Now available: The Design and Implementation of the FreeBSD Operating System (Second Edition)
[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]
FreeBSD/Linux Kernel Cross Reference
sys/netipsec/ipsec_input.c
Version:
- FREEBSD - FREEBSD-13-STABLE - FREEBSD-13-0 - FREEBSD-12-STABLE - FREEBSD-12-0 - FREEBSD-11-STABLE - FREEBSD-11-0 - FREEBSD-10-STABLE - FREEBSD-10-0 - FREEBSD-9-STABLE - FREEBSD-9-0 - FREEBSD-8-STABLE - FREEBSD-8-0 - FREEBSD-7-STABLE - FREEBSD-7-0 - FREEBSD-6-STABLE - FREEBSD-6-0 - FREEBSD-5-STABLE - FREEBSD-5-0 - FREEBSD-4-STABLE - FREEBSD-3-STABLE - FREEBSD22 - l41 - OPENBSD - linux-2.6 - MK84 - PLAN9 - xnu-8792
SearchContext: - none - 3 - 10
SearchContext: - none - 3 - 10
1 /* $FreeBSD$ */ 2 /* $OpenBSD: ipsec_input.c,v 1.63 2003/02/20 18:35:43 deraadt Exp $ */ 3 /*- 4 * The authors of this code are John Ioannidis (ji@tla.org), 5 * Angelos D. Keromytis (kermit@csd.uch.gr) and 6 * Niels Provos (provos@physnet.uni-hamburg.de). 7 * 8 * This code was written by John Ioannidis for BSD/OS in Athens, Greece, 9 * in November 1995. 10 * 11 * Ported to OpenBSD and NetBSD, with additional transforms, in December 1996, 12 * by Angelos D. Keromytis. 13 * 14 * Additional transforms and features in 1997 and 1998 by Angelos D. Keromytis 15 * and Niels Provos. 16 * 17 * Additional features in 1999 by Angelos D. Keromytis. 18 * 19 * Copyright (C) 1995, 1996, 1997, 1998, 1999 by John Ioannidis, 20 * Angelos D. Keromytis and Niels Provos. 21 * Copyright (c) 2001, Angelos D. Keromytis. 22 * 23 * Permission to use, copy, and modify this software with or without fee 24 * is hereby granted, provided that this entire notice is included in 25 * all copies of any software which is or includes a copy or 26 * modification of this software. 27 * You may use this code under the GNU public license if you so wish. Please 28 * contribute changes back to the authors under this freer than GPL license 29 * so that we may further the use of strong encryption without limitations to 30 * all. 31 * 32 * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR 33 * IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY 34 * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE 35 * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR 36 * PURPOSE. 37 */ 38 39 /* 40 * IPsec input processing. 41 */ 42 43 #include "opt_inet.h" 44 #include "opt_inet6.h" 45 #include "opt_ipsec.h" 46 #include "opt_enc.h" 47 48 #include <sys/param.h> 49 #include <sys/systm.h> 50 #include <sys/malloc.h> 51 #include <sys/mbuf.h> 52 #include <sys/domain.h> 53 #include <sys/protosw.h> 54 #include <sys/socket.h> 55 #include <sys/errno.h> 56 #include <sys/syslog.h> 57 58 #include <net/if.h> 59 #include <net/pfil.h> 60 #include <net/route.h> 61 #include <net/netisr.h> 62 #include <net/vnet.h> 63 64 #include <netinet/in.h> 65 #include <netinet/in_systm.h> 66 #include <netinet/ip.h> 67 #include <netinet/ip_var.h> 68 #include <netinet/in_var.h> 69 70 #include <netinet/ip6.h> 71 #ifdef INET6 72 #include <netinet6/ip6_var.h> 73 #endif 74 #include <netinet/in_pcb.h> 75 #ifdef INET6 76 #include <netinet/icmp6.h> 77 #endif 78 79 #include <netipsec/ipsec.h> 80 #ifdef INET6 81 #include <netipsec/ipsec6.h> 82 #endif 83 #include <netipsec/ah_var.h> 84 #include <netipsec/esp.h> 85 #include <netipsec/esp_var.h> 86 #include <netipsec/ipcomp_var.h> 87 88 #include <netipsec/key.h> 89 #include <netipsec/keydb.h> 90 91 #include <netipsec/xform.h> 92 #include <netinet6/ip6protosw.h> 93 94 #include <machine/in_cksum.h> 95 #include <machine/stdarg.h> 96 97 #ifdef DEV_ENC 98 #include <net/if_enc.h> 99 #endif 100 101 102 #define IPSEC_ISTAT(p,x,y,z) ((p) == IPPROTO_ESP ? (x)++ : \ 103 (p) == IPPROTO_AH ? (y)++ : (z)++) 104 105 #ifdef INET 106 static void ipsec4_common_ctlinput(int, struct sockaddr *, void *, int); 107 #endif 108 109 /* 110 * ipsec_common_input gets called when an IPsec-protected packet 111 * is received by IPv4 or IPv6. It's job is to find the right SA 112 * and call the appropriate transform. The transform callback 113 * takes care of further processing (like ingress filtering). 114 */ 115 static int 116 ipsec_common_input(struct mbuf *m, int skip, int protoff, int af, int sproto) 117 { 118 union sockaddr_union dst_address; 119 struct secasvar *sav; 120 u_int32_t spi; 121 int error; 122 #ifdef IPSEC_NAT_T 123 struct m_tag *tag; 124 #endif 125 126 IPSEC_ISTAT(sproto, V_espstat.esps_input, V_ahstat.ahs_input, 127 V_ipcompstat.ipcomps_input); 128 129 IPSEC_ASSERT(m != NULL, ("null packet")); 130 131 IPSEC_ASSERT(sproto == IPPROTO_ESP || sproto == IPPROTO_AH || 132 sproto == IPPROTO_IPCOMP, 133 ("unexpected security protocol %u", sproto)); 134 135 if ((sproto == IPPROTO_ESP && !V_esp_enable) || 136 (sproto == IPPROTO_AH && !V_ah_enable) || 137 (sproto == IPPROTO_IPCOMP && !V_ipcomp_enable)) { 138 m_freem(m); 139 IPSEC_ISTAT(sproto, V_espstat.esps_pdrops, V_ahstat.ahs_pdrops, 140 V_ipcompstat.ipcomps_pdrops); 141 return EOPNOTSUPP; 142 } 143 144 if (m->m_pkthdr.len - skip < 2 * sizeof (u_int32_t)) { 145 m_freem(m); 146 IPSEC_ISTAT(sproto, V_espstat.esps_hdrops, V_ahstat.ahs_hdrops, 147 V_ipcompstat.ipcomps_hdrops); 148 DPRINTF(("%s: packet too small\n", __func__)); 149 return EINVAL; 150 } 151 152 /* Retrieve the SPI from the relevant IPsec header */ 153 if (sproto == IPPROTO_ESP) 154 m_copydata(m, skip, sizeof(u_int32_t), (caddr_t) &spi); 155 else if (sproto == IPPROTO_AH) 156 m_copydata(m, skip + sizeof(u_int32_t), sizeof(u_int32_t), 157 (caddr_t) &spi); 158 else if (sproto == IPPROTO_IPCOMP) { 159 u_int16_t cpi; 160 m_copydata(m, skip + sizeof(u_int16_t), sizeof(u_int16_t), 161 (caddr_t) &cpi); 162 spi = ntohl(htons(cpi)); 163 } 164 165 /* 166 * Find the SA and (indirectly) call the appropriate 167 * kernel crypto routine. The resulting mbuf chain is a valid 168 * IP packet ready to go through input processing. 169 */ 170 bzero(&dst_address, sizeof (dst_address)); 171 dst_address.sa.sa_family = af; 172 switch (af) { 173 #ifdef INET 174 case AF_INET: 175 dst_address.sin.sin_len = sizeof(struct sockaddr_in); 176 m_copydata(m, offsetof(struct ip, ip_dst), 177 sizeof(struct in_addr), 178 (caddr_t) &dst_address.sin.sin_addr); 179 #ifdef IPSEC_NAT_T 180 /* Find the source port for NAT-T; see udp*_espdecap. */ 181 tag = m_tag_find(m, PACKET_TAG_IPSEC_NAT_T_PORTS, NULL); 182 if (tag != NULL) 183 dst_address.sin.sin_port = ((u_int16_t *)(tag + 1))[1]; 184 #endif /* IPSEC_NAT_T */ 185 break; 186 #endif /* INET */ 187 #ifdef INET6 188 case AF_INET6: 189 dst_address.sin6.sin6_len = sizeof(struct sockaddr_in6); 190 m_copydata(m, offsetof(struct ip6_hdr, ip6_dst), 191 sizeof(struct in6_addr), 192 (caddr_t) &dst_address.sin6.sin6_addr); 193 break; 194 #endif /* INET6 */ 195 default: 196 DPRINTF(("%s: unsupported protocol family %u\n", __func__, af)); 197 m_freem(m); 198 IPSEC_ISTAT(sproto, V_espstat.esps_nopf, V_ahstat.ahs_nopf, 199 V_ipcompstat.ipcomps_nopf); 200 return EPFNOSUPPORT; 201 } 202 203 /* NB: only pass dst since key_allocsa follows RFC2401 */ 204 sav = KEY_ALLOCSA(&dst_address, sproto, spi); 205 if (sav == NULL) { 206 DPRINTF(("%s: no key association found for SA %s/%08lx/%u\n", 207 __func__, ipsec_address(&dst_address), 208 (u_long) ntohl(spi), sproto)); 209 IPSEC_ISTAT(sproto, V_espstat.esps_notdb, V_ahstat.ahs_notdb, 210 V_ipcompstat.ipcomps_notdb); 211 m_freem(m); 212 return ENOENT; 213 } 214 215 if (sav->tdb_xform == NULL) { 216 DPRINTF(("%s: attempted to use uninitialized SA %s/%08lx/%u\n", 217 __func__, ipsec_address(&dst_address), 218 (u_long) ntohl(spi), sproto)); 219 IPSEC_ISTAT(sproto, V_espstat.esps_noxform, V_ahstat.ahs_noxform, 220 V_ipcompstat.ipcomps_noxform); 221 KEY_FREESAV(&sav); 222 m_freem(m); 223 return ENXIO; 224 } 225 226 /* 227 * Call appropriate transform and return -- callback takes care of 228 * everything else. 229 */ 230 error = (*sav->tdb_xform->xf_input)(m, sav, skip, protoff); 231 KEY_FREESAV(&sav); 232 return error; 233 } 234 235 #ifdef INET 236 /* 237 * Common input handler for IPv4 AH, ESP, and IPCOMP. 238 */ 239 int 240 ipsec4_common_input(struct mbuf *m, ...) 241 { 242 va_list ap; 243 int off, nxt; 244 245 va_start(ap, m); 246 off = va_arg(ap, int); 247 nxt = va_arg(ap, int); 248 va_end(ap); 249 250 return ipsec_common_input(m, off, offsetof(struct ip, ip_p), 251 AF_INET, nxt); 252 } 253 254 void 255 ah4_input(struct mbuf *m, int off) 256 { 257 ipsec4_common_input(m, off, IPPROTO_AH); 258 } 259 void 260 ah4_ctlinput(int cmd, struct sockaddr *sa, void *v) 261 { 262 if (sa->sa_family == AF_INET && 263 sa->sa_len == sizeof(struct sockaddr_in)) 264 ipsec4_common_ctlinput(cmd, sa, v, IPPROTO_AH); 265 } 266 267 void 268 esp4_input(struct mbuf *m, int off) 269 { 270 ipsec4_common_input(m, off, IPPROTO_ESP); 271 } 272 void 273 esp4_ctlinput(int cmd, struct sockaddr *sa, void *v) 274 { 275 if (sa->sa_family == AF_INET && 276 sa->sa_len == sizeof(struct sockaddr_in)) 277 ipsec4_common_ctlinput(cmd, sa, v, IPPROTO_ESP); 278 } 279 280 void 281 ipcomp4_input(struct mbuf *m, int off) 282 { 283 ipsec4_common_input(m, off, IPPROTO_IPCOMP); 284 } 285 286 /* 287 * IPsec input callback for INET protocols. 288 * This routine is called as the transform callback. 289 * Takes care of filtering and other sanity checks on 290 * the processed packet. 291 */ 292 int 293 ipsec4_common_input_cb(struct mbuf *m, struct secasvar *sav, 294 int skip, int protoff, struct m_tag *mt) 295 { 296 int prot, af, sproto; 297 struct ip *ip; 298 struct m_tag *mtag; 299 struct tdb_ident *tdbi; 300 struct secasindex *saidx; 301 int error; 302 #ifdef INET6 303 #ifdef notyet 304 char ip6buf[INET6_ADDRSTRLEN]; 305 #endif 306 #endif 307 308 IPSEC_ASSERT(m != NULL, ("null mbuf")); 309 IPSEC_ASSERT(sav != NULL, ("null SA")); 310 IPSEC_ASSERT(sav->sah != NULL, ("null SAH")); 311 saidx = &sav->sah->saidx; 312 af = saidx->dst.sa.sa_family; 313 IPSEC_ASSERT(af == AF_INET, ("unexpected af %u", af)); 314 sproto = saidx->proto; 315 IPSEC_ASSERT(sproto == IPPROTO_ESP || sproto == IPPROTO_AH || 316 sproto == IPPROTO_IPCOMP, 317 ("unexpected security protocol %u", sproto)); 318 319 /* Sanity check */ 320 if (m == NULL) { 321 DPRINTF(("%s: null mbuf", __func__)); 322 IPSEC_ISTAT(sproto, V_espstat.esps_badkcr, V_ahstat.ahs_badkcr, 323 V_ipcompstat.ipcomps_badkcr); 324 KEY_FREESAV(&sav); 325 return EINVAL; 326 } 327 328 if (skip != 0) { 329 /* Fix IPv4 header */ 330 if (m->m_len < skip && (m = m_pullup(m, skip)) == NULL) { 331 DPRINTF(("%s: processing failed for SA %s/%08lx\n", 332 __func__, ipsec_address(&sav->sah->saidx.dst), 333 (u_long) ntohl(sav->spi))); 334 IPSEC_ISTAT(sproto, V_espstat.esps_hdrops, V_ahstat.ahs_hdrops, 335 V_ipcompstat.ipcomps_hdrops); 336 error = ENOBUFS; 337 goto bad; 338 } 339 340 ip = mtod(m, struct ip *); 341 ip->ip_len = htons(m->m_pkthdr.len); 342 ip->ip_off = htons(ip->ip_off); 343 ip->ip_sum = 0; 344 ip->ip_sum = in_cksum(m, ip->ip_hl << 2); 345 } else { 346 ip = mtod(m, struct ip *); 347 } 348 prot = ip->ip_p; 349 350 #ifdef notyet 351 /* IP-in-IP encapsulation */ 352 if (prot == IPPROTO_IPIP) { 353 struct ip ipn; 354 355 if (m->m_pkthdr.len - skip < sizeof(struct ip)) { 356 IPSEC_ISTAT(sproto, V_espstat.esps_hdrops, 357 V_ahstat.ahs_hdrops, 358 V_ipcompstat.ipcomps_hdrops); 359 error = EINVAL; 360 goto bad; 361 } 362 /* ipn will now contain the inner IPv4 header */ 363 m_copydata(m, ip->ip_hl << 2, sizeof(struct ip), 364 (caddr_t) &ipn); 365 366 /* XXX PROXY address isn't recorded in SAH */ 367 /* 368 * Check that the inner source address is the same as 369 * the proxy address, if available. 370 */ 371 if ((saidx->proxy.sa.sa_family == AF_INET && 372 saidx->proxy.sin.sin_addr.s_addr != 373 INADDR_ANY && 374 ipn.ip_src.s_addr != 375 saidx->proxy.sin.sin_addr.s_addr) || 376 (saidx->proxy.sa.sa_family != AF_INET && 377 saidx->proxy.sa.sa_family != 0)) { 378 379 DPRINTF(("%s: inner source address %s doesn't " 380 "correspond to expected proxy source %s, " 381 "SA %s/%08lx\n", __func__, 382 inet_ntoa4(ipn.ip_src), 383 ipsp_address(saidx->proxy), 384 ipsp_address(saidx->dst), 385 (u_long) ntohl(sav->spi))); 386 387 IPSEC_ISTAT(sproto, V_espstat.esps_pdrops, 388 V_ahstat.ahs_pdrops, 389 V_ipcompstat.ipcomps_pdrops); 390 error = EACCES; 391 goto bad; 392 } 393 } 394 #ifdef INET6 395 /* IPv6-in-IP encapsulation. */ 396 if (prot == IPPROTO_IPV6) { 397 struct ip6_hdr ip6n; 398 399 if (m->m_pkthdr.len - skip < sizeof(struct ip6_hdr)) { 400 IPSEC_ISTAT(sproto, V_espstat.esps_hdrops, 401 V_ahstat.ahs_hdrops, 402 V_ipcompstat.ipcomps_hdrops); 403 error = EINVAL; 404 goto bad; 405 } 406 /* ip6n will now contain the inner IPv6 header. */ 407 m_copydata(m, ip->ip_hl << 2, sizeof(struct ip6_hdr), 408 (caddr_t) &ip6n); 409 410 /* 411 * Check that the inner source address is the same as 412 * the proxy address, if available. 413 */ 414 if ((saidx->proxy.sa.sa_family == AF_INET6 && 415 !IN6_IS_ADDR_UNSPECIFIED(&saidx->proxy.sin6.sin6_addr) && 416 !IN6_ARE_ADDR_EQUAL(&ip6n.ip6_src, 417 &saidx->proxy.sin6.sin6_addr)) || 418 (saidx->proxy.sa.sa_family != AF_INET6 && 419 saidx->proxy.sa.sa_family != 0)) { 420 421 DPRINTF(("%s: inner source address %s doesn't " 422 "correspond to expected proxy source %s, " 423 "SA %s/%08lx\n", __func__, 424 ip6_sprintf(ip6buf, &ip6n.ip6_src), 425 ipsec_address(&saidx->proxy), 426 ipsec_address(&saidx->dst), 427 (u_long) ntohl(sav->spi))); 428 429 IPSEC_ISTAT(sproto, V_espstat.esps_pdrops, 430 V_ahstat.ahs_pdrops, 431 V_ipcompstat.ipcomps_pdrops); 432 error = EACCES; 433 goto bad; 434 } 435 } 436 #endif /* INET6 */ 437 #endif /*XXX*/ 438 439 /* 440 * Record what we've done to the packet (under what SA it was 441 * processed). If we've been passed an mtag, it means the packet 442 * was already processed by an ethernet/crypto combo card and 443 * thus has a tag attached with all the right information, but 444 * with a PACKET_TAG_IPSEC_IN_CRYPTO_DONE as opposed to 445 * PACKET_TAG_IPSEC_IN_DONE type; in that case, just change the type. 446 */ 447 if (mt == NULL && sproto != IPPROTO_IPCOMP) { 448 mtag = m_tag_get(PACKET_TAG_IPSEC_IN_DONE, 449 sizeof(struct tdb_ident), M_NOWAIT); 450 if (mtag == NULL) { 451 DPRINTF(("%s: failed to get tag\n", __func__)); 452 IPSEC_ISTAT(sproto, V_espstat.esps_hdrops, 453 V_ahstat.ahs_hdrops, V_ipcompstat.ipcomps_hdrops); 454 error = ENOMEM; 455 goto bad; 456 } 457 458 tdbi = (struct tdb_ident *)(mtag + 1); 459 bcopy(&saidx->dst, &tdbi->dst, saidx->dst.sa.sa_len); 460 tdbi->proto = sproto; 461 tdbi->spi = sav->spi; 462 /* Cache those two for enc(4) in xform_ipip. */ 463 tdbi->alg_auth = sav->alg_auth; 464 tdbi->alg_enc = sav->alg_enc; 465 466 m_tag_prepend(m, mtag); 467 } else if (mt != NULL) { 468 mt->m_tag_id = PACKET_TAG_IPSEC_IN_DONE; 469 /* XXX do we need to mark m_flags??? */ 470 } 471 472 key_sa_recordxfer(sav, m); /* record data transfer */ 473 474 #ifdef DEV_ENC 475 encif->if_ipackets++; 476 encif->if_ibytes += m->m_pkthdr.len; 477 478 /* 479 * Pass the mbuf to enc0 for bpf and pfil. We will filter the IPIP 480 * packet later after it has been decapsulated. 481 */ 482 ipsec_bpf(m, sav, AF_INET, ENC_IN|ENC_BEFORE); 483 484 if (prot != IPPROTO_IPIP) 485 if ((error = ipsec_filter(&m, PFIL_IN, ENC_IN|ENC_BEFORE)) != 0) 486 return (error); 487 #endif 488 489 /* 490 * Re-dispatch via software interrupt. 491 */ 492 if ((error = netisr_queue_src(NETISR_IP, (uintptr_t)sav->spi, m))) { 493 IPSEC_ISTAT(sproto, V_espstat.esps_qfull, V_ahstat.ahs_qfull, 494 V_ipcompstat.ipcomps_qfull); 495 496 DPRINTF(("%s: queue full; proto %u packet dropped\n", 497 __func__, sproto)); 498 return error; 499 } 500 return 0; 501 bad: 502 m_freem(m); 503 return error; 504 } 505 506 void 507 ipsec4_common_ctlinput(int cmd, struct sockaddr *sa, void *v, int proto) 508 { 509 /* XXX nothing just yet */ 510 } 511 #endif /* INET */ 512 513 #ifdef INET6 514 /* IPv6 AH wrapper. */ 515 int 516 ipsec6_common_input(struct mbuf **mp, int *offp, int proto) 517 { 518 int l = 0; 519 int protoff; 520 struct ip6_ext ip6e; 521 522 if (*offp < sizeof(struct ip6_hdr)) { 523 DPRINTF(("%s: bad offset %u\n", __func__, *offp)); 524 return IPPROTO_DONE; 525 } else if (*offp == sizeof(struct ip6_hdr)) { 526 protoff = offsetof(struct ip6_hdr, ip6_nxt); 527 } else { 528 /* Chase down the header chain... */ 529 protoff = sizeof(struct ip6_hdr); 530 531 do { 532 protoff += l; 533 m_copydata(*mp, protoff, sizeof(ip6e), 534 (caddr_t) &ip6e); 535 536 if (ip6e.ip6e_nxt == IPPROTO_AH) 537 l = (ip6e.ip6e_len + 2) << 2; 538 else 539 l = (ip6e.ip6e_len + 1) << 3; 540 IPSEC_ASSERT(l > 0, ("l went zero or negative")); 541 } while (protoff + l < *offp); 542 543 /* Malformed packet check */ 544 if (protoff + l != *offp) { 545 DPRINTF(("%s: bad packet header chain, protoff %u, " 546 "l %u, off %u\n", __func__, protoff, l, *offp)); 547 IPSEC_ISTAT(proto, V_espstat.esps_hdrops, 548 V_ahstat.ahs_hdrops, 549 V_ipcompstat.ipcomps_hdrops); 550 m_freem(*mp); 551 *mp = NULL; 552 return IPPROTO_DONE; 553 } 554 protoff += offsetof(struct ip6_ext, ip6e_nxt); 555 } 556 (void) ipsec_common_input(*mp, *offp, protoff, AF_INET6, proto); 557 return IPPROTO_DONE; 558 } 559 560 /* 561 * IPsec input callback, called by the transform callback. Takes care of 562 * filtering and other sanity checks on the processed packet. 563 */ 564 int 565 ipsec6_common_input_cb(struct mbuf *m, struct secasvar *sav, int skip, int protoff, 566 struct m_tag *mt) 567 { 568 int prot, af, sproto; 569 struct ip6_hdr *ip6; 570 struct m_tag *mtag; 571 struct tdb_ident *tdbi; 572 struct secasindex *saidx; 573 int nxt; 574 u_int8_t nxt8; 575 int error, nest; 576 #ifdef notyet 577 char ip6buf[INET6_ADDRSTRLEN]; 578 #endif 579 580 IPSEC_ASSERT(m != NULL, ("null mbuf")); 581 IPSEC_ASSERT(sav != NULL, ("null SA")); 582 IPSEC_ASSERT(sav->sah != NULL, ("null SAH")); 583 saidx = &sav->sah->saidx; 584 af = saidx->dst.sa.sa_family; 585 IPSEC_ASSERT(af == AF_INET6, ("unexpected af %u", af)); 586 sproto = saidx->proto; 587 IPSEC_ASSERT(sproto == IPPROTO_ESP || sproto == IPPROTO_AH || 588 sproto == IPPROTO_IPCOMP, 589 ("unexpected security protocol %u", sproto)); 590 591 /* Sanity check */ 592 if (m == NULL) { 593 DPRINTF(("%s: null mbuf", __func__)); 594 IPSEC_ISTAT(sproto, V_espstat.esps_badkcr, V_ahstat.ahs_badkcr, 595 V_ipcompstat.ipcomps_badkcr); 596 error = EINVAL; 597 goto bad; 598 } 599 600 /* Fix IPv6 header */ 601 if (m->m_len < sizeof(struct ip6_hdr) && 602 (m = m_pullup(m, sizeof(struct ip6_hdr))) == NULL) { 603 604 DPRINTF(("%s: processing failed for SA %s/%08lx\n", 605 __func__, ipsec_address(&sav->sah->saidx.dst), 606 (u_long) ntohl(sav->spi))); 607 608 IPSEC_ISTAT(sproto, V_espstat.esps_hdrops, V_ahstat.ahs_hdrops, 609 V_ipcompstat.ipcomps_hdrops); 610 error = EACCES; 611 goto bad; 612 } 613 614 ip6 = mtod(m, struct ip6_hdr *); 615 ip6->ip6_plen = htons(m->m_pkthdr.len - sizeof(struct ip6_hdr)); 616 617 /* Save protocol */ 618 prot = 0; 619 m_copydata(m, protoff, 1, (unsigned char *) &prot); 620 621 #ifdef notyet 622 #ifdef INET 623 /* IP-in-IP encapsulation */ 624 if (prot == IPPROTO_IPIP) { 625 struct ip ipn; 626 627 if (m->m_pkthdr.len - skip < sizeof(struct ip)) { 628 IPSEC_ISTAT(sproto, V_espstat.esps_hdrops, 629 V_ahstat.ahs_hdrops, 630 V_ipcompstat.ipcomps_hdrops); 631 error = EINVAL; 632 goto bad; 633 } 634 /* ipn will now contain the inner IPv4 header */ 635 m_copydata(m, skip, sizeof(struct ip), (caddr_t) &ipn); 636 637 /* 638 * Check that the inner source address is the same as 639 * the proxy address, if available. 640 */ 641 if ((saidx->proxy.sa.sa_family == AF_INET && 642 saidx->proxy.sin.sin_addr.s_addr != INADDR_ANY && 643 ipn.ip_src.s_addr != saidx->proxy.sin.sin_addr.s_addr) || 644 (saidx->proxy.sa.sa_family != AF_INET && 645 saidx->proxy.sa.sa_family != 0)) { 646 647 DPRINTF(("%s: inner source address %s doesn't " 648 "correspond to expected proxy source %s, " 649 "SA %s/%08lx\n", __func__, 650 inet_ntoa4(ipn.ip_src), 651 ipsec_address(&saidx->proxy), 652 ipsec_address(&saidx->dst), 653 (u_long) ntohl(sav->spi))); 654 655 IPSEC_ISTATsproto, (V_espstat.esps_pdrops, 656 V_ahstat.ahs_pdrops, V_ipcompstat.ipcomps_pdrops); 657 error = EACCES; 658 goto bad; 659 } 660 } 661 #endif /* INET */ 662 663 /* IPv6-in-IP encapsulation */ 664 if (prot == IPPROTO_IPV6) { 665 struct ip6_hdr ip6n; 666 667 if (m->m_pkthdr.len - skip < sizeof(struct ip6_hdr)) { 668 IPSEC_ISTAT(sproto, V_espstat.esps_hdrops, 669 V_ahstat.ahs_hdrops, 670 V_ipcompstat.ipcomps_hdrops); 671 error = EINVAL; 672 goto bad; 673 } 674 /* ip6n will now contain the inner IPv6 header. */ 675 m_copydata(m, skip, sizeof(struct ip6_hdr), 676 (caddr_t) &ip6n); 677 678 /* 679 * Check that the inner source address is the same as 680 * the proxy address, if available. 681 */ 682 if ((saidx->proxy.sa.sa_family == AF_INET6 && 683 !IN6_IS_ADDR_UNSPECIFIED(&saidx->proxy.sin6.sin6_addr) && 684 !IN6_ARE_ADDR_EQUAL(&ip6n.ip6_src, 685 &saidx->proxy.sin6.sin6_addr)) || 686 (saidx->proxy.sa.sa_family != AF_INET6 && 687 saidx->proxy.sa.sa_family != 0)) { 688 689 DPRINTF(("%s: inner source address %s doesn't " 690 "correspond to expected proxy source %s, " 691 "SA %s/%08lx\n", __func__, 692 ip6_sprintf(ip6buf, &ip6n.ip6_src), 693 ipsec_address(&saidx->proxy), 694 ipsec_address(&saidx->dst), 695 (u_long) ntohl(sav->spi))); 696 697 IPSEC_ISTAT(sproto, V_espstat.esps_pdrops, 698 V_ahstat.ahs_pdrops, V_ipcompstat.ipcomps_pdrops); 699 error = EACCES; 700 goto bad; 701 } 702 } 703 #endif /*XXX*/ 704 705 /* 706 * Record what we've done to the packet (under what SA it was 707 * processed). If we've been passed an mtag, it means the packet 708 * was already processed by an ethernet/crypto combo card and 709 * thus has a tag attached with all the right information, but 710 * with a PACKET_TAG_IPSEC_IN_CRYPTO_DONE as opposed to 711 * PACKET_TAG_IPSEC_IN_DONE type; in that case, just change the type. 712 */ 713 if (mt == NULL && sproto != IPPROTO_IPCOMP) { 714 mtag = m_tag_get(PACKET_TAG_IPSEC_IN_DONE, 715 sizeof(struct tdb_ident), M_NOWAIT); 716 if (mtag == NULL) { 717 DPRINTF(("%s: failed to get tag\n", __func__)); 718 IPSEC_ISTAT(sproto, V_espstat.esps_hdrops, 719 V_ahstat.ahs_hdrops, V_ipcompstat.ipcomps_hdrops); 720 error = ENOMEM; 721 goto bad; 722 } 723 724 tdbi = (struct tdb_ident *)(mtag + 1); 725 bcopy(&saidx->dst, &tdbi->dst, sizeof(union sockaddr_union)); 726 tdbi->proto = sproto; 727 tdbi->spi = sav->spi; 728 /* Cache those two for enc(4) in xform_ipip. */ 729 tdbi->alg_auth = sav->alg_auth; 730 tdbi->alg_enc = sav->alg_enc; 731 732 m_tag_prepend(m, mtag); 733 } else { 734 if (mt != NULL) 735 mt->m_tag_id = PACKET_TAG_IPSEC_IN_DONE; 736 /* XXX do we need to mark m_flags??? */ 737 } 738 739 key_sa_recordxfer(sav, m); 740 741 #ifdef DEV_ENC 742 encif->if_ipackets++; 743 encif->if_ibytes += m->m_pkthdr.len; 744 745 /* 746 * Pass the mbuf to enc0 for bpf and pfil. We will filter the IPIP 747 * packet later after it has been decapsulated. 748 */ 749 ipsec_bpf(m, sav, AF_INET6, ENC_IN|ENC_BEFORE); 750 751 /* XXX-BZ does not make sense. */ 752 if (prot != IPPROTO_IPIP) 753 if ((error = ipsec_filter(&m, PFIL_IN, ENC_IN|ENC_BEFORE)) != 0) 754 return (error); 755 #endif 756 757 /* Retrieve new protocol */ 758 m_copydata(m, protoff, sizeof(u_int8_t), (caddr_t) &nxt8); 759 760 /* 761 * See the end of ip6_input for this logic. 762 * IPPROTO_IPV[46] case will be processed just like other ones 763 */ 764 nest = 0; 765 nxt = nxt8; 766 while (nxt != IPPROTO_DONE) { 767 if (V_ip6_hdrnestlimit && (++nest > V_ip6_hdrnestlimit)) { 768 V_ip6stat.ip6s_toomanyhdr++; 769 error = EINVAL; 770 goto bad; 771 } 772 773 /* 774 * Protection against faulty packet - there should be 775 * more sanity checks in header chain processing. 776 */ 777 if (m->m_pkthdr.len < skip) { 778 V_ip6stat.ip6s_tooshort++; 779 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_truncated); 780 error = EINVAL; 781 goto bad; 782 } 783 /* 784 * Enforce IPsec policy checking if we are seeing last header. 785 * note that we do not visit this with protocols with pcb layer 786 * code - like udp/tcp/raw ip. 787 */ 788 if ((inet6sw[ip6_protox[nxt]].pr_flags & PR_LASTHDR) != 0 && 789 ipsec6_in_reject(m, NULL)) { 790 error = EINVAL; 791 goto bad; 792 } 793 nxt = (*inet6sw[ip6_protox[nxt]].pr_input)(&m, &skip, nxt); 794 } 795 return 0; 796 bad: 797 if (m) 798 m_freem(m); 799 return error; 800 } 801 802 void 803 esp6_ctlinput(int cmd, struct sockaddr *sa, void *d) 804 { 805 struct ip6ctlparam *ip6cp = NULL; 806 struct mbuf *m = NULL; 807 struct ip6_hdr *ip6; 808 int off; 809 810 if (sa->sa_family != AF_INET6 || 811 sa->sa_len != sizeof(struct sockaddr_in6)) 812 return; 813 if ((unsigned)cmd >= PRC_NCMDS) 814 return; 815 816 /* if the parameter is from icmp6, decode it. */ 817 if (d != NULL) { 818 ip6cp = (struct ip6ctlparam *)d; 819 m = ip6cp->ip6c_m; 820 ip6 = ip6cp->ip6c_ip6; 821 off = ip6cp->ip6c_off; 822 } else { 823 m = NULL; 824 ip6 = NULL; 825 off = 0; /* calm gcc */ 826 } 827 828 if (ip6 != NULL) { 829 830 struct ip6ctlparam ip6cp1; 831 832 /* 833 * Notify the error to all possible sockets via pfctlinput2. 834 * Since the upper layer information (such as protocol type, 835 * source and destination ports) is embedded in the encrypted 836 * data and might have been cut, we can't directly call 837 * an upper layer ctlinput function. However, the pcbnotify 838 * function will consider source and destination addresses 839 * as well as the flow info value, and may be able to find 840 * some PCB that should be notified. 841 * Although pfctlinput2 will call esp6_ctlinput(), there is 842 * no possibility of an infinite loop of function calls, 843 * because we don't pass the inner IPv6 header. 844 */ 845 bzero(&ip6cp1, sizeof(ip6cp1)); 846 ip6cp1.ip6c_src = ip6cp->ip6c_src; 847 pfctlinput2(cmd, sa, (void *)&ip6cp1); 848 849 /* 850 * Then go to special cases that need ESP header information. 851 * XXX: We assume that when ip6 is non NULL, 852 * M and OFF are valid. 853 */ 854 855 if (cmd == PRC_MSGSIZE) { 856 struct secasvar *sav; 857 u_int32_t spi; 858 int valid; 859 860 /* check header length before using m_copydata */ 861 if (m->m_pkthdr.len < off + sizeof (struct esp)) 862 return; 863 m_copydata(m, off + offsetof(struct esp, esp_spi), 864 sizeof(u_int32_t), (caddr_t) &spi); 865 /* 866 * Check to see if we have a valid SA corresponding to 867 * the address in the ICMP message payload. 868 */ 869 sav = KEY_ALLOCSA((union sockaddr_union *)sa, 870 IPPROTO_ESP, spi); 871 valid = (sav != NULL); 872 if (sav) 873 KEY_FREESAV(&sav); 874 875 /* XXX Further validation? */ 876 877 /* 878 * Depending on whether the SA is "valid" and 879 * routing table size (mtudisc_{hi,lo}wat), we will: 880 * - recalcurate the new MTU and create the 881 * corresponding routing entry, or 882 * - ignore the MTU change notification. 883 */ 884 icmp6_mtudisc_update(ip6cp, valid); 885 } 886 } else { 887 /* we normally notify any pcb here */ 888 } 889 } 890 #endif /* INET6 */
Cache object: a999cf1ee38da1f49a03ac556ca69101
[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]