1 /* $OpenBSD: ipsec_output.c,v 1.27 2003/07/09 22:03:16 itojun Exp $ */ 2 /* 3 * The author of this code is Angelos D. Keromytis (angelos@cis.upenn.edu) 4 * 5 * Copyright (c) 2000-2001 Angelos D. Keromytis. 6 * 7 * Permission to use, copy, and modify this software with or without fee 8 * is hereby granted, provided that this entire notice is included in 9 * all copies of any software which is or includes a copy or 10 * modification of this software. 11 * You may use this code under the GNU public license if you so wish. Please 12 * contribute changes back to the authors under this freer than GPL license 13 * so that we may further the use of strong encryption without limitations to 14 * all. 15 * 16 * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR 17 * IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY 18 * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE 19 * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR 20 * PURPOSE. 21 */ 22 23 #include <sys/param.h> 24 #include <sys/systm.h> 25 #include <sys/mbuf.h> 26 #include <sys/socket.h> 27 #include <sys/kernel.h> 28 29 #include <net/if.h> 30 #include <net/route.h> 31 32 #ifdef INET 33 #include <netinet/in.h> 34 #include <netinet/in_systm.h> 35 #include <netinet/ip.h> 36 #include <netinet/in_pcb.h> 37 #include <netinet/ip_var.h> 38 #endif /* INET */ 39 40 #ifdef INET6 41 #ifndef INET 42 #include <netinet/in.h> 43 #endif 44 #include <netinet6/in6_var.h> 45 #endif /* INET6 */ 46 47 #include <netinet/ip_ipsp.h> 48 #include <netinet/ip_ah.h> 49 #include <netinet/ip_esp.h> 50 #include <netinet/ip_ipcomp.h> 51 #include <crypto/xform.h> 52 53 #ifdef ENCDEBUG 54 #define DPRINTF(x) if (encdebug) printf x 55 #else 56 #define DPRINTF(x) 57 #endif 58 59 /* 60 * Loop over a tdb chain, taking into consideration protocol tunneling. The 61 * fourth argument is set if the first encapsulation header is already in 62 * place. 63 */ 64 int 65 ipsp_process_packet(struct mbuf *m, struct tdb *tdb, int af, int tunalready) 66 { 67 struct timeval tv; 68 int i, off, error; 69 struct mbuf *mp; 70 71 #ifdef INET 72 int setdf = 0; 73 struct ip *ip; 74 #endif /* INET */ 75 #ifdef INET6 76 struct ip6_hdr *ip6; 77 #endif /* INET6 */ 78 79 /* Check that the transform is allowed by the administrator. */ 80 if ((tdb->tdb_sproto == IPPROTO_ESP && !esp_enable) || 81 (tdb->tdb_sproto == IPPROTO_AH && !ah_enable) || 82 (tdb->tdb_sproto == IPPROTO_IPCOMP && !ipcomp_enable)) { 83 DPRINTF(("ipsp_process_packet(): IPsec outbound packet " 84 "dropped due to policy (check your sysctls)\n")); 85 m_freem(m); 86 return EHOSTUNREACH; 87 } 88 89 /* Sanity check. */ 90 if (!tdb->tdb_xform) { 91 DPRINTF(("ipsp_process_packet(): uninitialized TDB\n")); 92 m_freem(m); 93 return EHOSTUNREACH; 94 } 95 96 /* Check if the SPI is invalid. */ 97 if (tdb->tdb_flags & TDBF_INVALID) { 98 DPRINTF(("ipsp_process_packet(): attempt to use invalid " 99 "SA %s/%08x/%u\n", ipsp_address(tdb->tdb_dst), 100 ntohl(tdb->tdb_spi), tdb->tdb_sproto)); 101 m_freem(m); 102 return ENXIO; 103 } 104 105 /* Check that the network protocol is supported */ 106 switch (tdb->tdb_dst.sa.sa_family) { 107 #ifdef INET 108 case AF_INET: 109 break; 110 #endif /* INET */ 111 112 #ifdef INET6 113 case AF_INET6: 114 break; 115 #endif /* INET6 */ 116 117 default: 118 DPRINTF(("ipsp_process_packet(): attempt to use " 119 "SA %s/%08x/%u for protocol family %d\n", 120 ipsp_address(tdb->tdb_dst), ntohl(tdb->tdb_spi), 121 tdb->tdb_sproto, tdb->tdb_dst.sa.sa_family)); 122 m_freem(m); 123 return ENXIO; 124 } 125 126 /* 127 * Register first use if applicable, setup relevant expiration timer. 128 */ 129 if (tdb->tdb_first_use == 0) { 130 int pri; 131 132 pri = splhigh(); 133 tdb->tdb_first_use = time.tv_sec; 134 splx(pri); 135 136 tv.tv_usec = 0; 137 138 tv.tv_sec = tdb->tdb_first_use + tdb->tdb_exp_first_use; 139 if (tdb->tdb_flags & TDBF_FIRSTUSE) 140 timeout_add(&tdb->tdb_first_tmo, 141 hzto(&tv)); 142 143 tv.tv_sec = tdb->tdb_first_use + tdb->tdb_soft_first_use; 144 if (tdb->tdb_flags & TDBF_SOFT_FIRSTUSE) 145 timeout_add(&tdb->tdb_sfirst_tmo, 146 hzto(&tv)); 147 } 148 149 /* 150 * Check for tunneling if we don't have the first header in place. 151 * When doing Ethernet-over-IP, we are handed an already-encapsulated 152 * frame, so we don't need to re-encapsulate. 153 */ 154 if (tunalready == 0) { 155 /* 156 * If the target protocol family is different, we know we'll be 157 * doing tunneling. 158 */ 159 if (af == tdb->tdb_dst.sa.sa_family) { 160 #ifdef INET 161 if (af == AF_INET) 162 i = sizeof(struct ip); 163 #endif /* INET */ 164 165 #ifdef INET6 166 if (af == AF_INET6) 167 i = sizeof(struct ip6_hdr); 168 #endif /* INET6 */ 169 170 /* Bring the network header in the first mbuf. */ 171 if (m->m_len < i) { 172 if ((m = m_pullup(m, i)) == NULL) 173 return ENOBUFS; 174 } 175 176 #ifdef INET 177 ip = mtod(m, struct ip *); 178 179 /* 180 * This is not a bridge packet, remember if we 181 * had IP_DF. 182 */ 183 setdf = ip->ip_off & htons(IP_DF); 184 #endif /* INET */ 185 186 #ifdef INET6 187 ip6 = mtod(m, struct ip6_hdr *); 188 #endif /* INET6 */ 189 } 190 191 /* Do the appropriate encapsulation, if necessary. */ 192 if ((tdb->tdb_dst.sa.sa_family != af) || /* PF mismatch */ 193 (tdb->tdb_flags & TDBF_TUNNELING) || /* Tunneling needed */ 194 (tdb->tdb_xform->xf_type == XF_IP4) || /* ditto */ 195 #ifdef INET 196 ((tdb->tdb_dst.sa.sa_family == AF_INET) && 197 (tdb->tdb_dst.sin.sin_addr.s_addr != INADDR_ANY) && 198 (tdb->tdb_dst.sin.sin_addr.s_addr != ip->ip_dst.s_addr)) || 199 #endif /* INET */ 200 #ifdef INET6 201 ((tdb->tdb_dst.sa.sa_family == AF_INET6) && 202 (!IN6_IS_ADDR_UNSPECIFIED(&tdb->tdb_dst.sin6.sin6_addr)) && 203 (!IN6_ARE_ADDR_EQUAL(&tdb->tdb_dst.sin6.sin6_addr, 204 &ip6->ip6_dst))) || 205 #endif /* INET6 */ 206 0) { 207 #ifdef INET 208 /* Fix IPv4 header checksum and length. */ 209 if (af == AF_INET) { 210 if (m->m_len < sizeof(struct ip)) 211 if ((m = m_pullup(m, 212 sizeof(struct ip))) == NULL) 213 return ENOBUFS; 214 215 ip = mtod(m, struct ip *); 216 ip->ip_len = htons(m->m_pkthdr.len); 217 ip->ip_sum = 0; 218 ip->ip_sum = in_cksum(m, ip->ip_hl << 2); 219 } 220 #endif /* INET */ 221 222 #ifdef INET6 223 /* Fix IPv6 header payload length. */ 224 if (af == AF_INET6) { 225 if (m->m_len < sizeof(struct ip6_hdr)) 226 if ((m = m_pullup(m, 227 sizeof(struct ip6_hdr))) == NULL) 228 return ENOBUFS; 229 230 if (m->m_pkthdr.len - sizeof(*ip6) > 231 IPV6_MAXPACKET) { 232 /* No jumbogram support. */ 233 m_freem(m); 234 return ENXIO; /*?*/ 235 } 236 ip6 = mtod(m, struct ip6_hdr *); 237 ip6->ip6_plen = htons(m->m_pkthdr.len 238 - sizeof(*ip6)); 239 } 240 #endif /* INET6 */ 241 242 /* Encapsulate -- the last two arguments are unused. */ 243 error = ipip_output(m, tdb, &mp, 0, 0); 244 if ((mp == NULL) && (!error)) 245 error = EFAULT; 246 if (error) { 247 if (mp) { 248 m_freem(mp); 249 mp = NULL; 250 } 251 return error; 252 } 253 254 m = mp; 255 mp = NULL; 256 257 #ifdef INET 258 if (tdb->tdb_dst.sa.sa_family == AF_INET && setdf) { 259 if (m->m_len < sizeof(struct ip)) 260 if ((m = m_pullup(m, 261 sizeof(struct ip))) == NULL) 262 return ENOBUFS; 263 264 ip = mtod(m, struct ip *); 265 ip->ip_off |= htons(IP_DF); 266 } 267 268 /* Remember that we appended a tunnel header. */ 269 tdb->tdb_flags |= TDBF_USEDTUNNEL; 270 #endif 271 } 272 273 /* We may be done with this TDB */ 274 if (tdb->tdb_xform->xf_type == XF_IP4) 275 return ipsp_process_done(m, tdb); 276 } else { 277 /* 278 * If this is just an IP-IP TDB and we're told there's 279 * already an encapsulation header, move on. 280 */ 281 if (tdb->tdb_xform->xf_type == XF_IP4) 282 return ipsp_process_done(m, tdb); 283 } 284 285 /* Extract some information off the headers. */ 286 switch (tdb->tdb_dst.sa.sa_family) { 287 #ifdef INET 288 case AF_INET: 289 ip = mtod(m, struct ip *); 290 i = ip->ip_hl << 2; 291 off = offsetof(struct ip, ip_p); 292 break; 293 #endif /* INET */ 294 295 #ifdef INET6 296 case AF_INET6: 297 ip6 = mtod(m, struct ip6_hdr *); 298 i = sizeof(struct ip6_hdr); 299 off = offsetof(struct ip6_hdr, ip6_nxt); 300 break; 301 #endif /* INET6 */ 302 } 303 304 /* Non expansion policy for IPCOMP */ 305 if (tdb->tdb_sproto == IPPROTO_IPCOMP) { 306 if ((m->m_pkthdr.len - i) < tdb->tdb_compalgxform->minlen) { 307 extern struct ipcompstat ipcompstat; 308 309 /* No need to compress, leave the packet untouched */ 310 ipcompstat.ipcomps_minlen++; 311 return ipsp_process_done(m, tdb); 312 } 313 } 314 315 /* Invoke the IPsec transform. */ 316 return (*(tdb->tdb_xform->xf_output))(m, tdb, NULL, i, off); 317 } 318 319 /* 320 * Called by the IPsec output transform callbacks, to transmit the packet 321 * or do further processing, as necessary. 322 */ 323 int 324 ipsp_process_done(struct mbuf *m, struct tdb *tdb) 325 { 326 #ifdef INET 327 struct ip *ip; 328 #endif /* INET */ 329 330 #ifdef INET6 331 struct ip6_hdr *ip6; 332 #endif /* INET6 */ 333 334 struct tdb_ident *tdbi; 335 struct m_tag *mtag; 336 337 tdb->tdb_last_used = time.tv_sec; 338 339 switch (tdb->tdb_dst.sa.sa_family) { 340 #ifdef INET 341 case AF_INET: 342 /* Fix the header length, for AH processing. */ 343 ip = mtod(m, struct ip *); 344 ip->ip_len = htons(m->m_pkthdr.len); 345 break; 346 #endif /* INET */ 347 348 #ifdef INET6 349 case AF_INET6: 350 /* Fix the header length, for AH processing. */ 351 if (m->m_pkthdr.len < sizeof(*ip6)) { 352 m_freem(m); 353 return ENXIO; 354 } 355 if (m->m_pkthdr.len - sizeof(*ip6) > IPV6_MAXPACKET) { 356 /* No jumbogram support. */ 357 m_freem(m); 358 return ENXIO; 359 } 360 ip6 = mtod(m, struct ip6_hdr *); 361 ip6->ip6_plen = htons(m->m_pkthdr.len - sizeof(*ip6)); 362 break; 363 #endif /* INET6 */ 364 365 default: 366 m_freem(m); 367 DPRINTF(("ipsp_process_done(): unknown protocol family (%d)\n", 368 tdb->tdb_dst.sa.sa_family)); 369 return ENXIO; 370 } 371 372 /* 373 * Add a record of what we've done or what needs to be done to the 374 * packet. 375 */ 376 if ((tdb->tdb_flags & TDBF_SKIPCRYPTO) == 0) 377 mtag = m_tag_get(PACKET_TAG_IPSEC_OUT_DONE, 378 sizeof(struct tdb_ident), 379 M_NOWAIT); 380 else 381 mtag = m_tag_get(PACKET_TAG_IPSEC_OUT_CRYPTO_NEEDED, 382 sizeof(struct tdb_ident), M_NOWAIT); 383 384 if (mtag == NULL) { 385 m_freem(m); 386 DPRINTF(("ipsp_process_done(): could not allocate packet " 387 "tag\n")); 388 return ENOMEM; 389 } 390 391 tdbi = (struct tdb_ident *)(mtag + 1); 392 bcopy(&tdb->tdb_dst, &tdbi->dst, sizeof(union sockaddr_union)); 393 tdbi->proto = tdb->tdb_sproto; 394 tdbi->spi = tdb->tdb_spi; 395 396 m_tag_prepend(m, mtag); 397 398 /* If there's another (bundled) TDB to apply, do so. */ 399 if (tdb->tdb_onext) 400 return ipsp_process_packet(m, tdb->tdb_onext, 401 tdb->tdb_dst.sa.sa_family, 0); 402 403 /* 404 * We're done with IPsec processing, transmit the packet using the 405 * appropriate network protocol (IP or IPv6). SPD lookup will be 406 * performed again there. 407 */ 408 switch (tdb->tdb_dst.sa.sa_family) { 409 #ifdef INET 410 case AF_INET: 411 return ip_output(m, (void *)NULL, (void *)NULL, IP_RAWOUTPUT, (void *)NULL, (void *)NULL); 412 #endif /* INET */ 413 414 #ifdef INET6 415 case AF_INET6: 416 /* 417 * We don't need massage, IPv6 header fields are always in 418 * net endian. 419 */ 420 return ip6_output(m, NULL, NULL, 0, NULL, NULL); 421 #endif /* INET6 */ 422 } 423 return EINVAL; /* Not reached. */ 424 } 425 426 ssize_t 427 ipsec_hdrsz(struct tdb *tdbp) 428 { 429 ssize_t adjust; 430 431 switch (tdbp->tdb_sproto) { 432 case IPPROTO_ESP: 433 if (tdbp->tdb_encalgxform == NULL) 434 return (-1); 435 436 /* Header length */ 437 if (tdbp->tdb_flags & TDBF_NOREPLAY) 438 adjust = sizeof(u_int32_t) + tdbp->tdb_ivlen; 439 else 440 adjust = 2 * sizeof(u_int32_t) + tdbp->tdb_ivlen; 441 /* Authenticator */ 442 if (tdbp->tdb_authalgxform != NULL) 443 adjust += AH_HMAC_HASHLEN; 444 /* Padding */ 445 adjust += tdbp->tdb_encalgxform->blocksize; 446 break; 447 448 case IPPROTO_AH: 449 if (tdbp->tdb_authalgxform == NULL) 450 return (-1); 451 452 if (!(tdbp->tdb_flags & TDBF_NOREPLAY)) 453 adjust = AH_FLENGTH + sizeof(u_int32_t); 454 else 455 adjust = AH_FLENGTH; 456 adjust += tdbp->tdb_authalgxform->authsize; 457 break; 458 459 default: 460 return (-1); 461 } 462 463 if (!(tdbp->tdb_flags & TDBF_TUNNELING) && 464 !(tdbp->tdb_flags & TDBF_USEDTUNNEL)) 465 return (adjust); 466 467 switch (tdbp->tdb_dst.sa.sa_family) { 468 #ifdef INET 469 case AF_INET: 470 adjust += sizeof(struct ip); 471 break; 472 #endif /* INET */ 473 #ifdef INET6 474 case AF_INET6: 475 adjust += sizeof(struct ip6_hdr); 476 break; 477 #endif /* INET6 */ 478 } 479 480 return (adjust); 481 } 482 483 void 484 ipsec_adjust_mtu(struct mbuf *m, u_int32_t mtu) 485 { 486 struct tdb_ident *tdbi; 487 struct tdb *tdbp; 488 struct m_tag *mtag; 489 ssize_t adjust; 490 int s; 491 492 s = spltdb(); 493 494 for (mtag = m_tag_find(m, PACKET_TAG_IPSEC_OUT_DONE, NULL); mtag; 495 mtag = m_tag_find(m, PACKET_TAG_IPSEC_OUT_DONE, mtag)) { 496 tdbi = (struct tdb_ident *)(mtag + 1); 497 tdbp = gettdb(tdbi->spi, &tdbi->dst, tdbi->proto); 498 if (tdbp == NULL) 499 break; 500 501 if ((adjust = ipsec_hdrsz(tdbp)) == -1) 502 break; 503 504 mtu -= adjust; 505 tdbp->tdb_mtu = mtu; 506 tdbp->tdb_mtutimeout = time.tv_sec + ip_mtudisc_timeout; 507 } 508 509 splx(s); 510 } 511