if_ipsec.c revision 1.3.2.11
1 1.3.2.11 martin /* $NetBSD: if_ipsec.c,v 1.3.2.11 2019/03/15 14:47:22 martin Exp $ */ 2 1.3.2.2 snj 3 1.3.2.2 snj /* 4 1.3.2.2 snj * Copyright (c) 2017 Internet Initiative Japan Inc. 5 1.3.2.2 snj * All rights reserved. 6 1.3.2.2 snj * 7 1.3.2.2 snj * Redistribution and use in source and binary forms, with or without 8 1.3.2.2 snj * modification, are permitted provided that the following conditions 9 1.3.2.2 snj * are met: 10 1.3.2.2 snj * 1. Redistributions of source code must retain the above copyright 11 1.3.2.2 snj * notice, this list of conditions and the following disclaimer. 12 1.3.2.2 snj * 2. Redistributions in binary form must reproduce the above copyright 13 1.3.2.2 snj * notice, this list of conditions and the following disclaimer in the 14 1.3.2.2 snj * documentation and/or other materials provided with the distribution. 15 1.3.2.2 snj * 16 1.3.2.2 snj * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 17 1.3.2.2 snj * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 18 1.3.2.2 snj * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 19 1.3.2.2 snj * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 20 1.3.2.2 snj * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 21 1.3.2.2 snj * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 22 1.3.2.2 snj * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 23 1.3.2.2 snj * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 24 1.3.2.2 snj * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 25 1.3.2.2 snj * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 26 1.3.2.2 snj * POSSIBILITY OF SUCH DAMAGE. 27 1.3.2.2 snj */ 28 1.3.2.2 snj 29 1.3.2.2 snj #include <sys/cdefs.h> 30 1.3.2.11 martin __KERNEL_RCSID(0, "$NetBSD: if_ipsec.c,v 1.3.2.11 2019/03/15 14:47:22 martin Exp $"); 31 1.3.2.2 snj 32 1.3.2.2 snj #ifdef _KERNEL_OPT 33 1.3.2.2 snj #include "opt_inet.h" 34 1.3.2.2 snj #endif 35 1.3.2.2 snj 36 1.3.2.2 snj #include <sys/param.h> 37 1.3.2.2 snj #include <sys/systm.h> 38 1.3.2.2 snj #include <sys/kernel.h> 39 1.3.2.2 snj #include <sys/mbuf.h> 40 1.3.2.2 snj #include <sys/socket.h> 41 1.3.2.2 snj #include <sys/sockio.h> 42 1.3.2.2 snj #include <sys/errno.h> 43 1.3.2.2 snj #include <sys/ioctl.h> 44 1.3.2.2 snj #include <sys/time.h> 45 1.3.2.2 snj #include <sys/syslog.h> 46 1.3.2.2 snj #include <sys/cpu.h> 47 1.3.2.2 snj #include <sys/kmem.h> 48 1.3.2.2 snj #include <sys/mutex.h> 49 1.3.2.2 snj #include <sys/pserialize.h> 50 1.3.2.2 snj #include <sys/psref.h> 51 1.3.2.2 snj 52 1.3.2.2 snj #include <net/if.h> 53 1.3.2.2 snj #include <net/if_types.h> 54 1.3.2.2 snj #include <net/route.h> 55 1.3.2.2 snj #include <net/bpf.h> 56 1.3.2.2 snj #include <net/pfkeyv2.h> 57 1.3.2.2 snj 58 1.3.2.2 snj #include <netinet/in.h> 59 1.3.2.2 snj #include <netinet/in_systm.h> 60 1.3.2.2 snj #include <netinet/ip.h> 61 1.3.2.2 snj #ifdef INET 62 1.3.2.2 snj #include <netinet/in_var.h> 63 1.3.2.2 snj #endif /* INET */ 64 1.3.2.2 snj 65 1.3.2.2 snj #ifdef INET6 66 1.3.2.2 snj #include <netinet6/in6_var.h> 67 1.3.2.2 snj #include <netinet/ip6.h> 68 1.3.2.2 snj #include <netinet6/ip6_var.h> 69 1.3.2.2 snj #endif /* INET6 */ 70 1.3.2.2 snj 71 1.3.2.2 snj #include <netinet/ip_encap.h> 72 1.3.2.2 snj 73 1.3.2.2 snj #include <net/if_ipsec.h> 74 1.3.2.2 snj 75 1.3.2.2 snj #include <net/raw_cb.h> 76 1.3.2.2 snj #include <net/pfkeyv2.h> 77 1.3.2.2 snj 78 1.3.2.2 snj #include <netipsec/key.h> 79 1.3.2.5 martin #include <netipsec/keydb.h> /* for union sockaddr_union */ 80 1.3.2.2 snj #include <netipsec/ipsec.h> 81 1.3.2.2 snj #include <netipsec/ipsecif.h> 82 1.3.2.2 snj 83 1.3.2.2 snj static void if_ipsec_ro_init_pc(void *, void *, struct cpu_info *); 84 1.3.2.2 snj static void if_ipsec_ro_fini_pc(void *, void *, struct cpu_info *); 85 1.3.2.2 snj 86 1.3.2.2 snj static int if_ipsec_clone_create(struct if_clone *, int); 87 1.3.2.2 snj static int if_ipsec_clone_destroy(struct ifnet *); 88 1.3.2.2 snj 89 1.3.2.2 snj static inline int if_ipsec_out_direct(struct ipsec_variant *, struct mbuf *, int); 90 1.3.2.2 snj static inline void if_ipsec_in_enqueue(struct mbuf *, int, struct ifnet *); 91 1.3.2.2 snj 92 1.3.2.2 snj static int if_ipsec_encap_attach(struct ipsec_variant *); 93 1.3.2.2 snj static int if_ipsec_encap_detach(struct ipsec_variant *); 94 1.3.2.2 snj static int if_ipsec_set_tunnel(struct ifnet *, 95 1.3.2.2 snj struct sockaddr *, struct sockaddr *); 96 1.3.2.2 snj static void if_ipsec_delete_tunnel(struct ifnet *); 97 1.3.2.2 snj static int if_ipsec_ensure_flags(struct ifnet *, short); 98 1.3.2.2 snj static void if_ipsec_attach0(struct ipsec_softc *); 99 1.3.2.2 snj 100 1.3.2.2 snj static int if_ipsec_update_variant(struct ipsec_softc *, 101 1.3.2.2 snj struct ipsec_variant *, struct ipsec_variant *); 102 1.3.2.2 snj 103 1.3.2.2 snj /* sadb_msg */ 104 1.3.2.2 snj static inline void if_ipsec_add_mbuf(struct mbuf *, void *, size_t); 105 1.3.2.2 snj static inline void if_ipsec_add_pad(struct mbuf *, size_t); 106 1.3.2.2 snj static inline size_t if_ipsec_set_sadb_addr(struct sadb_address *, 107 1.3.2.2 snj struct sockaddr *, int, uint16_t); 108 1.3.2.2 snj static inline size_t if_ipsec_set_sadb_src(struct sadb_address *, 109 1.3.2.2 snj struct sockaddr *, int); 110 1.3.2.2 snj static inline size_t if_ipsec_set_sadb_dst(struct sadb_address *, 111 1.3.2.2 snj struct sockaddr *, int); 112 1.3.2.2 snj static inline size_t if_ipsec_set_sadb_x_policy(struct sadb_x_policy *, 113 1.3.2.3 martin struct sadb_x_ipsecrequest *, uint16_t, uint8_t, uint32_t, uint8_t, 114 1.3.2.3 martin struct sockaddr *, struct sockaddr *); 115 1.3.2.2 snj static inline void if_ipsec_set_sadb_msg(struct sadb_msg *, uint16_t, uint8_t); 116 1.3.2.2 snj static inline void if_ipsec_set_sadb_msg_add(struct sadb_msg *, uint16_t); 117 1.3.2.2 snj static inline void if_ipsec_set_sadb_msg_del(struct sadb_msg *, uint16_t); 118 1.3.2.2 snj /* SPD */ 119 1.3.2.2 snj static int if_ipsec_share_sp(struct ipsec_variant *); 120 1.3.2.2 snj static int if_ipsec_unshare_sp(struct ipsec_variant *); 121 1.3.2.2 snj static inline struct secpolicy *if_ipsec_add_sp0(struct sockaddr *, 122 1.3.2.2 snj in_port_t, struct sockaddr *, in_port_t, int, int, int, u_int); 123 1.3.2.2 snj static inline int if_ipsec_del_sp0(struct secpolicy *); 124 1.3.2.2 snj static int if_ipsec_add_sp(struct ipsec_variant *, 125 1.3.2.2 snj struct sockaddr *, in_port_t, struct sockaddr *, in_port_t); 126 1.3.2.2 snj static void if_ipsec_del_sp(struct ipsec_variant *); 127 1.3.2.2 snj static int if_ipsec_replace_sp(struct ipsec_softc *, struct ipsec_variant *, 128 1.3.2.2 snj struct ipsec_variant *); 129 1.3.2.2 snj 130 1.3.2.2 snj static int if_ipsec_set_addr_port(struct sockaddr *, struct sockaddr *, 131 1.3.2.2 snj in_port_t); 132 1.3.2.2 snj #define IF_IPSEC_GATHER_PSRC_ADDR_PORT(var, target) \ 133 1.3.2.2 snj if_ipsec_set_addr_port(target, (var)->iv_psrc, (var)->iv_sport) 134 1.3.2.2 snj #define IF_IPSEC_GATHER_PDST_ADDR_PORT(var, target) \ 135 1.3.2.2 snj if_ipsec_set_addr_port(target, (var)->iv_pdst, (var)->iv_dport) 136 1.3.2.2 snj 137 1.3.2.2 snj /* 138 1.3.2.2 snj * ipsec global variable definitions 139 1.3.2.2 snj */ 140 1.3.2.2 snj 141 1.3.2.2 snj /* This list is used in ioctl context only. */ 142 1.3.2.2 snj LIST_HEAD(ipsec_sclist, ipsec_softc); 143 1.3.2.2 snj static struct { 144 1.3.2.2 snj struct ipsec_sclist list; 145 1.3.2.2 snj kmutex_t lock; 146 1.3.2.2 snj } ipsec_softcs __cacheline_aligned; 147 1.3.2.2 snj 148 1.3.2.2 snj struct psref_class *iv_psref_class __read_mostly; 149 1.3.2.2 snj 150 1.3.2.2 snj struct if_clone ipsec_cloner = 151 1.3.2.2 snj IF_CLONE_INITIALIZER("ipsec", if_ipsec_clone_create, if_ipsec_clone_destroy); 152 1.3.2.2 snj static int max_ipsec_nesting = MAX_IPSEC_NEST; 153 1.3.2.2 snj 154 1.3.2.2 snj /* ARGSUSED */ 155 1.3.2.2 snj void 156 1.3.2.2 snj ipsecifattach(int count) 157 1.3.2.2 snj { 158 1.3.2.2 snj 159 1.3.2.2 snj mutex_init(&ipsec_softcs.lock, MUTEX_DEFAULT, IPL_NONE); 160 1.3.2.2 snj LIST_INIT(&ipsec_softcs.list); 161 1.3.2.2 snj 162 1.3.2.2 snj iv_psref_class = psref_class_create("ipsecvar", IPL_SOFTNET); 163 1.3.2.2 snj 164 1.3.2.2 snj if_clone_attach(&ipsec_cloner); 165 1.3.2.2 snj } 166 1.3.2.2 snj 167 1.3.2.2 snj static int 168 1.3.2.2 snj if_ipsec_clone_create(struct if_clone *ifc, int unit) 169 1.3.2.2 snj { 170 1.3.2.2 snj struct ipsec_softc *sc; 171 1.3.2.2 snj struct ipsec_variant *var; 172 1.3.2.2 snj 173 1.3.2.2 snj sc = kmem_zalloc(sizeof(*sc), KM_SLEEP); 174 1.3.2.2 snj 175 1.3.2.2 snj if_initname(&sc->ipsec_if, ifc->ifc_name, unit); 176 1.3.2.2 snj 177 1.3.2.2 snj if_ipsec_attach0(sc); 178 1.3.2.2 snj 179 1.3.2.2 snj var = kmem_zalloc(sizeof(*var), KM_SLEEP); 180 1.3.2.2 snj var->iv_softc = sc; 181 1.3.2.2 snj psref_target_init(&var->iv_psref, iv_psref_class); 182 1.3.2.2 snj 183 1.3.2.2 snj sc->ipsec_var = var; 184 1.3.2.2 snj mutex_init(&sc->ipsec_lock, MUTEX_DEFAULT, IPL_NONE); 185 1.3.2.10 martin sc->ipsec_psz = pserialize_create(); 186 1.3.2.2 snj sc->ipsec_ro_percpu = percpu_alloc(sizeof(struct ipsec_ro)); 187 1.3.2.2 snj percpu_foreach(sc->ipsec_ro_percpu, if_ipsec_ro_init_pc, NULL); 188 1.3.2.2 snj 189 1.3.2.2 snj mutex_enter(&ipsec_softcs.lock); 190 1.3.2.2 snj LIST_INSERT_HEAD(&ipsec_softcs.list, sc, ipsec_list); 191 1.3.2.2 snj mutex_exit(&ipsec_softcs.lock); 192 1.3.2.2 snj return 0; 193 1.3.2.2 snj } 194 1.3.2.2 snj 195 1.3.2.2 snj static void 196 1.3.2.2 snj if_ipsec_attach0(struct ipsec_softc *sc) 197 1.3.2.2 snj { 198 1.3.2.2 snj 199 1.3.2.2 snj sc->ipsec_if.if_addrlen = 0; 200 1.3.2.2 snj sc->ipsec_if.if_mtu = IPSEC_MTU; 201 1.3.2.2 snj sc->ipsec_if.if_flags = IFF_POINTOPOINT | IFF_MULTICAST; 202 1.3.2.2 snj /* set ipsec(4) specific default flags. */ 203 1.3.2.2 snj sc->ipsec_if.if_flags |= IFF_FWD_IPV6; 204 1.3.2.2 snj sc->ipsec_if.if_extflags = IFEF_NO_LINK_STATE_CHANGE | IFEF_MPSAFE; 205 1.3.2.2 snj sc->ipsec_if.if_ioctl = if_ipsec_ioctl; 206 1.3.2.2 snj sc->ipsec_if.if_output = if_ipsec_output; 207 1.3.2.2 snj sc->ipsec_if.if_type = IFT_IPSEC; 208 1.3.2.2 snj sc->ipsec_if.if_dlt = DLT_NULL; 209 1.3.2.2 snj sc->ipsec_if.if_softc = sc; 210 1.3.2.2 snj IFQ_SET_READY(&sc->ipsec_if.if_snd); 211 1.3.2.2 snj if_initialize(&sc->ipsec_if); 212 1.3.2.2 snj if_alloc_sadl(&sc->ipsec_if); 213 1.3.2.2 snj bpf_attach(&sc->ipsec_if, DLT_NULL, sizeof(u_int)); 214 1.3.2.2 snj if_register(&sc->ipsec_if); 215 1.3.2.2 snj } 216 1.3.2.2 snj 217 1.3.2.2 snj static void 218 1.3.2.2 snj if_ipsec_ro_init_pc(void *p, void *arg __unused, struct cpu_info *ci __unused) 219 1.3.2.2 snj { 220 1.3.2.2 snj struct ipsec_ro *iro = p; 221 1.3.2.2 snj 222 1.3.2.7 martin iro->ir_lock = mutex_obj_alloc(MUTEX_DEFAULT, IPL_NONE); 223 1.3.2.2 snj } 224 1.3.2.2 snj 225 1.3.2.2 snj static void 226 1.3.2.2 snj if_ipsec_ro_fini_pc(void *p, void *arg __unused, struct cpu_info *ci __unused) 227 1.3.2.2 snj { 228 1.3.2.2 snj struct ipsec_ro *iro = p; 229 1.3.2.2 snj 230 1.3.2.2 snj rtcache_free(&iro->ir_ro); 231 1.3.2.2 snj 232 1.3.2.7 martin mutex_obj_free(iro->ir_lock); 233 1.3.2.2 snj } 234 1.3.2.2 snj 235 1.3.2.2 snj static int 236 1.3.2.2 snj if_ipsec_clone_destroy(struct ifnet *ifp) 237 1.3.2.2 snj { 238 1.3.2.2 snj struct ipsec_softc *sc = ifp->if_softc; 239 1.3.2.2 snj struct ipsec_variant *var; 240 1.3.2.2 snj int bound; 241 1.3.2.2 snj 242 1.3.2.2 snj mutex_enter(&ipsec_softcs.lock); 243 1.3.2.2 snj LIST_REMOVE(sc, ipsec_list); 244 1.3.2.2 snj mutex_exit(&ipsec_softcs.lock); 245 1.3.2.2 snj 246 1.3.2.2 snj bound = curlwp_bind(); 247 1.3.2.2 snj if_ipsec_delete_tunnel(&sc->ipsec_if); 248 1.3.2.2 snj curlwp_bindx(bound); 249 1.3.2.2 snj 250 1.3.2.2 snj bpf_detach(ifp); 251 1.3.2.2 snj if_detach(ifp); 252 1.3.2.2 snj 253 1.3.2.2 snj percpu_foreach(sc->ipsec_ro_percpu, if_ipsec_ro_fini_pc, NULL); 254 1.3.2.2 snj percpu_free(sc->ipsec_ro_percpu, sizeof(struct ipsec_ro)); 255 1.3.2.2 snj 256 1.3.2.10 martin pserialize_destroy(sc->ipsec_psz); 257 1.3.2.2 snj mutex_destroy(&sc->ipsec_lock); 258 1.3.2.2 snj 259 1.3.2.2 snj var = sc->ipsec_var; 260 1.3.2.2 snj kmem_free(var, sizeof(*var)); 261 1.3.2.2 snj kmem_free(sc, sizeof(*sc)); 262 1.3.2.2 snj 263 1.3.2.2 snj return 0; 264 1.3.2.2 snj } 265 1.3.2.2 snj 266 1.3.2.2 snj static inline bool 267 1.3.2.2 snj if_ipsec_nat_t(struct ipsec_softc *sc) 268 1.3.2.2 snj { 269 1.3.2.2 snj 270 1.3.2.2 snj return (sc->ipsec_if.if_flags & IFF_NAT_T) != 0; 271 1.3.2.2 snj } 272 1.3.2.2 snj 273 1.3.2.2 snj static inline bool 274 1.3.2.2 snj if_ipsec_fwd_ipv6(struct ipsec_softc *sc) 275 1.3.2.2 snj { 276 1.3.2.2 snj 277 1.3.2.2 snj return (sc->ipsec_if.if_flags & IFF_FWD_IPV6) != 0; 278 1.3.2.2 snj } 279 1.3.2.2 snj 280 1.3.2.2 snj int 281 1.3.2.2 snj if_ipsec_encap_func(struct mbuf *m, int off, int proto, void *arg) 282 1.3.2.2 snj { 283 1.3.2.5 martin uint8_t v; 284 1.3.2.2 snj struct ipsec_softc *sc; 285 1.3.2.2 snj struct ipsec_variant *var = NULL; 286 1.3.2.2 snj struct psref psref; 287 1.3.2.2 snj int ret = 0; 288 1.3.2.2 snj 289 1.3.2.2 snj sc = arg; 290 1.3.2.2 snj KASSERT(sc != NULL); 291 1.3.2.2 snj 292 1.3.2.2 snj if ((sc->ipsec_if.if_flags & IFF_UP) == 0) 293 1.3.2.2 snj goto out; 294 1.3.2.2 snj 295 1.3.2.2 snj var = if_ipsec_getref_variant(sc, &psref); 296 1.3.2.2 snj if (if_ipsec_variant_is_unconfigured(var)) 297 1.3.2.2 snj goto out; 298 1.3.2.2 snj 299 1.3.2.2 snj switch (proto) { 300 1.3.2.2 snj case IPPROTO_IPV4: 301 1.3.2.2 snj case IPPROTO_IPV6: 302 1.3.2.2 snj break; 303 1.3.2.2 snj default: 304 1.3.2.2 snj goto out; 305 1.3.2.2 snj } 306 1.3.2.2 snj 307 1.3.2.5 martin m_copydata(m, 0, sizeof(v), &v); 308 1.3.2.5 martin v = (v >> 4) & 0xff; /* Get the IP version number. */ 309 1.3.2.2 snj 310 1.3.2.5 martin switch (v) { 311 1.3.2.2 snj #ifdef INET 312 1.3.2.5 martin case IPVERSION: { 313 1.3.2.5 martin struct ip ip; 314 1.3.2.5 martin 315 1.3.2.5 martin if (m->m_pkthdr.len < sizeof(ip)) 316 1.3.2.5 martin goto out; 317 1.3.2.5 martin 318 1.3.2.5 martin m_copydata(m, 0, sizeof(ip), &ip); 319 1.3.2.2 snj if (var->iv_psrc->sa_family != AF_INET || 320 1.3.2.2 snj var->iv_pdst->sa_family != AF_INET) 321 1.3.2.2 snj goto out; 322 1.3.2.2 snj ret = ipsecif4_encap_func(m, &ip, var); 323 1.3.2.2 snj break; 324 1.3.2.5 martin } 325 1.3.2.5 martin #endif 326 1.3.2.5 martin #ifdef INET6 327 1.3.2.5 martin case (IPV6_VERSION >> 4): { 328 1.3.2.5 martin struct ip6_hdr ip6; 329 1.3.2.5 martin 330 1.3.2.5 martin if (m->m_pkthdr.len < sizeof(ip6)) 331 1.3.2.5 martin goto out; 332 1.3.2.5 martin 333 1.3.2.5 martin m_copydata(m, 0, sizeof(ip6), &ip6); 334 1.3.2.5 martin if (var->iv_psrc->sa_family != AF_INET6 || 335 1.3.2.5 martin var->iv_pdst->sa_family != AF_INET6) 336 1.3.2.5 martin goto out; 337 1.3.2.5 martin ret = ipsecif6_encap_func(m, &ip6, var); 338 1.3.2.5 martin break; 339 1.3.2.5 martin } 340 1.3.2.2 snj #endif 341 1.3.2.2 snj default: 342 1.3.2.2 snj goto out; 343 1.3.2.2 snj } 344 1.3.2.2 snj 345 1.3.2.2 snj out: 346 1.3.2.2 snj if (var != NULL) 347 1.3.2.2 snj if_ipsec_putref_variant(var, &psref); 348 1.3.2.2 snj return ret; 349 1.3.2.2 snj } 350 1.3.2.2 snj 351 1.3.2.2 snj /* 352 1.3.2.2 snj * ipsec(4) I/F may cause infinite recursion calls when misconfigured. 353 1.3.2.2 snj * We'll prevent this by introducing upper limit. 354 1.3.2.2 snj */ 355 1.3.2.2 snj static int 356 1.3.2.2 snj if_ipsec_check_nesting(struct ifnet *ifp, struct mbuf *m) 357 1.3.2.2 snj { 358 1.3.2.2 snj 359 1.3.2.2 snj return if_tunnel_check_nesting(ifp, m, max_ipsec_nesting); 360 1.3.2.2 snj } 361 1.3.2.2 snj 362 1.3.2.2 snj int 363 1.3.2.2 snj if_ipsec_output(struct ifnet *ifp, struct mbuf *m, const struct sockaddr *dst, 364 1.3.2.2 snj const struct rtentry *rt) 365 1.3.2.2 snj { 366 1.3.2.2 snj struct ipsec_softc *sc = ifp->if_softc; 367 1.3.2.2 snj struct ipsec_variant *var; 368 1.3.2.2 snj struct psref psref; 369 1.3.2.2 snj int error; 370 1.3.2.2 snj int bound; 371 1.3.2.2 snj 372 1.3.2.2 snj IFQ_CLASSIFY(&ifp->if_snd, m, dst->sa_family); 373 1.3.2.2 snj 374 1.3.2.2 snj error = if_ipsec_check_nesting(ifp, m); 375 1.3.2.2 snj if (error) { 376 1.3.2.2 snj m_freem(m); 377 1.3.2.2 snj goto noref_end; 378 1.3.2.2 snj } 379 1.3.2.2 snj 380 1.3.2.2 snj if ((ifp->if_flags & IFF_UP) == 0) { 381 1.3.2.2 snj m_freem(m); 382 1.3.2.2 snj error = ENETDOWN; 383 1.3.2.2 snj goto noref_end; 384 1.3.2.2 snj } 385 1.3.2.2 snj 386 1.3.2.2 snj 387 1.3.2.2 snj bound = curlwp_bind(); 388 1.3.2.2 snj var = if_ipsec_getref_variant(sc, &psref); 389 1.3.2.2 snj if (if_ipsec_variant_is_unconfigured(var)) { 390 1.3.2.2 snj m_freem(m); 391 1.3.2.2 snj error = ENETDOWN; 392 1.3.2.2 snj goto end; 393 1.3.2.2 snj } 394 1.3.2.2 snj 395 1.3.2.2 snj m->m_flags &= ~(M_BCAST|M_MCAST); 396 1.3.2.2 snj 397 1.3.2.2 snj /* use DLT_NULL encapsulation here to pass inner af type */ 398 1.3.2.2 snj M_PREPEND(m, sizeof(int), M_DONTWAIT); 399 1.3.2.2 snj if (!m) { 400 1.3.2.2 snj error = ENOBUFS; 401 1.3.2.2 snj goto end; 402 1.3.2.2 snj } 403 1.3.2.2 snj *mtod(m, int *) = dst->sa_family; 404 1.3.2.2 snj 405 1.3.2.2 snj #if INET6 406 1.3.2.2 snj /* drop IPv6 packet if IFF_FWD_IPV6 is not set */ 407 1.3.2.2 snj if (dst->sa_family == AF_INET6 && 408 1.3.2.2 snj !if_ipsec_fwd_ipv6(sc)) { 409 1.3.2.2 snj /* 410 1.3.2.2 snj * IPv6 packet is not allowed to forward,that is not error. 411 1.3.2.2 snj */ 412 1.3.2.2 snj error = 0; 413 1.3.2.2 snj IF_DROP(&ifp->if_snd); 414 1.3.2.2 snj m_freem(m); 415 1.3.2.2 snj goto end; 416 1.3.2.2 snj } 417 1.3.2.2 snj #endif 418 1.3.2.2 snj 419 1.3.2.2 snj error = if_ipsec_out_direct(var, m, dst->sa_family); 420 1.3.2.2 snj 421 1.3.2.2 snj end: 422 1.3.2.2 snj if_ipsec_putref_variant(var, &psref); 423 1.3.2.2 snj curlwp_bindx(bound); 424 1.3.2.2 snj noref_end: 425 1.3.2.2 snj if (error) 426 1.3.2.2 snj ifp->if_oerrors++; 427 1.3.2.2 snj 428 1.3.2.2 snj return error; 429 1.3.2.2 snj } 430 1.3.2.2 snj 431 1.3.2.2 snj static inline int 432 1.3.2.2 snj if_ipsec_out_direct(struct ipsec_variant *var, struct mbuf *m, int family) 433 1.3.2.2 snj { 434 1.3.2.2 snj struct ifnet *ifp = &var->iv_softc->ipsec_if; 435 1.3.2.2 snj int error; 436 1.3.2.2 snj int len; 437 1.3.2.2 snj 438 1.3.2.2 snj KASSERT(if_ipsec_heldref_variant(var)); 439 1.3.2.2 snj KASSERT(var->iv_output != NULL); 440 1.3.2.2 snj 441 1.3.2.2 snj len = m->m_pkthdr.len; 442 1.3.2.2 snj 443 1.3.2.2 snj /* input DLT_NULL frame to BPF */ 444 1.3.2.2 snj bpf_mtap(ifp, m); 445 1.3.2.2 snj 446 1.3.2.2 snj /* grab and chop off inner af type */ 447 1.3.2.2 snj /* XXX need pullup? */ 448 1.3.2.2 snj m_adj(m, sizeof(int)); 449 1.3.2.2 snj 450 1.3.2.2 snj error = var->iv_output(var, family, m); 451 1.3.2.2 snj if (error) 452 1.3.2.2 snj return error; 453 1.3.2.2 snj 454 1.3.2.2 snj ifp->if_opackets++; 455 1.3.2.2 snj ifp->if_obytes += len; 456 1.3.2.2 snj 457 1.3.2.2 snj return 0; 458 1.3.2.2 snj } 459 1.3.2.2 snj 460 1.3.2.2 snj void 461 1.3.2.2 snj if_ipsec_input(struct mbuf *m, int af, struct ifnet *ifp) 462 1.3.2.2 snj { 463 1.3.2.2 snj 464 1.3.2.2 snj KASSERT(ifp != NULL); 465 1.3.2.2 snj 466 1.3.2.2 snj m_set_rcvif(m, ifp); 467 1.3.2.2 snj 468 1.3.2.2 snj bpf_mtap_af(ifp, af, m); 469 1.3.2.2 snj 470 1.3.2.2 snj if_ipsec_in_enqueue(m, af, ifp); 471 1.3.2.2 snj 472 1.3.2.2 snj return; 473 1.3.2.2 snj } 474 1.3.2.2 snj 475 1.3.2.2 snj static inline void 476 1.3.2.2 snj if_ipsec_in_enqueue(struct mbuf *m, int af, struct ifnet *ifp) 477 1.3.2.2 snj { 478 1.3.2.2 snj pktqueue_t *pktq; 479 1.3.2.2 snj int pktlen; 480 1.3.2.2 snj 481 1.3.2.2 snj /* 482 1.3.2.2 snj * Put the packet to the network layer input queue according to the 483 1.3.2.2 snj * specified address family. 484 1.3.2.2 snj */ 485 1.3.2.2 snj switch (af) { 486 1.3.2.2 snj #ifdef INET 487 1.3.2.2 snj case AF_INET: 488 1.3.2.2 snj pktq = ip_pktq; 489 1.3.2.2 snj break; 490 1.3.2.2 snj #endif 491 1.3.2.2 snj #ifdef INET6 492 1.3.2.2 snj case AF_INET6: 493 1.3.2.2 snj pktq = ip6_pktq; 494 1.3.2.2 snj break; 495 1.3.2.2 snj #endif 496 1.3.2.2 snj default: 497 1.3.2.2 snj ifp->if_ierrors++; 498 1.3.2.2 snj m_freem(m); 499 1.3.2.2 snj return; 500 1.3.2.2 snj } 501 1.3.2.2 snj 502 1.3.2.2 snj #if 1 503 1.3.2.2 snj const u_int h = curcpu()->ci_index; 504 1.3.2.2 snj #else 505 1.3.2.2 snj const uint32_t h = pktq_rps_hash(m); 506 1.3.2.2 snj #endif 507 1.3.2.2 snj pktlen = m->m_pkthdr.len; 508 1.3.2.2 snj if (__predict_true(pktq_enqueue(pktq, m, h))) { 509 1.3.2.2 snj ifp->if_ibytes += pktlen; 510 1.3.2.2 snj ifp->if_ipackets++; 511 1.3.2.2 snj } else { 512 1.3.2.2 snj m_freem(m); 513 1.3.2.2 snj } 514 1.3.2.2 snj 515 1.3.2.2 snj return; 516 1.3.2.2 snj } 517 1.3.2.2 snj 518 1.3.2.2 snj static inline int 519 1.3.2.2 snj if_ipsec_check_salen(struct sockaddr *addr) 520 1.3.2.2 snj { 521 1.3.2.2 snj 522 1.3.2.2 snj switch (addr->sa_family) { 523 1.3.2.2 snj #ifdef INET 524 1.3.2.2 snj case AF_INET: 525 1.3.2.2 snj if (addr->sa_len != sizeof(struct sockaddr_in)) 526 1.3.2.2 snj return EINVAL; 527 1.3.2.2 snj break; 528 1.3.2.2 snj #endif /* INET */ 529 1.3.2.2 snj #ifdef INET6 530 1.3.2.2 snj case AF_INET6: 531 1.3.2.2 snj if (addr->sa_len != sizeof(struct sockaddr_in6)) 532 1.3.2.2 snj return EINVAL; 533 1.3.2.2 snj break; 534 1.3.2.2 snj #endif /* INET6 */ 535 1.3.2.2 snj default: 536 1.3.2.2 snj return EAFNOSUPPORT; 537 1.3.2.2 snj } 538 1.3.2.2 snj 539 1.3.2.2 snj return 0; 540 1.3.2.2 snj } 541 1.3.2.2 snj 542 1.3.2.2 snj /* XXX how should we handle IPv6 scope on SIOC[GS]IFPHYADDR? */ 543 1.3.2.2 snj int 544 1.3.2.2 snj if_ipsec_ioctl(struct ifnet *ifp, u_long cmd, void *data) 545 1.3.2.2 snj { 546 1.3.2.2 snj struct ipsec_softc *sc = ifp->if_softc; 547 1.3.2.2 snj struct ipsec_variant *var = NULL; 548 1.3.2.2 snj struct ifreq *ifr = (struct ifreq*)data; 549 1.3.2.2 snj struct ifaddr *ifa = (struct ifaddr*)data; 550 1.3.2.2 snj int error = 0, size; 551 1.3.2.2 snj struct sockaddr *dst, *src; 552 1.3.2.2 snj u_long mtu; 553 1.3.2.2 snj short oflags = ifp->if_flags; 554 1.3.2.2 snj int bound; 555 1.3.2.2 snj struct psref psref; 556 1.3.2.2 snj 557 1.3.2.2 snj switch (cmd) { 558 1.3.2.2 snj case SIOCINITIFADDR: 559 1.3.2.2 snj ifp->if_flags |= IFF_UP; 560 1.3.2.2 snj ifa->ifa_rtrequest = p2p_rtrequest; 561 1.3.2.2 snj break; 562 1.3.2.2 snj 563 1.3.2.2 snj case SIOCSIFDSTADDR: 564 1.3.2.2 snj break; 565 1.3.2.2 snj 566 1.3.2.2 snj case SIOCADDMULTI: 567 1.3.2.2 snj case SIOCDELMULTI: 568 1.3.2.2 snj switch (ifr->ifr_addr.sa_family) { 569 1.3.2.2 snj #ifdef INET 570 1.3.2.2 snj case AF_INET: /* IP supports Multicast */ 571 1.3.2.2 snj break; 572 1.3.2.2 snj #endif /* INET */ 573 1.3.2.2 snj #ifdef INET6 574 1.3.2.2 snj case AF_INET6: /* IP6 supports Multicast */ 575 1.3.2.2 snj break; 576 1.3.2.2 snj #endif /* INET6 */ 577 1.3.2.2 snj default: /* Other protocols doesn't support Multicast */ 578 1.3.2.2 snj error = EAFNOSUPPORT; 579 1.3.2.2 snj break; 580 1.3.2.2 snj } 581 1.3.2.2 snj break; 582 1.3.2.2 snj 583 1.3.2.2 snj case SIOCSIFMTU: 584 1.3.2.2 snj mtu = ifr->ifr_mtu; 585 1.3.2.2 snj if (mtu < IPSEC_MTU_MIN || mtu > IPSEC_MTU_MAX) 586 1.3.2.2 snj return EINVAL; 587 1.3.2.2 snj else if ((error = ifioctl_common(ifp, cmd, data)) == ENETRESET) 588 1.3.2.2 snj error = 0; 589 1.3.2.2 snj break; 590 1.3.2.2 snj 591 1.3.2.2 snj #ifdef INET 592 1.3.2.2 snj case SIOCSIFPHYADDR: 593 1.3.2.2 snj #endif 594 1.3.2.2 snj #ifdef INET6 595 1.3.2.2 snj case SIOCSIFPHYADDR_IN6: 596 1.3.2.2 snj #endif /* INET6 */ 597 1.3.2.2 snj case SIOCSLIFPHYADDR: 598 1.3.2.2 snj switch (cmd) { 599 1.3.2.2 snj #ifdef INET 600 1.3.2.2 snj case SIOCSIFPHYADDR: 601 1.3.2.2 snj src = (struct sockaddr *) 602 1.3.2.2 snj &(((struct in_aliasreq *)data)->ifra_addr); 603 1.3.2.2 snj dst = (struct sockaddr *) 604 1.3.2.2 snj &(((struct in_aliasreq *)data)->ifra_dstaddr); 605 1.3.2.2 snj break; 606 1.3.2.2 snj #endif /* INET */ 607 1.3.2.2 snj #ifdef INET6 608 1.3.2.2 snj case SIOCSIFPHYADDR_IN6: 609 1.3.2.2 snj src = (struct sockaddr *) 610 1.3.2.2 snj &(((struct in6_aliasreq *)data)->ifra_addr); 611 1.3.2.2 snj dst = (struct sockaddr *) 612 1.3.2.2 snj &(((struct in6_aliasreq *)data)->ifra_dstaddr); 613 1.3.2.2 snj break; 614 1.3.2.2 snj #endif /* INET6 */ 615 1.3.2.2 snj case SIOCSLIFPHYADDR: 616 1.3.2.2 snj src = (struct sockaddr *) 617 1.3.2.2 snj &(((struct if_laddrreq *)data)->addr); 618 1.3.2.2 snj dst = (struct sockaddr *) 619 1.3.2.2 snj &(((struct if_laddrreq *)data)->dstaddr); 620 1.3.2.2 snj break; 621 1.3.2.2 snj default: 622 1.3.2.2 snj return EINVAL; 623 1.3.2.2 snj } 624 1.3.2.2 snj 625 1.3.2.2 snj /* sa_family must be equal */ 626 1.3.2.2 snj if (src->sa_family != dst->sa_family) 627 1.3.2.2 snj return EINVAL; 628 1.3.2.2 snj 629 1.3.2.2 snj error = if_ipsec_check_salen(src); 630 1.3.2.2 snj if (error) 631 1.3.2.2 snj return error; 632 1.3.2.2 snj error = if_ipsec_check_salen(dst); 633 1.3.2.2 snj if (error) 634 1.3.2.2 snj return error; 635 1.3.2.2 snj 636 1.3.2.2 snj /* check sa_family looks sane for the cmd */ 637 1.3.2.2 snj switch (cmd) { 638 1.3.2.2 snj #ifdef INET 639 1.3.2.2 snj case SIOCSIFPHYADDR: 640 1.3.2.2 snj if (src->sa_family == AF_INET) 641 1.3.2.2 snj break; 642 1.3.2.2 snj return EAFNOSUPPORT; 643 1.3.2.2 snj #endif /* INET */ 644 1.3.2.2 snj #ifdef INET6 645 1.3.2.2 snj case SIOCSIFPHYADDR_IN6: 646 1.3.2.2 snj if (src->sa_family == AF_INET6) 647 1.3.2.2 snj break; 648 1.3.2.2 snj return EAFNOSUPPORT; 649 1.3.2.2 snj #endif /* INET6 */ 650 1.3.2.2 snj case SIOCSLIFPHYADDR: 651 1.3.2.2 snj /* checks done in the above */ 652 1.3.2.2 snj break; 653 1.3.2.2 snj } 654 1.3.2.2 snj /* 655 1.3.2.2 snj * calls if_ipsec_getref_variant() for other softcs to check 656 1.3.2.2 snj * address pair duplicattion 657 1.3.2.2 snj */ 658 1.3.2.2 snj bound = curlwp_bind(); 659 1.3.2.2 snj error = if_ipsec_set_tunnel(&sc->ipsec_if, src, dst); 660 1.3.2.2 snj if (error) 661 1.3.2.2 snj goto bad; 662 1.3.2.5 martin curlwp_bindx(bound); 663 1.3.2.2 snj break; 664 1.3.2.2 snj 665 1.3.2.2 snj case SIOCDIFPHYADDR: 666 1.3.2.2 snj bound = curlwp_bind(); 667 1.3.2.2 snj if_ipsec_delete_tunnel(&sc->ipsec_if); 668 1.3.2.2 snj curlwp_bindx(bound); 669 1.3.2.2 snj break; 670 1.3.2.2 snj 671 1.3.2.2 snj case SIOCGIFPSRCADDR: 672 1.3.2.2 snj #ifdef INET6 673 1.3.2.2 snj case SIOCGIFPSRCADDR_IN6: 674 1.3.2.2 snj #endif /* INET6 */ 675 1.3.2.2 snj bound = curlwp_bind(); 676 1.3.2.2 snj var = if_ipsec_getref_variant(sc, &psref); 677 1.3.2.2 snj if (var->iv_psrc == NULL) { 678 1.3.2.2 snj error = EADDRNOTAVAIL; 679 1.3.2.2 snj goto bad; 680 1.3.2.2 snj } 681 1.3.2.2 snj src = var->iv_psrc; 682 1.3.2.2 snj switch (cmd) { 683 1.3.2.2 snj #ifdef INET 684 1.3.2.2 snj case SIOCGIFPSRCADDR: 685 1.3.2.2 snj dst = &ifr->ifr_addr; 686 1.3.2.2 snj size = sizeof(ifr->ifr_addr); 687 1.3.2.2 snj break; 688 1.3.2.2 snj #endif /* INET */ 689 1.3.2.2 snj #ifdef INET6 690 1.3.2.2 snj case SIOCGIFPSRCADDR_IN6: 691 1.3.2.2 snj dst = (struct sockaddr *) 692 1.3.2.2 snj &(((struct in6_ifreq *)data)->ifr_addr); 693 1.3.2.2 snj size = sizeof(((struct in6_ifreq *)data)->ifr_addr); 694 1.3.2.2 snj break; 695 1.3.2.2 snj #endif /* INET6 */ 696 1.3.2.2 snj default: 697 1.3.2.2 snj error = EADDRNOTAVAIL; 698 1.3.2.2 snj goto bad; 699 1.3.2.2 snj } 700 1.3.2.2 snj if (src->sa_len > size) { 701 1.3.2.2 snj error = EINVAL; 702 1.3.2.2 snj goto bad; 703 1.3.2.2 snj } 704 1.3.2.2 snj error = IF_IPSEC_GATHER_PSRC_ADDR_PORT(var, dst); 705 1.3.2.2 snj if (error) 706 1.3.2.2 snj goto bad; 707 1.3.2.2 snj if_ipsec_putref_variant(var, &psref); 708 1.3.2.2 snj curlwp_bindx(bound); 709 1.3.2.2 snj break; 710 1.3.2.2 snj 711 1.3.2.2 snj case SIOCGIFPDSTADDR: 712 1.3.2.2 snj #ifdef INET6 713 1.3.2.2 snj case SIOCGIFPDSTADDR_IN6: 714 1.3.2.2 snj #endif /* INET6 */ 715 1.3.2.2 snj bound = curlwp_bind(); 716 1.3.2.2 snj var = if_ipsec_getref_variant(sc, &psref); 717 1.3.2.2 snj if (var->iv_pdst == NULL) { 718 1.3.2.2 snj error = EADDRNOTAVAIL; 719 1.3.2.2 snj goto bad; 720 1.3.2.2 snj } 721 1.3.2.2 snj src = var->iv_pdst; 722 1.3.2.2 snj switch (cmd) { 723 1.3.2.2 snj #ifdef INET 724 1.3.2.2 snj case SIOCGIFPDSTADDR: 725 1.3.2.2 snj dst = &ifr->ifr_addr; 726 1.3.2.2 snj size = sizeof(ifr->ifr_addr); 727 1.3.2.2 snj break; 728 1.3.2.2 snj #endif /* INET */ 729 1.3.2.2 snj #ifdef INET6 730 1.3.2.2 snj case SIOCGIFPDSTADDR_IN6: 731 1.3.2.2 snj dst = (struct sockaddr *) 732 1.3.2.2 snj &(((struct in6_ifreq *)data)->ifr_addr); 733 1.3.2.2 snj size = sizeof(((struct in6_ifreq *)data)->ifr_addr); 734 1.3.2.2 snj break; 735 1.3.2.2 snj #endif /* INET6 */ 736 1.3.2.2 snj default: 737 1.3.2.2 snj error = EADDRNOTAVAIL; 738 1.3.2.2 snj goto bad; 739 1.3.2.2 snj } 740 1.3.2.2 snj if (src->sa_len > size) { 741 1.3.2.2 snj error = EINVAL; 742 1.3.2.2 snj goto bad; 743 1.3.2.2 snj } 744 1.3.2.2 snj error = IF_IPSEC_GATHER_PDST_ADDR_PORT(var, dst); 745 1.3.2.2 snj if (error) 746 1.3.2.2 snj goto bad; 747 1.3.2.2 snj if_ipsec_putref_variant(var, &psref); 748 1.3.2.2 snj curlwp_bindx(bound); 749 1.3.2.2 snj break; 750 1.3.2.2 snj 751 1.3.2.2 snj case SIOCGLIFPHYADDR: 752 1.3.2.2 snj bound = curlwp_bind(); 753 1.3.2.2 snj var = if_ipsec_getref_variant(sc, &psref); 754 1.3.2.2 snj if (if_ipsec_variant_is_unconfigured(var)) { 755 1.3.2.2 snj error = EADDRNOTAVAIL; 756 1.3.2.2 snj goto bad; 757 1.3.2.2 snj } 758 1.3.2.2 snj 759 1.3.2.2 snj /* copy src */ 760 1.3.2.2 snj src = var->iv_psrc; 761 1.3.2.2 snj dst = (struct sockaddr *) 762 1.3.2.2 snj &(((struct if_laddrreq *)data)->addr); 763 1.3.2.2 snj size = sizeof(((struct if_laddrreq *)data)->addr); 764 1.3.2.2 snj if (src->sa_len > size) { 765 1.3.2.2 snj error = EINVAL; 766 1.3.2.2 snj goto bad; 767 1.3.2.2 snj } 768 1.3.2.2 snj error = IF_IPSEC_GATHER_PSRC_ADDR_PORT(var, dst); 769 1.3.2.2 snj if (error) 770 1.3.2.2 snj goto bad; 771 1.3.2.2 snj 772 1.3.2.2 snj /* copy dst */ 773 1.3.2.2 snj src = var->iv_pdst; 774 1.3.2.2 snj dst = (struct sockaddr *) 775 1.3.2.2 snj &(((struct if_laddrreq *)data)->dstaddr); 776 1.3.2.2 snj size = sizeof(((struct if_laddrreq *)data)->dstaddr); 777 1.3.2.2 snj if (src->sa_len > size) { 778 1.3.2.2 snj error = EINVAL; 779 1.3.2.2 snj goto bad; 780 1.3.2.2 snj } 781 1.3.2.2 snj error = IF_IPSEC_GATHER_PDST_ADDR_PORT(var, dst); 782 1.3.2.2 snj if (error) 783 1.3.2.2 snj goto bad; 784 1.3.2.2 snj if_ipsec_putref_variant(var, &psref); 785 1.3.2.2 snj curlwp_bindx(bound); 786 1.3.2.2 snj break; 787 1.3.2.2 snj 788 1.3.2.2 snj default: 789 1.3.2.2 snj error = ifioctl_common(ifp, cmd, data); 790 1.3.2.2 snj if (!error) { 791 1.3.2.2 snj bound = curlwp_bind(); 792 1.3.2.2 snj error = if_ipsec_ensure_flags(&sc->ipsec_if, oflags); 793 1.3.2.2 snj if (error) 794 1.3.2.2 snj goto bad; 795 1.3.2.5 martin curlwp_bindx(bound); 796 1.3.2.2 snj } 797 1.3.2.2 snj break; 798 1.3.2.2 snj } 799 1.3.2.2 snj return error; 800 1.3.2.2 snj 801 1.3.2.2 snj bad: 802 1.3.2.2 snj if (var != NULL) 803 1.3.2.2 snj if_ipsec_putref_variant(var, &psref); 804 1.3.2.2 snj curlwp_bindx(bound); 805 1.3.2.2 snj 806 1.3.2.2 snj return error; 807 1.3.2.2 snj } 808 1.3.2.2 snj 809 1.3.2.2 snj struct encap_funcs { 810 1.3.2.2 snj #ifdef INET 811 1.3.2.2 snj int (*ef_inet)(struct ipsec_variant *); 812 1.3.2.2 snj #endif 813 1.3.2.2 snj #ifdef INET6 814 1.3.2.2 snj int (*ef_inet6)(struct ipsec_variant *); 815 1.3.2.2 snj #endif 816 1.3.2.2 snj }; 817 1.3.2.2 snj 818 1.3.2.2 snj static struct encap_funcs ipsec_encap_attach = { 819 1.3.2.2 snj #ifdef INET 820 1.3.2.2 snj .ef_inet = ipsecif4_attach, 821 1.3.2.2 snj #endif 822 1.3.2.2 snj #ifdef INET6 823 1.3.2.2 snj .ef_inet6 = &ipsecif6_attach, 824 1.3.2.2 snj #endif 825 1.3.2.2 snj }; 826 1.3.2.2 snj 827 1.3.2.2 snj static struct encap_funcs ipsec_encap_detach = { 828 1.3.2.2 snj #ifdef INET 829 1.3.2.2 snj .ef_inet = ipsecif4_detach, 830 1.3.2.2 snj #endif 831 1.3.2.2 snj #ifdef INET6 832 1.3.2.2 snj .ef_inet6 = &ipsecif6_detach, 833 1.3.2.2 snj #endif 834 1.3.2.2 snj }; 835 1.3.2.2 snj 836 1.3.2.2 snj static int 837 1.3.2.2 snj if_ipsec_encap_common(struct ipsec_variant *var, struct encap_funcs *funcs) 838 1.3.2.2 snj { 839 1.3.2.2 snj int error; 840 1.3.2.2 snj 841 1.3.2.2 snj KASSERT(var != NULL); 842 1.3.2.2 snj KASSERT(if_ipsec_variant_is_configured(var)); 843 1.3.2.2 snj 844 1.3.2.2 snj switch (var->iv_psrc->sa_family) { 845 1.3.2.2 snj #ifdef INET 846 1.3.2.2 snj case AF_INET: 847 1.3.2.2 snj error = (funcs->ef_inet)(var); 848 1.3.2.2 snj break; 849 1.3.2.2 snj #endif /* INET */ 850 1.3.2.2 snj #ifdef INET6 851 1.3.2.2 snj case AF_INET6: 852 1.3.2.2 snj error = (funcs->ef_inet6)(var); 853 1.3.2.2 snj break; 854 1.3.2.2 snj #endif /* INET6 */ 855 1.3.2.2 snj default: 856 1.3.2.2 snj error = EINVAL; 857 1.3.2.2 snj break; 858 1.3.2.2 snj } 859 1.3.2.2 snj 860 1.3.2.2 snj return error; 861 1.3.2.2 snj } 862 1.3.2.2 snj 863 1.3.2.2 snj static int 864 1.3.2.2 snj if_ipsec_encap_attach(struct ipsec_variant *var) 865 1.3.2.2 snj { 866 1.3.2.2 snj 867 1.3.2.2 snj return if_ipsec_encap_common(var, &ipsec_encap_attach); 868 1.3.2.2 snj } 869 1.3.2.2 snj 870 1.3.2.2 snj static int 871 1.3.2.2 snj if_ipsec_encap_detach(struct ipsec_variant *var) 872 1.3.2.2 snj { 873 1.3.2.2 snj 874 1.3.2.2 snj return if_ipsec_encap_common(var, &ipsec_encap_detach); 875 1.3.2.2 snj } 876 1.3.2.2 snj 877 1.3.2.2 snj /* 878 1.3.2.2 snj * Validate and set ipsec(4) I/F configurations. 879 1.3.2.2 snj * (1) validate 880 1.3.2.2 snj * (1-1) Check the argument src and dst address pair will change 881 1.3.2.2 snj * configuration from current src and dst address pair. 882 1.3.2.2 snj * (1-2) Check any ipsec(4) I/F uses duplicated src and dst address pair 883 1.3.2.2 snj * with argument src and dst address pair, except for NAT-T shared 884 1.3.2.2 snj * tunnels. 885 1.3.2.2 snj * (2) set 886 1.3.2.2 snj * (2-1) Create variant for new configuration. 887 1.3.2.2 snj * (2-2) Create temporary "null" variant used to avoid to access 888 1.3.2.2 snj * dangling variant while SPs are deleted and added. 889 1.3.2.2 snj * (2-3) Swap variant include its SPs. 890 1.3.2.2 snj * (2-4) Cleanup last configurations. 891 1.3.2.2 snj */ 892 1.3.2.2 snj static int 893 1.3.2.2 snj if_ipsec_set_tunnel(struct ifnet *ifp, 894 1.3.2.2 snj struct sockaddr *src, struct sockaddr *dst) 895 1.3.2.2 snj { 896 1.3.2.2 snj struct ipsec_softc *sc = ifp->if_softc; 897 1.3.2.2 snj struct ipsec_softc *sc2; 898 1.3.2.2 snj struct ipsec_variant *ovar, *nvar, *nullvar; 899 1.3.2.2 snj struct sockaddr *osrc, *odst; 900 1.3.2.2 snj struct sockaddr *nsrc, *ndst; 901 1.3.2.2 snj in_port_t nsport = 0, ndport = 0; 902 1.3.2.2 snj int error; 903 1.3.2.2 snj 904 1.3.2.2 snj error = encap_lock_enter(); 905 1.3.2.2 snj if (error) 906 1.3.2.2 snj return error; 907 1.3.2.2 snj 908 1.3.2.2 snj nsrc = sockaddr_dup(src, M_WAITOK); 909 1.3.2.2 snj ndst = sockaddr_dup(dst, M_WAITOK); 910 1.3.2.2 snj nvar = kmem_zalloc(sizeof(*nvar), KM_SLEEP); 911 1.3.2.2 snj nullvar = kmem_zalloc(sizeof(*nullvar), KM_SLEEP); 912 1.3.2.2 snj 913 1.3.2.2 snj mutex_enter(&sc->ipsec_lock); 914 1.3.2.2 snj 915 1.3.2.2 snj ovar = sc->ipsec_var; 916 1.3.2.2 snj 917 1.3.2.2 snj switch(nsrc->sa_family) { 918 1.3.2.2 snj #ifdef INET 919 1.3.2.2 snj case AF_INET: 920 1.3.2.3 martin nsport = satosin(src)->sin_port; 921 1.3.2.2 snj /* 922 1.3.2.2 snj * avoid confuse SP when NAT-T disabled, 923 1.3.2.2 snj * e.g. 924 1.3.2.2 snj * expected: 10.0.1.2[any] 10.0.1.1[any] 4(ipv4) 925 1.3.2.2 snj * confuse : 10.0.1.2[600] 10.0.1.1[600] 4(ipv4) 926 1.3.2.2 snj */ 927 1.3.2.2 snj satosin(nsrc)->sin_port = 0; 928 1.3.2.3 martin ndport = satosin(dst)->sin_port; 929 1.3.2.2 snj satosin(ndst)->sin_port = 0; 930 1.3.2.2 snj break; 931 1.3.2.2 snj #endif /* INET */ 932 1.3.2.2 snj #ifdef INET6 933 1.3.2.2 snj case AF_INET6: 934 1.3.2.3 martin nsport = satosin6(src)->sin6_port; 935 1.3.2.2 snj satosin6(nsrc)->sin6_port = 0; 936 1.3.2.3 martin ndport = satosin6(dst)->sin6_port; 937 1.3.2.2 snj satosin6(ndst)->sin6_port = 0; 938 1.3.2.2 snj break; 939 1.3.2.2 snj #endif /* INET6 */ 940 1.3.2.2 snj default: 941 1.3.2.2 snj log(LOG_DEBUG, 942 1.3.2.2 snj "%s: Invalid address family: %d.\n", 943 1.3.2.2 snj __func__, src->sa_family); 944 1.3.2.2 snj error = EINVAL; 945 1.3.2.2 snj goto out; 946 1.3.2.2 snj } 947 1.3.2.2 snj 948 1.3.2.2 snj /* 949 1.3.2.2 snj * (1-1) Check the argument src and dst address pair will change 950 1.3.2.2 snj * configuration from current src and dst address pair. 951 1.3.2.2 snj */ 952 1.3.2.2 snj if ((ovar->iv_pdst && sockaddr_cmp(ovar->iv_pdst, dst) == 0) && 953 1.3.2.2 snj (ovar->iv_psrc && sockaddr_cmp(ovar->iv_psrc, src) == 0) && 954 1.3.2.2 snj (ovar->iv_sport == nsport && ovar->iv_dport == ndport)) { 955 1.3.2.2 snj /* address and port pair not changed. */ 956 1.3.2.2 snj error = 0; 957 1.3.2.2 snj goto out; 958 1.3.2.2 snj } 959 1.3.2.2 snj 960 1.3.2.2 snj /* 961 1.3.2.2 snj * (1-2) Check any ipsec(4) I/F uses duplicated src and dst address pair 962 1.3.2.2 snj * with argument src and dst address pair, except for NAT-T shared 963 1.3.2.2 snj * tunnels. 964 1.3.2.2 snj */ 965 1.3.2.2 snj mutex_enter(&ipsec_softcs.lock); 966 1.3.2.2 snj LIST_FOREACH(sc2, &ipsec_softcs.list, ipsec_list) { 967 1.3.2.2 snj struct ipsec_variant *var2; 968 1.3.2.2 snj struct psref psref; 969 1.3.2.2 snj 970 1.3.2.2 snj if (sc2 == sc) 971 1.3.2.2 snj continue; 972 1.3.2.2 snj var2 = if_ipsec_getref_variant(sc2, &psref); 973 1.3.2.2 snj if (if_ipsec_variant_is_unconfigured(var2)) { 974 1.3.2.2 snj if_ipsec_putref_variant(var2, &psref); 975 1.3.2.2 snj continue; 976 1.3.2.2 snj } 977 1.3.2.2 snj if (if_ipsec_nat_t(sc) || if_ipsec_nat_t(sc2)) { 978 1.3.2.2 snj if_ipsec_putref_variant(var2, &psref); 979 1.3.2.2 snj continue; /* NAT-T shared tunnel */ 980 1.3.2.2 snj } 981 1.3.2.2 snj if (sockaddr_cmp(var2->iv_pdst, dst) == 0 && 982 1.3.2.2 snj sockaddr_cmp(var2->iv_psrc, src) == 0) { 983 1.3.2.2 snj if_ipsec_putref_variant(var2, &psref); 984 1.3.2.2 snj mutex_exit(&ipsec_softcs.lock); 985 1.3.2.2 snj error = EADDRNOTAVAIL; 986 1.3.2.2 snj goto out; 987 1.3.2.2 snj } 988 1.3.2.2 snj 989 1.3.2.2 snj if_ipsec_putref_variant(var2, &psref); 990 1.3.2.2 snj /* XXX both end must be valid? (I mean, not 0.0.0.0) */ 991 1.3.2.2 snj } 992 1.3.2.2 snj mutex_exit(&ipsec_softcs.lock); 993 1.3.2.2 snj 994 1.3.2.2 snj 995 1.3.2.2 snj osrc = ovar->iv_psrc; 996 1.3.2.2 snj odst = ovar->iv_pdst; 997 1.3.2.2 snj 998 1.3.2.2 snj /* 999 1.3.2.2 snj * (2-1) Create ipsec_variant for new configuration. 1000 1.3.2.2 snj */ 1001 1.3.2.2 snj if_ipsec_copy_variant(nvar, ovar); 1002 1.3.2.2 snj nvar->iv_psrc = nsrc; 1003 1.3.2.2 snj nvar->iv_pdst = ndst; 1004 1.3.2.2 snj nvar->iv_sport = nsport; 1005 1.3.2.2 snj nvar->iv_dport = ndport; 1006 1.3.2.2 snj nvar->iv_encap_cookie4 = NULL; 1007 1.3.2.2 snj nvar->iv_encap_cookie6 = NULL; 1008 1.3.2.2 snj psref_target_init(&nvar->iv_psref, iv_psref_class); 1009 1.3.2.2 snj error = if_ipsec_encap_attach(nvar); 1010 1.3.2.2 snj if (error) 1011 1.3.2.2 snj goto out; 1012 1.3.2.2 snj 1013 1.3.2.2 snj /* 1014 1.3.2.2 snj * (2-2) Create temporary "null" variant. 1015 1.3.2.2 snj */ 1016 1.3.2.2 snj if_ipsec_copy_variant(nullvar, ovar); 1017 1.3.2.2 snj if_ipsec_clear_config(nullvar); 1018 1.3.2.2 snj psref_target_init(&nullvar->iv_psref, iv_psref_class); 1019 1.3.2.2 snj membar_producer(); 1020 1.3.2.2 snj /* 1021 1.3.2.2 snj * (2-3) Swap variant include its SPs. 1022 1.3.2.2 snj */ 1023 1.3.2.2 snj error = if_ipsec_update_variant(sc, nvar, nullvar); 1024 1.3.2.2 snj if (error) { 1025 1.3.2.2 snj if_ipsec_encap_detach(nvar); 1026 1.3.2.2 snj goto out; 1027 1.3.2.2 snj } 1028 1.3.2.2 snj 1029 1.3.2.2 snj mutex_exit(&sc->ipsec_lock); 1030 1.3.2.2 snj 1031 1.3.2.2 snj /* 1032 1.3.2.2 snj * (2-4) Cleanup last configurations. 1033 1.3.2.2 snj */ 1034 1.3.2.2 snj if (if_ipsec_variant_is_configured(ovar)) 1035 1.3.2.2 snj if_ipsec_encap_detach(ovar); 1036 1.3.2.2 snj encap_lock_exit(); 1037 1.3.2.2 snj 1038 1.3.2.2 snj if (osrc != NULL) 1039 1.3.2.2 snj sockaddr_free(osrc); 1040 1.3.2.2 snj if (odst != NULL) 1041 1.3.2.2 snj sockaddr_free(odst); 1042 1.3.2.2 snj kmem_free(ovar, sizeof(*ovar)); 1043 1.3.2.2 snj kmem_free(nullvar, sizeof(*nullvar)); 1044 1.3.2.2 snj 1045 1.3.2.2 snj return 0; 1046 1.3.2.2 snj 1047 1.3.2.2 snj out: 1048 1.3.2.2 snj mutex_exit(&sc->ipsec_lock); 1049 1.3.2.2 snj encap_lock_exit(); 1050 1.3.2.2 snj 1051 1.3.2.2 snj sockaddr_free(nsrc); 1052 1.3.2.2 snj sockaddr_free(ndst); 1053 1.3.2.2 snj kmem_free(nvar, sizeof(*nvar)); 1054 1.3.2.2 snj kmem_free(nullvar, sizeof(*nullvar)); 1055 1.3.2.2 snj 1056 1.3.2.2 snj return error; 1057 1.3.2.2 snj } 1058 1.3.2.2 snj 1059 1.3.2.2 snj /* 1060 1.3.2.2 snj * Validate and delete ipsec(4) I/F configurations. 1061 1.3.2.2 snj * (1) validate 1062 1.3.2.2 snj * (1-1) Check current src and dst address pair are null, 1063 1.3.2.2 snj * which means the ipsec(4) I/F is already done deletetunnel. 1064 1.3.2.2 snj * (2) delete 1065 1.3.2.2 snj * (2-1) Create variant for deleted status. 1066 1.3.2.2 snj * (2-2) Create temporary "null" variant used to avoid to access 1067 1.3.2.2 snj * dangling variant while SPs are deleted and added. 1068 1.3.2.2 snj * NOTE: 1069 1.3.2.2 snj * The contents of temporary "null" variant equal to the variant 1070 1.3.2.2 snj * of (2-1), however two psref_target_destroy() synchronization 1071 1.3.2.2 snj * points are necessary to avoid to access dangling variant 1072 1.3.2.2 snj * while SPs are deleted and added. To implement that simply, 1073 1.3.2.2 snj * we use the same manner as if_ipsec_set_tunnel(), that is, 1074 1.3.2.2 snj * create extra "null" variant and use it temporarily. 1075 1.3.2.2 snj * (2-3) Swap variant include its SPs. 1076 1.3.2.2 snj * (2-4) Cleanup last configurations. 1077 1.3.2.2 snj */ 1078 1.3.2.2 snj static void 1079 1.3.2.2 snj if_ipsec_delete_tunnel(struct ifnet *ifp) 1080 1.3.2.2 snj { 1081 1.3.2.2 snj struct ipsec_softc *sc = ifp->if_softc; 1082 1.3.2.2 snj struct ipsec_variant *ovar, *nvar, *nullvar; 1083 1.3.2.2 snj struct sockaddr *osrc, *odst; 1084 1.3.2.2 snj int error; 1085 1.3.2.2 snj 1086 1.3.2.2 snj error = encap_lock_enter(); 1087 1.3.2.2 snj if (error) 1088 1.3.2.2 snj return; 1089 1.3.2.2 snj 1090 1.3.2.2 snj nvar = kmem_zalloc(sizeof(*nvar), KM_SLEEP); 1091 1.3.2.2 snj nullvar = kmem_zalloc(sizeof(*nullvar), KM_SLEEP); 1092 1.3.2.2 snj 1093 1.3.2.2 snj mutex_enter(&sc->ipsec_lock); 1094 1.3.2.2 snj 1095 1.3.2.2 snj ovar = sc->ipsec_var; 1096 1.3.2.2 snj osrc = ovar->iv_psrc; 1097 1.3.2.2 snj odst = ovar->iv_pdst; 1098 1.3.2.2 snj /* 1099 1.3.2.2 snj * (1-1) Check current src and dst address pair are null, 1100 1.3.2.2 snj * which means the ipsec(4) I/F is already done deletetunnel. 1101 1.3.2.2 snj */ 1102 1.3.2.2 snj if (osrc == NULL || odst == NULL) { 1103 1.3.2.2 snj /* address pair not changed. */ 1104 1.3.2.2 snj mutex_exit(&sc->ipsec_lock); 1105 1.3.2.2 snj encap_lock_exit(); 1106 1.3.2.2 snj kmem_free(nvar, sizeof(*nvar)); 1107 1.3.2.11 martin kmem_free(nullvar, sizeof(*nullvar)); 1108 1.3.2.2 snj return; 1109 1.3.2.2 snj } 1110 1.3.2.2 snj 1111 1.3.2.2 snj /* 1112 1.3.2.2 snj * (2-1) Create variant for deleted status. 1113 1.3.2.2 snj */ 1114 1.3.2.2 snj if_ipsec_copy_variant(nvar, ovar); 1115 1.3.2.2 snj if_ipsec_clear_config(nvar); 1116 1.3.2.2 snj psref_target_init(&nvar->iv_psref, iv_psref_class); 1117 1.3.2.2 snj 1118 1.3.2.2 snj /* 1119 1.3.2.2 snj * (2-2) Create temporary "null" variant used to avoid to access 1120 1.3.2.2 snj * dangling variant while SPs are deleted and added. 1121 1.3.2.2 snj */ 1122 1.3.2.2 snj if_ipsec_copy_variant(nullvar, ovar); 1123 1.3.2.2 snj if_ipsec_clear_config(nullvar); 1124 1.3.2.2 snj psref_target_init(&nullvar->iv_psref, iv_psref_class); 1125 1.3.2.2 snj membar_producer(); 1126 1.3.2.2 snj /* 1127 1.3.2.2 snj * (2-3) Swap variant include its SPs. 1128 1.3.2.2 snj */ 1129 1.3.2.2 snj /* if_ipsec_update_variant() does not fail when delete SP only. */ 1130 1.3.2.2 snj (void)if_ipsec_update_variant(sc, nvar, nullvar); 1131 1.3.2.2 snj 1132 1.3.2.2 snj mutex_exit(&sc->ipsec_lock); 1133 1.3.2.2 snj 1134 1.3.2.2 snj /* 1135 1.3.2.2 snj * (2-4) Cleanup last configurations. 1136 1.3.2.2 snj */ 1137 1.3.2.2 snj if (if_ipsec_variant_is_configured(ovar)) 1138 1.3.2.2 snj if_ipsec_encap_detach(ovar); 1139 1.3.2.2 snj encap_lock_exit(); 1140 1.3.2.2 snj 1141 1.3.2.2 snj sockaddr_free(osrc); 1142 1.3.2.2 snj sockaddr_free(odst); 1143 1.3.2.2 snj kmem_free(ovar, sizeof(*ovar)); 1144 1.3.2.2 snj kmem_free(nullvar, sizeof(*nullvar)); 1145 1.3.2.2 snj } 1146 1.3.2.2 snj 1147 1.3.2.2 snj /* 1148 1.3.2.2 snj * Check IFF_NAT_T and IFF_FWD_IPV6 flags, therefore update SPs if needed. 1149 1.3.2.2 snj * (1) check 1150 1.3.2.2 snj * (1-1) Check flags are changed. 1151 1.3.2.2 snj * (1-2) Check current src and dst address pair. If they are null, 1152 1.3.2.2 snj * that means the ipsec(4) I/F is deletetunnel'ed, so it is 1153 1.3.2.2 snj * not needed to update. 1154 1.3.2.2 snj * (2) update 1155 1.3.2.2 snj * (2-1) Create variant for new SPs. 1156 1.3.2.2 snj * (2-2) Create temporary "null" variant used to avoid to access 1157 1.3.2.2 snj * dangling variant while SPs are deleted and added. 1158 1.3.2.2 snj * NOTE: 1159 1.3.2.2 snj * There is the same problem as if_ipsec_delete_tunnel(). 1160 1.3.2.2 snj * (2-3) Swap variant include its SPs. 1161 1.3.2.2 snj * (2-4) Cleanup unused configurations. 1162 1.3.2.2 snj * NOTE: use the same encap_cookies. 1163 1.3.2.2 snj */ 1164 1.3.2.2 snj static int 1165 1.3.2.2 snj if_ipsec_ensure_flags(struct ifnet *ifp, short oflags) 1166 1.3.2.2 snj { 1167 1.3.2.2 snj struct ipsec_softc *sc = ifp->if_softc; 1168 1.3.2.2 snj struct ipsec_variant *ovar, *nvar, *nullvar; 1169 1.3.2.2 snj int error; 1170 1.3.2.2 snj 1171 1.3.2.2 snj /* 1172 1.3.2.2 snj * (1) Check flags are changed. 1173 1.3.2.2 snj */ 1174 1.3.2.2 snj if ((oflags & (IFF_NAT_T|IFF_FWD_IPV6)) == 1175 1.3.2.2 snj (ifp->if_flags & (IFF_NAT_T|IFF_FWD_IPV6))) 1176 1.3.2.2 snj return 0; /* flags not changed. */ 1177 1.3.2.2 snj 1178 1.3.2.2 snj error = encap_lock_enter(); 1179 1.3.2.2 snj if (error) 1180 1.3.2.2 snj return error; 1181 1.3.2.2 snj 1182 1.3.2.2 snj nvar = kmem_zalloc(sizeof(*nvar), KM_SLEEP); 1183 1.3.2.2 snj nullvar = kmem_zalloc(sizeof(*nullvar), KM_SLEEP); 1184 1.3.2.2 snj 1185 1.3.2.2 snj mutex_enter(&sc->ipsec_lock); 1186 1.3.2.2 snj 1187 1.3.2.2 snj ovar = sc->ipsec_var; 1188 1.3.2.2 snj /* 1189 1.3.2.2 snj * (1-2) Check current src and dst address pair. 1190 1.3.2.2 snj */ 1191 1.3.2.2 snj if (if_ipsec_variant_is_unconfigured(ovar)) { 1192 1.3.2.2 snj /* nothing to do */ 1193 1.3.2.2 snj mutex_exit(&sc->ipsec_lock); 1194 1.3.2.5 martin encap_lock_exit(); 1195 1.3.2.11 martin kmem_free(nvar, sizeof(*nvar)); 1196 1.3.2.11 martin kmem_free(nullvar, sizeof(*nullvar)); 1197 1.3.2.2 snj return 0; 1198 1.3.2.2 snj } 1199 1.3.2.2 snj 1200 1.3.2.2 snj /* 1201 1.3.2.2 snj * (2-1) Create variant for new SPs. 1202 1.3.2.2 snj */ 1203 1.3.2.2 snj if_ipsec_copy_variant(nvar, ovar); 1204 1.3.2.2 snj psref_target_init(&nvar->iv_psref, iv_psref_class); 1205 1.3.2.2 snj /* 1206 1.3.2.2 snj * (2-2) Create temporary "null" variant used to avoid to access 1207 1.3.2.2 snj * dangling variant while SPs are deleted and added. 1208 1.3.2.2 snj */ 1209 1.3.2.2 snj if_ipsec_copy_variant(nullvar, ovar); 1210 1.3.2.2 snj if_ipsec_clear_config(nullvar); 1211 1.3.2.2 snj psref_target_init(&nullvar->iv_psref, iv_psref_class); 1212 1.3.2.2 snj membar_producer(); 1213 1.3.2.2 snj /* 1214 1.3.2.2 snj * (2-3) Swap variant include its SPs. 1215 1.3.2.2 snj */ 1216 1.3.2.2 snj error = if_ipsec_update_variant(sc, nvar, nullvar); 1217 1.3.2.2 snj 1218 1.3.2.2 snj mutex_exit(&sc->ipsec_lock); 1219 1.3.2.2 snj encap_lock_exit(); 1220 1.3.2.2 snj 1221 1.3.2.2 snj /* 1222 1.3.2.2 snj * (2-4) Cleanup unused configurations. 1223 1.3.2.2 snj */ 1224 1.3.2.2 snj if (!error) 1225 1.3.2.2 snj kmem_free(ovar, sizeof(*ovar)); 1226 1.3.2.2 snj else 1227 1.3.2.2 snj kmem_free(nvar, sizeof(*ovar)); 1228 1.3.2.2 snj kmem_free(nullvar, sizeof(*nullvar)); 1229 1.3.2.2 snj 1230 1.3.2.2 snj return error; 1231 1.3.2.2 snj } 1232 1.3.2.2 snj 1233 1.3.2.2 snj /* 1234 1.3.2.2 snj * SPD management 1235 1.3.2.2 snj */ 1236 1.3.2.2 snj 1237 1.3.2.2 snj /* 1238 1.3.2.2 snj * Share SP set with other NAT-T ipsec(4) I/F(s). 1239 1.3.2.2 snj * Return 1, when "var" shares SP set. 1240 1.3.2.2 snj * Return 0, when "var" cannot share SP set. 1241 1.3.2.2 snj * 1242 1.3.2.2 snj * NOTE: 1243 1.3.2.2 snj * if_ipsec_share_sp() and if_ipsec_unshare_sp() would require global lock 1244 1.3.2.2 snj * to exclude other ipsec(4) I/Fs set_tunnel/delete_tunnel. E.g. when ipsec0 1245 1.3.2.2 snj * and ipsec1 can share SP set, running ipsec0's set_tunnel and ipsec1's 1246 1.3.2.2 snj * set_tunnel causes race. 1247 1.3.2.2 snj * Currently, (fortunately) encap_lock works as this global lock. 1248 1.3.2.2 snj */ 1249 1.3.2.2 snj static int 1250 1.3.2.2 snj if_ipsec_share_sp(struct ipsec_variant *var) 1251 1.3.2.2 snj { 1252 1.3.2.2 snj struct ipsec_softc *sc = var->iv_softc; 1253 1.3.2.2 snj struct ipsec_softc *sc2; 1254 1.3.2.2 snj struct ipsec_variant *var2; 1255 1.3.2.2 snj struct psref psref; 1256 1.3.2.2 snj 1257 1.3.2.2 snj KASSERT(encap_lock_held()); 1258 1.3.2.2 snj KASSERT(var->iv_psrc != NULL && var->iv_pdst != NULL); 1259 1.3.2.2 snj 1260 1.3.2.2 snj mutex_enter(&ipsec_softcs.lock); 1261 1.3.2.2 snj LIST_FOREACH(sc2, &ipsec_softcs.list, ipsec_list) { 1262 1.3.2.2 snj if (sc2 == sc) 1263 1.3.2.2 snj continue; 1264 1.3.2.2 snj var2 = if_ipsec_getref_variant(sc2, &psref); 1265 1.3.2.2 snj if (if_ipsec_variant_is_unconfigured(var2)) { 1266 1.3.2.2 snj if_ipsec_putref_variant(var2, &psref); 1267 1.3.2.2 snj continue; 1268 1.3.2.2 snj } 1269 1.3.2.2 snj if (sockaddr_cmp(var2->iv_pdst, var->iv_pdst) != 0 || 1270 1.3.2.2 snj sockaddr_cmp(var2->iv_psrc, var->iv_psrc) != 0) { 1271 1.3.2.2 snj if_ipsec_putref_variant(var2, &psref); 1272 1.3.2.2 snj continue; 1273 1.3.2.2 snj } 1274 1.3.2.2 snj 1275 1.3.2.2 snj break; 1276 1.3.2.2 snj } 1277 1.3.2.2 snj mutex_exit(&ipsec_softcs.lock); 1278 1.3.2.2 snj if (sc2 == NULL) 1279 1.3.2.2 snj return 0; /* not shared */ 1280 1.3.2.2 snj 1281 1.3.2.2 snj IV_SP_IN(var) = IV_SP_IN(var2); 1282 1.3.2.2 snj IV_SP_IN6(var) = IV_SP_IN6(var2); 1283 1.3.2.2 snj IV_SP_OUT(var) = IV_SP_OUT(var2); 1284 1.3.2.2 snj IV_SP_OUT6(var) = IV_SP_OUT6(var2); 1285 1.3.2.2 snj 1286 1.3.2.2 snj if_ipsec_putref_variant(var2, &psref); 1287 1.3.2.2 snj return 1; /* shared */ 1288 1.3.2.2 snj } 1289 1.3.2.2 snj 1290 1.3.2.2 snj /* 1291 1.3.2.2 snj * Unshare SP set with other NAT-T ipsec(4) I/F(s). 1292 1.3.2.2 snj * Return 1, when "var" shared SP set, and then unshare them. 1293 1.3.2.2 snj * Return 0, when "var" did not share SP set. 1294 1.3.2.2 snj * 1295 1.3.2.2 snj * NOTE: 1296 1.3.2.2 snj * See if_ipsec_share_sp()'s note. 1297 1.3.2.2 snj */ 1298 1.3.2.2 snj static int 1299 1.3.2.2 snj if_ipsec_unshare_sp(struct ipsec_variant *var) 1300 1.3.2.2 snj { 1301 1.3.2.2 snj struct ipsec_softc *sc = var->iv_softc; 1302 1.3.2.2 snj struct ipsec_softc *sc2; 1303 1.3.2.2 snj struct ipsec_variant *var2; 1304 1.3.2.2 snj struct psref psref; 1305 1.3.2.2 snj 1306 1.3.2.2 snj KASSERT(encap_lock_held()); 1307 1.3.2.2 snj 1308 1.3.2.2 snj if (!var->iv_pdst || !var->iv_psrc) 1309 1.3.2.2 snj return 0; 1310 1.3.2.2 snj 1311 1.3.2.2 snj mutex_enter(&ipsec_softcs.lock); 1312 1.3.2.2 snj LIST_FOREACH(sc2, &ipsec_softcs.list, ipsec_list) { 1313 1.3.2.2 snj if (sc2 == sc) 1314 1.3.2.2 snj continue; 1315 1.3.2.2 snj var2 = if_ipsec_getref_variant(sc2, &psref); 1316 1.3.2.2 snj if (!var2->iv_pdst || !var2->iv_psrc) { 1317 1.3.2.2 snj if_ipsec_putref_variant(var2, &psref); 1318 1.3.2.2 snj continue; 1319 1.3.2.2 snj } 1320 1.3.2.2 snj if (sockaddr_cmp(var2->iv_pdst, var->iv_pdst) != 0 || 1321 1.3.2.2 snj sockaddr_cmp(var2->iv_psrc, var->iv_psrc) != 0) { 1322 1.3.2.2 snj if_ipsec_putref_variant(var2, &psref); 1323 1.3.2.2 snj continue; 1324 1.3.2.2 snj } 1325 1.3.2.2 snj 1326 1.3.2.2 snj break; 1327 1.3.2.2 snj } 1328 1.3.2.2 snj mutex_exit(&ipsec_softcs.lock); 1329 1.3.2.2 snj if (sc2 == NULL) 1330 1.3.2.2 snj return 0; /* not shared */ 1331 1.3.2.2 snj 1332 1.3.2.2 snj IV_SP_IN(var) = NULL; 1333 1.3.2.2 snj IV_SP_IN6(var) = NULL; 1334 1.3.2.2 snj IV_SP_OUT(var) = NULL; 1335 1.3.2.2 snj IV_SP_OUT6(var) = NULL; 1336 1.3.2.2 snj if_ipsec_putref_variant(var2, &psref); 1337 1.3.2.2 snj return 1; /* shared */ 1338 1.3.2.2 snj } 1339 1.3.2.2 snj 1340 1.3.2.2 snj static inline void 1341 1.3.2.4 martin if_ipsec_add_mbuf_optalign(struct mbuf *m0, void *data, size_t len, bool align) 1342 1.3.2.2 snj { 1343 1.3.2.2 snj struct mbuf *m; 1344 1.3.2.2 snj 1345 1.3.2.6 martin MGET(m, M_WAIT, MT_DATA); 1346 1.3.2.6 martin if (align) { 1347 1.3.2.4 martin m->m_len = PFKEY_ALIGN8(len); 1348 1.3.2.6 martin memset(mtod(m, void *), 0, m->m_len); 1349 1.3.2.6 martin } else 1350 1.3.2.4 martin m->m_len = len; 1351 1.3.2.2 snj m_copyback(m, 0, len, data); 1352 1.3.2.2 snj m_cat(m0, m); 1353 1.3.2.2 snj } 1354 1.3.2.2 snj 1355 1.3.2.2 snj static inline void 1356 1.3.2.4 martin if_ipsec_add_mbuf(struct mbuf *m0, void *data, size_t len) 1357 1.3.2.4 martin { 1358 1.3.2.4 martin 1359 1.3.2.4 martin if_ipsec_add_mbuf_optalign(m0, data, len, true); 1360 1.3.2.4 martin } 1361 1.3.2.4 martin 1362 1.3.2.4 martin static inline void 1363 1.3.2.4 martin if_ipsec_add_mbuf_addr_port(struct mbuf *m0, struct sockaddr *addr, in_port_t port, bool align) 1364 1.3.2.3 martin { 1365 1.3.2.3 martin 1366 1.3.2.3 martin if (port == 0) { 1367 1.3.2.4 martin if_ipsec_add_mbuf_optalign(m0, addr, addr->sa_len, align); 1368 1.3.2.3 martin } else { 1369 1.3.2.5 martin union sockaddr_union addrport_u; 1370 1.3.2.5 martin struct sockaddr *addrport = &addrport_u.sa; 1371 1.3.2.3 martin 1372 1.3.2.5 martin if_ipsec_set_addr_port(addrport, addr, port); 1373 1.3.2.5 martin if_ipsec_add_mbuf_optalign(m0, addrport, addrport->sa_len, align); 1374 1.3.2.3 martin } 1375 1.3.2.3 martin } 1376 1.3.2.3 martin 1377 1.3.2.3 martin static inline void 1378 1.3.2.2 snj if_ipsec_add_pad(struct mbuf *m0, size_t len) 1379 1.3.2.2 snj { 1380 1.3.2.2 snj struct mbuf *m; 1381 1.3.2.2 snj 1382 1.3.2.2 snj if (len == 0) 1383 1.3.2.2 snj return; 1384 1.3.2.2 snj 1385 1.3.2.6 martin MGET(m, M_WAIT, MT_DATA); 1386 1.3.2.2 snj m->m_len = len; 1387 1.3.2.6 martin memset(mtod(m, void *), 0, m->m_len); 1388 1.3.2.2 snj m_cat(m0, m); 1389 1.3.2.2 snj } 1390 1.3.2.2 snj 1391 1.3.2.2 snj static inline size_t 1392 1.3.2.2 snj if_ipsec_set_sadb_addr(struct sadb_address *saaddr, struct sockaddr *addr, 1393 1.3.2.2 snj int proto, uint16_t exttype) 1394 1.3.2.2 snj { 1395 1.3.2.2 snj size_t size; 1396 1.3.2.2 snj 1397 1.3.2.2 snj KASSERT(saaddr != NULL); 1398 1.3.2.2 snj KASSERT(addr != NULL); 1399 1.3.2.2 snj 1400 1.3.2.2 snj size = sizeof(*saaddr) + PFKEY_ALIGN8(addr->sa_len); 1401 1.3.2.2 snj saaddr->sadb_address_len = PFKEY_UNIT64(size); 1402 1.3.2.2 snj saaddr->sadb_address_exttype = exttype; 1403 1.3.2.2 snj saaddr->sadb_address_proto = proto; 1404 1.3.2.2 snj switch (addr->sa_family) { 1405 1.3.2.2 snj #ifdef INET 1406 1.3.2.2 snj case AF_INET: 1407 1.3.2.2 snj saaddr->sadb_address_prefixlen = sizeof(struct in_addr) << 3; 1408 1.3.2.2 snj break; 1409 1.3.2.2 snj #endif /* INET */ 1410 1.3.2.2 snj #ifdef INET6 1411 1.3.2.2 snj case AF_INET6: 1412 1.3.2.2 snj saaddr->sadb_address_prefixlen = sizeof(struct in6_addr) << 3; 1413 1.3.2.2 snj break; 1414 1.3.2.2 snj #endif /* INET6 */ 1415 1.3.2.2 snj default: 1416 1.3.2.2 snj log(LOG_DEBUG, 1417 1.3.2.2 snj "%s: Invalid address family: %d.\n", 1418 1.3.2.2 snj __func__, addr->sa_family); 1419 1.3.2.2 snj break; 1420 1.3.2.2 snj } 1421 1.3.2.2 snj saaddr->sadb_address_reserved = 0; 1422 1.3.2.2 snj 1423 1.3.2.2 snj return size; 1424 1.3.2.2 snj } 1425 1.3.2.2 snj 1426 1.3.2.2 snj static inline size_t 1427 1.3.2.2 snj if_ipsec_set_sadb_src(struct sadb_address *sasrc, struct sockaddr *src, 1428 1.3.2.2 snj int proto) 1429 1.3.2.2 snj { 1430 1.3.2.2 snj 1431 1.3.2.2 snj return if_ipsec_set_sadb_addr(sasrc, src, proto, 1432 1.3.2.2 snj SADB_EXT_ADDRESS_SRC); 1433 1.3.2.2 snj } 1434 1.3.2.2 snj 1435 1.3.2.2 snj static inline size_t 1436 1.3.2.2 snj if_ipsec_set_sadb_dst(struct sadb_address *sadst, struct sockaddr *dst, 1437 1.3.2.2 snj int proto) 1438 1.3.2.2 snj { 1439 1.3.2.2 snj 1440 1.3.2.2 snj return if_ipsec_set_sadb_addr(sadst, dst, proto, 1441 1.3.2.2 snj SADB_EXT_ADDRESS_DST); 1442 1.3.2.2 snj } 1443 1.3.2.2 snj 1444 1.3.2.2 snj static inline size_t 1445 1.3.2.2 snj if_ipsec_set_sadb_x_policy(struct sadb_x_policy *xpl, 1446 1.3.2.2 snj struct sadb_x_ipsecrequest *xisr, uint16_t policy, uint8_t dir, uint32_t id, 1447 1.3.2.3 martin uint8_t level, struct sockaddr *src, struct sockaddr *dst) 1448 1.3.2.2 snj { 1449 1.3.2.2 snj size_t size; 1450 1.3.2.2 snj 1451 1.3.2.2 snj KASSERT(policy != IPSEC_POLICY_IPSEC || xisr != NULL); 1452 1.3.2.2 snj 1453 1.3.2.2 snj size = sizeof(*xpl); 1454 1.3.2.2 snj if (policy == IPSEC_POLICY_IPSEC) { 1455 1.3.2.2 snj size += PFKEY_ALIGN8(sizeof(*xisr)); 1456 1.3.2.4 martin if (src != NULL && dst != NULL) 1457 1.3.2.4 martin size += PFKEY_ALIGN8(src->sa_len + dst->sa_len); 1458 1.3.2.2 snj } 1459 1.3.2.2 snj xpl->sadb_x_policy_len = PFKEY_UNIT64(size); 1460 1.3.2.2 snj xpl->sadb_x_policy_exttype = SADB_X_EXT_POLICY; 1461 1.3.2.2 snj xpl->sadb_x_policy_type = policy; 1462 1.3.2.2 snj xpl->sadb_x_policy_dir = dir; 1463 1.3.2.2 snj xpl->sadb_x_policy_reserved = 0; 1464 1.3.2.2 snj xpl->sadb_x_policy_id = id; 1465 1.3.2.2 snj xpl->sadb_x_policy_reserved2 = 0; 1466 1.3.2.2 snj 1467 1.3.2.2 snj if (policy == IPSEC_POLICY_IPSEC) { 1468 1.3.2.2 snj xisr->sadb_x_ipsecrequest_len = PFKEY_ALIGN8(sizeof(*xisr)); 1469 1.3.2.4 martin if (src != NULL && dst != NULL) 1470 1.3.2.4 martin xisr->sadb_x_ipsecrequest_len += 1471 1.3.2.4 martin PFKEY_ALIGN8(src->sa_len + dst->sa_len); 1472 1.3.2.2 snj xisr->sadb_x_ipsecrequest_proto = IPPROTO_ESP; 1473 1.3.2.2 snj xisr->sadb_x_ipsecrequest_mode = IPSEC_MODE_TRANSPORT; 1474 1.3.2.2 snj xisr->sadb_x_ipsecrequest_level = level; 1475 1.3.2.2 snj xisr->sadb_x_ipsecrequest_reqid = key_newreqid(); 1476 1.3.2.2 snj } 1477 1.3.2.2 snj 1478 1.3.2.2 snj return size; 1479 1.3.2.2 snj } 1480 1.3.2.2 snj 1481 1.3.2.2 snj static inline void 1482 1.3.2.2 snj if_ipsec_set_sadb_msg(struct sadb_msg *msg, uint16_t extlen, uint8_t msgtype) 1483 1.3.2.2 snj { 1484 1.3.2.2 snj 1485 1.3.2.2 snj KASSERT(msg != NULL); 1486 1.3.2.2 snj 1487 1.3.2.2 snj msg->sadb_msg_version = PF_KEY_V2; 1488 1.3.2.2 snj msg->sadb_msg_type = msgtype; 1489 1.3.2.2 snj msg->sadb_msg_errno = 0; 1490 1.3.2.2 snj msg->sadb_msg_satype = SADB_SATYPE_UNSPEC; 1491 1.3.2.2 snj msg->sadb_msg_len = PFKEY_UNIT64(sizeof(*msg)) + extlen; 1492 1.3.2.2 snj msg->sadb_msg_reserved = 0; 1493 1.3.2.2 snj msg->sadb_msg_seq = 0; /* XXXX */ 1494 1.3.2.2 snj msg->sadb_msg_pid = 0; /* XXXX */ 1495 1.3.2.2 snj } 1496 1.3.2.2 snj 1497 1.3.2.2 snj static inline void 1498 1.3.2.2 snj if_ipsec_set_sadb_msg_add(struct sadb_msg *msg, uint16_t extlen) 1499 1.3.2.2 snj { 1500 1.3.2.2 snj 1501 1.3.2.2 snj if_ipsec_set_sadb_msg(msg, extlen, SADB_X_SPDADD); 1502 1.3.2.2 snj } 1503 1.3.2.2 snj 1504 1.3.2.2 snj static inline void 1505 1.3.2.2 snj if_ipsec_set_sadb_msg_del(struct sadb_msg *msg, uint16_t extlen) 1506 1.3.2.2 snj { 1507 1.3.2.2 snj 1508 1.3.2.2 snj if_ipsec_set_sadb_msg(msg, extlen, SADB_X_SPDDELETE2); 1509 1.3.2.2 snj } 1510 1.3.2.2 snj 1511 1.3.2.2 snj static int 1512 1.3.2.2 snj if_ipsec_set_addr_port(struct sockaddr *addrport, struct sockaddr *addr, 1513 1.3.2.2 snj in_port_t port) 1514 1.3.2.2 snj { 1515 1.3.2.2 snj int error = 0; 1516 1.3.2.2 snj 1517 1.3.2.2 snj sockaddr_copy(addrport, addr->sa_len, addr); 1518 1.3.2.2 snj 1519 1.3.2.2 snj switch (addr->sa_family) { 1520 1.3.2.2 snj #ifdef INET 1521 1.3.2.2 snj case AF_INET: { 1522 1.3.2.2 snj struct sockaddr_in *sin = satosin(addrport); 1523 1.3.2.3 martin sin->sin_port = port; 1524 1.3.2.2 snj break; 1525 1.3.2.2 snj } 1526 1.3.2.2 snj #endif /* INET */ 1527 1.3.2.2 snj #ifdef INET6 1528 1.3.2.2 snj case AF_INET6: { 1529 1.3.2.2 snj struct sockaddr_in6 *sin6 = satosin6(addrport); 1530 1.3.2.3 martin sin6->sin6_port = port; 1531 1.3.2.2 snj break; 1532 1.3.2.2 snj } 1533 1.3.2.2 snj #endif /* INET6 */ 1534 1.3.2.2 snj default: 1535 1.3.2.2 snj log(LOG_DEBUG, 1536 1.3.2.2 snj "%s: Invalid address family: %d.\n", 1537 1.3.2.2 snj __func__, addr->sa_family); 1538 1.3.2.2 snj error = EINVAL; 1539 1.3.2.2 snj } 1540 1.3.2.2 snj 1541 1.3.2.2 snj return error; 1542 1.3.2.2 snj } 1543 1.3.2.2 snj 1544 1.3.2.2 snj static struct secpolicy * 1545 1.3.2.2 snj if_ipsec_add_sp0(struct sockaddr *src, in_port_t sport, 1546 1.3.2.2 snj struct sockaddr *dst, in_port_t dport, 1547 1.3.2.2 snj int dir, int proto, int level, u_int policy) 1548 1.3.2.2 snj { 1549 1.3.2.2 snj struct sadb_msg msg; 1550 1.3.2.2 snj struct sadb_address xsrc, xdst; 1551 1.3.2.2 snj struct sadb_x_policy xpl; 1552 1.3.2.2 snj struct sadb_x_ipsecrequest xisr; 1553 1.3.2.2 snj size_t size; 1554 1.3.2.2 snj size_t padlen; 1555 1.3.2.2 snj uint16_t ext_msg_len = 0; 1556 1.3.2.2 snj struct mbuf *m; 1557 1.3.2.2 snj 1558 1.3.2.2 snj memset(&msg, 0, sizeof(msg)); 1559 1.3.2.2 snj memset(&xsrc, 0, sizeof(xsrc)); 1560 1.3.2.2 snj memset(&xdst, 0, sizeof(xdst)); 1561 1.3.2.2 snj memset(&xpl, 0, sizeof(xpl)); 1562 1.3.2.2 snj memset(&xisr, 0, sizeof(xisr)); 1563 1.3.2.2 snj 1564 1.3.2.6 martin MGETHDR(m, M_WAIT, MT_DATA); 1565 1.3.2.2 snj 1566 1.3.2.2 snj size = if_ipsec_set_sadb_src(&xsrc, src, proto); 1567 1.3.2.2 snj ext_msg_len += PFKEY_UNIT64(size); 1568 1.3.2.2 snj size = if_ipsec_set_sadb_dst(&xdst, dst, proto); 1569 1.3.2.2 snj ext_msg_len += PFKEY_UNIT64(size); 1570 1.3.2.3 martin size = if_ipsec_set_sadb_x_policy(&xpl, &xisr, policy, dir, 0, level, src, dst); 1571 1.3.2.2 snj ext_msg_len += PFKEY_UNIT64(size); 1572 1.3.2.2 snj if_ipsec_set_sadb_msg_add(&msg, ext_msg_len); 1573 1.3.2.2 snj 1574 1.3.2.2 snj /* build PF_KEY message */ 1575 1.3.2.2 snj 1576 1.3.2.2 snj m->m_len = sizeof(msg); 1577 1.3.2.2 snj m_copyback(m, 0, sizeof(msg), &msg); 1578 1.3.2.2 snj 1579 1.3.2.2 snj if_ipsec_add_mbuf(m, &xsrc, sizeof(xsrc)); 1580 1.3.2.8 martin /* 1581 1.3.2.8 martin * secpolicy.spidx.{src, dst} must not be set port number, 1582 1.3.2.8 martin * even if it is used for NAT-T. 1583 1.3.2.8 martin */ 1584 1.3.2.8 martin if_ipsec_add_mbuf_addr_port(m, src, 0, true); 1585 1.3.2.2 snj padlen = PFKEY_UNUNIT64(xsrc.sadb_address_len) 1586 1.3.2.2 snj - (sizeof(xsrc) + PFKEY_ALIGN8(src->sa_len)); 1587 1.3.2.2 snj if_ipsec_add_pad(m, padlen); 1588 1.3.2.2 snj 1589 1.3.2.2 snj if_ipsec_add_mbuf(m, &xdst, sizeof(xdst)); 1590 1.3.2.8 martin /* ditto */ 1591 1.3.2.8 martin if_ipsec_add_mbuf_addr_port(m, dst, 0, true); 1592 1.3.2.2 snj padlen = PFKEY_UNUNIT64(xdst.sadb_address_len) 1593 1.3.2.2 snj - (sizeof(xdst) + PFKEY_ALIGN8(dst->sa_len)); 1594 1.3.2.2 snj if_ipsec_add_pad(m, padlen); 1595 1.3.2.2 snj 1596 1.3.2.2 snj if_ipsec_add_mbuf(m, &xpl, sizeof(xpl)); 1597 1.3.2.9 martin padlen = PFKEY_UNUNIT64(xpl.sadb_x_policy_len) - sizeof(xpl); 1598 1.3.2.3 martin if (policy == IPSEC_POLICY_IPSEC) { 1599 1.3.2.2 snj if_ipsec_add_mbuf(m, &xisr, sizeof(xisr)); 1600 1.3.2.8 martin /* 1601 1.3.2.8 martin * secpolicy.req->saidx.{src, dst} must be set port number, 1602 1.3.2.8 martin * when it is used for NAT-T. 1603 1.3.2.8 martin */ 1604 1.3.2.4 martin if_ipsec_add_mbuf_addr_port(m, src, sport, false); 1605 1.3.2.4 martin if_ipsec_add_mbuf_addr_port(m, dst, dport, false); 1606 1.3.2.9 martin padlen -= PFKEY_ALIGN8(sizeof(xisr)); 1607 1.3.2.4 martin padlen -= PFKEY_ALIGN8(src->sa_len + dst->sa_len); 1608 1.3.2.9 martin } 1609 1.3.2.3 martin if_ipsec_add_pad(m, padlen); 1610 1.3.2.2 snj 1611 1.3.2.2 snj /* key_kpi_spdadd() has already done KEY_SP_REF(). */ 1612 1.3.2.2 snj return key_kpi_spdadd(m); 1613 1.3.2.2 snj } 1614 1.3.2.2 snj 1615 1.3.2.2 snj static int 1616 1.3.2.2 snj if_ipsec_add_sp(struct ipsec_variant *var, 1617 1.3.2.2 snj struct sockaddr *src, in_port_t sport, 1618 1.3.2.2 snj struct sockaddr *dst, in_port_t dport) 1619 1.3.2.2 snj { 1620 1.3.2.2 snj struct ipsec_softc *sc = var->iv_softc; 1621 1.3.2.2 snj int level; 1622 1.3.2.2 snj u_int v6policy; 1623 1.3.2.2 snj 1624 1.3.2.2 snj /* 1625 1.3.2.2 snj * must delete sp before add it. 1626 1.3.2.2 snj */ 1627 1.3.2.2 snj KASSERT(IV_SP_IN(var) == NULL); 1628 1.3.2.2 snj KASSERT(IV_SP_OUT(var) == NULL); 1629 1.3.2.2 snj KASSERT(IV_SP_IN6(var) == NULL); 1630 1.3.2.2 snj KASSERT(IV_SP_OUT6(var) == NULL); 1631 1.3.2.2 snj 1632 1.3.2.2 snj /* 1633 1.3.2.2 snj * can be shared? 1634 1.3.2.2 snj */ 1635 1.3.2.2 snj if (if_ipsec_share_sp(var)) 1636 1.3.2.2 snj return 0; 1637 1.3.2.2 snj 1638 1.3.2.2 snj if (if_ipsec_nat_t(sc)) 1639 1.3.2.2 snj level = IPSEC_LEVEL_REQUIRE; 1640 1.3.2.2 snj else 1641 1.3.2.2 snj level = IPSEC_LEVEL_UNIQUE; 1642 1.3.2.2 snj 1643 1.3.2.2 snj if (if_ipsec_fwd_ipv6(sc)) 1644 1.3.2.2 snj v6policy = IPSEC_POLICY_IPSEC; 1645 1.3.2.2 snj else 1646 1.3.2.2 snj v6policy = IPSEC_POLICY_DISCARD; 1647 1.3.2.2 snj 1648 1.3.2.2 snj IV_SP_IN(var) = if_ipsec_add_sp0(dst, dport, src, sport, 1649 1.3.2.2 snj IPSEC_DIR_INBOUND, IPPROTO_IPIP, level, IPSEC_POLICY_IPSEC); 1650 1.3.2.2 snj if (IV_SP_IN(var) == NULL) 1651 1.3.2.2 snj goto fail; 1652 1.3.2.2 snj IV_SP_OUT(var) = if_ipsec_add_sp0(src, sport, dst, dport, 1653 1.3.2.2 snj IPSEC_DIR_OUTBOUND, IPPROTO_IPIP, level, IPSEC_POLICY_IPSEC); 1654 1.3.2.2 snj if (IV_SP_OUT(var) == NULL) 1655 1.3.2.2 snj goto fail; 1656 1.3.2.2 snj IV_SP_IN6(var) = if_ipsec_add_sp0(dst, dport, src, sport, 1657 1.3.2.2 snj IPSEC_DIR_INBOUND, IPPROTO_IPV6, level, v6policy); 1658 1.3.2.2 snj if (IV_SP_IN6(var) == NULL) 1659 1.3.2.2 snj goto fail; 1660 1.3.2.2 snj IV_SP_OUT6(var) = if_ipsec_add_sp0(src, sport, dst, dport, 1661 1.3.2.2 snj IPSEC_DIR_OUTBOUND, IPPROTO_IPV6, level, v6policy); 1662 1.3.2.2 snj if (IV_SP_OUT6(var) == NULL) 1663 1.3.2.2 snj goto fail; 1664 1.3.2.2 snj 1665 1.3.2.2 snj return 0; 1666 1.3.2.2 snj 1667 1.3.2.2 snj fail: 1668 1.3.2.2 snj if (IV_SP_IN6(var) != NULL) { 1669 1.3.2.2 snj if_ipsec_del_sp0(IV_SP_IN6(var)); 1670 1.3.2.2 snj IV_SP_IN6(var) = NULL; 1671 1.3.2.2 snj } 1672 1.3.2.2 snj if (IV_SP_OUT(var) != NULL) { 1673 1.3.2.2 snj if_ipsec_del_sp0(IV_SP_OUT(var)); 1674 1.3.2.2 snj IV_SP_OUT(var) = NULL; 1675 1.3.2.2 snj } 1676 1.3.2.2 snj if (IV_SP_IN(var) != NULL) { 1677 1.3.2.2 snj if_ipsec_del_sp0(IV_SP_IN(var)); 1678 1.3.2.2 snj IV_SP_IN(var) = NULL; 1679 1.3.2.2 snj } 1680 1.3.2.2 snj 1681 1.3.2.2 snj return EEXIST; 1682 1.3.2.2 snj } 1683 1.3.2.2 snj 1684 1.3.2.2 snj static int 1685 1.3.2.2 snj if_ipsec_del_sp0(struct secpolicy *sp) 1686 1.3.2.2 snj { 1687 1.3.2.2 snj struct sadb_msg msg; 1688 1.3.2.2 snj struct sadb_x_policy xpl; 1689 1.3.2.2 snj size_t size; 1690 1.3.2.2 snj uint16_t ext_msg_len = 0; 1691 1.3.2.2 snj int error; 1692 1.3.2.2 snj struct mbuf *m; 1693 1.3.2.2 snj 1694 1.3.2.2 snj if (sp == NULL) 1695 1.3.2.2 snj return 0; 1696 1.3.2.2 snj 1697 1.3.2.2 snj memset(&msg, 0, sizeof(msg)); 1698 1.3.2.2 snj memset(&xpl, 0, sizeof(xpl)); 1699 1.3.2.2 snj 1700 1.3.2.6 martin MGETHDR(m, M_WAIT, MT_DATA); 1701 1.3.2.2 snj 1702 1.3.2.3 martin size = if_ipsec_set_sadb_x_policy(&xpl, NULL, 0, 0, sp->id, 0, NULL, NULL); 1703 1.3.2.2 snj ext_msg_len += PFKEY_UNIT64(size); 1704 1.3.2.2 snj 1705 1.3.2.2 snj if_ipsec_set_sadb_msg_del(&msg, ext_msg_len); 1706 1.3.2.2 snj 1707 1.3.2.2 snj m->m_len = sizeof(msg); 1708 1.3.2.2 snj m_copyback(m, 0, sizeof(msg), &msg); 1709 1.3.2.2 snj 1710 1.3.2.2 snj if_ipsec_add_mbuf(m, &xpl, sizeof(xpl)); 1711 1.3.2.2 snj 1712 1.3.2.2 snj /* unreference correspond to key_kpi_spdadd(). */ 1713 1.3.2.2 snj KEY_SP_UNREF(&sp); 1714 1.3.2.2 snj error = key_kpi_spddelete2(m); 1715 1.3.2.2 snj if (error != 0) { 1716 1.3.2.2 snj log(LOG_ERR, "%s: cannot delete SP(ID=%u) (error=%d).\n", 1717 1.3.2.2 snj __func__, sp->id, error); 1718 1.3.2.2 snj } 1719 1.3.2.2 snj return error; 1720 1.3.2.2 snj } 1721 1.3.2.2 snj 1722 1.3.2.2 snj static void 1723 1.3.2.2 snj if_ipsec_del_sp(struct ipsec_variant *var) 1724 1.3.2.2 snj { 1725 1.3.2.2 snj 1726 1.3.2.2 snj /* are the SPs shared? */ 1727 1.3.2.2 snj if (if_ipsec_unshare_sp(var)) 1728 1.3.2.2 snj return; 1729 1.3.2.2 snj 1730 1.3.2.2 snj (void)if_ipsec_del_sp0(IV_SP_OUT(var)); 1731 1.3.2.2 snj (void)if_ipsec_del_sp0(IV_SP_IN(var)); 1732 1.3.2.2 snj (void)if_ipsec_del_sp0(IV_SP_OUT6(var)); 1733 1.3.2.2 snj (void)if_ipsec_del_sp0(IV_SP_IN6(var)); 1734 1.3.2.2 snj IV_SP_IN(var) = NULL; 1735 1.3.2.2 snj IV_SP_IN6(var) = NULL; 1736 1.3.2.2 snj IV_SP_OUT(var) = NULL; 1737 1.3.2.2 snj IV_SP_OUT6(var) = NULL; 1738 1.3.2.2 snj } 1739 1.3.2.2 snj 1740 1.3.2.2 snj static int 1741 1.3.2.2 snj if_ipsec_replace_sp(struct ipsec_softc *sc, struct ipsec_variant *ovar, 1742 1.3.2.2 snj struct ipsec_variant *nvar) 1743 1.3.2.2 snj { 1744 1.3.2.2 snj in_port_t src_port = 0; 1745 1.3.2.2 snj in_port_t dst_port = 0; 1746 1.3.2.2 snj struct sockaddr *src; 1747 1.3.2.2 snj struct sockaddr *dst; 1748 1.3.2.2 snj int error = 0; 1749 1.3.2.2 snj 1750 1.3.2.2 snj KASSERT(mutex_owned(&sc->ipsec_lock)); 1751 1.3.2.2 snj 1752 1.3.2.2 snj if_ipsec_del_sp(ovar); 1753 1.3.2.2 snj 1754 1.3.2.2 snj src = nvar->iv_psrc; 1755 1.3.2.2 snj dst = nvar->iv_pdst; 1756 1.3.2.2 snj if (if_ipsec_nat_t(sc)) { 1757 1.3.2.2 snj /* NAT-T enabled */ 1758 1.3.2.2 snj src_port = nvar->iv_sport; 1759 1.3.2.2 snj dst_port = nvar->iv_dport; 1760 1.3.2.2 snj } 1761 1.3.2.2 snj if (src && dst) 1762 1.3.2.2 snj error = if_ipsec_add_sp(nvar, src, src_port, dst, dst_port); 1763 1.3.2.2 snj 1764 1.3.2.2 snj return error; 1765 1.3.2.2 snj } 1766 1.3.2.2 snj 1767 1.3.2.2 snj /* 1768 1.3.2.2 snj * ipsec_variant and its SPs update API. 1769 1.3.2.2 snj * 1770 1.3.2.2 snj * Assumption: 1771 1.3.2.2 snj * reader side dereferences sc->ipsec_var in reader critical section only, 1772 1.3.2.2 snj * that is, all of reader sides do not reader the sc->ipsec_var after 1773 1.3.2.2 snj * pserialize_perform(). 1774 1.3.2.2 snj */ 1775 1.3.2.2 snj static int 1776 1.3.2.2 snj if_ipsec_update_variant(struct ipsec_softc *sc, struct ipsec_variant *nvar, 1777 1.3.2.2 snj struct ipsec_variant *nullvar) 1778 1.3.2.2 snj { 1779 1.3.2.2 snj struct ifnet *ifp = &sc->ipsec_if; 1780 1.3.2.2 snj struct ipsec_variant *ovar = sc->ipsec_var; 1781 1.3.2.2 snj int error; 1782 1.3.2.2 snj 1783 1.3.2.2 snj KASSERT(mutex_owned(&sc->ipsec_lock)); 1784 1.3.2.2 snj 1785 1.3.2.2 snj /* 1786 1.3.2.2 snj * To keep consistency between ipsec(4) I/F settings and SPs, 1787 1.3.2.2 snj * we stop packet processing while replacing SPs, that is, we set 1788 1.3.2.2 snj * "null" config variant to sc->ipsec_var. 1789 1.3.2.2 snj */ 1790 1.3.2.2 snj sc->ipsec_var = nullvar; 1791 1.3.2.10 martin pserialize_perform(sc->ipsec_psz); 1792 1.3.2.2 snj psref_target_destroy(&ovar->iv_psref, iv_psref_class); 1793 1.3.2.2 snj 1794 1.3.2.2 snj error = if_ipsec_replace_sp(sc, ovar, nvar); 1795 1.3.2.2 snj if (!error) 1796 1.3.2.2 snj sc->ipsec_var = nvar; 1797 1.3.2.2 snj else { 1798 1.3.2.2 snj sc->ipsec_var = ovar; /* rollback */ 1799 1.3.2.2 snj psref_target_init(&ovar->iv_psref, iv_psref_class); 1800 1.3.2.2 snj } 1801 1.3.2.2 snj 1802 1.3.2.10 martin pserialize_perform(sc->ipsec_psz); 1803 1.3.2.2 snj psref_target_destroy(&nullvar->iv_psref, iv_psref_class); 1804 1.3.2.2 snj 1805 1.3.2.2 snj if (if_ipsec_variant_is_configured(sc->ipsec_var)) 1806 1.3.2.2 snj ifp->if_flags |= IFF_RUNNING; 1807 1.3.2.2 snj else 1808 1.3.2.2 snj ifp->if_flags &= ~IFF_RUNNING; 1809 1.3.2.2 snj 1810 1.3.2.2 snj return error; 1811 1.3.2.2 snj } 1812
Indexes created Fri Sep 26 20:09:58 GMT 2025