1 /* $OpenBSD: ipsec_input.c,v 1.138 2017/01/23 09:10:06 mpi Exp $ */ 2 /* 3 * The authors of this code are John Ioannidis (ji@tla.org), 4 * Angelos D. Keromytis (kermit@csd.uch.gr) and 5 * Niels Provos (provos@physnet.uni-hamburg.de). 6 * 7 * This code was written by John Ioannidis for BSD/OS in Athens, Greece, 8 * in November 1995. 9 * 10 * Ported to OpenBSD and NetBSD, with additional transforms, in December 1996, 11 * by Angelos D. Keromytis. 12 * 13 * Additional transforms and features in 1997 and 1998 by Angelos D. Keromytis 14 * and Niels Provos. 15 * 16 * Additional features in 1999 by Angelos D. Keromytis. 17 * 18 * Copyright (C) 1995, 1996, 1997, 1998, 1999 by John Ioannidis, 19 * Angelos D. Keromytis and Niels Provos. 20 * Copyright (c) 2001, Angelos D. Keromytis. 21 * 22 * Permission to use, copy, and modify this software with or without fee 23 * is hereby granted, provided that this entire notice is included in 24 * all copies of any software which is or includes a copy or 25 * modification of this software. 26 * You may use this code under the GNU public license if you so wish. Please 27 * contribute changes back to the authors under this freer than GPL license 28 * so that we may further the use of strong encryption without limitations to 29 * all. 30 * 31 * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR 32 * IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY 33 * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE 34 * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR 35 * PURPOSE. 36 */ 37 38 #include "pf.h" 39 40 #include <sys/param.h> 41 #include <sys/systm.h> 42 #include <sys/protosw.h> 43 #include <sys/mbuf.h> 44 #include <sys/socket.h> 45 #include <sys/sysctl.h> 46 #include <sys/kernel.h> 47 #include <sys/timeout.h> 48 49 #include <net/if.h> 50 #include <net/if_var.h> 51 #include <net/netisr.h> 52 #include <net/bpf.h> 53 #include <net/route.h> 54 55 #include <netinet/in.h> 56 #include <netinet/ip.h> 57 #include <netinet/ip_var.h> 58 #include <netinet/ip_icmp.h> 59 #include <netinet/tcp.h> 60 #include <netinet/udp.h> 61 62 #if NPF > 0 63 #include <net/pfvar.h> 64 #endif 65 66 #ifdef INET6 67 #include <netinet6/in6_var.h> 68 #include <netinet/ip6.h> 69 #include <netinet6/ip6_var.h> 70 #include <netinet6/ip6protosw.h> 71 #endif /* INET6 */ 72 73 #include <netinet/ip_ipsp.h> 74 #include <netinet/ip_esp.h> 75 #include <netinet/ip_ah.h> 76 #include <netinet/ip_ipcomp.h> 77 78 #include <net/if_enc.h> 79 80 #include "bpfilter.h" 81 82 void *ipsec_common_ctlinput(u_int, int, struct sockaddr *, void *, int); 83 int ah4_input_cb(struct mbuf *, ...); 84 int esp4_input_cb(struct mbuf *, ...); 85 int ipcomp4_input_cb(struct mbuf *, ...); 86 87 #ifdef INET6 88 int ah6_input_cb(struct mbuf *, int, int); 89 int esp6_input_cb(struct mbuf *, int, int); 90 int ipcomp6_input_cb(struct mbuf *, int, int); 91 #endif 92 93 #ifdef ENCDEBUG 94 #define DPRINTF(x) if (encdebug) printf x 95 #else 96 #define DPRINTF(x) 97 #endif 98 99 /* sysctl variables */ 100 int esp_enable = 1; 101 int ah_enable = 1; 102 int ipcomp_enable = 0; 103 104 int *espctl_vars[ESPCTL_MAXID] = ESPCTL_VARS; 105 int *ahctl_vars[AHCTL_MAXID] = AHCTL_VARS; 106 int *ipcompctl_vars[IPCOMPCTL_MAXID] = IPCOMPCTL_VARS; 107 108 /* 109 * ipsec_common_input() gets called when we receive an IPsec-protected packet 110 * in IPv4 or IPv6. All it does is find the right TDB and call the appropriate 111 * transform. The callback takes care of further processing (like ingress 112 * filtering). 113 */ 114 int 115 ipsec_common_input(struct mbuf *m, int skip, int protoff, int af, int sproto, 116 int udpencap) 117 { 118 #define IPSEC_ISTAT(x,y,z) (sproto == IPPROTO_ESP ? (x)++ : \ 119 sproto == IPPROTO_AH ? (y)++ : (z)++) 120 121 union sockaddr_union dst_address; 122 struct tdb *tdbp; 123 struct ifnet *encif; 124 u_int32_t spi; 125 u_int16_t cpi; 126 int error; 127 #ifdef ENCDEBUG 128 char buf[INET6_ADDRSTRLEN]; 129 #endif 130 131 splsoftassert(IPL_SOFTNET); 132 133 IPSEC_ISTAT(espstat.esps_input, ahstat.ahs_input, 134 ipcompstat.ipcomps_input); 135 136 if (m == NULL) { 137 DPRINTF(("ipsec_common_input(): NULL packet received\n")); 138 IPSEC_ISTAT(espstat.esps_hdrops, ahstat.ahs_hdrops, 139 ipcompstat.ipcomps_hdrops); 140 return EINVAL; 141 } 142 143 if ((sproto == IPPROTO_ESP && !esp_enable) || 144 (sproto == IPPROTO_AH && !ah_enable) || 145 #if NPF > 0 146 (m->m_pkthdr.pf.flags & PF_TAG_DIVERTED) || 147 #endif 148 (sproto == IPPROTO_IPCOMP && !ipcomp_enable)) { 149 switch (af) { 150 case AF_INET: 151 rip_input(m, skip, sproto); 152 break; 153 #ifdef INET6 154 case AF_INET6: 155 rip6_input(&m, &skip, sproto); 156 break; 157 #endif /* INET6 */ 158 default: 159 DPRINTF(("ipsec_common_input(): unsupported protocol " 160 "family %d\n", af)); 161 m_freem(m); 162 IPSEC_ISTAT(espstat.esps_nopf, ahstat.ahs_nopf, 163 ipcompstat.ipcomps_nopf); 164 return EPFNOSUPPORT; 165 } 166 return 0; 167 } 168 if ((sproto == IPPROTO_IPCOMP) && (m->m_flags & M_COMP)) { 169 m_freem(m); 170 ipcompstat.ipcomps_pdrops++; 171 DPRINTF(("ipsec_common_input(): repeated decompression\n")); 172 return EINVAL; 173 } 174 175 if (m->m_pkthdr.len - skip < 2 * sizeof(u_int32_t)) { 176 m_freem(m); 177 IPSEC_ISTAT(espstat.esps_hdrops, ahstat.ahs_hdrops, 178 ipcompstat.ipcomps_hdrops); 179 DPRINTF(("ipsec_common_input(): packet too small\n")); 180 return EINVAL; 181 } 182 183 /* Retrieve the SPI from the relevant IPsec header */ 184 if (sproto == IPPROTO_ESP) 185 m_copydata(m, skip, sizeof(u_int32_t), (caddr_t) &spi); 186 else if (sproto == IPPROTO_AH) 187 m_copydata(m, skip + sizeof(u_int32_t), sizeof(u_int32_t), 188 (caddr_t) &spi); 189 else if (sproto == IPPROTO_IPCOMP) { 190 m_copydata(m, skip + sizeof(u_int16_t), sizeof(u_int16_t), 191 (caddr_t) &cpi); 192 spi = ntohl(htons(cpi)); 193 } 194 195 /* 196 * Find tunnel control block and (indirectly) call the appropriate 197 * kernel crypto routine. The resulting mbuf chain is a valid 198 * IP packet ready to go through input processing. 199 */ 200 201 memset(&dst_address, 0, sizeof(dst_address)); 202 dst_address.sa.sa_family = af; 203 204 switch (af) { 205 case AF_INET: 206 dst_address.sin.sin_len = sizeof(struct sockaddr_in); 207 m_copydata(m, offsetof(struct ip, ip_dst), 208 sizeof(struct in_addr), 209 (caddr_t) &(dst_address.sin.sin_addr)); 210 break; 211 212 #ifdef INET6 213 case AF_INET6: 214 dst_address.sin6.sin6_len = sizeof(struct sockaddr_in6); 215 m_copydata(m, offsetof(struct ip6_hdr, ip6_dst), 216 sizeof(struct in6_addr), 217 (caddr_t) &(dst_address.sin6.sin6_addr)); 218 in6_recoverscope(&dst_address.sin6, 219 &dst_address.sin6.sin6_addr); 220 break; 221 #endif /* INET6 */ 222 223 default: 224 DPRINTF(("ipsec_common_input(): unsupported protocol " 225 "family %d\n", af)); 226 m_freem(m); 227 IPSEC_ISTAT(espstat.esps_nopf, ahstat.ahs_nopf, 228 ipcompstat.ipcomps_nopf); 229 return EPFNOSUPPORT; 230 } 231 232 tdbp = gettdb(rtable_l2(m->m_pkthdr.ph_rtableid), 233 spi, &dst_address, sproto); 234 if (tdbp == NULL) { 235 DPRINTF(("ipsec_common_input(): could not find SA for " 236 "packet to %s, spi %08x\n", 237 ipsp_address(&dst_address, buf, sizeof(buf)), ntohl(spi))); 238 m_freem(m); 239 IPSEC_ISTAT(espstat.esps_notdb, ahstat.ahs_notdb, 240 ipcompstat.ipcomps_notdb); 241 return ENOENT; 242 } 243 244 if (tdbp->tdb_flags & TDBF_INVALID) { 245 DPRINTF(("ipsec_common_input(): attempted to use invalid " 246 "SA %s/%08x/%u\n", ipsp_address(&dst_address, buf, 247 sizeof(buf)), ntohl(spi), tdbp->tdb_sproto)); 248 m_freem(m); 249 IPSEC_ISTAT(espstat.esps_invalid, ahstat.ahs_invalid, 250 ipcompstat.ipcomps_invalid); 251 return EINVAL; 252 } 253 254 if (udpencap && !(tdbp->tdb_flags & TDBF_UDPENCAP)) { 255 DPRINTF(("ipsec_common_input(): attempted to use non-udpencap " 256 "SA %s/%08x/%u\n", ipsp_address(&dst_address, buf, 257 sizeof(buf)), ntohl(spi), tdbp->tdb_sproto)); 258 m_freem(m); 259 espstat.esps_udpinval++; 260 return EINVAL; 261 } 262 263 if (!udpencap && (tdbp->tdb_flags & TDBF_UDPENCAP)) { 264 DPRINTF(("ipsec_common_input(): attempted to use udpencap " 265 "SA %s/%08x/%u\n", ipsp_address(&dst_address, buf, 266 sizeof(buf)), ntohl(spi), tdbp->tdb_sproto)); 267 m_freem(m); 268 espstat.esps_udpneeded++; 269 return EINVAL; 270 } 271 272 if (tdbp->tdb_xform == NULL) { 273 DPRINTF(("ipsec_common_input(): attempted to use uninitialized " 274 "SA %s/%08x/%u\n", ipsp_address(&dst_address, buf, 275 sizeof(buf)), ntohl(spi), tdbp->tdb_sproto)); 276 m_freem(m); 277 IPSEC_ISTAT(espstat.esps_noxform, ahstat.ahs_noxform, 278 ipcompstat.ipcomps_noxform); 279 return ENXIO; 280 } 281 282 if (sproto != IPPROTO_IPCOMP) { 283 if ((encif = enc_getif(tdbp->tdb_rdomain, 284 tdbp->tdb_tap)) == NULL) { 285 DPRINTF(("ipsec_common_input(): " 286 "no enc%u interface for SA %s/%08x/%u\n", 287 tdbp->tdb_tap, ipsp_address(&dst_address, buf, 288 sizeof(buf)), ntohl(spi), tdbp->tdb_sproto)); 289 m_freem(m); 290 291 IPSEC_ISTAT(espstat.esps_pdrops, 292 ahstat.ahs_pdrops, 293 ipcompstat.ipcomps_pdrops); 294 return EACCES; 295 } 296 297 /* XXX This conflicts with the scoped nature of IPv6 */ 298 m->m_pkthdr.ph_ifidx = encif->if_index; 299 } 300 301 /* Register first use, setup expiration timer. */ 302 if (tdbp->tdb_first_use == 0) { 303 tdbp->tdb_first_use = time_second; 304 if (tdbp->tdb_flags & TDBF_FIRSTUSE) 305 timeout_add_sec(&tdbp->tdb_first_tmo, 306 tdbp->tdb_exp_first_use); 307 if (tdbp->tdb_flags & TDBF_SOFT_FIRSTUSE) 308 timeout_add_sec(&tdbp->tdb_sfirst_tmo, 309 tdbp->tdb_soft_first_use); 310 } 311 312 /* 313 * Call appropriate transform and return -- callback takes care of 314 * everything else. 315 */ 316 error = (*(tdbp->tdb_xform->xf_input))(m, tdbp, skip, protoff); 317 return error; 318 } 319 320 /* 321 * IPsec input callback, called by the transform callback. Takes care of 322 * filtering and other sanity checks on the processed packet. 323 */ 324 int 325 ipsec_common_input_cb(struct mbuf *m, struct tdb *tdbp, int skip, int protoff) 326 { 327 int af, sproto; 328 u_char prot; 329 330 #if NBPFILTER > 0 331 struct ifnet *encif; 332 #endif 333 334 struct ip *ip, ipn; 335 336 #ifdef INET6 337 struct ip6_hdr *ip6, ip6n; 338 #endif /* INET6 */ 339 struct m_tag *mtag; 340 struct tdb_ident *tdbi; 341 342 #ifdef ENCDEBUG 343 char buf[INET6_ADDRSTRLEN]; 344 #endif 345 346 af = tdbp->tdb_dst.sa.sa_family; 347 sproto = tdbp->tdb_sproto; 348 349 tdbp->tdb_last_used = time_second; 350 351 /* Sanity check */ 352 if (m == NULL) { 353 /* The called routine will print a message if necessary */ 354 IPSEC_ISTAT(espstat.esps_badkcr, ahstat.ahs_badkcr, 355 ipcompstat.ipcomps_badkcr); 356 return EINVAL; 357 } 358 359 /* Fix IPv4 header */ 360 if (af == AF_INET) { 361 if ((m->m_len < skip) && ((m = m_pullup(m, skip)) == NULL)) { 362 DPRINTF(("ipsec_common_input_cb(): processing failed " 363 "for SA %s/%08x\n", ipsp_address(&tdbp->tdb_dst, 364 buf, sizeof(buf)), ntohl(tdbp->tdb_spi))); 365 IPSEC_ISTAT(espstat.esps_hdrops, ahstat.ahs_hdrops, 366 ipcompstat.ipcomps_hdrops); 367 return ENOBUFS; 368 } 369 370 ip = mtod(m, struct ip *); 371 ip->ip_len = htons(m->m_pkthdr.len); 372 ip->ip_sum = 0; 373 ip->ip_sum = in_cksum(m, ip->ip_hl << 2); 374 prot = ip->ip_p; 375 376 /* IP-in-IP encapsulation */ 377 if (prot == IPPROTO_IPIP) { 378 if (m->m_pkthdr.len - skip < sizeof(struct ip)) { 379 m_freem(m); 380 IPSEC_ISTAT(espstat.esps_hdrops, 381 ahstat.ahs_hdrops, 382 ipcompstat.ipcomps_hdrops); 383 return EINVAL; 384 } 385 /* ipn will now contain the inner IPv4 header */ 386 m_copydata(m, skip, sizeof(struct ip), 387 (caddr_t) &ipn); 388 } 389 390 #ifdef INET6 391 /* IPv6-in-IP encapsulation. */ 392 if (prot == IPPROTO_IPV6) { 393 if (m->m_pkthdr.len - skip < sizeof(struct ip6_hdr)) { 394 m_freem(m); 395 IPSEC_ISTAT(espstat.esps_hdrops, 396 ahstat.ahs_hdrops, 397 ipcompstat.ipcomps_hdrops); 398 return EINVAL; 399 } 400 /* ip6n will now contain the inner IPv6 header. */ 401 m_copydata(m, skip, sizeof(struct ip6_hdr), 402 (caddr_t) &ip6n); 403 } 404 #endif /* INET6 */ 405 } 406 407 #ifdef INET6 408 /* Fix IPv6 header */ 409 if (af == AF_INET6) 410 { 411 if (m->m_len < sizeof(struct ip6_hdr) && 412 (m = m_pullup(m, sizeof(struct ip6_hdr))) == NULL) { 413 414 DPRINTF(("ipsec_common_input_cb(): processing failed " 415 "for SA %s/%08x\n", ipsp_address(&tdbp->tdb_dst, 416 buf, sizeof(buf)), ntohl(tdbp->tdb_spi))); 417 418 IPSEC_ISTAT(espstat.esps_hdrops, ahstat.ahs_hdrops, 419 ipcompstat.ipcomps_hdrops); 420 return EACCES; 421 } 422 423 ip6 = mtod(m, struct ip6_hdr *); 424 ip6->ip6_plen = htons(m->m_pkthdr.len - skip); 425 426 /* Save protocol */ 427 m_copydata(m, protoff, 1, (caddr_t) &prot); 428 429 /* IP-in-IP encapsulation */ 430 if (prot == IPPROTO_IPIP) { 431 if (m->m_pkthdr.len - skip < sizeof(struct ip)) { 432 m_freem(m); 433 IPSEC_ISTAT(espstat.esps_hdrops, 434 ahstat.ahs_hdrops, 435 ipcompstat.ipcomps_hdrops); 436 return EINVAL; 437 } 438 /* ipn will now contain the inner IPv4 header */ 439 m_copydata(m, skip, sizeof(struct ip), (caddr_t) &ipn); 440 } 441 442 /* IPv6-in-IP encapsulation */ 443 if (prot == IPPROTO_IPV6) { 444 if (m->m_pkthdr.len - skip < sizeof(struct ip6_hdr)) { 445 m_freem(m); 446 IPSEC_ISTAT(espstat.esps_hdrops, 447 ahstat.ahs_hdrops, 448 ipcompstat.ipcomps_hdrops); 449 return EINVAL; 450 } 451 /* ip6n will now contain the inner IPv6 header. */ 452 m_copydata(m, skip, sizeof(struct ip6_hdr), 453 (caddr_t) &ip6n); 454 } 455 } 456 #endif /* INET6 */ 457 458 /* 459 * Fix TCP/UDP checksum of UDP encapsulated transport mode ESP packet. 460 * (RFC3948 3.1.2) 461 */ 462 if ((af == AF_INET || af == AF_INET6) && 463 (tdbp->tdb_flags & TDBF_UDPENCAP) && 464 (tdbp->tdb_flags & TDBF_TUNNELING) == 0) { 465 u_int16_t cksum; 466 467 switch (prot) { 468 case IPPROTO_UDP: 469 if (m->m_pkthdr.len < skip + sizeof(struct udphdr)) { 470 m_freem(m); 471 IPSEC_ISTAT(espstat.esps_hdrops, 472 ahstat.ahs_hdrops, 473 ipcompstat.ipcomps_hdrops); 474 return EINVAL; 475 } 476 cksum = 0; 477 m_copyback(m, skip + offsetof(struct udphdr, uh_sum), 478 sizeof(cksum), &cksum, M_NOWAIT); 479 #ifdef INET6 480 if (af == AF_INET6) { 481 cksum = in6_cksum(m, IPPROTO_UDP, skip, 482 m->m_pkthdr.len - skip); 483 m_copyback(m, skip + offsetof(struct udphdr, 484 uh_sum), sizeof(cksum), &cksum, M_NOWAIT); 485 } 486 #endif 487 break; 488 case IPPROTO_TCP: 489 if (m->m_pkthdr.len < skip + sizeof(struct tcphdr)) { 490 m_freem(m); 491 IPSEC_ISTAT(espstat.esps_hdrops, 492 ahstat.ahs_hdrops, 493 ipcompstat.ipcomps_hdrops); 494 return EINVAL; 495 } 496 cksum = 0; 497 m_copyback(m, skip + offsetof(struct tcphdr, th_sum), 498 sizeof(cksum), &cksum, M_NOWAIT); 499 if (af == AF_INET) 500 cksum = in4_cksum(m, IPPROTO_TCP, skip, 501 m->m_pkthdr.len - skip); 502 #ifdef INET6 503 else if (af == AF_INET6) 504 cksum = in6_cksum(m, IPPROTO_TCP, skip, 505 m->m_pkthdr.len - skip); 506 #endif 507 m_copyback(m, skip + offsetof(struct tcphdr, th_sum), 508 sizeof(cksum), &cksum, M_NOWAIT); 509 break; 510 } 511 } 512 513 /* 514 * Record what we've done to the packet (under what SA it was 515 * processed). 516 */ 517 if (tdbp->tdb_sproto != IPPROTO_IPCOMP) { 518 mtag = m_tag_get(PACKET_TAG_IPSEC_IN_DONE, 519 sizeof(struct tdb_ident), M_NOWAIT); 520 if (mtag == NULL) { 521 m_freem(m); 522 DPRINTF(("ipsec_common_input_cb(): failed to " 523 "get tag\n")); 524 IPSEC_ISTAT(espstat.esps_hdrops, ahstat.ahs_hdrops, 525 ipcompstat.ipcomps_hdrops); 526 return ENOMEM; 527 } 528 529 tdbi = (struct tdb_ident *)(mtag + 1); 530 bcopy(&tdbp->tdb_dst, &tdbi->dst, 531 sizeof(union sockaddr_union)); 532 tdbi->proto = tdbp->tdb_sproto; 533 tdbi->spi = tdbp->tdb_spi; 534 tdbi->rdomain = tdbp->tdb_rdomain; 535 536 m_tag_prepend(m, mtag); 537 } 538 539 if (sproto == IPPROTO_ESP) { 540 /* Packet is confidential ? */ 541 if (tdbp->tdb_encalgxform) 542 m->m_flags |= M_CONF; 543 544 /* Check if we had authenticated ESP. */ 545 if (tdbp->tdb_authalgxform) 546 m->m_flags |= M_AUTH; 547 } else if (sproto == IPPROTO_AH) { 548 m->m_flags |= M_AUTH; 549 } else if (sproto == IPPROTO_IPCOMP) { 550 m->m_flags |= M_COMP; 551 } 552 553 #if NPF > 0 554 /* Add pf tag if requested. */ 555 pf_tag_packet(m, tdbp->tdb_tag, -1); 556 pf_pkt_addr_changed(m); 557 #endif 558 559 if (tdbp->tdb_flags & TDBF_TUNNELING) 560 m->m_flags |= M_TUNNEL; 561 562 #if NBPFILTER > 0 563 if ((encif = enc_getif(tdbp->tdb_rdomain, tdbp->tdb_tap)) != NULL) { 564 encif->if_ipackets++; 565 encif->if_ibytes += m->m_pkthdr.len; 566 567 if (encif->if_bpf) { 568 struct enchdr hdr; 569 570 hdr.af = af; 571 hdr.spi = tdbp->tdb_spi; 572 hdr.flags = m->m_flags & (M_AUTH|M_CONF); 573 574 bpf_mtap_hdr(encif->if_bpf, (char *)&hdr, 575 ENC_HDRLEN, m, BPF_DIRECTION_IN, NULL); 576 } 577 } 578 #endif 579 580 /* Call the appropriate IPsec transform callback. */ 581 switch (af) { 582 case AF_INET: 583 switch (sproto) 584 { 585 case IPPROTO_ESP: 586 return esp4_input_cb(m); 587 588 case IPPROTO_AH: 589 return ah4_input_cb(m); 590 591 case IPPROTO_IPCOMP: 592 return ipcomp4_input_cb(m); 593 594 default: 595 DPRINTF(("ipsec_common_input_cb(): unknown/unsupported" 596 " security protocol %d\n", sproto)); 597 m_freem(m); 598 return EPFNOSUPPORT; 599 } 600 break; 601 602 #ifdef INET6 603 case AF_INET6: 604 switch (sproto) { 605 case IPPROTO_ESP: 606 return esp6_input_cb(m, skip, protoff); 607 608 case IPPROTO_AH: 609 return ah6_input_cb(m, skip, protoff); 610 611 case IPPROTO_IPCOMP: 612 return ipcomp6_input_cb(m, skip, protoff); 613 614 default: 615 DPRINTF(("ipsec_common_input_cb(): unknown/unsupported" 616 " security protocol %d\n", sproto)); 617 m_freem(m); 618 return EPFNOSUPPORT; 619 } 620 break; 621 #endif /* INET6 */ 622 623 default: 624 DPRINTF(("ipsec_common_input_cb(): unknown/unsupported " 625 "protocol family %d\n", af)); 626 m_freem(m); 627 return EPFNOSUPPORT; 628 } 629 #undef IPSEC_ISTAT 630 } 631 632 int 633 esp_sysctl(int *name, u_int namelen, void *oldp, size_t *oldlenp, void *newp, 634 size_t newlen) 635 { 636 /* All sysctl names at this level are terminal. */ 637 if (namelen != 1) 638 return (ENOTDIR); 639 640 switch (name[0]) { 641 case ESPCTL_STATS: 642 if (newp != NULL) 643 return (EPERM); 644 return (sysctl_struct(oldp, oldlenp, newp, newlen, 645 &espstat, sizeof(espstat))); 646 default: 647 if (name[0] < ESPCTL_MAXID) 648 return (sysctl_int_arr(espctl_vars, name, namelen, 649 oldp, oldlenp, newp, newlen)); 650 return (ENOPROTOOPT); 651 } 652 } 653 654 int 655 ah_sysctl(int *name, u_int namelen, void *oldp, size_t *oldlenp, void *newp, 656 size_t newlen) 657 { 658 /* All sysctl names at this level are terminal. */ 659 if (namelen != 1) 660 return (ENOTDIR); 661 662 switch (name[0]) { 663 case AHCTL_STATS: 664 if (newp != NULL) 665 return (EPERM); 666 return (sysctl_struct(oldp, oldlenp, newp, newlen, 667 &ahstat, sizeof(ahstat))); 668 default: 669 if (name[0] < AHCTL_MAXID) 670 return (sysctl_int_arr(ahctl_vars, name, namelen, 671 oldp, oldlenp, newp, newlen)); 672 return (ENOPROTOOPT); 673 } 674 } 675 676 int 677 ipcomp_sysctl(int *name, u_int namelen, void *oldp, size_t *oldlenp, void *newp, 678 size_t newlen) 679 { 680 /* All sysctl names at this level are terminal. */ 681 if (namelen != 1) 682 return (ENOTDIR); 683 684 switch (name[0]) { 685 case IPCOMPCTL_STATS: 686 if (newp != NULL) 687 return (EPERM); 688 return (sysctl_struct(oldp, oldlenp, newp, newlen, 689 &ipcompstat, sizeof(ipcompstat))); 690 default: 691 if (name[0] < IPCOMPCTL_MAXID) 692 return (sysctl_int_arr(ipcompctl_vars, name, namelen, 693 oldp, oldlenp, newp, newlen)); 694 return (ENOPROTOOPT); 695 } 696 } 697 698 /* IPv4 AH wrapper. */ 699 void 700 ah4_input(struct mbuf *m, ...) 701 { 702 int skip; 703 704 va_list ap; 705 va_start(ap, m); 706 skip = va_arg(ap, int); 707 va_end(ap); 708 709 ipsec_common_input(m, skip, offsetof(struct ip, ip_p), AF_INET, 710 IPPROTO_AH, 0); 711 return; 712 } 713 714 /* IPv4 AH callback. */ 715 int 716 ah4_input_cb(struct mbuf *m, ...) 717 { 718 /* 719 * Interface pointer is already in first mbuf; chop off the 720 * `outer' header and reschedule. 721 */ 722 723 if (niq_enqueue(&ipintrq, m) != 0) { 724 ahstat.ahs_qfull++; 725 DPRINTF(("ah4_input_cb(): dropped packet because of full " 726 "IP queue\n")); 727 return ENOBUFS; 728 } 729 730 return 0; 731 } 732 733 734 /* XXX rdomain */ 735 void * 736 ah4_ctlinput(int cmd, struct sockaddr *sa, u_int rdomain, void *v) 737 { 738 if (sa->sa_family != AF_INET || 739 sa->sa_len != sizeof(struct sockaddr_in)) 740 return (NULL); 741 742 return (ipsec_common_ctlinput(rdomain, cmd, sa, v, IPPROTO_AH)); 743 } 744 745 /* IPv4 ESP wrapper. */ 746 void 747 esp4_input(struct mbuf *m, ...) 748 { 749 int skip; 750 751 va_list ap; 752 va_start(ap, m); 753 skip = va_arg(ap, int); 754 va_end(ap); 755 756 ipsec_common_input(m, skip, offsetof(struct ip, ip_p), AF_INET, 757 IPPROTO_ESP, 0); 758 } 759 760 /* IPv4 ESP callback. */ 761 int 762 esp4_input_cb(struct mbuf *m, ...) 763 { 764 /* 765 * Interface pointer is already in first mbuf; chop off the 766 * `outer' header and reschedule. 767 */ 768 if (niq_enqueue(&ipintrq, m) != 0) { 769 espstat.esps_qfull++; 770 DPRINTF(("esp4_input_cb(): dropped packet because of full " 771 "IP queue\n")); 772 return ENOBUFS; 773 } 774 775 return 0; 776 } 777 778 /* IPv4 IPCOMP wrapper */ 779 void 780 ipcomp4_input(struct mbuf *m, ...) 781 { 782 int skip; 783 va_list ap; 784 va_start(ap, m); 785 skip = va_arg(ap, int); 786 va_end(ap); 787 788 ipsec_common_input(m, skip, offsetof(struct ip, ip_p), AF_INET, 789 IPPROTO_IPCOMP, 0); 790 } 791 792 /* IPv4 IPCOMP callback */ 793 int 794 ipcomp4_input_cb(struct mbuf *m, ...) 795 { 796 /* 797 * Interface pointer is already in first mbuf; chop off the 798 * `outer' header and reschedule. 799 */ 800 if (niq_enqueue(&ipintrq, m) != 0) { 801 ipcompstat.ipcomps_qfull++; 802 DPRINTF(("ipcomp4_input_cb(): dropped packet because of full IP queue\n")); 803 return ENOBUFS; 804 } 805 806 return 0; 807 } 808 809 void * 810 ipsec_common_ctlinput(u_int rdomain, int cmd, struct sockaddr *sa, 811 void *v, int proto) 812 { 813 struct ip *ip = v; 814 815 if (cmd == PRC_MSGSIZE && ip && ip_mtudisc && ip->ip_v == 4) { 816 struct tdb *tdbp; 817 struct sockaddr_in dst; 818 struct icmp *icp; 819 int hlen = ip->ip_hl << 2; 820 u_int32_t spi, mtu; 821 ssize_t adjust; 822 823 /* Find the right MTU. */ 824 icp = (struct icmp *)((caddr_t) ip - 825 offsetof(struct icmp, icmp_ip)); 826 mtu = ntohs(icp->icmp_nextmtu); 827 828 /* 829 * Ignore the packet, if we do not receive a MTU 830 * or the MTU is too small to be acceptable. 831 */ 832 if (mtu < 296) 833 return (NULL); 834 835 memset(&dst, 0, sizeof(struct sockaddr_in)); 836 dst.sin_family = AF_INET; 837 dst.sin_len = sizeof(struct sockaddr_in); 838 dst.sin_addr.s_addr = ip->ip_dst.s_addr; 839 840 bcopy((caddr_t)ip + hlen, &spi, sizeof(u_int32_t)); 841 842 tdbp = gettdb(rdomain, spi, (union sockaddr_union *)&dst, 843 proto); 844 if (tdbp == NULL || tdbp->tdb_flags & TDBF_INVALID) 845 return (NULL); 846 847 /* Walk the chain backwards to the first tdb */ 848 for (; tdbp; tdbp = tdbp->tdb_inext) { 849 if (tdbp->tdb_flags & TDBF_INVALID || 850 (adjust = ipsec_hdrsz(tdbp)) == -1) 851 return (NULL); 852 853 mtu -= adjust; 854 855 /* Store adjusted MTU in tdb */ 856 tdbp->tdb_mtu = mtu; 857 tdbp->tdb_mtutimeout = time_second + 858 ip_mtudisc_timeout; 859 DPRINTF(("ipsec_common_ctlinput: " 860 "spi %08x mtu %d adjust %ld\n", 861 ntohl(tdbp->tdb_spi), tdbp->tdb_mtu, 862 adjust)); 863 } 864 } 865 return (NULL); 866 } 867 868 /* XXX rdomain */ 869 void * 870 udpencap_ctlinput(int cmd, struct sockaddr *sa, u_int rdomain, void *v) 871 { 872 struct ip *ip = v; 873 struct tdb *tdbp; 874 struct icmp *icp; 875 u_int32_t mtu; 876 ssize_t adjust; 877 struct sockaddr_in dst, src; 878 union sockaddr_union *su_dst, *su_src; 879 880 splsoftassert(IPL_SOFTNET); 881 882 icp = (struct icmp *)((caddr_t) ip - offsetof(struct icmp, icmp_ip)); 883 mtu = ntohs(icp->icmp_nextmtu); 884 885 /* 886 * Ignore the packet, if we do not receive a MTU 887 * or the MTU is too small to be acceptable. 888 */ 889 if (mtu < 296) 890 return (NULL); 891 892 memset(&dst, 0, sizeof(dst)); 893 dst.sin_family = AF_INET; 894 dst.sin_len = sizeof(struct sockaddr_in); 895 dst.sin_addr.s_addr = ip->ip_dst.s_addr; 896 su_dst = (union sockaddr_union *)&dst; 897 memset(&src, 0, sizeof(src)); 898 src.sin_family = AF_INET; 899 src.sin_len = sizeof(struct sockaddr_in); 900 src.sin_addr.s_addr = ip->ip_src.s_addr; 901 su_src = (union sockaddr_union *)&src; 902 903 tdbp = gettdbbysrcdst(rdomain, 0, su_src, su_dst, IPPROTO_ESP); 904 905 for (; tdbp != NULL; tdbp = tdbp->tdb_snext) { 906 if (tdbp->tdb_sproto == IPPROTO_ESP && 907 ((tdbp->tdb_flags & (TDBF_INVALID|TDBF_UDPENCAP)) == 908 TDBF_UDPENCAP) && 909 !memcmp(&tdbp->tdb_dst, &dst, SA_LEN(&su_dst->sa)) && 910 !memcmp(&tdbp->tdb_src, &src, SA_LEN(&su_src->sa))) { 911 if ((adjust = ipsec_hdrsz(tdbp)) != -1) { 912 /* Store adjusted MTU in tdb */ 913 tdbp->tdb_mtu = mtu - adjust; 914 tdbp->tdb_mtutimeout = time_second + 915 ip_mtudisc_timeout; 916 DPRINTF(("udpencap_ctlinput: " 917 "spi %08x mtu %d adjust %ld\n", 918 ntohl(tdbp->tdb_spi), tdbp->tdb_mtu, 919 adjust)); 920 } 921 } 922 } 923 return (NULL); 924 } 925 926 /* XXX rdomain */ 927 void * 928 esp4_ctlinput(int cmd, struct sockaddr *sa, u_int rdomain, void *v) 929 { 930 if (sa->sa_family != AF_INET || 931 sa->sa_len != sizeof(struct sockaddr_in)) 932 return (NULL); 933 934 return (ipsec_common_ctlinput(rdomain, cmd, sa, v, IPPROTO_ESP)); 935 } 936 937 #ifdef INET6 938 /* IPv6 AH wrapper. */ 939 int 940 ah6_input(struct mbuf **mp, int *offp, int proto) 941 { 942 int l = 0; 943 int protoff, nxt; 944 struct ip6_ext ip6e; 945 946 if (*offp < sizeof(struct ip6_hdr)) { 947 DPRINTF(("ah6_input(): bad offset\n")); 948 ahstat.ahs_hdrops++; 949 m_freem(*mp); 950 *mp = NULL; 951 return IPPROTO_DONE; 952 } else if (*offp == sizeof(struct ip6_hdr)) { 953 protoff = offsetof(struct ip6_hdr, ip6_nxt); 954 } else { 955 /* Chase down the header chain... */ 956 protoff = sizeof(struct ip6_hdr); 957 nxt = (mtod(*mp, struct ip6_hdr *))->ip6_nxt; 958 959 do { 960 protoff += l; 961 m_copydata(*mp, protoff, sizeof(ip6e), 962 (caddr_t) &ip6e); 963 964 if (nxt == IPPROTO_AH) 965 l = (ip6e.ip6e_len + 2) << 2; 966 else 967 l = (ip6e.ip6e_len + 1) << 3; 968 #ifdef DIAGNOSTIC 969 if (l <= 0) 970 panic("ah6_input: l went zero or negative"); 971 #endif 972 973 nxt = ip6e.ip6e_nxt; 974 } while (protoff + l < *offp); 975 976 /* Malformed packet check */ 977 if (protoff + l != *offp) { 978 DPRINTF(("ah6_input(): bad packet header chain\n")); 979 ahstat.ahs_hdrops++; 980 m_freem(*mp); 981 *mp = NULL; 982 return IPPROTO_DONE; 983 } 984 protoff += offsetof(struct ip6_ext, ip6e_nxt); 985 } 986 ipsec_common_input(*mp, *offp, protoff, AF_INET6, proto, 0); 987 return IPPROTO_DONE; 988 } 989 990 /* IPv6 AH callback. */ 991 int 992 ah6_input_cb(struct mbuf *m, int off, int protoff) 993 { 994 int nxt; 995 u_int8_t nxt8; 996 int nest = 0; 997 998 /* Retrieve new protocol */ 999 m_copydata(m, protoff, sizeof(u_int8_t), (caddr_t) &nxt8); 1000 nxt = nxt8; 1001 1002 /* 1003 * see the end of ip6_input for this logic. 1004 * IPPROTO_IPV[46] case will be processed just like other ones 1005 */ 1006 while (nxt != IPPROTO_DONE) { 1007 if (ip6_hdrnestlimit && (++nest > ip6_hdrnestlimit)) { 1008 ip6stat.ip6s_toomanyhdr++; 1009 goto bad; 1010 } 1011 1012 /* 1013 * Protection against faulty packet - there should be 1014 * more sanity checks in header chain processing. 1015 */ 1016 if (m->m_pkthdr.len < off) { 1017 ip6stat.ip6s_tooshort++; 1018 goto bad; 1019 } 1020 nxt = (*inet6sw[ip6_protox[nxt]].pr_input)(&m, &off, nxt); 1021 } 1022 return 0; 1023 1024 bad: 1025 m_freem(m); 1026 return EINVAL; 1027 } 1028 1029 /* IPv6 ESP wrapper. */ 1030 int 1031 esp6_input(struct mbuf **mp, int *offp, int proto) 1032 { 1033 int l = 0; 1034 int protoff, nxt; 1035 struct ip6_ext ip6e; 1036 1037 if (*offp < sizeof(struct ip6_hdr)) { 1038 DPRINTF(("esp6_input(): bad offset\n")); 1039 espstat.esps_hdrops++; 1040 m_freem(*mp); 1041 *mp = NULL; 1042 return IPPROTO_DONE; 1043 } else if (*offp == sizeof(struct ip6_hdr)) { 1044 protoff = offsetof(struct ip6_hdr, ip6_nxt); 1045 } else { 1046 /* Chase down the header chain... */ 1047 protoff = sizeof(struct ip6_hdr); 1048 nxt = (mtod(*mp, struct ip6_hdr *))->ip6_nxt; 1049 1050 do { 1051 protoff += l; 1052 m_copydata(*mp, protoff, sizeof(ip6e), 1053 (caddr_t) &ip6e); 1054 1055 if (nxt == IPPROTO_AH) 1056 l = (ip6e.ip6e_len + 2) << 2; 1057 else 1058 l = (ip6e.ip6e_len + 1) << 3; 1059 #ifdef DIAGNOSTIC 1060 if (l <= 0) 1061 panic("esp6_input: l went zero or negative"); 1062 #endif 1063 1064 nxt = ip6e.ip6e_nxt; 1065 } while (protoff + l < *offp); 1066 1067 /* Malformed packet check */ 1068 if (protoff + l != *offp) { 1069 DPRINTF(("esp6_input(): bad packet header chain\n")); 1070 espstat.esps_hdrops++; 1071 m_freem(*mp); 1072 *mp = NULL; 1073 return IPPROTO_DONE; 1074 } 1075 protoff += offsetof(struct ip6_ext, ip6e_nxt); 1076 } 1077 ipsec_common_input(*mp, *offp, protoff, AF_INET6, proto, 0); 1078 return IPPROTO_DONE; 1079 1080 } 1081 1082 /* IPv6 ESP callback */ 1083 int 1084 esp6_input_cb(struct mbuf *m, int skip, int protoff) 1085 { 1086 return ah6_input_cb(m, skip, protoff); 1087 } 1088 1089 /* IPv6 IPcomp wrapper */ 1090 int 1091 ipcomp6_input(struct mbuf **mp, int *offp, int proto) 1092 { 1093 int l = 0; 1094 int protoff, nxt; 1095 struct ip6_ext ip6e; 1096 1097 if (*offp < sizeof(struct ip6_hdr)) { 1098 DPRINTF(("ipcomp6_input(): bad offset\n")); 1099 ipcompstat.ipcomps_hdrops++; 1100 m_freem(*mp); 1101 *mp = NULL; 1102 return IPPROTO_DONE; 1103 } else if (*offp == sizeof(struct ip6_hdr)) { 1104 protoff = offsetof(struct ip6_hdr, ip6_nxt); 1105 } else { 1106 /* Chase down the header chain... */ 1107 protoff = sizeof(struct ip6_hdr); 1108 nxt = (mtod(*mp, struct ip6_hdr *))->ip6_nxt; 1109 1110 do { 1111 protoff += l; 1112 m_copydata(*mp, protoff, sizeof(ip6e), 1113 (caddr_t) &ip6e); 1114 if (nxt == IPPROTO_AH) 1115 l = (ip6e.ip6e_len + 2) << 2; 1116 else 1117 l = (ip6e.ip6e_len + 1) << 3; 1118 #ifdef DIAGNOSTIC 1119 if (l <= 0) 1120 panic("ipcomp6_input: l went zero or negative"); 1121 #endif 1122 1123 nxt = ip6e.ip6e_nxt; 1124 } while (protoff + l < *offp); 1125 1126 /* Malformed packet check */ 1127 if (protoff + l != *offp) { 1128 DPRINTF(("ipcomp6_input(): bad packet header chain\n")); 1129 ipcompstat.ipcomps_hdrops++; 1130 m_freem(*mp); 1131 *mp = NULL; 1132 return IPPROTO_DONE; 1133 } 1134 1135 protoff += offsetof(struct ip6_ext, ip6e_nxt); 1136 } 1137 ipsec_common_input(*mp, *offp, protoff, AF_INET6, proto, 0); 1138 return IPPROTO_DONE; 1139 } 1140 1141 /* IPv6 IPcomp callback */ 1142 int 1143 ipcomp6_input_cb(struct mbuf *m, int skip, int protoff) 1144 { 1145 return ah6_input_cb(m, skip, protoff); 1146 } 1147 1148 #endif /* INET6 */ 1149