Now available: The Design and Implementation of the FreeBSD Operating System (Second Edition)
[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]
FreeBSD/Linux Kernel Cross Reference
sys/netipsec/xform_esp.c
Version:
- FREEBSD - FREEBSD-13-STABLE - FREEBSD-13-0 - FREEBSD-12-STABLE - FREEBSD-12-0 - FREEBSD-11-STABLE - FREEBSD-11-0 - FREEBSD-10-STABLE - FREEBSD-10-0 - FREEBSD-9-STABLE - FREEBSD-9-0 - FREEBSD-8-STABLE - FREEBSD-8-0 - FREEBSD-7-STABLE - FREEBSD-7-0 - FREEBSD-6-STABLE - FREEBSD-6-0 - FREEBSD-5-STABLE - FREEBSD-5-0 - FREEBSD-4-STABLE - FREEBSD-3-STABLE - FREEBSD22 - l41 - OPENBSD - linux-2.6 - MK84 - PLAN9 - xnu-8792
SearchContext: - none - 3 - 10
SearchContext: - none - 3 - 10
1 /* $FreeBSD: releng/10.2/sys/netipsec/xform_esp.c 283901 2015-06-02 03:14:42Z ae $ */ 2 /* $OpenBSD: ip_esp.c,v 1.69 2001/06/26 06:18:59 angelos Exp $ */ 3 /*- 4 * The authors of this code are John Ioannidis (ji@tla.org), 5 * Angelos D. Keromytis (kermit@csd.uch.gr) and 6 * Niels Provos (provos@physnet.uni-hamburg.de). 7 * 8 * The original version of this code was written by John Ioannidis 9 * for BSD/OS in Athens, Greece, in November 1995. 10 * 11 * Ported to OpenBSD and NetBSD, with additional transforms, in December 1996, 12 * by Angelos D. Keromytis. 13 * 14 * Additional transforms and features in 1997 and 1998 by Angelos D. Keromytis 15 * and Niels Provos. 16 * 17 * Additional features in 1999 by Angelos D. Keromytis. 18 * 19 * Copyright (C) 1995, 1996, 1997, 1998, 1999 by John Ioannidis, 20 * Angelos D. Keromytis and Niels Provos. 21 * Copyright (c) 2001 Angelos D. Keromytis. 22 * 23 * Permission to use, copy, and modify this software with or without fee 24 * is hereby granted, provided that this entire notice is included in 25 * all copies of any software which is or includes a copy or 26 * modification of this software. 27 * You may use this code under the GNU public license if you so wish. Please 28 * contribute changes back to the authors under this freer than GPL license 29 * so that we may further the use of strong encryption without limitations to 30 * all. 31 * 32 * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR 33 * IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY 34 * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE 35 * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR 36 * PURPOSE. 37 */ 38 #include "opt_inet.h" 39 #include "opt_inet6.h" 40 41 #include <sys/param.h> 42 #include <sys/systm.h> 43 #include <sys/mbuf.h> 44 #include <sys/socket.h> 45 #include <sys/syslog.h> 46 #include <sys/kernel.h> 47 #include <sys/random.h> 48 #include <sys/sysctl.h> 49 50 #include <net/if.h> 51 #include <net/vnet.h> 52 53 #include <netinet/in.h> 54 #include <netinet/in_systm.h> 55 #include <netinet/ip.h> 56 #include <netinet/ip_ecn.h> 57 #include <netinet/ip6.h> 58 59 #include <netipsec/ipsec.h> 60 #include <netipsec/ah.h> 61 #include <netipsec/ah_var.h> 62 #include <netipsec/esp.h> 63 #include <netipsec/esp_var.h> 64 #include <netipsec/xform.h> 65 66 #ifdef INET6 67 #include <netinet6/ip6_var.h> 68 #include <netipsec/ipsec6.h> 69 #include <netinet6/ip6_ecn.h> 70 #endif 71 72 #include <netipsec/key.h> 73 #include <netipsec/key_debug.h> 74 75 #include <opencrypto/cryptodev.h> 76 #include <opencrypto/xform.h> 77 78 VNET_DEFINE(int, esp_enable) = 1; 79 VNET_PCPUSTAT_DEFINE(struct espstat, espstat); 80 VNET_PCPUSTAT_SYSINIT(espstat); 81 82 #ifdef VIMAGE 83 VNET_PCPUSTAT_SYSUNINIT(espstat); 84 #endif /* VIMAGE */ 85 86 SYSCTL_DECL(_net_inet_esp); 87 SYSCTL_VNET_INT(_net_inet_esp, OID_AUTO, 88 esp_enable, CTLFLAG_RW, &VNET_NAME(esp_enable), 0, ""); 89 SYSCTL_VNET_PCPUSTAT(_net_inet_esp, IPSECCTL_STATS, stats, 90 struct espstat, espstat, 91 "ESP statistics (struct espstat, netipsec/esp_var.h"); 92 93 static int esp_input_cb(struct cryptop *op); 94 static int esp_output_cb(struct cryptop *crp); 95 96 /* 97 * NB: this is public for use by the PF_KEY support. 98 * NB: if you add support here; be sure to add code to esp_attach below! 99 */ 100 struct enc_xform * 101 esp_algorithm_lookup(int alg) 102 { 103 if (alg >= ESP_ALG_MAX) 104 return NULL; 105 switch (alg) { 106 case SADB_EALG_DESCBC: 107 return &enc_xform_des; 108 case SADB_EALG_3DESCBC: 109 return &enc_xform_3des; 110 case SADB_X_EALG_AES: 111 return &enc_xform_rijndael128; 112 case SADB_X_EALG_BLOWFISHCBC: 113 return &enc_xform_blf; 114 case SADB_X_EALG_CAST128CBC: 115 return &enc_xform_cast5; 116 case SADB_X_EALG_SKIPJACK: 117 return &enc_xform_skipjack; 118 case SADB_EALG_NULL: 119 return &enc_xform_null; 120 case SADB_X_EALG_CAMELLIACBC: 121 return &enc_xform_camellia; 122 } 123 return NULL; 124 } 125 126 size_t 127 esp_hdrsiz(struct secasvar *sav) 128 { 129 size_t size; 130 131 if (sav != NULL) { 132 /*XXX not right for null algorithm--does it matter??*/ 133 IPSEC_ASSERT(sav->tdb_encalgxform != NULL, 134 ("SA with null xform")); 135 if (sav->flags & SADB_X_EXT_OLD) 136 size = sizeof (struct esp); 137 else 138 size = sizeof (struct newesp); 139 size += sav->tdb_encalgxform->blocksize + 9; 140 /*XXX need alg check???*/ 141 if (sav->tdb_authalgxform != NULL && sav->replay) 142 size += ah_hdrsiz(sav); 143 } else { 144 /* 145 * base header size 146 * + max iv length for CBC mode 147 * + max pad length 148 * + sizeof (pad length field) 149 * + sizeof (next header field) 150 * + max icv supported. 151 */ 152 size = sizeof (struct newesp) + EALG_MAX_BLOCK_LEN + 9 + 16; 153 } 154 return size; 155 } 156 157 /* 158 * esp_init() is called when an SPI is being set up. 159 */ 160 static int 161 esp_init(struct secasvar *sav, struct xformsw *xsp) 162 { 163 struct enc_xform *txform; 164 struct cryptoini cria, crie; 165 int keylen; 166 int error; 167 168 txform = esp_algorithm_lookup(sav->alg_enc); 169 if (txform == NULL) { 170 DPRINTF(("%s: unsupported encryption algorithm %d\n", 171 __func__, sav->alg_enc)); 172 return EINVAL; 173 } 174 if (sav->key_enc == NULL) { 175 DPRINTF(("%s: no encoding key for %s algorithm\n", 176 __func__, txform->name)); 177 return EINVAL; 178 } 179 if ((sav->flags&(SADB_X_EXT_OLD|SADB_X_EXT_IV4B)) == SADB_X_EXT_IV4B) { 180 DPRINTF(("%s: 4-byte IV not supported with protocol\n", 181 __func__)); 182 return EINVAL; 183 } 184 keylen = _KEYLEN(sav->key_enc); 185 if (txform->minkey > keylen || keylen > txform->maxkey) { 186 DPRINTF(("%s: invalid key length %u, must be in the range " 187 "[%u..%u] for algorithm %s\n", __func__, 188 keylen, txform->minkey, txform->maxkey, 189 txform->name)); 190 return EINVAL; 191 } 192 193 /* 194 * NB: The null xform needs a non-zero blocksize to keep the 195 * crypto code happy but if we use it to set ivlen then 196 * the ESP header will be processed incorrectly. The 197 * compromise is to force it to zero here. 198 */ 199 sav->ivlen = (txform == &enc_xform_null ? 0 : txform->blocksize); 200 sav->iv = (caddr_t) malloc(sav->ivlen, M_XDATA, M_WAITOK); 201 key_randomfill(sav->iv, sav->ivlen); /*XXX*/ 202 203 /* 204 * Setup AH-related state. 205 */ 206 if (sav->alg_auth != 0) { 207 error = ah_init0(sav, xsp, &cria); 208 if (error) 209 return error; 210 } 211 212 /* NB: override anything set in ah_init0 */ 213 sav->tdb_xform = xsp; 214 sav->tdb_encalgxform = txform; 215 216 /* Initialize crypto session. */ 217 bzero(&crie, sizeof (crie)); 218 crie.cri_alg = sav->tdb_encalgxform->type; 219 crie.cri_klen = _KEYBITS(sav->key_enc); 220 crie.cri_key = sav->key_enc->key_data; 221 /* XXX Rounds ? */ 222 223 if (sav->tdb_authalgxform && sav->tdb_encalgxform) { 224 /* init both auth & enc */ 225 crie.cri_next = &cria; 226 error = crypto_newsession(&sav->tdb_cryptoid, 227 &crie, V_crypto_support); 228 } else if (sav->tdb_encalgxform) { 229 error = crypto_newsession(&sav->tdb_cryptoid, 230 &crie, V_crypto_support); 231 } else if (sav->tdb_authalgxform) { 232 error = crypto_newsession(&sav->tdb_cryptoid, 233 &cria, V_crypto_support); 234 } else { 235 /* XXX cannot happen? */ 236 DPRINTF(("%s: no encoding OR authentication xform!\n", 237 __func__)); 238 error = EINVAL; 239 } 240 return error; 241 } 242 243 /* 244 * Paranoia. 245 */ 246 static int 247 esp_zeroize(struct secasvar *sav) 248 { 249 /* NB: ah_zerorize free's the crypto session state */ 250 int error = ah_zeroize(sav); 251 252 if (sav->key_enc) 253 bzero(sav->key_enc->key_data, _KEYLEN(sav->key_enc)); 254 if (sav->iv) { 255 free(sav->iv, M_XDATA); 256 sav->iv = NULL; 257 } 258 sav->tdb_encalgxform = NULL; 259 sav->tdb_xform = NULL; 260 return error; 261 } 262 263 /* 264 * ESP input processing, called (eventually) through the protocol switch. 265 */ 266 static int 267 esp_input(struct mbuf *m, struct secasvar *sav, int skip, int protoff) 268 { 269 struct auth_hash *esph; 270 struct enc_xform *espx; 271 struct tdb_ident *tdbi; 272 struct tdb_crypto *tc; 273 int plen, alen, hlen; 274 struct m_tag *mtag; 275 struct newesp *esp; 276 277 struct cryptodesc *crde; 278 struct cryptop *crp; 279 280 IPSEC_ASSERT(sav != NULL, ("null SA")); 281 IPSEC_ASSERT(sav->tdb_encalgxform != NULL, ("null encoding xform")); 282 283 /* Valid IP Packet length ? */ 284 if ( (skip&3) || (m->m_pkthdr.len&3) ){ 285 DPRINTF(("%s: misaligned packet, skip %u pkt len %u", 286 __func__, skip, m->m_pkthdr.len)); 287 ESPSTAT_INC(esps_badilen); 288 m_freem(m); 289 return EINVAL; 290 } 291 292 /* XXX don't pullup, just copy header */ 293 IP6_EXTHDR_GET(esp, struct newesp *, m, skip, sizeof (struct newesp)); 294 295 esph = sav->tdb_authalgxform; 296 espx = sav->tdb_encalgxform; 297 298 /* Determine the ESP header length */ 299 if (sav->flags & SADB_X_EXT_OLD) 300 hlen = sizeof (struct esp) + sav->ivlen; 301 else 302 hlen = sizeof (struct newesp) + sav->ivlen; 303 /* Authenticator hash size */ 304 if (esph != NULL) { 305 switch (esph->type) { 306 case CRYPTO_SHA2_256_HMAC: 307 case CRYPTO_SHA2_384_HMAC: 308 case CRYPTO_SHA2_512_HMAC: 309 alen = esph->hashsize/2; 310 break; 311 default: 312 alen = AH_HMAC_HASHLEN; 313 break; 314 } 315 }else 316 alen = 0; 317 318 /* 319 * Verify payload length is multiple of encryption algorithm 320 * block size. 321 * 322 * NB: This works for the null algorithm because the blocksize 323 * is 4 and all packets must be 4-byte aligned regardless 324 * of the algorithm. 325 */ 326 plen = m->m_pkthdr.len - (skip + hlen + alen); 327 if ((plen & (espx->blocksize - 1)) || (plen <= 0)) { 328 DPRINTF(("%s: payload of %d octets not a multiple of %d octets," 329 " SA %s/%08lx\n", __func__, 330 plen, espx->blocksize, 331 ipsec_address(&sav->sah->saidx.dst), 332 (u_long) ntohl(sav->spi))); 333 ESPSTAT_INC(esps_badilen); 334 m_freem(m); 335 return EINVAL; 336 } 337 338 /* 339 * Check sequence number. 340 */ 341 if (esph && sav->replay && !ipsec_chkreplay(ntohl(esp->esp_seq), sav)) { 342 DPRINTF(("%s: packet replay check for %s\n", __func__, 343 ipsec_logsastr(sav))); /*XXX*/ 344 ESPSTAT_INC(esps_replay); 345 m_freem(m); 346 return ENOBUFS; /*XXX*/ 347 } 348 349 /* Update the counters */ 350 ESPSTAT_ADD(esps_ibytes, m->m_pkthdr.len - (skip + hlen + alen)); 351 352 /* Find out if we've already done crypto */ 353 for (mtag = m_tag_find(m, PACKET_TAG_IPSEC_IN_CRYPTO_DONE, NULL); 354 mtag != NULL; 355 mtag = m_tag_find(m, PACKET_TAG_IPSEC_IN_CRYPTO_DONE, mtag)) { 356 tdbi = (struct tdb_ident *) (mtag + 1); 357 if (tdbi->proto == sav->sah->saidx.proto && 358 tdbi->spi == sav->spi && 359 !bcmp(&tdbi->dst, &sav->sah->saidx.dst, 360 sizeof(union sockaddr_union))) 361 break; 362 } 363 364 /* Get crypto descriptors */ 365 crp = crypto_getreq(esph && espx ? 2 : 1); 366 if (crp == NULL) { 367 DPRINTF(("%s: failed to acquire crypto descriptors\n", 368 __func__)); 369 ESPSTAT_INC(esps_crypto); 370 m_freem(m); 371 return ENOBUFS; 372 } 373 374 /* Get IPsec-specific opaque pointer */ 375 if (esph == NULL || mtag != NULL) 376 tc = (struct tdb_crypto *) malloc(sizeof(struct tdb_crypto), 377 M_XDATA, M_NOWAIT|M_ZERO); 378 else 379 tc = (struct tdb_crypto *) malloc(sizeof(struct tdb_crypto) + alen, 380 M_XDATA, M_NOWAIT|M_ZERO); 381 if (tc == NULL) { 382 crypto_freereq(crp); 383 DPRINTF(("%s: failed to allocate tdb_crypto\n", __func__)); 384 ESPSTAT_INC(esps_crypto); 385 m_freem(m); 386 return ENOBUFS; 387 } 388 389 tc->tc_ptr = (caddr_t) mtag; 390 391 if (esph) { 392 struct cryptodesc *crda = crp->crp_desc; 393 394 IPSEC_ASSERT(crda != NULL, ("null ah crypto descriptor")); 395 396 /* Authentication descriptor */ 397 crda->crd_skip = skip; 398 crda->crd_len = m->m_pkthdr.len - (skip + alen); 399 crda->crd_inject = m->m_pkthdr.len - alen; 400 401 crda->crd_alg = esph->type; 402 crda->crd_key = sav->key_auth->key_data; 403 crda->crd_klen = _KEYBITS(sav->key_auth); 404 405 /* Copy the authenticator */ 406 if (mtag == NULL) 407 m_copydata(m, m->m_pkthdr.len - alen, alen, 408 (caddr_t) (tc + 1)); 409 410 /* Chain authentication request */ 411 crde = crda->crd_next; 412 } else { 413 crde = crp->crp_desc; 414 } 415 416 /* Crypto operation descriptor */ 417 crp->crp_ilen = m->m_pkthdr.len; /* Total input length */ 418 crp->crp_flags = CRYPTO_F_IMBUF | CRYPTO_F_CBIFSYNC; 419 crp->crp_buf = (caddr_t) m; 420 crp->crp_callback = esp_input_cb; 421 crp->crp_sid = sav->tdb_cryptoid; 422 crp->crp_opaque = (caddr_t) tc; 423 424 /* These are passed as-is to the callback */ 425 tc->tc_spi = sav->spi; 426 tc->tc_dst = sav->sah->saidx.dst; 427 tc->tc_proto = sav->sah->saidx.proto; 428 tc->tc_protoff = protoff; 429 tc->tc_skip = skip; 430 KEY_ADDREFSA(sav); 431 tc->tc_sav = sav; 432 433 /* Decryption descriptor */ 434 if (espx) { 435 IPSEC_ASSERT(crde != NULL, ("null esp crypto descriptor")); 436 crde->crd_skip = skip + hlen; 437 crde->crd_len = m->m_pkthdr.len - (skip + hlen + alen); 438 crde->crd_inject = skip + hlen - sav->ivlen; 439 440 crde->crd_alg = espx->type; 441 crde->crd_key = sav->key_enc->key_data; 442 crde->crd_klen = _KEYBITS(sav->key_enc); 443 /* XXX Rounds ? */ 444 } 445 446 if (mtag == NULL) 447 return crypto_dispatch(crp); 448 else 449 return esp_input_cb(crp); 450 } 451 452 /* 453 * ESP input callback from the crypto driver. 454 */ 455 static int 456 esp_input_cb(struct cryptop *crp) 457 { 458 u_int8_t lastthree[3], aalg[AH_HMAC_MAXHASHLEN]; 459 int hlen, skip, protoff, error, alen; 460 struct mbuf *m; 461 struct cryptodesc *crd; 462 struct auth_hash *esph; 463 struct enc_xform *espx; 464 struct tdb_crypto *tc; 465 struct m_tag *mtag; 466 struct secasvar *sav; 467 struct secasindex *saidx; 468 caddr_t ptr; 469 470 crd = crp->crp_desc; 471 IPSEC_ASSERT(crd != NULL, ("null crypto descriptor!")); 472 473 tc = (struct tdb_crypto *) crp->crp_opaque; 474 IPSEC_ASSERT(tc != NULL, ("null opaque crypto data area!")); 475 skip = tc->tc_skip; 476 protoff = tc->tc_protoff; 477 mtag = (struct m_tag *) tc->tc_ptr; 478 m = (struct mbuf *) crp->crp_buf; 479 480 sav = tc->tc_sav; 481 IPSEC_ASSERT(sav != NULL, ("null SA!")); 482 483 saidx = &sav->sah->saidx; 484 IPSEC_ASSERT(saidx->dst.sa.sa_family == AF_INET || 485 saidx->dst.sa.sa_family == AF_INET6, 486 ("unexpected protocol family %u", saidx->dst.sa.sa_family)); 487 488 esph = sav->tdb_authalgxform; 489 espx = sav->tdb_encalgxform; 490 491 /* Check for crypto errors */ 492 if (crp->crp_etype) { 493 /* Reset the session ID */ 494 if (sav->tdb_cryptoid != 0) 495 sav->tdb_cryptoid = crp->crp_sid; 496 497 if (crp->crp_etype == EAGAIN) 498 return (crypto_dispatch(crp)); 499 500 ESPSTAT_INC(esps_noxform); 501 DPRINTF(("%s: crypto error %d\n", __func__, crp->crp_etype)); 502 error = crp->crp_etype; 503 goto bad; 504 } 505 506 /* Shouldn't happen... */ 507 if (m == NULL) { 508 ESPSTAT_INC(esps_crypto); 509 DPRINTF(("%s: bogus returned buffer from crypto\n", __func__)); 510 error = EINVAL; 511 goto bad; 512 } 513 ESPSTAT_INC(esps_hist[sav->alg_enc]); 514 515 /* If authentication was performed, check now. */ 516 if (esph != NULL) { 517 switch (esph->type) { 518 case CRYPTO_SHA2_256_HMAC: 519 case CRYPTO_SHA2_384_HMAC: 520 case CRYPTO_SHA2_512_HMAC: 521 alen = esph->hashsize/2; 522 break; 523 default: 524 alen = AH_HMAC_HASHLEN; 525 break; 526 } 527 /* 528 * If we have a tag, it means an IPsec-aware NIC did 529 * the verification for us. Otherwise we need to 530 * check the authentication calculation. 531 */ 532 AHSTAT_INC(ahs_hist[sav->alg_auth]); 533 if (mtag == NULL) { 534 /* Copy the authenticator from the packet */ 535 m_copydata(m, m->m_pkthdr.len - alen, 536 alen, aalg); 537 538 ptr = (caddr_t) (tc + 1); 539 540 /* Verify authenticator */ 541 if (bcmp(ptr, aalg, alen) != 0) { 542 DPRINTF(("%s: " 543 "authentication hash mismatch for packet in SA %s/%08lx\n", 544 __func__, 545 ipsec_address(&saidx->dst), 546 (u_long) ntohl(sav->spi))); 547 ESPSTAT_INC(esps_badauth); 548 error = EACCES; 549 goto bad; 550 } 551 } 552 553 /* Remove trailing authenticator */ 554 m_adj(m, -alen); 555 } 556 557 /* Release the crypto descriptors */ 558 free(tc, M_XDATA), tc = NULL; 559 crypto_freereq(crp), crp = NULL; 560 561 /* 562 * Packet is now decrypted. 563 */ 564 m->m_flags |= M_DECRYPTED; 565 566 /* 567 * Update replay sequence number, if appropriate. 568 */ 569 if (sav->replay) { 570 u_int32_t seq; 571 572 m_copydata(m, skip + offsetof(struct newesp, esp_seq), 573 sizeof (seq), (caddr_t) &seq); 574 if (ipsec_updatereplay(ntohl(seq), sav)) { 575 DPRINTF(("%s: packet replay check for %s\n", __func__, 576 ipsec_logsastr(sav))); 577 ESPSTAT_INC(esps_replay); 578 error = ENOBUFS; 579 goto bad; 580 } 581 } 582 583 /* Determine the ESP header length */ 584 if (sav->flags & SADB_X_EXT_OLD) 585 hlen = sizeof (struct esp) + sav->ivlen; 586 else 587 hlen = sizeof (struct newesp) + sav->ivlen; 588 589 /* Remove the ESP header and IV from the mbuf. */ 590 error = m_striphdr(m, skip, hlen); 591 if (error) { 592 ESPSTAT_INC(esps_hdrops); 593 DPRINTF(("%s: bad mbuf chain, SA %s/%08lx\n", __func__, 594 ipsec_address(&sav->sah->saidx.dst), 595 (u_long) ntohl(sav->spi))); 596 goto bad; 597 } 598 599 /* Save the last three bytes of decrypted data */ 600 m_copydata(m, m->m_pkthdr.len - 3, 3, lastthree); 601 602 /* Verify pad length */ 603 if (lastthree[1] + 2 > m->m_pkthdr.len - skip) { 604 ESPSTAT_INC(esps_badilen); 605 DPRINTF(("%s: invalid padding length %d for %u byte packet " 606 "in SA %s/%08lx\n", __func__, 607 lastthree[1], m->m_pkthdr.len - skip, 608 ipsec_address(&sav->sah->saidx.dst), 609 (u_long) ntohl(sav->spi))); 610 error = EINVAL; 611 goto bad; 612 } 613 614 /* Verify correct decryption by checking the last padding bytes */ 615 if ((sav->flags & SADB_X_EXT_PMASK) != SADB_X_EXT_PRAND) { 616 if (lastthree[1] != lastthree[0] && lastthree[1] != 0) { 617 ESPSTAT_INC(esps_badenc); 618 DPRINTF(("%s: decryption failed for packet in " 619 "SA %s/%08lx\n", __func__, 620 ipsec_address(&sav->sah->saidx.dst), 621 (u_long) ntohl(sav->spi))); 622 error = EINVAL; 623 goto bad; 624 } 625 } 626 627 /* Trim the mbuf chain to remove trailing authenticator and padding */ 628 m_adj(m, -(lastthree[1] + 2)); 629 630 /* Restore the Next Protocol field */ 631 m_copyback(m, protoff, sizeof (u_int8_t), lastthree + 2); 632 633 switch (saidx->dst.sa.sa_family) { 634 #ifdef INET6 635 case AF_INET6: 636 error = ipsec6_common_input_cb(m, sav, skip, protoff, mtag); 637 break; 638 #endif 639 #ifdef INET 640 case AF_INET: 641 error = ipsec4_common_input_cb(m, sav, skip, protoff, mtag); 642 break; 643 #endif 644 default: 645 panic("%s: Unexpected address family: %d saidx=%p", __func__, 646 saidx->dst.sa.sa_family, saidx); 647 } 648 649 KEY_FREESAV(&sav); 650 return error; 651 bad: 652 if (sav) 653 KEY_FREESAV(&sav); 654 if (m != NULL) 655 m_freem(m); 656 if (tc != NULL) 657 free(tc, M_XDATA); 658 if (crp != NULL) 659 crypto_freereq(crp); 660 return error; 661 } 662 663 /* 664 * ESP output routine, called by ipsec[46]_process_packet(). 665 */ 666 static int 667 esp_output( 668 struct mbuf *m, 669 struct ipsecrequest *isr, 670 struct mbuf **mp, 671 int skip, 672 int protoff 673 ) 674 { 675 struct enc_xform *espx; 676 struct auth_hash *esph; 677 int hlen, rlen, padding, blks, alen, i, roff; 678 struct mbuf *mo = (struct mbuf *) NULL; 679 struct tdb_crypto *tc; 680 struct secasvar *sav; 681 struct secasindex *saidx; 682 unsigned char *pad; 683 u_int8_t prot; 684 int error, maxpacketsize; 685 686 struct cryptodesc *crde = NULL, *crda = NULL; 687 struct cryptop *crp; 688 689 sav = isr->sav; 690 IPSEC_ASSERT(sav != NULL, ("null SA")); 691 esph = sav->tdb_authalgxform; 692 espx = sav->tdb_encalgxform; 693 IPSEC_ASSERT(espx != NULL, ("null encoding xform")); 694 695 if (sav->flags & SADB_X_EXT_OLD) 696 hlen = sizeof (struct esp) + sav->ivlen; 697 else 698 hlen = sizeof (struct newesp) + sav->ivlen; 699 700 rlen = m->m_pkthdr.len - skip; /* Raw payload length. */ 701 /* 702 * NB: The null encoding transform has a blocksize of 4 703 * so that headers are properly aligned. 704 */ 705 blks = espx->blocksize; /* IV blocksize */ 706 707 /* XXX clamp padding length a la KAME??? */ 708 padding = ((blks - ((rlen + 2) % blks)) % blks) + 2; 709 710 if (esph) 711 switch (esph->type) { 712 case CRYPTO_SHA2_256_HMAC: 713 case CRYPTO_SHA2_384_HMAC: 714 case CRYPTO_SHA2_512_HMAC: 715 alen = esph->hashsize/2; 716 break; 717 default: 718 alen = AH_HMAC_HASHLEN; 719 break; 720 } 721 else 722 alen = 0; 723 724 ESPSTAT_INC(esps_output); 725 726 saidx = &sav->sah->saidx; 727 /* Check for maximum packet size violations. */ 728 switch (saidx->dst.sa.sa_family) { 729 #ifdef INET 730 case AF_INET: 731 maxpacketsize = IP_MAXPACKET; 732 break; 733 #endif /* INET */ 734 #ifdef INET6 735 case AF_INET6: 736 maxpacketsize = IPV6_MAXPACKET; 737 break; 738 #endif /* INET6 */ 739 default: 740 DPRINTF(("%s: unknown/unsupported protocol " 741 "family %d, SA %s/%08lx\n", __func__, 742 saidx->dst.sa.sa_family, ipsec_address(&saidx->dst), 743 (u_long) ntohl(sav->spi))); 744 ESPSTAT_INC(esps_nopf); 745 error = EPFNOSUPPORT; 746 goto bad; 747 } 748 if (skip + hlen + rlen + padding + alen > maxpacketsize) { 749 DPRINTF(("%s: packet in SA %s/%08lx got too big " 750 "(len %u, max len %u)\n", __func__, 751 ipsec_address(&saidx->dst), (u_long) ntohl(sav->spi), 752 skip + hlen + rlen + padding + alen, maxpacketsize)); 753 ESPSTAT_INC(esps_toobig); 754 error = EMSGSIZE; 755 goto bad; 756 } 757 758 /* Update the counters. */ 759 ESPSTAT_ADD(esps_obytes, m->m_pkthdr.len - skip); 760 761 m = m_unshare(m, M_NOWAIT); 762 if (m == NULL) { 763 DPRINTF(("%s: cannot clone mbuf chain, SA %s/%08lx\n", __func__, 764 ipsec_address(&saidx->dst), (u_long) ntohl(sav->spi))); 765 ESPSTAT_INC(esps_hdrops); 766 error = ENOBUFS; 767 goto bad; 768 } 769 770 /* Inject ESP header. */ 771 mo = m_makespace(m, skip, hlen, &roff); 772 if (mo == NULL) { 773 DPRINTF(("%s: %u byte ESP hdr inject failed for SA %s/%08lx\n", 774 __func__, hlen, ipsec_address(&saidx->dst), 775 (u_long) ntohl(sav->spi))); 776 ESPSTAT_INC(esps_hdrops); /* XXX diffs from openbsd */ 777 error = ENOBUFS; 778 goto bad; 779 } 780 781 /* Initialize ESP header. */ 782 bcopy((caddr_t) &sav->spi, mtod(mo, caddr_t) + roff, sizeof(u_int32_t)); 783 if (sav->replay) { 784 u_int32_t replay; 785 786 #ifdef REGRESSION 787 /* Emulate replay attack when ipsec_replay is TRUE. */ 788 if (!V_ipsec_replay) 789 #endif 790 sav->replay->count++; 791 replay = htonl(sav->replay->count); 792 bcopy((caddr_t) &replay, 793 mtod(mo, caddr_t) + roff + sizeof(u_int32_t), 794 sizeof(u_int32_t)); 795 } 796 797 /* 798 * Add padding -- better to do it ourselves than use the crypto engine, 799 * although if/when we support compression, we'd have to do that. 800 */ 801 pad = (u_char *) m_pad(m, padding + alen); 802 if (pad == NULL) { 803 DPRINTF(("%s: m_pad failed for SA %s/%08lx\n", __func__, 804 ipsec_address(&saidx->dst), (u_long) ntohl(sav->spi))); 805 m = NULL; /* NB: free'd by m_pad */ 806 error = ENOBUFS; 807 goto bad; 808 } 809 810 /* 811 * Add padding: random, zero, or self-describing. 812 * XXX catch unexpected setting 813 */ 814 switch (sav->flags & SADB_X_EXT_PMASK) { 815 case SADB_X_EXT_PRAND: 816 (void) read_random(pad, padding - 2); 817 break; 818 case SADB_X_EXT_PZERO: 819 bzero(pad, padding - 2); 820 break; 821 case SADB_X_EXT_PSEQ: 822 for (i = 0; i < padding - 2; i++) 823 pad[i] = i+1; 824 break; 825 } 826 827 /* Fix padding length and Next Protocol in padding itself. */ 828 pad[padding - 2] = padding - 2; 829 m_copydata(m, protoff, sizeof(u_int8_t), pad + padding - 1); 830 831 /* Fix Next Protocol in IPv4/IPv6 header. */ 832 prot = IPPROTO_ESP; 833 m_copyback(m, protoff, sizeof(u_int8_t), (u_char *) &prot); 834 835 /* Get crypto descriptors. */ 836 crp = crypto_getreq(esph && espx ? 2 : 1); 837 if (crp == NULL) { 838 DPRINTF(("%s: failed to acquire crypto descriptors\n", 839 __func__)); 840 ESPSTAT_INC(esps_crypto); 841 error = ENOBUFS; 842 goto bad; 843 } 844 845 if (espx) { 846 crde = crp->crp_desc; 847 crda = crde->crd_next; 848 849 /* Encryption descriptor. */ 850 crde->crd_skip = skip + hlen; 851 crde->crd_len = m->m_pkthdr.len - (skip + hlen + alen); 852 crde->crd_flags = CRD_F_ENCRYPT; 853 crde->crd_inject = skip + hlen - sav->ivlen; 854 855 /* Encryption operation. */ 856 crde->crd_alg = espx->type; 857 crde->crd_key = sav->key_enc->key_data; 858 crde->crd_klen = _KEYBITS(sav->key_enc); 859 /* XXX Rounds ? */ 860 } else 861 crda = crp->crp_desc; 862 863 /* IPsec-specific opaque crypto info. */ 864 tc = (struct tdb_crypto *) malloc(sizeof(struct tdb_crypto), 865 M_XDATA, M_NOWAIT|M_ZERO); 866 if (tc == NULL) { 867 crypto_freereq(crp); 868 DPRINTF(("%s: failed to allocate tdb_crypto\n", __func__)); 869 ESPSTAT_INC(esps_crypto); 870 error = ENOBUFS; 871 goto bad; 872 } 873 874 /* Callback parameters */ 875 tc->tc_isr = isr; 876 KEY_ADDREFSA(sav); 877 tc->tc_sav = sav; 878 tc->tc_spi = sav->spi; 879 tc->tc_dst = saidx->dst; 880 tc->tc_proto = saidx->proto; 881 882 /* Crypto operation descriptor. */ 883 crp->crp_ilen = m->m_pkthdr.len; /* Total input length. */ 884 crp->crp_flags = CRYPTO_F_IMBUF | CRYPTO_F_CBIFSYNC; 885 crp->crp_buf = (caddr_t) m; 886 crp->crp_callback = esp_output_cb; 887 crp->crp_opaque = (caddr_t) tc; 888 crp->crp_sid = sav->tdb_cryptoid; 889 890 if (esph) { 891 /* Authentication descriptor. */ 892 crda->crd_skip = skip; 893 crda->crd_len = m->m_pkthdr.len - (skip + alen); 894 crda->crd_inject = m->m_pkthdr.len - alen; 895 896 /* Authentication operation. */ 897 crda->crd_alg = esph->type; 898 crda->crd_key = sav->key_auth->key_data; 899 crda->crd_klen = _KEYBITS(sav->key_auth); 900 } 901 902 return crypto_dispatch(crp); 903 bad: 904 if (m) 905 m_freem(m); 906 return (error); 907 } 908 909 /* 910 * ESP output callback from the crypto driver. 911 */ 912 static int 913 esp_output_cb(struct cryptop *crp) 914 { 915 struct tdb_crypto *tc; 916 struct ipsecrequest *isr; 917 struct secasvar *sav; 918 struct mbuf *m; 919 int error; 920 921 tc = (struct tdb_crypto *) crp->crp_opaque; 922 IPSEC_ASSERT(tc != NULL, ("null opaque data area!")); 923 m = (struct mbuf *) crp->crp_buf; 924 925 isr = tc->tc_isr; 926 IPSECREQUEST_LOCK(isr); 927 sav = tc->tc_sav; 928 /* With the isr lock released SA pointer can be updated. */ 929 if (sav != isr->sav) { 930 ESPSTAT_INC(esps_notdb); 931 DPRINTF(("%s: SA gone during crypto (SA %s/%08lx proto %u)\n", 932 __func__, ipsec_address(&tc->tc_dst), 933 (u_long) ntohl(tc->tc_spi), tc->tc_proto)); 934 error = ENOBUFS; /*XXX*/ 935 goto bad; 936 } 937 938 /* Check for crypto errors. */ 939 if (crp->crp_etype) { 940 /* Reset session ID. */ 941 if (sav->tdb_cryptoid != 0) 942 sav->tdb_cryptoid = crp->crp_sid; 943 944 if (crp->crp_etype == EAGAIN) { 945 IPSECREQUEST_UNLOCK(isr); 946 return (crypto_dispatch(crp)); 947 } 948 949 ESPSTAT_INC(esps_noxform); 950 DPRINTF(("%s: crypto error %d\n", __func__, crp->crp_etype)); 951 error = crp->crp_etype; 952 goto bad; 953 } 954 955 /* Shouldn't happen... */ 956 if (m == NULL) { 957 ESPSTAT_INC(esps_crypto); 958 DPRINTF(("%s: bogus returned buffer from crypto\n", __func__)); 959 error = EINVAL; 960 goto bad; 961 } 962 ESPSTAT_INC(esps_hist[sav->alg_enc]); 963 if (sav->tdb_authalgxform != NULL) 964 AHSTAT_INC(ahs_hist[sav->alg_auth]); 965 966 /* Release crypto descriptors. */ 967 free(tc, M_XDATA); 968 crypto_freereq(crp); 969 970 #ifdef REGRESSION 971 /* Emulate man-in-the-middle attack when ipsec_integrity is TRUE. */ 972 if (V_ipsec_integrity) { 973 static unsigned char ipseczeroes[AH_HMAC_MAXHASHLEN]; 974 struct auth_hash *esph; 975 976 /* 977 * Corrupt HMAC if we want to test integrity verification of 978 * the other side. 979 */ 980 esph = sav->tdb_authalgxform; 981 if (esph != NULL) { 982 int alen; 983 984 switch (esph->type) { 985 case CRYPTO_SHA2_256_HMAC: 986 case CRYPTO_SHA2_384_HMAC: 987 case CRYPTO_SHA2_512_HMAC: 988 alen = esph->hashsize/2; 989 break; 990 default: 991 alen = AH_HMAC_HASHLEN; 992 break; 993 } 994 m_copyback(m, m->m_pkthdr.len - alen, 995 alen, ipseczeroes); 996 } 997 } 998 #endif 999 1000 /* NB: m is reclaimed by ipsec_process_done. */ 1001 error = ipsec_process_done(m, isr); 1002 KEY_FREESAV(&sav); 1003 IPSECREQUEST_UNLOCK(isr); 1004 return error; 1005 bad: 1006 if (sav) 1007 KEY_FREESAV(&sav); 1008 IPSECREQUEST_UNLOCK(isr); 1009 if (m) 1010 m_freem(m); 1011 free(tc, M_XDATA); 1012 crypto_freereq(crp); 1013 return error; 1014 } 1015 1016 static struct xformsw esp_xformsw = { 1017 XF_ESP, XFT_CONF|XFT_AUTH, "IPsec ESP", 1018 esp_init, esp_zeroize, esp_input, 1019 esp_output 1020 }; 1021 1022 static void 1023 esp_attach(void) 1024 { 1025 1026 xform_register(&esp_xformsw); 1027 } 1028 SYSINIT(esp_xform_init, SI_SUB_PROTO_DOMAIN, SI_ORDER_MIDDLE, esp_attach, NULL);
Cache object: d15b9aa42acbc2c54f37e93145dfec18
[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]