ipsec.c revision 1.104
1 /* $NetBSD: ipsec.c,v 1.104 2017/07/18 09:00:55 ozaki-r Exp $ */ 2 /* $FreeBSD: /usr/local/www/cvsroot/FreeBSD/src/sys/netipsec/ipsec.c,v 1.2.2.2 2003/07/01 01:38:13 sam Exp $ */ 3 /* $KAME: ipsec.c,v 1.103 2001/05/24 07:14:18 sakane Exp $ */ 4 5 /* 6 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. 7 * All rights reserved. 8 * 9 * Redistribution and use in source and binary forms, with or without 10 * modification, are permitted provided that the following conditions 11 * are met: 12 * 1. Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * 2. Redistributions in binary form must reproduce the above copyright 15 * notice, this list of conditions and the following disclaimer in the 16 * documentation and/or other materials provided with the distribution. 17 * 3. Neither the name of the project nor the names of its contributors 18 * may be used to endorse or promote products derived from this software 19 * without specific prior written permission. 20 * 21 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND 22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 24 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE 25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 31 * SUCH DAMAGE. 32 */ 33 34 #include <sys/cdefs.h> 35 __KERNEL_RCSID(0, "$NetBSD: ipsec.c,v 1.104 2017/07/18 09:00:55 ozaki-r Exp $"); 36 37 /* 38 * IPsec controller part. 39 */ 40 41 #if defined(_KERNEL_OPT) 42 #include "opt_inet.h" 43 #include "opt_ipsec.h" 44 #endif 45 46 #include <sys/param.h> 47 #include <sys/systm.h> 48 #include <sys/mbuf.h> 49 #include <sys/domain.h> 50 #include <sys/protosw.h> 51 #include <sys/socket.h> 52 #include <sys/socketvar.h> 53 #include <sys/errno.h> 54 #include <sys/time.h> 55 #include <sys/kernel.h> 56 #include <sys/syslog.h> 57 #include <sys/sysctl.h> 58 #include <sys/proc.h> 59 #include <sys/kauth.h> 60 #include <sys/cpu.h> 61 #include <sys/kmem.h> 62 63 #include <net/if.h> 64 #include <net/route.h> 65 66 #include <netinet/in.h> 67 #include <netinet/in_systm.h> 68 #include <netinet/ip.h> 69 #include <netinet/ip_var.h> 70 #include <netinet/in_var.h> 71 #include <netinet/udp.h> 72 #include <netinet/udp_var.h> 73 #include <netinet/tcp.h> 74 #include <netinet/udp.h> 75 #include <netinet/ip_icmp.h> 76 #include <netinet/ip_private.h> 77 78 #include <netinet/ip6.h> 79 #ifdef INET6 80 #include <netinet6/ip6_var.h> 81 #endif 82 #include <netinet/in_pcb.h> 83 #ifdef INET6 84 #include <netinet6/in6_pcb.h> 85 #include <netinet/icmp6.h> 86 #endif 87 88 #include <netipsec/ipsec.h> 89 #include <netipsec/ipsec_var.h> 90 #include <netipsec/ipsec_private.h> 91 #ifdef INET6 92 #include <netipsec/ipsec6.h> 93 #endif 94 #include <netipsec/ah_var.h> 95 #include <netipsec/esp_var.h> 96 #include <netipsec/ipcomp.h> /*XXX*/ 97 #include <netipsec/ipcomp_var.h> 98 99 #include <netipsec/key.h> 100 #include <netipsec/keydb.h> 101 #include <netipsec/key_debug.h> 102 103 #include <netipsec/xform.h> 104 105 #include <net/net_osdep.h> 106 107 int ipsec_used = 0; 108 int ipsec_enabled = 1; 109 110 #ifdef IPSEC_DEBUG 111 int ipsec_debug = 1; 112 113 /* 114 * When set to 1, IPsec will send packets with the same sequence number. 115 * This allows to verify if the other side has proper replay attacks detection. 116 */ 117 int ipsec_replay = 0; 118 119 /* 120 * When set 1, IPsec will send packets with corrupted HMAC. 121 * This allows to verify if the other side properly detects modified packets. 122 */ 123 int ipsec_integrity = 0; 124 #else 125 int ipsec_debug = 0; 126 #endif 127 128 percpu_t *ipsecstat_percpu; 129 int ip4_ah_offsetmask = 0; /* maybe IP_DF? */ 130 int ip4_ipsec_dfbit = 2; /* DF bit on encap. 0: clear 1: set 2: copy */ 131 int ip4_esp_trans_deflev = IPSEC_LEVEL_USE; 132 int ip4_esp_net_deflev = IPSEC_LEVEL_USE; 133 int ip4_ah_trans_deflev = IPSEC_LEVEL_USE; 134 int ip4_ah_net_deflev = IPSEC_LEVEL_USE; 135 struct secpolicy ip4_def_policy; 136 int ip4_ipsec_ecn = 0; /* ECN ignore(-1)/forbidden(0)/allowed(1) */ 137 int ip4_esp_randpad = -1; 138 139 u_int ipsec_spdgen = 1; /* SPD generation # */ 140 141 static struct secpolicy *ipsec_checkpcbcache (struct mbuf *, 142 struct inpcbpolicy *, int); 143 static int ipsec_fillpcbcache (struct inpcbpolicy *, struct mbuf *, 144 struct secpolicy *, int); 145 static int ipsec_invalpcbcache (struct inpcbpolicy *, int); 146 147 /* 148 * Crypto support requirements: 149 * 150 * 1 require hardware support 151 * -1 require software support 152 * 0 take anything 153 */ 154 int crypto_support = 0; 155 156 static struct secpolicy *ipsec_getpolicybysock(struct mbuf *, u_int, 157 struct inpcb_hdr *, int *); 158 159 #ifdef __FreeBSD__ 160 /* net.inet.ipsec */ 161 SYSCTL_INT(_net_inet_ipsec, IPSECCTL_ESP_RANDPAD, 162 esp_randpad, CTLFLAG_RW, &ip4_esp_randpad, 0, ""); 163 SYSCTL_INT(_net_inet_ipsec, OID_AUTO, 164 crypto_support, CTLFLAG_RW, &crypto_support,0, ""); 165 SYSCTL_INT(_net_inet_ipsec, OID_AUTO, test_replay, CTLFLAG_RW, &ipsec_replay, 0, 166 "Emulate replay attack"); 167 SYSCTL_INT(_net_inet_ipsec, OID_AUTO, test_integrity, CTLFLAG_RW, 168 &ipsec_integrity, 0, "Emulate man-in-the-middle attack"); 169 #endif /* __FreeBSD__ */ 170 171 #ifdef INET6 172 int ip6_esp_trans_deflev = IPSEC_LEVEL_USE; 173 int ip6_esp_net_deflev = IPSEC_LEVEL_USE; 174 int ip6_ah_trans_deflev = IPSEC_LEVEL_USE; 175 int ip6_ah_net_deflev = IPSEC_LEVEL_USE; 176 struct secpolicy ip6_def_policy; 177 int ip6_ipsec_ecn = 0; /* ECN ignore(-1)/forbidden(0)/allowed(1) */ 178 int ip6_esp_randpad = -1; 179 180 181 #ifdef __FreeBSD__ 182 /* net.inet6.ipsec6 */ 183 SYSCTL_INT(_net_inet6_ipsec6, IPSECCTL_ESP_RANDPAD, 184 esp_randpad, CTLFLAG_RW, &ip6_esp_randpad, 0, ""); 185 #endif /* __FreeBSD__ */ 186 #endif /* INET6 */ 187 188 static int ipsec4_setspidx_inpcb (struct mbuf *, struct inpcb *); 189 #ifdef INET6 190 static int ipsec6_setspidx_in6pcb (struct mbuf *, struct in6pcb *); 191 #endif 192 static int ipsec_setspidx (struct mbuf *, struct secpolicyindex *, int); 193 static void ipsec4_get_ulp (struct mbuf *m, struct secpolicyindex *, int); 194 static int ipsec4_setspidx_ipaddr (struct mbuf *, struct secpolicyindex *); 195 #ifdef INET6 196 static void ipsec6_get_ulp (struct mbuf *m, struct secpolicyindex *, int); 197 static int ipsec6_setspidx_ipaddr (struct mbuf *, struct secpolicyindex *); 198 #endif 199 static void ipsec_delpcbpolicy (struct inpcbpolicy *); 200 static struct secpolicy *ipsec_deepcopy_policy (const struct secpolicy *); 201 static int ipsec_set_policy (struct secpolicy **, int, const void *, size_t, 202 kauth_cred_t); 203 static int ipsec_get_policy (struct secpolicy *, struct mbuf **); 204 static void vshiftl (unsigned char *, int, int); 205 static size_t ipsec_hdrsiz (const struct secpolicy *); 206 207 /* 208 * Try to validate and use cached policy on a PCB. 209 */ 210 static struct secpolicy * 211 ipsec_checkpcbcache(struct mbuf *m, struct inpcbpolicy *pcbsp, int dir) 212 { 213 struct secpolicyindex spidx; 214 215 KASSERT(IPSEC_DIR_IS_VALID(dir)); 216 KASSERT(pcbsp != NULL); 217 KASSERT(dir < __arraycount(pcbsp->sp_cache)); 218 KASSERT(inph_locked(pcbsp->sp_inph)); 219 220 /* SPD table change invalidate all the caches. */ 221 if (ipsec_spdgen != pcbsp->sp_cache[dir].cachegen) { 222 ipsec_invalpcbcache(pcbsp, dir); 223 return NULL; 224 } 225 if (!pcbsp->sp_cache[dir].cachesp) 226 return NULL; 227 if (pcbsp->sp_cache[dir].cachesp->state != IPSEC_SPSTATE_ALIVE) { 228 ipsec_invalpcbcache(pcbsp, dir); 229 return NULL; 230 } 231 if ((pcbsp->sp_cacheflags & IPSEC_PCBSP_CONNECTED) == 0) { 232 if (ipsec_setspidx(m, &spidx, 1) != 0) 233 return NULL; 234 235 /* 236 * We have to make an exact match here since the cached rule 237 * might have lower priority than a rule that would otherwise 238 * have matched the packet. 239 */ 240 if (memcmp(&pcbsp->sp_cache[dir].cacheidx, &spidx, sizeof(spidx))) 241 return NULL; 242 } else { 243 /* 244 * The pcb is connected, and the L4 code is sure that: 245 * - outgoing side uses inp_[lf]addr 246 * - incoming side looks up policy after inpcb lookup 247 * and address pair is know to be stable. We do not need 248 * to generate spidx again, nor check the address match again. 249 * 250 * For IPv4/v6 SOCK_STREAM sockets, this assumptions holds 251 * and there are calls to ipsec_pcbconn() from in_pcbconnect(). 252 */ 253 } 254 255 pcbsp->sp_cache[dir].cachesp->lastused = time_second; 256 KEY_SP_REF(pcbsp->sp_cache[dir].cachesp); 257 KEYDEBUG_PRINTF(KEYDEBUG_IPSEC_STAMP, 258 "DP cause refcnt++:%d SP:%p\n", 259 pcbsp->sp_cache[dir].cachesp->refcnt, 260 pcbsp->sp_cache[dir].cachesp); 261 return pcbsp->sp_cache[dir].cachesp; 262 } 263 264 static int 265 ipsec_fillpcbcache(struct inpcbpolicy *pcbsp, struct mbuf *m, 266 struct secpolicy *sp, int dir) 267 { 268 269 KASSERT(IPSEC_DIR_IS_INOROUT(dir)); 270 KASSERT(dir < __arraycount(pcbsp->sp_cache)); 271 KASSERT(inph_locked(pcbsp->sp_inph)); 272 273 if (pcbsp->sp_cache[dir].cachesp) 274 KEY_FREESP(&pcbsp->sp_cache[dir].cachesp); 275 pcbsp->sp_cache[dir].cachesp = NULL; 276 pcbsp->sp_cache[dir].cachehint = IPSEC_PCBHINT_UNKNOWN; 277 if (ipsec_setspidx(m, &pcbsp->sp_cache[dir].cacheidx, 1) != 0) { 278 return EINVAL; 279 } 280 pcbsp->sp_cache[dir].cachesp = sp; 281 if (pcbsp->sp_cache[dir].cachesp) { 282 KEY_SP_REF(pcbsp->sp_cache[dir].cachesp); 283 KEYDEBUG_PRINTF(KEYDEBUG_IPSEC_STAMP, 284 "DP cause refcnt++:%d SP:%p\n", 285 pcbsp->sp_cache[dir].cachesp->refcnt, 286 pcbsp->sp_cache[dir].cachesp); 287 288 /* 289 * If the PCB is connected, we can remember a hint to 290 * possibly short-circuit IPsec processing in other places. 291 */ 292 if (pcbsp->sp_cacheflags & IPSEC_PCBSP_CONNECTED) { 293 switch (pcbsp->sp_cache[dir].cachesp->policy) { 294 case IPSEC_POLICY_NONE: 295 case IPSEC_POLICY_BYPASS: 296 pcbsp->sp_cache[dir].cachehint = 297 IPSEC_PCBHINT_NO; 298 break; 299 default: 300 pcbsp->sp_cache[dir].cachehint = 301 IPSEC_PCBHINT_YES; 302 } 303 } 304 } 305 pcbsp->sp_cache[dir].cachegen = ipsec_spdgen; 306 307 return 0; 308 } 309 310 static int 311 ipsec_invalpcbcache(struct inpcbpolicy *pcbsp, int dir) 312 { 313 int i; 314 315 KASSERT(inph_locked(pcbsp->sp_inph)); 316 317 for (i = IPSEC_DIR_INBOUND; i <= IPSEC_DIR_OUTBOUND; i++) { 318 if (dir != IPSEC_DIR_ANY && i != dir) 319 continue; 320 if (pcbsp->sp_cache[i].cachesp) 321 KEY_FREESP(&pcbsp->sp_cache[i].cachesp); 322 pcbsp->sp_cache[i].cachesp = NULL; 323 pcbsp->sp_cache[i].cachehint = IPSEC_PCBHINT_UNKNOWN; 324 pcbsp->sp_cache[i].cachegen = 0; 325 memset(&pcbsp->sp_cache[i].cacheidx, 0, 326 sizeof(pcbsp->sp_cache[i].cacheidx)); 327 } 328 return 0; 329 } 330 331 void 332 ipsec_pcbconn(struct inpcbpolicy *pcbsp) 333 { 334 335 KASSERT(inph_locked(pcbsp->sp_inph)); 336 337 pcbsp->sp_cacheflags |= IPSEC_PCBSP_CONNECTED; 338 ipsec_invalpcbcache(pcbsp, IPSEC_DIR_ANY); 339 } 340 341 void 342 ipsec_pcbdisconn(struct inpcbpolicy *pcbsp) 343 { 344 345 KASSERT(inph_locked(pcbsp->sp_inph)); 346 347 pcbsp->sp_cacheflags &= ~IPSEC_PCBSP_CONNECTED; 348 ipsec_invalpcbcache(pcbsp, IPSEC_DIR_ANY); 349 } 350 351 void 352 ipsec_invalpcbcacheall(void) 353 { 354 355 if (ipsec_spdgen == UINT_MAX) 356 ipsec_spdgen = 1; 357 else 358 ipsec_spdgen++; 359 } 360 361 /* 362 * Return a held reference to the default SP. 363 */ 364 static struct secpolicy * 365 key_get_default_sp(int af, const char *where, int tag) 366 { 367 struct secpolicy *sp; 368 369 KEYDEBUG_PRINTF(KEYDEBUG_IPSEC_STAMP, "DP from %s:%u\n", where, tag); 370 371 switch(af) { 372 case AF_INET: 373 sp = &ip4_def_policy; 374 break; 375 #ifdef INET6 376 case AF_INET6: 377 sp = &ip6_def_policy; 378 break; 379 #endif 380 default: 381 KEYDEBUG_PRINTF(KEYDEBUG_IPSEC_STAMP, 382 "unexpected protocol family %u\n", af); 383 return NULL; 384 } 385 386 if (sp->policy != IPSEC_POLICY_DISCARD && 387 sp->policy != IPSEC_POLICY_NONE) { 388 IPSECLOG(LOG_INFO, "fixed system default policy: %d->%d\n", 389 sp->policy, IPSEC_POLICY_NONE); 390 sp->policy = IPSEC_POLICY_NONE; 391 } 392 KEY_SP_REF(sp); 393 394 KEYDEBUG_PRINTF(KEYDEBUG_IPSEC_STAMP, "DP returns SP:%p (%u)\n", 395 sp, sp->refcnt); 396 return sp; 397 } 398 #define KEY_GET_DEFAULT_SP(af) \ 399 key_get_default_sp((af), __func__, __LINE__) 400 401 /* 402 * For OUTBOUND packet having a socket. Searching SPD for packet, 403 * and return a pointer to SP. 404 * OUT: NULL: no apropreate SP found, the following value is set to error. 405 * 0 : bypass 406 * EACCES : discard packet. 407 * ENOENT : ipsec_acquire() in progress, maybe. 408 * others : error occurred. 409 * others: a pointer to SP 410 * 411 * NOTE: IPv6 mapped address concern is implemented here. 412 */ 413 struct secpolicy * 414 ipsec_getpolicy(const struct tdb_ident *tdbi, u_int dir) 415 { 416 struct secpolicy *sp; 417 418 KASSERT(tdbi != NULL); 419 KASSERTMSG(IPSEC_DIR_IS_INOROUT(dir), "invalid direction %u", dir); 420 421 sp = KEY_LOOKUP_SP(tdbi->spi, &tdbi->dst, tdbi->proto, dir); 422 if (sp == NULL) /*XXX????*/ 423 sp = KEY_GET_DEFAULT_SP(tdbi->dst.sa.sa_family); 424 KASSERT(sp != NULL); 425 return sp; 426 } 427 428 /* 429 * For OUTBOUND packet having a socket. Searching SPD for packet, 430 * and return a pointer to SP. 431 * OUT: NULL: no apropreate SP found, the following value is set to error. 432 * 0 : bypass 433 * EACCES : discard packet. 434 * ENOENT : ipsec_acquire() in progress, maybe. 435 * others : error occurred. 436 * others: a pointer to SP 437 * 438 * NOTE: IPv6 mapped address concern is implemented here. 439 */ 440 static struct secpolicy * 441 ipsec_getpolicybysock(struct mbuf *m, u_int dir, struct inpcb_hdr *inph, 442 int *error) 443 { 444 struct inpcbpolicy *pcbsp = NULL; 445 struct secpolicy *currsp = NULL; /* policy on socket */ 446 struct secpolicy *sp; 447 int af; 448 449 KASSERT(m != NULL); 450 KASSERT(inph != NULL); 451 KASSERT(error != NULL); 452 KASSERTMSG(IPSEC_DIR_IS_INOROUT(dir), "invalid direction %u", dir); 453 454 KASSERT(inph->inph_socket != NULL); 455 KASSERT(inph_locked(inph)); 456 457 /* XXX FIXME inpcb/in6pcb vs socket*/ 458 af = inph->inph_af; 459 KASSERTMSG(af == AF_INET || af == AF_INET6, 460 "unexpected protocol family %u", af); 461 462 KASSERT(inph->inph_sp != NULL); 463 /* If we have a cached entry, and if it is still valid, use it. */ 464 IPSEC_STATINC(IPSEC_STAT_SPDCACHELOOKUP); 465 currsp = ipsec_checkpcbcache(m, inph->inph_sp, dir); 466 if (currsp) { 467 *error = 0; 468 return currsp; 469 } 470 IPSEC_STATINC(IPSEC_STAT_SPDCACHEMISS); 471 472 switch (af) { 473 case AF_INET: { 474 struct inpcb *in4p = (struct inpcb *)inph; 475 /* set spidx in pcb */ 476 *error = ipsec4_setspidx_inpcb(m, in4p); 477 pcbsp = in4p->inp_sp; 478 break; 479 } 480 481 #if defined(INET6) 482 case AF_INET6: { 483 struct in6pcb *in6p = (struct in6pcb *)inph; 484 /* set spidx in pcb */ 485 *error = ipsec6_setspidx_in6pcb(m, in6p); 486 pcbsp = in6p->in6p_sp; 487 break; 488 } 489 #endif 490 default: 491 *error = EPFNOSUPPORT; 492 break; 493 } 494 if (*error) 495 return NULL; 496 497 KASSERT(pcbsp != NULL); 498 switch (dir) { 499 case IPSEC_DIR_INBOUND: 500 currsp = pcbsp->sp_in; 501 break; 502 case IPSEC_DIR_OUTBOUND: 503 currsp = pcbsp->sp_out; 504 break; 505 } 506 KASSERT(currsp != NULL); 507 508 if (pcbsp->priv) { /* when privilieged socket */ 509 switch (currsp->policy) { 510 case IPSEC_POLICY_BYPASS: 511 case IPSEC_POLICY_IPSEC: 512 KEY_SP_REF(currsp); 513 sp = currsp; 514 break; 515 516 case IPSEC_POLICY_ENTRUST: 517 /* look for a policy in SPD */ 518 sp = KEY_LOOKUP_SP_BYSPIDX(&currsp->spidx, dir); 519 if (sp == NULL) /* no SP found */ 520 sp = KEY_GET_DEFAULT_SP(af); 521 break; 522 523 default: 524 IPSECLOG(LOG_ERR, "Invalid policy for PCB %d\n", 525 currsp->policy); 526 *error = EINVAL; 527 return NULL; 528 } 529 } else { /* unpriv, SPD has policy */ 530 sp = KEY_LOOKUP_SP_BYSPIDX(&currsp->spidx, dir); 531 if (sp == NULL) { /* no SP found */ 532 switch (currsp->policy) { 533 case IPSEC_POLICY_BYPASS: 534 IPSECLOG(LOG_ERR, "Illegal policy for " 535 "non-priviliged defined %d\n", 536 currsp->policy); 537 *error = EINVAL; 538 return NULL; 539 540 case IPSEC_POLICY_ENTRUST: 541 sp = KEY_GET_DEFAULT_SP(af); 542 break; 543 544 case IPSEC_POLICY_IPSEC: 545 KEY_SP_REF(currsp); 546 sp = currsp; 547 break; 548 549 default: 550 IPSECLOG(LOG_ERR, "Invalid policy for " 551 "PCB %d\n", currsp->policy); 552 *error = EINVAL; 553 return NULL; 554 } 555 } 556 } 557 KASSERTMSG(sp != NULL, "null SP (priv %u policy %u", pcbsp->priv, 558 currsp->policy); 559 KEYDEBUG_PRINTF(KEYDEBUG_IPSEC_STAMP, 560 "DP (priv %u policy %u) allocates SP:%p (refcnt %u)\n", 561 pcbsp->priv, currsp->policy, sp, sp->refcnt); 562 ipsec_fillpcbcache(pcbsp, m, sp, dir); 563 return sp; 564 } 565 566 /* 567 * For FORWADING packet or OUTBOUND without a socket. Searching SPD for packet, 568 * and return a pointer to SP. 569 * OUT: positive: a pointer to the entry for security policy leaf matched. 570 * NULL: no apropreate SP found, the following value is set to error. 571 * 0 : bypass 572 * EACCES : discard packet. 573 * ENOENT : ipsec_acquire() in progress, maybe. 574 * others : error occurred. 575 */ 576 struct secpolicy * 577 ipsec_getpolicybyaddr(struct mbuf *m, u_int dir, int flag, int *error) 578 { 579 struct secpolicyindex spidx; 580 struct secpolicy *sp; 581 582 KASSERT(m != NULL); 583 KASSERT(error != NULL); 584 KASSERTMSG(IPSEC_DIR_IS_INOROUT(dir), "invalid direction %u", dir); 585 586 sp = NULL; 587 588 /* Make an index to look for a policy. */ 589 *error = ipsec_setspidx(m, &spidx, (flag & IP_FORWARDING) ? 0 : 1); 590 if (*error != 0) { 591 IPSECLOG(LOG_DEBUG, "setpidx failed, dir %u flag %u\n", dir, flag); 592 memset(&spidx, 0, sizeof (spidx)); 593 return NULL; 594 } 595 596 spidx.dir = dir; 597 598 if (key_havesp(dir)) { 599 sp = KEY_LOOKUP_SP_BYSPIDX(&spidx, dir); 600 } 601 602 if (sp == NULL) /* no SP found, use system default */ 603 sp = KEY_GET_DEFAULT_SP(spidx.dst.sa.sa_family); 604 KASSERT(sp != NULL); 605 return sp; 606 } 607 608 struct secpolicy * 609 ipsec4_checkpolicy(struct mbuf *m, u_int dir, u_int flag, int *error, 610 struct inpcb *inp) 611 { 612 struct secpolicy *sp; 613 614 *error = 0; 615 616 if (inp == NULL) { 617 sp = ipsec_getpolicybyaddr(m, dir, flag, error); 618 } else { 619 KASSERT(inp->inp_socket != NULL); 620 sp = ipsec_getpolicybysock(m, dir, (struct inpcb_hdr *)inp, error); 621 } 622 if (sp == NULL) { 623 KASSERTMSG(*error != 0, "getpolicy failed w/o error"); 624 IPSEC_STATINC(IPSEC_STAT_OUT_INVAL); 625 return NULL; 626 } 627 KASSERTMSG(*error == 0, "sp w/ error set to %u", *error); 628 switch (sp->policy) { 629 case IPSEC_POLICY_ENTRUST: 630 default: 631 printf("%s: invalid policy %u\n", __func__, sp->policy); 632 /* fall thru... */ 633 case IPSEC_POLICY_DISCARD: 634 IPSEC_STATINC(IPSEC_STAT_OUT_POLVIO); 635 *error = -EINVAL; /* packet is discarded by caller */ 636 break; 637 case IPSEC_POLICY_BYPASS: 638 case IPSEC_POLICY_NONE: 639 KEY_FREESP(&sp); 640 sp = NULL; /* NB: force NULL result */ 641 break; 642 case IPSEC_POLICY_IPSEC: 643 KASSERT(sp->req != NULL); 644 break; 645 } 646 if (*error != 0) { 647 KEY_FREESP(&sp); 648 sp = NULL; 649 IPSECLOG(LOG_DEBUG, "done, error %d\n", *error); 650 } 651 return sp; 652 } 653 654 int 655 ipsec4_output(struct mbuf *m, struct inpcb *inp, int flags, 656 u_long *mtu, bool *natt_frag, bool *done) 657 { 658 const struct ip *ip = mtod(m, const struct ip *); 659 struct secpolicy *sp = NULL; 660 int error, s; 661 662 /* 663 * Check the security policy (SP) for the packet and, if required, 664 * do IPsec-related processing. There are two cases here; the first 665 * time a packet is sent through it will be untagged and handled by 666 * ipsec4_checkpolicy(). If the packet is resubmitted to ip_output 667 * (e.g. after AH, ESP, etc. processing), there will be a tag to 668 * bypass the lookup and related policy checking. 669 */ 670 if (ipsec_outdone(m)) { 671 return 0; 672 } 673 s = splsoftnet(); 674 if (inp && ipsec_pcb_skip_ipsec(inp->inp_sp, IPSEC_DIR_OUTBOUND)) { 675 splx(s); 676 return 0; 677 } 678 sp = ipsec4_checkpolicy(m, IPSEC_DIR_OUTBOUND, flags, &error, inp); 679 680 /* 681 * There are four return cases: 682 * sp != NULL apply IPsec policy 683 * sp == NULL, error == 0 no IPsec handling needed 684 * sp == NULL, error == -EINVAL discard packet w/o error 685 * sp == NULL, error != 0 discard packet, report error 686 */ 687 if (sp == NULL) { 688 splx(s); 689 if (error) { 690 /* 691 * Hack: -EINVAL is used to signal that a packet 692 * should be silently discarded. This is typically 693 * because we asked key management for an SA and 694 * it was delayed (e.g. kicked up to IKE). 695 */ 696 if (error == -EINVAL) 697 error = 0; 698 m_freem(m); 699 *done = true; 700 return error; 701 } 702 /* No IPsec processing for this packet. */ 703 return 0; 704 } 705 706 /* 707 * NAT-T ESP fragmentation: do not do IPSec processing now, 708 * we will do it on each fragmented packet. 709 */ 710 if (sp->req->sav && (sp->req->sav->natt_type & 711 (UDP_ENCAP_ESPINUDP|UDP_ENCAP_ESPINUDP_NON_IKE))) { 712 if (ntohs(ip->ip_len) > sp->req->sav->esp_frag) { 713 *mtu = sp->req->sav->esp_frag; 714 *natt_frag = true; 715 KEY_FREESP(&sp); 716 splx(s); 717 return 0; 718 } 719 } 720 721 /* 722 * Do delayed checksums now because we send before 723 * this is done in the normal processing path. 724 */ 725 if (m->m_pkthdr.csum_flags & (M_CSUM_TCPv4|M_CSUM_UDPv4)) { 726 in_delayed_cksum(m); 727 m->m_pkthdr.csum_flags &= ~(M_CSUM_TCPv4|M_CSUM_UDPv4); 728 } 729 730 /* Note: callee frees mbuf */ 731 error = ipsec4_process_packet(m, sp->req); 732 /* 733 * Preserve KAME behaviour: ENOENT can be returned 734 * when an SA acquire is in progress. Don't propagate 735 * this to user-level; it confuses applications. 736 * 737 * XXX this will go away when the SADB is redone. 738 */ 739 if (error == ENOENT) 740 error = 0; 741 KEY_FREESP(&sp); 742 splx(s); 743 *done = true; 744 return error; 745 } 746 747 int 748 ipsec4_input(struct mbuf *m, int flags) 749 { 750 struct m_tag *mtag; 751 struct tdb_ident *tdbi; 752 struct secpolicy *sp; 753 int error, s; 754 755 /* 756 * Check if the packet has already had IPsec processing done. 757 * If so, then just pass it along. This tag gets set during AH, 758 * ESP, etc. input handling, before the packet is returned to 759 * the IP input queue for delivery. 760 */ 761 mtag = m_tag_find(m, PACKET_TAG_IPSEC_IN_DONE, NULL); 762 s = splsoftnet(); 763 if (mtag != NULL) { 764 tdbi = (struct tdb_ident *)(mtag + 1); 765 sp = ipsec_getpolicy(tdbi, IPSEC_DIR_INBOUND); 766 } else { 767 sp = ipsec_getpolicybyaddr(m, IPSEC_DIR_INBOUND, 768 IP_FORWARDING, &error); 769 } 770 if (sp == NULL) { 771 splx(s); 772 return EINVAL; 773 } 774 775 /* 776 * Check security policy against packet attributes. 777 */ 778 error = ipsec_in_reject(sp, m); 779 KEY_FREESP(&sp); 780 splx(s); 781 if (error) { 782 return error; 783 } 784 785 if (flags == 0) { 786 /* We are done. */ 787 return 0; 788 } 789 790 /* 791 * Peek at the outbound SP for this packet to determine if 792 * it is a Fast Forward candidate. 793 */ 794 s = splsoftnet(); 795 sp = ipsec4_checkpolicy(m, IPSEC_DIR_OUTBOUND, flags, &error, NULL); 796 if (sp != NULL) { 797 m->m_flags &= ~M_CANFASTFWD; 798 KEY_FREESP(&sp); 799 } 800 splx(s); 801 return 0; 802 } 803 804 int 805 ipsec4_forward(struct mbuf *m, int *destmtu) 806 { 807 /* 808 * If the packet is routed over IPsec tunnel, tell the 809 * originator the tunnel MTU. 810 * tunnel MTU = if MTU - sizeof(IP) - ESP/AH hdrsiz 811 * XXX quickhack!!! 812 */ 813 struct secpolicy *sp; 814 size_t ipsechdr; 815 int error; 816 817 sp = ipsec4_getpolicybyaddr(m, 818 IPSEC_DIR_OUTBOUND, IP_FORWARDING, &error); 819 if (sp == NULL) { 820 return EINVAL; 821 } 822 823 /* Count IPsec header size. */ 824 ipsechdr = ipsec4_hdrsiz(m, IPSEC_DIR_OUTBOUND, NULL); 825 826 /* 827 * Find the correct route for outer IPv4 header, compute tunnel MTU. 828 */ 829 if (sp->req && sp->req->sav) { 830 struct route *ro; 831 struct rtentry *rt; 832 833 ro = &sp->req->sav->sah->sa_route; 834 rt = rtcache_validate(ro); 835 if (rt && rt->rt_ifp) { 836 *destmtu = rt->rt_rmx.rmx_mtu ? 837 rt->rt_rmx.rmx_mtu : rt->rt_ifp->if_mtu; 838 *destmtu -= ipsechdr; 839 } 840 rtcache_unref(rt, ro); 841 } 842 KEY_FREESP(&sp); 843 return 0; 844 } 845 846 #ifdef INET6 847 struct secpolicy * 848 ipsec6_checkpolicy(struct mbuf *m, u_int dir, u_int flag, int *error, 849 struct in6pcb *in6p) 850 { 851 struct secpolicy *sp; 852 853 *error = 0; 854 855 if (in6p == NULL) { 856 sp = ipsec_getpolicybyaddr(m, dir, flag, error); 857 } else { 858 KASSERT(in6p->in6p_socket != NULL); 859 sp = ipsec_getpolicybysock(m, dir, (struct inpcb_hdr *)in6p, error); 860 } 861 if (sp == NULL) { 862 KASSERTMSG(*error != 0, "getpolicy failed w/o error"); 863 IPSEC_STATINC(IPSEC_STAT_OUT_INVAL); 864 return NULL; 865 } 866 KASSERTMSG(*error == 0, "sp w/ error set to %u", *error); 867 switch (sp->policy) { 868 case IPSEC_POLICY_ENTRUST: 869 default: 870 printf("%s: invalid policy %u\n", __func__, sp->policy); 871 /* fall thru... */ 872 case IPSEC_POLICY_DISCARD: 873 IPSEC_STATINC(IPSEC_STAT_OUT_POLVIO); 874 *error = -EINVAL; /* packet is discarded by caller */ 875 break; 876 case IPSEC_POLICY_BYPASS: 877 case IPSEC_POLICY_NONE: 878 KEY_FREESP(&sp); 879 sp = NULL; /* NB: force NULL result */ 880 break; 881 case IPSEC_POLICY_IPSEC: 882 KASSERT(sp->req != NULL); 883 break; 884 } 885 if (*error != 0) { 886 KEY_FREESP(&sp); 887 sp = NULL; 888 IPSECLOG(LOG_DEBUG, "done, error %d\n", *error); 889 } 890 return sp; 891 } 892 #endif /* INET6 */ 893 894 static int 895 ipsec4_setspidx_inpcb(struct mbuf *m, struct inpcb *pcb) 896 { 897 int error; 898 899 KASSERT(pcb != NULL); 900 KASSERT(pcb->inp_sp != NULL); 901 KASSERT(pcb->inp_sp->sp_out != NULL); 902 KASSERT(pcb->inp_sp->sp_in != NULL); 903 904 error = ipsec_setspidx(m, &pcb->inp_sp->sp_in->spidx, 1); 905 if (error == 0) { 906 pcb->inp_sp->sp_in->spidx.dir = IPSEC_DIR_INBOUND; 907 pcb->inp_sp->sp_out->spidx = pcb->inp_sp->sp_in->spidx; 908 pcb->inp_sp->sp_out->spidx.dir = IPSEC_DIR_OUTBOUND; 909 } else { 910 memset(&pcb->inp_sp->sp_in->spidx, 0, 911 sizeof(pcb->inp_sp->sp_in->spidx)); 912 memset(&pcb->inp_sp->sp_out->spidx, 0, 913 sizeof(pcb->inp_sp->sp_in->spidx)); 914 } 915 return error; 916 } 917 918 #ifdef INET6 919 static int 920 ipsec6_setspidx_in6pcb(struct mbuf *m, struct in6pcb *pcb) 921 { 922 struct secpolicyindex *spidx; 923 int error; 924 925 KASSERT(pcb != NULL); 926 KASSERT(pcb->in6p_sp != NULL); 927 KASSERT(pcb->in6p_sp->sp_out != NULL); 928 KASSERT(pcb->in6p_sp->sp_in != NULL); 929 930 memset(&pcb->in6p_sp->sp_in->spidx, 0, sizeof(*spidx)); 931 memset(&pcb->in6p_sp->sp_out->spidx, 0, sizeof(*spidx)); 932 933 spidx = &pcb->in6p_sp->sp_in->spidx; 934 error = ipsec_setspidx(m, spidx, 1); 935 if (error) 936 goto bad; 937 spidx->dir = IPSEC_DIR_INBOUND; 938 939 spidx = &pcb->in6p_sp->sp_out->spidx; 940 error = ipsec_setspidx(m, spidx, 1); 941 if (error) 942 goto bad; 943 spidx->dir = IPSEC_DIR_OUTBOUND; 944 945 return 0; 946 947 bad: 948 memset(&pcb->in6p_sp->sp_in->spidx, 0, sizeof(*spidx)); 949 memset(&pcb->in6p_sp->sp_out->spidx, 0, sizeof(*spidx)); 950 return error; 951 } 952 #endif 953 954 /* 955 * configure security policy index (src/dst/proto/sport/dport) 956 * by looking at the content of mbuf. 957 * the caller is responsible for error recovery (like clearing up spidx). 958 */ 959 static int 960 ipsec_setspidx(struct mbuf *m, struct secpolicyindex *spidx, int needport) 961 { 962 struct ip *ip = NULL; 963 struct ip ipbuf; 964 u_int v; 965 struct mbuf *n; 966 int len; 967 int error; 968 969 KASSERT(m != NULL); 970 971 /* 972 * validate m->m_pkthdr.len. we see incorrect length if we 973 * mistakenly call this function with inconsistent mbuf chain 974 * (like 4.4BSD tcp/udp processing). XXX should we panic here? 975 */ 976 len = 0; 977 for (n = m; n; n = n->m_next) 978 len += n->m_len; 979 if (m->m_pkthdr.len != len) { 980 KEYDEBUG_PRINTF(KEYDEBUG_IPSEC_DUMP, 981 "total of m_len(%d) != pkthdr.len(%d), ignored.\n", 982 len, m->m_pkthdr.len); 983 return EINVAL; 984 } 985 986 if (m->m_pkthdr.len < sizeof(struct ip)) { 987 KEYDEBUG_PRINTF(KEYDEBUG_IPSEC_DUMP, 988 "pkthdr.len(%d) < sizeof(struct ip), ignored.\n", 989 m->m_pkthdr.len); 990 return EINVAL; 991 } 992 993 if (m->m_len >= sizeof(*ip)) 994 ip = mtod(m, struct ip *); 995 else { 996 m_copydata(m, 0, sizeof(ipbuf), &ipbuf); 997 ip = &ipbuf; 998 } 999 v = ip->ip_v; 1000 switch (v) { 1001 case 4: 1002 error = ipsec4_setspidx_ipaddr(m, spidx); 1003 if (error) 1004 return error; 1005 ipsec4_get_ulp(m, spidx, needport); 1006 return 0; 1007 #ifdef INET6 1008 case 6: 1009 if (m->m_pkthdr.len < sizeof(struct ip6_hdr)) { 1010 KEYDEBUG_PRINTF(KEYDEBUG_IPSEC_DUMP, 1011 "pkthdr.len(%d) < sizeof(struct ip6_hdr), " 1012 "ignored.\n", m->m_pkthdr.len); 1013 return EINVAL; 1014 } 1015 error = ipsec6_setspidx_ipaddr(m, spidx); 1016 if (error) 1017 return error; 1018 ipsec6_get_ulp(m, spidx, needport); 1019 return 0; 1020 #endif 1021 default: 1022 KEYDEBUG_PRINTF(KEYDEBUG_IPSEC_DUMP, 1023 "unknown IP version %u, ignored.\n", v); 1024 return EINVAL; 1025 } 1026 } 1027 1028 static void 1029 ipsec4_get_ulp(struct mbuf *m, struct secpolicyindex *spidx, int needport) 1030 { 1031 u_int8_t nxt; 1032 int off; 1033 1034 /* sanity check */ 1035 KASSERT(m != NULL); 1036 KASSERTMSG(m->m_pkthdr.len >= sizeof(struct ip), "packet too short"); 1037 1038 /* NB: ip_input() flips it into host endian XXX need more checking */ 1039 if (m->m_len >= sizeof(struct ip)) { 1040 struct ip *ip = mtod(m, struct ip *); 1041 if (ip->ip_off & htons(IP_MF | IP_OFFMASK)) 1042 goto done; 1043 off = ip->ip_hl << 2; 1044 nxt = ip->ip_p; 1045 } else { 1046 struct ip ih; 1047 1048 m_copydata(m, 0, sizeof (struct ip), &ih); 1049 if (ih.ip_off & htons(IP_MF | IP_OFFMASK)) 1050 goto done; 1051 off = ih.ip_hl << 2; 1052 nxt = ih.ip_p; 1053 } 1054 1055 while (off < m->m_pkthdr.len) { 1056 struct ip6_ext ip6e; 1057 struct tcphdr th; 1058 struct udphdr uh; 1059 struct icmp icmph; 1060 1061 switch (nxt) { 1062 case IPPROTO_TCP: 1063 spidx->ul_proto = nxt; 1064 if (!needport) 1065 goto done_proto; 1066 if (off + sizeof(struct tcphdr) > m->m_pkthdr.len) 1067 goto done; 1068 m_copydata(m, off, sizeof (th), &th); 1069 spidx->src.sin.sin_port = th.th_sport; 1070 spidx->dst.sin.sin_port = th.th_dport; 1071 return; 1072 case IPPROTO_UDP: 1073 spidx->ul_proto = nxt; 1074 if (!needport) 1075 goto done_proto; 1076 if (off + sizeof(struct udphdr) > m->m_pkthdr.len) 1077 goto done; 1078 m_copydata(m, off, sizeof (uh), &uh); 1079 spidx->src.sin.sin_port = uh.uh_sport; 1080 spidx->dst.sin.sin_port = uh.uh_dport; 1081 return; 1082 case IPPROTO_AH: 1083 if (m->m_pkthdr.len > off + sizeof(ip6e)) 1084 goto done; 1085 /* XXX sigh, this works but is totally bogus */ 1086 m_copydata(m, off, sizeof(ip6e), &ip6e); 1087 off += (ip6e.ip6e_len + 2) << 2; 1088 nxt = ip6e.ip6e_nxt; 1089 break; 1090 case IPPROTO_ICMP: 1091 spidx->ul_proto = nxt; 1092 if (off + sizeof(struct icmp) > m->m_pkthdr.len) 1093 return; 1094 m_copydata(m, off, sizeof(icmph), &icmph); 1095 ((struct sockaddr_in *)&spidx->src)->sin_port = 1096 htons((uint16_t)icmph.icmp_type); 1097 ((struct sockaddr_in *)&spidx->dst)->sin_port = 1098 htons((uint16_t)icmph.icmp_code); 1099 return; 1100 default: 1101 /* XXX intermediate headers??? */ 1102 spidx->ul_proto = nxt; 1103 goto done_proto; 1104 } 1105 } 1106 done: 1107 spidx->ul_proto = IPSEC_ULPROTO_ANY; 1108 done_proto: 1109 spidx->src.sin.sin_port = IPSEC_PORT_ANY; 1110 spidx->dst.sin.sin_port = IPSEC_PORT_ANY; 1111 } 1112 1113 /* assumes that m is sane */ 1114 static int 1115 ipsec4_setspidx_ipaddr(struct mbuf *m, struct secpolicyindex *spidx) 1116 { 1117 static const struct sockaddr_in template = { 1118 sizeof (struct sockaddr_in), 1119 AF_INET, 1120 0, { 0 }, { 0, 0, 0, 0, 0, 0, 0, 0 } 1121 }; 1122 1123 spidx->src.sin = template; 1124 spidx->dst.sin = template; 1125 1126 if (m->m_len < sizeof (struct ip)) { 1127 m_copydata(m, offsetof(struct ip, ip_src), 1128 sizeof(struct in_addr), &spidx->src.sin.sin_addr); 1129 m_copydata(m, offsetof(struct ip, ip_dst), 1130 sizeof(struct in_addr), &spidx->dst.sin.sin_addr); 1131 } else { 1132 struct ip *ip = mtod(m, struct ip *); 1133 spidx->src.sin.sin_addr = ip->ip_src; 1134 spidx->dst.sin.sin_addr = ip->ip_dst; 1135 } 1136 1137 spidx->prefs = sizeof(struct in_addr) << 3; 1138 spidx->prefd = sizeof(struct in_addr) << 3; 1139 1140 return 0; 1141 } 1142 1143 #ifdef INET6 1144 static void 1145 ipsec6_get_ulp(struct mbuf *m, struct secpolicyindex *spidx, 1146 int needport) 1147 { 1148 int off, nxt; 1149 struct tcphdr th; 1150 struct udphdr uh; 1151 struct icmp6_hdr icmph; 1152 1153 KASSERT(m != NULL); 1154 1155 if (KEYDEBUG_ON(KEYDEBUG_IPSEC_DUMP)) { 1156 printf("%s:\n", __func__); 1157 kdebug_mbuf(m); 1158 } 1159 1160 /* set default */ 1161 spidx->ul_proto = IPSEC_ULPROTO_ANY; 1162 ((struct sockaddr_in6 *)&spidx->src)->sin6_port = IPSEC_PORT_ANY; 1163 ((struct sockaddr_in6 *)&spidx->dst)->sin6_port = IPSEC_PORT_ANY; 1164 1165 nxt = -1; 1166 off = ip6_lasthdr(m, 0, IPPROTO_IPV6, &nxt); 1167 if (off < 0 || m->m_pkthdr.len < off) 1168 return; 1169 1170 switch (nxt) { 1171 case IPPROTO_TCP: 1172 spidx->ul_proto = nxt; 1173 if (!needport) 1174 break; 1175 if (off + sizeof(struct tcphdr) > m->m_pkthdr.len) 1176 break; 1177 m_copydata(m, off, sizeof(th), &th); 1178 ((struct sockaddr_in6 *)&spidx->src)->sin6_port = th.th_sport; 1179 ((struct sockaddr_in6 *)&spidx->dst)->sin6_port = th.th_dport; 1180 break; 1181 case IPPROTO_UDP: 1182 spidx->ul_proto = nxt; 1183 if (!needport) 1184 break; 1185 if (off + sizeof(struct udphdr) > m->m_pkthdr.len) 1186 break; 1187 m_copydata(m, off, sizeof(uh), &uh); 1188 ((struct sockaddr_in6 *)&spidx->src)->sin6_port = uh.uh_sport; 1189 ((struct sockaddr_in6 *)&spidx->dst)->sin6_port = uh.uh_dport; 1190 break; 1191 case IPPROTO_ICMPV6: 1192 spidx->ul_proto = nxt; 1193 if (off + sizeof(struct icmp6_hdr) > m->m_pkthdr.len) 1194 break; 1195 m_copydata(m, off, sizeof(icmph), &icmph); 1196 ((struct sockaddr_in6 *)&spidx->src)->sin6_port = 1197 htons((uint16_t)icmph.icmp6_type); 1198 ((struct sockaddr_in6 *)&spidx->dst)->sin6_port = 1199 htons((uint16_t)icmph.icmp6_code); 1200 break; 1201 default: 1202 /* XXX intermediate headers??? */ 1203 spidx->ul_proto = nxt; 1204 break; 1205 } 1206 } 1207 1208 /* assumes that m is sane */ 1209 static int 1210 ipsec6_setspidx_ipaddr(struct mbuf *m, struct secpolicyindex *spidx) 1211 { 1212 struct ip6_hdr *ip6 = NULL; 1213 struct ip6_hdr ip6buf; 1214 struct sockaddr_in6 *sin6; 1215 1216 if (m->m_len >= sizeof(*ip6)) 1217 ip6 = mtod(m, struct ip6_hdr *); 1218 else { 1219 m_copydata(m, 0, sizeof(ip6buf), &ip6buf); 1220 ip6 = &ip6buf; 1221 } 1222 1223 sin6 = (struct sockaddr_in6 *)&spidx->src; 1224 memset(sin6, 0, sizeof(*sin6)); 1225 sin6->sin6_family = AF_INET6; 1226 sin6->sin6_len = sizeof(struct sockaddr_in6); 1227 memcpy(&sin6->sin6_addr, &ip6->ip6_src, sizeof(ip6->ip6_src)); 1228 if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_src)) { 1229 sin6->sin6_addr.s6_addr16[1] = 0; 1230 sin6->sin6_scope_id = ntohs(ip6->ip6_src.s6_addr16[1]); 1231 } 1232 spidx->prefs = sizeof(struct in6_addr) << 3; 1233 1234 sin6 = (struct sockaddr_in6 *)&spidx->dst; 1235 memset(sin6, 0, sizeof(*sin6)); 1236 sin6->sin6_family = AF_INET6; 1237 sin6->sin6_len = sizeof(struct sockaddr_in6); 1238 memcpy(&sin6->sin6_addr, &ip6->ip6_dst, sizeof(ip6->ip6_dst)); 1239 if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_dst)) { 1240 sin6->sin6_addr.s6_addr16[1] = 0; 1241 sin6->sin6_scope_id = ntohs(ip6->ip6_dst.s6_addr16[1]); 1242 } 1243 spidx->prefd = sizeof(struct in6_addr) << 3; 1244 1245 return 0; 1246 } 1247 #endif 1248 1249 static void 1250 ipsec_delpcbpolicy(struct inpcbpolicy *p) 1251 { 1252 1253 kmem_intr_free(p, sizeof(*p)); 1254 } 1255 1256 /* initialize policy in PCB */ 1257 int 1258 ipsec_init_policy(struct socket *so, struct inpcbpolicy **policy) 1259 { 1260 struct inpcbpolicy *new; 1261 1262 KASSERT(so != NULL); 1263 KASSERT(policy != NULL); 1264 1265 new = kmem_intr_zalloc(sizeof(*new), KM_NOSLEEP); 1266 if (new == NULL) { 1267 IPSECLOG(LOG_DEBUG, "No more memory.\n"); 1268 return ENOBUFS; 1269 } 1270 1271 if (IPSEC_PRIVILEGED_SO(so)) 1272 new->priv = 1; 1273 else 1274 new->priv = 0; 1275 1276 if ((new->sp_in = KEY_NEWSP()) == NULL) { 1277 ipsec_delpcbpolicy(new); 1278 return ENOBUFS; 1279 } 1280 new->sp_in->state = IPSEC_SPSTATE_ALIVE; 1281 new->sp_in->policy = IPSEC_POLICY_ENTRUST; 1282 1283 if ((new->sp_out = KEY_NEWSP()) == NULL) { 1284 KEY_FREESP(&new->sp_in); 1285 ipsec_delpcbpolicy(new); 1286 return ENOBUFS; 1287 } 1288 new->sp_out->state = IPSEC_SPSTATE_ALIVE; 1289 new->sp_out->policy = IPSEC_POLICY_ENTRUST; 1290 1291 *policy = new; 1292 1293 return 0; 1294 } 1295 1296 /* copy old ipsec policy into new */ 1297 int 1298 ipsec_copy_policy(const struct inpcbpolicy *old, struct inpcbpolicy *new) 1299 { 1300 struct secpolicy *sp; 1301 1302 sp = ipsec_deepcopy_policy(old->sp_in); 1303 if (sp) { 1304 KEY_FREESP(&new->sp_in); 1305 new->sp_in = sp; 1306 } else 1307 return ENOBUFS; 1308 1309 sp = ipsec_deepcopy_policy(old->sp_out); 1310 if (sp) { 1311 KEY_FREESP(&new->sp_out); 1312 new->sp_out = sp; 1313 } else 1314 return ENOBUFS; 1315 1316 new->priv = old->priv; 1317 1318 return 0; 1319 } 1320 1321 /* deep-copy a policy in PCB */ 1322 static struct secpolicy * 1323 ipsec_deepcopy_policy(const struct secpolicy *src) 1324 { 1325 struct ipsecrequest *newchain = NULL; 1326 const struct ipsecrequest *p; 1327 struct ipsecrequest **q; 1328 struct secpolicy *dst; 1329 1330 if (src == NULL) 1331 return NULL; 1332 dst = KEY_NEWSP(); 1333 if (dst == NULL) 1334 return NULL; 1335 1336 /* 1337 * deep-copy IPsec request chain. This is required since struct 1338 * ipsecrequest is not reference counted. 1339 */ 1340 q = &newchain; 1341 for (p = src->req; p; p = p->next) { 1342 *q = kmem_zalloc(sizeof(**q), KM_SLEEP); 1343 (*q)->next = NULL; 1344 1345 (*q)->saidx.proto = p->saidx.proto; 1346 (*q)->saidx.mode = p->saidx.mode; 1347 (*q)->level = p->level; 1348 (*q)->saidx.reqid = p->saidx.reqid; 1349 1350 memcpy(&(*q)->saidx.src, &p->saidx.src, sizeof((*q)->saidx.src)); 1351 memcpy(&(*q)->saidx.dst, &p->saidx.dst, sizeof((*q)->saidx.dst)); 1352 1353 (*q)->sav = NULL; 1354 (*q)->sp = dst; 1355 1356 q = &((*q)->next); 1357 } 1358 1359 dst->req = newchain; 1360 dst->state = src->state; 1361 dst->policy = src->policy; 1362 /* do not touch the refcnt fields */ 1363 1364 return dst; 1365 } 1366 1367 /* set policy and ipsec request if present. */ 1368 static int 1369 ipsec_set_policy( 1370 struct secpolicy **policy, 1371 int optname, 1372 const void *request, 1373 size_t len, 1374 kauth_cred_t cred 1375 ) 1376 { 1377 const struct sadb_x_policy *xpl; 1378 struct secpolicy *newsp = NULL; 1379 int error; 1380 1381 KASSERT(!cpu_softintr_p()); 1382 1383 /* sanity check. */ 1384 if (policy == NULL || *policy == NULL || request == NULL) 1385 return EINVAL; 1386 if (len < sizeof(*xpl)) 1387 return EINVAL; 1388 xpl = (const struct sadb_x_policy *)request; 1389 1390 if (KEYDEBUG_ON(KEYDEBUG_IPSEC_DUMP)) { 1391 printf("%s: passed policy\n", __func__); 1392 kdebug_sadb_x_policy((const struct sadb_ext *)xpl); 1393 } 1394 1395 /* check policy type */ 1396 /* ipsec_set_policy() accepts IPSEC, ENTRUST and BYPASS. */ 1397 if (xpl->sadb_x_policy_type == IPSEC_POLICY_DISCARD 1398 || xpl->sadb_x_policy_type == IPSEC_POLICY_NONE) 1399 return EINVAL; 1400 1401 /* check privileged socket */ 1402 if (xpl->sadb_x_policy_type == IPSEC_POLICY_BYPASS) { 1403 error = kauth_authorize_network(cred, KAUTH_NETWORK_IPSEC, 1404 KAUTH_REQ_NETWORK_IPSEC_BYPASS, NULL, NULL, NULL); 1405 if (error) 1406 return (error); 1407 } 1408 1409 /* allocation new SP entry */ 1410 if ((newsp = key_msg2sp(xpl, len, &error)) == NULL) 1411 return error; 1412 1413 newsp->state = IPSEC_SPSTATE_ALIVE; 1414 1415 /* clear old SP and set new SP */ 1416 KEY_FREESP(policy); 1417 *policy = newsp; 1418 if (KEYDEBUG_ON(KEYDEBUG_IPSEC_DUMP)) { 1419 printf("%s: new policy\n", __func__); 1420 kdebug_secpolicy(newsp); 1421 } 1422 1423 return 0; 1424 } 1425 1426 static int 1427 ipsec_get_policy(struct secpolicy *policy, struct mbuf **mp) 1428 { 1429 1430 /* sanity check. */ 1431 if (policy == NULL || mp == NULL) 1432 return EINVAL; 1433 1434 *mp = key_sp2msg(policy); 1435 if (!*mp) { 1436 IPSECLOG(LOG_DEBUG, "No more memory.\n"); 1437 return ENOBUFS; 1438 } 1439 1440 (*mp)->m_type = MT_DATA; 1441 if (KEYDEBUG_ON(KEYDEBUG_IPSEC_DUMP)) { 1442 printf("%s:\n", __func__); 1443 kdebug_mbuf(*mp); 1444 } 1445 1446 return 0; 1447 } 1448 1449 int 1450 ipsec4_set_policy(struct inpcb *inp, int optname, const void *request, 1451 size_t len, kauth_cred_t cred) 1452 { 1453 const struct sadb_x_policy *xpl; 1454 struct secpolicy **policy; 1455 1456 KASSERT(!cpu_softintr_p()); 1457 1458 /* sanity check. */ 1459 if (inp == NULL || request == NULL) 1460 return EINVAL; 1461 if (len < sizeof(*xpl)) 1462 return EINVAL; 1463 xpl = (const struct sadb_x_policy *)request; 1464 1465 KASSERT(inp->inp_sp != NULL); 1466 1467 /* select direction */ 1468 switch (xpl->sadb_x_policy_dir) { 1469 case IPSEC_DIR_INBOUND: 1470 policy = &inp->inp_sp->sp_in; 1471 break; 1472 case IPSEC_DIR_OUTBOUND: 1473 policy = &inp->inp_sp->sp_out; 1474 break; 1475 default: 1476 IPSECLOG(LOG_ERR, "invalid direction=%u\n", 1477 xpl->sadb_x_policy_dir); 1478 return EINVAL; 1479 } 1480 1481 return ipsec_set_policy(policy, optname, request, len, cred); 1482 } 1483 1484 int 1485 ipsec4_get_policy(struct inpcb *inp, const void *request, size_t len, 1486 struct mbuf **mp) 1487 { 1488 const struct sadb_x_policy *xpl; 1489 struct secpolicy *policy; 1490 1491 /* sanity check. */ 1492 if (inp == NULL || request == NULL || mp == NULL) 1493 return EINVAL; 1494 KASSERT(inp->inp_sp != NULL); 1495 if (len < sizeof(*xpl)) 1496 return EINVAL; 1497 xpl = (const struct sadb_x_policy *)request; 1498 1499 /* select direction */ 1500 switch (xpl->sadb_x_policy_dir) { 1501 case IPSEC_DIR_INBOUND: 1502 policy = inp->inp_sp->sp_in; 1503 break; 1504 case IPSEC_DIR_OUTBOUND: 1505 policy = inp->inp_sp->sp_out; 1506 break; 1507 default: 1508 IPSECLOG(LOG_ERR, "invalid direction=%u\n", 1509 xpl->sadb_x_policy_dir); 1510 return EINVAL; 1511 } 1512 1513 return ipsec_get_policy(policy, mp); 1514 } 1515 1516 /* delete policy in PCB */ 1517 int 1518 ipsec4_delete_pcbpolicy(struct inpcb *inp) 1519 { 1520 1521 KASSERT(inp != NULL); 1522 1523 if (inp->inp_sp == NULL) 1524 return 0; 1525 1526 if (inp->inp_sp->sp_in != NULL) 1527 KEY_FREESP(&inp->inp_sp->sp_in); 1528 1529 if (inp->inp_sp->sp_out != NULL) 1530 KEY_FREESP(&inp->inp_sp->sp_out); 1531 1532 ipsec_invalpcbcache(inp->inp_sp, IPSEC_DIR_ANY); 1533 1534 ipsec_delpcbpolicy(inp->inp_sp); 1535 inp->inp_sp = NULL; 1536 1537 return 0; 1538 } 1539 1540 #ifdef INET6 1541 int 1542 ipsec6_set_policy(struct in6pcb *in6p, int optname, const void *request, 1543 size_t len, kauth_cred_t cred) 1544 { 1545 const struct sadb_x_policy *xpl; 1546 struct secpolicy **policy; 1547 1548 KASSERT(!cpu_softintr_p()); 1549 1550 /* sanity check. */ 1551 if (in6p == NULL || request == NULL) 1552 return EINVAL; 1553 if (len < sizeof(*xpl)) 1554 return EINVAL; 1555 xpl = (const struct sadb_x_policy *)request; 1556 1557 /* select direction */ 1558 switch (xpl->sadb_x_policy_dir) { 1559 case IPSEC_DIR_INBOUND: 1560 policy = &in6p->in6p_sp->sp_in; 1561 break; 1562 case IPSEC_DIR_OUTBOUND: 1563 policy = &in6p->in6p_sp->sp_out; 1564 break; 1565 default: 1566 IPSECLOG(LOG_ERR, "invalid direction=%u\n", 1567 xpl->sadb_x_policy_dir); 1568 return EINVAL; 1569 } 1570 1571 return ipsec_set_policy(policy, optname, request, len, cred); 1572 } 1573 1574 int 1575 ipsec6_get_policy(struct in6pcb *in6p, const void *request, size_t len, 1576 struct mbuf **mp) 1577 { 1578 const struct sadb_x_policy *xpl; 1579 struct secpolicy *policy; 1580 1581 /* sanity check. */ 1582 if (in6p == NULL || request == NULL || mp == NULL) 1583 return EINVAL; 1584 KASSERT(in6p->in6p_sp != NULL); 1585 if (len < sizeof(*xpl)) 1586 return EINVAL; 1587 xpl = (const struct sadb_x_policy *)request; 1588 1589 /* select direction */ 1590 switch (xpl->sadb_x_policy_dir) { 1591 case IPSEC_DIR_INBOUND: 1592 policy = in6p->in6p_sp->sp_in; 1593 break; 1594 case IPSEC_DIR_OUTBOUND: 1595 policy = in6p->in6p_sp->sp_out; 1596 break; 1597 default: 1598 IPSECLOG(LOG_ERR, "invalid direction=%u\n", 1599 xpl->sadb_x_policy_dir); 1600 return EINVAL; 1601 } 1602 1603 return ipsec_get_policy(policy, mp); 1604 } 1605 1606 int 1607 ipsec6_delete_pcbpolicy(struct in6pcb *in6p) 1608 { 1609 1610 KASSERT(in6p != NULL); 1611 1612 if (in6p->in6p_sp == NULL) 1613 return 0; 1614 1615 if (in6p->in6p_sp->sp_in != NULL) 1616 KEY_FREESP(&in6p->in6p_sp->sp_in); 1617 1618 if (in6p->in6p_sp->sp_out != NULL) 1619 KEY_FREESP(&in6p->in6p_sp->sp_out); 1620 1621 ipsec_invalpcbcache(in6p->in6p_sp, IPSEC_DIR_ANY); 1622 1623 ipsec_delpcbpolicy(in6p->in6p_sp); 1624 in6p->in6p_sp = NULL; 1625 1626 return 0; 1627 } 1628 #endif 1629 1630 /* 1631 * return current level. 1632 * Either IPSEC_LEVEL_USE or IPSEC_LEVEL_REQUIRE are always returned. 1633 */ 1634 u_int 1635 ipsec_get_reqlevel(const struct ipsecrequest *isr) 1636 { 1637 u_int level = 0; 1638 u_int esp_trans_deflev, esp_net_deflev; 1639 u_int ah_trans_deflev, ah_net_deflev; 1640 1641 KASSERT(isr != NULL); 1642 KASSERT(isr->sp != NULL); 1643 KASSERTMSG( 1644 isr->sp->spidx.src.sa.sa_family == isr->sp->spidx.dst.sa.sa_family, 1645 "af family mismatch, src %u, dst %u", 1646 isr->sp->spidx.src.sa.sa_family, isr->sp->spidx.dst.sa.sa_family); 1647 1648 /* XXX note that we have ipseclog() expanded here - code sync issue */ 1649 #define IPSEC_CHECK_DEFAULT(lev) \ 1650 (((lev) != IPSEC_LEVEL_USE && (lev) != IPSEC_LEVEL_REQUIRE \ 1651 && (lev) != IPSEC_LEVEL_UNIQUE) ? \ 1652 (ipsec_debug ? log(LOG_INFO, "fixed system default level " #lev \ 1653 ":%d->%d\n", (lev), IPSEC_LEVEL_REQUIRE) : (void)0), \ 1654 (lev) = IPSEC_LEVEL_REQUIRE, (lev) \ 1655 : (lev)) 1656 1657 /* set default level */ 1658 switch (((struct sockaddr *)&isr->sp->spidx.src)->sa_family) { 1659 #ifdef INET 1660 case AF_INET: 1661 esp_trans_deflev = IPSEC_CHECK_DEFAULT(ip4_esp_trans_deflev); 1662 esp_net_deflev = IPSEC_CHECK_DEFAULT(ip4_esp_net_deflev); 1663 ah_trans_deflev = IPSEC_CHECK_DEFAULT(ip4_ah_trans_deflev); 1664 ah_net_deflev = IPSEC_CHECK_DEFAULT(ip4_ah_net_deflev); 1665 break; 1666 #endif 1667 #ifdef INET6 1668 case AF_INET6: 1669 esp_trans_deflev = IPSEC_CHECK_DEFAULT(ip6_esp_trans_deflev); 1670 esp_net_deflev = IPSEC_CHECK_DEFAULT(ip6_esp_net_deflev); 1671 ah_trans_deflev = IPSEC_CHECK_DEFAULT(ip6_ah_trans_deflev); 1672 ah_net_deflev = IPSEC_CHECK_DEFAULT(ip6_ah_net_deflev); 1673 break; 1674 #endif /* INET6 */ 1675 default: 1676 panic("%s: unknown af %u", __func__, 1677 isr->sp->spidx.src.sa.sa_family); 1678 } 1679 1680 #undef IPSEC_CHECK_DEFAULT 1681 1682 /* set level */ 1683 switch (isr->level) { 1684 case IPSEC_LEVEL_DEFAULT: 1685 switch (isr->saidx.proto) { 1686 case IPPROTO_ESP: 1687 if (isr->saidx.mode == IPSEC_MODE_TUNNEL) 1688 level = esp_net_deflev; 1689 else 1690 level = esp_trans_deflev; 1691 break; 1692 case IPPROTO_AH: 1693 if (isr->saidx.mode == IPSEC_MODE_TUNNEL) 1694 level = ah_net_deflev; 1695 else 1696 level = ah_trans_deflev; 1697 break; 1698 case IPPROTO_IPCOMP: 1699 /* 1700 * we don't really care, as IPcomp document says that 1701 * we shouldn't compress small packets 1702 */ 1703 level = IPSEC_LEVEL_USE; 1704 break; 1705 default: 1706 panic("%s: Illegal protocol defined %u", __func__, 1707 isr->saidx.proto); 1708 } 1709 break; 1710 1711 case IPSEC_LEVEL_USE: 1712 case IPSEC_LEVEL_REQUIRE: 1713 level = isr->level; 1714 break; 1715 case IPSEC_LEVEL_UNIQUE: 1716 level = IPSEC_LEVEL_REQUIRE; 1717 break; 1718 1719 default: 1720 panic("%s: Illegal IPsec level %u", __func__, isr->level); 1721 } 1722 1723 return level; 1724 } 1725 1726 /* 1727 * Check security policy requirements against the actual 1728 * packet contents. Return one if the packet should be 1729 * reject as "invalid"; otherwiser return zero to have the 1730 * packet treated as "valid". 1731 * 1732 * OUT: 1733 * 0: valid 1734 * 1: invalid 1735 */ 1736 int 1737 ipsec_in_reject(const struct secpolicy *sp, const struct mbuf *m) 1738 { 1739 struct ipsecrequest *isr; 1740 int need_auth; 1741 1742 if (KEYDEBUG_ON(KEYDEBUG_IPSEC_DATA)) { 1743 printf("%s: using SP\n", __func__); 1744 kdebug_secpolicy(sp); 1745 } 1746 1747 /* check policy */ 1748 switch (sp->policy) { 1749 case IPSEC_POLICY_DISCARD: 1750 return 1; 1751 case IPSEC_POLICY_BYPASS: 1752 case IPSEC_POLICY_NONE: 1753 return 0; 1754 } 1755 1756 KASSERTMSG(sp->policy == IPSEC_POLICY_IPSEC, 1757 "invalid policy %u", sp->policy); 1758 1759 /* XXX should compare policy against ipsec header history */ 1760 1761 need_auth = 0; 1762 for (isr = sp->req; isr != NULL; isr = isr->next) { 1763 if (ipsec_get_reqlevel(isr) != IPSEC_LEVEL_REQUIRE) 1764 continue; 1765 switch (isr->saidx.proto) { 1766 case IPPROTO_ESP: 1767 if ((m->m_flags & M_DECRYPTED) == 0) { 1768 KEYDEBUG_PRINTF(KEYDEBUG_IPSEC_DUMP, 1769 "ESP m_flags:%x\n", m->m_flags); 1770 return 1; 1771 } 1772 1773 if (!need_auth && 1774 isr->sav != NULL && 1775 isr->sav->tdb_authalgxform != NULL && 1776 (m->m_flags & M_AUTHIPDGM) == 0) { 1777 KEYDEBUG_PRINTF(KEYDEBUG_IPSEC_DUMP, 1778 "ESP/AH m_flags:%x\n", m->m_flags); 1779 return 1; 1780 } 1781 break; 1782 case IPPROTO_AH: 1783 need_auth = 1; 1784 if ((m->m_flags & M_AUTHIPHDR) == 0) { 1785 KEYDEBUG_PRINTF(KEYDEBUG_IPSEC_DUMP, 1786 "AH m_flags:%x\n", m->m_flags); 1787 return 1; 1788 } 1789 break; 1790 case IPPROTO_IPCOMP: 1791 /* 1792 * we don't really care, as IPcomp document 1793 * says that we shouldn't compress small 1794 * packets, IPComp policy should always be 1795 * treated as being in "use" level. 1796 */ 1797 break; 1798 } 1799 } 1800 return 0; /* valid */ 1801 } 1802 1803 /* 1804 * Check AH/ESP integrity. 1805 * This function is called from tcp_input(), udp_input(), 1806 * and {ah,esp}4_input for tunnel mode 1807 */ 1808 int 1809 ipsec4_in_reject(struct mbuf *m, struct inpcb *inp) 1810 { 1811 struct secpolicy *sp; 1812 int error; 1813 int result; 1814 1815 KASSERT(m != NULL); 1816 1817 /* get SP for this packet. 1818 * When we are called from ip_forward(), we call 1819 * ipsec_getpolicybyaddr() with IP_FORWARDING flag. 1820 */ 1821 if (inp == NULL) 1822 sp = ipsec_getpolicybyaddr(m, IPSEC_DIR_INBOUND, IP_FORWARDING, &error); 1823 else 1824 sp = ipsec_getpolicybysock(m, IPSEC_DIR_INBOUND, 1825 (struct inpcb_hdr *)inp, &error); 1826 1827 if (sp != NULL) { 1828 result = ipsec_in_reject(sp, m); 1829 if (result) 1830 IPSEC_STATINC(IPSEC_STAT_IN_POLVIO); 1831 KEY_FREESP(&sp); 1832 } else { 1833 result = 0; /* XXX should be panic ? 1834 * -> No, there may be error. */ 1835 } 1836 return result; 1837 } 1838 1839 1840 #ifdef INET6 1841 /* 1842 * Check AH/ESP integrity. 1843 * This function is called from tcp6_input(), udp6_input(), 1844 * and {ah,esp}6_input for tunnel mode 1845 */ 1846 int 1847 ipsec6_in_reject(struct mbuf *m, struct in6pcb *in6p) 1848 { 1849 struct secpolicy *sp = NULL; 1850 int error; 1851 int result; 1852 1853 KASSERT(m != NULL); 1854 1855 /* get SP for this packet. 1856 * When we are called from ip_forward(), we call 1857 * ipsec_getpolicybyaddr() with IP_FORWARDING flag. 1858 */ 1859 if (in6p == NULL) 1860 sp = ipsec_getpolicybyaddr(m, IPSEC_DIR_INBOUND, IP_FORWARDING, &error); 1861 else 1862 sp = ipsec_getpolicybysock(m, IPSEC_DIR_INBOUND, 1863 (struct inpcb_hdr *)in6p, 1864 &error); 1865 1866 if (sp != NULL) { 1867 result = ipsec_in_reject(sp, m); 1868 if (result) 1869 IPSEC_STATINC(IPSEC_STAT_IN_POLVIO); 1870 KEY_FREESP(&sp); 1871 } else { 1872 result = 0; 1873 } 1874 return result; 1875 } 1876 #endif 1877 1878 /* 1879 * compute the byte size to be occupied by IPsec header. 1880 * in case it is tunneled, it includes the size of outer IP header. 1881 * NOTE: SP passed is free in this function. 1882 */ 1883 static size_t 1884 ipsec_hdrsiz(const struct secpolicy *sp) 1885 { 1886 const struct ipsecrequest *isr; 1887 size_t siz; 1888 1889 if (KEYDEBUG_ON(KEYDEBUG_IPSEC_DATA)) { 1890 printf("%s: using SP\n", __func__); 1891 kdebug_secpolicy(sp); 1892 } 1893 1894 switch (sp->policy) { 1895 case IPSEC_POLICY_DISCARD: 1896 case IPSEC_POLICY_BYPASS: 1897 case IPSEC_POLICY_NONE: 1898 return 0; 1899 } 1900 1901 KASSERTMSG(sp->policy == IPSEC_POLICY_IPSEC, 1902 "invalid policy %u", sp->policy); 1903 1904 siz = 0; 1905 for (isr = sp->req; isr != NULL; isr = isr->next) { 1906 size_t clen = 0; 1907 1908 switch (isr->saidx.proto) { 1909 case IPPROTO_ESP: 1910 clen = esp_hdrsiz(isr->sav); 1911 break; 1912 case IPPROTO_AH: 1913 clen = ah_hdrsiz(isr->sav); 1914 break; 1915 case IPPROTO_IPCOMP: 1916 clen = sizeof(struct ipcomp); 1917 break; 1918 } 1919 1920 if (isr->saidx.mode == IPSEC_MODE_TUNNEL) { 1921 switch (isr->saidx.dst.sa.sa_family) { 1922 case AF_INET: 1923 clen += sizeof(struct ip); 1924 break; 1925 #ifdef INET6 1926 case AF_INET6: 1927 clen += sizeof(struct ip6_hdr); 1928 break; 1929 #endif 1930 default: 1931 IPSECLOG(LOG_ERR, "unknown AF %d in " 1932 "IPsec tunnel SA\n", 1933 ((const struct sockaddr *)&isr->saidx.dst) 1934 ->sa_family); 1935 break; 1936 } 1937 } 1938 siz += clen; 1939 } 1940 1941 return siz; 1942 } 1943 1944 /* This function is called from ip_forward() and ipsec4_hdrsize_tcp(). */ 1945 size_t 1946 ipsec4_hdrsiz(struct mbuf *m, u_int dir, struct inpcb *inp) 1947 { 1948 struct secpolicy *sp; 1949 int error; 1950 size_t size; 1951 1952 KASSERT(m != NULL); 1953 KASSERTMSG(inp == NULL || inp->inp_socket != NULL, "socket w/o inpcb"); 1954 1955 /* get SP for this packet. 1956 * When we are called from ip_forward(), we call 1957 * ipsec_getpolicybyaddr() with IP_FORWARDING flag. 1958 */ 1959 if (inp == NULL) 1960 sp = ipsec_getpolicybyaddr(m, dir, IP_FORWARDING, &error); 1961 else 1962 sp = ipsec_getpolicybysock(m, dir, 1963 (struct inpcb_hdr *)inp, &error); 1964 1965 if (sp != NULL) { 1966 size = ipsec_hdrsiz(sp); 1967 KEYDEBUG_PRINTF(KEYDEBUG_IPSEC_DATA, "size:%lu.\n", 1968 (unsigned long)size); 1969 1970 KEY_FREESP(&sp); 1971 } else { 1972 size = 0; /* XXX should be panic ? */ 1973 } 1974 return size; 1975 } 1976 1977 #ifdef INET6 1978 /* This function is called from ipsec6_hdrsize_tcp(), 1979 * and maybe from ip6_forward.() 1980 */ 1981 size_t 1982 ipsec6_hdrsiz(struct mbuf *m, u_int dir, struct in6pcb *in6p) 1983 { 1984 struct secpolicy *sp; 1985 int error; 1986 size_t size; 1987 1988 KASSERT(m != NULL); 1989 KASSERTMSG(in6p == NULL || in6p->in6p_socket != NULL, 1990 "socket w/o inpcb"); 1991 1992 /* get SP for this packet */ 1993 /* XXX Is it right to call with IP_FORWARDING. */ 1994 if (in6p == NULL) 1995 sp = ipsec_getpolicybyaddr(m, dir, IP_FORWARDING, &error); 1996 else 1997 sp = ipsec_getpolicybysock(m, dir, 1998 (struct inpcb_hdr *)in6p, 1999 &error); 2000 2001 if (sp == NULL) 2002 return 0; 2003 size = ipsec_hdrsiz(sp); 2004 KEYDEBUG_PRINTF(KEYDEBUG_IPSEC_DATA, "size:%zu.\n", size); 2005 KEY_FREESP(&sp); 2006 2007 return size; 2008 } 2009 #endif /*INET6*/ 2010 2011 /* 2012 * Check the variable replay window. 2013 * ipsec_chkreplay() performs replay check before ICV verification. 2014 * ipsec_updatereplay() updates replay bitmap. This must be called after 2015 * ICV verification (it also performs replay check, which is usually done 2016 * beforehand). 2017 * 0 (zero) is returned if packet disallowed, 1 if packet permitted. 2018 * 2019 * based on RFC 2401. 2020 */ 2021 int 2022 ipsec_chkreplay(u_int32_t seq, const struct secasvar *sav) 2023 { 2024 const struct secreplay *replay; 2025 u_int32_t diff; 2026 int fr; 2027 u_int32_t wsizeb; /* constant: bits of window size */ 2028 int frlast; /* constant: last frame */ 2029 2030 IPSEC_SPLASSERT_SOFTNET(__func__); 2031 2032 KASSERT(sav != NULL); 2033 KASSERT(sav->replay != NULL); 2034 2035 replay = sav->replay; 2036 2037 if (replay->wsize == 0) 2038 return 1; /* no need to check replay. */ 2039 2040 /* constant */ 2041 frlast = replay->wsize - 1; 2042 wsizeb = replay->wsize << 3; 2043 2044 /* sequence number of 0 is invalid */ 2045 if (seq == 0) 2046 return 0; 2047 2048 /* first time is always okay */ 2049 if (replay->count == 0) 2050 return 1; 2051 2052 if (seq > replay->lastseq) { 2053 /* larger sequences are okay */ 2054 return 1; 2055 } else { 2056 /* seq is equal or less than lastseq. */ 2057 diff = replay->lastseq - seq; 2058 2059 /* over range to check, i.e. too old or wrapped */ 2060 if (diff >= wsizeb) 2061 return 0; 2062 2063 fr = frlast - diff / 8; 2064 2065 /* this packet already seen ? */ 2066 if ((replay->bitmap)[fr] & (1 << (diff % 8))) 2067 return 0; 2068 2069 /* out of order but good */ 2070 return 1; 2071 } 2072 } 2073 2074 /* 2075 * check replay counter whether to update or not. 2076 * OUT: 0: OK 2077 * 1: NG 2078 */ 2079 int 2080 ipsec_updatereplay(u_int32_t seq, const struct secasvar *sav) 2081 { 2082 struct secreplay *replay; 2083 u_int32_t diff; 2084 int fr; 2085 u_int32_t wsizeb; /* constant: bits of window size */ 2086 int frlast; /* constant: last frame */ 2087 char buf[INET6_ADDRSTRLEN]; 2088 2089 IPSEC_SPLASSERT_SOFTNET(__func__); 2090 2091 KASSERT(sav != NULL); 2092 KASSERT(sav->replay != NULL); 2093 2094 replay = sav->replay; 2095 2096 if (replay->wsize == 0) 2097 goto ok; /* no need to check replay. */ 2098 2099 /* constant */ 2100 frlast = replay->wsize - 1; 2101 wsizeb = replay->wsize << 3; 2102 2103 /* sequence number of 0 is invalid */ 2104 if (seq == 0) 2105 return 1; 2106 2107 /* first time */ 2108 if (replay->count == 0) { 2109 replay->lastseq = seq; 2110 memset(replay->bitmap, 0, replay->wsize); 2111 (replay->bitmap)[frlast] = 1; 2112 goto ok; 2113 } 2114 2115 if (seq > replay->lastseq) { 2116 /* seq is larger than lastseq. */ 2117 diff = seq - replay->lastseq; 2118 2119 /* new larger sequence number */ 2120 if (diff < wsizeb) { 2121 /* In window */ 2122 /* set bit for this packet */ 2123 vshiftl(replay->bitmap, diff, replay->wsize); 2124 (replay->bitmap)[frlast] |= 1; 2125 } else { 2126 /* this packet has a "way larger" */ 2127 memset(replay->bitmap, 0, replay->wsize); 2128 (replay->bitmap)[frlast] = 1; 2129 } 2130 replay->lastseq = seq; 2131 2132 /* larger is good */ 2133 } else { 2134 /* seq is equal or less than lastseq. */ 2135 diff = replay->lastseq - seq; 2136 2137 /* over range to check, i.e. too old or wrapped */ 2138 if (diff >= wsizeb) 2139 return 1; 2140 2141 fr = frlast - diff / 8; 2142 2143 /* this packet already seen ? */ 2144 if ((replay->bitmap)[fr] & (1 << (diff % 8))) 2145 return 1; 2146 2147 /* mark as seen */ 2148 (replay->bitmap)[fr] |= (1 << (diff % 8)); 2149 2150 /* out of order but good */ 2151 } 2152 2153 ok: 2154 if (replay->count == ~0) { 2155 2156 /* set overflow flag */ 2157 replay->overflow++; 2158 2159 /* don't increment, no more packets accepted */ 2160 if ((sav->flags & SADB_X_EXT_CYCSEQ) == 0) 2161 return 1; 2162 2163 IPSECLOG(LOG_WARNING, "replay counter made %d cycle. %s\n", 2164 replay->overflow, ipsec_logsastr(sav, buf, sizeof(buf))); 2165 } 2166 2167 replay->count++; 2168 2169 return 0; 2170 } 2171 2172 /* 2173 * shift variable length bunffer to left. 2174 * IN: bitmap: pointer to the buffer 2175 * nbit: the number of to shift. 2176 * wsize: buffer size (bytes). 2177 */ 2178 static void 2179 vshiftl(unsigned char *bitmap, int nbit, int wsize) 2180 { 2181 int s, j, i; 2182 unsigned char over; 2183 2184 for (j = 0; j < nbit; j += 8) { 2185 s = (nbit - j < 8) ? (nbit - j): 8; 2186 bitmap[0] <<= s; 2187 for (i = 1; i < wsize; i++) { 2188 over = (bitmap[i] >> (8 - s)); 2189 bitmap[i] <<= s; 2190 bitmap[i-1] |= over; 2191 } 2192 } 2193 2194 return; 2195 } 2196 2197 /* Return a printable string for the address. */ 2198 const char * 2199 ipsec_address(const union sockaddr_union *sa, char *buf, size_t size) 2200 { 2201 switch (sa->sa.sa_family) { 2202 #if INET 2203 case AF_INET: 2204 in_print(buf, size, &sa->sin.sin_addr); 2205 return buf; 2206 #endif /* INET */ 2207 2208 #if INET6 2209 case AF_INET6: 2210 in6_print(buf, size, &sa->sin6.sin6_addr); 2211 return buf; 2212 #endif /* INET6 */ 2213 2214 default: 2215 return "(unknown address family)"; 2216 } 2217 } 2218 2219 const char * 2220 ipsec_logsastr(const struct secasvar *sav, char *buf, size_t size) 2221 { 2222 const struct secasindex *saidx = &sav->sah->saidx; 2223 char sbuf[IPSEC_ADDRSTRLEN], dbuf[IPSEC_ADDRSTRLEN]; 2224 2225 KASSERTMSG(saidx->src.sa.sa_family == saidx->dst.sa.sa_family, 2226 "af family mismatch, src %u, dst %u", 2227 saidx->src.sa.sa_family, saidx->dst.sa.sa_family); 2228 2229 snprintf(buf, size, "SA(SPI=%u src=%s dst=%s)", 2230 (u_int32_t)ntohl(sav->spi), 2231 ipsec_address(&saidx->src, sbuf, sizeof(sbuf)), 2232 ipsec_address(&saidx->dst, dbuf, sizeof(dbuf))); 2233 2234 return buf; 2235 } 2236 2237 void 2238 ipsec_dumpmbuf(struct mbuf *m) 2239 { 2240 int totlen; 2241 int i; 2242 u_char *p; 2243 2244 totlen = 0; 2245 printf("---\n"); 2246 while (m) { 2247 p = mtod(m, u_char *); 2248 for (i = 0; i < m->m_len; i++) { 2249 printf("%02x ", p[i]); 2250 totlen++; 2251 if (totlen % 16 == 0) 2252 printf("\n"); 2253 } 2254 m = m->m_next; 2255 } 2256 if (totlen % 16 != 0) 2257 printf("\n"); 2258 printf("---\n"); 2259 } 2260 2261 #ifdef INET6 2262 struct secpolicy * 2263 ipsec6_check_policy(struct mbuf *m, struct in6pcb *in6p, 2264 int flags, int *needipsecp, int *errorp) 2265 { 2266 struct secpolicy *sp = NULL; 2267 int s; 2268 int error = 0; 2269 int needipsec = 0; 2270 2271 if (!ipsec_outdone(m)) { 2272 s = splsoftnet(); 2273 if (in6p != NULL && 2274 ipsec_pcb_skip_ipsec(in6p->in6p_sp, IPSEC_DIR_OUTBOUND)) { 2275 splx(s); 2276 goto skippolicycheck; 2277 } 2278 sp = ipsec6_checkpolicy(m, IPSEC_DIR_OUTBOUND, flags, &error,in6p); 2279 2280 /* 2281 * There are four return cases: 2282 * sp != NULL apply IPsec policy 2283 * sp == NULL, error == 0 no IPsec handling needed 2284 * sp == NULL, error == -EINVAL discard packet w/o error 2285 * sp == NULL, error != 0 discard packet, report error 2286 */ 2287 2288 splx(s); 2289 if (sp == NULL) { 2290 /* 2291 * Caller must check the error return to see if it needs to discard 2292 * the packet. 2293 */ 2294 needipsec = 0; 2295 } else { 2296 needipsec = 1; 2297 } 2298 } 2299 skippolicycheck:; 2300 2301 *errorp = error; 2302 *needipsecp = needipsec; 2303 return sp; 2304 } 2305 2306 int 2307 ipsec6_input(struct mbuf *m) 2308 { 2309 struct m_tag *mtag; 2310 struct tdb_ident *tdbi; 2311 struct secpolicy *sp; 2312 int s, error; 2313 2314 /* 2315 * Check if the packet has already had IPsec 2316 * processing done. If so, then just pass it 2317 * along. This tag gets set during AH, ESP, 2318 * etc. input handling, before the packet is 2319 * returned to the ip input queue for delivery. 2320 */ 2321 mtag = m_tag_find(m, PACKET_TAG_IPSEC_IN_DONE, 2322 NULL); 2323 s = splsoftnet(); 2324 if (mtag != NULL) { 2325 tdbi = (struct tdb_ident *)(mtag + 1); 2326 sp = ipsec_getpolicy(tdbi, 2327 IPSEC_DIR_INBOUND); 2328 } else { 2329 sp = ipsec_getpolicybyaddr(m, 2330 IPSEC_DIR_INBOUND, IP_FORWARDING, 2331 &error); 2332 } 2333 if (sp != NULL) { 2334 /* 2335 * Check security policy against packet 2336 * attributes. 2337 */ 2338 error = ipsec_in_reject(sp, m); 2339 KEY_FREESP(&sp); 2340 } else { 2341 /* XXX error stat??? */ 2342 error = EINVAL; 2343 IPSECLOG(LOG_DEBUG, "no SP, packet discarded\n");/*XXX*/ 2344 } 2345 splx(s); 2346 2347 return error; 2348 } 2349 #endif /* INET6 */ 2350 2351 2352 2353 /* XXX this stuff doesn't belong here... */ 2354 2355 static struct xformsw *xforms = NULL; 2356 2357 /* 2358 * Register a transform; typically at system startup. 2359 */ 2360 void 2361 xform_register(struct xformsw *xsp) 2362 { 2363 xsp->xf_next = xforms; 2364 xforms = xsp; 2365 } 2366 2367 /* 2368 * Initialize transform support in an sav. 2369 */ 2370 int 2371 xform_init(struct secasvar *sav, int xftype) 2372 { 2373 struct xformsw *xsp; 2374 2375 if (sav->tdb_xform != NULL) /* previously initialized */ 2376 return 0; 2377 for (xsp = xforms; xsp; xsp = xsp->xf_next) 2378 if (xsp->xf_type == xftype) 2379 return (*xsp->xf_init)(sav, xsp); 2380 2381 IPSECLOG(LOG_DEBUG, "no match for xform type %d\n", xftype); 2382 return EINVAL; 2383 } 2384 2385 void 2386 nat_t_ports_get(struct mbuf *m, u_int16_t *dport, u_int16_t *sport) { 2387 struct m_tag *tag; 2388 2389 if ((tag = m_tag_find(m, PACKET_TAG_IPSEC_NAT_T_PORTS, NULL))) { 2390 *sport = ((u_int16_t *)(tag + 1))[0]; 2391 *dport = ((u_int16_t *)(tag + 1))[1]; 2392 } else 2393 *sport = *dport = 0; 2394 } 2395 2396 /* 2397 * XXXJRT This should be done as a protosw init call. 2398 */ 2399 void 2400 ipsec_attach(void) 2401 { 2402 2403 ipsecstat_percpu = percpu_alloc(sizeof(uint64_t) * IPSEC_NSTATS); 2404 2405 sysctl_net_inet_ipsec_setup(NULL); 2406 #ifdef INET6 2407 sysctl_net_inet6_ipsec6_setup(NULL); 2408 #endif 2409 2410 ah_attach(); 2411 esp_attach(); 2412 ipcomp_attach(); 2413 ipe4_attach(); 2414 #ifdef TCP_SIGNATURE 2415 tcpsignature_attach(); 2416 #endif 2417 } 2418
Indexes created Tue Sep 30 11:09:46 GMT 2025