The Design and Implementation of the FreeBSD Operating System, Second Edition
Now available: The Design and Implementation of the FreeBSD Operating System (Second Edition)


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]

FreeBSD/Linux Kernel Cross Reference
sys/netipsec/ipsec.c

Version: -  FREEBSD  -  FREEBSD-13-STABLE  -  FREEBSD-13-0  -  FREEBSD-12-STABLE  -  FREEBSD-12-0  -  FREEBSD-11-STABLE  -  FREEBSD-11-0  -  FREEBSD-10-STABLE  -  FREEBSD-10-0  -  FREEBSD-9-STABLE  -  FREEBSD-9-0  -  FREEBSD-8-STABLE  -  FREEBSD-8-0  -  FREEBSD-7-STABLE  -  FREEBSD-7-0  -  FREEBSD-6-STABLE  -  FREEBSD-6-0  -  FREEBSD-5-STABLE  -  FREEBSD-5-0  -  FREEBSD-4-STABLE  -  FREEBSD-3-STABLE  -  FREEBSD22  -  l41  -  OPENBSD  -  linux-2.6  -  MK84  -  PLAN9  -  xnu-8792 
SearchContext: -  none  -  3  -  10 

    1 /*      $FreeBSD$       */
    2 /*      $KAME: ipsec.c,v 1.103 2001/05/24 07:14:18 sakane Exp $ */
    3 
    4 /*-
    5  * SPDX-License-Identifier: BSD-3-Clause
    6  *
    7  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
    8  * All rights reserved.
    9  *
   10  * Redistribution and use in source and binary forms, with or without
   11  * modification, are permitted provided that the following conditions
   12  * are met:
   13  * 1. Redistributions of source code must retain the above copyright
   14  *    notice, this list of conditions and the following disclaimer.
   15  * 2. Redistributions in binary form must reproduce the above copyright
   16  *    notice, this list of conditions and the following disclaimer in the
   17  *    documentation and/or other materials provided with the distribution.
   18  * 3. Neither the name of the project nor the names of its contributors
   19  *    may be used to endorse or promote products derived from this software
   20  *    without specific prior written permission.
   21  *
   22  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
   23  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
   24  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
   25  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
   26  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
   27  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
   28  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
   29  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
   30  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
   31  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
   32  * SUCH DAMAGE.
   33  */
   34 
   35 /*
   36  * IPsec controller part.
   37  */
   38 
   39 #include "opt_inet.h"
   40 #include "opt_inet6.h"
   41 #include "opt_ipsec.h"
   42 
   43 #include <sys/param.h>
   44 #include <sys/systm.h>
   45 #include <sys/malloc.h>
   46 #include <sys/mbuf.h>
   47 #include <sys/domain.h>
   48 #include <sys/priv.h>
   49 #include <sys/protosw.h>
   50 #include <sys/socket.h>
   51 #include <sys/socketvar.h>
   52 #include <sys/errno.h>
   53 #include <sys/hhook.h>
   54 #include <sys/time.h>
   55 #include <sys/kernel.h>
   56 #include <sys/syslog.h>
   57 #include <sys/sysctl.h>
   58 #include <sys/proc.h>
   59 
   60 #include <net/if.h>
   61 #include <net/if_enc.h>
   62 #include <net/if_var.h>
   63 #include <net/vnet.h>
   64 
   65 #include <netinet/in.h>
   66 #include <netinet/in_systm.h>
   67 #include <netinet/ip.h>
   68 #include <netinet/ip_var.h>
   69 #include <netinet/in_var.h>
   70 #include <netinet/udp.h>
   71 #include <netinet/udp_var.h>
   72 #include <netinet/tcp.h>
   73 #include <netinet/udp.h>
   74 
   75 #include <netinet/ip6.h>
   76 #ifdef INET6
   77 #include <netinet6/ip6_var.h>
   78 #endif
   79 #include <netinet/in_pcb.h>
   80 #ifdef INET6
   81 #include <netinet/icmp6.h>
   82 #endif
   83 
   84 #include <sys/types.h>
   85 #include <netipsec/ipsec.h>
   86 #ifdef INET6
   87 #include <netipsec/ipsec6.h>
   88 #endif
   89 #include <netipsec/ah_var.h>
   90 #include <netipsec/esp_var.h>
   91 #include <netipsec/ipcomp.h>            /*XXX*/
   92 #include <netipsec/ipcomp_var.h>
   93 #include <netipsec/ipsec_support.h>
   94 
   95 #include <netipsec/key.h>
   96 #include <netipsec/keydb.h>
   97 #include <netipsec/key_debug.h>
   98 
   99 #include <netipsec/xform.h>
  100 
  101 #include <machine/in_cksum.h>
  102 
  103 #include <opencrypto/cryptodev.h>
  104 
  105 /* NB: name changed so netstat doesn't use it. */
  106 VNET_PCPUSTAT_DEFINE(struct ipsecstat, ipsec4stat);
  107 VNET_PCPUSTAT_SYSINIT(ipsec4stat);
  108 
  109 #ifdef VIMAGE
  110 VNET_PCPUSTAT_SYSUNINIT(ipsec4stat);
  111 #endif /* VIMAGE */
  112 
  113 /* DF bit on encap. 0: clear 1: set 2: copy */
  114 VNET_DEFINE(int, ip4_ipsec_dfbit) = 0;
  115 VNET_DEFINE(int, ip4_esp_trans_deflev) = IPSEC_LEVEL_USE;
  116 VNET_DEFINE(int, ip4_esp_net_deflev) = IPSEC_LEVEL_USE;
  117 VNET_DEFINE(int, ip4_ah_trans_deflev) = IPSEC_LEVEL_USE;
  118 VNET_DEFINE(int, ip4_ah_net_deflev) = IPSEC_LEVEL_USE;
  119 /* ECN ignore(-1)/forbidden(0)/allowed(1) */
  120 VNET_DEFINE(int, ip4_ipsec_ecn) = 0;
  121 
  122 VNET_DEFINE_STATIC(int, ip4_filtertunnel) = 0;
  123 #define V_ip4_filtertunnel VNET(ip4_filtertunnel)
  124 VNET_DEFINE_STATIC(int, check_policy_history) = 0;
  125 #define V_check_policy_history  VNET(check_policy_history)
  126 VNET_DEFINE_STATIC(struct secpolicy *, def_policy) = NULL;
  127 #define V_def_policy    VNET(def_policy)
  128 static int
  129 sysctl_def_policy(SYSCTL_HANDLER_ARGS)
  130 {
  131         int error, value;
  132 
  133         value = V_def_policy->policy;
  134         error = sysctl_handle_int(oidp, &value, 0, req);
  135         if (error == 0) {
  136                 if (value != IPSEC_POLICY_DISCARD &&
  137                     value != IPSEC_POLICY_NONE)
  138                         return (EINVAL);
  139                 V_def_policy->policy = value;
  140         }
  141         return (error);
  142 }
  143 
  144 /*
  145  * Crypto support requirements:
  146  *
  147  *  1   require hardware support
  148  * -1   require software support
  149  *  0   take anything
  150  */
  151 VNET_DEFINE(int, crypto_support) = CRYPTOCAP_F_HARDWARE | CRYPTOCAP_F_SOFTWARE;
  152 
  153 /*
  154  * Use asynchronous mode to parallelize crypto jobs:
  155  *
  156  *  0 - disabled
  157  *  1 - enabled
  158  */
  159 VNET_DEFINE(int, async_crypto) = 0;
  160 
  161 /*
  162  * TCP/UDP checksum handling policy for transport mode NAT-T (RFC3948)
  163  *
  164  * 0 - auto: incrementally recompute, when checksum delta is known;
  165  *     if checksum delta isn't known, reset checksum to zero for UDP,
  166  *     and mark csum_flags as valid for TCP.
  167  * 1 - fully recompute TCP/UDP checksum.
  168  */
  169 VNET_DEFINE(int, natt_cksum_policy) = 0;
  170 
  171 FEATURE(ipsec, "Internet Protocol Security (IPsec)");
  172 FEATURE(ipsec_natt, "UDP Encapsulation of IPsec ESP Packets ('NAT-T')");
  173 
  174 SYSCTL_DECL(_net_inet_ipsec);
  175 
  176 /* net.inet.ipsec */
  177 SYSCTL_PROC(_net_inet_ipsec, IPSECCTL_DEF_POLICY, def_policy,
  178         CTLTYPE_INT | CTLFLAG_VNET | CTLFLAG_RW, 0, 0, sysctl_def_policy, "I",
  179         "IPsec default policy.");
  180 SYSCTL_INT(_net_inet_ipsec, IPSECCTL_DEF_ESP_TRANSLEV, esp_trans_deflev,
  181         CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ip4_esp_trans_deflev), 0,
  182         "Default ESP transport mode level");
  183 SYSCTL_INT(_net_inet_ipsec, IPSECCTL_DEF_ESP_NETLEV, esp_net_deflev,
  184         CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ip4_esp_net_deflev), 0,
  185         "Default ESP tunnel mode level.");
  186 SYSCTL_INT(_net_inet_ipsec, IPSECCTL_DEF_AH_TRANSLEV, ah_trans_deflev,
  187         CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ip4_ah_trans_deflev), 0,
  188         "AH transfer mode default level.");
  189 SYSCTL_INT(_net_inet_ipsec, IPSECCTL_DEF_AH_NETLEV, ah_net_deflev,
  190         CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ip4_ah_net_deflev), 0,
  191         "AH tunnel mode default level.");
  192 SYSCTL_INT(_net_inet_ipsec, IPSECCTL_AH_CLEARTOS, ah_cleartos,
  193         CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ah_cleartos), 0,
  194         "If set, clear type-of-service field when doing AH computation.");
  195 SYSCTL_INT(_net_inet_ipsec, IPSECCTL_DFBIT, dfbit,
  196         CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ip4_ipsec_dfbit), 0,
  197         "Do not fragment bit on encap.");
  198 SYSCTL_INT(_net_inet_ipsec, IPSECCTL_ECN, ecn,
  199         CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ip4_ipsec_ecn), 0,
  200         "Explicit Congestion Notification handling.");
  201 SYSCTL_INT(_net_inet_ipsec, OID_AUTO, crypto_support,
  202         CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(crypto_support), 0,
  203         "Crypto driver selection.");
  204 SYSCTL_INT(_net_inet_ipsec, OID_AUTO, async_crypto,
  205         CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(async_crypto), 0,
  206         "Use asynchronous mode to parallelize crypto jobs.");
  207 SYSCTL_INT(_net_inet_ipsec, OID_AUTO, check_policy_history,
  208         CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(check_policy_history), 0,
  209         "Use strict check of inbound packets to security policy compliance.");
  210 SYSCTL_INT(_net_inet_ipsec, OID_AUTO, natt_cksum_policy,
  211         CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(natt_cksum_policy), 0,
  212         "Method to fix TCP/UDP checksum for transport mode IPsec after NAT.");
  213 SYSCTL_INT(_net_inet_ipsec, OID_AUTO, filtertunnel,
  214         CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ip4_filtertunnel), 0,
  215         "If set, filter packets from an IPsec tunnel.");
  216 SYSCTL_VNET_PCPUSTAT(_net_inet_ipsec, OID_AUTO, ipsecstats, struct ipsecstat,
  217     ipsec4stat, "IPsec IPv4 statistics.");
  218 
  219 struct timeval ipsec_warn_interval = { .tv_sec = 1, .tv_usec = 0 };
  220 SYSCTL_TIMEVAL_SEC(_net_inet_ipsec, OID_AUTO, crypto_warn_interval, CTLFLAG_RW,
  221     &ipsec_warn_interval,
  222     "Delay in seconds between warnings of deprecated IPsec crypto algorithms.");
  223 
  224 #ifdef REGRESSION
  225 /*
  226  * When set to 1, IPsec will send packets with the same sequence number.
  227  * This allows to verify if the other side has proper replay attacks detection.
  228  */
  229 VNET_DEFINE(int, ipsec_replay) = 0;
  230 SYSCTL_INT(_net_inet_ipsec, OID_AUTO, test_replay,
  231         CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ipsec_replay), 0,
  232         "Emulate replay attack");
  233 /*
  234  * When set 1, IPsec will send packets with corrupted HMAC.
  235  * This allows to verify if the other side properly detects modified packets.
  236  */
  237 VNET_DEFINE(int, ipsec_integrity) = 0;
  238 SYSCTL_INT(_net_inet_ipsec, OID_AUTO, test_integrity,
  239         CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ipsec_integrity), 0,
  240         "Emulate man-in-the-middle attack");
  241 #endif
  242 
  243 #ifdef INET6 
  244 VNET_PCPUSTAT_DEFINE(struct ipsecstat, ipsec6stat);
  245 VNET_PCPUSTAT_SYSINIT(ipsec6stat);
  246 
  247 #ifdef VIMAGE
  248 VNET_PCPUSTAT_SYSUNINIT(ipsec6stat);
  249 #endif /* VIMAGE */
  250 
  251 VNET_DEFINE(int, ip6_esp_trans_deflev) = IPSEC_LEVEL_USE;
  252 VNET_DEFINE(int, ip6_esp_net_deflev) = IPSEC_LEVEL_USE;
  253 VNET_DEFINE(int, ip6_ah_trans_deflev) = IPSEC_LEVEL_USE;
  254 VNET_DEFINE(int, ip6_ah_net_deflev) = IPSEC_LEVEL_USE;
  255 VNET_DEFINE(int, ip6_ipsec_ecn) = 0;    /* ECN ignore(-1)/forbidden(0)/allowed(1) */
  256 
  257 VNET_DEFINE_STATIC(int, ip6_filtertunnel) = 0;
  258 #define V_ip6_filtertunnel      VNET(ip6_filtertunnel)
  259 
  260 SYSCTL_DECL(_net_inet6_ipsec6);
  261 
  262 /* net.inet6.ipsec6 */
  263 SYSCTL_PROC(_net_inet6_ipsec6, IPSECCTL_DEF_POLICY, def_policy,
  264         CTLTYPE_INT | CTLFLAG_VNET | CTLFLAG_RW, 0, 0, sysctl_def_policy, "I",
  265         "IPsec default policy.");
  266 SYSCTL_INT(_net_inet6_ipsec6, IPSECCTL_DEF_ESP_TRANSLEV, esp_trans_deflev,
  267         CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ip6_esp_trans_deflev), 0,
  268         "Default ESP transport mode level.");
  269 SYSCTL_INT(_net_inet6_ipsec6, IPSECCTL_DEF_ESP_NETLEV, esp_net_deflev,
  270         CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ip6_esp_net_deflev), 0,
  271         "Default ESP tunnel mode level.");
  272 SYSCTL_INT(_net_inet6_ipsec6, IPSECCTL_DEF_AH_TRANSLEV, ah_trans_deflev,
  273         CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ip6_ah_trans_deflev), 0,
  274         "AH transfer mode default level.");
  275 SYSCTL_INT(_net_inet6_ipsec6, IPSECCTL_DEF_AH_NETLEV, ah_net_deflev,
  276         CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ip6_ah_net_deflev), 0,
  277         "AH tunnel mode default level.");
  278 SYSCTL_INT(_net_inet6_ipsec6, IPSECCTL_ECN, ecn,
  279         CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ip6_ipsec_ecn), 0,
  280         "Explicit Congestion Notification handling.");
  281 SYSCTL_INT(_net_inet6_ipsec6, OID_AUTO, filtertunnel,
  282         CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ip6_filtertunnel),  0,
  283         "If set, filter packets from an IPsec tunnel.");
  284 SYSCTL_VNET_PCPUSTAT(_net_inet6_ipsec6, IPSECCTL_STATS, ipsecstats,
  285     struct ipsecstat, ipsec6stat, "IPsec IPv6 statistics.");
  286 #endif /* INET6 */
  287 
  288 static int ipsec_in_reject(struct secpolicy *, struct inpcb *,
  289     const struct mbuf *);
  290 
  291 #ifdef INET
  292 static void ipsec4_get_ulp(const struct mbuf *, struct secpolicyindex *, int);
  293 static void ipsec4_setspidx_ipaddr(const struct mbuf *,
  294     struct secpolicyindex *);
  295 #endif
  296 #ifdef INET6
  297 static void ipsec6_get_ulp(const struct mbuf *m, struct secpolicyindex *, int);
  298 static void ipsec6_setspidx_ipaddr(const struct mbuf *,
  299     struct secpolicyindex *);
  300 #endif
  301 
  302 /*
  303  * Return a held reference to the default SP.
  304  */
  305 static struct secpolicy *
  306 key_allocsp_default(void)
  307 {
  308 
  309         key_addref(V_def_policy);
  310         return (V_def_policy);
  311 }
  312 
  313 static void
  314 ipsec_invalidate_cache(struct inpcb *inp, u_int dir)
  315 {
  316         struct secpolicy *sp;
  317 
  318         INP_WLOCK_ASSERT(inp);
  319         if (dir == IPSEC_DIR_OUTBOUND) {
  320                 if (inp->inp_sp->flags & INP_INBOUND_POLICY)
  321                         return;
  322                 sp = inp->inp_sp->sp_in;
  323                 inp->inp_sp->sp_in = NULL;
  324         } else {
  325                 if (inp->inp_sp->flags & INP_OUTBOUND_POLICY)
  326                         return;
  327                 sp = inp->inp_sp->sp_out;
  328                 inp->inp_sp->sp_out = NULL;
  329         }
  330         if (sp != NULL)
  331                 key_freesp(&sp); /* release extra reference */
  332 }
  333 
  334 static void
  335 ipsec_cachepolicy(struct inpcb *inp, struct secpolicy *sp, u_int dir)
  336 {
  337         uint32_t genid;
  338         int downgrade;
  339 
  340         INP_LOCK_ASSERT(inp);
  341 
  342         if (dir == IPSEC_DIR_OUTBOUND) {
  343                 /* Do we have configured PCB policy? */
  344                 if (inp->inp_sp->flags & INP_OUTBOUND_POLICY)
  345                         return;
  346                 /* Another thread has already set cached policy */
  347                 if (inp->inp_sp->sp_out != NULL)
  348                         return;
  349                 /*
  350                  * Do not cache OUTBOUND policy if PCB isn't connected,
  351                  * i.e. foreign address is INADDR_ANY/UNSPECIFIED.
  352                  */
  353 #ifdef INET
  354                 if ((inp->inp_vflag & INP_IPV4) != 0 &&
  355                     inp->inp_faddr.s_addr == INADDR_ANY)
  356                         return;
  357 #endif
  358 #ifdef INET6
  359                 if ((inp->inp_vflag & INP_IPV6) != 0 &&
  360                     IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_faddr))
  361                         return;
  362 #endif
  363         } else {
  364                 /* Do we have configured PCB policy? */
  365                 if (inp->inp_sp->flags & INP_INBOUND_POLICY)
  366                         return;
  367                 /* Another thread has already set cached policy */
  368                 if (inp->inp_sp->sp_in != NULL)
  369                         return;
  370                 /*
  371                  * Do not cache INBOUND policy for listen socket,
  372                  * that is bound to INADDR_ANY/UNSPECIFIED address.
  373                  */
  374 #ifdef INET
  375                 if ((inp->inp_vflag & INP_IPV4) != 0 &&
  376                     inp->inp_faddr.s_addr == INADDR_ANY)
  377                         return;
  378 #endif
  379 #ifdef INET6
  380                 if ((inp->inp_vflag & INP_IPV6) != 0 &&
  381                     IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_faddr))
  382                         return;
  383 #endif
  384         }
  385         downgrade = 0;
  386         if (!INP_WLOCKED(inp)) {
  387                 if ((downgrade = INP_TRY_UPGRADE(inp)) == 0)
  388                         return;
  389         }
  390         if (dir == IPSEC_DIR_OUTBOUND)
  391                 inp->inp_sp->sp_out = sp;
  392         else
  393                 inp->inp_sp->sp_in = sp;
  394         /*
  395          * SP is already referenced by the lookup code.
  396          * We take extra reference here to avoid race in the
  397          * ipsec_getpcbpolicy() function - SP will not be freed in the
  398          * time between we take SP pointer from the cache and key_addref()
  399          * call.
  400          */
  401         key_addref(sp);
  402         genid = key_getspgen();
  403         if (genid != inp->inp_sp->genid) {
  404                 ipsec_invalidate_cache(inp, dir);
  405                 inp->inp_sp->genid = genid;
  406         }
  407         KEYDBG(IPSEC_STAMP,
  408             printf("%s: PCB(%p): cached %s SP(%p)\n",
  409             __func__, inp, dir == IPSEC_DIR_OUTBOUND ? "OUTBOUND":
  410             "INBOUND", sp));
  411         if (downgrade != 0)
  412                 INP_DOWNGRADE(inp);
  413 }
  414 
  415 static struct secpolicy *
  416 ipsec_checkpolicy(struct secpolicy *sp, struct inpcb *inp, int *error)
  417 {
  418 
  419         /* Save found OUTBOUND policy into PCB SP cache. */
  420         if (inp != NULL && inp->inp_sp != NULL && inp->inp_sp->sp_out == NULL)
  421                 ipsec_cachepolicy(inp, sp, IPSEC_DIR_OUTBOUND);
  422 
  423         switch (sp->policy) {
  424         default:
  425                 printf("%s: invalid policy %u\n", __func__, sp->policy);
  426                 /* FALLTHROUGH */
  427         case IPSEC_POLICY_DISCARD:
  428                 *error = -EINVAL;       /* Packet is discarded by caller. */
  429                 /* FALLTHROUGH */
  430         case IPSEC_POLICY_BYPASS:
  431         case IPSEC_POLICY_NONE:
  432                 key_freesp(&sp);
  433                 sp = NULL;              /* NB: force NULL result. */
  434                 break;
  435         case IPSEC_POLICY_IPSEC:
  436                 /* XXXAE: handle LARVAL SP */
  437                 break;
  438         }
  439         KEYDBG(IPSEC_DUMP,
  440             printf("%s: get SP(%p), error %d\n", __func__, sp, *error));
  441         return (sp);
  442 }
  443 
  444 static struct secpolicy *
  445 ipsec_getpcbpolicy(struct inpcb *inp, u_int dir)
  446 {
  447         struct secpolicy *sp;
  448         int flags, downgrade;
  449 
  450         if (inp == NULL || inp->inp_sp == NULL)
  451                 return (NULL);
  452 
  453         INP_LOCK_ASSERT(inp);
  454 
  455         flags = inp->inp_sp->flags;
  456         if (dir == IPSEC_DIR_OUTBOUND) {
  457                 sp = inp->inp_sp->sp_out;
  458                 flags &= INP_OUTBOUND_POLICY;
  459         } else {
  460                 sp = inp->inp_sp->sp_in;
  461                 flags &= INP_INBOUND_POLICY;
  462         }
  463         /*
  464          * Check flags. If we have PCB SP, just return it.
  465          * Otherwise we need to check that cached SP entry isn't stale.
  466          */
  467         if (flags == 0) {
  468                 if (sp == NULL)
  469                         return (NULL);
  470                 if (inp->inp_sp->genid != key_getspgen()) {
  471                         /* Invalidate the cache. */
  472                         downgrade = 0;
  473                         if (!INP_WLOCKED(inp)) {
  474                                 if ((downgrade = INP_TRY_UPGRADE(inp)) == 0)
  475                                         return (NULL);
  476                         }
  477                         ipsec_invalidate_cache(inp, IPSEC_DIR_OUTBOUND);
  478                         ipsec_invalidate_cache(inp, IPSEC_DIR_INBOUND);
  479                         if (downgrade != 0)
  480                                 INP_DOWNGRADE(inp);
  481                         return (NULL);
  482                 }
  483                 KEYDBG(IPSEC_STAMP,
  484                     printf("%s: PCB(%p): cache hit SP(%p)\n",
  485                     __func__, inp, sp));
  486                 /* Return referenced cached policy */
  487         }
  488         key_addref(sp);
  489         return (sp);
  490 }
  491 
  492 #ifdef INET
  493 static void
  494 ipsec4_get_ulp(const struct mbuf *m, struct secpolicyindex *spidx,
  495     int needport)
  496 {
  497         uint8_t nxt;
  498         int off;
  499 
  500         /* Sanity check. */
  501         IPSEC_ASSERT(m->m_pkthdr.len >= sizeof(struct ip),
  502             ("packet too short"));
  503 
  504         if (m->m_len >= sizeof (struct ip)) {
  505                 const struct ip *ip = mtod(m, const struct ip *);
  506                 if (ip->ip_off & htons(IP_MF | IP_OFFMASK))
  507                         goto done;
  508                 off = ip->ip_hl << 2;
  509                 nxt = ip->ip_p;
  510         } else {
  511                 struct ip ih;
  512 
  513                 m_copydata(m, 0, sizeof (struct ip), (caddr_t) &ih);
  514                 if (ih.ip_off & htons(IP_MF | IP_OFFMASK))
  515                         goto done;
  516                 off = ih.ip_hl << 2;
  517                 nxt = ih.ip_p;
  518         }
  519 
  520         while (off < m->m_pkthdr.len) {
  521                 struct ip6_ext ip6e;
  522                 struct tcphdr th;
  523                 struct udphdr uh;
  524 
  525                 switch (nxt) {
  526                 case IPPROTO_TCP:
  527                         spidx->ul_proto = nxt;
  528                         if (!needport)
  529                                 goto done_proto;
  530                         if (off + sizeof(struct tcphdr) > m->m_pkthdr.len)
  531                                 goto done;
  532                         m_copydata(m, off, sizeof (th), (caddr_t) &th);
  533                         spidx->src.sin.sin_port = th.th_sport;
  534                         spidx->dst.sin.sin_port = th.th_dport;
  535                         return;
  536                 case IPPROTO_UDP:
  537                         spidx->ul_proto = nxt;
  538                         if (!needport)
  539                                 goto done_proto;
  540                         if (off + sizeof(struct udphdr) > m->m_pkthdr.len)
  541                                 goto done;
  542                         m_copydata(m, off, sizeof (uh), (caddr_t) &uh);
  543                         spidx->src.sin.sin_port = uh.uh_sport;
  544                         spidx->dst.sin.sin_port = uh.uh_dport;
  545                         return;
  546                 case IPPROTO_AH:
  547                         if (off + sizeof(ip6e) > m->m_pkthdr.len)
  548                                 goto done;
  549                         /* XXX Sigh, this works but is totally bogus. */
  550                         m_copydata(m, off, sizeof(ip6e), (caddr_t) &ip6e);
  551                         off += (ip6e.ip6e_len + 2) << 2;
  552                         nxt = ip6e.ip6e_nxt;
  553                         break;
  554                 case IPPROTO_ICMP:
  555                 default:
  556                         /* XXX Intermediate headers??? */
  557                         spidx->ul_proto = nxt;
  558                         goto done_proto;
  559                 }
  560         }
  561 done:
  562         spidx->ul_proto = IPSEC_ULPROTO_ANY;
  563 done_proto:
  564         spidx->src.sin.sin_port = IPSEC_PORT_ANY;
  565         spidx->dst.sin.sin_port = IPSEC_PORT_ANY;
  566         KEYDBG(IPSEC_DUMP,
  567             printf("%s: ", __func__); kdebug_secpolicyindex(spidx, NULL));
  568 }
  569 
  570 static void
  571 ipsec4_setspidx_ipaddr(const struct mbuf *m, struct secpolicyindex *spidx)
  572 {
  573 
  574         ipsec4_setsockaddrs(m, &spidx->src, &spidx->dst);
  575         spidx->prefs = sizeof(struct in_addr) << 3;
  576         spidx->prefd = sizeof(struct in_addr) << 3;
  577 }
  578 
  579 static struct secpolicy *
  580 ipsec4_getpolicy(const struct mbuf *m, struct inpcb *inp, u_int dir,
  581     int needport)
  582 {
  583         struct secpolicyindex spidx;
  584         struct secpolicy *sp;
  585 
  586         sp = ipsec_getpcbpolicy(inp, dir);
  587         if (sp == NULL && key_havesp(dir)) {
  588                 /* Make an index to look for a policy. */
  589                 ipsec4_setspidx_ipaddr(m, &spidx);
  590                 ipsec4_get_ulp(m, &spidx, needport);
  591                 spidx.dir = dir;
  592                 sp = key_allocsp(&spidx, dir);
  593         }
  594         if (sp == NULL)         /* No SP found, use system default. */
  595                 sp = key_allocsp_default();
  596         return (sp);
  597 }
  598 
  599 /*
  600  * Check security policy for *OUTBOUND* IPv4 packet.
  601  */
  602 struct secpolicy *
  603 ipsec4_checkpolicy(const struct mbuf *m, struct inpcb *inp, int *error,
  604     int needport)
  605 {
  606         struct secpolicy *sp;
  607 
  608         *error = 0;
  609         sp = ipsec4_getpolicy(m, inp, IPSEC_DIR_OUTBOUND, needport);
  610         if (sp != NULL)
  611                 sp = ipsec_checkpolicy(sp, inp, error);
  612         if (sp == NULL) {
  613                 switch (*error) {
  614                 case 0: /* No IPsec required: BYPASS or NONE */
  615                         break;
  616                 case -EINVAL:
  617                         IPSECSTAT_INC(ips_out_polvio);
  618                         break;
  619                 default:
  620                         IPSECSTAT_INC(ips_out_inval);
  621                 }
  622         }
  623         KEYDBG(IPSEC_STAMP,
  624             printf("%s: using SP(%p), error %d\n", __func__, sp, *error));
  625         if (sp != NULL)
  626                 KEYDBG(IPSEC_DATA, kdebug_secpolicy(sp));
  627         return (sp);
  628 }
  629 
  630 /*
  631  * Check IPv4 packet against *INBOUND* security policy.
  632  * This function is called from tcp_input(), udp_input(),
  633  * rip_input() and sctp_input().
  634  */
  635 int
  636 ipsec4_in_reject(const struct mbuf *m, struct inpcb *inp)
  637 {
  638         struct secpolicy *sp;
  639         int result;
  640 
  641         sp = ipsec4_getpolicy(m, inp, IPSEC_DIR_INBOUND, 0);
  642         result = ipsec_in_reject(sp, inp, m);
  643         key_freesp(&sp);
  644         if (result != 0)
  645                 IPSECSTAT_INC(ips_in_polvio);
  646         return (result);
  647 }
  648 
  649 /*
  650  * IPSEC_CAP() method implementation for IPv4.
  651  */
  652 int
  653 ipsec4_capability(struct mbuf *m, u_int cap)
  654 {
  655 
  656         switch (cap) {
  657         case IPSEC_CAP_BYPASS_FILTER:
  658                 /*
  659                  * Bypass packet filtering for packets previously handled
  660                  * by IPsec.
  661                  */
  662                 if (!V_ip4_filtertunnel &&
  663                     m_tag_find(m, PACKET_TAG_IPSEC_IN_DONE, NULL) != NULL)
  664                         return (1);
  665                 return (0);
  666         case IPSEC_CAP_OPERABLE:
  667                 /* Do we have active security policies? */
  668                 if (key_havesp(IPSEC_DIR_INBOUND) != 0 ||
  669                     key_havesp(IPSEC_DIR_OUTBOUND) != 0)
  670                         return (1);
  671                 return (0);
  672         };
  673         return (EOPNOTSUPP);
  674 }
  675 
  676 #endif /* INET */
  677 
  678 #ifdef INET6
  679 static void
  680 ipsec6_get_ulp(const struct mbuf *m, struct secpolicyindex *spidx,
  681     int needport)
  682 {
  683         struct tcphdr th;
  684         struct udphdr uh;
  685         struct icmp6_hdr ih;
  686         int off, nxt;
  687 
  688         IPSEC_ASSERT(m->m_pkthdr.len >= sizeof(struct ip6_hdr),
  689             ("packet too short"));
  690 
  691         /* Set default. */
  692         spidx->ul_proto = IPSEC_ULPROTO_ANY;
  693         spidx->src.sin6.sin6_port = IPSEC_PORT_ANY;
  694         spidx->dst.sin6.sin6_port = IPSEC_PORT_ANY;
  695 
  696         nxt = -1;
  697         off = ip6_lasthdr(m, 0, IPPROTO_IPV6, &nxt);
  698         if (off < 0 || m->m_pkthdr.len < off)
  699                 return;
  700 
  701         switch (nxt) {
  702         case IPPROTO_TCP:
  703                 spidx->ul_proto = nxt;
  704                 if (!needport)
  705                         break;
  706                 if (off + sizeof(struct tcphdr) > m->m_pkthdr.len)
  707                         break;
  708                 m_copydata(m, off, sizeof(th), (caddr_t)&th);
  709                 spidx->src.sin6.sin6_port = th.th_sport;
  710                 spidx->dst.sin6.sin6_port = th.th_dport;
  711                 break;
  712         case IPPROTO_UDP:
  713                 spidx->ul_proto = nxt;
  714                 if (!needport)
  715                         break;
  716                 if (off + sizeof(struct udphdr) > m->m_pkthdr.len)
  717                         break;
  718                 m_copydata(m, off, sizeof(uh), (caddr_t)&uh);
  719                 spidx->src.sin6.sin6_port = uh.uh_sport;
  720                 spidx->dst.sin6.sin6_port = uh.uh_dport;
  721                 break;
  722         case IPPROTO_ICMPV6:
  723                 spidx->ul_proto = nxt;
  724                 if (off + sizeof(struct icmp6_hdr) > m->m_pkthdr.len)
  725                         break;
  726                 m_copydata(m, off, sizeof(ih), (caddr_t)&ih);
  727                 spidx->src.sin6.sin6_port = htons((uint16_t)ih.icmp6_type);
  728                 spidx->dst.sin6.sin6_port = htons((uint16_t)ih.icmp6_code);
  729                 break;
  730         default:
  731                 /* XXX Intermediate headers??? */
  732                 spidx->ul_proto = nxt;
  733                 break;
  734         }
  735         KEYDBG(IPSEC_DUMP,
  736             printf("%s: ", __func__); kdebug_secpolicyindex(spidx, NULL));
  737 }
  738 
  739 static void
  740 ipsec6_setspidx_ipaddr(const struct mbuf *m, struct secpolicyindex *spidx)
  741 {
  742 
  743         ipsec6_setsockaddrs(m, &spidx->src, &spidx->dst);
  744         spidx->prefs = sizeof(struct in6_addr) << 3;
  745         spidx->prefd = sizeof(struct in6_addr) << 3;
  746 }
  747 
  748 static struct secpolicy *
  749 ipsec6_getpolicy(const struct mbuf *m, struct inpcb *inp, u_int dir,
  750     int needport)
  751 {
  752         struct secpolicyindex spidx;
  753         struct secpolicy *sp;
  754 
  755         sp = ipsec_getpcbpolicy(inp, dir);
  756         if (sp == NULL && key_havesp(dir)) {
  757                 /* Make an index to look for a policy. */
  758                 ipsec6_setspidx_ipaddr(m, &spidx);
  759                 ipsec6_get_ulp(m, &spidx, needport);
  760                 spidx.dir = dir;
  761                 sp = key_allocsp(&spidx, dir);
  762         }
  763         if (sp == NULL)         /* No SP found, use system default. */
  764                 sp = key_allocsp_default();
  765         return (sp);
  766 }
  767 
  768 /*
  769  * Check security policy for *OUTBOUND* IPv6 packet.
  770  */
  771 struct secpolicy *
  772 ipsec6_checkpolicy(const struct mbuf *m, struct inpcb *inp, int *error,
  773     int needport)
  774 {
  775         struct secpolicy *sp;
  776 
  777         *error = 0;
  778         sp = ipsec6_getpolicy(m, inp, IPSEC_DIR_OUTBOUND, needport);
  779         if (sp != NULL)
  780                 sp = ipsec_checkpolicy(sp, inp, error);
  781         if (sp == NULL) {
  782                 switch (*error) {
  783                 case 0: /* No IPsec required: BYPASS or NONE */
  784                         break;
  785                 case -EINVAL:
  786                         IPSEC6STAT_INC(ips_out_polvio);
  787                         break;
  788                 default:
  789                         IPSEC6STAT_INC(ips_out_inval);
  790                 }
  791         }
  792         KEYDBG(IPSEC_STAMP,
  793             printf("%s: using SP(%p), error %d\n", __func__, sp, *error));
  794         if (sp != NULL)
  795                 KEYDBG(IPSEC_DATA, kdebug_secpolicy(sp));
  796         return (sp);
  797 }
  798 
  799 /*
  800  * Check IPv6 packet against inbound security policy.
  801  * This function is called from tcp6_input(), udp6_input(),
  802  * rip6_input() and sctp_input().
  803  */
  804 int
  805 ipsec6_in_reject(const struct mbuf *m, struct inpcb *inp)
  806 {
  807         struct secpolicy *sp;
  808         int result;
  809 
  810         sp = ipsec6_getpolicy(m, inp, IPSEC_DIR_INBOUND, 0);
  811         result = ipsec_in_reject(sp, inp, m);
  812         key_freesp(&sp);
  813         if (result)
  814                 IPSEC6STAT_INC(ips_in_polvio);
  815         return (result);
  816 }
  817 
  818 /*
  819  * IPSEC_CAP() method implementation for IPv6.
  820  */
  821 int
  822 ipsec6_capability(struct mbuf *m, u_int cap)
  823 {
  824 
  825         switch (cap) {
  826         case IPSEC_CAP_BYPASS_FILTER:
  827                 /*
  828                  * Bypass packet filtering for packets previously handled
  829                  * by IPsec.
  830                  */
  831                 if (!V_ip6_filtertunnel &&
  832                     m_tag_find(m, PACKET_TAG_IPSEC_IN_DONE, NULL) != NULL)
  833                         return (1);
  834                 return (0);
  835         case IPSEC_CAP_OPERABLE:
  836                 /* Do we have active security policies? */
  837                 if (key_havesp(IPSEC_DIR_INBOUND) != 0 ||
  838                     key_havesp(IPSEC_DIR_OUTBOUND) != 0)
  839                         return (1);
  840                 return (0);
  841         };
  842         return (EOPNOTSUPP);
  843 }
  844 #endif /* INET6 */
  845 
  846 int
  847 ipsec_run_hhooks(struct ipsec_ctx_data *ctx, int type)
  848 {
  849         int idx;
  850 
  851         switch (ctx->af) {
  852 #ifdef INET
  853         case AF_INET:
  854                 idx = HHOOK_IPSEC_INET;
  855                 break;
  856 #endif
  857 #ifdef INET6
  858         case AF_INET6:
  859                 idx = HHOOK_IPSEC_INET6;
  860                 break;
  861 #endif
  862         default:
  863                 return (EPFNOSUPPORT);
  864         }
  865         if (type == HHOOK_TYPE_IPSEC_IN)
  866                 HHOOKS_RUN_IF(V_ipsec_hhh_in[idx], ctx, NULL);
  867         else
  868                 HHOOKS_RUN_IF(V_ipsec_hhh_out[idx], ctx, NULL);
  869         if (*ctx->mp == NULL)
  870                 return (EACCES);
  871         return (0);
  872 }
  873 
  874 /*
  875  * Return current level.
  876  * Either IPSEC_LEVEL_USE or IPSEC_LEVEL_REQUIRE are always returned.
  877  */
  878 u_int
  879 ipsec_get_reqlevel(struct secpolicy *sp, u_int idx)
  880 {
  881         struct ipsecrequest *isr;
  882         u_int esp_trans_deflev, esp_net_deflev;
  883         u_int ah_trans_deflev, ah_net_deflev;
  884         u_int level = 0;
  885 
  886         IPSEC_ASSERT(idx < sp->tcount, ("Wrong IPsec request index %d", idx));
  887 /* XXX Note that we have ipseclog() expanded here - code sync issue. */
  888 #define IPSEC_CHECK_DEFAULT(lev) \
  889         (((lev) != IPSEC_LEVEL_USE && (lev) != IPSEC_LEVEL_REQUIRE &&   \
  890           (lev) != IPSEC_LEVEL_UNIQUE)                                  \
  891                 ? (V_ipsec_debug  ?                                     \
  892                 log(LOG_INFO, "fixed system default level " #lev ":%d->%d\n",\
  893                 (lev), IPSEC_LEVEL_REQUIRE) : 0),                       \
  894                 (lev) = IPSEC_LEVEL_REQUIRE, (lev) : (lev))
  895 
  896         /*
  897          * IPsec VTI uses unique security policy with fake spidx filled
  898          * with zeroes. Just return IPSEC_LEVEL_REQUIRE instead of doing
  899          * full level lookup for such policies.
  900          */
  901         if (sp->state == IPSEC_SPSTATE_IFNET) {
  902                 IPSEC_ASSERT(sp->req[idx]->level == IPSEC_LEVEL_UNIQUE,
  903                     ("Wrong IPsec request level %d", sp->req[idx]->level));
  904                 return (IPSEC_LEVEL_REQUIRE);
  905         }
  906 
  907         /* Set default level. */
  908         switch (sp->spidx.src.sa.sa_family) {
  909 #ifdef INET
  910         case AF_INET:
  911                 esp_trans_deflev = IPSEC_CHECK_DEFAULT(V_ip4_esp_trans_deflev);
  912                 esp_net_deflev = IPSEC_CHECK_DEFAULT(V_ip4_esp_net_deflev);
  913                 ah_trans_deflev = IPSEC_CHECK_DEFAULT(V_ip4_ah_trans_deflev);
  914                 ah_net_deflev = IPSEC_CHECK_DEFAULT(V_ip4_ah_net_deflev);
  915                 break;
  916 #endif
  917 #ifdef INET6
  918         case AF_INET6:
  919                 esp_trans_deflev = IPSEC_CHECK_DEFAULT(V_ip6_esp_trans_deflev);
  920                 esp_net_deflev = IPSEC_CHECK_DEFAULT(V_ip6_esp_net_deflev);
  921                 ah_trans_deflev = IPSEC_CHECK_DEFAULT(V_ip6_ah_trans_deflev);
  922                 ah_net_deflev = IPSEC_CHECK_DEFAULT(V_ip6_ah_net_deflev);
  923                 break;
  924 #endif /* INET6 */
  925         default:
  926                 panic("%s: unknown af %u",
  927                         __func__, sp->spidx.src.sa.sa_family);
  928         }
  929 
  930 #undef IPSEC_CHECK_DEFAULT
  931 
  932         isr = sp->req[idx];
  933         /* Set level. */
  934         switch (isr->level) {
  935         case IPSEC_LEVEL_DEFAULT:
  936                 switch (isr->saidx.proto) {
  937                 case IPPROTO_ESP:
  938                         if (isr->saidx.mode == IPSEC_MODE_TUNNEL)
  939                                 level = esp_net_deflev;
  940                         else
  941                                 level = esp_trans_deflev;
  942                         break;
  943                 case IPPROTO_AH:
  944                         if (isr->saidx.mode == IPSEC_MODE_TUNNEL)
  945                                 level = ah_net_deflev;
  946                         else
  947                                 level = ah_trans_deflev;
  948                         break;
  949                 case IPPROTO_IPCOMP:
  950                         /*
  951                          * We don't really care, as IPcomp document says that
  952                          * we shouldn't compress small packets.
  953                          */
  954                         level = IPSEC_LEVEL_USE;
  955                         break;
  956                 default:
  957                         panic("%s: Illegal protocol defined %u\n", __func__,
  958                                 isr->saidx.proto);
  959                 }
  960                 break;
  961 
  962         case IPSEC_LEVEL_USE:
  963         case IPSEC_LEVEL_REQUIRE:
  964                 level = isr->level;
  965                 break;
  966         case IPSEC_LEVEL_UNIQUE:
  967                 level = IPSEC_LEVEL_REQUIRE;
  968                 break;
  969 
  970         default:
  971                 panic("%s: Illegal IPsec level %u\n", __func__, isr->level);
  972         }
  973 
  974         return (level);
  975 }
  976 
  977 static int
  978 ipsec_check_history(const struct mbuf *m, struct secpolicy *sp, u_int idx)
  979 {
  980         struct xform_history *xh;
  981         struct m_tag *mtag;
  982 
  983         mtag = NULL;
  984         while ((mtag = m_tag_find(__DECONST(struct mbuf *, m),
  985             PACKET_TAG_IPSEC_IN_DONE, mtag)) != NULL) {
  986                 xh = (struct xform_history *)(mtag + 1);
  987                 KEYDBG(IPSEC_DATA,
  988                     char buf[IPSEC_ADDRSTRLEN];
  989                     printf("%s: mode %s proto %u dst %s\n", __func__,
  990                         kdebug_secasindex_mode(xh->mode), xh->proto,
  991                         ipsec_address(&xh->dst, buf, sizeof(buf))));
  992                 if (xh->proto != sp->req[idx]->saidx.proto)
  993                         continue;
  994                 /* If SA had IPSEC_MODE_ANY, consider this as match. */
  995                 if (xh->mode != sp->req[idx]->saidx.mode &&
  996                     xh->mode != IPSEC_MODE_ANY)
  997                         continue;
  998                 /*
  999                  * For transport mode IPsec request doesn't contain
 1000                  * addresses. We need to use address from spidx.
 1001                  */
 1002                 if (sp->req[idx]->saidx.mode == IPSEC_MODE_TRANSPORT) {
 1003                         if (key_sockaddrcmp_withmask(&xh->dst.sa,
 1004                             &sp->spidx.dst.sa, sp->spidx.prefd) != 0)
 1005                                 continue;
 1006                 } else {
 1007                         if (key_sockaddrcmp(&xh->dst.sa,
 1008                             &sp->req[idx]->saidx.dst.sa, 0) != 0)
 1009                                 continue;
 1010                 }
 1011                 return (0); /* matched */
 1012         }
 1013         return (1);
 1014 }
 1015 
 1016 /*
 1017  * Check security policy requirements against the actual
 1018  * packet contents.  Return one if the packet should be
 1019  * reject as "invalid"; otherwiser return zero to have the
 1020  * packet treated as "valid".
 1021  *
 1022  * OUT:
 1023  *      0: valid
 1024  *      1: invalid
 1025  */
 1026 static int
 1027 ipsec_in_reject(struct secpolicy *sp, struct inpcb *inp, const struct mbuf *m)
 1028 {
 1029         int i;
 1030 
 1031         KEYDBG(IPSEC_STAMP,
 1032             printf("%s: PCB(%p): using SP(%p)\n", __func__, inp, sp));
 1033         KEYDBG(IPSEC_DATA, kdebug_secpolicy(sp));
 1034 
 1035         if (inp != NULL && inp->inp_sp != NULL && inp->inp_sp->sp_in == NULL)
 1036                 ipsec_cachepolicy(inp, sp, IPSEC_DIR_INBOUND);
 1037 
 1038         /* Check policy. */
 1039         switch (sp->policy) {
 1040         case IPSEC_POLICY_DISCARD:
 1041                 return (1);
 1042         case IPSEC_POLICY_BYPASS:
 1043         case IPSEC_POLICY_NONE:
 1044                 return (0);
 1045         }
 1046 
 1047         IPSEC_ASSERT(sp->policy == IPSEC_POLICY_IPSEC,
 1048                 ("invalid policy %u", sp->policy));
 1049 
 1050         /*
 1051          * ipsec[46]_common_input_cb after each transform adds
 1052          * PACKET_TAG_IPSEC_IN_DONE mbuf tag. It contains SPI, proto, mode
 1053          * and destination address from saidx. We can compare info from
 1054          * these tags with requirements in SP.
 1055          */
 1056         for (i = 0; i < sp->tcount; i++) {
 1057                 /*
 1058                  * Do not check IPcomp, since IPcomp document
 1059                  * says that we shouldn't compress small packets.
 1060                  * IPComp policy should always be treated as being
 1061                  * in "use" level.
 1062                  */
 1063                 if (sp->req[i]->saidx.proto == IPPROTO_IPCOMP ||
 1064                     ipsec_get_reqlevel(sp, i) != IPSEC_LEVEL_REQUIRE)
 1065                         continue;
 1066                 if (V_check_policy_history != 0 &&
 1067                     ipsec_check_history(m, sp, i) != 0)
 1068                         return (1);
 1069                 else switch (sp->req[i]->saidx.proto) {
 1070                 case IPPROTO_ESP:
 1071                         if ((m->m_flags & M_DECRYPTED) == 0) {
 1072                                 KEYDBG(IPSEC_DUMP,
 1073                                     printf("%s: ESP m_flags:%x\n", __func__,
 1074                                             m->m_flags));
 1075                                 return (1);
 1076                         }
 1077                         break;
 1078                 case IPPROTO_AH:
 1079                         if ((m->m_flags & M_AUTHIPHDR) == 0) {
 1080                                 KEYDBG(IPSEC_DUMP,
 1081                                     printf("%s: AH m_flags:%x\n", __func__,
 1082                                             m->m_flags));
 1083                                 return (1);
 1084                         }
 1085                         break;
 1086                 }
 1087         }
 1088         return (0);             /* Valid. */
 1089 }
 1090 
 1091 /*
 1092  * Compute the byte size to be occupied by IPsec header.
 1093  * In case it is tunnelled, it includes the size of outer IP header.
 1094  */
 1095 static size_t
 1096 ipsec_hdrsiz_internal(struct secpolicy *sp)
 1097 {
 1098         size_t size;
 1099         int i;
 1100 
 1101         KEYDBG(IPSEC_STAMP, printf("%s: using SP(%p)\n", __func__, sp));
 1102         KEYDBG(IPSEC_DATA, kdebug_secpolicy(sp));
 1103 
 1104         switch (sp->policy) {
 1105         case IPSEC_POLICY_DISCARD:
 1106         case IPSEC_POLICY_BYPASS:
 1107         case IPSEC_POLICY_NONE:
 1108                 return (0);
 1109         }
 1110 
 1111         IPSEC_ASSERT(sp->policy == IPSEC_POLICY_IPSEC,
 1112                 ("invalid policy %u", sp->policy));
 1113 
 1114         /*
 1115          * XXX: for each transform we need to lookup suitable SA
 1116          * and use info from SA to calculate headers size.
 1117          * XXX: for NAT-T we need to cosider UDP header size.
 1118          */
 1119         size = 0;
 1120         for (i = 0; i < sp->tcount; i++) {
 1121                 switch (sp->req[i]->saidx.proto) {
 1122                 case IPPROTO_ESP:
 1123                         size += esp_hdrsiz(NULL);
 1124                         break;
 1125                 case IPPROTO_AH:
 1126                         size += ah_hdrsiz(NULL);
 1127                         break;
 1128                 case IPPROTO_IPCOMP:
 1129                         size += sizeof(struct ipcomp);
 1130                         break;
 1131                 }
 1132 
 1133                 if (sp->req[i]->saidx.mode == IPSEC_MODE_TUNNEL) {
 1134                         switch (sp->req[i]->saidx.dst.sa.sa_family) {
 1135 #ifdef INET
 1136                         case AF_INET:
 1137                                 size += sizeof(struct ip);
 1138                                 break;
 1139 #endif
 1140 #ifdef INET6
 1141                         case AF_INET6:
 1142                                 size += sizeof(struct ip6_hdr);
 1143                                 break;
 1144 #endif
 1145                         default:
 1146                                 ipseclog((LOG_ERR, "%s: unknown AF %d in "
 1147                                     "IPsec tunnel SA\n", __func__,
 1148                                     sp->req[i]->saidx.dst.sa.sa_family));
 1149                                 break;
 1150                         }
 1151                 }
 1152         }
 1153         return (size);
 1154 }
 1155 
 1156 /*
 1157  * Compute ESP/AH header size for protocols with PCB, including
 1158  * outer IP header. Currently only tcp_output() uses it.
 1159  */
 1160 size_t
 1161 ipsec_hdrsiz_inpcb(struct inpcb *inp)
 1162 {
 1163         struct secpolicyindex spidx;
 1164         struct secpolicy *sp;
 1165         size_t sz;
 1166 
 1167         sp = ipsec_getpcbpolicy(inp, IPSEC_DIR_OUTBOUND);
 1168         if (sp == NULL && key_havesp(IPSEC_DIR_OUTBOUND)) {
 1169                 ipsec_setspidx_inpcb(inp, &spidx, IPSEC_DIR_OUTBOUND);
 1170                 sp = key_allocsp(&spidx, IPSEC_DIR_OUTBOUND);
 1171         }
 1172         if (sp == NULL)
 1173                 sp = key_allocsp_default();
 1174         sz = ipsec_hdrsiz_internal(sp);
 1175         key_freesp(&sp);
 1176         return (sz);
 1177 }
 1178 
 1179 /*
 1180  * Check the variable replay window.
 1181  * ipsec_chkreplay() performs replay check before ICV verification.
 1182  * ipsec_updatereplay() updates replay bitmap.  This must be called after
 1183  * ICV verification (it also performs replay check, which is usually done
 1184  * beforehand).
 1185  * 0 (zero) is returned if packet disallowed, 1 if packet permitted.
 1186  *
 1187  * Based on RFC 6479. Blocks are 32 bits unsigned integers
 1188  */
 1189 
 1190 #define IPSEC_BITMAP_INDEX_MASK(w)      (w - 1)
 1191 #define IPSEC_REDUNDANT_BIT_SHIFTS      5
 1192 #define IPSEC_REDUNDANT_BITS            (1 << IPSEC_REDUNDANT_BIT_SHIFTS)
 1193 #define IPSEC_BITMAP_LOC_MASK           (IPSEC_REDUNDANT_BITS - 1)
 1194 
 1195 int
 1196 ipsec_chkreplay(uint32_t seq, struct secasvar *sav)
 1197 {
 1198         const struct secreplay *replay;
 1199         uint32_t wsizeb;                /* Constant: window size. */
 1200         int index, bit_location;
 1201 
 1202         IPSEC_ASSERT(sav != NULL, ("Null SA"));
 1203         IPSEC_ASSERT(sav->replay != NULL, ("Null replay state"));
 1204 
 1205         replay = sav->replay;
 1206 
 1207         /* No need to check replay if disabled. */
 1208         if (replay->wsize == 0)
 1209                 return (1);
 1210 
 1211         /* Constant. */
 1212         wsizeb = replay->wsize << 3;
 1213 
 1214         /* Sequence number of 0 is invalid. */
 1215         if (seq == 0)
 1216                 return (0);
 1217 
 1218         /* First time is always okay. */
 1219         if (replay->count == 0)
 1220                 return (1);
 1221 
 1222         /* Larger sequences are okay. */
 1223         if (seq > replay->lastseq)
 1224                 return (1);
 1225 
 1226         /* Over range to check, i.e. too old or wrapped. */
 1227         if (replay->lastseq - seq >= wsizeb)
 1228                 return (0);
 1229 
 1230         /* The sequence is inside the sliding window
 1231          * now check the bit in the bitmap
 1232          * bit location only depends on the sequence number
 1233          */
 1234         bit_location = seq & IPSEC_BITMAP_LOC_MASK;
 1235         index = (seq >> IPSEC_REDUNDANT_BIT_SHIFTS)
 1236                 & IPSEC_BITMAP_INDEX_MASK(replay->bitmap_size);
 1237 
 1238         /* This packet already seen? */
 1239         if ((replay->bitmap)[index] & (1 << bit_location))
 1240                 return (0);
 1241         return (1);
 1242 }
 1243 
 1244 /*
 1245  * Check replay counter whether to update or not.
 1246  * OUT: 0:      OK
 1247  *      1:      NG
 1248  */
 1249 int
 1250 ipsec_updatereplay(uint32_t seq, struct secasvar *sav)
 1251 {
 1252         char buf[128];
 1253         struct secreplay *replay;
 1254         uint32_t wsizeb;                /* Constant: window size. */
 1255         int diff, index, bit_location;
 1256 
 1257         IPSEC_ASSERT(sav != NULL, ("Null SA"));
 1258         IPSEC_ASSERT(sav->replay != NULL, ("Null replay state"));
 1259 
 1260         replay = sav->replay;
 1261 
 1262         if (replay->wsize == 0)
 1263                 goto ok;        /* No need to check replay. */
 1264 
 1265         /* Constant. */
 1266         wsizeb = replay->wsize << 3;
 1267 
 1268         /* Sequence number of 0 is invalid. */
 1269         if (seq == 0)
 1270                 return (1);
 1271 
 1272         /* The packet is too old, no need to update */
 1273         if (wsizeb + seq < replay->lastseq)
 1274                 goto ok;
 1275 
 1276         /* Now update the bit */
 1277         index = (seq >> IPSEC_REDUNDANT_BIT_SHIFTS);
 1278 
 1279         /* First check if the sequence number is in the range */
 1280         if (seq > replay->lastseq) {
 1281                 int id;
 1282                 int index_cur = replay->lastseq >> IPSEC_REDUNDANT_BIT_SHIFTS;
 1283 
 1284                 diff = index - index_cur;
 1285                 if (diff > replay->bitmap_size) {
 1286                         /* something unusual in this case */
 1287                         diff = replay->bitmap_size;
 1288                 }
 1289 
 1290                 for (id = 0; id < diff; ++id) {
 1291                         replay->bitmap[(id + index_cur + 1)
 1292                         & IPSEC_BITMAP_INDEX_MASK(replay->bitmap_size)] = 0;
 1293                 }
 1294 
 1295                 replay->lastseq = seq;
 1296         }
 1297 
 1298         index &= IPSEC_BITMAP_INDEX_MASK(replay->bitmap_size);
 1299         bit_location = seq & IPSEC_BITMAP_LOC_MASK;
 1300 
 1301         /* this packet has already been received */
 1302         if (replay->bitmap[index] & (1 << bit_location))
 1303                 return (1);
 1304 
 1305         replay->bitmap[index] |= (1 << bit_location);
 1306 
 1307 ok:
 1308         if (replay->count == ~0) {
 1309 
 1310                 /* Set overflow flag. */
 1311                 replay->overflow++;
 1312 
 1313                 /* Don't increment, no more packets accepted. */
 1314                 if ((sav->flags & SADB_X_EXT_CYCSEQ) == 0) {
 1315                         if (sav->sah->saidx.proto == IPPROTO_AH)
 1316                                 AHSTAT_INC(ahs_wrap);
 1317                         else if (sav->sah->saidx.proto == IPPROTO_ESP)
 1318                                 ESPSTAT_INC(esps_wrap);
 1319                         return (1);
 1320                 }
 1321 
 1322                 ipseclog((LOG_WARNING, "%s: replay counter made %d cycle. %s\n",
 1323                     __func__, replay->overflow,
 1324                     ipsec_sa2str(sav, buf, sizeof(buf))));
 1325         }
 1326 
 1327         replay->count++;
 1328         return (0);
 1329 }
 1330 
 1331 int
 1332 ipsec_updateid(struct secasvar *sav, crypto_session_t *new,
 1333     crypto_session_t *old)
 1334 {
 1335         crypto_session_t tmp;
 1336 
 1337         /*
 1338          * tdb_cryptoid is initialized by xform_init().
 1339          * Then it can be changed only when some crypto error occurred or
 1340          * when SA is deleted. We stored used cryptoid in the xform_data
 1341          * structure. In case when crypto error occurred and crypto
 1342          * subsystem has reinited the session, it returns new cryptoid
 1343          * and EAGAIN error code.
 1344          *
 1345          * This function will be called when we got EAGAIN from crypto
 1346          * subsystem.
 1347          * *new is cryptoid that was returned by crypto subsystem in
 1348          * the crp_sid.
 1349          * *old is the original cryptoid that we stored in xform_data.
 1350          *
 1351          * For first failed request *old == sav->tdb_cryptoid, then
 1352          * we update sav->tdb_cryptoid and redo crypto_dispatch().
 1353          * For next failed request *old != sav->tdb_cryptoid, then
 1354          * we store cryptoid from first request into the *new variable
 1355          * and crp_sid from this second session will be returned via
 1356          * *old pointer, so caller can release second session.
 1357          *
 1358          * XXXAE: check this more carefully.
 1359          */
 1360         KEYDBG(IPSEC_STAMP,
 1361             printf("%s: SA(%p) moves cryptoid %p -> %p\n",
 1362                 __func__, sav, *old, *new));
 1363         KEYDBG(IPSEC_DATA, kdebug_secasv(sav));
 1364         SECASVAR_LOCK(sav);
 1365         if (sav->tdb_cryptoid != *old) {
 1366                 /* cryptoid was already updated */
 1367                 tmp = *new;
 1368                 *new = sav->tdb_cryptoid;
 1369                 *old = tmp;
 1370                 SECASVAR_UNLOCK(sav);
 1371                 return (1);
 1372         }
 1373         sav->tdb_cryptoid = *new;
 1374         SECASVAR_UNLOCK(sav);
 1375         return (0);
 1376 }
 1377 
 1378 int
 1379 ipsec_initialized(void)
 1380 {
 1381 
 1382         return (V_def_policy != NULL);
 1383 }
 1384 
 1385 static void
 1386 def_policy_init(const void *unused __unused)
 1387 {
 1388 
 1389         V_def_policy = key_newsp();
 1390         if (V_def_policy != NULL) {
 1391                 V_def_policy->policy = IPSEC_POLICY_NONE;
 1392                 /* Force INPCB SP cache invalidation */
 1393                 key_bumpspgen();
 1394         } else
 1395                 printf("%s: failed to initialize default policy\n", __func__);
 1396 }
 1397 
 1398 
 1399 static void
 1400 def_policy_uninit(const void *unused __unused)
 1401 {
 1402 
 1403         if (V_def_policy != NULL) {
 1404                 key_freesp(&V_def_policy);
 1405                 key_bumpspgen();
 1406         }
 1407 }
 1408 
 1409 VNET_SYSINIT(def_policy_init, SI_SUB_PROTO_DOMAIN, SI_ORDER_FIRST,
 1410     def_policy_init, NULL);
 1411 VNET_SYSUNINIT(def_policy_uninit, SI_SUB_PROTO_DOMAIN, SI_ORDER_FIRST,
 1412     def_policy_uninit, NULL);

Cache object: 730c0e6977a6aafd5d2f41db0b544ded


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]


This page is part of the FreeBSD/Linux Linux Kernel Cross-Reference, and was automatically generated using a modified version of the LXR engine.