The Design and Implementation of the FreeBSD Operating System, Second Edition
Now available: The Design and Implementation of the FreeBSD Operating System (Second Edition)


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]

FreeBSD/Linux Kernel Cross Reference
sys/net/if_enc.c

Version: -  FREEBSD  -  FREEBSD-13-STABLE  -  FREEBSD-13-0  -  FREEBSD-12-STABLE  -  FREEBSD-12-0  -  FREEBSD-11-STABLE  -  FREEBSD-11-0  -  FREEBSD-10-STABLE  -  FREEBSD-10-0  -  FREEBSD-9-STABLE  -  FREEBSD-9-0  -  FREEBSD-8-STABLE  -  FREEBSD-8-0  -  FREEBSD-7-STABLE  -  FREEBSD-7-0  -  FREEBSD-6-STABLE  -  FREEBSD-6-0  -  FREEBSD-5-STABLE  -  FREEBSD-5-0  -  FREEBSD-4-STABLE  -  FREEBSD-3-STABLE  -  FREEBSD22  -  l41  -  OPENBSD  -  linux-2.6  -  MK84  -  PLAN9  -  xnu-8792 
SearchContext: -  none  -  3  -  10 

    1 /*-
    2  * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
    3  *
    4  * Copyright (c) 2006 The FreeBSD Project.
    5  * Copyright (c) 2015 Andrey V. Elsukov <ae@FreeBSD.org>
    6  * All rights reserved.
    7  *
    8  * Redistribution and use in source and binary forms, with or without
    9  * modification, are permitted provided that the following conditions
   10  * are met:
   11  *
   12  * 1. Redistributions of source code must retain the above copyright
   13  *    notice, this list of conditions and the following disclaimer.
   14  * 2. Redistributions in binary form must reproduce the above copyright
   15  *    notice, this list of conditions and the following disclaimer in the
   16  *    documentation and/or other materials provided with the distribution.
   17  *
   18  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
   19  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
   20  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
   21  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
   22  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
   23  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
   24  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
   25  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
   26  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
   27  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
   28  * SUCH DAMAGE.
   29  *
   30  * $FreeBSD$
   31  */
   32 
   33 #include "opt_inet.h"
   34 #include "opt_inet6.h"
   35 #include "opt_ipsec.h"
   36 
   37 #include <sys/param.h>
   38 #include <sys/systm.h>
   39 #include <sys/hhook.h>
   40 #include <sys/kernel.h>
   41 #include <sys/malloc.h>
   42 #include <sys/mbuf.h>
   43 #include <sys/module.h>
   44 #include <machine/bus.h>
   45 #include <sys/rman.h>
   46 #include <sys/socket.h>
   47 #include <sys/sockio.h>
   48 #include <sys/sysctl.h>
   49 
   50 #include <net/if.h>
   51 #include <net/if_enc.h>
   52 #include <net/if_var.h>
   53 #include <net/if_clone.h>
   54 #include <net/if_types.h>
   55 #include <net/pfil.h>
   56 #include <net/route.h>
   57 #include <net/netisr.h>
   58 #include <net/bpf.h>
   59 #include <net/vnet.h>
   60 
   61 #include <netinet/in.h>
   62 #include <netinet/in_systm.h>
   63 #include <netinet/ip.h>
   64 #include <netinet/ip_var.h>
   65 #include <netinet/in_var.h>
   66 
   67 #ifdef INET6
   68 #include <netinet/ip6.h>
   69 #include <netinet6/ip6_var.h>
   70 #endif
   71 
   72 #include <netipsec/ipsec.h>
   73 #include <netipsec/xform.h>
   74 
   75 #define ENCMTU          (1024+512)
   76 
   77 /* XXX this define must have the same value as in OpenBSD */
   78 #define M_CONF          0x0400  /* payload was encrypted (ESP-transport) */
   79 #define M_AUTH          0x0800  /* payload was authenticated (AH or ESP auth) */
   80 #define M_AUTH_AH       0x2000  /* header was authenticated (AH) */
   81 
   82 struct enchdr {
   83         u_int32_t af;
   84         u_int32_t spi;
   85         u_int32_t flags;
   86 };
   87 struct enc_softc {
   88         struct  ifnet *sc_ifp;
   89 };
   90 VNET_DEFINE_STATIC(struct enc_softc *, enc_sc);
   91 #define V_enc_sc        VNET(enc_sc)
   92 VNET_DEFINE_STATIC(struct if_clone *, enc_cloner);
   93 #define V_enc_cloner    VNET(enc_cloner)
   94 
   95 static int      enc_ioctl(struct ifnet *, u_long, caddr_t);
   96 static int      enc_output(struct ifnet *, struct mbuf *,
   97     const struct sockaddr *, struct route *);
   98 static int      enc_clone_create(struct if_clone *, int, caddr_t);
   99 static void     enc_clone_destroy(struct ifnet *);
  100 static int      enc_add_hhooks(struct enc_softc *);
  101 static void     enc_remove_hhooks(struct enc_softc *);
  102 
  103 static const char encname[] = "enc";
  104 
  105 #define IPSEC_ENC_AFTER_PFIL    0x04
  106 /*
  107  * Before and after are relative to when we are stripping the
  108  * outer IP header.
  109  *
  110  * AFTER_PFIL flag used only for bpf_mask_*. It enables BPF capturing
  111  * after PFIL hook execution. It might be useful when PFIL hook does
  112  * some changes to the packet, e.g. address translation. If PFIL hook
  113  * consumes mbuf, nothing will be captured.
  114  */
  115 VNET_DEFINE_STATIC(int, filter_mask_in) = IPSEC_ENC_BEFORE;
  116 VNET_DEFINE_STATIC(int, bpf_mask_in) = IPSEC_ENC_BEFORE;
  117 VNET_DEFINE_STATIC(int, filter_mask_out) = IPSEC_ENC_BEFORE;
  118 VNET_DEFINE_STATIC(int, bpf_mask_out) = IPSEC_ENC_BEFORE | IPSEC_ENC_AFTER;
  119 #define V_filter_mask_in        VNET(filter_mask_in)
  120 #define V_bpf_mask_in           VNET(bpf_mask_in)
  121 #define V_filter_mask_out       VNET(filter_mask_out)
  122 #define V_bpf_mask_out          VNET(bpf_mask_out)
  123 
  124 static SYSCTL_NODE(_net, OID_AUTO, enc, CTLFLAG_RW, 0, "enc sysctl");
  125 static SYSCTL_NODE(_net_enc, OID_AUTO, in, CTLFLAG_RW, 0, "enc input sysctl");
  126 static SYSCTL_NODE(_net_enc, OID_AUTO, out, CTLFLAG_RW, 0, "enc output sysctl");
  127 SYSCTL_INT(_net_enc_in, OID_AUTO, ipsec_filter_mask,
  128     CTLFLAG_RW | CTLFLAG_VNET, &VNET_NAME(filter_mask_in), 0,
  129     "IPsec input firewall filter mask");
  130 SYSCTL_INT(_net_enc_in, OID_AUTO, ipsec_bpf_mask,
  131     CTLFLAG_RW | CTLFLAG_VNET, &VNET_NAME(bpf_mask_in), 0,
  132     "IPsec input bpf mask");
  133 SYSCTL_INT(_net_enc_out, OID_AUTO, ipsec_filter_mask,
  134     CTLFLAG_RW | CTLFLAG_VNET, &VNET_NAME(filter_mask_out), 0,
  135     "IPsec output firewall filter mask");
  136 SYSCTL_INT(_net_enc_out, OID_AUTO, ipsec_bpf_mask,
  137     CTLFLAG_RW | CTLFLAG_VNET, &VNET_NAME(bpf_mask_out), 0,
  138     "IPsec output bpf mask");
  139 
  140 static void
  141 enc_clone_destroy(struct ifnet *ifp)
  142 {
  143         struct enc_softc *sc;
  144 
  145         sc = ifp->if_softc;
  146         KASSERT(sc == V_enc_sc, ("sc != ifp->if_softc"));
  147 
  148         bpfdetach(ifp);
  149         if_detach(ifp);
  150         if_free(ifp);
  151         free(sc, M_DEVBUF);
  152         V_enc_sc = NULL;
  153 }
  154 
  155 static int
  156 enc_clone_create(struct if_clone *ifc, int unit, caddr_t params)
  157 {
  158         struct ifnet *ifp;
  159         struct enc_softc *sc;
  160 
  161         sc = malloc(sizeof(struct enc_softc), M_DEVBUF,
  162             M_WAITOK | M_ZERO);
  163         ifp = sc->sc_ifp = if_alloc(IFT_ENC);
  164         if (ifp == NULL) {
  165                 free(sc, M_DEVBUF);
  166                 return (ENOSPC);
  167         }
  168         if (V_enc_sc != NULL) {
  169                 if_free(ifp);
  170                 free(sc, M_DEVBUF);
  171                 return (EEXIST);
  172         }
  173         V_enc_sc = sc;
  174         if_initname(ifp, encname, unit);
  175         ifp->if_mtu = ENCMTU;
  176         ifp->if_ioctl = enc_ioctl;
  177         ifp->if_output = enc_output;
  178         ifp->if_softc = sc;
  179         if_attach(ifp);
  180         bpfattach(ifp, DLT_ENC, sizeof(struct enchdr));
  181         return (0);
  182 }
  183 
  184 static int
  185 enc_output(struct ifnet *ifp, struct mbuf *m, const struct sockaddr *dst,
  186     struct route *ro)
  187 {
  188 
  189         m_freem(m);
  190         return (0);
  191 }
  192 
  193 static int
  194 enc_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
  195 {
  196 
  197         if (cmd != SIOCSIFFLAGS)
  198                 return (EINVAL);
  199         if (ifp->if_flags & IFF_UP)
  200                 ifp->if_drv_flags |= IFF_DRV_RUNNING;
  201         else
  202                 ifp->if_drv_flags &= ~IFF_DRV_RUNNING;
  203         return (0);
  204 }
  205 
  206 static void
  207 enc_bpftap(struct ifnet *ifp, struct mbuf *m, const struct secasvar *sav,
  208     int32_t hhook_type, uint8_t enc, uint8_t af)
  209 {
  210         struct enchdr hdr;
  211 
  212         if (hhook_type == HHOOK_TYPE_IPSEC_IN &&
  213             (enc & V_bpf_mask_in) == 0)
  214                 return;
  215         else if (hhook_type == HHOOK_TYPE_IPSEC_OUT &&
  216             (enc & V_bpf_mask_out) == 0)
  217                 return;
  218         if (bpf_peers_present(ifp->if_bpf) == 0)
  219                 return;
  220         hdr.af = af;
  221         hdr.spi = sav->spi;
  222         hdr.flags = 0;
  223         if (sav->alg_enc != SADB_EALG_NONE)
  224                 hdr.flags |= M_CONF;
  225         if (sav->alg_auth != SADB_AALG_NONE)
  226                 hdr.flags |= M_AUTH;
  227         bpf_mtap2(ifp->if_bpf, &hdr, sizeof(hdr), m);
  228 }
  229 
  230 /*
  231  * One helper hook function is used by any hook points.
  232  * + from hhook_type we can determine the packet direction:
  233  *   HHOOK_TYPE_IPSEC_IN or HHOOK_TYPE_IPSEC_OUT;
  234  * + from hhook_id we can determine address family: AF_INET or AF_INET6;
  235  * + udata contains pointer to enc_softc;
  236  * + ctx_data contains pointer to struct ipsec_ctx_data.
  237  */
  238 static int
  239 enc_hhook(int32_t hhook_type, int32_t hhook_id, void *udata, void *ctx_data,
  240     void *hdata, struct osd *hosd)
  241 {
  242         struct ipsec_ctx_data *ctx;
  243         struct enc_softc *sc;
  244         struct ifnet *ifp, *rcvif;
  245         struct pfil_head *ph;
  246         int pdir;
  247 
  248         sc = (struct enc_softc *)udata;
  249         ifp = sc->sc_ifp;
  250         if ((ifp->if_flags & IFF_UP) == 0)
  251                 return (0);
  252 
  253         ctx = (struct ipsec_ctx_data *)ctx_data;
  254         /* XXX: wrong hook point was used by caller? */
  255         if (ctx->af != hhook_id)
  256                 return (EPFNOSUPPORT);
  257 
  258         enc_bpftap(ifp, *ctx->mp, ctx->sav, hhook_type, ctx->enc, ctx->af);
  259         switch (hhook_type) {
  260         case HHOOK_TYPE_IPSEC_IN:
  261                 if (ctx->enc == IPSEC_ENC_BEFORE) {
  262                         /* Do accounting only once */
  263                         if_inc_counter(ifp, IFCOUNTER_IPACKETS, 1);
  264                         if_inc_counter(ifp, IFCOUNTER_IBYTES,
  265                             (*ctx->mp)->m_pkthdr.len);
  266                 }
  267                 if ((ctx->enc & V_filter_mask_in) == 0)
  268                         return (0); /* skip pfil processing */
  269                 pdir = PFIL_IN;
  270                 break;
  271         case HHOOK_TYPE_IPSEC_OUT:
  272                 if (ctx->enc == IPSEC_ENC_BEFORE) {
  273                         /* Do accounting only once */
  274                         if_inc_counter(ifp, IFCOUNTER_OPACKETS, 1);
  275                         if_inc_counter(ifp, IFCOUNTER_OBYTES,
  276                             (*ctx->mp)->m_pkthdr.len);
  277                 }
  278                 if ((ctx->enc & V_filter_mask_out) == 0)
  279                         return (0); /* skip pfil processing */
  280                 pdir = PFIL_OUT;
  281                 break;
  282         default:
  283                 return (EINVAL);
  284         }
  285 
  286         switch (hhook_id) {
  287 #ifdef INET
  288         case AF_INET:
  289                 ph = &V_inet_pfil_hook;
  290                 break;
  291 #endif
  292 #ifdef INET6
  293         case AF_INET6:
  294                 ph = &V_inet6_pfil_hook;
  295                 break;
  296 #endif
  297         default:
  298                 ph = NULL;
  299         }
  300         if (ph == NULL || !PFIL_HOOKED(ph))
  301                 return (0);
  302         /* Make a packet looks like it was received on enc(4) */
  303         rcvif = (*ctx->mp)->m_pkthdr.rcvif;
  304         (*ctx->mp)->m_pkthdr.rcvif = ifp;
  305         if (pfil_run_hooks(ph, ctx->mp, ifp, pdir, 0, ctx->inp) != 0 ||
  306             *ctx->mp == NULL) {
  307                 *ctx->mp = NULL; /* consumed by filter */
  308                 return (EACCES);
  309         }
  310         (*ctx->mp)->m_pkthdr.rcvif = rcvif;
  311         enc_bpftap(ifp, *ctx->mp, ctx->sav, hhook_type,
  312             IPSEC_ENC_AFTER_PFIL, ctx->af);
  313         return (0);
  314 }
  315 
  316 static int
  317 enc_add_hhooks(struct enc_softc *sc)
  318 {
  319         struct hookinfo hki;
  320         int error;
  321 
  322         error = EPFNOSUPPORT;
  323         hki.hook_func = enc_hhook;
  324         hki.hook_helper = NULL;
  325         hki.hook_udata = sc;
  326 #ifdef INET
  327         hki.hook_id = AF_INET;
  328         hki.hook_type = HHOOK_TYPE_IPSEC_IN;
  329         error = hhook_add_hook(V_ipsec_hhh_in[HHOOK_IPSEC_INET],
  330             &hki, HHOOK_WAITOK);
  331         if (error != 0)
  332                 return (error);
  333         hki.hook_type = HHOOK_TYPE_IPSEC_OUT;
  334         error = hhook_add_hook(V_ipsec_hhh_out[HHOOK_IPSEC_INET],
  335             &hki, HHOOK_WAITOK);
  336         if (error != 0)
  337                 return (error);
  338 #endif
  339 #ifdef INET6
  340         hki.hook_id = AF_INET6;
  341         hki.hook_type = HHOOK_TYPE_IPSEC_IN;
  342         error = hhook_add_hook(V_ipsec_hhh_in[HHOOK_IPSEC_INET6],
  343             &hki, HHOOK_WAITOK);
  344         if (error != 0)
  345                 return (error);
  346         hki.hook_type = HHOOK_TYPE_IPSEC_OUT;
  347         error = hhook_add_hook(V_ipsec_hhh_out[HHOOK_IPSEC_INET6],
  348             &hki, HHOOK_WAITOK);
  349         if (error != 0)
  350                 return (error);
  351 #endif
  352         return (error);
  353 }
  354 
  355 static void
  356 enc_remove_hhooks(struct enc_softc *sc)
  357 {
  358         struct hookinfo hki;
  359 
  360         hki.hook_func = enc_hhook;
  361         hki.hook_helper = NULL;
  362         hki.hook_udata = sc;
  363 #ifdef INET
  364         hki.hook_id = AF_INET;
  365         hki.hook_type = HHOOK_TYPE_IPSEC_IN;
  366         hhook_remove_hook(V_ipsec_hhh_in[HHOOK_IPSEC_INET], &hki);
  367         hki.hook_type = HHOOK_TYPE_IPSEC_OUT;
  368         hhook_remove_hook(V_ipsec_hhh_out[HHOOK_IPSEC_INET], &hki);
  369 #endif
  370 #ifdef INET6
  371         hki.hook_id = AF_INET6;
  372         hki.hook_type = HHOOK_TYPE_IPSEC_IN;
  373         hhook_remove_hook(V_ipsec_hhh_in[HHOOK_IPSEC_INET6], &hki);
  374         hki.hook_type = HHOOK_TYPE_IPSEC_OUT;
  375         hhook_remove_hook(V_ipsec_hhh_out[HHOOK_IPSEC_INET6], &hki);
  376 #endif
  377 }
  378 
  379 static void
  380 vnet_enc_init(const void *unused __unused)
  381 {
  382 
  383         V_enc_sc = NULL;
  384         V_enc_cloner = if_clone_simple(encname, enc_clone_create,
  385             enc_clone_destroy, 1);
  386 }
  387 VNET_SYSINIT(vnet_enc_init, SI_SUB_PSEUDO, SI_ORDER_ANY,
  388     vnet_enc_init, NULL);
  389 
  390 static void
  391 vnet_enc_init_proto(void *unused __unused)
  392 {
  393         KASSERT(V_enc_sc != NULL, ("%s: V_enc_sc is %p\n", __func__, V_enc_sc));
  394 
  395         if (enc_add_hhooks(V_enc_sc) != 0)
  396                 enc_clone_destroy(V_enc_sc->sc_ifp);
  397 }
  398 VNET_SYSINIT(vnet_enc_init_proto, SI_SUB_PROTO_IFATTACHDOMAIN, SI_ORDER_ANY,
  399     vnet_enc_init_proto, NULL);
  400 
  401 static void
  402 vnet_enc_uninit(const void *unused __unused)
  403 {
  404         KASSERT(V_enc_sc != NULL, ("%s: V_enc_sc is %p\n", __func__, V_enc_sc));
  405 
  406         if_clone_detach(V_enc_cloner);
  407 }
  408 VNET_SYSUNINIT(vnet_enc_uninit, SI_SUB_INIT_IF, SI_ORDER_ANY,
  409     vnet_enc_uninit, NULL);
  410 
  411 /*
  412  * The hhook consumer needs to go before ip[6]_destroy are called on
  413  * SI_ORDER_THIRD.
  414  */
  415 static void
  416 vnet_enc_uninit_hhook(const void *unused __unused)
  417 {
  418         KASSERT(V_enc_sc != NULL, ("%s: V_enc_sc is %p\n", __func__, V_enc_sc));
  419 
  420         enc_remove_hhooks(V_enc_sc);
  421 }
  422 VNET_SYSUNINIT(vnet_enc_uninit_hhook, SI_SUB_PROTO_DOMAIN, SI_ORDER_FOURTH,
  423     vnet_enc_uninit_hhook, NULL);
  424 
  425 static int
  426 enc_modevent(module_t mod, int type, void *data)
  427 {
  428 
  429         switch (type) {
  430         case MOD_LOAD:
  431         case MOD_UNLOAD:
  432                 break;
  433         default:
  434                 return (EOPNOTSUPP);
  435         }
  436         return (0);
  437 }
  438 
  439 static moduledata_t enc_mod = {
  440         "if_enc",
  441         enc_modevent,
  442         0
  443 };
  444 
  445 DECLARE_MODULE(if_enc, enc_mod, SI_SUB_PSEUDO, SI_ORDER_ANY);
  446 MODULE_VERSION(if_enc, 1);

Cache object: fd3cbe035773495b01337b1a7af25a9c


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]


This page is part of the FreeBSD/Linux Linux Kernel Cross-Reference, and was automatically generated using a modified version of the LXR engine.