1 /* $OpenBSD: ipsec_input.c,v 1.136 2016/09/02 09:39:32 vgross Exp $ */ 2 /* 3 * The authors of this code are John Ioannidis (ji@tla.org), 4 * Angelos D. Keromytis (kermit@csd.uch.gr) and 5 * Niels Provos (provos@physnet.uni-hamburg.de). 6 * 7 * This code was written by John Ioannidis for BSD/OS in Athens, Greece, 8 * in November 1995. 9 * 10 * Ported to OpenBSD and NetBSD, with additional transforms, in December 1996, 11 * by Angelos D. Keromytis. 12 * 13 * Additional transforms and features in 1997 and 1998 by Angelos D. Keromytis 14 * and Niels Provos. 15 * 16 * Additional features in 1999 by Angelos D. Keromytis. 17 * 18 * Copyright (C) 1995, 1996, 1997, 1998, 1999 by John Ioannidis, 19 * Angelos D. Keromytis and Niels Provos. 20 * Copyright (c) 2001, Angelos D. Keromytis. 21 * 22 * Permission to use, copy, and modify this software with or without fee 23 * is hereby granted, provided that this entire notice is included in 24 * all copies of any software which is or includes a copy or 25 * modification of this software. 26 * You may use this code under the GNU public license if you so wish. Please 27 * contribute changes back to the authors under this freer than GPL license 28 * so that we may further the use of strong encryption without limitations to 29 * all. 30 * 31 * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR 32 * IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY 33 * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE 34 * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR 35 * PURPOSE. 36 */ 37 38 #include "pf.h" 39 40 #include <sys/param.h> 41 #include <sys/systm.h> 42 #include <sys/protosw.h> 43 #include <sys/mbuf.h> 44 #include <sys/socket.h> 45 #include <sys/sysctl.h> 46 #include <sys/kernel.h> 47 #include <sys/timeout.h> 48 49 #include <net/if.h> 50 #include <net/if_var.h> 51 #include <net/netisr.h> 52 #include <net/bpf.h> 53 #include <net/route.h> 54 55 #include <netinet/in.h> 56 #include <netinet/ip.h> 57 #include <netinet/ip_var.h> 58 #include <netinet/ip_icmp.h> 59 #include <netinet/tcp.h> 60 #include <netinet/udp.h> 61 62 #if NPF > 0 63 #include <net/pfvar.h> 64 #endif 65 66 #ifdef INET6 67 #include <netinet6/in6_var.h> 68 #include <netinet/ip6.h> 69 #include <netinet6/ip6_var.h> 70 #include <netinet6/ip6protosw.h> 71 #endif /* INET6 */ 72 73 #include <netinet/ip_ipsp.h> 74 #include <netinet/ip_esp.h> 75 #include <netinet/ip_ah.h> 76 #include <netinet/ip_ipcomp.h> 77 78 #include <net/if_enc.h> 79 80 #include "bpfilter.h" 81 82 void *ipsec_common_ctlinput(u_int, int, struct sockaddr *, void *, int); 83 int ah4_input_cb(struct mbuf *, ...); 84 int esp4_input_cb(struct mbuf *, ...); 85 int ipcomp4_input_cb(struct mbuf *, ...); 86 87 #ifdef INET6 88 int ah6_input_cb(struct mbuf *, int, int); 89 int esp6_input_cb(struct mbuf *, int, int); 90 int ipcomp6_input_cb(struct mbuf *, int, int); 91 #endif 92 93 #ifdef ENCDEBUG 94 #define DPRINTF(x) if (encdebug) printf x 95 #else 96 #define DPRINTF(x) 97 #endif 98 99 /* sysctl variables */ 100 int esp_enable = 1; 101 int ah_enable = 1; 102 int ipcomp_enable = 0; 103 104 int *espctl_vars[ESPCTL_MAXID] = ESPCTL_VARS; 105 int *ahctl_vars[AHCTL_MAXID] = AHCTL_VARS; 106 int *ipcompctl_vars[IPCOMPCTL_MAXID] = IPCOMPCTL_VARS; 107 108 /* 109 * ipsec_common_input() gets called when we receive an IPsec-protected packet 110 * in IPv4 or IPv6. All it does is find the right TDB and call the appropriate 111 * transform. The callback takes care of further processing (like ingress 112 * filtering). 113 */ 114 int 115 ipsec_common_input(struct mbuf *m, int skip, int protoff, int af, int sproto, 116 int udpencap) 117 { 118 #define IPSEC_ISTAT(x,y,z) (sproto == IPPROTO_ESP ? (x)++ : \ 119 sproto == IPPROTO_AH ? (y)++ : (z)++) 120 121 union sockaddr_union dst_address; 122 struct tdb *tdbp; 123 struct ifnet *encif; 124 u_int32_t spi; 125 u_int16_t cpi; 126 int s, error; 127 #ifdef ENCDEBUG 128 char buf[INET6_ADDRSTRLEN]; 129 #endif 130 131 IPSEC_ISTAT(espstat.esps_input, ahstat.ahs_input, 132 ipcompstat.ipcomps_input); 133 134 if (m == NULL) { 135 DPRINTF(("ipsec_common_input(): NULL packet received\n")); 136 IPSEC_ISTAT(espstat.esps_hdrops, ahstat.ahs_hdrops, 137 ipcompstat.ipcomps_hdrops); 138 return EINVAL; 139 } 140 141 if ((sproto == IPPROTO_ESP && !esp_enable) || 142 (sproto == IPPROTO_AH && !ah_enable) || 143 #if NPF > 0 144 (m->m_pkthdr.pf.flags & PF_TAG_DIVERTED) || 145 #endif 146 (sproto == IPPROTO_IPCOMP && !ipcomp_enable)) { 147 switch (af) { 148 case AF_INET: 149 rip_input(m, skip, sproto); 150 break; 151 #ifdef INET6 152 case AF_INET6: 153 rip6_input(&m, &skip, sproto); 154 break; 155 #endif /* INET6 */ 156 default: 157 DPRINTF(("ipsec_common_input(): unsupported protocol " 158 "family %d\n", af)); 159 m_freem(m); 160 IPSEC_ISTAT(espstat.esps_nopf, ahstat.ahs_nopf, 161 ipcompstat.ipcomps_nopf); 162 return EPFNOSUPPORT; 163 } 164 return 0; 165 } 166 if ((sproto == IPPROTO_IPCOMP) && (m->m_flags & M_COMP)) { 167 m_freem(m); 168 ipcompstat.ipcomps_pdrops++; 169 DPRINTF(("ipsec_common_input(): repeated decompression\n")); 170 return EINVAL; 171 } 172 173 if (m->m_pkthdr.len - skip < 2 * sizeof(u_int32_t)) { 174 m_freem(m); 175 IPSEC_ISTAT(espstat.esps_hdrops, ahstat.ahs_hdrops, 176 ipcompstat.ipcomps_hdrops); 177 DPRINTF(("ipsec_common_input(): packet too small\n")); 178 return EINVAL; 179 } 180 181 /* Retrieve the SPI from the relevant IPsec header */ 182 if (sproto == IPPROTO_ESP) 183 m_copydata(m, skip, sizeof(u_int32_t), (caddr_t) &spi); 184 else if (sproto == IPPROTO_AH) 185 m_copydata(m, skip + sizeof(u_int32_t), sizeof(u_int32_t), 186 (caddr_t) &spi); 187 else if (sproto == IPPROTO_IPCOMP) { 188 m_copydata(m, skip + sizeof(u_int16_t), sizeof(u_int16_t), 189 (caddr_t) &cpi); 190 spi = ntohl(htons(cpi)); 191 } 192 193 /* 194 * Find tunnel control block and (indirectly) call the appropriate 195 * kernel crypto routine. The resulting mbuf chain is a valid 196 * IP packet ready to go through input processing. 197 */ 198 199 memset(&dst_address, 0, sizeof(dst_address)); 200 dst_address.sa.sa_family = af; 201 202 switch (af) { 203 case AF_INET: 204 dst_address.sin.sin_len = sizeof(struct sockaddr_in); 205 m_copydata(m, offsetof(struct ip, ip_dst), 206 sizeof(struct in_addr), 207 (caddr_t) &(dst_address.sin.sin_addr)); 208 break; 209 210 #ifdef INET6 211 case AF_INET6: 212 dst_address.sin6.sin6_len = sizeof(struct sockaddr_in6); 213 m_copydata(m, offsetof(struct ip6_hdr, ip6_dst), 214 sizeof(struct in6_addr), 215 (caddr_t) &(dst_address.sin6.sin6_addr)); 216 in6_recoverscope(&dst_address.sin6, 217 &dst_address.sin6.sin6_addr); 218 break; 219 #endif /* INET6 */ 220 221 default: 222 DPRINTF(("ipsec_common_input(): unsupported protocol " 223 "family %d\n", af)); 224 m_freem(m); 225 IPSEC_ISTAT(espstat.esps_nopf, ahstat.ahs_nopf, 226 ipcompstat.ipcomps_nopf); 227 return EPFNOSUPPORT; 228 } 229 230 s = splsoftnet(); 231 tdbp = gettdb(rtable_l2(m->m_pkthdr.ph_rtableid), 232 spi, &dst_address, sproto); 233 if (tdbp == NULL) { 234 splx(s); 235 DPRINTF(("ipsec_common_input(): could not find SA for " 236 "packet to %s, spi %08x\n", 237 ipsp_address(&dst_address, buf, sizeof(buf)), ntohl(spi))); 238 m_freem(m); 239 IPSEC_ISTAT(espstat.esps_notdb, ahstat.ahs_notdb, 240 ipcompstat.ipcomps_notdb); 241 return ENOENT; 242 } 243 244 if (tdbp->tdb_flags & TDBF_INVALID) { 245 splx(s); 246 DPRINTF(("ipsec_common_input(): attempted to use invalid " 247 "SA %s/%08x/%u\n", ipsp_address(&dst_address, buf, 248 sizeof(buf)), ntohl(spi), tdbp->tdb_sproto)); 249 m_freem(m); 250 IPSEC_ISTAT(espstat.esps_invalid, ahstat.ahs_invalid, 251 ipcompstat.ipcomps_invalid); 252 return EINVAL; 253 } 254 255 if (udpencap && !(tdbp->tdb_flags & TDBF_UDPENCAP)) { 256 splx(s); 257 DPRINTF(("ipsec_common_input(): attempted to use non-udpencap " 258 "SA %s/%08x/%u\n", ipsp_address(&dst_address, buf, 259 sizeof(buf)), ntohl(spi), tdbp->tdb_sproto)); 260 m_freem(m); 261 espstat.esps_udpinval++; 262 return EINVAL; 263 } 264 265 if (!udpencap && (tdbp->tdb_flags & TDBF_UDPENCAP)) { 266 splx(s); 267 DPRINTF(("ipsec_common_input(): attempted to use udpencap " 268 "SA %s/%08x/%u\n", ipsp_address(&dst_address, buf, 269 sizeof(buf)), ntohl(spi), tdbp->tdb_sproto)); 270 m_freem(m); 271 espstat.esps_udpneeded++; 272 return EINVAL; 273 } 274 275 if (tdbp->tdb_xform == NULL) { 276 splx(s); 277 DPRINTF(("ipsec_common_input(): attempted to use uninitialized " 278 "SA %s/%08x/%u\n", ipsp_address(&dst_address, buf, 279 sizeof(buf)), ntohl(spi), tdbp->tdb_sproto)); 280 m_freem(m); 281 IPSEC_ISTAT(espstat.esps_noxform, ahstat.ahs_noxform, 282 ipcompstat.ipcomps_noxform); 283 return ENXIO; 284 } 285 286 if (sproto != IPPROTO_IPCOMP) { 287 if ((encif = enc_getif(tdbp->tdb_rdomain, 288 tdbp->tdb_tap)) == NULL) { 289 splx(s); 290 DPRINTF(("ipsec_common_input(): " 291 "no enc%u interface for SA %s/%08x/%u\n", 292 tdbp->tdb_tap, ipsp_address(&dst_address, buf, 293 sizeof(buf)), ntohl(spi), tdbp->tdb_sproto)); 294 m_freem(m); 295 296 IPSEC_ISTAT(espstat.esps_pdrops, 297 ahstat.ahs_pdrops, 298 ipcompstat.ipcomps_pdrops); 299 return EACCES; 300 } 301 302 /* XXX This conflicts with the scoped nature of IPv6 */ 303 m->m_pkthdr.ph_ifidx = encif->if_index; 304 } 305 306 /* Register first use, setup expiration timer. */ 307 if (tdbp->tdb_first_use == 0) { 308 tdbp->tdb_first_use = time_second; 309 if (tdbp->tdb_flags & TDBF_FIRSTUSE) 310 timeout_add_sec(&tdbp->tdb_first_tmo, 311 tdbp->tdb_exp_first_use); 312 if (tdbp->tdb_flags & TDBF_SOFT_FIRSTUSE) 313 timeout_add_sec(&tdbp->tdb_sfirst_tmo, 314 tdbp->tdb_soft_first_use); 315 } 316 317 /* 318 * Call appropriate transform and return -- callback takes care of 319 * everything else. 320 */ 321 error = (*(tdbp->tdb_xform->xf_input))(m, tdbp, skip, protoff); 322 splx(s); 323 return error; 324 } 325 326 /* 327 * IPsec input callback, called by the transform callback. Takes care of 328 * filtering and other sanity checks on the processed packet. 329 */ 330 int 331 ipsec_common_input_cb(struct mbuf *m, struct tdb *tdbp, int skip, int protoff) 332 { 333 int af, sproto; 334 u_char prot; 335 336 #if NBPFILTER > 0 337 struct ifnet *encif; 338 #endif 339 340 struct ip *ip, ipn; 341 342 #ifdef INET6 343 struct ip6_hdr *ip6, ip6n; 344 #endif /* INET6 */ 345 struct m_tag *mtag; 346 struct tdb_ident *tdbi; 347 348 #ifdef ENCDEBUG 349 char buf[INET6_ADDRSTRLEN]; 350 #endif 351 352 af = tdbp->tdb_dst.sa.sa_family; 353 sproto = tdbp->tdb_sproto; 354 355 tdbp->tdb_last_used = time_second; 356 357 /* Sanity check */ 358 if (m == NULL) { 359 /* The called routine will print a message if necessary */ 360 IPSEC_ISTAT(espstat.esps_badkcr, ahstat.ahs_badkcr, 361 ipcompstat.ipcomps_badkcr); 362 return EINVAL; 363 } 364 365 /* Fix IPv4 header */ 366 if (af == AF_INET) { 367 if ((m->m_len < skip) && ((m = m_pullup(m, skip)) == NULL)) { 368 DPRINTF(("ipsec_common_input_cb(): processing failed " 369 "for SA %s/%08x\n", ipsp_address(&tdbp->tdb_dst, 370 buf, sizeof(buf)), ntohl(tdbp->tdb_spi))); 371 IPSEC_ISTAT(espstat.esps_hdrops, ahstat.ahs_hdrops, 372 ipcompstat.ipcomps_hdrops); 373 return ENOBUFS; 374 } 375 376 ip = mtod(m, struct ip *); 377 ip->ip_len = htons(m->m_pkthdr.len); 378 ip->ip_sum = 0; 379 ip->ip_sum = in_cksum(m, ip->ip_hl << 2); 380 prot = ip->ip_p; 381 382 /* IP-in-IP encapsulation */ 383 if (prot == IPPROTO_IPIP) { 384 if (m->m_pkthdr.len - skip < sizeof(struct ip)) { 385 m_freem(m); 386 IPSEC_ISTAT(espstat.esps_hdrops, 387 ahstat.ahs_hdrops, 388 ipcompstat.ipcomps_hdrops); 389 return EINVAL; 390 } 391 /* ipn will now contain the inner IPv4 header */ 392 m_copydata(m, skip, sizeof(struct ip), 393 (caddr_t) &ipn); 394 } 395 396 #ifdef INET6 397 /* IPv6-in-IP encapsulation. */ 398 if (prot == IPPROTO_IPV6) { 399 if (m->m_pkthdr.len - skip < sizeof(struct ip6_hdr)) { 400 m_freem(m); 401 IPSEC_ISTAT(espstat.esps_hdrops, 402 ahstat.ahs_hdrops, 403 ipcompstat.ipcomps_hdrops); 404 return EINVAL; 405 } 406 /* ip6n will now contain the inner IPv6 header. */ 407 m_copydata(m, skip, sizeof(struct ip6_hdr), 408 (caddr_t) &ip6n); 409 } 410 #endif /* INET6 */ 411 } 412 413 #ifdef INET6 414 /* Fix IPv6 header */ 415 if (af == AF_INET6) 416 { 417 if (m->m_len < sizeof(struct ip6_hdr) && 418 (m = m_pullup(m, sizeof(struct ip6_hdr))) == NULL) { 419 420 DPRINTF(("ipsec_common_input_cb(): processing failed " 421 "for SA %s/%08x\n", ipsp_address(&tdbp->tdb_dst, 422 buf, sizeof(buf)), ntohl(tdbp->tdb_spi))); 423 424 IPSEC_ISTAT(espstat.esps_hdrops, ahstat.ahs_hdrops, 425 ipcompstat.ipcomps_hdrops); 426 return EACCES; 427 } 428 429 ip6 = mtod(m, struct ip6_hdr *); 430 ip6->ip6_plen = htons(m->m_pkthdr.len - skip); 431 432 /* Save protocol */ 433 m_copydata(m, protoff, 1, (caddr_t) &prot); 434 435 /* IP-in-IP encapsulation */ 436 if (prot == IPPROTO_IPIP) { 437 if (m->m_pkthdr.len - skip < sizeof(struct ip)) { 438 m_freem(m); 439 IPSEC_ISTAT(espstat.esps_hdrops, 440 ahstat.ahs_hdrops, 441 ipcompstat.ipcomps_hdrops); 442 return EINVAL; 443 } 444 /* ipn will now contain the inner IPv4 header */ 445 m_copydata(m, skip, sizeof(struct ip), (caddr_t) &ipn); 446 } 447 448 /* IPv6-in-IP encapsulation */ 449 if (prot == IPPROTO_IPV6) { 450 if (m->m_pkthdr.len - skip < sizeof(struct ip6_hdr)) { 451 m_freem(m); 452 IPSEC_ISTAT(espstat.esps_hdrops, 453 ahstat.ahs_hdrops, 454 ipcompstat.ipcomps_hdrops); 455 return EINVAL; 456 } 457 /* ip6n will now contain the inner IPv6 header. */ 458 m_copydata(m, skip, sizeof(struct ip6_hdr), 459 (caddr_t) &ip6n); 460 } 461 } 462 #endif /* INET6 */ 463 464 /* 465 * Fix TCP/UDP checksum of UDP encapsulated transport mode ESP packet. 466 * (RFC3948 3.1.2) 467 */ 468 if ((af == AF_INET || af == AF_INET6) && 469 (tdbp->tdb_flags & TDBF_UDPENCAP) && 470 (tdbp->tdb_flags & TDBF_TUNNELING) == 0) { 471 u_int16_t cksum; 472 473 switch (prot) { 474 case IPPROTO_UDP: 475 if (m->m_pkthdr.len < skip + sizeof(struct udphdr)) { 476 m_freem(m); 477 IPSEC_ISTAT(espstat.esps_hdrops, 478 ahstat.ahs_hdrops, 479 ipcompstat.ipcomps_hdrops); 480 return EINVAL; 481 } 482 cksum = 0; 483 m_copyback(m, skip + offsetof(struct udphdr, uh_sum), 484 sizeof(cksum), &cksum, M_NOWAIT); 485 #ifdef INET6 486 if (af == AF_INET6) { 487 cksum = in6_cksum(m, IPPROTO_UDP, skip, 488 m->m_pkthdr.len - skip); 489 m_copyback(m, skip + offsetof(struct udphdr, 490 uh_sum), sizeof(cksum), &cksum, M_NOWAIT); 491 } 492 #endif 493 break; 494 case IPPROTO_TCP: 495 if (m->m_pkthdr.len < skip + sizeof(struct tcphdr)) { 496 m_freem(m); 497 IPSEC_ISTAT(espstat.esps_hdrops, 498 ahstat.ahs_hdrops, 499 ipcompstat.ipcomps_hdrops); 500 return EINVAL; 501 } 502 cksum = 0; 503 m_copyback(m, skip + offsetof(struct tcphdr, th_sum), 504 sizeof(cksum), &cksum, M_NOWAIT); 505 if (af == AF_INET) 506 cksum = in4_cksum(m, IPPROTO_TCP, skip, 507 m->m_pkthdr.len - skip); 508 #ifdef INET6 509 else if (af == AF_INET6) 510 cksum = in6_cksum(m, IPPROTO_TCP, skip, 511 m->m_pkthdr.len - skip); 512 #endif 513 m_copyback(m, skip + offsetof(struct tcphdr, th_sum), 514 sizeof(cksum), &cksum, M_NOWAIT); 515 break; 516 } 517 } 518 519 /* 520 * Record what we've done to the packet (under what SA it was 521 * processed). 522 */ 523 if (tdbp->tdb_sproto != IPPROTO_IPCOMP) { 524 mtag = m_tag_get(PACKET_TAG_IPSEC_IN_DONE, 525 sizeof(struct tdb_ident), M_NOWAIT); 526 if (mtag == NULL) { 527 m_freem(m); 528 DPRINTF(("ipsec_common_input_cb(): failed to " 529 "get tag\n")); 530 IPSEC_ISTAT(espstat.esps_hdrops, ahstat.ahs_hdrops, 531 ipcompstat.ipcomps_hdrops); 532 return ENOMEM; 533 } 534 535 tdbi = (struct tdb_ident *)(mtag + 1); 536 bcopy(&tdbp->tdb_dst, &tdbi->dst, 537 sizeof(union sockaddr_union)); 538 tdbi->proto = tdbp->tdb_sproto; 539 tdbi->spi = tdbp->tdb_spi; 540 tdbi->rdomain = tdbp->tdb_rdomain; 541 542 m_tag_prepend(m, mtag); 543 } 544 545 if (sproto == IPPROTO_ESP) { 546 /* Packet is confidential ? */ 547 if (tdbp->tdb_encalgxform) 548 m->m_flags |= M_CONF; 549 550 /* Check if we had authenticated ESP. */ 551 if (tdbp->tdb_authalgxform) 552 m->m_flags |= M_AUTH; 553 } else if (sproto == IPPROTO_AH) { 554 m->m_flags |= M_AUTH; 555 } else if (sproto == IPPROTO_IPCOMP) { 556 m->m_flags |= M_COMP; 557 } 558 559 #if NPF > 0 560 /* Add pf tag if requested. */ 561 pf_tag_packet(m, tdbp->tdb_tag, -1); 562 pf_pkt_addr_changed(m); 563 #endif 564 565 if (tdbp->tdb_flags & TDBF_TUNNELING) 566 m->m_flags |= M_TUNNEL; 567 568 #if NBPFILTER > 0 569 if ((encif = enc_getif(tdbp->tdb_rdomain, tdbp->tdb_tap)) != NULL) { 570 encif->if_ipackets++; 571 encif->if_ibytes += m->m_pkthdr.len; 572 573 if (encif->if_bpf) { 574 struct enchdr hdr; 575 576 hdr.af = af; 577 hdr.spi = tdbp->tdb_spi; 578 hdr.flags = m->m_flags & (M_AUTH|M_CONF); 579 580 bpf_mtap_hdr(encif->if_bpf, (char *)&hdr, 581 ENC_HDRLEN, m, BPF_DIRECTION_IN, NULL); 582 } 583 } 584 #endif 585 586 /* Call the appropriate IPsec transform callback. */ 587 switch (af) { 588 case AF_INET: 589 switch (sproto) 590 { 591 case IPPROTO_ESP: 592 return esp4_input_cb(m); 593 594 case IPPROTO_AH: 595 return ah4_input_cb(m); 596 597 case IPPROTO_IPCOMP: 598 return ipcomp4_input_cb(m); 599 600 default: 601 DPRINTF(("ipsec_common_input_cb(): unknown/unsupported" 602 " security protocol %d\n", sproto)); 603 m_freem(m); 604 return EPFNOSUPPORT; 605 } 606 break; 607 608 #ifdef INET6 609 case AF_INET6: 610 switch (sproto) { 611 case IPPROTO_ESP: 612 return esp6_input_cb(m, skip, protoff); 613 614 case IPPROTO_AH: 615 return ah6_input_cb(m, skip, protoff); 616 617 case IPPROTO_IPCOMP: 618 return ipcomp6_input_cb(m, skip, protoff); 619 620 default: 621 DPRINTF(("ipsec_common_input_cb(): unknown/unsupported" 622 " security protocol %d\n", sproto)); 623 m_freem(m); 624 return EPFNOSUPPORT; 625 } 626 break; 627 #endif /* INET6 */ 628 629 default: 630 DPRINTF(("ipsec_common_input_cb(): unknown/unsupported " 631 "protocol family %d\n", af)); 632 m_freem(m); 633 return EPFNOSUPPORT; 634 } 635 #undef IPSEC_ISTAT 636 } 637 638 int 639 esp_sysctl(int *name, u_int namelen, void *oldp, size_t *oldlenp, void *newp, 640 size_t newlen) 641 { 642 /* All sysctl names at this level are terminal. */ 643 if (namelen != 1) 644 return (ENOTDIR); 645 646 switch (name[0]) { 647 case ESPCTL_STATS: 648 if (newp != NULL) 649 return (EPERM); 650 return (sysctl_struct(oldp, oldlenp, newp, newlen, 651 &espstat, sizeof(espstat))); 652 default: 653 if (name[0] < ESPCTL_MAXID) 654 return (sysctl_int_arr(espctl_vars, name, namelen, 655 oldp, oldlenp, newp, newlen)); 656 return (ENOPROTOOPT); 657 } 658 } 659 660 int 661 ah_sysctl(int *name, u_int namelen, void *oldp, size_t *oldlenp, void *newp, 662 size_t newlen) 663 { 664 /* All sysctl names at this level are terminal. */ 665 if (namelen != 1) 666 return (ENOTDIR); 667 668 switch (name[0]) { 669 case AHCTL_STATS: 670 if (newp != NULL) 671 return (EPERM); 672 return (sysctl_struct(oldp, oldlenp, newp, newlen, 673 &ahstat, sizeof(ahstat))); 674 default: 675 if (name[0] < AHCTL_MAXID) 676 return (sysctl_int_arr(ahctl_vars, name, namelen, 677 oldp, oldlenp, newp, newlen)); 678 return (ENOPROTOOPT); 679 } 680 } 681 682 int 683 ipcomp_sysctl(int *name, u_int namelen, void *oldp, size_t *oldlenp, void *newp, 684 size_t newlen) 685 { 686 /* All sysctl names at this level are terminal. */ 687 if (namelen != 1) 688 return (ENOTDIR); 689 690 switch (name[0]) { 691 case IPCOMPCTL_STATS: 692 if (newp != NULL) 693 return (EPERM); 694 return (sysctl_struct(oldp, oldlenp, newp, newlen, 695 &ipcompstat, sizeof(ipcompstat))); 696 default: 697 if (name[0] < IPCOMPCTL_MAXID) 698 return (sysctl_int_arr(ipcompctl_vars, name, namelen, 699 oldp, oldlenp, newp, newlen)); 700 return (ENOPROTOOPT); 701 } 702 } 703 704 /* IPv4 AH wrapper. */ 705 void 706 ah4_input(struct mbuf *m, ...) 707 { 708 int skip; 709 710 va_list ap; 711 va_start(ap, m); 712 skip = va_arg(ap, int); 713 va_end(ap); 714 715 ipsec_common_input(m, skip, offsetof(struct ip, ip_p), AF_INET, 716 IPPROTO_AH, 0); 717 return; 718 } 719 720 /* IPv4 AH callback. */ 721 int 722 ah4_input_cb(struct mbuf *m, ...) 723 { 724 /* 725 * Interface pointer is already in first mbuf; chop off the 726 * `outer' header and reschedule. 727 */ 728 729 if (niq_enqueue(&ipintrq, m) != 0) { 730 ahstat.ahs_qfull++; 731 DPRINTF(("ah4_input_cb(): dropped packet because of full " 732 "IP queue\n")); 733 return ENOBUFS; 734 } 735 736 return 0; 737 } 738 739 740 /* XXX rdomain */ 741 void * 742 ah4_ctlinput(int cmd, struct sockaddr *sa, u_int rdomain, void *v) 743 { 744 if (sa->sa_family != AF_INET || 745 sa->sa_len != sizeof(struct sockaddr_in)) 746 return (NULL); 747 748 return (ipsec_common_ctlinput(rdomain, cmd, sa, v, IPPROTO_AH)); 749 } 750 751 /* IPv4 ESP wrapper. */ 752 void 753 esp4_input(struct mbuf *m, ...) 754 { 755 int skip; 756 757 va_list ap; 758 va_start(ap, m); 759 skip = va_arg(ap, int); 760 va_end(ap); 761 762 ipsec_common_input(m, skip, offsetof(struct ip, ip_p), AF_INET, 763 IPPROTO_ESP, 0); 764 } 765 766 /* IPv4 ESP callback. */ 767 int 768 esp4_input_cb(struct mbuf *m, ...) 769 { 770 /* 771 * Interface pointer is already in first mbuf; chop off the 772 * `outer' header and reschedule. 773 */ 774 if (niq_enqueue(&ipintrq, m) != 0) { 775 espstat.esps_qfull++; 776 DPRINTF(("esp4_input_cb(): dropped packet because of full " 777 "IP queue\n")); 778 return ENOBUFS; 779 } 780 781 return 0; 782 } 783 784 /* IPv4 IPCOMP wrapper */ 785 void 786 ipcomp4_input(struct mbuf *m, ...) 787 { 788 int skip; 789 va_list ap; 790 va_start(ap, m); 791 skip = va_arg(ap, int); 792 va_end(ap); 793 794 ipsec_common_input(m, skip, offsetof(struct ip, ip_p), AF_INET, 795 IPPROTO_IPCOMP, 0); 796 } 797 798 /* IPv4 IPCOMP callback */ 799 int 800 ipcomp4_input_cb(struct mbuf *m, ...) 801 { 802 /* 803 * Interface pointer is already in first mbuf; chop off the 804 * `outer' header and reschedule. 805 */ 806 if (niq_enqueue(&ipintrq, m) != 0) { 807 ipcompstat.ipcomps_qfull++; 808 DPRINTF(("ipcomp4_input_cb(): dropped packet because of full IP queue\n")); 809 return ENOBUFS; 810 } 811 812 return 0; 813 } 814 815 void * 816 ipsec_common_ctlinput(u_int rdomain, int cmd, struct sockaddr *sa, 817 void *v, int proto) 818 { 819 struct ip *ip = v; 820 int s; 821 822 if (cmd == PRC_MSGSIZE && ip && ip_mtudisc && ip->ip_v == 4) { 823 struct tdb *tdbp; 824 struct sockaddr_in dst; 825 struct icmp *icp; 826 int hlen = ip->ip_hl << 2; 827 u_int32_t spi, mtu; 828 ssize_t adjust; 829 830 /* Find the right MTU. */ 831 icp = (struct icmp *)((caddr_t) ip - 832 offsetof(struct icmp, icmp_ip)); 833 mtu = ntohs(icp->icmp_nextmtu); 834 835 /* 836 * Ignore the packet, if we do not receive a MTU 837 * or the MTU is too small to be acceptable. 838 */ 839 if (mtu < 296) 840 return (NULL); 841 842 memset(&dst, 0, sizeof(struct sockaddr_in)); 843 dst.sin_family = AF_INET; 844 dst.sin_len = sizeof(struct sockaddr_in); 845 dst.sin_addr.s_addr = ip->ip_dst.s_addr; 846 847 bcopy((caddr_t)ip + hlen, &spi, sizeof(u_int32_t)); 848 849 s = splsoftnet(); 850 tdbp = gettdb(rdomain, spi, (union sockaddr_union *)&dst, 851 proto); 852 if (tdbp == NULL || tdbp->tdb_flags & TDBF_INVALID) { 853 splx(s); 854 return (NULL); 855 } 856 857 /* Walk the chain backwards to the first tdb */ 858 for (; tdbp; tdbp = tdbp->tdb_inext) { 859 if (tdbp->tdb_flags & TDBF_INVALID || 860 (adjust = ipsec_hdrsz(tdbp)) == -1) { 861 splx(s); 862 return (NULL); 863 } 864 865 mtu -= adjust; 866 867 /* Store adjusted MTU in tdb */ 868 tdbp->tdb_mtu = mtu; 869 tdbp->tdb_mtutimeout = time_second + 870 ip_mtudisc_timeout; 871 DPRINTF(("ipsec_common_ctlinput: " 872 "spi %08x mtu %d adjust %ld\n", 873 ntohl(tdbp->tdb_spi), tdbp->tdb_mtu, 874 adjust)); 875 } 876 splx(s); 877 return (NULL); 878 } 879 return (NULL); 880 } 881 882 /* XXX rdomain */ 883 void * 884 udpencap_ctlinput(int cmd, struct sockaddr *sa, u_int rdomain, void *v) 885 { 886 struct ip *ip = v; 887 struct tdb *tdbp; 888 struct icmp *icp; 889 u_int32_t mtu; 890 ssize_t adjust; 891 struct sockaddr_in dst, src; 892 union sockaddr_union *su_dst, *su_src; 893 int s; 894 895 icp = (struct icmp *)((caddr_t) ip - offsetof(struct icmp, icmp_ip)); 896 mtu = ntohs(icp->icmp_nextmtu); 897 898 /* 899 * Ignore the packet, if we do not receive a MTU 900 * or the MTU is too small to be acceptable. 901 */ 902 if (mtu < 296) 903 return (NULL); 904 905 memset(&dst, 0, sizeof(dst)); 906 dst.sin_family = AF_INET; 907 dst.sin_len = sizeof(struct sockaddr_in); 908 dst.sin_addr.s_addr = ip->ip_dst.s_addr; 909 su_dst = (union sockaddr_union *)&dst; 910 memset(&src, 0, sizeof(src)); 911 src.sin_family = AF_INET; 912 src.sin_len = sizeof(struct sockaddr_in); 913 src.sin_addr.s_addr = ip->ip_src.s_addr; 914 su_src = (union sockaddr_union *)&src; 915 916 s = splsoftnet(); 917 tdbp = gettdbbysrcdst(rdomain, 0, su_src, su_dst, IPPROTO_ESP); 918 919 for (; tdbp != NULL; tdbp = tdbp->tdb_snext) { 920 if (tdbp->tdb_sproto == IPPROTO_ESP && 921 ((tdbp->tdb_flags & (TDBF_INVALID|TDBF_UDPENCAP)) == 922 TDBF_UDPENCAP) && 923 !memcmp(&tdbp->tdb_dst, &dst, SA_LEN(&su_dst->sa)) && 924 !memcmp(&tdbp->tdb_src, &src, SA_LEN(&su_src->sa))) { 925 if ((adjust = ipsec_hdrsz(tdbp)) != -1) { 926 /* Store adjusted MTU in tdb */ 927 tdbp->tdb_mtu = mtu - adjust; 928 tdbp->tdb_mtutimeout = time_second + 929 ip_mtudisc_timeout; 930 DPRINTF(("udpencap_ctlinput: " 931 "spi %08x mtu %d adjust %ld\n", 932 ntohl(tdbp->tdb_spi), tdbp->tdb_mtu, 933 adjust)); 934 } 935 } 936 } 937 splx(s); 938 return (NULL); 939 } 940 941 /* XXX rdomain */ 942 void * 943 esp4_ctlinput(int cmd, struct sockaddr *sa, u_int rdomain, void *v) 944 { 945 if (sa->sa_family != AF_INET || 946 sa->sa_len != sizeof(struct sockaddr_in)) 947 return (NULL); 948 949 return (ipsec_common_ctlinput(rdomain, cmd, sa, v, IPPROTO_ESP)); 950 } 951 952 #ifdef INET6 953 /* IPv6 AH wrapper. */ 954 int 955 ah6_input(struct mbuf **mp, int *offp, int proto) 956 { 957 int l = 0; 958 int protoff, nxt; 959 struct ip6_ext ip6e; 960 961 if (*offp < sizeof(struct ip6_hdr)) { 962 DPRINTF(("ah6_input(): bad offset\n")); 963 ahstat.ahs_hdrops++; 964 m_freem(*mp); 965 *mp = NULL; 966 return IPPROTO_DONE; 967 } else if (*offp == sizeof(struct ip6_hdr)) { 968 protoff = offsetof(struct ip6_hdr, ip6_nxt); 969 } else { 970 /* Chase down the header chain... */ 971 protoff = sizeof(struct ip6_hdr); 972 nxt = (mtod(*mp, struct ip6_hdr *))->ip6_nxt; 973 974 do { 975 protoff += l; 976 m_copydata(*mp, protoff, sizeof(ip6e), 977 (caddr_t) &ip6e); 978 979 if (nxt == IPPROTO_AH) 980 l = (ip6e.ip6e_len + 2) << 2; 981 else 982 l = (ip6e.ip6e_len + 1) << 3; 983 #ifdef DIAGNOSTIC 984 if (l <= 0) 985 panic("ah6_input: l went zero or negative"); 986 #endif 987 988 nxt = ip6e.ip6e_nxt; 989 } while (protoff + l < *offp); 990 991 /* Malformed packet check */ 992 if (protoff + l != *offp) { 993 DPRINTF(("ah6_input(): bad packet header chain\n")); 994 ahstat.ahs_hdrops++; 995 m_freem(*mp); 996 *mp = NULL; 997 return IPPROTO_DONE; 998 } 999 protoff += offsetof(struct ip6_ext, ip6e_nxt); 1000 } 1001 ipsec_common_input(*mp, *offp, protoff, AF_INET6, proto, 0); 1002 return IPPROTO_DONE; 1003 } 1004 1005 /* IPv6 AH callback. */ 1006 int 1007 ah6_input_cb(struct mbuf *m, int off, int protoff) 1008 { 1009 int nxt; 1010 u_int8_t nxt8; 1011 int nest = 0; 1012 1013 /* Retrieve new protocol */ 1014 m_copydata(m, protoff, sizeof(u_int8_t), (caddr_t) &nxt8); 1015 nxt = nxt8; 1016 1017 /* 1018 * see the end of ip6_input for this logic. 1019 * IPPROTO_IPV[46] case will be processed just like other ones 1020 */ 1021 while (nxt != IPPROTO_DONE) { 1022 if (ip6_hdrnestlimit && (++nest > ip6_hdrnestlimit)) { 1023 ip6stat.ip6s_toomanyhdr++; 1024 goto bad; 1025 } 1026 1027 /* 1028 * Protection against faulty packet - there should be 1029 * more sanity checks in header chain processing. 1030 */ 1031 if (m->m_pkthdr.len < off) { 1032 ip6stat.ip6s_tooshort++; 1033 goto bad; 1034 } 1035 nxt = (*inet6sw[ip6_protox[nxt]].pr_input)(&m, &off, nxt); 1036 } 1037 return 0; 1038 1039 bad: 1040 m_freem(m); 1041 return EINVAL; 1042 } 1043 1044 /* IPv6 ESP wrapper. */ 1045 int 1046 esp6_input(struct mbuf **mp, int *offp, int proto) 1047 { 1048 int l = 0; 1049 int protoff, nxt; 1050 struct ip6_ext ip6e; 1051 1052 if (*offp < sizeof(struct ip6_hdr)) { 1053 DPRINTF(("esp6_input(): bad offset\n")); 1054 espstat.esps_hdrops++; 1055 m_freem(*mp); 1056 *mp = NULL; 1057 return IPPROTO_DONE; 1058 } else if (*offp == sizeof(struct ip6_hdr)) { 1059 protoff = offsetof(struct ip6_hdr, ip6_nxt); 1060 } else { 1061 /* Chase down the header chain... */ 1062 protoff = sizeof(struct ip6_hdr); 1063 nxt = (mtod(*mp, struct ip6_hdr *))->ip6_nxt; 1064 1065 do { 1066 protoff += l; 1067 m_copydata(*mp, protoff, sizeof(ip6e), 1068 (caddr_t) &ip6e); 1069 1070 if (nxt == IPPROTO_AH) 1071 l = (ip6e.ip6e_len + 2) << 2; 1072 else 1073 l = (ip6e.ip6e_len + 1) << 3; 1074 #ifdef DIAGNOSTIC 1075 if (l <= 0) 1076 panic("esp6_input: l went zero or negative"); 1077 #endif 1078 1079 nxt = ip6e.ip6e_nxt; 1080 } while (protoff + l < *offp); 1081 1082 /* Malformed packet check */ 1083 if (protoff + l != *offp) { 1084 DPRINTF(("esp6_input(): bad packet header chain\n")); 1085 espstat.esps_hdrops++; 1086 m_freem(*mp); 1087 *mp = NULL; 1088 return IPPROTO_DONE; 1089 } 1090 protoff += offsetof(struct ip6_ext, ip6e_nxt); 1091 } 1092 ipsec_common_input(*mp, *offp, protoff, AF_INET6, proto, 0); 1093 return IPPROTO_DONE; 1094 1095 } 1096 1097 /* IPv6 ESP callback */ 1098 int 1099 esp6_input_cb(struct mbuf *m, int skip, int protoff) 1100 { 1101 return ah6_input_cb(m, skip, protoff); 1102 } 1103 1104 /* IPv6 IPcomp wrapper */ 1105 int 1106 ipcomp6_input(struct mbuf **mp, int *offp, int proto) 1107 { 1108 int l = 0; 1109 int protoff, nxt; 1110 struct ip6_ext ip6e; 1111 1112 if (*offp < sizeof(struct ip6_hdr)) { 1113 DPRINTF(("ipcomp6_input(): bad offset\n")); 1114 ipcompstat.ipcomps_hdrops++; 1115 m_freem(*mp); 1116 *mp = NULL; 1117 return IPPROTO_DONE; 1118 } else if (*offp == sizeof(struct ip6_hdr)) { 1119 protoff = offsetof(struct ip6_hdr, ip6_nxt); 1120 } else { 1121 /* Chase down the header chain... */ 1122 protoff = sizeof(struct ip6_hdr); 1123 nxt = (mtod(*mp, struct ip6_hdr *))->ip6_nxt; 1124 1125 do { 1126 protoff += l; 1127 m_copydata(*mp, protoff, sizeof(ip6e), 1128 (caddr_t) &ip6e); 1129 if (nxt == IPPROTO_AH) 1130 l = (ip6e.ip6e_len + 2) << 2; 1131 else 1132 l = (ip6e.ip6e_len + 1) << 3; 1133 #ifdef DIAGNOSTIC 1134 if (l <= 0) 1135 panic("ipcomp6_input: l went zero or negative"); 1136 #endif 1137 1138 nxt = ip6e.ip6e_nxt; 1139 } while (protoff + l < *offp); 1140 1141 /* Malformed packet check */ 1142 if (protoff + l != *offp) { 1143 DPRINTF(("ipcomp6_input(): bad packet header chain\n")); 1144 ipcompstat.ipcomps_hdrops++; 1145 m_freem(*mp); 1146 *mp = NULL; 1147 return IPPROTO_DONE; 1148 } 1149 1150 protoff += offsetof(struct ip6_ext, ip6e_nxt); 1151 } 1152 ipsec_common_input(*mp, *offp, protoff, AF_INET6, proto, 0); 1153 return IPPROTO_DONE; 1154 } 1155 1156 /* IPv6 IPcomp callback */ 1157 int 1158 ipcomp6_input_cb(struct mbuf *m, int skip, int protoff) 1159 { 1160 return ah6_input_cb(m, skip, protoff); 1161 } 1162 1163 #endif /* INET6 */ 1164