1 /*-
2 * SPDX-License-Identifier: BSD-2-Clause
3 *
4 * Copyright (c) 2006 The FreeBSD Project.
5 * Copyright (c) 2015 Andrey V. Elsukov <ae@FreeBSD.org>
6 * All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 * 2. Redistributions in binary form must reproduce the above copyright
15 * notice, this list of conditions and the following disclaimer in the
16 * documentation and/or other materials provided with the distribution.
17 *
18 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
19 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
20 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
21 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
22 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
23 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
24 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
25 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
26 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
27 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
28 * SUCH DAMAGE.
29 */
30
31 #include "opt_inet.h"
32 #include "opt_inet6.h"
33 #include "opt_ipsec.h"
34
35 #include <sys/param.h>
36 #include <sys/systm.h>
37 #include <sys/hhook.h>
38 #include <sys/kernel.h>
39 #include <sys/malloc.h>
40 #include <sys/mbuf.h>
41 #include <sys/module.h>
42 #include <machine/bus.h>
43 #include <sys/rman.h>
44 #include <sys/socket.h>
45 #include <sys/sockio.h>
46 #include <sys/sysctl.h>
47
48 #include <net/if.h>
49 #include <net/if_enc.h>
50 #include <net/if_var.h>
51 #include <net/if_private.h>
52 #include <net/if_clone.h>
53 #include <net/if_types.h>
54 #include <net/pfil.h>
55 #include <net/route.h>
56 #include <net/netisr.h>
57 #include <net/bpf.h>
58 #include <net/vnet.h>
59
60 #include <netinet/in.h>
61 #include <netinet/in_systm.h>
62 #include <netinet/ip.h>
63 #include <netinet/ip_var.h>
64 #include <netinet/in_var.h>
65
66 #ifdef INET6
67 #include <netinet/ip6.h>
68 #include <netinet6/ip6_var.h>
69 #endif
70
71 #include <netipsec/ipsec.h>
72 #include <netipsec/xform.h>
73
74 #define ENCMTU (1024+512)
75
76 /* XXX this define must have the same value as in OpenBSD */
77 #define M_CONF 0x0400 /* payload was encrypted (ESP-transport) */
78 #define M_AUTH 0x0800 /* payload was authenticated (AH or ESP auth) */
79 #define M_AUTH_AH 0x2000 /* header was authenticated (AH) */
80
81 struct enchdr {
82 u_int32_t af;
83 u_int32_t spi;
84 u_int32_t flags;
85 };
86 struct enc_softc {
87 struct ifnet *sc_ifp;
88 };
89 VNET_DEFINE_STATIC(struct enc_softc *, enc_sc);
90 #define V_enc_sc VNET(enc_sc)
91 VNET_DEFINE_STATIC(struct if_clone *, enc_cloner);
92 #define V_enc_cloner VNET(enc_cloner)
93
94 static int enc_ioctl(struct ifnet *, u_long, caddr_t);
95 static int enc_output(struct ifnet *, struct mbuf *,
96 const struct sockaddr *, struct route *);
97 static int enc_clone_create(struct if_clone *, char *, size_t,
98 struct ifc_data *, struct ifnet **);
99 static int enc_clone_destroy(struct if_clone *, struct ifnet *, uint32_t);
100 static void enc_add_hhooks(struct enc_softc *);
101 static void enc_remove_hhooks(struct enc_softc *);
102
103 static const char encname[] = "enc";
104
105 #define IPSEC_ENC_AFTER_PFIL 0x04
106 /*
107 * Before and after are relative to when we are stripping the
108 * outer IP header.
109 *
110 * AFTER_PFIL flag used only for bpf_mask_*. It enables BPF capturing
111 * after PFIL hook execution. It might be useful when PFIL hook does
112 * some changes to the packet, e.g. address translation. If PFIL hook
113 * consumes mbuf, nothing will be captured.
114 */
115 VNET_DEFINE_STATIC(int, filter_mask_in) = IPSEC_ENC_BEFORE;
116 VNET_DEFINE_STATIC(int, bpf_mask_in) = IPSEC_ENC_BEFORE;
117 VNET_DEFINE_STATIC(int, filter_mask_out) = IPSEC_ENC_BEFORE;
118 VNET_DEFINE_STATIC(int, bpf_mask_out) = IPSEC_ENC_BEFORE | IPSEC_ENC_AFTER;
119 #define V_filter_mask_in VNET(filter_mask_in)
120 #define V_bpf_mask_in VNET(bpf_mask_in)
121 #define V_filter_mask_out VNET(filter_mask_out)
122 #define V_bpf_mask_out VNET(bpf_mask_out)
123
124 static SYSCTL_NODE(_net, OID_AUTO, enc, CTLFLAG_RW | CTLFLAG_MPSAFE, 0,
125 "enc sysctl");
126 static SYSCTL_NODE(_net_enc, OID_AUTO, in, CTLFLAG_RW | CTLFLAG_MPSAFE, 0,
127 "enc input sysctl");
128 static SYSCTL_NODE(_net_enc, OID_AUTO, out, CTLFLAG_RW | CTLFLAG_MPSAFE, 0,
129 "enc output sysctl");
130 SYSCTL_INT(_net_enc_in, OID_AUTO, ipsec_filter_mask,
131 CTLFLAG_RW | CTLFLAG_VNET, &VNET_NAME(filter_mask_in), 0,
132 "IPsec input firewall filter mask");
133 SYSCTL_INT(_net_enc_in, OID_AUTO, ipsec_bpf_mask,
134 CTLFLAG_RW | CTLFLAG_VNET, &VNET_NAME(bpf_mask_in), 0,
135 "IPsec input bpf mask");
136 SYSCTL_INT(_net_enc_out, OID_AUTO, ipsec_filter_mask,
137 CTLFLAG_RW | CTLFLAG_VNET, &VNET_NAME(filter_mask_out), 0,
138 "IPsec output firewall filter mask");
139 SYSCTL_INT(_net_enc_out, OID_AUTO, ipsec_bpf_mask,
140 CTLFLAG_RW | CTLFLAG_VNET, &VNET_NAME(bpf_mask_out), 0,
141 "IPsec output bpf mask");
142
143 static int
enc_clone_destroy(struct if_clone * ifc,struct ifnet * ifp,uint32_t flags)144 enc_clone_destroy(struct if_clone *ifc, struct ifnet *ifp, uint32_t flags)
145 {
146 struct enc_softc *sc;
147
148 if (ifp->if_dunit == 0 && (flags & IFC_F_FORCE) == 0)
149 return (EINVAL);
150
151 sc = ifp->if_softc;
152 KASSERT(sc == V_enc_sc, ("sc != ifp->if_softc"));
153
154 bpfdetach(ifp);
155 if_detach(ifp);
156 if_free(ifp);
157 free(sc, M_DEVBUF);
158 return (0);
159 }
160
161 static int
enc_clone_create(struct if_clone * ifc,char * name,size_t len,struct ifc_data * ifd,struct ifnet ** ifpp)162 enc_clone_create(struct if_clone *ifc, char *name, size_t len,
163 struct ifc_data *ifd, struct ifnet **ifpp)
164 {
165 struct ifnet *ifp;
166 struct enc_softc *sc;
167
168 sc = malloc(sizeof(struct enc_softc), M_DEVBUF, M_WAITOK | M_ZERO);
169 ifp = sc->sc_ifp = if_alloc(IFT_ENC);
170 if_initname(ifp, encname, ifd->unit);
171 ifp->if_mtu = ENCMTU;
172 ifp->if_ioctl = enc_ioctl;
173 ifp->if_output = enc_output;
174 ifp->if_softc = sc;
175 if_attach(ifp);
176 bpfattach(ifp, DLT_ENC, sizeof(struct enchdr));
177 *ifpp = ifp;
178 return (0);
179 }
180
181 static int
enc_output(struct ifnet * ifp,struct mbuf * m,const struct sockaddr * dst,struct route * ro)182 enc_output(struct ifnet *ifp, struct mbuf *m, const struct sockaddr *dst,
183 struct route *ro)
184 {
185
186 m_freem(m);
187 return (0);
188 }
189
190 static int
enc_ioctl(struct ifnet * ifp,u_long cmd,caddr_t data)191 enc_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
192 {
193
194 if (cmd != SIOCSIFFLAGS)
195 return (EINVAL);
196 if (ifp->if_flags & IFF_UP)
197 ifp->if_drv_flags |= IFF_DRV_RUNNING;
198 else
199 ifp->if_drv_flags &= ~IFF_DRV_RUNNING;
200 return (0);
201 }
202
203 static void
enc_bpftap(struct ifnet * ifp,struct mbuf * m,const struct secasvar * sav,int32_t hhook_type,uint8_t enc,uint8_t af)204 enc_bpftap(struct ifnet *ifp, struct mbuf *m, const struct secasvar *sav,
205 int32_t hhook_type, uint8_t enc, uint8_t af)
206 {
207 struct enchdr hdr;
208
209 if (hhook_type == HHOOK_TYPE_IPSEC_IN &&
210 (enc & V_bpf_mask_in) == 0)
211 return;
212 else if (hhook_type == HHOOK_TYPE_IPSEC_OUT &&
213 (enc & V_bpf_mask_out) == 0)
214 return;
215 if (!bpf_peers_present(ifp->if_bpf))
216 return;
217 hdr.af = af;
218 hdr.spi = sav->spi;
219 hdr.flags = 0;
220 if (sav->alg_enc != SADB_EALG_NONE)
221 hdr.flags |= M_CONF;
222 if (sav->alg_auth != SADB_AALG_NONE)
223 hdr.flags |= M_AUTH;
224 bpf_mtap2(ifp->if_bpf, &hdr, sizeof(hdr), m);
225 }
226
227 /*
228 * One helper hook function is used by any hook points.
229 * + from hhook_type we can determine the packet direction:
230 * HHOOK_TYPE_IPSEC_IN or HHOOK_TYPE_IPSEC_OUT;
231 * + from hhook_id we can determine address family: AF_INET or AF_INET6;
232 * + udata contains pointer to enc_softc;
233 * + ctx_data contains pointer to struct ipsec_ctx_data.
234 */
235 static int
enc_hhook(int32_t hhook_type,int32_t hhook_id,void * udata,void * ctx_data,void * hdata,struct osd * hosd)236 enc_hhook(int32_t hhook_type, int32_t hhook_id, void *udata, void *ctx_data,
237 void *hdata, struct osd *hosd)
238 {
239 struct ipsec_ctx_data *ctx;
240 struct enc_softc *sc;
241 struct ifnet *ifp, *rcvif;
242 struct pfil_head *ph;
243 int pdir, ret;
244
245 sc = (struct enc_softc *)udata;
246 ifp = sc->sc_ifp;
247 if ((ifp->if_flags & IFF_UP) == 0)
248 return (0);
249
250 ctx = (struct ipsec_ctx_data *)ctx_data;
251 /* XXX: wrong hook point was used by caller? */
252 if (ctx->af != hhook_id)
253 return (EPFNOSUPPORT);
254
255 enc_bpftap(ifp, *ctx->mp, ctx->sav, hhook_type, ctx->enc, ctx->af);
256 switch (hhook_type) {
257 case HHOOK_TYPE_IPSEC_IN:
258 if (ctx->enc == IPSEC_ENC_BEFORE) {
259 /* Do accounting only once */
260 if_inc_counter(ifp, IFCOUNTER_IPACKETS, 1);
261 if_inc_counter(ifp, IFCOUNTER_IBYTES,
262 (*ctx->mp)->m_pkthdr.len);
263 }
264 if ((ctx->enc & V_filter_mask_in) == 0)
265 return (0); /* skip pfil processing */
266 pdir = PFIL_IN;
267 break;
268 case HHOOK_TYPE_IPSEC_OUT:
269 if (ctx->enc == IPSEC_ENC_BEFORE) {
270 /* Do accounting only once */
271 if_inc_counter(ifp, IFCOUNTER_OPACKETS, 1);
272 if_inc_counter(ifp, IFCOUNTER_OBYTES,
273 (*ctx->mp)->m_pkthdr.len);
274 }
275 if ((ctx->enc & V_filter_mask_out) == 0)
276 return (0); /* skip pfil processing */
277 pdir = PFIL_OUT;
278 break;
279 default:
280 return (EINVAL);
281 }
282
283 switch (hhook_id) {
284 #ifdef INET
285 case AF_INET:
286 ph = V_inet_pfil_head;
287 break;
288 #endif
289 #ifdef INET6
290 case AF_INET6:
291 ph = V_inet6_pfil_head;
292 break;
293 #endif
294 default:
295 ph = NULL;
296 }
297 if (ph == NULL || (pdir == PFIL_OUT && !PFIL_HOOKED_OUT(ph)) ||
298 (pdir == PFIL_IN && !PFIL_HOOKED_IN(ph)))
299 return (0);
300 /* Make a packet looks like it was received on enc(4) */
301 rcvif = (*ctx->mp)->m_pkthdr.rcvif;
302 (*ctx->mp)->m_pkthdr.rcvif = ifp;
303 if (pdir == PFIL_IN)
304 ret = pfil_mbuf_in(ph, ctx->mp, ifp, ctx->inp);
305 else
306 ret = pfil_mbuf_out(ph, ctx->mp, ifp, ctx->inp);
307 if (ret != PFIL_PASS) {
308 *ctx->mp = NULL; /* consumed by filter */
309 return (EACCES);
310 }
311 (*ctx->mp)->m_pkthdr.rcvif = rcvif;
312 enc_bpftap(ifp, *ctx->mp, ctx->sav, hhook_type,
313 IPSEC_ENC_AFTER_PFIL, ctx->af);
314 return (0);
315 }
316
317 static void
enc_add_hhooks(struct enc_softc * sc)318 enc_add_hhooks(struct enc_softc *sc)
319 {
320 struct hookinfo hki;
321 int error __diagused;
322
323 hki.hook_func = enc_hhook;
324 hki.hook_helper = NULL;
325 hki.hook_udata = sc;
326 #ifdef INET
327 hki.hook_id = AF_INET;
328 hki.hook_type = HHOOK_TYPE_IPSEC_IN;
329 error = hhook_add_hook(V_ipsec_hhh_in[HHOOK_IPSEC_INET],
330 &hki, HHOOK_WAITOK);
331 MPASS(error == 0);
332 hki.hook_type = HHOOK_TYPE_IPSEC_OUT;
333 error = hhook_add_hook(V_ipsec_hhh_out[HHOOK_IPSEC_INET],
334 &hki, HHOOK_WAITOK);
335 MPASS(error == 0);
336 #endif
337 #ifdef INET6
338 hki.hook_id = AF_INET6;
339 hki.hook_type = HHOOK_TYPE_IPSEC_IN;
340 error = hhook_add_hook(V_ipsec_hhh_in[HHOOK_IPSEC_INET6],
341 &hki, HHOOK_WAITOK);
342 MPASS(error == 0);
343 hki.hook_type = HHOOK_TYPE_IPSEC_OUT;
344 error = hhook_add_hook(V_ipsec_hhh_out[HHOOK_IPSEC_INET6],
345 &hki, HHOOK_WAITOK);
346 MPASS(error == 0);
347 #endif
348 }
349
350 static void
enc_remove_hhooks(struct enc_softc * sc)351 enc_remove_hhooks(struct enc_softc *sc)
352 {
353 struct hookinfo hki;
354
355 hki.hook_func = enc_hhook;
356 hki.hook_helper = NULL;
357 hki.hook_udata = sc;
358 #ifdef INET
359 hki.hook_id = AF_INET;
360 hki.hook_type = HHOOK_TYPE_IPSEC_IN;
361 hhook_remove_hook(V_ipsec_hhh_in[HHOOK_IPSEC_INET], &hki);
362 hki.hook_type = HHOOK_TYPE_IPSEC_OUT;
363 hhook_remove_hook(V_ipsec_hhh_out[HHOOK_IPSEC_INET], &hki);
364 #endif
365 #ifdef INET6
366 hki.hook_id = AF_INET6;
367 hki.hook_type = HHOOK_TYPE_IPSEC_IN;
368 hhook_remove_hook(V_ipsec_hhh_in[HHOOK_IPSEC_INET6], &hki);
369 hki.hook_type = HHOOK_TYPE_IPSEC_OUT;
370 hhook_remove_hook(V_ipsec_hhh_out[HHOOK_IPSEC_INET6], &hki);
371 #endif
372 }
373
374 static void
vnet_enc_init(const void * unused __unused)375 vnet_enc_init(const void *unused __unused)
376 {
377 struct ifnet *ifp;
378
379 struct if_clone_addreq req = {
380 .create_f = enc_clone_create,
381 .destroy_f = enc_clone_destroy,
382 .flags = IFC_F_AUTOUNIT | IFC_F_LIMITUNIT,
383 .maxunit = 0,
384 };
385 V_enc_cloner = ifc_attach_cloner(encname, &req);
386 struct ifc_data ifd = { .unit = 0 };
387 ifc_create_ifp(encname, &ifd, &ifp);
388 V_enc_sc = ifp->if_softc;
389 }
390 VNET_SYSINIT(vnet_enc_init, SI_SUB_PSEUDO, SI_ORDER_ANY,
391 vnet_enc_init, NULL);
392
393 static void
vnet_enc_init_proto(void * unused __unused)394 vnet_enc_init_proto(void *unused __unused)
395 {
396 KASSERT(V_enc_sc != NULL, ("%s: V_enc_sc is %p\n", __func__, V_enc_sc));
397
398 enc_add_hhooks(V_enc_sc);
399 }
400 VNET_SYSINIT(vnet_enc_init_proto, SI_SUB_PROTO_IFATTACHDOMAIN, SI_ORDER_ANY,
401 vnet_enc_init_proto, NULL);
402
403 static void
vnet_enc_uninit(const void * unused __unused)404 vnet_enc_uninit(const void *unused __unused)
405 {
406 KASSERT(V_enc_sc != NULL, ("%s: V_enc_sc is %p\n", __func__, V_enc_sc));
407
408 ifc_detach_cloner(V_enc_cloner);
409 V_enc_sc = NULL;
410 }
411 VNET_SYSUNINIT(vnet_enc_uninit, SI_SUB_INIT_IF, SI_ORDER_ANY,
412 vnet_enc_uninit, NULL);
413
414 /*
415 * The hhook consumer needs to go before ip[6]_destroy are called on
416 * SI_ORDER_THIRD.
417 */
418 static void
vnet_enc_uninit_hhook(const void * unused __unused)419 vnet_enc_uninit_hhook(const void *unused __unused)
420 {
421 KASSERT(V_enc_sc != NULL, ("%s: V_enc_sc is %p\n", __func__, V_enc_sc));
422
423 enc_remove_hhooks(V_enc_sc);
424 }
425 VNET_SYSUNINIT(vnet_enc_uninit_hhook, SI_SUB_PROTO_DOMAIN, SI_ORDER_FOURTH,
426 vnet_enc_uninit_hhook, NULL);
427
428 static int
enc_modevent(module_t mod,int type,void * data)429 enc_modevent(module_t mod, int type, void *data)
430 {
431
432 switch (type) {
433 case MOD_LOAD:
434 case MOD_UNLOAD:
435 break;
436 default:
437 return (EOPNOTSUPP);
438 }
439 return (0);
440 }
441
442 static moduledata_t enc_mod = {
443 "if_enc",
444 enc_modevent,
445 0
446 };
447
448 DECLARE_MODULE(if_enc, enc_mod, SI_SUB_PSEUDO, SI_ORDER_ANY);
449 MODULE_VERSION(if_enc, 1);
450