xref: /netbsd-src/sys/netipsec/xform_ipip.c (revision fc4f42693f9b1c31f39f9cf50af1bf2010325808) 
1 /*	$NetBSD: xform_ipip.c,v 1.63 2018/02/15 10:41:51 maxv Exp $	*/
2 /*	$FreeBSD: src/sys/netipsec/xform_ipip.c,v 1.3.2.1 2003/01/24 05:11:36 sam Exp $	*/
3 /*	$OpenBSD: ip_ipip.c,v 1.25 2002/06/10 18:04:55 itojun Exp $ */
4 
5 /*
6  * The authors of this code are John Ioannidis (ji@tla.org),
7  * Angelos D. Keromytis (kermit@csd.uch.gr) and
8  * Niels Provos (provos@physnet.uni-hamburg.de).
9  *
10  * The original version of this code was written by John Ioannidis
11  * for BSD/OS in Athens, Greece, in November 1995.
12  *
13  * Ported to OpenBSD and NetBSD, with additional transforms, in December 1996,
14  * by Angelos D. Keromytis.
15  *
16  * Additional transforms and features in 1997 and 1998 by Angelos D. Keromytis
17  * and Niels Provos.
18  *
19  * Additional features in 1999 by Angelos D. Keromytis.
20  *
21  * Copyright (C) 1995, 1996, 1997, 1998, 1999 by John Ioannidis,
22  * Angelos D. Keromytis and Niels Provos.
23  * Copyright (c) 2001, Angelos D. Keromytis.
24  *
25  * Permission to use, copy, and modify this software with or without fee
26  * is hereby granted, provided that this entire notice is included in
27  * all copies of any software which is or includes a copy or
28  * modification of this software.
29  * You may use this code under the GNU public license if you so wish. Please
30  * contribute changes back to the authors under this freer than GPL license
31  * so that we may further the use of strong encryption without limitations to
32  * all.
33  *
34  * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR
35  * IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY
36  * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE
37  * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR
38  * PURPOSE.
39  */
40 
41 #include <sys/cdefs.h>
42 __KERNEL_RCSID(0, "$NetBSD: xform_ipip.c,v 1.63 2018/02/15 10:41:51 maxv Exp $");
43 
44 /*
45  * IP-inside-IP processing
46  */
47 #if defined(_KERNEL_OPT)
48 #include "opt_inet.h"
49 #endif
50 
51 #include <sys/param.h>
52 #include <sys/systm.h>
53 #include <sys/mbuf.h>
54 #include <sys/socket.h>
55 #include <sys/kernel.h>
56 #include <sys/protosw.h>
57 #include <sys/sysctl.h>
58 
59 #include <net/if.h>
60 #include <net/route.h>
61 #include <net/netisr.h>
62 
63 #include <netinet/in.h>
64 #include <netinet/in_systm.h>
65 #include <netinet/in_var.h>
66 #include <netinet/ip.h>
67 #include <netinet/ip_ecn.h>
68 #include <netinet/ip_var.h>
69 #include <netinet/ip_encap.h>
70 
71 #include <netipsec/ipsec.h>
72 #include <netipsec/ipsec_private.h>
73 #include <netipsec/xform.h>
74 
75 #include <netipsec/ipip_var.h>
76 
77 #ifdef INET6
78 #include <netinet/ip6.h>
79 #include <netipsec/ipsec6.h>
80 #include <netinet6/in6_var.h>
81 #include <netinet6/ip6protosw.h>
82 #endif
83 
84 #include <netipsec/key.h>
85 #include <netipsec/key_debug.h>
86 
87 /* XXX IPCOMP */
88 #define	M_IPSEC	(M_AUTHIPHDR|M_AUTHIPDGM|M_DECRYPTED)
89 
90 typedef void pr_in_input_t(struct mbuf *m, ...);
91 
92 int ipip_allow = 0;
93 percpu_t *ipipstat_percpu;
94 
95 void ipe4_attach(void);
96 
97 static void _ipip_input(struct mbuf *m, int iphlen, struct ifnet *gifp);
98 
99 #ifdef INET6
100 int
101 ip4_input6(struct mbuf **m, int *offp, int proto, void *eparg __unused)
102 {
103 	_ipip_input(*m, *offp, NULL);
104 	return IPPROTO_DONE;
105 }
106 #endif
107 
108 #ifdef INET
109 void
110 ip4_input(struct mbuf *m, int off, int proto, void *eparg __unused)
111 {
112 	_ipip_input(m, off, NULL);
113 }
114 #endif
115 
116 /*
117  * ipip_input gets called when we receive an IP{46} encapsulated packet,
118  * either because we got it at a real interface, or because AH or ESP
119  * were being used in tunnel mode (in which case the rcvif element will
120  * contain the address of the encX interface associated with the tunnel).
121  */
122 static void
123 _ipip_input(struct mbuf *m, int iphlen, struct ifnet *gifp)
124 {
125 	register struct sockaddr_in *sin;
126 	register struct ifnet *ifp;
127 	register struct ifaddr *ifa;
128 	pktqueue_t *pktq = NULL;
129 	struct ip *ip4 = NULL;
130 #ifdef INET6
131 	register struct sockaddr_in6 *sin6;
132 	struct ip6_hdr *ip6 = NULL;
133 	uint8_t itos;
134 #endif
135 	uint8_t otos;
136 	uint8_t v;
137 	int hlen;
138 
139 	IPIP_STATINC(IPIP_STAT_IPACKETS);
140 
141 	m_copydata(m, 0, 1, &v);
142 
143 	switch (v >> 4) {
144 #ifdef INET
145 	case 4:
146 		hlen = sizeof(struct ip);
147 		break;
148 #endif
149 #ifdef INET6
150 	case 6:
151 		hlen = sizeof(struct ip6_hdr);
152 		break;
153 #endif
154 	default:
155 		DPRINTF(("%s: bad protocol version 0x%x (%u) "
156 		    "for outer header\n", __func__, v, v>>4));
157 		IPIP_STATINC(IPIP_STAT_FAMILY);
158 		m_freem(m);
159 		return;
160 	}
161 
162 	/* Bring the IP header in the first mbuf, if not there already */
163 	if (m->m_len < hlen) {
164 		if ((m = m_pullup(m, hlen)) == NULL) {
165 			DPRINTF(("%s: m_pullup (1) failed\n", __func__));
166 			IPIP_STATINC(IPIP_STAT_HDROPS);
167 			return;
168 		}
169 	}
170 
171 	/* Keep outer ecn field. */
172 	switch (v >> 4) {
173 #ifdef INET
174 	case 4:
175 		otos = mtod(m, struct ip *)->ip_tos;
176 		break;
177 #endif
178 #ifdef INET6
179 	case 6:
180 		otos = (ntohl(mtod(m, struct ip6_hdr *)->ip6_flow) >> 20) & 0xff;
181 		break;
182 #endif
183 	default:
184 		panic("%s: unknown ip version %u (outer)", __func__, v >> 4);
185 	}
186 
187 	/* Remove outer IP header */
188 	m_adj(m, iphlen);
189 
190 	/* Sanity check */
191 	if (m->m_pkthdr.len < sizeof(struct ip))  {
192 		IPIP_STATINC(IPIP_STAT_HDROPS);
193 		m_freem(m);
194 		return;
195 	}
196 
197 	m_copydata(m, 0, 1, &v);
198 
199 	switch (v >> 4) {
200 #ifdef INET
201 	case 4:
202 		hlen = sizeof(struct ip);
203 		pktq = ip_pktq;
204 		break;
205 #endif
206 #ifdef INET6
207 	case 6:
208 		hlen = sizeof(struct ip6_hdr);
209 		pktq = ip6_pktq;
210 		break;
211 #endif
212 	default:
213 		DPRINTF(("%s: bad protocol version %#x (%u) "
214 		    "for inner header\n", __func__, v, v >> 4));
215 		IPIP_STATINC(IPIP_STAT_FAMILY);
216 		m_freem(m);
217 		return;
218 	}
219 
220 	/*
221 	 * Bring the inner IP header in the first mbuf, if not there already.
222 	 */
223 	if (m->m_len < hlen) {
224 		if ((m = m_pullup(m, hlen)) == NULL) {
225 			DPRINTF(("%s: m_pullup (2) failed\n", __func__));
226 			IPIP_STATINC(IPIP_STAT_HDROPS);
227 			return;
228 		}
229 	}
230 
231 	/*
232 	 * RFC 1853 specifies that the inner TTL should not be touched on
233 	 * decapsulation. There's no reason this comment should be here, but
234 	 * this is as good as any a position.
235 	 */
236 
237 	/* Some sanity checks in the inner IP header */
238 	switch (v >> 4) {
239 #ifdef INET
240 	case 4:
241 		ip4 = mtod(m, struct ip *);
242 		ip_ecn_egress(ip4_ipsec_ecn, &otos, &ip4->ip_tos);
243 		break;
244 #endif
245 #ifdef INET6
246 	case 6:
247 		ip6 = mtod(m, struct ip6_hdr *);
248 		itos = (ntohl(ip6->ip6_flow) >> 20) & 0xff;
249 		ip_ecn_egress(ip6_ipsec_ecn, &otos, &itos);
250 		ip6->ip6_flow &= ~htonl(0xff << 20);
251 		ip6->ip6_flow |= htonl((uint32_t)itos << 20);
252 		break;
253 #endif
254 	default:
255 		panic("%s: unknown ip version %u (inner)", __func__, v>>4);
256 	}
257 
258 	/* Check for local address spoofing. */
259 	if ((m_get_rcvif_NOMPSAFE(m) == NULL ||
260 	    !(m_get_rcvif_NOMPSAFE(m)->if_flags & IFF_LOOPBACK)) &&
261 	    ipip_allow != 2) {
262 		int s = pserialize_read_enter();
263 		IFNET_READER_FOREACH(ifp) {
264 			IFADDR_READER_FOREACH(ifa, ifp) {
265 #ifdef INET
266 				if (ip4) {
267 					if (ifa->ifa_addr->sa_family !=
268 					    AF_INET)
269 						continue;
270 
271 					sin = (struct sockaddr_in *) ifa->ifa_addr;
272 
273 					if (sin->sin_addr.s_addr ==
274 					    ip4->ip_src.s_addr)	{
275 						pserialize_read_exit(s);
276 						IPIP_STATINC(IPIP_STAT_SPOOF);
277 						m_freem(m);
278 						return;
279 					}
280 				}
281 #endif /* INET */
282 
283 #ifdef INET6
284 				if (ip6) {
285 					if (ifa->ifa_addr->sa_family !=
286 					    AF_INET6)
287 						continue;
288 
289 					sin6 = (struct sockaddr_in6 *) ifa->ifa_addr;
290 
291 					if (IN6_ARE_ADDR_EQUAL(&sin6->sin6_addr, &ip6->ip6_src)) {
292 						pserialize_read_exit(s);
293 						IPIP_STATINC(IPIP_STAT_SPOOF);
294 						m_freem(m);
295 						return;
296 					}
297 
298 				}
299 #endif /* INET6 */
300 			}
301 		}
302 		pserialize_read_exit(s);
303 	}
304 
305 	/* Statistics: m->m_pkthdr.len is the length of the inner packet */
306 	IPIP_STATADD(IPIP_STAT_IBYTES, m->m_pkthdr.len);
307 
308 	/*
309 	 * Interface pointer stays the same; if no IPsec processing has
310 	 * been done (or will be done), this will point to a normal
311 	 * interface. Otherwise, it'll point to an enc interface, which
312 	 * will allow a packet filter to distinguish between secure and
313 	 * untrusted packets.
314 	 */
315 
316 	int s = splnet();
317 	if (__predict_false(!pktq_enqueue(pktq, m, 0))) {
318 		IPIP_STATINC(IPIP_STAT_QFULL);
319 		m_freem(m);
320 	}
321 	splx(s);
322 }
323 
324 int
325 ipip_output(struct mbuf *m, const struct ipsecrequest *isr,
326     struct secasvar *sav, struct mbuf **mp, int skip, int protoff)
327 {
328 	char buf[IPSEC_ADDRSTRLEN];
329 	uint8_t tp, otos;
330 	struct secasindex *saidx;
331 	int error, iphlen;
332 #ifdef INET
333 	uint8_t itos;
334 	struct ip *ipo;
335 #endif
336 #ifdef INET6
337 	struct ip6_hdr *ip6, *ip6o;
338 #endif
339 
340 	IPSEC_SPLASSERT_SOFTNET(__func__);
341 	KASSERT(sav != NULL);
342 
343 	/* XXX Deal with empty TDB source/destination addresses. */
344 
345 	m_copydata(m, 0, 1, &tp);
346 	tp = (tp >> 4) & 0xff;  /* Get the IP version number. */
347 
348 	saidx = &sav->sah->saidx;
349 	switch (saidx->dst.sa.sa_family) {
350 #ifdef INET
351 	case AF_INET:
352 		if (saidx->src.sa.sa_family != AF_INET ||
353 		    saidx->src.sin.sin_addr.s_addr == INADDR_ANY ||
354 		    saidx->dst.sin.sin_addr.s_addr == INADDR_ANY) {
355 			DPRINTF(("%s: unspecified tunnel endpoint "
356 			    "address in SA %s/%08lx\n", __func__,
357 			    ipsec_address(&saidx->dst, buf, sizeof(buf)),
358 			    (u_long) ntohl(sav->spi)));
359 			IPIP_STATINC(IPIP_STAT_UNSPEC);
360 			error = EINVAL;
361 			goto bad;
362 		}
363 
364 		M_PREPEND(m, sizeof(struct ip), M_DONTWAIT);
365 		if (m == NULL) {
366 			DPRINTF(("%s: M_PREPEND failed\n", __func__));
367 			IPIP_STATINC(IPIP_STAT_HDROPS);
368 			error = ENOBUFS;
369 			goto bad;
370 		}
371 
372 		iphlen = sizeof(struct ip);
373 
374 		ipo = mtod(m, struct ip *);
375 		ipo->ip_v = IPVERSION;
376 		ipo->ip_hl = 5;
377 		ipo->ip_len = htons(m->m_pkthdr.len);
378 		ipo->ip_ttl = ip_defttl;
379 		ipo->ip_sum = 0;
380 		ipo->ip_src = saidx->src.sin.sin_addr;
381 		ipo->ip_dst = saidx->dst.sin.sin_addr;
382 		ipo->ip_id = ip_newid(NULL);
383 
384 		/* If the inner protocol is IP... */
385 		if (tp == IPVERSION) {
386 			/* Save ECN notification */
387 			m_copydata(m, sizeof(struct ip) +
388 			    offsetof(struct ip, ip_tos),
389 			    sizeof(uint8_t), &itos);
390 
391 			ipo->ip_p = IPPROTO_IPIP;
392 
393 			/*
394 			 * We should be keeping tunnel soft-state and
395 			 * send back ICMPs if needed.
396 			 */
397 			m_copydata(m, sizeof(struct ip) +
398 			    offsetof(struct ip, ip_off),
399 			    sizeof(uint16_t), &ipo->ip_off);
400 			ipo->ip_off &= ~ htons(IP_DF | IP_MF | IP_OFFMASK);
401 		}
402 #ifdef INET6
403 		else if (tp == (IPV6_VERSION >> 4)) {
404 			uint32_t itos32;
405 
406 			/* Save ECN notification. */
407 			m_copydata(m, sizeof(struct ip) +
408 			    offsetof(struct ip6_hdr, ip6_flow),
409 			    sizeof(uint32_t), &itos32);
410 			itos = ntohl(itos32) >> 20;
411 			ipo->ip_p = IPPROTO_IPV6;
412 			ipo->ip_off = 0;
413 		}
414 #endif /* INET6 */
415 		else {
416 			goto nofamily;
417 		}
418 
419 		otos = 0;
420 		ip_ecn_ingress(ECN_ALLOWED, &otos, &itos);
421 		ipo->ip_tos = otos;
422 		break;
423 #endif /* INET */
424 
425 #ifdef INET6
426 	case AF_INET6:
427 		if (IN6_IS_ADDR_UNSPECIFIED(&saidx->dst.sin6.sin6_addr) ||
428 		    saidx->src.sa.sa_family != AF_INET6 ||
429 		    IN6_IS_ADDR_UNSPECIFIED(&saidx->src.sin6.sin6_addr)) {
430 			DPRINTF(("%s: unspecified tunnel endpoint "
431 			    "address in SA %s/%08lx\n", __func__,
432 			    ipsec_address(&saidx->dst, buf, sizeof(buf)),
433 			    (u_long) ntohl(sav->spi)));
434 			IPIP_STATINC(IPIP_STAT_UNSPEC);
435 			error = ENOBUFS;
436 			goto bad;
437 		}
438 
439 		if (tp == (IPV6_VERSION >> 4)) {
440 			/* scoped address handling */
441 			ip6 = mtod(m, struct ip6_hdr *);
442 			if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_src))
443 				ip6->ip6_src.s6_addr16[1] = 0;
444 			if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_dst))
445 				ip6->ip6_dst.s6_addr16[1] = 0;
446 		}
447 
448 		M_PREPEND(m, sizeof(struct ip6_hdr), M_DONTWAIT);
449 		if (m == NULL) {
450 			DPRINTF(("%s: M_PREPEND failed\n", __func__));
451 			IPIP_STATINC(IPIP_STAT_HDROPS);
452 			error = ENOBUFS;
453 			goto bad;
454 		}
455 
456 		iphlen = sizeof(struct ip6_hdr);
457 
458 		/* Initialize IPv6 header */
459 		ip6o = mtod(m, struct ip6_hdr *);
460 		ip6o->ip6_flow = 0;
461 		ip6o->ip6_vfc &= ~IPV6_VERSION_MASK;
462 		ip6o->ip6_vfc |= IPV6_VERSION;
463 		ip6o->ip6_plen = htons(m->m_pkthdr.len - sizeof(*ip6o));
464 		ip6o->ip6_hlim = ip_defttl;
465 		ip6o->ip6_dst = saidx->dst.sin6.sin6_addr;
466 		ip6o->ip6_src = saidx->src.sin6.sin6_addr;
467 		if (IN6_IS_SCOPE_LINKLOCAL(&ip6o->ip6_dst))
468 			ip6o->ip6_dst.s6_addr16[1] = htons(saidx->dst.sin6.sin6_scope_id);
469 		if (IN6_IS_SCOPE_LINKLOCAL(&ip6o->ip6_src))
470 			ip6o->ip6_src.s6_addr16[1] = htons(saidx->src.sin6.sin6_scope_id);
471 
472 #ifdef INET
473 		if (tp == IPVERSION) {
474 			/* Save ECN notification */
475 			m_copydata(m, sizeof(struct ip6_hdr) +
476 			    offsetof(struct ip, ip_tos), sizeof(uint8_t),
477 			    &itos);
478 
479 			/* This is really IPVERSION. */
480 			ip6o->ip6_nxt = IPPROTO_IPIP;
481 		} else
482 #endif /* INET */
483 		if (tp == (IPV6_VERSION >> 4)) {
484 			uint32_t itos32;
485 
486 			/* Save ECN notification. */
487 			m_copydata(m, sizeof(struct ip6_hdr) +
488 			    offsetof(struct ip6_hdr, ip6_flow),
489 			    sizeof(uint32_t), &itos32);
490 			itos = ntohl(itos32) >> 20;
491 
492 			ip6o->ip6_nxt = IPPROTO_IPV6;
493 		} else {
494 			goto nofamily;
495 		}
496 
497 		otos = 0;
498 		ip_ecn_ingress(ECN_ALLOWED, &otos, &itos);
499 		ip6o->ip6_flow |= htonl((uint32_t) otos << 20);
500 		break;
501 #endif /* INET6 */
502 
503 	default:
504 nofamily:
505 		DPRINTF(("%s: unsupported protocol family %u\n", __func__,
506 		    saidx->dst.sa.sa_family));
507 		IPIP_STATINC(IPIP_STAT_FAMILY);
508 		error = EAFNOSUPPORT;
509 		goto bad;
510 	}
511 
512 	IPIP_STATINC(IPIP_STAT_OPACKETS);
513 	IPIP_STATADD(IPIP_STAT_OBYTES, m->m_pkthdr.len - iphlen);
514 #if 0
515 	if (sav->tdb_xform->xf_type == XF_IP4)
516 		tdb->tdb_cur_bytes += m->m_pkthdr.len - iphlen;
517 #endif
518 
519 	*mp = m;
520 	return 0;
521 
522 bad:
523 	if (m)
524 		m_freem(m);
525 	*mp = NULL;
526 	return error;
527 }
528 
529 static int
530 ipe4_init(struct secasvar *sav, const struct xformsw *xsp)
531 {
532 	sav->tdb_xform = xsp;
533 	return 0;
534 }
535 
536 static int
537 ipe4_zeroize(struct secasvar *sav)
538 {
539 	sav->tdb_xform = NULL;
540 	return 0;
541 }
542 
543 static int
544 ipe4_input(struct mbuf *m, struct secasvar *sav, int skip, int protoff)
545 {
546 	/* This is a rather serious mistake, so no conditional printing. */
547 	printf("%s: should never be called\n", __func__);
548 	if (m)
549 		m_freem(m);
550 	return EOPNOTSUPP;
551 }
552 
553 static struct xformsw ipe4_xformsw = {
554 	.xf_type	= XF_IP4,
555 	.xf_flags	= 0,
556 	.xf_name	= "IPv4 Simple Encapsulation",
557 	.xf_init	= ipe4_init,
558 	.xf_zeroize	= ipe4_zeroize,
559 	.xf_input	= ipe4_input,
560 	.xf_output	= ipip_output,
561 	.xf_next	= NULL,
562 };
563 
564 #ifdef INET
565 static struct encapsw ipe4_encapsw = {
566 	.encapsw4 = {
567 		.pr_input = ip4_input,
568 		.pr_ctlinput = NULL,
569 	}
570 };
571 #endif
572 #ifdef INET6
573 static struct encapsw ipe4_encapsw6 = {
574 	.encapsw6 = {
575 		.pr_input = ip4_input6,
576 		.pr_ctlinput = NULL,
577 	}
578 };
579 #endif
580 
581 /*
582  * Check the encapsulated packet to see if we want it
583  */
584 static int
585 ipe4_encapcheck(struct mbuf *m, int off, int proto, void *arg)
586 {
587 	/*
588 	 * Only take packets coming from IPSEC tunnels; the rest
589 	 * must be handled by the gif tunnel code.  Note that we
590 	 * also return a minimum priority when we want the packet
591 	 * so any explicit gif tunnels take precedence.
592 	 */
593 	return ((m->m_flags & M_IPSEC) != 0 ? 1 : 0);
594 }
595 
596 void
597 ipe4_attach(void)
598 {
599 
600 	ipipstat_percpu = percpu_alloc(sizeof(uint64_t) * IPIP_NSTATS);
601 
602 	xform_register(&ipe4_xformsw);
603 	/* attach to encapsulation framework */
604 	/* XXX save return cookie for detach on module remove */
605 
606 	encapinit();
607 	/* This function is called before ifinit(). Who else gets lock? */
608 	(void)encap_lock_enter();
609 	/* ipe4_encapsw and ipe4_encapsw must be added atomically */
610 #ifdef INET
611 	(void)encap_attach_func(AF_INET, -1, ipe4_encapcheck, &ipe4_encapsw,
612 	    NULL);
613 #endif
614 #ifdef INET6
615 	(void)encap_attach_func(AF_INET6, -1, ipe4_encapcheck, &ipe4_encapsw6,
616 	    NULL);
617 #endif
618 	encap_lock_exit();
619 }
620