The Design and Implementation of the FreeBSD Operating System, Second Edition
Now available: The Design and Implementation of the FreeBSD Operating System (Second Edition)


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]

FreeBSD/Linux Kernel Cross Reference
sys/netipsec/ipsec.c

Version: -  FREEBSD  -  FREEBSD-12-STABLE  -  FREEBSD-12-0  -  FREEBSD-11-STABLE  -  FREEBSD-11-2  -  FREEBSD-11-1  -  FREEBSD-11-0  -  FREEBSD-10-STABLE  -  FREEBSD-10-4  -  FREEBSD-10-3  -  FREEBSD-10-2  -  FREEBSD-10-1  -  FREEBSD-10-0  -  FREEBSD-9-STABLE  -  FREEBSD-9-3  -  FREEBSD-9-2  -  FREEBSD-9-1  -  FREEBSD-9-0  -  FREEBSD-8-STABLE  -  FREEBSD-8-4  -  FREEBSD-8-3  -  FREEBSD-8-2  -  FREEBSD-8-1  -  FREEBSD-8-0  -  FREEBSD-7-STABLE  -  FREEBSD-7-4  -  FREEBSD-7-3  -  FREEBSD-7-2  -  FREEBSD-7-1  -  FREEBSD-7-0  -  FREEBSD-6-STABLE  -  FREEBSD-6-4  -  FREEBSD-6-3  -  FREEBSD-6-2  -  FREEBSD-6-1  -  FREEBSD-6-0  -  FREEBSD-5-STABLE  -  FREEBSD-5-5  -  FREEBSD-5-4  -  FREEBSD-5-3  -  FREEBSD-5-2  -  FREEBSD-5-1  -  FREEBSD-5-0  -  FREEBSD-4-STABLE  -  FREEBSD-3-STABLE  -  FREEBSD22  -  linux-2.6  -  linux-2.4.22  -  MK83  -  MK84  -  PLAN9  -  DFBSD  -  NETBSD  -  NETBSD5  -  NETBSD4  -  NETBSD3  -  NETBSD20  -  OPENBSD  -  xnu-517  -  xnu-792  -  xnu-792.6.70  -  xnu-1228  -  xnu-1456.1.26  -  xnu-1699.24.8  -  xnu-2050.18.24  -  OPENSOLARIS  -  minix-3-1-1 
SearchContext: -  none  -  3  -  10 

    1 /*      $FreeBSD: releng/11.1/sys/netipsec/ipsec.c 315514 2017-03-18 22:04:20Z ae $     */
    2 /*      $KAME: ipsec.c,v 1.103 2001/05/24 07:14:18 sakane Exp $ */
    3 
    4 /*-
    5  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
    6  * All rights reserved.
    7  *
    8  * Redistribution and use in source and binary forms, with or without
    9  * modification, are permitted provided that the following conditions
   10  * are met:
   11  * 1. Redistributions of source code must retain the above copyright
   12  *    notice, this list of conditions and the following disclaimer.
   13  * 2. Redistributions in binary form must reproduce the above copyright
   14  *    notice, this list of conditions and the following disclaimer in the
   15  *    documentation and/or other materials provided with the distribution.
   16  * 3. Neither the name of the project nor the names of its contributors
   17  *    may be used to endorse or promote products derived from this software
   18  *    without specific prior written permission.
   19  *
   20  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
   21  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
   22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
   23  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
   24  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
   25  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
   26  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
   27  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
   28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
   29  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
   30  * SUCH DAMAGE.
   31  */
   32 
   33 /*
   34  * IPsec controller part.
   35  */
   36 
   37 #include "opt_inet.h"
   38 #include "opt_inet6.h"
   39 #include "opt_ipsec.h"
   40 
   41 #include <sys/param.h>
   42 #include <sys/systm.h>
   43 #include <sys/malloc.h>
   44 #include <sys/mbuf.h>
   45 #include <sys/domain.h>
   46 #include <sys/priv.h>
   47 #include <sys/protosw.h>
   48 #include <sys/socket.h>
   49 #include <sys/socketvar.h>
   50 #include <sys/errno.h>
   51 #include <sys/hhook.h>
   52 #include <sys/time.h>
   53 #include <sys/kernel.h>
   54 #include <sys/syslog.h>
   55 #include <sys/sysctl.h>
   56 #include <sys/proc.h>
   57 
   58 #include <net/if.h>
   59 #include <net/if_enc.h>
   60 #include <net/if_var.h>
   61 #include <net/vnet.h>
   62 
   63 #include <netinet/in.h>
   64 #include <netinet/in_systm.h>
   65 #include <netinet/ip.h>
   66 #include <netinet/ip_var.h>
   67 #include <netinet/in_var.h>
   68 #include <netinet/udp.h>
   69 #include <netinet/udp_var.h>
   70 #include <netinet/tcp.h>
   71 #include <netinet/udp.h>
   72 
   73 #include <netinet/ip6.h>
   74 #ifdef INET6
   75 #include <netinet6/ip6_var.h>
   76 #endif
   77 #include <netinet/in_pcb.h>
   78 #ifdef INET6
   79 #include <netinet/icmp6.h>
   80 #endif
   81 
   82 #include <sys/types.h>
   83 #include <netipsec/ipsec.h>
   84 #ifdef INET6
   85 #include <netipsec/ipsec6.h>
   86 #endif
   87 #include <netipsec/ah_var.h>
   88 #include <netipsec/esp_var.h>
   89 #include <netipsec/ipcomp.h>            /*XXX*/
   90 #include <netipsec/ipcomp_var.h>
   91 #include <netipsec/ipsec_support.h>
   92 
   93 #include <netipsec/key.h>
   94 #include <netipsec/keydb.h>
   95 #include <netipsec/key_debug.h>
   96 
   97 #include <netipsec/xform.h>
   98 
   99 #include <machine/in_cksum.h>
  100 
  101 #include <opencrypto/cryptodev.h>
  102 
  103 /* NB: name changed so netstat doesn't use it. */
  104 VNET_PCPUSTAT_DEFINE(struct ipsecstat, ipsec4stat);
  105 VNET_PCPUSTAT_SYSINIT(ipsec4stat);
  106 
  107 #ifdef VIMAGE
  108 VNET_PCPUSTAT_SYSUNINIT(ipsec4stat);
  109 #endif /* VIMAGE */
  110 
  111 VNET_DEFINE(int, ip4_ah_offsetmask) = 0;        /* maybe IP_DF? */
  112 /* DF bit on encap. 0: clear 1: set 2: copy */
  113 VNET_DEFINE(int, ip4_ipsec_dfbit) = 0;
  114 VNET_DEFINE(int, ip4_esp_trans_deflev) = IPSEC_LEVEL_USE;
  115 VNET_DEFINE(int, ip4_esp_net_deflev) = IPSEC_LEVEL_USE;
  116 VNET_DEFINE(int, ip4_ah_trans_deflev) = IPSEC_LEVEL_USE;
  117 VNET_DEFINE(int, ip4_ah_net_deflev) = IPSEC_LEVEL_USE;
  118 /* ECN ignore(-1)/forbidden(0)/allowed(1) */
  119 VNET_DEFINE(int, ip4_ipsec_ecn) = 0;
  120 VNET_DEFINE(int, ip4_esp_randpad) = -1;
  121 
  122 static VNET_DEFINE(int, ip4_filtertunnel) = 0;
  123 #define V_ip4_filtertunnel VNET(ip4_filtertunnel)
  124 static VNET_DEFINE(int, check_policy_history) = 0;
  125 #define V_check_policy_history  VNET(check_policy_history)
  126 static VNET_DEFINE(struct secpolicy *, def_policy) = NULL;
  127 #define V_def_policy    VNET(def_policy)
  128 static int
  129 sysctl_def_policy(SYSCTL_HANDLER_ARGS)
  130 {
  131         int error, value;
  132 
  133         value = V_def_policy->policy;
  134         error = sysctl_handle_int(oidp, &value, 0, req);
  135         if (error == 0) {
  136                 if (value != IPSEC_POLICY_DISCARD &&
  137                     value != IPSEC_POLICY_NONE)
  138                         return (EINVAL);
  139                 V_def_policy->policy = value;
  140         }
  141         return (error);
  142 }
  143 
  144 /*
  145  * Crypto support requirements:
  146  *
  147  *  1   require hardware support
  148  * -1   require software support
  149  *  0   take anything
  150  */
  151 VNET_DEFINE(int, crypto_support) = CRYPTOCAP_F_HARDWARE | CRYPTOCAP_F_SOFTWARE;
  152 /*
  153  * TCP/UDP checksum handling policy for transport mode NAT-T (RFC3948)
  154  *
  155  * 0 - auto: incrementally recompute, when checksum delta is known;
  156  *     if checksum delta isn't known, reset checksum to zero for UDP,
  157  *     and mark csum_flags as valid for TCP.
  158  * 1 - fully recompute TCP/UDP checksum.
  159  */
  160 VNET_DEFINE(int, natt_cksum_policy) = 0;
  161 
  162 FEATURE(ipsec, "Internet Protocol Security (IPsec)");
  163 FEATURE(ipsec_natt, "UDP Encapsulation of IPsec ESP Packets ('NAT-T')");
  164 
  165 SYSCTL_DECL(_net_inet_ipsec);
  166 
  167 /* net.inet.ipsec */
  168 SYSCTL_PROC(_net_inet_ipsec, IPSECCTL_DEF_POLICY, def_policy,
  169         CTLTYPE_INT | CTLFLAG_VNET | CTLFLAG_RW, 0, 0, sysctl_def_policy, "I",
  170         "IPsec default policy.");
  171 SYSCTL_INT(_net_inet_ipsec, IPSECCTL_DEF_ESP_TRANSLEV, esp_trans_deflev,
  172         CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ip4_esp_trans_deflev), 0,
  173         "Default ESP transport mode level");
  174 SYSCTL_INT(_net_inet_ipsec, IPSECCTL_DEF_ESP_NETLEV, esp_net_deflev,
  175         CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ip4_esp_net_deflev), 0,
  176         "Default ESP tunnel mode level.");
  177 SYSCTL_INT(_net_inet_ipsec, IPSECCTL_DEF_AH_TRANSLEV, ah_trans_deflev,
  178         CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ip4_ah_trans_deflev), 0,
  179         "AH transfer mode default level.");
  180 SYSCTL_INT(_net_inet_ipsec, IPSECCTL_DEF_AH_NETLEV, ah_net_deflev,
  181         CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ip4_ah_net_deflev), 0,
  182         "AH tunnel mode default level.");
  183 SYSCTL_INT(_net_inet_ipsec, IPSECCTL_AH_CLEARTOS, ah_cleartos,
  184         CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ah_cleartos), 0,
  185         "If set, clear type-of-service field when doing AH computation.");
  186 SYSCTL_INT(_net_inet_ipsec, IPSECCTL_AH_OFFSETMASK, ah_offsetmask,
  187         CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ip4_ah_offsetmask), 0,
  188         "If not set, clear offset field mask when doing AH computation.");
  189 SYSCTL_INT(_net_inet_ipsec, IPSECCTL_DFBIT, dfbit,
  190         CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ip4_ipsec_dfbit), 0,
  191         "Do not fragment bit on encap.");
  192 SYSCTL_INT(_net_inet_ipsec, IPSECCTL_ECN, ecn,
  193         CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ip4_ipsec_ecn), 0,
  194         "Explicit Congestion Notification handling.");
  195 SYSCTL_INT(_net_inet_ipsec, OID_AUTO, crypto_support,
  196         CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(crypto_support), 0,
  197         "Crypto driver selection.");
  198 SYSCTL_INT(_net_inet_ipsec, OID_AUTO, check_policy_history,
  199         CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(check_policy_history), 0,
  200         "Use strict check of inbound packets to security policy compliance.");
  201 SYSCTL_INT(_net_inet_ipsec, OID_AUTO, natt_cksum_policy,
  202         CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(natt_cksum_policy), 0,
  203         "Method to fix TCP/UDP checksum for transport mode IPsec after NAT.");
  204 SYSCTL_INT(_net_inet_ipsec, OID_AUTO, filtertunnel,
  205         CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ip4_filtertunnel), 0,
  206         "If set, filter packets from an IPsec tunnel.");
  207 SYSCTL_VNET_PCPUSTAT(_net_inet_ipsec, OID_AUTO, ipsecstats, struct ipsecstat,
  208     ipsec4stat, "IPsec IPv4 statistics.");
  209 
  210 #ifdef REGRESSION
  211 /*
  212  * When set to 1, IPsec will send packets with the same sequence number.
  213  * This allows to verify if the other side has proper replay attacks detection.
  214  */
  215 VNET_DEFINE(int, ipsec_replay) = 0;
  216 SYSCTL_INT(_net_inet_ipsec, OID_AUTO, test_replay,
  217         CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ipsec_replay), 0,
  218         "Emulate replay attack");
  219 /*
  220  * When set 1, IPsec will send packets with corrupted HMAC.
  221  * This allows to verify if the other side properly detects modified packets.
  222  */
  223 VNET_DEFINE(int, ipsec_integrity) = 0;
  224 SYSCTL_INT(_net_inet_ipsec, OID_AUTO, test_integrity,
  225         CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ipsec_integrity), 0,
  226         "Emulate man-in-the-middle attack");
  227 #endif
  228 
  229 #ifdef INET6 
  230 VNET_PCPUSTAT_DEFINE(struct ipsecstat, ipsec6stat);
  231 VNET_PCPUSTAT_SYSINIT(ipsec6stat);
  232 
  233 #ifdef VIMAGE
  234 VNET_PCPUSTAT_SYSUNINIT(ipsec6stat);
  235 #endif /* VIMAGE */
  236 
  237 VNET_DEFINE(int, ip6_esp_trans_deflev) = IPSEC_LEVEL_USE;
  238 VNET_DEFINE(int, ip6_esp_net_deflev) = IPSEC_LEVEL_USE;
  239 VNET_DEFINE(int, ip6_ah_trans_deflev) = IPSEC_LEVEL_USE;
  240 VNET_DEFINE(int, ip6_ah_net_deflev) = IPSEC_LEVEL_USE;
  241 VNET_DEFINE(int, ip6_ipsec_ecn) = 0;    /* ECN ignore(-1)/forbidden(0)/allowed(1) */
  242 
  243 static VNET_DEFINE(int, ip6_filtertunnel) = 0;
  244 #define V_ip6_filtertunnel      VNET(ip6_filtertunnel)
  245 
  246 SYSCTL_DECL(_net_inet6_ipsec6);
  247 
  248 /* net.inet6.ipsec6 */
  249 SYSCTL_PROC(_net_inet6_ipsec6, IPSECCTL_DEF_POLICY, def_policy,
  250         CTLTYPE_INT | CTLFLAG_VNET | CTLFLAG_RW, 0, 0, sysctl_def_policy, "I",
  251         "IPsec default policy.");
  252 SYSCTL_INT(_net_inet6_ipsec6, IPSECCTL_DEF_ESP_TRANSLEV, esp_trans_deflev,
  253         CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ip6_esp_trans_deflev), 0,
  254         "Default ESP transport mode level.");
  255 SYSCTL_INT(_net_inet6_ipsec6, IPSECCTL_DEF_ESP_NETLEV, esp_net_deflev,
  256         CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ip6_esp_net_deflev), 0,
  257         "Default ESP tunnel mode level.");
  258 SYSCTL_INT(_net_inet6_ipsec6, IPSECCTL_DEF_AH_TRANSLEV, ah_trans_deflev,
  259         CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ip6_ah_trans_deflev), 0,
  260         "AH transfer mode default level.");
  261 SYSCTL_INT(_net_inet6_ipsec6, IPSECCTL_DEF_AH_NETLEV, ah_net_deflev,
  262         CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ip6_ah_net_deflev), 0,
  263         "AH tunnel mode default level.");
  264 SYSCTL_INT(_net_inet6_ipsec6, IPSECCTL_ECN, ecn,
  265         CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ip6_ipsec_ecn), 0,
  266         "Explicit Congestion Notification handling.");
  267 SYSCTL_INT(_net_inet6_ipsec6, OID_AUTO, filtertunnel,
  268         CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ip6_filtertunnel),  0,
  269         "If set, filter packets from an IPsec tunnel.");
  270 SYSCTL_VNET_PCPUSTAT(_net_inet6_ipsec6, IPSECCTL_STATS, ipsecstats,
  271     struct ipsecstat, ipsec6stat, "IPsec IPv6 statistics.");
  272 #endif /* INET6 */
  273 
  274 static int ipsec_in_reject(struct secpolicy *, struct inpcb *,
  275     const struct mbuf *);
  276 
  277 #ifdef INET
  278 static void ipsec4_get_ulp(const struct mbuf *, struct secpolicyindex *, int);
  279 static void ipsec4_setspidx_ipaddr(const struct mbuf *,
  280     struct secpolicyindex *);
  281 #endif
  282 #ifdef INET6
  283 static void ipsec6_get_ulp(const struct mbuf *m, struct secpolicyindex *, int);
  284 static void ipsec6_setspidx_ipaddr(const struct mbuf *,
  285     struct secpolicyindex *);
  286 #endif
  287 
  288 /*
  289  * Return a held reference to the default SP.
  290  */
  291 static struct secpolicy *
  292 key_allocsp_default(void)
  293 {
  294 
  295         key_addref(V_def_policy);
  296         return (V_def_policy);
  297 }
  298 
  299 static void
  300 ipsec_invalidate_cache(struct inpcb *inp, u_int dir)
  301 {
  302         struct secpolicy *sp;
  303 
  304         INP_WLOCK_ASSERT(inp);
  305         if (dir == IPSEC_DIR_OUTBOUND) {
  306                 if (inp->inp_sp->flags & INP_INBOUND_POLICY)
  307                         return;
  308                 sp = inp->inp_sp->sp_in;
  309                 inp->inp_sp->sp_in = NULL;
  310         } else {
  311                 if (inp->inp_sp->flags & INP_OUTBOUND_POLICY)
  312                         return;
  313                 sp = inp->inp_sp->sp_out;
  314                 inp->inp_sp->sp_out = NULL;
  315         }
  316         if (sp != NULL)
  317                 key_freesp(&sp); /* release extra reference */
  318 }
  319 
  320 static void
  321 ipsec_cachepolicy(struct inpcb *inp, struct secpolicy *sp, u_int dir)
  322 {
  323         uint32_t genid;
  324         int downgrade;
  325 
  326         INP_LOCK_ASSERT(inp);
  327 
  328         if (dir == IPSEC_DIR_OUTBOUND) {
  329                 /* Do we have configured PCB policy? */
  330                 if (inp->inp_sp->flags & INP_OUTBOUND_POLICY)
  331                         return;
  332                 /* Another thread has already set cached policy */
  333                 if (inp->inp_sp->sp_out != NULL)
  334                         return;
  335                 /*
  336                  * Do not cache OUTBOUND policy if PCB isn't connected,
  337                  * i.e. foreign address is INADDR_ANY/UNSPECIFIED.
  338                  */
  339 #ifdef INET
  340                 if ((inp->inp_vflag & INP_IPV4) != 0 &&
  341                     inp->inp_faddr.s_addr == INADDR_ANY)
  342                         return;
  343 #endif
  344 #ifdef INET6
  345                 if ((inp->inp_vflag & INP_IPV6) != 0 &&
  346                     IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_faddr))
  347                         return;
  348 #endif
  349         } else {
  350                 /* Do we have configured PCB policy? */
  351                 if (inp->inp_sp->flags & INP_INBOUND_POLICY)
  352                         return;
  353                 /* Another thread has already set cached policy */
  354                 if (inp->inp_sp->sp_in != NULL)
  355                         return;
  356                 /*
  357                  * Do not cache INBOUND policy for listen socket,
  358                  * that is bound to INADDR_ANY/UNSPECIFIED address.
  359                  */
  360 #ifdef INET
  361                 if ((inp->inp_vflag & INP_IPV4) != 0 &&
  362                     inp->inp_faddr.s_addr == INADDR_ANY)
  363                         return;
  364 #endif
  365 #ifdef INET6
  366                 if ((inp->inp_vflag & INP_IPV6) != 0 &&
  367                     IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_faddr))
  368                         return;
  369 #endif
  370         }
  371         downgrade = 0;
  372         if (!INP_WLOCKED(inp)) {
  373                 if ((downgrade = INP_TRY_UPGRADE(inp)) == 0)
  374                         return;
  375         }
  376         if (dir == IPSEC_DIR_OUTBOUND)
  377                 inp->inp_sp->sp_out = sp;
  378         else
  379                 inp->inp_sp->sp_in = sp;
  380         /*
  381          * SP is already referenced by the lookup code.
  382          * We take extra reference here to avoid race in the
  383          * ipsec_getpcbpolicy() function - SP will not be freed in the
  384          * time between we take SP pointer from the cache and key_addref()
  385          * call.
  386          */
  387         key_addref(sp);
  388         genid = key_getspgen();
  389         if (genid != inp->inp_sp->genid) {
  390                 ipsec_invalidate_cache(inp, dir);
  391                 inp->inp_sp->genid = genid;
  392         }
  393         KEYDBG(IPSEC_STAMP,
  394             printf("%s: PCB(%p): cached %s SP(%p)\n",
  395             __func__, inp, dir == IPSEC_DIR_OUTBOUND ? "OUTBOUND":
  396             "INBOUND", sp));
  397         if (downgrade != 0)
  398                 INP_DOWNGRADE(inp);
  399 }
  400 
  401 static struct secpolicy *
  402 ipsec_checkpolicy(struct secpolicy *sp, struct inpcb *inp, int *error)
  403 {
  404 
  405         /* Save found OUTBOUND policy into PCB SP cache. */
  406         if (inp != NULL && inp->inp_sp != NULL && inp->inp_sp->sp_out == NULL)
  407                 ipsec_cachepolicy(inp, sp, IPSEC_DIR_OUTBOUND);
  408 
  409         switch (sp->policy) {
  410         default:
  411                 printf("%s: invalid policy %u\n", __func__, sp->policy);
  412                 /* FALLTHROUGH */
  413         case IPSEC_POLICY_DISCARD:
  414                 *error = -EINVAL;       /* Packet is discarded by caller. */
  415                 /* FALLTHROUGH */
  416         case IPSEC_POLICY_BYPASS:
  417         case IPSEC_POLICY_NONE:
  418                 key_freesp(&sp);
  419                 sp = NULL;              /* NB: force NULL result. */
  420                 break;
  421         case IPSEC_POLICY_IPSEC:
  422                 /* XXXAE: handle LARVAL SP */
  423                 break;
  424         }
  425         KEYDBG(IPSEC_DUMP,
  426             printf("%s: get SP(%p), error %d\n", __func__, sp, *error));
  427         return (sp);
  428 }
  429 
  430 static struct secpolicy *
  431 ipsec_getpcbpolicy(struct inpcb *inp, u_int dir)
  432 {
  433         struct secpolicy *sp;
  434         int flags, downgrade;
  435 
  436         if (inp == NULL || inp->inp_sp == NULL)
  437                 return (NULL);
  438 
  439         INP_LOCK_ASSERT(inp);
  440 
  441         flags = inp->inp_sp->flags;
  442         if (dir == IPSEC_DIR_OUTBOUND) {
  443                 sp = inp->inp_sp->sp_out;
  444                 flags &= INP_OUTBOUND_POLICY;
  445         } else {
  446                 sp = inp->inp_sp->sp_in;
  447                 flags &= INP_INBOUND_POLICY;
  448         }
  449         /*
  450          * Check flags. If we have PCB SP, just return it.
  451          * Otherwise we need to check that cached SP entry isn't stale.
  452          */
  453         if (flags == 0) {
  454                 if (sp == NULL)
  455                         return (NULL);
  456                 if (inp->inp_sp->genid != key_getspgen()) {
  457                         /* Invalidate the cache. */
  458                         downgrade = 0;
  459                         if (!INP_WLOCKED(inp)) {
  460                                 if ((downgrade = INP_TRY_UPGRADE(inp)) == 0)
  461                                         return (NULL);
  462                         }
  463                         ipsec_invalidate_cache(inp, IPSEC_DIR_OUTBOUND);
  464                         ipsec_invalidate_cache(inp, IPSEC_DIR_INBOUND);
  465                         if (downgrade != 0)
  466                                 INP_DOWNGRADE(inp);
  467                         return (NULL);
  468                 }
  469                 KEYDBG(IPSEC_STAMP,
  470                     printf("%s: PCB(%p): cache hit SP(%p)\n",
  471                     __func__, inp, sp));
  472                 /* Return referenced cached policy */
  473         }
  474         key_addref(sp);
  475         return (sp);
  476 }
  477 
  478 #ifdef INET
  479 static void
  480 ipsec4_get_ulp(const struct mbuf *m, struct secpolicyindex *spidx,
  481     int needport)
  482 {
  483         uint8_t nxt;
  484         int off;
  485 
  486         /* Sanity check. */
  487         IPSEC_ASSERT(m->m_pkthdr.len >= sizeof(struct ip),
  488             ("packet too short"));
  489 
  490         if (m->m_len >= sizeof (struct ip)) {
  491                 const struct ip *ip = mtod(m, const struct ip *);
  492                 if (ip->ip_off & htons(IP_MF | IP_OFFMASK))
  493                         goto done;
  494                 off = ip->ip_hl << 2;
  495                 nxt = ip->ip_p;
  496         } else {
  497                 struct ip ih;
  498 
  499                 m_copydata(m, 0, sizeof (struct ip), (caddr_t) &ih);
  500                 if (ih.ip_off & htons(IP_MF | IP_OFFMASK))
  501                         goto done;
  502                 off = ih.ip_hl << 2;
  503                 nxt = ih.ip_p;
  504         }
  505 
  506         while (off < m->m_pkthdr.len) {
  507                 struct ip6_ext ip6e;
  508                 struct tcphdr th;
  509                 struct udphdr uh;
  510 
  511                 switch (nxt) {
  512                 case IPPROTO_TCP:
  513                         spidx->ul_proto = nxt;
  514                         if (!needport)
  515                                 goto done_proto;
  516                         if (off + sizeof(struct tcphdr) > m->m_pkthdr.len)
  517                                 goto done;
  518                         m_copydata(m, off, sizeof (th), (caddr_t) &th);
  519                         spidx->src.sin.sin_port = th.th_sport;
  520                         spidx->dst.sin.sin_port = th.th_dport;
  521                         return;
  522                 case IPPROTO_UDP:
  523                         spidx->ul_proto = nxt;
  524                         if (!needport)
  525                                 goto done_proto;
  526                         if (off + sizeof(struct udphdr) > m->m_pkthdr.len)
  527                                 goto done;
  528                         m_copydata(m, off, sizeof (uh), (caddr_t) &uh);
  529                         spidx->src.sin.sin_port = uh.uh_sport;
  530                         spidx->dst.sin.sin_port = uh.uh_dport;
  531                         return;
  532                 case IPPROTO_AH:
  533                         if (off + sizeof(ip6e) > m->m_pkthdr.len)
  534                                 goto done;
  535                         /* XXX Sigh, this works but is totally bogus. */
  536                         m_copydata(m, off, sizeof(ip6e), (caddr_t) &ip6e);
  537                         off += (ip6e.ip6e_len + 2) << 2;
  538                         nxt = ip6e.ip6e_nxt;
  539                         break;
  540                 case IPPROTO_ICMP:
  541                 default:
  542                         /* XXX Intermediate headers??? */
  543                         spidx->ul_proto = nxt;
  544                         goto done_proto;
  545                 }
  546         }
  547 done:
  548         spidx->ul_proto = IPSEC_ULPROTO_ANY;
  549 done_proto:
  550         spidx->src.sin.sin_port = IPSEC_PORT_ANY;
  551         spidx->dst.sin.sin_port = IPSEC_PORT_ANY;
  552         KEYDBG(IPSEC_DUMP,
  553             printf("%s: ", __func__); kdebug_secpolicyindex(spidx, NULL));
  554 }
  555 
  556 static void
  557 ipsec4_setspidx_ipaddr(const struct mbuf *m, struct secpolicyindex *spidx)
  558 {
  559 
  560         ipsec4_setsockaddrs(m, &spidx->src, &spidx->dst);
  561         spidx->prefs = sizeof(struct in_addr) << 3;
  562         spidx->prefd = sizeof(struct in_addr) << 3;
  563 }
  564 
  565 static struct secpolicy *
  566 ipsec4_getpolicy(const struct mbuf *m, struct inpcb *inp, u_int dir)
  567 {
  568         struct secpolicyindex spidx;
  569         struct secpolicy *sp;
  570 
  571         sp = ipsec_getpcbpolicy(inp, dir);
  572         if (sp == NULL && key_havesp(dir)) {
  573                 /* Make an index to look for a policy. */
  574                 ipsec4_setspidx_ipaddr(m, &spidx);
  575                 /* Fill ports in spidx if we have inpcb. */
  576                 ipsec4_get_ulp(m, &spidx, inp != NULL);
  577                 spidx.dir = dir;
  578                 sp = key_allocsp(&spidx, dir);
  579         }
  580         if (sp == NULL)         /* No SP found, use system default. */
  581                 sp = key_allocsp_default();
  582         return (sp);
  583 }
  584 
  585 /*
  586  * Check security policy for *OUTBOUND* IPv4 packet.
  587  */
  588 struct secpolicy *
  589 ipsec4_checkpolicy(const struct mbuf *m, struct inpcb *inp, int *error)
  590 {
  591         struct secpolicy *sp;
  592 
  593         *error = 0;
  594         sp = ipsec4_getpolicy(m, inp, IPSEC_DIR_OUTBOUND);
  595         if (sp != NULL)
  596                 sp = ipsec_checkpolicy(sp, inp, error);
  597         if (sp == NULL) {
  598                 switch (*error) {
  599                 case 0: /* No IPsec required: BYPASS or NONE */
  600                         break;
  601                 case -EINVAL:
  602                         IPSECSTAT_INC(ips_out_polvio);
  603                         break;
  604                 default:
  605                         IPSECSTAT_INC(ips_out_inval);
  606                 }
  607         }
  608         KEYDBG(IPSEC_STAMP,
  609             printf("%s: using SP(%p), error %d\n", __func__, sp, *error));
  610         if (sp != NULL)
  611                 KEYDBG(IPSEC_DATA, kdebug_secpolicy(sp));
  612         return (sp);
  613 }
  614 
  615 /*
  616  * Check IPv4 packet against *INBOUND* security policy.
  617  * This function is called from tcp_input(), udp_input(),
  618  * rip_input() and sctp_input().
  619  */
  620 int
  621 ipsec4_in_reject(const struct mbuf *m, struct inpcb *inp)
  622 {
  623         struct secpolicy *sp;
  624         int result;
  625 
  626         sp = ipsec4_getpolicy(m, inp, IPSEC_DIR_INBOUND);
  627         result = ipsec_in_reject(sp, inp, m);
  628         key_freesp(&sp);
  629         if (result != 0)
  630                 IPSECSTAT_INC(ips_in_polvio);
  631         return (result);
  632 }
  633 
  634 /*
  635  * IPSEC_CAP() method implementation for IPv4.
  636  */
  637 int
  638 ipsec4_capability(struct mbuf *m, u_int cap)
  639 {
  640 
  641         switch (cap) {
  642         case IPSEC_CAP_BYPASS_FILTER:
  643                 /*
  644                  * Bypass packet filtering for packets previously handled
  645                  * by IPsec.
  646                  */
  647                 if (!V_ip4_filtertunnel &&
  648                     m_tag_find(m, PACKET_TAG_IPSEC_IN_DONE, NULL) != NULL)
  649                         return (1);
  650                 return (0);
  651         case IPSEC_CAP_OPERABLE:
  652                 /* Do we have active security policies? */
  653                 if (key_havesp(IPSEC_DIR_INBOUND) != 0 ||
  654                     key_havesp(IPSEC_DIR_OUTBOUND) != 0)
  655                         return (1);
  656                 return (0);
  657         };
  658         return (EOPNOTSUPP);
  659 }
  660 
  661 #endif /* INET */
  662 
  663 #ifdef INET6
  664 static void
  665 ipsec6_get_ulp(const struct mbuf *m, struct secpolicyindex *spidx,
  666     int needport)
  667 {
  668         struct tcphdr th;
  669         struct udphdr uh;
  670         struct icmp6_hdr ih;
  671         int off, nxt;
  672 
  673         IPSEC_ASSERT(m->m_pkthdr.len >= sizeof(struct ip6_hdr),
  674             ("packet too short"));
  675 
  676         /* Set default. */
  677         spidx->ul_proto = IPSEC_ULPROTO_ANY;
  678         spidx->src.sin6.sin6_port = IPSEC_PORT_ANY;
  679         spidx->dst.sin6.sin6_port = IPSEC_PORT_ANY;
  680 
  681         nxt = -1;
  682         off = ip6_lasthdr(m, 0, IPPROTO_IPV6, &nxt);
  683         if (off < 0 || m->m_pkthdr.len < off)
  684                 return;
  685 
  686         switch (nxt) {
  687         case IPPROTO_TCP:
  688                 spidx->ul_proto = nxt;
  689                 if (!needport)
  690                         break;
  691                 if (off + sizeof(struct tcphdr) > m->m_pkthdr.len)
  692                         break;
  693                 m_copydata(m, off, sizeof(th), (caddr_t)&th);
  694                 spidx->src.sin6.sin6_port = th.th_sport;
  695                 spidx->dst.sin6.sin6_port = th.th_dport;
  696                 break;
  697         case IPPROTO_UDP:
  698                 spidx->ul_proto = nxt;
  699                 if (!needport)
  700                         break;
  701                 if (off + sizeof(struct udphdr) > m->m_pkthdr.len)
  702                         break;
  703                 m_copydata(m, off, sizeof(uh), (caddr_t)&uh);
  704                 spidx->src.sin6.sin6_port = uh.uh_sport;
  705                 spidx->dst.sin6.sin6_port = uh.uh_dport;
  706                 break;
  707         case IPPROTO_ICMPV6:
  708                 spidx->ul_proto = nxt;
  709                 if (off + sizeof(struct icmp6_hdr) > m->m_pkthdr.len)
  710                         break;
  711                 m_copydata(m, off, sizeof(ih), (caddr_t)&ih);
  712                 spidx->src.sin6.sin6_port = htons((uint16_t)ih.icmp6_type);
  713                 spidx->dst.sin6.sin6_port = htons((uint16_t)ih.icmp6_code);
  714                 break;
  715         default:
  716                 /* XXX Intermediate headers??? */
  717                 spidx->ul_proto = nxt;
  718                 break;
  719         }
  720         KEYDBG(IPSEC_DUMP,
  721             printf("%s: ", __func__); kdebug_secpolicyindex(spidx, NULL));
  722 }
  723 
  724 static void
  725 ipsec6_setspidx_ipaddr(const struct mbuf *m, struct secpolicyindex *spidx)
  726 {
  727 
  728         ipsec6_setsockaddrs(m, &spidx->src, &spidx->dst);
  729         spidx->prefs = sizeof(struct in6_addr) << 3;
  730         spidx->prefd = sizeof(struct in6_addr) << 3;
  731 }
  732 
  733 static struct secpolicy *
  734 ipsec6_getpolicy(const struct mbuf *m, struct inpcb *inp, u_int dir)
  735 {
  736         struct secpolicyindex spidx;
  737         struct secpolicy *sp;
  738 
  739         sp = ipsec_getpcbpolicy(inp, dir);
  740         if (sp == NULL && key_havesp(dir)) {
  741                 /* Make an index to look for a policy. */
  742                 ipsec6_setspidx_ipaddr(m, &spidx);
  743                 /* Fill ports in spidx if we have inpcb. */
  744                 ipsec6_get_ulp(m, &spidx, inp != NULL);
  745                 spidx.dir = dir;
  746                 sp = key_allocsp(&spidx, dir);
  747         }
  748         if (sp == NULL)         /* No SP found, use system default. */
  749                 sp = key_allocsp_default();
  750         return (sp);
  751 }
  752 
  753 /*
  754  * Check security policy for *OUTBOUND* IPv6 packet.
  755  */
  756 struct secpolicy *
  757 ipsec6_checkpolicy(const struct mbuf *m, struct inpcb *inp, int *error)
  758 {
  759         struct secpolicy *sp;
  760 
  761         *error = 0;
  762         sp = ipsec6_getpolicy(m, inp, IPSEC_DIR_OUTBOUND);
  763         if (sp != NULL)
  764                 sp = ipsec_checkpolicy(sp, inp, error);
  765         if (sp == NULL) {
  766                 switch (*error) {
  767                 case 0: /* No IPsec required: BYPASS or NONE */
  768                         break;
  769                 case -EINVAL:
  770                         IPSEC6STAT_INC(ips_out_polvio);
  771                         break;
  772                 default:
  773                         IPSEC6STAT_INC(ips_out_inval);
  774                 }
  775         }
  776         KEYDBG(IPSEC_STAMP,
  777             printf("%s: using SP(%p), error %d\n", __func__, sp, *error));
  778         if (sp != NULL)
  779                 KEYDBG(IPSEC_DATA, kdebug_secpolicy(sp));
  780         return (sp);
  781 }
  782 
  783 /*
  784  * Check IPv6 packet against inbound security policy.
  785  * This function is called from tcp6_input(), udp6_input(),
  786  * rip6_input() and sctp_input().
  787  */
  788 int
  789 ipsec6_in_reject(const struct mbuf *m, struct inpcb *inp)
  790 {
  791         struct secpolicy *sp;
  792         int result;
  793 
  794         sp = ipsec6_getpolicy(m, inp, IPSEC_DIR_INBOUND);
  795         result = ipsec_in_reject(sp, inp, m);
  796         key_freesp(&sp);
  797         if (result)
  798                 IPSEC6STAT_INC(ips_in_polvio);
  799         return (result);
  800 }
  801 
  802 /*
  803  * IPSEC_CAP() method implementation for IPv6.
  804  */
  805 int
  806 ipsec6_capability(struct mbuf *m, u_int cap)
  807 {
  808 
  809         switch (cap) {
  810         case IPSEC_CAP_BYPASS_FILTER:
  811                 /*
  812                  * Bypass packet filtering for packets previously handled
  813                  * by IPsec.
  814                  */
  815                 if (!V_ip6_filtertunnel &&
  816                     m_tag_find(m, PACKET_TAG_IPSEC_IN_DONE, NULL) != NULL)
  817                         return (1);
  818                 return (0);
  819         case IPSEC_CAP_OPERABLE:
  820                 /* Do we have active security policies? */
  821                 if (key_havesp(IPSEC_DIR_INBOUND) != 0 ||
  822                     key_havesp(IPSEC_DIR_OUTBOUND) != 0)
  823                         return (1);
  824                 return (0);
  825         };
  826         return (EOPNOTSUPP);
  827 }
  828 #endif /* INET6 */
  829 
  830 int
  831 ipsec_run_hhooks(struct ipsec_ctx_data *ctx, int type)
  832 {
  833         int idx;
  834 
  835         switch (ctx->af) {
  836 #ifdef INET
  837         case AF_INET:
  838                 idx = HHOOK_IPSEC_INET;
  839                 break;
  840 #endif
  841 #ifdef INET6
  842         case AF_INET6:
  843                 idx = HHOOK_IPSEC_INET6;
  844                 break;
  845 #endif
  846         default:
  847                 return (EPFNOSUPPORT);
  848         }
  849         if (type == HHOOK_TYPE_IPSEC_IN)
  850                 HHOOKS_RUN_IF(V_ipsec_hhh_in[idx], ctx, NULL);
  851         else
  852                 HHOOKS_RUN_IF(V_ipsec_hhh_out[idx], ctx, NULL);
  853         if (*ctx->mp == NULL)
  854                 return (EACCES);
  855         return (0);
  856 }
  857 
  858 /*
  859  * Return current level.
  860  * Either IPSEC_LEVEL_USE or IPSEC_LEVEL_REQUIRE are always returned.
  861  */
  862 u_int
  863 ipsec_get_reqlevel(struct secpolicy *sp, u_int idx)
  864 {
  865         struct ipsecrequest *isr;
  866         u_int esp_trans_deflev, esp_net_deflev;
  867         u_int ah_trans_deflev, ah_net_deflev;
  868         u_int level = 0;
  869 
  870         IPSEC_ASSERT(idx < sp->tcount, ("Wrong IPsec request index %d", idx));
  871 /* XXX Note that we have ipseclog() expanded here - code sync issue. */
  872 #define IPSEC_CHECK_DEFAULT(lev) \
  873         (((lev) != IPSEC_LEVEL_USE && (lev) != IPSEC_LEVEL_REQUIRE &&   \
  874           (lev) != IPSEC_LEVEL_UNIQUE)                                  \
  875                 ? (V_ipsec_debug  ?                                     \
  876                 log(LOG_INFO, "fixed system default level " #lev ":%d->%d\n",\
  877                 (lev), IPSEC_LEVEL_REQUIRE) : 0),                       \
  878                 (lev) = IPSEC_LEVEL_REQUIRE, (lev) : (lev))
  879 
  880         /*
  881          * IPsec VTI uses unique security policy with fake spidx filled
  882          * with zeroes. Just return IPSEC_LEVEL_REQUIRE instead of doing
  883          * full level lookup for such policies.
  884          */
  885         if (sp->state == IPSEC_SPSTATE_IFNET) {
  886                 IPSEC_ASSERT(sp->req[idx]->level == IPSEC_LEVEL_UNIQUE,
  887                     ("Wrong IPsec request level %d", sp->req[idx]->level));
  888                 return (IPSEC_LEVEL_REQUIRE);
  889         }
  890 
  891         /* Set default level. */
  892         switch (sp->spidx.src.sa.sa_family) {
  893 #ifdef INET
  894         case AF_INET:
  895                 esp_trans_deflev = IPSEC_CHECK_DEFAULT(V_ip4_esp_trans_deflev);
  896                 esp_net_deflev = IPSEC_CHECK_DEFAULT(V_ip4_esp_net_deflev);
  897                 ah_trans_deflev = IPSEC_CHECK_DEFAULT(V_ip4_ah_trans_deflev);
  898                 ah_net_deflev = IPSEC_CHECK_DEFAULT(V_ip4_ah_net_deflev);
  899                 break;
  900 #endif
  901 #ifdef INET6
  902         case AF_INET6:
  903                 esp_trans_deflev = IPSEC_CHECK_DEFAULT(V_ip6_esp_trans_deflev);
  904                 esp_net_deflev = IPSEC_CHECK_DEFAULT(V_ip6_esp_net_deflev);
  905                 ah_trans_deflev = IPSEC_CHECK_DEFAULT(V_ip6_ah_trans_deflev);
  906                 ah_net_deflev = IPSEC_CHECK_DEFAULT(V_ip6_ah_net_deflev);
  907                 break;
  908 #endif /* INET6 */
  909         default:
  910                 panic("%s: unknown af %u",
  911                         __func__, sp->spidx.src.sa.sa_family);
  912         }
  913 
  914 #undef IPSEC_CHECK_DEFAULT
  915 
  916         isr = sp->req[idx];
  917         /* Set level. */
  918         switch (isr->level) {
  919         case IPSEC_LEVEL_DEFAULT:
  920                 switch (isr->saidx.proto) {
  921                 case IPPROTO_ESP:
  922                         if (isr->saidx.mode == IPSEC_MODE_TUNNEL)
  923                                 level = esp_net_deflev;
  924                         else
  925                                 level = esp_trans_deflev;
  926                         break;
  927                 case IPPROTO_AH:
  928                         if (isr->saidx.mode == IPSEC_MODE_TUNNEL)
  929                                 level = ah_net_deflev;
  930                         else
  931                                 level = ah_trans_deflev;
  932                         break;
  933                 case IPPROTO_IPCOMP:
  934                         /*
  935                          * We don't really care, as IPcomp document says that
  936                          * we shouldn't compress small packets.
  937                          */
  938                         level = IPSEC_LEVEL_USE;
  939                         break;
  940                 default:
  941                         panic("%s: Illegal protocol defined %u\n", __func__,
  942                                 isr->saidx.proto);
  943                 }
  944                 break;
  945 
  946         case IPSEC_LEVEL_USE:
  947         case IPSEC_LEVEL_REQUIRE:
  948                 level = isr->level;
  949                 break;
  950         case IPSEC_LEVEL_UNIQUE:
  951                 level = IPSEC_LEVEL_REQUIRE;
  952                 break;
  953 
  954         default:
  955                 panic("%s: Illegal IPsec level %u\n", __func__, isr->level);
  956         }
  957 
  958         return (level);
  959 }
  960 
  961 static int
  962 ipsec_check_history(const struct mbuf *m, struct secpolicy *sp, u_int idx)
  963 {
  964         struct xform_history *xh;
  965         struct m_tag *mtag;
  966 
  967         mtag = NULL;
  968         while ((mtag = m_tag_find(__DECONST(struct mbuf *, m),
  969             PACKET_TAG_IPSEC_IN_DONE, mtag)) != NULL) {
  970                 xh = (struct xform_history *)(mtag + 1);
  971                 KEYDBG(IPSEC_DATA,
  972                     char buf[IPSEC_ADDRSTRLEN];
  973                     printf("%s: mode %s proto %u dst %s\n", __func__,
  974                         kdebug_secasindex_mode(xh->mode), xh->proto,
  975                         ipsec_address(&xh->dst, buf, sizeof(buf))));
  976                 if (xh->proto != sp->req[idx]->saidx.proto)
  977                         continue;
  978                 /* If SA had IPSEC_MODE_ANY, consider this as match. */
  979                 if (xh->mode != sp->req[idx]->saidx.mode &&
  980                     xh->mode != IPSEC_MODE_ANY)
  981                         continue;
  982                 /*
  983                  * For transport mode IPsec request doesn't contain
  984                  * addresses. We need to use address from spidx.
  985                  */
  986                 if (sp->req[idx]->saidx.mode == IPSEC_MODE_TRANSPORT) {
  987                         if (key_sockaddrcmp_withmask(&xh->dst.sa,
  988                             &sp->spidx.dst.sa, sp->spidx.prefd) != 0)
  989                                 continue;
  990                 } else {
  991                         if (key_sockaddrcmp(&xh->dst.sa,
  992                             &sp->req[idx]->saidx.dst.sa, 0) != 0)
  993                                 continue;
  994                 }
  995                 return (0); /* matched */
  996         }
  997         return (1);
  998 }
  999 
 1000 /*
 1001  * Check security policy requirements against the actual
 1002  * packet contents.  Return one if the packet should be
 1003  * reject as "invalid"; otherwiser return zero to have the
 1004  * packet treated as "valid".
 1005  *
 1006  * OUT:
 1007  *      0: valid
 1008  *      1: invalid
 1009  */
 1010 static int
 1011 ipsec_in_reject(struct secpolicy *sp, struct inpcb *inp, const struct mbuf *m)
 1012 {
 1013         int i;
 1014 
 1015         KEYDBG(IPSEC_STAMP,
 1016             printf("%s: PCB(%p): using SP(%p)\n", __func__, inp, sp));
 1017         KEYDBG(IPSEC_DATA, kdebug_secpolicy(sp));
 1018 
 1019         if (inp != NULL && inp->inp_sp != NULL && inp->inp_sp->sp_in == NULL)
 1020                 ipsec_cachepolicy(inp, sp, IPSEC_DIR_INBOUND);
 1021 
 1022         /* Check policy. */
 1023         switch (sp->policy) {
 1024         case IPSEC_POLICY_DISCARD:
 1025                 return (1);
 1026         case IPSEC_POLICY_BYPASS:
 1027         case IPSEC_POLICY_NONE:
 1028                 return (0);
 1029         }
 1030 
 1031         IPSEC_ASSERT(sp->policy == IPSEC_POLICY_IPSEC,
 1032                 ("invalid policy %u", sp->policy));
 1033 
 1034         /*
 1035          * ipsec[46]_common_input_cb after each transform adds
 1036          * PACKET_TAG_IPSEC_IN_DONE mbuf tag. It contains SPI, proto, mode
 1037          * and destination address from saidx. We can compare info from
 1038          * these tags with requirements in SP.
 1039          */
 1040         for (i = 0; i < sp->tcount; i++) {
 1041                 /*
 1042                  * Do not check IPcomp, since IPcomp document
 1043                  * says that we shouldn't compress small packets.
 1044                  * IPComp policy should always be treated as being
 1045                  * in "use" level.
 1046                  */
 1047                 if (sp->req[i]->saidx.proto == IPPROTO_IPCOMP ||
 1048                     ipsec_get_reqlevel(sp, i) != IPSEC_LEVEL_REQUIRE)
 1049                         continue;
 1050                 if (V_check_policy_history != 0 &&
 1051                     ipsec_check_history(m, sp, i) != 0)
 1052                         return (1);
 1053                 else switch (sp->req[i]->saidx.proto) {
 1054                 case IPPROTO_ESP:
 1055                         if ((m->m_flags & M_DECRYPTED) == 0) {
 1056                                 KEYDBG(IPSEC_DUMP,
 1057                                     printf("%s: ESP m_flags:%x\n", __func__,
 1058                                             m->m_flags));
 1059                                 return (1);
 1060                         }
 1061                         break;
 1062                 case IPPROTO_AH:
 1063                         if ((m->m_flags & M_AUTHIPHDR) == 0) {
 1064                                 KEYDBG(IPSEC_DUMP,
 1065                                     printf("%s: AH m_flags:%x\n", __func__,
 1066                                             m->m_flags));
 1067                                 return (1);
 1068                         }
 1069                         break;
 1070                 }
 1071         }
 1072         return (0);             /* Valid. */
 1073 }
 1074 
 1075 /*
 1076  * Compute the byte size to be occupied by IPsec header.
 1077  * In case it is tunnelled, it includes the size of outer IP header.
 1078  */
 1079 static size_t
 1080 ipsec_hdrsiz_internal(struct secpolicy *sp)
 1081 {
 1082         size_t size;
 1083         int i;
 1084 
 1085         KEYDBG(IPSEC_STAMP, printf("%s: using SP(%p)\n", __func__, sp));
 1086         KEYDBG(IPSEC_DATA, kdebug_secpolicy(sp));
 1087 
 1088         switch (sp->policy) {
 1089         case IPSEC_POLICY_DISCARD:
 1090         case IPSEC_POLICY_BYPASS:
 1091         case IPSEC_POLICY_NONE:
 1092                 return (0);
 1093         }
 1094 
 1095         IPSEC_ASSERT(sp->policy == IPSEC_POLICY_IPSEC,
 1096                 ("invalid policy %u", sp->policy));
 1097 
 1098         /*
 1099          * XXX: for each transform we need to lookup suitable SA
 1100          * and use info from SA to calculate headers size.
 1101          * XXX: for NAT-T we need to cosider UDP header size.
 1102          */
 1103         size = 0;
 1104         for (i = 0; i < sp->tcount; i++) {
 1105                 switch (sp->req[i]->saidx.proto) {
 1106                 case IPPROTO_ESP:
 1107                         size += esp_hdrsiz(NULL);
 1108                         break;
 1109                 case IPPROTO_AH:
 1110                         size += ah_hdrsiz(NULL);
 1111                         break;
 1112                 case IPPROTO_IPCOMP:
 1113                         size += sizeof(struct ipcomp);
 1114                         break;
 1115                 }
 1116 
 1117                 if (sp->req[i]->saidx.mode == IPSEC_MODE_TUNNEL) {
 1118                         switch (sp->req[i]->saidx.dst.sa.sa_family) {
 1119 #ifdef INET
 1120                         case AF_INET:
 1121                                 size += sizeof(struct ip);
 1122                                 break;
 1123 #endif
 1124 #ifdef INET6
 1125                         case AF_INET6:
 1126                                 size += sizeof(struct ip6_hdr);
 1127                                 break;
 1128 #endif
 1129                         default:
 1130                                 ipseclog((LOG_ERR, "%s: unknown AF %d in "
 1131                                     "IPsec tunnel SA\n", __func__,
 1132                                     sp->req[i]->saidx.dst.sa.sa_family));
 1133                                 break;
 1134                         }
 1135                 }
 1136         }
 1137         return (size);
 1138 }
 1139 
 1140 /*
 1141  * Compute ESP/AH header size for protocols with PCB, including
 1142  * outer IP header. Currently only tcp_output() uses it.
 1143  */
 1144 size_t
 1145 ipsec_hdrsiz_inpcb(struct inpcb *inp)
 1146 {
 1147         struct secpolicyindex spidx;
 1148         struct secpolicy *sp;
 1149         size_t sz;
 1150 
 1151         sp = ipsec_getpcbpolicy(inp, IPSEC_DIR_OUTBOUND);
 1152         if (sp == NULL && key_havesp(IPSEC_DIR_OUTBOUND)) {
 1153                 ipsec_setspidx_inpcb(inp, &spidx, IPSEC_DIR_OUTBOUND);
 1154                 sp = key_allocsp(&spidx, IPSEC_DIR_OUTBOUND);
 1155         }
 1156         if (sp == NULL)
 1157                 sp = key_allocsp_default();
 1158         sz = ipsec_hdrsiz_internal(sp);
 1159         key_freesp(&sp);
 1160         return (sz);
 1161 }
 1162 
 1163 /*
 1164  * Check the variable replay window.
 1165  * ipsec_chkreplay() performs replay check before ICV verification.
 1166  * ipsec_updatereplay() updates replay bitmap.  This must be called after
 1167  * ICV verification (it also performs replay check, which is usually done
 1168  * beforehand).
 1169  * 0 (zero) is returned if packet disallowed, 1 if packet permitted.
 1170  *
 1171  * Based on RFC 6479. Blocks are 32 bits unsigned integers
 1172  */
 1173 
 1174 #define IPSEC_BITMAP_INDEX_MASK(w)      (w - 1)
 1175 #define IPSEC_REDUNDANT_BIT_SHIFTS      5
 1176 #define IPSEC_REDUNDANT_BITS            (1 << IPSEC_REDUNDANT_BIT_SHIFTS)
 1177 #define IPSEC_BITMAP_LOC_MASK           (IPSEC_REDUNDANT_BITS - 1)
 1178 
 1179 int
 1180 ipsec_chkreplay(uint32_t seq, struct secasvar *sav)
 1181 {
 1182         const struct secreplay *replay;
 1183         uint32_t wsizeb;                /* Constant: window size. */
 1184         int index, bit_location;
 1185 
 1186         IPSEC_ASSERT(sav != NULL, ("Null SA"));
 1187         IPSEC_ASSERT(sav->replay != NULL, ("Null replay state"));
 1188 
 1189         replay = sav->replay;
 1190 
 1191         /* No need to check replay if disabled. */
 1192         if (replay->wsize == 0)
 1193                 return (1);
 1194 
 1195         /* Constant. */
 1196         wsizeb = replay->wsize << 3;
 1197 
 1198         /* Sequence number of 0 is invalid. */
 1199         if (seq == 0)
 1200                 return (0);
 1201 
 1202         /* First time is always okay. */
 1203         if (replay->count == 0)
 1204                 return (1);
 1205 
 1206         /* Larger sequences are okay. */
 1207         if (seq > replay->lastseq)
 1208                 return (1);
 1209 
 1210         /* Over range to check, i.e. too old or wrapped. */
 1211         if (replay->lastseq - seq >= wsizeb)
 1212                 return (0);
 1213 
 1214         /* The sequence is inside the sliding window
 1215          * now check the bit in the bitmap
 1216          * bit location only depends on the sequence number
 1217          */
 1218         bit_location = seq & IPSEC_BITMAP_LOC_MASK;
 1219         index = (seq >> IPSEC_REDUNDANT_BIT_SHIFTS)
 1220                 & IPSEC_BITMAP_INDEX_MASK(replay->bitmap_size);
 1221 
 1222         /* This packet already seen? */
 1223         if ((replay->bitmap)[index] & (1 << bit_location))
 1224                 return (0);
 1225         return (1);
 1226 }
 1227 
 1228 /*
 1229  * Check replay counter whether to update or not.
 1230  * OUT: 0:      OK
 1231  *      1:      NG
 1232  */
 1233 int
 1234 ipsec_updatereplay(uint32_t seq, struct secasvar *sav)
 1235 {
 1236         char buf[128];
 1237         struct secreplay *replay;
 1238         uint32_t wsizeb;                /* Constant: window size. */
 1239         int diff, index, bit_location;
 1240 
 1241         IPSEC_ASSERT(sav != NULL, ("Null SA"));
 1242         IPSEC_ASSERT(sav->replay != NULL, ("Null replay state"));
 1243 
 1244         replay = sav->replay;
 1245 
 1246         if (replay->wsize == 0)
 1247                 goto ok;        /* No need to check replay. */
 1248 
 1249         /* Constant. */
 1250         wsizeb = replay->wsize << 3;
 1251 
 1252         /* Sequence number of 0 is invalid. */
 1253         if (seq == 0)
 1254                 return (1);
 1255 
 1256         /* The packet is too old, no need to update */
 1257         if (wsizeb + seq < replay->lastseq)
 1258                 goto ok;
 1259 
 1260         /* Now update the bit */
 1261         index = (seq >> IPSEC_REDUNDANT_BIT_SHIFTS);
 1262 
 1263         /* First check if the sequence number is in the range */
 1264         if (seq > replay->lastseq) {
 1265                 int id;
 1266                 int index_cur = replay->lastseq >> IPSEC_REDUNDANT_BIT_SHIFTS;
 1267 
 1268                 diff = index - index_cur;
 1269                 if (diff > replay->bitmap_size) {
 1270                         /* something unusual in this case */
 1271                         diff = replay->bitmap_size;
 1272                 }
 1273 
 1274                 for (id = 0; id < diff; ++id) {
 1275                         replay->bitmap[(id + index_cur + 1)
 1276                         & IPSEC_BITMAP_INDEX_MASK(replay->bitmap_size)] = 0;
 1277                 }
 1278 
 1279                 replay->lastseq = seq;
 1280         }
 1281 
 1282         index &= IPSEC_BITMAP_INDEX_MASK(replay->bitmap_size);
 1283         bit_location = seq & IPSEC_BITMAP_LOC_MASK;
 1284 
 1285         /* this packet has already been received */
 1286         if (replay->bitmap[index] & (1 << bit_location))
 1287                 return (1);
 1288 
 1289         replay->bitmap[index] |= (1 << bit_location);
 1290 
 1291 ok:
 1292         if (replay->count == ~0) {
 1293 
 1294                 /* Set overflow flag. */
 1295                 replay->overflow++;
 1296 
 1297                 /* Don't increment, no more packets accepted. */
 1298                 if ((sav->flags & SADB_X_EXT_CYCSEQ) == 0) {
 1299                         if (sav->sah->saidx.proto == IPPROTO_AH)
 1300                                 AHSTAT_INC(ahs_wrap);
 1301                         else if (sav->sah->saidx.proto == IPPROTO_ESP)
 1302                                 ESPSTAT_INC(esps_wrap);
 1303                         return (1);
 1304                 }
 1305 
 1306                 ipseclog((LOG_WARNING, "%s: replay counter made %d cycle. %s\n",
 1307                     __func__, replay->overflow,
 1308                     ipsec_sa2str(sav, buf, sizeof(buf))));
 1309         }
 1310         return (0);
 1311 }
 1312 
 1313 int
 1314 ipsec_updateid(struct secasvar *sav, uint64_t *new, uint64_t *old)
 1315 {
 1316         uint64_t tmp;
 1317 
 1318         /*
 1319          * tdb_cryptoid is initialized by xform_init().
 1320          * Then it can be changed only when some crypto error occurred or
 1321          * when SA is deleted. We stored used cryptoid in the xform_data
 1322          * structure. In case when crypto error occurred and crypto
 1323          * subsystem has reinited the session, it returns new cryptoid
 1324          * and EAGAIN error code.
 1325          *
 1326          * This function will be called when we got EAGAIN from crypto
 1327          * subsystem.
 1328          * *new is cryptoid that was returned by crypto subsystem in
 1329          * the crp_sid.
 1330          * *old is the original cryptoid that we stored in xform_data.
 1331          *
 1332          * For first failed request *old == sav->tdb_cryptoid, then
 1333          * we update sav->tdb_cryptoid and redo crypto_dispatch().
 1334          * For next failed request *old != sav->tdb_cryptoid, then
 1335          * we store cryptoid from first request into the *new variable
 1336          * and crp_sid from this second session will be returned via
 1337          * *old pointer, so caller can release second session.
 1338          *
 1339          * XXXAE: check this more carefully.
 1340          */
 1341         KEYDBG(IPSEC_STAMP,
 1342             printf("%s: SA(%p) moves cryptoid %jd -> %jd\n",
 1343                 __func__, sav, (uintmax_t)(*old), (uintmax_t)(*new)));
 1344         KEYDBG(IPSEC_DATA, kdebug_secasv(sav));
 1345         SECASVAR_LOCK(sav);
 1346         if (sav->tdb_cryptoid != *old) {
 1347                 /* cryptoid was already updated */
 1348                 tmp = *new;
 1349                 *new = sav->tdb_cryptoid;
 1350                 *old = tmp;
 1351                 SECASVAR_UNLOCK(sav);
 1352                 return (1);
 1353         }
 1354         sav->tdb_cryptoid = *new;
 1355         SECASVAR_UNLOCK(sav);
 1356         return (0);
 1357 }
 1358 
 1359 int
 1360 ipsec_initialized(void)
 1361 {
 1362 
 1363         return (V_def_policy != NULL);
 1364 }
 1365 
 1366 static void
 1367 def_policy_init(const void *unused __unused)
 1368 {
 1369 
 1370         V_def_policy = key_newsp();
 1371         if (V_def_policy != NULL) {
 1372                 V_def_policy->policy = IPSEC_POLICY_NONE;
 1373                 /* Force INPCB SP cache invalidation */
 1374                 key_bumpspgen();
 1375         } else
 1376                 printf("%s: failed to initialize default policy\n", __func__);
 1377 }
 1378 
 1379 
 1380 static void
 1381 def_policy_uninit(const void *unused __unused)
 1382 {
 1383 
 1384         if (V_def_policy != NULL) {
 1385                 key_freesp(&V_def_policy);
 1386                 key_bumpspgen();
 1387         }
 1388 }
 1389 
 1390 VNET_SYSINIT(def_policy_init, SI_SUB_PROTO_DOMAIN, SI_ORDER_FIRST,
 1391     def_policy_init, NULL);
 1392 VNET_SYSUNINIT(def_policy_uninit, SI_SUB_PROTO_DOMAIN, SI_ORDER_FIRST,
 1393     def_policy_uninit, NULL);

Cache object: b93a775e154d16879dceed585891561a


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]


This page is part of the FreeBSD/Linux Linux Kernel Cross-Reference, and was automatically generated using a modified version of the LXR engine.