ipsec_netbsd.c revision 1.5
1 /* $NetBSD: ipsec_netbsd.c,v 1.5 2004/01/23 02:39:49 jonathan Exp $ */ 2 /* $KAME: esp_input.c,v 1.60 2001/09/04 08:43:19 itojun Exp $ */ 3 /* $KAME: ah_input.c,v 1.64 2001/09/04 08:43:19 itojun Exp $ */ 4 5 /* 6 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. 7 * All rights reserved. 8 * 9 * Redistribution and use in source and binary forms, with or without 10 * modification, are permitted provided that the following conditions 11 * are met: 12 * 1. Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * 2. Redistributions in binary form must reproduce the above copyright 15 * notice, this list of conditions and the following disclaimer in the 16 * documentation and/or other materials provided with the distribution. 17 * 3. Neither the name of the project nor the names of its contributors 18 * may be used to endorse or promote products derived from this software 19 * without specific prior written permission. 20 * 21 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND 22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 24 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE 25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 31 * SUCH DAMAGE. 32 */ 33 34 #include <sys/cdefs.h> 35 __KERNEL_RCSID(0, "$NetBSD: ipsec_netbsd.c,v 1.5 2004/01/23 02:39:49 jonathan Exp $"); 36 37 #include "opt_inet.h" 38 #include "opt_ipsec.h" 39 40 #include <sys/param.h> 41 #include <sys/systm.h> 42 #include <sys/malloc.h> 43 #include <sys/mbuf.h> 44 #include <sys/domain.h> 45 #include <sys/protosw.h> 46 #include <sys/socket.h> 47 #include <sys/errno.h> 48 #include <sys/time.h> 49 #include <sys/kernel.h> 50 #include <sys/sysctl.h> 51 52 #include <net/if.h> 53 #include <net/route.h> 54 #include <net/netisr.h> 55 #include <machine/cpu.h> 56 57 #include <netinet/in.h> 58 #include <netinet/in_systm.h> 59 #include <netinet/in_var.h> 60 #include <netinet/ip.h> 61 #include <netinet/ip_var.h> 62 #include <netinet/ip_ecn.h> 63 #include <netinet/ip_icmp.h> 64 65 66 #include <netipsec/ipsec.h> 67 #include <netipsec/key.h> 68 #include <netipsec/keydb.h> 69 #include <netipsec/key_debug.h> 70 #include <netipsec/ah_var.h> 71 #include <netipsec/esp.h> 72 73 #ifdef INET6 74 #include <netipsec/ipsec6.h> 75 #include <netinet6/ip6protosw.h> 76 #include <netinet/icmp6.h> 77 #endif 78 79 #include <machine/stdarg.h> 80 81 82 83 #include <netipsec/key.h> 84 85 /* assumes that ip header and ah header are contiguous on mbuf */ 86 void * 87 ah4_ctlinput(cmd, sa, v) 88 int cmd; 89 struct sockaddr *sa; 90 void *v; 91 { 92 struct ip *ip = v; 93 struct ah *ah; 94 struct icmp *icp; 95 struct secasvar *sav; 96 97 if (sa->sa_family != AF_INET || 98 sa->sa_len != sizeof(struct sockaddr_in)) 99 return NULL; 100 if ((unsigned)cmd >= PRC_NCMDS) 101 return NULL; 102 #ifndef notyet 103 (void) ip; (void) ah; (void) icp; (void) sav; 104 #else 105 if (cmd == PRC_MSGSIZE && ip_mtudisc && ip && ip->ip_v == 4) { 106 /* 107 * Check to see if we have a valid SA corresponding to 108 * the address in the ICMP message payload. 109 */ 110 ah = (struct ah *)((caddr_t)ip + (ip->ip_hl << 2)); 111 if ((sav = key_allocsa(AF_INET, 112 (caddr_t) &ip->ip_src, 113 (caddr_t) &ip->ip_dst, 114 IPPROTO_AH, ah->ah_spi)) == NULL) 115 return NULL; 116 if (sav->state != SADB_SASTATE_MATURE && 117 sav->state != SADB_SASTATE_DYING) { 118 key_freesav(sav); 119 return NULL; 120 } 121 122 /* XXX Further validation? */ 123 124 key_freesav(sav); 125 126 /* 127 * Now that we've validated that we are actually communicating 128 * with the host indicated in the ICMP message, locate the 129 * ICMP header, recalculate the new MTU, and create the 130 * corresponding routing entry. 131 */ 132 icp = (struct icmp *)((caddr_t)ip - 133 offsetof(struct icmp, icmp_ip)); 134 icmp_mtudisc(icp, ip->ip_dst); 135 136 return NULL; 137 } 138 #endif 139 140 return NULL; 141 } 142 143 /* assumes that ip header and esp header are contiguous on mbuf */ 144 void * 145 esp4_ctlinput(cmd, sa, v) 146 int cmd; 147 struct sockaddr *sa; 148 void *v; 149 { 150 struct ip *ip = v; 151 struct esp *esp; 152 struct icmp *icp; 153 struct secasvar *sav; 154 155 if (sa->sa_family != AF_INET || 156 sa->sa_len != sizeof(struct sockaddr_in)) 157 return NULL; 158 if ((unsigned)cmd >= PRC_NCMDS) 159 return NULL; 160 #ifndef notyet 161 (void) ip; (void) esp; (void) icp; (void) sav; 162 #else 163 if (cmd == PRC_MSGSIZE && ip_mtudisc && ip && ip->ip_v == 4) { 164 /* 165 * Check to see if we have a valid SA corresponding to 166 * the address in the ICMP message payload. 167 */ 168 esp = (struct esp *)((caddr_t)ip + (ip->ip_hl << 2)); 169 if ((sav = key_allocsa(AF_INET, 170 (caddr_t) &ip->ip_src, 171 (caddr_t) &ip->ip_dst, 172 IPPROTO_ESP, esp->esp_spi)) == NULL) 173 return NULL; 174 if (sav->state != SADB_SASTATE_MATURE && 175 sav->state != SADB_SASTATE_DYING) { 176 key_freesav(sav); 177 return NULL; 178 } 179 180 /* XXX Further validation? */ 181 182 key_freesav(sav); 183 184 /* 185 * Now that we've validated that we are actually communicating 186 * with the host indicated in the ICMP message, locate the 187 * ICMP header, recalculate the new MTU, and create the 188 * corresponding routing entry. 189 */ 190 icp = (struct icmp *)((caddr_t)ip - 191 offsetof(struct icmp, icmp_ip)); 192 icmp_mtudisc(icp, ip->ip_dst); 193 194 return NULL; 195 } 196 #endif 197 198 return NULL; 199 } 200 201 #ifdef INET6 202 void 203 esp6_ctlinput(cmd, sa, d) 204 int cmd; 205 struct sockaddr *sa; 206 void *d; 207 { 208 const struct newesp *espp; 209 struct newesp esp; 210 struct ip6ctlparam *ip6cp = NULL, ip6cp1; 211 struct secasvar *sav; 212 struct ip6_hdr *ip6; 213 struct mbuf *m; 214 int off; 215 struct sockaddr_in6 *sa6_src, *sa6_dst; 216 217 if (sa->sa_family != AF_INET6 || 218 sa->sa_len != sizeof(struct sockaddr_in6)) 219 return; 220 if ((unsigned)cmd >= PRC_NCMDS) 221 return; 222 223 /* if the parameter is from icmp6, decode it. */ 224 if (d != NULL) { 225 ip6cp = (struct ip6ctlparam *)d; 226 m = ip6cp->ip6c_m; 227 ip6 = ip6cp->ip6c_ip6; 228 off = ip6cp->ip6c_off; 229 } else { 230 m = NULL; 231 ip6 = NULL; 232 } 233 234 if (ip6) { 235 /* 236 * Notify the error to all possible sockets via pfctlinput2. 237 * Since the upper layer information (such as protocol type, 238 * source and destination ports) is embedded in the encrypted 239 * data and might have been cut, we can't directly call 240 * an upper layer ctlinput function. However, the pcbnotify 241 * function will consider source and destination addresses 242 * as well as the flow info value, and may be able to find 243 * some PCB that should be notified. 244 * Although pfctlinput2 will call esp6_ctlinput(), there is 245 * no possibility of an infinite loop of function calls, 246 * because we don't pass the inner IPv6 header. 247 */ 248 bzero(&ip6cp1, sizeof(ip6cp1)); 249 ip6cp1.ip6c_src = ip6cp->ip6c_src; 250 pfctlinput2(cmd, sa, (void *)&ip6cp1); 251 252 /* 253 * Then go to special cases that need ESP header information. 254 * XXX: We assume that when ip6 is non NULL, 255 * M and OFF are valid. 256 */ 257 258 /* check if we can safely examine src and dst ports */ 259 if (m->m_pkthdr.len < off + sizeof(esp)) 260 return; 261 262 if (m->m_len < off + sizeof(esp)) { 263 /* 264 * this should be rare case, 265 * so we compromise on this copy... 266 */ 267 m_copydata(m, off, sizeof(esp), (caddr_t)&esp); 268 espp = &esp; 269 } else 270 espp = (struct newesp*)(mtod(m, caddr_t) + off); 271 272 if (cmd == PRC_MSGSIZE) { 273 int valid = 0; 274 275 /* 276 * Check to see if we have a valid SA corresponding to 277 * the address in the ICMP message payload. 278 */ 279 sa6_src = ip6cp->ip6c_src; 280 sa6_dst = (struct sockaddr_in6 *)sa; 281 sav = key_allocsa(AF_INET6, 282 (caddr_t)&sa6_src->sin6_addr, 283 (caddr_t)&sa6_dst->sin6_addr, 284 IPPROTO_ESP, espp->esp_spi); 285 if (sav) { 286 if (sav->state == SADB_SASTATE_MATURE || 287 sav->state == SADB_SASTATE_DYING) 288 valid++; 289 key_freesav(sav); 290 } 291 292 /* XXX Further validation? */ 293 294 /* 295 * Depending on the value of "valid" and routing table 296 * size (mtudisc_{hi,lo}wat), we will: 297 * - recalcurate the new MTU and create the 298 * corresponding routing entry, or 299 * - ignore the MTU change notification. 300 */ 301 icmp6_mtudisc_update((struct ip6ctlparam *)d, valid); 302 } 303 } else { 304 /* we normally notify any pcb here */ 305 } 306 } 307 #endif /* INET6 */ 308 309 310 /*FIXME: placebo for invalpcbcacheall. Fast-IPsec has no pcb cache? */ 311 312 void ipsec_invalpcbcacheall(void); 313 void 314 ipsec_invalpcbcacheall(void) 315 { 316 } 317 318 static int 319 sysctl_fast_ipsec(SYSCTLFN_ARGS) 320 { 321 int error, t; 322 struct sysctlnode node; 323 324 node = *rnode; 325 t = *(int*)rnode->sysctl_data; 326 node.sysctl_data = &t; 327 error = sysctl_lookup(SYSCTLFN_CALL(&node)); 328 if (error || newp == NULL) 329 return (error); 330 331 switch (rnode->sysctl_num) { 332 case IPSECCTL_DEF_ESP_TRANSLEV: 333 case IPSECCTL_DEF_ESP_NETLEV: 334 case IPSECCTL_DEF_AH_TRANSLEV: 335 case IPSECCTL_DEF_AH_NETLEV: 336 if (t != IPSEC_LEVEL_USE && 337 t != IPSEC_LEVEL_REQUIRE) 338 return (EINVAL); 339 ipsec_invalpcbcacheall(); 340 break; 341 case IPSECCTL_DEF_POLICY: 342 if (t != IPSEC_POLICY_DISCARD && 343 t != IPSEC_POLICY_NONE) 344 return (EINVAL); 345 ipsec_invalpcbcacheall(); 346 break; 347 default: 348 return (EINVAL); 349 } 350 351 *(int*)rnode->sysctl_data = t; 352 353 return (0); 354 } 355 356 /* XXX will need a different oid at parent */ 357 /* @@@ i have called it "fast_ipsec" instead of "ipsec" */ 358 SYSCTL_SETUP(sysctl_net_inet_fast_ipsec_setup, "sysctl net.inet.fast_ipsec subtree setup") 359 { 360 361 sysctl_createv(SYSCTL_PERMANENT, 362 CTLTYPE_NODE, "net", NULL, 363 NULL, 0, NULL, 0, 364 CTL_NET, CTL_EOL); 365 sysctl_createv(SYSCTL_PERMANENT, 366 CTLTYPE_NODE, "inet", NULL, 367 NULL, 0, NULL, 0, 368 CTL_NET, PF_INET, CTL_EOL); 369 sysctl_createv(SYSCTL_PERMANENT, 370 CTLTYPE_NODE, "fast_ipsec", NULL, 371 NULL, 0, NULL, 0, 372 CTL_NET, PF_INET, IPPROTO_AH, CTL_EOL); 373 374 sysctl_createv(SYSCTL_PERMANENT|SYSCTL_READWRITE, 375 CTLTYPE_STRUCT, "stats", NULL, 376 NULL, 0, &ipsecstat, sizeof(ipsecstat), 377 CTL_NET, PF_INET, IPPROTO_AH, 378 IPSECCTL_STATS, CTL_EOL); 379 sysctl_createv(SYSCTL_PERMANENT|SYSCTL_READWRITE, 380 CTLTYPE_INT, "def_policy", NULL, 381 sysctl_fast_ipsec, 0, &ip4_def_policy.policy, 0, 382 CTL_NET, PF_INET, IPPROTO_AH, 383 IPSECCTL_DEF_POLICY, CTL_EOL); 384 sysctl_createv(SYSCTL_PERMANENT|SYSCTL_READWRITE, 385 CTLTYPE_INT, "esp_trans_deflev", NULL, 386 sysctl_fast_ipsec, 0, &ip4_esp_trans_deflev, 0, 387 CTL_NET, PF_INET, IPPROTO_AH, 388 IPSECCTL_DEF_ESP_TRANSLEV, CTL_EOL); 389 sysctl_createv(SYSCTL_PERMANENT|SYSCTL_READWRITE, 390 CTLTYPE_INT, "esp_net_deflev", NULL, 391 sysctl_fast_ipsec, 0, &ip4_esp_net_deflev, 0, 392 CTL_NET, PF_INET, IPPROTO_AH, 393 IPSECCTL_DEF_ESP_NETLEV, CTL_EOL); 394 sysctl_createv(SYSCTL_PERMANENT|SYSCTL_READWRITE, 395 CTLTYPE_INT, "ah_trans_deflev", NULL, 396 sysctl_fast_ipsec, 0, &ip4_ah_trans_deflev, 0, 397 CTL_NET, PF_INET, IPPROTO_AH, 398 IPSECCTL_DEF_AH_TRANSLEV, CTL_EOL); 399 sysctl_createv(SYSCTL_PERMANENT|SYSCTL_READWRITE, 400 CTLTYPE_INT, "ah_net_deflev", NULL, 401 sysctl_fast_ipsec, 0, &ip4_ah_net_deflev, 0, 402 CTL_NET, PF_INET, IPPROTO_AH, 403 IPSECCTL_DEF_AH_NETLEV, CTL_EOL); 404 sysctl_createv(SYSCTL_PERMANENT|SYSCTL_READWRITE, 405 CTLTYPE_INT, "ah_cleartos", NULL, 406 NULL, 0, &/*ip4_*/ah_cleartos, 0, 407 CTL_NET, PF_INET, IPPROTO_AH, 408 IPSECCTL_AH_CLEARTOS, CTL_EOL); 409 sysctl_createv(SYSCTL_PERMANENT|SYSCTL_READWRITE, 410 CTLTYPE_INT, "ah_offsetmask", NULL, 411 NULL, 0, &ip4_ah_offsetmask, 0, 412 CTL_NET, PF_INET, IPPROTO_AH, 413 IPSECCTL_AH_OFFSETMASK, CTL_EOL); 414 sysctl_createv(SYSCTL_PERMANENT|SYSCTL_READWRITE, 415 CTLTYPE_INT, "dfbit", NULL, 416 NULL, 0, &ip4_ipsec_dfbit, 0, 417 CTL_NET, PF_INET, IPPROTO_AH, 418 IPSECCTL_DFBIT, CTL_EOL); 419 sysctl_createv(SYSCTL_PERMANENT|SYSCTL_READWRITE, 420 CTLTYPE_INT, "ecn", NULL, 421 NULL, 0, &ip4_ipsec_ecn, 0, 422 CTL_NET, PF_INET, IPPROTO_AH, 423 IPSECCTL_ECN, CTL_EOL); 424 sysctl_createv(SYSCTL_PERMANENT|SYSCTL_READWRITE, 425 CTLTYPE_INT, "debug", NULL, 426 NULL, 0, &ipsec_debug, 0, 427 CTL_NET, PF_INET, IPPROTO_AH, 428 IPSECCTL_DEBUG, CTL_EOL); 429 430 /* 431 * "aliases" for the fast ipsec subtree 432 */ 433 sysctl_createv(SYSCTL_PERMANENT|SYSCTL_ALIAS, 434 CTLTYPE_NODE, "fast_esp", NULL, 435 NULL, IPPROTO_AH, NULL, 0, 436 CTL_NET, PF_INET, IPPROTO_ESP, CTL_EOL); 437 sysctl_createv(SYSCTL_PERMANENT|SYSCTL_ALIAS, 438 CTLTYPE_NODE, "fast_ipcomp", NULL, 439 NULL, IPPROTO_AH, NULL, 0, 440 CTL_NET, PF_INET, IPPROTO_IPCOMP, CTL_EOL); 441 sysctl_createv(SYSCTL_PERMANENT|SYSCTL_ALIAS, 442 CTLTYPE_NODE, "fast_ah", NULL, 443 NULL, IPPROTO_AH, NULL, 0, 444 CTL_NET, PF_INET, CTL_CREATE, CTL_EOL); 445 } 446
Indexes created Tue Sep 23 22:09:46 GMT 2025