xform_ipip.c revision 1.73
1 /* $NetBSD: xform_ipip.c,v 1.73 2018/05/07 09:25:04 maxv Exp $ */ 2 /* $FreeBSD: xform_ipip.c,v 1.3.2.1 2003/01/24 05:11:36 sam Exp $ */ 3 /* $OpenBSD: ip_ipip.c,v 1.25 2002/06/10 18:04:55 itojun Exp $ */ 4 5 /* 6 * The authors of this code are John Ioannidis (ji (at) tla.org), 7 * Angelos D. Keromytis (kermit (at) csd.uch.gr) and 8 * Niels Provos (provos (at) physnet.uni-hamburg.de). 9 * 10 * The original version of this code was written by John Ioannidis 11 * for BSD/OS in Athens, Greece, in November 1995. 12 * 13 * Ported to OpenBSD and NetBSD, with additional transforms, in December 1996, 14 * by Angelos D. Keromytis. 15 * 16 * Additional transforms and features in 1997 and 1998 by Angelos D. Keromytis 17 * and Niels Provos. 18 * 19 * Additional features in 1999 by Angelos D. Keromytis. 20 * 21 * Copyright (C) 1995, 1996, 1997, 1998, 1999 by John Ioannidis, 22 * Angelos D. Keromytis and Niels Provos. 23 * Copyright (c) 2001, Angelos D. Keromytis. 24 * 25 * Permission to use, copy, and modify this software with or without fee 26 * is hereby granted, provided that this entire notice is included in 27 * all copies of any software which is or includes a copy or 28 * modification of this software. 29 * You may use this code under the GNU public license if you so wish. Please 30 * contribute changes back to the authors under this freer than GPL license 31 * so that we may further the use of strong encryption without limitations to 32 * all. 33 * 34 * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR 35 * IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY 36 * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE 37 * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR 38 * PURPOSE. 39 */ 40 41 #include <sys/cdefs.h> 42 __KERNEL_RCSID(0, "$NetBSD: xform_ipip.c,v 1.73 2018/05/07 09:25:04 maxv Exp $"); 43 44 /* 45 * IP-inside-IP processing 46 */ 47 #if defined(_KERNEL_OPT) 48 #include "opt_inet.h" 49 #endif 50 51 #include <sys/param.h> 52 #include <sys/systm.h> 53 #include <sys/mbuf.h> 54 #include <sys/socket.h> 55 #include <sys/kernel.h> 56 #include <sys/protosw.h> 57 #include <sys/sysctl.h> 58 59 #include <net/if.h> 60 #include <net/route.h> 61 #include <net/netisr.h> 62 63 #include <netinet/in.h> 64 #include <netinet/in_systm.h> 65 #include <netinet/in_var.h> 66 #include <netinet/ip.h> 67 #include <netinet/ip_ecn.h> 68 #include <netinet/ip_var.h> 69 #include <netinet/ip_encap.h> 70 71 #include <netipsec/ipsec.h> 72 #include <netipsec/ipsec_private.h> 73 #include <netipsec/xform.h> 74 75 #include <netipsec/ipip_var.h> 76 77 #ifdef INET6 78 #include <netinet/ip6.h> 79 #include <netipsec/ipsec6.h> 80 #include <netinet6/in6_var.h> 81 #include <netinet6/ip6protosw.h> 82 #endif 83 84 #include <netipsec/key.h> 85 #include <netipsec/key_debug.h> 86 87 /* XXX IPCOMP */ 88 #define M_IPSEC (M_AUTHIPHDR|M_DECRYPTED) 89 90 int ipip_spoofcheck = 1; 91 percpu_t *ipipstat_percpu; 92 93 static void _ipip_input(struct mbuf *, int); 94 95 #ifdef INET6 96 static int 97 ip4_input6(struct mbuf **m, int *offp, int proto, void *eparg __unused) 98 { 99 _ipip_input(*m, *offp); 100 return IPPROTO_DONE; 101 } 102 #endif 103 104 #ifdef INET 105 static void 106 ip4_input(struct mbuf *m, int off, int proto, void *eparg __unused) 107 { 108 _ipip_input(m, off); 109 } 110 #endif 111 112 /* 113 * _ipip_input gets called when we receive an IP{46} encapsulated packet, 114 * because AH or ESP were being used in tunnel mode. 115 */ 116 static void 117 _ipip_input(struct mbuf *m, int iphlen) 118 { 119 register struct sockaddr_in *sin; 120 register struct ifnet *ifp; 121 register struct ifaddr *ifa; 122 pktqueue_t *pktq = NULL; 123 struct ip *ip4 = NULL; 124 #ifdef INET6 125 register struct sockaddr_in6 *sin6; 126 struct ip6_hdr *ip6 = NULL; 127 uint8_t itos; 128 #endif 129 uint8_t otos; 130 uint8_t v; 131 int hlen; 132 133 IPIP_STATINC(IPIP_STAT_IPACKETS); 134 135 m_copydata(m, 0, 1, &v); 136 137 switch (v >> 4) { 138 #ifdef INET 139 case 4: 140 hlen = sizeof(struct ip); 141 break; 142 #endif 143 #ifdef INET6 144 case 6: 145 hlen = sizeof(struct ip6_hdr); 146 break; 147 #endif 148 default: 149 DPRINTF(("%s: bad protocol version 0x%x (%u) " 150 "for outer header\n", __func__, v, v>>4)); 151 IPIP_STATINC(IPIP_STAT_FAMILY); 152 m_freem(m); 153 return; 154 } 155 156 /* Bring the IP header in the first mbuf, if not there already */ 157 if (m->m_len < hlen) { 158 if ((m = m_pullup(m, hlen)) == NULL) { 159 DPRINTF(("%s: m_pullup (1) failed\n", __func__)); 160 IPIP_STATINC(IPIP_STAT_HDROPS); 161 return; 162 } 163 } 164 165 /* Keep outer ecn field. */ 166 switch (v >> 4) { 167 #ifdef INET 168 case 4: 169 otos = mtod(m, struct ip *)->ip_tos; 170 break; 171 #endif 172 #ifdef INET6 173 case 6: 174 otos = (ntohl(mtod(m, struct ip6_hdr *)->ip6_flow) >> 20) & 0xff; 175 break; 176 #endif 177 default: 178 panic("%s: impossible (1)", __func__); 179 } 180 181 /* Remove outer IP header */ 182 m_adj(m, iphlen); 183 184 /* Sanity check */ 185 if (m->m_pkthdr.len < sizeof(struct ip)) { 186 IPIP_STATINC(IPIP_STAT_HDROPS); 187 m_freem(m); 188 return; 189 } 190 191 m_copydata(m, 0, 1, &v); 192 193 switch (v >> 4) { 194 #ifdef INET 195 case 4: 196 hlen = sizeof(struct ip); 197 pktq = ip_pktq; 198 break; 199 #endif 200 #ifdef INET6 201 case 6: 202 hlen = sizeof(struct ip6_hdr); 203 pktq = ip6_pktq; 204 break; 205 #endif 206 default: 207 DPRINTF(("%s: bad protocol version %#x (%u) " 208 "for inner header\n", __func__, v, v >> 4)); 209 IPIP_STATINC(IPIP_STAT_FAMILY); 210 m_freem(m); 211 return; 212 } 213 214 /* 215 * Bring the inner IP header in the first mbuf, if not there already. 216 */ 217 if (m->m_len < hlen) { 218 if ((m = m_pullup(m, hlen)) == NULL) { 219 DPRINTF(("%s: m_pullup (2) failed\n", __func__)); 220 IPIP_STATINC(IPIP_STAT_HDROPS); 221 return; 222 } 223 } 224 225 /* 226 * RFC 1853 specifies that the inner TTL should not be touched on 227 * decapsulation. There's no reason this comment should be here, but 228 * this is as good as any a position. 229 */ 230 231 /* Some sanity checks in the inner IP header */ 232 switch (v >> 4) { 233 #ifdef INET 234 case 4: 235 ip4 = mtod(m, struct ip *); 236 ip_ecn_egress(ip4_ipsec_ecn, &otos, &ip4->ip_tos); 237 break; 238 #endif 239 #ifdef INET6 240 case 6: 241 ip6 = mtod(m, struct ip6_hdr *); 242 itos = (ntohl(ip6->ip6_flow) >> 20) & 0xff; 243 ip_ecn_egress(ip6_ipsec_ecn, &otos, &itos); 244 ip6->ip6_flow &= ~htonl(0xff << 20); 245 ip6->ip6_flow |= htonl((uint32_t)itos << 20); 246 break; 247 #endif 248 default: 249 panic("%s: impossible (2)", __func__); 250 } 251 252 /* Check for local address spoofing. */ 253 if ((m_get_rcvif_NOMPSAFE(m) == NULL || 254 !(m_get_rcvif_NOMPSAFE(m)->if_flags & IFF_LOOPBACK)) && 255 ipip_spoofcheck) { 256 int s = pserialize_read_enter(); 257 IFNET_READER_FOREACH(ifp) { 258 IFADDR_READER_FOREACH(ifa, ifp) { 259 #ifdef INET 260 if (ip4) { 261 if (ifa->ifa_addr->sa_family != 262 AF_INET) 263 continue; 264 265 sin = (struct sockaddr_in *)ifa->ifa_addr; 266 267 if (sin->sin_addr.s_addr == 268 ip4->ip_src.s_addr) { 269 pserialize_read_exit(s); 270 IPIP_STATINC(IPIP_STAT_SPOOF); 271 m_freem(m); 272 return; 273 } 274 } 275 #endif 276 277 #ifdef INET6 278 if (ip6) { 279 if (ifa->ifa_addr->sa_family != 280 AF_INET6) 281 continue; 282 283 sin6 = (struct sockaddr_in6 *)ifa->ifa_addr; 284 285 if (IN6_ARE_ADDR_EQUAL(&sin6->sin6_addr, &ip6->ip6_src)) { 286 pserialize_read_exit(s); 287 IPIP_STATINC(IPIP_STAT_SPOOF); 288 m_freem(m); 289 return; 290 } 291 292 } 293 #endif 294 } 295 } 296 pserialize_read_exit(s); 297 } 298 299 /* Statistics: m->m_pkthdr.len is the length of the inner packet */ 300 IPIP_STATADD(IPIP_STAT_IBYTES, m->m_pkthdr.len); 301 302 /* 303 * Interface pointer stays the same; if no IPsec processing has 304 * been done (or will be done), this will point to a normal 305 * interface. Otherwise, it'll point to an enc interface, which 306 * will allow a packet filter to distinguish between secure and 307 * untrusted packets. 308 */ 309 310 int s = splnet(); 311 if (__predict_false(!pktq_enqueue(pktq, m, 0))) { 312 IPIP_STATINC(IPIP_STAT_QFULL); 313 m_freem(m); 314 } 315 splx(s); 316 } 317 318 int 319 ipip_output(struct mbuf *m, struct secasvar *sav, struct mbuf **mp) 320 { 321 char buf[IPSEC_ADDRSTRLEN]; 322 uint8_t tp, otos; 323 struct secasindex *saidx; 324 int error, iphlen; 325 #ifdef INET 326 uint8_t itos; 327 struct ip *ipo; 328 #endif 329 #ifdef INET6 330 struct ip6_hdr *ip6, *ip6o; 331 #endif 332 333 KASSERT(sav != NULL); 334 335 /* XXX Deal with empty TDB source/destination addresses. */ 336 337 m_copydata(m, 0, 1, &tp); 338 tp = (tp >> 4) & 0xff; /* Get the IP version number. */ 339 340 saidx = &sav->sah->saidx; 341 switch (saidx->dst.sa.sa_family) { 342 #ifdef INET 343 case AF_INET: 344 if (saidx->src.sa.sa_family != AF_INET || 345 saidx->src.sin.sin_addr.s_addr == INADDR_ANY || 346 saidx->dst.sin.sin_addr.s_addr == INADDR_ANY) { 347 DPRINTF(("%s: unspecified tunnel endpoint " 348 "address in SA %s/%08lx\n", __func__, 349 ipsec_address(&saidx->dst, buf, sizeof(buf)), 350 (u_long)ntohl(sav->spi))); 351 IPIP_STATINC(IPIP_STAT_UNSPEC); 352 error = EINVAL; 353 goto bad; 354 } 355 356 M_PREPEND(m, sizeof(struct ip), M_DONTWAIT); 357 if (m == NULL) { 358 DPRINTF(("%s: M_PREPEND failed\n", __func__)); 359 IPIP_STATINC(IPIP_STAT_HDROPS); 360 error = ENOBUFS; 361 goto bad; 362 } 363 364 iphlen = sizeof(struct ip); 365 366 ipo = mtod(m, struct ip *); 367 ipo->ip_v = IPVERSION; 368 ipo->ip_hl = 5; 369 ipo->ip_len = htons(m->m_pkthdr.len); 370 ipo->ip_ttl = ip_defttl; 371 ipo->ip_sum = 0; 372 ipo->ip_src = saidx->src.sin.sin_addr; 373 ipo->ip_dst = saidx->dst.sin.sin_addr; 374 ipo->ip_id = ip_newid(NULL); 375 376 /* If the inner protocol is IP... */ 377 if (tp == IPVERSION) { 378 /* Save ECN notification */ 379 m_copydata(m, sizeof(struct ip) + 380 offsetof(struct ip, ip_tos), 381 sizeof(uint8_t), &itos); 382 383 ipo->ip_p = IPPROTO_IPIP; 384 385 /* 386 * We should be keeping tunnel soft-state and 387 * send back ICMPs if needed. 388 */ 389 m_copydata(m, sizeof(struct ip) + 390 offsetof(struct ip, ip_off), 391 sizeof(uint16_t), &ipo->ip_off); 392 ipo->ip_off &= ~ htons(IP_DF | IP_MF | IP_OFFMASK); 393 } 394 #ifdef INET6 395 else if (tp == (IPV6_VERSION >> 4)) { 396 uint32_t itos32; 397 398 /* Save ECN notification. */ 399 m_copydata(m, sizeof(struct ip) + 400 offsetof(struct ip6_hdr, ip6_flow), 401 sizeof(uint32_t), &itos32); 402 itos = ntohl(itos32) >> 20; 403 ipo->ip_p = IPPROTO_IPV6; 404 ipo->ip_off = 0; 405 } 406 #endif 407 else { 408 goto nofamily; 409 } 410 411 otos = 0; 412 ip_ecn_ingress(ECN_ALLOWED, &otos, &itos); 413 ipo->ip_tos = otos; 414 break; 415 #endif /* INET */ 416 417 #ifdef INET6 418 case AF_INET6: 419 if (IN6_IS_ADDR_UNSPECIFIED(&saidx->dst.sin6.sin6_addr) || 420 saidx->src.sa.sa_family != AF_INET6 || 421 IN6_IS_ADDR_UNSPECIFIED(&saidx->src.sin6.sin6_addr)) { 422 DPRINTF(("%s: unspecified tunnel endpoint " 423 "address in SA %s/%08lx\n", __func__, 424 ipsec_address(&saidx->dst, buf, sizeof(buf)), 425 (u_long)ntohl(sav->spi))); 426 IPIP_STATINC(IPIP_STAT_UNSPEC); 427 error = ENOBUFS; 428 goto bad; 429 } 430 431 if (tp == (IPV6_VERSION >> 4)) { 432 /* scoped address handling */ 433 ip6 = mtod(m, struct ip6_hdr *); 434 if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_src)) 435 ip6->ip6_src.s6_addr16[1] = 0; 436 if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_dst)) 437 ip6->ip6_dst.s6_addr16[1] = 0; 438 } 439 440 M_PREPEND(m, sizeof(struct ip6_hdr), M_DONTWAIT); 441 if (m == NULL) { 442 DPRINTF(("%s: M_PREPEND failed\n", __func__)); 443 IPIP_STATINC(IPIP_STAT_HDROPS); 444 error = ENOBUFS; 445 goto bad; 446 } 447 448 iphlen = sizeof(struct ip6_hdr); 449 450 /* Initialize IPv6 header */ 451 ip6o = mtod(m, struct ip6_hdr *); 452 ip6o->ip6_flow = 0; 453 ip6o->ip6_vfc &= ~IPV6_VERSION_MASK; 454 ip6o->ip6_vfc |= IPV6_VERSION; 455 ip6o->ip6_plen = htons(m->m_pkthdr.len - sizeof(*ip6o)); 456 ip6o->ip6_hlim = ip_defttl; 457 ip6o->ip6_dst = saidx->dst.sin6.sin6_addr; 458 ip6o->ip6_src = saidx->src.sin6.sin6_addr; 459 if (IN6_IS_SCOPE_LINKLOCAL(&ip6o->ip6_dst)) 460 ip6o->ip6_dst.s6_addr16[1] = htons(saidx->dst.sin6.sin6_scope_id); 461 if (IN6_IS_SCOPE_LINKLOCAL(&ip6o->ip6_src)) 462 ip6o->ip6_src.s6_addr16[1] = htons(saidx->src.sin6.sin6_scope_id); 463 464 #ifdef INET 465 if (tp == IPVERSION) { 466 /* Save ECN notification */ 467 m_copydata(m, sizeof(struct ip6_hdr) + 468 offsetof(struct ip, ip_tos), sizeof(uint8_t), 469 &itos); 470 471 /* This is really IPVERSION. */ 472 ip6o->ip6_nxt = IPPROTO_IPIP; 473 } else 474 #endif 475 if (tp == (IPV6_VERSION >> 4)) { 476 uint32_t itos32; 477 478 /* Save ECN notification. */ 479 m_copydata(m, sizeof(struct ip6_hdr) + 480 offsetof(struct ip6_hdr, ip6_flow), 481 sizeof(uint32_t), &itos32); 482 itos = ntohl(itos32) >> 20; 483 484 ip6o->ip6_nxt = IPPROTO_IPV6; 485 } else { 486 goto nofamily; 487 } 488 489 otos = 0; 490 ip_ecn_ingress(ECN_ALLOWED, &otos, &itos); 491 ip6o->ip6_flow |= htonl((uint32_t)otos << 20); 492 break; 493 #endif /* INET6 */ 494 495 default: 496 nofamily: 497 DPRINTF(("%s: unsupported protocol family %u\n", __func__, 498 saidx->dst.sa.sa_family)); 499 IPIP_STATINC(IPIP_STAT_FAMILY); 500 error = EAFNOSUPPORT; 501 goto bad; 502 } 503 504 IPIP_STATINC(IPIP_STAT_OPACKETS); 505 IPIP_STATADD(IPIP_STAT_OBYTES, m->m_pkthdr.len - iphlen); 506 507 *mp = m; 508 return 0; 509 510 bad: 511 if (m) 512 m_freem(m); 513 *mp = NULL; 514 return error; 515 } 516 517 #ifdef INET 518 static struct encapsw ipe4_encapsw = { 519 .encapsw4 = { 520 .pr_input = ip4_input, 521 .pr_ctlinput = NULL, 522 } 523 }; 524 #endif 525 #ifdef INET6 526 static struct encapsw ipe4_encapsw6 = { 527 .encapsw6 = { 528 .pr_input = ip4_input6, 529 .pr_ctlinput = NULL, 530 } 531 }; 532 #endif 533 534 /* 535 * Check the encapsulated packet to see if we want it 536 */ 537 static int 538 ipe4_encapcheck(struct mbuf *m, int off, int proto, void *arg) 539 { 540 /* 541 * Only take packets coming from IPSEC tunnels; the rest 542 * must be handled by the gif tunnel code. Note that we 543 * also return a minimum priority when we want the packet 544 * so any explicit gif tunnels take precedence. 545 */ 546 return ((m->m_flags & M_IPSEC) != 0 ? 1 : 0); 547 } 548 549 /* -------------------------------------------------------------------------- */ 550 551 static int 552 ipe4_init(struct secasvar *sav, const struct xformsw *xsp) 553 { 554 sav->tdb_xform = xsp; 555 return 0; 556 } 557 558 static int 559 ipe4_zeroize(struct secasvar *sav) 560 { 561 sav->tdb_xform = NULL; 562 return 0; 563 } 564 565 static int 566 ipe4_input(struct mbuf *m, struct secasvar *sav, int skip, int protoff) 567 { 568 /* This is a rather serious mistake, so no conditional printing. */ 569 printf("%s: should never be called\n", __func__); 570 if (m) 571 m_freem(m); 572 return EOPNOTSUPP; 573 } 574 575 static int 576 ipe4_output(struct mbuf *m, const struct ipsecrequest *isr, 577 struct secasvar *sav, int skip, int protoff) 578 { 579 panic("%s: should not have been called", __func__); 580 } 581 582 static struct xformsw ipe4_xformsw = { 583 .xf_type = XF_IP4, 584 .xf_flags = 0, 585 .xf_name = "IPv4 Simple Encapsulation", 586 .xf_init = ipe4_init, 587 .xf_zeroize = ipe4_zeroize, 588 .xf_input = ipe4_input, 589 .xf_output = ipe4_output, 590 .xf_next = NULL, 591 }; 592 593 /* -------------------------------------------------------------------------- */ 594 595 void 596 ipe4_attach(void) 597 { 598 599 ipipstat_percpu = percpu_alloc(sizeof(uint64_t) * IPIP_NSTATS); 600 601 xform_register(&ipe4_xformsw); 602 /* attach to encapsulation framework */ 603 /* XXX save return cookie for detach on module remove */ 604 605 encapinit(); 606 /* This function is called before ifinit(). Who else gets lock? */ 607 (void)encap_lock_enter(); 608 /* ipe4_encapsw and ipe4_encapsw must be added atomically */ 609 #ifdef INET 610 (void)encap_attach_func(AF_INET, -1, ipe4_encapcheck, &ipe4_encapsw, 611 NULL); 612 #endif 613 #ifdef INET6 614 (void)encap_attach_func(AF_INET6, -1, ipe4_encapcheck, &ipe4_encapsw6, 615 NULL); 616 #endif 617 encap_lock_exit(); 618 } 619
Indexes created Mon Sep 22 10:09:38 GMT 2025