FreeBSD/Linux Kernel Cross Reference
sys/net/if_enc.c
1 /*-
2 * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
3 *
4 * Copyright (c) 2006 The FreeBSD Project.
5 * Copyright (c) 2015 Andrey V. Elsukov <ae@FreeBSD.org>
6 * All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 * 2. Redistributions in binary form must reproduce the above copyright
15 * notice, this list of conditions and the following disclaimer in the
16 * documentation and/or other materials provided with the distribution.
17 *
18 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
19 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
20 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
21 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
22 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
23 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
24 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
25 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
26 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
27 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
28 * SUCH DAMAGE.
29 *
30 * $FreeBSD$
31 */
32
33 #include "opt_inet.h"
34 #include "opt_inet6.h"
35 #include "opt_ipsec.h"
36
37 #include <sys/param.h>
38 #include <sys/systm.h>
39 #include <sys/hhook.h>
40 #include <sys/kernel.h>
41 #include <sys/malloc.h>
42 #include <sys/mbuf.h>
43 #include <sys/module.h>
44 #include <machine/bus.h>
45 #include <sys/rman.h>
46 #include <sys/socket.h>
47 #include <sys/sockio.h>
48 #include <sys/sysctl.h>
49
50 #include <net/if.h>
51 #include <net/if_enc.h>
52 #include <net/if_var.h>
53 #include <net/if_clone.h>
54 #include <net/if_types.h>
55 #include <net/pfil.h>
56 #include <net/route.h>
57 #include <net/netisr.h>
58 #include <net/bpf.h>
59 #include <net/vnet.h>
60
61 #include <netinet/in.h>
62 #include <netinet/in_systm.h>
63 #include <netinet/ip.h>
64 #include <netinet/ip_var.h>
65 #include <netinet/in_var.h>
66
67 #ifdef INET6
68 #include <netinet/ip6.h>
69 #include <netinet6/ip6_var.h>
70 #endif
71
72 #include <netipsec/ipsec.h>
73 #include <netipsec/xform.h>
74
75 #define ENCMTU (1024+512)
76
77 /* XXX this define must have the same value as in OpenBSD */
78 #define M_CONF 0x0400 /* payload was encrypted (ESP-transport) */
79 #define M_AUTH 0x0800 /* payload was authenticated (AH or ESP auth) */
80 #define M_AUTH_AH 0x2000 /* header was authenticated (AH) */
81
82 struct enchdr {
83 u_int32_t af;
84 u_int32_t spi;
85 u_int32_t flags;
86 };
87 struct enc_softc {
88 struct ifnet *sc_ifp;
89 };
90 VNET_DEFINE_STATIC(struct enc_softc *, enc_sc);
91 #define V_enc_sc VNET(enc_sc)
92 VNET_DEFINE_STATIC(struct if_clone *, enc_cloner);
93 #define V_enc_cloner VNET(enc_cloner)
94
95 static int enc_ioctl(struct ifnet *, u_long, caddr_t);
96 static int enc_output(struct ifnet *, struct mbuf *,
97 const struct sockaddr *, struct route *);
98 static int enc_clone_create(struct if_clone *, int, caddr_t);
99 static void enc_clone_destroy(struct ifnet *);
100 static int enc_add_hhooks(struct enc_softc *);
101 static void enc_remove_hhooks(struct enc_softc *);
102
103 static const char encname[] = "enc";
104
105 #define IPSEC_ENC_AFTER_PFIL 0x04
106 /*
107 * Before and after are relative to when we are stripping the
108 * outer IP header.
109 *
110 * AFTER_PFIL flag used only for bpf_mask_*. It enables BPF capturing
111 * after PFIL hook execution. It might be useful when PFIL hook does
112 * some changes to the packet, e.g. address translation. If PFIL hook
113 * consumes mbuf, nothing will be captured.
114 */
115 VNET_DEFINE_STATIC(int, filter_mask_in) = IPSEC_ENC_BEFORE;
116 VNET_DEFINE_STATIC(int, bpf_mask_in) = IPSEC_ENC_BEFORE;
117 VNET_DEFINE_STATIC(int, filter_mask_out) = IPSEC_ENC_BEFORE;
118 VNET_DEFINE_STATIC(int, bpf_mask_out) = IPSEC_ENC_BEFORE | IPSEC_ENC_AFTER;
119 #define V_filter_mask_in VNET(filter_mask_in)
120 #define V_bpf_mask_in VNET(bpf_mask_in)
121 #define V_filter_mask_out VNET(filter_mask_out)
122 #define V_bpf_mask_out VNET(bpf_mask_out)
123
124 static SYSCTL_NODE(_net, OID_AUTO, enc, CTLFLAG_RW, 0, "enc sysctl");
125 static SYSCTL_NODE(_net_enc, OID_AUTO, in, CTLFLAG_RW, 0, "enc input sysctl");
126 static SYSCTL_NODE(_net_enc, OID_AUTO, out, CTLFLAG_RW, 0, "enc output sysctl");
127 SYSCTL_INT(_net_enc_in, OID_AUTO, ipsec_filter_mask,
128 CTLFLAG_RW | CTLFLAG_VNET, &VNET_NAME(filter_mask_in), 0,
129 "IPsec input firewall filter mask");
130 SYSCTL_INT(_net_enc_in, OID_AUTO, ipsec_bpf_mask,
131 CTLFLAG_RW | CTLFLAG_VNET, &VNET_NAME(bpf_mask_in), 0,
132 "IPsec input bpf mask");
133 SYSCTL_INT(_net_enc_out, OID_AUTO, ipsec_filter_mask,
134 CTLFLAG_RW | CTLFLAG_VNET, &VNET_NAME(filter_mask_out), 0,
135 "IPsec output firewall filter mask");
136 SYSCTL_INT(_net_enc_out, OID_AUTO, ipsec_bpf_mask,
137 CTLFLAG_RW | CTLFLAG_VNET, &VNET_NAME(bpf_mask_out), 0,
138 "IPsec output bpf mask");
139
140 static void
141 enc_clone_destroy(struct ifnet *ifp)
142 {
143 struct enc_softc *sc;
144
145 sc = ifp->if_softc;
146 KASSERT(sc == V_enc_sc, ("sc != ifp->if_softc"));
147
148 bpfdetach(ifp);
149 if_detach(ifp);
150 if_free(ifp);
151 free(sc, M_DEVBUF);
152 V_enc_sc = NULL;
153 }
154
155 static int
156 enc_clone_create(struct if_clone *ifc, int unit, caddr_t params)
157 {
158 struct ifnet *ifp;
159 struct enc_softc *sc;
160
161 sc = malloc(sizeof(struct enc_softc), M_DEVBUF,
162 M_WAITOK | M_ZERO);
163 ifp = sc->sc_ifp = if_alloc(IFT_ENC);
164 if (ifp == NULL) {
165 free(sc, M_DEVBUF);
166 return (ENOSPC);
167 }
168 if (V_enc_sc != NULL) {
169 if_free(ifp);
170 free(sc, M_DEVBUF);
171 return (EEXIST);
172 }
173 V_enc_sc = sc;
174 if_initname(ifp, encname, unit);
175 ifp->if_mtu = ENCMTU;
176 ifp->if_ioctl = enc_ioctl;
177 ifp->if_output = enc_output;
178 ifp->if_softc = sc;
179 if_attach(ifp);
180 bpfattach(ifp, DLT_ENC, sizeof(struct enchdr));
181 return (0);
182 }
183
184 static int
185 enc_output(struct ifnet *ifp, struct mbuf *m, const struct sockaddr *dst,
186 struct route *ro)
187 {
188
189 m_freem(m);
190 return (0);
191 }
192
193 static int
194 enc_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
195 {
196
197 if (cmd != SIOCSIFFLAGS)
198 return (EINVAL);
199 if (ifp->if_flags & IFF_UP)
200 ifp->if_drv_flags |= IFF_DRV_RUNNING;
201 else
202 ifp->if_drv_flags &= ~IFF_DRV_RUNNING;
203 return (0);
204 }
205
206 static void
207 enc_bpftap(struct ifnet *ifp, struct mbuf *m, const struct secasvar *sav,
208 int32_t hhook_type, uint8_t enc, uint8_t af)
209 {
210 struct enchdr hdr;
211
212 if (hhook_type == HHOOK_TYPE_IPSEC_IN &&
213 (enc & V_bpf_mask_in) == 0)
214 return;
215 else if (hhook_type == HHOOK_TYPE_IPSEC_OUT &&
216 (enc & V_bpf_mask_out) == 0)
217 return;
218 if (bpf_peers_present(ifp->if_bpf) == 0)
219 return;
220 hdr.af = af;
221 hdr.spi = sav->spi;
222 hdr.flags = 0;
223 if (sav->alg_enc != SADB_EALG_NONE)
224 hdr.flags |= M_CONF;
225 if (sav->alg_auth != SADB_AALG_NONE)
226 hdr.flags |= M_AUTH;
227 bpf_mtap2(ifp->if_bpf, &hdr, sizeof(hdr), m);
228 }
229
230 /*
231 * One helper hook function is used by any hook points.
232 * + from hhook_type we can determine the packet direction:
233 * HHOOK_TYPE_IPSEC_IN or HHOOK_TYPE_IPSEC_OUT;
234 * + from hhook_id we can determine address family: AF_INET or AF_INET6;
235 * + udata contains pointer to enc_softc;
236 * + ctx_data contains pointer to struct ipsec_ctx_data.
237 */
238 static int
239 enc_hhook(int32_t hhook_type, int32_t hhook_id, void *udata, void *ctx_data,
240 void *hdata, struct osd *hosd)
241 {
242 struct ipsec_ctx_data *ctx;
243 struct enc_softc *sc;
244 struct ifnet *ifp, *rcvif;
245 struct pfil_head *ph;
246 int pdir;
247
248 sc = (struct enc_softc *)udata;
249 ifp = sc->sc_ifp;
250 if ((ifp->if_flags & IFF_UP) == 0)
251 return (0);
252
253 ctx = (struct ipsec_ctx_data *)ctx_data;
254 /* XXX: wrong hook point was used by caller? */
255 if (ctx->af != hhook_id)
256 return (EPFNOSUPPORT);
257
258 enc_bpftap(ifp, *ctx->mp, ctx->sav, hhook_type, ctx->enc, ctx->af);
259 switch (hhook_type) {
260 case HHOOK_TYPE_IPSEC_IN:
261 if (ctx->enc == IPSEC_ENC_BEFORE) {
262 /* Do accounting only once */
263 if_inc_counter(ifp, IFCOUNTER_IPACKETS, 1);
264 if_inc_counter(ifp, IFCOUNTER_IBYTES,
265 (*ctx->mp)->m_pkthdr.len);
266 }
267 if ((ctx->enc & V_filter_mask_in) == 0)
268 return (0); /* skip pfil processing */
269 pdir = PFIL_IN;
270 break;
271 case HHOOK_TYPE_IPSEC_OUT:
272 if (ctx->enc == IPSEC_ENC_BEFORE) {
273 /* Do accounting only once */
274 if_inc_counter(ifp, IFCOUNTER_OPACKETS, 1);
275 if_inc_counter(ifp, IFCOUNTER_OBYTES,
276 (*ctx->mp)->m_pkthdr.len);
277 }
278 if ((ctx->enc & V_filter_mask_out) == 0)
279 return (0); /* skip pfil processing */
280 pdir = PFIL_OUT;
281 break;
282 default:
283 return (EINVAL);
284 }
285
286 switch (hhook_id) {
287 #ifdef INET
288 case AF_INET:
289 ph = &V_inet_pfil_hook;
290 break;
291 #endif
292 #ifdef INET6
293 case AF_INET6:
294 ph = &V_inet6_pfil_hook;
295 break;
296 #endif
297 default:
298 ph = NULL;
299 }
300 if (ph == NULL || !PFIL_HOOKED(ph))
301 return (0);
302 /* Make a packet looks like it was received on enc(4) */
303 rcvif = (*ctx->mp)->m_pkthdr.rcvif;
304 (*ctx->mp)->m_pkthdr.rcvif = ifp;
305 if (pfil_run_hooks(ph, ctx->mp, ifp, pdir, 0, ctx->inp) != 0 ||
306 *ctx->mp == NULL) {
307 *ctx->mp = NULL; /* consumed by filter */
308 return (EACCES);
309 }
310 (*ctx->mp)->m_pkthdr.rcvif = rcvif;
311 enc_bpftap(ifp, *ctx->mp, ctx->sav, hhook_type,
312 IPSEC_ENC_AFTER_PFIL, ctx->af);
313 return (0);
314 }
315
316 static int
317 enc_add_hhooks(struct enc_softc *sc)
318 {
319 struct hookinfo hki;
320 int error;
321
322 error = EPFNOSUPPORT;
323 hki.hook_func = enc_hhook;
324 hki.hook_helper = NULL;
325 hki.hook_udata = sc;
326 #ifdef INET
327 hki.hook_id = AF_INET;
328 hki.hook_type = HHOOK_TYPE_IPSEC_IN;
329 error = hhook_add_hook(V_ipsec_hhh_in[HHOOK_IPSEC_INET],
330 &hki, HHOOK_WAITOK);
331 if (error != 0)
332 return (error);
333 hki.hook_type = HHOOK_TYPE_IPSEC_OUT;
334 error = hhook_add_hook(V_ipsec_hhh_out[HHOOK_IPSEC_INET],
335 &hki, HHOOK_WAITOK);
336 if (error != 0)
337 return (error);
338 #endif
339 #ifdef INET6
340 hki.hook_id = AF_INET6;
341 hki.hook_type = HHOOK_TYPE_IPSEC_IN;
342 error = hhook_add_hook(V_ipsec_hhh_in[HHOOK_IPSEC_INET6],
343 &hki, HHOOK_WAITOK);
344 if (error != 0)
345 return (error);
346 hki.hook_type = HHOOK_TYPE_IPSEC_OUT;
347 error = hhook_add_hook(V_ipsec_hhh_out[HHOOK_IPSEC_INET6],
348 &hki, HHOOK_WAITOK);
349 if (error != 0)
350 return (error);
351 #endif
352 return (error);
353 }
354
355 static void
356 enc_remove_hhooks(struct enc_softc *sc)
357 {
358 struct hookinfo hki;
359
360 hki.hook_func = enc_hhook;
361 hki.hook_helper = NULL;
362 hki.hook_udata = sc;
363 #ifdef INET
364 hki.hook_id = AF_INET;
365 hki.hook_type = HHOOK_TYPE_IPSEC_IN;
366 hhook_remove_hook(V_ipsec_hhh_in[HHOOK_IPSEC_INET], &hki);
367 hki.hook_type = HHOOK_TYPE_IPSEC_OUT;
368 hhook_remove_hook(V_ipsec_hhh_out[HHOOK_IPSEC_INET], &hki);
369 #endif
370 #ifdef INET6
371 hki.hook_id = AF_INET6;
372 hki.hook_type = HHOOK_TYPE_IPSEC_IN;
373 hhook_remove_hook(V_ipsec_hhh_in[HHOOK_IPSEC_INET6], &hki);
374 hki.hook_type = HHOOK_TYPE_IPSEC_OUT;
375 hhook_remove_hook(V_ipsec_hhh_out[HHOOK_IPSEC_INET6], &hki);
376 #endif
377 }
378
379 static void
380 vnet_enc_init(const void *unused __unused)
381 {
382
383 V_enc_sc = NULL;
384 V_enc_cloner = if_clone_simple(encname, enc_clone_create,
385 enc_clone_destroy, 1);
386 }
387 VNET_SYSINIT(vnet_enc_init, SI_SUB_PSEUDO, SI_ORDER_ANY,
388 vnet_enc_init, NULL);
389
390 static void
391 vnet_enc_init_proto(void *unused __unused)
392 {
393 KASSERT(V_enc_sc != NULL, ("%s: V_enc_sc is %p\n", __func__, V_enc_sc));
394
395 if (enc_add_hhooks(V_enc_sc) != 0)
396 enc_clone_destroy(V_enc_sc->sc_ifp);
397 }
398 VNET_SYSINIT(vnet_enc_init_proto, SI_SUB_PROTO_IFATTACHDOMAIN, SI_ORDER_ANY,
399 vnet_enc_init_proto, NULL);
400
401 static void
402 vnet_enc_uninit(const void *unused __unused)
403 {
404 KASSERT(V_enc_sc != NULL, ("%s: V_enc_sc is %p\n", __func__, V_enc_sc));
405
406 if_clone_detach(V_enc_cloner);
407 }
408 VNET_SYSUNINIT(vnet_enc_uninit, SI_SUB_INIT_IF, SI_ORDER_ANY,
409 vnet_enc_uninit, NULL);
410
411 /*
412 * The hhook consumer needs to go before ip[6]_destroy are called on
413 * SI_ORDER_THIRD.
414 */
415 static void
416 vnet_enc_uninit_hhook(const void *unused __unused)
417 {
418 KASSERT(V_enc_sc != NULL, ("%s: V_enc_sc is %p\n", __func__, V_enc_sc));
419
420 enc_remove_hhooks(V_enc_sc);
421 }
422 VNET_SYSUNINIT(vnet_enc_uninit_hhook, SI_SUB_PROTO_DOMAIN, SI_ORDER_FOURTH,
423 vnet_enc_uninit_hhook, NULL);
424
425 static int
426 enc_modevent(module_t mod, int type, void *data)
427 {
428
429 switch (type) {
430 case MOD_LOAD:
431 case MOD_UNLOAD:
432 break;
433 default:
434 return (EOPNOTSUPP);
435 }
436 return (0);
437 }
438
439 static moduledata_t enc_mod = {
440 "if_enc",
441 enc_modevent,
442 0
443 };
444
445 DECLARE_MODULE(if_enc, enc_mod, SI_SUB_PSEUDO, SI_ORDER_ANY);
446 MODULE_VERSION(if_enc, 1);
Cache object: fd3cbe035773495b01337b1a7af25a9c
|