ipsecif.c revision 1.11
1 /* $NetBSD: ipsecif.c,v 1.11 2018/11/15 10:23:56 maxv Exp $ */ 2 3 /* 4 * Copyright (c) 2017 Internet Initiative Japan Inc. 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 16 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 17 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 18 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 19 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 20 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 21 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 22 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 23 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 24 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 25 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 26 * POSSIBILITY OF SUCH DAMAGE. 27 */ 28 29 #include <sys/cdefs.h> 30 __KERNEL_RCSID(0, "$NetBSD: ipsecif.c,v 1.11 2018/11/15 10:23:56 maxv Exp $"); 31 32 #ifdef _KERNEL_OPT 33 #include "opt_inet.h" 34 #include "opt_ipsec.h" 35 #endif 36 37 #include <sys/param.h> 38 #include <sys/systm.h> 39 #include <sys/socket.h> 40 #include <sys/sockio.h> 41 #include <sys/mbuf.h> 42 #include <sys/errno.h> 43 #include <sys/ioctl.h> 44 #include <sys/syslog.h> 45 #include <sys/kernel.h> 46 47 #include <net/if.h> 48 #include <net/route.h> 49 50 #include <netinet/in.h> 51 #include <netinet/in_systm.h> 52 #include <netinet/ip.h> 53 #include <netinet/ip_var.h> 54 #include <netinet/in_var.h> 55 #include <netinet/ip_encap.h> 56 #include <netinet/ip_ecn.h> 57 #include <netinet/ip_private.h> 58 #include <netinet/udp.h> 59 60 #ifdef INET6 61 #include <netinet/ip6.h> 62 #include <netinet6/ip6_var.h> 63 #include <netinet6/ip6_private.h> 64 #include <netinet6/in6_var.h> 65 #include <netinet6/ip6protosw.h> /* for struct ip6ctlparam */ 66 #include <netinet/ip_ecn.h> 67 #endif 68 69 #include <netipsec/key.h> 70 #include <netipsec/ipsecif.h> 71 72 #include <net/if_ipsec.h> 73 74 static void ipsecif4_input(struct mbuf *, int, int, void *); 75 static int ipsecif4_output(struct ipsec_variant *, int, struct mbuf *); 76 static int ipsecif4_filter4(const struct ip *, struct ipsec_variant *, 77 struct ifnet *); 78 79 #ifdef INET6 80 static int ipsecif6_input(struct mbuf **, int *, int, void *); 81 static int ipsecif6_output(struct ipsec_variant *, int, struct mbuf *); 82 static int ipsecif6_filter6(const struct ip6_hdr *, struct ipsec_variant *, 83 struct ifnet *); 84 #endif 85 86 static int ip_ipsec_ttl = IPSEC_TTL; 87 static int ip_ipsec_copy_tos = 0; 88 #ifdef INET6 89 static int ip6_ipsec_hlim = IPSEC_HLIM; 90 static int ip6_ipsec_pmtu = 0; /* XXX: per interface configuration?? */ 91 static int ip6_ipsec_copy_tos = 0; 92 #endif 93 94 static const struct encapsw ipsecif4_encapsw = { 95 .encapsw4 = { 96 .pr_input = ipsecif4_input, 97 .pr_ctlinput = NULL, 98 } 99 }; 100 101 #ifdef INET6 102 static const struct encapsw ipsecif6_encapsw; 103 #endif 104 105 static struct mbuf * 106 ipsecif4_prepend_hdr(struct ipsec_variant *var, struct mbuf *m, 107 uint8_t proto, uint8_t tos) 108 { 109 struct ip *ip; 110 struct sockaddr_in *src, *dst; 111 112 src = satosin(var->iv_psrc); 113 dst = satosin(var->iv_pdst); 114 115 if (in_nullhost(src->sin_addr) || in_nullhost(src->sin_addr) || 116 src->sin_addr.s_addr == INADDR_BROADCAST || 117 dst->sin_addr.s_addr == INADDR_BROADCAST) { 118 m_freem(m); 119 return NULL; 120 } 121 m->m_flags &= ~M_BCAST; 122 123 if (IN_MULTICAST(src->sin_addr.s_addr) || 124 IN_MULTICAST(dst->sin_addr.s_addr)) { 125 m_freem(m); 126 return NULL; 127 } 128 129 M_PREPEND(m, sizeof(struct ip), M_DONTWAIT); 130 if (m && M_UNWRITABLE(m, sizeof(struct ip))) 131 m = m_pullup(m, sizeof(struct ip)); 132 if (m == NULL) 133 return NULL; 134 135 ip = mtod(m, struct ip *); 136 ip->ip_v = IPVERSION; 137 ip->ip_off = htons(0); 138 if (m->m_pkthdr.len < IP_MINFRAGSIZE) 139 ip->ip_id = 0; 140 else 141 ip->ip_id = ip_newid(NULL); 142 ip->ip_hl = sizeof(*ip) >> 2; 143 if (ip_ipsec_copy_tos) 144 ip->ip_tos = tos; 145 else 146 ip->ip_tos = 0; 147 ip->ip_sum = 0; 148 ip->ip_src = src->sin_addr; 149 ip->ip_dst = dst->sin_addr; 150 ip->ip_p = proto; 151 ip->ip_ttl = ip_ipsec_ttl; 152 ip->ip_len = htons(m->m_pkthdr.len); 153 #ifndef IPSEC_TX_TOS_CLEAR 154 struct ifnet *ifp = &var->iv_softc->ipsec_if; 155 if (ifp->if_flags & IFF_ECN) 156 ip_ecn_ingress(ECN_ALLOWED, &ip->ip_tos, &tos); 157 else 158 ip_ecn_ingress(ECN_NOCARE, &ip->ip_tos, &tos); 159 #endif 160 161 return m; 162 } 163 164 static int 165 ipsecif4_needfrag(struct mbuf *m, struct ipsecrequest *isr) 166 { 167 struct ip ip0; 168 struct ip *ip; 169 int mtu; 170 struct secasvar *sav; 171 172 sav = key_lookup_sa_bysaidx(&isr->saidx); 173 if (sav == NULL) 174 return 0; 175 176 if (!(sav->natt_type & UDP_ENCAP_ESPINUDP)) { 177 mtu = 0; 178 goto out; 179 } 180 181 if (m->m_len < sizeof(struct ip)) { 182 m_copydata(m, 0, sizeof(ip0), &ip0); 183 ip = &ip0; 184 } else { 185 ip = mtod(m, struct ip *); 186 } 187 mtu = sav->esp_frag; 188 if (ntohs(ip->ip_len) <= mtu) 189 mtu = 0; 190 191 out: 192 KEY_SA_UNREF(&sav); 193 return mtu; 194 } 195 196 static struct mbuf * 197 ipsecif4_flowinfo(struct mbuf *m, int family, int *proto0, u_int8_t *tos0) 198 { 199 const struct ip *ip; 200 int proto; 201 int tos; 202 203 KASSERT(proto0 != NULL); 204 KASSERT(tos0 != NULL); 205 206 switch (family) { 207 case AF_INET: 208 proto = IPPROTO_IPV4; 209 if (m->m_len < sizeof(*ip)) { 210 m = m_pullup(m, sizeof(*ip)); 211 if (m == NULL) { 212 *tos0 = 0; 213 *proto0 = 0; 214 return NULL; 215 } 216 } 217 ip = mtod(m, const struct ip *); 218 tos = ip->ip_tos; 219 /* TODO: support ALTQ for innner packet */ 220 break; 221 #ifdef INET6 222 case AF_INET6: { 223 const struct ip6_hdr *ip6; 224 proto = IPPROTO_IPV6; 225 if (m->m_len < sizeof(*ip6)) { 226 m = m_pullup(m, sizeof(*ip6)); 227 if (m == NULL) { 228 *tos0 = 0; 229 *proto0 = 0; 230 return NULL; 231 } 232 } 233 ip6 = mtod(m, const struct ip6_hdr *); 234 tos = (ntohl(ip6->ip6_flow) >> 20) & 0xff; 235 /* TODO: support ALTQ for innner packet */ 236 break; 237 } 238 #endif /* INET6 */ 239 default: 240 *tos0 = 0; 241 *proto0 = 0; 242 return NULL; 243 } 244 245 *proto0 = proto; 246 *tos0 = tos; 247 return m; 248 } 249 250 static int 251 ipsecif4_fragout(struct ipsec_variant *var, int family, struct mbuf *m, int mtu) 252 { 253 struct ifnet *ifp = &var->iv_softc->ipsec_if; 254 struct mbuf *next; 255 struct m_tag *mtag; 256 int error; 257 258 KASSERT(if_ipsec_heldref_variant(var)); 259 260 mtag = m_tag_find(m, PACKET_TAG_IPSEC_NAT_T_PORTS); 261 if (mtag) 262 m_tag_delete(m, mtag); 263 264 /* consider new IP header prepended in ipsecif4_output() */ 265 if (mtu <= sizeof(struct ip)) { 266 m_freem(m); 267 return ENETUNREACH; 268 } 269 m->m_pkthdr.csum_flags |= M_CSUM_IPv4; 270 error = ip_fragment(m, ifp, mtu - sizeof(struct ip)); 271 if (error) 272 return error; 273 274 for (error = 0; m; m = next) { 275 next = m->m_nextpkt; 276 m->m_nextpkt = NULL; 277 if (error) { 278 m_freem(m); 279 continue; 280 } 281 282 error = ipsecif4_output(var, family, m); 283 } 284 if (error == 0) 285 IP_STATINC(IP_STAT_FRAGMENTED); 286 287 return error; 288 } 289 290 int 291 ipsecif4_encap_func(struct mbuf *m, struct ip *ip, struct ipsec_variant *var) 292 { 293 struct m_tag *mtag; 294 struct sockaddr_in *src, *dst; 295 u_int16_t src_port = 0; 296 u_int16_t dst_port = 0; 297 298 KASSERT(var != NULL); 299 300 src = satosin(var->iv_psrc); 301 dst = satosin(var->iv_pdst); 302 mtag = m_tag_find(m, PACKET_TAG_IPSEC_NAT_T_PORTS); 303 if (mtag) { 304 u_int16_t *ports; 305 306 ports = (u_int16_t *)(mtag + 1); 307 src_port = ports[0]; 308 dst_port = ports[1]; 309 } 310 311 /* address match */ 312 if (src->sin_addr.s_addr != ip->ip_dst.s_addr || 313 dst->sin_addr.s_addr != ip->ip_src.s_addr) 314 return 0; 315 316 /* UDP encap? */ 317 if (mtag == NULL && var->iv_sport == 0 && var->iv_dport == 0) 318 goto match; 319 320 /* port match */ 321 if (src_port != var->iv_dport || 322 dst_port != var->iv_sport) { 323 #ifdef DEBUG 324 printf("%s: port mismatch: pkt(%u, %u), if(%u, %u)\n", 325 __func__, ntohs(src_port), ntohs(dst_port), 326 ntohs(var->iv_sport), ntohs(var->iv_dport)); 327 #endif 328 return 0; 329 } 330 331 match: 332 /* 333 * hide NAT-T information from encapsulated traffics. 334 * they don't know about IPsec. 335 */ 336 if (mtag) 337 m_tag_delete(m, mtag); 338 return sizeof(src->sin_addr) + sizeof(dst->sin_addr); 339 } 340 341 static int 342 ipsecif4_output(struct ipsec_variant *var, int family, struct mbuf *m) 343 { 344 struct secpolicy *sp = NULL; 345 u_int8_t tos; 346 int proto; 347 int error; 348 int mtu; 349 u_long sa_mtu = 0; 350 351 KASSERT(if_ipsec_heldref_variant(var)); 352 KASSERT(if_ipsec_variant_is_configured(var)); 353 KASSERT(var->iv_psrc->sa_family == AF_INET); 354 KASSERT(var->iv_pdst->sa_family == AF_INET); 355 356 sp = IV_SP_OUT(var); 357 KASSERT(sp != NULL); 358 /* 359 * The SPs in ipsec_variant are prevented from freed by 360 * ipsec_variant->iv_psref. So, KEY_SP_REF() is unnecessary here. 361 */ 362 363 KASSERT(sp->policy != IPSEC_POLICY_NONE); 364 KASSERT(sp->policy != IPSEC_POLICY_ENTRUST); 365 KASSERT(sp->policy != IPSEC_POLICY_BYPASS); 366 if (sp->policy != IPSEC_POLICY_IPSEC) { 367 struct ifnet *ifp = &var->iv_softc->ipsec_if; 368 m_freem(m); 369 IF_DROP(&ifp->if_snd); 370 return 0; 371 } 372 373 /* get flowinfo */ 374 m = ipsecif4_flowinfo(m, family, &proto, &tos); 375 if (m == NULL) { 376 error = ENETUNREACH; 377 goto done; 378 } 379 380 /* prepend new IP header */ 381 m = ipsecif4_prepend_hdr(var, m, proto, tos); 382 if (m == NULL) { 383 error = ENETUNREACH; 384 goto done; 385 } 386 387 /* 388 * Normal netipsec's NAT-T fragmentation is done in ip_output(). 389 * See "natt_frag" processing. 390 * However, ipsec(4) interface's one is not done in the same way, 391 * so we must do NAT-T fragmentation by own code. 392 */ 393 /* NAT-T ESP fragmentation */ 394 mtu = ipsecif4_needfrag(m, sp->req); 395 if (mtu > 0) 396 return ipsecif4_fragout(var, family, m, mtu); 397 398 /* IPsec output */ 399 IP_STATINC(IP_STAT_LOCALOUT); 400 error = ipsec4_process_packet(m, sp->req, &sa_mtu); 401 if (error == ENOENT) 402 error = 0; 403 /* 404 * frangmentation is already done in ipsecif4_fragout(), 405 * so ipsec4_process_packet() must not do fragmentation here. 406 */ 407 KASSERT(sa_mtu == 0); 408 409 done: 410 return error; 411 } 412 413 #ifdef INET6 414 int 415 ipsecif6_encap_func(struct mbuf *m, struct ip6_hdr *ip6, struct ipsec_variant *var) 416 { 417 struct m_tag *mtag; 418 struct sockaddr_in6 *src, *dst; 419 u_int16_t src_port = 0; 420 u_int16_t dst_port = 0; 421 422 KASSERT(var != NULL); 423 424 src = satosin6(var->iv_psrc); 425 dst = satosin6(var->iv_pdst); 426 mtag = m_tag_find(m, PACKET_TAG_IPSEC_NAT_T_PORTS); 427 if (mtag) { 428 u_int16_t *ports; 429 430 ports = (u_int16_t *)(mtag + 1); 431 src_port = ports[0]; 432 dst_port = ports[1]; 433 } 434 435 /* address match */ 436 if (!IN6_ARE_ADDR_EQUAL(&src->sin6_addr, &ip6->ip6_dst) || 437 !IN6_ARE_ADDR_EQUAL(&dst->sin6_addr, &ip6->ip6_src)) 438 return 0; 439 440 /* UDP encap? */ 441 if (mtag == NULL && var->iv_sport == 0 && var->iv_dport == 0) 442 goto match; 443 444 /* port match */ 445 if (src_port != var->iv_dport || 446 dst_port != var->iv_sport) { 447 #ifdef DEBUG 448 printf("%s: port mismatch: pkt(%u, %u), if(%u, %u)\n", 449 __func__, ntohs(src_port), ntohs(dst_port), 450 ntohs(var->iv_sport), ntohs(var->iv_dport)); 451 #endif 452 return 0; 453 } 454 455 match: 456 /* 457 * hide NAT-T information from encapsulated traffics. 458 * they don't know about IPsec. 459 */ 460 if (mtag) 461 m_tag_delete(m, mtag); 462 return sizeof(src->sin6_addr) + sizeof(dst->sin6_addr); 463 } 464 465 static int 466 ipsecif6_output(struct ipsec_variant *var, int family, struct mbuf *m) 467 { 468 struct ifnet *ifp = &var->iv_softc->ipsec_if; 469 struct ipsec_softc *sc = ifp->if_softc; 470 struct ipsec_ro *iro; 471 struct rtentry *rt; 472 struct sockaddr_in6 *sin6_src; 473 struct sockaddr_in6 *sin6_dst; 474 struct ip6_hdr *ip6; 475 int proto, error; 476 u_int8_t itos, otos; 477 union { 478 struct sockaddr dst; 479 struct sockaddr_in6 dst6; 480 } u; 481 482 KASSERT(if_ipsec_heldref_variant(var)); 483 KASSERT(if_ipsec_variant_is_configured(var)); 484 485 sin6_src = satosin6(var->iv_psrc); 486 sin6_dst = satosin6(var->iv_pdst); 487 488 KASSERT(sin6_src->sin6_family == AF_INET6); 489 KASSERT(sin6_dst->sin6_family == AF_INET6); 490 491 switch (family) { 492 #ifdef INET 493 case AF_INET: 494 { 495 struct ip *ip; 496 497 proto = IPPROTO_IPV4; 498 if (m->m_len < sizeof(*ip)) { 499 m = m_pullup(m, sizeof(*ip)); 500 if (m == NULL) 501 return ENOBUFS; 502 } 503 ip = mtod(m, struct ip *); 504 itos = ip->ip_tos; 505 /* TODO: support ALTQ for innner packet */ 506 break; 507 } 508 #endif /* INET */ 509 case AF_INET6: 510 { 511 struct ip6_hdr *xip6; 512 proto = IPPROTO_IPV6; 513 if (m->m_len < sizeof(*xip6)) { 514 m = m_pullup(m, sizeof(*xip6)); 515 if (m == NULL) 516 return ENOBUFS; 517 } 518 xip6 = mtod(m, struct ip6_hdr *); 519 itos = (ntohl(xip6->ip6_flow) >> 20) & 0xff; 520 /* TODO: support ALTQ for innner packet */ 521 break; 522 } 523 default: 524 m_freem(m); 525 return EAFNOSUPPORT; 526 } 527 528 /* prepend new IP header */ 529 M_PREPEND(m, sizeof(struct ip6_hdr), M_DONTWAIT); 530 if (m && M_UNWRITABLE(m, sizeof(struct ip6_hdr))) 531 m = m_pullup(m, sizeof(struct ip6_hdr)); 532 if (m == NULL) 533 return ENOBUFS; 534 535 ip6 = mtod(m, struct ip6_hdr *); 536 ip6->ip6_flow = 0; 537 ip6->ip6_vfc &= ~IPV6_VERSION_MASK; 538 ip6->ip6_vfc |= IPV6_VERSION; 539 #if 0 /* ip6->ip6_plen will be filled by ip6_output */ 540 ip6->ip6_plen = htons((u_short)m->m_pkthdr.len - sizeof(*ip6)); 541 #endif 542 ip6->ip6_nxt = proto; 543 ip6->ip6_hlim = ip6_ipsec_hlim; 544 ip6->ip6_src = sin6_src->sin6_addr; 545 /* bidirectional configured tunnel mode */ 546 if (!IN6_IS_ADDR_UNSPECIFIED(&sin6_dst->sin6_addr)) { 547 ip6->ip6_dst = sin6_dst->sin6_addr; 548 } else { 549 m_freem(m); 550 return ENETUNREACH; 551 } 552 #ifndef IPSEC_TX_TOS_CLEAR 553 if (ifp->if_flags & IFF_ECN) 554 ip_ecn_ingress(ECN_ALLOWED, &otos, &itos); 555 else 556 ip_ecn_ingress(ECN_NOCARE, &otos, &itos); 557 558 if (!ip6_ipsec_copy_tos) 559 otos = 0; 560 #else 561 if (ip6_ipsec_copy_tos) 562 otos = itos; 563 else 564 otos = 0; 565 #endif 566 ip6->ip6_flow &= ~ntohl(0xff00000); 567 ip6->ip6_flow |= htonl((u_int32_t)otos << 20); 568 569 sockaddr_in6_init(&u.dst6, &sin6_dst->sin6_addr, 0, 0, 0); 570 571 iro = percpu_getref(sc->ipsec_ro_percpu); 572 mutex_enter(iro->ir_lock); 573 if ((rt = rtcache_lookup(&iro->ir_ro, &u.dst)) == NULL) { 574 mutex_exit(iro->ir_lock); 575 percpu_putref(sc->ipsec_ro_percpu); 576 m_freem(m); 577 return ENETUNREACH; 578 } 579 580 if (rt->rt_ifp == ifp) { 581 rtcache_unref(rt, &iro->ir_ro); 582 rtcache_free(&iro->ir_ro); 583 mutex_exit(iro->ir_lock); 584 percpu_putref(sc->ipsec_ro_percpu); 585 m_freem(m); 586 return ENETUNREACH; 587 } 588 rtcache_unref(rt, &iro->ir_ro); 589 590 /* 591 * force fragmentation to minimum MTU, to avoid path MTU discovery. 592 * it is too painful to ask for resend of inner packet, to achieve 593 * path MTU discovery for encapsulated packets. 594 */ 595 error = ip6_output(m, 0, &iro->ir_ro, 596 ip6_ipsec_pmtu ? 0 : IPV6_MINMTU, 0, NULL, NULL); 597 if (error) 598 rtcache_free(&iro->ir_ro); 599 600 mutex_exit(iro->ir_lock); 601 percpu_putref(sc->ipsec_ro_percpu); 602 603 return error; 604 } 605 #endif /* INET6 */ 606 607 static void 608 ipsecif4_input(struct mbuf *m, int off, int proto, void *eparg) 609 { 610 struct ifnet *ipsecp; 611 struct ipsec_softc *sc = eparg; 612 struct ipsec_variant *var; 613 const struct ip *ip; 614 int af; 615 #ifndef IPSEC_TX_TOS_CLEAR 616 u_int8_t otos; 617 #endif 618 struct psref psref_rcvif; 619 struct psref psref_var; 620 struct ifnet *rcvif; 621 622 KASSERT(sc != NULL); 623 624 ipsecp = &sc->ipsec_if; 625 if ((ipsecp->if_flags & IFF_UP) == 0) { 626 m_freem(m); 627 ip_statinc(IP_STAT_NOIPSEC); 628 return; 629 } 630 631 var = if_ipsec_getref_variant(sc, &psref_var); 632 if (if_ipsec_variant_is_unconfigured(var)) { 633 if_ipsec_putref_variant(var, &psref_var); 634 m_freem(m); 635 ip_statinc(IP_STAT_NOIPSEC); 636 return; 637 } 638 639 ip = mtod(m, const struct ip *); 640 641 rcvif = m_get_rcvif_psref(m, &psref_rcvif); 642 if (rcvif == NULL || !ipsecif4_filter4(ip, var, rcvif)) { 643 m_put_rcvif_psref(rcvif, &psref_rcvif); 644 if_ipsec_putref_variant(var, &psref_var); 645 m_freem(m); 646 ip_statinc(IP_STAT_NOIPSEC); 647 return; 648 } 649 m_put_rcvif_psref(rcvif, &psref_rcvif); 650 if_ipsec_putref_variant(var, &psref_var); 651 #ifndef IPSEC_TX_TOS_CLEAR 652 otos = ip->ip_tos; 653 #endif 654 m_adj(m, off); 655 656 switch (proto) { 657 case IPPROTO_IPV4: 658 { 659 struct ip *xip; 660 af = AF_INET; 661 if (M_UNWRITABLE(m, sizeof(*xip))) { 662 m = m_pullup(m, sizeof(*xip)); 663 if (m == NULL) 664 return; 665 } 666 xip = mtod(m, struct ip *); 667 #ifndef IPSEC_TX_TOS_CLEAR 668 if (ipsecp->if_flags & IFF_ECN) 669 ip_ecn_egress(ECN_ALLOWED, &otos, &xip->ip_tos); 670 else 671 ip_ecn_egress(ECN_NOCARE, &otos, &xip->ip_tos); 672 #endif 673 break; 674 } 675 #ifdef INET6 676 case IPPROTO_IPV6: 677 { 678 struct ip6_hdr *ip6; 679 u_int8_t itos; 680 af = AF_INET6; 681 if (M_UNWRITABLE(m, sizeof(*ip6))) { 682 m = m_pullup(m, sizeof(*ip6)); 683 if (m == NULL) 684 return; 685 } 686 ip6 = mtod(m, struct ip6_hdr *); 687 itos = (ntohl(ip6->ip6_flow) >> 20) & 0xff; 688 #ifndef IPSEC_TX_TOS_CLEAR 689 if (ipsecp->if_flags & IFF_ECN) 690 ip_ecn_egress(ECN_ALLOWED, &otos, &itos); 691 else 692 ip_ecn_egress(ECN_NOCARE, &otos, &itos); 693 #endif 694 ip6->ip6_flow &= ~htonl(0xff << 20); 695 ip6->ip6_flow |= htonl((u_int32_t)itos << 20); 696 break; 697 } 698 #endif /* INET6 */ 699 default: 700 ip_statinc(IP_STAT_NOIPSEC); 701 m_freem(m); 702 return; 703 } 704 if_ipsec_input(m, af, ipsecp); 705 706 return; 707 } 708 709 /* 710 * validate and filter the pakcet 711 */ 712 static int 713 ipsecif4_filter4(const struct ip *ip, struct ipsec_variant *var, 714 struct ifnet *ifp) 715 { 716 struct sockaddr_in *src, *dst; 717 718 src = satosin(var->iv_psrc); 719 dst = satosin(var->iv_pdst); 720 721 return in_tunnel_validate(ip, src->sin_addr, dst->sin_addr); 722 } 723 724 #ifdef INET6 725 static int 726 ipsecif6_input(struct mbuf **mp, int *offp, int proto, void *eparg) 727 { 728 struct mbuf *m = *mp; 729 struct ifnet *ipsecp; 730 struct ipsec_softc *sc = eparg; 731 struct ipsec_variant *var; 732 struct ip6_hdr *ip6; 733 int af = 0; 734 #ifndef IPSEC_TX_TOS_CLEAR 735 u_int32_t otos; 736 #endif 737 struct psref psref_rcvif; 738 struct psref psref_var; 739 struct ifnet *rcvif; 740 741 KASSERT(eparg != NULL); 742 743 ipsecp = &sc->ipsec_if; 744 if ((ipsecp->if_flags & IFF_UP) == 0) { 745 m_freem(m); 746 IP6_STATINC(IP6_STAT_NOIPSEC); 747 return IPPROTO_DONE; 748 } 749 750 var = if_ipsec_getref_variant(sc, &psref_var); 751 if (if_ipsec_variant_is_unconfigured(var)) { 752 if_ipsec_putref_variant(var, &psref_var); 753 m_freem(m); 754 IP6_STATINC(IP6_STAT_NOIPSEC); 755 return IPPROTO_DONE; 756 } 757 758 ip6 = mtod(m, struct ip6_hdr *); 759 760 rcvif = m_get_rcvif_psref(m, &psref_rcvif); 761 if (rcvif == NULL || !ipsecif6_filter6(ip6, var, rcvif)) { 762 m_put_rcvif_psref(rcvif, &psref_rcvif); 763 if_ipsec_putref_variant(var, &psref_var); 764 m_freem(m); 765 IP6_STATINC(IP6_STAT_NOIPSEC); 766 return IPPROTO_DONE; 767 } 768 m_put_rcvif_psref(rcvif, &psref_rcvif); 769 if_ipsec_putref_variant(var, &psref_var); 770 771 #ifndef IPSEC_TX_TOS_CLEAR 772 otos = ip6->ip6_flow; 773 #endif 774 m_adj(m, *offp); 775 776 switch (proto) { 777 #ifdef INET 778 case IPPROTO_IPV4: 779 { 780 af = AF_INET; 781 #ifndef IPSEC_TX_TOS_CLEAR 782 struct ip *ip; 783 u_int8_t otos8; 784 otos8 = (ntohl(otos) >> 20) & 0xff; 785 786 if (M_UNWRITABLE(m, sizeof(*ip))) { 787 m = m_pullup(m, sizeof(*ip)); 788 if (m == NULL) 789 return IPPROTO_DONE; 790 } 791 ip = mtod(m, struct ip *); 792 if (ipsecp->if_flags & IFF_ECN) 793 ip_ecn_egress(ECN_ALLOWED, &otos8, &ip->ip_tos); 794 else 795 ip_ecn_egress(ECN_NOCARE, &otos8, &ip->ip_tos); 796 #endif 797 break; 798 } 799 #endif /* INET */ 800 case IPPROTO_IPV6: 801 { 802 af = AF_INET6; 803 #ifndef IPSEC_TX_TOS_CLEAR 804 struct ip6_hdr *xip6; 805 806 if (M_UNWRITABLE(m, sizeof(*xip6))) { 807 m = m_pullup(m, sizeof(*xip6)); 808 if (m == NULL) 809 return IPPROTO_DONE; 810 } 811 xip6 = mtod(m, struct ip6_hdr *); 812 if (ipsecp->if_flags & IFF_ECN) 813 ip6_ecn_egress(ECN_ALLOWED, &otos, &xip6->ip6_flow); 814 else 815 ip6_ecn_egress(ECN_NOCARE, &otos, &xip6->ip6_flow); 816 break; 817 #endif 818 } 819 default: 820 IP6_STATINC(IP6_STAT_NOIPSEC); 821 m_freem(m); 822 return IPPROTO_DONE; 823 } 824 825 if_ipsec_input(m, af, ipsecp); 826 return IPPROTO_DONE; 827 } 828 829 /* 830 * validate and filter the packet. 831 */ 832 static int 833 ipsecif6_filter6(const struct ip6_hdr *ip6, struct ipsec_variant *var, 834 struct ifnet *ifp) 835 { 836 struct sockaddr_in6 *src, *dst; 837 838 src = satosin6(var->iv_psrc); 839 dst = satosin6(var->iv_pdst); 840 841 return in6_tunnel_validate(ip6, &src->sin6_addr, &dst->sin6_addr); 842 } 843 #endif /* INET6 */ 844 845 int 846 ipsecif4_attach(struct ipsec_variant *var) 847 { 848 struct ipsec_softc *sc = var->iv_softc; 849 850 KASSERT(if_ipsec_variant_is_configured(var)); 851 852 if (var->iv_encap_cookie4 != NULL) 853 return EALREADY; 854 var->iv_encap_cookie4 = encap_attach_func(AF_INET, -1, if_ipsec_encap_func, 855 &ipsecif4_encapsw, sc); 856 if (var->iv_encap_cookie4 == NULL) 857 return EEXIST; 858 859 var->iv_output = ipsecif4_output; 860 return 0; 861 } 862 863 int 864 ipsecif4_detach(struct ipsec_variant *var) 865 { 866 int error; 867 868 if (var->iv_encap_cookie4 == NULL) 869 return 0; 870 871 var->iv_output = NULL; 872 error = encap_detach(var->iv_encap_cookie4); 873 if (error == 0) 874 var->iv_encap_cookie4 = NULL; 875 876 return error; 877 } 878 879 #ifdef INET6 880 int 881 ipsecif6_attach(struct ipsec_variant *var) 882 { 883 struct sockaddr_in6 mask6; 884 struct ipsec_softc *sc = var->iv_softc; 885 886 KASSERT(if_ipsec_variant_is_configured(var)); 887 KASSERT(var->iv_encap_cookie6 == NULL); 888 889 memset(&mask6, 0, sizeof(mask6)); 890 mask6.sin6_len = sizeof(struct sockaddr_in6); 891 mask6.sin6_addr.s6_addr32[0] = mask6.sin6_addr.s6_addr32[1] = 892 mask6.sin6_addr.s6_addr32[2] = mask6.sin6_addr.s6_addr32[3] = ~0; 893 894 var->iv_encap_cookie6 = encap_attach_func(AF_INET6, -1, if_ipsec_encap_func, 895 &ipsecif6_encapsw, sc); 896 if (var->iv_encap_cookie6 == NULL) 897 return EEXIST; 898 899 var->iv_output = ipsecif6_output; 900 return 0; 901 } 902 903 static void 904 ipsecif6_rtcache_free_pc(void *p, void *arg __unused, struct cpu_info *ci __unused) 905 { 906 struct ipsec_ro *iro = p; 907 908 mutex_enter(iro->ir_lock); 909 rtcache_free(&iro->ir_ro); 910 mutex_exit(iro->ir_lock); 911 } 912 913 int 914 ipsecif6_detach(struct ipsec_variant *var) 915 { 916 struct ipsec_softc *sc = var->iv_softc; 917 int error; 918 919 KASSERT(var->iv_encap_cookie6 != NULL); 920 921 percpu_foreach(sc->ipsec_ro_percpu, ipsecif6_rtcache_free_pc, NULL); 922 923 var->iv_output = NULL; 924 error = encap_detach(var->iv_encap_cookie6); 925 if (error == 0) 926 var->iv_encap_cookie6 = NULL; 927 return error; 928 } 929 930 void * 931 ipsecif6_ctlinput(int cmd, const struct sockaddr *sa, void *d, void *eparg) 932 { 933 struct ipsec_softc *sc = eparg; 934 struct ip6ctlparam *ip6cp = NULL; 935 struct ip6_hdr *ip6; 936 const struct sockaddr_in6 *dst6; 937 struct ipsec_ro *iro; 938 939 if (sa->sa_family != AF_INET6 || 940 sa->sa_len != sizeof(struct sockaddr_in6)) 941 return NULL; 942 943 if ((unsigned)cmd >= PRC_NCMDS) 944 return NULL; 945 if (cmd == PRC_HOSTDEAD) 946 d = NULL; 947 else if (inet6ctlerrmap[cmd] == 0) 948 return NULL; 949 950 /* if the parameter is from icmp6, decode it. */ 951 if (d != NULL) { 952 ip6cp = (struct ip6ctlparam *)d; 953 ip6 = ip6cp->ip6c_ip6; 954 } else { 955 ip6 = NULL; 956 } 957 958 if (!ip6) 959 return NULL; 960 961 iro = percpu_getref(sc->ipsec_ro_percpu); 962 mutex_enter(iro->ir_lock); 963 dst6 = satocsin6(rtcache_getdst(&iro->ir_ro)); 964 /* XXX scope */ 965 if (dst6 == NULL) 966 ; 967 else if (IN6_ARE_ADDR_EQUAL(&ip6->ip6_dst, &dst6->sin6_addr)) 968 /* flush route cache */ 969 rtcache_free(&iro->ir_ro); 970 971 mutex_exit(iro->ir_lock); 972 percpu_putref(sc->ipsec_ro_percpu); 973 974 return NULL; 975 } 976 977 ENCAP_PR_WRAP_CTLINPUT(ipsecif6_ctlinput) 978 #define ipsecif6_ctlinput ipsecif6_ctlinput_wrapper 979 980 static const struct encapsw ipsecif6_encapsw = { 981 .encapsw6 = { 982 .pr_input = ipsecif6_input, 983 .pr_ctlinput = ipsecif6_ctlinput, 984 } 985 }; 986 #endif /* INET6 */ 987
Indexes created Tue Sep 23 02:09:52 GMT 2025