { 679 sp = KEY_ALLOCSP(&spidx, dir); 680 } 681 682 if (sp == NULL) /* no SP found, use system default */ 683 sp = KEY_ALLOCSP_DEFAULT(spidx.dst.sa.sa_family); 684 IPSEC_ASSERT(sp != NULL, ("%s: null SP", __func__)); 685 return sp; 686 } 687 688 struct secpolicy * 689 ipsec4_checkpolicy(struct mbuf *m, u_int dir, u_int flag, int *error, 690 struct inpcb *inp) 691 { 692 struct secpolicy *sp; 693 694 *error = 0; 695 696 697 /* XXX KAME IPv6 calls us with non-null inp but bogus inp_socket? */ 698 if (inp == NULL || inp->inp_socket == NULL) { 699 sp = ipsec_getpolicybyaddr(m, dir, flag, error); 700 } else 701 sp = ipsec_getpolicybysock(m, dir, IN4PCB_TO_PCB(inp), error); 702 if (sp == NULL) { 703 IPSEC_ASSERT(*error != 0, 704 ("%s: getpolicy failed w/o error", __func__)); 705 IPSEC_STATINC(IPSEC_STAT_OUT_INVAL); 706 return NULL; 707 } 708 IPSEC_ASSERT(*error == 0, ("%s: sp w/ error set to %u", __func__, 709 *error)); 710 switch (sp->policy) { 711 case IPSEC_POLICY_ENTRUST: 712 default: 713 printf("%s: invalid policy %u\n", __func__, sp->policy); 714 /* fall thru... */ 715 case IPSEC_POLICY_DISCARD: 716 IPSEC_STATINC(IPSEC_STAT_OUT_POLVIO); 717 *error = -EINVAL; /* packet is discarded by caller */ 718 break; 719 case IPSEC_POLICY_BYPASS: 720 case IPSEC_POLICY_NONE: 721 KEY_FREESP(&sp); 722 sp = NULL; /* NB: force NULL result */ 723 break; 724 case IPSEC_POLICY_IPSEC: 725 if (sp->req == NULL) /* acquire an SA */ 726 *error = key_spdacquire(sp); 727 break; 728 } 729 if (*error != 0) { 730 KEY_FREESP(&sp); 731 sp = NULL; 732 DPRINTF(("%s: done, error %d\n", __func__, *error)); 733 } 734 return sp; 735 } 736 737 int 738 ipsec4_output(struct mbuf *m, struct socket *so, int flags, 739 struct secpolicy **sp_out, u_long *mtu, bool *natt_frag, bool *done) 740 { 741 const struct ip *ip = mtod(m, const struct ip *); 742 struct secpolicy *sp = NULL; 743 struct inpcb *inp; 744 int error, s; 745 746 inp = (so && so->so_proto->pr_domain->dom_family == AF_INET) ? 747 (struct inpcb *)so->so_pcb : NULL; 748 749 /* 750 * Check the security policy (SP) for the packet and, if required, 751 * do IPsec-related processing. There are two cases here; the first 752 * time a packet is sent through it will be untagged and handled by 753 * ipsec4_checkpolicy(). If the packet is resubmitted to ip_output 754 * (e.g. after AH, ESP, etc. processing), there will be a tag to 755 * bypass the lookup and related policy checking. 756 */ 757 if (ipsec_outdone(m)) { 758 return 0; 759 } 760 s = splsoftnet(); 761 if (inp && IPSEC_PCB_SKIP_IPSEC(inp->inp_sp, IPSEC_DIR_OUTBOUND)) { 762 splx(s); 763 return 0; 764 } 765 sp = ipsec4_checkpolicy(m, IPSEC_DIR_OUTBOUND, flags, &error, inp); 766 767 /* 768 * There are four return cases: 769 * sp != NULL apply IPsec policy 770 * sp == NULL, error == 0 no IPsec handling needed 771 * sp == NULL, error == -EINVAL discard packet w/o error 772 * sp == NULL, error != 0 discard packet, report error 773 */ 774 if (sp == NULL) { 775 splx(s); 776 if (error) { 777 /* 778 * Hack: -EINVAL is used to signal that a packet 779 * should be silently discarded. This is typically 780 * because we asked key management for an SA and 781 * it was delayed (e.g. kicked up to IKE). 782 */ 783 if (error == -EINVAL) 784 error = 0; 785 m_freem(m); 786 *done = true; 787 return error; 788 } 789 /* No IPsec processing for this packet. */ 790 return 0; 791 } 792 *sp_out = sp; 793 794 /* 795 * NAT-T ESP fragmentation: do not do IPSec processing now, 796 * we will do it on each fragmented packet. 797 */ 798 if (sp->req->sav && (sp->req->sav->natt_type & 799 (UDP_ENCAP_ESPINUDP|UDP_ENCAP_ESPINUDP_NON_IKE))) { 800 if (ntohs(ip->ip_len) > sp->req->sav->esp_frag) { 801 *mtu = sp->req->sav->esp_frag; 802 *natt_frag = true; 803 splx(s); 804 return 0; 805 } 806 } 807 808 /* 809 * Do delayed checksums now because we send before 810 * this is done in the normal processing path. 811 */ 812 if (m->m_pkthdr.csum_flags & (M_CSUM_TCPv4|M_CSUM_UDPv4)) { 813 in_delayed_cksum(m); 814 m->m_pkthdr.csum_flags &= ~(M_CSUM_TCPv4|M_CSUM_UDPv4); 815 } 816 817 /* Note: callee frees mbuf */ 818 error = ipsec4_process_packet(m, sp->req, flags, 0); 819 /* 820 * Preserve KAME behaviour: ENOENT can be returned 821 * when an SA acquire is in progress. Don't propagate 822 * this to user-level; it confuses applications. 823 * 824 * XXX this will go away when the SADB is redone. 825 */ 826 if (error == ENOENT) 827 error = 0; 828 splx(s); 829 *done = true; 830 return error; 831 } 832 833 int 834 ipsec4_input(struct mbuf *m, int flags) 835 { 836 struct m_tag *mtag; 837 struct tdb_ident *tdbi; 838 struct secpolicy *sp; 839 int error, s; 840 841 /* 842 * Check if the packet has already had IPsec processing done. 843 * If so, then just pass it along. This tag gets set during AH, 844 * ESP, etc. input handling, before the packet is returned to 845 * the IP input queue for delivery. 846 */ 847 mtag = m_tag_find(m, PACKET_TAG_IPSEC_IN_DONE, NULL); 848 s = splsoftnet(); 849 if (mtag != NULL) { 850 tdbi = (struct tdb_ident *)(mtag + 1); 851 sp = ipsec_getpolicy(tdbi, IPSEC_DIR_INBOUND); 852 } else { 853 sp = ipsec_getpolicybyaddr(m, IPSEC_DIR_INBOUND, 854 IP_FORWARDING, &error); 855 } 856 if (sp == NULL) { 857 splx(s); 858 return EINVAL; 859 } 860 861 /* 862 * Check security policy against packet attributes. 863 */ 864 error = ipsec_in_reject(sp, m); 865 KEY_FREESP(&sp); 866 splx(s); 867 if (error) { 868 return error; 869 } 870 871 if (flags == 0) { 872 /* We are done. */ 873 return 0; 874 } 875 876 /* 877 * Peek at the outbound SP for this packet to determine if 878 * it is a Fast Forward candidate. 879 */ 880 mtag = m_tag_find(m, PACKET_TAG_IPSEC_PENDING_TDB, NULL); 881 if (mtag != NULL) { 882 m->m_flags &= ~M_CANFASTFWD; 883 return 0; 884 } 885 886 s = splsoftnet(); 887 sp = ipsec4_checkpolicy(m, IPSEC_DIR_OUTBOUND, flags, &error, NULL); 888 if (sp != NULL) { 889 m->m_flags &= ~M_CANFASTFWD; 890 KEY_FREESP(&sp); 891 } 892 splx(s); 893 return 0; 894 } 895 896 int 897 ipsec4_forward(struct mbuf *m, int *destmtu) 898 { 899 /* 900 * If the packet is routed over IPsec tunnel, tell the 901 * originator the tunnel MTU. 902 * tunnel MTU = if MTU - sizeof(IP) - ESP/AH hdrsiz 903 * XXX quickhack!!! 904 */ 905 struct secpolicy *sp; 906 size_t ipsechdr; 907 int error; 908 909 sp = ipsec4_getpolicybyaddr(m, 910 IPSEC_DIR_OUTBOUND, IP_FORWARDING, &error); 911 if (sp == NULL) { 912 return EINVAL; 913 } 914 915 /* Count IPsec header size. */ 916 ipsechdr = ipsec4_hdrsiz(m, IPSEC_DIR_OUTBOUND, NULL); 917 918 /* 919 * Find the correct route for outer IPv4 header, compute tunnel MTU. 920 */ 921 if (sp->req && sp->req->sav && sp->req->sav->sah) { 922 struct route *ro; 923 struct rtentry *rt; 924 925 ro = &sp->req->sav->sah->sa_route; 926 rt = rtcache_validate(ro); 927 if (rt && rt->rt_ifp) { 928 *destmtu = rt->rt_rmx.rmx_mtu ? 929 rt->rt_rmx.rmx_mtu : rt->rt_ifp->if_mtu; 930 *destmtu -= ipsechdr; 931 } 932 rtcache_unref(rt, ro); 933 } 934 KEY_FREESP(&sp); 935 return 0; 936 } 937 938 #ifdef INET6 939 struct secpolicy * 940 ipsec6_checkpolicy(struct mbuf *m, u_int dir, u_int flag, int *error, 941 struct in6pcb *in6p) 942 { 943 struct secpolicy *sp; 944 945 *error = 0; 946 947 948 /* XXX KAME IPv6 calls us with non-null inp but bogus inp_socket? */ 949 if (in6p == NULL || in6p->in6p_socket == NULL) { 950 sp = ipsec_getpolicybyaddr(m, dir, flag, error); 951 } else 952 sp = ipsec_getpolicybysock(m, dir, IN6PCB_TO_PCB(in6p), error); 953 if (sp == NULL) { 954 IPSEC_ASSERT(*error != 0, ("%s: getpolicy failed w/o error", 955 __func__)); 956 IPSEC_STATINC(IPSEC_STAT_OUT_INVAL); 957 return NULL; 958 } 959 IPSEC_ASSERT(*error == 0, ("%s: sp w/ error set to %u", __func__, 960 *error)); 961 switch (sp->policy) { 962 case IPSEC_POLICY_ENTRUST: 963 default: 964 printf("%s: invalid policy %u\n", __func__, sp->policy); 965 /* fall thru... */ 966 case IPSEC_POLICY_DISCARD: 967 IPSEC_STATINC(IPSEC_STAT_OUT_POLVIO); 968 *error = -EINVAL; /* packet is discarded by caller */ 969 break; 970 case IPSEC_POLICY_BYPASS: 971 case IPSEC_POLICY_NONE: 972 KEY_FREESP(&sp); 973 sp = NULL; /* NB: force NULL result */ 974 break; 975 case IPSEC_POLICY_IPSEC: 976 if (sp->req == NULL) /* acquire an SA */ 977 *error = key_spdacquire(sp); 978 break; 979 } 980 if (*error != 0) { 981 KEY_FREESP(&sp); 982 sp = NULL; 983 DPRINTF(("%s: done, error %d\n", __func__, *error)); 984 } 985 return sp; 986 } 987 #endif /* INET6 */ 988 989 static int 990 ipsec4_setspidx_inpcb(struct mbuf *m, struct inpcb *pcb) 991 { 992 int error; 993 994 IPSEC_ASSERT(pcb != NULL, ("%s: null pcb", __func__)); 995 IPSEC_ASSERT(pcb->inp_sp != NULL, ("%s: null inp_sp", __func__)); 996 IPSEC_ASSERT(pcb->inp_sp->sp_out != NULL && pcb->inp_sp->sp_in != NULL, 997 ("%s: null sp_in || sp_out", __func__)); 998 999 error = ipsec_setspidx(m, &pcb->inp_sp->sp_in->spidx, 1); 1000 if (error == 0) { 1001 pcb->inp_sp->sp_in->spidx.dir = IPSEC_DIR_INBOUND; 1002 pcb->inp_sp->sp_out->spidx = pcb->inp_sp->sp_in->spidx; 1003 pcb->inp_sp->sp_out->spidx.dir = IPSEC_DIR_OUTBOUND; 1004 } else { 1005 memset(&pcb->inp_sp->sp_in->spidx, 0, 1006 sizeof (pcb->inp_sp->sp_in->spidx)); 1007 memset(&pcb->inp_sp->sp_out->spidx, 0, 1008 sizeof (pcb->inp_sp->sp_in->spidx)); 1009 } 1010 return error; 1011 } 1012 1013 #ifdef INET6 1014 static int 1015 ipsec6_setspidx_in6pcb(struct mbuf *m, struct in6pcb *pcb) 1016 { 1017 struct secpolicyindex *spidx; 1018 int error; 1019 1020 IPSEC_ASSERT(pcb != NULL, ("%s: null pcb", __func__)); 1021 IPSEC_ASSERT(pcb->in6p_sp != NULL, ("%s: null inp_sp", __func__)); 1022 IPSEC_ASSERT(pcb->in6p_sp->sp_out != NULL && 1023 pcb->in6p_sp->sp_in != NULL, ("%s: null sp_in || sp_out", 1024 __func__)); 1025 1026 memset(&pcb->in6p_sp->sp_in->spidx, 0, sizeof(*spidx)); 1027 memset(&pcb->in6p_sp->sp_out->spidx, 0, sizeof(*spidx)); 1028 1029 spidx = &pcb->in6p_sp->sp_in->spidx; 1030 error = ipsec_setspidx(m, spidx, 1); 1031 if (error) 1032 goto bad; 1033 spidx->dir = IPSEC_DIR_INBOUND; 1034 1035 spidx = &pcb->in6p_sp->sp_out->spidx; 1036 error = ipsec_setspidx(m, spidx, 1); 1037 if (error) 1038 goto bad; 1039 spidx->dir = IPSEC_DIR_OUTBOUND; 1040 1041 return 0; 1042 1043 bad: 1044 memset(&pcb->in6p_sp->sp_in->spidx, 0, sizeof(*spidx)); 1045 memset(&pcb->in6p_sp->sp_out->spidx, 0, sizeof(*spidx)); 1046 return error; 1047 } 1048 #endif 1049 1050 /* 1051 * configure security policy index (src/dst/proto/sport/dport) 1052 * by looking at the content of mbuf. 1053 * the caller is responsible for error recovery (like clearing up spidx). 1054 */ 1055 static int 1056 ipsec_setspidx(struct mbuf *m, struct secpolicyindex *spidx, int needport) 1057 { 1058 struct ip *ip = NULL; 1059 struct ip ipbuf; 1060 u_int v; 1061 struct mbuf *n; 1062 int len; 1063 int error; 1064 1065 IPSEC_ASSERT(m != NULL, ("%s: null mbuf", __func__)); 1066 1067 /* 1068 * validate m->m_pkthdr.len. we see incorrect length if we 1069 * mistakenly call this function with inconsistent mbuf chain 1070 * (like 4.4BSD tcp/udp processing). XXX should we panic here? 1071 */ 1072 len = 0; 1073 for (n = m; n; n = n->m_next) 1074 len += n->m_len; 1075 if (m->m_pkthdr.len != len) { 1076 KEYDEBUG(KEYDEBUG_IPSEC_DUMP, printf("%s: total of m_len(%d) " 1077 "!= pkthdr.len(%d), ignored.\n", __func__, len, 1078 m->m_pkthdr.len)); 1079 return EINVAL; 1080 } 1081 1082 if (m->m_pkthdr.len < sizeof(struct ip)) { 1083 KEYDEBUG(KEYDEBUG_IPSEC_DUMP, printf("%s: pkthdr.len(%d) < " 1084 "sizeof(struct ip), ignored.\n", __func__, 1085 m->m_pkthdr.len)); 1086 return EINVAL; 1087 } 1088 1089 if (m->m_len >= sizeof(*ip)) 1090 ip = mtod(m, struct ip *); 1091 else { 1092 m_copydata(m, 0, sizeof(ipbuf), &ipbuf); 1093 ip = &ipbuf; 1094 } 1095 v = ip->ip_v; 1096 switch (v) { 1097 case 4: 1098 error = ipsec4_setspidx_ipaddr(m, spidx); 1099 if (error) 1100 return error; 1101 ipsec4_get_ulp(m, spidx, needport); 1102 return 0; 1103 #ifdef INET6 1104 case 6: 1105 if (m->m_pkthdr.len < sizeof(struct ip6_hdr)) { 1106 KEYDEBUG(KEYDEBUG_IPSEC_DUMP, printf("%s: " 1107 "pkthdr.len(%d) < sizeof(struct ip6_hdr), " 1108 "ignored.\n", __func__, m->m_pkthdr.len)); 1109 return EINVAL; 1110 } 1111 error = ipsec6_setspidx_ipaddr(m, spidx); 1112 if (error) 1113 return error; 1114 ipsec6_get_ulp(m, spidx, needport); 1115 return 0; 1116 #endif 1117 default: 1118 KEYDEBUG(KEYDEBUG_IPSEC_DUMP, printf("%s: unknown IP version " 1119 "%u, ignored.\n", __func__, v)); 1120 return EINVAL; 1121 } 1122 } 1123 1124 static void 1125 ipsec4_get_ulp(struct mbuf *m, struct secpolicyindex *spidx, int needport) 1126 { 1127 u_int8_t nxt; 1128 int off; 1129 1130 /* sanity check */ 1131 IPSEC_ASSERT(m != NULL, ("%s: null mbuf", __func__)); 1132 IPSEC_ASSERT(m->m_pkthdr.len >= sizeof(struct ip), 1133 ("%s: packet too short", __func__)); 1134 1135 /* NB: ip_input() flips it into host endian XXX need more checking */ 1136 if (m->m_len >= sizeof(struct ip)) { 1137 struct ip *ip = mtod(m, struct ip *); 1138 if (ip->ip_off & IP_OFF_CONVERT(IP_MF | IP_OFFMASK)) 1139 goto done; 1140 off = ip->ip_hl << 2; 1141 nxt = ip->ip_p; 1142 } else { 1143 struct ip ih; 1144 1145 m_copydata(m, 0, sizeof (struct ip), &ih); 1146 if (ih.ip_off & IP_OFF_CONVERT(IP_MF | IP_OFFMASK)) 1147 goto done; 1148 off = ih.ip_hl << 2; 1149 nxt = ih.ip_p; 1150 } 1151 1152 while (off < m->m_pkthdr.len) { 1153 struct ip6_ext ip6e; 1154 struct tcphdr th; 1155 struct udphdr uh; 1156 struct icmp icmph; 1157 1158 switch (nxt) { 1159 case IPPROTO_TCP: 1160 spidx->ul_proto = nxt; 1161 if (!needport) 1162 goto done_proto; 1163 if (off + sizeof(struct tcphdr) > m->m_pkthdr.len) 1164 goto done; 1165 m_copydata(m, off, sizeof (th), &th); 1166 spidx->src.sin.sin_port = th.th_sport; 1167 spidx->dst.sin.sin_port = th.th_dport; 1168 return; 1169 case IPPROTO_UDP: 1170 spidx->ul_proto = nxt; 1171 if (!needport) 1172 goto done_proto; 1173 if (off + sizeof(struct udphdr) > m->m_pkthdr.len) 1174 goto done; 1175 m_copydata(m, off, sizeof (uh), &uh); 1176 spidx->src.sin.sin_port = uh.uh_sport; 1177 spidx->dst.sin.sin_port = uh.uh_dport; 1178 return; 1179 case IPPROTO_AH: 1180 if (m->m_pkthdr.len > off + sizeof(ip6e)) 1181 goto done; 1182 /* XXX sigh, this works but is totally bogus */ 1183 m_copydata(m, off, sizeof(ip6e), &ip6e); 1184 off += (ip6e.ip6e_len + 2) << 2; 1185 nxt = ip6e.ip6e_nxt; 1186 break; 1187 case IPPROTO_ICMP: 1188 spidx->ul_proto = nxt; 1189 if (off + sizeof(struct icmp) > m->m_pkthdr.len) 1190 return; 1191 m_copydata(m, off, sizeof(icmph), &icmph); 1192 ((struct sockaddr_in *)&spidx->src)->sin_port = 1193 htons((uint16_t)icmph.icmp_type); 1194 ((struct sockaddr_in *)&spidx->dst)->sin_port = 1195 htons((uint16_t)icmph.icmp_code); 1196 return; 1197 default: 1198 /* XXX intermediate headers??? */ 1199 spidx->ul_proto = nxt; 1200 goto done_proto; 1201 } 1202 } 1203 done: 1204 spidx->ul_proto = IPSEC_ULPROTO_ANY; 1205 done_proto: 1206 spidx->src.sin.sin_port = IPSEC_PORT_ANY; 1207 spidx->dst.sin.sin_port = IPSEC_PORT_ANY; 1208 } 1209 1210 /* assumes that m is sane */ 1211 static int 1212 ipsec4_setspidx_ipaddr(struct mbuf *m, struct secpolicyindex *spidx) 1213 { 1214 static const struct sockaddr_in template = { 1215 sizeof (struct sockaddr_in), 1216 AF_INET, 1217 0, { 0 }, { 0, 0, 0, 0, 0, 0, 0, 0 } 1218 }; 1219 1220 spidx->src.sin = template; 1221 spidx->dst.sin = template; 1222 1223 if (m->m_len < sizeof (struct ip)) { 1224 m_copydata(m, offsetof(struct ip, ip_src), 1225 sizeof (struct in_addr), 1226 &spidx->src.sin.sin_addr); 1227 m_copydata(m, offsetof(struct ip, ip_dst), 1228 sizeof (struct in_addr), 1229 &spidx->dst.sin.sin_addr); 1230 } else { 1231 struct ip *ip = mtod(m, struct ip *); 1232 spidx->src.sin.sin_addr = ip->ip_src; 1233 spidx->dst.sin.sin_addr = ip->ip_dst; 1234 } 1235 1236 spidx->prefs = sizeof(struct in_addr) << 3; 1237 spidx->prefd = sizeof(struct in_addr) << 3; 1238 1239 return 0; 1240 } 1241 1242 #ifdef INET6 1243 static void 1244 ipsec6_get_ulp(struct mbuf *m, struct secpolicyindex *spidx, 1245 int needport) 1246 { 1247 int off, nxt; 1248 struct tcphdr th; 1249 struct udphdr uh; 1250 struct icmp6_hdr icmph; 1251 1252 /* sanity check */ 1253 if (m == NULL) 1254 panic("%s: NULL pointer was passed", __func__); 1255 1256 KEYDEBUG(KEYDEBUG_IPSEC_DUMP, printf("%s:\n", __func__); 1257 kdebug_mbuf(m)); 1258 1259 /* set default */ 1260 spidx->ul_proto = IPSEC_ULPROTO_ANY; 1261 ((struct sockaddr_in6 *)&spidx->src)->sin6_port = IPSEC_PORT_ANY; 1262 ((struct sockaddr_in6 *)&spidx->dst)->sin6_port = IPSEC_PORT_ANY; 1263 1264 nxt = -1; 1265 off = ip6_lasthdr(m, 0, IPPROTO_IPV6, &nxt); 1266 if (off < 0 || m->m_pkthdr.len < off) 1267 return; 1268 1269 switch (nxt) { 1270 case IPPROTO_TCP: 1271 spidx->ul_proto = nxt; 1272 if (!needport) 1273 break; 1274 if (off + sizeof(struct tcphdr) > m->m_pkthdr.len) 1275 break; 1276 m_copydata(m, off, sizeof(th), &th); 1277 ((struct sockaddr_in6 *)&spidx->src)->sin6_port = th.th_sport; 1278 ((struct sockaddr_in6 *)&spidx->dst)->sin6_port = th.th_dport; 1279 break; 1280 case IPPROTO_UDP: 1281 spidx->ul_proto = nxt; 1282 if (!needport) 1283 break; 1284 if (off + sizeof(struct udphdr) > m->m_pkthdr.len) 1285 break; 1286 m_copydata(m, off, sizeof(uh), &uh); 1287 ((struct sockaddr_in6 *)&spidx->src)->sin6_port = uh.uh_sport; 1288 ((struct sockaddr_in6 *)&spidx->dst)->sin6_port = uh.uh_dport; 1289 break; 1290 case IPPROTO_ICMPV6: 1291 spidx->ul_proto = nxt; 1292 if (off + sizeof(struct icmp6_hdr) > m->m_pkthdr.len) 1293 break; 1294 m_copydata(m, off, sizeof(icmph), &icmph); 1295 ((struct sockaddr_in6 *)&spidx->src)->sin6_port = 1296 htons((uint16_t)icmph.icmp6_type); 1297 ((struct sockaddr_in6 *)&spidx->dst)->sin6_port = 1298 htons((uint16_t)icmph.icmp6_code); 1299 break; 1300 default: 1301 /* XXX intermediate headers??? */ 1302 spidx->ul_proto = nxt; 1303 break; 1304 } 1305 } 1306 1307 /* assumes that m is sane */ 1308 static int 1309 ipsec6_setspidx_ipaddr(struct mbuf *m, struct secpolicyindex *spidx) 1310 { 1311 struct ip6_hdr *ip6 = NULL; 1312 struct ip6_hdr ip6buf; 1313 struct sockaddr_in6 *sin6; 1314 1315 if (m->m_len >= sizeof(*ip6)) 1316 ip6 = mtod(m, struct ip6_hdr *); 1317 else { 1318 m_copydata(m, 0, sizeof(ip6buf), &ip6buf); 1319 ip6 = &ip6buf; 1320 } 1321 1322 sin6 = (struct sockaddr_in6 *)&spidx->src; 1323 memset(sin6, 0, sizeof(*sin6)); 1324 sin6->sin6_family = AF_INET6; 1325 sin6->sin6_len = sizeof(struct sockaddr_in6); 1326 memcpy(&sin6->sin6_addr, &ip6->ip6_src, sizeof(ip6->ip6_src)); 1327 if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_src)) { 1328 sin6->sin6_addr.s6_addr16[1] = 0; 1329 sin6->sin6_scope_id = ntohs(ip6->ip6_src.s6_addr16[1]); 1330 } 1331 spidx->prefs = sizeof(struct in6_addr) << 3; 1332 1333 sin6 = (struct sockaddr_in6 *)&spidx->dst; 1334 memset(sin6, 0, sizeof(*sin6)); 1335 sin6->sin6_family = AF_INET6; 1336 sin6->sin6_len = sizeof(struct sockaddr_in6); 1337 memcpy(&sin6->sin6_addr, &ip6->ip6_dst, sizeof(ip6->ip6_dst)); 1338 if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_dst)) { 1339 sin6->sin6_addr.s6_addr16[1] = 0; 1340 sin6->sin6_scope_id = ntohs(ip6->ip6_dst.s6_addr16[1]); 1341 } 1342 spidx->prefd = sizeof(struct in6_addr) << 3; 1343 1344 return 0; 1345 } 1346 #endif 1347 1348 static void 1349 ipsec_delpcbpolicy(struct inpcbpolicy *p) 1350 { 1351 free(p, M_SECA); 1352 } 1353 1354 /* initialize policy in PCB */ 1355 int 1356 ipsec_init_policy(struct socket *so, struct inpcbpolicy **policy) 1357 { 1358 struct inpcbpolicy *new; 1359 1360 /* sanity check. */ 1361 if (so == NULL || policy == NULL) 1362 panic("%s: NULL pointer was passed", __func__); 1363 1364 new = malloc(sizeof(*new), M_SECA, M_NOWAIT|M_ZERO); 1365 if (new == NULL) { 1366 ipseclog((LOG_DEBUG, "%s: No more memory.\n", __func__)); 1367 return ENOBUFS; 1368 } 1369 1370 if (IPSEC_PRIVILEGED_SO(so)) 1371 new->priv = 1; 1372 else 1373 new->priv = 0; 1374 1375 if ((new->sp_in = KEY_NEWSP()) == NULL) { 1376 ipsec_delpcbpolicy(new); 1377 return ENOBUFS; 1378 } 1379 new->sp_in->state = IPSEC_SPSTATE_ALIVE; 1380 new->sp_in->policy = IPSEC_POLICY_ENTRUST; 1381 1382 if ((new->sp_out = KEY_NEWSP()) == NULL) { 1383 KEY_FREESP(&new->sp_in); 1384 ipsec_delpcbpolicy(new); 1385 return ENOBUFS; 1386 } 1387 new->sp_out->state = IPSEC_SPSTATE_ALIVE; 1388 new->sp_out->policy = IPSEC_POLICY_ENTRUST; 1389 1390 *policy = new; 1391 1392 return 0; 1393 } 1394 1395 /* copy old ipsec policy into new */ 1396 int 1397 ipsec_copy_policy(const struct inpcbpolicy *old, struct inpcbpolicy *new) 1398 { 1399 struct secpolicy *sp; 1400 1401 sp = ipsec_deepcopy_policy(old->sp_in); 1402 if (sp) { 1403 KEY_FREESP(&new->sp_in); 1404 new->sp_in = sp; 1405 } else 1406 return ENOBUFS; 1407 1408 sp = ipsec_deepcopy_policy(old->sp_out); 1409 if (sp) { 1410 KEY_FREESP(&new->sp_out); 1411 new->sp_out = sp; 1412 } else 1413 return ENOBUFS; 1414 1415 new->priv = old->priv; 1416 1417 return 0; 1418 } 1419 1420 /* deep-copy a policy in PCB */ 1421 static struct secpolicy * 1422 ipsec_deepcopy_policy(const struct secpolicy *src) 1423 { 1424 struct ipsecrequest *newchain = NULL; 1425 const struct ipsecrequest *p; 1426 struct ipsecrequest **q; 1427 struct ipsecrequest *r; 1428 struct secpolicy *dst; 1429 1430 if (src == NULL) 1431 return NULL; 1432 dst = KEY_NEWSP(); 1433 if (dst == NULL) 1434 return NULL; 1435 1436 /* 1437 * deep-copy IPsec request chain. This is required since struct 1438 * ipsecrequest is not reference counted. 1439 */ 1440 q = &newchain; 1441 for (p = src->req; p; p = p->next) { 1442 *q = malloc(sizeof(**q), M_SECA, M_NOWAIT|M_ZERO); 1443 if (*q == NULL) 1444 goto fail; 1445 (*q)->next = NULL; 1446 1447 (*q)->saidx.proto = p->saidx.proto; 1448 (*q)->saidx.mode = p->saidx.mode; 1449 (*q)->level = p->level; 1450 (*q)->saidx.reqid = p->saidx.reqid; 1451 1452 memcpy(&(*q)->saidx.src, &p->saidx.src, sizeof((*q)->saidx.src)); 1453 memcpy(&(*q)->saidx.dst, &p->saidx.dst, sizeof((*q)->saidx.dst)); 1454 1455 (*q)->sav = NULL; 1456 (*q)->sp = dst; 1457 1458 q = &((*q)->next); 1459 } 1460 1461 dst->req = newchain; 1462 dst->state = src->state; 1463 dst->policy = src->policy; 1464 /* do not touch the refcnt fields */ 1465 1466 return dst; 1467 1468 fail: 1469 for (q = &newchain; *q; q = &r) { 1470 r = (*q)->next; 1471 free(*q, M_SECA); 1472 } 1473 return NULL; 1474 } 1475 1476 /* set policy and ipsec request if present. */ 1477 static int 1478 ipsec_set_policy( 1479 struct secpolicy **policy, 1480 int optname, 1481 const void *request, 1482 size_t len, 1483 kauth_cred_t cred 1484 ) 1485 { 1486 const struct sadb_x_policy *xpl; 1487 struct secpolicy *newsp = NULL; 1488 int error; 1489 1490 /* sanity check. */ 1491 if (policy == NULL || *policy == NULL || request == NULL) 1492 return EINVAL; 1493 if (len < sizeof(*xpl)) 1494 return EINVAL; 1495 xpl = (const struct sadb_x_policy *)request; 1496 1497 KEYDEBUG(KEYDEBUG_IPSEC_DUMP, printf("%s: passed policy\n", __func__); 1498 kdebug_sadb_x_policy((const struct sadb_ext *)xpl)); 1499 1500 /* check policy type */ 1501 /* ipsec_set_policy() accepts IPSEC, ENTRUST and BYPASS. */ 1502 if (xpl->sadb_x_policy_type == IPSEC_POLICY_DISCARD 1503 || xpl->sadb_x_policy_type == IPSEC_POLICY_NONE) 1504 return EINVAL; 1505 1506 /* check privileged socket */ 1507 if (xpl->sadb_x_policy_type == IPSEC_POLICY_BYPASS) { 1508 error = kauth_authorize_network(cred, KAUTH_NETWORK_IPSEC, 1509 KAUTH_REQ_NETWORK_IPSEC_BYPASS, NULL, NULL, NULL); 1510 if (error) 1511 return (error); 1512 } 1513 1514 /* allocation new SP entry */ 1515 if ((newsp = key_msg2sp(xpl, len, &error)) == NULL) 1516 return error; 1517 1518 newsp->state = IPSEC_SPSTATE_ALIVE; 1519 1520 /* clear old SP and set new SP */ 1521 KEY_FREESP(policy); 1522 *policy = newsp; 1523 KEYDEBUG(KEYDEBUG_IPSEC_DUMP, printf("%s: new policy\n", __func__); 1524 kdebug_secpolicy(newsp)); 1525 1526 return 0; 1527 } 1528 1529 static int 1530 ipsec_get_policy(struct secpolicy *policy, struct mbuf **mp) 1531 { 1532 1533 /* sanity check. */ 1534 if (policy == NULL || mp == NULL) 1535 return EINVAL; 1536 1537 *mp = key_sp2msg(policy); 1538 if (!*mp) { 1539 ipseclog((LOG_DEBUG, "%s: No more memory.\n", __func__)); 1540 return ENOBUFS; 1541 } 1542 1543 (*mp)->m_type = MT_DATA; 1544 KEYDEBUG(KEYDEBUG_IPSEC_DUMP, printf("%s:\n", __func__); 1545 kdebug_mbuf(*mp)); 1546 1547 return 0; 1548 } 1549 1550 int 1551 ipsec4_set_policy(struct inpcb *inp, int optname, const void *request, 1552 size_t len, kauth_cred_t cred) 1553 { 1554 const struct sadb_x_policy *xpl; 1555 struct secpolicy **policy; 1556 1557 /* sanity check. */ 1558 if (inp == NULL || request == NULL) 1559 return EINVAL; 1560 if (len < sizeof(*xpl)) 1561 return EINVAL; 1562 xpl = (const struct sadb_x_policy *)request; 1563 1564 IPSEC_ASSERT(inp->inp_sp != NULL, ("%s: null inp->in_sp", __func__)); 1565 1566 /* select direction */ 1567 switch (xpl->sadb_x_policy_dir) { 1568 case IPSEC_DIR_INBOUND: 1569 policy = &inp->inp_sp->sp_in; 1570 break; 1571 case IPSEC_DIR_OUTBOUND: 1572 policy = &inp->inp_sp->sp_out; 1573 break; 1574 default: 1575 ipseclog((LOG_ERR, "%s: invalid direction=%u\n", __func__, 1576 xpl->sadb_x_policy_dir)); 1577 return EINVAL; 1578 } 1579 1580 return ipsec_set_policy(policy, optname, request, len, cred); 1581 } 1582 1583 int 1584 ipsec4_get_policy(struct inpcb *inp, const void *request, size_t len, 1585 struct mbuf **mp) 1586 { 1587 const struct sadb_x_policy *xpl; 1588 struct secpolicy *policy; 1589 1590 /* sanity check. */ 1591 if (inp == NULL || request == NULL || mp == NULL) 1592 return EINVAL; 1593 IPSEC_ASSERT(inp->inp_sp != NULL, ("%s: null inp_sp", __func__)); 1594 if (len < sizeof(*xpl)) 1595 return EINVAL; 1596 xpl = (const struct sadb_x_policy *)request; 1597 1598 /* select direction */ 1599 switch (xpl->sadb_x_policy_dir) { 1600 case IPSEC_DIR_INBOUND: 1601 policy = inp->inp_sp->sp_in; 1602 break; 1603 case IPSEC_DIR_OUTBOUND: 1604 policy = inp->inp_sp->sp_out; 1605 break; 1606 default: 1607 ipseclog((LOG_ERR, "%s: invalid direction=%u\n", __func__, 1608 xpl->sadb_x_policy_dir)); 1609 return EINVAL; 1610 } 1611 1612 return ipsec_get_policy(policy, mp); 1613 } 1614 1615 /* delete policy in PCB */ 1616 int 1617 ipsec4_delete_pcbpolicy(struct inpcb *inp) 1618 { 1619 IPSEC_ASSERT(inp != NULL, ("%s: null inp", __func__)); 1620 1621 if (inp->inp_sp == NULL) 1622 return 0; 1623 1624 if (inp->inp_sp->sp_in != NULL) 1625 KEY_FREESP(&inp->inp_sp->sp_in); 1626 1627 if (inp->inp_sp->sp_out != NULL) 1628 KEY_FREESP(&inp->inp_sp->sp_out); 1629 1630 #ifdef __NetBSD__ 1631 ipsec_invalpcbcache(inp->inp_sp, IPSEC_DIR_ANY); 1632 #endif 1633 1634 ipsec_delpcbpolicy(inp->inp_sp); 1635 inp->inp_sp = NULL; 1636 1637 return 0; 1638 } 1639 1640 #ifdef INET6 1641 int 1642 ipsec6_set_policy(struct in6pcb *in6p, int optname, const void *request, 1643 size_t len, kauth_cred_t cred) 1644 { 1645 const struct sadb_x_policy *xpl; 1646 struct secpolicy **policy; 1647 1648 /* sanity check. */ 1649 if (in6p == NULL || request == NULL) 1650 return EINVAL; 1651 if (len < sizeof(*xpl)) 1652 return EINVAL; 1653 xpl = (const struct sadb_x_policy *)request; 1654 1655 /* select direction */ 1656 switch (xpl->sadb_x_policy_dir) { 1657 case IPSEC_DIR_INBOUND: 1658 policy = &in6p->in6p_sp->sp_in; 1659 break; 1660 case IPSEC_DIR_OUTBOUND: 1661 policy = &in6p->in6p_sp->sp_out; 1662 break; 1663 default: 1664 ipseclog((LOG_ERR, "%s: invalid direction=%u\n", __func__, 1665 xpl->sadb_x_policy_dir)); 1666 return EINVAL; 1667 } 1668 1669 return ipsec_set_policy(policy, optname, request, len, cred); 1670 } 1671 1672 int 1673 ipsec6_get_policy(struct in6pcb *in6p, const void *request, size_t len, 1674 struct mbuf **mp) 1675 { 1676 const struct sadb_x_policy *xpl; 1677 struct secpolicy *policy; 1678 1679 /* sanity check. */ 1680 if (in6p == NULL || request == NULL || mp == NULL) 1681 return EINVAL; 1682 IPSEC_ASSERT(in6p->in6p_sp != NULL, ("%s: null in6p_sp", __func__)); 1683 if (len < sizeof(*xpl)) 1684 return EINVAL; 1685 xpl = (const struct sadb_x_policy *)request; 1686 1687 /* select direction */ 1688 switch (xpl->sadb_x_policy_dir) { 1689 case IPSEC_DIR_INBOUND: 1690 policy = in6p->in6p_sp->sp_in; 1691 break; 1692 case IPSEC_DIR_OUTBOUND: 1693 policy = in6p->in6p_sp->sp_out; 1694 break; 1695 default: 1696 ipseclog((LOG_ERR, "%s: invalid direction=%u\n", __func__, 1697 xpl->sadb_x_policy_dir)); 1698 return EINVAL; 1699 } 1700 1701 return ipsec_get_policy(policy, mp); 1702 } 1703 1704 int 1705 ipsec6_delete_pcbpolicy(struct in6pcb *in6p) 1706 { 1707 IPSEC_ASSERT(in6p != NULL, ("%s: null in6p", __func__)); 1708 1709 if (in6p->in6p_sp == NULL) 1710 return 0; 1711 1712 if (in6p->in6p_sp->sp_in != NULL) 1713 KEY_FREESP(&in6p->in6p_sp->sp_in); 1714 1715 if (in6p->in6p_sp->sp_out != NULL) 1716 KEY_FREESP(&in6p->in6p_sp->sp_out); 1717 1718 #ifdef __NetBSD 1719 ipsec_invalpcbcache(in6p->in6p_sp, IPSEC_DIR_ANY); 1720 #endif 1721 1722 ipsec_delpcbpolicy(in6p->in6p_sp); 1723 in6p->in6p_sp = NULL; 1724 1725 return 0; 1726 } 1727 #endif 1728 1729 /* 1730 * return current level. 1731 * Either IPSEC_LEVEL_USE or IPSEC_LEVEL_REQUIRE are always returned. 1732 */ 1733 u_int 1734 ipsec_get_reqlevel(const struct ipsecrequest *isr) 1735 { 1736 u_int level = 0; 1737 u_int esp_trans_deflev, esp_net_deflev; 1738 u_int ah_trans_deflev, ah_net_deflev; 1739 1740 IPSEC_ASSERT(isr != NULL && isr->sp != NULL, ("%s: null argument", 1741 __func__)); 1742 IPSEC_ASSERT(isr->sp->spidx.src.sa.sa_family == 1743 isr->sp->spidx.dst.sa.sa_family, 1744 ("%s: af family mismatch, src %u, dst %u", __func__, 1745 isr->sp->spidx.src.sa.sa_family, isr->sp->spidx.dst.sa.sa_family)); 1746 1747 /* XXX note that we have ipseclog() expanded here - code sync issue */ 1748 #define IPSEC_CHECK_DEFAULT(lev) \ 1749 (((lev) != IPSEC_LEVEL_USE && (lev) != IPSEC_LEVEL_REQUIRE \ 1750 && (lev) != IPSEC_LEVEL_UNIQUE) ? \ 1751 (ipsec_debug ? log(LOG_INFO, "fixed system default level " #lev \ 1752 ":%d->%d\n", (lev), IPSEC_LEVEL_REQUIRE) : (void)0), \ 1753 (lev) = IPSEC_LEVEL_REQUIRE, (lev) \ 1754 : (lev)) 1755 1756 /* set default level */ 1757 switch (((struct sockaddr *)&isr->sp->spidx.src)->sa_family) { 1758 #ifdef INET 1759 case AF_INET: 1760 esp_trans_deflev = IPSEC_CHECK_DEFAULT(ip4_esp_trans_deflev); 1761 esp_net_deflev = IPSEC_CHECK_DEFAULT(ip4_esp_net_deflev); 1762 ah_trans_deflev = IPSEC_CHECK_DEFAULT(ip4_ah_trans_deflev); 1763 ah_net_deflev = IPSEC_CHECK_DEFAULT(ip4_ah_net_deflev); 1764 break; 1765 #endif 1766 #ifdef INET6 1767 case AF_INET6: 1768 esp_trans_deflev = IPSEC_CHECK_DEFAULT(ip6_esp_trans_deflev); 1769 esp_net_deflev = IPSEC_CHECK_DEFAULT(ip6_esp_net_deflev); 1770 ah_trans_deflev = IPSEC_CHECK_DEFAULT(ip6_ah_trans_deflev); 1771 ah_net_deflev = IPSEC_CHECK_DEFAULT(ip6_ah_net_deflev); 1772 break; 1773 #endif /* INET6 */ 1774 default: 1775 panic("%s: unknown af %u", __func__, 1776 isr->sp->spidx.src.sa.sa_family); 1777 } 1778 1779 #undef IPSEC_CHECK_DEFAULT 1780 1781 /* set level */ 1782 switch (isr->level) { 1783 case IPSEC_LEVEL_DEFAULT: 1784 switch (isr->saidx.proto) { 1785 case IPPROTO_ESP: 1786 if (isr->saidx.mode == IPSEC_MODE_TUNNEL) 1787 level = esp_net_deflev; 1788 else 1789 level = esp_trans_deflev; 1790 break; 1791 case IPPROTO_AH: 1792 if (isr->saidx.mode == IPSEC_MODE_TUNNEL) 1793 level = ah_net_deflev; 1794 else 1795 level = ah_trans_deflev; 1796 break; 1797 case IPPROTO_IPCOMP: 1798 /* 1799 * we don't really care, as IPcomp document says that 1800 * we shouldn't compress small packets 1801 */ 1802 level = IPSEC_LEVEL_USE; 1803 break; 1804 default: 1805 panic("%s: Illegal protocol defined %u", __func__, 1806 isr->saidx.proto); 1807 } 1808 break; 1809 1810 case IPSEC_LEVEL_USE: 1811 case IPSEC_LEVEL_REQUIRE: 1812 level = isr->level; 1813 break; 1814 case IPSEC_LEVEL_UNIQUE: 1815 level = IPSEC_LEVEL_REQUIRE; 1816 break; 1817 1818 default: 1819 panic("%s: Illegal IPsec level %u", __func__, isr->level); 1820 } 1821 1822 return level; 1823 } 1824 1825 /* 1826 * Check security policy requirements against the actual 1827 * packet contents. Return one if the packet should be 1828 * reject as "invalid"; otherwiser return zero to have the 1829 * packet treated as "valid". 1830 * 1831 * OUT: 1832 * 0: valid 1833 * 1: invalid 1834 */ 1835 int 1836 ipsec_in_reject(const struct secpolicy *sp, const struct mbuf *m) 1837 { 1838 struct ipsecrequest *isr; 1839 int need_auth; 1840 1841 KEYDEBUG(KEYDEBUG_IPSEC_DATA, printf("%s: using SP\n", __func__); 1842 kdebug_secpolicy(sp)); 1843 1844 /* check policy */ 1845 switch (sp->policy) { 1846 case IPSEC_POLICY_DISCARD: 1847 return 1; 1848 case IPSEC_POLICY_BYPASS: 1849 case IPSEC_POLICY_NONE: 1850 return 0; 1851 } 1852 1853 IPSEC_ASSERT(sp->policy == IPSEC_POLICY_IPSEC, 1854 ("%s: invalid policy %u", __func__, sp->policy)); 1855 1856 /* XXX should compare policy against ipsec header history */ 1857 1858 need_auth = 0; 1859 for (isr = sp->req; isr != NULL; isr = isr->next) { 1860 if (ipsec_get_reqlevel(isr) != IPSEC_LEVEL_REQUIRE) 1861 continue; 1862 switch (isr->saidx.proto) { 1863 case IPPROTO_ESP: 1864 if ((m->m_flags & M_DECRYPTED) == 0) { 1865 KEYDEBUG(KEYDEBUG_IPSEC_DUMP, 1866 printf("%s: ESP m_flags:%x\n", __func__, 1867 m->m_flags)); 1868 return 1; 1869 } 1870 1871 if (!need_auth && 1872 isr->sav != NULL && 1873 isr->sav->tdb_authalgxform != NULL && 1874 (m->m_flags & M_AUTHIPDGM) == 0) { 1875 KEYDEBUG(KEYDEBUG_IPSEC_DUMP, 1876 printf("%s: ESP/AH m_flags:%x\n", __func__, 1877 m->m_flags)); 1878 return 1; 1879 } 1880 break; 1881 case IPPROTO_AH: 1882 need_auth = 1; 1883 if ((m->m_flags & M_AUTHIPHDR) == 0) { 1884 KEYDEBUG(KEYDEBUG_IPSEC_DUMP, 1885 printf("%s: AH m_flags:%x\n", __func__, 1886 m->m_flags)); 1887 return 1; 1888 } 1889 break; 1890 case IPPROTO_IPCOMP: 1891 /* 1892 * we don't really care, as IPcomp document 1893 * says that we shouldn't compress small 1894 * packets, IPComp policy should always be 1895 * treated as being in "use" level. 1896 */ 1897 break; 1898 } 1899 } 1900 return 0; /* valid */ 1901 } 1902 1903 /* 1904 * Check AH/ESP integrity. 1905 * This function is called from tcp_input(), udp_input(), 1906 * and {ah,esp}4_input for tunnel mode 1907 */ 1908 int 1909 ipsec4_in_reject(struct mbuf *m, struct inpcb *inp) 1910 { 1911 struct secpolicy *sp; 1912 int error; 1913 int result; 1914 1915 IPSEC_ASSERT(m != NULL, ("%s: null mbuf", __func__)); 1916 1917 /* get SP for this packet. 1918 * When we are called from ip_forward(), we call 1919 * ipsec_getpolicybyaddr() with IP_FORWARDING flag. 1920 */ 1921 if (inp == NULL) 1922 sp = ipsec_getpolicybyaddr(m, IPSEC_DIR_INBOUND, IP_FORWARDING, &error); 1923 else 1924 sp = ipsec_getpolicybysock(m, IPSEC_DIR_INBOUND, 1925 IN4PCB_TO_PCB(inp), &error); 1926 1927 if (sp != NULL) { 1928 result = ipsec_in_reject(sp, m); 1929 if (result) 1930 IPSEC_STATINC(IPSEC_STAT_IN_POLVIO); 1931 KEY_FREESP(&sp); 1932 } else { 1933 result = 0; /* XXX should be panic ? 1934 * -> No, there may be error. */ 1935 } 1936 return result; 1937 } 1938 1939 1940 #ifdef INET6 1941 /* 1942 * Check AH/ESP integrity. 1943 * This function is called from tcp6_input(), udp6_input(), 1944 * and {ah,esp}6_input for tunnel mode 1945 */ 1946 int 1947 ipsec6_in_reject(struct mbuf *m, struct in6pcb *in6p) 1948 { 1949 struct secpolicy *sp = NULL; 1950 int error; 1951 int result; 1952 1953 /* sanity check */ 1954 if (m == NULL) 1955 return 0; /* XXX should be panic ? */ 1956 1957 /* get SP for this packet. 1958 * When we are called from ip_forward(), we call 1959 * ipsec_getpolicybyaddr() with IP_FORWARDING flag. 1960 */ 1961 if (in6p == NULL) 1962 sp = ipsec_getpolicybyaddr(m, IPSEC_DIR_INBOUND, IP_FORWARDING, &error); 1963 else 1964 sp = ipsec_getpolicybysock(m, IPSEC_DIR_INBOUND, 1965 IN6PCB_TO_PCB(in6p), 1966 &error); 1967 1968 if (sp != NULL) { 1969 result = ipsec_in_reject(sp, m); 1970 if (result) 1971 IPSEC_STATINC(IPSEC_STAT_IN_POLVIO); 1972 KEY_FREESP(&sp); 1973 } else { 1974 result = 0; 1975 } 1976 return result; 1977 } 1978 #endif 1979 1980 /* 1981 * compute the byte size to be occupied by IPsec header. 1982 * in case it is tunneled, it includes the size of outer IP header. 1983 * NOTE: SP passed is free in this function. 1984 */ 1985 static size_t 1986 ipsec_hdrsiz(const struct secpolicy *sp) 1987 { 1988 const struct ipsecrequest *isr; 1989 size_t siz; 1990 1991 KEYDEBUG(KEYDEBUG_IPSEC_DATA, printf("%s: using SP\n", __func__); 1992 kdebug_secpolicy(sp)); 1993 1994 switch (sp->policy) { 1995 case IPSEC_POLICY_DISCARD: 1996 case IPSEC_POLICY_BYPASS: 1997 case IPSEC_POLICY_NONE: 1998 return 0; 1999 } 2000 2001 IPSEC_ASSERT(sp->policy == IPSEC_POLICY_IPSEC, 2002 ("%s: invalid policy %u", __func__, sp->policy)); 2003 2004 siz = 0; 2005 for (isr = sp->req; isr != NULL; isr = isr->next) { 2006 size_t clen = 0; 2007 2008 switch (isr->saidx.proto) { 2009 case IPPROTO_ESP: 2010 clen = esp_hdrsiz(isr->sav); 2011 break; 2012 case IPPROTO_AH: 2013 clen = ah_hdrsiz(isr->sav); 2014 break; 2015 case IPPROTO_IPCOMP: 2016 clen = sizeof(struct ipcomp); 2017 break; 2018 } 2019 2020 if (isr->saidx.mode == IPSEC_MODE_TUNNEL) { 2021 switch (isr->saidx.dst.sa.sa_family) { 2022 case AF_INET: 2023 clen += sizeof(struct ip); 2024 break; 2025 #ifdef INET6 2026 case AF_INET6: 2027 clen += sizeof(struct ip6_hdr); 2028 break; 2029 #endif 2030 default: 2031 ipseclog((LOG_ERR, "%s: unknown AF %d in " 2032 "IPsec tunnel SA\n", __func__, 2033 ((const struct sockaddr *)&isr->saidx.dst) 2034 ->sa_family)); 2035 break; 2036 } 2037 } 2038 siz += clen; 2039 } 2040 2041 return siz; 2042 } 2043 2044 /* This function is called from ip_forward() and ipsec4_hdrsize_tcp(). */ 2045 size_t 2046 ipsec4_hdrsiz(struct mbuf *m, u_int dir, struct inpcb *inp) 2047 { 2048 struct secpolicy *sp; 2049 int error; 2050 size_t size; 2051 2052 IPSEC_ASSERT(m != NULL, ("%s: null mbuf", __func__)); 2053 IPSEC_ASSERT(inp == NULL || inp->inp_socket != NULL, 2054 ("%s: socket w/o inpcb", __func__)); 2055 2056 /* get SP for this packet. 2057 * When we are called from ip_forward(), we call 2058 * ipsec_getpolicybyaddr() with IP_FORWARDING flag. 2059 */ 2060 if (inp == NULL) 2061 sp = ipsec_getpolicybyaddr(m, dir, IP_FORWARDING, &error); 2062 else 2063 sp = ipsec_getpolicybysock(m, dir, 2064 IN4PCB_TO_PCB(inp), &error); 2065 2066 if (sp != NULL) { 2067 size = ipsec_hdrsiz(sp); 2068 KEYDEBUG(KEYDEBUG_IPSEC_DATA, printf("%s: size:%lu.\n", 2069 __func__, (unsigned long)size)); 2070 2071 KEY_FREESP(&sp); 2072 } else { 2073 size = 0; /* XXX should be panic ? */ 2074 } 2075 return size; 2076 } 2077 2078 #ifdef INET6 2079 /* This function is called from ipsec6_hdrsize_tcp(), 2080 * and maybe from ip6_forward.() 2081 */ 2082 size_t 2083 ipsec6_hdrsiz(struct mbuf *m, u_int dir, struct in6pcb *in6p) 2084 { 2085 struct secpolicy *sp; 2086 int error; 2087 size_t size; 2088 2089 IPSEC_ASSERT(m != NULL, ("%s: null mbuf", __func__)); 2090 IPSEC_ASSERT(in6p == NULL || in6p->in6p_socket != NULL, 2091 ("%s: socket w/o inpcb", __func__)); 2092 2093 /* get SP for this packet */ 2094 /* XXX Is it right to call with IP_FORWARDING. */ 2095 if (in6p == NULL) 2096 sp = ipsec_getpolicybyaddr(m, dir, IP_FORWARDING, &error); 2097 else 2098 sp = ipsec_getpolicybysock(m, dir, 2099 IN6PCB_TO_PCB(in6p), 2100 &error); 2101 2102 if (sp == NULL) 2103 return 0; 2104 size = ipsec_hdrsiz(sp); 2105 KEYDEBUG(KEYDEBUG_IPSEC_DATA, 2106 printf("%s: size:%zu.\n", __func__, size)); 2107 KEY_FREESP(&sp); 2108 2109 return size; 2110 } 2111 #endif /*INET6*/ 2112 2113 /* 2114 * Check the variable replay window. 2115 * ipsec_chkreplay() performs replay check before ICV verification. 2116 * ipsec_updatereplay() updates replay bitmap. This must be called after 2117 * ICV verification (it also performs replay check, which is usually done 2118 * beforehand). 2119 * 0 (zero) is returned if packet disallowed, 1 if packet permitted. 2120 * 2121 * based on RFC 2401. 2122 */ 2123 int 2124 ipsec_chkreplay(u_int32_t seq, const struct secasvar *sav) 2125 { 2126 const struct secreplay *replay; 2127 u_int32_t diff; 2128 int fr; 2129 u_int32_t wsizeb; /* constant: bits of window size */ 2130 int frlast; /* constant: last frame */ 2131 2132 IPSEC_SPLASSERT_SOFTNET(__func__); 2133 2134 IPSEC_ASSERT(sav != NULL, ("%s: Null SA", __func__)); 2135 IPSEC_ASSERT(sav->replay != NULL, ("%s: Null replay state", __func__)); 2136 2137 replay = sav->replay; 2138 2139 if (replay->wsize == 0) 2140 return 1; /* no need to check replay. */ 2141 2142 /* constant */ 2143 frlast = replay->wsize - 1; 2144 wsizeb = replay->wsize << 3; 2145 2146 /* sequence number of 0 is invalid */ 2147 if (seq == 0) 2148 return 0; 2149 2150 /* first time is always okay */ 2151 if (replay->count == 0) 2152 return 1; 2153 2154 if (seq > replay->lastseq) { 2155 /* larger sequences are okay */ 2156 return 1; 2157 } else { 2158 /* seq is equal or less than lastseq. */ 2159 diff = replay->lastseq - seq; 2160 2161 /* over range to check, i.e. too old or wrapped */ 2162 if (diff >= wsizeb) 2163 return 0; 2164 2165 fr = frlast - diff / 8; 2166 2167 /* this packet already seen ? */ 2168 if ((replay->bitmap)[fr] & (1 << (diff % 8))) 2169 return 0; 2170 2171 /* out of order but good */ 2172 return 1; 2173 } 2174 } 2175 2176 /* 2177 * check replay counter whether to update or not. 2178 * OUT: 0: OK 2179 * 1: NG 2180 */ 2181 int 2182 ipsec_updatereplay(u_int32_t seq, const struct secasvar *sav) 2183 { 2184 struct secreplay *replay; 2185 u_int32_t diff; 2186 int fr; 2187 u_int32_t wsizeb; /* constant: bits of window size */ 2188 int frlast; /* constant: last frame */ 2189 2190 IPSEC_SPLASSERT_SOFTNET(__func__); 2191 2192 IPSEC_ASSERT(sav != NULL, ("%s: Null SA", __func__)); 2193 IPSEC_ASSERT(sav->replay != NULL, ("%s: Null replay state", __func__)); 2194 2195 replay = sav->replay; 2196 2197 if (replay->wsize == 0) 2198 goto ok; /* no need to check replay. */ 2199 2200 /* constant */ 2201 frlast = replay->wsize - 1; 2202 wsizeb = replay->wsize << 3; 2203 2204 /* sequence number of 0 is invalid */ 2205 if (seq == 0) 2206 return 1; 2207 2208 /* first time */ 2209 if (replay->count == 0) { 2210 replay->lastseq = seq; 2211 memset(replay->bitmap, 0, replay->wsize); 2212 (replay->bitmap)[frlast] = 1; 2213 goto ok; 2214 } 2215 2216 if (seq > replay->lastseq) { 2217 /* seq is larger than lastseq. */ 2218 diff = seq - replay->lastseq; 2219 2220 /* new larger sequence number */ 2221 if (diff < wsizeb) { 2222 /* In window */ 2223 /* set bit for this packet */ 2224 vshiftl(replay->bitmap, diff, replay->wsize); 2225 (replay->bitmap)[frlast] |= 1; 2226 } else { 2227 /* this packet has a "way larger" */ 2228 memset(replay->bitmap, 0, replay->wsize); 2229 (replay->bitmap)[frlast] = 1; 2230 } 2231 replay->lastseq = seq; 2232 2233 /* larger is good */ 2234 } else { 2235 /* seq is equal or less than lastseq. */ 2236 diff = replay->lastseq - seq; 2237 2238 /* over range to check, i.e. too old or wrapped */ 2239 if (diff >= wsizeb) 2240 return 1; 2241 2242 fr = frlast - diff / 8; 2243 2244 /* this packet already seen ? */ 2245 if ((replay->bitmap)[fr] & (1 << (diff % 8))) 2246 return 1; 2247 2248 /* mark as seen */ 2249 (replay->bitmap)[fr] |= (1 << (diff % 8)); 2250 2251 /* out of order but good */ 2252 } 2253 2254 ok: 2255 if (replay->count == ~0) { 2256 2257 /* set overflow flag */ 2258 replay->overflow++; 2259 2260 /* don't increment, no more packets accepted */ 2261 if ((sav->flags & SADB_X_EXT_CYCSEQ) == 0) 2262 return 1; 2263 2264 ipseclog((LOG_WARNING, "replay counter made %d cycle. %s\n", 2265 replay->overflow, ipsec_logsastr(sav))); 2266 } 2267 2268 replay->count++; 2269 2270 return 0; 2271 } 2272 2273 /* 2274 * shift variable length bunffer to left. 2275 * IN: bitmap: pointer to the buffer 2276 * nbit: the number of to shift. 2277 * wsize: buffer size (bytes). 2278 */ 2279 static void 2280 vshiftl(unsigned char *bitmap, int nbit, int wsize) 2281 { 2282 int s, j, i; 2283 unsigned char over; 2284 2285 for (j = 0; j < nbit; j += 8) { 2286 s = (nbit - j < 8) ? (nbit - j): 8; 2287 bitmap[0] <<= s; 2288 for (i = 1; i < wsize; i++) { 2289 over = (bitmap[i] >> (8 - s)); 2290 bitmap[i] <<= s; 2291 bitmap[i-1] |= over; 2292 } 2293 } 2294 2295 return; 2296 } 2297 2298 /* Return a printable string for the IPv4 address. */ 2299 static char * 2300 inet_ntoa4(struct in_addr ina) 2301 { 2302 static char buf[4][4 * sizeof "123" + 4]; 2303 unsigned char *ucp = (unsigned char *) &ina; 2304 static int i = 3; 2305 2306 i = (i + 1) % 4; 2307 snprintf(buf[i], sizeof(buf[i]), "%d.%d.%d.%d", 2308 ucp[0] & 0xff, ucp[1] & 0xff, ucp[2] & 0xff, ucp[3] & 0xff); 2309 return (buf[i]); 2310 } 2311 2312 /* Return a printable string for the address. */ 2313 const char * 2314 ipsec_address(const union sockaddr_union *sa) 2315 { 2316 #if INET6 2317 static char ip6buf[INET6_ADDRSTRLEN]; /* XXX: NOMPSAFE */ 2318 #endif 2319 2320 switch (sa->sa.sa_family) { 2321 #if INET 2322 case AF_INET: 2323 return inet_ntoa4(sa->sin.sin_addr); 2324 #endif /* INET */ 2325 2326 #if INET6 2327 case AF_INET6: 2328 return IN6_PRINT(ip6buf, &sa->sin6.sin6_addr); 2329 #endif /* INET6 */ 2330 2331 default: 2332 return "(unknown address family)"; 2333 } 2334 } 2335 2336 const char * 2337 ipsec_logsastr(const struct secasvar *sav) 2338 { 2339 static char buf[256]; 2340 char *p; 2341 const struct secasindex *saidx = &sav->sah->saidx; 2342 2343 IPSEC_ASSERT(saidx->src.sa.sa_family == saidx->dst.sa.sa_family, 2344 ("%s: address family mismatch", __func__)); 2345 2346 p = buf; 2347 snprintf(buf, sizeof(buf), "SA(SPI=%u ", (u_int32_t)ntohl(sav->spi)); 2348 while (p && *p) 2349 p++; 2350 /* NB: only use ipsec_address on one address at a time */ 2351 snprintf(p, sizeof (buf) - (p - buf), "src=%s ", 2352 ipsec_address(&saidx->src)); 2353 while (p && *p) 2354 p++; 2355 snprintf(p, sizeof (buf) - (p - buf), "dst=%s)", 2356 ipsec_address(&saidx->dst)); 2357 2358 return buf; 2359 } 2360 2361 void 2362 ipsec_dumpmbuf(struct mbuf *m) 2363 { 2364 int totlen; 2365 int i; 2366 u_char *p; 2367 2368 totlen = 0; 2369 printf("---\n"); 2370 while (m) { 2371 p = mtod(m, u_char *); 2372 for (i = 0; i < m->m_len; i++) { 2373 printf("%02x ", p[i]); 2374 totlen++; 2375 if (totlen % 16 == 0) 2376 printf("\n"); 2377 } 2378 m = m->m_next; 2379 } 2380 if (totlen % 16 != 0) 2381 printf("\n"); 2382 printf("---\n"); 2383 } 2384 2385 #ifdef INET6 2386 struct secpolicy * 2387 ipsec6_check_policy(struct mbuf *m, const struct socket *so, 2388 int flags, int *needipsecp, int *errorp) 2389 { 2390 struct in6pcb *in6p = NULL; 2391 struct secpolicy *sp = NULL; 2392 int s; 2393 int error = 0; 2394 int needipsec = 0; 2395 2396 if (so != NULL && so->so_proto->pr_domain->dom_family == AF_INET6) 2397 in6p = sotoin6pcb(so); 2398 2399 if (!ipsec_outdone(m)) { 2400 s = splsoftnet(); 2401 if (in6p != NULL && 2402 IPSEC_PCB_SKIP_IPSEC(in6p->in6p_sp, IPSEC_DIR_OUTBOUND)) { 2403 splx(s); 2404 goto skippolicycheck; 2405 } 2406 sp = ipsec6_checkpolicy(m, IPSEC_DIR_OUTBOUND, flags, &error,in6p); 2407 2408 /* 2409 * There are four return cases: 2410 * sp != NULL apply IPsec policy 2411 * sp == NULL, error == 0 no IPsec handling needed 2412 * sp == NULL, error == -EINVAL discard packet w/o error 2413 * sp == NULL, error != 0 discard packet, report error 2414 */ 2415 2416 splx(s); 2417 if (sp == NULL) { 2418 /* 2419 * Caller must check the error return to see if it needs to discard 2420 * the packet. 2421 */ 2422 needipsec = 0; 2423 } else { 2424 needipsec = 1; 2425 } 2426 } 2427 skippolicycheck:; 2428 2429 *errorp = error; 2430 *needipsecp = needipsec; 2431 return sp; 2432 } 2433 2434 int 2435 ipsec6_input(struct mbuf *m) 2436 { 2437 struct m_tag *mtag; 2438 struct tdb_ident *tdbi; 2439 struct secpolicy *sp; 2440 int s, error; 2441 2442 /* 2443 * Check if the packet has already had IPsec 2444 * processing done. If so, then just pass it 2445 * along. This tag gets set during AH, ESP, 2446 * etc. input handling, before the packet is 2447 * returned to the ip input queue for delivery. 2448 */ 2449 mtag = m_tag_find(m, PACKET_TAG_IPSEC_IN_DONE, 2450 NULL); 2451 s = splsoftnet(); 2452 if (mtag != NULL) { 2453 tdbi = (struct tdb_ident *)(mtag + 1); 2454 sp = ipsec_getpolicy(tdbi, 2455 IPSEC_DIR_INBOUND); 2456 } else { 2457 sp = ipsec_getpolicybyaddr(m, 2458 IPSEC_DIR_INBOUND, IP_FORWARDING, 2459 &error); 2460 } 2461 if (sp != NULL) { 2462 /* 2463 * Check security policy against packet 2464 * attributes. 2465 */ 2466 error = ipsec_in_reject(sp, m); 2467 KEY_FREESP(&sp); 2468 } else { 2469 /* XXX error stat??? */ 2470 error = EINVAL; 2471 DPRINTF(("ip6_input: no SP, packet" 2472 " discarded\n"));/*XXX*/ 2473 } 2474 splx(s); 2475 2476 return error; 2477 } 2478 #endif /* INET6 */ 2479 2480 2481 2482 /* XXX this stuff doesn't belong here... */ 2483 2484 static struct xformsw *xforms = NULL; 2485 2486 /* 2487 * Register a transform; typically at system startup. 2488 */ 2489 void 2490 xform_register(struct xformsw *xsp) 2491 { 2492 xsp->xf_next = xforms; 2493 xforms = xsp; 2494 } 2495 2496 /* 2497 * Initialize transform support in an sav. 2498 */ 2499 int 2500 xform_init(struct secasvar *sav, int xftype) 2501 { 2502 struct xformsw *xsp; 2503 2504 if (sav->tdb_xform != NULL) /* previously initialized */ 2505 return 0; 2506 for (xsp = xforms; xsp; xsp = xsp->xf_next) 2507 if (xsp->xf_type == xftype) 2508 return (*xsp->xf_init)(sav, xsp); 2509 2510 DPRINTF(("%s: no match for xform type %d\n", __func__, xftype)); 2511 return EINVAL; 2512 } 2513 2514 void 2515 nat_t_ports_get(struct mbuf *m, u_int16_t *dport, u_int16_t *sport) { 2516 struct m_tag *tag; 2517 2518 if ((tag = m_tag_find(m, PACKET_TAG_IPSEC_NAT_T_PORTS, NULL))) { 2519 *sport = ((u_int16_t *)(tag + 1))[0]; 2520 *dport = ((u_int16_t *)(tag + 1))[1]; 2521 } else 2522 *sport = *dport = 0; 2523 } 2524 2525 #ifdef __NetBSD__ 2526 /* 2527 * XXXJRT This should be done as a protosw init call. 2528 */ 2529 void 2530 ipsec_attach(void) 2531 { 2532 2533 ipsecstat_percpu = percpu_alloc(sizeof(uint64_t) * IPSEC_NSTATS); 2534 2535 ah_attach(); 2536 esp_attach(); 2537 ipcomp_attach(); 2538 ipe4_attach(); 2539 #ifdef TCP_SIGNATURE 2540 tcpsignature_attach(); 2541 #endif 2542 } 2543 #endif /* __NetBSD__ */ 2544