FreeBSD/Linux Kernel Cross Reference
sys/netipsec/ipsec.c
1 /* $FreeBSD: releng/11.1/sys/netipsec/ipsec.c 315514 2017-03-18 22:04:20Z ae $ */
2 /* $KAME: ipsec.c,v 1.103 2001/05/24 07:14:18 sakane Exp $ */
3
4 /*-
5 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
6 * All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 * 1. Redistributions of source code must retain the above copyright
12 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
16 * 3. Neither the name of the project nor the names of its contributors
17 * may be used to endorse or promote products derived from this software
18 * without specific prior written permission.
19 *
20 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
21 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
24 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30 * SUCH DAMAGE.
31 */
32
33 /*
34 * IPsec controller part.
35 */
36
37 #include "opt_inet.h"
38 #include "opt_inet6.h"
39 #include "opt_ipsec.h"
40
41 #include <sys/param.h>
42 #include <sys/systm.h>
43 #include <sys/malloc.h>
44 #include <sys/mbuf.h>
45 #include <sys/domain.h>
46 #include <sys/priv.h>
47 #include <sys/protosw.h>
48 #include <sys/socket.h>
49 #include <sys/socketvar.h>
50 #include <sys/errno.h>
51 #include <sys/hhook.h>
52 #include <sys/time.h>
53 #include <sys/kernel.h>
54 #include <sys/syslog.h>
55 #include <sys/sysctl.h>
56 #include <sys/proc.h>
57
58 #include <net/if.h>
59 #include <net/if_enc.h>
60 #include <net/if_var.h>
61 #include <net/vnet.h>
62
63 #include <netinet/in.h>
64 #include <netinet/in_systm.h>
65 #include <netinet/ip.h>
66 #include <netinet/ip_var.h>
67 #include <netinet/in_var.h>
68 #include <netinet/udp.h>
69 #include <netinet/udp_var.h>
70 #include <netinet/tcp.h>
71 #include <netinet/udp.h>
72
73 #include <netinet/ip6.h>
74 #ifdef INET6
75 #include <netinet6/ip6_var.h>
76 #endif
77 #include <netinet/in_pcb.h>
78 #ifdef INET6
79 #include <netinet/icmp6.h>
80 #endif
81
82 #include <sys/types.h>
83 #include <netipsec/ipsec.h>
84 #ifdef INET6
85 #include <netipsec/ipsec6.h>
86 #endif
87 #include <netipsec/ah_var.h>
88 #include <netipsec/esp_var.h>
89 #include <netipsec/ipcomp.h> /*XXX*/
90 #include <netipsec/ipcomp_var.h>
91 #include <netipsec/ipsec_support.h>
92
93 #include <netipsec/key.h>
94 #include <netipsec/keydb.h>
95 #include <netipsec/key_debug.h>
96
97 #include <netipsec/xform.h>
98
99 #include <machine/in_cksum.h>
100
101 #include <opencrypto/cryptodev.h>
102
103 /* NB: name changed so netstat doesn't use it. */
104 VNET_PCPUSTAT_DEFINE(struct ipsecstat, ipsec4stat);
105 VNET_PCPUSTAT_SYSINIT(ipsec4stat);
106
107 #ifdef VIMAGE
108 VNET_PCPUSTAT_SYSUNINIT(ipsec4stat);
109 #endif /* VIMAGE */
110
111 VNET_DEFINE(int, ip4_ah_offsetmask) = 0; /* maybe IP_DF? */
112 /* DF bit on encap. 0: clear 1: set 2: copy */
113 VNET_DEFINE(int, ip4_ipsec_dfbit) = 0;
114 VNET_DEFINE(int, ip4_esp_trans_deflev) = IPSEC_LEVEL_USE;
115 VNET_DEFINE(int, ip4_esp_net_deflev) = IPSEC_LEVEL_USE;
116 VNET_DEFINE(int, ip4_ah_trans_deflev) = IPSEC_LEVEL_USE;
117 VNET_DEFINE(int, ip4_ah_net_deflev) = IPSEC_LEVEL_USE;
118 /* ECN ignore(-1)/forbidden(0)/allowed(1) */
119 VNET_DEFINE(int, ip4_ipsec_ecn) = 0;
120 VNET_DEFINE(int, ip4_esp_randpad) = -1;
121
122 static VNET_DEFINE(int, ip4_filtertunnel) = 0;
123 #define V_ip4_filtertunnel VNET(ip4_filtertunnel)
124 static VNET_DEFINE(int, check_policy_history) = 0;
125 #define V_check_policy_history VNET(check_policy_history)
126 static VNET_DEFINE(struct secpolicy *, def_policy) = NULL;
127 #define V_def_policy VNET(def_policy)
128 static int
129 sysctl_def_policy(SYSCTL_HANDLER_ARGS)
130 {
131 int error, value;
132
133 value = V_def_policy->policy;
134 error = sysctl_handle_int(oidp, &value, 0, req);
135 if (error == 0) {
136 if (value != IPSEC_POLICY_DISCARD &&
137 value != IPSEC_POLICY_NONE)
138 return (EINVAL);
139 V_def_policy->policy = value;
140 }
141 return (error);
142 }
143
144 /*
145 * Crypto support requirements:
146 *
147 * 1 require hardware support
148 * -1 require software support
149 * 0 take anything
150 */
151 VNET_DEFINE(int, crypto_support) = CRYPTOCAP_F_HARDWARE | CRYPTOCAP_F_SOFTWARE;
152 /*
153 * TCP/UDP checksum handling policy for transport mode NAT-T (RFC3948)
154 *
155 * 0 - auto: incrementally recompute, when checksum delta is known;
156 * if checksum delta isn't known, reset checksum to zero for UDP,
157 * and mark csum_flags as valid for TCP.
158 * 1 - fully recompute TCP/UDP checksum.
159 */
160 VNET_DEFINE(int, natt_cksum_policy) = 0;
161
162 FEATURE(ipsec, "Internet Protocol Security (IPsec)");
163 FEATURE(ipsec_natt, "UDP Encapsulation of IPsec ESP Packets ('NAT-T')");
164
165 SYSCTL_DECL(_net_inet_ipsec);
166
167 /* net.inet.ipsec */
168 SYSCTL_PROC(_net_inet_ipsec, IPSECCTL_DEF_POLICY, def_policy,
169 CTLTYPE_INT | CTLFLAG_VNET | CTLFLAG_RW, 0, 0, sysctl_def_policy, "I",
170 "IPsec default policy.");
171 SYSCTL_INT(_net_inet_ipsec, IPSECCTL_DEF_ESP_TRANSLEV, esp_trans_deflev,
172 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ip4_esp_trans_deflev), 0,
173 "Default ESP transport mode level");
174 SYSCTL_INT(_net_inet_ipsec, IPSECCTL_DEF_ESP_NETLEV, esp_net_deflev,
175 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ip4_esp_net_deflev), 0,
176 "Default ESP tunnel mode level.");
177 SYSCTL_INT(_net_inet_ipsec, IPSECCTL_DEF_AH_TRANSLEV, ah_trans_deflev,
178 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ip4_ah_trans_deflev), 0,
179 "AH transfer mode default level.");
180 SYSCTL_INT(_net_inet_ipsec, IPSECCTL_DEF_AH_NETLEV, ah_net_deflev,
181 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ip4_ah_net_deflev), 0,
182 "AH tunnel mode default level.");
183 SYSCTL_INT(_net_inet_ipsec, IPSECCTL_AH_CLEARTOS, ah_cleartos,
184 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ah_cleartos), 0,
185 "If set, clear type-of-service field when doing AH computation.");
186 SYSCTL_INT(_net_inet_ipsec, IPSECCTL_AH_OFFSETMASK, ah_offsetmask,
187 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ip4_ah_offsetmask), 0,
188 "If not set, clear offset field mask when doing AH computation.");
189 SYSCTL_INT(_net_inet_ipsec, IPSECCTL_DFBIT, dfbit,
190 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ip4_ipsec_dfbit), 0,
191 "Do not fragment bit on encap.");
192 SYSCTL_INT(_net_inet_ipsec, IPSECCTL_ECN, ecn,
193 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ip4_ipsec_ecn), 0,
194 "Explicit Congestion Notification handling.");
195 SYSCTL_INT(_net_inet_ipsec, OID_AUTO, crypto_support,
196 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(crypto_support), 0,
197 "Crypto driver selection.");
198 SYSCTL_INT(_net_inet_ipsec, OID_AUTO, check_policy_history,
199 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(check_policy_history), 0,
200 "Use strict check of inbound packets to security policy compliance.");
201 SYSCTL_INT(_net_inet_ipsec, OID_AUTO, natt_cksum_policy,
202 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(natt_cksum_policy), 0,
203 "Method to fix TCP/UDP checksum for transport mode IPsec after NAT.");
204 SYSCTL_INT(_net_inet_ipsec, OID_AUTO, filtertunnel,
205 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ip4_filtertunnel), 0,
206 "If set, filter packets from an IPsec tunnel.");
207 SYSCTL_VNET_PCPUSTAT(_net_inet_ipsec, OID_AUTO, ipsecstats, struct ipsecstat,
208 ipsec4stat, "IPsec IPv4 statistics.");
209
210 #ifdef REGRESSION
211 /*
212 * When set to 1, IPsec will send packets with the same sequence number.
213 * This allows to verify if the other side has proper replay attacks detection.
214 */
215 VNET_DEFINE(int, ipsec_replay) = 0;
216 SYSCTL_INT(_net_inet_ipsec, OID_AUTO, test_replay,
217 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ipsec_replay), 0,
218 "Emulate replay attack");
219 /*
220 * When set 1, IPsec will send packets with corrupted HMAC.
221 * This allows to verify if the other side properly detects modified packets.
222 */
223 VNET_DEFINE(int, ipsec_integrity) = 0;
224 SYSCTL_INT(_net_inet_ipsec, OID_AUTO, test_integrity,
225 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ipsec_integrity), 0,
226 "Emulate man-in-the-middle attack");
227 #endif
228
229 #ifdef INET6
230 VNET_PCPUSTAT_DEFINE(struct ipsecstat, ipsec6stat);
231 VNET_PCPUSTAT_SYSINIT(ipsec6stat);
232
233 #ifdef VIMAGE
234 VNET_PCPUSTAT_SYSUNINIT(ipsec6stat);
235 #endif /* VIMAGE */
236
237 VNET_DEFINE(int, ip6_esp_trans_deflev) = IPSEC_LEVEL_USE;
238 VNET_DEFINE(int, ip6_esp_net_deflev) = IPSEC_LEVEL_USE;
239 VNET_DEFINE(int, ip6_ah_trans_deflev) = IPSEC_LEVEL_USE;
240 VNET_DEFINE(int, ip6_ah_net_deflev) = IPSEC_LEVEL_USE;
241 VNET_DEFINE(int, ip6_ipsec_ecn) = 0; /* ECN ignore(-1)/forbidden(0)/allowed(1) */
242
243 static VNET_DEFINE(int, ip6_filtertunnel) = 0;
244 #define V_ip6_filtertunnel VNET(ip6_filtertunnel)
245
246 SYSCTL_DECL(_net_inet6_ipsec6);
247
248 /* net.inet6.ipsec6 */
249 SYSCTL_PROC(_net_inet6_ipsec6, IPSECCTL_DEF_POLICY, def_policy,
250 CTLTYPE_INT | CTLFLAG_VNET | CTLFLAG_RW, 0, 0, sysctl_def_policy, "I",
251 "IPsec default policy.");
252 SYSCTL_INT(_net_inet6_ipsec6, IPSECCTL_DEF_ESP_TRANSLEV, esp_trans_deflev,
253 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ip6_esp_trans_deflev), 0,
254 "Default ESP transport mode level.");
255 SYSCTL_INT(_net_inet6_ipsec6, IPSECCTL_DEF_ESP_NETLEV, esp_net_deflev,
256 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ip6_esp_net_deflev), 0,
257 "Default ESP tunnel mode level.");
258 SYSCTL_INT(_net_inet6_ipsec6, IPSECCTL_DEF_AH_TRANSLEV, ah_trans_deflev,
259 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ip6_ah_trans_deflev), 0,
260 "AH transfer mode default level.");
261 SYSCTL_INT(_net_inet6_ipsec6, IPSECCTL_DEF_AH_NETLEV, ah_net_deflev,
262 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ip6_ah_net_deflev), 0,
263 "AH tunnel mode default level.");
264 SYSCTL_INT(_net_inet6_ipsec6, IPSECCTL_ECN, ecn,
265 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ip6_ipsec_ecn), 0,
266 "Explicit Congestion Notification handling.");
267 SYSCTL_INT(_net_inet6_ipsec6, OID_AUTO, filtertunnel,
268 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ip6_filtertunnel), 0,
269 "If set, filter packets from an IPsec tunnel.");
270 SYSCTL_VNET_PCPUSTAT(_net_inet6_ipsec6, IPSECCTL_STATS, ipsecstats,
271 struct ipsecstat, ipsec6stat, "IPsec IPv6 statistics.");
272 #endif /* INET6 */
273
274 static int ipsec_in_reject(struct secpolicy *, struct inpcb *,
275 const struct mbuf *);
276
277 #ifdef INET
278 static void ipsec4_get_ulp(const struct mbuf *, struct secpolicyindex *, int);
279 static void ipsec4_setspidx_ipaddr(const struct mbuf *,
280 struct secpolicyindex *);
281 #endif
282 #ifdef INET6
283 static void ipsec6_get_ulp(const struct mbuf *m, struct secpolicyindex *, int);
284 static void ipsec6_setspidx_ipaddr(const struct mbuf *,
285 struct secpolicyindex *);
286 #endif
287
288 /*
289 * Return a held reference to the default SP.
290 */
291 static struct secpolicy *
292 key_allocsp_default(void)
293 {
294
295 key_addref(V_def_policy);
296 return (V_def_policy);
297 }
298
299 static void
300 ipsec_invalidate_cache(struct inpcb *inp, u_int dir)
301 {
302 struct secpolicy *sp;
303
304 INP_WLOCK_ASSERT(inp);
305 if (dir == IPSEC_DIR_OUTBOUND) {
306 if (inp->inp_sp->flags & INP_INBOUND_POLICY)
307 return;
308 sp = inp->inp_sp->sp_in;
309 inp->inp_sp->sp_in = NULL;
310 } else {
311 if (inp->inp_sp->flags & INP_OUTBOUND_POLICY)
312 return;
313 sp = inp->inp_sp->sp_out;
314 inp->inp_sp->sp_out = NULL;
315 }
316 if (sp != NULL)
317 key_freesp(&sp); /* release extra reference */
318 }
319
320 static void
321 ipsec_cachepolicy(struct inpcb *inp, struct secpolicy *sp, u_int dir)
322 {
323 uint32_t genid;
324 int downgrade;
325
326 INP_LOCK_ASSERT(inp);
327
328 if (dir == IPSEC_DIR_OUTBOUND) {
329 /* Do we have configured PCB policy? */
330 if (inp->inp_sp->flags & INP_OUTBOUND_POLICY)
331 return;
332 /* Another thread has already set cached policy */
333 if (inp->inp_sp->sp_out != NULL)
334 return;
335 /*
336 * Do not cache OUTBOUND policy if PCB isn't connected,
337 * i.e. foreign address is INADDR_ANY/UNSPECIFIED.
338 */
339 #ifdef INET
340 if ((inp->inp_vflag & INP_IPV4) != 0 &&
341 inp->inp_faddr.s_addr == INADDR_ANY)
342 return;
343 #endif
344 #ifdef INET6
345 if ((inp->inp_vflag & INP_IPV6) != 0 &&
346 IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_faddr))
347 return;
348 #endif
349 } else {
350 /* Do we have configured PCB policy? */
351 if (inp->inp_sp->flags & INP_INBOUND_POLICY)
352 return;
353 /* Another thread has already set cached policy */
354 if (inp->inp_sp->sp_in != NULL)
355 return;
356 /*
357 * Do not cache INBOUND policy for listen socket,
358 * that is bound to INADDR_ANY/UNSPECIFIED address.
359 */
360 #ifdef INET
361 if ((inp->inp_vflag & INP_IPV4) != 0 &&
362 inp->inp_faddr.s_addr == INADDR_ANY)
363 return;
364 #endif
365 #ifdef INET6
366 if ((inp->inp_vflag & INP_IPV6) != 0 &&
367 IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_faddr))
368 return;
369 #endif
370 }
371 downgrade = 0;
372 if (!INP_WLOCKED(inp)) {
373 if ((downgrade = INP_TRY_UPGRADE(inp)) == 0)
374 return;
375 }
376 if (dir == IPSEC_DIR_OUTBOUND)
377 inp->inp_sp->sp_out = sp;
378 else
379 inp->inp_sp->sp_in = sp;
380 /*
381 * SP is already referenced by the lookup code.
382 * We take extra reference here to avoid race in the
383 * ipsec_getpcbpolicy() function - SP will not be freed in the
384 * time between we take SP pointer from the cache and key_addref()
385 * call.
386 */
387 key_addref(sp);
388 genid = key_getspgen();
389 if (genid != inp->inp_sp->genid) {
390 ipsec_invalidate_cache(inp, dir);
391 inp->inp_sp->genid = genid;
392 }
393 KEYDBG(IPSEC_STAMP,
394 printf("%s: PCB(%p): cached %s SP(%p)\n",
395 __func__, inp, dir == IPSEC_DIR_OUTBOUND ? "OUTBOUND":
396 "INBOUND", sp));
397 if (downgrade != 0)
398 INP_DOWNGRADE(inp);
399 }
400
401 static struct secpolicy *
402 ipsec_checkpolicy(struct secpolicy *sp, struct inpcb *inp, int *error)
403 {
404
405 /* Save found OUTBOUND policy into PCB SP cache. */
406 if (inp != NULL && inp->inp_sp != NULL && inp->inp_sp->sp_out == NULL)
407 ipsec_cachepolicy(inp, sp, IPSEC_DIR_OUTBOUND);
408
409 switch (sp->policy) {
410 default:
411 printf("%s: invalid policy %u\n", __func__, sp->policy);
412 /* FALLTHROUGH */
413 case IPSEC_POLICY_DISCARD:
414 *error = -EINVAL; /* Packet is discarded by caller. */
415 /* FALLTHROUGH */
416 case IPSEC_POLICY_BYPASS:
417 case IPSEC_POLICY_NONE:
418 key_freesp(&sp);
419 sp = NULL; /* NB: force NULL result. */
420 break;
421 case IPSEC_POLICY_IPSEC:
422 /* XXXAE: handle LARVAL SP */
423 break;
424 }
425 KEYDBG(IPSEC_DUMP,
426 printf("%s: get SP(%p), error %d\n", __func__, sp, *error));
427 return (sp);
428 }
429
430 static struct secpolicy *
431 ipsec_getpcbpolicy(struct inpcb *inp, u_int dir)
432 {
433 struct secpolicy *sp;
434 int flags, downgrade;
435
436 if (inp == NULL || inp->inp_sp == NULL)
437 return (NULL);
438
439 INP_LOCK_ASSERT(inp);
440
441 flags = inp->inp_sp->flags;
442 if (dir == IPSEC_DIR_OUTBOUND) {
443 sp = inp->inp_sp->sp_out;
444 flags &= INP_OUTBOUND_POLICY;
445 } else {
446 sp = inp->inp_sp->sp_in;
447 flags &= INP_INBOUND_POLICY;
448 }
449 /*
450 * Check flags. If we have PCB SP, just return it.
451 * Otherwise we need to check that cached SP entry isn't stale.
452 */
453 if (flags == 0) {
454 if (sp == NULL)
455 return (NULL);
456 if (inp->inp_sp->genid != key_getspgen()) {
457 /* Invalidate the cache. */
458 downgrade = 0;
459 if (!INP_WLOCKED(inp)) {
460 if ((downgrade = INP_TRY_UPGRADE(inp)) == 0)
461 return (NULL);
462 }
463 ipsec_invalidate_cache(inp, IPSEC_DIR_OUTBOUND);
464 ipsec_invalidate_cache(inp, IPSEC_DIR_INBOUND);
465 if (downgrade != 0)
466 INP_DOWNGRADE(inp);
467 return (NULL);
468 }
469 KEYDBG(IPSEC_STAMP,
470 printf("%s: PCB(%p): cache hit SP(%p)\n",
471 __func__, inp, sp));
472 /* Return referenced cached policy */
473 }
474 key_addref(sp);
475 return (sp);
476 }
477
478 #ifdef INET
479 static void
480 ipsec4_get_ulp(const struct mbuf *m, struct secpolicyindex *spidx,
481 int needport)
482 {
483 uint8_t nxt;
484 int off;
485
486 /* Sanity check. */
487 IPSEC_ASSERT(m->m_pkthdr.len >= sizeof(struct ip),
488 ("packet too short"));
489
490 if (m->m_len >= sizeof (struct ip)) {
491 const struct ip *ip = mtod(m, const struct ip *);
492 if (ip->ip_off & htons(IP_MF | IP_OFFMASK))
493 goto done;
494 off = ip->ip_hl << 2;
495 nxt = ip->ip_p;
496 } else {
497 struct ip ih;
498
499 m_copydata(m, 0, sizeof (struct ip), (caddr_t) &ih);
500 if (ih.ip_off & htons(IP_MF | IP_OFFMASK))
501 goto done;
502 off = ih.ip_hl << 2;
503 nxt = ih.ip_p;
504 }
505
506 while (off < m->m_pkthdr.len) {
507 struct ip6_ext ip6e;
508 struct tcphdr th;
509 struct udphdr uh;
510
511 switch (nxt) {
512 case IPPROTO_TCP:
513 spidx->ul_proto = nxt;
514 if (!needport)
515 goto done_proto;
516 if (off + sizeof(struct tcphdr) > m->m_pkthdr.len)
517 goto done;
518 m_copydata(m, off, sizeof (th), (caddr_t) &th);
519 spidx->src.sin.sin_port = th.th_sport;
520 spidx->dst.sin.sin_port = th.th_dport;
521 return;
522 case IPPROTO_UDP:
523 spidx->ul_proto = nxt;
524 if (!needport)
525 goto done_proto;
526 if (off + sizeof(struct udphdr) > m->m_pkthdr.len)
527 goto done;
528 m_copydata(m, off, sizeof (uh), (caddr_t) &uh);
529 spidx->src.sin.sin_port = uh.uh_sport;
530 spidx->dst.sin.sin_port = uh.uh_dport;
531 return;
532 case IPPROTO_AH:
533 if (off + sizeof(ip6e) > m->m_pkthdr.len)
534 goto done;
535 /* XXX Sigh, this works but is totally bogus. */
536 m_copydata(m, off, sizeof(ip6e), (caddr_t) &ip6e);
537 off += (ip6e.ip6e_len + 2) << 2;
538 nxt = ip6e.ip6e_nxt;
539 break;
540 case IPPROTO_ICMP:
541 default:
542 /* XXX Intermediate headers??? */
543 spidx->ul_proto = nxt;
544 goto done_proto;
545 }
546 }
547 done:
548 spidx->ul_proto = IPSEC_ULPROTO_ANY;
549 done_proto:
550 spidx->src.sin.sin_port = IPSEC_PORT_ANY;
551 spidx->dst.sin.sin_port = IPSEC_PORT_ANY;
552 KEYDBG(IPSEC_DUMP,
553 printf("%s: ", __func__); kdebug_secpolicyindex(spidx, NULL));
554 }
555
556 static void
557 ipsec4_setspidx_ipaddr(const struct mbuf *m, struct secpolicyindex *spidx)
558 {
559
560 ipsec4_setsockaddrs(m, &spidx->src, &spidx->dst);
561 spidx->prefs = sizeof(struct in_addr) << 3;
562 spidx->prefd = sizeof(struct in_addr) << 3;
563 }
564
565 static struct secpolicy *
566 ipsec4_getpolicy(const struct mbuf *m, struct inpcb *inp, u_int dir)
567 {
568 struct secpolicyindex spidx;
569 struct secpolicy *sp;
570
571 sp = ipsec_getpcbpolicy(inp, dir);
572 if (sp == NULL && key_havesp(dir)) {
573 /* Make an index to look for a policy. */
574 ipsec4_setspidx_ipaddr(m, &spidx);
575 /* Fill ports in spidx if we have inpcb. */
576 ipsec4_get_ulp(m, &spidx, inp != NULL);
577 spidx.dir = dir;
578 sp = key_allocsp(&spidx, dir);
579 }
580 if (sp == NULL) /* No SP found, use system default. */
581 sp = key_allocsp_default();
582 return (sp);
583 }
584
585 /*
586 * Check security policy for *OUTBOUND* IPv4 packet.
587 */
588 struct secpolicy *
589 ipsec4_checkpolicy(const struct mbuf *m, struct inpcb *inp, int *error)
590 {
591 struct secpolicy *sp;
592
593 *error = 0;
594 sp = ipsec4_getpolicy(m, inp, IPSEC_DIR_OUTBOUND);
595 if (sp != NULL)
596 sp = ipsec_checkpolicy(sp, inp, error);
597 if (sp == NULL) {
598 switch (*error) {
599 case 0: /* No IPsec required: BYPASS or NONE */
600 break;
601 case -EINVAL:
602 IPSECSTAT_INC(ips_out_polvio);
603 break;
604 default:
605 IPSECSTAT_INC(ips_out_inval);
606 }
607 }
608 KEYDBG(IPSEC_STAMP,
609 printf("%s: using SP(%p), error %d\n", __func__, sp, *error));
610 if (sp != NULL)
611 KEYDBG(IPSEC_DATA, kdebug_secpolicy(sp));
612 return (sp);
613 }
614
615 /*
616 * Check IPv4 packet against *INBOUND* security policy.
617 * This function is called from tcp_input(), udp_input(),
618 * rip_input() and sctp_input().
619 */
620 int
621 ipsec4_in_reject(const struct mbuf *m, struct inpcb *inp)
622 {
623 struct secpolicy *sp;
624 int result;
625
626 sp = ipsec4_getpolicy(m, inp, IPSEC_DIR_INBOUND);
627 result = ipsec_in_reject(sp, inp, m);
628 key_freesp(&sp);
629 if (result != 0)
630 IPSECSTAT_INC(ips_in_polvio);
631 return (result);
632 }
633
634 /*
635 * IPSEC_CAP() method implementation for IPv4.
636 */
637 int
638 ipsec4_capability(struct mbuf *m, u_int cap)
639 {
640
641 switch (cap) {
642 case IPSEC_CAP_BYPASS_FILTER:
643 /*
644 * Bypass packet filtering for packets previously handled
645 * by IPsec.
646 */
647 if (!V_ip4_filtertunnel &&
648 m_tag_find(m, PACKET_TAG_IPSEC_IN_DONE, NULL) != NULL)
649 return (1);
650 return (0);
651 case IPSEC_CAP_OPERABLE:
652 /* Do we have active security policies? */
653 if (key_havesp(IPSEC_DIR_INBOUND) != 0 ||
654 key_havesp(IPSEC_DIR_OUTBOUND) != 0)
655 return (1);
656 return (0);
657 };
658 return (EOPNOTSUPP);
659 }
660
661 #endif /* INET */
662
663 #ifdef INET6
664 static void
665 ipsec6_get_ulp(const struct mbuf *m, struct secpolicyindex *spidx,
666 int needport)
667 {
668 struct tcphdr th;
669 struct udphdr uh;
670 struct icmp6_hdr ih;
671 int off, nxt;
672
673 IPSEC_ASSERT(m->m_pkthdr.len >= sizeof(struct ip6_hdr),
674 ("packet too short"));
675
676 /* Set default. */
677 spidx->ul_proto = IPSEC_ULPROTO_ANY;
678 spidx->src.sin6.sin6_port = IPSEC_PORT_ANY;
679 spidx->dst.sin6.sin6_port = IPSEC_PORT_ANY;
680
681 nxt = -1;
682 off = ip6_lasthdr(m, 0, IPPROTO_IPV6, &nxt);
683 if (off < 0 || m->m_pkthdr.len < off)
684 return;
685
686 switch (nxt) {
687 case IPPROTO_TCP:
688 spidx->ul_proto = nxt;
689 if (!needport)
690 break;
691 if (off + sizeof(struct tcphdr) > m->m_pkthdr.len)
692 break;
693 m_copydata(m, off, sizeof(th), (caddr_t)&th);
694 spidx->src.sin6.sin6_port = th.th_sport;
695 spidx->dst.sin6.sin6_port = th.th_dport;
696 break;
697 case IPPROTO_UDP:
698 spidx->ul_proto = nxt;
699 if (!needport)
700 break;
701 if (off + sizeof(struct udphdr) > m->m_pkthdr.len)
702 break;
703 m_copydata(m, off, sizeof(uh), (caddr_t)&uh);
704 spidx->src.sin6.sin6_port = uh.uh_sport;
705 spidx->dst.sin6.sin6_port = uh.uh_dport;
706 break;
707 case IPPROTO_ICMPV6:
708 spidx->ul_proto = nxt;
709 if (off + sizeof(struct icmp6_hdr) > m->m_pkthdr.len)
710 break;
711 m_copydata(m, off, sizeof(ih), (caddr_t)&ih);
712 spidx->src.sin6.sin6_port = htons((uint16_t)ih.icmp6_type);
713 spidx->dst.sin6.sin6_port = htons((uint16_t)ih.icmp6_code);
714 break;
715 default:
716 /* XXX Intermediate headers??? */
717 spidx->ul_proto = nxt;
718 break;
719 }
720 KEYDBG(IPSEC_DUMP,
721 printf("%s: ", __func__); kdebug_secpolicyindex(spidx, NULL));
722 }
723
724 static void
725 ipsec6_setspidx_ipaddr(const struct mbuf *m, struct secpolicyindex *spidx)
726 {
727
728 ipsec6_setsockaddrs(m, &spidx->src, &spidx->dst);
729 spidx->prefs = sizeof(struct in6_addr) << 3;
730 spidx->prefd = sizeof(struct in6_addr) << 3;
731 }
732
733 static struct secpolicy *
734 ipsec6_getpolicy(const struct mbuf *m, struct inpcb *inp, u_int dir)
735 {
736 struct secpolicyindex spidx;
737 struct secpolicy *sp;
738
739 sp = ipsec_getpcbpolicy(inp, dir);
740 if (sp == NULL && key_havesp(dir)) {
741 /* Make an index to look for a policy. */
742 ipsec6_setspidx_ipaddr(m, &spidx);
743 /* Fill ports in spidx if we have inpcb. */
744 ipsec6_get_ulp(m, &spidx, inp != NULL);
745 spidx.dir = dir;
746 sp = key_allocsp(&spidx, dir);
747 }
748 if (sp == NULL) /* No SP found, use system default. */
749 sp = key_allocsp_default();
750 return (sp);
751 }
752
753 /*
754 * Check security policy for *OUTBOUND* IPv6 packet.
755 */
756 struct secpolicy *
757 ipsec6_checkpolicy(const struct mbuf *m, struct inpcb *inp, int *error)
758 {
759 struct secpolicy *sp;
760
761 *error = 0;
762 sp = ipsec6_getpolicy(m, inp, IPSEC_DIR_OUTBOUND);
763 if (sp != NULL)
764 sp = ipsec_checkpolicy(sp, inp, error);
765 if (sp == NULL) {
766 switch (*error) {
767 case 0: /* No IPsec required: BYPASS or NONE */
768 break;
769 case -EINVAL:
770 IPSEC6STAT_INC(ips_out_polvio);
771 break;
772 default:
773 IPSEC6STAT_INC(ips_out_inval);
774 }
775 }
776 KEYDBG(IPSEC_STAMP,
777 printf("%s: using SP(%p), error %d\n", __func__, sp, *error));
778 if (sp != NULL)
779 KEYDBG(IPSEC_DATA, kdebug_secpolicy(sp));
780 return (sp);
781 }
782
783 /*
784 * Check IPv6 packet against inbound security policy.
785 * This function is called from tcp6_input(), udp6_input(),
786 * rip6_input() and sctp_input().
787 */
788 int
789 ipsec6_in_reject(const struct mbuf *m, struct inpcb *inp)
790 {
791 struct secpolicy *sp;
792 int result;
793
794 sp = ipsec6_getpolicy(m, inp, IPSEC_DIR_INBOUND);
795 result = ipsec_in_reject(sp, inp, m);
796 key_freesp(&sp);
797 if (result)
798 IPSEC6STAT_INC(ips_in_polvio);
799 return (result);
800 }
801
802 /*
803 * IPSEC_CAP() method implementation for IPv6.
804 */
805 int
806 ipsec6_capability(struct mbuf *m, u_int cap)
807 {
808
809 switch (cap) {
810 case IPSEC_CAP_BYPASS_FILTER:
811 /*
812 * Bypass packet filtering for packets previously handled
813 * by IPsec.
814 */
815 if (!V_ip6_filtertunnel &&
816 m_tag_find(m, PACKET_TAG_IPSEC_IN_DONE, NULL) != NULL)
817 return (1);
818 return (0);
819 case IPSEC_CAP_OPERABLE:
820 /* Do we have active security policies? */
821 if (key_havesp(IPSEC_DIR_INBOUND) != 0 ||
822 key_havesp(IPSEC_DIR_OUTBOUND) != 0)
823 return (1);
824 return (0);
825 };
826 return (EOPNOTSUPP);
827 }
828 #endif /* INET6 */
829
830 int
831 ipsec_run_hhooks(struct ipsec_ctx_data *ctx, int type)
832 {
833 int idx;
834
835 switch (ctx->af) {
836 #ifdef INET
837 case AF_INET:
838 idx = HHOOK_IPSEC_INET;
839 break;
840 #endif
841 #ifdef INET6
842 case AF_INET6:
843 idx = HHOOK_IPSEC_INET6;
844 break;
845 #endif
846 default:
847 return (EPFNOSUPPORT);
848 }
849 if (type == HHOOK_TYPE_IPSEC_IN)
850 HHOOKS_RUN_IF(V_ipsec_hhh_in[idx], ctx, NULL);
851 else
852 HHOOKS_RUN_IF(V_ipsec_hhh_out[idx], ctx, NULL);
853 if (*ctx->mp == NULL)
854 return (EACCES);
855 return (0);
856 }
857
858 /*
859 * Return current level.
860 * Either IPSEC_LEVEL_USE or IPSEC_LEVEL_REQUIRE are always returned.
861 */
862 u_int
863 ipsec_get_reqlevel(struct secpolicy *sp, u_int idx)
864 {
865 struct ipsecrequest *isr;
866 u_int esp_trans_deflev, esp_net_deflev;
867 u_int ah_trans_deflev, ah_net_deflev;
868 u_int level = 0;
869
870 IPSEC_ASSERT(idx < sp->tcount, ("Wrong IPsec request index %d", idx));
871 /* XXX Note that we have ipseclog() expanded here - code sync issue. */
872 #define IPSEC_CHECK_DEFAULT(lev) \
873 (((lev) != IPSEC_LEVEL_USE && (lev) != IPSEC_LEVEL_REQUIRE && \
874 (lev) != IPSEC_LEVEL_UNIQUE) \
875 ? (V_ipsec_debug ? \
876 log(LOG_INFO, "fixed system default level " #lev ":%d->%d\n",\
877 (lev), IPSEC_LEVEL_REQUIRE) : 0), \
878 (lev) = IPSEC_LEVEL_REQUIRE, (lev) : (lev))
879
880 /*
881 * IPsec VTI uses unique security policy with fake spidx filled
882 * with zeroes. Just return IPSEC_LEVEL_REQUIRE instead of doing
883 * full level lookup for such policies.
884 */
885 if (sp->state == IPSEC_SPSTATE_IFNET) {
886 IPSEC_ASSERT(sp->req[idx]->level == IPSEC_LEVEL_UNIQUE,
887 ("Wrong IPsec request level %d", sp->req[idx]->level));
888 return (IPSEC_LEVEL_REQUIRE);
889 }
890
891 /* Set default level. */
892 switch (sp->spidx.src.sa.sa_family) {
893 #ifdef INET
894 case AF_INET:
895 esp_trans_deflev = IPSEC_CHECK_DEFAULT(V_ip4_esp_trans_deflev);
896 esp_net_deflev = IPSEC_CHECK_DEFAULT(V_ip4_esp_net_deflev);
897 ah_trans_deflev = IPSEC_CHECK_DEFAULT(V_ip4_ah_trans_deflev);
898 ah_net_deflev = IPSEC_CHECK_DEFAULT(V_ip4_ah_net_deflev);
899 break;
900 #endif
901 #ifdef INET6
902 case AF_INET6:
903 esp_trans_deflev = IPSEC_CHECK_DEFAULT(V_ip6_esp_trans_deflev);
904 esp_net_deflev = IPSEC_CHECK_DEFAULT(V_ip6_esp_net_deflev);
905 ah_trans_deflev = IPSEC_CHECK_DEFAULT(V_ip6_ah_trans_deflev);
906 ah_net_deflev = IPSEC_CHECK_DEFAULT(V_ip6_ah_net_deflev);
907 break;
908 #endif /* INET6 */
909 default:
910 panic("%s: unknown af %u",
911 __func__, sp->spidx.src.sa.sa_family);
912 }
913
914 #undef IPSEC_CHECK_DEFAULT
915
916 isr = sp->req[idx];
917 /* Set level. */
918 switch (isr->level) {
919 case IPSEC_LEVEL_DEFAULT:
920 switch (isr->saidx.proto) {
921 case IPPROTO_ESP:
922 if (isr->saidx.mode == IPSEC_MODE_TUNNEL)
923 level = esp_net_deflev;
924 else
925 level = esp_trans_deflev;
926 break;
927 case IPPROTO_AH:
928 if (isr->saidx.mode == IPSEC_MODE_TUNNEL)
929 level = ah_net_deflev;
930 else
931 level = ah_trans_deflev;
932 break;
933 case IPPROTO_IPCOMP:
934 /*
935 * We don't really care, as IPcomp document says that
936 * we shouldn't compress small packets.
937 */
938 level = IPSEC_LEVEL_USE;
939 break;
940 default:
941 panic("%s: Illegal protocol defined %u\n", __func__,
942 isr->saidx.proto);
943 }
944 break;
945
946 case IPSEC_LEVEL_USE:
947 case IPSEC_LEVEL_REQUIRE:
948 level = isr->level;
949 break;
950 case IPSEC_LEVEL_UNIQUE:
951 level = IPSEC_LEVEL_REQUIRE;
952 break;
953
954 default:
955 panic("%s: Illegal IPsec level %u\n", __func__, isr->level);
956 }
957
958 return (level);
959 }
960
961 static int
962 ipsec_check_history(const struct mbuf *m, struct secpolicy *sp, u_int idx)
963 {
964 struct xform_history *xh;
965 struct m_tag *mtag;
966
967 mtag = NULL;
968 while ((mtag = m_tag_find(__DECONST(struct mbuf *, m),
969 PACKET_TAG_IPSEC_IN_DONE, mtag)) != NULL) {
970 xh = (struct xform_history *)(mtag + 1);
971 KEYDBG(IPSEC_DATA,
972 char buf[IPSEC_ADDRSTRLEN];
973 printf("%s: mode %s proto %u dst %s\n", __func__,
974 kdebug_secasindex_mode(xh->mode), xh->proto,
975 ipsec_address(&xh->dst, buf, sizeof(buf))));
976 if (xh->proto != sp->req[idx]->saidx.proto)
977 continue;
978 /* If SA had IPSEC_MODE_ANY, consider this as match. */
979 if (xh->mode != sp->req[idx]->saidx.mode &&
980 xh->mode != IPSEC_MODE_ANY)
981 continue;
982 /*
983 * For transport mode IPsec request doesn't contain
984 * addresses. We need to use address from spidx.
985 */
986 if (sp->req[idx]->saidx.mode == IPSEC_MODE_TRANSPORT) {
987 if (key_sockaddrcmp_withmask(&xh->dst.sa,
988 &sp->spidx.dst.sa, sp->spidx.prefd) != 0)
989 continue;
990 } else {
991 if (key_sockaddrcmp(&xh->dst.sa,
992 &sp->req[idx]->saidx.dst.sa, 0) != 0)
993 continue;
994 }
995 return (0); /* matched */
996 }
997 return (1);
998 }
999
1000 /*
1001 * Check security policy requirements against the actual
1002 * packet contents. Return one if the packet should be
1003 * reject as "invalid"; otherwiser return zero to have the
1004 * packet treated as "valid".
1005 *
1006 * OUT:
1007 * 0: valid
1008 * 1: invalid
1009 */
1010 static int
1011 ipsec_in_reject(struct secpolicy *sp, struct inpcb *inp, const struct mbuf *m)
1012 {
1013 int i;
1014
1015 KEYDBG(IPSEC_STAMP,
1016 printf("%s: PCB(%p): using SP(%p)\n", __func__, inp, sp));
1017 KEYDBG(IPSEC_DATA, kdebug_secpolicy(sp));
1018
1019 if (inp != NULL && inp->inp_sp != NULL && inp->inp_sp->sp_in == NULL)
1020 ipsec_cachepolicy(inp, sp, IPSEC_DIR_INBOUND);
1021
1022 /* Check policy. */
1023 switch (sp->policy) {
1024 case IPSEC_POLICY_DISCARD:
1025 return (1);
1026 case IPSEC_POLICY_BYPASS:
1027 case IPSEC_POLICY_NONE:
1028 return (0);
1029 }
1030
1031 IPSEC_ASSERT(sp->policy == IPSEC_POLICY_IPSEC,
1032 ("invalid policy %u", sp->policy));
1033
1034 /*
1035 * ipsec[46]_common_input_cb after each transform adds
1036 * PACKET_TAG_IPSEC_IN_DONE mbuf tag. It contains SPI, proto, mode
1037 * and destination address from saidx. We can compare info from
1038 * these tags with requirements in SP.
1039 */
1040 for (i = 0; i < sp->tcount; i++) {
1041 /*
1042 * Do not check IPcomp, since IPcomp document
1043 * says that we shouldn't compress small packets.
1044 * IPComp policy should always be treated as being
1045 * in "use" level.
1046 */
1047 if (sp->req[i]->saidx.proto == IPPROTO_IPCOMP ||
1048 ipsec_get_reqlevel(sp, i) != IPSEC_LEVEL_REQUIRE)
1049 continue;
1050 if (V_check_policy_history != 0 &&
1051 ipsec_check_history(m, sp, i) != 0)
1052 return (1);
1053 else switch (sp->req[i]->saidx.proto) {
1054 case IPPROTO_ESP:
1055 if ((m->m_flags & M_DECRYPTED) == 0) {
1056 KEYDBG(IPSEC_DUMP,
1057 printf("%s: ESP m_flags:%x\n", __func__,
1058 m->m_flags));
1059 return (1);
1060 }
1061 break;
1062 case IPPROTO_AH:
1063 if ((m->m_flags & M_AUTHIPHDR) == 0) {
1064 KEYDBG(IPSEC_DUMP,
1065 printf("%s: AH m_flags:%x\n", __func__,
1066 m->m_flags));
1067 return (1);
1068 }
1069 break;
1070 }
1071 }
1072 return (0); /* Valid. */
1073 }
1074
1075 /*
1076 * Compute the byte size to be occupied by IPsec header.
1077 * In case it is tunnelled, it includes the size of outer IP header.
1078 */
1079 static size_t
1080 ipsec_hdrsiz_internal(struct secpolicy *sp)
1081 {
1082 size_t size;
1083 int i;
1084
1085 KEYDBG(IPSEC_STAMP, printf("%s: using SP(%p)\n", __func__, sp));
1086 KEYDBG(IPSEC_DATA, kdebug_secpolicy(sp));
1087
1088 switch (sp->policy) {
1089 case IPSEC_POLICY_DISCARD:
1090 case IPSEC_POLICY_BYPASS:
1091 case IPSEC_POLICY_NONE:
1092 return (0);
1093 }
1094
1095 IPSEC_ASSERT(sp->policy == IPSEC_POLICY_IPSEC,
1096 ("invalid policy %u", sp->policy));
1097
1098 /*
1099 * XXX: for each transform we need to lookup suitable SA
1100 * and use info from SA to calculate headers size.
1101 * XXX: for NAT-T we need to cosider UDP header size.
1102 */
1103 size = 0;
1104 for (i = 0; i < sp->tcount; i++) {
1105 switch (sp->req[i]->saidx.proto) {
1106 case IPPROTO_ESP:
1107 size += esp_hdrsiz(NULL);
1108 break;
1109 case IPPROTO_AH:
1110 size += ah_hdrsiz(NULL);
1111 break;
1112 case IPPROTO_IPCOMP:
1113 size += sizeof(struct ipcomp);
1114 break;
1115 }
1116
1117 if (sp->req[i]->saidx.mode == IPSEC_MODE_TUNNEL) {
1118 switch (sp->req[i]->saidx.dst.sa.sa_family) {
1119 #ifdef INET
1120 case AF_INET:
1121 size += sizeof(struct ip);
1122 break;
1123 #endif
1124 #ifdef INET6
1125 case AF_INET6:
1126 size += sizeof(struct ip6_hdr);
1127 break;
1128 #endif
1129 default:
1130 ipseclog((LOG_ERR, "%s: unknown AF %d in "
1131 "IPsec tunnel SA\n", __func__,
1132 sp->req[i]->saidx.dst.sa.sa_family));
1133 break;
1134 }
1135 }
1136 }
1137 return (size);
1138 }
1139
1140 /*
1141 * Compute ESP/AH header size for protocols with PCB, including
1142 * outer IP header. Currently only tcp_output() uses it.
1143 */
1144 size_t
1145 ipsec_hdrsiz_inpcb(struct inpcb *inp)
1146 {
1147 struct secpolicyindex spidx;
1148 struct secpolicy *sp;
1149 size_t sz;
1150
1151 sp = ipsec_getpcbpolicy(inp, IPSEC_DIR_OUTBOUND);
1152 if (sp == NULL && key_havesp(IPSEC_DIR_OUTBOUND)) {
1153 ipsec_setspidx_inpcb(inp, &spidx, IPSEC_DIR_OUTBOUND);
1154 sp = key_allocsp(&spidx, IPSEC_DIR_OUTBOUND);
1155 }
1156 if (sp == NULL)
1157 sp = key_allocsp_default();
1158 sz = ipsec_hdrsiz_internal(sp);
1159 key_freesp(&sp);
1160 return (sz);
1161 }
1162
1163 /*
1164 * Check the variable replay window.
1165 * ipsec_chkreplay() performs replay check before ICV verification.
1166 * ipsec_updatereplay() updates replay bitmap. This must be called after
1167 * ICV verification (it also performs replay check, which is usually done
1168 * beforehand).
1169 * 0 (zero) is returned if packet disallowed, 1 if packet permitted.
1170 *
1171 * Based on RFC 6479. Blocks are 32 bits unsigned integers
1172 */
1173
1174 #define IPSEC_BITMAP_INDEX_MASK(w) (w - 1)
1175 #define IPSEC_REDUNDANT_BIT_SHIFTS 5
1176 #define IPSEC_REDUNDANT_BITS (1 << IPSEC_REDUNDANT_BIT_SHIFTS)
1177 #define IPSEC_BITMAP_LOC_MASK (IPSEC_REDUNDANT_BITS - 1)
1178
1179 int
1180 ipsec_chkreplay(uint32_t seq, struct secasvar *sav)
1181 {
1182 const struct secreplay *replay;
1183 uint32_t wsizeb; /* Constant: window size. */
1184 int index, bit_location;
1185
1186 IPSEC_ASSERT(sav != NULL, ("Null SA"));
1187 IPSEC_ASSERT(sav->replay != NULL, ("Null replay state"));
1188
1189 replay = sav->replay;
1190
1191 /* No need to check replay if disabled. */
1192 if (replay->wsize == 0)
1193 return (1);
1194
1195 /* Constant. */
1196 wsizeb = replay->wsize << 3;
1197
1198 /* Sequence number of 0 is invalid. */
1199 if (seq == 0)
1200 return (0);
1201
1202 /* First time is always okay. */
1203 if (replay->count == 0)
1204 return (1);
1205
1206 /* Larger sequences are okay. */
1207 if (seq > replay->lastseq)
1208 return (1);
1209
1210 /* Over range to check, i.e. too old or wrapped. */
1211 if (replay->lastseq - seq >= wsizeb)
1212 return (0);
1213
1214 /* The sequence is inside the sliding window
1215 * now check the bit in the bitmap
1216 * bit location only depends on the sequence number
1217 */
1218 bit_location = seq & IPSEC_BITMAP_LOC_MASK;
1219 index = (seq >> IPSEC_REDUNDANT_BIT_SHIFTS)
1220 & IPSEC_BITMAP_INDEX_MASK(replay->bitmap_size);
1221
1222 /* This packet already seen? */
1223 if ((replay->bitmap)[index] & (1 << bit_location))
1224 return (0);
1225 return (1);
1226 }
1227
1228 /*
1229 * Check replay counter whether to update or not.
1230 * OUT: 0: OK
1231 * 1: NG
1232 */
1233 int
1234 ipsec_updatereplay(uint32_t seq, struct secasvar *sav)
1235 {
1236 char buf[128];
1237 struct secreplay *replay;
1238 uint32_t wsizeb; /* Constant: window size. */
1239 int diff, index, bit_location;
1240
1241 IPSEC_ASSERT(sav != NULL, ("Null SA"));
1242 IPSEC_ASSERT(sav->replay != NULL, ("Null replay state"));
1243
1244 replay = sav->replay;
1245
1246 if (replay->wsize == 0)
1247 goto ok; /* No need to check replay. */
1248
1249 /* Constant. */
1250 wsizeb = replay->wsize << 3;
1251
1252 /* Sequence number of 0 is invalid. */
1253 if (seq == 0)
1254 return (1);
1255
1256 /* The packet is too old, no need to update */
1257 if (wsizeb + seq < replay->lastseq)
1258 goto ok;
1259
1260 /* Now update the bit */
1261 index = (seq >> IPSEC_REDUNDANT_BIT_SHIFTS);
1262
1263 /* First check if the sequence number is in the range */
1264 if (seq > replay->lastseq) {
1265 int id;
1266 int index_cur = replay->lastseq >> IPSEC_REDUNDANT_BIT_SHIFTS;
1267
1268 diff = index - index_cur;
1269 if (diff > replay->bitmap_size) {
1270 /* something unusual in this case */
1271 diff = replay->bitmap_size;
1272 }
1273
1274 for (id = 0; id < diff; ++id) {
1275 replay->bitmap[(id + index_cur + 1)
1276 & IPSEC_BITMAP_INDEX_MASK(replay->bitmap_size)] = 0;
1277 }
1278
1279 replay->lastseq = seq;
1280 }
1281
1282 index &= IPSEC_BITMAP_INDEX_MASK(replay->bitmap_size);
1283 bit_location = seq & IPSEC_BITMAP_LOC_MASK;
1284
1285 /* this packet has already been received */
1286 if (replay->bitmap[index] & (1 << bit_location))
1287 return (1);
1288
1289 replay->bitmap[index] |= (1 << bit_location);
1290
1291 ok:
1292 if (replay->count == ~0) {
1293
1294 /* Set overflow flag. */
1295 replay->overflow++;
1296
1297 /* Don't increment, no more packets accepted. */
1298 if ((sav->flags & SADB_X_EXT_CYCSEQ) == 0) {
1299 if (sav->sah->saidx.proto == IPPROTO_AH)
1300 AHSTAT_INC(ahs_wrap);
1301 else if (sav->sah->saidx.proto == IPPROTO_ESP)
1302 ESPSTAT_INC(esps_wrap);
1303 return (1);
1304 }
1305
1306 ipseclog((LOG_WARNING, "%s: replay counter made %d cycle. %s\n",
1307 __func__, replay->overflow,
1308 ipsec_sa2str(sav, buf, sizeof(buf))));
1309 }
1310 return (0);
1311 }
1312
1313 int
1314 ipsec_updateid(struct secasvar *sav, uint64_t *new, uint64_t *old)
1315 {
1316 uint64_t tmp;
1317
1318 /*
1319 * tdb_cryptoid is initialized by xform_init().
1320 * Then it can be changed only when some crypto error occurred or
1321 * when SA is deleted. We stored used cryptoid in the xform_data
1322 * structure. In case when crypto error occurred and crypto
1323 * subsystem has reinited the session, it returns new cryptoid
1324 * and EAGAIN error code.
1325 *
1326 * This function will be called when we got EAGAIN from crypto
1327 * subsystem.
1328 * *new is cryptoid that was returned by crypto subsystem in
1329 * the crp_sid.
1330 * *old is the original cryptoid that we stored in xform_data.
1331 *
1332 * For first failed request *old == sav->tdb_cryptoid, then
1333 * we update sav->tdb_cryptoid and redo crypto_dispatch().
1334 * For next failed request *old != sav->tdb_cryptoid, then
1335 * we store cryptoid from first request into the *new variable
1336 * and crp_sid from this second session will be returned via
1337 * *old pointer, so caller can release second session.
1338 *
1339 * XXXAE: check this more carefully.
1340 */
1341 KEYDBG(IPSEC_STAMP,
1342 printf("%s: SA(%p) moves cryptoid %jd -> %jd\n",
1343 __func__, sav, (uintmax_t)(*old), (uintmax_t)(*new)));
1344 KEYDBG(IPSEC_DATA, kdebug_secasv(sav));
1345 SECASVAR_LOCK(sav);
1346 if (sav->tdb_cryptoid != *old) {
1347 /* cryptoid was already updated */
1348 tmp = *new;
1349 *new = sav->tdb_cryptoid;
1350 *old = tmp;
1351 SECASVAR_UNLOCK(sav);
1352 return (1);
1353 }
1354 sav->tdb_cryptoid = *new;
1355 SECASVAR_UNLOCK(sav);
1356 return (0);
1357 }
1358
1359 int
1360 ipsec_initialized(void)
1361 {
1362
1363 return (V_def_policy != NULL);
1364 }
1365
1366 static void
1367 def_policy_init(const void *unused __unused)
1368 {
1369
1370 V_def_policy = key_newsp();
1371 if (V_def_policy != NULL) {
1372 V_def_policy->policy = IPSEC_POLICY_NONE;
1373 /* Force INPCB SP cache invalidation */
1374 key_bumpspgen();
1375 } else
1376 printf("%s: failed to initialize default policy\n", __func__);
1377 }
1378
1379
1380 static void
1381 def_policy_uninit(const void *unused __unused)
1382 {
1383
1384 if (V_def_policy != NULL) {
1385 key_freesp(&V_def_policy);
1386 key_bumpspgen();
1387 }
1388 }
1389
1390 VNET_SYSINIT(def_policy_init, SI_SUB_PROTO_DOMAIN, SI_ORDER_FIRST,
1391 def_policy_init, NULL);
1392 VNET_SYSUNINIT(def_policy_uninit, SI_SUB_PROTO_DOMAIN, SI_ORDER_FIRST,
1393 def_policy_uninit, NULL);
Cache object: b93a775e154d16879dceed585891561a
|