1 /* $NetBSD: ipsec_input.c,v 1.13.2.1 2007/05/24 19:13:12 pavel Exp $ */
2 /* $FreeBSD: /usr/local/www/cvsroot/FreeBSD/src/sys/netipsec/ipsec_input.c,v 1.2.4.2 2003/03/28 20:32:53 sam Exp $ */
3 /* $OpenBSD: ipsec_input.c,v 1.63 2003/02/20 18:35:43 deraadt Exp $ */
4
5 /*
6 * The authors of this code are John Ioannidis (ji@tla.org),
7 * Angelos D. Keromytis (kermit@csd.uch.gr) and
8 * Niels Provos (provos@physnet.uni-hamburg.de).
9 *
10 * This code was written by John Ioannidis for BSD/OS in Athens, Greece,
11 * in November 1995.
12 *
13 * Ported to OpenBSD and NetBSD, with additional transforms, in December 1996,
14 * by Angelos D. Keromytis.
15 *
16 * Additional transforms and features in 1997 and 1998 by Angelos D. Keromytis
17 * and Niels Provos.
18 *
19 * Additional features in 1999 by Angelos D. Keromytis.
20 *
21 * Copyright (C) 1995, 1996, 1997, 1998, 1999 by John Ioannidis,
22 * Angelos D. Keromytis and Niels Provos.
23 * Copyright (c) 2001, Angelos D. Keromytis.
24 *
25 * Permission to use, copy, and modify this software with or without fee
26 * is hereby granted, provided that this entire notice is included in
27 * all copies of any software which is or includes a copy or
28 * modification of this software.
29 * You may use this code under the GNU public license if you so wish. Please
30 * contribute changes back to the authors under this freer than GPL license
31 * so that we may further the use of strong encryption without limitations to
32 * all.
33 *
34 * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR
35 * IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY
36 * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE
37 * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR
38 * PURPOSE.
39 */
40
41 #include <sys/cdefs.h>
42 __KERNEL_RCSID(0, "$NetBSD: ipsec_input.c,v 1.13.2.1 2007/05/24 19:13:12 pavel Exp $");
43
44 /*
45 * IPsec input processing.
46 */
47
48 #include "opt_inet.h"
49 #ifdef __FreeBSD__
50 #include "opt_inet6.h"
51 #endif
52 #include "opt_ipsec.h"
53
54 #include <sys/param.h>
55 #include <sys/systm.h>
56 #include <sys/malloc.h>
57 #include <sys/mbuf.h>
58 #include <sys/domain.h>
59 #include <sys/protosw.h>
60 #include <sys/socket.h>
61 #include <sys/errno.h>
62 #include <sys/syslog.h>
63
64 #include <net/if.h>
65 #include <net/route.h>
66 #include <net/netisr.h>
67
68 #include <netinet/in.h>
69 #include <netinet/in_systm.h>
70 #include <netinet/ip.h>
71 #include <netinet/ip_var.h>
72 #include <netinet/in_var.h>
73
74 #include <netinet/ip6.h>
75 #ifdef INET6
76 #include <netinet6/ip6_var.h>
77 #endif
78 #include <netinet/in_pcb.h>
79 #ifdef INET6
80 #include <netinet/icmp6.h>
81 #endif
82
83 #include <netipsec/ipsec.h>
84 #ifdef INET6
85 #include <netipsec/ipsec6.h>
86 #endif
87 #include <netipsec/ah_var.h>
88 #include <netipsec/esp.h>
89 #include <netipsec/esp_var.h>
90 #include <netipsec/ipcomp_var.h>
91
92 #include <netipsec/key.h>
93 #include <netipsec/keydb.h>
94
95 #include <netipsec/xform.h>
96 #include <netinet6/ip6protosw.h>
97
98 #include <netipsec/ipsec_osdep.h>
99
100 #include <machine/stdarg.h>
101
102 #include <net/net_osdep.h>
103
104 #define IPSEC_ISTAT(p,x,y,z) ((p) == IPPROTO_ESP ? (x)++ : \
105 (p) == IPPROTO_AH ? (y)++ : (z)++)
106
107 /*
108 * ipsec_common_input gets called when an IPsec-protected packet
109 * is received by IPv4 or IPv6. It's job is to find the right SA
110 # and call the appropriate transform. The transform callback
111 * takes care of further processing (like ingress filtering).
112 */
113 static int
114 ipsec_common_input(struct mbuf *m, int skip, int protoff, int af, int sproto)
115 {
116 union sockaddr_union dst_address;
117 struct secasvar *sav;
118 u_int32_t spi;
119 int s, error;
120
121 IPSEC_ISTAT(sproto, espstat.esps_input, ahstat.ahs_input,
122 ipcompstat.ipcomps_input);
123
124 IPSEC_ASSERT(m != NULL, ("ipsec_common_input: null packet"));
125
126 if ((sproto == IPPROTO_ESP && !esp_enable) ||
127 (sproto == IPPROTO_AH && !ah_enable) ||
128 (sproto == IPPROTO_IPCOMP && !ipcomp_enable)) {
129 m_freem(m);
130 IPSEC_ISTAT(sproto, espstat.esps_pdrops, ahstat.ahs_pdrops,
131 ipcompstat.ipcomps_pdrops);
132 return EOPNOTSUPP;
133 }
134
135 if (m->m_pkthdr.len - skip < 2 * sizeof (u_int32_t)) {
136 m_freem(m);
137 IPSEC_ISTAT(sproto, espstat.esps_hdrops, ahstat.ahs_hdrops,
138 ipcompstat.ipcomps_hdrops);
139 DPRINTF(("ipsec_common_input: packet too small\n"));
140 return EINVAL;
141 }
142
143 /* Retrieve the SPI from the relevant IPsec header */
144 if (sproto == IPPROTO_ESP)
145 m_copydata(m, skip, sizeof(u_int32_t), (caddr_t) &spi);
146 else if (sproto == IPPROTO_AH)
147 m_copydata(m, skip + sizeof(u_int32_t), sizeof(u_int32_t),
148 (caddr_t) &spi);
149 else if (sproto == IPPROTO_IPCOMP) {
150 u_int16_t cpi;
151 m_copydata(m, skip + sizeof(u_int16_t), sizeof(u_int16_t),
152 (caddr_t) &cpi);
153 spi = ntohl(htons(cpi));
154 }
155
156 /*
157 * Find the SA and (indirectly) call the appropriate
158 * kernel crypto routine. The resulting mbuf chain is a valid
159 * IP packet ready to go through input processing.
160 */
161 bzero(&dst_address, sizeof (dst_address));
162 dst_address.sa.sa_family = af;
163 switch (af) {
164 #ifdef INET
165 case AF_INET:
166 dst_address.sin.sin_len = sizeof(struct sockaddr_in);
167 m_copydata(m, offsetof(struct ip, ip_dst),
168 sizeof(struct in_addr),
169 (caddr_t) &dst_address.sin.sin_addr);
170 break;
171 #endif /* INET */
172 #ifdef INET6
173 case AF_INET6:
174 dst_address.sin6.sin6_len = sizeof(struct sockaddr_in6);
175 m_copydata(m, offsetof(struct ip6_hdr, ip6_dst),
176 sizeof(struct in6_addr),
177 (caddr_t) &dst_address.sin6.sin6_addr);
178 break;
179 #endif /* INET6 */
180 default:
181 DPRINTF(("ipsec_common_input: unsupported protocol "
182 "family %u\n", af));
183 m_freem(m);
184 IPSEC_ISTAT(sproto, espstat.esps_nopf, ahstat.ahs_nopf,
185 ipcompstat.ipcomps_nopf);
186 return EPFNOSUPPORT;
187 }
188
189 s = splsoftnet();
190
191 /* NB: only pass dst since key_allocsa follows RFC2401 */
192 sav = KEY_ALLOCSA(&dst_address, sproto, spi);
193 if (sav == NULL) {
194 DPRINTF(("ipsec_common_input: no key association found for"
195 " SA %s/%08lx/%u\n",
196 ipsec_address(&dst_address),
197 (u_long) ntohl(spi), sproto));
198 IPSEC_ISTAT(sproto, espstat.esps_notdb, ahstat.ahs_notdb,
199 ipcompstat.ipcomps_notdb);
200 splx(s);
201 m_freem(m);
202 return ENOENT;
203 }
204
205 if (sav->tdb_xform == NULL) {
206 DPRINTF(("ipsec_common_input: attempted to use uninitialized"
207 " SA %s/%08lx/%u\n",
208 ipsec_address(&dst_address),
209 (u_long) ntohl(spi), sproto));
210 IPSEC_ISTAT(sproto, espstat.esps_noxform, ahstat.ahs_noxform,
211 ipcompstat.ipcomps_noxform);
212 KEY_FREESAV(&sav);
213 splx(s);
214 m_freem(m);
215 return ENXIO;
216 }
217
218 /*
219 * Call appropriate transform and return -- callback takes care of
220 * everything else.
221 */
222 error = (*sav->tdb_xform->xf_input)(m, sav, skip, protoff);
223 KEY_FREESAV(&sav);
224 splx(s);
225 return error;
226 }
227
228 #ifdef INET
229 /*
230 * Common input handler for IPv4 AH, ESP, and IPCOMP.
231 */
232 void
233 ipsec4_common_input(struct mbuf *m, ...)
234 {
235 va_list ap;
236 int off, nxt;
237
238 va_start(ap, m);
239 off = va_arg(ap, int);
240 nxt = va_arg(ap, int);
241 va_end(ap);
242
243 (void) ipsec_common_input(m, off, offsetof(struct ip, ip_p),
244 AF_INET, nxt);
245 }
246
247 /*
248 * IPsec input callback for INET protocols.
249 * This routine is called as the transform callback.
250 * Takes care of filtering and other sanity checks on
251 * the processed packet.
252 */
253 int
254 ipsec4_common_input_cb(struct mbuf *m, struct secasvar *sav,
255 int skip, int protoff, struct m_tag *mt)
256 {
257 int prot, af, sproto;
258 struct ip *ip;
259 struct m_tag *mtag;
260 struct tdb_ident *tdbi;
261 struct secasindex *saidx;
262 int error;
263
264 IPSEC_SPLASSERT_SOFTNET("ipsec4_common_input_cb");
265
266 IPSEC_ASSERT(m != NULL, ("ipsec4_common_input_cb: null mbuf"));
267 IPSEC_ASSERT(sav != NULL, ("ipsec4_common_input_cb: null SA"));
268 IPSEC_ASSERT(sav->sah != NULL, ("ipsec4_common_input_cb: null SAH"));
269 saidx = &sav->sah->saidx;
270 af = saidx->dst.sa.sa_family;
271 IPSEC_ASSERT(af == AF_INET, ("ipsec4_common_input_cb: unexpected af %u",af));
272 sproto = saidx->proto;
273 IPSEC_ASSERT(sproto == IPPROTO_ESP || sproto == IPPROTO_AH ||
274 sproto == IPPROTO_IPCOMP,
275 ("ipsec4_common_input_cb: unexpected security protocol %u",
276 sproto));
277
278 /* Sanity check */
279 if (m == NULL) {
280 DPRINTF(("ipsec4_common_input_cb: null mbuf"));
281 IPSEC_ISTAT(sproto, espstat.esps_badkcr, ahstat.ahs_badkcr,
282 ipcompstat.ipcomps_badkcr);
283 KEY_FREESAV(&sav);
284 return EINVAL;
285 }
286
287 if (skip != 0) {
288 /* Fix IPv4 header */
289 if (m->m_len < skip && (m = m_pullup(m, skip)) == NULL) {
290 DPRINTF(("ipsec4_common_input_cb: processing failed "
291 "for SA %s/%08lx\n",
292 ipsec_address(&sav->sah->saidx.dst),
293 (u_long) ntohl(sav->spi)));
294 IPSEC_ISTAT(sproto, espstat.esps_hdrops, ahstat.ahs_hdrops,
295 ipcompstat.ipcomps_hdrops);
296 error = ENOBUFS;
297 goto bad;
298 }
299
300 ip = mtod(m, struct ip *);
301 ip->ip_len = htons(m->m_pkthdr.len);
302 #ifdef __FreeBSD__
303 /* On FreeBSD, ip_off and ip_len assumed in host endian. */
304 ip->ip_off = htons(ip->ip_off);
305 #endif
306 ip->ip_sum = 0;
307 ip->ip_sum = in_cksum(m, ip->ip_hl << 2);
308 } else {
309 ip = mtod(m, struct ip *);
310 }
311 prot = ip->ip_p;
312
313 /* IP-in-IP encapsulation */
314 if (prot == IPPROTO_IPIP) {
315 struct ip ipn;
316
317 /* ipn will now contain the inner IPv4 header */
318 m_copydata(m, ip->ip_hl << 2, sizeof(struct ip),
319 (caddr_t) &ipn);
320
321 #ifdef notyet
322 /* XXX PROXY address isn't recorded in SAH */
323 /*
324 * Check that the inner source address is the same as
325 * the proxy address, if available.
326 */
327 if ((saidx->proxy.sa.sa_family == AF_INET &&
328 saidx->proxy.sin.sin_addr.s_addr !=
329 INADDR_ANY &&
330 ipn.ip_src.s_addr !=
331 saidx->proxy.sin.sin_addr.s_addr) ||
332 (saidx->proxy.sa.sa_family != AF_INET &&
333 saidx->proxy.sa.sa_family != 0)) {
334
335 DPRINTF(("ipsec4_common_input_cb: inner "
336 "source address %s doesn't correspond to "
337 "expected proxy source %s, SA %s/%08lx\n",
338 inet_ntoa4(ipn.ip_src),
339 ipsp_address(saidx->proxy),
340 ipsp_address(saidx->dst),
341 (u_long) ntohl(sav->spi)));
342
343 IPSEC_ISTAT(sproto, espstat.esps_pdrops,
344 ahstat.ahs_pdrops,
345 ipcompstat.ipcomps_pdrops);
346 error = EACCES;
347 goto bad;
348 }
349 #endif /*XXX*/
350 }
351 #if INET6
352 /* IPv6-in-IP encapsulation. */
353 if (prot == IPPROTO_IPV6) {
354 struct ip6_hdr ip6n;
355
356 /* ip6n will now contain the inner IPv6 header. */
357 m_copydata(m, ip->ip_hl << 2, sizeof(struct ip6_hdr),
358 (caddr_t) &ip6n);
359
360 #ifdef notyet
361 /*
362 * Check that the inner source address is the same as
363 * the proxy address, if available.
364 */
365 if ((saidx->proxy.sa.sa_family == AF_INET6 &&
366 !IN6_IS_ADDR_UNSPECIFIED(&saidx->proxy.sin6.sin6_addr) &&
367 !IN6_ARE_ADDR_EQUAL(&ip6n.ip6_src,
368 &saidx->proxy.sin6.sin6_addr)) ||
369 (saidx->proxy.sa.sa_family != AF_INET6 &&
370 saidx->proxy.sa.sa_family != 0)) {
371
372 DPRINTF(("ipsec4_common_input_cb: inner "
373 "source address %s doesn't correspond to "
374 "expected proxy source %s, SA %s/%08lx\n",
375 ip6_sprintf(&ip6n.ip6_src),
376 ipsec_address(&saidx->proxy),
377 ipsec_address(&saidx->dst),
378 (u_long) ntohl(sav->spi)));
379
380 IPSEC_ISTAT(sproto, espstat.esps_pdrops,
381 ahstat.ahs_pdrops,
382 ipcompstat.ipcomps_pdrops);
383 error = EACCES;
384 goto bad;
385 }
386 #endif /*XXX*/
387 }
388 #endif /* INET6 */
389
390 /*
391 * Record what we've done to the packet (under what SA it was
392 * processed). If we've been passed an mtag, it means the packet
393 * was already processed by an ethernet/crypto combo card and
394 * thus has a tag attached with all the right information, but
395 * with a PACKET_TAG_IPSEC_IN_CRYPTO_DONE as opposed to
396 * PACKET_TAG_IPSEC_IN_DONE type; in that case, just change the type.
397 */
398 if (mt == NULL && sproto != IPPROTO_IPCOMP) {
399 mtag = m_tag_get(PACKET_TAG_IPSEC_IN_DONE,
400 sizeof(struct tdb_ident), M_NOWAIT);
401 if (mtag == NULL) {
402 DPRINTF(("ipsec4_common_input_cb: failed to get tag\n"));
403 IPSEC_ISTAT(sproto, espstat.esps_hdrops,
404 ahstat.ahs_hdrops, ipcompstat.ipcomps_hdrops);
405 error = ENOMEM;
406 goto bad;
407 }
408
409 tdbi = (struct tdb_ident *)(mtag + 1);
410 bcopy(&saidx->dst, &tdbi->dst, saidx->dst.sa.sa_len);
411 tdbi->proto = sproto;
412 tdbi->spi = sav->spi;
413
414 m_tag_prepend(m, mtag);
415 } else {
416 if (mt != NULL)
417 mt->m_tag_id = PACKET_TAG_IPSEC_IN_DONE;
418 /* XXX do we need to mark m_flags??? */
419 }
420
421 key_sa_recordxfer(sav, m); /* record data transfer */
422
423 /*
424 * Re-dispatch via software interrupt.
425 */
426 if (!IF_HANDOFF(&ipintrq, m, NULL)) {
427 IPSEC_ISTAT(sproto, espstat.esps_qfull, ahstat.ahs_qfull,
428 ipcompstat.ipcomps_qfull);
429
430 DPRINTF(("ipsec4_common_input_cb: queue full; "
431 "proto %u packet dropped\n", sproto));
432 return ENOBUFS;
433 }
434 schednetisr(NETISR_IP);
435 return 0;
436 bad:
437 m_freem(m);
438 return error;
439 }
440 #endif /* INET */
441
442 #ifdef INET6
443 /* IPv6 AH wrapper. */
444 int
445 ipsec6_common_input(struct mbuf **mp, int *offp, int proto)
446 {
447 int l = 0;
448 int protoff;
449 struct ip6_ext ip6e;
450
451 if (*offp < sizeof(struct ip6_hdr)) {
452 DPRINTF(("ipsec6_common_input: bad offset %u\n", *offp));
453 return IPPROTO_DONE;
454 } else if (*offp == sizeof(struct ip6_hdr)) {
455 protoff = offsetof(struct ip6_hdr, ip6_nxt);
456 } else {
457 /* Chase down the header chain... */
458 protoff = sizeof(struct ip6_hdr);
459
460 do {
461 protoff += l;
462 m_copydata(*mp, protoff, sizeof(ip6e),
463 (caddr_t) &ip6e);
464
465 if (ip6e.ip6e_nxt == IPPROTO_AH)
466 l = (ip6e.ip6e_len + 2) << 2;
467 else
468 l = (ip6e.ip6e_len + 1) << 3;
469 IPSEC_ASSERT(l > 0, ("ah6_input: l went zero or negative"));
470 } while (protoff + l < *offp);
471
472 /* Malformed packet check */
473 if (protoff + l != *offp) {
474 DPRINTF(("ipsec6_common_input: bad packet header chain, "
475 "protoff %u, l %u, off %u\n", protoff, l, *offp));
476 IPSEC_ISTAT(proto, espstat.esps_hdrops,
477 ahstat.ahs_hdrops,
478 ipcompstat.ipcomps_hdrops);
479 m_freem(*mp);
480 *mp = NULL;
481 return IPPROTO_DONE;
482 }
483 protoff += offsetof(struct ip6_ext, ip6e_nxt);
484 }
485 (void) ipsec_common_input(*mp, *offp, protoff, AF_INET6, proto);
486 return IPPROTO_DONE;
487 }
488
489 /*
490 * NB: ipsec_netbsd.c has a duplicate definition of esp6_ctlinput(),
491 * with slightly ore recent multicast tests. These should be merged.
492 * For now, ifdef accordingly.
493 */
494 #ifdef __FreeBSD__
495 void
496 esp6_ctlinput(int cmd, struct sockaddr *sa, void *d)
497 {
498 if (sa->sa_family != AF_INET6 ||
499 sa->sa_len != sizeof(struct sockaddr_in6))
500 return;
501 if ((unsigned)cmd >= PRC_NCMDS)
502 return;
503
504 /* if the parameter is from icmp6, decode it. */
505 if (d != NULL) {
506 struct ip6ctlparam *ip6cp = (struct ip6ctlparam *)d;
507 struct mbuf *m = ip6cp->ip6c_m;
508 int off = ip6cp->ip6c_off;
509
510 struct ip6ctlparam ip6cp1;
511
512 /*
513 * Notify the error to all possible sockets via pfctlinput2.
514 * Since the upper layer information (such as protocol type,
515 * source and destination ports) is embedded in the encrypted
516 * data and might have been cut, we can't directly call
517 * an upper layer ctlinput function. However, the pcbnotify
518 * function will consider source and destination addresses
519 * as well as the flow info value, and may be able to find
520 * some PCB that should be notified.
521 * Although pfctlinput2 will call esp6_ctlinput(), there is
522 * no possibility of an infinite loop of function calls,
523 * because we don't pass the inner IPv6 header.
524 */
525 bzero(&ip6cp1, sizeof(ip6cp1));
526 ip6cp1.ip6c_src = ip6cp->ip6c_src;
527 pfctlinput2(cmd, sa, (void *)&ip6cp1);
528
529 /*
530 * Then go to special cases that need ESP header information.
531 * XXX: We assume that when ip6 is non NULL,
532 * M and OFF are valid.
533 */
534
535 if (cmd == PRC_MSGSIZE) {
536 struct secasvar *sav;
537 u_int32_t spi;
538 int valid;
539
540 /* check header length before using m_copydata */
541 if (m->m_pkthdr.len < off + sizeof (struct esp))
542 return;
543 m_copydata(m, off + offsetof(struct esp, esp_spi),
544 sizeof(u_int32_t), (caddr_t) &spi);
545 /*
546 * Check to see if we have a valid SA corresponding to
547 * the address in the ICMP message payload.
548 */
549 sav = KEY_ALLOCSA((union sockaddr_union *)sa,
550 IPPROTO_ESP, spi);
551 valid = (sav != NULL);
552 if (sav)
553 KEY_FREESAV(&sav);
554
555 /* XXX Further validation? */
556
557 /*
558 * Depending on whether the SA is "valid" and
559 * routing table size (mtudisc_{hi,lo}wat), we will:
560 * - recalcurate the new MTU and create the
561 * corresponding routing entry, or
562 * - ignore the MTU change notification.
563 */
564 icmp6_mtudisc_update(ip6cp, valid);
565 }
566 } else {
567 /* we normally notify any pcb here */
568 }
569 }
570 #endif /* __FreeBSD__ */
571
572 extern const struct ip6protosw inet6sw[];
573 extern u_char ip6_protox[];
574
575 /*
576 * IPsec input callback, called by the transform callback. Takes care of
577 * filtering and other sanity checks on the processed packet.
578 */
579 int
580 ipsec6_common_input_cb(struct mbuf *m, struct secasvar *sav, int skip, int protoff,
581 struct m_tag *mt)
582 {
583 int prot, af, sproto;
584 struct ip6_hdr *ip6;
585 struct m_tag *mtag;
586 struct tdb_ident *tdbi;
587 struct secasindex *saidx;
588 int nxt;
589 u_int8_t nxt8;
590 int error, nest;
591
592 IPSEC_ASSERT(m != NULL, ("ipsec6_common_input_cb: null mbuf"));
593 IPSEC_ASSERT(sav != NULL, ("ipsec6_common_input_cb: null SA"));
594 IPSEC_ASSERT(sav->sah != NULL, ("ipsec6_common_input_cb: null SAH"));
595 saidx = &sav->sah->saidx;
596 af = saidx->dst.sa.sa_family;
597 IPSEC_ASSERT(af == AF_INET6,
598 ("ipsec6_common_input_cb: unexpected af %u", af));
599 sproto = saidx->proto;
600 IPSEC_ASSERT(sproto == IPPROTO_ESP || sproto == IPPROTO_AH ||
601 sproto == IPPROTO_IPCOMP,
602 ("ipsec6_common_input_cb: unexpected security protocol %u",
603 sproto));
604
605 /* Sanity check */
606 if (m == NULL) {
607 DPRINTF(("ipsec6_common_input_cb: null mbuf"));
608 IPSEC_ISTAT(sproto, espstat.esps_badkcr, ahstat.ahs_badkcr,
609 ipcompstat.ipcomps_badkcr);
610 error = EINVAL;
611 goto bad;
612 }
613
614 /* Fix IPv6 header */
615 if (m->m_len < sizeof(struct ip6_hdr) &&
616 (m = m_pullup(m, sizeof(struct ip6_hdr))) == NULL) {
617
618 DPRINTF(("ipsec6_common_input_cb: processing failed "
619 "for SA %s/%08lx\n", ipsec_address(&sav->sah->saidx.dst),
620 (u_long) ntohl(sav->spi)));
621
622 IPSEC_ISTAT(sproto, espstat.esps_hdrops, ahstat.ahs_hdrops,
623 ipcompstat.ipcomps_hdrops);
624 error = EACCES;
625 goto bad;
626 }
627
628 ip6 = mtod(m, struct ip6_hdr *);
629 ip6->ip6_plen = htons(m->m_pkthdr.len - sizeof(struct ip6_hdr));
630
631 /* Save protocol */
632 m_copydata(m, protoff, 1, (unsigned char *) &prot);
633
634 #ifdef INET
635 /* IP-in-IP encapsulation */
636 if (prot == IPPROTO_IPIP) {
637 struct ip ipn;
638
639 /* ipn will now contain the inner IPv4 header */
640 m_copydata(m, skip, sizeof(struct ip), (caddr_t) &ipn);
641
642 #ifdef notyet
643 /*
644 * Check that the inner source address is the same as
645 * the proxy address, if available.
646 */
647 if ((saidx->proxy.sa.sa_family == AF_INET &&
648 saidx->proxy.sin.sin_addr.s_addr != INADDR_ANY &&
649 ipn.ip_src.s_addr != saidx->proxy.sin.sin_addr.s_addr) ||
650 (saidx->proxy.sa.sa_family != AF_INET &&
651 saidx->proxy.sa.sa_family != 0)) {
652
653 DPRINTF(("ipsec6_common_input_cb: inner "
654 "source address %s doesn't correspond to "
655 "expected proxy source %s, SA %s/%08lx\n",
656 inet_ntoa4(ipn.ip_src),
657 ipsec_address(&saidx->proxy),
658 ipsec_address(&saidx->dst),
659 (u_long) ntohl(sav->spi)));
660
661 IPSEC_ISTAT(sproto, espstat.esps_pdrops,
662 ahstat.ahs_pdrops, ipcompstat.ipcomps_pdrops);
663 error = EACCES;
664 goto bad;
665 }
666 #endif /*XXX*/
667 }
668 #endif /* INET */
669
670 /* IPv6-in-IP encapsulation */
671 if (prot == IPPROTO_IPV6) {
672 struct ip6_hdr ip6n;
673
674 /* ip6n will now contain the inner IPv6 header. */
675 m_copydata(m, skip, sizeof(struct ip6_hdr),
676 (caddr_t) &ip6n);
677
678 #ifdef notyet
679 /*
680 * Check that the inner source address is the same as
681 * the proxy address, if available.
682 */
683 if ((saidx->proxy.sa.sa_family == AF_INET6 &&
684 !IN6_IS_ADDR_UNSPECIFIED(&saidx->proxy.sin6.sin6_addr) &&
685 !IN6_ARE_ADDR_EQUAL(&ip6n.ip6_src,
686 &saidx->proxy.sin6.sin6_addr)) ||
687 (saidx->proxy.sa.sa_family != AF_INET6 &&
688 saidx->proxy.sa.sa_family != 0)) {
689
690 DPRINTF(("ipsec6_common_input_cb: inner "
691 "source address %s doesn't correspond to "
692 "expected proxy source %s, SA %s/%08lx\n",
693 ip6_sprintf(&ip6n.ip6_src),
694 ipsec_address(&saidx->proxy),
695 ipsec_address(&saidx->dst),
696 (u_long) ntohl(sav->spi)));
697
698 IPSEC_ISTAT(sproto, espstat.esps_pdrops,
699 ahstat.ahs_pdrops, ipcompstat.ipcomps_pdrops);
700 error = EACCES;
701 goto bad;
702 }
703 #endif /*XXX*/
704 }
705
706 /*
707 * Record what we've done to the packet (under what SA it was
708 * processed). If we've been passed an mtag, it means the packet
709 * was already processed by an ethernet/crypto combo card and
710 * thus has a tag attached with all the right information, but
711 * with a PACKET_TAG_IPSEC_IN_CRYPTO_DONE as opposed to
712 * PACKET_TAG_IPSEC_IN_DONE type; in that case, just change the type.
713 */
714 if (mt == NULL && sproto != IPPROTO_IPCOMP) {
715 mtag = m_tag_get(PACKET_TAG_IPSEC_IN_DONE,
716 sizeof(struct tdb_ident), M_NOWAIT);
717 if (mtag == NULL) {
718 DPRINTF(("ipsec_common_input_cb: failed to "
719 "get tag\n"));
720 IPSEC_ISTAT(sproto, espstat.esps_hdrops,
721 ahstat.ahs_hdrops, ipcompstat.ipcomps_hdrops);
722 error = ENOMEM;
723 goto bad;
724 }
725
726 tdbi = (struct tdb_ident *)(mtag + 1);
727 bcopy(&saidx->dst, &tdbi->dst, sizeof(union sockaddr_union));
728 tdbi->proto = sproto;
729 tdbi->spi = sav->spi;
730
731 m_tag_prepend(m, mtag);
732 } else {
733 if (mt != NULL)
734 mt->m_tag_id = PACKET_TAG_IPSEC_IN_DONE;
735 /* XXX do we need to mark m_flags??? */
736 }
737
738 key_sa_recordxfer(sav, m);
739
740 /* Retrieve new protocol */
741 m_copydata(m, protoff, sizeof(u_int8_t), (caddr_t) &nxt8);
742
743 /*
744 * See the end of ip6_input for this logic.
745 * IPPROTO_IPV[46] case will be processed just like other ones
746 */
747 nest = 0;
748 nxt = nxt8;
749 while (nxt != IPPROTO_DONE) {
750 if (ip6_hdrnestlimit && (++nest > ip6_hdrnestlimit)) {
751 ip6stat.ip6s_toomanyhdr++;
752 error = EINVAL;
753 goto bad;
754 }
755
756 /*
757 * Protection against faulty packet - there should be
758 * more sanity checks in header chain processing.
759 */
760 if (m->m_pkthdr.len < skip) {
761 ip6stat.ip6s_tooshort++;
762 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_truncated);
763 error = EINVAL;
764 goto bad;
765 }
766 /*
767 * Enforce IPsec policy checking if we are seeing last header.
768 * note that we do not visit this with protocols with pcb layer
769 * code - like udp/tcp/raw ip.
770 */
771 if ((inet6sw[ip6_protox[nxt]].pr_flags & PR_LASTHDR) != 0 &&
772 ipsec6_in_reject(m, NULL)) {
773 error = EINVAL;
774 goto bad;
775 }
776 nxt = (*inet6sw[ip6_protox[nxt]].pr_input)(&m, &skip, nxt);
777 }
778 return 0;
779 bad:
780 if (m)
781 m_freem(m);
782 return error;
783 }
784 #endif /* INET6 */
Cache object: 292c8bb908242210cf1fb2072445ca33
|