1 /* $OpenBSD: ipsec_input.c,v 1.91 2008/10/22 23:04:45 mpf Exp $ */ 2 /* 3 * The authors of this code are John Ioannidis (ji@tla.org), 4 * Angelos D. Keromytis (kermit@csd.uch.gr) and 5 * Niels Provos (provos@physnet.uni-hamburg.de). 6 * 7 * This code was written by John Ioannidis for BSD/OS in Athens, Greece, 8 * in November 1995. 9 * 10 * Ported to OpenBSD and NetBSD, with additional transforms, in December 1996, 11 * by Angelos D. Keromytis. 12 * 13 * Additional transforms and features in 1997 and 1998 by Angelos D. Keromytis 14 * and Niels Provos. 15 * 16 * Additional features in 1999 by Angelos D. Keromytis. 17 * 18 * Copyright (C) 1995, 1996, 1997, 1998, 1999 by John Ioannidis, 19 * Angelos D. Keromytis and Niels Provos. 20 * Copyright (c) 2001, Angelos D. Keromytis. 21 * 22 * Permission to use, copy, and modify this software with or without fee 23 * is hereby granted, provided that this entire notice is included in 24 * all copies of any software which is or includes a copy or 25 * modification of this software. 26 * You may use this code under the GNU public license if you so wish. Please 27 * contribute changes back to the authors under this freer than GPL license 28 * so that we may further the use of strong encryption without limitations to 29 * all. 30 * 31 * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR 32 * IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY 33 * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE 34 * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR 35 * PURPOSE. 36 */ 37 38 #include "pf.h" 39 40 #include <sys/param.h> 41 #include <sys/systm.h> 42 #include <sys/protosw.h> 43 #include <sys/mbuf.h> 44 #include <sys/socket.h> 45 #include <sys/sysctl.h> 46 #include <sys/kernel.h> 47 48 #include <net/if.h> 49 #include <net/netisr.h> 50 #include <net/bpf.h> 51 52 #if NPF > 0 53 #include <net/pfvar.h> 54 #endif 55 56 #include <netinet/in.h> 57 #include <netinet/in_systm.h> 58 #include <netinet/ip.h> 59 #include <netinet/ip_var.h> 60 #include <netinet/in_var.h> 61 #include <netinet/ip_icmp.h> 62 #include <netinet/tcp.h> 63 #include <netinet/udp.h> 64 65 #ifdef INET6 66 #ifndef INET 67 #include <netinet/in.h> 68 #endif 69 #include <netinet/ip6.h> 70 #include <netinet6/ip6_var.h> 71 #include <netinet6/ip6protosw.h> 72 #endif /* INET6 */ 73 74 #include <netinet/ip_ipsp.h> 75 #include <netinet/ip_esp.h> 76 #include <netinet/ip_ah.h> 77 #include <netinet/ip_ipcomp.h> 78 79 #include <net/if_enc.h> 80 81 #include "bpfilter.h" 82 83 void *ipsec_common_ctlinput(int, struct sockaddr *, void *, int); 84 85 #ifdef ENCDEBUG 86 #define DPRINTF(x) if (encdebug) printf x 87 #else 88 #define DPRINTF(x) 89 #endif 90 91 /* sysctl variables */ 92 int esp_enable = 1; 93 int ah_enable = 1; 94 int ipcomp_enable = 0; 95 96 int *espctl_vars[ESPCTL_MAXID] = ESPCTL_VARS; 97 int *ahctl_vars[AHCTL_MAXID] = AHCTL_VARS; 98 int *ipcompctl_vars[IPCOMPCTL_MAXID] = IPCOMPCTL_VARS; 99 100 #ifdef INET6 101 extern struct ip6protosw inet6sw[]; 102 extern u_char ip6_protox[]; 103 #endif 104 105 /* 106 * ipsec_common_input() gets called when we receive an IPsec-protected packet 107 * in IPv4 or IPv6. All it does is find the right TDB and call the appropriate 108 * transform. The callback takes care of further processing (like ingress 109 * filtering). 110 */ 111 int 112 ipsec_common_input(struct mbuf *m, int skip, int protoff, int af, int sproto, 113 int udpencap) 114 { 115 #define IPSEC_ISTAT(x,y,z) (sproto == IPPROTO_ESP ? (x)++ : \ 116 sproto == IPPROTO_AH ? (y)++ : (z)++) 117 118 union sockaddr_union dst_address; 119 struct timeval tv; 120 struct tdb *tdbp; 121 u_int32_t spi; 122 u_int16_t cpi; 123 int s, error; 124 125 IPSEC_ISTAT(espstat.esps_input, ahstat.ahs_input, 126 ipcompstat.ipcomps_input); 127 128 if (m == 0) { 129 DPRINTF(("ipsec_common_input(): NULL packet received\n")); 130 IPSEC_ISTAT(espstat.esps_hdrops, ahstat.ahs_hdrops, 131 ipcompstat.ipcomps_hdrops); 132 return EINVAL; 133 } 134 135 if ((sproto == IPPROTO_ESP && !esp_enable) || 136 (sproto == IPPROTO_AH && !ah_enable) || 137 (sproto == IPPROTO_IPCOMP && !ipcomp_enable)) { 138 rip_input(m, skip, sproto); 139 return 0; 140 } 141 142 if (m->m_pkthdr.len - skip < 2 * sizeof(u_int32_t)) { 143 m_freem(m); 144 IPSEC_ISTAT(espstat.esps_hdrops, ahstat.ahs_hdrops, 145 ipcompstat.ipcomps_hdrops); 146 DPRINTF(("ipsec_common_input(): packet too small\n")); 147 return EINVAL; 148 } 149 150 /* Retrieve the SPI from the relevant IPsec header */ 151 if (sproto == IPPROTO_ESP) 152 m_copydata(m, skip, sizeof(u_int32_t), (caddr_t) &spi); 153 else if (sproto == IPPROTO_AH) 154 m_copydata(m, skip + sizeof(u_int32_t), sizeof(u_int32_t), 155 (caddr_t) &spi); 156 else if (sproto == IPPROTO_IPCOMP) { 157 m_copydata(m, skip + sizeof(u_int16_t), sizeof(u_int16_t), 158 (caddr_t) &cpi); 159 spi = ntohl(htons(cpi)); 160 } 161 162 /* 163 * Find tunnel control block and (indirectly) call the appropriate 164 * kernel crypto routine. The resulting mbuf chain is a valid 165 * IP packet ready to go through input processing. 166 */ 167 168 bzero(&dst_address, sizeof(dst_address)); 169 dst_address.sa.sa_family = af; 170 171 switch (af) { 172 #ifdef INET 173 case AF_INET: 174 dst_address.sin.sin_len = sizeof(struct sockaddr_in); 175 m_copydata(m, offsetof(struct ip, ip_dst), 176 sizeof(struct in_addr), 177 (caddr_t) &(dst_address.sin.sin_addr)); 178 break; 179 #endif /* INET */ 180 181 #ifdef INET6 182 case AF_INET6: 183 dst_address.sin6.sin6_len = sizeof(struct sockaddr_in6); 184 m_copydata(m, offsetof(struct ip6_hdr, ip6_dst), 185 sizeof(struct in6_addr), 186 (caddr_t) &(dst_address.sin6.sin6_addr)); 187 in6_recoverscope(&dst_address.sin6, &dst_address.sin6.sin6_addr, 188 NULL); 189 break; 190 #endif /* INET6 */ 191 192 default: 193 DPRINTF(("ipsec_common_input(): unsupported protocol " 194 "family %d\n", af)); 195 m_freem(m); 196 IPSEC_ISTAT(espstat.esps_nopf, ahstat.ahs_nopf, 197 ipcompstat.ipcomps_nopf); 198 return EPFNOSUPPORT; 199 } 200 201 s = spltdb(); 202 tdbp = gettdb(spi, &dst_address, sproto); 203 if (tdbp == NULL) { 204 splx(s); 205 DPRINTF(("ipsec_common_input(): could not find SA for " 206 "packet to %s, spi %08x\n", 207 ipsp_address(dst_address), ntohl(spi))); 208 m_freem(m); 209 IPSEC_ISTAT(espstat.esps_notdb, ahstat.ahs_notdb, 210 ipcompstat.ipcomps_notdb); 211 return ENOENT; 212 } 213 214 if (tdbp->tdb_flags & TDBF_INVALID) { 215 splx(s); 216 DPRINTF(("ipsec_common_input(): attempted to use invalid SA %s/%08x/%u\n", ipsp_address(dst_address), ntohl(spi), tdbp->tdb_sproto)); 217 m_freem(m); 218 IPSEC_ISTAT(espstat.esps_invalid, ahstat.ahs_invalid, 219 ipcompstat.ipcomps_invalid); 220 return EINVAL; 221 } 222 223 if (udpencap && !(tdbp->tdb_flags & TDBF_UDPENCAP)) { 224 splx(s); 225 DPRINTF(("ipsec_common_input(): attempted to use non-udpencap SA %s/%08x/%u\n", ipsp_address(dst_address), ntohl(spi), tdbp->tdb_sproto)); 226 m_freem(m); 227 espstat.esps_udpinval++; 228 return EINVAL; 229 } 230 231 if (tdbp->tdb_xform == NULL) { 232 splx(s); 233 DPRINTF(("ipsec_common_input(): attempted to use uninitialized SA %s/%08x/%u\n", ipsp_address(dst_address), ntohl(spi), tdbp->tdb_sproto)); 234 m_freem(m); 235 IPSEC_ISTAT(espstat.esps_noxform, ahstat.ahs_noxform, 236 ipcompstat.ipcomps_noxform); 237 return ENXIO; 238 } 239 240 if (sproto != IPPROTO_IPCOMP) { 241 /* XXX This conflicts with the scoped nature of IPv6 */ 242 m->m_pkthdr.rcvif = &encif[0].sc_if; 243 } 244 245 /* Register first use, setup expiration timer. */ 246 if (tdbp->tdb_first_use == 0) { 247 tdbp->tdb_first_use = time_second; 248 249 tv.tv_usec = 0; 250 251 tv.tv_sec = tdbp->tdb_exp_first_use + tdbp->tdb_first_use; 252 if (tdbp->tdb_flags & TDBF_FIRSTUSE) 253 timeout_add(&tdbp->tdb_first_tmo, hzto(&tv)); 254 255 tv.tv_sec = tdbp->tdb_first_use + tdbp->tdb_soft_first_use; 256 if (tdbp->tdb_flags & TDBF_SOFT_FIRSTUSE) 257 timeout_add(&tdbp->tdb_sfirst_tmo, hzto(&tv)); 258 } 259 260 /* 261 * Call appropriate transform and return -- callback takes care of 262 * everything else. 263 */ 264 error = (*(tdbp->tdb_xform->xf_input))(m, tdbp, skip, protoff); 265 splx(s); 266 return error; 267 } 268 269 /* 270 * IPsec input callback, called by the transform callback. Takes care of 271 * filtering and other sanity checks on the processed packet. 272 */ 273 int 274 ipsec_common_input_cb(struct mbuf *m, struct tdb *tdbp, int skip, int protoff, 275 struct m_tag *mt) 276 { 277 int prot, af, sproto; 278 279 #if NBPFILTER > 0 280 struct ifnet *bpfif; 281 #endif 282 283 #ifdef INET 284 struct ip *ip, ipn; 285 #endif /* INET */ 286 287 #ifdef INET6 288 struct ip6_hdr *ip6, ip6n; 289 #endif /* INET6 */ 290 struct m_tag *mtag; 291 struct tdb_ident *tdbi; 292 293 af = tdbp->tdb_dst.sa.sa_family; 294 sproto = tdbp->tdb_sproto; 295 296 tdbp->tdb_last_used = time_second; 297 298 /* Sanity check */ 299 if (m == NULL) { 300 /* The called routine will print a message if necessary */ 301 IPSEC_ISTAT(espstat.esps_badkcr, ahstat.ahs_badkcr, 302 ipcompstat.ipcomps_badkcr); 303 return EINVAL; 304 } 305 306 #ifdef INET 307 /* Fix IPv4 header */ 308 if (af == AF_INET) { 309 if ((m->m_len < skip) && ((m = m_pullup(m, skip)) == NULL)) { 310 DPRINTF(("ipsec_common_input_cb(): processing failed " 311 "for SA %s/%08x\n", ipsp_address(tdbp->tdb_dst), 312 ntohl(tdbp->tdb_spi))); 313 IPSEC_ISTAT(espstat.esps_hdrops, ahstat.ahs_hdrops, 314 ipcompstat.ipcomps_hdrops); 315 return ENOBUFS; 316 } 317 318 ip = mtod(m, struct ip *); 319 ip->ip_len = htons(m->m_pkthdr.len); 320 ip->ip_sum = 0; 321 ip->ip_sum = in_cksum(m, ip->ip_hl << 2); 322 prot = ip->ip_p; 323 324 /* IP-in-IP encapsulation */ 325 if (prot == IPPROTO_IPIP) { 326 if (m->m_pkthdr.len - skip < sizeof(struct ip)) { 327 m_freem(m); 328 IPSEC_ISTAT(espstat.esps_hdrops, 329 ahstat.ahs_hdrops, 330 ipcompstat.ipcomps_hdrops); 331 return EINVAL; 332 } 333 /* ipn will now contain the inner IPv4 header */ 334 m_copydata(m, skip, sizeof(struct ip), 335 (caddr_t) &ipn); 336 337 /* 338 * Check that the inner source address is the same as 339 * the proxy address, if available. 340 */ 341 if ((tdbp->tdb_proxy.sa.sa_family == AF_INET && 342 tdbp->tdb_proxy.sin.sin_addr.s_addr != 343 INADDR_ANY && 344 ipn.ip_src.s_addr != 345 tdbp->tdb_proxy.sin.sin_addr.s_addr) || 346 (tdbp->tdb_proxy.sa.sa_family != AF_INET && 347 tdbp->tdb_proxy.sa.sa_family != 0)) { 348 349 DPRINTF(("ipsec_common_input_cb(): inner " 350 "source address %s doesn't correspond to " 351 "expected proxy source %s, SA %s/%08x\n", 352 inet_ntoa4(ipn.ip_src), 353 ipsp_address(tdbp->tdb_proxy), 354 ipsp_address(tdbp->tdb_dst), 355 ntohl(tdbp->tdb_spi))); 356 357 m_freem(m); 358 IPSEC_ISTAT(espstat.esps_pdrops, 359 ahstat.ahs_pdrops, 360 ipcompstat.ipcomps_pdrops); 361 return EACCES; 362 } 363 } 364 365 #ifdef INET6 366 /* IPv6-in-IP encapsulation. */ 367 if (prot == IPPROTO_IPV6) { 368 if (m->m_pkthdr.len - skip < sizeof(struct ip6_hdr)) { 369 m_freem(m); 370 IPSEC_ISTAT(espstat.esps_hdrops, 371 ahstat.ahs_hdrops, 372 ipcompstat.ipcomps_hdrops); 373 return EINVAL; 374 } 375 /* ip6n will now contain the inner IPv6 header. */ 376 m_copydata(m, skip, sizeof(struct ip6_hdr), 377 (caddr_t) &ip6n); 378 379 /* 380 * Check that the inner source address is the same as 381 * the proxy address, if available. 382 */ 383 if ((tdbp->tdb_proxy.sa.sa_family == AF_INET6 && 384 !IN6_IS_ADDR_UNSPECIFIED(&tdbp->tdb_proxy.sin6.sin6_addr) && 385 !IN6_ARE_ADDR_EQUAL(&ip6n.ip6_src, 386 &tdbp->tdb_proxy.sin6.sin6_addr)) || 387 (tdbp->tdb_proxy.sa.sa_family != AF_INET6 && 388 tdbp->tdb_proxy.sa.sa_family != 0)) { 389 390 DPRINTF(("ipsec_common_input_cb(): inner " 391 "source address %s doesn't correspond to " 392 "expected proxy source %s, SA %s/%08x\n", 393 ip6_sprintf(&ip6n.ip6_src), 394 ipsp_address(tdbp->tdb_proxy), 395 ipsp_address(tdbp->tdb_dst), 396 ntohl(tdbp->tdb_spi))); 397 398 m_freem(m); 399 IPSEC_ISTAT(espstat.esps_pdrops, 400 ahstat.ahs_pdrops, 401 ipcompstat.ipcomps_pdrops); 402 return EACCES; 403 } 404 } 405 #endif /* INET6 */ 406 } 407 #endif /* INET */ 408 409 #ifdef INET6 410 /* Fix IPv6 header */ 411 if (af == AF_INET6) 412 { 413 if (m->m_len < sizeof(struct ip6_hdr) && 414 (m = m_pullup(m, sizeof(struct ip6_hdr))) == NULL) { 415 416 DPRINTF(("ipsec_common_input_cb(): processing failed " 417 "for SA %s/%08x\n", ipsp_address(tdbp->tdb_dst), 418 ntohl(tdbp->tdb_spi))); 419 420 IPSEC_ISTAT(espstat.esps_hdrops, ahstat.ahs_hdrops, 421 ipcompstat.ipcomps_hdrops); 422 return EACCES; 423 } 424 425 ip6 = mtod(m, struct ip6_hdr *); 426 ip6->ip6_plen = htons(m->m_pkthdr.len - skip); 427 428 /* Save protocol */ 429 m_copydata(m, protoff, 1, (unsigned char *) &prot); 430 431 #ifdef INET 432 /* IP-in-IP encapsulation */ 433 if (prot == IPPROTO_IPIP) { 434 if (m->m_pkthdr.len - skip < sizeof(struct ip)) { 435 m_freem(m); 436 IPSEC_ISTAT(espstat.esps_hdrops, 437 ahstat.ahs_hdrops, 438 ipcompstat.ipcomps_hdrops); 439 return EINVAL; 440 } 441 /* ipn will now contain the inner IPv4 header */ 442 m_copydata(m, skip, sizeof(struct ip), (caddr_t) &ipn); 443 444 /* 445 * Check that the inner source address is the same as 446 * the proxy address, if available. 447 */ 448 if ((tdbp->tdb_proxy.sa.sa_family == AF_INET && 449 tdbp->tdb_proxy.sin.sin_addr.s_addr != 450 INADDR_ANY && 451 ipn.ip_src.s_addr != 452 tdbp->tdb_proxy.sin.sin_addr.s_addr) || 453 (tdbp->tdb_proxy.sa.sa_family != AF_INET && 454 tdbp->tdb_proxy.sa.sa_family != 0)) { 455 456 DPRINTF(("ipsec_common_input_cb(): inner " 457 "source address %s doesn't correspond to " 458 "expected proxy source %s, SA %s/%08x\n", 459 inet_ntoa4(ipn.ip_src), 460 ipsp_address(tdbp->tdb_proxy), 461 ipsp_address(tdbp->tdb_dst), 462 ntohl(tdbp->tdb_spi))); 463 464 m_freem(m); 465 IPSEC_ISTAT(espstat.esps_pdrops, 466 ahstat.ahs_pdrops, 467 ipcompstat.ipcomps_pdrops); 468 return EACCES; 469 } 470 } 471 #endif /* INET */ 472 473 /* IPv6-in-IP encapsulation */ 474 if (prot == IPPROTO_IPV6) { 475 if (m->m_pkthdr.len - skip < sizeof(struct ip6_hdr)) { 476 m_freem(m); 477 IPSEC_ISTAT(espstat.esps_hdrops, 478 ahstat.ahs_hdrops, 479 ipcompstat.ipcomps_hdrops); 480 return EINVAL; 481 } 482 /* ip6n will now contain the inner IPv6 header. */ 483 m_copydata(m, skip, sizeof(struct ip6_hdr), 484 (caddr_t) &ip6n); 485 486 /* 487 * Check that the inner source address is the same as 488 * the proxy address, if available. 489 */ 490 if ((tdbp->tdb_proxy.sa.sa_family == AF_INET6 && 491 !IN6_IS_ADDR_UNSPECIFIED(&tdbp->tdb_proxy.sin6.sin6_addr) && 492 !IN6_ARE_ADDR_EQUAL(&ip6n.ip6_src, 493 &tdbp->tdb_proxy.sin6.sin6_addr)) || 494 (tdbp->tdb_proxy.sa.sa_family != AF_INET6 && 495 tdbp->tdb_proxy.sa.sa_family != 0)) { 496 497 DPRINTF(("ipsec_common_input_cb(): inner " 498 "source address %s doesn't correspond to " 499 "expected proxy source %s, SA %s/%08x\n", 500 ip6_sprintf(&ip6n.ip6_src), 501 ipsp_address(tdbp->tdb_proxy), 502 ipsp_address(tdbp->tdb_dst), 503 ntohl(tdbp->tdb_spi))); 504 505 m_freem(m); 506 IPSEC_ISTAT(espstat.esps_pdrops, 507 ahstat.ahs_pdrops, 508 ipcompstat.ipcomps_pdrops); 509 return EACCES; 510 } 511 } 512 } 513 #endif /* INET6 */ 514 515 /* 516 * Record what we've done to the packet (under what SA it was 517 * processed). If we've been passed an mtag, it means the packet 518 * was already processed by an ethernet/crypto combo card and 519 * thus has a tag attached with all the right information, but 520 * with a PACKET_TAG_IPSEC_IN_CRYPTO_DONE as opposed to 521 * PACKET_TAG_IPSEC_IN_DONE type; in that case, just change the type. 522 */ 523 if (mt == NULL && tdbp->tdb_sproto != IPPROTO_IPCOMP) { 524 mtag = m_tag_get(PACKET_TAG_IPSEC_IN_DONE, 525 sizeof(struct tdb_ident), M_NOWAIT); 526 if (mtag == NULL) { 527 m_freem(m); 528 DPRINTF(("ipsec_common_input_cb(): failed to " 529 "get tag\n")); 530 IPSEC_ISTAT(espstat.esps_hdrops, ahstat.ahs_hdrops, 531 ipcompstat.ipcomps_hdrops); 532 return ENOMEM; 533 } 534 535 tdbi = (struct tdb_ident *)(mtag + 1); 536 bcopy(&tdbp->tdb_dst, &tdbi->dst, 537 sizeof(union sockaddr_union)); 538 tdbi->proto = tdbp->tdb_sproto; 539 tdbi->spi = tdbp->tdb_spi; 540 541 m_tag_prepend(m, mtag); 542 } else { 543 if (mt != NULL) 544 mt->m_tag_id = PACKET_TAG_IPSEC_IN_DONE; 545 } 546 547 if (sproto == IPPROTO_ESP) { 548 /* Packet is confidential ? */ 549 if (tdbp->tdb_encalgxform) 550 m->m_flags |= M_CONF; 551 552 /* Check if we had authenticated ESP. */ 553 if (tdbp->tdb_authalgxform) 554 m->m_flags |= M_AUTH; 555 } else if (sproto == IPPROTO_AH) 556 m->m_flags |= M_AUTH | M_AUTH_AH; 557 558 #if NPF > 0 559 /* Add pf tag if requested. */ 560 if (pf_tag_packet(m, tdbp->tdb_tag, -1)) 561 DPRINTF(("failed to tag ipsec packet\n")); 562 pf_pkt_addr_changed(m); 563 #endif 564 565 if (tdbp->tdb_flags & TDBF_TUNNELING) 566 m->m_flags |= M_TUNNEL; 567 568 #if NBPFILTER > 0 569 bpfif = &encif[0].sc_if; 570 bpfif->if_ipackets++; 571 bpfif->if_ibytes += m->m_pkthdr.len; 572 573 if (bpfif->if_bpf) { 574 struct enchdr hdr; 575 576 hdr.af = af; 577 hdr.spi = tdbp->tdb_spi; 578 hdr.flags = m->m_flags & (M_AUTH|M_CONF|M_AUTH_AH); 579 580 bpf_mtap_hdr(bpfif->if_bpf, (char *)&hdr, ENC_HDRLEN, m, 581 BPF_DIRECTION_IN); 582 } 583 #endif 584 585 /* Call the appropriate IPsec transform callback. */ 586 switch (af) { 587 #ifdef INET 588 case AF_INET: 589 switch (sproto) 590 { 591 case IPPROTO_ESP: 592 return esp4_input_cb(m); 593 594 case IPPROTO_AH: 595 return ah4_input_cb(m); 596 597 case IPPROTO_IPCOMP: 598 return ipcomp4_input_cb(m); 599 600 default: 601 DPRINTF(("ipsec_common_input_cb(): unknown/unsupported" 602 " security protocol %d\n", sproto)); 603 m_freem(m); 604 return EPFNOSUPPORT; 605 } 606 break; 607 #endif /* INET */ 608 609 #ifdef INET6 610 case AF_INET6: 611 switch (sproto) { 612 case IPPROTO_ESP: 613 return esp6_input_cb(m, skip, protoff); 614 615 case IPPROTO_AH: 616 return ah6_input_cb(m, skip, protoff); 617 618 case IPPROTO_IPCOMP: 619 return ipcomp6_input_cb(m, skip, protoff); 620 621 default: 622 DPRINTF(("ipsec_common_input_cb(): unknown/unsupported" 623 " security protocol %d\n", sproto)); 624 m_freem(m); 625 return EPFNOSUPPORT; 626 } 627 break; 628 #endif /* INET6 */ 629 630 default: 631 DPRINTF(("ipsec_common_input_cb(): unknown/unsupported " 632 "protocol family %d\n", af)); 633 m_freem(m); 634 return EPFNOSUPPORT; 635 } 636 #undef IPSEC_ISTAT 637 } 638 639 int 640 esp_sysctl(int *name, u_int namelen, void *oldp, size_t *oldlenp, void *newp, 641 size_t newlen) 642 { 643 /* All sysctl names at this level are terminal. */ 644 if (namelen != 1) 645 return (ENOTDIR); 646 647 switch (name[0]) { 648 case ESPCTL_STATS: 649 if (newp != NULL) 650 return (EPERM); 651 return (sysctl_struct(oldp, oldlenp, newp, newlen, 652 &espstat, sizeof(espstat))); 653 default: 654 if (name[0] < ESPCTL_MAXID) 655 return (sysctl_int_arr(espctl_vars, name, namelen, 656 oldp, oldlenp, newp, newlen)); 657 return (ENOPROTOOPT); 658 } 659 } 660 661 int 662 ah_sysctl(int *name, u_int namelen, void *oldp, size_t *oldlenp, void *newp, 663 size_t newlen) 664 { 665 /* All sysctl names at this level are terminal. */ 666 if (namelen != 1) 667 return (ENOTDIR); 668 669 switch (name[0]) { 670 case AHCTL_STATS: 671 if (newp != NULL) 672 return (EPERM); 673 return (sysctl_struct(oldp, oldlenp, newp, newlen, 674 &ahstat, sizeof(ahstat))); 675 default: 676 if (name[0] < AHCTL_MAXID) 677 return (sysctl_int_arr(ahctl_vars, name, namelen, 678 oldp, oldlenp, newp, newlen)); 679 return (ENOPROTOOPT); 680 } 681 } 682 683 int 684 ipcomp_sysctl(int *name, u_int namelen, void *oldp, size_t *oldlenp, void *newp, 685 size_t newlen) 686 { 687 /* All sysctl names at this level are terminal. */ 688 if (namelen != 1) 689 return (ENOTDIR); 690 691 switch (name[0]) { 692 case IPCOMPCTL_STATS: 693 if (newp != NULL) 694 return (EPERM); 695 return (sysctl_struct(oldp, oldlenp, newp, newlen, 696 &ipcompstat, sizeof(ipcompstat))); 697 default: 698 if (name[0] < IPCOMPCTL_MAXID) 699 return (sysctl_int_arr(ipcompctl_vars, name, namelen, 700 oldp, oldlenp, newp, newlen)); 701 return (ENOPROTOOPT); 702 } 703 } 704 705 #ifdef INET 706 /* IPv4 AH wrapper. */ 707 void 708 ah4_input(struct mbuf *m, ...) 709 { 710 int skip; 711 712 va_list ap; 713 va_start(ap, m); 714 skip = va_arg(ap, int); 715 va_end(ap); 716 717 ipsec_common_input(m, skip, offsetof(struct ip, ip_p), AF_INET, 718 IPPROTO_AH, 0); 719 return; 720 } 721 722 /* IPv4 AH callback. */ 723 int 724 ah4_input_cb(struct mbuf *m, ...) 725 { 726 struct ifqueue *ifq = &ipintrq; 727 int s = splnet(); 728 729 /* 730 * Interface pointer is already in first mbuf; chop off the 731 * `outer' header and reschedule. 732 */ 733 734 if (IF_QFULL(ifq)) { 735 IF_DROP(ifq); 736 ahstat.ahs_qfull++; 737 splx(s); 738 739 m_freem(m); 740 DPRINTF(("ah4_input_cb(): dropped packet because of full " 741 "IP queue\n")); 742 return ENOBUFS; 743 } 744 745 IF_ENQUEUE(ifq, m); 746 schednetisr(NETISR_IP); 747 splx(s); 748 return 0; 749 } 750 751 752 void * 753 ah4_ctlinput(int cmd, struct sockaddr *sa, void *v) 754 { 755 if (sa->sa_family != AF_INET || 756 sa->sa_len != sizeof(struct sockaddr_in)) 757 return (NULL); 758 759 return (ipsec_common_ctlinput(cmd, sa, v, IPPROTO_AH)); 760 } 761 762 /* IPv4 ESP wrapper. */ 763 void 764 esp4_input(struct mbuf *m, ...) 765 { 766 int skip; 767 768 va_list ap; 769 va_start(ap, m); 770 skip = va_arg(ap, int); 771 va_end(ap); 772 773 ipsec_common_input(m, skip, offsetof(struct ip, ip_p), AF_INET, 774 IPPROTO_ESP, 0); 775 } 776 777 /* IPv4 ESP callback. */ 778 int 779 esp4_input_cb(struct mbuf *m, ...) 780 { 781 struct ifqueue *ifq = &ipintrq; 782 int s = splnet(); 783 784 /* 785 * Interface pointer is already in first mbuf; chop off the 786 * `outer' header and reschedule. 787 */ 788 if (IF_QFULL(ifq)) { 789 IF_DROP(ifq); 790 espstat.esps_qfull++; 791 splx(s); 792 793 m_freem(m); 794 DPRINTF(("esp4_input_cb(): dropped packet because of full " 795 "IP queue\n")); 796 return ENOBUFS; 797 } 798 799 IF_ENQUEUE(ifq, m); 800 schednetisr(NETISR_IP); 801 splx(s); 802 return 0; 803 } 804 805 /* IPv4 IPCOMP wrapper */ 806 void 807 ipcomp4_input(struct mbuf *m, ...) 808 { 809 int skip; 810 va_list ap; 811 va_start(ap, m); 812 skip = va_arg(ap, int); 813 va_end(ap); 814 815 ipsec_common_input(m, skip, offsetof(struct ip, ip_p), AF_INET, 816 IPPROTO_IPCOMP, 0); 817 } 818 819 /* IPv4 IPCOMP callback */ 820 int 821 ipcomp4_input_cb(struct mbuf *m, ...) 822 { 823 struct ifqueue *ifq = &ipintrq; 824 int s = splnet(); 825 826 /* 827 * Interface pointer is already in first mbuf; chop off the 828 * `outer' header and reschedule. 829 */ 830 if (IF_QFULL(ifq)) { 831 IF_DROP(ifq); 832 ipcompstat.ipcomps_qfull++; 833 splx(s); 834 835 m_freem(m); 836 DPRINTF(("ipcomp4_input_cb(): dropped packet because of full IP queue\n")); 837 return ENOBUFS; 838 } 839 840 IF_ENQUEUE(ifq, m); 841 schednetisr(NETISR_IP); 842 splx(s); 843 844 return 0; 845 } 846 847 void * 848 ipsec_common_ctlinput(int cmd, struct sockaddr *sa, void *v, int proto) 849 { 850 extern u_int ip_mtudisc_timeout; 851 struct ip *ip = v; 852 int s; 853 854 if (cmd == PRC_MSGSIZE && ip && ip_mtudisc && ip->ip_v == 4) { 855 struct tdb *tdbp; 856 struct sockaddr_in dst; 857 struct icmp *icp; 858 int hlen = ip->ip_hl << 2; 859 u_int32_t spi, mtu; 860 ssize_t adjust; 861 862 /* Find the right MTU. */ 863 icp = (struct icmp *)((caddr_t) ip - 864 offsetof(struct icmp, icmp_ip)); 865 mtu = ntohs(icp->icmp_nextmtu); 866 867 /* 868 * Ignore the packet, if we do not receive a MTU 869 * or the MTU is too small to be acceptable. 870 */ 871 if (mtu < 296) 872 return (NULL); 873 874 bzero(&dst, sizeof(struct sockaddr_in)); 875 dst.sin_family = AF_INET; 876 dst.sin_len = sizeof(struct sockaddr_in); 877 dst.sin_addr.s_addr = ip->ip_dst.s_addr; 878 879 bcopy((caddr_t)ip + hlen, &spi, sizeof(u_int32_t)); 880 881 s = spltdb(); 882 tdbp = gettdb(spi, (union sockaddr_union *)&dst, proto); 883 if (tdbp == NULL || tdbp->tdb_flags & TDBF_INVALID) { 884 splx(s); 885 return (NULL); 886 } 887 888 /* Walk the chain backswards to the first tdb */ 889 for (; tdbp; tdbp = tdbp->tdb_inext) { 890 if (tdbp->tdb_flags & TDBF_INVALID || 891 (adjust = ipsec_hdrsz(tdbp)) == -1) { 892 splx(s); 893 return (NULL); 894 } 895 896 mtu -= adjust; 897 898 /* Store adjusted MTU in tdb */ 899 tdbp->tdb_mtu = mtu; 900 tdbp->tdb_mtutimeout = time_second + 901 ip_mtudisc_timeout; 902 DPRINTF(("ipsec_common_ctlinput: " 903 "spi %08x mtu %d adjust %d\n", 904 ntohl(tdbp->tdb_spi), tdbp->tdb_mtu, 905 adjust)); 906 } 907 splx(s); 908 return (NULL); 909 } 910 return (NULL); 911 } 912 913 void * 914 udpencap_ctlinput(int cmd, struct sockaddr *sa, void *v) 915 { 916 struct ip *ip = v; 917 struct tdb *tdbp; 918 struct icmp *icp; 919 u_int32_t mtu; 920 ssize_t adjust; 921 struct sockaddr_in dst, src; 922 union sockaddr_union *su_dst, *su_src; 923 int s; 924 925 icp = (struct icmp *)((caddr_t) ip - offsetof(struct icmp, icmp_ip)); 926 mtu = ntohs(icp->icmp_nextmtu); 927 928 /* 929 * Ignore the packet, if we do not receive a MTU 930 * or the MTU is too small to be acceptable. 931 */ 932 if (mtu < 296) 933 return (NULL); 934 935 bzero(&dst, sizeof(dst)); 936 dst.sin_family = AF_INET; 937 dst.sin_len = sizeof(struct sockaddr_in); 938 dst.sin_addr.s_addr = ip->ip_dst.s_addr; 939 su_dst = (union sockaddr_union *)&dst; 940 bzero(&src, sizeof(src)); 941 src.sin_family = AF_INET; 942 src.sin_len = sizeof(struct sockaddr_in); 943 src.sin_addr.s_addr = ip->ip_src.s_addr; 944 su_src = (union sockaddr_union *)&src; 945 946 s = spltdb(); 947 tdbp = gettdbbysrcdst(0, su_src, su_dst, IPPROTO_ESP); 948 949 for (; tdbp != NULL; tdbp = tdbp->tdb_snext) { 950 if (tdbp->tdb_sproto == IPPROTO_ESP && 951 ((tdbp->tdb_flags & (TDBF_INVALID|TDBF_UDPENCAP)) 952 == TDBF_UDPENCAP) && 953 !bcmp(&tdbp->tdb_dst, &dst, SA_LEN(&su_dst->sa)) && 954 !bcmp(&tdbp->tdb_src, &src, SA_LEN(&su_src->sa))) { 955 if ((adjust = ipsec_hdrsz(tdbp)) != -1) { 956 /* Store adjusted MTU in tdb */ 957 tdbp->tdb_mtu = mtu - adjust; 958 tdbp->tdb_mtutimeout = time_second + 959 ip_mtudisc_timeout; 960 DPRINTF(("udpencap_ctlinput: " 961 "spi %08x mtu %d adjust %d\n", 962 ntohl(tdbp->tdb_spi), tdbp->tdb_mtu, 963 adjust)); 964 } 965 } 966 } 967 splx(s); 968 return (NULL); 969 } 970 971 void * 972 esp4_ctlinput(int cmd, struct sockaddr *sa, void *v) 973 { 974 if (sa->sa_family != AF_INET || 975 sa->sa_len != sizeof(struct sockaddr_in)) 976 return (NULL); 977 978 return (ipsec_common_ctlinput(cmd, sa, v, IPPROTO_ESP)); 979 } 980 #endif /* INET */ 981 982 #ifdef INET6 983 /* IPv6 AH wrapper. */ 984 int 985 ah6_input(struct mbuf **mp, int *offp, int proto) 986 { 987 int l = 0; 988 int protoff, nxt; 989 struct ip6_ext ip6e; 990 991 if (*offp < sizeof(struct ip6_hdr)) { 992 DPRINTF(("ah6_input(): bad offset\n")); 993 return IPPROTO_DONE; 994 } else if (*offp == sizeof(struct ip6_hdr)) { 995 protoff = offsetof(struct ip6_hdr, ip6_nxt); 996 } else { 997 /* Chase down the header chain... */ 998 protoff = sizeof(struct ip6_hdr); 999 nxt = (mtod(*mp, struct ip6_hdr *))->ip6_nxt; 1000 1001 do { 1002 protoff += l; 1003 m_copydata(*mp, protoff, sizeof(ip6e), 1004 (caddr_t) &ip6e); 1005 1006 if (nxt == IPPROTO_AH) 1007 l = (ip6e.ip6e_len + 2) << 2; 1008 else 1009 l = (ip6e.ip6e_len + 1) << 3; 1010 #ifdef DIAGNOSTIC 1011 if (l <= 0) 1012 panic("ah6_input: l went zero or negative"); 1013 #endif 1014 1015 nxt = ip6e.ip6e_nxt; 1016 } while (protoff + l < *offp); 1017 1018 /* Malformed packet check */ 1019 if (protoff + l != *offp) { 1020 DPRINTF(("ah6_input(): bad packet header chain\n")); 1021 ahstat.ahs_hdrops++; 1022 m_freem(*mp); 1023 *mp = NULL; 1024 return IPPROTO_DONE; 1025 } 1026 protoff += offsetof(struct ip6_ext, ip6e_nxt); 1027 } 1028 ipsec_common_input(*mp, *offp, protoff, AF_INET6, proto, 0); 1029 return IPPROTO_DONE; 1030 } 1031 1032 /* IPv6 AH callback. */ 1033 int 1034 ah6_input_cb(struct mbuf *m, int off, int protoff) 1035 { 1036 int nxt; 1037 u_int8_t nxt8; 1038 int nest = 0; 1039 1040 /* Retrieve new protocol */ 1041 m_copydata(m, protoff, sizeof(u_int8_t), (caddr_t) &nxt8); 1042 nxt = nxt8; 1043 1044 /* 1045 * see the end of ip6_input for this logic. 1046 * IPPROTO_IPV[46] case will be processed just like other ones 1047 */ 1048 while (nxt != IPPROTO_DONE) { 1049 if (ip6_hdrnestlimit && (++nest > ip6_hdrnestlimit)) { 1050 ip6stat.ip6s_toomanyhdr++; 1051 goto bad; 1052 } 1053 1054 /* 1055 * Protection against faulty packet - there should be 1056 * more sanity checks in header chain processing. 1057 */ 1058 if (m->m_pkthdr.len < off) { 1059 ip6stat.ip6s_tooshort++; 1060 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_truncated); 1061 goto bad; 1062 } 1063 nxt = (*inet6sw[ip6_protox[nxt]].pr_input)(&m, &off, nxt); 1064 } 1065 return 0; 1066 1067 bad: 1068 m_freem(m); 1069 return EINVAL; 1070 } 1071 1072 /* IPv6 ESP wrapper. */ 1073 int 1074 esp6_input(struct mbuf **mp, int *offp, int proto) 1075 { 1076 int l = 0; 1077 int protoff, nxt; 1078 struct ip6_ext ip6e; 1079 1080 if (*offp < sizeof(struct ip6_hdr)) { 1081 DPRINTF(("esp6_input(): bad offset\n")); 1082 return IPPROTO_DONE; 1083 } else if (*offp == sizeof(struct ip6_hdr)) { 1084 protoff = offsetof(struct ip6_hdr, ip6_nxt); 1085 } else { 1086 /* Chase down the header chain... */ 1087 protoff = sizeof(struct ip6_hdr); 1088 nxt = (mtod(*mp, struct ip6_hdr *))->ip6_nxt; 1089 1090 do { 1091 protoff += l; 1092 m_copydata(*mp, protoff, sizeof(ip6e), 1093 (caddr_t) &ip6e); 1094 1095 if (nxt == IPPROTO_AH) 1096 l = (ip6e.ip6e_len + 2) << 2; 1097 else 1098 l = (ip6e.ip6e_len + 1) << 3; 1099 #ifdef DIAGNOSTIC 1100 if (l <= 0) 1101 panic("esp6_input: l went zero or negative"); 1102 #endif 1103 1104 nxt = ip6e.ip6e_nxt; 1105 } while (protoff + l < *offp); 1106 1107 /* Malformed packet check */ 1108 if (protoff + l != *offp) { 1109 DPRINTF(("esp6_input(): bad packet header chain\n")); 1110 espstat.esps_hdrops++; 1111 m_freem(*mp); 1112 *mp = NULL; 1113 return IPPROTO_DONE; 1114 } 1115 protoff += offsetof(struct ip6_ext, ip6e_nxt); 1116 } 1117 ipsec_common_input(*mp, *offp, protoff, AF_INET6, proto, 0); 1118 return IPPROTO_DONE; 1119 1120 } 1121 1122 /* IPv6 ESP callback */ 1123 int 1124 esp6_input_cb(struct mbuf *m, int skip, int protoff) 1125 { 1126 return ah6_input_cb(m, skip, protoff); 1127 } 1128 1129 /* IPv6 IPcomp wrapper */ 1130 int 1131 ipcomp6_input(struct mbuf **mp, int *offp, int proto) 1132 { 1133 int l = 0; 1134 int protoff, nxt; 1135 struct ip6_ext ip6e; 1136 1137 if (*offp < sizeof(struct ip6_hdr)) { 1138 DPRINTF(("ipcomp6_input(): bad offset\n")); 1139 return IPPROTO_DONE; 1140 } else if (*offp == sizeof(struct ip6_hdr)) { 1141 protoff = offsetof(struct ip6_hdr, ip6_nxt); 1142 } else { 1143 /* Chase down the header chain... */ 1144 protoff = sizeof(struct ip6_hdr); 1145 nxt = (mtod(*mp, struct ip6_hdr *))->ip6_nxt; 1146 1147 do { 1148 protoff += l; 1149 m_copydata(*mp, protoff, sizeof(ip6e), 1150 (caddr_t) &ip6e); 1151 if (nxt == IPPROTO_AH) 1152 l = (ip6e.ip6e_len + 2) << 2; 1153 else 1154 l = (ip6e.ip6e_len + 1) << 3; 1155 #ifdef DIAGNOSTIC 1156 if (l <= 0) 1157 panic("ipcomp6_input: l went zero or negative"); 1158 #endif 1159 1160 nxt = ip6e.ip6e_nxt; 1161 } while (protoff + l < *offp); 1162 1163 /* Malformed packet check */ 1164 if (protoff + l != *offp) { 1165 DPRINTF(("ipcomp6_input(): bad packet header chain\n")); 1166 ipcompstat.ipcomps_hdrops++; 1167 m_freem(*mp); 1168 *mp = NULL; 1169 return IPPROTO_DONE; 1170 } 1171 1172 protoff += offsetof(struct ip6_ext, ip6e_nxt); 1173 } 1174 ipsec_common_input(*mp, *offp, protoff, AF_INET6, proto, 0); 1175 return IPPROTO_DONE; 1176 } 1177 1178 /* IPv6 IPcomp callback */ 1179 int 1180 ipcomp6_input_cb(struct mbuf *m, int skip, int protoff) 1181 { 1182 return ah6_input_cb(m, skip, protoff); 1183 } 1184 1185 #endif /* INET6 */ 1186