FreeBSD/Linux Kernel Cross Reference
sys/net/if_ipsec.c
1 /*-
2 * Copyright (c) 2016 Yandex LLC
3 * Copyright (c) 2016 Andrey V. Elsukov <ae@FreeBSD.org>
4 * All rights reserved.
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 *
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution.
15 *
16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
17 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
18 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
19 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
20 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
21 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
22 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
23 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
24 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
25 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
26 */
27
28 #include <sys/cdefs.h>
29 __FBSDID("$FreeBSD: releng/11.1/sys/net/if_ipsec.c 315514 2017-03-18 22:04:20Z ae $");
30
31 #include "opt_inet.h"
32 #include "opt_inet6.h"
33
34 #include <sys/param.h>
35 #include <sys/systm.h>
36 #include <sys/kernel.h>
37 #include <sys/fnv_hash.h>
38 #include <sys/jail.h>
39 #include <sys/lock.h>
40 #include <sys/malloc.h>
41 #include <sys/mbuf.h>
42 #include <sys/module.h>
43 #include <sys/rmlock.h>
44 #include <sys/socket.h>
45 #include <sys/sockio.h>
46 #include <sys/sx.h>
47 #include <sys/errno.h>
48 #include <sys/sysctl.h>
49 #include <sys/priv.h>
50 #include <sys/proc.h>
51 #include <sys/conf.h>
52
53 #include <net/if.h>
54 #include <net/if_var.h>
55 #include <net/if_clone.h>
56 #include <net/if_types.h>
57 #include <net/bpf.h>
58 #include <net/route.h>
59 #include <net/vnet.h>
60
61 #include <netinet/in.h>
62 #include <netinet/in_var.h>
63 #include <netinet/ip.h>
64
65 #include <netinet/ip6.h>
66 #include <netinet6/in6_var.h>
67 #include <netinet6/scope6_var.h>
68
69 #include <netipsec/ipsec.h>
70 #ifdef INET6
71 #include <netipsec/ipsec6.h>
72 #endif
73
74 #include <net/if_ipsec.h>
75 #include <netipsec/key.h>
76
77 #include <security/mac/mac_framework.h>
78
79 static MALLOC_DEFINE(M_IPSEC, "ipsec", "IPsec Virtual Tunnel Interface");
80 static const char ipsecname[] = "ipsec";
81
82 #if defined(INET) && defined(INET6)
83 #define IPSEC_SPCOUNT 4
84 #else
85 #define IPSEC_SPCOUNT 2
86 #endif
87
88 struct ipsec_softc {
89 struct ifnet *ifp;
90
91 struct rmlock lock;
92 struct secpolicy *sp[IPSEC_SPCOUNT];
93
94 uint32_t reqid;
95 u_int family;
96 u_int fibnum;
97 LIST_ENTRY(ipsec_softc) chain;
98 LIST_ENTRY(ipsec_softc) hash;
99 };
100
101 #define IPSEC_LOCK_INIT(sc) rm_init(&(sc)->lock, "if_ipsec softc")
102 #define IPSEC_LOCK_DESTROY(sc) rm_destroy(&(sc)->lock)
103 #define IPSEC_RLOCK_TRACKER struct rm_priotracker ipsec_tracker
104 #define IPSEC_RLOCK(sc) rm_rlock(&(sc)->lock, &ipsec_tracker)
105 #define IPSEC_RUNLOCK(sc) rm_runlock(&(sc)->lock, &ipsec_tracker)
106 #define IPSEC_RLOCK_ASSERT(sc) rm_assert(&(sc)->lock, RA_RLOCKED)
107 #define IPSEC_WLOCK(sc) rm_wlock(&(sc)->lock)
108 #define IPSEC_WUNLOCK(sc) rm_wunlock(&(sc)->lock)
109 #define IPSEC_WLOCK_ASSERT(sc) rm_assert(&(sc)->lock, RA_WLOCKED)
110
111 static struct rmlock ipsec_sc_lock;
112 RM_SYSINIT(ipsec_sc_lock, &ipsec_sc_lock, "if_ipsec softc list");
113
114 #define IPSEC_SC_RLOCK_TRACKER struct rm_priotracker ipsec_sc_tracker
115 #define IPSEC_SC_RLOCK() rm_rlock(&ipsec_sc_lock, &ipsec_sc_tracker)
116 #define IPSEC_SC_RUNLOCK() rm_runlock(&ipsec_sc_lock, &ipsec_sc_tracker)
117 #define IPSEC_SC_RLOCK_ASSERT() rm_assert(&ipsec_sc_lock, RA_RLOCKED)
118 #define IPSEC_SC_WLOCK() rm_wlock(&ipsec_sc_lock)
119 #define IPSEC_SC_WUNLOCK() rm_wunlock(&ipsec_sc_lock)
120 #define IPSEC_SC_WLOCK_ASSERT() rm_assert(&ipsec_sc_lock, RA_WLOCKED)
121
122 LIST_HEAD(ipsec_iflist, ipsec_softc);
123 static VNET_DEFINE(struct ipsec_iflist, ipsec_sc_list);
124 static VNET_DEFINE(struct ipsec_iflist *, ipsec_sc_htbl);
125 static VNET_DEFINE(u_long, ipsec_sc_hmask);
126 #define V_ipsec_sc_list VNET(ipsec_sc_list)
127 #define V_ipsec_sc_htbl VNET(ipsec_sc_htbl)
128 #define V_ipsec_sc_hmask VNET(ipsec_sc_hmask)
129
130 static uint32_t
131 ipsec_hash(uint32_t id)
132 {
133
134 return (fnv_32_buf(&id, sizeof(id), FNV1_32_INIT));
135 }
136
137 #define SCHASH_NHASH_LOG2 5
138 #define SCHASH_NHASH (1 << SCHASH_NHASH_LOG2)
139 #define SCHASH_HASHVAL(id) (ipsec_hash((id)) & V_ipsec_sc_hmask)
140 #define SCHASH_HASH(id) &V_ipsec_sc_htbl[SCHASH_HASHVAL(id)]
141
142 /*
143 * ipsec_ioctl_sx protects from concurrent ioctls.
144 */
145 static struct sx ipsec_ioctl_sx;
146 SX_SYSINIT(ipsec_ioctl_sx, &ipsec_ioctl_sx, "ipsec_ioctl");
147
148 static int ipsec_init_reqid(struct ipsec_softc *);
149 static int ipsec_set_tunnel(struct ipsec_softc *, struct sockaddr *,
150 struct sockaddr *, uint32_t);
151 static void ipsec_delete_tunnel(struct ifnet *, int);
152
153 static int ipsec_set_addresses(struct ifnet *, struct sockaddr *,
154 struct sockaddr *);
155 static int ipsec_set_reqid(struct ifnet *, uint32_t);
156
157 static int ipsec_ioctl(struct ifnet *, u_long, caddr_t);
158 static int ipsec_transmit(struct ifnet *, struct mbuf *);
159 static int ipsec_output(struct ifnet *, struct mbuf *,
160 const struct sockaddr *, struct route *);
161 static void ipsec_qflush(struct ifnet *);
162 static int ipsec_clone_create(struct if_clone *, int, caddr_t);
163 static void ipsec_clone_destroy(struct ifnet *);
164
165 static VNET_DEFINE(struct if_clone *, ipsec_cloner);
166 #define V_ipsec_cloner VNET(ipsec_cloner)
167
168 static int
169 ipsec_clone_create(struct if_clone *ifc, int unit, caddr_t params)
170 {
171 struct ipsec_softc *sc;
172 struct ifnet *ifp;
173
174 sc = malloc(sizeof(*sc), M_IPSEC, M_WAITOK | M_ZERO);
175 sc->fibnum = curthread->td_proc->p_fibnum;
176 sc->ifp = ifp = if_alloc(IFT_TUNNEL);
177 IPSEC_LOCK_INIT(sc);
178 ifp->if_softc = sc;
179 if_initname(ifp, ipsecname, unit);
180
181 ifp->if_addrlen = 0;
182 ifp->if_mtu = IPSEC_MTU;
183 ifp->if_flags = IFF_POINTOPOINT | IFF_MULTICAST;
184 ifp->if_ioctl = ipsec_ioctl;
185 ifp->if_transmit = ipsec_transmit;
186 ifp->if_qflush = ipsec_qflush;
187 ifp->if_output = ipsec_output;
188 if_attach(ifp);
189 bpfattach(ifp, DLT_NULL, sizeof(uint32_t));
190
191 IPSEC_SC_WLOCK();
192 LIST_INSERT_HEAD(&V_ipsec_sc_list, sc, chain);
193 IPSEC_SC_WUNLOCK();
194 return (0);
195 }
196
197 static void
198 ipsec_clone_destroy(struct ifnet *ifp)
199 {
200 struct ipsec_softc *sc;
201
202 sx_xlock(&ipsec_ioctl_sx);
203 sc = ifp->if_softc;
204
205 IPSEC_SC_WLOCK();
206 ipsec_delete_tunnel(ifp, 1);
207 LIST_REMOVE(sc, chain);
208 IPSEC_SC_WUNLOCK();
209
210 bpfdetach(ifp);
211 if_detach(ifp);
212 ifp->if_softc = NULL;
213 sx_xunlock(&ipsec_ioctl_sx);
214
215 if_free(ifp);
216 IPSEC_LOCK_DESTROY(sc);
217 free(sc, M_IPSEC);
218 }
219
220 static void
221 vnet_ipsec_init(const void *unused __unused)
222 {
223
224 LIST_INIT(&V_ipsec_sc_list);
225 V_ipsec_sc_htbl = hashinit(SCHASH_NHASH, M_IPSEC, &V_ipsec_sc_hmask);
226 V_ipsec_cloner = if_clone_simple(ipsecname, ipsec_clone_create,
227 ipsec_clone_destroy, 0);
228 }
229 VNET_SYSINIT(vnet_ipsec_init, SI_SUB_PROTO_IFATTACHDOMAIN, SI_ORDER_ANY,
230 vnet_ipsec_init, NULL);
231
232 static void
233 vnet_ipsec_uninit(const void *unused __unused)
234 {
235
236 if_clone_detach(V_ipsec_cloner);
237 hashdestroy(V_ipsec_sc_htbl, M_IPSEC, V_ipsec_sc_hmask);
238 }
239 VNET_SYSUNINIT(vnet_ipsec_uninit, SI_SUB_PROTO_IFATTACHDOMAIN, SI_ORDER_ANY,
240 vnet_ipsec_uninit, NULL);
241
242 static struct secpolicy *
243 ipsec_getpolicy(struct ipsec_softc *sc, int dir, sa_family_t af)
244 {
245
246 switch (af) {
247 #ifdef INET
248 case AF_INET:
249 return (sc->sp[(dir == IPSEC_DIR_INBOUND ? 0: 1)]);
250 #endif
251 #ifdef INET6
252 case AF_INET6:
253 return (sc->sp[(dir == IPSEC_DIR_INBOUND ? 0: 1)
254 #ifdef INET
255 + 2
256 #endif
257 ]);
258 #endif
259 }
260 return (NULL);
261 }
262
263 static struct secasindex *
264 ipsec_getsaidx(struct ipsec_softc *sc, int dir, sa_family_t af)
265 {
266 struct secpolicy *sp;
267
268 sp = ipsec_getpolicy(sc, dir, af);
269 if (sp == NULL)
270 return (NULL);
271 return (&sp->req[0]->saidx);
272 }
273
274 static int
275 ipsec_transmit(struct ifnet *ifp, struct mbuf *m)
276 {
277 IPSEC_RLOCK_TRACKER;
278 struct ipsec_softc *sc;
279 struct secpolicy *sp;
280 struct ip *ip;
281 uint32_t af;
282 int error;
283
284 #ifdef MAC
285 error = mac_ifnet_check_transmit(ifp, m);
286 if (error) {
287 m_freem(m);
288 goto err;
289 }
290 #endif
291 error = ENETDOWN;
292 sc = ifp->if_softc;
293 if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0 ||
294 (ifp->if_flags & IFF_MONITOR) != 0 ||
295 (ifp->if_flags & IFF_UP) == 0) {
296 m_freem(m);
297 goto err;
298 }
299
300 /* Determine address family to correctly handle packet in BPF */
301 ip = mtod(m, struct ip *);
302 switch (ip->ip_v) {
303 #ifdef INET
304 case IPVERSION:
305 af = AF_INET;
306 break;
307 #endif
308 #ifdef INET6
309 case (IPV6_VERSION >> 4):
310 af = AF_INET6;
311 break;
312 #endif
313 default:
314 error = EAFNOSUPPORT;
315 m_freem(m);
316 goto err;
317 }
318
319 /*
320 * Loop prevention.
321 * XXX: for now just check presence of IPSEC_OUT_DONE mbuf tag.
322 * We can read full chain and compare destination address,
323 * proto and mode from xform_history with values from softc.
324 */
325 if (m_tag_find(m, PACKET_TAG_IPSEC_OUT_DONE, NULL) != NULL) {
326 m_freem(m);
327 goto err;
328 }
329
330 IPSEC_RLOCK(sc);
331 if (sc->family == 0) {
332 IPSEC_RUNLOCK(sc);
333 m_freem(m);
334 goto err;
335 }
336 sp = ipsec_getpolicy(sc, IPSEC_DIR_OUTBOUND, af);
337 key_addref(sp);
338 M_SETFIB(m, sc->fibnum);
339 IPSEC_RUNLOCK(sc);
340
341 BPF_MTAP2(ifp, &af, sizeof(af), m);
342 if_inc_counter(ifp, IFCOUNTER_OPACKETS, 1);
343 if_inc_counter(ifp, IFCOUNTER_OBYTES, m->m_pkthdr.len);
344
345 switch (af) {
346 #ifdef INET
347 case AF_INET:
348 error = ipsec4_process_packet(m, sp, NULL);
349 break;
350 #endif
351 #ifdef INET6
352 case AF_INET6:
353 error = ipsec6_process_packet(m, sp, NULL);
354 break;
355 #endif
356 default:
357 panic("%s: unknown address family\n", __func__);
358 }
359 err:
360 if (error != 0)
361 if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
362 return (error);
363 }
364
365 static void
366 ipsec_qflush(struct ifnet *ifp __unused)
367 {
368
369 }
370
371 static int
372 ipsec_output(struct ifnet *ifp, struct mbuf *m, const struct sockaddr *dst,
373 struct route *ro)
374 {
375
376 return (ifp->if_transmit(ifp, m));
377 }
378
379 int
380 ipsec_if_input(struct mbuf *m, struct secasvar *sav, uint32_t af)
381 {
382 IPSEC_SC_RLOCK_TRACKER;
383 struct secasindex *saidx;
384 struct ipsec_softc *sc;
385 struct ifnet *ifp;
386
387 if (sav->state != SADB_SASTATE_MATURE &&
388 sav->state != SADB_SASTATE_DYING) {
389 m_freem(m);
390 return (ENETDOWN);
391 }
392
393 if (sav->sah->saidx.mode != IPSEC_MODE_TUNNEL ||
394 sav->sah->saidx.proto != IPPROTO_ESP)
395 return (0);
396
397 IPSEC_SC_RLOCK();
398 /*
399 * We only acquire SC_RLOCK() while we are doing search in
400 * ipsec_sc_htbl. It is safe, because removing softc or changing
401 * of reqid/addresses requires removing from hash table.
402 */
403 LIST_FOREACH(sc, SCHASH_HASH(sav->sah->saidx.reqid), hash) {
404 saidx = ipsec_getsaidx(sc, IPSEC_DIR_INBOUND,
405 sav->sah->saidx.src.sa.sa_family);
406 /* SA's reqid should match reqid in SP */
407 if (saidx == NULL ||
408 sav->sah->saidx.reqid != saidx->reqid)
409 continue;
410 /* SAH's addresses should match tunnel endpoints. */
411 if (key_sockaddrcmp(&sav->sah->saidx.dst.sa,
412 &saidx->dst.sa, 0) != 0)
413 continue;
414 if (key_sockaddrcmp(&sav->sah->saidx.src.sa,
415 &saidx->src.sa, 0) == 0)
416 break;
417 }
418 if (sc == NULL) {
419 IPSEC_SC_RUNLOCK();
420 /* Tunnel was not found. Nothing to do. */
421 return (0);
422 }
423 ifp = sc->ifp;
424 if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0 ||
425 (ifp->if_flags & IFF_UP) == 0) {
426 IPSEC_SC_RUNLOCK();
427 m_freem(m);
428 return (ENETDOWN);
429 }
430 /*
431 * We found matching and working tunnel.
432 * Set its ifnet as receiving interface.
433 */
434 m->m_pkthdr.rcvif = ifp;
435 IPSEC_SC_RUNLOCK();
436
437 /* m_clrprotoflags(m); */
438 M_SETFIB(m, ifp->if_fib);
439 BPF_MTAP2(ifp, &af, sizeof(af), m);
440 if_inc_counter(ifp, IFCOUNTER_IPACKETS, 1);
441 if_inc_counter(ifp, IFCOUNTER_IBYTES, m->m_pkthdr.len);
442 if ((ifp->if_flags & IFF_MONITOR) != 0) {
443 m_freem(m);
444 return (ENETDOWN);
445 }
446 return (0);
447 }
448
449 /* XXX how should we handle IPv6 scope on SIOC[GS]IFPHYADDR? */
450 int
451 ipsec_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
452 {
453 IPSEC_RLOCK_TRACKER;
454 struct ifreq *ifr = (struct ifreq*)data;
455 struct sockaddr *dst, *src;
456 struct ipsec_softc *sc;
457 struct secasindex *saidx;
458 #ifdef INET
459 struct sockaddr_in *sin = NULL;
460 #endif
461 #ifdef INET6
462 struct sockaddr_in6 *sin6 = NULL;
463 #endif
464 uint32_t reqid;
465 int error;
466
467 switch (cmd) {
468 case SIOCSIFADDR:
469 ifp->if_flags |= IFF_UP;
470 case SIOCADDMULTI:
471 case SIOCDELMULTI:
472 case SIOCGIFMTU:
473 case SIOCSIFFLAGS:
474 return (0);
475 case SIOCSIFMTU:
476 if (ifr->ifr_mtu < IPSEC_MTU_MIN ||
477 ifr->ifr_mtu > IPSEC_MTU_MAX)
478 return (EINVAL);
479 else
480 ifp->if_mtu = ifr->ifr_mtu;
481 return (0);
482 }
483 sx_xlock(&ipsec_ioctl_sx);
484 sc = ifp->if_softc;
485 /* Check that softc is still here */
486 if (sc == NULL) {
487 error = ENXIO;
488 goto bad;
489 }
490 error = 0;
491 switch (cmd) {
492 case SIOCSIFPHYADDR:
493 #ifdef INET6
494 case SIOCSIFPHYADDR_IN6:
495 #endif
496 error = EINVAL;
497 switch (cmd) {
498 #ifdef INET
499 case SIOCSIFPHYADDR:
500 src = (struct sockaddr *)
501 &(((struct in_aliasreq *)data)->ifra_addr);
502 dst = (struct sockaddr *)
503 &(((struct in_aliasreq *)data)->ifra_dstaddr);
504 break;
505 #endif
506 #ifdef INET6
507 case SIOCSIFPHYADDR_IN6:
508 src = (struct sockaddr *)
509 &(((struct in6_aliasreq *)data)->ifra_addr);
510 dst = (struct sockaddr *)
511 &(((struct in6_aliasreq *)data)->ifra_dstaddr);
512 break;
513 #endif
514 default:
515 goto bad;
516 }
517 /* sa_family must be equal */
518 if (src->sa_family != dst->sa_family ||
519 src->sa_len != dst->sa_len)
520 goto bad;
521
522 /* validate sa_len */
523 switch (src->sa_family) {
524 #ifdef INET
525 case AF_INET:
526 if (src->sa_len != sizeof(struct sockaddr_in))
527 goto bad;
528 break;
529 #endif
530 #ifdef INET6
531 case AF_INET6:
532 if (src->sa_len != sizeof(struct sockaddr_in6))
533 goto bad;
534 break;
535 #endif
536 default:
537 error = EAFNOSUPPORT;
538 goto bad;
539 }
540 /* check sa_family looks sane for the cmd */
541 error = EAFNOSUPPORT;
542 switch (cmd) {
543 #ifdef INET
544 case SIOCSIFPHYADDR:
545 if (src->sa_family == AF_INET)
546 break;
547 goto bad;
548 #endif
549 #ifdef INET6
550 case SIOCSIFPHYADDR_IN6:
551 if (src->sa_family == AF_INET6)
552 break;
553 goto bad;
554 #endif
555 }
556 error = EADDRNOTAVAIL;
557 switch (src->sa_family) {
558 #ifdef INET
559 case AF_INET:
560 if (satosin(src)->sin_addr.s_addr == INADDR_ANY ||
561 satosin(dst)->sin_addr.s_addr == INADDR_ANY)
562 goto bad;
563 break;
564 #endif
565 #ifdef INET6
566 case AF_INET6:
567 if (IN6_IS_ADDR_UNSPECIFIED(&satosin6(src)->sin6_addr)
568 ||
569 IN6_IS_ADDR_UNSPECIFIED(&satosin6(dst)->sin6_addr))
570 goto bad;
571 /*
572 * Check validity of the scope zone ID of the
573 * addresses, and convert it into the kernel
574 * internal form if necessary.
575 */
576 error = sa6_embedscope(satosin6(src), 0);
577 if (error != 0)
578 goto bad;
579 error = sa6_embedscope(satosin6(dst), 0);
580 if (error != 0)
581 goto bad;
582 #endif
583 };
584 error = ipsec_set_addresses(ifp, src, dst);
585 break;
586 case SIOCDIFPHYADDR:
587 ipsec_delete_tunnel(ifp, 0);
588 break;
589 case SIOCGIFPSRCADDR:
590 case SIOCGIFPDSTADDR:
591 #ifdef INET6
592 case SIOCGIFPSRCADDR_IN6:
593 case SIOCGIFPDSTADDR_IN6:
594 #endif
595 IPSEC_RLOCK(sc);
596 if (sc->family == 0) {
597 IPSEC_RUNLOCK(sc);
598 error = EADDRNOTAVAIL;
599 break;
600 }
601 saidx = ipsec_getsaidx(sc, IPSEC_DIR_OUTBOUND, sc->family);
602 switch (cmd) {
603 #ifdef INET
604 case SIOCGIFPSRCADDR:
605 case SIOCGIFPDSTADDR:
606 if (saidx->src.sa.sa_family != AF_INET) {
607 error = EADDRNOTAVAIL;
608 break;
609 }
610 sin = (struct sockaddr_in *)&ifr->ifr_addr;
611 memset(sin, 0, sizeof(*sin));
612 sin->sin_family = AF_INET;
613 sin->sin_len = sizeof(*sin);
614 break;
615 #endif
616 #ifdef INET6
617 case SIOCGIFPSRCADDR_IN6:
618 case SIOCGIFPDSTADDR_IN6:
619 if (saidx->src.sa.sa_family != AF_INET6) {
620 error = EADDRNOTAVAIL;
621 break;
622 }
623 sin6 = (struct sockaddr_in6 *)
624 &(((struct in6_ifreq *)data)->ifr_addr);
625 memset(sin6, 0, sizeof(*sin6));
626 sin6->sin6_family = AF_INET6;
627 sin6->sin6_len = sizeof(*sin6);
628 break;
629 #endif
630 default:
631 error = EAFNOSUPPORT;
632 }
633 if (error == 0) {
634 switch (cmd) {
635 #ifdef INET
636 case SIOCGIFPSRCADDR:
637 sin->sin_addr = saidx->src.sin.sin_addr;
638 break;
639 case SIOCGIFPDSTADDR:
640 sin->sin_addr = saidx->dst.sin.sin_addr;
641 break;
642 #endif
643 #ifdef INET6
644 case SIOCGIFPSRCADDR_IN6:
645 sin6->sin6_addr = saidx->src.sin6.sin6_addr;
646 break;
647 case SIOCGIFPDSTADDR_IN6:
648 sin6->sin6_addr = saidx->dst.sin6.sin6_addr;
649 break;
650 #endif
651 }
652 }
653 IPSEC_RUNLOCK(sc);
654 if (error != 0)
655 break;
656 switch (cmd) {
657 #ifdef INET
658 case SIOCGIFPSRCADDR:
659 case SIOCGIFPDSTADDR:
660 error = prison_if(curthread->td_ucred,
661 (struct sockaddr *)sin);
662 if (error != 0)
663 memset(sin, 0, sizeof(*sin));
664 break;
665 #endif
666 #ifdef INET6
667 case SIOCGIFPSRCADDR_IN6:
668 case SIOCGIFPDSTADDR_IN6:
669 error = prison_if(curthread->td_ucred,
670 (struct sockaddr *)sin6);
671 if (error == 0)
672 error = sa6_recoverscope(sin6);
673 if (error != 0)
674 memset(sin6, 0, sizeof(*sin6));
675 #endif
676 }
677 break;
678 case SIOCGTUNFIB:
679 ifr->ifr_fib = sc->fibnum;
680 break;
681 case SIOCSTUNFIB:
682 if ((error = priv_check(curthread, PRIV_NET_SETIFFIB)) != 0)
683 break;
684 if (ifr->ifr_fib >= rt_numfibs)
685 error = EINVAL;
686 else
687 sc->fibnum = ifr->ifr_fib;
688 break;
689 case IPSECGREQID:
690 reqid = sc->reqid;
691 error = copyout(&reqid, ifr->ifr_data, sizeof(reqid));
692 break;
693 case IPSECSREQID:
694 if ((error = priv_check(curthread, PRIV_NET_SETIFCAP)) != 0)
695 break;
696 error = copyin(ifr->ifr_data, &reqid, sizeof(reqid));
697 if (error != 0)
698 break;
699 error = ipsec_set_reqid(ifp, reqid);
700 break;
701 default:
702 error = EINVAL;
703 break;
704 }
705 bad:
706 sx_xunlock(&ipsec_ioctl_sx);
707 return (error);
708 }
709
710 /*
711 * Allocate new private security policies for tunneling interface.
712 * Each tunneling interface has following security policies for
713 * both AF:
714 * 0.0.0.0/0[any] 0.0.0.0/0[any] -P in \
715 * ipsec esp/tunnel/RemoteIP-LocalIP/unique:reqid
716 * 0.0.0.0/0[any] 0.0.0.0/0[any] -P out \
717 * ipsec esp/tunnel/LocalIP-RemoteIP/unique:reqid
718 */
719 static int
720 ipsec_newpolicies(struct ipsec_softc *sc, struct secpolicy *sp[IPSEC_SPCOUNT],
721 const struct sockaddr *src, const struct sockaddr *dst, uint32_t reqid)
722 {
723 struct ipsecrequest *isr;
724 int i;
725
726 memset(sp, 0, sizeof(struct secpolicy *) * IPSEC_SPCOUNT);
727 for (i = 0; i < IPSEC_SPCOUNT; i++) {
728 if ((sp[i] = key_newsp()) == NULL)
729 goto fail;
730 if ((isr = ipsec_newisr()) == NULL)
731 goto fail;
732
733 sp[i]->policy = IPSEC_POLICY_IPSEC;
734 sp[i]->state = IPSEC_SPSTATE_DEAD;
735 sp[i]->req[sp[i]->tcount++] = isr;
736 sp[i]->created = time_second;
737 /* Use priority field to store if_index */
738 sp[i]->priority = sc->ifp->if_index;
739 isr->level = IPSEC_LEVEL_UNIQUE;
740 isr->saidx.proto = IPPROTO_ESP;
741 isr->saidx.mode = IPSEC_MODE_TUNNEL;
742 isr->saidx.reqid = reqid;
743 if (i % 2 == 0) {
744 sp[i]->spidx.dir = IPSEC_DIR_INBOUND;
745 bcopy(src, &isr->saidx.dst, src->sa_len);
746 bcopy(dst, &isr->saidx.src, dst->sa_len);
747 } else {
748 sp[i]->spidx.dir = IPSEC_DIR_OUTBOUND;
749 bcopy(src, &isr->saidx.src, src->sa_len);
750 bcopy(dst, &isr->saidx.dst, dst->sa_len);
751 }
752 sp[i]->spidx.ul_proto = IPSEC_ULPROTO_ANY;
753 #ifdef INET
754 if (i < 2) {
755 sp[i]->spidx.src.sa.sa_family =
756 sp[i]->spidx.dst.sa.sa_family = AF_INET;
757 sp[i]->spidx.src.sa.sa_len =
758 sp[i]->spidx.dst.sa.sa_len =
759 sizeof(struct sockaddr_in);
760 continue;
761 }
762 #endif
763 #ifdef INET6
764 sp[i]->spidx.src.sa.sa_family =
765 sp[i]->spidx.dst.sa.sa_family = AF_INET6;
766 sp[i]->spidx.src.sa.sa_len =
767 sp[i]->spidx.dst.sa.sa_len = sizeof(struct sockaddr_in6);
768 #endif
769 }
770 return (0);
771 fail:
772 for (i = 0; i < IPSEC_SPCOUNT; i++)
773 key_freesp(&sp[i]);
774 return (ENOMEM);
775 }
776
777 static int
778 ipsec_check_reqid(uint32_t reqid)
779 {
780 struct ipsec_softc *sc;
781
782 IPSEC_SC_RLOCK_ASSERT();
783 LIST_FOREACH(sc, &V_ipsec_sc_list, chain) {
784 if (sc->reqid == reqid)
785 return (EEXIST);
786 }
787 return (0);
788 }
789
790 /*
791 * We use key_newreqid() to automatically obtain unique reqid.
792 * Then we check that given id is unique, i.e. it is not used by
793 * another if_ipsec(4) interface. This macro limits the number of
794 * tries to get unique id.
795 */
796 #define IPSEC_REQID_TRYCNT 64
797 static int
798 ipsec_init_reqid(struct ipsec_softc *sc)
799 {
800 uint32_t reqid;
801 int trycount;
802
803 IPSEC_SC_RLOCK_ASSERT();
804
805 if (sc->reqid != 0) /* already initialized */
806 return (0);
807
808 trycount = IPSEC_REQID_TRYCNT;
809 while (--trycount > 0) {
810 reqid = key_newreqid();
811 if (ipsec_check_reqid(reqid) == 0)
812 break;
813 }
814 if (trycount == 0)
815 return (EEXIST);
816 sc->reqid = reqid;
817 return (0);
818 }
819
820 /*
821 * Set or update reqid for given tunneling interface.
822 * When specified reqid is zero, generate new one.
823 * We are protected by ioctl_sx lock from concurrent id generation.
824 * Also softc would not disappear while we hold ioctl_sx lock.
825 */
826 static int
827 ipsec_set_reqid(struct ifnet *ifp, uint32_t reqid)
828 {
829 IPSEC_SC_RLOCK_TRACKER;
830 struct ipsec_softc *sc;
831 struct secasindex *saidx;
832
833 sx_assert(&ipsec_ioctl_sx, SA_XLOCKED);
834
835 sc = ifp->if_softc;
836 if (sc->reqid == reqid && reqid != 0)
837 return (0);
838
839 IPSEC_SC_RLOCK();
840 if (reqid != 0) {
841 /* Check that specified reqid doesn't exist */
842 if (ipsec_check_reqid(reqid) != 0) {
843 IPSEC_SC_RUNLOCK();
844 return (EEXIST);
845 }
846 sc->reqid = reqid;
847 } else {
848 /* Generate new reqid */
849 if (ipsec_init_reqid(sc) != 0) {
850 IPSEC_SC_RUNLOCK();
851 return (EEXIST);
852 }
853 }
854 IPSEC_SC_RUNLOCK();
855
856 /* Tunnel isn't fully configured, just return. */
857 if (sc->family == 0)
858 return (0);
859
860 saidx = ipsec_getsaidx(sc, IPSEC_DIR_OUTBOUND, sc->family);
861 KASSERT(saidx != NULL,
862 ("saidx is NULL, but family is %d", sc->family));
863 return (ipsec_set_tunnel(sc, &saidx->src.sa, &saidx->dst.sa,
864 sc->reqid));
865 }
866
867 /*
868 * Set tunnel endpoints addresses.
869 */
870 static int
871 ipsec_set_addresses(struct ifnet *ifp, struct sockaddr *src,
872 struct sockaddr *dst)
873 {
874 IPSEC_SC_RLOCK_TRACKER;
875 struct ipsec_softc *sc, *tsc;
876 struct secasindex *saidx;
877
878 sx_assert(&ipsec_ioctl_sx, SA_XLOCKED);
879
880 sc = ifp->if_softc;
881 if (sc->family != 0) {
882 saidx = ipsec_getsaidx(sc, IPSEC_DIR_OUTBOUND,
883 src->sa_family);
884 if (saidx != NULL && saidx->reqid == sc->reqid &&
885 key_sockaddrcmp(&saidx->src.sa, src, 0) == 0 &&
886 key_sockaddrcmp(&saidx->dst.sa, dst, 0) == 0)
887 return (0); /* Nothing has been changed. */
888
889 }
890 /*
891 * We cannot service IPsec tunnel when source address is
892 * not our own.
893 */
894 #ifdef INET
895 if (src->sa_family == AF_INET &&
896 in_localip(satosin(src)->sin_addr) == 0)
897 return (EADDRNOTAVAIL);
898 #endif
899 #ifdef INET6
900 /*
901 * NOTE: IPv6 addresses are in kernel internal form with
902 * embedded scope zone id.
903 */
904 if (src->sa_family == AF_INET6 &&
905 in6_localip(&satosin6(src)->sin6_addr) == 0)
906 return (EADDRNOTAVAIL);
907 #endif
908 /* Check that given addresses aren't already configured */
909 IPSEC_SC_RLOCK();
910 LIST_FOREACH(tsc, &V_ipsec_sc_list, chain) {
911 if (tsc == sc || tsc->family != src->sa_family)
912 continue;
913 saidx = ipsec_getsaidx(tsc, IPSEC_DIR_OUTBOUND, tsc->family);
914 if (key_sockaddrcmp(&saidx->src.sa, src, 0) == 0 &&
915 key_sockaddrcmp(&saidx->dst.sa, dst, 0) == 0) {
916 /* We already have tunnel with such addresses */
917 IPSEC_SC_RUNLOCK();
918 return (EADDRNOTAVAIL);
919 }
920 }
921 /* If reqid is not set, generate new one. */
922 if (ipsec_init_reqid(sc) != 0) {
923 IPSEC_SC_RUNLOCK();
924 return (EEXIST);
925 }
926 IPSEC_SC_RUNLOCK();
927 return (ipsec_set_tunnel(sc, src, dst, sc->reqid));
928 }
929
930 static int
931 ipsec_set_tunnel(struct ipsec_softc *sc, struct sockaddr *src,
932 struct sockaddr *dst, uint32_t reqid)
933 {
934 struct secpolicy *sp[IPSEC_SPCOUNT];
935 struct secpolicy *oldsp[IPSEC_SPCOUNT];
936 int i, f;
937
938 sx_assert(&ipsec_ioctl_sx, SA_XLOCKED);
939
940 /* Allocate SP with new addresses. */
941 if (ipsec_newpolicies(sc, sp, src, dst, reqid) == 0) {
942 /* Add new policies to SPDB */
943 if (key_register_ifnet(sp, IPSEC_SPCOUNT) != 0) {
944 for (i = 0; i < IPSEC_SPCOUNT; i++)
945 key_freesp(&sp[i]);
946 return (EAGAIN);
947 }
948 IPSEC_SC_WLOCK();
949 if ((f = sc->family) != 0)
950 LIST_REMOVE(sc, hash);
951 IPSEC_WLOCK(sc);
952 for (i = 0; i < IPSEC_SPCOUNT; i++) {
953 oldsp[i] = sc->sp[i];
954 sc->sp[i] = sp[i];
955 }
956 sc->family = src->sa_family;
957 IPSEC_WUNLOCK(sc);
958 LIST_INSERT_HEAD(SCHASH_HASH(sc->reqid), sc, hash);
959 IPSEC_SC_WUNLOCK();
960 } else {
961 sc->ifp->if_drv_flags &= ~IFF_DRV_RUNNING;
962 return (ENOMEM);
963 }
964
965 sc->ifp->if_drv_flags |= IFF_DRV_RUNNING;
966 if (f != 0) {
967 key_unregister_ifnet(oldsp, IPSEC_SPCOUNT);
968 for (i = 0; i < IPSEC_SPCOUNT; i++)
969 key_freesp(&oldsp[i]);
970 }
971 return (0);
972 }
973
974 static void
975 ipsec_delete_tunnel(struct ifnet *ifp, int locked)
976 {
977 struct ipsec_softc *sc = ifp->if_softc;
978 struct secpolicy *oldsp[IPSEC_SPCOUNT];
979 int i;
980
981 sx_assert(&ipsec_ioctl_sx, SA_XLOCKED);
982
983 ifp->if_drv_flags &= ~IFF_DRV_RUNNING;
984 if (sc->family != 0) {
985 if (!locked)
986 IPSEC_SC_WLOCK();
987 /* Remove from hash table */
988 LIST_REMOVE(sc, hash);
989 IPSEC_WLOCK(sc);
990 for (i = 0; i < IPSEC_SPCOUNT; i++) {
991 oldsp[i] = sc->sp[i];
992 sc->sp[i] = NULL;
993 }
994 sc->family = 0;
995 IPSEC_WUNLOCK(sc);
996 if (!locked)
997 IPSEC_SC_WUNLOCK();
998 key_unregister_ifnet(oldsp, IPSEC_SPCOUNT);
999 for (i = 0; i < IPSEC_SPCOUNT; i++)
1000 key_freesp(&oldsp[i]);
1001 }
1002 }
Cache object: ff1ae7b11d04e21262395d99fa998fe2
|