ipsec_input.c

Version: - FREEBSD - FREEBSD-13-STABLE - FREEBSD-13-0 - FREEBSD-12-STABLE - FREEBSD-12-0 - FREEBSD-11-STABLE - FREEBSD-11-0 - FREEBSD-10-STABLE - FREEBSD-10-0 - FREEBSD-9-STABLE - FREEBSD-9-0 - FREEBSD-8-STABLE - FREEBSD-8-0 - FREEBSD-7-STABLE - FREEBSD-7-0 - FREEBSD-6-STABLE - FREEBSD-6-0 - FREEBSD-5-STABLE - FREEBSD-5-0 - FREEBSD-4-STABLE - FREEBSD-3-STABLE - FREEBSD22 - l41 - OPENBSD - linux-2.6 - MK84 - PLAN9 - xnu-8792
SearchContext: - none - 3 - 10
    1 /*      $FreeBSD: releng/6.0/sys/netipsec/ipsec_input.c 139823 2005-01-07 01:45:51Z imp $       */
    2 /*      $OpenBSD: ipsec_input.c,v 1.63 2003/02/20 18:35:43 deraadt Exp $        */
    3 /*-
    4  * The authors of this code are John Ioannidis (ji@tla.org),
    5  * Angelos D. Keromytis (kermit@csd.uch.gr) and
    6  * Niels Provos (provos@physnet.uni-hamburg.de).
    7  *
    8  * This code was written by John Ioannidis for BSD/OS in Athens, Greece,
    9  * in November 1995.
   10  *
   11  * Ported to OpenBSD and NetBSD, with additional transforms, in December 1996,
   12  * by Angelos D. Keromytis.
   13  *
   14  * Additional transforms and features in 1997 and 1998 by Angelos D. Keromytis
   15  * and Niels Provos.
   16  *
   17  * Additional features in 1999 by Angelos D. Keromytis.
   18  *
   19  * Copyright (C) 1995, 1996, 1997, 1998, 1999 by John Ioannidis,
   20  * Angelos D. Keromytis and Niels Provos.
   21  * Copyright (c) 2001, Angelos D. Keromytis.
   22  *
   23  * Permission to use, copy, and modify this software with or without fee
   24  * is hereby granted, provided that this entire notice is included in
   25  * all copies of any software which is or includes a copy or
   26  * modification of this software.
   27  * You may use this code under the GNU public license if you so wish. Please
   28  * contribute changes back to the authors under this freer than GPL license
   29  * so that we may further the use of strong encryption without limitations to
   30  * all.
   31  *
   32  * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR
   33  * IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY
   34  * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE
   35  * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR
   36  * PURPOSE.
   37  */
   38 
   39 /*
   40  * IPsec input processing.
   41  */
   42 
   43 #include "opt_inet.h"
   44 #include "opt_inet6.h"
   45 #include "opt_ipsec.h"
   46 
   47 #include <sys/param.h>
   48 #include <sys/systm.h>
   49 #include <sys/malloc.h>
   50 #include <sys/mbuf.h>
   51 #include <sys/domain.h>
   52 #include <sys/protosw.h>
   53 #include <sys/socket.h>
   54 #include <sys/errno.h>
   55 #include <sys/syslog.h>
   56 
   57 #include <net/if.h>
   58 #include <net/route.h>
   59 #include <net/netisr.h>
   60 
   61 #include <netinet/in.h>
   62 #include <netinet/in_systm.h>
   63 #include <netinet/ip.h>
   64 #include <netinet/ip_var.h>
   65 #include <netinet/in_var.h>
   66 
   67 #include <netinet/ip6.h>
   68 #ifdef INET6
   69 #include <netinet6/ip6_var.h>
   70 #endif
   71 #include <netinet/in_pcb.h>
   72 #ifdef INET6
   73 #include <netinet/icmp6.h>
   74 #endif
   75 
   76 #include <netipsec/ipsec.h>
   77 #ifdef INET6
   78 #include <netipsec/ipsec6.h>
   79 #endif
   80 #include <netipsec/ah_var.h>
   81 #include <netipsec/esp.h>
   82 #include <netipsec/esp_var.h>
   83 #include <netipsec/ipcomp_var.h>
   84 
   85 #include <netipsec/key.h>
   86 #include <netipsec/keydb.h>
   87 
   88 #include <netipsec/xform.h>
   89 #include <netinet6/ip6protosw.h>
   90 
   91 #include <machine/in_cksum.h>
   92 #include <machine/stdarg.h>
   93 
   94 #define IPSEC_ISTAT(p,x,y,z) ((p) == IPPROTO_ESP ? (x)++ : \
   95                             (p) == IPPROTO_AH ? (y)++ : (z)++)
   96 
   97 static void ipsec4_common_ctlinput(int, struct sockaddr *, void *, int);
   98 
   99 /*
  100  * ipsec_common_input gets called when an IPsec-protected packet
  101  * is received by IPv4 or IPv6.  It's job is to find the right SA
  102  # and call the appropriate transform.  The transform callback
  103  * takes care of further processing (like ingress filtering).
  104  */
  105 static int
  106 ipsec_common_input(struct mbuf *m, int skip, int protoff, int af, int sproto)
  107 {
  108         union sockaddr_union dst_address;
  109         struct secasvar *sav;
  110         u_int32_t spi;
  111         int error;
  112 
  113         IPSEC_ISTAT(sproto, espstat.esps_input, ahstat.ahs_input,
  114                 ipcompstat.ipcomps_input);
  115 
  116         IPSEC_ASSERT(m != NULL, ("null packet"));
  117 
  118         if ((sproto == IPPROTO_ESP && !esp_enable) ||
  119             (sproto == IPPROTO_AH && !ah_enable) ||
  120             (sproto == IPPROTO_IPCOMP && !ipcomp_enable)) {
  121                 m_freem(m);
  122                 IPSEC_ISTAT(sproto, espstat.esps_pdrops, ahstat.ahs_pdrops,
  123                     ipcompstat.ipcomps_pdrops);
  124                 return EOPNOTSUPP;
  125         }
  126 
  127         if (m->m_pkthdr.len - skip < 2 * sizeof (u_int32_t)) {
  128                 m_freem(m);
  129                 IPSEC_ISTAT(sproto, espstat.esps_hdrops, ahstat.ahs_hdrops,
  130                     ipcompstat.ipcomps_hdrops);
  131                 DPRINTF(("%s: packet too small\n", __func__));
  132                 return EINVAL;
  133         }
  134 
  135         /* Retrieve the SPI from the relevant IPsec header */
  136         if (sproto == IPPROTO_ESP)
  137                 m_copydata(m, skip, sizeof(u_int32_t), (caddr_t) &spi);
  138         else if (sproto == IPPROTO_AH)
  139                 m_copydata(m, skip + sizeof(u_int32_t), sizeof(u_int32_t),
  140                     (caddr_t) &spi);
  141         else if (sproto == IPPROTO_IPCOMP) {
  142                 u_int16_t cpi;
  143                 m_copydata(m, skip + sizeof(u_int16_t), sizeof(u_int16_t),
  144                     (caddr_t) &cpi);
  145                 spi = ntohl(htons(cpi));
  146         }
  147 
  148         /*
  149          * Find the SA and (indirectly) call the appropriate
  150          * kernel crypto routine. The resulting mbuf chain is a valid
  151          * IP packet ready to go through input processing.
  152          */
  153         bzero(&dst_address, sizeof (dst_address));
  154         dst_address.sa.sa_family = af;
  155         switch (af) {
  156 #ifdef INET
  157         case AF_INET:
  158                 dst_address.sin.sin_len = sizeof(struct sockaddr_in);
  159                 m_copydata(m, offsetof(struct ip, ip_dst),
  160                     sizeof(struct in_addr),
  161                     (caddr_t) &dst_address.sin.sin_addr);
  162                 break;
  163 #endif /* INET */
  164 #ifdef INET6
  165         case AF_INET6:
  166                 dst_address.sin6.sin6_len = sizeof(struct sockaddr_in6);
  167                 m_copydata(m, offsetof(struct ip6_hdr, ip6_dst),
  168                     sizeof(struct in6_addr),
  169                     (caddr_t) &dst_address.sin6.sin6_addr);
  170                 break;
  171 #endif /* INET6 */
  172         default:
  173                 DPRINTF(("%s: unsupported protocol family %u\n", __func__, af));
  174                 m_freem(m);
  175                 IPSEC_ISTAT(sproto, espstat.esps_nopf, ahstat.ahs_nopf,
  176                     ipcompstat.ipcomps_nopf);
  177                 return EPFNOSUPPORT;
  178         }
  179 
  180         /* NB: only pass dst since key_allocsa follows RFC2401 */
  181         sav = KEY_ALLOCSA(&dst_address, sproto, spi);
  182         if (sav == NULL) {
  183                 DPRINTF(("%s: no key association found for SA %s/%08lx/%u\n",
  184                           __func__, ipsec_address(&dst_address),
  185                           (u_long) ntohl(spi), sproto));
  186                 IPSEC_ISTAT(sproto, espstat.esps_notdb, ahstat.ahs_notdb,
  187                     ipcompstat.ipcomps_notdb);
  188                 m_freem(m);
  189                 return ENOENT;
  190         }
  191 
  192         if (sav->tdb_xform == NULL) {
  193                 DPRINTF(("%s: attempted to use uninitialized SA %s/%08lx/%u\n",
  194                          __func__, ipsec_address(&dst_address),
  195                          (u_long) ntohl(spi), sproto));
  196                 IPSEC_ISTAT(sproto, espstat.esps_noxform, ahstat.ahs_noxform,
  197                     ipcompstat.ipcomps_noxform);
  198                 KEY_FREESAV(&sav);
  199                 m_freem(m);
  200                 return ENXIO;
  201         }
  202 
  203         /*
  204          * Call appropriate transform and return -- callback takes care of
  205          * everything else.
  206          */
  207         error = (*sav->tdb_xform->xf_input)(m, sav, skip, protoff);
  208         KEY_FREESAV(&sav);
  209         return error;
  210 }
  211 
  212 #ifdef INET
  213 /*
  214  * Common input handler for IPv4 AH, ESP, and IPCOMP.
  215  */
  216 int
  217 ipsec4_common_input(struct mbuf *m, ...)
  218 {
  219         va_list ap;
  220         int off, nxt;
  221 
  222         va_start(ap, m);
  223         off = va_arg(ap, int);
  224         nxt = va_arg(ap, int);
  225         va_end(ap);
  226 
  227         return ipsec_common_input(m, off, offsetof(struct ip, ip_p),
  228                                   AF_INET, nxt);
  229 }
  230 
  231 void
  232 ah4_input(struct mbuf *m, int off)
  233 {
  234         ipsec4_common_input(m, off, IPPROTO_AH);
  235 }
  236 void
  237 ah4_ctlinput(int cmd, struct sockaddr *sa, void *v)
  238 {
  239         if (sa->sa_family == AF_INET &&
  240             sa->sa_len == sizeof(struct sockaddr_in))
  241                 ipsec4_common_ctlinput(cmd, sa, v, IPPROTO_AH);
  242 }
  243 
  244 void
  245 esp4_input(struct mbuf *m, int off)
  246 {
  247         ipsec4_common_input(m, off, IPPROTO_ESP);
  248 }
  249 void
  250 esp4_ctlinput(int cmd, struct sockaddr *sa, void *v)
  251 {
  252         if (sa->sa_family == AF_INET &&
  253             sa->sa_len == sizeof(struct sockaddr_in))
  254                 ipsec4_common_ctlinput(cmd, sa, v, IPPROTO_ESP);
  255 }
  256 
  257 void
  258 ipcomp4_input(struct mbuf *m, int off)
  259 {
  260         ipsec4_common_input(m, off, IPPROTO_IPCOMP);
  261 }
  262 
  263 /*
  264  * IPsec input callback for INET protocols.
  265  * This routine is called as the transform callback.
  266  * Takes care of filtering and other sanity checks on
  267  * the processed packet.
  268  */
  269 int
  270 ipsec4_common_input_cb(struct mbuf *m, struct secasvar *sav,
  271                         int skip, int protoff, struct m_tag *mt)
  272 {
  273         int prot, af, sproto;
  274         struct ip *ip;
  275         struct m_tag *mtag;
  276         struct tdb_ident *tdbi;
  277         struct secasindex *saidx;
  278         int error;
  279 
  280         IPSEC_SPLASSERT_SOFTNET(__func__);
  281 
  282         IPSEC_ASSERT(m != NULL, ("null mbuf"));
  283         IPSEC_ASSERT(sav != NULL, ("null SA"));
  284         IPSEC_ASSERT(sav->sah != NULL, ("null SAH"));
  285         saidx = &sav->sah->saidx;
  286         af = saidx->dst.sa.sa_family;
  287         IPSEC_ASSERT(af == AF_INET, ("unexpected af %u", af));
  288         sproto = saidx->proto;
  289         IPSEC_ASSERT(sproto == IPPROTO_ESP || sproto == IPPROTO_AH ||
  290                 sproto == IPPROTO_IPCOMP,
  291                 ("unexpected security protocol %u", sproto));
  292 
  293         /* Sanity check */
  294         if (m == NULL) {
  295                 DPRINTF(("%s: null mbuf", __func__));
  296                 IPSEC_ISTAT(sproto, espstat.esps_badkcr, ahstat.ahs_badkcr,
  297                     ipcompstat.ipcomps_badkcr);
  298                 KEY_FREESAV(&sav);
  299                 return EINVAL;
  300         }
  301 
  302         if (skip != 0) {
  303                 /* Fix IPv4 header */
  304                 if (m->m_len < skip && (m = m_pullup(m, skip)) == NULL) {
  305                         DPRINTF(("%s: processing failed for SA %s/%08lx\n",
  306                             __func__, ipsec_address(&sav->sah->saidx.dst),
  307                             (u_long) ntohl(sav->spi)));
  308                         IPSEC_ISTAT(sproto, espstat.esps_hdrops, ahstat.ahs_hdrops,
  309                             ipcompstat.ipcomps_hdrops);
  310                         error = ENOBUFS;
  311                         goto bad;
  312                 }
  313 
  314                 ip = mtod(m, struct ip *);
  315                 ip->ip_len = htons(m->m_pkthdr.len);
  316                 ip->ip_off = htons(ip->ip_off);
  317                 ip->ip_sum = 0;
  318                 ip->ip_sum = in_cksum(m, ip->ip_hl << 2);
  319         } else {
  320                 ip = mtod(m, struct ip *);
  321         }
  322         prot = ip->ip_p;
  323 
  324         /* IP-in-IP encapsulation */
  325         if (prot == IPPROTO_IPIP) {
  326                 struct ip ipn;
  327 
  328                 if (m->m_pkthdr.len - skip < sizeof(struct ip)) {
  329                         IPSEC_ISTAT(sproto, espstat.esps_hdrops,
  330                             ahstat.ahs_hdrops,
  331                             ipcompstat.ipcomps_hdrops);
  332                         error = EINVAL;
  333                         goto bad;
  334                 }
  335                 /* ipn will now contain the inner IPv4 header */
  336                 m_copydata(m, ip->ip_hl << 2, sizeof(struct ip),
  337                     (caddr_t) &ipn);
  338 
  339 #ifdef notyet
  340                 /* XXX PROXY address isn't recorded in SAH */
  341                 /*
  342                  * Check that the inner source address is the same as
  343                  * the proxy address, if available.
  344                  */
  345                 if ((saidx->proxy.sa.sa_family == AF_INET &&
  346                     saidx->proxy.sin.sin_addr.s_addr !=
  347                     INADDR_ANY &&
  348                     ipn.ip_src.s_addr !=
  349                     saidx->proxy.sin.sin_addr.s_addr) ||
  350                     (saidx->proxy.sa.sa_family != AF_INET &&
  351                         saidx->proxy.sa.sa_family != 0)) {
  352 
  353                         DPRINTF(("%s: inner source address %s doesn't "
  354                             "correspond to expected proxy source %s, "
  355                             "SA %s/%08lx\n", __func__,
  356                             inet_ntoa4(ipn.ip_src),
  357                             ipsp_address(saidx->proxy),
  358                             ipsp_address(saidx->dst),
  359                             (u_long) ntohl(sav->spi)));
  360 
  361                         IPSEC_ISTAT(sproto, espstat.esps_pdrops,
  362                             ahstat.ahs_pdrops,
  363                             ipcompstat.ipcomps_pdrops);
  364                         error = EACCES;
  365                         goto bad;
  366                 }
  367 #endif /*XXX*/
  368         }
  369 #if INET6
  370         /* IPv6-in-IP encapsulation. */
  371         if (prot == IPPROTO_IPV6) {
  372                 struct ip6_hdr ip6n;
  373 
  374                 if (m->m_pkthdr.len - skip < sizeof(struct ip6_hdr)) {
  375                         IPSEC_ISTAT(sproto, espstat.esps_hdrops,
  376                             ahstat.ahs_hdrops,
  377                             ipcompstat.ipcomps_hdrops);
  378                         error = EINVAL;
  379                         goto bad;
  380                 }
  381                 /* ip6n will now contain the inner IPv6 header. */
  382                 m_copydata(m, ip->ip_hl << 2, sizeof(struct ip6_hdr),
  383                     (caddr_t) &ip6n);
  384 
  385 #ifdef notyet
  386                 /*
  387                  * Check that the inner source address is the same as
  388                  * the proxy address, if available.
  389                  */
  390                 if ((saidx->proxy.sa.sa_family == AF_INET6 &&
  391                     !IN6_IS_ADDR_UNSPECIFIED(&saidx->proxy.sin6.sin6_addr) &&
  392                     !IN6_ARE_ADDR_EQUAL(&ip6n.ip6_src,
  393                         &saidx->proxy.sin6.sin6_addr)) ||
  394                     (saidx->proxy.sa.sa_family != AF_INET6 &&
  395                         saidx->proxy.sa.sa_family != 0)) {
  396 
  397                         DPRINTF(("%s: inner source address %s doesn't "
  398                             "correspond to expected proxy source %s, "
  399                             "SA %s/%08lx\n", __func__,
  400                             ip6_sprintf(&ip6n.ip6_src),
  401                             ipsec_address(&saidx->proxy),
  402                             ipsec_address(&saidx->dst),
  403                             (u_long) ntohl(sav->spi)));
  404 
  405                         IPSEC_ISTAT(sproto, espstat.esps_pdrops,
  406                             ahstat.ahs_pdrops,
  407                             ipcompstat.ipcomps_pdrops);
  408                         error = EACCES;
  409                         goto bad;
  410                 }
  411 #endif /*XXX*/
  412         }
  413 #endif /* INET6 */
  414 
  415         /*
  416          * Record what we've done to the packet (under what SA it was
  417          * processed). If we've been passed an mtag, it means the packet
  418          * was already processed by an ethernet/crypto combo card and
  419          * thus has a tag attached with all the right information, but
  420          * with a PACKET_TAG_IPSEC_IN_CRYPTO_DONE as opposed to
  421          * PACKET_TAG_IPSEC_IN_DONE type; in that case, just change the type.
  422          */
  423         if (mt == NULL && sproto != IPPROTO_IPCOMP) {
  424                 mtag = m_tag_get(PACKET_TAG_IPSEC_IN_DONE,
  425                     sizeof(struct tdb_ident), M_NOWAIT);
  426                 if (mtag == NULL) {
  427                         DPRINTF(("%s: failed to get tag\n", __func__));
  428                         IPSEC_ISTAT(sproto, espstat.esps_hdrops,
  429                             ahstat.ahs_hdrops, ipcompstat.ipcomps_hdrops);
  430                         error = ENOMEM;
  431                         goto bad;
  432                 }
  433 
  434                 tdbi = (struct tdb_ident *)(mtag + 1);
  435                 bcopy(&saidx->dst, &tdbi->dst, saidx->dst.sa.sa_len);
  436                 tdbi->proto = sproto;
  437                 tdbi->spi = sav->spi;
  438 
  439                 m_tag_prepend(m, mtag);
  440         } else {
  441                 mt->m_tag_id = PACKET_TAG_IPSEC_IN_DONE;
  442                 /* XXX do we need to mark m_flags??? */
  443         }
  444 
  445         key_sa_recordxfer(sav, m);              /* record data transfer */
  446 
  447         /*
  448          * Re-dispatch via software interrupt.
  449          */
  450         if ((error = netisr_queue(NETISR_IP, m))) {
  451                 IPSEC_ISTAT(sproto, espstat.esps_qfull, ahstat.ahs_qfull,
  452                             ipcompstat.ipcomps_qfull);
  453 
  454                 DPRINTF(("%s: queue full; proto %u packet dropped\n",
  455                         __func__, sproto));
  456                 return error;
  457         }
  458         return 0;
  459 bad:
  460         m_freem(m);
  461         return error;
  462 }
  463 
  464 void
  465 ipsec4_common_ctlinput(int cmd, struct sockaddr *sa, void *v, int proto)
  466 {
  467         /* XXX nothing just yet */
  468 }
  469 #endif /* INET */
  470 
  471 #ifdef INET6
  472 /* IPv6 AH wrapper. */
  473 int
  474 ipsec6_common_input(struct mbuf **mp, int *offp, int proto)
  475 {
  476         int l = 0;
  477         int protoff;
  478         struct ip6_ext ip6e;
  479 
  480         if (*offp < sizeof(struct ip6_hdr)) {
  481                 DPRINTF(("%s: bad offset %u\n", __func__, *offp));
  482                 return IPPROTO_DONE;
  483         } else if (*offp == sizeof(struct ip6_hdr)) {
  484                 protoff = offsetof(struct ip6_hdr, ip6_nxt);
  485         } else {
  486                 /* Chase down the header chain... */
  487                 protoff = sizeof(struct ip6_hdr);
  488 
  489                 do {
  490                         protoff += l;
  491                         m_copydata(*mp, protoff, sizeof(ip6e),
  492                             (caddr_t) &ip6e);
  493 
  494                         if (ip6e.ip6e_nxt == IPPROTO_AH)
  495                                 l = (ip6e.ip6e_len + 2) << 2;
  496                         else
  497                                 l = (ip6e.ip6e_len + 1) << 3;
  498                         IPSEC_ASSERT(l > 0, ("l went zero or negative"));
  499                 } while (protoff + l < *offp);
  500 
  501                 /* Malformed packet check */
  502                 if (protoff + l != *offp) {
  503                         DPRINTF(("%s: bad packet header chain, protoff %u, "
  504                                 "l %u, off %u\n", __func__, protoff, l, *offp));
  505                         IPSEC_ISTAT(proto, espstat.esps_hdrops,
  506                                     ahstat.ahs_hdrops,
  507                                     ipcompstat.ipcomps_hdrops);
  508                         m_freem(*mp);
  509                         *mp = NULL;
  510                         return IPPROTO_DONE;
  511                 }
  512                 protoff += offsetof(struct ip6_ext, ip6e_nxt);
  513         }
  514         (void) ipsec_common_input(*mp, *offp, protoff, AF_INET6, proto);
  515         return IPPROTO_DONE;
  516 }
  517 
  518 /*
  519  * IPsec input callback, called by the transform callback. Takes care of
  520  * filtering and other sanity checks on the processed packet.
  521  */
  522 int
  523 ipsec6_common_input_cb(struct mbuf *m, struct secasvar *sav, int skip, int protoff,
  524     struct m_tag *mt)
  525 {
  526         int prot, af, sproto;
  527         struct ip6_hdr *ip6;
  528         struct m_tag *mtag;
  529         struct tdb_ident *tdbi;
  530         struct secasindex *saidx;
  531         int nxt;
  532         u_int8_t nxt8;
  533         int error, nest;
  534 
  535         IPSEC_ASSERT(m != NULL, ("null mbuf"));
  536         IPSEC_ASSERT(sav != NULL, ("null SA"));
  537         IPSEC_ASSERT(sav->sah != NULL, ("null SAH"));
  538         saidx = &sav->sah->saidx;
  539         af = saidx->dst.sa.sa_family;
  540         IPSEC_ASSERT(af == AF_INET6, ("unexpected af %u", af));
  541         sproto = saidx->proto;
  542         IPSEC_ASSERT(sproto == IPPROTO_ESP || sproto == IPPROTO_AH ||
  543                 sproto == IPPROTO_IPCOMP,
  544                 ("unexpected security protocol %u", sproto));
  545 
  546         /* Sanity check */
  547         if (m == NULL) {
  548                 DPRINTF(("%s: null mbuf", __func__));
  549                 IPSEC_ISTAT(sproto, espstat.esps_badkcr, ahstat.ahs_badkcr,
  550                     ipcompstat.ipcomps_badkcr);
  551                 error = EINVAL;
  552                 goto bad;
  553         }
  554 
  555         /* Fix IPv6 header */
  556         if (m->m_len < sizeof(struct ip6_hdr) &&
  557             (m = m_pullup(m, sizeof(struct ip6_hdr))) == NULL) {
  558 
  559                 DPRINTF(("%s: processing failed for SA %s/%08lx\n",
  560                     __func__, ipsec_address(&sav->sah->saidx.dst),
  561                     (u_long) ntohl(sav->spi)));
  562 
  563                 IPSEC_ISTAT(sproto, espstat.esps_hdrops, ahstat.ahs_hdrops,
  564                     ipcompstat.ipcomps_hdrops);
  565                 error = EACCES;
  566                 goto bad;
  567         }
  568 
  569         ip6 = mtod(m, struct ip6_hdr *);
  570         ip6->ip6_plen = htons(m->m_pkthdr.len - sizeof(struct ip6_hdr));
  571 
  572         /* Save protocol */
  573         m_copydata(m, protoff, 1, (unsigned char *) &prot);
  574 
  575 #ifdef INET
  576         /* IP-in-IP encapsulation */
  577         if (prot == IPPROTO_IPIP) {
  578                 struct ip ipn;
  579 
  580                 if (m->m_pkthdr.len - skip < sizeof(struct ip)) {
  581                         IPSEC_ISTAT(sproto, espstat.esps_hdrops,
  582                             ahstat.ahs_hdrops,
  583                             ipcompstat.ipcomps_hdrops);
  584                         error = EINVAL;
  585                         goto bad;
  586                 }
  587                 /* ipn will now contain the inner IPv4 header */
  588                 m_copydata(m, skip, sizeof(struct ip), (caddr_t) &ipn);
  589 
  590 #ifdef notyet
  591                 /*
  592                  * Check that the inner source address is the same as
  593                  * the proxy address, if available.
  594                  */
  595                 if ((saidx->proxy.sa.sa_family == AF_INET &&
  596                     saidx->proxy.sin.sin_addr.s_addr != INADDR_ANY &&
  597                     ipn.ip_src.s_addr != saidx->proxy.sin.sin_addr.s_addr) ||
  598                     (saidx->proxy.sa.sa_family != AF_INET &&
  599                         saidx->proxy.sa.sa_family != 0)) {
  600 
  601                         DPRINTF(("%s: inner source address %s doesn't "
  602                             "correspond to expected proxy source %s, "
  603                             "SA %s/%08lx\n", __func__,
  604                             inet_ntoa4(ipn.ip_src),
  605                             ipsec_address(&saidx->proxy),
  606                             ipsec_address(&saidx->dst),
  607                             (u_long) ntohl(sav->spi)));
  608 
  609                         IPSEC_ISTATsproto, (espstat.esps_pdrops,
  610                             ahstat.ahs_pdrops, ipcompstat.ipcomps_pdrops);
  611                         error = EACCES;
  612                         goto bad;
  613                 }
  614 #endif /*XXX*/
  615         }
  616 #endif /* INET */
  617 
  618         /* IPv6-in-IP encapsulation */
  619         if (prot == IPPROTO_IPV6) {
  620                 struct ip6_hdr ip6n;
  621 
  622                 if (m->m_pkthdr.len - skip < sizeof(struct ip6_hdr)) {
  623                         IPSEC_ISTAT(sproto, espstat.esps_hdrops,
  624                             ahstat.ahs_hdrops,
  625                             ipcompstat.ipcomps_hdrops);
  626                         error = EINVAL;
  627                         goto bad;
  628                 }
  629                 /* ip6n will now contain the inner IPv6 header. */
  630                 m_copydata(m, skip, sizeof(struct ip6_hdr),
  631                     (caddr_t) &ip6n);
  632 
  633 #ifdef notyet
  634                 /*
  635                  * Check that the inner source address is the same as
  636                  * the proxy address, if available.
  637                  */
  638                 if ((saidx->proxy.sa.sa_family == AF_INET6 &&
  639                     !IN6_IS_ADDR_UNSPECIFIED(&saidx->proxy.sin6.sin6_addr) &&
  640                     !IN6_ARE_ADDR_EQUAL(&ip6n.ip6_src,
  641                         &saidx->proxy.sin6.sin6_addr)) ||
  642                     (saidx->proxy.sa.sa_family != AF_INET6 &&
  643                         saidx->proxy.sa.sa_family != 0)) {
  644 
  645                         DPRINTF(("%s: inner source address %s doesn't "
  646                             "correspond to expected proxy source %s, "
  647                             "SA %s/%08lx\n", __func__,
  648                             ip6_sprintf(&ip6n.ip6_src),
  649                             ipsec_address(&saidx->proxy),
  650                             ipsec_address(&saidx->dst),
  651                             (u_long) ntohl(sav->spi)));
  652 
  653                         IPSEC_ISTAT(sproto, espstat.esps_pdrops,
  654                             ahstat.ahs_pdrops, ipcompstat.ipcomps_pdrops);
  655                         error = EACCES;
  656                         goto bad;
  657                 }
  658 #endif /*XXX*/
  659         }
  660 
  661         /*
  662          * Record what we've done to the packet (under what SA it was
  663          * processed). If we've been passed an mtag, it means the packet
  664          * was already processed by an ethernet/crypto combo card and
  665          * thus has a tag attached with all the right information, but
  666          * with a PACKET_TAG_IPSEC_IN_CRYPTO_DONE as opposed to
  667          * PACKET_TAG_IPSEC_IN_DONE type; in that case, just change the type.
  668          */
  669         if (mt == NULL && sproto != IPPROTO_IPCOMP) {
  670                 mtag = m_tag_get(PACKET_TAG_IPSEC_IN_DONE,
  671                     sizeof(struct tdb_ident), M_NOWAIT);
  672                 if (mtag == NULL) {
  673                         DPRINTF(("%s: failed to get tag\n", __func__));
  674                         IPSEC_ISTAT(sproto, espstat.esps_hdrops,
  675                             ahstat.ahs_hdrops, ipcompstat.ipcomps_hdrops);
  676                         error = ENOMEM;
  677                         goto bad;
  678                 }
  679 
  680                 tdbi = (struct tdb_ident *)(mtag + 1);
  681                 bcopy(&saidx->dst, &tdbi->dst, sizeof(union sockaddr_union));
  682                 tdbi->proto = sproto;
  683                 tdbi->spi = sav->spi;
  684 
  685                 m_tag_prepend(m, mtag);
  686         } else {
  687                 if (mt != NULL)
  688                         mt->m_tag_id = PACKET_TAG_IPSEC_IN_DONE;
  689                 /* XXX do we need to mark m_flags??? */
  690         }
  691 
  692         key_sa_recordxfer(sav, m);
  693 
  694         /* Retrieve new protocol */
  695         m_copydata(m, protoff, sizeof(u_int8_t), (caddr_t) &nxt8);
  696 
  697         /*
  698          * See the end of ip6_input for this logic.
  699          * IPPROTO_IPV[46] case will be processed just like other ones
  700          */
  701         nest = 0;
  702         nxt = nxt8;
  703         while (nxt != IPPROTO_DONE) {
  704                 if (ip6_hdrnestlimit && (++nest > ip6_hdrnestlimit)) {
  705                         ip6stat.ip6s_toomanyhdr++;
  706                         error = EINVAL;
  707                         goto bad;
  708                 }
  709 
  710                 /*
  711                  * Protection against faulty packet - there should be
  712                  * more sanity checks in header chain processing.
  713                  */
  714                 if (m->m_pkthdr.len < skip) {
  715                         ip6stat.ip6s_tooshort++;
  716                         in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_truncated);
  717                         error = EINVAL;
  718                         goto bad;
  719                 }
  720                 /*
  721                  * Enforce IPsec policy checking if we are seeing last header.
  722                  * note that we do not visit this with protocols with pcb layer
  723                  * code - like udp/tcp/raw ip.
  724                  */
  725                 if ((inet6sw[ip6_protox[nxt]].pr_flags & PR_LASTHDR) != 0 &&
  726                     ipsec6_in_reject(m, NULL)) {
  727                         error = EINVAL;
  728                         goto bad;
  729                 }
  730                 nxt = (*inet6sw[ip6_protox[nxt]].pr_input)(&m, &skip, nxt);
  731         }
  732         return 0;
  733 bad:
  734         if (m)
  735                 m_freem(m);
  736         return error;
  737 }
  738 
  739 void
  740 esp6_ctlinput(int cmd, struct sockaddr *sa, void *d)
  741 {
  742         if (sa->sa_family != AF_INET6 ||
  743             sa->sa_len != sizeof(struct sockaddr_in6))
  744                 return;
  745         if ((unsigned)cmd >= PRC_NCMDS)
  746                 return;
  747 
  748         /* if the parameter is from icmp6, decode it. */
  749         if (d !=  NULL) {
  750                 struct ip6ctlparam *ip6cp = (struct ip6ctlparam *)d;
  751                 struct mbuf *m = ip6cp->ip6c_m;
  752                 int off = ip6cp->ip6c_off;
  753 
  754                 struct ip6ctlparam ip6cp1;
  755 
  756                 /*
  757                  * Notify the error to all possible sockets via pfctlinput2.
  758                  * Since the upper layer information (such as protocol type,
  759                  * source and destination ports) is embedded in the encrypted
  760                  * data and might have been cut, we can't directly call
  761                  * an upper layer ctlinput function. However, the pcbnotify
  762                  * function will consider source and destination addresses
  763                  * as well as the flow info value, and may be able to find
  764                  * some PCB that should be notified.
  765                  * Although pfctlinput2 will call esp6_ctlinput(), there is
  766                  * no possibility of an infinite loop of function calls,
  767                  * because we don't pass the inner IPv6 header.
  768                  */
  769                 bzero(&ip6cp1, sizeof(ip6cp1));
  770                 ip6cp1.ip6c_src = ip6cp->ip6c_src;
  771                 pfctlinput2(cmd, sa, (void *)&ip6cp1);
  772 
  773                 /*
  774                  * Then go to special cases that need ESP header information.
  775                  * XXX: We assume that when ip6 is non NULL,
  776                  * M and OFF are valid.
  777                  */
  778 
  779                 if (cmd == PRC_MSGSIZE) {
  780                         struct secasvar *sav;
  781                         u_int32_t spi;
  782                         int valid;
  783 
  784                         /* check header length before using m_copydata */
  785                         if (m->m_pkthdr.len < off + sizeof (struct esp))
  786                                 return;
  787                         m_copydata(m, off + offsetof(struct esp, esp_spi),
  788                                 sizeof(u_int32_t), (caddr_t) &spi);
  789                         /*
  790                          * Check to see if we have a valid SA corresponding to
  791                          * the address in the ICMP message payload.
  792                          */
  793                         sav = KEY_ALLOCSA((union sockaddr_union *)sa,
  794                                         IPPROTO_ESP, spi);
  795                         valid = (sav != NULL);
  796                         if (sav)
  797                                 KEY_FREESAV(&sav);
  798 
  799                         /* XXX Further validation? */
  800 
  801                         /*
  802                          * Depending on whether the SA is "valid" and
  803                          * routing table size (mtudisc_{hi,lo}wat), we will:
  804                          * - recalcurate the new MTU and create the
  805                          *   corresponding routing entry, or
  806                          * - ignore the MTU change notification.
  807                          */
  808                         icmp6_mtudisc_update(ip6cp, valid);
  809                 }
  810         } else {
  811                 /* we normally notify any pcb here */
  812         }
  813 }
  814 #endif /* INET6 */
Cache object: dfc2238de905d0998c7f1794285ec34a
[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]
This page is part of the FreeBSD/Linux Linux Kernel Cross-Reference, and was automatically generated using a modified version of the LXR engine.
FreeBSD/Linux Kernel Cross Reference sys/netipsec/ipsec_input.c

FreeBSD/Linux Kernel Cross Reference
sys/netipsec/ipsec_input.c
