The Design and Implementation of the FreeBSD Operating System, Second Edition
Now available: The Design and Implementation of the FreeBSD Operating System (Second Edition)


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]

FreeBSD/Linux Kernel Cross Reference
sys/net/if_enc.c

Version: -  FREEBSD  -  FREEBSD-12-STABLE  -  FREEBSD-12-0  -  FREEBSD-11-STABLE  -  FREEBSD-11-2  -  FREEBSD-11-1  -  FREEBSD-11-0  -  FREEBSD-10-STABLE  -  FREEBSD-10-4  -  FREEBSD-10-3  -  FREEBSD-10-2  -  FREEBSD-10-1  -  FREEBSD-10-0  -  FREEBSD-9-STABLE  -  FREEBSD-9-3  -  FREEBSD-9-2  -  FREEBSD-9-1  -  FREEBSD-9-0  -  FREEBSD-8-STABLE  -  FREEBSD-8-4  -  FREEBSD-8-3  -  FREEBSD-8-2  -  FREEBSD-8-1  -  FREEBSD-8-0  -  FREEBSD-7-STABLE  -  FREEBSD-7-4  -  FREEBSD-7-3  -  FREEBSD-7-2  -  FREEBSD-7-1  -  FREEBSD-7-0  -  FREEBSD-6-STABLE  -  FREEBSD-6-4  -  FREEBSD-6-3  -  FREEBSD-6-2  -  FREEBSD-6-1  -  FREEBSD-6-0  -  FREEBSD-5-STABLE  -  FREEBSD-5-5  -  FREEBSD-5-4  -  FREEBSD-5-3  -  FREEBSD-5-2  -  FREEBSD-5-1  -  FREEBSD-5-0  -  FREEBSD-4-STABLE  -  FREEBSD-3-STABLE  -  FREEBSD22  -  linux-2.6  -  linux-2.4.22  -  MK83  -  MK84  -  PLAN9  -  DFBSD  -  NETBSD  -  NETBSD5  -  NETBSD4  -  NETBSD3  -  NETBSD20  -  OPENBSD  -  xnu-517  -  xnu-792  -  xnu-792.6.70  -  xnu-1228  -  xnu-1456.1.26  -  xnu-1699.24.8  -  xnu-2050.18.24  -  OPENSOLARIS  -  minix-3-1-1 
SearchContext: -  none  -  3  -  10 

    1 /*-
    2  * Copyright (c) 2006 The FreeBSD Project.
    3  * All rights reserved.
    4  *
    5  * Redistribution and use in source and binary forms, with or without
    6  * modification, are permitted provided that the following conditions
    7  * are met:
    8  *
    9  * 1. Redistributions of source code must retain the above copyright
   10  *    notice, this list of conditions and the following disclaimer.
   11  * 2. Redistributions in binary form must reproduce the above copyright
   12  *    notice, this list of conditions and the following disclaimer in the
   13  *    documentation and/or other materials provided with the distribution.
   14  *
   15  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
   16  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
   17  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
   18  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
   19  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
   20  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
   21  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
   22  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
   23  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
   24  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
   25  * SUCH DAMAGE.
   26  *
   27  * $FreeBSD: releng/10.1/sys/net/if_enc.c 255926 2013-09-28 14:14:23Z glebius $
   28  */
   29 
   30 #include "opt_inet.h"
   31 #include "opt_inet6.h"
   32 #include "opt_enc.h"
   33 
   34 #include <sys/param.h>
   35 #include <sys/systm.h>
   36 #include <sys/kernel.h>
   37 #include <sys/malloc.h>
   38 #include <sys/mbuf.h>
   39 #include <sys/module.h>
   40 #include <machine/bus.h>
   41 #include <sys/rman.h>
   42 #include <sys/socket.h>
   43 #include <sys/sockio.h>
   44 #include <sys/sysctl.h>
   45 
   46 #include <net/if.h>
   47 #include <net/if_clone.h>
   48 #include <net/if_types.h>
   49 #include <net/pfil.h>
   50 #include <net/route.h>
   51 #include <net/netisr.h>
   52 #include <net/bpf.h>
   53 #include <net/vnet.h>
   54 
   55 #include <netinet/in.h>
   56 #include <netinet/in_systm.h>
   57 #include <netinet/ip.h>
   58 #include <netinet/ip_var.h>
   59 #include <netinet/in_var.h>
   60 
   61 #ifdef INET6
   62 #include <netinet/ip6.h>
   63 #include <netinet6/ip6_var.h>
   64 #endif
   65 
   66 #include <netipsec/ipsec.h>
   67 #include <netipsec/xform.h>
   68 
   69 #define ENCMTU          (1024+512)
   70 
   71 /* XXX this define must have the same value as in OpenBSD */
   72 #define M_CONF          0x0400  /* payload was encrypted (ESP-transport) */
   73 #define M_AUTH          0x0800  /* payload was authenticated (AH or ESP auth) */
   74 #define M_AUTH_AH       0x2000  /* header was authenticated (AH) */
   75 
   76 struct enchdr {
   77         u_int32_t af;
   78         u_int32_t spi;
   79         u_int32_t flags;
   80 };
   81 
   82 struct ifnet    *encif;
   83 static struct mtx       enc_mtx;
   84 
   85 struct enc_softc {
   86         struct  ifnet *sc_ifp;
   87 };
   88 
   89 static int      enc_ioctl(struct ifnet *, u_long, caddr_t);
   90 static int      enc_output(struct ifnet *ifp, struct mbuf *m,
   91                     const struct sockaddr *dst, struct route *ro);
   92 static int      enc_clone_create(struct if_clone *, int, caddr_t);
   93 static void     enc_clone_destroy(struct ifnet *);
   94 static struct if_clone *enc_cloner;
   95 static const char encname[] = "enc";
   96 
   97 /*
   98  * Sysctls.
   99  */
  100 
  101 /*
  102  * Before and after are relative to when we are stripping the
  103  * outer IP header.
  104  */
  105 static SYSCTL_NODE(_net, OID_AUTO, enc, CTLFLAG_RW, 0, "enc sysctl");
  106 
  107 static SYSCTL_NODE(_net_enc, OID_AUTO, in, CTLFLAG_RW, 0, "enc input sysctl");
  108 static int ipsec_filter_mask_in = ENC_BEFORE;
  109 SYSCTL_INT(_net_enc_in, OID_AUTO, ipsec_filter_mask, CTLFLAG_RW,
  110         &ipsec_filter_mask_in, 0, "IPsec input firewall filter mask");
  111 static int ipsec_bpf_mask_in = ENC_BEFORE;
  112 SYSCTL_INT(_net_enc_in, OID_AUTO, ipsec_bpf_mask, CTLFLAG_RW,
  113         &ipsec_bpf_mask_in, 0, "IPsec input bpf mask");
  114 
  115 static SYSCTL_NODE(_net_enc, OID_AUTO, out, CTLFLAG_RW, 0, "enc output sysctl");
  116 static int ipsec_filter_mask_out = ENC_BEFORE;
  117 SYSCTL_INT(_net_enc_out, OID_AUTO, ipsec_filter_mask, CTLFLAG_RW,
  118         &ipsec_filter_mask_out, 0, "IPsec output firewall filter mask");
  119 static int ipsec_bpf_mask_out = ENC_BEFORE|ENC_AFTER;
  120 SYSCTL_INT(_net_enc_out, OID_AUTO, ipsec_bpf_mask, CTLFLAG_RW,
  121         &ipsec_bpf_mask_out, 0, "IPsec output bpf mask");
  122 
  123 static void
  124 enc_clone_destroy(struct ifnet *ifp)
  125 {
  126         KASSERT(ifp != encif, ("%s: destroying encif", __func__));
  127 
  128         bpfdetach(ifp);
  129         if_detach(ifp);
  130         if_free(ifp);
  131 }
  132 
  133 static int
  134 enc_clone_create(struct if_clone *ifc, int unit, caddr_t params)
  135 {
  136         struct ifnet *ifp;
  137         struct enc_softc *sc;
  138 
  139         sc = malloc(sizeof(*sc), M_DEVBUF, M_WAITOK|M_ZERO);
  140         ifp = sc->sc_ifp = if_alloc(IFT_ENC);
  141         if (ifp == NULL) {
  142                 free(sc, M_DEVBUF);
  143                 return (ENOSPC);
  144         }
  145 
  146         if_initname(ifp, encname, unit);
  147         ifp->if_mtu = ENCMTU;
  148         ifp->if_ioctl = enc_ioctl;
  149         ifp->if_output = enc_output;
  150         ifp->if_snd.ifq_maxlen = ifqmaxlen;
  151         ifp->if_softc = sc;
  152         if_attach(ifp);
  153         bpfattach(ifp, DLT_ENC, sizeof(struct enchdr));
  154 
  155         mtx_lock(&enc_mtx);
  156         /* grab a pointer to enc0, ignore the rest */
  157         if (encif == NULL)
  158                 encif = ifp;
  159         mtx_unlock(&enc_mtx);
  160 
  161         return (0);
  162 }
  163 
  164 static int
  165 enc_modevent(module_t mod, int type, void *data)
  166 {
  167         switch (type) {
  168         case MOD_LOAD:
  169                 mtx_init(&enc_mtx, "enc mtx", NULL, MTX_DEF);
  170                 enc_cloner = if_clone_simple(encname, enc_clone_create,
  171                     enc_clone_destroy, 1);
  172                 break;
  173         case MOD_UNLOAD:
  174                 printf("enc module unload - not possible for this module\n");
  175                 return (EINVAL);
  176         default:
  177                 return (EOPNOTSUPP);
  178         }
  179         return (0);
  180 }
  181 
  182 static moduledata_t enc_mod = {
  183         "if_enc",
  184         enc_modevent,
  185         0
  186 };
  187 
  188 DECLARE_MODULE(if_enc, enc_mod, SI_SUB_PROTO_IFATTACHDOMAIN, SI_ORDER_ANY);
  189 
  190 static int
  191 enc_output(struct ifnet *ifp, struct mbuf *m, const struct sockaddr *dst,
  192     struct route *ro)
  193 {
  194         m_freem(m);
  195         return (0);
  196 }
  197 
  198 /*
  199  * Process an ioctl request.
  200  */
  201 /* ARGSUSED */
  202 static int
  203 enc_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
  204 {
  205         int error = 0;
  206 
  207         mtx_lock(&enc_mtx);
  208 
  209         switch (cmd) {
  210 
  211         case SIOCSIFFLAGS:
  212                 if (ifp->if_flags & IFF_UP)
  213                         ifp->if_drv_flags |= IFF_DRV_RUNNING;
  214                 else
  215                         ifp->if_drv_flags &= ~IFF_DRV_RUNNING;
  216 
  217                 break;
  218 
  219         default:
  220                 error = EINVAL;
  221         }
  222 
  223         mtx_unlock(&enc_mtx);
  224         return (error);
  225 }
  226 
  227 int
  228 ipsec_filter(struct mbuf **mp, int dir, int flags)
  229 {
  230         int error, i;
  231         struct ip *ip;
  232 
  233         KASSERT(encif != NULL, ("%s: encif is null", __func__));
  234         KASSERT(flags & (ENC_IN|ENC_OUT),
  235                 ("%s: invalid flags: %04x", __func__, flags));
  236 
  237         if ((encif->if_drv_flags & IFF_DRV_RUNNING) == 0)
  238                 return (0);
  239 
  240         if (flags & ENC_IN) {
  241                 if ((flags & ipsec_filter_mask_in) == 0)
  242                         return (0);
  243         } else {
  244                 if ((flags & ipsec_filter_mask_out) == 0)
  245                         return (0);
  246         }
  247 
  248         /* Skip pfil(9) if no filters are loaded */
  249         if (1
  250 #ifdef INET
  251             && !PFIL_HOOKED(&V_inet_pfil_hook)
  252 #endif
  253 #ifdef INET6
  254             && !PFIL_HOOKED(&V_inet6_pfil_hook)
  255 #endif
  256             ) {
  257                 return (0);
  258         }
  259 
  260         i = min((*mp)->m_pkthdr.len, max_protohdr);
  261         if ((*mp)->m_len < i) {
  262                 *mp = m_pullup(*mp, i);
  263                 if (*mp == NULL) {
  264                         printf("%s: m_pullup failed\n", __func__);
  265                         return (-1);
  266                 }
  267         }
  268 
  269         error = 0;
  270         ip = mtod(*mp, struct ip *);
  271         switch (ip->ip_v) {
  272 #ifdef INET
  273                 case 4:
  274                         error = pfil_run_hooks(&V_inet_pfil_hook, mp,
  275                             encif, dir, NULL);
  276                         break;
  277 #endif
  278 #ifdef INET6
  279                 case 6:
  280                         error = pfil_run_hooks(&V_inet6_pfil_hook, mp,
  281                             encif, dir, NULL);
  282                         break;
  283 #endif
  284                 default:
  285                         printf("%s: unknown IP version\n", __func__);
  286         }
  287 
  288         /*
  289          * If the mbuf was consumed by the filter for requeueing (dummynet, etc)
  290          * then error will be zero but we still want to return an error to our
  291          * caller so the null mbuf isn't forwarded further.
  292          */
  293         if (*mp == NULL && error == 0)
  294                 return (-1);    /* Consumed by the filter */
  295         if (*mp == NULL)
  296                 return (error);
  297         if (error != 0)
  298                 goto bad;
  299 
  300         return (error);
  301 
  302 bad:
  303         m_freem(*mp);
  304         *mp = NULL;
  305         return (error);
  306 }
  307 
  308 void
  309 ipsec_bpf(struct mbuf *m, struct secasvar *sav, int af, int flags)
  310 {
  311         int mflags;
  312         struct enchdr hdr;
  313 
  314         KASSERT(encif != NULL, ("%s: encif is null", __func__));
  315         KASSERT(flags & (ENC_IN|ENC_OUT),
  316                 ("%s: invalid flags: %04x", __func__, flags));
  317 
  318         if ((encif->if_drv_flags & IFF_DRV_RUNNING) == 0)
  319                 return;
  320 
  321         if (flags & ENC_IN) {
  322                 if ((flags & ipsec_bpf_mask_in) == 0)
  323                         return;
  324         } else {
  325                 if ((flags & ipsec_bpf_mask_out) == 0)
  326                         return;
  327         }
  328 
  329         if (bpf_peers_present(encif->if_bpf)) {
  330                 mflags = 0;
  331                 hdr.spi = 0;
  332                 if (!sav) {
  333                         struct m_tag *mtag;
  334                         mtag = m_tag_find(m, PACKET_TAG_IPSEC_IN_DONE, NULL);
  335                         if (mtag != NULL) {
  336                                 struct tdb_ident *tdbi;
  337                                 tdbi = (struct tdb_ident *) (mtag + 1);
  338                                 if (tdbi->alg_enc != SADB_EALG_NONE)
  339                                         mflags |= M_CONF;
  340                                 if (tdbi->alg_auth != SADB_AALG_NONE)
  341                                         mflags |= M_AUTH;
  342                                 hdr.spi = tdbi->spi;
  343                         }
  344                 } else {
  345                         if (sav->alg_enc != SADB_EALG_NONE)
  346                                 mflags |= M_CONF;
  347                         if (sav->alg_auth != SADB_AALG_NONE)
  348                                 mflags |= M_AUTH;
  349                         hdr.spi = sav->spi;
  350                 }
  351 
  352                 /*
  353                  * We need to prepend the address family as a four byte
  354                  * field.  Cons up a dummy header to pacify bpf.  This
  355                  * is safe because bpf will only read from the mbuf
  356                  * (i.e., it won't try to free it or keep a pointer a
  357                  * to it).
  358                  */
  359                 hdr.af = af;
  360                 /* hdr.spi already set above */
  361                 hdr.flags = mflags;
  362 
  363                 bpf_mtap2(encif->if_bpf, &hdr, sizeof(hdr), m);
  364         }
  365 }

Cache object: cd54de0760dfde6fc4e4a7de1735c49b


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]


This page is part of the FreeBSD/Linux Linux Kernel Cross-Reference, and was automatically generated using a modified version of the LXR engine.