1 /*-
2 * Copyright (c) 1982, 1986, 1988, 1993
3 * The Regents of the University of California. All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
13 * 4. Neither the name of the University nor the names of its contributors
14 * may be used to endorse or promote products derived from this software
15 * without specific prior written permission.
16 *
17 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
21 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27 * SUCH DAMAGE.
28 */
29
30 #include <sys/cdefs.h>
31 __FBSDID("$FreeBSD: releng/8.4/sys/netinet6/ip6_ipsec.c 239777 2012-08-28 12:56:28Z bz $");
32
33 #include "opt_inet6.h"
34 #include "opt_ipsec.h"
35
36 #include <sys/param.h>
37 #include <sys/systm.h>
38 #include <sys/kernel.h>
39 #include <sys/mac.h>
40 #include <sys/malloc.h>
41 #include <sys/mbuf.h>
42 #include <sys/protosw.h>
43 #include <sys/socket.h>
44 #include <sys/socketvar.h>
45 #include <sys/sysctl.h>
46
47 #include <net/if.h>
48 #include <net/route.h>
49 #include <net/vnet.h>
50
51 #include <netinet/in.h>
52 #include <netinet/in_systm.h>
53 #include <netinet/in_var.h>
54 #include <netinet/ip.h>
55 #include <netinet/ip6.h>
56 #include <netinet/in_pcb.h>
57 #include <netinet/ip_var.h>
58 #include <netinet/ip_options.h>
59
60 #include <machine/in_cksum.h>
61
62 #ifdef IPSEC
63 #include <netipsec/ipsec.h>
64 #include <netipsec/ipsec6.h>
65 #include <netipsec/xform.h>
66 #include <netipsec/key.h>
67 #ifdef IPSEC_DEBUG
68 #include <netipsec/key_debug.h>
69 #else
70 #define KEYDEBUG(lev,arg)
71 #endif
72 #endif /*IPSEC*/
73
74 #include <netinet6/ip6_ipsec.h>
75 #include <netinet6/ip6_var.h>
76
77 extern struct protosw inet6sw[];
78
79
80 #ifdef INET6
81 #ifdef IPSEC
82 #ifdef IPSEC_FILTERTUNNEL
83 static VNET_DEFINE(int, ip6_ipsec6_filtertunnel) = 1;
84 #else
85 static VNET_DEFINE(int, ip6_ipsec6_filtertunnel) = 0;
86 #endif
87 #define V_ip6_ipsec6_filtertunnel VNET(ip6_ipsec6_filtertunnel)
88
89 SYSCTL_DECL(_net_inet6_ipsec6);
90 SYSCTL_VNET_INT(_net_inet6_ipsec6, OID_AUTO,
91 filtertunnel, CTLFLAG_RW, &VNET_NAME(ip6_ipsec6_filtertunnel), 0,
92 "If set filter packets from an IPsec tunnel.");
93 #endif /* IPSEC */
94 #endif /* INET6 */
95
96 /*
97 * Check if we have to jump over firewall processing for this packet.
98 * Called from ip6_input().
99 * 1 = jump over firewall, 0 = packet goes through firewall.
100 */
101 int
102 ip6_ipsec_filtertunnel(struct mbuf *m)
103 {
104 #if defined(IPSEC)
105
106 /*
107 * Bypass packet filtering for packets previously handled by IPsec.
108 */
109 if (!V_ip6_ipsec6_filtertunnel &&
110 m_tag_find(m, PACKET_TAG_IPSEC_IN_DONE, NULL) != NULL)
111 return 1;
112 #endif
113 return 0;
114 }
115
116 /*
117 * Check if this packet has an active SA and needs to be dropped instead
118 * of forwarded.
119 * Called from ip6_input().
120 * 1 = drop packet, 0 = forward packet.
121 */
122 int
123 ip6_ipsec_fwd(struct mbuf *m)
124 {
125 #ifdef IPSEC
126 struct m_tag *mtag;
127 struct tdb_ident *tdbi;
128 struct secpolicy *sp;
129 int s, error;
130 mtag = m_tag_find(m, PACKET_TAG_IPSEC_IN_DONE, NULL);
131 s = splnet();
132 if (mtag != NULL) {
133 tdbi = (struct tdb_ident *)(mtag + 1);
134 sp = ipsec_getpolicy(tdbi, IPSEC_DIR_INBOUND);
135 } else {
136 sp = ipsec_getpolicybyaddr(m, IPSEC_DIR_INBOUND,
137 IP_FORWARDING, &error);
138 }
139 if (sp == NULL) { /* NB: can happen if error */
140 splx(s);
141 /*XXX error stat???*/
142 DPRINTF(("%s: no SP for forwarding\n", __func__)); /*XXX*/
143 return 1;
144 }
145
146 /*
147 * Check security policy against packet attributes.
148 */
149 error = ipsec_in_reject(sp, m);
150 KEY_FREESP(&sp);
151 splx(s);
152 if (error) {
153 V_ip6stat.ip6s_cantforward++;
154 return 1;
155 }
156 #endif /* IPSEC */
157 return 0;
158 }
159
160 /*
161 * Check if protocol type doesn't have a further header and do IPSEC
162 * decryption or reject right now. Protocols with further headers get
163 * their IPSEC treatment within the protocol specific processing.
164 * Called from ip6_input().
165 * 1 = drop packet, 0 = continue processing packet.
166 */
167 int
168 ip6_ipsec_input(struct mbuf *m, int nxt)
169 {
170 #ifdef IPSEC
171 struct m_tag *mtag;
172 struct tdb_ident *tdbi;
173 struct secpolicy *sp;
174 int s, error;
175 /*
176 * enforce IPsec policy checking if we are seeing last header.
177 * note that we do not visit this with protocols with pcb layer
178 * code - like udp/tcp/raw ip.
179 */
180 if ((inet6sw[ip6_protox[nxt]].pr_flags & PR_LASTHDR) != 0 &&
181 ipsec6_in_reject(m, NULL)) {
182
183 /*
184 * Check if the packet has already had IPsec processing
185 * done. If so, then just pass it along. This tag gets
186 * set during AH, ESP, etc. input handling, before the
187 * packet is returned to the ip input queue for delivery.
188 */
189 mtag = m_tag_find(m, PACKET_TAG_IPSEC_IN_DONE, NULL);
190 s = splnet();
191 if (mtag != NULL) {
192 tdbi = (struct tdb_ident *)(mtag + 1);
193 sp = ipsec_getpolicy(tdbi, IPSEC_DIR_INBOUND);
194 } else {
195 sp = ipsec_getpolicybyaddr(m, IPSEC_DIR_INBOUND,
196 IP_FORWARDING, &error);
197 }
198 if (sp != NULL) {
199 /*
200 * Check security policy against packet attributes.
201 */
202 error = ipsec_in_reject(sp, m);
203 KEY_FREESP(&sp);
204 } else {
205 /* XXX error stat??? */
206 error = EINVAL;
207 DPRINTF(("%s: no SP, packet discarded\n", __func__));/*XXX*/
208 return 1;
209 }
210 splx(s);
211 if (error)
212 return 1;
213 }
214 #endif /* IPSEC */
215 return 0;
216 }
217
218 /*
219 * Called from ip6_output().
220 * 1 = drop packet, 0 = continue processing packet,
221 * -1 = packet was reinjected and stop processing packet
222 */
223
224 int
225 ip6_ipsec_output(struct mbuf **m, struct inpcb *inp, int *flags, int *error,
226 struct ifnet **ifp, struct secpolicy **sp)
227 {
228 #ifdef IPSEC
229 struct tdb_ident *tdbi;
230 struct m_tag *mtag;
231 /* XXX int s; */
232 if (sp == NULL)
233 return 1;
234 mtag = m_tag_find(*m, PACKET_TAG_IPSEC_PENDING_TDB, NULL);
235 if (mtag != NULL) {
236 tdbi = (struct tdb_ident *)(mtag + 1);
237 *sp = ipsec_getpolicy(tdbi, IPSEC_DIR_OUTBOUND);
238 if (*sp == NULL)
239 *error = -EINVAL; /* force silent drop */
240 m_tag_delete(*m, mtag);
241 } else {
242 *sp = ipsec4_checkpolicy(*m, IPSEC_DIR_OUTBOUND, *flags,
243 error, inp);
244 }
245
246 /*
247 * There are four return cases:
248 * sp != NULL apply IPsec policy
249 * sp == NULL, error == 0 no IPsec handling needed
250 * sp == NULL, error == -EINVAL discard packet w/o error
251 * sp == NULL, error != 0 discard packet, report error
252 */
253 if (*sp != NULL) {
254 /* Loop detection, check if ipsec processing already done */
255 KASSERT((*sp)->req != NULL, ("ip_output: no ipsec request"));
256 for (mtag = m_tag_first(*m); mtag != NULL;
257 mtag = m_tag_next(*m, mtag)) {
258 if (mtag->m_tag_cookie != MTAG_ABI_COMPAT)
259 continue;
260 if (mtag->m_tag_id != PACKET_TAG_IPSEC_OUT_DONE &&
261 mtag->m_tag_id != PACKET_TAG_IPSEC_OUT_CRYPTO_NEEDED)
262 continue;
263 /*
264 * Check if policy has no SA associated with it.
265 * This can happen when an SP has yet to acquire
266 * an SA; e.g. on first reference. If it occurs,
267 * then we let ipsec4_process_packet do its thing.
268 */
269 if ((*sp)->req->sav == NULL)
270 break;
271 tdbi = (struct tdb_ident *)(mtag + 1);
272 if (tdbi->spi == (*sp)->req->sav->spi &&
273 tdbi->proto == (*sp)->req->sav->sah->saidx.proto &&
274 bcmp(&tdbi->dst, &(*sp)->req->sav->sah->saidx.dst,
275 sizeof (union sockaddr_union)) == 0) {
276 /*
277 * No IPsec processing is needed, free
278 * reference to SP.
279 *
280 * NB: null pointer to avoid free at
281 * done: below.
282 */
283 KEY_FREESP(sp), *sp = NULL;
284 /* XXX splx(s); */
285 goto done;
286 }
287 }
288
289 /*
290 * Do delayed checksums now because we send before
291 * this is done in the normal processing path.
292 */
293 if ((*m)->m_pkthdr.csum_flags & CSUM_DELAY_DATA) {
294 in_delayed_cksum(*m);
295 (*m)->m_pkthdr.csum_flags &= ~CSUM_DELAY_DATA;
296 }
297
298 /*
299 * Preserve KAME behaviour: ENOENT can be returned
300 * when an SA acquire is in progress. Don't propagate
301 * this to user-level; it confuses applications.
302 *
303 * XXX this will go away when the SADB is redone.
304 */
305 if (*error == ENOENT)
306 *error = 0;
307 goto do_ipsec;
308 } else { /* sp == NULL */
309 if (*error != 0) {
310 /*
311 * Hack: -EINVAL is used to signal that a packet
312 * should be silently discarded. This is typically
313 * because we asked key management for an SA and
314 * it was delayed (e.g. kicked up to IKE).
315 */
316 if (*error == -EINVAL)
317 *error = 0;
318 goto bad;
319 } else {
320 /* No IPsec processing for this packet. */
321 }
322 }
323 done:
324 return 0;
325 do_ipsec:
326 return -1;
327 bad:
328 return 1;
329 #endif /* IPSEC */
330 return 0;
331 }
332
333 #if 0
334 /*
335 * Compute the MTU for a forwarded packet that gets IPSEC encapsulated.
336 * Called from ip_forward().
337 * Returns MTU suggestion for ICMP needfrag reply.
338 */
339 int
340 ip6_ipsec_mtu(struct mbuf *m)
341 {
342 int mtu = 0;
343 /*
344 * If the packet is routed over IPsec tunnel, tell the
345 * originator the tunnel MTU.
346 * tunnel MTU = if MTU - sizeof(IP) - ESP/AH hdrsiz
347 * XXX quickhack!!!
348 */
349 #ifdef IPSEC
350 struct secpolicy *sp = NULL;
351 int ipsecerror;
352 int ipsechdr;
353 struct route *ro;
354 sp = ipsec_getpolicybyaddr(m,
355 IPSEC_DIR_OUTBOUND,
356 IP_FORWARDING,
357 &ipsecerror);
358 if (sp != NULL) {
359 /* count IPsec header size */
360 ipsechdr = ipsec_hdrsiz(m, IPSEC_DIR_OUTBOUND, NULL);
361
362 /*
363 * find the correct route for outer IPv4
364 * header, compute tunnel MTU.
365 */
366 if (sp->req != NULL &&
367 sp->req->sav != NULL &&
368 sp->req->sav->sah != NULL) {
369 ro = &sp->req->sav->sah->route_cache.sa_route;
370 if (ro->ro_rt && ro->ro_rt->rt_ifp) {
371 mtu =
372 ro->ro_rt->rt_rmx.rmx_mtu ?
373 ro->ro_rt->rt_rmx.rmx_mtu :
374 ro->ro_rt->rt_ifp->if_mtu;
375 mtu -= ipsechdr;
376 }
377 }
378 KEY_FREESP(&sp);
379 }
380 #endif /* IPSEC */
381 /* XXX else case missing. */
382 return mtu;
383 }
384 #endif
Cache object: 90c690eb27dc1d2782ca9c47b50718db
|