FreeBSD/Linux Kernel Cross Reference
sys/net/if_enc.c
1 /*-
2 * Copyright (c) 2006 The FreeBSD Project.
3 * Copyright (c) 2015 Andrey V. Elsukov <ae@FreeBSD.org>
4 * All rights reserved.
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 *
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution.
15 *
16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
17 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
18 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
19 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
20 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
21 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
22 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
24 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
25 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26 * SUCH DAMAGE.
27 *
28 * $FreeBSD$
29 */
30
31 #include "opt_inet.h"
32 #include "opt_inet6.h"
33 #include "opt_ipsec.h"
34
35 #include <sys/param.h>
36 #include <sys/systm.h>
37 #include <sys/hhook.h>
38 #include <sys/kernel.h>
39 #include <sys/malloc.h>
40 #include <sys/mbuf.h>
41 #include <sys/module.h>
42 #include <machine/bus.h>
43 #include <sys/rman.h>
44 #include <sys/socket.h>
45 #include <sys/sockio.h>
46 #include <sys/sysctl.h>
47
48 #include <net/if.h>
49 #include <net/if_enc.h>
50 #include <net/if_var.h>
51 #include <net/if_clone.h>
52 #include <net/if_types.h>
53 #include <net/pfil.h>
54 #include <net/route.h>
55 #include <net/netisr.h>
56 #include <net/bpf.h>
57 #include <net/vnet.h>
58
59 #include <netinet/in.h>
60 #include <netinet/in_systm.h>
61 #include <netinet/ip.h>
62 #include <netinet/ip_var.h>
63 #include <netinet/in_var.h>
64
65 #ifdef INET6
66 #include <netinet/ip6.h>
67 #include <netinet6/ip6_var.h>
68 #endif
69
70 #include <netipsec/ipsec.h>
71 #include <netipsec/xform.h>
72
73 #define ENCMTU (1024+512)
74
75 /* XXX this define must have the same value as in OpenBSD */
76 #define M_CONF 0x0400 /* payload was encrypted (ESP-transport) */
77 #define M_AUTH 0x0800 /* payload was authenticated (AH or ESP auth) */
78 #define M_AUTH_AH 0x2000 /* header was authenticated (AH) */
79
80 struct enchdr {
81 u_int32_t af;
82 u_int32_t spi;
83 u_int32_t flags;
84 };
85 struct enc_softc {
86 struct ifnet *sc_ifp;
87 };
88 static VNET_DEFINE(struct enc_softc *, enc_sc);
89 #define V_enc_sc VNET(enc_sc)
90 static VNET_DEFINE(struct if_clone *, enc_cloner);
91 #define V_enc_cloner VNET(enc_cloner)
92
93 static int enc_ioctl(struct ifnet *, u_long, caddr_t);
94 static int enc_output(struct ifnet *, struct mbuf *,
95 const struct sockaddr *, struct route *);
96 static int enc_clone_create(struct if_clone *, int, caddr_t);
97 static void enc_clone_destroy(struct ifnet *);
98 static int enc_add_hhooks(struct enc_softc *);
99 static void enc_remove_hhooks(struct enc_softc *);
100
101 static const char encname[] = "enc";
102
103 #define IPSEC_ENC_AFTER_PFIL 0x04
104 /*
105 * Before and after are relative to when we are stripping the
106 * outer IP header.
107 *
108 * AFTER_PFIL flag used only for bpf_mask_*. It enables BPF capturing
109 * after PFIL hook execution. It might be useful when PFIL hook does
110 * some changes to the packet, e.g. address translation. If PFIL hook
111 * consumes mbuf, nothing will be captured.
112 */
113 static VNET_DEFINE(int, filter_mask_in) = IPSEC_ENC_BEFORE;
114 static VNET_DEFINE(int, bpf_mask_in) = IPSEC_ENC_BEFORE;
115 static VNET_DEFINE(int, filter_mask_out) = IPSEC_ENC_BEFORE;
116 static VNET_DEFINE(int, bpf_mask_out) = IPSEC_ENC_BEFORE | IPSEC_ENC_AFTER;
117 #define V_filter_mask_in VNET(filter_mask_in)
118 #define V_bpf_mask_in VNET(bpf_mask_in)
119 #define V_filter_mask_out VNET(filter_mask_out)
120 #define V_bpf_mask_out VNET(bpf_mask_out)
121
122 static SYSCTL_NODE(_net, OID_AUTO, enc, CTLFLAG_RW, 0, "enc sysctl");
123 static SYSCTL_NODE(_net_enc, OID_AUTO, in, CTLFLAG_RW, 0, "enc input sysctl");
124 static SYSCTL_NODE(_net_enc, OID_AUTO, out, CTLFLAG_RW, 0, "enc output sysctl");
125 SYSCTL_INT(_net_enc_in, OID_AUTO, ipsec_filter_mask,
126 CTLFLAG_RW | CTLFLAG_VNET, &VNET_NAME(filter_mask_in), 0,
127 "IPsec input firewall filter mask");
128 SYSCTL_INT(_net_enc_in, OID_AUTO, ipsec_bpf_mask,
129 CTLFLAG_RW | CTLFLAG_VNET, &VNET_NAME(bpf_mask_in), 0,
130 "IPsec input bpf mask");
131 SYSCTL_INT(_net_enc_out, OID_AUTO, ipsec_filter_mask,
132 CTLFLAG_RW | CTLFLAG_VNET, &VNET_NAME(filter_mask_out), 0,
133 "IPsec output firewall filter mask");
134 SYSCTL_INT(_net_enc_out, OID_AUTO, ipsec_bpf_mask,
135 CTLFLAG_RW | CTLFLAG_VNET, &VNET_NAME(bpf_mask_out), 0,
136 "IPsec output bpf mask");
137
138 static void
139 enc_clone_destroy(struct ifnet *ifp)
140 {
141 struct enc_softc *sc;
142
143 sc = ifp->if_softc;
144 KASSERT(sc == V_enc_sc, ("sc != ifp->if_softc"));
145
146 bpfdetach(ifp);
147 if_detach(ifp);
148 if_free(ifp);
149 free(sc, M_DEVBUF);
150 V_enc_sc = NULL;
151 }
152
153 static int
154 enc_clone_create(struct if_clone *ifc, int unit, caddr_t params)
155 {
156 struct ifnet *ifp;
157 struct enc_softc *sc;
158
159 sc = malloc(sizeof(struct enc_softc), M_DEVBUF,
160 M_WAITOK | M_ZERO);
161 ifp = sc->sc_ifp = if_alloc(IFT_ENC);
162 if (ifp == NULL) {
163 free(sc, M_DEVBUF);
164 return (ENOSPC);
165 }
166 if (V_enc_sc != NULL) {
167 if_free(ifp);
168 free(sc, M_DEVBUF);
169 return (EEXIST);
170 }
171 V_enc_sc = sc;
172 if_initname(ifp, encname, unit);
173 ifp->if_mtu = ENCMTU;
174 ifp->if_ioctl = enc_ioctl;
175 ifp->if_output = enc_output;
176 ifp->if_softc = sc;
177 if_attach(ifp);
178 bpfattach(ifp, DLT_ENC, sizeof(struct enchdr));
179 return (0);
180 }
181
182 static int
183 enc_output(struct ifnet *ifp, struct mbuf *m, const struct sockaddr *dst,
184 struct route *ro)
185 {
186
187 m_freem(m);
188 return (0);
189 }
190
191 static int
192 enc_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
193 {
194
195 if (cmd != SIOCSIFFLAGS)
196 return (EINVAL);
197 if (ifp->if_flags & IFF_UP)
198 ifp->if_drv_flags |= IFF_DRV_RUNNING;
199 else
200 ifp->if_drv_flags &= ~IFF_DRV_RUNNING;
201 return (0);
202 }
203
204 static void
205 enc_bpftap(struct ifnet *ifp, struct mbuf *m, const struct secasvar *sav,
206 int32_t hhook_type, uint8_t enc, uint8_t af)
207 {
208 struct enchdr hdr;
209
210 if (hhook_type == HHOOK_TYPE_IPSEC_IN &&
211 (enc & V_bpf_mask_in) == 0)
212 return;
213 else if (hhook_type == HHOOK_TYPE_IPSEC_OUT &&
214 (enc & V_bpf_mask_out) == 0)
215 return;
216 if (bpf_peers_present(ifp->if_bpf) == 0)
217 return;
218 hdr.af = af;
219 hdr.spi = sav->spi;
220 hdr.flags = 0;
221 if (sav->alg_enc != SADB_EALG_NONE)
222 hdr.flags |= M_CONF;
223 if (sav->alg_auth != SADB_AALG_NONE)
224 hdr.flags |= M_AUTH;
225 bpf_mtap2(ifp->if_bpf, &hdr, sizeof(hdr), m);
226 }
227
228 /*
229 * One helper hook function is used by any hook points.
230 * + from hhook_type we can determine the packet direction:
231 * HHOOK_TYPE_IPSEC_IN or HHOOK_TYPE_IPSEC_OUT;
232 * + from hhook_id we can determine address family: AF_INET or AF_INET6;
233 * + udata contains pointer to enc_softc;
234 * + ctx_data contains pointer to struct ipsec_ctx_data.
235 */
236 static int
237 enc_hhook(int32_t hhook_type, int32_t hhook_id, void *udata, void *ctx_data,
238 void *hdata, struct osd *hosd)
239 {
240 struct ipsec_ctx_data *ctx;
241 struct enc_softc *sc;
242 struct ifnet *ifp, *rcvif;
243 struct pfil_head *ph;
244 int pdir;
245
246 sc = (struct enc_softc *)udata;
247 ifp = sc->sc_ifp;
248 if ((ifp->if_flags & IFF_UP) == 0)
249 return (0);
250
251 ctx = (struct ipsec_ctx_data *)ctx_data;
252 /* XXX: wrong hook point was used by caller? */
253 if (ctx->af != hhook_id)
254 return (EPFNOSUPPORT);
255
256 enc_bpftap(ifp, *ctx->mp, ctx->sav, hhook_type, ctx->enc, ctx->af);
257 switch (hhook_type) {
258 case HHOOK_TYPE_IPSEC_IN:
259 if (ctx->enc == IPSEC_ENC_BEFORE) {
260 /* Do accounting only once */
261 if_inc_counter(ifp, IFCOUNTER_IPACKETS, 1);
262 if_inc_counter(ifp, IFCOUNTER_IBYTES,
263 (*ctx->mp)->m_pkthdr.len);
264 }
265 if ((ctx->enc & V_filter_mask_in) == 0)
266 return (0); /* skip pfil processing */
267 pdir = PFIL_IN;
268 break;
269 case HHOOK_TYPE_IPSEC_OUT:
270 if (ctx->enc == IPSEC_ENC_BEFORE) {
271 /* Do accounting only once */
272 if_inc_counter(ifp, IFCOUNTER_OPACKETS, 1);
273 if_inc_counter(ifp, IFCOUNTER_OBYTES,
274 (*ctx->mp)->m_pkthdr.len);
275 }
276 if ((ctx->enc & V_filter_mask_out) == 0)
277 return (0); /* skip pfil processing */
278 pdir = PFIL_OUT;
279 break;
280 default:
281 return (EINVAL);
282 }
283
284 switch (hhook_id) {
285 #ifdef INET
286 case AF_INET:
287 ph = &V_inet_pfil_hook;
288 break;
289 #endif
290 #ifdef INET6
291 case AF_INET6:
292 ph = &V_inet6_pfil_hook;
293 break;
294 #endif
295 default:
296 ph = NULL;
297 }
298 if (ph == NULL || !PFIL_HOOKED(ph))
299 return (0);
300 /* Make a packet looks like it was received on enc(4) */
301 rcvif = (*ctx->mp)->m_pkthdr.rcvif;
302 (*ctx->mp)->m_pkthdr.rcvif = ifp;
303 if (pfil_run_hooks(ph, ctx->mp, ifp, pdir, 0, ctx->inp) != 0 ||
304 *ctx->mp == NULL) {
305 *ctx->mp = NULL; /* consumed by filter */
306 return (EACCES);
307 }
308 (*ctx->mp)->m_pkthdr.rcvif = rcvif;
309 enc_bpftap(ifp, *ctx->mp, ctx->sav, hhook_type,
310 IPSEC_ENC_AFTER_PFIL, ctx->af);
311 return (0);
312 }
313
314 static int
315 enc_add_hhooks(struct enc_softc *sc)
316 {
317 struct hookinfo hki;
318 int error;
319
320 error = EPFNOSUPPORT;
321 hki.hook_func = enc_hhook;
322 hki.hook_helper = NULL;
323 hki.hook_udata = sc;
324 #ifdef INET
325 hki.hook_id = AF_INET;
326 hki.hook_type = HHOOK_TYPE_IPSEC_IN;
327 error = hhook_add_hook(V_ipsec_hhh_in[HHOOK_IPSEC_INET],
328 &hki, HHOOK_WAITOK);
329 if (error != 0)
330 return (error);
331 hki.hook_type = HHOOK_TYPE_IPSEC_OUT;
332 error = hhook_add_hook(V_ipsec_hhh_out[HHOOK_IPSEC_INET],
333 &hki, HHOOK_WAITOK);
334 if (error != 0)
335 return (error);
336 #endif
337 #ifdef INET6
338 hki.hook_id = AF_INET6;
339 hki.hook_type = HHOOK_TYPE_IPSEC_IN;
340 error = hhook_add_hook(V_ipsec_hhh_in[HHOOK_IPSEC_INET6],
341 &hki, HHOOK_WAITOK);
342 if (error != 0)
343 return (error);
344 hki.hook_type = HHOOK_TYPE_IPSEC_OUT;
345 error = hhook_add_hook(V_ipsec_hhh_out[HHOOK_IPSEC_INET6],
346 &hki, HHOOK_WAITOK);
347 if (error != 0)
348 return (error);
349 #endif
350 return (error);
351 }
352
353 static void
354 enc_remove_hhooks(struct enc_softc *sc)
355 {
356 struct hookinfo hki;
357
358 hki.hook_func = enc_hhook;
359 hki.hook_helper = NULL;
360 hki.hook_udata = sc;
361 #ifdef INET
362 hki.hook_id = AF_INET;
363 hki.hook_type = HHOOK_TYPE_IPSEC_IN;
364 hhook_remove_hook(V_ipsec_hhh_in[HHOOK_IPSEC_INET], &hki);
365 hki.hook_type = HHOOK_TYPE_IPSEC_OUT;
366 hhook_remove_hook(V_ipsec_hhh_out[HHOOK_IPSEC_INET], &hki);
367 #endif
368 #ifdef INET6
369 hki.hook_id = AF_INET6;
370 hki.hook_type = HHOOK_TYPE_IPSEC_IN;
371 hhook_remove_hook(V_ipsec_hhh_in[HHOOK_IPSEC_INET6], &hki);
372 hki.hook_type = HHOOK_TYPE_IPSEC_OUT;
373 hhook_remove_hook(V_ipsec_hhh_out[HHOOK_IPSEC_INET6], &hki);
374 #endif
375 }
376
377 static void
378 vnet_enc_init(const void *unused __unused)
379 {
380
381 V_enc_sc = NULL;
382 V_enc_cloner = if_clone_simple(encname, enc_clone_create,
383 enc_clone_destroy, 1);
384 }
385 VNET_SYSINIT(vnet_enc_init, SI_SUB_PSEUDO, SI_ORDER_ANY,
386 vnet_enc_init, NULL);
387
388 static void
389 vnet_enc_init_proto(void *unused __unused)
390 {
391 KASSERT(V_enc_sc != NULL, ("%s: V_enc_sc is %p\n", __func__, V_enc_sc));
392
393 if (enc_add_hhooks(V_enc_sc) != 0)
394 enc_clone_destroy(V_enc_sc->sc_ifp);
395 }
396 VNET_SYSINIT(vnet_enc_init_proto, SI_SUB_PROTO_IFATTACHDOMAIN, SI_ORDER_ANY,
397 vnet_enc_init_proto, NULL);
398
399 static void
400 vnet_enc_uninit(const void *unused __unused)
401 {
402 KASSERT(V_enc_sc != NULL, ("%s: V_enc_sc is %p\n", __func__, V_enc_sc));
403
404 if_clone_detach(V_enc_cloner);
405 }
406 VNET_SYSUNINIT(vnet_enc_uninit, SI_SUB_INIT_IF, SI_ORDER_ANY,
407 vnet_enc_uninit, NULL);
408
409 /*
410 * The hhook consumer needs to go before ip[6]_destroy are called on
411 * SI_ORDER_THIRD.
412 */
413 static void
414 vnet_enc_uninit_hhook(const void *unused __unused)
415 {
416 KASSERT(V_enc_sc != NULL, ("%s: V_enc_sc is %p\n", __func__, V_enc_sc));
417
418 enc_remove_hhooks(V_enc_sc);
419 }
420 VNET_SYSUNINIT(vnet_enc_uninit_hhook, SI_SUB_PROTO_DOMAIN, SI_ORDER_FOURTH,
421 vnet_enc_uninit_hhook, NULL);
422
423 static int
424 enc_modevent(module_t mod, int type, void *data)
425 {
426
427 switch (type) {
428 case MOD_LOAD:
429 case MOD_UNLOAD:
430 break;
431 default:
432 return (EOPNOTSUPP);
433 }
434 return (0);
435 }
436
437 static moduledata_t enc_mod = {
438 "if_enc",
439 enc_modevent,
440 0
441 };
442
443 DECLARE_MODULE(if_enc, enc_mod, SI_SUB_PSEUDO, SI_ORDER_ANY);
444 MODULE_VERSION(if_enc, 1);
Cache object: 3a8bfab19fb19b784543f9c758ce43d5
|