1 /* $OpenBSD: ipsec_input.c,v 1.131 2015/05/13 10:42:46 jsg Exp $ */ 2 /* 3 * The authors of this code are John Ioannidis (ji@tla.org), 4 * Angelos D. Keromytis (kermit@csd.uch.gr) and 5 * Niels Provos (provos@physnet.uni-hamburg.de). 6 * 7 * This code was written by John Ioannidis for BSD/OS in Athens, Greece, 8 * in November 1995. 9 * 10 * Ported to OpenBSD and NetBSD, with additional transforms, in December 1996, 11 * by Angelos D. Keromytis. 12 * 13 * Additional transforms and features in 1997 and 1998 by Angelos D. Keromytis 14 * and Niels Provos. 15 * 16 * Additional features in 1999 by Angelos D. Keromytis. 17 * 18 * Copyright (C) 1995, 1996, 1997, 1998, 1999 by John Ioannidis, 19 * Angelos D. Keromytis and Niels Provos. 20 * Copyright (c) 2001, Angelos D. Keromytis. 21 * 22 * Permission to use, copy, and modify this software with or without fee 23 * is hereby granted, provided that this entire notice is included in 24 * all copies of any software which is or includes a copy or 25 * modification of this software. 26 * You may use this code under the GNU public license if you so wish. Please 27 * contribute changes back to the authors under this freer than GPL license 28 * so that we may further the use of strong encryption without limitations to 29 * all. 30 * 31 * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR 32 * IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY 33 * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE 34 * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR 35 * PURPOSE. 36 */ 37 38 #include "pf.h" 39 40 #include <sys/param.h> 41 #include <sys/systm.h> 42 #include <sys/protosw.h> 43 #include <sys/mbuf.h> 44 #include <sys/socket.h> 45 #include <sys/sysctl.h> 46 #include <sys/kernel.h> 47 #include <sys/timeout.h> 48 49 #include <net/if.h> 50 #include <net/if_var.h> 51 #include <net/netisr.h> 52 #include <net/bpf.h> 53 #include <net/route.h> 54 55 #include <netinet/in.h> 56 #include <netinet/ip.h> 57 #include <netinet/ip_var.h> 58 #include <netinet/ip_icmp.h> 59 #include <netinet/tcp.h> 60 #include <netinet/udp.h> 61 62 #if NPF > 0 63 #include <net/pfvar.h> 64 #endif 65 66 #ifdef INET6 67 #include <netinet6/in6_var.h> 68 #include <netinet/ip6.h> 69 #include <netinet6/ip6_var.h> 70 #include <netinet6/ip6protosw.h> 71 #endif /* INET6 */ 72 73 #include <netinet/ip_ipsp.h> 74 #include <netinet/ip_esp.h> 75 #include <netinet/ip_ah.h> 76 #include <netinet/ip_ipcomp.h> 77 78 #include <net/if_enc.h> 79 80 #include "bpfilter.h" 81 82 void *ipsec_common_ctlinput(u_int, int, struct sockaddr *, void *, int); 83 int ah4_input_cb(struct mbuf *, ...); 84 int esp4_input_cb(struct mbuf *, ...); 85 int ipcomp4_input_cb(struct mbuf *, ...); 86 87 #ifdef INET6 88 int ah6_input_cb(struct mbuf *, int, int); 89 int esp6_input_cb(struct mbuf *, int, int); 90 int ipcomp6_input_cb(struct mbuf *, int, int); 91 #endif 92 93 #ifdef ENCDEBUG 94 #define DPRINTF(x) if (encdebug) printf x 95 #else 96 #define DPRINTF(x) 97 #endif 98 99 /* sysctl variables */ 100 int esp_enable = 1; 101 int ah_enable = 1; 102 int ipcomp_enable = 0; 103 104 int *espctl_vars[ESPCTL_MAXID] = ESPCTL_VARS; 105 int *ahctl_vars[AHCTL_MAXID] = AHCTL_VARS; 106 int *ipcompctl_vars[IPCOMPCTL_MAXID] = IPCOMPCTL_VARS; 107 108 /* 109 * ipsec_common_input() gets called when we receive an IPsec-protected packet 110 * in IPv4 or IPv6. All it does is find the right TDB and call the appropriate 111 * transform. The callback takes care of further processing (like ingress 112 * filtering). 113 */ 114 int 115 ipsec_common_input(struct mbuf *m, int skip, int protoff, int af, int sproto, 116 int udpencap) 117 { 118 #define IPSEC_ISTAT(x,y,z) (sproto == IPPROTO_ESP ? (x)++ : \ 119 sproto == IPPROTO_AH ? (y)++ : (z)++) 120 121 union sockaddr_union dst_address; 122 struct timeval tv; 123 struct tdb *tdbp; 124 struct ifnet *encif; 125 u_int32_t spi; 126 u_int16_t cpi; 127 int s, error; 128 #ifdef ENCDEBUG 129 char buf[INET6_ADDRSTRLEN]; 130 #endif 131 132 IPSEC_ISTAT(espstat.esps_input, ahstat.ahs_input, 133 ipcompstat.ipcomps_input); 134 135 if (m == NULL) { 136 DPRINTF(("ipsec_common_input(): NULL packet received\n")); 137 IPSEC_ISTAT(espstat.esps_hdrops, ahstat.ahs_hdrops, 138 ipcompstat.ipcomps_hdrops); 139 return EINVAL; 140 } 141 142 if ((sproto == IPPROTO_ESP && !esp_enable) || 143 (sproto == IPPROTO_AH && !ah_enable) || 144 #if NPF > 0 145 (m->m_pkthdr.pf.flags & PF_TAG_DIVERTED) || 146 #endif 147 (sproto == IPPROTO_IPCOMP && !ipcomp_enable)) { 148 switch (af) { 149 case AF_INET: 150 rip_input(m, skip, sproto); 151 break; 152 #ifdef INET6 153 case AF_INET6: 154 rip6_input(&m, &skip, sproto); 155 break; 156 #endif /* INET6 */ 157 default: 158 DPRINTF(("ipsec_common_input(): unsupported protocol " 159 "family %d\n", af)); 160 m_freem(m); 161 IPSEC_ISTAT(espstat.esps_nopf, ahstat.ahs_nopf, 162 ipcompstat.ipcomps_nopf); 163 return EPFNOSUPPORT; 164 } 165 return 0; 166 } 167 if ((sproto == IPPROTO_IPCOMP) && (m->m_flags & M_COMP)) { 168 m_freem(m); 169 ipcompstat.ipcomps_pdrops++; 170 DPRINTF(("ipsec_common_input(): repeated decompression\n")); 171 return EINVAL; 172 } 173 174 if (m->m_pkthdr.len - skip < 2 * sizeof(u_int32_t)) { 175 m_freem(m); 176 IPSEC_ISTAT(espstat.esps_hdrops, ahstat.ahs_hdrops, 177 ipcompstat.ipcomps_hdrops); 178 DPRINTF(("ipsec_common_input(): packet too small\n")); 179 return EINVAL; 180 } 181 182 /* Retrieve the SPI from the relevant IPsec header */ 183 if (sproto == IPPROTO_ESP) 184 m_copydata(m, skip, sizeof(u_int32_t), (caddr_t) &spi); 185 else if (sproto == IPPROTO_AH) 186 m_copydata(m, skip + sizeof(u_int32_t), sizeof(u_int32_t), 187 (caddr_t) &spi); 188 else if (sproto == IPPROTO_IPCOMP) { 189 m_copydata(m, skip + sizeof(u_int16_t), sizeof(u_int16_t), 190 (caddr_t) &cpi); 191 spi = ntohl(htons(cpi)); 192 } 193 194 /* 195 * Find tunnel control block and (indirectly) call the appropriate 196 * kernel crypto routine. The resulting mbuf chain is a valid 197 * IP packet ready to go through input processing. 198 */ 199 200 memset(&dst_address, 0, sizeof(dst_address)); 201 dst_address.sa.sa_family = af; 202 203 switch (af) { 204 case AF_INET: 205 dst_address.sin.sin_len = sizeof(struct sockaddr_in); 206 m_copydata(m, offsetof(struct ip, ip_dst), 207 sizeof(struct in_addr), 208 (caddr_t) &(dst_address.sin.sin_addr)); 209 break; 210 211 #ifdef INET6 212 case AF_INET6: 213 dst_address.sin6.sin6_len = sizeof(struct sockaddr_in6); 214 m_copydata(m, offsetof(struct ip6_hdr, ip6_dst), 215 sizeof(struct in6_addr), 216 (caddr_t) &(dst_address.sin6.sin6_addr)); 217 in6_recoverscope(&dst_address.sin6, &dst_address.sin6.sin6_addr, 218 NULL); 219 break; 220 #endif /* INET6 */ 221 222 default: 223 DPRINTF(("ipsec_common_input(): unsupported protocol " 224 "family %d\n", af)); 225 m_freem(m); 226 IPSEC_ISTAT(espstat.esps_nopf, ahstat.ahs_nopf, 227 ipcompstat.ipcomps_nopf); 228 return EPFNOSUPPORT; 229 } 230 231 s = splsoftnet(); 232 tdbp = gettdb(rtable_l2(m->m_pkthdr.ph_rtableid), 233 spi, &dst_address, sproto); 234 if (tdbp == NULL) { 235 splx(s); 236 DPRINTF(("ipsec_common_input(): could not find SA for " 237 "packet to %s, spi %08x\n", 238 ipsp_address(&dst_address, buf, sizeof(buf)), ntohl(spi))); 239 m_freem(m); 240 IPSEC_ISTAT(espstat.esps_notdb, ahstat.ahs_notdb, 241 ipcompstat.ipcomps_notdb); 242 return ENOENT; 243 } 244 245 if (tdbp->tdb_flags & TDBF_INVALID) { 246 splx(s); 247 DPRINTF(("ipsec_common_input(): attempted to use invalid " 248 "SA %s/%08x/%u\n", ipsp_address(&dst_address, buf, 249 sizeof(buf)), ntohl(spi), tdbp->tdb_sproto)); 250 m_freem(m); 251 IPSEC_ISTAT(espstat.esps_invalid, ahstat.ahs_invalid, 252 ipcompstat.ipcomps_invalid); 253 return EINVAL; 254 } 255 256 if (udpencap && !(tdbp->tdb_flags & TDBF_UDPENCAP)) { 257 splx(s); 258 DPRINTF(("ipsec_common_input(): attempted to use non-udpencap " 259 "SA %s/%08x/%u\n", ipsp_address(&dst_address, buf, 260 sizeof(buf)), ntohl(spi), tdbp->tdb_sproto)); 261 m_freem(m); 262 espstat.esps_udpinval++; 263 return EINVAL; 264 } 265 266 if (tdbp->tdb_xform == NULL) { 267 splx(s); 268 DPRINTF(("ipsec_common_input(): attempted to use uninitialized " 269 "SA %s/%08x/%u\n", ipsp_address(&dst_address, buf, 270 sizeof(buf)), ntohl(spi), tdbp->tdb_sproto)); 271 m_freem(m); 272 IPSEC_ISTAT(espstat.esps_noxform, ahstat.ahs_noxform, 273 ipcompstat.ipcomps_noxform); 274 return ENXIO; 275 } 276 277 if (sproto != IPPROTO_IPCOMP) { 278 if ((encif = enc_getif(tdbp->tdb_rdomain, 279 tdbp->tdb_tap)) == NULL) { 280 splx(s); 281 DPRINTF(("ipsec_common_input(): " 282 "no enc%u interface for SA %s/%08x/%u\n", 283 tdbp->tdb_tap, ipsp_address(&dst_address, buf, 284 sizeof(buf)), ntohl(spi), tdbp->tdb_sproto)); 285 m_freem(m); 286 287 IPSEC_ISTAT(espstat.esps_pdrops, 288 ahstat.ahs_pdrops, 289 ipcompstat.ipcomps_pdrops); 290 return EACCES; 291 } 292 293 /* XXX This conflicts with the scoped nature of IPv6 */ 294 m->m_pkthdr.rcvif = encif; 295 } 296 297 /* Register first use, setup expiration timer. */ 298 if (tdbp->tdb_first_use == 0) { 299 tdbp->tdb_first_use = time_second; 300 301 tv.tv_usec = 0; 302 303 tv.tv_sec = tdbp->tdb_exp_first_use + tdbp->tdb_first_use; 304 if (tdbp->tdb_flags & TDBF_FIRSTUSE) 305 timeout_add(&tdbp->tdb_first_tmo, hzto(&tv)); 306 307 tv.tv_sec = tdbp->tdb_first_use + tdbp->tdb_soft_first_use; 308 if (tdbp->tdb_flags & TDBF_SOFT_FIRSTUSE) 309 timeout_add(&tdbp->tdb_sfirst_tmo, hzto(&tv)); 310 } 311 312 /* 313 * Call appropriate transform and return -- callback takes care of 314 * everything else. 315 */ 316 error = (*(tdbp->tdb_xform->xf_input))(m, tdbp, skip, protoff); 317 splx(s); 318 return error; 319 } 320 321 /* 322 * IPsec input callback, called by the transform callback. Takes care of 323 * filtering and other sanity checks on the processed packet. 324 */ 325 int 326 ipsec_common_input_cb(struct mbuf *m, struct tdb *tdbp, int skip, int protoff) 327 { 328 int af, sproto; 329 u_char prot; 330 331 #if NBPFILTER > 0 332 struct ifnet *encif; 333 #endif 334 335 struct ip *ip, ipn; 336 337 #ifdef INET6 338 struct ip6_hdr *ip6, ip6n; 339 #endif /* INET6 */ 340 struct m_tag *mtag; 341 struct tdb_ident *tdbi; 342 343 #ifdef ENCDEBUG 344 char buf[INET6_ADDRSTRLEN]; 345 #endif 346 347 af = tdbp->tdb_dst.sa.sa_family; 348 sproto = tdbp->tdb_sproto; 349 350 tdbp->tdb_last_used = time_second; 351 352 /* Sanity check */ 353 if (m == NULL) { 354 /* The called routine will print a message if necessary */ 355 IPSEC_ISTAT(espstat.esps_badkcr, ahstat.ahs_badkcr, 356 ipcompstat.ipcomps_badkcr); 357 return EINVAL; 358 } 359 360 /* Fix IPv4 header */ 361 if (af == AF_INET) { 362 if ((m->m_len < skip) && ((m = m_pullup(m, skip)) == NULL)) { 363 DPRINTF(("ipsec_common_input_cb(): processing failed " 364 "for SA %s/%08x\n", ipsp_address(&tdbp->tdb_dst, 365 buf, sizeof(buf)), ntohl(tdbp->tdb_spi))); 366 IPSEC_ISTAT(espstat.esps_hdrops, ahstat.ahs_hdrops, 367 ipcompstat.ipcomps_hdrops); 368 return ENOBUFS; 369 } 370 371 ip = mtod(m, struct ip *); 372 ip->ip_len = htons(m->m_pkthdr.len); 373 ip->ip_sum = 0; 374 ip->ip_sum = in_cksum(m, ip->ip_hl << 2); 375 prot = ip->ip_p; 376 377 /* IP-in-IP encapsulation */ 378 if (prot == IPPROTO_IPIP) { 379 if (m->m_pkthdr.len - skip < sizeof(struct ip)) { 380 m_freem(m); 381 IPSEC_ISTAT(espstat.esps_hdrops, 382 ahstat.ahs_hdrops, 383 ipcompstat.ipcomps_hdrops); 384 return EINVAL; 385 } 386 /* ipn will now contain the inner IPv4 header */ 387 m_copydata(m, skip, sizeof(struct ip), 388 (caddr_t) &ipn); 389 } 390 391 #ifdef INET6 392 /* IPv6-in-IP encapsulation. */ 393 if (prot == IPPROTO_IPV6) { 394 if (m->m_pkthdr.len - skip < sizeof(struct ip6_hdr)) { 395 m_freem(m); 396 IPSEC_ISTAT(espstat.esps_hdrops, 397 ahstat.ahs_hdrops, 398 ipcompstat.ipcomps_hdrops); 399 return EINVAL; 400 } 401 /* ip6n will now contain the inner IPv6 header. */ 402 m_copydata(m, skip, sizeof(struct ip6_hdr), 403 (caddr_t) &ip6n); 404 } 405 #endif /* INET6 */ 406 } 407 408 #ifdef INET6 409 /* Fix IPv6 header */ 410 if (af == AF_INET6) 411 { 412 if (m->m_len < sizeof(struct ip6_hdr) && 413 (m = m_pullup(m, sizeof(struct ip6_hdr))) == NULL) { 414 415 DPRINTF(("ipsec_common_input_cb(): processing failed " 416 "for SA %s/%08x\n", ipsp_address(&tdbp->tdb_dst, 417 buf, sizeof(buf)), ntohl(tdbp->tdb_spi))); 418 419 IPSEC_ISTAT(espstat.esps_hdrops, ahstat.ahs_hdrops, 420 ipcompstat.ipcomps_hdrops); 421 return EACCES; 422 } 423 424 ip6 = mtod(m, struct ip6_hdr *); 425 ip6->ip6_plen = htons(m->m_pkthdr.len - skip); 426 427 /* Save protocol */ 428 m_copydata(m, protoff, 1, (caddr_t) &prot); 429 430 /* IP-in-IP encapsulation */ 431 if (prot == IPPROTO_IPIP) { 432 if (m->m_pkthdr.len - skip < sizeof(struct ip)) { 433 m_freem(m); 434 IPSEC_ISTAT(espstat.esps_hdrops, 435 ahstat.ahs_hdrops, 436 ipcompstat.ipcomps_hdrops); 437 return EINVAL; 438 } 439 /* ipn will now contain the inner IPv4 header */ 440 m_copydata(m, skip, sizeof(struct ip), (caddr_t) &ipn); 441 } 442 443 /* IPv6-in-IP encapsulation */ 444 if (prot == IPPROTO_IPV6) { 445 if (m->m_pkthdr.len - skip < sizeof(struct ip6_hdr)) { 446 m_freem(m); 447 IPSEC_ISTAT(espstat.esps_hdrops, 448 ahstat.ahs_hdrops, 449 ipcompstat.ipcomps_hdrops); 450 return EINVAL; 451 } 452 /* ip6n will now contain the inner IPv6 header. */ 453 m_copydata(m, skip, sizeof(struct ip6_hdr), 454 (caddr_t) &ip6n); 455 } 456 } 457 #endif /* INET6 */ 458 459 /* 460 * Fix TCP/UDP checksum of UDP encapsulated transport mode ESP packet. 461 * (RFC3948 3.1.2) 462 */ 463 if ((af == AF_INET || af == AF_INET6) && 464 (tdbp->tdb_flags & TDBF_UDPENCAP) && 465 (tdbp->tdb_flags & TDBF_TUNNELING) == 0) { 466 u_int16_t cksum; 467 468 switch (prot) { 469 case IPPROTO_UDP: 470 if (m->m_pkthdr.len < skip + sizeof(struct udphdr)) { 471 m_freem(m); 472 IPSEC_ISTAT(espstat.esps_hdrops, 473 ahstat.ahs_hdrops, 474 ipcompstat.ipcomps_hdrops); 475 return EINVAL; 476 } 477 cksum = 0; 478 m_copyback(m, skip + offsetof(struct udphdr, uh_sum), 479 sizeof(cksum), &cksum, M_NOWAIT); 480 #ifdef INET6 481 if (af == AF_INET6) { 482 cksum = in6_cksum(m, IPPROTO_UDP, skip, 483 m->m_pkthdr.len - skip); 484 m_copyback(m, skip + offsetof(struct udphdr, 485 uh_sum), sizeof(cksum), &cksum, M_NOWAIT); 486 } 487 #endif 488 break; 489 case IPPROTO_TCP: 490 if (m->m_pkthdr.len < skip + sizeof(struct tcphdr)) { 491 m_freem(m); 492 IPSEC_ISTAT(espstat.esps_hdrops, 493 ahstat.ahs_hdrops, 494 ipcompstat.ipcomps_hdrops); 495 return EINVAL; 496 } 497 cksum = 0; 498 m_copyback(m, skip + offsetof(struct tcphdr, th_sum), 499 sizeof(cksum), &cksum, M_NOWAIT); 500 if (af == AF_INET) 501 cksum = in4_cksum(m, IPPROTO_TCP, skip, 502 m->m_pkthdr.len - skip); 503 #ifdef INET6 504 else if (af == AF_INET6) 505 cksum = in6_cksum(m, IPPROTO_TCP, skip, 506 m->m_pkthdr.len - skip); 507 #endif 508 m_copyback(m, skip + offsetof(struct tcphdr, th_sum), 509 sizeof(cksum), &cksum, M_NOWAIT); 510 break; 511 } 512 } 513 514 /* 515 * Record what we've done to the packet (under what SA it was 516 * processed). 517 */ 518 if (tdbp->tdb_sproto != IPPROTO_IPCOMP) { 519 mtag = m_tag_get(PACKET_TAG_IPSEC_IN_DONE, 520 sizeof(struct tdb_ident), M_NOWAIT); 521 if (mtag == NULL) { 522 m_freem(m); 523 DPRINTF(("ipsec_common_input_cb(): failed to " 524 "get tag\n")); 525 IPSEC_ISTAT(espstat.esps_hdrops, ahstat.ahs_hdrops, 526 ipcompstat.ipcomps_hdrops); 527 return ENOMEM; 528 } 529 530 tdbi = (struct tdb_ident *)(mtag + 1); 531 bcopy(&tdbp->tdb_dst, &tdbi->dst, 532 sizeof(union sockaddr_union)); 533 tdbi->proto = tdbp->tdb_sproto; 534 tdbi->spi = tdbp->tdb_spi; 535 tdbi->rdomain = tdbp->tdb_rdomain; 536 537 m_tag_prepend(m, mtag); 538 } 539 540 if (sproto == IPPROTO_ESP) { 541 /* Packet is confidential ? */ 542 if (tdbp->tdb_encalgxform) 543 m->m_flags |= M_CONF; 544 545 /* Check if we had authenticated ESP. */ 546 if (tdbp->tdb_authalgxform) 547 m->m_flags |= M_AUTH; 548 } else if (sproto == IPPROTO_AH) { 549 m->m_flags |= M_AUTH; 550 } else if (sproto == IPPROTO_IPCOMP) { 551 m->m_flags |= M_COMP; 552 } 553 554 #if NPF > 0 555 /* Add pf tag if requested. */ 556 pf_tag_packet(m, tdbp->tdb_tag, -1); 557 pf_pkt_addr_changed(m); 558 #endif 559 560 if (tdbp->tdb_flags & TDBF_TUNNELING) 561 m->m_flags |= M_TUNNEL; 562 563 #if NBPFILTER > 0 564 if ((encif = enc_getif(tdbp->tdb_rdomain, tdbp->tdb_tap)) != NULL) { 565 encif->if_ipackets++; 566 encif->if_ibytes += m->m_pkthdr.len; 567 568 if (encif->if_bpf) { 569 struct enchdr hdr; 570 571 hdr.af = af; 572 hdr.spi = tdbp->tdb_spi; 573 hdr.flags = m->m_flags & (M_AUTH|M_CONF); 574 575 bpf_mtap_hdr(encif->if_bpf, (char *)&hdr, 576 ENC_HDRLEN, m, BPF_DIRECTION_IN, NULL); 577 } 578 } 579 #endif 580 581 /* Call the appropriate IPsec transform callback. */ 582 switch (af) { 583 case AF_INET: 584 switch (sproto) 585 { 586 case IPPROTO_ESP: 587 return esp4_input_cb(m); 588 589 case IPPROTO_AH: 590 return ah4_input_cb(m); 591 592 case IPPROTO_IPCOMP: 593 return ipcomp4_input_cb(m); 594 595 default: 596 DPRINTF(("ipsec_common_input_cb(): unknown/unsupported" 597 " security protocol %d\n", sproto)); 598 m_freem(m); 599 return EPFNOSUPPORT; 600 } 601 break; 602 603 #ifdef INET6 604 case AF_INET6: 605 switch (sproto) { 606 case IPPROTO_ESP: 607 return esp6_input_cb(m, skip, protoff); 608 609 case IPPROTO_AH: 610 return ah6_input_cb(m, skip, protoff); 611 612 case IPPROTO_IPCOMP: 613 return ipcomp6_input_cb(m, skip, protoff); 614 615 default: 616 DPRINTF(("ipsec_common_input_cb(): unknown/unsupported" 617 " security protocol %d\n", sproto)); 618 m_freem(m); 619 return EPFNOSUPPORT; 620 } 621 break; 622 #endif /* INET6 */ 623 624 default: 625 DPRINTF(("ipsec_common_input_cb(): unknown/unsupported " 626 "protocol family %d\n", af)); 627 m_freem(m); 628 return EPFNOSUPPORT; 629 } 630 #undef IPSEC_ISTAT 631 } 632 633 int 634 esp_sysctl(int *name, u_int namelen, void *oldp, size_t *oldlenp, void *newp, 635 size_t newlen) 636 { 637 /* All sysctl names at this level are terminal. */ 638 if (namelen != 1) 639 return (ENOTDIR); 640 641 switch (name[0]) { 642 case ESPCTL_STATS: 643 if (newp != NULL) 644 return (EPERM); 645 return (sysctl_struct(oldp, oldlenp, newp, newlen, 646 &espstat, sizeof(espstat))); 647 default: 648 if (name[0] < ESPCTL_MAXID) 649 return (sysctl_int_arr(espctl_vars, name, namelen, 650 oldp, oldlenp, newp, newlen)); 651 return (ENOPROTOOPT); 652 } 653 } 654 655 int 656 ah_sysctl(int *name, u_int namelen, void *oldp, size_t *oldlenp, void *newp, 657 size_t newlen) 658 { 659 /* All sysctl names at this level are terminal. */ 660 if (namelen != 1) 661 return (ENOTDIR); 662 663 switch (name[0]) { 664 case AHCTL_STATS: 665 if (newp != NULL) 666 return (EPERM); 667 return (sysctl_struct(oldp, oldlenp, newp, newlen, 668 &ahstat, sizeof(ahstat))); 669 default: 670 if (name[0] < AHCTL_MAXID) 671 return (sysctl_int_arr(ahctl_vars, name, namelen, 672 oldp, oldlenp, newp, newlen)); 673 return (ENOPROTOOPT); 674 } 675 } 676 677 int 678 ipcomp_sysctl(int *name, u_int namelen, void *oldp, size_t *oldlenp, void *newp, 679 size_t newlen) 680 { 681 /* All sysctl names at this level are terminal. */ 682 if (namelen != 1) 683 return (ENOTDIR); 684 685 switch (name[0]) { 686 case IPCOMPCTL_STATS: 687 if (newp != NULL) 688 return (EPERM); 689 return (sysctl_struct(oldp, oldlenp, newp, newlen, 690 &ipcompstat, sizeof(ipcompstat))); 691 default: 692 if (name[0] < IPCOMPCTL_MAXID) 693 return (sysctl_int_arr(ipcompctl_vars, name, namelen, 694 oldp, oldlenp, newp, newlen)); 695 return (ENOPROTOOPT); 696 } 697 } 698 699 /* IPv4 AH wrapper. */ 700 void 701 ah4_input(struct mbuf *m, ...) 702 { 703 int skip; 704 705 va_list ap; 706 va_start(ap, m); 707 skip = va_arg(ap, int); 708 va_end(ap); 709 710 ipsec_common_input(m, skip, offsetof(struct ip, ip_p), AF_INET, 711 IPPROTO_AH, 0); 712 return; 713 } 714 715 /* IPv4 AH callback. */ 716 int 717 ah4_input_cb(struct mbuf *m, ...) 718 { 719 /* 720 * Interface pointer is already in first mbuf; chop off the 721 * `outer' header and reschedule. 722 */ 723 724 if (niq_enqueue(&ipintrq, m) != 0) { 725 ahstat.ahs_qfull++; 726 DPRINTF(("ah4_input_cb(): dropped packet because of full " 727 "IP queue\n")); 728 return ENOBUFS; 729 } 730 731 return 0; 732 } 733 734 735 /* XXX rdomain */ 736 void * 737 ah4_ctlinput(int cmd, struct sockaddr *sa, u_int rdomain, void *v) 738 { 739 if (sa->sa_family != AF_INET || 740 sa->sa_len != sizeof(struct sockaddr_in)) 741 return (NULL); 742 743 return (ipsec_common_ctlinput(rdomain, cmd, sa, v, IPPROTO_AH)); 744 } 745 746 /* IPv4 ESP wrapper. */ 747 void 748 esp4_input(struct mbuf *m, ...) 749 { 750 int skip; 751 752 va_list ap; 753 va_start(ap, m); 754 skip = va_arg(ap, int); 755 va_end(ap); 756 757 ipsec_common_input(m, skip, offsetof(struct ip, ip_p), AF_INET, 758 IPPROTO_ESP, 0); 759 } 760 761 /* IPv4 ESP callback. */ 762 int 763 esp4_input_cb(struct mbuf *m, ...) 764 { 765 /* 766 * Interface pointer is already in first mbuf; chop off the 767 * `outer' header and reschedule. 768 */ 769 if (niq_enqueue(&ipintrq, m) != 0) { 770 espstat.esps_qfull++; 771 DPRINTF(("esp4_input_cb(): dropped packet because of full " 772 "IP queue\n")); 773 return ENOBUFS; 774 } 775 776 return 0; 777 } 778 779 /* IPv4 IPCOMP wrapper */ 780 void 781 ipcomp4_input(struct mbuf *m, ...) 782 { 783 int skip; 784 va_list ap; 785 va_start(ap, m); 786 skip = va_arg(ap, int); 787 va_end(ap); 788 789 ipsec_common_input(m, skip, offsetof(struct ip, ip_p), AF_INET, 790 IPPROTO_IPCOMP, 0); 791 } 792 793 /* IPv4 IPCOMP callback */ 794 int 795 ipcomp4_input_cb(struct mbuf *m, ...) 796 { 797 /* 798 * Interface pointer is already in first mbuf; chop off the 799 * `outer' header and reschedule. 800 */ 801 if (niq_enqueue(&ipintrq, m) != 0) { 802 ipcompstat.ipcomps_qfull++; 803 DPRINTF(("ipcomp4_input_cb(): dropped packet because of full IP queue\n")); 804 return ENOBUFS; 805 } 806 807 return 0; 808 } 809 810 void * 811 ipsec_common_ctlinput(u_int rdomain, int cmd, struct sockaddr *sa, 812 void *v, int proto) 813 { 814 struct ip *ip = v; 815 int s; 816 817 if (cmd == PRC_MSGSIZE && ip && ip_mtudisc && ip->ip_v == 4) { 818 struct tdb *tdbp; 819 struct sockaddr_in dst; 820 struct icmp *icp; 821 int hlen = ip->ip_hl << 2; 822 u_int32_t spi, mtu; 823 ssize_t adjust; 824 825 /* Find the right MTU. */ 826 icp = (struct icmp *)((caddr_t) ip - 827 offsetof(struct icmp, icmp_ip)); 828 mtu = ntohs(icp->icmp_nextmtu); 829 830 /* 831 * Ignore the packet, if we do not receive a MTU 832 * or the MTU is too small to be acceptable. 833 */ 834 if (mtu < 296) 835 return (NULL); 836 837 memset(&dst, 0, sizeof(struct sockaddr_in)); 838 dst.sin_family = AF_INET; 839 dst.sin_len = sizeof(struct sockaddr_in); 840 dst.sin_addr.s_addr = ip->ip_dst.s_addr; 841 842 bcopy((caddr_t)ip + hlen, &spi, sizeof(u_int32_t)); 843 844 s = splsoftnet(); 845 tdbp = gettdb(rdomain, spi, (union sockaddr_union *)&dst, 846 proto); 847 if (tdbp == NULL || tdbp->tdb_flags & TDBF_INVALID) { 848 splx(s); 849 return (NULL); 850 } 851 852 /* Walk the chain backwards to the first tdb */ 853 for (; tdbp; tdbp = tdbp->tdb_inext) { 854 if (tdbp->tdb_flags & TDBF_INVALID || 855 (adjust = ipsec_hdrsz(tdbp)) == -1) { 856 splx(s); 857 return (NULL); 858 } 859 860 mtu -= adjust; 861 862 /* Store adjusted MTU in tdb */ 863 tdbp->tdb_mtu = mtu; 864 tdbp->tdb_mtutimeout = time_second + 865 ip_mtudisc_timeout; 866 DPRINTF(("ipsec_common_ctlinput: " 867 "spi %08x mtu %d adjust %ld\n", 868 ntohl(tdbp->tdb_spi), tdbp->tdb_mtu, 869 adjust)); 870 } 871 splx(s); 872 return (NULL); 873 } 874 return (NULL); 875 } 876 877 /* XXX rdomain */ 878 void * 879 udpencap_ctlinput(int cmd, struct sockaddr *sa, u_int rdomain, void *v) 880 { 881 struct ip *ip = v; 882 struct tdb *tdbp; 883 struct icmp *icp; 884 u_int32_t mtu; 885 ssize_t adjust; 886 struct sockaddr_in dst, src; 887 union sockaddr_union *su_dst, *su_src; 888 int s; 889 890 icp = (struct icmp *)((caddr_t) ip - offsetof(struct icmp, icmp_ip)); 891 mtu = ntohs(icp->icmp_nextmtu); 892 893 /* 894 * Ignore the packet, if we do not receive a MTU 895 * or the MTU is too small to be acceptable. 896 */ 897 if (mtu < 296) 898 return (NULL); 899 900 memset(&dst, 0, sizeof(dst)); 901 dst.sin_family = AF_INET; 902 dst.sin_len = sizeof(struct sockaddr_in); 903 dst.sin_addr.s_addr = ip->ip_dst.s_addr; 904 su_dst = (union sockaddr_union *)&dst; 905 memset(&src, 0, sizeof(src)); 906 src.sin_family = AF_INET; 907 src.sin_len = sizeof(struct sockaddr_in); 908 src.sin_addr.s_addr = ip->ip_src.s_addr; 909 su_src = (union sockaddr_union *)&src; 910 911 s = splsoftnet(); 912 tdbp = gettdbbysrcdst(rdomain, 0, su_src, su_dst, IPPROTO_ESP); 913 914 for (; tdbp != NULL; tdbp = tdbp->tdb_snext) { 915 if (tdbp->tdb_sproto == IPPROTO_ESP && 916 ((tdbp->tdb_flags & (TDBF_INVALID|TDBF_UDPENCAP)) == 917 TDBF_UDPENCAP) && 918 !memcmp(&tdbp->tdb_dst, &dst, SA_LEN(&su_dst->sa)) && 919 !memcmp(&tdbp->tdb_src, &src, SA_LEN(&su_src->sa))) { 920 if ((adjust = ipsec_hdrsz(tdbp)) != -1) { 921 /* Store adjusted MTU in tdb */ 922 tdbp->tdb_mtu = mtu - adjust; 923 tdbp->tdb_mtutimeout = time_second + 924 ip_mtudisc_timeout; 925 DPRINTF(("udpencap_ctlinput: " 926 "spi %08x mtu %d adjust %ld\n", 927 ntohl(tdbp->tdb_spi), tdbp->tdb_mtu, 928 adjust)); 929 } 930 } 931 } 932 splx(s); 933 return (NULL); 934 } 935 936 /* XXX rdomain */ 937 void * 938 esp4_ctlinput(int cmd, struct sockaddr *sa, u_int rdomain, void *v) 939 { 940 if (sa->sa_family != AF_INET || 941 sa->sa_len != sizeof(struct sockaddr_in)) 942 return (NULL); 943 944 return (ipsec_common_ctlinput(rdomain, cmd, sa, v, IPPROTO_ESP)); 945 } 946 947 #ifdef INET6 948 /* IPv6 AH wrapper. */ 949 int 950 ah6_input(struct mbuf **mp, int *offp, int proto) 951 { 952 int l = 0; 953 int protoff, nxt; 954 struct ip6_ext ip6e; 955 956 if (*offp < sizeof(struct ip6_hdr)) { 957 DPRINTF(("ah6_input(): bad offset\n")); 958 ahstat.ahs_hdrops++; 959 m_freem(*mp); 960 *mp = NULL; 961 return IPPROTO_DONE; 962 } else if (*offp == sizeof(struct ip6_hdr)) { 963 protoff = offsetof(struct ip6_hdr, ip6_nxt); 964 } else { 965 /* Chase down the header chain... */ 966 protoff = sizeof(struct ip6_hdr); 967 nxt = (mtod(*mp, struct ip6_hdr *))->ip6_nxt; 968 969 do { 970 protoff += l; 971 m_copydata(*mp, protoff, sizeof(ip6e), 972 (caddr_t) &ip6e); 973 974 if (nxt == IPPROTO_AH) 975 l = (ip6e.ip6e_len + 2) << 2; 976 else 977 l = (ip6e.ip6e_len + 1) << 3; 978 #ifdef DIAGNOSTIC 979 if (l <= 0) 980 panic("ah6_input: l went zero or negative"); 981 #endif 982 983 nxt = ip6e.ip6e_nxt; 984 } while (protoff + l < *offp); 985 986 /* Malformed packet check */ 987 if (protoff + l != *offp) { 988 DPRINTF(("ah6_input(): bad packet header chain\n")); 989 ahstat.ahs_hdrops++; 990 m_freem(*mp); 991 *mp = NULL; 992 return IPPROTO_DONE; 993 } 994 protoff += offsetof(struct ip6_ext, ip6e_nxt); 995 } 996 ipsec_common_input(*mp, *offp, protoff, AF_INET6, proto, 0); 997 return IPPROTO_DONE; 998 } 999 1000 /* IPv6 AH callback. */ 1001 int 1002 ah6_input_cb(struct mbuf *m, int off, int protoff) 1003 { 1004 int nxt; 1005 u_int8_t nxt8; 1006 int nest = 0; 1007 1008 /* Retrieve new protocol */ 1009 m_copydata(m, protoff, sizeof(u_int8_t), (caddr_t) &nxt8); 1010 nxt = nxt8; 1011 1012 /* 1013 * see the end of ip6_input for this logic. 1014 * IPPROTO_IPV[46] case will be processed just like other ones 1015 */ 1016 while (nxt != IPPROTO_DONE) { 1017 if (ip6_hdrnestlimit && (++nest > ip6_hdrnestlimit)) { 1018 ip6stat.ip6s_toomanyhdr++; 1019 goto bad; 1020 } 1021 1022 /* 1023 * Protection against faulty packet - there should be 1024 * more sanity checks in header chain processing. 1025 */ 1026 if (m->m_pkthdr.len < off) { 1027 ip6stat.ip6s_tooshort++; 1028 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_truncated); 1029 goto bad; 1030 } 1031 nxt = (*inet6sw[ip6_protox[nxt]].pr_input)(&m, &off, nxt); 1032 } 1033 return 0; 1034 1035 bad: 1036 m_freem(m); 1037 return EINVAL; 1038 } 1039 1040 /* IPv6 ESP wrapper. */ 1041 int 1042 esp6_input(struct mbuf **mp, int *offp, int proto) 1043 { 1044 int l = 0; 1045 int protoff, nxt; 1046 struct ip6_ext ip6e; 1047 1048 if (*offp < sizeof(struct ip6_hdr)) { 1049 DPRINTF(("esp6_input(): bad offset\n")); 1050 espstat.esps_hdrops++; 1051 m_freem(*mp); 1052 *mp = NULL; 1053 return IPPROTO_DONE; 1054 } else if (*offp == sizeof(struct ip6_hdr)) { 1055 protoff = offsetof(struct ip6_hdr, ip6_nxt); 1056 } else { 1057 /* Chase down the header chain... */ 1058 protoff = sizeof(struct ip6_hdr); 1059 nxt = (mtod(*mp, struct ip6_hdr *))->ip6_nxt; 1060 1061 do { 1062 protoff += l; 1063 m_copydata(*mp, protoff, sizeof(ip6e), 1064 (caddr_t) &ip6e); 1065 1066 if (nxt == IPPROTO_AH) 1067 l = (ip6e.ip6e_len + 2) << 2; 1068 else 1069 l = (ip6e.ip6e_len + 1) << 3; 1070 #ifdef DIAGNOSTIC 1071 if (l <= 0) 1072 panic("esp6_input: l went zero or negative"); 1073 #endif 1074 1075 nxt = ip6e.ip6e_nxt; 1076 } while (protoff + l < *offp); 1077 1078 /* Malformed packet check */ 1079 if (protoff + l != *offp) { 1080 DPRINTF(("esp6_input(): bad packet header chain\n")); 1081 espstat.esps_hdrops++; 1082 m_freem(*mp); 1083 *mp = NULL; 1084 return IPPROTO_DONE; 1085 } 1086 protoff += offsetof(struct ip6_ext, ip6e_nxt); 1087 } 1088 ipsec_common_input(*mp, *offp, protoff, AF_INET6, proto, 0); 1089 return IPPROTO_DONE; 1090 1091 } 1092 1093 /* IPv6 ESP callback */ 1094 int 1095 esp6_input_cb(struct mbuf *m, int skip, int protoff) 1096 { 1097 return ah6_input_cb(m, skip, protoff); 1098 } 1099 1100 /* IPv6 IPcomp wrapper */ 1101 int 1102 ipcomp6_input(struct mbuf **mp, int *offp, int proto) 1103 { 1104 int l = 0; 1105 int protoff, nxt; 1106 struct ip6_ext ip6e; 1107 1108 if (*offp < sizeof(struct ip6_hdr)) { 1109 DPRINTF(("ipcomp6_input(): bad offset\n")); 1110 ipcompstat.ipcomps_hdrops++; 1111 m_freem(*mp); 1112 *mp = NULL; 1113 return IPPROTO_DONE; 1114 } else if (*offp == sizeof(struct ip6_hdr)) { 1115 protoff = offsetof(struct ip6_hdr, ip6_nxt); 1116 } else { 1117 /* Chase down the header chain... */ 1118 protoff = sizeof(struct ip6_hdr); 1119 nxt = (mtod(*mp, struct ip6_hdr *))->ip6_nxt; 1120 1121 do { 1122 protoff += l; 1123 m_copydata(*mp, protoff, sizeof(ip6e), 1124 (caddr_t) &ip6e); 1125 if (nxt == IPPROTO_AH) 1126 l = (ip6e.ip6e_len + 2) << 2; 1127 else 1128 l = (ip6e.ip6e_len + 1) << 3; 1129 #ifdef DIAGNOSTIC 1130 if (l <= 0) 1131 panic("ipcomp6_input: l went zero or negative"); 1132 #endif 1133 1134 nxt = ip6e.ip6e_nxt; 1135 } while (protoff + l < *offp); 1136 1137 /* Malformed packet check */ 1138 if (protoff + l != *offp) { 1139 DPRINTF(("ipcomp6_input(): bad packet header chain\n")); 1140 ipcompstat.ipcomps_hdrops++; 1141 m_freem(*mp); 1142 *mp = NULL; 1143 return IPPROTO_DONE; 1144 } 1145 1146 protoff += offsetof(struct ip6_ext, ip6e_nxt); 1147 } 1148 ipsec_common_input(*mp, *offp, protoff, AF_INET6, proto, 0); 1149 return IPPROTO_DONE; 1150 } 1151 1152 /* IPv6 IPcomp callback */ 1153 int 1154 ipcomp6_input_cb(struct mbuf *m, int skip, int protoff) 1155 { 1156 return ah6_input_cb(m, skip, protoff); 1157 } 1158 1159 #endif /* INET6 */ 1160