The Design and Implementation of the FreeBSD Operating System, Second Edition
Now available: The Design and Implementation of the FreeBSD Operating System (Second Edition)


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]

FreeBSD/Linux Kernel Cross Reference
sys/net/if_enc.c

Version: -  FREEBSD  -  FREEBSD-13-STABLE  -  FREEBSD-13-0  -  FREEBSD-12-STABLE  -  FREEBSD-12-0  -  FREEBSD-11-STABLE  -  FREEBSD-11-0  -  FREEBSD-10-STABLE  -  FREEBSD-10-0  -  FREEBSD-9-STABLE  -  FREEBSD-9-0  -  FREEBSD-8-STABLE  -  FREEBSD-8-0  -  FREEBSD-7-STABLE  -  FREEBSD-7-0  -  FREEBSD-6-STABLE  -  FREEBSD-6-0  -  FREEBSD-5-STABLE  -  FREEBSD-5-0  -  FREEBSD-4-STABLE  -  FREEBSD-3-STABLE  -  FREEBSD22  -  l41  -  OPENBSD  -  linux-2.6  -  MK84  -  PLAN9  -  xnu-8792 
SearchContext: -  none  -  3  -  10 

    1 /*-
    2  * Copyright (c) 2006 The FreeBSD Project.
    3  * Copyright (c) 2015 Andrey V. Elsukov <ae@FreeBSD.org>
    4  * All rights reserved.
    5  *
    6  * Redistribution and use in source and binary forms, with or without
    7  * modification, are permitted provided that the following conditions
    8  * are met:
    9  *
   10  * 1. Redistributions of source code must retain the above copyright
   11  *    notice, this list of conditions and the following disclaimer.
   12  * 2. Redistributions in binary form must reproduce the above copyright
   13  *    notice, this list of conditions and the following disclaimer in the
   14  *    documentation and/or other materials provided with the distribution.
   15  *
   16  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
   17  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
   18  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
   19  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
   20  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
   21  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
   22  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
   23  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
   24  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
   25  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
   26  * SUCH DAMAGE.
   27  *
   28  * $FreeBSD: releng/11.0/sys/net/if_enc.c 302054 2016-06-21 13:48:49Z bz $
   29  */
   30 
   31 #include "opt_inet.h"
   32 #include "opt_inet6.h"
   33 
   34 #include <sys/param.h>
   35 #include <sys/systm.h>
   36 #include <sys/hhook.h>
   37 #include <sys/kernel.h>
   38 #include <sys/malloc.h>
   39 #include <sys/mbuf.h>
   40 #include <sys/module.h>
   41 #include <machine/bus.h>
   42 #include <sys/rman.h>
   43 #include <sys/socket.h>
   44 #include <sys/sockio.h>
   45 #include <sys/sysctl.h>
   46 
   47 #include <net/if.h>
   48 #include <net/if_enc.h>
   49 #include <net/if_var.h>
   50 #include <net/if_clone.h>
   51 #include <net/if_types.h>
   52 #include <net/pfil.h>
   53 #include <net/route.h>
   54 #include <net/netisr.h>
   55 #include <net/bpf.h>
   56 #include <net/vnet.h>
   57 
   58 #include <netinet/in.h>
   59 #include <netinet/in_systm.h>
   60 #include <netinet/ip.h>
   61 #include <netinet/ip_var.h>
   62 #include <netinet/in_var.h>
   63 
   64 #ifdef INET6
   65 #include <netinet/ip6.h>
   66 #include <netinet6/ip6_var.h>
   67 #endif
   68 
   69 #include <netipsec/ipsec.h>
   70 #include <netipsec/xform.h>
   71 
   72 #define ENCMTU          (1024+512)
   73 
   74 /* XXX this define must have the same value as in OpenBSD */
   75 #define M_CONF          0x0400  /* payload was encrypted (ESP-transport) */
   76 #define M_AUTH          0x0800  /* payload was authenticated (AH or ESP auth) */
   77 #define M_AUTH_AH       0x2000  /* header was authenticated (AH) */
   78 
   79 struct enchdr {
   80         u_int32_t af;
   81         u_int32_t spi;
   82         u_int32_t flags;
   83 };
   84 struct enc_softc {
   85         struct  ifnet *sc_ifp;
   86 };
   87 static VNET_DEFINE(struct enc_softc *, enc_sc);
   88 #define V_enc_sc        VNET(enc_sc)
   89 static VNET_DEFINE(struct if_clone *, enc_cloner);
   90 #define V_enc_cloner    VNET(enc_cloner)
   91 
   92 static int      enc_ioctl(struct ifnet *, u_long, caddr_t);
   93 static int      enc_output(struct ifnet *, struct mbuf *,
   94     const struct sockaddr *, struct route *);
   95 static int      enc_clone_create(struct if_clone *, int, caddr_t);
   96 static void     enc_clone_destroy(struct ifnet *);
   97 static int      enc_add_hhooks(struct enc_softc *);
   98 static void     enc_remove_hhooks(struct enc_softc *);
   99 
  100 static const char encname[] = "enc";
  101 
  102 /*
  103  * Before and after are relative to when we are stripping the
  104  * outer IP header.
  105  */
  106 static VNET_DEFINE(int, filter_mask_in) = IPSEC_ENC_BEFORE;
  107 static VNET_DEFINE(int, bpf_mask_in) = IPSEC_ENC_BEFORE;
  108 static VNET_DEFINE(int, filter_mask_out) = IPSEC_ENC_BEFORE;
  109 static VNET_DEFINE(int, bpf_mask_out) = IPSEC_ENC_BEFORE | IPSEC_ENC_AFTER;
  110 #define V_filter_mask_in        VNET(filter_mask_in)
  111 #define V_bpf_mask_in           VNET(bpf_mask_in)
  112 #define V_filter_mask_out       VNET(filter_mask_out)
  113 #define V_bpf_mask_out          VNET(bpf_mask_out)
  114 
  115 static SYSCTL_NODE(_net, OID_AUTO, enc, CTLFLAG_RW, 0, "enc sysctl");
  116 static SYSCTL_NODE(_net_enc, OID_AUTO, in, CTLFLAG_RW, 0, "enc input sysctl");
  117 static SYSCTL_NODE(_net_enc, OID_AUTO, out, CTLFLAG_RW, 0, "enc output sysctl");
  118 SYSCTL_INT(_net_enc_in, OID_AUTO, ipsec_filter_mask,
  119     CTLFLAG_RW | CTLFLAG_VNET, &VNET_NAME(filter_mask_in), 0,
  120     "IPsec input firewall filter mask");
  121 SYSCTL_INT(_net_enc_in, OID_AUTO, ipsec_bpf_mask,
  122     CTLFLAG_RW | CTLFLAG_VNET, &VNET_NAME(bpf_mask_in), 0,
  123     "IPsec input bpf mask");
  124 SYSCTL_INT(_net_enc_out, OID_AUTO, ipsec_filter_mask,
  125     CTLFLAG_RW | CTLFLAG_VNET, &VNET_NAME(filter_mask_out), 0,
  126     "IPsec output firewall filter mask");
  127 SYSCTL_INT(_net_enc_out, OID_AUTO, ipsec_bpf_mask,
  128     CTLFLAG_RW | CTLFLAG_VNET, &VNET_NAME(bpf_mask_out), 0,
  129     "IPsec output bpf mask");
  130 
  131 static void
  132 enc_clone_destroy(struct ifnet *ifp)
  133 {
  134         struct enc_softc *sc;
  135 
  136         sc = ifp->if_softc;
  137         KASSERT(sc == V_enc_sc, ("sc != ifp->if_softc"));
  138 
  139         bpfdetach(ifp);
  140         if_detach(ifp);
  141         if_free(ifp);
  142         free(sc, M_DEVBUF);
  143         V_enc_sc = NULL;
  144 }
  145 
  146 static int
  147 enc_clone_create(struct if_clone *ifc, int unit, caddr_t params)
  148 {
  149         struct ifnet *ifp;
  150         struct enc_softc *sc;
  151 
  152         sc = malloc(sizeof(struct enc_softc), M_DEVBUF,
  153             M_WAITOK | M_ZERO);
  154         ifp = sc->sc_ifp = if_alloc(IFT_ENC);
  155         if (ifp == NULL) {
  156                 free(sc, M_DEVBUF);
  157                 return (ENOSPC);
  158         }
  159         if (V_enc_sc != NULL) {
  160                 if_free(ifp);
  161                 free(sc, M_DEVBUF);
  162                 return (EEXIST);
  163         }
  164         V_enc_sc = sc;
  165         if_initname(ifp, encname, unit);
  166         ifp->if_mtu = ENCMTU;
  167         ifp->if_ioctl = enc_ioctl;
  168         ifp->if_output = enc_output;
  169         ifp->if_softc = sc;
  170         if_attach(ifp);
  171         bpfattach(ifp, DLT_ENC, sizeof(struct enchdr));
  172         return (0);
  173 }
  174 
  175 static int
  176 enc_output(struct ifnet *ifp, struct mbuf *m, const struct sockaddr *dst,
  177     struct route *ro)
  178 {
  179 
  180         m_freem(m);
  181         return (0);
  182 }
  183 
  184 static int
  185 enc_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
  186 {
  187 
  188         if (cmd != SIOCSIFFLAGS)
  189                 return (EINVAL);
  190         if (ifp->if_flags & IFF_UP)
  191                 ifp->if_drv_flags |= IFF_DRV_RUNNING;
  192         else
  193                 ifp->if_drv_flags &= ~IFF_DRV_RUNNING;
  194         return (0);
  195 }
  196 
  197 /*
  198  * One helper hook function is used by any hook points.
  199  * + from hhook_type we can determine the packet direction:
  200  *   HHOOK_TYPE_IPSEC_IN or HHOOK_TYPE_IPSEC_OUT;
  201  * + from hhook_id we can determine address family: AF_INET or AF_INET6;
  202  * + udata contains pointer to enc_softc;
  203  * + ctx_data contains pointer to struct ipsec_ctx_data.
  204  */
  205 static int
  206 enc_hhook(int32_t hhook_type, int32_t hhook_id, void *udata, void *ctx_data,
  207     void *hdata, struct osd *hosd)
  208 {
  209         struct enchdr hdr;
  210         struct ipsec_ctx_data *ctx;
  211         struct enc_softc *sc;
  212         struct ifnet *ifp, *rcvif;
  213         struct pfil_head *ph;
  214         int pdir;
  215 
  216         sc = (struct enc_softc *)udata;
  217         ifp = sc->sc_ifp;
  218         if ((ifp->if_flags & IFF_UP) == 0)
  219                 return (0);
  220 
  221         ctx = (struct ipsec_ctx_data *)ctx_data;
  222         /* XXX: wrong hook point was used by caller? */
  223         if (ctx->af != hhook_id)
  224                 return (EPFNOSUPPORT);
  225 
  226         if (((hhook_type == HHOOK_TYPE_IPSEC_IN &&
  227             (ctx->enc & V_bpf_mask_in) != 0) ||
  228             (hhook_type == HHOOK_TYPE_IPSEC_OUT &&
  229             (ctx->enc & V_bpf_mask_out) != 0)) &&
  230             bpf_peers_present(ifp->if_bpf) != 0) {
  231                 hdr.af = ctx->af;
  232                 hdr.spi = ctx->sav->spi;
  233                 hdr.flags = 0;
  234                 if (ctx->sav->alg_enc != SADB_EALG_NONE)
  235                         hdr.flags |= M_CONF;
  236                 if (ctx->sav->alg_auth != SADB_AALG_NONE)
  237                         hdr.flags |= M_AUTH;
  238                 bpf_mtap2(ifp->if_bpf, &hdr, sizeof(hdr), *ctx->mp);
  239         }
  240 
  241         switch (hhook_type) {
  242         case HHOOK_TYPE_IPSEC_IN:
  243                 if (ctx->enc == IPSEC_ENC_BEFORE) {
  244                         /* Do accounting only once */
  245                         if_inc_counter(ifp, IFCOUNTER_IPACKETS, 1);
  246                         if_inc_counter(ifp, IFCOUNTER_IBYTES,
  247                             (*ctx->mp)->m_pkthdr.len);
  248                 }
  249                 if ((ctx->enc & V_filter_mask_in) == 0)
  250                         return (0); /* skip pfil processing */
  251                 pdir = PFIL_IN;
  252                 break;
  253         case HHOOK_TYPE_IPSEC_OUT:
  254                 if (ctx->enc == IPSEC_ENC_BEFORE) {
  255                         /* Do accounting only once */
  256                         if_inc_counter(ifp, IFCOUNTER_OPACKETS, 1);
  257                         if_inc_counter(ifp, IFCOUNTER_OBYTES,
  258                             (*ctx->mp)->m_pkthdr.len);
  259                 }
  260                 if ((ctx->enc & V_filter_mask_out) == 0)
  261                         return (0); /* skip pfil processing */
  262                 pdir = PFIL_OUT;
  263                 break;
  264         default:
  265                 return (EINVAL);
  266         }
  267 
  268         switch (hhook_id) {
  269 #ifdef INET
  270         case AF_INET:
  271                 ph = &V_inet_pfil_hook;
  272                 break;
  273 #endif
  274 #ifdef INET6
  275         case AF_INET6:
  276                 ph = &V_inet6_pfil_hook;
  277                 break;
  278 #endif
  279         default:
  280                 ph = NULL;
  281         }
  282         if (ph == NULL || !PFIL_HOOKED(ph))
  283                 return (0);
  284         /* Make a packet looks like it was received on enc(4) */
  285         rcvif = (*ctx->mp)->m_pkthdr.rcvif;
  286         (*ctx->mp)->m_pkthdr.rcvif = ifp;
  287         if (pfil_run_hooks(ph, ctx->mp, ifp, pdir, NULL) != 0 ||
  288             *ctx->mp == NULL) {
  289                 *ctx->mp = NULL; /* consumed by filter */
  290                 return (EACCES);
  291         }
  292         (*ctx->mp)->m_pkthdr.rcvif = rcvif;
  293         return (0);
  294 }
  295 
  296 static int
  297 enc_add_hhooks(struct enc_softc *sc)
  298 {
  299         struct hookinfo hki;
  300         int error;
  301 
  302         error = EPFNOSUPPORT;
  303         hki.hook_func = enc_hhook;
  304         hki.hook_helper = NULL;
  305         hki.hook_udata = sc;
  306 #ifdef INET
  307         hki.hook_id = AF_INET;
  308         hki.hook_type = HHOOK_TYPE_IPSEC_IN;
  309         error = hhook_add_hook(V_ipsec_hhh_in[HHOOK_IPSEC_INET],
  310             &hki, HHOOK_WAITOK);
  311         if (error != 0)
  312                 return (error);
  313         hki.hook_type = HHOOK_TYPE_IPSEC_OUT;
  314         error = hhook_add_hook(V_ipsec_hhh_out[HHOOK_IPSEC_INET],
  315             &hki, HHOOK_WAITOK);
  316         if (error != 0)
  317                 return (error);
  318 #endif
  319 #ifdef INET6
  320         hki.hook_id = AF_INET6;
  321         hki.hook_type = HHOOK_TYPE_IPSEC_IN;
  322         error = hhook_add_hook(V_ipsec_hhh_in[HHOOK_IPSEC_INET6],
  323             &hki, HHOOK_WAITOK);
  324         if (error != 0)
  325                 return (error);
  326         hki.hook_type = HHOOK_TYPE_IPSEC_OUT;
  327         error = hhook_add_hook(V_ipsec_hhh_out[HHOOK_IPSEC_INET6],
  328             &hki, HHOOK_WAITOK);
  329         if (error != 0)
  330                 return (error);
  331 #endif
  332         return (error);
  333 }
  334 
  335 static void
  336 enc_remove_hhooks(struct enc_softc *sc)
  337 {
  338         struct hookinfo hki;
  339 
  340         hki.hook_func = enc_hhook;
  341         hki.hook_helper = NULL;
  342         hki.hook_udata = sc;
  343 #ifdef INET
  344         hki.hook_id = AF_INET;
  345         hki.hook_type = HHOOK_TYPE_IPSEC_IN;
  346         hhook_remove_hook(V_ipsec_hhh_in[HHOOK_IPSEC_INET], &hki);
  347         hki.hook_type = HHOOK_TYPE_IPSEC_OUT;
  348         hhook_remove_hook(V_ipsec_hhh_out[HHOOK_IPSEC_INET], &hki);
  349 #endif
  350 #ifdef INET6
  351         hki.hook_id = AF_INET6;
  352         hki.hook_type = HHOOK_TYPE_IPSEC_IN;
  353         hhook_remove_hook(V_ipsec_hhh_in[HHOOK_IPSEC_INET6], &hki);
  354         hki.hook_type = HHOOK_TYPE_IPSEC_OUT;
  355         hhook_remove_hook(V_ipsec_hhh_out[HHOOK_IPSEC_INET6], &hki);
  356 #endif
  357 }
  358 
  359 static void
  360 vnet_enc_init(const void *unused __unused)
  361 {
  362 
  363         V_enc_sc = NULL;
  364         V_enc_cloner = if_clone_simple(encname, enc_clone_create,
  365             enc_clone_destroy, 1);
  366 }
  367 VNET_SYSINIT(vnet_enc_init, SI_SUB_PSEUDO, SI_ORDER_ANY,
  368     vnet_enc_init, NULL);
  369 
  370 static void
  371 vnet_enc_init_proto(void *unused __unused)
  372 {
  373         KASSERT(V_enc_sc != NULL, ("%s: V_enc_sc is %p\n", __func__, V_enc_sc));
  374 
  375         if (enc_add_hhooks(V_enc_sc) != 0)
  376                 enc_clone_destroy(V_enc_sc->sc_ifp);
  377 }
  378 VNET_SYSINIT(vnet_enc_init_proto, SI_SUB_PROTO_IFATTACHDOMAIN, SI_ORDER_ANY,
  379     vnet_enc_init_proto, NULL);
  380 
  381 static void
  382 vnet_enc_uninit(const void *unused __unused)
  383 {
  384         KASSERT(V_enc_sc != NULL, ("%s: V_enc_sc is %p\n", __func__, V_enc_sc));
  385 
  386         if_clone_detach(V_enc_cloner);
  387 }
  388 VNET_SYSUNINIT(vnet_enc_uninit, SI_SUB_INIT_IF, SI_ORDER_ANY,
  389     vnet_enc_uninit, NULL);
  390 
  391 /*
  392  * The hhook consumer needs to go before ip[6]_destroy are called on
  393  * SI_ORDER_THIRD.
  394  */
  395 static void
  396 vnet_enc_uninit_hhook(const void *unused __unused)
  397 {
  398         KASSERT(V_enc_sc != NULL, ("%s: V_enc_sc is %p\n", __func__, V_enc_sc));
  399 
  400         enc_remove_hhooks(V_enc_sc);
  401 }
  402 VNET_SYSUNINIT(vnet_enc_uninit_hhook, SI_SUB_PROTO_DOMAIN, SI_ORDER_FOURTH,
  403     vnet_enc_uninit_hhook, NULL);
  404 
  405 static int
  406 enc_modevent(module_t mod, int type, void *data)
  407 {
  408 
  409         switch (type) {
  410         case MOD_LOAD:
  411         case MOD_UNLOAD:
  412                 break;
  413         default:
  414                 return (EOPNOTSUPP);
  415         }
  416         return (0);
  417 }
  418 
  419 static moduledata_t enc_mod = {
  420         "if_enc",
  421         enc_modevent,
  422         0
  423 };
  424 
  425 DECLARE_MODULE(if_enc, enc_mod, SI_SUB_PSEUDO, SI_ORDER_ANY);

Cache object: 978aee78e12402d4bbcd38a791be0b5e


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]


This page is part of the FreeBSD/Linux Linux Kernel Cross-Reference, and was automatically generated using a modified version of the LXR engine.