if_enc.c

Version: - FREEBSD - FREEBSD-13-STABLE - FREEBSD-13-0 - FREEBSD-12-STABLE - FREEBSD-12-0 - FREEBSD-11-STABLE - FREEBSD-11-0 - FREEBSD-10-STABLE - FREEBSD-10-0 - FREEBSD-9-STABLE - FREEBSD-9-0 - FREEBSD-8-STABLE - FREEBSD-8-0 - FREEBSD-7-STABLE - FREEBSD-7-0 - FREEBSD-6-STABLE - FREEBSD-6-0 - FREEBSD-5-STABLE - FREEBSD-5-0 - FREEBSD-4-STABLE - FREEBSD-3-STABLE - FREEBSD22 - l41 - OPENBSD - linux-2.6 - MK84 - PLAN9 - xnu-8792
SearchContext: - none - 3 - 10
    1 /*-
    2  * Copyright (c) 2006 The FreeBSD Project.
    3  * All rights reserved.
    4  *
    5  * Redistribution and use in source and binary forms, with or without
    6  * modification, are permitted provided that the following conditions
    7  * are met:
    8  *
    9  * 1. Redistributions of source code must retain the above copyright
   10  *    notice, this list of conditions and the following disclaimer.
   11  * 2. Redistributions in binary form must reproduce the above copyright
   12  *    notice, this list of conditions and the following disclaimer in the
   13  *    documentation and/or other materials provided with the distribution.
   14  *
   15  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
   16  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
   17  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
   18  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
   19  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
   20  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
   21  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
   22  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
   23  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
   24  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
   25  * SUCH DAMAGE.
   26  *
   27  * $FreeBSD: releng/9.0/sys/net/if_enc.c 221130 2011-04-27 19:30:44Z bz $
   28  */
   29 
   30 #include "opt_inet.h"
   31 #include "opt_inet6.h"
   32 #include "opt_enc.h"
   33 
   34 #include <sys/param.h>
   35 #include <sys/systm.h>
   36 #include <sys/kernel.h>
   37 #include <sys/malloc.h>
   38 #include <sys/mbuf.h>
   39 #include <sys/module.h>
   40 #include <machine/bus.h>
   41 #include <sys/rman.h>
   42 #include <sys/socket.h>
   43 #include <sys/sockio.h>
   44 #include <sys/sysctl.h>
   45 
   46 #include <net/if.h>
   47 #include <net/if_clone.h>
   48 #include <net/if_types.h>
   49 #include <net/pfil.h>
   50 #include <net/route.h>
   51 #include <net/netisr.h>
   52 #include <net/bpf.h>
   53 #include <net/vnet.h>
   54 
   55 #include <netinet/in.h>
   56 #include <netinet/in_systm.h>
   57 #include <netinet/ip.h>
   58 #include <netinet/ip_var.h>
   59 #include <netinet/in_var.h>
   60 
   61 #ifdef INET6
   62 #include <netinet/ip6.h>
   63 #include <netinet6/ip6_var.h>
   64 #endif
   65 
   66 #include <netipsec/ipsec.h>
   67 #include <netipsec/xform.h>
   68 
   69 #define ENCMTU          (1024+512)
   70 
   71 /* XXX this define must have the same value as in OpenBSD */
   72 #define M_CONF          0x0400  /* payload was encrypted (ESP-transport) */
   73 #define M_AUTH          0x0800  /* payload was authenticated (AH or ESP auth) */
   74 #define M_AUTH_AH       0x2000  /* header was authenticated (AH) */
   75 
   76 struct enchdr {
   77         u_int32_t af;
   78         u_int32_t spi;
   79         u_int32_t flags;
   80 };
   81 
   82 struct ifnet    *encif;
   83 static struct mtx       enc_mtx;
   84 
   85 struct enc_softc {
   86         struct  ifnet *sc_ifp;
   87 };
   88 
   89 static int      enc_ioctl(struct ifnet *, u_long, caddr_t);
   90 static int      enc_output(struct ifnet *ifp, struct mbuf *m,
   91                     struct sockaddr *dst, struct route *ro);
   92 static int      enc_clone_create(struct if_clone *, int, caddr_t);
   93 static void     enc_clone_destroy(struct ifnet *);
   94 
   95 IFC_SIMPLE_DECLARE(enc, 1);
   96 
   97 /*
   98  * Sysctls.
   99  */
  100 
  101 /*
  102  * Before and after are relative to when we are stripping the
  103  * outer IP header.
  104  */
  105 SYSCTL_NODE(_net, OID_AUTO, enc, CTLFLAG_RW, 0, "enc sysctl");
  106 
  107 SYSCTL_NODE(_net_enc, OID_AUTO, in, CTLFLAG_RW, 0, "enc input sysctl");
  108 static int ipsec_filter_mask_in = ENC_BEFORE;
  109 SYSCTL_INT(_net_enc_in, OID_AUTO, ipsec_filter_mask, CTLFLAG_RW,
  110         &ipsec_filter_mask_in, 0, "IPsec input firewall filter mask");
  111 static int ipsec_bpf_mask_in = ENC_BEFORE;
  112 SYSCTL_INT(_net_enc_in, OID_AUTO, ipsec_bpf_mask, CTLFLAG_RW,
  113         &ipsec_bpf_mask_in, 0, "IPsec input bpf mask");
  114 
  115 SYSCTL_NODE(_net_enc, OID_AUTO, out, CTLFLAG_RW, 0, "enc output sysctl");
  116 static int ipsec_filter_mask_out = ENC_BEFORE;
  117 SYSCTL_INT(_net_enc_out, OID_AUTO, ipsec_filter_mask, CTLFLAG_RW,
  118         &ipsec_filter_mask_out, 0, "IPsec output firewall filter mask");
  119 static int ipsec_bpf_mask_out = ENC_BEFORE|ENC_AFTER;
  120 SYSCTL_INT(_net_enc_out, OID_AUTO, ipsec_bpf_mask, CTLFLAG_RW,
  121         &ipsec_bpf_mask_out, 0, "IPsec output bpf mask");
  122 
  123 static void
  124 enc_clone_destroy(struct ifnet *ifp)
  125 {
  126         KASSERT(ifp != encif, ("%s: destroying encif", __func__));
  127 
  128         bpfdetach(ifp);
  129         if_detach(ifp);
  130         if_free(ifp);
  131 }
  132 
  133 static int
  134 enc_clone_create(struct if_clone *ifc, int unit, caddr_t params)
  135 {
  136         struct ifnet *ifp;
  137         struct enc_softc *sc;
  138 
  139         sc = malloc(sizeof(*sc), M_DEVBUF, M_WAITOK|M_ZERO);
  140         ifp = sc->sc_ifp = if_alloc(IFT_ENC);
  141         if (ifp == NULL) {
  142                 free(sc, M_DEVBUF);
  143                 return (ENOSPC);
  144         }
  145 
  146         if_initname(ifp, ifc->ifc_name, unit);
  147         ifp->if_mtu = ENCMTU;
  148         ifp->if_ioctl = enc_ioctl;
  149         ifp->if_output = enc_output;
  150         ifp->if_snd.ifq_maxlen = ifqmaxlen;
  151         ifp->if_softc = sc;
  152         if_attach(ifp);
  153         bpfattach(ifp, DLT_ENC, sizeof(struct enchdr));
  154 
  155         mtx_lock(&enc_mtx);
  156         /* grab a pointer to enc0, ignore the rest */
  157         if (encif == NULL)
  158                 encif = ifp;
  159         mtx_unlock(&enc_mtx);
  160 
  161         return (0);
  162 }
  163 
  164 static int
  165 enc_modevent(module_t mod, int type, void *data)
  166 {
  167         switch (type) {
  168         case MOD_LOAD:
  169                 mtx_init(&enc_mtx, "enc mtx", NULL, MTX_DEF);
  170                 if_clone_attach(&enc_cloner);
  171                 break;
  172         case MOD_UNLOAD:
  173                 printf("enc module unload - not possible for this module\n");
  174                 return (EINVAL);
  175         default:
  176                 return (EOPNOTSUPP);
  177         }
  178         return (0);
  179 }
  180 
  181 static moduledata_t enc_mod = {
  182         "enc",
  183         enc_modevent,
  184         0
  185 };
  186 
  187 DECLARE_MODULE(enc, enc_mod, SI_SUB_PROTO_IFATTACHDOMAIN, SI_ORDER_ANY);
  188 
  189 static int
  190 enc_output(struct ifnet *ifp, struct mbuf *m, struct sockaddr *dst,
  191     struct route *ro)
  192 {
  193         m_freem(m);
  194         return (0);
  195 }
  196 
  197 /*
  198  * Process an ioctl request.
  199  */
  200 /* ARGSUSED */
  201 static int
  202 enc_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
  203 {
  204         int error = 0;
  205 
  206         mtx_lock(&enc_mtx);
  207 
  208         switch (cmd) {
  209 
  210         case SIOCSIFFLAGS:
  211                 if (ifp->if_flags & IFF_UP)
  212                         ifp->if_drv_flags |= IFF_DRV_RUNNING;
  213                 else
  214                         ifp->if_drv_flags &= ~IFF_DRV_RUNNING;
  215 
  216                 break;
  217 
  218         default:
  219                 error = EINVAL;
  220         }
  221 
  222         mtx_unlock(&enc_mtx);
  223         return (error);
  224 }
  225 
  226 int
  227 ipsec_filter(struct mbuf **mp, int dir, int flags)
  228 {
  229         int error, i;
  230         struct ip *ip;
  231 
  232         KASSERT(encif != NULL, ("%s: encif is null", __func__));
  233         KASSERT(flags & (ENC_IN|ENC_OUT),
  234                 ("%s: invalid flags: %04x", __func__, flags));
  235 
  236         if ((encif->if_drv_flags & IFF_DRV_RUNNING) == 0)
  237                 return (0);
  238 
  239         if (flags & ENC_IN) {
  240                 if ((flags & ipsec_filter_mask_in) == 0)
  241                         return (0);
  242         } else {
  243                 if ((flags & ipsec_filter_mask_out) == 0)
  244                         return (0);
  245         }
  246 
  247         /* Skip pfil(9) if no filters are loaded */
  248         if (1
  249 #ifdef INET
  250             && !PFIL_HOOKED(&V_inet_pfil_hook)
  251 #endif
  252 #ifdef INET6
  253             && !PFIL_HOOKED(&V_inet6_pfil_hook)
  254 #endif
  255             ) {
  256                 return (0);
  257         }
  258 
  259         i = min((*mp)->m_pkthdr.len, max_protohdr);
  260         if ((*mp)->m_len < i) {
  261                 *mp = m_pullup(*mp, i);
  262                 if (*mp == NULL) {
  263                         printf("%s: m_pullup failed\n", __func__);
  264                         return (-1);
  265                 }
  266         }
  267 
  268         error = 0;
  269         ip = mtod(*mp, struct ip *);
  270         switch (ip->ip_v) {
  271 #ifdef INET
  272                 case 4:
  273                         /*
  274                          * before calling the firewall, swap fields the same as
  275                          * IP does. here we assume the header is contiguous
  276                          */
  277                         ip->ip_len = ntohs(ip->ip_len);
  278                         ip->ip_off = ntohs(ip->ip_off);
  279 
  280                         error = pfil_run_hooks(&V_inet_pfil_hook, mp,
  281                             encif, dir, NULL);
  282 
  283                         if (*mp == NULL || error != 0)
  284                                 break;
  285 
  286                         /* restore byte ordering */
  287                         ip = mtod(*mp, struct ip *);
  288                         ip->ip_len = htons(ip->ip_len);
  289                         ip->ip_off = htons(ip->ip_off);
  290                         break;
  291 #endif
  292 #ifdef INET6
  293                 case 6:
  294                         error = pfil_run_hooks(&V_inet6_pfil_hook, mp,
  295                             encif, dir, NULL);
  296                         break;
  297 #endif
  298                 default:
  299                         printf("%s: unknown IP version\n", __func__);
  300         }
  301 
  302         /*
  303          * If the mbuf was consumed by the filter for requeueing (dummynet, etc)
  304          * then error will be zero but we still want to return an error to our
  305          * caller so the null mbuf isn't forwarded further.
  306          */
  307         if (*mp == NULL && error == 0)
  308                 return (-1);    /* Consumed by the filter */
  309         if (*mp == NULL)
  310                 return (error);
  311         if (error != 0)
  312                 goto bad;
  313 
  314         return (error);
  315 
  316 bad:
  317         m_freem(*mp);
  318         *mp = NULL;
  319         return (error);
  320 }
  321 
  322 void
  323 ipsec_bpf(struct mbuf *m, struct secasvar *sav, int af, int flags)
  324 {
  325         int mflags;
  326         struct enchdr hdr;
  327 
  328         KASSERT(encif != NULL, ("%s: encif is null", __func__));
  329         KASSERT(flags & (ENC_IN|ENC_OUT),
  330                 ("%s: invalid flags: %04x", __func__, flags));
  331 
  332         if ((encif->if_drv_flags & IFF_DRV_RUNNING) == 0)
  333                 return;
  334 
  335         if (flags & ENC_IN) {
  336                 if ((flags & ipsec_bpf_mask_in) == 0)
  337                         return;
  338         } else {
  339                 if ((flags & ipsec_bpf_mask_out) == 0)
  340                         return;
  341         }
  342 
  343         if (bpf_peers_present(encif->if_bpf)) {
  344                 mflags = 0;
  345                 hdr.spi = 0;
  346                 if (!sav) {
  347                         struct m_tag *mtag;
  348                         mtag = m_tag_find(m, PACKET_TAG_IPSEC_IN_DONE, NULL);
  349                         if (mtag != NULL) {
  350                                 struct tdb_ident *tdbi;
  351                                 tdbi = (struct tdb_ident *) (mtag + 1);
  352                                 if (tdbi->alg_enc != SADB_EALG_NONE)
  353                                         mflags |= M_CONF;
  354                                 if (tdbi->alg_auth != SADB_AALG_NONE)
  355                                         mflags |= M_AUTH;
  356                                 hdr.spi = tdbi->spi;
  357                         }
  358                 } else {
  359                         if (sav->alg_enc != SADB_EALG_NONE)
  360                                 mflags |= M_CONF;
  361                         if (sav->alg_auth != SADB_AALG_NONE)
  362                                 mflags |= M_AUTH;
  363                         hdr.spi = sav->spi;
  364                 }
  365 
  366                 /*
  367                  * We need to prepend the address family as a four byte
  368                  * field.  Cons up a dummy header to pacify bpf.  This
  369                  * is safe because bpf will only read from the mbuf
  370                  * (i.e., it won't try to free it or keep a pointer a
  371                  * to it).
  372                  */
  373                 hdr.af = af;
  374                 /* hdr.spi already set above */
  375                 hdr.flags = mflags;
  376 
  377                 bpf_mtap2(encif->if_bpf, &hdr, sizeof(hdr), m);
  378         }
  379 }
Cache object: 31e5dfa906287de84c4bb7bce6c21c6f
[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]
This page is part of the FreeBSD/Linux Linux Kernel Cross-Reference, and was automatically generated using a modified version of the LXR engine.
FreeBSD/Linux Kernel Cross Reference sys/net/if_enc.c

FreeBSD/Linux Kernel Cross Reference
sys/net/if_enc.c
