1 /* $OpenBSD: ipsec_input.c,v 1.135 2015/09/10 17:52:05 claudio Exp $ */ 2 /* 3 * The authors of this code are John Ioannidis (ji@tla.org), 4 * Angelos D. Keromytis (kermit@csd.uch.gr) and 5 * Niels Provos (provos@physnet.uni-hamburg.de). 6 * 7 * This code was written by John Ioannidis for BSD/OS in Athens, Greece, 8 * in November 1995. 9 * 10 * Ported to OpenBSD and NetBSD, with additional transforms, in December 1996, 11 * by Angelos D. Keromytis. 12 * 13 * Additional transforms and features in 1997 and 1998 by Angelos D. Keromytis 14 * and Niels Provos. 15 * 16 * Additional features in 1999 by Angelos D. Keromytis. 17 * 18 * Copyright (C) 1995, 1996, 1997, 1998, 1999 by John Ioannidis, 19 * Angelos D. Keromytis and Niels Provos. 20 * Copyright (c) 2001, Angelos D. Keromytis. 21 * 22 * Permission to use, copy, and modify this software with or without fee 23 * is hereby granted, provided that this entire notice is included in 24 * all copies of any software which is or includes a copy or 25 * modification of this software. 26 * You may use this code under the GNU public license if you so wish. Please 27 * contribute changes back to the authors under this freer than GPL license 28 * so that we may further the use of strong encryption without limitations to 29 * all. 30 * 31 * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR 32 * IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY 33 * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE 34 * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR 35 * PURPOSE. 36 */ 37 38 #include "pf.h" 39 40 #include <sys/param.h> 41 #include <sys/systm.h> 42 #include <sys/protosw.h> 43 #include <sys/mbuf.h> 44 #include <sys/socket.h> 45 #include <sys/sysctl.h> 46 #include <sys/kernel.h> 47 #include <sys/timeout.h> 48 49 #include <net/if.h> 50 #include <net/if_var.h> 51 #include <net/netisr.h> 52 #include <net/bpf.h> 53 #include <net/route.h> 54 55 #include <netinet/in.h> 56 #include <netinet/ip.h> 57 #include <netinet/ip_var.h> 58 #include <netinet/ip_icmp.h> 59 #include <netinet/tcp.h> 60 #include <netinet/udp.h> 61 62 #if NPF > 0 63 #include <net/pfvar.h> 64 #endif 65 66 #ifdef INET6 67 #include <netinet6/in6_var.h> 68 #include <netinet/ip6.h> 69 #include <netinet6/ip6_var.h> 70 #include <netinet6/ip6protosw.h> 71 #endif /* INET6 */ 72 73 #include <netinet/ip_ipsp.h> 74 #include <netinet/ip_esp.h> 75 #include <netinet/ip_ah.h> 76 #include <netinet/ip_ipcomp.h> 77 78 #include <net/if_enc.h> 79 80 #include "bpfilter.h" 81 82 void *ipsec_common_ctlinput(u_int, int, struct sockaddr *, void *, int); 83 int ah4_input_cb(struct mbuf *, ...); 84 int esp4_input_cb(struct mbuf *, ...); 85 int ipcomp4_input_cb(struct mbuf *, ...); 86 87 #ifdef INET6 88 int ah6_input_cb(struct mbuf *, int, int); 89 int esp6_input_cb(struct mbuf *, int, int); 90 int ipcomp6_input_cb(struct mbuf *, int, int); 91 #endif 92 93 #ifdef ENCDEBUG 94 #define DPRINTF(x) if (encdebug) printf x 95 #else 96 #define DPRINTF(x) 97 #endif 98 99 /* sysctl variables */ 100 int esp_enable = 1; 101 int ah_enable = 1; 102 int ipcomp_enable = 0; 103 104 int *espctl_vars[ESPCTL_MAXID] = ESPCTL_VARS; 105 int *ahctl_vars[AHCTL_MAXID] = AHCTL_VARS; 106 int *ipcompctl_vars[IPCOMPCTL_MAXID] = IPCOMPCTL_VARS; 107 108 /* 109 * ipsec_common_input() gets called when we receive an IPsec-protected packet 110 * in IPv4 or IPv6. All it does is find the right TDB and call the appropriate 111 * transform. The callback takes care of further processing (like ingress 112 * filtering). 113 */ 114 int 115 ipsec_common_input(struct mbuf *m, int skip, int protoff, int af, int sproto, 116 int udpencap) 117 { 118 #define IPSEC_ISTAT(x,y,z) (sproto == IPPROTO_ESP ? (x)++ : \ 119 sproto == IPPROTO_AH ? (y)++ : (z)++) 120 121 union sockaddr_union dst_address; 122 struct tdb *tdbp; 123 struct ifnet *encif; 124 u_int32_t spi; 125 u_int16_t cpi; 126 int s, error; 127 #ifdef ENCDEBUG 128 char buf[INET6_ADDRSTRLEN]; 129 #endif 130 131 IPSEC_ISTAT(espstat.esps_input, ahstat.ahs_input, 132 ipcompstat.ipcomps_input); 133 134 if (m == NULL) { 135 DPRINTF(("ipsec_common_input(): NULL packet received\n")); 136 IPSEC_ISTAT(espstat.esps_hdrops, ahstat.ahs_hdrops, 137 ipcompstat.ipcomps_hdrops); 138 return EINVAL; 139 } 140 141 if ((sproto == IPPROTO_ESP && !esp_enable) || 142 (sproto == IPPROTO_AH && !ah_enable) || 143 #if NPF > 0 144 (m->m_pkthdr.pf.flags & PF_TAG_DIVERTED) || 145 #endif 146 (sproto == IPPROTO_IPCOMP && !ipcomp_enable)) { 147 switch (af) { 148 case AF_INET: 149 rip_input(m, skip, sproto); 150 break; 151 #ifdef INET6 152 case AF_INET6: 153 rip6_input(&m, &skip, sproto); 154 break; 155 #endif /* INET6 */ 156 default: 157 DPRINTF(("ipsec_common_input(): unsupported protocol " 158 "family %d\n", af)); 159 m_freem(m); 160 IPSEC_ISTAT(espstat.esps_nopf, ahstat.ahs_nopf, 161 ipcompstat.ipcomps_nopf); 162 return EPFNOSUPPORT; 163 } 164 return 0; 165 } 166 if ((sproto == IPPROTO_IPCOMP) && (m->m_flags & M_COMP)) { 167 m_freem(m); 168 ipcompstat.ipcomps_pdrops++; 169 DPRINTF(("ipsec_common_input(): repeated decompression\n")); 170 return EINVAL; 171 } 172 173 if (m->m_pkthdr.len - skip < 2 * sizeof(u_int32_t)) { 174 m_freem(m); 175 IPSEC_ISTAT(espstat.esps_hdrops, ahstat.ahs_hdrops, 176 ipcompstat.ipcomps_hdrops); 177 DPRINTF(("ipsec_common_input(): packet too small\n")); 178 return EINVAL; 179 } 180 181 /* Retrieve the SPI from the relevant IPsec header */ 182 if (sproto == IPPROTO_ESP) 183 m_copydata(m, skip, sizeof(u_int32_t), (caddr_t) &spi); 184 else if (sproto == IPPROTO_AH) 185 m_copydata(m, skip + sizeof(u_int32_t), sizeof(u_int32_t), 186 (caddr_t) &spi); 187 else if (sproto == IPPROTO_IPCOMP) { 188 m_copydata(m, skip + sizeof(u_int16_t), sizeof(u_int16_t), 189 (caddr_t) &cpi); 190 spi = ntohl(htons(cpi)); 191 } 192 193 /* 194 * Find tunnel control block and (indirectly) call the appropriate 195 * kernel crypto routine. The resulting mbuf chain is a valid 196 * IP packet ready to go through input processing. 197 */ 198 199 memset(&dst_address, 0, sizeof(dst_address)); 200 dst_address.sa.sa_family = af; 201 202 switch (af) { 203 case AF_INET: 204 dst_address.sin.sin_len = sizeof(struct sockaddr_in); 205 m_copydata(m, offsetof(struct ip, ip_dst), 206 sizeof(struct in_addr), 207 (caddr_t) &(dst_address.sin.sin_addr)); 208 break; 209 210 #ifdef INET6 211 case AF_INET6: 212 dst_address.sin6.sin6_len = sizeof(struct sockaddr_in6); 213 m_copydata(m, offsetof(struct ip6_hdr, ip6_dst), 214 sizeof(struct in6_addr), 215 (caddr_t) &(dst_address.sin6.sin6_addr)); 216 in6_recoverscope(&dst_address.sin6, 217 &dst_address.sin6.sin6_addr); 218 break; 219 #endif /* INET6 */ 220 221 default: 222 DPRINTF(("ipsec_common_input(): unsupported protocol " 223 "family %d\n", af)); 224 m_freem(m); 225 IPSEC_ISTAT(espstat.esps_nopf, ahstat.ahs_nopf, 226 ipcompstat.ipcomps_nopf); 227 return EPFNOSUPPORT; 228 } 229 230 s = splsoftnet(); 231 tdbp = gettdb(rtable_l2(m->m_pkthdr.ph_rtableid), 232 spi, &dst_address, sproto); 233 if (tdbp == NULL) { 234 splx(s); 235 DPRINTF(("ipsec_common_input(): could not find SA for " 236 "packet to %s, spi %08x\n", 237 ipsp_address(&dst_address, buf, sizeof(buf)), ntohl(spi))); 238 m_freem(m); 239 IPSEC_ISTAT(espstat.esps_notdb, ahstat.ahs_notdb, 240 ipcompstat.ipcomps_notdb); 241 return ENOENT; 242 } 243 244 if (tdbp->tdb_flags & TDBF_INVALID) { 245 splx(s); 246 DPRINTF(("ipsec_common_input(): attempted to use invalid " 247 "SA %s/%08x/%u\n", ipsp_address(&dst_address, buf, 248 sizeof(buf)), ntohl(spi), tdbp->tdb_sproto)); 249 m_freem(m); 250 IPSEC_ISTAT(espstat.esps_invalid, ahstat.ahs_invalid, 251 ipcompstat.ipcomps_invalid); 252 return EINVAL; 253 } 254 255 if (udpencap && !(tdbp->tdb_flags & TDBF_UDPENCAP)) { 256 splx(s); 257 DPRINTF(("ipsec_common_input(): attempted to use non-udpencap " 258 "SA %s/%08x/%u\n", ipsp_address(&dst_address, buf, 259 sizeof(buf)), ntohl(spi), tdbp->tdb_sproto)); 260 m_freem(m); 261 espstat.esps_udpinval++; 262 return EINVAL; 263 } 264 265 if (tdbp->tdb_xform == NULL) { 266 splx(s); 267 DPRINTF(("ipsec_common_input(): attempted to use uninitialized " 268 "SA %s/%08x/%u\n", ipsp_address(&dst_address, buf, 269 sizeof(buf)), ntohl(spi), tdbp->tdb_sproto)); 270 m_freem(m); 271 IPSEC_ISTAT(espstat.esps_noxform, ahstat.ahs_noxform, 272 ipcompstat.ipcomps_noxform); 273 return ENXIO; 274 } 275 276 if (sproto != IPPROTO_IPCOMP) { 277 if ((encif = enc_getif(tdbp->tdb_rdomain, 278 tdbp->tdb_tap)) == NULL) { 279 splx(s); 280 DPRINTF(("ipsec_common_input(): " 281 "no enc%u interface for SA %s/%08x/%u\n", 282 tdbp->tdb_tap, ipsp_address(&dst_address, buf, 283 sizeof(buf)), ntohl(spi), tdbp->tdb_sproto)); 284 m_freem(m); 285 286 IPSEC_ISTAT(espstat.esps_pdrops, 287 ahstat.ahs_pdrops, 288 ipcompstat.ipcomps_pdrops); 289 return EACCES; 290 } 291 292 /* XXX This conflicts with the scoped nature of IPv6 */ 293 m->m_pkthdr.ph_ifidx = encif->if_index; 294 } 295 296 /* Register first use, setup expiration timer. */ 297 if (tdbp->tdb_first_use == 0) { 298 tdbp->tdb_first_use = time_second; 299 if (tdbp->tdb_flags & TDBF_FIRSTUSE) 300 timeout_add_sec(&tdbp->tdb_first_tmo, 301 tdbp->tdb_exp_first_use); 302 if (tdbp->tdb_flags & TDBF_SOFT_FIRSTUSE) 303 timeout_add_sec(&tdbp->tdb_sfirst_tmo, 304 tdbp->tdb_soft_first_use); 305 } 306 307 /* 308 * Call appropriate transform and return -- callback takes care of 309 * everything else. 310 */ 311 error = (*(tdbp->tdb_xform->xf_input))(m, tdbp, skip, protoff); 312 splx(s); 313 return error; 314 } 315 316 /* 317 * IPsec input callback, called by the transform callback. Takes care of 318 * filtering and other sanity checks on the processed packet. 319 */ 320 int 321 ipsec_common_input_cb(struct mbuf *m, struct tdb *tdbp, int skip, int protoff) 322 { 323 int af, sproto; 324 u_char prot; 325 326 #if NBPFILTER > 0 327 struct ifnet *encif; 328 #endif 329 330 struct ip *ip, ipn; 331 332 #ifdef INET6 333 struct ip6_hdr *ip6, ip6n; 334 #endif /* INET6 */ 335 struct m_tag *mtag; 336 struct tdb_ident *tdbi; 337 338 #ifdef ENCDEBUG 339 char buf[INET6_ADDRSTRLEN]; 340 #endif 341 342 af = tdbp->tdb_dst.sa.sa_family; 343 sproto = tdbp->tdb_sproto; 344 345 tdbp->tdb_last_used = time_second; 346 347 /* Sanity check */ 348 if (m == NULL) { 349 /* The called routine will print a message if necessary */ 350 IPSEC_ISTAT(espstat.esps_badkcr, ahstat.ahs_badkcr, 351 ipcompstat.ipcomps_badkcr); 352 return EINVAL; 353 } 354 355 /* Fix IPv4 header */ 356 if (af == AF_INET) { 357 if ((m->m_len < skip) && ((m = m_pullup(m, skip)) == NULL)) { 358 DPRINTF(("ipsec_common_input_cb(): processing failed " 359 "for SA %s/%08x\n", ipsp_address(&tdbp->tdb_dst, 360 buf, sizeof(buf)), ntohl(tdbp->tdb_spi))); 361 IPSEC_ISTAT(espstat.esps_hdrops, ahstat.ahs_hdrops, 362 ipcompstat.ipcomps_hdrops); 363 return ENOBUFS; 364 } 365 366 ip = mtod(m, struct ip *); 367 ip->ip_len = htons(m->m_pkthdr.len); 368 ip->ip_sum = 0; 369 ip->ip_sum = in_cksum(m, ip->ip_hl << 2); 370 prot = ip->ip_p; 371 372 /* IP-in-IP encapsulation */ 373 if (prot == IPPROTO_IPIP) { 374 if (m->m_pkthdr.len - skip < sizeof(struct ip)) { 375 m_freem(m); 376 IPSEC_ISTAT(espstat.esps_hdrops, 377 ahstat.ahs_hdrops, 378 ipcompstat.ipcomps_hdrops); 379 return EINVAL; 380 } 381 /* ipn will now contain the inner IPv4 header */ 382 m_copydata(m, skip, sizeof(struct ip), 383 (caddr_t) &ipn); 384 } 385 386 #ifdef INET6 387 /* IPv6-in-IP encapsulation. */ 388 if (prot == IPPROTO_IPV6) { 389 if (m->m_pkthdr.len - skip < sizeof(struct ip6_hdr)) { 390 m_freem(m); 391 IPSEC_ISTAT(espstat.esps_hdrops, 392 ahstat.ahs_hdrops, 393 ipcompstat.ipcomps_hdrops); 394 return EINVAL; 395 } 396 /* ip6n will now contain the inner IPv6 header. */ 397 m_copydata(m, skip, sizeof(struct ip6_hdr), 398 (caddr_t) &ip6n); 399 } 400 #endif /* INET6 */ 401 } 402 403 #ifdef INET6 404 /* Fix IPv6 header */ 405 if (af == AF_INET6) 406 { 407 if (m->m_len < sizeof(struct ip6_hdr) && 408 (m = m_pullup(m, sizeof(struct ip6_hdr))) == NULL) { 409 410 DPRINTF(("ipsec_common_input_cb(): processing failed " 411 "for SA %s/%08x\n", ipsp_address(&tdbp->tdb_dst, 412 buf, sizeof(buf)), ntohl(tdbp->tdb_spi))); 413 414 IPSEC_ISTAT(espstat.esps_hdrops, ahstat.ahs_hdrops, 415 ipcompstat.ipcomps_hdrops); 416 return EACCES; 417 } 418 419 ip6 = mtod(m, struct ip6_hdr *); 420 ip6->ip6_plen = htons(m->m_pkthdr.len - skip); 421 422 /* Save protocol */ 423 m_copydata(m, protoff, 1, (caddr_t) &prot); 424 425 /* IP-in-IP encapsulation */ 426 if (prot == IPPROTO_IPIP) { 427 if (m->m_pkthdr.len - skip < sizeof(struct ip)) { 428 m_freem(m); 429 IPSEC_ISTAT(espstat.esps_hdrops, 430 ahstat.ahs_hdrops, 431 ipcompstat.ipcomps_hdrops); 432 return EINVAL; 433 } 434 /* ipn will now contain the inner IPv4 header */ 435 m_copydata(m, skip, sizeof(struct ip), (caddr_t) &ipn); 436 } 437 438 /* IPv6-in-IP encapsulation */ 439 if (prot == IPPROTO_IPV6) { 440 if (m->m_pkthdr.len - skip < sizeof(struct ip6_hdr)) { 441 m_freem(m); 442 IPSEC_ISTAT(espstat.esps_hdrops, 443 ahstat.ahs_hdrops, 444 ipcompstat.ipcomps_hdrops); 445 return EINVAL; 446 } 447 /* ip6n will now contain the inner IPv6 header. */ 448 m_copydata(m, skip, sizeof(struct ip6_hdr), 449 (caddr_t) &ip6n); 450 } 451 } 452 #endif /* INET6 */ 453 454 /* 455 * Fix TCP/UDP checksum of UDP encapsulated transport mode ESP packet. 456 * (RFC3948 3.1.2) 457 */ 458 if ((af == AF_INET || af == AF_INET6) && 459 (tdbp->tdb_flags & TDBF_UDPENCAP) && 460 (tdbp->tdb_flags & TDBF_TUNNELING) == 0) { 461 u_int16_t cksum; 462 463 switch (prot) { 464 case IPPROTO_UDP: 465 if (m->m_pkthdr.len < skip + sizeof(struct udphdr)) { 466 m_freem(m); 467 IPSEC_ISTAT(espstat.esps_hdrops, 468 ahstat.ahs_hdrops, 469 ipcompstat.ipcomps_hdrops); 470 return EINVAL; 471 } 472 cksum = 0; 473 m_copyback(m, skip + offsetof(struct udphdr, uh_sum), 474 sizeof(cksum), &cksum, M_NOWAIT); 475 #ifdef INET6 476 if (af == AF_INET6) { 477 cksum = in6_cksum(m, IPPROTO_UDP, skip, 478 m->m_pkthdr.len - skip); 479 m_copyback(m, skip + offsetof(struct udphdr, 480 uh_sum), sizeof(cksum), &cksum, M_NOWAIT); 481 } 482 #endif 483 break; 484 case IPPROTO_TCP: 485 if (m->m_pkthdr.len < skip + sizeof(struct tcphdr)) { 486 m_freem(m); 487 IPSEC_ISTAT(espstat.esps_hdrops, 488 ahstat.ahs_hdrops, 489 ipcompstat.ipcomps_hdrops); 490 return EINVAL; 491 } 492 cksum = 0; 493 m_copyback(m, skip + offsetof(struct tcphdr, th_sum), 494 sizeof(cksum), &cksum, M_NOWAIT); 495 if (af == AF_INET) 496 cksum = in4_cksum(m, IPPROTO_TCP, skip, 497 m->m_pkthdr.len - skip); 498 #ifdef INET6 499 else if (af == AF_INET6) 500 cksum = in6_cksum(m, IPPROTO_TCP, skip, 501 m->m_pkthdr.len - skip); 502 #endif 503 m_copyback(m, skip + offsetof(struct tcphdr, th_sum), 504 sizeof(cksum), &cksum, M_NOWAIT); 505 break; 506 } 507 } 508 509 /* 510 * Record what we've done to the packet (under what SA it was 511 * processed). 512 */ 513 if (tdbp->tdb_sproto != IPPROTO_IPCOMP) { 514 mtag = m_tag_get(PACKET_TAG_IPSEC_IN_DONE, 515 sizeof(struct tdb_ident), M_NOWAIT); 516 if (mtag == NULL) { 517 m_freem(m); 518 DPRINTF(("ipsec_common_input_cb(): failed to " 519 "get tag\n")); 520 IPSEC_ISTAT(espstat.esps_hdrops, ahstat.ahs_hdrops, 521 ipcompstat.ipcomps_hdrops); 522 return ENOMEM; 523 } 524 525 tdbi = (struct tdb_ident *)(mtag + 1); 526 bcopy(&tdbp->tdb_dst, &tdbi->dst, 527 sizeof(union sockaddr_union)); 528 tdbi->proto = tdbp->tdb_sproto; 529 tdbi->spi = tdbp->tdb_spi; 530 tdbi->rdomain = tdbp->tdb_rdomain; 531 532 m_tag_prepend(m, mtag); 533 } 534 535 if (sproto == IPPROTO_ESP) { 536 /* Packet is confidential ? */ 537 if (tdbp->tdb_encalgxform) 538 m->m_flags |= M_CONF; 539 540 /* Check if we had authenticated ESP. */ 541 if (tdbp->tdb_authalgxform) 542 m->m_flags |= M_AUTH; 543 } else if (sproto == IPPROTO_AH) { 544 m->m_flags |= M_AUTH; 545 } else if (sproto == IPPROTO_IPCOMP) { 546 m->m_flags |= M_COMP; 547 } 548 549 #if NPF > 0 550 /* Add pf tag if requested. */ 551 pf_tag_packet(m, tdbp->tdb_tag, -1); 552 pf_pkt_addr_changed(m); 553 #endif 554 555 if (tdbp->tdb_flags & TDBF_TUNNELING) 556 m->m_flags |= M_TUNNEL; 557 558 #if NBPFILTER > 0 559 if ((encif = enc_getif(tdbp->tdb_rdomain, tdbp->tdb_tap)) != NULL) { 560 encif->if_ipackets++; 561 encif->if_ibytes += m->m_pkthdr.len; 562 563 if (encif->if_bpf) { 564 struct enchdr hdr; 565 566 hdr.af = af; 567 hdr.spi = tdbp->tdb_spi; 568 hdr.flags = m->m_flags & (M_AUTH|M_CONF); 569 570 bpf_mtap_hdr(encif->if_bpf, (char *)&hdr, 571 ENC_HDRLEN, m, BPF_DIRECTION_IN, NULL); 572 } 573 } 574 #endif 575 576 /* Call the appropriate IPsec transform callback. */ 577 switch (af) { 578 case AF_INET: 579 switch (sproto) 580 { 581 case IPPROTO_ESP: 582 return esp4_input_cb(m); 583 584 case IPPROTO_AH: 585 return ah4_input_cb(m); 586 587 case IPPROTO_IPCOMP: 588 return ipcomp4_input_cb(m); 589 590 default: 591 DPRINTF(("ipsec_common_input_cb(): unknown/unsupported" 592 " security protocol %d\n", sproto)); 593 m_freem(m); 594 return EPFNOSUPPORT; 595 } 596 break; 597 598 #ifdef INET6 599 case AF_INET6: 600 switch (sproto) { 601 case IPPROTO_ESP: 602 return esp6_input_cb(m, skip, protoff); 603 604 case IPPROTO_AH: 605 return ah6_input_cb(m, skip, protoff); 606 607 case IPPROTO_IPCOMP: 608 return ipcomp6_input_cb(m, skip, protoff); 609 610 default: 611 DPRINTF(("ipsec_common_input_cb(): unknown/unsupported" 612 " security protocol %d\n", sproto)); 613 m_freem(m); 614 return EPFNOSUPPORT; 615 } 616 break; 617 #endif /* INET6 */ 618 619 default: 620 DPRINTF(("ipsec_common_input_cb(): unknown/unsupported " 621 "protocol family %d\n", af)); 622 m_freem(m); 623 return EPFNOSUPPORT; 624 } 625 #undef IPSEC_ISTAT 626 } 627 628 int 629 esp_sysctl(int *name, u_int namelen, void *oldp, size_t *oldlenp, void *newp, 630 size_t newlen) 631 { 632 /* All sysctl names at this level are terminal. */ 633 if (namelen != 1) 634 return (ENOTDIR); 635 636 switch (name[0]) { 637 case ESPCTL_STATS: 638 if (newp != NULL) 639 return (EPERM); 640 return (sysctl_struct(oldp, oldlenp, newp, newlen, 641 &espstat, sizeof(espstat))); 642 default: 643 if (name[0] < ESPCTL_MAXID) 644 return (sysctl_int_arr(espctl_vars, name, namelen, 645 oldp, oldlenp, newp, newlen)); 646 return (ENOPROTOOPT); 647 } 648 } 649 650 int 651 ah_sysctl(int *name, u_int namelen, void *oldp, size_t *oldlenp, void *newp, 652 size_t newlen) 653 { 654 /* All sysctl names at this level are terminal. */ 655 if (namelen != 1) 656 return (ENOTDIR); 657 658 switch (name[0]) { 659 case AHCTL_STATS: 660 if (newp != NULL) 661 return (EPERM); 662 return (sysctl_struct(oldp, oldlenp, newp, newlen, 663 &ahstat, sizeof(ahstat))); 664 default: 665 if (name[0] < AHCTL_MAXID) 666 return (sysctl_int_arr(ahctl_vars, name, namelen, 667 oldp, oldlenp, newp, newlen)); 668 return (ENOPROTOOPT); 669 } 670 } 671 672 int 673 ipcomp_sysctl(int *name, u_int namelen, void *oldp, size_t *oldlenp, void *newp, 674 size_t newlen) 675 { 676 /* All sysctl names at this level are terminal. */ 677 if (namelen != 1) 678 return (ENOTDIR); 679 680 switch (name[0]) { 681 case IPCOMPCTL_STATS: 682 if (newp != NULL) 683 return (EPERM); 684 return (sysctl_struct(oldp, oldlenp, newp, newlen, 685 &ipcompstat, sizeof(ipcompstat))); 686 default: 687 if (name[0] < IPCOMPCTL_MAXID) 688 return (sysctl_int_arr(ipcompctl_vars, name, namelen, 689 oldp, oldlenp, newp, newlen)); 690 return (ENOPROTOOPT); 691 } 692 } 693 694 /* IPv4 AH wrapper. */ 695 void 696 ah4_input(struct mbuf *m, ...) 697 { 698 int skip; 699 700 va_list ap; 701 va_start(ap, m); 702 skip = va_arg(ap, int); 703 va_end(ap); 704 705 ipsec_common_input(m, skip, offsetof(struct ip, ip_p), AF_INET, 706 IPPROTO_AH, 0); 707 return; 708 } 709 710 /* IPv4 AH callback. */ 711 int 712 ah4_input_cb(struct mbuf *m, ...) 713 { 714 /* 715 * Interface pointer is already in first mbuf; chop off the 716 * `outer' header and reschedule. 717 */ 718 719 if (niq_enqueue(&ipintrq, m) != 0) { 720 ahstat.ahs_qfull++; 721 DPRINTF(("ah4_input_cb(): dropped packet because of full " 722 "IP queue\n")); 723 return ENOBUFS; 724 } 725 726 return 0; 727 } 728 729 730 /* XXX rdomain */ 731 void * 732 ah4_ctlinput(int cmd, struct sockaddr *sa, u_int rdomain, void *v) 733 { 734 if (sa->sa_family != AF_INET || 735 sa->sa_len != sizeof(struct sockaddr_in)) 736 return (NULL); 737 738 return (ipsec_common_ctlinput(rdomain, cmd, sa, v, IPPROTO_AH)); 739 } 740 741 /* IPv4 ESP wrapper. */ 742 void 743 esp4_input(struct mbuf *m, ...) 744 { 745 int skip; 746 747 va_list ap; 748 va_start(ap, m); 749 skip = va_arg(ap, int); 750 va_end(ap); 751 752 ipsec_common_input(m, skip, offsetof(struct ip, ip_p), AF_INET, 753 IPPROTO_ESP, 0); 754 } 755 756 /* IPv4 ESP callback. */ 757 int 758 esp4_input_cb(struct mbuf *m, ...) 759 { 760 /* 761 * Interface pointer is already in first mbuf; chop off the 762 * `outer' header and reschedule. 763 */ 764 if (niq_enqueue(&ipintrq, m) != 0) { 765 espstat.esps_qfull++; 766 DPRINTF(("esp4_input_cb(): dropped packet because of full " 767 "IP queue\n")); 768 return ENOBUFS; 769 } 770 771 return 0; 772 } 773 774 /* IPv4 IPCOMP wrapper */ 775 void 776 ipcomp4_input(struct mbuf *m, ...) 777 { 778 int skip; 779 va_list ap; 780 va_start(ap, m); 781 skip = va_arg(ap, int); 782 va_end(ap); 783 784 ipsec_common_input(m, skip, offsetof(struct ip, ip_p), AF_INET, 785 IPPROTO_IPCOMP, 0); 786 } 787 788 /* IPv4 IPCOMP callback */ 789 int 790 ipcomp4_input_cb(struct mbuf *m, ...) 791 { 792 /* 793 * Interface pointer is already in first mbuf; chop off the 794 * `outer' header and reschedule. 795 */ 796 if (niq_enqueue(&ipintrq, m) != 0) { 797 ipcompstat.ipcomps_qfull++; 798 DPRINTF(("ipcomp4_input_cb(): dropped packet because of full IP queue\n")); 799 return ENOBUFS; 800 } 801 802 return 0; 803 } 804 805 void * 806 ipsec_common_ctlinput(u_int rdomain, int cmd, struct sockaddr *sa, 807 void *v, int proto) 808 { 809 struct ip *ip = v; 810 int s; 811 812 if (cmd == PRC_MSGSIZE && ip && ip_mtudisc && ip->ip_v == 4) { 813 struct tdb *tdbp; 814 struct sockaddr_in dst; 815 struct icmp *icp; 816 int hlen = ip->ip_hl << 2; 817 u_int32_t spi, mtu; 818 ssize_t adjust; 819 820 /* Find the right MTU. */ 821 icp = (struct icmp *)((caddr_t) ip - 822 offsetof(struct icmp, icmp_ip)); 823 mtu = ntohs(icp->icmp_nextmtu); 824 825 /* 826 * Ignore the packet, if we do not receive a MTU 827 * or the MTU is too small to be acceptable. 828 */ 829 if (mtu < 296) 830 return (NULL); 831 832 memset(&dst, 0, sizeof(struct sockaddr_in)); 833 dst.sin_family = AF_INET; 834 dst.sin_len = sizeof(struct sockaddr_in); 835 dst.sin_addr.s_addr = ip->ip_dst.s_addr; 836 837 bcopy((caddr_t)ip + hlen, &spi, sizeof(u_int32_t)); 838 839 s = splsoftnet(); 840 tdbp = gettdb(rdomain, spi, (union sockaddr_union *)&dst, 841 proto); 842 if (tdbp == NULL || tdbp->tdb_flags & TDBF_INVALID) { 843 splx(s); 844 return (NULL); 845 } 846 847 /* Walk the chain backwards to the first tdb */ 848 for (; tdbp; tdbp = tdbp->tdb_inext) { 849 if (tdbp->tdb_flags & TDBF_INVALID || 850 (adjust = ipsec_hdrsz(tdbp)) == -1) { 851 splx(s); 852 return (NULL); 853 } 854 855 mtu -= adjust; 856 857 /* Store adjusted MTU in tdb */ 858 tdbp->tdb_mtu = mtu; 859 tdbp->tdb_mtutimeout = time_second + 860 ip_mtudisc_timeout; 861 DPRINTF(("ipsec_common_ctlinput: " 862 "spi %08x mtu %d adjust %ld\n", 863 ntohl(tdbp->tdb_spi), tdbp->tdb_mtu, 864 adjust)); 865 } 866 splx(s); 867 return (NULL); 868 } 869 return (NULL); 870 } 871 872 /* XXX rdomain */ 873 void * 874 udpencap_ctlinput(int cmd, struct sockaddr *sa, u_int rdomain, void *v) 875 { 876 struct ip *ip = v; 877 struct tdb *tdbp; 878 struct icmp *icp; 879 u_int32_t mtu; 880 ssize_t adjust; 881 struct sockaddr_in dst, src; 882 union sockaddr_union *su_dst, *su_src; 883 int s; 884 885 icp = (struct icmp *)((caddr_t) ip - offsetof(struct icmp, icmp_ip)); 886 mtu = ntohs(icp->icmp_nextmtu); 887 888 /* 889 * Ignore the packet, if we do not receive a MTU 890 * or the MTU is too small to be acceptable. 891 */ 892 if (mtu < 296) 893 return (NULL); 894 895 memset(&dst, 0, sizeof(dst)); 896 dst.sin_family = AF_INET; 897 dst.sin_len = sizeof(struct sockaddr_in); 898 dst.sin_addr.s_addr = ip->ip_dst.s_addr; 899 su_dst = (union sockaddr_union *)&dst; 900 memset(&src, 0, sizeof(src)); 901 src.sin_family = AF_INET; 902 src.sin_len = sizeof(struct sockaddr_in); 903 src.sin_addr.s_addr = ip->ip_src.s_addr; 904 su_src = (union sockaddr_union *)&src; 905 906 s = splsoftnet(); 907 tdbp = gettdbbysrcdst(rdomain, 0, su_src, su_dst, IPPROTO_ESP); 908 909 for (; tdbp != NULL; tdbp = tdbp->tdb_snext) { 910 if (tdbp->tdb_sproto == IPPROTO_ESP && 911 ((tdbp->tdb_flags & (TDBF_INVALID|TDBF_UDPENCAP)) == 912 TDBF_UDPENCAP) && 913 !memcmp(&tdbp->tdb_dst, &dst, SA_LEN(&su_dst->sa)) && 914 !memcmp(&tdbp->tdb_src, &src, SA_LEN(&su_src->sa))) { 915 if ((adjust = ipsec_hdrsz(tdbp)) != -1) { 916 /* Store adjusted MTU in tdb */ 917 tdbp->tdb_mtu = mtu - adjust; 918 tdbp->tdb_mtutimeout = time_second + 919 ip_mtudisc_timeout; 920 DPRINTF(("udpencap_ctlinput: " 921 "spi %08x mtu %d adjust %ld\n", 922 ntohl(tdbp->tdb_spi), tdbp->tdb_mtu, 923 adjust)); 924 } 925 } 926 } 927 splx(s); 928 return (NULL); 929 } 930 931 /* XXX rdomain */ 932 void * 933 esp4_ctlinput(int cmd, struct sockaddr *sa, u_int rdomain, void *v) 934 { 935 if (sa->sa_family != AF_INET || 936 sa->sa_len != sizeof(struct sockaddr_in)) 937 return (NULL); 938 939 return (ipsec_common_ctlinput(rdomain, cmd, sa, v, IPPROTO_ESP)); 940 } 941 942 #ifdef INET6 943 /* IPv6 AH wrapper. */ 944 int 945 ah6_input(struct mbuf **mp, int *offp, int proto) 946 { 947 int l = 0; 948 int protoff, nxt; 949 struct ip6_ext ip6e; 950 951 if (*offp < sizeof(struct ip6_hdr)) { 952 DPRINTF(("ah6_input(): bad offset\n")); 953 ahstat.ahs_hdrops++; 954 m_freem(*mp); 955 *mp = NULL; 956 return IPPROTO_DONE; 957 } else if (*offp == sizeof(struct ip6_hdr)) { 958 protoff = offsetof(struct ip6_hdr, ip6_nxt); 959 } else { 960 /* Chase down the header chain... */ 961 protoff = sizeof(struct ip6_hdr); 962 nxt = (mtod(*mp, struct ip6_hdr *))->ip6_nxt; 963 964 do { 965 protoff += l; 966 m_copydata(*mp, protoff, sizeof(ip6e), 967 (caddr_t) &ip6e); 968 969 if (nxt == IPPROTO_AH) 970 l = (ip6e.ip6e_len + 2) << 2; 971 else 972 l = (ip6e.ip6e_len + 1) << 3; 973 #ifdef DIAGNOSTIC 974 if (l <= 0) 975 panic("ah6_input: l went zero or negative"); 976 #endif 977 978 nxt = ip6e.ip6e_nxt; 979 } while (protoff + l < *offp); 980 981 /* Malformed packet check */ 982 if (protoff + l != *offp) { 983 DPRINTF(("ah6_input(): bad packet header chain\n")); 984 ahstat.ahs_hdrops++; 985 m_freem(*mp); 986 *mp = NULL; 987 return IPPROTO_DONE; 988 } 989 protoff += offsetof(struct ip6_ext, ip6e_nxt); 990 } 991 ipsec_common_input(*mp, *offp, protoff, AF_INET6, proto, 0); 992 return IPPROTO_DONE; 993 } 994 995 /* IPv6 AH callback. */ 996 int 997 ah6_input_cb(struct mbuf *m, int off, int protoff) 998 { 999 int nxt; 1000 u_int8_t nxt8; 1001 int nest = 0; 1002 1003 /* Retrieve new protocol */ 1004 m_copydata(m, protoff, sizeof(u_int8_t), (caddr_t) &nxt8); 1005 nxt = nxt8; 1006 1007 /* 1008 * see the end of ip6_input for this logic. 1009 * IPPROTO_IPV[46] case will be processed just like other ones 1010 */ 1011 while (nxt != IPPROTO_DONE) { 1012 if (ip6_hdrnestlimit && (++nest > ip6_hdrnestlimit)) { 1013 ip6stat.ip6s_toomanyhdr++; 1014 goto bad; 1015 } 1016 1017 /* 1018 * Protection against faulty packet - there should be 1019 * more sanity checks in header chain processing. 1020 */ 1021 if (m->m_pkthdr.len < off) { 1022 ip6stat.ip6s_tooshort++; 1023 goto bad; 1024 } 1025 nxt = (*inet6sw[ip6_protox[nxt]].pr_input)(&m, &off, nxt); 1026 } 1027 return 0; 1028 1029 bad: 1030 m_freem(m); 1031 return EINVAL; 1032 } 1033 1034 /* IPv6 ESP wrapper. */ 1035 int 1036 esp6_input(struct mbuf **mp, int *offp, int proto) 1037 { 1038 int l = 0; 1039 int protoff, nxt; 1040 struct ip6_ext ip6e; 1041 1042 if (*offp < sizeof(struct ip6_hdr)) { 1043 DPRINTF(("esp6_input(): bad offset\n")); 1044 espstat.esps_hdrops++; 1045 m_freem(*mp); 1046 *mp = NULL; 1047 return IPPROTO_DONE; 1048 } else if (*offp == sizeof(struct ip6_hdr)) { 1049 protoff = offsetof(struct ip6_hdr, ip6_nxt); 1050 } else { 1051 /* Chase down the header chain... */ 1052 protoff = sizeof(struct ip6_hdr); 1053 nxt = (mtod(*mp, struct ip6_hdr *))->ip6_nxt; 1054 1055 do { 1056 protoff += l; 1057 m_copydata(*mp, protoff, sizeof(ip6e), 1058 (caddr_t) &ip6e); 1059 1060 if (nxt == IPPROTO_AH) 1061 l = (ip6e.ip6e_len + 2) << 2; 1062 else 1063 l = (ip6e.ip6e_len + 1) << 3; 1064 #ifdef DIAGNOSTIC 1065 if (l <= 0) 1066 panic("esp6_input: l went zero or negative"); 1067 #endif 1068 1069 nxt = ip6e.ip6e_nxt; 1070 } while (protoff + l < *offp); 1071 1072 /* Malformed packet check */ 1073 if (protoff + l != *offp) { 1074 DPRINTF(("esp6_input(): bad packet header chain\n")); 1075 espstat.esps_hdrops++; 1076 m_freem(*mp); 1077 *mp = NULL; 1078 return IPPROTO_DONE; 1079 } 1080 protoff += offsetof(struct ip6_ext, ip6e_nxt); 1081 } 1082 ipsec_common_input(*mp, *offp, protoff, AF_INET6, proto, 0); 1083 return IPPROTO_DONE; 1084 1085 } 1086 1087 /* IPv6 ESP callback */ 1088 int 1089 esp6_input_cb(struct mbuf *m, int skip, int protoff) 1090 { 1091 return ah6_input_cb(m, skip, protoff); 1092 } 1093 1094 /* IPv6 IPcomp wrapper */ 1095 int 1096 ipcomp6_input(struct mbuf **mp, int *offp, int proto) 1097 { 1098 int l = 0; 1099 int protoff, nxt; 1100 struct ip6_ext ip6e; 1101 1102 if (*offp < sizeof(struct ip6_hdr)) { 1103 DPRINTF(("ipcomp6_input(): bad offset\n")); 1104 ipcompstat.ipcomps_hdrops++; 1105 m_freem(*mp); 1106 *mp = NULL; 1107 return IPPROTO_DONE; 1108 } else if (*offp == sizeof(struct ip6_hdr)) { 1109 protoff = offsetof(struct ip6_hdr, ip6_nxt); 1110 } else { 1111 /* Chase down the header chain... */ 1112 protoff = sizeof(struct ip6_hdr); 1113 nxt = (mtod(*mp, struct ip6_hdr *))->ip6_nxt; 1114 1115 do { 1116 protoff += l; 1117 m_copydata(*mp, protoff, sizeof(ip6e), 1118 (caddr_t) &ip6e); 1119 if (nxt == IPPROTO_AH) 1120 l = (ip6e.ip6e_len + 2) << 2; 1121 else 1122 l = (ip6e.ip6e_len + 1) << 3; 1123 #ifdef DIAGNOSTIC 1124 if (l <= 0) 1125 panic("ipcomp6_input: l went zero or negative"); 1126 #endif 1127 1128 nxt = ip6e.ip6e_nxt; 1129 } while (protoff + l < *offp); 1130 1131 /* Malformed packet check */ 1132 if (protoff + l != *offp) { 1133 DPRINTF(("ipcomp6_input(): bad packet header chain\n")); 1134 ipcompstat.ipcomps_hdrops++; 1135 m_freem(*mp); 1136 *mp = NULL; 1137 return IPPROTO_DONE; 1138 } 1139 1140 protoff += offsetof(struct ip6_ext, ip6e_nxt); 1141 } 1142 ipsec_common_input(*mp, *offp, protoff, AF_INET6, proto, 0); 1143 return IPPROTO_DONE; 1144 } 1145 1146 /* IPv6 IPcomp callback */ 1147 int 1148 ipcomp6_input_cb(struct mbuf *m, int skip, int protoff) 1149 { 1150 return ah6_input_cb(m, skip, protoff); 1151 } 1152 1153 #endif /* INET6 */ 1154