Now available: The Design and Implementation of the FreeBSD Operating System (Second Edition)
[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]
FreeBSD/Linux Kernel Cross Reference
sys/netipsec/xform_ah.c
Version:
- FREEBSD - FREEBSD-13-STABLE - FREEBSD-13-0 - FREEBSD-12-STABLE - FREEBSD-12-0 - FREEBSD-11-STABLE - FREEBSD-11-0 - FREEBSD-10-STABLE - FREEBSD-10-0 - FREEBSD-9-STABLE - FREEBSD-9-0 - FREEBSD-8-STABLE - FREEBSD-8-0 - FREEBSD-7-STABLE - FREEBSD-7-0 - FREEBSD-6-STABLE - FREEBSD-6-0 - FREEBSD-5-STABLE - FREEBSD-5-0 - FREEBSD-4-STABLE - FREEBSD-3-STABLE - FREEBSD22 - l41 - OPENBSD - linux-2.6 - MK84 - PLAN9 - xnu-8792
SearchContext: - none - 3 - 10
SearchContext: - none - 3 - 10
1 /* $FreeBSD$ */ 2 /* $OpenBSD: ip_ah.c,v 1.63 2001/06/26 06:18:58 angelos Exp $ */ 3 /*- 4 * The authors of this code are John Ioannidis (ji@tla.org), 5 * Angelos D. Keromytis (kermit@csd.uch.gr) and 6 * Niels Provos (provos@physnet.uni-hamburg.de). 7 * 8 * The original version of this code was written by John Ioannidis 9 * for BSD/OS in Athens, Greece, in November 1995. 10 * 11 * Ported to OpenBSD and NetBSD, with additional transforms, in December 1996, 12 * by Angelos D. Keromytis. 13 * 14 * Additional transforms and features in 1997 and 1998 by Angelos D. Keromytis 15 * and Niels Provos. 16 * 17 * Additional features in 1999 by Angelos D. Keromytis and Niklas Hallqvist. 18 * 19 * Copyright (c) 1995, 1996, 1997, 1998, 1999 by John Ioannidis, 20 * Angelos D. Keromytis and Niels Provos. 21 * Copyright (c) 1999 Niklas Hallqvist. 22 * Copyright (c) 2001 Angelos D. Keromytis. 23 * 24 * Permission to use, copy, and modify this software with or without fee 25 * is hereby granted, provided that this entire notice is included in 26 * all copies of any software which is or includes a copy or 27 * modification of this software. 28 * You may use this code under the GNU public license if you so wish. Please 29 * contribute changes back to the authors under this freer than GPL license 30 * so that we may further the use of strong encryption without limitations to 31 * all. 32 * 33 * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR 34 * IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY 35 * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE 36 * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR 37 * PURPOSE. 38 */ 39 #include "opt_inet.h" 40 #include "opt_inet6.h" 41 42 #include <sys/param.h> 43 #include <sys/systm.h> 44 #include <sys/mbuf.h> 45 #include <sys/socket.h> 46 #include <sys/syslog.h> 47 #include <sys/kernel.h> 48 #include <sys/sysctl.h> 49 50 #include <net/if.h> 51 #include <net/vnet.h> 52 53 #include <netinet/in.h> 54 #include <netinet/in_systm.h> 55 #include <netinet/ip.h> 56 #include <netinet/ip_ecn.h> 57 #include <netinet/ip6.h> 58 59 #include <netipsec/ipsec.h> 60 #include <netipsec/ah.h> 61 #include <netipsec/ah_var.h> 62 #include <netipsec/xform.h> 63 64 #ifdef INET6 65 #include <netinet6/ip6_var.h> 66 #include <netipsec/ipsec6.h> 67 #include <netinet6/ip6_ecn.h> 68 #endif 69 70 #include <netipsec/key.h> 71 #include <netipsec/key_debug.h> 72 73 #include <opencrypto/cryptodev.h> 74 75 /* 76 * Return header size in bytes. The old protocol did not support 77 * the replay counter; the new protocol always includes the counter. 78 */ 79 #define HDRSIZE(sav) \ 80 (((sav)->flags & SADB_X_EXT_OLD) ? \ 81 sizeof (struct ah) : sizeof (struct ah) + sizeof (u_int32_t)) 82 /* 83 * Return authenticator size in bytes. The old protocol is known 84 * to use a fixed 16-byte authenticator. The new algorithm use 12-byte 85 * authenticator. 86 */ 87 #define AUTHSIZE(sav) ah_authsize(sav) 88 89 VNET_DEFINE(int, ah_enable) = 1; /* control flow of packets with AH */ 90 VNET_DEFINE(int, ah_cleartos) = 1; /* clear ip_tos when doing AH calc */ 91 VNET_PCPUSTAT_DEFINE(struct ahstat, ahstat); 92 VNET_PCPUSTAT_SYSINIT(ahstat); 93 94 #ifdef VIMAGE 95 VNET_PCPUSTAT_SYSUNINIT(ahstat); 96 #endif /* VIMAGE */ 97 98 #ifdef INET 99 SYSCTL_DECL(_net_inet_ah); 100 SYSCTL_VNET_INT(_net_inet_ah, OID_AUTO, 101 ah_enable, CTLFLAG_RW, &VNET_NAME(ah_enable), 0, ""); 102 SYSCTL_VNET_INT(_net_inet_ah, OID_AUTO, 103 ah_cleartos, CTLFLAG_RW, &VNET_NAME(ah_cleartos), 0, ""); 104 SYSCTL_VNET_PCPUSTAT(_net_inet_ah, IPSECCTL_STATS, stats, struct ahstat, 105 ahstat, "AH statistics (struct ahstat, netipsec/ah_var.h)"); 106 #endif 107 108 static unsigned char ipseczeroes[256]; /* larger than an ip6 extension hdr */ 109 110 static int ah_input_cb(struct cryptop*); 111 static int ah_output_cb(struct cryptop*); 112 113 static int 114 ah_authsize(struct secasvar *sav) 115 { 116 117 IPSEC_ASSERT(sav != NULL, ("%s: sav == NULL", __func__)); 118 119 if (sav->flags & SADB_X_EXT_OLD) 120 return 16; 121 122 switch (sav->alg_auth) { 123 case SADB_X_AALG_SHA2_256: 124 return 16; 125 case SADB_X_AALG_SHA2_384: 126 return 24; 127 case SADB_X_AALG_SHA2_512: 128 return 32; 129 default: 130 return AH_HMAC_HASHLEN; 131 } 132 /* NOTREACHED */ 133 } 134 /* 135 * NB: this is public for use by the PF_KEY support. 136 */ 137 struct auth_hash * 138 ah_algorithm_lookup(int alg) 139 { 140 if (alg > SADB_AALG_MAX) 141 return NULL; 142 switch (alg) { 143 case SADB_X_AALG_NULL: 144 return &auth_hash_null; 145 case SADB_AALG_MD5HMAC: 146 return &auth_hash_hmac_md5; 147 case SADB_AALG_SHA1HMAC: 148 return &auth_hash_hmac_sha1; 149 case SADB_X_AALG_RIPEMD160HMAC: 150 return &auth_hash_hmac_ripemd_160; 151 case SADB_X_AALG_MD5: 152 return &auth_hash_key_md5; 153 case SADB_X_AALG_SHA: 154 return &auth_hash_key_sha1; 155 case SADB_X_AALG_SHA2_256: 156 return &auth_hash_hmac_sha2_256; 157 case SADB_X_AALG_SHA2_384: 158 return &auth_hash_hmac_sha2_384; 159 case SADB_X_AALG_SHA2_512: 160 return &auth_hash_hmac_sha2_512; 161 } 162 return NULL; 163 } 164 165 size_t 166 ah_hdrsiz(struct secasvar *sav) 167 { 168 size_t size; 169 170 if (sav != NULL) { 171 int authsize; 172 IPSEC_ASSERT(sav->tdb_authalgxform != NULL, ("null xform")); 173 /*XXX not right for null algorithm--does it matter??*/ 174 authsize = AUTHSIZE(sav); 175 size = roundup(authsize, sizeof (u_int32_t)) + HDRSIZE(sav); 176 } else { 177 /* default guess */ 178 size = sizeof (struct ah) + sizeof (u_int32_t) + 16; 179 } 180 return size; 181 } 182 183 /* 184 * NB: public for use by esp_init. 185 */ 186 int 187 ah_init0(struct secasvar *sav, struct xformsw *xsp, struct cryptoini *cria) 188 { 189 struct auth_hash *thash; 190 int keylen; 191 192 thash = ah_algorithm_lookup(sav->alg_auth); 193 if (thash == NULL) { 194 DPRINTF(("%s: unsupported authentication algorithm %u\n", 195 __func__, sav->alg_auth)); 196 return EINVAL; 197 } 198 /* 199 * Verify the replay state block allocation is consistent with 200 * the protocol type. We check here so we can make assumptions 201 * later during protocol processing. 202 */ 203 /* NB: replay state is setup elsewhere (sigh) */ 204 if (((sav->flags&SADB_X_EXT_OLD) == 0) ^ (sav->replay != NULL)) { 205 DPRINTF(("%s: replay state block inconsistency, " 206 "%s algorithm %s replay state\n", __func__, 207 (sav->flags & SADB_X_EXT_OLD) ? "old" : "new", 208 sav->replay == NULL ? "without" : "with")); 209 return EINVAL; 210 } 211 if (sav->key_auth == NULL) { 212 DPRINTF(("%s: no authentication key for %s algorithm\n", 213 __func__, thash->name)); 214 return EINVAL; 215 } 216 keylen = _KEYLEN(sav->key_auth); 217 if (keylen != thash->keysize && thash->keysize != 0) { 218 DPRINTF(("%s: invalid keylength %d, algorithm %s requires " 219 "keysize %d\n", __func__, 220 keylen, thash->name, thash->keysize)); 221 return EINVAL; 222 } 223 224 sav->tdb_xform = xsp; 225 sav->tdb_authalgxform = thash; 226 227 /* Initialize crypto session. */ 228 bzero(cria, sizeof (*cria)); 229 cria->cri_alg = sav->tdb_authalgxform->type; 230 cria->cri_klen = _KEYBITS(sav->key_auth); 231 cria->cri_key = sav->key_auth->key_data; 232 cria->cri_mlen = AUTHSIZE(sav); 233 234 return 0; 235 } 236 237 /* 238 * ah_init() is called when an SPI is being set up. 239 */ 240 static int 241 ah_init(struct secasvar *sav, struct xformsw *xsp) 242 { 243 struct cryptoini cria; 244 int error; 245 246 error = ah_init0(sav, xsp, &cria); 247 return error ? error : 248 crypto_newsession(&sav->tdb_cryptoid, &cria, V_crypto_support); 249 } 250 251 /* 252 * Paranoia. 253 * 254 * NB: public for use by esp_zeroize (XXX). 255 */ 256 int 257 ah_zeroize(struct secasvar *sav) 258 { 259 int err; 260 261 if (sav->key_auth) 262 bzero(sav->key_auth->key_data, _KEYLEN(sav->key_auth)); 263 264 err = crypto_freesession(sav->tdb_cryptoid); 265 sav->tdb_cryptoid = 0; 266 sav->tdb_authalgxform = NULL; 267 sav->tdb_xform = NULL; 268 return err; 269 } 270 271 /* 272 * Massage IPv4/IPv6 headers for AH processing. 273 */ 274 static int 275 ah_massage_headers(struct mbuf **m0, int proto, int skip, int alg, int out) 276 { 277 struct mbuf *m = *m0; 278 unsigned char *ptr; 279 int off, count; 280 281 #ifdef INET 282 struct ip *ip; 283 #endif /* INET */ 284 285 #ifdef INET6 286 struct ip6_ext *ip6e; 287 struct ip6_hdr ip6; 288 int ad, alloc, nxt, noff; 289 #endif /* INET6 */ 290 291 switch (proto) { 292 #ifdef INET 293 case AF_INET: 294 /* 295 * This is the least painful way of dealing with IPv4 header 296 * and option processing -- just make sure they're in 297 * contiguous memory. 298 */ 299 *m0 = m = m_pullup(m, skip); 300 if (m == NULL) { 301 DPRINTF(("%s: m_pullup failed\n", __func__)); 302 return ENOBUFS; 303 } 304 305 /* Fix the IP header */ 306 ip = mtod(m, struct ip *); 307 if (V_ah_cleartos) 308 ip->ip_tos = 0; 309 ip->ip_ttl = 0; 310 ip->ip_sum = 0; 311 312 if (alg == CRYPTO_MD5_KPDK || alg == CRYPTO_SHA1_KPDK) 313 ip->ip_off &= htons(IP_DF); 314 else 315 ip->ip_off = htons(0); 316 317 ptr = mtod(m, unsigned char *); 318 319 /* IPv4 option processing */ 320 for (off = sizeof(struct ip); off < skip;) { 321 if (ptr[off] == IPOPT_EOL || ptr[off] == IPOPT_NOP || 322 off + 1 < skip) 323 ; 324 else { 325 DPRINTF(("%s: illegal IPv4 option length for " 326 "option %d\n", __func__, ptr[off])); 327 328 m_freem(m); 329 return EINVAL; 330 } 331 332 switch (ptr[off]) { 333 case IPOPT_EOL: 334 off = skip; /* End the loop. */ 335 break; 336 337 case IPOPT_NOP: 338 off++; 339 break; 340 341 case IPOPT_SECURITY: /* 0x82 */ 342 case 0x85: /* Extended security. */ 343 case 0x86: /* Commercial security. */ 344 case 0x94: /* Router alert */ 345 case 0x95: /* RFC1770 */ 346 /* Sanity check for option length. */ 347 if (ptr[off + 1] < 2) { 348 DPRINTF(("%s: illegal IPv4 option " 349 "length for option %d\n", 350 __func__, ptr[off])); 351 352 m_freem(m); 353 return EINVAL; 354 } 355 356 off += ptr[off + 1]; 357 break; 358 359 case IPOPT_LSRR: 360 case IPOPT_SSRR: 361 /* Sanity check for option length. */ 362 if (ptr[off + 1] < 2) { 363 DPRINTF(("%s: illegal IPv4 option " 364 "length for option %d\n", 365 __func__, ptr[off])); 366 367 m_freem(m); 368 return EINVAL; 369 } 370 371 /* 372 * On output, if we have either of the 373 * source routing options, we should 374 * swap the destination address of the 375 * IP header with the last address 376 * specified in the option, as that is 377 * what the destination's IP header 378 * will look like. 379 */ 380 if (out) 381 bcopy(ptr + off + ptr[off + 1] - 382 sizeof(struct in_addr), 383 &(ip->ip_dst), sizeof(struct in_addr)); 384 385 /* Fall through */ 386 default: 387 /* Sanity check for option length. */ 388 if (ptr[off + 1] < 2) { 389 DPRINTF(("%s: illegal IPv4 option " 390 "length for option %d\n", 391 __func__, ptr[off])); 392 m_freem(m); 393 return EINVAL; 394 } 395 396 /* Zeroize all other options. */ 397 count = ptr[off + 1]; 398 bcopy(ipseczeroes, ptr + off, count); 399 off += count; 400 break; 401 } 402 403 /* Sanity check. */ 404 if (off > skip) { 405 DPRINTF(("%s: malformed IPv4 options header\n", 406 __func__)); 407 408 m_freem(m); 409 return EINVAL; 410 } 411 } 412 413 break; 414 #endif /* INET */ 415 416 #ifdef INET6 417 case AF_INET6: /* Ugly... */ 418 /* Copy and "cook" the IPv6 header. */ 419 m_copydata(m, 0, sizeof(ip6), (caddr_t) &ip6); 420 421 /* We don't do IPv6 Jumbograms. */ 422 if (ip6.ip6_plen == 0) { 423 DPRINTF(("%s: unsupported IPv6 jumbogram\n", __func__)); 424 m_freem(m); 425 return EMSGSIZE; 426 } 427 428 ip6.ip6_flow = 0; 429 ip6.ip6_hlim = 0; 430 ip6.ip6_vfc &= ~IPV6_VERSION_MASK; 431 ip6.ip6_vfc |= IPV6_VERSION; 432 433 /* Scoped address handling. */ 434 if (IN6_IS_SCOPE_LINKLOCAL(&ip6.ip6_src)) 435 ip6.ip6_src.s6_addr16[1] = 0; 436 if (IN6_IS_SCOPE_LINKLOCAL(&ip6.ip6_dst)) 437 ip6.ip6_dst.s6_addr16[1] = 0; 438 439 /* Done with IPv6 header. */ 440 m_copyback(m, 0, sizeof(struct ip6_hdr), (caddr_t) &ip6); 441 442 /* Let's deal with the remaining headers (if any). */ 443 if (skip - sizeof(struct ip6_hdr) > 0) { 444 if (m->m_len <= skip) { 445 ptr = (unsigned char *) malloc( 446 skip - sizeof(struct ip6_hdr), 447 M_XDATA, M_NOWAIT); 448 if (ptr == NULL) { 449 DPRINTF(("%s: failed to allocate memory" 450 "for IPv6 headers\n",__func__)); 451 m_freem(m); 452 return ENOBUFS; 453 } 454 455 /* 456 * Copy all the protocol headers after 457 * the IPv6 header. 458 */ 459 m_copydata(m, sizeof(struct ip6_hdr), 460 skip - sizeof(struct ip6_hdr), ptr); 461 alloc = 1; 462 } else { 463 /* No need to allocate memory. */ 464 ptr = mtod(m, unsigned char *) + 465 sizeof(struct ip6_hdr); 466 alloc = 0; 467 } 468 } else 469 break; 470 471 nxt = ip6.ip6_nxt & 0xff; /* Next header type. */ 472 473 for (off = 0; off < skip - sizeof(struct ip6_hdr);) 474 switch (nxt) { 475 case IPPROTO_HOPOPTS: 476 case IPPROTO_DSTOPTS: 477 ip6e = (struct ip6_ext *)(ptr + off); 478 noff = off + ((ip6e->ip6e_len + 1) << 3); 479 480 /* Sanity check. */ 481 if (noff > skip - sizeof(struct ip6_hdr)) 482 goto error6; 483 484 /* 485 * Zero out mutable options. 486 */ 487 for (count = off + sizeof(struct ip6_ext); 488 count < noff;) { 489 if (ptr[count] == IP6OPT_PAD1) { 490 count++; 491 continue; /* Skip padding. */ 492 } 493 494 ad = ptr[count + 1] + 2; 495 if (count + ad > noff) 496 goto error6; 497 498 if (ptr[count] & IP6OPT_MUTABLE) 499 memset(ptr + count, 0, ad); 500 count += ad; 501 } 502 503 if (count != noff) 504 goto error6; 505 506 /* Advance. */ 507 off += ((ip6e->ip6e_len + 1) << 3); 508 nxt = ip6e->ip6e_nxt; 509 break; 510 511 case IPPROTO_ROUTING: 512 /* 513 * Always include routing headers in 514 * computation. 515 */ 516 ip6e = (struct ip6_ext *) (ptr + off); 517 off += ((ip6e->ip6e_len + 1) << 3); 518 nxt = ip6e->ip6e_nxt; 519 break; 520 521 default: 522 DPRINTF(("%s: unexpected IPv6 header type %d", 523 __func__, off)); 524 error6: 525 if (alloc) 526 free(ptr, M_XDATA); 527 m_freem(m); 528 return EINVAL; 529 } 530 531 /* Copyback and free, if we allocated. */ 532 if (alloc) { 533 m_copyback(m, sizeof(struct ip6_hdr), 534 skip - sizeof(struct ip6_hdr), ptr); 535 free(ptr, M_XDATA); 536 } 537 538 break; 539 #endif /* INET6 */ 540 } 541 542 return 0; 543 } 544 545 /* 546 * ah_input() gets called to verify that an input packet 547 * passes authentication. 548 */ 549 static int 550 ah_input(struct mbuf *m, struct secasvar *sav, int skip, int protoff) 551 { 552 struct auth_hash *ahx; 553 struct tdb_ident *tdbi; 554 struct tdb_crypto *tc; 555 struct m_tag *mtag; 556 struct newah *ah; 557 int hl, rplen, authsize; 558 559 struct cryptodesc *crda; 560 struct cryptop *crp; 561 562 IPSEC_ASSERT(sav != NULL, ("null SA")); 563 IPSEC_ASSERT(sav->key_auth != NULL, ("null authentication key")); 564 IPSEC_ASSERT(sav->tdb_authalgxform != NULL, 565 ("null authentication xform")); 566 567 /* Figure out header size. */ 568 rplen = HDRSIZE(sav); 569 570 /* XXX don't pullup, just copy header */ 571 IP6_EXTHDR_GET(ah, struct newah *, m, skip, rplen); 572 if (ah == NULL) { 573 DPRINTF(("ah_input: cannot pullup header\n")); 574 AHSTAT_INC(ahs_hdrops); /*XXX*/ 575 m_freem(m); 576 return ENOBUFS; 577 } 578 579 /* Check replay window, if applicable. */ 580 if (sav->replay && !ipsec_chkreplay(ntohl(ah->ah_seq), sav)) { 581 AHSTAT_INC(ahs_replay); 582 DPRINTF(("%s: packet replay failure: %s\n", __func__, 583 ipsec_logsastr(sav))); 584 m_freem(m); 585 return ENOBUFS; 586 } 587 588 /* Verify AH header length. */ 589 hl = ah->ah_len * sizeof (u_int32_t); 590 ahx = sav->tdb_authalgxform; 591 authsize = AUTHSIZE(sav); 592 if (hl != authsize + rplen - sizeof (struct ah)) { 593 DPRINTF(("%s: bad authenticator length %u (expecting %lu)" 594 " for packet in SA %s/%08lx\n", __func__, 595 hl, (u_long) (authsize + rplen - sizeof (struct ah)), 596 ipsec_address(&sav->sah->saidx.dst), 597 (u_long) ntohl(sav->spi))); 598 AHSTAT_INC(ahs_badauthl); 599 m_freem(m); 600 return EACCES; 601 } 602 if (skip + authsize + rplen > m->m_pkthdr.len) { 603 DPRINTF(("%s: bad mbuf length %u (expecting %lu)" 604 " for packet in SA %s/%08lx\n", __func__, 605 m->m_pkthdr.len, (u_long) (skip + authsize + rplen), 606 ipsec_address(&sav->sah->saidx.dst), 607 (u_long) ntohl(sav->spi))); 608 AHSTAT_INC(ahs_badauthl); 609 m_freem(m); 610 return EACCES; 611 } 612 AHSTAT_ADD(ahs_ibytes, m->m_pkthdr.len - skip - hl); 613 614 /* Get crypto descriptors. */ 615 crp = crypto_getreq(1); 616 if (crp == NULL) { 617 DPRINTF(("%s: failed to acquire crypto descriptor\n",__func__)); 618 AHSTAT_INC(ahs_crypto); 619 m_freem(m); 620 return ENOBUFS; 621 } 622 623 crda = crp->crp_desc; 624 IPSEC_ASSERT(crda != NULL, ("null crypto descriptor")); 625 626 crda->crd_skip = 0; 627 crda->crd_len = m->m_pkthdr.len; 628 crda->crd_inject = skip + rplen; 629 630 /* Authentication operation. */ 631 crda->crd_alg = ahx->type; 632 crda->crd_klen = _KEYBITS(sav->key_auth); 633 crda->crd_key = sav->key_auth->key_data; 634 635 /* Find out if we've already done crypto. */ 636 for (mtag = m_tag_find(m, PACKET_TAG_IPSEC_IN_CRYPTO_DONE, NULL); 637 mtag != NULL; 638 mtag = m_tag_find(m, PACKET_TAG_IPSEC_IN_CRYPTO_DONE, mtag)) { 639 tdbi = (struct tdb_ident *) (mtag + 1); 640 if (tdbi->proto == sav->sah->saidx.proto && 641 tdbi->spi == sav->spi && 642 !bcmp(&tdbi->dst, &sav->sah->saidx.dst, 643 sizeof (union sockaddr_union))) 644 break; 645 } 646 647 /* Allocate IPsec-specific opaque crypto info. */ 648 if (mtag == NULL) { 649 tc = (struct tdb_crypto *) malloc(sizeof (struct tdb_crypto) + 650 skip + rplen + authsize, M_XDATA, M_NOWAIT|M_ZERO); 651 } else { 652 /* Hash verification has already been done successfully. */ 653 tc = (struct tdb_crypto *) malloc(sizeof (struct tdb_crypto), 654 M_XDATA, M_NOWAIT|M_ZERO); 655 } 656 if (tc == NULL) { 657 DPRINTF(("%s: failed to allocate tdb_crypto\n", __func__)); 658 AHSTAT_INC(ahs_crypto); 659 crypto_freereq(crp); 660 m_freem(m); 661 return ENOBUFS; 662 } 663 664 /* Only save information if crypto processing is needed. */ 665 if (mtag == NULL) { 666 int error; 667 668 /* 669 * Save the authenticator, the skipped portion of the packet, 670 * and the AH header. 671 */ 672 m_copydata(m, 0, skip + rplen + authsize, (caddr_t)(tc+1)); 673 674 /* Zeroize the authenticator on the packet. */ 675 m_copyback(m, skip + rplen, authsize, ipseczeroes); 676 677 /* Save ah_nxt, since ah pointer can become invalid after "massage" */ 678 hl = ah->ah_nxt; 679 680 /* "Massage" the packet headers for crypto processing. */ 681 error = ah_massage_headers(&m, sav->sah->saidx.dst.sa.sa_family, 682 skip, ahx->type, 0); 683 if (error != 0) { 684 /* NB: mbuf is free'd by ah_massage_headers */ 685 AHSTAT_INC(ahs_hdrops); 686 free(tc, M_XDATA); 687 crypto_freereq(crp); 688 return error; 689 } 690 } 691 692 /* Crypto operation descriptor. */ 693 crp->crp_ilen = m->m_pkthdr.len; /* Total input length. */ 694 crp->crp_flags = CRYPTO_F_IMBUF | CRYPTO_F_CBIFSYNC; 695 crp->crp_buf = (caddr_t) m; 696 crp->crp_callback = ah_input_cb; 697 crp->crp_sid = sav->tdb_cryptoid; 698 crp->crp_opaque = (caddr_t) tc; 699 700 /* These are passed as-is to the callback. */ 701 tc->tc_spi = sav->spi; 702 tc->tc_dst = sav->sah->saidx.dst; 703 tc->tc_proto = sav->sah->saidx.proto; 704 tc->tc_nxt = hl; 705 tc->tc_protoff = protoff; 706 tc->tc_skip = skip; 707 tc->tc_ptr = (caddr_t) mtag; /* Save the mtag we've identified. */ 708 KEY_ADDREFSA(sav); 709 tc->tc_sav = sav; 710 711 if (mtag == NULL) 712 return crypto_dispatch(crp); 713 else 714 return ah_input_cb(crp); 715 } 716 717 /* 718 * AH input callback from the crypto driver. 719 */ 720 static int 721 ah_input_cb(struct cryptop *crp) 722 { 723 int rplen, error, skip, protoff; 724 unsigned char calc[AH_ALEN_MAX]; 725 struct mbuf *m; 726 struct cryptodesc *crd; 727 struct auth_hash *ahx; 728 struct tdb_crypto *tc; 729 struct m_tag *mtag; 730 struct secasvar *sav; 731 struct secasindex *saidx; 732 u_int8_t nxt; 733 caddr_t ptr; 734 int authsize; 735 736 crd = crp->crp_desc; 737 738 tc = (struct tdb_crypto *) crp->crp_opaque; 739 IPSEC_ASSERT(tc != NULL, ("null opaque crypto data area!")); 740 skip = tc->tc_skip; 741 nxt = tc->tc_nxt; 742 protoff = tc->tc_protoff; 743 mtag = (struct m_tag *) tc->tc_ptr; 744 m = (struct mbuf *) crp->crp_buf; 745 746 sav = tc->tc_sav; 747 IPSEC_ASSERT(sav != NULL, ("null SA!")); 748 749 saidx = &sav->sah->saidx; 750 IPSEC_ASSERT(saidx->dst.sa.sa_family == AF_INET || 751 saidx->dst.sa.sa_family == AF_INET6, 752 ("unexpected protocol family %u", saidx->dst.sa.sa_family)); 753 754 ahx = (struct auth_hash *) sav->tdb_authalgxform; 755 756 /* Check for crypto errors. */ 757 if (crp->crp_etype) { 758 if (sav->tdb_cryptoid != 0) 759 sav->tdb_cryptoid = crp->crp_sid; 760 761 if (crp->crp_etype == EAGAIN) 762 return (crypto_dispatch(crp)); 763 764 AHSTAT_INC(ahs_noxform); 765 DPRINTF(("%s: crypto error %d\n", __func__, crp->crp_etype)); 766 error = crp->crp_etype; 767 goto bad; 768 } else { 769 AHSTAT_INC(ahs_hist[sav->alg_auth]); 770 crypto_freereq(crp); /* No longer needed. */ 771 crp = NULL; 772 } 773 774 /* Shouldn't happen... */ 775 if (m == NULL) { 776 AHSTAT_INC(ahs_crypto); 777 DPRINTF(("%s: bogus returned buffer from crypto\n", __func__)); 778 error = EINVAL; 779 goto bad; 780 } 781 782 /* Figure out header size. */ 783 rplen = HDRSIZE(sav); 784 authsize = AUTHSIZE(sav); 785 786 /* Copy authenticator off the packet. */ 787 m_copydata(m, skip + rplen, authsize, calc); 788 789 /* 790 * If we have an mtag, we don't need to verify the authenticator -- 791 * it has been verified by an IPsec-aware NIC. 792 */ 793 if (mtag == NULL) { 794 ptr = (caddr_t) (tc + 1); 795 796 /* Verify authenticator. */ 797 if (bcmp(ptr + skip + rplen, calc, authsize)) { 798 DPRINTF(("%s: authentication hash mismatch for packet " 799 "in SA %s/%08lx\n", __func__, 800 ipsec_address(&saidx->dst), 801 (u_long) ntohl(sav->spi))); 802 AHSTAT_INC(ahs_badauth); 803 error = EACCES; 804 goto bad; 805 } 806 807 /* Fix the Next Protocol field. */ 808 ((u_int8_t *) ptr)[protoff] = nxt; 809 810 /* Copyback the saved (uncooked) network headers. */ 811 m_copyback(m, 0, skip, ptr); 812 } else { 813 /* Fix the Next Protocol field. */ 814 m_copyback(m, protoff, sizeof(u_int8_t), &nxt); 815 } 816 817 free(tc, M_XDATA), tc = NULL; /* No longer needed */ 818 819 /* 820 * Header is now authenticated. 821 */ 822 m->m_flags |= M_AUTHIPHDR|M_AUTHIPDGM; 823 824 /* 825 * Update replay sequence number, if appropriate. 826 */ 827 if (sav->replay) { 828 u_int32_t seq; 829 830 m_copydata(m, skip + offsetof(struct newah, ah_seq), 831 sizeof (seq), (caddr_t) &seq); 832 if (ipsec_updatereplay(ntohl(seq), sav)) { 833 AHSTAT_INC(ahs_replay); 834 error = ENOBUFS; /*XXX as above*/ 835 goto bad; 836 } 837 } 838 839 /* 840 * Remove the AH header and authenticator from the mbuf. 841 */ 842 error = m_striphdr(m, skip, rplen + authsize); 843 if (error) { 844 DPRINTF(("%s: mangled mbuf chain for SA %s/%08lx\n", __func__, 845 ipsec_address(&saidx->dst), (u_long) ntohl(sav->spi))); 846 847 AHSTAT_INC(ahs_hdrops); 848 goto bad; 849 } 850 851 switch (saidx->dst.sa.sa_family) { 852 #ifdef INET6 853 case AF_INET6: 854 error = ipsec6_common_input_cb(m, sav, skip, protoff, mtag); 855 break; 856 #endif 857 #ifdef INET 858 case AF_INET: 859 error = ipsec4_common_input_cb(m, sav, skip, protoff, mtag); 860 break; 861 #endif 862 default: 863 panic("%s: Unexpected address family: %d saidx=%p", __func__, 864 saidx->dst.sa.sa_family, saidx); 865 } 866 867 KEY_FREESAV(&sav); 868 return error; 869 bad: 870 if (sav) 871 KEY_FREESAV(&sav); 872 if (m != NULL) 873 m_freem(m); 874 if (tc != NULL) 875 free(tc, M_XDATA); 876 if (crp != NULL) 877 crypto_freereq(crp); 878 return error; 879 } 880 881 /* 882 * AH output routine, called by ipsec[46]_process_packet(). 883 */ 884 static int 885 ah_output( 886 struct mbuf *m, 887 struct ipsecrequest *isr, 888 struct mbuf **mp, 889 int skip, 890 int protoff) 891 { 892 struct secasvar *sav; 893 struct auth_hash *ahx; 894 struct cryptodesc *crda; 895 struct tdb_crypto *tc; 896 struct mbuf *mi; 897 struct cryptop *crp; 898 u_int16_t iplen; 899 int error, rplen, authsize, maxpacketsize, roff; 900 u_int8_t prot; 901 struct newah *ah; 902 903 sav = isr->sav; 904 IPSEC_ASSERT(sav != NULL, ("null SA")); 905 ahx = sav->tdb_authalgxform; 906 IPSEC_ASSERT(ahx != NULL, ("null authentication xform")); 907 908 AHSTAT_INC(ahs_output); 909 910 /* Figure out header size. */ 911 rplen = HDRSIZE(sav); 912 913 /* Check for maximum packet size violations. */ 914 switch (sav->sah->saidx.dst.sa.sa_family) { 915 #ifdef INET 916 case AF_INET: 917 maxpacketsize = IP_MAXPACKET; 918 break; 919 #endif /* INET */ 920 #ifdef INET6 921 case AF_INET6: 922 maxpacketsize = IPV6_MAXPACKET; 923 break; 924 #endif /* INET6 */ 925 default: 926 DPRINTF(("%s: unknown/unsupported protocol family %u, " 927 "SA %s/%08lx\n", __func__, 928 sav->sah->saidx.dst.sa.sa_family, 929 ipsec_address(&sav->sah->saidx.dst), 930 (u_long) ntohl(sav->spi))); 931 AHSTAT_INC(ahs_nopf); 932 error = EPFNOSUPPORT; 933 goto bad; 934 } 935 authsize = AUTHSIZE(sav); 936 if (rplen + authsize + m->m_pkthdr.len > maxpacketsize) { 937 DPRINTF(("%s: packet in SA %s/%08lx got too big " 938 "(len %u, max len %u)\n", __func__, 939 ipsec_address(&sav->sah->saidx.dst), 940 (u_long) ntohl(sav->spi), 941 rplen + authsize + m->m_pkthdr.len, maxpacketsize)); 942 AHSTAT_INC(ahs_toobig); 943 error = EMSGSIZE; 944 goto bad; 945 } 946 947 /* Update the counters. */ 948 AHSTAT_ADD(ahs_obytes, m->m_pkthdr.len - skip); 949 950 m = m_unshare(m, M_NOWAIT); 951 if (m == NULL) { 952 DPRINTF(("%s: cannot clone mbuf chain, SA %s/%08lx\n", __func__, 953 ipsec_address(&sav->sah->saidx.dst), 954 (u_long) ntohl(sav->spi))); 955 AHSTAT_INC(ahs_hdrops); 956 error = ENOBUFS; 957 goto bad; 958 } 959 960 /* Inject AH header. */ 961 mi = m_makespace(m, skip, rplen + authsize, &roff); 962 if (mi == NULL) { 963 DPRINTF(("%s: failed to inject %u byte AH header for SA " 964 "%s/%08lx\n", __func__, 965 rplen + authsize, 966 ipsec_address(&sav->sah->saidx.dst), 967 (u_long) ntohl(sav->spi))); 968 AHSTAT_INC(ahs_hdrops); /*XXX differs from openbsd */ 969 error = ENOBUFS; 970 goto bad; 971 } 972 973 /* 974 * The AH header is guaranteed by m_makespace() to be in 975 * contiguous memory, at roff bytes offset into the returned mbuf. 976 */ 977 ah = (struct newah *)(mtod(mi, caddr_t) + roff); 978 979 /* Initialize the AH header. */ 980 m_copydata(m, protoff, sizeof(u_int8_t), (caddr_t) &ah->ah_nxt); 981 ah->ah_len = (rplen + authsize - sizeof(struct ah)) / sizeof(u_int32_t); 982 ah->ah_reserve = 0; 983 ah->ah_spi = sav->spi; 984 985 /* Zeroize authenticator. */ 986 m_copyback(m, skip + rplen, authsize, ipseczeroes); 987 988 /* Insert packet replay counter, as requested. */ 989 if (sav->replay) { 990 if (sav->replay->count == ~0 && 991 (sav->flags & SADB_X_EXT_CYCSEQ) == 0) { 992 DPRINTF(("%s: replay counter wrapped for SA %s/%08lx\n", 993 __func__, 994 ipsec_address(&sav->sah->saidx.dst), 995 (u_long) ntohl(sav->spi))); 996 AHSTAT_INC(ahs_wrap); 997 error = EINVAL; 998 goto bad; 999 } 1000 #ifdef REGRESSION 1001 /* Emulate replay attack when ipsec_replay is TRUE. */ 1002 if (!V_ipsec_replay) 1003 #endif 1004 sav->replay->count++; 1005 ah->ah_seq = htonl(sav->replay->count); 1006 } 1007 1008 /* Get crypto descriptors. */ 1009 crp = crypto_getreq(1); 1010 if (crp == NULL) { 1011 DPRINTF(("%s: failed to acquire crypto descriptors\n", 1012 __func__)); 1013 AHSTAT_INC(ahs_crypto); 1014 error = ENOBUFS; 1015 goto bad; 1016 } 1017 1018 crda = crp->crp_desc; 1019 1020 crda->crd_skip = 0; 1021 crda->crd_inject = skip + rplen; 1022 crda->crd_len = m->m_pkthdr.len; 1023 1024 /* Authentication operation. */ 1025 crda->crd_alg = ahx->type; 1026 crda->crd_key = sav->key_auth->key_data; 1027 crda->crd_klen = _KEYBITS(sav->key_auth); 1028 1029 /* Allocate IPsec-specific opaque crypto info. */ 1030 tc = (struct tdb_crypto *) malloc( 1031 sizeof(struct tdb_crypto) + skip, M_XDATA, M_NOWAIT|M_ZERO); 1032 if (tc == NULL) { 1033 crypto_freereq(crp); 1034 DPRINTF(("%s: failed to allocate tdb_crypto\n", __func__)); 1035 AHSTAT_INC(ahs_crypto); 1036 error = ENOBUFS; 1037 goto bad; 1038 } 1039 1040 /* Save the skipped portion of the packet. */ 1041 m_copydata(m, 0, skip, (caddr_t) (tc + 1)); 1042 1043 /* 1044 * Fix IP header length on the header used for 1045 * authentication. We don't need to fix the original 1046 * header length as it will be fixed by our caller. 1047 */ 1048 switch (sav->sah->saidx.dst.sa.sa_family) { 1049 #ifdef INET 1050 case AF_INET: 1051 bcopy(((caddr_t)(tc + 1)) + 1052 offsetof(struct ip, ip_len), 1053 (caddr_t) &iplen, sizeof(u_int16_t)); 1054 iplen = htons(ntohs(iplen) + rplen + authsize); 1055 m_copyback(m, offsetof(struct ip, ip_len), 1056 sizeof(u_int16_t), (caddr_t) &iplen); 1057 break; 1058 #endif /* INET */ 1059 1060 #ifdef INET6 1061 case AF_INET6: 1062 bcopy(((caddr_t)(tc + 1)) + 1063 offsetof(struct ip6_hdr, ip6_plen), 1064 (caddr_t) &iplen, sizeof(u_int16_t)); 1065 iplen = htons(ntohs(iplen) + rplen + authsize); 1066 m_copyback(m, offsetof(struct ip6_hdr, ip6_plen), 1067 sizeof(u_int16_t), (caddr_t) &iplen); 1068 break; 1069 #endif /* INET6 */ 1070 } 1071 1072 /* Fix the Next Header field in saved header. */ 1073 ((u_int8_t *) (tc + 1))[protoff] = IPPROTO_AH; 1074 1075 /* Update the Next Protocol field in the IP header. */ 1076 prot = IPPROTO_AH; 1077 m_copyback(m, protoff, sizeof(u_int8_t), (caddr_t) &prot); 1078 1079 /* "Massage" the packet headers for crypto processing. */ 1080 error = ah_massage_headers(&m, sav->sah->saidx.dst.sa.sa_family, 1081 skip, ahx->type, 1); 1082 if (error != 0) { 1083 m = NULL; /* mbuf was free'd by ah_massage_headers. */ 1084 free(tc, M_XDATA); 1085 crypto_freereq(crp); 1086 goto bad; 1087 } 1088 1089 /* Crypto operation descriptor. */ 1090 crp->crp_ilen = m->m_pkthdr.len; /* Total input length. */ 1091 crp->crp_flags = CRYPTO_F_IMBUF | CRYPTO_F_CBIFSYNC; 1092 crp->crp_buf = (caddr_t) m; 1093 crp->crp_callback = ah_output_cb; 1094 crp->crp_sid = sav->tdb_cryptoid; 1095 crp->crp_opaque = (caddr_t) tc; 1096 1097 /* These are passed as-is to the callback. */ 1098 tc->tc_isr = isr; 1099 KEY_ADDREFSA(sav); 1100 tc->tc_sav = sav; 1101 tc->tc_spi = sav->spi; 1102 tc->tc_dst = sav->sah->saidx.dst; 1103 tc->tc_proto = sav->sah->saidx.proto; 1104 tc->tc_skip = skip; 1105 tc->tc_protoff = protoff; 1106 1107 return crypto_dispatch(crp); 1108 bad: 1109 if (m) 1110 m_freem(m); 1111 return (error); 1112 } 1113 1114 /* 1115 * AH output callback from the crypto driver. 1116 */ 1117 static int 1118 ah_output_cb(struct cryptop *crp) 1119 { 1120 int skip, protoff, error; 1121 struct tdb_crypto *tc; 1122 struct ipsecrequest *isr; 1123 struct secasvar *sav; 1124 struct mbuf *m; 1125 caddr_t ptr; 1126 1127 tc = (struct tdb_crypto *) crp->crp_opaque; 1128 IPSEC_ASSERT(tc != NULL, ("null opaque data area!")); 1129 skip = tc->tc_skip; 1130 protoff = tc->tc_protoff; 1131 ptr = (caddr_t) (tc + 1); 1132 m = (struct mbuf *) crp->crp_buf; 1133 1134 isr = tc->tc_isr; 1135 IPSECREQUEST_LOCK(isr); 1136 sav = tc->tc_sav; 1137 /* With the isr lock released SA pointer can be updated. */ 1138 if (sav != isr->sav) { 1139 AHSTAT_INC(ahs_notdb); 1140 DPRINTF(("%s: SA expired while in crypto\n", __func__)); 1141 error = ENOBUFS; /*XXX*/ 1142 goto bad; 1143 } 1144 1145 /* Check for crypto errors. */ 1146 if (crp->crp_etype) { 1147 if (sav->tdb_cryptoid != 0) 1148 sav->tdb_cryptoid = crp->crp_sid; 1149 1150 if (crp->crp_etype == EAGAIN) { 1151 IPSECREQUEST_UNLOCK(isr); 1152 return (crypto_dispatch(crp)); 1153 } 1154 1155 AHSTAT_INC(ahs_noxform); 1156 DPRINTF(("%s: crypto error %d\n", __func__, crp->crp_etype)); 1157 error = crp->crp_etype; 1158 goto bad; 1159 } 1160 1161 /* Shouldn't happen... */ 1162 if (m == NULL) { 1163 AHSTAT_INC(ahs_crypto); 1164 DPRINTF(("%s: bogus returned buffer from crypto\n", __func__)); 1165 error = EINVAL; 1166 goto bad; 1167 } 1168 AHSTAT_INC(ahs_hist[sav->alg_auth]); 1169 1170 /* 1171 * Copy original headers (with the new protocol number) back 1172 * in place. 1173 */ 1174 m_copyback(m, 0, skip, ptr); 1175 1176 /* No longer needed. */ 1177 free(tc, M_XDATA); 1178 crypto_freereq(crp); 1179 1180 #ifdef REGRESSION 1181 /* Emulate man-in-the-middle attack when ipsec_integrity is TRUE. */ 1182 if (V_ipsec_integrity) { 1183 int alen; 1184 1185 /* 1186 * Corrupt HMAC if we want to test integrity verification of 1187 * the other side. 1188 */ 1189 alen = AUTHSIZE(sav); 1190 m_copyback(m, m->m_pkthdr.len - alen, alen, ipseczeroes); 1191 } 1192 #endif 1193 1194 /* NB: m is reclaimed by ipsec_process_done. */ 1195 error = ipsec_process_done(m, isr); 1196 KEY_FREESAV(&sav); 1197 IPSECREQUEST_UNLOCK(isr); 1198 return error; 1199 bad: 1200 if (sav) 1201 KEY_FREESAV(&sav); 1202 IPSECREQUEST_UNLOCK(isr); 1203 if (m) 1204 m_freem(m); 1205 free(tc, M_XDATA); 1206 crypto_freereq(crp); 1207 return error; 1208 } 1209 1210 static struct xformsw ah_xformsw = { 1211 XF_AH, XFT_AUTH, "IPsec AH", 1212 ah_init, ah_zeroize, ah_input, ah_output, 1213 }; 1214 1215 static void 1216 ah_attach(void) 1217 { 1218 1219 xform_register(&ah_xformsw); 1220 } 1221 1222 SYSINIT(ah_xform_init, SI_SUB_PROTO_DOMAIN, SI_ORDER_MIDDLE, ah_attach, NULL);
Cache object: 6d0111dad3d9e2b727a572db75b334e9
[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]