1 /* $OpenBSD: ipsec_input.c,v 1.108 2012/09/26 14:53:23 markus Exp $ */ 2 /* 3 * The authors of this code are John Ioannidis (ji@tla.org), 4 * Angelos D. Keromytis (kermit@csd.uch.gr) and 5 * Niels Provos (provos@physnet.uni-hamburg.de). 6 * 7 * This code was written by John Ioannidis for BSD/OS in Athens, Greece, 8 * in November 1995. 9 * 10 * Ported to OpenBSD and NetBSD, with additional transforms, in December 1996, 11 * by Angelos D. Keromytis. 12 * 13 * Additional transforms and features in 1997 and 1998 by Angelos D. Keromytis 14 * and Niels Provos. 15 * 16 * Additional features in 1999 by Angelos D. Keromytis. 17 * 18 * Copyright (C) 1995, 1996, 1997, 1998, 1999 by John Ioannidis, 19 * Angelos D. Keromytis and Niels Provos. 20 * Copyright (c) 2001, Angelos D. Keromytis. 21 * 22 * Permission to use, copy, and modify this software with or without fee 23 * is hereby granted, provided that this entire notice is included in 24 * all copies of any software which is or includes a copy or 25 * modification of this software. 26 * You may use this code under the GNU public license if you so wish. Please 27 * contribute changes back to the authors under this freer than GPL license 28 * so that we may further the use of strong encryption without limitations to 29 * all. 30 * 31 * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR 32 * IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY 33 * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE 34 * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR 35 * PURPOSE. 36 */ 37 38 #include "pf.h" 39 40 #include <sys/param.h> 41 #include <sys/systm.h> 42 #include <sys/protosw.h> 43 #include <sys/mbuf.h> 44 #include <sys/socket.h> 45 #include <sys/proc.h> 46 #include <sys/sysctl.h> 47 #include <sys/kernel.h> 48 49 #include <net/if.h> 50 #include <net/netisr.h> 51 #include <net/bpf.h> 52 #include <net/route.h> 53 54 #if NPF > 0 55 #include <net/pfvar.h> 56 #endif 57 58 #include <netinet/in.h> 59 #include <netinet/in_systm.h> 60 #include <netinet/ip.h> 61 #include <netinet/ip_var.h> 62 #include <netinet/in_var.h> 63 #include <netinet/ip_icmp.h> 64 #include <netinet/tcp.h> 65 #include <netinet/udp.h> 66 67 #ifdef INET6 68 #ifndef INET 69 #include <netinet/in.h> 70 #endif 71 #include <netinet/ip6.h> 72 #include <netinet6/ip6_var.h> 73 #include <netinet6/ip6protosw.h> 74 #endif /* INET6 */ 75 76 #include <netinet/ip_ipsp.h> 77 #include <netinet/ip_esp.h> 78 #include <netinet/ip_ah.h> 79 #include <netinet/ip_ipcomp.h> 80 81 #include <net/if_enc.h> 82 83 #include "bpfilter.h" 84 85 void *ipsec_common_ctlinput(u_int, int, struct sockaddr *, void *, int); 86 87 #ifdef ENCDEBUG 88 #define DPRINTF(x) if (encdebug) printf x 89 #else 90 #define DPRINTF(x) 91 #endif 92 93 /* sysctl variables */ 94 int esp_enable = 1; 95 int ah_enable = 1; 96 int ipcomp_enable = 0; 97 98 int *espctl_vars[ESPCTL_MAXID] = ESPCTL_VARS; 99 int *ahctl_vars[AHCTL_MAXID] = AHCTL_VARS; 100 int *ipcompctl_vars[IPCOMPCTL_MAXID] = IPCOMPCTL_VARS; 101 102 #ifdef INET6 103 extern struct ip6protosw inet6sw[]; 104 extern u_char ip6_protox[]; 105 #endif 106 107 /* 108 * ipsec_common_input() gets called when we receive an IPsec-protected packet 109 * in IPv4 or IPv6. All it does is find the right TDB and call the appropriate 110 * transform. The callback takes care of further processing (like ingress 111 * filtering). 112 */ 113 int 114 ipsec_common_input(struct mbuf *m, int skip, int protoff, int af, int sproto, 115 int udpencap) 116 { 117 #define IPSEC_ISTAT(x,y,z) (sproto == IPPROTO_ESP ? (x)++ : \ 118 sproto == IPPROTO_AH ? (y)++ : (z)++) 119 120 union sockaddr_union dst_address; 121 struct timeval tv; 122 struct tdb *tdbp; 123 struct ifnet *encif; 124 u_int32_t spi; 125 u_int16_t cpi; 126 int s, error; 127 128 IPSEC_ISTAT(espstat.esps_input, ahstat.ahs_input, 129 ipcompstat.ipcomps_input); 130 131 if (m == 0) { 132 DPRINTF(("ipsec_common_input(): NULL packet received\n")); 133 IPSEC_ISTAT(espstat.esps_hdrops, ahstat.ahs_hdrops, 134 ipcompstat.ipcomps_hdrops); 135 return EINVAL; 136 } 137 138 if ((sproto == IPPROTO_ESP && !esp_enable) || 139 (sproto == IPPROTO_AH && !ah_enable) || 140 (sproto == IPPROTO_IPCOMP && !ipcomp_enable)) { 141 switch (af) { 142 #ifdef INET 143 case AF_INET: 144 rip_input(m, skip, sproto); 145 break; 146 #endif /* INET */ 147 #ifdef INET6 148 case AF_INET6: 149 rip6_input(&m, &skip, sproto); 150 break; 151 #endif /* INET6 */ 152 default: 153 DPRINTF(("ipsec_common_input(): unsupported protocol " 154 "family %d\n", af)); 155 m_freem(m); 156 IPSEC_ISTAT(espstat.esps_nopf, ahstat.ahs_nopf, 157 ipcompstat.ipcomps_nopf); 158 return EPFNOSUPPORT; 159 } 160 return 0; 161 } 162 if ((sproto == IPPROTO_IPCOMP) && (m->m_flags & M_COMP)) { 163 m_freem(m); 164 ipcompstat.ipcomps_pdrops++; 165 DPRINTF(("ipsec_common_input(): repeated decompression\n")); 166 return EINVAL; 167 } 168 169 if (m->m_pkthdr.len - skip < 2 * sizeof(u_int32_t)) { 170 m_freem(m); 171 IPSEC_ISTAT(espstat.esps_hdrops, ahstat.ahs_hdrops, 172 ipcompstat.ipcomps_hdrops); 173 DPRINTF(("ipsec_common_input(): packet too small\n")); 174 return EINVAL; 175 } 176 177 /* Retrieve the SPI from the relevant IPsec header */ 178 if (sproto == IPPROTO_ESP) 179 m_copydata(m, skip, sizeof(u_int32_t), (caddr_t) &spi); 180 else if (sproto == IPPROTO_AH) 181 m_copydata(m, skip + sizeof(u_int32_t), sizeof(u_int32_t), 182 (caddr_t) &spi); 183 else if (sproto == IPPROTO_IPCOMP) { 184 m_copydata(m, skip + sizeof(u_int16_t), sizeof(u_int16_t), 185 (caddr_t) &cpi); 186 spi = ntohl(htons(cpi)); 187 } 188 189 /* 190 * Find tunnel control block and (indirectly) call the appropriate 191 * kernel crypto routine. The resulting mbuf chain is a valid 192 * IP packet ready to go through input processing. 193 */ 194 195 bzero(&dst_address, sizeof(dst_address)); 196 dst_address.sa.sa_family = af; 197 198 switch (af) { 199 #ifdef INET 200 case AF_INET: 201 dst_address.sin.sin_len = sizeof(struct sockaddr_in); 202 m_copydata(m, offsetof(struct ip, ip_dst), 203 sizeof(struct in_addr), 204 (caddr_t) &(dst_address.sin.sin_addr)); 205 break; 206 #endif /* INET */ 207 208 #ifdef INET6 209 case AF_INET6: 210 dst_address.sin6.sin6_len = sizeof(struct sockaddr_in6); 211 m_copydata(m, offsetof(struct ip6_hdr, ip6_dst), 212 sizeof(struct in6_addr), 213 (caddr_t) &(dst_address.sin6.sin6_addr)); 214 in6_recoverscope(&dst_address.sin6, &dst_address.sin6.sin6_addr, 215 NULL); 216 break; 217 #endif /* INET6 */ 218 219 default: 220 DPRINTF(("ipsec_common_input(): unsupported protocol " 221 "family %d\n", af)); 222 m_freem(m); 223 IPSEC_ISTAT(espstat.esps_nopf, ahstat.ahs_nopf, 224 ipcompstat.ipcomps_nopf); 225 return EPFNOSUPPORT; 226 } 227 228 s = splsoftnet(); 229 tdbp = gettdb(rtable_l2(m->m_pkthdr.rdomain), 230 spi, &dst_address, sproto); 231 if (tdbp == NULL) { 232 splx(s); 233 DPRINTF(("ipsec_common_input(): could not find SA for " 234 "packet to %s, spi %08x\n", 235 ipsp_address(dst_address), ntohl(spi))); 236 m_freem(m); 237 IPSEC_ISTAT(espstat.esps_notdb, ahstat.ahs_notdb, 238 ipcompstat.ipcomps_notdb); 239 return ENOENT; 240 } 241 242 if (tdbp->tdb_flags & TDBF_INVALID) { 243 splx(s); 244 DPRINTF(("ipsec_common_input(): attempted to use invalid SA %s/%08x/%u\n", ipsp_address(dst_address), ntohl(spi), tdbp->tdb_sproto)); 245 m_freem(m); 246 IPSEC_ISTAT(espstat.esps_invalid, ahstat.ahs_invalid, 247 ipcompstat.ipcomps_invalid); 248 return EINVAL; 249 } 250 251 if (udpencap && !(tdbp->tdb_flags & TDBF_UDPENCAP)) { 252 splx(s); 253 DPRINTF(("ipsec_common_input(): attempted to use non-udpencap SA %s/%08x/%u\n", ipsp_address(dst_address), ntohl(spi), tdbp->tdb_sproto)); 254 m_freem(m); 255 espstat.esps_udpinval++; 256 return EINVAL; 257 } 258 259 if (tdbp->tdb_xform == NULL) { 260 splx(s); 261 DPRINTF(("ipsec_common_input(): attempted to use uninitialized SA %s/%08x/%u\n", ipsp_address(dst_address), ntohl(spi), tdbp->tdb_sproto)); 262 m_freem(m); 263 IPSEC_ISTAT(espstat.esps_noxform, ahstat.ahs_noxform, 264 ipcompstat.ipcomps_noxform); 265 return ENXIO; 266 } 267 268 if (sproto != IPPROTO_IPCOMP) { 269 if ((encif = enc_getif(tdbp->tdb_rdomain, 270 tdbp->tdb_tap)) == NULL) { 271 splx(s); 272 DPRINTF(("ipsec_common_input(): " 273 "no enc%u interface for SA %s/%08x/%u\n", 274 tdbp->tdb_tap, ipsp_address(dst_address), 275 ntohl(spi), tdbp->tdb_sproto)); 276 m_freem(m); 277 278 IPSEC_ISTAT(espstat.esps_pdrops, 279 ahstat.ahs_pdrops, 280 ipcompstat.ipcomps_pdrops); 281 return EACCES; 282 } 283 284 /* XXX This conflicts with the scoped nature of IPv6 */ 285 m->m_pkthdr.rcvif = encif; 286 } 287 288 /* Register first use, setup expiration timer. */ 289 if (tdbp->tdb_first_use == 0) { 290 tdbp->tdb_first_use = time_second; 291 292 tv.tv_usec = 0; 293 294 tv.tv_sec = tdbp->tdb_exp_first_use + tdbp->tdb_first_use; 295 if (tdbp->tdb_flags & TDBF_FIRSTUSE) 296 timeout_add(&tdbp->tdb_first_tmo, hzto(&tv)); 297 298 tv.tv_sec = tdbp->tdb_first_use + tdbp->tdb_soft_first_use; 299 if (tdbp->tdb_flags & TDBF_SOFT_FIRSTUSE) 300 timeout_add(&tdbp->tdb_sfirst_tmo, hzto(&tv)); 301 } 302 303 /* 304 * Call appropriate transform and return -- callback takes care of 305 * everything else. 306 */ 307 error = (*(tdbp->tdb_xform->xf_input))(m, tdbp, skip, protoff); 308 splx(s); 309 return error; 310 } 311 312 /* 313 * IPsec input callback, called by the transform callback. Takes care of 314 * filtering and other sanity checks on the processed packet. 315 */ 316 int 317 ipsec_common_input_cb(struct mbuf *m, struct tdb *tdbp, int skip, int protoff, 318 struct m_tag *mt) 319 { 320 int af, sproto; 321 u_char prot; 322 323 #if NBPFILTER > 0 324 struct ifnet *encif; 325 #endif 326 327 #ifdef INET 328 struct ip *ip, ipn; 329 #endif /* INET */ 330 331 #ifdef INET6 332 struct ip6_hdr *ip6, ip6n; 333 #endif /* INET6 */ 334 struct m_tag *mtag; 335 struct tdb_ident *tdbi; 336 337 af = tdbp->tdb_dst.sa.sa_family; 338 sproto = tdbp->tdb_sproto; 339 340 tdbp->tdb_last_used = time_second; 341 342 /* Sanity check */ 343 if (m == NULL) { 344 /* The called routine will print a message if necessary */ 345 IPSEC_ISTAT(espstat.esps_badkcr, ahstat.ahs_badkcr, 346 ipcompstat.ipcomps_badkcr); 347 return EINVAL; 348 } 349 350 #ifdef INET 351 /* Fix IPv4 header */ 352 if (af == AF_INET) { 353 if ((m->m_len < skip) && ((m = m_pullup(m, skip)) == NULL)) { 354 DPRINTF(("ipsec_common_input_cb(): processing failed " 355 "for SA %s/%08x\n", ipsp_address(tdbp->tdb_dst), 356 ntohl(tdbp->tdb_spi))); 357 IPSEC_ISTAT(espstat.esps_hdrops, ahstat.ahs_hdrops, 358 ipcompstat.ipcomps_hdrops); 359 return ENOBUFS; 360 } 361 362 ip = mtod(m, struct ip *); 363 ip->ip_len = htons(m->m_pkthdr.len); 364 ip->ip_sum = 0; 365 ip->ip_sum = in_cksum(m, ip->ip_hl << 2); 366 prot = ip->ip_p; 367 368 /* IP-in-IP encapsulation */ 369 if (prot == IPPROTO_IPIP) { 370 if (m->m_pkthdr.len - skip < sizeof(struct ip)) { 371 m_freem(m); 372 IPSEC_ISTAT(espstat.esps_hdrops, 373 ahstat.ahs_hdrops, 374 ipcompstat.ipcomps_hdrops); 375 return EINVAL; 376 } 377 /* ipn will now contain the inner IPv4 header */ 378 m_copydata(m, skip, sizeof(struct ip), 379 (caddr_t) &ipn); 380 381 /* 382 * Check that the inner source address is the same as 383 * the proxy address, if available. 384 */ 385 if ((tdbp->tdb_proxy.sa.sa_family == AF_INET && 386 tdbp->tdb_proxy.sin.sin_addr.s_addr != 387 INADDR_ANY && 388 ipn.ip_src.s_addr != 389 tdbp->tdb_proxy.sin.sin_addr.s_addr) || 390 (tdbp->tdb_proxy.sa.sa_family != AF_INET && 391 tdbp->tdb_proxy.sa.sa_family != 0)) { 392 393 DPRINTF(("ipsec_common_input_cb(): inner " 394 "source address %s doesn't correspond to " 395 "expected proxy source %s, SA %s/%08x\n", 396 inet_ntoa4(ipn.ip_src), 397 ipsp_address(tdbp->tdb_proxy), 398 ipsp_address(tdbp->tdb_dst), 399 ntohl(tdbp->tdb_spi))); 400 401 m_freem(m); 402 IPSEC_ISTAT(espstat.esps_pdrops, 403 ahstat.ahs_pdrops, 404 ipcompstat.ipcomps_pdrops); 405 return EACCES; 406 } 407 } 408 409 #ifdef INET6 410 /* IPv6-in-IP encapsulation. */ 411 if (prot == IPPROTO_IPV6) { 412 if (m->m_pkthdr.len - skip < sizeof(struct ip6_hdr)) { 413 m_freem(m); 414 IPSEC_ISTAT(espstat.esps_hdrops, 415 ahstat.ahs_hdrops, 416 ipcompstat.ipcomps_hdrops); 417 return EINVAL; 418 } 419 /* ip6n will now contain the inner IPv6 header. */ 420 m_copydata(m, skip, sizeof(struct ip6_hdr), 421 (caddr_t) &ip6n); 422 423 /* 424 * Check that the inner source address is the same as 425 * the proxy address, if available. 426 */ 427 if ((tdbp->tdb_proxy.sa.sa_family == AF_INET6 && 428 !IN6_IS_ADDR_UNSPECIFIED(&tdbp->tdb_proxy.sin6.sin6_addr) && 429 !IN6_ARE_ADDR_EQUAL(&ip6n.ip6_src, 430 &tdbp->tdb_proxy.sin6.sin6_addr)) || 431 (tdbp->tdb_proxy.sa.sa_family != AF_INET6 && 432 tdbp->tdb_proxy.sa.sa_family != 0)) { 433 434 DPRINTF(("ipsec_common_input_cb(): inner " 435 "source address %s doesn't correspond to " 436 "expected proxy source %s, SA %s/%08x\n", 437 ip6_sprintf(&ip6n.ip6_src), 438 ipsp_address(tdbp->tdb_proxy), 439 ipsp_address(tdbp->tdb_dst), 440 ntohl(tdbp->tdb_spi))); 441 442 m_freem(m); 443 IPSEC_ISTAT(espstat.esps_pdrops, 444 ahstat.ahs_pdrops, 445 ipcompstat.ipcomps_pdrops); 446 return EACCES; 447 } 448 } 449 #endif /* INET6 */ 450 } 451 #endif /* INET */ 452 453 #ifdef INET6 454 /* Fix IPv6 header */ 455 if (af == AF_INET6) 456 { 457 if (m->m_len < sizeof(struct ip6_hdr) && 458 (m = m_pullup(m, sizeof(struct ip6_hdr))) == NULL) { 459 460 DPRINTF(("ipsec_common_input_cb(): processing failed " 461 "for SA %s/%08x\n", ipsp_address(tdbp->tdb_dst), 462 ntohl(tdbp->tdb_spi))); 463 464 IPSEC_ISTAT(espstat.esps_hdrops, ahstat.ahs_hdrops, 465 ipcompstat.ipcomps_hdrops); 466 return EACCES; 467 } 468 469 ip6 = mtod(m, struct ip6_hdr *); 470 ip6->ip6_plen = htons(m->m_pkthdr.len - skip); 471 472 /* Save protocol */ 473 m_copydata(m, protoff, 1, (caddr_t) &prot); 474 475 #ifdef INET 476 /* IP-in-IP encapsulation */ 477 if (prot == IPPROTO_IPIP) { 478 if (m->m_pkthdr.len - skip < sizeof(struct ip)) { 479 m_freem(m); 480 IPSEC_ISTAT(espstat.esps_hdrops, 481 ahstat.ahs_hdrops, 482 ipcompstat.ipcomps_hdrops); 483 return EINVAL; 484 } 485 /* ipn will now contain the inner IPv4 header */ 486 m_copydata(m, skip, sizeof(struct ip), (caddr_t) &ipn); 487 488 /* 489 * Check that the inner source address is the same as 490 * the proxy address, if available. 491 */ 492 if ((tdbp->tdb_proxy.sa.sa_family == AF_INET && 493 tdbp->tdb_proxy.sin.sin_addr.s_addr != 494 INADDR_ANY && 495 ipn.ip_src.s_addr != 496 tdbp->tdb_proxy.sin.sin_addr.s_addr) || 497 (tdbp->tdb_proxy.sa.sa_family != AF_INET && 498 tdbp->tdb_proxy.sa.sa_family != 0)) { 499 500 DPRINTF(("ipsec_common_input_cb(): inner " 501 "source address %s doesn't correspond to " 502 "expected proxy source %s, SA %s/%08x\n", 503 inet_ntoa4(ipn.ip_src), 504 ipsp_address(tdbp->tdb_proxy), 505 ipsp_address(tdbp->tdb_dst), 506 ntohl(tdbp->tdb_spi))); 507 508 m_freem(m); 509 IPSEC_ISTAT(espstat.esps_pdrops, 510 ahstat.ahs_pdrops, 511 ipcompstat.ipcomps_pdrops); 512 return EACCES; 513 } 514 } 515 #endif /* INET */ 516 517 /* IPv6-in-IP encapsulation */ 518 if (prot == IPPROTO_IPV6) { 519 if (m->m_pkthdr.len - skip < sizeof(struct ip6_hdr)) { 520 m_freem(m); 521 IPSEC_ISTAT(espstat.esps_hdrops, 522 ahstat.ahs_hdrops, 523 ipcompstat.ipcomps_hdrops); 524 return EINVAL; 525 } 526 /* ip6n will now contain the inner IPv6 header. */ 527 m_copydata(m, skip, sizeof(struct ip6_hdr), 528 (caddr_t) &ip6n); 529 530 /* 531 * Check that the inner source address is the same as 532 * the proxy address, if available. 533 */ 534 if ((tdbp->tdb_proxy.sa.sa_family == AF_INET6 && 535 !IN6_IS_ADDR_UNSPECIFIED(&tdbp->tdb_proxy.sin6.sin6_addr) && 536 !IN6_ARE_ADDR_EQUAL(&ip6n.ip6_src, 537 &tdbp->tdb_proxy.sin6.sin6_addr)) || 538 (tdbp->tdb_proxy.sa.sa_family != AF_INET6 && 539 tdbp->tdb_proxy.sa.sa_family != 0)) { 540 541 DPRINTF(("ipsec_common_input_cb(): inner " 542 "source address %s doesn't correspond to " 543 "expected proxy source %s, SA %s/%08x\n", 544 ip6_sprintf(&ip6n.ip6_src), 545 ipsp_address(tdbp->tdb_proxy), 546 ipsp_address(tdbp->tdb_dst), 547 ntohl(tdbp->tdb_spi))); 548 549 m_freem(m); 550 IPSEC_ISTAT(espstat.esps_pdrops, 551 ahstat.ahs_pdrops, 552 ipcompstat.ipcomps_pdrops); 553 return EACCES; 554 } 555 } 556 } 557 #endif /* INET6 */ 558 559 /* 560 * Fix TCP/UDP checksum of UDP encapsulated transport mode ESP packet. 561 * (RFC3948 3.1.2) 562 */ 563 if ((af == AF_INET || af == AF_INET6) && 564 (tdbp->tdb_flags & TDBF_UDPENCAP) && 565 (tdbp->tdb_flags & TDBF_TUNNELING) == 0) { 566 u_int16_t cksum; 567 568 switch (prot) { 569 case IPPROTO_UDP: 570 if (m->m_pkthdr.len < skip + sizeof(struct udphdr)) { 571 m_freem(m); 572 IPSEC_ISTAT(espstat.esps_hdrops, 573 ahstat.ahs_hdrops, 574 ipcompstat.ipcomps_hdrops); 575 return EINVAL; 576 } 577 cksum = 0; 578 m_copyback(m, skip + offsetof(struct udphdr, uh_sum), 579 sizeof(cksum), &cksum, M_NOWAIT); 580 #ifdef INET6 581 if (af == AF_INET6) { 582 cksum = in6_cksum(m, IPPROTO_UDP, skip, 583 m->m_pkthdr.len - skip); 584 m_copyback(m, skip + offsetof(struct udphdr, 585 uh_sum), sizeof(cksum), &cksum, M_NOWAIT); 586 } 587 #endif 588 break; 589 case IPPROTO_TCP: 590 if (m->m_pkthdr.len < skip + sizeof(struct tcphdr)) { 591 m_freem(m); 592 IPSEC_ISTAT(espstat.esps_hdrops, 593 ahstat.ahs_hdrops, 594 ipcompstat.ipcomps_hdrops); 595 return EINVAL; 596 } 597 cksum = 0; 598 m_copyback(m, skip + offsetof(struct tcphdr, th_sum), 599 sizeof(cksum), &cksum, M_NOWAIT); 600 if (af == AF_INET) 601 cksum = in4_cksum(m, IPPROTO_TCP, skip, 602 m->m_pkthdr.len - skip); 603 #ifdef INET6 604 else if (af == AF_INET6) 605 cksum = in6_cksum(m, IPPROTO_TCP, skip, 606 m->m_pkthdr.len - skip); 607 #endif 608 m_copyback(m, skip + offsetof(struct tcphdr, th_sum), 609 sizeof(cksum), &cksum, M_NOWAIT); 610 break; 611 } 612 } 613 614 /* 615 * Record what we've done to the packet (under what SA it was 616 * processed). If we've been passed an mtag, it means the packet 617 * was already processed by an ethernet/crypto combo card and 618 * thus has a tag attached with all the right information, but 619 * with a PACKET_TAG_IPSEC_IN_CRYPTO_DONE as opposed to 620 * PACKET_TAG_IPSEC_IN_DONE type; in that case, just change the type. 621 */ 622 if (tdbp->tdb_sproto != IPPROTO_IPCOMP) { 623 mtag = m_tag_get(PACKET_TAG_IPSEC_IN_DONE, 624 sizeof(struct tdb_ident), M_NOWAIT); 625 if (mtag == NULL) { 626 m_freem(m); 627 DPRINTF(("ipsec_common_input_cb(): failed to " 628 "get tag\n")); 629 IPSEC_ISTAT(espstat.esps_hdrops, ahstat.ahs_hdrops, 630 ipcompstat.ipcomps_hdrops); 631 return ENOMEM; 632 } 633 634 tdbi = (struct tdb_ident *)(mtag + 1); 635 bcopy(&tdbp->tdb_dst, &tdbi->dst, 636 sizeof(union sockaddr_union)); 637 tdbi->proto = tdbp->tdb_sproto; 638 tdbi->spi = tdbp->tdb_spi; 639 tdbi->rdomain = tdbp->tdb_rdomain; 640 641 m_tag_prepend(m, mtag); 642 } 643 644 if (sproto == IPPROTO_ESP) { 645 /* Packet is confidential ? */ 646 if (tdbp->tdb_encalgxform) 647 m->m_flags |= M_CONF; 648 649 /* Check if we had authenticated ESP. */ 650 if (tdbp->tdb_authalgxform) 651 m->m_flags |= M_AUTH; 652 } else if (sproto == IPPROTO_AH) { 653 m->m_flags |= M_AUTH; 654 } else if (sproto == IPPROTO_IPCOMP) { 655 m->m_flags |= M_COMP; 656 } 657 658 #if NPF > 0 659 /* Add pf tag if requested. */ 660 pf_tag_packet(m, tdbp->tdb_tag, -1); 661 pf_pkt_addr_changed(m); 662 #endif 663 664 if (tdbp->tdb_flags & TDBF_TUNNELING) 665 m->m_flags |= M_TUNNEL; 666 667 #if NBPFILTER > 0 668 if ((encif = enc_getif(tdbp->tdb_rdomain, tdbp->tdb_tap)) != NULL) { 669 encif->if_ipackets++; 670 encif->if_ibytes += m->m_pkthdr.len; 671 672 if (encif->if_bpf) { 673 struct enchdr hdr; 674 675 hdr.af = af; 676 hdr.spi = tdbp->tdb_spi; 677 hdr.flags = m->m_flags & (M_AUTH|M_CONF); 678 679 bpf_mtap_hdr(encif->if_bpf, (char *)&hdr, 680 ENC_HDRLEN, m, BPF_DIRECTION_IN); 681 } 682 } 683 #endif 684 685 /* Call the appropriate IPsec transform callback. */ 686 switch (af) { 687 #ifdef INET 688 case AF_INET: 689 switch (sproto) 690 { 691 case IPPROTO_ESP: 692 return esp4_input_cb(m); 693 694 case IPPROTO_AH: 695 return ah4_input_cb(m); 696 697 case IPPROTO_IPCOMP: 698 return ipcomp4_input_cb(m); 699 700 default: 701 DPRINTF(("ipsec_common_input_cb(): unknown/unsupported" 702 " security protocol %d\n", sproto)); 703 m_freem(m); 704 return EPFNOSUPPORT; 705 } 706 break; 707 #endif /* INET */ 708 709 #ifdef INET6 710 case AF_INET6: 711 switch (sproto) { 712 case IPPROTO_ESP: 713 return esp6_input_cb(m, skip, protoff); 714 715 case IPPROTO_AH: 716 return ah6_input_cb(m, skip, protoff); 717 718 case IPPROTO_IPCOMP: 719 return ipcomp6_input_cb(m, skip, protoff); 720 721 default: 722 DPRINTF(("ipsec_common_input_cb(): unknown/unsupported" 723 " security protocol %d\n", sproto)); 724 m_freem(m); 725 return EPFNOSUPPORT; 726 } 727 break; 728 #endif /* INET6 */ 729 730 default: 731 DPRINTF(("ipsec_common_input_cb(): unknown/unsupported " 732 "protocol family %d\n", af)); 733 m_freem(m); 734 return EPFNOSUPPORT; 735 } 736 #undef IPSEC_ISTAT 737 } 738 739 int 740 esp_sysctl(int *name, u_int namelen, void *oldp, size_t *oldlenp, void *newp, 741 size_t newlen) 742 { 743 /* All sysctl names at this level are terminal. */ 744 if (namelen != 1) 745 return (ENOTDIR); 746 747 switch (name[0]) { 748 case ESPCTL_STATS: 749 if (newp != NULL) 750 return (EPERM); 751 return (sysctl_struct(oldp, oldlenp, newp, newlen, 752 &espstat, sizeof(espstat))); 753 default: 754 if (name[0] < ESPCTL_MAXID) 755 return (sysctl_int_arr(espctl_vars, name, namelen, 756 oldp, oldlenp, newp, newlen)); 757 return (ENOPROTOOPT); 758 } 759 } 760 761 int 762 ah_sysctl(int *name, u_int namelen, void *oldp, size_t *oldlenp, void *newp, 763 size_t newlen) 764 { 765 /* All sysctl names at this level are terminal. */ 766 if (namelen != 1) 767 return (ENOTDIR); 768 769 switch (name[0]) { 770 case AHCTL_STATS: 771 if (newp != NULL) 772 return (EPERM); 773 return (sysctl_struct(oldp, oldlenp, newp, newlen, 774 &ahstat, sizeof(ahstat))); 775 default: 776 if (name[0] < AHCTL_MAXID) 777 return (sysctl_int_arr(ahctl_vars, name, namelen, 778 oldp, oldlenp, newp, newlen)); 779 return (ENOPROTOOPT); 780 } 781 } 782 783 int 784 ipcomp_sysctl(int *name, u_int namelen, void *oldp, size_t *oldlenp, void *newp, 785 size_t newlen) 786 { 787 /* All sysctl names at this level are terminal. */ 788 if (namelen != 1) 789 return (ENOTDIR); 790 791 switch (name[0]) { 792 case IPCOMPCTL_STATS: 793 if (newp != NULL) 794 return (EPERM); 795 return (sysctl_struct(oldp, oldlenp, newp, newlen, 796 &ipcompstat, sizeof(ipcompstat))); 797 default: 798 if (name[0] < IPCOMPCTL_MAXID) 799 return (sysctl_int_arr(ipcompctl_vars, name, namelen, 800 oldp, oldlenp, newp, newlen)); 801 return (ENOPROTOOPT); 802 } 803 } 804 805 #ifdef INET 806 /* IPv4 AH wrapper. */ 807 void 808 ah4_input(struct mbuf *m, ...) 809 { 810 int skip; 811 812 va_list ap; 813 va_start(ap, m); 814 skip = va_arg(ap, int); 815 va_end(ap); 816 817 ipsec_common_input(m, skip, offsetof(struct ip, ip_p), AF_INET, 818 IPPROTO_AH, 0); 819 return; 820 } 821 822 /* IPv4 AH callback. */ 823 int 824 ah4_input_cb(struct mbuf *m, ...) 825 { 826 struct ifqueue *ifq = &ipintrq; 827 int s = splnet(); 828 829 /* 830 * Interface pointer is already in first mbuf; chop off the 831 * `outer' header and reschedule. 832 */ 833 834 if (IF_QFULL(ifq)) { 835 IF_DROP(ifq); 836 ahstat.ahs_qfull++; 837 splx(s); 838 839 m_freem(m); 840 DPRINTF(("ah4_input_cb(): dropped packet because of full " 841 "IP queue\n")); 842 return ENOBUFS; 843 } 844 845 IF_ENQUEUE(ifq, m); 846 schednetisr(NETISR_IP); 847 splx(s); 848 return 0; 849 } 850 851 852 /* XXX rdomain */ 853 void * 854 ah4_ctlinput(int cmd, struct sockaddr *sa, u_int rdomain, void *v) 855 { 856 if (sa->sa_family != AF_INET || 857 sa->sa_len != sizeof(struct sockaddr_in)) 858 return (NULL); 859 860 return (ipsec_common_ctlinput(rdomain, cmd, sa, v, IPPROTO_AH)); 861 } 862 863 /* IPv4 ESP wrapper. */ 864 void 865 esp4_input(struct mbuf *m, ...) 866 { 867 int skip; 868 869 va_list ap; 870 va_start(ap, m); 871 skip = va_arg(ap, int); 872 va_end(ap); 873 874 ipsec_common_input(m, skip, offsetof(struct ip, ip_p), AF_INET, 875 IPPROTO_ESP, 0); 876 } 877 878 /* IPv4 ESP callback. */ 879 int 880 esp4_input_cb(struct mbuf *m, ...) 881 { 882 struct ifqueue *ifq = &ipintrq; 883 int s = splnet(); 884 885 /* 886 * Interface pointer is already in first mbuf; chop off the 887 * `outer' header and reschedule. 888 */ 889 if (IF_QFULL(ifq)) { 890 IF_DROP(ifq); 891 espstat.esps_qfull++; 892 splx(s); 893 894 m_freem(m); 895 DPRINTF(("esp4_input_cb(): dropped packet because of full " 896 "IP queue\n")); 897 return ENOBUFS; 898 } 899 900 IF_ENQUEUE(ifq, m); 901 schednetisr(NETISR_IP); 902 splx(s); 903 return 0; 904 } 905 906 /* IPv4 IPCOMP wrapper */ 907 void 908 ipcomp4_input(struct mbuf *m, ...) 909 { 910 int skip; 911 va_list ap; 912 va_start(ap, m); 913 skip = va_arg(ap, int); 914 va_end(ap); 915 916 ipsec_common_input(m, skip, offsetof(struct ip, ip_p), AF_INET, 917 IPPROTO_IPCOMP, 0); 918 } 919 920 /* IPv4 IPCOMP callback */ 921 int 922 ipcomp4_input_cb(struct mbuf *m, ...) 923 { 924 struct ifqueue *ifq = &ipintrq; 925 int s = splnet(); 926 927 /* 928 * Interface pointer is already in first mbuf; chop off the 929 * `outer' header and reschedule. 930 */ 931 if (IF_QFULL(ifq)) { 932 IF_DROP(ifq); 933 ipcompstat.ipcomps_qfull++; 934 splx(s); 935 936 m_freem(m); 937 DPRINTF(("ipcomp4_input_cb(): dropped packet because of full IP queue\n")); 938 return ENOBUFS; 939 } 940 941 IF_ENQUEUE(ifq, m); 942 schednetisr(NETISR_IP); 943 splx(s); 944 945 return 0; 946 } 947 948 void * 949 ipsec_common_ctlinput(u_int rdomain, int cmd, struct sockaddr *sa, 950 void *v, int proto) 951 { 952 extern u_int ip_mtudisc_timeout; 953 struct ip *ip = v; 954 int s; 955 956 if (cmd == PRC_MSGSIZE && ip && ip_mtudisc && ip->ip_v == 4) { 957 struct tdb *tdbp; 958 struct sockaddr_in dst; 959 struct icmp *icp; 960 int hlen = ip->ip_hl << 2; 961 u_int32_t spi, mtu; 962 ssize_t adjust; 963 964 /* Find the right MTU. */ 965 icp = (struct icmp *)((caddr_t) ip - 966 offsetof(struct icmp, icmp_ip)); 967 mtu = ntohs(icp->icmp_nextmtu); 968 969 /* 970 * Ignore the packet, if we do not receive a MTU 971 * or the MTU is too small to be acceptable. 972 */ 973 if (mtu < 296) 974 return (NULL); 975 976 bzero(&dst, sizeof(struct sockaddr_in)); 977 dst.sin_family = AF_INET; 978 dst.sin_len = sizeof(struct sockaddr_in); 979 dst.sin_addr.s_addr = ip->ip_dst.s_addr; 980 981 bcopy((caddr_t)ip + hlen, &spi, sizeof(u_int32_t)); 982 983 s = splsoftnet(); 984 tdbp = gettdb(rdomain, spi, (union sockaddr_union *)&dst, 985 proto); 986 if (tdbp == NULL || tdbp->tdb_flags & TDBF_INVALID) { 987 splx(s); 988 return (NULL); 989 } 990 991 /* Walk the chain backswards to the first tdb */ 992 for (; tdbp; tdbp = tdbp->tdb_inext) { 993 if (tdbp->tdb_flags & TDBF_INVALID || 994 (adjust = ipsec_hdrsz(tdbp)) == -1) { 995 splx(s); 996 return (NULL); 997 } 998 999 mtu -= adjust; 1000 1001 /* Store adjusted MTU in tdb */ 1002 tdbp->tdb_mtu = mtu; 1003 tdbp->tdb_mtutimeout = time_second + 1004 ip_mtudisc_timeout; 1005 DPRINTF(("ipsec_common_ctlinput: " 1006 "spi %08x mtu %d adjust %d\n", 1007 ntohl(tdbp->tdb_spi), tdbp->tdb_mtu, 1008 adjust)); 1009 } 1010 splx(s); 1011 return (NULL); 1012 } 1013 return (NULL); 1014 } 1015 1016 /* XXX rdomain */ 1017 void * 1018 udpencap_ctlinput(int cmd, struct sockaddr *sa, u_int rdomain, void *v) 1019 { 1020 struct ip *ip = v; 1021 struct tdb *tdbp; 1022 struct icmp *icp; 1023 u_int32_t mtu; 1024 ssize_t adjust; 1025 struct sockaddr_in dst, src; 1026 union sockaddr_union *su_dst, *su_src; 1027 int s; 1028 1029 icp = (struct icmp *)((caddr_t) ip - offsetof(struct icmp, icmp_ip)); 1030 mtu = ntohs(icp->icmp_nextmtu); 1031 1032 /* 1033 * Ignore the packet, if we do not receive a MTU 1034 * or the MTU is too small to be acceptable. 1035 */ 1036 if (mtu < 296) 1037 return (NULL); 1038 1039 bzero(&dst, sizeof(dst)); 1040 dst.sin_family = AF_INET; 1041 dst.sin_len = sizeof(struct sockaddr_in); 1042 dst.sin_addr.s_addr = ip->ip_dst.s_addr; 1043 su_dst = (union sockaddr_union *)&dst; 1044 bzero(&src, sizeof(src)); 1045 src.sin_family = AF_INET; 1046 src.sin_len = sizeof(struct sockaddr_in); 1047 src.sin_addr.s_addr = ip->ip_src.s_addr; 1048 su_src = (union sockaddr_union *)&src; 1049 1050 s = splsoftnet(); 1051 tdbp = gettdbbysrcdst(rdomain, 0, su_src, su_dst, IPPROTO_ESP); 1052 1053 for (; tdbp != NULL; tdbp = tdbp->tdb_snext) { 1054 if (tdbp->tdb_sproto == IPPROTO_ESP && 1055 ((tdbp->tdb_flags & (TDBF_INVALID|TDBF_UDPENCAP)) 1056 == TDBF_UDPENCAP) && 1057 !bcmp(&tdbp->tdb_dst, &dst, SA_LEN(&su_dst->sa)) && 1058 !bcmp(&tdbp->tdb_src, &src, SA_LEN(&su_src->sa))) { 1059 if ((adjust = ipsec_hdrsz(tdbp)) != -1) { 1060 /* Store adjusted MTU in tdb */ 1061 tdbp->tdb_mtu = mtu - adjust; 1062 tdbp->tdb_mtutimeout = time_second + 1063 ip_mtudisc_timeout; 1064 DPRINTF(("udpencap_ctlinput: " 1065 "spi %08x mtu %d adjust %d\n", 1066 ntohl(tdbp->tdb_spi), tdbp->tdb_mtu, 1067 adjust)); 1068 } 1069 } 1070 } 1071 splx(s); 1072 return (NULL); 1073 } 1074 1075 /* XXX rdomain */ 1076 void * 1077 esp4_ctlinput(int cmd, struct sockaddr *sa, u_int rdomain, void *v) 1078 { 1079 if (sa->sa_family != AF_INET || 1080 sa->sa_len != sizeof(struct sockaddr_in)) 1081 return (NULL); 1082 1083 return (ipsec_common_ctlinput(rdomain, cmd, sa, v, IPPROTO_ESP)); 1084 } 1085 #endif /* INET */ 1086 1087 #ifdef INET6 1088 /* IPv6 AH wrapper. */ 1089 int 1090 ah6_input(struct mbuf **mp, int *offp, int proto) 1091 { 1092 int l = 0; 1093 int protoff, nxt; 1094 struct ip6_ext ip6e; 1095 1096 if (*offp < sizeof(struct ip6_hdr)) { 1097 DPRINTF(("ah6_input(): bad offset\n")); 1098 ahstat.ahs_hdrops++; 1099 m_freem(*mp); 1100 *mp = NULL; 1101 return IPPROTO_DONE; 1102 } else if (*offp == sizeof(struct ip6_hdr)) { 1103 protoff = offsetof(struct ip6_hdr, ip6_nxt); 1104 } else { 1105 /* Chase down the header chain... */ 1106 protoff = sizeof(struct ip6_hdr); 1107 nxt = (mtod(*mp, struct ip6_hdr *))->ip6_nxt; 1108 1109 do { 1110 protoff += l; 1111 m_copydata(*mp, protoff, sizeof(ip6e), 1112 (caddr_t) &ip6e); 1113 1114 if (nxt == IPPROTO_AH) 1115 l = (ip6e.ip6e_len + 2) << 2; 1116 else 1117 l = (ip6e.ip6e_len + 1) << 3; 1118 #ifdef DIAGNOSTIC 1119 if (l <= 0) 1120 panic("ah6_input: l went zero or negative"); 1121 #endif 1122 1123 nxt = ip6e.ip6e_nxt; 1124 } while (protoff + l < *offp); 1125 1126 /* Malformed packet check */ 1127 if (protoff + l != *offp) { 1128 DPRINTF(("ah6_input(): bad packet header chain\n")); 1129 ahstat.ahs_hdrops++; 1130 m_freem(*mp); 1131 *mp = NULL; 1132 return IPPROTO_DONE; 1133 } 1134 protoff += offsetof(struct ip6_ext, ip6e_nxt); 1135 } 1136 ipsec_common_input(*mp, *offp, protoff, AF_INET6, proto, 0); 1137 return IPPROTO_DONE; 1138 } 1139 1140 /* IPv6 AH callback. */ 1141 int 1142 ah6_input_cb(struct mbuf *m, int off, int protoff) 1143 { 1144 int nxt; 1145 u_int8_t nxt8; 1146 int nest = 0; 1147 1148 /* Retrieve new protocol */ 1149 m_copydata(m, protoff, sizeof(u_int8_t), (caddr_t) &nxt8); 1150 nxt = nxt8; 1151 1152 /* 1153 * see the end of ip6_input for this logic. 1154 * IPPROTO_IPV[46] case will be processed just like other ones 1155 */ 1156 while (nxt != IPPROTO_DONE) { 1157 if (ip6_hdrnestlimit && (++nest > ip6_hdrnestlimit)) { 1158 ip6stat.ip6s_toomanyhdr++; 1159 goto bad; 1160 } 1161 1162 /* 1163 * Protection against faulty packet - there should be 1164 * more sanity checks in header chain processing. 1165 */ 1166 if (m->m_pkthdr.len < off) { 1167 ip6stat.ip6s_tooshort++; 1168 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_truncated); 1169 goto bad; 1170 } 1171 nxt = (*inet6sw[ip6_protox[nxt]].pr_input)(&m, &off, nxt); 1172 } 1173 return 0; 1174 1175 bad: 1176 m_freem(m); 1177 return EINVAL; 1178 } 1179 1180 /* IPv6 ESP wrapper. */ 1181 int 1182 esp6_input(struct mbuf **mp, int *offp, int proto) 1183 { 1184 int l = 0; 1185 int protoff, nxt; 1186 struct ip6_ext ip6e; 1187 1188 if (*offp < sizeof(struct ip6_hdr)) { 1189 DPRINTF(("esp6_input(): bad offset\n")); 1190 espstat.esps_hdrops++; 1191 m_freem(*mp); 1192 *mp = NULL; 1193 return IPPROTO_DONE; 1194 } else if (*offp == sizeof(struct ip6_hdr)) { 1195 protoff = offsetof(struct ip6_hdr, ip6_nxt); 1196 } else { 1197 /* Chase down the header chain... */ 1198 protoff = sizeof(struct ip6_hdr); 1199 nxt = (mtod(*mp, struct ip6_hdr *))->ip6_nxt; 1200 1201 do { 1202 protoff += l; 1203 m_copydata(*mp, protoff, sizeof(ip6e), 1204 (caddr_t) &ip6e); 1205 1206 if (nxt == IPPROTO_AH) 1207 l = (ip6e.ip6e_len + 2) << 2; 1208 else 1209 l = (ip6e.ip6e_len + 1) << 3; 1210 #ifdef DIAGNOSTIC 1211 if (l <= 0) 1212 panic("esp6_input: l went zero or negative"); 1213 #endif 1214 1215 nxt = ip6e.ip6e_nxt; 1216 } while (protoff + l < *offp); 1217 1218 /* Malformed packet check */ 1219 if (protoff + l != *offp) { 1220 DPRINTF(("esp6_input(): bad packet header chain\n")); 1221 espstat.esps_hdrops++; 1222 m_freem(*mp); 1223 *mp = NULL; 1224 return IPPROTO_DONE; 1225 } 1226 protoff += offsetof(struct ip6_ext, ip6e_nxt); 1227 } 1228 ipsec_common_input(*mp, *offp, protoff, AF_INET6, proto, 0); 1229 return IPPROTO_DONE; 1230 1231 } 1232 1233 /* IPv6 ESP callback */ 1234 int 1235 esp6_input_cb(struct mbuf *m, int skip, int protoff) 1236 { 1237 return ah6_input_cb(m, skip, protoff); 1238 } 1239 1240 /* IPv6 IPcomp wrapper */ 1241 int 1242 ipcomp6_input(struct mbuf **mp, int *offp, int proto) 1243 { 1244 int l = 0; 1245 int protoff, nxt; 1246 struct ip6_ext ip6e; 1247 1248 if (*offp < sizeof(struct ip6_hdr)) { 1249 DPRINTF(("ipcomp6_input(): bad offset\n")); 1250 ipcompstat.ipcomps_hdrops++; 1251 m_freem(*mp); 1252 *mp = NULL; 1253 return IPPROTO_DONE; 1254 } else if (*offp == sizeof(struct ip6_hdr)) { 1255 protoff = offsetof(struct ip6_hdr, ip6_nxt); 1256 } else { 1257 /* Chase down the header chain... */ 1258 protoff = sizeof(struct ip6_hdr); 1259 nxt = (mtod(*mp, struct ip6_hdr *))->ip6_nxt; 1260 1261 do { 1262 protoff += l; 1263 m_copydata(*mp, protoff, sizeof(ip6e), 1264 (caddr_t) &ip6e); 1265 if (nxt == IPPROTO_AH) 1266 l = (ip6e.ip6e_len + 2) << 2; 1267 else 1268 l = (ip6e.ip6e_len + 1) << 3; 1269 #ifdef DIAGNOSTIC 1270 if (l <= 0) 1271 panic("ipcomp6_input: l went zero or negative"); 1272 #endif 1273 1274 nxt = ip6e.ip6e_nxt; 1275 } while (protoff + l < *offp); 1276 1277 /* Malformed packet check */ 1278 if (protoff + l != *offp) { 1279 DPRINTF(("ipcomp6_input(): bad packet header chain\n")); 1280 ipcompstat.ipcomps_hdrops++; 1281 m_freem(*mp); 1282 *mp = NULL; 1283 return IPPROTO_DONE; 1284 } 1285 1286 protoff += offsetof(struct ip6_ext, ip6e_nxt); 1287 } 1288 ipsec_common_input(*mp, *offp, protoff, AF_INET6, proto, 0); 1289 return IPPROTO_DONE; 1290 } 1291 1292 /* IPv6 IPcomp callback */ 1293 int 1294 ipcomp6_input_cb(struct mbuf *m, int skip, int protoff) 1295 { 1296 return ah6_input_cb(m, skip, protoff); 1297 } 1298 1299 #endif /* INET6 */ 1300