FreeBSD/Linux Kernel Cross Reference
sys/net/if_enc.c
1 /*-
2 * Copyright (c) 2006 The FreeBSD Project.
3 * Copyright (c) 2015 Andrey V. Elsukov <ae@FreeBSD.org>
4 * All rights reserved.
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 *
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution.
15 *
16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
17 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
18 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
19 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
20 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
21 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
22 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
24 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
25 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26 * SUCH DAMAGE.
27 *
28 * $FreeBSD: releng/11.0/sys/net/if_enc.c 302054 2016-06-21 13:48:49Z bz $
29 */
30
31 #include "opt_inet.h"
32 #include "opt_inet6.h"
33
34 #include <sys/param.h>
35 #include <sys/systm.h>
36 #include <sys/hhook.h>
37 #include <sys/kernel.h>
38 #include <sys/malloc.h>
39 #include <sys/mbuf.h>
40 #include <sys/module.h>
41 #include <machine/bus.h>
42 #include <sys/rman.h>
43 #include <sys/socket.h>
44 #include <sys/sockio.h>
45 #include <sys/sysctl.h>
46
47 #include <net/if.h>
48 #include <net/if_enc.h>
49 #include <net/if_var.h>
50 #include <net/if_clone.h>
51 #include <net/if_types.h>
52 #include <net/pfil.h>
53 #include <net/route.h>
54 #include <net/netisr.h>
55 #include <net/bpf.h>
56 #include <net/vnet.h>
57
58 #include <netinet/in.h>
59 #include <netinet/in_systm.h>
60 #include <netinet/ip.h>
61 #include <netinet/ip_var.h>
62 #include <netinet/in_var.h>
63
64 #ifdef INET6
65 #include <netinet/ip6.h>
66 #include <netinet6/ip6_var.h>
67 #endif
68
69 #include <netipsec/ipsec.h>
70 #include <netipsec/xform.h>
71
72 #define ENCMTU (1024+512)
73
74 /* XXX this define must have the same value as in OpenBSD */
75 #define M_CONF 0x0400 /* payload was encrypted (ESP-transport) */
76 #define M_AUTH 0x0800 /* payload was authenticated (AH or ESP auth) */
77 #define M_AUTH_AH 0x2000 /* header was authenticated (AH) */
78
79 struct enchdr {
80 u_int32_t af;
81 u_int32_t spi;
82 u_int32_t flags;
83 };
84 struct enc_softc {
85 struct ifnet *sc_ifp;
86 };
87 static VNET_DEFINE(struct enc_softc *, enc_sc);
88 #define V_enc_sc VNET(enc_sc)
89 static VNET_DEFINE(struct if_clone *, enc_cloner);
90 #define V_enc_cloner VNET(enc_cloner)
91
92 static int enc_ioctl(struct ifnet *, u_long, caddr_t);
93 static int enc_output(struct ifnet *, struct mbuf *,
94 const struct sockaddr *, struct route *);
95 static int enc_clone_create(struct if_clone *, int, caddr_t);
96 static void enc_clone_destroy(struct ifnet *);
97 static int enc_add_hhooks(struct enc_softc *);
98 static void enc_remove_hhooks(struct enc_softc *);
99
100 static const char encname[] = "enc";
101
102 /*
103 * Before and after are relative to when we are stripping the
104 * outer IP header.
105 */
106 static VNET_DEFINE(int, filter_mask_in) = IPSEC_ENC_BEFORE;
107 static VNET_DEFINE(int, bpf_mask_in) = IPSEC_ENC_BEFORE;
108 static VNET_DEFINE(int, filter_mask_out) = IPSEC_ENC_BEFORE;
109 static VNET_DEFINE(int, bpf_mask_out) = IPSEC_ENC_BEFORE | IPSEC_ENC_AFTER;
110 #define V_filter_mask_in VNET(filter_mask_in)
111 #define V_bpf_mask_in VNET(bpf_mask_in)
112 #define V_filter_mask_out VNET(filter_mask_out)
113 #define V_bpf_mask_out VNET(bpf_mask_out)
114
115 static SYSCTL_NODE(_net, OID_AUTO, enc, CTLFLAG_RW, 0, "enc sysctl");
116 static SYSCTL_NODE(_net_enc, OID_AUTO, in, CTLFLAG_RW, 0, "enc input sysctl");
117 static SYSCTL_NODE(_net_enc, OID_AUTO, out, CTLFLAG_RW, 0, "enc output sysctl");
118 SYSCTL_INT(_net_enc_in, OID_AUTO, ipsec_filter_mask,
119 CTLFLAG_RW | CTLFLAG_VNET, &VNET_NAME(filter_mask_in), 0,
120 "IPsec input firewall filter mask");
121 SYSCTL_INT(_net_enc_in, OID_AUTO, ipsec_bpf_mask,
122 CTLFLAG_RW | CTLFLAG_VNET, &VNET_NAME(bpf_mask_in), 0,
123 "IPsec input bpf mask");
124 SYSCTL_INT(_net_enc_out, OID_AUTO, ipsec_filter_mask,
125 CTLFLAG_RW | CTLFLAG_VNET, &VNET_NAME(filter_mask_out), 0,
126 "IPsec output firewall filter mask");
127 SYSCTL_INT(_net_enc_out, OID_AUTO, ipsec_bpf_mask,
128 CTLFLAG_RW | CTLFLAG_VNET, &VNET_NAME(bpf_mask_out), 0,
129 "IPsec output bpf mask");
130
131 static void
132 enc_clone_destroy(struct ifnet *ifp)
133 {
134 struct enc_softc *sc;
135
136 sc = ifp->if_softc;
137 KASSERT(sc == V_enc_sc, ("sc != ifp->if_softc"));
138
139 bpfdetach(ifp);
140 if_detach(ifp);
141 if_free(ifp);
142 free(sc, M_DEVBUF);
143 V_enc_sc = NULL;
144 }
145
146 static int
147 enc_clone_create(struct if_clone *ifc, int unit, caddr_t params)
148 {
149 struct ifnet *ifp;
150 struct enc_softc *sc;
151
152 sc = malloc(sizeof(struct enc_softc), M_DEVBUF,
153 M_WAITOK | M_ZERO);
154 ifp = sc->sc_ifp = if_alloc(IFT_ENC);
155 if (ifp == NULL) {
156 free(sc, M_DEVBUF);
157 return (ENOSPC);
158 }
159 if (V_enc_sc != NULL) {
160 if_free(ifp);
161 free(sc, M_DEVBUF);
162 return (EEXIST);
163 }
164 V_enc_sc = sc;
165 if_initname(ifp, encname, unit);
166 ifp->if_mtu = ENCMTU;
167 ifp->if_ioctl = enc_ioctl;
168 ifp->if_output = enc_output;
169 ifp->if_softc = sc;
170 if_attach(ifp);
171 bpfattach(ifp, DLT_ENC, sizeof(struct enchdr));
172 return (0);
173 }
174
175 static int
176 enc_output(struct ifnet *ifp, struct mbuf *m, const struct sockaddr *dst,
177 struct route *ro)
178 {
179
180 m_freem(m);
181 return (0);
182 }
183
184 static int
185 enc_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
186 {
187
188 if (cmd != SIOCSIFFLAGS)
189 return (EINVAL);
190 if (ifp->if_flags & IFF_UP)
191 ifp->if_drv_flags |= IFF_DRV_RUNNING;
192 else
193 ifp->if_drv_flags &= ~IFF_DRV_RUNNING;
194 return (0);
195 }
196
197 /*
198 * One helper hook function is used by any hook points.
199 * + from hhook_type we can determine the packet direction:
200 * HHOOK_TYPE_IPSEC_IN or HHOOK_TYPE_IPSEC_OUT;
201 * + from hhook_id we can determine address family: AF_INET or AF_INET6;
202 * + udata contains pointer to enc_softc;
203 * + ctx_data contains pointer to struct ipsec_ctx_data.
204 */
205 static int
206 enc_hhook(int32_t hhook_type, int32_t hhook_id, void *udata, void *ctx_data,
207 void *hdata, struct osd *hosd)
208 {
209 struct enchdr hdr;
210 struct ipsec_ctx_data *ctx;
211 struct enc_softc *sc;
212 struct ifnet *ifp, *rcvif;
213 struct pfil_head *ph;
214 int pdir;
215
216 sc = (struct enc_softc *)udata;
217 ifp = sc->sc_ifp;
218 if ((ifp->if_flags & IFF_UP) == 0)
219 return (0);
220
221 ctx = (struct ipsec_ctx_data *)ctx_data;
222 /* XXX: wrong hook point was used by caller? */
223 if (ctx->af != hhook_id)
224 return (EPFNOSUPPORT);
225
226 if (((hhook_type == HHOOK_TYPE_IPSEC_IN &&
227 (ctx->enc & V_bpf_mask_in) != 0) ||
228 (hhook_type == HHOOK_TYPE_IPSEC_OUT &&
229 (ctx->enc & V_bpf_mask_out) != 0)) &&
230 bpf_peers_present(ifp->if_bpf) != 0) {
231 hdr.af = ctx->af;
232 hdr.spi = ctx->sav->spi;
233 hdr.flags = 0;
234 if (ctx->sav->alg_enc != SADB_EALG_NONE)
235 hdr.flags |= M_CONF;
236 if (ctx->sav->alg_auth != SADB_AALG_NONE)
237 hdr.flags |= M_AUTH;
238 bpf_mtap2(ifp->if_bpf, &hdr, sizeof(hdr), *ctx->mp);
239 }
240
241 switch (hhook_type) {
242 case HHOOK_TYPE_IPSEC_IN:
243 if (ctx->enc == IPSEC_ENC_BEFORE) {
244 /* Do accounting only once */
245 if_inc_counter(ifp, IFCOUNTER_IPACKETS, 1);
246 if_inc_counter(ifp, IFCOUNTER_IBYTES,
247 (*ctx->mp)->m_pkthdr.len);
248 }
249 if ((ctx->enc & V_filter_mask_in) == 0)
250 return (0); /* skip pfil processing */
251 pdir = PFIL_IN;
252 break;
253 case HHOOK_TYPE_IPSEC_OUT:
254 if (ctx->enc == IPSEC_ENC_BEFORE) {
255 /* Do accounting only once */
256 if_inc_counter(ifp, IFCOUNTER_OPACKETS, 1);
257 if_inc_counter(ifp, IFCOUNTER_OBYTES,
258 (*ctx->mp)->m_pkthdr.len);
259 }
260 if ((ctx->enc & V_filter_mask_out) == 0)
261 return (0); /* skip pfil processing */
262 pdir = PFIL_OUT;
263 break;
264 default:
265 return (EINVAL);
266 }
267
268 switch (hhook_id) {
269 #ifdef INET
270 case AF_INET:
271 ph = &V_inet_pfil_hook;
272 break;
273 #endif
274 #ifdef INET6
275 case AF_INET6:
276 ph = &V_inet6_pfil_hook;
277 break;
278 #endif
279 default:
280 ph = NULL;
281 }
282 if (ph == NULL || !PFIL_HOOKED(ph))
283 return (0);
284 /* Make a packet looks like it was received on enc(4) */
285 rcvif = (*ctx->mp)->m_pkthdr.rcvif;
286 (*ctx->mp)->m_pkthdr.rcvif = ifp;
287 if (pfil_run_hooks(ph, ctx->mp, ifp, pdir, NULL) != 0 ||
288 *ctx->mp == NULL) {
289 *ctx->mp = NULL; /* consumed by filter */
290 return (EACCES);
291 }
292 (*ctx->mp)->m_pkthdr.rcvif = rcvif;
293 return (0);
294 }
295
296 static int
297 enc_add_hhooks(struct enc_softc *sc)
298 {
299 struct hookinfo hki;
300 int error;
301
302 error = EPFNOSUPPORT;
303 hki.hook_func = enc_hhook;
304 hki.hook_helper = NULL;
305 hki.hook_udata = sc;
306 #ifdef INET
307 hki.hook_id = AF_INET;
308 hki.hook_type = HHOOK_TYPE_IPSEC_IN;
309 error = hhook_add_hook(V_ipsec_hhh_in[HHOOK_IPSEC_INET],
310 &hki, HHOOK_WAITOK);
311 if (error != 0)
312 return (error);
313 hki.hook_type = HHOOK_TYPE_IPSEC_OUT;
314 error = hhook_add_hook(V_ipsec_hhh_out[HHOOK_IPSEC_INET],
315 &hki, HHOOK_WAITOK);
316 if (error != 0)
317 return (error);
318 #endif
319 #ifdef INET6
320 hki.hook_id = AF_INET6;
321 hki.hook_type = HHOOK_TYPE_IPSEC_IN;
322 error = hhook_add_hook(V_ipsec_hhh_in[HHOOK_IPSEC_INET6],
323 &hki, HHOOK_WAITOK);
324 if (error != 0)
325 return (error);
326 hki.hook_type = HHOOK_TYPE_IPSEC_OUT;
327 error = hhook_add_hook(V_ipsec_hhh_out[HHOOK_IPSEC_INET6],
328 &hki, HHOOK_WAITOK);
329 if (error != 0)
330 return (error);
331 #endif
332 return (error);
333 }
334
335 static void
336 enc_remove_hhooks(struct enc_softc *sc)
337 {
338 struct hookinfo hki;
339
340 hki.hook_func = enc_hhook;
341 hki.hook_helper = NULL;
342 hki.hook_udata = sc;
343 #ifdef INET
344 hki.hook_id = AF_INET;
345 hki.hook_type = HHOOK_TYPE_IPSEC_IN;
346 hhook_remove_hook(V_ipsec_hhh_in[HHOOK_IPSEC_INET], &hki);
347 hki.hook_type = HHOOK_TYPE_IPSEC_OUT;
348 hhook_remove_hook(V_ipsec_hhh_out[HHOOK_IPSEC_INET], &hki);
349 #endif
350 #ifdef INET6
351 hki.hook_id = AF_INET6;
352 hki.hook_type = HHOOK_TYPE_IPSEC_IN;
353 hhook_remove_hook(V_ipsec_hhh_in[HHOOK_IPSEC_INET6], &hki);
354 hki.hook_type = HHOOK_TYPE_IPSEC_OUT;
355 hhook_remove_hook(V_ipsec_hhh_out[HHOOK_IPSEC_INET6], &hki);
356 #endif
357 }
358
359 static void
360 vnet_enc_init(const void *unused __unused)
361 {
362
363 V_enc_sc = NULL;
364 V_enc_cloner = if_clone_simple(encname, enc_clone_create,
365 enc_clone_destroy, 1);
366 }
367 VNET_SYSINIT(vnet_enc_init, SI_SUB_PSEUDO, SI_ORDER_ANY,
368 vnet_enc_init, NULL);
369
370 static void
371 vnet_enc_init_proto(void *unused __unused)
372 {
373 KASSERT(V_enc_sc != NULL, ("%s: V_enc_sc is %p\n", __func__, V_enc_sc));
374
375 if (enc_add_hhooks(V_enc_sc) != 0)
376 enc_clone_destroy(V_enc_sc->sc_ifp);
377 }
378 VNET_SYSINIT(vnet_enc_init_proto, SI_SUB_PROTO_IFATTACHDOMAIN, SI_ORDER_ANY,
379 vnet_enc_init_proto, NULL);
380
381 static void
382 vnet_enc_uninit(const void *unused __unused)
383 {
384 KASSERT(V_enc_sc != NULL, ("%s: V_enc_sc is %p\n", __func__, V_enc_sc));
385
386 if_clone_detach(V_enc_cloner);
387 }
388 VNET_SYSUNINIT(vnet_enc_uninit, SI_SUB_INIT_IF, SI_ORDER_ANY,
389 vnet_enc_uninit, NULL);
390
391 /*
392 * The hhook consumer needs to go before ip[6]_destroy are called on
393 * SI_ORDER_THIRD.
394 */
395 static void
396 vnet_enc_uninit_hhook(const void *unused __unused)
397 {
398 KASSERT(V_enc_sc != NULL, ("%s: V_enc_sc is %p\n", __func__, V_enc_sc));
399
400 enc_remove_hhooks(V_enc_sc);
401 }
402 VNET_SYSUNINIT(vnet_enc_uninit_hhook, SI_SUB_PROTO_DOMAIN, SI_ORDER_FOURTH,
403 vnet_enc_uninit_hhook, NULL);
404
405 static int
406 enc_modevent(module_t mod, int type, void *data)
407 {
408
409 switch (type) {
410 case MOD_LOAD:
411 case MOD_UNLOAD:
412 break;
413 default:
414 return (EOPNOTSUPP);
415 }
416 return (0);
417 }
418
419 static moduledata_t enc_mod = {
420 "if_enc",
421 enc_modevent,
422 0
423 };
424
425 DECLARE_MODULE(if_enc, enc_mod, SI_SUB_PSEUDO, SI_ORDER_ANY);
Cache object: 978aee78e12402d4bbcd38a791be0b5e
|