xref: /netbsd-src/sys/netipsec/ipsec_input.c (revision 7c3f385475147b6e1c4753f2bee961630e2dfc40)
1 /*	$NetBSD: ipsec_input.c,v 1.19 2008/04/15 04:43:53 thorpej Exp $	*/
2 /*	$FreeBSD: /usr/local/www/cvsroot/FreeBSD/src/sys/netipsec/ipsec_input.c,v 1.2.4.2 2003/03/28 20:32:53 sam Exp $	*/
3 /*	$OpenBSD: ipsec_input.c,v 1.63 2003/02/20 18:35:43 deraadt Exp $	*/
4 
5 /*
6  * The authors of this code are John Ioannidis (ji@tla.org),
7  * Angelos D. Keromytis (kermit@csd.uch.gr) and
8  * Niels Provos (provos@physnet.uni-hamburg.de).
9  *
10  * This code was written by John Ioannidis for BSD/OS in Athens, Greece,
11  * in November 1995.
12  *
13  * Ported to OpenBSD and NetBSD, with additional transforms, in December 1996,
14  * by Angelos D. Keromytis.
15  *
16  * Additional transforms and features in 1997 and 1998 by Angelos D. Keromytis
17  * and Niels Provos.
18  *
19  * Additional features in 1999 by Angelos D. Keromytis.
20  *
21  * Copyright (C) 1995, 1996, 1997, 1998, 1999 by John Ioannidis,
22  * Angelos D. Keromytis and Niels Provos.
23  * Copyright (c) 2001, Angelos D. Keromytis.
24  *
25  * Permission to use, copy, and modify this software with or without fee
26  * is hereby granted, provided that this entire notice is included in
27  * all copies of any software which is or includes a copy or
28  * modification of this software.
29  * You may use this code under the GNU public license if you so wish. Please
30  * contribute changes back to the authors under this freer than GPL license
31  * so that we may further the use of strong encryption without limitations to
32  * all.
33  *
34  * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR
35  * IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY
36  * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE
37  * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR
38  * PURPOSE.
39  */
40 
41 #include <sys/cdefs.h>
42 __KERNEL_RCSID(0, "$NetBSD: ipsec_input.c,v 1.19 2008/04/15 04:43:53 thorpej Exp $");
43 
44 /*
45  * IPsec input processing.
46  */
47 
48 #include "opt_inet.h"
49 #ifdef __FreeBSD__
50 #include "opt_inet6.h"
51 #endif
52 #include "opt_ipsec.h"
53 
54 #include <sys/param.h>
55 #include <sys/systm.h>
56 #include <sys/malloc.h>
57 #include <sys/mbuf.h>
58 #include <sys/domain.h>
59 #include <sys/protosw.h>
60 #include <sys/socket.h>
61 #include <sys/errno.h>
62 #include <sys/syslog.h>
63 
64 #include <net/if.h>
65 #include <net/route.h>
66 #include <net/netisr.h>
67 
68 #include <netinet/in.h>
69 #include <netinet/in_systm.h>
70 #include <netinet/ip.h>
71 #include <netinet/ip_var.h>
72 #include <netinet/in_var.h>
73 
74 #include <netinet/ip6.h>
75 #ifdef INET6
76 #include <netinet6/ip6_var.h>
77 #include <netinet6/ip6_private.h>
78 #endif
79 #include <netinet/in_pcb.h>
80 #ifdef INET6
81 #include <netinet/icmp6.h>
82 #endif
83 
84 #include <netipsec/ipsec.h>
85 #ifdef INET6
86 #include <netipsec/ipsec6.h>
87 #endif
88 #include <netipsec/ah_var.h>
89 #include <netipsec/esp.h>
90 #include <netipsec/esp_var.h>
91 #include <netipsec/ipcomp_var.h>
92 
93 #include <netipsec/key.h>
94 #include <netipsec/keydb.h>
95 
96 #include <netipsec/xform.h>
97 #include <netinet6/ip6protosw.h>
98 
99 #include <netipsec/ipsec_osdep.h>
100 
101 #include <machine/stdarg.h>
102 
103 #include <net/net_osdep.h>
104 
105 #define IPSEC_ISTAT(p,x,y,z) ((p) == IPPROTO_ESP ? (x)++ : \
106 			    (p) == IPPROTO_AH ? (y)++ : (z)++)
107 
108 /*
109  * ipsec_common_input gets called when an IPsec-protected packet
110  * is received by IPv4 or IPv6.  It's job is to find the right SA
111  # and call the appropriate transform.  The transform callback
112  * takes care of further processing (like ingress filtering).
113  */
114 static int
115 ipsec_common_input(struct mbuf *m, int skip, int protoff, int af, int sproto)
116 {
117 	union sockaddr_union dst_address;
118 	struct secasvar *sav;
119 	u_int32_t spi;
120 	u_int16_t sport = 0;
121 	u_int16_t dport = 0;
122 	int s, error;
123 #ifdef IPSEC_NAT_T
124 	struct m_tag * tag = NULL;
125 #endif
126 
127 	IPSEC_ISTAT(sproto, espstat.esps_input, ahstat.ahs_input,
128 		ipcompstat.ipcomps_input);
129 
130 	IPSEC_ASSERT(m != NULL, ("ipsec_common_input: null packet"));
131 
132 	if ((sproto == IPPROTO_ESP && !esp_enable) ||
133 	    (sproto == IPPROTO_AH && !ah_enable) ||
134 	    (sproto == IPPROTO_IPCOMP && !ipcomp_enable)) {
135 		m_freem(m);
136 		IPSEC_ISTAT(sproto, espstat.esps_pdrops, ahstat.ahs_pdrops,
137 		    ipcompstat.ipcomps_pdrops);
138 		return EOPNOTSUPP;
139 	}
140 
141 	if (m->m_pkthdr.len - skip < 2 * sizeof (u_int32_t)) {
142 		m_freem(m);
143 		IPSEC_ISTAT(sproto, espstat.esps_hdrops, ahstat.ahs_hdrops,
144 		    ipcompstat.ipcomps_hdrops);
145 		DPRINTF(("ipsec_common_input: packet too small\n"));
146 		return EINVAL;
147 	}
148 
149 	/* Retrieve the SPI from the relevant IPsec header */
150 	if (sproto == IPPROTO_ESP)
151 		m_copydata(m, skip, sizeof(u_int32_t), &spi);
152 	else if (sproto == IPPROTO_AH)
153 		m_copydata(m, skip + sizeof(u_int32_t), sizeof(u_int32_t), &spi);
154 	else if (sproto == IPPROTO_IPCOMP) {
155 		u_int16_t cpi;
156 		m_copydata(m, skip + sizeof(u_int16_t), sizeof(u_int16_t), &cpi);
157 		spi = ntohl(htons(cpi));
158 	} else {
159 		panic("ipsec_common_input called with bad protocol number :"
160 		      "%d\n", sproto);
161 	}
162 
163 
164 #ifdef IPSEC_NAT_T
165 	/* find the source port for NAT-T */
166 	if ((tag = m_tag_find(m, PACKET_TAG_IPSEC_NAT_T_PORTS, NULL))) {
167 		sport = ((u_int16_t *)(tag + 1))[0];
168 		dport = ((u_int16_t *)(tag + 1))[1];
169 	}
170 #endif
171 
172 	/*
173 	 * Find the SA and (indirectly) call the appropriate
174 	 * kernel crypto routine. The resulting mbuf chain is a valid
175 	 * IP packet ready to go through input processing.
176 	 */
177 	bzero(&dst_address, sizeof (dst_address));
178 	dst_address.sa.sa_family = af;
179 	switch (af) {
180 #ifdef INET
181 	case AF_INET:
182 		dst_address.sin.sin_len = sizeof(struct sockaddr_in);
183 		m_copydata(m, offsetof(struct ip, ip_dst),
184 		    sizeof(struct in_addr),
185 		    &dst_address.sin.sin_addr);
186 		break;
187 #endif /* INET */
188 #ifdef INET6
189 	case AF_INET6:
190 		dst_address.sin6.sin6_len = sizeof(struct sockaddr_in6);
191 		m_copydata(m, offsetof(struct ip6_hdr, ip6_dst),
192 		    sizeof(struct in6_addr),
193 		    &dst_address.sin6.sin6_addr);
194 		break;
195 #endif /* INET6 */
196 	default:
197 		DPRINTF(("ipsec_common_input: unsupported protocol "
198 			"family %u\n", af));
199 		m_freem(m);
200 		IPSEC_ISTAT(sproto, espstat.esps_nopf, ahstat.ahs_nopf,
201 		    ipcompstat.ipcomps_nopf);
202 		return EPFNOSUPPORT;
203 	}
204 
205 	s = splsoftnet();
206 
207 	/* NB: only pass dst since key_allocsa follows RFC2401 */
208 	sav = KEY_ALLOCSA(&dst_address, sproto, spi, sport, dport);
209 	if (sav == NULL) {
210 		DPRINTF(("ipsec_common_input: no key association found for"
211 			  " SA %s/%08lx/%u/%u\n",
212 			  ipsec_address(&dst_address),
213 			  (u_long) ntohl(spi), sproto, ntohs(dport)));
214 		IPSEC_ISTAT(sproto, espstat.esps_notdb, ahstat.ahs_notdb,
215 		    ipcompstat.ipcomps_notdb);
216 		splx(s);
217 		m_freem(m);
218 		return ENOENT;
219 	}
220 
221 	if (sav->tdb_xform == NULL) {
222 		DPRINTF(("ipsec_common_input: attempted to use uninitialized"
223 			 " SA %s/%08lx/%u\n",
224 			 ipsec_address(&dst_address),
225 			 (u_long) ntohl(spi), sproto));
226 		IPSEC_ISTAT(sproto, espstat.esps_noxform, ahstat.ahs_noxform,
227 		    ipcompstat.ipcomps_noxform);
228 		KEY_FREESAV(&sav);
229 		splx(s);
230 		m_freem(m);
231 		return ENXIO;
232 	}
233 
234 	/*
235 	 * Call appropriate transform and return -- callback takes care of
236 	 * everything else.
237 	 */
238 	error = (*sav->tdb_xform->xf_input)(m, sav, skip, protoff);
239 	KEY_FREESAV(&sav);
240 	splx(s);
241 	return error;
242 }
243 
244 #ifdef INET
245 /*
246  * Common input handler for IPv4 AH, ESP, and IPCOMP.
247  */
248 void
249 ipsec4_common_input(struct mbuf *m, ...)
250 {
251 	va_list ap;
252 	int off, nxt;
253 
254 	va_start(ap, m);
255 	off = va_arg(ap, int);
256 	nxt = va_arg(ap, int);
257 	va_end(ap);
258 
259 	(void) ipsec_common_input(m, off, offsetof(struct ip, ip_p),
260 				  AF_INET, nxt);
261 }
262 
263 /*
264  * IPsec input callback for INET protocols.
265  * This routine is called as the transform callback.
266  * Takes care of filtering and other sanity checks on
267  * the processed packet.
268  */
269 int
270 ipsec4_common_input_cb(struct mbuf *m, struct secasvar *sav,
271     int skip, int protoff, struct m_tag *mt)
272 {
273 	int prot, af, sproto;
274 	struct ip *ip;
275 	struct m_tag *mtag;
276 	struct tdb_ident *tdbi;
277 	struct secasindex *saidx;
278 	int error;
279 
280 	IPSEC_SPLASSERT_SOFTNET("ipsec4_common_input_cb");
281 
282 	IPSEC_ASSERT(m != NULL, ("ipsec4_common_input_cb: null mbuf"));
283 	IPSEC_ASSERT(sav != NULL, ("ipsec4_common_input_cb: null SA"));
284 	IPSEC_ASSERT(sav->sah != NULL, ("ipsec4_common_input_cb: null SAH"));
285 	saidx = &sav->sah->saidx;
286 	af = saidx->dst.sa.sa_family;
287 	IPSEC_ASSERT(af == AF_INET, ("ipsec4_common_input_cb: unexpected af %u",af));
288 	sproto = saidx->proto;
289 	IPSEC_ASSERT(sproto == IPPROTO_ESP || sproto == IPPROTO_AH ||
290 		sproto == IPPROTO_IPCOMP,
291 		("ipsec4_common_input_cb: unexpected security protocol %u",
292 		sproto));
293 
294 	/* Sanity check */
295 	if (m == NULL) {
296 		DPRINTF(("ipsec4_common_input_cb: null mbuf"));
297 		IPSEC_ISTAT(sproto, espstat.esps_badkcr, ahstat.ahs_badkcr,
298 		    ipcompstat.ipcomps_badkcr);
299 		KEY_FREESAV(&sav);
300 		return EINVAL;
301 	}
302 
303 	if (skip != 0) {
304 		/* Fix IPv4 header */
305 		if (m->m_len < skip && (m = m_pullup(m, skip)) == NULL) {
306 			DPRINTF(("ipsec4_common_input_cb: processing failed "
307 			    "for SA %s/%08lx\n",
308 			    ipsec_address(&sav->sah->saidx.dst),
309 			    (u_long) ntohl(sav->spi)));
310 			IPSEC_ISTAT(sproto, espstat.esps_hdrops, ahstat.ahs_hdrops,
311 			    ipcompstat.ipcomps_hdrops);
312 			error = ENOBUFS;
313 			goto bad;
314 		}
315 
316 		ip = mtod(m, struct ip *);
317 		ip->ip_len = htons(m->m_pkthdr.len);
318 #ifdef __FreeBSD__
319 		/* On FreeBSD, ip_off and ip_len assumed in host endian. */
320 		ip->ip_off = htons(ip->ip_off);
321 #endif
322 		ip->ip_sum = 0;
323 		ip->ip_sum = in_cksum(m, ip->ip_hl << 2);
324 	} else {
325 		ip = mtod(m, struct ip *);
326 	}
327 	prot = ip->ip_p;
328 
329 	/* IP-in-IP encapsulation */
330 	if (prot == IPPROTO_IPIP) {
331 		struct ip ipn;
332 
333 		/* ipn will now contain the inner IPv4 header */
334 		m_copydata(m, ip->ip_hl << 2, sizeof(struct ip), &ipn);
335 
336 #ifdef notyet
337 		/* XXX PROXY address isn't recorded in SAH */
338 		/*
339 		 * Check that the inner source address is the same as
340 		 * the proxy address, if available.
341 		 */
342 		if ((saidx->proxy.sa.sa_family == AF_INET &&
343 		    saidx->proxy.sin.sin_addr.s_addr !=
344 		    INADDR_ANY &&
345 		    ipn.ip_src.s_addr !=
346 		    saidx->proxy.sin.sin_addr.s_addr) ||
347 		    (saidx->proxy.sa.sa_family != AF_INET &&
348 			saidx->proxy.sa.sa_family != 0)) {
349 
350 			DPRINTF(("ipsec4_common_input_cb: inner "
351 			    "source address %s doesn't correspond to "
352 			    "expected proxy source %s, SA %s/%08lx\n",
353 			    inet_ntoa4(ipn.ip_src),
354 			    ipsp_address(saidx->proxy),
355 			    ipsp_address(saidx->dst),
356 			    (u_long) ntohl(sav->spi)));
357 
358 			IPSEC_ISTAT(sproto, espstat.esps_pdrops,
359 			    ahstat.ahs_pdrops,
360 			    ipcompstat.ipcomps_pdrops);
361 			error = EACCES;
362 			goto bad;
363 		}
364 #endif /*XXX*/
365 	}
366 #if INET6
367 	/* IPv6-in-IP encapsulation. */
368 	if (prot == IPPROTO_IPV6) {
369 		struct ip6_hdr ip6n;
370 
371 		/* ip6n will now contain the inner IPv6 header. */
372 		m_copydata(m, ip->ip_hl << 2, sizeof(struct ip6_hdr), &ip6n);
373 
374 #ifdef notyet
375 		/*
376 		 * Check that the inner source address is the same as
377 		 * the proxy address, if available.
378 		 */
379 		if ((saidx->proxy.sa.sa_family == AF_INET6 &&
380 		    !IN6_IS_ADDR_UNSPECIFIED(&saidx->proxy.sin6.sin6_addr) &&
381 		    !IN6_ARE_ADDR_EQUAL(&ip6n.ip6_src,
382 			&saidx->proxy.sin6.sin6_addr)) ||
383 		    (saidx->proxy.sa.sa_family != AF_INET6 &&
384 			saidx->proxy.sa.sa_family != 0)) {
385 
386 			DPRINTF(("ipsec4_common_input_cb: inner "
387 			    "source address %s doesn't correspond to "
388 			    "expected proxy source %s, SA %s/%08lx\n",
389 			    ip6_sprintf(&ip6n.ip6_src),
390 			    ipsec_address(&saidx->proxy),
391 			    ipsec_address(&saidx->dst),
392 			    (u_long) ntohl(sav->spi)));
393 
394 			IPSEC_ISTAT(sproto, espstat.esps_pdrops,
395 			    ahstat.ahs_pdrops,
396 			    ipcompstat.ipcomps_pdrops);
397 			error = EACCES;
398 			goto bad;
399 		}
400 #endif /*XXX*/
401 	}
402 #endif /* INET6 */
403 
404 	/*
405 	 * Record what we've done to the packet (under what SA it was
406 	 * processed). If we've been passed an mtag, it means the packet
407 	 * was already processed by an ethernet/crypto combo card and
408 	 * thus has a tag attached with all the right information, but
409 	 * with a PACKET_TAG_IPSEC_IN_CRYPTO_DONE as opposed to
410 	 * PACKET_TAG_IPSEC_IN_DONE type; in that case, just change the type.
411 	 */
412 	if (mt == NULL && sproto != IPPROTO_IPCOMP) {
413 		mtag = m_tag_get(PACKET_TAG_IPSEC_IN_DONE,
414 		    sizeof(struct tdb_ident), M_NOWAIT);
415 		if (mtag == NULL) {
416 			DPRINTF(("ipsec4_common_input_cb: failed to get tag\n"));
417 			IPSEC_ISTAT(sproto, espstat.esps_hdrops,
418 			    ahstat.ahs_hdrops, ipcompstat.ipcomps_hdrops);
419 			error = ENOMEM;
420 			goto bad;
421 		}
422 
423 		tdbi = (struct tdb_ident *)(mtag + 1);
424 		bcopy(&saidx->dst, &tdbi->dst, saidx->dst.sa.sa_len);
425 		tdbi->proto = sproto;
426 		tdbi->spi = sav->spi;
427 
428 		m_tag_prepend(m, mtag);
429 	} else {
430 		if (mt != NULL)
431 			mt->m_tag_id = PACKET_TAG_IPSEC_IN_DONE;
432 			/* XXX do we need to mark m_flags??? */
433 	}
434 
435 	key_sa_recordxfer(sav, m);		/* record data transfer */
436 
437 	/*
438 	 * Re-dispatch via software interrupt.
439 	 */
440 	if (!IF_HANDOFF(&ipintrq, m, NULL)) {
441 		IPSEC_ISTAT(sproto, espstat.esps_qfull, ahstat.ahs_qfull,
442 			    ipcompstat.ipcomps_qfull);
443 
444 		DPRINTF(("ipsec4_common_input_cb: queue full; "
445 			"proto %u packet dropped\n", sproto));
446 		return ENOBUFS;
447 	}
448 	schednetisr(NETISR_IP);
449 	return 0;
450 bad:
451 	m_freem(m);
452 	return error;
453 }
454 #endif /* INET */
455 
456 #ifdef INET6
457 /* IPv6 AH wrapper. */
458 int
459 ipsec6_common_input(struct mbuf **mp, int *offp, int proto)
460 {
461 	int l = 0;
462 	int protoff;
463 	struct ip6_ext ip6e;
464 
465 	if (*offp < sizeof(struct ip6_hdr)) {
466 		DPRINTF(("ipsec6_common_input: bad offset %u\n", *offp));
467 		return IPPROTO_DONE;
468 	} else if (*offp == sizeof(struct ip6_hdr)) {
469 		protoff = offsetof(struct ip6_hdr, ip6_nxt);
470 	} else {
471 		/* Chase down the header chain... */
472 		protoff = sizeof(struct ip6_hdr);
473 
474 		do {
475 			protoff += l;
476 			m_copydata(*mp, protoff, sizeof(ip6e), &ip6e);
477 
478 			if (ip6e.ip6e_nxt == IPPROTO_AH)
479 				l = (ip6e.ip6e_len + 2) << 2;
480 			else
481 				l = (ip6e.ip6e_len + 1) << 3;
482 			IPSEC_ASSERT(l > 0, ("ah6_input: l went zero or negative"));
483 		} while (protoff + l < *offp);
484 
485 		/* Malformed packet check */
486 		if (protoff + l != *offp) {
487 			DPRINTF(("ipsec6_common_input: bad packet header chain, "
488 				"protoff %u, l %u, off %u\n", protoff, l, *offp));
489 			IPSEC_ISTAT(proto, espstat.esps_hdrops,
490 				    ahstat.ahs_hdrops,
491 				    ipcompstat.ipcomps_hdrops);
492 			m_freem(*mp);
493 			*mp = NULL;
494 			return IPPROTO_DONE;
495 		}
496 		protoff += offsetof(struct ip6_ext, ip6e_nxt);
497 	}
498 	(void) ipsec_common_input(*mp, *offp, protoff, AF_INET6, proto);
499 	return IPPROTO_DONE;
500 }
501 
502 /*
503  * NB: ipsec_netbsd.c has a duplicate definition of esp6_ctlinput(),
504  * with slightly ore recent multicast tests. These should be merged.
505  * For now, ifdef accordingly.
506  */
507 #ifdef __FreeBSD__
508 void
509 esp6_ctlinput(int cmd, struct sockaddr *sa, void *d)
510 {
511 	if (sa->sa_family != AF_INET6 ||
512 	    sa->sa_len != sizeof(struct sockaddr_in6))
513 		return;
514 	if ((unsigned)cmd >= PRC_NCMDS)
515 		return;
516 
517 	/* if the parameter is from icmp6, decode it. */
518 	if (d !=  NULL) {
519 		struct ip6ctlparam *ip6cp = (struct ip6ctlparam *)d;
520 		struct mbuf *m = ip6cp->ip6c_m;
521 		int off = ip6cp->ip6c_off;
522 
523 		struct ip6ctlparam ip6cp1;
524 
525 		/*
526 		 * Notify the error to all possible sockets via pfctlinput2.
527 		 * Since the upper layer information (such as protocol type,
528 		 * source and destination ports) is embedded in the encrypted
529 		 * data and might have been cut, we can't directly call
530 		 * an upper layer ctlinput function. However, the pcbnotify
531 		 * function will consider source and destination addresses
532 		 * as well as the flow info value, and may be able to find
533 		 * some PCB that should be notified.
534 		 * Although pfctlinput2 will call esp6_ctlinput(), there is
535 		 * no possibility of an infinite loop of function calls,
536 		 * because we don't pass the inner IPv6 header.
537 		 */
538 		bzero(&ip6cp1, sizeof(ip6cp1));
539 		ip6cp1.ip6c_src = ip6cp->ip6c_src;
540 		pfctlinput2(cmd, sa, &ip6cp1);
541 
542 		/*
543 		 * Then go to special cases that need ESP header information.
544 		 * XXX: We assume that when ip6 is non NULL,
545 		 * M and OFF are valid.
546 		 */
547 
548 		if (cmd == PRC_MSGSIZE) {
549 			struct secasvar *sav;
550 			u_int32_t spi;
551 			int valid;
552 
553 			/* check header length before using m_copydata */
554 			if (m->m_pkthdr.len < off + sizeof (struct esp))
555 				return;
556 			m_copydata(m, off + offsetof(struct esp, esp_spi),
557 				sizeof(u_int32_t), &spi);
558 			/*
559 			 * Check to see if we have a valid SA corresponding to
560 			 * the address in the ICMP message payload.
561 			 */
562 			sav = KEY_ALLOCSA((union sockaddr_union *)sa,
563 					IPPROTO_ESP, spi);
564 			valid = (sav != NULL);
565 			if (sav)
566 				KEY_FREESAV(&sav);
567 
568 			/* XXX Further validation? */
569 
570 			/*
571 			 * Depending on whether the SA is "valid" and
572 			 * routing table size (mtudisc_{hi,lo}wat), we will:
573 			 * - recalcurate the new MTU and create the
574 			 *   corresponding routing entry, or
575 			 * - ignore the MTU change notification.
576 			 */
577 			icmp6_mtudisc_update(ip6cp, valid);
578 		}
579 	} else {
580 		/* we normally notify any pcb here */
581 	}
582 }
583 #endif /* __FreeBSD__ */
584 
585 extern	const struct ip6protosw inet6sw[];
586 extern	u_char ip6_protox[];
587 
588 /*
589  * IPsec input callback, called by the transform callback. Takes care of
590  * filtering and other sanity checks on the processed packet.
591  */
592 int
593 ipsec6_common_input_cb(struct mbuf *m, struct secasvar *sav, int skip, int protoff,
594     struct m_tag *mt)
595 {
596 	int prot, af, sproto;
597 	struct ip6_hdr *ip6;
598 	struct m_tag *mtag;
599 	struct tdb_ident *tdbi;
600 	struct secasindex *saidx;
601 	int nxt;
602 	u_int8_t nxt8;
603 	int error, nest;
604 
605 	IPSEC_ASSERT(m != NULL, ("ipsec6_common_input_cb: null mbuf"));
606 	IPSEC_ASSERT(sav != NULL, ("ipsec6_common_input_cb: null SA"));
607 	IPSEC_ASSERT(sav->sah != NULL, ("ipsec6_common_input_cb: null SAH"));
608 	saidx = &sav->sah->saidx;
609 	af = saidx->dst.sa.sa_family;
610 	IPSEC_ASSERT(af == AF_INET6,
611 		("ipsec6_common_input_cb: unexpected af %u", af));
612 	sproto = saidx->proto;
613 	IPSEC_ASSERT(sproto == IPPROTO_ESP || sproto == IPPROTO_AH ||
614 		sproto == IPPROTO_IPCOMP,
615 		("ipsec6_common_input_cb: unexpected security protocol %u",
616 		sproto));
617 
618 	/* Sanity check */
619 	if (m == NULL) {
620 		DPRINTF(("ipsec6_common_input_cb: null mbuf"));
621 		IPSEC_ISTAT(sproto, espstat.esps_badkcr, ahstat.ahs_badkcr,
622 		    ipcompstat.ipcomps_badkcr);
623 		error = EINVAL;
624 		goto bad;
625 	}
626 
627 	/* Fix IPv6 header */
628 	if (m->m_len < sizeof(struct ip6_hdr) &&
629 	    (m = m_pullup(m, sizeof(struct ip6_hdr))) == NULL) {
630 
631 		DPRINTF(("ipsec6_common_input_cb: processing failed "
632 		    "for SA %s/%08lx\n", ipsec_address(&sav->sah->saidx.dst),
633 		    (u_long) ntohl(sav->spi)));
634 
635 		IPSEC_ISTAT(sproto, espstat.esps_hdrops, ahstat.ahs_hdrops,
636 		    ipcompstat.ipcomps_hdrops);
637 		error = EACCES;
638 		goto bad;
639 	}
640 
641 	ip6 = mtod(m, struct ip6_hdr *);
642 	ip6->ip6_plen = htons(m->m_pkthdr.len - sizeof(struct ip6_hdr));
643 
644 	/* Save protocol */
645 	m_copydata(m, protoff, 1, (unsigned char *) &prot);
646 
647 #ifdef INET
648 	/* IP-in-IP encapsulation */
649 	if (prot == IPPROTO_IPIP) {
650 		struct ip ipn;
651 
652 		/* ipn will now contain the inner IPv4 header */
653 		m_copydata(m, skip, sizeof(struct ip), &ipn);
654 
655 #ifdef notyet
656 		/*
657 		 * Check that the inner source address is the same as
658 		 * the proxy address, if available.
659 		 */
660 		if ((saidx->proxy.sa.sa_family == AF_INET &&
661 		    saidx->proxy.sin.sin_addr.s_addr != INADDR_ANY &&
662 		    ipn.ip_src.s_addr != saidx->proxy.sin.sin_addr.s_addr) ||
663 		    (saidx->proxy.sa.sa_family != AF_INET &&
664 			saidx->proxy.sa.sa_family != 0)) {
665 
666 			DPRINTF(("ipsec6_common_input_cb: inner "
667 			    "source address %s doesn't correspond to "
668 			    "expected proxy source %s, SA %s/%08lx\n",
669 			    inet_ntoa4(ipn.ip_src),
670 			    ipsec_address(&saidx->proxy),
671 			    ipsec_address(&saidx->dst),
672 			    (u_long) ntohl(sav->spi)));
673 
674 			IPSEC_ISTAT(sproto, espstat.esps_pdrops,
675 			    ahstat.ahs_pdrops, ipcompstat.ipcomps_pdrops);
676 			error = EACCES;
677 			goto bad;
678 		}
679 #endif /*XXX*/
680 	}
681 #endif /* INET */
682 
683 	/* IPv6-in-IP encapsulation */
684 	if (prot == IPPROTO_IPV6) {
685 		struct ip6_hdr ip6n;
686 
687 		/* ip6n will now contain the inner IPv6 header. */
688 		m_copydata(m, skip, sizeof(struct ip6_hdr), &ip6n);
689 
690 #ifdef notyet
691 		/*
692 		 * Check that the inner source address is the same as
693 		 * the proxy address, if available.
694 		 */
695 		if ((saidx->proxy.sa.sa_family == AF_INET6 &&
696 		    !IN6_IS_ADDR_UNSPECIFIED(&saidx->proxy.sin6.sin6_addr) &&
697 		    !IN6_ARE_ADDR_EQUAL(&ip6n.ip6_src,
698 			&saidx->proxy.sin6.sin6_addr)) ||
699 		    (saidx->proxy.sa.sa_family != AF_INET6 &&
700 			saidx->proxy.sa.sa_family != 0)) {
701 
702 			DPRINTF(("ipsec6_common_input_cb: inner "
703 			    "source address %s doesn't correspond to "
704 			    "expected proxy source %s, SA %s/%08lx\n",
705 			    ip6_sprintf(&ip6n.ip6_src),
706 			    ipsec_address(&saidx->proxy),
707 			    ipsec_address(&saidx->dst),
708 			    (u_long) ntohl(sav->spi)));
709 
710 			IPSEC_ISTAT(sproto, espstat.esps_pdrops,
711 			    ahstat.ahs_pdrops, ipcompstat.ipcomps_pdrops);
712 			error = EACCES;
713 			goto bad;
714 		}
715 #endif /*XXX*/
716 	}
717 
718 	/*
719 	 * Record what we've done to the packet (under what SA it was
720 	 * processed). If we've been passed an mtag, it means the packet
721 	 * was already processed by an ethernet/crypto combo card and
722 	 * thus has a tag attached with all the right information, but
723 	 * with a PACKET_TAG_IPSEC_IN_CRYPTO_DONE as opposed to
724 	 * PACKET_TAG_IPSEC_IN_DONE type; in that case, just change the type.
725 	 */
726 	if (mt == NULL && sproto != IPPROTO_IPCOMP) {
727 		mtag = m_tag_get(PACKET_TAG_IPSEC_IN_DONE,
728 		    sizeof(struct tdb_ident), M_NOWAIT);
729 		if (mtag == NULL) {
730 			DPRINTF(("ipsec_common_input_cb: failed to "
731 			    "get tag\n"));
732 			IPSEC_ISTAT(sproto, espstat.esps_hdrops,
733 			    ahstat.ahs_hdrops, ipcompstat.ipcomps_hdrops);
734 			error = ENOMEM;
735 			goto bad;
736 		}
737 
738 		tdbi = (struct tdb_ident *)(mtag + 1);
739 		bcopy(&saidx->dst, &tdbi->dst, sizeof(union sockaddr_union));
740 		tdbi->proto = sproto;
741 		tdbi->spi = sav->spi;
742 
743 		m_tag_prepend(m, mtag);
744 	} else {
745 		if (mt != NULL)
746 			mt->m_tag_id = PACKET_TAG_IPSEC_IN_DONE;
747 			/* XXX do we need to mark m_flags??? */
748 	}
749 
750 	key_sa_recordxfer(sav, m);
751 
752 	/* Retrieve new protocol */
753 	m_copydata(m, protoff, sizeof(u_int8_t), &nxt8);
754 
755 	/*
756 	 * See the end of ip6_input for this logic.
757 	 * IPPROTO_IPV[46] case will be processed just like other ones
758 	 */
759 	nest = 0;
760 	nxt = nxt8;
761 	while (nxt != IPPROTO_DONE) {
762 		if (ip6_hdrnestlimit && (++nest > ip6_hdrnestlimit)) {
763 			IP6_STATINC(IP6_STAT_TOOMANYHDR);
764 			error = EINVAL;
765 			goto bad;
766 		}
767 
768 		/*
769 		 * Protection against faulty packet - there should be
770 		 * more sanity checks in header chain processing.
771 		 */
772 		if (m->m_pkthdr.len < skip) {
773 			IP6_STATINC(IP6_STAT_TOOSHORT);
774 			in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_truncated);
775 			error = EINVAL;
776 			goto bad;
777 		}
778 		/*
779 		 * Enforce IPsec policy checking if we are seeing last header.
780 		 * note that we do not visit this with protocols with pcb layer
781 		 * code - like udp/tcp/raw ip.
782 		 */
783 		if ((inet6sw[ip6_protox[nxt]].pr_flags & PR_LASTHDR) != 0 &&
784 		    ipsec6_in_reject(m, NULL)) {
785 			error = EINVAL;
786 			goto bad;
787 		}
788 		nxt = (*inet6sw[ip6_protox[nxt]].pr_input)(&m, &skip, nxt);
789 	}
790 	return 0;
791 bad:
792 	if (m)
793 		m_freem(m);
794 	return error;
795 }
796 #endif /* INET6 */
797