1 /*- 2 * SPDX-License-Identifier: BSD-3-Clause 3 * 4 * Copyright (c) 2003 Bruce M. Simpson <bms@spc.org> 5 * Copyright (c) 2016 Andrey V. Elsukov <ae@FreeBSD.org> 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 3. The name of the author may not be used to endorse or promote products 17 * derived from this software without specific prior written permission. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 20 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 21 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 22 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 23 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 24 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 25 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 26 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 27 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 28 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 29 */ 30 31 /* TCP MD5 Signature Option (RFC2385) */ 32 #include <sys/cdefs.h> 33 __FBSDID("$FreeBSD$"); 34 35 #include "opt_inet.h" 36 #include "opt_inet6.h" 37 #include "opt_ipsec.h" 38 39 #include <sys/param.h> 40 #include <sys/systm.h> 41 #include <sys/mbuf.h> 42 #include <sys/lock.h> 43 #include <sys/md5.h> 44 #include <sys/rmlock.h> 45 #include <sys/socket.h> 46 #include <sys/sockopt.h> 47 #include <sys/kernel.h> 48 #include <sys/module.h> 49 #include <sys/protosw.h> 50 51 #include <netinet/in.h> 52 #include <netinet/in_pcb.h> 53 #include <netinet/in_systm.h> 54 #include <netinet/ip.h> 55 #include <netinet/ip_var.h> 56 #include <netinet/tcp.h> 57 #include <netinet/tcp_var.h> 58 59 #include <net/vnet.h> 60 61 #include <netipsec/ipsec.h> 62 #include <netipsec/ipsec_support.h> 63 #include <netipsec/xform.h> 64 65 #ifdef INET6 66 #include <netinet/ip6.h> 67 #include <netipsec/ipsec6.h> 68 #endif 69 70 #include <netipsec/key.h> 71 #include <netipsec/key_debug.h> 72 73 #define TCP_SIGLEN 16 /* length of computed digest in bytes */ 74 #define TCP_KEYLEN_MIN 1 /* minimum length of TCP-MD5 key */ 75 #define TCP_KEYLEN_MAX 80 /* maximum length of TCP-MD5 key */ 76 77 static int 78 tcp_ipsec_pcbctl(struct inpcb *inp, struct sockopt *sopt) 79 { 80 struct tcpcb *tp; 81 int error, optval; 82 83 if (sopt->sopt_name != TCP_MD5SIG) { 84 return (ENOPROTOOPT); 85 } 86 87 if (sopt->sopt_dir == SOPT_GET) { 88 INP_RLOCK(inp); 89 if (inp->inp_flags & (INP_TIMEWAIT | INP_DROPPED)) { 90 INP_RUNLOCK(inp); 91 return (ECONNRESET); 92 } 93 tp = intotcpcb(inp); 94 optval = (tp->t_flags & TF_SIGNATURE) ? 1 : 0; 95 INP_RUNLOCK(inp); 96 97 /* On success return with released INP_WLOCK */ 98 return (sooptcopyout(sopt, &optval, sizeof(optval))); 99 } 100 101 error = sooptcopyin(sopt, &optval, sizeof(optval), sizeof(optval)); 102 if (error != 0) 103 return (error); 104 105 /* INP_WLOCK_RECHECK */ 106 INP_WLOCK(inp); 107 if (inp->inp_flags & (INP_TIMEWAIT | INP_DROPPED)) { 108 INP_WUNLOCK(inp); 109 return (ECONNRESET); 110 } 111 tp = intotcpcb(inp); 112 if (optval > 0) 113 tp->t_flags |= TF_SIGNATURE; 114 else 115 tp->t_flags &= ~TF_SIGNATURE; 116 117 INP_WUNLOCK(inp); 118 return (error); 119 } 120 121 /* 122 * Callback function invoked by m_apply() to digest TCP segment data 123 * contained within an mbuf chain. 124 */ 125 static int 126 tcp_signature_apply(void *fstate, void *data, u_int len) 127 { 128 129 MD5Update(fstate, (u_char *)data, len); 130 return (0); 131 } 132 133 #ifdef INET 134 static int 135 ip_pseudo_compute(struct mbuf *m, MD5_CTX *ctx) 136 { 137 struct ippseudo ipp; 138 struct ip *ip; 139 140 ip = mtod(m, struct ip *); 141 ipp.ippseudo_src.s_addr = ip->ip_src.s_addr; 142 ipp.ippseudo_dst.s_addr = ip->ip_dst.s_addr; 143 ipp.ippseudo_p = IPPROTO_TCP; 144 ipp.ippseudo_pad = 0; 145 ipp.ippseudo_len = htons(m->m_pkthdr.len - (ip->ip_hl << 2)); 146 MD5Update(ctx, (char *)&ipp, sizeof(ipp)); 147 return (ip->ip_hl << 2); 148 } 149 #endif 150 151 #ifdef INET6 152 static int 153 ip6_pseudo_compute(struct mbuf *m, MD5_CTX *ctx) 154 { 155 struct ip6_pseudo { 156 struct in6_addr src, dst; 157 uint32_t len; 158 uint32_t nxt; 159 } ip6p __aligned(4); 160 struct ip6_hdr *ip6; 161 162 ip6 = mtod(m, struct ip6_hdr *); 163 ip6p.src = ip6->ip6_src; 164 ip6p.dst = ip6->ip6_dst; 165 ip6p.len = htonl(m->m_pkthdr.len - sizeof(*ip6)); /* XXX: ext headers */ 166 ip6p.nxt = htonl(IPPROTO_TCP); 167 MD5Update(ctx, (char *)&ip6p, sizeof(ip6p)); 168 return (sizeof(*ip6)); 169 } 170 #endif 171 172 static int 173 tcp_signature_compute(struct mbuf *m, struct tcphdr *th, 174 struct secasvar *sav, u_char *buf) 175 { 176 MD5_CTX ctx; 177 int len; 178 u_short csum; 179 180 MD5Init(&ctx); 181 /* Step 1: Update MD5 hash with IP(v6) pseudo-header. */ 182 switch (sav->sah->saidx.dst.sa.sa_family) { 183 #ifdef INET 184 case AF_INET: 185 len = ip_pseudo_compute(m, &ctx); 186 break; 187 #endif 188 #ifdef INET6 189 case AF_INET6: 190 len = ip6_pseudo_compute(m, &ctx); 191 break; 192 #endif 193 default: 194 return (EAFNOSUPPORT); 195 } 196 /* 197 * Step 2: Update MD5 hash with TCP header, excluding options. 198 * The TCP checksum must be set to zero. 199 */ 200 csum = th->th_sum; 201 th->th_sum = 0; 202 MD5Update(&ctx, (char *)th, sizeof(struct tcphdr)); 203 th->th_sum = csum; 204 /* 205 * Step 3: Update MD5 hash with TCP segment data. 206 * Use m_apply() to avoid an early m_pullup(). 207 */ 208 len += (th->th_off << 2); 209 if (m->m_pkthdr.len - len > 0) 210 m_apply(m, len, m->m_pkthdr.len - len, 211 tcp_signature_apply, &ctx); 212 /* 213 * Step 4: Update MD5 hash with shared secret. 214 */ 215 MD5Update(&ctx, sav->key_auth->key_data, _KEYLEN(sav->key_auth)); 216 MD5Final(buf, &ctx); 217 key_sa_recordxfer(sav, m); 218 return (0); 219 } 220 221 static void 222 setsockaddrs(const struct mbuf *m, union sockaddr_union *src, 223 union sockaddr_union *dst) 224 { 225 struct ip *ip; 226 227 IPSEC_ASSERT(m->m_len >= sizeof(*ip), ("unexpected mbuf len")); 228 229 ip = mtod(m, struct ip *); 230 switch (ip->ip_v) { 231 #ifdef INET 232 case IPVERSION: 233 ipsec4_setsockaddrs(m, src, dst); 234 break; 235 #endif 236 #ifdef INET6 237 case (IPV6_VERSION >> 4): 238 ipsec6_setsockaddrs(m, src, dst); 239 break; 240 #endif 241 default: 242 bzero(src, sizeof(*src)); 243 bzero(dst, sizeof(*dst)); 244 } 245 } 246 247 /* 248 * Compute TCP-MD5 hash of an *INBOUND* TCP segment. 249 * Parameters: 250 * m pointer to head of mbuf chain 251 * th pointer to TCP header 252 * buf pointer to storage for computed MD5 digest 253 * 254 * Return 0 if successful, otherwise return -1. 255 */ 256 static int 257 tcp_ipsec_input(struct mbuf *m, struct tcphdr *th, u_char *buf) 258 { 259 char tmpdigest[TCP_SIGLEN]; 260 struct secasindex saidx; 261 struct secasvar *sav; 262 263 setsockaddrs(m, &saidx.src, &saidx.dst); 264 saidx.proto = IPPROTO_TCP; 265 saidx.mode = IPSEC_MODE_TCPMD5; 266 saidx.reqid = 0; 267 sav = key_allocsa_tcpmd5(&saidx); 268 if (sav == NULL) { 269 KMOD_TCPSTAT_INC(tcps_sig_err_buildsig); 270 return (EACCES); 271 } 272 /* 273 * tcp_input() operates with TCP header fields in host 274 * byte order. We expect them in network byte order. 275 */ 276 tcp_fields_to_net(th); 277 tcp_signature_compute(m, th, sav, tmpdigest); 278 tcp_fields_to_host(th); 279 key_freesav(&sav); 280 if (bcmp(buf, tmpdigest, TCP_SIGLEN) != 0) { 281 KMOD_TCPSTAT_INC(tcps_sig_rcvbadsig); 282 return (EACCES); 283 } 284 KMOD_TCPSTAT_INC(tcps_sig_rcvgoodsig); 285 return (0); 286 } 287 288 /* 289 * Compute TCP-MD5 hash of an *OUTBOUND* TCP segment. 290 * Parameters: 291 * m pointer to head of mbuf chain 292 * th pointer to TCP header 293 * buf pointer to storage for computed MD5 digest 294 * 295 * Return 0 if successful, otherwise return error code. 296 */ 297 static int 298 tcp_ipsec_output(struct mbuf *m, struct tcphdr *th, u_char *buf) 299 { 300 struct secasindex saidx; 301 struct secasvar *sav; 302 303 setsockaddrs(m, &saidx.src, &saidx.dst); 304 saidx.proto = IPPROTO_TCP; 305 saidx.mode = IPSEC_MODE_TCPMD5; 306 saidx.reqid = 0; 307 sav = key_allocsa_tcpmd5(&saidx); 308 if (sav == NULL) { 309 KMOD_TCPSTAT_INC(tcps_sig_err_buildsig); 310 return (EACCES); 311 } 312 tcp_signature_compute(m, th, sav, buf); 313 key_freesav(&sav); 314 return (0); 315 } 316 317 /* 318 * Initialize a TCP-MD5 SA. Called when the SA is being set up. 319 * 320 * We don't need to set up the tdb prefixed fields, as we don't use the 321 * opencrypto code; we just perform a key length check. 322 * 323 * XXX: Currently we have used single 'magic' SPI and need to still 324 * support this. 325 * 326 * This allows per-host granularity without affecting the userland 327 * interface, which is a simple socket option toggle switch, 328 * TCP_SIGNATURE_ENABLE. 329 * 330 * To allow per-service granularity requires that we have a means 331 * of mapping port to SPI. The mandated way of doing this is to 332 * use SPD entries to specify packet flows which get the TCP-MD5 333 * treatment, however the code to do this is currently unstable 334 * and unsuitable for production use. 335 * 336 * Therefore we use this compromise in the meantime. 337 */ 338 static int 339 tcpsignature_init(struct secasvar *sav, struct xformsw *xsp) 340 { 341 int keylen; 342 343 if (sav->alg_auth != SADB_X_AALG_TCP_MD5) { 344 DPRINTF(("%s: unsupported authentication algorithm %u\n", 345 __func__, sav->alg_auth)); 346 return (EINVAL); 347 } 348 if (sav->key_auth == NULL) { 349 DPRINTF(("%s: no authentication key present\n", __func__)); 350 return (EINVAL); 351 } 352 keylen = _KEYLEN(sav->key_auth); 353 if ((keylen < TCP_KEYLEN_MIN) || (keylen > TCP_KEYLEN_MAX)) { 354 DPRINTF(("%s: invalid key length %u\n", __func__, keylen)); 355 return (EINVAL); 356 } 357 sav->tdb_xform = xsp; 358 return (0); 359 } 360 361 /* 362 * Called when the SA is deleted. 363 */ 364 static void 365 tcpsignature_cleanup(struct secasvar *sav) 366 { 367 } 368 369 static struct xformsw tcpsignature_xformsw = { 370 .xf_type = XF_TCPSIGNATURE, 371 .xf_name = "TCP-MD5", 372 .xf_init = tcpsignature_init, 373 .xf_cleanup = tcpsignature_cleanup, 374 }; 375 376 static const struct tcpmd5_methods tcpmd5_methods = { 377 .input = tcp_ipsec_input, 378 .output = tcp_ipsec_output, 379 .pcbctl = tcp_ipsec_pcbctl, 380 }; 381 382 #ifndef KLD_MODULE 383 /* TCP-MD5 support is build in the kernel */ 384 static const struct tcpmd5_support tcpmd5_ipsec = { 385 .enabled = IPSEC_MODULE_ENABLED, 386 .methods = &tcpmd5_methods 387 }; 388 const struct tcpmd5_support * const tcp_ipsec_support = &tcpmd5_ipsec; 389 #endif /* !KLD_MODULE */ 390 391 static int 392 tcpmd5_modevent(module_t mod, int type, void *data) 393 { 394 395 switch (type) { 396 case MOD_LOAD: 397 xform_attach(&tcpsignature_xformsw); 398 #ifdef KLD_MODULE 399 tcpmd5_support_enable(&tcpmd5_methods); 400 #endif 401 break; 402 case MOD_UNLOAD: 403 #ifdef KLD_MODULE 404 tcpmd5_support_disable(); 405 #endif 406 xform_detach(&tcpsignature_xformsw); 407 break; 408 default: 409 return (EOPNOTSUPP); 410 } 411 return (0); 412 } 413 414 static moduledata_t tcpmd5_mod = { 415 "tcpmd5", 416 tcpmd5_modevent, 417 0 418 }; 419 420 DECLARE_MODULE(tcpmd5, tcpmd5_mod, SI_SUB_PROTO_DOMAIN, SI_ORDER_ANY); 421 MODULE_VERSION(tcpmd5, 1); 422 #ifdef KLD_MODULE 423 MODULE_DEPEND(tcpmd5, ipsec_support, 1, 1, 1); 424 #endif 425