ipsec_input.c

Version: - FREEBSD - FREEBSD-13-STABLE - FREEBSD-13-0 - FREEBSD-12-STABLE - FREEBSD-12-0 - FREEBSD-11-STABLE - FREEBSD-11-0 - FREEBSD-10-STABLE - FREEBSD-10-0 - FREEBSD-9-STABLE - FREEBSD-9-0 - FREEBSD-8-STABLE - FREEBSD-8-0 - FREEBSD-7-STABLE - FREEBSD-7-0 - FREEBSD-6-STABLE - FREEBSD-6-0 - FREEBSD-5-STABLE - FREEBSD-5-0 - FREEBSD-4-STABLE - FREEBSD-3-STABLE - FREEBSD22 - l41 - OPENBSD - linux-2.6 - MK84 - PLAN9 - xnu-8792
SearchContext: - none - 3 - 10
    1 /*      $FreeBSD: releng/5.1/sys/netipsec/ipsec_input.c 112758 2003-03-28 20:28:05Z sam $       */
    2 /*      $OpenBSD: ipsec_input.c,v 1.63 2003/02/20 18:35:43 deraadt Exp $        */
    3 /*
    4  * The authors of this code are John Ioannidis (ji@tla.org),
    5  * Angelos D. Keromytis (kermit@csd.uch.gr) and
    6  * Niels Provos (provos@physnet.uni-hamburg.de).
    7  *
    8  * This code was written by John Ioannidis for BSD/OS in Athens, Greece,
    9  * in November 1995.
   10  *
   11  * Ported to OpenBSD and NetBSD, with additional transforms, in December 1996,
   12  * by Angelos D. Keromytis.
   13  *
   14  * Additional transforms and features in 1997 and 1998 by Angelos D. Keromytis
   15  * and Niels Provos.
   16  *
   17  * Additional features in 1999 by Angelos D. Keromytis.
   18  *
   19  * Copyright (C) 1995, 1996, 1997, 1998, 1999 by John Ioannidis,
   20  * Angelos D. Keromytis and Niels Provos.
   21  * Copyright (c) 2001, Angelos D. Keromytis.
   22  *
   23  * Permission to use, copy, and modify this software with or without fee
   24  * is hereby granted, provided that this entire notice is included in
   25  * all copies of any software which is or includes a copy or
   26  * modification of this software.
   27  * You may use this code under the GNU public license if you so wish. Please
   28  * contribute changes back to the authors under this freer than GPL license
   29  * so that we may further the use of strong encryption without limitations to
   30  * all.
   31  *
   32  * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR
   33  * IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY
   34  * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE
   35  * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR
   36  * PURPOSE.
   37  */
   38 
   39 /*
   40  * IPsec input processing.
   41  */
   42 
   43 #include "opt_inet.h"
   44 #include "opt_inet6.h"
   45 #include "opt_ipsec.h"
   46 
   47 #include <sys/param.h>
   48 #include <sys/systm.h>
   49 #include <sys/malloc.h>
   50 #include <sys/mbuf.h>
   51 #include <sys/domain.h>
   52 #include <sys/protosw.h>
   53 #include <sys/socket.h>
   54 #include <sys/errno.h>
   55 #include <sys/syslog.h>
   56 
   57 #include <net/if.h>
   58 #include <net/route.h>
   59 #include <net/netisr.h>
   60 
   61 #include <netinet/in.h>
   62 #include <netinet/in_systm.h>
   63 #include <netinet/ip.h>
   64 #include <netinet/ip_var.h>
   65 #include <netinet/in_var.h>
   66 
   67 #include <netinet/ip6.h>
   68 #ifdef INET6
   69 #include <netinet6/ip6_var.h>
   70 #endif
   71 #include <netinet/in_pcb.h>
   72 #ifdef INET6
   73 #include <netinet/icmp6.h>
   74 #endif
   75 
   76 #include <netipsec/ipsec.h>
   77 #ifdef INET6
   78 #include <netipsec/ipsec6.h>
   79 #endif
   80 #include <netipsec/ah_var.h>
   81 #include <netipsec/esp.h>
   82 #include <netipsec/esp_var.h>
   83 #include <netipsec/ipcomp_var.h>
   84 
   85 #include <netipsec/key.h>
   86 #include <netipsec/keydb.h>
   87 
   88 #include <netipsec/xform.h>
   89 #include <netinet6/ip6protosw.h>
   90 
   91 #include <machine/in_cksum.h>
   92 #include <machine/stdarg.h>
   93 
   94 #include <net/net_osdep.h>
   95 
   96 #define IPSEC_ISTAT(p,x,y,z) ((p) == IPPROTO_ESP ? (x)++ : \
   97                             (p) == IPPROTO_AH ? (y)++ : (z)++)
   98 
   99 /*
  100  * ipsec_common_input gets called when an IPsec-protected packet
  101  * is received by IPv4 or IPv6.  It's job is to find the right SA
  102  # and call the appropriate transform.  The transform callback
  103  * takes care of further processing (like ingress filtering).
  104  */
  105 static int
  106 ipsec_common_input(struct mbuf *m, int skip, int protoff, int af, int sproto)
  107 {
  108         union sockaddr_union dst_address;
  109         struct secasvar *sav;
  110         u_int32_t spi;
  111         int s, error;
  112 
  113         IPSEC_ISTAT(sproto, espstat.esps_input, ahstat.ahs_input,
  114                 ipcompstat.ipcomps_input);
  115 
  116         KASSERT(m != NULL, ("ipsec_common_input: null packet"));
  117 
  118         if ((sproto == IPPROTO_ESP && !esp_enable) ||
  119             (sproto == IPPROTO_AH && !ah_enable) ||
  120             (sproto == IPPROTO_IPCOMP && !ipcomp_enable)) {
  121                 m_freem(m);
  122                 IPSEC_ISTAT(sproto, espstat.esps_pdrops, ahstat.ahs_pdrops,
  123                     ipcompstat.ipcomps_pdrops);
  124                 return EOPNOTSUPP;
  125         }
  126 
  127         if (m->m_pkthdr.len - skip < 2 * sizeof (u_int32_t)) {
  128                 m_freem(m);
  129                 IPSEC_ISTAT(sproto, espstat.esps_hdrops, ahstat.ahs_hdrops,
  130                     ipcompstat.ipcomps_hdrops);
  131                 DPRINTF(("ipsec_common_input: packet too small\n"));
  132                 return EINVAL;
  133         }
  134 
  135         /* Retrieve the SPI from the relevant IPsec header */
  136         if (sproto == IPPROTO_ESP)
  137                 m_copydata(m, skip, sizeof(u_int32_t), (caddr_t) &spi);
  138         else if (sproto == IPPROTO_AH)
  139                 m_copydata(m, skip + sizeof(u_int32_t), sizeof(u_int32_t),
  140                     (caddr_t) &spi);
  141         else if (sproto == IPPROTO_IPCOMP) {
  142                 u_int16_t cpi;
  143                 m_copydata(m, skip + sizeof(u_int16_t), sizeof(u_int16_t),
  144                     (caddr_t) &cpi);
  145                 spi = ntohl(htons(cpi));
  146         }
  147 
  148         /*
  149          * Find the SA and (indirectly) call the appropriate
  150          * kernel crypto routine. The resulting mbuf chain is a valid
  151          * IP packet ready to go through input processing.
  152          */
  153         bzero(&dst_address, sizeof (dst_address));
  154         dst_address.sa.sa_family = af;
  155         switch (af) {
  156 #ifdef INET
  157         case AF_INET:
  158                 dst_address.sin.sin_len = sizeof(struct sockaddr_in);
  159                 m_copydata(m, offsetof(struct ip, ip_dst),
  160                     sizeof(struct in_addr),
  161                     (caddr_t) &dst_address.sin.sin_addr);
  162                 break;
  163 #endif /* INET */
  164 #ifdef INET6
  165         case AF_INET6:
  166                 dst_address.sin6.sin6_len = sizeof(struct sockaddr_in6);
  167                 m_copydata(m, offsetof(struct ip6_hdr, ip6_dst),
  168                     sizeof(struct in6_addr),
  169                     (caddr_t) &dst_address.sin6.sin6_addr);
  170                 break;
  171 #endif /* INET6 */
  172         default:
  173                 DPRINTF(("ipsec_common_input: unsupported protocol "
  174                         "family %u\n", af));
  175                 m_freem(m);
  176                 IPSEC_ISTAT(sproto, espstat.esps_nopf, ahstat.ahs_nopf,
  177                     ipcompstat.ipcomps_nopf);
  178                 return EPFNOSUPPORT;
  179         }
  180 
  181         s = splnet();
  182 
  183         /* NB: only pass dst since key_allocsa follows RFC2401 */
  184         sav = KEY_ALLOCSA(&dst_address, sproto, spi);
  185         if (sav == NULL) {
  186                 DPRINTF(("ipsec_common_input: no key association found for"
  187                           " SA %s/%08lx/%u\n",
  188                           ipsec_address(&dst_address),
  189                           (u_long) ntohl(spi), sproto));
  190                 IPSEC_ISTAT(sproto, espstat.esps_notdb, ahstat.ahs_notdb,
  191                     ipcompstat.ipcomps_notdb);
  192                 splx(s);
  193                 m_freem(m);
  194                 return ENOENT;
  195         }
  196 
  197         if (sav->tdb_xform == NULL) {
  198                 DPRINTF(("ipsec_common_input: attempted to use uninitialized"
  199                          " SA %s/%08lx/%u\n",
  200                          ipsec_address(&dst_address),
  201                          (u_long) ntohl(spi), sproto));
  202                 IPSEC_ISTAT(sproto, espstat.esps_noxform, ahstat.ahs_noxform,
  203                     ipcompstat.ipcomps_noxform);
  204                 KEY_FREESAV(&sav);
  205                 splx(s);
  206                 m_freem(m);
  207                 return ENXIO;
  208         }
  209 
  210         /*
  211          * Call appropriate transform and return -- callback takes care of
  212          * everything else.
  213          */
  214         error = (*sav->tdb_xform->xf_input)(m, sav, skip, protoff);
  215         KEY_FREESAV(&sav);
  216         splx(s);
  217         return error;
  218 }
  219 
  220 #ifdef INET
  221 /*
  222  * Common input handler for IPv4 AH, ESP, and IPCOMP.
  223  */
  224 int
  225 ipsec4_common_input(struct mbuf *m, ...)
  226 {
  227         va_list ap;
  228         int off, nxt;
  229 
  230         va_start(ap, m);
  231         off = va_arg(ap, int);
  232         nxt = va_arg(ap, int);
  233         va_end(ap);
  234 
  235         return ipsec_common_input(m, off, offsetof(struct ip, ip_p),
  236                                   AF_INET, nxt);
  237 }
  238 
  239 void
  240 ah4_input(struct mbuf *m, int off)
  241 {
  242         ipsec4_common_input(m, off, IPPROTO_AH);
  243 }
  244 
  245 void
  246 esp4_input(struct mbuf *m, int off)
  247 {
  248         ipsec4_common_input(m, off, IPPROTO_ESP);
  249 }
  250 
  251 void
  252 ipcomp4_input(struct mbuf *m, int off)
  253 {
  254         ipsec4_common_input(m, off, IPPROTO_IPCOMP);
  255 }
  256 
  257 /*
  258  * IPsec input callback for INET protocols.
  259  * This routine is called as the transform callback.
  260  * Takes care of filtering and other sanity checks on
  261  * the processed packet.
  262  */
  263 int
  264 ipsec4_common_input_cb(struct mbuf *m, struct secasvar *sav,
  265                         int skip, int protoff, struct m_tag *mt)
  266 {
  267         int prot, af, sproto;
  268         struct ip *ip;
  269         struct m_tag *mtag;
  270         struct tdb_ident *tdbi;
  271         struct secasindex *saidx;
  272         int error;
  273 
  274 #if 0
  275         SPLASSERT(net, "ipsec4_common_input_cb");
  276 #endif
  277 
  278         KASSERT(m != NULL, ("ipsec4_common_input_cb: null mbuf"));
  279         KASSERT(sav != NULL, ("ipsec4_common_input_cb: null SA"));
  280         KASSERT(sav->sah != NULL, ("ipsec4_common_input_cb: null SAH"));
  281         saidx = &sav->sah->saidx;
  282         af = saidx->dst.sa.sa_family;
  283         KASSERT(af == AF_INET, ("ipsec4_common_input_cb: unexpected af %u",af));
  284         sproto = saidx->proto;
  285         KASSERT(sproto == IPPROTO_ESP || sproto == IPPROTO_AH ||
  286                 sproto == IPPROTO_IPCOMP,
  287                 ("ipsec4_common_input_cb: unexpected security protocol %u",
  288                 sproto));
  289 
  290         /* Sanity check */
  291         if (m == NULL) {
  292                 DPRINTF(("ipsec4_common_input_cb: null mbuf"));
  293                 IPSEC_ISTAT(sproto, espstat.esps_badkcr, ahstat.ahs_badkcr,
  294                     ipcompstat.ipcomps_badkcr);
  295                 KEY_FREESAV(&sav);
  296                 return EINVAL;
  297         }
  298 
  299         if (skip != 0) {
  300                 /* Fix IPv4 header */
  301                 if (m->m_len < skip && (m = m_pullup(m, skip)) == NULL) {
  302                         DPRINTF(("ipsec4_common_input_cb: processing failed "
  303                             "for SA %s/%08lx\n",
  304                             ipsec_address(&sav->sah->saidx.dst),
  305                             (u_long) ntohl(sav->spi)));
  306                         IPSEC_ISTAT(sproto, espstat.esps_hdrops, ahstat.ahs_hdrops,
  307                             ipcompstat.ipcomps_hdrops);
  308                         error = ENOBUFS;
  309                         goto bad;
  310                 }
  311 
  312                 ip = mtod(m, struct ip *);
  313                 ip->ip_len = htons(m->m_pkthdr.len);
  314                 ip->ip_off = htons(ip->ip_off);
  315                 ip->ip_sum = 0;
  316                 ip->ip_sum = in_cksum(m, ip->ip_hl << 2);
  317         } else {
  318                 ip = mtod(m, struct ip *);
  319         }
  320         prot = ip->ip_p;
  321 
  322         /* IP-in-IP encapsulation */
  323         if (prot == IPPROTO_IPIP) {
  324                 struct ip ipn;
  325 
  326                 /* ipn will now contain the inner IPv4 header */
  327                 m_copydata(m, ip->ip_hl << 2, sizeof(struct ip),
  328                     (caddr_t) &ipn);
  329 
  330 #ifdef notyet
  331                 /* XXX PROXY address isn't recorded in SAH */
  332                 /*
  333                  * Check that the inner source address is the same as
  334                  * the proxy address, if available.
  335                  */
  336                 if ((saidx->proxy.sa.sa_family == AF_INET &&
  337                     saidx->proxy.sin.sin_addr.s_addr !=
  338                     INADDR_ANY &&
  339                     ipn.ip_src.s_addr !=
  340                     saidx->proxy.sin.sin_addr.s_addr) ||
  341                     (saidx->proxy.sa.sa_family != AF_INET &&
  342                         saidx->proxy.sa.sa_family != 0)) {
  343 
  344                         DPRINTF(("ipsec4_common_input_cb: inner "
  345                             "source address %s doesn't correspond to "
  346                             "expected proxy source %s, SA %s/%08lx\n",
  347                             inet_ntoa4(ipn.ip_src),
  348                             ipsp_address(saidx->proxy),
  349                             ipsp_address(saidx->dst),
  350                             (u_long) ntohl(sav->spi)));
  351 
  352                         IPSEC_ISTAT(sproto, espstat.esps_pdrops,
  353                             ahstat.ahs_pdrops,
  354                             ipcompstat.ipcomps_pdrops);
  355                         error = EACCES;
  356                         goto bad;
  357                 }
  358 #endif /*XXX*/
  359         }
  360 #if INET6
  361         /* IPv6-in-IP encapsulation. */
  362         if (prot == IPPROTO_IPV6) {
  363                 struct ip6_hdr ip6n;
  364 
  365                 /* ip6n will now contain the inner IPv6 header. */
  366                 m_copydata(m, ip->ip_hl << 2, sizeof(struct ip6_hdr),
  367                     (caddr_t) &ip6n);
  368 
  369 #ifdef notyet
  370                 /*
  371                  * Check that the inner source address is the same as
  372                  * the proxy address, if available.
  373                  */
  374                 if ((saidx->proxy.sa.sa_family == AF_INET6 &&
  375                     !IN6_IS_ADDR_UNSPECIFIED(&saidx->proxy.sin6.sin6_addr) &&
  376                     !IN6_ARE_ADDR_EQUAL(&ip6n.ip6_src,
  377                         &saidx->proxy.sin6.sin6_addr)) ||
  378                     (saidx->proxy.sa.sa_family != AF_INET6 &&
  379                         saidx->proxy.sa.sa_family != 0)) {
  380 
  381                         DPRINTF(("ipsec4_common_input_cb: inner "
  382                             "source address %s doesn't correspond to "
  383                             "expected proxy source %s, SA %s/%08lx\n",
  384                             ip6_sprintf(&ip6n.ip6_src),
  385                             ipsec_address(&saidx->proxy),
  386                             ipsec_address(&saidx->dst),
  387                             (u_long) ntohl(sav->spi)));
  388 
  389                         IPSEC_ISTAT(sproto, espstat.esps_pdrops,
  390                             ahstat.ahs_pdrops,
  391                             ipcompstat.ipcomps_pdrops);
  392                         error = EACCES;
  393                         goto bad;
  394                 }
  395 #endif /*XXX*/
  396         }
  397 #endif /* INET6 */
  398 
  399         /*
  400          * Record what we've done to the packet (under what SA it was
  401          * processed). If we've been passed an mtag, it means the packet
  402          * was already processed by an ethernet/crypto combo card and
  403          * thus has a tag attached with all the right information, but
  404          * with a PACKET_TAG_IPSEC_IN_CRYPTO_DONE as opposed to
  405          * PACKET_TAG_IPSEC_IN_DONE type; in that case, just change the type.
  406          */
  407         if (mt == NULL && sproto != IPPROTO_IPCOMP) {
  408                 mtag = m_tag_get(PACKET_TAG_IPSEC_IN_DONE,
  409                     sizeof(struct tdb_ident), M_NOWAIT);
  410                 if (mtag == NULL) {
  411                         DPRINTF(("ipsec4_common_input_cb: failed to get tag\n"));
  412                         IPSEC_ISTAT(sproto, espstat.esps_hdrops,
  413                             ahstat.ahs_hdrops, ipcompstat.ipcomps_hdrops);
  414                         error = ENOMEM;
  415                         goto bad;
  416                 }
  417 
  418                 tdbi = (struct tdb_ident *)(mtag + 1);
  419                 bcopy(&saidx->dst, &tdbi->dst, saidx->dst.sa.sa_len);
  420                 tdbi->proto = sproto;
  421                 tdbi->spi = sav->spi;
  422 
  423                 m_tag_prepend(m, mtag);
  424         } else {
  425                 mt->m_tag_id = PACKET_TAG_IPSEC_IN_DONE;
  426                 /* XXX do we need to mark m_flags??? */
  427         }
  428 
  429         key_sa_recordxfer(sav, m);              /* record data transfer */
  430 
  431         /*
  432          * Re-dispatch via software interrupt.
  433          */
  434         if (!netisr_queue(NETISR_IP, m)) {
  435                 IPSEC_ISTAT(sproto, espstat.esps_qfull, ahstat.ahs_qfull,
  436                             ipcompstat.ipcomps_qfull);
  437 
  438                 DPRINTF(("ipsec4_common_input_cb: queue full; "
  439                         "proto %u packet dropped\n", sproto));
  440                 return ENOBUFS;
  441         }
  442         return 0;
  443 bad:
  444         m_freem(m);
  445         return error;
  446 }
  447 #endif /* INET */
  448 
  449 #ifdef INET6
  450 /* IPv6 AH wrapper. */
  451 int
  452 ipsec6_common_input(struct mbuf **mp, int *offp, int proto)
  453 {
  454         int l = 0;
  455         int protoff;
  456         struct ip6_ext ip6e;
  457 
  458         if (*offp < sizeof(struct ip6_hdr)) {
  459                 DPRINTF(("ipsec6_common_input: bad offset %u\n", *offp));
  460                 return IPPROTO_DONE;
  461         } else if (*offp == sizeof(struct ip6_hdr)) {
  462                 protoff = offsetof(struct ip6_hdr, ip6_nxt);
  463         } else {
  464                 /* Chase down the header chain... */
  465                 protoff = sizeof(struct ip6_hdr);
  466 
  467                 do {
  468                         protoff += l;
  469                         m_copydata(*mp, protoff, sizeof(ip6e),
  470                             (caddr_t) &ip6e);
  471 
  472                         if (ip6e.ip6e_nxt == IPPROTO_AH)
  473                                 l = (ip6e.ip6e_len + 2) << 2;
  474                         else
  475                                 l = (ip6e.ip6e_len + 1) << 3;
  476                         KASSERT(l > 0, ("ah6_input: l went zero or negative"));
  477                 } while (protoff + l < *offp);
  478 
  479                 /* Malformed packet check */
  480                 if (protoff + l != *offp) {
  481                         DPRINTF(("ipsec6_common_input: bad packet header chain, "
  482                                 "protoff %u, l %u, off %u\n", protoff, l, *offp));
  483                         IPSEC_ISTAT(proto, espstat.esps_hdrops,
  484                                     ahstat.ahs_hdrops,
  485                                     ipcompstat.ipcomps_hdrops);
  486                         m_freem(*mp);
  487                         *mp = NULL;
  488                         return IPPROTO_DONE;
  489                 }
  490                 protoff += offsetof(struct ip6_ext, ip6e_nxt);
  491         }
  492         (void) ipsec_common_input(*mp, *offp, protoff, AF_INET6, proto);
  493         return IPPROTO_DONE;
  494 }
  495 
  496 void
  497 esp6_ctlinput(int cmd, struct sockaddr *sa, void *d)
  498 {
  499         if (sa->sa_family != AF_INET6 ||
  500             sa->sa_len != sizeof(struct sockaddr_in6))
  501                 return;
  502         if ((unsigned)cmd >= PRC_NCMDS)
  503                 return;
  504 
  505         /* if the parameter is from icmp6, decode it. */
  506         if (d !=  NULL) {
  507                 struct ip6ctlparam *ip6cp = (struct ip6ctlparam *)d;
  508                 struct mbuf *m = ip6cp->ip6c_m;
  509                 int off = ip6cp->ip6c_off;
  510 
  511                 struct ip6ctlparam ip6cp1;
  512 
  513                 /*
  514                  * Notify the error to all possible sockets via pfctlinput2.
  515                  * Since the upper layer information (such as protocol type,
  516                  * source and destination ports) is embedded in the encrypted
  517                  * data and might have been cut, we can't directly call
  518                  * an upper layer ctlinput function. However, the pcbnotify
  519                  * function will consider source and destination addresses
  520                  * as well as the flow info value, and may be able to find
  521                  * some PCB that should be notified.
  522                  * Although pfctlinput2 will call esp6_ctlinput(), there is
  523                  * no possibility of an infinite loop of function calls,
  524                  * because we don't pass the inner IPv6 header.
  525                  */
  526                 bzero(&ip6cp1, sizeof(ip6cp1));
  527                 ip6cp1.ip6c_src = ip6cp->ip6c_src;
  528                 pfctlinput2(cmd, sa, (void *)&ip6cp1);
  529 
  530                 /*
  531                  * Then go to special cases that need ESP header information.
  532                  * XXX: We assume that when ip6 is non NULL,
  533                  * M and OFF are valid.
  534                  */
  535 
  536                 if (cmd == PRC_MSGSIZE) {
  537                         struct secasvar *sav;
  538                         u_int32_t spi;
  539                         int valid;
  540 
  541                         /* check header length before using m_copydata */
  542                         if (m->m_pkthdr.len < off + sizeof (struct esp))
  543                                 return;
  544                         m_copydata(m, off + offsetof(struct esp, esp_spi),
  545                                 sizeof(u_int32_t), (caddr_t) &spi);
  546                         /*
  547                          * Check to see if we have a valid SA corresponding to
  548                          * the address in the ICMP message payload.
  549                          */
  550                         sav = KEY_ALLOCSA((union sockaddr_union *)sa,
  551                                         IPPROTO_ESP, spi);
  552                         valid = (sav != NULL);
  553                         if (sav)
  554                                 KEY_FREESAV(&sav);
  555 
  556                         /* XXX Further validation? */
  557 
  558                         /*
  559                          * Depending on whether the SA is "valid" and
  560                          * routing table size (mtudisc_{hi,lo}wat), we will:
  561                          * - recalcurate the new MTU and create the
  562                          *   corresponding routing entry, or
  563                          * - ignore the MTU change notification.
  564                          */
  565                         icmp6_mtudisc_update(ip6cp, valid);
  566                 }
  567         } else {
  568                 /* we normally notify any pcb here */
  569         }
  570 }
  571 
  572 /*
  573  * IPsec input callback, called by the transform callback. Takes care of
  574  * filtering and other sanity checks on the processed packet.
  575  */
  576 int
  577 ipsec6_common_input_cb(struct mbuf *m, struct secasvar *sav, int skip, int protoff,
  578     struct m_tag *mt)
  579 {
  580         int prot, af, sproto;
  581         struct ip6_hdr *ip6;
  582         struct m_tag *mtag;
  583         struct tdb_ident *tdbi;
  584         struct secasindex *saidx;
  585         int nxt;
  586         u_int8_t nxt8;
  587         int error, nest;
  588 
  589         KASSERT(m != NULL, ("ipsec6_common_input_cb: null mbuf"));
  590         KASSERT(sav != NULL, ("ipsec6_common_input_cb: null SA"));
  591         KASSERT(sav->sah != NULL, ("ipsec6_common_input_cb: null SAH"));
  592         saidx = &sav->sah->saidx;
  593         af = saidx->dst.sa.sa_family;
  594         KASSERT(af == AF_INET6,
  595                 ("ipsec6_common_input_cb: unexpected af %u", af));
  596         sproto = saidx->proto;
  597         KASSERT(sproto == IPPROTO_ESP || sproto == IPPROTO_AH ||
  598                 sproto == IPPROTO_IPCOMP,
  599                 ("ipsec6_common_input_cb: unexpected security protocol %u",
  600                 sproto));
  601 
  602         /* Sanity check */
  603         if (m == NULL) {
  604                 DPRINTF(("ipsec4_common_input_cb: null mbuf"));
  605                 IPSEC_ISTAT(sproto, espstat.esps_badkcr, ahstat.ahs_badkcr,
  606                     ipcompstat.ipcomps_badkcr);
  607                 error = EINVAL;
  608                 goto bad;
  609         }
  610 
  611         /* Fix IPv6 header */
  612         if (m->m_len < sizeof(struct ip6_hdr) &&
  613             (m = m_pullup(m, sizeof(struct ip6_hdr))) == NULL) {
  614 
  615                 DPRINTF(("ipsec_common_input_cb: processing failed "
  616                     "for SA %s/%08lx\n", ipsec_address(&sav->sah->saidx.dst),
  617                     (u_long) ntohl(sav->spi)));
  618 
  619                 IPSEC_ISTAT(sproto, espstat.esps_hdrops, ahstat.ahs_hdrops,
  620                     ipcompstat.ipcomps_hdrops);
  621                 error = EACCES;
  622                 goto bad;
  623         }
  624 
  625         ip6 = mtod(m, struct ip6_hdr *);
  626         ip6->ip6_plen = htons(m->m_pkthdr.len - sizeof(struct ip6_hdr));
  627 
  628         /* Save protocol */
  629         m_copydata(m, protoff, 1, (unsigned char *) &prot);
  630 
  631 #ifdef INET
  632         /* IP-in-IP encapsulation */
  633         if (prot == IPPROTO_IPIP) {
  634                 struct ip ipn;
  635 
  636                 /* ipn will now contain the inner IPv4 header */
  637                 m_copydata(m, skip, sizeof(struct ip), (caddr_t) &ipn);
  638 
  639 #ifdef notyet
  640                 /*
  641                  * Check that the inner source address is the same as
  642                  * the proxy address, if available.
  643                  */
  644                 if ((saidx->proxy.sa.sa_family == AF_INET &&
  645                     saidx->proxy.sin.sin_addr.s_addr != INADDR_ANY &&
  646                     ipn.ip_src.s_addr != saidx->proxy.sin.sin_addr.s_addr) ||
  647                     (saidx->proxy.sa.sa_family != AF_INET &&
  648                         saidx->proxy.sa.sa_family != 0)) {
  649 
  650                         DPRINTF(("ipsec_common_input_cb: inner "
  651                             "source address %s doesn't correspond to "
  652                             "expected proxy source %s, SA %s/%08lx\n",
  653                             inet_ntoa4(ipn.ip_src),
  654                             ipsec_address(&saidx->proxy),
  655                             ipsec_address(&saidx->dst),
  656                             (u_long) ntohl(sav->spi)));
  657 
  658                         IPSEC_ISTATsproto, (espstat.esps_pdrops,
  659                             ahstat.ahs_pdrops, ipcompstat.ipcomps_pdrops);
  660                         error = EACCES;
  661                         goto bad;
  662                 }
  663 #endif /*XXX*/
  664         }
  665 #endif /* INET */
  666 
  667         /* IPv6-in-IP encapsulation */
  668         if (prot == IPPROTO_IPV6) {
  669                 struct ip6_hdr ip6n;
  670 
  671                 /* ip6n will now contain the inner IPv6 header. */
  672                 m_copydata(m, skip, sizeof(struct ip6_hdr),
  673                     (caddr_t) &ip6n);
  674 
  675 #ifdef notyet
  676                 /*
  677                  * Check that the inner source address is the same as
  678                  * the proxy address, if available.
  679                  */
  680                 if ((saidx->proxy.sa.sa_family == AF_INET6 &&
  681                     !IN6_IS_ADDR_UNSPECIFIED(&saidx->proxy.sin6.sin6_addr) &&
  682                     !IN6_ARE_ADDR_EQUAL(&ip6n.ip6_src,
  683                         &saidx->proxy.sin6.sin6_addr)) ||
  684                     (saidx->proxy.sa.sa_family != AF_INET6 &&
  685                         saidx->proxy.sa.sa_family != 0)) {
  686 
  687                         DPRINTF(("ipsec_common_input_cb: inner "
  688                             "source address %s doesn't correspond to "
  689                             "expected proxy source %s, SA %s/%08lx\n",
  690                             ip6_sprintf(&ip6n.ip6_src),
  691                             ipsec_address(&saidx->proxy),
  692                             ipsec_address(&saidx->dst),
  693                             (u_long) ntohl(sav->spi)));
  694 
  695                         IPSEC_ISTAT(sproto, espstat.esps_pdrops,
  696                             ahstat.ahs_pdrops, ipcompstat.ipcomps_pdrops);
  697                         error = EACCES;
  698                         goto bad;
  699                 }
  700 #endif /*XXX*/
  701         }
  702 
  703         /*
  704          * Record what we've done to the packet (under what SA it was
  705          * processed). If we've been passed an mtag, it means the packet
  706          * was already processed by an ethernet/crypto combo card and
  707          * thus has a tag attached with all the right information, but
  708          * with a PACKET_TAG_IPSEC_IN_CRYPTO_DONE as opposed to
  709          * PACKET_TAG_IPSEC_IN_DONE type; in that case, just change the type.
  710          */
  711         if (mt == NULL && sproto != IPPROTO_IPCOMP) {
  712                 mtag = m_tag_get(PACKET_TAG_IPSEC_IN_DONE,
  713                     sizeof(struct tdb_ident), M_NOWAIT);
  714                 if (mtag == NULL) {
  715                         DPRINTF(("ipsec_common_input_cb: failed to "
  716                             "get tag\n"));
  717                         IPSEC_ISTAT(sproto, espstat.esps_hdrops,
  718                             ahstat.ahs_hdrops, ipcompstat.ipcomps_hdrops);
  719                         error = ENOMEM;
  720                         goto bad;
  721                 }
  722 
  723                 tdbi = (struct tdb_ident *)(mtag + 1);
  724                 bcopy(&saidx->dst, &tdbi->dst, sizeof(union sockaddr_union));
  725                 tdbi->proto = sproto;
  726                 tdbi->spi = sav->spi;
  727 
  728                 m_tag_prepend(m, mtag);
  729         } else {
  730                 mt->m_tag_id = PACKET_TAG_IPSEC_IN_DONE;
  731                 /* XXX do we need to mark m_flags??? */
  732         }
  733 
  734         key_sa_recordxfer(sav, m);
  735 
  736         /* Retrieve new protocol */
  737         m_copydata(m, protoff, sizeof(u_int8_t), (caddr_t) &nxt8);
  738 
  739         /*
  740          * See the end of ip6_input for this logic.
  741          * IPPROTO_IPV[46] case will be processed just like other ones
  742          */
  743         nest = 0;
  744         nxt = nxt8;
  745         while (nxt != IPPROTO_DONE) {
  746                 if (ip6_hdrnestlimit && (++nest > ip6_hdrnestlimit)) {
  747                         ip6stat.ip6s_toomanyhdr++;
  748                         error = EINVAL;
  749                         goto bad;
  750                 }
  751 
  752                 /*
  753                  * Protection against faulty packet - there should be
  754                  * more sanity checks in header chain processing.
  755                  */
  756                 if (m->m_pkthdr.len < skip) {
  757                         ip6stat.ip6s_tooshort++;
  758                         in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_truncated);
  759                         error = EINVAL;
  760                         goto bad;
  761                 }
  762                 /*
  763                  * Enforce IPsec policy checking if we are seeing last header.
  764                  * note that we do not visit this with protocols with pcb layer
  765                  * code - like udp/tcp/raw ip.
  766                  */
  767                 if ((inet6sw[ip6_protox[nxt]].pr_flags & PR_LASTHDR) != 0 &&
  768                     ipsec6_in_reject(m, NULL)) {
  769                         error = EINVAL;
  770                         goto bad;
  771                 }
  772                 nxt = (*inet6sw[ip6_protox[nxt]].pr_input)(&m, &skip, nxt);
  773         }
  774         return 0;
  775 bad:
  776         if (m)
  777                 m_freem(m);
  778         return error;
  779 }
  780 #endif /* INET6 */
Cache object: a55648b6a56b853c88a7c8ebe90e09b9
[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]
This page is part of the FreeBSD/Linux Linux Kernel Cross-Reference, and was automatically generated using a modified version of the LXR engine.
FreeBSD/Linux Kernel Cross Reference sys/netipsec/ipsec_input.c

FreeBSD/Linux Kernel Cross Reference
sys/netipsec/ipsec_input.c
