Now available: The Design and Implementation of the FreeBSD Operating System (Second Edition)
[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]
FreeBSD/Linux Kernel Cross Reference
sys/netipsec/ipsec.c
Version:
- FREEBSD - FREEBSD-13-STABLE - FREEBSD-13-0 - FREEBSD-12-STABLE - FREEBSD-12-0 - FREEBSD-11-STABLE - FREEBSD-11-0 - FREEBSD-10-STABLE - FREEBSD-10-0 - FREEBSD-9-STABLE - FREEBSD-9-0 - FREEBSD-8-STABLE - FREEBSD-8-0 - FREEBSD-7-STABLE - FREEBSD-7-0 - FREEBSD-6-STABLE - FREEBSD-6-0 - FREEBSD-5-STABLE - FREEBSD-5-0 - FREEBSD-4-STABLE - FREEBSD-3-STABLE - FREEBSD22 - l41 - OPENBSD - linux-2.6 - MK84 - PLAN9 - xnu-8792
SearchContext: - none - 3 - 10
SearchContext: - none - 3 - 10
1 /* $FreeBSD$ */ 2 /* $KAME: ipsec.c,v 1.103 2001/05/24 07:14:18 sakane Exp $ */ 3 4 /*- 5 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. 6 * All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 3. Neither the name of the project nor the names of its contributors 17 * may be used to endorse or promote products derived from this software 18 * without specific prior written permission. 19 * 20 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND 21 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 22 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 23 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE 24 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 25 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 26 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 27 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 29 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 30 * SUCH DAMAGE. 31 */ 32 33 /* 34 * IPsec controller part. 35 */ 36 37 #include "opt_inet.h" 38 #include "opt_inet6.h" 39 #include "opt_ipsec.h" 40 41 #include <sys/param.h> 42 #include <sys/systm.h> 43 #include <sys/malloc.h> 44 #include <sys/mbuf.h> 45 #include <sys/domain.h> 46 #include <sys/priv.h> 47 #include <sys/protosw.h> 48 #include <sys/socket.h> 49 #include <sys/socketvar.h> 50 #include <sys/errno.h> 51 #include <sys/hhook.h> 52 #include <sys/time.h> 53 #include <sys/kernel.h> 54 #include <sys/syslog.h> 55 #include <sys/sysctl.h> 56 #include <sys/proc.h> 57 58 #include <net/if.h> 59 #include <net/if_enc.h> 60 #include <net/if_var.h> 61 #include <net/vnet.h> 62 63 #include <netinet/in.h> 64 #include <netinet/in_systm.h> 65 #include <netinet/ip.h> 66 #include <netinet/ip_var.h> 67 #include <netinet/in_var.h> 68 #include <netinet/udp.h> 69 #include <netinet/udp_var.h> 70 #include <netinet/tcp.h> 71 #include <netinet/udp.h> 72 73 #include <netinet/ip6.h> 74 #ifdef INET6 75 #include <netinet6/ip6_var.h> 76 #endif 77 #include <netinet/in_pcb.h> 78 #ifdef INET6 79 #include <netinet/icmp6.h> 80 #endif 81 82 #include <sys/types.h> 83 #include <netipsec/ipsec.h> 84 #ifdef INET6 85 #include <netipsec/ipsec6.h> 86 #endif 87 #include <netipsec/ah_var.h> 88 #include <netipsec/esp_var.h> 89 #include <netipsec/ipcomp.h> /*XXX*/ 90 #include <netipsec/ipcomp_var.h> 91 #include <netipsec/ipsec_support.h> 92 93 #include <netipsec/key.h> 94 #include <netipsec/keydb.h> 95 #include <netipsec/key_debug.h> 96 97 #include <netipsec/xform.h> 98 99 #include <machine/in_cksum.h> 100 101 #include <opencrypto/cryptodev.h> 102 103 /* NB: name changed so netstat doesn't use it. */ 104 VNET_PCPUSTAT_DEFINE(struct ipsecstat, ipsec4stat); 105 VNET_PCPUSTAT_SYSINIT(ipsec4stat); 106 107 #ifdef VIMAGE 108 VNET_PCPUSTAT_SYSUNINIT(ipsec4stat); 109 #endif /* VIMAGE */ 110 111 /* DF bit on encap. 0: clear 1: set 2: copy */ 112 VNET_DEFINE(int, ip4_ipsec_dfbit) = 0; 113 VNET_DEFINE(int, ip4_esp_trans_deflev) = IPSEC_LEVEL_USE; 114 VNET_DEFINE(int, ip4_esp_net_deflev) = IPSEC_LEVEL_USE; 115 VNET_DEFINE(int, ip4_ah_trans_deflev) = IPSEC_LEVEL_USE; 116 VNET_DEFINE(int, ip4_ah_net_deflev) = IPSEC_LEVEL_USE; 117 /* ECN ignore(-1)/forbidden(0)/allowed(1) */ 118 VNET_DEFINE(int, ip4_ipsec_ecn) = 0; 119 120 static VNET_DEFINE(int, ip4_filtertunnel) = 0; 121 #define V_ip4_filtertunnel VNET(ip4_filtertunnel) 122 static VNET_DEFINE(int, check_policy_history) = 0; 123 #define V_check_policy_history VNET(check_policy_history) 124 static VNET_DEFINE(struct secpolicy *, def_policy) = NULL; 125 #define V_def_policy VNET(def_policy) 126 static int 127 sysctl_def_policy(SYSCTL_HANDLER_ARGS) 128 { 129 int error, value; 130 131 value = V_def_policy->policy; 132 error = sysctl_handle_int(oidp, &value, 0, req); 133 if (error == 0) { 134 if (value != IPSEC_POLICY_DISCARD && 135 value != IPSEC_POLICY_NONE) 136 return (EINVAL); 137 V_def_policy->policy = value; 138 } 139 return (error); 140 } 141 142 /* 143 * Crypto support requirements: 144 * 145 * 1 require hardware support 146 * -1 require software support 147 * 0 take anything 148 */ 149 VNET_DEFINE(int, crypto_support) = CRYPTOCAP_F_HARDWARE | CRYPTOCAP_F_SOFTWARE; 150 /* 151 * TCP/UDP checksum handling policy for transport mode NAT-T (RFC3948) 152 * 153 * 0 - auto: incrementally recompute, when checksum delta is known; 154 * if checksum delta isn't known, reset checksum to zero for UDP, 155 * and mark csum_flags as valid for TCP. 156 * 1 - fully recompute TCP/UDP checksum. 157 */ 158 VNET_DEFINE(int, natt_cksum_policy) = 0; 159 160 FEATURE(ipsec, "Internet Protocol Security (IPsec)"); 161 FEATURE(ipsec_natt, "UDP Encapsulation of IPsec ESP Packets ('NAT-T')"); 162 163 SYSCTL_DECL(_net_inet_ipsec); 164 165 /* net.inet.ipsec */ 166 SYSCTL_PROC(_net_inet_ipsec, IPSECCTL_DEF_POLICY, def_policy, 167 CTLTYPE_INT | CTLFLAG_VNET | CTLFLAG_RW, 0, 0, sysctl_def_policy, "I", 168 "IPsec default policy."); 169 SYSCTL_INT(_net_inet_ipsec, IPSECCTL_DEF_ESP_TRANSLEV, esp_trans_deflev, 170 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ip4_esp_trans_deflev), 0, 171 "Default ESP transport mode level"); 172 SYSCTL_INT(_net_inet_ipsec, IPSECCTL_DEF_ESP_NETLEV, esp_net_deflev, 173 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ip4_esp_net_deflev), 0, 174 "Default ESP tunnel mode level."); 175 SYSCTL_INT(_net_inet_ipsec, IPSECCTL_DEF_AH_TRANSLEV, ah_trans_deflev, 176 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ip4_ah_trans_deflev), 0, 177 "AH transfer mode default level."); 178 SYSCTL_INT(_net_inet_ipsec, IPSECCTL_DEF_AH_NETLEV, ah_net_deflev, 179 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ip4_ah_net_deflev), 0, 180 "AH tunnel mode default level."); 181 SYSCTL_INT(_net_inet_ipsec, IPSECCTL_AH_CLEARTOS, ah_cleartos, 182 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ah_cleartos), 0, 183 "If set, clear type-of-service field when doing AH computation."); 184 SYSCTL_INT(_net_inet_ipsec, IPSECCTL_DFBIT, dfbit, 185 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ip4_ipsec_dfbit), 0, 186 "Do not fragment bit on encap."); 187 SYSCTL_INT(_net_inet_ipsec, IPSECCTL_ECN, ecn, 188 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ip4_ipsec_ecn), 0, 189 "Explicit Congestion Notification handling."); 190 SYSCTL_INT(_net_inet_ipsec, OID_AUTO, crypto_support, 191 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(crypto_support), 0, 192 "Crypto driver selection."); 193 SYSCTL_INT(_net_inet_ipsec, OID_AUTO, check_policy_history, 194 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(check_policy_history), 0, 195 "Use strict check of inbound packets to security policy compliance."); 196 SYSCTL_INT(_net_inet_ipsec, OID_AUTO, natt_cksum_policy, 197 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(natt_cksum_policy), 0, 198 "Method to fix TCP/UDP checksum for transport mode IPsec after NAT."); 199 SYSCTL_INT(_net_inet_ipsec, OID_AUTO, filtertunnel, 200 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ip4_filtertunnel), 0, 201 "If set, filter packets from an IPsec tunnel."); 202 SYSCTL_VNET_PCPUSTAT(_net_inet_ipsec, OID_AUTO, ipsecstats, struct ipsecstat, 203 ipsec4stat, "IPsec IPv4 statistics."); 204 205 struct timeval ipsec_warn_interval = { .tv_sec = 1, .tv_usec = 0 }; 206 SYSCTL_TIMEVAL_SEC(_net_inet_ipsec, OID_AUTO, crypto_warn_interval, CTLFLAG_RW, 207 &ipsec_warn_interval, 208 "Delay in seconds between warnings of deprecated IPsec crypto algorithms."); 209 210 #ifdef REGRESSION 211 /* 212 * When set to 1, IPsec will send packets with the same sequence number. 213 * This allows to verify if the other side has proper replay attacks detection. 214 */ 215 VNET_DEFINE(int, ipsec_replay) = 0; 216 SYSCTL_INT(_net_inet_ipsec, OID_AUTO, test_replay, 217 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ipsec_replay), 0, 218 "Emulate replay attack"); 219 /* 220 * When set 1, IPsec will send packets with corrupted HMAC. 221 * This allows to verify if the other side properly detects modified packets. 222 */ 223 VNET_DEFINE(int, ipsec_integrity) = 0; 224 SYSCTL_INT(_net_inet_ipsec, OID_AUTO, test_integrity, 225 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ipsec_integrity), 0, 226 "Emulate man-in-the-middle attack"); 227 #endif 228 229 #ifdef INET6 230 VNET_PCPUSTAT_DEFINE(struct ipsecstat, ipsec6stat); 231 VNET_PCPUSTAT_SYSINIT(ipsec6stat); 232 233 #ifdef VIMAGE 234 VNET_PCPUSTAT_SYSUNINIT(ipsec6stat); 235 #endif /* VIMAGE */ 236 237 VNET_DEFINE(int, ip6_esp_trans_deflev) = IPSEC_LEVEL_USE; 238 VNET_DEFINE(int, ip6_esp_net_deflev) = IPSEC_LEVEL_USE; 239 VNET_DEFINE(int, ip6_ah_trans_deflev) = IPSEC_LEVEL_USE; 240 VNET_DEFINE(int, ip6_ah_net_deflev) = IPSEC_LEVEL_USE; 241 VNET_DEFINE(int, ip6_ipsec_ecn) = 0; /* ECN ignore(-1)/forbidden(0)/allowed(1) */ 242 243 static VNET_DEFINE(int, ip6_filtertunnel) = 0; 244 #define V_ip6_filtertunnel VNET(ip6_filtertunnel) 245 246 SYSCTL_DECL(_net_inet6_ipsec6); 247 248 /* net.inet6.ipsec6 */ 249 SYSCTL_PROC(_net_inet6_ipsec6, IPSECCTL_DEF_POLICY, def_policy, 250 CTLTYPE_INT | CTLFLAG_VNET | CTLFLAG_RW, 0, 0, sysctl_def_policy, "I", 251 "IPsec default policy."); 252 SYSCTL_INT(_net_inet6_ipsec6, IPSECCTL_DEF_ESP_TRANSLEV, esp_trans_deflev, 253 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ip6_esp_trans_deflev), 0, 254 "Default ESP transport mode level."); 255 SYSCTL_INT(_net_inet6_ipsec6, IPSECCTL_DEF_ESP_NETLEV, esp_net_deflev, 256 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ip6_esp_net_deflev), 0, 257 "Default ESP tunnel mode level."); 258 SYSCTL_INT(_net_inet6_ipsec6, IPSECCTL_DEF_AH_TRANSLEV, ah_trans_deflev, 259 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ip6_ah_trans_deflev), 0, 260 "AH transfer mode default level."); 261 SYSCTL_INT(_net_inet6_ipsec6, IPSECCTL_DEF_AH_NETLEV, ah_net_deflev, 262 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ip6_ah_net_deflev), 0, 263 "AH tunnel mode default level."); 264 SYSCTL_INT(_net_inet6_ipsec6, IPSECCTL_ECN, ecn, 265 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ip6_ipsec_ecn), 0, 266 "Explicit Congestion Notification handling."); 267 SYSCTL_INT(_net_inet6_ipsec6, OID_AUTO, filtertunnel, 268 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ip6_filtertunnel), 0, 269 "If set, filter packets from an IPsec tunnel."); 270 SYSCTL_VNET_PCPUSTAT(_net_inet6_ipsec6, IPSECCTL_STATS, ipsecstats, 271 struct ipsecstat, ipsec6stat, "IPsec IPv6 statistics."); 272 #endif /* INET6 */ 273 274 static int ipsec_in_reject(struct secpolicy *, struct inpcb *, 275 const struct mbuf *); 276 277 #ifdef INET 278 static void ipsec4_get_ulp(const struct mbuf *, struct secpolicyindex *, int); 279 static void ipsec4_setspidx_ipaddr(const struct mbuf *, 280 struct secpolicyindex *); 281 #endif 282 #ifdef INET6 283 static void ipsec6_get_ulp(const struct mbuf *m, struct secpolicyindex *, int); 284 static void ipsec6_setspidx_ipaddr(const struct mbuf *, 285 struct secpolicyindex *); 286 #endif 287 288 /* 289 * Return a held reference to the default SP. 290 */ 291 static struct secpolicy * 292 key_allocsp_default(void) 293 { 294 295 key_addref(V_def_policy); 296 return (V_def_policy); 297 } 298 299 static void 300 ipsec_invalidate_cache(struct inpcb *inp, u_int dir) 301 { 302 struct secpolicy *sp; 303 304 INP_WLOCK_ASSERT(inp); 305 if (dir == IPSEC_DIR_OUTBOUND) { 306 if (inp->inp_sp->flags & INP_INBOUND_POLICY) 307 return; 308 sp = inp->inp_sp->sp_in; 309 inp->inp_sp->sp_in = NULL; 310 } else { 311 if (inp->inp_sp->flags & INP_OUTBOUND_POLICY) 312 return; 313 sp = inp->inp_sp->sp_out; 314 inp->inp_sp->sp_out = NULL; 315 } 316 if (sp != NULL) 317 key_freesp(&sp); /* release extra reference */ 318 } 319 320 static void 321 ipsec_cachepolicy(struct inpcb *inp, struct secpolicy *sp, u_int dir) 322 { 323 uint32_t genid; 324 int downgrade; 325 326 INP_LOCK_ASSERT(inp); 327 328 if (dir == IPSEC_DIR_OUTBOUND) { 329 /* Do we have configured PCB policy? */ 330 if (inp->inp_sp->flags & INP_OUTBOUND_POLICY) 331 return; 332 /* Another thread has already set cached policy */ 333 if (inp->inp_sp->sp_out != NULL) 334 return; 335 /* 336 * Do not cache OUTBOUND policy if PCB isn't connected, 337 * i.e. foreign address is INADDR_ANY/UNSPECIFIED. 338 */ 339 #ifdef INET 340 if ((inp->inp_vflag & INP_IPV4) != 0 && 341 inp->inp_faddr.s_addr == INADDR_ANY) 342 return; 343 #endif 344 #ifdef INET6 345 if ((inp->inp_vflag & INP_IPV6) != 0 && 346 IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_faddr)) 347 return; 348 #endif 349 } else { 350 /* Do we have configured PCB policy? */ 351 if (inp->inp_sp->flags & INP_INBOUND_POLICY) 352 return; 353 /* Another thread has already set cached policy */ 354 if (inp->inp_sp->sp_in != NULL) 355 return; 356 /* 357 * Do not cache INBOUND policy for listen socket, 358 * that is bound to INADDR_ANY/UNSPECIFIED address. 359 */ 360 #ifdef INET 361 if ((inp->inp_vflag & INP_IPV4) != 0 && 362 inp->inp_faddr.s_addr == INADDR_ANY) 363 return; 364 #endif 365 #ifdef INET6 366 if ((inp->inp_vflag & INP_IPV6) != 0 && 367 IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_faddr)) 368 return; 369 #endif 370 } 371 downgrade = 0; 372 if (!INP_WLOCKED(inp)) { 373 if ((downgrade = INP_TRY_UPGRADE(inp)) == 0) 374 return; 375 } 376 if (dir == IPSEC_DIR_OUTBOUND) 377 inp->inp_sp->sp_out = sp; 378 else 379 inp->inp_sp->sp_in = sp; 380 /* 381 * SP is already referenced by the lookup code. 382 * We take extra reference here to avoid race in the 383 * ipsec_getpcbpolicy() function - SP will not be freed in the 384 * time between we take SP pointer from the cache and key_addref() 385 * call. 386 */ 387 key_addref(sp); 388 genid = key_getspgen(); 389 if (genid != inp->inp_sp->genid) { 390 ipsec_invalidate_cache(inp, dir); 391 inp->inp_sp->genid = genid; 392 } 393 KEYDBG(IPSEC_STAMP, 394 printf("%s: PCB(%p): cached %s SP(%p)\n", 395 __func__, inp, dir == IPSEC_DIR_OUTBOUND ? "OUTBOUND": 396 "INBOUND", sp)); 397 if (downgrade != 0) 398 INP_DOWNGRADE(inp); 399 } 400 401 static struct secpolicy * 402 ipsec_checkpolicy(struct secpolicy *sp, struct inpcb *inp, int *error) 403 { 404 405 /* Save found OUTBOUND policy into PCB SP cache. */ 406 if (inp != NULL && inp->inp_sp != NULL && inp->inp_sp->sp_out == NULL) 407 ipsec_cachepolicy(inp, sp, IPSEC_DIR_OUTBOUND); 408 409 switch (sp->policy) { 410 default: 411 printf("%s: invalid policy %u\n", __func__, sp->policy); 412 /* FALLTHROUGH */ 413 case IPSEC_POLICY_DISCARD: 414 *error = -EINVAL; /* Packet is discarded by caller. */ 415 /* FALLTHROUGH */ 416 case IPSEC_POLICY_BYPASS: 417 case IPSEC_POLICY_NONE: 418 key_freesp(&sp); 419 sp = NULL; /* NB: force NULL result. */ 420 break; 421 case IPSEC_POLICY_IPSEC: 422 /* XXXAE: handle LARVAL SP */ 423 break; 424 } 425 KEYDBG(IPSEC_DUMP, 426 printf("%s: get SP(%p), error %d\n", __func__, sp, *error)); 427 return (sp); 428 } 429 430 static struct secpolicy * 431 ipsec_getpcbpolicy(struct inpcb *inp, u_int dir) 432 { 433 struct secpolicy *sp; 434 int flags, downgrade; 435 436 if (inp == NULL || inp->inp_sp == NULL) 437 return (NULL); 438 439 INP_LOCK_ASSERT(inp); 440 441 flags = inp->inp_sp->flags; 442 if (dir == IPSEC_DIR_OUTBOUND) { 443 sp = inp->inp_sp->sp_out; 444 flags &= INP_OUTBOUND_POLICY; 445 } else { 446 sp = inp->inp_sp->sp_in; 447 flags &= INP_INBOUND_POLICY; 448 } 449 /* 450 * Check flags. If we have PCB SP, just return it. 451 * Otherwise we need to check that cached SP entry isn't stale. 452 */ 453 if (flags == 0) { 454 if (sp == NULL) 455 return (NULL); 456 if (inp->inp_sp->genid != key_getspgen()) { 457 /* Invalidate the cache. */ 458 downgrade = 0; 459 if (!INP_WLOCKED(inp)) { 460 if ((downgrade = INP_TRY_UPGRADE(inp)) == 0) 461 return (NULL); 462 } 463 ipsec_invalidate_cache(inp, IPSEC_DIR_OUTBOUND); 464 ipsec_invalidate_cache(inp, IPSEC_DIR_INBOUND); 465 if (downgrade != 0) 466 INP_DOWNGRADE(inp); 467 return (NULL); 468 } 469 KEYDBG(IPSEC_STAMP, 470 printf("%s: PCB(%p): cache hit SP(%p)\n", 471 __func__, inp, sp)); 472 /* Return referenced cached policy */ 473 } 474 key_addref(sp); 475 return (sp); 476 } 477 478 #ifdef INET 479 static void 480 ipsec4_get_ulp(const struct mbuf *m, struct secpolicyindex *spidx, 481 int needport) 482 { 483 uint8_t nxt; 484 int off; 485 486 /* Sanity check. */ 487 IPSEC_ASSERT(m->m_pkthdr.len >= sizeof(struct ip), 488 ("packet too short")); 489 490 if (m->m_len >= sizeof (struct ip)) { 491 const struct ip *ip = mtod(m, const struct ip *); 492 if (ip->ip_off & htons(IP_MF | IP_OFFMASK)) 493 goto done; 494 off = ip->ip_hl << 2; 495 nxt = ip->ip_p; 496 } else { 497 struct ip ih; 498 499 m_copydata(m, 0, sizeof (struct ip), (caddr_t) &ih); 500 if (ih.ip_off & htons(IP_MF | IP_OFFMASK)) 501 goto done; 502 off = ih.ip_hl << 2; 503 nxt = ih.ip_p; 504 } 505 506 while (off < m->m_pkthdr.len) { 507 struct ip6_ext ip6e; 508 struct tcphdr th; 509 struct udphdr uh; 510 511 switch (nxt) { 512 case IPPROTO_TCP: 513 spidx->ul_proto = nxt; 514 if (!needport) 515 goto done_proto; 516 if (off + sizeof(struct tcphdr) > m->m_pkthdr.len) 517 goto done; 518 m_copydata(m, off, sizeof (th), (caddr_t) &th); 519 spidx->src.sin.sin_port = th.th_sport; 520 spidx->dst.sin.sin_port = th.th_dport; 521 return; 522 case IPPROTO_UDP: 523 spidx->ul_proto = nxt; 524 if (!needport) 525 goto done_proto; 526 if (off + sizeof(struct udphdr) > m->m_pkthdr.len) 527 goto done; 528 m_copydata(m, off, sizeof (uh), (caddr_t) &uh); 529 spidx->src.sin.sin_port = uh.uh_sport; 530 spidx->dst.sin.sin_port = uh.uh_dport; 531 return; 532 case IPPROTO_AH: 533 if (off + sizeof(ip6e) > m->m_pkthdr.len) 534 goto done; 535 /* XXX Sigh, this works but is totally bogus. */ 536 m_copydata(m, off, sizeof(ip6e), (caddr_t) &ip6e); 537 off += (ip6e.ip6e_len + 2) << 2; 538 nxt = ip6e.ip6e_nxt; 539 break; 540 case IPPROTO_ICMP: 541 default: 542 /* XXX Intermediate headers??? */ 543 spidx->ul_proto = nxt; 544 goto done_proto; 545 } 546 } 547 done: 548 spidx->ul_proto = IPSEC_ULPROTO_ANY; 549 done_proto: 550 spidx->src.sin.sin_port = IPSEC_PORT_ANY; 551 spidx->dst.sin.sin_port = IPSEC_PORT_ANY; 552 KEYDBG(IPSEC_DUMP, 553 printf("%s: ", __func__); kdebug_secpolicyindex(spidx, NULL)); 554 } 555 556 static void 557 ipsec4_setspidx_ipaddr(const struct mbuf *m, struct secpolicyindex *spidx) 558 { 559 560 ipsec4_setsockaddrs(m, &spidx->src, &spidx->dst); 561 spidx->prefs = sizeof(struct in_addr) << 3; 562 spidx->prefd = sizeof(struct in_addr) << 3; 563 } 564 565 static struct secpolicy * 566 ipsec4_getpolicy(const struct mbuf *m, struct inpcb *inp, u_int dir, 567 int needport) 568 { 569 struct secpolicyindex spidx; 570 struct secpolicy *sp; 571 572 sp = ipsec_getpcbpolicy(inp, dir); 573 if (sp == NULL && key_havesp(dir)) { 574 /* Make an index to look for a policy. */ 575 ipsec4_setspidx_ipaddr(m, &spidx); 576 ipsec4_get_ulp(m, &spidx, needport); 577 spidx.dir = dir; 578 sp = key_allocsp(&spidx, dir); 579 } 580 if (sp == NULL) /* No SP found, use system default. */ 581 sp = key_allocsp_default(); 582 return (sp); 583 } 584 585 /* 586 * Check security policy for *OUTBOUND* IPv4 packet. 587 */ 588 struct secpolicy * 589 ipsec4_checkpolicy(const struct mbuf *m, struct inpcb *inp, int *error, 590 int needport) 591 { 592 struct secpolicy *sp; 593 594 *error = 0; 595 sp = ipsec4_getpolicy(m, inp, IPSEC_DIR_OUTBOUND, needport); 596 if (sp != NULL) 597 sp = ipsec_checkpolicy(sp, inp, error); 598 if (sp == NULL) { 599 switch (*error) { 600 case 0: /* No IPsec required: BYPASS or NONE */ 601 break; 602 case -EINVAL: 603 IPSECSTAT_INC(ips_out_polvio); 604 break; 605 default: 606 IPSECSTAT_INC(ips_out_inval); 607 } 608 } 609 KEYDBG(IPSEC_STAMP, 610 printf("%s: using SP(%p), error %d\n", __func__, sp, *error)); 611 if (sp != NULL) 612 KEYDBG(IPSEC_DATA, kdebug_secpolicy(sp)); 613 return (sp); 614 } 615 616 /* 617 * Check IPv4 packet against *INBOUND* security policy. 618 * This function is called from tcp_input(), udp_input(), 619 * rip_input() and sctp_input(). 620 */ 621 int 622 ipsec4_in_reject(const struct mbuf *m, struct inpcb *inp) 623 { 624 struct secpolicy *sp; 625 int result; 626 627 sp = ipsec4_getpolicy(m, inp, IPSEC_DIR_INBOUND, 0); 628 result = ipsec_in_reject(sp, inp, m); 629 key_freesp(&sp); 630 if (result != 0) 631 IPSECSTAT_INC(ips_in_polvio); 632 return (result); 633 } 634 635 /* 636 * IPSEC_CAP() method implementation for IPv4. 637 */ 638 int 639 ipsec4_capability(struct mbuf *m, u_int cap) 640 { 641 642 switch (cap) { 643 case IPSEC_CAP_BYPASS_FILTER: 644 /* 645 * Bypass packet filtering for packets previously handled 646 * by IPsec. 647 */ 648 if (!V_ip4_filtertunnel && 649 m_tag_find(m, PACKET_TAG_IPSEC_IN_DONE, NULL) != NULL) 650 return (1); 651 return (0); 652 case IPSEC_CAP_OPERABLE: 653 /* Do we have active security policies? */ 654 if (key_havesp(IPSEC_DIR_INBOUND) != 0 || 655 key_havesp(IPSEC_DIR_OUTBOUND) != 0) 656 return (1); 657 return (0); 658 }; 659 return (EOPNOTSUPP); 660 } 661 662 #endif /* INET */ 663 664 #ifdef INET6 665 static void 666 ipsec6_get_ulp(const struct mbuf *m, struct secpolicyindex *spidx, 667 int needport) 668 { 669 struct tcphdr th; 670 struct udphdr uh; 671 struct icmp6_hdr ih; 672 int off, nxt; 673 674 IPSEC_ASSERT(m->m_pkthdr.len >= sizeof(struct ip6_hdr), 675 ("packet too short")); 676 677 /* Set default. */ 678 spidx->ul_proto = IPSEC_ULPROTO_ANY; 679 spidx->src.sin6.sin6_port = IPSEC_PORT_ANY; 680 spidx->dst.sin6.sin6_port = IPSEC_PORT_ANY; 681 682 nxt = -1; 683 off = ip6_lasthdr(m, 0, IPPROTO_IPV6, &nxt); 684 if (off < 0 || m->m_pkthdr.len < off) 685 return; 686 687 switch (nxt) { 688 case IPPROTO_TCP: 689 spidx->ul_proto = nxt; 690 if (!needport) 691 break; 692 if (off + sizeof(struct tcphdr) > m->m_pkthdr.len) 693 break; 694 m_copydata(m, off, sizeof(th), (caddr_t)&th); 695 spidx->src.sin6.sin6_port = th.th_sport; 696 spidx->dst.sin6.sin6_port = th.th_dport; 697 break; 698 case IPPROTO_UDP: 699 spidx->ul_proto = nxt; 700 if (!needport) 701 break; 702 if (off + sizeof(struct udphdr) > m->m_pkthdr.len) 703 break; 704 m_copydata(m, off, sizeof(uh), (caddr_t)&uh); 705 spidx->src.sin6.sin6_port = uh.uh_sport; 706 spidx->dst.sin6.sin6_port = uh.uh_dport; 707 break; 708 case IPPROTO_ICMPV6: 709 spidx->ul_proto = nxt; 710 if (off + sizeof(struct icmp6_hdr) > m->m_pkthdr.len) 711 break; 712 m_copydata(m, off, sizeof(ih), (caddr_t)&ih); 713 spidx->src.sin6.sin6_port = htons((uint16_t)ih.icmp6_type); 714 spidx->dst.sin6.sin6_port = htons((uint16_t)ih.icmp6_code); 715 break; 716 default: 717 /* XXX Intermediate headers??? */ 718 spidx->ul_proto = nxt; 719 break; 720 } 721 KEYDBG(IPSEC_DUMP, 722 printf("%s: ", __func__); kdebug_secpolicyindex(spidx, NULL)); 723 } 724 725 static void 726 ipsec6_setspidx_ipaddr(const struct mbuf *m, struct secpolicyindex *spidx) 727 { 728 729 ipsec6_setsockaddrs(m, &spidx->src, &spidx->dst); 730 spidx->prefs = sizeof(struct in6_addr) << 3; 731 spidx->prefd = sizeof(struct in6_addr) << 3; 732 } 733 734 static struct secpolicy * 735 ipsec6_getpolicy(const struct mbuf *m, struct inpcb *inp, u_int dir, 736 int needport) 737 { 738 struct secpolicyindex spidx; 739 struct secpolicy *sp; 740 741 sp = ipsec_getpcbpolicy(inp, dir); 742 if (sp == NULL && key_havesp(dir)) { 743 /* Make an index to look for a policy. */ 744 ipsec6_setspidx_ipaddr(m, &spidx); 745 ipsec6_get_ulp(m, &spidx, needport); 746 spidx.dir = dir; 747 sp = key_allocsp(&spidx, dir); 748 } 749 if (sp == NULL) /* No SP found, use system default. */ 750 sp = key_allocsp_default(); 751 return (sp); 752 } 753 754 /* 755 * Check security policy for *OUTBOUND* IPv6 packet. 756 */ 757 struct secpolicy * 758 ipsec6_checkpolicy(const struct mbuf *m, struct inpcb *inp, int *error, 759 int needport) 760 { 761 struct secpolicy *sp; 762 763 *error = 0; 764 sp = ipsec6_getpolicy(m, inp, IPSEC_DIR_OUTBOUND, needport); 765 if (sp != NULL) 766 sp = ipsec_checkpolicy(sp, inp, error); 767 if (sp == NULL) { 768 switch (*error) { 769 case 0: /* No IPsec required: BYPASS or NONE */ 770 break; 771 case -EINVAL: 772 IPSEC6STAT_INC(ips_out_polvio); 773 break; 774 default: 775 IPSEC6STAT_INC(ips_out_inval); 776 } 777 } 778 KEYDBG(IPSEC_STAMP, 779 printf("%s: using SP(%p), error %d\n", __func__, sp, *error)); 780 if (sp != NULL) 781 KEYDBG(IPSEC_DATA, kdebug_secpolicy(sp)); 782 return (sp); 783 } 784 785 /* 786 * Check IPv6 packet against inbound security policy. 787 * This function is called from tcp6_input(), udp6_input(), 788 * rip6_input() and sctp_input(). 789 */ 790 int 791 ipsec6_in_reject(const struct mbuf *m, struct inpcb *inp) 792 { 793 struct secpolicy *sp; 794 int result; 795 796 sp = ipsec6_getpolicy(m, inp, IPSEC_DIR_INBOUND, 0); 797 result = ipsec_in_reject(sp, inp, m); 798 key_freesp(&sp); 799 if (result) 800 IPSEC6STAT_INC(ips_in_polvio); 801 return (result); 802 } 803 804 /* 805 * IPSEC_CAP() method implementation for IPv6. 806 */ 807 int 808 ipsec6_capability(struct mbuf *m, u_int cap) 809 { 810 811 switch (cap) { 812 case IPSEC_CAP_BYPASS_FILTER: 813 /* 814 * Bypass packet filtering for packets previously handled 815 * by IPsec. 816 */ 817 if (!V_ip6_filtertunnel && 818 m_tag_find(m, PACKET_TAG_IPSEC_IN_DONE, NULL) != NULL) 819 return (1); 820 return (0); 821 case IPSEC_CAP_OPERABLE: 822 /* Do we have active security policies? */ 823 if (key_havesp(IPSEC_DIR_INBOUND) != 0 || 824 key_havesp(IPSEC_DIR_OUTBOUND) != 0) 825 return (1); 826 return (0); 827 }; 828 return (EOPNOTSUPP); 829 } 830 #endif /* INET6 */ 831 832 int 833 ipsec_run_hhooks(struct ipsec_ctx_data *ctx, int type) 834 { 835 int idx; 836 837 switch (ctx->af) { 838 #ifdef INET 839 case AF_INET: 840 idx = HHOOK_IPSEC_INET; 841 break; 842 #endif 843 #ifdef INET6 844 case AF_INET6: 845 idx = HHOOK_IPSEC_INET6; 846 break; 847 #endif 848 default: 849 return (EPFNOSUPPORT); 850 } 851 if (type == HHOOK_TYPE_IPSEC_IN) 852 HHOOKS_RUN_IF(V_ipsec_hhh_in[idx], ctx, NULL); 853 else 854 HHOOKS_RUN_IF(V_ipsec_hhh_out[idx], ctx, NULL); 855 if (*ctx->mp == NULL) 856 return (EACCES); 857 return (0); 858 } 859 860 /* 861 * Return current level. 862 * Either IPSEC_LEVEL_USE or IPSEC_LEVEL_REQUIRE are always returned. 863 */ 864 u_int 865 ipsec_get_reqlevel(struct secpolicy *sp, u_int idx) 866 { 867 struct ipsecrequest *isr; 868 u_int esp_trans_deflev, esp_net_deflev; 869 u_int ah_trans_deflev, ah_net_deflev; 870 u_int level = 0; 871 872 IPSEC_ASSERT(idx < sp->tcount, ("Wrong IPsec request index %d", idx)); 873 /* XXX Note that we have ipseclog() expanded here - code sync issue. */ 874 #define IPSEC_CHECK_DEFAULT(lev) \ 875 (((lev) != IPSEC_LEVEL_USE && (lev) != IPSEC_LEVEL_REQUIRE && \ 876 (lev) != IPSEC_LEVEL_UNIQUE) \ 877 ? (V_ipsec_debug ? \ 878 log(LOG_INFO, "fixed system default level " #lev ":%d->%d\n",\ 879 (lev), IPSEC_LEVEL_REQUIRE) : 0), \ 880 (lev) = IPSEC_LEVEL_REQUIRE, (lev) : (lev)) 881 882 /* 883 * IPsec VTI uses unique security policy with fake spidx filled 884 * with zeroes. Just return IPSEC_LEVEL_REQUIRE instead of doing 885 * full level lookup for such policies. 886 */ 887 if (sp->state == IPSEC_SPSTATE_IFNET) { 888 IPSEC_ASSERT(sp->req[idx]->level == IPSEC_LEVEL_UNIQUE, 889 ("Wrong IPsec request level %d", sp->req[idx]->level)); 890 return (IPSEC_LEVEL_REQUIRE); 891 } 892 893 /* Set default level. */ 894 switch (sp->spidx.src.sa.sa_family) { 895 #ifdef INET 896 case AF_INET: 897 esp_trans_deflev = IPSEC_CHECK_DEFAULT(V_ip4_esp_trans_deflev); 898 esp_net_deflev = IPSEC_CHECK_DEFAULT(V_ip4_esp_net_deflev); 899 ah_trans_deflev = IPSEC_CHECK_DEFAULT(V_ip4_ah_trans_deflev); 900 ah_net_deflev = IPSEC_CHECK_DEFAULT(V_ip4_ah_net_deflev); 901 break; 902 #endif 903 #ifdef INET6 904 case AF_INET6: 905 esp_trans_deflev = IPSEC_CHECK_DEFAULT(V_ip6_esp_trans_deflev); 906 esp_net_deflev = IPSEC_CHECK_DEFAULT(V_ip6_esp_net_deflev); 907 ah_trans_deflev = IPSEC_CHECK_DEFAULT(V_ip6_ah_trans_deflev); 908 ah_net_deflev = IPSEC_CHECK_DEFAULT(V_ip6_ah_net_deflev); 909 break; 910 #endif /* INET6 */ 911 default: 912 panic("%s: unknown af %u", 913 __func__, sp->spidx.src.sa.sa_family); 914 } 915 916 #undef IPSEC_CHECK_DEFAULT 917 918 isr = sp->req[idx]; 919 /* Set level. */ 920 switch (isr->level) { 921 case IPSEC_LEVEL_DEFAULT: 922 switch (isr->saidx.proto) { 923 case IPPROTO_ESP: 924 if (isr->saidx.mode == IPSEC_MODE_TUNNEL) 925 level = esp_net_deflev; 926 else 927 level = esp_trans_deflev; 928 break; 929 case IPPROTO_AH: 930 if (isr->saidx.mode == IPSEC_MODE_TUNNEL) 931 level = ah_net_deflev; 932 else 933 level = ah_trans_deflev; 934 break; 935 case IPPROTO_IPCOMP: 936 /* 937 * We don't really care, as IPcomp document says that 938 * we shouldn't compress small packets. 939 */ 940 level = IPSEC_LEVEL_USE; 941 break; 942 default: 943 panic("%s: Illegal protocol defined %u\n", __func__, 944 isr->saidx.proto); 945 } 946 break; 947 948 case IPSEC_LEVEL_USE: 949 case IPSEC_LEVEL_REQUIRE: 950 level = isr->level; 951 break; 952 case IPSEC_LEVEL_UNIQUE: 953 level = IPSEC_LEVEL_REQUIRE; 954 break; 955 956 default: 957 panic("%s: Illegal IPsec level %u\n", __func__, isr->level); 958 } 959 960 return (level); 961 } 962 963 static int 964 ipsec_check_history(const struct mbuf *m, struct secpolicy *sp, u_int idx) 965 { 966 struct xform_history *xh; 967 struct m_tag *mtag; 968 969 mtag = NULL; 970 while ((mtag = m_tag_find(__DECONST(struct mbuf *, m), 971 PACKET_TAG_IPSEC_IN_DONE, mtag)) != NULL) { 972 xh = (struct xform_history *)(mtag + 1); 973 KEYDBG(IPSEC_DATA, 974 char buf[IPSEC_ADDRSTRLEN]; 975 printf("%s: mode %s proto %u dst %s\n", __func__, 976 kdebug_secasindex_mode(xh->mode), xh->proto, 977 ipsec_address(&xh->dst, buf, sizeof(buf)))); 978 if (xh->proto != sp->req[idx]->saidx.proto) 979 continue; 980 /* If SA had IPSEC_MODE_ANY, consider this as match. */ 981 if (xh->mode != sp->req[idx]->saidx.mode && 982 xh->mode != IPSEC_MODE_ANY) 983 continue; 984 /* 985 * For transport mode IPsec request doesn't contain 986 * addresses. We need to use address from spidx. 987 */ 988 if (sp->req[idx]->saidx.mode == IPSEC_MODE_TRANSPORT) { 989 if (key_sockaddrcmp_withmask(&xh->dst.sa, 990 &sp->spidx.dst.sa, sp->spidx.prefd) != 0) 991 continue; 992 } else { 993 if (key_sockaddrcmp(&xh->dst.sa, 994 &sp->req[idx]->saidx.dst.sa, 0) != 0) 995 continue; 996 } 997 return (0); /* matched */ 998 } 999 return (1); 1000 } 1001 1002 /* 1003 * Check security policy requirements against the actual 1004 * packet contents. Return one if the packet should be 1005 * reject as "invalid"; otherwiser return zero to have the 1006 * packet treated as "valid". 1007 * 1008 * OUT: 1009 * 0: valid 1010 * 1: invalid 1011 */ 1012 static int 1013 ipsec_in_reject(struct secpolicy *sp, struct inpcb *inp, const struct mbuf *m) 1014 { 1015 int i; 1016 1017 KEYDBG(IPSEC_STAMP, 1018 printf("%s: PCB(%p): using SP(%p)\n", __func__, inp, sp)); 1019 KEYDBG(IPSEC_DATA, kdebug_secpolicy(sp)); 1020 1021 if (inp != NULL && inp->inp_sp != NULL && inp->inp_sp->sp_in == NULL) 1022 ipsec_cachepolicy(inp, sp, IPSEC_DIR_INBOUND); 1023 1024 /* Check policy. */ 1025 switch (sp->policy) { 1026 case IPSEC_POLICY_DISCARD: 1027 return (1); 1028 case IPSEC_POLICY_BYPASS: 1029 case IPSEC_POLICY_NONE: 1030 return (0); 1031 } 1032 1033 IPSEC_ASSERT(sp->policy == IPSEC_POLICY_IPSEC, 1034 ("invalid policy %u", sp->policy)); 1035 1036 /* 1037 * ipsec[46]_common_input_cb after each transform adds 1038 * PACKET_TAG_IPSEC_IN_DONE mbuf tag. It contains SPI, proto, mode 1039 * and destination address from saidx. We can compare info from 1040 * these tags with requirements in SP. 1041 */ 1042 for (i = 0; i < sp->tcount; i++) { 1043 /* 1044 * Do not check IPcomp, since IPcomp document 1045 * says that we shouldn't compress small packets. 1046 * IPComp policy should always be treated as being 1047 * in "use" level. 1048 */ 1049 if (sp->req[i]->saidx.proto == IPPROTO_IPCOMP || 1050 ipsec_get_reqlevel(sp, i) != IPSEC_LEVEL_REQUIRE) 1051 continue; 1052 if (V_check_policy_history != 0 && 1053 ipsec_check_history(m, sp, i) != 0) 1054 return (1); 1055 else switch (sp->req[i]->saidx.proto) { 1056 case IPPROTO_ESP: 1057 if ((m->m_flags & M_DECRYPTED) == 0) { 1058 KEYDBG(IPSEC_DUMP, 1059 printf("%s: ESP m_flags:%x\n", __func__, 1060 m->m_flags)); 1061 return (1); 1062 } 1063 break; 1064 case IPPROTO_AH: 1065 if ((m->m_flags & M_AUTHIPHDR) == 0) { 1066 KEYDBG(IPSEC_DUMP, 1067 printf("%s: AH m_flags:%x\n", __func__, 1068 m->m_flags)); 1069 return (1); 1070 } 1071 break; 1072 } 1073 } 1074 return (0); /* Valid. */ 1075 } 1076 1077 /* 1078 * Compute the byte size to be occupied by IPsec header. 1079 * In case it is tunnelled, it includes the size of outer IP header. 1080 */ 1081 static size_t 1082 ipsec_hdrsiz_internal(struct secpolicy *sp) 1083 { 1084 size_t size; 1085 int i; 1086 1087 KEYDBG(IPSEC_STAMP, printf("%s: using SP(%p)\n", __func__, sp)); 1088 KEYDBG(IPSEC_DATA, kdebug_secpolicy(sp)); 1089 1090 switch (sp->policy) { 1091 case IPSEC_POLICY_DISCARD: 1092 case IPSEC_POLICY_BYPASS: 1093 case IPSEC_POLICY_NONE: 1094 return (0); 1095 } 1096 1097 IPSEC_ASSERT(sp->policy == IPSEC_POLICY_IPSEC, 1098 ("invalid policy %u", sp->policy)); 1099 1100 /* 1101 * XXX: for each transform we need to lookup suitable SA 1102 * and use info from SA to calculate headers size. 1103 * XXX: for NAT-T we need to cosider UDP header size. 1104 */ 1105 size = 0; 1106 for (i = 0; i < sp->tcount; i++) { 1107 switch (sp->req[i]->saidx.proto) { 1108 case IPPROTO_ESP: 1109 size += esp_hdrsiz(NULL); 1110 break; 1111 case IPPROTO_AH: 1112 size += ah_hdrsiz(NULL); 1113 break; 1114 case IPPROTO_IPCOMP: 1115 size += sizeof(struct ipcomp); 1116 break; 1117 } 1118 1119 if (sp->req[i]->saidx.mode == IPSEC_MODE_TUNNEL) { 1120 switch (sp->req[i]->saidx.dst.sa.sa_family) { 1121 #ifdef INET 1122 case AF_INET: 1123 size += sizeof(struct ip); 1124 break; 1125 #endif 1126 #ifdef INET6 1127 case AF_INET6: 1128 size += sizeof(struct ip6_hdr); 1129 break; 1130 #endif 1131 default: 1132 ipseclog((LOG_ERR, "%s: unknown AF %d in " 1133 "IPsec tunnel SA\n", __func__, 1134 sp->req[i]->saidx.dst.sa.sa_family)); 1135 break; 1136 } 1137 } 1138 } 1139 return (size); 1140 } 1141 1142 /* 1143 * Compute ESP/AH header size for protocols with PCB, including 1144 * outer IP header. Currently only tcp_output() uses it. 1145 */ 1146 size_t 1147 ipsec_hdrsiz_inpcb(struct inpcb *inp) 1148 { 1149 struct secpolicyindex spidx; 1150 struct secpolicy *sp; 1151 size_t sz; 1152 1153 sp = ipsec_getpcbpolicy(inp, IPSEC_DIR_OUTBOUND); 1154 if (sp == NULL && key_havesp(IPSEC_DIR_OUTBOUND)) { 1155 ipsec_setspidx_inpcb(inp, &spidx, IPSEC_DIR_OUTBOUND); 1156 sp = key_allocsp(&spidx, IPSEC_DIR_OUTBOUND); 1157 } 1158 if (sp == NULL) 1159 sp = key_allocsp_default(); 1160 sz = ipsec_hdrsiz_internal(sp); 1161 key_freesp(&sp); 1162 return (sz); 1163 } 1164 1165 /* 1166 * Check the variable replay window. 1167 * ipsec_chkreplay() performs replay check before ICV verification. 1168 * ipsec_updatereplay() updates replay bitmap. This must be called after 1169 * ICV verification (it also performs replay check, which is usually done 1170 * beforehand). 1171 * 0 (zero) is returned if packet disallowed, 1 if packet permitted. 1172 * 1173 * Based on RFC 6479. Blocks are 32 bits unsigned integers 1174 */ 1175 1176 #define IPSEC_BITMAP_INDEX_MASK(w) (w - 1) 1177 #define IPSEC_REDUNDANT_BIT_SHIFTS 5 1178 #define IPSEC_REDUNDANT_BITS (1 << IPSEC_REDUNDANT_BIT_SHIFTS) 1179 #define IPSEC_BITMAP_LOC_MASK (IPSEC_REDUNDANT_BITS - 1) 1180 1181 int 1182 ipsec_chkreplay(uint32_t seq, struct secasvar *sav) 1183 { 1184 const struct secreplay *replay; 1185 uint32_t wsizeb; /* Constant: window size. */ 1186 int index, bit_location; 1187 1188 IPSEC_ASSERT(sav != NULL, ("Null SA")); 1189 IPSEC_ASSERT(sav->replay != NULL, ("Null replay state")); 1190 1191 replay = sav->replay; 1192 1193 /* No need to check replay if disabled. */ 1194 if (replay->wsize == 0) 1195 return (1); 1196 1197 /* Constant. */ 1198 wsizeb = replay->wsize << 3; 1199 1200 /* Sequence number of 0 is invalid. */ 1201 if (seq == 0) 1202 return (0); 1203 1204 /* First time is always okay. */ 1205 if (replay->count == 0) 1206 return (1); 1207 1208 /* Larger sequences are okay. */ 1209 if (seq > replay->lastseq) 1210 return (1); 1211 1212 /* Over range to check, i.e. too old or wrapped. */ 1213 if (replay->lastseq - seq >= wsizeb) 1214 return (0); 1215 1216 /* The sequence is inside the sliding window 1217 * now check the bit in the bitmap 1218 * bit location only depends on the sequence number 1219 */ 1220 bit_location = seq & IPSEC_BITMAP_LOC_MASK; 1221 index = (seq >> IPSEC_REDUNDANT_BIT_SHIFTS) 1222 & IPSEC_BITMAP_INDEX_MASK(replay->bitmap_size); 1223 1224 /* This packet already seen? */ 1225 if ((replay->bitmap)[index] & (1 << bit_location)) 1226 return (0); 1227 return (1); 1228 } 1229 1230 /* 1231 * Check replay counter whether to update or not. 1232 * OUT: 0: OK 1233 * 1: NG 1234 */ 1235 int 1236 ipsec_updatereplay(uint32_t seq, struct secasvar *sav) 1237 { 1238 char buf[128]; 1239 struct secreplay *replay; 1240 uint32_t wsizeb; /* Constant: window size. */ 1241 int diff, index, bit_location; 1242 1243 IPSEC_ASSERT(sav != NULL, ("Null SA")); 1244 IPSEC_ASSERT(sav->replay != NULL, ("Null replay state")); 1245 1246 replay = sav->replay; 1247 1248 if (replay->wsize == 0) 1249 goto ok; /* No need to check replay. */ 1250 1251 /* Constant. */ 1252 wsizeb = replay->wsize << 3; 1253 1254 /* Sequence number of 0 is invalid. */ 1255 if (seq == 0) 1256 return (1); 1257 1258 /* The packet is too old, no need to update */ 1259 if (wsizeb + seq < replay->lastseq) 1260 goto ok; 1261 1262 /* Now update the bit */ 1263 index = (seq >> IPSEC_REDUNDANT_BIT_SHIFTS); 1264 1265 /* First check if the sequence number is in the range */ 1266 if (seq > replay->lastseq) { 1267 int id; 1268 int index_cur = replay->lastseq >> IPSEC_REDUNDANT_BIT_SHIFTS; 1269 1270 diff = index - index_cur; 1271 if (diff > replay->bitmap_size) { 1272 /* something unusual in this case */ 1273 diff = replay->bitmap_size; 1274 } 1275 1276 for (id = 0; id < diff; ++id) { 1277 replay->bitmap[(id + index_cur + 1) 1278 & IPSEC_BITMAP_INDEX_MASK(replay->bitmap_size)] = 0; 1279 } 1280 1281 replay->lastseq = seq; 1282 } 1283 1284 index &= IPSEC_BITMAP_INDEX_MASK(replay->bitmap_size); 1285 bit_location = seq & IPSEC_BITMAP_LOC_MASK; 1286 1287 /* this packet has already been received */ 1288 if (replay->bitmap[index] & (1 << bit_location)) 1289 return (1); 1290 1291 replay->bitmap[index] |= (1 << bit_location); 1292 1293 ok: 1294 if (replay->count == ~0) { 1295 1296 /* Set overflow flag. */ 1297 replay->overflow++; 1298 1299 /* Don't increment, no more packets accepted. */ 1300 if ((sav->flags & SADB_X_EXT_CYCSEQ) == 0) { 1301 if (sav->sah->saidx.proto == IPPROTO_AH) 1302 AHSTAT_INC(ahs_wrap); 1303 else if (sav->sah->saidx.proto == IPPROTO_ESP) 1304 ESPSTAT_INC(esps_wrap); 1305 return (1); 1306 } 1307 1308 ipseclog((LOG_WARNING, "%s: replay counter made %d cycle. %s\n", 1309 __func__, replay->overflow, 1310 ipsec_sa2str(sav, buf, sizeof(buf)))); 1311 } 1312 1313 replay->count++; 1314 return (0); 1315 } 1316 1317 int 1318 ipsec_updateid(struct secasvar *sav, uint64_t *new, uint64_t *old) 1319 { 1320 uint64_t tmp; 1321 1322 /* 1323 * tdb_cryptoid is initialized by xform_init(). 1324 * Then it can be changed only when some crypto error occurred or 1325 * when SA is deleted. We stored used cryptoid in the xform_data 1326 * structure. In case when crypto error occurred and crypto 1327 * subsystem has reinited the session, it returns new cryptoid 1328 * and EAGAIN error code. 1329 * 1330 * This function will be called when we got EAGAIN from crypto 1331 * subsystem. 1332 * *new is cryptoid that was returned by crypto subsystem in 1333 * the crp_sid. 1334 * *old is the original cryptoid that we stored in xform_data. 1335 * 1336 * For first failed request *old == sav->tdb_cryptoid, then 1337 * we update sav->tdb_cryptoid and redo crypto_dispatch(). 1338 * For next failed request *old != sav->tdb_cryptoid, then 1339 * we store cryptoid from first request into the *new variable 1340 * and crp_sid from this second session will be returned via 1341 * *old pointer, so caller can release second session. 1342 * 1343 * XXXAE: check this more carefully. 1344 */ 1345 KEYDBG(IPSEC_STAMP, 1346 printf("%s: SA(%p) moves cryptoid %jd -> %jd\n", 1347 __func__, sav, (uintmax_t)(*old), (uintmax_t)(*new))); 1348 KEYDBG(IPSEC_DATA, kdebug_secasv(sav)); 1349 SECASVAR_LOCK(sav); 1350 if (sav->tdb_cryptoid != *old) { 1351 /* cryptoid was already updated */ 1352 tmp = *new; 1353 *new = sav->tdb_cryptoid; 1354 *old = tmp; 1355 SECASVAR_UNLOCK(sav); 1356 return (1); 1357 } 1358 sav->tdb_cryptoid = *new; 1359 SECASVAR_UNLOCK(sav); 1360 return (0); 1361 } 1362 1363 int 1364 ipsec_initialized(void) 1365 { 1366 1367 return (V_def_policy != NULL); 1368 } 1369 1370 static void 1371 def_policy_init(const void *unused __unused) 1372 { 1373 1374 V_def_policy = key_newsp(); 1375 if (V_def_policy != NULL) { 1376 V_def_policy->policy = IPSEC_POLICY_NONE; 1377 /* Force INPCB SP cache invalidation */ 1378 key_bumpspgen(); 1379 } else 1380 printf("%s: failed to initialize default policy\n", __func__); 1381 } 1382 1383 1384 static void 1385 def_policy_uninit(const void *unused __unused) 1386 { 1387 1388 if (V_def_policy != NULL) { 1389 key_freesp(&V_def_policy); 1390 key_bumpspgen(); 1391 } 1392 } 1393 1394 VNET_SYSINIT(def_policy_init, SI_SUB_PROTO_DOMAIN, SI_ORDER_FIRST, 1395 def_policy_init, NULL); 1396 VNET_SYSUNINIT(def_policy_uninit, SI_SUB_PROTO_DOMAIN, SI_ORDER_FIRST, 1397 def_policy_uninit, NULL);
Cache object: 0337b801476ce5f5998901108282bb95
[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]